From ed4441bc92c4d0856a65fd37417dfe8a075317c0 Mon Sep 17 00:00:00 2001
From: kingwil <5839248+kingwil@users.noreply.github.com>
Date: Wed, 14 Oct 2026 20:04:36 +0100
Subject: [PATCH 1/7] Add Defender XDR 3.2.1 workbook-only candidate package

Include three XDR workbooks and their connector prerequisite; preserve existing repository content. Candidate validation and installation remain incomplete.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Data/Solution_Microsoft Defender XDR.json |   452 +-
 .../Microsoft Defender XDR/Package/3.2.1.zip  |   Bin 0 -> 243596 bytes
 .../Package/createUiDefinition.json           |  6126 +-
 .../Package/mainTemplate.json                 | 74274 +++++++--------
 .../Package/testParameters.json               |    26 +-
 .../SolutionMetadata.json                     |    37 +-
 .../MicrosoftDefenderForEndPoint.json         |  3889 +
 .../MicrosoftDefenderForIdentity.json         |  5443 ++
 ...nderForOffice365detectionsandinsights.json | 77565 ++++++++++++++++
 9 files changed, 118705 insertions(+), 49107 deletions(-)
 create mode 100644 Solutions/Microsoft Defender XDR/Package/3.2.1.zip
 create mode 100644 Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForEndPoint.json
 create mode 100644 Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForIdentity.json
 create mode 100644 Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json

diff --git a/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json b/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json
index 1c8d54ffb68..418bfdf88ef 100644
--- a/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json	
+++ b/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json	
@@ -2,451 +2,25 @@
   "Name": "Microsoft Defender XDR",
   "Author": "Microsoft - support@microsoft.com",
   "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
-  "Description": "The [Microsoft Defender XDR](https://www.microsoft.com/security/business/threat-protection/microsoft-365-defender) solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.\n\nAdditional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on [GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender). This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)",
+  "Description": "Workbook-only authoring candidate for Microsoft Defender XDR: Defender for Endpoint, Defender for Identity, and Office 365 Detections & Insights. Includes the Microsoft Defender XDR connector prerequisite for panels using connected Sentinel SecurityAlert data. Detection rules, hunting queries, playbooks, and Sentinel workbook installation are excluded. Live installation and runtime qualification are not established.",
   "Data Connectors": [
     "Data Connectors/MicrosoftThreatProtection.json"
   ],
-  "Analytic Rules": [
-    "Analytic Rules/PossiblePhishingwithCSL&NetworkSession.yaml",
-    "Analytic Rules/SUNSPOTHashes.yaml",
-    "Analytic Rules/PotentialBuildProcessCompromiseMDE.yaml",
-    "Analytic Rules/SolarWinds_TEARDROP_Process-IOCs.yaml",
-    "Analytic Rules/SolarWinds_SUNBURST_Network-IOCs.yaml",
-    "Analytic Rules/SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs.yaml",
-    "Analytic Rules/AVdetectionsrelatedtoUkrainebasedthreats.yaml",
-    "Analytic Rules/AVTarrask.yaml",
-    "Analytic Rules/AVSpringShell.yaml",
-    "Analytic Rules/PossibleWebpBufferOverflow.yaml",
-    "Analytic Rules/Campaign/Jupyter-Solarmaker/DeimosComponentExecution.yaml",
-    "Analytic Rules/Campaign/Macaw Ransomware/ImminentRansomware.yaml",
-    "Analytic Rules/Campaign/Sysrv-botnet/MaliciousCMDExecutionByJava.yaml",
-    "Analytic Rules/Command and Control/C2-NamedPipe.yaml",
-    "Analytic Rules/Credential Access/DoppelPaymerProcDump.yaml",
-    "Analytic Rules/Credential Access/LSASSCredDumpProcdump.yaml",
-    "Analytic Rules/Defense Evasion/DoppelpaymerStopService.yaml",
-    "Analytic Rules/Defense Evasion/QakbotCampaignSelfDeletion.yaml",
-    "Analytic Rules/Defense Evasion/Regsvr32Rundll32ImageLoadsAbnormalExtension.yaml",
-    "Analytic Rules/Defense Evasion/Regsvr32Rundll32WithAnomalousParentProcess.yaml",
-    "Analytic Rules/Discovery/SuspiciousCommandInitiatedByWebServerProcess.yaml",
-    "Analytic Rules/Execution/BITSAdminActivity.yaml",
-    "Analytic Rules/Execution/OfficeAppsLaunchingWscript.yaml",
-    "Analytic Rules/Execution/PotentialKerberoastActivities.yaml",
-    "Analytic Rules/Exfiltration/FilesCopiedToUSBDrives.yaml",
-    "Analytic Rules/Exploits/MosaicLoader.yaml",
-    "Analytic Rules/Impact/AnomalousVoulmeOfFileDeletion.yaml",
-    "Analytic Rules/Lateral Movement/RemoteFileCreationWithPsExec.yaml",
-    "Analytic Rules/Lateral Movement/ServiceAccountsPerformingRemotePS.yaml",
-    "Analytic Rules/Persistence/AccountCreation.yaml",
-    "Analytic Rules/Persistence/LocalAdminGroupChanges.yaml",
-    "Analytic Rules/Persistence/RareProcessAsService.yaml",
-    "Analytic Rules/Ransomware/DEV-0270/DisableSecurityServiceViaRegistry.yaml",
-    "Analytic Rules/Ransomware/DataDeletionOnMulipleDrivesUsingCipherExe.yaml",
-    "Analytic Rules/Ransomware/LaZagneCredTheft.yaml",
-    "Analytic Rules/Ransomware/LogDeletionUsingWevtutil.yaml",
-    "Analytic Rules/Ransomware/MultiProcessKillWithTaskKill.yaml",
-    "Analytic Rules/Ransomware/PotentialCobaltStrikeRansomwareActivity.yaml",
-    "Analytic Rules/Ransomware/QakbotDiscoveryActivities.yaml",
-    "Analytic Rules/Ransomware/ShadowCopyDeletion.yaml"
-  ],
-  "Hunting Queries": [
-    "Hunting Queries/Appspot Phishing Abuse.yaml",
-    "Hunting Queries/Campaigns/Bazacall/PayloadDropUsingCertUtil.yaml",
-    "Hunting Queries/Campaigns/JudgementPandaExfilActivity.yaml",
-    "Hunting Queries/Campaigns/Jupyter-Solarmaker/DeimosComponentExecution.yaml",
-    "Hunting Queries/Campaigns/LemonDuck/LemonDuckRegistrationFunction.yaml",
-    "Hunting Queries/Campaigns/Log4j/DeviceWithLog4jAlerts.yaml",
-    "Hunting Queries/Campaigns/Log4j/Log4jVulnRelatedAlerts.yaml",
-    "Hunting Queries/Campaigns/Macaw Ransomware/ImminentRansomware.yaml",
-    "Hunting Queries/Campaigns/Macaw Ransomware/MaliciousUseOfMSBuildAsLoLBin.yaml",
-    "Hunting Queries/Campaigns/Qakbot/QakbotReconActivities.yaml",
-    "Hunting Queries/Campaigns/RobbinhoodDriver.yaml",
-    "Hunting Queries/Campaigns/Snip3MaliciousNetworkConnectivity.yaml",
-    "Hunting Queries/Campaigns/Sysrv-botnet/MaliciousCMDExecutionByJava.yaml",
-    "Hunting Queries/Check for spoofing attempts on the domain with Authentication failures.yaml",
-    "Hunting Queries/Command and Control/C2-NamedPipe.yaml",
-    "Hunting Queries/Command and Control/ReconWithRundll.yaml",
-    "Hunting Queries/Credential Access/DoppelPaymerProcdump.yaml",
-    "Hunting Queries/Credential Access/LaZagne.yaml",
-    "Hunting Queries/Credential Access/LSASSCredDumpProcdump.yaml",
-    "Hunting Queries/Defense Evasion/ClearSystemLogs.yaml",
-    "Hunting Queries/Defense Evasion/DoppelpaymerStopServices.yaml",
-    "Hunting Queries/Defense Evasion/QakbotCampaignSelfDeletion.yaml",
-    "Hunting Queries/Defense Evasion/Regsvr32Rundll32ImageLoadsAbnormalExtension.yaml",
-    "Hunting Queries/Defense Evasion/Regsvr32Rundll32WithAnomalousParentProcess.yaml",
-    "Hunting Queries/Delivered Bad Emails from Top bad IPv4 addresses.yaml",
-    "Hunting Queries/Discovery/SuspiciousCommandInitiatedByWebServerProcess.yaml",
-    "Hunting Queries/Discovery/User&GroupEnumWithNetCommand.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Attachment/ATP policy status check.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Attachment/JNLP attachment.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Attachment/Safe attachment detection.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/Authentication failures.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/CompAuth Failure Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/DKIM Failure Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/DMARC Failure Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/SPF Failure Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/Spoof attempts with auth failure.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof detections by Sender Domain.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof DMARC detections by Sender Domain.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof Intra-Org detections by SenderDomain.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Custom Detections/Message from Accepted Domain with DMARC TempError.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Custom Detections/Message with URL listed on OpenPhish delivered into Inbox.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Custom Detections/Potential OAuth phishing email delivered into Inbox.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Custom Detections/Potentially malicious SVG file delivered into Inbox.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Audit Email Preview-Download action.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Bad email percentage - Inbound emails.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Calculate MDO Efficacy.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Email sender IP address Geo location information.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Hunt for Admin email access.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Hunt for TABL changes.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Local time to UTC time conversion.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Mail item accessed.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Malicious email senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/MDO daily detection summary report.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/New TABL Items.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Top 10 Domains sending Malicious Emails (Malware+Phish+Spam).yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Malware).yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Phish).yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Spam).yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Top 10 Targeted Users (Malware+Phish+Spam).yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam).yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Total number of detections by MDO over time.yaml",
-    "Hunting Queries/Email and Collaboration Queries/General/Total number of detections by MDO.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Automated email notifications and suspicious sign-in activity.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/BEC - File sharing tactics - Dropbox.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/BEC - File sharing tactics - OneDrive or SharePoint.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Email bombing.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Emails containing links to IP addresses.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Files share contents and suspicious sign-in activity.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Good emails from senders with bad patterns.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for email bombing attacks.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for email conversation take over attempts.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for malicious attachments using external IOC source.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for malicious URLs using external IOC source.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Inbox rule change which forward-redirect email.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_CountOfRecipientsEmailaddressbySubject.YAML",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_Countofrecipientsemailaddressesbysubject.YAML",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_CountOfSendersEmailaddressbySubject.YAML",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_SummaryOfSenders.YAML",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_URLClickedinEmail.YAML",
-    "Hunting Queries/Email and Collaboration Queries/Hunting/Top outbound recipient domains sending inbound emails with threats.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Detections by detection methods.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Mail reply to new domain.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Mailflow by directionality.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Malicious emails detected per day.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Sender recipient contact establishment.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Spam Detections by Delivery Location - High.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Spam Detections by Delivery Location - Medium.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top 100 malicious email senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top 100 senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Zero day threats.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Email containing malware accessed on a unmanaged device.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Email containing malware sent by an internal sender.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Email malware detection report.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detection Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by AV.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by Safe Attachments.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detection Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Delivery Location.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Detection Technology Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Detection Technology.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware detections by Workload Locations.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware detections by Workload Type.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Top Domains sending Malware.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Top Email Malware Families.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Top Users receiving Malware.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Zero-day Malware Detections Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Communication from suspicious external users.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Communication to suspicious external users.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Expanding recipients into separate rows.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/External malicious Teams messages sent from internal senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for malicious messages using External Threat Intelligence.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Inbound Teams messages by sender domains.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious Teams messages by URL detection methods.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious Teams messages received from external senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Microsoft Teams chat initiated by a suspicious external user.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Number of unique accounts performing Teams message Admin submissions.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Number of unique accounts performing Teams message User  submissions.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Possible partner impersonation in external Team messages.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Possible Teams phishing activity.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Potentially malicious URL click in Teams.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Rare Domains in External Teams Messages.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Suspicious Teams Display Name.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin submission of Malware and Phish daily trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin submission of No Threats daily trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin-User Submissions Grading Verdicts.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams blocked URL clicks daily trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Malware ZAP .yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Message with URL listed on OpenPhish.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams message ZAPed with the same URL in Email.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams messages from a specific sender by ThreadType.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams messages with suspicious URL domains.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Phish ZAP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams post delivery events daily trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Spam ZAP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams URL clicks actions summarized by URLs clicked on.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams URL clicks through actions on Phish or Malware URLs summarized by URLs.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams User submissions daily trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams users clicking on suspicious URL domains.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 Attacked user by Phish messages.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 external senders sending Teams messages.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 External senders sending Teams phishing messsages.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 sender domains - Admin Teams message submissions FN.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 sender domains - Teams user submissions FN or FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders - Teams users submissions FN or FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders of  Admin Teams message submissions FN.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders of  Admin Teams message submissions FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 Users clicking on malicious URLs in Teams.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top accounts performing Teams admin submissions FN or FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top accounts performing Teams user submissions FN or FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top domains outbound sending Malicious Teams messages inbound.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top external malicious senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Malware.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Phish.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Spam.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top malicious URLs clicked by users in Teams.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Total number of MDO Teams protection detections daily.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/URL click on URLs in ZAP-d Teams messages.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Spam and Phish delivered to Inbox due to Admin Overrides.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Spam and Phish delivered to Inbox due to User Overrides.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Top policies performing admin overrides.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Top policies performing user overrides.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with Admin Overrides - Allow.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with Admin Overrides - Block.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with User Overrides - Allow.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with User Overrides - Block.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detection Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location - High.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location - Medium.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Detection Technology Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Detection Technology.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Possible device code phishing attempts.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Top Domains sending Phish.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Top Users receiving Phish.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Zero-day Phish Detections Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Campaign with randomly named attachments.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Campaign with suspicious keywords.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Custom detection-Emails with QR from non-prevalent senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Emails delivered having URLs from QR codes.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Emails with QR codes and suspicious keywords in subject.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Emails with QR codes from non-prevalent sender.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Hunting for sender patterns.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Hunting for user signals-clusters.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Inbound emails with QR code URLs.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Personalized campaigns based on the first few keywords.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Personalized campaigns based on the last few keywords.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Risky sign-in attempt from a non-managed device.yaml",
-    "Hunting Queries/Email and Collaboration Queries/QR code/Suspicious sign-in attempts from QR code phishing campaigns.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Group quarantine release.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/High Confidence Phish Released.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Phish reason trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Phish reason.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Release Email Details.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine release trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine releases by Detection types.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Spam reason trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Spam reason.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Remediation/AIR investigation actions insight.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Remediation/Email remediation action list.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Bulk Detection Top10 Domains.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Delivery Location.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection IP and Geo Position.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Mails with BCL.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Tech.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top10 Domains.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top10 Users.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top15 Domains Details.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top15 Users Details.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detections by Detection technology.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Display Name - Spoof and Impersonation.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections by Detection Technology Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections by Detection Technology.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Referral phish emails.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof and impersonation detections by sender IP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof and impersonation phish detections.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections by Detection Technology Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections by Detection Technology.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Top Domains with BEC Threats inbound.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/User not covered under display name impersonation.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submission Trend - FN.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submission Trend - FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Method - Phish FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Method - Spam FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Type.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Grading Verdict - FN-FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission State - FN.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission State - FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission Type - FN.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission Type - FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing admin submissions - FN.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing admin submissions - FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing user submissions.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Top Detection Overrides - Admin Submissions.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Top Sender Domains - Admin Submissions FN.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Top Sender Domains - Admin Submissions FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Total Submissions by Submission Status.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Total Submissions by Submission Type.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User reported submissions.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submission Accuracy versus Admin Verdicts.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top detection overrides by Admins.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top detection overrides by Users.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders domains.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org P2 senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org Subjects.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Admin review status.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Grading Verdict - FN-FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Submission Type.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions from Junk Folder.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions Trend - FN.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Attacked more than x times average.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Malicious mails by sender IPs.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top 10 percent of most attacked users.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top 10 URL domains attacking organization.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top external malicious senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top targeted users.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/End user malicious clicks.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/URL click count by click action.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/URL click on ZAP Email.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/URL clicks actions by URL.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/URLClick details based on malicious URL click alert.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/User clicked through events.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/User clicks on malicious inbound emails.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/User clicks on phishing URLs in emails.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/Malicious Clicks allowed (click-through).yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/Malicious Emails with QR code Urls.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/Phishing Email Url Redirector.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/SafeLinks URL detections.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Malware).yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Phish).yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Spam).yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/URL Click attempts by threat type.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/URL Clicks by Action.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/URLs by location.yaml",
-    "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by Admin.yaml",
-    "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by Location.yaml",
-    "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by ZAP type.yaml",
-    "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events over time.yaml",
-    "Hunting Queries/EmailDelivered-ToInbox.yaml",
-    "Hunting Queries/Execution/AnomalousPayloadDeliveredWithISOFile.yaml",
-    "Hunting Queries/Execution/BitsadminActivity.yaml",
-    "Hunting Queries/Execution/MaliciousUseOfMSIExec.yaml",
-    "Hunting Queries/Execution/MaliciousUseOfMsiExecMimikatz.yaml",
-    "Hunting Queries/Execution/OfficeAppsLaunchingWscript.yaml",
-    "Hunting Queries/Execution/PotentialKerberoastActivities.yaml",
-    "Hunting Queries/Execution/PowerShellDownloads.yaml",
-    "Hunting Queries/Execution/SuspiciousAppExeutedByWebserver.yaml",
-    "Hunting Queries/Execution/SuspiciousMshtaUsage.yaml",
-    "Hunting Queries/Exfiltration/FilesCopiedToUSBDrives.yaml",
-    "Hunting Queries/Exploits/CVE-2022-26134-Confluence.yaml",
-    "Hunting Queries/Exploits/MosaicLoader.yaml",
-    "Hunting Queries/Exploits/Print Spooler RCE/SpoolsvSpawningRundll32.yaml",
-    "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousDLLInSpoolFolder.yaml",
-    "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousFilesInSpoolFolder.yaml",
-    "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousSpoolsvChildProcess.yaml",
-    "Hunting Queries/Exploits/PrintNightmareUsageDetection-CVE-2021-1675.yaml",
-    "Hunting Queries/Exploits/SuspiciousFileCreationByPrintSpoolerService.yaml",
-    "Hunting Queries/General Queries/MITRESuspiciousEvents.yaml",
-    "Hunting Queries/Impact/AnomalousVoulmeOfFileDeletion.yaml",
-    "Hunting Queries/Initial Access/DetectMailSniper.yaml",
-    "Hunting Queries/Lateral Movement/AccountBruteForce.yaml",
-    "Hunting Queries/Lateral Movement/RemoteFileCreationWithPsExec.yaml",
-    "Hunting Queries/Lateral Movement/ServiceAccountsPerformingRemotePS.yaml",
-    "Hunting Queries/Persistence/AccountCreation.yaml",
-    "Hunting Queries/Persistence/LocalAdminGroupChanges.yaml",
-    "Hunting Queries/Persistence/RareProcessAsService.yaml",
-    "Hunting Queries/Persistence/ScheduledTaskCreation.yaml",
-    "Hunting Queries/Privilege Escalation/SAMNameChange_CVE-2021-42278.yaml",
-    "Hunting Queries/Ransomware/DataDeletionOnMulipleDrivesUsingCipherExe.yaml",
-    "Hunting Queries/Ransomware/DetectMultipleSignsOfRamsomwareActivity.yaml",
-    "Hunting Queries/Ransomware/DEV-0270/DisableSecurityServiceViaRegistry.yaml",
-    "Hunting Queries/Ransomware/DEV-0270/DomainDiscoveryWMICwithDLLHostExe.yaml",
-    "Hunting Queries/Ransomware/DEV-0270/MDEExclusionUsingPowerShell.yaml",
-    "Hunting Queries/Ransomware/IcedIdSuspiciousImageLoad.yaml",
-    "Hunting Queries/Ransomware/LaZagneCredTheft.yaml",
-    "Hunting Queries/Ransomware/LogDeletionUsingWevtutil.yaml",
-    "Hunting Queries/Ransomware/MultiProcessKillWithTaskKill.yaml",
-    "Hunting Queries/Ransomware/PotentialCobaltStrikeRansomwareActivity.yaml",
-    "Hunting Queries/Ransomware/QakbotDiscoveryActivities.yaml",
-    "Hunting Queries/Ransomware/ShadowCopyDeletion.yaml",
-    "Hunting Queries/Ransomware/TurningOffServicesWithSCCommad.yaml",
-    "Hunting Queries/TVM/Detect_CISA_Alert_AA22-117A2021_Top_Routinely_Exploited_Vulnerabilities.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Punycode chars lookalike domains.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for RMM tool execution following Teams messages.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for alerts correlated with Teams messages.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Identify acting user for reported phish.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Authentication/Inbound Sender Domains Failing Email Authentication.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Automatic External Email Forwarding by Type.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/First-Contact External Email Senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/New External Sender Domains Carrying Threats.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top External Domains Receiving Auto-forwarded Email.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top External Recipients Receiving Auto-forwarded Email.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top Users Auto-forwarding Email Externally.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections Over Time.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections by Location.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections by Workload.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by MDO Detonation.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by SharePoint Antivirus.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/File Scanning Coverage.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detection IP and Geo Position.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Sender Country.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Threat Classification.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Top Attacked Users by Malware Threat Classification.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Malware/Top File Owners Holding Malware.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/First-Contact External Teams Senders.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious files shared in Microsoft Teams.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Microsoft Teams External versus Internal Thread Exposure.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams File Protection Summary.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/SecOps Mailbox Override Count.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/SecOps Mailbox Overrides by Threat Type.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Top Recipients Receiving Threats Delivered by Override.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Overrides/Top Sender Domains Delivering Threats via Override.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detection IP and Geo Position.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Sender Country.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Threat Classification.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Phishing Detected by LLM Content Analysis.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Phish/Top Attacked Users by Phish Threat Classification.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Release Percentage.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Investigation Outcomes by Day.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Delivery to Action Latency.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Efficiency Over Time.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Manual versus Automatic Approval.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detections by Sender Country.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation and Spoof Detections by Sender Country.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Top Recipients Targeted by Impersonation or BEC.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing user submissions - FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Inbound Subjects FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org P2 senders FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) sender domains FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions Trend - FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Detection Method - Phish FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Detection Method - Spam FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Submission State - FP.yaml",
-    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Largest Malicious Email Campaigns by Cluster.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/Blocked URL Clicks by Workload.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/Top 20 Malicious URLs by Clicks.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/Top Clicks on Malicious URLs.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/URL Click-Through by Workload.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL Click/URL Threat Protection Summary.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/Malware URL Detections Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/Phishing URL Detections Trend.yaml",
-    "Hunting Queries/Email and Collaboration Queries/URL/QR Code URL Detections Trend.yaml"
-  ],
-  "Workbooks": [
-    "Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json",
-    "Workbooks/MicrosoftDefenderForEndPoint.json",
-    "Workbooks/MicrosoftDefenderForIdentity.json"
-  ],
+  "Analytic Rules": [],
+  "Hunting Queries": [],
+  "Workbooks": [],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft Defender XDR",
-  "Version": "3.0.18",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [
     "MicrosoftThreatProtection"
-  ]
+  ],
+  "XDR Workbooks": [
+    "XDR Workbooks/MicrosoftDefenderForEndPoint.json",
+    "XDR Workbooks/MicrosoftDefenderForIdentity.json",
+    "XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json"
+  ],
+  "Playbooks": [],
+  "XDR Detections": [],
+  "Version": "3.2.1"
 }
diff --git a/Solutions/Microsoft Defender XDR/Package/3.2.1.zip b/Solutions/Microsoft Defender XDR/Package/3.2.1.zip
new file mode 100644
index 0000000000000000000000000000000000000000..0a6451bf26c6489089275d34b3c568200a287935
GIT binary patch
literal 243596
zcmcHALy#yyvoH9zZQHhO+qP}nw(UM`yZf|l+qT{P&Nnl0V{XLEi@SLdwaQx7BBOr!
zPX%dU5EK9a00;oZbU9se39uDGZ~%Z=Q~&_<e^p~AQ$rV1RZ9_5GfO*57fX9PIxA;;
zyB3XKJK{FPpWguQ@c!0H662Oe+!ERtJ*ZJGlJJkDzo#ck8e)R9=I)rz<Ge}MnjIKt
zO;7V5B*PBrRl1TZoU{+|hKYmk?~W&jem?I&1Rp)J&@`GZV2b-Xrn6>EW~7vvMx1FC
zIs<;Suw<2Vo4nlIa&k$FmZo=ldsc3S37lV_*_>uVkmSu$J1Yy3_!CFuRm-<UYnxOV
z2S~8%Uerp(H8VO+H?FTN%>%C%)pJoH;3FH?QJ88)!p6nSZxYe~ihoqe9;Sf=NUpr^
znVEUGf@3739ow2r)Jl35{Su31V=Hv5-|35{`m>&vized?t4PpmE7Ds;ldX;^gj2Bb
zB_G{C;8KyHj;l>p3Nv*tbT-Xy^9|`6Uf+p=Quk^-S|Wa)M4#&;3Ir0-Yd^n_g=m-N
z=i4^+*XI#^=o2+Tf-$iiuyg_wEGeI*Dsa*=EQ1MBTxF!R3Vo|gWdU;m&p&4Seqh!4
zl7nU2I|jtqGaK6u5$usK7Xi6~F^YUvshXN<d-HSgW*LQt=Y8C~z7D^vRyOX<l9J@d
zC<*Fnp;;hEwFi;*Pvp*1fedZ8U&FQ=N}8EBwcvNO>9--|3xp0c6!`q466+Coq6;^s
z4LY*hL%O}{rni+YyDHV3V5{9i*-BVUqo8MSN_Pa%sX_$yN8gv%PtYNI)VddhIy~CH
z!juW@aDkO^dMB9@iF|%W=?&uGl<_gY0Cy;)GwLC`6)USbwe&l`!w8q93@@4kCkp!E
zTk4BkTZ~eeD{A745{2Ok)9&CFHz3;h(k*ZtPBa?tL1bv>M--MwatFh)Vhcj08d*!n
z*%Vzi)NDV5v@%x*V1W4E7(9T|5AfPvP{D=Cq(b0XlZlYePf8Zx=D1o@2GGWQGvne;
zrWo5H9JM<s$Qf~P6}f~Ezb{Tn{GB7GC@3lqY$~l+Crupuz#V%*!PaE=(ASn13V-kR
z;hJ>HlgqMOrbkyM{a(+XNdv|TmRlt6y^C)_?LT&8^?^QgpSz%9XR~}aTkbW@JM5n;
zgJr<hrYjO!jVL!XQLAS$43DA+90fK7LhA+q_oZ{Am!!><>TH(KySKkQuF7RDz;L+F
zspc7h?q0xR3Hv!eUVdWtLXHYZ!cc|c;6j3@&K7o=DxD3Y##@jpL+Ma~Z$Ief&ydt;
zNW&5zLoN#o^s#l-xqp~1&g<|)O1sc<1DRd*72n#v$tiYVTHvt0&&xC<^+Y*4Cm&yR
zDSYd;Iv<F#8(r$<W@J6}BB5(?=AAsGtUYNdqRz55Y{^Js%`|G+F^kKFaR`P%gx-(z
zS~vmnLFy@d#j(!hS`PA*6JD~nkU^Q#DxB0~z$J0yk)j-s@a65msVbn0Tt5YrEQ-M9
zSL^D+$6}~XpzIl!sZ8y*`f?5>i9C2Nw!=>K3i=wQWVEdwFP`3>JiNY6&+o@AoUpH}
z?0hPss?5>ugwjjZ#<$L_YSpa>XxEWQBX7lpNj0NF)4C09Z+(0No@@IFQ5=e?<&=F$
zOF$%DUz3};w}nH#QxocE7z%T?{T&m2|C+=$V{fNaW3dO|u&)~PVCe<SlXQ^ZV`z0i
zc7G(D5H~<@yL~9t%{6;R?j>UkZ0LQ-k}<}F4lZ0)W;AfvDYAUDTR8Pb%%IIvfFV7W
z8)48Ec_4bqzufZ0ktGv0YTG~u`?QHaF}GSu`WB*Dv=w@5gfEk4i%WZA)6BJOMU!73
zRp@B<*)pd15nWH!U#sET%rqo<;abRHoO3rFNnYurWbF8s;=9SY{O~OTjm9i5c)DEk
zP`cF#7P}74axooP#!)L^KxBTD=>_%cAT(m1kfV%7!BLT~7BunlfMP)l+5@5Evcpb~
z1FzRF2|}YnR~N}15v)7??KNT;drK;H-|6ps$hw(#p`qbqc;i##J<%AQ_X}RYRq0b@
z?*z%G!)_ryK){x=B{Us@IAU4<8YFU{vV!F71cI#&q2Aa4Lpx~7WEzc-EpQUaG2Bx7
zu@`d0XvcTgb*R5;nVWd-92i$4W#hNYXXhKMlQsCXzej7pgP<in^q|eTr2;4QzqZBq
za$|CR+slK`u=a7#m(0D<)4L9Tof)%ON{nS_2RepyAG`@12yD{_`kiC#LE_EyxyV%0
zE|-?4?=dPgsJZN&=og-V{{u3^9DY&>?kBTjN>q0)S;SFbBrPeNW_CaKe%$%GPEZGG
zPE{I?!7>{<Z4UUMz#y^#U_EOKIG7|?s^CuE=PEfq)*H+B*B#HXCOHKyzwrd?hDW<Q
zZ6o5xow-&yJ0<t_X?TeLtFsQZN$ov_MLzh%b~rvfspmG$9@bH}>kl4MF|2CN3!cop
zELn`};cp^7<M8M&xOh~e-YZ+q9SM2H?H1_(Gl6m*LMR592?dr2nqLe!5%z`@lXvxV
zXubi6%fe&Hy+t-;EZO*vu=f&N*>aQ1i+spxP~G?8Bzio({ujE!f9tyROf?;{b-)1A
zUc>;1|GKWNp{1RQsjY*}zux<Q_1mkSORr6iMv9MLpIuLI8nczP3tFk}i-YqgJoy}%
z&zQyWsN9=%?ui*7Nr{6DqID3<(e3l+Yj+NN2RvK;@pq^_RU**~v&mMT-4a_Q0BBW#
z!aoY>yT7-;(1iQ)OF2oHXmSY*u)_IyE?r-e=3%-#gv<wFxL?{R332Ds2ky;P5)TR~
zEQ(28X!p3ca2vXbnYVihE<d8Yuc32h_zb-4BzAAikQLV*ceowI{l5pV%t%Ji;Q;-&
zcL0Qd;`>X`1?SqEFgzEr!X!jk@4e_D{<);H00evxpHnab1#_1R&P8)CIw&Img$?Kh
zHr32bWVNC|PqR(%Ku^EH!3T!`vl0?OS->OrGBClW@d!u*-1&dgEil$@NC1J%jJwc>
zazm8&LB`jOqhlP8LimlzjlTInL%b9XlKQ~)j_}*K#?|>wN45US@Sw2*Z^j!U`8^1s
zC>pgSB8HBU4iTY2@g5mVA;Os%Vdxbn%prWAihd#9J6(vzk^UTo9_&WE5yR0eHbp$=
z<A(SVj=5P%)PoimIY`a<?|AjIJ~v1XflU31v?*`q5M>iZgS@~t%yHbARlg5YN^vt>
z4b0+yp~qQ-gbWjA@4MqAQWsw)pLdYK#mDm{Kxz}=9YABun=F$w7fPTYlGalhK=ywj
z86c9vG48h&yR}-y#V5Ur*Q}g=bfA}Yo0u(E)y${(OZJBA@Em&Y4`df8qjS3#+A6tl
zlLC%k$4eiCwMyd<(32V-smmS56w<BB-w_Tz)=EoSdgLj~jxoAXXu2AGU9P*y^~xi<
z(P~7y1?V}x1pCFnpd>`f4hASj5N)<Zz~gSubqMdY!vKCkkGJDKL3O3s_B-7H-;RXE
z1NlSOV-^K`VXXreLVVsOX^i!QZOW`UuCZ@Y5UerPdrkwy_^>U&LS8jYugaFgEpiOi
z@vM@XjbR-9v49J<(4`q%2^(QB{PB&F!2w}wNC2!eY#7q6h!wII8lZ%ntHG5sRwBta
zPG)zEz_kyGzy@P0JmVl+;<s593bkyV5BCs8!)sF98(+?q*NTpqynn{VSzB|E$g4@l
zY{hM@Ov9trUvSG`P>hRT8!T3vs1BtcpYk7I77L3SG%NJI(NN)*5|`5^ft{iC7=<&y
zs+01=i5|~4T2PTGFL-gG{<%6Je~)-SH?e<kj=ECM<8CECP1DJkUuGfT@WJ;WJPlY!
zKk+)^PxMax4NEPz=myI2x0k&AYNO6l9Y}-`><t?Ny&$=~-Qtp)33I-DqX?~koFUJt
zGC18TeKEmWu$wqOSHwP^jd&VXtXdZ9P^62*1a<RBhf@rI3LBUGWA$)#L^-N}Yn8T7
zf_P2mYcznB{%CGFe6=CIO`6PYwfc-ktIT61Ui)n=@;2|j1q0}bf}%CtB`a4t2PHGi
zbou$WiHKQOiLslomkd<kVY9qO8sJ^=bBrl|jXpwtFG-#Nueg!>QftrICq)eTbhnDg
zp6Q(vq;xkw{|U>vY-Yn*&g5nIoUWPHCYVzUOP+4@OW9J6Looj>2VH);OuHi+=d&5R
zn0g(9#r@1^cjn$zR7s_lD$-BD&c-R*8VYHBLAIm*-buT;A{QcG%3X=d0G-=uJ-pYM
zxw-xne)c)ZHDcPD$M8_4CM+lBn=?BT--8cQh}(ZFeVp}J{3#~}d6GU7&vS4*3d)={
zy|n(CteML16))xLNjQ4qrQFLcK^qMx5R~;T{$MhQhV`}9q>7Xu)CWcV$1Hp-O56x8
zAXJwsI!UWjdXWyhKKejYkLjh8n-h0$!wqw`7sk;d8-G?hOT{+!>ti3mFXp)A!3_fP
zB?u)G{a1?ch@x4zJTQa@-ou20EjOu1v7*S)F28TMzvXzFZu6E+6l12U0hSE~J^TgM
z@h0Iq%mgT^Z&}PwK%~s>4G&h7m|!g@=s*aFzn)T1W~B^dehjYPBuH2RUQnkrqCM?)
z-EK{c%_7UqV^vJX*P;or;g-AMX0&C6($OdCrW-;NM9e_HkI)9-HEeD!Z!cjew|Fia
zu%Y2_D{y__Rp9m+;rXjlc3%`?gn&$7ab^s+165)#VYBvJ1g((V;wZ}Wg^2;TJC3}$
zWZaWykyLgkcC=M8VPmln5&eEXe||RcFbM#=)i~V!%yt4NJ?3fRo(MYkgD>>G=N^dV
z5h!DF4H|&6AXaIBRx@8p#b=V4_zi@;510JQ^S~7f%h28Da_z=-_4dd8t<JVb1w}N8
z<a)Nv(A><gp(Z_2Xyi?yGnr<#MBk|QYuF{1o@{ujSvxmsnH#d6|2sY+K&^XBJUM?s
zcKl;j0%J`^B|y~wICO2_TuVR(D6RA1wy_s36JbVVMmM=ey|bhxkP=Yf7GqUXlleA6
z?51t4{)x{l2msmZ9VymHTk-mwl2csBD+k>_YIN$GaDR!g{{q9HCu$KqFl&0pE&j1d
z9{r)xHCQ)UV_a^mc{_0q4|3hE(%KVBNJO_7Ccx#f0OX?sO!Naq?-+AT!r~h98i_4b
z5BSkWW{BCzI6LI^9c(n{lqfr{c-ODX8*+qs2)nx>_e1QInTHS^uk}K^)7XCe659Tt
zqb2xDL<j*jtF`L=<nu2xWNAxrAZBh@zb<h~572(_I@fy2tIhaOmrV=kBi76VX|nk(
zKbRb8r)KaX!_WyzT;cKcjyDSrah$I(Qp_zTTyn9$C=J>6g__qwoU6^;%@o`kVR!!6
z!4~@GPt=;xx16s(J$Y)b<rR((tazVwQkk=H&w?DPGPQS(CID3Ms8fdTzbCE(;wA}<
zT}`S&+NMXu*)KA}9JV{4PLG0bU|VLp`6HL#CVHik3j3|aSU#?jv6nc8t4j8HEFqER
zN)*L%*|N~a5zXJ@wQF-_LR-g5ABU*nMPe!p8^Ha0_wrNWFK3($((neiWrKKBTArBg
z{|q~C!8RE9jV*|t5r)2VBs`@$C(SabA76Kc`OXb^O;4g`-P?xm@k?YD;RH~e4o&<W
za5uz#qg_+#k%zwjg1f-U>2%xgI=a(4n32r<g1Z!?@hcJF3nN`nuy@5>FG_2@TS%+;
zjE8nK>XmnrGWlKVsW-UoOc8DMk_X&Xad}Js7a#aE)i~SRQHpnETF(f0T|X!t!{`Nn
zjnjJ0FtfHvCVHeC7;d%Suz&2iU7<bbd^#%Ed6lV+^oH>9HEPl(AtP*$D}BnT%RPD7
z1Sp852==!`Ru>*8YJhvi#~a=Jk;1sj2HA&qF?(uM_`JKv7FUS9Y4!TFn)!44gW28)
zcx!fjb{%9@T+sONAnyRMHgProONrKj-#kYdekI?77}uEpRKGsFHa;-SY`JHo-z>T>
zvBvE`weA1Z$o9U61m{V*`H-@*(q56FP4z^vBY|VDS3bkyb80+rVOW@0Z;x|~7aup0
zYgu(~kE^50u3E@<mxy}PIVkSKw9(<KFg9Od(M1nGxhO2GdUxA0(=(=4Gk>JgUVVoJ
zXOQ|J;jl2DUQxjxZ}PDB3h#CMd-siII9*^-SX%CGH>aX&i>+n43pM@3AL&}E>G^al
z*k29s{QK;gqZp?#76@`0na(^n2@52}@`cuTh9ZFr<1261hW8$aOTe#-?HH;2QZpp+
z!D(imERSL+WN6{EwWlzYc$MA-ByFr1{be;Lvt@<S4;eW+sfE=S1=cxIx``0zHFK#!
z|B$8V31~2mN{zSDWlLm1T)&zjr~#;E4ThPwY650(D9Slo%u&<d@%D~g5@=_In%62@
zutx)jaZC%1@&1Z2)+%cR51#x^IiB&XfaI6czl|ofq%~JYtmw<w-gi{HBh@Kxpz5hT
zRp}PL^Dz>)n?yoFaYj2ys<aL;B?0~@jxvHwmh}eTW|`_t!0S#qC_x?wA!T?<T+4!M
zq^^?cHid#IH(o6?1Cl}xHZmq5wkAQEDpF`r15e;V0WNDQrNOIarJG!<(56Dl=H(qV
zaDG;#valsGP?1DqMH-Px8o5FiIb5Yk!?-31IYSoSH9$ogph_B$LKfT{>Aw&C8mHqt
z7b0y{C#;#FL)xyKIxj=o{LwV99mrZnnqiS*ah72CcOKu6rj|(3G+B^q5aD)c0;g_}
zN0&DLvSsV24m}YP%D4(;=q{G9?N1WUPxg{{tv@SONFFt=Lh881W^aJdekNp?u1ZwM
zcQ*<Rr0N21auiBEicpC{pX4}b<F+W~4mI&f9Y%_nFCljsqKpuJ90V5AXDK^*rVRUu
zs#kMWnJS`uqVqOfTv-*9ys&T?9ebvA0^BG+4gO))x|nYXpNFlQsUwRrq%THa$vO0j
zegrH+R?F3wMH$c&!>{HV?W73)j-k^yMX8P@T01-oJbBc`BCS`S2c({<WP&p2>;6^G
zQO!;N)$@9-;}|8=`|`f*+4ZS))%*B7$=&rai|xL9UHJ5S=A?UW+?BrlSU%Ob6zyx<
zd7M7gIwkG1-?^VQS33mlGvB$Lq)CKTW>@EKUoElHOZ#IUx-^x)`qEb?*VB#CoT^M)
zmuBSIvNSQNOl6-Y)!_(rOj?<|S|;b~)>bOAaj7!)nGf`ySi-k+nlc(suzX)E;rIoi
zgv}q7G7?XmdT%Ug_@!{V!B<YQbE`5GPXu~jEXmuwN*RuC<;)j`G7wMXdUq&+`K2&v
zldlZGk0STNQF?oNLYDsVr}q_wr^(asrNr;eOEGd2eq}N=msSm4A5EZD=<fQ0u)(r>
zQd4zxC}KsdWnbt0ZwCG#CiLaU&hNfA7FZtl`#w263Hh%3Vc(p0xPg>{zz9h|(J%r(
z;|tDcSIage(^y9OeJP<Ejt9_fGDdsyZPyPx@vHZ5`0r!iFaJ}ZV%;2oZ~Qz9!C`ta
z3x<tR_~MvBA=*^!&@XE8yX#;;!VSz~0?2j<982`{hr6g${o8HSf4*Yd@FCLxWun~7
z)+ApD{DN2Wuex8tfK$|F2)X;*CJ9JycdR#47VMA@5@temy0<GWl(7)Fko@(12*1d^
z0R}CGo2D2*BpWECb8U%z5r^wUR@{^seIETS`<|;sr(Es|`d$~H42_YxldTRAC{Pnr
zjK7apgOZ-PXKtRh7JB_$>2M!0sa<BS^}jLZKl%!dliX)KwbIiRI*R>Vu;GDT>wxd9
zjg%?PVe%gsbCE<7W=V~6ECS^jH&|c#+?XsB5jaAd7FdFpkRPewa{yNNxCK!UnI*-5
z!2zd`e(Q9C90U<Qri=AlX9K;2&bPYIpm&j&f_-9Z`(EY?i_bzL77_1yElggd+R$%Q
z6Git<T{3pXC5Q!-gbuxtS+MFY6pS{hCZ=&A_;e6(I(in^*m@`@6-fj^v@`Y<>j~#Z
zZ9GjjZ!Y|1*;bkh0j4(1Tp#>^M!kl??Y|?svNN51ZRW@#z|7%k0K0A+(NPqVPT(re
zRT+wbCGziG^y6J{J()2eF4o%nPsb8xmp`kC0c9X=${(-ru!FT#&O#_fv)QhkA@ck+
zcjpJ|@Rdjr)@deENCIR72odnFG5opHzN<0xuUT8ytWzY-rAwmL<!2fq3ezqJO*H$n
zuFOd;TdOFz(Z-7dMRF*zI23<K<G@em8b8|0$37m;9SEO#_f$#7muRIC!@mXPm%JYo
za4e$etU6i#Msd}D@OI1JA-Qrap<2^mwUbA7n#2tUvfM;|@3hCG8pS;Kc7Sz*E>{^5
z$6g17-FE2sg$a*9p-3u<NTQRLjs+o?n){s|wR*g8)LlXvEa!O$uA8-VW43N5WxueL
zfks9@bA<fqNUey}mWmDdBbS?sGD)Hjb*&{M4!U`zRHJyRWh@Do{jN$jz($f*2^T?y
zTwT%gGnar;4NprXZ4ApU$@;h#se6KQLFPeE(p#w#X`VMMOJ9qLfJStSlE(gi0Uk22
zq#t}9DtnE)NQaJ2%gQUKvFR$Q;3^SF9yR!?((sv2u~-XTj_<vYX^1Y5;et!n$dnk<
zSF9_V6z;=%gf^@Cl{nK^aoU@~Z`{Bg870}5QiPV@P^5#6>GB=w_5w3=nlu!${vgN8
zE49#C`c+&{_{UfH;VKreIi?5Ivnio^jmZExwGu^)Z?p`7&hEB^aT8MJ`MrvWl2`G9
zR$fjs`!%r&aKnRV1Z{q}aGqI2cf=U6>JKU0C$B776xsP;QgFM>gmlIzHoeES)~%pB
z-8BY%+ysvgCs80SP}x@MX}TO+bi&jM)f}p^79DOYWPu~~8VSH<G`i^@-<_m@xLs$f
z7O`52C}Q`cJhKb8vqBF};^>eyx3eHCEk3KO#1Ow2)~`9?TRVxrGE)9x<#cX06#Ms`
zVtb;=mJtJ#pQRIMiBe&>0glaQOls+uY;8P353C|YO08+M>}8t{%ALn)>->JMJLKe(
zo)Tuule9P4xx$ms$F!N^hR9e^L8^ln(GPP9qP7*<L}}Fx97~S)aGU!EJbGYrWyn+t
zFfs4=_1uIlyhchEEeXS~aI9khghU5Gf3*dwx75LqzG!Y=#E}{3B_XnlgV1MO3x){E
zG^)mC0X%6F-{r5{qnTB(W$MOJR=>XP4EgEd@m@ZyZUay2Ea9O8%BbL>{}#Od#jqGN
za)Ssgg2&H*;Fa_?z!{5T@!9LCuy_z&B-Dk32M?lyZw3b|+`WCp3RYMx>8`imKg6K3
z(HCWTG8=#l!r{-B!hVTisJdFkf^_i>Yj@e11hgTGk0X^$f660CYS=<%jR_}GYao4T
z3AED`wyc2vcqNPfk-+Jzq@a>^g|+<vq*Dhr8a~?Te2SpG5emv3+Dl#c;Zsd1wd?K_
z*bJ!xHuL>@;>L2^_aezDNWA0U3+ss$3krs9Kat7*p2q_vM*r5c_)cz{<M12;H86?|
zK~8(Vh+p6W1^v55adqQ#v0Ws_BE19@(4aJIqEYGBVG|C`(tTK|?7QiBMy6#`c6Tk5
zzMTaNRPjZt_|xYoe`nut_{;79`8%Q&aWDTR{lNZ7Z-4)C#oB3vrgTysy7ujJ@aOqD
zsmAIkHdA=;eAb{o!WX|cw~G)`2guzovKS~lm<d2G*@J`LN%-zNV)tP-&v3Kj5a0XI
zqixJt5p2AzFBxGTAsi(yU(Zi~qwxv>F|Q^z{;iGs2`yWBll1I15dHn$_z*6)%gw@g
zZNxF7ztVD`E4~-oKL;?#kAwpPHfV787BkLV@3a@i7%f+84Zdej+YkqjkE0bZd=J>r
zt5=q$e#WQ!3!4l23j5*u>9l)u>>o3|OK0ni(h6Yqnc!gqh<x;8L=V%?6z8!DCd6_S
zoo$B74r1gGQ7~t~H6(!Im+aQ^;EyAH2$<<f@PWY%kQqd4jCBzLO4R@l+m~DLeV!xf
ziXAq5qxycj9fO{w8Z&>OWSNJRui9Z4xcG(r;Lo~Yb^@;1I~O-G8aXq0cg>i|<$l&b
zHp$u!x=~$Cbnu;z$m2|2aAX^JG2?@~braiuU~L)Jrm1k)Oh9I1Z-Qx?D_}cU<S;lG
zcCE%%+faVOH8hkUX!zXskt*kuS*MASh^lyjp|N^aL}yeaaV&jw8etgMkXN>lXG`LQ
zXU1ii3;Sf~85aMbv}|8e<H$gCF-V~67yF@)L+0QBwDee*nBZG)O~Q|%qT8vzDG5oP
z6g61itG0wC34vu*AZ;VG<WWTfZzqW=D~1iJ)HB|s?^s?T!g3yJ#|FuMZc)?1462Zr
zG9bXZav-!g%A>~e;YEqyRwNNsg%w(P%SFE}>BeHja&J?!Muft`T4!-EG*DTArHKY>
zh%6lm+E-V8=as^|<X{nq)`~@$@n$U=MzS^buTRe~kPx|EhPO2i4{~=Tnhv;LL-GZx
zCB&rH@n&yV(p)P#=V~(_9}F#Tgl?I<l&-{-iNS<~=qG=X@MN<@v^a`cJ|$ri?2S93
zh3iAK_4gl53I)i1cB#?*DSLwgY$cp`psUvx*hO$2092)cbr7Jzb*!d7juI>|&hDrh
zRDI~0{K{UDuxN3fJ0Y5A1AM9=QP34wt|y;RI5`8rI**x+nCaJopxq^F9?p0st%$=W
zLjIajO7{ecV^gahOgnV{WI%sJg?OfrV_Ihk<dU9fkWFx|<V*VtU84ljHb2$0zyX4H
zyceqMkRM?76c=Wq#usiB^UHS1n9gf3uA_InD(Od7KN0MKA+m)K1MGZvdSKoL>BC3k
z4tbRRGK6ZIe!>8k$g#JLKU;uu?%bi&3i;-Pl}7qEUss1<bTH;SHK@b)>>`j$R(66>
z1|qJ#F_%64(Qs4Sfv<F^@j0877KeTZL(%&HDH^+YPr<M(&m>2lI4~23zFX4DQKX!Z
ztM^XkiUC5Kc%Ruz6C^D@aprJ_{F+DNy6ljRW4`hmI|AKR9X51Bck-$d;sQ^@VE2=^
zrS^LsAZ|-`G5c?JDLV}{=RFCM6jA9uN1y7I>`K9BtSsT)WgE**v)V*7w;a%>*0C9=
z&*VCj)qzLL0xC%|Xs*Rc?{Fcf=^L;MOZz^J(6WW<Q0|t68H4#arX5LO87}cEocbF=
zv>xR%XYF~al?WQ+HKtn{l_<6DWbIt_IPK$x2;CvLHDb?dGjd2lt)LUvvmJjJnT^#x
zNJru!3prmnGoyYy@n~QH48{d7aNkCkGp^Gz`=7pKb4C)lQJe2jpKEdJTNPy3oO?l%
zqJ6k&hR@0@E)tRQIAm*Z4>1ZaO#P{0r4ZA_Ik#yBPpkg(tmdD|u~0;(g(*^GE`h;Z
z<g5c>yftd{wiD6<86Cqm=TTa>$`rp8{Hw6*8A-;*Whwzh1;>-ZO!exCK&_>uw82&)
zi-0w#zeYLqpwy^+t-vaB&H3PeDr8cCS?e%uz$=OxS>RWLlGNa|B1c+q&!Dn?c^n>J
z!kpI7V!^Wm($p1<JOs#2+{!O(=kYqG^-und&8-}-OX{R3GkR$U4WI>n(6>N^&km*0
zU_;~P$7mnQ6F0Fs@}hr^5**hg5kOd5e^3OL)ITW7Q6m8Ffg&9DEOHiIF?#!Aw(Qt1
z1MD61-bwn#r&B>ZK}iiOUxE94{fVH0c!^I?(o<2j&!#qNDoA~JzpaF|0~b}=?E#A>
z1kcW)5I8jhsSjYQ;W$Us7y!CQ0ZCV|vpLXw&j<1K|Ms1~4P?tiJkNYfND64@m&}Ih
znKxh`TY3mG!0HRdEWw298`LP`ca7G%dv75{E8u9ZjJtR-W#=k*Em375oPgP&dz)2P
z_>K(3?yshM&T+3lvITUn5qM7YO==<&l)f2;RCZt&4|NYBV}b9)Gz?Q4z{Dr7R~xH%
zNSGS)fjyr;LM0UNDFwf`^_bcji_!+#gWvFh$JymgP9@Nb3l*Y!l(QXRXWpmuW$&Jn
zLdj-(@9H8bB%Hdrz7)k`5Y)Hp5Ad@LG3R5N9DZ>|YxBJp!P@z*y+>vSM%6snZ`e0r
z$2MS!_4_n^WqaZ!L5O5zaWWv1aC|~HgAy?W+c`}p%n`WHClw2)K9W$|eApArJzS=Q
zkUTCO4$CjXn>8Q8?s~+D2EB6R6!{ku!U;|I5Q+~}B_n>ZSm)ShDZBy)o?SkM80KqV
z|EY9vn;vVkX-)m+|LA6xNvbP^nPcnxx>uR^);T-61VNHj%;vUaIt^pvDyKn2!YS6&
zi&EZozZ&Y*72I=KiuntA;3ph+sw?g%SVnhMh9;3ceCPqV$!T)xCfMr;HVRMQq>8Q#
z0#3LY4&Wz*<`N@x#~y0FPGwueu<q#?Jk5PV1x=+gZkhd00^CT}*k2%at|0sZiXVHg
z?kO`@8fW3uE>#kXjV<Nzx$AKO)FNm-Z`f3mMOD6mD7OGey&fI%RTzYbypG@9XXW^`
zSRRi{b6Bd0>;Td>=9+GFc$%gU=ZXnQx_R_0R;+9bGN<jv)bZ^e(Zh1_nMa+f49}04
z0QEg3*MzLgr`#<ahLjb2(5h*Ax7Ws;_P)Sp`uuZ#J@ElBPxUE8UT+?Hf`t=QwI)5h
zs?AM`>|3T|`D1znGnHPE6n7g2hfotKS;TXTMZ2)QXH&_~P%s%+XWdH-_Y#i$h+b3C
zKI{|r+U~OW(bJz06T2C1K^60bn-_^oNlvaEbZkW5wx(MEJQTZ04GpsAjAL-M(7$rs
zx(JX5kR15}uB!1&PQA@@JG}duJUu$Pv9lfJW(i7CQ_wBev5<}Kn}+Y!%gL?rGDd+J
z;)79M45~{IZhN&c&4%fDl}%s&2H@oYvMzwNVP|!uh9JTMo3Kw}CxRW+F;0Sf(`YoA
z6$m3-5Vz5~bg3&CM%uH^*?1@tY30s?<0j9PESk~VMfU$eYEV)~5OI&DZ0y!XCn_T-
z0>7#tVd1_KxpI5&OArV5;z$S_!A1|4rz^gfr9+;P_RzXT{%fBqugh=(hA0b;0ZH>j
z<F3}nyQsbCfJVVu)qH3Kbk)hf3<RbAtQo9^ow|$g@A5ZkAG&-E>(m%a*(KI_wF}he
zc!2&<f_sJ#IIA1_D)QPdpi>JFk`GJ{+7pn<7KC1V8A4X!@kQoTS=#&fcgnZ2=S()i
z&}4tvTdkDb62UlvlKY%UCUG!;hE6ZO&D*<-JQ}<6FGVP*`hk<yUxqF`fA2E%vZ-z1
z-Mn+A3pYaj1=w9owIgntn`xt6+(D#>P+ociu;K$$wvAZt)g&5Sn!vZ>?qiO2_v=r{
z#Q<CMZZ|nggvU!A=n9gg?r;+O$U%iRY;9d(`XRZTT-l>P%1Bs~2c?HJ05pR*Du1)p
zTQPiWD$*NvmgSH}6@S(aW|3`U&rLByy4D+|nYUQ8PJ3^zXuV};(8;t++eazeZN0U>
zVVyAfR&9roId80lw=cy!YST+VMa{zMAP2?>SWw6jO*AD<aV1g%fzxL8-K?^eQ349U
z2w5$}Xt0T+u?J*u1QGb$pp%exanzNO{Kv|!h!rkUz>g}B8t-sH$$KTMPXr=pAJ4Kk
zP^ju=tAsKw;A5ejG{GAr4W)=9`iE|CANn7WF3Pb?jJm32=r;T70MK%#%b<hrJ4m>M
zL}ER2p&U47CHK}RI#o-NYdh8qz~p>FfJn#GS&)8K%a!l_jqclK`zHMzeg*|K#90q{
zne}flCOGr2XsNABy|4!PN$gBLRh%iEEwC9Ep-8;ig$+(3g^&o=#$l8hsd*+7Y3~({
zT!b$XZh9^sPb!O5A<HnGYET_@0+&My%{h*X%L6@X*u0Jnq@p9@u}kf>9+9PY?>q&q
zbWSL<^X1%rd`d>JDfm4kBR-wbMkSdnv~4{g5r4mQcf^h8MmX@-aw@Z-vr`f41kB(V
zl>wDs4l~VA6hcM?oIQp)fWi2LbdI<YL0Ad19kUL?Xy+xPrHN0QrV&yKs_UWW;6Y1<
zsOfh1K6#8zjES9KtK1Y*1&M_%@B)A^qqH0mtCzPL)Dgk0n&|kE2|KA4_ZCsH;0ndV
z=Zb~T<_VuHxC_O*ICHU1&i%>EQ{38bX}fM?m3{5KHoIIh26b<V)7@T}5+sItZ?{r?
zcxPgLV19@G=r^?!D!?T3Oq4ckM+R|?BqIOdh99Br&a-j(`xocR%I1Hs829xIpH!L(
zPTReq!UWRHx^_`gba5j7k-p$b7T$Y5mZ(_kytL_10w4Uk*qJV(r5|m!wf;cvX7H;8
z`_`p@_b^ebiU#2U)wsum2iv}P%c#O^rN{X^w<{U+n@G}F0i8ybeYcfh;YcTw&u?*S
z5==wy+*B7dFFtbb(!C3J<!`$|2jW;j3ZE>JToiK-Bh1rcNDmrmFn5bEu@v7dHdGxU
zZ<PG&?Q{Uz8i@-G{@SFRcNuo>*0BmW3P%!k;6;jZ%cAL_fbA2!j~I4&nR(ji?%;0O
zH8vCnoL3v7<8Gv1q>tndxdN`iv0r>lFC9w}B73A^5oHfCKtR=wvB8A{bw^JB0#D>1
z9*-OBNyOOOpZUntEa5XxsZ}9{+*MLc4G#(;ESVZWVB>-4VY`MBI+WA-Qim8)h3u5n
z3MV(m0^{qoaDDJ^;O1&>77lps(O=?it-rY~ZI82a5a2>j>RHg+E;Ul9&!?2vR<&t*
z7RlH;;o-}Bj?Y<0E60m(gROtdWN|4b-G8n({$P+G11*0B>E(C~YWoxv`(1q67oNCz
zHcb7hdLpkkm8yG3Ia|HIOU!d0ryAWAsov>My!lP<!h<A4f0j@evYM5L=tTSAI)YCY
z@*yxl;XwIVm}dlqN7BH}BRZuHj#Fs}R2UvH$>a5JDEwn|qwBEFH(4Wba{)SB`5mxj
z5FT)d&Q`t^zEyU%)-Ju>_a;KX2b5UnaWcqm$f#tW=Akk>=Xf-@`c#7Me7=`w3}9cy
z>|Z_f$03qf=gKBY+F3w9NEw-Q7zT!mI~ffj$E&P-RQX4lySsV}^=(@n(RR{2+^;=>
zqANjSLf6iVxWOl9Fm;GHopr)F2Ca!5O?pV(#BmFjTU)KrPyc-rYr*wM2>~^t1$zBs
zeSFr{nybw({U~m`blvei{dSkkzYqEWfur|m%d91lowqq1M#*ZKR$iS-;OP!E^Ibvb
zDJQk6Oo4fUH12JM4LIKG@Gd4M(z>D3vQGE1$6Vbs1ocN`nljT6gKR#5%#9;9=3g+W
z^E^N|O+RzB6lGQyYFN19EgD@%IMaB86=(Krh5=S`?wHuk{xBWaA+z?)Ybt05d<WLi
z&|8I>xPSD7HE&3HB!P<}(>?r~w9KL)51CQG9P-UdzRf5_#kSkzi)0*}#Pp0JcY=rv
z@(Kq}a@1FLzJY^{mgYiaekia=>%hYRj<zb^JF0p$w)yV3@r0Dxbbo#;cp$%ne?h+q
zH0Rg}fP$}76YK1L9`j#nicV7l@;F{A-<Tm;Q0am6G$DbmXoegA>Tt@DPgB??Qvp9a
z#O?cUR|755oLx+!N#?0tHptZ`rwC<IQB)F{R3pR(Rf)-17FpNr|D7IsT$JSZUb4bB
zz3g_DoT8{7>_X`+cGI<=?_?b+b{o0^Pv62nsu&OAuxiojkje@=yoYTK_<V9US~#kh
zn<wHMs_t=)J}(WG2i&KGo~b!3wu!?(C~vlAESlNl;j=0(_PmG!AZ?Iw6;R1E5WRj5
z4=XY7wLsLwvTg?e^GW!Z@^MVE&(R(|7NF6G7PnOiyj8=-r6p7!P<%5BbF_0XXxb1M
z71u|aaj?S$yg(jfmZLT?ZH%s#sBfgI)XCYe5Q40gQ&7I47MK_|v7BY@W(u3icQIQV
zMg|%>fQfgs_=$5vmBf39O(3><KpY9uM|qFmGjK;j#mr-(Ur4Pd`%lvBWMiFqOhw=6
zF!TB+M8%XwPomW?P``v14Z~ay&lCW1QbP}M$%HcvFgr)Hl;MGsEz}|LlQecQIq^p|
zF(r@US!!J!kG)iy2{;B<@PC7=3&a$r$yHMDu23R*68xToft2djutB&<>q%d4sa#S)
z=NHX-(=51w<CNqQ9`{6>6BOI01V4RlwD|RaE3RTSD`Tjljz@7@$|(w{F}e3nVF2Vd
z+$?MbtFc}asvsy;5DW@Q77*W<xt(hr#UPpr?^6)n7EGYoJfEdDXa0G<5<2_c1;7md
z{?jHJbF=9x*IJurEL$mdqT4L2_$-P_O*|?sshAhdcD<0WqWymipG7?_DvH>aXc47X
zG;l83;YUv#81PojJ~j-5K%-dM@<>YNtO%n~i@bsZQPWSopd(U0Cj^4>VN=xroKa7+
zII1vme)xfpU?=TasLT~}3O5YAWT9E>?%($Z{q*p7u3ndSfM@j=@z4NdRq@aQ1aAWw
z=Msjm5P(GS`4|wrl3xCDB%oTp{q<IyKMF4s?nJ_a1JT8^fQJ$4+r4E4E3B3DJtqU?
zj&uKvDpj>TlGdiTHF;I4isqTdIKc1f0zG&*(^znkyp<%voa9v;^q??8)i%<{K1*Xw
z3HvDUw|_W`AF6~cmT2kd{KW1r!yl_lgf$)F=xC$kJz$v@H=3T1%Jcm*m9pvJ8rTXc
zTAkT&yLf9c6ndHH5F|G6OOVp_&7ttX@OlNW#)J4@VwzI2j0;H~K=dTuucr=$fgNfp
z2GW=J&r5G5f4~c^x&3IA7cD$S?Js=(JC+7*$B|9^virGz(7t@UfuT$8YCtpoMEXnq
znEf8pI+e~7=0enE{{&_X^%AbMk&e^%sg5rCYM%i7<?m{i_-reM{OU~|74fxplEn7+
zsWp0Ri<&aq{WBoji#lSdkno^w+n8cM$@?0uucH-utvxvRYA>5x7`;nJxf<N-JLy@E
znr$9Nu4V*`YHd?szk4D!OTJ)k9~wTvp*OnDCe7L#gUrU>3fnqUz;>d*X}CAwR)?**
zuJnRyWNdkqvA1^foF?O#RjY}Wh@yCosj+laNM}?eb)ay08D$vLl2@{lXG7+QW5%UL
zDDKOZ`2V8A>KR8ueP3OAEX?&$tk(x%r{T~|)ZUZ?B!KNgWaRQfD_GJ{7#2m+PC_eQ
zRW$HU(&(}xn8->4<E^@GwOwSak#S<RB7;S~S1IU022@E*7!hGyI1$?|WzpjJa3V$U
zKP6*-3@bMB7Kt3QbtC^LcsPY`MXJPdIiCY3-JA$JW9Jq|D~aRoFza_zTb&3!KpoM-
zhAZCp?H1m+L?t<4=6+QuX81mwQrN+yvBxpt<Y_ki5kf<Gu6Ys%)FB@#qTZ;hmxG&!
z|DS*rP37(XLxGIK1NTB)fwlm=RO3nn1y*awrWDRD0I@8POj*IKEAIyqRkT9d7#^5^
z4#O-3VbMTP5geKujBs0V`ZmKm819%dkWtJVLZ1~*txEpIXL7*bkUR=iqxRUcJkxmN
zw&gcroal3cK0#QD-C0PQ9yomnkh8=3w_i>baXi;`k{&2{oW1P+8wu)rAkS{|-E|nI
z3;J2g>&(YFzd6MmQse~X+wue}mE_Ofh3I&!ZSd_m3)2JtOE>}vCQ#S+DKWIc>+&jS
zo}7{7^5Hm|a^Ipl2(>D;x@8=-?QPvjuiCFPJ9K*(i(E%S1CANQ1PPZWa9uA-7?6!Z
z+b3z^%v(mp(eog4!wjrQyv69D1?Ezd4l~Ui30Se?y0aG&Nnclv{hjJQ;Y);|IN@w6
zE@8L9WOeM;I)_Rc50YbX-W6i=4eJwoW;!XfYNk4nvtwb-XgY#nPZC&+OSBHB_JJVm
zm%h!%@+YlB)EsIyU#pD7)!Nr`3pJCq%UmUM!sOS8KI<vVrNK#Jm4It_z!yelYjFtL
z8gtA-&L7Oos4Mgv!Gwc^dCm*ezuxYE>$t#P-W}(6ajM#HlG*mV;LrqNIHIPlC`pqQ
z-jr?fn^AW%Xkq<tewVkpAV7*Vmjt49r|4HNd{bRiL8M&+gaV3cj+f;*{0FB(l-82d
zhB^o=q6UCw<Xx#=>E4=K;8^6-vmk0hgj3-$tKThvic0#?ftJGZxFFR+XEU(2;C&XD
z-QJ!e+;-lh9@65UriFo<7}>f1*+IKruwg-^cdladZE1H~P%lN1*-bO72PL3iG7}_j
z8_OraZn*3?lZV3$x5UI5Q~N3h5b9hIe@`m<*T;1@uuffY^PFLjHl~&da!)-@)4GfQ
z+)sAnzg>SSPcEqMX0~W6O22u1EQhrMl~+3K0*Rys&n==7I5iG@WSUw_rRaJnOrPg|
zCME^6@=4}H_skfvPb}UA8DRB>U{qql_5IZ<=5veJy?tpXMJwcJtWG|EGGXH`e6rx{
z@pSy_)?iL&zmy4{m|6XxR=A+~(hW;M&nA&KqdrXGhY@9bHA2C7dpATKGsshiXWu#~
zo-X;iejg>ATk&7#dMT1h+NqVLV|{B)^K%)Av-bZ7l2V4PS=i@4)(8ourw9dX#+}<L
zvuKJg&^Mtl-=9wQ`NFkuKQ%O?e4h8&{0-Mg-{1ZiQr6urZBYKpoZ#G}pyY#6N87Wr
zHR5pm20q^6pZeFb0z1`aAGfgX==QohKr~8OW6JAOkm%bwAHq9hF3d}d_>R(%N$_9b
z&~9w6dD~qE$t5B>fBT4Ifx$`MkUQyH7XF4Eb*z4Mw3oz39GQxWJ|J8_Nl-?5a^s+D
zBl5XB(*o$B*h^xpkv(A;hp&M8mv7UJg|x2>j?G*My7juRWOkw3=m68Fy3d|dl4$Yp
z1}CT)U8~ia{*OcmmkKt;CYS_@9d>B9c|%}YAe>-H+)n$<&G{HYu&IzH9KL4eEI3Zm
ze8I8_y=|z#O=9hqCgKKdv6+TI<S76*HN=dZj(PMql!t3>Fc5}ir=5d`1u!1KCwVgD
zk%>C7O~V8wY1f19wZx=fkq*N-IHC+V1_aG3jl1d}w$zBpiD{Og`m>*+s93347FSV%
zTr$Gvt3Xq<f0)2(*}5H%efHerM1$Nqa@Y!!_V$^)4N$g@yl0G{=-#nJBGBwnqx)rw
zZ#cqX&K>C*$lJUEV<r<20H#=mQpK0X?wM9$6+&9=<emFiS=N2!chI*~S!1Mid&L7E
zgh>Wt2+OQXq8moxfSEYndv)WcaK@msy96piLDvo)HwWyaxsSv^1EOvHcNQ9o&J)<5
zVaAO$gd7^kLuUw9yobWR9_g``OsgH$w!7ThX}Kkr0dAEQ#tBI&<;I3AXNh=stp!~o
zmD~|dY8x`F*o>{IEkrjWpP3;WITk;h(?FxgH3u}nJPC@ped}%<-aBj&GVY<KMUaw~
zipbNJp`Rq!noiTr+OM7Gd380nU$<`To=|Ms$1C4!y|#U3A2WT^X+xDiYOjKIt;62$
z&`Ux?!K^rmVPJxQ9hL;qR8!IfS2EoTD0Obn-8ex3C8%f!T46R?$I#qDFf&qn!Ri8)
zjI@udvQ%>3{*MdM<o<uT5X)0gm!~QP@^zu2Al>Di(S61Ogb_o7ceoFZT;gTu7y<I8
z>pG7Ccps3416wv7%*bid83ZEhi7VCLeID{abLvaA%#)y>n!oN-!(hw~2gE28g1tqF
zcYS=hQNPI1eZD`sKf#aqa06U_FmE$QY)BLa{Cqo@O>0!-jo-qDYG~rE=uF{kiOsb3
zMVASAEl`pImYK~nqBQq4<7^`1k&3ak!X0jP^V#KbYor*a6Rc|@4xy^aV0Z^9@p)l~
ztXt-(!IiZ{e6}cj7qjv;KEh_9l@6KY*S}mEA5V!{ch&%5=^-8UXAU?d!ECEw=?M?=
z`zAjnriL+2fwP%ioei6q4p7IY2+gPrCj597V}PRWFf8EeFwFn{6_1GaArC4bGhvof
z-l`|%vUId$C}ja=6V)_CFTjVAh*a0<?SJ(gni>{3##Xy7q6!uZo8tihWkP8=AkwJn
zFs>tlTQbx2BNK8_E$c6*X2B7P|1TbL6N-0p=3<>%{FRxZxaL#7w<{G87z`Q9UWSbL
z9~;plCk_<U1%|lXn>$XDwvYJc+1Gch8yl<di+23?3tD!08Y+U+zB&U)BN5YeS;5tb
zNCjQxqYPZ&X*zMC(PeGZu@o-MW0g01bZa-xVr$L0{N2D?2iB8&&(UF`W(^(E9g4xQ
zIS+=*=%!(<*;=o|Re4t;+$W{9ktRBeI?Hhz;ryOX7LV`B#x$6w-kF^~Xl`uM?zLM#
z{>t}Or#{4<gftFaG?^^+G-jBGRlg1t)@a^3VNxlsZG4z2X8sr%;O%%M`Wl%V49?c9
zoM$a|+2*kxI1cx}v4e9DQj~iZ4NnDZZ~q;{;Pdm8^E!8XSF^5((I}w2x=<~51N}UG
zWEaRKFip<g{6l)F7|H;d6AjBSJBT3yst$}TE*$7vGWsVtVtesuT>lh1doQf{%;X%=
zy=b{bA(re_Qd}($3IYtNDo{}UzUW?yp)v}R^TkG=7(%VwnB)c*hu|W^)460@^dLg^
zYHlVjSji!1@=cAetvh{>qenFGLQl$3;Ku<KX1L$Ggr{zlU3ww;$Qsq*^K*&+QAjJt
zvroOPPtRmQ4K^)kxi{%#upkpHPa*l)a4LH9JT%)&eBLjfm|Zb?-IjVLzbB)*TYouE
zQ<#7JzZ|q0?G2gU`A)3OYv0_x1Vm4Pa4(XcwU^jf%h)QWe+I$@Fl6!H(y4H-C`yln
zp_@AtMtxj|k}${+JR-WsvyMlix9AS{e$!8yHlmIybd>TJV5eYQpg8@t94CCI>>}es
zI@jL=<iIxwk=}z$_}!3Ui5|@ZMPA|2M0owhWWA}<VDC7<?wXme2BfM1(m02PCP}(!
zKwn5X*%TCJhO;XfEdhs%%sf2#e_@)tMk4h+cYV=j+I-xPeW9W&AtFlmj`P@|2S+${
zq<Ebb4T=-Bq@D&1qF$otL%X&0MyTh{iQSciTH^Ge3V~|fv6Wdlzgq3Zj^{21hy1Lo
zYw_Lx(^RyroG)&@kw=}^g%TC6aF0&k&L)6-gB54)VxAF3a`u4O)pkD#*Dj;(!)qpZ
z3w#^aUeEg{GjY%O5ljAn(pUmFWvXlN2T7SlVKx$@pb5mMrCgg)>JOV9lV8#ia1xVC
zikvB8GKd>oe92*N*_j4THX531k;Q?4BCR72LwMTqD6i<srI^;6ljdVmYU7>7jo|+5
z7XG_y_S6qP+vF~(&IrZS;MPCE%pRI1*A>{)_<I-s<M~opJ<4{TW$=_#GX&JFbicF_
z6D4^IVm*$N?5k*Dy}smrw+&=w^<rfguaSre{4xHdgB(8kZ}VrAougj!KKrnk9x`gC
zrdUloUF(|ozQWgJ8%z9(y~63qT7<4+QHn>x)PKd@PtK>Hn5-fyyHV6>$*KiPRT%Vh
zeCo(-J*>jivCGhAdTqT-raH+LRU7nZbqp>7G{f9&beQD~T1US<7JIOOxk>~ufGH7U
zs4A-ZBGh1x=|o$%p{>mII>9+LCA~%Gr$uMJp0oyPW%R?1b(dxdTYI5aqs3;w`J?*?
z<wK{Jub@Kxs^|D#=RLm)9qHdj-Hr%dTT0VNM-%NkEB6sopX!LaQoM?nkBgYkXqWaL
ze9i2ANs{1#Xx5nqCi<-p0S`CKwU$k@CZadc%k>tWB8ezEscedqHfbu_DIj9%enDM!
zR>^)L&&~NC8w1~nmb`@~7TFfB4n~>-;kO6wws!Im`Kf$FzI*^LJ6!PfI`MUxop*=m
z=`U|&$#_U-nEj`U*oO*feVi68+Z62MqzpxaaQAZrNa7<O$dO8;Rmz=5Xwf_1*>K&7
zR_{1n2<F)+T!85SfQ<&_y}w6Q@V!xNHY8UfHdd%D&>&V`IrTItG8G7E0~%j?XL>}k
zkL0<SZucRAqnTXDb?@98swAFc>cV#SBusqC`TA3iD&Sqo6=OT8p1$27oRb8<G|f%s
z|JEo;Z>au73M(|p@_|k5Y&iZGXYUwfYol#xrfuxBZQI^y=T6(UZ5umn+qP}nwq5z1
z)7`gDS5$P@{j=5^@9(uD<{0CdWBSRAxl`X=rgQiP8r_|71Bbe(LDq!z$wLuk8z@4c
zHM`8QD_flCpo*V{Daa-oB3?=0<E-rcRxW4#vA=A=hR$qFOY;byS>*A`fM;VP{Y+tu
zq$;{7VM#Q{!Z%6w4q8F|g;qh%EBV|AKM#UHiZre65HDgUl2O=7ndwRXR!xnrOh}Q?
zliY(q(rM=)Wdd8WL9+fEDMWU{l}eI?La(y&!Ltqz%1fnfEMTo&HX^`m6fr-8iS-nx
z5|#(w&n0{+%%w1|GYl0<`mHZZxN<Vu7Wke-dCN+wl%s0EWiJR-S(PcxH_-R{qV*3~
z(#l^Y8_UMMxnLVVq`QCot4S~Va^(%A{TFQZOdqfotY5U|N)V<|uPl{z-9ta7Rlm2+
zQbPzRzhY7dsP2r1F3gD6p&wfAe-M8cmyj6$t6eq8@^8E9P{{fKM8{{v2yLu9yLqx@
z_Q$U3I-EmhFj7uop?(Uh3QH>--ODk-$YYFs=$acILw~-OcIO2B?k<W?&~&+{^vze+
zWrD>PMRO)KhfGntR#|DY44i-93!@=nBAZaFka!R1*TgnSRZ?BG9SnE^9%3?HeM>C(
zz^HwV33Pti5nB&;05W1to}*Lg)?^j%3wHUC*lflznI%=_%XOSIIva@>4hEMkR_+u$
zuyPMFlyIqBijvW~*pN@p8z_T}K=|4oC?rx-X8l?H-=K1k=xBK2buC$dY}|0IFMy0R
zv97VhaOF01UQc&6ppw7h@2L67D4pXRZ-Z7;F`vlUn>;#6_QP0b-UAroM4&Ca<onYo
zFxTYJr04LEMVP`^E7-FB4%q#Dnu>INDQW_i+JOQ`?t>{j?Xy_82ErQfvo^B|Y}00D
ztc#Hb>UJ9rB)r+g;heKmC_%y~tK&rhA5ukQ5kCt97Qu{2TOd+RhMA9l_mBvOwz;z&
zz1&qWuUL52hSWEoYuP4BW?z6IG@o;&#^l*VSgZ|FE@e}ZT3l1~{{VMguN03>dfU2&
z!}uEjxTI{i!DcA0NKFl=R8A&w#E%K5l(};#?u{FZZ{plTo4!mkHuia)M32-2R<?x~
zUc{;-JgG!%r;EWOe+my)W^}Sb5AGrHS1|;{VkY0L`N(jk3g9n<xReq<Atp9Tx-@9f
zr=yGPLskaxG*XPqlDSLjCS3=l`*EJ+)9Kv#ju=urqM)h)(Mx8M6lbmckqtGyZBkh?
z%wTm|HTBZyL&gv66y&+h;FN}x?G&OO&VH~E+iXDc3!4#+EdvbxQO5*sjM9se+a>wo
zzE()^sDfyRyrLeDSq!u0{s)Qr6M<nJ$p+$w&B~ne9@XU^yHm+&W*gC`bE(GM-atls
zZ|T_2<e|^Rmd&Z%%08A305rkFh9hXkDtP(H-!JO3;lN^M73Cf|O<PcY7D>gk=d9I9
z%(0(lT)g&<R0*%G`|zp^uP$xsf#;fQ;yxv_d=G`Ux{PYIqpPFx;2^D?Kz)$`d)oVp
zHDDL=gz&w-B3maYd~xX>BR3aTJc0X}hu!bmR_&NK2-Exg2M0Ry+nl1A4mxoEjzjQK
zv+rz>*Rtn<$lGwT=INSpTiHyQ8cS0p$86(eb8K9nux2#jz^GU<GnyBlb=B{|>G>@C
zOd@>>HrN18IOkjMce%Pc?*$n{fz$qz#0#2f)}G44#%BEpSKi^AG~DVx^#hW-B$k{|
z&^~^~{qdOA(xy2)fo8NwMz%<uNoy=iR-gS0t7Kqjo=o~eXih<pafwyQu4-62C}O#>
zro#v4j7W?vcq{bWMkQ<-7Q?fUXvHKep4=$EkFLTpN-W1ZLcqFJvdQ0@bG%m`8K;`3
zS)i1Kn!k16apK(#>QC@3YOw`^N0sP)IqGk3)|t}&_WU|~M0;usw{hf+0x@0RwG!()
zR?*8Scaaurb^pTxHoiLgzHZ&JlG>?*AZN<Vb;Oez8=o!51-_IqBACCL^5W4hiIkQ1
zm6*%hN+95@(D|WjvmV|_Lv+-8^ki9pF0Ip_T^xsYD-oB^ge_(1OnUOQ3}!hHBB$sw
z*CEs!Q7b_H=&<Pcd@OZ%bza?(iWfv2>QLR9FwTV;zj}9XXSTd&mfD`8d9L{Q>0--C
zCnnuKTJUs%@8j~?aoq-Ia($QGzsi*o^<@i!7rjG+-CGUR2j_hu=NN#qt{)=W=-iHa
z=q$A9eA(}yT|Y_Dq&&O}C);noP+h#q8<KFFlbHO84L8)^`?BDq7!nAfu$G@<YBN3Z
z&bjdgqy>O6F54PRhUN20H|;#zc&SdOW^d!_s`&x45RXDZSM7xgP@|^B5<zw$NEZiE
z*bM#Hg}87qiW<V1O90o$mvdosMPOIShX5Ov?ZXaPbNSWVu=$~cKE{pq2?@l+#Zl2M
z>;r|L?f!J39b<J<Wc)<~p(zeD{lmF=GEb3#L+Z-XEw6K-RL*58sEwPICRBdiAOom0
z{JLmtMbEyk8*#Y7sfsi?W2>8r8qe4s>3zAMFx=oMwL!Lkz<Old`}LA?(}(NOTbn78
z=g`Zx?MU3Pc5%(N;vBk|LuA8_B$0`$7>C>`>_Or93(z`O>0kntchYc5Ygx|-LRwmA
z2<PoL{N7=5bo&RTPc&<hRyY!e=naG%7Q(p~%8MlB+7*^JQ`h~6@XM}wX4ZTY*Y6uD
zdBe-J9dN!Yd%i2r@C{haR@oozqDcPQoL;dy_N(5QtZ)atps}=GZS{UYU5vV&6`-gp
zT5~cHFa4}Owo9Lg%A;_ygF30Fuh3RTSuYK0jZL`_>LFt;o^|w;dX?!y{r>5}gQ@tQ
z%lhHB!}dk}swZgQWuf7V=RDs9Qu%3>PXko{eP@H*!J<1)vD4><QWhyr5i2A<+WMxs
z7z%bZAi-_vishtT*prQm^fYrKUv`?KslT%J9CrIs(y>k~Rx(}pDCjhg;VjR=fEMi`
z8{%wh2}JEkj4(YNPzLgFJsO7_w}&hIDaq>xtsDDL?=-WrFu>=uYz_Ngh4Q$!iGy$t
zJ_vZ$1$!*>uChfi)`b{92l^~tz5UZU7-jeifjG{f3v$0C9-`<=Bmkd6La29*0h6Z8
zNE>h~gGZ%|)<gBo6szIXm6q0{QQ~9IgQxod_RoUBQ+4s@Fl9vzj#WOa13AS@ImOCe
zMveug^-iP@5F)N;HILOwF&A!cZiZ=*dyERaTJ#r`xmVnR?qZtH%MgY~e0^Nu38B?3
zQ9f`)2h=G$TQwbq$CnI{HZ?GNy1TegFz}GaVz=XX2cuSEW0aNM%~BzM`fQ;iuN}2G
z3{qZPqTPpPa{LqK<f?x)4;UJmho(-GC14cW(Z4eOY}G<5D86$US01Txul|{?B%NZa
zFblh$$ZDHH=`qS;I!&lNGpKS27Wzn*3n$a03z+66JhaGmDiPc7#X&fqWp68b-+67N
z*sTA)H&93QC{V-GG|Nu^Kpcl=BYf_fGTQKfUD8UQQNe9EAP77axYXWd3b8$#rT5d%
zZBnnAkHJ06>-7ZcJP_e!ugTLvj-#;pCMPc9Zs7Q{4?|X(Z+B<P7JPZ18YBG|#q$XN
zH>wYu|H2n`>L{zLxBbFrn+M)Ni5P+CXoz{B18MIHN{ytX?&|(sIR&6$AQj_14tBgl
zgpp`SyF&{5-oL9u`v27m;?JfXyHSzC1o7|Ql3=|ey_5L_YnOl4*iQa#RiwkM@H~1A
zv#w57xn3#6;{6*6sDl1~LjjpS0vIEA)x$?^&wegKnz3T#ZV~^t)I-ouaC2GF(GLeZ
z<3I#<O!lq*X@w9KN6nWS`sPR&Ta2D7<wikT;ouG@PHi)y*sI|?33Hdl4F{H<6_HK>
zQ<Vo-=??i{mELLfD$rC}01!&{TwC_T%Sq%*v`Y$gMc|!S<ut?JQGAM5r1Z)kDnLfl
z1A@_!*dmk$`OF|;rV7uMtw{uEEs7zY`aa`<Tz7klKq3xB`JX-(5kCBiC6guQRj+KR
zX%;)zjBJ^=)qItAa*g9m;TVbCf0ad4Y6$&bZ4tDsO?C^00zVq2a+<>xC&s1*bfY*M
zIe}CxDEilJn8mD%^=vemC)A#x<nhw2JnL}52hyc_WJ#=Q2yWx-EVq-05&Ow`5viFg
zd5lLJC6+3ler53kwX|ZTHXzIkzG9Cr`zYHFN??zlTpg6pTGr!I9u=J&OSMbx$<)vO
zqepw;gK+V@#M%2>oj^)t@u%4<cfhk`f#gtrumFJS>mFky1ed&n{~`mNZ~jlo02^;|
zJ!yL}|L@7hAB6;Nasc!`<?JI^#`uelSfjg#ZVneZlF5ck@Ba`D_}^=z!v6;iNU<_f
zt1Y9^bgET*RO?`s-WxnfL?-TVjk7XJyt=PNE4V!)`hzkU*B&Meu`Kdic&w>9I7CCr
z=qW}g^MSQI%#E=ex$D-8PG=5EexcX3B-G2yG(3$OV^5AGekB2d)xC~(*V_y3680Y{
zwBOzlh@!5=mF|t-Ey{W_7-jEPAR+#_*@SxA|41Vzi0eC_){vV8QLkQ_NcGbtlL~z@
z4dBu*Ib=)#TRvS~ieVgeUEUe;*;Vl$`%kg&W59HR|B>OZtRpjWV?(rY&)}j5dUtPI
zzzAw3xT9J9TMZ>Go2o3fKh=z9xU2Blq}%1=sQfzq{}e+k9VM&_^r(mDR~W~Qc6ugx
z$+jGi)<KoyqH>K{SbRuA;?AvirM><kC$mi62^oPg)-8Ji?|^9R#-48=DZ@9e14n#F
zYpVfxRuMPruM@rsZ-Zwk<D}#>H_<xy?@jxbhECH9aU{!_Ar-UboV#P|j(wAfSL&5m
z|KclHrLC-MAa=i{vC-p|joJ-tG|X7^NxZk-7CiAPYFiYcd7QnQO08C8f~0Ad$u=SQ
zSPqANsscQ*R~Vcu+v2f!_EWJeHNm#5>rkyMNyczO(V9FqM`+_|yAZG>dGtVrovWJ-
zxo5%LedtN+O!X@1%vG60gs{%?#NQ0^Oi5>hABT_=*x}~4QW4>|7o2?|HFtFd|K>7l
zxkkNd=>`;@p=@o&=4_yIE=P!pKGllvuwDO^1L<n-H?@#~QYI8qUJBXkK|jwU73Z<b
z`E4Md;0`h#ucvPBBP$+Py;DQUqH^X@4Z^@;wsDOpiER#s$YRF*D=N!6^lYWCYypd^
z$o!H*;O=xsg=9p+>)Is*W}+A1yo~({tFDCN*Dvt0MPw2Od|2=@8G6>IMErX|gK{LJ
z!>?xvbVv<g<!g8mMJ&oZW6F5;n#in@2XNp;Mn}uP0X!s9^$=O0?#!1<88GXp0LTPk
zVNf9_eZ|?ccDVyyr3vop<=!SiWV7uJcL(`Xl_v+EVOgRQ)u^G<ZFuo+IPq>Qs-z)?
z+UbeU*4Egv^FBQ59Xj_Wn$pHgn^|@Qa71sRG3?u0GEY0Lpp{i!ITremYtve$0VR^t
z4;h(N$Edt@)l_S~XCm*ldD$MpLqXvg@HI7fW^p4t+Dm78Jak&qRL4@<KL4pgYS)7T
zA<PJ-RT9dE7D-@V(h+o!i6yxzZF-hD`0qmtE`+=by();?z;EZ%nOeW<c|6nq7_C<F
zb7VWbQ=CXSu&Cm0v@CK}+<`TQtl*j828QA$zwIadPclPAN$)>oM&fF&4W*(v_1>|Z
z{H~obuor~cqxgdJCN3TiN)U~#cp_(;^$x!h-vj~cUg?(TU>Kw9JbeKhs~z<ik})X<
z*Ze~2eWf~0BHyy&F>+QX6Qrr&3NvJ(IN|h5gbi<p$NS;M<MeU0w$EtsamKgk@%(S!
zCY&v2g2Cg(_M&{v&T`CsR5YTT?#tka%++^Lz#!3jgRKNeidV=+2i?gqYUVUAx5o3g
zT#7SUjI#tRB*XU5KaG4V>rL@?3`9o);cl!7kww+J)AJ({u7xAB7;vPlT*!{!7Qn1~
zLM5eKW?Q*CgDd!nZ>{ES?+!)w&yRn$CSnAU2ErCMAY~^zKRh+p8eP?ou1J>Ol)S!i
zGN#7m=dBq_dALTlwRo@FtNK^lKaOpmrjq7(uzN#@T%pBo%6)4B@VHPmb%&c)a^)*G
ztwmZl<(jqLZ!(rG9m1^^?OOWhYp@^B&6=lo4Y|n+jrc+WZf)s#^Zn&KJVdvacU9C@
zOI^oUxK|}C_%1b0i~D{A!Q7oJM@8{t_MFMHyJY|y%e{@j4hyPlG_cry{%t+yZvYSX
z)~<OZ$x#_MZ<aiB2L|3_qguW}R(LjA(DLb@xnIiYzdQF&DPvD+9~e$u>`v)tITR7>
z!+8~e-`YzKYk4Q}iDAvtiiBYkxq_6yhCcE_c^=>Hu<dhA%LaCDGgil#uj3HEZ2n5f
zOc_q$guc|vyGS!kN-rGEl8kHjqk1+&*LQ#-`F2iV(OA`Ax+p-w4rpL?VlB@|S3M6k
zs&`kIW+5^R`x*SBjsE+CKk%7z*rMYypL)>ltF}7%oq1>0e4Dp5rECJ6Vme4{#HDp3
z5mfZDZ|sYbWz$iM@OyK6kqPElwyZQKb1$VJ(CeAOa@*Ypw0-~GAsb|=8UIqHMeH<f
zQlC9VcUb6@h{%i{UYM>n2s>G{37!3&>(dSHoaEiB)}3u+K(<*~D8O5Gwyqt0p$gGs
z>L}{7Hv+C@$sy~4r*b*0Wywzij4roV-_U#^Mj7r(0HG7qsyq;thbZ<s3BZ?x2+C7)
z=(Hsl#x~sA&{-+F!+0Yn-Fh@rt)0VUg80<y$mKD(-J5vCd}I6-a(PjceVq^MNN&+u
zZjpL`k$p*NlLyHQBxcZm4*#QTKf}N3`6P-9_ivvN$+crEDW1^3KU2RlSyV>^ShS$*
z%GO}Qjwn+Ah|Nl{24LREVS2%~QttiIjTA@d-`4Da@wa5HrDNimNyb=@xENt(cJ>Os
zNv@O(s&NvA{2sV#862d*S8T>>;OX!Q`rBJ{$l`7hK!M^~$Ed0zz+Qs#5#b3>-qZ>9
zsDRNFj4yXhIqS7;1`C$yz0odrYZkjKJ!wf#lcxozA^_U^4DoDBWju#YChWcDKn3ny
zcMQ)XL<*hv3Lzd$_$y!4n4wvgP4MYy>C>#wY`pn0SE*;pknu}0QlEjlzNnGTY6pyG
z?Et4`(uO2(8aD_%ce(aIFB1eA?#xm-swI`l=MVW}t)}$Z{B&+{@Ng9;%ff~d>wHjQ
z6!2D4i|qa4XQmn4Yf*ado<|1Aq@dXx5DJ6Y0r-nIC@mpGOsinive9iiF4qC*kK_a7
zud##rQ^e@$K+a~6)E=7NEF`{>wj#z|0YdiHwG$_{E>}omo)+nTVn5-W=+HppUqHTA
zH98Z7zU&eX5+;~_ss5Q_vdyajxZ=23hE6p$oEnd__h_rSbgkQsLVUh|r9i=&Xbl$Z
zS+kjXnDIH|Vi#LObX?y+8kVoi1`eC=J?#XvBl(LRA~&^eQDnD?3=p-W9b6Z53?jgf
z8KHojl0APs+EDWg!sSW#zcbW8|GVPg-!V|r_>lufK0UkxG7O1TJP6Y%kl<*%@Hh9n
z+>$}MqcpwysER(Ic4>*8mFQrBi+`hG^k^4(L!;#x*NZhE6N?8+vlxHOzOOeU&+@=7
z!$J^mSFayz^sgVWA?csza9*;wRH*X)o7)^ut$7IX9aiL@3OU+V2^4sR)$GU2Y-GHX
z63DW>BFngcNrWJ`Ras+FwsBTrnuv8+1B;<4RwMnSit-i8pPAE{pSq`GU$1;%tE1;J
zXuX92hO_=c<ch+#4>mXe>fR|yQ4Ir+mdc~KVY9BJf+NmKn^%>0F>u9VqFEQXEQs>^
z_}JdPH)(`w+6m(c6LC^X{T?-mk;B?(EK=&7o=Y`qVVKknxz%o95b`Y%iyVhIUpLt~
zilLf07n6sVlc;NdlZHNZ=@@;<Fc!sZw9q)XP(}eg#+in7t)c}E^kTiWvgmg>twb96
z;gbfX{S+{vy6P#F*W5CyP%{|tq7t#wO!Lr?98P+C7G6IguN}?X6ivL~%fN-j%`3=^
z!#VqiH_w<cQVK?(p=Mai2(e(Wt^0zg+d?5-w0b4$SXBHBHxA)$QATSoyD~T5phwo1
z|34*mJ#eaq{e2VlEsJ9;z(A(MK{ybv#6W_2XVn5Mx{Bp9A)x<cKNI}qO20MrsQc+0
z=@3U>6Q*F=UHfwO$$%4P|L5!{90<8jXQI~VpX}#n-Si&p1PP8V0HJYaD(e;3R2&+}
zv#A5wJQ?zpKNTxoOepa|)ew!%;YZm7Zn=RWT-PD#B3BmvSD}Pm8P;q!W&9j+VHWvl
z9v*^9g|}TnnQ}VdP|Kxm#UqUto3L^}k9@PC@<70@s*=%WY^{G|ZB;U^`4v*?!=|fc
zdf+Gq!*$V0<AtkGGTfj2K>1{v+P9;8TH|Kk_Whz!oYXIO|G>C+9tTs=iXZAM&K9~c
zLDo?G?YSF2Am}c%=$L(__<;D8#LZ#Po%VJ7_lw>E;e!`?K|o?hFqq0305-Jn#R~E>
z2+Zps;OvTn5MsqW*;vmv=C_xmFFRTAv8qp)-^a71ZJ<O$T`d~EjCsM6qhm5sIti%M
ziw%qxTSGGN*cDoMY;x~yCr^3~1@P11@0o%)UsK&K>_X4!ENNlB8|v8%c?Jlk)<4Xh
zYT!Ei7)?GzD#Ijt%Net@PnWb=PL~*2v20C3{Jy8&t~A|IN&#LjC`CO!+pqz6qF2va
zqDn6`??Iia0bus<rm+>!tjp!4((-lN@_i5T6ITG8p`L?G+XN$6`K2z<%{;YaJckq*
zWOCBvt9B#KLe*LRnb%P}A@>M+!?)HHZTES5Esv5rFPE$Bzq+-5A~b5&-Khwm15o6P
zwZs%Id&pYycl5Tjc*{IQl0+9{7j?y}VSn^+iab638|v1ZH{5(P{vnPwE)Z~QvO-p_
z<4`J5d^9`L!D^Km=?=pISJ$}gAj0pl-!HivA2(iT-@ewCk$q;kh$*!PutDi92<rmh
z_yZ=BD@v9rpIuNL7a3Qif;=O11|C2^hzL0t$P0YC<L7^MjNYO43loA-$AT#yxL$#L
zog<CN!>@V>!b|`DO9OWu4B{!?D?(lyD+{z<zb5(HRT!D@F0;0VPV@@i^uYUh^PjdN
zgpGkL&u5&sD*kJVB8dDM=vv@&)g|ABhJdNz8Ng%$4_{k;UDUN;p*2h8w3VoFZ>9|}
z5Ob43$)LQ@I-O#Ws6d%wCZyPX0o&Rj+Y#LQoK%K)mH{w(OUyp%RXJZIVXFwou6+me
z);#h)pO=EJ_baO(ECbzNA2*LSt(H%5p`V(<E)-G-=>XL92-I^*GgA83fXjAa+s_BV
z)$4RKR_h@Zc>kC#Q-%Opq^>qxj{k=93>F=Kg#ggl?fUrmGmWtH-d@j>DVAH+?rx8u
zv9OR0Sbu#o%I4ZGiq|tv_hPp%g=}Xi5ccqH;)($7hOLBVpjY+|K49kbG_)!75t{s8
zsnM$4zhSxK12flMl0)Je{(*rwykyxR7e^y3;#gYsl?S=sbKle7Up__@@F}uD(P7e-
z7d`oLp^0bdHL6l|C_?kK3<$NBV|hhCNzsh5q*AbgY(iwMF<hgS#|2#TU%fZHZqCvK
zJ>=>*>dWUL>lSRk|GlNqrLB?T9sr3tvb8eEND!p5JXM6J4=qrS65%iXedP)!QwPK9
zXMidz?RPD|GsM?lsU&1GX<WOjGO+m2OkcJZa6($zWsvZG!O}%%vDOciQ##fUM1R6V
z4|dSS=&A~V;`P!ad?LOEyw9&vpl2gHa$}2sa>wtXi}3d8UCjXDBz<P^6Q5Oe>N9HR
z&&;Y{M{7C?=GPm;S}Q>d?Mc?|EvN5wJ-sg<RMoE3wGTjRI>&pwsbW~D60g}(o4d>Y
zsx>;xBRQ48vmnJSmn2@H8JF>aufgJI+3@CA9_|Gj&!5<w?12*SPtS|<OkGgc(l^p7
zwJ>6UDn1m5UyqpZ{Vwg@3XJ42+3;W!U#;Km0~sg$Te6}xSG+wNYLoQOzJR}FR3Iy+
z-N3z=$%^yUOs!?(3l%N8pp{58<AWI1WYnAv_92>JmEK=o7{xh}q+jnHj~lj7nM$R3
z%QXedKEmt};sBq)cHMoGuUih(0!>R*rwvj>2F@br+dsK2(R7_uvq6=IQ(HAL1><RX
zSqVijsX31uHQW%7Vj{~N(Pvf_T=3G;IF*&9-}G%e^m?at!9x)_7}wlfa`dIPjX0AE
zO`!>FW3DN>E53O^76sgG3mxSUKO6NXwr+kFSNcyHn>XA-!+NGxf2pnWV>a~lg_|y1
z6Y8B;cOx-DU1H5OyhQU85xtvN-aCpSyj0BGOjrlbXl1Xe;=wyrE~9~CqDNNv5x_n8
zQ9Oa)$teTkTGdo5W$LX95V}WXYGB7MnwDJz7e&pqTBKp}IFzUx;*arIkeeULA%*n+
z1Tza?a*H&1&&*!aW^dl+^QY!0$}U2)q9YqDA|b-@?uPggYb$fY(u~1-GYZ7=my&Hp
zk5a8Ml|02KuM=c|kFM6D4<--I%hf6eeQ(wf8_UCt@?ZvWFizCwz-mahstE&GxsR~Q
zY%~>*&N8|d6@S~zP4i}nl1oP0sNo)K2{6x8G0}moOko;$$ZiT_Ov>ez)?o#(cI}rz
za5Tb+A1884;9#{Dlq|!83pDbU{uB}rgzF<3$U?e{+(hQ_<^S0^(sR`WR<o<V3T=q0
zX|tF^A{;f?K`r9F3fL$L0}g@_*6O#HJ-4X)i5W;}UZM<<kU6_D_Ix{@E!ixIWSnnC
zU614Id%6fJ7ejeBU?;J1J&wU^SX4+#m(i39mysI*aYKh<OY#=yL)r*o!IPKP71Mk^
zYys0(YbPz*Fa=y3cUb!lr;H3I@sU`S<#8;4<>vt)CQrhGmx%1QFUI3rtC3I*=e~dU
zQr?+7yivItR`ln2a3Q6n?>HS}t2Zf0V~*)>%Sp=<g_G!uD-ZYyfI;EH1(#J^wK6Ah
zQslX?5kvH3TC==8xeP?5=QtmWLZ?0?W*LVC-14Kba4!t(x>|+>A~c#vU?x|1Dcf#)
zFr!R|8f^0m-(@5Ijbm`g(U9+3i<2)yG<T8KG1E1tTpHR_O+k?xRkAaMp_a#ah8aDf
z2xi>+bMygLB{L&y=-<2L`f*hJt1U7zb+V62Wuq@(GqwfM*+qIUi?b%UjQiJc88=E}
zZbg`=PVIo-B35i}MXHzNx&>1AbIGLmhc__N_?)%r21F-UN^N2;Ax2<mQJF5imfFuR
z2z54=c#<)(Hhj{nk%nxRnmp<;?*!G)L(kFk^-7s43R5+1qn%NKwf8~6{!jNuM=vaH
zySM*%JBbH}Hgy}vK;0sfup(fuyfVy<UXrlYisIte_w-gfZL3v*SwM6ABwTg);sj*|
zeBHRtNZsL*$>`E=`)Sd3>~N4+{8>;SQ-BJjV=S==oQoKnugjRt&WO*>6h^ih4@fK<
z<2_-2V*WY_Cw^(yHl-1VuGClD>}5G8hkWq<uO+U-(4}_5jSwTk4YNLj5)4p6(ntUH
z$?ImLy%4|2C-p$Dl)P#Go9t-FUJnxB>smpoUKQ{Vb&i2ff8_{na*X2XZ)))}b9Cx2
za#R7{3!i6*#&~t1N>@I%di?6XOj@yRYp9xDmYGh<KB(XUAchw@{a6utQFn}9pGw}h
z$)jEtJV8bPc&<Vwi1kh|7auzlwA{MbN!q`nC_QiZ<d8!|eL}9dF_FV3D7mcUCUF}W
zW2-?lc})H&0vn<uN(R<iWZ`%0a0GC~Vg#K<6vCH;gnN*Jbp;dy_Qc|t$Sz<8BcZaz
z&=5}e2+xU!<bYg%5TwaWr=0AO5BN190wZs<SF!gw23RsZpZmve1EYwhOqfN~U>@&t
zLNQ0fJd!ed32{;Bx-kN4-eHj+(GMR3E{z_Kh%>=1avWQDgfl^~bMh#v9S2(Po5h(7
zSD&m<-$5*W>(2Be#*kQH)m&h=?@RV#uI6Iu&sn;jm7P|SyjKRdzTJ=cGX2)u465*&
z!ol@xoA>jwvg=DEqfNoAJ-C}9$r}0LGC=`kpk@ua;GeHqj8eoe?%RVmardfry}ij1
z<6#0lTX%t`5I<<dv~!DcV4y)bA~J#u2P3fMZ76}j%U8^t?*XjOxkK?CgM<>>h>1@j
z=Pm4{5S2m*Gr<x2wI}TvWrwiq5?KUzU91IrnwQdjzo({WV-iD-1*G{RZ3c9A>n38c
z6hf!R5nT^^fs*cNz~s+wNvJ&ij);rR08(>KAgRFH74g(=n}N0(u`%pTy@kvIWyUbV
zoG|n2>&?^jkM<eXDVLbR-Tcr(^hUa(v0dNk#LhEo!6ONxa`*r{`=|nF#U?WM><830
zltj^kXvI!Gus`3Jgb9SuvB%V6>4cYWeFq7*koC`g6XO#8x`)!?>-gHG;nc&3Ff#L0
zfw}p}XcofvjOEJ`2<`w4GKm9aw=dCVPr<M!XKwt>{Z!><`Lr89iwlDOYq~KsveHSR
zLMT_)0~j!AW;I)PlTr&S+mJyh$Ap!W^`gh5Ha()`g_@KJFb(p~1S34(HVmo&6}P+1
z?DsdE=P;k|^-Jmz0xG%Oi;hRa8!tWgdbK=S*<msI9?KxX)$g8;_Mg<(78-Q;v<M0H
zQ$-qT;-Go^`>wR3Xa;nr-tYmrW}mDu>yu{Eq&6jL*`gb2j=K8c7L6R@BLROub~37H
zc!y}h8p;-pb~hD=@zYTxWmRH#yI^}bz3simRyb?7@Wj>#B{E0kk7bg0TKr*gtmwSw
z(#1)$@#6OIi3YLs&IC}E>OGMZKu5Yo{`T6hbYP`7j;d5@nUzJ(F6_nP=3D%VNL{C|
zgdqS<?DV7c$7i(b84h>ZKe$X&qR<aExa}Fkp`sXpnA>v9M9a1m@*tsLYSC3@XQ0+_
zLAnpz%ox$Upj%ybTl|AMn*7zO9n6nSxb5yiz%lq6e{Hcm3A0@8CWyvOkPT(jWsY1c
zBh;;L@CC^Z{rpiou%!nO55DyQ7dwE2hkXcVk<69KCn!6L#W95*xLj|W<=$jbLN#V~
zDb?_EC}9#`vf2cYX2?w<9{cVADoVCAxze~asv!5|u4WcFDef?&%2FeAw&yJokDL_J
zD`2a|J-FBWeGjcEM`B&?@deciF^mrsHr5aX;LbS&)L<Tla)A1%k5te2-7wa{@dZo)
zIG~@yk4#8PJ7M;No(aX-doS|pjZeAot7#Sn<KFa~C>uH6X-sx;&m9#|_aDpKOP%Ao
z$=EFI5gZtKEmX{MI~zYQ=FaHgVka$ZK5r^u;_&cO!K278pLOfUXn}ys%5Gm_e);pA
z(5eCa5=Kz|5ELM?5q}BGT$8nlkY(|1yS$`p32f?D&iTNjuSr(}NQ)JLlE4^p9vo3i
z5t7mF93N^7*d3y<g|EO%3A`da(9~j>{&UUS%hGLUUCDNLc{3$v{vA;})(ybf7C8m%
zSl7ixeJ?=OiQQ(j>YtnR5<#zN{~GFU8poWy00~tj4?`wWf!%)UAK99#+0Ps7*DkDv
zO9pvUVeL@u9o+f$kb803V|D&)sl48Q?J6%88JuLoHqXTxqMhFVw|0F!O=Q8$VM+z<
zZCSmOu6@C$&BS8z&38~ccl#|Nb68MXPFv3{@<VV?K}740t*z<7(m31Pd3ULC`zExx
z5?JVi<4CZFtrlHSP<9S~j6*2h9xl{Mzb$mhddnZyxGX0)uT&a4NJYH_<!j%|dqjK+
zWz`qo%Z}qMca|8zgkr8gee9waZD3U9FXF+$0db6?L|?d>*}C8D3mwg%%JhgUH?NL`
z^(VpRhN@G&)8!4_rfAG^c&&*IH*WS=e4vpyrflMEOR>JZVRxLzQraLJNzR|<oTGJd
z8rK2lfc5)M6OK`jra18T6+TRh4;-dBRD#vcHo801&J9_s&E%*;JE?b?A$9LxtvZ+1
zPig8pH`ds8XB(i0Jrq>$OWQ<TlYXrY@M`a!4wiU{Ht#bV>%-Iin@fA;iTC|R4ieu>
zoP|l8IfB)DpP>fK(&CI<I|?Yl?VF=(D(8cv$ej>cM@`P#Reie>7*&ZxS`<C0IJWup
z+=+hxVLLm+(wlGfIi*v#U3S?JA8kTg)h_u`F&Vi|VC&Sd-Erm=t5_5aVQ%&l?ZxVO
zFjM8@r^WB8_IQgZ3THjqWDOP_y`@qWWlWl5&rJAK0CrBrahZA#*1w2sqPrdpn;v=6
zB`An3e2L*eb8D3^Cl@aJmv9UqyIWggEYORkHax>4$Z@O?+sS&lL(?}?S?mixf40<i
zhGzBt+^lIitqWB}Xn@0ZBDB5f%z%q)DlY_xZR*POeKDTVRNKlF;c=L!&)8?D$UjIM
zkyw{eJsXf{56XY#s>WN!%{;)i5XU@Wv&1Oxg)D?Q0PI|l>^aeGm}rS%Uw`WKre}!w
zKD31`*|$Hr!-SJF59UMF8c9))4yB1`Ng1jQEz}UKNA8kOJ((_j9({rED34!YZ)maP
zQj8QDj=_LV%<~9Q7^$HPA4U2kZ@Ev5$q@_cs-cf~PHhnDcdJYwU!th|9oxK~_t>)U
zhp6v;3^r-4#_DM47hF_lm>Nf<TW?Svg#Jam<fyW_lhiUte_yWFd~l<^6v>`cZMo>b
zY<{wBL#@$nWQ_G<G*8GRDKb8MTcBoPG(fdjR^5?hdN|)6?nx^bfm2ese{WUEggmCp
z>n3%SV1UK9WOluq4vhbD?w1PO709xqd-VY4_>>@25z#r>Jj0)HL^totft7q#-w!XY
z7kgz>hDnVWK$3?Q2Adq(+v0XjgDBP_0bV~aPcP}|z-)D+*eK!Y0skkKq*S&VEa@#r
z!RLbVG0k3@+v8-$#6~Xn`A_b6r+LJ{MVp9bs_9A{3bX}hW381c?UT~7i;)PcrUBR7
z3NG>UJ55fyXJkUQi+>=?yjE%O<r?W=vN4A$laoJ=G*hhvv$6|L!blf)jz2fQ62dF3
zB@HP0!l~K3_XtZdj4nStNT0sKE`@Y1wQ!@gppLo-nz^qxNF4vKGzVZIXJ_|t{80|_
zm2cFC55$8cnel7#?6{2MC2jhZ-9$k`!{88GA%Zy;p_`%5Pz-XI&xtTG#M@p>g<!8p
z>(TfYAo&L5un%;05erih`@7esBQksBbEVumX@=ac0G6_}6~6)0XwvdzlM<!mi(Yk(
zoimsgPT;C3-*Tq^e~&R(e@qYs6n*7V2O|~=(eTu|{Pcy%F8^}bh`UY+X-LFa9$CT@
z(AWf+#^wIGu7mOtb5(4{-^bTvw?_kDNzn3QYQR#8+F6{&C=&pxdRT>vsjp8^zrSXD
zz(sgx3jdM;D75U1sS@&$6m*=rSI&oeBh$3Dbj2Yl`GeQ}73twP4}!V2I{Ryb#PM#?
zmFh|1yz0Yf-Bu!_@E76R_|W0n(t%D>6lk@j6);Qb^I8GQ_ST$b*5{`>bCWU4@A0?z
zu*Vhn=rX*nVdTL4Gb0w%D5?1#t{$G+hqOy09~$o`J3S7#o00JT>IPZh5O8|zP*X=&
zlzzKC^ruk6md~A#ZJXI*7XUjAwOGJ`OGz;+SbXcvWJ>_M_U&9nuYEjlgl512tDYcF
zeug6Xi`ivuj9Etn^S#jXI`hd(@WmkqF5C^6b|4>d0vd6Gghx;?BL$1fu$Ws%%sES)
z8XeUOcun`{UwSJZ^z;zV$7P6W@o*y5>n7MtBLKHewq*<NDj^+?bQ-~ScsJH6o0pS3
z8<$p;t6er0EAf_~7EKoV<FTF<=5+<DN-9?4ozquO9{OL27Rw8LPERX*+-RlLB-zj6
zVq<4Gc7PlhC3S|Q14^~hj<6QNdV1-UV5C{4=0$XhqbEQY^oGP<d$r)_C8Fdc96>w&
zlzQ4Sn`$T_w~mmxK-4Dn5NNK-#Qgg~`;L9o>Z_53EqC&<Ca}Jwzg&6<L9BldDU=tY
zp3RFRzCEJ0m3+Bt+vs`*Yv-uZXWq&STIb;3sebJ@5(~1~r3Lg}a^|qb#@|Nk!ygP|
zc<@_E))Pw)#-F*V65;l;vM5)SBpd!s%Y8GBp|1v{umYvH#EFPk<FlP^&L#uQXtIx0
z*`1g9J<P<!D}=WXl4|>LzTCTf_&Vjf*KcE3$`L&s%l_9rwjLU6!X1i{xtJI#ue2LN
zO>`m6uM@6*2{pnp#xg4^yg6;ep|f~6zQ4Xp*#g-@+W%Lv26T9&xyH=BbHT8stW+aT
zaZJiH|5v1XU2GKz1WHWYGbOPi2rQkMO2YzVQFSm=2yN`Jmaqy{6hUVpdy`0Rj}8^9
z8iou9Zt{k`Q{_393f^Ed+V5oa+$1mWhyt+PaQN%p4{dzwAzJ8ce<@ee+<W(O<bud_
zm7VP@Wu=GOj?t`7@7m;5)X%31Uf!nl)%tBZ%*pSk3iO_zr*It$A5k4;pAftIUV1|+
z)eKRNgV~8gP<wlkcX8bSC-?a}n59#&U;%+qogpPJ5CcVu;%-AQSJFyo(j@RMmn1Xz
z5NEfF<mXPXI+7^4X=+9n)3Iz%K-svxRQ4B;GMy`sC73Qyq?v;gu~l3d`{_k&nY$GB
z(UbCkm^x>j=)0_8*C}S6_ZpCoRe*r^tVX;;SbG~)zu~>W<z=PgddJ~Djc4Aq<3yed
zhq`?Pa}UNRnC-qaV+705q6nI82h{0iC0UP!r`EK$!xW1&|GP{IRK_<Y8mHiEwJt)v
zGX-ReWFv!h7sHG5=t8chQ&Y}U{nB-1LvX|k%=@#U@wur?y5|f6cY;Xo7b&fWs=iWp
z93$!$a}%M?=Z<IV>dX5pObdWhaN3#{JnjfesHB>_7t$q1)R_!!&~+uYP)Vajx#ooa
zCvWEpO*5m7L-*z3231+Cdxs1~vgm4Wkoc2iZetz(7T%*3nUvpr$d*3)7G}<$!IKCK
zW!){<n?0!>w32gwbcjL_v7PtniGR*+pmn3@WC;xgSL5ty-!??bG0J3rtHmoV(sy-X
zGt^(Oaj;E$CwLgq>1GWO!xYUr$ThHG343E7qU+maQ7PQ1eY^+v-FjUO<UX@p9~=KV
zc(7pDss6DBmSoz+?g`(g*p6F=!ELo84>BfGKjFS>C-@J6;|gw_c4lGXAZDi*w0v14
zO6F2@pY?YfY=GIK>Q|=O_O|Ra+auc|m`75mneF2gtcBXau97fjRdb1>2)-bhM}2oC
z?R#nhO66kAMmQXRR8E0}Z4~fNq~(%hUtRt8EYjj*8<nXAiHs9M+ysyBcbH^#2R!z8
zO#vo`Nq-e9B89DFF+Es_%Etni;0mb8D5%he1(2HzJwmvdAq10$+FM)Pld~PUk(0>`
zB?sDoKFT3z%~Qj>D$H5`y2+|Z4O-N=1kEfpt*TBhiYTo>s7Or<v&#Id>TI;0tHi3j
z{(*Ew^<;(fX>44{*j8Z^UMa7z(80oo(k0MF^%_q-s!CWF$s#6Sb6G~29FC`Uc6?%6
z0BSm;?ezLVlf%}T1`#IIZ;W-)W<%uBQXAuc!Si`c2*ARBO)s*vyER4F1JKJY{*q;{
zvnEk_tHHM$bt}59m`yFn4l)t3lWfT7%G6E9;n(?g+5GKC%hATvY+K*rOz)_32YcxA
ziN6)q@s>6lt96;8KRb(u+_0vC;4k1*Sa}_hj?&jtH;(wW|Lkq3)6-Xf6hr&s)X6H5
zDTEZL=ZtmTGsYq4Ik@i~I<~hY-?YIwmg4$rq22A5dpB4iFrp!#Bfqq}-_Z^<3V#KC
zC9wK}7tl&}H~d^5JXi;$wiw(^!nxV^Z_ZC<vTRv=2+r|Q?$n%^$SA;Qp7g{it_^Sl
ze{b<(n-dn;?LoaA+HxPXZJ$X~^><(g-Ip-`kVso&wP&vuY(4hB*QHp*J2cZn-+lKA
zX-19Ap@y7VseBsoYlcu{F)`F(2O@y$3>05qWx8(zWJkCtgB;HYWzrrK?CnPjtz0oL
zSeh&qQVtw5+5Qlj5b)?b=XJWYIeagR_kL~N#27+5wtLel`F2*ezCiM@6|9)dMAF~s
zL@pD4WKB*q-0rHw@)<T*8)#~6@Q|rCe*yBnUufMs*W+rFpNX0yn&K9*OtU%|T#XjH
zs<Qgma=M@mp3M(Yux&x28A*>wn}<VH{**fF5NoeHwO&~@?HNC13A{kG?UG}r<bz?(
zXdr!M5;ykVh137mt{lPs{893>V*8L{&a2u%*}Zu{Gv`ltk$Y~p=0mG}YN>bQ^xCd;
z@dX)XyWm6j!$0Sa(gF@W?EAxkBw2YqWH;F#a}?3%$73=nl}`u>GvXHM&|Z1)y7jB6
z&!BC(jM`vY3d~!BaRx&DqoS%k5$aGsSR|X7!2?wrmsI=rF3Ic9`|1@rx@)JEPuC*q
zas}n{R6=wf(#N{38gw=$(<SP!8}If=H<Yk>{}e{7n+cgcwNh$nVPTC$04Yc9$=Q%k
z3$%>Q9oAAtkZD&ke`}&v<CHx?iTIUCI904!gkCFy$|M@;vFj+GqG?-EaCBOczgi^U
z#ly5(fQFEZqW#Xo4^1`nF3A7@?Iz`(+{ttsWz^S!fXZlS$Xif<_4$(h^2zwvS=4{T
zq)94RUHZE=r&=#RQ_x#ZhWn-7&fjNcWsb9sav@qNB6DPAb%wKkK+Rt%?u@dg&aAFZ
zt%H7rr^DH^q;W7@SSeCpDAM9T#X+0K&i2?8p1-h^wm65$XLdf&7o(~{<y?vCicHl|
z-remQvNiAK*(pf7=lNC0>E=TrE2RNnx4<a3ME}T7Y1$EAzS+=BZevsX6smHWw9Ieu
zb7SsTxk;0`?Rm!ea8c9XwVFiI5pMtC9hx&+L(_t@YPhkkX~pgkSZ~n6T4Gl|1-fZI
z33?&|%06=lAp>EMNuw@-cRRKhsKm8G-ACsG`SGOE)xpJCD!$ubTt<FqZC^t25og3G
zkYYtS-L_qAPqaUfb56+P)`*UWf%l`Lbk&RJV+c4qe*SeXt+qyHz7pSMO5dAvLkajL
z7?%&YWr%z8y8L~k!xNx0`<e4o`kUUBl?PWV-rl@(3EMgz{HNo>b^*BCZ`Z7?F5>!Z
zrZQWhO>i~C@lqw+fzpq>kUBoY&A2@&>q}1;nl(hsyO?!{+>0IYKT47LeLu7oK6C~?
z%$*Uug~BQJ&AkBFT^!alay(d{2E~Z?%dvkT-u~5ux!HrE)ESK`7Bsw;_wU$9-`-0b
z^F(5={8IV&2SENq0#Y00D<FYG`jp{)no?6Dczf?%hr=D--QrKSknabdOm~dMm|6`n
zhNfn$t>@+%Xqr)#dA2pZcTt?k$Kt{uuSVP42}G5fp_-O$$tIEAk4J6jWkpnnb%aYX
zaP#ewD!nVdcV;Ja(|7rt_1EdFTNyEVa%`58>%X~PSO=xg3+q%B7Sl6To#l@}GH9O{
zE{@M)tz|6nAs;|1&yc41qIUC_II-Q`N4Kn|akp0h$HLu2P7o79q3Nwc-UZouvtsc6
z70<cyt{LRNb&0ibGe_Wl4(t*adAeclk7av>ecIw&8jwDFxjdui&Wia;aL7bH$ou_@
zhEKnftEyiF7~)CarGAH)i@Jo=vPBp(s>H#qd&<R!F_zjwlLbtp>OVo(XJ#Jl+whhe
zMQU*NxLm}sQ@V;Qc<rTLJVwh7xaa{lKkx@9{UphrO+4lAp|=$)rzacjwLloUIv<JA
zL*0t~kp8&{M+PTh#SC6a(eU`=Oi;jY8l1dFyk<oOIZ6;+(@f6y@HpyrROZ9NCd!oC
zUcPU^305<w{bNkjJva7T`5H{h0o>PfBvXLH8GsLdY~hF>b!6k~T9kch?*_vvcNfZ!
zGZBNQH<{~C-Z)*5cLj$@G4H*`@2-7WrB(WL8@0p-dt2j;APJU|nSnJ?%+?lZP&!-o
z_Y~!+rkSl5T{}Y#U2+8oG;b?5cb}DUojiB{_4d*DJEgMu9h{SDQuuvSA7YH7>Vl6)
z4eVlofu2~lzHA~_X8nedSQevE>W-jIZDBc69v+1LP^NKeI8zSizUWc@$4gEf$`_U-
zoLFzO&a0wzphwur>tei)`Zc(yHEr{c<g5d=?0VAqM~2_rZ6=DPyC@Ul4GklWGP<3z
zp@oKiJ{?K7-K`_4_x?dD`guJZp?Nueiw4|*w_XX$gNrTdy5Lv<|4NDmo~9sf`$Jvv
z`rr<aeAV#|j~%)^%ocL{uM<eSS1LrUGWR9KE9dfxoJ$(2-%W*X@mIRrikcN_N<+zI
z@2Ux5*Jr}=l`?<t9<v2hT9noNh?X{d#P#6GyYpAtqY11-<KX*-jDc_iqiBac5m>XL
zYY>a6%`Icuz-%rbvwJl>ZkBlelH&Sx>?+9K5^MDr?T)G@aN{9MtJEB{Bn!a&QC2pH
zW$S9N>QiGCh66Ko>n4egfPR1pe!cL9M8bx0j3r`4KEfAs<md{(zI8kZC4udKF^(ky
z<H$QS`R8j-H_a8qKCr^9O@J8wozt$?7y%MloUzt|vg*`4zFY&I5y@h@U=(ZaWX)s1
z)(w-za(u3qjtgo@bFer0ic+<STK{kSVQU)GfUTFCCo40E)uyZ*E2+-Ycvl0dN7Z2P
z<G8b9HDR|i^i;Z{Hcb4zF(D4|F|C+eYzChH!3Nr3`%=%&)t`z1faHc-6NGf|+Sl9A
z$@hldAg;wF?o@Y7R+90dH2v`vI~vIMrb;y>rxJnSnH(-u@~aH-YpUS}2nMl4c~_!l
zy(o)uceYUEba6)nvNr4kfecs9;1)B9WEZR8@qPA*fCGq=^1Q;k+0j^{y0bSkZZSB}
z9GvQf4)z6-h)6*=$`+2@yQ35nPw9E)8}2k%($QYxRnc=`gi8Qn4{~X4pw%&D%RKVn
zAXsEgEUV4F0a8j<OQA;Q(FLn=t`~xD48hW9{~8x+*G^W+$pD5r=6h%O_!(n=OyXSH
zVe8nyrix*F$jkS@q;rm*LMyE-Kw2wbNe!ZKz~8$OcHha;#6c~jP0|?HNYbEOT~~TS
zOeE`zQX1EID-SQ&NR>Q4?}dtrj?7dUtioA@o@<4ek<Swq{y2DvKPUDQ+>Ub*cSY1=
zqah)`y+^p5@MI1z19yCEV*JvB4#!bN3v5Ms&oYjnKc2e^2|Aynriy(#8}y}gB><cQ
z<Z5Fp(BVm?Cxe#bpqo`+572CLs|Igv7!N}~m@6hqfqU^5avpff?j>hIFN7-!6Vpw!
zC+??*86E_4BB@wi7!X!QwM<iDpplhFEp^G*@CEgzd$9*oaG}z4t333>+wK?!=G!{N
z#eBIf?vH^-a20}?8p`$~!Bf2pFxx|{IS9T+_!Eyq-J0gl((h1vhy;!GOPN}$Svl_%
zSn>;B`4HgQnF`x&@unx%W^31v;MyJzEcoM;{s1_6<LA`}2Kt>J0pHJ`1W?GDGfN+7
zu@^2$c_f8GZ=IEy`Zc-qC0U>S6XWiEr%ky6p{C7<ydM`%HLdt}nYm&GRb4d8+3QLZ
z4{&<;A<~~FCE2U1wIwew9_<-I57X*nkL`h6r__UE_F@@qozE9goEra(sa?W%tKYNk
z>@e=yAp){yNX5Q>SJbmW{`v%@rUsC|Xww1Dnq~VU^N6SXxm$`5B*wpyW-0W1ZY2Wi
z9~j*+hM=!S;u~@VJBqC{+|f>m3Cu+KK8Ygo6P^!(lRmNz47qvtMSKG>S@@_k++qP!
ze++n;*(FvLDA_Wf?gKH9wC<68YS{o&_qozS^+~V=U_83e@$ktd2jyVnaaAnDkK|+D
zt)B4am`k9I1^*jW`{%PFIQ{1)A(qfht*TRji>_^b7ish8J=2kWW?!6!PZ-8~e5P&S
z)K(qzsaq1`$z;zwBq`MKfwb$gl{gd}jiOR^)<<licyQz;w2?jLP&$rF5-Wfuc@hO|
z9dF;Kpjq3R4J*<Mfxr{{4{${Nad#NP0pGthj}I`Rkib8Oi{-hs1_JX#5yrj<L2gk+
zZZ$7Fih^0f+ExgEpeE^}I<xlpQ|=KEnL#L2sU6%WR>>u!GE=BzE#<znD#^cc>x0Q>
z<89JLd8a%VR+~`H>e1HFfX*y*0IcbOKG1bNkbU?%&dZZgNb&I;lV)!YdOcDGdUUTE
z{5EY>CnHhEkm3Q6<J$iNzCc00LH5Hx7bN@`cdma;!UgO9V-R*kKkc|e(b~iiMywZf
z-Fb$BT69<PC0SCjL}VFjj-p`ORaGn%KeD8D7<-qIciO<x7TcLv`WazIV0VIv|M}18
zEm*c+<T+uuwoKOg#!0^gX$$^4J^eVN%yO5ZITX!FI;BD~3pmmrx8$LmfdgiUxM`ea
zh=j$T5KJdSCv%QeFhL0fM+MPz!sN*;A@eZ`B9zZ4%4o=QCMPrvV($#Sj3bvuc}n1q
zymLU^jeSIrPj65VdBJtyEl8N5AVUNI1mkFmvS1pK5Xu2SuS1~$<dS(pf@zeUou0xh
z;lI;UkZ|X78hMa#n32-+(^K>=4dOJ&gN(w!vSJbZI7JzC7io|$5rO$cG|Nz)k|1JJ
z%7f`FrzuJ*!c5{Ya06HZs7*hUc@nZ#(T6+@+#Dq-&1gR6>*0nm7)s}H6yz~j3lWC0
zO9Utn%XpEZSumZ^EXQe(U7>`=Nl4Fb<80B-)J4}MK@N!`n)W(VvQITt_8siHwt+Qj
z$=Hz%4XZ>Zs->vZq0W~$Q|fJ<sl#+s8}w4yBK3(2TB+MSh5Q5pZMGc23Cd#hfx5pW
z8FER4lE%4c(qio}o}mxHJP1jO@)!}oKxtew?-<oyj@V^=)|wf;Lw<z~SrqCpr7PMf
z_$RFQZ_l{Ci5JbD{f<fv)ubp>AghQkfnRSJ%}7=uyIhW{YCQB4ZLP-2)GIOX^c|IW
zCiJS#Z_nP4EJq(GjoA1baHr#<l(R&?J%fAw+3y#v*r|Ml@;E`V#7nO%4KI+S@js}W
zmyJ!<3r>n9oA5=LuxU-21MPewvf$skA6O_qi*H^;BwXf!oAr~`MtLx&%o*Zy{wj^<
z?+W&bvo3S`o<vjH?<^NCNyNJ*kxRY5!nQ`!?yM76N&g!Gx`&2(IW~=^Y2baJd2e&m
z$PdE2zpPs+l6v}4_46BZ<8U#L-jdv90+=ATp59({otL^#)xB-ybql!zoN-UlPY9qd
z*(xwGRBSQN=c^~5d&ztKB;W&;W1~eBKsDLyJLv=b&qrCl<j`s!b%Qwx_Yk&^r1a_~
zTK6d2XA=)PZ0t%Oj@oe4HjvA3)Q)!4fNdI1+Hlf_lXlxDts%h-M{YQBPxr`mE!xrS
z^T#pGAx*m*SQYowWcCoE`JVTep+|F)PFVo*NS2b%oh9~!cwQmOLA@icA6LmLp6}VR
zBV)(%RICwG!G!o4CaOea%Q775nUB@X@qH04gz^+T&mbiq0<90ih((ZbUF!e%F(uI=
zB%s~@gWEseQ>LAd@}_IxMEt9aLn{Bm!kn_wAueM|eZmp}ausd;TQ!bCMF|RjP^@|+
zC!m6DjtK=(PSa}=o}S)@#vc@52qRhRrR(=R$MFdDv7>?^S|Jv;6xqe5?|LSsy6SXF
ziTuQM{TqBxw-egr5bE+s5VB;(A<fY=B@w!4Qrp+X$9WKe8WdfiJkDGalJumeuSa!v
z&v_8lw9w<K3G%sf6AeXn)kNkJ-;YBNU7!>cvZyR15^@I7i5TgG&1Ve82liLqdGXgQ
zrwRMDY}z3i{TH?kphwSX8i4MV)`xh!WM%v2ny#BT+LmYGtc-qVTqNok7&&PV8swXK
z<dDW{LjOh**cWtxw&D$a$t^h?c$B4y-Igz)tw054#1?B2i9pzs@`(I9`bQi@=qiZ3
zi;((xya1#0Nk!+~5}2<!a#waTSdHocUa)gkTP}9e#wd<zg(@pjtzgwG32Eli6ZVG*
zlE#x32XQg9G7BF!hwU-%Rr}h>Gqx$u#`kH?!X2J-FW{b#am(6K=Pju1-p_o+)_Rn=
z!$G?D6R#V7k9NZIl;Aj>-p?~G26y-=Z=3rsi~QbRZ^hUSpZNxVi2FBXLGU+0J`)GD
z^Q?j6+4RJ&h9%wGiMPZ$b)0^|AKl-XmFSC%S2@D2?gMR6@KgY9agWz(9Wi6v*H=aw
zd}X*)9tIJ0XC%$Ldpbkuy&PsfzxW(vg`*H7f$qxTQAX2%W^af?!&>LJ=0C%`E1bgH
zIO?7@kPt==Z5`AKix=TZ4k?XB_rdw0ZKc*<s(n}M;Fii2OR4ugNw4nVnr)I@j<II@
zG*n-*?^5v6ei)0kpOahbvhCMYec|rmlC{eW``=>+wbQ)G9?r?!!{elt!uDvVwq#^^
z4_B*IFxz*n4r^wey6!23Z4m<wq_V%ic!#}xmyIV^c^GT9A{6esY*4vs?J%kf;nDmK
z{FWck>TzLe-zkHac3*mV%#IXA)Uy0UeJC8)p+3<p?CZLUHN}=NaeW^vhAq3qw`_}&
z$Ld4z9q}N}(f0!voqRP$ctv#F=}N(j-D%}d;WQeASWQ}EB}63K81W!v2>*<Q<+~B`
zmQ5;^j<>~QqOyjc-LCV5-phGHl}tl+To*es(Xpme1zWB}u%f7z<vWfq8}8sd(ZhM-
zNL01%Jdv$CPaGJzSg9h}^TlecC?(5izvAaR;;okp{F4p(ex}u2(PTExM-!3jJK}x%
z$QSR^JDNi1HJQ>+#X$#qzZWl@ke)EakCWzT&a2NW6B?saBuml+DPz%Li{kXRXK=-c
z?$K8)sB!y%ZcRZ-rqh%`O|#o?h(TP_tKLVZM0=u4i7r`^Y7h&1wqavUa~13;o`PLN
z@oe~!?M{xJyNc{!Sa*$ikBu(3m@yUzqaVPLw}$y4>?u3j>AmH>H+yZHch`W3<?rIu
zE5mIMTwhKN)Sw=v)WM$XQLM?Hge}W8v29Y{G*wMfo$bh?+xywEa-H)?^x;Jh%onk5
zj)*>aA?_Eq{tcTUVpM-|Il6%(_gt2wuf9eOBRK5FVMvmUJ}-VLzB~u$?yoCQFDMzO
z&;Kk*s%jWtUyc|y%r`m5i1{Y>%3gr~#Uu=-(Q~loHXB5K9OW3E;pd8!d=~${p`cQD
z?!=+@HSgzU7UcA6G2pK*N8i4L@i}qI-s1Yv2Y0|l$`BpCInO;lobzH_=WGQ^9GkZR
z;9<l*WO4BU>Lq1(7ry{sL6K_c1zt;rs-hn$nREATw?2poisBr_QMlx+;u&I$Xcmzq
zo5eYTW1Wf00(%2OKCS^VrU2Ox@HV?ZXx>x6$KXsS^#Yfn;GCZFw*MD0PrgQt^*KF-
z2nW_nFi&Wj#gQ2DoB#$*yvWe6@84t-1b7`wl(D7YbMylSO2gqpf{0Jx_HbqRlI{a7
zqk5)A3_`Fjdm1Dga<Hv>GFA-F_btQs4C9N$F+2cw^S@H!0S~uE<mXKiucH^uDS#Al
z<Rc(N*u4eI!NSFt<%COC2~BY+Yi9{bub`(4;A5a#v;6{-h6Q5;fZ3G=aAUz)LDLWr
zGtQ9k-sR*8WXm9sn7|_>eJ{xJAaaXY%z1^gZa(dF#ami*$0fPS3)v-ft6TL(Ullf{
z*Y#sqSX?egHNW^p&_0e|)9`iV$5qLNyE>3x)9_^&xK}F!`PVqT3S;8ch9Uf8YC{Yn
zbaFXj)xQg40Oh$HO`3oBZuyZ$B+B0be%11FRP#0W=kCf_UIih2TU;{2`v%6pVN@jn
zis6k{9GU0sZcQE+i&>@8xf`6?+7P7~O_W6R!G)^^W{G}bp6~JmePr}k3rS$z&dC+U
zT)m7w)ck`y>J#SYjija<P#I59a|rq{7Vb{0$^CuuwoHw;QO>ZMnX+kSyM}SxnZwE1
zb83xaQ$=sp=BT#Jk#~6H?OOx~QzE;&KFpZ9sd!ndnP_dh#d<yNOyK_Ly&dI|M(k$D
zP<2^|;p;8K=Up9l_;BUyNlkD!wOjy3%gA{zw=wb~Ujfy|)aF>t&D=P*ySf8}iZf1g
zP(i||Nai+me_}quWm1fI00`R`AdF$Gc85IMM+e3#<{<}5>znv-6?~zi^5$>=|L#WU
z5lF5_nH(eO{ioI|4d+3yWFlL3SJn6iB(vM`2sj9HY){0o{qe>QMu|8MM#OD^KJ++2
z83puek}i*OjCwr@YsW~rjVoeJZQG+NH$#ocB9BK8(EX#Xx#{uTJUWYuDw{f?RL8pE
zDOhs>R6}-EZ0Zg*ER`C*?>r`p%Zd_~YhDMVON}6GN3s>!$G%H_tl7SXEl*dl<hh>g
ztE!~w+X-SYx)cOB7+t=+(dCCZg^PDuAft6NvV4=2!>T%#jpQ>-;9o&UJdaa~vKXMp
zb79RO9;mko6E{Ic88LeYw?fcj7=B9sxu8)VE?Jo*rPm~6|DK>Af0iK^Ajw@4GQbat
znDr}<(LWb~dlfEG;8Adr;k8pr+?=`nFkFAp+1WSeNja0>woc_6=iC49|M=hkumAV|
z{@-2{cAa-=4EB@f-0P=MZ-*rEGM6Oun{($|X#e+<S)M1^^Yil}hrrpqP=ubj@%)@u
zBn6DMdhW}XK{ZFhisiw@ViRmjGR3Z;nTF*Up5(db;Hm_MqW{Lho3o3YOtY^PUHzT~
z$^_ALeAujBEb<tXy&iHF8EExkZ(yPgD^r<Y0ibCz1W8E3kcNn`J>-er`Tmh*8iyhB
z0%6)f;UcBk{;Q-?M^{zT!j`RgSTk%L6U{cUqI(k2HQACW?X?6S<2bCQ{~@O&e7XPd
zG|y5^S5~m>IU3e%*TR-&7+8^Q*|t1Qa%`v9@P7I5`sa_;_<sHQr7Y|6`H!<W%Wu+v
z<)08cUu{a2J>y5Vcf@6?odcHLk%>ulYGTdNRIHi0g)K|cv2V&6kyTkXWO5+o{Sdk7
zG6BjH#+}vqfJZ5SC1p9u>A4?7Byt0=Kv6f3(*q`F=(1-RHo=;y$bf3)V8^iytV=ev
zHAi=R&mNaopU9c=4MDS%`WKg@qPuCl(vg1?2GP~|e}n%Yco&MQsJ5(Lj>LQ}E=Ql7
zkVIFPqqZf};2IbF?Q>vm5x?0t8thU1if_IS!WAGTUa-iX>wGi#Y`%pwL6ALyxgYY&
zp0IDX={YOinK&WsBTGof7bGOtv}9`OnD{_xGBL32`X+W%$FYfId%7n*CP8AAu^42C
ziWW5AvMj?>v1KU)Yp$$e;+Q@rs_A&Dq)=7ap3iNNAqv_XWQZ>>LsTv%;9m6sUR~i7
zkA5UMy&+5Vj;2go7r7nXxVEwpzcL5?`6A2%$gg!xBM;JTaa6=2Wml5M-U8gbAeT|>
z`^<?1xKQx0Dy+<B=&$h&y#{zi$hQTd0x6x*C<Ct-8hJR6G1%5flB6+lXaDsd|CuEu
zf&^epHUVJ+oUY0iCn(`MlL-o<YntT&_bs2Glx9gBWt0OsGVIVIm)L*($A3cZG8h~p
zXb}Z|0P+$<DEL0KdktguX~cvW0uYP2JEIu@#?j9%r5?{4MZw99xJw9y$bvAYUi)rj
zak${q?;r|UCF}Nvk~CtH-8!#zb91x8{m=+6vXTcocfxpju1Jb;E*a;teqI*FY-Yfo
zunojT4eZd!oy|#l6+}~fMVB~;GN8o_0|q3HBZ`-lq&W65#A%$5(Hf7ogBSg4FrDEH
zwjT(lnN|zXWrXjMJdq?xB;^wBQq)5jy`oOKAnEeI{^NhXNYWrgFg<kA;(@qAn)R8D
zi?zH>cB^CRQSm(4nrlg#Z)3$WBn;9gcBpP+-%(|v`M#oj8TjCP?{)`d$gZ)I*O5m*
zKM%mv4RNc_IdtX({SDG&!r!^DRD}G<09v`hUllC<vaOZjK?;<88_cOovK&5Yrd57a
z;p4kBj{SFW5b@8JT7K5x^IzjMqB*-5f_w=@EV(M8LlI_+VRX!Tmvy=PZov1~X&k+a
zQ`Ww$nAPA+`1&15Q{pZ>!anPkUVgUV^Q$1GKP)MHRAkA7Z>yQd1UO!GVu~B<as;75
zu%r_x)jYr}NB11bKk-w`Yq7QG9kExBr9kV|hHz`RwOFKDa<X2AdT+t?^>0B$vJ8!-
zGVN$|dK#(DzC_Nl4J3R(?g{yBbC_+*L8eJx^~*qZJ8lC9ZBWOP|8$at?BgH8eHoYq
zUh19jZ5xFdeJO0nao1tR7a3*oRD6+lhoY^m@|X5c`MtXjMjGF|3Fh20s5?=Qz>)F0
z<!wF`ptSgjE^qG+f+_qW{8r@00cf&@OY&5KNvN**p6+;9HmQO&$#bz~n;y1^>Ntul
z%Z9&QdHBE-$sd0Bv93NE^vD${$i7NUsyJ98vX3>(A=vhaim9oqvZqUuty+T~`O5?V
z^Bp3NYU-frSA9^WNQ#DS)iki=%f$3Flen_l@gD0JQM{@FvO4xML?T~~zWtDsC3?9?
zQyS$R)zw1d2>)S-+vRQ{WtMVuQfhbp*YDqtPfyW*{l|YIQ29<!&O+~SmQXhUI27Sh
z0uh#B7))v8QsK?A8aSLiN9$(j5VW+dy4X_D`q@i`6&#ml@HVsbx8#bP&9haDd0`-i
ziB`(aLZJk4LsK!q(t^)i74RbAo<CxSfDT1cch)wGZu;cbK{u;4DzuM$Q=s@q>dw&1
zcs>XB@+ESrc?sJBS|lFHg*y}XdI7`0bP;&)RJF}3r|!%xnp~M7xJgapblIjG_hV3W
z!_cs5=zR8Nv7(e8r@V}6=uo0{d787TugDviOOAX>z<|L*!*?!{SdhKQur{9!^TanZ
zl4m%gH?33o*BJqqFmNR6GFF%?DkjT<^lF>tQ|f_h#p!9=wuyr<_u{ffQDNJ`X)E8)
zz2Y%3a<yA^;NohaK2%X$-O#b?DFEZ*tKd;guw<$_@eR|p)g9gdn?G)omPhn6kmfs*
zk~tN+(QOKW&4kj6M1aNc0(ibi_%{Fp2*Mx-S$GRyHA;#>mMEaa*+xSn4*C`dl$0R*
z;hzf<evG%)xdsCP8~<pJH7IDlN<jIGaMs+i7CnU1u0BoO{Ft^(MEJS;it8$-iEZkr
zShEZd6WO=0?Gs%!HKKafrq(yLy>W88dE0J$X@y}~0H9Zfc~n@BOEwMT;#Y?10&prx
z8eaz<d-`}`;KE{IzAfAmPfsiVfzwm4BJE}+cqlH|=u79uILb*70WXJ6Pv>H|oHIH-
zh1@9a4Dh<IgA{yhCn!snP-Fr||CB^oJcoad86-y#p&-xD=_$mYpPoXI(^Hb?#GTCn
zFyi!dGrY?m5Ba1jhn&<xHd2p%KzC`3I%|n`9#c#970dTs>=-u1nr%p!7_y69;>sqG
zWQBUhv5%>G=rQeYZ?8k!{Pga10Z0RmE)6hGKtF1p`wGq`qapX);E+rL%!Z}j#r#hq
zkY0qu1H%TKAtmmN#lTfqHyv?jNLXaFT)}PGm5Q-FiCvj4QY3?fK4A8r89+-|)+<tH
zzKLD#t<Nh%2cK(I=OkQ5qhQU{fdPsldw~P6%H!r>*ZSmBxSd`rn3*IEqPzrLSebBz
z$RIjgN#InxCPl8c7GRlTH3bqx$L<8SNPDW%l|e9cc=VCU8g+0B<w%40z+SFbX*~Zv
zo|7P2?Vo=~{9`*lOSk@u4d1ouf{r<Iub|!*D3yw;x*$;q0E!ZjVrSTK;l;7dmdhfA
zOJ&dQVBxx_2P}BWgBRJQ-b4C=-525>{uq0pN%TUH=!qJ!CsIUrbcpTZZ9f!<y^tUJ
zp*{5X0qAVC?}_BFQ!mgLv7rY_LqBAOz0er;M_|~YaQWi^YV41wuosHL3Ub23A<09Q
zwilK|SNw*JBYHZ@l7mFBf?dB#0!Zi{Bo9~=QzTb1JWs{Cr07_46bIXeM6vHnvf}HW
zqH5~VH73dtWwBm>%l)C2yV+Q~qD~(Zbovp3DHjq;rHy1S12DYY`1Ud+8Ph9)?W!mZ
z7e+@20FHz#+IHh8i^G5$!>(wNr30c;81^f1uXs4i=OiRS)F!2a3acT>ldK5lhhUga
zS~fp+A!vOHA|goj&Gaw~f_73EA6-8G#`J-<vNIk8y92NJwO>x+8eU*f4g^=Qo^BlZ
zK{`hth)>arN(YBd7@#7W#~vL65-yEkK|MAJ5{4qc1jbWE4so4f9w%jQKA8t0h{z5N
z<D0XCnYa~Q*v`xfrR#}gy9RY3{{Y1rAvShAi(*UmWZAV9>Ui26xSrg`E%4_*SL)-H
z<5SCS#3>wbiIb2lA#Q5}#g%z!TB*Jtg#!RN1#D!3SaOasVGZR0V4Nj~9)+4YLw-o6
zQ$b}-EpxUzJ5pcrDVB|k<}*rw-ReeA)Rr7m)_m+yOT(IO%Gf4`1o6>|uR5M&d*1C6
zlzL0K40?qX?aq9}(-_sW9j)0rTGAT*+lI78I~AE^I$gnlt}8X`sgSm)EF0y1NvCh<
zH4Qo7H2M>$dkO>-lm+ue$kY=8%(|`g2kQQkK+fDCWQw6ia-*N<5?ug8>5}~9XPV!{
z=~W5ciy#OIgDR<A?Is3VX{Sg!{WK?^>xq?4S+=F0=yJ8Jm~Mq*+%xMuTXUAYvQ`%2
z9V_)2>_)xIdA*(Sn5VhgRJJ~i@wif-@_GCt4kC0FMBW9kBJl#?MWBswL+QFPtyBBt
zNk}u7o~(VGAZbNmSIwAYZkMzwUE{0z>gSH7r8`RO)VjtF9)ONX@ApY}e@L$SuHMzn
zoStj6(b?U4zx<sY+-iP5R1I_sZZ&%-1NKx2?5`N;t{&*gVib=5(tS(;b>JL@%Y`m^
z5+N#fC0oUsEa{lYx`bUtl4Y5=iY+UTkEcc$y%1Mo9fa=m^yfHda#0Z!19hh{<6#)|
z8zor~E}2{GGzu~hra-!5E`c|*F7hI9D8+SL$c2@|$eiZ07$jyU#4a)lz8E<${TYco
zFk#W?I!NP)i+6bpbparaiWDZ1$FbTO*WOYcd_ki)jHe*Zg>ihv#&;FPHxWvhdKMnZ
z!V!ctW{RL16q~XH9|XE&t|5e{_aUxJGbRgz^a?}a*^Qz+jUfT1pOP$37cO{uinK<(
zB$_sU(-$~<D@&T)nwYUlH~l0IS)r1tXci_O(I9=Ajcwa?v88C#F?84WO?!|yjxBL8
zId{!Dt9}&D1(jxS=D6T03Pw}3h}ikSizxW#0{B_h(h<a%x^z<BP;dDaz%GhsV${#>
zksR|3KRconBRYLY(u{h=)Gq+tF{7X0CO=tS7{R~KuQC0c)HG@QGrDNDbymoNwFPWe
zfK)}#;La?r(jbnWO`iSw{!RT4h19SyjYdUc<v{Y7LvWllK8z>#T_O{E!kkS|T|f&U
zn;H|&(7#vNv6|CvR%b#S{Bg77#_RQw1zW4`>OiCcsY{2#En`(8Y|e*dZhgZBA+cKq
z-$x=OuG|a#MZ}bP-6h1y?M<Y4o%Nqb%x<GW*nI-RuKj3*UFx`w;VU+l6o+EX^Caw;
zwt`*HwiQcv75i}+kTRy=tl3^6){`@bOxpcWc{De|4Kl&}cC~?$tYC_Pfr%FhuL$#H
zb|EpYlNTN@^L>01L9#}GK>RCluK*8wg5H+_2Ebp=<Ghe4QJ%*CAkhSU;Nb}4BN&lZ
zG-2w_i0Cz|rT%D-iEgNt@9Hv^ELFmqVd~g2Jq=rmFR7j{n~vi@;A8SJPPmQyih77U
zIM?LEEyv~iLQ4VCWm-r;XdXiVYn4NQM`j8sk~#91Hc&VaM>_@U?h7@H(R*=15JoTK
zWcg?hil<Q3mQ)98HrS6Pk6@yyCRROzD2}YiRN3Tx_2AzV;B)G)2-DcCyds4kK$l0P
z@p6>71jWe#(yF~mLB!RapnI&mUG5dpKX%$TT*;x1>toweEv%`4GViDatCHs!u5D|I
zbqBoEWAdG7)n5V|RdXIIUnHUVUU9F1gHa3kWGc!{ZWFhqMr?P=C^ea^HU72v#v&;9
ziA2kj%MpJfS<3M0m1O@c9!mC)>aFDeY<Vu(2k~NFj>h-IW231&{E05PqejcBG*wf)
zo=5w5DyUD*Qy~d%RR`t5CedH=8BLkfGDG^iW5a!qcd0ve-GhCKi0jyvu1eUVDuJg+
z#g3-<*z!G7gUpG(vpve=DLq9k4^I#kPgDH~a+c_tq&x?B(|sAPi{g<2H(^o;Q!K$i
zDfP6!Td-QI@6wlhmg>HO(BAeS>5Wg<(|NgAOY9lCsJj@pEXs!NH$8>LAgT^Fj=$$q
zxq|cltX0B)259Z=)A;QfXbj4+u#&AKgQ7fIo0aL9qx;Ev6n4a6-vfbt5A5}>R+Toq
z_3oa7``~o%kI-F@bS&&p9Xs8DldVebtZRnpuG8E%8T%fI*!N4qeozAT!;`Q7ap(BQ
zd!C7paZ+94!_hc&7lxy8w?|`lp)PRnBc3d`Bi{XPN*F-~(w?s%GZDWEXvn0bR+gm`
zY5{BK#dMldo>z>=?M9t)J#Y_#zEJ3eOvPp$bWnD%N)YA9-15ta*p3xvl;m@gysMte
zX-aAIo_1{jM4fCFhhFw$%4E{tI-u2eIsT)-jidgncWcAR$@C-76g28iI<Mj=|4_W0
zJHQRPj%6>^&F2@NgKYCzxPMBVA@~Ae^!Uw)wxb!YZDLz?!7atmFmZ{2Rar5JtJ$u!
zBfG*=(qA29O5p-NLmXH&pcJ;ntu~V&i{hNllYDtnYie9m3_ZCp)XERLS`ipP5(asF
zk)Y?v<%l~bFB2O3C)_)FymNs?iPGWtC%P;kB?>F_4$th>!l1R3^-@i=K|=)PYkDD`
z0dUajJbtat)0AAbL8${uoiCz~xu-(sK}>e-^6w-oEJejmCws(h_fMlEE!+b!>JIV%
z!bp9zf`DTa%~3TU`?}_XAV9I>C=#}0ThTqq*L7_(x<2b?^T&-EfTxSaUStZn2UzUe
z%C4bE?ho9qSh`AV6;l~<w^5B?OY${rs;Z?+ME2B;g64o0SpE!XfwzMe$h?aS9C=g#
z$xrIo4MoKElF7yb9Q<_ySOC4Q<=nV?NI|a{e<;SEO*Vv_uSJ@(vKgOK6D*;g8f3-g
zzb{-NDLsI?VGh2E(_&1o-!X@4#&|Kn{AIjAUW}qRhyQT^1`*s>Kq<o@39|sIxp5SU
z>2vm!fhDGBN@MI0Sc7yC((G#l`DlG`cij}Ek6aMYgiZ%AA5vNX8XgUk&><|wxx#xW
z39=$XPIny<A6$nRnxuM|DvpdbpIVssx`K6+>aIeFMfJxQbGCL0c%;DJgt7p(5~wIc
zCkaiP$O+?m#8?yQqe1!Y{X9qivLGn|pA-s2_KE}mcX^UhQ0-8UYYgL*{cpU;(a$V1
z;w@o?tX*dPz(Q=@p{B1{Sd*xOHCflNEqfMLB;S-&)mMC9AN0bv0T!~had(OJvB44X
znean=yjUPr*^jW9YXEJ9$Kj-Q$oby_|70xz4J=tz?%8-EE`#kgc$sHU061~u8Vhuc
z_U{vEb@@f{>Tj$_xz^${|Mz4-U);}E^3efnv{To95R6|OT%)4>+XvRT#cA*}ddnCm
z9Tc{AtalwyFuR5jJzf}0M{#AF>K0aHMa7yeK^_fN#;)Wjs^#jILN}!}e7I6tn_{J>
zp!T+-pjJc@?N(5<i~hF<8{ev3>LsT6s;d~bOtI#x3P7mZ*wz&dTSS&k*`}JN3}V`?
zh-oENb;Ne;lCXV%b$ocRjsq&=fXX-o+I0{fkIOh4#^A8fg>SYVE!*r%k}JDZ!c^BO
z)-+ebmg7rUBfeoMu1kGufU`b|=kl$wI-6Xb2R!Nr!nkw|dv6nTn0NCEOmeN{UUBSC
z4sYf$cs%c+f_*G*&$7DvIV^sLh~4`b%>G53r;qIWyE_Nw;QNa(QXVZUt=p1iNyNso
z>zi292*r-(QLOle?zpBTIlA}gG|=3W>h-&84gE;thPOpS2@RYu_jdzdG~kU_9OOzD
zwQCI#uC{_ayIB^y0V(}{R`k*(oM`0~H$fzfqbV;Az1CX<m$hk1l3Cy)H;z*;fW%7~
zIsqq(eBsdvg39by9uvrY<(4p7_V5L9bcX&)!=%i@x<s>JI>Tv@U7?gt*}_20EMBB8
zK&ZxP1t=^KwdMiK(+iE=np(WR9X(SV*`8@RkmAVKEvz||V&eD|9Nv6KrVfz@b@*{)
z!s<jY(l5#Mq&imPtuo$rkj`2xX05>|;C)n+!K#TjM)o6(Uq^n7F5pV|1gHBGxcz(z
zl22k2)|X6FeIxFQx<DtIJ1g#y@dUjoE|S)A<t@_`@~S>3Wk0p1z$upnP2C4fvYf*~
ztiKCbxOM-PgL0q~wuYmJD<95Day!x?$o$_ek1ZJnIi3GRSqy$xa;c5y7ZInT+?g{-
z2NLbEPTc@j_FSXBE3|WccFQ$DeLcx4j9s{8U~+Fr4!1|A@J&&T3)xUv+*aKxi`z<c
z%75?HtGL`)&GH{zs=^&tTbdp_$*QgZB7IoQJI=J}V>hZU?QZqylt!RUOar&)sCm^r
z#|<R^axW~WDE26;Swd0uIy218Y`;O*fTSQ+X>^1WcVxL=9}+Nkb3J>sa=+y|nn7I&
z6IUUS5mv^IZxJjxmTu{u>{H(zf;?_hTmspo_RkiXeUPXQaRNF(SYoE9blD~YiESEh
z5#B`Yri>*12zIW5c50Z-{AFsI)LIG__O;@_dm&NXPwD3|SjU?C|Ku!W1KRTd475?C
z9z@VV1RX@sE+VKv8QvR{IHlVSfc$5WVDD#EW%;qA*g6K0R9z=naV#He7SXXqJs0bi
zulc5L$(BS0@T#MMR|%dJmxdGY1I0y5dx3|+j444hWf(b61?EaIY{hkSiY-NVv8KB+
zc083}$u=Bar<P|Ln_$!in5*(<fVsLYn5&PgIn%ff3P6ducIpdZSFM3dk*qhqlpni*
z12qK<ihSohyJ1khND@e^J)`IYSUqx-q%@;BOnm{Ns3_qc1%Raih~9CQ<CcC)L@ItM
zp#(6>Gw^1D#Ry#HUoX^yUOXp3lod^Wq!Ed7^db!7oAd9&*u6q;f-Jv1)F~hlo|>Gi
z#&#+libvSh9n~ZnHf5?|jVL~LB!^%}^*qZ|RaLd+$K^$~PGl{~+8N%rRLj{e=)3e3
zV}~TAE)A|(dg+FrSdqrMj-B?AA&_z6nv*4RC?YxY<)SHK-dxO!YZfm;4?ZSo5T`*N
z6qs+NPnWxNXj)P-fz}y{TAq?13Zm&5`Y3)YT61}L?2J}vvV~(9EWbEo;Nl<rbHRP*
zmK-YWa}q=Mc|2idQp!}^E=3N_;84MdD}2t9G@d7r%|4|`oB~^bNVG)RB1^<cDYJaD
zwVT65h@53YGIl5N>6GCpyg!~5k_Lcp=ft0npRc<Ml*0yxx9Y_8@^*6_%OsLwVB$$C
z@ER_*EE8PbG(*yC$+O82{M|I)temd?>9ECl);FDJbkgn=wk_@G*2JGrz~_zO@vJBJ
zoQRF7z7$51z(3iN@q%@;CI6?G?RUic^f4vCK74vdQ<p|LnbJ>U;hEXTix*BvPgpvq
zll9S@S4CE)Fh-}cBu$VqZul&&H}R(nX*DavTA|fos*c$}TP#d#P4fh!a4-shH<ogu
zIT<MQ9r2J@Ec6vCw0-#oqf~KK4@Rl#*&2*ek17S}7YVq!-Rz;Yt8gz<tJJm9u-#vN
zyBm+%UfZqRwPn4BRejF%q+JP;2Udb>u=I#C`V3cO`7<OP??cV{eWd2$#Xp#wdq$Z&
z76x`8=fSILvscyK>qQ5Affa3Vsny9It<MHEeV_V<f_)3{yJXA47IAFs*%HxR!!TS`
zdcfu)*hN_?@&tV^Y<dlabIp=;B81NIW&_fSb+7^>*o7;w7WEGb&@>`p8R!pIOXR2Y
zp9>m+-DMTKpfXX4)evTy%B)nN1H@5~$1KYZXrPY@7I0j1i!g2WOp2nawq!{rR&+-J
zcmaZKL$k1LQA?3MVo~=FkeZ)Dvh13nr4c&wP7w#72#bMu1Ae&1XXphtuETA`GY3}5
ztC-!h%>)E=>JSfXo=g#tl)7wIhuIAqM{ls?bhhMFm~s<zh%sk%s~?9Qr|~o}o671u
z2Q$tPTQtNL4N1p0Ji&t*r(}2rGtSes+6`u$#_9}aoa0}Sowcr@ozLixkldRqOnee%
zI{`f(;*qQP+9#(yzn7-X!5CEi47SZa<UAOI9w%Qk*fx)|{KM^hztPb9fG`fW%`X#y
zzHWLcOk$7MzDbCto2rHt&sVTUbc!8Scd)G3I+Y}VUh{{T^kc`Qe~gnCA|ekWs_@4+
z*%`(7xFXOsD%p}m9866J!*qQa+bTq5Qp<2$qDZEt96bVk^PoBzBP+`}D&v`|oI$UJ
z5wD0n#u%3&$T@Mqq;eg2G^?zAL6pbBa413r(dlVrc04`p7EsKsJuI$Qv;wmsK?L@7
zbb4Bjm7Bj$Pnn$)LYeanou2Xmhy^%3ouJdxU*EsU;I}wMr>87*bT$VskJHo5@w{7h
zd=I~wQBt6@mFdulvz0UtI@9VQXIj|p746HP-Mx>aPc6kW3?2K#hBUpdf^CP`*rW<2
zj$;!^bB=u+)kBYCf3JYLKfq7#UJIM>axEh>N{Ta6^8#STd59^dA$ML$Xc|C1Fy=Nu
z;GdZP34Kh#=F4-(BcD=c@aMt3K?qUFB)x*1ligD3CNp$_>KO_;g=Chc*6r5pMz|c6
z9k5tq$l*3CD-|#)RfY>z6I%aVtC`IBR2lrFOG1*Kutw(OiefSUqC|l^=~167La?k$
zfPqlPUZO0g315lI0L?0on<HK8l8^s(dR;^!-O5Rl29ZF=T$}G2y5@KSPXqJaDC1v6
zkmKcOf__P1Z1SWWrdY`Fq(@gC@2fr5b!7lNaQmZ(sjr5h9AyY=UM?%WH<{_GceQ8l
z#YXR1Zb7{)l%GXPeXjb{sy-`fTFDUzCCO@nKoMpt`Vp;cXP0*8`|FEkdN_*d-uR_0
zL83uOw~9urL|3VZr@VOC)h(<gL0=c_(T0A1Yc{s+64WT9e!ll$JDDV!Lshz!?qP%I
z9DG$bQaHde9V&PCG$ZsdAM~@O?PWvTKeyj5X#4}HF{8j`lXST^N$$MP)<{y39}Y<#
zvb3v0?~da9(jSpU9&Z`dANvSWJ)DalyVS)vbaa&j00j~x4_NlnJ?i+9V_{9TG^|;=
zgDqnE08m9d-BwK5+5`(Zfbo?-0~p`oV0>R+j=pWtY_XSNg5JD&i^S`K7{{6g*#x~1
z45Sb<Gmf0a|AAhH1i-`Y0IZJ-Shon(2hx2*JV!Y!3(U7z0TEtO4T7y1b_m3t6fr5J
zTsek9#;dq|oz8aQ{Jp2w0li^b2xysA<MSyM7Ws_MY4$au5iBnHKzxec1kn|bAqeJx
z=@&;_rccsX43&?jij`@BSz~yG5d09&1BUe%LRwJ<sCG1zKcPzFoB4qcO-A1_?7yyX
zV^pV_W&7B*R0nI0YhjxjDt08x^BtY~s_Z}DfGxf>D`yi(rZ`2Xr|cZ@<AS^*M2l=9
zV9<T>1G0XE`W+Vr`3E?91i3Sk=7p5b(E};sTtD<z0^=39fzS}|o*#(p_-R{t^IY=(
zYoBl`O|hx3c?vdUVq;D6By4Mvj}=8$JkO<y;%?_YpLRIa8dY&@#$Zm{!>T+IgiEFu
zg+4&R1J@vE{#Y5_BmL}#3$UelT+ssxKLJGA#E#>EQ#?{j+$tpi9m<wjPUmOnJ)Otb
z+=6mBIzPW0L0hDRRArsPdUey*lIav(pgGBD8nEQdCmR6u9u-dB4psANgY3_>$kIwr
z>nv-!*$d<ZQN34K`7u|_rl9Dmm4%E+m8KAOq2A%V-p+W;sAXf>`b@{;N<++N@sBu&
z&{Yt57oY-)7dcH4v@vezm7BW5+7#NRPC}Zw^kn7J1W7A;$!fMFa|iUgjfzQlgxDL@
zVU1Y1zIkQYmGfpLQRPvCpm-OB9KJ#sot>E(mtW{em~-*5JfsfQbq)9oJ9Hp>`Y_e_
zoJZ@l<Vc=uO4P-wD!W)Co`fxz8d%XSQ_@^lS2g{y@%RX@iP}xJ|K~VIBn%4<ngd#s
zEMN%LZaj^Ge*=kdf^KGkJ3~Q+Zf0GC;05q?rHorLa%fKTSq$=T5CJm=Ov`nU<{))s
zB=UgyqS1Ab#u4)!ffv`KIf$MVfrAO-YJ9LD6<Fb`)fq&09L7^%@4`5~Vne%%;+qI1
zObHEdWVUc;Al#E;ni&&(p&AsMQeYhkbjciA2<sCO*QFVg?Sa9Bp$GtcK;wqYmMO{d
zbm8U;j%D6gq*`ZtePAX*vTmviZcWsA;av+l=_~K(nrTo8ONK$PrcjEB@7P%Ph~pZv
zLR8lp<elTnJHXqmRBTZHc?lE0DB$r$!DxyW5jzri!Qkw<Ca9aJG7lo)DC-vXrklw|
z{<&&`eD2&tldT>EraHLJTYj6iNlh&>#0EI+RVi<RzW;cUkTj#8;C(q+?X5^93l<r;
zmK`$vw1^VoUY&gZaV>A`Z<nK2aCM4XoQbBta~Sl%=dueM{<D=*&)C(<zyGPN0Ax^D
z<h<;70{#5@{>|=gnuXSTX?|~Xa-ft6#l_hXh2eE$f91!a`0H^c$4wg`q{r6J6KV5`
zR`u4tP6o+yzhu7P)%U0*&n9W~7d&Hjg1U>IliQoh%IWAomm)xSkfD#@J8<u1=o$n4
zxW#G1F%(rZ33g;d!J17CY}vAlCDX7?;wy^h*^ft@&Jbp%>{WwoQ=0B57r!CVbOAEv
zi`O+H7H}fpf#n$Nr;J5IFXK5Ri~`f@$#*}z1b<{Po<jPa#~uZww-i!g#Z%zuf@>Ns
zQAkP346t0oJ&PA0ATx<Fr6j~RaT?YPz#tgU6Hov!p_YV8CUAgiptQTy496rB5(9d*
zNb?y@=W$9WC;*F#8>dN}G823$wZ0|pEQlz2Q;Z6_`I+R4l!VoCyi4OkzCQW+&AV|U
z-Bt|a_9ie*D8y~g3l{#AGn;-rB85pxH)M$jnl0ue68k0cX-&|Qd4+>mFWm8jq|HSx
zwgx#OC<M=E1QH58L%*@XBbe#$C$l_HvghaLFhbA;fUn{5Y+mgDnH$f~oiLuBmw)mE
zMfh<VGkQ=By;%YmMX(>Im>0sTp=UT0D}+hFzOl8(G@6mf4WcP#bH^e**tw?3lBOBs
zqvKNQy<sUiW!HT`dTAA0Mb!++kujAN9c#YfVn^|Gtoo+qO0G@(y8xxU>pQ0I1_Np6
z7~iqqO_MBANKS{HMG)rb4I}6BxV`0f$H|*FZ^uCIjLzYpiJ&v|;x$g<8|D!&ykVHO
zD-4MP2b@_$MM}Ce^vfbeSsX6dpQHE&F%dFD1?@t^wd2bCN($6gk!TR|*NNNJt8SaD
zQci;AfL|n8LaB%T>p%V{x}p^DXlg*NLa`DrayZq?cp>uQv1X^iHM5i!sr2H6@~LF#
z<ijs7;m#p*P}4>928Ccd<#9eN`i=+R5f4n^5CK%(Pj_)W1k)(UDNd<Jedb)#Joifs
zsw5nS^9<)Ph7}DdCOD!un5G2BJ_hL9b4`^LO_A@{^}uPKk$k@^LiS8Wbrl2alI(*s
zq>gP>m9edx#4!ogCHW56kcZ-E!JubB`AFt-7A8~p@iftu`Mx;IR+gtt+qi_+w1cnD
z{q@kO>mQ$(zr`~)AFc{pQ!R?9V9+nN5yQHZhH%Mfx*%}87Ua=B4hXw(wED(D9V;5@
zz?i5_YM?A9T{J*YtfvBqNxd(o)09rj-hPgw4wEc28T~q}ZpINj-q|b;y^j6|BM@m=
zba9;0DZ@4HSh4Eq$CNz|ofKT1^+GI62$%(~*7>#v;#xVfzZKdCsYmUUvc%jG*FzWC
zvW^P_wBH(hbMY`1p-ZuyzA4=na}>C7)c>%ok?ygElauL3`WYCHQK!SsZi-iNlz%9K
z+*n9bkFMUu8H*rdJ{NJG$Mex0yZ!WFM4QUHx}e%E*zyZ#@4CH;od8#QDf}#hsFLjJ
zSaDnlYpOx8Z7D9c4B4TSnyyVYp*=i7PJ6eBe^Y)4Ap;AAl+eBj-{uaUH$cNBs~%)E
zWnKd`CR>rmp|94SOGle})Jdh5V5-M_MkDTI5Jcc9176Gw2Ez?teY1P)nLY6Rwa}}k
z$_asV@QFmrlgm-5m<AdN!(d7ymtKx0mm|0@iJK!3Ih-)a80ZiC@?+rV$R#NNM*s-O
zbsUH~@5nNZ!;t^}`Zbyo&>;uWl>Ox+$*wL(Yn}vkU+<RD4gyDifg=fS)$F`{@j2*h
zXf7~4J9rUy5?X*l=r2H546+*ZxY9%7L+To_cL9C0c0^CtOvh9u?8~NxHQ%(bW!n~(
z6kpLaT~#HGKJZ*=1!^DScsfF__OTJgiMW%}xT)qZlcl9)(!8~dX1Rdp;k*M6UM=l<
zoC5*RqIi+;GOh18I-zINvk78%_Dhm_6C^I|2@<#UcrDr5f=!3yXckOoG(~BUac|qY
zS&_I`B@4kT%*hftbhRG5LfI@{gdTjXCtza`TE!&Yr9;zFd%qrVdIo8)dFZKV&E>w7
zfWehe7iL^60SiOr5w$f#<BTr38}w%|od6gRw>73Ti2OKpDRO9*ql8%wA;la|7#GhI
z*o~AXamqX_Nwh@SB1?o-qT;(C7Ma;0k+V$Tc$d>D9X5G?4Ek$E17W|o7m4O-7gU^Z
zdhX{a>=4_tse?Vs@~}pA4?9G+Fflbr*KNZzeRGf^gcQ*hpDtvIy7b^I(KSgKm91PV
zAPE-o1*Gp1hBl9##3~6~`;`F4V_QbJC!iWHood+>wj<|lWTWpD7hUDHxY)r^Z&=*c
z1|cA^SmUaPjoZ_Sg%=Hj&0saXT&sngrI~A=$ZyXYiDy~K4c^edJ>&hdGW^#eWO6f>
z8$``?Sf6Pccs+%O22gqzj=uz%I=XM`3g%T;s(56nVXWOO|5Hdl(7D4yFyC$^Ax8(v
z`i=$UKKy5kge(})M=KiZvTobNQLyJ2Hr8ZY$BssAtXPU=DmHaheTT+<^T&-_{d6I@
znT(7u(!V?`+}*(GE4r(hzCp06gL|c_Q*2AFk5%3DCB=6Xf1`<Yz>q6{1`N5wG2{ve
zxw<o~vn=t%Q78b#8Ibb2^BIU<0xh~3gk7dh_!3}p-s<SH$%aVXwE$gKHrqO*b*#F+
zKy`(q-%bFzztNO==|*|LUC#>-{u)kP0%AQ(rBt_Nv|53L<g@H+wxj`!#0g{fiu>WV
z&5^|{q;$%baTza=7o#Z7g|jZK!9)n`BuUaZNduD8Tg8)8`r*kLmT5?aO0hvSA8QsR
z*ivi{Yno-)ieg%-=RIJhcH3E9qxPmI`)@*YWE8RhJ@!dL(`JbIcoPOfgU++MzH9xA
zJxBktASuvlL?`IKFCtJ$hd^X;ie8Z*q#im+DQFU?$4&Eb%KjG|#()0){Sh3aTPdlQ
z9HF1e)X^nPC&a<Bqd8dfR2>svlQA(=S@%?fT81{LOplMPP`*AzI*X&ZF$k-}05Nwz
z5EFJQcUSxU2voKLuT|(%C$$TxL?BqpjKbQl3SN%J{IcSA)sA|#Ta8s@$trf#VP(#1
zmH1t_qZTj3%7356NwTwoD0Mk{0-$^ws6Zejw0&j33JvlQg==q?v`Pu0NcA^Xq}X%u
zmHm@_DEC!-;s0izsx1`X#2*IWh5@*Nb1W4d_6Itcrj$na1G9mV{GK!T;-eRb@}UmD
z_BcIg;171A?gjVpT?!KV0Qm7F06*$t-Q!05pq6S|n&o0oHVv#Px{Mvi(Xi|)RF)-`
zddkCBYSiRJCIXglnx(e!PV^ePwRi2B#M{D!{GR5p0zG51HQVuJN5z)px>%!@f(bZ$
zc^;*bZ#a^B7Z5Q|PjOKY(JCZtJ2+&g$nE<Zz%k%e-j!F~?I>S($@w*=pA!**E*#3X
zVNjll#2+#9QjGl*$mbPJ$Mt@LEQ%Sb(egwzx;BL(S7^-@uFBMT_fU^wk64yhR98;~
zV0&Py3H0xPC7cJ5o0m(~tjLrXUOg{uHE>a*kM?7w(&k1dwbc~r1>ps_3JY0`n`CZ%
znTPBIUlJp-Enr5!hyFl&IH5dV(StK(k6Y|;Bu6$>#l}=72G(TN!j>shY#N?!5<_xq
zbAT4#Bks6}81jPazypl>jacH#f?4dtEB*k11?^BlLR4bm!bR^PFvFzA2QX%L_1zcG
z{>dDCaSP@*3!ISs&S3Q6p5&>-#uJpqh!l}GW!^AniROzi4-!B-s{((7_!dVl1&sdc
zQ;qrMjD;JLMMjUy^ggjz<Oj(UHn|vHt}Q&FO>4m72}(|>R)$9!bV8eW!q7;!8E9}<
zaRYl~VtOpG1FGcChS-6}9Xl}T8`Luh7Y{+Wc+A)Xx?)NWku<E^wvRPildvV}4mK>)
zH#JjtTvK{vZkpUp`t`eO4gE;t(zR`)QG+R5nR_v~>H@>L;;Sn>cv*{tvxVT^mI2l*
zDP1gAEFEiLqZ35JIGXap&}Y3pG^O!0CCMysksHUU7eGF+44nYqn=d>%K~S0fIu;<s
zizrV)y5Wx@Lrh;mF97fX%%BGfPh$o_5HHdqsJ{dq5b@FTAP+cx;%%8(U`u+LSUk^@
zTv_q4>^L&kJkx``TN?Hi%W-|zGhJ-}<vIc=S9Js!t(TN}Qk|#qJvNfuon(pbc?^F|
z0IY4@7ObhNRAXj8()e}c$LInsr%!Otd;-<~ry%(xXk)#7QT2_uwRrk7CZnE+=FW;6
zZ9GA5iYu+PTzTI$h0m(bN!d@Wsfj@19YWeSN}6+$bXc7^NqUNzVeG=rK^JdG4m;8b
zRI?xmQIG%LsbaC`tY-O-E>%IvP@7$W%+<B(3eNC{#k}K8o9U@W6)ktGPp35U-qJh`
z+@7Q6RrefskW-L)_kc)_Vvn+#uL2r+{l;9lob5O08a^{b?R5~%|G0nHX@e!G!8g9$
zeQ`ZlLCw-BF%?C{re~U1Q+*vfl4oNodH+9q@1h(xj-(5}3Pu~VR%r_s?-#o@aeQg_
z_>8+-W2<K)w%y?X0kDcI7Re!5lC``2$9aW6{ul7G^rM_7`6B_|>&7aTY^g*=bX%$d
zabp5Ve3|(rx2fYgwmH~<?oiDI&8hL{lIzu?CcH}LT$g@eopyGBwvgNFlEQ9~-YioQ
zi<h)cw=JG-tB}QqV5E?8(;!5W=TqAbvQTWhEDy?H%6NFDjOH63j2VxU2<g7sAvP+i
z!|iUk-947u-ISBO7os7aDoUTX%)rCt@PWGtmOA1^A0LVbdqwn3OVt$D!>S2xf`-O1
z@l^#|I@fJeaU4zA5Nxvg%YiIyC0UwgmSVO@#e&6+v-JMMO|GBELb0YQzRq>-VNcf;
zY`CV0T~p&&QMvD1uA!KGl~fKCYt_#{v355UYZqNg@PZ9LP6`a@Yw)HeOGwV!#AYPh
zn%m5eDR6C1Ae1HFILeI-Xx~S`v@O#j#aWIk&j49nP$xoOl9HhCNa#|ZB@jxOiHu7X
zsaml`vUmnLH}90uOy7>t%r`8~4B}v}c_ua}Wtec?!Q7{&t$IGSUG<P$Wfp~|laZsO
z)K`@{IY%k4l^cu@`IJ*0TnTUYmJ>|rk6!Wc4Oub{D@(?188Tdpxt?k0Sg{p?4UHMt
z^Eku0Z&KfODY5BSNQm>GqNY0wYdf1qwUEtK3mF|RNBkd#!_UE5PdapLi<vFPVrcc}
zr2!-Gk5@Vgi6+)0z9>felCVz~DFKD!(>YHmB&MD4PX%F|FvqZX?uGnVWH3JN_T;oK
z(CPdLogh_F#z-5r3}4+E{&c3uuM64rZn{OfVJSWHUo04XI@QW_8nEn&(aOXd?NLCX
zmxQ5Wj?kY)q4l#igufhg_{(53>S+iWY)1RF8IA8ys9PK1PL@#R?!&r<$gIaFn61Ni
zC&4tncD&&hv4%4N`u1HqGMet_8Pc|RV%?%K?qfLP<8T1D%Qf>z{aMWWD9w+=pXDya
zc^h|wdm+w)3_hON?jByBahksb@bA|RE?oo5)SbGIT*OI*6=etRM539hqNu8gZHMXD
zPz?inhQYC=>Yicvie@;*15ZY;DrKsy*V4+^gv%QSFp*JU9<kACyI0#<*$5C{AM3pk
zi4B-)8j)1JLy&C^xNVu4CvDrdZ5t<T+qP}nwr$(iN!zw7|66sV-s|j$)!D7pSTW`t
z^Q(jGxh`qD5lx&0C(Z==EiaHpU|%}VyfPYa#RPDJwz>hD-LUw1#;Op$3AQvL*>9BQ
zTsc~~CFu#VI7@5E^}`-WFU!ak3u)we4-GM23RT~xIabGgGCqQUCmv>CM$04X7UBba
z$f@UA#f`+n1;}wsB+!q|-{}U9KR%Mp6$(n|00c|yy^gD|@&Qdlj#NcGh{Gq3>u`(E
z4TXS<RtDhJ&!CX4L8qio1nq^>-zvlZ6;Q~(cXoMQVZ^i2DV~<fF!m^dp_CTg|LTn(
z>cyy9+-34qmI$HmKyfm;vctQRmq=d;g|QASt}5Zc5*k0IZH&CKawo~<ANb&=E2?LZ
zp-;WNJkL04SZ}s@dz|=pB<-_H|BTUon9G>s3+ZJ(Nmb(Bm0^?DkNfuq`ei08>|Gtf
zR8=h_gD(lR-@^s}wN_w-O~~|gkPu3jicXPc;AjYUR<vx;`1T?(rGSt+Z0qgPvX0t~
zNFYPh8G|4_x;9d~O`hM!!IX3s6-keSYM;Yg_(ymlX%ky@;Q0>x8w)07K>-Dmy7&dG
zheOZGo1f^#=sT6`b_-K7wDs$%{^Z%8v+G8vmBmYhFHGOv_hXgE4Q(^uwZFS*6!v(H
zrz-uu;nlCIAy9*l9iuAcyx-Jhan?@imqJ|bGBM$k1kO&yrC&YsG8N1G)Zv&|EkAor
z;9RCp^@UWDuQ{iO!o-p<DLE}FvmFNMd>!?5G-Nmr4+zd#_-044Qw%PPG;z)x6zQ?K
zQEO3^lq2OL!YB$VS*7Jf@W`S}kuxw)GV$1`d7fyfZ<XuFYBYPIzQ@I>6RAIJ47e5^
zuJxg-Dq(Tl^+|f5@Y~rR9U=(3YqganQQXMNT7ab{Ci*O4EGSTy(MD+K5fg{?1w&<L
zh5gEJ6^TfDQh$PQ+(Tq#jShzU<YY%q4-ZpcZWv!_War1j<K`%UB~8i5D%WXNy3TOe
zb6aOV+M$wFW%i9P8LMIp)6({#_VZi&oNljHZ)T(t)M{jr6ZH%>Fj>J_>Mqpyt@+ai
zlx9`5taqdodan{TbE@;k6>nP~T7wG*VIsa@6J<c@TJ{`CKO69aN#KfOjRqF+O$^Tp
zM0e$=`4S{_<Vn?my=H=IQ;B=Q1?@<Q&PWb>E>n?t0;^VJLXLI5rIpJ?O3~nd8JqIg
z4@WF*e<VRUuDkYJU@}H%#L4#ycZU^sDv3kZfJj6_T+wI&tQ}JS@a`lcNj$>=Z+hr%
zabXjq>gsxP=6K!So_u946ivj;j!fnQ_$kUl?7V#fsJuW+7yUnwhGY3;V=M?nP<W#7
zE<drc*>dquo*EDJse(t#^L4~T85&d5(<VA~8Cpohq7JBkIvsVpGV3_rliuw%+B*$T
z`z*FuR=0FBhQuVzR#RnIl}2TW$JmewHZF4m%4IW*y%esFxk<Sjq#s@08ME0)UbJ^>
z5Q06dr?N?>o@|^Gf!s-k7YF#g#A2qo=zXZvy{tqB@19HYV_#k;GtUjgO`R1_RNcX6
zd9Ktpi!HnU4Ne<o$u#*DG+FK~P!w9wB$r6E&5k~^GT|yV1ko5^Ul~PgT#-h-N{=$}
zOG}|d39ae>u321#?Ay=q;@xp;&z5gGwenlSG&vqWQszeK5&<@?0}lapo5=O2mYh*4
zryO?+j`U(XXjz#jq-7d8*i`44V7VKYXZx5s(Q?*d6P~(n25nUnP*4PchbZn?+Kffy
zuH!UZ?9J>9ZMECwVSfvZ+x+axjj!n14;iQ}ggw&kh@}7^ZfvKdIi+EB7{aQ8M|rvc
z%<=gc`q(7=BAN>}wug1z7lm<h0o-ZvSwsx)0F;vcdr3w>ndpT{x*(q#4#)$C0*!Ph
zd&T^p4d&PlmmH8@;YPq1kQ@kBEpN=xC-Bnofo^sJf$SS>{?(`Q{koMlqq>!pHP;t8
z!4zbytX_+KH3jW!t`PdrW-Qu2RKm{|uELdXidl|yF?7BFe+1+lWb~!UYwfZ?yd{qD
zNkruu+I-R(JrrVW_=H-E@U*1_B_+iDX&a~FxBfxw8~8J~;POB2yT`C+j;$>~mSut<
zY_@0431g*KB1EXeF9)R+Vvc0Q&vsXuIar`7XXOya8hzdv=;dyIKAwSGa^&((b*smP
z!<;OJKHyD`sGyp$!UgLF-(_`+Cy3xKVA4If`M~&BjUG{Rduzm$ptL^=N)w4!4iSrh
zoj(uTwgVJu5V$x)yqV#+uS0ix$<>J9=_Y1HiOOxjH51XJsmXjOzcqrL&T6h;DwaCJ
zOMKpmzqvJ08e@5N?FWC2Mn1^l9VgvWKb-85`H!&btR~cU(n*a?x@R4c{Ox>QiExbr
zO@xp;vV4uR!;JguqbRKIqMK}X#ix_i+T%0J<ewV>)L=UNvN1NYKoKC~>ER(j%R#6g
zwhK+uNng`ASZMAQZ9?2p9=mO+riU>H7AAeW>=n!w7Lw%$XqCggb&Ki~-tcszpWpZ8
zhUD83$X0)$c`E@A6fQ)4f-{XYbPOLH>y|M>fsPa$|Dkj)T1q#wQ$U4V&ptgTtg|3l
zaI_F|24<d8>*b0!qx(s&Gn4sn?##m5dBFzU5+_FwF^U(v{h(0z;l>=om&hFA3Z%JV
zcCmV&YY(44iEm))$86$-iq8;m47j=%VdJxG*-HzTJ3mp1wNfyUqLmqiibt7$f330+
z(X3-e9fOLiMwK4?>2DQ~)x|M8_r#p1=meu3v#5tC44lI2q$qj$lq80qgN7ytEHx;d
z61|UYTt9a#5!BEQ_7bP1BY_`V8t0v6$k!u^9LK1x4V!o{8eFfvzy!bu90XlS!a~p}
z*Vl6udgn}2IW3nec~KBl)A|S@VA<7b@w29H`#N&Dd$s!gr&jm9DyyDUZ2I?&8NIb$
zijT|n@%rEt8og~%k2?|&ei#X-wvskz$&A=7Jtp;^fxl}YO!;|bk5!Z%I5=0XR;m;&
z^wm^xIa6oEjFv^Sv<V;0IOn7saDn;RK>afisa@r|F>mHnKnbaWV$8fE`c()9HP>WY
zHPNEd_@y!TY#^g)t3K(lz&8gBX`6XaCu+bI4(S_Ebgu~<bD5x5pLkX`LiWxEt!F(o
zbWjI37~JOjxE~P}o|yD-`o(J1Qnvnvr{J&pNN7Ok+mc2*uaR||bXXs^+-tQs>!SN3
zFL+zi?o2`<r;r1PAxgn$u<ZdhVuPe+{~_^yec3amkQL#56jv&-KFIterP<-^C0YA9
zpq%~n((5-eU$e0@Fk_E~WA*Q!>*eW+e^Dpn$9BkuE0n~V!LtKn`);oOWAKRz6csmZ
zeE*G<QC;hZVos0kf34pbj!ZIcZ?GP9F-_My?wO!wRrH|)?pRarKk*;P7i`Abf11}F
zh19@@)fiXtJS>Gb#EdS{Q|lF-MpPasVDKYsI7%dyt=MTtLuSEUkQawz%Kt7a$ZXuP
zB8)v-Kh*vG0W847fB!#!LUaG;DHL)(k_x~}te@+tsxDlmBoQyrEXSV#oR9~Y)Lw;u
zxpL1bXdaYZ6IONTJMVyH3*L;w<3TY5^BX$b=h1)FlMP&@_63{SIOaQ$c>Le93szzk
z>T*f&t;ttf3MQck+lykBE%q4Zfy9o<zg5Y)dnG`d(^=<5u793$z4_Lh(X#WRnX?&`
zXr!K<$Ery>EKSjo#k)14Z3cDQPt`@(zKy8?-!M-I7lS^|Wgf0DvN!j`61+FZmee|P
zEzdpMQ}LlTHy3Ap>d|IsUX@rA`-$`yT;ZBxC)JV677{ZmBQ4wYo?HXnn!}IPSo<oK
z`X6e&Uw=Ve4$4@CskcTro0%eyVzjnf>jjn&eDDG!kY52w<aI#ao{Swf(P_%I;*%?T
zF^WpP^KNRIyg?tbAJQgsuYyinsGP(W4tU0XW~g>qE%ios*E-?9tA~DURwiu0jHNC_
ztX%R&m_sp2hQmX=hw<0+S|YR)HP&9h^<kIOj%)Xu&70fH$JoZa)O+5B*|wP$Cg!n~
zAF#n3H(KlW>_IxEm+J?u4VXeHmv-UULk-B<<bxOm*R(Ne-5dx5f{Gkq>64^0#Z^Q=
z1*_tsM6|$FHfibaC_4Ox>?z2?WF<0EZ!^Sw*^b0<ap$yx4?YOerP+~CSj@T`c#Oof
zCd^1iI+YWIW|^%6*<o3oh6h25`ALlJFA;|ot*#jhyg~FAZpbZcsX8Ac*qfRqU^@v>
zbnlS+m0jFhghT^wOYr=W)1`%<YqClKwFKR%cB{@zza2RdAg*Q(==0bZXN2R>1Q*rm
z1MxdJ@eS0^;Ih86jDU)s_GQ1jm8F$l1|GT+4dEo0eI885EJYuphrQ4M-3KOX<yC?Z
zl**u{zB0=A5#AdbthhdFk1I7$=@4ffa|p`}mkio13^}6-`Zn1d#s<bD#+W8zp|**N
z2ji9C;*FYoH5zf3aJl?>J_6irAa1Dzx$3GTwYx_L3pQOQR^p2|JjJ+iS#vI(qt7cR
z$4Mn+<64RyS1yA}-6U2QxXitBkxyESx7vl2tBQkO4A<PtyapmJ)}>cbsx)F^U=lIY
z{stS0u_!Idr&V|!_mOq6eP<@ftqtI7wyhx7&B^rg5X`LV!>&kAuXqoR#FPLy))^a&
z%F9$S4m)wUhMipHa;R+($(^Y@!fhb&Jr;VQuQ^`(@sRzYDQ_?c0dYTXv;Q;Aku7SE
zE@v|$;-Q5s>?7I0oxSLlbDuF-TomyQI>lAR6=bzJX08(r*rsx#ZckE;hnFfb#ujZA
zzh|oHfoDf2F=j=SJ>!XJ#OR>vw5!aG^k+7{ttamwwRSt&VgY+z5*ch=hAX?{@TpwQ
zuZzAUK-Lsfy5tqI&xBW0-z$39Czji+BF~wQmjC~Q+7F#Y8}luN8+X{#Y|zt#!eo%F
z(0I=($A;6Up!PDWcB+VceBAKjRr4T#wt<2_<jfujKzyNG_x1ye&qp4>yHf+n-Gc-)
zn4N^?@UyAal#eeQ5)hkAuWEl+2>D<In)Z>q<C`EyDMCH5Oc9B~79%o`OIL5iT>pGA
zujRJ>@e3=qM0K>b(nvBGeB`+#uZV0Hbl$4dnq2p5f(4js0r-0{L~+*f;s@ys^Y=6p
zfS07-ong}0;e!;LB&0sYK7XTXtn6P8NiGWeLR<aVk*U9LS6?k{MJ<#MH|98uz%>|F
zj^!oxzQF163CwI5V`+5gp-<x;g}Qi>Z}!M;d+VNm0dieFHg`^o7C5B1^?0gbF%`DR
z`bc@6(@`F|f-h-Al5N+k$|prn*|x=9^rxnma&O;$=YHTFz{eHnhk#&cV8B<(*rm<d
z4z6`aXLON{{01Dq9nPZ|-HjdcQ^Af8azf;;4z$pv>_#m9(WNou%ZM#6KzsN#bAavk
zi$UT}`9mz?fUQmlEY^&x^^QG?_FzZ9vlV$yERP)w19M3S>7KCt^q&AgOdA3e@)s68
zzv;3Shq9}fPi~zD?2+Crk)353S*>9G(YasfG&PiCX{JWjQd&t{kL-Q>xK>*#rWnL&
zBO^n>5quOsk`JKD)=BUL1lhxLa@Xxg<$(|OF~HIi%3`9L<}0hm@61^RI%wazT3EUe
zOf6b>HS%3=Bx1vW3#N{I;+1m9HY$=`h|A05+)%Ye_wlz2zN3KtQOS$)sO+=J(Vvb~
zhgeN$`ojyrtgUUb@Ta^$rZU}vkKE>?DjlKb+U;(L)lT3fe>ph@tFe6>uJn>^+{`fp
ztTfA~^}(}HZ6ffcE?H7nl|wl#0wu6=?Uos?Gv`8YdIdWbaqBi~Sr#F4!`+HEe|d!p
zx=3IspwiF(#-USha7K#~`0L4kaq&i^M4^oE^#mIhsJ-8D#f%{+Cvl{mC@JllgD5ur
z0Apx3iBksEE&o;94Sld9iFdA$fu1Qb1EkB&?b&9|3int5@xDVbSrS()DX`P!D;a(0
z7shXflN|V*gI+C4rx<o+dOfU?P1=|d!nboWU>P&s$<$Iue%(9a7Fk;CG%;+5Jzv2u
zuA=p8NPo1`U~WMlTwu+#dnQ>k4YUMJx9qB-z7JC|nB*HH-vC-HqHtbG-LJW(b&gP6
z!{@hYTJ2XCAiBzJwOh|!_V~@?26Ej8((j!9-lm<et+~ws`_x<3UOfykSfhPLi8T;<
z^1dvqiJ;lKr5-luD8@^pN`5r(^7Jvz!*kPW&#Mwv5c#Iry9BGT&vS9!1cplGk|&Cv
zKnU%$K~=oXq{7bUe6@(QlRO51I4~oe6il2xp9>mIOd?+NBg7n~fFj(ZaEG4I<ux6M
zq{|4?HAY3tA1unVn-l`{vYOL%PgC;uWm|xvhiQ;Xx(`poiBBWXDMc=L*+)JSfqf=)
zfSV5Bj${6G4Z0eDT8CV1RthXvdSQ5=34ob&sxSQq*}^l}P-e_9`3@QW0(;%EBIwwi
z8S)7wP<wdarXyW=O>>MJbQV5=nc-X5`a&2`Yrk05xpKY^$L)jl#=sd!vx`)9{OhXt
z{JI9iTxuL;uEX1NQv|9?FHM_lqK1z(o9rnml`hH8%B41rTFr}P7Sv+T5cveBHb>JY
zq6xUM)8Y+B&7@HjU0i1SIOBWSj}z#++@#BH2tume2R^fC27jBVd~a6m2w3*V&trLG
z2a4MmxWp9BJ^21fP(A4LUT`e52raHK4U=&j@ZEF6oThZA#9pu2f;YN1OVMT(lACC8
zzme_|Y}Cva|I*ZKo1$I+wp8yroy#{D{cE>&0Oga>Y0bXCZnd<Mb4E=ThQb!8nkQHn
zb|!{;r-F1&7U>>dqQ1QJEm5XF)1|){{Da^3sJc>z2N2MwLB74?2H+XCV&kfr(f=jF
z${T7z<t|30n7caf<guhW3Iz|SjoREfD1dIxxLu}o@4|)xpaG2KDi82<1j^S5yom#U
zZsV}*{on4LsI_$)A&hF#Uc}N(gwi3@m3zI$6z#v+ouB;8I!Wb9wB*CVZc~bu!7>xQ
zYd37Hnta36JBk+RX&0K%N-a|`qdo*Da9b$eke2CV=kXBoYcW8x)ora!C)BMCh*uQj
zFp!>EMcgAPb5sC^Ts!e1+WGrPc7X~7d#a>k{JXNQP#if0AEJhcDAXyM@VOE{cZLLM
zsCxvB7K$4y;3zQ+NrSX%zaa8Jh%iOw*qZQLGs^DhAhrc<j`c_eYvb_zsb{BidueL%
zKV{~~NOHeld0rLj5d{nnRAYOA4MR>w_a2yY<!yRGq~v#?lzaRH;D?HjtY9ZC%6b5w
zIvty?z#80eFoo^AFJl60C3h?t0){B2WD@Sy8OVZgQ+85Ro@qLkTwuGkFtxSyab~z7
zqx9O#R^j>8olA5nHo9wQy}IXKEmmMi_<j2i2m6d}D`+F$O;cf^b|1d<Xg?9o_P0D6
zg*WSg-ETXwnn7zSy4z#FWf5D1h!O>nKcX}S>uYmXA=)*FRvfT*)&uF|A!VVqHQoLx
z1Tau`;ytJ@@NJt-+DmSf8j=gIlzQBi>lZe~*ASufch->xHgiBX(oooRU6yZdw6*!$
zGH1q((pc1Om`9F`7#gLFb!af02YF1qR@wI8s&2xR2i~#FZPhUpY{!Ahj6BQpzvl*i
zNyT7@fb*sMP~VbkxFsg4q88)tzFW4Bwj=S+JJ2kXj_5;FY9n{5<e?#f^(so{ne=>p
zB~lE``RiIEHrz){jiU|I*4_;NKc8HQ4Un_8zMHtXsm53_5V($l&o}q}k{EOB5aRLI
z#$WSxwnOZcq^dAXV4U6inJ%K>BIW7xAl`_DZhhKOr5OmHlvJNSJO^-g1P7rtkRjrb
zBR@3@u-u)pHq?%ToV=?S2+ngwhH~Xdj7*aZQ^-g91Y<K=U-KXP*tGQdC*|(yegyaL
z95zzCQ;qgk(j=umvo?@(-LP>VKp%-OCu|_KSdy@`?4tHU!NtaW0hSUQdn3=KT9jU(
zBMR4$L;a10lA^Q0X@~=V$*#zrnjsu5?X<Z$GUZWY#3~YEj>AMCl>pW}kgKFgXhIKO
z!k%##d_G3I0InD@8iF&o2w{or(1Of?``GRz@&9b@GQRPnsEgTh=a^*8`1eD`TP93=
zrn*Z8kcW}V&5PV=s$(S|YW7LR+d;PbPTq360R{`NRw2D5?SN;6`pO!Z@y3o8NKXVa
z(I1T+VDyR9nM{oJ5=Wa#;BMz7k=a9%b@(+mxTgRs;VYqp5R=+~exTjkASQ%w3B#5a
zJSSX1B*aj_@weaZ&wA2p?+`AuCUeru`XJOcln#INQ|@l6U=K)JRqzgiGQeDx;|}*!
zT4*hE2a=!b73xOb+aR&1UvV8*c!S~4wJP`ys!f1!xgza$p~)u(9H}djad%N}d$`d&
zjTXOn?&8%#!lA%WU+Gz9(LsDT#UsxB<;{Lbx+f<?`YumH*&CnTZ%4Z~%qPcneYe-}
z-8p+Z1ul<Z6#Z9*!Z7dtEoUnE=Y>V2&a6@x?Y&x*SZ}BJKogZ}t_E2$>>9G-*?mYj
zeFgwHNE)5e1nf)w9jhw4*8k!-FB=Bev8<op<>6}X;0|ZP$r5i<q9VC7^<01+FITT+
zW;+{r@wFwuoZoK6Z8Y0663le}df63460xSxR9x{I%Xz)qgf`Pus|Y-qZk0^GWgg&V
zH)WGZ**b)LVvt*)W$*6wxTpV5{2|f()G5NR|MMmV-uU*^>M4lsjzEU8nSkTAnLlhT
z$7UTuv$0&4uYknWA;<6nv8uf982tcdWkqT5rD2mK^V+H(intDSf`Dbs%I6#v$&!Dl
zVKWx|R}g@75j@}zRD)=p6(QfzPu2r?6|45Wg#J2pNkQGs(sP+QHi$d45-||{Hr4pS
zH#GCT40czzsBy(8cc}iVg0>ZVOsMu2v0AHkGQH*t$||Nbv#WlAIRizu<uD=5?`mf6
z*}USTV3!;HKJee}Q=vUWx~R^{4iKqHB53H&{hl19u~(k^svCrJH#`}B7V{r;N!HY5
z8`1oum={+YI6+rK_;WNU`nAB2-9;9@KprzTr-vSbFkQa4{(gT_-FaN*u4~($4lpXI
zTy?A}>OoYFG>H(TAAGq_FhkOH(zCBT=LimTYLcB11qGmvP;1h8>Fkdn1nKYtgTZ3b
zXQdiL8?zwFh_m+h3ig45>}B2W79l61=t9J%Pq8=<9eB{U=@7l?BBO)%a<^o(Ax*3h
zh#@j!7)VFSIPafX4hXvaT8xMD{i{F6xKdVBOytVa8>354R#xOWkvNHGYfE0L^)#8~
zJ?$@RE6s%M>%yv7C&b**+cStcCicXR7@t(>B(w9AH@eE3dBp^<hFZZK$3uyG!PpD8
zkhi))R>mBt`>JaI5q6ZA3Dlmy;YNUpB0e)6fgr*@n~|<xD@nAez{vdF?;k|V$^!q1
z1!HXn4L>#DQAZs08I)z9l>soyk?UV0`_nvscY&wd<;x;k`}6!f%J6RY4eC%kn}GJ<
z1t}4BB7wNA#|h#IqLdlO94l;RxlD&yN|CApi1B^&iyjTrJOu%hVqRH#_7Nf%9XRl{
zjQDbdmBGz`5FDab?<{@b<HLaD%f-1;9rO!>_=XiGB^L@K3cyVP1FxqL5yQtG)Vx-6
zGAFVWx{4DMp=3?e?=o}+%4*O`3ogeYx>ibC*O?)u3_GE4O9Rx%V1h(l9^+b-oR=N0
z>(yVQ*pnEMK88xy=&b|7MVPD7a>~(hRZ(PiUQF_LTpHJM+MCDM-~WqZs?SXPIo*y3
zQK5Rx9gtJ_)%duRRz8DD1*S$8_$B^JVg%6$>)l2c0S4$e&{jk+XfgO-Jp>n|#JOmt
z0|;j4iAfMRg?_$-Bn#Zd@z?HOPL5LX+fB<bcvfNuorD6eS3*91CnLjEOYUO~e-7lA
z2@tNrXM{)3MTs#)(tR4OfFoFOpV*TViSCR4{%$j?sW1_xVxuXlpi-PQp}&lC16$?-
zafutt3#-o{akw{oOLKEuxVq%aa0GRlJHvk9e>!9p@wcjIP;&jz(SyN?#yXqlx&g~3
zyhDxnn-wc&_~;0ktvssSJK3Hry4VxVwEpf;Xj3Z1SoU1NPIWG8=6OC8VBWLXlLj=y
zsl)Be_h|hgAJJdpDlgs|)`A)mFzZ|>x@AUVS;%@smqe_s&`Nk%GeJU!t5wTrBa7Kf
zqkD6e?%{fTs*OmG7UWe;*Frx3vf`Em=1xAkGOBMSk@CV@vqxiRW-WX3#5P5=i@M(4
zD45c6QL$3{hzg)`Qx`>p<IkpOV`VP9HQ?5fJ?~WN7P-YVWLv=18O&^gy`-10eMy~w
z)!GR1|ED#>zW-NR<0qz>=L_aZLunhGm#9Sw=++A|-WnR?(zDxMF`IV$s-{}*53|Ek
zXG#HFiD_Ij4IRkfdt(;YGK#e=XFt=;-h*6kign`-L_pmPHxm#o@bZ#-cIl@!6NF^R
zwKJ<xRBgZa4e4YWe!7KopZ$bq4fcaPwQIMrJ{J1yO&kPr9@;4lf5Z(P2oX!3`ng=~
zk;qI-L72bc90pi3*}VHm*tFN4w!zPzzM!5l5|3BJH1ijIG!>sCwF@$coWBnW7h!A|
znA`GHJMQR%R5fuQg#J!t$U^IdS!R{|mzWNORGz1)m4wg?wxZOS$5`_k88iorgmNt`
z!*k^qI|FGA;jjyhLdb2zEtyFiS0_lq44EgkO*+>X(3z?D$$G1(V+azhI)M!$i92WK
zO5In2F!|8!>srKnb4fuS>QxSDZL-izn((ghOw{F@ak{i07_J^kGw@ireXGK6gC(a`
zVn`64{QP|9{@4~a38p7slpt0d<&#GN@5%7FrAm{YLQjj&ECS5I`+T}3*wKJw<u;Li
zNwi+e27xbW2sN6HK^2%Z(mxS}PnP%@u}la?++acmt<G7QtW=pYBZ~c-Xqe8A5oO`0
z{`mgi03uI)_#vwl{2aYm?}(Ls4PDTZ6SI?38W6%=^vxcSgc4`19+wKkA)vM&Cw#Yo
z_)HWS=9z`Ol|(a@nZAn%7Y<AAI=MxPRbHo2HB8zzlr4X{Rl$vCj#|ExotcIsA8sXk
zT*13Q19h;chJ0-<EI7OdBh7yK&gpmTTNy8$^m1znWL{)Am(KaX7x{N;rU+*eH8Wx$
zVB~U3$vmHRhjg8=m~V~pgyhcd&Rey5=DM(E^2~`#S=B$wIL26CmkrtqUUg9T1>L1g
z*4ct_(K!UW=|yna8q&G5fP{krC?{J*X+dD=pk-AmJ_iJWoLlC@X2aZ|*g;iQfcK@Q
zp!xwPfwNcDx(8ipy>lJqI2Q?B-da~qJmXHT&KA$L5}hYm5c=PX%z)t!`tF<ALPRO8
zrN;T{!omAr&0W`CG5$M2fXLr=*<E>3`TgR|R-T*YK=L1!T1dcM_5BRLZ!sf2IKm87
zA!|NzTEwceXa(0UH-pSf@&82}-=qr9nMO?<(}T@MTg|{)Lx;_W+Z4lgNqB80(&^^v
z8NY>Bq>j+g@LB6Bcqulg8l>5xKT|CNFMU`nu`H18&8AR;Qt<V=lzNUp>kDX$TFH<i
zzTW$fkDhz+>Ln`xwI=rDVNL|bh6H`#MfO$@)@7d3D5Xnx&{=qrSKtX#VLKorP>~qn
z%h0&n41~rb(U1Z!|I0Z{24eSn5CR3juCbR@;h2;!h?HsnjpkFgQqNvAP?hDmmB(y~
zVn{shOukg+zU<oY27TNUcNO#PU75d1Fm55PQvpC5!##$+a6t9J!tdwPAHhlhv>Zoo
zujk&`8MxgP5BT72PPT3OoXFSy9j|8g(qz+GRlu3T5gH81x09A$97^Jd+51gS*((iI
z;b1>f7*K3yYoQ<i#L8ogHUjvn`uoDPEUK8S6Yk3|DU}{vFsA)3hS1c)R&U23{D&;?
zLU@@k#E@_!7rFAnM(ihm><lO77|hz=vhElHLWgUKFxJ316(L(8-46k{EK-wE1SRUn
zzEXc-1t|i~@7P33!#4^-$xD<)b2mtz<`$&4Do$!yP{rD+6%tm8rQxVNx77#l9wl44
zNp%GBCDTy<d=c7vPsCZ1i0%7x*9^ZZ-QoOT7s2&vrV+!Oyqk!LeAa_{!VdF^)Buna
z!mLZ#QCokTda>RgRP{5wpI;O(IU#6JdLC2WM$p2#y#oB*chDM-SID%s$=lES1mSlq
zCvacxw!D?28rwtV!ec%HulnzxpriCCh8?re^(dvSNvm16#kR~j^PnPIRN0WDP7eI3
zH;yv)N|2LCB6ie-c>SIeeFS+Mhxsn%@K)9%7%!Pno}0|~=1K2uWjJve&l@*bbq9S5
zHAs4Y9xYK~;z)ujVQJcwN9^BoA4f%T`_6;c0MRqi?4qB|y5-wx%vVTQu<C9?V>Z8^
zC_EEw4zlJ#%aZB>oLQ^vD&{pp5d5PZ{`(izPQ}!QP6dDAyZwWPPaP@zA}hBP3AAGc
zgH>8Zw03qz8pY;Qn#C)oD;S7fAjBbR1vWWlG+*kb`ih0;uPQMwa30gT+6oMi`&;QN
zjBstydon`@k0?#G`%}c`_uOg=8V%g*KxT`Ds)7opIoSPo+yMixdq9GG5Ttcbmt)+N
zSYXtkBNn%&!4+J>FLivWkO>%Ct8OO-$^|dxXfWEc&7LO(YgH*HhbQ;HvR~sJ?rw1P
zTm|g&z=+INW4c(qJ_qM-MlzgZ*qQbZw-tNQS$UC%Ix>Y=<fG+oDw}tcFh+d|SlI)3
zp9@zKzcI@XM=%}dn4;&LV$F^R4~uiY?xK@dg(lFmrkpB;6#)7p;zmu4QV9HEE0{iV
z99J-Pm>HU2(iMOTTWicgOey5=(bdw%2!>bPd9{?&aQ@VAPHo!S95$9GBvZY)TE{T5
z7)i`C`qBm%UWL|q`-@`i7N@kjW0{n4qJD`vFDtb2Angl<3-zd@%<w$5rI2h~zx=t)
z@>&W0BxFe4A=nApa~)AAB;pqVwmZ0(&+XortK(6d`>(g*Jx-23`+~fAw`|MR`>k;a
zZlEho6lRf}eirMq@qOMXlhXHftgOXSfj^-baNyLi=w={LZ#Nr4tiXE3oP~uOa`$vl
zJa2Kj9O^Bg9A04=BUf)u4$7KFr_NC?>m*{&Z1C5%o9NIE;dB(E&JF^-4G6Tx53KeM
z4jV8q755Wb;C(V?jX>NNZ#<+TG!*~qqk;%d|NSbcnDs$>bh*wD2q9I<`EsoT>gT~~
zPzfjd6wKzSJ$3J`7{N4bs<(UE{9?^3o0GHE8zi%%(qK>#;+cDKFp5gL8D@0vyD!Sq
zG)GZL`rA61Zg|TqY#7hrE>!Jv<eGPAAFlqD3T27_)pu*_tWx+OQxgkqsv851IhrFy
zkl_wF1ZLxKZBZ+RWtAC4rXD-^U!eV-fY`yyV#IZC=?tLg-XxES;iGryT6cIyZ!RuL
zC_L7V*Fh{T>Gt2#CR1TIJ~9|T$z!J2QrjWDR?H)A$X&qYYrYmYzP1l|q@A>E|6r@Y
zS7>S@A?eSru<%sVRn_o_pAa;%REmlU4`eQBd4j~qNNo}OdgHVxO3dYM7%Q-s4ZlbI
z9O69~AC};#=O0OvaYrZF1?&c~Zm|3Pg9r9NCE~94HqiE9Q7?ykN?Ao*$O$8TK8wyG
zlmE&u<g#SMlu51kCM=PSUgiDb$1B+*7-AUdEQo`05;5cwi+KhzGdTrld7~zJx{?vJ
zBNP*QT7Ytqrt++&QDS>C#%q+gp<Oh<*A)D4*&s-#ZDyb$3M*_xY-4|dd$Bo$&=Foe
zQH7QbAj{JP+o;`(mHBl*%~vVyhRtzH<>X|09u|80e96deIFvwLkwS=Xz8Vve9^rC;
zl9|J8C=L7@r2ebYBvKGA@17witc8vp_+&ZAOELRTX}u+ZQAlze$?KFvkM~`VC^ATk
z8%BXkPM~SOxN6mDi>U*wu5+hJJK{<-=6UIdcfmn&TBbD{v<Q@k`iuF*&E(k<kj*cC
zAXYb%k86rr$x9WMSnF>EiVIFIFzjKDhTLdSHo^=SulN-!sYwRxyVDMn(9nG@Cp_Dn
z+a5Wz2Xq3ZTAeMvb_g358T1lQ{I$YI8@8ZziJ9rKmu@(xfS5)mA3PwyG-LW($aH!*
zJ3N%SMdcq^aklEf!bTrY4H5Y1X1+6WdNBX<?#BGC{AG=!v{2r)<*-hauaqSbXSC^E
zB#}$Q$DyfFF0Q&Z-q-HIxGniscFP2jBhd~tM~Ic3{YE_1Hs-Q+CE(h3E2$BP5sl?o
z_j$%D;qrCWmVp|Mlr=qeB3C^zdTK3vpbjr%6z&UmZ(dIrAz?MXBQ?OQT?A}k%a{G|
zyHGer3|gB$>_~SwN}=T4)u7;{foA<;9V8o9L2g(S4N2hlRGUG6?lNw3UJ>xyr&8B5
zihTHOMmEHdrmWPc#_6D1e!Vwsq6_yYANZT<AcjOp2>7B7r^+n?jPU?#RTGhM30O+*
zgn~|;z0~5FEt6nqtKG-K$~J?tKjDjXIx}7oFOR5hjN@{<eK)WEpj!Hp_SN;2CO9qd
zd4x1YpOGBR#=+SVowtKyW82YF5=7`LR#im&v66swamqH7Di&trS+tY6_tT$^WG}Bx
z#^@kdtaoS2*3u{iaF)t?`2EaB+^^D$0vdc&{GR2Ay}vDyJqML2)nw^!c1Y}{w_0li
zrX>dOPU<0nIW1H!1m+(x!_+Or@C%~;y%JI24&jhz*>(jwuZ*o@&x)Gd?@j&ZFeg<_
z93oM?skVap84A252-?^>DzqO(4$v=JBp9H|ODFN$CPzRn#*ps>VLz86`=lRb7NF=U
z5IhUuZwk^5UjBtSb>2#tBdF_gQr}lyQE-H!aE-)-{`WP=lj4W*7+SCV1$9blsY9m4
zP+v_glNJ2rAgnTr6;onokKpgU@}%{<{i60Z6*|&->QTgx3(2pxgd4;k%W-FM;0at|
zm^1A_kecC$75@+b-fBOXQ7QO=`R6y4_rQob{1BIy;b^5)>nDlrmW$g%h9sMw%hln|
zgf&@GK5ilD6kYMiR<(YSEbvYuQ$%D$<*Z+N`CFvjt||bIo+9Zcf2oT^*Eu>VKr2A<
z_to<9Rt%9yZp2%rtEei6Fk>xk8tGv+-utT#>!<t#erpag)Ipj*nLsMs@#5f&tVp}q
z->Um3DX>^|$_j8`yg;FVH=db<Z4{~zE&${w+Q{T>WFFt7a*Ssu=c=2~Oj$DRO7>AK
z4$*|owD$x0946cdw6vW-?JLtLDYlT2>xwUc`Zj=m%+|v^SfbrJB}ol!=wc86Z5A;B
zbU2!3tmo$>D+tX#_bVaDaX!vs`#Iw8`3FL859Ien3MSuO`|)W?WcZEQS{=k_j6Orv
zznW3($wq49Kb?!`bgGCR)wuh#wN4kQ?UR<5Pe7|tm0sqFzgs-uM4iI6x4%GVuT>sY
zmfBM1A8Xh&s@gP=WMd6A_7>eilC{>3<#B$S>A#w4pfeUlY$z<&=K5b+$%?Yt#GRUf
zs_i_hrTjASR>qHIUA<)8^Ov<Yf$#UI_5SNUm|J!xZPI;lY6q%mzo@oEk;T8VRxhch
zb1nu@;-dS@gLxJJ)LA8ww+F{V2!wuSSfK=?PxUvcw`nHv?2k>NN5o?iga2;6e?=CY
zb{O;gxILn^1$w2H4)<1BfF$Wi59lHCK(*(#QvJ`(ccn+uj07**@1Enjx*T`=v7AYl
zno@z8Tr`~Thta}b>NsU&)}Q|fRGqy2h5-oNO8u@hcHye8=f?rMH@hzrsvkxYs%zbi
ztRtzXj|S|Xl61-|&Ua@TD8@uYCRbbiuzp`q;XX;PfI=f}7o;&H4gloq2{CYO>QQ!~
zqAXowMXbP*i`aQ`3)mY&^0;r2tBwq9chfjE83GZ-WKRAv)4fw7-5%ENU%HwpUI;-m
z9VJ)D=In@xnxfu(r?svai&^T0Yx%f*qw8P+)?iY-OZX8{4x!O;^@%+}t^_j!*b+71
zQj<9U)79;K#6k&w?jjeS$AL5*LP<i>oyBTx(A4)I?>I#Lg4A7x_0@}6<un<mt^O$%
ze4dmGy;&FR%eSdpZEblg6K*}>u9N*F3Sd^6>BL010cTrpNPi$7QYjVmFx+TUuP<7F
z0FYKW_vxLkYknuqnLxRDI*gZ-d~){4Lj2hN>FSMQD_L`lAqY#bG&|G>3&3;vy&d8R
zQ{o_KQ2U4kbR7wP!K5TReEx%%KO?lOz|!bb=d|T*&;{_b%IvH%BXxU7P+XYH^#d3z
z))T)Fm)k&93=K*eX7Wl6T&;x^tABBHzfFUg(&PvxtJ?Im%|X~Y&br05EC9ywQHh%^
z!H;L^Y_xD#mic1lxbfiJb{+{1|FgsQ3dZX8&!>sfjc&GWH)3Qb8BwqA<rddySoomu
zwRxz_rgdjc3B7iI!~}GD|EQz(AFh%anc$8o6Cu#t>C&B@?QeE$pRK_gTU+1Fqsxzt
z4Lmj+Z|CX#L#l6V*dEWUgTo6vuV5wakt&o{?iW2au1mw&2b9&9bbpQ$NLJ>Zks&3k
zs^7~>X;RJ?mTlnMe0Zb)IK{$`9M8O2y%@6HGvzOPpVP3R+o2C^STkK6I_&omy&*`p
z?01;qLB)Tqe0ND6m?7})MBtw52YGLxP1Jc+oi97$a>t8!U97}LduG}%(0@l3;v65`
z!FIi~KsatRP(e2vy}?sdVsK;!{_!_FvtKp=m>N73?&)E}j=bwxNsc_17NX7I-L0$5
zZ29BGMObp={Hm0T-g<)sn53j+YXmvh=P4#>ExzKY4ttC{Mb+f8oZ;?+g6XAt{j>uj
zkdv<$_)>xnL`37jTp<e(LxQ6x74&o2mPGpL*NofXnz`I^#+oP$3=@lbjDV&erTnf4
zGwRN$tzSx*)LcnH$k2h@mTLI@1fs&&WGn*UYIjfprQE0pIs~tu%m&>JZaE4*xtIT7
zh=ku_S`IuI)ATuL`!^fWS+#bCVkEFH6$i)}kXKv5;tUfPR++6{cIRxUqfoP-+f^cV
z1k+~4??q6KmSj2VOxPxPe;ti$FssdAC~8Q^(Z3SLEp2*552No-fUypOrB_FvW|vRh
z2S?|Ubb1BDNZDN}kp!B>5G~5|x3Nq)z8MLZNN{gaVsCfH)LDe@HR(z2#3S}KlKLE)
zq)diRHO)QO32e^UC>{vZ&Y;VB%IDHkgw+ZNWNS6MziCdOlLT;1vy_wJ%*^sW0FuAP
z5i~#bYWvE233^x9y+yVS<3QzdSQKd>ic*)Wd<j#5iwwxYLdW{WjctAUpfSE+uWP;b
zMyDD!r1flHfKOTzPc@AlK0epu>K6CZbxM)>3y;+SE3?llwdkMaWt~)MIPz;dMJl=g
zFtEri^^oH-Q2jOI41bu|&NMsa{tk1lO?wP^=^F+;R}sM+M#*wLejDyKSLRwHm(bdj
zRviISE`1Nex%0eTZU(6x-<ejCN8Iy&PTE_hN^EsDn7FJ;(T1@Xw9gPv=xkntJII{h
zWjNJFkFCOlT;mkDte6z8k;y`s_!G5I@+lh$Zde~d6kN7$wSLBxi{1Q_B!io{ZCVQB
zh_?>)OS}M6&jeKE$7q=6Fa|C$RuI3|<1*ls7qmJ~<O?5uMx}2^R}38ZJ|_IM*i%O*
z*@mA*O-={k^5x5eT8d1&1#Yp3A|7HqHnPsn381*a&%Mcx2TNV!SM<*2IdeeHmzLd`
zIo#6MYYJ%;t)54nc=?e+!A4DF`iQg@drdG;cADDJCQ--{RgOLnF4f4!sip=)M>U*E
z6iMX0^`lu8dWW1-b_O)nCed1*GM;D1m0@rNrn2{j%32@7%4`IJFqrAE8b?uo#2ri(
z`q6f`9F-{i5k<c}=X&o~!KIDwhlr;i*FU;{$yE)yO_Eo$KJqG>8(11J*5<usuood;
z2GdpBP#+>hccB$|F>x#}LzD*&&B57~r6>PR5r_fXe^e3_CU9{i8DG8eNWa<CByjOI
zH`w{WsK(FBv8sr_d~hcl+@bzyWXXb3jq`2~@!q>`!14OOz%S435YO@B!J)bkYvrd%
zSX*&q=>?`kJ}YgEP`-G}dL>hiybJ3KZC7XC+i<k;Q&$cl#*&<*6t1;ccj8+O^@kkU
zUy^r(&`kf%YCA`|TaC4|9B#f-a<py(|0Xbgb>P$Uy$R~~*k41ncYJO`eM)3V054Ld
z${0JDsK5~WsVW1%YSh4&VvLuWX2}RegS9F5A#%e#DL0J4GjfLmWrV(l6T?x$192wk
zul=;IK48v2a0@z&FbfZ%D7ywzKrCZhl>Em*T0lO*K^UI+SC&dD%9>e}R>Q4m;xarG
z*rypgA{qsNfLwG#HNwW}{rpyrZ>G#7lW+?>L+%qyI0@1*!9udq4pUOqkt7Tu^4UsD
z2xIw>V8qZ*E)sw)7ydg@3*__FHPr*cF(D$!h?$@V+Wn%ZmWp6>h`1b?BuG3>^lJ`$
z*iYyW21Lya93vH(kxJ-1r}9Zj<KI)<w@9QHr{xr4b%d8sW3XZu7^*sRtl*3;ww-mf
zJjYGn*=hu6nzANd02vi)agdQwt;DG9GkPySB}Ixj1lIHq;G@N=$qnzvTY}=u?n9?Q
z@ZU8of$sy!&kzBPw*)oQM-@WI%`=bPvxB%pHgFEm2_fN52Zn{RffF~MPPM{3R1#NZ
zWt@34hu+B06qihU?J&_l{K`-T4wvV+qZLO;saz!@Ny?G~MB!&pfz-3-%F8-z8`(^g
zD^uvk4@+dotkY(D$dsu=SEwp4)S5o*-Jjpf=Zau1v5SgMch8^cQ47XhGqd94M-b4B
z?3N>DxZ{NsXp6UBrU*1zoN4?Xkm<?x6Z6n<=;&SaW(JrE?jw=Mf;q0aJVKYGgpGc<
zKkxG5B3Z+7=G?y~0BC?Z9SrTbw9oCv=^N%mBd*ECLKD@tz#b2<$!5S0tJDC#ts50`
zlChrow=Q0+Xm3Stvvjin>M%zx$=mckQ^D@<s@<}6%WEnAyYHO6C#I-&X9qhFuN`jo
zbU@j$C|0z5e`88^a)^r)0kYroiNEjWX)ZOO$$)gmSSobG`slyyDhN-<Wvn4L(ax6R
zg)Fa@qLup%AlNd<<dIk1+^`M=rSHSm#)^E8tbtwXcU|wt->2uao8a}=I}E4Rr=u?m
z)ZK4~yJ_oQe!VWT!P*Mj6++xU_Zyu85<tjP$Bk^|UAEn@qyn%wf8l267uJPBi|spG
z>8YbVP1V~+>ye;R=X6Hz1Dm7ilO5y;kS(JC+F1Zot(FIbSFI!0attfp|BRUWRMbU7
zMqLzyQ1NHXC}P=U4wESQxyZON?p9fuM(u(|WU|ebo(=<Pv;m+V*LPh_GsTVk-akIg
zIxq`hml(wIl35UU5RoH9+(rT}&1xAGwc{>n&l!c0##pV}>p(_Irbx3)%7CBEyZ95Z
zC~ViFsiX~V`gJZT;Y6XoG{OmGi%EWtL(Mk-vCxF?mz=uOiwU3kMZ_u+HNNG~awGmG
zlDOwX5uvCyHIw#fgrHzSf38}b;&{0OglMtP=fL?-IlmX*7|rRF^;M36Y5ML3FgOo-
z%2(a>jTW@7jN2Bp&I}-Og^K+PIaM+bwC<F@ufSjuhreKB`n!%8)>L9?VziFZ<^?E3
z*`B@9ppFt6v=z+Cjtjn05W*X$MY-Q(h{fM`oERX=19KEOp;&R_PHEY2=r)^RAL#lC
zI15tmT2(BsDx7sqln`xz$%s4-*ctNXb`&vpk8*PfI#e(EoFDP{Vy#{)qFi4=O11pR
zvvL8sw!-ts%c{lxsnKTHh30Yc!&Qcq&M$kfP*tCwZhj-cp|r_dKWYzePbD1*?zX2A
z;67AollymV@&6V2>ckjtNvh6yIRNQ(ICWBRj}|s`Ni)QTB2U`QvIQ?N^qzLDiQ?UE
z_Y(O%um$p=L7)?sKm0Zmp|i85#L?&QbAByAIadupd!+=JFQPFZI`F_xlR;t9;!)M~
zwa)-IOAt6gU~x?32Rx&lA4l1N$hMt{ZF7BB##}Sdfm7wIP2?Z159f}Dg+--BMyFu?
zTtz6Xm=pbdM6inr<MNne&6>&^&$F{uZI6u)7B-%YAD8bIdV$TnHMB?(jZ8h76l~Q|
zys+8%PW+CkiDIRyivd}c8lmy-)*)Wjl<RTe@1fvvX`@Ur47oo!1i6m-=ZFvy5BP`V
zQsN#Ey!``4AiTYaNq$?$y}sfS%y1CGrJvtjpADz081E!7!zM)Do|QM<^d)+MTvSpi
zDdA`aQF;S@`q;kQh;qG2!@)mx4}qy{XahSMq#WOF%oUjU`slj0X8dhPk>@&N3wW^|
zI7y9!Rf<VL#5}ZI-+X4Gv>dd@mDDQeKJfpEhWsJLeLgA};eS&eglDv@Wf9=$9=-C9
z9E4q08`gZ${#75_sy7CYpM#+Md?yIEUJ78+y6~s<`$!D_#tgMLBXs6%o*xh338tlZ
zg$Kkignylgv)2<;bu}R(&GDl5l2Asm$ChG`<VoQEK`-A&`pD)Fp0}NQDlQNY{;Pmp
zLaZzQBhnbG7T8XgBUj@5pt0qpxVgfn3n94mzJGD!bckkO6nWj}L&#d)f#tCkt?|6#
zT0jI1r45L1`ncx|FmI!DikmkuRu<5KCR&JA{F!{b%RVi@<sVRF2}+|jA5jt^xl&o2
z`L*2oq}1CT`#!UMCM6v$(6$Ys{3|d@C0AM3zP~%t9I7SX7#~cxpON;U)~Wdx@&vGN
zW^+*)nRnJ$d`a5wO>Ad6nD(!JrTpz{AswOloNImH+Zn&{a(%T#nsS0NpJLy1758Xt
z6t~%&K^0a|#ETK%HnHg39SGTXSmYyo;MQ5J+_}MA;<){|;f9$vM)ZTyiR0eYq+@C?
zu|(}3GJ?j+urQo$l&P}QZcVpl)UJPqWjFWidj3W}*^E4x!~@{obbCXAH!SzEL$wm_
z6v+tnhd;c44@d&n2b|bT1$v~q3}mTUi$xILjZg<Pm}8&Vr`IFAxFw-$Y!FlcO!yPc
z){R^S`jZv3+X(SDEC?Hlzer#mOE`OTq$n8IgY9(Guf!hpW6oUnofe4so{1jCu}G8j
z-Vo9V4+)(jkB~;~&ygLf2?%kZ>Z4)Q_c!i*+TDsN$zg^(5CHXbAl2^Ot<7I_MU30-
zc$!1y|Bm|z!R(Ta!N=-({O$u7Y$6DuWlc4lkcZW{rGOzNI6l6-s5w<$O3I|>ko1%E
z@f3i<W^Mt?GfIimhd+;kDexy&^dKZ!T?J*Gg&f&oRo2+(4?beJC{Om+)RaNiQ_H9}
zfnnPb-ed)fj|V>yLDc%En&|sC6Uhw;CR~8jGh%?LleEkUGqLe^CrlitRFz$+%qsr(
zxy0c2pXajb5TB(t5x;bkPn2w&mkwmKaz4siCZZy-?E+-BvH8p`$j~SQgVl1NAM1cd
zm2y&!tH?5or(j+yD<~hKDpa#il{3*7U0hCv4k1|2q7$#wXKIWBgWqN7D#%f~NDg}-
z(buS`7HN(hL8RZf^eosgZWJ)%2M|~a=!f&^2BIp$RtlJr0L?=odRwG^f8ul>qkH$a
zVC7T}Kmh`&G72?)ngn5Nl&Id2j_S*QF&8N<2mf(@7Kbvb_YTVm)PtVn?M{xnH)e5i
z!1tR*$nX)E&%AA`H30fA8)QIHqTI!U6moQqkOP<s>=$&k)H6O_mbU&khd%<UBXMuY
zC&+Y14(bjoS>2ako<5*lc&u1&mv3v@OhMw1;H6nMYUOU?3L3nleE#UKX*1#<6}%Kh
z?34vGvO<1QdRGOwAxlbA)PN($7{FezY^+H@T8KGlBh$m5H2;(L6BP)q4T``8<>v;4
zvRsb{U=7##^$O06w-PjRk>8S&NV6*A-+?jvP{1KS{VvAFLT}T>fOsEue*k2m%vopU
z$xU21jV8+YkB?H=-3pn|PA#(W{d9wAn$tV>2<+nU&|&AWB~&KUkF>I5%~=brGG-QA
zvTdB^q>fqrjNvi)QEh##b;TgF`xTP&(xswmuPx)c43iZ`s6WJZZOtAV#j@qP67<Py
z7DH(r=Kle(Ku^E<)IdACg)Upw@o<${F@!;tU8Bm18Cs#pitn0}+$_9<65DR8Qehh(
zADjZ)9CCm4wei$;%Im^|>nrcCxHiWzsI3oNZ9R1D)pH%)(=8QSRO8sNnTb7(nwT@@
zQbH_Zn(V=Aug3{b+lS@|G`+vSN3UYWR~bIq`fQaLS!~kTsyaJqO^cl$G=su^utcw{
zuE=BH^Zt;K8M+Ec!x~ZR5VPXAL4W08k`<<u(lSB3dB#y9EcQ(uX8&YBX8#4XUc)`~
z<)t&nvrVpIi>nM92KTV1`V`v^)0t=c+_TjOyu3i${Xj|7GJU-(Okc~E$WCiYIzLn3
zn`cscDb?=E$|f}V(lt6m$NcH!=@@x2yBSLY<tb1h*H*l2R4$?79w}JYQ&4G2?@rMw
z;M0OJTGBO#H;B(X&KPI+e^DL!+VV8p^fZTJZWt;yC;%^tX=2T^n8_f7$EA;sIDO+S
zaTY|N;4Zk`%4_1ft3X`^`P{pT_6=eCyXsn!aJ2DO`|;?PG%PP%;%3nDF^(hDwV^bt
z{3Q*m%}liX_xGSMEMDM#Eo?lny;S}9c=TJv<Fq+FcG+FHACAUQV`(4Tsm}7@g<6Gr
zu~U`e$!2}9+27&{3dIX)EDDPhC-A8hu=3N+wX)v@Z{?kC&ATe@b*oB@l}#_Eu3$x(
zvWgXNp?-c@fpPbyIoLzCy;%04RVPWw(cRavxHt-wjV{5Pn-|^OviZ+1J_lK8a}rYC
z%d`3OcFiDk1P)!&k$c-mEBD~i*EE~PY5tnz{9ImFdQ-H3rS6xU!cdQ%A)kcV%J|<c
zi35KB%ESTY_Nat)u*#f8HDcSEftgM<Y-pZ_J%<r&6Y5c>Se8Yt$DIYIVZ$i2llSkQ
zfR=N`kq42X<qfG}8C!8#sxC@Zc9udR>gqL3M7p624TOv<kD4U769{vMy}~@$y~4B%
zg?Y@xhT@pm@HK)R-*YiHR8`Y-oxAP^d*|veSF*=EUh;vGD8$7r|KjYiu!MM~tufp6
zuxb+pau-tU5<>^UQ*_OszU!`X@EC$N?gdo&orqPa!YPUv2u1mG8A*X@9EK#x__Okt
zc8rBb=p`(Jh(XCXefBSkqU)CR{Nqs(tnrP4He~emHxAtpvE%CkI0{tuZX!1TAugl$
zYXX|FuzcXy$Fg^Ilm;Z&jMK|7CT!e*drPtn88JT=Y}v(UV0UT3!ZPq<7N>k;bjO=G
zEqhn=M22OI%OtPuu#b%A0D?quK@}mpfO8q+-;Vq!M^U)3K<>eI@d}l{vtW<y{FE%F
z+m>o`?5Zlq2IUqes=}~g8?ND4w(f9psJ6y}B%(pkB(cu6LFB_UzLx%ILh)Wz*@C!(
zjRRQXC0R`8qmpw;NJ%q#NgV8QB^JvTrl_)>bZwIWNmXVOxf1}f1Mo)iB05^OQ7@KI
z$aU>ZMPR*W)s3Xt>V0#nbGc#LuBl*;Gl~sL73?~ej+w96Ow|lWu^yjw;q(;!z$2cD
z(}Bn>wqR=^;60rMGTv-aK)JLHNZ+F=M^D<^K~E$TVlO|p`)a{xk7z|2i<+URmFS{D
zTr?%wClcK(up^Cnc#S<gG`<*K!D+MExoUvC`{58I1$wW3koPW_vt0G>h{wamlY31O
zDw`<p$1OqWjTQ?nx}=SGP14Jw2g)*QSz7}@#=!zWx@B=kVJ`M9&aj~qAG<0yvCb5O
zGU{8d_Q(@%HNavxZKcyYna#wJ5&O$k#3u_nA`<zUq=Lv13w)oaGNpJ!U99hPuvPau
z1)I5yy2o1cIID{dkn`7uoOONJajG4M=%&R9)v=|4dCI3QCI)k{?kT3H>W<;CRZPJT
z{_0v^S*4aLAQV`XyE^l=uLP9jd=f(>mbi%)7fBfLvr;=8mt==ybYA4?`v*^1K=U#B
zK25=omQ1)rWkgSFTEqo6zck1$Z{)?*<5O}KK$bsvFp(kH6O!!XF1q{i{kR=wiL3e?
z0x5k{v4N5s7?LQ(mddCBNV`X@2ktOi+;zMg^zQ|Nw|pV}@n!8w`s2$l@8A9LMXaSi
zzR1P&$Cm=r`QwXs^T(I6{y)A*Nav3)KhN_pjxWc5d=XSK<3GN<ijyFWbNEicu77-a
zktEqO=o=fO?>|!>j{o>_9$)kHJPx9KBp1{lU&<Br$CvAAK&O9vAxRPjg^Br(FC^uE
zd;!<lKfd@W|L0s};r!#vJcG{paawf00Up6a5&Ppy62sI6B>dwGEY?51@Xtw{&C@&Z
zW8dP88(eOmp(Dx_(<h39Ep9p3po)fx;`vzfxJ8*yxT~)=H9j`QyH=MwXI`N<*N0u{
zu3nyYl@TH-PP?n}wBzEmOJugp3hR}27dY-l<23=Rj}TpJpk)m(t@3y61G|mJ^4UTK
z>G5nuI1bMi3QM7{tbh8KG=yl1x6yeTPk^&URv}az&~P?BU6pL~o3la{s-AwEwZ8!0
zX0VVyPzbT}W=s6A@u~2-?YzWhu~NHKmc6f{VEc1XwE13&Qq@Owlg;^WHd=i?xb@ze
z=H#pS)!u*9Pd(hLfvR~1wH<6T)xic~6gw7IuxaS7$t>c!)>kkeKQtH7(utw;4lS^}
z@@gQB%|bVsk|g0}h}|kEZ@F)1S=)fpJph!>Jah~}*L0gQ)5Iz>DK=E%V&eE3R+(W@
zOC`3l$v^a7V+aebBrPmqZ&9~voJ<;yBXzSv#UD$G+Hv8-HEy_gfjd_LHY^Li4d@gl
zA;}?3q!D*3?*4GUi92p3O}7*2_9C}Df$S0RSc!O+K|p;0?D5EtQ_3L@7-iFV9x~*C
zPhiTUNj`;*@BYJnhrV)EUsGJ-=vZf_f(_4euuE(g6Wub2sSrao9x^Mibk;0yT`$U*
z`8X<kHsxyT0S%T*x3uK_-~aRfHhumCgH_@6MZ%O5cGL8{T;~W@t!KHK7PW(grAtGR
zWBasTy!AqCEaWh_<lzmh<0OqKmrGiL@v@%)!KXo-26>S2#tP2Uf<U8Q%K2P;AQPa)
zS;H0bp&*2ZzL0g@bT#HVSn+)m8_eO@V~&p%O;J5ZC5Gu3gRWla>MOkEYM8J-WF=6z
z%~AUZ0l`)lz%HKGy~c=1te~-Srr|m9jR>2UGrY8r{7RG(Lt0v>$Vmo>kbEmkOBLTe
z*ueU7CJT^DN~hACzT%rgV3o$4mGGGmY^60(l|P`gQw<J*_lpyF2Z%~P*kjL8G()v5
z8!Nu$VuNcOyN&~HBEISy4mbR-k=5eCJEnC5Sirx$pNm=+&r>Q?RvzVx7*>lgX2A^d
zr?ZboN_j%8^;uh>(jTy}hlz!02fG#djBBoESXgsh3mcwKvFBMTR$N23EZ1VT{-9~e
zTj6<iPF}c6uDCPH{U$-0QrtMRET#d0TX%O)5y6frp9ERXQ(;}_BEF7id4nljw*M5p
zjc7OrX2-@BF>Yv~(o$a|?&1o36)@N~MDhR_f*>I$`8?%NwdkvKvh6@y&1kEb(s`QR
z1#q<uW$JM6tyi6<d5l;(!IoxGpi|`lU|E<j%QCs|*pBtc6#$6K@2<rs#flSLCZs`k
z+FhdXm_U=d8bj7xt?S*;8;ew&_={J<HtETD^|CIPw5*^Qk9Q+0_|(2A{rUt3`rDbP
z@z*CsthT81$!}+^CVqV)8xh|=`R#03lTb=J<%&S5Ck2Pwr@;cZI)U}3?32ZVlQdvk
zdJ0sDa`zqt)lDT`zw+KOP|Ym9`gRX(k<52luHKY05p&hE(drm_B?c`HqvAzK4jek|
z6~5JnXl=*j)H@`p-Yr@6>ZH|upY0LE*1K4rfVe)CbAAx!8wpu@Hu^PK;8o?&fqJ4C
zhR+O+ZI4^nAgYR8+o0Gp4Q{A5)rhl!pnCO}1DDcDE+t(RWJ*$Zc`QUqw#iLH_bseA
zRKbSE8Bi*?m{Vq{o~@}&Uu6^;h?J_Ifk<gDL`nc4yqD%@VW<|GRlzh=)1^qg{4R-<
zDm%KgmtRj~c?~KZ`xnTEitAC|yl0yTioTE1I1J%tm6bO8Ac9fM!3?;}4iCLvBrhsV
z^AyNl$b=Whc^*IpV3Ej_-(Ak>od{l3*Klk{RWWf54;!X#W5>2Rwp2oGt~oZ<9&&01
zkZ)C4E8Ojj)EiJURViGnXyJQOUC37eV~YetW#SW3<^El8CJ7=ITm?)l6at264i;bG
zC(`v0$w@llungA7>H`4A4py_Y9j+>trecM=4mJ#GU`Kad?5GM=U0>B5`pBWM1zT9P
z%8J#smZhOgtX{*`n|-z~z}zOj7Z8HPjE+a+Vma2|l(a&D-?V!b?EhubX6dN#LT(7Z
zB<-wkFA4i3>icxgQ_7<p4h3)kVe#Ax`LSSAJYH=0v@X)=?FgNyiZVvps70N$SjC^t
zl%=VJ8$}q;XpP#b=F(CN0A9vZ0mqdC1`w{?M5QP0li$u3su6IXuya;rIwOM;FG&%*
zj{f}Qx3gulHzYhhXlSo3NRJNP)64<g`&Q`Q_zuOox%2HL)XLop^;)?cQ0Ie`%f@-T
zlUN$xSS(??9PhYoZ}H$vTqOFgL2>!`eDn-y8*|}&Z9~oDu+xn1UO^E)x{uQWsSjtt
z;p!;2l<VGV%3yN-_AeZ+*B2=Pl)Q1l{!}EEe28kQaUZv);mp0Qpo&fD@qqz@tIuH`
zw0(UPi>C*1UOhL18gY+3*ES>3V48RdCZS({y9aJ=&Y>G4iA}geY!g#r``B<jjvY!E
zW~yPTME98PT8C}yml>_UfvI0KJQ(^Pi`m~*m`fC@W7k#)HeA=i9=9~Cd%EWso~QV_
zJ(&G>H~Y(Vybq(lsHvyPUzFX4!N1$+*5>|h1q;UhZh>W{{!W=*hJHEml?lI7#bD%L
z*bjtu0YW4WV0J|!%GqBZw~@aoM33$oG?@4g^Hx8Y_!p;WxSoG|xg1RVy=HAN@%Q_A
zJSP5Ht$lPl%3$I@XvrR&S9-m!!I$CTNcP~o^2iS9!Fi?6qz%q1-&{}!=av0T{{Sc4
zi+y)+UfIv|58`~kX_p?V^U9%H)|p{Bw#{6u=)}hcuuOV}VqwoSsHLdP_qli2J}e&+
zGW!-TEYR-Y!E*Quj9L~~GzBZJu3<wrEbMSi!4}aNwH?N7;tsAWySuK4<+~5h6{x7E
z;|dhrhu=!4$*tX1I?pe7t#rO$=Csl-(#vN>%y{Lp(yn0eSXtNx29K4+TTerT9-T30
za9BA^1a)v&S)8K5VddM)<>0W=Yt{ybm3}{uz!ui=!hUob%HXbYm~uThVhxgg(2_kk
zV)c4mgF)@#NcP}}^~jXZ!4a#^qz#T(-&{}!N38u!{{WNSi+y)+#M;mF58^yHV%?!5
z)}gzL*t)^FVRCFR-^T_eD)v;HVMWs&S8*&)wKw=<t^RUIowqu5o`$RB-$2;#NRsDq
zZc*J(b*woa$A(K(OdOYC&o_O_Z9;vr|KxeAJJrj}ulDb2Br3b$WR{^<aTpRWP6fLM
zI#1)mE2#A8!x+OqFEYe|0uwPvZw7uxGm#^G3_eCg2mpel8QC=O;Wa~g^cbC-becOk
z85e#yGoEE+!ZYOEBqS5*+92h+Y-B=mehqGfkZOvOG`$gSPQfgJ1Z<GCZJvpo(*)5t
z3^|$1IigdNKW&arW_ErX<va|736Cg8DNo`w&tzw?M>5V(0;Y>9pIQw0+NzI^ujDTy
z$b1DKWH~1+2%$e|JfBRFrfAk!=E9EsoI|Q?baL|c0!?|CfcwxTf&^@wPNRU55NGoQ
zx&UM0X%<If-cL@DpT;xc36(}9ghwKN9o}Fn5^ph-^N2)wHU=Lrk-0w0IZq3ZuROjc
zDMKlr#W}}>QjvNqj>BRCQ!dha5s_Wa&!4vP<mJRGa)CGB)`~24Cnw<PRAvQ-?>aB|
z8B7dJd+lB(v+Fg7J4V?&ONvx_)tEEUU^eci*%Lz$elN|h{2+uB-ASC~nDH>Ug0t^G
zUYv_rxFTUT77t42(}*F$W{^&A?#+S>az|x|K*uv7Hbo;-5=A`Bs`*)!s_#OKa4zx+
z(g0phHHg+*e|v$-*A2^*&>W<r9{W@Do@aR)&>RJl@mTam%ECOFk%$P#SNJ@RviXds
zwIGl%jIYBWD^^3Z6D*#QAj-yaE;w{0EgLF?r0kcJl59?=(6ztM!E5kEmO-_0o#s=1
zBUW}4!^8ia2PtQAZh7R#X=AnEl*5B0%F&N+UI^(RVOYrM@vAsu0n8u?!2=LPR5&A&
zc|HZ{q;dz!@{~uDd^#FeIp+Qg7G9DDS3$_j`4F!&$nuoral^aV57Mlb?_a-5{_>so
zm)Aj-&J(dKN#V?joOSR?M}EIM_5SkRY4Vrfj;DE^WY11dudlD4&dNehX*@gS5uRtK
zWwyIhFN`OrnxdJfs&cB>r>trY7tP_SIb79*b7<~#RP^x`$Rd_6R|t`iq1LK_RnJIH
z5dREu1ailIh6tL@XC%UL!c(zT1Q7@XJOHlPUL0TEVo=tpVw|eZsaPwrd${Z#Zgmes
z-*B^UxZN>abqtpstA-ER2f;}dcKI-f_%k$(uMt@|t*Ye&f)&c0kjAqljb}l|Z#Pc;
zRJBfFY&ec^KIIrXf~WB{Cf(OoE*}j2z#(Tik8$0PYFGmADR;z>L@c8u;m^?DHF0hr
zkabpUkWmJyQg0)G7D%6_pNccIkUd<rivOu$D1>FBm_+bKWTU5}qaE}iTCeDT1X<t(
zVUXW!P(%`vk{Qo=`ct7zUJ!4s;s&!y(xA{^g6#W$&PjL?uYKl<gmY23YV0zuPTENE
z#)Ttr8VHwzZ?Ea@th}03@fB53umTCj4NudsOLZM9<qzC9_pH3?w^d%Z&-U2N^Y~Xz
z7_8)ly`-VY%s3p5S(z&rWjvIbeG{GrF&oR1D&Z;YVLZJ8Z6zV;CDfZeML(9htV{!m
z*&Os#skg;)PlN2kaDLJ_6}1+9D70X4Vuc*?tda<wq5u9NCDA-2u)KeNUVb^tCK);d
z#ha%AF!J%^qGjo|kD4y~B%OSkk<Z5$!Hj1)nI&U%BE0WK!^LxN*{G`hzeuvY^7A;$
zUl$sdY)C#dkBV!;vFKQ{@m4s%@d#Bu{;zosJo@MieLRvgP|e*33fdR@cr->orwpAT
zbqtDD1i$8SMoCE0vZWch<T&GL0M9krVcaM45L#B?G^xf8+HxW%w|3S4FdB`U-Iw}K
zkVUZwnz(5OF^sk!UNx{*{_1LU+Un75>c}0AekI}P_T!ffi?8b_lWOStrlGIv#aA7C
zm0)#;*I#6jTs8s5_7l+T$yc2M8Mm|j_(izFvca3%55DTd9gZ9_sOL8qL4wYp`@g(@
zS1jOvCn;pG-bn^pTfi^x-=V6qayG0@v(c+x`<)j!3ASJEa1npqyokT(zIl7eSY=!L
z>VG?w3tA;*_*Pk}=<`^Ps_4;r=rH)NO$n?8y!av_;Y}XUtUwsomCu72e+A0V=lo3?
z&(2G&SZKt-jK3$*`aHushe$1<^93Yj?ITd4uU+6M5AslstxxQ6*Q8jyo{hGOrr)r-
zd#v?Q$o+ih&h~P3Zg*AdS9%NI=H6cTP3LD1E=adDzHIAHQe~sEH+OZb)Q^iEPJOr-
zX5@1)o6p{)64!ejOoBYyBuzc+?!Vtc8Z!=eYLedUERq|yvjvgVZnJzA%qkm-%dPZ?
z%=37S`2D^M7_o)jv~k0SE68OMpbeYgy}#Id8Z~T-5^Si3iVfW}u*(dNUB|E$LJVE=
z>CvG=Is3M@X?sL0eu{GrQ0EU|HQk6?2-|9Ts&f`>q}o3Uaz5Kgmj5j&MZObbKw<%%
zeLT8`75Yq7ls`X5p4d4snD9uF@n_{P<u}iwIO5MeLN8%nA_gVn^x3~CimqGM^N&Y@
zdE~oXGLU?iv#J$PtS||KN%Ra(_;!WJkE0yJUi3^;lF!B8*BqeGXI>n#=dzvaX^`{h
zMTh_V|Ficd%5fW6+UTp~aQ+^$G?gUwMK(RH7Hzlg$d;}ocgNq7!krt67@~kOfFe~M
z&yD*I_YMCixp6WRYwaW@aRDQ2kyvs=E@%19cRn0^*S8?ywcb<o>QdyFvAB{AJ1Mzp
z;Yroh6FDd~amrS|o0hl>6qg;t)jA)m_P(W)mdC8}xQ?Y;O}TKS7Y!BXBnMlSc4@Bg
zh@r++Sg8ftiCPuga`=tGgnxkxskxvlrKha&)s1ESr~u1PoK6~#-N}--?ihGx;J+tt
zSvHg2C;`4k(QAbqSMU?$5n<qEE{XJ+z;IUnG0d_QR;c=DwIh0#%nNXyC?8sVxde}#
zbl=5_kY<bua5_kTQ!XN~6sm^`*|MCJ=isM1C(4}>&65OO!YM7lW8G<Pas1@QQds9G
z%k;EE6h2(ORS-~zhZXsz?HLg^J>SMoU_>~uJrlbmVu4MB@O*xs3612?Ec>Nlun=fs
zT@Itasc&@zR@&MST-kj`@D2O>Ks{Gf;eu<=W>qI$psg$X7`>gv7ZO*oKyk{Y{TPan
zu0z2)kOfAjGZIhI<0m(sKR3XesVOJjN$6Y<5CZQO#O&4(W(Hxt3F1^B7{v}ZeH=#I
z#-`!Bj$!zM8AC3uHX%_%>b37$sTbvVS5Hc{^~2#&pHAx5((>KW(GsU%glXHU);n6J
zaoRXpMvXsZN<QsTNZV7>DuhfXTRc9ydo6bK2zB03g*9f}mTeARtnG29h_;7eEXP;(
zBL`bn>sg6zfyebQ>xbb3%d2YKs;jl7Pnq%lD~nTf5vTkV<hpELiX0u0$z;^A4|Yv{
zt!Az44@pG9#8Lm=7#Tf-V$%mwY|y6q>h2DvnLX`?w`E2AOms^m7lfUYd<PnU1Nq#Z
zS;9U&`xF;dC*=p($>O67%r6NQNvpzJ%`&E{s1@SgjM|wMLFylsolde8>=f&<{h^OH
zHEw-&aiW&blwk32({tK>WK-s0%Zyy?L=MA*`WE(s$Ot0aVlKVcGPgR-p&CSUK`wZ9
zm3HOqx3eTJSBVHK5TpvKDZRjBq<x`EU6hodw=M>|drQHp&9hiMa8cNETw;er;J~p7
zc6?58V3;2EjKC6+?fZ^%@8>N*X=hn6&wHBTSw|pUE7=xuV$%i4X4)1YP{-yFr!1Ls
z(E>luNM6P)o&mP^u1x2hwK|>J+ayj9g#-s~Xk&*^7YBjmU^ff{<~g<qob@)`Tbmj7
zZO)ASk!Q>JGif<fp;>YxED&skJ8XJX1{u`5=vr*rernP&dRA*p6|*uFJ<TN8o1`d9
zMW^DpP%^*ZXf6#GAlykKm~4)m?2M#Hd}2ac5e4FLQN}4N>zZT%$2}n1XIEub!_;mC
z>D0X5fSo=Zd=^wuud4d(+sE(pYSNUwJ!PtXMnfoe*MscGrU%Vpq12$eu$$}EJd4GH
zm8lIYq>f+=GakCwu>%(q%QbO8s2Mth^B{WUCy)yC;x~|Ev}CYFf{{+G_V(Uq6yI?N
z?+}D*+3Xa>adh;e_+HmsT|QO21^RGM-O+CV0`0>A!~u3LR>qyR`y#YPK09o2_hXCW
z4|;bq-N1|-$HyVH1$F}0$ALowEc}4FJn~$^+#$^U_QHRvICr%xRu28g66S6Nc4T|h
z!Y*?i?2t&{kOV%qZSMG?N4ZPaxx5D8P5m<fZ*B#6qp1o=q9fY>R)y#PO@`}B?F*vx
zcSGBNi+@d&zw|!#1tLJc0FZ+epi|>Xo?XFPtb_fj+?SDz>^w%#YFdOQN>)Hbcqc-<
zif2_k2X(MCk8{DwWHGKd1tRcs5fvStNZJL^^GR|6Et@K`1#pr{$d3x~hM;H&vIgJ_
zh(5B(H4{K_jQ%1RnHLSl08N2ZfeMtRGG4CC5J`(Gk+;L{p^*h*2}GRdC{EE;mdpH5
z=h-~3a6*N);A<34g%pw<1hnmCTrMOJM5@a>C$pJIl|dJ-z!=OG-+~^XEJrk#A*-E`
z=va2Ai~&jWq=pDdQ7@jVXz3!G=S)0Z)dp$WnCH1j%VdG103n@|Yrq=MlWfk>v)N1+
zQ;I}D<lq7w$y?86GaVmyj9!%JDozq4<L|Xih6{!2;BqEE(~Z#P4~3G;fTTi#iPYb5
zfygC^6ZwZ^eaHpT-@9q$TNs2?B*)DV?95!SayqK7(&H+4o~2QoPZ3FBtbUt=eW`+s
z5p<D)RjY<iY2=vtq^W>qCFf^va;_vE&~e}u6M*FTNNa|K<~y#UPpG$uU5ONqzdC?M
zwRtbVRv4Hr<t)UZFb(X8z`>#EIoJ<uBebZ)7+n{}`=Axw))EIU7rniM6<h9THw^Qw
zwv}o}x!&f0PUP}`-Kfhd=4G@SHbu>rE+(W`L1he70a(hM2ll*`)k@o-R<PfoQ&8gz
z@hiAQj^2<fS>hQfNy|zI#k|l#TqPVUM{kbRwb2;;qVFWxmB^1;Pe59%7kt#hw!q#3
z+P3UaUHZ$6k)&O?v_c&H@`8gB|K|?}qxZ(g(HNa&)6GwrA4l~_s6wX@Bq0E_IT4@G
zpFbQN{YN~K``>@S2KYzCYw<^1qW{oa;U5Kv{Y>abiba9`LxNNP=rEA{QIRqHQ8P9C
zG0Cz?BK{z=8T@}re$UcBW@IrV$sbkW^BE_l_~TOKarB2KG5G`Nkgl?v|1pioA3)?H
zcPa+<;w+c_1|+bYsvi!Hv$Vqv@!_BzU&VDK;Ct*bLEh-MbU}^vy!uYd_7biPCVCER
z3ig%~+~x@Hs+!vkX_RwqL)(8@+wd11juWZk$!>^zOE9;t@^<@Cf789=Gpp~4-Zs=r
zz0a{KF1uCXT@KRR+tF}WT?Si&G3)m4XT#b%F!M&?nfnH5?oO7vU%=+-PVAAPX20Og
zo294OGo8|&;hg*M(O#1(e2)On>x6mUAlUP!A)mLKDtxDTzJDm_4FW><4h!9<BYTC2
z?iVP!Ycp2*mG6e$cQK21RQjk0LdWAFHU$ybF<gdez$46ruq?-7^qwQHR@i5jB6MVi
zaRn{uTj|tru15W%XQ-HSE>fWJ6l0L1)#KT`EMgAfWcidNU1Qc*qFP#^IF&wGMc;t=
zYnEq|Toj)Hvvu7GwO2fj_AF5+WML3t;qnkWuFo(v+yE0ZbVU#f!VK{U%?b5X>rb%S
zI&c*COal9;`rT*SIjVP5+&j+kO}cyM!42wr-y#0~u%)&geq2`dHphT;3>aT5l;W;R
z_CrvF4vJ`|)P0DDxX-f1ZV?okMBlXoYBPdq=yB{=Ccz=&40|CBh=?3&2JStUF8<zk
zHlZUp<iWSV$zqItdG~zO2pOwo3kk>-sP&#=M=nYtO(aK92n4@NHfF<kY8VYoxc$^H
zz&$1qB{@ozXCv-MOX}|?qseutF?d5rsjAh15G#z=$F);*vx^Q<?e>#ku5FG#X=Rk1
z7UVJpk5BCi#9dL1it<W`6qycm8_e&P9DrZmJs+c=K$TfQ!9V1&9B(jo<^XGeiyJxH
zkI^r(wJ=s0g7|0ING-7`TYEgM_}hzF2L7!%Y`!RqBCI-H$k^(;Bc#cXxtEOQQD%g$
z2yr9~j-AMha9~o7Bir^J?z@3yg^y51>#a|@XgVuYFG`pumZO(|T$;zna!tYlk=p6a
zggG#{OLueM*#5=jy8kO{MJ<C{0R*9=H^<fW(RjP)w}im2UsfE|&5bn@BV2wfzrm>t
zjBehi3tfGu(SOb6`7iIDqf_~1vWOE^v@By~>AetST|g_)xGGZmeht_&EL)kP%?%;M
z@a<#_v3`9?WbT9t%L`3>aH}&ix)hy)^O}+J2#~5(gT6(kF|KZWI55EQUVjMv&}g*!
z+J}RuhEYRS)qHJwzidE%fB09u2F|KAAm#VEiQ^T*{f;u(1CYhH(kkf}Cwa{Gw6X*J
z{a&W7+UR!c!N`3};57vAua};^mh^8aKfAXbhx-_kw(VTu&CTVvoIv)mD|2u_?kFoV
z+aqCUgxGa`13QuMaUddwO&U_icU<4J$vxKPS|02QEO^ugQm#&)(o*kQrsj6k3c5Pa
z3K_fz`AHCb1h5nn&cVWqk}SI@P!eBA7^kjq+yLmLS(%_KktA55;Ur=a9VzZHGMyy?
z;`eH0rzu56sK_KJXQH@Jf411)-d2x|WF=SU8RC%6DNdD`BiVDZD{@5^=%0N^$UimI
z?HIkv;|b8J$snLkaIzdmP)Dn99suq&u{}-cswmkCNFKrkT1Y|TDy?g&qi>+|^_x|0
zo9c@JH#$^3%i}4@7qxLckBf_MpuFmZ3bg|-L=tx>(V7G$ViK1z;Gi1VVS{Fr%HVl6
zPdI3{Oko!V@6fZ60-%7r(P`Tt(lrRm*E%UtA-Wyy4EsN;ZjP&(5dffNADU(>a3t{K
z$&t{xyuhL$-{!~YN0H7!*=;3~;+ZI9E+&>GT<PFNNuo&kN^~r7Rs%FUaLc=bb(GMU
z{bI|BV;R(qu!y*Y9Zp<KsAFO?v<%yfJWFu%5o*7!ov_){U>4Cuck|Q0rLz}rU%!0z
zztPXne)_(>wH-YxL4y&Zc>nSEOznR_VuMc5FRy<dX*-bKKID!A6E@2yhlO1FFui8d
z1ST^cX@yyXaz|A@GK5i@>1_hX0LNwLS-y;`+)eMU)oz$gZzQDe^ge?6YP?={m7eK=
zY5}m?16nEQ^4gh<5daXpv?aVygWZ91o~?pnDx~Ba!Qxpg(o&Z7OwEHfcCrCawzU2?
zXWck_fQ0>8i1O&o*%(=d(L#4tIMuu7<r?o|DybI)Iz?}e>%Z2RNp#7b&Oa+9CT|Hf
z*)F++@gwP?S%2Nutudj<dUPGCMbk?xKF#1bQPuVu+!_>-ubLFk%JLXix;7FiPUrUM
z!2_+0VR^7cz7mnEZnY=Yh9MMrw_MoXbVFLL>cV)N)ej(S)xkASv}>-5uHV`UtnD;S
z?}hMz3uO=5p@dFs@=^PKBPWgEu|kx;o|EENi6KwRqh@QUzRy`Um1dz=wcyn)epPrg
zOvTp;VG<JD_2iDx50E+WEm-h-({7AjlI9Niv^*izcd1%7)?>3`xZaTTq8hSl08e)v
z6Qe4)`wrYP$H-cOmDUxKf{i<!hg5FrX;^>AH2StPJ&p8yN6@?4Kvs3OeoF71tq0(y
zs$X7IzgBM)NVTG|xT(M4zWfFVhFadOKMCA}kI>wzKFMIMd#KjB_FTCK=DJ+)TeQ}h
z_F%0WtabO<S|?T9o!kss!{sJ(c;r*eso`UXISf<go0vyD@GP5g-`K)kv;O8<!{{SU
z?%HK{SPCtFEHn=$H*MQ7O&n5}VMlO*1J|&y7f_oTmgQMu-7pU{5B1ML^Kgqa51oiR
z^lxN3`v$#GasCT*Ccx69V-jy8u?lb?_EMQh+jtI$??S!OVsI!BQD*%y+@1**M==8k
zR*|LJ0RTzP!4{^hUdO%uXvmjHAvAcF#c8SO7mGT_dB$RrV3AJZR7l>2r-;;S5;Jg7
zkOIAUH%8)<VDmD*gq$u}o3{dhQu8?Bsx63$2-qEU>J<r<YEe2svKDw<n~Wt$tq@?4
zpOXYU0<y|)>386Ehyg$bCA7u_0;k)zs+1MVz74&N(<moJna^1{&jmVayI3GyOqN|h
zww?=7nF`gbkZolI3DFT1=dmuULf^wcf%8G4^v@vz^2Mv?I`%&!Kr2vUa3(0b`tfee
z2(q!Qo^_l-s_^B;A}SKdR$r(Vl$mUf>cULB3w~GLjurEfBqA@-GUO02e{mX@v1|tg
zk4MAC(70xxcTbMtC3arB5J-uLE~n$oik0hNmS<T6;1Erpv3QE4wNl|5a{+Phs&T4^
znwX=-|Il)J)swI{2P=ogu2d1#EQL>!PHya~=n7@=bhaPEf*(bO6Gb)-Ba35)I3W(~
zz{VDJ9gF)xBtrV=91dXGgpu6Gsw-z<XA4w(_z+><HSM15YTNCUrrAmxGw<2)(tQ;?
zU3cgQav|DI4%B=9t(^NEbLVma>LG3XSzUm1opfG&eojh7Dfoh`E8Q2{_j|9tlbb5A
zC{$OvuWEjU&OkNoRMx{~^XyVj+LqcL0RVjYrLgnUbwTH+z0mpPT+pYc4r*Urur^RG
zwQyxsb*K(J4tzMgiO)Z^cB!Ws-<1`p+kyiaxhdJ+rR3%5xP7oBgKt%fvpQtH6;-dp
z<adtFezc6dLwNlc3OgQR?6(cr5M%%KW9)Adnhtp#w}+;GZEGZ)Ogn9Q_m&n{*nSi`
z+{Gbf3_G?ZFd?3YEjO@D&#;+g1@{>2*p&-f+3_G6Z87U*C{g@9S%m(gY!o1^DD6#4
zfL;2;CfkGzk%u5Dz!VY$+>5|C2*S0Zpq!HYLI<A7_zocDYm!smrG%7n%I_ZpZ-k-Y
zM=r%KvkdGIU*N#wHfBL+x;7Z+!!Iz8290mf_`b5nw^`4li)H<L+=TO=ZsY)fa)(@s
zduc2X?D~asDc%pEX0O<G-!dF(Vi6h!#J2mGSW$#6%W{Ze+Yx8%9*YQXSD1yB{kA|y
z-2=Y^$*(AITaghp602{HuF9)YMiCVWk@RrJPj?AKkaqNwEN@$p+YuEN>~@SK99Owj
z6pr>pfon0aUiYo@ZO-jHD<LkRvN=z|W-Ymf8^Y*rT!zxd1V{gj%L+35ZTj7xkB^W4
zS;3?s3zY;vr{XGEU<Muo!6lhck5m|Z0F|SrwsY70Yeg|=n>UD6wL@T)hz2826w>QK
zz*f&=CLJ|#fzHJ|2kRF@;7wP6LG1&m-rXUr;f;`K<Im#>#QQ_fa1JA=zxx=`Bx90o
zTwVe<Psdf0izzs0S`LWG*4TwCEeVr8m#Ge8X@{K1k^H7|Ow=E6S9ikKk9Cj`kZRrR
zC5pN{a!3?-*a=05orw9EdW2)&<F<(G$mhg+bfW0VNt4#+x?56zM_Rifp%a+5Cu##i
zCuqaAGe$W{FO-X}b|5p7=L_X%RjX-TMkM7lS(nVHi-zvYbt{4W>Z!G;{;ngXc-8Wd
zpLT259ShxpY3mYN&XrprU5-lxE2<xy(L`;mh|_3=SnM8{QT40(DDBb7^17dWV0AlX
zRg0dW$~NA=6GumDavZLJVK+(PmvGq4Etq;sBR@u~rb7D@kGowQ_d2M*?%&TBKj;;v
zq1)Yokx6*<i!jyRtz2z-rJ;YXqce3#609L`bo83CrJN>UvR<vay!P6xLGYdYhOZgS
z^&FyQj>?Q@bDC7i->XkGLQjxs80e(?ZO6#$WkY;_s0Or$6+d0^HR?xe!1(E^5A^=<
z@8=7oNBr>PX*2u{Wkc1T!;h!E_PsyU3_9&cI$di$^QZdeYgYF0=cnt?=cm;)>^h}Z
z)GUGat6IH`z`tc2d#Qrn5ALy}>hUsERP*E>px!0#@&I|4!}90}D#o94Wpww}d$2Ty
zfRN6}46EbwuZ}-mYgss7dRgp4Sie_B07cmYmPW(4YfMK2(a}J3w4cRnuiz<eazEq&
zj@;114j}?l?l{;Z+_H%+46-(g<vtkr|Go-c-*x=g*{ziYHWy69m-6v*p@Iu~j(}3y
zA5>aD2GI!8maPhh_oRP65?8uFNJI$Sg&E{zj3-c&d;($$sF0@Onie1TQ13;>Z371P
z%2tEO70E>k;Mp=KaSE94y8<4NgRrN~*0D{~BHYA+vJg8~L~$r6#|Ec_1VB*ZxR1_e
zI{?NXA7H!>A82sj6@~yzLMs8=hacCYzQ+m^eOgn_ETa(YQQuUxY$knw*g<lG1*{pT
zKTw&?kZHh!O|u6$^;fr2-48^9IyQFYXk-qxqcFfUViY^RW8#odio+-}!cfrA@uGVy
zvb0twNDOLy_ppi(YuC8rTOocOQDux|sJ3#jMX+16P5k3kk!sMnt!M!4#jbt(Xs*KX
zD(qt?a1Nt-!|Gb`MHL{az234a*=lGAQ4V#vr-29+mxV~8Mv|iQ<O0`nlai|x-@UZH
zpVWJq%>B%=nSu(`Z(PMG&#vx@+;lBpcNhk4=!YKmsRweC0Bnv=u<Mw@pd|1ZwH}?^
zbaEo09rACPPeLJYmsg8UP``G)sJ!*NteLKQaFZ1TM3=qlvJJ~87ncI!jA1Rbf_vp^
zf>g{EM<ICGp}H%{>3JS=Q8NGzF^M-2F~6dm*mtC_5*0gzh+?CFs1D#25q&Mc`sq5a
z`U+vO7brSj>i2jV3#;9lE9A(&=U7U<J-_i%jg5m@R;VB8w&DHZa`52c$I}%s-Im<l
zUx&3jy1p`QwOx8~J0Xy@<Xr6UIUXeH`luNEzK~UT-K4w+ey+g<+ziX$<ob+Gu6+y=
zx`bg>tQ(mjbH_c)+;NBW+Z`2K%LpAiBnEb=u(2Z?6B8;z?1irDTE1;?cAw)?&$`4&
zbYApbQa$@li^3`wQi}kVD$!4m@!}l<SZ9+4qd}TBSuiS&sw#<uqPbFh@&!1iWSqhh
zj}}VixwtFV5;bsp*-C`xxUL^i>=PHVAlLy8d0^wnWv*dR8VQp;I$OzL08l@JkE!ot
zT2fe783vYA;*DM?<wDv)b02(3+ZO(y`3^$;9RsNi>G<x5s@vO<2Zi@$pJ7-VTYm<H
zcb$r|D+JTGZ0=hWJHiJVCX-?!e2T-s2>g%*l>6>IR(D@EtiK)SX%Exzwi_D{xJNEw
zk6rgFMpv-c$vfp@mKDFvN!ep0$kR@wvLuQAx18kpH+ecb1{--Rt6^1NDJhX551@>;
ze3m5H)yZFE=>E&NDDR5yTQzq-q(ERe25||dl)Knrp^Itgd)W1Cg9#^~R`B?c0)zIe
zeg^IL`r2=;#uo4_@9Mv87G$OUZgWTvs_(W{Kd8Qg>N}{u_cjy#XI6cC+wq|M-t0pR
z%J0^nLHS*;qwK1jI5doi<6;&BA$C0C<A4SR4lUtwD=-MR={;6|e|hs#CAX10ZCz!y
zBE9Nr!th3|mCA%PvzZ{kuopM4fG#cBW8zie0^sG9f!zd1?21;bVX{Ee_!CORBrfAA
zAd{=AIx2LR>nqEV%H9osjZ{kW@?6AuD;H9h0+2tGiLIp*89c@^<&W|)UuAiDzL1FK
zQYQ?8$Vdo|%oT$kptWV9b4bA>N%P<eBssqnMHx>Nj9Q?18j)$7#3YA?tw<^apln6D
zm!%0Hxq(km<~!1Pc<NSvgHi#!(CTS|u0)bx#frByLRI$m7|7D@jzJ*K*nY+U?nX`!
zcntf@7uaE5ghPiB?0O+1loMBQ@#u^JE5ZhDVHu9qQh~f@f?RNzR#}A3vnv$_091Fe
z;OHlkKt%5ty*`hNb4l9yc1ETZTjkPf?k!-L?#()^n%pKMhovZ2o?dC!Sw*$Q40qT3
zT?!@W#C&cD_pGzc$J3d*2$+8re#t8jO8brW3qKVTczTJE5GGXB*SZmLDtTmeC8OrK
z2D(r3$*&y%{TMxw_JTG+*$dvhTH)Zk_bbjk8S5$At8e|1Coj?{Ta!HgmpoCn2R)Mi
zmBlH#h*N$VL(VVRdg$>80X%-GMeUBfKZGSCIj;{tHujW?d8f9bbP9n7)bv+x#8I2q
z51o?&fK2L%4+kT?Mm9Vv@5?7)4Q+T3Zhtt?mKkVyZI-FWq#u#c>EQsyueaa9D)ST_
z)Kg<nJJ<aTYUg7!%G@K`wILj(8I~a&<#VnHCCv;=V%^VhOgy$@LJIA}g1Fh(59a!Z
zvmih@9oECmhJIKNTYm=k)oP3SuC6OLAk1?a=B@{+?gIl;0;%o^wQUhlQ&?L}>FaN<
z4eVS$`N3w+V-OWc^0&B%X`I9*n721<LI<;ow;%lGk`kEEP2E3$TuCI4wTmk*zW;4b
zl6Tq0cP<Igy@QWqJ(=i+epTN{((@p!xqCXc<Mq|=lb&^t#H>pxSvNhqlrHxggP_UJ
zoX`y{PO)d30d_1q!Za{E9GZ*@>RGNJ>!6(L%3eDjwQtngIOVpxY1$5&pR-cXEW7v-
zzU4MIjr!tMatOiWt+aUuaVe%-vn_m0r|`G34@l0+(+>w%;Qo7R8pfZ#K~zo=%(5gQ
zvqC(reyQ#}O|w*dLkYWpaY-Q&Sd!&W|J5*T+w;Epa3H<N-<Hao{B6nWS|CdY_;)7h
z(?mpNw?GtSX^A0A$WzOhebRqliFk5eKBZa0zftvEoyVp4MmP9R9}d3zsrCf@^5&)T
z7`=?s3-ouA11qg`Ldmr%n{!ff)vlAOfhTe(YS;I>oUjXBR&g#}Z53@+FR9+RallE}
zT$#s{iA+LAT94Lw;lQ)~DvBU4lI^+DvsaKvlnY$OGjyd|s|oPV1<K|n%chXNSMN0N
z0!w0O+z|m_xZvQNE9QmrkO@9QjLgcp_747%C(q$=<s3TRmO<|ORL+REBocD`6y5Jq
z9>EMH@+O3CvvUE}B2ub`>CDE^gBFAE6Uj{_ACN=Sc<!L2`s+aAxAF-hiO5S;cU-&N
z<19T!@09nk>a4C3eD^gSGF;83vpk!|g?Osk2i~Ug9CG`CzY&^p1>RC1Nz2p+Ml2UH
z&K+pXvK-}e@LEQ3qWhAILX@3{lmqLE<T*)8!Ec<au6z8?^8`^yg12*Axh<H(Jr@Vu
zjId)HHl{p?u%IRpu4QuKn2+0;Ud;1|Fi|Yc=U?8u#4rgY5njsWl*D>1qNynJn5oIA
zGAAa|H4MCVamJ73+s(u6+;Q^xeKrA9#<SXsJyqUaaIEJsFt&=Lj;HrJu3P1Ao~Lmp
zx49!(N9Bu!RbMXN#WUp<|K-g~{hr=LKO8Kl6mBx5q1yL-CQ1?~(Do0t)m_04pr>_V
zWArKq-?*u`?2ful;{B_VoAq0@S;uMZ>}@KtcCTo)gLq39AqABpL6-+dQ?b2w#f>j~
zb)9u^W#cVw)#r@5X}#bosgiY7K6_c?xGHsUA+L8K$H^{UBl+B({KzuN+4J3Z#5I&s
zyM4eVr`8U}+g;2X2ZaD_kK~IR_GAy2b+;eZKJV=9o7*#i%aSAS_AGeU436JBH2ykH
zH>KN3RG(n+lqCCP$hnz!;kF2@cAM;d{duRCRNBLXXr3f@KQlXso;z)N``9z~wrZ@g
zZQO8hl&nmB(+(`=V`fA?cA}8ukXt4e1_@{sx`q?oXWsUns#s}}1<C+n4Ek9Y=KXA?
zBDqRTu656u$QwymrtQ8YiO#Iv)j73rDJjooYt8|^nkpd;uByVXviu^+2)}(Wv*+zO
z|Fs&MgV41jp83lzgj-t&wh@?tFgW&@L$MQh0S-csV8Wb$QJaY<@b2+Cc;1=)-8l~u
zbRN^WjDE<X^^;v&M+(Wr4vgxzK0$5!S`%~@iw8bET@nPAX$RP{91}aP<>SDh0S?2!
zW^Q2khHE@-lZIASfP#Ph1YX|$TeicN-Ea;VeYqv~cW}KogE_1e`MB0wtLHf>30iq1
z)YgniPJm(lzkke0I!_2>5Br}Q%RY@$FkC30JR=Fok9tjL>&jj7_Xa{gC7<>wrNb28
zltLzxp4FvWNE^NW_iA98FoG&#przWwyVVifq>pa}At)4h`#Fgkmlq`O#||&*=QNDG
z?ie~nv^`vqSc0UwyE){=ZaphcZ+KjP5B;#@_=Kx!e5<QPDQ5E5K3pHn`q{h$$Ud1&
z6kNZmqicg`HEU^<NFoX*j@sA9$XGQj?I-nhc(Q8)X?jTtcB`4nK_hsUl4McFtk_j4
zxU)ISlQ<RZoa8$w;s^4%Jxv~;o_&gos+01Ad})Q~Ci38e)rfpzMXu|H*c7(Fj%g9d
z*%D!9)5xPD3|zx{<lckx>}sb|mM*l&D8<FKegoK^u64331x_^wLbd0uHJsB$EBI}&
z`L5jsXR+P{?~0`VU^kv12$@HzjU79n*l~Rq2To*RBXF2W-H4mfea`y(E^CO=G?1Y7
zb+3-O2gY^Nkm-J<QxeFZTJgW&+3M{<RXIAw7d9JZC<eW@_DBlC&f9^*cOhyV;u)_+
zBgYvHSl}~k1Q0pSy%1BM`q;3o&<Z^(w7-M_?|vkl(?O%{Nz}~5b#n<$ic4_MY(BuQ
z71-MxPjLQqPpBqHcfA*uF3{Sz*s8>Sp03qVwZNU$avQ5#+A;e6uxiQS$J5<|$126a
zer$@v=S(A8Is3Mv>28R1Z_R~!0C~>^KO_0YP7cP0ja0v@AoKBq%aPnZv3FYWm44}Z
zCgIe;W<){1WCD}Wav)7CW!zydGq>oM>u(PD^lkX`E;{zH0MtG1_{=s!OhqWLLoE}B
zjv;_;2xx|d%h>=>9{}oK2B6+$@<snfrn7I*o4B}GR0$GxL#Drw_~QtYab2BfkdGWR
zMV+^PrA%L8u`>WOE0q8cg?UPnI@>oqQElrwD|Ig0R_g<J4OYDvqX<&PV$gL6D;vV8
zQu5qjiG*#@sjKEB*%i*kY_1ZmS0L~xCq<dh8Nk;O2AsL%N+T&MX28XkW>b>DHdeKp
ziYQay0)Y22CIsJ#aev*Q(qSy5qFoOkV8a#GcLssLaXP`dDB_|7Cib6xc&0MKL(qH*
z>6uwZ*m;B4m*Dj7aI75aUhiw3t3vYg9iuk_oYSmCaY`Y&Lc-#eduE<aNlGTrBe<TW
z#e520J;@cX2Uj}xB!``1odeQ4!JDSkYG8)uX_3L%0Qa+bS;Vr9jHJMQSCk|NuszFC
z&`uQu|8`;SYL@K<bT<ewZSLFH5~htEumTXDIhcor<2l529e&>}M!o5HRIfs9;DLEo
zj8@u>)El{ABEGELvvP-6tLe+I6**mFK;;l!{uqf*Ga}cHoOsfHq+f#a<5>(L6nBMy
zupY9#>_~y-b7n*ywkWl*6Veb976q95)G-Xp4&3ky%%yu}N9s?oo6ajaL03*IZO@bw
z4{ALG^`j(7zarHZy(3CXl?>=n^=o3os`lf?z68&3f%$xv#EihyDKkYEN=i|bP;8b<
zYgbiO4Q8l&u$Fx92Bdn^ORUOA63pMG8?1&$W4>D?eicDsJ%BCF!JHr0*WXUdS(OK`
zPZiiQ+11ZCxClA)V3n&o-|po*xZ5(_wH!`$S+c0=?KQT-7CGLMwNTyLQppA|g6e_9
zBlI5Eqo*o(&0zFoRO69p7{>;B(y#iY+ut!VM}0$N_l>?evabK|<7xf7O!%PaHCv{~
zZb9-Hxd_^ibQ@Eb@~8Us*K8Mm{$RSizoyIH#2L(&gZXmf&m%Qob_MIbESRAanB1h;
zGr{HP@d#7bb#WN^mScpr#kq0M)s9L<&7ze-t;<=`;NdIDX}(qpl)6V2l_Kqg#;-Oe
z+`b~=?mI)ECG|i&Y<RVZe3Sc}W5;no`3Wr?`aZ|pbqzwe<Jva6=QFy6n%F+0+a7W`
zZKGWLHWz7`EFj&z<X7M1GGF3<xZ9I_PvFHpo#bBRn8cw3M}ZBK-0?BtmX8_tXkeHw
z<(@rg_#F+u*llOuKGWAhN7{<Ls%)KVzfq&F*3+%1^jz>cpyh8&v9PQ#tD<+*mesNP
z{glLs*3)HyvW&LQyq&C}uRiM=yH>lKBE9ZCtx@YbSE<zf=Io$T_g?8M)v7IrA5WJX
z1xm4gyRA6)3fxV(uF3)Jy6NAbUO#ALP=E3a`t_h+KY0E6X3EoU%JqH4t=kbXESp5w
z4~2~#!;dgwmVv23h$n1HT=S9BZEZv#D<C@TsJEa|wSe!c{92r>980P?fVl1`Q&vJ8
z{Jrew*^e@-&f~OAP+a1N+5n~AC{OMHoZga`sr#x-9;Jq2v|X&+8MeJmxa>XtHDt>5
zxbZ=p9DwG7IJxd;K${O}^V>C3K5TK)3j)(LOc$GW0H8L)ao}-+ohXPxZim8Q_Zigo
z!$wSG*9`xCb$5w&xN=Vc99M8Sy|2!}uLS7NE09_w^b!?9q!qc8GB~0mY0n3sP^tl%
zqhkd8-%n8i{K`=R!QCYRaa7fgb*kMOwpldI#$Z-FkGV_$$v`&0<(nf&rmFCl4aOA+
z!es-LEDSQ|JXL5^b^ZHKESYnmxjQwp%3T1`MQmU9mxg6Vrfo)%jkyO<Iy3Mwh1|Z3
z*iLA>p+nsPN>{dK(YomkJX4BOM{JzhOGb6YZwxwBd!qM&**7znqZid&*I?8nOD7^n
z=W$VHlJPh$(0M#LPXG~LpovK5aSFM<Q*l){0T%kn33~V9^;7hss203RO^c>vfr>It
zl8Ugo9vO)jtd|^NOh~qGz37h7JH0B)b1{{SyC)}`R~?X@AS#mV3LO#7RoUI8JgW7@
zDcAyGbft!bSwiN8@*kX>fEw2;`xNm-N~SS8djCQ0n^}=T(((@n<KEvN707N0Nq9{Z
zVWq+?4eaTuG$N@MS5MU_!D5!g<<TnB`G<o)e>fPuH$RThzr^YPgO0jAUD62UX8#su
z>S>RwsT18>NBpkF^~KTA8eHH;hee~=HO=6nPky}BSs-6V@b=-y)4HTJQNg<a_XhvK
zgZ2*$@H;&&L-g?1iyq#Iia5*5zbtNhH9)GH{}hXxtORJ-D;@S}-PRD^c|c-I+TI6@
z=m^swe!y`MxB+%Jr8tD>YT;9#`@;8Z?><AfY86n8O{I%Lu-F=15gu#>8KRt|Ko2No
zX*nMinMuo2FpWO}(6JrcCJDO=bYwm?WyBpY9YPqj`kkFalv*;XA{!CS1-anaRa#%k
zNh!ukeCcrS)G?5~z(2`1aa6TAOCfR16k_%;q4Pp;^zP+Z0fCL@pno2JTKqmn$7MDf
zqhrYoHAct9x%~6@7^Eu@Ri)5>k`SN|5+XfD&-9=uS4Uh(NxY*Tk5O?UK>y9INX}8!
z{bCG>a1`$ukwSgDpHNa0kO?*GR5%cja~X@PO2IBOB$UAT5Y=Th1dIK2WfGcJ=yHk!
zGqkW1SOE@g=3>VP9NQBPHN+!#9>V%<>B?#!*hGTWU+L?yXHwCD=a-iL_Lbj?zr^y5
zb$fse!`*Kukc<6>+WF7oY7FZa!-57H)C^Sf$vM_-mJ7G`!D?D|HH9Ifyv(Y#yQhY}
zt5V)w)w+_qtdv6;#k`okOL*_?GMmY_J}rJ%Z^MQxe}iCl`3vmL@|P@yPN{2gseVb~
zOZ7|4=Bj{2rhX|X<nsA&kc*;}zx+0@eq#}r|I#egzs!GE)kpJGy*wjKl{?MSq7=FO
z9T=SDFQxitn#g}9M3<`m`c3}B#ijh0%v9rlkJZ1^OkIz`RV)jQRh3Cb)Gt$^+W>*^
z)tJuHGG8o>=P!Bklge+k?1P4FVJnT8dZ-HAOTb0nGi9{AwI2?S!GeL!k4r(1@G5w>
ztB>4zV3XheOB!qHZYooS>eO<7H=AzO#9OwD9Ca;2o!T}SestrWXX&LRr9MTB6ryds
zkqI_m@Da4<x!Ox1Srv#2i(eCwPRjG6GOO0sQk3fmeTPhV_s4oqhSxtFRJ-+ugKks)
zN{Y8?j-k_4NQTw~Tryr&+wW;@p3;FXryAC<Jj|mpdX<WI*{f8jx8mri8jaJ_PBX_y
z_Tl+CDOWz)?jcZJtHFYXu6(>6%q1(@={6hM7)XJD$D)3+bz2jQ>nCLKuYnF@!?W_f
zd=e6dZ+H-HtLK`pP(R*$xzV^W;GOoZh%ZTXqeJ4}*ah3L5xvg4M#k@uu_E;M4JpM=
z;lH~_{%$ZnHo%g0qZ=D(J@vr8Xg)O$Kb}_e46ewza`^GIo>6d7&xpg1r>(iuwoew5
zRYAr2OY6_9zG3Sv7?)Nwu^uLP;AM7&--wx%Uv$~6@4DHN3SY6hQGL<DOj--ngPF8Z
z5(bjRY9t1d#ruY$zP?RiAB!Mm-18le<G>07?1V0)H1im?BEp%+C~>{;9$N(AP|*~I
zEk`msO0!z+7dZ#Ytc55?I~ob4HovljF`{!&Q6blKE|7?2^62XQuI`TE?5h=gZ83w#
z=II<fUD_aVjNYA#LZBjvXJ`gTpRQKTO<-8N0%cYjE})M!OV@>v#VuRsNQwl>lLaa=
z7Lx>vbP}gRNLY0dPg0UR4jWu5u6Q=x&jc3=J8+!H!Bj*HJJk0u2^hzWxOT)N*W^RG
zY@IH94=bEpG3Vq`pr2o@SXOdX!Gfw*QkU3ljZF;JRCg_HGU8S1Os-p49d*=q?P#eR
z2_$!A9?xbH`_DxwBun7UBT5I;*<d;wOlO1XY%rZYNYmL@HC>&aR<<i`r)`<jze5I`
zmW`R~6uIhI37VF*v>pfBR11^Wn5s&00c@goz-~1dm>xt1k9(zmYkguL^*b<ZkGRyw
z)P-DDByw<QS`nty2rWttlLq%${eHQEuDhiMDB=I;#jEEiC!FLx1$=etp_axlFNBix
zEBp)6_?I>jx70|d%217t;Ewo2rn5w>2FCmz!(ZTn9UY@LH5{m+nkDR9JM@<zGjF65
z9OV3><t{JKEQ8UDNrK{(gFcW+y&dY3tvjA(mrC&{W&%|5WP!K<k9d3uK5YixX*qfT
zk|7)=@dZHp6M<j`7I#6JE|Wbul(`dxmKizNvTcSPVMLgOKE;78Ov;Ghb{IZxFpG+W
z-z@=Gy&ihX@LtPf+`+%K)4?qT*o#FwDO`I&U`18mtcrJ1otJPDxq3j-NX1pMkoVi`
zgpriTGJvJEP9)fFI?J<ZtRWf$xZ-xf71zqfc0CBiM)<@^fBI@xfK{UMk0KQSRN|||
z<>n?#?o9#u?_QpP$1>r42W>~*9UP8dT^=0Yr9h5*MDRqD`3|3_CmB4K-Ielz{$^54
zu(wAtKZel$ohy`q<DcT`eELJKQp=phlemNin0GZB-JRFFK=j;4>9P&(x<MeYVHylO
zzC&=xTpRli^=-~r==t7|R1UUw0$T-qll39kdnc9aXSC{OvwAd1<{}aKwofsmj=&Ca
zO&l`8F^x>qcOBwUdmX>*y0X`fN3G^t>sz&xn$uQrz(Gv2>_VF3wy8O43RE^H@EC7f
zt}--iNHX_@lFZ44`2*M!Ugw$iX6}|(uF*r!M5N5Tpk2O-qL>L}doC&%QC@$sL4U2h
zuS%GN2eYf{9mpysIQWB$c~M((l-Ctv6{NZeS<4i#ze-uD-i`o}xiz=ji}X?yWjq1Z
zQzfkG6r;lmbmp`u&Zj5_jyF)$fgY|@nTjCwj+kbb?G!~aEAZ<qhIoz~oEB#}*mRPN
zDgB%hc2VWq0w=^V`aXpLmK1U5Sy>Wx4oC`>T&^i?T$iN=U}f??um=z*;-ZeY$OWIv
zZlioI)B0tICK<ax;*(%=`E6zLB>-=50l^0F!OHVIn@`RW%aVl9EdLxS-PAzulhMtJ
z43mY1i#hjP>=4t&VdVLk`G#Xy)MBRZK5h$Atxp$A1|vD#vwF2l1$XOO#@#hJ)_+Rl
z&+3KQUBeY}s)kHJi5v37gQbU(0)hizcdGNz%0%XA*`Yi9dzN1$nF@jUa8UO}_V&Yp
zG<3{Uy{{d~LfiI+UOxFIMnp#wASkriCkymebqOL0Ude=8=4jk5dSi;J{i{}$%JI{n
zYq%{3tZ9O^x(T;ezwR``=;ut=4<lMPz^?2#SuRmFaFz6N?6SUbRr+8^S#L;zG2dZ)
z;JG~wDP>$HLa(A-mEXR}W9JXJWbfEP)!oHfa8L-ArJUr88}>xb$m{gO+UK3U%{B*9
zslph$8czB)o}CN;yY=9DHkrLGGS{)k+`t-hQ(Me!nOJt4?0wyHr<da2<<La)BssYA
zh8!uA?6m9MTf)XLa$T3XCN{mmz>Y5>96H>=)Qkcag`5eS-eZS<Euk$bd{TDm`uCMg
zvBjq;S?nsAvLk6~r(<@NioBLJ;ZZo1?t)8PO=qc6?d2JF7`H9o5!hg!i5=gva9~p(
zn-ODCKthMO{^QnblxKXEN>i+!E4!&Tn^ci?`bXQVxmg9-IdyF-CbR<jtqcc+yWpy9
z!o?wMG7;!!B5%O&@M|j~6RJ7<cv|~w+m*K-gSVP^Px)6}_)BfNfC{pNi~Kby&+EId
zU^VKx<?p}D(lL7b*JqaN4WfR%90m;C);)8_&C;}8VF;gN-!u*E7(!rT`#v^_8-^CO
zL=^JDne(}vIX#>4WAWYuf-#d4aNHOkcBsj45V{t2!-zVzLw!cq@u&^nn>!(_eyilN
z%CDlGA%^j%%B6y(t$S98r`0cAXA2naVJ)N_p3L&6|7sYv?RnpPIM803FXg>?ofRcM
zQ?~jA`p2`^=tWv68f68W8tvxF`G?3ed=6orWL{=yHqR#l9sT3k>ydVANau?d@7Lzu
zArYiw(XNBVl3%B`Izl_Es66=4W0Z?xo|MXLtfa7ZKFKEJ59Fs-dSLBx+3MqYu01!u
zuj*!8AR+xO3LLq_v7Kqe;*}t?ERBB`yw&4epxHcucl(`h`<3eMfLNM~nUG<DFbuK>
zFggTStS*4{x<Nd0@EbMbPM9>)D&{=pxyf=Ex-y4gNnpzY>b^WKz^eqMmpRyS8A)|)
zFNFWXs9Xxf$aF^HiKh622xEw7ltIQ-A8;81DVoGxL4u>(_4)ixX8XB(Oxt4-c+9y)
zTp+MCAos9|J?hzkVVEW*#^Y9vHn@Cduu)VWR?dy1Rf}Pyrbk>ZZmu<f0|!3xDKM^y
zJO=x=IMQG_*tn{FOEF@NdTttcb$>67OyLFHdnOluvFxK!<tkN7J)|h8q}rx6#(z9}
zEz@xAS$pU8zGG%ny^=!by0x}mZhSH8>U<+NT2<@YIb%SAevLZytI<4J9%yH$%6}kn
z0{*LOxTEBo%k{cz>(w7udgsfm<+#7rN3M$bzgxvrZSV#s*lk9a4NkDlBQ`j}I>RwI
z!3HPTy>^1Z(e<!>V1^e4hGUx86&}S7Ar2<K<6+x18MmluaU$-q4-6zvrFIr5yA(MB
z6{_p`+Af(_1snlIOf6Z<EMu1>88t*UEqPPwgta7i`yMdQyUtXW>gSIBuP-~JZ*4;R
z5i?oDIJQX`VaKH=4kJ6nc3>G16PC@4bztuMGNI{0Pf2O4>CWb}7_1L;E^lWM+I@CI
zoGEZG-TG9u?Q2ZcSu7s-L=7o3xIt_j_#VMd$bB3du=AR}=eVZHh#fp`^NH3!ik-|S
zOS?QwXlZkk2F*&Ttnl5OlmxBZ&ud%BBqu=8{og<4B%LQDkITjX)CB0$I0av?innDX
zA^CbsN=K*dlF2lT>QnORngw=9Xqp1aWU{NNXDQ%UontV1O(wUEwwa1udh;tS%gCtf
zQa?qsJuZ;Dfuy=KIV7oWJuC72@VNd4`e6y5hpTEJtE)vRX7bk!`O3*;B9oQZb#%S^
zt!DK`h9sh3;;6YgMn-=q^fT2pc%lo;ZF)xbiDljnMU+mqXDLY*Wz33Qk!lC9cqFLe
zQ~5)lO<$9oOoakj9(>KD;gElUos)bAbm)P6ZciNUr)QtyqUxmlAYWQRxxP^MVD%H`
z2gEf(fo;o)utNfdsU>_&nXrYyEyMF3IsQr|ciLOd+vqCT`K0JuXz8M5OCK;sYxlBQ
zthcheA!<L|?IU8L<ApAcs9|A;dJGfGvT@{xkxxU%xBdIf>Gdv~ZFJ37A&^QG?rMr}
zJMXQ<5Ug?WLy=2+%v}Kb!i>IF^7AP0d_Rf=HVmI&$7BQtCKuQw!sXlyx#5w=ebOkT
zFPs?~6<h2vg*MHbo18^!(jj#iO8ckQKgdjbE897&zm(RqJ?(YVzCBZ3w;b(<A5WWN
zWYX)V<&gKfrLw#~tebfF@wDpEaC$%JG%l^Fau0Zta>36?elgG+9o$uBqVa>HkZns6
z`=H=mgM}mrZ0tFXg&l)4Oamvvu1|PGspD-m?5@B0@ft8`h|7&(^^xRnaS_uviOa<n
z)c341`aryiw22V95zh@ENs`A}HjRt#f18u!UH0Ws@EcFAhlPBPT*fTNa<Om${_a`^
z4oT=^OE}D8j^lH-F5F^3zSlnk^8FThi?pyVz2DDClAyP9I*p5>l4bWHG3tZaC2~4R
zfOdJ7<)9_d1<>jMNxdY_t)48P&Qd=>_*AAw0u@6gM(!YKkI~y~p0hShP*FEor-qUI
z*w2$}&Y#U@O83}`aQ{AK**u4#kS$bcnW5P-b*=`GukB%xwX`XKi<k4X%@Cu3`FSkI
z8hY4jbpa1fXJxVg^f^oBkU|)I!KwiT@KjfBu!2l0H2fHn<<1hakUZ8h?KCt7#T@vu
z%Y{l7UuCOO@bxT01eFzuTm@l&ie~X8q~(!np?)87Q^%>!yc17nA}_L3@h(ZSCLo@}
zIy(`3r2-L}U4p8K3YN_TipyIDyccu2AK=|}7>%eEV#~82(#Ughz^IFfV?~ie9aDJr
z<F*iN0K8YE?bRgjOxSuwm+gtaJ^eeZEtRKTt^qy4kI^e2*and#krT6B6{x^cQx_a4
zkL#tb7Sjnhzp{CWk~k7<!4gsL0g@A5rBCCd7WXynd0D#~MTemI%^5mHGm;nLSFqw8
zy&+ffsWVcNE|oKEDmmA=nCl4PH)qGq4VlBFYQ7GFUh%@pXFB}P?Yh8TVTB(K<e;uD
z9;l*a?v*N?iAv-wzcOt39}Y(S&;b~vCe_KxHbcdoGGz<;rWBy5Yznv*TD;n9-?R=9
z$$q&UnXqHCTRs0wjfTQEwz!IExV3?P2J7jTM*400IF<#sT0XE;4FLT$N6f%dHLz4|
z{TW!Q9yLo99C!~KpzoNW;GW}RL79mi9+{Yik%5`-IF4Zx>V)g9XLsL&-Lent3efKf
z{cYiX4MP78!0+WmeFX4(kNBZW4T1wpSlF?Af&;<~OlU-1N?qYN{)3pVXc~XoJWtyb
zvz_Z$@;OTg)={MtYg@}m^HxhaKSxJ$rf0dD=$~O0?+q7%S^V&k`DWxW*Np<~TcH7V
zo(NOJB3Rg_?YLe*!zg;(cAgE${Ec>=dWYW&kpBhEIU6zmgRN(+t!GV0gtA9mEBImQ
z)t$o}iaG5Ae!yI!%qPVLpibXVGa4&%#r8Ls%q90UyrDl%I(DITSp_&O4U2xTeSHXY
z7y=z`UwnSBdY;c2HEd2W7omq8I|y)S5C<E?j%-H4fHUuL3mq!ZK_-@oKdp*wZOa9H
zQM)5puY;TR1q~^Gcl1k03sZ|Wqjg#+JT+>ICf}gziY8Jrc@Qq8_Wh$<^#aMNVd7-@
z#*+7S)a+XBHQXuvPopR1DT;TIF2>bG^((ZyE^=dRPE&~ftVNkKQm*bC6b-Jvaos++
zGWu{Z8lb^<KCnk?>JRp~3>;#Zjw!GUF&d6z*_beDV4FF%V-Y8$k#&#lOh1sM5a?$y
zA(9;O=!c(2QaJC}OX;G0th_Brxy5o?BaN02R6utL1qt5dgDS>|=Glcz3x1XMYAc{N
zbOa}<_(b5qL~jJ7mV#tcKjuVg)#zPL*o8W?XL$w;b)fFUyK|XLTpq9$YU9?;Tkdtd
z394fc+`vUG%A<&5FQf)`Oln}tIl<I&Eb2#u2xdHj#q&<#=l&*g9<y=>r$bxFlc;00
zf?#@IszMMc02&9&Xb$2MsOIqbx+_J7*u?2%jDF6_w=*&wBl!R57`>G;E+ky6muNSP
z3d+;@4bS7rd7`+5n;dQvGP^4)sTz`py_P7ap)ZUOI}W$7V-k)@7)Cg>P2rHh^g_0d
ze*97CZ7UblQ6!gYs+a1hwjTFXxjhe_F&N8AID3|lorj}PZNTU)t0gO#Zi|xSWg#iB
zmvx^`Pn#Q3$XMHYd3P5*q<+2s?x0zGY0csWLefLlFHAdRB5(}sM$Ce}-Na$wTR1eS
z?GxXL3^DMI+;m%)q2x*kyB+yy*xUEs+m#TkW#IPC-Z}%@yFDDSaXL}d;iJ)U=l#*T
zyjm+B+IT>8UKkFAdvPdKOZXul3$7h7;Sd`WGm5Z71CEK~dDt?2TX0G(#{GNFCu17u
zwWVXi5YMJ0PGtbx4?iy{(Os4KU7aVUeyzhBv)<&ioNN+O-4(~^ukqv@tIRZYnbNI7
zQXX@e$wfx*Nn=uzm_;2okRs)7Xu?&~AGRhO(tuNg`PiZn#J&4ICc-kXXPAy>7$%J@
z`~I(uIOXwW%;zL&mdWnxqxE+6>J8V(-I(EfGA`ZI86HJcga)D5v_gg*KO#8fgkjfU
zgt}Hhxa&S{Th9_j)N2bJiS$w=*-VW3$HNLA{$>|NSFb40(UQ+%&;hPt-+65*I;k`H
zU3%u7?#*=){>rBs5x;GD?+E(u4_{lF5eunzfr6@2Sf3rMRo0*xeDy50<GVy^wb#`6
z>ZDc_=x=tcu|B7t%O1<qT7NcWuG)Uc?RwbN6{hnk75NXct9$ivp2qNk>F?gTZ2zIG
z<Ot|L-#62a6e&K%)A{s=T(NeX#gn*%2AFr1V(SY><K0Nr*^MykzM2838JM9JQEYi6
zzzzlLFg1Ma69EBvo*?3pGl47#f?d67NhTbG!Moz@tAwvLV&FCb@LHl@OXeG-y=!G=
z9HhNL+FSWENPB9@4AS0bH2XblY0npg8^kcNMO_a&mgQpVSuS>6hZ>>n8ix4*4BN`c
zHWNAMwpCQFG*0hi*;cP#o!2~v_3P^y9amtE5r&c=kF_FfWZ5K*C45Vy6EYD^6p!Ld
zEM}RUPcpO^t9y6H@l$3qH7*a_E>45cW}IX0aT`0fNiZ?F1)1$!%k@oS8taH?@6iHL
zOrq;nh>XYCyhL;XutpR`={48L-I?6FM-O{;n@+@t7g8)t*TN2QIi}oV*su&{JIu1I
zAu&i#+3z0)!0frpRNukBGe%O06@;DFM8ElAfdr(&Ku7CYd}RbZj|(!T@njCz0o_U{
zu85~`LUKucJ3xf53lWA-u?idv*UuEWF!0G&sA#w>Gnn+=fr?)6b%uueRTX~QE9smR
z=)=LEtJdvghNz2xyeif2kQPN2*}f<*3>J#JY@xUhM)F!LeAs#uF@2NRF2%MBVP+l^
zn1rT>4c8*BV;ZJuJ#tEeB`f)oh<KYv=P|0K(8B^jOs6_D;{v5wiDtPdfG;6VS0AA0
zs08+dt8AWt7WUgb&V_vPMa2*=r}JnG^!0GPITK!-p`(mSwwWJ)d2u#^Dj_T=T{@Gi
z0T>SD-AwsQ+yJ+7D!<_CUfAVa-s9+%&F>$(?RnF__ks^c?{M_qmeTsL&)$GWw$Chz
z4G*$e+K!2d8CuvP#BseaWOlR#sJ{N@kc4Vm5~`hWNDnI+l@NlsHgT{Q@(??gCoqk|
z2%CNoGVa?n5<@bot@yVg8P%;Mqk1D4NV4xFMqX#7*e(6kyGqv1RS`>h)ph8h$~dJ{
zs#bFN7;%C5e3rzF=xjD12PdQyszi{Yf#X!apt4fM>7^*j7zFn$z2zK7Ty}lGG)E5Q
zJT!fVeanon;~ErG$91veGRob^4H<Lqu{HlCDN0badf&79hCLdP4O5}kzLbgutQ<{w
z+Duue)~d1{E3Dxd6(ka%F~zenf=_iK4-l2ttC&kw=~&gHQ9Um>C{1yyXyIUL=_Fej
zdd4qF3MtI~3hbnx!}+y8F~6R8aya(O!yQr<g&s383EcoYuIXZG`X)9F!K}!p#PhxY
zInDjB8kok$&1&Ne?WDm&XChLlFW8Y@MN!NIvORa-9c|;BEiyz>k}RP0kkoGd1a9U1
zUe5Kcc6CsN3vKR|@!-oQUy@IL?a&5~(GwM2+-YN9scfitxhPma12^0~{CL_bb8A*^
zeGJJK!>djE;ck`GT&wtpA5W_*>Vm95?H2Fi8B`+wcn3Sj`$OmoIzd0e?s53>RQ?Ov
zyfj~bDn$-y`ecp#@Z;%=qPnIoX>A+2206jii0BLB-Y^ZZ7LU!geZyUUpPb3I=eyhp
zB5azTi=D{vG4X603&*zLI1n~}I5J0HY`me!p^F<N4mtOxB-u~i@My?A56~(+2(jZ+
z0~6mO*cBr1EZYby{>TZuZYFP3v;E<S8$YQY4Fbm?a6s;cUDp*%A?X&?(@)R7!J>aV
zoBlrH2KR*Taf4uA2!S1DxHu4@g-s(0J<Fmlp<58WgLVA+)^TNzdn|@=Q-mz=LyEaa
z1$MaY;n45`OkKwg2#tKs*D+PED|_vDY!_sAlOr18Rf1oil_g;pf~&N{V|h)fx`nb>
zJ)4)=l$0?;wa%&FSU+U>70F@LD*+c{tn93@bisjUeHn9^9KKLwwlYinlP6FKsVbf?
zRs7@$02ShtX7iM5AVY(PNG0$=<{~B(vMfA#Lh3e(s*UQcsBYtvC+p3x8@@BkQXYdY
zNRq$BMNH!)E*Dz{ct&zE6{W~QS%;B+N9e{030Wyf9_#NC7vKLjC&{~P<2#oGBFsU?
zy-v59o%U0SFtQwk(erG!=>GHdm+`e%W@Hl2FkA;a4mGi3TLM$z1E-76P1A`Ym-)B8
zGOe2~&6aTgb5;tPWf#)wvrWWTn{XwB2p(@eFc0EV3@$6>CMr3S)A{s+To0He@g#i;
zNw&VZ9hcSeJ}Y;z){ci>=pAxbPZofzG%a|&%U*~odmm_Yq-<Ekr3JLR;iCWZ|Neii
zz-`S{6#@23q-6qtuY4ji<<LcME7tT>pa9m&;4T{AG5oF=wc5u4v`rOUg`7!8NtaHD
zK-opVAvuA<$LL%nGcbF{60H_3&`h#^z<Vi2vkaDAOcIpG#YIIccMPT(`0vRR2+E#L
zp+c^mI8UEELC<D07zO~lmANE81Q4CnGAq;`?v1I+M06R8s~Y&%??-`VSy99^5r`%k
zyTG7<H>7vPEjkJ1)^6In?&&=`EXy)N!@{;f1MCnH;gI?vHXRn4HZiHSR<gMdM!V$|
z*)`N@>|6)GnF|)rVz7;<*+-NYK<LE=c9Zy0=C*9j(E>#YnLunCDI}5YxW#ar<w)Bb
zj?rI5GAo)13`-Zw>8fUyOlwuG$U?9=q_0E--c3bO&GRH?3nbDg%bA#pw7dmx;g;#N
z->h<j$aZKL;lOe@b|MyGY7v6D&+Wh<#0b8GDfrIW<Iw8#t4l#Qa-M;`P0cmf@w!v0
zHKX+OgXt{Ab!GfQZR;0$l}}!ZOOd=*6X#!mY@#lzh^O;Jx<NEU#j2;@3ifJNpr1&b
z(Cm|bP}X-A=lXm)J^gU-Lam7&g!QMhSHCvtEjrZvXVvAOM0uX^VuU(x{t)LySwEw5
zYsG~^t9FVVL1L@ti6AneR*ie5Wb*5USQNd7-y0uCtEzfCr(m_5Wcfl@)@y+r4PA{&
z9hc{1@oOT|NqOF_<bC(mk0bOQGR9T9uI^1}{8Q9v`Npzj`{AXZGt@Nhh(W_3yH~es
z|0$q1y5gTjd6nfCjlFe@4)Gx*2-DkM+x1x$w1Y$TKgFW|?7OTai7ZaiL!WBc@K{gX
z=1wauYyXR%wvDx;v7EL$zSww`M`Kt&yT1lc>jbbXho#HDEybi(H;<P3_wT)C|9iJN
z-JBGEA^g{OO5*wTwaCFrPbT75y|g5#n`d*Hh@%`X9QEr*C(RSRFEBz+Ov4x>Yox1`
z+m0(e=Dkw-KJ$7U4nLl*924ouhU(P5Aid<>+FO3~=8;~t@QfZl@MiZ15^l?}1h$#(
zm`XqRj7-71-WgrE@fQLt>2gfbpAJ8sZXV;^-Q>m&Po8I2&%lRK#;n+taPI&zOG<*E
zPvsAJHho>08l;&ao{EQPwf<5JgY8**Es8<o0kiLY72>?{=lt639p@e}O6G!}k^JJ8
zNF{B9oe!Ln4{uiMlX2L-9{TnrrJUh2KlINGBJ1##ANp7Bs3F(-+|CyhJ@38b`K6_{
zJtVfNbd&C?MkwaPgQv(cZgZk<f9T`*b1=ylSzi8Saoai`_&NVmNJH!YnuzpQO7dSj
zqW`bf&I=A&_)6nOtlJvPZI5i9uX~N$PUCiaqqgsuZ5^@gbMHWAP21DRz@Ts9Re3IQ
z>2Zgh&bY&veB~^_$O;~8n7araHxzz=J?hxl5s`&MH}tS=nGlEUGS4*bKl5M(0LUU#
zS#s41+wPFmuI0WrQqrW=IH)R#nvPPGUh<BEa<%JGCuVDk(ai)u<TOj;GLuDpWw+yg
z-bX<lH#CTkU7z{b@vQ)p$g{A`{V*Vr@FMFAP+8tX?_>4xmyjTE1EztRErYLd@HGy;
z#?RnuRA&VEdmgZ#vHN7-&DaaWZH>j?UtGPz5B|l$zc~08H~tL%#lgRLzigLZ-BLaH
z7az%o9{h`s;xiBa#mDfK2mfL-G=qQf0s0qj!HM>`yhgiP&hM@B$gzAYgn%`}x3R-a
zfkSFiOhezK%oY)|A3$C=oz3-32Nz!7hg5|pen#I>Q^#F&A?@c$@(J~9$8@pjGl3mH
zGBNQ?2Mbqtf>Yu6mKZ!qgC}W-S{tI)?o`xT<2_Ml#$$CP=_9k_Pg0i#chc&EZ*V6K
z?xew;wDD(fCk^hTHM{5FPSOK0xRV~I1$uBNJ&MmfxRV~kS03C+&Cm?)q`{rEa>+bK
zchW=mDp5DIISCz1eH&7l2pf~Y;@AvWXqc`iTw_bt>&KRP)4L67anr!djM36@)G%y5
znq-`|a7@Nbf=$m8*fC%>GS9=lusjl)0kuRpFdGlaIKK$9@ebthdr})edGdXaxm_lB
zp#oNYG*8Be&Lv+iB1w?}nXW*jVMLXbseBIpZRzH2xPN(Eup}$yxd1<T46bHqd6phO
zc_JIq@|7!&W~hW^X%tW3rT5>`@4$8O3FY%d6yKiE?>-)#m*uQ@dU8_CXR|CXkEay}
z@-fS%CnCkayghj}FOw|0IDu}R%nO0#`?$<-O<PZrWPx>$am92$0up@vG7x(L_wals
z+wu0NcduI`v}0T5#YrZ~m`}=ip5iQR8c<aprxP5fI8(J^Ke9aEASU*sD8i28yEq^=
z!){<%+_R~{0x^Q2?)0Q;S;N_1W(^vkrqL~q(f`io)hL&FmY^MY{1rrjCD|Nuv`X4h
zQJ{GNw_s>q%}eE8DrRJ=fCX{?YbAo@>B{lpnz<UQfx@=uo@Ba23?<^KL|nBH%NDi<
zP=2=^$gtIH*DS<&fu@qFTYQ=&SzMwLf-)JI5p}4;5W+#6XVbV4Xpzlxl;snWY7Rb_
zAaPj$g=(3Kyf}XHWE;Qri#j)L3#$QNpw$<IQCvdiB?7fivlMYs5-dIe`YKm7&q#TG
zjGkv{5lfgyTo9T_WJj;8%b3VDnJs^!1)8Uc<S|ARz9sz1NFktVp0PPVLIl5UZtU%`
z^IGgP9B#Uyfx|%9*zsHgho)~~+ZMj-dZsYNea>Ll+Qj>NH~3Q*GqDCoB)!fOc2s{-
zO?tg@KTt`(nyFSrtdEft^c0JHYra6g(UCZw9FI|N#~Vu^lHQ6(OE9EXAyk}`%Q&mp
zlc!{%&J38xs56h@=qPSKzplGa-lN+HcE7L674sSOL(|8CL=JWcK=y)=VBd`#>Y0HR
zxaR$b?7c|!^j9)QYpp5BUM)x^i|y#WxGD@ZB1D*8kSh5DxfE;Hp<bpdmm@mL#f0Qs
z?#Edq>+7$|c_H}nvTF%jt5=uQ*)+<pU1oKt-u>10&=;XgT<(&9VP=Mq7M@c~0zbgQ
zBP=um#zJ$QcKHZ7GFtL#UrcQ;tv*A`@-erGI%A1WAALBeq+Crl-|QkU8odVn%jt)M
z9^?L(Wqhv~^y}7vEFp1Un#=yE#rVIn52Mj>_wCWR`5Si7(`%Lm?~eLC(meFghi<L<
z!7MM~o_y?AnL%6*%8)&KEiL#g7Sa%Y@Ocd8i)WwWoms&T)OS0$rTCM(V61odx7FLm
zBRR=T*9aXR2AFVeVTZZ~CI*kN5TO}y+hJZrhm&jtM!yy+E83^4^Gs%)St(4y3ARF-
z>>YW-`F0o1Hwlf_&j_y1{i1@8_YXcOqI>YIdA~jgH4NKW|7;(P-BN#`y2FpB-TDEI
zT^E9?QmPapD~sRnL>>}#+`~j2%QIrg-*5|r$3s?<M;E}np8&mj)7?d&zDIKLgB6H<
zn|q#N2iOwCz>X7g91=k>F)4SbW%%5W9)W%J7wIb084J-H>C63mhSt7gWVOY0zTBqU
zGp^<WBuHsI`V0oveehy~h4m>q2#HVKh}oDE3uvuF7Y9C%u<KaF6?Wv=))%0)zAqNm
z&#afOT6u%6`t@{GW%2GCj88ut{6s&&$EnQOH`i&mX{u7I{mkm>U^srz`6LH5bx1S#
z6(fKKHTABmsn?0M==*OTy4D&6+^2!dap*V%JE0w6VmdbVg&A1BA2=Qh@4wbsqo*s9
ztT%#*_!0ySK<DA+DA8K%QAcDQZP#Fz@wZwQu4<IJY%Z$>nCNEUkObj&l;T3dJMX0m
z`<XC84}E1aPQsA52Bto9u){+a6Xu!Nw`|i03}Qzve?Tj<M#X%|#n~vT!}9z*%k!bH
zQs1J6>H02awk@#Z`V5Bwr&ti*b(vw<G#boJtISRHnye1U%G?BNRLIr8<&Yd~OLqk4
zH?H??#qrjLAQrPEE{|419wD38pFbRo-kTpkt9h!|x*OQ1>XI6MyI$d+%|bN*Db|e7
zV4=GGl*(r$zt|(KvXb|oOY5AJ`t><3!>J8+zN39+08$JVs&!LrKqB9kCF_yM<$+~$
z!K?r~0d=uMg^dH@1=w(G!z7_=5ziXjz?<aqCXjp(&F^^#&S#dZ+d}<qNY`z#x~nh@
z!u3;hK=>s|nc#l~PV#iJ!wx&Rf7iIEcR=d&UK)h!b>lNnW3U37{^OwSeYEc1A<S=A
z;rgM=*rpR0P8b@PMl8gRO?@1&faB0*7K?042-kZAh-YxjO8%7Q)*V4S_geMXG0zWu
zJx0WEsBPNV^<57;QRL%LhyV-bnZl!XU@<o6yk8dj{B~N-niV);pYNa&-1|gJy710O
z=N56rts$GWw6(LJXuCS|NK*|x4#9XpbPp>1(o`A(kMFQbfA=8I4^}>=f(ODkee4M0
zV<+-WObGEY^$lX1k;7RKJV2~-z70;<Qxoq5+WB59u%8$4{Lq(a<a?CCGPPM0V26W6
z$%+WJBg?QH!*in`dZfVTTU@EP2z?&b>SJHBmKhq%4?|3-6Jdw)00+J>aTGF_S(d{X
zaR$rN=S5o#mZrymgx+SX8UWFc-Ox1vqMNZ8FdLia%7EGE{S26m&t{sw<ACS~E1NT$
ziomBf4wwkAV?-7vJhZUkxh56dH%-$YWb;8be;nBezKmc!AfngpNrQB~gC}Yr#M*SM
z4dI6U5g8EC=&=Jo?znXQ(1q-XdeksY8%Hjs*zt&u!_c8Pv;<`~^Mk<LLe{hX=8(C3
zZRT>@LAaG)v!5mGvE(c_EEbvqCSDX;*a;jP6W^xT<AV6aBg~@fX5YH9*N(?_|LAU>
z(Z(mL)1q=w>J)4$hc3!4MV`mJNjriuu6~tl#wDQuvAl$5P^{BngL5)Ngim9cv{$4Y
zONf1)X_})aPnx>wN}fE?x&e4+bY^9AMIclWo(0b+q|YtSVS5H)e`^ZjF*?t##3jJ{
zQ`I2cYJ|?q+iqf^rlV?8##K}L!*cxo+u3*D((hhEl4Uf_askPgzde~<I{|Z1iW#O0
zEdQO%VK7eS5(iz9l;e7YAak`!#tfK?axp>&*O;*^OL+_(A<5t3B39{_w@j5;WrP1&
zum5+1Zd_WB%9-S`o?&tE{cm%UyvsJeb4il9EZo0Nx7Oh~zWx?;?OlZkH*`XXnKx*N
z9fJm#x}0OfwTR_AjzQLD_`3eCV%>CGX_2M>oRxxR*@YCNwo#_5Go|v^2p(_sw;aT!
zm~NF4zb4$|TiFLBC)(+UgDVj4o|=a7r*9CI2M=ahl8{*;o>sq9cb=wMD!!qFUBI}c
z9G=Ybr~hggw(WV}d^nJ}lW$9fKl!%gbuF+0FiGM``ZN(y*)0%7Sz2Pisz0@i*(d$?
zm4L1LDa{i8jjHGBJTApIy1{??aPZwTxuLiA&$D`8d{u2w=;&FJWLMJC^X*B=RntzY
zHlE1Q_^xw=6uJzSrA3y+oRp$K7oy_G*Wj2kC+wo~wik0MLH*S!6BmFu%knzQZk1E}
zT~5+s2D!Z?PvIE76DdhcBpZ41mn35s=w)1#BXkv)=Ws}TIFR=s>!@tjxH_IBiT<|p
zra3C037=Rpm+!q5?A5HOsYC1Se001mgZ&$E8H+2`-sU|uBnc_uP$hXDL*8+DDk`*H
zE~eQfOgfSXINspJWPxa&5sru~OQdBE1BKy)Tc9gJE<_4Pxo-b$C!&{=r=BLVKYtYj
z1h3tsdz%A7)Nn9^EcK4*dYE|J!JL?m9|_a&2))k<>gC#6T1MzyE>gY%S|;^fbTkt=
z`tKielFk#7$K~RGMv%^0uM#CoRf11<jV#tq_(t^EWiHnlveo*OiL`U^+gzj|SVff(
zSoaHlLtucs1;pp}874<>#|cIpAxy&|m>9&wj&He`ct(V|5FBzslgNLJERySUmXPUG
zPQqrwwYOzG>$<Z|Pq0YuL2=5(40b$KioRXKPBgB~{xW|w2;qP(<|Iy}uOks9n&bq~
zJ)QagO?8t@Cg>DRVT+6b!y%4Z$*0?Xh`30zQcP#%;^<XAc_}VM@>;feB)8J;HOM#J
zT>v^gb@kY@Rt9UmuD)V+>YnSQyF$8tle!ReifEj+3x#nWjpWGY0K92EE1{@mRxpx~
z{0PRpUFo!4&S(VlV*Ru2j*LbKG$C2D>dAj)af&YDl%Ik?lg;7egEB@aOPls|L;hM_
zcz@X2U=Kga?vq3mOdPEkoiQ>-z0{y}uSvlM*2uLWDUu8FIWuAx0tA<rgo>o~=B;Kq
zQB_o$Zg1-BoQPA3(K6^I`TyB_7v;8*BwhGbYPH*INx_nFDctN<N4UGkv;L#Itz&!o
zL~Ps9Q8$nnlK=+*B`fxyh<%WAUT&Y{L{{O-D@ainQc#4uB@(DA6tb!^zs&q{CKaFK
zzEYs>8;V{4mX8)R_JY9jWgs!}rNBfOKK3DLpIc@q4a;*JLmseNsW!GUb%EW^shJ46
zZ(3~U=O4=rxeSqp`}vx4e!2Oz+L}@(z7#MR)d7qk2`de8A-(8k6!B5rFa%{!k}NN^
z%zS*Sm5G`W;3?!1Ezw1P)PblSsS_P1<kASRWf%q~!gR6kSSI!vky40|O2arpYlq#|
zvZ<m%K(+d$;a>Q=Foa~TnI9@Us1{8n3tGIEi{=1vn#*AVGG0kxDScWTq0<`ntxRk6
zWhtK&(suL^Aju8>PIyG&YAyT4I1WH0-^4;saaTjha!uRte9VaDVZtmMQ%((RnSmcL
zGay7ffF*uFhLYYy?`$p&cCeQ~zUOw>b^IsyZVRC&VGK3Qp7ta493LyS`e`J!Qvc{t
z4yJpw+9<P3YS>nQ{m`*6akzzjGqkWPLf7G@O<d3Jx7K}PP<z@`3!OnD@aoGDJT{NI
z*FNG_TXd?`3eYhW*hDjV+WcrlGxYi7S316-sr-C0X#cTz<<%(4M*6zy*Tt(oPU%En
zRQ}eu=4>f0rtPE4CC7rE)<OGa3>pp2K}2<H^XyZVUaOmY@#S)^kLESHpT;#s$LNn2
z4Q&`on$#mvUpCCWvfzpStH-MjAvdr2{yM`<J(Ke4x#?+__C~w(^uu4Rqty!y781^+
zi#_fWOaei$Z<rj5z;Qg+VvZXea)sEr@Q9_sB&|@9FyS*$0h4$h_sOP`M`6LzAZB2E
zE5&U^1V*764nSusZklCMsHl!8zLr@Y4K<Y!C|eW~*|R9yfBavWn~sGXN7pjF#d=_M
zwBnjbzb>zM5f9QcQqA>N!5E?ATY~#8CY%_Ua3L_G1_PE`8T!6uQ0qD7Gu{aTg3H#~
z3vE^K@~{koy<#uVt`1+8Zw6=8=|;EprK*72H^X5n^){zNHscNtS^77(>#$zDYP3-Y
zKf1bUk_dHE9Sqs=#*w7?gif#O+IquO%J_rq+5i~!*(e!{?60ZX{QlUe33V%@cM|a=
z-hTG(Z8$j{ev;o{vpnha_Lb<oP2&7xSqlUxl1{eh>MF@p6uNq`NuDQ@lc%p_nn$Z-
z`czn<qy!5t3``s%F(rav=2)J?eK!<A@7GxmJ{H;=xD1!7oyy%<`4abr4jz~?(4&Kg
ziw>Iir+el46hS8kqp0;zVvRrcMcGzKNl)-~cu*oaS}o79xIqN?lmjTr>q>$t#F%;9
z6_#mH)3#`zCBL^^)G|xnbjlE{rCD=WXLvoAWch#vjD}W-L*ay&n9Rk#?Luy=>4d(J
zBowQ-iu<(I>Zea@eZaI<l`FbSTI&jS1kICCkQ`))LGuf7tI@TbOKB|=Se3uyrMe4^
zqbwhwH*pS?SRs6(40s8naS_t0E<9`Hvd)tlfb|+iu^z+5MAwapt3SbfrW3G&v!Z_;
zy`AOJc#L8x)%CGx=KaFeirQXV&nuF3%f!a%G)<-{1l`_mva0HNEB}aVI-cv>40A3$
zOib6ozVC+E5Y)4!<#6e{#}vM;7stIPtD?^*s;9NNs+|&23weC7Y*aPuZL(3_An+}N
z5ljQ{_&S_p%B&E(hR1F0J8rP@gnXVJw!1_EDrtCf8K+Iqt`Pet;lb-uN&8gN2XcJ&
zsiX&=O1g*Qc+Ne8G222h`vGDC89LGn8TN@SF|h-N83}D1FoQ9Z1kxkycr#B`c3;D&
z+H>aVf~L4R@$|{1=&1+TDr?kn142D+U{gv5*un^=(qh<hZDINWCydA=G&}B|HM-pT
z-ecD2Qx>jm^FLi_8-YhGY=fu~DjXcJfMVBniETIm3+V&Y27FfepX&^i`$_S9s>Vm3
zx_QW{o5!2EDJkQ=0Rh~G3^1{Ug()*_OdT2$&ks$LKR{jM1KJcHa67!e<jkkFOZIV9
zhZ|RQ>@n?qs8k;+wehD9l{&ysDeq`?I@5Jc7E%`rKNOhQzK5x86KpbWSRS=QSD1aM
z)ZRm-Y!|N!lu~-ua|x94gkusJP#n5mh>1g8%&5t*O9IO#KIf+2^Z)n!{}03e4<#I*
z0R4X*G}W*eRq>X&P^mvY(hyQ`R2>x+B~^tu0ggP&$4T;a*NkmlA`E9VlsMDhLJz7!
zOMThD&N7J;-Ba`0?Cc&Y4s49c`iqzWjIAcCnAgUbbWB->IE@jzozg68lmmE;QeBB)
z6b(mMQ68!(Zxs{RcNi83+#N~=5J61txCS<)XJcY;2Q$|+ux-o0F%0SZoE)$_L@mdA
zsTj~$P21H8*bsZAnthO30E?2dP4HDfY)gh=h=b6uF%cfYzUQ0Ru$c6jB@8dz5F_7%
zc?~d6zjp<^tz}|+g!n6vlLd6I`tWI`P0mGNwM6`Rarw7*z9m%tt-0x${QK~$;&f;W
zPEX{2L|~0!32F-4#*%m*CSD*g6T-%ULzzj1$32H1Q8-mgl8b1nyYTq8?Wf)8`=3Cd
z%cAbLRS=b7xYUxqhZ&@$5ze8It7~H}C8N}LnN5u2vl{lwyx$V02O`{uKJn9I-Cre)
z+Xh{E+$M|>sA~;DSB67y-~=wVMJNo@V9c-|AfxEWg0AjlnCu>RwYAal<XH3Po}j1A
zKY-Y)Bc{z4rU(qn6j-_}#KdDJ=zbQs?5Jg0!t&gnj<S33)xNjIyTxA})NXn3Ay{)0
zJD8jOJyGA!_p&q!Yrg9~466^rS~viD^83|?V^4nnaOC$L!Z(vN|M9j1V{6Zpf0vjo
z%0*z>9P@xUm{7;Z%pejA!|*wE>@buYDk!b~^2-ikJUoeoBDtmG-=i#I(KyO)H$){(
z%NX4fw*Exf+IS<LOr|uA3X~_x{_>9*9e;XodMgDj_3TzBJg@`9H6(Va&oBwVk?fcZ
zQ=2j&m<U4Fvs?8+TTdux>t4vMT4}Wko^1@H9jY}zf2biy(GJ&I7N(WWrqd+Nmj-I-
zz$;CQg_9J|V*P6obfsdmieRjOg}!MCg54l+pu%o|1H+`)bA>A{H?RX{oSkh9srp-{
z!>RPMq8y@3GO(hn0>-oWhQ<I>7lY7oR}*@RZfKeUzg4biuJ8?5KdPB19^Pvx)%Ju|
zOuF2qw#0@nB_<w(Qu)%uE;S9$7sB*5g+d>cQ)GX9R!c&u_Q7IRi`>J7QEkm(<#FM8
z!XelK5&|NiP_Rn_Oqg&Pr<O}LQH?$`pT!+vxyPfi>W<MpewJh(M%9N=by%xCi&b+<
zGWo2-sCp8sm4yi{lesR(hG7a!m@P0PUWh}R63gJ6($GKhsH?khSS^dXI!x-SMNM(5
zpsP?grtKIec4QzhaYTRvVF=8HLtMkKn9sxGvoH2aT(#Grt0yc`+eS{2kcHIuTueME
zFyS`Cz9}U(IWbt^TU>I{TOs?7oVp*zs;%veK62_%2tuB4<kS%dPT3*oXfE~*U^p-#
zXr9>~rc#8iXSp^pAE2&ukI+1F;M5b?Ec?KzK5*(OA5T4hRnK3w@u%mnn*Ztfs~(e+
z)R7+H(!?QkJxm-)F_4tvz_V=6CYH3l4Vi3xEYvRiRUTdw3H7Y#s|;=m+wv&pR%l|v
zpvHk^8rZS9Z}`ly8CeAn_jUfNpT5rD{vx6Nold5&iy)&KeAN)^cH~v>Vg|-o%|@l-
zdN%Vlou5~TE6pnFj?MB$^>`ZJ-q73gbHpU4vrHL<B_}dQNxBeDb$+gfeturtj;B*d
z6^Y^@&Z5a|tZ)@&0?yT>&r=G6L-HFR&x90b7wG(4J3chdnw_7cNagp=W5p`aNj-L2
z+JWe05$A+NGNDlnAzT3bWpb?VRIDSf(fN5X`9j8xeqemnR}y^(AEl}+AcCMTc!YYE
z#0<bnm>Bi&)uRvQn^Ea1=jRA^YK?JbQ^_NE>Y9xxmDx0jvxto)%)sB;Gu)Wj4Dn<l
z3%V3YM=qcJMTU}_7)^?a{rfEbiZx?dR_y1EfHw59`Yq8@bR!u$g<r}BKA!+PmkNaA
z$r$D@O5)EaXXxK2f@Y)F>aO$iCd*khh3dn~I)~2{J6Z8<p3X9O8Q{;LTz!2C`BPZ}
z`+b%dL~H61C$~_`QC;@=L<xstXY4jN=jSVGI1bQXzVVS_pwV5y3p~wJ8fWmL&rmuW
zgBt@Hd3RO3V0~j!u#QzBbuSB1(@z+Il;;u7rgT#IL(b1HRH$AKu{U{wvT2eRG-ydF
zs%6Yp{VX7QWBuxCi65oOY&fdk0jIGjNb6vs7if4vmIgyzS;g}7)0-cEInzk_#yG>b
z37=)9r09Xet8A^c!h@(pD9MT%p^eAEMKR8DMX_i&lv&<jc|$`w-5-lvQ|&1=B6!zZ
zMIPGBkiH$-IJAiYDujc5hdbD}P0zQbPZ_tKBSe`@>x~CCFD|3&ww%%&-GDqV+b}h|
zesPdAHqJ_bvJps062c!*x}?>l-o8N)DPpOlUj=M{Nr-Mn5g)Z3jzBCp%hcH+Cl_-V
zW)s3xAO9SsvVl+*hb{QTW6=aTn<<VhYJLrRqJOz8lO|zu>XWc&Y1!57^KqM4HORfh
zka)Qq7Tp;YEf<pV5f}NSZ~+L#vQh*UY0HWy+~VN}b5{+@e%EE-4$2AotU`reA^2z>
zj;>nzd~ynk-Pz}pg&De%Y5B}`it5tI9keECX{2AFWx(s3O-_rZ>tU2XwO-P?AqvY|
z+Fj{stDaz0bLv{vl$x18A@uw9bV9$%KQo#C8HK0Clr^shd4hv^P)-DVpn6$51oZjj
zwYsn|lvVTATzHF5{sS_W3gVSaIVgLVD1~Ktx_IX~G7aOxKrdT!KR{;jj`L&+Nker6
zM1Ajk`fxSw7hf({y!)~SL(xK6grVxSN-u6`n^5OrzUx*Z@^|$W<pa0AS8ud&jrzN<
z_^{HUtIVeZhuRm#=zubnyWP7vm9^-hPcQD4UOc#ed6ek8o#c=_v>bLFC4id>*)+De
zfqpxAg)HN#iFx-YNVcEf5;0cM9Fj*9I_|j6J4IGMwIupsN&wtIBfqDkEf0sngtI!l
zhm$;+{?y%)Tec!U<}{D8JmM-?zSFyJElG3p9bH8C1k@Fo-tl36S4rYKJVdu!c3WCo
zds%l`SFoEzliB2BG>ic#q;dXpG>r0Wi_^Pq<!!2woT>@yVV7PfiHQ>---)-89E+U<
z`6NqbDQ`B>S$s}%nhs^Y)2(Vtc%On%P^y|;UXb!~HE#Qq42NS0?<S<<Om>~HkGgzY
zJR6TYbqbyF-|8Dpqss}WQ)e3cUf2Fc(Y4HeE!~7pms_M5%Ab~Wci%ZS%TPl=xd1oV
zsAZS&jGi>zfLho$e2NKUA@*G<vBRX}n%oVH@L3YUCDVDN82)U*g*q7}TMhvx3OZj6
zEG}_VEr5$V!G!2PqG98LRN?F}tSnEHc(^b0y+<Q^G;&8YQaj!tH1TJ(w0a<NBM>=1
zWsizM8l5o6B49v|_r;gX#kbx=kWVjYw}&9x^U*_)yPA*(4$kxtWDh|ezm)e7WDi01
z5aj&Y>><b=f^6^AJp{QW1lh9wx?+)r6x22y8=Hotm<S@VZ*Yn|=}-{_GVuL}Wg>3p
z!JEb!5b@Y)ix(nO|Gj$0Dn#|U<mU({w0-FiOl|IAB0?84#|<!Jlu6%_CS6%oYWMt{
zwNkek7q5wR&|C1-px@+>=Fzo0ef!%P`Z!~gC<Da2=A<n%HZaC565E`zwFI_hY6m($
zU*FUDIhx88tm~SJM+KHEBs|LUl;%mQLen?rhiDv31#uVMrxHTq0TNHph+e~ZigF<X
zq(WPvE2#NVVD#tb3dD!x3qZlni)kI8zkT>c4=c|pA5C;(!0K@CgQhk2@3KD>6hx+t
zF#0K(-ah_*u=5hPnMG{DDfR;{F)^i!8RrZKTrwkYY)UQJr{HZ08|+i?_L73PWE)k<
zM8GXoZl-%?A@972x3}>2&J7uGd)m9#?%d6Nd)=<RF<s~?jgmCVBgpnq*;;CXa~KFb
zZ`)m(&*CT^zJ?@{S(>UmiMF#C$jVv4O^$UwTIF}$TeeVGI*xJmUPs#`3b}+>hUE}!
z2r4llfrFWF92{~INQZG#ibJm3x^n5vi7;-lI%`6D5a@b^6>j!9UUTKr%vO<_cj~=C
zQ#scgIt3vwWPVVt0iCc@Oh|DZB%UadAD}mtyq{HU=n0x6ag--%vD9k9bRCkQgd6f_
z1sVf`HLB&lT+~oXR>%0DxOg7baJ9PkNTc46Y5gKVqC5Dm3Xyg~OUS?qup8PICWaSa
zYS<>`EOh;Vn+~&jdafpQp<+32QWxskZ@=xPa4w4KMJJN<Nfd)06J4S_$v7R;w8@f=
zno$FjD6TWS&d%y4=(o;IG?T;{O)OHi|1?f!;>~orm{q6Kv{d|p%KC+c@cE=(zH@nQ
z^%q6RL!M+goDHX^Q<`S-PuQDIKhPW1)6X=gXJ;4fo6ZLH-$fiMe0;fGON~1h0y5MV
z^k=b~{Q34bUC1yBPv=Ju`B7Gp_12gOowEjw)Hi%AH;m%)<<D>l6&s_m3Ubh+P+Qxk
zF_`x|2H0db4Z*nIA(SuUZy$bn=oj+055FuKh(1LgdMx$XwICuLX2!hNnbE`OHZSIV
z&WkD=T5fCT60zn^39Q#NE;c(w8qv5`@e9D^#XekI49B?oRBx^2r&%ti>Q}vg{5^?c
z^fijbC6rl8W}qgV(&6w7((9`}+7UpFVg2!<5G}2&oW1yR$rC!38JDN?8`8iygB!G}
zzv}XG=O`{#=D@0Jixpm6S`FlHAAVUg4lQx>_cYY2)wfns(teWV{Waygef`?L=Hzi;
zoS{Zp+3KCsjQ7cvD<hl6QC!gFZVro5*KL_ZqYFU%LYW*l?!3nu6DnkHZkySm)WkNq
zkNXXiX+KVL3)tx?eoO(`c=YFJ>`vQ1MxyrdM}LO){(bN=1)K5q4>6sk)A18}7mXug
z`-i!e5Z?ckUdo*wN57jV@i;9NW7ijRFm-;GVUZ1hOJO)2u^W@Qrs+5g2NpFkacmn0
zj%#8I{Hg&Zf*o{aoKAq?!NZP^Sq7ycgX|WoVQz;WGDc|-h5@F5BQOaZiYXx+yNqxu
zecz|nsxrh!DuIyFDwovroU7BcYs+OV+bf-0H$Xonlj&IIQVh^r8jTgV;(S@pX_|1E
zWy<T4(;P_NO4zcw^(fk_vZO3a@_Z~~sj7db2#SZM*%K00c#y57)o=~&87{Vo1*w~s
z#LPD-4lIL(MEKkhJ=VRpOwW#3cN;QB$B7viBP>9aR+pD>MHD_HXgv5lXM?~;YesQD
zu<@WE#_KkQ`@xL|pPLrth9TSwVBCBcpyNL97@B}+b0`fh<bj2woRx-k`M@KXo0CP0
zsu<7bllS>Zrk_vF^iON+TC&pr<+8eC-jmcw=v{Vaci?d|^@IxFd=u00Z65LLc*=C$
z5AMhzEJmug_E*sJ6=lYKn}K^(+NY5`+WKLE2!v-6ifzYZm{4wG#+iq0+civKbK5lh
z=g7CQH>FM48H$WUsnnW}xAFaM8r<B*JYV?>LdsHsF3}ogOJAcnNgF%78ssHfb=$?<
zrHxzPiOUXmy%U24C9}hAbHm)HVyUOOoUuz}1#@Sc8f6p%jjN%KGgJN7TEZ{UIE1QU
z&COT`2(CYgp2+U6m+Ucb|E3#+Mrd+uh9-nuh71R;BeCxoo^6MQ>3hLZAxtmzM^{M}
z>5r~fKtrF>2%>*~m#K(&z6<2kt*Zw1sk<zCETO0>+PDRT{xp^}uCOQy@xU1xB{!{u
zN5xYPQwo8_Vy41^bNy5;EUJpY)U^Yi2neM|im!{=*ba)aMd%ZgNz6@VU?N--`_lHY
zZMxJZl=w`T2Q1c*(WoRT)1sv7TeKx`0jJk8t2n#$98+FE_lgg!4zq;|N6~Nug(Wn<
zBgprhf>YJZIV}Qq>p0#sbRAJWzFN>rQLUuztGrbTO&YP8O080bXjBM&DkoAzb-9~q
z0<#p+F`6oRN|hM)RK+%#;vz_SJCT*93|u!P*bIrl#P&QKc-+O(GCVKj2J=JOE8<%#
z;z?S3GA*{@WvY3($t)=6YWIxd;a-$<y}i$?>X5vuOH!=SUyF+dXi-z|r1ffD9W`!$
zCoVhP2_-RF=hC{{{;Fr|gUn{*{GxrFby1aDcl3(#Q?9JO`lLQ)b=ei6A(&_3Fc1tA
z0*nBTOEIzCAh1kf1_A3g>DDGaEpv8?<UG(+R)Zzo_t{PO^b$N|cQ|C5O&0d*cN?%5
zea+5D2txaZF8+AYuu4>jZ?!-F@j}h>i!U|Sq90(P63kp9NXTtMexDukehl?gc8TqM
zd=|s*q=EW~{7F5uIw*@5q0tjQ>T9w*S*o}$T<Kvn&Ns5KbnNuOEzB;eRuP-yaLx!d
zap3tjCLRwl3oR21DFTaxCbf*CPpt-oZGj3(gCuVu28;5MI?CGBZxuLF%y&fvP+%S<
zp?a940|ZA?k;AGvhBNf*&+qYE!Ci<J3!^bann9{)Rq#_c1gAH&P=J0f725Yw#aC3U
z>u0*8Y6U!Mxp@0qQ;pK~bLVVXpk7C(^YenfLzhdU)m|3%byU<yuIj<+hdaAKZxl$R
zTjexH;g}8)EvM~9G0rRchA2Z}D*rK)aX!AS=a6Q_H0~d|S<8&Ier4&Gk4xT!?JyjZ
z65r&3hbi|ROqgq7>bn9vCbMnkP+z*w(wVARy5}e<mM*OMto{;REEdR_UTSL1sP)=u
zsR2=jdggC=l^dST7}Rp?lx@Ai)YyLn9oo02bAYZaz3=I5uTxX)TUy@IrM>8R(otcn
z?GUSBhZsxjkoknMrXkWEQI$lmh2W}q+m~pUs<cb%jTYaQLm22Lvi}|Bqk?6=O1)iC
z(Dtly;8a&OzD6SoIAL*xO7K-X{+esm_v%VG71mq`Ul$p=^Hle0;$Q)+$);`1smiPU
zH~4l=C}0x*O{KM6EH4SrjM}VU>J_g^|L5O#gY!R6L^5Mzd0M5LHs4B-4BfaDX4_h*
z46x7v7^R!41GFC#@?iC=NAT_&^+&6bEl5T?S+{v<>CtQC*EYY_9=<x0xcQy(0qU<7
z^qUu7F6SS0*>$QY>f-z86LXK+N?#(qJ6Y?-{afp64Q_igl=~d2pmy$X4SRHlGKB|L
z$Dr6)4^gm#Uaot&UM1H`Bj}}C&rQEuAIWYFx@<4hdTM&1J`$l`u*#mFPYn2kdlmio
zs)Q{92|LL)d1%?*Larw&!l<h$plvHC1#awV>2wHGdU)&h!HwJAo&4BduTF?p8Mo}X
z44lZA86m@jc`go&(8iEiLM+22rq7;%XIanY&s9u%yCU|gP<#V%3ZZh^K~Z{y;rBWm
ze+k!hMT9*-@>+tAI++bs$?sczcN9kuFF!7mJ9K`@X7+nF%NsSp#SDg7*8?xe=F3OB
zK<{Eco&jsWP&Icla1&gqi^}pmgW~Ux$t>kkyQQm1Dno-|5JE~I5Gv^ZHT!=xhfI#>
zb(GA~C*vwEho%yQw{;U+fz3^iaBP@?hY1gT%ovy0c0)-l>G06(qe#mr(qd6`TMu&!
zN&P{`sib0VCH(we$vPyZOLRjsM3>9>J;kH;JS#oV%AI*u8r&I*Oylk@{=siDze&=s
zzv|?!ccMch7w;MPP~VBOv%&n%-f0X!>+|Ne>@*IOi?>ls$8S|=UYQLtXdf&)H{EWg
zY_|Pr=V*)79q0q^zJeyymF+Pj;70i^DgRtckh1)YUYvu47dlu*tupU$R~`Mi)XlED
zKxH4`XrCL(A1|s0(o<Mnvt)Saj~BJZRSfaPm&=7wx8l+f+*<m;=N_eY^p_FvfA)^?
zXW$rrb|@V&`pETz_M;y``1^iLuWhi3!1IEDSQd6{X<#C4hJDkpu@!isFu6yF++cX^
zxuEZH*Wgst7EpxK#Bbw8*yQm`az0FnUgA)bn-CBlvJeyL+t{})iOtY5Xh<y23-({4
z*Sc$s-bUc}Z%Hm$l6+P4ZJWZs^;<8K<fMo;F3^)Gmy^DJr>c>e3#4TK^0TU7i|IHT
z#;+jq_VvBh?^NZppIrG)fJsyp<~>yIq!1K+4VlLUea?Lp?1WE;G1Tjn@sJLsDEm*d
z0pbZ{E5Ol(8=ry|H_IxHo+%6tMp>lNYfh9|417I#gsZPLMzznfoiNe6R_)}}V8oX$
z_L=Z834;J=@+l4j?pd7so*|CR0iYJlV-@XO=)5C&zUFrYdH#yBXfhisGcG$rd#cQ-
zE2b}kv-_>ZSqSPbr8r%Ka^E$4?D?L9i31YLeH%-c34_~&h7aMWI^<HE`W0_OPd-4A
zauKOrOG#lv^y>Y&6rbl+xf53MAu_Soa|2Isx3Zb@bI`F;rRw-DwKDJ0uiivIMw143
zSPf#qBUE0zQ;&yQUvX8r#FoIUua?++#bwIV{OMKgAPYAxdq;g)!d*B@`m%%vQ9|y(
z3*oI^+S@<VFqJYshBAxY-%JNI_`bp2CD!EDb=MA+7S0N6$MH=UyPQ!>ESKQG_9bQp
zvpgCK&P?mbP2hc%>FUz({;G5-Nj<D0UB%+su|}6m39~KEG4mwB#A6IIlLa^=rXxa6
zx>mrCUsCUf+j|`{(^Gpl!J9iUdz-}aq)kH1Bq5kMriZEYY|J_FJeQInlwObGtfNU*
zZ{dN<l`I&)eYKK@tX9(3DY>VLSx-q3IA-2u>Y9#ec_x;D<zV6)1XG)v*l=kmrR8zM
zTIE82p4fe-UH>t;@!KatPmSMG;~(MP{G6Ea!_YPZNilP{1EF;`4y41e;X0HG782JH
zM{ZaG7wdekQNg=)s@yUE-z@%$!elIDdbS^Mq>g!MhuWx&re%3g8>47S-q^ajj*f6q
zP4XlTqu~s41M{Rz6l{gusIVXSpz*Bb(V-Rv43j0_F3`JNQ`%+-NNv>xsj3@-7=<tc
z@F0)ijEaVk4AK}-xt!n=s3*|z(H0@01@tEg>$*mop0t?55fwmfTMpp@{glL61by%k
zjfbkT*0M><6ZF4kG==b;Sm#n+Cy|=qtaaGlOOV9hXYp5Dyn^kFY~k9r9~d4cejqU6
zzK@x2h1hb9kQ-qjY~um&%wtoxT6nmUt~J?-unz0*%8XpaM=jNxEf&|735tgob1(p7
zH=0H=&dW@*%Qw1mS^4)uJ*92x!|yXPVL$cQckFp(cAy%>-7@?3l*TsC`m5p$nt?Y-
zjOGWr<o!2CQ)b}(l5p)eR0C<8K5G-<8nn5CC4w^-;jsSVk{uXb78!7T;gf?<(woQR
zF>C1Dw25PJhNbTkOhUuNzH8aoF+*EY(`Jl4fa|9})cZrd)1f}-UPr4x|NHZQ<N05x
zhrj;({?FP>YgJsU(#C(4`6v<DS=&qXHcGR+PB*_qk)r+Aod2z6&j#r8iK@{2`D9Ql
z(TooN{3>s=xr_fWzML)V>f?-Yn#*C5-WHwBjo@D{>u$8Ykf!wZ&#{b$`KaB=AMIPe
zoS`3(F+f?Ka+=Sz3xj`!S|eZEmKs0Y^jp&4KRV^ALN&y&E-kG9Z>VCxP>Rz}u==Y~
z3rdf!KQEQ4#aXz#M9s1Ypaplotx+UlQ)#<(qh88&0PVc^a#@u6Lw~$bLfIzlU)N}}
zIKbR&G)e=spSLF~IBK$jc?o)Uv;}rgTX2-zq7T4uet;CqNB5fVpYpqZ%g=^B<j!Ev
zHq0T+B35V{CgwrtVPb{>rqr{sVf(~q!to`QNABLl1%pQ_uOoR=22r2>O4F~(`uHt@
zpy{*a`OO{unaVAql8tpQ+8<JIJ3=QDntqi+7XYLvR$Ug(whQ!0RnBY;r*y>8ah9km
zl}w_Xew8tzvpkv5JmQKbRW<lVf28~@*D}i^7%JQxLoR<dP2vm+XukU}7hc}va4p8F
zJf(`tKnb2sX3>uT+yS#V0^3fzT9aAM6UfEOW>dIKc@t9_XH%NWnBSH(0V%AqEPo;a
z=<p_R@dCE<E_yy;q3M~}v8lua{EW<E2KGYk7<M2+%QlaEEm6*ADdo55I%}`0!nb{=
zMO0LfQ!e-ctONMv4CD?3O1bW7vrp}I&o0n^M8nZo(|6pAB)E@SK1;POe@ap)ps3od
z|433`2jF9xWl<POCFDRl6c6W}?3$RMD0*8|dqkk{s4r(KKV!uj?!*F8q=x*@fBzrt
ziEDCzz&!lVfB#?g?T0G&e3rvLf+lnv@hF*P|MTDf_w0$Ru}Vy~TVS>@ZO`^?>=N6>
z#4>Fh_!hyQ6%vau*Rz5LDE53HNdH0*NMj$@$3{&{^I}p;rr!8ol%iP#tJKYuECC<X
z68oT6*h0Now8~9iFK4v`;ILQ{H(y_+aPkVlTItYj-f-4x>MBj9GR-3igIsa{#b4C5
zQq&h0jZChw{5FMokz)yLIq0&{V$)q)e18F1k`2n_<}{UnZHc5c2VK<sY+jBot44nZ
z)-sh1-@UAF$AE}kCU~$IP|@MW+V8w93%@N-kPz4CalsE#ZgOw3OTdp8gAmL?jhzmb
zUt+-}uyd}w!q(ugI%bq7LQxXWWq4?9?oF|wso~6xP!qB?A8>%ofw8=y%O?1~aO2rP
z4XC<WjjI0RY>j}m2Q?^f8Y~&y{6npYGbk_ZLjn#WB%rC=9&<>5$CxKf)5T1<CMJ@&
z*f)j1!nFytP3hTg&?^e76a}TpuGFdvP5we1*)L!IWq6@Ab*+$snoA2xB+x)xw?-Ly
z0V-)hP!~eA>leL7(Q6dFMzLO_SU99FFXzs4@R)0(6&&0v?x|EFrRuj^sN)Nufim8+
zX=VPs)|HmFt?ymgbg7LMK@827n~K`frkhIGY6BOn^-MXw2it2=@BuGp@C<$qOg}3V
zXp3=PHaqU1!Ih2mn%qHXautGd%xauZLz4xefrG%|m~h9(LEswLmu|q_z%>HjJ77Td
zldddsW$6HGq)XO7-jJ?V7sZ`m(bYBBuB;+`N|(W_8csqK#SFBsvZB-iW971HRHp?|
zYR#W|)+m*xQ$<?sqHA!I0?V&JoQ^qAU=@iaQ<-uZ=a5>pjIL%{jTZFJQHkHG-*6gb
zUs0xtsN4f<&6e!_WkzH&#Z#*)G`OwfKu`v*HzSZ76IWW8N=a~NIj*!_p9|si=1Q5C
zq-A@fNN*~v)+T0E0c-Dc3+z^}M3r9C$l_?8v+CoYqqK^;`+QQ|z4o-#4Zls3iLOlb
z`i^N%2T*-&usI_7SaWz5gaoaTlJ=|3F4ss+V}Q%#R>7xBZ)rfNjjsN@syAbh8IjD`
zSe~ZPrUEmYr_Iay0-X(XhR%^`7z1RLucEG)HGlK6aMEJTdYBOSIX7~M37tRlity9M
zCvcUT3sg)-Rp)BS{ph>J1{#yl2b&&su<5)oJ-c92lk_#Rjxh?cwg2_uh{qmux^SrN
z^vcQoZ)9utB8zv9k6zdlx43bl(2TC(wz?|b$tz?T9i`#H;&`7&u=Wvz@$Lmj*d~<M
zl`eGxL9k~?6BFS(m`TR4%a~;g%Mq3cjsh)v7mMgR5;HoU1J3pVm_>EtE$oa6k;)7J
zh{Hh7ieVoVdZx#`EqX>>>4$<kSO~+xB#;98p0u#(5@M6Uu><!3Lf8)yJ=1cwPPCsm
ziuOhi{W-vB?UMGLT58|YBXRpg;tI*z3W{sp^MtXuVw^27uK27+<C4i$S*chV-O)sT
zfTAXkK-b)(aXlKhR8snE(Z`2pdNl6Ip$a`3*Q0T*CEKHMJsP(KF0l<7=X-uAOh<7G
zdzc7UU>2AGHW*=&y43U?<M7eAcX6IloTS5jBXLdat-vM9p7syAwOW2gu$y}FBpvPu
zy!jq=Oy4Bf1I|riNgGp1Elf<?<-QvTJ9q$U{KE&{mWuZy0B^+zdg!f(-tIjJZl$dC
z;M+dIw_=+6V7MNBt4_l{7_JY7JAOQ7ZU^kc;g0=<KX5o)4;?*p1oT5h`wjLN)Yyl^
z-3LOk4FqTVQgBKbro^x@F{O`vZZYg}!wDQ2*vz9x2*J&i5w-^mZmzxkf^Y@T<Z_&B
z9+G>qxLG+j+W}{e#SF$BhCS&JOsE4Q>U-Fyp6ybfTXxXbdY=c*)`?+vu&ggB*O!!g
zt|jHRMB<uZZ+h{~hm`4{v*nRw`VK&`^lvM$t8FXFZPw6EvQcvLCZ^-tJmOgq`@i|F
zJeo-LlD_4Dxb-n!`=rO$B5=Pp`2FN3d0Q0bcxoo_^UG`{eHoQLW$W>+fo+UbDJ^aa
zOJZ9PiHTtm>=Vnvf$uQO;>;tSbNEJTU7zgzwM^3pqA!FD%Npm3<ZKTX>nxM4q6OL{
zt*wK?Tv%qKDwQxvH5c7kqhP~s<>rB$t}bsaX1Yjvtobl;`RLPR9PwL}6m!xDO%XCz
zLxmYjhrh^cIo3%mgX-@qb@M=}kc|?)Y9vBRh(?LxOj*{ddVSdoVsb>Uqhyvo6?<Aw
zN;SUijA=uNfZ1H)z%zjqo-rKQ0_ra~p+Q4S7!R?44kQX?8+*BAHrKZl?C~qAx`Vib
z4JFYHg=!!L@2iq?u|&{&Q@pS4`kbq~H}~s*xddi;=)Jwu>(AF%<r@x$PBq{=8S~|t
zUF1=|_;NYlb>kY{d*hn&ociO19ub1xp+;z9d>Sz*U3bL=OKZ{hD8h5i6q}Q<LqrpZ
z-=hh8pYR?{STQj@0n7msz|7e~+dv7XVF>AR3bZc<CPa9cdZvR338?J{GLSw!dME*u
zhG&2zr~y?t!g>G!9=oNjRUaG=grKHlM+Cw349DZ1z}%oACbnl|X4w=I!!Sd}rSN^f
zM-UzwLFgfaMW*Bh=8!q_NTvKl;j&_8%8XSDeIpr8+YoNj*Ibsy@}MjbQd{n8dN%gk
za}OERkip#Ez7aFncoy6zYOv7xGT30@aO!b`o?%A)^teHXpFRqq#|@V8#(F(*>`@cP
zwhf@IU;`F-p(iYCI+nl$umcuSj-~0EAqy!nh<o_3fi_5rlGjkB5{&&xlI2~1f+aXX
zqgg1%r3=|BTfZ)=4c9?XyUcQ=^MyK>x?deK9|;+&0<JYvZKfYY#zQ)k0>F>D7-u%i
zrn)@dpiwDrqWx50Xn}JUCN`pDG*vjcj>M?CMngJ%GNJdt$f956mL-<FAfN^{F!gN*
z6T>$!a{`Jz+hvANg>M8sNo*Bz-@?J#%cgDXH~CNY%E9_U@+5`Y<ZI|n^)<>ZSU2=B
zr+LSU<m%GKt?$HTrvm7MUCW>EofNiR`BBf<C9;CmzHCET&}QY!ZeR(j6#SYY=xgR}
z%ckSD3h36hrgqi7_)<ThZeoF&bgm6$P4;ytkJ_30oTHRYx39m`7nXQ5#i>ihSgkY>
z;@iGw6HIJsU}7644uoKsx`c2~a>oehF<S-;YIzc(H+fF^SCmB)Ach0=xYVWBIuqxO
zgeq}%3NX4-)aw=thl!ZMp^5k{7!H}_voy+Y5xt?QjDa?c)5(-Z!#KM@A7@i&FGKR0
zj%T`+BwT&#G);ynolGQ>VF+sewf-FRhQh#zWTta-Z!5z>r%^r;OMt2ukwuf8>;az!
zt_+M2d#)2=VsHcd#B;H2@W2zq=C;-Q{O0WeJ<+vosW=f=%J1qR-<FQwQN>?XqM_9H
zJL%5);yY=+i^}#oBS-HRAEU_%Yp2(vd*_D!>GkL}M@6qkKQ-#EXN$AXs~z37Y06yU
zb3!rU#KnYrHV)j-z@ATdz_<(p*Ichnum1AOs;^d03aHH@g5!#ge~+?=MdK)k<e@b?
z(aE$deezo|F`p<~_xL9~nM`RK6<T+c{pBAsI{uWby$4iS)%a=+Y|UepuWXnmvnj&J
zG!aH`f78l*1Fl>>1ii$%Atxsjnhq7))QM?KzpZ_)DHTdX?Q$)U82p%|V&mdiGZO_1
z67jjT2*n;}924fcm=e##B9yjoc}xmx6-)D~wpY%_W|OU(u~wUDg}3A?$s+A7xjJiE
zWJP$QGQQv+#<=`dWx(Z>fw6O~!bHo9bugo*7AmYabbh|Rr}OiMW2XvmOQ0~|B#NUf
zPida$$kWX+omyE`c4pB%1igi0Is`Kd;@?oNb7eY*h(ZIvRG!wRCC$)pNfFlx4b6=-
zNehGS<R~`})40p-5yI91!UI@z8Y%d2&5ltxnS5!9(6KNzgoQ~EP#id+#Gc`Yt|yp7
zg}e8qX5DqIHL^{AOLEDQ<m+Ey@7$Dgs(0A3oRt*OMqK(N%H?Duviz8^(D&*YkU9V^
zKcC!yuJFn<jPG6}rgme@lku2NGx@6grTpeqoW$}qqx>t(ODy2ZBz^U-hGE;T`}*_A
z53nhHpQpwDMb!&%&R{x@hViSh4D)t_C`{rU1N+S@%b0#E{=Sj0k-cKcSiIK#+>D}J
zzAgs*-RF}ZmTYG#&3@jm{r$^a=pnr<$M#aqg8Ci)y=m?nt%?V!oTf69agJohDQrKY
za1c(5ev93x88FOlYeXuSbb=-lT;mx^DFgrmJ{BV|&GqhtK8<81QGPp(I316{?|q$&
zuK}V<A+&Ka9m{V;tbQv0F^d#vCcjN(3NYJsByR>NoAD9shbeTdE{L*h2L5jif5k&I
znT_*kIxa%}2Z+tG2rx0s(<q0op|8m-j<^CjGQ=d@#>NT%D#ZY{Q}DIxpyncYc@kwj
ziNk0(OZ80`#XD$DBByD3tK$SxG)<#KV|A+h1bFhZ*%-p_5!HbJ>UbEBlN&savK(p%
zsC`)N=fiQrz>Tka=Od^~r%3jusRTR&-M~3Gg$Qh|&qk9e<@v?;Ed2rgou31+F`2+A
zBZ>}Rou8u*Y8o4}r(QCyUUE^@psZS~#-7AkqzdQ4SdonL6cEKEEk~EnVuc|kD3xNy
zWi{bQL|HmhJMQYEsiVr@*v@rEItJNOAQj++GVMw-U<rrFfMXf>0VZ5XOijzju1{Ut
zH>C)Kcfd&a{KkNOuWO(vFzd%u(yt=9QTu@gy7jW;BMPfKPXQDMg{E0OC7Eam(O`5-
z{lHNi<<YVYqp>v9+DCZ`n}O;Gfm&SbC3>J$#L6iotNhnrQyS046jsnb&kzO0DbuOi
z1N65KzvxUC1<H*kupVGyvjMspMPsdxO{3zOVC#?&S_7X77<R;F>QU$<(b%U-5z6H-
z0m;5VAE(h*rDPVO)?DLBn9CSt(J-cCl-*{zoJ73bgX&!?noOjCSt%Duxqrc$*BmMJ
zK3HzKD2d0nwbMc`>2NlNwN|g#X_~OHoa_U>U$Ut5TYm}Dxg`*98aDH7*TU2^LQEKO
zG4&h|`&M9ZVz~izc%OXJ0OAFW#<z%0Cg4q~*464&q|V#=FL*^&*_dHUV|3YGHm}Ps
zCs7ROtge3yqL!Y{q4`bxdJ@H_aCw%~$@J{3ZiRl^rWN{aX)AO%M3-m+_Duw_5OS`O
z6&O71hw4Q7+z2=*^CO;ewdZ;7fZCw{R2$i!Z?ANaO|(4O#$J(Zqnc>ALP~wCTiVUp
zpcup7KK$~~Blz2gUm63@yZ1wnp*}M{pQzxbN=nfsVoli}s8v<SZVDP$<JvGyChGEH
zaTOPX7NkDai>3TD%jH!4+Tb1e8pYxg%!FhH#{MZC4$mOTv+ARrhSM0<A1{>rs2D9e
zmKm3)ZLt~{XNq6r!!L{1=+|CcQBTI=h1KgB7-z7wlT=|3^%T%;V!NIl-RC%prP4n-
z+^nwKGQca7psf5tnH)Fn+-szl?xMnYpbp2}s_P!|rEJ?~1lGfIY_=aq3%SaD{PXQ^
zJ3YsbDcJ5$<Vhfxa;FDL)YkSyp5j+JhR~K>-^i1bEVbM2@GR3=Ivqc?mr|YxJ3P;=
z1n}U=y`DQfk$yu@=!wd=w5!PJSM)?4rqpB(eHYN$)~=iK6MB$J8@yk^>JW|az`+Hs
zd$J2Q*?^1`?A5i>jpcf-#VIyJi(%r+00)L}aTr>Zy3})I&~u=+qZy$(+}%NxZuw3J
z4nq_pEELA>gd_KZL<~NksBL}&=g7T)5QFOf57=`PdKk?A32=PPnc7MSTlT(yAEdZ?
z4N1tdJNtaBl{Wh{x>u8(L;QwRZ%z5-!4YIU@Ns6_yBufi7AucH_ZT@Q1IyurW5+Xn
zOl;r5zVt2Z1l;jh;5n2ZG8=vupZwfWlR?Nj_-1R*+gyqXoMdY8*2(2t^`L{|Pvyn%
zVt}q>49=SY`bjy~bMS1xrO{Z5x@KGD>zk$tmszHw|8ttpRD#T+^Q)0ma*J4!=VKX5
z{#7}HWtt}UkyGLrI|{6t?=5{;7PBa4u7|nd8JPG?V9G-i8<xWjhf?V?=fLx%iV6+I
zp#^WeEos?W5uGB_DJHp{231FeEays?Q^+dXg6oLtA=P62RAdMe?FwJ*wp9Tw!wrdn
zLn;GITqDGR$9!z@Fkr528-XA8p3ple@oM9P8}%AbLj6ZAK|5*mb7I&N8QeFKL8)Y~
zQD7^JXD;>Ytk+^UYq3x2AnvX@2Ciw_B9Pc3A;ZM<B&IeOScHKu1SQ-x9w1ryK<dDh
z$8vE{E%3W6jmFxN;AM@yyL%ew;4Yb;gDtW>cP4p3XuHj9>0Y*$RYgtgdRi5yr&Zb7
z_1@E}^t3ATLZU5^w~9k%EAp70cJa{CLGNtsbyrmc^%&tkIBAH$BrrY9TrRLdm~BbJ
z5`>z^6iwcS3Q*y4Zd7t;g_ob7e^gQ4prcf{Ry%mSh7DF^o1Bj2Fv=qc7%kaU8rgLd
zJ%BT$GMIEqiVCf*1~ifRC;?D{=GBe)NKO_=7;i=qA0aKbDxE>{QJjpEAtXDfcx)Z|
z4VfTgnq_d$H62HyLBUuJ=#i;aYN;;9gX;;|vZ6vDToOnF`)(*O;f9ZCC<vA=w+w@s
zCimTEsEfbZgiqXzl1!o`jfN2<3S7%nL|o@~7K>)Ei_E@J$Xc<OCX#}88LlesSSqF<
zzl}wta%JmbR1xGFgIO8e4VS?zY;Pmfca~<t8WnuLn@ThOumW#bDEzndj>e_-;&ngk
zqAa&%&A&KIF5bd>d#iSX-}TF@x>EDjd@l7mbeM3bVD=6Z)_JlzxSba!Vz8=);^yfd
z)O-D}TIMddpGjyiO~xOSS;|{Y7T@pE=Gg#USszvQ+RrL^t=&lbySvwuY>Cq1_!k7F
zdQFSd7e(P|l*!37zdfD%_H2MYLn<$VY(!Ye;`7PE8(2s&cze}!5nYyW+5r6=WqB0y
zTu%agCG>Z5vjaQQTqmt(xKghO#$9Y0m&h0(<H8sql`wnS9>F;>4dcQ<FZCWXKxXOQ
zE@R5u*DotUQEM1_JTJbW%lR=vK>ORPrhiOb)oL8BDW?JHhepM8=qB4!1ebpYT1%<v
zyuH%bUGXkX;^!Lsehdb9Taum~wW)3N)TWO`$uzh}v0kzH9byeus~6Fu6j3;E4^bXX
z@&vcc?x#UtWcF}K?A8H1+f<Bk4No#NVAvE=VB-4%2fkp~XO<lXGB5(yJ7WA&S3Z0+
z^s;2!eLC=EIie?nU#bD^j9zjxG^J^USQr$lz*;sAOwYo;>06#>G26Bu0G>Z8^inOE
z$Hp$zAbR9-OXO0`T8~@yxaE4>vLPltYI)eGrPgnD!YnsqS3PFgW0pN;xpH+pv$&xi
zv#ef7k6AuH5$!R{dTM&ivXeL-L8RrLK%FhJid}AaBn&VOLyCz>ZR{Hs#g6R|(+&ug
zo_)l4C2)K_9$cAC>E!7^l`xto15?6ac19^fBebYs0k#PZF%hAG14Fvl@I7j|4wEA6
zV=T8rDPf^JHb@C$=rPJIF-n-U9-{0a%JmRsEhRlddDsZ0(r9{sa*1xx2UXT{(Fawo
z(MJ2k#z#kg`k>0Sv(<~}<BMnyQ0`G4pNC85`2v)4a87r8Qu>}J0v=$S2^$mJ^>Gk*
z5(mTyO+O5I=!6H(A7>hK`n{@Qs*%fixU#kn+N5&7L|NWolr!eb&Lv?9KQ>FCwn58m
zNg>oGepz9KQOuJxl{_Ec&ZC*Ch+P?kxqwraqY0s`myF^5Cg>xc5>K6;KwJ)aI{?!5
zT;DJa6MK>{Oc>`lke<W_=fV<!NqqnCSqxUoCJ55|5=AVE>=tmt3NA!C9(RS-3pv&h
zWR%u$rQQ}R)Usgh1gRV}0)qhqDJsY%*D_5bp>RxSa|NzmlpC(=*&)bVTmf7@85w4`
zxSWaYWY_ls>6=tw!=NrE)HE>T%*BrDdx2@&j0HW{;yhW{x*b<b5y(s}(+it#wfAQC
zL?!klNz@1JJn2p??LYB+6J=t%#|D*{0pF?%|6Ga%wvP1|UoP7XRb|I27PCM54Ctc<
z>-5`xcA3wlPb&qJv-4ykbTXmeqRDLXHr0iue~yMx4sX-!?bb&&1hz>AB$iKz-~lEC
zDEobnVd_wUZBv?|%LpUB_YAY8mh-NH2~cQEo%E#YtX8GwbwI)@TcA+kVM3mhdi4}*
z)S$T{HFb#=_2=Cc!ohDcze&=sWpsq-(8$Gm1}fV-adtMCcaV1)Lsv?rD`k1UFAUF}
zn{GE#HrxKRv+S(ypx~3*8@JOs9lJI5g_kf`CcRr|;<|ZMwhy{^yTg{}zUcJDm&=85
zwCINsjN-+Y%VmS>wfl9aNUz=Z+Wm3)H+${=;0THv5a~8ry)79N#IUg8$`BKWdYBO@
zF?RynXMxWgVyxHdSAV&(7U$|20rg!(Aj5S0dz3{i8b|r<dT~CPmc({dEpp1%J^l$#
zCR3V5g%cpk{_>9*9e+yJ-g8aIGu61cdOp@X*OE7;;*VGNsaIt;^hYJz{+Og<qs*=u
zVwpo>nGSPo%uV0K#0_jrO%f`r&j>=-32lGH1gvU%<-jZ7j<r@GHrsPeOYXNMmn=!X
zsv3Hm?70*55=w4EDWZ*Q=OoJIWFxlrm`<(l)iWR^K9`?QZeU+|Wg5nJuMtxsf_X9?
z(`hDOmA{nVyo!@pzGjqvg?WhuT$!Y={?#yS+jU=mK2h$j?{n?;`aTy`FF-Ph={Oq3
zuf{UW+YO>HiE|98<F71Z`mOl;Mn=O?{)#1I@mlwDGm3Kgx)|_xpHF_6^UA3*cTfbQ
z>7P?0d6^46q?hH`UaDEB+;hrI&q|Mdnp{UhIe#-41N@RF+F&m|!?j1SDzMjd3Ko@A
zbou~Tq_a$>&<^@F;%Sm4VUB*5p~lR?1^zw^BQBBcIwg1UsPaOqq=bg^nU*#_yY0{%
zo9V2EF$I*M=@S1fDIJ#VRuAw(PhYEQUn&t#qdejOHApGo^`i+C35ug^Qe-%c<ai46
zH%p`Z7Uhyo8m>j~J&tb?9S&0{6L{TBrbuUFnGH}X!zh+@3(9L5!8c%HrBckeR6|5z
z8mT)k(0@R##e6Oj&1Hr-jgd?fQQVTJvn*E)jU@%{=DMGd=FxB_2PjL>B#EOu(Md%k
znZfkuX~e-F4xUm*$G~g~(oqinCdx<fx0vxfx{mVO3vl_uzw>jb_%fNm8xcqYo3GB#
z^_cZ@z`$`e@M}Pm!D}`gN(gU&Im3+^s}r6uO67GVZ<K`4Fq9l#r$+8{kwq&04iBt7
zzZZA)&^C@HHE>+56Y#alw4)|rh`<(}l$g4v#KdMEW`YZBdKMF2K!xEL2OK6ax9y-$
zP_}zTA;jWcpH5|p{_C$Pjb~#D()iD_CAAKlYcWidNxhpuzEL(4LdGbYMqeR!=oUq>
zh`@V~D2nCH+(JW~&QzJs8`$2aDXfNuL!T=L)Bv2gV`xA~K8|9w9^h$e;fy9~i;Rbj
z_9^GHl=9mP^lNh+MMVYkViC=45vk0kNi5JmW)c57hJtO47NabiL7<Kd6TKhaLdTTn
zS`J(5?(TsIi(+1mdn?W`JM^g}4mL>OV-ivyvp|^Gc4T0=fo-{V(4*jufC51yI2!8W
zjrHcZO#ybOK`=}y@V2*B)a&xgNfZO8_39D@s0r3hqWBap&vH7Mo}JaL&~MwcLcc9-
zg${@45<#3<8iC(eE~%EVzStz}HiuY3ejZod48YGnX&2ai9(w&r$yP;W4>DA}7IcYN
z^JPQcCyk4jl>!5L<65=<!sUfD6&J&{r9RctQGS}`a;kpS<N13M#pr7ki%ZaelNo4Z
zr*t?xLvUP_eYC;c#<2c)p^lg(sZ>0nW0`Szs-AOzjJZ6ndi*rwebmKDT$ZMi-e&>#
zOhQ22FO<n~<IcUtVCXJNoMVZ=bdJYR7MC*k$1|zoBlZ>b{j`I)OBJ`FbtyfdYd|6K
z4BHAF?6}m&#Pv-axUPc(8JHgTcwjq+TmoE6)Y@3skDUtD*QLE-!f|DlE{lI{y^MBN
zew5A^pRX#|Ps<ASysTh9SGm5SMt}=7949x0v6&^~SqTIv1MIQmTnnMxu`IpEgkf8r
zk3G*On1n3E)G;g^IE+{_Fih8w2cA{{a+#s4x_s@9xdcvu)7*@b8Yw9PHJ0QMY?Cpd
zA)9P5QJ_o^C_5~S_-O*O5z#S-tG2=*-$46zwS_-{yJ9KDQxQ-IA<`4LrG!e01rRZ0
zTaLgabOY=Qm*J3x!gW2D8g^f^d2Px2t*j=siR@P8enA~yQo<SSUc<RVZDn1-x&Hf|
zxa@G(9SS+$t0~kMxqrSz?&nYSEegkmULXvgVOvs;2_#=pJG8J(3AI^B9D_f=iGCol
zmgV8D52kx5ao_KXkGU%rhY!4jcN-2Lea$>R)C_a0@>4WUq*0d_U+M?bO%%f|lty)7
z8<v5<yq+)nsAJ%sbAdn8eS+1ho(Wm@5il#<(YoA%Qh|Gp;Rqkw)H5()LSh>D4rVlT
zsKJTkHaQ}%^Bn9^)}7sk^i|<;cjS64%8IR_dsVEh(LZK#8I5K+?0?K?N<qh$D9UtP
z98Ti#Ei@-&NN3|*1#W0Bvx;g`Ur&?i45D2C$B{9jNK0R{y#hxW%RDO-Llsh?@jrOP
zGU5IvE}y0zeTFcKav0MLj<xYEQuUV~olmw{CuLE$-BRM+z-Ff5S=bRmU=j!eQzLY+
z#TX^r@;xb@V@kYQX&Z}PX}lVut;+1IHV9Zq_Mr2Ei1O8}vh^+75X%-rSYqOAW8pmQ
zD)aMMQSG~`{HFmJ8qqY8abA9gF3}sVX1e@j&j~@w3#@X&3cE6i7lylJT+LCayMK<-
zLUL65?_vf4ne)7-nu0S!BbqJNl%HH<`E3f<f2t&@^&;n+IlCx#<~&iM7fE=kXSHR$
zMOmEWx*~nm@E*#{>%=#xRNg2wUv;oMb!pXva;8^*-2-oF?|VOLd$6zh-kXF+Se)jV
z=t-?!M0?cYk<GDf((g<|QpaHe2ev0Mafrao<s8#Ma2|@#CZ>11@Wu88w)X*Ebf~Mn
z7QHy`(%OYk>mp1$A`C*9gffPqiZ&*eXJS7PKK8jGxL~0O<O9UW9Vx<4RM>tze4(zc
z-J=W73SDSbe%=9F(7Sz)EZi@$&{t+&F+V-B@MN9McF(DJlx1&wWMS=W_3;qTCLUrR
zMp*Zt2*)!>K&ilznI0z6bujfQ!ORhc!wknTxj0@_Ve2xu`v4U-RKI<AK;cOgz%7&Q
zpkT^wSb{^mfLRh?F)P5tlpYRz$HP1@&A?<v!2Ld2VOK0c*TH=}D50u>+an3j3Q1@d
zXx#xwP#b)YBlI}JUQ>qp2!(?WTJLd$9!FR$s(pmQ{Jive70&}lXxU%gVFcn(%d{+s
z4NFnM0;PoE3QP@RxKdb#aL7@XtK7hXa!=JNb(+FnC?_7iHsx-DdFR@cmgkrurv%%S
zJD4~jr2n`M_PKAGhUo{E`z(nimP%q5`5S1?Qy|JJ?t76HY!s0;?Mik_Fxf!rvk?T0
zCn03aG<$e^g-)r43xKp$$t_UZ>Q)PcVjdKTRv=svu=|wsdTKa7-s%;LE?ZV?H`}xs
zsQw9BE52%T$jt|&zdmNDqFs2Veb4@@6fQ5JvLa_-RoTL&gnKRFP}F<>2H(y-0}SEc
zQs92Rn19Qy*?)U=#erEcio(+<i)Z8UX;WU#fU>78K$plEAmhRqAjP14+J2^UWE#eW
zfnK)m8X)WJY`y@@<`jpyij3%TZkD=cIH;kZVk~XO!S*PPvxO$ncSW05JntT)usKXv
zG1|Y0>G(E}cvdJ|oA1h_iBy94Er&OHRaOR2RRN-j{P0M8Bt5v$g9}UKr1t<nevm?I
z_dCR-2h;D99uB%@(S1ty++n?we3OTUgtvf$CsDk`3e>Ou<Q1}vBc@5|SyGM~&AVeA
zU+xCXv|NFM&~h*#)W9ro1$GTn_yKiXJ2a04)l&s|wnFpfsEk!x1xazyq6RK1Xzm8A
z;H{Cp0ukI6*DJ?xIJn-nfF84hz;&s>79$2GCLx$gJH*_h++{(?0*^mmK(8%{+v0ip
zzHWG48_Ao8-U{U5zM(fjkid+8BLuK?A2t5=j44gFfB~1v#bz{6-=@&OH7y(v=2whc
zVQ)*HsK@?#>~DtyuyMfk)F*vl(Nkc<?6JQd`#aux<vsS-V}A|d?6JQ-Bd{y5vJL2G
zcphc0X<)~f0uy1`*!NwI1q%by;xe>^cLbo{Oqrg0Mg7VqA1-(g%1T3RGUa}W)x)$v
zz5+aaQdnO(OWT2c)M0@gND~`Svy4b-V(L;G8)is7*A8g-Jj+7uEPw^tH%e~MgvPf>
zlnf(j3C=XyQJCN<EqkcHV7L12qNF_p?XfgjR!X`QQXQMuLvzm+nyXoTtF9Wvz6;%J
zC{K&s4iK2WQDa~F_pP~n>tVLocIuD&Shk~%Wh><75W{`EEy!}7mI?a&s_66yiN}c>
zE;&aIaVzN~2M-)QeBLoorDe1Y5aOA_;Z|Va&=CeEfz2`VEfX`xCXQgzvrX&pfsl7`
zo>Kfi9qu&_DvH6@qw}FqMJ&^9fl!eeX_5|i$4jbV0dO*l=S<TKaXM4g;}@*gr-GoU
zIY`psjv-T~u>FuYJ{F;nkf!TnDm;Ou^j*uBz9Xggd{LA=32lL_l#x@V&^}D;RMFe=
z=&3xVu+aPPsb?2HRf)yH1W;*NZAMU)(z|5{mA>tX#ZVRRV`&CuIp98pvQMGx;gHQg
zeNo{9f<xvuz#a-Y*zDfJg+ls3sy>jaA)I|6RSzI;g}H14A~M$v0_ug>4?K#AVY-+~
zi(}!NZfMhh1QuJ5xUBy2%c`$d?{EOEhzRyzI{rP%A{LFK{C53Oa562aQGP4t<`ZS>
z9{+?VlPOK30&I-3zx-oH$Dfk5_gvHQOf_yACp$dX;%id`>#Mue2U<6$vtpR}F-gTn
z<a^Bs3l=geY}+&?mVw1Ep(Mae2m^bb6B@q5iQ}(A;8wN0a^RaG<Zeh?4I87k(O8yc
z!)was44r-iIO{5j;(UNUNjk|C*zrD=Kc~^PF8K`qFvjJtpGJ{dN?>hYM?#^w8PF`j
zFL?sB5+fcZvkds{8=T`AqC8Eq4E-9x|C2CBJQ<HEOVR?(9n&0~U>VA0e5A<38-pu{
zG*AOnLshUF{QKkk=?~wtA3oAhqBnU?`Dmh07$Evv-9|kQ)!O$j*$>~poc{3Tbd=}Q
z?A6PcV@cEaVp3jq!IQ~L8RJ>@QpiweXD4A8afxl$d6`jQrmK6$VUpr(n&3o)4Cl}V
zrYxD|XN@8MIE%(Pj$(8jrLzpCv}9<H;?~gX-_c(tObQ{zJwFeP^9YxPFYAG=ek^oy
zl>1t6r)@17%LyHWJBu=fRHczp<M*_|O=vn)^cW|mG5xmofu>X_k3)Iw&RZduA*bB;
zacFxsCLZxIGbF{*a}6VOZ7Iaww?g}_TjBQZhNh#TURpmFD@E-s@6~ESw(CH3j+s;+
z!YfzKxW<xwSuIt-H(|}ZD*O!k>S>yAnPsr1tH90?6^NFVXX|ZLul4FG<=x0Qjbkaa
z{~}K6i=mpsRHk?;(<l+>QwrE^CQ~TZ5K1Wu-yiJL*_5VV$5AXRXT~t4Koa<0e@$sT
z8`Ct(Z~yta{F2cOvYz2w`L*2e3;6t9946Iu3YP|edKN>5cKSI!Rkt>=?4MMri5kPM
zQ0AW~eEhipAE2)cU6oUXPCs6~fBF9BA782oJ^OqzK<`t)`pvUJvm=eKM_HWYax%?t
zPd_O)Bf$9C*>(fbLr~M)K1`*kySJ8izn{K87Oxtk-;(+uuRFKTs;SSlUv<gU?>4>L
z&FVHYx5b2QH7Sj`0Lce2EGFguM-%#0;$kW2by3f~kRhFop$7xpA;2n_<#aMdSuUq~
zU9ejigKA%k_&NuR>RfqNexgM*Y?h=sGy-pp&igNvEDYdDln3(?ZX4)PuHCUZ)Q7w~
zed5l<iA%yv;q9%x1+M5CV0w~A`B*<&7a#OOz?YuwjrL(PxN9vAwjQrK0Rh>0uu4L<
z8>-dq>Ma7$Ix}-MVJik|)g41JwncunKwGy%S$9HLcSlt>#bw<=8Z!x+I8ASN7Rim<
z(}GA^=HZCsU8Z&(gxGMo-o#JnEKk;q>Yuw9TU&%OEiqw!{rP>N=Wf`z3q!#twsd?N
zVAr+?CNwZGbsY<{kQojMq!$Q&a-^o=zM&v%j|R|hNiJEEeElmRZ5z!Xg~yf0y%f<#
z6!j#^<z!=a$76<3ey^SZsm=TH^T`b?h*zdzeD@kLwNSA_rly&ERsK?b^D0ha`I=Gw
z73L)taAlId`d7oSZP$JM`9uX+exK_=%kOhh^#U3frsHTBzk;K`-5?5+ILEN`Us=ZV
zTk-de1YGSEOUB~0?&oF{<??kg;O{=4{IDF@YvX!LpfiO*eg85SdYCWE@xD|u^Fs^k
z%ZfH9NgU-#nl0L-%G}kKY?db}gvHH6ePAQ6fcq}cX7d^b&PuGTVOYP9!DK~%RcQnb
zLatDr3}rr&DO8XH+qf9pY&uS;fSR1iMraZJP5BIR8Utve8o*$mi0bL9;M0+cRV@&*
z=0jdfHJofpITY-SMIF#OO+aWP6|=}^U|ORz%D$?JR1t;(6@q;MLA&tp{QQH2@K=~0
zm|&R1SLXn9K#RZU=xvfhIHH6yjvx%lO$^SCBt==2%WQz6_*!OpG=x~(X_93T$Uf|Q
zX)=j29ofi}IE>N>>I|XQQw7<hG6t~`7k5_d7S5bf_#j?ZrX8I(wr7WuNC$^JfCz9N
z;=pDUbDx=pAww>mLr#TXvF4Qm)(-Jj>sOmyC{HQ>ssW!Or1f+v(>A<w21P#BE$?Do
z)A4w2ZG)i0>dG$A$7%FcBVcvCQ4rT_kn#zIXl?=F*%IY69ZD5N3ljHL39Xz+fHa5I
zFgTq|X*2}?K^Q`F@o;XDHFlB@atO~-?p1KDUY^y;o5eFV9o6zx#Z7^1GXm71S}Xer
z9$$h3E39F=@Ne5NiR1VV_JhF3gxC}_S8{B)mN0FXyO#MJE95HaR(}^V9%Zs*zSQD6
zPC(9tifLWHiM5cahU6#LaEwF~SwVHGUNaQar8z}{M&sLVh$$UH1UF<vq!FMX@^lq=
zIv?vh4-K;01|)TfSQMXDe-G3k&NT9s0+!RbHcS(!s+w^+rs*jRsM*b=+0NOSD!;n&
zTKcVZZ3T?2fx+ky!h#!cS{w9gJi;F@6t4H;%ViZ~TR>vQSsOm9pN(d`gY-Pt;v_T$
zDhQf(Dd4gV=C;hlRrwVgp^Prc<#amQav;T4W$dAQHC@}zgTj-4p-he&ckVUIU3XEM
zw`!eq4#reAM2UE)9O#FPAOax)@?EtFmrLrdkk@@?Z&hb@qi%X9kZTJM?$&<XExoxN
zr%CG>!Vb8k0mGg{eN4C&U=|97EolhmJB|!|dcb;fdAz@+lW2U4)b5@|8N#c~POU^=
zm2ob>kt69>k=(?a^yJbb%WgXux2FqMmymf9tIhkYRJk`Ate?P>t8k66Dp#qvf66h2
z`jHz6ZuO`KHHVNI{Gd>@rO^75j@^j`IObv~0eC|*G^SaOGAZMMQm{cOYL=#qVjAaV
zK4+Ob7o{khrV{+x`k7V%0*{-tSuOiw(g60{PG2X|whiC2ap>6=Cc^eG^_YPLm%{Lw
zVFqk<u-voI*DFmj)7I>gwX}z&qvFx1ihwBIrCK1bc3T3cHM~-yD`)k(0F$6xWzF@W
zjDz)>zIJ$5xr~)X|EtVL2{?}7MX4enpHJ$?n`66wuf}zWqEKbzm0o%1S$*}lX?!+7
z%|8by%TrGC)6XX#qg=j15JgapBAbq*{Pb-y7Ban}`DlPXpS=8ha`p%La#m*K)%HMB
zV=w5U8dOZ>cLiD0$NzX^Ij*|oO*zfKl+#>arpBqR`UNKQqm=QBFPCl0L)idomjR6^
zYa0jEpq8cx>e~?9_u|WCqmhRFvFs^U4SQ~&y)klUcB#D>B3(4o?E(juyFWkBn<x&G
z-vNb&rQJ;_?;cIiJqKpH$b#ihqgLRbyF7!n%{^PQ-89{{8yuwDCJybGPqK9;*DiTn
zWyrwCXc#MQi#V^M2D*}GtqDA^9yZ_PpN|X<blMV<>G5m`TmnPJqiqTO@;kcaw+lG-
z?aj9++jV7}aL~`>dvNQjxCIa_XD=Jc)1|Q74&6HzMn%)!3}}@<J%>O~H@A1NXRA`1
zcF35?1I(oBVPdlY2h_H(7c$Frs87O>A0=ek2*P>u`|dz#H*^yS-i9M()C114EE1>=
z0XlsX1M{5jQ^vz6mS;~19-XH0nvUhx_^6Dpqcn*X%=N?|(vMf~@tfbbjcTw>>f5e~
zUFn;cxTb@dZBrb0k}+G_rem!Ru-yEJ&juykZABa-IJ)?lJxJPvq{j`CJ`GE39|0G=
zCDvPFPm?mM>%Bek_x^Rttw?(q7o3X#ODPy8o=Y(`q=$XSAffMhhV>8{<-HqY4gMB(
zTe%?Dkb7&-#tKtR<@e}Nm24_GxEGpQq)H+Hm97e!t(3k6n(muX1U2Z@9V2=zRp+B<
zIFeaj2AwBi(K+N{6!s4|^{ZI$R8FLbw8;YsWR)N>qN$K^6c6`r{5ZSFDZ9nxRCKm{
z4mC22JFe>sS7MJF5)&?M95_aRISp(fs4YV(j&5bWnNG*ivc>hWw#$|*s0}nnbUIZ@
zIea`*sYM$DyOu68T8}M5@*5C*$e8c8;;I!kku;m7GJ84;tnrvfzs3wtx`fjJ8-!Yz
z5N2U&5CV*29^;-ZLz6vkJVYaR8lPB}s}UBU;^uUZ0ye4k?^8Im;FO!nG=q#|$PXHw
zmFNS&7l3c1G6R6K18h-5W&QC2LaWfr>XcT@;cJ4dUc7vvLaY`8tm?g~U>~oNL6&qf
z9|+aD8KR;3@T8+IepkQm-hH^{r*|LrM(f^ffo>M-p=v2Mm$sy?gDDXqCXNwe-!nP(
z1IHCk;F~^u=3bkHT-0@{O7{%arTM3Y9<#>QsMP1vGDTZga_*XZ+R!upchNvwxzKT8
zTPhXyb4$RSMpEZrK0Ui?8XfO$Wf(RMxi7In3>y<l0~{DW!PMrKB(`Ij?jdKiK>;-7
z8CJOx8TyZ8tT2UQ$I)oTFWPDv$+9*d*#0Bg*l#q&qXO;*+F?tzy)&X2@QDIp!*wKp
zHbHrK&x#6bOQ=p8TNhM-(z*3uLp93$6_`m`Z*5d;G6g=_Adg<>daej3G)PD%(=ixo
zDyIWPz5-6BQ9M;hCUit~88CfQd#|j0*^?y8>yFrMV^qb9T8UUbmADKjo>>sVY!{Tl
zt<V=XbFe{)#DsYq2g0(kFWu0fCbPIrp5yVJOk3<a+pi(TZr@rxjeE;AQ#7L2)%s;K
zzc4nhht8nIW2cf;11wXnYPe(YIc~n9#q2DEF40_?+59b~8l$dOKS0azRsNaD{IvXX
zfb7LPKk8Z4xnf0U<(+><;b|+0Y=IhAeSS7T&SJxjys^fRnu%`p9SYA;6aV7NrTTwa
z9M4k4@s`ZrUcnxfETv0Atv!5B4p&*bPXwr0hk5XnAfq{{IRM;9@pkqx=W1H|;$ZiQ
zrnU~5eq}sIIQ4ML=54-cWkITrZT$022Ff-OKDH|Y>iRYg!a!g`Jp=m$0)Dvdm=3W*
z-`c?J_}t2J?Wugt)2zzn7{2d9z?bi_5EJSX%!F@X;e~_{Vlq2?%2m0pk}StR%W-rK
zxbeT!$@De)Uo)CQ<bEvCyP~evToJCS02c>xLa266b2OsUsRTC5q>Ax4Kc^uO?}?&=
z^Yd5eKV_QWQ8G)>n^~Tqt64gf==49|T%EPzu3AXUL{~5e)=x-I0sc+|#mZUoO(8O|
zK>w%*J)tojN=Q;cSPv~y6uDx6QaP4Dp{ws<5XzEFF3_int#>4E5eSDWZzDC^=d~OI
zU2c}+@;Sf@KTYCH)}jC9BNtqrl#f)b3-Ece<lAam+Jj!%rg@j84O3dp=rNV23T)dm
zUCY2CaD7Yy--Akh0=qn5fpn;0lT`>-PtRWc^z`g|p=XC39#uR1RbAdM2}21i-|QCs
z=bNh?*w|N8U))HU^&*?wO&c`_Ih|6q(Lqt9e3T~tkG(frZW~M21z%+q_sNpz;*u~A
z&Q!*6+370pZKqwbv#Pr+hhqU)ps)=BEC7_O+EFL^4f>+*`szGJU-zS&7wA{$_}74e
z1WACTYz<I`BPC!>_}BE0-@lk%@+;%dZCAz#3>}Vlg8VEhBEJr29#T>)nC}z;t0Y_w
zi*%94Hx-V&7y=Cth5LkSE&<hLMp$Dp9QCvGiq`HR)*Kj9V*t{XUXf9$A?0@#3-`>a
zFvW6+b`F5ehFo4P3C;6Kb)SGfO5AAm+fYJ9Z-rw2b2PnNqAqkN{4i&f)UGP{26j`i
z*ig8pXpTG@rWr*ZWgyo)<`tuiUPbg8;zp}>xgH6M!DuUhN+3((-y95yed(Im369;<
zG)m1-#Y78ya2as1s}UWmf#;JzCl;mm8IB#MxXH;qli5{Q0oIosi7(UZyk-GggUBwn
z2V48hDj-)U4VIQ0948z0E4PU8jQ~7W8Wt=%vs#j+r?A)r=@tCW_{eg#GE+v$0e)9!
z;icvIPcp}RJ9f8w-B;5#2~|RDJ;Z@)YS?fz8+$$g5x6!{T}8E=dmZcoyGrgO@1~yS
z;AT#@@2tNHoj&cby_ThmTKtI^z?^2Fu@?9B+6^{AUY35L31Y|x-c21in2q}VoXp_M
zCg|N|lwa~+rF+oo7Uiz~!iWccLerGxD}>U_NF74n0-6;3rj$oQQ|!A-`_sF@B}p(N
z$wS|z4)t`$_f%|9Ex?9u66~lR#niG?-}M|f3?HREz1>}oxwS#?ADPXhOGy3l<2i9*
zQI*SE>`|WE;Gd;>1K3D3hpoA5c7|V|U%1!hwf@T$1DLJD67U0xok(EjzZd~8FK}5O
zb^eCGgE}fejE2&HKV)+F)|njcMGAw)Qn>@E3~t*Nax2X41J6qkSV|b!aEYo0Hay+I
zB+xXhyP-;Ts)wfe4ZJuX^CdcIxSxABXb$}ABnN&r1z~W>!(BAk>FS+D3EUk#E{<PU
z>@X1b?S?C^YJz<2+(h%{>(2o6zyCj8j3ncKF%k&rQFy#m`AC*I0?hM^Q7Iv8s#6vc
zm1?rYrfRifNBi<4P+Ux*C=8qjd&*};K0Ppxu}oCKUNoOilvZL^W$Q0w;T0lQ#hb4t
zLprM6m>5Xf`JKZdwo0ZC`${!cH8h9;jufVa4Tl7nScZW;TeCHdgpL;6cb)8cO_9Si
zNZ`cPg62?9k_p!5TpaGuhOj=Aws3Ke1`DQouRH#874Xu93c!^K%E75x-oPmeB4+zZ
ziYnybY2EC99OWsf@dIYLA;Bz4gb83g0b3G_IRK6!N5{<46R>CF3HtX%@`W?fC}iH&
z6S$lqSuync3XBZs7#d}n5r74VSOQHy%`y?0HeSwrTQEb)QnFhBuv|a}PoU8}jUyl8
zz>+YUE_gHrx8=};!AZ2lPed$X?wn@v4XQpDt`ioca=^@+ZTq}j2oGNU6!^C1dX|rM
zEA+5ID1<&y2Zy1m2E=ky-~9&L{2p=6y?N%zhQy#UJTr^{QKAeGCSWnmXugP9KRhn!
zk+I7))Xr9(xjGL^CRVm9Q7$+uTNPw1@KNJ{l=+C(*5;*;#M!x}Fcg8J>>%AzmX*1$
zymf>4g88kUaW=Vy(2`AFe#I&X`ie5}7keyeDW0=G2e$fqv(?=$&xg$+`<`d(HVv`r
z+Ykw<Q%pk5!o)Q7kXou?`&;a*kImKipbm+5)8UvJx<!3TvEw)vHdNci#IzmkQiB*8
zwN1~ZgLC0FgTdfjco65pn#}m7^124WtL{0zt6w1;1sT1hNe&`n)61~t?+rp67y0U-
zhQigmlp7~C)$oiXw{t(cCFcfymz|(jg^)B$f5L)AMlVX)l>3&0fWgpI>OM@|eXbfK
zcV-f9hxM_`Q3CgU#X3oAX&O=xNg@(2Ny`ijwH%fZej6TzTm1xIC0B5bPC<eOu*PyA
z83E{2%st@&bphzo)_)e|Uv9V~mZ+QmDE$O$AIL_>JVux|mzWcp&7vG+sQh4Vg0(((
zbQ1Ip$I@Ke#+GF(*sxU#JF4Ph&D4l)sex_S&OKI0)%NPSn1>I*KCM?p1$6{p$kNad
z2RZXq6H{ey1s5D@^Woia9a5AR83DiB6ZD2}1un2g;9Xl}kuP>!wE?8gCrZ`?c)+Tv
zwh36KrS42@3ljY2A}@Gi-Wj<;9z_YIuo;RJWi(j$6fKg3`rzK1-PF1{qzb69I0c<B
zr(ZvC49C<gVp0YB7BR44P#t@ULa<3y-PCO(G@W&~|KrrAtg}O|Tda>n0g^@2Db0k*
z@EL4Q{^DZ9wiN$kS-l~Nc67V$Mc>PuceHv!4vs^I1hsf@jzcXA=JB}?^?`?Ky9Xb*
z5=XZ*Gf+bnhq^(q;d>z_wi9CNY1A|o%OipDu(-;1G=p@%WJ;T?<#Q7I3$U}545cUr
z*K%D}S_wAE7e4T3;erQbiJO~iiZ~|+4RWZ<dP6d13xcthnM{E+4_Ue-Gs#e`YD<&_
zgXKBR`G6Y|R&&gym~(hncVoZZh39_p;BAalC$6bzK6Vvd!G@)&*wYLLo2DOxmK!=M
zp$}`1m1!_n0#llM?q!<sJd?FJ5b9qhX`D`PCS3O79tW_(bHIaxl^qrN<{imnAJ<BJ
z$8wxMptGvfX}!(y33|4wdSGaCV4URRWf*s)kdhmq4Pb^x2ZCcvrx9e^D}Y6g03w0_
z2wchn7n2|gSbKn|&qYB{S}XvPZoyKxuzZ~7)nNiGY()wYG3n9E2;2yOgfPCt?{90*
z{atq(dhi?FwXM*1l@NQOVPQjugq?~>u|Z8m^>o{FtO5GDF8($z*=>rNbWyqk@XNF&
zH?JNCQVy+-r_YiLUJ+}%2&L%k3|-WDYB5e}ns1fwnnE*gZp9wH)bPcKiG;t>0w62j
za3<kZum*R!61b}tg3oVA6o+woy<ULtI+l&y&a)^f;Fono&M1kGTV9SQ&00$%UaD5T
z<@H1>pDR`logw1o$62~ag5%@k4IQ6uYJL1fRh02W8;|cq`VWC4iS98{WL}Ui@^lgP
zJMblW1VU?9?6PIty48i$O+ap7I;vWqI=vws>wu164(ld}cN@}fFmolyTvuhn4hVC*
z=9oMb;#(I2uA0p|RZ6qsc@{CX=*x)4!R`xD9zi3BLm3?)!z}F9p4*T)H|+ZztdVEa
zX-22z$?+?!^)8i}s;b|pE2(G%cG3JYjf0N5vC%9IIP_bZQSiaot{f5-FDWTzWd5$&
z&eM$2<eYYGpc?9*GRAOr(j9iz9<q%JwrZ~U`>6+VY&o*ON>>-NN9~NxGn&J4k#o-o
z({;yBZj%Z>e@7~0H0Z2(?RfHiI?%}%`DxOB%dM>6Lk*{XkM$l_uiLEuUAEgzcBm_=
zAkz=@Yte2FK)W2%FVm!WFF$EUr)1P)9PgNq24CJ@S`_JQ`?YoV6qa3>+Iy?Sunel2
zwokDZS_B)K9%9$0CI(*>$Fo914a`Sq!+*yRV^+14PY<e^WLO-hr`z?DJi!XI+BPVr
zY~<R@J++p{YrVY2CqlIgNOjCM5z=c0Qc4n}Ds5B%8qu%d0tZQTxmkn_5Y)VI@8uHK
z4xr$oWEw7FMv<E8qOO?fs=W|tJKnr_`?;dl8Jd$Ur=LNUeOxN3-*Df%aiikPC<Faa
zRWphp@dwXc(P(uHsXLy>lq8J=A0C;0{z7l^rNSSTPve%J-Y-1i?sp^lS{lIb&Z=Ix
z87Rxh&F7dV)8ew($H!*XPh<2mQp#*3&6hCtrOYH7+hW6qO24KxE&s6(0~=qA#`URM
z`LJ4ii%iBe0v-6Kf-Dw!doc)a-l&y>SFpb~=>Fh!AN?OMU*?=?Q{M3+VxpyH|7A?T
zP3B^BLvz_uC-q-Ve^q64S*|pmR3-#jC<<4KO_qjJj)(cmER(uEt@Tm-d<NSdmSfrH
z&q!%3Z}H+B_WT**+Pbpv6QnB2iGoh+txk|OZu-R3a`iHc($S~0<q<Z$Wh#`Nvqr-o
zk7U<JpU&j3wa4g(>N$*<4}*#OJdI4P+>qVx;in8<T~RwFx=?OE1q^3-pR?gJ##fM(
zF^c+jPEr00=_>AGx{Apyu5oz`-h&h_Qads^$hL5YU2(sYxO{_MfqvL&TNvMZTlClx
zGp29odL{8mA3a5y@_={UH_x2(UG~fNLZ2pm)AfC0Ro+2;lOA%CXO~!krg}EEO+y2a
z6B9e39%4^*4BPNbjcCd}c0iPvV;tD0CZS6=#N`;WdgcQ!qvQ+6qi*=-iZ+GjisO_-
z8OrC>kHW}b4c9!`o>~IY**s2fax`1SMFg2rS8)NE5-<A4f+eny(V{F*Za|Ba0}D*}
zgN)7>+**W)_);D-D*ZM@5`=sivWUZGuY5r(Y<9t8acCeMli|#pfdT?3h2{7gag=3%
z9Gy{E{?qa^3t$y|9{&mcjey61SS*F`ZCn$^mm>nCg$zq^3(d-a+3QQ73v&<yfwPL$
zB?;4WLUqv5WRbU!d7P?dAUqFZK5r?oPL8`@NS*11j-gsACW@+H!|*jssILMJ84X;=
z_k%EegzETC07XlixJ->w+vpWK5e=G{M9a(T{)gVRDbSm0ZxL}<DP&<gch$1bt}y*N
z=QRpO@Xadr6M1e!fW*z5rr|NyIyV%@wJg!1*>Q*XK2db?Jp%oNt`jt_DynOsqXg21
z3#jo@RV<0stjKi00cs5e6gB#U6)sg;-{_=9&CPh^a@-{M>trUme<yq=9~Z9Y&QWgV
z&HSLF+=yuqCm<nKJgQ;CS12Y<U}GZ;6{<M48wT2NiPkRB761CaSLudJ^z`)jFVB#s
zXcks%tQzCm%>hi>%B@sh6vs2r$VeE$Jn~{@vM!m(F&LFuFiai;%gr;dfjJW8Q8ER7
zo3)5wD*$3kK?#G1AjpG!G7OXL-`~Iel^awynV#9>7m+{(<yRtLvn`UKyf$0zRtYS9
zwByYxDRJPNRg_=3S!*|{<Ov#g0DJ$L8NW6d=}NbRqfcj|nMu7wi9+~!xH%rQ1+AL#
zM`vHq760<iX*$1slK4T@`MvnNPC4Z7D}U#iff6X1hW*e`v0+ma6RKF)4>i@cJj1rl
z`;3jn{GNc-Ii!YjE*rgN6=&Jc79D3ao6{^88qQkM-3j{b{B=Y5na|U@-tJrLJj)N-
zqVz1w9YpKdLdN@{_GAO^sq`d1F%?xYu<t>Na^i&8(I~}~IFwS&45>OK1ze-_<n$g?
zp8Zsw(zWzf6`nko&Y<ob)SYY3zd_x3tL!j893Qr_)3jAn)hz`prfp-x^eJ{i-@>Xw
zblX)N%k&2j&W*~>epl#0Rh|5bcmRq{_945fIXM*$dYiJ+n-rX!1K3l&$r>4yn_G^(
zLAlB4Feo?IuaQBy`Dpw&_vGdtvgc+H+Kz7-9=5H}!iMW8*inKI2TEY*8nqpTnD<z*
z$r91-q|_8DF5tRI6w_dB{*3^!9L$25E7NFjzO6;W$%fPtQyrDcO1h$JoS-R9K+RS?
z@D}kG-l=#NCDTdGV-tHU<}ts?d7jEw?<OcnXC&hK&M{YN&Z4g@Ifp>gEQfW%X~Z(>
zvCpexy*4vZhEYOsu}CN{SPrJrUV>8-iQ$8)tQ{<#n`O_KXKApI=|6au43?E(DH^;@
zxmhM?SgYRz-7#lln^fnsv8vdt05IFsnzyCFWP|Icz@)0Kx~dXlMbmX`*apGG^&ISm
zwn7Y7Gc14b+FYZ+tnb%v;IauD@h{Ag^bGaW8S*&ujv~$m=ge{hJE|4gk#$G4ilq-L
z_j+9G{>sL`wrtbSb#S;G94_yz!zDZ29=Zb3(mda{vF8N@8$=JVtNI}hsOp4X5NNjj
z7!ibeC?I=Xfd|z;vb*E~s2|}wcGW&I8XWS@g~FRukBpJnQ}YOI42s8X+j#J*WONu5
zkL%aSpm-b<kDZvfhpczhT-OXu)5EGAy4Wxs4?C8wV5;c05~zl$X=KRleYo7-jn%a+
zvp1h2LsvA{AR+cGC&Y%K+1T++69*<Fgbf@wFtl%;9=!d<Is&ZibGzcX8~0u*o6&oz
z+I(B)V@A(u!onrrzkNO~Q$i!Da>f`p5<nNkt9e!;mP!~Dn5ELR%Jh7Ko~JVpvb2KE
zn7M|cjOOz+$r*2)MZUnyjLJ;Mz|oaT>>@=JmKFfzwI=uS(&7>U>^mruDm^k&8j}Rl
z<3{jpz)x?^W4vK;`e_m{v|bYbHOeC|ilgFY3&H0y(o!ZN{6M@-huDaxNsGihMforP
zSdjQb+HuqA`)s;A^&yos@fe?-MJ&YOKwGB!G2ZzA|JSw?Aq*^2Gjt!Ds^Me9QFZJ>
zF2B%o6-U#oKrz;(AKHC~YWr@{nrQuNT2L=dzx)Xfz-<Edh#iwMHkSs`))0qL1bbv#
zjMMkDiTxzZ9I(*NE=D4iy`uc^Bl6h!i~Tf?$vme|<uCHhQ^*bSqeuKNJShQ`OtYu|
zrYO2@SwCKkcxHQ<;l2pUULZ&slQ^0tPa%Z7*&qtjq`(la{Zv!tU&Y_o6ppE<UK$5K
z@_w!_qk{e@2K>Xt=;!jheI*aTb9n&1;Rhfa$7vDp0iDW`oiZBK41eW;O=36)!DyBE
zH|1G*^5hBn09u9GS<BO-fxRtHWA5^v&nf6l#E}V4SX;!u;ifh}CV38F4+2od_ZJ!Q
zZyG1@`?t@*mc^u}#HU-+*t20VEMo)#>Cl!Rr#VYGp3^JJ=tHIeTU(%;bdjO=ub=T~
zg7R8`po3azra1&{%wm2`vfyC(>G@eG35ew#wNs}0(A9jMY6jM+5@I7XeC$x_Vx9Vy
z;^<mvd+V8{yKl7S_Ue`Oz0q7POrf1p)#Ho;NO({&7IInu-X}-bG>+l_tgS4ar<siD
z;P&RS^qLf;T)<^u<z>kzDFb>AXhr3VihoqqS3gUtulk{7yB4+-Tg678QS619kA0Im
zfks@HsE;vpAH8ITe8zxQq-DC|OL9dKDG-316(~*U@`@!f&5BO8Q6AUDsy~BDV2YH@
zum{Uf+3&cw05E@bMDALA*fZ%n@!>L~q<|VipUHu}*R)Uto<SpWt=6%(rH1r9V};r1
zUIiPhuJSwN{$1A3l5F}}8Xo_|+&c=mK%Ov-t*rDb+e^y|WYKxPMjb3)kJ(Y5q{Z<E
z$Yll)_*s!NvEX9#{Q2h+LR|pEh<Y3uh~u+YO)aCrFt8a(o#WMsEL&~RtKN3w1;?p}
zw$cRsH{cUa$|`5*zh!V0pEPQ8rssrzm^45OD0A8GI%-!9mk01?{=R9%Zgf|(U)P4v
zYQwJTbhBfZ<vZH4>*bdKgtkKZlyz6pd}^Qd@o3#mb@Zu@@3Tz5Rj8jPJr0fVb62r?
zNCqY@Fdc8N%*yqIUC3z`(fl>>Xk4p#Q2Yhng%ritEr-rv42;!h@z(Kzc1}&z#YOcS
zdz{)^6LW3hVY(Ucg)f+<`=K8YtSTx%4h0G(zO7=1IF{-grV`rfW8`3-m%f-42lI59
zSGmg3+v1WR`f!gwi??zj{qD6b48)|)kgzM_Vet){*@lwZd*A--F)smAHzQx@=bRSD
zHR`S<kob&0lbkJ%a&4R;IjTnM+&QlY%ekSIO>Ad5u;;a8Jz;pfJWj}v(_Gb%V&`JS
z*R`ChReq+$BTx1ORl487`u)9w=h3ZrZ)ttc|57nh<{Ro_{S)9MgiuX26|8!Sfeqa=
zuxqP2Hk>ffec#dyJG{s0kZ0hDJ*}24;}+3}6g_9EE`ZQn6qKJJpcaX8p%tn8!<hrH
zXa-i|1oRQ2-lWo+ZPSjR<2lWmlI$4JLgI*Vu~LUN0q>=obb);ESE3YMrq?T)LU43S
zrZnenQZT3!bWTH>QSg%oHC;inDTN#B&yZ)$QYPpP4Wh*ishToDuhVO!8Oj8`O1QHH
z*IycrB0ucldKMTYE>g^i)ze>H(|zB!eC#Qqf(^y?utOCU2aadCzM&A?c#JN4e4@*=
zr479;i(OzVvRsLfE^S<`N6E9ifBo$9Ur82$UK=jIfE0u)`j6j>)}HcvnfvvANY7z4
zUeTvfQjF0@c|To@V5!07VJVa9Azyaz7*<~O{B?Q_4`CHn4;#x7UK<We(e;V(Hr!_r
zy^>fqZ(h7D_gl5it|G#9NXSn!_8P8I@v)7ouM{zAcXb>81kcwoLj2u&W@v@++s5wj
z!Yi=6@>P9|4bHMYkh+#CO3-m<eq*wMsVGOc?Q_~W*d`ZS<HO(u(;X~5tAP-|<96*#
zPKwZ+iS_U&TClv8c~O~IAYUV`0(jb1id+(}S=Bc|T3Zg=SHo70`gy}*GePeQQY`Wb
zl6z``o&))5z_FUybtHagd^3;wUit7AmF7|jHskH<e7szHBbWXoLZ_$b7oHIlC24|}
zHTWb)38ewo^uWJWTGoXHP6F=X%D;DsRc#zE<&DjbBntP(=Kwg^BYs64HHlWEX1mz1
zbkL<qITcGRt|ZdOqi0uB&My>oeqqcMROD)U+&bQId7d#Axqiq9UU`E4$dors<0rEo
zwtxH2O`4Pw2=OoEMkoyHWKbciV)MhwoPbb+;bF`7k49Nm#aY~rvh3@#uMw0Ty&yN8
z5>DTU3Z3+6qc!VrbfD;J?$PxWjpVxM^a(!Oa7;{O9ucFbC|ShuZR^UKTxA{;NR-nw
zKzHOS_0SH~P_?lWXdyO;>S5yA6sxvt>yE1V#QGMJ&w3Y?{n*N0?kc-Ft@LqS;XmE7
z-gguW`%|bzMC8Y3B_TF%Zgl)1TTsMP!(UNQ`MqSp#q!Cx;f5!K$0`(f8QGA@KO*OJ
z3->A=J(wi}Ep<(^e6ig933^qCU}}=*;D1+z+LUf0z_pgnfx<O~hoWDRI12cO@~G!+
zJ{x^dfR_~;x_+W}Q|B*j^CkC}j?&|<Ue4`Kat9=faFKNaPgMZ_N;52MgeJuf07{0I
z>IANDhqmo^=(S6qcW=`*SN6KSCleblZ?A@KW==DoCIzTxR-9Do-X=*HWwVxj#dc5{
zhBT9bVi|Zv<%^6pxX$$o_7o(skGW5*)W}3hZ38Yj#+J&OyST@SIcC}JAI9d=4dNJq
z7h+3s38;)hOhOvsP&HkRdIoVd@4;@aO6GW0`e0w>=nZ$hhWl=jweG7Zju&|W%V4bo
zSL>a{t~BYq=#x0Uk(U*B_l|GaCM&O?tI}bc-$H4-6D4dh7)CUk6Q6~i)*K|6Lwe=C
zF7%@;S`&QT(Es|s|L6br|NNim$^V`%&~+5Y-1DeNQAU|_JT$xj)kb^+9*aEmm18vn
zsL4&eFYdrzVNVxKMVp~Co03Gx87JEmrr%{(!$;t&9P@c#+E+N&9>yjoY8bexZeg3K
z8a4t)!JbZ4Of_49{U6%;W+3KU+T{9eZSq~U#x1(zKQ5v;Km^4RxZ#Csl&KKx3n1S(
z6V?UTDl7WOjhfX#qk1njs%ZjH^OpjCKBIo6R)wnow5oEMOb|`-1%qvhile-~l$uJ`
zZp&h4)#{zpn^t>ik;wg3q(CEdOi!jK6ZGQ!yEml}xkRXT_3058S&zDGdKk+wPc}p1
zF?t=%qM|ff2B+ZyF6)}q*{~07f#6x<*3VEBg{7q;%0V4;+$=K&kA@<PX2%yJ1onpI
z*GxHlF{;^weoYJXo)*kFAr-5QO8n_~N!iJV3!zh;kH^jq3Hv1fJFKSkAo|ih-5c(L
zMxcYg!yV^k{E(QQ?VH$Cd><R0?qSFC2v&)!`=;%Mp|L)k@R9Q}trp?sQyjf|F&Kvj
z<8Z?`+{*NRC&O^*TPU3kZ;OekF()ZlZ(2>eHQt1Wf|s&yLS_u0lLL9SvPSh!Y2}b=
zyyo+CHeWy-IjH0$U?*alC^Acvsnjk2!_=6fU2V-Pc3w~hN?l-s$%(=x?u9p3FMlzr
z%)K8VeoYt?_)p0!HLcvW`k>$xj+t%E{ERB^nAKrEL8_vhDCo3ar!1dQ5+4H##(E$3
z<$}5?svZFs1gAxJ;uWN)?YIsa@G_z?V+NL&NRKp+tf6PqX+}9}12+XGeVSl_6uW#y
z#WgTOM4ef0R&|yJtZEe{-mCg0CB=-)-&Hv>rx~TmIqla><xlsgjB#ckw}yZ8O^pdW
zpPweXQuvz;u#Pje<3ME|&py=ODUoMeD$gFBGUonkG+WGGW;{CnMKp~H7=+fnl}@l!
zJtv_c(+~7(Ay0(LUbf4b@G?z`_mWIszrF?s;Zg6g@FDPH#Y>AKopsF{dxuS4-H-S?
zD?U=6Xu3%V)*V8yVFdvursZPW2m&W`bWaPFL44edd<t;$mE%SX@##cj%Y%Q!WzA5{
z3`GU=_GNfT5<&s&E!-S+)$~fv8^}leoMFbQ)6-`Gz@32plw-~_(^6%9%25=uh=7d7
zY#?Bq;+#8~&tt)xo^l%%Z}BC)rWv|i%t*o=?(0K2W@BfzYiOdh5K7w+Y>BbV84!bo
zE`UC0j;74zD+B50?L4np>KO7v&0ZGeC|~$K&2z3_yd+7$P+DhcM$vVeeL3mw(CytY
zSI)ZSp)n1EIpXm+c*9A($X6^793zJbMJvnQyFu5NQr``mc(!+(WV>X(yHvhj!(V^9
z(dbYeZA(7e4Y`@41u&srCfI1k3bJ1RC}RcJTsfzwXv>i$5#Q=-qe$cQnr6pu(tueS
z{&+KnFvibtnjK$^#PKznT#U#+!99WfR<_9ggcBBA8rdJSav6UOvZW`1O#dujac5P5
zmcS84YLYwrT#QOziJJL=zxgv9q!pUSYIXufwpIfPr{|qCK|DsI0l(qyzqNoEp08R;
zh*ghR*syIEJC+|{8XAV7X`xEBbzpjpKDQP5bUOfEC6eS8Fwv$<m*VKeHv+79L4b|G
zvoSG41uKD}`krMIgKl=|+VHh&zw^-pP_BTkZNq>4MmUs{gCN3g1Fck@Fmzm7!PJBd
zXTGUoS9J&`#Bz0Fn1Sl7ixC(=E6bk&wDKUJm9H9TyuYs?E1xm$zB6RyIi1lUYQjvG
zY1{y?5^ORg103N}I6Qv#>YO8c2r-rfvk1JQxrAEBp)8?<LA%dEf15bM>7ww{8O=*y
z%}pqk=RBd?vsdS6&cP)yf5}7w@DlZIgi9w#h}V}lAQfln6#yF+<O@Y{3Zct<7{CYS
zw9cuD(A|Q`tR!R}qCtxC^uXYiB+7Qft2C+NDVFbG+qMmCP|v`QXNTCdHBYy7EufBZ
zp8*=mCDvTtFkj^Y=c`XF^EM!b%`rF|FfDs@FV;H1KY(~86VOzEm6ghaRS$XU$5Kml
z>`|XAa^^ob&!RL#S+x<zC*LszRJlUM*6NOexpxMEJwKXn5ycEuBcMK}w&i0()qU*f
zM8UdB6f^LtWm5Zbr*x{TDq&x+^YoX>)BY`lrmzrG$UDk)nQIrgIMiW%FW{Ca<62+`
zGBwA$G%sXkqt&cQd>@14iO&8<UGPS=n`tRD{68otCGsNkNpbuuEkK9(hUPh$(pLeR
zpd)-VLFd$u<`GQ_4kZ}`8O=-Z$#&h2NEFERI{!g$I(R)U<rrK>bm3ojPV+@v95lFk
zCt3eNgk(=MGQaE@k}WpncDh2@bpE`b{~FlH7qjFIWFmvF5vt9OT7`OoBlR#oeIxMC
zrrDmK!B+b&AJI`8Q!^^}P^L&jvfWiFwSyH|nt<O&(}el^Bt>Zj?y8O3-;jK$+(uiA
z{Ogu+5X$p$bceIGS8Pu$=Ik3KzdQ)vL#Ren$5gQC*%TXYXk(A~1`Zs@QB0k9hU+~J
z(V+a3@i5Oquu^hVL&=78l^R-M-&&#D9HqFF!N-sY{CMst;|X$C9=i&coLzV2jXUPK
z7dVX0M8+Kl4Tw2rwBQb!f&7{xWh|VqBSUay4*7H#CJ$k$Ah^B`3eM6bDww#zh$O?2
zk4t2*f|41UQ8=9Qnk-#O`>_<N;W704PULwIA{qa_NZN7dDa?07;!;KjRY5tMrPWTF
zg-_6{P}tl>@tm2bQJDH*?Ms#feE92n%}|)kpEIFfaHY&Z#ncs?Z}ou&U>y31pv#Pg
zXGfPsG0&f#o<it%a#EU+PW*IsN)x=uPo+T#r_9cZb;~?u@)Cqs*2K7fV`1jgMMiP?
zz4iA;KeHNyD=2`c{_Xtr1mN-oQ_UBx4`H}8%TLfxr-W&4?u2wGH9MG*^?u2SuH#!)
z;8IM(AjF0e`q*<k1$$IC13L^{o4AiqMywqbPtgmOu3j8^r*qqc^M>4@<LWdTZ$FKs
z|Gan$UNtMZ>nne8c|P;)%RQ{cGqA*-p2~J4Xi8aMNQQ6n=|<rYTploZKD0}Rvb9R&
zdl_Yw^a^Oeja={`0rD;<(!rwU8o{4{n3QubcOXP<|Cgj_myj#6bd-@#PiyCDtsg`i
zZQd%W>gwe6)MC`AmP9*5TZ2+*BC0kN0WV-hzTt~;1sV=~0N@RL!}8d~6G`-j<3*#<
zpU)5joveQ-$AW93ztt->eF@;_<Iy`usnw|N{YFJ#BU&rFohrL)D!ZL3yQ`I%1juH+
z23RKw3EjskVbx%a4yx)P4gYohab#(jW>L^LNkf_yf4n(#UIsw(`VY!3h~>HN?#Pm6
z#am&4Rlivth7N162gSOnQ1+%)Us`Q<+PG!mewWYeiFjC^U>!+V9+zFqJN?R+r~jca
z7eSf(nodF2u-Qf7PU%Ucd<Mtbec}5RMR)X2#g<{{*a%Dod#V{=&7ubJRn^l>^Ks}%
zngzIl0-(@n5_G{>TWdjmb-u>FKS3fNLG(`!y9NOJjAMSm5YlMy<O$$GJbCgwrX+dt
zq=sc!u;i4j$%X5Rgj%;XJJd2Zn}}6q;A{{+ML;+aKGBD^yIS@R`$|&mp2^gK>Ju;Y
zD7F+s!G>p1?E2Kiq2W;1we=wMzky7BYkRA?VWfWP1NlOer+qeF1-*96Jc&1WD_mbv
z9@tS+W+jL)eI`lzbehqBEFut^rN54FiUBU3BwQZ`(4+)3gK37YK@Or{slO<evD}*2
zZ4LNPrnIA1l&P|6UNr*!jYXg|a(%-VoToXsfYv{tCioqCL+bi2eh>}Vw0pKKwa|4;
z)$p*Q+8Q=|gJO?pCU%KQ4OMr1(^ej%s%!mC#k?NK%~PS#k=GNt%1;oxn`+T0?;#zc
z`V_sO!GcF$(TzG7XnV#rENq`<Qnw=2L$Il9+;lw~#YR<8yRztPvqJ^1w$T@&?!dql
zIIC)+R{c=bybJ>BSdr%yVZHyjOlS=Vok7g2xVW!q7DPV4Y2{4o4~F+&;ABdCT4K?O
zzyB)Bmbe`&#p`7JB`KnUN&g~i#v2mFV(=n#ibU~quA8sLOO?7Q`nAXiQwIh&0F&V#
zKMMjDE=yt-+us1;U^b5^2V)08b+!KlftQ##aDx>p=7?k&x%rXD0A5EqMb{abuax7a
zAfQrAF-WPr-pZ&GUJn{>B2knWUhKP0R>r}=yjYu`W138h%k>4%&T2>&2+fKA<uj|f
zqJtbys@;2fig@5o^&K>(GZyd#mBkvUTB~|kGm_==;q;Wzn%VkTizLS|B_Vi((yvio
zZMJb+Dwt&U>IFKhlW?^IQM5=|B;{2Uz>OkLgjX-h4o*+yQWtBStJ+_aybudnYMhxD
zP#)#)*)|p_;`ysrNkQW{nl{(BnCZH*FRq$pE0zamm5OXmzgpkprmm3h#%Hfy1AOF}
zAb0!dR;#^A3WknSueEXDf*_#UldX%j+E{+|L5&%B%Ib&J%Y0Nmom8L4fag{<qO$W3
zuc}9D`+k+kjxR<t0ugrUBIjoZ57GmLeR6}?c8rpiNvnn1Rt;1u<PFKb@bv0X5pyvH
zM4_-;HBqhRX}-wk{8xs&$InnI4nQb6&uHENFp?-WjhpagOdvyboi;wnX(KJs@~Yxz
zXq^fdqiQ%njx=kX*{u~<rU+6$mTi4_#c#nz14}iS@7(gk5P<dT59_D(-<W@X<D6z!
zJG&A<P5vW99g;=N&=pl?bmnK4-0QUqQrcr=UDyz?38SPCJFk4TddrBB@HJSwv)D&B
zZm0?|vF)c!v0NX<1gYZ*d~f4pqOck(TVGKQ-?piBwKnit_Q-sR!#acQaJ;(MU^}+7
z&cFTrVpeX%d@(!bPr0KfJoRqm!CY>8_<Ov<UFc8Izk>;?g==HcwI#E`Lgs~0g8Rtw
z%VwE(Tc09(g(oR<m9E^|Rnk%zb;J4<3Hr&euhL{M5q82?^D-GrWeO)*t$~uVumT!=
zHbl+0oMRSPpK>^GzAdSC_@T#{=hZBt?=nW_C{3h;EzIN6=*G=7M;m-@+lII<`BCfV
zJibIocS-AYpM36A$22wH_i*3@1~yFJz(n^$tk{~S=t1b}n)$e64Y(#N;vQWhR;!~P
zYqQcS5J6|4t*YUT@O%TThphn!-zA!$w~$_Mz7}{OTF9d5bbItzuLR4xg%;eCbjpWN
z0Cvfzy!ZLEon*^F&<8ou6y5VJs{2?m1BwmJ3b3mN4)zR(=$2<tVt<PO!yyma2I72+
ztTAwA;?nO;nmgd!fm3&@iBN=zwYW-`xnr1pBcrSKhdIq4oCFLH+&WNt7D@+aIUJJF
z>TnETbU>ndOy-j(?*Rhl1&wJzpFEkMCr|!NvY_$cO$z8-MT-7?k$gcf(>S2n(wkR_
zmwtt3aPK^M@|Ok42%KybozobCh~XXA(Xqq_b*o4n=}X!@cy={$1vcF$51J0Dd6YGX
z37Hc44f;URzbLMy`ozTnF&%8UzJXn$`q;5`-!v`Pqd_MSlt&1eUSrq9H4IUmEMFn_
z0iMm6TvqMe;*x;FKBPtxY#6L9w6swt<>r*pqmWLVv2TJAyqTA3`e{bMW3+Ktluom=
zC}FW2OosPKOfrt3#kskLQlaT`TKV11$k)zI)ET&16J!c%FJRNM2zV8G+&#XP^J#!_
z1>7ExjK5gr@jhORYG>BP=+l|RpB7%x(8f`%$kBKLm1^hOx=OVoqEdOn{U@A#Av^ol
z)ov@h+)M-q<<<sRDN(g{mS+4cT~~dz<Pqb9%c)vb4Zxxj6PSUJT`SAf=}=s(Em0VT
z$DZ=#BA@1<Ac9}l>vWFEbjpzJ%075mY5%GXt8I#f=4Iv8L|HSvRfXm&Sz-OuRyEg@
zS!tp+tu2-1TUl-0lvY(+OH3508A`LFIkBBIGJW+jj|8&3tCr{Rj729+&K+kf0*w-f
z5+4&i@UUS)kdW^gSSOz6xu!=965IuBwY@z$o1AtZC^qW(L^T2vyQUFfgX$(Gnr33(
zQ$mO6lsM`D#a1G3v)Ngnyk`Rl*(!w4qe5R(h+^ul5#Z2Kb!-@lgBbvz6B>?6sBZYm
zx@9(?ua!Ro`r1Lz*FL0k^hTPLMV#()GMkfV3Yb*F=t?;tau*o3KfzY6+3FcnwE#CF
zE^#qcf?xGOiUNG1ugMjJVRF|Okg&v1c>n0t3&;Z>O%tvislc8k&@;14S8&l2rmu&#
zQee%}Yf#3N-EuQ1O9Lq!Rv4Q;si2!nceZ?ja^69Z&PW76S;F057JX$}l$^}wfL^@t
zfIH4l(4V=h_a$Xfs4N+8UdW`sAhB_ex%`sMc`EKS&4MUlN^?$)9MH<aVYav=36e45
zt9~}jsUXVJSfuKGvJH0bU38T~5==IfBAr(hDUJU{iY`G$mWbtLSB)TZFHZe0FsS^J
zfMr9_C`!VN<VCjdi$z8cj5Sv+ny!wkg7eXdOAX(`s%M7S@SOm|DU03ECaS0TdSE<8
z+ZIcekr(TBYK`1tZSbwf_NCaCuL6V{8?3gO(Xm`Plg4iP?ff<J<H-NAac51Ix7Ao=
z6@co`S#|Ie;J+}aMA-wZ?%&Q|b5{oz89~cWIm)Z$eEeG$vxbD;1SDbbjg82P%OUR@
z6eqmHKi<e==?pbnX^;P1($5ID%qAUwMoJwze$~gcS)R$~%Y~K|Fmi0QnAg=AER{n4
z$i%ZUn)|mbewBo2T?zDC7QasGX~X_<{yYt+RQ}wRFaJv>Ua??m{_QKXx`q}@G5w8E
zzlbsccF8^-wCRf^xEOJukUU8l9^FkNV7>ytXnb?M?YG(VHG~_y1N8bE^gHe<_U<yu
zFWDIz%@+KK=k6yWQ3d!eF?~hTv1Q*__+2sOY7`fXZN(L>?6fv5?E_h<`koyXFZfAO
z)#i^uWx-#yRAlGKa`hScLO<tpwSfsTSKFvf=Q+8qSFgR9AX8b}y*R}hJ@aR+9kN)|
z_mr+e53CdgXI5FVq3*30Tv_QGw0}!y9NTYgmBn&v9x_5RRz92{sS9iEt2%SGb@TD)
zFXsr38W#KyURq^m)n<p@q@U_v&XLbfCgG*pXpK+Xo9HWe>M?&;P}O}VxqqC~;`1Vj
z(&RXw$5C<2H<EDcZY~698UBrHzepGPkDtb4(I@a(n!?!Dn#*LRPyKkb%<CR~I%|?*
zf<7L}%158hs_*@HRPCvwPiNI1@T$5ik3OB%rsU%hU-d}rhoettjs3w&@auQA;OcgQ
z;=)btP4xBX(^*N~NqySRYQNWe5L=^aTRea=Y#$(4-bbI#%1r@pVA;zTatj>T*R9}5
z#YXqnFOJD(w}a6TMlt`uj#}mlSg~`sd{@os656BO9Gw--b;w7(U!}J@Kr+s&RE{2~
z(YnJha@FW__PI<!D&~x9;<{>$yXWfL5!rGFY|CA9B<__VaV@N6CuENv*%1$zByh()
zQQZr}uGnt^hF$S+c16V>-Gg0`(clHiz6{p|r_7_jE)D@KbxZ2mPHd<2cGHONs#L`a
z)hujKg<|3aIsn<|zOCw-V&7M=jh`4D5Mxo!E=I!Wq9{N7C`>olPve-(bNW>N(lqK+
zDZ`;;nmzqDMbUN3`tf4KjW5y&Qv_u%AcJ5MN7Ljf$k_+761@SNIy)+9uxcbKxeN45
zG9^<M%G}vrbWV~lZRVnCIn~v>P4)323yCicMs-6H_v>RQb<Fz~M(m~BUK3>W8qso~
z2%_JzAQmt@8M!WvLRWBI&=d6GlJdN=d4c(}+UUS_cL8!&e1rZ`dIJT>qakF4m5vA#
zlyh8>%FqHs44^-u#)g*Cu%HRbXC#gxV!i+!Jy>DbSDm0|EcxX>X_hiV2*nFe5jvv;
zhEt<eI;Sua!pd$|ho7K7iZm{qj4(hx7BF+gbQ%>A_zPC5_1cuB2~a#m-Xe+vh;0ud
zFN&i=gm4pvvjk&kf*nA}Ws(+%T#+bdTLqM%6Y#bn1q>8M1J(!jk!ex^FvmBw-r0y4
zF|R>M!)6prW(^w}12AT;*i}W|a0jc|ONrOa$5hTBm>d^5vpvRfdW{!zbWE;E#xb2p
z5=?}C7f8ZK4lDfzd4NeXha{R4G$(m}oo0Zbk<)@}i<toqT3<23fw_&Tguj8kZI<Q*
zqY({yTHL5h4b?MjtQfk14UL-E@e~6as;v-Du~g4dAECwV&4xoRBMH!X%~=Oo-FH9Y
zCQE1B()l(R)&|4cU|1UrYlC6!77S~`4&K$MR$AEwYgZbI2lLrYMV6iHXX~wD{Vi*Q
z{cNzGJyiSIpcNgAXoC@LFf0#-<-xGL^|BZY%iDhj!}48px43imv%0#qj|EK)L+XUC
zjY(j;*suc^yQb^lAh2~xO~VhI&4Ha8KI794L2iDUNOa)8M!B#AY>C;MOOLr<1xY>-
zZ(}r`pU&nai-e^u%76LCg2W%vZx^*#X>K1??4sv{8c}@%n}J2KL2M7Z5KyB~HPndi
z8NRu0v9&I<_N+3aD1V*8M%W}DjR5%I1D(ymMDmJ_4j^BngvPjx50l|xFVl<%hv}AC
zCdtSN<k(~gH)}jVq>12NmR`{W+%eZr;0OSlnUg)UYyT6H$cyouu)lCQygZE;FaTU8
z<z&O+LtQtMvi-kSmI(bsJ5kq`7h~t+p}OmuS`cE7SPC{3Kg5m_TG+Nin`qPvP21nr
z(n`;5#apI%<<ZiE#-Fu6%3rHxS)DF0ijU>Fkslwupz}DrkrV#6H2dPE>6fGNCoxRf
zNI8AdPBbc4%gNh0&6xKriC>9@aSHJh`JDJPKNaBRS$--gB9~un`HaXssu4<4G#x7j
zR#ZIacF9^%d8B;w(*&Y5>Yr0~do-RLomNA9FVfqV<2#yctBr$e4<AhyN%W5eeb13&
zkGd>~qw#qBsW#qNg#N71zU&UmB1esi0i6R*)Z3(~yBK}UXr3-IpS}u?kE(Ax7f&HW
zElesHvGSt{I$EAx91zXcY-*dDX9kX=`<kLVb`W~59{P%@HiiKmvH$>>9NEXK;JAGd
zo7ch-SZ-VCJ)WSW4bvr06uz0Eohy<>aNp;Qy;F2%P1vm++qOGSI<{@ww%M`mbZp!1
z*m`2ywv9jU_l<v#vCsBV)mW#iYOSjKp4Xfs;<<-oH`E*;bASZ(kpqjIV&@EWWZiaY
zG2qEh+6=%e6{zvA>YRd4xglhZcK~>gH(czO_Lcq|c0i8lmf_cdi5QAu*ue-9fPZ59
zur#Bf-P>!SM9a+yB!}gDi6>c%QL-fJh_Q?g*GL<I_E99@J7rw7(IbPA+~riEb_$F$
zz!vgbf&eN;xu~k%DQl^E)JC9C7ShnU%qgJ-{z*&5@f_=w-3@>DES(ZIcU<r8yM`(w
z1ikW6p>n>&HD3+X81pYGj+;RS!4kZYA+v(33?BPnyOk&PY&dd8wM6RSu18vjZzi*V
z&)H8`3MN?N8n}0k!cJkK<`B4*yU6uki!ytrm)l03o#lp28tJWkbX-hJPdEU7V<t<D
zo#oV1jWxDq<O4R|4xwxmsr%I>YL-#INfy*}=U_6SC1$_Wf=x6P&*H<#gc6f9$^2_o
z)Z<FDkt)aB(*IL4wz0tIt}b^<ZWNP=)c@{J;>_Mc?qR73L3ZM*B@3xC4As1Td|+12
zcR{!23Bmbu0VU)#{wXy(7h}f-=95tvrvhCX=s)_ERwg3ef7^=0Q~T7~7?Mbz<NK|1
zNI&X@oiA0PE5<W<Xam%6s+}@KZSxzj&N@BxaDQ&qSi3pV#?4FVotMd|R^xyvaVH%A
z>_>840s1;B$$~6#dWs|n&hzNkr)0u*pf&-u^ni*0T#S2qlUC;71tk!AlZ!)nFkLg2
zs!1;y$&{?5#>p$rj2&<XM(?H<>-g;PHhS8Okq`R8PE3auozL;_%b{2K(gSmhY=l?=
z)r4oE5`pP?vV7kJGl~;_%4~JYkp9!!=|8KyKGZ|#2AcgAFeq>=;mqS3H$*tE$IGW^
z$!W%A2Z1XFhE@`>do1bw->7Fnj>*TWxpM_tc(en=+Db@SlAt%3(Q^h3hA?qXoDtsU
zRToiF2j*Z`#n)JrxG&gB4u@WIY4!s9q-7GY{Y+iu5Hha5AU}F(V<Wsq$O-0q7#D2D
z>^jv`P@N*g?E#BSU?U-tl*ox)u;27z6ciMgq=Rin5Z8Tw`S0-l!UYHYp$z@8s7MOJ
z7lIOClgqiWZ<AmczTy8;l+WqZ925<PjTeV?i8Q;IPJFmY=8WlMKp2Iy3^m&c({ikF
z`mcD${(3QnI(V7j-7#z3?F3Z?_Y^`~88x9cD3z6$Y8k2l%$c;$e!bm;TewjQJyyVy
zo5ymi<o~cAU_HY_Lxm@i%i{rY4%Zbb-z|d)#1|DCC5>bHxQmhMU(c7T4DuC=ClcbL
zKVA@;4oj|J>bmSO9zLsTbMlv>A-jRhL4xdPn@qvWFivg;vn5&Sfq&xr(eFdQLWvM_
zN0&kBqEIG~8ON~5c7{;$g>9N4;@F_zjhgL2U?8>}Qo|V?pwKyUqq{$or+C#ZBQbB;
z02g(+$E#Tm*1Fd5U8()!Cv_@!Vzr{CLx@|kXQ*BZ(}E_&Bh89#l&Q^H<K?Yjyv7X)
z4k%}6ISagZPB6{Ol<%V)|3)h%h~UNub9@jAIQBx5+wTe7YA#$BVi(yn==*igK2u>w
zb#qULoPhgT8G7pjX>hXkjPGykV-8c+a^$^@Y*F%_P0^<meJum3s;qM!D>Lwn8(7XY
z>`oA9yRLRjY(q0=mv8AZHQ0O{J+f}3kK$w3WkbyqBj-MeP&&KBC}C|lz11=2YyGW%
zB5U4q_#|W*9I?tIOveIM5{hdy(4_JM<qifIS+OyCqnzP#tbpFjvFdzQyBh5&?l_1M
z0`+MY)vUy#5dWjU+|g0DXM?Hg+<+p6$56$49YOFymFfBYXKr9tIfvJNIs`gHR6&uE
zbY|pR2-CY#CpxDfDuJ5mfU*Bx{I|wgh%qbHy?Pd7u!?7v$%#H{(?Vp|+W0o*C&=W=
zjEpq8u4eT;xoo6#SrLu3)jzsspt-I*>;-4hu2A^Xsay?GS9ia-7(Fl)Yg2+D$L_cV
z?J+l~!e)pI7zWK*6{~YDHkRq$(BjY)Xgb15h~_fe^!9y-uoR!gF4mjo`zzNZ?^Cje
z6fy|jx#2{|ByY}mlPbsz^tR9_-Z+jG2U@}ovZneY&JxVDZsE?$(#D??DYPekr~5eK
zOK*QBE=_@Q*Ycgl_aV(AX1o?^MAO9jd^%lcg}SSkBPa39W!ZlAW<*}Ak2xx{i|jx{
zy|I5kr324JT5O!HxT`DvurY_btC}VUB7}}rc*zxe>DuLlC56-0Q<i7S^%<~hofSAe
zo40yj&AI2wtgSjbsFhZz$H;L~K*m$1;-{Ng6Dp&<mzZt^C5EetO>n%s>aETNL`I;i
zHe*olooXhSySJGB<Pi&CJ~(s9H}2~NaGz6J=fRC?lbJ8YN-?;=3eAS6+DFEMX5$fh
zd0Ik<G|>JCjUY71?mFF@BMNF$RuZYp{7_dK7P-$Edd@kFpS$zy%yiCPID9E%L7}zv
z6dW2*LYZ=HwD~Awb22!RV+65M=Q>oZG7oaLISc(MFh(ohBR<_XIUxNHY|goMYi_}<
z;LKK@t~e5>UvoDzAKp7N06&Ing(chyyCvUKq@z$7)|V80Bsg|kSS!@s5^RUid##UR
z-&RQ9WELI&In(9Y?Why=pZzBYf{?BvE$(@Sso?-I!jn$LelL@*va${ZLlrmIF;dz4
zdn{1sBy?9XY%40AeYQ9oPX&_xh^Ga|3WEVssJY>EU76K;OT~+Oa$%qjPtRc<`YZ3-
zA<Z9?3nvln)<Jsr{PXJE8LK?p$V#L2d7uAyVUbzZi$4pq;pc7b72A$>6)s95_O%u%
z0o=Mhug&(SELTEn+Ui<m3v;w7u#=4Sf;yvfs1RvN724fKNWa=DLF|~PU#=CCv70Eu
zT&1PT<%+s4Usdt8XCjdIW>i>^##}Bu<@_IK?$D;^c<4GS!|tUSvh(y$ll;4HUk+=H
zC3G30oD}Y!Hu|S7WgIEaww}<m+fm!ve<VQax;AYUKL{>t9jXR`tLi{2=)Ro%Z3j!-
z3tG>*air>@+ff^;hkf=BA1QlFIn-T)te^|N0`CIv6=?*PgK;+4Q`v5cJsCKDQ-jA_
zYJe#=a=pz*n5qcMTl(ITl%z}9<=BphyFo|yXW|2FxC7oxlNMv%JpxCA;EB}$&vg=%
zPz@Znrue+2IP*yhF_d`I(w@lrGDSe%bOKfSdKLLCNpu+C!p0KbUQ)P<!n3%|T|qkT
z?gzuGGkER#6L#1IP@?KfLRQ1C?`|Ew_P6E>HUa7s7W+-C^bE7{Ih0OUXsjq8O20x9
zl1GLW2Zgvh7Ux7zNGfa#cEdt6KM+7yz+50>(teOGYt5yoQe+9|NCX~viaz=0OBq=n
z=`U^y?B9uFO{ouQEMYkzE?t2#(15nmP66kHPJ0ml`MkfGM2LGrL?$8!%fa?C=19vf
zA0zrXahw`%;|!JeXlIxS`tmRUe^118EMF=p!*_hQI<#kexj5Cds7bc_ob9P=@&P4P
zb{AJXlse#w_Bi|s>XjCi`PP1-JS~p56yGe}xZCWwiqF`GPlTth5$^BPzep9NPtU$8
z8>pz>_<S5u?IwPW7mGYC(Z@SN1YOZ0FqSx>4qtkXX|F5?=J4FSgPH@MA2T`<Oh|W!
zBd{ytH&v8>QHaKw8$F`}LrjXJKxPf7K_DwvPMN+hX{Cr<z_as7LS&Z6w8w9>ia~8l
zs_{}S&CCz1kI8ZBIy#{d)MCFxJpK?Y!0kV1!C@ds13i@@<*F0ijDvzCZ__|3p5JoP
zz+v@(Pm)OFipObkre(j49xy}CX~)8OG_^tG?d;!0fn^V$92C9D+#c?0iLErhny7PC
zqR1C)_j#IHOp=IKjq-QYL^HtXM$ep5y<Mt@3z<dyhWU{z%)0UzC=PoG$>2*4iVhm-
z?OwjC_jC%5I3_6+QS*>8!QDJ0wF(n?$Lr@P#s-2HVIBj=@*IO+0PsA}GPEW@-D<%v
z&i8TCGYdLvL``g}Q6(YE4QT!%eaHSHrgyddAU(wF_cSXs9*7mf==djbV13Jos==)2
z2u4L<)VqC5(8c5Hx*1RXvYU+7@#x{dw@;{;stRyt9JG#<-EaiHzq<2k4%Sw4$f%}K
ztlqAWOc;6mIXUJ6jA62Y$)x4@LAiZ(&Q`Z)_L$)BZmn!n6q@En?wcAEr<6I^Gt98{
zRwaS2`b9IGk?`YW`2F(PUzK*_#!GM8uYTw}gR>G#H&QMg9B}QK0-7AYki*g#OC~z{
zOne_3wNEmq?Z}1c$<!O*olPCw&*7F8c7bC3`HZo>H2muQD8<kFCA;8aWLm%PB1V6N
z^%4*F&(BqEm&mEpIa6|{shhz?9=CrI$g)mQtlcFiC{FVOeS;2}6(%gA<AGit7ECri
zqgAsT_IZ1$kTcR4zh#4B)@$?(r|F<5$g?1FC6Vw5!4Hls0xu*1Q+Ty5x6!khP_T~E
zBZr|NFnZDCMzD818Un1fK(n{Gl1`wk)YOeI$1XX=NS_FLA9OT6#xPDzzaTxT|Jg;1
zYNwEV2TDF3?kziK{N5|*ULdC#u&&`HuodieVn+wWgEdkLdK6=u0Yr1wkOUDPOrUdX
zh*y;YC9+CMq*3LG$@Zr6fe+|Dem8MYrLNs`=z>ijId>bhR5zNP+ShfmRnfZv^MIbI
zSUEpw_x1CtEla9KFV{|$tO@$c)vS&PPK>=2X%?GaR!^9xs%<wU&DRDlPByZLbO)#q
zuoN`s22E10V_;QP;N(sl5Wj?6{RKA=6p<YIJ<56)I+(j!^Z6mxU2!{a>)vyKvc`s~
zoj$Vf1L5X_9YAi95TF!VuS;d}Pb)<@R=*oC(j2o}itT_%LZf-{+h}TW?ArVFiW%?T
zx~KY4q#J(=Tk6u6fo<OXzy%|Je{t2&Qc!Cd(5;;E8%s;F&40u40;LpKYa&zq3`}&M
z%=C4L<8Vb1^Kb(G5ax(6_5(Kw^VD09T%z*mOg*h~`Wle)l-1(9tj5aw5sm3OXrbZZ
z#?)oJJ!9>J#q8##+$g~%J2l3X?^n6_-d*&yiT|U<4LX#zuGxM|)-4i}RUj}FjT9<3
zDleda#n&a}eQ%g%?Qo#ET-MpMbukF%4<iHXL>)vzdE<#n3}kM?KK5TBGmA1gJV>@-
zPzGm3leOKWY?^D3+9kZc_Ys6C8HF%7Zj74!9Yb#Dm_ow4Q9eQ7E!O#whAkKy7Z=4+
zNLG`U(t?c@_dTOz;}I7<vOk}Er1pF6F-Da_dl}(-#`fV)F;>UZ@cu2Ts$yLQ<$eSk
z!Ltf&;1BmXTUp_nu9xbsw>dxG6xQE8F{g=rvI+ZaRxVqDmJDNF{`ZwxeeA(TDsRk@
z8<`~)v*=`14EfUN+ahe=j8>`kY85Cl4fS8oT032guyN)S>9Ca6!<56<X9H=HPhXc~
zulzARrI&9*i}fddVt;FC7)2Dxr3vAB*pmUX$p=81?FC=FOM;}VVy(+-oAvtL3MKM+
zmL;NpltNPRDF4Km`7C}(=zLpi1Pqf~{Y15Mdk;(YM?kc(uYeZHUHq(=Hbr<Uc*5M;
z+~J0XAU^I;gm)qVJY^Gy8nT<;8Et`g(b?vKJ6)nIkw=F;tUq7mCp<A}^&D4D+!(Y)
z)FZQRP#I+<P1?v}5EE=E_OEaiAx1|@X=3z4cgRPES?aHIyR`A*@duT$9B1~XP(|*h
z2C#oAh3Gig-`w}OPR_TvzpJe7Hq?dAIgBMb7SR=5>Fv5J?ZWXlrHvgD11!dSN5*6Y
zP7EX<-K*?7X07Bp+EzW+*m$p&4co|_PHLM^@#lL>dcvtf>ffNAzauImJ)z17CnYxY
z#kx#kFiqY93R|G*o-MIOw^h{kO4^;+)%Hv?(5`<;-VJ4$)%N}JXxcCHs6yE;($fM0
zGXITS>$S`0g74V*+!Mgg83lCeijr(Mwt<RLsFxZLEi?~Ofvi3>sHkJZu`nW{swzW=
z*)XY*b7UK9wt2Zum|tp@o*mRtIb{jqM3v4Y41Di0tth660g=GDPgvYa(8x3@0!0f8
znm(D9DT1>U30{D28B)IS$(MVdf-9EBTEni;VR^HM0IO>4l!ZyE*J4>Ig-I(>bz0Rv
zOygK?c%<HFHMZMTh2==CzgiKJw>Z<YuEFL8m|(jBaFH-eivj?*MVi)@gVKu?t(`d*
zhxZ*;uUYvR+zQ$wrI}jh<Vk(rckvSxVQjutHC^xa2>v^@US<d{1WW#1|K{!U8m|F3
zHDvFXn*tf=(~aSrxG86ipX?DV63^_a@G0SaD6_T^|BY=P$8^Y$98!>tgZm89A1(~G
zH^$9UAKs8uY5!YNr+ySH{+dxeV?E4hdz$H9-pUiYt`$=ETEvK0l?{8LW~|${Kwy(O
zGg@}?#yjynsm!o?T{0`G$4}WP)fQlXji2({gh5%7aWB@cxn4u#4&65#V1s^w8yMzd
zbeVs)DF{9DhjBtw6kM=3v`#Qkkk4Vc4AXHQ2Z8_-CZZ)r&zVCT7g9OrdMGw^$%i-*
zPl7VZ$7W|ZppefYl5j$RdFlzs;ScDX(|jdBPc7Q{*Nh40#!(m#mA*@?qa5xsiM+u`
zVgvyr%+HLXAR<&3nq){=sNFzDFNkI<O2Q8&Hw&Yc!1e8^y-neSnyFG)A<dYd9|m8s
zz7jNuo|AtjXK<>by3wb_xpM~B#syk4<zLDC|29R$RX0x%Q1(|yFO8ZgH7C^Q2Ief-
zcbmv&C*wQJrz;j`b8ZQXPhnSV7@Y;UdxUh8c9v_$J0hjTZlL6uHB{S&x&>7rcYd&n
zvr6<9^R4eXwzw%-f9b|f0oU`Fo?L?|jH|t$a6Pb-iIwu`vsUE!?PWH@*A{?1p6$2l
zJI2{%2ncI)ulaWb$NFK}59(QEC-d9j$VD_RG=zWErRZd4d<>M-?-ZBY=8->^$co)w
zCYXILZ_^bpW-JoXos*$HtiZ=s5O$A{1{a>0vZBYxG*Ye%@YX+MT$=hN^LMn>;X(W{
z8QWD~Ee`ku#d;E9S>un~WpIS!7Gc`(y%{LgemKP!*hqn5@^ACGE~^F}ti~OKKx*y4
z=UQa{as+b371)5#8TCRl&L{%*K~F-K^~xuYZKJPT+OSiw<!RmDnye$ev4yadERtEm
z#7dH^ZYJj|nzxj>*X{ESSh@c9kVU)K_H1B)^i``$T2XKjrPm7JpeF_$#64B9e5yw9
zIL&E=+o#{zr0rN==Wbi?P;nfXVXZ4{!(r3e9*!*z)?il|awxCpi1ka|ymTM@pt4+E
z=y!cu+2+SAubAk$N{mff<R$`sWtvePQjDlJPECVgqXqQQFVf0@XtQ4^6h|(CuNaO>
zyp0+oswu`Oh{3@0fvfg+2EL_A;*`$gLZKUQW{S4;N~Z(GV9GT@H(DH~(hjMH7m(Nk
zvDCMLVh}sXI;CjQRVw7hnw~5po>X~yYS|n70HgT;3(qle=zjqPWCpKs>WNUgrJBGH
zt(D<=!cxQbXkK}I6Dy!+T%m<nTxt(Qy%5k)Zspa+vhHXAHd@{$uV4>&2}@}S%WI9K
ziL+3zb`O5&ou=ZLCb(QT8Lq4JTj;m=sRa1-9$&l<jjQV{3ce3X)r|cYn1~=tAkGeh
z-l|ecab~GR%Jk5vG*gjk?3Hr{Yu)-$x6z~3vOkp(JnCMal$<>0%FTC%)si!FHpYSp
zingGhTPY7|ml5S``wzEwz@xd6(in5eU;%qfFnYr#k$Jng8Gsb7zK2DJqZw?Nwy063
zV#cCYv~@L%$o^!bzs0*r`-Wq5sg}CAb#Iiue8Ls|7+U}9*`V{EXTvr2p4r8ZXG1)+
zJerG^y=!2T<2=mAZJCxR;rQQ+llfICGxdktGCn@G_1B+&x!65n+yPK5U-p>3b=)lC
zqB9mdA)Igv$R5jhzW)*5Z-w~ZO}Suf8l}q#rgd`c3~&chUwkEJpjeqwoS&S`z08)n
z4COpGU6nE&{7nGi=FV%DczDZTPqT#A(2|ca_Zzf?<-sj(g>PT(I<uQ(34y;s_NMMD
zW4z^@7YEn%e`gWB>`nJ;Y!2~TZ=)?e-3*~$nt>sn@vZqsQ4gl-KoEzZYirBtO-^G&
zTCa4QrY*Twj#Z{f7vNR!H1dPs2S`>FZ3(#zcdP|ZP6BT8E}dB)0qZmw0e9I{=uU4M
zbgpVx9Qh>%XUe#^vHM2s4=Q*WImVtfm)PW|M&;{jCIFHZwxh!c_2g=1{V7i22O+G_
zyX3bM-4NwR>M>1+#idZsX^-nwz4YTtRyClxXR<mDLXa>k9M!s#5H>a${Fy8e_>P69
zaCz0uIriUSlb<&EI+mszN1n?gO&apJ_y0c_oFdYCz}NxO|HwGv#wGHWZt#w)FWq=9
ze*ufE{b-I^XuaYruPXYwD}GQ99`=86!7Dfa!v)ik{$E^hn&wk!V5YerbzlP~gS^rI
z^jRs_GJnFfWMSay+2vVHzf?bbWDVc>9_Kh-5}uuXu+bmH8FvWj#rT)qyaZs=eU3}#
zNp?Uvl1VvDw<mnV{AigKJOn2iAE;q0VkH7k)X#qR;`~xMWjA;>+Htlg;g`N=p<UYB
za@6U_dW)i^w$rdUASv7kbpzj^VJ@f_x~C0!p_m~94gF08G=RVt0wE(jm5y2`C5_Y-
zAu^Mh=PhTp4=q(|A!f9cLMB9N_BYH!=(zEOM&4l1Ymd(YXkvtqcCv&Fxt^Eeq&2Ic
z3`l`D@Gj7#YJ(>xF%Wwh70pBuuaJ_et(q=xBMmbz@DC>`bS?}|9_7CR59HgTqD|Tz
zUPI>MMeS?w>~d^hi?x=x@(N^|mCzX7zbhJ#s>_8c&92K|1Xnaywzi*UX4OpXRrZn9
zvpP$ito&$vf+e-Vkribc#1)b7^7D1)=Ui$BaTO2FE*wa}IM%gX-d{Mg=X$b(gN2Tb
z@Ggt33HTc;;)=d<-}T`F@H5;p39fC8jZh2%H`!!-r5mX&O4i;N6rGG)C*bg7B%!js
zoltg?<U!o`;8ai(iz9L0A@m&W%&iWMZEg%M`Zv&r^4n2fg=JeuEN0^GAw*nn%V2b^
z=tBkyx>n~QJd!^cdJk5<pU+wA#V=YO>#v<3$&zv50_Q{_$CUj(fySD6xH8XWSQ)Jx
zzU@GHp--H(;5XZ{(Dizr3sE4gKS7z~^bDML07*D{iK{?VyF8HB2g!I5A>1F-PAQ%p
z3ibJ~1e-Sxv2FrkBp1E-RqsGP1~v$eCvPRLYX`z;XwOVp{dpRk9_jtjp7O7hYd?Uc
znpZC#)>lwqShRzg=A%y=mf=d;f7<>Xy6NF>S}3NB<7Sp{6E591U$Mls5ebSoMB0dh
z^x(_1(c|C0<|*_TpYzD*+QJkr8%LrWt$n%NkCCT$$_!024g`9lP+Vwv4E$>Wh3WoZ
zJL1z`XFb`+Z~+6-J$li@&3(WyBCK_57Bjyr-?s7Ej1hS1%dK~32e{<sjOKT`VNbWF
z$807c>lP8OMQgX+OsWnyQ`R-tN6+9{+_$hg8?5Y8pABsl{Gye=0dw>##;|xMG83|P
zVaRmK<!*WtK`r}Ei|aOHlNVWnFX65OiY)YE@GN=kWMACr%MbvXej*Rnbk4Wy=`G#p
zVbs`*hJP^IK@A{P%aezzk;g-ozo#&_<|z2%=0$I8_<r}Oyan8T)Ngpz9T|AY)o3aj
zj15y9FUU6nafLAQe$SLEh0v4qV{3jUjvjk|WORrunD^NX95d}CRvhBEA!(!8*ks))
zPEfvR=h#{xU>GfG1%=*SQ8u3UH!E}Y)Gw=^uEjL`xB)3v4j{g{9&WR&rJCQj&t3Rb
zcXB{4qlYc4T6%C*Q%&lr7grh^%X%p0RS>g3X58TgSJLX*RW`ivlqDb4R_-;+F6s$l
zlvSv#S9FE`(O2DxYM_OCucZE@ElWtOZDsxC2VmAqBzC9UMJhglD@O%m{5ye|{9B-}
z7FwRU%{-?udd1ubTuw`C)~foW=lk#XNGjomR+V01v6E#BYe_51k_{S*rNendRL>GU
z?QRQOOsp-8Tj3Ik{*kS12LAd1tw6P83;LQ?la>~(J=PVWK3DIO_Q85_wP;7NC`X_i
zCw;~W`(w+2nw9mWrDe=@)8bHntA;j>T{U_eDos;m55HH~)G2M3mKME{-&g*chaaW8
zj5cD$9FxKl1H1sW#YQ4vv#GVr&aU1qLhUknM8G;~?FggNy2Z+2pMAMi);4llQ!4og
zZ(#Qh(v7XDWuZmWgqeY5$-y{qN5IN<d}9s`u4xtpP6{g0QcWNM4f#})P9r=Hvyf2W
zR97k`S1QhFOXg5+DmDjNDHU&wGZKr2$I`N<F^!gCsQv8@9|QJ+h|<8zQ{y`NqnY_g
zoqzElaa!H)k3TQd+tvAA^DL(nVxuormA!aW`?5{lXX}W|$+jDpRkzy~eJ=uJ_LOgK
zcdpm^l-$+(OVj1~<Wuc?H}{$QT-OE}kG%c%uf|N~3J2j$a7~kenuV*Onva^y27Z&x
zfIS&ITR(TYHDsJS{nlfl)xN)SYBH#n1)tVQ;(BP}L$Zk0N~d@?=Xwx#3ID6AXjMx3
zzKa8o;4j)tUz|G`OIy&cW0OME?Usy>^zXa0w^BiKt}a(poB$R$<RiCV>;?}U_oa^u
zBQ3Wm42SXEaX#Fk-!1*52>X8M$@auvL}b*4WNc~0-EwcOgQXi2n`d7$dKbfwew3Gj
zeRnb}pFmc-8Ln&FmhKkZ{n(caJ}-~_XB++$1lnAyy3FvLtDCWg*z`#>bNOLD@~1S2
z5)A=o!F_b5oAqvi6W$Hxe2uZ`hu-M&pBLrtu-)8Ltg(tgW8?>N>jGI*E95wJLm1uG
zz5j!2op5^vbS&~MafX!kPHT6B@EYI?UJ!RR)Uah5(|;%;2tv9#*@wBRC$8rlVY%%W
z<9Ik-6XoNFe<`eY)iHHNEL4aHl<bs-bs7XhheyD6*o|in0FLHn8~90QE5cnzZa4Uy
z1kmE<F}dv0!J0_xq{#tcQ4gJE9JH`V4Egs-MarJnylz?3jVykspIEh$S^V~PVV!jC
zAsFL*(_3U8C7r>D4}}HMjf`$)(#;OPx8Ro?Or@~PN~KrY5#eoAxFFVuDVtyYADroN
zLLfY?KjCIWTcVr+W^a)o`qd4(Z;NkZk>{cnYQ6pFg5+5|`#*%HJ0HdhwnN!(wBC;k
zTtE`&dwtN}`xd^$QD-KR0Zql1-fk$oYLBr3MI9RAdX1g&0F3N~Wqv?}6dX!$<YC9I
zZALZ!CX<e&Fn=qo33NV-0vv2dQreGA48B*5siF2f-hi7f_d^HR{?limVC%MWYtKam
z_sMflrmvrJ+LYMlcSc@%;hf*gNw+4X8vZCGptrRi4o+%u@&P-k;@lUa_-sI};wl6a
zfP?!`5r`C|=eo~@{ZJ94_c(Q?dYzmCVjvt*Lb>9yfrQIf&oKLm6jo6|oo|ZOz5BGN
z^neH0cRS?bHO+JJCI`>Vnb!gPu}G6f7t=vsT}xRx@fx$&;n5A<=HNpy<~<`SXn_e_
zKNPsa4Am0$gH*4Fm-aw{dUrYxk{%UK)%)>r#OkDw@<iA|eW#1;^D@E>AV5y-L7Oc;
zr@-H}V;_eZo@xl(;}XkDBR~M190?Uxy*M!ohffafmSovH4W`on#x@DjPDbZ2n%qo9
zbMwFB4(~cg+6%>cC9<i~?+vP(HO)lqAKpi1n~N5WfxjExsqT7X{$q`}wdPeD0ZC;4
z!ZHIg#8PJqPR*7?G&rchTJ@*f7#Xnax`}fTb8VY>V~0Zm3EI@Tjxw@}%@t@!ut_Hv
zC>(&`H24<6If|^?a!n-8L%_Kg`Xd_S9Yqepo4sTHZ>WFH_ygn=Y=u=KngkR^ep_#d
z42~*VUvF>SeTf@s&-KiNVm(qcW<7V(&OPV=4$-VL!suA$`NO|V4#b{XYq;VWtwy50
zgt8Ah`1pCVv4Gib$||st>puayn@GHB216eKZZ4%HJuR?P=gN9;iT7`!ToO~dEq6qm
z+mK`ben-0hgi~zFD;WVvYrQjvPX?`gI1C=?uI=<^U*QBufr73_?i&d^t6sdu1`02;
z;#GJpkO*7Mu%lCUbN<~@kF`WLLZB?X5wjb>Sx$MhL!wyvJu8@X(vSe@xOa=SSMr0d
zESa^D$nKM55CZwAHmT@wao&ljZ8Aukj}`(op(bTu#=V&&D31z)Q&8Y-ecZ_WbO%KR
z1@8OEIMc}1m)?LxxPfM`I>-t9Z4RyJXITJ!DeyHhHKzu9DEQhn#oVDrnKkqHAMxLC
z`6`ftE8J+EdYQ#XTUeSI9vzU97N3DQWcl>#cJaY%Gsf}3Ze9I9tH{9;cZ|8W7~a8>
zCdvp%>BVlNXCFnBv^z#u8$3)zdqB?uVui_O=n;OM^&OIpmnTfb95PH~U8&p_3}VS9
z)o6f8_yT!gn7nv_{X>Bf)Yd`b;|n3;dakoq$w<i0?+GD$UelAc7vRS|Kq3>66`(4Z
zCS8BbqCW_p>bCvcJNM|H$XO+3kZK<+bUZ@ZY&P-d*;w#v15olkyq2X`y!7()BT=f`
zDsqs{+n<9u;BEWS*p)A4tYV15g)QqnV60-Ep$1yOeZ8m;I4*rN<E$(EI@_WR#f*#W
zDLw_eLBKY2cUHi{CXBkCwa3oL^7L(QoI7V2gzv}g%|0mD7E(~-lexhdWQzAS>n)Im
z6U{?-Z5e@@x9~tH`pe2~L=at=Rjg$@7vn_0ub$KjCx5SwAAfGEKL(@A(>J~G?yHcX
z!e4)|?trE3eja_n!M*mzUw4rc014Z91(>034iKoij;59yEH}ed1;<v0#F}}0V&8S_
zwEv<4tFpr$uL}ZALAHpj=|IcOurdmQAa>jA?Qc1H8C1vTRp{twas3V?U@w~>SUZ2)
zVs*68C4Xh5D@!fW|9Zg3uPX?g+97)9D6-fjgy<?8$TN4zG4l_&+ROt78xoS4Swo@K
zVS`+_jvwR{y=RGwJc$&dr1MLhp)!;YMA@b7kjNQ1CHcda+nOhorOZDW$n3&Hp()4z
zZJt9ua(s}H>@5hxM38$!QWuQFy8XLTGiiXy=SOB$5MxV=o}=Q&f2<9b!A~>SIa*-i
zxlvxMH3_i*O87e*kO4UPM=Q+Cv?K=BgASg@UblB?%ni!kOv#tD(Zy39w9;j%3~%I~
zYV3*Baow__`#0k+%a79-yaA*wf6xTa=!Cm~+0Vz%`A@{ELvs8HnDS(OJ@OmZ6WZip
ztgUs9H0ZR_LSOJBegg;mp0uEsB(A@!N(5S1Dq)_FAqyU@`#I(lk&w&kR}fTv06`EG
zBN4gH1}~^lzkga?10}(4qkcgVC|h^rz~GD$a6Sak_1;h+p9`ev;g)=*MK_<Jrz=ws
z3Q6KIuqy+5XBFk*jC{kzWptagl0azJ9}YR+s$Jz*=<2}MQndkvlM5->%3>hYip~Eq
z@+#@DvtyyaPM-}l>yZLAOM&qk(<k-ZOfDeh&z_XTIMjKHywm@xC%O%5a{i=2`K|Fy
zSkOlLW+@Kyi-s_i!Kf>*a!Q|4E$Wmezkr(S>wDE}`JgR<R@Z@Mi?*^7%B?Nj9cWxd
zcb+u4SX+r)+h`I0TqS*C*FhvN97q8uQ02iT{So14<kIin*v5_V{1kqI*6^Z@TkjSu
z5E%_Sc%mVa?BjA|bNZeeMp4zKEh7}a;#`C3t2}bc=)zWP%L-Il+s4}H)GU}6v;$S<
z!@WnCu&?2hdK!A9`LJOr&h8B|zGbK9{=SlGKcxe1GS5P84*GARCQ<xX@GrzeJUj;B
z;1b6aViXKNA%<)?cr%c4gJ2Y>SeSybaKK+pAv0k#5z1Vqq<Vz|895D{!7b+p@>t5K
zyQE%1(PRI1-1l&z+|2@_yTHue%)bo6f}v1AP{XrerhQ~2#7Ut3dZ~h-;fb0;fs#qQ
z{QO~>{eH*CM7vXFw0A_i3>3wfKiN-A@OvzyLD7A^4MxZx9HQ8T_bj8B;l17@DW;V2
zl1R5yhkYg)jcC8n4aps`W`I(FtQzf2Qi3~GA2{VfGYZK}u>oO5ycSqN`7RjZf&@X$
zNQRUh0{(Y(;m1@N5PzuvPFWDEtWp|T!56QLQyA~Vl<maOPLgQ#P4nqWK4vEs*G5wK
zu(%Uy^_5x>OA%5o+Vkmvjcdn}2jlGWj?*%>li~)CGgKI@a^oB!N00!vWxPJ*aifRy
zS^d9oiYWO-j`SH#8r;#-v&RM)!DONy(NG3?Ec6-Da?ScvFQ%W~wq_3)ujp(hie&>y
z^p=G?>KfPEInX|TDKmKAX{cFM3JYWcsz`dke7g);erbkW+#Oa`kPGq8E?ITTbfG-U
zZ7WKe2-Ti_JY9f}IX$G;hsX5*yK~V>{V3koncJ3gKOYaZE>!A;JhF&Xk&9DP#Ly(>
zUhJcfOpOZ{0}GAD#Eg)|ytN9C1hjL*X<u5OATh?}_t({tp)oxK8tod^GzliK+(Tbd
zelFsxrhR<SOQyqo2^RhB*@ykVBL1+G6->O7+E}w#PIEygKlC8yd0CYGHJ)E3gYTTC
zy|%IAx({NwraxDUEQ<A2+58x`z?(9k6;D*A_m^}!Ke<$0_Bef4*<4rCYmM*d#db&g
zECPB9tp&jpKE#Of?l!xt{@b}M3({TabYVjPt{{u=p8bITF+JVjO`NyLBNl`W{fyLt
zSoCm4rsYn#VTyX~vhtF=McDjRW=oX%Rfd022E4wI+w@iRNO8GBQBB<UAYQ}oB>z0x
zOt&_7aUUm~A)MjHUPpaZK6XJQ62*H>FPu9m!L<uKYF?4(ZB18CF?bK7h;WAQ@EI(n
zcJDo{sEgjwQfeF&%_<XaZ%{xZ(rgPb-Fi`(#IuibAWkaX@qnOuMY8Zg65|P!IZ^t4
z&Q(U46b4!Q^n-dIp%`wySKM-e#~a%o=P0`S%`-togTKdAvp~UvoTo6m)T6pjsgjg;
z136S7?gT=;a+IckbV%Dpy!-mf$nup3B#c!qMxont{I5nlElw97ZWgD$zPcPO&gU!!
zo7uHhRqBAE=6ri6s6Bf|%srnz4vbjd46gxCRtY6PRo3b~|AhmVL?Ngkl`@W5N+=P*
z>djNd{W%L<Q5KfBDuZZSi+xtXL|xV->BSe%^W>M5AaT^V5EHRE68wRLxHq3L1K&+g
z<Wy9T8K?A1oasFM*h<fhEfBBg)EtmYZ57|(z%QD0_GOpN!FoH7qpP_S_hHe3lz@c7
zN5LQ?W<<O>4cU`z36S?dy@KjL!rRW$R|q`g^MiH(%(@x@aI-;7Yl1O>6+sV?FZ@qB
z1QHi~ku5;{s|OEc;X_`*y&Lp|I^I7TZtN;CS0Md6XEkkl-?>oASgR0f8l`H3MOtW0
zu~q+X!{DS{i<qD`JgxK)`LuzjwC4sN+nZ?n@y1=@j7FC*%njH!3X}c@w;2y<E3X@7
z{f1@&lPiaKf{(%T(Cwh?8=hYraukU7(SW|q&!pPS_uBi9K0W)Pl`Fn`_%9?x`|-pb
z`yg*>M2mAx(2>T|2wene&pK3n)bj<WH*miP2XnQ8-%fgmKppLfO`?6uz->dIdX=h!
z(T3{!*u~Gu$VwhqBGGb^8LiJQp>tlG6W(5rbfYlh#Bv~)$phxt(x53mMD(!M*@TmR
zVlL_&A+`Hu+-m|tSe#9+rD}gV!zG+XHC&#MvIv)|7tW-cudO!!6*~<n9d-RWeFW8M
zlx+YIFWKaVo=HD(f&ac7skeCN{8z2p@|jWbdjnLb;gM<J>v<)6&2q~m?%3pN*Rdg`
z|H-1X#l++mNZq>HpygU?vpQY%%rg(IMHH@$H2L$qQu^Yu!-nMF_`XKtuY8AX)1Yxx
zYxlx-B!bE1oz{<VHF+rIcRB3Nrj9uP6}J+aBH#@5G2fva;BB<B!Y+%Cn^9;W<U?qk
zQmC}I9y>W&{-)4LPB6&%<|{C}^DG>kDl(E?gSN4ft@edxS11_1Xu_%{B-Q|*03{T9
zGp(W3jZ195TBdaRN1KP7+WO^wpG!V1JBz}_)TW%icttfL0{*Y%N(oF~M#*~1b$hqf
z?3Tw*(9K{#nbo2PiMDG_oAH5Bapb`?W^H{@5^dpUq+e}Bs}}tYB<{nfPUXL%F`KM7
za*}21J)bU=sOQJTVkA#l@(XLnnZB*-A!l|I(AXD7i`b)rw@#LPVlMHDg6Md*B>Wo1
ztgk1y8mv{`H(o@m4ZgfWDv2?ZM5i)K-}gtxa2n6Wu+bze`6MbvbnRI>Bjf3MJR2;P
zftn-BG_8!|Uj9YP!<B!PqX?m{%W2OmCr(kE#sLg((0Cr!X@qk*4UO4T+FKrt>Mb7b
z@ZlQ1_@#Q-c3vZo=s!8hM~uTd7m9I)!jEV+>n_pRjQ1nPn+h)O+zlsBzHU`I=R7F7
ze`dLlqE^_&MN&JF5Tmre6Q+?IEBsy$FEC;^U{w`;zd@Zi`wVfyh$Wex3SRPG?m+T7
z{K^En@=UV2U$P5M+D$)i4x^0+KGI;L(+HhwFTh{)W%><Jx`3?h8U+tV6k~U>ee<ct
z*k9l2K$H7n*%7)3Mfh9iiOl&&fxo{1tAty<FB=?(_Ku$?LEJk$hv5kPdIvdJQ=*JD
zu-zcPVkbv{ZWxRR8`@rg9uu89qx1u64J2A8Kx%&ptIpDhnf3c*E<rL1DP|RNz+eWd
zddG5*W{8rFl{m)kXqY!N3~u?y$KeV@Qwgw<bxzVFWyr(bFoMmGb^1G@W!*c^KKYS0
z9zZT=<lZ}nJM46UH3k=J;*AkcLmA8r-ot&q&WG6q1JxP_Fm<CD#rpONT7r2?AVomq
zA*zefp7PBwwX?TGh(fWcPWzh()4RFI4`m#_cH6$@nEIr0go^LjeTj?l?Ch$Ae-udW
zxjqzNgT|8tc!LE)b+8|EY6QPDU_p;j8&c7mUeXeuvOXjMd&8+%x9A(p-55jzF?2Kl
z+0k;)SfGFy4Lg%{xr2LvtU5uF(cef&Zo@Y4gj+C1rI+1wX3KMH-=(B%LQB@%36%uf
zx>jzTRQ8WNbo;`=MgdYAGxR@rH27orOLyN#<0=!K+j-)D=9vt6%hI5)xsIOr!-JLZ
z!fzuBp;#goKW|gr4}TbF{Ql5p;bY)@2t7(7Ngu>_aSxz5xxA4(TU_4>EA&*~W>WMF
zAMH0#CIyl-@RI<|G`-Zp>LEmXlq_{@=U}BBMmcF&Kvpn~R)drF>n+)<yOPvp=(H9i
zv9}{T!8$a=6Wgce71CpZVq+SYN|rs3DJSm;>A{0?GyBiq_xA(a^bCu_EJIdi+xZDM
z`29NOu)mGR3pgVsky{m$iu%mrv%3MU_5>S0sQBii$M~Y`5I}2kP@`45b9rD2>?&?*
zU6H_Y&^{DSH8ljU`=8lMLFE7fVNDiqIrLQtE2e+5*+D_7ar8&8x<E5yGpCv}u6@?J
z&nB?a5OyhN8Ihq1S)uG^ZdRO2dJ^dsaQ_oH)IL__CGqsrY`|@#2W9VEJGrk8guX?2
z=Ra<LKQGb;Y>67kbUcdF&(b9-_~UGYF_V^ymWo?=3A2$~s5aE2m7H+n_x+en>|c8f
zSjZzlJ|_-=Ob{oFWV(0<SgxKZYOx7!(KJS)w(I#748qw79t63(LeFvSM<oN!&Q2JZ
zy7-yFjHsC@rG`NuWua28JZ!pVt6YuV+q}P`0EsAS7J6QV(lJDM>W(anBYdWOY<Szf
zE#_7lw`HYo?KN0OZh<E;^x(ixVyV~mF0YouJA2t^qZXIZwEX0UbrrFyG_Me-FS&W7
zIYU&!ns77w|C-E@5Es^iqcZafqT9NJHHbAB;rLDcavLcTF*{`v8*owXw#6w&b4|lR
z$T)uyLw*>9Yxmq?efkj0oI3=7#0C6~F3V;Ta=v;RaQrkipZ4pN7*GFbai!*O_j~#N
zs{OwI{_^|I{oYqKT>d9xT$kI4q{koP$xW7!s+d?u_<Mt2;N1^j=ALIvPe%uh6D(&M
zM)brPXPRC_RH;|v9JAX>d%^*|YL!5T7NIY;fJuhV*k-lnkcyxSNc|TB+NV44R#w-<
z7}<N5*_pjZ-jAtYsC(vOr3XP!!?N%d4`?;t1-wj?p(*t}4G@cLC=s+IRs#}pcNocR
z#|nRg#6E+F9+50AWmYNex?i%(QARsoOZ}w<0UPbe;Gn~>1~YF+TBucJw5wKNB?m&~
zsoxYf^!5cm&p_iNqbh5aXH5Wn*xCvkEv$7#Ay<nzWzD`D&Q@*i_P3L2%=L6nr=qHI
z*NX>^`Kv9?%?GN}aiwf|gZanAbF4zm+P{H@4r*-XzcKZ@I9zPQB{8<zjP?9#@C9cT
zR^<n=Nzck6^P(V06fxX@d*C=FAn9?Z#70>Da0wC6IswLvkyCtf^YjXHO@zK-4Q1fP
z@u8Y?jTIHVBdnU!w;X2LTE2AVL-D{8s(XE3PMY@2L23NgRzoCR{SWt-?Ow0)(~PUK
zw^U}%+*JLk?snpcnx3p`Z6?qf$Fc2hpd*ZkOrOF&g2mdGqjMr%V5L3q`->1NHsOgQ
z#CUS3262aHVaHX}ugkQY#__HQ)N#HBkq#ZRY%u7MSli@Pa&kU}3@O@+pB9(yrYn8{
zN6sl#DVYQ<Ge#Gj;%wmVdW)?GSBq_oK~Mz*`PIsZ2w_J~jfKo|%dzvhX?Wn1C-&Yu
z04X^Nx=r0DR9&5Gs4!P@%5Drqw;{>;oMde-#+nBA*8D1uKQqh&=(X8S<3O;TE+A5)
z=t634B{L`!^MEPRCzm?`2or`tEhPDs^Uc^BU<ag!d}k|ICNN$?JKlR9B1$l24A;V%
zNM<Q>^3e0O&)*m<5)Tv&ASbf%pI2SogZd?8&Lkx0GSI+-)O|>r)Ib|i7!6G%9*eJa
zfbw4Z{USfA3lSs?Hd)w<D4-Vz1->2TW^XXT7uAL&3}nPus+<CBfcGwjeJ`>_2_a_}
zOizSH0^6VFaqdnUHSjOZ7glkUUb7W3x(GS-Ld~OkeSQ7cRha0XoMfJr5ZvLvu(GpN
zutV(%lTi%}N6es4!S+P-RtBk}E?lIiu1K;stlB$7<Ng@Ta9Hsiu~>QxiF+#}NTrU9
zA~ZZ}2zn1c@ywCTE51Z&W?FOtsR`ZUXA+8N=}FS<(u|0P53&DFvx=g=-{QU>sU?Gu
z`W|KsVj%ZWESJpLXqWENF4O=Eg?AoKa8@*-*9Ma<XmE2BZt156+l#73FWn_RgfBag
z*KUv|qqX&Y@1w@sdSC`;p>2zpAY9JDUm%uDyVpV*)Iz>0K-C*NwJ<5Zi;UwpMDXLj
zaAwhov|(|>EA;$lH@8eN#@|c`B)6+efN2QtFXJpR+G9-N_}_Wq)oP+Ll>N4hS+O41
z73C@0bT40gF@*q*!^_IGHk=Kt?rw5Rsgn)Tk4DSPLvvid9$2NP`M^GLS=HeiTh9A5
zu#rkR8AoFu&L9P1jXC5bD}tTkLa%@Y{s?6ntJ`Kw{9E<7Qi1b@P#0?sEm|cyPE88o
zE_Tefw>Tn_)s#Nv^cEH_-WV10ZBp}92$XK&E9ggG=QLY@pc!S)bxObmhaIT<T3!mp
z_bD0d>IlEc3zGwE=N#wmIvY%5yOKuke$7ziH1qI&`5?(Pf~dCU;q_(i-SQJ3mZkSQ
zaT@e=-jj$AL~L{|=7=|?faNVk3&$2dnDUG2TXk6}uth_l^qoq8WSZqm&Z(ycJ~KRS
zq<H;hG_MWnrYozeDxF`)-Aw{jBLDY;v#!s=c>;}+f=_mI`jJsc86TTXs=){;mzlA$
zI<K-K-saWg=r#qA#s!k&V?A_+?<S;bWC8Zd><EUMcXBkZu}s;IW^trl6z#XQ|3ymI
zL&B*3)YlCs1?+=a&d)B<uBa>?M*bQ=YNgo_8mB$9P_T0UYHiI8{VB!#w_}jYyu~Sx
z^W8b5vEYFaMB9@Df=#g?P%#wAyEIck!x}Ly7UA#%Q{1ZQTU45S@0BdUM~bn%vo+rk
z4>EXiO#vA9{Q_{P)k)bQLeP7m<W7Ob;JF>tJ02uFeg|;C_>n~}?RFTK4`bGln^j9?
zb-o9gAValS*#+#kHV{{bum@`Qi7ntP@;r&s?&Q0VAfW+cJU2V#TI{u1vs82$IvK=m
zlCpa)^>XZ2BY7vG`G%WJLl*!eQ7V2pQS42o{K2(D%c+WP5<&xd&O2;iPzXf$?SB$Z
zf=?s^Yu;=VsM~UqIlJMTHQD3eStt(BpyCZ|#v%U-j2d_(YFjM%j0xJ*vT|$J**uWU
z^mLXescpD9&d1%IYdL<2)woqY>FB^OgjwRS(xEELgJNOoL&g~eCfD1cY~v`4Z|}m_
zz3#JFzDE0i&UKPer8Ab}Zk8ae$WUfWfN8+}_CJma_5)_{CxUZ|4{5zoHJ4-@MFCH0
zTemoo@$Uvl`Sokm_w79^Sp9a1i`{@|XP<xF7#=307DeHUI-9k%N)&Rpsajr{o4<q(
zHNp3)TdbUoz&Pw57n==WK;+T(;$?7Q1Y(xgOZhx=ZHwdIW~VK8cT;~IEzk_j01tK5
z$gj*$$6HcyS7450vKV`iIDVf31_#4>mTe5Xh~wkr@7`BVjRdzw6cRK{n}=d&W4uGM
zaQ{@{<6~w{oj&aBTwyyjF7VE)Od@c?b>#6xa5U_IS^i&&7}Gn;#9;?eBxncNT>N1#
z_xH|}PQG$?Su>|_K%`UC>;oMi`;56Nm-H0P@i7lUgfqH0g-com*&_>TK9f&Ak-7lG
zAMy?yRk}D0r6M+>z-poq!AIt?gJAyZ>4~dpGM9cE)1PJMWDe*a?4j`JU+s<!69&vQ
zJn$G<pUs~$UD_`)&{I<h9tN9UY$l;n9*CO$cFPEE;eL|BLliqejY{<S-<9N35>qCL
z6Hv477|^C*(=HO%qp&m>dmlw?t{1gRF4A3U9B}&*1ULn>RaiWKbpkfXj=9pben-!0
z1G7Yy@H-R-L(6`2lAsF*ssQEN477i1OF#g$N~#1REjNmK(WO#qT^um+FmZLArLrJx
z3rL(n^Dn2apNiW0AF)7-e}1?45pn0Ynrn~xHZL`*sV=nfUcVk|0+h<jD&SE<!15@8
zsoX;GG4=4)ZT|5nwW&N^AYjyZdG-dT^888AJwq+}z2ZZBwHsFtnIS>}77<&9>_sBl
zBp$XxzvU(zumby<kGm%9PUyd+_8u#N!2JlKi;T;a$KoPvwgMYt=m!>x50mP*5rES{
zN_`PhP#2ta^GD*2UV0rGkWc43FpSKLZ#tGOQWvP(BL^aJLO>R$fi{m;p^;N+tUN38
zQ+AHRmo{8^MpwO;m7j<I+`&P;^l#9h=smnr09@Ks*(#PILUZ{98jObwDp``g0)XIZ
z8M?cmC5IoS3_7T#20~_0Km>@00WFqzrjA%p#w)Bp4v7LPFeARd9<+iRy`_avM9zy`
z6bxC(JQC6SK9Jz%r2t1GXn{)<L?nSK+cJm)#1`Tqw+WH2>?Mdz$-J0?b=)@@+wX^D
zc01q@hXM}p=aT!Qh;!I)GTxzjs$3i_JN}Ut7+y9|5^c1B;Eyk45?JFvs95sooMbMc
z9$86UuO=A5L?j)w(e}C9=@Hs<A(s<X3hg<R2+dd_AE0o!!5k}(HlenQ%Bp7;6OYke
z4!oShbT=K_s%QJf`^o@2GD<v$h`;f)M0VDoL&+YNOG-ZMFpxk_5G$i#w+DEp{W#<x
zy<pM^yi%;rp&#)w<cZ@MT1PhSZbdZ*%CwnClcmu>9gDGfX@zaZi#PQnHlVmi8bb*6
zXyI{7-kXnTBlofL3U3Kc*e)<MYuT?7MT`~Z+*<YSRg%^Z_PBF6mntTSV<ym`?KKNk
zr9x{34K_*dtl8cM?6he9^C!6io61CKd9-Ph!ZkVZ221Bser6BL{~rMFKoGwKa^?mh
zR}3|h8~uqb&`V$_Dai-Fu>3YouS@7&1VKm`R7vaAZgQZNc8a8vuQT$ko>=LeXIuIc
zTP&BA)2(ofJ7%5dYtEBb*2+S>W2HWW-KcjttG6>8iZoZ7%GReb99HU6F^|8+L4>Y@
z$a@K_NIVC45olxBP`YkR>$HCIBxD(7gO!gXq%0}ysu`1vwn?kfHomH>e(q3Ox`V_{
zt!nJx0ce@@exG#rcga=X*1Niy({qJ3TDx2Cm%p=xTg_kZss=iOTg@KIfIU?L`zr?8
zs|Px=7=`1%@(@!%-Eof6<-$}vg%BN6#nG{$DkdhXsbH!ps;UyIIjVMgJT=1TmAn$`
zAav*Fzr;D0i;AEas5^-{55u9~7|DWg!QEmfQILT!1=1aN3A~-Qkr#nODX!x}F033z
zW-On^ATe_xcAhct#mIr_&q(Bf35!KHK^jLwyvt*#3jk?MrZ9;-fz{5r_BGYP7c`2)
zcmm>F7{}LqeAiKY8=-`&XW@}796?B9rU<G*u?bJ`L7+?S8bU;RA3`b1xGW6PD-1<s
zH;VE!h6I>?O0qniQ}FbZX^lEbH0$_HU*ha7EopW%F=Lr-x=9?W#+0#U*qC_4fb?k&
zb{tBvtr^U<OzQh%r<XVmEpc!;cf~oYeiSYwm1c0}gy1R*MiVrT`1!!|DERvv_*vf4
z0mPWPbW+|>AH@~GFN$Y!)XyG}9P<o6JD?OJJG~@n#=K(cF9F>#V_)GWA1p77<lkpE
zn0-rXnl$kly==DiypRQJ3)rjxsfwP#ompI^K^#3BJ^S;g5A{D3Qp3hH8Wo9^1Ic3n
z!7*rj7>*vgL?-uyJDZ@ofEGYDH7=Z?f3LD*HK*OI&V@Mm<7UZC)axP(uC2PO1DOV-
zE*(m@jAe<iIUkbI`iAvFV!I5!Cn6*+-3#4C#FTmMCB)J3Cepmly3Zr#w^1+bJ^^9Z
zIay(sxzx3M&B2Q1GHiIBg59yBVd^=KW}8%VPRoFlaRq11_6o6{f;r^U?&r#*xe;!V
zN#?h$4U}XBQw$7DJWoVLm@l^r$#D%{d7{kQ_%?!MjR1l8M?$Xw4|{|@l>r98U(VvZ
zkSI}}#(yKx2z?ge2*U#yk(M-J`p$^x6|1Frvd6@<blaz<iWOT|uwji&Y>zzy+nTTF
zp0AEw*MG#v<SI^tjr^K<NH{px<ijn;<!zy*0O>L<Bp@`4A%L~YAs`|%r4-2>`AZup
z9EgLRf>rm08ph~@I3Wn5H*vB!*@NO~Om`IB#fAg+W5pww82T9No<%fQ)l{Z!^1gcX
z?+NfZ^;d*zY?fY;!VjR$Bhq*|N?d~C<N#^aUZo%s>Q2x-R^BcTis(<B_ARQo%%whd
zY~99&4k+`kPOz?cu0<Wk(CmBQrB2CrVy*rX*r=NGSotDJ&G(Xf4IGSGz$aHxZgQJA
zmKt%rQ%0%D<gJOX%{LZ7xvwNz48EL+Cz7WOuU<+1Yw=L>U#hoK{JQ43<R9dV`Q>c*
zKs+{@%ELdgg>ckZvnoy1l&I&iE}jbdQ}a|vf}`r7C~Ok@HJ`GSJ1ujhzk4>^cX*fD
zW7j>}r-)G3u}xjUHq!|_MLKp3&BwOyjSa}0=)2paJf6~1wC3RnqT*?)KSAyS-H=q|
z0B^c4!*x+SQs5>`3So*T7$~Kl_3sv}*7Cdb{hp<|uOPIyJxF@v)Ae*-F5VJ<hF;cP
z4A(5mhVC~#g~cGM4mOUz<5RhW^ZsnDg#QfC+SgCxw`ZU+D96G}t{oW^717$fOv@bI
zPu8QbB@X)@2<&@cueY_TtixMx?>V>+PWS!@-StSv!VcB4(;Yb3x<aRIGfcOg=Dx|;
z_ejLPUlR5^C1AgM^7Vh*JO1&WXW}YOs!O~-8h71={%G9q(b!$64IKQLNS50Y?|wHW
zoIwWCj;|m$5x)yq$fcyUEK4iY0^ZK6$s}bWub7D2jaub;5FP|wq0kGNiqAS|q3qz5
zAj*-u<(Cn$Eh|nL$!8?Fte(qB%2@P?wQT@IoopJ1UiNd!WzyeTpw+iI{$~M=qwcGB
zwBh7rawReaowX;OcX5<|F5b=^;0A5SvX|=S+pBLuw)rePJS9#ae1R}JeKVrt8WwfN
z*ik9CrC0_glvr3-HH%Qgp~{Zz3QtLYbthAb5b!zTz_J0Quq|%2nFLuB=WLebi$Sfa
zVNEgg<ib!ZKkRBnU;s%N<n={@o=0EKgk$m|VX;3D-qFLI3oJ{N4#$6Divm)jutM+f
z%w8@GT1(X|)kGUKL{Pq_7ZMo&d#%ptYjvKc<ZARv9Z>3g7k$hF6*}+4WY;eLR<goE
zR%~^$&-m^B_3S_k_ehMoy*z+0(oa?pa2;Z}y5VErG<*;Q7<OGv!M5sXrl<I(X>3N<
z=lyK{xKRV}bg|frOd$^di+x+!6%@(+f!j6P)QO{Grb6yEW)N&EzJbTOZkq~GJ$<8~
z*`o!P|9Z5*<Ddm{@8SYS9u+|HqdIm&5wX4CvatjQf8PKWK<{fgH|`%&&@09t%JFBT
z4I$?%k><Q?Cg#)xOQ@#?S#tUB3Rg%<51@9KgYV+B7}NVp?r_Z+FAkW$i08<QQ55I!
ze=fivg8K?6WjG{Z7C<!`N0FSqU{5(%Vu~g##x8+1NarETen60q)(3ajO+osIf`BG<
zI)M3*vI5ZXV3>q1;W5q?-a|={6&VV;Yl-+kU1AxE?qR06DmHv(W8#|{Hpk4Q8X-0_
zPcP<d<rIiWfxk#)0c<5uQHBNyOPk0E!+OM66X~Nt`Rn_6f&OJqQUX3H42bL<2>|YL
zkTOv1Fi&U<<COn@JkQZDJTu~vutHWYvu<D^j_I<oZ`jySn2Qb7G_a$3Hr5n>tmwM0
z`M%lfg^vLiva)gaiS@C;5%HPyLp)t9kgDtzY~~6;Tj6mysvUCix4<8)B%pyMtI9na
zj^t&qy@n|B><IuTZd_xDj<NpxNLgNfS-koiFH)|x{49PS_2`TH`AVJ~u*Q1o+7E*9
zyMt>~w10eHjU!G&oY5m=oU~Bb-m~7dN5O0xLUg(?n65@uhnY6kR87Z*qd*=FUBy&!
zHQlDBt+7oh4Ii(Rwob9qQBeEXQcx=*iFPX}){FkfgN<LSUFsyJ`8w4sM`hUXbqyd?
z9qgEzfo-CyW7T1Xq4i?gQN*;8s#;<@wn^CD!#X}bSjQffu}5X>1MOM}kB4QPEvt7}
zXu~(#C(Abbib7S&6wFMMVZ)#bwq0Mr2JtORqm=n}4`+Q4&*h`BI-6Xbdpzn#!nm{z
zdtWE$aPQ_NnB-c?z2exP9Nx?+cs%c+f;|<tXI0<*92Wojh~0-6%>G@Rrw{D=yE_MF
z@B51|(oU9@HXX&b72;r(`eSSugkjh47}k8tbm>@8T+=%_4Ycs2dVhIipr2XX@V00u
zp@9<?{%+ul2E6f-gIwvNc4HtS)K-vZH_KugkkapGNiSW(iB?W=BSgYDnuy}iYrREq
zS(~IJnFbWmI8MC)5-(+F08SS9++!mImHCe%CQ$gwEnu|#;S1vEIr<|DlQIkI0!@R-
z6sJLUjZ!w@3j;N?c%D*#P>s_HP*@^r%>tgM7aBX7TD-m;9a9`R-q>~_#gT8?*l-!c
z#Pu0Cy!o!mT%z{s@WaT2)rsJwUy|vdI#$E2GTwHO&RQ&Ht-&YYeN>ads);v7_A`s$
zM}CZ6!j<q9PWM-E`}rCqU*#sOE}5+QLEaU0flfB}ytqe(BlMxTNY<7sZ<(f$SM@n6
z`>8brPPsg2>LFl~<pK_3^<BWyt^1DxlmiX;8lF8~`EW*(<4A`f^S@pkS~3iBHv1Ff
zG5BrCr8b^lWt@t3Z_XesNVLN`wF6k$bB(&L(9ZSQE!P0`btJ1Wrf|!^<UWubZjV;s
zo3fe^vZ1oPt=d(Vx0UQv{M@crdAaeL<u7fj!W~yznhrb3t1bZ|eV)%+&a~-ccUE26
z?dr1$i$I&02DIa-Mb$mW4J7|&FD$1h_86~OLQ!=(Gu+K=zd_f4q##!5>;Nb3z;eIY
zCtz;pdUmpMzfE1kVpPF|Y6LREs@U~yf)&>`ZPQbI=F>jN<Cx+S$R@R4*U0R>M0FP@
zpgRal-1L+#*2zF}n}%D2H(9$WBgsF4ovWao8fLS2nVKfGH3bX%TJhh5kf<J}^m7W<
zvF83iISW~j_S^#lZ4{|{5wsUUdl9sa2r5yA_r@en*>(e<_}5FY4>PN>dg>^)u0<5x
zGzr#R+sB4YOl&icV$=2wf9%_;t&kqP>R{kik|)Kb;RO6ZaS_vA;9+oMN)SyrM$S`#
zxza30qpr!Yt(g=XCRMTP=>#i|<(ek5y|J|kMy-drD*yE`SI2_6x?0YeCUj5$N-VTf
z-wC^F1zd_`o$;mom;w&e1TZM_o%3vmLG>z0Ag%V4q0eCT$WfBAjO8%(IfSC3M0gYc
zmIfet$61co^jjiQiAxD3fKi@-Hxn#IK)HXtR1bRbj090uG<n4$66NSs7{<33ufv#L
zqYpur9}jg3NJOM27pk$HN{8YRrlzZpiGjx|Gq6E4AG?Z6u&aBXJ=S$ychuAJB3mW0
zHObmJ-nUZA*)Hk3^c3TVBxRHZH$1&`!%wV8V_nBiyW$9Bg1Ba6fn0`2&V9L9inuoy
z_u`ty^U#BjNgBjykOu|kTj|q97cNUnN+!@cM^VdD5=22Xd5*5+Pep4~gvU-<l_py{
zhQad7GX^gH!Qbb?cWxn|(!M1zbf3o~UM6K+#Z4J<Sq6s+PF&%0mZb44fo%3EOX3vR
z0z{$(%H~-jPfD5Po3GsrE<)rk5|Z&dNld2<M-lyrtdJ}Kd^<P(cKCeVZJ-=BIJ{LS
zu9LSLb?q@xGz$|?(Sg^X*tW;u@@80y;V7O%`rz-T`DW>Kbx(&a&$GGdJfp#Sr?72l
zN4F;ad;&gi9FJ!;x#vi3O!cKOk_7%>OU4V{&6fP1a<;FD_w_0zz&?DvWGQ7)PA2TD
zTzGEw@#47~vH?%$G*}(YMO9>J3PW_RD#{3H!-mh|Y7_tTQd!Olu~KL`n5tzq&@~pO
zm8M04Q8*X{z#C6F(VPqvdQChe7YqHK7uvpjy-}*Ts(YhU^=$P<sgp`U`dtF9j+;HS
zb`|brYE{}+>bLv*Z+GKS+iSax`?joiu&U3vp0q7Nioi;64OUJ#qfdWDmjC*s<6WrP
ze2CQCzxa11=Z;Y(r^3MY<lK8zZT70Vf4yjrFR-KyF10$@$@*-tvF|hA(y(s>ewS+7
z*e0%nJx3uXwJeM3$|E)x!7i#wktgV_wCObz&NWNYKnk71%?6|;>tF>&unSjUCF&m(
zplL+HGSDBamdH=p-{&j>yUQ|mL1m(pt0B!am077k2Z*B}k9n3I&_Ev)Ea0%_7HQh-
zm=s0V9mQ70STkJ>-~|YFEW^f*&1_Beh|TCdAT>XQWZ5-COCxmVQj-Uu2#bMu197;9
z&(SMkT!-6AWDcy7S8==NIuj7ksY^Vtd2&TSQtGmK9d0*l9KGI>)7p|#VakorU5q))
zTYVaKoW|3@Z7R$2?9DiRY*8Ou)F&O^@C5f}oRZ<`%{WijYS)`_8mrTraSne)w${3W
zc0OZ2LvnASF!4#4?F96Ej7P5GYoDC<{6U&Fdt*@bueWV>A?My0beeooZ`(Y~^7ps%
z!$w2z0>aqaHos2<`l{)rFo~V6eUlKw9P0+wJYT~GF&TDs)5WUhm`qUsdd=@+(hnVz
zeibLLWJDfBRN<>Q*%`%nS`p|5QyfJhE@op0!=%279UY=FnQgh0Xv)~u4jzHNc~Gs4
zk(K2fmGMkf&Y<_wh*!iOV~ooX<ea!*Qn?8{mQ~iiAj)HDIFzA+=={7gJD#7n3n&)W
z9v;^#TY=e-AOib3IzKPRD$L*K=iJT-q0D)P&d<dF<N}<ZkI?z~pFe%b;HNl6=jS|h
zbUFhskMr}*@w{7hd=I~wv!p<0E7PG9cPnY$=}hZ)In&Z^uNmL}?CyOWeP(N(WtrF~
z4y5U&8g^Xb;4#w}ab1TfhI{DasNeNCcJ~UX`vd&x^1ZYPFIF-#qog=9H7@{eoQIfV
z77FK;grx!G1LJN31b)ThPv|NIo3F?nk9@|s!CwUT1|dWxlk^&LPPR*>n@rJ5RL@Y*
zDkQTkwQ9HKH^P^*vI8D#3_0AUWu*cprOI%@YeMVaYBiIom@0>#q$DKifHyKD*9^<~
z7bObZNsswt9)e|E0StsP_7Y_|OT<c4254S+*c|Cfmty?K>2)5-bSr}-4I+t-xia4s
zbj{%io(Ar_QO3W@AjdCfBlK$uV^c@vFy%rHM;*HIL|^M;U6%$R0=KVZOno&3?I1%~
z@p4(}y~#{hz3Ux&FE)DDa!cyvq5M2j>RZ*PQT16-(^8H=C`pzR1j;Z|*^g{xJG-<y
z-(OcO)4QXX?u}o%CP*|0*;dhrmuM>$iIf*_+Pa0UNzm5@d$gh7-<pkWy99L>GC$vY
zu&qoI&7o@TN_Vh9v<|+i8!231neHlgcQhk(FduZYrR`-y+dsG8E@=EaP-Dh`%O>e!
zZ<5@3ovo0hram5$yvx!q3%xsvi%b8E%=385sQ$5!Al1RS_|&B?&Y`30BmgLoAbG^H
zm+3LrS6mw#x@};?HeGC!u@3-M#4{ajtlFDkA$u^s@?Q_ecXu$pAHJOZVU1>szYHVv
z;loEHUl+tV)-1?I=#^w3rI?us<Sg+EdJ_@=54#7jJ|SQo5vmWQ`-XUqa#$9aZ?OV0
zyrdcgUo-3yh&?G{Qb@US9ED6&p<<n$@51@}#BKt1%e4^DGOs4)Qz|U-DVwqE2gD*+
zT=bdv41EZqYY{^b%mC9bj)Y8~q_G^T7)=!`vj%33;}t^iLp%#O)?Wx|MLD3_!BGCB
zDot$WXE8Jtz2?||ZQ;h4$qd`^F|~CU8!ol6!z>-UitYKX$$VY)A928zSem7?2_#dT
zqVscpj>K_6UJ;^2HW4uBzQh4pJwn}%3y1sz96f^Ql%#nfr3>^xh6L9S{guFY1#TcT
zB)S&|B0GHAR?)nW{QuY`oXXG~<{O@dEtNRfP&@@YhT>yQQ#H?{Ow;Ig?(=DfQ>{>y
zz-A0)Y<*ajM}ly{^`g)RD0tu+1kE2WBYI@tXgCL3iYF93pzxDGq)qHN5jZ6xwdAc*
z0??ssk>zam9DQQ5_(oVzzMNfLd^v-*NC~ORJA?IVr>!NE33`cUBxh;BlQR!C0P39-
zPTmex^Kygy&$Y<XN>A%9YP#8%$PJ=;udwn%p_olU(N!x88IvkaA?!lE!&$wZ;gD0y
z#<KO94u_S7Sj^&YaS);FAo5;<3MiiEEJe`9u%TCO>JDpDST}VNvW&99(x(wpmh_U<
zY)M9Y^tz3TNqB_#8`NTrc)6~5W%-r!VJT7NL4%+~7lj<YL>aA}nK_qV=t#J8@u57V
z?yBqR@fmjLK=$-us_{7|>$K!5o;p?-#k#IiY!FYuHf0vpOna;tl$yF>o*Ivj@QSG2
zWcz=Kb40?h;GhMdHOT^wP)*}W6#N@Vgd=o24d@gF8M>Xe5rXHy*OfAE$;hD@%cn8O
zzd;1d7%(k2L7Icqk&(y)=8Hu)K^jNgcLZKskL4hGG6W7LoU8G{f>dCIFIVRf-EkOC
zfV~Uj_?i#xI*M;2lyD_9yph?QPC>XQ#WXW6_(C-(HetXz66lgUv=H7WB9yX>%l5!v
z!cZgtKA>?!X3Lahc{->0Tws}Z6{%L)ULTlAkgS{Pf}@E#ue=*cCtc+o(->P!!HQ)O
zY-o&O;=2wuJ>pVJ)rd~*UfwyZyaT-5QpE=KUz9NM^8y}U7K|on9`PfA=N!&nXoA{_
zDzhL0j<RlHZ@QUm<e#f1$hX!_G}-E2V5)=bd=$6oI;m-m46y-Dds)gGp|@8r6Ov}^
zE4(j*<=%=^vS5*cYuP1}uk$D&^m_32Y9(*%Z(q*d!PO~maW0zvRluMJzK~t`@SiP}
zdd9C-@%^9H6@Uy1^IVi2j-a1EfBLYyn`WWaUYg$<o!n8%gyQn-$inct@xO}WQ2h0<
zlH;ZgkkaGY&m(2?idOYjzK(jybH8N1;MI3hl4p}Nx(l8$KSAw9&(ZOwvUEDS&!q^^
z?Pcf#_zpaH8M?+mpSCz{xt69IV}f1P(y-w$3)_xLu`;%tG4VCc^PJNWr!$1PDSO!<
z+mxnT%Ecc@G?{~p`RaYmhy|R;Yp@)H{gkt4=uJF>gi&Bx9lZYO4frF=@f6bUEcO^6
zy`_)}E1m#H7u>LLfkH-7Zh#dU?rA&+0hvpbDI+1ijnlAZ00zN$mVg3)3$-L%aDf9<
z1Et-qW;iC9lo-&vd74jII*U^_LIGG@Xq+Z-%1!X4)cTRoX%I2=p%@i(^9#x6DG96P
zxJ=_hz8?JY;d0nWw-v*<y%9_k3JKfuoQFT<+@@cTNa2#wEm<Ifrt=wz<bKI~S|haJ
zUg03tOLsgeX$z5yuR)Fo3c>RkfrP@Iqu==85zO?jgK3^8*^7${7$N8az}Il`d{*rL
za~jVs+%TS8lz;LhMfh<Vb9&G%vsnTcMX(>ISQNs#Wo9^(D}+hFzwx!lESi#t2GIob
zxnr3g?7}cq#W1Yl!Eq_g&ajk%vg<w|owN#6(+x{;Rm>F4#D;HC>}sBgb$@JAg*wE)
z4^YbczGLccFp!3h^Bw!$G|4=L<aF4b2VssraB?n>+edMC3_g7LI0Sm<bPfki2A!c-
z?{N~}a*ufF4a2ovVMts!;M^K2Q_?+0zs^&X#o?U)If`!)7a=oL&@MDwJFeWXq(E(z
zi3TBmoxEMW>bA)$<s@hh#6^-NjCtt4{^Nh4YsLVNrUv9H6)W*Phf}?X=Q1xIZ*~&g
za7$^CN-s{Bm`a8QpMQM=cMh3>nl56uC<NQ7i1XpmcOv+Xcwh>L2%zeIx{vE2m_$L&
zaLPR9bLX1oxnE#VCE+lfWjK#9tZ2wE!4bQ~EG0PhF+ks57`mbvn)<M=2SM|k<hxxF
zsyEhjs#(}nR3DrnP3-8piXC%I+%aLMqTT}=@>m=#IP@$iAIWUS!(<9So+i4o*cW%P
zmgQNeZCt=>+QQf8;d*G)^^Z@?-{Kjck5GlJs1{{ZFz6T85yPsJhIGkjx*!O=7UZ!m
z4hXw(w7SMY9V!~?jxkZ2)IeEI+Gv2FSVsjAmwI1KCMlbgz5NnLEhbrLGP-qG-Hd1O
zcxTf%^ji8KoPkKgql@E|O*pP`%ZgP`Kd1b0Xr<t4try~9LclBtway<pAg+}o`%9sH
zP&(938Bfd|2|aX?E$gr_K>Mx1k1rp`BD5*C(>JBvVx9#wj=CR~71BM_aB?!aV&8!A
zIBRv-`AzXIj`Gh%kQ)z4>d@6?obd=E?sF06c|1G2XSbgYjA&DNR~J;<1zUax?OnT9
zu@&G-CxxGF5nWNKi8Yrh*w8J49b2Q=wp5ofHl_~Qg!b?RIqlsh{!RHIqzo(-Qd0XS
zeVbc&-T)1kta^~ulz9!%m~2TNhrZVKTsqp+qfRQd1Xn%gQx*v)gCGJ=8SrA}Fc>s|
z_01lzXLir`*FvwFDklWe!B-M324Buf#Wc`J7zPs-QTF9*^yLihOG0x5B8M9W83+C0
zUw#h!98r=2a0GyW+{A&bb4eCy9ERfO_wUh!fDSo`Cj2i~B)k4{w&F=p_w`;g+Fs!3
zE^s8lQO(YaSKorxhUNm(vxOINE1?A_g#8M1#UZOfkE=W;KBTS@yA0UL+7Ug|7`tO#
z!M-{+u;GtwY&(vP70uTS!_;-fV2?akT7lY!1fGu6t6epsIFWEt8aCDZWwNxiOq#cn
z(JYtnJc4%+!K<ZRPjDdMSrpF`QD*Hsjt1=c<oO8kJNpeuy%CZZ_6W(_dbpBoZO*4d
zax@JlQ<kDM$b`3T-K<FHb;&}A3Nx}mE?ce#uTVCP=b;B5>j~I6gjO+0x^P)qYVTJA
zPM<^CYY}=XTcg645-_+DMq$Rq67Voo5m8$+G)~z<xIupd(+Pk930q^zg2<0k%8<*l
z93|Xx2r1@7!nk;rz;2{0iBs-jNumYH=2;@G5*6PCvB=yGiQGj3$Ge<P>98sK<IrDI
z7D)TWgGe-2yP)Dk&~rCOVV5|b!(8mywucR7de|kVjmg+hOw+N(V}IOB5mJg+7oRR=
zin{dRF3=50Ih8G4Dj*3K@&%;tl7=>qpTsH&-1;j4j>oo)a8E!rUOLtCDQrj1+sH;g
zC@#9nZSiskL%m^f*ER?NiNzXMJ#5^bRxG@17;Fa1>E+g1$a$K%^%ME+StIc*FS)@R
z`nPAIUtUK1*oRDR#&UzGnHK9aNdvE=@X!ECZ^QAIAX5kTZC%2=YD*O-mKw(1&GJ8m
z<O8icybI>rQ4(^rkgV@nK<>hSu91)>1A4Nev8kGlLtG7euH|4ubxiCU%)y$i*<;ON
zR5y2M+&6#RxYbV=lAFuO2qW|R!@}JUoW5pKW9(Z5>n6BY>L$aELVc{8V_(sHSMxWT
zSbGe)@?Vc3cXtfA0z$6t4C^jRJaH6CKyePFyy|=gqL)OAZU$kOX%oH&n4Gsf`fRiz
zQg<almzT}9&S({@t}9So;pn#$K<+Or<zBi`9thX-!h^qt6PJKk4^t`CZ5gXpAR+lQ
z`++ZM03&h3m|hD%+;wy0F$*c1@MT=YbL7P+igW3#3u`cv0y{~PG)~fh<m{+;a#}Y$
zIm;efilsAb5yQuZ%?P$N$HRtUTaKoUZQb)8u~K{8SzV#_rY8F@Qgq}LG6y~OAYo}U
z#C*631EE3ZSzX_?dd6O$f0>gMXf<LZ^greisH8(6vN%QWNDwj)4N?Z01m+3Te4O(C
z2Z!-r-hMiOWAs`|swGG0rZRO+#V`qRvFaKwHay+L#5Yt-EL}A{-D0+7^eWTCV=I)e
zPm#{zU~UZ3>d-^XJq*Nz-OAnNey@Pamf*Dted?%o0hI^@E16Mv`&Gd&XG3vWiMwh?
zz1pqDEAnI&JL>Q<7qv>_F5FQ|6yoLIrg4(&tRPE$IeP-2d>g1hA|$N)%7GOc<RJ^!
z-YjLA5@eC;Z@fsc=khE6m47JrRelk_^H0?l%5U-yJ#a%0+#ooXiVnL29ZXWjqKARm
zz)6138GQHA%R~8ChhKY~9yRa>zft#s`*@v#gx&*wJPE*$x>$GGh#$<>9ow)e_SCV3
z4b4=s>$(P3sm4@Q(V3?`ex*iDPUIqB38z_V8}CK0v0Hn$UXyq%T*$X9hZX1;n{7C*
zuev(66-u$eYz-4|`0_l)6yI_cdLIxmPfu}C5YaLu?0Rs>R*~BeH-MwZtGq9-y5lHc
zM9J9=X5SJSfi4}&wqZ~{mx(`O?xh&}1IXtUO@{S;gDi?Us?lN~8(o<~kt?+33Rh+7
zynm=ixko(9E2^s}0<b-B)dc!?z!J`bi00)|H7j!Eg;&o@TMb;+=%W2ts<gS$QEfG)
zdO>;tF2h0=<0cucFLR%r;Co_3t_zqkAD}<b9!@ByD|!f~?6k!WS8-KK*Bs1LVqrto
zZETNKhR2p?j)|qX&bWsb-y`n0h#2yMo4^B%`i)rPi-K9~!Ylp+fd%WKf~2U#!-b39
zLtutUjSt|=?((}YpZ&oMd~plrHw)a5|IA_Z;hq$!#D*i3#fTJ<H)Y;1cY$W}Fb@(y
zJF5bJr1%y`lmSM6^{K}E3dVwlWS+6ZGQCeM7Wq-~giS6+lv@{`uuf~h;|WSmsa8fr
z8ni;2c*4*~#|$*MuegCdGBKS>?0~M&X&*aq+OY$pu0cJ$aPb&~i&MrPFtxGb62-u#
z<M`Nc3<cYY>0-+s`(tBlx^%3Zn46|>lYW1BW1yc|T)MVxG-_~#D|asjS6yH@mwa`l
z2QP1t2(}R1+cLnKC8dkylBHt>Y;=T37)KLP82YTYhbAnZq$HUJ6wx?Ny#VroWoQ6=
zZ$9_f2tj53<4}SW&!apA=|((;95H<fy#T-mFozx}JdHU7K|D{3p#BncK*mSUf;<rT
ziN`Xtz?O6}v3Q=RP*wA>>bfd6ys-y)w+!rSwo85Ljj7RtavcDat2zRl)=SD9ROe~<
zfQ=;gCt0Eg9>ZS~0Bc*f1#7A*)tK4OEPfyPF?tD?(^t4>zJluiYmj`Ew6WU0tolLT
zS|a@!mr)0@x#z`=HXNZ3#g(?UTzTI$h0m(bQQ1$esgXqD?L*o(N}4m0v{;=PNji#|
zVN7A?po<SAhaG7Js#y?(tS5eMRk7G}UbFnAO;u1b)Mi&8bG5CygfskkK5IGCW_qf#
zik92eXA>5AA6cFTwBx8n)jh`@<P4<VJs^^!*kioryMTpWw=owkXZsDhhR+O9do4us
ze>^<wwB8cb;2S^gzPKK(pk|wlj5STiV{bghhVGl#RXhhX#baY?JNDS@Z9qq4bAfZJ
z{klfHTIGZ{@toVz4{YPkPS6%|cV3d)4bsIr7Ex}}Hr`g&ZnBW_k6@$_bW;OF67N&f
z4zg0LTb2i<H)T9NQ$~Hqdt=7a1VVbKc8HyfYA@aO(%n;$?xu|7tuz|EmMneQFa!6(
z;UjkwEO^ALHa--ORz&noOVt#|#i|Kzf`-O0@l^#|I@8CdV%wUsBiLl~#~v(gBUqYd
z7G$;x#e%uSS$O~9I@Zrqfml-&UuQaVv8(F}HXPH$j;S%MsLb~*$52eRi7I=DwenvN
zv34AYwX0=FaEXQ=CsGG=AGm4B8j$lQuo=lZW1IOg1+47}gtFv2XSovr?WYKkwnbW`
zILmSA86cVqszk_ZQW8jygk|Wn1VRZjo^h!JRg+hw7tbK)=1~#N^lpe|zF{%XAU0;2
zYhr^^4-=-_nEBKktFBMSj(SS2GOI+hl#!!=)K`@%IY&XSr5g+<`IJ!>+;DIAh7(NT
zk6z;N^;t4bD@(?H88RHpb6nHVu`*T&HZ;$`uFE{E`zH0r4kcrH4+(J|Rn+v-!Rlu7
zC=ar^=^&%QdX4|%aQHb{>&X%v+iGTu5uaN1_rib?_=Am3LcEJDi7(_#UlZ@^RZ4*2
z_<G4w3W;ea?5hNf<K`GIp1UC%@C?R-<&j)e1(pUsMCV9Vlo8T~4a3)R3;*;|5uYXP
zx{Ku^%V8-k^IxnOeU_RP=``Tj$=Qm;8_iijq1VJia*fdMd7<sA)`!2GbofheGiqrF
z>1{@bwHb|$NYsssa4$=!a{REaJ~Hd+5oY7@-HR}d`;Is45NkN&O5e6eM?}+|y+B%r
z8ru$y@esoqpN0d#G0)5s^=C03A~in|f0kpCa~F4m2SLs~4L+UN?iOC3ahksd<=<~R
zT)KLcsiV4&T*XPLE6PsXi9|D1MNw4~k8MxKhH4ntH4KI=Rd)@;S2V*m9(gi)RVh+s
zy%ko*y1Kk(0OJ`2=8-qtZ1-wfD{BGb+he^~BC$cInnolngRhrU+%HFy&j=)&0*F(&
z5;6ySl{3DG*p8zhkHIaTE3^+9z<od~k=T%qb|N<RsXO)=He5=up_)1-j;mnXW1gy;
zu1fo~K!=Elso94b;W3w*r2HcE1pt%8nHr8z6yKsC0{c(Vp6HOqkq?AV8Oo9{$kE`B
z!DM>z3-D2)055>TL^^&lZ`nTr%_L%0##qFG%ETz1qgVVw1f!M2N33$iaWsQ<rZR4L
zA|CiEa8*H4YUQi!@Qq{M+q?>!moUq;NE;+gMtuL@#F1YQ)~Vr{y(uY!8{H(FSu@;+
z|EYjXYlDWi!%|kkoQ<Gl{g&CscDBBeuR!5#>T_zWEfcII)ZN^&I5zvXEoyIUU99A1
z26La0YxXr``PaY~wmiAaqs?#wHS~b$W_WN$MAXiTIJ?2Z)cm<H2v(~D!GATdz8QLn
zKChziHS#i5BwQ@)U^YZcSO&j6YcML@g1Ee%Z4H(ZHxj66Se4<FS^F$+;aUOlm!p|H
z8%Th~s_=Tki2jwNDOn6kV*7Fi{|$RfX~7EhmePl#zBystdasQ<kojNSz{fR|_PhQ4
zb<fQQwcqbkw>8|OA4Gq=zyEgk-UUbWE_jgk*xnp_fHPAGi;u`E+q3n(lfh=H?tNx<
z{p+RFN5seWJ~O?hr1zQWGqc^@XQr^}pSHuySRK1QWj1zA&%lPGDA;j47aJ~7sHy0t
zqwdHFz4>F0y0RH{#loD>Du11;I4Q!_d9*st<3yqxJQb`J)6|JiiH0d5DmF}4#V(@?
z_9!tl%QanQSO>>i**vILPFj_F7W$l!SuI)fd+EDTU~FKFOQ?;UxL_r{2_U$*bn*zI
zJeDphMasML^UA^H{Jb4>hOiWKs0-N&%!C9HxNxEKb3RVtUv+-YeQ5x&BhS$Jx#(O@
z{QP``&d>k+=|cuT#VI;J=M*}HK<VuKd^5VmmYv=M^SN{0&wZf0DiAMYpJ^>QhVdo7
zA})FlNC)5l{O)}uiRI`-F$pH)v4#yo4eZz!KpPNG@l<!LING6)q<+^U*&VH*j#Kcb
z%lFdJVS!?Q3CSjdjjj2dalb4`VaY<_Bbl%?h`o_;Q6umx7Jm{+UQs4c1boK0ua^M7
z2tsfsBk48dzHFBiJ%g;)b%f?t{!C@5Ri_sq*)L~h`+u89*WksFlvUnJc(5YlkgWGV
z=FxSnUY3Y?au+E|LXr-68{j5_<>ZSJ1(31Fd@>KgOGjyBuCB6c*OOsG<zZu-D?ReT
zAE(cG1n>&!muQfrK_tPJS7y5c);uh;Y$FcB0AwUIFW?dKYswRUkIGTXRTO?rEqn4r
zSL@LkmiiZ{CRY*!sTzWIkRhyiQ!dZG;l5n;u6OKRZu8E?2LIwbMuJj{&Wx(Fl7^Pj
zoI^pfoE=oU3RPL=cjazwlk&4`vd_Dx`P@6f=NgZlAY@yE?s$o|ve8){<e`{b8wdF{
zIXc_K05;U}TQf3lm!r-?=I474wv{EJIaIA(=?<oY*0H#C+ky+s(p{rfI;yHVIP-K1
zDO?RDY!fcEcYe=ZiB|4FjTr;}nxu=pNwQrk`Z`H!>f<5FyDaUpn7gC6xb)A+Jdd}G
z>L2@vP#xk{PF>#O{P=YefV*vwJYqqM63;VrUB#;B+8}7z*rkqx4UKxHri~dhH^DRZ
zIJ4!y9%uF-II~Ndte<=ze!3B;s1PE+Uy1v`mgOTkBDC!4)Iefyh}<ZL$v#K#Ae^dR
ze1vXU1q)jOU#2XHQ&0uC3$%#mDI(qsqAQ_s;4eTmk)av!7)k(&wt(H<iDCQRM<JU8
zc`ze6LwxoDG?W6uDap8QVuVt56R=x>Q3#6%-M*fO*IeV5P2<qZen5dQG#NpLLPj{6
zZ9YxoIRsPWKpu?4AkGdAV9Q4&@oUv?__eCy=)Ue+m@+cPhHo0!Q8Wkp4k4Zgu$qp4
z50Smvkzh4{iF4-0@%7JOAZQ7$$&Cqx2*<pjEyx_C#Apc?*Dg~=OUTjgD|AQr(XAk)
zl!O%EGK(D9jhi5r2c&lOfJQH#=ZJX|5nEa+>SjR%GIw1y(bUXU8j4vERe+eoN{uxm
z-&!|O$JCTfTwEZRWb9w~#J;}!<?AcBbH09_yR#tU7tYtummiDHHWsLN4~5@^@!Wfr
zB&#^2mA=en`7H#p4vJNH{=Aq?BXaE(Uq+x-p_AkTsQTwW<y;xn2(hb5h^kfOWj*xr
z6S?JMd`ogN96oPWYDQqLpqjR8@>dtMKkvQ9oR$U$k;GrllrLwSQntaLH*DCyzPkMS
zc}^+IGJhU^<=WWVcCGomyjh%HF5@gO6t%0nCifr>CKHy5ZTOrp8jw(Ykx`b*Tg7|(
z*H@Q~&!1Sv^{2dm7@7Rug*MhM5ggi!iz{-?5D7yBZ)h=uQI#DYP2*cMBhjLIdT-%?
zWdI+*Gr^bZ6)q4B836;>JbAuj7ycY&+xKCmz{A*ye>%cW?7Is-2|@sIh{d|2d4jw-
zMByWrrf~|!L~i815WLaFtIPN3hDBbSW@sXWv;t_kuwnW^n&lh!?(^lVk9>39U6$Kb
z``fX12y7u=VG#yj&OWh%qx*6;f?ty~hCP9+ZP<BR{uT!jx(*`mC1@HmHVY7+LH&VS
z!iuhcYIR>1kI!&p?V7bn+L9}i(Q2haRla=HHe#(;I*X%~3R@{t(jU+!(8;^Y4Bbux
zIz_iI<Two`K}6u_!!QNK-cDHr<au@VjH5KnMA<0LQ5JJ<o<t~{yC8?;LL`Aao}Bh!
zjs5r*QP7l$=5kmZKbFRJ0nY%MApm69OsNT(eFgMwKa6iHTCM+eEw!#v=yppVC$!qW
zmG{RUcf)r^2XAis&#c<?S+QbujGE7vA4l*tTB49&KE8jOp#ki+7i4)5(Y*E|a~l(1
z?K&g)wSGyUmx#ETjO8B;@;GHA9F$wNk*yjI|9M^6wQtFAIJ{VGxj`OVnp<KKx^?`|
z9VUcVhgjXV!{P8;RTQi$%5bC&+eZ&drD@w(m9AE^!&=Y|Volp_S<7<LKF|aTcg=BF
zX=0ZW75)NA<vRq9?2}+|Dbr!4pJ?APC~ISnSBHBT1mgD5iyJZ~PEy9APhHS#QGM_~
zr(9pr3W&Y<*I~JMZ*js>lE<7@|IlTe&9VNaP{BK9=SEVNq$~q4jDlqNy0s3B?GjjV
z_eJ{g<wIGeIOX@sDKC?9fMsfzwzPA6N~`?BWt;8qzktTkzSrN%&2fwY)@|*34zzP1
z>AuLmcft1UKnWdIFDH{L_6=q)J+~UV!a<=K{Hf3kw&r+>*Y{l<<)4c=XY+)mAHX;3
ztn&~r<BVH-xj{V6^LW-a5V=jUc1yNwpf+1x2rHo&Yu5U6YmTUUM8=+R8GA)%bXreg
z08w<yHdU%(!*&=pe2-vTF&%813RNxD9NX?L0NJ*Eo|e|XSJC$>`d&rftLS?beXpYL
zRrK($SJC$>`p2rG=OO@nqu`zTQrbjI)5*smnrC1Pf=CaplXxjr)tlAn2%{b9Y%yIP
z`-28shQYPv=-n?Fs`)c4jiZfvy>*9R_4>qsQ)cL2Ns?^sZ@)Q-W>IBY2p8MuwAK*O
zy1QTEeCI^A7*E=E(-bSg%2Nioq2E_s?`iKr|BSi}8eO2BHlHm`t}J%9?l+X)G_{?F
zMPgSYTq0QSyDKTf-)&RSKchBeecD@x%Dt;$dKVif@Vx8WC^x99y{|QL<f+^HS~_r+
zGulVLwH(UglQ3($h@GSJwnZ8>D5sOLt#$0)p6cFCF@4*n*y%KMkM%nYWZ-ff)sBdz
zyI808MzP!z%lj@ih$_PGb1;blKcFPa%OJnDNRB(B1+^ntx!RjSTG|KN-b&pwnD3p(
zT>R@sM0Y)*dx9Pxfd2PB0e3kAdj`iIgZMj<|8dUBUr)-G)(Y6{M2%^-XP6cv8uk@~
zV8a`$*fFVveU}i=rkbbun{aI!eeNpq9Wq}QJHNW)EhDXL%~mznwlN#~V{Eug!H%cu
z*k)rg_H3$9gFWILic7(bJd_c_?uvND^K%{~B$#thLy5GBWK(1y#0rU6#Fb#hZh?u<
z(G?_)OBq3QO47VgukrMEQ-;Lj0o|2)d_N?U3G;YEHCV6g0ND}OB3kkJc1m*Sn&#Lb
zwv7#4aj`)uKuK8)J4A7nF>^ek-2*Y{M~d3(WS8C$hqg7z;WA0ZH!MXU%C66L=#d~?
zv;&YLlL^n>m9sPeA(S-&&gy>VzorwO(C#u01G*4#CLFvFy3T?b1kqIi5$j5SX7tx2
z<4RgLUdq3>35n`Kc%Coi*n?7)-~3DD)}#4Ge7$8r9{2LAmE~asrPc-3eoIs!4}IBK
zwi*6c;Z?1R7m4RNOA)j&Y@l2<bvm^vz}nYx$imD?$TG?X68A`1!bqy7NHW?!tyv3b
zkG+&Vhf?$0QNgpS+JS4G-|8(Y^K#votuq00_JO!8tkrBKMz!VTL>C1nNRv`pb9UTQ
zynt(Ioix5piu1d|?i`U7YcS#M5Oy9bp0MJ$V^7x=tXj5?4U-y}P=#SzHB{49JXLqi
z9#8mS_%{Wfu!VuPaK$NL&YOOJK%DzQ4%SR<toz0o+nNH%!Ip__TQ#xjDW=1iO<ecz
z$idnHaY{SEKXeCvXb1Vwqvsp}JtqS$skCB-5<GQOlR$Gur%@cnlf_7;$3;QprzFeM
zInC!Ot1w&&sOay2yyGoTAsf|lnwN6`tkroYMbfJJs7OM-Yi6qmKV9K{z`Z0Pvz>4{
zpGc62$Xz~wH}Q;5JV#u7L4((CJ`5|+9NtS52ic;TPF>*olqf)M7*h_XGYuwFd;`j6
zHbP;1i}`(zT<A)|x=R6wBuN@4X+UyzOt>Ab8{Cd-YrbJ<E+#rruwnRcw|YL-e9s_`
z=@`yN;OEDu1mb6Og}|Fip}$Cuo`=BCK}H@VENu$cLr~7Fi0n%k(!8@9k_Pd7-Kj$V
zGAAhkIfIQjWG(XJ5J)Rd(K`XFFi085ZOjuof;cU)X?}V8X?PsfPYwOKn*xYfx@LLK
z7@HQQ*f4z;+luO7rchlsEXT5UXj*#(P*(*|<Haf9x(}cgx(}t$cTxBh0OxX*i{$oo
zbrhe*R>XznZh1!4rj-0r>XAmZLoWUn_=6REb>4hc@XOgyTnOSm*io-`bMT5V%x^pD
z@G=**O5(oRQA-r!<=>_;c<$|}AWH!n%E{}~))RqLsjc}qQkIEBmaV-C$}%0uBGun`
zkz&W?SN<#iQ0}VyB7WzestuIi<R3=8+HXI#A0%`*DYf4kn%z(LcR-u&elw{~RQCyR
ztb_L2%OlRBI`rLVA+QJ@#5DNr)O`ji^IoSQH-7gCh)Z;@8GQG#%S(Q*!9PhAeq9(k
zZFRmg_H9SeHLM#<$A;qj*ag=RL-SO}B#bDIc|vM{np;Szl)Dc#z;3P9dR5zz{5;;W
z9OmCm(06o`5l8W`ZRiR%9M8nAV`x|>V^>!lVkvs>>2X+3k2(o0xi!_P<N}UI8i!oD
zy4ww@m7?JLV;(;Ubwvx!!J+gT-PIbi8_d2XFrg|PRt@2JdDO$_!i6kGaP7waK%gQw
z5RZc_igPwg^2I>5Ic(uGQzgsVU)YD@lIUb%7%Bg&prhiiO9H%Hc%EPl)#dpBwBcNq
zNB>?%o0coptjMK(ubvUE8n~>{MP0B|X>+5a+G=k1!zsp1GFo5e-YKV@bpBu%OY!iY
zHdE>ADx-?0V#Q!8HeAicj_cT18*8>hiEg;|W~YeV{X8|F(DLf#2GSt%f}6kt-{oe(
znw_~|2-@=l7Z*SAOr_97@b@`91mc2cUaiLvMowz)4rgMP-x=}D3}z66Q}8rd;D-EX
z?qLk)Qusg*M}W*sDim<(@a!(oY#!!860&MgB}*Phl!3c;^@&g7(U~%iV##=zyg~Cd
z6XiU%oP6`QXX_+19*A7Nn6)w)|I#YUV!J$@C+V8nHf>Dz$i6*d`r2x+R?~iV)kfFD
z_}YeZ?jL1akFYJ&W*zXAIe+nn&zW->avz{IU7^#qAdhXQxo@1}9ubQB#U|b<DslhR
zon3=w52YAwF}X882=kqulr1~GcZT;eU?<D&Iwms|W9(pGaVa)b-^aG<sMyjC*HSD`
zxAYTpr4n9@?=No*^fQY~7nF^fRGxo}JNtoa9I#zWZi3R~j<-kzbHqT_&0-3EbJ7uN
zNx#|voDw-e!Z@0Uve0F{IW%GMBqhl-poqqC>ID(^lpFx_m(M-!#TQNZk0Of;=V4M{
zxW%IYJ~rr&EKJJ4zlHDuOoQwirEJ1ihbJbA=P8Bgy*Nd=%)u@r_s}fJ0|CQ-B;77-
zNGH9nr5c_}bsu}aMX+I+4tCYCg2%35S=6#T%esfednYHYHMF_zqDKFm&`Y`;REKG}
zEX6#4Fg@N_jq|UK_CZAO)g+B-XpNEm%;NWvAETFW1$>3m{1p_AUxVbU+=Gpi`XKLy
zdJZ|+-1Fkz7>>|~;^J6auDn&6qE6N4sO+cK)JV+iD?)wH-A2h~Mv@lQW+dq-)`T&I
zy@M`3kR0};RmON(O|bDihOXS>cJ(D0$bQAo?K+lJ!)unmw5bY0acy<Z1l6^!x|CMt
z^L*BFrcH;Y&MU<xEb>0GJPl~aQH!d3jvK;k-t3bL=PZgn#%sO{Sm<>dbK#P)-=J$L
zcp&cO5U3XimM+Xag$rPHKJLB(9<5+unyTZCRTF!3?0{>%jcw+cm{>Z|Or07g+ny1i
z=gjWHnE~fh`*n>x(4Ki)X0M(B0YBTxTs?FJ_8zR;-MKQZ@8#M0R+ufhN1IZfma6A;
z(PYNtA3?b+V0Acy&$Y|qnr^DEmrH>nyJyo*S^-_#@F%B%HhT?pmmF31tvuezt@R>O
zFCz6KQacez<_m2pSgmFkZRhX*SR|~1)oKML`FQ0lWo&y?GcdDVh7HHiv19ubTc$R4
zESsrJ_fE)w!{HF#OFV|A&E{=^hREfk0Jv*+&Ly2y_jUq)MH%t}-)AX{^0hDvpfR5?
zNTe>b<yUcnRHejLD9k~;s*uA5lawuZR*~U~xh3J;6d*4~0%<{1p+%oUW+Pxc%1{!+
zY6T=j87x4YqIq;nxJOgrZN$Bij^$*}=hVp(L%p%9Q<q_4K^j0!qnNn*7#qZ=nx!b3
zXWj!HJ}OJh5>4Jt13KjbHe`b0J5Uk_3V|S>qxU&Dw{21ez|V!t{Sra*`p_|&b9|2+
zh;16*q8W5nVs?_0Ri;T!^neVvwz0?QwYGNv{?_pNN*5B%!*Br0RjwAF+BTtnwRBTp
zU;Vz;`E1<{#+3l8^+!?|eA!lw`(%+3PeJ;BG=hJLy4d@k9nkme(MtXgLyF+n>g$EL
zPfu2gP&Ab)8X#&BYm5zT>|uwg1Y5RE{4rsk>Ge?$-<^8{E<+d=;E{aG<q!~Vnl5TA
z<vk^7d=q#qtI+H2#O`s2F#fdxG1qf}N8<uVD|;=f=Ryp17loJ2I&M&6HHvy78QM}~
zU@z)<#-3+<+&p6+uJD9d#)lqha918vT+AoSWV))Yn@sVs?+_0g2Gz0a5(87;A&zNS
zp5l-me*NI^>zXa_*H>_!@j94iydLGbU?QIiXuGbAJ>64u?C6AHgW5iJE!)Mut?P`9
zJ>6z@58D2aLEAa#IM?4HPMI&ioJkyXMfv>?5=|Y`I1EXWu@}V;O`LU?&}%qHkq0H?
z^u_NKMb|Cshc9OW)x1DA&%Lr2P-0>d29xLo;A|WTxE+j9B+m)GW*&f=r$Rgg;Xp!o
z-vbVNwwzRK86TZ=PBe!6n9ehhjp16_Imz8f>g*<9w_HS?#aWICPde9ZZpuWHFq>rn
zb+E-{fB?V*emV|=EJu_?o>-=1!lLWlV9^b#8_XNK*tR@^4aQV#6U)KAV^K}jiJ=?H
z37LXdiDQdBSPIQ)VH7Ipvy9i{6rM85f*TGS(NOLb$PNX3KP1D;m?WVYSs<4olJkf<
zmLeWg$7AWH@jUe4W0D4O8stHde4vc1qYIa%8KZMRutMaPq$2-io{}I6qRDe~C4VYf
zqXK*ja48Z-A@^?)o(CHsDY`<P$fs<<^*rob5<~ZSJmO_i#+`vFLoUleT?A*Qi2O^^
zc$Vbh0;Md8Q+Uz2S}U7pNkF-Vs?;Izg`2_sh1^9#GJczg>6Fl3qCXDOF=YWT7jFFR
z0H*6ZMEW*T2gb>t`Bt{Hct2VOoQ)NmcqTSg-@^tm4eY8e#lE9zOx0Y2C~9w`->T*9
z5;a-gJLaZ)2MyL+slQ_^<%*rVuHbwSQIj0ynK#Ehyh_}9*p}+gh4*{l4>pB|@($Jx
zurbfq#QS=c65vq2Ub2+3C?^y4Rjvy6<oDva8?pgs6bDP=xTwA_jeK~HR7DvfZP<vI
zSgQX|FO{0!*W|&XjS|bM-*QG=?Ynk<>tY3(jY0seKvKU6K3opfK94+JW@!Rkg-kpo
zR|oxG_#13puO92>q@4|(a;QNMcJuwT$D<?CbmJb}i>j65Q*}?6PmeGgZ|`1&X?$P8
zG$1%@wCBy;q2i3oUTsgI0O2}&fi&fzL6<#f<g$6jc#2T5xjqTAod&o^cjTTZYtu(j
zp5_bE1;^vN`v&(wl26DpqeY}aoaV0~%;vYhJ`ljjt2imuE!m039a?Pc>gL$P*4WXo
zp;8mux=%6l3DZ^LGmWuFY;2OTehoLuy85?fhvL}_=aDzuZGKuZE>?h&Td^TmLJ2`J
znMM#CD8U-RvWfhZ{e8|Nu-YtxPjbtqTncI5sq9g+I12I@ph&pF_@E$<hcnQKoj7?D
zjq0hc=h_~2EY-n=ZM)dfO@j5YqY`hd`-)@rCYocIXc|aLmzq4J1xixoH$8lgUh$0w
zBTfL#^D#&tdv4raH!L_>F7d#y%jNZ?)QmqM&-xajjt|iURDt%7pk)16?PnBP?|6T7
zdk{K~L8x6UKyMG~gHN~o>+M1NX*VC52J!xrADo=h<R0xo{dRx<?e48CZC0(fvh-JE
zZzkzq{F8j~AB~x$OVazE>*Q<DTS~r<rKC{kp0=4pGj-+@k6=n{2OADGv8ys2GeaX(
zQB2p-H^mXkel~yn>mJdKG>!_T<zIp<aDy<&7dwJAlLC$F7rB*J#N8T(3BV^L4Wv0G
z$bS0!oP<~Lea5^xxO>3dQ;BW$3`!Mq>|^S<V{9m{gKg8(v8nlvGPcH^>YE3TZQV+e
zyG?YJaZaeG(fe7#(kzZdE`$F@X2}oe^-pg~Y|z3GhcPb09CPA|@InS@c)9YQhiqjz
z=Hw@B05Y74h9t{gp!4&f(G?KQYlu*U_zf`@z->w6S&%U_c>U9x;rTg7;BmpGRs#`T
zZ6{0O*ss|sMuiE0%=0N2`$V8N8od4Z>eHJMdi$sMA4ll(<vYl|K1*KB^C=`Do+nAT
zz;p`s3TQU@|Ji#J<+za~ZSYlMIMySQn?d3}sAA2iq^fRhtGYBgx@}jIX#x>}Obn4g
zHh?6RJ=JUfE3EAc=vnkA|C6kFMBvN|Nm3HYgv`22N(ACU9PXcg?oP5I5zehuzi66e
zTv`RB`&Srcd4XZ>2?bC(;aB*QCoIj%?SQb#emqVp7tk4a$T42~uZ2-U5(<GzMcTQH
z3mYZ;Q*5=o40=?BD8hNfpgYqUNrdNlDxS6HrZT6fuXKF;hLdToKJ!y>)eX{2ls!I%
z&w6r`Lqk~_+g%7a6@hiKNJwM{_xVWG*KOw>hegPUM=7&$NJ5G&+a;Jd#K4*z*qRk^
zT{FzvJ}k_e9u~VtZf(YF{qxJ`%GR`43LU(56N`=CG&u@OAnYF=OKbj&XHm*V(m+Yz
zpIH8c-iXBFInN?+zvNt47p1#o1n%oIl3hUBabXgSd4a|mNzgg^pFd_Kna2d2E&utr
zd<ZM|95ubi`o%EalAybF;J!bAn8a&Sd8cXk{-ElR@b*OKqGNR<G8jdfezR-@iZ)&i
zIF*wl@}*D`lk8AdGbI-st0^msl;N}(56L_RYo7)uNM%t(dBJCL@@o5-c=@Q^*`+q+
z5WY^Ub2ta#FNd=X!mX8-%Fck7qJ|xf8tKtH-v^x{@fDOS&ijKA`YnUb>Z7XP<=jf6
zY2U_~Y<;y+x6>u*RQpEV6?G?!Tk6D;X};6Gm;%l^ES|a_=C1uHm%+Agp;ou>wibqh
zPj#bK-Dthmj@luAp(N=BbyF^PRW5n);%1R?d(!w_<MrM=Qt!26^saE2i(<Z!i!Dm@
z)fx|qsEFm*`VhueWO?sH4R3)%8*_SZ)-Vqsw#c<RE7sC(T{ZfZ-T}bs?Uu145qNvZ
zjUA1sI~Y%QGn!t@-{Sfi;<tr6yTNMAIf%g|TU>idZavPHmZYKIpCx&dsqHHMTZ+p=
z|A5SkbVINHc^&X*2lVg3szs&N2r|jVECTjhH2eP0(X|ykUk@2Gybzl@wXhZX77iSZ
zVBMh1cbR1|7T!7<WZa^L_m{NbL7H9&-?OcHo<Imo>4URqtJD46k978cqMQj5Ydhc1
zMx?EwaDRhvXEV{euNd#F|7bh-r-%#=+RoN^Xg?=nu|WNx%S1`R<2V}ggmM|bx>fHi
zOUn?E(CymA0N3SOaJq7Bcr4~N5>TcjOVcz7qio6<iqrH0R?Y>l93d14_=YD0axp=i
zHS{9Ni`x#aCYKk$#5)C6<7QwOra`f%*$%dR-NeMP4eVH<t8v5dT>Cx;R$JP1xU;$%
z%T7pX9S0Yo1Lx>)#<Mmgb+jV$RvAhSmeaQ7F89TnzM!cBo%-yu(uGFu=?;b`km@==
zmyE9#P5GVhf2o)3^XW_>2RkL^;=b)TE(@_4P=+ndFtN|Q5c@u7njKIp2*1JNy;q63
znw}(b{{Q#?`v11BRw%P}-&BigwJQoEQM~8}?~?Htouer!coqQ~!VmW+3D-)%`B7`q
zA9d^Qc!)r)H8gvUf+%S=3sZk2aoG%ztVUT#@m)iK@EMxTOq=x_9f>P#ZQ15fkB(}9
zSoZzD(<ng~QNqqavP$O#&k)pc)Pj}U;9z42t?6i->M#W)<~iku3QE*Euwy+|GUNo`
zfIAWq%aUYU5i~g0pxlnpx}<^O1qpcEc=J}ncF876HG9pH=}mYO(tIn0*FDV=bsa*}
ziW~aD(wQ7RB)a1;9GaSjErU3in1+QJ*S)|DS!hvxPbA@BQ5QsSs`&X*HvX$RGWa&>
zShm;{6qY3BU{R%o+OAEq<&gehtDKjCht>10Se@TRS(nqvZlbORIm<l9!J%nc*do4x
zi5W2LQInd~X14DQIcV>MsM}oB?TS|9q=<NaT7{C1k{;S#FF|@5B_QxL?YnK##9HC5
zu7Z5(T}4~wdr0E^txEH1P-X9?mzaN=!H8=6`ix{b{|M*yVYiB-6S;^%`d-X<8Xf{X
zpNw1n)MZU8c`ZHEhuQ*veLVt-s|BbEL!ZU3a!r-Lc60;vwFH#|HC2TO@GPMwpx;II
z^C+Q3HPrTtLXluiHcH)b^~NrmNav;Xm5v&-xmgn_`%QA%oaR9-*`$^LMNFzCcTOmV
ztNejW#+2EPV}w{Y10j0^n1tNL8gWd^<R%GhI>2mOWDmSm^4K7dS7){`yhI6$E+aN4
zkS%>V%~dH-^p_`2Pk$DS%rdnGu$slCAku}Djl}>blE$?qq@nILrEaOiDUcsZ=?Id{
zh`$Sr7dA5zyBQeXDI#UYjS4{z7HB$;i)a?}X2K7pZ=_(*0iC0IbU#zI?x}Fmz7A!%
zRe4@lsh}dnOLgTo%E&<fy|`cf*n`*O5Z)G(@P>TCn}^{iv&oLgo&qqmTL^!6m$Lv|
z144W#k#dJ506WKxzBZrn;rQ_0NrC-kbSM3C``t&qTqSps@LkjLeMk2&_bdZjmc}u$
zZ5vbOd6uvFrsu8qU43xaxAdua{_@g7f8;4D{dkt(@5=G75$&{<Syp*Gikj+leBB79
z8$zU(sza-{BShjf8OxWU56$|~n5W|QjwqsOnz0CIOgTCPDYuw2K0@%a`0J5$Yy_Dp
z1Fb?{IS?JS8<iDYNwLWNm+`TfCgB~XLbSHB{wWXBI~HoSeFVT)-3fiyJ)h`=>Nqr9
z8(WU=V$ah8?1mxXI=7kOtn(D?GsJ;t(hGfG7wNPW-t_s)Is;w3k&o`DhIqSdl4VCn
z!HUe2wBXZOv1rbhgauY2o^4mlQ6u7Jm4XeT$Vz_vFA<MfUKSE3Rd-BELu?(qtqJ@i
zPoF1Yiq7G1`v~XMM*x~XMzfFVQ+In_z4}6(deV#`RN6yT-AQ>O9*xk8@<?1+t~xK<
z8fx9<sA{KC)kqHPBSQTZQf=Q9(kYqscx_5%JF0_mO5xi<6E8>s-=vrOQMn}4d-CtS
zUM#=5c(eLPpI712H%7NZKqm3(lkqs?@}?C@>gLm)BW*Kq4(iq1?|nYz3Hy~7Swwg2
zwS4uO{RWSPr$EWsZ9#xUkTNdb6i3pop|2zl=z5*5CENpWA?QIM`sX*+s_dI8RUlFQ
zx_vL-TN8-wT7jbzhB-ADwrt(SzDaG&H0}pXw?c#ag8;b21abpW4g{6PKUe518>KyT
z>$1^<lpSv_ZwUZCTdWeJ)HhqQdNd3K>g^S=0kQ?4{cX*lk>FRJ<ZZ*k+TvhqxDz5-
zA^oG*kc4uqVmthalVVC{=uk}e!TlBX9zqh}RcmVR3;{zd*zXq$_BM#+gT^&zT>GMN
zP2}y_^DR~SWjh=1160_QRP|sLHg21N%L0lm$1|~IYCaA;*T>WixZ~NruiO5^vS`Vm
zXy4bLxzmRm_%Vx`pvr)Nf5&}sWR??f4OeE51zM;F8n*l(#Fj}6?1z4cb;sg?Z=0H9
z3;@Gz`FAXBmBEGi>$xzC$sSyn#WV~q%U=OjcyKPuoux9kD(@!VHtygDE8hCV)I7?3
z9E6&UEyHthpfMZUmSZ|h^K{}F`yk%ldspRB&b^y*?9Oh=hDUv>+YB?q2(e}92KISK
zvFCV!Z)=|6I9qap3`D7~E5<e#vaDcmOTKr!u>0*fq=M)V?#P2X^1XLQ{yHkh;>o9|
zx00bEp5Kyl$2Zq@-n~;Nf;bnm1iV^hX8MB<yQ@CCWC^_8yo&2a6(vPRaGH&;HJ((2
zSh!<D5-FRmHJk;H<Me8O!)P_+>W8hM>O?mUFQnMEGz(iSlu<dcNlZ=i3}Vq>GZAu7
z1p37cSW*IpSOG(<fO{|T4>1A;mLB{Wob*>+v4fNTZ6q72ULKtE@2ZSExaqeOmbxtT
zJ>S5d4S~3PYGThdefYn?wQSupiTS{-K6lbRzck_up7}SoIqmG5Z&J_XZm40~^mS|n
zI>A9;2bgh<>8|B@JRBn9el_OQ;FEt-<BQUb24DQa7k}`@Z=CLfFaF?*zgEB;eDOEw
zPT#~E-`?4{VBeZ?!7!NTXcUt`W7u+SjswHz*zj#zGc?E3s5=-J?zK05KdI>MGj$%I
z7rs1WwtC-pirpEn`@6{~c?iDo%`d)pKJk`DCp|sF`;jyNDw$6Mp8X;QyVEG=NdzzG
zZvU~RyHDmS+<owgZ_LgRg>1|68KRI4KJj<MCtluN-^45aJ1R~-({x=ADE649Lnap=
z`<mus$FdpK3~B~jq8;3A1JdjHY!)x@(+Om>|2Hz7Jw`7{RzUWsR}j4T@MW4qDiU7(
zT!Y*~B0fHTnr0b~MaX1fKWbA_bF@h38A`J;NtEzbYF5)UFIF0iWNzI_nsbzsX(KWG
zgcOL9EQ_kB$@vL-0&;8)_NAHXVw#~G#uf2Qy^HcWV?2o$m0?T04tZM$=qV5$I*-QC
zanTG6rL1pC7AOFLzZ^M37!mmQG=-|g6jCvTpezNYRX{3(v}+Z(<g`e$ljGwbg6v25
z-|_J)4wZp!!jO!6e|CI~{>n25B~6k=6<DC`QZdQW`FMgzHF!FKB=#{1c$j8f)RK%L
zGgmR;QHC;3c~X>VV{)*&@k|U8(ikIxX61*j`#Vz6u9G|hb+(AclY%GGEGR$NOzMLo
zoHfjvnr#s3Vc<y^WmD)|%t>-`SG={BSMrV?ThuYA?K;>Dz?0B%OiZ}Ju@(A`&Rk3L
zsWV_H6_zqX>AaB3B`X#FYD));`l;M5m!K<f87+O1UX^H!6zo@c8HxksjoQuX<mj9m
zha|7wlF*Do8TKd8Ksy38I)_gFrY64ZUI|=OO+S;nxq*q~vp6aaSN3g$-XHwO`-7u*
z`iD(WNvHC5%Vm#*P;o9nl2P}SX83IR%lXPmMY_UH2F~@9@m#Kt3O|$JnOs)@TI5IP
z=OKx6F0vhVd(a&)e3I5+jz*0+Sp9Z8NOt{nR85P-3C^eF)5lijBlJ9>=`>2lvc%t_
zVxo40n#9)n`-!lRZ!!YDw;x~f4DJQUBnF?ErSl->hZ$6TxVBPsS{H5i?FbzsUDHO$
zI8uuM_P=h!sM{sGsjF1vMmc1GkuA@|yGLamO)RZluLydn_WIRnc`%5AYsUlc{6rX1
zlY;&rim#rg0g$^7xLRkOTnk#$`o1(^PXGM&j#k|uqf1+U@8DEtfKwmj(r(>M*IL!q
zH#^DhJ$U}D_x}!ie=5MRzPFMj=^vaSV{3Xz`De(7w-xnV1`ZyuGb$mP<x;Hcng`L6
zJnWe!$Bs^kX$Q9D+vFa@o^R4wtybpfO__=<Safn}odVP?an2V}UPy?uf-w|^8D{+N
zbDk9OqE6}tNvB&ifm*qZFAN9vbOs6uKp!Qyqyc@jYLo!T2u;!}GzE~5MR^e=v?xIi
zbOqXOlw79qC1)d18R%m<Aosk)LQ0rKqJ33mX{aFB5;ByvF&;;kJOcnW6%_)o@@Yf*
zyLk>hIZVTXCy0OIbY4W4JO_|Aj1nLLpu8Yqc!aJdseoD&&Kc;c83FyU3=5TJh+L73
z!~ETe&`<4;AwT?9sZ(vQK<6$sh=u*oWY{83fIX@k*kv~NLyhQxv6tEL(phtJt=~*y
zTaG05*Io6aYJHdZUu#{*M4;?Z(pbG4u)vL2(I(Ikz^65^;b;Xyc(i-ImHwb2G>D<y
z+lq};mu>Y)YTLDY@(4;dKlU^Att7US%OB4XljWDv;w@M3CY=epBWDs65>=d|DY@Vu
zbKb0?1dZ$!y(rJHHz|C|PpTK96H$1m9xqBasdDy{`a_j9H37}$l-Agnp)Fl1s{yd8
z9sxeBfmk;rbXn1aNcUdu4mIU69en#UKsnfYYGxG(CyUAz^^s&5SsX6SJ}fNw-;vBL
z-?$pYY^mJy?b*In1g%O5v)hfn2Pt8$NA|nRpx%&3W+2TC&g$PKqkNi_*=he8<xvpD
zQL*SH70$|IvkZy#h6H^gz@^g}$s(n(MfuNvpOg4a+UL9^@mw^d+c#AaN_juwSC`R0
zZYc4SkQ<)q_?U#Afi0JC>{$-Oy6Xqba{|ZFwnTSY|8Q+Uuk}N`&L`dZV_xSo_WFPu
z##Mf_ahA?!2qU*dZ}3k)KgG|J97rr1KH4sb%??=25=yhFEL`0`r5W40zc<W-(lcG(
z)gkCL(>w=TE_JaNIu5oq-*y6@+74Z(XRfPz?R-?Ajj?gnZC5Cps^nkNf(L1O@kjWa
z+Z0Oq(Mws2vuLZVBvLhPm0P|iTJ?h%0}`w9{Qbcd02XJurv2eD3d9n@G>v02%lTRP
zm-5LOq|SXD5PAXgk}xQlW@rDZX{PBokKZ5s2s+3QMW+7Cs#ZYg#Uzf#$yv<9qFo^h
z)1<&4qMsSs?34QU6^D&=7NjwIEZe!7L<N7WI{b(C2R|+at57!oC-Y(gu#wWXn2LjS
zC}Jj#(6c{3|8<03zx-t+05d2pbg&;z3nqJhS`Oh<OqTdN{O`>q%2BQ~cc8JQal`~s
z@q#aql&lr2P^QoUpn!jx#lU)5-8nkp^dhhN7$t2wQm?c<C`_qL{v+9Wb#UpGP38qj
z7|B?EhStx>$u=(GFAzgrsmvjXVrX7ecM7$gipnk}-%t`ZuacUXMcO@zax|L<ag<M>
z2^c%Lu~E*@;p{x)pwJ#kG_e3vEP`7z%3<l(>`;l(WDq>0rXB`yN-q#436tOH#+1R8
z{J+<7McC*kU`+O9{rMVmiD`P6`4*(d@;w~5o`-{wS)p%gn#-(vjEMK#oHB*Lwyk-5
z{8~`=Hm49!@H1Jl!(i#rbjmlM0<f?^`;=<__I(FSw?!U2L2q*&&SOz<nkG?^0?n=4
zrF>3l>BI?p2O{At=hXt#qr$&Ql1@ns84S`4%~JRz5sA^PgaZK@zZ)=ixhG)4U{<e_
zipwGz34D!X+hz<~A#t#0P!nsMQQM_l^PPbayWYE4U}{(%$6|ry8?q6c><e*KH7aK1
z7r0x`(P2eIZ3NqFpHM0q=Fy3G???jnFsJVimOIg`JD*PvtAC501OVaJ{c9g!0}t@K
zg?j(y@z$$l@%4j|-@WMF*Y*(;mx(;n9(Lev*Y^#LnHtt~X2}dbf$v+`vrTSm)MqXm
zGWcx2{r>#?*WvQ(UVeXm{_Az_zCS<zb=%cf*DP*6_0QqryTdt7zWv3gR>eMMt+?U6
z2dCM?zV?Dp^TUu?m~*aS%LrXeY|X_w4Q-40)O5ZDMey!%m;iK?E27V}_xj~8!>!l3
z^<KaH<r<gX>zBW5x%29J;mTA08g9Jd#%m-JmWyKd3vV{hX7L^?dT@?C?EB7QjuUd-
z#J&&tnQR(j&-F|knw<Nd6`EuKIk(?;0N$s0RPe54VZc4xmtbk-xW-Lb8%Q=@hn*JS
zPHg@(T#UoTSYM3Im9hKn7{v2Ez8lNAd*BzO<~v^C86Gyw5TfA_0~4DQ?2*9qO~<fo
zH+)DIazUAIhOJOHoy5Fhqs%j~U@LbKWf^}K<+GS9q$in(j-hoNvC!d5T^Q(I8b`u1
z-Hmu7Y<==Rm2FjliBXY7<1vu!PaxbyJZIHi+~%n?qU=x-Q!otjykUU^LX7Y@p49<D
zz>2Q|JQb<%@QQ)+)A04m(|JbuU9xL8j1c8F+AY?T#Vp733Fd*ru;qs~_H5$ekP=3T
zrTL*dfE?R|zNTTjM-1)8#%P7perc4;Z^_N)NXCm&<@8QDux2;Po}ee<^n+;JiUNxw
zMGTdp%$7HdB!6t)AMh$Cbkg3=dt<Nf?JrkX`UWOiywS;Px$Lr4nqXT6qwp~2#m5QB
zKk}GQc~Ts1&%!CZ@0v-OkHk1$>T<E1uUa!B^wMZO?gnq_k`;OdSn3R_5ml)(G0S0<
zl%HU`f`2*J8bOzY<5{~z*XQh|t}Za)s8!AY_;S58T2IvAg_l?Bc9R}ntwy9b8SEhS
z-9?$sh}t!&h)bJhuRq^ndkmK$5c-|-?b@AU@le9{3{lV@X4szA5jX@Od+49Ld6|9P
zAWhdl!?qqnqx&DlXb5$6t6QcA6!&mbD=&iw4;H&~EW^_+!m!T_3tIvAG2yy~P22Uj
z=QE<&!9HMjDj`qlrKBPtH(tDTG_Q>84v$v1UO^_;!t{ir)q{fb#4P>%sn`|KyRUoG
z_sx(|)54~01=!LJjstG`I3zS++zPF5o9p;q6Ro88w?ra4$tmtP8YxeUwL=;p%5Mu%
zmdBF#8n+2kcE0ef0+y{#_W~_f40Ctjaz!O8z{}-Qw*g?bFIgFCeyO3}AZF*vmO$pV
zSslR4eaPylzW;z|uKzRSb-YIq*MMm5)#vWsYy+yfe(DBPv)`Y6**4{_*-MM2IV2)^
zP<VZx7a)oKPm9}@t06kupZVfOw-NO0Hx*0IxTo~v8=5e>fa!xpN*$jP)AfDK3}$1?
z^Bo+R#Kt=30kND=3oK`UtQgOe?`g&8wmw)fR&2`W$=+Bo%#fHSwHelUK(OWNAr34z
z#2VENs)w$tu^~oSKPyI*JUA=H+93^AjPGE@D9`TOv|>a_krA9`<J-4il-=!bzi1Ee
zn)Zu!CF|@Ltx~sVzbLD%?G3GlcC=qqmvzH_v0+y4g#DtC_(RuFXOT6}#46)*b%edt
zPhT2GdyoX=?psO9Rkn91$-w)5nE2mdCD}i?w{d?CR+9BoH&{vf{n?jo^BknLG#d|A
zlH2$aw~@cwz4r;c2d{?yCV>X}_+Vj2!ZqsH)Wwd+3AUK6;Xrp?tn)DBB-E*9ZB7(6
z<lVYf-YpL+#Ii~(u`fBdJk51o*N4SMJZw1u$DU>y*fE@ddDL`Rz=oV#L(Z*ll5^{q
zD9Z~B5Eh{Y`ZqG2Jw|`wSNN|yVPLA034r^h)2fW`O$&kq@k=XV&Uqr?{s~7Rv@KKP
zsBGIgk2!^`yfdCfDLa9#oQh(YsxD?+#yrU<(JV(8@qET<MB;dX(uC)T#2F`Sfhftc
zg|u=&jwvWgGL8s><X35eW*MjREEkrCD(%h)1(0|Pa{0(HK!U<7oklrFhd=%NRAsHo
z=d)S7z;ps&At?$%FY>Jkw%&+TS3yP+h7*3(n39Aw`$=-?VKvL56jF(xj9*6l>T#KU
z3v!f;lw>p}(G+?gz_2b7$jBwC7b%5ERwO(_0T0uR!+`}EorTRO%Ft8>dAYs(Sz-cF
zNKvp$$}G(eJkv65OkK{f<q;G6y3eucd4a)g-*=7sY>xk>wQ%dqW^!M^S}AwV@$s6y
zBeu9qUv)L%Vv{V;6<8SL<`MfzZ63L2(BU-AVVeLHFH0SPUmz-YLLk|euolK?GUgeY
zM0t^Bu%4p4_VCNmm?!fn;qd~&N>!ctzHWZi3M;2(au?0vw<eZS+ht)GSeS(@z!uRt
z_RWA}-3f`$J=-DLIw4_CeEQ-jFY<a<wfD_#_spt2GeY@13kiioGg-QY$}MrTjn%!&
zR$op({rq(OtplgW=_z{i{N<VS(q+8P&qyfcGZ?12Yes0E$g8Ok)9~{r;VoPeOdvgl
z%*r_7XbMOS3|<&CF^$PQ=c>7w7u|Qy5nCi=8qvdd@5QP}^YnzK)At7>2rwID(FK{x
zA3hvC-VpMvhuOL`?TT-p*h65(Rq=20SsWD&wt@;-2A1akcz<y8PXEv{)kb-e7JND@
z7R&F5f~TjIRkzvVzeLIZgAUu%aMZP{i!0zY=gIjrO6u5XM<b--tmWsWp&h*u0zmus
zC_HTRPnG~PVJ=PND+bx@V{LCXguS`y4Prc}U0ZW$PCj2zYxz{c0ac;W82|2(s2f4$
zk3O7N4b|fm24~U#>ZeB^&f8<Y6K3Q6GwANh<^5(B;Qs64yW4&tfblIEesy!Z6tNG;
zZ|??W5TIx}pZ=0bed}2?jtc02{@@HFoilXU8aMk2!`8TSmX$l~JF%pM_PUnut!;$q
zlm{B2*kA;LTN9vU>kcNS={m#>JX<&KF+TH`3fri_xGrkA2Bhh{wME-hN~Qqqn($=A
zS=r7Afd-138t4gnvV;~cfrUjXwY_-`t1-$EfpE@gGDe(a@d96wERnII#|eq=2!c~i
z+rvh10%rI@z%5J}H?ZaV6ce3km>ZPZ;Ll*11A@~;aCX~NT?l9M?#f7VAz{?UK8qI(
z6!j}?H_`jjv><?$pMHKiAU3y;*eD;9uLst=AmxK*g!`2!j<T4YGx^Ihq|}J0UzJ)N
zWB&$_P!s==)6uR9{fM;dphGvof7Hx0$KMAOf-*4wW!>es7{H?Pz8S!x0W8`q;Pew*
zss%NGMGpilQb+Cp65VX}hb{4NwnQy_47=iHA7I!O4`){lR)xXfc8?8i55%faLSGNt
zs^Bu>+Yo=rCIE~E2FC=FrBl}nbUk3i3cbPO0`z(Uqym`x^&Ti2ybX3)kxT9w(iKR8
zI*J{>Fa8<6#%;s$2sWq*LBc{4dyY>rwQTB`I(5QeU7F%`b+4U|?KZA{)~(vEh2Fk;
z(TwB;urvJhG>+&6dagq5lr}AlG5kl+Dhm<--gg;6{*Wp*Pm~lXIzE2;>IDu+4qU>j
z?&D(s<0bL3WRy#`zf3fbNRZA8(K?0JbHM6>Z6lF*;P6QxJx!ocjv@xh>O(;8Nsf+>
zrzDPOl+N?x<CAOcfHWzC4gEFBqacc-VzFf+XC>pSOl<y!1REC~xCoFeQu80>KmUDB
z;x}o(oqes1-N}4nSO}x1>1?6?^ZobfwYQ$3+m2;w42PUL*z$q^6Q6k4)E!6njL`9Y
z^R~C1dDE@8JFmIPX#Vrd=gI`JKxrs8i?lYuUMyo=9lj<ZM=zq}A}_a++SkfXR_;R?
zdvAq(Y$WN)1pbMY$xLLMM>)?To}-X+Vd@eIii;@bD4&t+0yx3KWCfhxaYn#y^FM#g
zNHUKJc&GgHarsd7>m0q!VsY3=Zg2HGh*JtSxbw1PX_<H;#t0@17{=lI1M&7xvbf+6
zH-GqP@ka2iWs>9f2S-%{B#zUoEe!}dv8e8eEdBnV+d(-i!a7AsOtQnW<G-URx!_pM
zS6NIMeh}j!na2<eOM~;QG7_P@;4?XMwK+w+ywvlhmdg=+y_UuKyVPzqf2*2RCaWh@
z{P*oFxnU2oc)0_@4E8pQpC@6uxf^e@`1<Y76G)z&y-yBjS(JdFBg2`k`1G}vP)+;M
z2yR(%&B2=bwY;k2MVq5~{i5G8=&(Mj`rce=GQ!%r4%91PTL)CLYFUH1FP)Dkb@N8u
zd~>;NZoXOwb?eKYztfSo;z}3Yf%8NhT6H(fx*PS{+uVuHVp!@5EP+lRo<-p8MuqGF
zB8>DZsC!{GdQq;w(j1&-1xP1QkaW$UDk_?4N>#F1EZxpm-<7F;bB_A8+371xjZwUr
zgepq()ly~Dwx@mhTuV7t<#*YtIX7wI8v%>W8tno2;a<D5VlC~~Rij_&9jNTRL+&hb
z-ERm5>}q1%frq{u|NL6K^XtQ3+hC>}tj3&!zC*IbwU^}9<7{b38v6ZNk~f*!F1WCz
zxIFX^$h=55^y;5q8`OE=`tLl8(ZwtR3SKn3$67D5xnUX(!Ng_^TZZo9AaHH0anp2}
zYco@GZXIwkZc*+1OIq+CO)vfk;Ne!~S3r!V@WENM73~&j9)^G*-zFePi4ZDK4*w)T
zKV=`Ram9WSK?JUtD-eUGNuI_L6Iq8Zc$t+Ik_wOl!g$jQfokwivluv=0EI}%Q2`>2
zkiAjT$!$zp=wYxxzeY4m^E8A`hmyMp(8zBPshA_vu~C>(2=+0Ckpe2xf;CV9cVVs|
z8N8++BlMrI5KS3x{Z>M*IVAwV(jvNqI3B?Q#VM5z-&>=FJWZ1@%BH9R{6sn82~4ld
zqM*i|F!Y9#Y5o{R$tBN=XiN%@{__<U-733MhfB|A(FMRgq6Q9!-560aosnpq++I8o
z1x@PaR!p*W5^`o*j>lcB`=)~}J7n0`9S{4arfbA;3{x}ivBQbfIn|Pq8|zmRUqM`&
zr482hJP{j7?ia+$WE^DOvV|s^xdG~(R5rI_NA0$IPSBePmk|T#gk(jjmW$*B6ON>O
z4;`s21I-j5(^fxjBecl6mABghbY1QS0il?=wt+3z3vfWWk2NO<^nmF`5Duxd*C(MU
zmsew5rI$RDjvFgePcRb2;%K}inSjsADjGm|$L@p*PA5qkr{jp{r?3~ZG!|FF_Ep;p
z$tL45I)?xlJc|JA;D>8sRdjP2pb5#*BQ=6Y&62-m;}`sr#}c(h{{kSDFtJK+k?C9p
z0(pNRPV7~sUvv7~45lZFgY;7;6vm(V0-b{#Oi6M07hYVY*@fcIKWAu!9^pp~+I`E(
z0Cl|}NH+esIlqKz^d%&BVCB%y(WYb%^2O;T=AULTLN!P7G2}03)^(zuHYc$Cf(XL`
zOo{ggZ(qGwPG`|cVj)hnPK%ZEN$UalTvX`sISQJ7AS1DAjwE!P0mjxS8)oUW0o#tp
zEu^yTPjUo)MC;48TuhE?47)Y?0#Qc4qyJ8$1YJZ4JC7jn7E;x*5&&%vyZ!nRNIt9y
zjn_kMy(e3)n*wn&ofoP(QO)L8w>2<od@&O9obp2jwQ3z$wmlw_)8+>wIqmNiqU~D<
z5xA_yU48KVBh7k!ujPA7a`Jg-b2q@YOF)v<ee8R_k999(9wpr7j`y%6S;-jsMslod
z?0ZYG&0c&18Fn{O*7AJA^mGH;mZf1Uv|Q|Yo{kOI40VeJVc-p-?3R3LAf4SnmaXcz
zzrw5-!XV0S5M{*-tr29!v*si>3tvNsZMRj4u#KM|oB-P#a)0r)@z!p_>(YyxEAKD3
zHpelDt@m7Pedy9_;Cp6ZIy!c!!Lj8s8wUopF=x!DggC^u*}a!u4`)1UUz$fC>HX&`
z^fYCBo#CS`&sK?%#UY)qtFx2VRGs`F87TX~3c0dUkw*~E`}K@W(Pcy$)`(h$n5ydr
z{fWo3T$xfz%LEDLIY%>Lv2V&Sw;v41?!TcnOSlhxdzs7&T$}6I;X1>X#RDAZA;qr8
zOcuBy4_y5oZ!eH`UsIB_OkXdQ>1)*%xz?VN<Yx-;=9!dUO0m1LvI$APq(<lHke`fC
zMkq+xVk847PaqU>ZN<xv$}ObyND*~C1Cgd=cZya4pB53LWw_>ef%r7wjB$4NH`PPm
zTY=%)f#FfiElbB11>i-qZEV;Mvl+PX_;l|Ar*G8~r%?g|?h@@*s)?Iafw~Ivsdp7^
z4Pkd(bz_ilv{kEpfABVoONC2l1}%<pnxL)?rCH_MEUpeS(ei)30)b&!fqSQHJaD{J
z{dj-yp^D?QJw0~WUC<AYMo?pEAG=na<;zR83i0AvRf;#8^}%6(0~HjCtJSCqixemD
zt6X5^uN}3rpMtkmr`zzYlwP;4#7NurVd@IjlqsuN^A+m%R}~m_HO;{uva4d*C#*V|
zl`*>e5{uPUplziDZ*N|7bI0aCJ^2*nrOipK@?Om5PrEgP&;by-B$0d9S1WpO$u-R<
zX;wTV1%D~kmEIv*z*6_NpfJ>fGZd0IU+e$7W8i>)e&fIa_U@>J^I(NJhZ@9n4GS}q
z8rU)d0|y=>*d;WeOmiHEI{Tdkr(wfT(#fkAk3h<~<R}2o&{9KcSjN^UOO>KjWoJ<W
zQCF^MBGL_EXb8x-_NtjhUj@Rv##v!M*t5cRER6-s#+K&U*a{7Ty)f`Gw{+bwOq2Wm
z7JKLVhijw9>~HXaGEj(*Tm0gDU!sHrwreog53ueM4RRM!>=Vm`g{PT@MMK|TNAMV&
zHtqye`GfFPsN5-(4}_-uq4cD{G>v02%lTRPm$r{ZK<EW*gM>lJG&}oOO*2i$dHnuB
zIct0;rw!?S{heJmgzxw!2M&eGejU#ZK!{84{W<{6NLW5_8e-YI+DiixY^K>ooDw!_
zz`bR#4e2pI64A2NZ(w(6!NSt<W141st9QpQX;$`5^+dX5jLIahZMTn{7XX4JsR|V#
zyMPPn<KOoDC`X}aERcJ!UA#i&znZhhZagK2nXaR|9Q(S?u|>IqiLNnhxt4Evj%#|H
zJXBkw3KG!>&?K?Wwn60eB)yV+G$DAet88hxgN*~C#LHkYouA5>OJbEYy_dwrE_b5Z
zwlGDN^`vW?1W2kfo5+&@0y{w5D6YJtWgGQoiN(6E$y5aPdtPZI%~tOksm|w?>-x5a
z1I{S6DAlm<IVNVI<}%%|Jk8lZ>%!?N`Xf(xCT<5Jk60D0g#ddxkEFlZ@&e`3HXyl2
z6OJCWV+TEwkq~?F-0rFcqdlTEX)NjpMXf{^jle|{l7A%0VktV(Q4iMG{X^r`@Kj8j
z?c}Nf^6rO2kPO0m^@F^xgE`Ax|AGWOZoGM`DMDovrGDI6D812QAw`#ABc74$;^3Y}
znRT3<0U+za0zjtYa8F}C4js<0Ws(s4I=8XOG>bACI=->z3AY+xG2FJ2^iHNzab=|8
zY7z0#l8lH%z9uOka>SxA<e5w<-VhgSoeqxbUbkQ~mr?gxYhGt{u>o@a){wJl4ku1^
z;t<nzIH4wX3@}fH)W^hPJ~ji*4s_GAJhm=U@V!@EYn4?>sRBZQO?h21Ut1-hq~PNe
zJh6l(suW2W@mVPyj>=$%BlJ?`>H90sSVW5v`Z>#hM@z<BqB5eVby&nDnqL;>7YnJl
z27E#;BgpaxFV3V3_L$6WLl?dN^}XMOS>o#<2S>`#)?5h54H1$k#g5LX1xR~9oO@1~
zRk}{FKz~yR-s+9?<@3g!^yTy0S1-PN7JKQ-XStcad{&swm(RiC%jdHGFP|l(^X2nz
z^CC{ui_w?QB9zSN%jc)*EQ-?to(b6X%jYMvS$+n6V<YtQC(7f|m(MTLE1tbfqog>J
z8|usFaz}mnd^L&a<jZF=o5hhbF@O0?GXCW=P-nk<4m1AuxyZu#<?}p;&V^~Fy59hg
z;H89p`8-QuY9kVV`3#%&%V+*+mge*9EAZHNxZ?)O?HM|tT(d)>dD!8Ohb^iZm}o(W
zjet9pg@pU&dQ;=R3Es81+`03V++1IFC0)I|?J6V0Ox<>u<!#5sZ8wwIGApcC+Fjtf
zI~r|pSlvT(t$~&`z_g0*+6Q(!8p(H+2-4%-D&RQ0s{|G$uWWw%Z5D$!#q;E4mX0B2
zi>yM3I3VF{eY+~z=r?Cd6sq2Sp0^(Ww;3$t_Y^|xeAyB|Z2T%%x1EpJELKXF+N$rR
z3bub2MVsG6m8yQKn{3X1v(f7Jf!2HDFel%PS9|wSKmFmV2D%Yg)b+5-bPrpEQS3Qf
z!?tDmHgkyYJKw;3eBUUdC5fSAhbk<uR1KuDS;!_6GMn+z#cmyxx0)MT);6GY_W-4{
zA3BC$8m3E`ZDXC;6k9s+G4VnJ>&$YfqZ3!##t*&I7{U^jq=hBin%C_Hl1YO&Qa39^
z{E-Y%J5n63QG?<IbS?!pta84M=mgDTQh=LC!|zt;{-EEa9a>3~b|Psn^2ig&9s$Nm
z!t)#)>J_lZlQ7LF2R~qxPttkJPyn33j3?t_0tesShy5P<&ecOh^ND9-li3=!g22N*
zaeYio$0oK$EZw@#QGq2{v(&ntls@xmqBxs!xAlMq%dJ~l^8WY#`hT08KM}!7vA#&0
zal#f&=H(_LShb(!Zd#TOmbNa9MUL&$dh^yBv9Xck=z_-!*vGRhrCe@l3C7EQ0tBB$
zX%-bx&Ko<p$W#E0dMg)m@q<i&mgWsA<b6R1ANoc%P1`qE;9)HcZEP`*<A8Y~)(lM#
zJe^p!XAQEtlGWF+<!YF)zGNj(xXV?$hk#%!3t$(|>#8wg5-Vt|oN0JZJP~g5a)wtH
zl8;0wF{G7+R8BHLgydIQSxP;-w~qDYOe&B|u1>8ved>u?uv%lzO887HY^^m>6(3OA
zsRlye-HHi(4T#Eou-Bfa8J6xkF4jWF#}+p@_B{`1BB35y9=F18k=5ef6Vtj5EWj`C
zM^Veuc}9iE%9COl!)gVLSu%tC%lZ2Qt-K*Na@LkY=?_@g{lvnI2YVESj2nJnIoR-g
z2U|f%aS%8<)_lu!9N%HCd9TBgx7_pUoV=h*uF;w0c{4+XrZmnxPiaIz>+YT@!r3w7
z<0vn9CamjR_}B5gXhaH^?Vq6M3619v*|Bj%j2cp?wA9y#yHJ5IBL>HYNFD$~5JAXE
zG0!+uE&3`+wjF4z>1~x#I?uAN0bK18GIh{<>s@CU0V9q{uwytB!l`lqupCU7<Jdg(
zT+i8a0Ra5+yL<7G+HoS532B5o?QT(cO`u6#i6L+9*3C5Z#wHav{<2Eg4tg?LzpcwH
zEh|vt2^O+~k8MTi-6I(2hjUTmyGP1bTU7e!!+EQTcaLNv;_0Ig=c}58Qj(M_9Hkzq
z7;Ya23*7ny*4wgAsu#yu#CBu~REctL-3h9jO1l2!y?vmXS$xgiUfLm<@2XtA8E3-h
zs%N9sHS|;rT3klzL&z97bkfUxt52Y{YbK|@Mw065C97Vaw7T!RJ)GEj7wh8?*C*s$
z7{$fbfGj;5{T5N+b?u=8^+dC*kXanN0e7%PbRGMyMR8zT+|pfY5N}I>>h%wYSW0VS
zDVe$mrX*#TeF>!G+T6Cx(7~EVHEbE2K}ZE3bIKe&a1EWA>x@D}Af@Wh5J>4(0x1E2
z@JgDWg`rwVRw~j^9WF)6<zF+9Qe{V%_VTMqD%GHp*uNBfNU2AC^PX)BQ1o+>rEv_J
zRbJZcqXb4V2Q%O*J3RDyIe3vW%~J^WLdIMf=XnGffJGux{`GQBUn{_i?pvPg={hF9
z6=2IYUF^9o$Bs^@%MH(^#(hrB0P9=VHZJaVM(Qo7nXV~n6;<4mN+DkZj4cNsDifcO
zD);XanIuYBbQv+RQ3x2OIaquJPo&EbDM&Wvunjh>)q4PpJy^-o^|-D%hK@Dvd)Tt5
zg+0^vv8QWP_e0(E=$=DiOSZ6Tm#N*gF-k+3SiOd=w{y1NfVoXP7Z8HPj1G@RYCG0X
z%CJIF*tC18=>KKXW=T|dA`gVOvv$_Ep9uRX>ihVTXOt%eTnaz{Vd*@G`JsrWc(~l~
zX<ek#+aq+WYuX4IN3GCF%T@f#xwbNuaH9z0IjvDU-CkL03Bb#FCg8YozyQLPhp1%Y
zKKgLJRE>c9gq^c0(-|3*_=zarb@YcvAI?|J-jMM4K|_1(g|v6*o?#E@-uFWHMqhDR
zH&4E6Eo$xSFY1l!azLFQ<hpF!x7S*h)^}c(a9obAd2H|S;#4RSefOYHK0Y0sA!BPU
zoNsNY*$+F-=<5q8f}^{i7D#ir3m&eFa>I4qTTB^D&fouogL?fYBY=`O6zq>GvE+Re
zQ?0vrG!1v|O&6*-l=cq{7^prE^P=s`QB-da%X$6W3}VC`X0B~VqQNxr6PSeFeYgWO
zH}9bvBZ*76M_e0I;)dAr1CBjP7-qU<>%<J0={pbG*e^3$e+N^)Xm~L6?~B>r*O*T<
zYGU8j2)2CR!vS{;YzAiFSwWzMraPGZuW$C3`}j7D{-UOyCVx@(HVppVMt3&%cPm&j
z_IC@cGWB=L^fL6ziLXrfohk++|I&FNqzhO?;sR!uB%z%BX}^v9%|*0#YS3Wff0$bR
zVB%k%qCq|X{_Aou@%Ngw!NlM1&;FSBYq56kWR$_g|Dad)Kwjzfxdtx7{aM)qd1cQo
z>4Ch`XVM1p%6DI=19|0krhkAF?!>t}kXLSJ`iJFwx5F;oSMth3x2!YE@m!brSTjk8
zEr>E1Sek=_z@m<(voPer!{)HOo{{PIps+x@1B2z^Z!qdOTr)JR`KEy_({ixK4GlZQ
zVAS;(cZokxSFTT85!?4Rm@80GPvQy`y$#+<r^%gZE1mb3SSy|9t4J&DBE2{(V#X`V
zO1pxAv9fdw42+d!t*5bs_RbhI5LO;0f;tdZmZxYStbG4<IS^KQ&Dua%>Gx+3Y+)T1
z_TEV-16}1|uIqt_HLUChy|M=)R<F-B7}W01${vVVdnSAiM65oOHW0DC`$8RvShq9%
z159=&&fS5Cbvx5PEa!oU^%aR&51lUJnil7l&9TM85L=Y!IM7{&HN*6L&2s|X-NMIO
z|8Pj1w?1{Afve=-5U^oSlIL;mP}9;)Y<L03mQQp{JfGnpv_r~WLPK)<$@A8Csu#<z
z=Jz!cmA&C)nxm&_9Fri;M05}IGD{UJsO0ovjNv~|a>OA7CSs7@40uOVkt2Ns93vtY
z0D`0$`6LSAGedgx6dfOTnmaxoDIU(0=Q$bk90iLR$wj(0NVzT>8Iyuv0gVt+O;M6%
z3qf;=rZY&u23gzYxyU(95KZHllkuD*Iw8eLb9^$h^Yf(OaU6|#LOII#EX|5sb_NF|
z=M2rjbW!C~OCeud_0!>{{L2w!zJed}f)f_S(4Q=wk0;2`3}+;BVW(liAyqayK7RfN
zO?W&5`p^Y}1Z<p6l8BNR=kpnK0mj0!JWa&BA0MMIOQ(Vfl_eyGR}y{|FEAB}w-_pT
zLXsjM0mn;ZuFnh3GsXBS(kqfNl<{d=a7-u_skhQJRuh<Uk=Bcd>~djo(#n%pkU-@E
zZ+@*cS?rFFf$3Cc1&3#y4}1m_1Jhp9%Vc)F=5R+SpXW1`O0ODoE*i{7-86e*2!i+0
zd=y48r0AZdd4U;^qf5B^{_iI*#VlNsI3I}@CHXXAh_ET7)0+p=D2LopIU>;UTr3;a
z$b=*bkMnAN)}`uuBSttEc?D?%pQjo`>#IM1gUZhh+mz4(R!2Sd6ZDGbMHbNlMKa>C
z=#5+p^JGdAB8ac>dz$3)DbMPKK;k&PilbcZhGr*NIwet(kK|l%=t@>Lq!vlpFS$zc
zIh{b){&Nnj!6$hR)yjQZO!z|V>?DPk|2~g0&g9(kBuul$ZowIc7fDi}Uw?TbRtJe=
zwMGx0rU{E+21yJIKv<%Jj7a9i1Xd@NCs1BwJQ)|0qfwP(?jNx6W?6I@#k`yk@j0Ws
z$Vibk*u`O#<@Nf0_rvVRAA%pBMR_)#iBm}~&RpfJgI_x9_lMKq#~)5-KYloz6vZq*
zJ3YO+x;mMbg-&QXJ>?0W=ci@1yVD>}$ESv7*r&R7s=24EY7VRBaMc{HYQhCHcY37y
z_!QP6mLFFvBC&>Ay9RbWBLzYH6ZjFx6Z;GiG?`CHg3}q##8D9?upr<CpkfDUdU1n6
zIj5R+s(YtmugLD<vU|AIJq&%r&A#Dw$8gm#Tz0G)K4c#Rk}90?ag^{gG)b=zS-P#N
z?F0)emM0-ir?V`bMmfLPIL%YtIfb#|G{MD$W9SH;q*s`9KU=wdF!Te*oZ%wHbw8?M
z3B0E~5o40DoRS$oL;q=rdjr8*XX=1Va!8eWlLhF&>NCt!afhn4hpSfc-wh0fuxu2Q
z1ipxD^z`W98uAdWcl2MQJPM*XDi&J=kr~Ozlovevi;^bakYJ<W2D3`CNXaiz{`24G
zBz}`_eCLwHb5Xf&U1waKw2|VA3nFk93Ch9umvpZ!yxLR?HC@xN1_{Qkz%Z~+O%rS7
zAJ8{%S$H*XD!lHV?Xj8X@lTvE*vU(0NkfpCa=0AxGFL9jc`P&g&UhB3Y$R{08PDJh
z<Jl!hD>IT^K)v}1`n8m0Wg1A#<{+m^xh<7v8e|`a`;(@bs8#hrNx|aAiaF$2B?&r5
z|MSO;B=eZS_WtMN^5HZe=ja>+Z=OXEk&hp$mL+Q+H7WZf8-JXVPls=!DbEWsosH13
zVBd>|)qBs`QC0gt$ZU1xFVnnurX(!ckbG&LC^g|wbgbEU%N^kG2vr>aXS{$o`sf_J
zKaev}&E0DX(ieMwFhaj&44or=1cFuqe=X9Sl9*&=OH*>ean7>{-fOhOcu3|kw5-8x
zQjHy?<(Zt^nyUZ$=xEgJzLa;OJV}Mq#G>iMaJ2jIs)4ogS68Dm){kymN510d*9IKj
zef%=Q;<MVzq#C-pZRneN@l6L`C0M=2=T})IS51Jm`vf$5@=d2e`t9sKe&MdLYVh{%
zgRlDV6-N#k)QiQNXok+A`)^;pP#gGfB!djr*IEOuBjD|;7pSVNoDFB&Z1n2a?am9_
z1iNo{P{f}#74awCFYm4xt8DAG`rmftf>ufCzEze|eIChCsUB^H4x@i;OJFVF#U}}g
z7ez#Kg)nX^Uqn;>6oj8o#V=VpeOXGyLL!c){1r(y=NZ1Xi`0s6zJR1`d<9DMwF?{+
zQ4!0r_3=IKniSRN*=nn3@`m;6`&u8wJS?u=*<MuVc2|vlrFY;q_h#WY$<F~ONH;XT
z?8+ypvQfF)ySh{A$7P07pI8i2@+q3mr@v$p*LxO?qaxq7ntIsX|9OMem~+snNw&E5
zlH7WnEiFmoCfjGptg@xJJW3D9yht}Jzkgl_jM%|$+R*Sp1-Y0-Xv-mZ=N0?FpqA@U
zf-T+Bv1JAp_L;@8?^&)!h-DffJ$R^4&TU)Uj9Wx3{*o3Ppw2&n)pRRvA#AJVt<G7r
zHPrq=RPgE6VENxOq{t6q3`lIC^Y;f=utU#uP5Z-R6o``pg9(q!a(-6+rF?RhqzQi<
z5PAXgk}xQlW@rDZX{PBokKZ4N$Rj@#G6KmD1*=*C!3vW&8YgFP!?!C$VVV>e&Z09z
zn|)IMzTyCdo&{;l9?N#FCQ-p3s}BF+{lSl21PQOTo}%9_d3G7`E77sjg2^79mR&s+
zlTrmv*=l!F5_gWGq6J*7v#~1cTQY7~%u0*vNSM{62}fAbP(C3UU{%VbxxylbYExmU
z7APZXS#87MHv$O%0_Q?=L03{wS!JsmiS|(r$WN4vYm43KlC|yx;>^JRj$hMsCah5$
zY>m9r3o)-?C&)rV!OC0^VKag0EbU{MrU~p&`Ozvv^emp|U_6mFwCd*qEONqp7s-G$
zBb0;D0Ifh$zd_iWG9Cg_C=2DHXBjCbV5gf9Y0e1eaf~kEmgZowZgn?5Ili$J*1F14
zwd_y;A1>P}2*}IB2wmNDv=Hl#YhugOLhPB2j%^ZB&m^2XF1ybGjl|R}+ofT$5NKlU
z7)F1U-|7%h+6o9Rao;2OhTU_ZS}U@0&Xi@dY%^G(tvmb#y`DuEf>*IXQNjd%3{?oz
zA!jYh0wvQKiN?vv@r~Ed4ftkq$q923ns5R_;N7B_-5SG8Bh=MFobosgu*Gy2`yn&2
zuDQ0QX)dSQkV~r>kf;vowd-D~Hsz?VC8a$2;qs_%C;4b;`}Q=nL<xW}O`K}Ip=BB+
zwUOnhwx>+VryVM3T51}Vknwnn#izg3qNhcu^^UBphH)F%9K2ZJapx##PQysduNp@N
zSXQH~V7EYVHO;Cpd|>gboVW7V3h9$D-hZc2f-a(jor7GL&I_KQLoyy8weZ0<<k#rd
z%JGnx=ae6IpN){#0Tk;okbHwS)m3+UKr=hyhqr|yex-0rB;$lmNY*0^z=0^YW0tT_
zPd-I?IY{wAdLcd%V17XY9yc1i)huJOiAo{vtf<~m5rqCx;&dWPK`&pA?S($v6x{mi
z;zT8%Nx|abrsp)>&<v=94L!866<QRNz%{Vzg_;+d2DO8GEpyA;9GXEv#>oXsuadT$
z{dyKh#VQeD1%p&lHH8&;gp@5*s*55d=&g&v_RdnU?DH(*4_p*>ESs1<;n=fGf-RQ?
z*wb_eJDO+k&~#nPy7%iAsI;>*pJyG-@L5YBT`Sq<Vqpghkj)epz)=fxh!Psl8E=rE
zXCx~k8qI*)dsmioZ>>(H_ST8zg+9Ta?VH#lfsH-Su(0j>9(62}d)9gk_tsX1d7CR^
zcjnnL|4blf(ltvQggJtvu*abn2q%N;6kW?r+f7Y6K~E};sf?@)RZmkv_9h8R6W(e#
z%B9TD8JY{=0)#sOf{E^k#ZF0r_$SH*ipUX*@*+xTQMDv0IO!1CzPc*2nx=LuOsD$w
zn(Xxc;H$8TI!#q?-#&k*(~=6=+fk;fGKxacUk@_(O%IwyT&h8L;WSsfc^2^pD^qKR
zA6T4HOqp+E%k*qa3|q$@33T5gjCtXn-$2sQi`_tuQIf$H2}T&Tn#X%LqIk~}ycHl^
z$!6y$io(O^`Om85^5=7TTA=p_<rDP=Fwou~fFEG%#}eFGdoDt6MA_kpyB|j!d(fww
zZhLxYSuXYilVi)XUF=zbhq>zoHVYk_P<wE5zdiS#($8I<ilsq+U)<ac&kRi`FtAN+
z3tJ@Q*e9NgO_N!!?*z;a)|tEp;!X8uAl}>x@kWIzAhGgj|7+=<|5xFzFSIZ4((lK%
z0TcfkFMnZu><UD{d;uZ{$w8;a<1D>`w`hy|Q<^VB;n{hDo>XBGYA;z19^owy@zS4F
z#yO~*rCF45TEvS{8B-txI~S4O;jsw20D3-&FQ8{r8EgTJWP<V|UA)058l0?w_yVGj
z=yDYaAU{DraZ2WS%`rez2&xcplqSMou1FC{@++P--R_~2IifLmoM$LX&{dj={7{p0
zo|QbITp{?1g;O$x!~lV9dl?lA5eFhs^-aiZ#uEwX!Y?ofa~W?zO;DPlAQLXDEtlv>
z45x^INpoCLgoLOUO{KSVp3XDM&sOz8KpXQc<4F-OkPsk*adHh=<7u4E8G16CscH%y
zbMPEophNNK$!w<l<4(}?0$oLMjD-Ka!ekhitPUnt@)Okw1%F7ETna%d1er+wJIWEc
zBvCB>A)-EHoT%?z_wqGNLc-&ddJ1|+E?Bu7<yYy%DtMYEVU$e~Nno!2J_mfMq>K@C
zkpQYy(Wex1On%aY!?qIZv$Hr?1|Cp;;AJEL5$7YRA|%w`aaH()>WJtYNa5tW6KG_g
zcOq>0o^A(>`q<~XhAr+{*w-BkyPm1}Mqp7ItaIai(28zji$g3Ib-V+LEl#u>y7`vJ
zN_nDO?{Gk;V*9_W)n)1Pa@3ETB3DbB6Vhp*1Ouf5mW1;F&s*87zy_6q{R*9f8lUrz
zU=lfeMXp4R&qzTUC?QnyTsd(SaIGA^I+4E}jnG^5Bu=k*cGxHZX|bNOqXxGH&KA(N
z#ek~XU!;`8&B_G|arpK*110`H-X9#j(>@%H(6e;9xs?9lsG12`=@gtKIFL5S{1f_*
z_Xmgn9vzAE@8977{Jo58@q1LDe^*E0?>UJ5l&d27B1iu&$f>`#B9Q!E24ncWiq!D?
zI8Dbf|DDWc@c&ctk2LvxMiw&?|6W!;pD|MK-!FL<g}<vHCci^Cq^mSzzfVK*I|OnO
zClv*}IL*Ykfe9>@>idI}G-<_#cz;mMuZ(rX;d|_`Kwhc0R7Ev<UVf)#yo5=>M6H2M
z&fY?T+w9?8Hgmf!jbg2B==<BX9e>`6aUxVaF$|t<apqP{-tIW6Z@RO8X8B#w>pJvO
z=X0#`%WgDymz^|sHZ<H-lfhPJ%&PypVOTpmX5Pp>b5|$L{=rgrbJ$!xh#fN2?B=|A
zv-C7Orc>I{opYCXwATz3zJr73b=*8};Ou!*m(SZx72a!|@9qkE1BcL^-9mR6$WAVz
zyE%&X?Z!&G^4-w;E@n|rr7z%~Z#m4zIwu@knoV)wu@F<v4Z|{MaL<`nEAW{m4;_(V
zTvAKAD4m?n)vSN?1m$zacmiQO`3U4_Sv;K=dBnh-ESr+J4Q7o5tEJ(JQ|gnY_YJ^b
zvn(BFJpT%ut?MqRo&0f>Wht<H>U$yPHuJG%yA%hS?O~$(Huro^sK)mYPN<ezcY#&t
zz+u#Z1a?vN+hv<Ms(UK#E#vqm-Mv+CgZkbzh`)Q(P}?4TSXT8m`+&3njBn;jaaSe#
z!6`yHMbt~`KKMi2XW62k2ZaivZ<}6VQi22DVc0Tsf_=&;cKpC2JhTGcv+uEV@wcwA
z2_3>E54HtH79;fb&C{b=$XG2~2tqDLjrU}9<h&pPA~}Rg!1-N7W7f1YO{>F%n`fE^
z<}r=}lA%~yHlnV#r21~cn_Sfzfi;8_vRUN_u>!n4sf?nVO>`(wW<NpZ+Gh9@D5DrO
zCzlaed@55QZi{LGFRnOGkZ!@S0e&~c1iXFobcB8dRb~Md|B^*wz5(pafYty%Zj9M}
zg5HYW!d#^Y{GUZ9mBc2o_GnthZ_j5b*th0z_@Xonu^e<Re5>z{kS0FnPBNMkP|dfw
zk3+68Y=usUJw0GJG)>oHuI(9yzlSnfXMc)K)7qhGQ^GPaEVTv1);u{8dlEK?&`xhA
z%mLso%*|b}{hP^k|7Y6pS_ZQM2ttRiPRiepM%zWdB?f-=vW!t(KUgC%!q2b8H#irL
z(e?YmLN(v&^q<ms_V&$FbS}P38ZsiQ7Imzwz2kzcDrh(wmsJYeuLfs^VM-`k-{3+F
z-%j`ttJjxA=9a6l_@VX>ZVX0vm!fkpUQ<#W0#mi@&<{x0M&*O|2O0qH)rU}pj*eFU
z_Ws~Z(<;iUT(9-$mjU#5kN%|gz_W4>2>HG0;%J3%-%}=g0J8YjuuAI1aTc*1QFaJ_
zzZ29|fo`|%jNC;6uOWDUzx3>tq<>5K*`4h?+<i#e*1N%*!{xV}Kz84iIk+Hu%8Jx<
zi0^AYwry9#R>)oK@sMIY@B_=WY*#nQJ=WzK7VMHNc-SOTu1=rQQ12R0bJJ@DT}{$l
zI4?qe5(FOskYd6ZAiO9}(~BI%(S@LKss=|jflk261YPks#*z&u7>npo#vUWnS<JzI
zuTpmETBL`HNP_Z==NIyyjp%Q$%VI~Ok*i6H7^HKG5-H}0=sD>XxgrbnUtLPbe<`Zl
z3HmLI#t>FbI03bslf^WGI$FB(0CBJO?Wt>*Rf%3e@({++LI@gHN!3c_eFKB9-Yj$5
zlwS;DqeIiPESi#RQGx4OlwUlC`pOqd)(*T73f`e$YZ4Umaa2UWgQ{tVHJec=gOhX~
zGtg|Q<Sug73eQGzpaQa5r)`o**Dxqws-#3YZx6IJ?f+E{b5ypBfB-GVP<LCBBOyMX
zm<g533lIhIHakIo<jEYA-9{oQmhxQWVxnoxqz;}JBn+jkMEMe@6+yE_x4bJ{M?sC*
z&9|Ibh8EZ%<{>k%#fXhbVCh)*4b9X;$KXugL+!V564qxLtfFAiKKvAM>DlwwFJC<Q
zztCTv{Q7hAXghpTfCj^P{_excGkN|&5F2!g-oE_Hk-~x0@gYteSg>g}ew2%?56f#N
zATW{fNGZ&UlzUX>BSRP^sX8Wb1aw?FNwZ~MWk0>UQoCU_y%LnZ^ZQ8ZtN429Rq{+t
zRD*!koX}E17r#9dJ_1037g)k`IoT~b=d)E*Ov#jd#c4E)cv6VEp2&63<WAP)$%fYd
z>RH<lA1GlTb6y<2dNx9arZw1|B~SJ4S-D1ippt4spmX%<r25wym_*gw8vK(&aPpQ|
zlg*k7m_L#%>iyU5-5Ll*w4>UPJ(^x({%Ho+iEOsh;l`x!Y}KN8QWPh!(-lZ0V>&ly
z4+=C6hULlT*-A#PeAHZ68>WzF?Rw#OQyppas!ijqcR!G@<p9@|XtrEcUA?uHSljBF
zIt$?g=MoR<QA5i&`LOxCmXnU4Sk8-&6Ow-v9P*?%tdEBB`#ejh0v7tM61>{guX1mO
zrT8)?R8WH3mfR8g1u`eT1_Zye>_+GXsh^Nf%L`I|m$GLgH8(4!>lH~Z$|)-+@VxJw
zXl2Fici@peLdFuUv}%y#bkrI=q;iv`VgDgr>tbhW8L9P-V00BgRt~l*rOwVq0eC3e
z7eC6smT%-p_M%4I<iFv$_y!23T0E^j2|R<3P(La^$$-{9RJ5+SR_*~@mvMHBXq|2j
zXx)I;-Dk8;sJOk%3`)agI<;8n2ABn!i!EwV98g!sEM%Tzn3TENme@7xAFc&P_c*z0
zJG#S?Yx%x}dC-||nwG9(Kd>pbIOEu}H3K_dU<R6DI0j!g%|n=n>dz47;TFR@v^?(6
zzme(eF?ufj{1@mM2c${)B;H116^Mb@No69i@eCN>xqPJ&!68RP!ulh4JmWM9BMKC(
zJWZ4V0Fs;o7A8@zlg@Y)<%=ia8azv*q)_1(^D4)AN+S|uo{Xb}i?|JEh*Z%eW?-Tq
zIePwPg!m^;=S6f0IbG6b+zKE{&7+vfzMz1I5ZzIwUJ+EOMo0%p)&j39$XJlnat?s}
zoWx)e5KaCN{0L@;2nb|QLt{?Bak}}aOj#lEZ5VBogc-?;Y)*@L#?fKZ!~*GJ()0qd
z^<3~0DwMB6wv{7Dh>ik2iBw%B`yM6=j1PjPKLHQO=f6EwzW*tKumS}JV}iuhPx?hh
z5S?v|tYr+6l`nS|1w4jq^||apk&5ofA<UGy;2+Z3v0^=vm}doArW^w2FG`{!68#9k
z;!#Iqs7*64y5kdgiB2jL0x1wt^|Y*6ku)95vNR2W9HPQ!EY6TXD<!`%<KXu$J10k|
z0&_ItKQxS9)gtVy!O~#SH&jHqO5u|v;~SeQ+Co`0o$VH3!3{&r3PTh7p~0|4EFXKO
zXJR9;ErYpU$o*jN3=RNo!c6Xh>WWp^Is#=peDE-DL%YxVV!N%{RJ76>=6!au^jtbm
zR|EQmT=1rm19jeiE!KVu?p&@w7E<8P>I#JEr1j#{2`OYq!RJi=(tfe|yz}ZCai~HR
zh4Pp7t17-iYoh9YO7w6Uo?RMA6RGV40Dv#Q<aU0(&guNT<2t{b3;JAFPVK8JRsiKv
z4_7u-x#~c1h=;>!|NL{KPdoMeu53U)<_yTlb<Jj<nwOX3_Q?_ve9Km>)h_c5uX^Ps
z-`hKTZzJ*!?)Bfu?RfC9-!@@`kNx-evA>CHI^=cS?wbC+(MY(NdL4TAHY_eT-O#s~
zjs1X9Y?%hfgg6d1Y|qpk&7_9m-D9$2TP|p1#{+M)#jKN|M8@w)L-doxC_q|~+MAL9
z+u;-IY!kvo9-O3rQ%DfRUWAB)AY983lv9#jD91D5-vL4S>g1GnDIuj;^1D01Yre0!
zp&ekG8XC5U%dzJ$6I0LEZ4<zG{~N5MLE{@VzVEE@ZPxRG#j^fAs@?g|H^u;fdWT$!
zJ83N7?D~y!Dc%pEW+&fv*U+p$$K2O6@NIW7F~SfVhG7xSG($$|Jr)sOuYiRmew(Ai
z_J!Y~<d-3E8=esr6RQhHm-Uq?qlol`h&w#vvp$Xp0!KehvnGn%^r$Flw<9FzxYDd5
zd9<gJT#F&<br+p)#@x=*0{j9>%y|l!wTLxb2aIm}Wk_v|GxT3kQBsC~NPhf}larJG
zDrwS?g-Vd06MhvhFa?VNXCjzTC#W#k07^qmg>zTqYj`mz%p1h2${?^xM1vW~b7A!$
zfYq~z3PVklqY0m9fPPT~)^tf2R5pO}-5zcYueeAXKZ(ZR?++ux8O)&i?jsb$DHYMi
z#ZO@7X_;y=J_Q3!!vHbf>bsC81);*`GF5IYO_viflaEWoMD+ptniIaiuY;g~l>25U
zQPgIkMMBTPmd|}`h1A7?Ll|})X7bPsT}GU}6Gcx?>$E=CJ(9X7(%J(Fox-|3l?M<y
zMH`Nt5z0t%Ax(6Z0hy94TS!Bz+)e8;B1xmkx@1OeHgs36TS@GfrPi|g+lG|<w}yrM
zyxl^7E_8#Yt!ii(S8gHba#SGLQC;VZ+G}HlpGL#QqQ7HCIj-`fG-oHxs&RIS)y<Su
zjqn6zw(;(hC_G$~<8TEHyG{zf#KW#1!O~lr`4L*R6q=uS)E?rfGeGrq|2A3tqIQ^~
zZnq~!B;i#r!cu#)a<{3ShW?MrJ5#wN!5#ubN2e=W>Zu(jtKF*VYwpd81mDVU_>#g}
z&%j&eut-@t58^WUd-<u3&@s|A4V|{X?Fi|eY>4k3$qDUn#m`rKjjCux7(ZY2f!;m(
z+hl>%j6eEtUQd4=vZ3tHqYvku{=IvoBIq=Ww1(Cw^M~r;OImdK=jZF#=jY`zY#XIk
zv@D4Bt9rf6z`tc4dm)|P5ALy{YJVeCl<VXku---7<$>}pre*H~RE)mn&S;;l_h4%b
z4k4|X8Ft6l-yMIr*0!*|^|sh0VEs-R0c6M?KpHjeu0=W;0v!#3j&?)Lc5<F#I&*#I
z;n4PVY!Sk7z$^<pgc&9=xklD{vD^oM|8J|<^=-p{mEBq*uo<U3x)jAHTsjwY3;~6}
zA7olT3f>3;%a)bHd&0gS@+(y#BqD^^g(>7@jK<KCC;>hN0T)nl6&4?NSnqim+Xevl
z601Sviex+i@@$cjC;`s*T_F#MN!SsywM<<%2-7hSsE;ip46x4whBX!t;z58K%icT8
zb|8%JA7Q*pAE<fXC5HeYp_PQ~M<3R+zDJT1eO`r}S!N-aM_s6D876)AsKw+41gxH?
z-%*jykgh?&y4wSt`n#i4_k)ojuZ_Mj8mSeSq3_`!qye^EOUFJ50_=yO=KDPGEhoIk
zB1>a;g2W*AcZaJ8zIL@azTx865>-Y>xN1uSTL`B`6XGAO@>GMtZDj)}D|ThuM|0_p
zS8^X)j&m4Q2UZ)!=cR+BvU-cAM6aPEL>kn^nFb<MROCDkYe_1Y#}~Mgo1|PN<J}AN
z{j@sEMDAyr&LmZ!dgCfeSbB9=<fd!cx_#fXeb;xe8#o|0ap2~-1lyL*wSagI4UD~$
zn@&#!wL|<{<dcxh+vVM&64bBVFEVd^pFPu74{ox9Akbx}xpc$!$@nD)KV#Sn4d-65
zn;;c)8KV%a?9kkmi0L_r7_TA#4nB!D5HY`_oY*y_uM!nomGFF{fG98E6&`&JyZZS$
ztNIFIvEwK@S{nCgnG37Tnk(eUuH{%rz8$;qQj4{LSv07MwEOVx(X#X4qYvjRXu1u#
zySoo7b9D8~sL^*}#cjDjR+4kRyXAP0sH>}Du=_$*;dP7h9@x1C6L38(gOTei8o71>
zBvcK<u2?rSL*|Zqmbv2&>9;)<TSN0L(<d6X18!oATRJ8I_p#&Kwr#kk#^`<aOMTW3
zj1<iCu1Ttc?=(VKWn5?x5T%ND(_=h;gMijqr@^S1rgavKGDcOIL_&tSlJVqoFiZ(Q
zg{3%JD4u8huAn7y;&#GHxMSJ2>jl^)He^9CJ?t~j#Gy@XO$&mM>tye+k^umae+C;<
z*T%G@u&x3ImQ>=6Rw!vg>Y=$0wxn$vf6#mfq5h7M)P{6?cSP0goXCU1d$Z3l?2WB|
z28DN>iqe;Y=^7?;jR0HRg)mHdfC+a4?0cH$`qT@UYu{sa_eCA`w`Dx-a2j5>edB@m
z$OP@NZC=Ib3eGz5q*%<-{O@y8bRrUDNy}4N1d0B)jAYs4EIB#>jJ%Q6uxzgoA(0^u
zpzyYQ636M)=}*FS|3#D+cSZLtySp1xz|$;^*aQawv#~{e8wbAYVB0Y@$}KN2y!~Se
z4BD^!Giblp*M2KCHixpTt^YQoAWQ9cn?ZU|eYfrULG>L}-$C`gx0&d_vg+G8jtAxU
zW*=fuez*P^l;8C_N?+x~3jB~*Hm08EW6L2f_5x4CzQJu~cp715aF5mBx36Bv<TfHs
zTU(hegI={YVR)m`N<~7N*^Cp2uou;@fG#bf$3&~#1;ENH9J>hwvCA92hVcSTqfaR2
z<EV(Hz)UWiYN^oeSYK&|WcF_O*O5$VUQBqDHF6=P2@v^Hk=R-ok-=gtQvOIA^HrJ^
zlZ9Y37b;;8ct(PAWF{l%0b5%nI)@ZIB4{4`0!hv<d0s?gNu%ayo`hr?#SzJ%V=Iyh
z0V!Js-Aj`gnA{LgP~<yOd3dT`KSl|MxX`jRL03GEv5bnhG(%<f_6UNd-5o$6O6hK3
z0JB5O^Bjs@>T+yRC&a!*3AP=dl7JDLGro6VzzVm4TiAvpxm6(V87CJEmQ@;}NqQyS
z03g&|#2NaP#Ng38LN6y#J`q7XU(d+2j8?g{n>!mAmV3Pq%Pu#Ak;7ILJ5TMj>+GTm
zF~jXWf0tYdT0Wl}+&!yo^U-uBe+16IbiZV!1*Q2$^MzmYF_d14NC*q69Bb8yC=qdF
zRU=1rxth99vhl|jfqsOJ1zyk$Q1+bFua-Rc_VY4kp78Y){Z)_NX7TeROxGljf1AY;
zdr&j^-)WSfizs2|5#;<5y@wGWA)v=E^{6?JcaLDph?v)pKGb+h8F{BdQCgKi0lEC;
z8&TMd>xU*J2O^U!@&4dQ?U4;-#dA>-_Rxlc@c8|KLS~@n6)aQDN!KHxHNt_4Umd>#
zDszSos--cgo$LM#YUjRzGWRI#+Te~-Ps`wr@-_E_lxBu4vF^`sP3+q>A%yl}L)>ic
z2e|&>YzR<Jhy8G~sUP;k)<1*!YBi$X*K}ojggQ3G%yuBvy{F-TK&pEZm?rlEof})A
z^z{$dI(DvK{D7IW2t)-E|24{^Ac~^`;Oz~E(7~*X+Yfeg5fYdLn}&Y?xspg0DHB(e
z|NQqkiQl9f-?=0Z?j39#>w}4I7+3j?M0g&ARqUP?cD%m%UDC7ekeGETCF`cLOX+g2
zF$pU8ndRG_!2;}<x`!>p3~}IT4)%2#@W3%_PS#O5*VVmtJ}TR&v2n?5H`6o?G=E78
z9;E5TAK_bWGt<Z~UM7d&EZQ12?;tApbZfSS?`ahNL5u;3ReApY;0nxtXS$~S;V}xt
z62UZ$V=~M6S^1ap$yt&n{Bc0&1<XqViNNACJNs8nGfl^N{Qf{#k$)(pHTj2vRjojl
z4zTZxle3tIMY}>2rb&SzOURj_%|5ArU-4)>Db9j4W{+h%SCgpVk5z~N@c!V(Un@({
z+gC57#pp$pT%f;^45HEsBb3;yqC2Mrll?j^J9sLlqB4EI$q2nrb>$ObYAeHLb&~3h
zY6F}w%@tWR9*ZP&q*1iW3kR0%-@*{`BAJdYEPFW#d9lDnG(%Uiw<-YMgrjs`&~ysv
zd(}w;FVHxG&K(jUhI0nSxqO~W3mIoeh>}?`SJuI|S^N}=OXJYVwhVGVCt^jsCLtH|
zC&T?N<q=F#EFOaEHl1*27Lh`BOl3BP5i}wQAB)&jqJWs1+HwaqRbK}ZzZJ)b#5^lx
z+fik5|Nq&07v;8*EL-$fax~LpQHLqxk$AaU9pkpk-Hxd$``E6YI8%01<O>wWAixGd
z$?AzYasT1|;r)^uI}-o_@C8bgEK+bpcTpsenMmx++>f=_j?&~DebUj#>S4<+A$DKW
zA;Y)nbe5&lD3>qv_#oO;TtaO>h&RGet|3|qBx$LB!H8#4<+%fmS(>424pGZ6ipyuo
zWG;)=MLK|WO|y(9g%o$LRo6cL=UI#x6v6AAS8hvAgzI2mm?0*%VPhuz5KCrK=~$+q
z#C+Pp^n9L$l*@cco`3!D69yqrM0kl%B8khjh^Dg0BCdr|S5AyoXc&0yqEwu#yB8NX
zYsabUci99`5zXo-_EblAA+VlBz}PBJTan(|gl=`bd7eb6+U8DGA5|<CR()~vDVpi1
z_^%&+D(@>d(a$H#C50E2(oh}yek}_c#W42Iwbxz458z4b#>VJf2C;EdbJ?A?gT%Xc
zr8eu2db5s_I@r7D$m-wG>HzVUM}!hongm@P9E*<aojYE{!dLfMCs!__#f|>Rs9n|z
zzNJ;Mt}14)dK_1+4k6_AA>=6T6E#xT?Z}U;ik!Xbzay@pl<M~amx5Y7oVR`48z;F0
zYma6(cYKl^Le}l)uy(m;=h)ni1zeT_dHeI=-7-0T=hXPy1l_c4t5AKCM^hT_QX%JV
z(S>~xSoIV3uKnEWCSCUMB%H_b<FCvPs%NiFZx?^Y&R&f*zKuIhj@Ff#XWG8SJ<N^J
z!z2s@4uoZ5X;7bqfn$*Hka^oXrebA9<|qY(G1zBqnD@(-hU6+WxwbuLGFxcEs%-Za
zjmygFZJV=HE*0gu8qFo3R}-zI!MD2c>oofsr&R18%<Q^5%71CbW}tNS#4|taLfG3n
zunphzr6I7(3B$y9ee4G=#gr4DGn>oMcMo_SylP2*TjoK7&LTEf*$-*BUf4_TNUoUJ
zfl+<$0&3g063|&Bk6b(*>id>y``EIGiHT!**f*GugTS}B;~Spg7*E@!Q5q{i!M|RB
zm$(0h@37%FoC8K*ZOPpoyxg0?9ahL}T-&YH^@0`@tvnKHZ^k5}z%c*cf5~Vvk113S
z`=1)iK8+G^Txg&?r!mb=J40yN%5C!Z1%!S|zwOdWiz$B53Y|<kUYB+wP4xPIR1>pE
zBd9V48m2wmTOF~B^6`x%1dRf3UZ+sw>I=pD(c{MQx)MfSKNz||tT|m!Sb`?y<7QA7
zyK${Lz2WlmeUuj~j!*bj&u{f@UdWmH*oEtZTR)u_0NJOLiH7S}eYAZLjbSa#5{+ff
z<!ST#F)~(7OY_R|d$_Xg16e#J&G}v{m4ij_GNJKJ5%IjQQSfMMmd8;d`6bPI7~&`D
zx*c5}-(G%;^6DYg3wdaR=q~!;(ON_vwL-^n0&GfKVq#hpYPN)!+bndM41CA1o_O@&
zGQI9~%CehMWmM|o+PDF1Pq#W*mJ+8H2ST;yt#zEUn?~~6;PYL(3(lf)6MQV1{?Tqc
zz8`RxF&h)xXP7vigMAWO*zgHAnG*^#JmjjspV9?US_vemW8JHB?tyXLG*r1?6_f<>
zr$+uSM7BD6P}NSE;|rUOb`*nMTSp`%<(JLG;m43Q4*86?qLCAv`P}z7Hhjn&7jA%=
z$2@G<R$v9L71$5qz&nhBb7j(KQ-~IlxK5Vfq_~3c%;p2^R*Aif;|b2c_6fB}(p?{g
zWjAPTUToE3w@%mUtXkksYlMyUPi0{Aw`bKzo_)FKpFCC>4)#+s9PYD>Y!&R=il)0G
z*1aJM2LO4`q<BrUue}0{$Bk5ftRVC8(bY(9p4h!sd}Uucu1N(muo*J2FS*1tun3fi
zWn2*MaC3`&x&FripS}&B-bTkh6@a=ch{tUsz)S`b6K0t>Ach3CA)pzSj^G18eE_IG
z3_!ij<ct25PG>)$4^jU0rYexo51IZ};g3To#&vy}LOpV@6wA8xD|Pw`i=6_PS(^la
zD9jQX*VVq^ifUUgt5RobY_&ar*I?E2F$$qnECySL@?t?aRVbbttdOt`I(0pqIK9T1
zoXvHi^$G+YW;8FdIS2SU!hkbZTxm2x`3$(&l5|RA*v6`HGa05DTmbN1&ZQJvG4Agd
zsC1YMWoXya2iS0p^_@W?aFk4NCi5sSfQkL*H!pQXcu1O0pgc2ADZgAG_7yn2Jsm5j
zy7Tlk&sDDY`OeV?3BhSzpeSLGU7=v{Iy^H^rZk}wcp~^dP4f8^qI!xezMNbY+*2HO
znsp9H@1$4^r8WaoG*9vr&Ib5Bofmne#>i;`+;@3FGXUH3Gy&^WL-6+tbJtR~6VTnD
z)U<_XV@sMgCg2629w%4?25|{>93l?gW7HAH(|Q$_4jz!Re6-SUr0>Wim(f)fo>e=<
zT1#K0ttfGg0F^___Qyzmn^CoPl;A1<QF#-zAI&02p?E9=g!Po|<VW%?PjDl2vBj8$
zNx%Y3dFW%|F=7~&?K{B($kIXik-7qQSGiIGx>Br4f2I;V==B+x9|euO9qF-@JEHPb
zse~Tge@Sdu^?ttaFTpiJVlkh^5vL$JMXKpSX(96hnoTq1?W($}!3^~itR>&O1F7Eh
z3hVZf0`oWN2CL~QG2aamzlxx+p1=m@U?$G%?>|n9SyczGOBL8~+11xCa1m<i!7Eok
zeDf(k!LJS1T_fOBx22k@?q1_7Y>?wEc?<P#TRPbQM$k{7@CcpD%h}T%yyq}`Dy#9-
zG>mftoprl@-hSROGDlrUWc!Y;JF@Qo*_Vs@vnu$Y=`|a!$96;N8np<Tm$U~{xAKSj
z_V>I`Jb!Rq9<J-MBRGTma&TX6{P#rNmu<y*Cl6*od{dYVyC#GjT@hmDI1Ua%&mu-(
zTS6EIZgx~AY8tLgYF)091{Yr|PV==|pt3#Eu#ibBHGZ`-VgH7Nv#W%_Na~3=Zg{l}
zJyUo>U_uBOKY@h<&l6ZUjzOs)j&1V;m*@s+V!K2)BjieK!%Y5tE|Vg@fpYhXUwu=^
ze2M?zaSQp5z>5PFayKL<C5+<Gw?W8>hpDhU%!SK*!*rN%?ZLutS@?OsoqfBcuY-;>
z4SU_$I@5lmMPIF_y_obuiaDU=?@Y0<Y%uGlds@r-Sp9KIqqwxwRfDRHrp>&atf6Z@
zmp}CFwx1!r?!MBZF8f?%Qg?^b!=~=s(lx5}Se|{kSRND@#pT^i!@1L7KjXS;2dwMG
z^9|<pQ6q!8!ZX;{gMEGU_VwM2r+&uuq2ku<kQ$avL+l08#>DVKOu1!XW>D%%n^DJn
z;&fXZ5y%>d4m;`|EUE_ZUAJGWlT~0zcLxyHo;qcv#KGUoah}~Mv+6od+Z4qmey9yl
z>W%tj58(8cx=ig`Rq-f26{GEHWpCK_Hs!K&`S;K%*W<<qb#efj59;K)e*@ZlK%4K^
zO?lkvr0e^pX_yW+Z682wRAAo~6qC>o17Qb}@IwZ*z1fI~Y`fuqtbSdh9j?Mt0LPUA
zPVehWh${j5^BS}k1-(SMlu1P{r5%pwRQdA(D3p`{&Cxjm{_htk2Y%%+hUD&of;y^u
z$7QMA8n&4)hK<3kco_**$~Qw$OjYAA7Z_I{2v-Bpx-jUR^F*Uj_4hx1<MCX`lDo5H
zR(T9Sx{&W0{wiUap=q08Xk+05l+N@$%%HX}r#1;}Cm_rjpmaq;iq?rY@Jwk=9l24o
zmz?UF-xzGFrl5C$*>`i7qqmi;mtfR5O(rr!mr-7%it#wg(PcEbi~$j!qlrxBQ3AET
z6M0<^0T%l6=jhYh_b<@fyjt+OG%cFa8<ZDO99M+R^~@-|V7=rh=TfnKmy7NkeJWRF
zaVe*YargQ2&8rT`P7srEdW}x05W4O5QXbXz;uL&=FuTe^!aSz)T*nWdKL<0e)Aj`t
zHwm3a{PefaYTr!r6pEIAJ{foZ{-Qy4OGv_7q6jM!ZfRmKE|e2VkGQ(3MhWJ#I4Vw8
zxz0bI{M+Y~(QoFL5&EYn`M>D2{iI74q1x;}f}~z_xSCqoy>-U#YFu9wp02?KZVXr~
zEW5=pgzS<ZZw(fxn-Sdo?8`;n(weN`KES;pK5*3WfdPJ3&dZQJ{Qa_rdr=XmS@Gwa
zeXj;6b@T7?<}ND%2KKH@`?U5og^wPP*wD6j0V5J=8r1Uz_I=04L@<T}$gY+i^Mofo
z*LDvXx>cKidTuIP43fpx*otsrBgqhDGy!@*rAsS$)MO@&NWnDv20+JVZkr<P%F(I$
z!c-Y|z;p;{)cP~Oge<jqRAn|ImPz_mq}NIPO-2hj*6K@(d#BEU>?HmvzKPRn%xMCJ
zYo?I1hbf!qQlL*iz0M)A@e=IM^KUo*7^CwdosH4CVul){^ZZi%`Hu*+D^OLH(*HcB
zKp!M!a*ke>lcGZ%QLZ%cmU%oz`Bw?{Z+cBLfvU&P$504I^PW+q)Hk0KT3RGzLeFI>
z97xEyisW@=U>7NpT46j!b6HQp&2F|b4NNO=1jD`=SeW>hj{}=Km>52>T}hZBpLp;P
z)^EdB*89LF60Gh@UynUgh7Mf6wDh;H{6_vIR(Gu115_IBZaaZm?02-zf05T?Sicw+
zG|-@?V46=ZaXDtSaO)UsNz1N97&6L>v|776TIhX^^7g7OJ9*4TIkb__^Vz3ZbnY(F
znY!!S%|G<rupz5Ykj$<=z}~DrqzOEf{w^x?hd8>@A0j^24cw&qL(ZU<&*zg&=7sw3
z_j&b+heG|ArAhf={tw-KI8XG=Gs<<l(=^EonW@jf;H*9r`ajcH{bxeUR`p+hSN{?6
zO8uA4^x*#y>Hkhs{e1+XV%2D*yNpw+KTKsg21taj=5(GE+0D{?{+h)<>-tv9F=*Hp
zw$g~{i>k!E7((<NS4JaR`}yP?JQ&#gvXt})w?cHgddZCoHpT59(pghKrgl~6hgyE#
z&90j@`IgNlM{UngtG5k~pK@@o(&S2!QePlWbJ=v>r~;dB#R$gpO7EpmtP0eHo8M!Z
zOp43XBCXceQkLro{Rx?H?_cUY8E*f4Qtj5CPufHIE6qP@8ABJVkPHn0TykDj+wVo~
zo+=YvE=pL#@-&ae=v^W|rSB4{?~20HYBnw|TEiS8^$f2rX|eLs<`V+dwVo^(=*r9M
z$z1ZHU2OBAje!&hcr5BG8$XxC;^h^p`S(DFvEf?vySfqzhHtnKe%9A5-a>u(;?0f5
z3kTjs*NgZQt$t{cxG(&IP1s1e&f8ALKOtj9>hA|y$X@Bc{WE_zI3E|llIEZnKGItB
zz`tm|FrR(7sN@X3QL^&v%SA0w@MS3x&%RtVWT)w$%qOdoipw`$zGnRn8+XCHG_r}y
zX@U!WO0V$;IaB&e*>>Z-ZuX?YTdaPl-ss>atrhCQO}a1=29m{UCI*tlLqk#D-lwpO
zN04#hdc+mjw*nuNz=4uxF2`0#1$Q~4jvE}XM-UE`lESbNNJghgTATec6F`}DBa2Z_
zC!w<DSGF)lYz`(W)SAvDl94JNUESZd-7%bfwSixH%;2(lGKWZ4>5w=_pDtxCQ65J#
zG=rnB>{iPrFsxmJF{>OG@QgJ}*H@{UTlUV;1WB63Hz-eeL}M(INt8&bVAXjvNof2u
zd~k`p7U^_17hE81pOBDXCPR)1^IS}QE-<H#9g5H~#ZWH0ESJ557f!91OL`^IFYi_?
zE48X%K~*cMO>DNtCkAV(y_PmP@v3#E)-9}#I_tX*wA6zHlDi^{W;2ET7qXCwCGhSU
zrGx8iaGedVv%z&XxXzB!b@p9dR~HwR@2d3EHr(ldLI#|c3pdvVa`d$dG_87RTn@ge
z1}1Oesw(JLU=w`=eyhR3bQBdl4$A&6?TKB?Z{M(8>M##82WnZ-kl?_yLd=*ESd1Aa
z^AFkl{%HkWcf$<O%Kz!xcdt-J1<g7J`0CO_4U1u(ORecw_!m^-Uz$YR$|9X=M>RTy
zU*tDBoyBrBFy<c-`~@M{(K-51!+{o5vy@+!0sSS&%m)<&2R%P;gv)a@OJVjR8lxx?
zU=O6qZil|q=+39<l{P%`nFNzOzCl7lL_E5Jm^O##w3<Bt$xwmf=qo_`V~Icl^T%LJ
z7x9i9%7XZTWrhS>w#_k-Mu=(PG3?vYWSmN22f@<@v*=9teg(Md_0TbfcUm6f7XGbS
z4sI#IUfwi|!ZjBJ)>QS2Rq;ug^9oL)Ru5<ziM)<))bGu8!f7HRmB7+iCkkvgon`4X
zDj^yJxMIKHid$7<yB&mLBYa|IJbg7Qz$#VwFEWt;R1&My<;9O6+?x{gKmGI?B9^h}
z254LQ?htVN?)u>PF(q;w5Wy3R=RICeM>BY(9#`oH<vUYqg1tSH`6;CK_wG<7j(>}$
z^XZ#RmzH@QO`-w@U_RDrbdTQd0@ZUDqsumg<M_VBhG}q2JVJ569UFUudA8s@a6NY@
zDhFFTg{=bK$@&!Ror}tKD_XUySv{E|bD<19+hdqBA~B(ki32VLW}#_%4xuiy*YV4)
zYkTc{)Mmc5epJ28oTh;T0b-V>UzIy<o0+3Upz=9E#CY3sRjFY^k+}ydGN%^i8}KK*
z&(boQ*{`nL!VY~cL+$1T>+)R~MqDD>bx_W!j{3_D_G=Y=)ygDXm|j=+Kvgj*ARe60
z^V*Z6qppyvpv+CETBd>hRmn<ycL;#Yt+n0WCRZ{qq6wIux?okSnKG@Qteh4`*%U><
z@dk!E(8CqFQW2Eik<;|5S)xc)1%97Kkk64p(BgFlKAkw_+CFELf350mK@j2`{g}W6
zD~dSuvM4CO1SEwnF1KiHT(_ksU}f<>@CQ(6;%l98kx4OEkBzdqD(jab7N`6xlHVks
zt9Pr4F9CQ%NJut-7gk(m>3njDcpAr)rP+Oybkh^POGP&;G)x{C4i>_7FrlW6gV6Ob
z_Y7iK%;Ki!JZ%qBZBOS*4kI<)vwF2F19$6M#_csZF8@@{pVbSqy@o5~R1KMc7B|$1
z2Tu>9IV1<b?o`*KRfWuxqD6Q3A8GbAPIU^z=ac$b)YE=GQI3vzQtoS~s?nyup;J$O
zkt0%O6Ch}Gu}|jcqkbgFD0rs|ZkeNTv+0c`s&?;McdF*E1YN_=YQh#nuvQOYfBlya
zjWGHpE&GQVtp{LNew;K@C>!{ec5&>gzj4+2;7D2TNP#);F+XtKj*gTfDq>l#qQ1s&
z*X7as1upqJdYHO>yagw@<Y^*kc5}xkQ4)EZ=dgCUXJ@y~$yAvzMqkHC*T>V#0nqOW
zZs(KP*&}lsf6N`cF?aRF?90W{PuRP*XRn*0f2gSm=W%@U=p8vqC+W589V}sE5IT;-
z9TS_bZ(!od5C=pM%*@c|VIa7)*#QUqYYlD5;8VI&JHD@ViY+ls#bQ_Klr2rO3_7OQ
ziOgzU6E1~Q=`n=FwKyx2YNyCJ;lj2&BC)|;6BEy}ux~RDn<3|+PXj_7?`hjLIx@b>
zq{&yyN<Z^vlPR*!{%A%uH=7{6OV>7XLMx!(%5+fp6+)GZba6<Vj3xSosvqDpd~9T7
zLO0L8T-5Q}X6KE|;I2i!r~0dI{HM}&0Ue~VklA}$T-Lw7gVk8}tv>%cOUCHqUtd~|
zJE;2gau_glTldVKo26+x(vY6Oo@pAG7*b+tdmc8a69g8sWEhAcm~&sjoQ}`<sYGvl
z$+^iW1a1r$6J~Pk2abiEAY{ZQ%;RhwkJ=Euc@)a(AGKaq#Z}5+h++Jp3aMb_>z?KE
zMfIT_YyrnTtc66tm1*|kpAEydUH6C2CuP*;p`thM)4ag1wXgmL{pZW~=xvf~8f6We
z8ubh1{HM%Pd<kiubY7%rHqRy!o&M*`_oFhbp@J`^dcU^z4h^9kOBp)2S&Hk_UPl;b
zm6ZoCdW<re&*MV7jkOlmtS7lh`2+o_Q69JqxonN`yecC%|5){yQI4dFyJ&Fa632F0
zA{MVDoux_i4=EZ?oJlmB$8c}=;hS-#`f)%l&E!m~v_O~!^#m|G6j-dj0_*hx@hBi}
zw3v6wm77*G=jq5zn!(f+86-;rTNY6FWl;`MC1}0Kz?aKuQs(wT`Y+7Nl|-CQXEd6W
z6n~Im3>l3o$+&t3Ttq;Mrf^qK;Ap=wpMTKVZXqAjc6kU9b74^j2rLb#J#1o^xwdZ@
zrpc)Bv`wQ8A)gs+6xEAWvT?d<F^sf$M8(bBttJTIz)QXW#x<Em;NO;~C0GtNu4>=X
zj98;im<Dd$JxZfWc){bnREs}fj?w6LwJD}A(iBw6Y%49s|9tsgmEqd4_tx#*z|5w8
z6@|`idu`mjh{dey^Ml%Gb*~@ioC68^E&42P4d?OlM3Y{fzoAhK@vB>eqtu<t{W@#=
zEnlvR&KGGTaDS_pTs8B*8_iT>aEBn+KC{b)AlT*^8-if1=@^1wLlEqsgJ5uU9d``O
za0A~UrimTtGE68Xn0my;wqtT(G1C%M9&ii{G*4}I<|w_A83Gfk9r@a>nO6;*0!2)%
zS*t2zS2P|ih-@1Arm_iZO>qAaFxS0}C@b@`XZ-77C3<fH?S<UrAs5)DL5PXNOdN!E
zfNkG0LM|<v8|%Q_ha%AIrW8r#tZ7U0>j=CLY_5JzL)2foA<q=Jm-a5IwtWjxokjA<
z1vOyY5C*le@3|C{KzKMXVCOYGmpG=$sqH^)_ep7g<h|S{OS?P>wDP$rhh}9|R`_l~
z3yN0m=e4h7l2M@O{_nqJG?~XVi;A27sR_`hQ3A1Eoo~x&OtbZ#l$K4~CX-n(s!!>+
zTQ=Atp;<IYCzHOeo~49eeU8EGEh@Qf^vzW4(wlE-ct%F;kopB;&3S>^4KyhqCW9i?
zjcXO2A1*K7L3y!)&%?KRBCBunLeA934fV?DWTJ|d*L}33`;B3BW`@Qx=kj#%?HC!|
zsVJ|hzJn{;z}&@?(Oq(xw?h$CknLqc<C`Mld0(X32`nB3s`ysC$<pb2n$fA$Aj^~Q
zSu`B#FYrs6^+1Q7sOxsb;eLDhEy}BhR4?SA4V2p}bw_KTaL=cX5lC!XB*cXJ95YLL
zm~m-KLs*9EK5_h&F7C9mp0_bn(EFt5dT7~A!<Rl_jMnaDv#8w49*3%ZyxT{}1L6h_
z4w+$L!d#B2W!X6Ng3x0D@oevqIlVrmvyGwoDg{!j!fi|OW9z=P7=kq+erR%Ok9iD0
zUy$fq6+aJs*Ym<qV#Dw#CMKuYH-*F|m5vZ*APkp2?UP0$ec{X~QL*_BBD6_v?s68b
zDTmZzDD9qF|4C<Mw6a;l`k}0z?PaeQ<J+<1btBOJ?90WX8CCRpF><JT-7r~xdsYwe
z*_VsziH6hrsLQxCMCAZ@k}@e?)9mX&Z*=llnTf_nM<LtPBz8f;I|dJ^@7vfV#KOc7
z95bJU*zu?c86)mi$L{(czuW>Q4SBf{tUen5Ey^Pn#Zhsy1@%3voIa3mqI@EhZNzf}
zNRnnzshdXmkAI)j_*44uDEN&h*Kr}=Lx*#VSPqsBz~3FqzyS?BY)Qf`PKYP?x^#;H
z`Ck7UknelsEh?3D75#oi;~0IMvuTv)l`gvriBT8Ku8`Al47AI$Gy^Mv-2kl)kkl*U
z-0I34`Yg%|sF<qKNMK^<!pJQo?K%3G&NJSm3Cimsm!)A8KlZCQor{;VnYKN)BHVvW
zcskEuD%1#dS!NivDxF&b$k#q$o;Iv0fQuLNq{$Fd0`s#-%{4q>W7IiZIGq*o4WQ3?
zJckm(5DV4=$bqN23WMczTA|^`P%L*A(;LNOt;$ZrU{EB0FT1$W#p0`KRT{pYhKQn~
zB9W^g>@UzPx`MJi$}BAJhuYLpQdZuHrZbu4X`*?T6j>7x&*8E<5xk`wQI=kTsflu)
z&LoP8Jp<nJIol2J?hwvGW(C-CEyy%-9qe=FU`nhoB#fBSwV$?!U<2U2B5kjPyd|*p
ziY}UhzrFlBtSw!qU9Evqz|YY;AlL?#Bvyji><Ua^WvNR6l*jc_*Nf>n1i#XGf#N8X
z{D#M}-UAdTye^+6Mh)(3)`_yVH;NWP^M}{y0?lZa%iqC^clv=|tE*nqg0`ugVN=OO
zS&O;O5dQG`eDQ;-VNwmhOoCo<!^&$~{Ljt4z+YhnpHI}Ju5KQvqE+pcs+@@~<gDH@
zZ26y0M%~l_n50Fila*tJj$3W25p-QCKvTJB;8tkyYP0>&I7Aft<#J|1&tW&7{GJ94
zjc*)rmD8}diGB&|X-_l#v3VS;h8rUvSgHnq{+c6ZV5u5ds<!?cSgM{hOBEb=#|_XY
zW*~)294r|(F%hAOSr8hSdxQ|fri=vZy=RX<g5B^B^abd5l>Vl2zXqZI2;lchP@e$&
z-lbmPFoR;>k`^YGN3l=2fhh}_!<Zup@s2`V(KPzDSx%dR*{pS}_?#64>$Eb8OJB>V
z<gHeEeuhq!q^Fq{^m~xvo#8?t#mA4#H$%c5C-kvr1qS$eLd*<{VriQ;aa^ATVfeKD
zJR6Yt8~r@>4!;v1{{h`O8!`WbuV<~VXH80k_D9?*`C;kS-f0f`oOJ;|;4abblY9eE
zr|YO0jkUXC`<+Yfk^@a|=+0A_yU_SrCpaukOL<}Q`ytU`NOai0`h2u@o+mgnY(cS*
zfs2Xl`#3Nt!3MQMo72D-+<n?ghfZ`*g=L~|t8!bLdO=s!ZYkF5;HF(gL+Rfw`x45+
z)T+&BofQgKjhd>-59qe4iPB7tBBa#({dBKUAk{SpPMU3OdDlQq-*#^iPU*gyQZO%2
z)JMA*S6}LnFz&j^jk!6CM#|Tk7a6C;>W71-A=Edn#|PhxKA(&RXz-&?>?tkvqdhKt
zLJgCc5<8HiL5O8z%9(*}PHbXP60p!ZU_a9v8s`%IA}3UlL!Q3*Wu%nzmcNwUG>?^!
z1ueFCPHUvm5`qfoE}<bQ7WJU=F=AQzRh0$5PCC8i&>K31lT?1AaA2Yj5=u)!v8lgg
zR9V&NQ%3n$eP++H6d3Bj+=qMTs+hPsU@O$d-rZZyZK4VK!H(R)#VjVmP+&J;1|}vm
zFcX4eW)X{dA*GTVPhjzU()hW*$xKAN=n-^iDtQWZtXB|-_myr0(Hx+0u#D!QE`ezd
zudlsQREkZMOvdP!wD>rq(=meoADyF*O2>tQi}ez1r%^$BWqrfTXmS~AZsA1@w+Wp+
zmX%aZ$#JhGCRpG}Bfx|R3lozHOoJfAfo)1cebWv2I{NV^Ww)(dP^Y0<s!6$2N4593
zW6JG#@QlG(R>0Y_eC!;LLA3#+w``WIV7ko<niaXCz+Sd}T2H$8K`9w)N3VYEV~5nY
zckdl6i-)!>?w}+cvwdOO0hc~8uoH3%_I48ozGvaUWVS~=5*l*g9l7hau2RXh61E@x
zY1rF$-rKbjT<XBhoxO1eHg|hCVxwfDsl!L3^Va>Nb#=8?T(t3kXx%Uz3I}m0R7?1n
zj|Io}xg^xa)C@yRm@hCTu8S?xv!!6n;=(&{J{i+M@2xT?42g6~qeLaZz4>Lyh;EzA
zpXxd>^=&QQnDs8F<zkai>MlP=e~l)WSXZX0+f-o{nutiKN-ipUPdSqog<14*10_-(
zhb3GM{kSdRfcb(M+`|?NA@AMuFqM{pUBe`<VVEqm?89FhQ6i$NNX%)xSSJ0~N8|45
z);q3|$06Z6GA<pcgoh!Mfk7EIt$<_Vg%k&Za_ktKGRN|%aGa;@>sg|RdT*gqnOw;@
zoyk%6cvum`-yEW7+Z8!FU5Z%@Hoz_XJMS$`C-ppiQ*b4L8fJ`%ZOz2CZQFKoV%x^V
zwr$(C?POxx$>!d>yDwc`)&0<2&5yrkS4y;J$>#wlobRCu3|h~ryDi0A509s9(qDD)
z9T-&Qs^Rtv^{8fuiQNvhIy^p7#fmK9gN_7EhTNXhH6w4?9!0rI+4H+5fa}teQ1!Ke
znrrH0iL|NhV!_qJ-+ST!9O;_xfu9+bCPiYs_mMhOm*h$NTFhB;JI3iv2hPmlzcBq?
z)hU|s*>SFAi)H!xD}|gv=@-~Qsf<@0%3`2Fuj!e%FBG7m-Kz`l!kPT3DFUoJ01{-l
ziG3r;7Zr&$EEc=0;5Vw}dP2uIja^zQrnrq=0vlSdwzE$U@mP&ro=)$0EzQRgl&}`5
ztA^2$;U*lZZOMUnq4a-h@doH)dh4pPteAeDT`iMC%3~+Gnda`#xB4TFN?W~|lU5MN
zzx0h@&Xp_%f8@v{3U{>_(`Li9jc?7n2fdOh-4)A*)W4tHK=?#B7w#SY`Pd&pvSNV1
zsI8{1k`67RqANE$Qjai|0V@CG^W=i(rwOlAAtuE%xQ8dg^<vMV7PV;qi4kj^Amg+-
zWtA8$!=a~^8R-w=1Yt6;w^D~_fo`F;B!``6c<KlRruTe8dc?oYVo(&VEc~b^eVfWY
z6c?m`b!yKZQZt#2Brj3=sfYB#BNv07I-FyU02G(nLWbQ~6ZPLvs`>}+y|1KeW4`>O
zQfBt5qD*zV@{it*aE=anQ_b?(0G!4jo!pQ0s1%$ZhLmRbwNoyckw@mITltiAV{)U$
ztO?me$=+$waNBf*r)Nu8hZ=17Gc%<~NrNs7h5Q(yQbPcma+&k`V^ZCPzpw63xW$^#
z->Ai67s?Q($i*Zyb2UgEccsGOmmtYGY5YESIkQIegFn6TO%!!rn+?O%_PMb^y?MNP
z*ip8-MN24@teAXXA1}|5oS*>$WAka+GQD=>&yI(5_MjJs%05)fTeHX7+j}P}1K0Q+
zGHrmbCskOnYrBW5iJxIn4J&4Om-dkc1Hl%_tPBh+pfFmA$RltdHlbR6XXn1S5%Shl
zf=e)=PTE7Ig^7!G6n!>?Akx%ohUgGPtUP?X{S6xAp@zy@x3)qI<z1)+Z-gA?^*N}b
z-IbDaH6M#5k}K0rC{oT#6N^GR_T|)Nnx}h4#Kh=7Q&#LXRU3eL*o%V~X#&vUa7zy1
z+9_2MwZ}Tc`0eEqcvjev&*ogI9EDR6{ZH*LG)%+7jp!%C4)pi!NHb@l*<ImRGrm!#
zVCb7TuNyo<@vvjz^5wPk)(1gUqeVQ6GU{ooR8+W@)dv{H0pxv#5vE39HD_&{{7yPG
zUe(e?j$3l!XYN$J<`Kv;Fp&8w=xdU5QuZP!<OWY_`ea=(yDL|NA4R)mr>j-)uDx!U
zt($|)c3#rB3w@Ih(pK2<T6t5Y=e$51QwDBu(nbfSO$vfqCO5N|SQd*I7vk6b^!vzb
z)eYy-%?hUXsB=NXZ1f)F7A?AdIL<vOmfq(&c+z{FPS53DHzp}`Q=~mD=7A$8(q<Sf
z!>cTm7|NZ3N1a;!I6mG_hxv0y%jKJg427bwEwsZ3J*py8QYimX%Fl2<gU|S{(R1>#
zobtb3z_><iXLc249Um}Od49BD`EPJb-L{$@G{!(i?{cx*9~`jJ`6lbDqPcNnE{~!;
zBmO$n$|NIHJ*0GRy<@+!Q)F6y=@Cu;ftXQzu8)k2ptRClN8AiP;@>!QdxERebQ?`6
zwzipTPrjBh@5bgmVB&A5!(Rc#*E?tgQJgJO_owJuvw2TzKODtvOJ=9E@Y8KED(4Xe
z?$=1J9sgxW_xUej@n8|DTdE@4o0Ds^g&mPC#Oeoa1NjRH3WmLqKyNJdRp$QQCh8;k
zX7D*Kw-MWGyp^xkl6_1zlU{E+ef3sp!{1gIkRj(rM~E9G)DJ=GBg$RXmreI|I&qgJ
zV$_Lh;6C0OsENKwf+=|T71xbr8J00i6Yg=c03>_mjZEz5N7AWk07Qc>MJuM!rCF3R
z6g>5Lg?Q=yO&e*0ipu`XbS{dfGq>K^%LT08FNOYj_urC)10V=-<hz08BGOpO8thyJ
zkC-MbqTXuiF}D|1UGL5Vo<~0fbS*gGqlG+19aU^-Dj7O^?ysx~5flBgK{1~~vjSlr
zCHPeSU6=6x#X;@2*;K!<j&cvSkLu95E?YnhjFE!oDx6#vzGj~FhFf&g@+5Qy?4U@4
z(o$EG2c<oFPxql0hz(BcY_F*n+Rx{$$e()(gN*@iD(>FRWiK8m)rp7{`Bjid63U}Q
z#zh0d!Tge$bi5UhegIsVcno>t^U%+r%H(H_rbreS?uX`0qIc1HAY+yJfR&C5H4T+(
z(8y?X7<BtXU~Ajflka!muN~2SmoXJIkS8fp5m>((t9;7C+Kg#c?Rh1CV0D~8Z|Yvh
zmrAUkZV}+WGHlvKnPvPE8M0x58}6=zSi!?1CyK*NcAjFts?fJ{(+ofT-jV%HDX6=`
zhRGxEYS5}SIa*D3ea*~b6M3=(L-S$xJK4E}=**Z>A%Hs2(th)SA!gMxQZ3?NO_o&)
zJE4u8W529;N8?V-bH}JtBSk8Gp#_3>6Lw8JV-hQCbpW2X7Py?$lTE-vf~^BzQ{}Pt
z{oH|Bp%J7r(kC@5)^GzBY}`ef@tjFqs)KhXiDOKWUPK!o6!5@f4-G+kB%F#Yv{;Rq
z#SEm$VmCw`MU1&@=r@b8C_mwjPih#m4`F~qiXxL*Eyfg0s>;#Qq<BN`lEV7C!Y8RX
zV*dC98Y35Dr6{GLdWNCfAeC$tj^7Gp)Dr%f)4@oI5EvTBhx$>PZRIUq5cYogIDN4<
zwtt){&PT;F-LwES0`Y2S6yd@thY$ue%FfqcgVVR^9%wT@h--{LbYZ6XfY*e#l<{Sb
z>wX0$!lG4Ff04g-Xhi!ID@@MY9tM~9tSG2v%VA*T$Zemo%=y=TeY|a5N8X{+SbVK4
zt?*6kGormhHC=h3n7AwGDJ?HYI7F#hvv39UtJWAws0dVHKaZdMd#<@7z1IH7xHV}k
zuZVGk(4CM--%8AK7R@y+xDZW=o?!I2_xzE~?ANaTwLDeniJr)fVyYdsuk-cq>g6tv
zvNabCBd~qO=MU}5a=^ltdo~eV?vQZHtliSpx5_ru!1$hH@(j%6@~gL9vIym<2=Rc_
zf79BwulPv9U{@TW@;rz@<KU;{cf1rSBsaYe)1^<Z&#8x7&){Gv9L`}b%YAR`p49_g
zi~|4-wp1)-x2YvkGtWJo17CWVdySTgA88Rge1NFq=VwMxI-ac2or$6%{;l6x4eHsZ
zH$#9H-v=*ykz=^OvuOZKBjc!X+NI{7h=Y4clFejicBq*it?G1mgt3sThn~E`oy&C;
z``doJY>S-?hd1KXl`Qc`<q`6#>AGY2{w@<|@QH_|%U&p-lD>qRW5n0Z&pY*q<BEWk
z%|qKgO}8fqQ}oCENVm5Qt(>e3Ca@F1_S1x>*M^;#L6kmj^q|RyI-sv4X)D5Dj?3`A
z?MgI_vva&*bHxtXOP(fin{KN2EKCW&`Eb}x<mN4-l^ZsA=X|=90&omi@;<G=Ql8%=
z$9&SXOvY+;+1%-uANN^iBUCkA=GMumq&C)I<)tCW=@L$?mgL&@oJ_p%rvAHUruy<~
zu*E^x&-|uMDtOc*Wqi$=yLe7M`|eos?CXQtNoqy1)N^dRjK92VUzmJMZ~2^BuXb#9
z9&Vo44lhq{E=cenXc%)HDw<Rt#B<?1Kr*^>t_Aut!MD!riiJoPn;oMgY9(!KzSj$_
zZKXx}kBDoNC2GJ7zY+)t5Jo9it!uCW8gF9Wh7+aC3}AsTr_5J1r6?zNr{Ztpd{9R>
z)nZnHN7;{EU=EK^W_ipSi0%*}Ao(M!FOR^5|4e^NO|UTAR7=y@TaxD_bPilfjX?jV
z-t|F34D|tIm|J8L#sXhAOtkEVP$%jw%HMe$cJTL-s>5Jd7Td;%Hsodh49_Qw4*qtC
zsJr!c2T>1qKQi>N<Krs(jHvrXSoZ-@&kMQ6J&cYwxP^NV14D^v5F>`ZyET+>eIWw-
z@iCLY>LyG*8;!p|eQzz*PHEpS4Yr||39H3q^zu*XxvHw8w+<=BHgAY>5!trUh56iw
z5iHRqy2Ks1qqQOD>O<?`AdHN(PJ;faxY{q$aI-O@cxK`Fkjf?^%S#25Dw=$<w@J5h
z|H8XbtD%GkH6eDuV;@^kLWtcwqU`#MEfg8tULi}zF`_IbnIRMzj|{>CqO8Zy0spN3
z9B@zqx)RfW_Z}y?M;(wD!B;Vq)rY}GoaDxlOcTdZ+Cg4@aMw?brouClS~@RLbzj(m
zY-$DUnhcwxv1`&>@unGOHWQN`lMWT1OG?AWie9y^CL~LNE|?|5LYN-pVIBw4<2)0F
z?!>LXTwIL6J9bds^b=RU+2O|^Wl(i%3m<TUGwOt&1R$v>6i09jwy30f_I*<2XN~}P
zXNU*K{y?z|j4u59xR8b`M50>3otlM~OQ28hmFfA6`-B$6*pX+AG5H!fzL3+CrHeF7
z?s5C#&Y3X<sAkGh!T)p2md%*}`+mE9?QlmbIbAuvQJ*<(8$9#TE^IBXDzWzpoFE%U
zTlj<$znRGJUqxvRJ!WEwj^Xq5*h$UHHcC65Q4$&c=u9<(mQ5G}DxWSe4k!RCX;-@l
zPCmz49Mr`ONkyFL<89(_@tQ!co`SuaK$3Pomne^;VSkTw@`oq|INduw_|ChtOo${8
zmqNz$gpl8`X9-2Aif~anGSBRhrKY>y3x=lLVP#q93oLqT)fH;gJNO8XX-7Q@8*Dgd
zmzYFiY7VMIwqg^h{;`tI^|0j`t!-*dp&rzTE{-VE^2rziDCdI2Gje1pc$W^K_6ubG
zC&_R^nq@{lMaoRU@xsra{~Pkx((gD8A0L<IsGT=!os4GxB|o-VH}oI{W&T5wUtMww
zV9=WK)IGp&lnXpF=JxK<x<wNB6scl~O6XL^VkK1-VdX4ov_1Ja%yNc9Mt?CorCvq>
zw0V|scO3kJg{y3APfwe#ikD1b^jW>V{&d#T+9SRGry8rxMaS&b6f*9kXcyQSZm!oM
zZf8@{)qO~1r40diOErzeUAk=qC;56X3KfjYBjOYu=_1`kbT^wP%Gq+$Bc%-oQD}%|
zn-OAC^o62-q;=;j$g5TpN*+XWun0#=Nk;6P{=L`KoL?wDn-h#(g<5Fa$1u^+^H2lC
z>GOcr?m;7X$cQIdyeC{I2SP8pWF&7_I7N-B0HeB9;zMj3bDj!InCik|cMbw)`v?z`
z)jFYvj5=+&a{y8@W)urPS)nC8SCwf;isTd>p*78}_QWaG{Eu{N)zGs8J@1ijD7-VM
z&^KI1CcpZd0E076-elTC|2;?i)bq*-veCG?S+x!e3rB!6mS%EHo6I7Xl+)YEy+qMr
zvhfcl|99D6E%5Dh`&u~A`d$0?8ZFR=hjW$$^{V1uJ)brGSB+Q5+)1bRvw7zWj>~MM
zRx|i>bi17L-RuBUqbCiWbOVTwQp#sFWmts-)=v_m2s}qbk)vPkYQ(_j{!VK#1MNe&
zrzL^sFozq$tgE4;W}7v8RKk=~lwWw)h%zV`+7VV74#|)LlnIq}&t^0v!3tcoN0pLl
zz2tmCStU!OOu8SsSuo=Q*L~pi33HkaJc_m^E}#4P{ul2y&r5FjQ(w!`*Bc?V!Rqjv
zWrz7i$Sdd;&%49i6~XMP^Pf_SB1)qA`qwSle|hpF!02b{$zgdu1Ncxeq2<JKwEpgF
z;2w{~8)A99gk3M@XofTB)t0Ng&BQG9ME<?NNw7)@(EZc{D7r6T9~C|2@&+1ph~Dyb
zo9~W|E}(xZc&hIY87^nq(j{gIlkQLOaVtA^haeEnVVscVV>pOf>T=O%H6h`jc#sT3
z)feMjPS%$}XEg~TLLaj)=T)d|YgKx3s>*q`bwY24juUd$*xWdhxZbZ=FIlBjG@72R
zs^Oy#3aZICQp<$W`mR%fnN!PRwxqjcszum*94}NYPhetxT)MzSKb3^=3@qVMJb<_4
z<JZB%zCEof7LWGdV{e3Qf2;ZDfSmAkaY>5MJl7R9#5QPFO+Kv4VAOahwOEz5K%||R
z?8N=;v_$Qzce5Y?{o5#_C#!0t7|c+mM*2tg0pU=%(ruQ8Gxah9Y^8Xd`(di4Q4#K=
zLv8fRp@;5#6ZflXWo8TmPTY`=8_B8c_#^&wn8}NdxHg!qFp#bbl&(r$q!pm`4s3nc
zNfwW`KZb;z`9FQHQRiJ+j-4z-VXxHD5erGNVx>oqwm-ajPnzD<63-IW7T$-FvlNU^
zhwQ=gQ69D*s^yW{jr?U#;hkl=_f}qI{qnOO#dYTV+k~TbkrK{FeTlCrkRmL8x$|#U
z!no(dF^}IKZMJKI4ih7TX7Hra>#Hf%F>r=Bq;R;A?aPP|+l47~$YYR8AH7O;R~j`o
zl#lPT)fpDf8~T`u=NKnJ5mf1R6koqG|BV%nz;gxpt^}2O5;}9T!Hqw*zowBPx%tan
z17@Fi*KV$3k5<&$cwO)|h`R*>dV8t=0h6-c*UotRgNABxH_}kxJwp>_6VX?^D53N5
zAP+j4Da+yAdtIC}6has@1B^x-wWa%K2mBLxlQ&t4CaiY$y=vVF(BD4nH7C)j?0R|m
z1pl<&M<iSAZHpg6*bi;TP8BsTamhArWxD4Vg=B{qauc>gCiqAsh72BvS<UnDj^59m
zjY$8}^C%7tFT^L!Gc%Md3r#bV-+&F@?e+~)KeocjtT!U%{ndCcfK&S%>BjqHg6%<j
zP%CYX|CS1ML#{zI<YJD6&Y(^9FhKUpYx_WQ>(7I`dWD?#n5L<|9UT<C$&Z)_P4J%0
zY>#Ods)fFn8Q*vB)MFmmxA1@(JG+so0!sK+#?=nN|6oW9F*$6ifkls#<qK+hu&uoi
zgNx|h*v`?C_P}Fmlp{re@~4p=%|94!g&_?!8<4)8n}N{&x=<>5Lm%<z7pB`n2Dk1U
zBfiKV)^w_lGY{9n#7LMwrv&N4?Qr?FnsgD{Hc2mo6AEvX+PXL(z>f(}J=QwKv%}UB
z`&jvHU#i{R?9e8IXtTI-p$hFu$ua>K30Vx*2LlR&lCzrX!8%YKyI4Sbh^|HEeZH>C
zMX+&D@cFwSGSyrIU1c<%y06&sB>zFuRD&4ZM2voTNo>eeTOI;&f~pll#01L<O13yG
z0#F$7G%l<UUROgU1LNe<d{S}s@1n91j*wGHRaJBaRS|7ZGwiS6>*hXkvzh!;OEMvT
z!Nh~6E^sH`9B6-(K%%pIhR|da`x!%#AVLur&2i7C{Zk2FJ>MsoNb(%>6fvsa*TMZ-
z6%74xaHfGv;F2$yW9r{y$KXI(^WSznLh@~z7)B72BKAyzWG%7k*`&V%AoFf_^10^^
zQ(D5tEARTg6|2AH60Nm0<;T-Z6(|f8z7BSdnZFWkI*%iU9hX{NGe$H+k6*sDW~*G$
zD6{;)Vwr4fflz+%Cx@W^Kwaq}lHqI<TDMJ4g}UpODz@?I|3&O&3LE4Lk7<fSmW5%>
z!&<WWg0d|Z;X5cccVdsQ;?V0quQf~gYu(h4+fV{TB}jxL0PcbYt)4PLxt=aD;J2@S
zqHnOf1ekW3Dc#o^z14=Z?~7Ny9homR^Vh$a;8IV2wEuzrI@m~;Kyv8>5Kz_6V3W!2
zBwszL)posFW^}$2pK7`S!7q9E7la(SuLnizlc>*o=PtVL3RZHbH^%4%%fr*xgL}b~
zJf5227wxIx98EEC-R8apVz~qHS;3=|ic0o7DLd&ng|DWF=3~cV{?8=}ltVvusfPA(
z8x^H@CD8=0AM-w{+#aTPJhaTOLWtLo8T;{`{G9ww%)Il`)*zw%`|vlo^5}AdsEPxL
zxD#70TXZpS*gc$><FoFV_@0bI7H9LWteEK*mD+E@n&0kKBOR@BauU)o?8<;-5qVeb
ztO#uDlrew@xS*I3^a#!-<_=+UkuqWVdb~tjpRfV@p3Q7ip`Hndm^;UpH%7i%zfxql
zM|O|ouLw21%WZT&L>8zc`J(L9=*TiEDD*{QU2>U$qKjCV#fqk;#=o;A(xisqjnZo!
zCr+eH5C041{R{_U`(_GoSU#kjYgaCMX<Qkd()8CW<@GjhtB$Q&DWNRP8ta)c0f|si
zr|^Gt>>~q%ALSwBZIMb%@5%-d4Noi<ATNesVYsD+R9b<mi&f;8F~|0hixYA1o<io#
zq9oFW(stCMEvlxmF7gXL#789&oYo&%s7mC+s6~mgZ0RW{fRkj;jRcP}L^}^N@h8Os
zcaoF(@-6i#On`3ZS6co3r`K+DLG<?26!-UdLSyWLhP~t4|Kk&)+zXrMpIqf_+q;0q
z?-rL#=y1>~C!8PgDwJFW$u806qcawxa$yGZ3)jde@68KMSwVMY4m80<e!9#TQcX+f
zkEdiyrd&k-#6~`@uo4(E3+h9cWj`i-s9}?wSSE(S$eYh|WO~gGLlun~a$hF)4FCCf
zs%+@veb2|w`LAbV=;Ci2!&xFkRZjYmm;TQff%yEi!e<R6u9V!?58<@GIIdSs<Kb8N
z^-f&*3mu3hiUlh3QrsyKGxmBE^3RtMx(?I?RST;yAQLJ6gM%p`C<ZU9p@rTyX?e`l
zGxo6Vy%t65tL2N}E(;1wNKQMAtJBlGsyGhdaUt)oA&x#xuT9(Oilp7B^q5P)e+l6%
z;p{28PTm;zQzAov6M1Cr^XC~OUqq=;U_|{!Vx<}dF+Lk0@}CN2oibyk{`4jrV5UMX
z40Ri&t(pl-5(!em9Y9s#xirMe1pfkFI!kbQ?%ydQB8Hjzklzr1nNzOM9kOgPk47p9
z&MYK6XhKz;FBwAO)M@p$T+sYfA0rEH#Nz=IcL?lJ!dGb3obcg@21Oi837=KkT#>KW
zUSQ=WU@~-1rJop1R07p9-G!Wlg+fBm4=0GtD`cDF%8)wHT9qQ)$-;9%`5x=q5Ij-9
z6oP9g`4k5o8PTlrL6@jn^mR=PJjJhK9j8vfZbsARbE1~UwK3R%rMZZhb#4WqtTcpH
zIp^?}@>rJ_P3Q95oQ)v<X5DeF`TWu6*UD6>_($ZYNz*45j?_|^#d73)if>t_{v9XS
zzsDR>?dXZV7IjyDwR$a$U}c>}mdiz1ic)<VuJg95+f$za@LKeSTj%sgL>kSjCU{lO
zo7%^IxE4-t=9;-r=4uKq(H<U4^PeG&#tg`hMgyA_zp_tyAbgjI{vEOG=-IL@^cHsd
z*g&iob<NT8_`Fm&H+tmt3HGNs)s1)uNDx9j!6g_Wu}2?kPTB_wRU>Zri&cUpH0J&`
z7(dPhDVA8dPM9H%>5nfGnCyE|jo82j6D`Az7BHi-O+Qv7R~GxP%s`qx4wXprEBwMe
z@tWXU?XcL0=-@=sluaGM%3pQU@8SGDBIQ%SL-ed|8~QI2XE#afwPAm_KQsmilLftg
zTT<S&7DQ9FA@4z!Hox5(sb^l*FJ0VZfm*eliG+%Q6pW3mhBK#vj$uW#-KRt2c!{nl
zz^Li`0a3-vkqsU#dJVSq;-BbhoAhGAtwtcBr_Ni&c|%FFYmBBx(zL`e$h8(=`m_59
zX7pD*#-`WLW)+k(HPLJ0eL(&D#ny)1FV0uuo<39e`SVMvIrjw8p^<WQD0$+ni`k`j
zW;JrBN5h4D@e;Bay)ot()v<@NT0seDbZyL3c40$Fu)fJU?$CD|@&KahhP7993tL1+
z?J}2gJ0m=)%?#I@-bDXCF1OZgf%`9~8o`|3C;#+OoBEPkZ}{Lv)|Ms4_-~xus)ZdI
zHM5QE1EInwAmtNRlE9RDQ{6Ywk^u?}%_p%WJuTXclv3MHlu*m#l^m5!o!OH0UcDfq
zLR5o!c7oE<M}|8tL@i5Bf_mb}5zg8}LYkJJw&IrFy^X3#R2~_P%PbdA>0|}O9HU5q
zM=5p{b4eG4jjGU<l-sx3TfzI}bi*emiu@$1esaowDfAIi;uY<7i{mDj@z{Qk*rMV1
z1Is_^VR%K2K5qksdY}7RkErdj2<ixVoT5%nnCUj1c2((R(_<&8MvJ6X=2X2?GVsZh
zPlAfd4A+pD_QI|9j%ljnsexfT{F67^U`TE@4Na)j4iD)|vo7v)c4Y)_PH8slQTdak
zIL+a0U%kRot?QVm^G^UAR+Ju&aR1ycnxaAQ0vo@j?YgyZ9pw%nx_T7=raXUh!YG>|
z+o5<tAOdD9PJ*W>K|p@PQ5cW!MR|%Jalr9>@po+rt${#Hnovm0gJ^)aj)c^um;O&)
z6sRe^X*|D25T5N(+4z+uri$k@x6V9j3t2XAJ1Wm35SK|5rwxDU2%MGVDUcRspRy*b
zRyB<@-)<0+dywhKR)eUT){f^Sw)bRzljT<lmGz&SuwZLM7Qx^^P;~i=b=o>OGJPU%
zzjZ%3%5TR6e+NE_?3kq&Ohq;X4(EF}CN>h2O*Wuj>ro&SE%j8!h2h0KqT7#I=2y@~
z7T#Q$Ti}*~cd2PF?T&wb6`b1IOLa!;kfn=2N$YR6ev){E%Hv#`S<_BB2|op8{RrTs
z&DRDN8(<lKagxO@XVH#+_Ty3>cey3aO`LDY{v|(-5-nlOZ-3%JL<;ZBP(V6B3r(Hz
zl9}<<`^|Ur%?JC<muTk&_V5iet2|(+Jfy`bU$(<LkEm#;jE5E+Urr>uE0&F6pYGFT
zJ={!-6yk_2nR%|42dR>0V!y^W;~1{ArF6gU<%EC+*=$(vgX(B!R53<*+{8c{MKOU?
z0&U2~lztrL0K}Iot@gY1?~gS>0l%EW77b;U4HgFM3Z4WsjF8k-8x&{0fq|hlFwGKs
zwb^7BGvvWr7M>k9Kl#U#3Ts|jymba<)u&r#N>GU2TmSC@r2AKx^%y;@Jt8(MY5$+q
zXD<{S^aS39puJ!%`ny1;n!U+|YaNblR>nGS$Pcv9v3S>-uRHr985cx#8YEv$?XSx$
zTks@bOB)E%Z(tvlY<TNFtgw%mQ4J&Yfb{+!y)HX690O`HsMda0-c)hVer8V$ti(dX
zA-uR9CdPNer=7?9`wvh%^|=q1e<|!hQSwiok&q_J4nA002gi{DtEhXz$`ChasaEai
zGnt+TagX;QoPgl`i_>5e&FRoSgI+YZn#HdgHgxwtgm0ugW^rGt0Uy8UT%3RPm2v7O
zzH3v%-0g|_J(nE)>=6Ob(^(kcK9~YzfDt^I7KY(A6}mkKoQTUJExDH4HMigbp?m$g
z*^TXEN#HUW5~1%*`l6NT-7~-Y`l%i{c<Iu^&j60TvItb4ut(3A9sb`lf|$<^Xm^_F
zP>!t!eKWlDt81T?0xihGQ7YtMUl1p+DMXw)X2?vLQE1+#q5$ACM$ZQLU=Q#cb&MwJ
z8~qR|a=)~7EkH6|1#@fM`ZK&f%I#0~k8?Rvl1?u1`{kJ<ijRlAE6ITd?n0G}yB2hS
zh1jKRh8~(Q_97KlDT9$H6-tn`Rtqk-N(^kh9mAnQRkO-rhBag^#3E|W)&fegaZj^C
zU-Q+ARjR>|L|zKChM5LkmWf;LVFcN!s8)jnlS)6&Rx?1K4GOok7H7AYp5jS+PjUk8
z!VjxpPE~xVrY%J2)Jz0CSK6UA{~Toa{$D!jZZR!np1qoqM_@G|8MsF!&%FAEMV+ra
zjXZ6WD$&AKkcw32N>R&jAO#r(Ay>Kkp;k&};69kX%Ub><@K?k|%!~ziq6Go9DomUw
zJLb|ft|~r8HW_XJ4IvRB$S?2?=H4La6nl#{W1OWElt_)uIhyBB^UAmPlWyPSe?SG;
z`pP`ZXT63?nep1Z0L&$R!=`5XJQK#1!&Q1|f9M8q(?J+}b0tHpOeO3$vFP@8n9wE4
z#U%qpH5$tZF8^x5z0_u-)YUlu-a#Z__#h&B40wCE0YhGdn3?WXD*Gi}0ks(Qd>0Yf
zxY*#uXKiV23i>_Pfo=*CRt^UBT`g?~2K67gQg#c$XldGI*e{b4H6T{(ZziYVZX#Yl
z^v_oWC<GLR|9<j`KIyj;&qP!BE0A*$B*K&{ge*_Mlmn0~TyNQk7dPC83aIbWvM;Ew
z%JWXI-Xjl(1l}nUtqiW>%D`Y8DyRenJom(tm7&DOM*JA7exA*M-r*jccqy5Po{62(
zYO)wZiy#UL1PeU%LT~hx_kdaS)F|ikjr?)V7u(|N1_AP!-l@}*5HzDEyIxbIGuvHx
z3pA*aRi9{)9nZ#V`t-C#4Aqq7dGu7I=%ZWuruITc1JfXJ$-OpKFd7-7D4-dvgp*52
zh>uHaHM)dJ94$N^db;40Th#~61jNN+9s?`5kLWdO#F1#|1UD<|v^Vsr;mFL4T=BI_
zN3RZqvutFVk_(ZC&R$l$Pzjp^Xb)sWkJiY$#1QWlI4dhDfzEjT1aesIn|O|3w?aAz
zTo~vrKumoyJ~glbnN*a=>+|HmhKW+=@B+3^w#qy6Rr(Gp+oMl3am*{3)P2wpn(4;U
zGX#ez<L7ZPkw^hK9bIbRn^5q`$^~%LeY41Q8&0Vwr@Xs^&W2>K<S6opti<Ojy~wlN
zyn?N^p&~|?Fih$tlKzlYCwe6TM=5-z9n;h4)Mk&U<#d+kxZP?O#)mZ`tTTHi{M>;K
zkM|V+<PIq=p4}CYtIEVOxA|$roY#&~NN^*v>UK6Wv#QGW*hPPm+9?tKqORa{H;tp_
z@dJ_gc~<yBn4sA1@7-Q~Z^Mnocojs>Gg1l*a+v;!7)aA*PMRY^)6>&v$~8b2GI9A{
z$>=0-nwsGj!E2h_Fk!ltdRv0~bPZ0tZIwH~CE?@}=lXdm+c)vla3Sr@5r?NGDZXET
zLY_k{`w&}2-We*1InYqGHBCzsFokgW^b{6BoS47~!_1`!!#U&M_xXKyA*4>teCRF3
z>q-FOn`&1<{PoG$ZoGB&#&BTDpg`|XuGJQqnU*3std{KjNX9H0R{Yh@*1y&34w5iV
zaCe;+1B(}LhXV7f?3TdebOMs|h+kp#XjR3LmpEW?|BWs8LZpWL7r$Kk{XvA8c64?b
zJ#`-mU2`%huhA1rvvMP!7(h4N4>#xJ$e@U(vGBQk5dL;jAd%_+M=jf5U!<beGBcu6
zYZ2=iPIT+gr1h|@J7+;uhH0NB_Y1>MzLHWzKB2kNy&n(XXS2;h`>}%p)Kyz%)(jlY
z!+*D;nycOB^nQ$j+@)ZKOp572*K~=APElD+_NtXdf-26ZC>glMmY0VnLl?H-tz}k9
zlTFybS*nAI$NHym!ctbJB3+T`o{PW7R<`7!;)5q;=vu)|Q&!{NBbJOkb!17n7o$8S
zN{IglcgSO~hSb|^r^DF3j(rFHO$vC?HN{Qrf=TSF=ho@IhfNEyx5+)OY9sj5;58z`
z8CaMH4q|9;%jVsR|J*=_VY%(C5}0R|N7*m`tXYD=)+keYKYQ7p6!sB1gti3Q;-hBU
zXdm_FS^84Tnp-hh0_xgC7dZ!PLiya`>Pcz2HV~`3N!R7(^?gS^M_@w|`Y-RW_L{t}
zt&BTk7@lp`mW(degqxM&`Wx)@>R!wJFIu|Low?*e_IW2p{aYQ$oE#%($L6gaxeR;7
zh$lP6{946V@@6^OYhCV7T_BR0{;TeFcN6i{rRxLI7K*%@vCBy4Ylb9p&ydhV$Dxaq
z<uUoW^)lK8>6{bqC#DRt9qN3c+fVH9_s-sfZsQ&4LUv|5^tnNbE?u~UBGHfN9QSvq
z3hb3w?ikCKbxzAm_E)-$v3-TsQt}NgXhE(b%X=pw+M&hf6GfJ^A@ntAp*`)p?5dbf
zH%;1zeT{4$)7Qkl=)#F(|LJ1daQ8|}&%}x35uciYV95-PqV&HCw5=`I=qbvdj{LUX
zA3}bj`sQyo^Om3HDw|gXv=Pyh4n^HS;X(Q)+}|4s<i4VY>JrQ^t2P*CM#=7V@Knl`
zSC5hX2>PXX$6Hk!!G{&|`Bp+D9~VqjU1I>_TFSHcjVS!~sFuec=Uuqm@S3H0Y}`04
zytplj_iA48f)s>$FxZn@-gk$(k7Y=Ve+QtK@U){(Ua+*I8|kr-SD9Gav4JpmFGXH<
z0zVu2z}Iv#0%08N1e%}E`oP-?VCqdiA0I`q73DXatbS}<hQGrGyZb1f3WY=vM|+<M
zlEYiGAZ@X6GQ&n>wK{{OKUd!HsKU;a#%7RY&EMyVQr9;Jgo9{JqjB_y$rHN&$h0??
zFJ9g|vPy2b^t=S9Lw5O#!@Y^fnj`6qEwJ_cogLxG5an>2#K>$^8HN~c6*1J3Z;tD2
zmb~OQGt2Pg<P!SvQaX3#?kn^<974z3{Votmr!aqe`arydR3f~pf0qU!#@F7bXfITw
z&#u=V#iTH&asp@JlO*_DOLN#4x&wFXn;r+?73lGO6o#sxChEyL8}@p%J_{_Qzq_sx
zNdEf0Ad1-~X~wqW%h&pd+>$0@^>ezQv<wVIkyyvDklKuY?5redI0|>I1L5E)+&m@v
zwCbYDjeqYZm$NSLG{in{4{m6=c^-$rw(?wV{ZKSV-Ccl{?R44)-pF}s%HN|;3Tv7c
z0Wg?Q+_qfWnv)6SX&*om#P`%n?#P$=46#WK@fo=1UX7er?JZV$wZCu=-nw+J;>rIZ
z8)793)e@Bs27$qw_S@TyN)X}=%TU0#*_^KzEg%_e8agirJrK@DqN#?gadjS17N*tw
zVYy!N3@ol+z~KZZqBHT)t^&@gRgx8V$0N=rk0U5ZY3huzV0}Q9Ss<pIuhh1H>34#Y
zkne|kZ2%eS)sI4V(4(;+C#hiIC8x*{W6`d;;+ZdHGuG^Ziao)vt57V=nnh-;1-S@m
z4i4V~PsMHy=YY}S+btfb^v|x4&?!})&R7igc-pY-pvaua_t=gk_Qobb91+GS6?c?1
zN@vlSS3qH*kBS!wSut-k5AZqP5@wR9oEv0RdH-MdWX(Y}OLjr=1w82y24?Sm%<$Fa
zZWEm^F*fw~6bw6#tehG1#Nl-<Tb57mN_ojjV{XBm`+M=6+pTN3P;d>Mi)ESpF*2c$
zwLniw$Jn*4&s;EU!A&EV$7oFbcxB75@JS|%xv~Agh{XUoo!%!bhI}1E1lp)TjG(pk
z#<2eOHKu;T7Ax3+PpEv?-=90?VV3US3IbmhW*Dysz6W(=gQbM9$K+r48m5BKIa}Sy
z_e=~G*2eYa*`KIZ7P5K`K+(n}f;r#5Y9GUIV#2$%6EoWWv1(iMe^D*5F5myp1(G);
zP7BDe7bT2A&7Yt1u0!Px*ZxG0B9edT{htiyP2ztD!Nv}vs3@e(T$NAf6g4g}_c}(%
zWgV^Ro4a`r!XBR&zyN#Wpz}4LRPEfhs;KajxZ>S%-1Yq}%G>#$z13g&f=a8;X~1;o
zzwxHgVs=T%_RY&$a_6mR3Fda7LAk`SR{LX~<y86Du4z`sNJW&6f4o;1qzgWoN9cAH
zB`=N;*-_VDxKUex=MnKG-mk5kye?mYPU$|=&Uc~7qcv(D;p=>R;fpVNHssyUnA4)o
zQ~QSwchr~#MFyL9L-^w98A?6lfxaRyb{=mwQb(Bu`yV02!f=0;6&`nG5PeVuR1%Eq
zWSqSVHvsb5<s;if9-DF0rWX6iW?N{O9Il_fm)Q=C)L)2!B*-WQNw(<veNj^_<VBnW
zQBm_S!XrD2Q>Mkbt=!~Y_joz##~#QTX+kuF*_EeI*^1U-!egc}ZjxP5DkT6z=w7jz
zJXIw&r>jC@qM?aeCtX<nl}1F4pMDr4uD&PWlB_zw(rVVaN{U`+qlwJ4Q^;Nmi;leK
zC<fbo6=mXKb9!#m@psPt?e7FqvTUMi3Wl8sDsSO}+ee#GV6PgEs6C&}fxX1v6<gTn
z12%kL8_h(m5IZ{fgQE^0yl4NBS*I}8(D_+Ge0BD64S;$I0(Zc4CbgFGp&M^bCl#&9
z)2ngecT;mU8r5eG?HN~lT%oAobvf5N7k-P99Qn)9#E&~xWbpogV!@fuM-09evut}^
zkAFrj5$o9+;z|XOBXVbc9t!>&F<XMX885~_uq_J948PfWg+6%7df_JL_s;NkBCClR
zIU{_Lq9yP4@O8_=E+>v-%N+*)IHN!9EQE=aUIDuV4p%4kKX6Ug4fo^u;VRo9k(iF{
zh}-!1wS(qq`sXtBGeEWJ1&D^gv6WK6U*ueSmPLEh^6wVa8!2Y^JP-9Otn<A99NB!a
z`uB4Z&&iFRQ;0mIbli+Q=-7$ay<TVHC%l1%%UODFI(ABg1;@`H8ZPER?Rup(gx3Tq
z*Y}&03F&s9mA1r3hs7(WeWHG398IMlN-KI+t*%hwGBV!}a(d3hV~f)bHQOOx0SG;^
zEdU(jtxU7K6x+Yd5|SI4ED@igo6^jPO)Zf|Feg>o(1sBdWiNd-r8&lWp@=na(5#<Z
zzb@pjD2YTHI*HCsK8?SWj|WXdM1$50!(q|6?yWzKezV=)PXSR-KXUpG(!Y*^-9;8h
zS*hMDkP$9HHKe5jEhrC?@}@=aBsR&sv7h$CGL>?~sDN2B2TGAfa#toPgXEtAh_w6?
z<#2--6{`g-T7mJ7@JeQr-FBirQ*kiT=HtEI1KQ-|J$E9uRDyW{q#X?;xrVz8jW)O%
z#i<GzQwa{W4zon*r~Jb6%dU!Yp}TTgi8=va8anI(6Pd1*<qBu##n#WN))Qy4#6j~c
zsSKO<$m}Wv#+;EM_jmU50?L*vOw_{>Z4K{F3Gd0XdMZI7`k8(MLQGOHOkms;L&FXM
z{j`2q5LT=CDj5&e!;8c*_uR5d*W`yCvzFHqwHG0qYxp&jgy62XOZ1({?xW>w#Gt3^
z_LobI0ZIkL9S`5H%e3@kGd=Wf^iLqEBz?{(LLyiH4_=O$cZNl!Hn`^J_Xf--GPp&t
ze^igNXSvjRK~LE?6M3W)1w|3(14;Oz_H{|YMP?-kHU>`$O_Em80~~)A2mOyXQr)-*
zsT-xK3!$iy(-#?|d7H4gt)!IY*Cp;C=+zVT$_pxWK2<ry#$T(;fFyIoL`w0C*D(9$
zl#gmHqW5q=Ki=@JP&dIF)iH<sm;;sP+ILHApk!^$^PJvz)V8~if9WYSRL3|;EUn*`
z9_~-k$*@SS%v`S4^LItdcH9Si`O&K8E@h`YIV&%VSD*Kth2mrtq>M`xY8^5Q{Fq<E
zR2N*TFptr^g%S(s6MS<f3d3yC9mVe*u%EBn*GB&~xtpA(#87PqZF#Yil5~%OA}C#P
zrP8nTFS>%eNSkg<=5;&e7}KjXIJuHjsM1#2sQMo2P-BdW)3G#}E_z%xE&7oQ@!YrM
zPs7a|!&-1WjW=%_T3iqagg)V&;ubt7Z$CdYuT+#h(NvkAj_W>f1C&=ixCSj&iH3i1
z6=u*cGYhZ(DNi_QLhPj5c>-^jQCUxV6rIqkAo}Z!^6D!*WHQF6SF&AAVa`<!%Kn%X
zl`}^I&S&5rEP12C^%Y{dbbThtj>f7D#g~HBu2b&GVqXiyYP`^Vq<pya1@p0v^ec7H
zR{>ysTp<O*tdJ3z@|H~}{@roi(f6uX_+LNi@@er@iz2BIn@#Xqb223;wKI_DY4aJ-
z<wy{>`sW!^=ey|VoQJVg{G9BvwXUYf1NLjvRE~3yZJfmBhs+Srqny;+)DIxp64P<c
zqKs(&;0+nvENGrr6ThyibUyg1dW?c->Do$qM=j5Ny0QcHbc$gNhEyHN-Bd?Vs0|dT
zhHTR%Tao;OS*STPRjWlXW&_uLLAdB)0g=axoTpnqo~<hl`w|3+_W4pCM8kz_L$dKN
z&%_h5Et@jv#{kT~p(_7tb9G_<6j<5A?fj`PYJ({AqpLu-i(41XX3ZW8ERKOmFyyBJ
z2NyFhil`w-Jw!@6hsS@kK6`3~g|tft$rBHChd&cUSr(GKJdEB;xA#`fPG?1U)rh!;
zc(8QgRXFLRd(Kr%0?h5TRq|@~m1JY>dacuZ5e&l-^C%zRO@dXAXPv_%<HilX@>6hW
zbBsv(Mps8U=@=`;*H`*y$w{pvrw9%gA^=6<&tF>jy>jvWh|B0MQIqeK&66%~&%&HU
z*lC%%`pe43Bgkj~mRs8G#Avv6uo*|vP$D$+$nSTReBojKNeezFjKrtFfwbbB26W91
zg+^$hQ+PEX`osdOhm8BIw}J7dax=}Ws4pvTl=%vOpWyp<<WE`bTZ8PC2bBl2!&kHb
z>|+&X)bLhT*9xZY`TbGx88h_4J)45y0o$*1HIu-<8;}!K88&Q6EE`|VZ0m;JkZ-*m
zbhAP2^*p9vo8&!(OF1~uimEwt6OOeHf+H2BD(%3oOLNy$0~hTu%8$VQPt)>0KSX@7
z+5K<nXahn$JX+@3hloFgOzPOqFe%Zy%ajn??ujC~J%YX8ykNsQ{Q4hb?x$f4gewS~
z(LP`|&!4Hf9WRt1GcX{A8mo0h{^5;SPcj3;s=LAc|L}<%BKMk(1G-0a0+kfB_>p8$
zdL)v!NOyXOj|UP@NZ?u8p#5%QgHy$KhP$mLtU{6ngbdwvYrm1ZmcM7VJFbVTEZqZZ
z`dyy!I|A~n-iOw<`DLHRH~_?4SHxxr#Vvt;zsnf8D9fS?>kn#rKp$`>zXM<W-2b{~
z`}n&D_x*ORswmfX(Kf+?GE`GQ6`_f@{9Ha{>m(Di{d4o)LVPR`@0D=4u^jAM(V|N_
zW>30IJNqZ@-hO6>f`id9r0_ydTLMB$`Zq(w4AI@wVc@N+<l6<A*bX#(xUs=Dup^m&
z?g`E)H|_W_H<$sL7iWZjO~S|@#{J4p-*h-68A2`KXxhye)XG+X>e5MC@2-BL2xV7!
zIAc_vt{ko1V^e>ri^K*rN*9eK8HuL8`(~eRFSk{2H-gC>G`#m2cA`i1F#IGiA;x6P
z@5{^%_mTbA@@}fpd$z>zTjqFEZB~9R!z1Otr}w)THf`)M0$U*w3v*D9xKjhw$Lp*0
z0)}N~hF4(H1;rx$BX-J{OlTz@Lm7!=1iy)NgdJAm6;~0vJbY<~j@=nt`z5zWBrhH}
zdr>xHSRGy9IT=;Padtwf?s=b8GET@CZ2Ur(2#>f0O%AHAT5CQcCQgvGKpN6%>Ruxz
z5=+(=D%J&#Xtf`rJv95REfOCZgFFR@T8@R?CQ_b`W|$>8Vi5dI>)ta?{UG?5TRVEw
zH&b1$^(OkUx&a&6SNfq4U|JzY20IVz@QuB85~Jq1IFL3V*Ac}PQX?Hkr}6Radc-<I
z`|I%q6GW=|*ophShv?0lguVXwFYJv@8Nsx!usQhMg}l<%*D9mZdg~p~+nWXTEjC!R
zY*mPmoAtFO=d`4oEDS}-=bVFgLRU}Z)8&j~cQo9LI%Ao)8x2X^q*@X)N_YH!HRL3a
z*#EUp49;0^**Q;o4-6-lXr!hpkE9C;PQ#^G3^QW9-49-IUB2<vv--RXpGX}%7u_P*
z+4{&P-44tyddu4BE8z&9OJ6u<7*5qe8wi+luyWZAAY0T;A7P_8x5yT99qE<avZ0b9
z9h~a3?TX{w&%-yxVaY_^WiN})B{~~fy5OPh{q87~z>SzgbpX9Dlt#4*-W;tZc*(u3
zJe(uK0EcA~@6O3@X`=*W5RqF@;S|QRfq{ed!}bPx!I>pu3NVTr@gF(_$oa|T9u!Oo
z2|Aw0Auo4|mU9CbLRW$W02>ZaB`40vW*}DrH4@zMlbVsFG;*^&G7`V`xa!7>IwgWK
zcPpJ&dBtM~eWed<Tiw7ju+}CSWM)>ht=xGB&>y*R-9*FS#9+$M-zFFFfoHgxohyPv
zrA{^DvY^guzp5uklO9Xkyc&Kk8NGo0w;_Cp{zXLiuDz~lx=yF!q{-oqqnBjH&A>Gy
zqXC=Oh1Rw^z$F)V@RRY~C2^Ql>rrhOiy7259&-xbsqfu3x_GkJGe!Q8EfExu$xDT@
zhi&2*3Ik?F+Hc@|P|r!<PR_XNv7gW-Kc6x3kI3>wnT=*67x*aK$bf3m>4GC9+?t1(
zV{VEN3cv4hf#B>jZ~Ii9z~y-EZ07sxL(lUI<81F;kI$=WsuBG_Gl}&p`*;O<0>YYZ
z2`A3fJ<G<&KZyFh#^S4`9S?SHDbCoun-hCk(urSGujjVIs`!>*J*6*S%R3z+@t;>>
zq3h6;spyRy#-nv&S8VaWE6c$H1)r_%F@j5}9@tqrah!Z=If^l}x8S~<g5^=QCz25a
zjL&4|GlDGnF?l$KN|-XVT{smq`ojGOY*k;8Cc?*)w|m91^qk;Gn8iX7Aez>96S(*w
z=S7za(XQHM;0MQ#!~EPgAzxgnJS&U~y(K^buD&TN_9D>b@ns|$u2Wrr2DFEZ3Cv`-
zRiD5zx_8j8V^4L%*InKFfs~J{ox27K0tee#vxIRXe*>(%veVSJyhs|J2L__*aF&IJ
zPQNvLvX9=ajMmcKxI3Ia+X=$6glFPU(yEvpWT<p}>S^1nlbJ*tq%^C_tNafl5o@v5
zvDCsHb|o-Bu%Wx;;D$?7@8rp}s=dT$c4U)q<1$$G@i8|1Ka5ie3}fI)CW<DZHH%{N
zGY$g{+P(67`<M=|4HC#^{JF1B2hwit4I!2cs;3l5MX-gtWya`_Q1V>**f6!1i4`nq
zN6h}(omQOwrt=x8@$4C~i6aly)F`q2loNMk$bRs)AQ*J|OxOA68Um#qoXs-*b>Ke3
zy->^-A&bk>Il&=i1TUJu6J?bIuV-bJbyb3G-*qEP^<xugUx+F}Urc};AVElUo(tXO
z4qaws=k$h7I28}MY-%`KV>EfC+GzF2C=kiVea`vfQOiMR!;I6Qz*7X_MMC%IDid_j
zNXf-*VVcFje#Lw^P~I~oSMJHG@JB4het*?`Yq{^Iv+(QVf4%p7rF=XYC3*5r84w5<
zAwyHf1D<xiAA2C=jH6Tx>(@Y-(rns)#>I^=;#py}hkO4_2e%ALHUN*de2L+I>Le5Y
z)<zUJB2XI<)k!{b)0Qk=e~FfwqYh9xvl*uZCOAZXFI8Q|-J#YzDy~Us&<3$nrw+@g
z(UQpQ6s%3=bjrYh)zr}`9t$dI+oc~RS;_g*Xg;j8(RO0&?)!KLI|>%VEkDeS6pfK_
zwZ8qNFqUAIBxNfp1GADMuHrZexNlg))lts+f>)U^X7zH_+=&K8+K|4n<IT+<2yWVO
zS3vjC$|fYLwjbf(6K@;q8m9%~%SI5K4P|lR)ZQHQBdv9$wKkx<QNw4NM<J3zo-uYK
zx4u%T%NyI9{40-UY|Xoicq(LVFNPs=<9*fNCl6n0K_jN}{iDR`UkboYM25gXu)WJu
z?Zb{2dyDt#27xg<ZwSFd+XeQTv|sJ|ad0-b9_q`P!7`0BhLt(4IDP0Us27uq%ea)O
z>X_e^+>P>bz2BcG1I{Fgz*$mIN#giHt#v3FonR>e3c0jk&F2TY1t%;Kx&`W03X^#A
z7#K{)KOAb(+%Nbmk`-mjIOWF;p2b`6Splr;wMNG8g5@Oir>bh5b?34uGy&MD?2L%@
z{^|_LRR>Uv%13F=?$8WNg&SZRGdmzY&*GdU=*A&-x^%Xy+`go&$Mj8Ia|g5lhf#}6
zF+rXiA-MN$nK}_`g!k?OgBUJeXD_jP9@iM)rI`qgfAjLd%i;>l{M)gH6)5&(>P{Sx
zKSlqAaunE|<p;#Vzv21cDY1%<C{<|<3pgo$6)it1LBf?YCsEFyVQl$jpq76y3QGv*
zfvLu+Gwx9w+QXNrM2;^>m(K-!x$Eq=+_7awT;PlohmV6QSFP20_@*JHN#6{XhC#47
z<I*Ghoy**F3?&c1Nwc@unXkgL;l(hTJ|9V@B^MfdR*BdAQMJS{O#-&GRYB;>(hO(p
zDvleP<2E}S>4|8JXz$>ptk!j3FOS|S98+gd>gqI0U%;>ZDee{%Ca{2?$&AfKQ=Io{
zS{wRR27tAT+mw89+9QF3YO=4WNqIDdWgLhHAl@dRzWpDzzA3npHefThZQFJ-u}^H<
zwr$(CIk9aUGvSGC&CKTeYqxeU_NKe5@B8g~oMvS4_>;F5zsjx%)F;>tfKOKHhskNW
zel-?5EECIGYb?5dIy*^9<@Pd5KdgvfC``|bU6mCVb80j6d{+66gqOMqolE4_bY90I
z*kh#n>w>ohi50H7?cei3R3wobpJ$c*^K^aW-lWEj1k^PFv0w+agVTXl39kN#JtqC{
zC0@3l3Cnj@&b<rdTAv`pUY;T3c4*U=PLbcOTurskgu1h>&V!*K{31qKvrXAUU!lS?
zzsKcwVYn!l5S-fK2jy4uJDS*swWirYNM67N=_C3y&$96zE6#A8JF(eJOvgF!b%iW9
zUAuzaCtBoZIskj#VJI(s;tOec^=Q}B2_=0hVu463I=RdJs*2ZgJ`@g_(t4!c_#)2r
zwgoI$nsKd=<CuldR(fpx4B0W|ON`@R<ViVSK`wKGcpIh8@Ra2XSby&C<P*mQdDV)g
zj(j*8+RS`88l;Z61}V8jjs!N~vmIu(hnd>5Mx6F9h1S97_eV*)Ep0y&$NS<R)AlI{
zukoU7O&lSalz&^l7U|ZWT0-<pQ7bMlWenz?qUpZ6!S{Tx4YPGd!%{=FyR8%#9I>wi
zhAqE+BKI<4+!BNIVv?T~cM$pb-jQ^cx2%Uc_CV~#Sl@&m_`KEgA$}Tl3gO(`-DhPJ
zHX%pyKVko!Ja7_pd)h=@Ohmor-qlw!B}RHhff=Jh$vbzJjK(xFv8HNwyD?701NEr3
z_}=868>EDW83L4}wu2)$R1EwIagxZN8sphwpm;TNZgp|s0-v`dUj(y(-UPOXGn#}(
z`7pgi+47B+Mx4Lu-L?*H(Xn13Wjv?32$t`<mZ$BYMB7I6RgZDwt5k%{V@ah{(}Rqu
z3@{EgaG9s+HWm|_Z%kd+W{G=t6=|b>pX@byab12gd#=K}A2^Nr855dhcTHSxBgfQT
z_$aOdoak@w=IuIy@v?<2&qv=|>v3xHh&Ak?rm5QB`{l;Q3v38iz8*$698QcIzXQqJ
zPN+YfMpo2>pCFHnr<|E$^R5R?@-2ELbc*DcxA|yh!zH+C)L>K9*1iK)F!=4Ixsiu%
zoPC_RbSY0-Ya^q;QpFVMMgBAl*JT)hu|TF+IIf)3?HgjE8rn?L$ES*cKpLG{=&)u&
zm^0E64cUB|IpfylOixjeVJd#I{7R*XVy#T|ct<vCJ?jZH6>!tjod%8=Vv`&9j(M|K
zQZ&>$u{r340?r)Wx2w*sfr++eg4x&|+8G)@rc@Wqjzr>@Che(RaM5dp*TT(5-qx?&
z&*vZd!sgzczP^>3g^f+q8w3dXJp25(kHBpGV`ZYiuB<-y()e!QQh>L@ALlyBu>G4s
z)NPzXQ3Tly{Usw(Z2v?ufera)T-Y5cj-dx14&zhw-=(l}R29r1t&xyM7IwveA_)Bz
z98a3y7G}J5h7*&+3$AvC!mNS?|C{8{NHk$<FDU5{0;O>BIw+L=X5DR_=b-~(7#F^F
zaTEg0R{aY$c}_Hw88-j{4%JXb#ksLC@1sDY6bcc($QfzqyX=%}x|qc*dG-VOu!Nb#
za$GvRzddVSJLxWip{p|9%t#7JS^KW$uJ+D#zVBpF1cJrOOIy~^cI!T=a%fjBa|q%I
zQY8`h8U5^J;rH!sMT+#PbEu@d*};(Kr3ika9kD3hD0I+MEE89&12KYe5Gf={Y1Ul|
zIW$Qt2YB_vt_UF|<N;5MZfKL3TKhL7jaCpkM>ixJlY|+w{hu5S{B02>{sot^hj2dC
zU(Cqa*l`mngKZ6Jxz*4I_fc^?;CH1|N3#`M;!8(}`10PSz)CPN_`Ft@<`8i!GG`ae
zXyspc@sr0>VZX&Bu%79-%d}kl3$4UQM%nG{tP3K*cc?cx^MxN_9ytb>(R9OiJDi$c
zTC8_I=02$T>xVv)S12GI9x#Cbb^LRzI{uHe)LwG(F1zi{C&r#L@gSkyjK6-T62?2T
zi8kX*Ne9fY=C;cr>-2^m;BrZ7ck~fO+q2slfC+od#d<pcutxB&%8#N8lLn4+dE(`q
zD{mU)?d;FI(lqzV)4lU(%7CoH)o@k~T0jOcyTDdwlPx-eQFWzxK`SWQRC^V;y6)#P
znK6{7QxJBhUV#3AXl{ZKejqH!<bIw$KdMb$ESr}P632x3+&wXDJY3;qMdkw?AvS)_
zf%#5I)<FSeO+zd-6CgFgu&g{=aRd8f9<`TbRpTQw49rwmHcLyn&mt#^C_34zS`cxh
zK|mN{PtWz$#KoeEe~8us6Yr0bkLzfG7C7YJ-4MOv^N3=Mx7lpfgZ{4F)VIi9<?t!o
zs}n4u>TYK=2aJ|K^axCLlplGj-DfIuq<sWX|I+5{&phF8v}<H@S#`LViObaD?<4xf
z&%LVHDAmYA=Og%0oqprf&huHfy`-N@6>RFgO14>&5z2Uxv*{^{*i#_!C+K0(^J#7S
z>4ABG;nU{5ENFWcf<TkvL*I-HC3%w6+iFa~jf1vYF@T=xgdJ8x@GmN096cpQ^b%{U
z@ShOn(y1AcvuJpFKGW8So~YK(yp$tb0Y$PqfyL)BSLFoX3HU%-MY)d1%Zr!lMo|kO
zJl{V4oIcG#q2gR+vM-JrDojbM*C(L2D5(lD^G?IZ8e&4EX$PAa8g+4>6?O25z<07>
zs9o-@yDfig{%v+?QMYEHbHLao&sN+^nHicPp%F$cdj$X2IBv$!97<0CjK#yjEX!(3
z3zEHNSv34P!k|~nzY?1nFCm|9kP*~musKR1qmn{V?fCp7OQD=WmcO-A5TY*}6*o8=
z^4^g~vx_ZXOuQJpO08hMf^urnQ3iDbmT)ePLk2$d=8S|JS-)rD26cEHbQoOAjgG>v
z(`14sPo9Wd%L+fsYIZQ=7X506bfV!TJYfbbm&Ni_Zm#oI$JQ+OZ^p5Jbc$nOaG$IG
zeD$`m93TDssE*!;^s!$rmiFJ|rp1K^+#~@IriKIu5lx;A&g;rdnxr1q3K@)Knel}g
z!)eF)BZ?DdaM6LG-cbY{s`K|BwmH^(^E0)jhDNF%yo#~^wB50*ctd3<B=5aPM|yve
z!lm*|DE&FvU8LHJ9dP8eGdmSQYtFn7>ewJVWsU{?=jQ%26LKwIv9<8g7AQ26jkm1L
z+s@7l|KR!dTGQqD69-vENXC2oh~PdBZ8JdYfFuv&mC>WrV$jJ+lU#+D+LYsDA8$cP
zmIMUnt{ErTy1|3`={?7i0O*M>B7+gU_emA)08%1H`qNn;`t6lW;|DOX5Dqry{uaFe
zY}SMP?Ha{g)d%s@7>+vwQ9J`M^sj!u(JO3xg$6sd3g(%(#3%=LaFhigfz%P<8(-O6
zgmyfsG<eWLB74R?AJLQ_(x?x~i9Ix9n!H4TG-j1k6RQyGxtJ#|yZodu23uy867%im
zNeKWGc;Dg(x$_lQBMA~9Dxv8bOP+MuM@jl@+Fg)RMhn6>{FQG2&YaKC!Y#wQk9&qS
zKLjgoMDMQ=M;&%j`2+f#`R;ZM9)xS$l*e4ldE^nBc~OctK7K2e8CR3J%ZQUkI~KT^
z%7dQ5gFPPOl~)-=LuJj|?T06aKr2FPsXAQ?D<yAsu6ENolUR{J7ih|_iF=M?rWm3Y
zg#GZ-HW@T@3+t8kr2o`3mMtOL!E5tA%G8I?Qpoic2e$AR&f+a6bPPo6-!zwpc*+i!
zA4<X<IvGzngBSCvAY&rM)-9D3rj(>`aSqkQTBBsxv0QQE%SpDxKw3Mf2T7RKLlb6Y
z@Om;01rlxGkAEpCUU;ZlBL8qmz+zM@RN5lX9Eta;<*{L>^%IQ+2S+W$+<Y0y$`b+N
z_wr5dPB8Vsins{65UTGqW_dJMsueImzqBB;!V*RFdjMT_copY{7utz{WH!zih3J-k
z#$$64kVx%T$3)-+!J=G`0{Hj4-)Bv_`gO=<MnZ<**O~%+TiJ*;gl)Y+b1DZcnb2=Y
zzX2oV>W%=Yl`c}0Mq7*h?1bRxhVV@|259sRk7mm^yf%ahYOd>4M?7Hxa<XnQGXW?^
zm9~bA@4VIT^}r$e8Y@#t+UO+-->qJT0fJbZMeVUbgp!Pc*`jyAmk+}sx>W(tOaK?*
z!eH_h;6u8H{URz!?iM_5v<DLvzR#Y|Ftl&{BaM1loqWG&HqmR^ZlU!zXqQM}I{wxM
zcP8DWB!fabYbM3cBokgkk_z!<h6g(img(EhglD2)$bi4!22Rj+AF(gObGEZPMQAP^
ztpqlW)%0Jbh8j^1)x|+P`w<S@nUk?YI=oOUiXZB+<zE~#@8W;AtN0%PqgP<FVP<gS
ze_?Usp^}cZf0gD(tl+E@PpAZ##bHHzNxsYI)<tX!uW!7)IrPW-Tua3Iu$|y*G+I_6
z8d+0Uj}l$blH`th2==%XCP#Ix{@~MN*s;giPj^<*_?;Xi6;JPpcV6zGY%DN1!rFS#
z9qA{t(~cYb{Km<(lUN$2cOn$v|G1;Ea9@dG_e%XhktEl(7E0k_>r1A1Um%XM-ExiZ
z?UF+2xx-js&IX`fQuU<;MmLQ;?mB}Y7wlekO`unEKZO-k`N{3X<oQS_9vjO7EcQG>
z%kAxZXnzz#SN|M}#H>SFf=MLM+vkzmF-k?8lpZ$F&vrnVa7U1BBEkc07q~GsG(|!Z
z3q^_S<a+(YtGc$5G>Yu`5w*;?XT4w?WfB%XyxF%uIYNRuQcK=7*I3Q_KteLw^zje%
zb~lVDqBRhVz;Hv}o-&N_yB&qN%&M<Mda{K6)32_a>r-5yYD$4LAatgK>d(VI%renC
z5Br>bLhC+~T%zzRPFK)p1b{KdUh}od+=uI>)6!_CvK{}e0dOXyIdXfLTF7g|2BQtV
zXLs$LE5jO`D$n$rugkBLzpCgBJ%Epoutbh1^wA>9KyJbZso<JhTs&_r&py4;F@-A4
zGCS_?f{ai)EZgIJqom3dAzX?;qSx#>_c_9eb&i0zLUg@7ZIeqs_meShu!z-uXO>Mv
z1S7Li)}qoxj<M<-RhVyZ->J6>q?nkq)eyd;oKCxnIJI;~tc*jY$eJ=~tS#j%jhXsZ
z2)@W_l1*~}9UDZnM|h)$s)n$btEk)v>48u?0pn;tzSm|^F)>d?^}E5Qujp;@=uA8^
zlbWpn>>6<!gnjwaLX@%L<bE+cZkp^19AtZomxamzR3BE4L9D+DwDY$Z<mt9zCNvR&
z3AMSbpAapBYf*g5D#>tRm6%l5OD(_xY}O-CbA8swk~Fo~+BXmH>+#1syA#ST96@Xm
z>|lBbS+vOA8t$_*SI6XSuAQmb^w&<0*T4O~_Sa3<CDF(o$JddzD&J@IUmf<BhyLE#
zzHF#rIfTM`9+WX<wR`W51&?H_(+;+Fnlr*$dc|SRiluTCgRFAm<<26|IRG*n_@yZS
zE-F>))Zq8(jX=yW%gqz_qi_KQEj8y%m-P6hg=iFH29+u+lU&@k7Bns}pa7Ca;_Yr6
zFgM{Uf#cW+*(WLMV9p0#x#5gPNiOY?biYaWgwG~ImSXNShZqfEn`Tr8^%N>syQ-oe
z2fcybLRuQKKrnNP_mY=n9BV^FMcT^ZSygNu+@QMP9nt-r0(%?1c299mD>I=WQQnWJ
zlvhgM(Pqdw;9~ofC9@qf!E*)sZEmHm*Q_Kj5`Z5oeKNg1Qbjh23DwHciJvpXVCO)-
zs+nOi42S9W!j*3E<qZ3qMe3{LE=E$-wf|RROd7D^_$zkg_zAJMgWHAsO~0@ALc`^E
z&H|-jBpmt;#_Vt7VLn9-=#Ix-afD1~nufv~<GzgnO*YTwcX`oBYczk^3R-)2ZNC9P
zVJK-ghtSkjo1yuGPEYEK=j&;zUG(zT+bKl358!cyTHK3_O{n15lbU@GDdG%H#T(U(
zd|1{(Q_9uRh-qwp&U{6}O?lW_?5TFr1$9La0OmKg>dD>;&c8eh&{=SzHAIc;+2mkK
z;u7Dk<`QQ!ekl_S!Is|msfw6iEoc$-wA`mZp4PF$TvAlUiNINK#C&Gr5r?w)_oU^V
zIJI6UUo6)JFUiMBO+NCXMNne#i+WK<7H~ROZsRG_!xLR-d-X|*vu`is<53O()HB<E
zl*+Op5-ZhZ+68=04%s}B`6Q9SLEi{XmpTXzF}8kMFQ(4kD5CbLgDg<Ru_l~62)}~Y
zvClUFy%9c%;G3{<EY4gF9|>QB?&Ze(-bNN@S`Kekf|+Mf1#!PrkgRN<QZ9<;-N{Gg
z$p^u{1>OyPaNlmr&IZ)1ig%d1FOlL*m#HtSD;1;?DJE`lCScujr+K1o!#E?p$#QAN
zXS@#G9}D_f7eS9T(+ok2Ez=A+%?b8c{0r8Zi}0r`;3N7HQEOdg#RLO?^bx4I&JE1!
z7D?@9agJ@c5S6iXQ#m@iZ;nWl{dR`K2i8G@_n;T$>f492lQ|dZQ6;$guvGzqJZ$I|
zUO7VBA_>D?vvo3xF2ib5qcgN^fgHjF5)b?*&di*WtQO4=ys|LXCmdh|4yC*fvhoWG
z&?c%SBZa7V*D*}RhC@)eOPKpCl<u<Y`=V)8>Thy{EEV`sG@ahM7JHV6y+l;BTPz@i
zoH_ppNn^R6ck@Q^s+ak`I$<#=Z<n1A>Awfu?6^{T9Zrhy=sbNsa<i8l$RwzM>&gqK
zxBV>ASG&ode2|pjwa@Tif|Yw~mI>a5Vr+#JuL69v48uvtr*Z%}5^pS)<Yi1Wp^WDb
z(tuW?MbC$<dV3K5o2oUcl~gF1V!siBIP@o0+yE0y9bk5lX(oj|1h#2xq3_*5?@z-q
zqb|D;5`P-y(GataApDF~Q3~Z%OdaN9Es-R$`UBZEMvW?S<u>#(mrWQ1D1<VjBsmAK
z95^ax`7>A827^V!4L=W<2dqqxOhw6vP=3AnQHz$#E}>Vq;id{yXkGCQCt+~torKem
zZfmIEy$zi_Myz(533U|+Hr1J@-4osGzAf-{G~X17)yQjsa|OX`p?g35snHig{PIzb
zHw~_@ZWMSs!prac!#1J%Pg8Zw)<%D*Cy`M13;Q2EvzE1r^pL5ok7i_U98`N_UVH(m
zbS3A8W75ZWT+hE9{tQJ7QcVSA9B5;e3bixPY~6N!cT*T|u67ae1!HOzd?K`#V{Pa|
zq8BY@@tw=8X){)zs0$CX=@uy+7>gF9`aEOs+AJc-002v5|9S^RdA{OLJ7hlU;}VPr
z`FQ`J1WmtWAVQ63Lwi@Ux-nL}(K0R|haYsgZ(KV}JM0vCWaI<6X)a{0>)Kc72zxkR
zx-wbxDEjcN4r_eXUXZ)JJ|h?x{GC_6r|VpgtkQ`kSz^8)W1%)|UuzYT4SH_dK1UuL
zU$+1J#-wo&F3Yugra}g@u!dSEATpVuVnSk=XKnLef%ju>Vzh7582Fkg*UOu+gjn^Y
z5{{60>X{TLAxqw?$2u*Q(cWx0B%>axnfOsM<t3`3%mXU^ayp<W^Tey|{e5;<w7B}e
z`_*|hKsw5g6EhD~>ZJc#B+j<`tfVlvHTM`pnIV7^>j2*wReN=_<L!@*b_id-SovCP
z7F*F}1D*LW;JcgdFs;LgdVbMcN%>@)@=l`Iqlo;?=X)dFAJ)=NYH4!4&5OoM+&H!#
zP^Nlm`HmnRvoN-{#CS!2+FkMI2@O(3oCQ!4CC?UM@K+_km57=(5EtbG@r2T1kxgdd
zpZ1FUinD<Mp^WFoLYIs0pS;!!CM7epROz_G$EZl}9x)6m=LAysum6qTx^VPQ|33gO
zPE%od7Zg@<<p;HtO9ne<S*wekr3)6_YaYi+>#}Jf6?cftsUwtWkl}+k?p3*E=L?Jm
zgfF1dXsE1Y8G4W`-$EcfV9{4(g+gwa;Lo&Jcy=iKmlzJ*bn^M8`Ss!DG(2M}8s5C6
z%J$oke&kI^^|VbCOc4Yi^UYD_yb0lE6-06EsZHxsCBcf$MFiAlKX2$#%9I2)MuLlp
zjiAAsBltbHf^0yHm-;Be7S%6tiIA*R8IB{Ed(JGz4e#DAN`)vUYeP`Fu{_9ea8#Bz
zSA{7uYFKTOUUA8gbi;%TJNj5aENwKZ5|*B6YQ;KZCV@<$$ivmYFzMKY11Oe8X_Yrh
zrl_W}#JOPf@u;SB7a3Z~L4vBr1$j;b9Z3IR`<4r^W^xb@@PuPBe0x2FWa*EaxRb<D
z89aH9#kQHf;5FLs#Ct<5n%d{YkLL;F9?Ux!k6VLP#3}!hywjy6r9j{f->6RFmuQjR
z3>*ZfU${N@7yKDtDuYCzc?scHFK}HYV>Qd2J;O_tFyCwr#e{@ouH_jY)Fot`Q-AH8
zH8|TIDg<u-ibghis9z}W74!FznKrr-71a7`!U%N3*p)HDnytYTeUf{+BJLi?9Q_{A
zCGsXIDjVchkc{S}gB>1GnJt~;TN3C4sAwS~Mhc}PRgv;Ilb;1S<3(#VKzrrr@Qi6W
zB;Qvp{U~<JLG$s9`OUqNOoKBUE5Xq!Q6`W}!7BERygwMhhTA0*$!020szye{uOmI3
zOhsKOzXSH3|AfQ5S(zvLl;>F3zc=aZ>a_bK>yx~A?y?gAxt|e7xe=xxf^ffKXpF=M
zmy}Yu*K?1kAg%^QSY%;W?H%i@GJ%<<sA7OiAO>U=?0UR}AJ|-LUL19($S?T!ei`QD
z&tZc}t1u>%(d=@tuYNyJ-C>&+nN9nbWYGXDO?~9S1tDwfO@AyOe@63KI&)+;wLUDj
z;E<D<h+aiBY-aj!xU=|nmw(|W;T)Lp#ycs6bmufb=3Io52WsxWq{vL3{=-rn`(|+4
zoBv@cn1t8|B72q&*18`FK-5-}^cX6NLtG&B18<~s?$lAugd*Fvls?0lxy<yG7+R+#
z0ocX=!AqgV4$6lF@DLTQ0uetu%Z7*nU2%z<>Z`9SNQX@7yAkV@&p{2K;Tg5rl2)cW
zq(tomiWB`uo13ToH!7JQ6@3dB`?4h(<HG?L;%bJfz9V5r({%b6|F(T_uj~Ah=TjCm
z5nfVLh6*weUf5@!5jny1s*KZivBoVj#8=Q@lAtyd6I>a?T;z0oxQ%kGJBd8>SB5ok
z!m>7Vg8liwzc$<M(tANgdXTQ!MRR~*k2zDY{ys;?hD>}KMlc?{3k=s3j#3hUtB^*C
z3MP%4A?{5Etd&$6;;^QUWs+N|U*G&7@t`Kl^+gQ=Lo{j?!hxoE7sf9NhYc~;nBL9r
zij{hh6gK;)6KQF-pw*ia_(xJBbyvLIw5w2c0$Yiv^qM!1--(_c>h$Bb<Emst{guQe
zKuNWVx+}1s;<dH%18TIn_>z4NzG(_}42!}Lm7SwWhQS1?*xdFBRpCi6x{U$Z)15^S
zX3T$p{_muIGmqasWv{;LTNPL9n-cqM{j{PoPqL_f!oVtWMK?`^E=_!kF@8qyU~j*{
zi^#;Fpk>I9U)~{h>I-FBFQ94~ot5rgA~KK{+c|Rrc4(R-8iPDk{gy{TVO&d9W7XD#
zNgLi!FErkk+_WEb_np4$K8#jl8fm`i>bhflm43>&b1s{K-~3}x!b0+-njV3|;Tcl5
zsQ|@y#a%G|^bA93&hbX78C$p&_Mo#@9E{5H##Q5>GFgFTxCxCI9mZeiL@lb_y>Z~m
zYUu)sBv~XY;6N+(Ch6Gl@4>TKth-7|w|yqs?VClBZ9}mAI8M7?g>gwZ7gtD-*6N+!
ze1WNKub#E7Oe2N?;*y5BhXy_b1BLIVw@8$qxBAvc3IJ{fOH9k?(9YyQz&_)BtFG!r
zUH$J03IZZ4s=)lr!Xl)P1W-P+@QR02+9%jtLCaW^>VDS=JFb=&&ilEMjFCd><sTOk
z35jd_O*P$6cCl^Boa=O=Bg;Rb;Fm&r8JoVzEeEJd;Cvo6+Y=eA;%Z%c9e47WOasn&
zZGxvTdn4LjP<5{ehv6@y&*gG;?B#5OKhGfUa=v??B0Hgir@oG8L?pa(r0LY0KB(8q
zvBY)>_9+3Cwt1T#gH4Xz1iI~GPWwtR(F-()+EzN<zMXetClEV5Ak2JsHjU!UNVz&a
zC^izqKPiU?vmBC11_w*x8AsNdPuY=u)lAbMNgv<IM<)qshLu?C{_*$~TWs7cg<FO*
z{md%t7{pq2*dvEWj%9e7os~POl)@^gYu&oCr6Z!awohcJ%c~b6I@}r+yBdbMB*HN6
z$pNAdvmm=+>+UwQ-baOl=YCs?wsI7<4ocwgSN3nf)U-wdKHq|dQ%MFHQ?G+q%=sCH
z+Vy_0@C=$nBr@jrY`)rIs~T?j3oiOyJTJlRn83zBzfOq2VnRD4QV7sf6w54jLne`M
zzY$5DIfvy}AUvbO`4a#9eFP(z(4?pK2@}5Mef~&S0G+VdGSEE&lL0{Z#lo|Wpbdv5
zD{F-`BHqdo$u4Hv?w;h9Zd+3%fTCM2tGX#O6+LlUv8%vxI|s1tY$sANF-}#&*Y$uo
z|B(<ccyZoc;oE;8Ff)t>PuU#%g{VHKN|UCp=b4AOMia(%J$;d3)DpaExq-q`5SGNc
z(mRqX=O&7w2O^<czAI|2yJj1#G#dhD0y|7u)UBv(pony;=xH-n5}Sd!Gsk5QRTCKT
zJEn1)^VkA>*^r1$ZHcPD+OX9(V|WaMPR<1?V+o6ip>qQbN!#bvaDOM;GKlm`4z8_G
z(Q?nl_GM4cK&6U-<{Ln^c;QJ<1H5sCrwZCZ^hxZaeyZ9>nL%EszOeTRcUR=woYlFn
zq2PuNF@Vl~U_|0dO1iPK%jvTd94jfYW_XMZz0kA`>1Cc(mMqBScp|H45mPbHZx6)C
zxMhCtN=&bR)Vi>qsGtm--bpgcS%6Hzk&J&GA=gMPhr$bXHVG^EAm1e-t5{tJd}cir
z`T8%97`S2ymbonutm{s7JZ~o5K{?%NjpEk{KVKxyCl?bsWvBJaPK%U!zaHP0ClH@S
zj5HDBeT#!72ZNqC9vu1JLd}HitH_XRsbK>6#op}Yapr~+$%iFUka}v1yNp^x_~gEj
zWSz7PnhC~%PJIB-zQHH|2~q_7;BsTR4hH#7T$2m53y1)mHzxo7AOl@A?y<*J_g{Ct
zTq)e}eVCIYVq%U#B*D1<Vpyw|{TJVM*qN+bKoL5XnAS^!FW91?8qSOpSq4mY(R_8^
z#06hAOapZZg5tp&nEjWbu>`|yvi|2?<c#KT)4=aXlzF1hOLnjxF#6n}fSk*e!6i;R
z-#p`3T&fp=NE58Eeg`EYyjekzMMpZoLVihrd1fMZFZ9plK>*b+=4QVvtVzwFNJY3y
zdP{5ero_!)#}B;;Jf{rpyvr<}(a{_tv<+5&G$BQus(Q#K;m?LtT@I>yLKE}w<ew0h
zcz>kj@50hNs|H|hR@WfQ1tG2>ty`jGyT8lRayP_W7cg^bYd<tPY%pH(d-_5i(l+fu
zgR9{&U&;gaIx`#vXEoaLKaPYlu8T~!;JUUZoQOR`O?VY&Ap8Ru`20l=jSnN>=ac<+
zWj`i|1f`G*JrUHbaqYpvI{8|w4{UjUW=Al72Z`<w2%+1pw;1*ts_{RO!+QTSC?KC(
zRXQt?LFp#WMu=iI%kMyn!tyRt5ZWhZs*Ql{o8c{FRp6GG(QO@_)@@XV6ixC<e|r~5
zRr%Qa7Fz^oMaM}28zW&|2(CB05fg&BuCMPUH2i4WVA{0gm9oYDd7IUT4zZ<`4{3v<
zw<DDW`fqBKSib1O<z{WTBI>fY5u|DtE!0?I>b;5KxM{$kPmF1y@Rmri^?y%g!@dxa
zvvxs(7%d%JeV_2*Pr+*bB<f;3pTadn!n-i8TM*(11QV~(_$CXUu<abbhQjbM*cClR
zQ{OTiA!<=GfrbIvFKZ8kNJW@bM#xl4w`AzSQQ`p|A2d8UY30fR^e6wXj0a|i@qcAJ
zZi<}gdG~9p*wdUq`<B6v2i+R*`rH+5jjVUol$N&1*BI3A`aBqRfc|OLr(_VL$vcmc
z{78dsWR9ik%u5ET)Bk{`XA~FivigYlC4AKT6s}&Tt-Rt?MG#AUDzf>=Gj{4D`4B>4
zlfSlf4j4f8uMwQgfq;H27uw)9fATDGS9Y3Kh=F5RCrY?)zZ=x^H9qGAySP=38LkiW
z{y&OY)NeQi@x4CLg*r6^n^9~h+h~4&H@-hjiU<S&Dp6iR{rmgo{V=mI#9Synxl}7a
z{p7=-j6?I((VOT)(9%)35Mmf0l>7AnJmy=V-g@8C9+kl>Oqj8#<iIVw$5Cu$9~Vo{
z&krjuBFIhf&p@q`*W4qFl!<AT2|>q#;)&EXLZevmTf})NtRS0ij#`SBuEdqM)-Ki`
ztuNjfDE*NLK96IG{3Sp!56KkGd>PCb$l&Id^qCXbXb%wglP7bsOco|nuTHZ0O5o~b
zm62)@7*B2h^f&qy!5S|gDYgIdp)V6C3-cjD0&I+C*n0CU@(k^|b1=He&u`9mh(7k~
z9-Q1nRFoDQ=nP=dOWZILAKQpjn1b_9q|G27q{~_AnNAg`%VFLDwAfF>3q{%r%3y)o
zP`2H0SG`mS$tm9Lza`gn8g*oDB_(ADTr0k?omIG@xFTT{@53s|jL%%*Htok%No-+w
zEyHh-U(W4BmmQO%yn(Yg<q$Cte@_in&=kp2V!m#OnP-^6Q$*I;^XPA95C?)5_Qs7>
z+EP0?Kvq|9*nY0mes@=IkG2@f)kNcsG$@^HKnV5I4MKNnMlj7(i&7Ud{mAowdseh`
z5rx*25_=+rtTQA=$mLdf>z+KMI6aaH@O;qj#swW;fXYP_M-)+T{bT{w_4hTuz4Uaw
zRvxOGKIy6uA3x8{iEuu5J=8K~eOy;~wrc+}JK@S|il-`P#U^<ti5M&UQv7C6c$hLm
zbg-Xy*@;rDAv_lc3BlAM|3fD<-%3n<>^{;s$)_e+|MU=<Ba<L~qYNryE~Pb6{-7>-
z>tA?Ucrh=u^P%3LnFyOSde1tfucTMz!cO;tQAp#8yB7@uFvf1EEFvIT;%ck=y~qNj
zU-g!OEiqSUkH(=<?R^b7N>V*EJ*8P|G2Sm7N0gxTE;dc{b~xesZcFL$ipd2it4j--
zOO3OOm#T~I&N^Rd({T}W>hoXgWL+M<Ip{KCd&J4T3#;=XD7HDZfUhX|N3*f2zs>Q@
zZ6Y))VCW}*8j0ZqJ?F;tao`HfU3SQYJmg1)vF<tL33diWaID&at{aw5XTpFHeKC=7
zB*db<lsssehim4bpY@!f6hxXtuX)jJG#AN}?_TyE6Nw0=U)n<8DY>uz(HIO-uKFth
zKG9%ZO3mUGRJcEw18E0%6H~JW5Mcg5J)*H&WtW})tFx{+=V5M4Fbe`Mbiw`n;<a4U
z7d{%MKr4MCNcig!Nh5zqFtYrE`{&f_;jJ!G=eBo}_*HrL!gbr^`;5up4}HQvEjXLD
zM?UaH?9n2B{JtrS*;bccOBag(Yh!=yrBj}0iGs4NUI5*kzWJ1ecZ#UiF2gD`*8^JT
zEk-?eqw&5-bUG)(B{FMP9ZVBlc#+5?=5#9RLZdevf{PJ8wrQ?HNf^uivHZGd?3v@T
zWl}1RF!~lK)MuEwq9J6V!Hm`#7^$t$F=FP(6jd0QvE}SV(7FtmD81P%S$>Fhyh^fv
zDmpDW0xliICq{_J!CovjF>lzw@Yf*32t~nwSMYBN+AwmLB4-F=X$Mm$4+`38@%dI#
zw0pz_7uFE1U6~YfFf-zpJ`UVic?qs%3M2_W$$ZjPpBfV1v<VWftEb;Fzjm`#;fP0P
z9)6ZSj=Rkz>F$n`K9hpwMQn0|hg4&q<&29>U;8VB8@8O3gRLXoXIyG#>(eO0{;2>d
zBrAJ18(!h+Wd}(~RG;b5+MtNBSm%P_t82Kz@Xv{IgafU8mlV-+6rP@dDCxotvvf^M
zbsIIuV3gkFrv2$R3%X38K2r3bg9YMmC`;JQ;nFOb?G**_J4`|OZf#M$PQluA?zk#1
z;o3v`afOndD#(RWeflqmMCQR@%JnAgw~p%b40~U$7r(uc40ALBo;;H|)+`6URo17|
z$t3!6-M{*ios(YL?<&!@X+e3cxGUX0=(eP)h*OFV`#7kk1|se$jkuF;G72c)`tD^!
zRtl=PlbED99SGzB^~~VPme!uO6-%eBunIN}%Dv3<s}hn)QBosDQ=a4w3m{0Hvy_7D
z92TL<JJ-3ja7cK$k;z`Jzhhfta1#zEE{=qu6ST5Tr187w(V4-y@0*BJkFy7jwhra;
z)A)fuWd(ii-Ed4n5w3zlaV@&v0(;UvIhy{CX<Hn}GzBzs={pdPsh8aux(2%0^C6=t
z21tPsaW?E)XY_PSSpS}OU*^S8-A182By}w!W)Fc0gNV7E26XDFyoUD@vH8~Wwc_`l
z=L<I=3UuOsI&(jrc;r!)Te7TF=DmS>*dH3l;t3&%Vi|?nGThnaeiCh&_H_yT-b-qZ
zx=Gso#hy&sJA0)j`(%!L3dZTe^FE%k<CR~a=VKPygEW3UmA5wLRWR!ENR&qRsuTLm
z?&U(+fGX21tNmF?U|L1gmAtQ!=%clPk`hXc6~kpI8>rIE&k8=Fhky~(K_P}Z<&x%1
zgj^niD65>BqcTb{KjSyg=BZFdlUqjcwSAGD0Sfkm%eqzPWvmSJsw=zS!Fgp>U}LoS
zyG6{TA~qV|Doc5ugL%>IhZYgTE5p;XZ0c+pXO9u%wbA*c7Y7+RNsK2g_T;;V+<sYv
zrmUN}QX@PI?6ms29`Q1dR{c4Bq-Xk!miE)FcR+s75spC`1!xyv4Y6az_8(~826zh5
z>|{+J;KBSu?Ev6#2!-<>!T)3<6dMwRqVo#LqsXcxlL2JOg}pLl<12D0hR926OIvG8
z`^c9wMYEH&*TEIz25GT2X(n_7^f40tAD8qa9%iYUK#l?W$}R`030mF0(5bIcZ@=$^
zguS;kzVHoO5vsZUQ4!wiFouXbZpdZAfF1{*^(Jv_fyq{rCDb-P`D+7H8@gCotVOr>
z{-DY0sgw)-A<H|Vl9kr>ue67oC5T_HMqIHBT3;M4kO99=aN__CTb<j075koXk#6h5
z#f*0fd`lPm)Cu(n1V6M=t@ZY(M>?A#+xt4qVCeCqliaT(=uq(d_AoOS9(*vM66sN-
zJ?x(c{!U;ABG1d8HP2-G9<~IUGs`dVPIvQNFqn+K)cE7`jHX?LU;Jq?G2LB6i*$h>
zcwqirUHPGc_{#P<#wcg26QG`YcG<y+{w8>vh~Oj5(U#$)g3^;eQNtcDUay0f9nPpQ
zyzuqqN{O5@B$9>QVHT%qap)GReIL9iOoY5-@6ITI+!TlSN2LP&sMct5S(niwW#51B
zea!(!yfveXQFcN?{@s;k;29T^e5%nNP{hbZwIdz~nsG^dzg1MWQy(P;A$3aJ3N7QC
z^wcD>TxlGAO}1asG3q0CWt}m5;bU+3=KIPAl$7uVo2D@rI?4Oq5+w|Y9@oFx%E9z$
zsKrezRu<}HU9Z|h+f`?p#2o8Ow=|8WrF!&LtCHn9z}STcFse|Y2FYqd&S}W*>1E&S
z*n$!~J;d0$i~#2v$Ifyry>Z<N!p7!EkxQEb2dfRoLMr`cvz4fjX_C}KMmc406D0(;
z`|eF0$t#BlnJP<Kfvt_n#;YC#iM#|oYDb$TyQBT}?^$SjW^q{p6j%Ei>$Ou9Xt7uu
zmD^0ZO-1Wzykx1-^3%mjY86=Zh*vtDlhT6i2=}*2`=JwVJ(!yHO{~;g9Kfv=ZKL=J
zfj7>IuH9yu`(_JNa9s@}qY`Z_H3C=giyVQ~(9`%xnq!3n^jH_pVK6nl!W-p5s<prV
zV3AmPF6adoNzMrGA{(J-{vdB)ckyYKAWj}Zj4@T;L?`J_xP0}>pLGQNWRu_PP+AdM
zbI@9AzN*Upy|Pf+PN`eMRqJCYh-;D5gdFesfBJo24`K>``)}gc^LIdYYuA0&lxL;o
z=J9Y*VZk?>+mgQM<(n*Y5L$c|+$3Axv}Mmo=$F^HEhy<{1?rr!(%Z$$`U}yj{=`gm
z-8f!}D7YWMCj6NWkBQx0tYR$G0WllBPxtTPd`lhOxw9v|BAcR&Xd<UPdy{N*qW|PO
zHMhE-VU6G2x`1mh97H8J!lp?k76>4Vrp4e-5T*Z3TYH|9x$9^2Y4|uEP%0}RyYEm%
z&@R5kzd;e|Q=-&#Ajv|LOCs1C8e(iOQoS<14vC;d*Fj`g1vO_FoSo)pyD>(kx}O?<
zxKyjRpgsf(iI#Ft0VW1GaSNK%9Gns#MUOTcj*lt<RmE<5o!-tARA}k#S9aRKQNJ(A
zAj?psWCEXLj}>Lfg)~<pf6Bt$)FQ{4(AZbGVjmeL@)V6f3l;%f@)F%nm8t7nK5|mj
z?sRA<9&NkKVdPi2xA|<%GQ~Y#7PDL3m#R+HfM(EYa_+MB#^g3y3Gu@h!*irsaQS|F
zrYF}Qpr>8@jttog3eyacl6eDx)SR_+nsuGp-at*%f}bgqC$dM=3(#U_3!b}^__heu
z*=HJtr1u28_uty#@jpu50@A5_tl2$<A);)Ca++cdA|a{I+B!iBu+?K@A|c92D@mId
z5bhLr{?9B|UPeLQO|g>dda(*a-0!lWUxwSg&+!>(D(+WD#II~hT+w%|geT||?9Id<
z2)d(dO_m~q$ei}S+T#}4*VR1y9DeHYmo$3k)akXKcq2jhc{`w(#Cl;NWmOuVL}Zw2
z`xr$iW~X1WO}Tv0CypZSkN?BRRWv9G%uT@{do@k?jn%8ePN9bhiXDC!Ht3<~;s&5X
zM_OY@r5isQgGUoR5Y*V+AB%N;x)lK2xw8S5YOM>3W~})R&yM#D^^tU(H5n-^>TqU@
zFQ_Rhh5sl(m;pr|^vT%1wT(t-K`K^UXK57?EkwX1TGxM~k~2+lZ38Sx8YOOF$%1;@
zZ`*)KVIGP;M9noJM=uDVODjR<0;s{;cb=>l=?^n;R~1m^tS!zx*r!0`!QWeZyU$>&
zJD{)}QB`N|jC4u$z2f{Lq1gC@pQzn$0kT3Ug75-bs3Y1!X9lINU%>ZyCDU?G#@l1_
zK)G$iaQ!Jj2FIo9fpE7tFwnhAg7by)D%Mucg3yw^$2!zCDFrqepD>9GxM9sks9#Hd
z)EJu(r;5X8cMGwkb{xVrlO36NtcuGoF-Q*^Il_@`v81mr)sF*a88zZvk|bAk!A8~6
z3e*1K>@tFHnRJDeSB;9X%vee$5uQ}TE?41e(d#r;gLYj5(oW#w{&Q4dCgRx}%uCI=
zgi~>(MeS)@<th-f^fG%Zd<WAx%TxhR3R56dpxVrVhCo$73=}yvtu$zcY=iC;voviF
zCIH^M)O`R>D#U_iyIYu2UQYhjLnGS%Bx|#Vz}E;TZ>KmRdWa?r;cb&UD%u@OX;}Wy
zseb{ud4So$*`-O@bKw{KoGpBKdCX<&HJG7h#+(tE=6{Y!Q=Zz2>l}J*Hs+&F#M*`;
zJRv)*XJNTcrY!-79ZS*`yjM=7EmP}eu7<adjEGf$y6{hgN{eygCZN&Z-9A-`dX!Ua
z)^BGp!?Kg7NGWR2Gx}Q_Il6Xlfv>A^A%ye<<b?LX8V<AsFthmoHuj#=!H)k*H39i{
zo|@?AZOCD7qCi?d#7{_T2*KRsgogsFegGzM3hbho8YMjH0~klX3w^8Lo|*H!P^dX%
zDGW(}W++^sc)@$+)uy)WqHSC3sp=FC5jIpn%+T^asbAa=K3Nr+#^NLBRsfnRp$S|k
zma2)p0&s-n0zVF&cyZUErUK0bn8ZYLA`1^kA&YB9d$dYpcJ>3+?x3oYt-$15bv+_}
zjQAhuF(*F%*qa1vooj)x2~FWg>wIra5YA-2Xc4mg8xaW26GO@ySq?s6>EdNa71>wB
zVii4&Uc}~QWjGm1(*r#(H%P!}#zauk9bP~9#9|x~4EV9yH8r=`PD~o}$V*%@qVeYK
z6iHPyfW*FNiOvFLNwyn{#822~iaN4Y{BXGHOvxR3*sJe6x~89Wo8Mzq=$A_ml3VyM
zP>(P@=HHsKGO2zTH9IzOrhP*3$@`kJIcZ&Yg^iltY7?b~{<@WipP@fQ4t8Uc6+%wr
zms(%?!wTUgPHU=8754Q)<o57X-453P4gLba<X7*XwWi9_ZG~vi<$2;fq~>)t!7K8$
z_2)%0EC`iNq;`Q}7H0-{=!OG4C|JSJYksQFX3%442-uKLEHziF6tj?5UV1Liv(h^u
zwf?(90&`W^K5p=Tm=FT4MWP4OIOZs7`UQiqCZZn!hrJ5CJdWLe6vZ<@;ugwIBbu6{
z;IRjdVEQStT|w}~A{5FhBc~Ri#GV>g-f~sSlxa%qBb|7_wOMyx8F_FQVcqDmQH3E<
zQiM~ftaZ#P5G}GDUC*VnNqfS<GE|N3!gzBil8cg{u_8@4)VDCEGe=Cd6--3_h9!k{
zp%+McRt4zsD3~QoBV}`A*FValAQ1(atRj957H_%@gXo5dU7)`@;au>MCseBbL(O<6
zvYyAkoE^a&Ei(79peZU5PbZNdG|hRi!<+i7>MgUZVB)UvU|P+-{L`djG7~UEhb^04
zk1vb)*4ZYK;U_NFs8OF7+vf@}wE_bGCA%x??OGeV-EAM>fgOM4tEb?py46xG2U4&x
z9(8{P4;)Vb^{@(Oe)zV1NY$?WLRuJEPqIeote6q2Q^jT@1tiE=@nmhb<GM(7=yi_|
zeC&$Gd*UU%aeyaune*kjBnU3JHkJ1XQMF$h7wV3(b=pD;-G;(%@FINd59dQ*bJ>l*
zy03EL7|c!H+aJLh(@Vc|CbF}j?kGpZdpWWkrcG@y*l30MXnGtqfg&cV13fS;xzTrv
z=37*sxR@E{=n7aevzJz;xzwA1Mn;o1baOaVm_nL~%8=}s#*uT)nWYfdpOU{RtQR>b
zj8b6G=Co#7aBMj1hTrTZFdE{~{qXk&S^2==@nSeNz-3_56vpV#h-#Pydl|X|=~^5;
z=}>ArxqP+9VY!Hu5)>rkCaoF{^Y7dk*qVx4^21@dZo15qNZJG@?)0(w6KaiT)(Ef8
za}p7ENGeL%H(dGzp~~=VpH1(HghD@l62zFy!SxR=FS0?WKdiB+&K$#;^Kkr@a;jvZ
zNCwgdckZY@88AYcH^D_U%&CgRVrnu6p*?=Hq!7qSH9pxvmffTCG3Fwhf%2_-sE-NX
zu2G&C-pH{eY8s%OEN{*@YbDC>+~1rIt#U9`lzC$U#+-q<m=kw)Bcxm#EbdX^jIp^q
ziyR^L4Y}>-I>pzF{C^6mb6RGRyX3VBVL?)2mZB=dXYMc=6rRV{lJ!(B61BZb^L`#h
zA~Js{-}D~66Sg1|Y?~{`hQbr*kgzN;`&p$vD8<eXfkQjXPc&r{UGQ))hA`rVWpx@v
zc^f(Htmg%>TsHljmMZ}J#f*F3Zu6ca?gkgoE?dlyGt|8MGyNn5&_WCOhas;ftnTnw
zLppi+xJXR>qGd}tyA^Uut5w!Q*_ueJTh?4fqs=C&N*-#4t)LpTgQ4yvi=N%`wfJWJ
zj|O(Z;@7@^+%83bJub#)PPOq2s~Z7MMx=di%i_J5BK23(x|T#JZ)VoAfvaPR+Pys2
zgD_8DLMjdJFU0ig^6$XwFnbj=bPD5x-E)juSE3waf2vE~kK)+wHSN}gAzB|!WWh-r
z*Zn-Tqjb(2X#*VxC3}z=A2%Z&Nk57pduC`%ZQ*DbFo}J%>`ol^A+tawWy9<c5FPnq
zieG9fozg<{iO&{bbasN6660orjgVoegBZha9s~XPz74k)n~OutZhP*c7q+BGqBBDo
zuwnT*bIoJ+0AzXYyS)A<*Of1O;+D&x95bD8@T!rY#@q{z(B*_Wj*5nIj9&9~*CuHt
zvG8tdtJSg284d5@FZw%H8o%b=M=bgJ`BJD390ej%(r?pK?lKsw`StO4-I1>@eaT8#
zWF0c`@AM~H9@<mYMtQ$l>{3(}N>U*Wks_{ZEhGh8wg1$2H=F@&>!*w1#Y3(r02QqK
zyu8}ZN3H68$OdOQTsU~4L#ajoXfC8n1RF52fn~9R`LT0cUoJi|aP|7OnRDy)x!7e6
zP%gC<r4Dv3bK{hRxsZfIgzIxCw_Ih{)3fRlC*2{ix@uWF8Ky3pn0wvw`@K88D-tp}
z0}A0`5_>R2&DW64yCDfA$UrM-gw`e<ZoLS$&V&91QhskvymCLaYl4B`I?paGQT5#T
z?|R#WLFOENYShc9c*1z}3fTcl+DM$Z=Y1vT15WDqEP19&pul&R$d88x!d0<9a&(yU
z3Y*53PfAQ`ck1-}x2K476B^{7eF*N&+?{;D)HF*HCSXq{`ilD)GO-I*z<Y3OlFK@-
z_jTu^|JKqxwH2CU|MAJOr{;)tfhj(+ZRv{LW2;?Hs-32knu28E`>S6wKZt!RU_j>Z
zOZ8paRESIpKki6n+=}KNDMdhW{4%k=5?aec+2$2%)QO>ChY7d|Lm0w1g3zqk6;G-$
z2A{XMoc#yE|1Gn{WL7}dyI<8xW&MzcUpG;aE(G(;eW{3Ivubh1w<LpFuCy1b67nZ}
z`bC)|*>OjUG;MTp17i+k7WrR7(fuGb%`S;!5YUrwS7!Q|Z4p`?)Wl(H3d=H3eU9Ml
zhBFC~o%_EV$cC3&-NNW87GLzjThy4+e+<TcBkExHqtfn+J*SI;+(#ZZSUvNBTqJCu
zQai`)larJ-?!D=At-K*$&lnBm3jspOc5fRxH)cWpo|p8;x`3C{c75XAd!-q6+}=xl
zE;EBa!7tNsrMzUayx>}-r29`Dj7SVnBBuQd8y<wxlnOnm&GBuL43Lu<cZ0xrtBGL4
z_V#C&b~K2d9@1>;*E9;ed!~9Tv@vv^X8^lZOFfjxocx;`C7d<8wnVrvUBEXKi1<}w
z;g;QJ#ZspaV@{4b&xt>eP>Giqm!6$}abjzqaF_|N^+J-cCKxE9Bi9?tEHs=mAPiSu
zi#PDUh32ixZ=u;kUOu!|(<kkl-<eHlB4kw6-0HG&|C(_2zWk;KfsOHrON!5@EGC=?
z);IKc*^)g4zi#hnLr*Df=u6<Q4`_|jrayI%4C(sE(qtu;^crb1ehBK1sg~8^2o=R;
z?(7pOb*7z7I#JII-)fEpq;?7n*9iZxZ)2#NFu=lRh;AOm?<SJDC@0P*7vtYoe?6O(
z`C-;q=lEpaNvpp{F6PZ258yLPu`J}7T?EJOX*U;6M#uLp#yu2%W!QkT3&q(cf+oq}
zoKQ0^j0iV~Ae}!+;><=4NlSICA#$hZ>Nsl^ZcxidOD?e+u7-ikSKJWLS7Z!+^FpKa
z#KluA)dNwz@Y5HDJ&Ybuq;!_ZW~B3W!CgRC*D|USl72U<>6M7WP^@v0oau}YfgsIg
z)GnL0SP&c<ZrSRZ9y_Rmk&h5`L;!)9#bBD)n=Y+GJATUweM_vFm=#ekqWgz_h+j+u
zp3;ROVRw|m(T{+drDLQOgEgz2&f@Ef_(%pmI=Elw>Mq0Jtk6lolA{K(k}^?!1GW4}
za{3sIb~)|rn4x0%S!{WpkPuyAyV+6|3|q;!N_sT=N@H&PhH&tv02yO}<t!1utaaw@
zPBy>I8Er9U`%m>23-ru>vuCoi7F1hnUSIj;9`R(4`XWY8;ms!M&(GZsQjtT4;nX|v
z;(5mX&LK2?H~zDvJxvb6zfs}?V3!c1>QVp*ol#+YgEYLxqC=OKZERVDtm5$MpfSwc
zGR%3spS>%_rd*mE<jfNQw(UHNlqG6Z{`cMsABTLPM*b{xK2Xvw)+;Vd3%)a$vBp_m
z;KYO;fwRH8ftaoIhd6%ZnV#RD3aRrLv8Su6<2?gXF?NEwF0Brz_*C$;pIxfed^8H<
zL6d3b5bUVp%jWvD$>2_OGiF%~VClN7jlukA=43>{{fxfiO&CQca`Vv)s3J-rerzrO
ztE+R2&Ln8_er($lO>Enk_>OJc$;7s8`;KjEVmlMtni!jBci#{DcAu{9)2HhCR#n{>
zet(LMUf<W7ET{4sC;o{zKTL5|fGfF(ZHwh3(Ac?uO$#ekVC&9={u>fPX+7tAWn!CM
zULrrs1Ag$NUvh69l2ijH!}aN;=)!8#QVvA%y;O(|ddy$4e_wmSmW|O9<SxFymD=+v
zzn469&*3_FQtgGeDP^8wVnU=R)MjX9-pvfMv^c3j*Ql|+cDAL%eS!c^GoVgOt(}64
zW-s|H8)O^t?OLi4XCu!4C3*d>nWDd8%_5iEysBrOISW|!&sFWr$<Ku^brdvE;J!f=
zRuGA(KFtiV1i?5Qg0DAsh~>WJIu0dt>ZXL$0rLdDT#?L75znwRJqUv;43{hn=J0Q}
zyL_GRPD87PEgk({H7L70Yq9$#@Yt*jr^<0Zikunfl9irY=Nd2cz#L20IX9BIlmW_k
zNRdEJl93zeCo9Yh%gQQjy5V+I@cQ_7<<_K-?P}H@Jsp&%M3L<n(h`U^y*V7SpB9gh
zxSf(hY9tA1`)bg6R`2)`z3||f7t&4fHvh31T{G8FM_9CivBQVMH!+ZsPN&}4Gm&$r
z!<*I=&H+3(z=D;LEQRHp%lo7S!q}1K!bd?GmwrGjoMd%a-e!bL4oVDBAel@XyQNX*
zj<=?X4ka?9!d(+k0i5Z2WSn9PGtJnml-VT{6%_>Z8keoJB3Lk(M_<^EfQIbpc-_JI
z6lne6OI3s{dD;!;vh%@mGOx(Pi6ok^W)1z=0a=*BgG%1$b;czlE#|u2F&+ku4F2sf
z%idHF%1CysAW7$?SLa&c?1OCehguNmf;V+PI`Hbf2c0Z_G`B<a+0?8^!mI^{JlnIx
zKY-bW;sW{ZV=1O1cP6bMv<D)cCOiwvjW7p+g+ytgz2moxwi~g|m*5O<{uAAZZONS*
z1>o_qsDQIQVgm^6A(Pb=%W&M4ZYG0Chrh=f!WQ5lPDNx6WzR)?GDsl4!N;puKFQ8?
z6Rg;HwShz>q>c&)sIMmhqplNealqvJS@5_C(_&~MubuiNH1|JkMZ0fq78{_;e`iNi
zFCkZ*Wf7gHT-ZysTMXlKH@w_8x9Cr`MlY)M5=^Z^?GsRxN537LxD1bA8zYlYA{s|8
zlPp9zMBca96BGug{43xyf1950Y$WoeE$&5!N2B%bHA-c^r<W%{QKSgXX#}SgCf^y2
zjg&T_7!3-f5lqgy^jP_U2N$|;9xlBe0a2WKhC(V^>Ms{&Q+Wn8O{wwh2@MLb0t)n8
zpoj<jSa%?KuLR(c(7zZ@GBuw$B7jJ}uQ5QNJ9G4Rh{HU&S%Vg1gfDgmj2QV{Cp)?T
zH7mUg+Q1CCMsoxqbtao)7iGf7%e69^k30_p&%HntgA5fwDoN;Uts<TpiC2r|Z|m(e
z{<GlnB@BtP%^(YPi))n8#Dd%fc$z-WbEY{C(n6K#gXl&rV82JE$x!R-|CJ*nI^+cS
zkhhMpaHg@=a}4kP>ci7a+kYVQF%rbKLqchasw@f|*ZZF^@Rw1h7;1*ed)Ir(`w>B#
zupU&fuW~WO|4C-2HhW9l75I(;6HDR!CzIXz7m2-l_yGAdbFp<E{`!H}?Gt^N?HS)M
z(nqDg$B$YE@21Q<c{Q=V6^|ROhfvS;n;_ejh=ACAI&&)_^TR*W2Lx;ceoLWpq^r>V
zmY55jR<(RSw_rX{Dh2f`G@fiXt)^1NB3q5H(3{1pEW7Ay*ahz6OA=&>rtyye43+=R
zhhABa5cK(t*h6Q@Kb%}!QlB=M*c^>YUM#B5Ce0$noqLPVa2yt$Z(|#Km1r3$(Ct;y
z01Gq*O+>=0{^<l`G3nwYqtwFc>)DK*iXJ|}YDHW6I?Gu;h6taf17DA+h2fR`wtBEQ
z$F~6U*Py-O;UQ;vT%VtEoA&Qg2yGL(D!)882CR9rkzx-P)pb&VHj(&E?**+Kg_PEj
z3zeVqk|!)=1&f1e{T;9*yfQeK&{Hu5P!R^aZqA@gIb(Ct+3t@$I$Je@8Wpwx$l6{p
z2R#eS<r$v|c#;vmD1la&sTmEg9E6f3l2JLO7Lgw{qREiv9_4r!(bUT5eZnz-shh0D
zyc@KrJeEXafgILqCUhqJcmzi0JbULjB@SXj=2pOYF`gF4^99LEYuYYvF`&*XC}E}+
zc}=MO)}1(}TDhhZkeQ!bnZJF;#@$L71icd>Z8;S09cyNTC&uQSN$u-DTmf%i8kO?B
z!)=?)hw#lbpQmf%@%(tTRu$={LQvKzqXDmYy>L};Trx1J&v0^+Khif@vbOHY^l9w@
zxSkc%l1qGnc@9{*jzPYrVZ`n&EMw*zJC_qxxd>sGOisKpWL<XbTY-N9d+d4ZwOg&9
zYw<-jP6lggPme}x*4-aWIX7l7P_(q?%R1b8G8OjgKe_bWlnDJSm!C3ndS8?TFJD$&
zL-NYBD#MC*_P|zdU!zPr5hoZ-_%Qjr{x_)m0qGhwkD*V2loQ4LOI80!TT*!|BNHeS
zenuvl-C-TkzI?*;m*82PF5PfGo+Z##E-X=0b}+bu=P~^FWU--nb}6q2>b@g#xQadf
zUQ_pwLiER-b@S;U_a}{3WrU4eO|>F%s9cB`5o%ZoXO$X0aINR*lu=NPerG9WjPsLy
z|3&J12apHc;`sf{z=)ORU;uCf)vjr{?7>r<#ThFXr>zWX@lE&*f3xt)8~m}9VFz63
z5K^}@Y%g^QG!m26cA@Lce;{x?Jt5?VLq}|}aQywEH7MT0Kim7DjZ8urK>WL0M`VH3
zGTArKQ<=4TCt{{_hLeha#Y}JqM_Mo0yee&r>LWjE4eKflJ7qb&galR>{s&H_I2Jh#
zv`?IqI6}0KEb=^*-KqtNP?!=uw}pNUR0TdFc+p4(!4_st#(fM!F<gC*K$o)hd)7nn
z43p(nFj3<yQosHY&2<V-f=*|kJPjX=_@}<3>D)x(Ig^ndn_y=l`oPdG9$JDpx1j;4
zP4zy1*L2tK7TefI?3io7u8BWViBD0oSim(af~cK|ZxCnAW2U$Byf`0j%|9B?|F4jC
zeICn>))~84Of3<{#WF~XNG9iSp;KMokFo+p2OmjL!l}^zGf6?*{`gEs&9OT#DULXX
z^Id1?1>{39S3zBp*vjEI*LvM2AcD{vAyM7$lc7BXSs3mdS$hvgUpu$><dxJFAConF
zE4A5X>+7{Z%l;orC#sm?uW*Wrcf8p7Jwt6teN!X0=`-<HbnhNnRHbct_0S`XUe~i&
zD?atq)^{NHNUGTy!7ua@G-jUDDtiQVD$J#mW&UX+#Fpw|jt8b^5hG~UJoZQweVSf3
zt)65sZrX!gM!vMJ6ivNO4gcDN6<EF~@)C>)_q+KgI?M1uPfLwT#a=rPo6r+w`8!Jv
zvBONf!WE{E><X=^J1!dEG|$HI*Icg~$oL~!_?Hpvi5G*%vlOjYnc(T^**r`#ipV6K
z8PaERQRZV=68;-|Uxuuaz)UdAU0|-egsSZ~-!Ou{l^p4KR2>TMqMoNPb|YyyeQMZj
za8e>|XsI$?(Q!iRb^m#3>enf}hq6A-FaOBRXnCwycfh5&lDM56OGpi$m|x;fjM%&M
z^5F2yr;L|85F6%&@t_6-A!{KYywd2cpGID&O=NkHq1TVYKr_eumdRl4Nqrl#iT^ca
z)0H&4hnC?axQviKVX%nMRJ}61#@R(>T)a#&->F}URZ&8WAgAa%w-`AlrMY>Wj#Mal
z!A;10k!EVv)U&*E)mS2&z7RV7nPIf!ytA|nKbb4e@P!Upu{}?#U9oMvMVK}#xTZYM
zuIh<!YGBITA|Rr?WoBK(CU5iPz?tXpm*U{Iga7;1pM$--Bw<>FS|*}%m7TTm(D_el
zt}<+kTGRZn2b25^?R&PY>8($U?x`pft3*>2KlQS86+_beX0`qRaf?W4@m`VygEL{(
z<@=8G7&#!w3>bc?hm~8<y?N@3?6ZvIx#I@a@vyKHZ+0rF*s^gzjqnHUpi>>@I)N7e
zz~bT(_p*qno95PLo#rLbExwX^VQO7V&XKFDM{i>`pgg`$u#?eFoMP7W%>#AmGSD5v
zOb#Ydm=LSSC@gHSq~X=U@`SX8`*lHviLOn`LTX3Xm+_q!Q{@q9O_ygd=H`bJHPIAq
zUQav}dxY*EEg~yIv<GPQ34+GDjoC54R=0KT0vgrXvpnd9=nZ;s%3;^gqKYrjK{IRM
z^)=s2CQ54IcKwpV_?r@z0{0YqbwFAfo1aBvpq(Q!wnr?jVZ?;MoQp!Etbh-i$U@v5
ztH*ewm{AQ|Z+FuBRr_`P_2&1b@UZvwtMo)oEFqF_96i|ymjIbi0dzh5ir7f8qz9-q
z1z0?&@nFR4(_6`%{wbDKNKTm0R>vy80$M6)qB<zLlZ8<EL_DXyx`Je!fX;8yW5=`l
zvm=21$dZexJ+^(<s_s*CMMpRMB>=1a1rX(}z4#l{?Y*ob9EX$&4J8zt0aTe}4Lj0%
zzv+gdPbp*YhdOB`e_=;jxD}dc#mjl&yZ5*yV&#A$NVyd?h3L?}4b22c#5<RDq!PZ#
zB?XqYXr%%gXZ6ZF8^elvZXZFx|8N2H1$BFBqyJ<?Xnmt+X_Nl7O%#UJXHzxcq9M-m
zGGlohHkp|3Vj!J|F0I`mS5x=17FFvLlMIY2ld$*)$*<c&q0GgX8F@Ro2KQ|<y){FG
z)yCop6l^CF`0Ta2$S3z%os<4MHGsNM84OvhnBFix_78rG|GLDY{tK(;Idc<Q<`3f%
z?*4nP0|7CDux)XqMS{8ojI~b>1*HmoySN2ExS*LY=O*Kv1)hJPv6IX5&H9?)Drb=X
z_(r7U37R{!a&>@Z^`;;>J=7`D|H-Vty0svyT;*o`F=k8y>qI4l4;v^kC8=3X!tOG)
zGWMG#gwM(UU_3DA7pbC2_D~U;E=WklzsQz<>@zPOpa^vJeW{6L1Gtyst}8Zvt}2~g
zf})>VyRrbml!nDeC(asZ|3;Weoy94}^4QpnA4l-T*6S6a)0rzOm)|~1bU^>XU+63=
z;lKVs^L)sDyE&gbr-p*-Hchsjn4JU_C^K;r@Jz|Ixym`JL!ecV6XZyi3kf=Pi$|oE
zbv!x=PvzF#yyL(@iEHY!M4G;HV%*q4!_gmtlI+nRFJ^xiZ(aPPO3WTd*B|2KDwu`8
z%SyX05d_CUvRq4B2rS0-+s7{K#ShxU$DM<+qz^wkaTG@Fl~M@5DsdtRpbTBEOO!Q%
zi25S`?Go(TM78o;<M0~DBA*saS$Oz(<Ap&HSpQ9D1!JWR`ya2Mu7`16-9+UZ)|bhY
zq<n<oda%I)8H6^{xB6UcoNg2|<HKYhO!Jnvj_wP__|!@OKI%bPQbP;hkfaVL!P2~9
z@`Q!HCUON`0mvuTVQhz`<WKYJaY?JZglS-7qdLNP4u~(%YFcJR>C$IB9>!EcXq=22
z#X+8WDo2(=u^=m#`bWyyEn@E>bw_TjR2A4&mMC|Eaazx}8u}edY7dD9T2LY@F&Hvo
zkk<`DjL9E$xaFBJspXr+v2kQXzl=Wsj*@S*#Q=7#)TBwuvSZ@iS8w<Em+i)%yI#h+
zFK~q@-m%aT3UMXU1<wFByPB<$jYX+-a5OR;r%;X+jEcl$!l&7{4dm-71a6E9#+DQt
z9a<rfsO(yMGooXkH@<y}iCU!ZkRFoVT#9llA6u%SdF*c<q^-V+WAO<v5+)}Am6h$&
z&T?D3%BvmM&;s<Rl$*@aQ`&f%_4B`0+888uYwepgyFXK4^dKRgDF#KjwBg;pWk!%`
z-cCr!G3<0QBt55IMU#map~pcB(FG;Dog4fx#_uqjHa7*7YwGsT1(JTyPY~~wR;Yep
zVUTGO@66RLx0I=je1<e1jh;WVRex#)3gOI=e*=;V)L*16j-YRkpbd)IGbMR>K@+PN
zgh)?bR5OWl3+IHqcZqtN{dt5fVy411Knc;!S#BdZk#Kht_PL4_O>XB{n7SqM&Lgw^
zh(K!Lq?{1bEfz{99&GS<qSHZ*hYb6J0h}xmV+6DaBj{&0OANZSW}Pm%3Pk=5kR2^Z
zU;p5D0Z6TZFr7$E^LK@R?kOpD8BDm~b)%kBC1Fd9w@YIu=<GG4`;eL%UR%MdH{mP}
zrNCpJdaeG9AOG&$#%Z{VR^X1xVoFlQ;{>UK$U>L`m25*pf}T;BhG+=GFs9BL*+HZy
zS0M~*2t<Rr>;d_(-Gec|XPGSRD)(krFHp&i2)6s~9GwA@M!xqm5@P2k-llY#d_0Oh
zgS{}#bfYy02i++qXCi_~+Az}&k%q%ZDUGPROtPkBFi{~LYoyJ@P72%fb(s386D!kb
zfh0vzgeU<K*AP4fsv~7lU+yZ|2>&rNIGc)gReQH#HxQA*EpPKkR|u}s*g?%eYpcMk
zeFgLrbci;^zZ9yfN|i{1AFbjCE&Uwv4oMF7i6H01J{{-XEAbWKJHE1zDz6Gr^^_vh
zk8I(cfFvx*As4a<Lq2kE7NiK{HIiE!E3}Qm(g_g(x0eIUGM9PP6bFX*JYRjU^)HA5
zY8)dt56KV)=ToROS;EIBf*v$g9r$b^73Z$$NF`GaD|0!tW1Mf{`I9e~{*BolS@?oo
zK_`GThAGj!(~W{&Aku9zHe~k><s=TC&-@QObG~SEW(670pJN)+QE=W3+O1^hkZ|48
zaqn*6wWA>fK~dohMsDU^>6C|RL6z4(&%dZe8W^2;I=hU2weTgMpTe0ou0?ge)CR<O
z3&<&upyN(T0691pX-;5ct1h1({`CoF9V2H$T|K_Z8j0FQo2m2!v54a)QfASVTp5b1
zQS5NuibsA5SZZnpa4wDTZ^n03Z%SB4z29ayqR@P<zC|`RudEQ!A6>xz?A;vi4!c8b
z=361RW7-|MErNx$I6*n`$UR+Wb9mpe42N1$=o;jU>yxGiATF_+C|4AqKUSl6OtDVL
zV0t4&^g*-EY~thjp4Z#MjjcUt+rRTCcnSBNAgFFKTMJDV%!zPWu&`&b4AN#dk%>B(
zg1)$*B!wB#z!cO51uoFV$Y5~B|DqxA0FVTwWXs1;Lm%l_G`P@TQc9PHj?P|NXB-Ph
zni%=kH|$TdXk4dLq(mbD1FhI;D|1-jf8bCiG__CcL1vc4P{H@Fr!l}h-<+F`0RTsg
zfRnUVB{o1ohsdV3Xg(-TSWn4_>2y)ir>W+2q<L5v%4-ghidk_GQx?%(@??~#DS#Ar
zT{D8;4Ovky@J3oL`VBucLx0j)9{6&0{pL4{r$R-wBmZ%Av4pa7cUYojvyL+0;Gsu=
zvrVM5xao~KUod}xLVmuVi0Z>g5SK9n8>b;gzzQd|14#kfcG(~`^bY$kFF(4xKGJ-I
zxwJA(_S%8NF<^UE+Zf<n)ctSs*UQXA>yGNexUT+N6zwNnZ0${5>P#P+*YEOm#e8a2
zA8OoOENt2kQ3ns=otIg9Lg2Dh!nJAk$~<j8D5q0@5Cl~R0Sz?#6uSr?D02mh-jxu{
z<-2<ENou@xgAEng4<ajX)$`Gv7!E<&3K!QqCo2;6Gx|Bix#fJ7)Nvr9cpvk{ALV*n
z?OBH%a1eU~q$uMg1&lfTSnL>yFJBYllVSnI0LT?FzXe)$AK0Dkw@>StMXSZ_4+-%$
z2^Y0TPT&P&#f81fn!UONEQ-1=cvVtJ@l}zWM${#)wyNuF=vT)FTLYWU0duEyVkjMB
zZ|7e(Jt(33*Mxm&Bgbk^cayQZJ4(xd<{k~AP{hX_LaLSwxWoR%4%+HvUR!Uo-A{pq
zF0wtt;eHNs!(j$a`s=^d-oqcQA?+~Zo9gdiE{K)77(F!n5s5SY)%>Ymy_V~_gqkK7
zTpW(+)`@*ixVSOxqM{RU5;bpZF62{S145tx3qI2<gDU#w{M>B%`fFswj5y*?-M$*o
zK7p<DI8>6D#t)yqpw(@^1c%J4Yio_rpA=;mvJ6$UXiawPyo;n9S<$NE4jeFfg~Zvv
z@=k0wbVrlCvT4QZB`K6yX^Vw199TFAleqfR(FG3}A_(H%K8MT{PXzZGm-v{ZdmmEu
zZXeckk@OI|IfNAUFt^}1({v!*EXJ!A^UG(7Pjz{wUhMC2g3S(V$#RT#uoRRFkijjK
z;Jyh$oOVJ;dwIXP7_sX&Ggoa9p8+cCx7M*hx~WQu!d^oNX|fegf__akfB13%P`R6p
z$AG5Gw`XBCg9W0sdIIsDV=Z|hS!)(j`4b1U*#sHyGpEsp?%AAl1;wT2cbO19<cG(M
z#gp=xBu8BWoM+qlLd7j19<lQb$H_GvG5y;V9vllV8aBG$^3EmNif1HTi|e*pGZOVm
zs*BZhJX)6k5@7X1$SffaAYefa-SsT&>_`=5HWX7_5B1_BOI#$*f0lcwYaIEBeMXZ2
zEL$x=%a5tc4>_9}(IZ5h((kKqT&<0;dXERUS7D+}>{Q=uimSwt6q-@A%p$uBrNe_>
z4>&J(t6(axNchJNl!A<a&m3XU)H1OC0}%zO$zuo-hqt_-@*@oDcZ5{vgq8{&Lgw+q
zBR(qlZ*=U<wz1PHRr&Nle`#1s;*v<uYQ?fbBDPJj!g8iA2R-O&N8)tsmKWyTQ*n>>
zuARArP!mHORy;kQp-g(hgRMG&?y#^>n9YjgesqChf5vjUC!xPue+Ls2=<dP>MT^<j
zU+cuRP&5)@_(WdH+RBkP^weq6T|Av^2u{gu+=-)7aV3=WMiF|bBFVA|)CmcQfYl67
zZGh(9LUC%&hIy_cYyc{@{SD3p#_iscl-3=21Y_o#c1=^wh0K|m<7nhgm2?9AN!h>d
zl|{_Rh3EGJ%sxpXDJS>18r@5BdQ?L3+GeMnMB@B)<?4y<^;O^3{6`eN5`O0HNw53&
z{9GcinP&Dv;C(CQzoHVKykg)!ayNAdOs9<=%oa)DgOFj~7T#}y{U+nNCWnoV0MD@O
z`FH7J^{_~>Z_O7t@uixG=FG6+uJi~&R1bw400S;DM$TcE1qcpxa^^_djj0HUXtR7)
zJXTjis)eIEED=z7SG1N0DV}VCSKZBaco|LjY!q1CO1Ve7YGF_S^*T*25DlWC?^o`8
zu0JQ(+h2CO5Ss@9Nb&<$40FjP?kEhAFz;_%)LapWA15k08wl_h#VIS{^H{2URF{Yq
zyAZz23Q4l_F0dLJs_|2eH1)v|9bCsB@WxMyDDtdo>)iu8Y5}^+;J2mnH)ymO681ad
zG;!h+jK(exZ*EVPEeX>dEd>0gA>iM&bg0B}cD>kr(mQuE6lDDbr6`Zp#+O)8OG8A+
zNRxowC8HJKh;nZ|q;Al5Poz<|Jnz({qz_T#tkSP9&dc=4q3{Z*6Rpp}9@C&!h8Syt
zq8T4RvUpfSVfRDhG>iCG5eoipE8I+$p4-OP+8Ew5oiOQ`N&~H}F&Z*=$-Y2Pebau4
zx7TnWnX};G84=$@QN3b(*WSptLKtEwls-zZ*H$1}PAD;y9W7BhMY>JYuE4u2WYJ)>
zJNMJLnPbtoT1|@?*9B^w2GL&Z0KboD8H)H_yAbw@uK0Y)Ism#Mgs-Pf;|IT68N|dB
zJpFI-)8y6ykWKQuyP%f^&qR7CVf&Dx3^$b6c0#lT(`>FHX0o1PJ~S?(=Fxz`(*qd@
zoU6P1YU1g%KX~ALNh-ef<C~z~&}~;*=miMq=ME_~PNVrgWXHB|gVDz*@?fFRhJ@vO
z@F_u!ct}$oQv|rtNWY3lO|GtcL1EI3b8ix_uaRRuK7LqC;~~ql3LVq1?*F)d82_E|
zGx`|bUVfhV4Ps`ev$6N<KKlrR3!iiPH<<9yjr_?8(`|qq=3GKg@?TLC^`yMM(zgS(
z1z~ng&7kynYDI71FY;4;SwEYQMat+7BFFbx5`kusJ-Lfn*HPcTH3?!W1r!$D&YH0q
zCNWo|9+6#ezMMiGwY<%{#K1v;Vu{2Rrd92c0bxS5FlF&L5gx~`p0TK%%POS>{R0d>
z3H-@Ir_7uY>Jg`Wgdg+4M_|G-n@4!kA*B<Rm+rhJc^q~ky?vH)v+w|~es=n}-I@XD
ztkKp;FFXUCep}>U6nah9zpn)!*mD0Bxce60l$EHnHO;L=K0Jj2r1q^RXe`A|N+Jh8
z;D74}ciC%R)-*&-4fRp2aQK&)sK%rn1*S1nZZWKlW;ryg*e-$C(6sw=!>nm(s+5U3
zwzqz-Q$zxo8{+)*Lc$P!3@fJyC&Q4W8>&9x4db6Bh?Uk6B}XOytSlHbw>m`bQ-F2e
zmgku=<4u{fsm(<Vo|Qm)?fDKX^N4~9Hc?GI4s18Fm`UA#ED8_}-pcedkBnIOmQFo)
z){yv)XO4JiR*n8##xQ7b;9;w5Fkst=<)UjV{?(5Lanna~Zwvq%KA4I_rnKjp!SF%b
zwAr~oKMf5eh?=?oRS{xnhjhhMHu8DQz@ap71kWak=(ARwuJ;W7I?&{BBv>GW0XY$m
zHCMFbEoisNx}04B`td$ASLfGuPnnHWuuxBM{l#|SDY}I;P?9R5#rFS`)mQhyNnkpq
z7MBL(ZbOBQfLDbz{0mMma}&{1u!0gwt)nkAkSL1!floOa4=vF1E5xlB%1cdX#v-F;
zw=k@{HmrrEEz^`UKf0m=(+nUBPEDwGlPOSDkVWg>Vq}3)2%aiui6Epo|JMM|PlR4t
zxQtbZF&El_mjNmIM{woS&rvEB*%9qznp4JKHUq{rZN;n!k-QU5SY_pG*o#yk)dU1)
z6Ec~2G!k8x=0Wn1jtM_mRIfjIR@+x@U7@6y9H~q>Dyfxlza}QzAaFHFQq^_Y11E#X
z;cE>5!#^P>LW>o%CAjIwy@^uqv+Z%MYqr?3cxuM8;^cg;f{l$J?ZmQYjUn3TzCYcY
z0~IY;kEz#Nm{cVc8F(x3+7Gu-B#~!I_);k+iDSS^3C)c2-KOgtGq-ZOSq8|FYSnV9
zcK7PnlQbdoU*W5ee8KjRgQZpY`>uT5AEn!P3``(uOXnHSF8O|^QLe@>X8DsN^wcxk
zwi8752s@JUykDu+myi{$NxQ#a2l`5Mm~xyxyALiF>~9E^PTf)EF=A<{^p)3JGS^;W
zRwaw{9^PqUPJJ*a$j?(PqzGN#9jKO;A-=s_h>x@>eR|WgesQPOGNo%xb~giMEb37f
zwsHPBX3NycWb;`p98<r|q6?9TXOa;8wIws?f$FoE)U<yqd*8zh#_xi9c-7t)46a-~
zpJ;0nBf?iW4jhJmLeD4%^G*Zk&$-xmSkS%uFdwo-PE0L3iC6M0rIvURR|D<iRSDqb
z6<4t0giT5GTvfyb8Z>;QYoA90Tk&!5>^c!`xo1vd^mM&g*>s#OpAw_kJ+WqZc!x9=
zIkQ^}ptZ#NGgMP-%Dw&tR_FAHytVf2-*maErfyV^nG~B<d2+EOGgLL!W*%3aANhP8
zvw~|NLVX3LsV!;xtQK${mc8C*ppu#=>H%YxhZ=H5^7@pKKXipvpAxWk^LGwMJ@Cv=
z^V5Gia-%>?b+~eJf;Az0Jv9j?N4>w@ck{1NZZ=9#=xMX3jcMh*_VoT<xy<{)F2&5Y
z^`v_E`J%|b{q*rF`)?-h?8go8Q|)mkuIZ=8Hg@M${BePw?;_U^4H0kO4akjA*hm@9
z_JwEVulMr8D}a6r*`<9qv<KT+%ON;b&~cyt<zGQTAQEI(fNiZ_Ia!^leyb8W<~hG!
zFIV!E0J4NA2BlFTzEy^`!EnsrA?H#yLq0!nu)e-fGt9f`TJ5yVONeFqOeGeye2yc`
z5Cb@e&84dnKhBPx*(TRKl68F6N!f77Uq^qPMRqHUi<UN^Wfy$m7<Lh^EsOShhE>rI
z+pTQR5WbEV(=S(9aXXHvzv2%!Z|Td@l`{#|{ed9%21x3w?AcmOP0sj+t(fih9v1V9
zg)D)clL)^Vczg_@Je`+`JQ3~cNb4_X@LDR#AD;6kMwwqPF>HV1nPkv-XrEdCNiLKt
zmm!2DYJOhWms)P@-*W!&9C$8_X8Kv_35pv$OWyM<FCe@7C+!^d>SBVb(=rE|YAgKy
z+e4t90oDD;V<Bs%o@++b*=2F1d)C>$2hkh=H`+xs@#b7KndhM=1Qj}?Zlx}J8>b7e
z9CXf}TZSA#LEfIGXqMfZ;W^;;F)^yEL0sw^u<x?d!3*6^+s^J=*%gqEdIQriKqDDk
zpa`Rrus#bWYBHOrVk|17sdBeSRmvtsY}5lm$gg4OpawnSEbIHiJHtvItkM;ZQJ^eu
z$c0zkfE$(opzG8k^fmCNTxf$~82}m9=$lNriE4}P*RNBnww6gP5xSj(IdU8zZpj%I
z&K@d3*ewljgfO-UBoz8%nwbLCUFsMp37K3Vdec(y69Gd4d>K01By|~Na_sxxEEXoh
z16&$UN0BLm-NpjOAi8GNRebISO06*su2wU;LQ9y5dm6rppF+w_^oZ41$lij1DaT?w
zRH+x99F;6A$JZLdUy3z|JX6$IB5IFf0#vwYr(_nZ2oy=n9(T8IGn8hR(ZD{-Ogw^Z
z?;;k9^U8S?E*qAaaD!wzymJU%HjHa|s5pST1#HGM5UX_oQ<kBOde#HBHmK_A$=q=e
zlBl(B+by&?$I#YXV*_{j`*FrVBgySXF2*V)MOW{VM)Y>t+f6&^Q17wvaJjBid)e)=
zG3VoA#!7I*QrumlDF^j?<Q8tKd+1^FkEk3&kB{CQ!xw9p*5|Ve^Nx;x3|MTmk!{#7
z=pt)Fl+(d4L+(CtOdR#x?m6)umEgSUvit8u!ghwKG%h>(dm>t3%R?7a$)lTsKc%+j
z4NTee(&fzA;z~;B8G62K<&#?1(xSAg*jp87+?a0)QJY1=+H58xL@7aUN%BVy)YuB$
zc7m@Ork2~MIvU3x_V!evpbb;J7r}ReTD^I|(Z^t8k%;y8lPQZMk(GB185?yV!q$vi
zr4tnaf9fM(IA!>Rk|TCpb9L`AHks2H4Uj>y=EjIF*Ly|LJh*eg-^GEun3^nMpz$=+
zlt?lNu4~f3N52Ys)W`mlJ}oW1Sl#Hbjh^dR4KXktj&DU2)Z0l5S&DrN5lO!AO{un;
z615rKVcyjCe-^vK`(=-!+c8#;f+OkL<xdicfFJi17)quXMW^B9?|J);HFz63>f&>p
zyFc^hM}AM0s-7BFmRr#RE4V*157mWJ*}Eb<(Vl?f8D2Rgmj`toRAFBNlS<*zpelp?
z>{G_ilbAuDlHzUX%iH)OIFLe^k85(XqrK4{cwZdH_7Er4HYS!nRh?YQa{xbdu<^n+
z*H<quuj3exVZY1_omw6WYuxQ)L-#D^_OOPQ5`=0^>0LLl!=&g2q$%xl?b*(Rkb*ht
z^R|Qs5MDUZUmchp{PZBzQDjf42JG~VwENFI@NE0oyivb$o?p=_UlYVR2slh)YpM=$
zG(nlR6qjH3=yU+s*No?>VOz!?dgN=_{CQIcH?6#dPHu6i?DKv$?m}k>+r}#PCPZ!o
zf7caH1!p?rcA4o<qv+&3G|Y6hZXRVtRJE8Q&!Q;6lJ$-=-ot$m8{gO`Y9nzGUnV?g
zda7m{mjO$^x&xc5Lbi*gBWa*Mj0I#GHkMnBuXSQEwb4aSP4AsJBo*KNzMjwZKmT+6
z0LXxXVSr$OfPlb&D5lBlQvQNk7KR1^nZX1B!Tx^xe-C3PQ$rV1RZB5bGfO*57fX9P
z1}kTKyZ_$^BTIF=TrD`rlqVSo>i@Ce_HEkM(9%xD)Yie~+tmLKhlKi1FR<@3`1^j>
I0{-3p7qmSOD*ylh

literal 0
HcmV?d00001

diff --git a/Solutions/Microsoft Defender XDR/Package/createUiDefinition.json b/Solutions/Microsoft Defender XDR/Package/createUiDefinition.json
index 24edc3ff13b..373809538ea 100644
--- a/Solutions/Microsoft Defender XDR/Package/createUiDefinition.json	
+++ b/Solutions/Microsoft Defender XDR/Package/createUiDefinition.json	
@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20XDR/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Microsoft Defender XDR](https://www.microsoft.com/security/business/threat-protection/microsoft-365-defender) solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.\n\nAdditional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on [GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender). This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 1, **Workbooks:** 3, **Analytic Rules:** 40, **Hunting Queries:** 387\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20XDR/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nWorkbook-only authoring candidate for Microsoft Defender XDR: Defender for Endpoint, Defender for Identity, and Office 365 Detections & Insights. Includes the Microsoft Defender XDR connector prerequisite for panels using connected Sentinel SecurityAlert data. Detection rules, hunting queries, playbooks, and Sentinel workbook installation are excluded. Live installation and runtime qualification are not established.\n\n**Data Connectors:** 1, **XDR Workbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -52,6126 +52,46 @@
     ],
     "steps": [
       {
-        "name": "dataconnectors",
-        "label": "Data Connectors",
-        "bladeTitle": "Data Connectors",
-        "elements": [
-          {
-            "name": "dataconnectors1-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "This Solution installs the data connector for Microsoft Defender XDR. You can get Microsoft Defender XDR custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
-            }
-          },
-          {
-            "name": "dataconnectors-link1",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "link": {
-                "label": "Learn more about connecting data sources",
-                "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
-              }
-            }
-          }
-        ]
-      },
-      {
-        "name": "workbooks",
-        "label": "Workbooks",
-        "subLabel": {
-          "preValidation": "Configure the workbooks",
-          "postValidation": "Done"
-        },
-        "bladeTitle": "Workbooks",
-        "elements": [
-          {
-            "name": "workbooks-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view."
-            }
-          },
-          {
-            "name": "workbooks-link",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "link": {
-                "label": "Learn more",
-                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
-              }
-            }
-          },
-          {
-            "name": "workbook1",
-            "type": "Microsoft.Common.Section",
-            "label": "Microsoft Defender for Office 365 Detections and Insights",
-            "elements": [
-              {
-                "name": "workbook1-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Gain extensive insight into your organization's Microsoft Defender for Office 365 protection across email and Microsoft Teams by analyzing and correlating events. \nYou can track detections and insights over time including: metrics for phish, spam, and malware, URL and URL click detection details, malicious file detections, Microsoft Teams collaboration protection (impersonation, voice phishing, and malicious URLs and files), post-delivery detections, user and admin submissions, system overrides, and actions taken by security administrators."
-                }
-              }
-            ]
-          },
-          {
-            "name": "workbook2",
-            "type": "Microsoft.Common.Section",
-            "label": "Microsoft Defender For EndPoint",
-            "elements": [
-              {
-                "name": "workbook2-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "A wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through M365 Defender Connector."
-                }
-              }
-            ]
-          },
-          {
-            "name": "workbook3",
-            "type": "Microsoft.Common.Section",
-            "label": "Microsoft Defender For Identity",
-            "elements": [
-              {
-                "name": "workbook3-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Use this workbook to analyse the advance hunting data ingested for Defender For Identity."
-                }
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "name": "analytics",
-        "label": "Analytics",
-        "subLabel": {
-          "preValidation": "Configure the analytics",
-          "postValidation": "Done"
-        },
-        "bladeTitle": "Analytics",
+        "name": "contentSelection",
+        "label": "Content selection",
         "elements": [
           {
-            "name": "analytics-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view."
-            }
-          },
-          {
-            "name": "analytics-link",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "link": {
-                "label": "Learn more",
-                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
-              }
-            }
-          },
-          {
-            "name": "analytic1",
-            "type": "Microsoft.Common.Section",
-            "label": "Possible Phishing with CSL and Network Sessions",
-            "elements": [
-              {
-                "name": "analytic1-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. \nIf your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic2",
-            "type": "Microsoft.Common.Section",
-            "label": "SUNSPOT malware hashes",
-            "elements": [
-              {
-                "name": "analytic2-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query uses Microsoft Defender for Endpoint data to look for IoCs associated with the SUNSPOT malware shared by Crowdstrike.\nMore details: \n  - https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/\n  - https://techcommunity.microsoft.com/blog/microsoftsentinelblog/monitoring-the-software-supply-chain-with-azure-sentinel/2176463/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic3",
-            "type": "Microsoft.Common.Section",
-            "label": "Potential Build Process Compromise - MDE",
-            "elements": [
-              {
-                "name": "analytic3-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process. This query uses Microsoft Defender for Endpoint telemetry.\nMore details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic4",
-            "type": "Microsoft.Common.Section",
-            "label": "TEARDROP memory-only dropper",
-            "elements": [
-              {
-                "name": "analytic4-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic5",
-            "type": "Microsoft.Common.Section",
-            "label": "SUNBURST network beacons",
-            "elements": [
-              {
-                "name": "analytic5-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies SolarWinds SUNBURST domain beacon IOCs in DeviceNetworkEvents\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic6",
-            "type": "Microsoft.Common.Section",
-            "label": "SUNBURST and SUPERNOVA backdoor hashes",
-            "elements": [
-              {
-                "name": "analytic6-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in DeviceFileEvents\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic7",
-            "type": "Microsoft.Common.Section",
-            "label": "AV detections related to Ukraine threats",
-            "elements": [
-              {
-                "name": "analytic7-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for Microsoft Defender AV detections for malware observed in relation to the war in Ukraine.\n  Ref: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ "
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic8",
-            "type": "Microsoft.Common.Section",
-            "label": "AV detections related to Tarrask malware",
-            "elements": [
-              {
-                "name": "analytic8-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for Microsoft Defender AV detections related to Tarrask malware. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged-on users etc. \n This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.\n Reference: https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic9",
-            "type": "Microsoft.Common.Section",
-            "label": "AV detections related to SpringShell Vulnerability",
-            "elements": [
-              {
-                "name": "analytic9-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for Microsoft Defender AV detections related to the SpringShell vulnerability. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device.\n  This query joins the DeviceInfo table to clearly connect other information such as device group, IP, logged-on users, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.\n  Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic10",
-            "type": "Microsoft.Common.Section",
-            "label": "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863",
-            "elements": [
-              {
-                "name": "analytic10-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks at device, process, and network events from Defender for Endpoint that may be vulnerable to buffer overflow defined in CVE-2023-4863. Results are not an indicator of malicious activity."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic11",
-            "type": "Microsoft.Common.Section",
-            "label": "Deimos Component Execution",
-            "elements": [
-              {
-                "name": "analytic11-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic12",
-            "type": "Microsoft.Common.Section",
-            "label": "Imminent Ransomware",
-            "elements": [
-              {
-                "name": "analytic12-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for a series of commands that are commonly used by attackers to disable security tools and system recovery tools before deploying Macaw ransomware in an organization."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic13",
-            "type": "Microsoft.Common.Section",
-            "label": "Java Executing cmd to run Powershell",
-            "elements": [
-              {
-                "name": "analytic13-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query was originally published in the threat analytics report, Sysrv botnet evolution.\nSysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.\nThe following query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic14",
-            "type": "Microsoft.Common.Section",
-            "label": "C2-NamedPipe",
-            "elements": [
-              {
-                "name": "analytic14-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Detects the creation of a named pipe used by known APT malware.\nReference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic15",
-            "type": "Microsoft.Common.Section",
-            "label": "DopplePaymer Procdump",
-            "elements": [
-              {
-                "name": "analytic15-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.\nDoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they use SysInternal utilities such as ProcDump to dump credentials from LSASS. They often use these stolen credentials to turn off security software, run malicious commands, and spread malware throughout an organization.\nThe following query detects ProcDump being used to dump credentials from LSASS.\nThe See also section below lists links to other queries associated with DoppelPaymer.\nReferences:\nhttps://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/DoppelPaymer.KM!MTB\nhttps://docs.microsoft.com/sysinternals/downloads/procdump\nhttps://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic16",
-            "type": "Microsoft.Common.Section",
-            "label": "LSASS Credential Dumping with Procdump",
-            "elements": [
-              {
-                "name": "analytic16-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query was originally published in the threat analytics report, \"Exchange Server zero-days exploited in the wild\".\nIn early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:\n1. CVE-2021-26855\n2. CVE-2021-26857\n3. CVE-2021-26858\n4. CVE-2021-27065\nThe following query looks for evidence of Procdump being used to dump credentials from LSASS, the Local Security Authentication Server. This might indicate an attacker has compromised user accounts.\nMore queries related to this threat can be found under the See also section of this page.\nReference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic17",
-            "type": "Microsoft.Common.Section",
-            "label": "Doppelpaymer Stop Services",
-            "elements": [
-              {
-                "name": "analytic17-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.\nDoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization.\nThe following query detects attempts to stop security services.\nThe See also section below lists links to other queries associated with DoppelPaymer.\nReferences:\nhttps://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/DoppelPaymer.KM!MTB"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic18",
-            "type": "Microsoft.Common.Section",
-            "label": "Qakbot Campaign Self Deletion",
-            "elements": [
-              {
-                "name": "analytic18-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware\nQakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.\nThe following query detects if an instance of Qakbot has attempted to overwrite its original binary.\nReference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic19",
-            "type": "Microsoft.Common.Section",
-            "label": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
-            "elements": [
-              {
-                "name": "analytic19-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll.\nJoins the data to public network events.\nReferences:\nhttps://threathunt.blog/running-live-malware-for-threat-hunting-purposes/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic20",
-            "type": "Microsoft.Common.Section",
-            "label": "Regsvr32 Rundll32 with Anomalous Parent Process",
-            "elements": [
-              {
-                "name": "analytic20-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This analytical rule looks for rundll32.exe or regsvr32.exe being spawned by abnormal processes: wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe.\nBlog: https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic21",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Suspicious Commands Initiated by Webserver Processes",
-            "elements": [
-              {
-                "name": "analytic21-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query was originally published in the threat analytics report, Operation Soft Cell.\nOperation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.\nOperation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.\nReference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic22",
-            "type": "Microsoft.Common.Section",
-            "label": "Bitsadmin Activity",
-            "elements": [
-              {
-                "name": "analytic22-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. \nThis service is commonly used for legitimate purposes, but can also be used as part of a malware downloader. \nAdditionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This\nquery will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer\ndirectionality."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic23",
-            "type": "Microsoft.Common.Section",
-            "label": "Office Apps Launching Wscipt",
-            "elements": [
-              {
-                "name": "analytic23-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated.\nTrickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command-and-control (C2) operations.\nTrickbot is frequently spread through email. An attacker will send a target a message with an attachment containing a malicious macro. If the target enables the macro, it will write a JScript Encoded (JSE) file to disk (JScript is a Microsoft dialect of ECMAScript). The JSE file will then be launched using wscript.exe to perform a variety of malicious tasks, particularly reconnaissance.\nThe following query detects when Office applications have launched wscript.exe to run a JSE file.\nSee Detect rundll.exe being used for reconnaissance and command-and-control for another query related to Trickbot activity.\nReference - https://attack.mitre.org/software/S0266/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic24",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Potential Kerberoast Activities",
-            "elements": [
-              {
-                "name": "analytic24-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query aim to detect if someone requests service tickets (where count => maxcount)\nThe query requires trimming to set a baseline level for MaxCount  \nMitre Technique: Kerberoasting (T1558.003)\n@MattiasBorg82"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic25",
-            "type": "Microsoft.Common.Section",
-            "label": "Files Copied to USB Drives",
-            "elements": [
-              {
-                "name": "analytic25-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic26",
-            "type": "Microsoft.Common.Section",
-            "label": "MosaicLoader",
-            "elements": [
-              {
-                "name": "analytic26-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic27",
-            "type": "Microsoft.Common.Section",
-            "label": "Unusual Volume of file deletion by users",
-            "elements": [
-              {
-                "name": "analytic27-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here.\nThis applies to SharePoint and OneDrive users.\nAudit event and Cloud application identifier references.\nReference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-activities?view=o365-worldwide\nReference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic28",
-            "type": "Microsoft.Common.Section",
-            "label": "Remote File Creation with PsExec",
-            "elements": [
-              {
-                "name": "analytic28-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog.\nRyuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.\nRyuk operators use PsExec to manually spread the ransomware to other devices.\nThe following query detects remote file creation events that might indicate an active attack.\nThe See also section below lists links to other queries associated with Ryuk ransomware.\nReferences:\nhttps://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk.AA\nhttps://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/\nhttps://docs.microsoft.com/sysinternals/downloads/psexec"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic29",
-            "type": "Microsoft.Common.Section",
-            "label": "Service Accounts Performing Remote PS",
-            "elements": [
-              {
-                "name": "analytic29-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Service Accounts Performing Remote PowerShell.\nThe purpose behind this detection is for finding service accounts that are performing remote powershell sessions.\nThere are two phases to the detection: Identify service accounts, Find remote PS cmdlets being ran by these accounts.\nTo accomplish this, we utilize DeviceLogonEvents and DeviceEvents to find cmdlets ran that meet the criteria.\nOne of the main advantages of this method is that only requires server telemetry, and not the attacking client.\nThe first phase relies on the DeviceLogonEvents to determine whether an account is a service account or not, consider the following accounts with logons:.\nRandom_user has DeviceLogonEvents with type 2, 3, 7, 10, 11 & 13.\nRandom_service_account 'should' only have DeviceLogonEvents with type 3,4 or 5."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic30",
-            "type": "Microsoft.Common.Section",
-            "label": "Account Creation",
-            "elements": [
-              {
-                "name": "analytic30-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "User accounts may be created to achieve persistence on a machine.\nRead more here: https://attack.mitre.org/wiki/Technique/T1136.\nTags: #CreateAccount.\nQuery #1: Query for users being created using \"net user\" command.\n\"net user\" commands are noisy, so needs to be joined with another signal -.\nE.g. in this example we look for use of uncommon & undocumented commandline switches (e.g. /ad instead of /add)."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic31",
-            "type": "Microsoft.Common.Section",
-            "label": "Local Admin Group Changes",
-            "elements": [
-              {
-                "name": "analytic31-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for changes to the local administrators group.\nBlogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic32",
-            "type": "Microsoft.Common.Section",
-            "label": "Rare Process as a Service",
-            "elements": [
-              {
-                "name": "analytic32-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query is looking for rarely seen processes which are launched as a service. Whiltelisted process list need to be updated based on the environment.\nAuthor: Jouni Mikkola\nMore info: https://threathunt.blog/rare-process-launch-as-a-service/"
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic33",
-            "type": "Microsoft.Common.Section",
-            "label": "Disabling Security Services via Registry",
-            "elements": [
-              {
-                "name": "analytic33-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for processes modifying the registry to disable security features. This is a common technique used by threat actors for defence evasion."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic34",
-            "type": "Microsoft.Common.Section",
-            "label": "Deletion of data on multiple drives using cipher exe",
-            "elements": [
-              {
-                "name": "analytic34-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic35",
-            "type": "Microsoft.Common.Section",
-            "label": "LaZagne Credential Theft",
-            "elements": [
-              {
-                "name": "analytic35-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "LaZagne is a popular open-source tool used to recover passwords stored on a local computer. It has been used in ransomware attacks to steal credentials and escalate privileges. This query looks for the execution of LaZagne."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic36",
-            "type": "Microsoft.Common.Section",
-            "label": "Clearing of forensic evidence from event logs using wevtutil",
-            "elements": [
-              {
-                "name": "analytic36-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. Clearing event logs can be a sign of ransomware activity, as ransomware often attempts to cover its tracks by deleting logs."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic37",
-            "type": "Microsoft.Common.Section",
-            "label": "Stopping multiple processes using taskkill",
-            "elements": [
-              {
-                "name": "analytic37-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. This is a common technique used by ransomware to stop security products and other processes."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic38",
-            "type": "Microsoft.Common.Section",
-            "label": "Potential Ransomware activity related to Cobalt Strike",
-            "elements": [
-              {
-                "name": "analytic38-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns. It looks for alerts that indicate potential ransomware activity, such as attempts to clear security event logs, delete backup files, and execute Cobalt Strike malware."
-                }
-              }
-            ]
-          },
-          {
-            "name": "analytic39",
-            "type": "Microsoft.Common.Section",
-            "label": "Qakbot Discovery Activies",
-            "elements": [
-              {
-                "name": "analytic39-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. It looks for discovery commands such as net.exe, whoami.exe, nslookup.exe, netstat.exe, arp.exe, and ping.exe."
-                }
-              }
-            ]
+            "name": "DeployDefenderWorkbook",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployDefenderWorkbook",
+            "defaultValue": false,
+            "toolTip": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification."
           },
           {
-            "name": "analytic40",
-            "type": "Microsoft.Common.Section",
-            "label": "Shadow Copy Deletions",
-            "elements": [
-              {
-                "name": "analytic40-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors.\nThis query detects know commands that have been used by the ransomware actors.\nSome information from Mitre Attack: \nhttps://attack.mitre.org/techniques/T1490/"
-                }
-              }
-            ]
+            "name": "DeployDataConnector",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployDataConnector",
+            "defaultValue": true,
+            "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
           }
         ]
       },
       {
-        "name": "huntingqueries",
-        "label": "Hunting Queries",
-        "bladeTitle": "Hunting Queries",
+        "name": "dataconnectors",
+        "label": "Data Connectors",
+        "bladeTitle": "Data Connectors",
         "elements": [
           {
-            "name": "huntingqueries-text",
+            "name": "dataconnectors1-text",
             "type": "Microsoft.Common.TextBlock",
             "options": {
-              "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. "
+              "text": "This Solution installs the data connector for Microsoft Defender XDR. You can get Microsoft Defender XDR custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
             }
           },
           {
-            "name": "huntingqueries-link",
+            "name": "dataconnectors-link1",
             "type": "Microsoft.Common.TextBlock",
             "options": {
               "link": {
-                "label": "Learn more",
-                "uri": "https://docs.microsoft.com/azure/sentinel/hunting"
+                "label": "Learn more about connecting data sources",
+                "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
               }
             }
-          },
-          {
-            "name": "huntingquery1",
-            "type": "Microsoft.Common.Section",
-            "label": "Appspot Phishing Abuse",
-            "elements": [
-              {
-                "name": "huntingquery1-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps surface phishing campaigns associated with Appspot abuse.These emails frequently contain phishing links that utilize the recipients' own email address as a unique identifier in the URI.\nThis campaign was published on Twitter by @MsftSecIntel at this link: https://twitter.com/MsftSecIntel/status/1374148156301004800\nReference - https://twitter.com/MsftSecIntel/status/1374148156301004800 This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery2",
-            "type": "Microsoft.Common.Section",
-            "label": "Dropping Payload via certutil",
-            "elements": [
-              {
-                "name": "huntingquery2-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "BazaCall campaign tricks users into calling a fake customer support center, and download a malicious Excel file which contains a macro to infect users' device with BazaLoader. This query searches for a copy of certutil.exe used by the macro. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery3",
-            "type": "Microsoft.Common.Section",
-            "label": "Judgement Panda Exfil Activity",
-            "elements": [
-              {
-                "name": "huntingquery3-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml.\nQuestions via Twitter: @janvonkirchheim. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery4",
-            "type": "Microsoft.Common.Section",
-            "label": "Deimos Component Execution",
-            "elements": [
-              {
-                "name": "huntingquery4-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising. This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery5",
-            "type": "Microsoft.Common.Section",
-            "label": "LemonDuck Registration Function",
-            "elements": [
-              {
-                "name": "huntingquery5-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "LemonDuck is a malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery6",
-            "type": "Microsoft.Common.Section",
-            "label": "Devices with Log4j vulnerability alerts and additional other alert related context",
-            "elements": [
-              {
-                "name": "huntingquery6-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J. This hunting query depends on MicrosoftThreatProtection data connector (AlertInfo AlertEvidence Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery7",
-            "type": "Microsoft.Common.Section",
-            "label": "Alerts Related to Log4j Vulnerability",
-            "elements": [
-              {
-                "name": "huntingquery7-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Microsoft has observed attackers exploiting vulnerabilities associated with Log4J. This hunting query depends on MicrosoftThreatProtection data connector (AlertInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery8",
-            "type": "Microsoft.Common.Section",
-            "label": "Imminent Ransomware",
-            "elements": [
-              {
-                "name": "huntingquery8-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Before deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery9",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious Use of MSBuild as LOLBin",
-            "elements": [
-              {
-                "name": "huntingquery9-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery10",
-            "type": "Microsoft.Common.Section",
-            "label": "Qakbot Reconnaissance Activities",
-            "elements": [
-              {
-                "name": "huntingquery10-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for reconnaissance and beaconing activities after code injection occurs in Qakbot infections. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery11",
-            "type": "Microsoft.Common.Section",
-            "label": "Robbinhood Driver",
-            "elements": [
-              {
-                "name": "huntingquery11-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query detects the presence of the Robbinhood ransomware driver. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery12",
-            "type": "Microsoft.Common.Section",
-            "label": "Snip3 Malicious Network Connectivity",
-            "elements": [
-              {
-                "name": "huntingquery12-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query looks for potentially hollowed processes that may be used to facilitate command-and-control or exfiltration by Snip3 malware. This hunting query depends on MicrosoftThreatProtection data connector (DeviceNetworkEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery13",
-            "type": "Microsoft.Common.Section",
-            "label": "Java Executing cmd to run Powershell",
-            "elements": [
-              {
-                "name": "huntingquery13-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery14",
-            "type": "Microsoft.Common.Section",
-            "label": "Spoofing attempts from Specific Domains",
-            "elements": [
-              {
-                "name": "huntingquery14-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query identifies potential phishing or spoofing attempts originating from specific domains with authentication failures. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery15",
-            "type": "Microsoft.Common.Section",
-            "label": "C2-NamedPipe",
-            "elements": [
-              {
-                "name": "huntingquery15-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Detects the creation of a named pipe used by known APT malware.\nReference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery16",
-            "type": "Microsoft.Common.Section",
-            "label": "Recon with Rundll",
-            "elements": [
-              {
-                "name": "huntingquery16-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query detects suspicious rundll.exe activity associated with Trickbot campaigns. This hunting query depends on MicrosoftThreatProtection data connector (DeviceNetworkEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery17",
-            "type": "Microsoft.Common.Section",
-            "label": "DopplePaymer Procdump",
-            "elements": [
-              {
-                "name": "huntingquery17-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Detects the use of ProcDump to dump credentials from LSASS memory by DoppelPaymer ransomware operators. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery18",
-            "type": "Microsoft.Common.Section",
-            "label": "Credential Harvesting Using LaZagne",
-            "elements": [
-              {
-                "name": "huntingquery18-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Detects the use of LaZagne to steal credentials from the SAM database by Ryuk ransomware operators. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery19",
-            "type": "Microsoft.Common.Section",
-            "label": "LSASS Credential Dumping with Procdump",
-            "elements": [
-              {
-                "name": "huntingquery19-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Detects the use of Procdump to dump credentials from LSASS memory. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery20",
-            "type": "Microsoft.Common.Section",
-            "label": "Clear System Logs",
-            "elements": [
-              {
-                "name": "huntingquery20-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query searches for attempts to use fsutil.exe to clear system logs and delete forensic artifacts. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery21",
-            "type": "Microsoft.Common.Section",
-            "label": "Doppelpaymer Stop Services",
-            "elements": [
-              {
-                "name": "huntingquery21-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for attempts to stop security services, which is a common tactic used by DoppelPaymer ransomware operators. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery22",
-            "type": "Microsoft.Common.Section",
-            "label": "Qakbot Campaign Self Deletion",
-            "elements": [
-              {
-                "name": "huntingquery22-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query detects if an instance of Qakbot has attempted to overwrite its original binary. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery23",
-            "type": "Microsoft.Common.Section",
-            "label": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
-            "elements": [
-              {
-                "name": "huntingquery23-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceNetworkEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery24",
-            "type": "Microsoft.Common.Section",
-            "label": "Regsvr32 Rundll32 with Anomalous Parent Process",
-            "elements": [
-              {
-                "name": "huntingquery24-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for rundll32.exe or regsvr32.exe being spawned by abnormal processes such as wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceNetworkEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery25",
-            "type": "Microsoft.Common.Section",
-            "label": "Determine Successfully Delivered Phishing Emails by top IP Addresses",
-            "elements": [
-              {
-                "name": "huntingquery25-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query identifies phishing emails sent that were successfully delivered, by top IP addressess. cutoff default value is 5, adjust the value as needed. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery26",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Suspicious Commands Initiated by Webserver Processes",
-            "elements": [
-              {
-                "name": "huntingquery26-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Detect suspicious commands initiated by web server processes used for network discovery and user/owner discovery. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery27",
-            "type": "Microsoft.Common.Section",
-            "label": "Enumeration of Users & Groups for Lateral Movement",
-            "elements": [
-              {
-                "name": "huntingquery27-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query hunts for attempts to list users or groups using Net commands, which are commonly used for lateral movement. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery28",
-            "type": "Microsoft.Common.Section",
-            "label": "ATP policy status check",
-            "elements": [
-              {
-                "name": "huntingquery28-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery29",
-            "type": "Microsoft.Common.Section",
-            "label": "JNLP-File-Attachment",
-            "elements": [
-              {
-                "name": "huntingquery29-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "JNLP file extensions are an uncommon file type often used to deliver malware. This hunting query depends on MicrosoftThreatProtection data connector (EmailAttachmentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery30",
-            "type": "Microsoft.Common.Section",
-            "label": "Safe Attachments detections",
-            "elements": [
-              {
-                "name": "huntingquery30-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query provides insights on the detections done by Safe Attachment detections This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery31",
-            "type": "Microsoft.Common.Section",
-            "label": "Authentication failures by time and authentication type",
-            "elements": [
-              {
-                "name": "huntingquery31-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery32",
-            "type": "Microsoft.Common.Section",
-            "label": "CompAuth Failure Trend",
-            "elements": [
-              {
-                "name": "huntingquery32-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spoof - Composite Authentication fails summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery33",
-            "type": "Microsoft.Common.Section",
-            "label": "DKIM Failure Trend",
-            "elements": [
-              {
-                "name": "huntingquery33-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spoof - DKIM fails summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery34",
-            "type": "Microsoft.Common.Section",
-            "label": "DMARC Failure Trend",
-            "elements": [
-              {
-                "name": "huntingquery34-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spoof - DMARC fails summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery35",
-            "type": "Microsoft.Common.Section",
-            "label": "SPF Failure Trend",
-            "elements": [
-              {
-                "name": "huntingquery35-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spoof - SPF fails summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery36",
-            "type": "Microsoft.Common.Section",
-            "label": "Spoof attempts with auth failure",
-            "elements": [
-              {
-                "name": "huntingquery36-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps in checking for spoofing attempts on the domain with Authentication failures This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery37",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Spoof external domain detections by Sender domain (P1/P2)",
-            "elements": [
-              {
-                "name": "huntingquery37-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery38",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Spoof DMARC detections by Sender domain (P1/P2)",
-            "elements": [
-              {
-                "name": "huntingquery38-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery39",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Spoof intra-org detections by Sender domain (P1/P2)",
-            "elements": [
-              {
-                "name": "huntingquery39-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery40",
-            "type": "Microsoft.Common.Section",
-            "label": "Message from an Accepted Domain with DMARC TempError",
-            "elements": [
-              {
-                "name": "huntingquery40-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery41",
-            "type": "Microsoft.Common.Section",
-            "label": "Message with URL listed on OpenPhish delivered into Inbox",
-            "elements": [
-              {
-                "name": "huntingquery41-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email with a URL from OpenPhish was delivered to Inbox This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery42",
-            "type": "Microsoft.Common.Section",
-            "label": "Potential OAuth phishing email delivered into Inbox",
-            "elements": [
-              {
-                "name": "huntingquery42-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious OAuth app URL has been delivered into an Inbox. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery43",
-            "type": "Microsoft.Common.Section",
-            "label": "Potentially malicious svg file delivered to Inbox",
-            "elements": [
-              {
-                "name": "huntingquery43-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailAttachmentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery44",
-            "type": "Microsoft.Common.Section",
-            "label": "Audit Email Preview-Download action",
-            "elements": [
-              {
-                "name": "huntingquery44-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery45",
-            "type": "Microsoft.Common.Section",
-            "label": "Bad email percentage of Inbound emails",
-            "elements": [
-              {
-                "name": "huntingquery45-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery46",
-            "type": "Microsoft.Common.Section",
-            "label": "Calculate overall MDO efficacy",
-            "elements": [
-              {
-                "name": "huntingquery46-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery47",
-            "type": "Microsoft.Common.Section",
-            "label": "Email sender IP address Geo location information",
-            "elements": [
-              {
-                "name": "huntingquery47-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps getting GeoIP information of emails SenderIPv4 addresses. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery48",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for Admin email access",
-            "elements": [
-              {
-                "name": "huntingquery48-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps report on email access by administrators This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery49",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for TABL changes",
-            "elements": [
-              {
-                "name": "huntingquery49-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery50",
-            "type": "Microsoft.Common.Section",
-            "label": "Local time to UTC time conversion",
-            "elements": [
-              {
-                "name": "huntingquery50-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Advanced Hunting has default timezone as UTC time. Filters in Advanced Hunting also work in UTC by default whereas query results are shown in local time if user has selected local time zone in security center settings. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery51",
-            "type": "Microsoft.Common.Section",
-            "label": "Mail item accessed",
-            "elements": [
-              {
-                "name": "huntingquery51-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing emails accessed by end users using cloud app events data This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery52",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious email senders",
-            "elements": [
-              {
-                "name": "huntingquery52-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for emails from a sender with at least one email in quarantine This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery53",
-            "type": "Microsoft.Common.Section",
-            "label": "MDO daily detection summary report",
-            "elements": [
-              {
-                "name": "huntingquery53-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents AlertEvidence EmailEvents EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery54",
-            "type": "Microsoft.Common.Section",
-            "label": "New TABL Items",
-            "elements": [
-              {
-                "name": "huntingquery54-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps identifying when new items being added to the Tenant/Allow Block List (TABL) in Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery55",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)",
-            "elements": [
-              {
-                "name": "huntingquery55-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies the top 10 sender domains delivering inbound emails classified as malware, phishing, or spam.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery56",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 External Senders (Malware)",
-            "elements": [
-              {
-                "name": "huntingquery56-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies the top 10 external sender addresses delivering inbound emails classified as malware.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the malware filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery57",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 External Senders (Phish)",
-            "elements": [
-              {
-                "name": "huntingquery57-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies the top 10 external sender addresses delivering inbound emails classified as phishing.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the phishing filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery58",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 External Senders (Spam)",
-            "elements": [
-              {
-                "name": "huntingquery58-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies the top 10 external sender addresses delivering inbound emails classified as spam.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery59",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 External Senders (Spam)",
-            "elements": [
-              {
-                "name": "huntingquery59-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies the top 10 external sender addresses delivering inbound emails classified as spam.\nTo exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery60",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Targeted Users (Malware+Phish+Spam)",
-            "elements": [
-              {
-                "name": "huntingquery60-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies the top 10 users receiving inbound emails classified as malware, phishing, or spam.\nBased on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery61",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)",
-            "elements": [
-              {
-                "name": "huntingquery61-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Visualises the top 10 users with click attempts on URLs in emails detected as malware, phishing, or spam, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery62",
-            "type": "Microsoft.Common.Section",
-            "label": "MDO Threat Protection Detections trend over time",
-            "elements": [
-              {
-                "name": "huntingquery62-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Graph of MDO detections trended over time This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery63",
-            "type": "Microsoft.Common.Section",
-            "label": "Total number of detections by MDO",
-            "elements": [
-              {
-                "name": "huntingquery63-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Provides a summary of total number of detections This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery64",
-            "type": "Microsoft.Common.Section",
-            "label": "Automated email notifications and suspicious sign-in activity",
-            "elements": [
-              {
-                "name": "huntingquery64-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for Automated email notifications and suspicious sign-in activity This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents AADSignInEventsBeta Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery65",
-            "type": "Microsoft.Common.Section",
-            "label": "BEC - File sharing tactics - Dropbox",
-            "elements": [
-              {
-                "name": "huntingquery65-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for BEC - File sharing tactics - Dropbox This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery66",
-            "type": "Microsoft.Common.Section",
-            "label": "BEC - File sharing tactics - OneDrive or SharePoint",
-            "elements": [
-              {
-                "name": "huntingquery66-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery67",
-            "type": "Microsoft.Common.Section",
-            "label": "Email bombing attacks",
-            "elements": [
-              {
-                "name": "huntingquery67-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing recipients who are potentially victim of email bombing attacks This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery68",
-            "type": "Microsoft.Common.Section",
-            "label": "Emails containing links to IP addresses",
-            "elements": [
-              {
-                "name": "huntingquery68-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for Emails containing links to IP addresses This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery69",
-            "type": "Microsoft.Common.Section",
-            "label": "Files share contents and suspicious sign-in activity",
-            "elements": [
-              {
-                "name": "huntingquery69-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for Files share contents and suspicious sign-in activity This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents AADSignInEventsBeta Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery70",
-            "type": "Microsoft.Common.Section",
-            "label": "Good emails from senders with bad patterns",
-            "elements": [
-              {
-                "name": "huntingquery70-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for good emails from senders with bad patterns This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery71",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for email bombing attacks",
-            "elements": [
-              {
-                "name": "huntingquery71-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps to hunt for possible email bombing attacks in Microsoft Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery72",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for email conversation take over attempts",
-            "elements": [
-              {
-                "name": "huntingquery72-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for email conversation take over attempts This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery73",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for malicious attachments using external IOC source",
-            "elements": [
-              {
-                "name": "huntingquery73-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source This hunting query depends on MicrosoftThreatProtection data connector (EmailAttachmentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery74",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for malicious URLs using external IOC source",
-            "elements": [
-              {
-                "name": "huntingquery74-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for emails with malicious URLs based on external IOC source This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery75",
-            "type": "Microsoft.Common.Section",
-            "label": "Inbox rule changes which forward-redirect email",
-            "elements": [
-              {
-                "name": "huntingquery75-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for Inbox rule changes which forward-redirect email This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery76",
-            "type": "Microsoft.Common.Section",
-            "label": "MDO_CountOfRecipientsEmailaddressbySubject",
-            "elements": [
-              {
-                "name": "huntingquery76-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Count of recipient's email addresses by subject This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery77",
-            "type": "Microsoft.Common.Section",
-            "label": "MDO_Countofrecipientsemailaddressesbysubject",
-            "elements": [
-              {
-                "name": "huntingquery77-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Count of recipient's email addresses by subject This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery78",
-            "type": "Microsoft.Common.Section",
-            "label": "MDO_CountOfSendersEmailaddressbySubject",
-            "elements": [
-              {
-                "name": "huntingquery78-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Count of sender's email addresses by subject This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery79",
-            "type": "Microsoft.Common.Section",
-            "label": "MDO_SummaryOfSenders",
-            "elements": [
-              {
-                "name": "huntingquery79-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Count of all Senders and where they were delivered This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery80",
-            "type": "Microsoft.Common.Section",
-            "label": "MDO_URLClickedinEmail",
-            "elements": [
-              {
-                "name": "huntingquery80-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "URLs clicked in Email This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery81",
-            "type": "Microsoft.Common.Section",
-            "label": "Top outbound recipient domains sending inbound emails with threats",
-            "elements": [
-              {
-                "name": "huntingquery81-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for top outbound recipient domains which are sending inbound emails with threats This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery82",
-            "type": "Microsoft.Common.Section",
-            "label": "Detections by detection methods",
-            "elements": [
-              {
-                "name": "huntingquery82-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing malicious email detections by detection methods This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery83",
-            "type": "Microsoft.Common.Section",
-            "label": "Mail reply to new domain",
-            "elements": [
-              {
-                "name": "huntingquery83-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery84",
-            "type": "Microsoft.Common.Section",
-            "label": "Mailflow by directionality",
-            "elements": [
-              {
-                "name": "huntingquery84-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing inbound / outbound / intra-org emails by domain per day This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery85",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious emails detected per day",
-            "elements": [
-              {
-                "name": "huntingquery85-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing Malware, Phishing, Spam emails caught per day This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery86",
-            "type": "Microsoft.Common.Section",
-            "label": "Sender recipient contact establishment",
-            "elements": [
-              {
-                "name": "huntingquery86-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps in checking the sender-recipient contact establishment status This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery87",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam Detections (High) by delivery location",
-            "elements": [
-              {
-                "name": "huntingquery87-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails with Spam detections (High confidence) summarizing the data by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery88",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam Detections (Normal) by delivery location",
-            "elements": [
-              {
-                "name": "huntingquery88-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery89",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 100 malicious email senders",
-            "elements": [
-              {
-                "name": "huntingquery89-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing top 100 malicious senders This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery90",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 100 senders",
-            "elements": [
-              {
-                "name": "huntingquery90-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing top 100 senders in your organization in last 30 days This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery91",
-            "type": "Microsoft.Common.Section",
-            "label": "Zero day threats",
-            "elements": [
-              {
-                "name": "huntingquery91-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing zero day threats via URL and file detonations This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery92",
-            "type": "Microsoft.Common.Section",
-            "label": "Email containing malware accessed on a unmanaged device",
-            "elements": [
-              {
-                "name": "huntingquery92-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we are looking for emails containing malware accessed on a unmanaged device This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents CloudAppEvents AADSignInEventsBeta Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery93",
-            "type": "Microsoft.Common.Section",
-            "label": "Email containing malware sent by an internal sender",
-            "elements": [
-              {
-                "name": "huntingquery93-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we are looking for emails containing malware attachment sent by an internal sender This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery94",
-            "type": "Microsoft.Common.Section",
-            "label": "Email malware detection report",
-            "elements": [
-              {
-                "name": "huntingquery94-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing email malware detection cases This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailAttachmentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery95",
-            "type": "Microsoft.Common.Section",
-            "label": "File Malware Detection Trend",
-            "elements": [
-              {
-                "name": "huntingquery95-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery96",
-            "type": "Microsoft.Common.Section",
-            "label": "File Malware by Top Malware Families (Anti Virus)",
-            "elements": [
-              {
-                "name": "huntingquery96-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery97",
-            "type": "Microsoft.Common.Section",
-            "label": "File Malware by Top Malware Families (Safe Attachments)",
-            "elements": [
-              {
-                "name": "huntingquery97-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations) This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery98",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery98-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Malware detections over time summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery99",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware Detections by delivery location",
-            "elements": [
-              {
-                "name": "huntingquery99-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery100",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware Detections by Detection technology Trend",
-            "elements": [
-              {
-                "name": "huntingquery100-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery101",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware Detections by Detection technology",
-            "elements": [
-              {
-                "name": "huntingquery101-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery102",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware detections by Workload Locations",
-            "elements": [
-              {
-                "name": "huntingquery102-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery103",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware detections by Workload Type",
-            "elements": [
-              {
-                "name": "huntingquery103-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery104",
-            "type": "Microsoft.Common.Section",
-            "label": "Email Top Domains sending Malware",
-            "elements": [
-              {
-                "name": "huntingquery104-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery105",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Malware Families",
-            "elements": [
-              {
-                "name": "huntingquery105-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery106",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Users receiving Malware",
-            "elements": [
-              {
-                "name": "huntingquery106-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery107",
-            "type": "Microsoft.Common.Section",
-            "label": "Zero-day Malware Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery107-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery108",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams communication from suspicious external users",
-            "elements": [
-              {
-                "name": "huntingquery108-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for communication from suspicious external users. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery109",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams communication to suspicious external users",
-            "elements": [
-              {
-                "name": "huntingquery109-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for communication with suspicious external users. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery110",
-            "type": "Microsoft.Common.Section",
-            "label": "Expanding recipients into separate rows",
-            "elements": [
-              {
-                "name": "huntingquery110-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for recipients of Teams messages. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery111",
-            "type": "Microsoft.Common.Section",
-            "label": "External malicious Teams messages sent from internal senders",
-            "elements": [
-              {
-                "name": "huntingquery111-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for external malicious Teams messages sent from internal senders This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery112",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for malicious messages using External Threat Intelligence",
-            "elements": [
-              {
-                "name": "huntingquery112-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source This hunting query depends on MicrosoftThreatProtection data connector (MessageUrlInfo MessageEvents UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery113",
-            "type": "Microsoft.Common.Section",
-            "label": "Inbound Teams messages by sender domains",
-            "elements": [
-              {
-                "name": "huntingquery113-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing volume of inbound external Teams message by sender domains This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery114",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious Teams messages by URL detection methods",
-            "elements": [
-              {
-                "name": "huntingquery114-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing malicious Teams message detections by URL detection methods This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery115",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious Teams messages received from external senders",
-            "elements": [
-              {
-                "name": "huntingquery115-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for malicious Teams messages received from external senders. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery116",
-            "type": "Microsoft.Common.Section",
-            "label": "Microsoft Teams chat initiated by a suspicious external user",
-            "elements": [
-              {
-                "name": "huntingquery116-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages. This hunting query depends on MicrosoftThreatProtection data connector (AlertInfo AlertEvidence Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery117",
-            "type": "Microsoft.Common.Section",
-            "label": "Number of unique accounts performing Teams message Admin submissions",
-            "elements": [
-              {
-                "name": "huntingquery117-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises number of unqiue accounts performing Teams message admin submissions as false negatives or false positives This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery118",
-            "type": "Microsoft.Common.Section",
-            "label": "Number of unique accounts performing Teams message User  submissions",
-            "elements": [
-              {
-                "name": "huntingquery118-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises number of unqiue accounts performing Teams message user submissions as false negatives or false positives This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery119",
-            "type": "Microsoft.Common.Section",
-            "label": "Possible partner impersonation in external Team messages",
-            "elements": [
-              {
-                "name": "huntingquery119-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery120",
-            "type": "Microsoft.Common.Section",
-            "label": "Possible Teams phishing activity",
-            "elements": [
-              {
-                "name": "huntingquery120-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for possible Teams phishing activity. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery121",
-            "type": "Microsoft.Common.Section",
-            "label": "Potentially malicious URL click in Teams",
-            "elements": [
-              {
-                "name": "huntingquery121-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query provides insights on a potentially malicious URL click in Teams This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents MessageUrlInfo UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery122",
-            "type": "Microsoft.Common.Section",
-            "label": "Rare Domains in External Teams Messages",
-            "elements": [
-              {
-                "name": "huntingquery122-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Detects rare domains (seen in fewer than 3 Teams messages) appearing in external Microsoft Teams threads within the last 24 hours. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents MessageUrlInfo UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery123",
-            "type": "Microsoft.Common.Section",
-            "label": "Suspicious Teams Display Name",
-            "elements": [
-              {
-                "name": "huntingquery123-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for Teams messages from an external user with a suspicious display name. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery124",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams Admin submission of Malware and Phish daily trend",
-            "elements": [
-              {
-                "name": "huntingquery124-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of admin false negative Teams message submissions by submission type of Phish or Malware This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery125",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams Admin submission of No Threats daily trend",
-            "elements": [
-              {
-                "name": "huntingquery125-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of admin false positive Teams message submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery126",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams Admin-User Submissions Grading Verdicts",
-            "elements": [
-              {
-                "name": "huntingquery126-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualizes Teams messages submitted by users or admins then graded in the submission process. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery127",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams blocked URL clicks daily trend",
-            "elements": [
-              {
-                "name": "huntingquery127-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery128",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams Malware ZAP",
-            "elements": [
-              {
-                "name": "huntingquery128-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for Teams messages with Malware threats that have been ZAPed. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery129",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams Message with URL listed on OpenPhish",
-            "elements": [
-              {
-                "name": "huntingquery129-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish was delivered. This hunting query depends on MicrosoftThreatProtection data connector (MessageUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery130",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams message ZAPed with the same URL in Email",
-            "elements": [
-              {
-                "name": "huntingquery130-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for Teams messages that have been ZAPed with the same URL in Email. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents MessageUrlInfo EmailUrlInfo EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery131",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams messages from a specific sender by ThreadType",
-            "elements": [
-              {
-                "name": "huntingquery131-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for Teams messages from a specific sender by ThreadType. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery132",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams messages with suspicious URL domains",
-            "elements": [
-              {
-                "name": "huntingquery132-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for Teams messages with suspicious URL domains. This hunting query depends on MicrosoftThreatProtection data connector (MessageUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery133",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams Phish ZAP",
-            "elements": [
-              {
-                "name": "huntingquery133-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for Teams messages with Phish threats that have been ZAPed. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery134",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams post delivery events daily trend",
-            "elements": [
-              {
-                "name": "huntingquery134-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualizes the daily amount of post delivery events on Teams messages. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery135",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams Spam ZAP",
-            "elements": [
-              {
-                "name": "huntingquery135-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for Teams messages with Spam threats that have been ZAPed. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery136",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams URL clicks actions summarized by URLs clicked on",
-            "elements": [
-              {
-                "name": "huntingquery136-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery137",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs",
-            "elements": [
-              {
-                "name": "huntingquery137-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery138",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams User submissions daily trend",
-            "elements": [
-              {
-                "name": "huntingquery138-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of user false negative and false postive Teams message submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery139",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams users clicking on suspicious URL domains",
-            "elements": [
-              {
-                "name": "huntingquery139-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for Teams users clicking on suspicious URL domains. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents MessageEvents MessageUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery140",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Attacked user by Phish messages",
-            "elements": [
-              {
-                "name": "huntingquery140-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Top 10 attacked users by Phish messages from external senders using Teams This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery141",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 external senders sending Teams messages",
-            "elements": [
-              {
-                "name": "huntingquery141-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visulises all up Top 10 external senders sending Teams messages This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery142",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 External senders sending Teams phishing messsages",
-            "elements": [
-              {
-                "name": "huntingquery142-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looking for top 10 External senders sending Team phishing messsages. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery143",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 sender domains - Admin Teams message submissions FN",
-            "elements": [
-              {
-                "name": "huntingquery143-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery144",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 sender domains - Teams user submissions FN or FP",
-            "elements": [
-              {
-                "name": "huntingquery144-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery145",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 senders - Teams users submissions FN or FP",
-            "elements": [
-              {
-                "name": "huntingquery145-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery146",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 senders of  Admin Teams message submissions FN",
-            "elements": [
-              {
-                "name": "huntingquery146-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery147",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 senders of  Admin Teams message submissions FP",
-            "elements": [
-              {
-                "name": "huntingquery147-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises Teams messages submitted by admins as false positives, summarizing the data by top 10 indidvidual senders of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery148",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Users clicking on malicious URLs in Teams",
-            "elements": [
-              {
-                "name": "huntingquery148-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery149",
-            "type": "Microsoft.Common.Section",
-            "label": "Top accounts performing Teams admin submissions FN or FP",
-            "elements": [
-              {
-                "name": "huntingquery149-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top admins performing false negative or false positive admin submissions of Teams messages This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery150",
-            "type": "Microsoft.Common.Section",
-            "label": "Top accounts performing Teams user submissions FN or FP",
-            "elements": [
-              {
-                "name": "huntingquery150-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top users performing false negative or false positive user submissions of Teams messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery151",
-            "type": "Microsoft.Common.Section",
-            "label": "Top domains outbound sending Malicious Teams messages inbound",
-            "elements": [
-              {
-                "name": "huntingquery151-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looking for potential partner compromise via comparing outbound Teams message traffic per target domain and looking for malicious Teams messages from the same domains as inbound. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery152",
-            "type": "Microsoft.Common.Section",
-            "label": "Top External malicious Senders",
-            "elements": [
-              {
-                "name": "huntingquery152-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Top external senders sending malicious inbound Teams messages Spam, Phish, Malware This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery153",
-            "type": "Microsoft.Common.Section",
-            "label": "Top External Sender domains - Malware",
-            "elements": [
-              {
-                "name": "huntingquery153-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Top External Sender domains sending Teams message with Malware threats This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery154",
-            "type": "Microsoft.Common.Section",
-            "label": "Top External Sender domains - Phish",
-            "elements": [
-              {
-                "name": "huntingquery154-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Top External Sender domains sending Teams message with Phish threats This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery155",
-            "type": "Microsoft.Common.Section",
-            "label": "Top External Sender domains - Spam",
-            "elements": [
-              {
-                "name": "huntingquery155-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Top External Sender domains sending Teams message with Spam threats This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery156",
-            "type": "Microsoft.Common.Section",
-            "label": "Top malicious URLs clicked by users in Teams",
-            "elements": [
-              {
-                "name": "huntingquery156-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunt for top malicious URLs clicked by users in Teams This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery157",
-            "type": "Microsoft.Common.Section",
-            "label": "Total number of MDO Teams protection detections daily",
-            "elements": [
-              {
-                "name": "huntingquery157-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visulises Total number of MDO Teams protection detections daily This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery158",
-            "type": "Microsoft.Common.Section",
-            "label": "URL click on URLs in ZAP-d Teams messages",
-            "elements": [
-              {
-                "name": "huntingquery158-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents MessagePostDeliveryEvents MessageUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery159",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam and Phish allowed to inbox by Admin Overrides",
-            "elements": [
-              {
-                "name": "huntingquery159-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps in reviewing malicious emails allowed due to admin overrides This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery160",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam and Phish allowed to inbox by User Overrides",
-            "elements": [
-              {
-                "name": "huntingquery160-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps in reviewing malicious emails allowed due to user overrides This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery161",
-            "type": "Microsoft.Common.Section",
-            "label": "Top policies performing admin overrides",
-            "elements": [
-              {
-                "name": "huntingquery161-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps in reviewing top policies for admin overrides (Allow/Block) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery162",
-            "type": "Microsoft.Common.Section",
-            "label": "Top policies performing user overrides",
-            "elements": [
-              {
-                "name": "huntingquery162-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps in reviewing top policies for user overrides (Allow/Block) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery163",
-            "type": "Microsoft.Common.Section",
-            "label": "Total Emails with Admin Overrides (Allow)",
-            "elements": [
-              {
-                "name": "huntingquery163-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery164",
-            "type": "Microsoft.Common.Section",
-            "label": "Total Emails with Admin Overrides (Block)",
-            "elements": [
-              {
-                "name": "huntingquery164-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery165",
-            "type": "Microsoft.Common.Section",
-            "label": "Total Emails with User Overrides (Allow)",
-            "elements": [
-              {
-                "name": "huntingquery165-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery166",
-            "type": "Microsoft.Common.Section",
-            "label": "Total Emails with User Overrides (Block)",
-            "elements": [
-              {
-                "name": "huntingquery166-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery167",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery167-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish detections over time summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery168",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detections (High) by delivery location",
-            "elements": [
-              {
-                "name": "huntingquery168-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery169",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detections (Normal) by delivery location",
-            "elements": [
-              {
-                "name": "huntingquery169-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery170",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detections by delivery location trend",
-            "elements": [
-              {
-                "name": "huntingquery170-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery171",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detections by Detection technology Trend",
-            "elements": [
-              {
-                "name": "huntingquery171-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery172",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detections by Detection technology",
-            "elements": [
-              {
-                "name": "huntingquery172-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish detections summarizing the data by various Phish detection technologies/controls This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery173",
-            "type": "Microsoft.Common.Section",
-            "label": "Possible device code phishing attempts",
-            "elements": [
-              {
-                "name": "huntingquery173-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps hunting for possible device code Phishing attempts This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents AADSignInEventsBeta Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery174",
-            "type": "Microsoft.Common.Section",
-            "label": "Email Top Domains sending Phish",
-            "elements": [
-              {
-                "name": "huntingquery174-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery175",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Users receiving Phish",
-            "elements": [
-              {
-                "name": "huntingquery175-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery176",
-            "type": "Microsoft.Common.Section",
-            "label": "Zero-day Phish Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery176-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery177",
-            "type": "Microsoft.Common.Section",
-            "label": "Campaign with randomly named attachments",
-            "elements": [
-              {
-                "name": "huntingquery177-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery178",
-            "type": "Microsoft.Common.Section",
-            "label": "Campaign with suspicious keywords",
-            "elements": [
-              {
-                "name": "huntingquery178-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this detection, we track emails with suspicious keywords in subjects. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery179",
-            "type": "Microsoft.Common.Section",
-            "label": "Custom detection-Emails with QR from non-prevalent senders",
-            "elements": [
-              {
-                "name": "huntingquery179-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery180",
-            "type": "Microsoft.Common.Section",
-            "label": "Emails delivered having URLs from QR codes",
-            "elements": [
-              {
-                "name": "huntingquery180-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we hunt for inbound emails delivered having URLs from QR codes This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery181",
-            "type": "Microsoft.Common.Section",
-            "label": "Emails with QR codes and suspicious keywords in subject",
-            "elements": [
-              {
-                "name": "huntingquery181-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery182",
-            "type": "Microsoft.Common.Section",
-            "label": "Emails with QR codes from non-prevalent sender",
-            "elements": [
-              {
-                "name": "huntingquery182-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery183",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunting for sender patterns",
-            "elements": [
-              {
-                "name": "huntingquery183-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailAttachmentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery184",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunting for user signals-clusters",
-            "elements": [
-              {
-                "name": "huntingquery184-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery185",
-            "type": "Microsoft.Common.Section",
-            "label": "Inbound emails with QR code URLs",
-            "elements": [
-              {
-                "name": "huntingquery185-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we summarize volume of inbound emails with QR code URLs in last 30 days This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery186",
-            "type": "Microsoft.Common.Section",
-            "label": "Personalized campaigns based on the first few keywords",
-            "elements": [
-              {
-                "name": "huntingquery186-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this detection, we track emails with personalized subjects. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery187",
-            "type": "Microsoft.Common.Section",
-            "label": "Personalized campaigns based on the last few keywords",
-            "elements": [
-              {
-                "name": "huntingquery187-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this detection, we track emails with personalized subjects. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery188",
-            "type": "Microsoft.Common.Section",
-            "label": "Risky sign-in attempt from a non-managed device",
-            "elements": [
-              {
-                "name": "huntingquery188-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery189",
-            "type": "Microsoft.Common.Section",
-            "label": "Suspicious sign-in attempts from QR code phishing campaigns",
-            "elements": [
-              {
-                "name": "huntingquery189-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents AADSignInEventsBeta Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery190",
-            "type": "Microsoft.Common.Section",
-            "label": "Group quarantine release",
-            "elements": [
-              {
-                "name": "huntingquery190-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery191",
-            "type": "Microsoft.Common.Section",
-            "label": "High Confidence Phish Released",
-            "elements": [
-              {
-                "name": "huntingquery191-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query shows information about high confidence phish email that has been released from the Quarantine. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery192",
-            "type": "Microsoft.Common.Section",
-            "label": "Quarantine Phish Reason trend",
-            "elements": [
-              {
-                "name": "huntingquery192-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery193",
-            "type": "Microsoft.Common.Section",
-            "label": "Quarantine Phish Reason",
-            "elements": [
-              {
-                "name": "huntingquery193-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total amount of phish emails that are quarantined, summarized by the detection method This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery194",
-            "type": "Microsoft.Common.Section",
-            "label": "Quarantine Release Email Details",
-            "elements": [
-              {
-                "name": "huntingquery194-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query shows information about email that has been released from the Quarantine in Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery195",
-            "type": "Microsoft.Common.Section",
-            "label": "Quarantine release trend",
-            "elements": [
-              {
-                "name": "huntingquery195-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing quarantine release trend in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery196",
-            "type": "Microsoft.Common.Section",
-            "label": "Quarantine releases by Detection Types",
-            "elements": [
-              {
-                "name": "huntingquery196-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails released from quarantine and summarizing the result by the original filter verdict This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery197",
-            "type": "Microsoft.Common.Section",
-            "label": "Quarantine Spam Reason trend",
-            "elements": [
-              {
-                "name": "huntingquery197-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery198",
-            "type": "Microsoft.Common.Section",
-            "label": "Quarantine Spam Reason",
-            "elements": [
-              {
-                "name": "huntingquery198-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total amount of spam emails that are quarantined, summarized by the detection method This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery199",
-            "type": "Microsoft.Common.Section",
-            "label": "AIR investigation actions insight",
-            "elements": [
-              {
-                "name": "huntingquery199-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query provides insights into AIR investigation actions in Microsoft Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery200",
-            "type": "Microsoft.Common.Section",
-            "label": "Listing Email Remediation Actions via Explorer",
-            "elements": [
-              {
-                "name": "huntingquery200-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Listing Email Remediation Actions performed via Explorer in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery201",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 domains sending Bulk email",
-            "elements": [
-              {
-                "name": "huntingquery201-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total inbound emails which has any Bulk complaint level. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery202",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam detection by delivery location",
-            "elements": [
-              {
-                "name": "huntingquery202-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery203",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam detection by IP and its location",
-            "elements": [
-              {
-                "name": "huntingquery203-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery204",
-            "type": "Microsoft.Common.Section",
-            "label": "Bulk Emails by Sender Bulk Complaint level",
-            "elements": [
-              {
-                "name": "huntingquery204-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total inbound emails which has any Bulk complaint level. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery205",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam detection technologies",
-            "elements": [
-              {
-                "name": "huntingquery205-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery206",
-            "type": "Microsoft.Common.Section",
-            "label": "Email Top 10 Domains sending Spam",
-            "elements": [
-              {
-                "name": "huntingquery206-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total inbound emails with Spam detections. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery207",
-            "type": "Microsoft.Common.Section",
-            "label": "Email Top 10 Targeted Users (Spam)",
-            "elements": [
-              {
-                "name": "huntingquery207-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises top 10 users targeted with Spam. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery208",
-            "type": "Microsoft.Common.Section",
-            "label": "Email Top 15 Domains sending Spam with Additional Details",
-            "elements": [
-              {
-                "name": "huntingquery208-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery209",
-            "type": "Microsoft.Common.Section",
-            "label": "Email Top 15 Targeted Users (Spam) with Additional Details",
-            "elements": [
-              {
-                "name": "huntingquery209-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises top 15 users targeted with Spam with summarized spam detections. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery210",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam detection trend",
-            "elements": [
-              {
-                "name": "huntingquery210-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spam detections over time summarizing the data daily This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery211",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam Detections by Detection technology",
-            "elements": [
-              {
-                "name": "huntingquery211-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery212",
-            "type": "Microsoft.Common.Section",
-            "label": "Display Name - Spoof and Impersonation",
-            "elements": [
-              {
-                "name": "huntingquery212-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery213",
-            "type": "Microsoft.Common.Section",
-            "label": "Impersonation Detections by Detection Technology Trend",
-            "elements": [
-              {
-                "name": "huntingquery213-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery214",
-            "type": "Microsoft.Common.Section",
-            "label": "Impersonation Detections by Detection Technology",
-            "elements": [
-              {
-                "name": "huntingquery214-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery215",
-            "type": "Microsoft.Common.Section",
-            "label": "Impersonation Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery215-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish (BEC) - Impersonation detections over time. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery216",
-            "type": "Microsoft.Common.Section",
-            "label": "referral-phish-emails",
-            "elements": [
-              {
-                "name": "huntingquery216-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Hunting for credential phishing using the \"Referral\" infrastructure using Defender for Office 365 data This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery217",
-            "type": "Microsoft.Common.Section",
-            "label": "Spoof and impersonation detections by sender IP",
-            "elements": [
-              {
-                "name": "huntingquery217-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing count of spoof and impersonation detections done per sender IP This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery218",
-            "type": "Microsoft.Common.Section",
-            "label": "Spoof and impersonation phish detections",
-            "elements": [
-              {
-                "name": "huntingquery218-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing count of phish detections done by spoof detection methods This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery219",
-            "type": "Microsoft.Common.Section",
-            "label": "Spoof Detections by Detection Technology Trend",
-            "elements": [
-              {
-                "name": "huntingquery219-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology over time This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery220",
-            "type": "Microsoft.Common.Section",
-            "label": "Spoof Detections by Detection Technology",
-            "elements": [
-              {
-                "name": "huntingquery220-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery221",
-            "type": "Microsoft.Common.Section",
-            "label": "Spoof Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery221-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery222",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Domains Outbound with Emails with Threats Inbound (Partner BEC)",
-            "elements": [
-              {
-                "name": "huntingquery222-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery223",
-            "type": "Microsoft.Common.Section",
-            "label": "User not covered under display name impersonation",
-            "elements": [
-              {
-                "name": "huntingquery223-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps to find threats using display name impersonation for users not already protected with User Impersonation This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents IdentityInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery224",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submission Trend (FN)",
-            "elements": [
-              {
-                "name": "huntingquery224-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of admin false negative submission by submission type. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery225",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submission Trend (FP)",
-            "elements": [
-              {
-                "name": "huntingquery225-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of admin false positive submission by submission type. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery226",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submissions by DetectionMethod (Phish FP)",
-            "elements": [
-              {
-                "name": "huntingquery226-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the original detection technology of emails submitted as phish false positive by admins This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery227",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submissions by DetectionMethod (Spam FP)",
-            "elements": [
-              {
-                "name": "huntingquery227-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the original detection technology of emails submitted as spam false positive by admins This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery228",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submissions by Detection Type",
-            "elements": [
-              {
-                "name": "huntingquery228-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery229",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submissions by Grading verdict (FN-FP)",
-            "elements": [
-              {
-                "name": "huntingquery229-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery230",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submissions by Submission State (FN)",
-            "elements": [
-              {
-                "name": "huntingquery230-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total amount of admin false negative submissions by the state of the submission. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery231",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submissions by Submission State (FP)",
-            "elements": [
-              {
-                "name": "huntingquery231-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total amount of admin false positive submissions by the state of the submission. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery232",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submissions by Submission Type (FN)",
-            "elements": [
-              {
-                "name": "huntingquery232-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing admin reported email submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery233",
-            "type": "Microsoft.Common.Section",
-            "label": "Admin Submissions by Submission Type (FP)",
-            "elements": [
-              {
-                "name": "huntingquery233-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total amount of admin false positive submission by submission type. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery234",
-            "type": "Microsoft.Common.Section",
-            "label": "Top accounts performing admin submissions (FN)",
-            "elements": [
-              {
-                "name": "huntingquery234-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top admins performing false negative submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery235",
-            "type": "Microsoft.Common.Section",
-            "label": "Top accounts performing admin submissions (FP)",
-            "elements": [
-              {
-                "name": "huntingquery235-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top admins performing false positive submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery236",
-            "type": "Microsoft.Common.Section",
-            "label": "Top accounts performing user submissions",
-            "elements": [
-              {
-                "name": "huntingquery236-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query graphs top accounts performing user submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery237",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Detection Overrides - Admin Email Submissions (FN)",
-            "elements": [
-              {
-                "name": "huntingquery237-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery238",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 sender domains - Admin email submissions (FN)",
-            "elements": [
-              {
-                "name": "huntingquery238-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery239",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 sender domains - Admin email submissions (FP)",
-            "elements": [
-              {
-                "name": "huntingquery239-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery240",
-            "type": "Microsoft.Common.Section",
-            "label": "Total Submissions by Submission Type",
-            "elements": [
-              {
-                "name": "huntingquery240-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Total Submissions by Submission Status This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery241",
-            "type": "Microsoft.Common.Section",
-            "label": "Total Submissions by Submission Type",
-            "elements": [
-              {
-                "name": "huntingquery241-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Total Submissions by Submission Type This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery242",
-            "type": "Microsoft.Common.Section",
-            "label": "User reported submissions",
-            "elements": [
-              {
-                "name": "huntingquery242-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing user reported email submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery243",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions accuracy vs Admin review verdict",
-            "elements": [
-              {
-                "name": "huntingquery243-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises user submissions type compared to admin review verdict This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery244",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FN) - Top Detection Overrides by Admins",
-            "elements": [
-              {
-                "name": "huntingquery244-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery245",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FN) - Top Detection Overrides by Users",
-            "elements": [
-              {
-                "name": "huntingquery245-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery246",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FN) - Top Inbound P2 Senders domains",
-            "elements": [
-              {
-                "name": "huntingquery246-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises top sender domains of inbound emails submitted as false negatives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery247",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FN) - Top Inbound P2 Senders",
-            "elements": [
-              {
-                "name": "huntingquery247-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises top sender email addresses of inbound emails submitted as false negatives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery248",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FN) - Top Intra-Org P2 Senders",
-            "elements": [
-              {
-                "name": "huntingquery248-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises top sender email addresses of intra-org emails submitted as false negatives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery249",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FN) - Top Intra-Org Subjects",
-            "elements": [
-              {
-                "name": "huntingquery249-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises top 10 subjects of intra-org emails submitted as false negatives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery250",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions by Admin review status (Mark and Notify)",
-            "elements": [
-              {
-                "name": "huntingquery250-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises user submissions where admin also performed 'mark and notify' action on the submission This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery251",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FN-FP) by Grading verdict",
-            "elements": [
-              {
-                "name": "huntingquery251-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery252",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FN) by Submission Type",
-            "elements": [
-              {
-                "name": "huntingquery252-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total ammount of user false negative submission by submission type, including the phish simulations reported emails This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery253",
-            "type": "Microsoft.Common.Section",
-            "label": "User email submissions (FN) from Junk Folder",
-            "elements": [
-              {
-                "name": "huntingquery253-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the total ammount of user false negative submissions from the junk folder This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery254",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submission Trend (FN)",
-            "elements": [
-              {
-                "name": "huntingquery254-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery255",
-            "type": "Microsoft.Common.Section",
-            "label": "Attacked more than x times average",
-            "elements": [
-              {
-                "name": "huntingquery255-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing count of users attacked more than x times average. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery256",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious mails by sender IPs",
-            "elements": [
-              {
-                "name": "huntingquery256-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing sender IPs sending malicious email of type Malware or Phish This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery257",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10% of most attacked users",
-            "elements": [
-              {
-                "name": "huntingquery257-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing the list of top 10% of most attacked users This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery258",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 URL domains attacking organization",
-            "elements": [
-              {
-                "name": "huntingquery258-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing list of top 10 URL domains attacking the organization This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery259",
-            "type": "Microsoft.Common.Section",
-            "label": "Top external malicious senders",
-            "elements": [
-              {
-                "name": "huntingquery259-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery260",
-            "type": "Microsoft.Common.Section",
-            "label": "Top targeted users",
-            "elements": [
-              {
-                "name": "huntingquery260-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery261",
-            "type": "Microsoft.Common.Section",
-            "label": "End user malicious clicks",
-            "elements": [
-              {
-                "name": "huntingquery261-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing list of top users click on Phis URLs This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery262",
-            "type": "Microsoft.Common.Section",
-            "label": "URL click count by click action",
-            "elements": [
-              {
-                "name": "huntingquery262-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing URL click count by ClickAction This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery263",
-            "type": "Microsoft.Common.Section",
-            "label": "URL click on ZAP email",
-            "elements": [
-              {
-                "name": "huntingquery263-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Alertinfo AlertEvidence Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery264",
-            "type": "Microsoft.Common.Section",
-            "label": "URL clicks actions by URL",
-            "elements": [
-              {
-                "name": "huntingquery264-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we are looking URL click actions by URL in the last 7 days This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery265",
-            "type": "Microsoft.Common.Section",
-            "label": "URLClick details based on malicious URL click alert",
-            "elements": [
-              {
-                "name": "huntingquery265-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Alertinfo AlertEvidence Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery266",
-            "type": "Microsoft.Common.Section",
-            "label": "User clicked through events",
-            "elements": [
-              {
-                "name": "huntingquery266-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery267",
-            "type": "Microsoft.Common.Section",
-            "label": "User clicks on malicious inbound emails",
-            "elements": [
-              {
-                "name": "huntingquery267-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query provides insights on users who clicked on a suspicious URL This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery268",
-            "type": "Microsoft.Common.Section",
-            "label": "User clicks on phishing URLs in emails",
-            "elements": [
-              {
-                "name": "huntingquery268-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query helps in determining clickthroughs when email delivered because of detection overrides. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery269",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious Clicks allowed (click-through)",
-            "elements": [
-              {
-                "name": "huntingquery269-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery270",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious Emails with QR code Urls",
-            "elements": [
-              {
-                "name": "huntingquery270-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery271",
-            "type": "Microsoft.Common.Section",
-            "label": "PhishingEmailUrlRedirector (1)",
-            "elements": [
-              {
-                "name": "huntingquery271-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data. This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery272",
-            "type": "Microsoft.Common.Section",
-            "label": "SafeLinks URL detections",
-            "elements": [
-              {
-                "name": "huntingquery272-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query provides insights on the detections done by SafeLinks protection in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery273",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Users clicking on Malicious URLs (Malware)",
-            "elements": [
-              {
-                "name": "huntingquery273-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery274",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Users clicking on Malicious URLs (Phish)",
-            "elements": [
-              {
-                "name": "huntingquery274-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery275",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 10 Users clicking on Malicious URLs (Spam)",
-            "elements": [
-              {
-                "name": "huntingquery275-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Visualises the top 10 users with click attempts on URLs in emails detected as spam, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery276",
-            "type": "Microsoft.Common.Section",
-            "label": "URL Click attempts by threat type",
-            "elements": [
-              {
-                "name": "huntingquery276-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery277",
-            "type": "Microsoft.Common.Section",
-            "label": "URL Clicks by Action",
-            "elements": [
-              {
-                "name": "huntingquery277-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery278",
-            "type": "Microsoft.Common.Section",
-            "label": "URLs by location",
-            "elements": [
-              {
-                "name": "huntingquery278-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery279",
-            "type": "Microsoft.Common.Section",
-            "label": "Post Delivery Events by Admin",
-            "elements": [
-              {
-                "name": "huntingquery279-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery280",
-            "type": "Microsoft.Common.Section",
-            "label": "Post Delivery Events by Location",
-            "elements": [
-              {
-                "name": "huntingquery280-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery281",
-            "type": "Microsoft.Common.Section",
-            "label": "Post Delivery Events by ZAP type",
-            "elements": [
-              {
-                "name": "huntingquery281-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery282",
-            "type": "Microsoft.Common.Section",
-            "label": "Post Delivery Events over time",
-            "elements": [
-              {
-                "name": "huntingquery282-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge. This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery283",
-            "type": "Microsoft.Common.Section",
-            "label": "Determine Successfully Delivered Phishing Emails to Inbox/Junk folder.",
-            "elements": [
-              {
-                "name": "huntingquery283-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query identifies threats which got successfully delivered to Inbox/Junk folder. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery284",
-            "type": "Microsoft.Common.Section",
-            "label": "Anomalous Payload Delivered from ISO files",
-            "elements": [
-              {
-                "name": "huntingquery284-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for lnk file executions from other locations than C: drive, which can relate to mounted ISO-files. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery285",
-            "type": "Microsoft.Common.Section",
-            "label": "Bitsadmin Activity",
-            "elements": [
-              {
-                "name": "huntingquery285-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for use of bitsadmin.exe for file transfer, which can be used for legitimate purposes or as part of a malware downloader. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery286",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Malicious use of MSIExec",
-            "elements": [
-              {
-                "name": "huntingquery286-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query detects possible download and execution using Msiexec. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery287",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Malicious use of Msiexec Mimikatz",
-            "elements": [
-              {
-                "name": "huntingquery287-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for malicious use of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery288",
-            "type": "Microsoft.Common.Section",
-            "label": "Office Apps Launching Wscipt",
-            "elements": [
-              {
-                "name": "huntingquery288-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "The query searches for Office applications launching wscript.exe to run a JSE file. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery289",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Potential kerberoast Activities",
-            "elements": [
-              {
-                "name": "huntingquery289-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query aim to detect if someone requests service tickets (where count => maxcount). The query requires trimming to set a baseline level for MaxCount. This hunting query depends on MicrosoftThreatProtection data connector (IdentityLogonEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery290",
-            "type": "Microsoft.Common.Section",
-            "label": "PowerShell Downloads",
-            "elements": [
-              {
-                "name": "huntingquery290-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "The query searches for PowerShell execution events that could involve a download. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery291",
-            "type": "Microsoft.Common.Section",
-            "label": "Webserver Executing Suspicious Applications",
-            "elements": [
-              {
-                "name": "huntingquery291-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for common webserver process names and identifies any processes launched using a scripting language (cmd, powershell, wscript, cscript). This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery292",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect Suspicious Mshta Usage",
-            "elements": [
-              {
-                "name": "huntingquery292-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query detects when mshta.exe has been run, which might include illegitimate usage by attackers. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery293",
-            "type": "Microsoft.Common.Section",
-            "label": "Files Copied to USB Drives",
-            "elements": [
-              {
-                "name": "huntingquery293-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents DeviceFileEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery294",
-            "type": "Microsoft.Common.Section",
-            "label": "Suspicious Tomcat Confluence Process Launch",
-            "elements": [
-              {
-                "name": "huntingquery294-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery295",
-            "type": "Microsoft.Common.Section",
-            "label": "MosaicLoader",
-            "elements": [
-              {
-                "name": "huntingquery295-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection. This hunting query depends on MicrosoftThreatProtection data connector (DeviceRegistryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery296",
-            "type": "Microsoft.Common.Section",
-            "label": "Spoolsv Spawning Rundll32",
-            "elements": [
-              {
-                "name": "huntingquery296-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Look for the spoolsv.exe launching rundll32.exe with an empty command line. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery297",
-            "type": "Microsoft.Common.Section",
-            "label": "Suspicious DLLs in spool Folder",
-            "elements": [
-              {
-                "name": "huntingquery297-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Look for the creation of suspicious DLL files spawned in the \\spool\\ folder along with DLLs that were recently loaded afterwards from \\Old. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents DeviceImageLoadEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery298",
-            "type": "Microsoft.Common.Section",
-            "label": "Suspicious Files in spool Folder",
-            "elements": [
-              {
-                "name": "huntingquery298-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery299",
-            "type": "Microsoft.Common.Section",
-            "label": "Suspicious Spoolsv Child Process",
-            "elements": [
-              {
-                "name": "huntingquery299-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675 This hunting query depends on MicrosoftThreatProtection data connector (DeviceImageLoadEvents DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery300",
-            "type": "Microsoft.Common.Section",
-            "label": "PrintNightmare CVE-2021-1675 usage Detection",
-            "elements": [
-              {
-                "name": "huntingquery300-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for any file creations in the print spooler drivers folder. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery301",
-            "type": "Microsoft.Common.Section",
-            "label": "Windows Print Spooler Service Suspicious File Creation",
-            "elements": [
-              {
-                "name": "huntingquery301-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "The query digs in Windows print spooler drivers folder for any file creations. This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery302",
-            "type": "Microsoft.Common.Section",
-            "label": "MITRE - Suspicious Events",
-            "elements": [
-              {
-                "name": "huntingquery302-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query looks for several different MITRE techniques, grouped by risk level. A weighting is applied to each risk level and a total score calculated per machine. Techniques can be added/removed as required. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery303",
-            "type": "Microsoft.Common.Section",
-            "label": "Unusual Volume of file deletion by users",
-            "elements": [
-              {
-                "name": "huntingquery303-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents AADSignInEventsBeta Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery304",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect MaiSniper",
-            "elements": [
-              {
-                "name": "huntingquery304-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for usage of MailSniper Exchange attack tool. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceNetworkEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery305",
-            "type": "Microsoft.Common.Section",
-            "label": "Account Brute Force",
-            "elements": [
-              {
-                "name": "huntingquery305-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query searches for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded. This hunting query depends on MicrosoftThreatProtection data connector (DeviceLogonEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery306",
-            "type": "Microsoft.Common.Section",
-            "label": "Remote File Creation with PsExec",
-            "elements": [
-              {
-                "name": "huntingquery306-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query detects remote file creation events that might indicate an active attack using PsExec. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery307",
-            "type": "Microsoft.Common.Section",
-            "label": "Service Accounts Performing Remote PS",
-            "elements": [
-              {
-                "name": "huntingquery307-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for any Service Accounts Performing Remote PowerShell. This hunting query depends on MicrosoftThreatProtection data connector (DeviceLogonEvents DeviceEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery308",
-            "type": "Microsoft.Common.Section",
-            "label": "Account Creation",
-            "elements": [
-              {
-                "name": "huntingquery308-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for the creation of user accounts on a machine using the \"net user\" command. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery309",
-            "type": "Microsoft.Common.Section",
-            "label": "Local Admin Group Changes",
-            "elements": [
-              {
-                "name": "huntingquery309-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This hunting query searches for changes to the local administrators group. This hunting query depends on MicrosoftThreatProtection data connector (IdentityInfo DeviceEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery310",
-            "type": "Microsoft.Common.Section",
-            "label": "Rare Process as a Service",
-            "elements": [
-              {
-                "name": "huntingquery310-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query looks for rarely seen processes which are launched as a service. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceNetworkEvents DeviceFileEvents DeviceImageLoadEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery311",
-            "type": "Microsoft.Common.Section",
-            "label": "Scheduled Task Creation",
-            "elements": [
-              {
-                "name": "huntingquery311-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for any scheduled task creation event. This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery312",
-            "type": "Microsoft.Common.Section",
-            "label": "SAM Name Change CVE-2021-42278",
-            "elements": [
-              {
-                "name": "huntingquery312-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity. This hunting query depends on MicrosoftThreatProtection data connector (IdentityDirectoryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery313",
-            "type": "Microsoft.Common.Section",
-            "label": "Deletion of data on multiple drives using cipher exe",
-            "elements": [
-              {
-                "name": "huntingquery313-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery314",
-            "type": "Microsoft.Common.Section",
-            "label": "Check for multiple signs of Ransomware Activity",
-            "elements": [
-              {
-                "name": "huntingquery314-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for multiple signs of ransomware activity to identify affected devices. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery315",
-            "type": "Microsoft.Common.Section",
-            "label": "Disabling Services via Registry",
-            "elements": [
-              {
-                "name": "huntingquery315-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Search for processes modifying the registry to disable security features. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery316",
-            "type": "Microsoft.Common.Section",
-            "label": "DLLHost.exe WMIC domain discovery",
-            "elements": [
-              {
-                "name": "huntingquery316-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for dllhost.exe calling WMIC to discover additional hosts and associated domain. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery317",
-            "type": "Microsoft.Common.Section",
-            "label": "PowerShell adding exclusion path for Microsoft Defender of ProgramData",
-            "elements": [
-              {
-                "name": "huntingquery317-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery318",
-            "type": "Microsoft.Common.Section",
-            "label": "Suspicious Image Load related to IcedId",
-            "elements": [
-              {
-                "name": "huntingquery318-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to IcedId ransomware. This hunting query depends on MicrosoftThreatProtection data connector (DeviceImageLoadEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery319",
-            "type": "Microsoft.Common.Section",
-            "label": "LaZagne Credential Theft",
-            "elements": [
-              {
-                "name": "huntingquery319-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query can be used to locate processes executing credential theft activity, often LaZagne in ransomware compromises. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery320",
-            "type": "Microsoft.Common.Section",
-            "label": "Clearing of forensic evidence from event logs using wevtutil",
-            "elements": [
-              {
-                "name": "huntingquery320-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery321",
-            "type": "Microsoft.Common.Section",
-            "label": "Stopping multiple processes using taskkill",
-            "elements": [
-              {
-                "name": "huntingquery321-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery322",
-            "type": "Microsoft.Common.Section",
-            "label": "Potential Ransomware activity related to Cobalt Strike",
-            "elements": [
-              {
-                "name": "huntingquery322-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns. This hunting query depends on MicrosoftThreatProtection data connector (AlertInfo AlertEvidence DeviceLogonEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery323",
-            "type": "Microsoft.Common.Section",
-            "label": "Qakbot Discovery Activies",
-            "elements": [
-              {
-                "name": "huntingquery323-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery324",
-            "type": "Microsoft.Common.Section",
-            "label": "Shadow Copy Deletions",
-            "elements": [
-              {
-                "name": "huntingquery324-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery325",
-            "type": "Microsoft.Common.Section",
-            "label": "Turning off services using sc exe",
-            "elements": [
-              {
-                "name": "huntingquery325-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query checks for attempts to turn off at least 10 existing services using sc.exe. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery326",
-            "type": "Microsoft.Common.Section",
-            "label": "Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities",
-            "elements": [
-              {
-                "name": "huntingquery326-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a This hunting query depends on MicrosoftThreatProtection data connector (DeviceTvmSoftwareVulnerabilitiesKB Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery327",
-            "type": "Microsoft.Common.Section",
-            "label": "Punycode lookalikes",
-            "elements": [
-              {
-                "name": "huntingquery327-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Punycode lookalike domains in Emails and Teams messages This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo MessageUrlInfo MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery328",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for RMM tool execution following Teams messages",
-            "elements": [
-              {
-                "name": "huntingquery328-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Correlates inbound Microsoft Teams messages with subsequent execution of common Remote Monitoring and Management (RMM) tools (QuickAssist, AnyDesk, TeamViewer) \non the recipient's device within a short time window. This pattern is associated with social engineering / tech-support-scam intrusions (e.g., Storm-1811 / Black \nBasta) where attackers lure victims via Teams chat and then convince them to launch an RMM tool to gain remote access. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents DeviceProcessEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery329",
-            "type": "Microsoft.Common.Section",
-            "label": "Hunt for alerts correlated with Teams messages",
-            "elements": [
-              {
-                "name": "huntingquery329-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Correlates Microsoft Teams message activity with downstream Defender alerts on the\nrecipient (victim) identity, surfacing potential phishing or social-engineering chats\nthat are followed by alert activity within a tunable time window. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents CloudAppEvents AlertEvidence Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery330",
-            "type": "Microsoft.Common.Section",
-            "label": "Identify acting user for reported phish",
-            "elements": [
-              {
-                "name": "huntingquery330-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "Identifies the user who acted on a reported phishing message and compares that actor with the original recipient, helping investigate delegate or shared mailbox reporting scenarios. This hunting query depends on MicrosoftThreatProtection data connector (AlertEvidence CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery331",
-            "type": "Microsoft.Common.Section",
-            "label": "Inbound Sender Domains Failing Email Authentication",
-            "elements": [
-              {
-                "name": "huntingquery331-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, and Composite Authentication), using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery332",
-            "type": "Microsoft.Common.Section",
-            "label": "Automatic External Email Forwarding Overview by Type (Mailbox Rule and SMTP)",
-            "elements": [
-              {
-                "name": "huntingquery332-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises automatic external email forwarding across the tenant by forwarding type (mailbox rule versus SMTP forwarding), using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery333",
-            "type": "Microsoft.Common.Section",
-            "label": "First-Contact External Email Senders",
-            "elements": [
-              {
-                "name": "huntingquery333-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists external email senders seen for the first time in the period (most recent first), surfacing new first-contact relationships, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery334",
-            "type": "Microsoft.Common.Section",
-            "label": "New External Sender Domains Carrying Threats",
-            "elements": [
-              {
-                "name": "huntingquery334-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists external sender domains seen for the first time in the period that already carried threats, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery335",
-            "type": "Microsoft.Common.Section",
-            "label": "Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
-            "elements": [
-              {
-                "name": "huntingquery335-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the top external domains receiving automatically forwarded email, by forwarding type, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery336",
-            "type": "Microsoft.Common.Section",
-            "label": "Top External Recipients Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
-            "elements": [
-              {
-                "name": "huntingquery336-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the top external recipients receiving automatically forwarded email, by forwarding type, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery337",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)",
-            "elements": [
-              {
-                "name": "huntingquery337-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the top internal users automatically forwarding email to external addresses, by forwarding type, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery338",
-            "type": "Microsoft.Common.Section",
-            "label": "File Malware Detections Over Time (SharePoint, OneDrive and Teams)",
-            "elements": [
-              {
-                "name": "huntingquery338-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query shows the daily volume of file malware detections in SharePoint, OneDrive and Teams over the last 30 days, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery339",
-            "type": "Microsoft.Common.Section",
-            "label": "File Malware Detections by Location (SharePoint, OneDrive and Teams)",
-            "elements": [
-              {
-                "name": "huntingquery339-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query surfaces malware detections in files stored in SharePoint, OneDrive and Teams, grouped by the site or personal location where each file resides, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery340",
-            "type": "Microsoft.Common.Section",
-            "label": "File Malware Detections by Workload (SharePoint, OneDrive and Teams)",
-            "elements": [
-              {
-                "name": "huntingquery340-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises malware detections in files stored in SharePoint, OneDrive and Teams by the Microsoft 365 collaboration workload, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery341",
-            "type": "Microsoft.Common.Section",
-            "label": "File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)",
-            "elements": [
-              {
-                "name": "huntingquery341-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by Microsoft Defender for Office 365 (Safe Attachments detonation), using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery342",
-            "type": "Microsoft.Common.Section",
-            "label": "File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)",
-            "elements": [
-              {
-                "name": "huntingquery342-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by the built-in SharePoint Online antivirus, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery343",
-            "type": "Microsoft.Common.Section",
-            "label": "File Scanning Coverage (SharePoint, OneDrive and Teams)",
-            "elements": [
-              {
-                "name": "huntingquery343-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises file scanning coverage in SharePoint, OneDrive and Teams: how many files were processed, how many were found malicious, and how many were scanned with no detection, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery344",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware Detection IP and Geo Position",
-            "elements": [
-              {
-                "name": "huntingquery344-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises inbound email malware detections by sender IP address with geographic coordinates for mapping. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery345",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware Detections by Sender Country",
-            "elements": [
-              {
-                "name": "huntingquery345-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises inbound email malware detections by the sender IP address country, derived from the sender IPv4 address. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery346",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware Detections by Threat Classification",
-            "elements": [
-              {
-                "name": "huntingquery346-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises inbound email malware detections grouped by the malware threat classification (for example Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery347",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Attacked Users by Malware Threat Classification",
-            "elements": [
-              {
-                "name": "huntingquery347-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query surfaces, for each malware threat classification, the recipient most frequently targeted by inbound malware email. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery348",
-            "type": "Microsoft.Common.Section",
-            "label": "Top File Owners Holding Malware (SharePoint, OneDrive and Teams)",
-            "elements": [
-              {
-                "name": "huntingquery348-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the file owners (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery349",
-            "type": "Microsoft.Common.Section",
-            "label": "First-Contact External Teams Senders",
-            "elements": [
-              {
-                "name": "huntingquery349-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists external Microsoft Teams senders by the date they were first seen, surfacing recent first-contact senders. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery350",
-            "type": "Microsoft.Common.Section",
-            "label": "Malicious files shared in Microsoft Teams",
-            "elements": [
-              {
-                "name": "huntingquery350-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery351",
-            "type": "Microsoft.Common.Section",
-            "label": "Microsoft Teams External versus Internal Thread Exposure",
-            "elements": [
-              {
-                "name": "huntingquery351-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery352",
-            "type": "Microsoft.Common.Section",
-            "label": "Teams File Protection Summary",
-            "elements": [
-              {
-                "name": "huntingquery352-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarizes Microsoft Teams file protection: files scanned, files with malware detected, and files with no detection. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery353",
-            "type": "Microsoft.Common.Section",
-            "label": "SecOps Mailbox Override Count",
-            "elements": [
-              {
-                "name": "huntingquery353-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query counts inbound emails delivered to the SecOps mailbox by an organisation-level allow override. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery354",
-            "type": "Microsoft.Common.Section",
-            "label": "SecOps Mailbox Overrides by Threat Type",
-            "elements": [
-              {
-                "name": "huntingquery354-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query breaks down inbound emails delivered to the SecOps mailbox by an organisation-level allow override, grouped by threat type. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery355",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Recipients Receiving Threats Delivered by Override",
-            "elements": [
-              {
-                "name": "huntingquery355-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the recipients who received the most threats that were delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery356",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Sender Domains Delivering Threats via Override",
-            "elements": [
-              {
-                "name": "huntingquery356-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the sender domains whose threats were most often delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery357",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detection IP and Geo Position",
-            "elements": [
-              {
-                "name": "huntingquery357-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises inbound email phishing detections by sender IP address with geographic coordinates for mapping. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery358",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detections by Sender Country",
-            "elements": [
-              {
-                "name": "huntingquery358-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises inbound email phishing detections by the sender IP address country, derived from the sender IPv4 address. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery359",
-            "type": "Microsoft.Common.Section",
-            "label": "Phish Detections by Threat Classification",
-            "elements": [
-              {
-                "name": "huntingquery359-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises inbound email phishing detections grouped by the message-intent threat classification produced by Microsoft Defender for Office 365 LLM content analysis (for example Invoice, Gift card, Payroll, PII gathering). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery360",
-            "type": "Microsoft.Common.Section",
-            "label": "Phishing Detected by LLM Content Analysis",
-            "elements": [
-              {
-                "name": "huntingquery360-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists inbound phishing messages that Microsoft Defender for Office 365 detected using LLM (Language AI) content analysis, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery361",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Attacked Users by Phish Threat Classification",
-            "elements": [
-              {
-                "name": "huntingquery361-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query surfaces, for each phishing message-intent threat classification, the recipient most frequently targeted by inbound phishing email. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery362",
-            "type": "Microsoft.Common.Section",
-            "label": "Quarantine Release Percentage",
-            "elements": [
-              {
-                "name": "huntingquery362-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query calculates the percentage of quarantined emails that were subsequently released, out of the total quarantined. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery363",
-            "type": "Microsoft.Common.Section",
-            "label": "Automated Investigation Outcomes by Day",
-            "elements": [
-              {
-                "name": "huntingquery363-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarizes daily automated investigation outcomes (threat detected versus clean) by correlating automated remediation events with alert evidence, using the EmailPostDeliveryEvents and AlertEvidence tables. This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents AlertEvidence Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery364",
-            "type": "Microsoft.Common.Section",
-            "label": "Automated Remediation Delivery to Action Latency",
-            "elements": [
-              {
-                "name": "huntingquery364-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query measures how long after delivery Microsoft Defender for Office 365 automated remediation acts on a message, reported as daily average and percentiles, using the EmailEvents and EmailPostDeliveryEvents tables. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery365",
-            "type": "Microsoft.Common.Section",
-            "label": "Automated Remediation Efficiency Over Time",
-            "elements": [
-              {
-                "name": "huntingquery365-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query trends the outcome (success versus failure) of Microsoft Defender for Office 365 automated remediation actions over time, using the EmailPostDeliveryEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery366",
-            "type": "Microsoft.Common.Section",
-            "label": "Automated Remediation Manual versus Automatic Approval",
-            "elements": [
-              {
-                "name": "huntingquery366-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query shows whether Microsoft Defender for Office 365 automated remediation actions were taken automatically or required manual admin approval, using the EmailPostDeliveryEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery367",
-            "type": "Microsoft.Common.Section",
-            "label": "Spam Detections by Sender Country",
-            "elements": [
-              {
-                "name": "huntingquery367-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarizes inbound spam detections by the geographic country of the sending IP address, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery368",
-            "type": "Microsoft.Common.Section",
-            "label": "Impersonation and Spoof Detections by Sender Country",
-            "elements": [
-              {
-                "name": "huntingquery368-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarizes inbound impersonation and spoof (BEC) detections by the geographic country of the sending IP address, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery369",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Recipients Targeted by Impersonation or BEC",
-            "elements": [
-              {
-                "name": "huntingquery369-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery370",
-            "type": "Microsoft.Common.Section",
-            "label": "Top accounts performing user submissions (FP)",
-            "elements": [
-              {
-                "name": "huntingquery370-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top accounts performing user false positive submissions. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery371",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FP) - Top Inbound Subjects",
-            "elements": [
-              {
-                "name": "huntingquery371-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top 10 subjects of inbound emails submitted as false positives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery372",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FP) - Top Intra-Org P2 Senders",
-            "elements": [
-              {
-                "name": "huntingquery372-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top 10 intra-org senders of emails submitted as false positives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery373",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FP) - Top P2 Sender Domains",
-            "elements": [
-              {
-                "name": "huntingquery373-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top 10 sender domains of emails submitted as false positives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery374",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submissions (FP) - Top Inbound P2 Senders",
-            "elements": [
-              {
-                "name": "huntingquery374-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the top 10 inbound senders of emails submitted as false positives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery375",
-            "type": "Microsoft.Common.Section",
-            "label": "User Email Submission Trend (FP)",
-            "elements": [
-              {
-                "name": "huntingquery375-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises the daily amount of user false positive email submissions over time. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery376",
-            "type": "Microsoft.Common.Section",
-            "label": "User Submissions by Detection Method - Phish (FP)",
-            "elements": [
-              {
-                "name": "huntingquery376-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises user false positive submissions by the original phish filter verdict on the reported message. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery377",
-            "type": "Microsoft.Common.Section",
-            "label": "User Submissions by Detection Method - Spam (FP)",
-            "elements": [
-              {
-                "name": "huntingquery377-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises user false positive submissions by the original spam filter verdict on the reported message. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery378",
-            "type": "Microsoft.Common.Section",
-            "label": "User Submissions by Submission State (FP)",
-            "elements": [
-              {
-                "name": "huntingquery378-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises user false positive submissions by submission state. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery379",
-            "type": "Microsoft.Common.Section",
-            "label": "Largest Malicious Email Campaigns by Cluster",
-            "elements": [
-              {
-                "name": "huntingquery379-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query surfaces the largest malicious inbound email campaigns, clustered by EmailClusterId, with one row per attack wave, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery380",
-            "type": "Microsoft.Common.Section",
-            "label": "Blocked URL Clicks by Workload",
-            "elements": [
-              {
-                "name": "huntingquery380-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises blocked Safe Links URL clicks over time broken down by the workload the click came from (Email, Teams, Office, Microsoft 365 Copilot). This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery381",
-            "type": "Microsoft.Common.Section",
-            "label": "Top 20 Malicious URLs by Clicks",
-            "elements": [
-              {
-                "name": "huntingquery381-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the top 20 URLs carrying a detection ranked by the number of clicks registered, with the threat type, click action and workload for each. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery382",
-            "type": "Microsoft.Common.Section",
-            "label": "Top Clicks on Malicious URLs",
-            "elements": [
-              {
-                "name": "huntingquery382-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query lists the malicious URLs that registered the most user clicks, with threat type, click action and workload, using the UrlClickEvents table. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery383",
-            "type": "Microsoft.Common.Section",
-            "label": "URL Click-Through by Workload",
-            "elements": [
-              {
-                "name": "huntingquery383-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query shows malicious URL click-throughs (where the user proceeded past the Safe Links warning) broken down by the workload the click came from. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery384",
-            "type": "Microsoft.Common.Section",
-            "label": "URL Threat Protection Summary",
-            "elements": [
-              {
-                "name": "huntingquery384-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query summarises URL threat protection activity (Safe Links click outcomes and distinct URLs seen in email) as a set of headline metrics for the selected period. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery385",
-            "type": "Microsoft.Common.Section",
-            "label": "Malware URL Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery385-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises inbound email malware detections attributed to URL-based detection technologies over time. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery386",
-            "type": "Microsoft.Common.Section",
-            "label": "Phishing URL Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery386-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises inbound email phishing detections attributed to URL-based detection technologies over time. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
-                }
-              }
-            ]
-          },
-          {
-            "name": "huntingquery387",
-            "type": "Microsoft.Common.Section",
-            "label": "QR Code URL Detections Trend",
-            "elements": [
-              {
-                "name": "huntingquery387-text",
-                "type": "Microsoft.Common.TextBlock",
-                "options": {
-                  "text": "This query visualises inbound email detections involving URLs embedded in QR codes over time, split by the threat type of the detection (phishing, malware, spam). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
-                }
-              }
-            ]
           }
         ]
       }
@@ -6179,7 +99,9 @@
     "outputs": {
       "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
       "location": "[location()]",
-      "workspace": "[basics('workspace')]"
+      "workspace": "[basics('workspace')]",
+      "DeployDefenderWorkbook": "[steps('contentSelection').DeployDefenderWorkbook]",
+      "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]"
     }
   }
 }
diff --git a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json
index 65cfc8c6d19..f29c7c4d474 100644
--- a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json	
+++ b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json	
@@ -28,28 +28,18 @@
         "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
       }
     },
-    "workbook1-name": {
-      "type": "string",
-      "defaultValue": "Microsoft Defender for Office 365 Detections and Insights",
-      "minLength": 1,
-      "metadata": {
-        "description": "Name for the workbook"
-      }
-    },
-    "workbook2-name": {
-      "type": "string",
-      "defaultValue": "Microsoft Defender For EndPoint",
-      "minLength": 1,
+    "DeployDefenderWorkbook": {
+      "type": "bool",
+      "defaultValue": false,
       "metadata": {
-        "description": "Name for the workbook"
+        "description": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification."
       }
     },
-    "workbook3-name": {
-      "type": "string",
-      "defaultValue": "Microsoft Defender For Identity",
-      "minLength": 1,
+    "DeployDataConnector": {
+      "type": "bool",
+      "defaultValue": true,
       "metadata": {
-        "description": "Name for the workbook"
+        "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
       }
     }
   },
@@ -57,7 +47,7 @@
     "email": "support@microsoft.com",
     "_email": "[variables('email')]",
     "_solutionName": "Microsoft Defender XDR",
-    "_solutionVersion": "3.0.18",
+    "_solutionVersion": "3.2.1",
     "solutionId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
     "_solutionId": "[variables('solutionId')]",
     "uiConfigId1": "MicrosoftThreatProtection",
@@ -69,2241 +59,6 @@
     "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]",
     "dataConnectorVersion1": "1.0.0",
     "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]",
-    "analyticRuleObject1": {
-      "analyticRuleVersion1": "1.1.2",
-      "_analyticRulecontentId1": "6c3a1258-bcdd-4fcd-b753-1a9bc826ce12",
-      "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6c3a1258-bcdd-4fcd-b753-1a9bc826ce12')]",
-      "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6c3a1258-bcdd-4fcd-b753-1a9bc826ce12')))]",
-      "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6c3a1258-bcdd-4fcd-b753-1a9bc826ce12','-', '1.1.2')))]"
-    },
-    "analyticRuleObject2": {
-      "analyticRuleVersion2": "1.0.4",
-      "_analyticRulecontentId2": "53e936c6-6c30-4d12-8343-b8a0456e8429",
-      "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '53e936c6-6c30-4d12-8343-b8a0456e8429')]",
-      "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('53e936c6-6c30-4d12-8343-b8a0456e8429')))]",
-      "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','53e936c6-6c30-4d12-8343-b8a0456e8429','-', '1.0.4')))]"
-    },
-    "analyticRuleObject3": {
-      "analyticRuleVersion3": "1.1.0",
-      "_analyticRulecontentId3": "1bf6e165-5e32-420e-ab4f-0da8558a8be2",
-      "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1bf6e165-5e32-420e-ab4f-0da8558a8be2')]",
-      "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1bf6e165-5e32-420e-ab4f-0da8558a8be2')))]",
-      "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1bf6e165-5e32-420e-ab4f-0da8558a8be2','-', '1.1.0')))]"
-    },
-    "analyticRuleObject4": {
-      "analyticRuleVersion4": "1.0.6",
-      "_analyticRulecontentId4": "738702fd-0a66-42c7-8586-e30f0583f8fe",
-      "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '738702fd-0a66-42c7-8586-e30f0583f8fe')]",
-      "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('738702fd-0a66-42c7-8586-e30f0583f8fe')))]",
-      "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','738702fd-0a66-42c7-8586-e30f0583f8fe','-', '1.0.6')))]"
-    },
-    "analyticRuleObject5": {
-      "analyticRuleVersion5": "1.0.5",
-      "_analyticRulecontentId5": "ce1e7025-866c-41f3-9b08-ec170e05e73e",
-      "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ce1e7025-866c-41f3-9b08-ec170e05e73e')]",
-      "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ce1e7025-866c-41f3-9b08-ec170e05e73e')))]",
-      "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ce1e7025-866c-41f3-9b08-ec170e05e73e','-', '1.0.5')))]"
-    },
-    "analyticRuleObject6": {
-      "analyticRuleVersion6": "1.0.7",
-      "_analyticRulecontentId6": "a3c144f9-8051-47d4-ac29-ffb0c312c910",
-      "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a3c144f9-8051-47d4-ac29-ffb0c312c910')]",
-      "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a3c144f9-8051-47d4-ac29-ffb0c312c910')))]",
-      "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a3c144f9-8051-47d4-ac29-ffb0c312c910','-', '1.0.7')))]"
-    },
-    "analyticRuleObject7": {
-      "analyticRuleVersion7": "1.1.3",
-      "_analyticRulecontentId7": "b6685757-3ed1-4b05-a5bd-2cacadc86c2a",
-      "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b6685757-3ed1-4b05-a5bd-2cacadc86c2a')]",
-      "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b6685757-3ed1-4b05-a5bd-2cacadc86c2a')))]",
-      "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b6685757-3ed1-4b05-a5bd-2cacadc86c2a','-', '1.1.3')))]"
-    },
-    "analyticRuleObject8": {
-      "analyticRuleVersion8": "1.0.4",
-      "_analyticRulecontentId8": "1785d372-b9fe-4283-96a6-3a1d83cabfd1",
-      "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1785d372-b9fe-4283-96a6-3a1d83cabfd1')]",
-      "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1785d372-b9fe-4283-96a6-3a1d83cabfd1')))]",
-      "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1785d372-b9fe-4283-96a6-3a1d83cabfd1','-', '1.0.4')))]"
-    },
-    "analyticRuleObject9": {
-      "analyticRuleVersion9": "1.0.3",
-      "_analyticRulecontentId9": "3bd33158-3f0b-47e3-a50f-7c20a1b88038",
-      "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3bd33158-3f0b-47e3-a50f-7c20a1b88038')]",
-      "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3bd33158-3f0b-47e3-a50f-7c20a1b88038')))]",
-      "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3bd33158-3f0b-47e3-a50f-7c20a1b88038','-', '1.0.3')))]"
-    },
-    "analyticRuleObject10": {
-      "analyticRuleVersion10": "1.1.3",
-      "_analyticRulecontentId10": "26e81021-2de6-4442-a74a-a77885e96911",
-      "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '26e81021-2de6-4442-a74a-a77885e96911')]",
-      "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('26e81021-2de6-4442-a74a-a77885e96911')))]",
-      "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','26e81021-2de6-4442-a74a-a77885e96911','-', '1.1.3')))]"
-    },
-    "analyticRuleObject11": {
-      "analyticRuleVersion11": "1.0.0",
-      "_analyticRulecontentId11": "c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b",
-      "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b')]",
-      "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b')))]",
-      "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b','-', '1.0.0')))]"
-    },
-    "TemplateEmptyArray": "[json('[]')]",
-    "analyticRuleObject12": {
-      "analyticRuleVersion12": "1.0.0",
-      "_analyticRulecontentId12": "bb46dd86-e642-48a4-975c-44f5ac2b5033",
-      "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bb46dd86-e642-48a4-975c-44f5ac2b5033')]",
-      "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bb46dd86-e642-48a4-975c-44f5ac2b5033')))]",
-      "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bb46dd86-e642-48a4-975c-44f5ac2b5033','-', '1.0.0')))]"
-    },
-    "analyticRuleObject13": {
-      "analyticRuleVersion13": "1.0.0",
-      "_analyticRulecontentId13": "2c81c0a0-9823-4a14-b21a-2b4acd3335d2",
-      "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2c81c0a0-9823-4a14-b21a-2b4acd3335d2')]",
-      "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2c81c0a0-9823-4a14-b21a-2b4acd3335d2')))]",
-      "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2c81c0a0-9823-4a14-b21a-2b4acd3335d2','-', '1.0.0')))]"
-    },
-    "analyticRuleObject14": {
-      "analyticRuleVersion14": "1.0.0",
-      "_analyticRulecontentId14": "7ce00cba-f76f-4026-ab7f-7e4f1b67bd18",
-      "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7ce00cba-f76f-4026-ab7f-7e4f1b67bd18')]",
-      "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7ce00cba-f76f-4026-ab7f-7e4f1b67bd18')))]",
-      "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7ce00cba-f76f-4026-ab7f-7e4f1b67bd18','-', '1.0.0')))]"
-    },
-    "analyticRuleObject15": {
-      "analyticRuleVersion15": "1.0.0",
-      "_analyticRulecontentId15": "1be34fb9-f81b-47ae-84fb-465e6686d76c",
-      "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1be34fb9-f81b-47ae-84fb-465e6686d76c')]",
-      "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1be34fb9-f81b-47ae-84fb-465e6686d76c')))]",
-      "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1be34fb9-f81b-47ae-84fb-465e6686d76c','-', '1.0.0')))]"
-    },
-    "analyticRuleObject16": {
-      "analyticRuleVersion16": "1.0.0",
-      "_analyticRulecontentId16": "c332b840-61e4-462e-a201-0e2d69bad45d",
-      "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c332b840-61e4-462e-a201-0e2d69bad45d')]",
-      "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c332b840-61e4-462e-a201-0e2d69bad45d')))]",
-      "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c332b840-61e4-462e-a201-0e2d69bad45d','-', '1.0.0')))]"
-    },
-    "analyticRuleObject17": {
-      "analyticRuleVersion17": "1.0.0",
-      "_analyticRulecontentId17": "5bdc1504-880c-4b30-a39c-7c746535928d",
-      "analyticRuleId17": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5bdc1504-880c-4b30-a39c-7c746535928d')]",
-      "analyticRuleTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5bdc1504-880c-4b30-a39c-7c746535928d')))]",
-      "_analyticRulecontentProductId17": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5bdc1504-880c-4b30-a39c-7c746535928d','-', '1.0.0')))]"
-    },
-    "analyticRuleObject18": {
-      "analyticRuleVersion18": "1.0.0",
-      "_analyticRulecontentId18": "47c02e21-3949-4e05-a28e-576cd75ff6f6",
-      "analyticRuleId18": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '47c02e21-3949-4e05-a28e-576cd75ff6f6')]",
-      "analyticRuleTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('47c02e21-3949-4e05-a28e-576cd75ff6f6')))]",
-      "_analyticRulecontentProductId18": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','47c02e21-3949-4e05-a28e-576cd75ff6f6','-', '1.0.0')))]"
-    },
-    "analyticRuleObject19": {
-      "analyticRuleVersion19": "1.0.0",
-      "_analyticRulecontentId19": "36fbd4e7-5630-4414-aa42-702a7fdded21",
-      "analyticRuleId19": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '36fbd4e7-5630-4414-aa42-702a7fdded21')]",
-      "analyticRuleTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('36fbd4e7-5630-4414-aa42-702a7fdded21')))]",
-      "_analyticRulecontentProductId19": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','36fbd4e7-5630-4414-aa42-702a7fdded21','-', '1.0.0')))]"
-    },
-    "analyticRuleObject20": {
-      "analyticRuleVersion20": "1.0.0",
-      "_analyticRulecontentId20": "2624fc55-0998-4897-bb48-1c6422befce4",
-      "analyticRuleId20": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2624fc55-0998-4897-bb48-1c6422befce4')]",
-      "analyticRuleTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2624fc55-0998-4897-bb48-1c6422befce4')))]",
-      "_analyticRulecontentProductId20": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2624fc55-0998-4897-bb48-1c6422befce4','-', '1.0.0')))]"
-    },
-    "analyticRuleObject21": {
-      "analyticRuleVersion21": "1.0.0",
-      "_analyticRulecontentId21": "fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7",
-      "analyticRuleId21": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7')]",
-      "analyticRuleTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7')))]",
-      "_analyticRulecontentProductId21": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7','-', '1.0.0')))]"
-    },
-    "analyticRuleObject22": {
-      "analyticRuleVersion22": "1.0.0",
-      "_analyticRulecontentId22": "2a1dc4c2-a8d6-4a0e-8539-9b971c851195",
-      "analyticRuleId22": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2a1dc4c2-a8d6-4a0e-8539-9b971c851195')]",
-      "analyticRuleTemplateSpecName22": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2a1dc4c2-a8d6-4a0e-8539-9b971c851195')))]",
-      "_analyticRulecontentProductId22": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2a1dc4c2-a8d6-4a0e-8539-9b971c851195','-', '1.0.0')))]"
-    },
-    "analyticRuleObject23": {
-      "analyticRuleVersion23": "1.0.0",
-      "_analyticRulecontentId23": "174de33b-107b-4cd8-a85d-b4025a35453f",
-      "analyticRuleId23": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '174de33b-107b-4cd8-a85d-b4025a35453f')]",
-      "analyticRuleTemplateSpecName23": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('174de33b-107b-4cd8-a85d-b4025a35453f')))]",
-      "_analyticRulecontentProductId23": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','174de33b-107b-4cd8-a85d-b4025a35453f','-', '1.0.0')))]"
-    },
-    "analyticRuleObject24": {
-      "analyticRuleVersion24": "1.0.0",
-      "_analyticRulecontentId24": "12134de5-361b-427c-a1a0-d43f40a593c4",
-      "analyticRuleId24": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '12134de5-361b-427c-a1a0-d43f40a593c4')]",
-      "analyticRuleTemplateSpecName24": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('12134de5-361b-427c-a1a0-d43f40a593c4')))]",
-      "_analyticRulecontentProductId24": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','12134de5-361b-427c-a1a0-d43f40a593c4','-', '1.0.0')))]"
-    },
-    "analyticRuleObject25": {
-      "analyticRuleVersion25": "1.0.0",
-      "_analyticRulecontentId25": "3ab04acf-e0e7-4f7c-8995-748ab4c848c2",
-      "analyticRuleId25": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3ab04acf-e0e7-4f7c-8995-748ab4c848c2')]",
-      "analyticRuleTemplateSpecName25": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3ab04acf-e0e7-4f7c-8995-748ab4c848c2')))]",
-      "_analyticRulecontentProductId25": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3ab04acf-e0e7-4f7c-8995-748ab4c848c2','-', '1.0.0')))]"
-    },
-    "analyticRuleObject26": {
-      "analyticRuleVersion26": "1.0.0",
-      "_analyticRulecontentId26": "506f4d6b-3864-4bb1-8f75-a13fb066f97a",
-      "analyticRuleId26": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '506f4d6b-3864-4bb1-8f75-a13fb066f97a')]",
-      "analyticRuleTemplateSpecName26": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('506f4d6b-3864-4bb1-8f75-a13fb066f97a')))]",
-      "_analyticRulecontentProductId26": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','506f4d6b-3864-4bb1-8f75-a13fb066f97a','-', '1.0.0')))]"
-    },
-    "analyticRuleObject27": {
-      "analyticRuleVersion27": "1.0.3",
-      "_analyticRulecontentId27": "e5f8e196-3544-4a8b-96a9-17c1b6a49710",
-      "analyticRuleId27": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e5f8e196-3544-4a8b-96a9-17c1b6a49710')]",
-      "analyticRuleTemplateSpecName27": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e5f8e196-3544-4a8b-96a9-17c1b6a49710')))]",
-      "_analyticRulecontentProductId27": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e5f8e196-3544-4a8b-96a9-17c1b6a49710','-', '1.0.3')))]"
-    },
-    "analyticRuleObject28": {
-      "analyticRuleVersion28": "1.0.0",
-      "_analyticRulecontentId28": "35ab0d58-baab-4154-87ed-fa2f69797e9e",
-      "analyticRuleId28": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '35ab0d58-baab-4154-87ed-fa2f69797e9e')]",
-      "analyticRuleTemplateSpecName28": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('35ab0d58-baab-4154-87ed-fa2f69797e9e')))]",
-      "_analyticRulecontentProductId28": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35ab0d58-baab-4154-87ed-fa2f69797e9e','-', '1.0.0')))]"
-    },
-    "analyticRuleObject29": {
-      "analyticRuleVersion29": "1.0.0",
-      "_analyticRulecontentId29": "d29cc957-0ddb-4d00-8d6f-ad1bb345ff9a",
-      "analyticRuleId29": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd29cc957-0ddb-4d00-8d6f-ad1bb345ff9a')]",
-      "analyticRuleTemplateSpecName29": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d29cc957-0ddb-4d00-8d6f-ad1bb345ff9a')))]",
-      "_analyticRulecontentProductId29": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d29cc957-0ddb-4d00-8d6f-ad1bb345ff9a','-', '1.0.0')))]"
-    },
-    "analyticRuleObject30": {
-      "analyticRuleVersion30": "1.0.0",
-      "_analyticRulecontentId30": "450f4e56-5bba-4070-b9d9-9204ba9d777d",
-      "analyticRuleId30": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '450f4e56-5bba-4070-b9d9-9204ba9d777d')]",
-      "analyticRuleTemplateSpecName30": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('450f4e56-5bba-4070-b9d9-9204ba9d777d')))]",
-      "_analyticRulecontentProductId30": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','450f4e56-5bba-4070-b9d9-9204ba9d777d','-', '1.0.0')))]"
-    },
-    "analyticRuleObject31": {
-      "analyticRuleVersion31": "1.0.2",
-      "_analyticRulecontentId31": "63aa43c2-e88e-4102-aea5-0432851c541a",
-      "analyticRuleId31": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '63aa43c2-e88e-4102-aea5-0432851c541a')]",
-      "analyticRuleTemplateSpecName31": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('63aa43c2-e88e-4102-aea5-0432851c541a')))]",
-      "_analyticRulecontentProductId31": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','63aa43c2-e88e-4102-aea5-0432851c541a','-', '1.0.2')))]"
-    },
-    "analyticRuleObject32": {
-      "analyticRuleVersion32": "1.0.0",
-      "_analyticRulecontentId32": "91a451e3-178f-41b2-9e5d-da97d75b9971",
-      "analyticRuleId32": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '91a451e3-178f-41b2-9e5d-da97d75b9971')]",
-      "analyticRuleTemplateSpecName32": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('91a451e3-178f-41b2-9e5d-da97d75b9971')))]",
-      "_analyticRulecontentProductId32": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','91a451e3-178f-41b2-9e5d-da97d75b9971','-', '1.0.0')))]"
-    },
-    "analyticRuleObject33": {
-      "analyticRuleVersion33": "1.0.0",
-      "_analyticRulecontentId33": "32b29155-3fd3-4a9e-a0ca-a67e2593b60b",
-      "analyticRuleId33": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '32b29155-3fd3-4a9e-a0ca-a67e2593b60b')]",
-      "analyticRuleTemplateSpecName33": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('32b29155-3fd3-4a9e-a0ca-a67e2593b60b')))]",
-      "_analyticRulecontentProductId33": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','32b29155-3fd3-4a9e-a0ca-a67e2593b60b','-', '1.0.0')))]"
-    },
-    "analyticRuleObject34": {
-      "analyticRuleVersion34": "1.0.0",
-      "_analyticRulecontentId34": "03caa992-477f-4b19-8e2a-8cd58f8f9652",
-      "analyticRuleId34": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '03caa992-477f-4b19-8e2a-8cd58f8f9652')]",
-      "analyticRuleTemplateSpecName34": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('03caa992-477f-4b19-8e2a-8cd58f8f9652')))]",
-      "_analyticRulecontentProductId34": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','03caa992-477f-4b19-8e2a-8cd58f8f9652','-', '1.0.0')))]"
-    },
-    "analyticRuleObject35": {
-      "analyticRuleVersion35": "1.0.0",
-      "_analyticRulecontentId35": "7d0d3050-8dac-4b83-bfae-902f7dc0c21c",
-      "analyticRuleId35": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7d0d3050-8dac-4b83-bfae-902f7dc0c21c')]",
-      "analyticRuleTemplateSpecName35": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7d0d3050-8dac-4b83-bfae-902f7dc0c21c')))]",
-      "_analyticRulecontentProductId35": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7d0d3050-8dac-4b83-bfae-902f7dc0c21c','-', '1.0.0')))]"
-    },
-    "analyticRuleObject36": {
-      "analyticRuleVersion36": "1.0.0",
-      "_analyticRulecontentId36": "515d0bba-b297-4f83-8280-20ff7f27ecb1",
-      "analyticRuleId36": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '515d0bba-b297-4f83-8280-20ff7f27ecb1')]",
-      "analyticRuleTemplateSpecName36": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('515d0bba-b297-4f83-8280-20ff7f27ecb1')))]",
-      "_analyticRulecontentProductId36": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','515d0bba-b297-4f83-8280-20ff7f27ecb1','-', '1.0.0')))]"
-    },
-    "analyticRuleObject37": {
-      "analyticRuleVersion37": "1.0.0",
-      "_analyticRulecontentId37": "4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77",
-      "analyticRuleId37": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77')]",
-      "analyticRuleTemplateSpecName37": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77')))]",
-      "_analyticRulecontentProductId37": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77','-', '1.0.0')))]"
-    },
-    "analyticRuleObject38": {
-      "analyticRuleVersion38": "1.0.1",
-      "_analyticRulecontentId38": "4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d",
-      "analyticRuleId38": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d')]",
-      "analyticRuleTemplateSpecName38": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d')))]",
-      "_analyticRulecontentProductId38": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d','-', '1.0.1')))]"
-    },
-    "analyticRuleObject39": {
-      "analyticRuleVersion39": "1.0.0",
-      "_analyticRulecontentId39": "ba9db6b2-3d05-42ae-8aee-3a15bbe29f27",
-      "analyticRuleId39": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ba9db6b2-3d05-42ae-8aee-3a15bbe29f27')]",
-      "analyticRuleTemplateSpecName39": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ba9db6b2-3d05-42ae-8aee-3a15bbe29f27')))]",
-      "_analyticRulecontentProductId39": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ba9db6b2-3d05-42ae-8aee-3a15bbe29f27','-', '1.0.0')))]"
-    },
-    "analyticRuleObject40": {
-      "analyticRuleVersion40": "1.0.0",
-      "_analyticRulecontentId40": "28c63a44-2d35-48b7-831b-3ed24af17c7e",
-      "analyticRuleId40": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '28c63a44-2d35-48b7-831b-3ed24af17c7e')]",
-      "analyticRuleTemplateSpecName40": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('28c63a44-2d35-48b7-831b-3ed24af17c7e')))]",
-      "_analyticRulecontentProductId40": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','28c63a44-2d35-48b7-831b-3ed24af17c7e','-', '1.0.0')))]"
-    },
-    "huntingQueryObject1": {
-      "huntingQueryVersion1": "1.1.0",
-      "_huntingQuerycontentId1": "cdac93ef-56c0-45bf-9e7f-9cbf0ad06808",
-      "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdac93ef-56c0-45bf-9e7f-9cbf0ad06808')))]"
-    },
-    "huntingQueryObject2": {
-      "huntingQueryVersion2": "1.0.0",
-      "_huntingQuerycontentId2": "4d11f63f-5b64-416e-8d77-266e4c6d382e",
-      "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4d11f63f-5b64-416e-8d77-266e4c6d382e')))]"
-    },
-    "huntingQueryObject3": {
-      "huntingQueryVersion3": "1.0.0",
-      "_huntingQuerycontentId3": "d7b7dcad-d806-4a61-b8fc-0d7c9c45bdec",
-      "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d7b7dcad-d806-4a61-b8fc-0d7c9c45bdec')))]"
-    },
-    "huntingQueryObject4": {
-      "huntingQueryVersion4": "1.0.0",
-      "_huntingQuerycontentId4": "fe9edc77-1b6c-4f1e-a223-64b580b50187",
-      "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fe9edc77-1b6c-4f1e-a223-64b580b50187')))]"
-    },
-    "huntingQueryObject5": {
-      "huntingQueryVersion5": "1.0.0",
-      "_huntingQuerycontentId5": "147c4c0a-7241-4ce9-9b71-0aecb8a2b59f",
-      "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('147c4c0a-7241-4ce9-9b71-0aecb8a2b59f')))]"
-    },
-    "huntingQueryObject6": {
-      "huntingQueryVersion6": "1.0.0",
-      "_huntingQuerycontentId6": "8fe88892-3a55-4220-9141-939a8e7a15c5",
-      "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8fe88892-3a55-4220-9141-939a8e7a15c5')))]"
-    },
-    "huntingQueryObject7": {
-      "huntingQueryVersion7": "1.0.0",
-      "_huntingQuerycontentId7": "e7791695-c103-4d20-a75a-53e90788616b",
-      "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e7791695-c103-4d20-a75a-53e90788616b')))]"
-    },
-    "huntingQueryObject8": {
-      "huntingQueryVersion8": "1.0.0",
-      "_huntingQuerycontentId8": "846bf25e-3d2d-4122-9b60-adfadd2fc616",
-      "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('846bf25e-3d2d-4122-9b60-adfadd2fc616')))]"
-    },
-    "huntingQueryObject9": {
-      "huntingQueryVersion9": "1.0.0",
-      "_huntingQuerycontentId9": "1850a459-b009-43d0-a575-8284b737eef8",
-      "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1850a459-b009-43d0-a575-8284b737eef8')))]"
-    },
-    "huntingQueryObject10": {
-      "huntingQueryVersion10": "1.0.0",
-      "_huntingQuerycontentId10": "d6991ef1-b225-4780-b6a6-cfe9b5278f5e",
-      "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d6991ef1-b225-4780-b6a6-cfe9b5278f5e')))]"
-    },
-    "huntingQueryObject11": {
-      "huntingQueryVersion11": "1.0.0",
-      "_huntingQuerycontentId11": "4713d763-122d-419c-bf6f-bdef111cd8e2",
-      "huntingQueryTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4713d763-122d-419c-bf6f-bdef111cd8e2')))]"
-    },
-    "huntingQueryObject12": {
-      "huntingQueryVersion12": "1.0.0",
-      "_huntingQuerycontentId12": "b3470e40-39ae-4c28-9282-440038f6f964",
-      "huntingQueryTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3470e40-39ae-4c28-9282-440038f6f964')))]"
-    },
-    "huntingQueryObject13": {
-      "huntingQueryVersion13": "1.0.0",
-      "_huntingQuerycontentId13": "a18e8bcf-e05d-4e45-bc6e-2c5004729fbd",
-      "huntingQueryTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a18e8bcf-e05d-4e45-bc6e-2c5004729fbd')))]"
-    },
-    "huntingQueryObject14": {
-      "huntingQueryVersion14": "1.1.1",
-      "_huntingQuerycontentId14": "cdac93ef-56c0-45bf-9e7f-9cbf0ad034234",
-      "huntingQueryTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdac93ef-56c0-45bf-9e7f-9cbf0ad034234')))]"
-    },
-    "huntingQueryObject15": {
-      "huntingQueryVersion15": "1.0.0",
-      "_huntingQuerycontentId15": "f78255b6-8f91-4cf3-a25c-e1144b7b5425",
-      "huntingQueryTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f78255b6-8f91-4cf3-a25c-e1144b7b5425')))]"
-    },
-    "huntingQueryObject16": {
-      "huntingQueryVersion16": "1.0.0",
-      "_huntingQuerycontentId16": "76c14475-9a22-4cc1-922c-437d7f614a36",
-      "huntingQueryTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('76c14475-9a22-4cc1-922c-437d7f614a36')))]"
-    },
-    "huntingQueryObject17": {
-      "huntingQueryVersion17": "1.0.0",
-      "_huntingQuerycontentId17": "89b31213-4350-4730-8d27-26667ce53894",
-      "huntingQueryTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('89b31213-4350-4730-8d27-26667ce53894')))]"
-    },
-    "huntingQueryObject18": {
-      "huntingQueryVersion18": "1.0.0",
-      "_huntingQuerycontentId18": "79f9bb6b-6d31-412e-b3bc-6e5ad1303112",
-      "huntingQueryTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('79f9bb6b-6d31-412e-b3bc-6e5ad1303112')))]"
-    },
-    "huntingQueryObject19": {
-      "huntingQueryVersion19": "1.0.0",
-      "_huntingQuerycontentId19": "0b985ed8-aacd-41ba-9b17-489be9224159",
-      "huntingQueryTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0b985ed8-aacd-41ba-9b17-489be9224159')))]"
-    },
-    "huntingQueryObject20": {
-      "huntingQueryVersion20": "1.0.0",
-      "_huntingQuerycontentId20": "6284b962-ab0d-46d8-a47f-1eb1ac1be463",
-      "huntingQueryTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6284b962-ab0d-46d8-a47f-1eb1ac1be463')))]"
-    },
-    "huntingQueryObject21": {
-      "huntingQueryVersion21": "1.0.0",
-      "_huntingQuerycontentId21": "abf42310-51c7-4d7f-98d2-e5af09859aab",
-      "huntingQueryTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('abf42310-51c7-4d7f-98d2-e5af09859aab')))]"
-    },
-    "huntingQueryObject22": {
-      "huntingQueryVersion22": "1.0.0",
-      "_huntingQuerycontentId22": "63ecff0f-3a86-468b-8c9e-a7a88fe33ebb",
-      "huntingQueryTemplateSpecName22": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('63ecff0f-3a86-468b-8c9e-a7a88fe33ebb')))]"
-    },
-    "huntingQueryObject23": {
-      "huntingQueryVersion23": "1.0.0",
-      "_huntingQuerycontentId23": "b1f8aac2-766d-47ec-8787-84bc7692ff77",
-      "huntingQueryTemplateSpecName23": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b1f8aac2-766d-47ec-8787-84bc7692ff77')))]"
-    },
-    "huntingQueryObject24": {
-      "huntingQueryVersion24": "1.0.0",
-      "_huntingQuerycontentId24": "54ea2379-28e7-48e1-8dfd-aaf8fb1331ba",
-      "huntingQueryTemplateSpecName24": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('54ea2379-28e7-48e1-8dfd-aaf8fb1331ba')))]"
-    },
-    "huntingQueryObject25": {
-      "huntingQueryVersion25": "1.0.2",
-      "_huntingQuerycontentId25": "cdac93ef-56c0-45bf-9e7f-9cbf0ad06567",
-      "huntingQueryTemplateSpecName25": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdac93ef-56c0-45bf-9e7f-9cbf0ad06567')))]"
-    },
-    "huntingQueryObject26": {
-      "huntingQueryVersion26": "1.0.0",
-      "_huntingQuerycontentId26": "fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7",
-      "huntingQueryTemplateSpecName26": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7')))]"
-    },
-    "huntingQueryObject27": {
-      "huntingQueryVersion27": "1.0.0",
-      "_huntingQuerycontentId27": "29683151-e15d-4c0c-845b-892be89bf080",
-      "huntingQueryTemplateSpecName27": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('29683151-e15d-4c0c-845b-892be89bf080')))]"
-    },
-    "huntingQueryObject28": {
-      "huntingQueryVersion28": "1.0.0",
-      "_huntingQuerycontentId28": "518e6938-10ef-4165-af19-82f1287141bc",
-      "huntingQueryTemplateSpecName28": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('518e6938-10ef-4165-af19-82f1287141bc')))]"
-    },
-    "huntingQueryObject29": {
-      "huntingQueryVersion29": "1.0.0",
-      "_huntingQuerycontentId29": "b6392f39-a1f4-4ec8-8689-4cb9d28c295a",
-      "huntingQueryTemplateSpecName29": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b6392f39-a1f4-4ec8-8689-4cb9d28c295a')))]"
-    },
-    "huntingQueryObject30": {
-      "huntingQueryVersion30": "1.0.0",
-      "_huntingQuerycontentId30": "16eda414-1550-4cdc-8512-0769901d3f05",
-      "huntingQueryTemplateSpecName30": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('16eda414-1550-4cdc-8512-0769901d3f05')))]"
-    },
-    "huntingQueryObject31": {
-      "huntingQueryVersion31": "1.0.0",
-      "_huntingQuerycontentId31": "7fbf7687-5ded-4c39-9fe9-f4f6aa6fc422",
-      "huntingQueryTemplateSpecName31": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7fbf7687-5ded-4c39-9fe9-f4f6aa6fc422')))]"
-    },
-    "huntingQueryObject32": {
-      "huntingQueryVersion32": "1.0.0",
-      "_huntingQuerycontentId32": "eb560458-d96f-4c68-acbb-14b3c706ebe7",
-      "huntingQueryTemplateSpecName32": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('eb560458-d96f-4c68-acbb-14b3c706ebe7')))]"
-    },
-    "huntingQueryObject33": {
-      "huntingQueryVersion33": "1.0.0",
-      "_huntingQuerycontentId33": "14d47b2a-62b3-4c7b-819c-699e264c581d",
-      "huntingQueryTemplateSpecName33": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('14d47b2a-62b3-4c7b-819c-699e264c581d')))]"
-    },
-    "huntingQueryObject34": {
-      "huntingQueryVersion34": "1.0.0",
-      "_huntingQuerycontentId34": "62d6a2e6-4583-4538-a476-a5b3c672657b",
-      "huntingQueryTemplateSpecName34": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('62d6a2e6-4583-4538-a476-a5b3c672657b')))]"
-    },
-    "huntingQueryObject35": {
-      "huntingQueryVersion35": "1.0.0",
-      "_huntingQuerycontentId35": "79755078-7be8-4f13-a8e7-1ce87cb7d5c0",
-      "huntingQueryTemplateSpecName35": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('79755078-7be8-4f13-a8e7-1ce87cb7d5c0')))]"
-    },
-    "huntingQueryObject36": {
-      "huntingQueryVersion36": "1.0.0",
-      "_huntingQuerycontentId36": "5971f2e7-1bb2-4170-aa7a-577ed8a45c72",
-      "huntingQueryTemplateSpecName36": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5971f2e7-1bb2-4170-aa7a-577ed8a45c72')))]"
-    },
-    "huntingQueryObject37": {
-      "huntingQueryVersion37": "1.1.0",
-      "_huntingQuerycontentId37": "3dbaa9c1-5e69-40a9-bacb-8cbdb4a0e6cb",
-      "huntingQueryTemplateSpecName37": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3dbaa9c1-5e69-40a9-bacb-8cbdb4a0e6cb')))]"
-    },
-    "huntingQueryObject38": {
-      "huntingQueryVersion38": "1.1.0",
-      "_huntingQuerycontentId38": "23b646e8-b885-4cde-a9ab-1e35fa5e37a7",
-      "huntingQueryTemplateSpecName38": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('23b646e8-b885-4cde-a9ab-1e35fa5e37a7')))]"
-    },
-    "huntingQueryObject39": {
-      "huntingQueryVersion39": "1.1.0",
-      "_huntingQuerycontentId39": "ba97d6b9-f82e-4917-9c07-4c0028bbd32d",
-      "huntingQueryTemplateSpecName39": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ba97d6b9-f82e-4917-9c07-4c0028bbd32d')))]"
-    },
-    "huntingQueryObject40": {
-      "huntingQueryVersion40": "1.0.0",
-      "_huntingQuerycontentId40": "4c021477-38f0-409e-869b-11056fcd47f1",
-      "huntingQueryTemplateSpecName40": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4c021477-38f0-409e-869b-11056fcd47f1')))]"
-    },
-    "huntingQueryObject41": {
-      "huntingQueryVersion41": "1.0.0",
-      "_huntingQuerycontentId41": "a8c66aec-2000-45d8-8481-36aaa17f1033",
-      "huntingQueryTemplateSpecName41": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a8c66aec-2000-45d8-8481-36aaa17f1033')))]"
-    },
-    "huntingQueryObject42": {
-      "huntingQueryVersion42": "1.0.1",
-      "_huntingQuerycontentId42": "08113d6f-3c95-45ba-94df-4fdd7f35d944",
-      "huntingQueryTemplateSpecName42": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('08113d6f-3c95-45ba-94df-4fdd7f35d944')))]"
-    },
-    "huntingQueryObject43": {
-      "huntingQueryVersion43": "1.0.0",
-      "_huntingQuerycontentId43": "1b56831b-3713-4c9c-ac75-a7e330623076",
-      "huntingQueryTemplateSpecName43": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1b56831b-3713-4c9c-ac75-a7e330623076')))]"
-    },
-    "huntingQueryObject44": {
-      "huntingQueryVersion44": "1.0.0",
-      "_huntingQuerycontentId44": "ba1a91ad-1f99-4386-b191-06a76ef213f8",
-      "huntingQueryTemplateSpecName44": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ba1a91ad-1f99-4386-b191-06a76ef213f8')))]"
-    },
-    "huntingQueryObject45": {
-      "huntingQueryVersion45": "1.0.0",
-      "_huntingQuerycontentId45": "242561f3-568a-4864-be15-fbc85b2e77f9",
-      "huntingQueryTemplateSpecName45": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('242561f3-568a-4864-be15-fbc85b2e77f9')))]"
-    },
-    "huntingQueryObject46": {
-      "huntingQueryVersion46": "1.0.0",
-      "_huntingQuerycontentId46": "ff56a21d-fc95-4c11-8f9d-cc59c48cd4e6",
-      "huntingQueryTemplateSpecName46": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ff56a21d-fc95-4c11-8f9d-cc59c48cd4e6')))]"
-    },
-    "huntingQueryObject47": {
-      "huntingQueryVersion47": "1.0.0",
-      "_huntingQuerycontentId47": "0d5ae69d-bdb2-404d-8c8c-50ebe68b6a5b",
-      "huntingQueryTemplateSpecName47": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0d5ae69d-bdb2-404d-8c8c-50ebe68b6a5b')))]"
-    },
-    "huntingQueryObject48": {
-      "huntingQueryVersion48": "1.0.0",
-      "_huntingQuerycontentId48": "e55e178e-48ba-4313-918a-2d3e16a95441",
-      "huntingQueryTemplateSpecName48": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e55e178e-48ba-4313-918a-2d3e16a95441')))]"
-    },
-    "huntingQueryObject49": {
-      "huntingQueryVersion49": "1.0.0",
-      "_huntingQuerycontentId49": "bc2d8214-afb6-4876-b210-25b69325b9b2",
-      "huntingQueryTemplateSpecName49": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bc2d8214-afb6-4876-b210-25b69325b9b2')))]"
-    },
-    "huntingQueryObject50": {
-      "huntingQueryVersion50": "1.0.0",
-      "_huntingQuerycontentId50": "712ffdd8-ddce-4372-85dd-063029b418cf",
-      "huntingQueryTemplateSpecName50": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('712ffdd8-ddce-4372-85dd-063029b418cf')))]"
-    },
-    "huntingQueryObject51": {
-      "huntingQueryVersion51": "1.0.0",
-      "_huntingQuerycontentId51": "81ede5df-2ec3-40a5-9dff-1fe6a841079d",
-      "huntingQueryTemplateSpecName51": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('81ede5df-2ec3-40a5-9dff-1fe6a841079d')))]"
-    },
-    "huntingQueryObject52": {
-      "huntingQueryVersion52": "1.0.0",
-      "_huntingQuerycontentId52": "63c799bc-7567-4e4d-97be-e143fcfaa333",
-      "huntingQueryTemplateSpecName52": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('63c799bc-7567-4e4d-97be-e143fcfaa333')))]"
-    },
-    "huntingQueryObject53": {
-      "huntingQueryVersion53": "1.0.0",
-      "_huntingQuerycontentId53": "deb4b2c6-c10e-4044-8cf4-84243e40db73",
-      "huntingQueryTemplateSpecName53": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('deb4b2c6-c10e-4044-8cf4-84243e40db73')))]"
-    },
-    "huntingQueryObject54": {
-      "huntingQueryVersion54": "1.0.0",
-      "_huntingQuerycontentId54": "92b76a34-502e-4a53-93ec-9fc37c3b358c",
-      "huntingQueryTemplateSpecName54": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('92b76a34-502e-4a53-93ec-9fc37c3b358c')))]"
-    },
-    "huntingQueryObject55": {
-      "huntingQueryVersion55": "1.1.0",
-      "_huntingQuerycontentId55": "af183f01-6d98-4fca-8ca4-63577b78a26e",
-      "huntingQueryTemplateSpecName55": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('af183f01-6d98-4fca-8ca4-63577b78a26e')))]"
-    },
-    "huntingQueryObject56": {
-      "huntingQueryVersion56": "1.1.0",
-      "_huntingQuerycontentId56": "530ef5e4-7ee4-4d70-a8e2-a06459605c02",
-      "huntingQueryTemplateSpecName56": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('530ef5e4-7ee4-4d70-a8e2-a06459605c02')))]"
-    },
-    "huntingQueryObject57": {
-      "huntingQueryVersion57": "1.1.0",
-      "_huntingQuerycontentId57": "db9789ab-0636-4ea6-b779-1b72b4b64aac",
-      "huntingQueryTemplateSpecName57": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('db9789ab-0636-4ea6-b779-1b72b4b64aac')))]"
-    },
-    "huntingQueryObject58": {
-      "huntingQueryVersion58": "1.0.0",
-      "_huntingQuerycontentId58": "86c7d21b-2081-419d-bc2e-7bc909d61eef",
-      "huntingQueryTemplateSpecName58": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('86c7d21b-2081-419d-bc2e-7bc909d61eef')))]"
-    },
-    "huntingQueryObject59": {
-      "huntingQueryVersion59": "1.0.0",
-      "_huntingQuerycontentId59": "6f606826-b995-4a8d-8c2c-ee08e3d1194a",
-      "huntingQueryTemplateSpecName59": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6f606826-b995-4a8d-8c2c-ee08e3d1194a')))]"
-    },
-    "huntingQueryObject60": {
-      "huntingQueryVersion60": "1.1.0",
-      "_huntingQuerycontentId60": "b8330f6e-fc47-40ce-b225-5d3b055c6446",
-      "huntingQueryTemplateSpecName60": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b8330f6e-fc47-40ce-b225-5d3b055c6446')))]"
-    },
-    "huntingQueryObject61": {
-      "huntingQueryVersion61": "1.0.0",
-      "_huntingQuerycontentId61": "7d7a3d3f-22db-4cdf-ba67-c57215777a3c",
-      "huntingQueryTemplateSpecName61": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7d7a3d3f-22db-4cdf-ba67-c57215777a3c')))]"
-    },
-    "huntingQueryObject62": {
-      "huntingQueryVersion62": "1.0.0",
-      "_huntingQuerycontentId62": "eb0e4edb-f423-49f8-a02a-4ededdd30dd5",
-      "huntingQueryTemplateSpecName62": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('eb0e4edb-f423-49f8-a02a-4ededdd30dd5')))]"
-    },
-    "huntingQueryObject63": {
-      "huntingQueryVersion63": "1.0.0",
-      "_huntingQuerycontentId63": "0717b136-a1ef-4af0-a911-e189d0064099",
-      "huntingQueryTemplateSpecName63": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0717b136-a1ef-4af0-a911-e189d0064099')))]"
-    },
-    "huntingQueryObject64": {
-      "huntingQueryVersion64": "1.0.0",
-      "_huntingQuerycontentId64": "0955f477-6471-468a-9b13-fc5fa96d7db2",
-      "huntingQueryTemplateSpecName64": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0955f477-6471-468a-9b13-fc5fa96d7db2')))]"
-    },
-    "huntingQueryObject65": {
-      "huntingQueryVersion65": "1.0.0",
-      "_huntingQuerycontentId65": "85dea577-1c76-44ff-8cad-b47182874ddb",
-      "huntingQueryTemplateSpecName65": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('85dea577-1c76-44ff-8cad-b47182874ddb')))]"
-    },
-    "huntingQueryObject66": {
-      "huntingQueryVersion66": "1.0.0",
-      "_huntingQuerycontentId66": "da745698-da8a-40c5-b527-2e9328c2cefe",
-      "huntingQueryTemplateSpecName66": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('da745698-da8a-40c5-b527-2e9328c2cefe')))]"
-    },
-    "huntingQueryObject67": {
-      "huntingQueryVersion67": "1.0.0",
-      "_huntingQuerycontentId67": "c1cac5ad-7aaa-40de-89aa-954f5a33a578",
-      "huntingQueryTemplateSpecName67": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c1cac5ad-7aaa-40de-89aa-954f5a33a578')))]"
-    },
-    "huntingQueryObject68": {
-      "huntingQueryVersion68": "1.0.0",
-      "_huntingQuerycontentId68": "8e9a96dd-f85d-4f5e-a65f-dcc55d6d9935",
-      "huntingQueryTemplateSpecName68": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8e9a96dd-f85d-4f5e-a65f-dcc55d6d9935')))]"
-    },
-    "huntingQueryObject69": {
-      "huntingQueryVersion69": "1.0.0",
-      "_huntingQuerycontentId69": "11cc0e3f-9718-4ab5-be7b-d9c036ed6b0a",
-      "huntingQueryTemplateSpecName69": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('11cc0e3f-9718-4ab5-be7b-d9c036ed6b0a')))]"
-    },
-    "huntingQueryObject70": {
-      "huntingQueryVersion70": "1.0.0",
-      "_huntingQuerycontentId70": "e6259b03-622e-4e11-9c54-94987dad7c14",
-      "huntingQueryTemplateSpecName70": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e6259b03-622e-4e11-9c54-94987dad7c14')))]"
-    },
-    "huntingQueryObject71": {
-      "huntingQueryVersion71": "1.0.0",
-      "_huntingQuerycontentId71": "dd4a480b-aa24-4b62-b1f3-f538d8abbdfb",
-      "huntingQueryTemplateSpecName71": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dd4a480b-aa24-4b62-b1f3-f538d8abbdfb')))]"
-    },
-    "huntingQueryObject72": {
-      "huntingQueryVersion72": "1.0.0",
-      "_huntingQuerycontentId72": "fb46ca1b-0b46-4d9c-b3b3-2f8f807e9f72",
-      "huntingQueryTemplateSpecName72": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fb46ca1b-0b46-4d9c-b3b3-2f8f807e9f72')))]"
-    },
-    "huntingQueryObject73": {
-      "huntingQueryVersion73": "1.0.0",
-      "_huntingQuerycontentId73": "0da830c3-5d0e-4b98-bfa1-d5131a8d0ebe",
-      "huntingQueryTemplateSpecName73": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0da830c3-5d0e-4b98-bfa1-d5131a8d0ebe')))]"
-    },
-    "huntingQueryObject74": {
-      "huntingQueryVersion74": "1.0.0",
-      "_huntingQuerycontentId74": "57f95ba7-938d-4a76-b411-c01034c0d167",
-      "huntingQueryTemplateSpecName74": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('57f95ba7-938d-4a76-b411-c01034c0d167')))]"
-    },
-    "huntingQueryObject75": {
-      "huntingQueryVersion75": "1.0.0",
-      "_huntingQuerycontentId75": "54569b06-47fc-41ae-9b00-f7d9b61337b6",
-      "huntingQueryTemplateSpecName75": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('54569b06-47fc-41ae-9b00-f7d9b61337b6')))]"
-    },
-    "huntingQueryObject76": {
-      "huntingQueryVersion76": "1.0.0",
-      "_huntingQuerycontentId76": "430a9c0d-f3ce-46a3-a994-92b3ada0d1b2",
-      "huntingQueryTemplateSpecName76": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('430a9c0d-f3ce-46a3-a994-92b3ada0d1b2')))]"
-    },
-    "huntingQueryObject77": {
-      "huntingQueryVersion77": "1.0.0",
-      "_huntingQuerycontentId77": "f840db5b-87c9-43c8-a8c3-5b6b83838cd4",
-      "huntingQueryTemplateSpecName77": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f840db5b-87c9-43c8-a8c3-5b6b83838cd4')))]"
-    },
-    "huntingQueryObject78": {
-      "huntingQueryVersion78": "1.0.0",
-      "_huntingQuerycontentId78": "b95994d1-1008-4c42-a74f-9f2967e39ed6",
-      "huntingQueryTemplateSpecName78": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b95994d1-1008-4c42-a74f-9f2967e39ed6')))]"
-    },
-    "huntingQueryObject79": {
-      "huntingQueryVersion79": "1.0.0",
-      "_huntingQuerycontentId79": "a96c1571-1f7d-48dc-8287-7df5a5f0d987",
-      "huntingQueryTemplateSpecName79": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a96c1571-1f7d-48dc-8287-7df5a5f0d987')))]"
-    },
-    "huntingQueryObject80": {
-      "huntingQueryVersion80": "1.0.0",
-      "_huntingQuerycontentId80": "2c6e7f75-d83c-4344-afdc-83335fe550e6",
-      "huntingQueryTemplateSpecName80": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2c6e7f75-d83c-4344-afdc-83335fe550e6')))]"
-    },
-    "huntingQueryObject81": {
-      "huntingQueryVersion81": "1.0.0",
-      "_huntingQuerycontentId81": "38d6e2fb-a804-4170-8d32-d251ecd6bcd2",
-      "huntingQueryTemplateSpecName81": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('38d6e2fb-a804-4170-8d32-d251ecd6bcd2')))]"
-    },
-    "huntingQueryObject82": {
-      "huntingQueryVersion82": "1.0.0",
-      "_huntingQuerycontentId82": "1c51e10e-7f77-40bc-bd37-6aa55cdf94d6",
-      "huntingQueryTemplateSpecName82": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1c51e10e-7f77-40bc-bd37-6aa55cdf94d6')))]"
-    },
-    "huntingQueryObject83": {
-      "huntingQueryVersion83": "1.0.0",
-      "_huntingQuerycontentId83": "da7b973a-0045-4fd6-9161-269369336d24",
-      "huntingQueryTemplateSpecName83": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('da7b973a-0045-4fd6-9161-269369336d24')))]"
-    },
-    "huntingQueryObject84": {
-      "huntingQueryVersion84": "1.0.0",
-      "_huntingQuerycontentId84": "6b478186-da3b-4d71-beaa-aa5b42908499",
-      "huntingQueryTemplateSpecName84": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6b478186-da3b-4d71-beaa-aa5b42908499')))]"
-    },
-    "huntingQueryObject85": {
-      "huntingQueryVersion85": "1.0.0",
-      "_huntingQuerycontentId85": "da932998-81dd-4be4-963c-f4890cb4192e",
-      "huntingQueryTemplateSpecName85": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('da932998-81dd-4be4-963c-f4890cb4192e')))]"
-    },
-    "huntingQueryObject86": {
-      "huntingQueryVersion86": "1.0.0",
-      "_huntingQuerycontentId86": "b2beec6a-2c1c-4319-a191-e70c2ee42857",
-      "huntingQueryTemplateSpecName86": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b2beec6a-2c1c-4319-a191-e70c2ee42857')))]"
-    },
-    "huntingQueryObject87": {
-      "huntingQueryVersion87": "1.0.0",
-      "_huntingQuerycontentId87": "45c47684-6650-44b6-81c0-951522d0c435",
-      "huntingQueryTemplateSpecName87": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('45c47684-6650-44b6-81c0-951522d0c435')))]"
-    },
-    "huntingQueryObject88": {
-      "huntingQueryVersion88": "1.0.0",
-      "_huntingQuerycontentId88": "99e1246e-c1a9-4794-8e96-eb906c73c529",
-      "huntingQueryTemplateSpecName88": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('99e1246e-c1a9-4794-8e96-eb906c73c529')))]"
-    },
-    "huntingQueryObject89": {
-      "huntingQueryVersion89": "1.0.0",
-      "_huntingQuerycontentId89": "12225f50-9d41-4b78-8269-cc127d98654c",
-      "huntingQueryTemplateSpecName89": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('12225f50-9d41-4b78-8269-cc127d98654c')))]"
-    },
-    "huntingQueryObject90": {
-      "huntingQueryVersion90": "1.0.0",
-      "_huntingQuerycontentId90": "cadf6e78-2a9a-4fb5-b788-30a592d699d3",
-      "huntingQueryTemplateSpecName90": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cadf6e78-2a9a-4fb5-b788-30a592d699d3')))]"
-    },
-    "huntingQueryObject91": {
-      "huntingQueryVersion91": "1.0.0",
-      "_huntingQuerycontentId91": "95b0c7ed-2853-4343-80a9-ab076cf31e51",
-      "huntingQueryTemplateSpecName91": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('95b0c7ed-2853-4343-80a9-ab076cf31e51')))]"
-    },
-    "huntingQueryObject92": {
-      "huntingQueryVersion92": "1.0.0",
-      "_huntingQuerycontentId92": "439f817c-845c-4dda-a8d9-5c1f6831cee9",
-      "huntingQueryTemplateSpecName92": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('439f817c-845c-4dda-a8d9-5c1f6831cee9')))]"
-    },
-    "huntingQueryObject93": {
-      "huntingQueryVersion93": "1.0.0",
-      "_huntingQuerycontentId93": "07c85687-6dee-4266-9345-1e34de85d989",
-      "huntingQueryTemplateSpecName93": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('07c85687-6dee-4266-9345-1e34de85d989')))]"
-    },
-    "huntingQueryObject94": {
-      "huntingQueryVersion94": "1.0.0",
-      "_huntingQuerycontentId94": "23dbd58b-23ce-42ae-b4d1-0dfdd35871ea",
-      "huntingQueryTemplateSpecName94": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('23dbd58b-23ce-42ae-b4d1-0dfdd35871ea')))]"
-    },
-    "huntingQueryObject95": {
-      "huntingQueryVersion95": "1.0.0",
-      "_huntingQuerycontentId95": "817043be-4b30-4e66-a742-8f601a78b08f",
-      "huntingQueryTemplateSpecName95": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('817043be-4b30-4e66-a742-8f601a78b08f')))]"
-    },
-    "huntingQueryObject96": {
-      "huntingQueryVersion96": "1.0.0",
-      "_huntingQuerycontentId96": "a924de5a-89ce-43c7-8adc-b130e5f1924c",
-      "huntingQueryTemplateSpecName96": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a924de5a-89ce-43c7-8adc-b130e5f1924c')))]"
-    },
-    "huntingQueryObject97": {
-      "huntingQueryVersion97": "1.0.0",
-      "_huntingQuerycontentId97": "2de2de5d-87a3-4e13-9b97-5f42e44d0954",
-      "huntingQueryTemplateSpecName97": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2de2de5d-87a3-4e13-9b97-5f42e44d0954')))]"
-    },
-    "huntingQueryObject98": {
-      "huntingQueryVersion98": "1.1.0",
-      "_huntingQuerycontentId98": "e1dbe1d2-785a-4ecd-a1c0-233fc0e990bc",
-      "huntingQueryTemplateSpecName98": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e1dbe1d2-785a-4ecd-a1c0-233fc0e990bc')))]"
-    },
-    "huntingQueryObject99": {
-      "huntingQueryVersion99": "1.1.0",
-      "_huntingQuerycontentId99": "b3a4b803-06f6-46d8-9220-b3a53e85ce4f",
-      "huntingQueryTemplateSpecName99": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3a4b803-06f6-46d8-9220-b3a53e85ce4f')))]"
-    },
-    "huntingQueryObject100": {
-      "huntingQueryVersion100": "1.1.0",
-      "_huntingQuerycontentId100": "db79eb5a-785a-400a-a7ef-7285dde8e116",
-      "huntingQueryTemplateSpecName100": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('db79eb5a-785a-400a-a7ef-7285dde8e116')))]"
-    },
-    "huntingQueryObject101": {
-      "huntingQueryVersion101": "1.1.0",
-      "_huntingQuerycontentId101": "15d255f7-57a6-4b23-bd89-376930d3a305",
-      "huntingQueryTemplateSpecName101": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('15d255f7-57a6-4b23-bd89-376930d3a305')))]"
-    },
-    "huntingQueryObject102": {
-      "huntingQueryVersion102": "1.0.0",
-      "_huntingQuerycontentId102": "ef29d6b6-9192-46aa-b16a-082c2da2f78f",
-      "huntingQueryTemplateSpecName102": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ef29d6b6-9192-46aa-b16a-082c2da2f78f')))]"
-    },
-    "huntingQueryObject103": {
-      "huntingQueryVersion103": "1.0.0",
-      "_huntingQuerycontentId103": "af541ae2-9bb4-4737-a8ea-4fa261bc3866",
-      "huntingQueryTemplateSpecName103": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('af541ae2-9bb4-4737-a8ea-4fa261bc3866')))]"
-    },
-    "huntingQueryObject104": {
-      "huntingQueryVersion104": "1.0.0",
-      "_huntingQuerycontentId104": "a2a7bede-cf55-47ed-9aeb-7b4c97079f4f",
-      "huntingQueryTemplateSpecName104": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a2a7bede-cf55-47ed-9aeb-7b4c97079f4f')))]"
-    },
-    "huntingQueryObject105": {
-      "huntingQueryVersion105": "1.1.0",
-      "_huntingQuerycontentId105": "0d16e85e-82ec-460a-bf48-e90164464f7c",
-      "huntingQueryTemplateSpecName105": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0d16e85e-82ec-460a-bf48-e90164464f7c')))]"
-    },
-    "huntingQueryObject106": {
-      "huntingQueryVersion106": "1.0.0",
-      "_huntingQuerycontentId106": "c6bbcac2-a6b8-4537-a32a-6f1367e6aa44",
-      "huntingQueryTemplateSpecName106": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c6bbcac2-a6b8-4537-a32a-6f1367e6aa44')))]"
-    },
-    "huntingQueryObject107": {
-      "huntingQueryVersion107": "1.1.0",
-      "_huntingQuerycontentId107": "a370ad6f-e7fa-4740-ab9e-cb5560e3599f",
-      "huntingQueryTemplateSpecName107": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a370ad6f-e7fa-4740-ab9e-cb5560e3599f')))]"
-    },
-    "huntingQueryObject108": {
-      "huntingQueryVersion108": "1.0.0",
-      "_huntingQuerycontentId108": "c3a6f568-8200-4f2f-88b8-a4df5eb54ba9",
-      "huntingQueryTemplateSpecName108": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c3a6f568-8200-4f2f-88b8-a4df5eb54ba9')))]"
-    },
-    "huntingQueryObject109": {
-      "huntingQueryVersion109": "1.0.0",
-      "_huntingQuerycontentId109": "12eeae9e-8f0a-4b8c-b437-31c998f15af8",
-      "huntingQueryTemplateSpecName109": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('12eeae9e-8f0a-4b8c-b437-31c998f15af8')))]"
-    },
-    "huntingQueryObject110": {
-      "huntingQueryVersion110": "1.0.0",
-      "_huntingQuerycontentId110": "18fee342-8209-4270-9198-711646867e71",
-      "huntingQueryTemplateSpecName110": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('18fee342-8209-4270-9198-711646867e71')))]"
-    },
-    "huntingQueryObject111": {
-      "huntingQueryVersion111": "1.0.0",
-      "_huntingQuerycontentId111": "9cb4a6eb-c7ae-44ac-b12b-c16ec63da385",
-      "huntingQueryTemplateSpecName111": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9cb4a6eb-c7ae-44ac-b12b-c16ec63da385')))]"
-    },
-    "huntingQueryObject112": {
-      "huntingQueryVersion112": "1.0.0",
-      "_huntingQuerycontentId112": "28c79831-120c-4028-8a2b-4e4ae3082148",
-      "huntingQueryTemplateSpecName112": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('28c79831-120c-4028-8a2b-4e4ae3082148')))]"
-    },
-    "huntingQueryObject113": {
-      "huntingQueryVersion113": "1.0.0",
-      "_huntingQuerycontentId113": "f304b75a-a2a0-45fb-814c-40b6e08211f0",
-      "huntingQueryTemplateSpecName113": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f304b75a-a2a0-45fb-814c-40b6e08211f0')))]"
-    },
-    "huntingQueryObject114": {
-      "huntingQueryVersion114": "1.0.0",
-      "_huntingQuerycontentId114": "b3470167-2608-44a2-bd2f-8ebad88a27d5",
-      "huntingQueryTemplateSpecName114": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3470167-2608-44a2-bd2f-8ebad88a27d5')))]"
-    },
-    "huntingQueryObject115": {
-      "huntingQueryVersion115": "1.0.0",
-      "_huntingQuerycontentId115": "3cb281a9-34e5-4864-8303-6c07e096818b",
-      "huntingQueryTemplateSpecName115": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3cb281a9-34e5-4864-8303-6c07e096818b')))]"
-    },
-    "huntingQueryObject116": {
-      "huntingQueryVersion116": "1.0.0",
-      "_huntingQuerycontentId116": "b8eb3e2e-0f95-458e-b6d1-fe36a0ee8310",
-      "huntingQueryTemplateSpecName116": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b8eb3e2e-0f95-458e-b6d1-fe36a0ee8310')))]"
-    },
-    "huntingQueryObject117": {
-      "huntingQueryVersion117": "1.0.0",
-      "_huntingQuerycontentId117": "dc230eec-acc2-482f-8601-25125c8ff122",
-      "huntingQueryTemplateSpecName117": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dc230eec-acc2-482f-8601-25125c8ff122')))]"
-    },
-    "huntingQueryObject118": {
-      "huntingQueryVersion118": "1.0.0",
-      "_huntingQuerycontentId118": "489ad959-48eb-4c34-bed6-764cfd39214d",
-      "huntingQueryTemplateSpecName118": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('489ad959-48eb-4c34-bed6-764cfd39214d')))]"
-    },
-    "huntingQueryObject119": {
-      "huntingQueryVersion119": "1.0.0",
-      "_huntingQuerycontentId119": "f094e9f1-2d55-450d-af1a-0fdcd290f8c4",
-      "huntingQueryTemplateSpecName119": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f094e9f1-2d55-450d-af1a-0fdcd290f8c4')))]"
-    },
-    "huntingQueryObject120": {
-      "huntingQueryVersion120": "1.0.0",
-      "_huntingQuerycontentId120": "01cf63bd-debd-4d03-847c-d19c31844501",
-      "huntingQueryTemplateSpecName120": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('01cf63bd-debd-4d03-847c-d19c31844501')))]"
-    },
-    "huntingQueryObject121": {
-      "huntingQueryVersion121": "1.0.0",
-      "_huntingQuerycontentId121": "8d25156b-2ac4-4528-b1b1-f8427267f9f2",
-      "huntingQueryTemplateSpecName121": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8d25156b-2ac4-4528-b1b1-f8427267f9f2')))]"
-    },
-    "huntingQueryObject122": {
-      "huntingQueryVersion122": "1.0.0",
-      "_huntingQuerycontentId122": "b2a36ca5-b6a4-4f27-a7d8-7f044885cccf",
-      "huntingQueryTemplateSpecName122": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b2a36ca5-b6a4-4f27-a7d8-7f044885cccf')))]"
-    },
-    "huntingQueryObject123": {
-      "huntingQueryVersion123": "1.0.0",
-      "_huntingQuerycontentId123": "02bdbd93-02b7-40e4-9468-d501463e57af",
-      "huntingQueryTemplateSpecName123": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('02bdbd93-02b7-40e4-9468-d501463e57af')))]"
-    },
-    "huntingQueryObject124": {
-      "huntingQueryVersion124": "1.0.0",
-      "_huntingQuerycontentId124": "fc47e222-c348-43ca-ba11-b4628fe243cd",
-      "huntingQueryTemplateSpecName124": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fc47e222-c348-43ca-ba11-b4628fe243cd')))]"
-    },
-    "huntingQueryObject125": {
-      "huntingQueryVersion125": "1.0.0",
-      "_huntingQuerycontentId125": "b2a6440b-6ebd-4d86-aa33-cfe11f9defcf",
-      "huntingQueryTemplateSpecName125": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b2a6440b-6ebd-4d86-aa33-cfe11f9defcf')))]"
-    },
-    "huntingQueryObject126": {
-      "huntingQueryVersion126": "1.0.0",
-      "_huntingQuerycontentId126": "20c9d89a-ad65-48f4-ba14-605715af640a",
-      "huntingQueryTemplateSpecName126": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('20c9d89a-ad65-48f4-ba14-605715af640a')))]"
-    },
-    "huntingQueryObject127": {
-      "huntingQueryVersion127": "1.0.0",
-      "_huntingQuerycontentId127": "71117505-5a71-431e-8605-8896960affe5",
-      "huntingQueryTemplateSpecName127": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('71117505-5a71-431e-8605-8896960affe5')))]"
-    },
-    "huntingQueryObject128": {
-      "huntingQueryVersion128": "1.0.0",
-      "_huntingQuerycontentId128": "4684afc7-3d05-4ec1-8fb0-342707d0ac5d",
-      "huntingQueryTemplateSpecName128": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4684afc7-3d05-4ec1-8fb0-342707d0ac5d')))]"
-    },
-    "huntingQueryObject129": {
-      "huntingQueryVersion129": "1.0.0",
-      "_huntingQuerycontentId129": "45d955e0-0e34-4ce7-833d-c14b43d69677",
-      "huntingQueryTemplateSpecName129": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('45d955e0-0e34-4ce7-833d-c14b43d69677')))]"
-    },
-    "huntingQueryObject130": {
-      "huntingQueryVersion130": "1.0.0",
-      "_huntingQuerycontentId130": "8b7a84e9-5831-4e90-9b98-bd57493c6cc9",
-      "huntingQueryTemplateSpecName130": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8b7a84e9-5831-4e90-9b98-bd57493c6cc9')))]"
-    },
-    "huntingQueryObject131": {
-      "huntingQueryVersion131": "1.0.0",
-      "_huntingQuerycontentId131": "f6f317c4-8ebe-4f93-9068-720705a75c65",
-      "huntingQueryTemplateSpecName131": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f6f317c4-8ebe-4f93-9068-720705a75c65')))]"
-    },
-    "huntingQueryObject132": {
-      "huntingQueryVersion132": "1.0.0",
-      "_huntingQuerycontentId132": "5515296b-8f4c-42f1-a5ad-0574fbf99f23",
-      "huntingQueryTemplateSpecName132": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5515296b-8f4c-42f1-a5ad-0574fbf99f23')))]"
-    },
-    "huntingQueryObject133": {
-      "huntingQueryVersion133": "1.0.0",
-      "_huntingQuerycontentId133": "abd7e757-7737-4c9f-af7a-92e87172ff4f",
-      "huntingQueryTemplateSpecName133": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('abd7e757-7737-4c9f-af7a-92e87172ff4f')))]"
-    },
-    "huntingQueryObject134": {
-      "huntingQueryVersion134": "1.0.0",
-      "_huntingQuerycontentId134": "fea3f03b-0723-4f3e-9f6a-c8a6a67fbde0",
-      "huntingQueryTemplateSpecName134": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fea3f03b-0723-4f3e-9f6a-c8a6a67fbde0')))]"
-    },
-    "huntingQueryObject135": {
-      "huntingQueryVersion135": "1.0.0",
-      "_huntingQuerycontentId135": "008ff55b-0588-4d39-af03-c08f1bb519d7",
-      "huntingQueryTemplateSpecName135": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('008ff55b-0588-4d39-af03-c08f1bb519d7')))]"
-    },
-    "huntingQueryObject136": {
-      "huntingQueryVersion136": "1.0.0",
-      "_huntingQuerycontentId136": "161b163c-0805-46fd-abda-2fe5f0a5185e",
-      "huntingQueryTemplateSpecName136": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('161b163c-0805-46fd-abda-2fe5f0a5185e')))]"
-    },
-    "huntingQueryObject137": {
-      "huntingQueryVersion137": "1.0.0",
-      "_huntingQuerycontentId137": "68aaf2af-83ac-4f9e-9680-4050700b93f9",
-      "huntingQueryTemplateSpecName137": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('68aaf2af-83ac-4f9e-9680-4050700b93f9')))]"
-    },
-    "huntingQueryObject138": {
-      "huntingQueryVersion138": "1.0.0",
-      "_huntingQuerycontentId138": "ace8e98a-660b-4fa9-a877-60644eb83344",
-      "huntingQueryTemplateSpecName138": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ace8e98a-660b-4fa9-a877-60644eb83344')))]"
-    },
-    "huntingQueryObject139": {
-      "huntingQueryVersion139": "1.0.0",
-      "_huntingQuerycontentId139": "b1fa5bb7-9c4e-4d4f-826a-afc1fbe8c2cf",
-      "huntingQueryTemplateSpecName139": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b1fa5bb7-9c4e-4d4f-826a-afc1fbe8c2cf')))]"
-    },
-    "huntingQueryObject140": {
-      "huntingQueryVersion140": "1.0.0",
-      "_huntingQuerycontentId140": "8b3bd5c3-1f37-4131-8b3a-a0f6d540e56d",
-      "huntingQueryTemplateSpecName140": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8b3bd5c3-1f37-4131-8b3a-a0f6d540e56d')))]"
-    },
-    "huntingQueryObject141": {
-      "huntingQueryVersion141": "1.0.0",
-      "_huntingQuerycontentId141": "511406e2-2bdf-4b4d-a436-17dadbf4829f",
-      "huntingQueryTemplateSpecName141": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('511406e2-2bdf-4b4d-a436-17dadbf4829f')))]"
-    },
-    "huntingQueryObject142": {
-      "huntingQueryVersion142": "1.0.0",
-      "_huntingQuerycontentId142": "0bd46e27-9d5a-4abd-889b-829a8b4d29a4",
-      "huntingQueryTemplateSpecName142": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0bd46e27-9d5a-4abd-889b-829a8b4d29a4')))]"
-    },
-    "huntingQueryObject143": {
-      "huntingQueryVersion143": "1.0.0",
-      "_huntingQuerycontentId143": "132dffdf-3ee0-4748-8509-fbd3a92e5c9f",
-      "huntingQueryTemplateSpecName143": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('132dffdf-3ee0-4748-8509-fbd3a92e5c9f')))]"
-    },
-    "huntingQueryObject144": {
-      "huntingQueryVersion144": "1.0.0",
-      "_huntingQuerycontentId144": "bebb6652-3c52-4358-a946-ecd63cddf082",
-      "huntingQueryTemplateSpecName144": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bebb6652-3c52-4358-a946-ecd63cddf082')))]"
-    },
-    "huntingQueryObject145": {
-      "huntingQueryVersion145": "1.0.0",
-      "_huntingQuerycontentId145": "2d8448f5-c0a2-46d7-a004-e062970ccb7b",
-      "huntingQueryTemplateSpecName145": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2d8448f5-c0a2-46d7-a004-e062970ccb7b')))]"
-    },
-    "huntingQueryObject146": {
-      "huntingQueryVersion146": "1.0.0",
-      "_huntingQuerycontentId146": "49071a21-fbb6-472f-932f-5b6ca1a25883",
-      "huntingQueryTemplateSpecName146": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('49071a21-fbb6-472f-932f-5b6ca1a25883')))]"
-    },
-    "huntingQueryObject147": {
-      "huntingQueryVersion147": "1.0.0",
-      "_huntingQuerycontentId147": "f82f3d63-b7f2-494d-8254-612405702dd4",
-      "huntingQueryTemplateSpecName147": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f82f3d63-b7f2-494d-8254-612405702dd4')))]"
-    },
-    "huntingQueryObject148": {
-      "huntingQueryVersion148": "1.0.0",
-      "_huntingQuerycontentId148": "b3b507e9-9f92-4751-8463-fc77394fed91",
-      "huntingQueryTemplateSpecName148": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3b507e9-9f92-4751-8463-fc77394fed91')))]"
-    },
-    "huntingQueryObject149": {
-      "huntingQueryVersion149": "1.0.0",
-      "_huntingQuerycontentId149": "0a29c9f0-e8d4-4339-a196-52bb3a090a79",
-      "huntingQueryTemplateSpecName149": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0a29c9f0-e8d4-4339-a196-52bb3a090a79')))]"
-    },
-    "huntingQueryObject150": {
-      "huntingQueryVersion150": "1.0.0",
-      "_huntingQuerycontentId150": "9ffbd78f-c87c-4fd2-96ec-fd46e27bbd21",
-      "huntingQueryTemplateSpecName150": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9ffbd78f-c87c-4fd2-96ec-fd46e27bbd21')))]"
-    },
-    "huntingQueryObject151": {
-      "huntingQueryVersion151": "1.0.0",
-      "_huntingQuerycontentId151": "ab2f1fd6-1023-425e-a429-ff74db5709be",
-      "huntingQueryTemplateSpecName151": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ab2f1fd6-1023-425e-a429-ff74db5709be')))]"
-    },
-    "huntingQueryObject152": {
-      "huntingQueryVersion152": "1.0.0",
-      "_huntingQuerycontentId152": "74b581fc-e8cb-4b50-9d82-7b91d3a88a08",
-      "huntingQueryTemplateSpecName152": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('74b581fc-e8cb-4b50-9d82-7b91d3a88a08')))]"
-    },
-    "huntingQueryObject153": {
-      "huntingQueryVersion153": "1.0.0",
-      "_huntingQuerycontentId153": "90cd91d1-7b90-421c-a5c9-0479b6b7e6a2",
-      "huntingQueryTemplateSpecName153": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('90cd91d1-7b90-421c-a5c9-0479b6b7e6a2')))]"
-    },
-    "huntingQueryObject154": {
-      "huntingQueryVersion154": "1.0.0",
-      "_huntingQuerycontentId154": "0c68250b-44b5-46f4-8cac-f3e7149e8c61",
-      "huntingQueryTemplateSpecName154": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0c68250b-44b5-46f4-8cac-f3e7149e8c61')))]"
-    },
-    "huntingQueryObject155": {
-      "huntingQueryVersion155": "1.0.0",
-      "_huntingQuerycontentId155": "0c829a3c-ead1-4ebc-92c9-2e85abb1edeb",
-      "huntingQueryTemplateSpecName155": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0c829a3c-ead1-4ebc-92c9-2e85abb1edeb')))]"
-    },
-    "huntingQueryObject156": {
-      "huntingQueryVersion156": "1.0.0",
-      "_huntingQuerycontentId156": "6610945e-9496-4ef4-9bc4-a511a3f2a477",
-      "huntingQueryTemplateSpecName156": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6610945e-9496-4ef4-9bc4-a511a3f2a477')))]"
-    },
-    "huntingQueryObject157": {
-      "huntingQueryVersion157": "1.0.0",
-      "_huntingQuerycontentId157": "75ade06c-7326-4e0d-9dfb-27e05043525b",
-      "huntingQueryTemplateSpecName157": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('75ade06c-7326-4e0d-9dfb-27e05043525b')))]"
-    },
-    "huntingQueryObject158": {
-      "huntingQueryVersion158": "1.0.0",
-      "_huntingQuerycontentId158": "2ae448b1-b27d-4043-a92f-ef10202cdb7a",
-      "huntingQueryTemplateSpecName158": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2ae448b1-b27d-4043-a92f-ef10202cdb7a')))]"
-    },
-    "huntingQueryObject159": {
-      "huntingQueryVersion159": "1.0.0",
-      "_huntingQuerycontentId159": "02e237ed-f7b5-49dd-92e6-1b340d5e37fb",
-      "huntingQueryTemplateSpecName159": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('02e237ed-f7b5-49dd-92e6-1b340d5e37fb')))]"
-    },
-    "huntingQueryObject160": {
-      "huntingQueryVersion160": "1.0.0",
-      "_huntingQuerycontentId160": "b1f797d1-6ea4-4f8f-b663-6c8a1c1018e9",
-      "huntingQueryTemplateSpecName160": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b1f797d1-6ea4-4f8f-b663-6c8a1c1018e9')))]"
-    },
-    "huntingQueryObject161": {
-      "huntingQueryVersion161": "1.0.0",
-      "_huntingQuerycontentId161": "c73ae295-d120-4f79-aaed-de005f766ad2",
-      "huntingQueryTemplateSpecName161": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c73ae295-d120-4f79-aaed-de005f766ad2')))]"
-    },
-    "huntingQueryObject162": {
-      "huntingQueryVersion162": "1.0.0",
-      "_huntingQuerycontentId162": "fe2cb53e-4eb3-4676-87c1-f80d2813f542",
-      "huntingQueryTemplateSpecName162": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fe2cb53e-4eb3-4676-87c1-f80d2813f542')))]"
-    },
-    "huntingQueryObject163": {
-      "huntingQueryVersion163": "1.1.0",
-      "_huntingQuerycontentId163": "8f8fd7c8-277a-48c3-ad67-c80b3037c5af",
-      "huntingQueryTemplateSpecName163": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8f8fd7c8-277a-48c3-ad67-c80b3037c5af')))]"
-    },
-    "huntingQueryObject164": {
-      "huntingQueryVersion164": "1.1.0",
-      "_huntingQuerycontentId164": "bd6aae91-6233-430b-a5af-15c6406a7770",
-      "huntingQueryTemplateSpecName164": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bd6aae91-6233-430b-a5af-15c6406a7770')))]"
-    },
-    "huntingQueryObject165": {
-      "huntingQueryVersion165": "1.1.0",
-      "_huntingQuerycontentId165": "e6b3edc5-ec6f-44ae-9bb4-60c9ea49154e",
-      "huntingQueryTemplateSpecName165": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e6b3edc5-ec6f-44ae-9bb4-60c9ea49154e')))]"
-    },
-    "huntingQueryObject166": {
-      "huntingQueryVersion166": "1.1.0",
-      "_huntingQuerycontentId166": "74e076da-58e8-436d-b7bc-68888dbb6091",
-      "huntingQueryTemplateSpecName166": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('74e076da-58e8-436d-b7bc-68888dbb6091')))]"
-    },
-    "huntingQueryObject167": {
-      "huntingQueryVersion167": "1.1.0",
-      "_huntingQuerycontentId167": "fbe7a9d2-507e-4974-9e9a-d1cba3907f67",
-      "huntingQueryTemplateSpecName167": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fbe7a9d2-507e-4974-9e9a-d1cba3907f67')))]"
-    },
-    "huntingQueryObject168": {
-      "huntingQueryVersion168": "1.1.0",
-      "_huntingQuerycontentId168": "76c77c8a-bd2a-489a-af52-97291211e4e4",
-      "huntingQueryTemplateSpecName168": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('76c77c8a-bd2a-489a-af52-97291211e4e4')))]"
-    },
-    "huntingQueryObject169": {
-      "huntingQueryVersion169": "1.1.0",
-      "_huntingQuerycontentId169": "4d86021c-cad7-489b-a8c8-dddecb87a2ef",
-      "huntingQueryTemplateSpecName169": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4d86021c-cad7-489b-a8c8-dddecb87a2ef')))]"
-    },
-    "huntingQueryObject170": {
-      "huntingQueryVersion170": "1.1.0",
-      "_huntingQuerycontentId170": "b20e56b8-e335-43d9-b7b3-43c034c43aea",
-      "huntingQueryTemplateSpecName170": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b20e56b8-e335-43d9-b7b3-43c034c43aea')))]"
-    },
-    "huntingQueryObject171": {
-      "huntingQueryVersion171": "1.1.0",
-      "_huntingQuerycontentId171": "dd6efecd-7fe5-41b1-a122-8e0a15de9451",
-      "huntingQueryTemplateSpecName171": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dd6efecd-7fe5-41b1-a122-8e0a15de9451')))]"
-    },
-    "huntingQueryObject172": {
-      "huntingQueryVersion172": "1.1.0",
-      "_huntingQuerycontentId172": "4c30fab1-db4f-4a64-b66b-51478e43a477",
-      "huntingQueryTemplateSpecName172": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4c30fab1-db4f-4a64-b66b-51478e43a477')))]"
-    },
-    "huntingQueryObject173": {
-      "huntingQueryVersion173": "1.0.1",
-      "_huntingQuerycontentId173": "ad76e484-f159-4d23-99ee-e734f0b8b60b",
-      "huntingQueryTemplateSpecName173": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ad76e484-f159-4d23-99ee-e734f0b8b60b')))]"
-    },
-    "huntingQueryObject174": {
-      "huntingQueryVersion174": "1.0.0",
-      "_huntingQuerycontentId174": "0b197e26-7899-47ff-9be9-f7ba6dc949ea",
-      "huntingQueryTemplateSpecName174": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0b197e26-7899-47ff-9be9-f7ba6dc949ea')))]"
-    },
-    "huntingQueryObject175": {
-      "huntingQueryVersion175": "1.0.0",
-      "_huntingQuerycontentId175": "87846aad-624c-4e18-b963-81bedd7123a2",
-      "huntingQueryTemplateSpecName175": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('87846aad-624c-4e18-b963-81bedd7123a2')))]"
-    },
-    "huntingQueryObject176": {
-      "huntingQueryVersion176": "1.1.0",
-      "_huntingQuerycontentId176": "80f357a6-6bb4-4b2b-a88c-265fccafc794",
-      "huntingQueryTemplateSpecName176": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('80f357a6-6bb4-4b2b-a88c-265fccafc794')))]"
-    },
-    "huntingQueryObject177": {
-      "huntingQueryVersion177": "1.0.0",
-      "_huntingQuerycontentId177": "25150085-015a-4673-9b67-bc6ad9475500",
-      "huntingQueryTemplateSpecName177": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('25150085-015a-4673-9b67-bc6ad9475500')))]"
-    },
-    "huntingQueryObject178": {
-      "huntingQueryVersion178": "1.0.0",
-      "_huntingQuerycontentId178": "9b086a51-e396-4718-90d7-f7b3646e6581",
-      "huntingQueryTemplateSpecName178": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9b086a51-e396-4718-90d7-f7b3646e6581')))]"
-    },
-    "huntingQueryObject179": {
-      "huntingQueryVersion179": "1.0.0",
-      "_huntingQuerycontentId179": "516046e8-a460-4f7b-86eb-421d3a9cdff1",
-      "huntingQueryTemplateSpecName179": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('516046e8-a460-4f7b-86eb-421d3a9cdff1')))]"
-    },
-    "huntingQueryObject180": {
-      "huntingQueryVersion180": "1.0.0",
-      "_huntingQuerycontentId180": "594fe5a1-53b6-466b-86df-028366c3994e",
-      "huntingQueryTemplateSpecName180": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('594fe5a1-53b6-466b-86df-028366c3994e')))]"
-    },
-    "huntingQueryObject181": {
-      "huntingQueryVersion181": "1.0.0",
-      "_huntingQuerycontentId181": "706b711a-7622-40f1-9ebb-331d1a0ff697",
-      "huntingQueryTemplateSpecName181": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('706b711a-7622-40f1-9ebb-331d1a0ff697')))]"
-    },
-    "huntingQueryObject182": {
-      "huntingQueryVersion182": "1.0.0",
-      "_huntingQuerycontentId182": "f708c866-073a-4107-a60b-ba6f86e54caa",
-      "huntingQueryTemplateSpecName182": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f708c866-073a-4107-a60b-ba6f86e54caa')))]"
-    },
-    "huntingQueryObject183": {
-      "huntingQueryVersion183": "1.0.0",
-      "_huntingQuerycontentId183": "68aa199c-259b-4bb0-8e7a-8ed6f96c5525",
-      "huntingQueryTemplateSpecName183": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('68aa199c-259b-4bb0-8e7a-8ed6f96c5525')))]"
-    },
-    "huntingQueryObject184": {
-      "huntingQueryVersion184": "1.0.0",
-      "_huntingQuerycontentId184": "8c852f12-499f-499b-afc1-25c50aa9b462",
-      "huntingQueryTemplateSpecName184": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8c852f12-499f-499b-afc1-25c50aa9b462')))]"
-    },
-    "huntingQueryObject185": {
-      "huntingQueryVersion185": "1.0.0",
-      "_huntingQuerycontentId185": "f6354c94-3a95-4235-8530-414f016a7bf6",
-      "huntingQueryTemplateSpecName185": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f6354c94-3a95-4235-8530-414f016a7bf6')))]"
-    },
-    "huntingQueryObject186": {
-      "huntingQueryVersion186": "1.0.0",
-      "_huntingQuerycontentId186": "dc7e1eb5-16f5-4ad5-96a1-794970f4b310",
-      "huntingQueryTemplateSpecName186": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dc7e1eb5-16f5-4ad5-96a1-794970f4b310')))]"
-    },
-    "huntingQueryObject187": {
-      "huntingQueryVersion187": "1.0.0",
-      "_huntingQuerycontentId187": "54d3455d-27e0-4ceb-99f9-375abd620151",
-      "huntingQueryTemplateSpecName187": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('54d3455d-27e0-4ceb-99f9-375abd620151')))]"
-    },
-    "huntingQueryObject188": {
-      "huntingQueryVersion188": "1.0.0",
-      "_huntingQuerycontentId188": "8d298b5c-feca-4add-bd42-e43e0a317a88",
-      "huntingQueryTemplateSpecName188": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8d298b5c-feca-4add-bd42-e43e0a317a88')))]"
-    },
-    "huntingQueryObject189": {
-      "huntingQueryVersion189": "1.0.0",
-      "_huntingQuerycontentId189": "3131d0ba-32c9-483e-a25c-82e26a07e116",
-      "huntingQueryTemplateSpecName189": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3131d0ba-32c9-483e-a25c-82e26a07e116')))]"
-    },
-    "huntingQueryObject190": {
-      "huntingQueryVersion190": "1.0.0",
-      "_huntingQuerycontentId190": "a12cac64-ea6d-46d4-91a6-262b165fb9ad",
-      "huntingQueryTemplateSpecName190": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a12cac64-ea6d-46d4-91a6-262b165fb9ad')))]"
-    },
-    "huntingQueryObject191": {
-      "huntingQueryVersion191": "1.0.0",
-      "_huntingQuerycontentId191": "9e8faa62-7222-48a5-a78f-ef2d22f866dc",
-      "huntingQueryTemplateSpecName191": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9e8faa62-7222-48a5-a78f-ef2d22f866dc')))]"
-    },
-    "huntingQueryObject192": {
-      "huntingQueryVersion192": "1.1.0",
-      "_huntingQuerycontentId192": "79bed402-09bc-453b-ab92-8b1411e683fa",
-      "huntingQueryTemplateSpecName192": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('79bed402-09bc-453b-ab92-8b1411e683fa')))]"
-    },
-    "huntingQueryObject193": {
-      "huntingQueryVersion193": "1.1.0",
-      "_huntingQuerycontentId193": "36cf7ce5-7264-46d9-9f47-57b59049b44f",
-      "huntingQueryTemplateSpecName193": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('36cf7ce5-7264-46d9-9f47-57b59049b44f')))]"
-    },
-    "huntingQueryObject194": {
-      "huntingQueryVersion194": "1.0.0",
-      "_huntingQuerycontentId194": "6f96f6d7-d972-421e-a59f-6b9a8de81324",
-      "huntingQueryTemplateSpecName194": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6f96f6d7-d972-421e-a59f-6b9a8de81324')))]"
-    },
-    "huntingQueryObject195": {
-      "huntingQueryVersion195": "1.0.0",
-      "_huntingQuerycontentId195": "9f135aef-ad25-4df2-bdab-8399978a36a2",
-      "huntingQueryTemplateSpecName195": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9f135aef-ad25-4df2-bdab-8399978a36a2')))]"
-    },
-    "huntingQueryObject196": {
-      "huntingQueryVersion196": "1.0.0",
-      "_huntingQuerycontentId196": "23e6d66b-511a-43fd-9863-6924da60319a",
-      "huntingQueryTemplateSpecName196": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('23e6d66b-511a-43fd-9863-6924da60319a')))]"
-    },
-    "huntingQueryObject197": {
-      "huntingQueryVersion197": "1.1.0",
-      "_huntingQuerycontentId197": "32a981ad-cd5a-4d80-8c6c-d59b9893c019",
-      "huntingQueryTemplateSpecName197": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('32a981ad-cd5a-4d80-8c6c-d59b9893c019')))]"
-    },
-    "huntingQueryObject198": {
-      "huntingQueryVersion198": "1.1.0",
-      "_huntingQuerycontentId198": "bde9d9fc-e166-4628-91f7-fb86ace93af0",
-      "huntingQueryTemplateSpecName198": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bde9d9fc-e166-4628-91f7-fb86ace93af0')))]"
-    },
-    "huntingQueryObject199": {
-      "huntingQueryVersion199": "1.0.0",
-      "_huntingQuerycontentId199": "77104824-b41e-412d-8e50-26971fe97ab0",
-      "huntingQueryTemplateSpecName199": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('77104824-b41e-412d-8e50-26971fe97ab0')))]"
-    },
-    "huntingQueryObject200": {
-      "huntingQueryVersion200": "1.0.0",
-      "_huntingQuerycontentId200": "99713387-9d61-49eb-8edc-f51153d8bb01",
-      "huntingQueryTemplateSpecName200": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('99713387-9d61-49eb-8edc-f51153d8bb01')))]"
-    },
-    "huntingQueryObject201": {
-      "huntingQueryVersion201": "1.1.0",
-      "_huntingQuerycontentId201": "147131b3-8b57-4c50-b981-5a951ed82272",
-      "huntingQueryTemplateSpecName201": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('147131b3-8b57-4c50-b981-5a951ed82272')))]"
-    },
-    "huntingQueryObject202": {
-      "huntingQueryVersion202": "1.1.0",
-      "_huntingQuerycontentId202": "7e93ce37-0cc5-4aa9-b30a-07772affa481",
-      "huntingQueryTemplateSpecName202": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7e93ce37-0cc5-4aa9-b30a-07772affa481')))]"
-    },
-    "huntingQueryObject203": {
-      "huntingQueryVersion203": "1.1.0",
-      "_huntingQuerycontentId203": "316f8777-09fd-480b-a726-21f521fa990f",
-      "huntingQueryTemplateSpecName203": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('316f8777-09fd-480b-a726-21f521fa990f')))]"
-    },
-    "huntingQueryObject204": {
-      "huntingQueryVersion204": "1.1.0",
-      "_huntingQuerycontentId204": "2e903da3-32fe-46b0-8df7-5f39e55db17e",
-      "huntingQueryTemplateSpecName204": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2e903da3-32fe-46b0-8df7-5f39e55db17e')))]"
-    },
-    "huntingQueryObject205": {
-      "huntingQueryVersion205": "1.1.0",
-      "_huntingQuerycontentId205": "f290d544-c499-4b23-8a7e-c4cbb7ab6316",
-      "huntingQueryTemplateSpecName205": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f290d544-c499-4b23-8a7e-c4cbb7ab6316')))]"
-    },
-    "huntingQueryObject206": {
-      "huntingQueryVersion206": "1.1.0",
-      "_huntingQuerycontentId206": "6fe463ca-4cd3-4d97-a099-6b736f28a128",
-      "huntingQueryTemplateSpecName206": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6fe463ca-4cd3-4d97-a099-6b736f28a128')))]"
-    },
-    "huntingQueryObject207": {
-      "huntingQueryVersion207": "1.1.0",
-      "_huntingQuerycontentId207": "9e4b7553-1113-4d40-bb6b-7daca7d7d255",
-      "huntingQueryTemplateSpecName207": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9e4b7553-1113-4d40-bb6b-7daca7d7d255')))]"
-    },
-    "huntingQueryObject208": {
-      "huntingQueryVersion208": "1.1.0",
-      "_huntingQuerycontentId208": "c03e13ee-0e7a-4d05-b3f4-790b01bb30a5",
-      "huntingQueryTemplateSpecName208": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c03e13ee-0e7a-4d05-b3f4-790b01bb30a5')))]"
-    },
-    "huntingQueryObject209": {
-      "huntingQueryVersion209": "1.1.0",
-      "_huntingQuerycontentId209": "86f2b124-8caf-4b53-845a-87de3ffccbdf",
-      "huntingQueryTemplateSpecName209": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('86f2b124-8caf-4b53-845a-87de3ffccbdf')))]"
-    },
-    "huntingQueryObject210": {
-      "huntingQueryVersion210": "1.1.0",
-      "_huntingQuerycontentId210": "ae690d6f-0ea5-4617-95cf-1ed9a5fcb329",
-      "huntingQueryTemplateSpecName210": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ae690d6f-0ea5-4617-95cf-1ed9a5fcb329')))]"
-    },
-    "huntingQueryObject211": {
-      "huntingQueryVersion211": "1.1.0",
-      "_huntingQuerycontentId211": "16cfa413-238f-4355-9f8a-4b97ce7572ac",
-      "huntingQueryTemplateSpecName211": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('16cfa413-238f-4355-9f8a-4b97ce7572ac')))]"
-    },
-    "huntingQueryObject212": {
-      "huntingQueryVersion212": "1.0.0",
-      "_huntingQuerycontentId212": "6a570927-8638-4a6f-ac09-72a7d51ffa3c",
-      "huntingQueryTemplateSpecName212": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6a570927-8638-4a6f-ac09-72a7d51ffa3c')))]"
-    },
-    "huntingQueryObject213": {
-      "huntingQueryVersion213": "1.0.0",
-      "_huntingQuerycontentId213": "418e8859-b22a-4fd4-b273-5433e054cdc7",
-      "huntingQueryTemplateSpecName213": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('418e8859-b22a-4fd4-b273-5433e054cdc7')))]"
-    },
-    "huntingQueryObject214": {
-      "huntingQueryVersion214": "1.1.0",
-      "_huntingQuerycontentId214": "15a17150-811d-4829-a3d6-489139c9ff5e",
-      "huntingQueryTemplateSpecName214": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('15a17150-811d-4829-a3d6-489139c9ff5e')))]"
-    },
-    "huntingQueryObject215": {
-      "huntingQueryVersion215": "1.0.0",
-      "_huntingQuerycontentId215": "416cd270-6327-441a-9304-940c832cf361",
-      "huntingQueryTemplateSpecName215": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('416cd270-6327-441a-9304-940c832cf361')))]"
-    },
-    "huntingQueryObject216": {
-      "huntingQueryVersion216": "1.0.0",
-      "_huntingQuerycontentId216": "cdc4da1c-64a1-4941-be59-1f5cc85481ab",
-      "huntingQueryTemplateSpecName216": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdc4da1c-64a1-4941-be59-1f5cc85481ab')))]"
-    },
-    "huntingQueryObject217": {
-      "huntingQueryVersion217": "1.0.0",
-      "_huntingQuerycontentId217": "b3180ac0-6d94-494a-8b8c-fcc84319ea6e",
-      "huntingQueryTemplateSpecName217": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3180ac0-6d94-494a-8b8c-fcc84319ea6e')))]"
-    },
-    "huntingQueryObject218": {
-      "huntingQueryVersion218": "1.0.0",
-      "_huntingQuerycontentId218": "011c3d48-f6ca-405f-9763-66c7856ad2ba",
-      "huntingQueryTemplateSpecName218": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('011c3d48-f6ca-405f-9763-66c7856ad2ba')))]"
-    },
-    "huntingQueryObject219": {
-      "huntingQueryVersion219": "1.0.0",
-      "_huntingQuerycontentId219": "1dce39ec-8a64-4e49-9d6e-926ee6f04c39",
-      "huntingQueryTemplateSpecName219": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1dce39ec-8a64-4e49-9d6e-926ee6f04c39')))]"
-    },
-    "huntingQueryObject220": {
-      "huntingQueryVersion220": "1.1.0",
-      "_huntingQuerycontentId220": "53139a92-eb64-46d2-be97-e752a71e7021",
-      "huntingQueryTemplateSpecName220": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('53139a92-eb64-46d2-be97-e752a71e7021')))]"
-    },
-    "huntingQueryObject221": {
-      "huntingQueryVersion221": "1.0.0",
-      "_huntingQuerycontentId221": "09b263e1-9c73-4585-a55c-bc209e148e14",
-      "huntingQueryTemplateSpecName221": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('09b263e1-9c73-4585-a55c-bc209e148e14')))]"
-    },
-    "huntingQueryObject222": {
-      "huntingQueryVersion222": "1.1.0",
-      "_huntingQuerycontentId222": "f9442d20-eff8-4751-9a75-6451aeace687",
-      "huntingQueryTemplateSpecName222": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f9442d20-eff8-4751-9a75-6451aeace687')))]"
-    },
-    "huntingQueryObject223": {
-      "huntingQueryVersion223": "1.0.0",
-      "_huntingQuerycontentId223": "e90345b3-439c-44e1-a85d-8ae84ad9c65b",
-      "huntingQueryTemplateSpecName223": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e90345b3-439c-44e1-a85d-8ae84ad9c65b')))]"
-    },
-    "huntingQueryObject224": {
-      "huntingQueryVersion224": "1.0.0",
-      "_huntingQuerycontentId224": "c51b0367-573a-42c3-a4a2-2d8b1ef6bea9",
-      "huntingQueryTemplateSpecName224": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c51b0367-573a-42c3-a4a2-2d8b1ef6bea9')))]"
-    },
-    "huntingQueryObject225": {
-      "huntingQueryVersion225": "1.0.0",
-      "_huntingQuerycontentId225": "e3a11181-3ff9-4ba0-908d-3e229b476ce3",
-      "huntingQueryTemplateSpecName225": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e3a11181-3ff9-4ba0-908d-3e229b476ce3')))]"
-    },
-    "huntingQueryObject226": {
-      "huntingQueryVersion226": "1.0.0",
-      "_huntingQuerycontentId226": "515a98db-49a5-4592-80b7-8227998da9ed",
-      "huntingQueryTemplateSpecName226": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('515a98db-49a5-4592-80b7-8227998da9ed')))]"
-    },
-    "huntingQueryObject227": {
-      "huntingQueryVersion227": "1.0.0",
-      "_huntingQuerycontentId227": "5cb9399f-e4d7-46c1-bdfa-d66eec278bf2",
-      "huntingQueryTemplateSpecName227": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5cb9399f-e4d7-46c1-bdfa-d66eec278bf2')))]"
-    },
-    "huntingQueryObject228": {
-      "huntingQueryVersion228": "1.0.0",
-      "_huntingQuerycontentId228": "8f82894a-1b18-4d1e-a580-1dcaff739a32",
-      "huntingQueryTemplateSpecName228": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8f82894a-1b18-4d1e-a580-1dcaff739a32')))]"
-    },
-    "huntingQueryObject229": {
-      "huntingQueryVersion229": "1.0.0",
-      "_huntingQuerycontentId229": "8425234b-f09d-490e-be3d-a7ecf081c5d0",
-      "huntingQueryTemplateSpecName229": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8425234b-f09d-490e-be3d-a7ecf081c5d0')))]"
-    },
-    "huntingQueryObject230": {
-      "huntingQueryVersion230": "1.0.0",
-      "_huntingQuerycontentId230": "60cddbbb-2244-4a61-ad73-b20b1c6f5027",
-      "huntingQueryTemplateSpecName230": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('60cddbbb-2244-4a61-ad73-b20b1c6f5027')))]"
-    },
-    "huntingQueryObject231": {
-      "huntingQueryVersion231": "1.0.0",
-      "_huntingQuerycontentId231": "354d78b3-91b7-4219-9079-57e63e281077",
-      "huntingQueryTemplateSpecName231": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('354d78b3-91b7-4219-9079-57e63e281077')))]"
-    },
-    "huntingQueryObject232": {
-      "huntingQueryVersion232": "1.0.0",
-      "_huntingQuerycontentId232": "a7f2dae2-2e33-4744-b013-37dc5628d939",
-      "huntingQueryTemplateSpecName232": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a7f2dae2-2e33-4744-b013-37dc5628d939')))]"
-    },
-    "huntingQueryObject233": {
-      "huntingQueryVersion233": "1.0.0",
-      "_huntingQuerycontentId233": "de074419-2ec5-4c7f-a7f6-0a49178b314c",
-      "huntingQueryTemplateSpecName233": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('de074419-2ec5-4c7f-a7f6-0a49178b314c')))]"
-    },
-    "huntingQueryObject234": {
-      "huntingQueryVersion234": "1.0.0",
-      "_huntingQuerycontentId234": "d236f728-8b0f-4b4f-acf7-e4707993b841",
-      "huntingQueryTemplateSpecName234": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d236f728-8b0f-4b4f-acf7-e4707993b841')))]"
-    },
-    "huntingQueryObject235": {
-      "huntingQueryVersion235": "1.0.0",
-      "_huntingQuerycontentId235": "8b0bae20-687f-47ca-bc2e-8dabbed9cbae",
-      "huntingQueryTemplateSpecName235": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8b0bae20-687f-47ca-bc2e-8dabbed9cbae')))]"
-    },
-    "huntingQueryObject236": {
-      "huntingQueryVersion236": "1.0.0",
-      "_huntingQuerycontentId236": "47506508-dee4-4d4d-93a8-1c78d63cd2eb",
-      "huntingQueryTemplateSpecName236": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('47506508-dee4-4d4d-93a8-1c78d63cd2eb')))]"
-    },
-    "huntingQueryObject237": {
-      "huntingQueryVersion237": "1.0.0",
-      "_huntingQuerycontentId237": "72f939fe-c77b-4c25-91b4-3f784c9c58c3",
-      "huntingQueryTemplateSpecName237": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('72f939fe-c77b-4c25-91b4-3f784c9c58c3')))]"
-    },
-    "huntingQueryObject238": {
-      "huntingQueryVersion238": "1.0.0",
-      "_huntingQuerycontentId238": "da7eecca-ecb8-4b8e-a111-62d2b48e2e69",
-      "huntingQueryTemplateSpecName238": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('da7eecca-ecb8-4b8e-a111-62d2b48e2e69')))]"
-    },
-    "huntingQueryObject239": {
-      "huntingQueryVersion239": "1.0.0",
-      "_huntingQuerycontentId239": "4c786e9a-b570-47bc-877f-7f3da87a4673",
-      "huntingQueryTemplateSpecName239": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4c786e9a-b570-47bc-877f-7f3da87a4673')))]"
-    },
-    "huntingQueryObject240": {
-      "huntingQueryVersion240": "1.0.0",
-      "_huntingQuerycontentId240": "53c58a33-668d-46e1-9714-5892c87650d9",
-      "huntingQueryTemplateSpecName240": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('53c58a33-668d-46e1-9714-5892c87650d9')))]"
-    },
-    "huntingQueryObject241": {
-      "huntingQueryVersion241": "1.0.0",
-      "_huntingQuerycontentId241": "8cde246b-7ed1-429c-933a-f7d0363dbbc0",
-      "huntingQueryTemplateSpecName241": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8cde246b-7ed1-429c-933a-f7d0363dbbc0')))]"
-    },
-    "huntingQueryObject242": {
-      "huntingQueryVersion242": "1.0.0",
-      "_huntingQuerycontentId242": "0bd33643-c517-48b1-8211-25a7fbd15a50",
-      "huntingQueryTemplateSpecName242": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0bd33643-c517-48b1-8211-25a7fbd15a50')))]"
-    },
-    "huntingQueryObject243": {
-      "huntingQueryVersion243": "1.0.0",
-      "_huntingQuerycontentId243": "d78bad8c-3d94-4a73-bdbe-1c567e3d6d62",
-      "huntingQueryTemplateSpecName243": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d78bad8c-3d94-4a73-bdbe-1c567e3d6d62')))]"
-    },
-    "huntingQueryObject244": {
-      "huntingQueryVersion244": "1.0.0",
-      "_huntingQuerycontentId244": "58acf93f-27de-4af4-8a5f-d87ee59326f9",
-      "huntingQueryTemplateSpecName244": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('58acf93f-27de-4af4-8a5f-d87ee59326f9')))]"
-    },
-    "huntingQueryObject245": {
-      "huntingQueryVersion245": "1.0.0",
-      "_huntingQuerycontentId245": "0a9385bc-2ef9-4b0e-8834-12f796b08ca8",
-      "huntingQueryTemplateSpecName245": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0a9385bc-2ef9-4b0e-8834-12f796b08ca8')))]"
-    },
-    "huntingQueryObject246": {
-      "huntingQueryVersion246": "1.0.0",
-      "_huntingQuerycontentId246": "385aca1d-2135-40c6-af8e-030c9e086cf5",
-      "huntingQueryTemplateSpecName246": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('385aca1d-2135-40c6-af8e-030c9e086cf5')))]"
-    },
-    "huntingQueryObject247": {
-      "huntingQueryVersion247": "1.0.0",
-      "_huntingQuerycontentId247": "12798858-1916-4b59-a85e-8a7a4f7b43cf",
-      "huntingQueryTemplateSpecName247": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('12798858-1916-4b59-a85e-8a7a4f7b43cf')))]"
-    },
-    "huntingQueryObject248": {
-      "huntingQueryVersion248": "1.0.0",
-      "_huntingQuerycontentId248": "b78eddd9-ebe5-42ab-95b4-928a782b52b5",
-      "huntingQueryTemplateSpecName248": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b78eddd9-ebe5-42ab-95b4-928a782b52b5')))]"
-    },
-    "huntingQueryObject249": {
-      "huntingQueryVersion249": "1.0.0",
-      "_huntingQuerycontentId249": "cbf3abc0-2b2d-4852-ab7a-9f7a1231997e",
-      "huntingQueryTemplateSpecName249": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cbf3abc0-2b2d-4852-ab7a-9f7a1231997e')))]"
-    },
-    "huntingQueryObject250": {
-      "huntingQueryVersion250": "1.0.0",
-      "_huntingQuerycontentId250": "201cb524-b4b4-479a-9637-da35cfa1e30a",
-      "huntingQueryTemplateSpecName250": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('201cb524-b4b4-479a-9637-da35cfa1e30a')))]"
-    },
-    "huntingQueryObject251": {
-      "huntingQueryVersion251": "1.0.0",
-      "_huntingQuerycontentId251": "abdca3e6-c198-404a-b95c-f09ddfed2027",
-      "huntingQueryTemplateSpecName251": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('abdca3e6-c198-404a-b95c-f09ddfed2027')))]"
-    },
-    "huntingQueryObject252": {
-      "huntingQueryVersion252": "1.0.0",
-      "_huntingQuerycontentId252": "289283e9-9f63-488c-8d62-fe9c598f3cd5",
-      "huntingQueryTemplateSpecName252": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('289283e9-9f63-488c-8d62-fe9c598f3cd5')))]"
-    },
-    "huntingQueryObject253": {
-      "huntingQueryVersion253": "1.0.0",
-      "_huntingQuerycontentId253": "300b0d05-e99e-4349-ab2b-ec12ff5c2da1",
-      "huntingQueryTemplateSpecName253": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('300b0d05-e99e-4349-ab2b-ec12ff5c2da1')))]"
-    },
-    "huntingQueryObject254": {
-      "huntingQueryVersion254": "1.0.0",
-      "_huntingQuerycontentId254": "9c4359a1-0bf9-45b3-9a1a-f333c437a061",
-      "huntingQueryTemplateSpecName254": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9c4359a1-0bf9-45b3-9a1a-f333c437a061')))]"
-    },
-    "huntingQueryObject255": {
-      "huntingQueryVersion255": "1.0.0",
-      "_huntingQuerycontentId255": "de480ca4-4095-4fef-b3e7-2a3f17f24e78",
-      "huntingQueryTemplateSpecName255": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('de480ca4-4095-4fef-b3e7-2a3f17f24e78')))]"
-    },
-    "huntingQueryObject256": {
-      "huntingQueryVersion256": "1.0.0",
-      "_huntingQuerycontentId256": "a8ccbf35-4c6d-4a8f-8c42-04fd9b000a27",
-      "huntingQueryTemplateSpecName256": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a8ccbf35-4c6d-4a8f-8c42-04fd9b000a27')))]"
-    },
-    "huntingQueryObject257": {
-      "huntingQueryVersion257": "1.0.0",
-      "_huntingQuerycontentId257": "e3b7b5c1-0e50-4dfb-b73a-c226636eaf58",
-      "huntingQueryTemplateSpecName257": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e3b7b5c1-0e50-4dfb-b73a-c226636eaf58')))]"
-    },
-    "huntingQueryObject258": {
-      "huntingQueryVersion258": "1.0.0",
-      "_huntingQuerycontentId258": "27ee28e7-423b-48c9-a410-cbc6c8e21d25",
-      "huntingQueryTemplateSpecName258": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('27ee28e7-423b-48c9-a410-cbc6c8e21d25')))]"
-    },
-    "huntingQueryObject259": {
-      "huntingQueryVersion259": "1.0.0",
-      "_huntingQuerycontentId259": "9d6c8c17-06b0-4044-b18e-35eb3dfc5cf2",
-      "huntingQueryTemplateSpecName259": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9d6c8c17-06b0-4044-b18e-35eb3dfc5cf2')))]"
-    },
-    "huntingQueryObject260": {
-      "huntingQueryVersion260": "1.0.0",
-      "_huntingQuerycontentId260": "a1664330-810a-473b-b354-acbaa751a294",
-      "huntingQueryTemplateSpecName260": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a1664330-810a-473b-b354-acbaa751a294')))]"
-    },
-    "huntingQueryObject261": {
-      "huntingQueryVersion261": "1.0.0",
-      "_huntingQuerycontentId261": "d24e9c4a-b72a-4a85-89cd-83760ae61155",
-      "huntingQueryTemplateSpecName261": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d24e9c4a-b72a-4a85-89cd-83760ae61155')))]"
-    },
-    "huntingQueryObject262": {
-      "huntingQueryVersion262": "1.0.0",
-      "_huntingQuerycontentId262": "3f007cdc-86bf-4657-9015-05101a3e54f5",
-      "huntingQueryTemplateSpecName262": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3f007cdc-86bf-4657-9015-05101a3e54f5')))]"
-    },
-    "huntingQueryObject263": {
-      "huntingQueryVersion263": "1.0.0",
-      "_huntingQuerycontentId263": "efe27064-6d35-4720-b7f5-e0326695613d",
-      "huntingQueryTemplateSpecName263": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('efe27064-6d35-4720-b7f5-e0326695613d')))]"
-    },
-    "huntingQueryObject264": {
-      "huntingQueryVersion264": "1.0.0",
-      "_huntingQuerycontentId264": "bc46e331-3cb0-483d-9c90-989d2a59457f",
-      "huntingQueryTemplateSpecName264": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bc46e331-3cb0-483d-9c90-989d2a59457f')))]"
-    },
-    "huntingQueryObject265": {
-      "huntingQueryVersion265": "1.0.0",
-      "_huntingQuerycontentId265": "03e61096-20d0-46eb-b8e0-a507dd00a19f",
-      "huntingQueryTemplateSpecName265": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('03e61096-20d0-46eb-b8e0-a507dd00a19f')))]"
-    },
-    "huntingQueryObject266": {
-      "huntingQueryVersion266": "1.0.0",
-      "_huntingQuerycontentId266": "f075d4c4-cf76-4e5d-9c2d-9ed524286316",
-      "huntingQueryTemplateSpecName266": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f075d4c4-cf76-4e5d-9c2d-9ed524286316')))]"
-    },
-    "huntingQueryObject267": {
-      "huntingQueryVersion267": "1.0.0",
-      "_huntingQuerycontentId267": "891f4865-75e5-4d40-bc24-ebf97da3ca9a",
-      "huntingQueryTemplateSpecName267": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('891f4865-75e5-4d40-bc24-ebf97da3ca9a')))]"
-    },
-    "huntingQueryObject268": {
-      "huntingQueryVersion268": "1.0.0",
-      "_huntingQuerycontentId268": "d823da0e-1334-4a66-8ff4-2c2c40d26295",
-      "huntingQueryTemplateSpecName268": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d823da0e-1334-4a66-8ff4-2c2c40d26295')))]"
-    },
-    "huntingQueryObject269": {
-      "huntingQueryVersion269": "1.0.0",
-      "_huntingQuerycontentId269": "ba4f7e56-a2f8-4a30-b848-200fdc7fc3a2",
-      "huntingQueryTemplateSpecName269": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ba4f7e56-a2f8-4a30-b848-200fdc7fc3a2')))]"
-    },
-    "huntingQueryObject270": {
-      "huntingQueryVersion270": "1.0.0",
-      "_huntingQuerycontentId270": "13260191-fb10-4a36-9ca1-2bbc0aaf77d0",
-      "huntingQueryTemplateSpecName270": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('13260191-fb10-4a36-9ca1-2bbc0aaf77d0')))]"
-    },
-    "huntingQueryObject271": {
-      "huntingQueryVersion271": "1.0.0",
-      "_huntingQuerycontentId271": "08aff8c6-b983-43a3-be95-68a10c3d35e6",
-      "huntingQueryTemplateSpecName271": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('08aff8c6-b983-43a3-be95-68a10c3d35e6')))]"
-    },
-    "huntingQueryObject272": {
-      "huntingQueryVersion272": "1.0.0",
-      "_huntingQuerycontentId272": "492f1ea1-37c3-410a-a2f2-4e4eae2ff7f9",
-      "huntingQueryTemplateSpecName272": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('492f1ea1-37c3-410a-a2f2-4e4eae2ff7f9')))]"
-    },
-    "huntingQueryObject273": {
-      "huntingQueryVersion273": "1.1.0",
-      "_huntingQuerycontentId273": "5a84e13a-bb17-4124-9564-d74cdb84c124",
-      "huntingQueryTemplateSpecName273": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5a84e13a-bb17-4124-9564-d74cdb84c124')))]"
-    },
-    "huntingQueryObject274": {
-      "huntingQueryVersion274": "1.1.0",
-      "_huntingQuerycontentId274": "a937905e-ee5c-406c-ab86-8e2581240112",
-      "huntingQueryTemplateSpecName274": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a937905e-ee5c-406c-ab86-8e2581240112')))]"
-    },
-    "huntingQueryObject275": {
-      "huntingQueryVersion275": "1.1.0",
-      "_huntingQuerycontentId275": "3a2fdf32-ebe7-4f65-a1c3-fc7faf23ae90",
-      "huntingQueryTemplateSpecName275": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3a2fdf32-ebe7-4f65-a1c3-fc7faf23ae90')))]"
-    },
-    "huntingQueryObject276": {
-      "huntingQueryVersion276": "1.0.0",
-      "_huntingQuerycontentId276": "3eef362d-3aee-4950-9208-4afa6f7afbe9",
-      "huntingQueryTemplateSpecName276": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3eef362d-3aee-4950-9208-4afa6f7afbe9')))]"
-    },
-    "huntingQueryObject277": {
-      "huntingQueryVersion277": "1.0.0",
-      "_huntingQuerycontentId277": "4620ece3-dceb-4151-8621-5a56351c97cd",
-      "huntingQueryTemplateSpecName277": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4620ece3-dceb-4151-8621-5a56351c97cd')))]"
-    },
-    "huntingQueryObject278": {
-      "huntingQueryVersion278": "1.0.0",
-      "_huntingQuerycontentId278": "ab006655-d723-4844-9d5d-91cb3b020555",
-      "huntingQueryTemplateSpecName278": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ab006655-d723-4844-9d5d-91cb3b020555')))]"
-    },
-    "huntingQueryObject279": {
-      "huntingQueryVersion279": "1.1.0",
-      "_huntingQuerycontentId279": "21bafecb-ae8f-4667-b7d6-144e047cb602",
-      "huntingQueryTemplateSpecName279": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('21bafecb-ae8f-4667-b7d6-144e047cb602')))]"
-    },
-    "huntingQueryObject280": {
-      "huntingQueryVersion280": "1.0.0",
-      "_huntingQuerycontentId280": "5e8d5202-ffdc-4d16-ad33-d56eb319c175",
-      "huntingQueryTemplateSpecName280": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5e8d5202-ffdc-4d16-ad33-d56eb319c175')))]"
-    },
-    "huntingQueryObject281": {
-      "huntingQueryVersion281": "1.1.0",
-      "_huntingQuerycontentId281": "dbc25434-bbe7-4517-bf4b-48ad9cb4e980",
-      "huntingQueryTemplateSpecName281": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dbc25434-bbe7-4517-bf4b-48ad9cb4e980')))]"
-    },
-    "huntingQueryObject282": {
-      "huntingQueryVersion282": "1.0.0",
-      "_huntingQuerycontentId282": "dd9df55e-79b7-48e0-9d19-965fcadae5e9",
-      "huntingQueryTemplateSpecName282": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dd9df55e-79b7-48e0-9d19-965fcadae5e9')))]"
-    },
-    "huntingQueryObject283": {
-      "huntingQueryVersion283": "1.0.2",
-      "_huntingQuerycontentId283": "cdac93ef-56c0-45bf-9e7f-9cbf0ad06123",
-      "huntingQueryTemplateSpecName283": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdac93ef-56c0-45bf-9e7f-9cbf0ad06123')))]"
-    },
-    "huntingQueryObject284": {
-      "huntingQueryVersion284": "1.0.0",
-      "_huntingQuerycontentId284": "14694b88-a6e9-4cd1-9c4a-e382bdd82d8d",
-      "huntingQueryTemplateSpecName284": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('14694b88-a6e9-4cd1-9c4a-e382bdd82d8d')))]"
-    },
-    "huntingQueryObject285": {
-      "huntingQueryVersion285": "1.0.0",
-      "_huntingQuerycontentId285": "bba7bbbe-5aa3-4c08-bd23-dd6cd8ccaf20",
-      "huntingQueryTemplateSpecName285": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bba7bbbe-5aa3-4c08-bd23-dd6cd8ccaf20')))]"
-    },
-    "huntingQueryObject286": {
-      "huntingQueryVersion286": "1.0.0",
-      "_huntingQuerycontentId286": "7a5597de-7e99-470d-944f-acb163b9cb14",
-      "huntingQueryTemplateSpecName286": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7a5597de-7e99-470d-944f-acb163b9cb14')))]"
-    },
-    "huntingQueryObject287": {
-      "huntingQueryVersion287": "1.0.0",
-      "_huntingQuerycontentId287": "58e6170e-0512-4485-9638-463fdde85b0e",
-      "huntingQueryTemplateSpecName287": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('58e6170e-0512-4485-9638-463fdde85b0e')))]"
-    },
-    "huntingQueryObject288": {
-      "huntingQueryVersion288": "1.0.0",
-      "_huntingQuerycontentId288": "fe912310-32f5-4256-933b-d4b45e7e6e54",
-      "huntingQueryTemplateSpecName288": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fe912310-32f5-4256-933b-d4b45e7e6e54')))]"
-    },
-    "huntingQueryObject289": {
-      "huntingQueryVersion289": "1.0.0",
-      "_huntingQuerycontentId289": "35ca729c-04b4-4f6c-b383-caed1b85226e",
-      "huntingQueryTemplateSpecName289": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('35ca729c-04b4-4f6c-b383-caed1b85226e')))]"
-    },
-    "huntingQueryObject290": {
-      "huntingQueryVersion290": "1.0.0",
-      "_huntingQuerycontentId290": "3842e70d-45be-43b1-8206-4ebc4c305f34",
-      "huntingQueryTemplateSpecName290": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3842e70d-45be-43b1-8206-4ebc4c305f34')))]"
-    },
-    "huntingQueryObject291": {
-      "huntingQueryVersion291": "1.0.0",
-      "_huntingQuerycontentId291": "761230a3-71ad-4522-bfbc-1dca698ffc42",
-      "huntingQueryTemplateSpecName291": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('761230a3-71ad-4522-bfbc-1dca698ffc42')))]"
-    },
-    "huntingQueryObject292": {
-      "huntingQueryVersion292": "1.0.0",
-      "_huntingQuerycontentId292": "81f02314-2ff5-45cb-a35d-0deb546a0104",
-      "huntingQueryTemplateSpecName292": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('81f02314-2ff5-45cb-a35d-0deb546a0104')))]"
-    },
-    "huntingQueryObject293": {
-      "huntingQueryVersion293": "1.0.0",
-      "_huntingQuerycontentId293": "f350f0e7-0e52-434c-a113-197883219f00",
-      "huntingQueryTemplateSpecName293": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f350f0e7-0e52-434c-a113-197883219f00')))]"
-    },
-    "huntingQueryObject294": {
-      "huntingQueryVersion294": "1.0.0",
-      "_huntingQuerycontentId294": "c5b3e559-7c44-442c-9e73-c753abb02c13",
-      "huntingQueryTemplateSpecName294": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c5b3e559-7c44-442c-9e73-c753abb02c13')))]"
-    },
-    "huntingQueryObject295": {
-      "huntingQueryVersion295": "1.0.0",
-      "_huntingQuerycontentId295": "0efbcea0-1dc0-4844-8a9c-3a1d98fc1697",
-      "huntingQueryTemplateSpecName295": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0efbcea0-1dc0-4844-8a9c-3a1d98fc1697')))]"
-    },
-    "huntingQueryObject296": {
-      "huntingQueryVersion296": "1.0.0",
-      "_huntingQuerycontentId296": "3cc2127f-d9ca-46a0-9628-89f702be82b3",
-      "huntingQueryTemplateSpecName296": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3cc2127f-d9ca-46a0-9628-89f702be82b3')))]"
-    },
-    "huntingQueryObject297": {
-      "huntingQueryVersion297": "1.0.0",
-      "_huntingQuerycontentId297": "0b5b076b-9a1c-440c-a11f-8471a75f46fd",
-      "huntingQueryTemplateSpecName297": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0b5b076b-9a1c-440c-a11f-8471a75f46fd')))]"
-    },
-    "huntingQueryObject298": {
-      "huntingQueryVersion298": "1.0.0",
-      "_huntingQuerycontentId298": "2d16b6fc-eb63-491c-a2c2-1160e2e41dcf",
-      "huntingQueryTemplateSpecName298": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2d16b6fc-eb63-491c-a2c2-1160e2e41dcf')))]"
-    },
-    "huntingQueryObject299": {
-      "huntingQueryVersion299": "1.0.0",
-      "_huntingQuerycontentId299": "084a6349-b3d6-4528-91e4-4de5d52424e5",
-      "huntingQueryTemplateSpecName299": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('084a6349-b3d6-4528-91e4-4de5d52424e5')))]"
-    },
-    "huntingQueryObject300": {
-      "huntingQueryVersion300": "1.0.0",
-      "_huntingQuerycontentId300": "8f404352-c4ff-44d1-8d70-c50ee2fad8f8",
-      "huntingQueryTemplateSpecName300": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8f404352-c4ff-44d1-8d70-c50ee2fad8f8')))]"
-    },
-    "huntingQueryObject301": {
-      "huntingQueryVersion301": "1.0.0",
-      "_huntingQuerycontentId301": "daa347a4-8251-43a7-9730-32f22aa741ab",
-      "huntingQueryTemplateSpecName301": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('daa347a4-8251-43a7-9730-32f22aa741ab')))]"
-    },
-    "huntingQueryObject302": {
-      "huntingQueryVersion302": "1.0.0",
-      "_huntingQuerycontentId302": "8722489a-d6f1-4b66-98e9-e3dfda902019",
-      "huntingQueryTemplateSpecName302": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8722489a-d6f1-4b66-98e9-e3dfda902019')))]"
-    },
-    "huntingQueryObject303": {
-      "huntingQueryVersion303": "1.0.2",
-      "_huntingQuerycontentId303": "2bdd260c-c687-4cb2-9992-87e5ce677678",
-      "huntingQueryTemplateSpecName303": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2bdd260c-c687-4cb2-9992-87e5ce677678')))]"
-    },
-    "huntingQueryObject304": {
-      "huntingQueryVersion304": "1.0.0",
-      "_huntingQuerycontentId304": "e17ddfc6-7478-443b-99ff-286f3d09b8aa",
-      "huntingQueryTemplateSpecName304": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e17ddfc6-7478-443b-99ff-286f3d09b8aa')))]"
-    },
-    "huntingQueryObject305": {
-      "huntingQueryVersion305": "1.0.0",
-      "_huntingQuerycontentId305": "4095e430-d3f4-426f-92c5-aa5c5e137ca0",
-      "huntingQueryTemplateSpecName305": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4095e430-d3f4-426f-92c5-aa5c5e137ca0')))]"
-    },
-    "huntingQueryObject306": {
-      "huntingQueryVersion306": "1.0.0",
-      "_huntingQuerycontentId306": "a7214393-9da7-432e-9b41-fb02b4f740bd",
-      "huntingQueryTemplateSpecName306": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a7214393-9da7-432e-9b41-fb02b4f740bd')))]"
-    },
-    "huntingQueryObject307": {
-      "huntingQueryVersion307": "1.0.0",
-      "_huntingQuerycontentId307": "cedc5bfa-01f6-4e54-b87b-1edbe430e27a",
-      "huntingQueryTemplateSpecName307": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cedc5bfa-01f6-4e54-b87b-1edbe430e27a')))]"
-    },
-    "huntingQueryObject308": {
-      "huntingQueryVersion308": "1.0.0",
-      "_huntingQuerycontentId308": "d0585c34-1b03-473c-938d-11fe73f7e053",
-      "huntingQueryTemplateSpecName308": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d0585c34-1b03-473c-938d-11fe73f7e053')))]"
-    },
-    "huntingQueryObject309": {
-      "huntingQueryVersion309": "1.0.0",
-      "_huntingQuerycontentId309": "63142c12-5d8b-48cf-a0f6-b523c855497c",
-      "huntingQueryTemplateSpecName309": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('63142c12-5d8b-48cf-a0f6-b523c855497c')))]"
-    },
-    "huntingQueryObject310": {
-      "huntingQueryVersion310": "1.0.0",
-      "_huntingQuerycontentId310": "96976bb1-1993-45b8-a477-8236ee93976b",
-      "huntingQueryTemplateSpecName310": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('96976bb1-1993-45b8-a477-8236ee93976b')))]"
-    },
-    "huntingQueryObject311": {
-      "huntingQueryVersion311": "1.0.0",
-      "_huntingQuerycontentId311": "1ddee78f-7508-4f4a-9b6b-d2927724217d",
-      "huntingQueryTemplateSpecName311": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1ddee78f-7508-4f4a-9b6b-d2927724217d')))]"
-    },
-    "huntingQueryObject312": {
-      "huntingQueryVersion312": "1.0.0",
-      "_huntingQuerycontentId312": "1299962c-804e-459a-8d3d-41d68bc45ba2",
-      "huntingQueryTemplateSpecName312": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1299962c-804e-459a-8d3d-41d68bc45ba2')))]"
-    },
-    "huntingQueryObject313": {
-      "huntingQueryVersion313": "1.0.0",
-      "_huntingQuerycontentId313": "cb2fb8f9-89bd-485e-8422-da8cb6c7bc23",
-      "huntingQueryTemplateSpecName313": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cb2fb8f9-89bd-485e-8422-da8cb6c7bc23')))]"
-    },
-    "huntingQueryObject314": {
-      "huntingQueryVersion314": "1.0.0",
-      "_huntingQuerycontentId314": "4f669adc-2c00-4bc8-896b-e59f068dcb18",
-      "huntingQueryTemplateSpecName314": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4f669adc-2c00-4bc8-896b-e59f068dcb18')))]"
-    },
-    "huntingQueryObject315": {
-      "huntingQueryVersion315": "1.0.0",
-      "_huntingQuerycontentId315": "06ea5081-cdea-40c8-b829-240ece951243",
-      "huntingQueryTemplateSpecName315": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('06ea5081-cdea-40c8-b829-240ece951243')))]"
-    },
-    "huntingQueryObject316": {
-      "huntingQueryVersion316": "1.0.0",
-      "_huntingQuerycontentId316": "f086d58b-c44b-4fae-903b-f65ad042a4ee",
-      "huntingQueryTemplateSpecName316": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f086d58b-c44b-4fae-903b-f65ad042a4ee')))]"
-    },
-    "huntingQueryObject317": {
-      "huntingQueryVersion317": "1.0.0",
-      "_huntingQuerycontentId317": "88707168-d4a4-4ca7-a516-b2ee0310af1b",
-      "huntingQueryTemplateSpecName317": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('88707168-d4a4-4ca7-a516-b2ee0310af1b')))]"
-    },
-    "huntingQueryObject318": {
-      "huntingQueryVersion318": "1.0.0",
-      "_huntingQuerycontentId318": "853bacff-45cf-42f2-b2a6-6727fcf183ef",
-      "huntingQueryTemplateSpecName318": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('853bacff-45cf-42f2-b2a6-6727fcf183ef')))]"
-    },
-    "huntingQueryObject319": {
-      "huntingQueryVersion319": "1.0.0",
-      "_huntingQuerycontentId319": "829cf5ba-39d5-4986-814e-d46f8437c27b",
-      "huntingQueryTemplateSpecName319": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('829cf5ba-39d5-4986-814e-d46f8437c27b')))]"
-    },
-    "huntingQueryObject320": {
-      "huntingQueryVersion320": "1.0.0",
-      "_huntingQuerycontentId320": "3dd9ab09-0ea3-4f47-ba10-f84045ab52c3",
-      "huntingQueryTemplateSpecName320": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3dd9ab09-0ea3-4f47-ba10-f84045ab52c3')))]"
-    },
-    "huntingQueryObject321": {
-      "huntingQueryVersion321": "1.0.0",
-      "_huntingQuerycontentId321": "4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77",
-      "huntingQueryTemplateSpecName321": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77')))]"
-    },
-    "huntingQueryObject322": {
-      "huntingQueryVersion322": "1.0.0",
-      "_huntingQuerycontentId322": "74cc0176-3900-440e-b179-45d6a957145a",
-      "huntingQueryTemplateSpecName322": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('74cc0176-3900-440e-b179-45d6a957145a')))]"
-    },
-    "huntingQueryObject323": {
-      "huntingQueryVersion323": "1.0.0",
-      "_huntingQuerycontentId323": "e18109aa-f252-48ec-b115-1b7c16e1174f",
-      "huntingQueryTemplateSpecName323": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e18109aa-f252-48ec-b115-1b7c16e1174f')))]"
-    },
-    "huntingQueryObject324": {
-      "huntingQueryVersion324": "1.0.0",
-      "_huntingQuerycontentId324": "aa3a8508-c0ff-404d-8d5c-4e7f548b0d86",
-      "huntingQueryTemplateSpecName324": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('aa3a8508-c0ff-404d-8d5c-4e7f548b0d86')))]"
-    },
-    "huntingQueryObject325": {
-      "huntingQueryVersion325": "1.0.0",
-      "_huntingQuerycontentId325": "9674f529-f0e9-4305-862d-479ccc9e28f1",
-      "huntingQueryTemplateSpecName325": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9674f529-f0e9-4305-862d-479ccc9e28f1')))]"
-    },
-    "huntingQueryObject326": {
-      "huntingQueryVersion326": "1.0.0",
-      "_huntingQuerycontentId326": "180bacfd-18de-450a-8e0c-7d2fa399ca49",
-      "huntingQueryTemplateSpecName326": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('180bacfd-18de-450a-8e0c-7d2fa399ca49')))]"
-    },
-    "huntingQueryObject327": {
-      "huntingQueryVersion327": "1.0.1",
-      "_huntingQuerycontentId327": "9582b09c-a5cd-4da0-8244-52cc952da158",
-      "huntingQueryTemplateSpecName327": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9582b09c-a5cd-4da0-8244-52cc952da158')))]"
-    },
-    "huntingQueryObject328": {
-      "huntingQueryVersion328": "1.0.0",
-      "_huntingQuerycontentId328": "a2ad014d-0a3a-45eb-ad58-b20532b86015",
-      "huntingQueryTemplateSpecName328": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a2ad014d-0a3a-45eb-ad58-b20532b86015')))]"
-    },
-    "huntingQueryObject329": {
-      "huntingQueryVersion329": "1.0.0",
-      "_huntingQuerycontentId329": "d0232a68-41e1-4fdf-aa17-bf67001fe7b2",
-      "huntingQueryTemplateSpecName329": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d0232a68-41e1-4fdf-aa17-bf67001fe7b2')))]"
-    },
-    "huntingQueryObject330": {
-      "huntingQueryVersion330": "1.0.0",
-      "_huntingQuerycontentId330": "a5888069-ad78-4ac5-9241-5ee83eb19d5d",
-      "huntingQueryTemplateSpecName330": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a5888069-ad78-4ac5-9241-5ee83eb19d5d')))]"
-    },
-    "huntingQueryObject331": {
-      "huntingQueryVersion331": "1.0.0",
-      "_huntingQuerycontentId331": "80067390-3954-4276-bbca-8d4be1df0591",
-      "huntingQueryTemplateSpecName331": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('80067390-3954-4276-bbca-8d4be1df0591')))]"
-    },
-    "huntingQueryObject332": {
-      "huntingQueryVersion332": "1.0.0",
-      "_huntingQuerycontentId332": "cb7629af-4872-427a-9042-ce848c2f49e7",
-      "huntingQueryTemplateSpecName332": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cb7629af-4872-427a-9042-ce848c2f49e7')))]"
-    },
-    "huntingQueryObject333": {
-      "huntingQueryVersion333": "1.0.0",
-      "_huntingQuerycontentId333": "6ad2dbb3-40de-4e39-a3b0-5c8be4e37b7b",
-      "huntingQueryTemplateSpecName333": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6ad2dbb3-40de-4e39-a3b0-5c8be4e37b7b')))]"
-    },
-    "huntingQueryObject334": {
-      "huntingQueryVersion334": "1.0.0",
-      "_huntingQuerycontentId334": "41614487-ccca-458e-81eb-dffbeba0b703",
-      "huntingQueryTemplateSpecName334": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('41614487-ccca-458e-81eb-dffbeba0b703')))]"
-    },
-    "huntingQueryObject335": {
-      "huntingQueryVersion335": "1.0.0",
-      "_huntingQuerycontentId335": "370583ef-40d1-4d8e-a2e2-16095704f357",
-      "huntingQueryTemplateSpecName335": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('370583ef-40d1-4d8e-a2e2-16095704f357')))]"
-    },
-    "huntingQueryObject336": {
-      "huntingQueryVersion336": "1.0.0",
-      "_huntingQuerycontentId336": "01d676ef-29fb-4974-9db1-763660d577fa",
-      "huntingQueryTemplateSpecName336": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('01d676ef-29fb-4974-9db1-763660d577fa')))]"
-    },
-    "huntingQueryObject337": {
-      "huntingQueryVersion337": "1.0.0",
-      "_huntingQuerycontentId337": "7d5d4ac0-e3db-4ddc-9fd3-9894c7de2c5c",
-      "huntingQueryTemplateSpecName337": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7d5d4ac0-e3db-4ddc-9fd3-9894c7de2c5c')))]"
-    },
-    "huntingQueryObject338": {
-      "huntingQueryVersion338": "1.0.0",
-      "_huntingQuerycontentId338": "5dcb4965-db9c-4fee-a7b1-c178998ce5e8",
-      "huntingQueryTemplateSpecName338": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5dcb4965-db9c-4fee-a7b1-c178998ce5e8')))]"
-    },
-    "huntingQueryObject339": {
-      "huntingQueryVersion339": "1.0.0",
-      "_huntingQuerycontentId339": "f72e4cc0-1cb9-413a-8f56-f0363c205d1c",
-      "huntingQueryTemplateSpecName339": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f72e4cc0-1cb9-413a-8f56-f0363c205d1c')))]"
-    },
-    "huntingQueryObject340": {
-      "huntingQueryVersion340": "1.0.0",
-      "_huntingQuerycontentId340": "6f0595a9-724e-4b19-8a9c-8a50d0ac2eef",
-      "huntingQueryTemplateSpecName340": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6f0595a9-724e-4b19-8a9c-8a50d0ac2eef')))]"
-    },
-    "huntingQueryObject341": {
-      "huntingQueryVersion341": "1.0.0",
-      "_huntingQuerycontentId341": "2c96d709-274b-45b8-b53a-545124ac8d8a",
-      "huntingQueryTemplateSpecName341": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2c96d709-274b-45b8-b53a-545124ac8d8a')))]"
-    },
-    "huntingQueryObject342": {
-      "huntingQueryVersion342": "1.0.0",
-      "_huntingQuerycontentId342": "57d825ee-1546-48af-b2d3-644731d21ad3",
-      "huntingQueryTemplateSpecName342": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('57d825ee-1546-48af-b2d3-644731d21ad3')))]"
-    },
-    "huntingQueryObject343": {
-      "huntingQueryVersion343": "1.0.0",
-      "_huntingQuerycontentId343": "f9caad74-cd5a-4559-949a-6cd0f3376ff6",
-      "huntingQueryTemplateSpecName343": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f9caad74-cd5a-4559-949a-6cd0f3376ff6')))]"
-    },
-    "huntingQueryObject344": {
-      "huntingQueryVersion344": "1.0.0",
-      "_huntingQuerycontentId344": "b232adb3-059b-4351-9e4b-78a3c15175e5",
-      "huntingQueryTemplateSpecName344": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b232adb3-059b-4351-9e4b-78a3c15175e5')))]"
-    },
-    "huntingQueryObject345": {
-      "huntingQueryVersion345": "1.0.0",
-      "_huntingQuerycontentId345": "eee98563-fd77-4d6a-a1aa-e0e4952b5cf3",
-      "huntingQueryTemplateSpecName345": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('eee98563-fd77-4d6a-a1aa-e0e4952b5cf3')))]"
-    },
-    "huntingQueryObject346": {
-      "huntingQueryVersion346": "1.0.0",
-      "_huntingQuerycontentId346": "f9ec4d6a-4112-4f4a-bbe9-71eb6f65ce3d",
-      "huntingQueryTemplateSpecName346": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f9ec4d6a-4112-4f4a-bbe9-71eb6f65ce3d')))]"
-    },
-    "huntingQueryObject347": {
-      "huntingQueryVersion347": "1.0.0",
-      "_huntingQuerycontentId347": "a52f16af-5632-420d-ae90-b1b8bd742af0",
-      "huntingQueryTemplateSpecName347": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a52f16af-5632-420d-ae90-b1b8bd742af0')))]"
-    },
-    "huntingQueryObject348": {
-      "huntingQueryVersion348": "1.0.0",
-      "_huntingQuerycontentId348": "c8b12c34-4571-4d37-ae85-fafb02f8bc24",
-      "huntingQueryTemplateSpecName348": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c8b12c34-4571-4d37-ae85-fafb02f8bc24')))]"
-    },
-    "huntingQueryObject349": {
-      "huntingQueryVersion349": "1.0.0",
-      "_huntingQuerycontentId349": "3c9780f9-1784-48b3-b82e-d1e334c08ed2",
-      "huntingQueryTemplateSpecName349": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3c9780f9-1784-48b3-b82e-d1e334c08ed2')))]"
-    },
-    "huntingQueryObject350": {
-      "huntingQueryVersion350": "1.0.0",
-      "_huntingQuerycontentId350": "b2ec7e00-f8a5-450a-81d9-ddb884162595",
-      "huntingQueryTemplateSpecName350": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b2ec7e00-f8a5-450a-81d9-ddb884162595')))]"
-    },
-    "huntingQueryObject351": {
-      "huntingQueryVersion351": "1.0.0",
-      "_huntingQuerycontentId351": "9ddbd09d-6119-4e78-bf15-911c4113d608",
-      "huntingQueryTemplateSpecName351": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9ddbd09d-6119-4e78-bf15-911c4113d608')))]"
-    },
-    "huntingQueryObject352": {
-      "huntingQueryVersion352": "1.0.0",
-      "_huntingQuerycontentId352": "1be71088-f71c-43cc-9adc-9e5fd7a3a8c4",
-      "huntingQueryTemplateSpecName352": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1be71088-f71c-43cc-9adc-9e5fd7a3a8c4')))]"
-    },
-    "huntingQueryObject353": {
-      "huntingQueryVersion353": "1.0.0",
-      "_huntingQuerycontentId353": "293d6bbe-97b6-458e-8670-929e9f1756d2",
-      "huntingQueryTemplateSpecName353": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('293d6bbe-97b6-458e-8670-929e9f1756d2')))]"
-    },
-    "huntingQueryObject354": {
-      "huntingQueryVersion354": "1.0.0",
-      "_huntingQuerycontentId354": "b5ac7138-d807-450e-9f67-dbdac948f651",
-      "huntingQueryTemplateSpecName354": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b5ac7138-d807-450e-9f67-dbdac948f651')))]"
-    },
-    "huntingQueryObject355": {
-      "huntingQueryVersion355": "1.0.0",
-      "_huntingQuerycontentId355": "95f7ab0b-3025-487e-9523-1b68152f4b91",
-      "huntingQueryTemplateSpecName355": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('95f7ab0b-3025-487e-9523-1b68152f4b91')))]"
-    },
-    "huntingQueryObject356": {
-      "huntingQueryVersion356": "1.0.0",
-      "_huntingQuerycontentId356": "d3427b51-d7b9-4610-a871-5738e59cfa93",
-      "huntingQueryTemplateSpecName356": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d3427b51-d7b9-4610-a871-5738e59cfa93')))]"
-    },
-    "huntingQueryObject357": {
-      "huntingQueryVersion357": "1.0.0",
-      "_huntingQuerycontentId357": "22dd5345-f620-41b2-b319-a1b3cfa9cb8e",
-      "huntingQueryTemplateSpecName357": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('22dd5345-f620-41b2-b319-a1b3cfa9cb8e')))]"
-    },
-    "huntingQueryObject358": {
-      "huntingQueryVersion358": "1.0.0",
-      "_huntingQuerycontentId358": "7d041b6d-973b-48aa-886d-d234047511f2",
-      "huntingQueryTemplateSpecName358": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7d041b6d-973b-48aa-886d-d234047511f2')))]"
-    },
-    "huntingQueryObject359": {
-      "huntingQueryVersion359": "1.0.0",
-      "_huntingQuerycontentId359": "b54359db-ca8c-4a11-98b7-0f320b870cbd",
-      "huntingQueryTemplateSpecName359": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b54359db-ca8c-4a11-98b7-0f320b870cbd')))]"
-    },
-    "huntingQueryObject360": {
-      "huntingQueryVersion360": "1.0.0",
-      "_huntingQuerycontentId360": "945a8419-d3ec-41ba-a4b3-c37303bd9458",
-      "huntingQueryTemplateSpecName360": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('945a8419-d3ec-41ba-a4b3-c37303bd9458')))]"
-    },
-    "huntingQueryObject361": {
-      "huntingQueryVersion361": "1.0.0",
-      "_huntingQuerycontentId361": "ccaec93a-7231-4483-9d36-78106f0a8a1a",
-      "huntingQueryTemplateSpecName361": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ccaec93a-7231-4483-9d36-78106f0a8a1a')))]"
-    },
-    "huntingQueryObject362": {
-      "huntingQueryVersion362": "1.0.0",
-      "_huntingQuerycontentId362": "60cf8dc6-b3f7-4bd9-b877-3ed9c9443750",
-      "huntingQueryTemplateSpecName362": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('60cf8dc6-b3f7-4bd9-b877-3ed9c9443750')))]"
-    },
-    "huntingQueryObject363": {
-      "huntingQueryVersion363": "1.0.0",
-      "_huntingQuerycontentId363": "8c86aaf1-46c1-4eee-8953-60f163e83253",
-      "huntingQueryTemplateSpecName363": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8c86aaf1-46c1-4eee-8953-60f163e83253')))]"
-    },
-    "huntingQueryObject364": {
-      "huntingQueryVersion364": "1.0.0",
-      "_huntingQuerycontentId364": "3027abf0-a965-42bd-babe-79f34bbd9e7a",
-      "huntingQueryTemplateSpecName364": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3027abf0-a965-42bd-babe-79f34bbd9e7a')))]"
-    },
-    "huntingQueryObject365": {
-      "huntingQueryVersion365": "1.0.0",
-      "_huntingQuerycontentId365": "ca968fd4-2778-4bca-9da3-2dd1f1b38746",
-      "huntingQueryTemplateSpecName365": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ca968fd4-2778-4bca-9da3-2dd1f1b38746')))]"
-    },
-    "huntingQueryObject366": {
-      "huntingQueryVersion366": "1.0.0",
-      "_huntingQuerycontentId366": "2a3fe5b0-9a99-467a-b5f9-57825530b22b",
-      "huntingQueryTemplateSpecName366": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2a3fe5b0-9a99-467a-b5f9-57825530b22b')))]"
-    },
-    "huntingQueryObject367": {
-      "huntingQueryVersion367": "1.0.0",
-      "_huntingQuerycontentId367": "fd9d2289-a2c3-4634-8a87-abe4a7db896f",
-      "huntingQueryTemplateSpecName367": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fd9d2289-a2c3-4634-8a87-abe4a7db896f')))]"
-    },
-    "huntingQueryObject368": {
-      "huntingQueryVersion368": "1.0.0",
-      "_huntingQuerycontentId368": "04f08949-c44a-4c02-9d3c-ba40186ea6b2",
-      "huntingQueryTemplateSpecName368": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('04f08949-c44a-4c02-9d3c-ba40186ea6b2')))]"
-    },
-    "huntingQueryObject369": {
-      "huntingQueryVersion369": "1.0.0",
-      "_huntingQuerycontentId369": "14d4474b-10d0-4d03-9938-98c8ef92f15a",
-      "huntingQueryTemplateSpecName369": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('14d4474b-10d0-4d03-9938-98c8ef92f15a')))]"
-    },
-    "huntingQueryObject370": {
-      "huntingQueryVersion370": "1.0.0",
-      "_huntingQuerycontentId370": "2bf1fded-7eb8-4cff-9e1d-efd204cac3f6",
-      "huntingQueryTemplateSpecName370": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2bf1fded-7eb8-4cff-9e1d-efd204cac3f6')))]"
-    },
-    "huntingQueryObject371": {
-      "huntingQueryVersion371": "1.0.0",
-      "_huntingQuerycontentId371": "3f252bcb-71a8-4c04-bed9-4dd53419ecb6",
-      "huntingQueryTemplateSpecName371": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3f252bcb-71a8-4c04-bed9-4dd53419ecb6')))]"
-    },
-    "huntingQueryObject372": {
-      "huntingQueryVersion372": "1.0.0",
-      "_huntingQuerycontentId372": "6b26701a-a1c7-4782-a662-f44cdca5bb5f",
-      "huntingQueryTemplateSpecName372": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6b26701a-a1c7-4782-a662-f44cdca5bb5f')))]"
-    },
-    "huntingQueryObject373": {
-      "huntingQueryVersion373": "1.0.0",
-      "_huntingQuerycontentId373": "97f19cad-130a-47b3-a3bb-cbc2e66845f0",
-      "huntingQueryTemplateSpecName373": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('97f19cad-130a-47b3-a3bb-cbc2e66845f0')))]"
-    },
-    "huntingQueryObject374": {
-      "huntingQueryVersion374": "1.0.0",
-      "_huntingQuerycontentId374": "37511ce4-f88e-4e2d-b505-27411af1a226",
-      "huntingQueryTemplateSpecName374": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('37511ce4-f88e-4e2d-b505-27411af1a226')))]"
-    },
-    "huntingQueryObject375": {
-      "huntingQueryVersion375": "1.0.0",
-      "_huntingQuerycontentId375": "97f0d020-be70-4732-b5d7-abcfeecc459c",
-      "huntingQueryTemplateSpecName375": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('97f0d020-be70-4732-b5d7-abcfeecc459c')))]"
-    },
-    "huntingQueryObject376": {
-      "huntingQueryVersion376": "1.0.0",
-      "_huntingQuerycontentId376": "4ae87c11-4030-42cb-b87d-993198ca40e0",
-      "huntingQueryTemplateSpecName376": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4ae87c11-4030-42cb-b87d-993198ca40e0')))]"
-    },
-    "huntingQueryObject377": {
-      "huntingQueryVersion377": "1.0.0",
-      "_huntingQuerycontentId377": "05d933db-f605-48d5-a177-af64be537cf4",
-      "huntingQueryTemplateSpecName377": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('05d933db-f605-48d5-a177-af64be537cf4')))]"
-    },
-    "huntingQueryObject378": {
-      "huntingQueryVersion378": "1.0.0",
-      "_huntingQuerycontentId378": "2f8a0226-b3f3-4a31-b32b-2dd15d644625",
-      "huntingQueryTemplateSpecName378": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2f8a0226-b3f3-4a31-b32b-2dd15d644625')))]"
-    },
-    "huntingQueryObject379": {
-      "huntingQueryVersion379": "1.0.0",
-      "_huntingQuerycontentId379": "a92a3921-1a71-4a4d-8382-873b689ff7d8",
-      "huntingQueryTemplateSpecName379": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a92a3921-1a71-4a4d-8382-873b689ff7d8')))]"
-    },
-    "huntingQueryObject380": {
-      "huntingQueryVersion380": "1.0.0",
-      "_huntingQuerycontentId380": "22811654-25ac-43d6-ba63-699ec29dd6af",
-      "huntingQueryTemplateSpecName380": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('22811654-25ac-43d6-ba63-699ec29dd6af')))]"
-    },
-    "huntingQueryObject381": {
-      "huntingQueryVersion381": "1.0.0",
-      "_huntingQuerycontentId381": "13e20569-a96c-48c4-b0d7-3c2058d24245",
-      "huntingQueryTemplateSpecName381": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('13e20569-a96c-48c4-b0d7-3c2058d24245')))]"
-    },
-    "huntingQueryObject382": {
-      "huntingQueryVersion382": "1.0.0",
-      "_huntingQuerycontentId382": "d31069b5-44a5-4a5d-96fa-68db27074023",
-      "huntingQueryTemplateSpecName382": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d31069b5-44a5-4a5d-96fa-68db27074023')))]"
-    },
-    "huntingQueryObject383": {
-      "huntingQueryVersion383": "1.0.0",
-      "_huntingQuerycontentId383": "07e1f2f5-3662-4e8b-8f52-5273d220976b",
-      "huntingQueryTemplateSpecName383": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('07e1f2f5-3662-4e8b-8f52-5273d220976b')))]"
-    },
-    "huntingQueryObject384": {
-      "huntingQueryVersion384": "1.0.0",
-      "_huntingQuerycontentId384": "a0d5391b-a44c-433c-8e08-7137f6e4a23c",
-      "huntingQueryTemplateSpecName384": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a0d5391b-a44c-433c-8e08-7137f6e4a23c')))]"
-    },
-    "huntingQueryObject385": {
-      "huntingQueryVersion385": "1.0.0",
-      "_huntingQuerycontentId385": "effba60e-0a4a-4558-bbf6-4e099607d82e",
-      "huntingQueryTemplateSpecName385": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('effba60e-0a4a-4558-bbf6-4e099607d82e')))]"
-    },
-    "huntingQueryObject386": {
-      "huntingQueryVersion386": "1.0.0",
-      "_huntingQuerycontentId386": "4bce2a7c-31fb-46e9-8487-ce611bd98004",
-      "huntingQueryTemplateSpecName386": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4bce2a7c-31fb-46e9-8487-ce611bd98004')))]"
-    },
-    "huntingQueryObject387": {
-      "huntingQueryVersion387": "1.0.0",
-      "_huntingQuerycontentId387": "88035c0e-0e2d-4805-a249-34d54a88c3fe",
-      "huntingQueryTemplateSpecName387": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('88035c0e-0e2d-4805-a249-34d54a88c3fe')))]"
-    },
-    "workbookVersion1": "4.0.0",
-    "workbookContentId1": "MicrosoftDefenderForOffice365detectionsandinsights",
-    "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
-    "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
-    "_workbookContentId1": "[variables('workbookContentId1')]",
-    "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
-    "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
-    "workbookVersion2": "1.0.0",
-    "workbookContentId2": "MicrosoftDefenderForEndPoint",
-    "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]",
-    "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]",
-    "_workbookContentId2": "[variables('workbookContentId2')]",
-    "_workbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId2'),'-', variables('workbookVersion2'))))]",
-    "workbookVersion3": "1.0.0",
-    "workbookContentId3": "MicrosoftDefenderForIdentity",
-    "workbookId3": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId3'))]",
-    "workbookTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId3'))))]",
-    "_workbookContentId3": "[variables('workbookContentId3')]",
-    "_workbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId3'),'-', variables('workbookVersion3'))))]",
     "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
   },
   "resources": [
@@ -2316,7 +71,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Microsoft Defender XDR data connector with template version 3.0.18",
+        "description": "Microsoft Defender XDR data connector with template version 3.2.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion1')]",
@@ -2569,7 +324,8 @@
         "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
         "id": "[variables('_dataConnectorcontentProductId1')]",
         "version": "[variables('dataConnectorVersion1')]"
-      }
+      },
+      "condition": "[parameters('DeployDataConnector')]"
     },
     {
       "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
@@ -2599,7 +355,8 @@
           "tier": "Microsoft",
           "link": "https://support.microsoft.com"
         }
-      }
+      },
+      "condition": "[parameters('DeployDataConnector')]"
     },
     {
       "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
@@ -2806,40374 +563,31831 @@
           ],
           "id": "[variables('_uiConfigId1')]"
         }
-      }
+      },
+      "condition": "[parameters('DeployDataConnector')]"
     },
     {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
       "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]",
       "location": "[parameters('workspace-location')]",
+      "properties": {
+        "version": "3.2.1",
+        "kind": "Solution",
+        "contentSchemaVersion": "3.0.0",
+        "displayName": "Microsoft Defender XDR",
+        "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
+        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20XDR/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>Workbook-only authoring candidate for Microsoft Defender XDR: Defender for Endpoint, Defender for Identity, and Office 365 Detections &amp; Insights. Includes the Microsoft Defender XDR connector prerequisite for panels using connected Sentinel SecurityAlert data. Detection rules, hunting queries, playbooks, and Sentinel workbook installation are excluded. Live installation and runtime qualification are not established.</p>\n<p><strong>Data Connectors:</strong> 1, <strong>XDR Workbooks:</strong> 3</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
+        "contentKind": "Solution",
+        "contentProductId": "[variables('_solutioncontentProductId')]",
+        "id": "[variables('_solutioncontentProductId')]",
+        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
+        "contentId": "[variables('_solutionId')]",
+        "parentId": "[variables('_solutionId')]",
+        "source": {
+          "kind": "Solution",
+          "name": "Microsoft Defender XDR",
+          "sourceId": "[variables('_solutionId')]"
+        },
+        "author": {
+          "name": "Microsoft",
+          "email": "[variables('_email')]"
+        },
+        "support": {
+          "name": "Microsoft Corporation",
+          "email": "support@microsoft.com",
+          "tier": "Microsoft",
+          "link": "https://support.microsoft.com"
+        },
+        "dependencies": {
+          "operator": "AND",
+          "criteria": [
+            {
+              "kind": "DataConnector",
+              "contentId": "[variables('_dataConnectorContentId1')]",
+              "version": "[variables('dataConnectorVersion1')]"
+            },
+            {
+              "kind": "DefenderWorkbook",
+              "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215",
+              "version": "3.2.1"
+            },
+            {
+              "kind": "DefenderWorkbook",
+              "contentId": "200c5dd2-9786-5619-8425-4508a238d76a",
+              "version": "3.2.1"
+            },
+            {
+              "kind": "DefenderWorkbook",
+              "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c",
+              "version": "3.2.1"
+            }
+          ]
+        },
+        "firstPublishDate": "2022-05-02",
+        "providers": [
+          "Microsoft"
+        ],
+        "categories": {
+          "domains": [
+            "Security - Threat Protection"
+          ]
+        }
+      },
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "DefenderWorkbook-6215edc38e31ea23679b02a59de10f4a",
       "dependsOn": [
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "PossiblePhishingwithCSL&NetworkSession_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
+        "mode": "Incremental",
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "imports": {
+            "MicrosoftSecurity": {
+              "provider": "MicrosoftSecurity",
+              "version": "1.0.0"
+            }
+          },
+          "resources": {
+            "workbook": {
+              "import": "MicrosoftSecurity",
+              "type": "Microsoft.Security/workbooks@2026-06-01-preview",
               "properties": {
-                "description": "This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. \nIf your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored.",
-                "displayName": "Possible Phishing with CSL and Network Sessions",
-                "enabled": false,
-                "query": "//SuspiciousUrlClicked\nAlertEvidence\n| where ServiceSource =~ \"Microsoft Defender for Office 365\"\n| where EntityType =~ \"Url\"\n| project AlertId, RemoteUrl\n| join kind=inner (\nAlertEvidence\n| where ServiceSource =~ \"Microsoft Defender for Office 365\"\n| where EntityType =~ \"MailMessage\"\n| project AlertId, NetworkMessageId\n)\non AlertId\n| distinct RemoteUrl, NetworkMessageId\n| join EmailEvents on NetworkMessageId\n| distinct RemoteUrl, NetworkMessageId, RecipientEmailAddress, RecipientObjectId\n| join kind = inner IdentityInfo on $left.RecipientObjectId  == $right.AccountObjectId\n| distinct RemoteUrl, NetworkMessageId, RecipientEmailAddress , RecipientObjectId, AccountSID\n| join kind = inner  \n(DeviceEvents\n| where ActionType =~ \"BrowserLaunchedToOpenUrl\"| where isnotempty(RemoteUrl)\n| project  UrlClickedByUserSid = RemoteUrl,\nInitiatingProcessAccountSid, DeviceName, DeviceId, InitiatingProcessFileName,\nInitiatingProcessAccountUpn, InitiatingProcessAccountName, InitiatingProcessAccountDomain\n)\non $left.AccountSID == $right.InitiatingProcessAccountSid and $left.RemoteUrl == $right.UrlClickedByUserSid\n| distinct  RemoteUrl, NetworkMessageId, RecipientEmailAddress, RecipientObjectId,\n AccountSID, UrlClickedByUserSid, DeviceName, DeviceId, InitiatingProcessFileName,\n InitiatingProcessAccountUpn, InitiatingProcessAccountName, InitiatingProcessAccountDomain\n|  join kind=inner\n(\n//Suspicious url clicked found in common security logs\nCommonSecurityLog\n| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceAction, DestinationDnsDomain, DestinationIP, RequestURL, SourceIP, SourceHostName, RequestClientApplication\n) on $left.RemoteUrl== $right.RequestURL\n|  join kind=inner\n(\n//Find the relevant network sessions\n_Im_NetworkSession\n| where isnotempty(DstIpAddr)\n| where not(ipv4_is_private(DstIpAddr))\n| project TimeGenerated, SrcIpAddr, SrcPortNumber, DstIpAddr, DstPortNumber, DstBytes, SrcBytes\n) on  $left.DestinationIP == $right.DstIpAddr //The relevant network session being projected \n| summarize count() by TimeGenerated, RecipientEmailAddress, UrlClickedByUserSid, InitiatingProcessAccountUpn, InitiatingProcessAccountName, InitiatingProcessAccountDomain,\nDeviceName, InitiatingProcessFileName, DeviceProduct, DeviceAction, SourceIP, DestinationIP, RequestClientApplication\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n| extend RecipientEmailName = tostring(split(RecipientEmailAddress,'@',0)[0]), RecipientEmailUPNSuffix = tostring(split(RecipientEmailAddress,'@',1)[0])\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "AlertEvidence",
-                      "EmailEvents",
-                      "IdentityInfo",
-                      "DeviceEvents",
-                      "DeviceNetworkEvents"
-                    ]
-                  },
-                  {
-                    "connectorId": "Zscaler",
-                    "dataTypes": [
-                      "CommonSecurityLog"
-                    ]
-                  },
-                  {
-                    "connectorId": "Fortinet",
-                    "dataTypes": [
-                      "CommonSecurityLog"
-                    ]
-                  },
-                  {
-                    "connectorId": "CheckPoint",
-                    "dataTypes": [
-                      "CommonSecurityLog"
-                    ]
-                  },
-                  {
-                    "connectorId": "PaloAltoNetworks",
-                    "dataTypes": [
-                      "CommonSecurityLog"
-                    ]
-                  },
-                  {
-                    "connectorId": "AWSS3",
-                    "datatypes": [
-                      "AWSVPCFlow"
-                    ]
-                  },
-                  {
-                    "connectorId": "WindowsForwardedEvents",
-                    "dataTypes": [
-                      "WindowsEvent"
-                    ]
-                  },
-                  {
-                    "connectorId": "SecurityEvents",
-                    "dataTypes": [
-                      "SecurityEvent"
-                    ]
-                  },
-                  {
-                    "connectorId": "WindowsSecurityEvents",
-                    "dataTypes": [
-                      "SecurityEvent"
-                    ]
-                  },
-                  {
-                    "connectorId": "MicrosoftSysmonForLinux",
-                    "dataTypes": [
-                      "Syslog"
-                    ]
-                  },
-                  {
-                    "connectorId": "AzureNSG",
-                    "dataTypes": [
-                      "AzureDiagnostics"
-                    ]
-                  },
-                  {
-                    "connectorId": "AzureMonitor(VMInsights)",
-                    "dataTypes": [
-                      "VMConnection"
-                    ]
-                  },
-                  {
-                    "connectorId": "AIVectraStream",
-                    "dataTypes": [
-                      "VectraStream_CL"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "InitialAccess",
-                  "CommandAndControl"
-                ],
-                "techniques": [
-                  "T1566",
-                  "T1102"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
-                      },
-                      {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "RecipientEmailAddress"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "RecipientEmailName"
-                      },
-                      {
-                        "identifier": "UPNSuffix",
-                        "columnName": "RecipientEmailUPNSuffix"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "SourceIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "DestinationIP"
-                      }
-                    ],
-                    "entityType": "IP"
+                "id": "4fffade5-9b6b-51af-a33d-97641e240595",
+                "name": "MicrosoftDefenderForEndPoint",
+                "content": {
+                  "version": "Notebook/1.0",
+                  "items": [
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "## Microsoft Defender for Endpoint (Preview)\n---\n\nA workbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through Microsoft Defender XDR Connector.\n\n\n"
+                      },
+                      "name": "text - 2"
+                    },
+                    {
+                      "type": 9,
+                      "content": {
+                        "version": "KqlParameterItem/1.0",
+                        "parameters": [
+                          {
+                            "id": "b22a3bd7-19b3-495d-a0df-95a7a59d98ff",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "TimeRange",
+                            "type": 4,
+                            "value": {
+                              "durationMs": 172800000
+                            },
+                            "typeSettings": {
+                              "selectableValues": [
+                                {
+                                  "durationMs": 300000
+                                },
+                                {
+                                  "durationMs": 900000
+                                },
+                                {
+                                  "durationMs": 1800000
+                                },
+                                {
+                                  "durationMs": 3600000
+                                },
+                                {
+                                  "durationMs": 14400000
+                                },
+                                {
+                                  "durationMs": 43200000
+                                },
+                                {
+                                  "durationMs": 86400000
+                                },
+                                {
+                                  "durationMs": 172800000
+                                },
+                                {
+                                  "durationMs": 259200000
+                                },
+                                {
+                                  "durationMs": 604800000
+                                },
+                                {
+                                  "durationMs": 1209600000
+                                },
+                                {
+                                  "durationMs": 2419200000
+                                },
+                                {
+                                  "durationMs": 2592000000
+                                },
+                                {
+                                  "durationMs": 5184000000
+                                },
+                                {
+                                  "durationMs": 7776000000
+                                }
+                              ],
+                              "allowCustom": true
+                            },
+                            "timeContext": {
+                              "durationMs": 86400000
+                            }
+                          },
+                          {
+                            "id": "f0450560-ef16-4aa9-a3ad-7485dd909587",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "Help",
+                            "type": 10,
+                            "isRequired": true,
+                            "typeSettings": {
+                              "additionalResourceOptions": []
+                            },
+                            "jsonData": "[[{ \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }]",
+                            "label": "Show Help",
+                            "value": "Yes"
+                          }
+                        ],
+                        "style": "pills"
+                      },
+                      "name": "parameters - 2"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "\r\n|Overview|Device|Network|File|\r\n|--------|------|-------|----|\r\n|MDE Tables Last Data Received|Source of the AV detections|Internet Connected Devices|FileActivityCount per Device|\r\n|Daily Data Flow on MDE Tables|Get stats on ASR audit events|Count By Machine Group|Count by InitiatingProcessAccountUpn|\r\n|Device Heartbeat|Get stats on ASR blocks|Count By Network Adaptor||\r\n|Device where files are copied to USB Drive|AV Detections with USB Disk Drive|TimeSeries on Network Activity||\r\n|Device Internet Connectivity Status |List files copied to USB mounted drives|Top 10 RemoteUrl accessed over TimeRange||\r\n|Device Count by DNS Suffix ||Tor Clients||\r\n|Device Microsoft Entra ID Join status ||||\r\n|Device ClientVersion ||||"
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Help",
+                        "comparison": "isEqualTo",
+                        "value": "Yes"
+                      },
+                      "name": "text - 8"
+                    },
+                    {
+                      "type": 11,
+                      "content": {
+                        "version": "LinkItem/1.0",
+                        "style": "tabs",
+                        "links": [
+                          {
+                            "id": "454d4e02-26ba-4195-ae30-94752bbf4603",
+                            "cellValue": "selectedTab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Overview",
+                            "subTarget": "Overview",
+                            "preText": "Overview",
+                            "style": "link"
+                          },
+                          {
+                            "id": "3d902e84-3e5b-4631-85d1-c229ec2abf75",
+                            "cellValue": "selectedTab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Device",
+                            "subTarget": "Device",
+                            "style": "link"
+                          },
+                          {
+                            "id": "bbc20288-b398-4f63-b7a9-e3830213bb34",
+                            "cellValue": "selectedTab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Network",
+                            "subTarget": "Network",
+                            "style": "link"
+                          },
+                          {
+                            "id": "edab4a44-8ca3-4ba1-bede-4186f4376d28",
+                            "cellValue": "selectedTab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "File",
+                            "subTarget": "File",
+                            "style": "link"
+                          }
+                        ]
+                      },
+                      "name": "links - 3"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "union \r\nisfuzzy = true\r\n(DeviceInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type= \"DeviceInfo\" | extend Description = \"Machine information (including OS information)\"),\r\n(DeviceNetworkInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkInfo\"  | extend Description = \"Network properties of machines\"),\r\n(DeviceProcessEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceProcessEvents\" | extend Description = \"Process creation and related events\"),\r\n(DeviceNetworkEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkEvents\" | extend Description = \"Network connection and related events\"),\r\n(DeviceFileEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileEvents\" | extend Description = \"File creation, modification, and other file system events\"),\r\n(DeviceRegistryEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceRegistryEvents\" | extend Description = \"Creation and modification of registry entries\"),\r\n(DeviceLogonEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceLogonEvents\" | extend Description = \"Sign-ins and other authentication events\"),\r\n(DeviceImageLoadEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceImageLoadEvents\" | extend Description = \"DLL loading events\"),\r\n(DeviceEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceEvents\" | extend Description = \"Additional events types\"),\r\n(DeviceFileCertificateInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileCertificateInfo\" | extend Description = \"Certificate information of signed files)\")\r\n| extend [\"Last Log Received At (Local Time)\"] = TimeGenerated\r\n| project Type, Description, [\"Last Log Received At (Local Time)\"]",
+                              "size": 0,
+                              "title": "MDE Tables Last Data Received based on {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Type",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 0,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Last Log Received At",
+                                    "formatter": 6,
+                                    "dateFormat": {
+                                      "showUtcTime": null,
+                                      "formatName": "fullDateTimePattern"
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1",
+                              "size": 1,
+                              "title": "Daily Data Flow on MDE Tables over {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "timechart",
+                              "chartSettings": {
+                                "xAxis": "count_"
+                              }
+                            },
+                            "name": "query - 2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceInfo \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| extend ParsedFields=parse_json(LoggedOnUsers)[0]\r\n| extend DurationAtLeast= format_timespan(now()-TimeGenerated,'dd:hh:mm:ss')\r\n| project DurationAtLeast,TimeGenerated,DeviceName,DomainName=ParsedFields.DomainName,UserName=ParsedFields.UserName\r\n| order by DurationAtLeast asc",
+                              "size": 0,
+                              "title": "Device Heartbeat from TimeTange {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc\r\n| summarize FileCount = count() by DeviceName\r\n| order by FileCount desc",
+                              "size": 1,
+                              "title": "Device where files are copied to USB Drive from TimeTange {TimeRange}",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FileCount",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 0 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)",
+                              "size": 1,
+                              "title": "Device Internet Connectivity Status from TimeTange {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FileCount",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 0 - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain",
+                              "size": 1,
+                              "title": "Device Count by DNS Suffix",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "gridSettings": {
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "showMetrics": false,
+                                "showLegend": true
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 0 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by tostring(IsAzureADJoined)",
+                              "size": 1,
+                              "title": "Device EntraID Join status",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "gridSettings": {
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "showMetrics": false,
+                                "showLegend": true
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 0 - Copy - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by ClientVersion",
+                              "size": 1,
+                              "title": "Device ClientVersion",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "gridSettings": {
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "showMetrics": false,
+                                "showLegend": true
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 0 - Copy - Copy - Copy - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "selectedTab",
+                        "comparison": "isEqualTo",
+                        "value": "Overview"
+                      },
+                      "name": "groupOverview"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\r\n//\r\n//Get the list of AV detections\r\nlet avDetections =\r\nDeviceEvents\r\n| where ActionType == \"AntivirusDetection\" and isnotempty(MD5)\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\r\n//Get a list of file creations\r\nlet fileCreations =\r\nDeviceFileEvents \r\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\r\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\r\n//Join the file creations and AV detections on the MD5 of the file\r\navDetections | join kind=inner (fileCreations) on MD5\r\n| project-away MD51 //Remove the duplicated MD5 field\r\n| sort by Timestamp desc ",
+                              "size": 0,
+                              "title": "Source of the AV detections for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Audited\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType",
+                              "size": 0,
+                              "title": "Get stats on ASR audit events - count events and machines per rule for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 1"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Blocked\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType",
+                              "size": 0,
+                              "title": "Get stats on ASR blocks - count events and machines per rule for {TimeRange}",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 1 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query make a best-guess detection regarding which removable media device caused an AV detection\r\n//The query is best run over 30 days to get the full USB history\r\n//\r\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\r\nlet usbDetections =\r\n    DeviceEvents\r\n    | where ActionType == \"AntivirusDetection\" and FolderPath !startswith \"c\" and FolderPath matches regex \"^[A-Za-z]{1}\"\r\n    | extend ParsedFields=parse_json(AdditionalFields)\r\n    | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\r\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\r\nlet usbConnections = \r\n    DeviceEvents\r\n    | where ActionType == \"PnpDeviceConnected\"\r\n    | extend parsed=parse_json(AdditionalFields)\r\n    | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\r\n    | where ClassName == \"DiskDrive\"\r\n    | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\r\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\r\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\r\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\r\n| sort by DetectionTime desc",
+                              "size": 0,
+                              "title": "AV Detections with USB Disk Drive for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 3"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc",
+                              "size": 0,
+                              "title": "List files copied to USB mounted drives for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 4"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "selectedTab",
+                        "comparison": "isEqualTo",
+                        "value": "Device"
+                      },
+                      "name": "groupDevice"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mv-apply ConnectedNetworks on \r\n(\r\nwhere ConnectedNetworks.IsConnectedToInternet == true\r\n)\r\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet",
+                              "size": 0,
+                              "title": "Internet Connected Devices for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by MachineGroup",
+                              "size": 0,
+                              "title": "Count By Machine Group for {TimeRange}",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus",
+                              "size": 0,
+                              "title": "Count By Network Adaptor",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0 - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkEvents\r\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)",
+                              "size": 0,
+                              "title": "TimeSeries on Network Activity for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "timechart"
+                            },
+                            "name": "query - 0 - Copy - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkEvents\r\n| where isnotempty(RemoteUrl)\r\n| summarize count() by RemoteUrl\r\n| order by count_ desc\r\n| limit 10",
+                              "size": 0,
+                              "title": "Top 10 RemoteUrl accessed over TimeRange {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "categoricalbar"
+                            },
+                            "name": "query - 0 - Copy - Copy - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents  \r\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc",
+                              "size": 0,
+                              "title": "Tor Clients for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 5"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "selectedTab",
+                        "comparison": "isEqualTo",
+                        "value": "Network"
+                      },
+                      "name": "groupNetwork"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceFileEvents\r\n| summarize FileActivityCount = count() by DeviceName",
+                              "size": 0,
+                              "title": "FileActivityCount per Device for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "unstackedbar"
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn",
+                              "size": 0,
+                              "title": "Count by InitiatingProcessAccountUpn for {TimeRange}",
+                              "queryType": "advancedHunting",
+                              "visualization": "unstackedbar"
+                            },
+                            "name": "query - 0 - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "selectedTab",
+                        "comparison": "isEqualTo",
+                        "value": "File"
+                      },
+                      "name": "groupFile"
+                    }
+                  ],
+                  "fromTemplateId": "sentinel-MicrosoftDefenderForEndPoint",
+                  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
+                  "contentProvenance": {
+                    "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+                    "packageVersion": "3.2.1",
+                    "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215",
+                    "contentVersion": "3.2.1"
                   }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 1",
-                "parentId": "[variables('analyticRuleObject1').analyticRuleId1]",
-                "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject1').analyticRuleVersion1]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
                 }
               }
             }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Possible Phishing with CSL and Network Sessions",
-        "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
-        "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
-        "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
-      }
+          }
+        }
+      },
+      "condition": "[parameters('DeployDefenderWorkbook')]"
     },
     {
       "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
       "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]",
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('05a7425a-fcda-5e24-823d-f8c9dd7a6215')))]",
       "location": "[parameters('workspace-location')]",
       "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-6215edc38e31ea23679b02a59de10f4a')]",
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "SUNSPOTHashes_AnalyticalRules Analytics Rule with template version 3.0.18",
+        "description": "Defender Workbook: MicrosoftDefenderForEndPoint",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query uses Microsoft Defender for Endpoint data to look for IoCs associated with the SUNSPOT malware shared by Crowdstrike.\nMore details: \n  - https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/\n  - https://techcommunity.microsoft.com/blog/microsoftsentinelblog/monitoring-the-software-supply-chain-with-azure-sentinel/2176463/",
-                "displayName": "SUNSPOT malware hashes",
-                "enabled": false,
-                "query": "let SUNSPOT_Hashes = dynamic([\"c45c9bda8db1d470f1fd0dcc346dc449839eb5ce9a948c70369230af0b3ef168\", \"0819db19be479122c1d48743e644070a8dc9a1c852df9a8c0dc2343e904da389\"]);\nunion isfuzzy=true(\nDeviceEvents\n| where InitiatingProcessSHA256 in (SUNSPOT_Hashes)),\n(DeviceImageLoadEvents\n| where InitiatingProcessSHA256 in (SUNSPOT_Hashes))\n| extend timestamp=TimeGenerated\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceImageLoadEvents",
-                      "DeviceEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Persistence"
-                ],
-                "techniques": [
-                  "T1554"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
-                      },
-                      {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "imports": {
+            "MicrosoftSecurity": {
+              "provider": "MicrosoftSecurity",
+              "version": "1.0.0"
+            }
+          },
+          "resources": {
+            "workbook": {
+              "import": "MicrosoftSecurity",
+              "type": "Microsoft.Security/workbooks@2026-06-01-preview",
               "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 2",
-                "parentId": "[variables('analyticRuleObject2').analyticRuleId2]",
-                "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject2').analyticRuleVersion2]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
+                "id": "4fffade5-9b6b-51af-a33d-97641e240595",
+                "name": "MicrosoftDefenderForEndPoint",
+                "content": {
+                  "version": "Notebook/1.0",
+                  "items": [
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "## Microsoft Defender for Endpoint (Preview)\n---\n\nA workbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through Microsoft Defender XDR Connector.\n\n\n"
+                      },
+                      "name": "text - 2"
+                    },
+                    {
+                      "type": 9,
+                      "content": {
+                        "version": "KqlParameterItem/1.0",
+                        "parameters": [
+                          {
+                            "id": "b22a3bd7-19b3-495d-a0df-95a7a59d98ff",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "TimeRange",
+                            "type": 4,
+                            "value": {
+                              "durationMs": 172800000
+                            },
+                            "typeSettings": {
+                              "selectableValues": [
+                                {
+                                  "durationMs": 300000
+                                },
+                                {
+                                  "durationMs": 900000
+                                },
+                                {
+                                  "durationMs": 1800000
+                                },
+                                {
+                                  "durationMs": 3600000
+                                },
+                                {
+                                  "durationMs": 14400000
+                                },
+                                {
+                                  "durationMs": 43200000
+                                },
+                                {
+                                  "durationMs": 86400000
+                                },
+                                {
+                                  "durationMs": 172800000
+                                },
+                                {
+                                  "durationMs": 259200000
+                                },
+                                {
+                                  "durationMs": 604800000
+                                },
+                                {
+                                  "durationMs": 1209600000
+                                },
+                                {
+                                  "durationMs": 2419200000
+                                },
+                                {
+                                  "durationMs": 2592000000
+                                },
+                                {
+                                  "durationMs": 5184000000
+                                },
+                                {
+                                  "durationMs": 7776000000
+                                }
+                              ],
+                              "allowCustom": true
+                            },
+                            "timeContext": {
+                              "durationMs": 86400000
+                            }
+                          },
+                          {
+                            "id": "f0450560-ef16-4aa9-a3ad-7485dd909587",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "Help",
+                            "type": 10,
+                            "isRequired": true,
+                            "typeSettings": {
+                              "additionalResourceOptions": []
+                            },
+                            "jsonData": "[[{ \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }]",
+                            "label": "Show Help",
+                            "value": "Yes"
+                          }
+                        ],
+                        "style": "pills"
+                      },
+                      "name": "parameters - 2"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "\r\n|Overview|Device|Network|File|\r\n|--------|------|-------|----|\r\n|MDE Tables Last Data Received|Source of the AV detections|Internet Connected Devices|FileActivityCount per Device|\r\n|Daily Data Flow on MDE Tables|Get stats on ASR audit events|Count By Machine Group|Count by InitiatingProcessAccountUpn|\r\n|Device Heartbeat|Get stats on ASR blocks|Count By Network Adaptor||\r\n|Device where files are copied to USB Drive|AV Detections with USB Disk Drive|TimeSeries on Network Activity||\r\n|Device Internet Connectivity Status |List files copied to USB mounted drives|Top 10 RemoteUrl accessed over TimeRange||\r\n|Device Count by DNS Suffix ||Tor Clients||\r\n|Device Microsoft Entra ID Join status ||||\r\n|Device ClientVersion ||||"
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Help",
+                        "comparison": "isEqualTo",
+                        "value": "Yes"
+                      },
+                      "name": "text - 8"
+                    },
+                    {
+                      "type": 11,
+                      "content": {
+                        "version": "LinkItem/1.0",
+                        "style": "tabs",
+                        "links": [
+                          {
+                            "id": "454d4e02-26ba-4195-ae30-94752bbf4603",
+                            "cellValue": "selectedTab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Overview",
+                            "subTarget": "Overview",
+                            "preText": "Overview",
+                            "style": "link"
+                          },
+                          {
+                            "id": "3d902e84-3e5b-4631-85d1-c229ec2abf75",
+                            "cellValue": "selectedTab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Device",
+                            "subTarget": "Device",
+                            "style": "link"
+                          },
+                          {
+                            "id": "bbc20288-b398-4f63-b7a9-e3830213bb34",
+                            "cellValue": "selectedTab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Network",
+                            "subTarget": "Network",
+                            "style": "link"
+                          },
+                          {
+                            "id": "edab4a44-8ca3-4ba1-bede-4186f4376d28",
+                            "cellValue": "selectedTab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "File",
+                            "subTarget": "File",
+                            "style": "link"
+                          }
+                        ]
+                      },
+                      "name": "links - 3"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "union \r\nisfuzzy = true\r\n(DeviceInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type= \"DeviceInfo\" | extend Description = \"Machine information (including OS information)\"),\r\n(DeviceNetworkInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkInfo\"  | extend Description = \"Network properties of machines\"),\r\n(DeviceProcessEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceProcessEvents\" | extend Description = \"Process creation and related events\"),\r\n(DeviceNetworkEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkEvents\" | extend Description = \"Network connection and related events\"),\r\n(DeviceFileEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileEvents\" | extend Description = \"File creation, modification, and other file system events\"),\r\n(DeviceRegistryEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceRegistryEvents\" | extend Description = \"Creation and modification of registry entries\"),\r\n(DeviceLogonEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceLogonEvents\" | extend Description = \"Sign-ins and other authentication events\"),\r\n(DeviceImageLoadEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceImageLoadEvents\" | extend Description = \"DLL loading events\"),\r\n(DeviceEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceEvents\" | extend Description = \"Additional events types\"),\r\n(DeviceFileCertificateInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileCertificateInfo\" | extend Description = \"Certificate information of signed files)\")\r\n| extend [\"Last Log Received At (Local Time)\"] = TimeGenerated\r\n| project Type, Description, [\"Last Log Received At (Local Time)\"]",
+                              "size": 0,
+                              "title": "MDE Tables Last Data Received based on {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Type",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 0,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Last Log Received At",
+                                    "formatter": 6,
+                                    "dateFormat": {
+                                      "showUtcTime": null,
+                                      "formatName": "fullDateTimePattern"
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1",
+                              "size": 1,
+                              "title": "Daily Data Flow on MDE Tables over {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "timechart",
+                              "chartSettings": {
+                                "xAxis": "count_"
+                              }
+                            },
+                            "name": "query - 2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceInfo \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| extend ParsedFields=parse_json(LoggedOnUsers)[0]\r\n| extend DurationAtLeast= format_timespan(now()-TimeGenerated,'dd:hh:mm:ss')\r\n| project DurationAtLeast,TimeGenerated,DeviceName,DomainName=ParsedFields.DomainName,UserName=ParsedFields.UserName\r\n| order by DurationAtLeast asc",
+                              "size": 0,
+                              "title": "Device Heartbeat from TimeTange {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc\r\n| summarize FileCount = count() by DeviceName\r\n| order by FileCount desc",
+                              "size": 1,
+                              "title": "Device where files are copied to USB Drive from TimeTange {TimeRange}",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FileCount",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 0 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)",
+                              "size": 1,
+                              "title": "Device Internet Connectivity Status from TimeTange {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FileCount",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 0 - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain",
+                              "size": 1,
+                              "title": "Device Count by DNS Suffix",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "gridSettings": {
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "showMetrics": false,
+                                "showLegend": true
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 0 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by tostring(IsAzureADJoined)",
+                              "size": 1,
+                              "title": "Device EntraID Join status",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "gridSettings": {
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "showMetrics": false,
+                                "showLegend": true
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 0 - Copy - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by ClientVersion",
+                              "size": 1,
+                              "title": "Device ClientVersion",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "gridSettings": {
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "showMetrics": false,
+                                "showLegend": true
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 0 - Copy - Copy - Copy - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "selectedTab",
+                        "comparison": "isEqualTo",
+                        "value": "Overview"
+                      },
+                      "name": "groupOverview"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\r\n//\r\n//Get the list of AV detections\r\nlet avDetections =\r\nDeviceEvents\r\n| where ActionType == \"AntivirusDetection\" and isnotempty(MD5)\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\r\n//Get a list of file creations\r\nlet fileCreations =\r\nDeviceFileEvents \r\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\r\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\r\n//Join the file creations and AV detections on the MD5 of the file\r\navDetections | join kind=inner (fileCreations) on MD5\r\n| project-away MD51 //Remove the duplicated MD5 field\r\n| sort by Timestamp desc ",
+                              "size": 0,
+                              "title": "Source of the AV detections for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Audited\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType",
+                              "size": 0,
+                              "title": "Get stats on ASR audit events - count events and machines per rule for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 1"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Blocked\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType",
+                              "size": 0,
+                              "title": "Get stats on ASR blocks - count events and machines per rule for {TimeRange}",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 1 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query make a best-guess detection regarding which removable media device caused an AV detection\r\n//The query is best run over 30 days to get the full USB history\r\n//\r\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\r\nlet usbDetections =\r\n    DeviceEvents\r\n    | where ActionType == \"AntivirusDetection\" and FolderPath !startswith \"c\" and FolderPath matches regex \"^[A-Za-z]{1}\"\r\n    | extend ParsedFields=parse_json(AdditionalFields)\r\n    | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\r\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\r\nlet usbConnections = \r\n    DeviceEvents\r\n    | where ActionType == \"PnpDeviceConnected\"\r\n    | extend parsed=parse_json(AdditionalFields)\r\n    | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\r\n    | where ClassName == \"DiskDrive\"\r\n    | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\r\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\r\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\r\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\r\n| sort by DetectionTime desc",
+                              "size": 0,
+                              "title": "AV Detections with USB Disk Drive for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 3"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc",
+                              "size": 0,
+                              "title": "List files copied to USB mounted drives for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 4"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "selectedTab",
+                        "comparison": "isEqualTo",
+                        "value": "Device"
+                      },
+                      "name": "groupDevice"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mv-apply ConnectedNetworks on \r\n(\r\nwhere ConnectedNetworks.IsConnectedToInternet == true\r\n)\r\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet",
+                              "size": 0,
+                              "title": "Internet Connected Devices for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by MachineGroup",
+                              "size": 0,
+                              "title": "Count By Machine Group for {TimeRange}",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus",
+                              "size": 0,
+                              "title": "Count By Network Adaptor",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0 - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkEvents\r\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)",
+                              "size": 0,
+                              "title": "TimeSeries on Network Activity for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "timechart"
+                            },
+                            "name": "query - 0 - Copy - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceNetworkEvents\r\n| where isnotempty(RemoteUrl)\r\n| summarize count() by RemoteUrl\r\n| order by count_ desc\r\n| limit 10",
+                              "size": 0,
+                              "title": "Top 10 RemoteUrl accessed over TimeRange {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "categoricalbar"
+                            },
+                            "name": "query - 0 - Copy - Copy - Copy - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents  \r\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc",
+                              "size": 0,
+                              "title": "Tor Clients for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting"
+                            },
+                            "name": "query - 5"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "selectedTab",
+                        "comparison": "isEqualTo",
+                        "value": "Network"
+                      },
+                      "name": "groupNetwork"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceFileEvents\r\n| summarize FileActivityCount = count() by DeviceName",
+                              "size": 0,
+                              "title": "FileActivityCount per Device for {TimeRange}",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "unstackedbar"
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn",
+                              "size": 0,
+                              "title": "Count by InitiatingProcessAccountUpn for {TimeRange}",
+                              "queryType": "advancedHunting",
+                              "visualization": "unstackedbar"
+                            },
+                            "name": "query - 0 - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "selectedTab",
+                        "comparison": "isEqualTo",
+                        "value": "File"
+                      },
+                      "name": "groupFile"
+                    }
+                  ],
+                  "fromTemplateId": "sentinel-MicrosoftDefenderForEndPoint",
+                  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
+                  "contentProvenance": {
+                    "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+                    "packageVersion": "3.2.1",
+                    "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215",
+                    "contentVersion": "3.2.1"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "packageKind": "Solution",
+        "packageVersion": "3.2.1",
+        "packageName": "Microsoft Defender XDR",
+        "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215",
+        "contentKind": "DefenderWorkbook",
+        "displayName": "MicrosoftDefenderForEndPoint",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','05a7425a-fcda-5e24-823d-f8c9dd7a6215','-','3.2.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','05a7425a-fcda-5e24-823d-f8c9dd7a6215','-','3.2.1')))]",
+        "version": "3.2.1",
+        "contentProvenance": {
+          "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+          "packageVersion": "3.2.1",
+          "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215",
+          "contentVersion": "3.2.1",
+          "requiredWorkloads": [
+            {
+              "workload": "mde",
+              "dataTypes": [
+                "DeviceEvents",
+                "DeviceFileCertificateInfo",
+                "DeviceFileEvents",
+                "DeviceImageLoadEvents",
+                "DeviceInfo",
+                "DeviceLogonEvents",
+                "DeviceNetworkEvents",
+                "DeviceNetworkInfo",
+                "DeviceProcessEvents",
+                "DeviceRegistryEvents"
+              ]
             }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "SUNSPOT malware hashes",
-        "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
-        "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
-        "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
-      }
+          ],
+          "requiredDataConnectors": [],
+          "requiredWorkspaceFunctions": []
+        }
+      },
+      "condition": "[parameters('DeployDefenderWorkbook')]"
     },
     {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]",
-      "location": "[parameters('workspace-location')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "DefenderWorkbook-29875c404a91f6531ba59a4626d443d6",
       "dependsOn": [
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "PotentialBuildProcessCompromiseMDE_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
+        "mode": "Incremental",
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "imports": {
+            "MicrosoftSecurity": {
+              "provider": "MicrosoftSecurity",
+              "version": "1.0.0"
+            }
+          },
+          "resources": {
+            "workbook": {
+              "import": "MicrosoftSecurity",
+              "type": "Microsoft.Security/workbooks@2026-06-01-preview",
               "properties": {
-                "description": "The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process. This query uses Microsoft Defender for Endpoint telemetry.\nMore details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463",
-                "displayName": "Potential Build Process Compromise - MDE",
-                "enabled": false,
-                "query": "// How far back to look for events from\nlet timeframe = 1d;\n// How close together build events and file modifications should occur to alert (make this smaller to reduce FPs)\nlet time_window = 5m;\n// Edit this to include build processes used\nlet build_processes = dynamic([\"MSBuild.exe\", \"dotnet.exe\", \"VBCSCompiler.exe\"]);\n// Include any processes that you want to allow to edit files during/around the build process\nlet allow_list = dynamic([]);\nDeviceProcessEvents\n| where TimeGenerated > ago(timeframe)\n// Look for build process starts\n| where FileName has_any (build_processes)\n| summarize by BuildParentProcess=InitiatingProcessFileName, BuildProcess=FileName, BuildAccount = AccountName, DeviceName, BuildCommand=ProcessCommandLine, \ntimekey= bin(TimeGenerated, time_window), BuildProcessTime=TimeGenerated\n| join kind=inner(\nDeviceFileEvents\n| where TimeGenerated > ago(timeframe)\n| where InitiatingProcessFileName !in (allow_list)\n| where ActionType == \"FileCreated\"  or ActionType == \"FileModified\"\n// Look for code files, edit this to include file extensions used in build.\n| where FileName endswith \".cs\" or FileName endswith \".cpp\"\n| summarize by FileEditParentProcess=InitiatingProcessParentFileName, FileEditAccount = InitiatingProcessAccountName, FileEditDomain = InitiatingProcessAccountDomain, FileEditUpn = InitiatingProcessAccountUpn, \nDeviceName, FileEdited=FileName, FileEditProcess=InitiatingProcessFileName, timekey= bin(TimeGenerated, time_window), FileEditTime=TimeGenerated)\n// join where build processes and file modifications seen at same time on same host\non timekey, DeviceName\n// Limit to only where the file edit happens after the build process starts\n| where BuildProcessTime <= FileEditTime\n| summarize make_set(FileEdited), make_set(FileEditProcess) by timekey, DeviceName, BuildParentProcess, BuildProcess, FileEditAccount, FileEditDomain, FileEditUpn\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents",
-                      "DeviceFileEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Persistence"
-                ],
-                "techniques": [
-                  "T1554"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "FileEditUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "FileEditAccount"
-                      },
-                      {
-                        "identifier": "UPNSuffix",
-                        "columnName": "FileEditDomain"
-                      }
-                    ],
-                    "entityType": "Account"
+                "id": "baa399d3-2174-5938-b0b8-b91aed73090a",
+                "name": "MicrosoftDefenderForIdentity",
+                "content": {
+                  "version": "Notebook/1.0",
+                  "items": [
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "## Microsoft Defender for Identity\n---\n"
+                      },
+                      "name": "text - 2"
+                    },
+                    {
+                      "type": 9,
+                      "content": {
+                        "version": "KqlParameterItem/1.0",
+                        "parameters": [
+                          {
+                            "id": "2e238f92-709c-410b-93e0-60eab6150a75",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "TimeRange",
+                            "type": 4,
+                            "isRequired": true,
+                            "value": {
+                              "durationMs": 1800000
+                            },
+                            "typeSettings": {
+                              "selectableValues": [
+                                {
+                                  "durationMs": 1800000
+                                },
+                                {
+                                  "durationMs": 3600000
+                                },
+                                {
+                                  "durationMs": 14400000
+                                },
+                                {
+                                  "durationMs": 43200000
+                                },
+                                {
+                                  "durationMs": 86400000
+                                },
+                                {
+                                  "durationMs": 172800000
+                                },
+                                {
+                                  "durationMs": 259200000
+                                },
+                                {
+                                  "durationMs": 604800000
+                                },
+                                {
+                                  "durationMs": 1209600000
+                                },
+                                {
+                                  "durationMs": 2592000000
+                                },
+                                {
+                                  "durationMs": 5184000000
+                                },
+                                {
+                                  "durationMs": 7776000000
+                                }
+                              ],
+                              "allowCustom": true
+                            },
+                            "timeContext": {
+                              "durationMs": 86400000
+                            }
+                          },
+                          {
+                            "id": "ec13514a-7e54-4d41-86db-2805727a2fa7",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "About",
+                            "type": 10,
+                            "description": "",
+                            "isRequired": true,
+                            "value": "Show",
+                            "typeSettings": {
+                              "additionalResourceOptions": [],
+                              "showDefault": false
+                            },
+                            "jsonData": "[[\r\n    \"Show\",\r\n    \"Hide\"\r\n]"
+                          }
+                        ],
+                        "style": "pills"
+                      },
+                      "name": "parameters - 1"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Microsoft Defender for Identity Analysis Workbook\r\n\r\n",
+                              "style": "info"
+                            },
+                            "name": "text - 0"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "About",
+                        "comparison": "isEqualTo",
+                        "value": "Show"
+                      },
+                      "name": "AboutGroup"
+                    },
+                    {
+                      "type": 11,
+                      "content": {
+                        "version": "LinkItem/1.0",
+                        "style": "tabs",
+                        "links": [
+                          {
+                            "id": "48578fe1-da47-4a4c-b495-ce7fe24ce495",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Overview",
+                            "subTarget": "grpOverview",
+                            "style": "link"
+                          },
+                          {
+                            "id": "30e93159-8bf5-4006-820f-406ea10bcd17",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "LogOnEvents",
+                            "subTarget": "grpLogOnEvents",
+                            "style": "link"
+                          },
+                          {
+                            "id": "c40f76ed-94be-40ff-b65b-3fda306f2c3d",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "QueryEvents",
+                            "subTarget": "grpQueryEvents",
+                            "style": "link"
+                          },
+                          {
+                            "id": "38c88a53-f7b1-42da-83d6-0c809835eaab",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "DirectoryEvents",
+                            "subTarget": "grpDirectoryEvents",
+                            "style": "link"
+                          },
+                          {
+                            "id": "0ad83579-c492-4c20-8db6-27883db5abc8",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Alerts",
+                            "subTarget": "grpAlerts",
+                            "style": "link"
+                          }
+                        ]
+                      },
+                      "name": "links - 8"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| summarize count() by LogonType",
+                              "size": 0,
+                              "title": "Log On Summary",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "showBorder": false,
+                                "titleContent": {
+                                  "columnMatch": "LogonType",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "auto"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "customWidth": "40",
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n|summarize count() by ActionType",
+                              "size": 0,
+                              "title": "Log On Status",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 1"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| summarize count() by Protocol",
+                              "size": 0,
+                              "title": "Log On Protocol",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "barchart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 1 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityQueryEvents\r\n| summarize count() by Protocol",
+                              "size": 0,
+                              "title": "Query Summary",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "barchart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 3"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort",
+                              "size": 0,
+                              "title": "Query Destination Port",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 3 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityQueryEvents\r\n| where isnotempty(QueryType)\r\n| summarize count() by QueryType\r\n| order by count_ desc\r\n| take 10",
+                              "size": 0,
+                              "title": "Top 10 Query Types",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol",
+                              "size": 0,
+                              "title": "Directory Events Protocol",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "categoricalbar"
+                            },
+                            "customWidth": "40",
+                            "name": "query - 6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain",
+                              "size": 0,
+                              "title": "Directory Events Protocol",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 6 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10",
+                              "size": 0,
+                              "title": "Top 10 Accounts Activity",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 6 - Copy - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpOverview"
+                      },
+                      "name": "grpOverview"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend FROM_DEVICE_ = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE_ = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by FROM_DEVICE_, TO_DEVICE_\r\n| order by sum_Count_ desc",
+                              "size": 0,
+                              "title": "Resource Access Summary in Devices",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "sum_Count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "45",
+                            "name": "query - 0",
+                            "styleSettings": {
+                              "margin": "5px",
+                              "padding": "5px",
+                              "showBorder": true
+                            }
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc",
+                              "size": 0,
+                              "title": "Resource Access Summary in OS",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "sum_Count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "45",
+                            "name": "query - 0 - Copy",
+                            "styleSettings": {
+                              "margin": "5px",
+                              "padding": "5px",
+                              "showBorder": true
+                            }
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc",
+                              "size": 0,
+                              "title": "Credentials validation Summary in Devices",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "sum_Count",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "45",
+                            "name": "query - 0 - Copy",
+                            "styleSettings": {
+                              "margin": "5px",
+                              "padding": "5px",
+                              "showBorder": true
+                            }
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count);\r\ndata\r\n| summarize sum(Count) by  TO_DEVICE\r\n| order by sum_Count desc\r\n| join kind=inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by TO_DEVICE\r\n)\r\non $left.TO_DEVICE == $right.TO_DEVICE",
+                              "size": 0,
+                              "title": "Credentials validation by Domain Controllers",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "sum_Count",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TO_DEVICE1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 10,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "45",
+                            "name": "query - 0 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "5px",
+                              "padding": "5px",
+                              "showBorder": true
+                            }
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn",
+                              "size": 0,
+                              "title": "Logon Summary by Users",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "LogonSuccess",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "LogonFailed",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "redPurple"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "AccountUpn1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0 - Copy - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpLogOnEvents"
+                      },
+                      "name": "AttachmentGroup"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = IdentityQueryEvents\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"]);\r\ndata\r\n| summarize count() by QueryType, TO_DEVICE\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by QueryType, TO_DEVICE\r\n) on $left.QueryType == $right.QueryType and $left.TO_DEVICE== $right.TO_DEVICE",
+                              "size": 0,
+                              "title": "Device Query Summary",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "TO_DEVICE",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "QueryType1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "TO_DEVICE1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 21,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true,
+                                "hierarchySettings": {
+                                  "treeType": 1,
+                                  "groupBy": [
+                                    "TO_DEVICE"
+                                  ],
+                                  "expandTopLevel": true
+                                }
+                              }
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName",
+                              "size": 0,
+                              "title": "Query Summary from Source Devices",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "DeviceName1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0 - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpQueryEvents"
+                      },
+                      "name": "UrlGroup"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActionType ",
+                              "size": 0,
+                              "title": "Timeline on ActionType",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "timechart"
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc",
+                              "size": 0,
+                              "title": "Top 10 Actions",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "categoricalbar",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ]
+                              },
+                              "tileSettings": {
+                                "showBorder": false,
+                                "titleContent": {
+                                  "columnMatch": "DestinationPort",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "auto"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "name": "query - 0 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn",
+                              "size": 0,
+                              "title": "Account Trend on Directory Events",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              },
+                              "tileSettings": {
+                                "showBorder": false,
+                                "titleContent": {
+                                  "columnMatch": "DestinationPort",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "auto"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "name": "query - 0 - Copy - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpDirectoryEvents"
+                      },
+                      "name": "group - 8"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName",
+                              "size": 0,
+                              "noDataMessage": "Alerts",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "AlertName1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 21,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] == \"host\"\r\n| where isnotempty(Entities[\"HostName\"])\r\n| extend HostName = tostring(Entities[\"HostName\"]);\r\ndata\r\n| summarize count() by HostName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by HostName\r\n) on $left.HostName == $right.HostName",
+                              "size": 0,
+                              "title": "Impacted Hosts",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "HostName1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "query - 1"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpAlerts"
+                      },
+                      "name": "group - 8"
+                    }
+                  ],
+                  "fromTemplateId": "sentinel-MicrosoftDefenderForIdentity",
+                  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
+                  "contentProvenance": {
+                    "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+                    "packageVersion": "3.2.1",
+                    "contentId": "200c5dd2-9786-5619-8425-4508a238d76a",
+                    "contentVersion": "3.2.1"
                   }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 3",
-                "parentId": "[variables('analyticRuleObject3').analyticRuleId3]",
-                "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject3').analyticRuleVersion3]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
                 }
               }
             }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Potential Build Process Compromise - MDE",
-        "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
-        "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
-        "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
-      }
+          }
+        }
+      },
+      "condition": "[parameters('DeployDefenderWorkbook')]"
     },
     {
       "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
       "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]",
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('200c5dd2-9786-5619-8425-4508a238d76a')))]",
       "location": "[parameters('workspace-location')]",
       "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-29875c404a91f6531ba59a4626d443d6')]",
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "SolarWinds_TEARDROP_Process-IOCs_AnalyticalRules Analytics Rule with template version 3.0.18",
+        "description": "Defender Workbook: MicrosoftDefenderForIdentity",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f",
-                "displayName": "TEARDROP memory-only dropper",
-                "enabled": false,
-                "query": "DeviceEvents\n| where ActionType has \"ExploitGuardNonMicrosoftSignedBlocked\"\n| where InitiatingProcessFileName has \"svchost.exe\" and FileName has \"NetSetupSvc.dll\"\n| extend HashAlgorithm = \"SHA1\"\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution",
-                  "Persistence",
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1543",
-                  "T1059",
-                  "T1027"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
-                      },
-                      {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Algorithm",
-                        "columnName": "HashAlgorithm"
-                      },
-                      {
-                        "identifier": "Value",
-                        "columnName": "InitiatingProcessSHA1"
-                      }
-                    ],
-                    "entityType": "FileHash"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 4",
-                "parentId": "[variables('analyticRuleObject4').analyticRuleId4]",
-                "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject4').analyticRuleVersion4]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "imports": {
+            "MicrosoftSecurity": {
+              "provider": "MicrosoftSecurity",
+              "version": "1.0.0"
             }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "TEARDROP memory-only dropper",
-        "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
-        "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
-        "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SolarWinds_SUNBURST_Network-IOCs_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
+          },
+          "resources": {
+            "workbook": {
+              "import": "MicrosoftSecurity",
+              "type": "Microsoft.Security/workbooks@2026-06-01-preview",
               "properties": {
-                "description": "Identifies SolarWinds SUNBURST domain beacon IOCs in DeviceNetworkEvents\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f",
-                "displayName": "SUNBURST network beacons",
-                "enabled": false,
-                "query": "let SunburstURL=dynamic([\"panhardware.com\",\"databasegalore.com\",\"avsvmcloud.com\",\"freescanonline.com\",\"thedoccloud.com\",\"deftsecurity.com\"]);\nDeviceNetworkEvents\n| where ActionType == \"ConnectionSuccess\"\n| where RemoteUrl in(SunburstURL)\n| extend HashAlgorithm = 'MD5'\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceNetworkEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution",
-                  "Persistence",
-                  "InitialAccess"
-                ],
-                "techniques": [
-                  "T1195",
-                  "T1059",
-                  "T1546"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
-                      },
-                      {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "RemoteIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Url",
-                        "columnName": "RemoteUrl"
-                      }
-                    ],
-                    "entityType": "URL"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Algorithm",
-                        "columnName": "HashAlgorithm"
-                      },
-                      {
-                        "identifier": "Value",
-                        "columnName": "InitiatingProcessMD5"
-                      }
-                    ],
-                    "entityType": "FileHash"
-                  }
-                ]
-              }
+                "id": "baa399d3-2174-5938-b0b8-b91aed73090a",
+                "name": "MicrosoftDefenderForIdentity",
+                "content": {
+                  "version": "Notebook/1.0",
+                  "items": [
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "## Microsoft Defender for Identity\n---\n"
+                      },
+                      "name": "text - 2"
+                    },
+                    {
+                      "type": 9,
+                      "content": {
+                        "version": "KqlParameterItem/1.0",
+                        "parameters": [
+                          {
+                            "id": "2e238f92-709c-410b-93e0-60eab6150a75",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "TimeRange",
+                            "type": 4,
+                            "isRequired": true,
+                            "value": {
+                              "durationMs": 1800000
+                            },
+                            "typeSettings": {
+                              "selectableValues": [
+                                {
+                                  "durationMs": 1800000
+                                },
+                                {
+                                  "durationMs": 3600000
+                                },
+                                {
+                                  "durationMs": 14400000
+                                },
+                                {
+                                  "durationMs": 43200000
+                                },
+                                {
+                                  "durationMs": 86400000
+                                },
+                                {
+                                  "durationMs": 172800000
+                                },
+                                {
+                                  "durationMs": 259200000
+                                },
+                                {
+                                  "durationMs": 604800000
+                                },
+                                {
+                                  "durationMs": 1209600000
+                                },
+                                {
+                                  "durationMs": 2592000000
+                                },
+                                {
+                                  "durationMs": 5184000000
+                                },
+                                {
+                                  "durationMs": 7776000000
+                                }
+                              ],
+                              "allowCustom": true
+                            },
+                            "timeContext": {
+                              "durationMs": 86400000
+                            }
+                          },
+                          {
+                            "id": "ec13514a-7e54-4d41-86db-2805727a2fa7",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "About",
+                            "type": 10,
+                            "description": "",
+                            "isRequired": true,
+                            "value": "Show",
+                            "typeSettings": {
+                              "additionalResourceOptions": [],
+                              "showDefault": false
+                            },
+                            "jsonData": "[[\r\n    \"Show\",\r\n    \"Hide\"\r\n]"
+                          }
+                        ],
+                        "style": "pills"
+                      },
+                      "name": "parameters - 1"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Microsoft Defender for Identity Analysis Workbook\r\n\r\n",
+                              "style": "info"
+                            },
+                            "name": "text - 0"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "About",
+                        "comparison": "isEqualTo",
+                        "value": "Show"
+                      },
+                      "name": "AboutGroup"
+                    },
+                    {
+                      "type": 11,
+                      "content": {
+                        "version": "LinkItem/1.0",
+                        "style": "tabs",
+                        "links": [
+                          {
+                            "id": "48578fe1-da47-4a4c-b495-ce7fe24ce495",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Overview",
+                            "subTarget": "grpOverview",
+                            "style": "link"
+                          },
+                          {
+                            "id": "30e93159-8bf5-4006-820f-406ea10bcd17",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "LogOnEvents",
+                            "subTarget": "grpLogOnEvents",
+                            "style": "link"
+                          },
+                          {
+                            "id": "c40f76ed-94be-40ff-b65b-3fda306f2c3d",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "QueryEvents",
+                            "subTarget": "grpQueryEvents",
+                            "style": "link"
+                          },
+                          {
+                            "id": "38c88a53-f7b1-42da-83d6-0c809835eaab",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "DirectoryEvents",
+                            "subTarget": "grpDirectoryEvents",
+                            "style": "link"
+                          },
+                          {
+                            "id": "0ad83579-c492-4c20-8db6-27883db5abc8",
+                            "cellValue": "Nav",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Alerts",
+                            "subTarget": "grpAlerts",
+                            "style": "link"
+                          }
+                        ]
+                      },
+                      "name": "links - 8"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| summarize count() by LogonType",
+                              "size": 0,
+                              "title": "Log On Summary",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "showBorder": false,
+                                "titleContent": {
+                                  "columnMatch": "LogonType",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "auto"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "customWidth": "40",
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n|summarize count() by ActionType",
+                              "size": 0,
+                              "title": "Log On Status",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 1"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| summarize count() by Protocol",
+                              "size": 0,
+                              "title": "Log On Protocol",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "barchart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 1 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityQueryEvents\r\n| summarize count() by Protocol",
+                              "size": 0,
+                              "title": "Query Summary",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "barchart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 3"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort",
+                              "size": 0,
+                              "title": "Query Destination Port",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 3 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityQueryEvents\r\n| where isnotempty(QueryType)\r\n| summarize count() by QueryType\r\n| order by count_ desc\r\n| take 10",
+                              "size": 0,
+                              "title": "Top 10 Query Types",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol",
+                              "size": 0,
+                              "title": "Directory Events Protocol",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "categoricalbar"
+                            },
+                            "customWidth": "40",
+                            "name": "query - 6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain",
+                              "size": 0,
+                              "title": "Directory Events Protocol",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "30",
+                            "name": "query - 6 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10",
+                              "size": 0,
+                              "title": "Top 10 Accounts Activity",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "30",
+                            "name": "query - 6 - Copy - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpOverview"
+                      },
+                      "name": "grpOverview"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend FROM_DEVICE_ = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE_ = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by FROM_DEVICE_, TO_DEVICE_\r\n| order by sum_Count_ desc",
+                              "size": 0,
+                              "title": "Resource Access Summary in Devices",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "sum_Count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "45",
+                            "name": "query - 0",
+                            "styleSettings": {
+                              "margin": "5px",
+                              "padding": "5px",
+                              "showBorder": true
+                            }
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc",
+                              "size": 0,
+                              "title": "Resource Access Summary in OS",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "sum_Count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "45",
+                            "name": "query - 0 - Copy",
+                            "styleSettings": {
+                              "margin": "5px",
+                              "padding": "5px",
+                              "showBorder": true
+                            }
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc",
+                              "size": 0,
+                              "title": "Credentials validation Summary in Devices",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "sum_Count",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "45",
+                            "name": "query - 0 - Copy",
+                            "styleSettings": {
+                              "margin": "5px",
+                              "padding": "5px",
+                              "showBorder": true
+                            }
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count);\r\ndata\r\n| summarize sum(Count) by  TO_DEVICE\r\n| order by sum_Count desc\r\n| join kind=inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by TO_DEVICE\r\n)\r\non $left.TO_DEVICE == $right.TO_DEVICE",
+                              "size": 0,
+                              "title": "Credentials validation by Domain Controllers",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "sum_Count",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TO_DEVICE1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 10,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "45",
+                            "name": "query - 0 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "5px",
+                              "padding": "5px",
+                              "showBorder": true
+                            }
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn",
+                              "size": 0,
+                              "title": "Logon Summary by Users",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "LogonSuccess",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "LogonFailed",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "redPurple"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "AccountUpn1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0 - Copy - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpLogOnEvents"
+                      },
+                      "name": "AttachmentGroup"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = IdentityQueryEvents\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"]);\r\ndata\r\n| summarize count() by QueryType, TO_DEVICE\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by QueryType, TO_DEVICE\r\n) on $left.QueryType == $right.QueryType and $left.TO_DEVICE== $right.TO_DEVICE",
+                              "size": 0,
+                              "title": "Device Query Summary",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "TO_DEVICE",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "QueryType1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "TO_DEVICE1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 21,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true,
+                                "hierarchySettings": {
+                                  "treeType": 1,
+                                  "groupBy": [
+                                    "TO_DEVICE"
+                                  ],
+                                  "expandTopLevel": true
+                                }
+                              }
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName",
+                              "size": 0,
+                              "title": "Query Summary from Source Devices",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "DeviceName1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              }
+                            },
+                            "name": "query - 0 - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpQueryEvents"
+                      },
+                      "name": "UrlGroup"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActionType ",
+                              "size": 0,
+                              "title": "Timeline on ActionType",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "timechart"
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc",
+                              "size": 0,
+                              "title": "Top 10 Actions",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "categoricalbar",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ]
+                              },
+                              "tileSettings": {
+                                "showBorder": false,
+                                "titleContent": {
+                                  "columnMatch": "DestinationPort",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "auto"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "name": "query - 0 - Copy"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn",
+                              "size": 0,
+                              "title": "Account Trend on Directory Events",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ],
+                                "rowLimit": 10000,
+                                "filter": true
+                              },
+                              "tileSettings": {
+                                "showBorder": false,
+                                "titleContent": {
+                                  "columnMatch": "DestinationPort",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "auto"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "name": "query - 0 - Copy - Copy"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpDirectoryEvents"
+                      },
+                      "name": "group - 8"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName",
+                              "size": 0,
+                              "noDataMessage": "Alerts",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "AlertName1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 21,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "query - 0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] == \"host\"\r\n| where isnotempty(Entities[\"HostName\"])\r\n| extend HostName = tostring(Entities[\"HostName\"]);\r\ndata\r\n| summarize count() by HostName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by HostName\r\n) on $left.HostName == $right.HostName",
+                              "size": 0,
+                              "title": "Impacted Hosts",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 8,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "HostName1",
+                                    "formatter": 5
+                                  },
+                                  {
+                                    "columnMatch": "Trend",
+                                    "formatter": 9,
+                                    "formatOptions": {
+                                      "palette": "red"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TimeGenerated",
+                                    "formatter": 5
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "query - 1"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Nav",
+                        "comparison": "isEqualTo",
+                        "value": "grpAlerts"
+                      },
+                      "name": "group - 8"
+                    }
+                  ],
+                  "fromTemplateId": "sentinel-MicrosoftDefenderForIdentity",
+                  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
+                  "contentProvenance": {
+                    "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+                    "packageVersion": "3.2.1",
+                    "contentId": "200c5dd2-9786-5619-8425-4508a238d76a",
+                    "contentVersion": "3.2.1"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "packageKind": "Solution",
+        "packageVersion": "3.2.1",
+        "packageName": "Microsoft Defender XDR",
+        "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "200c5dd2-9786-5619-8425-4508a238d76a",
+        "contentKind": "DefenderWorkbook",
+        "displayName": "MicrosoftDefenderForIdentity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','200c5dd2-9786-5619-8425-4508a238d76a','-','3.2.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','200c5dd2-9786-5619-8425-4508a238d76a','-','3.2.1')))]",
+        "version": "3.2.1",
+        "contentProvenance": {
+          "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+          "packageVersion": "3.2.1",
+          "contentId": "200c5dd2-9786-5619-8425-4508a238d76a",
+          "contentVersion": "3.2.1",
+          "requiredWorkloads": [
+            {
+              "workload": "mdi",
+              "dataTypes": [
+                "IdentityDirectoryEvents",
+                "IdentityLogonEvents",
+                "IdentityQueryEvents"
+              ]
             },
             {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 5",
-                "parentId": "[variables('analyticRuleObject5').analyticRuleId5]",
-                "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject5').analyticRuleVersion5]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
+              "workload": "sentinel",
+              "dataTypes": [
+                "SecurityAlert"
+              ]
             }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "SUNBURST network beacons",
-        "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
-        "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
-        "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in DeviceFileEvents\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f",
-                "displayName": "SUNBURST and SUPERNOVA backdoor hashes",
-                "enabled": false,
-                "query": "let SunburstMD5=dynamic([\"b91ce2fa41029f6955bff20079468448\",\"02af7cec58b9a5da1c542b5a32151ba1\",\"2c4a910a1299cdae2a4e55988a2f102e\",\"846e27a652a5e1bfbd0ddd38a16dc865\",\"4f2eb62fa529c0283b28d05ddd311fae\"]);\nlet SupernovaMD5=\"56ceb6d0011d87b6e4d7023d7ef85676\";\nDeviceFileEvents\n| where MD5 in(SunburstMD5) or MD5 in(SupernovaMD5)\n| extend HashAlgorithm = \"MD5\"\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceFileEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution",
-                  "Persistence",
-                  "InitialAccess"
-                ],
-                "techniques": [
-                  "T1195",
-                  "T1059",
-                  "T1546"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
-                      },
-                      {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Algorithm",
-                        "columnName": "HashAlgorithm"
-                      },
-                      {
-                        "identifier": "Value",
-                        "columnName": "MD5"
-                      }
-                    ],
-                    "entityType": "FileHash"
-                  }
-                ]
-              }
-            },
+          ],
+          "requiredDataConnectors": [
             {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 6",
-                "parentId": "[variables('analyticRuleObject6').analyticRuleId6]",
-                "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject6').analyticRuleVersion6]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
+              "connectorId": "MicrosoftThreatProtection",
+              "dataTypes": [
+                "SecurityAlert"
+              ]
             }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "SUNBURST and SUPERNOVA backdoor hashes",
-        "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
-        "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
-        "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
-      }
+          ],
+          "requiredWorkspaceFunctions": []
+        }
+      },
+      "condition": "[parameters('DeployDefenderWorkbook')]"
     },
     {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]",
-      "location": "[parameters('workspace-location')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "DefenderWorkbook-da2727e752b5d883c20387dfb93fc051",
       "dependsOn": [
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "AVdetectionsrelatedtoUkrainebasedthreats_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query looks for Microsoft Defender AV detections for malware observed in relation to the war in Ukraine.\n  Ref: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ ",
-                "displayName": "AV detections related to Ukraine threats",
-                "enabled": false,
-                "query": "let UA_threats = dynamic([\"FoxBlade\", \"WhisperGate\", \"Lasainraw\", \"SonicVote\", \"CaddyWiper\", \"AprilAxe\", \"FiberLake\", \"Industroyer\", \"DesertBlade\"]);\nSecurityAlert\n| where ProviderName =~ \"MDATP\"\n| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n| where ThreatFamilyName in~ (UA_threats)\n| extend HostName = tostring(split(CompromisedEntity, \".\")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "SecurityAlert"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Impact"
-                ],
-                "techniques": [
-                  "T1485"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "CompromisedEntity"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 7",
-                "parentId": "[variables('analyticRuleObject7').analyticRuleId7]",
-                "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject7').analyticRuleVersion7]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
+        "mode": "Incremental",
+        "expressionEvaluationOptions": {
+          "scope": "inner"
         },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "AV detections related to Ukraine threats",
-        "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
-        "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
-        "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AVTarrask_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
+        "template": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query looks for Microsoft Defender AV detections related to Tarrask malware. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged-on users etc. \n This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.\n Reference: https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/",
-                "displayName": "AV detections related to Tarrask malware",
-                "enabled": false,
-                "query": "let Tarrask_threats = dynamic([\"HackTool:Win64/Tarrask!MS\", \"HackTool:Win64/Ligolo!MSR\", \"Behavior:Win32/ScheduledTaskHide.A\", \"Tarrask\"]);\nDeviceInfo\n| extend DeviceName = tolower(DeviceName)\n| join kind=rightouter ( SecurityAlert\n| where ProviderName =~ \"MDATP\"\n| extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)\n| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n| where ThreatName in~ (Tarrask_threats) or ThreatFamilyName in~ (Tarrask_threats)\n| extend CompromisedEntity = tolower(CompromisedEntity)\n) on $left.DeviceName == $right.CompromisedEntity\n| summarize by DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId , bin(TimeGenerated, 1d), CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities\n| extend HostName = tostring(split(CompromisedEntity, \".\")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "SecurityAlert"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Persistence"
-                ],
-                "techniques": [
-                  "T1053"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "CompromisedEntity"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "PublicIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 8",
-                "parentId": "[variables('analyticRuleObject8').analyticRuleId8]",
-                "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject8').analyticRuleVersion8]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "imports": {
+            "MicrosoftSecurity": {
+              "provider": "MicrosoftSecurity",
+              "version": "1.0.0"
             }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "AV detections related to Tarrask malware",
-        "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
-        "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
-        "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AVSpringShell_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query looks for Microsoft Defender AV detections related to the SpringShell vulnerability. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device.\n  This query joins the DeviceInfo table to clearly connect other information such as device group, IP, logged-on users, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.\n  Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/",
-                "displayName": "AV detections related to SpringShell Vulnerability",
-                "enabled": false,
-                "query": "let SpringShell_threats = dynamic([\"Trojan:Python/SpringShellExpl\", \"Exploit:Python/SpringShell\", \"Backdoor:PHP/Remoteshell.V\", \"SpringShell\"]);\nDeviceInfo\n| extend DeviceName = tolower(DeviceName)\n| join kind=inner ( SecurityAlert\n| where ProviderName =~ \"MDATP\"\n| extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)\n| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n| where ThreatName in~ (SpringShell_threats) or ThreatFamilyName in~ (SpringShell_threats)\n| extend CompromisedEntity = tolower(CompromisedEntity)\n) on $left.DeviceName == $right.CompromisedEntity\n| summarize by DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId , bin(TimeGenerated, 1d), CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities\n| extend HostName = tostring(split(CompromisedEntity, \".\")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "SecurityAlert"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "InitialAccess"
-                ],
-                "techniques": [
-                  "T1190"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "CompromisedEntity"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "PublicIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]",
+          },
+          "resources": {
+            "workbook": {
+              "import": "MicrosoftSecurity",
+              "type": "Microsoft.Security/workbooks@2026-06-01-preview",
               "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 9",
-                "parentId": "[variables('analyticRuleObject9').analyticRuleId9]",
-                "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject9').analyticRuleVersion9]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "AV detections related to SpringShell Vulnerability",
-        "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
-        "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
-        "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "PossibleWebpBufferOverflow_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query looks at device, process, and network events from Defender for Endpoint that may be vulnerable to buffer overflow defined in CVE-2023-4863. Results are not an indicator of malicious activity.",
-                "displayName": "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863",
-                "enabled": false,
-                "query": "//CVE-2023-4863 Process activity with .webp files on devices where CVE-2023-4863 is unpatched\n//This query shows all process activity with .webp files on vulnerable machines and is not an indicator of malicious activity\nlet VulnDevices = DeviceTvmSoftwareVulnerabilities\n    | where CveId == \"CVE-2023-4863\"\n    | distinct DeviceId;\nunion DeviceProcessEvents, DeviceNetworkEvents, DeviceEvents\n| where DeviceId in (VulnDevices) and (InitiatingProcessCommandLine has(\".webp\") or ProcessCommandLine has(\".webp\"))\n| extend Name = tostring(split(AccountUpn, \"@\")[0]), UPNSuffix = tostring(split(AccountUpn, \"@\")[1])\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Informational",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents",
-                      "DeviceNetworkEvents",
-                      "DeviceEvents",
-                      "DeviceTvmSoftwareVulnerabilities"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution"
-                ],
-                "techniques": [
-                  "T1203"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "AccountUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "Name"
-                      },
-                      {
-                        "identifier": "UPNSuffix",
-                        "columnName": "UPNSuffix"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "LocalIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
-                      }
-                    ],
-                    "entityType": "Process"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "InitiatingProcessId"
-                      }
-                    ],
-                    "entityType": "Process"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
-                      }
-                    ],
-                    "entityType": "Process"
-                  }
-                ],
-                "eventGroupingSettings": {
-                  "aggregationKind": "SingleAlert"
-                },
-                "alertDetailsOverride": {
-                  "alertDynamicProperties": [],
-                  "alertDisplayNameFormat": "Possible exploitation of CVE-2023-4863"
-                },
-                "incidentConfiguration": {
-                  "groupingConfiguration": {
-                    "reopenClosedIncident": false,
-                    "enabled": false,
-                    "matchingMethod": "Selected",
-                    "groupByEntities": [
-                      "Account"
-                    ],
-                    "lookbackDuration": "PT5H"
-                  },
-                  "createIncident": false
-                }
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject10').analyticRuleId10,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 10",
-                "parentId": "[variables('analyticRuleObject10').analyticRuleId10]",
-                "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject10').analyticRuleVersion10]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863",
-        "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
-        "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
-        "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject11').analyticRuleTemplateSpecName11]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DeimosComponentExecution_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.",
-                "displayName": "Deimos Component Execution",
-                "enabled": false,
-                "query": "DeviceEvents   \n| where InitiatingProcessFileName =~ \"powershell.exe\"\n| where ActionType == \"AmsiScriptContent\"\n| where AdditionalFields endswith '[mArS.deiMos]::inteRaCt()\"}'\n| project InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, AdditionalFields, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution",
-                  "Collection",
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1059",
-                  "T1005",
-                  "T1020"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                "id": "8f47d55b-34a6-5d13-a89f-315b1a2a4f53",
+                "name": "MicrosoftDefenderForOffice365detectionsandinsights",
+                "content": {
+                  "version": "Notebook/1.0",
+                  "items": [
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "\n<table style=\"width:100%; border-collapse:collapse; border:none;\">\n  <tr style=\"border:none;\">\n    <td style=\"text-align:left; border:none; font-size:28px; font-weight:bold;width:1%;\">\n      Microsoft Defender for Office 365 Detections and Insights\n    </td>\n    <td style=\"text-align:right; border:none;width:1%;\">\n      <img height=\"40\" src=\"https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b\">\n\t</td>\n  </tr>\n</table>\n<table>\n<tr>\n<td style=\"text-align:left; border:none; font-size:16px; width:10%;\">This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.<br>It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.<br> The workbook uses data from hunting tables streamed from <a href=\"https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables\">Microsoft Defender XDR</a> via the Microsoft Sentinel Connector. Keep the data in the <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/configure-data-retention\">Log Analytics workspace</a> for as long as necessary to get insights over an extended period, based on your organisation's needs.</td>\n</tr>\n</table>\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n\n\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view."
+                      },
+                      "name": "text - 2",
+                      "id": "d2b45ab8-a1c1-43d2-853d-290640bf4c94"
+                    },
+                    {
+                      "type": 9,
+                      "content": {
+                        "version": "KqlParameterItem/1.0",
+                        "parameters": [
+                          {
+                            "id": "2e238f92-709c-410b-93e0-60eab6150a75",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "TimeRange",
+                            "type": 4,
+                            "isRequired": true,
+                            "isGlobal": true,
+                            "typeSettings": {
+                              "selectableValues": [
+                                {
+                                  "durationMs": 3600000
+                                },
+                                {
+                                  "durationMs": 14400000
+                                },
+                                {
+                                  "durationMs": 43200000
+                                },
+                                {
+                                  "durationMs": 86400000
+                                },
+                                {
+                                  "durationMs": 172800000
+                                },
+                                {
+                                  "durationMs": 259200000
+                                },
+                                {
+                                  "durationMs": 604800000
+                                },
+                                {
+                                  "durationMs": 1209600000
+                                },
+                                {
+                                  "durationMs": 2592000000
+                                },
+                                {
+                                  "durationMs": 5184000000
+                                },
+                                {
+                                  "durationMs": 7776000000
+                                }
+                              ],
+                              "allowCustom": true
+                            },
+                            "timeContext": {
+                              "durationMs": 86400000
+                            },
+                            "value": {
+                              "durationMs": 7776000000
+                            },
+                            "key": "2e238f92-709c-410b-93e0-60eab6150a75"
+                          },
+                          {
+                            "id": "165f2f4a-e49f-4561-adc5-d0527a4caf32",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "Granularity",
+                            "label": "Trend interval",
+                            "type": 2,
+                            "isRequired": true,
+                            "typeSettings": {
+                              "additionalResourceOptions": [],
+                              "showDefault": false
+                            },
+                            "jsonData": "[[{ \"value\": \"1d\", \"label\": \"Daily (1d)\", \"selected\": true }, { \"value\": \"7d\", \"label\": \"Weekly (7d)\" }, { \"value\": \"30d\", \"label\": \"Monthly (30d)\" }, { \"value\": \"90d\", \"label\": \"Quarterly (90d)\" }]",
+                            "timeContext": {
+                              "durationMs": 86400000
+                            },
+                            "value": "1d"
+                          }
+                        ],
+                        "style": "pills"
+                      },
+                      "name": "parameters - 1",
+                      "id": "0021e733-42b4-461f-8f6c-14e6e765389d"
+                    },
+                    {
+                      "type": 11,
+                      "content": {
+                        "version": "LinkItem/1.0",
+                        "style": "tabs",
+                        "links": [
+                          {
+                            "id": "3d26d949-bba8-486c-9af7-2b85bd5c8ab0",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Executive Summary",
+                            "subTarget": "1",
+                            "style": "link",
+                            "key": "3d26d949-bba8-486c-9af7-2b85bd5c8ab0"
+                          },
+                          {
+                            "id": "a5f95467-84c1-4d8b-858c-7819339af748",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Malware",
+                            "subTarget": "2",
+                            "style": "link",
+                            "key": "a5f95467-84c1-4d8b-858c-7819339af748"
+                          },
+                          {
+                            "id": "b6c93de8-16d9-4c90-999b-837935de5645",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Phish",
+                            "subTarget": "3",
+                            "style": "link",
+                            "key": "b6c93de8-16d9-4c90-999b-837935de5645"
+                          },
+                          {
+                            "id": "9e006e81-4fd4-40b9-9d20-3705dd6c17ad",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Impersonation & BEC",
+                            "subTarget": "15",
+                            "style": "link",
+                            "key": "75f1e28f-e95a-4810-af40-6b47b35cda46"
+                          },
+                          {
+                            "id": "df2c53b4-b6ed-4151-95fb-b3f08b849b84",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Spam",
+                            "subTarget": "4",
+                            "style": "link",
+                            "key": "df2c53b4-b6ed-4151-95fb-b3f08b849b84"
+                          },
+                          {
+                            "id": "fd2006c9-39b5-43ac-b05d-47309ee22deb",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Teams & Collaboration",
+                            "subTarget": "14",
+                            "style": "link",
+                            "key": "fd2006c9-39b5-43ac-b05d-47309ee22deb"
+                          },
+                          {
+                            "id": "ee01f95a-c5f7-4864-82e8-54a164741ba2",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "File - Malware (SharePoint, Teams and OneDrive)",
+                            "subTarget": "9",
+                            "style": "link",
+                            "key": "ee01f95a-c5f7-4864-82e8-54a164741ba2"
+                          },
+                          {
+                            "id": "9df30067-3266-48a8-b9e3-d65952098d46",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "URL & Clicks",
+                            "subTarget": "5",
+                            "style": "link",
+                            "key": "9df30067-3266-48a8-b9e3-d65952098d46"
+                          },
+                          {
+                            "id": "b4be0ac3-3f48-44a8-b4b6-b46e17c710cd",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Top Users & Exfiltration",
+                            "subTarget": "6",
+                            "style": "link",
+                            "key": "b4be0ac3-3f48-44a8-b4b6-b46e17c710cd"
+                          },
+                          {
+                            "id": "e1d34091-7b3c-4e2d-a032-8be82a989313",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Detection Overrides",
+                            "subTarget": "7",
+                            "style": "link",
+                            "key": "e1d34091-7b3c-4e2d-a032-8be82a989313"
+                          },
+                          {
+                            "id": "a1e6264d-8f85-4a94-9ffd-eee36c04a0d5",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Post-Delivery & Quarantine",
+                            "subTarget": "11",
+                            "style": "link",
+                            "key": "a1e6264d-8f85-4a94-9ffd-eee36c04a0d5"
+                          },
+                          {
+                            "id": "08c43a4f-f502-4813-9b8d-3f6b0b62b2fd",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "False Negative(FN) Submissions",
+                            "subTarget": "8",
+                            "style": "link",
+                            "key": "08c43a4f-f502-4813-9b8d-3f6b0b62b2fd"
+                          },
+                          {
+                            "id": "638d931f-f319-4914-b72d-8d68e914c7d4",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "False Positive(FP) Submissions",
+                            "subTarget": "10",
+                            "style": "link",
+                            "key": "638d931f-f319-4914-b72d-8d68e914c7d4"
+                          },
+                          {
+                            "id": "b2920bee-c32a-4fdd-9d32-b004db2f3ac8",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Security Operations Center (SOC) Insights",
+                            "subTarget": "13",
+                            "style": "link",
+                            "key": "b2920bee-c32a-4fdd-9d32-b004db2f3ac8"
+                          }
+                        ]
+                      },
+                      "name": "links - 14",
+                      "id": "5c9a1d6b-c248-432b-a1c0-496337635775"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Defender for Office 365 - Protection Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Microsoft Defender for Office 365** is a comprehensive security solution designed to protect organizations from advanced threats targeting their email and collaboration tools. It leverages a multi-layered approach to safeguard against phishing, malware, business email compromise (BEC), and other sophisticated attacks.\r\n"
+                                  },
+                                  "name": "text - 13",
+                                  "styleSettings": {
+                                    "margin": "0",
+                                    "padding": "0"
+                                  },
+                                  "id": "46119f93-fad9-413c-8e10-7615c6fdde2f"
+                                },
+                                {
+                                  "type": 12,
+                                  "content": {
+                                    "version": "NotebookGroup/1.0",
+                                    "groupType": "editable",
+                                    "items": [
+                                      {
+                                        "type": 3,
+                                        "content": {
+                                          "version": "KqlItem/1.0",
+                                          "query": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n    // this alteration is due to the threat types being updated directly within advanced hunting.\r\n    //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n    | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n    | extend MDO_detection = parse_json(DetectionMethods) \r\n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n    EmailPostDeliveryEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n    | summarize arg_max(Timestamp, *) by Key \r\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n    CloudAppEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n    | where ActionType == \"AdminSubmissionSubmitted\" \r\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n    | where SubmissionType in (\"1\", \"2\") \r\n    | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n    EmailEventsThreats \r\n    | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n    CloudAppEventsFiltered \r\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n    ); \r\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\n\r\nprint StatisticName=\"Effectiveness Post Delivery\", Value=abs(round(((toreal(toscalar(FN_Admin_Submissions))+toreal(toscalar(FN_ZAP_Unsuccessful)))/(toreal(toscalar(Mal_Phish_Mailflow))+toreal(toscalar(FN_ZAP_Successful))+toreal(toscalar(FN_ZAP_Unsuccessful))+toreal(toscalar(FN_Admin_Submissions))-toreal(toscalar(FP_ZAP)))*100-100),2))",
+                                          "size": 1,
+                                          "showAnalytics": true,
+                                          "timeContextFromParameter": "TimeRange",
+                                          "queryType": "advancedHunting",
+                                          "visualization": "stat",
+                                          "tileSettings": {
+                                            "showBorder": false,
+                                            "titleContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "leftContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 12,
+                                              "formatOptions": {
+                                                "palette": "auto"
+                                              },
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "graphSettings": {
+                                            "type": 0,
+                                            "topContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "centerContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 1,
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "statSettings": {
+                                            "valueField": "Value",
+                                            "valueAggregation": "None",
+                                            "colorSettings": {
+                                              "type": "thresholds",
+                                              "mode": "foreground",
+                                              "heatmapPalette": "greenRed",
+                                              "thresholdsGrid": [
+                                                {
+                                                  "operator": ">",
+                                                  "thresholdValue": "95",
+                                                  "representation": "green"
+                                                },
+                                                {
+                                                  "operator": "<=",
+                                                  "thresholdValue": "95",
+                                                  "representation": "orange"
+                                                },
+                                                {
+                                                  "operator": "<=",
+                                                  "thresholdValue": "90",
+                                                  "representation": "red"
+                                                }
+                                              ]
+                                            },
+                                            "iconSettings": {
+                                              "thresholdsGrid": []
+                                            },
+                                            "numberFormatSettings": {
+                                              "unit": 1,
+                                              "options": {
+                                                "style": "decimal"
+                                              }
+                                            },
+                                            "tagText": "Phish / Malware Effectiveness - Post Delivery",
+                                            "valueFontStyle": "superLarge",
+                                            "tagTextPosition": "bottom"
+                                          }
+                                        },
+                                        "customWidth": "50",
+                                        "name": "query - 5",
+                                        "id": "62de2a91-a809-48ec-a111-e697d556b2b3"
+                                      },
+                                      {
+                                        "type": 3,
+                                        "content": {
+                                          "version": "KqlItem/1.0",
+                                          "query": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))",
+                                          "size": 1,
+                                          "showAnalytics": true,
+                                          "timeContextFromParameter": "TimeRange",
+                                          "queryType": "advancedHunting",
+                                          "visualization": "stat",
+                                          "tileSettings": {
+                                            "titleContent": {
+                                              "columnMatch": "Release_Percentage",
+                                              "formatter": 12,
+                                              "formatOptions": {
+                                                "palette": "none"
+                                              },
+                                              "numberFormat": {
+                                                "unit": 1,
+                                                "options": {
+                                                  "style": "decimal"
+                                                }
+                                              }
+                                            },
+                                            "showBorder": true,
+                                            "sortCriteriaField": "Release_Percentage",
+                                            "size": "auto"
+                                          },
+                                          "graphSettings": {
+                                            "type": 0,
+                                            "topContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "centerContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 1,
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "statSettings": {
+                                            "valueField": "Release_Percentage",
+                                            "valueAggregation": "None",
+                                            "colorSettings": {
+                                              "type": "thresholds",
+                                              "mode": "foreground",
+                                              "heatmapPalette": "greenRed",
+                                              "thresholdsGrid": [
+                                                {
+                                                  "operator": "<",
+                                                  "thresholdValue": "5",
+                                                  "representation": "green"
+                                                },
+                                                {
+                                                  "operator": ">",
+                                                  "thresholdValue": "5",
+                                                  "representation": "redDark"
+                                                }
+                                              ]
+                                            },
+                                            "iconSettings": {
+                                              "thresholdsGrid": []
+                                            },
+                                            "numberFormatSettings": {
+                                              "unit": 1,
+                                              "options": {
+                                                "style": "decimal"
+                                              }
+                                            },
+                                            "tagText": "Quarantine Release Percentage",
+                                            "valueFontStyle": "superLarge",
+                                            "tagTextPosition": "bottom"
+                                          }
+                                        },
+                                        "customWidth": "50",
+                                        "name": "query - 1",
+                                        "id": "858ac1a4-8828-45e9-968c-d3cfc1216c64"
+                                      }
+                                    ]
+                                  },
+                                  "name": "TopNr",
+                                  "id": "1369c97e-848b-475a-b447-3a435cb7a1f1"
+                                },
+                                {
+                                  "type": 12,
+                                  "content": {
+                                    "version": "NotebookGroup/1.0",
+                                    "groupType": "editable",
+                                    "items": [
+                                      {
+                                        "type": 1,
+                                        "content": {
+                                          "json": "**Effectiveness visually represents the protection given by Defender for Office 365 against phishing and malware in email messages.** <br>\r\nWe consider messages that your users report, as well as decisions that are made after delivery."
+                                        },
+                                        "name": "text - 9",
+                                        "styleSettings": {
+                                          "margin": "1px"
+                                        },
+                                        "id": "25e2e19e-aefb-4e37-b28f-b4138d63e109"
+                                      },
+                                      {
+                                        "type": 3,
+                                        "content": {
+                                          "version": "KqlItem/1.0",
+                                          "query": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n    // this alteration is due to the threat types being updated directly within advanced hunting.\r\n    //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n    | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n    | extend MDO_detection = parse_json(DetectionMethods) \r\n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n    EmailPostDeliveryEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n    | summarize arg_max(Timestamp, *) by Key \r\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n    CloudAppEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n    | where ActionType == \"AdminSubmissionSubmitted\" \r\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n    | where SubmissionType in (\"1\", \"2\") \r\n    | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n    EmailEventsThreats \r\n    | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n    CloudAppEventsFiltered \r\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n    ); \r\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\nunion withsource=Table \r\n    (print StatisticName=\"Mal/Phish Mailflow totals - Minus FPs\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \r\n    (print StatisticName=\"Admin Mal/Phish FNs Submitted\", Value=toreal(FN_Admin_Submissions)), \r\n    (print StatisticName=\"Mal/Phish FPs Reverse Zapped\", Value=toreal(FP_ZAP)), \r\n    (print StatisticName=\"Mal / Phish Successfully Zapped\", Value=toreal(FN_ZAP_Successful)), \r\n    (print StatisticName=\"Mal / Phish UN-Successfully Zapped\", Value=toreal(FN_ZAP_Unsuccessful)), \r\n    (print StatisticName=\"Effectiveness Post Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \r\n    (print StatisticName=\"Effectiveness Pre-Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))) \r\n| project StatisticName, Value",
+                                          "size": 0,
+                                          "showAnalytics": true,
+                                          "timeContextFromParameter": "TimeRange",
+                                          "queryType": "advancedHunting",
+                                          "visualization": "table",
+                                          "gridSettings": {
+                                            "formatters": [
+                                              {
+                                                "columnMatch": "Value",
+                                                "formatter": 0,
+                                                "numberFormat": {
+                                                  "unit": 17,
+                                                  "options": {
+                                                    "style": "decimal"
+                                                  }
+                                                }
+                                              }
+                                            ]
+                                          },
+                                          "tileSettings": {
+                                            "showBorder": false,
+                                            "titleContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "leftContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 12,
+                                              "formatOptions": {
+                                                "palette": "auto"
+                                              },
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "graphSettings": {
+                                            "type": 2,
+                                            "topContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "centerContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 1,
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            },
+                                            "nodeIdField": "StatisticName",
+                                            "sourceIdField": "Value",
+                                            "targetIdField": "Value",
+                                            "graphOrientation": 3,
+                                            "showOrientationToggles": false,
+                                            "nodeSize": null,
+                                            "staticNodeSize": 100,
+                                            "colorSettings": null,
+                                            "hivesMargin": 5,
+                                            "edgeColorSettings": null
+                                          }
+                                        },
+                                        "name": "query - 7",
+                                        "id": "9e09ff94-8092-49c7-860f-341049e1398c"
+                                      }
+                                    ]
+                                  },
+                                  "customWidth": "50",
+                                  "name": "Effectiveness Nr",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "31081a73-9a54-4668-9e26-ad7347f1e06e"
+                                },
+                                {
+                                  "type": 12,
+                                  "content": {
+                                    "version": "NotebookGroup/1.0",
+                                    "groupType": "editable",
+                                    "items": [
+                                      {
+                                        "type": 1,
+                                        "content": {
+                                          "json": "**Quarantine release rate by detection technology.** \r\n<br>\r\nFor each detector, the share of its quarantined mail that was later released (Release % = released / quarantined). A high rate can indicate false positives worth reviewing."
+                                        },
+                                        "name": "text - 1",
+                                        "styleSettings": {
+                                          "margin": "1px"
+                                        },
+                                        "id": "e9848043-03dd-4ada-9e73-238067463f74"
+                                      },
+                                      {
+                                        "type": 3,
+                                        "content": {
+                                          "version": "KqlItem/1.0",
+                                          "query": "//Per detection technology: the share of its quarantined emails later released from quarantine (a high rate can indicate false positives). Top 7 by release rate; detectors with <10 quarantined excluded so the rate is meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\"\r\n| join kind=leftouter (\r\n    EmailPostDeliveryEvents\r\n    | where Action == \"Quarantine release\"\r\n    | distinct NetworkMessageId\r\n    | extend ReleasedFlag = \"yes\"\r\n  ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Technology']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc\r\n| take 7",
+                                          "size": 0,
+                                          "showAnalytics": true,
+                                          "timeContextFromParameter": "TimeRange",
+                                          "queryType": "advancedHunting",
+                                          "visualization": "table",
+                                          "gridSettings": {
+                                            "formatters": [
+                                              {
+                                                "columnMatch": "Quarantined Emails",
+                                                "formatter": 0,
+                                                "formatOptions": {
+                                                  "customColumnWidthSetting": "130px"
+                                                },
+                                                "numberFormat": {
+                                                  "unit": 17,
+                                                  "options": {
+                                                    "style": "decimal",
+                                                    "maximumFractionDigits": 1
+                                                  }
+                                                }
+                                              },
+                                              {
+                                                "columnMatch": "Released",
+                                                "formatter": 3,
+                                                "formatOptions": {
+                                                  "palette": "redDark",
+                                                  "customColumnWidthSetting": "90px"
+                                                },
+                                                "numberFormat": {
+                                                  "unit": 17,
+                                                  "options": {
+                                                    "style": "decimal",
+                                                    "maximumFractionDigits": 1
+                                                  }
+                                                }
+                                              },
+                                              {
+                                                "columnMatch": "Release %",
+                                                "formatter": 4,
+                                                "formatOptions": {
+                                                  "palette": "red",
+                                                  "min": 0,
+                                                  "max": 20,
+                                                  "customColumnWidthSetting": "90px"
+                                                },
+                                                "numberFormat": {
+                                                  "unit": 1,
+                                                  "options": {
+                                                    "style": "decimal"
+                                                  }
+                                                }
+                                              }
+                                            ],
+                                            "filter": true
+                                          }
+                                        },
+                                        "name": "query - 2",
+                                        "id": "1bbae9d1-d6f8-446a-817c-8fdc2df83d4c"
+                                      }
+                                    ]
+                                  },
+                                  "customWidth": "50",
+                                  "name": "Quarantine Overview Relese",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "36fd8f20-ece7-4889-9fb1-f5b85b97b45a"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Protection Insights",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "1d8e22e0-22f7-453e-aed2-9e56ace1363a"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Protection details\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis Overview provides an executive summary of your Microsoft Defender for Office 365 email security posture: the volume of mail processed, threats detected and filtered (phishing, malware, spam), overall protection effectiveness, and the mix of threats targeting your organization. Use it as a starting point, then drill into the dedicated tabs for detailed investigation."
+                                  },
+                                  "name": "text - 13",
+                                  "id": "24cf577c-e12a-4747-95a7-1c19bee17397"
+                                },
+                                {
+                                  "type": 9,
+                                  "content": {
+                                    "version": "KqlParameterItem/1.0",
+                                    "parameters": [
+                                      {
+                                        "id": "5c0f0101-0a11-4b22-9c33-000000000101",
+                                        "version": "KqlParameterItem/1.0",
+                                        "name": "ProtectionView",
+                                        "label": "Protection view",
+                                        "type": 2,
+                                        "isRequired": true,
+                                        "typeSettings": {
+                                          "additionalResourceOptions": [],
+                                          "showDefault": false
+                                        },
+                                        "jsonData": "[[{ \"value\": \"Table\", \"label\": \"Summary table\", \"selected\": true }, { \"value\": \"Tiles\", \"label\": \"Detailed tiles\" }]",
+                                        "value": "Tiles"
+                                      }
+                                    ],
+                                    "style": "pills"
+                                  },
+                                  "name": "Protection view selector",
+                                  "id": "5c0f0102-0a11-4b22-9c33-000000000102"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "let base = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize arg_max(Timestamp, ThreatTypes, DeliveryAction, OrgLevelPolicy, OrgLevelAction, UserLevelAction) by Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress));\r\nlet agg = materialize(base | summarize\r\n    Total = count(),\r\n    Filtered = countif(isnotempty(ThreatTypes) and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FMal = countif(ThreatTypes has \"Malware\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FPhish = countif(ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FSpam = countif(ThreatTypes == \"Spam\" and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    Deliv = countif(isnotempty(ThreatTypes) and DeliveryAction == \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n    Blocked = countif(isempty(ThreatTypes) and DeliveryAction != \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n    Clean = countif(isempty(ThreatTypes) and DeliveryAction == \"Delivered\"));\r\nlet pd = materialize(EmailPostDeliveryEvents | where ActionResult == \"Success\" | summarize MalZap = countif(ActionType == \"Malware ZAP\"), PhishZap = countif(ActionType == \"Phish ZAP\"), SpamZap = countif(ActionType == \"Spam ZAP\"));\r\nlet sub = materialize(CloudAppEvents | extend R = tostring(parse_json(RawEventData).RecordType), SCT = tostring(parse_json(RawEventData).SubmissionContentType) | where R == \"29\" | summarize Adm = countif(ActionType == \"AdminSubmissionSubmitted\" and SCT == \"Mail\"), Usr = countif(ActionType == \"UserSubmission\"));\r\nlet Total = toscalar(agg | project Total);\r\nlet Filtered = toscalar(agg | project Filtered);\r\nlet FMal = toscalar(agg | project FMal);\r\nlet FPhish = toscalar(agg | project FPhish);\r\nlet FSpam = toscalar(agg | project FSpam);\r\nlet Deliv = toscalar(agg | project Deliv);\r\nlet Blocked = toscalar(agg | project Blocked);\r\nlet Clean = toscalar(agg | project Clean);\r\nlet MalZap = toscalar(pd | project MalZap);\r\nlet PhishZap = toscalar(pd | project PhishZap);\r\nlet SpamZap = toscalar(pd | project SpamZap);\r\nlet Adm = toscalar(sub | project Adm);\r\nlet Usr = toscalar(sub | project Usr);\r\nunion\r\n    (print o = 1, Name = \"Total Inbound Emails\", Count = Total),\r\n    (print o = 2, Name = \"    Filtering Totals\", Count = Filtered),\r\n    (print o = 3, Name = \"        Filtered as Malware\", Count = FMal),\r\n    (print o = 4, Name = \"        Filtered as Phish\", Count = FPhish),\r\n    (print o = 5, Name = \"        Filtered as Spam\", Count = FSpam),\r\n    (print o = 6, Name = \"    Delivered with Detection\", Count = Deliv),\r\n    (print o = 7, Name = \"    User/Admin Blocked\", Count = Blocked),\r\n    (print o = 8, Name = \"    Clean Emails\", Count = Clean),\r\n    (print o = 9, Name = \"Post-Delivery ZAP Removals\", Count = MalZap + PhishZap + SpamZap),\r\n    (print o = 10, Name = \"    Removed by Malware ZAP\", Count = MalZap),\r\n    (print o = 11, Name = \"    Removed by Phish ZAP\", Count = PhishZap),\r\n    (print o = 12, Name = \"    Removed by Spam ZAP\", Count = SpamZap),\r\n    (print o = 13, Name = \"User/Admin Reported\", Count = Adm + Usr),\r\n    (print o = 14, Name = \"    Reported by Admins\", Count = Adm),\r\n    (print o = 15, Name = \"    Reported by Users\", Count = Usr)\r\n| sort by o asc\r\n| extend [\"% of Inbound\"] = round(Count * 100.0 / Total, 1)\r\n| project Name, Count, [\"% of Inbound\"]",
+                                    "size": 3,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "table",
+                                    "gridSettings": {
+                                      "formatters": [
+                                        {
+                                          "columnMatch": "Name",
+                                          "formatter": 1,
+                                          "formatOptions": {
+                                            "customColumnWidthSetting": "3fr"
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "Count",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "3fr"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal"
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "% of Inbound",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "green",
+                                            "min": 0,
+                                            "max": 100,
+                                            "customColumnWidthSetting": "2fr"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 1,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "customWidth": "100",
+                                  "conditionalVisibility": {
+                                    "parameterName": "ProtectionView",
+                                    "comparison": "isEqualTo",
+                                    "value": "Table"
+                                  },
+                                  "name": "query - option 1 grid",
+                                  "id": "5c0f0005-0a11-4b22-9c33-000000000005"
+                                },
+                                {
+                                  "type": 12,
+                                  "content": {
+                                    "version": "NotebookGroup/1.0",
+                                    "groupType": "editable",
+                                    "items": [
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "title": "Total Emails",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Total Inbound Emails\";",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "gridSettings": {
+                                                  "formatters": [
+                                                    {
+                                                      "columnMatch": "Count",
+                                                      "formatter": 4,
+                                                      "formatOptions": {
+                                                        "palette": "greenRed"
+                                                      }
+                                                    }
+                                                  ]
+                                                },
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1,
+                                                    "formatOptions": {
+                                                      "compositeBarSettings": {
+                                                        "labelText": ""
+                                                      }
+                                                    }
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "blue",
+                                                      "compositeBarSettings": {
+                                                        "labelText": ""
+                                                      }
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                },
+                                                "chartSettings": {
+                                                  "xAxis": "Count",
+                                                  "createOtherGroup": 0
+                                                },
+                                                "mapSettings": {
+                                                  "locInfo": "LatLong",
+                                                  "sizeSettings": "Count",
+                                                  "sizeAggregation": "Sum",
+                                                  "legendMetric": "Count",
+                                                  "legendAggregation": "Sum",
+                                                  "itemColorSettings": {
+                                                    "type": "heatmap",
+                                                    "colorAggregation": "Sum",
+                                                    "nodeColorField": "Count",
+                                                    "heatmapPalette": "greenRed"
+                                                  }
+                                                }
+                                              },
+                                              "name": "query - 1",
+                                              "id": "84e8d60b-7937-46f5-b2f4-a1a4adf06c9f"
+                                            }
+                                          ]
+                                        },
+                                        "name": "Total Inbound",
+                                        "id": "1aeed046-9ea5-4583-b966-722847997fc7"
+                                      },
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "title": "Filtering Totals",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| where isnotempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Filtering Totals\";",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1,
+                                                    "formatOptions": {
+                                                      "compositeBarSettings": {
+                                                        "labelText": ""
+                                                      }
+                                                    }
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "redDark",
+                                                      "compositeBarSettings": {
+                                                        "labelText": ""
+                                                      }
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "name": "query - 1",
+                                              "id": "bae9a200-589f-4ca6-a3cf-f1110f644c49"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises Total emails detected as Malware\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has ('Malware') and EmailDirection == \"Inbound\"\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Malware\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "red"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 4",
+                                              "id": "0984d05b-fd2c-48e1-835f-41afc5a2385a"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises Total emails detected as Phish\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Phish\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "orange"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 4",
+                                              "id": "ced2d054-76d1-40df-a412-0bc86a6c3336"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises Total emails by detected as Spam\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes == 'Spam' and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Spam\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "yellow"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 4",
+                                              "id": "14456a0d-f5ac-46a0-a007-c72c7c40c58f"
+                                            }
+                                          ]
+                                        },
+                                        "customWidth": "50",
+                                        "name": "group - 9",
+                                        "id": "d4e69885-f1b2-4c2b-85c2-188a6708dc4b"
+                                      },
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "title": " ",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and DeliveryAction == 'Delivered'\r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Delivered with Detection\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 0,
+                                                      "palette": "red"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "394d1ed4-7089-4291-bc80-f9948e3be6a9"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isempty(ThreatTypes) \r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| where DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"User/Admin Blocked\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "gray"
+                                                    },
+                                                    "tooltipFormat": {
+                                                      "tooltip": "Emails blocked from being delivered because of User or Admin overriddes"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "c29a2268-67d1-4958-a9a3-696384075987"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| where isempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction == 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Clean Emails\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "gray"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "89a02ac7-971c-4672-bf5d-64709c479536"
+                                            }
+                                          ]
+                                        },
+                                        "customWidth": "50",
+                                        "name": "group - 8",
+                                        "id": "761e74d4-279e-465f-ba47-5eeec4cf05d2"
+                                      },
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "title": "Post-Delivery ZAP Removals",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Malware ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Malware ZAP\"\r\n",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "red"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "b06666bc-6ec0-49e7-a332-77e278d2320f"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Phish ZAP\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "orange"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "6fbac01b-0c42-46dc-8ca8-68e285593a45"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Spam ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Spam ZAP\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "yellow"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "7bd27a3b-be13-4ca0-9964-0f872f826b45"
+                                            }
+                                          ]
+                                        },
+                                        "name": "Post Delivery",
+                                        "id": "4d20339e-5215-4edf-99d6-728cac183d16"
+                                      },
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Admins\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "palette": "none"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "50",
+                                              "name": "query - 3",
+                                              "id": "7490fa3a-e287-4fc3-b025-8772b9edb601"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\r\n| where Record == 29 and ActionType == \"UserSubmission\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Users\"\r\n",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "palette": "none"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "50",
+                                              "name": "query - 2",
+                                              "id": "7af222dc-fd74-40ec-8ab7-741e179c07bf"
+                                            }
+                                          ]
+                                        },
+                                        "name": "Reported",
+                                        "id": "8151e242-1c30-4550-ae9c-83f159e1a456"
+                                      }
+                                    ]
+                                  },
+                                  "conditionalVisibility": {
+                                    "parameterName": "ProtectionView",
+                                    "comparison": "isEqualTo",
+                                    "value": "Tiles"
+                                  },
+                                  "name": "Protection - Tiles view",
+                                  "id": "5c0f0103-0a11-4b22-9c33-000000000103"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "## Most Attacked Users<br>\r\n\r\n**The users most targeted by inbound email threats across all threat types (malware, phishing, and spam) in the selected period. Concentrated targeting of a few individuals is a strong signal of deliberate campaigns.**<br><br>**Recommended action:** Prioritise these users for security awareness training, tighter protection policies (for example the Strict preset), and closer monitoring - they are your highest-risk people."
+                                  },
+                                  "name": "exec vap banner",
+                                  "id": "1fe431fb-cc96-4e81-b164-3a1a3823ebeb"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query surfaces the users most targeted by inbound email threats across all threat types (malware, phishing, spam) for the selected period, so SecOps can prioritise the highest-risk individuals. Similar to a \"Most Attacked People\" view.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where isnotempty(ThreatTypes)\r\n| summarize\r\n    ['Total Threats'] = count(),\r\n    Malware = countif(ThreatTypes has \"Malware\"),\r\n    Phish   = countif(ThreatTypes has \"Phish\"),\r\n    Spam    = countif(ThreatTypes has \"Spam\"),\r\n    ['Last Seen'] = max(Timestamp)\r\n    by ['User']=RecipientEmailAddress\r\n| top 10 by ['Total Threats']\r\n| project ['User'], ['Total Threats'], Malware, Phish, Spam, ['Last Seen']",
+                                    "size": 3,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "table",
+                                    "gridSettings": {
+                                      "filter": true,
+                                      "formatters": [
+                                        {
+                                          "columnMatch": "Malware",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "145px"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "Phish",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "145px"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "Spam",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "145px"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "Total Threats",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "145px"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "customWidth": "100",
+                                  "name": "exec vap table",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "2dfd91b1-b8d3-4a72-aaf4-a30a1886bed7"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "## Detection trend over time - grouped by {Granularity}\r\n**Represents total emails, total detections, total user submissions and admin email submissions over time summarizing the data per {Granularity} interval**"
+                                  },
+                                  "name": "text - 14",
+                                  "id": "ddbbdaef-b374-42a8-821c-7fcd7ee53ba9"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query visualises total emails, total detections, total user, and admin email submissions over time summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet scaffold = range Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran;\r\nlet baseQuery = materialize(EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where isnotempty(Timestamp));\r\nlet sub = materialize(CloudAppEvents\r\n| extend Record = (parse_json(RawEventData)).RecordType, SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29);\r\nlet zapbase = EmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\" or ActionType == \"Spam ZAP\";\r\nunion\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Inbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Inbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Phish') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Phish\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Malware') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Malware\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Spam') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Spam\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Intra-org\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Intra-org Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Outbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Outbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where isnotempty(ThreatTypes) | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails with Threat\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"UserSubmission\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Users\"),\r\n(scaffold | join kind=leftouter (zapbase | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Removed by ZAP\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"Mail\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Admins\")",
+                                    "size": 0,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "linechart",
+                                    "chartSettings": {
+                                      "xAxis": "Timestamp",
+                                      "seriesLabelSettings": [
+                                        {
+                                          "seriesName": "Total Inbound Emails",
+                                          "label": "Inbound Emails",
+                                          "color": "green"
+                                        },
+                                        {
+                                          "seriesName": "Total Emails with Threat",
+                                          "label": "Emails with Threat",
+                                          "color": "redDark"
+                                        },
+                                        {
+                                          "seriesName": "Emails Detected as Phish",
+                                          "label": "Emails with Phish",
+                                          "color": "redBright"
+                                        },
+                                        {
+                                          "seriesName": "Emails Detected as Malware",
+                                          "label": "Emails with Malware",
+                                          "color": "red"
+                                        },
+                                        {
+                                          "seriesName": "Total Intra-org Emails",
+                                          "label": "Intra-org Emails",
+                                          "color": "greenDark"
+                                        },
+                                        {
+                                          "seriesName": "Emails Detected as Spam",
+                                          "label": "Emails with Spam",
+                                          "color": "gray"
+                                        },
+                                        {
+                                          "seriesName": "Total Outbound Emails",
+                                          "label": "Outbound Emails",
+                                          "color": "greenDarkDark"
+                                        },
+                                        {
+                                          "seriesName": "Total Emails Removed by ZAP",
+                                          "label": "Emails ZAP-d",
+                                          "color": "orangeDark"
+                                        },
+                                        {
+                                          "seriesName": "Total Emails Reported by Users",
+                                          "label": "User Reported Emails",
+                                          "color": "lightBlue"
+                                        },
+                                        {
+                                          "seriesName": "Total Emails Reported by Admins",
+                                          "color": "blueDark"
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "customWidth": "100",
+                                  "name": "query - 1",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "bcbefa48-f553-4290-acff-2691caf898ea"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "## Bad traffic (%) - Inbound Emails - grouped by {Granularity}\r\n**This represents bad traffic (% of emails with threats) compared to total inbound emails, summarized per {Granularity} interval over time.**"
+                                  },
+                                  "name": "text - 15",
+                                  "id": "30761bcc-b1a5-45e2-8c0a-22388fbbf16c"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, {Granularity})\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| project Timestamp, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                                    "size": 0,
+                                    "aggregation": 3,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "linechart"
+                                  },
+                                  "customWidth": "100",
+                                  "name": "query - 4",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "508036a8-d969-44c2-b2d2-c62d99999197"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Protection Details",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "e6edeeeb-dcde-41d0-88c7-97ef773403b1"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Collaboration Protection Posture\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 protects Microsoft Teams and collaboration, not only email. This snapshot shows Teams threat activity for the period.<br><br>**Recommended action:** Review the dedicated **Teams &amp; Collaboration** tab for impersonation, malicious URLs, risky senders and file threats in Teams."
+                                  },
+                                  "name": "exec collab banner",
+                                  "id": "3d78a6aa-51d4-4cab-93d1-26dff86fd667"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//Headline Microsoft Teams / collaboration protection metrics for the executive summary, with per-interval sparklines so the collaboration threat trend is visible at a glance. Messages and URLs are counted per distinct Teams message.\r\nlet gran = {Granularity};\r\nlet me = materialize(MessageEvents);\r\nlet cae = materialize(CloudAppEvents | where ActionType == \"TeamsImpersonationDetected\");\r\nlet mui = materialize(MessageUrlInfo);\r\nlet uce = materialize(UrlClickEvents | where Workload == \"Teams\" and ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\"));\r\nlet fmc = materialize(FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\");\r\nunion\r\n(me | summarize Count = dcount(TeamsMessageId) | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(me | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(me | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Teams Threat Messages\", Ord = 2, Trend = toscalar(me | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(cae | summarize Count = count() | extend Details = \"Teams Impersonation Detections\", Ord = 3, Trend = toscalar(cae | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(mui | summarize Count = dcount(TeamsMessageId) | extend Details = \"URLs Shared in Teams\", Ord = 4, Trend = toscalar(mui | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(uce | summarize Count = count() | extend Details = \"Malicious Clicks Blocked\", Ord = 5, Trend = toscalar(uce | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 6, Trend = toscalar(fmc | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Malicious Teams Files\", Ord = 7, Trend = toscalar(fmc | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+                                    "size": 3,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "tiles",
+                                    "tileSettings": {
+                                      "titleContent": {
+                                        "columnMatch": "Details",
+                                        "formatter": 1
+                                      },
+                                      "leftContent": {
+                                        "columnMatch": "Count",
+                                        "formatter": 12,
+                                        "formatOptions": {
+                                          "min": 0,
+                                          "palette": "blue"
+                                        },
+                                        "numberFormat": {
+                                          "unit": 17,
+                                          "options": {
+                                            "style": "decimal",
+                                            "maximumFractionDigits": 1
+                                          }
+                                        }
+                                      },
+                                      "secondaryContent": {
+                                        "columnMatch": "Trend",
+                                        "formatter": 21
+                                      },
+                                      "showBorder": true,
+                                      "size": "auto"
+                                    }
+                                  },
+                                  "customWidth": "100",
+                                  "name": "exec collab tiles",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "3175aee5-56d2-4cb1-b1c3-75be683e6ffb"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Collaboration Posture",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "39b0921f-fcef-49f4-8d52-0dcd1f33045b"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Emerging Threats\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<p style=\"font-size:16px;\">With more sophisticated adversaries and new threats emerging frequently and prevalently, it's critical to be able to quickly identify and react to these threats.</p>\r\n\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Email threat landscape</b></p>](https://security.microsoft.com/threatanalytics3/f186e4b0-28df-499a-901e-c64768b6d0dc/overview?filters=tags%253DPhishing)\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Automated business email impersonation campaign uses parallel aging report and payroll diversion lures</b></p>](https://security.microsoft.com/threatanalytics3/3eb53378-892d-4695-a497-25d0a54181ee)\r\n[<p style=\"font-size:16px;\"><b>🛡️Tool Profile: StealC</b></p>](https://security.microsoft.com/threatanalytics3/4d837c12-1db4-49c8-8466-219198d40b9b)\r\n[<p style=\"font-size:16px;\"><b>🛡️OSINT Profile: UNC1151/Ghostwriter phishing campaign targeting Gmail accounts</b></p>](https://security.microsoft.com/threatanalytics3/b1a7e5e7-4b43-4758-8805-f714a131161a)\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Encrypted message campaign targets real estate/financial sectors</b></p>](https://security.microsoft.com/threatanalytics3/651d669a-4721-42ab-bb96-509e94b5bfd9)\r\n\r\n<br>\r\n<a href=\"https://go.microsoft.com/fwlink/?linkid=2323913\" target=\"_blank\" style=\"font-size:14px; padding:10px 20px; background-color:#003366; color:white; border:none; border-radius:5px;\">\r\n<b>View all\r\n \r\n</a>\r\n"
+                                  },
+                                  "name": "text - 10",
+                                  "styleSettings": {
+                                    "margin": "0",
+                                    "padding": "0"
+                                  },
+                                  "id": "0c781e85-af9a-41a6-9cf7-b3bb9a09d5d0"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Emerging Threats",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "4f8886d3-882a-4c14-ab7f-a37bd302e32f"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Microsoft 365 Secure Email Gateway Performance\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<p style=\"font-size:16px;\">Using multiple vendor email security products can offer diverse detections. However, our comprehensive end-to-end approach—spanning prevention, detection, posture, investigation, response, and user training—delivers a unified and effective defense that matches or exceeds the efficacy of siloed Secure Email Gateway solutions.</p>\r\n\r\n[<p style=\"font-size:18px;\"><b>Learn more</b></p>](https://www.microsoft.com/en-us/security/blog/2026/06/15/microsoft-defender-email-security-benchmarking-key-insights-from-one-year-of-data/) \r\n\r\n<br>\r\n<p style=\"font-size:16px;\"><b>High-severity email threats missed per 1,000 users protected - February–April 2026 (Microsoft Defender email security benchmarking)</b></p>"
+                                  },
+                                  "name": "text - 12",
+                                  "id": "94c804f9-2860-4768-be59-fb31a4ff22d7"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "datatable(Index:int, Name:string, Value:int)\r\n[\r\n    1, \"Defender for Office 365\", 194,\r\n    2, \"Mimecast\", 478,\r\n    3, \"ProofPoint\", 483,\r\n    4, \"HornetSecurity\", 813,\r\n    5, \"TrendMicro\", 1151,\r\n    6, \"IronPort\", 1274,\r\n    7, \"Barracuda\", 1585,\r\n    8, \"FireEye\", 2107\r\n]\r\n| project [\"Email security solution\"] = Name, [\"High-severity threats missed / 1K users\"] = Value\r\n| order by [\"High-severity threats missed / 1K users\"] asc\r\n",
+                                    "size": 0,
+                                    "timeContext": {
+                                      "durationMs": 86400000
+                                    },
+                                    "queryType": "advancedHunting",
+                                    "visualization": "table",
+                                    "gridSettings": {
+                                      "formatters": [
+                                        {
+                                          "columnMatch": "Email security solution",
+                                          "formatter": 1,
+                                          "formatOptions": {
+                                            "customColumnWidthSetting": "40%"
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "High-severity threats missed / 1K users",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "min": 0,
+                                            "max": 2107,
+                                            "customColumnWidthSetting": "60%"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "useGrouping": true
+                                            }
+                                          }
+                                        }
+                                      ],
+                                      "rowLimit": 10,
+                                      "sortBy": [
+                                        {
+                                          "itemKey": "High-severity threats missed / 1K users",
+                                          "sortOrder": 1
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "name": "query - 11",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "e54fd5bd-17e2-40dc-897d-8a3bb21116ff"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec SEG Performance",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "1f3a7e2b-0a1f-48ba-9da3-e7531d500938"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "id": "ab3756d3-3f60-4024-9376-0f1a7d47ac13",
+                                  "type": 1,
+                                  "name": "text - 18",
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Stay Current\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<br>\r\n\r\n- **Threat Analytics (Defender XDR)** — live, tenant-specific threat intelligence and recommended actions: <a href=\"https://learn.microsoft.com/en-us/defender-xdr/threat-analytics\" target=\"_blank\">aka.ms/threatanalytics</a>\r\n- **Microsoft Security Blog** — campaign write-ups and threat research: <a href=\"https://www.microsoft.com/en-us/security/blog/\" target=\"_blank\">microsoft.com/security/blog</a>\r\n- **Microsoft Defender for Office 365 Tech Community blog** — product updates and reporting guidance: <a href=\"https://techcommunity.microsoft.com/category/microsoft-defender-for-office-365/blog/microsoftdefenderforoffice365blog\" target=\"_blank\">Tech Community</a>\r\n- **Latest features in Microsoft Defender for Office 365** — <a href=\"https://learn.microsoft.com/en-us/defender-office-365/defender-for-office-365-whats-new\" target=\"_blank\">What's new in Microsoft Defender for Office 365</a> \r\n- **Share reporting feedback**: <a href=\"https://aka.ms/mdoreportingfeedback\" target=\"_blank\">aka.ms/mdoreportingfeedback</a>\r\n"
+                                  }
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Stay Current",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "5e22c565-cd2e-41f3-8d5a-0735af67c93f"
+                          }
+                        ],
+                        "exportParameters": true
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "1"
+                      },
+                      "name": "Detection Overview",
+                      "styleSettings": {
+                        "margin": "0",
+                        "padding": "0"
+                      },
+                      "id": "3f2cc277-9eb3-486d-a1f8-9fa5374a3d80"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Malware detection insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **malware threat** (such as viruses, spyware, or ransomware) within its **URLs** or **attachments**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "text - 13",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "81f28ffc-b69e-4960-a61c-cac17a012ed6"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of inbound email malware detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet mal = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Malware\";\r\nlet inbox = mal | where DeliveryLocation has \"Inbox\";\r\nlet malTrend = toscalar(mal | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(mal | summarize count()), Details = \"Malware Emails\", Ord = 1, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = malTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "malware kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "20c06dd3-5025-4b2b-960e-ff012f5d2343"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detection Trends, Threat Classes, and Malware Names\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend, threat classes and Malware types. \r\n<br><br>**Recommended action:** If malware volume spikes, confirm Safe Attachments (Block mode) is enabled for all users and investigate the top malware families below."
+                            },
+                            "name": "text - 14",
+                            "id": "1f09c6ec-b2de-4aa9-bd8e-81d11c92ebd4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detection Trend\r\n**This visual displays a per-{Granularity} trend of email malware detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for malware threats.**"
+                            },
+                            "name": "text - Malware Trend header",
+                            "id": "e90b714f-de84-4571-9a60-b3b2f3bd09dd"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize MalwareDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareDetections = coalesce(MalwareDetections, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "MalwareDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 0",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "350d0aa3-c093-4105-a150-c20111ac2912"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detection Trend - Advanced Threats\r\n**Not all threats are going to be easily recognisable, that's why Microsoft Defender for Office 365 has advanced threat detection methods, that use virtual sandbox environments to detonate URLs and Files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Malware detections of these advanced threats**"
+                            },
+                            "name": "text - Malware Advanced Threats header",
+                            "id": "12e07248-ada4-41d9-99cc-824eb65cff79"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod in ('File detonation','URL detonation')\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "File detonation",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "URL detonation",
+                                    "color": "orangeDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 9",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "ebcb6f29-02be-4dd0-b792-cd99285c29d4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Threat Classification\r\n**Summary of email messages detected by Microsoft Defender for Office 365 as malware, grouped by type of malware (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware).**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 15",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5638fc51-0830-4675-87d4-82f03df17bbf"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Attacked Users by Malware Threat Classification\r\n**Displays the recipient most frequently targeted for each malware type (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware) in inbound email detections.**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 15 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d2e3903b-4984-40da-a437-3d6a2b121e23"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Threat Name\r\n**Summarises email messages flagged by Microsoft Defender for Office 365, grouped by specific malware names detected in URLs or attachments.**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 15 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6c0bebcf-9838-4385-ab3a-30db6c994284"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by threat classification of the malware threat in the message.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has 'Malware' and ThreatClassification  has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count(Key) by ThreatClassification\r\n| sort by Count desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "33",
+                            "name": "query - 11",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "acb98530-8e3a-4383-b42f-8fd74b1c3fbe"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Malware detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Malware\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Count desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TopEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "statSettings": {
+                                "valueField": "RecipientEmailAddress",
+                                "valueAggregation": "None",
+                                "colorSettings": {
+                                  "type": "static",
+                                  "mode": "background",
+                                  "heatmapPalette": "greenRed",
+                                  "thresholdsGrid": []
+                                },
+                                "iconSettings": {
+                                  "thresholdsGrid": []
+                                },
+                                "tagText": "",
+                                "valueFontStyle": "auto"
+                              },
+                              "chartSettings": {
+                                "xAxis": "RecipientEmailAddress"
+                              }
+                            },
+                            "customWidth": "33",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 5 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d9b46c97-91ce-4d64-aca6-3126ac49c0ff"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.\r\nEmailEvents \r\n| where isnotempty(ThreatNames) and ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand ThreatName = split(ThreatNames, \",\") to typeof(string)\r\n| where isnotempty(ThreatName)\r\n| distinct Key, ThreatName\r\n| summarize Count = count() by ThreatName\r\n| top 15 by Count\r\n| project ['Threat Name'] = ThreatName, Count",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Count",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "xAxis": "ThreatNames",
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "33",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 3",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b9a4b34f-f54f-4d6e-bb20-81925d0f5540"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "group - 3",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "82853a93-e11f-4e4a-80f4-733850a1d3ff"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detections by Delivery Location, Detection Technology and Sender Infrastructure Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Malware. \r\n<br><br>**Recommended action:** For sender IPs or countries you do not do business with, consider connection filtering or geo-based rules; verify the detection technologies catching these are enabled."
+                            },
+                            "name": "banner - Malware Delivery Detection Sender",
+                            "id": "cba6403d-e2b1-4fe8-af52-57e5c2aa8e54"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by delivery location\r\n**Visualizes counts (per {Granularity}) of malware detections of inbound emails by delivery location: Quarantine or Failed (rejected with or without NDR)**"
+                            },
+                            "name": "text - Malware Delivery Location header",
+                            "id": "95be7f48-40eb-4154-91d8-20f7033f2ff5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware' and EmailDirection == 'Inbound'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalMalwareDetections=count(), Quarantine=countif(DeliveryLocation == 'Quarantine'), Failed=countif(DeliveryLocation == 'Failed') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalMalwareDetections=coalesce(TotalMalwareDetections,0), Quarantine=coalesce(Quarantine,0), Failed=coalesce(Failed,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalMalwareDetections",
+                                    "color": "blue"
+                                  },
+                                  {
+                                    "seriesName": "Quarantine",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "Failed",
+                                    "color": "redDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 10",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b2c19e58-2123-490b-9631-c0b238c582e6"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Malware detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+                            },
+                            "name": "text - Malware Detection Technology header",
+                            "id": "f3c2691e-4f32-4109-9524-8a11719e4425"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "66",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 8",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f00c1ce0-e55e-44c0-8bf0-4af662ccef89"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nEmailEvents \r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod)\r\n| sort by Count desc\r\n| project ['Detection Technology'] = MalwareMethod, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "34",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 2",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "590880a9-1cf7-44ae-b4de-2f65bc700b5d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Malware, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "name": "text - Malware Geo Location header",
+                            "id": "19d78b48-af58-4bee-abfe-57efb1eba125"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "title": "Malware Detections-Sender Heatmap (IPv4)",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "gridSettings": {
+                                "sortBy": [
+                                  {
+                                    "itemKey": "count_",
+                                    "sortOrder": 2
+                                  }
+                                ]
+                              },
+                              "sortBy": [
+                                {
+                                  "itemKey": "count_",
+                                  "sortOrder": 2
+                                }
+                              ],
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "locInfoColumn": "GeoInfo",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 1",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8cb46ec0-ac2a-41d1-bf8a-0b8585d1fefc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Malware Emails'] = count_\r\n| sort by ['Malware Emails'] desc\r\n\r\n\r\n",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malware Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": [],
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "locInfoColumn": "GeoInfo",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 1 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b6a0355a-2b8f-48a5-8edc-58f4f7f8180a"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "Malware-Detectiontech-Deliverylocation-SendingInfra",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "2692cb5e-825c-45c1-bd3a-096b55e8d760"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders. \r\n<br><br>**Recommended action:** Apply the Strict preset security policy to the most-attacked users and consider adding persistent malicious sender domains to the Tenant Allow/Block List."
+                            },
+                            "name": "banner - Malware Top Users Senders",
+                            "id": "bc5b37a4-71e4-4a2f-b0ba-b3dd87333391"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections top attacked users\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Malware. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Malware Top Users header",
+                            "id": "cb87a026-ad03-45cc-887e-ab460490d9a5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails with Malware detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(ThreatTypes has \"Malware\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malware Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - Malware Top Recipients",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e7ffef62-f85e-4188-8ab9-d90a5c666c30"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains with Malware Detections (Inbound)\r\n**Displays the top 10 sender domains sending inbound emails detected as Malware. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Malware Top Senders header",
+                            "id": "93390807-25b2-4bea-9648-98e821da8ec6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malware Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal",
+                                        "useGrouping": false
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "BadEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - Malware Top Sender Domains",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "eaa45734-2df2-4a5e-b35b-1295e00cb46f"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "MalwareTopAttackedUser-TopSenders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "4e0900ab-e7e4-4cf1-93a4-7e86bca20782"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Phishing Detection Insights\r\n\r\n---\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Phishing threat** within its **email content**, **URLs**, or **attachments**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "text - 24",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "fe82d665-fa9e-4fc2-9ba9-7e2eabb9a04b"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of inbound email phishing detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet ph = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Phish\";\r\nlet inbox = ph | where DeliveryLocation has \"Inbox\";\r\nlet phTrend = toscalar(ph | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(ph | summarize count()), Details = \"Phish Emails\", Ord = 1, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = phTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "phish kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "5debf0b8-4384-485b-8a7f-71ead592718a"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%;\">Phishing Detection Trend, LLM Content Analysis, Advanced Threats, and Threat Classes\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends, advanced threat detections, LLM-based content analysis, and threat classes.<br><br>**Recommended action:** Review the LLM-classified phishing themes; enable Safe Links and impersonation protection, and prioritise awareness training on the dominant lure types."
+                            },
+                            "name": "text - Phish Section1 Banner",
+                            "id": "ce5e489f-c83b-4bc8-9e63-b08dfb5ef31f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detection Trend<br>\r\n\r\n**This visual displays a per-{Granularity} trend of email Phish detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Phish threats.**"
+                            },
+                            "name": "text - Phish Trend Header",
+                            "id": "429ef4d2-61a9-40d0-940f-2212ddce22ce"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\"\r\n| summarize PhishDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, PhishDetections = coalesce(PhishDetections, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "PhishDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b0d170ec-331c-4ad0-8ce6-258704cc5345"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detection Trend - Advanced Threats<br>\r\n\r\n**Not all threats are easily recognizable, which is why Microsoft Defender for Office 365 uses advanced detection methods, including virtual sandbox environments to detonate URLs and files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Phish detections of these advanced threats.**"
+                            },
+                            "name": "text - Phish AdvThreats Header",
+                            "id": "425476e0-066a-42ee-afb9-5dabc612a3c8"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| project Timestamp, RecipientEmailAddress, NetworkMessageId, DT=parse_json(DetectionMethods)\r\n| evaluate bag_unpack(DT)\r\n| summarize [\"File detonation\"]=countif(Phish has 'File detonation' and Phish !has 'File detonation reputation'), [\"URL detonation\"]=countif(Phish has 'URL detonation' and Phish !has 'URL detonation reputation') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"File detonation\"]=coalesce([\"File detonation\"],0), [\"URL detonation\"]=coalesce([\"URL detonation\"],0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "URL detonation",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "File detonation",
+                                    "color": "redDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish AdvThreats Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6b62347a-b162-49e6-891c-07697af22dd9"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - LLM content analysis<br>\r\n\r\n**Microsoft Defender for Office 365 uses Language AI for Phish and Business Email Compromise (BEC) detection. These models are progressively learning from thousands of real-world phishing attempts and analyzing all messages classified as phish. Furthermore, it incorporates advanced Machine Learning and Natural Language Processing (NLP) techniques to read, process, and understand email content the way a human analyst might, yet in a fraction of the time and at a large scale. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-defender-for-office-365s-language-ai-for-phish-enhancing-email-securit/4410446)**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - Phish LLM Content Header",
+                            "id": "c23460b1-e025-4f6c-b2d5-3f78c0c9afc6"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - LLM Threat Classifications<br>\r\n\r\n**Microsoft Defender for Office 365 uses purpose-built Large Language Models (LLM) at scale to provide AI-powered email and collaboration security. Our solution now parses language to understand and identify attacker intent and classifies threats at machine speed – keeping malicious emails out of your inbox and giving security operations (SOC) teams a new level of insight into adversary techniques. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-ignite-redefining-email-security-with-llms-to-tackle-a-new-era-of-soci/4302421)**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - Phish LLM ThreatClass Header",
+                            "id": "1d723c26-501f-4385-9331-957ab7ae5019"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails detected as Phish by LLM content analysis detection technology in Microsoft Defender for Office 365. \r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and DetectionMethods contains \"LLM content analysis\"\r\n| summarize count()\r\n| sort by count_ desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "stat",
+                              "statSettings": {
+                                "valueAggregation": "None",
+                                "colorSettings": {
+                                  "type": "thresholds",
+                                  "mode": "foreground",
+                                  "thresholdsGrid": [
+                                    {
+                                      "operator": ">",
+                                      "thresholdValue": "0",
+                                      "representation": "red"
+                                    },
+                                    {
+                                      "operator": "<=",
+                                      "thresholdValue": "0",
+                                      "representation": "red"
+                                    }
+                                  ]
+                                },
+                                "iconSettings": {
+                                  "thresholdsGrid": []
+                                },
+                                "tagText": "",
+                                "valueFontStyle": "auto",
+                                "tagTextPosition": "bottom"
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish LLM Content Count",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "86a301c5-2bc0-436a-982c-861beee7c9ab"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by intent of the message.\r\n// Microsoft Defender for Office 365 LLM analysis is analyzing email messages to understand the intent of the messages. These threat classifications are then used in filtering decisions.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and ThreatClassification  has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize count() by ThreatClassification\r\n| sort by count_ desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish LLM ThreatClass Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d547b730-f174-4f78-8998-02f24453304e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Attacked Users by LLM Threat classes (Phish)<br>\r\n\r\n**Displays recipients most frequently targeted by inbound phishing emails, grouped by threat classification (e.g., Gift Card, Invoice, Payroll). Helps identify users at higher risk for phishing attacks. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish LLM TopUsers Header",
+                            "id": "4ba9d9eb-d88d-4e5d-ba58-a740559677f7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Phish detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Emails desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "80px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish LLM TopUsers",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "51599ab2-db69-4195-b4e9-2828729ec35b"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "group - 5",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "25c47f6a-3525-435e-90cf-357f02fb2fed"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections by Delivery location, Detection technology and Sender infrastructure insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Phish detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Phish.<br><br>**Recommended action:** Verify anti-phishing and Safe Links policies cover these delivery paths; consider blocking sender infrastructure from regions you do not operate in, where appropriate."
+                            },
+                            "name": "text - Phish Section2 Banner",
+                            "id": "6876063e-6a4f-48ea-829d-4486922783dd"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections by delivery location<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various delivery locations: Quarantine, Junk folder or Failed (rejected with or without NDR)**"
+                            },
+                            "name": "text - Phish DeliveryLoc Header",
+                            "id": "b5045aab-1b4b-4d35-af41-a6315d36e864"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.\r\n//The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\" and EmailDirection == \"Inbound\"\r\n| summarize TotalPhishDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalPhishDetections=coalesce(TotalPhishDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Quarantine",
+                                    "color": "greenDark"
+                                  },
+                                  {
+                                    "seriesName": "Failed",
+                                    "color": "green"
+                                  },
+                                  {
+                                    "seriesName": "Dropped",
+                                    "color": "green"
+                                  },
+                                  {
+                                    "seriesName": "Junk folder",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "Inbox",
+                                    "color": "redBright"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish DeliveryLoc Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e839848c-d176-4251-bbb4-1c2e1103ed2d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish detections by Detection Technology<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+                            },
+                            "name": "text - Phish DetTech Header",
+                            "id": "149bf1b3-80cc-4e82-ae5d-ddee0f6b0cd9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls in Microsoft Defender for Office 365.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "createOtherGroup": 15
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish DetTech Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b0b16329-e1a6-4138-871e-76d57a60b978"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarized by individual Phish detection technology/control in Microsoft Defender for Office 365.\r\n//Each detection technology is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\n//The where clause excludes deliveries to the SecOps Mailbox and by the Phish Simulation system.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish DetTech Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5270ba04-599f-4940-805b-687f7475bc70"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections by SenderIPv4 Geo Location<br>\r\n\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "name": "text - Phish Geo Header",
+                            "id": "ddd0c12f-1bb1-4d7d-afb4-f28bcfcd7c4b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address (SenderIPv4).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish Geo Map",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "85ea7223-7d77-43f5-b0d9-e0de7c898758"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Phish' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Phish Emails'] = count_\r\n| sort by ['Phish Emails'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Phish Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish Country Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f561209b-15a6-442e-af10-63e375088209"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "group - 25- Phish delivery locations-detecion tech-sender infra",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "10f3e3eb-b330-4955-952e-01eff69405e9"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Enroll the most-targeted users in security awareness training and consider blocking persistent phishing sender domains."
+                            },
+                            "name": "text - Phish Section3 Banner",
+                            "id": "f46ed4a8-e2b5-4ccd-ae38-efc571bfc791"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections top attacked users\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Phish. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish TopUsers Header",
+                            "id": "96d9b543-070a-42d4-bbed-3f5cf79ca7ce"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails with Phish detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),PhishEmailCount = countif(ThreatTypes has \"Phish\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount !=0\r\n| top 15 by PhishEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Phish Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish TopRecipients Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "25100115-78d3-4144-b44e-613b44f02484"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains with Phish Detections (Inbound)\r\n**Displays the top 10 sender domains sending inbound emails detected as Phish. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish TopSenders Header",
+                            "id": "e7fcb7fe-4bca-4153-a9b0-8ded135b1c64"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain), now including the Phish confidence split (High/Normal) and the aggregated phish detection methods seen per domain. Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\r\n| extend PhishMethods = parse_json(DetectionMethods).Phish\r\n| summarize TotalEmailCount = count(),\r\n            PhishEmailCount = countif(ThreatTypes has \"Phish\"),\r\n            Phish_High = countif(ThreatTypes has \"Phish\" and PhishConf == \"High\"),\r\n            Phish_Normal = countif(ThreatTypes has \"Phish\" and PhishConf == \"Normal\"),\r\n            PhishMethodSet = make_set_if(PhishMethods, ThreatTypes has \"Phish\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount != 0\r\n| top 15 by PhishEmailCount\r\n| mv-apply S = PhishMethodSet on ( mv-expand m = S to typeof(string) | summarize Methods = make_set(m) )\r\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound, ['Detection Methods'] = strcat_array(Methods, \", \")",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Phish Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish (High)",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish (Normal)",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "BadEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish TopSenders Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "717bfce8-b5d4-4900-99db-4ba0c503591d"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "group - 26-PhishDetectionsTopattackedusers-topsenders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "553afca2-caa1-45b1-bec0-dca426b5be46"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Spam Detection Insights\r\n\r\n---\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Spam threat** within its **email content**, **URLs**, or **attachments**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "text - Spam Tab Intro",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "a693a05a-a772-4ac4-9863-07ad0d1b7092"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of inbound email spam detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet sp = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Spam\";\r\nlet junk = sp | where DeliveryLocation has \"Junk\";\r\nlet spTrend = toscalar(sp | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet junkTrend = toscalar(junk | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(sp | summarize count()), Details = \"Spam Emails\", Ord = 1, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = spTrend),\r\n(print Count = toscalar(junk | summarize count()), Details = \"Sent to Junk\", Ord = 4, Trend = junkTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "spam kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "cadd5331-1db8-4ac8-bc99-42cd5227ee51"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detection Effectiveness and Trends\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Effectiveness and per-{Granularity} trend. For effectiveness, we consider messages reported by your admins and decisions made post-delivery.<br><br>**Recommended action:** If legitimate mail is marked as spam, review the Spam and Bulk thresholds; if spam is leaking through, tighten them."
+                            },
+                            "name": "text - Spam Section1 Banner",
+                            "id": "1093f3b6-cea7-4f54-9029-f9aadd79ca9f"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query calculates the effectiveness of spam detections without edge data.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n            EmailEvents\r\n            | where Timestamp between (minTime ..maxTime )\r\n            | where ThreatTypes contains \"Spam\"\r\n            | project NetworkMessageId, ThreatTypes)\r\n            on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint\r\nEffectiveness_PostDelivery = abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))/(toreal(toscalar(_Spam_Mailflow))+toreal(toscalar(_FN_ZAP_Successful_Spam))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))+toreal(toscalar(_FN_Admin_Submissions_SPM))-toreal(toscalar(_SPAM_ZAP_FP)))*100-100),2))",
+                                    "size": 1,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "stat",
+                                    "statSettings": {
+                                      "valueAggregation": "None",
+                                      "colorSettings": {
+                                        "type": "thresholds",
+                                        "mode": "foreground",
+                                        "heatmapPalette": "greenRed",
+                                        "thresholdsGrid": [
+                                          {
+                                            "operator": ">",
+                                            "thresholdValue": "95",
+                                            "representation": "green"
+                                          },
+                                          {
+                                            "operator": "<=",
+                                            "thresholdValue": "95",
+                                            "representation": "orange"
+                                          },
+                                          {
+                                            "operator": "<=",
+                                            "thresholdValue": "90",
+                                            "representation": "red"
+                                          }
+                                        ]
+                                      },
+                                      "iconSettings": {
+                                        "thresholdsGrid": []
+                                      },
+                                      "numberFormatSettings": {
+                                        "unit": 1,
+                                        "options": {
+                                          "style": "decimal"
+                                        }
+                                      },
+                                      "tagText": "Spam Effectiveness (without Edge data)",
+                                      "valueFontStyle": "superLarge",
+                                      "tagTextPosition": "bottom"
+                                    }
+                                  },
+                                  "customWidth": "50",
+                                  "name": "query - Spam Effectiveness Stat",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "036851c1-489e-4fda-8059-850c161578b3"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "let minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n            EmailEvents\r\n            | where Timestamp between (minTime ..maxTime )\r\n            | where ThreatTypes contains \"Spam\"\r\n            | project NetworkMessageId, ThreatTypes)\r\n            on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint StatisticName=\"Spam Mailflow Minus FPs\", Value=toreal((toscalar(_Spam_Mailflow)) - toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Admin FNs Submitted\", Value=toreal(toscalar(_FN_Admin_Submissions_SPM)))\r\n| union (print StatisticName=\"Spam FPs Reverse Zapped\", Value=toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Zapped Successfully\", Value=toreal(toscalar(_FN_ZAP_Successful_Spam)))\r\n| union (print StatisticName=\"Spam NotZapped\", Value=toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))\r\n| union (print StatisticName=\"Spam Effectiveness Post Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2)))\r\n| union (print StatisticName=\"Spam Effectiveness Pre-Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + (toscalar(_FN_ZAP_Successful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2 )))\r\n| project ['Statistic'] = StatisticName, Value",
+                                    "size": 0,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "table",
+                                    "tileSettings": {
+                                      "showBorder": false,
+                                      "titleContent": {
+                                        "columnMatch": "StatisticName",
+                                        "formatter": 1
+                                      },
+                                      "leftContent": {
+                                        "columnMatch": "Value",
+                                        "formatter": 12,
+                                        "formatOptions": {
+                                          "palette": "auto"
+                                        },
+                                        "numberFormat": {
+                                          "unit": 17,
+                                          "options": {
+                                            "maximumSignificantDigits": 3,
+                                            "maximumFractionDigits": 2
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "gridSettings": {
+                                      "formatters": [
+                                        {
+                                          "columnMatch": "Value",
+                                          "formatter": 0,
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 2
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "customWidth": "50",
+                                  "name": "query - Spam Effectiveness Table",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "8d456ea2-f04a-4d71-95c6-fbaad8c2d2f2"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "Spam Effectiveness",
+                            "id": "82812b88-e7f7-4be0-9d13-8e7a7d8c0c4e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detection Trend<br>\r\n\r\n**This visual displays a per-{Granularity} trend of email Spam detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Spam threats.**"
+                            },
+                            "name": "text - Spam Trend Header",
+                            "id": "b5574a88-430b-4cca-a76e-9a0b07e9da2e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpamDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "SpamDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "09b7d330-1683-45c4-ac0e-8141580d13b5"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "group - 6-Spam-detections-trend",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "25273f47-8201-4565-8815-1d059ee8abb6"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detections by Delivery location, Detection technology, Sender infrastructure and Bulk insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Spam detections delivery locations, detection technologies used for detections, sender infrastructure and Bulk insights in inbound email identified by Microsoft Defender for Office 365 as Spam.<br><br>**Recommended action:** Raise the Bulk Complaint Level (BCL) threshold for noisy sender domains and consider blocking high-volume, low-value bulk senders where appropriate."
+                            },
+                            "name": "text - Spam Section2 Banner",
+                            "id": "b82f442b-a3a0-44f7-82df-2fd4a9594992"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections by delivery location<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various delivery locations Quarantine, Junk folder or Failed (rejected with or without NDR)**"
+                            },
+                            "name": "text - Spam DeliveryLoc Header",
+                            "id": "a6326d97-56cc-45fb-8019-e0c3346968f2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\" and EmailDirection == \"Inbound\"\r\n| summarize TotalSpamDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalSpamDetections=coalesce(TotalSpamDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalSpamDetections",
+                                    "color": "blue"
+                                  },
+                                  {
+                                    "seriesName": "Quarantine",
+                                    "color": "greenDark"
+                                  },
+                                  {
+                                    "seriesName": "Junkfolder",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "Inbox",
+                                    "color": "redBright"
+                                  },
+                                  {
+                                    "seriesName": "Failed",
+                                    "color": "red"
+                                  },
+                                  {
+                                    "seriesName": "Dropped",
+                                    "color": "redDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam DeliveryLoc Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "97f89032-34e3-40ff-bb88-42d195aea095"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections Detection Technology<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+                            },
+                            "name": "text - Spam DetTech Header",
+                            "id": "935ea90d-8430-49d5-b942-3a7b319a603e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where DetectionMethods has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam DetTech Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f31ec0d1-04e1-4b2b-9b98-27289ca34b84"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections summarized by individual Spam detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Spam (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\"\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam DetTech Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "95e40479-f0bc-41ff-8191-634b606d3632"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections by SenderIPv4 Geo Location<br>\r\n\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Spam, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "name": "text - Spam Geo Header",
+                            "id": "614d1c3f-df6a-4659-b170-7b466c66d66f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\" and isnotempty(SenderIPv4)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "locInfoColumn": "SenderIPv4",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Spam Geo Map",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5519d715-dc79-45f8-8ed5-a63a253c45e3"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Spam' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spam Emails'] = count_\r\n| sort by ['Spam Emails'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spam Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "locInfoColumn": "SenderIPv4",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Spam Country Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5078dc24-e8be-4943-98fc-6527968e1e3d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections Bulk Insights<br>\r\n\r\n**Displays the distribution of inbound emails across different Bulk Complaint Levels together with Top 10 domains sending Bulk email (grey mail). Helps identify patterns in bulk email complaints and assess potential spam or unwanted message trends.**"
+                            },
+                            "name": "text - Spam Bulk Header",
+                            "id": "cd7b3cbe-a6c1-422c-ab37-4afc26002d5d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel\r\n| sort by BulkComplaintLevel desc\r\n| project ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blueDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Spam Bulk By Level",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "021c022b-aa67-427d-9e1a-688af7aed5d4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel, SenderFromDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain'] = SenderFromDomain, ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Spam Bulk By Domain",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b1835e0f-f9ad-44c3-bba4-cf9a9546d09a"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "group - 28-Spam-Delivery location-Detection technology-Sender infrastructure insights",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "307d3d03-93ae-4c8f-b68b-f833ee7d38e8"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "\r\n<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Review the most-affected users and the top spam sender domains as possible block-list candidates."
+                            },
+                            "name": "text - Spam Section3 Banner",
+                            "id": "4c34ed7b-86da-4ee1-8a69-f96c213a4340"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections top attacked users<br>\r\n\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Spam TopUsers Header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "be708ad5-51fd-4a54-b1bc-f912e12b4a01"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection ==\"Inbound\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),SpamEmailCount = countif(ThreatTypes has \"Spam\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount)* 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spam Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal",
+                                        "useGrouping": false
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam TopRecipients Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6e7b357d-6792-41c5-83fc-efae31afe2ee"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains with Spam Detections (Inbound)<br>\r\n\r\n**Displays the top 10 sender domains sending inbound emails detected as Spam. Helps identify external sources most frequently associated with spam content for prioritised monitoring and mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Spam TopSenders Header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1d1bdb8d-9619-488b-935a-3791ad73f096"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(),\r\n            SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spam Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam TopSenders Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "253efada-ca89-49c5-b1e3-e42ac005b938"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "group - 29-Spam Detections Top attacked users and top senders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "d4cc057f-c9b7-40b9-85d3-52f90767d1f5"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Email Impersonation &amp; BEC Insights\r\n\r\n---\r\nThis tab focuses on the highest-value email threat class: **impersonation and Business Email Compromise (BEC)**. It brings together impersonation and spoof detections, sender authentication (DMARC, DKIM, SPF, CompAuth), supply-chain and partner-compromise correlation, and first-contact / new-vendor senders - the signals that precede targeted financial and credential attacks. It is the email-side companion to the impersonation insights on the **Teams &amp; Collaboration** tab."
+                      },
+                      "name": "text - impersonation bec description",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "id": "fda8ccd5-fafc-457a-a6a2-05b504be1023"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of inbound email impersonation and spoof (BEC) detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet bec = EmailEvents | where EmailDirection == \"Inbound\" | where DetectionMethods has \"Impersonation\" or DetectionMethods has \"Spoof\";\r\nlet inbox = bec | where DeliveryLocation has \"Inbox\";\r\nlet becTrend = toscalar(bec | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(bec | summarize count()), Details = \"Impersonation / Spoof Emails\", Ord = 1, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(SenderFromDomain)), Details = \"Spoofed Sender Domains\", Ord = 3, Trend = becTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "name": "bec kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "91fdd28f-31c4-4f94-b60a-12cd97d44ddf"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Business Email Compromise (BEC) detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Business Email Compromise (BEC) detections Impersonation and Spoof.<br><br>**Recommended action:** Enable mailbox intelligence and impersonation protection for frequently-impersonated users and domains; consider adding confirmed look-alike domains to the Tenant Block List."
+                            },
+                            "name": "text - Phish BEC Banner",
+                            "id": "e3b2232c-8056-4913-a652-64f70e228750"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Impersonation detections Trend\r\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Impersonation detection methods by Microsoft Defender for Office 365. Helps track impersonation attack patterns over time.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Imp Trend Header",
+                            "id": "e95667df-3bcd-4023-9e8f-99ed05bc4bf0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Impersonation'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ImpersonationDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "ImpersonationDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Imp Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "61fa166d-f300-42a6-a324-de18b3fdf4c1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Impersonation detections by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Impersonations.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Imp Tech Header",
+                            "id": "09e1a866-f344-4a92-a3bd-8c3c3c5d598d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Imp Tech Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6cd5662f-13b4-4a9b-afe7-0a6343e3ab5c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Impersonation detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "graphSettings": {
+                                "type": 0
+                              },
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Imp Tech Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "73499618-e842-440e-a555-cd8849093884"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Impersonation detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Impersonation, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Imp Geo Header",
+                            "id": "189a1ac1-f275-4697-880b-7ffae1e5d263"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish BEC Imp Geo Map",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "574b61ad-ec2d-4517-93c5-d0e9bd14f2e9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Impersonation Emails'] = count_\r\n| sort by ['Impersonation Emails'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "title": "Impersonation Detections-Sender Heatmap (IPv4)",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Impersonation Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish BEC Imp Country",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e53b7dbc-4683-4309-b879-c7be68599159"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Spoof detections Trend\r\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Spoof detection methods by Microsoft Defender for Office 365. Helps track Spoofing based attack patterns over time.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Spoof Trend Header",
+                            "id": "8db0f1b0-49bf-43a2-9f9f-164eb9530629"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Spoof'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpoofDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "SpoofDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Spoof Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9a308cd9-bf05-4287-b0d5-54636d081a82"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Spoof detections Trend by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Spoofing.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Spoof Tech Header",
+                            "id": "28c9c15d-d22f-4412-9efc-868b95082668"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily by various Spoof Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "yAxis": [
+                                  "Count"
+                                ],
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "[[\"Spoof external domain\"]",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "[[\"Spoof intra-org\"]",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "[[\"Spoof DMARC\"]",
+                                    "color": "yellowDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Spoof Tech Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1a1328fc-5404-4dff-99ed-3a30082a4cbe"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Spoof detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Spoof Tech Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "f7df9892-85b4-49c3-8739-873b745183a3"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Spoof detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Spoofing, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Spoof Geo Header",
+                            "id": "3c83e7f0-5391-4b1a-bb5b-de0d17488efd"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish BEC Spoof Geo Map",
+                            "styleSettings": {
+                              "margin": "15px",
+                              "padding": "15px"
+                            },
+                            "id": "122d860c-ab0d-475e-b29e-2955020680c7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spoof Emails'] = count_\r\n| sort by ['Spoof Emails'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spoof Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish BEC Spoof Country",
+                            "styleSettings": {
+                              "margin": "15px",
+                              "padding": "15px"
+                            },
+                            "id": "9d0111bc-8d01-4a99-9009-645dc02c3bed"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Supply-Chain &amp; Partner Risk (Possible Partner Compromise)\r\n**Correlates the external domains your organization emails most with inbound emails from those same domains that carried threats. A trusted partner or supplier domain suddenly sending threats is a strong signal that the partner may be compromised - a common supply-chain and business email compromise (BEC) vector.**<br><br>**Recommended action:** Verify any flagged partner through a trusted channel before acting on their recent messages, alert them to a possible compromise, and consider tightening inbound policy for that domain until confirmed clean."
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish Partner Compromise Header",
+                            "id": "2c62c576-3b05-4663-ae2e-4f961d7409c6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) \r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Outbound\"\r\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| summarize count() by RecipientDomain\r\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\r\n| join (EmailEvents | where EmailDirection == \"Inbound\" and isempty(ThreatTypes)==false) on SenderFromDomain\r\n| summarize max(OutboundCount),count() by SenderFromDomain\r\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\r\n| extend Bad_Traffic_Percentage = todouble(round(IncomingEmailsWithThreats / todouble(OutboundEmails) * 100, 2))\r\n| top 15 by OutboundEmails\r\n| project ['Sender Domain'] = SenderFromDomain, ['Outbound Emails'] = OutboundEmails, ['Inbound w/ Threats'] = IncomingEmailsWithThreats, ['Bad Traffic %'] = Bad_Traffic_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Outbound Emails",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Inbound w/ Threats",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "60ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish Partner Compromise",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1aaa047c-1108-4288-833e-61ca35b5495a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Recipients Targeted by Impersonation / BEC\r\n**Lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, showing the number of impersonation emails, how many distinct senders were involved, the top spoofed sender domains, and how many of those messages were delivered to the inbox. Helps identify high-risk users (often executives or finance staff) who may need extra protection or awareness.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - impersonation targets",
+                            "id": "b1e7c2a4-9f3d-4a6b-8c12-7d5e9f0a1b23"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top recipients targeted by impersonation / BEC, with distinct senders, spoofed domains and how many landed in the inbox.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| where DetectionMethods has \"Impersonation\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize ImpersonationEmails = count(),\r\n            DistinctSenders      = dcount(SenderFromAddress),\r\n            TopSpoofedDomains    = make_set(SenderFromDomain, 5),\r\n            DeliveredToInbox     = countif(DeliveryLocation has \"Inbox\")\r\n        by RecipientEmailAddress\r\n| top 20 by ImpersonationEmails\r\n| project ['Recipient'] = RecipientEmailAddress, ['Impersonation Emails'] = ImpersonationEmails, ['Distinct Senders'] = DistinctSenders, ['Top Spoofed Domains'] = strcat_array(TopSpoofedDomains, \", \"), ['Delivered to Inbox'] = DeliveredToInbox",
+                              "size": 0,
+                              "title": "Top Recipients Targeted by Impersonation / BEC",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "showAnalytics": true,
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Impersonation Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "15"
+                            },
+                            "name": "newviz - impersonation targets",
+                            "id": "afe28369-af82-47ae-846d-179bd86b660e"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "name": "group - 7 - Phish-BEC-Insights",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "b7971cd9-d086-47c7-8f66-50956b9c56c3"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Sender Authentication details (DMARC, DKIM, SPF, CompAuth)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Sender Authentication checks details in inbound email by Microsoft Defender for Office 365 focusing on the various Sender Authentication standards: DMARC, DKIM, SPF, CompAuth.<br><br>**Recommended action:** For domains failing DMARC/DKIM/SPF, verify your own outbound authentication is published and enforced (p=reject), and treat persistent external spoofers as possible block candidates."
+                            },
+                            "name": "text - Phish Section5 Banner",
+                            "id": "90d7a338-d943-4398-b788-bfd4f93007d4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections Sender Authentication Trend (DMARC, DKIM, SPF, CompAuth)\r\n**Shows counts (per {Granularity}) of sender authentication check outcomes (DMARC, DKIM, SPF, CompAuth) performed by Microsoft Defender for Office 365 on inbound emails. Useful for monitoring authentication success and failure patterns over time to identify anomalies or potential phishing risks.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish SenderAuth Trend Header",
+                            "id": "4a0ab90e-55dd-4fa6-82c3-0edc57ce0966"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof- DMARC fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DMARCFail = (tostring(parse_json(AuthenticationDetails).DMARC) == \"fail\") \r\n| summarize DMARCFail = sum(DMARCFail) by bin (Timestamp,{Granularity})",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "DMARCFail",
+                                    "color": "orangeDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish Auth DMARC Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "79920d30-01d4-4412-b994-853e50c9d7d8"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof- DKIM fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DKIMFail = (tostring(parse_json(AuthenticationDetails).DKIM) == \"fail\") \r\n| summarize DKIMFail = sum(DKIMFail) by bin (Timestamp,{Granularity})",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "DKIMFail",
+                                    "color": "yellowDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish Auth DKIM Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "bf09ffd4-eee0-42f7-a507-1cf54d9c365a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof- SPF fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend SPFFail = (tostring(parse_json(AuthenticationDetails).SPF) == \"fail\") \r\n| summarize SPFFail = sum(SPFFail) by bin (Timestamp,{Granularity})",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "SPFFail",
+                                    "color": "purpleDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish Auth SPF Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "4d66fe13-9904-45cf-8783-f3ee984f3a66"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof- Composite Authentication fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend CompAuthFail = (tostring(parse_json(AuthenticationDetails).CompAuth) == \"fail\") \r\n| summarize CompAuthFail = sum(CompAuthFail) by bin (Timestamp,{Granularity})",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "CompAuthFail",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish Auth CompAuth Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "0968b828-23fe-4fa2-a5ea-8ab39362457f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections Top Sender Domains with DMARC Failures (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails where Spoof-DMARC detection triggered. Includes total inbound email volume and calculates DMARC fail traffic percentage per domain to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish Auth DMARC Domains Header",
+                            "id": "24d4689a-eb6d-49f5-85a8-fcadca409f7a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and DMARC fail traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof DMARC\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where DMARCFailCount !=0\r\n| top 10 by DMARCFailCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['DMARC Failures'] = DMARCFailCount, ['Total Inbound'] = TotalEmailCount, ['DMARC Fail %'] = DMARCFail_Traffic_Percentage",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "DMARCFail",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "DMARC Fail %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish Auth DMARC Domains",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "642814ad-9d24-4be9-ae10-3578e89da05b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections Top Sender Domains with Spoof External Domain Detections (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof External Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish Auth SpoofExt Domains Header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "993fdc34-354b-412e-be39-facbde4f4f0e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof external domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof external domain\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofExternalCount !=0\r\n| top 10 by SpoofExternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof External'] = SpoofExternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof External %'] = SpoofExternal_Traffic_Percentage",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spoof External",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spoof External %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "SpoofExternalFail",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true,
+                                "sortBy": [
+                                  {
+                                    "itemKey": "Spoof External %",
+                                    "sortOrder": 2
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish Auth SpoofExt Domains",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "69ca3799-d2d5-4896-b3a5-1eeba46f0b46"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections Top Sender Domains with Spoof Internal Domain Detections (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof Internal Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish Auth SpoofInt Domains Header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3fa33c5d-0eba-471f-b47f-0c12c1f770d6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof intra-org\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofInternalCount !=0\r\n| top 10 by SpoofInternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof Internal'] = SpoofInternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof Internal %'] = SpoofInternal_Traffic_Percentage",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "title": "Top 10 Spoof intra-org detections by Sender domain (P1/P2)",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spoof Internal",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spoof Internal %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "SpoofIntraorgFail",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish Auth SpoofInt Domains",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "ae0c65c7-68ea-4d50-b177-1effeaf1c045"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "name": "group - 8-Phish-SenderAuth",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "8077779a-4da8-46be-8032-626bd8c36dbd"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">First-Contact &amp; New-Vendor Senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nExternal email senders and domains seen for the first time in the selected period. New/first-contact relationships - especially ones already carrying threats - are a common precursor to phishing, business email compromise (BEC), and supply-chain attacks.<br><br>**Recommended action:** Treat brand-new domains sending threats as high-priority review; verify any that claim to be a known brand or partner before trusting their messages."
+                            },
+                            "name": "phish fc banner",
+                            "id": "05b83435-c7ed-48a3-919e-388b2e599726"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### First-contact external senders<br>\r\n\r\n**External email senders ordered by when they were first seen in the period (most recent first). In tenants with longer history this highlights genuinely new senders.**"
+                            },
+                            "customWidth": "100",
+                            "name": "phish fc senders header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "c57dffb4-dfdb-4a1e-93be-16fa9e856a0d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists external email senders seen for the first time in the selected period (most recent first), surfacing new/first-contact senders. In tenants with longer history this highlights genuinely new relationships - a common precursor to BEC and supply-chain attacks.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderFromAddress)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), Messages=count(), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\r\n| top 20 by FirstSeen desc\r\n| project ['Sender']=SenderFromAddress, ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, ['Threat Messages']=ThreatMessages",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "phish fc senders table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d1ceb0ac-2dad-49af-b416-a3376a7b8513"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### New sender domains carrying threats<br>\r\n\r\n**External sender domains seen for the first time in the period that already carried threats, most-recent first. A brand-new domain sending threats to your users is a strong early-warning signal.**"
+                            },
+                            "customWidth": "100",
+                            "name": "phish fc domains header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "bd29bbe4-cde2-499c-a1d0-e2cc51f7733d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists external sender domains seen for the first time in the selected period that already carried threats, ranked by most-recently first seen. A brand-new domain sending threats to your users is a strong early-warning signal for phishing and BEC.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Messages=count(), Senders=dcount(SenderFromAddress), Recipients=dcount(RecipientEmailAddress), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderDomain\r\n| where ThreatMessages > 0\r\n| top 20 by FirstSeen desc\r\n| project ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, Senders, Recipients, ['Threat Messages']=ThreatMessages, ['Last Seen']=LastSeen",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Senders",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Recipients",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "phish fc domains table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7da952d5-5ae2-4b2e-a5cf-c78b11bda4f8"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "customWidth": "100",
+                      "name": "group - Phish First Contact",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "90e5248a-2c35-48f3-869c-c45c631c6fbf"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# URL Detections and URL Click Insights\r\n\r\n---\r\nThis tab provides insights into **URL-based detections** in email messages and details about URL clicks performed by end users on URLs identified as **malicious**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "text - 24 - Copy - Copy",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "2156430d-fec6-48bb-a9a8-3166182f6993"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of URL threat protection (Safe Links clicks and URLs seen in email) for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet clicks = UrlClickEvents;\r\nlet blocked = clicks | where ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\");\r\nlet allowed = clicks | where ActionType == \"ClickAllowed\";\r\nlet blockedTrend = toscalar(blocked | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet allowedTrend = toscalar(allowed | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet usersTrend = toscalar(clicks | make-series Trend = dcount(AccountUpn) default = 0 on Timestamp step gran | project Trend);\r\nlet urlsTrend = toscalar(EmailUrlInfo | make-series Trend = dcount(Url) default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(blocked | summarize count()), Details = \"Malicious Clicks Blocked\", Ord = 1, Trend = blockedTrend),\r\n(print Count = toscalar(allowed | summarize count()), Details = \"Clicks Allowed Through\", Ord = 2, Trend = allowedTrend),\r\n(print Count = toscalar(clicks | summarize dcount(AccountUpn)), Details = \"Users Clicking Links\", Ord = 3, Trend = usersTrend),\r\n(print Count = toscalar(EmailUrlInfo | summarize dcount(Url)), Details = \"Distinct URLs in Email\", Ord = 4, Trend = urlsTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "url kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "d5e2326a-a5dd-4217-bb75-0e337d75d306"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Insights on URL-Based Threat Detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain URL based threat detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends of URL-based threat detections, QR code detections, and URL scans activity by locations.<br><br>**Recommended action:** Confirm Safe Links is enabled for email and Teams; investigate QR-code and URL detection spikes for emerging campaigns."
+                            },
+                            "name": "text - 13 - Copy",
+                            "id": "ed3468e7-1936-45fd-9168-93010a662302"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend of URL-Based Malware Threat Detections<br>\r\n\r\n**This visual displays a per-{Granularity} trend of emails with URL based Malware threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for malware threats.**"
+                            },
+                            "name": "text - 13 - Copy - Copy",
+                            "id": "77e7bbac-d752-478b-bce9-06bb1bd12bfe"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod contains \"URL\"\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "query - 8 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "79ef5e7b-57a6-4519-9899-18fd8cae5e68"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend of URL-Based Phish Threat Detections<br>\r\n\r\n**This visual displays a per-{Granularity} trend of emails with URL based Phish threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for Phish threats.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy",
+                            "id": "48923812-5440-4f47-8881-273f14cbfb8e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phishing detections over time summarizing the data daily by various Phishing URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Phish'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand PhishMethod = ParsedMethods.Phish\r\n| where PhishMethod contains \"URL\"\r\n| summarize Count = count() by PhishMethod = tostring(PhishMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct PhishMethod | extend d = 1) on d | project Timestamp, PhishMethod\r\n| join kind=leftouter (agg) on Timestamp, PhishMethod\r\n| project Timestamp, PhishMethod, Count = coalesce(Count, 0)\r\n| sort by PhishMethod asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "query - 8 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b983b361-6c2e-47d5-b2c5-edd9caa6a55d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend (per {Granularity}) of QR Code-Based Threat Detections<br>\r\n\r\n**Displays counts (per {Granularity}) of inbound emails containing QR codes flagged for Phish, Malware, or Spam via URL-based detection methods. Helps track QR code abuse patterns over time.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3d8b75e1-6e1d-44eb-b1fc-78d3db7feb71"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### URL Scan activity by Location (per {Granularity})<br>\r\n\r\n**Displays counts (per {Granularity}) of URLs scanned from various locations within emails (e.g., body, attachments, QR codes). Helps identify where malicious URLs are most commonly embedded.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b275b28c-e441-4c19-9055-256d5d45c69c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\" \r\n| where DetectionMethods has \"Url\"\r\n| join EmailUrlInfo on NetworkMessageId\r\n| where UrlLocation == \"QRCode\"\r\n| summarize [\"Phish QR Detection\"]=countif(parse_json(DetectionMethods).Phish has \"URL\"), [\"Malware QR Detection\"]=countif(parse_json(DetectionMethods).Malware has \"URL\"), [\"Spam QR Detection\"]=countif(parse_json(DetectionMethods).Spam has \"URL\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Phish QR Detection\"]=coalesce([\"Phish QR Detection\"],0), [\"Malware QR Detection\"]=coalesce([\"Malware QR Detection\"],0), [\"Spam QR Detection\"]=coalesce([\"Spam QR Detection\"],0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "graphSettings": {
+                                "type": 0
+                              },
+                              "chartSettings": {
+                                "xAxis": "Timestamp",
+                                "xSettings": {
+                                  "dateFormatSettings": {
+                                    "formatName": "shortDatePattern",
+                                    "showUtcTime": false
+                                  }
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 6",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6c2a7724-d3c2-42b2-b8da-7acbcd0666c6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises where URL's have been scanned identified from various locations in emails\r\nEmailUrlInfo\r\n| summarize  count() by UrlLocation",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 5",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5640dbd5-4085-4f2a-8fb9-e4112233e99e"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "group - 9-URL detections",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "b572d79b-17a0-48ac-9a43-4f20324cf998"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Insights on URL Click-Based Threat Detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain URL click based threat detections in emails as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend of blocked URL clicks, time-of-click URL scans by workload, malicious clicks allowed, top clicks on malicious URLs, and more.<br><br>**Recommended action:** For blocked-click spikes, verify Safe Links is set to not allow click-through; investigate workloads with high click-through activity."
+                            },
+                            "name": "text - 13 - Copy - Copy",
+                            "id": "6d37617e-911e-4ce6-a10d-4749486738ea"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend (per {Granularity}) of Blocked URL Click Events<br>\r\n\r\n**Shows the count (per {Granularity}) of blocked URL click attempts and click attempts on URLs with detections, grouped by threat types (e.g., Phish, Malware, Spam). Helps track user interaction with malicious links over time across various threat types.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy",
+                            "id": "9e477950-bedc-4cc0-9863-df07d124806c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// Generates a time-series analysis for blocked URL click events from the 'UrlClickEvents' table\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| where ActionType has_any(\"ClickBlocked\")\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, BlockedClicks = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "BlockedClicks",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "query - 4",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "366e80d9-f6ed-43af-91e5-3d04cdcf692d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of click attempts on URL's with detections split by the different threat types identified\r\nUrlClickEvents\r\n| where isnotempty(ThreatTypes)\r\n| summarize count() by ThreatTypes",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "query - 4",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a356eac3-62c2-4fc9-a4d9-3b05b13848df"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend (per {Granularity}) of URL Click Actions by Type<br>\r\n\r\n**Displays counts (per {Granularity}) of URL click events categorised by action type: Blocked, Allowed, Pending Verdict, Error Page, and Clicked Through. Helps identify risky user behaviour and policy gaps.**"
+                            },
+                            "customWidth": "66",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a91fe7a6-f507-48f7-bbcc-61dc4f998ba6"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### URL Clicks by Workload<br>\r\n\r\n**Displays counts (per {Granularity}) of URL click events grouped by Workload (e.g., Outlook, Teams, Copilot, Office Apps: Word, Excel, PowerPoint) Helps identify which applications are most frequently used for URL interactions and potential risk exposure.**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "ce05fa08-6e68-4c02-a0bf-2be6cdfae935"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises different URL click event types by action (e.g., blocked, allowed, pending verdict, error pages, and clicked through), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| summarize ClickBlocked=countif(ActionType has_any(\"ClickBlocked\")), ClickAllowed=countif(ActionType has_any(\"ClickAllowed\")), PendingVerdict=countif(ActionType has_any(\"UrlScanInProgress\")), ErrorPage=countif(ActionType has_any(\"UrlErrorPage\")), ClickedThrough=countif(IsClickedThrough == true) by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickBlocked=coalesce(ClickBlocked,0), ClickAllowed=coalesce(ClickAllowed,0), PendingVerdict=coalesce(PendingVerdict,0), ErrorPage=coalesce(ErrorPage,0), ClickedThrough=coalesce(ClickedThrough,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "query - 1",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a12b4c78-7d18-4adc-86e0-54395d6a996a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises where URL clicks scanned by the Workload the click happened from\r\nUrlClickEvents\r\n| summarize  count() by Workload",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "query - 5 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3237cd55-1d5c-41a9-a8f2-1d46c61a709e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Blocked URL Clicks by Workload (per {Granularity})<br>\r\n\r\n**Displays counts (per {Granularity}) of blocked URL click attempts grouped by Workload (Email, Teams, Office, Microsoft 365 Copilot). Helps identify which platforms are most exposed to malicious link interactions and where user awareness or policy enforcement should be strengthened.**"
+                            },
+                            "customWidth": "66",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1f209a83-3d50-4bb8-9a79-a365a50a4142"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Click-Through Activity on Detected URLs by Workload<br>\r\n\r\n**Displays counts of click‑through actions on URLs already identified with detections, grouped by Workload where the click happened. Helps identify clients/platforms where users are most likely to proceed to risky URLs and prioritise awareness training or policy tuning for those workloads**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "33592db8-0ff5-4d8e-bd8f-0201b81a4584"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises blocked URL click event types by Workload (e.g., Email, Teams, Office, Microsoft 365 Copilot), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where ActionType ==\"ClickBlocked\"\r\n| summarize Teams=countif(Workload==\"Teams\"), Office=countif(Workload==\"Office\"), Email=countif(Workload==\"Email\"), Copilot=countif(Workload==\"Copilot\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Teams=coalesce(Teams,0), Office=coalesce(Office,0), Email=coalesce(Email,0), Copilot=coalesce(Copilot,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "66",
+                            "name": "query - 3",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "80241767-0f69-4e2e-9889-3bf1f48e4f02"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of click-through activities on URL's with detections split by the source client\r\nUrlClickEvents \r\n| where IsClickedThrough !=\"0\"\r\n| where isnotempty(ThreatTypes) \r\n| summarize count() by Workload",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "query - 2",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "fde29b46-2896-4bfc-bb61-09436696d738"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top clicks on Malicious URLs<br>\r\n\r\n**Displays the top 20 URLs associated with detections that registered the highest number of clicks. Includes ThreatTypes, ActionType, and Workload to provide context on the nature of the threat and where user interaction occurred.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "22bda63a-626c-47de-9a76-ad665ef87862"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows the top 20 URL's that have a detection associated with the most ammount of clicks registered \r\nUrlClickEvents\r\n| where ThreatTypes !=\"\"\r\n| summarize count() by Url, ThreatTypes, ActionType, Workload\r\n| top 20 by count_\r\n| project ['URL']=Url, ['Threat Types']=ThreatTypes, ['Action Type']=ActionType, Workload, ['Click Count']=count_",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Click Count",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 10 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a044fd4e-7be6-4a11-974c-b54e417c2a81"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "group - 31-URL clicks",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "75e543f6-08c0-42ed-9869-ecd61b721d34"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Risky Users Clicking on URLs with Threats\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and identify users who have clicked on malicious URLs detected by Microsoft Defender for Office 365.<br><br>**Recommended action:** Enroll these users in security awareness training and verify Safe Links policy coverage for their mailboxes."
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy",
+                            "id": "19487811-a94b-4537-877e-61ac7e287c21"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Users Clicking on URLs with Malware Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Malware. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "78e10621-0e98-44c4-8399-810c19f138c2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 users with click attempts on URL's with malware detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),MalwareClickCount = countif(ThreatTypes has \"Malware\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(MalwareClickCount / todouble(TotalClickCount) *100, 2))\r\n| where MalwareClickCount !=0\r\n| sort by MalwareClickCount desc\r\n| top 15 by MalwareClickCount\r\n| project ['User']=AccountUpn, ['Malware Clicks']=MalwareClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malware Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "25ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Clicks",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Click %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "25ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TotalEmailCount",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - 18 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a7ae8a75-ca7f-49be-8cad-d1451a3bd396"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Users Clicking on URLs with Phish Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Phish. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "90d9a0c3-970a-4998-be62-3b3b84bb0f37"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 users with click attempts on URL's with Phish detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),PhishClickCount = countif(ThreatTypes has \"Phish\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(PhishClickCount / todouble(TotalClickCount) *100, 2))\r\n| where PhishClickCount !=0\r\n| sort by PhishClickCount desc\r\n| top 15 by PhishClickCount\r\n| project ['User']=AccountUpn, ['Phish Clicks']=PhishClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Phish Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "25ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Clicks",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Click %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "25ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareClickCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TotalEmailCount",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - 18 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d46877d9-03af-463a-b406-bb4c601dffeb"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Users Clicking on URLs with Spam Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Spam. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "dc66e020-0932-4346-8e20-6a2dc78de7a9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 users with click attempts on URL's with Spam detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),SpamClickCount = countif(ThreatTypes has \"Spam\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(SpamClickCount / todouble(TotalClickCount) *100, 2))\r\n| where SpamClickCount !=0\r\n| sort by SpamClickCount desc\r\n| top 15 by SpamClickCount\r\n| project ['User']=AccountUpn, ['Spam Clicks']=SpamClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spam Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "25ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Clicks",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Click %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "25ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "PhishClickCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareClickCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TotalEmailCount",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - 18 - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "734ee45e-4dff-4ca1-b17d-02389086b17b"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "group - 32-Top clickers",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "ee6c3413-28be-49a1-a89d-bf5fce7acfa4"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Microsoft Teams Collaboration Protection\r\n\r\n---\r\nAs email defenses mature, attackers are shifting into **Microsoft Teams**, where messages bypass secure email gateways and carry the implicit trust of a colleague chat. Microsoft Threat Intelligence reports Teams-based phishing and voice phishing (vishing) rising steadily through 2026, most often as **IT help desk or technical-support impersonation** from external or newly-created tenants, used to steer users toward remote-access tools and credential theft.\r\n\r\nThis tab shows **Microsoft Defender for Office 365** protection for Microsoft Teams: threat detections and impersonation, suspicious external senders, malicious URLs and clicks, malicious files, post-delivery ZAP removals, and user and admin submissions across chats and channels.\r\n\r\n**Recommended action:** Treat unsolicited external help desk or IT support contact as suspicious. Restrict inbound chat from unmanaged and consumer tenants, allowlist trusted external domains, remove or restrict remote-support tools such as Quick Assist where they are not required, and enforce phishing-resistant MFA for all users (Conditional Access with authentication strength), prioritizing privileged and administrator accounts first.\r\n\r\n[<p><b>Disrupting threats targeting Microsoft Teams</b></p>](https://www.microsoft.com/en-us/security/blog/2025/10/07/disrupting-threats-targeting-microsoft-teams/)[<p><b>Cross-tenant helpdesk impersonation to data exfiltration: a human-operated intrusion playbook</b></p>](https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/)[<p><b>Help on the line: how a Microsoft Teams support call led to compromise</b></p>](https://www.microsoft.com/en-us/security/blog/2026/03/16/help-on-the-line-how-a-microsoft-teams-support-call-led-to-compromise/)[<p><b>Email threat landscape: Q2 2026 trends and insights</b></p>](https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/)"
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "text - teams description",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "5c0f0100-0a11-4b22-9c33-000000000100"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//Headline Microsoft Teams protection metrics for the selected period, with per-interval sparklines. Messages are de-duplicated to the latest record per Teams message.\r\nlet gran = {Granularity};\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(msgs | summarize Count = count() | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(msgs | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Messages with Threats\", Ord = 2, Trend = toscalar(msgs | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend Details = \"Phish Detections\", Ord = 3, Trend = toscalar(msgs | where ThreatTypes has \"Phish\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend Details = \"Malware Detections\", Ord = 4, Trend = toscalar(msgs | where ThreatTypes has \"Malware\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend Details = \"Spam Detections\", Ord = 5, Trend = toscalar(msgs | where ThreatTypes has \"Spam\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 6, Trend = toscalar(msgs | where SafetyTip == \"URLMessageWarning\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(zap | summarize Count = count() | extend Details = \"Post-Delivery ZAP Actions\", Ord = 7, Trend = toscalar(zap | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "name": "teams kpi tiles",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "b2c476ca-4141-43b4-9d4e-98470aa432fc",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
                       }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject11').analyticRuleId11,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 11",
-                "parentId": "[variables('analyticRuleObject11').analyticRuleId11]",
-                "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject11').analyticRuleVersion11]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Deimos Component Execution",
-        "contentProductId": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
-        "id": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
-        "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject12').analyticRuleTemplateSpecName12]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ImminentRansomware_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query checks for a series of commands that are commonly used by attackers to disable security tools and system recovery tools before deploying Macaw ransomware in an organization.",
-                "displayName": "Imminent Ransomware",
-                "enabled": false,
-                "query": "_ASim_ProcessEvent \n// Pivot on specific commands \n| where CommandLine has_any(\"-ExclusionPath\", \"Set-MpPreference\", \"advfirewall\", \"-ExclusionExtension\", \n\"-EnableControlledFolderAccess\", \"windefend\", \"onstart\", \"bcdedit\", \"Startup\") \n// Making list of found commands \n| summarize CommandLine = make_set(CommandLine, 10000) by DvcId, Dvc, bin(TimeGenerated, 6h) \n// Extending columns for later aggregration, based on TTP\n| extend StartUpExclusionPath = iff(CommandLine has_all(\"-ExclusionPath\", \"Startup\"), 1, 0) \n| extend DefenderTamp = iff(CommandLine has \"Set-MpPreference\" \nand CommandLine has_any( \n\"-SevereThreatDefaultAction 6\" \n\"-HighThreatDefaultAction 6\", \n\"-ModerateThreatDefaultAction 6\", \n\"-LowThreatDefaultAction 6\" \n\"-ScanScheduleDay 8\"), 1, 0) \n| extend NetshFirewallTampering = iff(CommandLine has_all( \"netsh\", \"advfirewall\", \"allprofiles state off\"), 1, 0) \n| extend BatExclusion = iff(CommandLine has_all(\"-ExclusionExtension\", \".bat\"), 1, 0) \n| extend ExeExclusion = iff(CommandLine has_all(\"-ExclusionExtension\", \".exe\"), 1, 0) \n| extend DisableControlledFolderAccess = iff(CommandLine has_all(\"-EnableControlledFolderAccess\", \"Disabled\"), 1, 0) \n| extend ScDeleteDefend = iff(CommandLine has_all(\"sc\", \"delete\", \"windefend\"), 1, 0) \n| extend BootTampering = iff(CommandLine has_all(\"bcdedit\", \"default\") and CommandLine has_any (\"recoveryenabled No\", \"bootstatuspolicy ignoreallfailures\"), 1, 0) \n| extend SchTasks = iff(CommandLine has_all(\"/sc\", \"onstart\", \"system\", \"/create\", \"/delay\"), 1, 0) \n// Summarizing found commands \n| summarize by NetshFirewallTampering ,BatExclusion, ExeExclusion, DisableControlledFolderAccess, ScDeleteDefend, SchTasks, BootTampering, DefenderTamp, StartUpExclusionPath, DvcId, Dvc, TimeGenerated \n// Adding up each piece of evidence \n| extend EvidenceCount = NetshFirewallTampering + BatExclusion + ExeExclusion + DisableControlledFolderAccess + ScDeleteDefend + SchTasks + BootTampering + DefenderTamp + StartUpExclusionPath \n| where EvidenceCount > 4\n| extend HostName = iff(Dvc has '.', substring(Dvc, 0, indexof(Dvc, '.')), Dvc)\n| extend DnsDomain = iff(Dvc has '.', substring(Dvc, indexof(Dvc, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": "[variables('TemplateEmptyArray')]",
-                "tactics": [
-                  "DefenseEvasion",
-                  "Persistence"
-                ],
-                "techniques": [
-                  "T1562",
-                  "T1547"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "Dvc"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Microsoft Teams - Collaboration Protection Overview\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 extends its protection to **Microsoft Teams**, detecting malicious messages, URLs, and files shared through chats and channels. This tab summarizes Teams message detections, link-safety warnings, post-delivery ZAP, file scanning, and user/admin submissions.<br><br>*Scope note: the Teams message tables surface metadata for external-conversation messages plus internal messages that contain URLs, so counts reflect that scope rather than the full volume of Teams messages.*"
+                            },
+                            "name": "teams overview banner",
+                            "id": "2f71360f-1673-480f-8361-5afc83aee67d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Teams threat detections over time<br>\r\n\r\n**Volume (per selected interval) of Microsoft Teams messages detected with a threat by Microsoft Defender for Office 365. Spikes may indicate a targeted Teams-based campaign.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams trend header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "0ac71d4e-8ecb-4d17-9fd3-10754007ec07"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the number of Microsoft Teams messages detected with a threat over time, de-duplicated to the latest record per message and summarized per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId | summarize ThreatDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ThreatDetections = coalesce(ThreatDetections, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp",
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "ThreatDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams detection trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "937f3bc6-21f5-4f4c-ab72-78f08f32c5bd"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Threat type breakdown<br>\r\n\r\n**Split of Microsoft Teams threat detections across Phish, Malware, and Spam.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams threat pie header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "645a39ae-843a-47db-8016-6082ef37744d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Thread exposure<br>\r\n\r\n**De-duplicated Microsoft Teams messages split by whether the conversation includes external participants.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams thread header",
+                            "id": "a1a48f9a-8593-4ab5-8824-5998c643e844"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query breaks down Microsoft Teams threat detections by threat type for the selected period, de-duplicated to the latest record per message. A message flagged for more than one threat type is counted under each, so the split can exceed the distinct message count.\r\nlet msgs = MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nunion\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend ThreatType = \"Phish\"),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend ThreatType = \"Malware\"),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend ThreatType = \"Spam\")\r\n| project ThreatType, Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "teams threat type pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "029b4ecc-cd95-4385-a251-8ab194add8f4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| extend Thread = iif(IsExternalThread == true, \"External Thread\", \"Internal Thread\")\r\n| summarize Count = count() by Thread",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "teams thread pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1581f447-9b3e-4857-84b8-e78b5df65ac5"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Overview",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "283f36b2-5c54-4afe-9a87-33d4796bd5b7"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Calls and Vishing (Voice Phishing)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Voice phishing (vishing) over Microsoft Teams is the fastest-growing collaboration threat of 2026. Attackers impersonate IT help desk or support and call users directly, often after a chat lure, to talk them into granting remote access or entering credentials. Because a target must be online to answer, malicious calls cluster in working hours. This section surfaces Teams call activity, when calls happen, and callers using support or brand-impersonation identities.**<br><br>*Interim data source: Teams call activity is currently read from Microsoft Defender for Cloud Apps call telemetry (CloudAppEvents). It will move to the dedicated CallActivityEvents table once that table is available to stream into Microsoft Sentinel.*<br><br>**Recommended action:** Treat unsolicited help desk or support calls as suspicious. Confirm any request through a known internal channel, and never grant remote access such as Quick Assist on the strength of an inbound Teams call. Restrict inbound calls and chat from unmanaged and consumer tenants."
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls banner",
+                            "id": "9815bdc9-9e10-4e84-9164-783092b4ccb0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Teams call and vishing headline metrics for the selected period, with per-interval sparklines. Interim source: Defender for Cloud Apps call telemetry (CloudAppEvents / CallParticipantDetail).\r\nlet gran = {Granularity};\r\nlet calls = materialize(CloudAppEvents | where ActionType == \"CallParticipantDetail\" | extend R = parse_json(RawEventData) | extend CallId = tostring(R.CallId), UId = tolower(tostring(R.UserId)));\r\nlet susp = calls | extend Local = tostring(split(UId, \"@\")[0]), Dom = tostring(split(UId, \"@\")[1]) | where Local matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\" or Dom endswith \".onmicrosoft.com\";\r\nlet reported = CloudAppEvents | where ActionType == \"CallReported\";\r\nunion\r\n(calls | summarize Count = dcount(CallId) | extend Details = \"Teams Calls\", Ord = 1, Trend = toscalar(calls | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(susp | summarize Count = dcount(UId) | extend Details = \"Impersonation-style Callers\", Ord = 2, Trend = toscalar(susp | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(reported | summarize Count = count() | extend Details = \"Reported Suspicious Calls\", Ord = 3, Trend = toscalar(reported | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+                              "size": 3,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Trend",
+                                  "formatter": 21
+                                },
+                                "showBorder": true,
+                                "size": "auto"
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls kpi",
+                            "id": "be8946d9-1eae-405c-b8df-cee2242cb44d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Teams call activity over time<br>\r\n**Distinct Microsoft Teams calls per selected interval. A sudden rise, or calls outside normal working hours, can indicate a vishing campaign in progress.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls trend header",
+                            "id": "1b49c98f-e5d9-457c-b058-a195e89eac0e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Distinct Teams calls per interval (interim source: CloudAppEvents / CallParticipantDetail).\r\nCloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId)\r\n| summarize ['Teams Calls'] = dcount(CallId) by Timestamp = bin(Timestamp, {Granularity})\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp",
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Teams Calls",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls trend",
+                            "id": "7538b3ca-b96d-421a-9cdc-69b8aef4b185"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### When calls happen (hour of day, UTC)<br>\r\n**Microsoft Teams calls by the hour of day they started (UTC), listed 00:00 through 23:00. The bar length is the number of calls that started in that hour across the selected period. Vishing calls cluster in working hours because the target must be online to answer, with the heaviest malicious-call activity between 14:00 and 20:00 UTC, Monday to Friday, according to Microsoft Threat Intelligence. Use this to baseline normal call timing and spot unusual off-hours spikes.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls hour header",
+                            "id": "6bc095e9-fe0d-4f6f-81bd-f3374d758229"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Teams calls by start hour of day (UTC), all 24 hours 00:00..23:00 in order (interim source: CloudAppEvents / CallParticipantDetail).\r\nlet data = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend JoinTime = todatetime(R.JoinTime), CallId = tostring(R.CallId)\r\n| where isnotempty(JoinTime) and isnotempty(CallId)\r\n| summarize CallStart = min(JoinTime) by CallId\r\n| extend HourUTC = hourofday(CallStart)\r\n| summarize Calls = count() by HourUTC;\r\nrange HourUTC from 0 to 23 step 1\r\n| join kind=leftouter (data) on HourUTC\r\n| extend Calls = coalesce(Calls, 0)\r\n| extend HourLabel = strcat(iif(HourUTC < 10, strcat(\"0\", tostring(HourUTC)), tostring(HourUTC)), \":00\")\r\n| order by HourUTC asc\r\n| project ['Hour of Day (UTC)'] = HourLabel, ['Teams Calls'] = Calls",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Teams Calls",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blueDark",
+                                      "customColumnWidthSetting": "360px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls hour",
+                            "id": "c36a9909-5570-4fe7-8efc-1b9b4745713a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Suspicious callers (support and helpdesk impersonation)<br>\r\n**Teams call participants whose display name or address looks like IT support, help desk, or a well-known brand (for example \"Microsoft IT support\", \"Help Desk\", \"Office 365 Support\"), or who dial in from a throwaway `.onmicrosoft.com` tenant. Origin shows whether the caller is external, an external throwaway tenant, or inside your own tenant. External and throwaway-tenant callers are the primary vishing risk; own-tenant matches are frequently a legitimate internal help desk and should be confirmed rather than assumed malicious.**<br><br>**Recommended action:** Prioritise External and `.onmicrosoft` callers, confirm none are legitimate, and warn the users they called. Genuine IT support does not cold-call staff over Teams to request remote access."
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls susp header",
+                            "id": "aa420b5f-efd2-4da5-ab41-192031f62ed1"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Suspicious Teams callers by impersonation-style DISPLAY NAME or address (Attendees[].DisplayName / UPN), with Origin from the org's own accepted (EmailEvents inbound) domains - no tenant-id anchor. Interim source: CloudAppEvents / CallParticipantDetail.\r\nlet suspRegex = @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\";\r\nlet ownDomains = toscalar(EmailEvents | where EmailDirection == \"Inbound\" | extend RD = tolower(tostring(split(RecipientEmailAddress, \"@\")[1])) | where isnotempty(RD) | summarize make_set(RD, 200));\r\nlet calls = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId), JoinTime = todatetime(R.JoinTime), Attendees = R.Attendees\r\n| where isnotempty(CallId);\r\nlet callAtt = calls | summarize Attendees = take_any(Attendees), JoinTime = min(JoinTime) by CallId;\r\ncallAtt\r\n| mv-expand Att = Attendees\r\n| extend Caller = tolower(tostring(Att.UPN)), CallerName = tostring(Att.DisplayName)\r\n| extend CallerDom = tostring(split(Caller, \"@\")[1])\r\n| where isnotempty(Caller)\r\n| extend SuspName = CallerName matches regex suspRegex or Caller matches regex suspRegex\r\n| where SuspName or CallerDom endswith \".onmicrosoft.com\"\r\n| extend Origin = case(CallerDom endswith \".onmicrosoft.com\", \"External (.onmicrosoft throwaway)\", set_has_element(ownDomains, CallerDom), \"Own tenant\", \"External\")\r\n| summarize CallsPlaced = dcount(CallId), FirstSeen = min(JoinTime), LastSeen = max(JoinTime) by CallerName, Caller, Origin\r\n| extend OriginRank = case(Origin == \"External (.onmicrosoft throwaway)\", 0, Origin == \"External\", 1, 2)\r\n| sort by OriginRank asc, CallsPlaced desc\r\n| take 10\r\n| project ['Caller Display Name'] = CallerName, ['Caller Address'] = Caller, ['Origin'] = Origin, ['Calls Placed'] = CallsPlaced, ['First Seen'] = FirstSeen, ['Last Seen'] = LastSeen",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Calls Placed",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls susp table",
+                            "id": "d1c4df7b-db07-4c4c-bc71-dfd8623cd704"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Calls and Vishing",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "1d133411-9b5c-4ede-8502-68b3b02262e4"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Impersonation &amp; Identity Deception\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 flags Teams messages where a sender impersonates a brand, a specific person, or a trusted domain. Impersonation is the entry point for most Teams social-engineering: attackers pose as IT, executives, or Microsoft to build trust before delivering a malicious link or request. These visuals expose <b>who is being impersonated, who is being targeted, and the infrastructure (display names, look-alike domains, and URLs)</b> behind the campaigns so you can hunt IOCs and coach at-risk users.<br><br>**Recommended action:** Treat the impersonated display names and look-alike domains below as IOCs to hunt, and prioritize the Microsoft Defender alert *Microsoft Teams chat initiated by a suspicious external user*. Teach users that a Teams display name is not proof of identity: verify the real sender domain, and confirm any help desk, executive, or Microsoft support request through a known internal channel before acting."
+                            },
+                            "name": "teams imp banner",
+                            "id": "7ff04ff3-9f2d-4a49-8383-2b542d78fe9b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nunion\r\n(imp | summarize Count=count() | extend Details=\"Impersonation Detections\", Ord=1),\r\n(imp | summarize Count=dcount(FakeSenderAddress) | extend Details=\"Distinct Fake Senders\", Ord=2),\r\n(imp | summarize Count=dcount(TargetUser) | extend Details=\"Targeted Users\", Ord=3),\r\n(imp | summarize Count=dcount(ImpersonationType) | extend Details=\"Impersonation Types\", Ord=4)\r\n| sort by Ord asc | project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e37f94d5-9bcc-432e-aa66-25831603c228"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Impersonation over time, by type<br>\r\n\r\n**Trend of Brand, User, and Domain impersonation detections. A spike in a single type often marks the start of a targeted campaign.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp trend header",
+                            "id": "09907f5b-5c20-4a7e-86d3-c89153c4df98"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Count=count() by ImpersonationType, Timestamp=bin(Timestamp, {Granularity}) | sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp trend",
+                            "id": "757204b1-e900-4217-a2ff-2224a033fdcc"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Suspicious external senders (impersonation and throwaway tenants)<br>\r\n**External Microsoft Teams senders flagged as likely impersonation: throwaway `.onmicrosoft.com` tenants and/or help desk, IT support, security, admin, or account/update-themed display names. Attackers rotate through many such identities (for example numbered `ithelpdesk<n>@...` addresses) from newly-created or consumer tenants to pose as internal support, frequently before the Defender impersonation detector assigns a verdict. This heuristic complements that detector.**<br><br>**Recommended action:** Review high threat-rate senders, block the sending domains, and remind users that genuine IT support does not cold-contact them from an external tenant; verify any such request through a known internal channel."
+                            },
+                            "customWidth": "100",
+                            "name": "teams susp senders header",
+                            "id": "5df4af86-49e9-4fc7-b6ad-76d3ef3f7da6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//External Teams senders flagged as likely impersonation: throwaway .onmicrosoft.com tenants and/or help desk / IT / admin / update-themed display names, ranked by messages carrying a threat.\r\nMessageEvents\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \"@\")[1]))\r\n| extend IsOnMicrosoft = SenderDomain endswith \".onmicrosoft.com\"\r\n| extend SuspName = SenderDisplayName matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\"\r\n| where IsOnMicrosoft or SuspName\r\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\r\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \"Throwaway .onmicrosoft tenant + helpdesk-style name\", IsOnMicrosoft, \"Throwaway .onmicrosoft tenant\", \"Helpdesk / IT-style display name\")\r\n| extend ThreatPct = round(todouble(ThreatMessages) * 100 / TeamsMessages, 1)\r\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages, ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\r\n| sort by ['Threat Messages'] desc, ['Teams Messages'] desc\r\n| take 10",
+                              "size": 0,
+                              "title": "",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Teams Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 100
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams susp senders table",
+                            "id": "dd1d79d8-f591-4aae-bd44-6ad23a3e0ae4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Who is being targeted<br>\r\n\r\n**Internal users receiving the most impersonation attempts. Concentrated targeting of a few users is a strong signal of a deliberate campaign - prioritize these users for security awareness training.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp targets header",
+                            "id": "43112ad1-ebc9-42fb-9ebd-0dbaa862ed45"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Distinct Fake Senders']=dcount(FakeSenderAddress), Types=make_set(ImpersonationType,3), ['Last Seen']=max(Timestamp) by ['Targeted User']=TargetUser | top 10 by Detections",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp targets",
+                            "id": "cc4b3f98-bfcb-4741-9abb-9ff099eb946f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Impersonating senders<br>\r\n\r\n**The identities behind the impersonation, grouped by fake display name, sender domain, and type. Attackers rotate through many sending addresses under a single display name - Distinct Sender Addresses exposes that rotation, and a high count is itself a strong bulk-campaign signal. Use First/Last Seen to scope the campaign window.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp senders header",
+                            "id": "99859796-7b69-42e7-a27a-541e0ba86cb2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the identities behind Teams impersonation, grouped by the fake display name, sender domain, and impersonation type. Attackers rotate through many sending addresses under one display name, so Distinct Sender Addresses reveals bulk campaigns that per-address ranking would hide.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp\r\n| summarize Detections=count(), SenderAddresses=dcount(FakeSenderAddress), Targets=dcount(TargetUser), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by FakeDisplayName, FakeSenderDomain, ImpersonationType\r\n| top 10 by Detections\r\n| project ['Fake Display Name']=FakeDisplayName, ['Sender Domain']=FakeSenderDomain, ['Impersonation Type']=ImpersonationType, ['Distinct Sender Addresses']=SenderAddresses, Detections, ['Targeted Users']=Targets, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Distinct Sender Addresses",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp senders",
+                            "id": "209439a0-5be3-4e41-abe9-695552730dc8"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Display names abused<br>\r\n\r\n**The identities attackers pretend to be (for example \"IT HelpDesk\", \"Microsoft Support\"). These are the trust anchors of the social-engineering lure.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp names header",
+                            "id": "e645578b-7a52-4d38-9d83-f5c500bbfe1a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Distinct Senders']=dcount(FakeSenderAddress) by ['Fake Display Name']=FakeDisplayName | top 10 by Detections",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Senders",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp names",
+                            "id": "d723d72b-4e7c-431b-ae7b-980879c8bd75"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Look-alike sender domains<br>\r\n\r\n**Sending domains used for impersonation - watch for typosquats (for example rnicrosoft.com for m&rarr;rn). Add confirmed domains to your Tenant Allow/Block List.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp domains header",
+                            "id": "98040a5a-bbd5-4c95-b976-5630ce48b282"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Display Names Used']=dcount(FakeDisplayName) by ['Sender Domain']=FakeSenderDomain | top 10 by Detections",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Display Names Used",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp domains",
+                            "id": "94b9fa45-c889-46a7-8b80-92e5d280ad3b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### URL IOCs from impersonation messages<br>\r\n\r\n**URL domains that appeared in messages sent by impersonating senders. Threat actors deliberately mix legitimate domains (for example microsoft.com or google.com) with their malicious ones to make the lure look trustworthy, so treat this as a review list - not a blocklist. Investigate the unfamiliar or look-alike domains and block only those you confirm malicious; never block a well-known legitimate domain from this list.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp ioc header",
+                            "id": "d5f4886c-7c7e-4c6f-94ca-569cabda5ede"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists URL domains that appeared in messages sent by impersonating senders, with a breakdown of how many carried Malware, Phish, or Spam verdicts. Threat actors mix legitimate and malicious domains in a single lure, so review the unfamiliar or look-alike domains and block only confirmed-malicious ones.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ChatThreadId = tostring(RD.ChatThreadId);\r\nlet impThreads = imp | distinct ChatThreadId;\r\nlet impMsgs = MessageEvents\r\n    | where ThreadId in (impThreads)\r\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n    | project TeamsMessageId, ThreatTypes;\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| join kind=inner (impMsgs) on TeamsMessageId\r\n| summarize ['URL Count']=count(), Messages=dcount(TeamsMessageId), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by ['URL Domain']=UrlDomain\r\n| top 10 by ['URL Count']",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "URL Count",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp ioc",
+                            "id": "958ac65c-d56d-4a80-ba83-2ab33e8b1e2e"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Impersonation",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "c49582db-6318-423f-b806-91cbeb625ea2"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malicious URLs and Link Warnings in Teams\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nTracks URLs shared through Microsoft Teams, messages that triggered a Microsoft Defender for Office 365 URL safety-tip warning, and the outcome of Teams URL clicks (allowed versus blocked) captured in UrlClickEvents.<br><br>**Recommended action:** Enable Safe Links for Microsoft Teams so links are checked at click time, and prioritize *User clicked a malicious link in Teams chat* alerts for investigation. Treat a blocked click as an attempted compromise: check whether the user went on to share credentials or run a file, and reset credentials where warranted."
+                            },
+                            "name": "teams url banner",
+                            "id": "e3ec4d65-8d1f-4303-bd8f-eb1ae521da41"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query surfaces Microsoft Teams URL-sharing and link-warning metrics for the selected period. URL-warning messages carry the Microsoft Defender for Office 365 URL safety tip.\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nunion\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 1),\r\n(MessageUrlInfo | summarize Count = count() | extend Details = \"URLs Shared in Messages\", Ord = 2),\r\n(MessageUrlInfo | summarize Count = dcount(TeamsMessageId) | extend Details = \"Messages Containing URLs\", Ord = 3),\r\n(MessageUrlInfo | summarize Count = dcount(UrlDomain) | extend Details = \"Distinct URL Domains\", Ord = 4)\r\n| sort by Ord asc\r\n| project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams url tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b71382c7-c0f7-4f9d-9d21-e0a8bf9504ff"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Teams URL click outcomes over time<br>\r\n\r\n**Allowed versus blocked Microsoft Teams URL clicks (per selected interval) from UrlClickEvents where the click happened in the Teams workload.**"
+                            },
+                            "customWidth": "66",
+                            "name": "teams click trend header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "30818e0d-6c4b-4868-896a-ac48cb3cef86"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Click outcomes<br>\r\n\r\n**Distribution of Microsoft Teams URL click actions by type.**"
+                            },
+                            "customWidth": "33",
+                            "name": "teams click pie header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "5a882138-2241-4527-80b8-9983c5807050"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Microsoft Teams URL click outcomes over time (allowed vs blocked) using the UrlClickEvents workload filter, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(UrlClickEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(UrlClickEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where Workload == \"Teams\"\r\n| summarize ClickAllowed = countif(ActionType has \"ClickAllowed\"), ClickBlocked = countif(ActionType has \"ClickBlocked\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickAllowed = coalesce(ClickAllowed, 0), ClickBlocked = coalesce(ClickBlocked, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "teams click trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7a2f5559-1e3e-412a-addf-c3bf6be98502"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows Microsoft Teams URL click outcomes by action type for the selected period.\r\nUrlClickEvents\r\n| where Workload == \"Teams\"\r\n| where isnotempty(ActionType)\r\n| summarize Count = count() by ActionType",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "teams click pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "889c6bb3-438b-4575-84f2-084c1b5fd1f4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top domains shared in Teams messages<br>\r\n\r\n**The 10 most-shared URL domains in Microsoft Teams messages, with the number of messages each appeared in.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams top domains header",
+                            "id": "dcb8c87c-087e-4d69-b7b7-0329296293ff"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 URL domains shared in Microsoft Teams messages by volume for the selected period.\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| summarize UrlCount = count(), Messages = dcount(TeamsMessageId) by UrlDomain\r\n| top 10 by UrlCount\r\n| project ['URL Domain']=UrlDomain, ['URLs Shared']=UrlCount, ['Messages']=Messages",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "URLs Shared",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams top domains table",
+                            "id": "7561adb0-1fbe-41ce-a924-a27bcd4c5c12"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Malicious URLs",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "6d47c309-be9e-4b21-940e-7c7b282e5dc2"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Targeted Users &amp; Risky Senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nIdentifies who is most targeted in Microsoft Teams, and profiles the external senders and domains behind risky messages - URL safety-tip warnings, first-contact senders, threat-carrying domains, and low-reputation link infrastructure - so you can spot anomalous senders before they succeed.<br><br>**Recommended action:** Prioritize the most-targeted users for phishing-resistant MFA and awareness coaching, and treat first-contact external senders and low-reputation domains as IOCs. Restrict inbound chat from unmanaged and consumer tenants, and allowlist only trusted external domains so unsolicited outsiders cannot start a conversation."
+                            },
+                            "name": "teams risky banner",
+                            "id": "0aa13d73-2e13-487c-a7c4-d90464a554d4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top targeted users (messages with threats)<br>\r\n\r\n**The 10 users receiving the most Microsoft Teams messages that contained a threat, expanded from each message recipient list.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams targeted header",
+                            "id": "827dc0f6-2bb2-49b9-acf8-d7b400238594"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 users receiving Microsoft Teams messages that contained a threat, expanded from the message recipient list, with each user's total Teams messages received and the share that carried a threat. Messages are de-duplicated to the latest record per message.\r\nlet expanded = MessageEvents\r\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n    | mv-expand rd = parse_json(RecipientDetails)\r\n    | extend Recipient = tostring(rd.RecipientSmtpAddress)\r\n    | where isnotempty(Recipient);\r\nlet totals = expanded | summarize TotalMessages = count() by Recipient;\r\nexpanded\r\n| where isnotempty(ThreatTypes)\r\n| summarize ThreatMessages = count() by Recipient\r\n| join kind=leftouter (totals) on Recipient\r\n| extend ThreatPct = round(100.0 * ThreatMessages / TotalMessages, 1)\r\n| top 10 by ThreatMessages\r\n| project ['Recipient']=Recipient, ['Threat Messages']=ThreatMessages, ['Total Messages']=TotalMessages, ['Threat %']=ThreatPct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams targeted users table",
+                            "id": "79481d1b-617e-46df-b555-9f7240932dd0"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top senders of URL-warning messages<br>\r\n\r\n**Senders whose Microsoft Teams messages most often triggered a URL safety-tip warning.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams warn senders header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "ef71d7dd-4442-4992-977d-d550aad4533c"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top domains in URL-warning messages<br>\r\n\r\n**URL domains most frequently present in Microsoft Teams messages that triggered a URL safety-tip warning.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams warn domains header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "6f41a4ba-f832-4947-ad27-cd6b8015bd63"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 senders whose Microsoft Teams messages triggered a URL safety-tip warning for the selected period, with each sender's total Teams messages and the share that carried a warning. Messages are de-duplicated to the latest record per message.\r\nlet dedup = MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nlet totals = dedup | summarize TotalMessages = count() by SenderEmailAddress;\r\ndedup\r\n| where SafetyTip == \"URLMessageWarning\"\r\n| summarize WarningMessages = count() by SenderEmailAddress\r\n| join kind=leftouter (totals) on SenderEmailAddress\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Warning Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams warn senders table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3fa023af-79e3-407f-ac20-b0aa6e3ba511"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 URL domains appearing in Microsoft Teams messages that triggered a URL safety-tip warning, with the domain's total message appearances and the share that carried a warning.\r\nlet warned = MessageEvents | where SafetyTip == \"URLMessageWarning\" | distinct TeamsMessageId;\r\nlet totals = MessageUrlInfo | where isnotempty(UrlDomain) | summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;\r\nMessageUrlInfo\r\n| where TeamsMessageId in (warned)\r\n| summarize WarningMessages = dcount(TeamsMessageId) by UrlDomain\r\n| join kind=leftouter (totals) on UrlDomain\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['URL Domain']=UrlDomain, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Warning Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams warn domains table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "68811015-1383-48ad-86da-4f8f9d39e4c4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### First-contact external senders<br>\r\n\r\n**External Microsoft Teams senders ordered by when they were first seen in the period (most recent first). Note: some flows tag internal-domain senders as external - to hide your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams fc senders header",
+                            "id": "0f131ff3-d6b2-4187-b86c-ca3493594b54"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists external Microsoft Teams senders by the date they were first seen in the selected period, surfacing recent first-contact senders. Messages are de-duplicated to the latest record per message. In tenants with longer history this highlights genuinely new senders.\r\n// TIP: IsExternalThread may still surface senders from your own accepted domains. To hide them,\r\n// uncomment the ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n//| where tostring(split(SenderEmailAddress, \"@\")[1]) !in~ (ExcludeDomains)\r\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\r\n| top 10 by FirstSeen desc\r\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true,
+                                "sortBy": [
+                                  {
+                                    "itemKey": "Threat Messages",
+                                    "sortOrder": 2
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams fc senders table",
+                            "id": "4e10a78d-8858-4dbb-9db0-e7b7d7e7636c"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### External sender-domain risk<br>\r\n\r\n**External sending domains ranked by threat volume, with the mix of conversation types (1:1 chat, group chat, channel), threat breakdown, threat rate, count of messages carrying low-reputation URLs (domains on commonly-abused TLDs such as .xyz, .top, .click, .shop, .zip), and first/last-seen. A domain that is new in the period, skews toward 1:1 chats, or shows a high threat rate is anomalous and warrants review. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams anomaly header",
+                            "id": "a91295db-8192-4828-93c5-408436e4b0e1"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query ranks external sender domains in Microsoft Teams by threat volume for the selected period, split by conversation type (1:1 chat, group chat, channel), with threat-type breakdown, threat rate, and a count of messages carrying low-reputation URL TLDs. Messages are de-duplicated to the latest record per message. New, 1:1-skewed, or high-threat-rate domains are the anomalies to review.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n    | where isnotempty(UrlDomain)\r\n    | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n    | where Tld in (suspTlds)\r\n    | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\"), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages > 0\r\n| extend ThreatRatePct = round(100.0 * ThreatMessages / Messages, 1)\r\n| top 10 by ThreatMessages desc\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Threat Msgs']=ThreatMessages, Malware, Phish, Spam, ['Threat Rate %']=ThreatRatePct, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams anomaly table",
+                            "id": "bcd6746d-8298-495d-9d6c-2fadc6cba569"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Suspicious new senders (no threat verdict yet)<br>\r\n\r\n**External sending domains with no threat verdict yet, but that are either sending low-reputation-URL messages or showing unusual volume. These slip past threat filters - watch for new domains skewing toward 1:1 chats, an early social-engineering signal. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams newdom header",
+                            "id": "9e3844f4-befc-4b76-a8cd-ca53fdf51d41"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query surfaces external sender domains in Microsoft Teams that have NO threat verdict yet but are sending messages with low-reputation URL TLDs or unusual volume, split by conversation type. These are early-warning senders that have not tripped a detection. Messages are de-duplicated to the latest record per message.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n    | where isnotempty(UrlDomain)\r\n    | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n    | where Tld in (suspTlds)\r\n    | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages == 0\r\n| where SuspUrlMsgs > 0 or Messages >= 5\r\n| order by SuspUrlMsgs desc, Messages desc\r\n| take 10\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams newdom table",
+                            "id": "8036a5b7-b5b3-4af4-912f-bb092bb01b89"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Low-reputation link domains in Teams (IOC radar)<br>\r\n\r\n**URL domains shared in Teams that use TLDs commonly abused for phishing and malware (for example .xyz, .top, .click, .zip, .shop). Ranked by message reach, with first/last-seen. Review these domains as potential indicators - .zip and .mov are especially deceptive because links read like file names.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams tld header",
+                            "id": "d48921f4-233c-4e0f-a97b-83e1bcaed399"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists URL domains shared in Microsoft Teams that use low-reputation TLDs commonly abused for phishing and malware, ranked by the number of Teams messages they appeared in, with first- and last-seen. Treat high-reach or newly-seen domains as candidate indicators of compromise.\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n| where Tld in (suspTlds)\r\n| summarize Messages=dcount(TeamsMessageId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ['URL Domain']=UrlDomain, ['TLD']=Tld\r\n| top 10 by Messages desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams tld table",
+                            "id": "30d5588e-010c-474a-9c53-74b73dcc9676"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Targeted Users & Risky Senders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "6fef737b-cb4e-4a51-9ced-bf11754a6b33"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams File Protection\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 scans files shared in Microsoft Teams. These visuals show files scanned versus malware detected, and list the malicious files found.<br><br>**Recommended action:** Investigate each malicious file below and confirm it was quarantined and removed from the SharePoint or OneDrive location backing the chat. Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, and use attack surface reduction rules to block executable content delivered through collaboration."
+                            },
+                            "name": "teams file banner",
+                            "id": "2f01c905-dd65-4a13-9f67-c70402b2c175"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection - for the selected period.\r\nlet base = FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\";\r\nunion\r\n(base | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files Scanned - No Detection\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams file tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9f555c51-1680-47ef-94d4-b1f8cf9dce3b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malicious files shared in Teams<br>\r\n\r\n**Files shared in Microsoft Teams that were detected with malware, with owner and file details.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams file table header",
+                            "id": "4cd3274e-0c61-4722-83b7-1fccf8a94a57"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365 for the selected period.\r\nFileMaliciousContentInfo\r\n| where Workload == \"MicrosoftTeams\"\r\n| where isnotempty(ThreatTypes)\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams file table",
+                            "id": "135e0e7d-7110-40ee-a377-1a5992b2ef9d"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams File Protection",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "8ecc1bae-4a06-4b1c-8952-59fb434b7cbc"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Post-Delivery ZAP Insights (Teams)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nZero-hour auto purge (ZAP) removes malicious Microsoft Teams messages after delivery. These visuals summarize ZAP volume, type, result, and the senders whose messages were most often removed.<br><br>**Recommended action:** Confirm zero-hour auto purge is enabled for Microsoft Teams so newly-weaponized messages are pulled after delivery. Investigate senders with repeated ZAP removals as likely compromised or malicious accounts and block or restrict them. A rising ZAP trend can signal an active campaign that slipped past delivery-time filtering."
+                            },
+                            "name": "teams zap banner",
+                            "id": "136cfb4e-d2a5-4db0-9771-6b6380011ba0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes Microsoft Teams post-delivery ZAP (zero-hour auto purge) activity by Microsoft Defender for Office 365 for the selected period.\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(zap | summarize Count = count() | extend Details = \"Total ZAP Actions\", Ord = 1),\r\n(zap | where ActionType == \"Malware ZAP\" | summarize Count = count() | extend Details = \"Malware ZAP\", Ord = 2),\r\n(zap | where ActionType == \"Phish ZAP\" | summarize Count = count() | extend Details = \"Phish ZAP\", Ord = 3),\r\n(zap | where ActionResult == \"Success\" | summarize Count = count() | extend Details = \"Successful Actions\", Ord = 4),\r\n(zap | where ActionResult == \"Failed\" | summarize Count = count() | extend Details = \"Failed Actions\", Ord = 5),\r\n(zap | where Action == \"Moved to quarantine\" | summarize Count = count() | extend Details = \"Moved to Quarantine\", Ord = 6)\r\n| sort by Ord asc\r\n| project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams zap tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "06980411-5e6b-4aa4-a746-351cd2b12dae"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP actions over time<br>\r\n\r\n**Microsoft Teams post-delivery ZAP actions (per selected interval) split by Malware ZAP and Phish ZAP.**"
+                            },
+                            "customWidth": "66",
+                            "name": "teams zap trend header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "7fc1cfcd-3a9f-45b1-9f39-3820fce23c03"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP by action type<br>\r\n\r\n**Distribution of Microsoft Teams post-delivery ZAP actions by type.**"
+                            },
+                            "customWidth": "33",
+                            "name": "teams zap pie header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "9bc0d0a3-876a-49d7-9046-31764511ca38"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Microsoft Teams post-delivery ZAP actions over time by ZAP type, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessagePostDeliveryEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessagePostDeliveryEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessagePostDeliveryEvents\r\n| summarize MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareZAP = coalesce(MalwareZAP, 0), PhishZAP = coalesce(PhishZAP, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "teams zap trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c78a509e-324f-4a8c-b2e7-bce3e0d20667"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows Microsoft Teams post-delivery ZAP actions by type for the selected period.\r\nMessagePostDeliveryEvents\r\n| summarize Count = count() by ActionType",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "teams zap pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "cfc94695-fb02-4b6c-a223-f79f7b947379"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top senders whose messages were removed by ZAP<br>\r\n\r\n**Senders whose Microsoft Teams messages were most often removed by post-delivery ZAP.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams zap senders header",
+                            "id": "f8677ffe-007a-41ca-81de-1ae5dd19d06a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 senders whose Microsoft Teams messages were removed by post-delivery ZAP for the selected period.\r\nMessagePostDeliveryEvents\r\n| where isnotempty(SenderEmailAddress)\r\n| summarize ZapActions = count(), MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by SenderEmailAddress\r\n| top 10 by ZapActions\r\n| project ['Sender']=SenderEmailAddress, ['ZAP Actions']=ZapActions, ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "ZAP Actions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams zap senders table",
+                            "id": "50c9a883-6442-40dc-b84f-57adfbb46a38"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams ZAP",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "f5cc2425-e5ae-4520-9a97-2e4c2c447dcd"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Message and Call Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Teams messages and calls reported by users, and messages submitted by admins, for review by Microsoft. Sourced from the submission records in CloudAppEvents.<br><br>**Recommended action:** Encourage users to report suspicious Teams messages and calls so Microsoft can tune protection, and triage admin submissions promptly. A cluster of reports naming the same sender, display name, or call identity is an early signal of a targeted campaign: pivot those identities into the impersonation and risky-sender views above to scope it."
+                            },
+                            "name": "teams sub banner",
+                            "id": "54cbfb29-2626-4b65-8cb5-a42ff4b41e63"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes Microsoft Teams message and call submissions reported to Microsoft for the selected period, split by user and admin reports. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nunion\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Messages Reported by Users\", Ord = 1),\r\n(sub | where SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Calls Reported by Users\", Ord = 2),\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\" | summarize Count = count() | extend Details = \"Messages Submitted by Admins\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams sub tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "419ed645-ebc1-4df1-b9f0-c744403ab494"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Submissions over time<br>\r\n\r\n**Microsoft Teams user and admin submissions (per selected interval).**"
+                            },
+                            "customWidth": "66",
+                            "name": "teams sub trend header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "6a795b0a-82e2-427a-8ac0-abfb5bb5e447"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Submission mix<br>\r\n\r\n**Microsoft Teams submissions split by content type (message or call) and reporter (user or admin).**"
+                            },
+                            "customWidth": "33",
+                            "name": "teams sub pie header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "1f4c55f8-7290-4b6f-b02a-e3134568b9ff"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Microsoft Teams message and call submissions over time, summarizing the data per selected interval. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet gran = {Granularity};\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nlet minTime = toscalar(sub | summarize min(Timestamp));\r\nlet maxTime = toscalar(sub | summarize max(Timestamp));\r\nlet agg = materialize(sub\r\n| summarize UserReports = countif(ActionType == \"UserSubmission\"), AdminReports = countif(ActionType == \"AdminSubmission\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, UserReports = coalesce(UserReports, 0), AdminReports = coalesce(AdminReports, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "teams sub trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7dcb03da-de96-4388-90a4-0a3f3ca98dc6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows the mix of Microsoft Teams submissions by content type and reporter for the selected period. Only completed user submissions (chat and call) and admin submissions (chat) are counted; submission triage/timeout lifecycle records are excluded.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\"\r\n| where (SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\")\r\n    or (SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\")\r\n    or (SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\")\r\n| extend Reporter = iif(ActionType == \"AdminSubmission\", \"Admin\", \"User\")\r\n| summarize Count = count() by SubmissionType = strcat(SubmissionContentType, \" (\", Reporter, \")\")",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "teams sub pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "84a0141e-51de-4423-acb0-3c4342a49bf2"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative (FN) User Submissions by submission State<br>\r\n\r\n**Microsoft Teams messages reported by users as missed detections, broken down by submission state (for example Rescaned, Graded). Tracks the processing status of user reports.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub state header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "1b2bdffd-69b0-41b0-bdda-b242b7faaec0"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative (FN) User Submissions by Triage Verdict<br>\r\n\r\n**Microsoft Teams user submissions grouped by the verdict assigned during grading (for example Phishing, NotSpam, Spam). Shows how reported messages were graded and highlights detection gaps.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub verdict header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "bdb97e09-44d2-41ad-a99f-931e4a8169cc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows Microsoft Teams user (false negative) message submissions by submission state (for example Rescaned, Graded), to track processing status.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend SubmissionState = tostring(RD.SubmissionState)\r\n| summarize Count = count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub state pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "139ce840-5fc2-44d1-9872-91b37a74f0e7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows Microsoft Teams user (false negative) message submissions by the triage verdict assigned during grading (for example Phishing, NotSpam, Spam).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend TriageVerdict = tostring(parse_json(tostring(RD.GradingResult)).TriageVerdict)\r\n| where isnotempty(TriageVerdict)\r\n| summarize Count = count() by TriageVerdict",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub verdict pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "538ce4a3-a1ff-4b8d-a466-2173edbb2cd7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 P2 sender domains in FN User Submissions<br>\r\n\r\n**The sender domains most often reported by users as missed Microsoft Teams threats. High-volume domains are candidate sources of malicious messaging.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub domains header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "9b8db0c7-2bf2-4077-ae20-60146001bf23"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 individual P2 senders in FN User Submissions<br>\r\n\r\n**The individual senders most often reported by users as missed Microsoft Teams threats.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub senders header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "ffbe90ab-129c-47fa-9dac-50cab528ad55"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 P2 (envelope) sender domains of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2SenderDomain = tostring(RD.P2SenderDomain)\r\n| where isnotempty(P2SenderDomain)\r\n| summarize Submissions = count() by ['P2 Sender Domain']=P2SenderDomain\r\n| top 10 by Submissions",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub domains table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b18192fb-26a8-4bd1-9b07-7aeab496eae3"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 individual P2 (envelope) senders of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2Sender = tostring(RD.P2Sender)\r\n| where isnotempty(P2Sender)\r\n| summarize Submissions = count() by ['P2 Sender']=P2Sender\r\n| top 10 by Submissions",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub senders table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7ead0a01-2b56-4225-b625-554b09350013"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 users performing the most FN User Submissions<br>\r\n\r\n**The users who report the most Microsoft Teams messages as missed detections - useful for recognising engaged reporters and spotting over-reporting.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub topusers header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "fb893cdd-d6d3-431a-a1d2-87652571a10d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 admins performing the most FN Admin Submissions<br>\r\n\r\n**The admins who submit the most Microsoft Teams messages as missed detections.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub topadmins header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "14fca69b-e152-4a5d-bd2c-020c34c2226a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 users who reported the most Microsoft Teams messages as false negatives (missed detections), with each submitter's email (from the submission record) to disambiguate users with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterEmail = tostring(RD.UserId)\r\n| where isnotempty(Submitter) and SubmitterEmail has \"@\"\r\n| summarize Submissions = count() by ['Submitter']=Submitter, ['Email']=SubmitterEmail\r\n| top 10 by Submissions",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub topusers table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a171a35b-35b0-46ce-a916-052a54101126"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 admins who submitted the most Microsoft Teams messages as false negatives (missed detections). The admin's own email is not present in the submission record (that would require the Identity table), so the Submitter ID (object GUID) is shown to disambiguate admins with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"AdminSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterId = tostring(RD.SubmitterId)\r\n| where isnotempty(Submitter)\r\n| summarize Submissions = count() by ['Admin']=Submitter, ['Submitter ID']=SubmitterId\r\n| top 10 by Submissions",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub topadmins table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8bf37c2b-067a-4341-a192-2aa45699c3f7"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Submissions",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "eeea53a4-69d9-426e-bf9f-1789cd73bfed"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Recent Threat Detail\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThe most recent Microsoft Teams phishing and malware messages, de-duplicated to the latest record per message, for investigation."
+                            },
+                            "name": "teams detail banner",
+                            "id": "4bdd917c-721f-450b-b455-45cbd5f59cc5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Last 10 Teams phishing messages<br>\r\n\r\n**Most recent Microsoft Teams messages detected as phishing, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams detail phish header",
+                            "id": "9bcf96c1-a958-4515-b171-10ec2f3ba660"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams detail phish table",
+                            "id": "3675d08f-1165-4f47-a633-e432cf96e3d5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Last 10 Teams malware messages<br>\r\n\r\n**Most recent Microsoft Teams messages detected as malware, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams detail mal header",
+                            "id": "6b9d66d2-8d89-47b0-a72a-5ee8623082dc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams detail mal table",
+                            "id": "d6e76d0a-7eee-4c05-8e92-10f9622b5ab3"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Detail",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "1e9c879b-d6be-4d36-9068-b5438abf7dd2"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Top Attacked Users, Top Senders, and Automatic External Email Forwarding\r\n\r\n---\r\nThis tab provides insights into **Top attacked users, Top Senders** in inbound email messages and details about **automatic external email forwarding**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "6"
+                      },
+                      "name": "text - 24 - Copy - Copy - Copy",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "f1a60054-44b1-432e-be7a-9d7d114ff5c7"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Attacked Users and Top Senders Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides key visuals that highlight top attacked users – individuals most frequently targeted by inbound email threats as detected by Microsoft Defender for Office 365. Offers insights into top email senders and sender domains across inbound email traffic, helping identify patterns and potential risk sources.<br><br>**Recommended action:** Apply the Strict preset to the most-attacked users and review the top sender domains as possible block-list candidates."
+                            },
+                            "name": "text - 13 - Copy - Copy",
+                            "id": "ff220902-30b8-4aef-9b79-14c913a1b2d2"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Attacked Users<br>\r\n\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam, Phishing, or Malware. Helps identify high-risk users for targeted security awareness and policy enforcement.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy",
+                            "id": "58f34b9f-824d-4fcf-b2aa-d7d380aa08d5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 users that are receiving Spam, Phishing or Malware emails\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by RecipientEmailAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by ThreatEmailCount\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    }
+                                  }
+                                ],
+                                "filter": true,
+                                "sortBy": [
+                                  {
+                                    "itemKey": "$gen_bar_Threat Emails_2",
+                                    "sortOrder": 2
+                                  }
+                                ]
+                              },
+                              "sortBy": [
+                                {
+                                  "itemKey": "$gen_bar_Threat Emails_2",
+                                  "sortOrder": 2
+                                }
+                              ],
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 28",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e9459e78-6b43-4ef2-9596-32169d95c610"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Senders of Inbound Emails<br>\r\n\r\n**Displays the top 10 sender email addresses from external sources delivering inbound emails. Helps identify high-volume external senders for monitoring and policy enforcement.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "id": "eb4590a7-57c7-4728-af62-3d798afe6f2d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by SenderFromAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender']=SenderFromAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 28 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e4272979-1073-4c1e-9b1b-b971bc3efc33"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains of Inbound Emails<br>\r\n\r\n**Displays the top 10 sender domains from external sources delivering inbound emails. Helps identify high-volume external sender domains for monitoring and policy enforcement.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "id": "7ab63415-17ce-47f1-a614-e5e6edbe472e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by SenderFromDomain\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 28 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b593da94-b735-4fe3-a82d-18c90156e506"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "6"
+                      },
+                      "name": "group - 10-Top attacked users and top senders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "3e41cc1a-166e-4094-bc66-7e26a918b2e9"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Automatic External Email Forwarding Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Email forwarding can be useful, but can also pose a security risk due to the potential disclosure of information.**\r\n<br>\r\n\r\nUsers can configure [<b>Inbox rules</b>](https://support.microsoft.com/en-US/Outlook/mail/use-rules-to-automatically-forward-messages) in Outlook or set up [<b>SMTP forwarding</b>](https://support.microsoft.com/en-us/office/turn-on-automatic-forwarding-in-outlook-7f2670a1-7fff-4475-8a3c-5822d63b0c8e) to automatically forward messages to external recipients. You can control automatic external email forwarding from cloud mailboxes using [<b>Outbound spam policies</b>](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding) in Microsoft Defender for Office 365. \r\n**Attackers might exploit this capability to compromise your organization or its partners.**<br><br>**Recommended action:** Investigate external auto-forwarding - it is a common data-exfiltration path. Consider disabling auto-forwarding via the outbound spam policy unless a business case is documented."
+                            },
+                            "name": "text - 8",
+                            "id": "b04d1590-98e3-4650-9172-33e75561e1e5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Automatic Email Forwarding by Type<br>\r\n\r\n**Displays counts of outbound emails automatically forwarded to external addresses, grouped by forwarding type (e.g., SMTP forwarding, inbox rules). Helps identify forwarding behaviors that may pose data exfiltration risks.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c7cb7917-eaf4-4a1e-989a-75f4b6182851"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Internal Users Forwarding Emails Externally<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded emails to external addresses (regardless of the forwarding type used). Helps identify potential data exfiltration risks and enforce forwarding policies.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5a5d5a8c-c195-45db-a878-e6ac908cc919"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises automatic email forwarding to external email addresses by forwarding type\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize count() by ForwardingType\r\n| sort by count_ desc \r\n",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "15094d98-add2-4b50-a0df-ee91fd34c6fb"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| sort by TotalForwardedMessages desc \r\n| top 10 by TotalForwardedMessages\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\r\n\r\n",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "TotalForwardedMessages"
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "73d66038-2ea0-449d-9aeb-a1bd4b207d7f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Internal Users Forwarding Emails Using Mailbox Rules<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9a7b5fc3-da23-4e95-87df-542a5e3f6320"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "TotalForwardedMessages"
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 30 - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f8d7b85d-944a-493f-a143-7e18277846c9"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 External domains Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\r\n\r\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "cda99a50-b7c4-4d95-ac61-7231080a3f5d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 External Recipients Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\r\n\r\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "72b01575-c33e-457c-98db-ea755c003bf0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 external domains who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "823dec28-48b5-4be3-8e68-04301a952a62"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "14804990-bfc9-43b7-8c8d-95c2cf32ee56"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Internal Users Forwarding Emails via SMTP Forwarding<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "fa04b313-5756-4ff7-9ee8-ec61e6b382cc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize count() by ForwardingUser\r\n| top 10 by count_ desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=count_",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              },
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 30 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "bed8e717-4ea7-4f71-aaa7-b70a31f4dc88"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 External domains receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\r\n\r\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f76bc717-3cf8-4d8d-92fa-3f2024065f8f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 External Recipients Receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\r\n\r\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "2190c799-ab4f-4bd8-87e1-f9c5c224cca4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c3be87b3-8ce8-40f2-ad92-0651bed71117"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "fb6b0113-f5bb-46a7-994b-92ebc3c7881d"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "6"
+                      },
+                      "name": "group - 34 - Automatic email forwarding",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "02c91ebb-4f92-4843-a73b-6dea7a6ac2bd"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Email detection action overrides\r\n\r\n---\r\n\r\nThis tab provides insights into admin or end-user configured **detection overrides** where the message was detected as a threat by Microsoft Defender for Office 365, however an admin-configured policy or end-user setting overrode the detection action.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/understand-overrides-in-email-entity) "
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "text - 13 - Copy",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "ae594968-00b9-40b8-b5dd-052a27440afb"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Admin configured Detection Overrides (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track emails subject to administrator policies (e.g., Transport Rules, Tenant Allow/Block List) with an \"Allow\" action, overriding Microsoft Defender for Office 365 detections (excluding SecOps Mailbox overrides).<br><br>**Recommended action:** Review Allow overrides that later carried threats and remove stale or overly broad allow entries - they weaken protection."
+                            },
+                            "name": "text - AdminOverridesAllowHeader",
+                            "id": "3d70a304-c590-4156-a6d4-da147fe106ab"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Overrides (Allow) Trend\r\n**Displays the count (per {Granularity}) of emails where an administrator policy with an \"Allow\" action overrode detections (excluding SecOps Mailbox). Helps track the frequency of admin overrides over time.**"
+                            },
+                            "name": "text - AdminOverridesAllowTrend",
+                            "id": "a4ee104a-a0a1-4725-a60f-deedcc91af70"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to an admin policy with action of allow independent of action taken, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Admin Overrides",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "query - 3",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "79928e9e-48ed-4d08-8ff7-c21fe027550e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Total Emails by Admin Override type (Allow)\r\n**Summarizes the total count of emails subject to administrator policies with an \"Allow\" action, grouped by the type of override. Helps identify which policies are most frequently allowing emails.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - AdminOverridesAllowByType",
+                            "id": "855fce09-2000-4d16-8521-8b4eeddfae00"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Overrides (Allow) by Override Type and Threat Type\r\n**Details the count of emails allowed by administrator policies, categorized by the override type and the detected threat type. Helps assess the risk associated with allowed emails.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - AdminOverridesAllowByTypeAndThreat",
+                            "id": "a2613078-b427-4b23-aca0-21989b1944db"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 16",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b21a0329-8f52-45c2-81f2-6df65c134673"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 2",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "0bf4cbe6-7c84-49d4-801c-d955762b5699"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### SecOps Mailbox Overrides (Allow)\r\nThis section focuses on emails allowed specifically due to the SecOps Mailbox override policy, typically used for investigation and analysis.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/advanced-delivery-policy-configure) "
+                            },
+                            "name": "text - SecOpsOverridesHeader",
+                            "id": "f582dc86-4c40-4cdd-ba0b-ec6ef8820a27"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to the \r\nEmailEvents \r\n| where OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "stat",
+                              "statSettings": {
+                                "valueAggregation": "None",
+                                "colorSettings": {
+                                  "type": "static",
+                                  "mode": "background",
+                                  "heatmapPalette": "greenRed",
+                                  "thresholdsGrid": []
+                                },
+                                "iconSettings": {
+                                  "thresholdsGrid": []
+                                },
+                                "tagText": "",
+                                "valueFontStyle": "auto",
+                                "tagTextPosition": "bottom"
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 1",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8ad2fea4-dcd0-454e-a4d4-b5275c86fd9b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails delivered to the SecOps Mailbox by threat type\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 1,
+                              "showAnalytics": true,
+                              "title": " ",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 4",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "52c04df2-69b5-46e4-a000-7c6d212a132a"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "group - 15 - Admin Detection Overrides - Allow",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "9b9baf2f-fd5f-41b6-8368-b515f8de4fd4"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Admin configured Detection Overrides (Block)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email messages blocked by administrative policies (e.g. Tenant allow/block list, Antimalware policy file type block), overriding detection actions defined by Microsoft Defender for Office 365.<br><br>**Recommended action:** Confirm these blocks are still needed and consolidate them into the Tenant Allow/Block List where appropriate."
+                            },
+                            "name": "text - AdminOverridesBlockHeader",
+                            "id": "6157683b-cce7-4165-886f-0da73e25ce86"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Overrides (Block) Trend\r\n**Displays the count (per {Granularity}) of emails where an administrator policy with a \"Block\" action overrode detections. Helps track the frequency of admin blocks over time.**"
+                            },
+                            "name": "text - AdminOverridesBlockTrend",
+                            "id": "699820b4-a984-45cc-ab2f-607c3c8569d4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Admin Overrides",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 5",
+                            "styleSettings": {
+                              "margin": "10",
+                              "padding": "10"
+                            },
+                            "id": "9ef5e7fb-843e-439b-b4f3-9b0bb149e74b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Total Emails by Admin Override Type (Block)\r\n**Summarizes the total count of emails subject to administrator policies with a \"Block\" action, grouped by the type of override.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - AdminOverridesBlockByType",
+                            "id": "5694a7c0-1ee5-40b4-ae2b-263d189c4b4e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Overrides (Block) by Override Type and Threat Type\r\n**Details the count of emails blocked by administrator policies, categorized by the override type and the detected threat type.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - AdminOverridesBlockByTypeAndThreat",
+                            "id": "6e309742-37c0-4ad5-9b9a-63643059bfaf"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to an admin policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 6",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "eabc80ed-d0e9-43d2-ab13-a5af478f11c8"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 7",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1661bfa6-d8fd-4387-a334-1bc027a3f6d1"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "group - 36-Admin Detection Overrides - Block",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "7d514e9a-f67f-45a6-ba1b-6492348cc18b"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User configured Detection Overrides (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track email messages subject to user policies (e.g. [Safe Senders list defined in Outlook](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365#use-outlook-safe-senders)) with an \"Allow\" action, overriding Microsoft Defender for Office 365 detections.<br><br>**Recommended action:** Educate users that safe-sender allows can bypass protection; review high-risk user allow entries."
+                            },
+                            "name": "text - UserOverridesAllowHeader",
+                            "id": "4d41c560-0e73-40c5-b610-33e9500e88c4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Overrides (Allow) Trend\r\n**Displays the count (per {Granularity}) of emails where a user policy with an \"Allow\" action overrode detections. Helps track the frequency of user overrides over time.**"
+                            },
+                            "name": "text - UserOverridesAllowTrend",
+                            "id": "9432efff-9f03-4d74-8781-02be8b2d07fa"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "User Overrides",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "query - 3",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "02da1d33-e477-479d-bdd3-95ab1ad7c75c"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Total Emails by User Override Type (Allow)\r\n**Summarizes the total count of emails subject to user policies with an \"Allow\" action, grouped by the type of override.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - UserOverridesAllowByType",
+                            "id": "006a2e87-b1b6-4cc3-a763-ceebaa86b340"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Overrides (Allow) by Override Type and Threat Type\r\n**Details the count of emails allowed by user policies, categorized by the override type and the detected threat type. Helps assess the risk associated with user-allowed emails.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - UserOverridesAllowByTypeAndThreat",
+                            "id": "7c34bb4b-46c0-4054-9596-3dfd010bb036"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 16",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d1d9021d-e6bf-47b1-bdd2-438a212d2767"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "50",
+                            "name": "query - 2",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1acd913c-c945-4a58-b04e-d008ca53ffe3"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "group - 15 - User Detection Overrides - Allow",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "c939060e-6a8b-49ff-951b-a3abddbd9fb4"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User configured Detection Overrides (Block)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into emails blocked by user-configured policies (e.g., [Blocked Senders list in Outlook](https://support.microsoft.com/en-us/office/block-or-unblock-senders-in-outlook-9bf812d4-6995-4d19-901a-76d6e26939b0)).<br><br>**Recommended action:** Use user block trends to identify unwanted senders that may warrant tenant-wide blocking."
+                            },
+                            "name": "text - UserOverridesBlockHeader",
+                            "id": "be6c6a3e-08ee-47c5-b8e7-6a1078dd17d1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Overrides (Block) Trend\r\n**Displays the count (per {Granularity}) of emails where a user policy with a \"Block\" action overrode detections. Helps track the frequency of user blocks over time.**"
+                            },
+                            "name": "text - UserOverridesBlockTrend",
+                            "id": "7cd77d54-2e2b-4d23-a6a9-4bd6bca2642a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "User Overrides",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 5",
+                            "styleSettings": {
+                              "margin": "10",
+                              "padding": "10"
+                            },
+                            "id": "0b21b66c-001d-4b3d-b47f-f3a420ccaaf8"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Total Emails by User Override Type (Block)\r\n**Summarizes the total count of emails subject to user policies with a \"Block\" action, grouped by the type of override.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - UserOverridesBlockByType",
+                            "id": "fd513501-5e9d-45d9-9d0d-cd546002b8cf"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Overrides (Block) by Override Type and Threat Type\r\n**Details the count of emails blocked by user policies, categorized by the override type and the detected threat type.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - UserOverridesBlockByTypeAndThreat",
+                            "id": "4fbfa876-47ed-4c3b-81ee-1c40b982cecd"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to a user type policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 6",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d3fccaa6-80fd-419d-bb37-aedf67263419"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 7",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e5e74ce1-fa67-45ea-bc80-97237342e370"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "group - 37-User Detection Overrides - Block",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "0c1d327a-c2f1-4b9b-b210-53c808b53b48"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User &amp; Sender Override Detail (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nInbound messages that Microsoft Defender for Office 365 **detected as threats but delivered anyway** because of an admin- or user-configured **Allow** override (phishing-simulation and SecOps Mailbox traffic excluded). **Total Threats** is all detected threats to that recipient / sender domain in the selected range; **Overridden Threats** and **Override %** are the portion delivered due to an Allow override, and **Override Types** names the specific overrides responsible. **User-configured** overrides come from the recipient's own mailbox junk-email settings in Outlook / Outlook on the web (the mailbox \"safelist collection\") &mdash; the **Safe Senders** and **Safe Recipients** lists and **trusted contacts** (\"Also trust email from my Contacts\"). **Admin-configured** overrides come from the **Tenant Allow/Block List, Exchange mail flow (transport) rules, the IP Allow List, or allowed sender/domain lists in anti-spam policies**. Use this to spot users or domains where overrides are letting threats through &mdash; candidates for policy review or a Tenant Allow/Block List (TABL) block.<br><br>**Recommended action:** Focus on the users and sender domains with the most allow overrides - these are the biggest protection gaps."
+                            },
+                            "name": "Overrides - User Detail Header",
+                            "id": "3b0e83f3-f340-4b95-85c5-831783e8abc2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top recipients receiving threats that were delivered due to an admin or user override, with the share of their threats that were overridden and a breakdown of which override types caused them.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n    \"(none)\")\r\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n        by RecipientEmailAddress\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 15 by OverriddenThreats\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Overridden Threats",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Override %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "graphSettings": {
+                                "type": 2,
+                                "topContent": {
+                                  "columnMatch": "StatisticName",
+                                  "formatter": 1
+                                },
+                                "centerContent": {
+                                  "columnMatch": "Value",
+                                  "formatter": 1,
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                },
+                                "nodeIdField": "StatisticName",
+                                "sourceIdField": "Value",
+                                "targetIdField": "Value",
+                                "graphOrientation": 3,
+                                "showOrientationToggles": false,
+                                "nodeSize": null,
+                                "staticNodeSize": 100,
+                                "colorSettings": null,
+                                "hivesMargin": 5,
+                                "edgeColorSettings": null
+                              }
+                            },
+                            "name": "Overrides - Top Users",
+                            "id": "d7e169a2-808a-4bbf-86ee-5be561c690f7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top sender domains sending threats to users, with the share of those threats that were delivered because of an admin or user override and a breakdown of which override types caused them. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n    \"(none)\")\r\n| summarize PerType = count() by SenderFromDomain, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n        by SenderFromDomain\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 10 by OverriddenThreats\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Overridden Threats",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Override %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "graphSettings": {
+                                "type": 2,
+                                "topContent": {
+                                  "columnMatch": "StatisticName",
+                                  "formatter": 1
+                                },
+                                "centerContent": {
+                                  "columnMatch": "Value",
+                                  "formatter": 1,
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                },
+                                "nodeIdField": "StatisticName",
+                                "sourceIdField": "Value",
+                                "targetIdField": "Value",
+                                "graphOrientation": 3,
+                                "showOrientationToggles": false,
+                                "nodeSize": null,
+                                "staticNodeSize": 100,
+                                "colorSettings": null,
+                                "hivesMargin": 5,
+                                "edgeColorSettings": null
+                              }
+                            },
+                            "name": "Overrides - Top Sender Domains",
+                            "id": "0eda3153-10ea-4d4e-80ca-7e5ad99e9883"
+                          }
+                        ]
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "Overrides - User & Sender Detail",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "d5f38e54-a3c7-4df6-b569-bbabe85e1a36"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# False Negative(FN) Submissions insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **False Negative(FN) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message reported to have **Malware, Phish or Spam threat** within its **content, URLs or attachments**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "8"
+                      },
+                      "name": "text - 13 - Copy",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "3b243dca-89ce-41e6-bccb-9ceb0953aa2e"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Negative(FN) Admin submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message **False Negative(FN) Submissions performed by administrators** in Microsoft Defender for Office 365 where the message reported to have Malware, Phish or Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Prioritise admin-submitted misses for policy tuning; recurring sender domains may be block-list candidates."
+                            },
+                            "name": "fn admin - section header",
+                            "id": "64420254-0dae-4495-bd55-fc49e5bc1ed0"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions per-{Granularity} trend by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment). Helps to monitor where detections were missed and later submitted by admins as false negatives to Microsoft.**"
+                            },
+                            "name": "fn admin - trend heading",
+                            "id": "5f2de929-6f32-4079-a031-cbf689c15b29"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of admin false negative submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Malware_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Malware_URL_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Malware_Attach_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\"), Admin_Phish_URL_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Phish_Attach_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Malware (Mail)']=coalesce(Admin_Malware_FN,0), ['Phish (Mail)']=coalesce(Admin_Phish_FN,0), ['Spam (Mail)']=coalesce(Admin_Spam_FN,0), ['Malware (URL)']=coalesce(Admin_Malware_URL_FN,0), ['Malware (Attachment)']=coalesce(Admin_Malware_Attach_FN,0), ['Phish (URL)']=coalesce(Admin_Phish_URL_FN,0), ['Phish (Attachment)']=coalesce(Admin_Phish_Attach_FN,0) | sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalAdminSubmissions",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Phish (Mail)",
+                                    "color": "redBright"
+                                  },
+                                  {
+                                    "seriesName": "Spam (Mail)",
+                                    "color": "orange"
+                                  },
+                                  {
+                                    "seriesName": "Malware (Mail)",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Phish (URL)",
+                                    "color": "purple"
+                                  },
+                                  {
+                                    "seriesName": "Malware (Attachment)",
+                                    "color": "yellowDark"
+                                  },
+                                  {
+                                    "seriesName": "Phish (Attachment)",
+                                    "color": "purpleDark"
+                                  },
+                                  {
+                                    "seriesName": "Malware (URL)",
+                                    "color": "yellow"
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "fn admin - submissions trend",
+                            "id": "1b61155b-92a1-4533-9561-2e85e9a4dbf8"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment).**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - by-type heading",
+                            "id": "bbaa9ff9-a95d-495a-a44c-6b4cae888a24"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions by submission State\r\n**Displays the total count of False Negative(FN) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - by-state heading",
+                            "id": "b060c706-342a-4b2e-b81a-920bf4d8c5d9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false negative submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Malware (URL)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Malware (Attachment)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Phish (URL)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Phish (Attachment)\",\r\n\"Other\")))))))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - by-type pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9d9d714a-357b-4ac3-bcb7-33601d3c3108"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - by-state pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "169f0f1c-1f1e-44fb-965e-850733f01879"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN)/False Positive(FP) Admin Submissions by Triage Verdict\r\n**Displays the total count of False Negative(FN)/False Positive(FP) Admin Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - triage-verdict heading",
+                            "id": "3df841be-c1b0-4d61-8e38-316a34a48bd1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Admins Submitting False Negatives \r\n**Displays the top 15 admin accounts that submitted the highest number of false negative messages (missed detections) via AdminSubmission. Helps identify key contributors to threat remediation and potential patterns in detection gaps.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - top-admins heading",
+                            "id": "e1e966f4-1f4d-4377-97c6-e2077fc0b8fa"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - triage-verdict pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6df0db72-f9db-444e-856a-4369921d199b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top admins performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - top-admins pie",
+                            "id": "b5ccb4a1-9783-47cf-bf21-ded924f1a200"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions by Top Sender Domains\r\n**For each top sender domain that admins reported missed threats for, shows the domain's MDO-detected threat profile (emails with threats and the Malware/Phish/Spam breakdown), the count of admin FN submissions, and the submission rate (Admin Submission % = admin submissions / total inbound from the domain). A high rate can flag a domain whose mail is frequently reported as missed.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn admin - top-sender-domains heading",
+                            "id": "1a481c97-ac85-4b62-a86d-51b33b5a8e68"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 sender domains that admins reported false negatives (missed threats) for, with each domain's MDO-detected threat profile for context.\r\nlet subs = CloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\")\r\n| summarize AdminSubmissions=count() by P2SenderDomain;\r\nlet domainProfile = EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalInbound=count(), EmailsWithThreats=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by SenderFromDomain;\r\nsubs\r\n| join kind=leftouter (domainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend AdminSubmissionPct = round(AdminSubmissions * 100.0 / todouble(coalesce(TotalInbound, AdminSubmissions)), 2)\r\n| top 10 by AdminSubmissions desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails With Threats']=coalesce(EmailsWithThreats,0), ['Malware']=coalesce(Malware,0), ['Phish']=coalesce(Phish,0), ['Spam']=coalesce(Spam,0), ['Admin Submissions']=AdminSubmissions, ['Admin Submission %']=AdminSubmissionPct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails With Threats",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Admin Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "120px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Admin Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "110px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn admin - top-sender-domains table",
+                            "id": "e56bed92-b0fb-4b76-90f3-169f4206418b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions by admin Detection override types\r\n**Displays the top 10 cases where emails were submitted as false negatives by admins, even though they were initially detected by Microsoft Defender for Office 365 but delivered due to an admin policy override. Includes details on PolicyOverride, PolicySource, and DetectionVerdict for deeper insight into override behaviour.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn admin - override-types heading",
+                            "id": "293c174c-0197-4cf8-bbce-36fe42e5cf1b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was a admin policy override\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\"))),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\") and PolicyOverride !=\"NoOverride\"\r\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Override Source']=PolicyPolicyOverrideType, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn admin - override-types table",
+                            "id": "97799422-53e0-4e3b-8103-297fd1c744eb"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "8"
+                      },
+                      "name": "group - 11-Fn Admin Submissions",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "45a1c185-4fbf-4e83-832e-1f20af427796"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Negative(FN) User submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message **False Negative(FN) Submissions performed by end users** in Microsoft Defender for Office 365 where the message reported as having Phish, Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Recognise engaged reporters, coach over-reporters, and use graded phishing verdicts to tune anti-phishing policy."
+                            },
+                            "name": "fn user - section header",
+                            "id": "ca0b48e6-8bd8-4f99-956a-f9c72cc870db"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions per-{Granularity} trend by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) User Submissions grouped by submission type (Spam, Phish and Attack simulations) . Helps to monitor where detections were missed and later submitted by users as false negatives.**"
+                            },
+                            "name": "fn user - trend heading",
+                            "id": "60ac8608-7875-45e6-8c83-e6bd0c34af8b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize User_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_AttackSim_Submission=countif(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Phish (Mail)']=coalesce(User_Phish_FN,0), ['Spam (Mail)']=coalesce(User_Spam_FN,0), ['Attack simulation reported']=coalesce(User_AttackSim_Submission,0) | sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalAdminSubmissions",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Phish (Mail)",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Attack simulation reported",
+                                    "color": "green"
+                                  },
+                                  {
+                                    "seriesName": "Spam (Mail)",
+                                    "color": "orangeDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "fn user - submissions trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "29355816-6cba-4264-938e-b0b27afdcb12"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions by submission State\r\n**Displays the total count of False Negative(FN) User Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of user submissions and identify bottlenecks or errors.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - by-state heading",
+                            "id": "6a4b32cc-b7e4-47bb-b1b9-f415df7e629c"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions by Triage Verdict\r\n**Displays the total count of False Negative(FN)/False Positive(FP) User Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - triage-verdict heading",
+                            "id": "1427e34f-be44-4517-ae73-cc4776a49fe7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| summarize count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - by-state pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a6151271-e925-4804-a3c1-06afee27c026"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - triage-verdict pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6ff319ea-b5c5-4e33-9e5c-065aadbf465d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions of already detected Emails (from Junk folder)\r\n**Displays the total count of False Negative(FN) User Submissions where the email message was already detected by Microsoft Defender for Office 365 and the detection action was configured to deliver the message into the Junk folder of the user mailbox. It breaks down the result based on the original detection verdict determined by Microsoft Defender for Office 365. Helps track the user submissions of messages that already had a detection. Consider changing the detection action to Quarantine to avoid these submissions.**"
+                            },
+                            "name": "fn user - junk-folder heading",
+                            "id": "d6338907-489d-4c88-b82f-260fc0f9d302"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| summarize count() by ThreatTypes,User_SubmissionType\r\n| project ThreatTypes,User_SubmissionType, Emails = count_",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - junk-folder pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c13452cb-e864-4f01-8623-51f3ea13bbbc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId,UserId = (parse_json(RawEventData)).UserId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| summarize TotalJunkSubmittedEmailCount=count(),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by tostring(UserId)\r\n| top 15 by TotalJunkSubmittedEmailCount desc\r\n| project ['User']=UserId, ['Junk Submissions']=TotalJunkSubmittedEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Junk Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - junk-folder table",
+                            "id": "b242f301-c9f7-41f9-aa73-03848bd58eae"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions - Admin review status (Mark and Notify)\r\n**Displays counts of False Negative(FN) User Submissions that were reviewed by admins and marked with a notify action. The Mark and Notify action also can be taken automatically with Automated investigation and response (AIR). Helps track cases where admins confirmed user reports and communicated the outcome, supporting transparency and user trust.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - mark-notify heading",
+                            "id": "784bf171-53ae-4907-b2b0-7fc5039df231"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions accuracy vs Admin review verdict\r\n**Displays counts of False Negative(FN) User Submissions (Phish, Junk, NotJunk) compared to admin review results. Highlights whether submissions were Correct, Not Correct, or misclassified comparing user submission type with the Admin decision using Mark and Notify action in Microsoft Defender for Office 365 (e.g., “Phish reported as Junk”, “Reported but not malicious”).**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - accuracy heading",
+                            "id": "3d137383-6436-4213-9824-72f424b67290"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises user submissions where admin also performed 'mark and notify' action on the submission\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| summarize count() by Reviewed",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - mark-notify pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7bb7d116-bd61-4e46-81dd-d634a31e7369"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises user submissions type compared to admin review verdict. \r\n//Eg. User reporting a phish but admin review is 'not threat found'\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \"Correct\", iif(AdminReviewResult==\"Phish\" and UserReportedAs == \"Junk\", \"Phish reported as junk\",iif(AdminReviewResult==\"Junk\" and UserReportedAs == \"Phish\",\"Junk reported as Phish\",iif(AdminReviewResult==\"NotJunk\",\"Reported but not malicious or spam\",iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Not correct\")))))\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| where Reviewed==\"Reviewed\"\r\n| summarize count() by ReviewedAccuracy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - accuracy pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8af1b9f0-995c-4c58-9960-8e69c6960987"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 P2 Email Senders domains in False Negative(FN) User Submissions \r\n**Displays the top 10 P2 email sender domains of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per domain to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-p2-domains heading",
+                            "id": "78dab1f9-09ec-46e2-aee4-f256e368cdd5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top 10 sender domains of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromDomain;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromDomain\r\n| join TotalInboundbySender on SenderFromDomain\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Domain']=SenderFromDomain, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "12ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-p2-domains table",
+                            "id": "6e6a59d4-70e1-4d85-bebb-6bb23d25d2d9"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 P2 Individual Email Senders in False Negative(FN) User Submissions \r\n**Displays the top 10 P2 individual email sender addresses of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-p2-senders heading",
+                            "id": "a6e8fda5-dd05-49ed-87e2-16443495396e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top 10 sender email addresses of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "12ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-p2-senders table",
+                            "id": "878fd15f-2607-4d6d-b919-0b4bea6a1850"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Intra-org Email Senders in False Negative(FN) User Submissions \r\n**Displays the top 10 email senders of intra-org emails reported by users as false negatives (missed detections). Includes total intra-org email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - intraorg-senders heading",
+                            "id": "87a51814-7f01-42e3-aea2-4136c869d39d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top 10 sender email address of intra-org emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Intra-org\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Intra-org']=count_, ['User Submission %']=UserSubmissions_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Intra-org",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submission %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "12ch"
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - intraorg-senders table",
+                            "id": "38edca4b-a403-41e8-8c2b-7c0595e93b7a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Intra-org Email Subjects in False Negative(FN) User Submissions \r\n**Displays the top 10 Email Subjects of intra-org emails reported by users as false negatives (missed detections). Helps to highlight high-risk intra-org email sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - intraorg-subjects heading",
+                            "id": "52b0bc5b-7e54-4a5b-a487-8a736a8c2397"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize count() by Subject\r\n| top 10 by count_ desc\r\n| project ['Subject']=Subject, ['User Submissions']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Subject",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "70ch"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - intraorg-subjects table",
+                            "id": "ee2c1d2e-3d4e-4024-8422-985b22cb7475"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Detection Overrides defined by Admins in False Negative(FN) User Submissions \r\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to an admin-defined policy override. Includes details on OrgLevelAction, OrgLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - admin-override heading",
+                            "id": "0dd9b3ce-9716-42bb-93de-495f0af2d075"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an admin definded policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and OrgLevelAction!=\"\"\r\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Override Policy",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "48ch"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - admin-override table",
+                            "id": "100de6ca-beb0-44d7-a715-449a389e9e8a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Detection Overrides defined by Users in False Negative(FN) User Submissions \r\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to a user-defined override. Includes details on UserLevelAction, UserLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - user-override heading",
+                            "id": "67057c7d-c0af-4373-b23a-4001fbced888"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and UserLevelAction!=\"\"\r\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Override Policy",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "48ch"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - user-override table",
+                            "id": "1b97f7d2-152d-4eb0-bfac-e161fbfa4046"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 users performing the most False Negative(FN) User Submissions\r\n**Displays the Top 10 user accounts that performed the highest number of False Negative(FN) User Submissions (missed detections). Helps identify individuals most engaged in reporting suspicious, malicious messages and potential patterns in detection gaps.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-users heading",
+                            "id": "7799a0a0-a835-4080-b59a-736b08ad809e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 users performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-users pie",
+                            "id": "44838734-43a0-4301-9ddb-a644c7ec509a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 users performing the most User Submissions of Attack simulation messages\r\n**Displays the top 10 user accounts that reported phishing simulation emails during cyber security awareness campaigns. Supports evaluation of cyber security awareness programme effectiveness and identifies highly engaged users.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - attacksim-users heading",
+                            "id": "8a96e90f-765f-40c0-8476-30c97d43c328"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top users reporting the phishing simulation emails.\r\nCloudAppEvents \r\n| extend Record= (parse_json(RawEventData)).RecordType \r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState \r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| where Record == 29\r\n| where ActionType == \"AttackSimUserSubmission\" \r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - attacksim-users pie",
+                            "id": "ab648c4a-4c46-4c73-96f0-784c9bcef961"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "8"
+                      },
+                      "name": "group - 11 - FN User submissions",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "348ce24a-7cbc-4b66-a471-dfe3827bed2d"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# False Positive(FP) Submissions insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **False Positive(FP) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by administrators or users."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "10"
+                      },
+                      "name": "fp - tab description",
+                      "id": "78e2df52-a0d2-499a-95fe-708f67db5ad6"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Positive(FP) Admin Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nAdministrator submissions represent escalated false positive reports submitted by security team members rather than end users. These typically involve more complex cases requiring expert review, such as recurring issues affecting multiple users, business-critical communications being blocked, or suspected policy misconfigurations. Admin submissions carry higher priority and can result in actions as allow-list additions or global policy changes to prevent widespread user impact.<br><br>**Recommended action:** Review recurring false-positive sender domains and consider allow entries or policy tuning to reduce business disruption."
+                            },
+                            "name": "fp admin - section header",
+                            "id": "02d54e9c-e989-4cde-a128-68a6381ed9d7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Submission Volume and Type Breakdown\r\n\r\n**These charts track the volume and composition of administrator-initiated false positive submissions. The trend chart shows submission patterns (per {Granularity}) across Email, URL, and Attachment types, while the pie chart reveals the distribution among these categories. Spikes in admin submissions often signal systemic issues requiring immediate policy review, as admins typically escalate only the most impactful or recurring problems.**"
+                            },
+                            "name": "fp admin - volume/type heading",
+                            "id": "103b8362-a10f-4b46-a757-8290c4269a5c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of admin false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Email_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_URL_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Attach_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Email']=coalesce(Admin_Email_FP,0), ['URL']=coalesce(Admin_URL_FP,0), ['Attachment']=coalesce(Admin_Attach_FP,0) | sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalAdminSubmissions",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Phish_FN",
+                                    "color": "redBright"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Spam_FN",
+                                    "color": "orange"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Malware_FN",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Phish_URL_FN",
+                                    "color": "purple"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Malware_Attach_FN",
+                                    "color": "yellowDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Phish_Attach_FN",
+                                    "color": "purpleDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Malware_URL_FN",
+                                    "color": "yellow"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Email_FP",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_URL_FP",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Attach_FP",
+                                    "color": "yellow"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "fp admin - submissions trend",
+                            "id": "326762ca-1f2b-48e9-90d6-ff2aa6a75e95"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false positive submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Email\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"URL\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Attachment\",\r\n\"Other\")))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "33",
+                            "name": "fp admin - by-type pie",
+                            "id": "be925c4c-5718-4385-8e82-59c57b975ac5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Positive(FP) Admin Submissions by submission state<br>\r\n\r\n**Displays the total count of False Positive(FP) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - by-state heading",
+                            "id": "2b2acb67-c070-48bd-acf1-025c05aae8b5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Admins Submitting False Positives<br>\r\n\r\n**Displays the top 15 admin accounts that submitted the highest number of false positive messages via AdminSubmission.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - top-admins heading",
+                            "id": "52206f40-fae9-460f-97b8-2cf9b633098f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false positive submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - by-state pie",
+                            "id": "96133d9e-24fb-417e-a3cd-df98dda4c60a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top admins performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \r\n| where Record == 29 and SubmissionType ==\"3\"\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - top-admins pie",
+                            "id": "da7b4c89-904d-4917-b6cd-04b32e02d4a1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Submission False Positive Malware Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as malware.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - malware-detection heading",
+                            "id": "69d649e0-86fd-4c08-afd4-e6c200b11c86"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Admin false positive submissions whose original verdict was Malware, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Malware.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Malware\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Malware\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Malware FPs'] = Pct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "% of",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - malware-detection table",
+                            "id": "607eb19b-1ded-488d-98db-8b23f9e90967"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Submission False Positive Phish Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - phish-detection heading",
+                            "id": "c1f1e12f-d0aa-4023-9172-8182772b3331"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Admin false positive submissions whose original verdict was Phish, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Phish.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Phish\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Phish\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Phish FPs'] = Pct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "% of",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - phish-detection pie",
+                            "id": "b6c074f9-affa-41a3-802a-53541394ae73"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Submission False Positive Spam Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - spam-detection heading",
+                            "id": "f0f2adb9-34af-4df0-90e6-087a265bedf6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Admin false positive submissions whose original verdict was Spam, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Spam.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Spam\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Spam\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Spam FPs'] = Pct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "% of",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - spam-detection pie",
+                            "id": "e877d9c9-3bd3-4368-997e-945f18ffcf5f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains for Admin False Positive Submissions<br>\r\n\r\n**Lists the top 10 sender domains of emails reported as false positives by administrators (legitimate messages incorrectly flagged as spam or phishing). Helps identify domains frequently misclassified.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - top-sender-domains heading",
+                            "id": "37680101-7e4b-4bcc-9e7e-0ccd2d914881"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin False Positive Submissions by Original Threat Verdict<br>\r\n\r\n**Displays all administrator-submitted false positive emails by their original filter verdict (e.g., spam, phishing) and policy override details. Helps identify which threat categories are most often misclassified.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - by-verdict heading",
+                            "id": "879e81ad-00a6-4a10-bcb6-56879133bb9f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 sender domains of emails which are submitted as false positive by admins\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType ==\"3\"\r\n| summarize count() by P2SenderDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - top-sender-domains table",
+                            "id": "42844dc9-4418-487b-a5ad-31e1f6b4b487"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Email\",\r\n\"Other\"),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - by-verdict table",
+                            "id": "3ebbd402-06ef-45a7-b4ee-c5938b98b540"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "10"
+                      },
+                      "name": "fp admin - group",
+                      "styleSettings": {
+                        "showBorder": true
+                      },
+                      "id": "b6215b53-c181-4693-a14f-441809f65f38"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Positive (FP) User Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message False Postive(FP) Submissions performed by end users in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by users. User submissions are critical feedback mechanisms that help security teams identify overly aggressive detection rules, refine security policies, and reduce user friction. High false positive rates can erode user trust and lead to security fatigue, so monitoring these metrics helps balance protection with productivity.<br><br>**Recommended action:** High user false-positive volume suggests over-aggressive filtering - review the affected senders and adjust policy."
+                            },
+                            "name": "fp user - section header",
+                            "id": "0d93d7ee-a61e-43b7-bdcd-172bd79ad050"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Submission Trend\r\n\r\n**Displays the volume (per {Granularity}) of false positive submissions from end users. A sudden spike may indicate a new detection rule causing widespread misclassification, while a declining trend suggests improving detection accuracy. Monitoring this trend helps security teams respond quickly to detection issues before they impact user productivity.**"
+                            },
+                            "name": "fp user - trend heading",
+                            "id": "c3f8ae45-0498-4fa8-b9d1-35e926932639"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of user false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where SubmissionType == \"3\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User FP Submissions'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "User FP Submissions",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - submissions trend",
+                            "id": "847032f5-56a8-4681-9665-9e917c7c9355"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User False Positive Submissions by State<br>\r\n\r\n**Displays the total number of user-reported false positive email submissions grouped by their processing state (e.g., pending, completed). Helps track submission workflow and resolution progress.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp user - by-state heading",
+                            "id": "7bd03278-7734-4fbf-a502-95b42e90160e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Users Performing False Positive Submissions<br>\r\n\r\n**Lists the top 15 users who reported emails as false positives (legitimate messages incorrectly flagged as threats). Helps identify frequent reporters and potential training or policy adjustment needs.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp user - top-users heading",
+                            "id": "7e2b987b-325d-4f69-8d6b-fafd6676a03a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false positive submission by submission state.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fp user - by-state pie",
+                            "id": "df79d08b-3eac-4101-a3f2-3a4a3bf450ce"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top users performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fp user - top-users pie",
+                            "id": "ec7505d8-3a70-4bde-a985-baf5a0c4ec34"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Submission False Positive Malware Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection technique that flagged them. Malware quarantine is admin-only by default, so this table only populates when a custom quarantine policy lets users view and report their own malware detections - it is usually empty.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - malware-verdict heading",
+                            "id": "693b1072-5ddd-49d0-a0f5-2bba4c287edf"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//User false positive submissions whose email was originally flagged as Malware, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Malware.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Malware\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "22ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - malware-verdict table",
+                            "id": "10ea55bd-937e-454d-b6cc-a9dccfdf3417"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Submission False Positive Phish Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - phish-verdict heading",
+                            "id": "6dd14abb-2772-4271-89d8-8c0dcdbfd9e5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//User false positive submissions whose email was originally flagged as Phish, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Phish.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Phish\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "22ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - phish-verdict pie",
+                            "id": "57049aad-eb17-4e65-a8a4-b5d05b0501cd"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Submission False Positive Spam Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - spam-verdict heading",
+                            "id": "5479b2ed-b629-41e7-9857-c91191b09c8f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//User false positive submissions whose email was originally flagged as Spam, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Spam.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Spam\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "22ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - spam-verdict pie",
+                            "id": "45a2122e-0281-4602-906d-a0406ed20d54"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains for User False Positive Submissions<br>\r\n\r\n**Lists the top 10 sender domains of emails reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify domains frequently misclassified.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-sender-domains heading",
+                            "id": "2751fca4-3ac5-45fe-a965-8c811018926a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 sender domains reported as false positives by users, with each domain's total inbound volume and the share of it reported as FP (a high rate flags a domain whose legitimate mail is most often misclassified).\r\nlet totalByDomain = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderFromDomain;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize FPSubmissions = count() by P2SenderDomain\r\n| join kind=leftouter (totalByDomain) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Domain'] = P2SenderDomain, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "18ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "FP Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-sender-domains table",
+                            "id": "c69b126d-9f25-44a0-b96d-601d89a563f1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Senders in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 email senders whose messages were reported as false positives by users (legitimate emails incorrectly flagged as threats). Helps identify senders frequently misclassified.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-senders heading",
+                            "id": "b39966ad-2b40-4144-ae3f-c7ac6b9fb97c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 email senders reported as false positives by users, with each sender's total inbound volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "18ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "FP Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-senders table",
+                            "id": "077ab610-58ed-4d23-886c-dbf912cef2d7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Subjects in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 email subjects reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify common patterns in misclassified emails.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-subjects heading",
+                            "id": "a5b939e1-0fbf-4ee1-a6a3-01fa7639af3a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 email subjects reported as false positives by users, with how many distinct recipients reported each (a subject reported by many users is a broad misclassification pattern).\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count(), DistinctRecipients = dcount(RecipientObjectId) by Subject\r\n| top 10 by FPSubmissions desc\r\n| project ['Subject'] = Subject, ['FP Submissions'] = FPSubmissions, ['Distinct Recipients'] = DistinctRecipients",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Subject",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "70ch"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Recipients",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "18ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-subjects table",
+                            "id": "71d5c290-f5d0-493c-b821-b5345dbe7312"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Intra-Org Senders in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 internal senders whose emails were reported as false positives by users (legitimate intra-org messages incorrectly flagged as threats). Helps identify internal communication patterns causing misclassification.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - intraorg-senders heading",
+                            "id": "1d38f458-dfde-4608-ad7d-ee8628e85ee7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 internal senders whose emails were reported as false positives by users, with total intra-org volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Intra-org\" | summarize TotalIntraOrg = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalIntraOrg) or TotalIntraOrg == 0, 0.0, round(FPSubmissions * 100.0 / TotalIntraOrg, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Intra-org'] = coalesce(TotalIntraOrg, 0), ['FP Submission %'] = FPPct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Intra-org",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "18ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "FP Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - intraorg-senders table",
+                            "id": "b6699a7f-897a-4016-ae2c-d816f3a9492b"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "10"
+                      },
+                      "name": "fp user - group",
+                      "styleSettings": {
+                        "showBorder": true
+                      },
+                      "id": "2ad3311e-e92b-4a49-bdd0-775f085c4587"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# File Malware Detections (SharePoint, Teams and OneDrive)\r\n\r\n---\r\n\r\nThis tab provides insights into malicious file detections across Microsoft collaboration platforms such as SharePoint, OneDrive, and Teams.\r\n\r\n[<p><b>Safe Attachments for SharePoint, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-about)\r\n[<p><b>Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-for-spo-odfb-teams-about) "
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "9"
+                      },
+                      "name": "filemal - tab description",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "cefcac88-f373-4748-b0ea-e7600f63edd7"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//Microsoft Defender for Office 365 value for files in SharePoint / OneDrive / Teams: total files processed, how many had a malware detection, and how many were scanned with no detection. A per-period Trend series feeds the tile sparkline.\r\nlet gran = {Granularity};\r\nlet base = FileMaliciousContentInfo;\r\nlet counts = union\r\n(base | summarize Count = count() | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files Scanned - No Detection\", Ord = 3);\r\nlet tagged = union\r\n(base | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\"),\r\n(base | where isnotempty(ThreatTypes) | extend Cat = \"Files with Malware Detected\"),\r\n(base | where isempty(ThreatTypes) | extend Cat = \"Files Scanned - No Detection\");\r\nlet trends = tagged | make-series Trend = count() default = 0 on Timestamp step gran by Cat;\r\ncounts\r\n| join kind=leftouter (trends) on Cat\r\n| sort by Ord asc\r\n| project Count, Details = Cat, Trend",
+                        "size": 3,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "name": "filemal - MDO value tiles",
+                      "id": "843e58a9-6324-4a90-a652-bfb0549e79dc",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "9"
+                      }
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">File Malware Detection (SharePoint, OneDrive, and Teams)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section monitors malware detections in files stored across Microsoft 365 collaboration platforms. Microsoft Defender for Office 365 and built-in SharePoint Online antivirus work together to scan files uploaded to SharePoint, OneDrive, and Teams. Understanding file-based malware patterns helps protect collaborative workspaces and identify potential security risks in shared content.<br><br>**Recommended action:** For repeat file owners or sites, investigate possible compromise and confirm Safe Attachments for SharePoint, OneDrive and Teams is enabled."
+                            },
+                            "name": "filemal - section header",
+                            "id": "373fe4e5-fc90-49cf-93ba-c8b100efce57"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### File Malware Detection Trend<br>\r\n\r\n**This visual tracks the volume (per {Granularity}) of malware detections in files across all Microsoft 365 workloads. Spikes in detection activity may indicate targeted attacks or emerging malware campaigns affecting collaborative platforms. Regular monitoring helps identify unusual patterns that require investigation.**"
+                            },
+                            "name": "filemal - trend heading",
+                            "id": "30145585-8998-443a-b6ec-062d136c621f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(FileMaliciousContentInfo\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Files']=coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "tileSettings": {
+                                "showBorder": false
+                              },
+                              "graphSettings": {
+                                "type": 0
+                              },
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Files",
+                                    "color": "blueDark"
+                                  }
+                                ],
+                                "showDataPoints": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - detection trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d39cea9b-75a8-4c29-bfdb-2e0db855e98a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Family Analysis - Defender for Office 365\r\n**Provides a breakdown of malware detections in files scanned by Microsoft Defender for Office 365 (Safe Attachments detonation) across SharePoint, OneDrive, and Teams. The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify dominant threats and their spread across collaboration platforms.**"
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - family MDO heading",
+                            "id": "4e330873-f732-4d37-a7b0-dced08b019b0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes File malware detections by Microsoft Defender for Office 365 (Safe Attachments detonation) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"detonation\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "tileSettings": {
+                                "showBorder": false,
+                                "titleContent": {
+                                  "columnMatch": "RawinfoVirusInfo",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "auto"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              },
+                              "graphSettings": {
+                                "type": 0,
+                                "topContent": {
+                                  "columnMatch": "RawinfoVirusInfo",
+                                  "formatter": 1
+                                },
+                                "centerContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 1,
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              },
+                              "chartSettings": {
+                                "xAxis": "RawinfoVirusInfo",
+                                "createOtherGroup": 15
+                              },
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Files",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - family MDO table",
+                            "id": "c3fbb1c9-be67-43b9-9a32-7fb265a84ffc"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Family Analysis - SharePoint AV\r\n**Provides a breakdown of malware detections in files across SharePoint, OneDrive, and Teams caught by the built-in SharePoint antivirus (Antimalware engine). The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify prevalent threats and their spread across collaboration environments.**"
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - family SPO-AV heading",
+                            "id": "331a8361-6e81-4615-b33a-97ebb3e31529"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes File malware detections by the built-in SharePoint antivirus (Antimalware engine) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"Antimalware engine\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "chartSettings": {
+                                "xAxis": "RawinfoVirusInfo",
+                                "createOtherGroup": 10
+                              },
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Files",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - family SPO-AV table",
+                            "id": "bbcdccd9-eedb-476a-a0e7-8504f8770229"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Location<br>\r\n\r\n**Displays the number of malware detections grouped by specific SharePoint sites or OneDrive locations. Helps identify which sites have the highest volume of detected threats for targeted remediation and security hardening.**"
+                            },
+                            "customWidth": "50",
+                            "name": "filemal - by-location heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c5668d6e-7c0e-4ce3-9509-ca93dda3efad"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Application<br>\r\n\r\n**Summarizes malware detections across Microsoft collaboration apps, including SharePoint, OneDrive, and Teams. Helps identify which applications experience the highest volume of detected threats for targeted security measures.**"
+                            },
+                            "customWidth": "50",
+                            "name": "filemal - by-application heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "07e64ca9-04a2-44b2-a044-e927bc73ef1b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists total Malware detections of files on SharePoint, OneDrive and Teams by the location (site or personal path) where the file resides.\r\nFileMaliciousContentInfo\r\n| extend ['Site / Location'] = tostring(split(FolderPath, '/')[4])\r\n| summarize ['Detections'] = count() by ['Site / Location']\r\n| sort by ['Detections'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "filemal - by-location table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3ce3ea65-a4df-450f-871c-8956d59818a9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams summarizing the data by the Microsoft collaboration application (workload).\r\nFileMaliciousContentInfo\r\n| summarize count() by Workload\r\n| sort by count_ desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "filemal - by-application pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "003afc8e-0403-4aa9-9084-a3c2e435216a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top File Owners Holding Malware\r\n**Lists the users (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, with the count of malicious files, distinct files, affected workloads and sample threat names. Helps pinpoint the accounts and collaboration locations most affected by malicious content for targeted remediation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - top-owners heading",
+                            "id": "c2f8d3b5-0a4e-4b7c-9d23-8e6f0a1b2c34"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top file owners (or the SharePoint/Teams site, when a file has no user owner) whose SharePoint/OneDrive/Teams files were flagged as malware, with distinct files, workloads and sample threat names.\r\nFileMaliciousContentInfo\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Malicious Files'] = count(),\n            ['Distinct Files']  = dcount(SHA256),\n            ['Workloads']       = make_set(Workload, 3),\n            ['Sample Threats']  = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\n            ['Last Seen']       = max(Timestamp)\n        by ['Owner']=Owner\n| top 20 by ['Malicious Files']",
+                              "size": 0,
+                              "title": "Top File Owners Holding Malware",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malicious Files",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Files",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "filemal - top-owners table",
+                            "id": "36d9a683-9f9d-4a70-84d9-ec351542f827"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "9"
+                      },
+                      "name": "filemal - group",
+                      "styleSettings": {
+                        "showBorder": true
+                      },
+                      "id": "50886cd9-87bf-4a84-bd80-d7f44441b3f7"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Post-Delivery &amp; Quarantine Insights\r\n\r\n---\r\nThis tab covers what happens to threats **after delivery**: Zero-hour Auto Purge (ZAP) remediation of malicious messages already in mailboxes, and quarantine management - what is held, released, and by whom. Together they show how effectively post-delivery response contains threats that reached the inbox."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "11"
+                      },
+                      "name": "postdelivery - tab description",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "93371620-d968-4987-bddd-6c9b9e5a0344"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Post Delivery Protection offered by ZAP\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into Microsoft Defender for Office 365's post-delivery protection capabilities through Zero-Hour Auto Purge (ZAP). ZAP is a critical security feature that continuously monitors delivered emails and automatically removes messages that are later identified as malicious. These visuals help track ZAP effectiveness, response times, and remediation patterns.<br><br>**Recommended action:** High post-delivery ZAP volume means threats are reaching inboxes before being caught - review pre-delivery filtering and detection latency."
+                            },
+                            "name": "postdelivery - section header",
+                            "id": "b22ee5f1-a2dc-4509-92a3-1dbcad3a6ee7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP Post-Delivery Actions (per {Granularity})<br>\r\n\r\n**Shows the count (per {Granularity}) of emails that were remediated post-delivery by Zero-Hour Auto Purge (ZAP). Helps track how often threats are detected and removed after reaching user mailboxes.**"
+                            },
+                            "customWidth": "50",
+                            "name": "postdelivery - zap-actions heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "af1aa73f-d952-4827-bcc9-b97a19016829"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP Actions by Detection Type (per {Granularity})<br>\r\n\r\n**Visualizes the count (per {Granularity}) of post-delivery remediation actions performed by Zero-Hour Auto Purge (ZAP), broken down by detection type (Spam ZAP, Phish ZAP, Malware ZAP). Helps track which threat categories are most frequently remediated after delivery.**"
+                            },
+                            "customWidth": "50",
+                            "name": "postdelivery - by-detection-type heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8eb38cb1-4e2d-435a-81be-e661c9b89ff4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailPostDeliveryEvents \r\n| where ActionType has \"ZAP\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Zapped Emails'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Zapped Emails",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "postdelivery - zap-actions trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "dd60fd71-4e14-4b38-ad22-39f1e3e3f55a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType has \"ZAP\"\r\n| summarize [\"Spam ZAP\"]=countif(ActionType has 'Spam ZAP'), [\"Phish ZAP\"]=countif(ActionType has 'Phish ZAP'), [\"Malware ZAP\"]=countif(ActionType has 'Malware ZAP') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Spam ZAP\"]=coalesce([\"Spam ZAP\"],0), [\"Phish ZAP\"]=coalesce([\"Phish ZAP\"],0), [\"Malware ZAP\"]=coalesce([\"Malware ZAP\"],0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "50",
+                            "name": "postdelivery - by-detection-type trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "511f4a43-9f56-48ad-a644-b72722af82d7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP Remediation by Destination<br>\r\n\r\n**This visual shows where ZAP moves malicious emails during remediation. Post-delivery actions can send emails to different locations: Quarantine (isolated for admin review), Deleted Items (soft delete), Junk Email folder, or back to Inbox (for false positive corrections). Understanding these patterns helps evaluate ZAP policy configurations and ensures malicious content is properly isolated from users.**"
+                            },
+                            "name": "postdelivery - by-destination heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "dc7b9b6c-36fb-4ae4-a3e8-ff11da681c97"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType contains \"ZAP\"\r\n| summarize Quarantine=countif(DeliveryLocation has 'Quarantine'), ['Deleted Items']=countif(DeliveryLocation has 'Delete'), Junk=countif(DeliveryLocation has 'Junk'), Inbox=countif(DeliveryLocation has 'Inbox') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Quarantine=coalesce(Quarantine,0), ['Deleted Items']=coalesce(['Deleted Items'],0), Junk=coalesce(Junk,0), Inbox=coalesce(Inbox,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "name": "postdelivery - by-destination trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "cbb737ef-1c7e-4b3e-af26-a553fe6147c9"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "11"
+                      },
+                      "name": "postdelivery - group",
+                      "styleSettings": {
+                        "showBorder": true
+                      },
+                      "id": "e436ecee-8886-4179-a578-9e4a42e75b9e"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Quarantine Management and Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides comprehensive insights into quarantine operations, including release patterns, detection methods, and threat categorization. It helps security teams understand what types of threats are being quarantined and monitor quarantine release activity to identify potential false positives or security policy effectiveness.<br><br>**Recommended action:** Investigate high release rates - they indicate false positives or risky user releases; review quarantine policies and release permissions."
+                            },
+                            "name": "quarantine - section header",
+                            "id": "c4862977-6670-4716-8109-252a361d7478"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Quarantine Release Trend<br>\r\n\r\n**This visual displays the per-{Granularity} trend of emails released from quarantine by administrators. Monitoring this metric helps identify patterns in quarantine management and potential areas where policy adjustments may be needed to reduce unnecessary quarantines.**"
+                            },
+                            "name": "quarantine - release-trend heading",
+                            "id": "8526a5e0-c6a4-44e3-b00a-5e135374f58e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of emails released from quarantine\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\" and Action has 'Quarantine release'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Quarantine Releases'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Quarantine Releases",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - release trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3625d1f1-f34a-4cbf-a78f-eb2e5506bad4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Quarantine Release Percentage<br>\r\n\r\n**Calculates the percentage of quarantined emails that were successfully released compared to the total quarantined messages. This metric helps measure engagement with quarantine and assess the effectiveness of quarantine policies.**"
+                            },
+                            "customWidth": "40",
+                            "name": "quarantine - release-pct heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e3a9502c-9030-4621-b248-55cdf69f81ae"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Quarantine Release Analysis by Detection Type<br>\r\n\r\n**For each detection technology, this shows the share of its quarantined emails that were later released from quarantine (Release % = released / quarantined). A high release rate flags a detector that may be over-flagging legitimate mail - a strong candidate for policy or rule tuning. The Released count shows the volume behind each rate.**"
+                            },
+                            "customWidth": "60",
+                            "name": "quarantine - release-by-detection heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "976fc90f-bf46-4315-b05e-4e501b37b869"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "title": " ",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "stat",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Release_Percentage",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "none"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 1,
+                                    "options": {
+                                      "style": "decimal"
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "sortCriteriaField": "Release_Percentage",
+                                "size": "auto"
+                              },
+                              "statSettings": {
+                                "valueField": "Release_Percentage",
+                                "valueAggregation": "None",
+                                "colorSettings": {
+                                  "type": "thresholds",
+                                  "mode": "foreground",
+                                  "heatmapPalette": "greenRed",
+                                  "thresholdsGrid": [
+                                    {
+                                      "operator": "<",
+                                      "thresholdValue": "5",
+                                      "representation": "green"
+                                    },
+                                    {
+                                      "operator": ">",
+                                      "thresholdValue": "5",
+                                      "representation": "redDark"
+                                    }
+                                  ]
+                                },
+                                "iconSettings": {
+                                  "thresholdsGrid": []
+                                },
+                                "numberFormatSettings": {
+                                  "unit": 1,
+                                  "options": {
+                                    "style": "decimal"
+                                  }
+                                },
+                                "tagText": "Quarantine Release Percentage",
+                                "valueFontStyle": "mega",
+                                "tagTextPosition": "bottom"
+                              }
+                            },
+                            "customWidth": "40",
+                            "name": "quarantine - release-pct stat",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "64e157ce-2f6a-423f-9ce5-eade8b6f41d5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Per detection technology: the share of its quarantined emails that were later released from quarantine.\r\n//Release % = released / quarantined for that detection technology - a high rate flags a detector that may be over-flagging legitimate mail (potential false positives). Detectors with fewer than 10 quarantined emails are excluded so the rate is statistically meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\r\n| join kind=leftouter (\r\n    EmailPostDeliveryEvents\r\n    | where Action == \"Quarantine release\"\r\n    | distinct NetworkMessageId\r\n    | extend ReleasedFlag = \"yes\"\r\n  ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Quarantined Emails",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Released",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Release %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "60",
+                            "name": "quarantine - release-by-detection pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9a6d21b7-7542-4ae5-8f3f-b18474b52a20"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Email Quarantine Analysis<br>\r\n\r\n**These visuals break down quarantined malware emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple malware detection techniques including file detonation, file reputation analysis, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-malware policies and identify emerging malware tactics.<br>The line chart shows per-{Granularity} trends across all malware detection methods, while the table provides an overall distribution of detection reasons.**"
+                            },
+                            "name": "quarantine - malware heading",
+                            "id": "59f84161-a010-44c2-aec1-b72ed98ccdff"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of malware emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Malware\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - malware trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a54a8daf-0be2-4c0e-a8d7-4ff0e0879fd2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of malware emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Malware (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Malware' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Malware)\r\n| summarize count() by Malware\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Malware, ['Detections']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - malware table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b5d0d022-cf41-47e5-ae06-cf2176b47758"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phishing Email Quarantine Analysis<br>\r\n\r\n**These visuals break down quarantined phishing emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple phishing detection techniques including impersonation protection, URL detonation, spoof detection, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-phishing policies and identify emerging phishing tactics.<br>The line chart shows per-{Granularity} trends across all phishing detection methods, while the table provides an overall distribution of detection reasons.**"
+                            },
+                            "name": "quarantine - phish heading",
+                            "id": "aca50104-cb68-4a8f-82ee-ea8eee25fe14"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of phish emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Phish\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - phish trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "57151360-0577-45ce-8fc6-10a3790865ce"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of phish emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Phish (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Phish)\r\n| summarize count() by Phish\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Phish, ['Detections']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - phish pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "df78c64b-76f6-4980-80df-d0d432e780a5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Email Quarantine Analysis<br>\r\n\r\n**These visuals provide detailed insights into quarantined spam emails categorized by detection methods. Spam detection technologies include advanced filters, general filters, bulk email filtering, reputation-based systems (IP, domain, URL), and mixed analysis detection. Analyzing spam quarantine patterns helps fine-tune spam filtering policies to balance security with user productivity and reduce false positives.<br>The line chart displays per-{Granularity} trends for each spam detection method, while the table shows the overall distribution.**"
+                            },
+                            "name": "quarantine - spam heading",
+                            "id": "e131910f-0233-474a-a9b8-9f70a49246cf"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of spam emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet baseQuery = EmailEvents\r\n| where DetectionMethods has \"Spam\" and DeliveryLocation == \"Quarantine\";\r\nlet agg = materialize(baseQuery\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - spam trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5762bcc7-bbda-4a3d-91cf-de18fbdd2775"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of spam emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Spam (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Spam)\r\n| summarize count() by Spam\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Spam, ['Detections']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - spam pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "2995f55b-17f9-458b-8630-e0370d14522a"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "11"
+                      },
+                      "name": "quarantine - group",
+                      "id": "430294af-c68f-4427-8b55-d552a3d89d42",
+                      "styleSettings": {
+                        "showBorder": true
                       }
-                    ],
-                    "entityType": "Host"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Security Operations Center (SOC) Insights \r\n\r\n---\r\n\r\nThis tab provides a view for security operations. Combines incident response metrics with investigation insights to evaluate the effectiveness of both automated systems and manual interventions."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "13"
+                      },
+                      "name": "soc - tab description",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "fd65243c-514c-4813-978f-fb908226d049"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Security Incident Response Metrics\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Operational efficiency insights.** Tracks incident volume, resolution speed, automation efficacy, and classification accuracy to evaluate SOC performance.<br><br>**Recommended action:** Track mean time to close by severity against your SLA and investigate any severity trending upward."
+                            },
+                            "name": "soc - incident-metrics section header",
+                            "id": "f92c3e24-3e0f-4f4c-8ee9-3ec60832f7b1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Email Security Incidents<br>\r\n\r\n**These visuals display the per-{Granularity} trend of email-related security incidents, as well as the proportion of email incidents compared to the total number of incidents in Defender.**"
+                            },
+                            "name": "soc - email-incidents heading",
+                            "id": "c1cf6796-6071-4d2e-bf2c-c5e8d2a99a12"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// Filter for incidents that have at least one Email Security alert\r\nlet gran = {Granularity};\r\nlet OfficeEmailAlerts = SecurityAlert\r\n    | where ProductName contains \"Office 365 Advanced Threat Protection\" or ProductName contains \"Microsoft 365 Defender\"\r\n    | project SystemAlertId;\r\nlet agg = materialize(SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds) \r\n| join kind=inner\r\n    (OfficeEmailAlerts | extend SystemAlertId = tostring(SystemAlertId))\r\n    on $left.AlertId == $right.SystemAlertId\r\n| summarize arg_max(TimeGenerated, *), AlertCount = dcount(AlertId) by IncidentNumber\r\n| summarize Incidents_Number = count() by TimeGenerated = bin(TimeGenerated, gran));\r\nrange TimeGenerated from toscalar(agg | summarize min(TimeGenerated)) to toscalar(agg | summarize max(TimeGenerated)) step gran\r\n| join kind=leftouter (agg) on TimeGenerated\r\n| project TimeGenerated, ['Email Security Incidents'] = coalesce(Incidents_Number, 0)\r\n| sort by TimeGenerated asc",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Email Security Incidents",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "75",
+                            "name": "soc - email-incidents trend",
+                            "id": "e23cfcda-1017-4fd0-ac71-8a861c450f71"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// Categorize incidents: Email Security vs Other\r\nlet AllAlerts = SecurityAlert\r\n    | extend SystemAlertId = tostring(SystemAlertId)\r\n    | project SystemAlertId, ProductName;\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds)\r\n| join kind=inner\r\n    (AllAlerts)\r\n    on $left.AlertId == $right.SystemAlertId\r\n| summarize AlertSystems = make_set(ProductName) by IncidentNumber\r\n| extend HasEmailSecurity = \r\n    AlertSystems has \"Office 365 Advanced Threat Protection\" or \r\n    AlertSystems has \"Microsoft 365 Defender\"\r\n| extend Category = iff(HasEmailSecurity, \"Email Security\", \"Other\")\r\n| summarize IncidentCount = count() by Category\r\n",
+                              "size": 3,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "25",
+                            "name": "soc - incident-category pie",
+                            "id": "baae2150-1b04-43b4-9713-48fd3cc6247f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Average Incident Time To Close (minutes)\r\n**This visual displays the average time, in minutes, to close email-related security incidents (per {Granularity}), split by severity, so you can see how resolution speed changes over time. Reference SLA targets: High 60, Medium 120, Low 240, Informational 480 minutes.**"
+                            },
+                            "name": "soc - time-to-close heading",
+                            "id": "e23ccc6c-b0f0-407b-8e01-d8b69c40a745"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// SLA thresholds by severity for email-security (MDO) incidents\r\nlet SLA_Variables = datatable (Severity:string, TimeToResolve:int) [\r\n    \"High\", 60,\r\n    \"Medium\", 120,\r\n    \"Low\", 240,\r\n    \"Informational\", 480\r\n];\r\n\r\n// Identify MDO-related incidents via alert correlation\r\nlet EmailSecurityIncidents = \r\n    SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for each MDO-related incident\r\nlet LatestMdoIncidents =\r\n    SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, Severity, CreatedTime, ClosedTime, Title) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    | where not(Title startswith \"CC_\");  // Exclude non-email incidents as needed\r\n\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| extend TimeToResolveIncident = datetime_diff('minute', ClosedTime, CreatedTime)\r\n| join kind=inner SLA_Variables on Severity\r\n| summarize\r\n    ['Avg Time to Close (min)'] = avg(TimeToResolveIncident),\r\n    CountIncidents = count(), Breached = countif(TimeToResolveIncident > TimeToResolve)\r\n    by Day = bin(ClosedTime, 1d), Severity\r\n| order by Day asc, Severity asc",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Day",
+                                "yAxis": [
+                                  "Avg Time to Close (min)"
+                                ],
+                                "group": "Severity",
+                                "createOtherGroup": null
+                              }
+                            },
+                            "name": "soc - sla-by-severity trend",
+                            "id": "3f7d1f17-8d2f-4a1b-a97e-17973812ca6f"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "### Closed Incident Classification (True Positive vs False Positive)\r\n\r\nThis visual shows the distribution of closed email-related incidents classified as True Positive versus False Positive. It helps assess detection accuracy and provides insight into validation trends."
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - classification heading",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "48db10ce-8246-4f5e-8b68-f618d9c7f77c"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "### True Positive Incident Classification Rate\r\n\r\nThis visual displays the percentage of email-related incidents confirmed as True Positive. It offers a clear measure of classification accuracy and highlights changes in detection effectiveness over time."
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - tp-rate heading",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "34a84dbf-609a-407f-afef-f1592eb4a92b"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "### Incidents Automated vs Manual Closure\r\n\r\nThis visual illustrates the proportion of email-related incidents closed automatically versus manually. It provides visibility into operational efficiency and the impact of automation on incident resolution.\r\n<br> ⚠️ *You will have to review the underlying query and add any automation system specific to your organization.*"
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - auto-vs-manual-closure heading",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "a1fd9136-7a12-4d80-b3e1-e2704a84f734"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "// Build a list of MDO-related incidents by cross-referencing SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get only the most recent state of each incident, ensuring it's MDO-related\r\nlet LatestIncidents = SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    | where not(Title startswith \"CC_\");  // Exclude incidents unrelated to MDO (e.g., DSPM)\r\n\r\nLatestIncidents\r\n| where Status == 'Closed'                                     // (Optional) Limit to closed/fully classified incidents\r\n| summarize Count = count() by Classification = iif(\r\n    isnull(Classification) or trim(\" \", Classification) == \"\",\r\n    \"Not Set\", \r\n    Classification\r\n  )\r\n| order by Count desc",
+                                    "size": 3,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "piechart"
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - classification pie",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "cfa5b7c5-50cc-4b3b-8bba-1a93c57bff43"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n    SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n    SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n    | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n    TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n    TotalClosed       = count()\r\n| extend TruePositiveRate = iff(\r\n    TotalClosed > 0,\r\n    TruePositiveCount * 100.0 / TotalClosed,\r\n    real(null)\r\n)",
+                                    "size": 1,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "stat",
+                                    "statSettings": {
+                                      "valueField": "TruePositiveRate",
+                                      "valueAggregation": "None",
+                                      "colorSettings": {
+                                        "type": "static",
+                                        "mode": "background",
+                                        "heatmapPalette": "greenRed",
+                                        "thresholdsGrid": []
+                                      },
+                                      "iconSettings": {
+                                        "thresholdsGrid": []
+                                      },
+                                      "numberFormatSettings": {
+                                        "unit": 1,
+                                        "options": {
+                                          "style": "decimal",
+                                          "maximumFractionDigits": 2
+                                        }
+                                      },
+                                      "tagText": "True Positive Rate",
+                                      "valueFontStyle": "xxLarge",
+                                      "tagTextPosition": "bottom"
+                                    }
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - tp-rate stat",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "eca235aa-38aa-46dd-a569-74dd8f83b2f0"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\")          // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff(                       // Add strings for your automation systems\r\n        tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n        \"Automated\",\r\n        \"Human\"\r\n    )\r\n| summarize ClosedCount = count() by ClosedBy",
+                                    "size": 3,
+                                    "showAnalytics": true,
+                                    "queryType": "advancedHunting",
+                                    "visualization": "piechart"
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - closure pie",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "a4bc160f-1ba6-4779-86cd-ef44422f1e29"
+                                }
+                              ]
+                            },
+                            "name": "soc - incident-insights group",
+                            "id": "3083ac4d-0bdd-4db7-a5f0-0d41cb67a4eb"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "13"
+                      },
+                      "name": "soc - incident-metrics group",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "18ff8970-e5f6-4c51-918a-aa693a45d18f"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Investigation & Response Actions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Remediation efficacy analysis.** Compares automated (AIR) and manual admin actions to evaluate response times and investigation outcomes.\r\n<br><br>**Recommended action:** Reduce AIR pending-action latency by reviewing why approvals take long, and increase automation where it is safe to do so."
+                            },
+                            "name": "soc - air section header",
+                            "id": "5e0b06c8-7774-4eb4-8b7f-572b3732de84"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Automated Investigation and Response (AIR) Actions (per {Granularity})\r\n\r\nThis visual shows the per-{Granularity} trend of Automated Investigation and Response (AIR) actions, including the number of successful and failed attempts (because of prior remediation)."
+                            },
+                            "customWidth": "100",
+                            "name": "soc - air-actions heading",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "05f14dec-e76c-413c-83a0-31a05dce65e7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query attempts to show AIR Efficiency Over Time by displaying the number of successes and failures over time\r\nEmailPostDeliveryEvents\r\n| where ActionType =~ \"Automated Remediation\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by bin(Timestamp, {Granularity}), ActionResult",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "graphSettings": {
+                                "type": 0,
+                                "topContent": {
+                                  "columnMatch": "AlertId",
+                                  "formatter": 1
+                                },
+                                "centerContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 1,
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              },
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "soc - air-efficiency trend",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "ae2a1850-5b7e-49f7-bac4-d888053ab49b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Automated Investigation and Response (AIR) Response Time After Email Delivery (per {Granularity})\r\n\r\nThis visual displays the average (per {Granularity}), 80th percentile (p80), 90th percentile (p90) and 99th percentile (p99) time needed, measured in minutes, from email delivery to AIR action. It serves as a SOC metric to monitor responsiveness (security team members reviewing and manually approving AIR Pending Actions) and identify potential latency in automated incident handling. If the latency is high focus on reviewing why reviwing AIR Pending Actions takes longer time for admins and consider <a href='https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation#configure-automated-remediation'>auto-aproval of URL, Files and Email clusters. </a>\r\n"
+                            },
+                            "customWidth": "100",
+                            "name": "soc - air-response-time heading",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "98c66d9e-efdf-40fc-b8b0-be35d7fd97a9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// SOC metric: Daily average/p75 delay (in minutes) from email delivery to AIR action\r\nlet deliveries = EmailEvents\r\n  | where DeliveryAction == \"Delivered\"// delivered emails\r\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n  | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\r\nlet remediations = EmailPostDeliveryEvents\r\n  | where ActionType =~ \"Automated Remediation\"// automated remediation events\r\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n  | summarize FirstRemediation = min(Timestamp) by MsgKey;\r\ndeliveries\r\n| join kind=inner remediations on MsgKey\r\n| extend DelayMinutes = datetime_diff(\"minute\", FirstRemediation, FirstDelivery)\r\n| where DelayMinutes >= 0\r\n| summarize ['Avg (min)'] = avg(DelayMinutes),\r\n            ['P80 (min)'] = percentile(DelayMinutes, 80),\r\n            ['P90 (min)'] = percentile(DelayMinutes, 90),\r\n            ['P99 (min)'] = percentile(DelayMinutes, 99),\r\n            CountEmails = count()\r\n   by bin(FirstRemediation, 1d) ",
+                              "size": 0,
+                              "aggregation": 3,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "gridSettings": {
+                                "sortBy": [
+                                  {
+                                    "itemKey": "FirstRemediation",
+                                    "sortOrder": 1
+                                  }
+                                ]
+                              },
+                              "sortBy": [
+                                {
+                                  "itemKey": "FirstRemediation",
+                                  "sortOrder": 1
+                                }
+                              ],
+                              "chartSettings": {
+                                "xAxis": "FirstRemediation",
+                                "yAxis": [
+                                  "P99 (min)",
+                                  "P90 (min)",
+                                  "P80 (min)",
+                                  "Avg (min)"
+                                ],
+                                "showLegend": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "soc - air-latency area",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "900383f1-6443-4d50-b15d-26e4ac11b255"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Automated Investigation and Response (AIR) Investigation Results Trend\r\n\r\nThis visual displays the per-{Granularity} trend of AIR investigation outcomes, categorized as **Threat Detected** or **Clean**. It helps track the effectiveness of automated investigations over time and highlights patterns in threat detection."
+                            },
+                            "customWidth": "67",
+                            "name": "soc - air-outcomes heading",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "d1cabfbe-6040-4b6e-9ce5-f48e9973dfc9"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Investigation Actions Taken: Automated Investigation and Response (AIR) vs Manual (Human)\r\n\r\nThis visual shows whether actions taken after an Automated Investigation and Response (AIR) required manual approval by an administrator or were executed automatically. It provides insight into the level of automation versus human intervention in post-investigation remediation."
+                            },
+                            "customWidth": "33",
+                            "name": "soc - air-auto-vs-manual heading",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "2f98514b-0172-4c4e-ba25-9a5e4138c570"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// AIR investigation outcomes by day: ThreatDetected vs. Clean\r\n\r\n// Step 1: Deduplicate automated remediation events by message and recipient\r\nlet AutoRemediations = \r\n    EmailPostDeliveryEvents\r\n    | where ActionType == \"Automated Remediation\"\r\n    | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\r\n    | project NetworkMessageId, RecipientEmailAddress, Timestamp;\r\n\r\n// Step 2: Derive threat verdicts using AlertEvidence\r\nlet EvidenceVerdicts =\r\n    AlertEvidence\r\n    | where EntityType in (\"MailMessage\", \"MailCluster\")\r\n    | extend extra = todynamic(AdditionalFields)\r\n    // If this is a mail cluster, use provided NetworkMessageIds array; otherwise wrap NetworkMessageId as a single-item array\r\n    | extend networkIds = iff(\r\n      isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\r\n      pack_array(NetworkMessageId),          // create a single-element array using pack_array\r\n      extra.NetworkMessageIds                // use the array as-is if it exists\r\n    )\r\n    | mv-expand nmID = networkIds                // expand to individual message IDs\r\n    // Derive verdict from LastVerdict, ThreatAnalysisSummary, and ThreatIntelligence\r\n    | extend \r\n        lastVerdict = tolower(tostring(extra.LastVerdict)),\r\n        threatAIList = extra.ThreatAnalysisSummary,\r\n        threatInt   = extra.ThreatIntelligence\r\n    | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \"\"),\r\n             verdictTI          = iff(array_length(threatInt) > 0, \"malicious\", \"\")   // any item in ThreatIntelligence indicates malicious\r\n    // Mark as threat-detected if verdict is malicious/suspicious or threat evidence is present\r\n    | extend ThreatDetectedFlag = \r\n        case(\r\n            lastVerdict in (\"malicious\",\"suspicious\") or verdictFromAnalysis in (\"malicious\",\"suspicious\")\r\n                or verdictTI == \"malicious\",\r\n            true,\r\n            false\r\n        )\r\n    // Weight mail clusters by MailCount; default to 1 for single messages\r\n    | extend MailCountInt = toint(extra.MailCount)\r\n    | extend Weight = iff(EntityType == \"MailCluster\", \r\n                        coalesce(MailCountInt, 1), // default to 1 if MailCount is missing\r\n                        1)\r\n    | summarize IsThreatDetected = any(ThreatDetectedFlag), \r\n                WeightSum       = sum(Weight) \r\n    by nmID = tostring(nmID);\r\n\r\n// Step 3: Join remediation events with verdicts and aggregate by day\r\nAutoRemediations\r\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\r\n| extend isThreat      = coalesce(IsThreatDetected, false), \r\n         effectiveWeight= coalesce(WeightSum, 1)\r\n| extend InvestigationOutcome = iif(isThreat, \"Threat Detected\", \"Clean\")\r\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, {Granularity}), InvestigationOutcome\r\n| order by Day asc, InvestigationOutcome asc",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "67",
+                            "name": "soc - air-outcomes trend",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "18552ccb-d8d4-45c4-a3cf-072203df9325"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "soc - air-auto-vs-manual pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "03bc6e3c-05de-426d-91d8-b48a36b4ea74"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "### Post-Delivery Actions by Admin\r\n\r\nThis visual displays the number (per {Granularity}) of emails where an administrator performed a post-delivery action. Actions are summarized by type, including **Soft Delete**, **Hard Delete**, **Moved to Junk Folder**, **Moved to Inbox**, and **Quarantine Release**, providing insight into manual intervention trends after email delivery."
+                                  },
+                                  "name": "soc - post-delivery-by-admin heading",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "a0961ca9-da58-49c4-9a1c-873c5569bed9"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query visualises the daily ammount of emails that had an admin post delivery action, summarizing the data by action type\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\"\r\n| summarize [\"Soft Delete\"]=countif(Action has 'Soft Delete'), [\"Hard Delete\"]=countif(Action has 'Hard Delete'), [\"Moved to junk folder\"]=countif(Action has 'Moved to junk folder'), [\"Moved to inbox\"]=countif(Action has 'Moved to inbox'), [\"Quarantine release\"]=countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Soft Delete\"]=coalesce([\"Soft Delete\"],0), [\"Hard Delete\"]=coalesce([\"Hard Delete\"],0), [\"Moved to junk folder\"]=coalesce([\"Moved to junk folder\"],0), [\"Moved to inbox\"]=coalesce([\"Moved to inbox\"],0), [\"Quarantine release\"]=coalesce([\"Quarantine release\"],0)\r\n| sort by Timestamp asc",
+                                    "size": 0,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "linechart"
+                                  },
+                                  "name": "soc - post-delivery-by-admin trend",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "d2ea8eac-a3db-46b0-bcb4-3abbb95ba4ad"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "soc - post-delivery group",
+                            "id": "ebca14d5-954d-4e35-a225-cb0f8a3ea81b"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "13"
+                      },
+                      "name": "soc - air group",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "0a05394d-f813-4408-ac4d-8f481ae34c0b"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Malicious Email Campaigns (Clustered)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Groups malicious inbound emails into campaigns (attack waves) using the Email Cluster ID assigned by Microsoft Defender for Office 365, showing one row per campaign with the message count, distinct recipients, sender domains, threat mix and sample subjects. Helps the SOC understand the scale and shape of coordinated attacks rather than viewing individual messages in isolation.**<br><br>**Recommended action:** Pivot on the top campaign clusters to hunt related messages and consider blocking shared sender infrastructure."
+                            },
+                            "name": "soc - campaigns heading",
+                            "id": "d3a9e4c6-1b5f-4c8d-ae34-9f7a1b2c3d45"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Largest malicious inbound email campaigns clustered by EmailClusterId - one row per attack wave (messages, recipients, URL clicks, sender domains, threat mix, sample subjects).\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n            Recipients = dcount(RecipientEmailAddress),\r\n            SenderDomains = dcount(SenderFromDomain),\r\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n            SampleSubjects = make_set(Subject, 5),\r\n            FirstSeen = min(Timestamp),\r\n            LastSeen = max(Timestamp)\r\n        by EmailClusterId\r\n| join kind=leftouter (clicksByCluster) on EmailClusterId\r\n| extend UrlClicks = coalesce(UrlClicks, 0)\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by Messages\r\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['URL Clicks']=UrlClicks, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 0,
+                              "title": "",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Recipients",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "URL Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "soc - campaigns table",
+                            "id": "a2a391e1-0e26-4e0e-a8d3-26e3c7132079"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Most-Clicked Email Campaigns (Recipient Engagement)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Ranks malicious inbound campaigns by recipient URL clicks, surfacing the attack waves that reached a mailbox and drew engagement regardless of raw message volume. The highest-volume campaigns are usually quarantined before delivery, so the clusters that draw clicks are often smaller, targeted waves. A non-zero URL Clicks count means a recipient opened a URL within the campaign's messages. Because attackers often mix legitimate URLs with malicious ones to build credibility, and a per-URL threat verdict is not available here, treat these as clicks on potentially malicious URLs that warrant review rather than confirmed malicious clicks.**<br><br>**Recommended action:** Focus on these clusters for user follow-up (awareness and, where credentials may be exposed, password reset) and hunt for related messages sharing sender infrastructure."
+                            },
+                            "name": "soc - mostclicked heading",
+                            "id": "e9e41b47-0434-42e5-8b04-4170ab061b81"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Malicious inbound campaigns ranked by recipient URL clicks - the attack waves that reached a mailbox and drew engagement, regardless of message volume.\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n            Recipients = dcount(RecipientEmailAddress),\r\n            SenderDomains = dcount(SenderFromDomain),\r\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n            SampleSubjects = make_set(Subject, 5),\r\n            FirstSeen = min(Timestamp),\r\n            LastSeen = max(Timestamp)\r\n        by EmailClusterId\r\n| join kind=inner (clicksByCluster) on EmailClusterId\r\n| where UrlClicks > 0\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by UrlClicks\r\n| project ['Email Cluster ID']=EmailClusterId, ['URL Clicks']=UrlClicks, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 0,
+                              "title": "",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "URL Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Recipients",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "soc - mostclicked table",
+                            "id": "1ffe8f97-ad79-47d9-9598-dd73ee54cd8d"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "13"
+                      },
+                      "name": "soc - campaigns group",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "b8f2a1c4-5d6e-4a7b-9c8d-0e1f2a3b4c5d"
+                    }
+                  ],
+                  "isLocked": true,
+                  "fromTemplateId": "sentinel-MicrosoftDefenderForOffice365detectionsandinsights",
+                  "contentProvenance": {
+                    "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+                    "packageVersion": "3.2.1",
+                    "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c",
+                    "contentVersion": "3.2.1"
                   }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject12').analyticRuleId12,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 12",
-                "parentId": "[variables('analyticRuleObject12').analyticRuleId12]",
-                "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject12').analyticRuleVersion12]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
                 }
               }
             }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Imminent Ransomware",
-        "contentProductId": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
-        "id": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
-        "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
-      }
+          }
+        }
+      },
+      "condition": "[parameters('DeployDefenderWorkbook')]"
     },
     {
       "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
       "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject13').analyticRuleTemplateSpecName13]",
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dwb-',uniqueString('e39952df-ba60-50cf-80f6-76f7a2ebf57c')))]",
       "location": "[parameters('workspace-location')]",
       "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'DefenderWorkbook-da2727e752b5d883c20387dfb93fc051')]",
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "MaliciousCMDExecutionByJava_AnalyticalRules Analytics Rule with template version 3.0.18",
+        "description": "Defender Workbook: MicrosoftDefenderForOffice365detectionsandinsights",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query was originally published in the threat analytics report, Sysrv botnet evolution.\nSysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.\nThe following query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script.",
-                "displayName": "Java Executing cmd to run Powershell",
-                "enabled": false,
-                "query": "DeviceProcessEvents                         \n| where InitiatingProcessFileName == 'java.exe' and FileName == 'cmd.exe' \nand ProcessCommandLine has_all('powershell iex','DownloadString')\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution"
-                ],
-                "techniques": [
-                  "T1059"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject13').analyticRuleId13,'/'))))]",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "imports": {
+            "MicrosoftSecurity": {
+              "provider": "MicrosoftSecurity",
+              "version": "1.0.0"
+            }
+          },
+          "resources": {
+            "workbook": {
+              "import": "MicrosoftSecurity",
+              "type": "Microsoft.Security/workbooks@2026-06-01-preview",
               "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 13",
-                "parentId": "[variables('analyticRuleObject13').analyticRuleId13]",
-                "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject13').analyticRuleVersion13]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Java Executing cmd to run Powershell",
-        "contentProductId": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
-        "id": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
-        "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject14').analyticRuleTemplateSpecName14]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "C2-NamedPipe_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Detects the creation of a named pipe used by known APT malware.\nReference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c",
-                "displayName": "C2-NamedPipe",
-                "enabled": false,
-                "query": "// this is what should be constantly tweaked with default C2 framework names, search uses has_any (wildcard)\nlet badPipeNames = pack_array(\n    '\\\\psexec',                                     // PSexec default pipe\n    '\\\\paexec',                                     // PSexec default pipe\n    '\\\\remcom',                                     // PSexec default pipe\n    '\\\\csexec',                                     // PSexec default pipe\n    '\\\\isapi_http',                                 // Uroburos Malware Named Pipe\n    '\\\\isapi_dg',                                   // Uroburos Malware Named Pipe\n    '\\\\isapi_dg2',                                  // Uroburos Malware Named Pipe\n    '\\\\sdlrpc',                                     // Cobra Trojan Named Pipe http://goo.gl/8rOZUX\n    '\\\\ahexec',                                     // Sofacy group malware\n    '\\\\winsession',                                 // Wild Neutron APT malware https://goo.gl/pivRZJ\n    '\\\\lsassw',                                     // Wild Neutron APT malware https://goo.gl/pivRZJ\n    '\\\\46a676ab7f179e511e30dd2dc41bd388',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\9f81f59bc58452127884ce513865ed20',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\e710f28d59aa529d6792ca6ff0ca1b34',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\rpchlp_3',                                   // Project Sauron https://goo.gl/eFoP4A - Technical Analysis Input\n    '\\\\NamePipe_MoreWindows',                       // US-CERT Alert - RedLeaves https://www.us-cert.gov/ncas/alerts/TA17-117A\n    '\\\\pcheap_reuse',                               // Pipe used by Equation Group malware 77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0\n    '\\\\gruntsvc',                                   // Covenant default named pipe\n    '\\\\583da945-62af-10e8-4902-a8f205c72b2e',       // SolarWinds SUNBURST malware report https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n    '\\\\bizkaz',                                     // Snatch Ransomware https://thedfirreport.com/2020/06/21/snatch-ransomware/\n    '\\\\atctl',                                      // https://www.virustotal.com/#/file/a4ddb2664a6c87a1d3c5da5a5a32a5df9a0b0c8f2e951811bd1ec1d44d42ccf1/detection\n    '\\\\userpipe',                                   // ruag apt case\n    '\\\\iehelper',                                   // ruag apt case\n    '\\\\sdlrpc',                                     // project cobra https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    '\\\\comnap',                                     // https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    '\\\\lsadump',                                    // Cred Dump-Tools Named Pipes\n    '\\\\cachedump',                                  // Cred Dump-Tools Named Pipes\n    '\\\\wceservicepipe',                             // Cred Dump-Tools Named Pipes\n    '\\\\jaccdpqnvbrrxlaf',                           // PoshC2 default named pipe\n    '\\\\svcctl',                                     // CrackMapExec default named pipe\n    '\\\\csexecsvc'                                   // CSEXEC default named pipe\n    '\\\\status_',                                    // CS default named pipes https://github.com/Neo23x0/sigma/issues/253\n    '\\\\MSSE-',                                      // CobaltStrike default named pipe\n    '\\\\status_',                                    // CobaltStrike default named pipe\n    '\\\\msagent_',                                   // (target) CobaltStrike default named pipe\n    '\\\\postex_ssh_',                                // CobaltStrike default named pipe\n    '\\\\postex_',                                    // CobaltStrike default named pipe\n    '\\\\Posh'                                        // PoshC2 default named pipe\n);\nDeviceEvents\n| where ActionType == \"NamedPipeEvent\"\n| extend ParsedFields=parse_json(AdditionalFields)\n| where ParsedFields.FileOperation == \"File created\"\n| where ParsedFields.PipeName has_any (badPipeNames)\n| project TimeGenerated, ActionType, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, ParsedFields.FileOperation, ParsedFields.PipeName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "CommandAndControl"
-                ],
-                "techniques": [
-                  "T1105"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject14').analyticRuleId14,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 14",
-                "parentId": "[variables('analyticRuleObject14').analyticRuleId14]",
-                "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject14').analyticRuleVersion14]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "C2-NamedPipe",
-        "contentProductId": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
-        "id": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
-        "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject15').analyticRuleTemplateSpecName15]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DoppelPaymerProcDump_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.\nDoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they use SysInternal utilities such as ProcDump to dump credentials from LSASS. They often use these stolen credentials to turn off security software, run malicious commands, and spread malware throughout an organization.\nThe following query detects ProcDump being used to dump credentials from LSASS.\nThe See also section below lists links to other queries associated with DoppelPaymer.\nReferences:\nhttps://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/DoppelPaymer.KM!MTB\nhttps://docs.microsoft.com/sysinternals/downloads/procdump\nhttps://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection",
-                "displayName": "DopplePaymer Procdump",
-                "enabled": false,
-                "query": "// Dumping of LSASS memory using procdump\nDeviceProcessEvents\n// Command lines that include \"lsass\" and -accepteula or -ma flags used in procdump\n| where (ProcessCommandLine has \"lsass\" and (ProcessCommandLine has \"-accepteula\" or\nProcessCommandLine contains \"-ma\"))\n// Omits possible FPs where the full command is just \"procdump.exe lsass\"\nor (FileName in~ ('procdump.exe','procdump64.exe') and ProcessCommandLine has 'lsass')\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "CredentialAccess"
-                ],
-                "techniques": [
-                  "T1003"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject15').analyticRuleId15,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 15",
-                "parentId": "[variables('analyticRuleObject15').analyticRuleId15]",
-                "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject15').analyticRuleVersion15]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "DopplePaymer Procdump",
-        "contentProductId": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
-        "id": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
-        "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject16').analyticRuleTemplateSpecName16]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LSASSCredDumpProcdump_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query was originally published in the threat analytics report, \"Exchange Server zero-days exploited in the wild\".\nIn early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:\n1. CVE-2021-26855\n2. CVE-2021-26857\n3. CVE-2021-26858\n4. CVE-2021-27065\nThe following query looks for evidence of Procdump being used to dump credentials from LSASS, the Local Security Authentication Server. This might indicate an attacker has compromised user accounts.\nMore queries related to this threat can be found under the See also section of this page.\nReference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/",
-                "displayName": "LSASS Credential Dumping with Procdump",
-                "enabled": false,
-                "query": "DeviceProcessEvents \n| where (FileName has_any (\"procdump.exe\", \"procdump64.exe\") and ProcessCommandLine has \"lsass\") or \n// Looking for Accepteula flag or Write a dump file with all process memory\n(ProcessCommandLine has \"lsass.exe\" and (ProcessCommandLine has \"-accepteula\" or ProcessCommandLine contains \"-ma\"))\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "CredentialAccess"
-                ],
-                "techniques": [
-                  "T1003"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject16').analyticRuleId16,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 16",
-                "parentId": "[variables('analyticRuleObject16').analyticRuleId16]",
-                "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject16').analyticRuleVersion16]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "LSASS Credential Dumping with Procdump",
-        "contentProductId": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
-        "id": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
-        "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject17').analyticRuleTemplateSpecName17]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DoppelpaymerStopService_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.\nDoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization.\nThe following query detects attempts to stop security services.\nThe See also section below lists links to other queries associated with DoppelPaymer.\nReferences:\nhttps://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/DoppelPaymer.KM!MTB",
-                "displayName": "Doppelpaymer Stop Services",
-                "enabled": false,
-                "query": "// Attempts to stop services and allow ransomware execution\nDeviceProcessEvents\n| where InitiatingProcessFileName startswith \"psexe\" and FileName =~ \"powershell.exe\" and\n  ProcessCommandLine has \"stop-service\" and ProcessCommandLine has \"sql\" and ProcessCommandLine has \"msexchange\"\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution",
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1059",
-                  "T1562"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject17').analyticRuleId17,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 17",
-                "parentId": "[variables('analyticRuleObject17').analyticRuleId17]",
-                "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject17').analyticRuleVersion17]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Doppelpaymer Stop Services",
-        "contentProductId": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]",
-        "id": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]",
-        "version": "[variables('analyticRuleObject17').analyticRuleVersion17]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject18').analyticRuleTemplateSpecName18]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "QakbotCampaignSelfDeletion_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware\nQakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.\nThe following query detects if an instance of Qakbot has attempted to overwrite its original binary.\nReference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/",
-                "displayName": "Qakbot Campaign Self Deletion",
-                "enabled": false,
-                "query": "DeviceProcessEvents \n| where FileName =~ \"ping.exe\"\n| where InitiatingProcessFileName =~ \"cmd.exe\"\n| where (InitiatingProcessCommandLine has \"calc.exe\") and (InitiatingProcessCommandLine has \"-n 6\") and (InitiatingProcessCommandLine has \"127.0.0.1\")\n| project TimeGenerated, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DeviceId, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1070"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject18').analyticRuleId18,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 18",
-                "parentId": "[variables('analyticRuleObject18').analyticRuleId18]",
-                "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject18').analyticRuleVersion18]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Qakbot Campaign Self Deletion",
-        "contentProductId": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]",
-        "id": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]",
-        "version": "[variables('analyticRuleObject18').analyticRuleVersion18]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject19').analyticRuleTemplateSpecName19]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Regsvr32Rundll32ImageLoadsAbnormalExtension_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll.\nJoins the data to public network events.\nReferences:\nhttps://threathunt.blog/running-live-malware-for-threat-hunting-purposes/",
-                "displayName": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
-                "enabled": false,
-                "query": "DeviceImageLoadEvents \n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where FileName !endswith \".dll\"\n| join (\nDeviceNetworkEvents\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where RemoteIPType == \"Public\"\n) on InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessCommandLine\n| project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalIP, LocalPort, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessParentFileName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents",
-                      "DeviceNetworkEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion"
-                ],
-                "subTechniques": [
-                  "T1218.010",
-                  "T1218.011"
-                ],
-                "techniques": [
-                  "T1218",
-                  "T1218"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "LocalIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "RemoteIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Url",
-                        "columnName": "RemoteUrl"
-                      }
-                    ],
-                    "entityType": "URL"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject19').analyticRuleId19,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 19",
-                "parentId": "[variables('analyticRuleObject19').analyticRuleId19]",
-                "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject19').analyticRuleVersion19]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
-        "contentProductId": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]",
-        "id": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]",
-        "version": "[variables('analyticRuleObject19').analyticRuleVersion19]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject20').analyticRuleTemplateSpecName20]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Regsvr32Rundll32WithAnomalousParentProcess_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject20')._analyticRulecontentId20]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This analytical rule looks for rundll32.exe or regsvr32.exe being spawned by abnormal processes: wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe.\nBlog: https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/",
-                "displayName": "Regsvr32 Rundll32 with Anomalous Parent Process",
-                "enabled": false,
-                "query": "DeviceProcessEvents\n| where FileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where InitiatingProcessFileName has_any (\"wscript.exe\",\"powershell.exe\",\"cmd.exe\",\"pwsh.exe\",\"cscript.exe\")\n| project TimeGenerated, DeviceName, InvestigatedProcessName=FileName, InvestigatedProcessCommandLine = ProcessCommandLine,InvestigatedProcessStartTime = ProcessCreationTime, InvestigatedProcessId = ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName\n| join (\nDeviceNetworkEvents\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where RemoteIPType == \"Public\"\n| project DeviceName, InvestigatedProcessName=InitiatingProcessFileName, InvestigatedProcessCommandLine = InitiatingProcessCommandLine,InvestigatedProcessStartTime = InitiatingProcessCreationTime, InvestigatedProcessId = InitiatingProcessId, LocalIP, RemoteIP, RemoteUrl\n) on DeviceName, InvestigatedProcessCommandLine, InvestigatedProcessId, InvestigatedProcessName, InvestigatedProcessStartTime\n| project-away DeviceName1, InvestigatedProcessCommandLine1, InvestigatedProcessId1, InvestigatedProcessName1, InvestigatedProcessStartTime1\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents",
-                      "DeviceNetworkEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion"
-                ],
-                "subTechniques": [
-                  "T1218.010",
-                  "T1218.011"
-                ],
-                "techniques": [
-                  "T1218",
-                  "T1218"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "LocalIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "RemoteIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Url",
-                        "columnName": "RemoteUrl"
-                      }
-                    ],
-                    "entityType": "URL"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject20').analyticRuleId20,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 20",
-                "parentId": "[variables('analyticRuleObject20').analyticRuleId20]",
-                "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject20').analyticRuleVersion20]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Regsvr32 Rundll32 with Anomalous Parent Process",
-        "contentProductId": "[variables('analyticRuleObject20')._analyticRulecontentProductId20]",
-        "id": "[variables('analyticRuleObject20')._analyticRulecontentProductId20]",
-        "version": "[variables('analyticRuleObject20').analyticRuleVersion20]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject21').analyticRuleTemplateSpecName21]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SuspiciousCommandInitiatedByWebServerProcess_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject21')._analyticRulecontentId21]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query was originally published in the threat analytics report, Operation Soft Cell.\nOperation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.\nOperation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.\nReference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers",
-                "displayName": "Detect Suspicious Commands Initiated by Webserver Processes",
-                "enabled": false,
-                "query": "// Suspicious commands launched by web server processes\nDeviceProcessEvents \n| where (((InitiatingProcessParentFileName in(\"w3wp.exe\", \"beasvc.exe\",\n    \"httpd.exe\") or InitiatingProcessParentFileName startswith \"tomcat\")\n    or InitiatingProcessFileName in(\"w3wp.exe\", \"beasvc.exe\", \"httpd.exe\") or\n    InitiatingProcessFileName startswith \"tomcat\"))\n    and FileName in~('cmd.exe', 'powershell.exe')\n| where ProcessCommandLine contains '%temp%'\n    or ProcessCommandLine has 'wget'\n    or ProcessCommandLine has 'whoami'\n    or ProcessCommandLine has 'certutil'\n    or ProcessCommandLine has 'systeminfo'\n    or ProcessCommandLine has 'ping'\n    or ProcessCommandLine has 'ipconfig'\n    or ProcessCommandLine has 'timeout'\n| summarize\n    take_any(FileName),\n    make_set(ProcessCommandLine, 100000),\n    take_any(InitiatingProcessFileName),\n    take_any(InitiatingProcessParentFileName)\n    by DeviceId, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution",
-                  "DefenseEvasion",
-                  "Discovery"
-                ],
-                "techniques": [
-                  "T1059",
-                  "T1574",
-                  "T1087",
-                  "T1082"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject21').analyticRuleId21,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 21",
-                "parentId": "[variables('analyticRuleObject21').analyticRuleId21]",
-                "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject21').analyticRuleVersion21]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Detect Suspicious Commands Initiated by Webserver Processes",
-        "contentProductId": "[variables('analyticRuleObject21')._analyticRulecontentProductId21]",
-        "id": "[variables('analyticRuleObject21')._analyticRulecontentProductId21]",
-        "version": "[variables('analyticRuleObject21').analyticRuleVersion21]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject22').analyticRuleTemplateSpecName22]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "BITSAdminActivity_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject22')._analyticRulecontentId22]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. \nThis service is commonly used for legitimate purposes, but can also be used as part of a malware downloader. \nAdditionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This\nquery will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer\ndirectionality.",
-                "displayName": "Bitsadmin Activity",
-                "enabled": false,
-                "query": "DeviceProcessEvents\n| where \n    (FileName =~ \"bitsadmin.exe\" or column_ifexists('ProcessVersionInfoOriginalFileName','ColumnNotAvailable') =~ 'bitsadmin.exe')\n    and ProcessCommandLine has_any ('/Transfer','/AddFile', '/AddFileSet','/AddFileWithRanges')\n| extend \n    ParsedCommandLine = parse_command_line(ProcessCommandLine,'windows')\n| extend     \n    RemoteUrl = tostring(ParsedCommandLine[-2]),\n    LocalFile= tostring(ParsedCommandLine[-1]),\n    Direction = iff(ProcessCommandLine has \"/Upload\", 'Upload', 'Download')\n| project-reorder \n    TimeGenerated,\n    DeviceId,\n    DeviceName,\n    Direction,\n    RemoteUrl,\n    LocalFile,\n    InitiatingProcessFolderPath,\n    InitiatingProcessAccountDomain,\n    InitiatingProcessAccountName,\n    InitiatingProcessSHA256,\n    ProcessId,\n    ProcessCommandLine\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Persistence",
-                  "CommandAndControl",
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1197",
-                  "T1105",
-                  "T1048"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
-                      },
-                      {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
-                      }
-                    ],
-                    "entityType": "Process"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject22').analyticRuleId22,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 22",
-                "parentId": "[variables('analyticRuleObject22').analyticRuleId22]",
-                "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject22').analyticRuleVersion22]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Bitsadmin Activity",
-        "contentProductId": "[variables('analyticRuleObject22')._analyticRulecontentProductId22]",
-        "id": "[variables('analyticRuleObject22')._analyticRulecontentProductId22]",
-        "version": "[variables('analyticRuleObject22').analyticRuleVersion22]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject23').analyticRuleTemplateSpecName23]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "OfficeAppsLaunchingWscript_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject23')._analyticRulecontentId23]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated.\nTrickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command-and-control (C2) operations.\nTrickbot is frequently spread through email. An attacker will send a target a message with an attachment containing a malicious macro. If the target enables the macro, it will write a JScript Encoded (JSE) file to disk (JScript is a Microsoft dialect of ECMAScript). The JSE file will then be launched using wscript.exe to perform a variety of malicious tasks, particularly reconnaissance.\nThe following query detects when Office applications have launched wscript.exe to run a JSE file.\nSee Detect rundll.exe being used for reconnaissance and command-and-control for another query related to Trickbot activity.\nReference - https://attack.mitre.org/software/S0266/",
-                "displayName": "Office Apps Launching Wscipt",
-                "enabled": false,
-                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName in~ ('winword.exe', 'excel.exe', 'outlook.exe') \n| where FileName =~ \"wscript.exe\" and ProcessCommandLine has \".jse\"\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution",
-                  "Collection",
-                  "CommandAndControl"
-                ],
-                "techniques": [
-                  "T1059",
-                  "T1105",
-                  "T1203"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
-                      },
-                      {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
-                      }
-                    ],
-                    "entityType": "Process"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject23').analyticRuleId23,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 23",
-                "parentId": "[variables('analyticRuleObject23').analyticRuleId23]",
-                "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject23').analyticRuleVersion23]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Office Apps Launching Wscipt",
-        "contentProductId": "[variables('analyticRuleObject23')._analyticRulecontentProductId23]",
-        "id": "[variables('analyticRuleObject23')._analyticRulecontentProductId23]",
-        "version": "[variables('analyticRuleObject23').analyticRuleVersion23]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject24').analyticRuleTemplateSpecName24]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "PotentialKerberoastActivities_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject24')._analyticRulecontentId24]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query aim to detect if someone requests service tickets (where count => maxcount)\nThe query requires trimming to set a baseline level for MaxCount  \nMitre Technique: Kerberoasting (T1558.003)\n@MattiasBorg82",
-                "displayName": "Detect Potential Kerberoast Activities",
-                "enabled": false,
-                "query": "let MaxCount = 70; //Number of requests per 2 minute timeframe, depending on org size.\nIdentityLogonEvents\n| where ActionType == \"LogonSuccess\"\n| where Protocol == \"Kerberos\"\n| extend json = todynamic(parse_json(tostring(AdditionalFields)))\n| extend SPN = json.Spns,\n       AttackTechniques = json.AttackTechniques\n      | project-away json\n| where isnotempty(SPN)\n| where AttackTechniques has \"T1558.003\"\n| mv-expand SPN\n        | extend SPNType = tostring(extract(@\"^\\w+\",0,tostring(SPN)))\n| distinct tostring(SPN), DeviceName, AccountUpn, AccountSid, bin(TimeGenerated, 2m), ReportId, tostring(AttackTechniques)\n| summarize count(), SPNS=(make_list(SPN, 100000)),ReportId=tostring((make_list(ReportId, 100000))[0]) by AccountUpn,AccountSid,DeviceName, bin(TimeGenerated, 2m), tostring(AttackTechniques)\n| extend SPNS = (replace_regex(tostring(SPNS), @'[^\\w+-\\/]+', '')) \n| where count_ >= MaxCount\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n| extend AccountDomain = tostring(split(AccountUpn, '@')[1]), AccountName = tostring(split(AccountUpn, '@')[0])\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "IdentityLogonEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "CredentialAccess"
-                ],
-                "subTechniques": [
-                  "T1558.003"
-                ],
-                "techniques": [
-                  "T1558"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "AccountUpn"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "AccountDomain"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
-                      }
-                    ],
-                    "entityType": "Account"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject24').analyticRuleId24,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 24",
-                "parentId": "[variables('analyticRuleObject24').analyticRuleId24]",
-                "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject24').analyticRuleVersion24]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Detect Potential Kerberoast Activities",
-        "contentProductId": "[variables('analyticRuleObject24')._analyticRulecontentProductId24]",
-        "id": "[variables('analyticRuleObject24')._analyticRulecontentProductId24]",
-        "version": "[variables('analyticRuleObject24').analyticRuleVersion24]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject25').analyticRuleTemplateSpecName25]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "FilesCopiedToUSBDrives_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject25')._analyticRulecontentId25]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types.",
-                "displayName": "Files Copied to USB Drives",
-                "enabled": false,
-                "query": "let UsbDriveMount = DeviceEvents\n| where ActionType==\"UsbDriveMounted\"\n| extend ParsedFields=parse_json(AdditionalFields)\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=TimeGenerated,\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\n| order by DeviceId asc, MountTime desc;\nlet FileCreation = DeviceFileEvents\n| where InitiatingProcessAccountName != \"system\"\n| where ActionType == \"FileCreated\"\n| where FolderPath !startswith \"C:\\\\\"\n| where FolderPath !startswith \"\\\\\"\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\nFileName, FolderPath, SHA256, TimeGenerated, SensitivityLabel, IsAzureInfoProtectionApplied\n| order by DeviceId asc, TimeGenerated desc;\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\n| where FolderPath startswith DriveLetter\n| where TimeGenerated >= MountTime\n| partition hint.strategy=native by ReportId ( top 1 by MountTime )\n| order by DeviceId asc, TimeGenerated desc\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n| extend FileHashAlgorithm = 'SHA256'\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceEvents",
-                      "DeviceFileEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Exfiltration"
-                ],
-                "techniques": [
-                  "T1041"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Name",
-                        "columnName": "FileName"
-                      },
-                      {
-                        "identifier": "Directory",
-                        "columnName": "FolderPath"
-                      }
-                    ],
-                    "entityType": "File"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Algorithm",
-                        "columnName": "FileHashAlgorithm"
-                      },
-                      {
-                        "identifier": "Value",
-                        "columnName": "SHA256"
-                      }
-                    ],
-                    "entityType": "FileHash"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject25').analyticRuleId25,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 25",
-                "parentId": "[variables('analyticRuleObject25').analyticRuleId25]",
-                "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject25').analyticRuleVersion25]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Files Copied to USB Drives",
-        "contentProductId": "[variables('analyticRuleObject25')._analyticRulecontentProductId25]",
-        "id": "[variables('analyticRuleObject25')._analyticRulecontentProductId25]",
-        "version": "[variables('analyticRuleObject25').analyticRuleVersion25]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject26').analyticRuleTemplateSpecName26]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MosaicLoader_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject26')._analyticRulecontentId26]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection.",
-                "displayName": "MosaicLoader",
-                "enabled": false,
-                "query": "DeviceRegistryEvents \n| where ((ActionType == \"RegistryValueSet\") and (RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows Defender\\\\Exclusions\\\\Paths\" \nor RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Extensions\"\nor RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\"))\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceRegistryEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1562"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Name",
-                        "columnName": "RegistryValueName"
-                      },
-                      {
-                        "identifier": "Value",
-                        "columnName": "RegistryValueData"
-                      }
-                    ],
-                    "entityType": "RegistryValue"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject26').analyticRuleId26,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 26",
-                "parentId": "[variables('analyticRuleObject26').analyticRuleId26]",
-                "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject26').analyticRuleVersion26]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "MosaicLoader",
-        "contentProductId": "[variables('analyticRuleObject26')._analyticRulecontentProductId26]",
-        "id": "[variables('analyticRuleObject26')._analyticRulecontentProductId26]",
-        "version": "[variables('analyticRuleObject26').analyticRuleVersion26]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject27').analyticRuleTemplateSpecName27]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AnomalousVoulmeOfFileDeletion_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject27')._analyticRulecontentId27]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here.\nThis applies to SharePoint and OneDrive users.\nAudit event and Cloud application identifier references.\nReference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-activities?view=o365-worldwide\nReference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers",
-                "displayName": "Unusual Volume of file deletion by users",
-                "enabled": false,
-                "query": "let relevantOperations = pack_array(\"FileDeleted\", \"FileRecycled\", \"FileDeletedFirstStageRecycleBin\", \"FileDeletedSecondStageRecycleBin\", \"FileVersionsAllMinorsRecycled\", \"FileVersionRecycled\", \"FileVersionsAllRecycled\");\nlet relevantAppIds = pack_array(int(20892), int(15600)); // App Ids for SharePoint and OneDrive\nlet timeWindow = 7d;\nlet timeNow = now();\n//\nlet riskyUsers= // Look for users with risky sign-ins\n  SigninLogs    \n  | where CreatedDateTime between ((timeNow - timeWindow) .. (timeNow))\n  | where isnotempty(UserId) and isnotempty(OriginalRequestId)\n  | where ResultType == '0'\n  | where RiskLevelDuringSignIn == 'high'\n  | project UserId, RiskLevelDuringSignIn, CreatedDateTime, SessionId=OriginalRequestId\n  ;\nlet hasUsers = isnotempty(toscalar(riskyUsers));\n//\nlet deleteEvents = // look for file deletion activity and scope it to risky users\n  CloudAppEvents\n  | where hasUsers\n  | where TimeGenerated between ((timeNow - timeWindow) .. (timeNow))\n  | where ApplicationId in (relevantAppIds)\n  | where isnotempty(AccountObjectId)\n  | where AccountObjectId in (riskyUsers)\n  | where ActionType in (relevantOperations)\n  | extend SessionId= tostring(RawEventData.AppAccessContext.AADSessionId)\n  | where isnotempty(SessionId)\n  | project UserId=AccountObjectId, AccountDisplayName, ApplicationId, SessionId, ActionType, TimeGenerated, ReportId\n  ;   \n //\ndeleteEvents  \n| join kind=leftsemi riskyUsers on UserId, SessionId\n| summarize Count=count() , (Timestamp, ReportId)=arg_min(TimeGenerated, ReportId) by UserId, AccountDisplayName, ApplicationId, ActionType, Time=bin(TimeGenerated, 5m)\n// look for only those scoped users who have generated an increase in file deletion activity.\n| summarize TotalCount= countif(Count > 50), (Timestamp, ReportId)=arg_min(Timestamp, ReportId) by UserId, AccountDisplayName, ApplicationId \n| where TotalCount >= 3\n| project UserId, AccountDisplayName, ApplicationId, TotalCount, ReportId, Timestamp\n| extend NTDomain = tostring(split(AccountDisplayName,'\\\\',0)[0]), Name = tostring(split(AccountDisplayName,'\\\\',1)[0])\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "CloudAppEvents",
-                      "AADSignInEventsBeta"
-                    ]
-                  },
-                  {
-                    "connectorId": "AzureActiveDirectory",
-                    "dataTypes": [
-                      "SigninLogs"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Impact"
-                ],
-                "techniques": [
-                  "T1485"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "AadUserId",
-                        "columnName": "UserId"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Name",
-                        "columnName": "Name"
-                      },
-                      {
-                        "identifier": "NTDomain",
-                        "columnName": "NTDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "AppId",
-                        "columnName": "ApplicationId"
-                      }
-                    ],
-                    "entityType": "CloudApplication"
-                  }
-                ],
-                "customDetails": {
-                  "Count": "TotalCount"
-                }
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject27').analyticRuleId27,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 27",
-                "parentId": "[variables('analyticRuleObject27').analyticRuleId27]",
-                "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject27').analyticRuleVersion27]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Unusual Volume of file deletion by users",
-        "contentProductId": "[variables('analyticRuleObject27')._analyticRulecontentProductId27]",
-        "id": "[variables('analyticRuleObject27')._analyticRulecontentProductId27]",
-        "version": "[variables('analyticRuleObject27').analyticRuleVersion27]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject28').analyticRuleTemplateSpecName28]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "RemoteFileCreationWithPsExec_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject28')._analyticRulecontentId28]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog.\nRyuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.\nRyuk operators use PsExec to manually spread the ransomware to other devices.\nThe following query detects remote file creation events that might indicate an active attack.\nThe See also section below lists links to other queries associated with Ryuk ransomware.\nReferences:\nhttps://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk.AA\nhttps://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/\nhttps://docs.microsoft.com/sysinternals/downloads/psexec",
-                "displayName": "Remote File Creation with PsExec",
-                "enabled": false,
-                "query": "// Find PsExec creating multiple files on remote machines in a 10-minute window\nDeviceFileEvents\n// Looking for PsExec by accepteula command flag\n| where InitiatingProcessCommandLine has \"accepteula\"\n// Remote machines and file is exe\n| where FolderPath has \"\\\\\\\\\" and FileName endswith \".exe\"\n| extend Exe = countof(InitiatingProcessCommandLine, \".exe\")\n// Checking to see if command line has 2 .exe or .bat\n| where InitiatingProcessCommandLine !has \".ps1\" and Exe > 1 or\nInitiatingProcessCommandLine has \".bat\"\n// Exclusions: Remove the following line to widen scope of AHQ\n| where not(InitiatingProcessCommandLine has_any(\"batch\", \"auditpol\",\n\"script\", \"scripts\", \"illusive\", \"rebootrequired\"))\n| summarize FileCount = dcount(FolderPath), make_set(SHA1, 100000), make_set(FolderPath, 100000),\nmake_set(FileName, 100000), make_set(InitiatingProcessCommandLine, 100000) by DeviceId, DeviceName,\nTimeWindow=bin(TimeGenerated, 10m), InitiatingProcessFileName\n| where FileCount > 4\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceFileEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "LateralMovement"
-                ],
-                "techniques": [
-                  "T1570"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject28').analyticRuleId28,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 28",
-                "parentId": "[variables('analyticRuleObject28').analyticRuleId28]",
-                "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject28').analyticRuleVersion28]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Remote File Creation with PsExec",
-        "contentProductId": "[variables('analyticRuleObject28')._analyticRulecontentProductId28]",
-        "id": "[variables('analyticRuleObject28')._analyticRulecontentProductId28]",
-        "version": "[variables('analyticRuleObject28').analyticRuleVersion28]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject29').analyticRuleTemplateSpecName29]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ServiceAccountsPerformingRemotePS_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject29')._analyticRulecontentId29]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "Service Accounts Performing Remote PowerShell.\nThe purpose behind this detection is for finding service accounts that are performing remote powershell sessions.\nThere are two phases to the detection: Identify service accounts, Find remote PS cmdlets being ran by these accounts.\nTo accomplish this, we utilize DeviceLogonEvents and DeviceEvents to find cmdlets ran that meet the criteria.\nOne of the main advantages of this method is that only requires server telemetry, and not the attacking client.\nThe first phase relies on the DeviceLogonEvents to determine whether an account is a service account or not, consider the following accounts with logons:.\nRandom_user has DeviceLogonEvents with type 2, 3, 7, 10, 11 & 13.\nRandom_service_account 'should' only have DeviceLogonEvents with type 3,4 or 5.",
-                "displayName": "Service Accounts Performing Remote PS",
-                "enabled": false,
-                "query": "let InteractiveTypes = pack_array(                                  // Declare Interactive logon type names\n    'Interactive',\n    'CachedInteractive',\n    'Unlock',\n    'RemoteInteractive',\n    'CachedRemoteInteractive',\n    'CachedUnlock'\n);\nlet WhitelistedCmdlets = pack_array(                                // List of whitelisted commands that don't provide a lot of value\n    'prompt',\n    'Out-Default',\n    'out-lineoutput',\n    'format-default',\n    'Set-StrictMode',\n    'TabExpansion2'\n);\nlet WhitelistedAccounts = pack_array('FakeWhitelistedAccount');     // List of accounts that are known to perform this activity in the environment and can be ignored\nDeviceLogonEvents                                                         // Get all logon events...\n| where AccountName !in~ (WhitelistedAccounts)                      // ...where it is not a whitelisted account...\n| where ActionType == \"LogonSuccess\"                                // ...and the logon was successful...\n| where AccountName !contains \"$\"                                   // ...and not a machine logon.\n| where AccountName !has \"winrm va_\"                                // WinRM will have pseudo account names that match this if there is an explicit permission for an admin to run the cmdlet, so assume it is good.\n| extend IsInteractive=(LogonType in (InteractiveTypes))            // Determine if the logon is interactive (True=1,False=0)...\n| summarize HasInteractiveLogon=max(IsInteractive)                  // ...then bucket and get the maximum interactive value (0 or 1)...\n            by AccountName                                          // ... by the AccountNames\n| where HasInteractiveLogon == 0                                    // ...and filter out all accounts that had an interactive logon.\n// At this point, we have a list of accounts that we believe to be service accounts\n// Now we need to find RemotePS sessions that were spawned by those accounts\n// Note that we look at all powershell cmdlets executed to form a 29-day baseline to evaluate the data on today\n| join kind=rightsemi (                                             // Start by dropping the account name and only tracking the...\n\tDeviceEvents                                                      // ...\n\t| where ActionType == 'PowerShellCommand'                         // ...PowerShell commands seen...\n\t| where InitiatingProcessFileName =~ 'wsmprovhost.exe'            // ...whose parent was wsmprovhost.exe (RemotePS Server)...\n    | extend AccountName = InitiatingProcessAccountName             // ...and add an AccountName field so the join is easier\n) on AccountName\n// At this point, we have all of the commands that were ran by service accounts\n| extend Command = tostring(extractjson('$.Command', tostring(AdditionalFields))) // Extract the actual PowerShell command that was executed\n| where Command !in (WhitelistedCmdlets)                                          // Remove any values that match the whitelisted cmdlets\n| summarize (Timestamp, ReportId)=arg_max(TimeGenerated, ReportId),               // Then group all of the cmdlets and calculate the min/max times of execution...\n    make_set(Command, 100000), count(), min(TimeGenerated) by                     // ...as well as creating a list of cmdlets ran and the count..\n    AccountName, AccountDomain, DeviceName, DeviceId                                             // ...and have the commonality be the account, DeviceName and DeviceId\n// At this point, we have machine-account pairs along with the list of commands run as well as the first/last time the commands were ran\n| order by AccountName asc                                        // Order the final list by AccountName just to make it easier to go through\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")                                           \n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceLogonEvents",
-                      "DeviceEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "LateralMovement"
-                ],
-                "techniques": [
-                  "T1210"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "AccountName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "AccountDomain"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
-                      }
-                    ],
-                    "entityType": "Account"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject29').analyticRuleId29,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 29",
-                "parentId": "[variables('analyticRuleObject29').analyticRuleId29]",
-                "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject29').analyticRuleVersion29]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Service Accounts Performing Remote PS",
-        "contentProductId": "[variables('analyticRuleObject29')._analyticRulecontentProductId29]",
-        "id": "[variables('analyticRuleObject29')._analyticRulecontentProductId29]",
-        "version": "[variables('analyticRuleObject29').analyticRuleVersion29]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject30').analyticRuleTemplateSpecName30]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AccountCreation_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject30')._analyticRulecontentId30]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "User accounts may be created to achieve persistence on a machine.\nRead more here: https://attack.mitre.org/wiki/Technique/T1136.\nTags: #CreateAccount.\nQuery #1: Query for users being created using \"net user\" command.\n\"net user\" commands are noisy, so needs to be joined with another signal -.\nE.g. in this example we look for use of uncommon & undocumented commandline switches (e.g. /ad instead of /add).",
-                "displayName": "Account Creation",
-                "enabled": false,
-                "query": "DeviceProcessEvents\n// Pro-tip: \n// There are many different ways to run a process from a file - e.g. by using full path, env. variables, ~1 annotation, more...\n// So, to find executions of a known filename, better filter on the filename (and possibly on folder path) than on the commandline.\n| where FileName in~ (\"net.exe\", \"net1.exe\")\n// Parse the user name from the commandline.\n// To have case-insensitive parsing use the i flag, to have non-greedy match (e.g. CreatedUser as short as possible), specify U flag:\n// \"kind=regex flags=i\"\n| parse kind=regex flags=iU ProcessCommandLine with * \"user \" CreatedUser \" \" * \"/ad\"\n// Filter rows where user could not be parsed - e.g. because it was not a user command, or the /add commandline switch was not specified.\n| where isnotempty(CreatedUser)\n// Every net.exe executed will run net1.exe with the same commandline.\n// in this where clause we remove such rows, as they duplicate the number of results we have without adding any value.\n| where not (FileName =~ \"net1.exe\" and InitiatingProcessFileName =~ \"net.exe\" and replace(\"net\", \"net1\", InitiatingProcessCommandLine) =~ ProcessCommandLine)\n// If /domain is specified, so the user is created on the domain controller.\n// Also, any prefix that's longer than 1 char will also do the same, e.g. /do, /dom, /doma, ....\n| extend CreatedOnLocalMachine=(ProcessCommandLine !contains \"/do\")\n| where ProcessCommandLine !contains \"/add\" or (CreatedOnLocalMachine == 0 and ProcessCommandLine !contains \"/domain\")\n| summarize MachineCount=dcount(DeviceName) by CreatedUser, CreatedOnLocalMachine, InitiatingProcessFileName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessCommandLine, DeviceId, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Persistence"
-                ],
-                "techniques": [
-                  "T1136"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
-                      },
-                      {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
-                      }
-                    ],
-                    "entityType": "Process"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject30').analyticRuleId30,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 30",
-                "parentId": "[variables('analyticRuleObject30').analyticRuleId30]",
-                "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject30').analyticRuleVersion30]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Account Creation",
-        "contentProductId": "[variables('analyticRuleObject30')._analyticRulecontentProductId30]",
-        "id": "[variables('analyticRuleObject30')._analyticRulecontentProductId30]",
-        "version": "[variables('analyticRuleObject30').analyticRuleVersion30]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject31').analyticRuleTemplateSpecName31]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LocalAdminGroupChanges_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject31')._analyticRulecontentId31]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query searches for changes to the local administrators group.\nBlogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.",
-                "displayName": "Local Admin Group Changes",
-                "enabled": false,
-                "query": "let machineAccountSIDs = dynamic([\n  \"S-1-5-18\",\n  \"S-1-5-20\",\n  \"S-1-5-19\"]);\nlet ADAZUsers =  IdentityInfo \n| extend DirectoryDomain = AccountDomain \n| extend DirectoryAccount = AccountName \n| extend OnPremSid = AccountSID\n| distinct DirectoryDomain , DirectoryAccount , OnPremSid , AccountCloudSID, AccountUPN, GivenName, Surname;\n // check for any new created or modified local accounts \nlet NewUsers =  DeviceEvents\n| where ActionType contains \"UserAccountCreated\" or ActionType contains \"UserAccountModified\"\n| extend lUserAdded = AccountName\n| extend NewUserSID = AccountSid\n| extend laccountdomain = AccountDomain\n| distinct NewUserSID, lUserAdded,laccountdomain;\n// Check for any local group changes and enrich the data with the account name obtained from the previous query\nDeviceEvents \n| where ActionType == 'UserAccountAddedToLocalGroup'\n// Exclude machine and wellknown SIDs \n| where (AccountSid !in (machineAccountSIDs)) and (AccountSid matches regex @\"S-\\d-\\d+-\\d+-(\\d+-){1,5}\\d+\")\n| extend LocalGroupSID = tostring(parse_json(AdditionalFields).GroupSid)\n| extend LocalGroup = tostring(parse_json(AdditionalFields).GroupName)\n| extend AddedAccountSID = AccountSid\n| extend Actor = trim(@\"[^\\w]+\",InitiatingProcessAccountName)\n// limit to local administrators group\n// | where LocalGroupSID contains \"S-1-5-32-544\"\n| join kind=leftouter    (NewUsers)\non $left.AddedAccountSID == $right.NewUserSID\n| project TimeGenerated, DeviceName, LocalGroup,LocalGroupSID, AddedAccountSID, lUserAdded , Actor, ActionType , laccountdomain \n| join kind=innerunique  (ADAZUsers)\non $left.AddedAccountSID == $right.OnPremSid\n| extend UserAdded = iff(isnotempty(lUserAdded),strcat(laccountdomain,\"\\\\\", lUserAdded), strcat(DirectoryDomain,\"\\\\\", DirectoryAccount))\n| extend AccountName = iff(isnotempty(lUserAdded), lUserAdded, DirectoryAccount)\n| project TimeGenerated, DeviceName, LocalGroup, LocalGroupSID, AddedAccountSID, UserAdded ,Actor, ActionType, AccountName, laccountdomain  \n| where DeviceName !contains Actor\n// Provide details on actors that added users\n// | summarize count()  by Actor \n// | join ADAZUsers\n// on $left.Actor == $right.DirectoryAccount \n// | render piechart\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "IdentityInfo",
-                      "DeviceEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Persistence"
-                ],
-                "techniques": [
-                  "T1098"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "UserAdded"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
-                      },
-                      {
-                        "identifier": "NTDomain",
-                        "columnName": "laccountdomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject31').analyticRuleId31,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 31",
-                "parentId": "[variables('analyticRuleObject31').analyticRuleId31]",
-                "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject31').analyticRuleVersion31]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Local Admin Group Changes",
-        "contentProductId": "[variables('analyticRuleObject31')._analyticRulecontentProductId31]",
-        "id": "[variables('analyticRuleObject31')._analyticRulecontentProductId31]",
-        "version": "[variables('analyticRuleObject31').analyticRuleVersion31]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject32').analyticRuleTemplateSpecName32]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "RareProcessAsService_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject32')._analyticRulecontentId32]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query is looking for rarely seen processes which are launched as a service. Whiltelisted process list need to be updated based on the environment.\nAuthor: Jouni Mikkola\nMore info: https://threathunt.blog/rare-process-launch-as-a-service/",
-                "displayName": "Rare Process as a Service",
-                "enabled": false,
-                "query": "let LookupTime = 14d;\nlet WhiteList = pack_array(\n\"svchost.exe\",\n\"mssense.exe\",\n\"msmpeng.exe\",\n\"searchindexer.exe\",\n\"microsoftedgeupdate.exe\"\n);\nlet GetServices = materialize (\nDeviceProcessEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, StartedChildProcess = FileName, StartedChildProcessSHA1 = SHA1, StartedChildProcessCmdline = ProcessCommandLine, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName\n);\nGetServices\n| summarize count() by ServiceProcess, DeviceName\n| where count_ < 6 \n| join kind = inner GetServices on ServiceProcess, DeviceName \n| join kind = leftouter ( \nDeviceNetworkEvents \n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, NetworkAction = ActionType, RemoteIP, RemoteUrl\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| join kind = leftouter (\nDeviceFileEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, FileAction = ActionType, ModifiedFile = FileName, ModifiedFileSHA1 = SHA1, ModifiedFilePath = FolderPath\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| join kind = leftouter (\nDeviceImageLoadEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, LoadedDLL = FileName, LoadedDLLSHA1 = SHA1, LoadedDLLPath = FolderPath\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| summarize ConnectedAddresses = make_set(RemoteIP, 100000), ConnectedUrls = make_set(RemoteUrl, 100000), FilesModified = make_set(ModifiedFile, 100000),FileModFolderPath = make_set(ModifiedFilePath, 100000),FileModHA1s = make_set(ModifiedFileSHA1, 100000), ChildProcesses = make_set(StartedChildProcess, 100000), ChildCommandlines = make_set(StartedChildProcessCmdline, 100000), DLLsLoaded = make_set(LoadedDLL, 100000), DLLSHA1 = make_set(LoadedDLLSHA1, 100000) by DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P14D",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents",
-                      "DeviceNetworkEvents",
-                      "DeviceFileEvents",
-                      "DeviceImageLoadEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Persistence"
-                ],
-                "subTechniques": [
-                  "T1543.003"
-                ],
-                "techniques": [
-                  "T1543",
-                  "T1543"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "ServiceProcessID"
-                      },
-                      {
-                        "identifier": "CommandLine",
-                        "columnName": "ServiceProcessCmdline"
-                      }
-                    ],
-                    "entityType": "Process"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject32').analyticRuleId32,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 32",
-                "parentId": "[variables('analyticRuleObject32').analyticRuleId32]",
-                "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject32').analyticRuleVersion32]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Rare Process as a Service",
-        "contentProductId": "[variables('analyticRuleObject32')._analyticRulecontentProductId32]",
-        "id": "[variables('analyticRuleObject32')._analyticRulecontentProductId32]",
-        "version": "[variables('analyticRuleObject32').analyticRuleVersion32]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject33').analyticRuleTemplateSpecName33]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DisableSecurityServiceViaRegistry_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject33')._analyticRulecontentId33]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query checks for processes modifying the registry to disable security features. This is a common technique used by threat actors for defence evasion.",
-                "displayName": "Disabling Security Services via Registry",
-                "enabled": false,
-                "query": "DeviceProcessEvents\n| where InitiatingProcessCommandLine has_all(@'\"reg\"', 'add', @'\"HKLM\\SOFTWARE\\Policies\\', '/v','/t', 'REG_DWORD', '/d', '/f')\n  and InitiatingProcessCommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', \n  'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource')\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1562"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "AccountUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
-                      },
-                      {
-                        "identifier": "NTDomain",
-                        "columnName": "AccountDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
-                      },
-                      {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
-                      }
-                    ],
-                    "entityType": "Process"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject33').analyticRuleId33,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 33",
-                "parentId": "[variables('analyticRuleObject33').analyticRuleId33]",
-                "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject33').analyticRuleVersion33]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Disabling Security Services via Registry",
-        "contentProductId": "[variables('analyticRuleObject33')._analyticRulecontentProductId33]",
-        "id": "[variables('analyticRuleObject33')._analyticRulecontentProductId33]",
-        "version": "[variables('analyticRuleObject33').analyticRuleVersion33]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject34').analyticRuleTemplateSpecName34]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DataDeletionOnMulipleDrivesUsingCipherExe_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject34')._analyticRulecontentId34]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption.",
-                "displayName": "Deletion of data on multiple drives using cipher exe",
-                "enabled": false,
-                "query": "// Look for cipher.exe deleting data from multiple drives\nDeviceProcessEvents\n| where FileName =~ \"cipher.exe\" \n// cipher.exe /w flag used for deleting data \n| where ProcessCommandLine has \"/w\" \n| summarize CipherCount = dcount(ProcessCommandLine), CipherList = make_set(ProcessCommandLine, 1000) by DeviceId, DeviceName, bin(TimeGenerated, 1m) \n// cipher.exe accessing multiple drives in a short timeframe  \n| where CipherCount > 1\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Impact"
-                ],
-                "techniques": [
-                  "T1485"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject34').analyticRuleId34,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 34",
-                "parentId": "[variables('analyticRuleObject34').analyticRuleId34]",
-                "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject34').analyticRuleVersion34]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Deletion of data on multiple drives using cipher exe",
-        "contentProductId": "[variables('analyticRuleObject34')._analyticRulecontentProductId34]",
-        "id": "[variables('analyticRuleObject34')._analyticRulecontentProductId34]",
-        "version": "[variables('analyticRuleObject34').analyticRuleVersion34]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject35').analyticRuleTemplateSpecName35]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LaZagneCredTheft_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject35')._analyticRulecontentId35]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "LaZagne is a popular open-source tool used to recover passwords stored on a local computer. It has been used in ransomware attacks to steal credentials and escalate privileges. This query looks for the execution of LaZagne.",
-                "displayName": "LaZagne Credential Theft",
-                "enabled": false,
-                "query": "DeviceProcessEvents \n| where FileName =~ 'reg.exe'\n| where ProcessCommandLine has_all('save','hklm','sam')\n| project DeviceId, DeviceName, TimeGenerated, InitiatingProcessId, InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "CredentialAccess"
-                ],
-                "techniques": [
-                  "T1003"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
-                      },
-                      {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
-                      }
-                    ],
-                    "entityType": "Process"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject35').analyticRuleId35,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 35",
-                "parentId": "[variables('analyticRuleObject35').analyticRuleId35]",
-                "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject35').analyticRuleVersion35]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "LaZagne Credential Theft",
-        "contentProductId": "[variables('analyticRuleObject35')._analyticRulecontentProductId35]",
-        "id": "[variables('analyticRuleObject35')._analyticRulecontentProductId35]",
-        "version": "[variables('analyticRuleObject35').analyticRuleVersion35]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject36').analyticRuleTemplateSpecName36]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LogDeletionUsingWevtutil_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject36')._analyticRulecontentId36]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. Clearing event logs can be a sign of ransomware activity, as ransomware often attempts to cover its tracks by deleting logs.",
-                "displayName": "Clearing of forensic evidence from event logs using wevtutil",
-                "enabled": false,
-                "query": "// Look for use of wevtutil to clear multiple logs\nDeviceProcessEvents\n| where ProcessCommandLine has \"WEVTUTIL\" and ProcessCommandLine has \"CL\"\n| summarize LogClearCount = dcount(tostring(ProcessCommandLine)), ClearedLogList = make_set(ProcessCommandLine, 100000) by DeviceId, DeviceName, bin(TimeGenerated, 5m)\n| where LogClearCount > 10\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1070"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject36').analyticRuleId36,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 36",
-                "parentId": "[variables('analyticRuleObject36').analyticRuleId36]",
-                "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject36').analyticRuleVersion36]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Clearing of forensic evidence from event logs using wevtutil",
-        "contentProductId": "[variables('analyticRuleObject36')._analyticRulecontentProductId36]",
-        "id": "[variables('analyticRuleObject36')._analyticRulecontentProductId36]",
-        "version": "[variables('analyticRuleObject36').analyticRuleVersion36]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject37').analyticRuleTemplateSpecName37]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MultiProcessKillWithTaskKill_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject37')._analyticRulecontentId37]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. This is a common technique used by ransomware to stop security products and other processes.",
-                "displayName": "Stopping multiple processes using taskkill",
-                "enabled": false,
-                "query": "// Find attempts to stop processes using taskkill.exe\nDeviceProcessEvents\n| where FileName =~ \"taskkill.exe\" \n| summarize taskKillCount = dcount(ProcessCommandLine), TaskKillList = make_set(ProcessCommandLine, 10000) by DeviceId, DeviceName, bin(TimeGenerated, 2m)\n| where taskKillCount > 10\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion"
-                ],
-                "techniques": [
-                  "T1562"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject37').analyticRuleId37,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 37",
-                "parentId": "[variables('analyticRuleObject37').analyticRuleId37]",
-                "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject37').analyticRuleVersion37]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Stopping multiple processes using taskkill",
-        "contentProductId": "[variables('analyticRuleObject37')._analyticRulecontentProductId37]",
-        "id": "[variables('analyticRuleObject37')._analyticRulecontentProductId37]",
-        "version": "[variables('analyticRuleObject37').analyticRuleVersion37]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject38').analyticRuleTemplateSpecName38]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "PotentialCobaltStrikeRansomwareActivity_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject38')._analyticRulecontentId38]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns. It looks for alerts that indicate potential ransomware activity, such as attempts to clear security event logs, delete backup files, and execute Cobalt Strike malware.",
-                "displayName": "Potential Ransomware activity related to Cobalt Strike",
-                "enabled": false,
-                "query": "// Look for sc.exe disabling services\nAlertInfo \n// Attempts to clear security event logs. \n| where Title in(\"Event log was cleared\", \n// List alerts flagging attempts to delete backup files. \n\"File backups were deleted\", \n// Potential Cobalt Strike activity - Note that other threat activity can also \n// trigger alerts for suspicious decoded content \n\"Suspicious decoded content\", \n// Cobalt Strike activity \n\"\\'Atosev\\' malware was detected\", \n\"\\'Ploty\\' malware was detected\", \n\"\\'Bynoco\\' malware was detected\",\n\"\\'Cobaltstrike\\' malware was detected\",\n\"Echo command over pipe on localhost\",\n\"Known attack framework activity was observed\",\n\"An active \\'Cobaltstrike\\' malware was detected\",\n\"Suspicious \\'CobaltStrike\\' behavior was prevented\",\n\"Suspicious process launch by Rundll32.exe\") \n| extend AlertTime = TimeGenerated | distinct AlertTime, AlertId, Title \n| join AlertEvidence on $left.AlertId == $right.AlertId\n| summarize by DeviceId, AlertTime, Title, AlertId\n// Get device IDs\n| join DeviceLogonEvents on $left.DeviceId == $right.DeviceId \n// Creating 10 day Window surrounding alert activity \n| where TimeGenerated < AlertTime + 12h and TimeGenerated > AlertTime - 12h // Projecting specific columns \n| project Title, DeviceName, DeviceId, TimeGenerated, LogonType, AccountDomain, AccountName, AccountSid, AlertTime, AlertId, RemoteIP, RemoteDeviceName\n| extend AccountFullName = tostring(strcat(AccountDomain, \"\\\\\", AccountName))\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "P1D",
-                "queryPeriod": "P1D",
-                "severity": "High",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "AlertInfo",
-                      "AlertEvidence",
-                      "DeviceLogonEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Execution",
-                  "Persistence",
-                  "DefenseEvasion",
-                  "Impact"
-                ],
-                "techniques": [
-                  "T1059",
-                  "T1078",
-                  "T1070",
-                  "T1490"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "AccountFullName"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "AccountDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "Address",
-                        "columnName": "RemoteIP"
-                      }
-                    ],
-                    "entityType": "IP"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject38').analyticRuleId38,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 38",
-                "parentId": "[variables('analyticRuleObject38').analyticRuleId38]",
-                "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject38').analyticRuleVersion38]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Potential Ransomware activity related to Cobalt Strike",
-        "contentProductId": "[variables('analyticRuleObject38')._analyticRulecontentProductId38]",
-        "id": "[variables('analyticRuleObject38')._analyticRulecontentProductId38]",
-        "version": "[variables('analyticRuleObject38').analyticRuleVersion38]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject39').analyticRuleTemplateSpecName39]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "QakbotDiscoveryActivities_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject39')._analyticRulecontentId39]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. It looks for discovery commands such as net.exe, whoami.exe, nslookup.exe, netstat.exe, arp.exe, and ping.exe.",
-                "displayName": "Qakbot Discovery Activies",
-                "enabled": false,
-                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName in~('mobsync.exe','explorer.exe')\n| where (FileName =~ 'net.exe' and InitiatingProcessCommandLine has_all('view','/all'))\n     or (FileName =~ 'whoami.exe' and InitiatingProcessCommandLine has '/all')\n     or (FileName =~ 'nslookup.exe' and InitiatingProcessCommandLine has_all('querytype=ALL','timeout=10'))\n     or (FileName =~ 'netstat.exe' and InitiatingProcessCommandLine has '-nao')\n     or (FileName =~ 'arp.exe' and InitiatingProcessCommandLine has '-a')\n     or (FileName =~ 'ping.exe' and InitiatingProcessCommandLine has '-t' and InitiatingProcessCommandLine endswith '127.0.0.1')\n| summarize DiscoveryCommands = dcount(InitiatingProcessCommandLine), make_set(InitiatingProcessFileName), make_set(FileName), make_set(InitiatingProcessCommandLine) by DeviceId, DeviceName, bin(TimeGenerated, 5m)   \n| where DiscoveryCommands >= 3\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "DefenseEvasion",
-                  "Discovery",
-                  "Execution"
-                ],
-                "techniques": [
-                  "T1140",
-                  "T1010",
-                  "T1059"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject39').analyticRuleId39,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 39",
-                "parentId": "[variables('analyticRuleObject39').analyticRuleId39]",
-                "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject39').analyticRuleVersion39]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Qakbot Discovery Activies",
-        "contentProductId": "[variables('analyticRuleObject39')._analyticRulecontentProductId39]",
-        "id": "[variables('analyticRuleObject39')._analyticRulecontentProductId39]",
-        "version": "[variables('analyticRuleObject39').analyticRuleVersion39]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('analyticRuleObject40').analyticRuleTemplateSpecName40]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ShadowCopyDeletion_AnalyticalRules Analytics Rule with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
-              "name": "[variables('analyticRuleObject40')._analyticRulecontentId40]",
-              "apiVersion": "2023-02-01-preview",
-              "kind": "Scheduled",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "description": "This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors.\nThis query detects know commands that have been used by the ransomware actors.\nSome information from Mitre Attack: \nhttps://attack.mitre.org/techniques/T1490/",
-                "displayName": "Shadow Copy Deletions",
-                "enabled": false,
-                "query": "let CommonRansomwareExecutionCommands = dynamic([@'vssadmin.exe delete shadows /all /quiet', \n@'wmic.exe shadowcopy delete', @'wbadmin delete catalog -quiet', \n@'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}',\n@'del /s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk', \n@'wbadmin delete systemstatebackup -keepVersions:0', \n@'schtasks.exe /Change /TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" /disable', \n@'schtasks.exe /Change /TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" /enable >nul 2>&1', \n@'reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /f >nul 2>&1']);\nDeviceProcessEvents\n| where ProcessCommandLine has_any (CommonRansomwareExecutionCommands)\n| project-reorder TimeGenerated, ProcessCommandLine, DeviceName, AccountName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
-                "queryFrequency": "PT1H",
-                "queryPeriod": "PT1H",
-                "severity": "Medium",
-                "suppressionDuration": "PT1H",
-                "suppressionEnabled": false,
-                "triggerOperator": "GreaterThan",
-                "triggerThreshold": 0,
-                "status": "Available",
-                "requiredDataConnectors": [
-                  {
-                    "connectorId": "MicrosoftThreatProtection",
-                    "dataTypes": [
-                      "DeviceProcessEvents"
-                    ]
-                  }
-                ],
-                "tactics": [
-                  "Impact"
-                ],
-                "techniques": [
-                  "T1490"
-                ],
-                "entityMappings": [
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
-                      },
-                      {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
-                      }
-                    ],
-                    "entityType": "Host"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "FullName",
-                        "columnName": "AccountUpn"
-                      },
-                      {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
-                      },
-                      {
-                        "identifier": "DnsDomain",
-                        "columnName": "AccountDomain"
-                      }
-                    ],
-                    "entityType": "Account"
-                  },
-                  {
-                    "fieldMappings": [
-                      {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
-                      },
-                      {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
-                      }
-                    ],
-                    "entityType": "Process"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject40').analyticRuleId40,'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Analytics Rule 40",
-                "parentId": "[variables('analyticRuleObject40').analyticRuleId40]",
-                "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]",
-                "kind": "AnalyticsRule",
-                "version": "[variables('analyticRuleObject40').analyticRuleVersion40]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]",
-        "contentKind": "AnalyticsRule",
-        "displayName": "Shadow Copy Deletions",
-        "contentProductId": "[variables('analyticRuleObject40')._analyticRulecontentProductId40]",
-        "id": "[variables('analyticRuleObject40')._analyticRulecontentProductId40]",
-        "version": "[variables('analyticRuleObject40').analyticRuleVersion40]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Appspot Phishing Abuse_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_1",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Appspot Phishing Abuse",
-                "category": "Hunting Queries",
-                "query": "EmailUrlInfo\n// Detect URLs with a subdomain on appspot.com\n| where UrlDomain matches regex @'\\b[\\w\\-]+-dot-[\\w\\-\\.]+\\.appspot\\.com\\b'\n// Enrich results with sender and recipient data\n| join kind=inner EmailEvents on $left.NetworkMessageId==$right.NetworkMessageId\n// Phishing attempts from Appspot related campaigns typically contain the recipient's email address in the URI\n// Example 1: https://example-dot-example.appspot.com/#recipient@domain.com\n// Example 2: https://example-dot-example.appspot.com/index.html?user=recipient@domain.com\n| where Url has RecipientEmailAddress\n    // Some phishing campaigns pass recipient email as a Base64 encoded string in the URI\n    or Url has base64_encode_tostring(RecipientEmailAddress)\n| project-away NetworkMessageId1, ReportId1, Type1, TimeGenerated1, Timestamp1\n| extend Name = tostring(split(SenderFromAddress, '@', 0)[0]), UPNSuffix = tostring(split(SenderFromAddress, '@', 1)[0])\n| extend Account_0_Name = Name\n| extend Account_0_UPNSuffix = UPNSuffix\n| extend IP_0_Address = SenderIPv4\n| extend URL_0_Url = Url\n| extend MailBox_0_MailboxPrimaryAddress = RecipientEmailAddress\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps surface phishing campaigns associated with Appspot abuse.These emails frequently contain phishing links that utilize the recipients' own email address as a unique identifier in the URI.\nThis campaign was published on Twitter by @MsftSecIntel at this link: https://twitter.com/MsftSecIntel/status/1374148156301004800\nReference - https://twitter.com/MsftSecIntel/status/1374148156301004800"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 1",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]",
-                "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject1').huntingQueryVersion1]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Appspot Phishing Abuse",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "PayloadDropUsingCertUtil_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_2",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Dropping Payload via certutil",
-                "category": "Hunting Queries",
-                "query": "DeviceFileEvents\n| where InitiatingProcessFileName !~ \"certutil.exe\"\n| where InitiatingProcessFileName !~ \"cmd.exe\"\n| where InitiatingProcessCommandLine has_all(\"-urlcache\", \"split\", \"http\")\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "BazaCall campaign tricks users into calling a fake customer support center, and download a malicious Excel file which contains a macro to infect users' device with BazaLoader. This query searches for a copy of certutil.exe used by the macro."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 2",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]",
-                "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject2').huntingQueryVersion2]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Dropping Payload via certutil",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "JudgementPandaExfilActivity_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_3",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Judgement Panda Exfil Activity",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where ProcessCommandLine has @\"\\ldifde.exe -f -n \"\n     or ProcessCommandLine has @\"\\7za.exe a 1.7z \" \n     or ProcessCommandLine endswith @\" eprod.ldf\" \n     or ProcessCommandLine has @\"\\aaaa\\procdump64.exe\" \n     or ProcessCommandLine has @\"\\aaaa\\netsess.exe\" \n     or ProcessCommandLine has @\"\\aaaa\\7za.exe\" \n     or ProcessCommandLine has @\"copy .\\1.7z \\\" \n     or ProcessCommandLine has @\"copy \\client\\c$\\aaaa\\\" \n     or FolderPath == @\"C:\\Users\\Public\\7za.exe\"\n| top 100 by TimeGenerated desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml.\nQuestions via Twitter: @janvonkirchheim."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1560"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 3",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]",
-                "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject3').huntingQueryVersion3]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Judgement Panda Exfil Activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DeimosComponentExecution_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_4",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Deimos Component Execution",
-                "category": "Hunting Queries",
-                "query": "DeviceEvents   \n| where InitiatingProcessFileName =~ \"powershell.exe\"\n| where ActionType == \"AmsiScriptContent\"\n| where AdditionalFields endswith '[mArS.deiMos]::inteRaCt()\"}'\n| project InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, AdditionalFields\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,Collection,Exfiltration,Impact"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 4",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]",
-                "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject4').huntingQueryVersion4]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Deimos Component Execution",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LemonDuckRegistrationFunction_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_5",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "LemonDuck Registration Function",
-                "category": "Hunting Queries",
-                "query": "DeviceEvents\n| where ActionType == \"PowerShellCommand\"\n| where AdditionalFields =~ \"{\\\"Command\\\":\\\"SIEX\\\"}\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "LemonDuck is a malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,Persistence,LateralMovement,CommandAndControl"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 5",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]",
-                "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject5').huntingQueryVersion5]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
-        "contentKind": "HuntingQuery",
-        "displayName": "LemonDuck Registration Function",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject6').huntingQueryTemplateSpecName6]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DeviceWithLog4jAlerts_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_6",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Devices with Log4j vulnerability alerts and additional other alert related context",
-                "category": "Hunting Queries",
-                "query": "// Get any devices with Log4J related Alert Activity\nlet DevicesLog4JAlerts = AlertInfo\n| where Title in~('Suspicious script launched',\n'Exploitation attempt against Log4j (CVE-2021-44228)',\n'Suspicious process executed by a network service',\n'Possible target of Log4j exploitation (CVE-2021-44228)',\n'Possible target of Log4j exploitation',\n'Possible Log4j exploitation',\n'Network connection seen in CVE-2021-44228 exploitation',\n'Log4j exploitation detected',\n'Possible exploitation of CVE-2021-44228',\n'Possible target of Log4j vulnerability (CVE-2021-44228) scanning',\n'Possible source of Log4j exploitation'\n'Log4j exploitation attempt via cloud application', // Previously titled Exploitation attempt against Log4j\n'Log4j exploitation attempt via email' // Previously titled Log4j Exploitation Attempt\n)\n// Join in evidence information\n| join kind=innerunique AlertEvidence on AlertId\n| where DeviceId != \"\"\n| summarize by DeviceId, Title;\n// Get additional alert activity for each device\nAlertEvidence\n| where DeviceId in(DevicesLog4JAlerts)\n// Add additional info\n| join kind=leftouter AlertInfo on AlertId\n| summarize DeviceAlerts = make_set(Title, 100000), AlertIDs = make_set(AlertId, 100000) by DeviceId, bin(TimeGenerated, 1d)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 6",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6)]",
-                "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject6').huntingQueryVersion6]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Devices with Log4j vulnerability alerts and additional other alert related context",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject7').huntingQueryTemplateSpecName7]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Log4jVulnRelatedAlerts_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_7",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Alerts Related to Log4j Vulnerability",
-                "category": "Hunting Queries",
-                "query": "AlertInfo\n| where Title in~('Suspicious script launched',\n'Exploitation attempt against Log4j (CVE-2021-44228)',\n'Suspicious process executed by a network service',\n'Possible target of Log4j exploitation (CVE-2021-44228)',\n'Possible target of Log4j exploitation',\n'Possible Log4j exploitation',\n'Network connection seen in CVE-2021-44228 exploitation',\n'Log4j exploitation detected',\n'Possible exploitation of CVE-2021-44228',\n'Possible target of Log4j vulnerability (CVE-2021-44228) scanning',\n'Possible source of Log4j exploitation',\n'Log4j exploitation attempt via cloud application', // Previously titled Exploitation attempt against Log4j\n'Log4j exploitation attempt via email' // Previously titled Log4j Exploitation Attempt\n)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Microsoft has observed attackers exploiting vulnerabilities associated with Log4J."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 7",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7)]",
-                "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject7').huntingQueryVersion7]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Alerts Related to Log4j Vulnerability",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject8').huntingQueryTemplateSpecName8]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ImminentRansomware_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_8",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Imminent Ransomware",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n// Pivot on specific commands \n| where ProcessCommandLine has_any(\"-ExclusionPath\", \"Set-MpPreference\", \"advfirewall\", \"-ExclusionExtension\", \n\"-EnableControlledFolderAccess\", \"windefend\", \"onstart\", \"bcdedit\", \"Startup\") \n// Making list of found commands \n| summarize ProcessCommandLine = make_set(ProcessCommandLine, 10000) by DeviceId, bin(TimeGenerated, 6h) \n// Extending columns for later aggregration, based on TTP \n| extend StartUpExclusionPath = iff(ProcessCommandLine has_all(\"-ExclusionPath\", \"Startup\"), 1, 0) \n| extend DefenderTamp = iff(ProcessCommandLine has \"Set-MpPreference\" \nand ProcessCommandLine has_any( \n\"-SevereThreatDefaultAction 6\" \n\"-HighThreatDefaultAction 6\", \n\"-ModerateThreatDefaultAction 6\", \n\"-LowThreatDefaultAction 6\" \n\"-ScanScheduleDay 8\"), 1, 0) \n| extend NetshFirewallTampering = iff(ProcessCommandLine has_all( \"netsh\", \"advfirewall\", \"allprofiles state off\"), 1, 0) \n| extend BatExclusion = iff(ProcessCommandLine has_all(\"-ExclusionExtension\", \".bat\"), 1, 0) \n| extend ExeExclusion = iff(ProcessCommandLine has_all(\"-ExclusionExtension\", \".exe\"), 1, 0) \n| extend DisableControlledFolderAccess = iff(ProcessCommandLine has_all(\"-EnableControlledFolderAccess\", \"Disabled\"), 1, 0) \n| extend ScDeleteDefend = iff(ProcessCommandLine has_all(\"sc\", \"delete\", \"windefend\"), 1, 0) \n| extend BootTampering = iff(ProcessCommandLine has_all(\"bcdedit\", \"default\") and ProcessCommandLine has_any (\"recoveryenabled No\", \"bootstatuspolicy ignoreallfailures\"), 1, 0) \n| extend SchTasks = iff(ProcessCommandLine has_all(\"/sc\", \"onstart\", \"system\", \"/create\", \"/delay\"), 1, 0) \n// Summarizing found commands \n| summarize by NetshFirewallTampering ,BatExclusion, ExeExclusion, DisableControlledFolderAccess, ScDeleteDefend, SchTasks, BootTampering, DefenderTamp, StartUpExclusionPath, DeviceId, TimeGenerated \n// Adding up each piece of evidence \n| extend EvidenceCount = NetshFirewallTampering + BatExclusion + ExeExclusion + DisableControlledFolderAccess + ScDeleteDefend + SchTasks + BootTampering + DefenderTamp + StartUpExclusionPath \n| where EvidenceCount > 4\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Before deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 8",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8)]",
-                "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject8').huntingQueryVersion8]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Imminent Ransomware",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject9').huntingQueryTemplateSpecName9]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MaliciousUseOfMSBuildAsLoLBin_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_9",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious Use of MSBuild as LOLBin",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName =~ \"wmiprvse.exe\" \n| where FileName =~ \"msbuild.exe\" and ProcessCommandLine has \"programdata\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CommandAndControl"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 9",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9)]",
-                "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject9').huntingQueryVersion9]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious Use of MSBuild as LOLBin",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject10').huntingQueryTemplateSpecName10]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "QakbotReconActivities_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_10",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Qakbot Reconnaissance Activities",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where InitiatingProcessFileName == InitiatingProcessCommandLine\n| where ProcessCommandLine has_any (\n\"whoami /all\",\"cmd /c set\",\"arp -a\",\"ipconfig /all\",\"net view /all\",\"nslookup -querytype=ALL -timeout=10\",\n\"net share\",\"route print\",\"netstat -nao\",\"net localgroup\")\n| summarize dcount(FileName), make_set(ProcessCommandLine, 10000) by DeviceId,bin(TimeGenerated, 1d), InitiatingProcessFileName, InitiatingProcessCommandLine\n| where dcount_FileName >= 8\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for reconnaissance and beaconing activities after code injection occurs in Qakbot infections."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Discovery"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 10",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10)]",
-                "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject10').huntingQueryVersion10]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Qakbot Reconnaissance Activities",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject11').huntingQueryTemplateSpecName11]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "RobbinhoodDriver_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject11').huntingQueryVersion11]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_11",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Robbinhood Driver",
-                "category": "Hunting Queries",
-                "query": "DeviceFileEvents\n| where TimeGenerated > ago(7d)\n| where SHA1 in('0b15b5cc64caf0c6ad9bd759eb35383b1f718edf3d7ab4cd912d0d8c1826edf8',\n'31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427')\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query detects the presence of the Robbinhood ransomware driver."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 11",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11)]",
-                "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject11').huntingQueryVersion11]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Robbinhood Driver",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject12').huntingQueryTemplateSpecName12]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Snip3MaliciousNetworkConnectivity_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject12').huntingQueryVersion12]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_12",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Snip3 Malicious Network Connectivity",
-                "category": "Hunting Queries",
-                "query": "DeviceNetworkEvents \n| where InitiatingProcessFileName in~ (\"RegSvcs.exe\",\"RegAsm.exe\", \"InstallUtil.exe\") \n| where InitiatingProcessCommandLine in~ (\"\\\"RegAsm.exe\\\"\",\"\\\"RegSvcs.exe\\\"\",\"\\\"InstallUtil.exe\\\"\") \n| where InitiatingProcessParentFileName endswith \"powershell.exe\" \n  or InitiatingProcessParentFileName endswith \"powershell_ise.exe\" \n  or InitiatingProcessParentFileName endswith \"pwsh.exe\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query looks for potentially hollowed processes that may be used to facilitate command-and-control or exfiltration by Snip3 malware."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CommandAndControl,Exfiltration"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 12",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12)]",
-                "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject12').huntingQueryVersion12]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Snip3 Malicious Network Connectivity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject13').huntingQueryTemplateSpecName13]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MaliciousCMDExecutionByJava_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject13').huntingQueryVersion13]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_13",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Java Executing cmd to run Powershell",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents                         \n| where InitiatingProcessFileName == 'java.exe' and FileName == 'cmd.exe' \nand ProcessCommandLine has_all('powershell iex','DownloadString')\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 13",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13)]",
-                "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject13').huntingQueryVersion13]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Java Executing cmd to run Powershell",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject14').huntingQueryTemplateSpecName14]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Check for spoofing attempts on the domain with Authentication failures_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject14').huntingQueryVersion14]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_14",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spoofing attempts from Specific Domains",
-                "category": "Hunting Queries",
-                "query": "// Add the list of domains to search for.\nlet DomainList = dynamic([\"contoso.com\"]); \nEmailEvents \n| where TimeGenerated > ago (1d) and DetectionMethods has \"spoof\" and SenderFromDomain in~ (DomainList)\n| project TimeGenerated, AR=parse_json(AuthenticationDetails) , NetworkMessageId, EmailDirection, Subject, SenderFromAddress, SenderIPv4, ThreatTypes, DetectionMethods, ThreatNames  \n| evaluate bag_unpack(AR)  \n| where column_ifexists('SPF','') =~ \"fail\" or  column_ifexists('DMARC','') =~ \"fail\" or column_ifexists('DKIM','') =~ \"fail\" or column_ifexists('CompAuth','') =~ \"fail\"\n| extend Name = tostring(split(SenderFromAddress, '@', 0)[0]), UPNSuffix = tostring(split(SenderFromAddress, '@', 1)[0])\n| extend Account_0_Name = Name\n| extend Account_0_UPNSuffix = UPNSuffix\n| extend IP_0_Address = SenderIPv4\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query identifies potential phishing or spoofing attempts originating from specific domains with authentication failures."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 14",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14)]",
-                "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject14').huntingQueryVersion14]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spoofing attempts from Specific Domains",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '1.1.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '1.1.1')))]",
-        "version": "1.1.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject15').huntingQueryTemplateSpecName15]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "C2-NamedPipe_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject15').huntingQueryVersion15]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_15",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "C2-NamedPipe",
-                "category": "Hunting Queries",
-                "query": "// maximum lookback time\nlet minTimeRange = ago(7d);\n// this is what should be constantly tweaked with default C2 framework names, search uses has_any (wildcard)\nlet badPipeNames = pack_array(\n    '\\\\psexec',                                     // PSexec default pipe\n    '\\\\paexec',                                     // PSexec default pipe\n    '\\\\remcom',                                     // PSexec default pipe\n    '\\\\csexec',                                     // PSexec default pipe\n    '\\\\isapi_http',                                 // Uroburos Malware Named Pipe\n    '\\\\isapi_dg',                                   // Uroburos Malware Named Pipe\n    '\\\\isapi_dg2',                                  // Uroburos Malware Named Pipe\n    '\\\\sdlrpc',                                     // Cobra Trojan Named Pipe http://goo.gl/8rOZUX\n    '\\\\ahexec',                                     // Sofacy group malware\n    '\\\\winsession',                                 // Wild Neutron APT malware https://goo.gl/pivRZJ\n    '\\\\lsassw',                                     // Wild Neutron APT malware https://goo.gl/pivRZJ\n    '\\\\46a676ab7f179e511e30dd2dc41bd388',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\9f81f59bc58452127884ce513865ed20',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\e710f28d59aa529d6792ca6ff0ca1b34',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\rpchlp_3',                                   // Project Sauron https://goo.gl/eFoP4A - Technical Analysis Input\n    '\\\\NamePipe_MoreWindows',                       // Cloud Hopper Annex B https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, US-CERT Alert - RedLeaves https://www.us-cert.gov/ncas/alerts/TA17-117A\n    '\\\\pcheap_reuse',                               // Pipe used by Equation Group malware 77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0\n    '\\\\gruntsvc',                                   // Covenant default named pipe\n    '\\\\583da945-62af-10e8-4902-a8f205c72b2e',       // SolarWinds SUNBURST malware report https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n    '\\\\bizkaz',                                     // Snatch Ransomware https://thedfirreport.com/2020/06/21/snatch-ransomware/\n    '\\\\atctl',                                      // https://www.virustotal.com/#/file/a4ddb2664a6c87a1d3c5da5a5a32a5df9a0b0c8f2e951811bd1ec1d44d42ccf1/detection\n    '\\\\userpipe',                                   // ruag apt case\n    '\\\\iehelper',                                   // ruag apt case\n    '\\\\sdlrpc',                                     // project cobra https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    '\\\\comnap',                                     // https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    '\\\\lsadump',                                    // Cred Dump-Tools Named Pipes\n    '\\\\cachedump',                                  // Cred Dump-Tools Named Pipes\n    '\\\\wceservicepipe',                             // Cred Dump-Tools Named Pipes\n    '\\\\jaccdpqnvbrrxlaf',                           // PoshC2 default named pipe\n    '\\\\svcctl',                                     // CrackMapExec default named pipe\n    '\\\\csexecsvc'                                   // CSEXEC default named pipe\n    '\\\\status_',                                    // CS default named pipes https://github.com/Neo23x0/sigma/issues/253\n    '\\\\MSSE-',                                      // CobaltStrike default named pipe\n    '\\\\status_',                                    // CobaltStrike default named pipe\n    '\\\\msagent_',                                   // (target) CobaltStrike default named pipe\n    '\\\\postex_ssh_',                                // CobaltStrike default named pipe\n    '\\\\postex_',                                    // CobaltStrike default named pipe\n    '\\\\Posh'                                        // PoshC2 default named pipe\n);\nDeviceEvents\n| where ActionType == \"NamedPipeEvent\" and Timestamp > minTimeRange\n| extend ParsedFields=parse_json(AdditionalFields)\n| where ParsedFields.FileOperation == \"File created\"\n| where ParsedFields.PipeName has_any (badPipeNames)\n| project TimeGenerated, ActionType, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, ParsedFields.FileOperation, ParsedFields.PipeName\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Detects the creation of a named pipe used by known APT malware.\nReference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CommandAndControl"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 15",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15)]",
-                "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject15').huntingQueryVersion15]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
-        "contentKind": "HuntingQuery",
-        "displayName": "C2-NamedPipe",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject16').huntingQueryTemplateSpecName16]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ReconWithRundll_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject16').huntingQueryVersion16]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_16",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Recon with Rundll",
-                "category": "Hunting Queries",
-                "query": "DeviceNetworkEvents\n| where InitiatingProcessFileName =~ \"rundll32.exe\"\n// Empty command line\n| where InitiatingProcessCommandLine has \"rundll32.exe\" and InitiatingProcessCommandLine !contains \" \" \nand InitiatingProcessCommandLine != \"\" \n| summarize DestinationIPCount = dcount(RemoteIP), make_set(RemoteIP, 100000), make_set(RemoteUrl, 100000), \nmake_set(RemotePort, 100000) by InitiatingProcessCommandLine, DeviceId, bin(TimeGenerated, 5m)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query detects suspicious rundll.exe activity associated with Trickbot campaigns."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Discovery,Collection,CommandAndControl"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 16",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16)]",
-                "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject16').huntingQueryVersion16]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Recon with Rundll",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject17').huntingQueryTemplateSpecName17]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DoppelPaymerProcdump_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject17').huntingQueryVersion17]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_17",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "DopplePaymer Procdump",
-                "category": "Hunting Queries",
-                "query": "// Dumping of LSASS memory using procdump\nDeviceProcessEvents\n| where TimeGenerated > ago(7d)\n// Command lines that include \"lsass\" and -accepteula or -ma flags used in procdump\n| where (ProcessCommandLine has \"lsass\" and (ProcessCommandLine has \"-accepteula\" or\nProcessCommandLine contains \"-ma\"))\n// Omits possible FPs where the full command is just \"procdump.exe lsass\"\nor (FileName in~ ('procdump.exe','procdump64.exe') and ProcessCommandLine has 'lsass')\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Detects the use of ProcDump to dump credentials from LSASS memory by DoppelPaymer ransomware operators."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CredentialAccess"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 17",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17)]",
-                "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject17').huntingQueryVersion17]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
-        "contentKind": "HuntingQuery",
-        "displayName": "DopplePaymer Procdump",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject18').huntingQueryTemplateSpecName18]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LaZagne_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject18').huntingQueryVersion18]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_18",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Credential Harvesting Using LaZagne",
-                "category": "Hunting Queries",
-                "query": "// Find credential theft via SAM database export by LaZagne\nDeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where FileName =~ 'reg.exe'\n    and ProcessCommandLine has 'save'\n    and ProcessCommandLine has 'hklm'\n    and ProcessCommandLine has 'sam'\n| project DeviceId, TimeGenerated, InitiatingProcessId,\nInitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Detects the use of LaZagne to steal credentials from the SAM database by Ryuk ransomware operators."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CredentialAccess"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject18')._huntingQuerycontentId18),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 18",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject18')._huntingQuerycontentId18)]",
-                "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject18').huntingQueryVersion18]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Credential Harvesting Using LaZagne",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject19').huntingQueryTemplateSpecName19]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LSASSCredDumpProcdump_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject19').huntingQueryVersion19]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_19",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "LSASS Credential Dumping with Procdump",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where (FileName has_any (\"procdump.exe\", \"procdump64.exe\") and ProcessCommandLine has \"lsass\") or \n// Looking for Accepteula flag or Write a dump file with all process memory\n(ProcessCommandLine has \"lsass.exe\" and (ProcessCommandLine has \"-accepteula\" or ProcessCommandLine contains \"-ma\"))\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Detects the use of Procdump to dump credentials from LSASS memory."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CredentialAccess"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject19')._huntingQuerycontentId19),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 19",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject19')._huntingQuerycontentId19)]",
-                "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject19').huntingQueryVersion19]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
-        "contentKind": "HuntingQuery",
-        "displayName": "LSASS Credential Dumping with Procdump",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject20').huntingQueryTemplateSpecName20]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ClearSystemLogs_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject20').huntingQueryVersion20]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_20",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Clear System Logs",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where FileName =~ \"fsutil.exe\"\nand ProcessCommandLine has \"usn\" and ProcessCommandLine has \"deletejournal\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query searches for attempts to use fsutil.exe to clear system logs and delete forensic artifacts."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject20')._huntingQuerycontentId20),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 20",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject20')._huntingQuerycontentId20)]",
-                "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject20').huntingQueryVersion20]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Clear System Logs",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject21').huntingQueryTemplateSpecName21]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DoppelpaymerStopServices_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject21').huntingQueryVersion21]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_21",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Doppelpaymer Stop Services",
-                "category": "Hunting Queries",
-                "query": "// Attempts to stop services and allow ransomware execution\nDeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where InitiatingProcessFileName startswith \"psexe\" and FileName =~ \"powershell.exe\" and\nProcessCommandLine has \"stop-service\"\nand ProcessCommandLine has \"sql\" and ProcessCommandLine has \"msexchange\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for attempts to stop security services, which is a common tactic used by DoppelPaymer ransomware operators."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject21')._huntingQuerycontentId21),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 21",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject21')._huntingQuerycontentId21)]",
-                "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject21').huntingQueryVersion21]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Doppelpaymer Stop Services",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject22').huntingQueryTemplateSpecName22]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "QakbotCampaignSelfDeletion_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject22').huntingQueryVersion22]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_22",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Qakbot Campaign Self Deletion",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where FileName =~ \"ping.exe\"\n| where InitiatingProcessFileName =~ \"cmd.exe\"\n| where (InitiatingProcessCommandLine has \"calc.exe\") and (InitiatingProcessCommandLine has \"-n 6\") and (InitiatingProcessCommandLine has \"127.0.0.1\")\n| project TimeGenerated, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DeviceId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query detects if an instance of Qakbot has attempted to overwrite its original binary."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject22')._huntingQuerycontentId22),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 22",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject22')._huntingQuerycontentId22)]",
-                "contentId": "[variables('huntingQueryObject22')._huntingQuerycontentId22]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject22').huntingQueryVersion22]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject22')._huntingQuerycontentId22]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Qakbot Campaign Self Deletion",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject22')._huntingQuerycontentId22,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject22')._huntingQuerycontentId22,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject23').huntingQueryTemplateSpecName23]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Regsvr32Rundll32ImageLoadsAbnormalExtension_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject23').huntingQueryVersion23]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_23",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
-                "category": "Hunting Queries",
-                "query": "DeviceImageLoadEvents \n| where TimeGenerated > ago(1d)\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where FileName !endswith \".dll\"\n| join (\nDeviceNetworkEvents\n| where TimeGenerated > ago(30d)\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where RemoteIPType == \"Public\"\n) on InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessCommandLine\n| project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessParentFileName\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1218.010,T1218.011"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject23')._huntingQuerycontentId23),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 23",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject23')._huntingQuerycontentId23)]",
-                "contentId": "[variables('huntingQueryObject23')._huntingQuerycontentId23]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject23').huntingQueryVersion23]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject23')._huntingQuerycontentId23]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject23')._huntingQuerycontentId23,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject23')._huntingQuerycontentId23,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject24').huntingQueryTemplateSpecName24]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Regsvr32Rundll32WithAnomalousParentProcess_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject24').huntingQueryVersion24]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_24",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Regsvr32 Rundll32 with Anomalous Parent Process",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(30d)\n| where FileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where InitiatingProcessFileName has_any (\"wscript.exe\",\"powershell.exe\",\"cmd.exe\",\"pwsh.exe\",\"cscript.exe\")\n| project TimeGenerated,DeviceName, InvestigatedProcessName=FileName, InvestigatedProcessCommandLine = ProcessCommandLine,InvestigatedProcessStartTime = ProcessCreationTime, InvestigatedProcessId = ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName\n| join (\nDeviceNetworkEvents\n| where TimeGenerated > ago(30d)\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where RemoteIPType == \"Public\"\n| project DeviceName, InvestigatedProcessName=InitiatingProcessFileName, InvestigatedProcessCommandLine = InitiatingProcessCommandLine,InvestigatedProcessStartTime = InitiatingProcessCreationTime, InvestigatedProcessId = InitiatingProcessId, RemoteIP, RemoteUrl\n) on DeviceName, InvestigatedProcessCommandLine, InvestigatedProcessId, InvestigatedProcessName, InvestigatedProcessStartTime\n| project-away DeviceName1, InvestigatedProcessCommandLine1, InvestigatedProcessId1, InvestigatedProcessName1, InvestigatedProcessStartTime1\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for rundll32.exe or regsvr32.exe being spawned by abnormal processes such as wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1218.010,T1218.011"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject24')._huntingQuerycontentId24),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 24",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject24')._huntingQuerycontentId24)]",
-                "contentId": "[variables('huntingQueryObject24')._huntingQuerycontentId24]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject24').huntingQueryVersion24]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject24')._huntingQuerycontentId24]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Regsvr32 Rundll32 with Anomalous Parent Process",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject24')._huntingQuerycontentId24,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject24')._huntingQuerycontentId24,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject25').huntingQueryTemplateSpecName25]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Delivered Bad Emails from Top bad IPv4 addresses_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject25').huntingQueryVersion25]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_25",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Determine Successfully Delivered Phishing Emails by top IP Addresses",
-                "category": "Hunting Queries",
-                "query": "// Adjust the cutoff as needed \nlet cutoff = 5;\nEmailEvents\n| where ThreatTypes has \"Malware\" or ThreatTypes has \"Phish\" \n| summarize count() by SenderIPv4 \n| where count_ > cutoff\n| join kind=inner EmailEvents on SenderIPv4  \n| where DeliveryAction =~ \"Delivered\"\n| extend Name = tostring(split(SenderFromAddress, '@', 0)[0]), UPNSuffix = tostring(split(SenderFromAddress, '@', 1)[0])\n| extend Account_0_Name = Name\n| extend Account_0_UPNSuffix = UPNSuffix\n| extend IP_0_Address = SenderIPv4\n| extend MailBox_0_MailboxPrimaryAddress = RecipientEmailAddress\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query identifies phishing emails sent that were successfully delivered, by top IP addressess. cutoff default value is 5, adjust the value as needed."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject25')._huntingQuerycontentId25),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 25",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject25')._huntingQuerycontentId25)]",
-                "contentId": "[variables('huntingQueryObject25')._huntingQuerycontentId25]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject25').huntingQueryVersion25]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject25')._huntingQuerycontentId25]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Determine Successfully Delivered Phishing Emails by top IP Addresses",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject25')._huntingQuerycontentId25,'-', '1.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject25')._huntingQuerycontentId25,'-', '1.0.2')))]",
-        "version": "1.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject26').huntingQueryTemplateSpecName26]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SuspiciousCommandInitiatedByWebServerProcess_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject26').huntingQueryVersion26]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_26",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Detect Suspicious Commands Initiated by Webserver Processes",
-                "category": "Hunting Queries",
-                "query": "// Suspicious commands launched by web server processes\nDeviceProcessEvents \n| where TimeGenerated > ago(7d)\n// Pivoting on parents or grand parents\nand (((InitiatingProcessParentFileName in(\"w3wp.exe\", \"beasvc.exe\",\n\"httpd.exe\") or InitiatingProcessParentFileName startswith \"tomcat\")\nor InitiatingProcessFileName in(\"w3wp.exe\", \"beasvc.exe\", \"httpd.exe\") or\nInitiatingProcessFileName startswith \"tomcat\"))\n    and FileName in~('cmd.exe','powershell.exe')\n| where ProcessCommandLine contains '%temp%'\n    or ProcessCommandLine has 'wget'\n    or ProcessCommandLine has 'whoami'\n    or ProcessCommandLine has 'certutil'\n    or ProcessCommandLine has 'systeminfo'\n    or ProcessCommandLine has 'ping'\n    or ProcessCommandLine has 'ipconfig'\n    or ProcessCommandLine has 'timeout'\n| summarize take_any(TimeGenerated), take_any(TimeGenerated), take_any(FileName),\nmake_set(ProcessCommandLine, 100000), take_any(InitiatingProcessFileName),\ntake_any(InitiatingProcessParentFileName) by DeviceId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Detect suspicious commands initiated by web server processes used for network discovery and user/owner discovery."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,DefenseEvasion,Discovery"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject26')._huntingQuerycontentId26),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 26",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject26')._huntingQuerycontentId26)]",
-                "contentId": "[variables('huntingQueryObject26')._huntingQuerycontentId26]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject26').huntingQueryVersion26]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject26')._huntingQuerycontentId26]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Detect Suspicious Commands Initiated by Webserver Processes",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject26')._huntingQuerycontentId26,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject26')._huntingQuerycontentId26,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject27').huntingQueryTemplateSpecName27]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User&GroupEnumWithNetCommand_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject27').huntingQueryVersion27]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_27",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Enumeration of Users & Groups for Lateral Movement",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where TimeGenerated > ago(7d) \n| where FileName == 'net.exe' and AccountName != \"\" and ProcessCommandLine !contains '\\\\'  and ProcessCommandLine !contains '/add' \n| where (ProcessCommandLine contains ' user ' or ProcessCommandLine contains ' group ') and (ProcessCommandLine contains ' /do' or ProcessCommandLine contains ' /domain') \n| extend Target = extract(\"(?i)[user|group] (\\\"*[a-zA-Z0-9-_ ]+\\\"*)\", 1, ProcessCommandLine) | filter Target  != '' \n| project AccountName, Target, ProcessCommandLine, DeviceName, TimeGenerated  \n| sort by AccountName, Target\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query hunts for attempts to list users or groups using Net commands, which are commonly used for lateral movement."
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject27')._huntingQuerycontentId27),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 27",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject27')._huntingQuerycontentId27)]",
-                "contentId": "[variables('huntingQueryObject27')._huntingQuerycontentId27]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject27').huntingQueryVersion27]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject27')._huntingQuerycontentId27]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Enumeration of Users & Groups for Lateral Movement",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject27')._huntingQuerycontentId27,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject27')._huntingQuerycontentId27,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject28').huntingQueryTemplateSpecName28]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ATP policy status check_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject28').huntingQueryVersion28]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_28",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "ATP policy status check",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where Application == \"Microsoft Exchange Online\"\n| where ActionType == \"Set-AtpPolicyForO365\"\n| mv-expand ActivityObjects\n| extend Name = tostring(ActivityObjects.Name)\n| extend Value = tostring(ActivityObjects.Value)\n| where Name in (\"EnableATPForSPOTeamsODB\", \"EnableSafeDocs\", \"AllowSafeDocsOpen\")\n| extend packed = pack(Name, Value)\n| summarize PackedInfo = make_bag(packed), ActionType = any(ActionType) by Timestamp, AccountDisplayName\n| evaluate bag_unpack(PackedInfo)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject28')._huntingQuerycontentId28),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 28",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject28')._huntingQuerycontentId28)]",
-                "contentId": "[variables('huntingQueryObject28')._huntingQuerycontentId28]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject28').huntingQueryVersion28]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject28')._huntingQuerycontentId28]",
-        "contentKind": "HuntingQuery",
-        "displayName": "ATP policy status check",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject28')._huntingQuerycontentId28,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject28')._huntingQuerycontentId28,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject29').huntingQueryTemplateSpecName29]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "JNLP attachment_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject29').huntingQueryVersion29]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_29",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "JNLP-File-Attachment",
-                "category": "Hunting Queries",
-                "query": "EmailAttachmentInfo\n| where FileName endswith \".jnlp\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "JNLP file extensions are an uncommon file type often used to deliver malware."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject29')._huntingQuerycontentId29),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 29",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject29')._huntingQuerycontentId29)]",
-                "contentId": "[variables('huntingQueryObject29')._huntingQuerycontentId29]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject29').huntingQueryVersion29]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject29')._huntingQuerycontentId29]",
-        "contentKind": "HuntingQuery",
-        "displayName": "JNLP-File-Attachment",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject29')._huntingQuerycontentId29,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject29')._huntingQuerycontentId29,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject30').huntingQueryTemplateSpecName30]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Safe attachment detection_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject30').huntingQueryVersion30]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_30",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Safe Attachments detections",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where DetectionMethods != \"\" \n| extend detection= tostring(parse_json(DetectionMethods).Phish) \n| where detection has \"File detonation reputation\" or detection has \"File detonation\"\n| summarize total=count() by bin(Timestamp, 1d) \n| order by Timestamp asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query provides insights on the detections done by Safe Attachment detections"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject30')._huntingQuerycontentId30),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 30",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject30')._huntingQuerycontentId30)]",
-                "contentId": "[variables('huntingQueryObject30')._huntingQuerycontentId30]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject30').huntingQueryVersion30]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject30')._huntingQuerycontentId30]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Safe Attachments detections",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject30')._huntingQuerycontentId30,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject30')._huntingQuerycontentId30,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject31').huntingQueryTemplateSpecName31]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Authentication failures_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject31').huntingQueryVersion31]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_31",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Authentication failures by time and authentication type",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago (30d)\n| project Timestamp, AR=parse_json(AuthenticationDetails), NetworkMessageId, EmailDirection, SenderFromAddress, ThreatTypes, DetectionMethods\n| evaluate bag_unpack(AR)\n| where DMARC == \"fail\"\n| summarize count() by bin(Timestamp, 1d)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject31')._huntingQuerycontentId31),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 31",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject31')._huntingQuerycontentId31)]",
-                "contentId": "[variables('huntingQueryObject31')._huntingQuerycontentId31]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject31').huntingQueryVersion31]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject31')._huntingQuerycontentId31]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Authentication failures by time and authentication type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject31')._huntingQuerycontentId31,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject31')._huntingQuerycontentId31,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject32').huntingQueryTemplateSpecName32]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "CompAuth Failure Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject32').huntingQueryVersion32]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_32",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "CompAuth Failure Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| extend CompAuthFail = AuthenticationDetails has_any ('CompAuth\":\"fail') \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spoof - Composite Authentication fails summarizing the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject32')._huntingQuerycontentId32),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 32",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject32')._huntingQuerycontentId32)]",
-                "contentId": "[variables('huntingQueryObject32')._huntingQuerycontentId32]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject32').huntingQueryVersion32]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject32')._huntingQuerycontentId32]",
-        "contentKind": "HuntingQuery",
-        "displayName": "CompAuth Failure Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject32')._huntingQuerycontentId32,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject32')._huntingQuerycontentId32,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject33').huntingQueryTemplateSpecName33]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DKIM Failure Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject33').huntingQueryVersion33]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_33",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "DKIM Failure Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| extend DMARCFail = AuthenticationDetails has_any ('DKIM\":\"fail') \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spoof - DKIM fails summarizing the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject33')._huntingQuerycontentId33),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 33",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject33')._huntingQuerycontentId33)]",
-                "contentId": "[variables('huntingQueryObject33')._huntingQuerycontentId33]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject33').huntingQueryVersion33]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject33')._huntingQuerycontentId33]",
-        "contentKind": "HuntingQuery",
-        "displayName": "DKIM Failure Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject33')._huntingQuerycontentId33,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject33')._huntingQuerycontentId33,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject34').huntingQueryTemplateSpecName34]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DMARC Failure Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject34').huntingQueryVersion34]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_34",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "DMARC Failure Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| extend DMARCFail = AuthenticationDetails has_any ('DMARC\":\"fail') \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spoof - DMARC fails summarizing the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject34')._huntingQuerycontentId34),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 34",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject34')._huntingQuerycontentId34)]",
-                "contentId": "[variables('huntingQueryObject34')._huntingQuerycontentId34]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject34').huntingQueryVersion34]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject34')._huntingQuerycontentId34]",
-        "contentKind": "HuntingQuery",
-        "displayName": "DMARC Failure Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject34')._huntingQuerycontentId34,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject34')._huntingQuerycontentId34,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject35').huntingQueryTemplateSpecName35]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SPF Failure Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject35').huntingQueryVersion35]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_35",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "SPF Failure Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| extend DMARCFail = AuthenticationDetails has_any ('SPF\":\"fail') \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spoof - SPF fails summarizing the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject35')._huntingQuerycontentId35),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 35",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject35')._huntingQuerycontentId35)]",
-                "contentId": "[variables('huntingQueryObject35')._huntingQuerycontentId35]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject35').huntingQueryVersion35]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject35')._huntingQuerycontentId35]",
-        "contentKind": "HuntingQuery",
-        "displayName": "SPF Failure Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject35')._huntingQuerycontentId35,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject35')._huntingQuerycontentId35,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject36').huntingQueryTemplateSpecName36]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spoof attempts with auth failure_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject36').huntingQueryVersion36]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_36",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spoof attempts with auth failure",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where Timestamp > ago (1d) and DetectionMethods contains \"spoof\"  \n| project Timestamp, AR=parse_json(AuthenticationDetails) , NetworkMessageId, EmailDirection, Subject, SenderFromAddress, SenderIPv4,ThreatTypes, DetectionMethods, ThreatNames  \n| evaluate bag_unpack(AR)  \n| where SPF == \"fail\" or DMARC == \"fail\" or DKIM == \"fail\" or CompAuth == \"fail\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps in checking for spoofing attempts on the domain with Authentication failures"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject36')._huntingQuerycontentId36),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 36",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject36')._huntingQuerycontentId36)]",
-                "contentId": "[variables('huntingQueryObject36')._huntingQuerycontentId36]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject36').huntingQueryVersion36]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject36')._huntingQuerycontentId36]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spoof attempts with auth failure",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject36')._huntingQuerycontentId36,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject36')._huntingQuerycontentId36,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject37').huntingQueryTemplateSpecName37]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Spoof detections by Sender Domain_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject37').huntingQueryVersion37]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_37",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Spoof external domain detections by Sender domain (P1/P2)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\"\n| summarize TotalEmailCount = count(),\n            SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof external domain\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\n| where SpoofExternalCount != 0\n| top 10 by SpoofExternalCount\n| project P1Sender, P2Sender, SpoofExternalCount, TotalEmailCount, SpoofExternal_Traffic_Percentage\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject37')._huntingQuerycontentId37),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 37",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject37')._huntingQuerycontentId37)]",
-                "contentId": "[variables('huntingQueryObject37')._huntingQuerycontentId37]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject37').huntingQueryVersion37]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject37')._huntingQuerycontentId37]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Spoof external domain detections by Sender domain (P1/P2)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject37')._huntingQuerycontentId37,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject37')._huntingQuerycontentId37,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject38').huntingQueryTemplateSpecName38]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Spoof DMARC detections by Sender Domain_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject38').huntingQueryVersion38]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_38",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Spoof DMARC detections by Sender domain (P1/P2)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\"\n| summarize TotalEmailCount = count(),\n            DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof DMARC\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\n| where DMARCFailCount != 0\n| top 10 by DMARCFailCount\n| project P1Sender, P2Sender, DMARCFailCount, TotalEmailCount, DMARCFail_Traffic_Percentage\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject38')._huntingQuerycontentId38),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 38",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject38')._huntingQuerycontentId38)]",
-                "contentId": "[variables('huntingQueryObject38')._huntingQuerycontentId38]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject38').huntingQueryVersion38]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject38')._huntingQuerycontentId38]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Spoof DMARC detections by Sender domain (P1/P2)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject38')._huntingQuerycontentId38,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject38')._huntingQuerycontentId38,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject39').huntingQueryTemplateSpecName39]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Spoof Intra-Org detections by SenderDomain_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject39').huntingQueryVersion39]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_39",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Spoof intra-org detections by Sender domain (P1/P2)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\"\n| summarize TotalEmailCount = count(),\n            SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof intra-org\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\n| where SpoofInternalCount != 0\n| top 10 by SpoofInternalCount\n| project P1Sender, P2Sender, SpoofInternalCount, TotalEmailCount, SpoofInternal_Traffic_Percentage\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject39')._huntingQuerycontentId39),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 39",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject39')._huntingQuerycontentId39)]",
-                "contentId": "[variables('huntingQueryObject39')._huntingQuerycontentId39]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject39').huntingQueryVersion39]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject39')._huntingQuerycontentId39]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Spoof intra-org detections by Sender domain (P1/P2)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject39')._huntingQuerycontentId39,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject39')._huntingQuerycontentId39,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject40').huntingQueryTemplateSpecName40]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Message from Accepted Domain with DMARC TempError_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject40').huntingQueryVersion40]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_40",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Message from an Accepted Domain with DMARC TempError",
-                "category": "Hunting Queries",
-                "query": "let SenderDomains = pack_array ('contoso.com','fabrikam.fr');\nEmailEvents\n| where EmailDirection == 'Inbound' and SenderMailFromDomain in (SenderDomains)\n| extend SPF= tostring(parse_json(AuthenticationDetails).SPF)\n| extend DMARC= tostring(parse_json(AuthenticationDetails).DMARC)\n| where DMARC == \"temperror\" or SPF == \"temperror\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject40')._huntingQuerycontentId40),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 40",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject40')._huntingQuerycontentId40)]",
-                "contentId": "[variables('huntingQueryObject40')._huntingQuerycontentId40]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject40').huntingQueryVersion40]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject40')._huntingQuerycontentId40]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Message from an Accepted Domain with DMARC TempError",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject40')._huntingQuerycontentId40,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject40')._huntingQuerycontentId40,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject41').huntingQueryTemplateSpecName41]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Message with URL listed on OpenPhish delivered into Inbox_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject41').huntingQueryVersion41]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_41",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Message with URL listed on OpenPhish delivered into Inbox",
-                "category": "Hunting Queries",
-                "query": "let PhishingURLs = externaldata(url: string)\n[\n    \"https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt\"\n]\nwith (format=\"txt\"); // CSV and JSON formats are also valid formats if using the premium feeds\nEmailUrlInfo\n| where Url in (PhishingURLs)\n| join EmailEvents on NetworkMessageId\n| where LatestDeliveryAction == \"Delivered\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email with a URL from OpenPhish was delivered to Inbox"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject41')._huntingQuerycontentId41),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 41",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject41')._huntingQuerycontentId41)]",
-                "contentId": "[variables('huntingQueryObject41')._huntingQuerycontentId41]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject41').huntingQueryVersion41]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject41')._huntingQuerycontentId41]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Message with URL listed on OpenPhish delivered into Inbox",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject41')._huntingQuerycontentId41,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject41')._huntingQuerycontentId41,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject42').huntingQueryTemplateSpecName42]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Potential OAuth phishing email delivered into Inbox_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject42').huntingQueryVersion42]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_42",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Potential OAuth phishing email delivered into Inbox",
-                "category": "Hunting Queries",
-                "query": "let LoginCom = strcat(\"login.\", \"microsoftonline.com\");\nlet LoginUs  = strcat(\"login.\", \"microsoftonline.us\");\nlet ConsentUrls = pack_array(strcat(\"://\", LoginCom, \"/common/oauth2\"), strcat(\"://\", LoginCom, \"/consumers/oauth2\"), strcat(\"://\", LoginCom, \"/organizations/oauth2\"), strcat(\"://\", LoginUs, \"/common/oauth2\"), strcat(\"://\", LoginUs, \"/consumers/oauth2\"), strcat(\"://\", LoginUs, \"/organizations/oauth2\"));\nEmailUrlInfo\n| where Url has_any (ConsentUrls)\n| join EmailEvents on NetworkMessageId\n| where EmailDirection == \"Inbound\" and LatestDeliveryAction == \"Delivered\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious OAuth app URL has been delivered into an Inbox."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject42')._huntingQuerycontentId42),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 42",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject42')._huntingQuerycontentId42)]",
-                "contentId": "[variables('huntingQueryObject42')._huntingQuerycontentId42]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject42').huntingQueryVersion42]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject42')._huntingQuerycontentId42]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Potential OAuth phishing email delivered into Inbox",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject42')._huntingQuerycontentId42,'-', '1.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject42')._huntingQuerycontentId42,'-', '1.0.1')))]",
-        "version": "1.0.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject43').huntingQueryTemplateSpecName43]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Potentially malicious SVG file delivered into Inbox_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject43').huntingQueryVersion43]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_43",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Potentially malicious svg file delivered to Inbox",
-                "category": "Hunting Queries",
-                "query": "let SuspiciousDisplayNames = pack_array(\"Help Desk\", \"Help Desk Team\", \"Help Desk IT\", \"Microsoft Security\", \"IT Support\", \"Helpdesk\");\nEmailAttachmentInfo\n| where FileName contains \".svg\" and FileType == \"html\" // SVG files which render as only an image will display FileType as Text, unless containing Javascript which displays FileType as Html\n| join EmailEvents on NetworkMessageId\n// | where SenderDisplayName has_any (SuspiciousDisplayNames) // Optionally remove comment to also evaluate and filter based on email display name\n| where LatestDeliveryLocation == \"Inbox/folder\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject43')._huntingQuerycontentId43),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 43",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject43')._huntingQuerycontentId43)]",
-                "contentId": "[variables('huntingQueryObject43')._huntingQuerycontentId43]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject43').huntingQueryVersion43]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject43')._huntingQuerycontentId43]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Potentially malicious svg file delivered to Inbox",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject43')._huntingQuerycontentId43,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject43')._huntingQuerycontentId43,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject44').huntingQueryTemplateSpecName44]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Audit Email Preview-Download action_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject44').huntingQueryVersion44]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_44",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Audit Email Preview-Download action",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| project Timestamp, ActionType, AccountDisplayName, AR=parse_json(RawEventData) \n| evaluate bag_unpack(AR)\n| where RecordType == \"38\" and ExtendedProperties contains \"DownloadEMail\" or ExtendedProperties contains \"GetMailPreviewUrl\"\n| serialize \n| extend RowNumber = row_number()\n| mv-expand ExtendedProperties\n| evaluate bag_unpack(ExtendedProperties, 'xp_')\n| extend DownloadEMail = iff(tostring(xp_Name) == 'DownloadEMail', xp_Value, ''), GetMailPreviewUrl = iff(tostring(xp_Name) == 'GetMailPreviewUrl', xp_Value, ''), MailboxId = iff(tostring(xp_Name) == 'MailboxId', xp_Value, ''), InternetMessageId = iff(tostring(xp_Name) == 'InternetMessageId', xp_Value, '')\n| summarize Timestamp = any(Timestamp), ActionType = any(ActionType), AccountDisplayName = any(AccountDisplayName),  DownloadEmail = make_set_if(DownloadEMail, isnotempty( DownloadEMail)), GetMailPreviewUrl = make_set_if(GetMailPreviewUrl, isnotempty( GetMailPreviewUrl)), MailboxId = make_set_if(MailboxId, isnotempty( MailboxId)), InternetMessageId = make_set_if(InternetMessageId, isnotempty( InternetMessageId)) by RowNumber\n| extend DownloadEmail = tobool(DownloadEmail[0]), GetMailPreviewUrl = tobool(GetMailPreviewUrl[0]), MailboxId = tostring(MailboxId[0]), InternetMessageId = tostring(InternetMessageId[0])\n| project-away RowNumber\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1078"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject44')._huntingQuerycontentId44),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 44",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject44')._huntingQuerycontentId44)]",
-                "contentId": "[variables('huntingQueryObject44')._huntingQuerycontentId44]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject44').huntingQueryVersion44]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject44')._huntingQuerycontentId44]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Audit Email Preview-Download action",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject44')._huntingQuerycontentId44,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject44')._huntingQuerycontentId44,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject45').huntingQueryTemplateSpecName45]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Bad email percentage - Inbound emails_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject45').huntingQueryVersion45]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_45",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Bad email percentage of Inbound emails",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n| summarize TotalEmailCount = count(),\nBadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, 1d)\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\n| project Timestamp,Bad_Traffic_Percentage_Inbound\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject45')._huntingQuerycontentId45),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 45",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject45')._huntingQuerycontentId45)]",
-                "contentId": "[variables('huntingQueryObject45')._huntingQuerycontentId45]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject45').huntingQueryVersion45]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject45')._huntingQuerycontentId45]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Bad email percentage of Inbound emails",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject45')._huntingQuerycontentId45,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject45')._huntingQuerycontentId45,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject46').huntingQueryTemplateSpecName46]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Calculate MDO Efficacy_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject46').huntingQueryVersion46]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_46",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Calculate overall MDO efficacy",
-                "category": "Hunting Queries",
-                "query": "let _startTime = ago(30d); \nlet _endTime = now(); \n// Get all mailflow detected as clean at time of delivery \nlet EmailEventsClean = materialize( \n    EmailEvents \n    | where Timestamp between (_startTime .. _endTime) and EmailDirection == \"Inbound\" \n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" \n    | project NetworkMessageId,ThreatTypes \n); \n// Get all mailflow detected as phish or malware at time of delivery \nlet EmailEventsThreats = materialize( \n    EmailEvents \n    | where Timestamp between (_startTime .. _endTime) and EmailDirection == \"Inbound\" \n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \n    | extend MDO_detection = parse_json(DetectionMethods) \n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \n); \n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each\nlet EmailPostDeliveryFiltered = materialize( \n    EmailPostDeliveryEvents \n    | where Timestamp between (_startTime .. datetime_add('day', 7, _endTime)) \n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\",\"Redelivery\") \n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \n    | summarize arg_max(Timestamp, *) by Key \n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \n); \n// Optional - Get all admin submissions for malware or phish, so we can also count these in the miss bucket. \nlet CloudAppEventsFiltered = materialize( \n    CloudAppEvents \n    | where Timestamp between (_startTime .. datetime_add('day', 7, _endTime)) \n    | where ActionType == \"AdminSubmissionSubmitted\" \n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \n    | where SubmissionType in (\"1\", \"2\") \n    | project SubmissionType,NetworkMessageId \n); \n// Get the number of threats caught in mailflow \nlet Mal_Phish_Mailflow = toscalar( \n    EmailEventsThreats \n    | summarize count() \n); \n// Get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \nlet FP_ZAP = toscalar( \n    EmailPostDeliveryFiltered \n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and ActionType == \"Redelivery\" \n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \n    | summarize count() \n); \n// Get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \nlet FN_ZAP_Successful = toscalar( \n    EmailPostDeliveryFiltered \n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \n    | summarize count() \n); \n// Get the number of threats unsuccessfully cleaned up post delivery. \nlet FN_ZAP_Unsuccessful = toscalar( \n    EmailPostDeliveryFiltered \n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \n    | summarize count() \n); \n// Join the admin submissions to clean mailflow to find the additional miss \nlet FN_Admin_Submissions = toscalar( \n    CloudAppEventsFiltered \n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \n    | summarize count() \n    ); \n// Print each result, and run the formula to calculate effectiveness at time of delivery and post delivery. \nunion withsource=Table \n    (print StatisticName=\"Mal/Phish Mailflow totals - Minus FPs\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \n    (print StatisticName=\"Admin Mal/Phish FNs Submitted\", Value=toreal(FN_Admin_Submissions)), \n    (print StatisticName=\"Mal/Phish FPs Reverse Zapped\", Value=toreal(FP_ZAP)), \n    (print StatisticName=\"Mal/Phish Successfully Zapped\", Value=toreal(FN_ZAP_Successful)), \n    (print StatisticName=\"Mal/Phish UN-Successfully Zapped\", Value=toreal(FN_ZAP_Unsuccessful)), \n    (print StatisticName=\"Effectiveness Post Delivery\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \n    (print StatisticName=\"Effectiveness Pre-Delivery\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2)))\n| project StatisticName, Value\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject46')._huntingQuerycontentId46),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 46",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject46')._huntingQuerycontentId46)]",
-                "contentId": "[variables('huntingQueryObject46')._huntingQuerycontentId46]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject46').huntingQueryVersion46]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject46')._huntingQuerycontentId46]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Calculate overall MDO efficacy",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject46')._huntingQuerycontentId46,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject46')._huntingQuerycontentId46,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject47').huntingQueryTemplateSpecName47]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Email sender IP address Geo location information_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject47').huntingQueryVersion47]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_47",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email sender IP address Geo location information",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where geo_info_from_ip_address(SenderIPv4) != \"\"\n| extend GeoIPInfo = geo_info_from_ip_address(SenderIPv4)\n| extend country = tostring(parse_json(GeoIPInfo).country)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps getting GeoIP information of emails SenderIPv4 addresses."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject47')._huntingQuerycontentId47),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 47",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject47')._huntingQuerycontentId47)]",
-                "contentId": "[variables('huntingQueryObject47')._huntingQuerycontentId47]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject47').huntingQueryVersion47]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject47')._huntingQuerycontentId47]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email sender IP address Geo location information",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject47')._huntingQuerycontentId47,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject47')._huntingQuerycontentId47,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject48').huntingQueryTemplateSpecName48]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for Admin email access_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject48').huntingQueryVersion48]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_48",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for Admin email access",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminMailAccess\"\n| extend data = RawEventData[\"ExtendedProperties\"]\n| extend OpenedMailbox = data[1].[\"Value\"]\n| extend OpenedEmail = url_decode(tostring(data[2].[\"Value\"]))\n| project AccountDisplayName, ActionType, OpenedMailbox, OpenedEmail\n| join EmailEvents on $left.OpenedEmail == $right.InternetMessageId\n| project Timestamp , Actor = AccountDisplayName, ActionType, OpenedMailbox, SenderFromAddress, RecipientEmailAddress, Subject\n| order by Timestamp desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps report on email access by administrators"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1078"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject48')._huntingQuerycontentId48),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 48",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject48')._huntingQuerycontentId48)]",
-                "contentId": "[variables('huntingQueryObject48')._huntingQuerycontentId48]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject48').huntingQueryVersion48]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject48')._huntingQuerycontentId48]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for Admin email access",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject48')._huntingQuerycontentId48,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject48')._huntingQuerycontentId48,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject49').huntingQueryTemplateSpecName49]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for TABL changes_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject49').huntingQueryVersion49]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_49",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for TABL changes",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType contains \"TenantAllowBlockListItems\"\n| order by Timestamp desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject49')._huntingQuerycontentId49),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 49",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject49')._huntingQuerycontentId49)]",
-                "contentId": "[variables('huntingQueryObject49')._huntingQuerycontentId49]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject49').huntingQueryVersion49]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject49')._huntingQuerycontentId49]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for TABL changes",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject49')._huntingQuerycontentId49,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject49')._huntingQuerycontentId49,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject50').huntingQueryTemplateSpecName50]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Local time to UTC time conversion_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject50').huntingQueryVersion50]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_50",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Local time to UTC time conversion",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp between (datetime_local_to_utc(datetime(2023-08-10T00:00:00Z),\"Europe/Madrid\") .. datetime_local_to_utc(datetime(2023-08-31T23:59:59Z),\"Europe/Madrid\"))\n| where DeliveryAction == \"Delivered\"\n| where LatestDeliveryLocation == \"Quarantine\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Advanced Hunting has default timezone as UTC time. Filters in Advanced Hunting also work in UTC by default whereas query results are shown in local time if user has selected local time zone in security center settings."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject50')._huntingQuerycontentId50),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 50",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject50')._huntingQuerycontentId50)]",
-                "contentId": "[variables('huntingQueryObject50')._huntingQuerycontentId50]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject50').huntingQueryVersion50]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject50')._huntingQuerycontentId50]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Local time to UTC time conversion",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject50')._huntingQuerycontentId50,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject50')._huntingQuerycontentId50,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject51').huntingQueryTemplateSpecName51]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Mail item accessed_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject51').huntingQueryVersion51]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_51",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Mail item accessed",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where Timestamp > ago(30d)\n| extend Record= (parse_json(RawEventData)).RecordType\n| where Record == 50\n| take 10\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing emails accessed by end users using cloud app events data"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject51')._huntingQuerycontentId51),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 51",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject51')._huntingQuerycontentId51)]",
-                "contentId": "[variables('huntingQueryObject51')._huntingQuerycontentId51]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject51').huntingQueryVersion51]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject51')._huntingQuerycontentId51]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Mail item accessed",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject51')._huntingQuerycontentId51,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject51')._huntingQuerycontentId51,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject52').huntingQueryTemplateSpecName52]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malicious email senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject52').huntingQueryVersion52]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_52",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious email senders",
-                "category": "Hunting Queries",
-                "query": "let SenderWithQuarantine = EmailEvents\n| where LatestDeliveryLocation == \"Quarantine\"\n| project SenderFromAddress;\nEmailEvents\n| where LatestDeliveryLocation == \"Inbox/folder\"\n| where SenderFromAddress in (SenderWithQuarantine)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for emails from a sender with at least one email in quarantine"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject52')._huntingQuerycontentId52),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 52",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject52')._huntingQuerycontentId52)]",
-                "contentId": "[variables('huntingQueryObject52')._huntingQuerycontentId52]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject52').huntingQueryVersion52]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject52')._huntingQuerycontentId52]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious email senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject52')._huntingQuerycontentId52,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject52')._huntingQuerycontentId52,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject53').huntingQueryTemplateSpecName53]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MDO daily detection summary report_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject53').huntingQueryVersion53]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_53",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MDO daily detection summary report",
-                "category": "Hunting Queries",
-                "query": "let QueryTime = 30d;\nlet Reports = CloudAppEvents \n| where Timestamp > ago(QueryTime)\n| where ActionType == \"UserSubmission\" or ActionType == \"AdminSubmission\"\n| extend MessageDate = todatetime((parse_json(RawEventData)).MessageDate)\n| extend NetworkMessageID = tostring((parse_json(RawEventData)).ObjectId)\n| extend Date_value = tostring(format_datetime( MessageDate, \"yyyy-MM-dd\"))\n| distinct Date_value,NetworkMessageID\n| summarize count() by Date_value\n| project Date_value, MessagesGotReported=count_;\nlet ThreatByAutomation = (AlertEvidence | where Title == \"Email reported by user as malware or phish\")\n| extend LastVerdictfromAutomation = tostring((parse_json(AdditionalFields)).LastVerdict)\n| extend Date_value = tostring(format_datetime( Timestamp, \"yyyy-MM-dd\"))\n| extend DetectionFromAIR = iif(isempty(LastVerdictfromAutomation), \"NoThreatsFound\", tostring(LastVerdictfromAutomation))\n| summarize PostDeliveryTotalAIRInvestigations = count(),\n         PostDeliveryAirNoThreatsFound = countif(DetectionFromAIR contains \"NoThreatsFound\"),\n         PostDeliveryAirSuspicious = countif(DetectionFromAIR contains \"Suspicious\"),\n         PostDeliveryAirMalicious = countif(DetectionFromAIR contains \"Malicious\")\n         by Date_value          //Date Reported from Message Submissions from CloudAppEvents does not match to the AIR Investigations from Alert playbooks\n| project Date_value, PostDeliveryTotalAIRInvestigations, PostDeliveryAirNoThreatsFound, PostDeliveryAirSuspicious, PostDeliveryAirMalicious;\nlet DeliveryInboundEvents = (EmailEvents | where EmailDirection == \"Inbound\" and Timestamp > ago(QueryTime)\n| extend Date_value = tostring(format_datetime( Timestamp, \"yyyy-MM-dd\"))\n| project Date_value, Timestamp, NetworkMessageId, DetectionMethods ,RecipientEmailAddress);\nlet PostDeliveryEvents = (EmailPostDeliveryEvents | where ActionType contains \"ZAP\" and ActionResult == \"Success\"| join DeliveryInboundEvents on RecipientEmailAddress, NetworkMessageId //Only successful ZAP Events, there could still be more, join on Recipient and NetID\n| extend Date_value = tostring(format_datetime( Timestamp, \"yyyy-MM-dd\")) //Zap Timestamp is used and not MessageDate received\n| summarize PostDeliveryZAP=count() by Date_value);\nlet DeliveryByThreat = (DeliveryInboundEvents\n| where Timestamp > ago(QueryTime)\n| extend Date_value = tostring(format_datetime( Timestamp, \"yyyy-MM-dd\"))\n| extend MDO_detection = parse_json(DetectionMethods)\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\"))\n| summarize TotalEmails = count(),\n         Clean = countif(FirstSubcategory contains \"Clean\"),\n         Malware = countif(FirstSubcategory contains \"Malware\"),\n         Phish = countif(FirstSubcategory contains \"Phish\"),\n         Spam = countif(FirstSubcategory contains \"Spam\" and FirstSubcategory !contains \"Bulk\"),\n         Bulk = countif(FirstSubcategory contains \"Bulk\")                  \n         by Date_value;\nDeliveryByThreat\n| join kind=fullouter Reports on Date_value\n| join kind=fullouter PostDeliveryEvents on Date_value\n| join kind=fullouter ThreatByAutomation on Date_value\n| sort by Date_value asc\n| project Date_value, Clean, Malware, Phish, Spam, Bulk, MessagesGotReported, PostDeliveryZAP, PostDeliveryTotalAIRInvestigations, PostDeliveryAirNoThreatsFound, PostDeliveryAirMalicious, PostDeliveryAirSuspicious\n| where isnotempty(Date_value) // As Reports from CloudAppEvents Submissions could contain messages submitted before 30 days it is good to remove all > 30 days, otherwise EMailEvents wouldn't have a date\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject53')._huntingQuerycontentId53),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 53",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject53')._huntingQuerycontentId53)]",
-                "contentId": "[variables('huntingQueryObject53')._huntingQuerycontentId53]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject53').huntingQueryVersion53]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject53')._huntingQuerycontentId53]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MDO daily detection summary report",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject53')._huntingQuerycontentId53,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject53')._huntingQuerycontentId53,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject54').huntingQueryTemplateSpecName54]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "New TABL Items_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject54').huntingQueryVersion54]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_54",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "New TABL Items",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"New-TenantAllowBlockListItems\"\n| extend Parameters = RawEventData.Parameters\n| mv-apply Parameters on ( \n  extend Out=bag_pack(tostring(Parameters.Name), Parameters.Value)\n  | summarize Parameters=make_bag(Out)\n  )\n| extend Allow=Parameters.Allow, Block=Parameters.Block, Entry=Parameters.Entries, ExpirationDate=Parameters.ExpirationDate, ListType=Parameters.ListType,ListSubType=Parameters.ListSubType, ModifiedBy=Parameters.ModifiedBy, NoExpiration=Parameters.NoExpiration, SubmissionID=Parameters.SubmissionID, SubmissionUserId=Parameters.SubmissionUserId, Notes=Parameters.Notes\n| extend Action=iff(Allow == \"True\", \"Allow\", iff(Block == \"True\", \"Block\", \"Unknown\")), AccountUpn=tostring(coalesce(SubmissionUserId, ModifiedBy))\n| project Timestamp, Action, ListType, ListSubType, Entry, ExpirationDate, NoExpiration, AccountUpn, Notes, SubmissionID, ReportId\n| order by Timestamp desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps identifying when new items being added to the Tenant/Allow Block List (TABL) in Defender for Office 365."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject54')._huntingQuerycontentId54),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 54",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject54')._huntingQuerycontentId54)]",
-                "contentId": "[variables('huntingQueryObject54')._huntingQuerycontentId54]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject54').huntingQueryVersion54]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject54')._huntingQuerycontentId54]",
-        "contentKind": "HuntingQuery",
-        "displayName": "New TABL Items",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject54')._huntingQuerycontentId54,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject54')._huntingQuerycontentId54,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject55').huntingQueryTemplateSpecName55]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject55').huntingQueryVersion55]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_55",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n// Exclude phishing-simulation and SecOps mailbox traffic so they do not skew the ranking\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has_any (\"Malware\", \"Phish\", \"Spam\")\n// Uncomment the line below to exclude your own organization's domains (including subdomains)\n// | where SenderFromDomain !contains \".yourdomain.com\"\n// De-duplicate each delivery (NetworkMessageId + recipient) before counting so re-scanned messages are counted once\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderFromDomain\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies the top 10 sender domains delivering inbound emails classified as malware, phishing, or spam.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject55')._huntingQuerycontentId55),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 55",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject55')._huntingQuerycontentId55)]",
-                "contentId": "[variables('huntingQueryObject55')._huntingQuerycontentId55]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject55').huntingQueryVersion55]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject55')._huntingQuerycontentId55]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject55')._huntingQuerycontentId55,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject55')._huntingQuerycontentId55,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject56').huntingQueryTemplateSpecName56]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 External Senders (Malware)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject56').huntingQueryVersion56]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_56",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 External Senders (Malware)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n// Exclude phishing-simulation and SecOps mailbox traffic so they do not skew the ranking\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Malware\"\n//| where SenderFromAddress !contains \".yourdomain.com\"\n// De-duplicate each delivery (NetworkMessageId + recipient) before counting so re-scanned messages are counted once\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderFromAddress\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies the top 10 external sender addresses delivering inbound emails classified as malware.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the malware filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject56')._huntingQuerycontentId56),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 56",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject56')._huntingQuerycontentId56)]",
-                "contentId": "[variables('huntingQueryObject56')._huntingQuerycontentId56]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject56').huntingQueryVersion56]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject56')._huntingQuerycontentId56]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 External Senders (Malware)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject56')._huntingQuerycontentId56,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject56')._huntingQuerycontentId56,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject57').huntingQueryTemplateSpecName57]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 External Senders (Phish)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject57').huntingQueryVersion57]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_57",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 External Senders (Phish)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n// Exclude phishing-simulation and SecOps mailbox traffic so they do not skew the ranking\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Phish\"\n//| where SenderFromAddress !contains \".yourdomain.com\"\n// De-duplicate each delivery (NetworkMessageId + recipient) before counting so re-scanned messages are counted once\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderFromAddress\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies the top 10 external sender addresses delivering inbound emails classified as phishing.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the phishing filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject57')._huntingQuerycontentId57),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 57",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject57')._huntingQuerycontentId57)]",
-                "contentId": "[variables('huntingQueryObject57')._huntingQuerycontentId57]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject57').huntingQueryVersion57]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject57')._huntingQuerycontentId57]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 External Senders (Phish)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject57')._huntingQuerycontentId57,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject57')._huntingQuerycontentId57,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject58').huntingQueryTemplateSpecName58]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 External Senders (Spam)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject58').huntingQueryVersion58]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_58",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 External Senders (Spam)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n| where ThreatTypes has \"Spam\"\n//| where SenderFromAddress !contains \".yourdomain.com\"\n| summarize count() by SenderFromAddress\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies the top 10 external sender addresses delivering inbound emails classified as spam.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject58')._huntingQuerycontentId58),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 58",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject58')._huntingQuerycontentId58)]",
-                "contentId": "[variables('huntingQueryObject58')._huntingQuerycontentId58]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject58').huntingQueryVersion58]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject58')._huntingQuerycontentId58]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 External Senders (Spam)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject58')._huntingQuerycontentId58,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject58')._huntingQuerycontentId58,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject59').huntingQueryTemplateSpecName59]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 External Senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject59').huntingQueryVersion59]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_59",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 External Senders (Spam)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n| where ThreatTypes has \"Spam\"\n//| where SenderFromAddress !contains \".yourdomain.com\"\n| summarize count() by SenderFromAddress\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies the top 10 external sender addresses delivering inbound emails classified as spam.\nTo exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject59')._huntingQuerycontentId59),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 59",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject59')._huntingQuerycontentId59)]",
-                "contentId": "[variables('huntingQueryObject59')._huntingQuerycontentId59]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject59').huntingQueryVersion59]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject59')._huntingQuerycontentId59]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 External Senders (Spam)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject59')._huntingQuerycontentId59,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject59')._huntingQuerycontentId59,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject60').huntingQueryTemplateSpecName60]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 Targeted Users (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject60').huntingQueryVersion60]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_60",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Targeted Users (Malware+Phish+Spam)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n// Exclude phishing-simulation and SecOps mailbox traffic so they do not skew the ranking\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has_any (\"Malware\", \"Phish\", \"Spam\")\n// De-duplicate each delivery (NetworkMessageId + recipient) before counting so re-scanned messages are counted once\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by RecipientEmailAddress\n| top 10 by count_\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies the top 10 users receiving inbound emails classified as malware, phishing, or spam.\nBased on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject60')._huntingQuerycontentId60),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 60",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject60')._huntingQuerycontentId60)]",
-                "contentId": "[variables('huntingQueryObject60')._huntingQuerycontentId60]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject60').huntingQueryVersion60]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject60')._huntingQuerycontentId60]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Targeted Users (Malware+Phish+Spam)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject60')._huntingQuerycontentId60,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject60')._huntingQuerycontentId60,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject61').huntingQueryTemplateSpecName61]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject61').huntingQueryVersion61]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_61",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| where ThreatTypes has_any (\"Malware\", \"Phish\", \"Spam\")\n| summarize count() by AccountUpn\n| top 10 by count_\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Visualises the top 10 users with click attempts on URLs in emails detected as malware, phishing, or spam, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject61')._huntingQuerycontentId61),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 61",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject61')._huntingQuerycontentId61)]",
-                "contentId": "[variables('huntingQueryObject61')._huntingQuerycontentId61]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject61').huntingQueryVersion61]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject61')._huntingQuerycontentId61]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject61')._huntingQuerycontentId61,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject61')._huntingQuerycontentId61,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject62').huntingQueryTemplateSpecName62]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total number of detections by MDO over time_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject62').huntingQueryVersion62]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_62",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MDO Threat Protection Detections trend over time",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet totalinbound = EmailEvents\n| where TimeGenerated >= TimeStart\n| where EmailDirection == \"Inbound\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Inbound Emails\";\nlet totalintraorg = EmailEvents\n| where TimeGenerated >= TimeStart\n| where EmailDirection == \"Intra-org\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Intra-org Emails\";\nlet totaloutbound = EmailEvents\n| where TimeGenerated >= TimeStart\n| where EmailDirection == \"Outbound\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Outbound Emails\";\nlet totalwiththreat = EmailEvents\n| where TimeGenerated >= TimeStart\n| where isnotempty(ThreatTypes)\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Emails with Threat\";\nlet phishingcount = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ThreatTypes has ('Phish')\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Emails Detected as Phish\";\nlet malwarecount = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ThreatTypes has ('Malware')\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Emails Detected as Malware\";\nlet spamcount = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ThreatTypes has ('Spam')\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Emails Detected as Spam\";\nlet zapcount = EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where ActionResult == \"Success\"\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Emails Removed by ZAP\";\nlet usersubmissioncount = CloudAppEvents\n| where TimeGenerated >= TimeStart\n| extend Record= (parse_json(RawEventData)).RecordType\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\n| where Record == 29 | where ActionType == \"UserSubmission\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Emails Reported by Users\";\nlet adminsubmissioncount = CloudAppEvents\n| where TimeGenerated >= TimeStart\n| extend Record= (parse_json(RawEventData)).RecordType\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\n| where Record == 29\n| where ActionType == \"AdminSubmission\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Emails Reported by Admins\";\nunion totalinbound, totalintraorg, totaloutbound, totalwiththreat, phishingcount, malwarecount, spamcount, zapcount,  usersubmissioncount, adminsubmissioncount\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Graph of MDO detections trended over time"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject62')._huntingQuerycontentId62),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 62",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject62')._huntingQuerycontentId62)]",
-                "contentId": "[variables('huntingQueryObject62')._huntingQuerycontentId62]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject62').huntingQueryVersion62]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject62')._huntingQuerycontentId62]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MDO Threat Protection Detections trend over time",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject62')._huntingQuerycontentId62,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject62')._huntingQuerycontentId62,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject63').huntingQueryTemplateSpecName63]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total number of detections by MDO_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject63').huntingQueryVersion63]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_63",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Total number of detections by MDO",
-                "category": "Hunting Queries",
-                "query": "let totalinbound = EmailEvents\n| where EmailDirection == \"Inbound\"\n| summarize Count = count()\n| extend Details = \"Total Inbound Emails\";\nlet totalintraorg = EmailEvents\n| where EmailDirection == \"Intra-org\"\n| summarize Count = count()\n| extend Details = \"Total Intra-org Emails\";\nlet totaloutbound = EmailEvents\n| where EmailDirection == \"Outbound\"\n| summarize Count = count()\n| extend Details = \"Total Outbound Emails\";\nlet totalwiththreat = EmailEvents\n| where isnotempty(ThreatTypes)\n| summarize Count = count()\n| extend Details = \"Total Emails with Threats\";\nlet phishingcount = EmailEvents\n| where ThreatTypes has ('Phish')\n| summarize Count= count()\n| extend Details = \"Emails Detected as Phish\";\nlet malwarecount = EmailEvents\n| where ThreatTypes has ('Malware')\n| summarize Count= count()\n| extend Details = \"Emails Detected as Malware\";\nlet spamcount = EmailEvents\n| where ThreatTypes has ('Spam')\n| summarize Count= count()\n| extend Details = \"Emails Detected as Spam\";\nlet usersubmissioncount = CloudAppEvents\n| extend Record= (parse_json(RawEventData)).RecordType\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\n| where Record == 29 | where ActionType == \"UserSubmission\"\n| summarize Count= count()\n| extend Details = \"Total Emails Reported by Users\";\nlet adminsubmissioncount = CloudAppEvents\n| extend Record= (parse_json(RawEventData)).RecordType\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\n| where Record == 29 | where ActionType == \"AdminSubmission\"\n| summarize Count= count()\n| extend Details = \"Total Emails Reported by Admins\";\nlet zapcount = EmailPostDeliveryEvents\n| where ActionResult == \"Success\"\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\"\n| summarize Count= count()\n| extend Details = \"Total Emails Removed by ZAP\";\nunion totalinbound, phishingcount, malwarecount, spamcount, totalintraorg, totaloutbound, totalwiththreat, usersubmissioncount, zapcount, adminsubmissioncount\n| project Count, Details\n| order by Count desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Provides a summary of total number of detections"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject63')._huntingQuerycontentId63),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 63",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject63')._huntingQuerycontentId63)]",
-                "contentId": "[variables('huntingQueryObject63')._huntingQuerycontentId63]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject63').huntingQueryVersion63]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject63')._huntingQuerycontentId63]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Total number of detections by MDO",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject63')._huntingQuerycontentId63,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject63')._huntingQuerycontentId63,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject64').huntingQueryTemplateSpecName64]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Automated email notifications and suspicious sign-in activity_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject64').huntingQueryVersion64]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_64",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Automated email notifications and suspicious sign-in activity",
-                "category": "Hunting Queries",
-                "query": "let usersWithSuspiciousEmails = EmailEvents\n| where SenderFromAddress in (\"no-reply@notify.microsoft.com\", \"no-reply@dropbox.com\") or InternetMessageId startswith \"<OneTimePasscode\"\n| where isnotempty(RecipientObjectId)\n| distinct RecipientObjectId;\nAADSignInEventsBeta\n| where AccountObjectId in (usersWithSuspiciousEmails)\n| where RiskLevelDuringSignIn == 100\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for Automated email notifications and suspicious sign-in activity"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject64')._huntingQuerycontentId64),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 64",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject64')._huntingQuerycontentId64)]",
-                "contentId": "[variables('huntingQueryObject64')._huntingQuerycontentId64]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject64').huntingQueryVersion64]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject64')._huntingQuerycontentId64]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Automated email notifications and suspicious sign-in activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject64')._huntingQuerycontentId64,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject64')._huntingQuerycontentId64,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject65').huntingQueryTemplateSpecName65]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "BEC - File sharing tactics - Dropbox_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject65').huntingQueryVersion65]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_65",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "BEC - File sharing tactics - Dropbox",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType in (\"Added users and/or groups to shared file/folder\", \"Invited user to Dropbox and added them to shared file/folder\")\n| where Application == \"Dropbox\"\n| where ObjectType == \"File\"\n| extend FileShared = tostring(ObjectName)\n| where isnotempty(FileShared)\n| mv-expand ActivityObjects\n| where ActivityObjects.Type == \"Account\" and ActivityObjects.Role == \"To\"\n| extend SharedBy = AccountId\n| extend UserSharedWith = tostring(ActivityObjects.Name)\n| summarize dcount(UserSharedWith) by FileShared, AccountObjectId\n| where dcount_UserSharedWith >= 20\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for BEC - File sharing tactics - Dropbox"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1021"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject65')._huntingQuerycontentId65),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 65",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject65')._huntingQuerycontentId65)]",
-                "contentId": "[variables('huntingQueryObject65')._huntingQuerycontentId65]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject65').huntingQueryVersion65]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject65')._huntingQuerycontentId65]",
-        "contentKind": "HuntingQuery",
-        "displayName": "BEC - File sharing tactics - Dropbox",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject65')._huntingQuerycontentId65,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject65')._huntingQuerycontentId65,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject66').huntingQueryTemplateSpecName66]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "BEC - File sharing tactics - OneDrive or SharePoint_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject66').huntingQueryVersion66]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_66",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "BEC - File sharing tactics - OneDrive or SharePoint",
-                "category": "Hunting Queries",
-                "query": "let securelinkCreated = CloudAppEvents\n| where ActionType == \"SecureLinkCreated\"\n| project FileCreatedTime = Timestamp, AccountObjectId, ObjectName;\nlet filesCreated = securelinkCreated\n| where isnotempty(ObjectName)\n| distinct tostring(ObjectName);\nCloudAppEvents\n| where ActionType == \"AddedToSecureLink\"\n| where Application in (\"Microsoft SharePoint Online\", \"Microsoft OneDrive for Business\")\n| extend FileShared = tostring(RawEventData.ObjectId)\n| where FileShared in (filesCreated)\n| extend UserSharedWith = tostring(RawEventData.TargetUserOrGroupName)\n| extend TypeofUserSharedWith = RawEventData.TargetUserOrGroupType\n| where TypeofUserSharedWith == \"Guest\"\n| where isnotempty(FileShared) and isnotempty(UserSharedWith)\n| join kind=inner securelinkCreated on $left.FileShared==$right.ObjectName\n// Secure file created recently (in the last 1day)\n| where (Timestamp - FileCreatedTime) between (1d .. 0h)\n| summarize NumofUsersSharedWith = dcount(UserSharedWith) by FileShared\n| where NumofUsersSharedWith >= 20\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1021"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject66')._huntingQuerycontentId66),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 66",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject66')._huntingQuerycontentId66)]",
-                "contentId": "[variables('huntingQueryObject66')._huntingQuerycontentId66]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject66').huntingQueryVersion66]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject66')._huntingQuerycontentId66]",
-        "contentKind": "HuntingQuery",
-        "displayName": "BEC - File sharing tactics - OneDrive or SharePoint",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject66')._huntingQuerycontentId66,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject66')._huntingQuerycontentId66,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject67').huntingQueryTemplateSpecName67]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Email bombing_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject67').huntingQueryVersion67]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_67",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email bombing attacks",
-                "category": "Hunting Queries",
-                "query": "// Find mail that is older than 4 hrs and establish if it is a reply/forward or not. Join that to recent mail where the User hadn't communicated previously. These are new first contact messages.\nlet Contact_Established = EmailEvents \n| where Timestamp <= ago(4hr)\n| where DeliveryLocation != \"Quarantine\"\nand EmailDirection == \"Inbound\"\nand OrgLevelAction != \"Block\"\nand UserLevelAction != \"Block\"\n| extend NewMsg = case(Subject startswith \"RE:\", false, Subject startswith \"FW:\", false, true )\n| where NewMsg == false\n| project Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress);\n// Find new mail in the last 4hrs.\nEmailEvents\n| where Timestamp > ago(4hr)\nand DeliveryAction == \"Delivered\"\n| extend Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress)\n| where Pair !in (Contact_Established)\n| summarize 5_Min_Count = dcount(NetworkMessageId) by RecipientEmailAddress, bin(Timestamp, 5m)\n| where 5_Min_Count > 5 // check if recipient has received more than 5 first contact emails in 5 mins\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing recipients who are potentially victim of email bombing attacks"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Initialaccess"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject67')._huntingQuerycontentId67),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 67",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject67')._huntingQuerycontentId67)]",
-                "contentId": "[variables('huntingQueryObject67')._huntingQuerycontentId67]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject67').huntingQueryVersion67]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject67')._huntingQuerycontentId67]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email bombing attacks",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject67')._huntingQuerycontentId67,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject67')._huntingQuerycontentId67,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject68').huntingQueryTemplateSpecName68]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Emails containing links to IP addresses_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject68').huntingQueryVersion68]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_68",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Emails containing links to IP addresses",
-                "category": "Hunting Queries",
-                "query": "EmailUrlInfo\n| where Url matches regex @\"file://(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for Emails containing links to IP addresses"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject68')._huntingQuerycontentId68),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 68",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject68')._huntingQuerycontentId68)]",
-                "contentId": "[variables('huntingQueryObject68')._huntingQuerycontentId68]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject68').huntingQueryVersion68]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject68')._huntingQuerycontentId68]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Emails containing links to IP addresses",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject68')._huntingQuerycontentId68,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject68')._huntingQuerycontentId68,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject69').huntingQueryTemplateSpecName69]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Files share contents and suspicious sign-in activity_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject69').huntingQueryVersion69]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_69",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Files share contents and suspicious sign-in activity",
-                "category": "Hunting Queries",
-                "query": "let usersWithSuspiciousEmails = EmailEvents\n| where Subject has_all (\"shared\", \"with you\")\n| where Subject has_any (\"payment\", \"invoice\", \"urgent\", \"mandatory\", \"Payoff\", \"Wire\", \"Confirmation\", \"password\")\n| where isnotempty(RecipientObjectId)\n| summarize RecipientCount = dcount(RecipientObjectId), RecipientList = make_set(RecipientObjectId) by Subject\n| where RecipientCount >= 10\n| mv-expand RecipientList to typeof(string)\n| distinct RecipientList;\nAADSignInEventsBeta\n| where AccountObjectId in (usersWithSuspiciousEmails)\n| where RiskLevelDuringSignIn == 100\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for Files share contents and suspicious sign-in activity"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject69')._huntingQuerycontentId69),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 69",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject69')._huntingQuerycontentId69)]",
-                "contentId": "[variables('huntingQueryObject69')._huntingQuerycontentId69]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject69').huntingQueryVersion69]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject69')._huntingQuerycontentId69]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Files share contents and suspicious sign-in activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject69')._huntingQuerycontentId69,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject69')._huntingQuerycontentId69,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject70').huntingQueryTemplateSpecName70]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Good emails from senders with bad patterns_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject70').huntingQueryVersion70]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_70",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Good emails from senders with bad patterns",
-                "category": "Hunting Queries",
-                "query": "//Good emails from senders with bad patterns\nlet PctPhishThreshold = 50;\nlet LookbackWindow = 1d;\n EmailEvents\n| where Timestamp > ago (LookbackWindow) and EmailDirection == \"Inbound\"\n| extend PhishMethods=tostring(parse_json(DetectionMethods).Phish)\n| where PhishMethods contains (\"File\") or PhishMethods contains (\"URL\") or PhishMethods contains (\"Filter\")\n| summarize PhishCount=count() by SenderMailFromAddress,AuthenticationDetails,PhishMethods\n| join kind=inner (EmailEvents | where Timestamp > ago (LookbackWindow) and EmailDirection == \"Inbound\"\n| summarize TotalCount=count() by SenderMailFromAddress,AuthenticationDetails) on SenderMailFromAddress,AuthenticationDetails\n| project-away SenderMailFromAddress1,AuthenticationDetails1\n| extend PctPhish = (PhishCount*100 / TotalCount)\n| where PctPhish < 100 and PctPhish>= PctPhishThreshold\n| join kind=inner (EmailEvents | where Timestamp > ago (LookbackWindow) and EmailDirection == \"Inbound\" and DeliveryLocation<> \"Quarantine\") on SenderMailFromAddress,AuthenticationDetails\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for good emails from senders with bad patterns"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject70')._huntingQuerycontentId70),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 70",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject70')._huntingQuerycontentId70)]",
-                "contentId": "[variables('huntingQueryObject70')._huntingQuerycontentId70]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject70').huntingQueryVersion70]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject70')._huntingQuerycontentId70]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Good emails from senders with bad patterns",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject70')._huntingQuerycontentId70,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject70')._huntingQuerycontentId70,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject71').huntingQueryTemplateSpecName71]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for email bombing attacks_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject71').huntingQueryVersion71]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_71",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for email bombing attacks",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n| make-series Emailcount = count()\n              on Timestamp step 1h by RecipientObjectId\n| extend (Anomalies, AnomalyScore, ExpectedEmails) = series_decompose_anomalies(Emailcount)\n| mv-expand Emailcount, Anomalies, AnomalyScore, ExpectedEmails to typeof(double), Timestamp\n| where Anomalies != 0\n| where AnomalyScore >= 10\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps to hunt for possible email bombing attacks in Microsoft Defender for Office 365."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject71')._huntingQuerycontentId71),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 71",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject71')._huntingQuerycontentId71)]",
-                "contentId": "[variables('huntingQueryObject71')._huntingQuerycontentId71]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject71').huntingQueryVersion71]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject71')._huntingQuerycontentId71]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for email bombing attacks",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject71')._huntingQuerycontentId71,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject71')._huntingQuerycontentId71,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject72').huntingQueryTemplateSpecName72]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for email conversation take over attempts_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject72').huntingQueryVersion72]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_72",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for email conversation take over attempts",
-                "category": "Hunting Queries",
-                "query": "let emailDelivered = EmailEvents\n| where Timestamp < ago(4hrs)\nand DeliveryAction == \"Delivered\"\n| extend Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress)\n| distinct Pair;\nlet EmailDomains = EmailEvents\n| where Timestamp < ago(4hrs)\nand DeliveryAction == \"Delivered\"\n| distinct SenderFromDomain;\nEmailEvents\n| where Timestamp >= ago(4hrs)\n| where DeliveryLocation != \"Quarantine\"\nand EmailDirection == \"Inbound\"\nand OrgLevelAction != \"Block\"\nand UserLevelAction != \"Block\"\n| extend NewMsg = case(Subject contains \"RE:\", false, Subject contains \"FW:\", false, true )\n| project Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress), NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject\n| join kind=leftouter ( emailDelivered ) on Pair\n| order by SenderMailFromAddress\n| where NewMsg == false\nand Pair1 == \"\"\n| join kind=leftouter (EmailDomains) on SenderFromDomain\n| where SenderFromDomain1 == \"\"\n| distinct Pair, NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for email conversation take over attempts"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject72')._huntingQuerycontentId72),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 72",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject72')._huntingQuerycontentId72)]",
-                "contentId": "[variables('huntingQueryObject72')._huntingQuerycontentId72]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject72').huntingQueryVersion72]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject72')._huntingQuerycontentId72]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for email conversation take over attempts",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject72')._huntingQuerycontentId72,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject72')._huntingQuerycontentId72,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject73').huntingQueryTemplateSpecName73]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for malicious attachments using external IOC source_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject73').huntingQueryVersion73]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_73",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for malicious attachments using external IOC source",
-                "category": "Hunting Queries",
-                "query": "let abuse_sha256 = (externaldata(sha256_hash: string)\n[@\"https://bazaar.abuse.ch/export/txt/sha256/recent/\"]\nwith (format=\"txt\"))\n| where sha256_hash !startswith \"#\"\n| project sha256_hash;\nabuse_sha256\n| join (EmailAttachmentInfo\n| where Timestamp > ago(1d)\n) on $left.sha256_hash == $right.SHA256\n| project Timestamp,SenderFromAddress,RecipientEmailAddress,FileName,FileType,SHA256,ThreatTypes,DetectionMethods,NetworkMessageId,ReportId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject73')._huntingQuerycontentId73),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 73",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject73')._huntingQuerycontentId73)]",
-                "contentId": "[variables('huntingQueryObject73')._huntingQuerycontentId73]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject73').huntingQueryVersion73]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject73')._huntingQuerycontentId73]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for malicious attachments using external IOC source",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject73')._huntingQuerycontentId73,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject73')._huntingQuerycontentId73,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject74').huntingQueryTemplateSpecName74]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for malicious URLs using external IOC source_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject74').huntingQueryVersion74]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_74",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for malicious URLs using external IOC source",
-                "category": "Hunting Queries",
-                "query": "let url = (externaldata(url: string )\n[@\"https://urlhaus.abuse.ch/downloads/text_online/\"]\nwith (format=\"txt\"))\n| project url;\nurl\n| join (EmailUrlInfo\n| where Timestamp > ago(2h) \n) on $left.url == $right.Url\n|join EmailEvents on NetworkMessageId\n|project Timestamp, NetworkMessageId, Url, UrlLocation, UrlDomain, SenderFromAddress, SenderDisplayName, SenderIPv4, Subject,RecipientEmailAddress, RecipientObjectId, LatestDeliveryAction, ThreatNames, ThreatTypes, DetectionMethods, DeliveryAction,ReportId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for emails with malicious URLs based on external IOC source"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject74')._huntingQuerycontentId74),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 74",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject74')._huntingQuerycontentId74)]",
-                "contentId": "[variables('huntingQueryObject74')._huntingQuerycontentId74]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject74').huntingQueryVersion74]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject74')._huntingQuerycontentId74]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for malicious URLs using external IOC source",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject74')._huntingQuerycontentId74,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject74')._huntingQuerycontentId74,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject75').huntingQueryTemplateSpecName75]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Inbox rule change which forward-redirect email_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject75').huntingQueryVersion75]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_75",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Inbox rule changes which forward-redirect email",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType contains \"Set-InboxRule\"\n|extend Parameters = tostring((parse_json(RawEventData)).Parameters)\n|where Parameters contains \"ForwardTo\" or Parameters contains \"RedirectTo\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for Inbox rule changes which forward-redirect email"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1098"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject75')._huntingQuerycontentId75),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 75",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject75')._huntingQuerycontentId75)]",
-                "contentId": "[variables('huntingQueryObject75')._huntingQuerycontentId75]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject75').huntingQueryVersion75]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject75')._huntingQuerycontentId75]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Inbox rule changes which forward-redirect email",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject75')._huntingQuerycontentId75,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject75')._huntingQuerycontentId75,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject76').huntingQueryTemplateSpecName76]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MDO_CountOfRecipientsEmailaddressbySubject_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject76').huntingQueryVersion76]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_76",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MDO_CountOfRecipientsEmailaddressbySubject",
-                "category": "Hunting Queries",
-                "query": "//Count of recipient's email addresses by subject\nEmailEvents\n//Change the date for as far back as you want to go\n| where Timestamp > ago(10d)\n| summarize CountRecipientEmailAddress=count() by RecipientEmailAddress, Subject\n//Change the Count of how many times the email with the same subject has come in\n| where CountRecipientEmailAddress >= 15\n| project RecipientEmailAddress, CountRecipientEmailAddress, Subject\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Count of recipient's email addresses by subject"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject76')._huntingQuerycontentId76),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 76",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject76')._huntingQuerycontentId76)]",
-                "contentId": "[variables('huntingQueryObject76')._huntingQuerycontentId76]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject76').huntingQueryVersion76]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject76')._huntingQuerycontentId76]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MDO_CountOfRecipientsEmailaddressbySubject",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject76')._huntingQuerycontentId76,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject76')._huntingQuerycontentId76,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject77').huntingQueryTemplateSpecName77]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MDO_Countofrecipientsemailaddressesbysubject_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject77').huntingQueryVersion77]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_77",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MDO_Countofrecipientsemailaddressesbysubject",
-                "category": "Hunting Queries",
-                "query": "//Count of recipient's email addresses by subject\nEmailEvents\n//Change the date for as far back as you want to go\n| where Timestamp > ago(10d)\n| summarize CountRecipientEmailAddress=count() by RecipientEmailAddress, Subject\n//Change the Count of how many times the email with the same subject has come in\n| where CountRecipientEmailAddress >= 15\n| project RecipientEmailAddress, CountRecipientEmailAddress, Subject\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Count of recipient's email addresses by subject"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject77')._huntingQuerycontentId77),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 77",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject77')._huntingQuerycontentId77)]",
-                "contentId": "[variables('huntingQueryObject77')._huntingQuerycontentId77]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject77').huntingQueryVersion77]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject77')._huntingQuerycontentId77]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MDO_Countofrecipientsemailaddressesbysubject",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject77')._huntingQuerycontentId77,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject77')._huntingQuerycontentId77,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject78').huntingQueryTemplateSpecName78]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MDO_CountOfSendersEmailaddressbySubject_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject78').huntingQueryVersion78]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_78",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MDO_CountOfSendersEmailaddressbySubject",
-                "category": "Hunting Queries",
-                "query": "//Count of sender's email addresses by subject\nEmailEvents\n//Change the date for as far back as you want to go\n| where Timestamp > ago(10d)\n| summarize CountSenderFromAddress=count() by SenderFromAddress, Subject\n//Change the Count of how many times the email with the same subject has come in\n| where CountSenderFromAddress >= 10\n| project SenderFromAddress, CountSenderFromAddress, Subject\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Count of sender's email addresses by subject"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject78')._huntingQuerycontentId78),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 78",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject78')._huntingQuerycontentId78)]",
-                "contentId": "[variables('huntingQueryObject78')._huntingQuerycontentId78]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject78').huntingQueryVersion78]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject78')._huntingQuerycontentId78]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MDO_CountOfSendersEmailaddressbySubject",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject78')._huntingQuerycontentId78,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject78')._huntingQuerycontentId78,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject79').huntingQueryTemplateSpecName79]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MDO_SummaryOfSenders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject79').huntingQueryVersion79]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_79",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MDO_SummaryOfSenders",
-                "category": "Hunting Queries",
-                "query": "//Distinct Count\nEmailEvents\n| summarize QuaratineEmails = count_distinct(DeliveryLocation == \"Quarantine\"),\n  Emails = count_distinct(DeliveryLocation == \"Inbox/folder\"),\n  JunkEmails = count_distinct(DeliveryLocation == \"Junk folder\")by SenderFromAddress\n\n//Count of all Senders and where they were delivered\nEmailEvents\n| summarize QuaratineEmails = count(DeliveryLocation == \"Quarantine\"),\n  Emails = count(DeliveryLocation == \"Inbox/folder\"),\n  JunkEmails = count(DeliveryLocation == \"Junk folder\")by SenderFromAddress\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Count of all Senders and where they were delivered"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject79')._huntingQuerycontentId79),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 79",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject79')._huntingQuerycontentId79)]",
-                "contentId": "[variables('huntingQueryObject79')._huntingQuerycontentId79]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject79').huntingQueryVersion79]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject79')._huntingQuerycontentId79]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MDO_SummaryOfSenders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject79')._huntingQuerycontentId79,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject79')._huntingQuerycontentId79,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject80').huntingQueryTemplateSpecName80]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MDO_URLClickedinEmail_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject80').huntingQueryVersion80]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_80",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MDO_URLClickedinEmail",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| where ActionType == \"ClickAllowed\"\n//| where ActionType <> \"ClickAllowed\"\n| project AccountUpn, ActionType, Url\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "URLs clicked in Email"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject80')._huntingQuerycontentId80),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 80",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject80')._huntingQuerycontentId80)]",
-                "contentId": "[variables('huntingQueryObject80')._huntingQuerycontentId80]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject80').huntingQueryVersion80]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject80')._huntingQuerycontentId80]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MDO_URLClickedinEmail",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject80')._huntingQuerycontentId80,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject80')._huntingQuerycontentId80,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject81').huntingQueryTemplateSpecName81]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top outbound recipient domains sending inbound emails with threats_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject81').huntingQueryVersion81]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_81",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top outbound recipient domains sending inbound emails with threats",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Outbound\"\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\n| summarize count() by RecipientDomain\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\n| join (EmailEvents | where EmailDirection == \"Inbound\" and isempty(ThreatTypes)==false) on SenderFromDomain\n| summarize max(OutboundCount),count() by SenderFromDomain\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\n| sort by OutboundEmails\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for top outbound recipient domains which are sending inbound emails with threats"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject81')._huntingQuerycontentId81),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 81",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject81')._huntingQuerycontentId81)]",
-                "contentId": "[variables('huntingQueryObject81')._huntingQuerycontentId81]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject81').huntingQueryVersion81]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject81')._huntingQuerycontentId81]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top outbound recipient domains sending inbound emails with threats",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject81')._huntingQuerycontentId81,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject81')._huntingQuerycontentId81,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject82').huntingQueryTemplateSpecName82]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Detections by detection methods_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject82').huntingQueryVersion82]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_82",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Detections by detection methods",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(7d)\n| where isnotempty(DetectionMethods)\n| extend MDO_detection = parse_json(DetectionMethods)\n| summarize TotalEmailCount = count(),\n            Phish_detection = countif(isnotempty(MDO_detection.Phish)),\n            Malware_detection = countif(isnotempty(MDO_detection.Malware)),\n            Spam_detection = countif(isnotempty( MDO_detection.Spam)),\n            URL_malicious_reputation = countif(MDO_detection.Phish == @'[\"URL malicious reputation\"]' or MDO_detection.Malware == @'[\"URL malicious reputation\"]'),\n            URL_detonation_reputation = countif(MDO_detection.Phish == @'[\"URL detonation reputation\"]' or MDO_detection.Malware == @'[\"URL detonation reputation\"]'),\n            URL_detonation = countif(MDO_detection.Phish == @'[\"URL detonation\"]' or MDO_detection.Malware == @'[\"URL detonation\"]'),\n            Advanced_filter = countif(MDO_detection.Phish == @'[\"Advanced filter\"]'),\n            General_filter = countif(MDO_detection.Phish == @'[\"General filter\"]'),\n            Spoof_intra_org = countif(MDO_detection.Phish == @'[\"Spoof intra-org\"]'),\n            Spoof_external_domain = countif(MDO_detection.Phish ==  @'[\"Spoof external domain\"]'),\n            Spoof_DMARC = countif(MDO_detection.Phish == @'[\"Spoof DMARC\"]'),\n            Impersonation_brand = countif(MDO_detection.Phish == @'[\"Impersonation brand\"]'),\n            Impersonation_user = countif(MDO_detection.Phish == @'[\"Impersonation user\"]'),\n            Impersonation_domain = countif(MDO_detection.Phish == @'[\"Impersonation domain\"]'),\n            Mixed_analysis_detection= countif(MDO_detection.Phish == @'[\"Mixed analysis detection\"]'),\n            File_reputation = countif(MDO_detection.Phish == @'[\"File reputation\"]' or MDO_detection.Malware == @'[\"File reputation\"]'),\n            File_detonation = countif(MDO_detection.Phish == @'[\"File detonation\"]' or MDO_detection.Malware == @'[\"File detonation\"]'),\n            File_detonation_reputation = countif(MDO_detection.Phish == @'[\"File detonation reputation\"]' or MDO_detection.Malware == @'[\"File detonation reputation\"]'),\n            Antimalware_engine = countif(MDO_detection.Malware == @'[\"Antimalware engine\"]'),\n            Fingerprint_matching = countif(MDO_detection.Phish == @'[\"Fingerprint matching\"]'), \n            Mailbox_intelligence_impersonation = countif(MDO_detection.Phish == @'[\"Mailbox intelligence impersonation\"]'),\n            Campaign = countif(MDO_detection.Phish == @'[\"Campaign\"]' or MDO_detection.Malware == @'[\"Campaign\"]') by bin(Timestamp, 1d)\n| project Timestamp, TotalEmailCount, Phish_detection, Malware_detection, Spam_detection,URL_malicious_reputation,URL_detonation_reputation ,URL_detonation,Advanced_filter, General_filter,Spoof_intra_org,Spoof_external_domain,Spoof_DMARC,Impersonation_brand,Impersonation_user,Impersonation_domain,\nMixed_analysis_detection,File_reputation,File_detonation,File_detonation_reputation,Antimalware_engine,Fingerprint_matching,Mailbox_intelligence_impersonation,Campaign\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing malicious email detections by detection methods"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject82')._huntingQuerycontentId82),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 82",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject82')._huntingQuerycontentId82)]",
-                "contentId": "[variables('huntingQueryObject82')._huntingQuerycontentId82]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject82').huntingQueryVersion82]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject82')._huntingQuerycontentId82]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Detections by detection methods",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject82')._huntingQuerycontentId82,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject82')._huntingQuerycontentId82,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject83').huntingQueryTemplateSpecName83]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Mail reply to new domain_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject83').huntingQueryVersion83]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_83",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Mail reply to new domain",
-                "category": "Hunting Queries",
-                "query": "let emailDelivered = EmailEvents\n| where Timestamp < ago(4hrs)\nand DeliveryAction == \"Delivered\"\n| extend Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress)\n| distinct Pair;\nlet EmailDomains = EmailEvents\n| where Timestamp < ago(4hrs)\nand DeliveryAction == \"Delivered\"\n| distinct SenderFromDomain;\nEmailEvents \n| where Timestamp >= ago(4hrs)\n| where DeliveryLocation != \"Quarantine\"\n and EmailDirection == \"Inbound\" \n and OrgLevelAction != \"Block\"\n and UserLevelAction != \"Block\"\n| extend NewMsg = case(Subject contains \"RE:\", false, Subject contains \"FW:\", false, true )\n| project Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress), NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject \n| join kind=leftouter ( emailDelivered ) on Pair\n| order by SenderMailFromAddress\n| where NewMsg == false\nand Pair1 == \"\"\n| join kind=leftouter (EmailDomains) on SenderFromDomain\n| where SenderFromDomain1 == \"\"\n| distinct Pair, NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject83')._huntingQuerycontentId83),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 83",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject83')._huntingQuerycontentId83)]",
-                "contentId": "[variables('huntingQueryObject83')._huntingQuerycontentId83]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject83').huntingQueryVersion83]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject83')._huntingQuerycontentId83]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Mail reply to new domain",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject83')._huntingQuerycontentId83,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject83')._huntingQuerycontentId83,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject84').huntingQueryTemplateSpecName84]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Mailflow by directionality_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject84').huntingQueryVersion84]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_84",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Mailflow by directionality",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where Timestamp > ago(30d)\n| extend domain = substring(RecipientEmailAddress, indexof(RecipientEmailAddress, \"@\")+1) \n| summarize total=count() by EmailDirection, domain, bin(Timestamp, 1d) \n| order by Timestamp asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing inbound / outbound / intra-org emails by domain per day"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject84')._huntingQuerycontentId84),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 84",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject84')._huntingQuerycontentId84)]",
-                "contentId": "[variables('huntingQueryObject84')._huntingQuerycontentId84]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject84').huntingQueryVersion84]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject84')._huntingQuerycontentId84]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Mailflow by directionality",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject84')._huntingQuerycontentId84,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject84')._huntingQuerycontentId84,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject85').huntingQueryTemplateSpecName85]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malicious emails detected per day_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject85').huntingQueryVersion85]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_85",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious emails detected per day",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where DetectionMethods != \"\" \n| extend detection= parse_json(DetectionMethods) \n| extend Spam = tostring(detection.Spam) \n| extend Phish = tostring(detection.Phish) \n| extend Malware = tostring(detection.Malware) \n| where Spam != '' or Phish != '' or Malware != '' \n| extend detection = case( \n    Malware != \"\", 'Malware', \n    Phish != \"\", 'Phish', \n    'Spam') \n| summarize total=count() by detection, bin(Timestamp, 1d) \n| order by Timestamp asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing Malware, Phishing, Spam emails caught per day"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject85')._huntingQuerycontentId85),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 85",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject85')._huntingQuerycontentId85)]",
-                "contentId": "[variables('huntingQueryObject85')._huntingQuerycontentId85]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject85').huntingQueryVersion85]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject85')._huntingQuerycontentId85]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious emails detected per day",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject85')._huntingQuerycontentId85,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject85')._huntingQuerycontentId85,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject86').huntingQueryTemplateSpecName86]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Sender recipient contact establishment_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject86').huntingQueryVersion86]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_86",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Sender recipient contact establishment",
-                "category": "Hunting Queries",
-                "query": "let emailDelivered = EmailEvents\n| where Timestamp < ago(30d)\nand DeliveryAction == \"Delivered\"\nand SenderDisplayName contains \"Microsoft\"\n| summarize count() by SenderFromAddress\n| where count_ > 3 // ensuring that some level of communications has occured.\n| project SenderFromAddress;\nEmailEvents \n| where Timestamp > ago(24hrs)\n| where DeliveryAction == \"Delivered\"\n and EmailDirection == \"Inbound\" \n and OrgLevelAction != \"Block\"\n and UserLevelAction != \"Block\"\n and SenderDisplayName contains \"Microsoft\" //Change the name here\n| extend NewMsg = case(Subject contains \"RE:\", false, Subject contains \"FW:\", false, true )\n| project SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject \n| join kind=leftanti  ( emailDelivered ) on SenderFromAddress\n| order by SenderMailFromAddress\n| summarize count() by SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps in checking the sender-recipient contact establishment status"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject86')._huntingQuerycontentId86),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 86",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject86')._huntingQuerycontentId86)]",
-                "contentId": "[variables('huntingQueryObject86')._huntingQuerycontentId86]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject86').huntingQueryVersion86]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject86')._huntingQuerycontentId86]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Sender recipient contact establishment",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject86')._huntingQuerycontentId86,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject86')._huntingQuerycontentId86,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject87').huntingQueryTemplateSpecName87]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detections by Delivery Location - High_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject87').huntingQueryVersion87]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_87",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam Detections (High) by delivery location",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ConfidenceLevel has_any ('Spam\":\"High')\n| summarize count() by LatestDeliveryLocation\n| sort by count_ desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails with Spam detections (High confidence) summarizing the data by Delivery Location."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject87')._huntingQuerycontentId87),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 87",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject87')._huntingQuerycontentId87)]",
-                "contentId": "[variables('huntingQueryObject87')._huntingQuerycontentId87]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject87').huntingQueryVersion87]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject87')._huntingQuerycontentId87]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam Detections (High) by delivery location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject87')._huntingQuerycontentId87,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject87')._huntingQuerycontentId87,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject88').huntingQueryTemplateSpecName88]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detections by Delivery Location - Medium_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject88').huntingQueryVersion88]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_88",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam Detections (Normal) by delivery location",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ConfidenceLevel has_any ('Spam\":\"Normal')\n| summarize count() by LatestDeliveryLocation\n| sort by count_ desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject88')._huntingQuerycontentId88),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 88",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject88')._huntingQuerycontentId88)]",
-                "contentId": "[variables('huntingQueryObject88')._huntingQuerycontentId88]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject88').huntingQueryVersion88]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject88')._huntingQuerycontentId88]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam Detections (Normal) by delivery location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject88')._huntingQuerycontentId88,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject88')._huntingQuerycontentId88,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject89').huntingQueryTemplateSpecName89]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 100 malicious email senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject89').huntingQueryVersion89]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_89",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 100 malicious email senders",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where ThreatTypes has \"Phish\" or ThreatTypes has \"Malware\" \n| summarize total=count() by SenderMailFromAddress \n| top 100 by total\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing top 100 malicious senders"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject89')._huntingQuerycontentId89),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 89",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject89')._huntingQuerycontentId89)]",
-                "contentId": "[variables('huntingQueryObject89')._huntingQuerycontentId89]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject89').huntingQueryVersion89]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject89')._huntingQuerycontentId89]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 100 malicious email senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject89')._huntingQuerycontentId89,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject89')._huntingQuerycontentId89,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject90').huntingQueryTemplateSpecName90]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 100 senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject90').huntingQueryVersion90]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_90",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 100 senders",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where Timestamp > ago(30d)\n| summarize mailCountBySender = count() by SenderMailFromAddress \n| top 100 by mailCountBySender\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing top 100 senders in your organization in last 30 days"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject90')._huntingQuerycontentId90),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 90",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject90')._huntingQuerycontentId90)]",
-                "contentId": "[variables('huntingQueryObject90')._huntingQuerycontentId90]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject90').huntingQueryVersion90]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject90')._huntingQuerycontentId90]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 100 senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject90')._huntingQuerycontentId90,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject90')._huntingQuerycontentId90,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject91').huntingQueryTemplateSpecName91]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Zero day threats_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject91').huntingQueryVersion91]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_91",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Zero day threats",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where Timestamp > ago(30d) \n| where DetectionMethods has \"URL Detonation\" or DetectionMethods has \"File Detonation\" \n| count\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing zero day threats via URL and file detonations"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject91')._huntingQuerycontentId91),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 91",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject91')._huntingQuerycontentId91)]",
-                "contentId": "[variables('huntingQueryObject91')._huntingQuerycontentId91]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject91').huntingQueryVersion91]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject91')._huntingQuerycontentId91]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Zero day threats",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject91')._huntingQuerycontentId91,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject91')._huntingQuerycontentId91,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject92').huntingQueryTemplateSpecName92]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Email containing malware accessed on a unmanaged device_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject92').huntingQueryVersion92]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_92",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email containing malware accessed on a unmanaged device",
-                "category": "Hunting Queries",
-                "query": "EmailPostDeliveryEvents\n| where ActionType == \"Malware ZAP\"\n| project NetworkMessageId,InternetMessageId,ActionType,ThreatTypes,DetectionMethods,ZAPReportId=ReportId,ZAPTimestamp=Timestamp\n| join (CloudAppEvents | where ActionType == \"MailItemsAccessed\"\n| extend RawEvent=parse_json(RawEventData)\n| mv-expand RawEvent.Folders\n| mv-expand RawEvent_Folders.FolderItems\n| project SessionId=tostring(RawEvent.SessionId),InternetMessageId=tostring(parse_json(RawEvent_Folders_FolderItems).InternetMessageId),ActionTimestamp=Timestamp,ActionReportId=ReportId\n) on InternetMessageId\n| where isnotempty(SessionId)\n| join (AADSignInEventsBeta | where isempty(DeviceName) | distinct AccountUpn,SessionId) on SessionId\n| project AccountUpn,NetworkMessageId,InternetMessageId,ActionType,ThreatTypes,DetectionMethods,SessionId,ReportId=ActionReportId,Timestamp=ActionTimestamp\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we are looking for emails containing malware accessed on a unmanaged device"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1204"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject92')._huntingQuerycontentId92),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 92",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject92')._huntingQuerycontentId92)]",
-                "contentId": "[variables('huntingQueryObject92')._huntingQuerycontentId92]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject92').huntingQueryVersion92]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject92')._huntingQuerycontentId92]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email containing malware accessed on a unmanaged device",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject92')._huntingQuerycontentId92,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject92')._huntingQuerycontentId92,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject93').huntingQueryTemplateSpecName93]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Email containing malware sent by an internal sender_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject93').huntingQueryVersion93]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_93",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email containing malware sent by an internal sender",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where EmailDirection == \"Intra-org\" or EmailDirection == \"Outbound\"\n| where ThreatTypes == \"Malware\" and SenderFromAddress !startswith \"postmaster@\" and SenderFromAddress !startswith \"microsoftexchange\"\n| join (EmailAttachmentInfo | where isnotempty(ThreatTypes)) on NetworkMessageId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we are looking for emails containing malware attachment sent by an internal sender"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1534"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject93')._huntingQuerycontentId93),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 93",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject93')._huntingQuerycontentId93)]",
-                "contentId": "[variables('huntingQueryObject93')._huntingQuerycontentId93]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject93').huntingQueryVersion93]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject93')._huntingQuerycontentId93]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email containing malware sent by an internal sender",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject93')._huntingQuerycontentId93,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject93')._huntingQuerycontentId93,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject94').huntingQueryTemplateSpecName94]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Email malware detection report_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject94').huntingQueryVersion94]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_94",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email malware detection report",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatNames)\n| join kind=inner EmailAttachmentInfo on NetworkMessageId \n| extend ThreatFamilyAttachment = strcat(format_datetime(Timestamp,'yyyy-M-dd H:mm:ss'), \" /\", ThreatNames, \" /\", FileName, \" /\", NetworkMessageId)\n| summarize ThreatFamily_wih_Attachment= make_list(ThreatFamilyAttachment) by RecipientEmailAddress\n| extend Case = array_length(ThreatFamily_wih_Attachment)\n| project RecipientEmailAddress, Case, ThreatFamily_wih_Attachment \n| sort by Case desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing email malware detection cases"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject94')._huntingQuerycontentId94),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 94",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject94')._huntingQuerycontentId94)]",
-                "contentId": "[variables('huntingQueryObject94')._huntingQuerycontentId94]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject94').huntingQueryVersion94]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject94')._huntingQuerycontentId94]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email malware detection report",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject94')._huntingQuerycontentId94,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject94')._huntingQuerycontentId94,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject95').huntingQueryTemplateSpecName95]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Malware Detection Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject95').huntingQueryVersion95]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_95",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Malware Detection Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nCloudAppEvents\n| where TimeGenerated >= TimeStart\n| where ActionType == 'FileMalwareDetected'\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject95')._huntingQuerycontentId95),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 95",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject95')._huntingQuerycontentId95)]",
-                "contentId": "[variables('huntingQueryObject95')._huntingQuerycontentId95]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject95').huntingQueryVersion95]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject95')._huntingQuerycontentId95]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Malware Detection Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject95')._huntingQuerycontentId95,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject95')._huntingQuerycontentId95,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject96').huntingQueryTemplateSpecName96]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Malware Top Families by AV_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject96').huntingQueryVersion96]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_96",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Malware by Top Malware Families (Anti Virus)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == 'FileMalwareDetected' and isempty(UserAgent)\n| project ObjectName, UserAgent, RawinfoVirusInfo = RawEventData.VirusInfo\n| summarize count() by tostring(RawinfoVirusInfo) | sort by count_\n| render piechart\n// | render columnchart // Uncomment to change the graph type\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject96')._huntingQuerycontentId96),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 96",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject96')._huntingQuerycontentId96)]",
-                "contentId": "[variables('huntingQueryObject96')._huntingQuerycontentId96]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject96').huntingQueryVersion96]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject96')._huntingQuerycontentId96]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Malware by Top Malware Families (Anti Virus)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject96')._huntingQuerycontentId96,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject96')._huntingQuerycontentId96,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject97').huntingQueryTemplateSpecName97]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Malware Top Families by Safe Attachments_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject97').huntingQueryVersion97]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_97",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Malware by Top Malware Families (Safe Attachments)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == 'FileMalwareDetected' and UserAgent =~ 'MS Scanner ATP'\n| project ObjectName, UserAgent, RawinfoVirusInfo = RawEventData.VirusInfo\n| summarize count() by tostring(RawinfoVirusInfo) | sort by count_\n| render piechart\n// | render columnchart // Uncomment to change the graph type\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject97')._huntingQuerycontentId97),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 97",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject97')._huntingQuerycontentId97)]",
-                "contentId": "[variables('huntingQueryObject97')._huntingQuerycontentId97]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject97').huntingQueryVersion97]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject97')._huntingQuerycontentId97]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Malware by Top Malware Families (Safe Attachments)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject97')._huntingQuerycontentId97,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject97')._huntingQuerycontentId97,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject98').huntingQueryTemplateSpecName98]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware Detection Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject98').huntingQueryVersion98]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_98",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\"\n| make-series MalwareDetections = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Malware detections over time summarizing the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject98')._huntingQuerycontentId98),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 98",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject98')._huntingQuerycontentId98)]",
-                "contentId": "[variables('huntingQueryObject98')._huntingQuerycontentId98]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject98').huntingQueryVersion98]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject98')._huntingQuerycontentId98]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject98')._huntingQuerycontentId98,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject98')._huntingQuerycontentId98,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject99').huntingQueryTemplateSpecName99]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware Detections by Delivery Location_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject99').huntingQueryVersion99]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_99",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware Detections by delivery location",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\" and EmailDirection == \"Inbound\"\n| make-series TotalMalwareDetections = count(), Quarantine = countif(DeliveryLocation == \"Quarantine\"), Failed = countif(DeliveryLocation == \"Failed\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject99')._huntingQuerycontentId99),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 99",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject99')._huntingQuerycontentId99)]",
-                "contentId": "[variables('huntingQueryObject99')._huntingQuerycontentId99]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject99').huntingQueryVersion99]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject99')._huntingQuerycontentId99]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware Detections by delivery location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject99')._huntingQuerycontentId99,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject99')._huntingQuerycontentId99,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject100').huntingQueryTemplateSpecName100]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware Detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject100').huntingQueryVersion100]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_100",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware Detections by Detection technology Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\"\n| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)\n| where isnotempty(MalwareMethod)\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by MalwareMethod\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject100')._huntingQuerycontentId100),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 100",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject100')._huntingQuerycontentId100)]",
-                "contentId": "[variables('huntingQueryObject100')._huntingQuerycontentId100]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject100').huntingQueryVersion100]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject100')._huntingQuerycontentId100]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware Detections by Detection technology Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject100')._huntingQuerycontentId100,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject100')._huntingQuerycontentId100,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject101').huntingQueryTemplateSpecName101]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware Detections by Detection Technology_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject101').huntingQueryVersion101]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_101",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware Detections by Detection technology",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\"\n| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)\n| where isnotempty(MalwareMethod)\n| summarize Count = count() by MalwareMethod\n| sort by Count desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject101')._huntingQuerycontentId101),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 101",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject101')._huntingQuerycontentId101)]",
-                "contentId": "[variables('huntingQueryObject101')._huntingQuerycontentId101]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject101').huntingQueryVersion101]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject101')._huntingQuerycontentId101]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware Detections by Detection technology",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject101')._huntingQuerycontentId101,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject101')._huntingQuerycontentId101,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject102').huntingQueryTemplateSpecName102]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware detections by Workload Locations_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject102').huntingQueryVersion102]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_102",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware detections by Workload Locations",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == 'FileMalwareDetected'\n| project location=(split(RawEventData.SiteUrl, '/')[4])\n| summarize count() by tostring(location)\n| sort by count_ desc\n| render columnchart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject102')._huntingQuerycontentId102),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 102",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject102')._huntingQuerycontentId102)]",
-                "contentId": "[variables('huntingQueryObject102')._huntingQuerycontentId102]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject102').huntingQueryVersion102]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject102')._huntingQuerycontentId102]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware detections by Workload Locations",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject102')._huntingQuerycontentId102,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject102')._huntingQuerycontentId102,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject103').huntingQueryTemplateSpecName103]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware detections by Workload Type_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject103').huntingQueryVersion103]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_103",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware detections by Workload Type",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == 'FileMalwareDetected'\n| extend Appwithteams = iff(Application =~ 'Microsoft SharePoint Online',strcat(Application,' / Teams Files'),Application)\n| extend Appwithteams = trim_start('Microsoft',Appwithteams) | summarize count() by Appwithteams\n| sort by count_ desc\n| render piechart\n// | render columnchart // Uncomment to change the graph type\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject103')._huntingQuerycontentId103),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 103",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject103')._huntingQuerycontentId103)]",
-                "contentId": "[variables('huntingQueryObject103')._huntingQuerycontentId103]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject103').huntingQueryVersion103]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject103')._huntingQuerycontentId103]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware detections by Workload Type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject103')._huntingQuerycontentId103,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject103')._huntingQuerycontentId103,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject104').huntingQueryTemplateSpecName104]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Domains sending Malware_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject104').huntingQueryVersion104]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_104",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email Top Domains sending Malware",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by SenderFromDomain\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where MalwareEmailCount != 0\n| top 15 by MalwareEmailCount\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain)"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject104')._huntingQuerycontentId104),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 104",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject104')._huntingQuerycontentId104)]",
-                "contentId": "[variables('huntingQueryObject104')._huntingQuerycontentId104]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject104').huntingQueryVersion104]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject104')._huntingQuerycontentId104]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email Top Domains sending Malware",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject104')._huntingQuerycontentId104,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject104')._huntingQuerycontentId104,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject105').huntingQueryTemplateSpecName105]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Email Malware Families_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject105').huntingQueryVersion105]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_105",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Malware Families",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where isnotempty(ThreatNames) and ThreatTypes has \"Malware\"\n| mv-expand ThreatName = split(ThreatNames, \",\") to typeof(string)\n| where isnotempty(ThreatName)\n| distinct Key, ThreatName\n| summarize Count = count() by ThreatName\n| top 15 by Count\n| project ['Threat Name'] = ThreatName, Count\n| render columnchart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject105')._huntingQuerycontentId105),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 105",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject105')._huntingQuerycontentId105)]",
-                "contentId": "[variables('huntingQueryObject105')._huntingQuerycontentId105]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject105').huntingQueryVersion105]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject105')._huntingQuerycontentId105]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Malware Families",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject105')._huntingQuerycontentId105,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject105')._huntingQuerycontentId105,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject106').huntingQueryTemplateSpecName106]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Users receiving Malware_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject106').huntingQueryVersion106]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_106",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Users receiving Malware",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by RecipientEmailAddress\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where MalwareEmailCount != 0\n| top 15 by MalwareEmailCount\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress)"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject106')._huntingQuerycontentId106),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 106",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject106')._huntingQuerycontentId106)]",
-                "contentId": "[variables('huntingQueryObject106')._huntingQuerycontentId106]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject106').huntingQueryVersion106]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject106')._huntingQuerycontentId106]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Users receiving Malware",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject106')._huntingQuerycontentId106,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject106')._huntingQuerycontentId106,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject107').huntingQueryTemplateSpecName107]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Zero-day Malware Detections Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject107').huntingQueryVersion107]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_107",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Zero-day Malware Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\"\n| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)\n| where MalwareMethod in ('File detonation', 'URL detonation')\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by MalwareMethod\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject107')._huntingQuerycontentId107),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 107",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject107')._huntingQuerycontentId107)]",
-                "contentId": "[variables('huntingQueryObject107')._huntingQuerycontentId107]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject107').huntingQueryVersion107]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject107')._huntingQuerycontentId107]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Zero-day Malware Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject107')._huntingQuerycontentId107,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject107')._huntingQuerycontentId107,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject108').huntingQueryTemplateSpecName108]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Communication from suspicious external users_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject108').huntingQueryVersion108]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_108",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams communication from suspicious external users",
-                "category": "Hunting Queries",
-                "query": "//This query uses MessageEvents to detect communication from suspicious external Help Desk\\Support representatives\nMessageEvents \n| where Timestamp > ago(30d) \n| where (SenderDisplayName contains \"help\" and SenderDisplayName contains \"desk\") \n  or (SenderDisplayName contains \"it\" and SenderDisplayName contains \"support\") \n  or (SenderDisplayName contains \"working\" and SenderDisplayName contains \"home\") \n| where IsExternalThread == true \n| project Timestamp, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for communication from suspicious external users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject108')._huntingQuerycontentId108),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 108",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject108')._huntingQuerycontentId108)]",
-                "contentId": "[variables('huntingQueryObject108')._huntingQuerycontentId108]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject108').huntingQueryVersion108]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject108')._huntingQuerycontentId108]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams communication from suspicious external users",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject108')._huntingQuerycontentId108,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject108')._huntingQuerycontentId108,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject109').huntingQueryTemplateSpecName109]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Communication to suspicious external users_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject109').huntingQueryVersion109]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_109",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams communication to suspicious external users",
-                "category": "Hunting Queries",
-                "query": "//This query uses MessageEvents to detect bi-directional outbound communication to suspicious external Help Desk\\Support representatives\nMessageEvents \n| where Timestamp > ago(30d) \n| where (RecipientDetails contains \"help\" and RecipientDetails contains \"desk\") \n  or (RecipientDetails contains \"it\" and RecipientDetails contains \"support\") \n  or (RecipientDetails contains \"working\" and RecipientDetails contains \"home\") \n| where IsExternalThread == true \n| project Timestamp, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for communication with suspicious external users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject109')._huntingQuerycontentId109),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 109",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject109')._huntingQuerycontentId109)]",
-                "contentId": "[variables('huntingQueryObject109')._huntingQuerycontentId109]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject109').huntingQueryVersion109]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject109')._huntingQuerycontentId109]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams communication to suspicious external users",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject109')._huntingQuerycontentId109,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject109')._huntingQuerycontentId109,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject110').huntingQueryTemplateSpecName110]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Expanding recipients into separate rows_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject110').huntingQueryVersion110]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_110",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Expanding recipients into separate rows",
-                "category": "Hunting Queries",
-                "query": "//Analyzing recipient details with a separate row for each recipient\nMessageEvents\n| mv-expand Recipients = RecipientDetails\n| extend RecipientSmtpAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for recipients of Teams messages."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject110')._huntingQuerycontentId110),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 110",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject110')._huntingQuerycontentId110)]",
-                "contentId": "[variables('huntingQueryObject110')._huntingQuerycontentId110]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject110').huntingQueryVersion110]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject110')._huntingQuerycontentId110]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Expanding recipients into separate rows",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject110')._huntingQuerycontentId110,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject110')._huntingQuerycontentId110,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject111').huntingQueryTemplateSpecName111]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "External malicious Teams messages sent from internal senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject111').huntingQueryVersion111]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_111",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "External malicious Teams messages sent from internal senders",
-                "category": "Hunting Queries",
-                "query": "//This query helps hunt for Teams messages from internal senders with Threats in them (Spam, Phish, Malware)\nMessageEvents \n| where Timestamp > ago(30d)\n| where IsExternalThread==1 and IsOwnedThread==1\n| where ThreatTypes has_any (\"Phish\",\"Malware\",\"Spam\")                    \n| project Timestamp,TeamsMessageId, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId, ThreatTypes, DetectionMethods\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for external malicious Teams messages sent from internal senders"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject111')._huntingQuerycontentId111),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 111",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject111')._huntingQuerycontentId111)]",
-                "contentId": "[variables('huntingQueryObject111')._huntingQuerycontentId111]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject111').huntingQueryVersion111]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject111')._huntingQuerycontentId111]",
-        "contentKind": "HuntingQuery",
-        "displayName": "External malicious Teams messages sent from internal senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject111')._huntingQuerycontentId111,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject111')._huntingQuerycontentId111,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject112').huntingQueryTemplateSpecName112]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for malicious messages using External Threat Intelligence_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject112').huntingQueryVersion112]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_112",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for malicious messages using External Threat Intelligence",
-                "category": "Hunting Queries",
-                "query": "// This query helps hunt for Teams messages with malicious URLs based on external IOC source\nlet url = (externaldata(url: string )\n[@\"https://urlhaus.abuse.ch/downloads/text_online/\"]\nwith (format=\"txt\"))\n| project url;\nurl\n| join (MessageUrlInfo\n| where Timestamp > ago(14d) \n) on $left.url == $right.Url\n|join MessageEvents on TeamsMessageId\n//|join UrlClickEvents on Url\n|project Timestamp, TeamsMessageId, Url, UrlDomain, SenderEmailAddress, SenderDisplayName, RecipientDetails,ThreatTypes, DetectionMethods, DeliveryAction,IsExternalThread, IsOwnedThread//, AccountUpn, ActionType, AppName, AppVersion, Workload\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject112')._huntingQuerycontentId112),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 112",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject112')._huntingQuerycontentId112)]",
-                "contentId": "[variables('huntingQueryObject112')._huntingQuerycontentId112]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject112').huntingQueryVersion112]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject112')._huntingQuerycontentId112]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for malicious messages using External Threat Intelligence",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject112')._huntingQuerycontentId112,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject112')._huntingQuerycontentId112,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject113').huntingQueryTemplateSpecName113]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Inbound Teams messages by sender domains_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject113').huntingQueryVersion113]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_113",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Inbound Teams messages by sender domains",
-                "category": "Hunting Queries",
-                "query": "//This query helps reviewing volume of inbound external Teams message by sender domains\n MessageEvents \n | where IsExternalThread==1 and IsOwnedThread==1\n | mv-expand Recipients = RecipientDetails\n | extend RecipientEmailAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType\n | extend Domain = substring(RecipientEmailAddress, indexof(RecipientEmailAddress, \"@\")+1)\n | summarize total=count() by Domain, bin(Timestamp, 1d) \n | order by Timestamp asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing volume of inbound external Teams message by sender domains"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject113')._huntingQuerycontentId113),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 113",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject113')._huntingQuerycontentId113)]",
-                "contentId": "[variables('huntingQueryObject113')._huntingQuerycontentId113]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject113').huntingQueryVersion113]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject113')._huntingQuerycontentId113]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Inbound Teams messages by sender domains",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject113')._huntingQuerycontentId113,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject113')._huntingQuerycontentId113,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject114').huntingQueryTemplateSpecName114]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malicious Teams messages by URL detection methods_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject114').huntingQueryVersion114]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_114",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious Teams messages by URL detection methods",
-                "category": "Hunting Queries",
-                "query": "//This query helps reviewing malicious Teams message detections by URL detection methods\nMessageEvents\n| where isnotempty(DetectionMethods)\n| extend MDO_detection = parse_json(DetectionMethods)\n| summarize TotalMessageCount = count(),\n           Phish_detection = countif(isnotempty(MDO_detection.Phish)),\n           Malware_detection = countif(isnotempty(MDO_detection.Malware)),\n           URL_malicious_reputation = countif(MDO_detection.Phish == @'[\"URL malicious reputation\"]' or MDO_detection.Malware == @'[\"URL malicious reputation\"]'),\n           URL_detonation_reputation = countif(MDO_detection.Phish == @'[\"URL detonation reputation\"]' or MDO_detection.Malware == @'[\"URL detonation reputation\"]')\n           by bin(Timestamp, 1d)\n| project Timestamp, Phish_detection, Malware_detection,URL_malicious_reputation,URL_detonation_reputation\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing malicious Teams message detections by URL detection methods"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject114')._huntingQuerycontentId114),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 114",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject114')._huntingQuerycontentId114)]",
-                "contentId": "[variables('huntingQueryObject114')._huntingQuerycontentId114]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject114').huntingQueryVersion114]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject114')._huntingQuerycontentId114]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious Teams messages by URL detection methods",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject114')._huntingQuerycontentId114,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject114')._huntingQuerycontentId114,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject115').huntingQueryTemplateSpecName115]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malicious Teams messages received from external senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject115').huntingQueryVersion115]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_115",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious Teams messages received from external senders",
-                "category": "Hunting Queries",
-                "query": "//This query helps hunt for Teams messages from external senders with Threats (Spam, Phish, Malware)\nMessageEvents \n| where Timestamp > ago(30d)\n| where IsExternalThread==1 and IsOwnedThread==0\n| where ThreatTypes has_any (\"Phish\",\"Malware\",\"Spam\")                    \n| project Timestamp,TeamsMessageId, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId, ThreatTypes, DetectionMethods\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for malicious Teams messages received from external senders."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject115')._huntingQuerycontentId115),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 115",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject115')._huntingQuerycontentId115)]",
-                "contentId": "[variables('huntingQueryObject115')._huntingQuerycontentId115]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject115').huntingQueryVersion115]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject115')._huntingQuerycontentId115]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious Teams messages received from external senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject115')._huntingQuerycontentId115,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject115')._huntingQuerycontentId115,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject116').huntingQueryTemplateSpecName116]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Microsoft Teams chat initiated by a suspicious external user_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject116').huntingQueryVersion116]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_116",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Microsoft Teams chat initiated by a suspicious external user",
-                "category": "Hunting Queries",
-                "query": "//Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external  Teams messages\nAlertInfo \n| where Timestamp >= ago(30d) \n| where Title == \"Microsoft Teams chat initiated by a suspicious external user\" \n| join AlertEvidence on AlertId\n| top 100 by Timestamp\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject116')._huntingQuerycontentId116),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 116",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject116')._huntingQuerycontentId116)]",
-                "contentId": "[variables('huntingQueryObject116')._huntingQuerycontentId116]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject116').huntingQueryVersion116]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject116')._huntingQuerycontentId116]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Microsoft Teams chat initiated by a suspicious external user",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject116')._huntingQuerycontentId116,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject116')._huntingQuerycontentId116,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject117').huntingQueryTemplateSpecName117]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Number of unique accounts performing Teams message Admin submissions_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject117').huntingQueryVersion117]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_117",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Number of unique accounts performing Teams message Admin submissions",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"1\",\"2\",\"3\")\n| summarize dcount(SubmittedBy) \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises number of unqiue accounts performing Teams message admin submissions as false negatives or false positives"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject117')._huntingQuerycontentId117),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 117",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject117')._huntingQuerycontentId117)]",
-                "contentId": "[variables('huntingQueryObject117')._huntingQuerycontentId117]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject117').huntingQueryVersion117]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject117')._huntingQuerycontentId117]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Number of unique accounts performing Teams message Admin submissions",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject117')._huntingQuerycontentId117,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject117')._huntingQuerycontentId117,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject118').huntingQueryTemplateSpecName118]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Number of unique accounts performing Teams message User  submissions_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject118').huntingQueryVersion118]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_118",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Number of unique accounts performing Teams message User  submissions",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)\n| where SubmissionContentType == \"ChatMessage\"\n| summarize dcount(SubmittedBy) \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises number of unqiue accounts performing Teams message user submissions as false negatives or false positives"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject118')._huntingQuerycontentId118),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 118",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject118')._huntingQuerycontentId118)]",
-                "contentId": "[variables('huntingQueryObject118')._huntingQuerycontentId118]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject118').huntingQueryVersion118]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject118')._huntingQuerycontentId118]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Number of unique accounts performing Teams message User  submissions",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject118')._huntingQuerycontentId118,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject118')._huntingQuerycontentId118,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject119').huntingQueryTemplateSpecName119]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Possible partner impersonation in external Team messages_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject119').huntingQueryVersion119]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_119",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Possible partner impersonation in external Team messages",
-                "category": "Hunting Queries",
-                "query": "//This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message\n MessageEvents \n | where IsOwnedThread==0 and IsExternalThread==1 and SenderDisplayName contains \"@contoso.com\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject119')._huntingQuerycontentId119),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 119",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject119')._huntingQuerycontentId119)]",
-                "contentId": "[variables('huntingQueryObject119')._huntingQuerycontentId119]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject119').huntingQueryVersion119]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject119')._huntingQuerycontentId119]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Possible partner impersonation in external Team messages",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject119')._huntingQuerycontentId119,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject119')._huntingQuerycontentId119,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject120').huntingQueryTemplateSpecName120]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Possible Teams phishing activity_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject120').huntingQueryVersion120]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_120",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Possible Teams phishing activity",
-                "category": "Hunting Queries",
-                "query": "let suspiciousUpns = DeviceProcessEvents\n| where DeviceId == \"alertedMachine\"\n| where isnotempty(InitiatingProcessAccountUpn)\n| project InitiatingProcessAccountUpn;\nCloudAppEvents\n| where Application == \"Microsoft Teams\"\n| where ActionType == \"ChatCreated\"\n| where isempty(AccountObjectId)\n| where RawEventData.ParticipantInfo.HasForeignTenantUsers == true\n| where RawEventData.CommunicationType == \"OneonOne\"\n| where RawEventData.ParticipantInfo.HasGuestUsers == false\n| where RawEventData.ParticipantInfo.HasOtherGuestUsers == false\n| where RawEventData.Members[0].DisplayName in (\"Microsoft  Security\", \"Help Desk\", \"Help Desk Team\", \"Help Desk IT\", \"Microsoft Security\", \"office\")\n| where AccountId has \"@\"\n| extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))\n| where TargetUPN in (suspiciousUpns)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looks for possible Teams phishing activity."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject120')._huntingQuerycontentId120),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 120",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject120')._huntingQuerycontentId120)]",
-                "contentId": "[variables('huntingQueryObject120')._huntingQuerycontentId120]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject120').huntingQueryVersion120]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject120')._huntingQuerycontentId120]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Possible Teams phishing activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject120')._huntingQuerycontentId120,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject120')._huntingQuerycontentId120,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject121').huntingQueryTemplateSpecName121]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Potentially malicious URL click in Teams_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject121').huntingQueryVersion121]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_121",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Potentially malicious URL click in Teams",
-                "category": "Hunting Queries",
-                "query": "//This query provides insights on a potentially malicious URL click in Teams\nMessagePostDeliveryEvents\n| join MessageUrlInfo on TeamsMessageId\n| join UrlClickEvents on Url\n| where Workload == \"Teams\" and ActionType1==\"ClickAllowed\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query provides insights on a potentially malicious URL click in Teams"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject121')._huntingQuerycontentId121),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 121",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject121')._huntingQuerycontentId121)]",
-                "contentId": "[variables('huntingQueryObject121')._huntingQuerycontentId121]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject121').huntingQueryVersion121]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject121')._huntingQuerycontentId121]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Potentially malicious URL click in Teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject121')._huntingQuerycontentId121,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject121')._huntingQuerycontentId121,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject122').huntingQueryTemplateSpecName122]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Rare Domains in External Teams Messages_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject122').huntingQueryVersion122]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_122",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Rare Domains in External Teams Messages",
-                "category": "Hunting Queries",
-                "query": "let lookback = 1d;\n// External Teams messages \nlet externalMsgs =\n  MessageEvents\n  | where Timestamp > ago(lookback) and IsExternalThread == true\n  | project MsgTime = Timestamp, TeamsMessageId, SenderEmailAddress, ME_ReportId = ReportId;\n// URLs found in Teams messages \nlet urlsInMsgs =\n  MessageUrlInfo\n  | where Timestamp > ago(lookback)\n  | project MUI_Time = Timestamp, TeamsMessageId, Url, UrlDomain, MUI_ReportId = ReportId;\n// Clicks coming from Teams \nlet clicks =\n  UrlClickEvents\n  | where Timestamp > ago(lookback) and Workload == \"Teams\"\n  | project ClickTime = Timestamp, Url, Clicker = AccountUpn, ClickAction = ActionType, UCE_ReportId = ReportId;\n// Define \"rare\" domains in the period \nlet rareDomains =\n  urlsInMsgs\n  | summarize msgCount = dcount(TeamsMessageId) by UrlDomain\n  | where msgCount < 3;\nrareDomains\n  | join kind=inner (urlsInMsgs) on UrlDomain\n  | join kind=leftouter (externalMsgs) on TeamsMessageId\n  | join kind=leftouter (clicks) on Url\n  | project\n      Timestamp = coalesce(ClickTime, MUI_Time, MsgTime),\n      UrlDomain,\n      Url,\n      SenderEmailAddress,\n      Clicker,\n      ClickTime,\n      ClickAction,\n      TeamsMessageId,\n      ReportId = coalesce(UCE_ReportId, MUI_ReportId, ME_ReportId)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Detects rare domains (seen in fewer than 3 Teams messages) appearing in external Microsoft Teams threads within the last 24 hours."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,Execution"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1204"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject122')._huntingQuerycontentId122),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 122",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject122')._huntingQuerycontentId122)]",
-                "contentId": "[variables('huntingQueryObject122')._huntingQuerycontentId122]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject122').huntingQueryVersion122]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject122')._huntingQuerycontentId122]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Rare Domains in External Teams Messages",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject122')._huntingQuerycontentId122,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject122')._huntingQuerycontentId122,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject123').huntingQueryTemplateSpecName123]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Suspicious Teams Display Name_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject123').huntingQueryVersion123]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_123",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Suspicious Teams Display Name",
-                "category": "Hunting Queries",
-                "query": "let SuspiciousDisplayNames = pack_array(\"Microsoft  Security\", \"Help Desk\", \"Help Desk Team\", \"Help Desk IT\", \"Microsoft Security\", \"IT Support\", \"Helpdesk\");\nMessageEvents\n| where IsExternalThread == 1 and IsOwnedThread == 0\n| where SenderDisplayName has_any (SuspiciousDisplayNames)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looks for Teams messages from an external user with a suspicious display name."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject123')._huntingQuerycontentId123),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 123",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject123')._huntingQuerycontentId123)]",
-                "contentId": "[variables('huntingQueryObject123')._huntingQuerycontentId123]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject123').huntingQueryVersion123]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject123')._huntingQuerycontentId123]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Suspicious Teams Display Name",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject123')._huntingQuerycontentId123,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject123')._huntingQuerycontentId123,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject124').huntingQueryTemplateSpecName124]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams Admin submission of Malware and Phish daily trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject124').huntingQueryVersion124]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_124",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams Admin submission of Malware and Phish daily trend",
-                "category": "Hunting Queries",
-                "query": "//Admin submission of false negative Teams message detections with Malware and Phish threat daily trend\nlet TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery=CloudAppEvents\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"ChatMessage\";\nlet Admin_Malware_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"2\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Malware_FN\";\nlet Admin_Phish_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Phish_FN\";\nunion Admin_Malware_FN,Admin_Phish_FN\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of admin false negative Teams message submissions by submission type of Phish or Malware"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject124')._huntingQuerycontentId124),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 124",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject124')._huntingQuerycontentId124)]",
-                "contentId": "[variables('huntingQueryObject124')._huntingQuerycontentId124]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject124').huntingQueryVersion124]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject124')._huntingQuerycontentId124]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams Admin submission of Malware and Phish daily trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject124')._huntingQuerycontentId124,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject124')._huntingQuerycontentId124,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject125').huntingQueryTemplateSpecName125]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams Admin submission of No Threats daily trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject125').huntingQueryVersion125]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_125",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams Admin submission of No Threats daily trend",
-                "category": "Hunting Queries",
-                "query": "//Admin submission of false positive Teams message detections daily trend\nlet TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery=CloudAppEvents\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"ChatMessage\";\nlet Admin_Teams_FP=baseQuery\n| make-series Count= countif(SubmissionType == \"3\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Teams_FP\";\nunion Admin_Teams_FP\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of admin false positive Teams message submissions"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject125')._huntingQuerycontentId125),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 125",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject125')._huntingQuerycontentId125)]",
-                "contentId": "[variables('huntingQueryObject125')._huntingQuerycontentId125]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject125').huntingQueryVersion125]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject125')._huntingQuerycontentId125]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams Admin submission of No Threats daily trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject125')._huntingQuerycontentId125,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject125')._huntingQuerycontentId125,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject126').huntingQueryTemplateSpecName126]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams Admin-User Submissions Grading Verdicts_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject126').huntingQueryVersion126]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_126",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams Admin-User Submissions Grading Verdicts",
-                "category": "Hunting Queries",
-                "query": "//This query visualizes Teams messages submitted by users or admins then graded in the submission process, summarizing the data by the various submission garde results\nCloudAppEvents\n| where ActionType == \"AdminSubmissionTriage\" or ActionType == \"UserSubmissionTriage\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmissionState=tostring((parse_json(RawEventData)).SubmissionState),TriageVerdict=tostring((parse_json(RawEventData)).GradingResult.TriageVerdict)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionState == \"Graded\"\n| summarize count() by TriageVerdict\n| project TriageVerdict, TeamsMessages = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualizes Teams messages submitted by users or admins then graded in the submission process."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject126')._huntingQuerycontentId126),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 126",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject126')._huntingQuerycontentId126)]",
-                "contentId": "[variables('huntingQueryObject126')._huntingQuerycontentId126]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject126').huntingQueryVersion126]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject126')._huntingQuerycontentId126]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams Admin-User Submissions Grading Verdicts",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject126')._huntingQuerycontentId126,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject126')._huntingQuerycontentId126,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject127').huntingQueryTemplateSpecName127]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams blocked URL clicks daily trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject127').huntingQueryVersion127]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_127",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams blocked URL clicks daily trend",
-                "category": "Hunting Queries",
-                "query": "//This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages summarizing the data by various Teams app names.\nlet TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nUrlClickEvents\n| where Timestamp >= TimeStart\n| where ActionType == \"ClickBlocked\" and Workload ==\"Teams\"\n| make-series TeamsBlockedClicks = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by AppName\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject127')._huntingQuerycontentId127),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 127",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject127')._huntingQuerycontentId127)]",
-                "contentId": "[variables('huntingQueryObject127')._huntingQuerycontentId127]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject127').huntingQueryVersion127]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject127')._huntingQuerycontentId127]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams blocked URL clicks daily trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject127')._huntingQuerycontentId127,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject127')._huntingQuerycontentId127,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject128').huntingQueryTemplateSpecName128]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams Malware ZAP _HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject128').huntingQueryVersion128]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_128",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams Malware ZAP",
-                "category": "Hunting Queries",
-                "query": "//Zero-hour auto purge (ZAP) took action on Teams messages containing Malware after delivery.\nMessagePostDeliveryEvents\n| where ActionType == 'Malware ZAP' \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for Teams messages with Malware threats that have been ZAPed."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject128')._huntingQuerycontentId128),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 128",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject128')._huntingQuerycontentId128)]",
-                "contentId": "[variables('huntingQueryObject128')._huntingQuerycontentId128]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject128').huntingQueryVersion128]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject128')._huntingQuerycontentId128]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams Malware ZAP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject128')._huntingQuerycontentId128,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject128')._huntingQuerycontentId128,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject129').huntingQueryTemplateSpecName129]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams Message with URL listed on OpenPhish_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject129').huntingQueryVersion129]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_129",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams Message with URL listed on OpenPhish",
-                "category": "Hunting Queries",
-                "query": "//This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish.\nlet PhishingURLs = externaldata(url: string)\n[\n\"https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt\"\n]\nwith (format=\"txt\"); // CSV and JSON formats are also valid formats if using the premium feeds\nMessageUrlInfo\n| where Url in (PhishingURLs)\n| join MessageEvents on TeamsMessageId\n//| where IsOwnedThread==0 and IsExternalThread==1\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish was delivered."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject129')._huntingQuerycontentId129),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 129",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject129')._huntingQuerycontentId129)]",
-                "contentId": "[variables('huntingQueryObject129')._huntingQuerycontentId129]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject129').huntingQueryVersion129]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject129')._huntingQuerycontentId129]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams Message with URL listed on OpenPhish",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject129')._huntingQuerycontentId129,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject129')._huntingQuerycontentId129,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject130').huntingQueryTemplateSpecName130]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams message ZAPed with the same URL in Email_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject130').huntingQueryVersion130]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_130",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams message ZAPed with the same URL in Email",
-                "category": "Hunting Queries",
-                "query": "//This query provides insights on Teams messages ZAPed with the same malicious URLs in Email messages\nMessagePostDeliveryEvents\n| join MessageUrlInfo on TeamsMessageId\n| join EmailUrlInfo on Url\n| join EmailEvents on NetworkMessageId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for Teams messages that have been ZAPed with the same URL in Email."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject130')._huntingQuerycontentId130),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 130",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject130')._huntingQuerycontentId130)]",
-                "contentId": "[variables('huntingQueryObject130')._huntingQuerycontentId130]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject130').huntingQueryVersion130]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject130')._huntingQuerycontentId130]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams message ZAPed with the same URL in Email",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject130')._huntingQuerycontentId130,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject130')._huntingQuerycontentId130,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject131').huntingQueryTemplateSpecName131]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams messages from a specific sender by ThreadType_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject131').huntingQueryVersion131]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_131",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams messages from a specific sender by ThreadType",
-                "category": "Hunting Queries",
-                "query": "//This query gets the count of messages from a sender across all types of conversations\nlet Sender = \"norpely@contoso.com\";\nMessageEvents\n| where SenderEmailAddress == Sender\n| summarize Count = count() by ThreadType\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for Teams messages from a specific sender by ThreadType."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject131')._huntingQuerycontentId131),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 131",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject131')._huntingQuerycontentId131)]",
-                "contentId": "[variables('huntingQueryObject131')._huntingQuerycontentId131]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject131').huntingQueryVersion131]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject131')._huntingQuerycontentId131]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams messages from a specific sender by ThreadType",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject131')._huntingQuerycontentId131,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject131')._huntingQuerycontentId131,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject132').huntingQueryTemplateSpecName132]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams messages with suspicious URL domains_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject132').huntingQueryVersion132]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_132",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams messages with suspicious URL domains",
-                "category": "Hunting Queries",
-                "query": "//This Query uses MessageUrlInfo to find external Teams messages with suspicious low reputation URL doamins (e.g .xyz etc)\nMessageUrlInfo\n| extend Domain = extract(@\"^(?:https?://)?([^/]+)\", 1, Url)\n| extend TLD = tostring(split(Domain, \".\")[-1])\n| where TLD has_any (\"dev\",\"app\",\"zip\",\"solutions\",\"io\",\"top\",\"xyz\")\n| project Timestamp,Url,UrlDomain,TLD,TeamsMessageId, ReportId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for Teams messages with suspicious URL domains."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject132')._huntingQuerycontentId132),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 132",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject132')._huntingQuerycontentId132)]",
-                "contentId": "[variables('huntingQueryObject132')._huntingQuerycontentId132]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject132').huntingQueryVersion132]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject132')._huntingQuerycontentId132]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams messages with suspicious URL domains",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject132')._huntingQuerycontentId132,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject132')._huntingQuerycontentId132,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject133').huntingQueryTemplateSpecName133]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams Phish ZAP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject133').huntingQueryVersion133]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_133",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams Phish ZAP",
-                "category": "Hunting Queries",
-                "query": "//Zero-hour auto purge (ZAP) took action on Teams messages containing Phish after delivery\nMessagePostDeliveryEvents\n| where ActionType == 'Phish ZAP' \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for Teams messages with Phish threats that have been ZAPed."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject133')._huntingQuerycontentId133),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 133",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject133')._huntingQuerycontentId133)]",
-                "contentId": "[variables('huntingQueryObject133')._huntingQuerycontentId133]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject133').huntingQueryVersion133]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject133')._huntingQuerycontentId133]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams Phish ZAP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject133')._huntingQuerycontentId133,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject133')._huntingQuerycontentId133,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject134').huntingQueryTemplateSpecName134]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams post delivery events daily trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject134').huntingQueryVersion134]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_134",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams post delivery events daily trend",
-                "category": "Hunting Queries",
-                "query": "//Teams post delivery ZAP events daily trend\nlet TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nMessagePostDeliveryEvents\n| where Timestamp >= TimeStart\n| where ActionType has \"ZAP\"\n| make-series ZappedTeamsMessages = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualizes the daily amount of post delivery events on Teams messages."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject134')._huntingQuerycontentId134),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 134",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject134')._huntingQuerycontentId134)]",
-                "contentId": "[variables('huntingQueryObject134')._huntingQuerycontentId134]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject134').huntingQueryVersion134]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject134')._huntingQuerycontentId134]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams post delivery events daily trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject134')._huntingQuerycontentId134,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject134')._huntingQuerycontentId134,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject135').huntingQueryTemplateSpecName135]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams Spam ZAP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject135').huntingQueryVersion135]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_135",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams Spam ZAP",
-                "category": "Hunting Queries",
-                "query": "//Zero-hour auto purge (ZAP) took action on Teams messages containing Spam after delivery\nMessagePostDeliveryEvents\n| where ActionType == 'Spam ZAP' \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for Teams messages with Spam threats that have been ZAPed."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject135')._huntingQuerycontentId135),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 135",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject135')._huntingQuerycontentId135)]",
-                "contentId": "[variables('huntingQueryObject135')._huntingQuerycontentId135]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject135').huntingQueryVersion135]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject135')._huntingQuerycontentId135]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams Spam ZAP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject135')._huntingQuerycontentId135,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject135')._huntingQuerycontentId135,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject136').huntingQueryTemplateSpecName136]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams URL clicks actions summarized by URLs clicked on_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject136').huntingQueryVersion136]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_136",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams URL clicks actions summarized by URLs clicked on",
-                "category": "Hunting Queries",
-                "query": "//Teams URL clicks actions summarized by URLs clicked on\nUrlClickEvents\n| extend UrlBlocked = ActionType has_any(\"ClickBlocked\")\n| extend UrlAllowed = ActionType has_any('ClickAllowed')\n| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')\n| extend ErrorPage = ActionType has_any('UrlErrorPage')\n| where Workload == \"Teams\"\n| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough) by Url\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject136')._huntingQuerycontentId136),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 136",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject136')._huntingQuerycontentId136)]",
-                "contentId": "[variables('huntingQueryObject136')._huntingQuerycontentId136]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject136').huntingQueryVersion136]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject136')._huntingQuerycontentId136]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams URL clicks actions summarized by URLs clicked on",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject136')._huntingQuerycontentId136,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject136')._huntingQuerycontentId136,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject137').huntingQueryTemplateSpecName137]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject137').huntingQueryVersion137]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_137",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs",
-                "category": "Hunting Queries",
-                "query": "//Teams URL clicks through actions on Phish or Malware URLs summarized by URLs\nUrlClickEvents \n| where IsClickedThrough !=\"0\" and Workload ==\"Teams\"\n| where ThreatTypes in (\"Phish\",\"Malware\") \n| summarize by Url,ThreatTypes, IsClickedThrough, ActionType\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject137')._huntingQuerycontentId137),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 137",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject137')._huntingQuerycontentId137)]",
-                "contentId": "[variables('huntingQueryObject137')._huntingQuerycontentId137]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject137').huntingQueryVersion137]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject137')._huntingQuerycontentId137]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject137')._huntingQuerycontentId137,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject137')._huntingQuerycontentId137,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject138').huntingQueryTemplateSpecName138]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams User submissions daily trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject138').huntingQueryVersion138]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_138",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams User submissions daily trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery=CloudAppEvents\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where ActionType == \"UserSubmission\" and SubmissionContentType == \"ChatMessage\";\nlet User_TeamsSubmission_FN_FP=baseQuery\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"User_TeamsSubmission_FN_FP\";\nunion User_TeamsSubmission_FN_FP\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of user false negative and false postive Teams message submissions"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject138')._huntingQuerycontentId138),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 138",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject138')._huntingQuerycontentId138)]",
-                "contentId": "[variables('huntingQueryObject138')._huntingQuerycontentId138]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject138').huntingQueryVersion138]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject138')._huntingQuerycontentId138]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams User submissions daily trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject138')._huntingQuerycontentId138,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject138')._huntingQuerycontentId138,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject139').huntingQueryTemplateSpecName139]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams users clicking on suspicious URL domains_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject139').huntingQueryVersion139]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_139",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams users clicking on suspicious URL domains",
-                "category": "Hunting Queries",
-                "query": "//This Query uses MessageUrlInfo, MessageEvents and UrlClickEvents to find external Teams messages with low reputation URL doamins (.xyz) and identify the top 10 users clicking on them. \nMessageUrlInfo\n| extend Domain = extract(@\"^(?:https?://)?([^/]+)\", 1, Url)\n| extend TLD = tostring(split(Domain, \".\")[-1])\n| where TLD has_any (\"dev\",\"app\",\"zip\",\"solutions\",\"io\",\"top\")\n| join MessageEvents on TeamsMessageId\n| join UrlClickEvents on Url\n| project Timestamp,Url,UrlDomain,TLD,TeamsMessageId, ReportId, Timestamp2,ActionType,AccountUpn,Workload, SenderDisplayName, SenderEmailAddress, ThreatTypes, DetectionMethods, RecipientDetails\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for Teams users clicking on suspicious URL domains."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject139')._huntingQuerycontentId139),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 139",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject139')._huntingQuerycontentId139)]",
-                "contentId": "[variables('huntingQueryObject139')._huntingQuerycontentId139]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject139').huntingQueryVersion139]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject139')._huntingQuerycontentId139]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams users clicking on suspicious URL domains",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject139')._huntingQuerycontentId139,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject139')._huntingQuerycontentId139,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject140').huntingQueryTemplateSpecName140]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 Attacked user by Phish messages_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject140').huntingQueryVersion140]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_140",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Attacked user by Phish messages",
-                "category": "Hunting Queries",
-                "query": "//Top 10 attacked users by Phish messages from external senders using Teams. Replace contoso.com with your own recipient domain.\nMessageEvents\n| where ThreatTypes has 'Phish' and IsOwnedThread==0 and IsExternalThread==1\n| mv-expand Recipients = RecipientDetails\n| extend RecipientEmailAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType\n| where RecipientEmailAddress contains ('contoso.com')\n| summarize count() by tostring(RecipientEmailAddress)\n| sort by count_\n| top 10 by count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Top 10 attacked users by Phish messages from external senders using Teams"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject140')._huntingQuerycontentId140),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 140",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject140')._huntingQuerycontentId140)]",
-                "contentId": "[variables('huntingQueryObject140')._huntingQuerycontentId140]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject140').huntingQueryVersion140]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject140')._huntingQuerycontentId140]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Attacked user by Phish messages",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject140')._huntingQuerycontentId140,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject140')._huntingQuerycontentId140,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject141').huntingQueryTemplateSpecName141]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 external senders sending Teams messages_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject141').huntingQueryVersion141]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_141",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 external senders sending Teams messages",
-                "category": "Hunting Queries",
-                "query": "//Top 10 external senders sending Teams messages\nMessageEvents \n| where IsOwnedThread==0 and IsExternalThread==1\n| summarize count() by SenderEmailAddress\n| sort by count_ desc\n| top 10 by count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visulises all up Top 10 external senders sending Teams messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject141')._huntingQuerycontentId141),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 141",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject141')._huntingQuerycontentId141)]",
-                "contentId": "[variables('huntingQueryObject141')._huntingQuerycontentId141]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject141').huntingQueryVersion141]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject141')._huntingQuerycontentId141]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 external senders sending Teams messages",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject141')._huntingQuerycontentId141,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject141')._huntingQuerycontentId141,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject142').huntingQueryTemplateSpecName142]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 External senders sending Teams phishing messsages_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject142').huntingQueryVersion142]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_142",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 External senders sending Teams phishing messsages",
-                "category": "Hunting Queries",
-                "query": "//This query looking for top 10 External senders sending Team phishing messsages\nMessageEvents\n| where IsOwnedThread==0 and IsExternalThread==1\n| where ThreatTypes has \"Phish\"\n| summarize Count = count() by SenderEmailAddress\n| top 10 by Count\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looking for top 10 External senders sending Team phishing messsages."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject142')._huntingQuerycontentId142),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 142",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject142')._huntingQuerycontentId142)]",
-                "contentId": "[variables('huntingQueryObject142')._huntingQuerycontentId142]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject142').huntingQueryVersion142]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject142')._huntingQuerycontentId142]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 External senders sending Teams phishing messsages",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject142')._huntingQuerycontentId142,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject142')._huntingQuerycontentId142,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject143').huntingQueryTemplateSpecName143]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 sender domains - Admin Teams message submissions FN_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject143').huntingQueryVersion143]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_143",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 sender domains - Admin Teams message submissions FN",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"2\",\"1\")\n| summarize count() by P2SenderDomain\n| project P2SenderDomain, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject143')._huntingQuerycontentId143),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 143",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject143')._huntingQuerycontentId143)]",
-                "contentId": "[variables('huntingQueryObject143')._huntingQuerycontentId143]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject143').huntingQueryVersion143]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject143')._huntingQuerycontentId143]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 sender domains - Admin Teams message submissions FN",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject143')._huntingQuerycontentId143,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject143')._huntingQuerycontentId143,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject144').huntingQueryTemplateSpecName144]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 sender domains - Teams user submissions FN or FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject144').huntingQueryVersion144]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_144",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 sender domains - Teams user submissions FN or FP",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"ChatMessage\"\n| summarize count() by P2SenderDomain\n| project P2SenderDomain, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject144')._huntingQuerycontentId144),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 144",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject144')._huntingQuerycontentId144)]",
-                "contentId": "[variables('huntingQueryObject144')._huntingQuerycontentId144]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject144').huntingQueryVersion144]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject144')._huntingQuerycontentId144]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 sender domains - Teams user submissions FN or FP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject144')._huntingQuerycontentId144,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject144')._huntingQuerycontentId144,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject145').huntingQueryTemplateSpecName145]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 senders - Teams users submissions FN or FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject145').huntingQueryVersion145]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_145",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 senders - Teams users submissions FN or FP",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)\n| where SubmissionContentType == \"ChatMessage\"\n| summarize count() by P2Sender\n| project P2Sender, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject145')._huntingQuerycontentId145),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 145",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject145')._huntingQuerycontentId145)]",
-                "contentId": "[variables('huntingQueryObject145')._huntingQuerycontentId145]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject145').huntingQueryVersion145]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject145')._huntingQuerycontentId145]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 senders - Teams users submissions FN or FP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject145')._huntingQuerycontentId145,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject145')._huntingQuerycontentId145,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject146').huntingQueryTemplateSpecName146]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 senders of  Admin Teams message submissions FN_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject146').huntingQueryVersion146]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_146",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 senders of  Admin Teams message submissions FN",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"2\",\"1\")\n| summarize count() by P2Sender\n| project P2Sender, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject146')._huntingQuerycontentId146),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 146",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject146')._huntingQuerycontentId146)]",
-                "contentId": "[variables('huntingQueryObject146')._huntingQuerycontentId146]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject146').huntingQueryVersion146]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject146')._huntingQuerycontentId146]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 senders of  Admin Teams message submissions FN",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject146')._huntingQuerycontentId146,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject146')._huntingQuerycontentId146,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject147').huntingQueryTemplateSpecName147]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 senders of  Admin Teams message submissions FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject147').huntingQueryVersion147]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_147",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 senders of  Admin Teams message submissions FP",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"3\")\n| summarize count() by P2Sender\n| project P2Sender, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises Teams messages submitted by admins as false positives, summarizing the data by top 10 indidvidual senders of those messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject147')._huntingQuerycontentId147),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 147",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject147')._huntingQuerycontentId147)]",
-                "contentId": "[variables('huntingQueryObject147')._huntingQuerycontentId147]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject147').huntingQueryVersion147]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject147')._huntingQuerycontentId147]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 senders of  Admin Teams message submissions FP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject147')._huntingQuerycontentId147,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject147')._huntingQuerycontentId147,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject148').huntingQueryTemplateSpecName148]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 Users clicking on malicious URLs in Teams_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject148').huntingQueryVersion148]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_148",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Users clicking on malicious URLs in Teams",
-                "category": "Hunting Queries",
-                "query": "//Top 10 Users clicking on malicious URLs in Teams\nUrlClickEvents \n| where Workload ==\"Teams\" and ThreatTypes in (\"Phish\",\"Malware\") \n| summarize Blocked = countif(ActionType ==\"ClickBlocked\"), Allowed = countif(ActionType ==\"ClickAllowed\"), PendingVerdict = countif(ActionType ==\"UrlScanInProgress\"), Error = countif(ActionType ==\"UrlErrorPage\"), ClickedThrough = countif(IsClickedThrough)by AccountUpn\n| top 10 by Blocked desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject148')._huntingQuerycontentId148),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 148",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject148')._huntingQuerycontentId148)]",
-                "contentId": "[variables('huntingQueryObject148')._huntingQuerycontentId148]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject148').huntingQueryVersion148]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject148')._huntingQuerycontentId148]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Users clicking on malicious URLs in Teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject148')._huntingQuerycontentId148,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject148')._huntingQuerycontentId148,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject149').huntingQueryTemplateSpecName149]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top accounts performing Teams admin submissions FN or FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject149').huntingQueryVersion149]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_149",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top accounts performing Teams admin submissions FN or FP",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"1\",\"2\",\"3\")\n| summarize count() by SubmittedBy\n| project SubmittedBy, TeamsMessages = count_\n|top 10 by TeamsMessages desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top admins performing false negative or false positive admin submissions of Teams messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject149')._huntingQuerycontentId149),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 149",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject149')._huntingQuerycontentId149)]",
-                "contentId": "[variables('huntingQueryObject149')._huntingQuerycontentId149]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject149').huntingQueryVersion149]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject149')._huntingQuerycontentId149]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top accounts performing Teams admin submissions FN or FP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject149')._huntingQuerycontentId149,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject149')._huntingQuerycontentId149,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject150').huntingQueryTemplateSpecName150]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top accounts performing Teams user submissions FN or FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject150').huntingQueryVersion150]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_150",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top accounts performing Teams user submissions FN or FP",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)\n| where SubmissionContentType == \"ChatMessage\"\n| summarize count() by SubmittedBy\n| project SubmittedBy, TeamsMessages = count_\n|top 10 by TeamsMessages desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top users performing false negative or false positive user submissions of Teams messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject150')._huntingQuerycontentId150),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 150",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject150')._huntingQuerycontentId150)]",
-                "contentId": "[variables('huntingQueryObject150')._huntingQuerycontentId150]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject150').huntingQueryVersion150]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject150')._huntingQuerycontentId150]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top accounts performing Teams user submissions FN or FP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject150')._huntingQuerycontentId150,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject150')._huntingQuerycontentId150,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject151').huntingQueryTemplateSpecName151]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top domains outbound sending Malicious Teams messages inbound_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject151').huntingQueryVersion151]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_151",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top domains outbound sending Malicious Teams messages inbound",
-                "category": "Hunting Queries",
-                "query": "// This query provides insights of top outbound recipient domains of outbound Teams messages by volume and shows total number of inbound Teams messages with Threats from the same domains (as inbound senders) indicating potential partner user or organization compromise.\nMessageEvents\n| where IsExternalThread==1 and IsOwnedThread==1\n| mv-expand Recipients = RecipientDetails\n| extend RecipientEmailAddress = Recipients.RecipientSmtpAddress\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\n//| where RecipientDomain !=\"contoso.com\"\n| summarize count() by RecipientDomain\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\n| join (MessageEvents |mv-expand Recipients = RecipientDetails|extend RecipientEmailAddress = Recipients.RecipientSmtpAddress|extend SenderFromDomain = tostring(split(RecipientEmailAddress, \"@\")[1])| where IsExternalThread==1 and IsOwnedThread==0 and isempty(ThreatTypes)==false) on SenderFromDomain\n| summarize max(OutboundCount),count() by SenderFromDomain\n//| extend Bad_Traffic_Percentage = todouble(round(IncomingTeamsMessagesWithThreats=count_ / todouble(OutboundTeamsMessages=max_OutboundCount), 2))\n| project SenderFromDomain, OutboundTeamsMessages=max_OutboundCount, IncomingTeamsMessagesWithThreats=count_//, Bad_Traffic_Percentage\n| sort by OutboundTeamsMessages\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looking for potential partner compromise via comparing outbound Teams message traffic per target domain and looking for malicious Teams messages from the same domains as inbound."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject151')._huntingQuerycontentId151),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 151",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject151')._huntingQuerycontentId151)]",
-                "contentId": "[variables('huntingQueryObject151')._huntingQuerycontentId151]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject151').huntingQueryVersion151]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject151')._huntingQuerycontentId151]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top domains outbound sending Malicious Teams messages inbound",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject151')._huntingQuerycontentId151,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject151')._huntingQuerycontentId151,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject152').huntingQueryTemplateSpecName152]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top external malicious senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject152').huntingQueryVersion152]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_152",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top External malicious Senders",
-                "category": "Hunting Queries",
-                "query": "//Top external senders sending malicious inbound Teams messages Spam, Phish, Malware\nMessageEvents \n| where IsOwnedThread==0 and IsExternalThread==1 and ThreatTypes !='' and Timestamp > ago(30d)\n| summarize count() by SenderEmailAddress, ThreatTypes \n| sort by count_ desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Top external senders sending malicious inbound Teams messages Spam, Phish, Malware"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject152')._huntingQuerycontentId152),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 152",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject152')._huntingQuerycontentId152)]",
-                "contentId": "[variables('huntingQueryObject152')._huntingQuerycontentId152]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject152').huntingQueryVersion152]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject152')._huntingQuerycontentId152]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top External malicious Senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject152')._huntingQuerycontentId152,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject152')._huntingQuerycontentId152,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject153').huntingQueryTemplateSpecName153]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top External Sender domains - Malware_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject153').huntingQueryVersion153]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_153",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top External Sender domains - Malware",
-                "category": "Hunting Queries",
-                "query": "//Top External Sender domains sending Teams message with Malware threats\nMessageEvents\n| where IsExternalThread==1 and IsOwnedThread==0\n| where ThreatTypes contains \"Malware\"\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\n| summarize count() by SenderDomain\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Top External Sender domains sending Teams message with Malware threats"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject153')._huntingQuerycontentId153),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 153",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject153')._huntingQuerycontentId153)]",
-                "contentId": "[variables('huntingQueryObject153')._huntingQuerycontentId153]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject153').huntingQueryVersion153]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject153')._huntingQuerycontentId153]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top External Sender domains - Malware",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject153')._huntingQuerycontentId153,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject153')._huntingQuerycontentId153,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject154').huntingQueryTemplateSpecName154]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top External Sender domains - Phish_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject154').huntingQueryVersion154]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_154",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top External Sender domains - Phish",
-                "category": "Hunting Queries",
-                "query": "//Top External Sender domains sending Teams message with Phish threats\nMessageEvents\n| where IsExternalThread==1 and IsOwnedThread==0\n| where ThreatTypes contains \"Phish\"\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\n| summarize count() by SenderDomain\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Top External Sender domains sending Teams message with Phish threats"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject154')._huntingQuerycontentId154),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 154",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject154')._huntingQuerycontentId154)]",
-                "contentId": "[variables('huntingQueryObject154')._huntingQuerycontentId154]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject154').huntingQueryVersion154]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject154')._huntingQuerycontentId154]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top External Sender domains - Phish",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject154')._huntingQuerycontentId154,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject154')._huntingQuerycontentId154,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject155').huntingQueryTemplateSpecName155]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top External Sender domains - Spam_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject155').huntingQueryVersion155]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_155",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top External Sender domains - Spam",
-                "category": "Hunting Queries",
-                "query": "//Top External Sender domains sending Teams message with Spam threats\nMessageEvents\n| where IsExternalThread==1 and IsOwnedThread==0\n| where ThreatTypes contains \"Spam\"\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\n| summarize count() by SenderDomain\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Top External Sender domains sending Teams message with Spam threats"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject155')._huntingQuerycontentId155),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 155",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject155')._huntingQuerycontentId155)]",
-                "contentId": "[variables('huntingQueryObject155')._huntingQuerycontentId155]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject155').huntingQueryVersion155]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject155')._huntingQuerycontentId155]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top External Sender domains - Spam",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject155')._huntingQuerycontentId155,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject155')._huntingQuerycontentId155,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject156').huntingQueryTemplateSpecName156]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top malicious URLs clicked by users in Teams_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject156').huntingQueryVersion156]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_156",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top malicious URLs clicked by users in Teams",
-                "category": "Hunting Queries",
-                "query": "//This query shows the top 20 URL's that have a detection associated with it and the most ammount of clicks registered from Microsoft Teams \nUrlClickEvents\n| where ThreatTypes !=\"\" and Workload ==\"Teams\"\n| summarize count() by Url, ThreatTypes, ActionType, Workload\n| project Url, ThreatTypes, ActionType, Workload, ClickCount=count_\n| top 20 by ClickCount\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunt for top malicious URLs clicked by users in Teams"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject156')._huntingQuerycontentId156),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 156",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject156')._huntingQuerycontentId156)]",
-                "contentId": "[variables('huntingQueryObject156')._huntingQuerycontentId156]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject156').huntingQueryVersion156]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject156')._huntingQuerycontentId156]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top malicious URLs clicked by users in Teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject156')._huntingQuerycontentId156,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject156')._huntingQuerycontentId156,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject157').huntingQueryTemplateSpecName157]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total number of MDO Teams protection detections daily_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject157').huntingQueryVersion157]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_157",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Total number of MDO Teams protection detections daily",
-                "category": "Hunting Queries",
-                "query": "//Total number of MDO Teams protection detections daily \nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\nlet baseQuery = MessageEvents\n//| where IsOwnedThread==0 and IsExternalThread==1 \n| where isnotempty(Timestamp);\nlet totalwiththreat = baseQuery\n| where isnotempty(ThreatTypes) \n| make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d \n| extend Details = \"Total Teams messages with Threat\";\nlet totalwithphishthreat = baseQuery\n| where ThreatTypes has ('Phish')\n| make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d \n| extend Details = \"Total Teams messages with Phish Threat\";\nlet totalwithmalwarethreat = baseQuery\n| where ThreatTypes has ('Malware')\n| make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d \n| extend Details = \"Total Teams messages with Malware Threat\";\nunion totalwiththreat, totalwithphishthreat, totalwithmalwarethreat\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visulises Total number of MDO Teams protection detections daily"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1562"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject157')._huntingQuerycontentId157),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 157",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject157')._huntingQuerycontentId157)]",
-                "contentId": "[variables('huntingQueryObject157')._huntingQuerycontentId157]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject157').huntingQueryVersion157]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject157')._huntingQuerycontentId157]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Total number of MDO Teams protection detections daily",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject157')._huntingQuerycontentId157,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject157')._huntingQuerycontentId157,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject158').huntingQueryTemplateSpecName158]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URL click on URLs in ZAP-d Teams messages_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject158').huntingQueryVersion158]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_158",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URL click on URLs in ZAP-d Teams messages",
-                "category": "Hunting Queries",
-                "query": "//URL click on URLs in ZAP-d Teams messages\nMessagePostDeliveryEvents\n| join MessageUrlInfo on TeamsMessageId\n| join UrlClickEvents on Url\n| where ActionType !=\"\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject158')._huntingQuerycontentId158),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 158",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject158')._huntingQuerycontentId158)]",
-                "contentId": "[variables('huntingQueryObject158')._huntingQuerycontentId158]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject158').huntingQueryVersion158]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject158')._huntingQuerycontentId158]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URL click on URLs in ZAP-d Teams messages",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject158')._huntingQuerycontentId158,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject158')._huntingQuerycontentId158,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject159').huntingQueryTemplateSpecName159]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam and Phish delivered to Inbox due to Admin Overrides_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject159').huntingQueryVersion159]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_159",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam and Phish allowed to inbox by Admin Overrides",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ConfidenceLevel != \"\" and OrgLevelPolicy!=\"\" and OrgLevelAction == \"Allow\" and DeliveryAction == \"Delivered\";\nlet spam=baseQuery\n| where ThreatTypes has 'Spam'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Allowed Spam\";\nlet phish=baseQuery\n| where ThreatTypes has 'Phish'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Allowed Phish\";\nunion spam,phish\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps in reviewing malicious emails allowed due to admin overrides"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject159')._huntingQuerycontentId159),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 159",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject159')._huntingQuerycontentId159)]",
-                "contentId": "[variables('huntingQueryObject159')._huntingQuerycontentId159]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject159').huntingQueryVersion159]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject159')._huntingQuerycontentId159]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam and Phish allowed to inbox by Admin Overrides",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject159')._huntingQuerycontentId159,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject159')._huntingQuerycontentId159,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject160').huntingQueryTemplateSpecName160]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam and Phish delivered to Inbox due to User Overrides_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject160').huntingQueryVersion160]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_160",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam and Phish allowed to inbox by User Overrides",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ConfidenceLevel != \"\" and UserLevelPolicy!=\"\" and UserLevelAction == \"Allow\" and DeliveryAction == \"Delivered\";\nlet spam=baseQuery\n| where ThreatTypes has 'Spam'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Allowed Spam\";\nlet phish=baseQuery\n| where ThreatTypes has 'Phish'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Allowed Phish\";\nunion spam,phish\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps in reviewing malicious emails allowed due to user overrides"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject160')._huntingQuerycontentId160),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 160",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject160')._huntingQuerycontentId160)]",
-                "contentId": "[variables('huntingQueryObject160')._huntingQuerycontentId160]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject160').huntingQueryVersion160]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject160')._huntingQuerycontentId160]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam and Phish allowed to inbox by User Overrides",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject160')._huntingQuerycontentId160,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject160')._huntingQuerycontentId160,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject161').huntingQueryTemplateSpecName161]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top policies performing admin overrides_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject161').huntingQueryVersion161]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_161",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top policies performing admin overrides",
-                "category": "Hunting Queries",
-                "query": "EmailEvents  \n| where OrgLevelPolicy!=\"\" and OrgLevelAction == \"Allow\"  //\"Block\"\n| extend OrgPolicy = split(OrgLevelPolicy, \"(\", 0)\n| summarize count() by tostring(OrgPolicy)\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps in reviewing top policies for admin overrides (Allow/Block)"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject161')._huntingQuerycontentId161),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 161",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject161')._huntingQuerycontentId161)]",
-                "contentId": "[variables('huntingQueryObject161')._huntingQuerycontentId161]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject161').huntingQueryVersion161]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject161')._huntingQuerycontentId161]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top policies performing admin overrides",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject161')._huntingQuerycontentId161,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject161')._huntingQuerycontentId161,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject162').huntingQueryTemplateSpecName162]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top policies performing user overrides_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject162').huntingQueryVersion162]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_162",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top policies performing user overrides",
-                "category": "Hunting Queries",
-                "query": "EmailEvents  \n| where UserLevelPolicy!=\"\" and UserLevelAction == \"Allow\" //\"Block\"\n| extend UserPolicy = split(UserLevelPolicy, \"(\", 0)\n| summarize count() by tostring(UserPolicy)\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps in reviewing top policies for user overrides (Allow/Block)"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject162')._huntingQuerycontentId162),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 162",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject162')._huntingQuerycontentId162)]",
-                "contentId": "[variables('huntingQueryObject162')._huntingQuerycontentId162]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject162').huntingQueryVersion162]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject162')._huntingQuerycontentId162]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top policies performing user overrides",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject162')._huntingQuerycontentId162,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject162')._huntingQuerycontentId162,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject163').huntingQueryTemplateSpecName163]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total Emails with Admin Overrides - Allow_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject163').huntingQueryVersion163]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_163",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Total Emails with Admin Overrides (Allow)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where OrgLevelPolicy != \"\" and OrgLevelAction == \"Allow\"\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by OrgLevelPolicy\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject163')._huntingQuerycontentId163),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 163",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject163')._huntingQuerycontentId163)]",
-                "contentId": "[variables('huntingQueryObject163')._huntingQuerycontentId163]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject163').huntingQueryVersion163]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject163')._huntingQuerycontentId163]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Total Emails with Admin Overrides (Allow)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject163')._huntingQuerycontentId163,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject163')._huntingQuerycontentId163,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject164').huntingQueryTemplateSpecName164]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total Emails with Admin Overrides - Block_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject164').huntingQueryVersion164]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_164",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Total Emails with Admin Overrides (Block)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where OrgLevelPolicy != \"\" and OrgLevelAction == \"Block\"\n| make-series TotalAdminOverrides = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject164')._huntingQuerycontentId164),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 164",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject164')._huntingQuerycontentId164)]",
-                "contentId": "[variables('huntingQueryObject164')._huntingQuerycontentId164]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject164').huntingQueryVersion164]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject164')._huntingQuerycontentId164]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Total Emails with Admin Overrides (Block)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject164')._huntingQuerycontentId164,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject164')._huntingQuerycontentId164,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject165').huntingQueryTemplateSpecName165]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total Emails with User Overrides - Allow_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject165').huntingQueryVersion165]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_165",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Total Emails with User Overrides (Allow)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where UserLevelPolicy != \"\" and UserLevelAction == \"Allow\"\n| summarize Emails = count() by UserLevelAction, UserLevelPolicy, ThreatTypes\n| sort by Emails desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject165')._huntingQuerycontentId165),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 165",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject165')._huntingQuerycontentId165)]",
-                "contentId": "[variables('huntingQueryObject165')._huntingQuerycontentId165]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject165').huntingQueryVersion165]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject165')._huntingQuerycontentId165]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Total Emails with User Overrides (Allow)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject165')._huntingQuerycontentId165,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject165')._huntingQuerycontentId165,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject166').huntingQueryTemplateSpecName166]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total Emails with User Overrides - Block_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject166').huntingQueryVersion166]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_166",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Total Emails with User Overrides (Block)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where UserLevelPolicy != \"\" and UserLevelAction == \"Block\"\n| make-series TotalUserOverrides = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject166')._huntingQuerycontentId166),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 166",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject166')._huntingQuerycontentId166)]",
-                "contentId": "[variables('huntingQueryObject166')._huntingQuerycontentId166]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject166').huntingQueryVersion166]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject166')._huntingQuerycontentId166]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Total Emails with User Overrides (Block)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject166')._huntingQuerycontentId166,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject166')._huntingQuerycontentId166,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject167').huntingQueryTemplateSpecName167]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detection Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject167').huntingQueryVersion167]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_167",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\"\n| make-series PhishDetections = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish detections over time summarizing the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject167')._huntingQuerycontentId167),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 167",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject167')._huntingQuerycontentId167)]",
-                "contentId": "[variables('huntingQueryObject167')._huntingQuerycontentId167]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject167').huntingQueryVersion167]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject167')._huntingQuerycontentId167]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject167')._huntingQuerycontentId167,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject167')._huntingQuerycontentId167,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject168').huntingQueryTemplateSpecName168]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detections by Delivery Location - High_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject168').huntingQueryVersion168]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_168",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detections (High) by delivery location",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where tostring(parse_json(ConfidenceLevel).Phish) == \"High\"\n| summarize count() by LatestDeliveryLocation\n| sort by count_ desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject168')._huntingQuerycontentId168),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 168",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject168')._huntingQuerycontentId168)]",
-                "contentId": "[variables('huntingQueryObject168')._huntingQuerycontentId168]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject168').huntingQueryVersion168]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject168')._huntingQuerycontentId168]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detections (High) by delivery location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject168')._huntingQuerycontentId168,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject168')._huntingQuerycontentId168,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject169').huntingQueryTemplateSpecName169]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detections by Delivery Location - Medium_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject169').huntingQueryVersion169]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_169",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detections (Normal) by delivery location",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where tostring(parse_json(ConfidenceLevel).Phish) == \"Normal\"\n| summarize count() by LatestDeliveryLocation\n| sort by count_ desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject169')._huntingQuerycontentId169),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 169",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject169')._huntingQuerycontentId169)]",
-                "contentId": "[variables('huntingQueryObject169')._huntingQuerycontentId169]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject169').huntingQueryVersion169]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject169')._huntingQuerycontentId169]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detections (Normal) by delivery location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject169')._huntingQuerycontentId169,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject169')._huntingQuerycontentId169,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject170').huntingQueryTemplateSpecName170]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detections by Delivery Location Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject170').huntingQueryVersion170]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_170",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detections by delivery location trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\" and EmailDirection == \"Inbound\"\n| make-series TotalPhishDetections = count(), Quarantine = countif(DeliveryLocation == \"Quarantine\"), Junkfolder = countif(DeliveryLocation == \"Junk folder\"), Inbox = countif(DeliveryLocation == \"Inbox/folder\"), Failed = countif(DeliveryLocation == \"Failed\"), Dropped = countif(DeliveryLocation == \"Dropped\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject170')._huntingQuerycontentId170),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 170",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject170')._huntingQuerycontentId170)]",
-                "contentId": "[variables('huntingQueryObject170')._huntingQuerycontentId170]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject170').huntingQueryVersion170]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject170')._huntingQuerycontentId170]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detections by delivery location trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject170')._huntingQuerycontentId170,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject170')._huntingQuerycontentId170,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject171').huntingQueryTemplateSpecName171]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject171').huntingQueryVersion171]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_171",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detections by Detection technology Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\"\n| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(PhishMethod)\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by PhishMethod\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject171')._huntingQuerycontentId171),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 171",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject171')._huntingQuerycontentId171)]",
-                "contentId": "[variables('huntingQueryObject171')._huntingQuerycontentId171]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject171').huntingQueryVersion171]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject171')._huntingQuerycontentId171]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detections by Detection technology Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject171')._huntingQuerycontentId171,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject171')._huntingQuerycontentId171,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject172').huntingQueryTemplateSpecName172]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detections by Detection Technology_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject172').huntingQueryVersion172]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_172",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detections by Detection technology",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\"\n| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(PhishMethod)\n| summarize Count = count() by PhishMethod\n| sort by Count desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish detections summarizing the data by various Phish detection technologies/controls"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject172')._huntingQuerycontentId172),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 172",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject172')._huntingQuerycontentId172)]",
-                "contentId": "[variables('huntingQueryObject172')._huntingQuerycontentId172]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject172').huntingQueryVersion172]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject172')._huntingQuerycontentId172]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detections by Detection technology",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject172')._huntingQuerycontentId172,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject172')._huntingQuerycontentId172,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject173').huntingQueryTemplateSpecName173]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Possible device code phishing attempts_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject173').huntingQueryVersion173]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_173",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Possible device code phishing attempts",
-                "category": "Hunting Queries",
-                "query": "let DeviceLoginUrls = pack_array(strcat(\"microsoft.\", \"com/devicelogin\"), strcat(\"login.\", \"microsoftonline.com/common/oauth2/deviceauth\"));\nlet suspiciousUserClicks = materialize(UrlClickEvents\n  | where ActionType in (\"ClickAllowed\", \"UrlScanInProgress\", \"UrlErrorPage\") or IsClickedThrough != \"0\"\n  | where UrlChain has_any (DeviceLoginUrls)\n  | extend AccountUpn = tolower(AccountUpn)\n  | project ClickTime = Timestamp, ActionType, UrlChain, NetworkMessageId, Url, AccountUpn);\n//Check for Risky Sign-In in the short time window\nlet interestedUsersUpn = suspiciousUserClicks\n  | where isnotempty(AccountUpn)\n  | distinct AccountUpn;\nlet suspiciousSignIns = materialize(AADSignInEventsBeta\n  | where ErrorCode == 0\n  | where AccountUpn in~ (interestedUsersUpn)\n  | where RiskLevelDuringSignIn in (10, 50, 100)\n  | extend AccountUpn = tolower(AccountUpn)\n  | join kind=inner suspiciousUserClicks on AccountUpn\n  | where (Timestamp - ClickTime) between (-2min .. 7min)\n  | project Timestamp, ReportId, ClickTime, AccountUpn, RiskLevelDuringSignIn, SessionId, IPAddress, Url\n);\n//Validate errorCode 50199 followed by success in 5 minute time interval for the interested user, which suggests a pause to input the code from the phishing email\nlet interestedSessionUsers = suspiciousSignIns\n  | where isnotempty(AccountUpn)\n  | distinct AccountUpn;\nlet shortIntervalSignInAttemptUsers = materialize(AADSignInEventsBeta\n  | where AccountUpn in~ (interestedSessionUsers)\n  | where ErrorCode in (0, 50199)\n  | summarize ErrorCodes = make_set(ErrorCode) by AccountUpn, CorrelationId, SessionId\n  | where ErrorCodes has_all (0, 50199)\n  | distinct AccountUpn);\nsuspiciousSignIns\n| where AccountUpn in (shortIntervalSignInAttemptUsers)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps hunting for possible device code Phishing attempts"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject173')._huntingQuerycontentId173),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 173",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject173')._huntingQuerycontentId173)]",
-                "contentId": "[variables('huntingQueryObject173')._huntingQuerycontentId173]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject173').huntingQueryVersion173]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject173')._huntingQuerycontentId173]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Possible device code phishing attempts",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject173')._huntingQuerycontentId173,'-', '1.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject173')._huntingQuerycontentId173,'-', '1.0.1')))]",
-        "version": "1.0.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject174').huntingQueryTemplateSpecName174]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Domains sending Phish_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject174').huntingQueryVersion174]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_174",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email Top Domains sending Phish",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\n| summarize TotalEmailCount = count(), PhishEmailCount = countif(ThreatTypes has \"Phish\"), Phish_High = countif(ThreatTypes has \"Phish\" and PhishConf == \"High\"), Phish_Normal = countif(ThreatTypes has \"Phish\" and PhishConf == \"Normal\") by SenderFromDomain\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where PhishEmailCount != 0\n| top 15 by PhishEmailCount\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject174')._huntingQuerycontentId174),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 174",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject174')._huntingQuerycontentId174)]",
-                "contentId": "[variables('huntingQueryObject174')._huntingQuerycontentId174]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject174').huntingQueryVersion174]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject174')._huntingQuerycontentId174]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email Top Domains sending Phish",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject174')._huntingQuerycontentId174,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject174')._huntingQuerycontentId174,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject175').huntingQueryTemplateSpecName175]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Users receiving Phish_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject175').huntingQueryVersion175]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_175",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Users receiving Phish",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), PhishEmailCount = countif(ThreatTypes has \"Phish\") by RecipientEmailAddress\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where PhishEmailCount != 0\n| top 15 by PhishEmailCount\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress)"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject175')._huntingQuerycontentId175),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 175",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject175')._huntingQuerycontentId175)]",
-                "contentId": "[variables('huntingQueryObject175')._huntingQuerycontentId175]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject175').huntingQueryVersion175]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject175')._huntingQuerycontentId175]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Users receiving Phish",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject175')._huntingQuerycontentId175,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject175')._huntingQuerycontentId175,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject176').huntingQueryTemplateSpecName176]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Zero-day Phish Detections Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject176').huntingQueryVersion176]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_176",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Zero-day Phish Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\"\n| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)\n| where PhishMethod in ('File detonation', 'URL detonation')\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by PhishMethod\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject176')._huntingQuerycontentId176),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 176",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject176')._huntingQuerycontentId176)]",
-                "contentId": "[variables('huntingQueryObject176')._huntingQuerycontentId176]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject176').huntingQueryVersion176]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject176')._huntingQuerycontentId176]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Zero-day Phish Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject176')._huntingQuerycontentId176,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject176')._huntingQuerycontentId176,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject177').huntingQueryTemplateSpecName177]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Campaign with randomly named attachments_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject177').huntingQueryVersion177]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_177",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Campaign with randomly named attachments",
-                "category": "Hunting Queries",
-                "query": "EmailAttachmentInfo\n| where Timestamp > ago(7d)\n| where FileType in (\"png\", \"jpg\", \"jpeg\", \"gif\", \"svg\")\n| where isnotempty(FileName)\n| extend firstFourFileName = substring(FileName, 0, 4)\n| summarize RecipientsCount = dcount(RecipientEmailAddress), FirstFourFilesCount = dcount(firstFourFileName), suspiciousEmails = make_set(NetworkMessageId, 10) by SenderFromAddress\n| where FirstFourFilesCount >= 10\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject177')._huntingQuerycontentId177),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 177",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject177')._huntingQuerycontentId177)]",
-                "contentId": "[variables('huntingQueryObject177')._huntingQuerycontentId177]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject177').huntingQueryVersion177]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject177')._huntingQuerycontentId177]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Campaign with randomly named attachments",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject177')._huntingQuerycontentId177,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject177')._huntingQuerycontentId177,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject178').huntingQueryTemplateSpecName178]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Campaign with suspicious keywords_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject178').huntingQueryVersion178]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_178",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Campaign with suspicious keywords",
-                "category": "Hunting Queries",
-                "query": "let PhishingKeywords = ()\n{pack_array(\"account\", \"alert\", \"bank\", \"billing\", \"card\", \"change\", \"confirmation\",\"login\", \"password\", \"mfa\", \"authorize\", \"authenticate\", \"payment\", \"urgent\", \"verify\", \"blocked\");};\nEmailEvents\n| where Timestamp > ago(1d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| where isempty(SenderObjectId)\n| where Subject has_any (PhishingKeywords())\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this detection, we track emails with suspicious keywords in subjects."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject178')._huntingQuerycontentId178),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 178",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject178')._huntingQuerycontentId178)]",
-                "contentId": "[variables('huntingQueryObject178')._huntingQuerycontentId178]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject178').huntingQueryVersion178]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject178')._huntingQuerycontentId178]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Campaign with suspicious keywords",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject178')._huntingQuerycontentId178,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject178')._huntingQuerycontentId178,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject179').huntingQueryTemplateSpecName179]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Custom detection-Emails with QR from non-prevalent senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject179').huntingQueryVersion179]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_179",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Custom detection-Emails with QR from non-prevalent senders",
-                "category": "Hunting Queries",
-                "query": "let QRCode_emails = EmailUrlInfo\n| where Timestamp > ago (2d)\n| where UrlLocation == \"QRCode\"\n| distinct Url,NetworkMessageId;\nlet nMIDs = QRCode_emails | distinct NetworkMessageId;\n// Extracting sender of the email with QRCode:\nlet senders_NMIDs = EmailEvents\n| where Timestamp > ago (2d)\n| where DeliveryAction != \"Blocked\" // Only delivered or Junked emails are interesting\n| where isnotempty(NetworkMessageId)\n| where NetworkMessageId in (nMIDs)\n| distinct  Timestamp, NetworkMessageId, RecipientEmailAddress, SenderFromAddress, InternetMessageId, RecipientObjectId, ReportId;\nlet senders = senders_NMIDs\n| distinct SenderFromAddress;\n// Checking sender prevalence in the organization\nlet senderprevalence = EmailEvents\n| where Timestamp between (ago(14d)..(now()-24h))\n| where isnotempty(SenderFromAddress)\n| where SenderFromAddress in (senders)\n| summarize TotalEmailCount = count()  by SenderFromAddress\n| where TotalEmailCount > 1;\nlet prevalent_Sender = senderprevalence\n| where isnotempty (SenderFromAddress)\n| distinct SenderFromAddress;\n// Checking where email sender was not prevalent.\nlet nMIDs_from_non_prevalent_Senders = senders_NMIDs\n| where SenderFromAddress !in (prevalent_Sender)\n| distinct NetworkMessageId;\nlet QRCode_emails_from_non_prevalent_senders = QRCode_emails\n| where NetworkMessageId in (nMIDs_from_non_prevalent_Senders)\n| join kind=inner senders_NMIDs on NetworkMessageId\n| project Timestamp,Url,NetworkMessageId, InternetMessageId, RecipientObjectId,RecipientEmailAddress, ReportId;\nQRCode_emails_from_non_prevalent_senders\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject179')._huntingQuerycontentId179),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 179",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject179')._huntingQuerycontentId179)]",
-                "contentId": "[variables('huntingQueryObject179')._huntingQuerycontentId179]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject179').huntingQueryVersion179]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject179')._huntingQuerycontentId179]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Custom detection-Emails with QR from non-prevalent senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject179')._huntingQuerycontentId179,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject179')._huntingQuerycontentId179,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject180').huntingQueryTemplateSpecName180]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Emails delivered having URLs from QR codes_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject180').huntingQueryVersion180]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_180",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Emails delivered having URLs from QR codes",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| join EmailUrlInfo on NetworkMessageId\n| where UrlLocation == \"QRCode\"\n| project Timestamp, NetworkMessageId, SenderFromAddress, Subject, Url, UrlDomain, UrlLocation,RecipientEmailAddress\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we hunt for inbound emails delivered having URLs from QR codes"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject180')._huntingQuerycontentId180),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 180",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject180')._huntingQuerycontentId180)]",
-                "contentId": "[variables('huntingQueryObject180')._huntingQuerycontentId180]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject180').huntingQueryVersion180]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject180')._huntingQuerycontentId180]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Emails delivered having URLs from QR codes",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject180')._huntingQuerycontentId180,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject180')._huntingQuerycontentId180,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject181').huntingQueryTemplateSpecName181]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Emails with QR codes and suspicious keywords in subject_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject181').huntingQueryVersion181]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_181",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Emails with QR codes and suspicious keywords in subject",
-                "category": "Hunting Queries",
-                "query": "let SubjectKeywords = ()\n{pack_array(\"authorize\", \"authenticate\", \"account\", \"confirmation\", \"QR\", \"login\", \"password\",  \"payment\", \"urgent\", \"verify\");};\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| where Subject has_any (SubjectKeywords)\n| join EmailUrlInfo on NetworkMessageId\n| where UrlLocation == \"QRCode\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject181')._huntingQuerycontentId181),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 181",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject181')._huntingQuerycontentId181)]",
-                "contentId": "[variables('huntingQueryObject181')._huntingQuerycontentId181]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject181').huntingQueryVersion181]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject181')._huntingQuerycontentId181]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Emails with QR codes and suspicious keywords in subject",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject181')._huntingQuerycontentId181,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject181')._huntingQuerycontentId181,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject182').huntingQueryTemplateSpecName182]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Emails with QR codes from non-prevalent sender_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject182').huntingQueryVersion182]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_182",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Emails with QR codes from non-prevalent sender",
-                "category": "Hunting Queries",
-                "query": "let senderprevalence =\nEmailEvents\n| where Timestamp between (ago(7d)..(now()-24h))\n| where isnotempty(SenderFromAddress)\n| summarize TotalEmailCount = dcount(NetworkMessageId) by SenderFromAddress\n| where TotalEmailCount > 1;\nlet prevalent_Sender = senderprevalence\n| where isnotempty (SenderFromAddress)\n| distinct SenderFromAddress;\nlet QR_from_non_prevalent =\nEmailEvents\n| where EmailDirection == \"Inbound\"\n| where Timestamp > ago(1d)\n| where SenderFromAddress !in (prevalent_Sender)\n| join EmailUrlInfo on NetworkMessageId\n| where UrlLocation == \"QRCode\"\n| distinct SenderFromAddress,Url,NetworkMessageId;\nQR_from_non_prevalent\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject182')._huntingQuerycontentId182),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 182",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject182')._huntingQuerycontentId182)]",
-                "contentId": "[variables('huntingQueryObject182')._huntingQuerycontentId182]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject182').huntingQueryVersion182]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject182')._huntingQuerycontentId182]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Emails with QR codes from non-prevalent sender",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject182')._huntingQuerycontentId182,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject182')._huntingQuerycontentId182,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject183').huntingQueryTemplateSpecName183]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunting for sender patterns_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject183').huntingQueryVersion183]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_183",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunting for sender patterns",
-                "category": "Hunting Queries",
-                "query": "let PhishingSenderDisplayNames = ()\n{\npack_array(\"IT\", \"support\", \"Payroll\", \"HR\", \"admin\", \"2FA\", \"notification\", \"sign\", \"reminder\", \"consent\", \"workplace\",\n\"administrator\", \"administration\", \"benefits\", \"employee\", \"update\", \"on behalf\");\n};\nlet suspiciousEmails = EmailEvents\n| where Timestamp > ago(1d)\n| where isnotempty(RecipientObjectId)\n| where isnotempty(SenderFromAddress)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| join kind=inner (EmailAttachmentInfo\n| where Timestamp > ago(1d)\n| where isempty(SenderObjectId)\n| where FileType has_any (\"png\", \"jpg\", \"jpeg\", \"bmp\", \"gif\")\n ) on NetworkMessageId\n| where SenderDisplayName has_any (PhishingSenderDisplayNames())\n| project Timestamp, Subject, FileName, SenderFromDomain, RecipientObjectId, NetworkMessageId;\nlet suspiciousSenders = suspiciousEmails | distinct SenderFromDomain;\nlet prevalentSenders = materialize(EmailEvents\n| where Timestamp between (ago(7d) .. ago(1d))\n| where isnotempty(RecipientObjectId)\n| where isnotempty(SenderFromAddress)\n| where SenderFromDomain in (suspiciousSenders)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| distinct SenderFromDomain);\nsuspiciousEmails\n| where SenderFromDomain !in (prevalentSenders)\n| project Timestamp, Subject, FileName, SenderFromDomain, RecipientObjectId, NetworkMessageId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject183')._huntingQuerycontentId183),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 183",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject183')._huntingQuerycontentId183)]",
-                "contentId": "[variables('huntingQueryObject183')._huntingQuerycontentId183]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject183').huntingQueryVersion183]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject183')._huntingQuerycontentId183]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunting for sender patterns",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject183')._huntingQuerycontentId183,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject183')._huntingQuerycontentId183,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject184').huntingQueryTemplateSpecName184]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunting for user signals-clusters_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject184').huntingQueryVersion184]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_184",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunting for user signals-clusters",
-                "category": "Hunting Queries",
-                "query": "let suspiciousClusters = EmailEvents\n| where Timestamp > ago(7d)\n| where EmailDirection == \"Inbound\"\n| where NetworkMessageId in (\"5ff15b1f-d731-4625-4c1c-08dc8615943f\",\"00ff0916-1263-428c-a558-08dc86a6d3cd\") //<List of suspicious Network Message Ids from Alerts>\n| distinct EmailClusterId;\nEmailEvents\n| where Timestamp > ago(7d)\n| where EmailDirection == \"Inbound\"\n| where EmailClusterId in (suspiciousClusters)\n| summarize make_set(Subject), make_set(SenderFromDomain), dcount(RecipientObjectId),dcount(SenderDisplayName) by EmailClusterId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject184')._huntingQuerycontentId184),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 184",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject184')._huntingQuerycontentId184)]",
-                "contentId": "[variables('huntingQueryObject184')._huntingQuerycontentId184]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject184').huntingQueryVersion184]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject184')._huntingQuerycontentId184]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunting for user signals-clusters",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject184')._huntingQuerycontentId184,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject184')._huntingQuerycontentId184,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject185').huntingQueryTemplateSpecName185]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Inbound emails with QR code URLs_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject185').huntingQueryVersion185]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_185",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Inbound emails with QR code URLs",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| join EmailUrlInfo on NetworkMessageId\n| where UrlLocation == \"QRCode\"\n| summarize dcount(NetworkMessageId) by bin(Timestamp, 1d)\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we summarize volume of inbound emails with QR code URLs in last 30 days"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject185')._huntingQuerycontentId185),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 185",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject185')._huntingQuerycontentId185)]",
-                "contentId": "[variables('huntingQueryObject185')._huntingQuerycontentId185]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject185').huntingQueryVersion185]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject185')._huntingQuerycontentId185]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Inbound emails with QR code URLs",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject185')._huntingQuerycontentId185,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject185')._huntingQuerycontentId185,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject186').huntingQueryTemplateSpecName186]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Personalized campaigns based on the first few keywords_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject186').huntingQueryVersion186]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_186",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Personalized campaigns based on the first few keywords",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(1d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| where isempty(SenderObjectId)\n| extend words = split(Subject,\" \")\n| project firstWord = tostring(words[0]), secondWord = tostring(words[1]), thirdWord = tostring(words[2]), Subject, SenderFromAddress, RecipientEmailAddress, NetworkMessageId\n| summarize SubjectsCount = dcount(Subject), RecipientsCount = dcount(RecipientEmailAddress), suspiciousEmails = make_set(NetworkMessageId, 10) by firstWord, secondWord, thirdWord, SenderFromAddress\n| where SubjectsCount >= 10\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this detection, we track emails with personalized subjects."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject186')._huntingQuerycontentId186),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 186",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject186')._huntingQuerycontentId186)]",
-                "contentId": "[variables('huntingQueryObject186')._huntingQuerycontentId186]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject186').huntingQueryVersion186]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject186')._huntingQuerycontentId186]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Personalized campaigns based on the first few keywords",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject186')._huntingQuerycontentId186,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject186')._huntingQuerycontentId186,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject187').huntingQueryTemplateSpecName187]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Personalized campaigns based on the last few keywords_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject187').huntingQueryVersion187]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_187",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Personalized campaigns based on the last few keywords",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(1d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| where isempty(SenderObjectId)\n| extend words = split(Subject,\" \")\n| project firstLastWord = tostring(words[-1]), secondLastWord = tostring(words[-2]), thirdLastWord = tostring(words[-3]), Subject, SenderFromAddress, RecipientEmailAddress, NetworkMessageId\n| summarize SubjectsCount = dcount(Subject), RecipientsCount = dcount(RecipientEmailAddress), suspiciousEmails = make_set(NetworkMessageId, 10) by firstLastWord, secondLastWord, thirdLastWord, SenderFromAddress\n| where SubjectsCount >= 10\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this detection, we track emails with personalized subjects."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject187')._huntingQuerycontentId187),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 187",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject187')._huntingQuerycontentId187)]",
-                "contentId": "[variables('huntingQueryObject187')._huntingQuerycontentId187]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject187').huntingQueryVersion187]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject187')._huntingQuerycontentId187]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Personalized campaigns based on the last few keywords",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject187')._huntingQuerycontentId187,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject187')._huntingQuerycontentId187,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject188').huntingQueryTemplateSpecName188]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Risky sign-in attempt from a non-managed device_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject188').huntingQueryVersion188]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_188",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Risky sign-in attempt from a non-managed device",
-                "category": "Hunting Queries",
-                "query": "AADSignInEventsBeta\n| where Timestamp > ago(7d)\n| where IsManaged != 1\n| where IsCompliant != 1\n//Filtering only for medium and high risk sign-in\n| where RiskLevelDuringSignIn in (50, 100)\n| where ClientAppUsed == \"Browser\"\n| where isempty(DeviceTrustType)\n| where isnotempty(State) or isnotempty(Country) or isnotempty(City)\n| where isnotempty(IPAddress)\n| where isnotempty(AccountObjectId)\n| where isempty(DeviceName)\n| where isempty(AadDeviceId)\n| project Timestamp,IPAddress, AccountObjectId, ApplicationId, SessionId, RiskLevelDuringSignIn\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject188')._huntingQuerycontentId188),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 188",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject188')._huntingQuerycontentId188)]",
-                "contentId": "[variables('huntingQueryObject188')._huntingQuerycontentId188]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject188').huntingQueryVersion188]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject188')._huntingQuerycontentId188]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Risky sign-in attempt from a non-managed device",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject188')._huntingQuerycontentId188,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject188')._huntingQuerycontentId188,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject189').huntingQueryTemplateSpecName189]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Suspicious sign-in attempts from QR code phishing campaigns_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject189').huntingQueryVersion189]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_189",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Suspicious sign-in attempts from QR code phishing campaigns",
-                "category": "Hunting Queries",
-                "query": "let successfulRiskySignIn = materialize(AADSignInEventsBeta\n| where Timestamp > ago(1d)\n| where isempty(DeviceTrustType)\n| where IsManaged != 1\n| where IsCompliant != 1\n| where RiskLevelDuringSignIn in (50, 100)\n| project Timestamp, ReportId, IPAddress, AccountUpn, AccountObjectId, SessionId, Country, State, City\n);\nlet suspiciousSignInUsers = successfulRiskySignIn\n| distinct AccountObjectId;\nlet suspiciousSignInIPs = successfulRiskySignIn\n| distinct IPAddress;\nlet suspiciousSignInCities = successfulRiskySignIn\n| distinct City;\nCloudAppEvents\n| where Timestamp > ago(1d)\n| where ActionType == \"MailItemsAccessed\"\n| where AccountObjectId in (suspiciousSignInUsers)\n| where IPAddress !in (suspiciousSignInIPs)\n| where City !in (suspiciousSignInCities)\n| join kind=inner successfulRiskySignIn on AccountObjectId\n| where AccountObjectId in (suspiciousSignInUsers)\n| where (Timestamp - Timestamp1) between (-5min .. 5min)\n| extend folders = RawEventData.Folders\n| mv-expand folders\n| extend items = folders.FolderItems\n| mv-expand items\n| extend InternetMessageId = tostring(items.InternetMessageId)\n| project Timestamp, ReportId, IPAddress, InternetMessageId, AccountObjectId, SessionId, Country, State, City\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject189')._huntingQuerycontentId189),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 189",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject189')._huntingQuerycontentId189)]",
-                "contentId": "[variables('huntingQueryObject189')._huntingQuerycontentId189]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject189').huntingQueryVersion189]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject189')._huntingQuerycontentId189]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Suspicious sign-in attempts from QR code phishing campaigns",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject189')._huntingQuerycontentId189,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject189')._huntingQuerycontentId189,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject190').huntingQueryTemplateSpecName190]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Group quarantine release_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject190').huntingQueryVersion190]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_190",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Group quarantine release",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"QuarantineReleaseMessage\"\n| extend parsed=parse_json(RawEventData)\n| extend NetworkMessageId = tostring(parsed.NetworkMessageId)\n| join EmailEvents on NetworkMessageId\n| summarize count() by DetectionMethods\n| order by count_ desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject190')._huntingQuerycontentId190),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 190",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject190')._huntingQuerycontentId190)]",
-                "contentId": "[variables('huntingQueryObject190')._huntingQuerycontentId190]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject190').huntingQueryVersion190]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject190')._huntingQuerycontentId190]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Group quarantine release",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject190')._huntingQuerycontentId190,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject190')._huntingQuerycontentId190,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject191').huntingQueryTemplateSpecName191]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "High Confidence Phish Released_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject191').huntingQueryVersion191]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_191",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "High Confidence Phish Released",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"QuarantineReleaseMessage\"\n| project ReleaseTime = Timestamp, ResultStatus = RawEventData.ResultStatus, ActionType, ReleasedBy = tostring(RawEventData.UserId), NetworkMessageId = tostring(RawEventData.NetworkMessageId), ReleaseTo = RawEventData.ReleaseTo\n| join kind=inner (\n  EmailEvents\n  | where todynamic(ConfidenceLevel).Phish == \"High\"\n  | project-rename EmailTime = Timestamp\n  ) on NetworkMessageId\n| project-away NetworkMessageId1\n| order by ReleaseTime asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query shows information about high confidence phish email that has been released from the Quarantine."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject191')._huntingQuerycontentId191),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 191",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject191')._huntingQuerycontentId191)]",
-                "contentId": "[variables('huntingQueryObject191')._huntingQuerycontentId191]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject191').huntingQueryVersion191]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject191')._huntingQuerycontentId191]",
-        "contentKind": "HuntingQuery",
-        "displayName": "High Confidence Phish Released",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject191')._huntingQuerycontentId191,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject191')._huntingQuerycontentId191,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject192').huntingQueryTemplateSpecName192]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Quarantine Phish reason trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject192').huntingQueryVersion192]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_192",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Quarantine Phish Reason trend",
-                "category": "Hunting Queries",
-                "query": "let minTime = startofday(ago(30d));\nlet maxTime = startofday(now());\nEmailEvents\n| where Timestamp >= minTime\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Phish\" and DeliveryLocation == \"Quarantine\"\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(Details)\n| where Timestamp < maxTime\n| make-series Count = count() default = 0 on Timestamp from minTime to maxTime step 1d by Details\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject192')._huntingQuerycontentId192),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 192",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject192')._huntingQuerycontentId192)]",
-                "contentId": "[variables('huntingQueryObject192')._huntingQuerycontentId192]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject192').huntingQueryVersion192]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject192')._huntingQuerycontentId192]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Quarantine Phish Reason trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject192')._huntingQuerycontentId192,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject192')._huntingQuerycontentId192,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject193').huntingQueryTemplateSpecName193]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Quarantine Phish reason_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject193').huntingQueryVersion193]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_193",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Quarantine Phish Reason",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish' and DeliveryLocation == \"Quarantine\"\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(Phish)\n| summarize count() by Phish\n| sort by count_ desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total amount of phish emails that are quarantined, summarized by the detection method"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject193')._huntingQuerycontentId193),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 193",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject193')._huntingQuerycontentId193)]",
-                "contentId": "[variables('huntingQueryObject193')._huntingQuerycontentId193]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject193').huntingQueryVersion193]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject193')._huntingQuerycontentId193]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Quarantine Phish Reason",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject193')._huntingQuerycontentId193,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject193')._huntingQuerycontentId193,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject194').huntingQueryTemplateSpecName194]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Quarantine Release Email Details_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject194').huntingQueryVersion194]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_194",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Quarantine Release Email Details",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"QuarantineReleaseMessage\"\n| project ReleaseTime = Timestamp, ResultStatus = RawEventData.ResultStatus, ActionType, ReleasedBy = tostring(RawEventData.UserId), NetworkMessageId = tostring(RawEventData.NetworkMessageId), ReleaseTo = RawEventData.ReleaseTo\n| join kind=inner (\n  EmailEvents\n  | project-rename EmailTime = Timestamp\n  ) on NetworkMessageId\n| project-away NetworkMessageId1\n| order by ReleaseTime asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query shows information about email that has been released from the Quarantine in Defender for Office 365."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject194')._huntingQuerycontentId194),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 194",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject194')._huntingQuerycontentId194)]",
-                "contentId": "[variables('huntingQueryObject194')._huntingQuerycontentId194]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject194').huntingQueryVersion194]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject194')._huntingQuerycontentId194]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Quarantine Release Email Details",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject194')._huntingQuerycontentId194,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject194')._huntingQuerycontentId194,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject195').huntingQueryTemplateSpecName195]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Quarantine release trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject195').huntingQueryVersion195]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_195",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Quarantine release trend",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"QuarantineReleaseMessage\"\n| summarize count() by bin(Timestamp, 1d)\n| project-rename Releases = count_\n| render timechart with (title=\"Quarantine Releases by Day\")\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing quarantine release trend in Defender for Office 365"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject195')._huntingQuerycontentId195),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 195",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject195')._huntingQuerycontentId195)]",
-                "contentId": "[variables('huntingQueryObject195')._huntingQuerycontentId195]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject195').huntingQueryVersion195]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject195')._huntingQuerycontentId195]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Quarantine release trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject195')._huntingQuerycontentId195,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject195')._huntingQuerycontentId195,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject196').huntingQueryTemplateSpecName196]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Quarantine releases by Detection types_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject196').huntingQueryVersion196]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_196",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Quarantine releases by Detection Types",
-                "category": "Hunting Queries",
-                "query": "let totalQuery = EmailPostDeliveryEvents\n| where Action == \"Quarantine release\"\n| join kind=inner (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\n| extend MDO_detection = parse_json(DetectionMethods1)\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\n| count;\nEmailPostDeliveryEvents\n| where Action == \"Quarantine release\"\n| join kind=inner (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\n| extend MDO_detection = parse_json(DetectionMethods1)\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\n| summarize count_messages = count() by FirstSubcategory\n| project FirstSubcategory, count_messages\n| order by count_messages desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails released from quarantine and summarizing the result by the original filter verdict"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject196')._huntingQuerycontentId196),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 196",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject196')._huntingQuerycontentId196)]",
-                "contentId": "[variables('huntingQueryObject196')._huntingQuerycontentId196]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject196').huntingQueryVersion196]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject196')._huntingQuerycontentId196]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Quarantine releases by Detection Types",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject196')._huntingQuerycontentId196,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject196')._huntingQuerycontentId196,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject197').huntingQueryTemplateSpecName197]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Quarantine Spam reason trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject197').huntingQueryVersion197]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_197",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Quarantine Spam Reason trend",
-                "category": "Hunting Queries",
-                "query": "let minTime = startofday(ago(30d));\nlet maxTime = startofday(now());\nEmailEvents\n| where Timestamp >= minTime\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Spam\" and DeliveryLocation == \"Quarantine\"\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\n| where isnotempty(Details)\n| where Timestamp < maxTime\n| make-series Count = count() default = 0 on Timestamp from minTime to maxTime step 1d by Details\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject197')._huntingQuerycontentId197),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 197",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject197')._huntingQuerycontentId197)]",
-                "contentId": "[variables('huntingQueryObject197')._huntingQuerycontentId197]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject197').huntingQueryVersion197]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject197')._huntingQuerycontentId197]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Quarantine Spam Reason trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject197')._huntingQuerycontentId197,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject197')._huntingQuerycontentId197,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject198').huntingQueryTemplateSpecName198]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Quarantine Spam reason_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject198').huntingQueryVersion198]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_198",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Quarantine Spam Reason",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam' and DeliveryLocation == \"Quarantine\"\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\n| where isnotempty(Spam)\n| summarize count() by Spam\n| sort by count_ desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total amount of spam emails that are quarantined, summarized by the detection method"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject198')._huntingQuerycontentId198),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 198",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject198')._huntingQuerycontentId198)]",
-                "contentId": "[variables('huntingQueryObject198')._huntingQuerycontentId198]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject198').huntingQueryVersion198]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject198')._huntingQuerycontentId198]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Quarantine Spam Reason",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject198')._huntingQuerycontentId198,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject198')._huntingQuerycontentId198,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject199').huntingQueryTemplateSpecName199]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AIR investigation actions insight_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject199').huntingQueryVersion199]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_199",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "AIR investigation actions insight",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AirInvestigationData\"\n| project Timestamp, RawEventData\n| extend EventData = parse_json(RawEventData)\n| extend Data = parse_json(tostring(EventData.Data))\n| extend InvestigationType = EventData.InvestigationType\n| extend InvestigationId = RawEventData.InvestigationId\n| extend Status = tostring(Data.Status)\n| where Status == \"Resolved\"\n| extend ActionRaw = parse_json(tostring(EventData.Actions))\n| mv-expand ActionRaw\n| extend Action = parse_json(tostring(ActionRaw))\n| extend ActionType=Action.ActionType, ActionApproval=Action.ActionApproval, ApprovedBy=Action.ApprovedBy, ApproverComment=Action.ApproverComment, ActionStatus=Action.ActionStatus\n| mv-expand Action.Entities\n| extend EntityQuery = Action_Entities.Query\n| mv-expand Action_Entities.Urls, Action_Entities.NetworkMessageIds\n| sort by Timestamp\n| project Timestamp, InvestigationType, InvestigationId, ActionType, ActionApproval, ApprovedBy, ApproverComment, ActionStatus, EntityQuery, Action_Entities_Urls, Action_Entities_NetworkMessageIds\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query provides insights into AIR investigation actions in Microsoft Defender for Office 365."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject199')._huntingQuerycontentId199),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 199",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject199')._huntingQuerycontentId199)]",
-                "contentId": "[variables('huntingQueryObject199')._huntingQuerycontentId199]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject199').huntingQueryVersion199]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject199')._huntingQuerycontentId199]",
-        "contentKind": "HuntingQuery",
-        "displayName": "AIR investigation actions insight",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject199')._huntingQuerycontentId199,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject199')._huntingQuerycontentId199,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject200').huntingQueryTemplateSpecName200]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Email remediation action list_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject200').huntingQueryVersion200]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_200",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Listing Email Remediation Actions via Explorer",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where LatestDeliveryAction in (\"Hard delete\", \"Soft delete\", \"Moved to junk folder\", \"Moved to deleted items\")\n| summarize HardDelete_NetworkID = make_list_if(strcat(NetworkMessageId, @\"\\\", Timestamp,@\"\\\", Subject), LatestDeliveryAction == \"Hard delete\"),  \n            SoftDelete_NetworkID = make_list_if(strcat(NetworkMessageId, @\"\\\", Timestamp,@\"\\\", Subject), LatestDeliveryAction == \"Soft delete\"),\n            MoveToJunk_NetworkID = make_list_if(strcat(NetworkMessageId, @\"\\\", Timestamp,@\"\\\", Subject), LatestDeliveryAction == \"Moved to junk folder\"),\n            MoveToDelete_NetworkID = make_list_if(strcat(NetworkMessageId, @\"\\\", Timestamp,@\"\\\", Subject), LatestDeliveryAction == \"Moved to deleted items\") by RecipientEmailAddress\n| extend HardDelete_case = array_length(HardDelete_NetworkID)\n| extend SoftDelete_case = array_length(SoftDelete_NetworkID)\n| extend MoveToJunk_case = array_length(MoveToJunk_NetworkID)\n| extend MoveToDelete_case = array_length(MoveToDelete_NetworkID)\n| extend Sum_case = HardDelete_case + SoftDelete_case + MoveToJunk_case + MoveToDelete_case\n| project RecipientEmailAddress, Sum_case, HardDelete_case, SoftDelete_case, MoveToJunk_case, MoveToDelete_case, HardDelete_NetworkID, SoftDelete_NetworkID, MoveToJunk_NetworkID, MoveToDelete_NetworkID\n| order by Sum_case desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Listing Email Remediation Actions performed via Explorer in Defender for Office 365"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject200')._huntingQuerycontentId200),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 200",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject200')._huntingQuerycontentId200)]",
-                "contentId": "[variables('huntingQueryObject200')._huntingQuerycontentId200]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject200').huntingQueryVersion200]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject200')._huntingQuerycontentId200]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Listing Email Remediation Actions via Explorer",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject200')._huntingQuerycontentId200,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject200')._huntingQuerycontentId200,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject201').huntingQueryTemplateSpecName201]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Bulk Detection Top10 Domains_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject201').huntingQueryVersion201]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_201",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 domains sending Bulk email",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\" and isnotempty(BulkComplaintLevel)\n| summarize count() by BulkComplaintLevel, SenderFromDomain\n| top 10 by count_\n| project SenderFromDomain, BulkComplaintLevel, Emails = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total inbound emails which has any Bulk complaint level."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject201')._huntingQuerycontentId201),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 201",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject201')._huntingQuerycontentId201)]",
-                "contentId": "[variables('huntingQueryObject201')._huntingQuerycontentId201]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject201').huntingQueryVersion201]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject201')._huntingQuerycontentId201]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 domains sending Bulk email",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject201')._huntingQuerycontentId201,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject201')._huntingQuerycontentId201,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject202').huntingQueryTemplateSpecName202]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection Delivery Location_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject202').huntingQueryVersion202]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_202",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam detection by delivery location",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where DetectionMethods has \"Spam\" and EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| make-series TotalSpamDetections=count(),Quarantine = countif(DeliveryLocation == \"Quarantine\"),Junkfolder=countif(DeliveryLocation == \"Junk folder\"),Inbox=countif(DeliveryLocation == \"Inbox/folder\"),Failed=countif(DeliveryLocation == \"Failed\"),Dropped=countif(DeliveryLocation == \"Dropped\") default = 0 on Timestamp step 1d\n// | render timechart // Uncomment this line to render as a graph\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject202')._huntingQuerycontentId202),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 202",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject202')._huntingQuerycontentId202)]",
-                "contentId": "[variables('huntingQueryObject202')._huntingQuerycontentId202]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject202').huntingQueryVersion202]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject202')._huntingQuerycontentId202]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam detection by delivery location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject202')._huntingQuerycontentId202,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject202')._huntingQuerycontentId202,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject203').huntingQueryTemplateSpecName203]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject203').huntingQueryVersion203]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_203",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam detection by IP and its location",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6).\nlet ipv4position = EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\" and SenderIPv4 != \"\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderIPv4\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude), Country = tostring(GeoInfo.country)\n| project SenderIPv4, Country, Latitude, Longitude, count_;\nlet ipv6position = EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\" and SenderIPv6 != \"\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderIPv6\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv6)\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude), Country = tostring(GeoInfo.country)\n| project SenderIPv6, Country, Latitude, Longitude, count_;\nipv4position\n| union ipv6position\n| project SenderIPv6, SenderIPv4, Country, Latitude, Longitude, count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject203')._huntingQuerycontentId203),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 203",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject203')._huntingQuerycontentId203)]",
-                "contentId": "[variables('huntingQueryObject203')._huntingQuerycontentId203]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject203').huntingQueryVersion203]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject203')._huntingQuerycontentId203]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam detection by IP and its location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject203')._huntingQuerycontentId203,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject203')._huntingQuerycontentId203,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject204').huntingQueryTemplateSpecName204]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection Mails with BCL_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject204').huntingQueryVersion204]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_204",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Bulk Emails by Sender Bulk Complaint level",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\" and isnotempty(BulkComplaintLevel)\n| summarize count() by BulkComplaintLevel\n| sort by BulkComplaintLevel desc\n| project BulkComplaintLevel, Emails = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total inbound emails which has any Bulk complaint level."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject204')._huntingQuerycontentId204),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 204",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject204')._huntingQuerycontentId204)]",
-                "contentId": "[variables('huntingQueryObject204')._huntingQuerycontentId204]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject204').huntingQueryVersion204]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject204')._huntingQuerycontentId204]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Bulk Emails by Sender Bulk Complaint level",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject204')._huntingQuerycontentId204,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject204')._huntingQuerycontentId204,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject205').huntingQueryTemplateSpecName205]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection Tech_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject205').huntingQueryVersion205]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_205",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam detection technologies",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls in Microsoft Defender for Office 365.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where DetectionMethods has 'Spam'\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| project Timestamp, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) | summarize count() by Spam=tostring(column_ifexists('Spam', ''))\n| sort by count_\n// | render piechart  // Uncomment this line to render as a graph\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject205')._huntingQuerycontentId205),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 205",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject205')._huntingQuerycontentId205)]",
-                "contentId": "[variables('huntingQueryObject205')._huntingQuerycontentId205]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject205').huntingQueryVersion205]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject205')._huntingQuerycontentId205]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam detection technologies",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject205')._huntingQuerycontentId205,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject205')._huntingQuerycontentId205,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject206').huntingQueryTemplateSpecName206]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection Top10 Domains_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject206').huntingQueryVersion206]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_206",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email Top 10 Domains sending Spam",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain).\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\n| extend Bad_Traffic_Percentage_Inbound = round(100.0 * SpamEmailCount / TotalEmailCount, 2)\n| where SpamEmailCount != 0\n| top 10 by SpamEmailCount\n| project SenderFromDomain, SpamEmailCount, TotalEmailCount, Bad_Traffic_Percentage_Inbound\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total inbound emails with Spam detections."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject206')._huntingQuerycontentId206),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 206",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject206')._huntingQuerycontentId206)]",
-                "contentId": "[variables('huntingQueryObject206')._huntingQuerycontentId206]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject206').huntingQueryVersion206]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject206')._huntingQuerycontentId206]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email Top 10 Domains sending Spam",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject206')._huntingQuerycontentId206,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject206')._huntingQuerycontentId206,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject207').huntingQueryTemplateSpecName207]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection Top10 Users_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject207').huntingQueryVersion207]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_207",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email Top 10 Targeted Users (Spam)",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 10 recipient email address (RecipientEmailAddress).\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\" and EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by RecipientEmailAddress\n| top 10 by count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises top 10 users targeted with Spam."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject207')._huntingQuerycontentId207),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 207",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject207')._huntingQuerycontentId207)]",
-                "contentId": "[variables('huntingQueryObject207')._huntingQuerycontentId207]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject207').huntingQueryVersion207]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject207')._huntingQuerycontentId207]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email Top 10 Targeted Users (Spam)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject207')._huntingQuerycontentId207,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject207')._huntingQuerycontentId207,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject208').huntingQueryTemplateSpecName208]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection Top15 Domains Details_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject208').huntingQueryVersion208]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_208",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email Top 15 Domains sending Spam with Additional Details",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(),\n            SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where SpamEmailCount != 0\n| top 15 by SpamEmailCount\n| project SenderFromDomain, SpamEmailCount, TotalEmailCount, Bad_Traffic_Percentage_Inbound\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject208')._huntingQuerycontentId208),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 208",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject208')._huntingQuerycontentId208)]",
-                "contentId": "[variables('huntingQueryObject208')._huntingQuerycontentId208]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject208').huntingQueryVersion208]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject208')._huntingQuerycontentId208]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email Top 15 Domains sending Spam with Additional Details",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject208')._huntingQuerycontentId208,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject208')._huntingQuerycontentId208,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject209').huntingQueryTemplateSpecName209]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection Top15 Users Details_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject209').huntingQueryVersion209]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_209",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Email Top 15 Targeted Users (Spam) with Additional Details",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), SpamEmailCount = countif(ThreatTypes has \"Spam\") by RecipientEmailAddress\n| extend Bad_Traffic_Percentage_Inbound = round(100.0 * SpamEmailCount / TotalEmailCount, 2)\n| where SpamEmailCount != 0\n| top 15 by SpamEmailCount\n| project RecipientEmailAddress, SpamEmailCount, TotalEmailCount, Bad_Traffic_Percentage_Inbound\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises top 15 users targeted with Spam with summarized spam detections."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject209')._huntingQuerycontentId209),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 209",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject209')._huntingQuerycontentId209)]",
-                "contentId": "[variables('huntingQueryObject209')._huntingQuerycontentId209]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject209').huntingQueryVersion209]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject209')._huntingQuerycontentId209]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Email Top 15 Targeted Users (Spam) with Additional Details",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject209')._huntingQuerycontentId209,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject209')._huntingQuerycontentId209,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject210').huntingQueryTemplateSpecName210]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detection Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject210').huntingQueryVersion210]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_210",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam detection trend",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total emails with Spam detections over time summarizing the data daily.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| make-series Count = count() default = 0 on Timestamp step 1d\n// | render timechart // Uncomment this line to render as a graph\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spam detections over time summarizing the data daily"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject210')._huntingQuerycontentId210),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 210",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject210')._huntingQuerycontentId210)]",
-                "contentId": "[variables('huntingQueryObject210')._huntingQuerycontentId210]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject210').huntingQueryVersion210]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject210')._huntingQuerycontentId210]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam detection trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject210')._huntingQuerycontentId210,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject210')._huntingQuerycontentId210,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject211').huntingQueryTemplateSpecName211]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detections by Detection technology_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject211').huntingQueryVersion211]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_211",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam Detections by Detection technology",
-                "category": "Hunting Queries",
-                "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\n//(v4) Single mv-expand over DetectionMethods.Spam replaces the previous 8-way union: less scan, and new spam techniques appear automatically.\nlet minTime = startofday(ago(30d));\nlet maxTime = startofday(now());\nEmailEvents\n| where Timestamp >= minTime\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where DetectionMethods has \"Spam\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\n| where Timestamp < maxTime\n| make-series Count = count() default = 0 on Timestamp from minTime to maxTime step 1d by Details\n// | render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject211')._huntingQuerycontentId211),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 211",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject211')._huntingQuerycontentId211)]",
-                "contentId": "[variables('huntingQueryObject211')._huntingQuerycontentId211]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject211').huntingQueryVersion211]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject211')._huntingQuerycontentId211]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam Detections by Detection technology",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject211')._huntingQuerycontentId211,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject211')._huntingQuerycontentId211,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject212').huntingQueryTemplateSpecName212]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Display Name - Spoof and Impersonation_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject212').huntingQueryVersion212]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_212",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Display Name - Spoof and Impersonation",
-                "category": "Hunting Queries",
-                "query": "let emailDelivered = EmailEvents\n| where Timestamp < ago(24hrs)\nand DeliveryAction == \"Delivered\"\nand SenderDisplayName contains \"Microsoft\"\n| summarize count() by SenderFromAddress\n| where count_ > 3 // ensuring that some level of communications has occurred.\n| project SenderFromAddress;\nEmailEvents\n| where Timestamp > ago(24hrs)\n| where DeliveryAction == \"Delivered\"\nand EmailDirection == \"Inbound\"\nand OrgLevelAction != \"Block\"\nand UserLevelAction != \"Block\"\nand SenderDisplayName contains \"Microsoft\"\n| extend NewMsg = case(Subject contains \"RE:\", false, Subject contains \"FW:\", false, true )\n| project SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject\n| join kind=leftanti  ( emailDelivered ) on SenderFromAddress\n| order by SenderMailFromAddress\n| summarize count() by SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject212')._huntingQuerycontentId212),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 212",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject212')._huntingQuerycontentId212)]",
-                "contentId": "[variables('huntingQueryObject212')._huntingQuerycontentId212]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject212').huntingQueryVersion212]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject212')._huntingQuerycontentId212]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Display Name - Spoof and Impersonation",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject212')._huntingQuerycontentId212,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject212')._huntingQuerycontentId212,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject213').huntingQueryTemplateSpecName213]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Impersonation Phishing detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject213').huntingQueryVersion213]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_213",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Impersonation Detections by Detection Technology Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = EmailEvents\n| where DetectionMethods has \"Phish\";\nlet bimp=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Impersonation brand' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Impersonation brand\";\nlet dimp=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Impersonation domain' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Impersonation domain\";\nlet uimp=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Impersonation user' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Impersonation user\";\nlet mimp=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Mailbox intelligence impersonation' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Mailbox intelligence impersonation\";\nunion bimp,dimp,uimp,mimp\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject213')._huntingQuerycontentId213),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 213",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject213')._huntingQuerycontentId213)]",
-                "contentId": "[variables('huntingQueryObject213')._huntingQuerycontentId213]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject213').huntingQueryVersion213]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject213')._huntingQuerycontentId213]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Impersonation Detections by Detection Technology Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject213')._huntingQuerycontentId213,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject213')._huntingQuerycontentId213,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject214').huntingQueryTemplateSpecName214]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Impersonation Phishing detections by Detection Technology_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject214').huntingQueryVersion214]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_214",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Impersonation Detections by Detection Technology",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has 'Impersonation'\n| project Timestamp, DT=parse_json(DetectionMethods)\n| evaluate bag_unpack(DT)\n| summarize count() by Phish=tostring(column_ifexists('Phish', ''))\n| sort by count_ desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject214')._huntingQuerycontentId214),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 214",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject214')._huntingQuerycontentId214)]",
-                "contentId": "[variables('huntingQueryObject214')._huntingQuerycontentId214]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject214').huntingQueryVersion214]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject214')._huntingQuerycontentId214]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Impersonation Detections by Detection Technology",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject214')._huntingQuerycontentId214,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject214')._huntingQuerycontentId214,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject215').huntingQueryTemplateSpecName215]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Impersonation Phishing detections trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject215').huntingQueryVersion215]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_215",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Impersonation Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents \n| where DetectionMethods has 'Impersonation' \n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"ImpersonatedEmails\"\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish (BEC) - Impersonation detections over time."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject215')._huntingQuerycontentId215),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 215",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject215')._huntingQuerycontentId215)]",
-                "contentId": "[variables('huntingQueryObject215')._huntingQuerycontentId215]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject215').huntingQueryVersion215]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject215')._huntingQuerycontentId215]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Impersonation Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject215')._huntingQuerycontentId215,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject215')._huntingQuerycontentId215,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject216').huntingQueryTemplateSpecName216]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Referral phish emails_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject216').huntingQueryVersion216]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_216",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "referral-phish-emails",
-                "category": "Hunting Queries",
-                "query": "let EmailAddresses = pack_array\n('zreffertalt.com.com','zreffesral.com.com','kzreffertal.com.com',\n'wzreffertal.com.com','refferal.comq','refferal.net','zreffertal.com.com',\n'zrefferal.com.com','refferasl.com.com','zreffesral.com','zrefsfertal.com.com',\n'irefferal.com','refferasl.co','zrefferal.com');\nEmailEvents\n| where SenderMailFromDomain in (EmailAddresses)\n| extend RecipientDomain = extract(\"[^@]+$\", 0, RecipientEmailAddress)\n| where SenderFromDomain == RecipientDomain\n| join EmailUrlInfo on $left.NetworkMessageId == $right.NetworkMessageId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Hunting for credential phishing using the \"Referral\" infrastructure using Defender for Office 365 data"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject216')._huntingQuerycontentId216),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 216",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject216')._huntingQuerycontentId216)]",
-                "contentId": "[variables('huntingQueryObject216')._huntingQuerycontentId216]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject216').huntingQueryVersion216]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject216')._huntingQuerycontentId216]",
-        "contentKind": "HuntingQuery",
-        "displayName": "referral-phish-emails",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject216')._huntingQuerycontentId216,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject216')._huntingQuerycontentId216,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject217').huntingQueryTemplateSpecName217]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spoof and impersonation detections by sender IP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject217').huntingQueryVersion217]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_217",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spoof and impersonation detections by sender IP",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n|where Timestamp > ago (30d) and (DetectionMethods contains 'spoof' or DetectionMethods contains \"impersonation\")  \n| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \n| summarize count() by SenderIPv4\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing count of spoof and impersonation detections done per sender IP"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject217')._huntingQuerycontentId217),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 217",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject217')._huntingQuerycontentId217)]",
-                "contentId": "[variables('huntingQueryObject217')._huntingQuerycontentId217]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject217').huntingQueryVersion217]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject217')._huntingQuerycontentId217]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spoof and impersonation detections by sender IP",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject217')._huntingQuerycontentId217,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject217')._huntingQuerycontentId217,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject218').huntingQueryTemplateSpecName218]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spoof and impersonation phish detections_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject218').huntingQueryVersion218]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_218",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spoof and impersonation phish detections",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n|where Timestamp > ago (30d) and (DetectionMethods contains 'spoof' or DetectionMethods contains \"impersonation\")\n| project Timestamp, AR=parse_json(ThreatTypes) , DT=parse_json(DetectionMethods), EmailDirection, SenderFromAddress\n| evaluate bag_unpack(DT)\n| summarize count() by tostring(Phish)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing count of phish detections done by spoof detection methods"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject218')._huntingQuerycontentId218),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 218",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject218')._huntingQuerycontentId218)]",
-                "contentId": "[variables('huntingQueryObject218')._huntingQuerycontentId218]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject218').huntingQueryVersion218]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject218')._huntingQuerycontentId218]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spoof and impersonation phish detections",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject218')._huntingQuerycontentId218,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject218')._huntingQuerycontentId218,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject219').huntingQueryTemplateSpecName219]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spoof detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject219').huntingQueryVersion219]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_219",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spoof Detections by Detection Technology Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = EmailEvents\n| where DetectionMethods has \"Phish\";\nlet sdmarc=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Spoof DMARC' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Spoof DMARC\";\nlet spoofe=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Spoof external domain' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Spoof external domain\";\nlet spoofi=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Spoof intra-org' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Spoof intra-org\";\nunion sdmarc, spoofe, spoofi\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology over time"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject219')._huntingQuerycontentId219),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 219",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject219')._huntingQuerycontentId219)]",
-                "contentId": "[variables('huntingQueryObject219')._huntingQuerycontentId219]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject219').huntingQueryVersion219]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject219')._huntingQuerycontentId219]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spoof Detections by Detection Technology Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject219')._huntingQuerycontentId219,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject219')._huntingQuerycontentId219,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject220').huntingQueryTemplateSpecName220]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spoof detections by Detection Technology_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject220').huntingQueryVersion220]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_220",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spoof Detections by Detection Technology",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has 'Spoof'\n| project Timestamp, DT=parse_json(DetectionMethods)\n| evaluate bag_unpack(DT)\n| summarize count() by Phish=tostring(column_ifexists('Phish', ''))\n| sort by count_ desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject220')._huntingQuerycontentId220),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 220",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject220')._huntingQuerycontentId220)]",
-                "contentId": "[variables('huntingQueryObject220')._huntingQuerycontentId220]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject220').huntingQueryVersion220]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject220')._huntingQuerycontentId220]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spoof Detections by Detection Technology",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject220')._huntingQuerycontentId220,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject220')._huntingQuerycontentId220,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject221').huntingQueryTemplateSpecName221]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spoof detections trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject221').huntingQueryVersion221]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_221",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spoof Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents \n| where DetectionMethods has 'Spoof' \n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"SpoofEmails\"\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject221')._huntingQuerycontentId221),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 221",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject221')._huntingQuerycontentId221)]",
-                "contentId": "[variables('huntingQueryObject221')._huntingQuerycontentId221]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject221').huntingQueryVersion221]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject221')._huntingQuerycontentId221]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spoof Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject221')._huntingQuerycontentId221,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject221')._huntingQuerycontentId221,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject222').huntingQueryTemplateSpecName222]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Domains with BEC Threats inbound_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject222').huntingQueryVersion222]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_222",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Domains Outbound with Emails with Threats Inbound (Partner BEC)",
-                "category": "Hunting Queries",
-                "query": "// Partner BEC: domains we email heavily (outbound volume) that also send us threats (inbound).\n// The ratio is inbound threat emails per 100 outbound emails to the domain, so it can exceed 100.\nlet EmailDeduped = EmailEvents\n    | where Timestamp > ago(30d)\n    | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n    | summarize arg_max(Timestamp, *) by Key;\nEmailDeduped\n| where EmailDirection == \"Outbound\"\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\n| summarize count() by RecipientDomain\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\n| join (\n    EmailDeduped\n    | where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes)\n  ) on SenderFromDomain\n| summarize max(OutboundCount), count() by SenderFromDomain\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\n| extend InboundThreatsPer100Outbound = round(100.0 * IncomingEmailsWithThreats / OutboundEmails, 2)\n| top 15 by OutboundEmails\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject222')._huntingQuerycontentId222),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 222",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject222')._huntingQuerycontentId222)]",
-                "contentId": "[variables('huntingQueryObject222')._huntingQuerycontentId222]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject222').huntingQueryVersion222]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject222')._huntingQuerycontentId222]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Domains Outbound with Emails with Threats Inbound (Partner BEC)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject222')._huntingQuerycontentId222,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject222')._huntingQuerycontentId222,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject223').huntingQueryTemplateSpecName223]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User not covered under display name impersonation_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject223').huntingQueryVersion223]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_223",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User not covered under display name impersonation",
-                "category": "Hunting Queries",
-                "query": "let display_names = \nIdentityInfo \n  | summarize by AccountDisplayName \n  | project-rename  SenderDisplayName = AccountDisplayName; \nEmailEvents \n  | where EmailDirection == \"Inbound\" \n  | where ThreatNames != \"\" \n  | where ThreatNames !contains \"Impersonation User\" \n  | lookup kind=inner (display_names) on SenderDisplayName, $left.SenderDisplayName == $right.SenderDisplayName \n  | where SenderDisplayName != \"\" \n  | summarize by SenderDisplayName\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps to find threats using display name impersonation for users not already protected with User Impersonation"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject223')._huntingQuerycontentId223),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 223",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject223')._huntingQuerycontentId223)]",
-                "contentId": "[variables('huntingQueryObject223')._huntingQuerycontentId223]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject223').huntingQueryVersion223]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject223')._huntingQuerycontentId223]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User not covered under display name impersonation",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject223')._huntingQuerycontentId223,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject223')._huntingQuerycontentId223,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject224').huntingQueryTemplateSpecName224]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submission Trend - FN_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject224').huntingQueryVersion224]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_224",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submission Trend (FN)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = CloudAppEvents\n| where TimeGenerated >= TimeStart\n| where ActionType contains \"Submission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType);\nlet Admin_Malware_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Malware_FN\";\nlet Admin_Phish_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Phish_FN\";\nlet Admin_Spam_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Spam_FN\";\nlet Admin_Malware_URL_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Malware_URL_FN\";\nlet Admin_Malware_Attach_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Malware_Attach_FN\";\nlet Admin_Phish_URL_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Phish_URL_FN\";\nlet Admin_Phish_Attach_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Phish_Attach_FN\";\nunion Admin_Malware_FN,Admin_Phish_FN,Admin_Spam_FN,Admin_Malware_URL_FN,Admin_Malware_Attach_FN,Admin_Phish_URL_FN,Admin_Phish_Attach_FN\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of admin false negative submission by submission type."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject224')._huntingQuerycontentId224),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 224",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject224')._huntingQuerycontentId224)]",
-                "contentId": "[variables('huntingQueryObject224')._huntingQuerycontentId224]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject224').huntingQueryVersion224]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject224')._huntingQuerycontentId224]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submission Trend (FN)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject224')._huntingQuerycontentId224,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject224')._huntingQuerycontentId224,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject225').huntingQueryTemplateSpecName225]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submission Trend - FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject225').huntingQueryVersion225]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_225",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submission Trend (FP)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = CloudAppEvents\n| where TimeGenerated >= TimeStart\n| where ActionType contains \"Submission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType);\nlet Admin_Email_FP=baseQuery\n| make-series Count= countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Email_FP\";\nlet Admin_URL_FP=baseQuery\n| make-series Count= countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_URL_FP\";\nlet Admin_Attach_FP=baseQuery\n| make-series Count= countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Attach_FP\";\nunion Admin_Email_FP,Admin_URL_FP,Admin_Attach_FP\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of admin false positive submission by submission type."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject225')._huntingQuerycontentId225),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 225",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject225')._huntingQuerycontentId225)]",
-                "contentId": "[variables('huntingQueryObject225')._huntingQuerycontentId225]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject225').huntingQueryVersion225]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject225')._huntingQuerycontentId225]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submission Trend (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject225')._huntingQuerycontentId225,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject225')._huntingQuerycontentId225,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject226').huntingQueryTemplateSpecName226]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submissions by Detection Method - Phish FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject226').huntingQueryVersion226]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_226",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submissions by DetectionMethod (Phish FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Admin_Email_FP\",\n\"Other\"),DetectionMethod=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdictControlSource),\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict ==\"Phish\"\n| summarize count() by DetectionMethod\n| project DetectionMethod,Emails = count_\n// | render piechart // Uncomment this line to render as a graph\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the original detection technology of emails submitted as phish false positive by admins"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject226')._huntingQuerycontentId226),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 226",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject226')._huntingQuerycontentId226)]",
-                "contentId": "[variables('huntingQueryObject226')._huntingQuerycontentId226]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject226').huntingQueryVersion226]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject226')._huntingQuerycontentId226]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submissions by DetectionMethod (Phish FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject226')._huntingQuerycontentId226,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject226')._huntingQuerycontentId226,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject227').huntingQueryTemplateSpecName227]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submissions by Detection Method - Spam FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject227').huntingQueryVersion227]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_227",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submissions by DetectionMethod (Spam FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Admin_Email_FP\",\n\"Other\"),DetectionMethod=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdictControlSource),\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict ==\"Spam\" \n| summarize count() by DetectionMethod\n| project DetectionMethod,Emails = count_\n// | render piechart // Uncomment this line to render as a graph\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the original detection technology of emails submitted as spam false positive by admins"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject227')._huntingQuerycontentId227),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 227",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject227')._huntingQuerycontentId227)]",
-                "contentId": "[variables('huntingQueryObject227')._huntingQuerycontentId227]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject227').huntingQueryVersion227]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject227')._huntingQuerycontentId227]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submissions by DetectionMethod (Spam FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject227')._huntingQuerycontentId227,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject227')._huntingQuerycontentId227,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject228').huntingQueryTemplateSpecName228]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submissions by Detection Type_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject228').huntingQueryVersion228]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_228",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submissions by Detection Type",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Admin_Email_FP\",\n\"Other\"),\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\n| project PolicyOverride, DetectionVerdict,Admin_SubmissionType, Emails = count_\n| top 10 by Emails desc\n// | render piechart // Uncomment this line to render as a graph\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject228')._huntingQuerycontentId228),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 228",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject228')._huntingQuerycontentId228)]",
-                "contentId": "[variables('huntingQueryObject228')._huntingQuerycontentId228]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject228').huntingQueryVersion228]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject228')._huntingQuerycontentId228]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submissions by Detection Type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject228')._huntingQuerycontentId228,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject228')._huntingQuerycontentId228,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject229').huntingQueryTemplateSpecName229]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submissions by Grading Verdict - FN-FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject229').huntingQueryVersion229]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_229",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submissions by Grading verdict (FN-FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType contains \"AdminSubmissionTriage\"\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict\n| summarize count() by tostring(TriageVerdict)\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject229')._huntingQuerycontentId229),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 229",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject229')._huntingQuerycontentId229)]",
-                "contentId": "[variables('huntingQueryObject229')._huntingQuerycontentId229]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject229').huntingQueryVersion229]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject229')._huntingQuerycontentId229]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submissions by Grading verdict (FN-FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject229')._huntingQuerycontentId229,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject229')._huntingQuerycontentId229,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject230').huntingQueryTemplateSpecName230]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submissions by Submission State - FN_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject230').huntingQueryVersion230]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_230",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submissions by Submission State (FN)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType contains \"AdminSubmission\"\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\n| summarize count() by tostring(SubmissionState)\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total amount of admin false negative submissions by the state of the submission."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject230')._huntingQuerycontentId230),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 230",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject230')._huntingQuerycontentId230)]",
-                "contentId": "[variables('huntingQueryObject230')._huntingQuerycontentId230]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject230').huntingQueryVersion230]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject230')._huntingQuerycontentId230]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submissions by Submission State (FN)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject230')._huntingQuerycontentId230,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject230')._huntingQuerycontentId230,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject231').huntingQueryTemplateSpecName231]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submissions by Submission State - FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject231').huntingQueryVersion231]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_231",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submissions by Submission State (FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType contains \"AdminSubmission\"\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where Record == 29 and SubmissionType == \"3\"\n| summarize count() by tostring(SubmissionState)\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total amount of admin false positive submissions by the state of the submission."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject231')._huntingQuerycontentId231),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 231",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject231')._huntingQuerycontentId231)]",
-                "contentId": "[variables('huntingQueryObject231')._huntingQuerycontentId231]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject231').huntingQueryVersion231]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject231')._huntingQuerycontentId231]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submissions by Submission State (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject231')._huntingQuerycontentId231,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject231')._huntingQuerycontentId231,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject232').huntingQueryTemplateSpecName232]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submissions by Submission Type - FN_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject232').huntingQueryVersion232]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_232",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submissions by Submission Type (FN)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType contains \"Submission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Malware_FN\",\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Spam_FN\",\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Admin_Malware_URL_FN\",\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Admin_Malware_Attach_FN\",\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Admin_Phish_URL_FN\",\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Admin_Phish_Attach_FN\",\n\"Other\")))))))\n| where Admin_SubmissionType!=\"Other\"\n| summarize count() by Admin_SubmissionType\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing admin reported email submissions"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject232')._huntingQuerycontentId232),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 232",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject232')._huntingQuerycontentId232)]",
-                "contentId": "[variables('huntingQueryObject232')._huntingQuerycontentId232]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject232').huntingQueryVersion232]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject232')._huntingQuerycontentId232]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submissions by Submission Type (FN)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject232')._huntingQuerycontentId232,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject232')._huntingQuerycontentId232,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject233').huntingQueryTemplateSpecName233]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Admin Submissions by Submission Type - FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject233').huntingQueryVersion233]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_233",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Admin Submissions by Submission Type (FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType contains \"Submission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Email_FP\",\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Admin_URL_FP\",\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Admin_Attach_FP\",\n\"Other\")))\n| where Admin_SubmissionType!=\"Other\"\n| summarize count() by Admin_SubmissionType\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total amount of admin false positive submission by submission type."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject233')._huntingQuerycontentId233),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 233",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject233')._huntingQuerycontentId233)]",
-                "contentId": "[variables('huntingQueryObject233')._huntingQuerycontentId233]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject233').huntingQueryVersion233]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject233')._huntingQuerycontentId233]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Admin Submissions by Submission Type (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject233')._huntingQuerycontentId233,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject233')._huntingQuerycontentId233,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject234').huntingQueryTemplateSpecName234]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top accounts performing admin submissions - FN_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject234').huntingQueryVersion234]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_234",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top accounts performing admin submissions (FN)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\n| summarize count() by tostring(UserId) | sort by count_\n| top 15 by count_\n| render columnchart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top admins performing false negative submissions"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject234')._huntingQuerycontentId234),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 234",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject234')._huntingQuerycontentId234)]",
-                "contentId": "[variables('huntingQueryObject234')._huntingQuerycontentId234]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject234').huntingQueryVersion234]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject234')._huntingQuerycontentId234]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top accounts performing admin submissions (FN)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject234')._huntingQuerycontentId234,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject234')._huntingQuerycontentId234,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject235').huntingQueryTemplateSpecName235]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top accounts performing admin submissions - FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject235').huntingQueryVersion235]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_235",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top accounts performing admin submissions (FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType\n| where Record == 29 and SubmissionType ==\"3\"\n| summarize count() by tostring(UserId) | sort by count_\n| top 15 by count_\n| render columnchart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top admins performing false positive submissions"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject235')._huntingQuerycontentId235),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 235",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject235')._huntingQuerycontentId235)]",
-                "contentId": "[variables('huntingQueryObject235')._huntingQuerycontentId235]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject235').huntingQueryVersion235]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject235')._huntingQuerycontentId235]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top accounts performing admin submissions (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject235')._huntingQuerycontentId235,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject235')._huntingQuerycontentId235,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject236').huntingQueryTemplateSpecName236]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top accounts performing user submissions_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject236').huntingQueryVersion236]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_236",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top accounts performing user submissions",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where Timestamp > ago(30d) \n| extend Record= (parse_json(RawEventData)).RecordType \n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState  \n| extend UserId = (parse_json(RawEventData)).UserId\n| where Record == 29 \n| where ActionType == \"UserSubmission\" \n| summarize count() by tostring(UserId) | sort by count_ //| top 50 by count_\n| render columnchart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query graphs top accounts performing user submissions"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject236')._huntingQuerycontentId236),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 236",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject236')._huntingQuerycontentId236)]",
-                "contentId": "[variables('huntingQueryObject236')._huntingQuerycontentId236]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject236').huntingQueryVersion236]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject236')._huntingQuerycontentId236]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top accounts performing user submissions",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject236')._huntingQuerycontentId236,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject236')._huntingQuerycontentId236,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject237').huntingQueryTemplateSpecName237]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Detection Overrides - Admin Submissions_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject237').huntingQueryVersion237]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_237",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Detection Overrides - Admin Email Submissions (FN)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Malware_FN\",\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Spam_FN\",\"Other\"))),\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\") and PolicyOverride !=\"NoOverride\"\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\n| project PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType, Emails = count_\n| top 10 by Emails desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject237')._huntingQuerycontentId237),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 237",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject237')._huntingQuerycontentId237)]",
-                "contentId": "[variables('huntingQueryObject237')._huntingQuerycontentId237]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject237').huntingQueryVersion237]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject237')._huntingQuerycontentId237]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Detection Overrides - Admin Email Submissions (FN)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject237')._huntingQuerycontentId237,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject237')._huntingQuerycontentId237,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject238').huntingQueryTemplateSpecName238]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Sender Domains - Admin Submissions FN_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject238').huntingQueryVersion238]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_238",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 sender domains - Admin email submissions (FN)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\")\n| summarize count() by P2SenderDomain\n| project P2SenderDomain, Emails = count_\n| top 10 by Emails desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject238')._huntingQuerycontentId238),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 238",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject238')._huntingQuerycontentId238)]",
-                "contentId": "[variables('huntingQueryObject238')._huntingQuerycontentId238]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject238').huntingQueryVersion238]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject238')._huntingQuerycontentId238]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 sender domains - Admin email submissions (FN)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject238')._huntingQuerycontentId238,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject238')._huntingQuerycontentId238,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject239').huntingQueryTemplateSpecName239]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Sender Domains - Admin Submissions FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject239').huntingQueryVersion239]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_239",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 sender domains - Admin email submissions (FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"Mail\" and SubmissionType ==\"3\"\n| summarize count() by P2SenderDomain\n| project P2SenderDomain, Emails = count_\n| top 10 by Emails desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject239')._huntingQuerycontentId239),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 239",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject239')._huntingQuerycontentId239)]",
-                "contentId": "[variables('huntingQueryObject239')._huntingQuerycontentId239]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject239').huntingQueryVersion239]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject239')._huntingQuerycontentId239]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 sender domains - Admin email submissions (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject239')._huntingQuerycontentId239,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject239')._huntingQuerycontentId239,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject240').huntingQueryTemplateSpecName240]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total Submissions by Submission Status_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject240').huntingQueryVersion240]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_240",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Total Submissions by Submission Type",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where Timestamp > ago(30d) \n| extend Record= (parse_json(RawEventData)).RecordType \n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState  \n| extend UserKey = (parse_json(RawEventData)).UserKey \n| where Record == 29 \n| where ActionType == \"UserSubmission\" or ActionType == \"AdminSubmission\" \n| summarize count() by tostring(SubmissionState) | sort by count_\n// | render piechart // Uncomment this line to render as a graph\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Total Submissions by Submission Status"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject240')._huntingQuerycontentId240),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 240",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject240')._huntingQuerycontentId240)]",
-                "contentId": "[variables('huntingQueryObject240')._huntingQuerycontentId240]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject240').huntingQueryVersion240]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject240')._huntingQuerycontentId240]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Total Submissions by Submission Type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject240')._huntingQuerycontentId240,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject240')._huntingQuerycontentId240,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject241').huntingQueryTemplateSpecName241]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Total Submissions by Submission Type_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject241').huntingQueryVersion241]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_241",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Total Submissions by Submission Type",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\" or ActionType == \"AdminSubmission\"\n| summarize count() by ActionType\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Total Submissions by Submission Type"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject241')._huntingQuerycontentId241),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 241",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject241')._huntingQuerycontentId241)]",
-                "contentId": "[variables('huntingQueryObject241')._huntingQuerycontentId241]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject241').huntingQueryVersion241]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject241')._huntingQuerycontentId241]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Total Submissions by Submission Type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject241')._huntingQuerycontentId241,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject241')._huntingQuerycontentId241,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject242').huntingQueryTemplateSpecName242]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User reported submissions_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject242').huntingQueryVersion242]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_242",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User reported submissions",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where Timestamp > ago(30d) \n| extend Record= (parse_json(RawEventData)).RecordType \n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState  \n| where Record == 29 \n| where ActionType == \"UserSubmission\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing user reported email submissions"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject242')._huntingQuerycontentId242),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 242",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject242')._huntingQuerycontentId242)]",
-                "contentId": "[variables('huntingQueryObject242')._huntingQuerycontentId242]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject242').huntingQueryVersion242]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject242')._huntingQuerycontentId242]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User reported submissions",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject242')._huntingQuerycontentId242,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject242')._huntingQuerycontentId242,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject243').huntingQueryTemplateSpecName243]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submission Accuracy versus Admin Verdicts_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject243').huntingQueryVersion243]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_243",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions accuracy vs Admin review verdict",
-                "category": "Hunting Queries",
-                "query": "let ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\n| mv-expand element = Properties\n| where element.Name == \"AdminReviewResult\"\n| project SubmissionId, AdminReviewResult = element.Value;\nCloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\n| join kind=leftouter ReviewResults on SubmissionId\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \"Correct\", iif(AdminReviewResult==\"Phish\" and UserReportedAs == \"Junk\", \"Phish reported as junk\",iif(AdminReviewResult==\"Junk\" and UserReportedAs == \"Phish\",\"Junk reported as Phish\",iif(AdminReviewResult==\"NotJunk\",\"Reported but not malicious or spam\",iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Not correct\")))))\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\n| where Reviewed==\"Reviewed\"\n| summarize count() by ReviewedAccuracy\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises user submissions type compared to admin review verdict"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject243')._huntingQuerycontentId243),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 243",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject243')._huntingQuerycontentId243)]",
-                "contentId": "[variables('huntingQueryObject243')._huntingQuerycontentId243]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject243').huntingQueryVersion243]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject243')._huntingQuerycontentId243]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions accuracy vs Admin review verdict",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject243')._huntingQuerycontentId243,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject243')._huntingQuerycontentId243,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject244').huntingQueryTemplateSpecName244]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top detection overrides by Admins_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject244').huntingQueryVersion244]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_244",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FN) - Top Detection Overrides by Admins",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where ThreatTypes !=\"\"and OrgLevelAction!=\"\"\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\n| project OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType, UserSubmissions = count_\n| top 10 by UserSubmissions desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject244')._huntingQuerycontentId244),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 244",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject244')._huntingQuerycontentId244)]",
-                "contentId": "[variables('huntingQueryObject244')._huntingQuerycontentId244]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject244').huntingQueryVersion244]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject244')._huntingQuerycontentId244]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FN) - Top Detection Overrides by Admins",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject244')._huntingQuerycontentId244,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject244')._huntingQuerycontentId244,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject245').huntingQueryTemplateSpecName245]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top detection overrides by Users_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject245').huntingQueryVersion245]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_245",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FN) - Top Detection Overrides by Users",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where ThreatTypes !=\"\"and UserLevelAction!=\"\"\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\n| project UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType, UserSubmissions = count_\n| top 10 by UserSubmissions desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject245')._huntingQuerycontentId245),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 245",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject245')._huntingQuerycontentId245)]",
-                "contentId": "[variables('huntingQueryObject245')._huntingQuerycontentId245]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject245').huntingQueryVersion245]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject245')._huntingQuerycontentId245]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FN) - Top Detection Overrides by Users",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject245')._huntingQuerycontentId245,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject245')._huntingQuerycontentId245,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject246').huntingQueryTemplateSpecName246]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top email (P2) senders domains_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject246').huntingQueryVersion246]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_246",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FN) - Top Inbound P2 Senders domains",
-                "category": "Hunting Queries",
-                "query": "let TotalInboundbySender = EmailEvents\n| where EmailDirection ==\"Inbound\"\n| summarize count() by SenderFromDomain;\nCloudAppEvents \n| where ActionType == \"UserSubmission\" \n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\"\n| summarize UserSubmissions=count() by SenderFromDomain\n| join TotalInboundbySender on SenderFromDomain\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\n| project SenderFromDomain, UserSubmissions, TotalInboundEmail=count_,UserSubmissions_Percentage\n| top 10 by UserSubmissions desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises top sender domains of inbound emails submitted as false negatives by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject246')._huntingQuerycontentId246),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 246",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject246')._huntingQuerycontentId246)]",
-                "contentId": "[variables('huntingQueryObject246')._huntingQuerycontentId246]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject246').huntingQueryVersion246]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject246')._huntingQuerycontentId246]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FN) - Top Inbound P2 Senders domains",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject246')._huntingQuerycontentId246,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject246')._huntingQuerycontentId246,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject247').huntingQueryTemplateSpecName247]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top email (P2) senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject247').huntingQueryVersion247]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_247",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FN) - Top Inbound P2 Senders",
-                "category": "Hunting Queries",
-                "query": "let TotalInboundbySender = EmailEvents\n| where EmailDirection ==\"Inbound\"\n| summarize count() by SenderFromAddress;\nCloudAppEvents \n| where ActionType == \"UserSubmission\" \n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\"\n| summarize UserSubmissions=count() by SenderFromAddress\n| join TotalInboundbySender on SenderFromAddress\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\n| project SenderFromAddress, UserSubmissions, TotalInboundEmail=count_,UserSubmissions_Percentage\n| top 10 by UserSubmissions desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises top sender email addresses of inbound emails submitted as false negatives by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject247')._huntingQuerycontentId247),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 247",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject247')._huntingQuerycontentId247)]",
-                "contentId": "[variables('huntingQueryObject247')._huntingQuerycontentId247]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject247').huntingQueryVersion247]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject247')._huntingQuerycontentId247]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FN) - Top Inbound P2 Senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject247')._huntingQuerycontentId247,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject247')._huntingQuerycontentId247,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject248').huntingQueryTemplateSpecName248]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top Intra-Org P2 senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject248').huntingQueryVersion248]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_248",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FN) - Top Intra-Org P2 Senders",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Intra-org\"\n| summarize count() by SenderMailFromAddress\n| project SenderMailFromAddress,UserSubmissions = count_\n| top 10 by UserSubmissions desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises top sender email addresses of intra-org emails submitted as false negatives by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject248')._huntingQuerycontentId248),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 248",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject248')._huntingQuerycontentId248)]",
-                "contentId": "[variables('huntingQueryObject248')._huntingQuerycontentId248]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject248').huntingQueryVersion248]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject248')._huntingQuerycontentId248]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FN) - Top Intra-Org P2 Senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject248')._huntingQuerycontentId248,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject248')._huntingQuerycontentId248,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject249').huntingQueryTemplateSpecName249]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top Intra-Org Subjects_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject249').huntingQueryVersion249]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_249",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FN) - Top Intra-Org Subjects",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Intra-org\"\n| summarize count() by Subject\n| project Subject,UserSubmissions = count_\n| top 10 by UserSubmissions desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises top 10 subjects of intra-org emails submitted as false negatives by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject249')._huntingQuerycontentId249),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 249",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject249')._huntingQuerycontentId249)]",
-                "contentId": "[variables('huntingQueryObject249')._huntingQuerycontentId249]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject249').huntingQueryVersion249]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject249')._huntingQuerycontentId249]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FN) - Top Intra-Org Subjects",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject249')._huntingQuerycontentId249,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject249')._huntingQuerycontentId249,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject250').huntingQueryTemplateSpecName250]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions by Admin review status_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject250').huntingQueryVersion250]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_250",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions by Admin review status (Mark and Notify)",
-                "category": "Hunting Queries",
-                "query": "let ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\n| mv-expand element = Properties\n| where element.Name == \"AdminReviewResult\"\n| project SubmissionId, AdminReviewResult = element.Value;\nCloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\n| join kind=leftouter ReviewResults on SubmissionId\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\n| summarize count() by Reviewed\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises user submissions where admin also performed 'mark and notify' action on the submission"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject250')._huntingQuerycontentId250),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 250",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject250')._huntingQuerycontentId250)]",
-                "contentId": "[variables('huntingQueryObject250')._huntingQuerycontentId250]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject250').huntingQueryVersion250]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject250')._huntingQuerycontentId250]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions by Admin review status (Mark and Notify)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject250')._huntingQuerycontentId250,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject250')._huntingQuerycontentId250,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject251').huntingQueryTemplateSpecName251]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions by Grading Verdict - FN-FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject251').huntingQueryVersion251]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_251",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FN-FP) by Grading verdict",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType contains \"UserSubmissionTriage\" \n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \n| summarize count() by tostring(TriageVerdict)\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject251')._huntingQuerycontentId251),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 251",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject251')._huntingQuerycontentId251)]",
-                "contentId": "[variables('huntingQueryObject251')._huntingQuerycontentId251]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject251').huntingQueryVersion251]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject251')._huntingQuerycontentId251]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FN-FP) by Grading verdict",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject251')._huntingQuerycontentId251,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject251')._huntingQuerycontentId251,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject252').huntingQueryTemplateSpecName252]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions by Submission Type_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject252').huntingQueryVersion252]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_252",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FN) by Submission Type",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType contains \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\niff(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\",\"User_AttackSim_Submission\",\n\"Other\")))\n| where User_SubmissionType!=\"Other\"\n| summarize count() by User_SubmissionType\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total ammount of user false negative submission by submission type, including the phish simulations reported emails"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject252')._huntingQuerycontentId252),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 252",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject252')._huntingQuerycontentId252)]",
-                "contentId": "[variables('huntingQueryObject252')._huntingQuerycontentId252]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject252').huntingQueryVersion252]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject252')._huntingQuerycontentId252]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FN) by Submission Type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject252')._huntingQuerycontentId252,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject252')._huntingQuerycontentId252,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject253').huntingQueryTemplateSpecName253]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions from Junk Folder_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject253').huntingQueryVersion253]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_253",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User email submissions (FN) from Junk Folder",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where DeliveryLocation == \"Junk folder\"\n| summarize count() by ThreatTypes,User_SubmissionType\n| project ThreatTypes,User_SubmissionType, Emails = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the total ammount of user false negative submissions from the junk folder"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject253')._huntingQuerycontentId253),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 253",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject253')._huntingQuerycontentId253)]",
-                "contentId": "[variables('huntingQueryObject253')._huntingQuerycontentId253]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject253').huntingQueryVersion253]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject253')._huntingQuerycontentId253]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User email submissions (FN) from Junk Folder",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject253')._huntingQuerycontentId253,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject253')._huntingQuerycontentId253,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject254').huntingQueryTemplateSpecName254]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions Trend - FN_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject254').huntingQueryVersion254]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_254",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submission Trend (FN)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = CloudAppEvents\n| where ActionType contains \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType);\nlet User_Phish_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"User_Phish_FN\";\nlet User_Spam_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"User_Spam_FN\";\nlet User_AttackSim_Submission=baseQuery\n| make-series Count= countif(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"User_AttackSim_Submission\";\nunion User_Phish_FN,User_Spam_FN,User_AttackSim_Submission\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject254')._huntingQuerycontentId254),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 254",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject254')._huntingQuerycontentId254)]",
-                "contentId": "[variables('huntingQueryObject254')._huntingQuerycontentId254]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject254').huntingQueryVersion254]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject254')._huntingQuerycontentId254]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submission Trend (FN)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject254')._huntingQuerycontentId254,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject254')._huntingQuerycontentId254,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject255').huntingQueryTemplateSpecName255]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Attacked more than x times average_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject255').huntingQueryVersion255]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_255",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Attacked more than x times average",
-                "category": "Hunting Queries",
-                "query": "let AverageThreatPerRecipient = toscalar(EmailEvents \n| where DetectionMethods != \"\" \n| summarize total=count() by RecipientEmailAddress \n| summarize avg(total)); \nEmailEvents \n| where DetectionMethods != \"\" \n| summarize total=count() by RecipientEmailAddress \n| where tolong(total) >= 1*AverageThreatPerRecipient // update \"1\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing count of users attacked more than x times average."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject255')._huntingQuerycontentId255),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 255",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject255')._huntingQuerycontentId255)]",
-                "contentId": "[variables('huntingQueryObject255')._huntingQuerycontentId255]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject255').huntingQueryVersion255]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject255')._huntingQuerycontentId255]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Attacked more than x times average",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject255')._huntingQuerycontentId255,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject255')._huntingQuerycontentId255,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject256').huntingQueryTemplateSpecName256]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malicious mails by sender IPs_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject256').huntingQueryVersion256]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_256",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious mails by sender IPs",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where Timestamp > ago(30d) \n| where ThreatTypes has \"Phish\" or ThreatTypes has \"Malware\"\n| summarize count() by SenderIPv4 //SenderIPv6\n| sort by count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing sender IPs sending malicious email of type Malware or Phish"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject256')._huntingQuerycontentId256),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 256",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject256')._huntingQuerycontentId256)]",
-                "contentId": "[variables('huntingQueryObject256')._huntingQuerycontentId256]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject256').huntingQueryVersion256]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject256')._huntingQuerycontentId256]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious mails by sender IPs",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject256')._huntingQuerycontentId256,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject256')._huntingQuerycontentId256,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject257').huntingQueryTemplateSpecName257]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 percent of most attacked users_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject257').huntingQueryVersion257]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_257",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10% of most attacked users",
-                "category": "Hunting Queries",
-                "query": "let topTargeted = toscalar( EmailEvents \n| where DetectionMethods != \"\" \n| summarize total=count() by RecipientEmailAddress \n| summarize percentiles(total,90)); \nEmailEvents \n| where DetectionMethods != \"\" \n| summarize total=count() by RecipientEmailAddress \n| where total >= topTargeted \n| order by total desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing the list of top 10% of most attacked users"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject257')._huntingQuerycontentId257),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 257",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject257')._huntingQuerycontentId257)]",
-                "contentId": "[variables('huntingQueryObject257')._huntingQuerycontentId257]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject257').huntingQueryVersion257]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject257')._huntingQuerycontentId257]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10% of most attacked users",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject257')._huntingQuerycontentId257,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject257')._huntingQuerycontentId257,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject258').huntingQueryTemplateSpecName258]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 URL domains attacking organization_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject258').huntingQueryVersion258]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_258",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 URL domains attacking organization",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where ThreatTypes != \"\" \n| extend detection= parse_json(DetectionMethods) \n| extend Spam = tostring(detection.Spam) \n| extend Phish = tostring(detection.Phish) \n| where (Spam == '[\"URL malicious reputation\"]') or (Phish == '[\"URL malicious reputation\"]') or (Phish == '[\"URL detonation reputation\"]') or (Phish == '[\"URL detonation\"]') \n| join EmailUrlInfo on NetworkMessageId\n| summarize total=count() by UrlDomain \n| top 10 by total \n| render columnchart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing list of top 10 URL domains attacking the organization"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject258')._huntingQuerycontentId258),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 258",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject258')._huntingQuerycontentId258)]",
-                "contentId": "[variables('huntingQueryObject258')._huntingQuerycontentId258]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject258').huntingQueryVersion258]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject258')._huntingQuerycontentId258]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 URL domains attacking organization",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject258')._huntingQuerycontentId258,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject258')._huntingQuerycontentId258,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject259').huntingQueryTemplateSpecName259]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top external malicious senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject259').huntingQueryVersion259]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_259",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top external malicious senders",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where Timestamp > ago(30d) \n| where EmailDirection == \"Inbound\" \n| summarize count() by SenderFromAddress \n| sort by count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject259')._huntingQuerycontentId259),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 259",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject259')._huntingQuerycontentId259)]",
-                "contentId": "[variables('huntingQueryObject259')._huntingQuerycontentId259]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject259').huntingQueryVersion259]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject259')._huntingQuerycontentId259]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top external malicious senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject259')._huntingQuerycontentId259,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject259')._huntingQuerycontentId259,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject260').huntingQueryTemplateSpecName260]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top targeted users_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject260').huntingQueryVersion260]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_260",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top targeted users",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where Timestamp > ago(30d) \n| where ThreatTypes has \"Malware\" or ThreatTypes has \"Phish\" \n| summarize count() by RecipientEmailAddress \n| sort by count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject260')._huntingQuerycontentId260),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 260",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject260')._huntingQuerycontentId260)]",
-                "contentId": "[variables('huntingQueryObject260')._huntingQuerycontentId260]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject260').huntingQueryVersion260]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject260')._huntingQuerycontentId260]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top targeted users",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject260')._huntingQuerycontentId260,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject260')._huntingQuerycontentId260,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject261').huntingQueryTemplateSpecName261]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "End user malicious clicks_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject261').huntingQueryVersion261]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_261",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "End user malicious clicks",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| where ThreatTypes contains \"Phish\"\n| extend UrlBlocked = ActionType has_any(\"ClickBlocked\")\n| extend UrlAllowed = ActionType has_any('ClickAllowed')\n| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')\n| extend ErrorPage = ActionType has_any('UrlErrorPage')\n| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough)  by AccountUpn\n| sort by Blocked desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing list of top users click on Phis URLs"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject261')._huntingQuerycontentId261),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 261",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject261')._huntingQuerycontentId261)]",
-                "contentId": "[variables('huntingQueryObject261')._huntingQuerycontentId261]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject261').huntingQueryVersion261]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject261')._huntingQuerycontentId261]",
-        "contentKind": "HuntingQuery",
-        "displayName": "End user malicious clicks",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject261')._huntingQuerycontentId261,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject261')._huntingQuerycontentId261,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject262').huntingQueryTemplateSpecName262]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URL click count by click action_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject262').huntingQueryVersion262]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_262",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URL click count by click action",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents \n| extend UrlBlocked = ActionType has_any(\"ClickBlocked\") \n| extend UrlAllowed = ActionType has_any('ClickAllowed') \n| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress') \n| extend ErrorPage = ActionType has_any('UrlErrorPage') \n| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough)\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing URL click count by ClickAction"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject262')._huntingQuerycontentId262),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 262",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject262')._huntingQuerycontentId262)]",
-                "contentId": "[variables('huntingQueryObject262')._huntingQuerycontentId262]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject262').huntingQueryVersion262]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject262')._huntingQuerycontentId262]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URL click count by click action",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject262')._huntingQuerycontentId262,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject262')._huntingQuerycontentId262,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject263').huntingQueryTemplateSpecName263]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URL click on ZAP Email_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject263').huntingQueryVersion263]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_263",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URL click on ZAP email",
-                "category": "Hunting Queries",
-                "query": "AlertInfo\n| where Title contains \"Email messages containing malicious URL removed after delivery\" and Timestamp > ago (7d)\n| join kind=inner (AlertEvidence| where EntityType == \"MailMessage\") on AlertId \n| join UrlClickEvents on NetworkMessageId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject263')._huntingQuerycontentId263),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 263",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject263')._huntingQuerycontentId263)]",
-                "contentId": "[variables('huntingQueryObject263')._huntingQuerycontentId263]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject263').huntingQueryVersion263]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject263')._huntingQuerycontentId263]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URL click on ZAP email",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject263')._huntingQuerycontentId263,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject263')._huntingQuerycontentId263,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject264').huntingQueryTemplateSpecName264]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URL clicks actions by URL_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject264').huntingQueryVersion264]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_264",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URL clicks actions by URL",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| extend UrlBlocked = ActionType has_any(\"ClickBlocked\")\n| extend UrlAllowed = ActionType has_any('ClickAllowed')\n| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')\n| extend ErrorPage = ActionType has_any('UrlErrorPage')\n| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough) by Url\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we are looking URL click actions by URL in the last 7 days"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject264')._huntingQuerycontentId264),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 264",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject264')._huntingQuerycontentId264)]",
-                "contentId": "[variables('huntingQueryObject264')._huntingQuerycontentId264]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject264').huntingQueryVersion264]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject264')._huntingQuerycontentId264]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URL clicks actions by URL",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject264')._huntingQuerycontentId264,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject264')._huntingQuerycontentId264,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject265').huntingQueryTemplateSpecName265]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URLClick details based on malicious URL click alert_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject265').huntingQueryVersion265]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_265",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URLClick details based on malicious URL click alert",
-                "category": "Hunting Queries",
-                "query": "AlertInfo\n| where Title contains \"Potentially malicious\" and Timestamp > ago (30d)\n| join kind=inner (AlertEvidence| where EntityType == \"MailMessage\") on AlertId \n| join UrlClickEvents on NetworkMessageId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject265')._huntingQuerycontentId265),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 265",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject265')._huntingQuerycontentId265)]",
-                "contentId": "[variables('huntingQueryObject265')._huntingQuerycontentId265]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject265').huntingQueryVersion265]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject265')._huntingQuerycontentId265]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URLClick details based on malicious URL click alert",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject265')._huntingQuerycontentId265,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject265')._huntingQuerycontentId265,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject266').huntingQueryTemplateSpecName266]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User clicked through events_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject266').huntingQueryVersion266]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_266",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User clicked through events",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents \n| where ActionType == \"ClickAllowed\" or IsClickedThrough !=\"0\" \n| where ThreatTypes has \"Phish\" \n| summarize by ReportId, IsClickedThrough, AccountUpn, NetworkMessageId, ThreatTypes\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject266')._huntingQuerycontentId266),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 266",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject266')._huntingQuerycontentId266)]",
-                "contentId": "[variables('huntingQueryObject266')._huntingQuerycontentId266]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject266').huntingQueryVersion266]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject266')._huntingQuerycontentId266]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User clicked through events",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject266')._huntingQuerycontentId266,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject266')._huntingQuerycontentId266,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject267').huntingQueryTemplateSpecName267]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User clicks on malicious inbound emails_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject267').huntingQueryVersion267]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_267",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User clicks on malicious inbound emails",
-                "category": "Hunting Queries",
-                "query": "let UrlClicked = (UrlClickEvents\n| where ActionType == \"ClickAllowed\" or IsClickedThrough !=\"0\"\n| extend Device_IPv4 = IPAddress\n| project ActionType, Device_IPv4, Url, UrlChain, IPAddress, NetworkMessageId);\nEmailEvents\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes) and EmailDirection == \"Inbound\"\n| where ThreatTypes has_any (\"Malware\", \"Phish\")\n| extend SenderFromAddress_IPv4 = strcat(SenderFromAddress, \", \", SenderIPv4)\n| join kind = inner UrlClicked on NetworkMessageId\n| project Timestamp,NetworkMessageId, Subject, SenderFromAddress_IPv4, RecipientEmailAddress, ThreatTypes, ActionType, Url, UrlChain, Device_IPv4, LatestDeliveryLocation, LatestDeliveryAction, EmailAction, EmailActionPolicy\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query provides insights on users who clicked on a suspicious URL"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject267')._huntingQuerycontentId267),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 267",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject267')._huntingQuerycontentId267)]",
-                "contentId": "[variables('huntingQueryObject267')._huntingQuerycontentId267]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject267').huntingQueryVersion267]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject267')._huntingQuerycontentId267]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User clicks on malicious inbound emails",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject267')._huntingQuerycontentId267,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject267')._huntingQuerycontentId267,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject268').huntingQueryTemplateSpecName268]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User clicks on phishing URLs in emails_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject268').huntingQueryVersion268]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_268",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User clicks on phishing URLs in emails",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents \n| where ThreatTypes has \"Phish\" \n| join EmailEvents on NetworkMessageId,  $left.AccountUpn == $right.RecipientEmailAddress \n| project Timestamp, Url, ActionType, AccountUpn, ReportId, NetworkMessageId, ThreatTypes, IsClickedThrough, DeliveryLocation, OrgLevelAction, UserLevelAction\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query helps in determining clickthroughs when email delivered because of detection overrides."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject268')._huntingQuerycontentId268),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 268",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject268')._huntingQuerycontentId268)]",
-                "contentId": "[variables('huntingQueryObject268')._huntingQuerycontentId268]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject268').huntingQueryVersion268]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject268')._huntingQuerycontentId268]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User clicks on phishing URLs in emails",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject268')._huntingQuerycontentId268,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject268')._huntingQuerycontentId268,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject269').huntingQueryTemplateSpecName269]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malicious Clicks allowed (click-through)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject269').huntingQueryVersion269]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_269",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious Clicks allowed (click-through)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nUrlClickEvents\n| where TimeGenerated >= TimeStart\n| where IsClickedThrough == 1\n| where isnotempty(ThreatTypes)\n| make-series Count = count() default = 0 on TimeGenerated from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject269')._huntingQuerycontentId269),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 269",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject269')._huntingQuerycontentId269)]",
-                "contentId": "[variables('huntingQueryObject269')._huntingQuerycontentId269]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject269').huntingQueryVersion269]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject269')._huntingQuerycontentId269]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious Clicks allowed (click-through)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject269')._huntingQuerycontentId269,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject269')._huntingQuerycontentId269,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject270').huntingQueryTemplateSpecName270]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malicious Emails with QR code Urls_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject270').huntingQueryVersion270]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_270",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious Emails with QR code Urls",
-                "category": "Hunting Queries",
-                "query": "EmailUrlInfo\n| where UrlLocation == \"QRCode\"\n| join kind=inner (\n    EmailEvents\n    | where isnotempty(ThreatTypes)\n    | project NetworkMessageId, ThreatTypes\n) on NetworkMessageId\n| summarize count() by ThreatTypes\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject270')._huntingQuerycontentId270),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 270",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject270')._huntingQuerycontentId270)]",
-                "contentId": "[variables('huntingQueryObject270')._huntingQuerycontentId270]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject270').huntingQueryVersion270]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject270')._huntingQuerycontentId270]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious Emails with QR code Urls",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject270')._huntingQuerycontentId270,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject270')._huntingQuerycontentId270,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject271').huntingQueryTemplateSpecName271]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phishing Email Url Redirector_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject271').huntingQueryVersion271]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_271",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "PhishingEmailUrlRedirector (1)",
-                "category": "Hunting Queries",
-                "query": "EmailUrlInfo\n//This regex identifies emails containing the \"T-Dot\" redirector pattern in the URL\n| where Url matches regex @\"s?\\:\\/\\/(?:www\\.)?t\\.(?:[\\w\\-\\.]+\\/+)+(?:r|redirect)\\/?\\?\" \n    //This regex narrows in on emails that contain the known malicious domain pattern in the URL from the most recent campaigns\n    and Url matches regex @\"[a-zA-Z]\\-[a-zA-Z]{2}\\.(xyz|club|shop)\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject271')._huntingQuerycontentId271),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 271",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject271')._huntingQuerycontentId271)]",
-                "contentId": "[variables('huntingQueryObject271')._huntingQuerycontentId271]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject271').huntingQueryVersion271]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject271')._huntingQuerycontentId271]",
-        "contentKind": "HuntingQuery",
-        "displayName": "PhishingEmailUrlRedirector (1)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject271')._huntingQuerycontentId271,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject271')._huntingQuerycontentId271,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject272').huntingQueryTemplateSpecName272]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SafeLinks URL detections_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject272').huntingQueryVersion272]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_272",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "SafeLinks URL detections",
-                "category": "Hunting Queries",
-                "query": "EmailEvents \n| where DetectionMethods != \"\" \n| extend detection= tostring(parse_json(DetectionMethods).Phish) \n| where detection == '[\"URL detonation reputation\"]' or detection == '[\"URL detonation\"]' \n| summarize total=count() by bin(Timestamp, 1d) \n| order by Timestamp asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query provides insights on the detections done by SafeLinks protection in Defender for Office 365"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject272')._huntingQuerycontentId272),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 272",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject272')._huntingQuerycontentId272)]",
-                "contentId": "[variables('huntingQueryObject272')._huntingQuerycontentId272]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject272').huntingQueryVersion272]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject272')._huntingQuerycontentId272]",
-        "contentKind": "HuntingQuery",
-        "displayName": "SafeLinks URL detections",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject272')._huntingQuerycontentId272,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject272')._huntingQuerycontentId272,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject273').huntingQueryTemplateSpecName273]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 Users clicking on Malicious URLs (Malware)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject273').huntingQueryVersion273]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_273",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Users clicking on Malicious URLs (Malware)",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| summarize TotalClickCount = count(), MalwareClickCount = countif(ThreatTypes has \"Malware\") by AccountUpn\n| extend Bad_Click_Percentage = round(100.0 * MalwareClickCount / TotalClickCount, 2)\n| where MalwareClickCount != 0\n| top 10 by MalwareClickCount\n| project User = AccountUpn, MalwareClicks = MalwareClickCount, TotalClicks = TotalClickCount, Bad_Click_Percentage\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject273')._huntingQuerycontentId273),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 273",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject273')._huntingQuerycontentId273)]",
-                "contentId": "[variables('huntingQueryObject273')._huntingQuerycontentId273]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject273').huntingQueryVersion273]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject273')._huntingQuerycontentId273]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Users clicking on Malicious URLs (Malware)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject273')._huntingQuerycontentId273,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject273')._huntingQuerycontentId273,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject274').huntingQueryTemplateSpecName274]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 Users clicking on Malicious URLs (Phish)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject274').huntingQueryVersion274]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_274",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Users clicking on Malicious URLs (Phish)",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| summarize TotalClickCount = count(), PhishClickCount = countif(ThreatTypes has \"Phish\") by AccountUpn\n| extend Bad_Click_Percentage = round(100.0 * PhishClickCount / TotalClickCount, 2)\n| where PhishClickCount != 0\n| top 10 by PhishClickCount\n| project User = AccountUpn, PhishClicks = PhishClickCount, TotalClicks = TotalClickCount, Bad_Click_Percentage\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject274')._huntingQuerycontentId274),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 274",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject274')._huntingQuerycontentId274)]",
-                "contentId": "[variables('huntingQueryObject274')._huntingQuerycontentId274]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject274').huntingQueryVersion274]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject274')._huntingQuerycontentId274]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Users clicking on Malicious URLs (Phish)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject274')._huntingQuerycontentId274,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject274')._huntingQuerycontentId274,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject275').huntingQueryTemplateSpecName275]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 10 Users clicking on Malicious URLs (Spam)_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject275').huntingQueryVersion275]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_275",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 10 Users clicking on Malicious URLs (Spam)",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| summarize TotalClickCount = count(), SpamClickCount = countif(ThreatTypes has \"Spam\") by AccountUpn\n| extend Bad_Click_Percentage = round(100.0 * SpamClickCount / TotalClickCount, 2)\n| where SpamClickCount != 0\n| top 10 by SpamClickCount\n| project User = AccountUpn, SpamClicks = SpamClickCount, TotalClicks = TotalClickCount, Bad_Click_Percentage\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Visualises the top 10 users with click attempts on URLs in emails detected as spam, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject275')._huntingQuerycontentId275),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 275",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject275')._huntingQuerycontentId275)]",
-                "contentId": "[variables('huntingQueryObject275')._huntingQuerycontentId275]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject275').huntingQueryVersion275]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject275')._huntingQuerycontentId275]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 10 Users clicking on Malicious URLs (Spam)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject275')._huntingQuerycontentId275,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject275')._huntingQuerycontentId275,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject276').huntingQueryTemplateSpecName276]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URL Click attempts by threat type_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject276').huntingQueryVersion276]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_276",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URL Click attempts by threat type",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nUrlClickEvents\n| where TimeGenerated >= TimeStart\n| where isnotempty(ThreatTypes)\n| summarize Count = count() by ThreatTypes, bin(TimeGenerated, 1d)\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject276')._huntingQuerycontentId276),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 276",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject276')._huntingQuerycontentId276)]",
-                "contentId": "[variables('huntingQueryObject276')._huntingQuerycontentId276]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject276').huntingQueryVersion276]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject276')._huntingQuerycontentId276]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URL Click attempts by threat type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject276')._huntingQuerycontentId276,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject276')._huntingQuerycontentId276,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject277').huntingQueryTemplateSpecName277]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URL Clicks by Action_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject277').huntingQueryVersion277]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_277",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URL Clicks by Action",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| summarize Count = count() by ActionType\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject277')._huntingQuerycontentId277),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 277",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject277')._huntingQuerycontentId277)]",
-                "contentId": "[variables('huntingQueryObject277')._huntingQuerycontentId277]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject277').huntingQueryVersion277]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject277')._huntingQuerycontentId277]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URL Clicks by Action",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject277')._huntingQuerycontentId277,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject277')._huntingQuerycontentId277,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject278').huntingQueryTemplateSpecName278]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URLs by location_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject278').huntingQueryVersion278]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_278",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URLs by location",
-                "category": "Hunting Queries",
-                "query": "EmailUrlInfo\n| summarize Count = count() by UrlLocation\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject278')._huntingQuerycontentId278),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 278",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject278')._huntingQuerycontentId278)]",
-                "contentId": "[variables('huntingQueryObject278')._huntingQuerycontentId278]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject278').huntingQueryVersion278]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject278')._huntingQuerycontentId278]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URLs by location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject278')._huntingQuerycontentId278,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject278')._huntingQuerycontentId278,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject279').huntingQueryTemplateSpecName279]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Post Delivery Events by Admin_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject279').huntingQueryVersion279]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_279",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Post Delivery Events by Admin",
-                "category": "Hunting Queries",
-                "query": "let gran = 1d;\nlet minTime = startofday(ago(30d));\nlet maxTime = startofday(now());\nlet agg = materialize(EmailPostDeliveryEvents\n    | where Timestamp >= minTime and Timestamp < maxTime\n    | where ActionTrigger has \"AdminAction\"\n    | summarize [\"Soft Delete\"] = countif(Action has 'Soft Delete'), [\"Hard Delete\"] = countif(Action has 'Hard Delete'), [\"Moved to junk folder\"] = countif(Action has 'Moved to junk folder'), [\"Moved to inbox\"] = countif(Action has 'Moved to inbox'), [\"Quarantine release\"] = countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\nrange Timestamp from minTime to maxTime - 1d step gran\n| join kind=leftouter (agg) on Timestamp\n| project Timestamp, [\"Soft Delete\"] = coalesce([\"Soft Delete\"], 0), [\"Hard Delete\"] = coalesce([\"Hard Delete\"], 0), [\"Moved to junk folder\"] = coalesce([\"Moved to junk folder\"], 0), [\"Moved to inbox\"] = coalesce([\"Moved to inbox\"], 0), [\"Quarantine release\"] = coalesce([\"Quarantine release\"], 0)\n| sort by Timestamp asc\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject279')._huntingQuerycontentId279),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 279",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject279')._huntingQuerycontentId279)]",
-                "contentId": "[variables('huntingQueryObject279')._huntingQuerycontentId279]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject279').huntingQueryVersion279]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject279')._huntingQuerycontentId279]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Post Delivery Events by Admin",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject279')._huntingQuerycontentId279,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject279')._huntingQuerycontentId279,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject280').huntingQueryTemplateSpecName280]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Post Delivery Events by Location_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject280').huntingQueryVersion280]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_280",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Post Delivery Events by Location",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet quarantine=EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where DeliveryLocation has 'Quarantine'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Quarantine\";\nlet delete=EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where DeliveryLocation has 'Delete'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Delete\";\nlet junk=EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where DeliveryLocation has 'Junk'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Junk\";\nlet inbox=EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where DeliveryLocation has 'Inbox'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Inbox\";\nunion quarantine,delete,junk,inbox\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject280')._huntingQuerycontentId280),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 280",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject280')._huntingQuerycontentId280)]",
-                "contentId": "[variables('huntingQueryObject280')._huntingQuerycontentId280]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject280').huntingQueryVersion280]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject280')._huntingQuerycontentId280]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Post Delivery Events by Location",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject280')._huntingQuerycontentId280,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject280')._huntingQuerycontentId280,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject281').huntingQueryTemplateSpecName281]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Post Delivery Events by ZAP type_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject281').huntingQueryVersion281]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_281",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Post Delivery Events by ZAP type",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailPostDeliveryEvents\n| where Timestamp >= TimeStart\n| where ActionType has \"ZAP\"\n| where Timestamp < TimeEnd\n| make-series ['Spam ZAP'] = countif(ActionType has 'Spam ZAP'), ['Phish ZAP'] = countif(ActionType has 'Phish ZAP'), ['Malware ZAP'] = countif(ActionType has 'Malware ZAP') default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject281')._huntingQuerycontentId281),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 281",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject281')._huntingQuerycontentId281)]",
-                "contentId": "[variables('huntingQueryObject281')._huntingQuerycontentId281]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject281').huntingQueryVersion281]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject281')._huntingQuerycontentId281]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Post Delivery Events by ZAP type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject281')._huntingQuerycontentId281,'-', '1.1.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject281')._huntingQuerycontentId281,'-', '1.1.0')))]",
-        "version": "1.1.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject282').huntingQueryTemplateSpecName282]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Post Delivery Events over time_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject282').huntingQueryVersion282]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_282",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Post Delivery Events over time",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where ActionType has \"ZAP\"\n| make-series ZappedEmails = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject282')._huntingQuerycontentId282),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 282",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject282')._huntingQuerycontentId282)]",
-                "contentId": "[variables('huntingQueryObject282')._huntingQuerycontentId282]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject282').huntingQueryVersion282]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject282')._huntingQuerycontentId282]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Post Delivery Events over time",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject282')._huntingQuerycontentId282,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject282')._huntingQuerycontentId282,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject283').huntingQueryTemplateSpecName283]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "EmailDelivered-ToInbox_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject283').huntingQueryVersion283]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_283",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Determine Successfully Delivered Phishing Emails to Inbox/Junk folder.",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where isnotempty(ThreatTypes) and DeliveryLocation in~ (\"Inbox/folder\",\"Junk folder\")\n| extend Name = tostring(split(SenderFromAddress, '@', 0)[0]), UPNSuffix = tostring(split(SenderFromAddress, '@', 1)[0])\n| extend Account_0_Name = Name\n| extend Account_0_UPNSuffix = UPNSuffix\n| extend IP_0_Address = SenderIPv4\n| extend MailBox_0_MailboxPrimaryAddress = RecipientEmailAddress\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query identifies threats which got successfully delivered to Inbox/Junk folder."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject283')._huntingQuerycontentId283),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 283",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject283')._huntingQuerycontentId283)]",
-                "contentId": "[variables('huntingQueryObject283')._huntingQuerycontentId283]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject283').huntingQueryVersion283]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject283')._huntingQuerycontentId283]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Determine Successfully Delivered Phishing Emails to Inbox/Junk folder.",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject283')._huntingQuerycontentId283,'-', '1.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject283')._huntingQuerycontentId283,'-', '1.0.2')))]",
-        "version": "1.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject284').huntingQueryTemplateSpecName284]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AnomalousPayloadDeliveredWithISOFile_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject284').huntingQueryVersion284]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_284",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Anomalous Payload Delivered from ISO files",
-                "category": "Hunting Queries",
-                "query": "DeviceEvents\n| where TimeGenerated > ago(30d) \n| where ActionType == 'BrowserLaunchedToOpenUrl' \n| where RemoteUrl endswith \".lnk\"\n| where RemoteUrl !startswith \"C:\"\n| project LNKLaunchTimestamp = TimeGenerated, DeviceName, RemoteUrl\n| parse RemoteUrl with Drive '\\\\' *\n| extend Drive= tostring(Drive)\n| where isnotempty(Drive)\n| join kind=innerunique (\nDeviceProcessEvents\n| where TimeGenerated > ago(30d)\n| where FolderPath !startswith \"C:\"\n| parse FolderPath with Drive '\\\\' *\n| project Drive= tostring(Drive), StartedProcessTimestamp = TimeGenerated, StartedProcessName = FileName, StartedProcessSHA1 = SHA1, StartedProcessCommandline = ProcessCommandLine, StartedProcessPath = FolderPath, DeviceName, StartedProcessParentName = InitiatingProcessFileName, StartedProcessParentCmdline = InitiatingProcessCommandLine, StartedParentProcessFolderPath = InitiatingProcessFolderPath, StartedProcessGrandParent = InitiatingProcessParentFileName, TimeGenerated\n) on DeviceName, Drive\n| where StartedProcessTimestamp between (LNKLaunchTimestamp ..(LNKLaunchTimestamp+1m))\n| project-away Drive1, DeviceName1\n| project-reorder LNKLaunchTimestamp, StartedProcessTimestamp, DeviceName, RemoteUrl, Drive, StartedProcessName, StartedProcessSHA1, StartedProcessPath,StartedProcessCommandline, StartedProcessParentName, StartedProcessParentCmdline, StartedParentProcessFolderPath, StartedProcessGrandParent, TimeGenerated\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for lnk file executions from other locations than C: drive, which can relate to mounted ISO-files."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1204"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject284')._huntingQuerycontentId284),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 284",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject284')._huntingQuerycontentId284)]",
-                "contentId": "[variables('huntingQueryObject284')._huntingQuerycontentId284]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject284').huntingQueryVersion284]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject284')._huntingQuerycontentId284]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Anomalous Payload Delivered from ISO files",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject284')._huntingQuerycontentId284,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject284')._huntingQuerycontentId284,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject285').huntingQueryTemplateSpecName285]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "BitsadminActivity_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject285').huntingQueryVersion285]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_285",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Bitsadmin Activity",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where \n    (FileName =~ \"bitsadmin.exe\" or column_ifexists('ProcessVersionInfoOriginalFileName','ColumnNotAvailable') =~ 'bitsadmin.exe')\n    and ProcessCommandLine has_any ('/Transfer','/AddFile', '/AddFileSet','/AddFileWithRanges')\n| extend \n    ParsedCommandLine = parse_command_line(ProcessCommandLine,'windows')\n| extend     \n    RemoteUrl = tostring(ParsedCommandLine[-2]),\n    LocalFile= tostring(ParsedCommandLine[-1]),\n    Direction = iff(ProcessCommandLine has \"/Upload\", 'Upload', 'Download')\n| project-reorder \n    TimeGenerated,\n    DeviceId,\n    DeviceName,\n    Direction,\n    RemoteUrl,\n    LocalFile,\n    InitiatingProcessFolderPath,\n    InitiatingProcessAccountDomain,\n    InitiatingProcessAccountName,\n    InitiatingProcessSHA256,\n    ProcessCommandLine\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for use of bitsadmin.exe for file transfer, which can be used for legitimate purposes or as part of a malware downloader."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence,CommandAndControl,Exfiltration"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject285')._huntingQuerycontentId285),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 285",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject285')._huntingQuerycontentId285)]",
-                "contentId": "[variables('huntingQueryObject285')._huntingQuerycontentId285]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject285').huntingQueryVersion285]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject285')._huntingQuerycontentId285]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Bitsadmin Activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject285')._huntingQuerycontentId285,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject285')._huntingQuerycontentId285,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject286').huntingQueryTemplateSpecName286]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MaliciousUseOfMSIExec_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject286').huntingQueryVersion286]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_286",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Detect Malicious use of MSIExec",
-                "category": "Hunting Queries",
-                "query": "//Find possible download and execution using Msiexec\nDeviceProcessEvents\n| where TimeGenerated > ago(7d)\n//MSIExec\n| where FileName =~ \"msiexec.exe\" and \n//With domain in command line\n(ProcessCommandLine has \"http\" and ProcessCommandLine has \"return\")//Find PowerShell running files from the temp folder\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query detects possible download and execution using Msiexec."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,PrivilegeEscalation,CredentialAccess"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject286')._huntingQuerycontentId286),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 286",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject286')._huntingQuerycontentId286)]",
-                "contentId": "[variables('huntingQueryObject286')._huntingQuerycontentId286]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject286').huntingQueryVersion286]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject286')._huntingQuerycontentId286]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Detect Malicious use of MSIExec",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject286')._huntingQuerycontentId286,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject286')._huntingQuerycontentId286,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject287').huntingQueryTemplateSpecName287]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MaliciousUseOfMsiExecMimikatz_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject287').huntingQueryVersion287]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_287",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Detect Malicious use of Msiexec Mimikatz",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where Timestamp > ago(7d)\n| where InitiatingProcessFileName =~ \"msiexec.exe\"\n//Mimikatz commands\nand (ProcessCommandLine contains \"privilege::\" \nor ProcessCommandLine has \"sekurlsa\" \nor ProcessCommandLine contains \"token::\")\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for malicious use of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,CredentialAccess,PrivilegeEscalation"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject287')._huntingQuerycontentId287),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 287",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject287')._huntingQuerycontentId287)]",
-                "contentId": "[variables('huntingQueryObject287')._huntingQuerycontentId287]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject287').huntingQueryVersion287]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject287')._huntingQuerycontentId287]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Detect Malicious use of Msiexec Mimikatz",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject287')._huntingQuerycontentId287,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject287')._huntingQuerycontentId287,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject288').huntingQueryTemplateSpecName288]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "OfficeAppsLaunchingWscript_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject288').huntingQueryVersion288]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_288",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Office Apps Launching Wscipt",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName in~('winword.exe', 'excel.exe', 'outlook.exe') \n| where FileName =~ \"wscript.exe\" and ProcessCommandLine has \".jse\" \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "The query searches for Office applications launching wscript.exe to run a JSE file."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "LateralMovement,Collection,CommandAndControl"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject288')._huntingQuerycontentId288),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 288",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject288')._huntingQuerycontentId288)]",
-                "contentId": "[variables('huntingQueryObject288')._huntingQuerycontentId288]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject288').huntingQueryVersion288]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject288')._huntingQuerycontentId288]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Office Apps Launching Wscipt",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject288')._huntingQuerycontentId288,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject288')._huntingQuerycontentId288,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject289').huntingQueryTemplateSpecName289]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "PotentialKerberoastActivities_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject289').huntingQueryVersion289]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_289",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Detect Potential kerberoast Activities",
-                "category": "Hunting Queries",
-                "query": "let MaxCount = 70; //Number of requests per 2 minute timeframe, depending on org size.\nIdentityLogonEvents\n| where TimeGenerated > ago(1d)\n| where ActionType == \"LogonSuccess\"\n| where Protocol == \"Kerberos\"\n| extend json = todynamic(parse_json(tostring(AdditionalFields)))\n| extend SPN = json.Spns,\n       AttackTechniques = json.AttackTechniques\n      | project-away json\n| where isnotempty(SPN)\n| where AttackTechniques has \"T1558.003\"\n| mv-expand SPN\n        | extend SPNType = tostring(extract(@\"^\\w+\",0,tostring(SPN)))\n| distinct tostring(SPN),DeviceName,AccountUpn, AccountSid,bin(TimeGenerated,2m),ReportId, tostring(AttackTechniques)\n| summarize count(), SPNS=(make_list(SPN, 100000)),ReportId=tostring((make_list(ReportId, 100000))[0]) by AccountUpn,AccountSid,DeviceName, bin(TimeGenerated, 2m), tostring(AttackTechniques)\n| extend SPNS = (replace_regex(tostring(SPNS), @'[^\\w+-\\/]+', ''))\n| where count_ >= MaxCount\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query aim to detect if someone requests service tickets (where count => maxcount). The query requires trimming to set a baseline level for MaxCount."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1558.003"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject289')._huntingQuerycontentId289),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 289",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject289')._huntingQuerycontentId289)]",
-                "contentId": "[variables('huntingQueryObject289')._huntingQuerycontentId289]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject289').huntingQueryVersion289]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject289')._huntingQuerycontentId289]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Detect Potential kerberoast Activities",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject289')._huntingQuerycontentId289,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject289')._huntingQuerycontentId289,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject290').huntingQueryTemplateSpecName290]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "PowerShellDownloads_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject290').huntingQueryVersion290]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_290",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "PowerShell Downloads",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where FileName in~ (\"powershell.exe\", \"powershell_ise.exe\")\n| where ProcessCommandLine has \"Net.WebClient\"\n   or ProcessCommandLine has \"DownloadFile\"\n   or ProcessCommandLine has \"Invoke-WebRequest\"\n   or ProcessCommandLine has \"Invoke-Shellcode\"\n   or ProcessCommandLine has \"http\"\n   or ProcessCommandLine has \"IEX\"\n   or ProcessCommandLine has \"Start-BitsTransfer\"\n   or ProcessCommandLine has \"mpcmdrun.exe\"\n| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine\n| top 100 by TimeGenerated\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "The query searches for PowerShell execution events that could involve a download."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject290')._huntingQuerycontentId290),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 290",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject290')._huntingQuerycontentId290)]",
-                "contentId": "[variables('huntingQueryObject290')._huntingQuerycontentId290]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject290').huntingQueryVersion290]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject290')._huntingQuerycontentId290]",
-        "contentKind": "HuntingQuery",
-        "displayName": "PowerShell Downloads",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject290')._huntingQuerycontentId290,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject290')._huntingQuerycontentId290,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject291').huntingQueryTemplateSpecName291]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SuspiciousAppExeutedByWebserver_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject291').huntingQueryVersion291]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_291",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Webserver Executing Suspicious Applications",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where InitiatingProcessFileName in~ ('w3wp.exe', 'httpd.exe') // 'sqlservr.exe')\n| where FileName in~ ('cmd.exe', 'powershell.exe', 'cscript.exe', 'wscript.exe', 'net.exe', 'net1.exe', 'ping.exe', 'whoami.exe')\n| summarize instances = count() by ProcessCommandLine, FolderPath, DeviceName, DeviceId \n| order by instances asc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looks for common webserver process names and identifies any processes launched using a scripting language (cmd, powershell, wscript, cscript)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject291')._huntingQuerycontentId291),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 291",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject291')._huntingQuerycontentId291)]",
-                "contentId": "[variables('huntingQueryObject291')._huntingQuerycontentId291]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject291').huntingQueryVersion291]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject291')._huntingQuerycontentId291]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Webserver Executing Suspicious Applications",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject291')._huntingQuerycontentId291,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject291')._huntingQuerycontentId291,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject292').huntingQueryTemplateSpecName292]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SuspiciousMshtaUsage_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject292').huntingQueryVersion292]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_292",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Detect Suspicious Mshta Usage",
-                "category": "Hunting Queries",
-                "query": "// mshta.exe script launching processes\nDeviceProcessEvents \n| where Timestamp > ago(7d)\nand InitiatingProcessFileName =~ 'mshta.exe'\nand InitiatingProcessCommandLine contains '<script>'\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query detects when mshta.exe has been run, which might include illegitimate usage by attackers."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject292')._huntingQuerycontentId292),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 292",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject292')._huntingQuerycontentId292)]",
-                "contentId": "[variables('huntingQueryObject292')._huntingQuerycontentId292]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject292').huntingQueryVersion292]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject292')._huntingQuerycontentId292]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Detect Suspicious Mshta Usage",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject292')._huntingQuerycontentId292,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject292')._huntingQuerycontentId292,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject293').huntingQueryTemplateSpecName293]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "FilesCopiedToUSBDrives_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject293').huntingQueryVersion293]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_293",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Files Copied to USB Drives",
-                "category": "Hunting Queries",
-                "query": "let UsbDriveMount = DeviceEvents\n| where ActionType==\"UsbDriveMounted\"\n| extend ParsedFields=parse_json(AdditionalFields)\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=TimeGenerated,\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\n| order by DeviceId asc, MountTime desc;\nlet FileCreation = DeviceFileEvents\n| where InitiatingProcessAccountName != \"system\"\n| where ActionType == \"FileCreated\"\n| where FolderPath !startswith \"C:\\\\\"\n| where FolderPath !startswith \"\\\\\"\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\nFileName, FolderPath, SHA256, TimeGenerated, SensitivityLabel, IsAzureInfoProtectionApplied\n| order by DeviceId asc, TimeGenerated desc;\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\n| where FolderPath startswith DriveLetter\n| where TimeGenerated >= MountTime\n| partition hint.strategy=native by ReportId ( top 1 by MountTime )\n| order by DeviceId asc, TimeGenerated desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Exfiltration"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject293')._huntingQuerycontentId293),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 293",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject293')._huntingQuerycontentId293)]",
-                "contentId": "[variables('huntingQueryObject293')._huntingQuerycontentId293]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject293').huntingQueryVersion293]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject293')._huntingQuerycontentId293]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Files Copied to USB Drives",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject293')._huntingQuerycontentId293,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject293')._huntingQuerycontentId293,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject294').huntingQueryTemplateSpecName294]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "CVE-2022-26134-Confluence_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject294').huntingQueryVersion294]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_294",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Suspicious Tomcat Confluence Process Launch",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where InitiatingProcessFileName hasprefix \"tomcat\" and InitiatingProcessCommandLine has \"confluence\"\n| where (ProcessCommandLine has_any(\"certutil\", \"whoami\", \"nltest\", \" dir \", \"curl\", \"ifconfig\", \"cat \", \"net user\",\n\"net time /domain\",\"tasklist\",\"-c ls\",\"ipconfig\",\"arp\",\"ping\",\"net view\",\"net group\",\"netstat\", \"wmic datafile\"))\nor (FileName =~ \"powershell.exe\" and ProcessCommandLine hasprefix \"-e\") \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,PrivilegeEscalation"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1203"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject294')._huntingQuerycontentId294),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 294",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject294')._huntingQuerycontentId294)]",
-                "contentId": "[variables('huntingQueryObject294')._huntingQuerycontentId294]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject294').huntingQueryVersion294]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject294')._huntingQuerycontentId294]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Suspicious Tomcat Confluence Process Launch",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject294')._huntingQuerycontentId294,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject294')._huntingQuerycontentId294,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject295').huntingQueryTemplateSpecName295]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MosaicLoader_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject295').huntingQueryVersion295]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_295",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MosaicLoader",
-                "category": "Hunting Queries",
-                "query": "DeviceRegistryEvents \n| where ((ActionType == \"RegistryValueSet\") and (RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows Defender\\\\Exclusions\\\\Paths\" \nor RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Extensions\"\nor RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\"))\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CommandAndControl"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject295')._huntingQuerycontentId295),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 295",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject295')._huntingQuerycontentId295)]",
-                "contentId": "[variables('huntingQueryObject295')._huntingQuerycontentId295]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject295').huntingQueryVersion295]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject295')._huntingQuerycontentId295]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MosaicLoader",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject295')._huntingQuerycontentId295,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject295')._huntingQuerycontentId295,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject296').huntingQueryTemplateSpecName296]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SpoolsvSpawningRundll32_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject296').huntingQueryVersion296]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_296",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spoolsv Spawning Rundll32",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where InitiatingProcessParentFileName has \"spoolsv.exe\"\n| where InitiatingProcessFileName =~ \"rundll32.exe\"\n| where isempty(InitiatingProcessCommandLine) or InitiatingProcessCommandLine endswith \"rundll32.exe\" //either commandline is empty or just \"rundll32.exe\"\n| where FileName !in~ (\"WerFault.exe\")\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Look for the spoolsv.exe launching rundll32.exe with an empty command line."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation,Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject296')._huntingQuerycontentId296),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 296",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject296')._huntingQuerycontentId296)]",
-                "contentId": "[variables('huntingQueryObject296')._huntingQuerycontentId296]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject296').huntingQueryVersion296]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject296')._huntingQuerycontentId296]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spoolsv Spawning Rundll32",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject296')._huntingQuerycontentId296,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject296')._huntingQuerycontentId296,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject297').huntingQueryTemplateSpecName297]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SuspiciousDLLInSpoolFolder_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject297').huntingQueryVersion297]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_297",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Suspicious DLLs in spool Folder",
-                "category": "Hunting Queries",
-                "query": "DeviceFileEvents\n| where FolderPath contains @\"\\system32\\spool\\drivers\\x64\\3\\\"\n| where FileName endswith \".dll\"\n| where ActionType in (\"FileCreated\", \"FileRenamed\")\n| join kind=inner DeviceImageLoadEvents on DeviceId,DeviceName,FileName,InitiatingProcessFileName\n| where TimeGenerated1 >= TimeGenerated and FolderPath1 contains @\"\\system32\\spool\\drivers\\x64\\3\\Old\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Look for the creation of suspicious DLL files spawned in the \\spool\\ folder along with DLLs that were recently loaded afterwards from \\Old."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation,Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject297')._huntingQuerycontentId297),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 297",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject297')._huntingQuerycontentId297)]",
-                "contentId": "[variables('huntingQueryObject297')._huntingQuerycontentId297]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject297').huntingQueryVersion297]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject297')._huntingQuerycontentId297]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Suspicious DLLs in spool Folder",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject297')._huntingQuerycontentId297,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject297')._huntingQuerycontentId297,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject298').huntingQueryTemplateSpecName298]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SuspiciousFilesInSpoolFolder_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject298').huntingQueryVersion298]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_298",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Suspicious Files in spool Folder",
-                "category": "Hunting Queries",
-                "query": "DeviceFileEvents\n| where FolderPath has @\"System32\\spool\\drivers\"\n| project DeviceName, TimeGenerated, ActionType, FolderPath, FileName, SHA1\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation,Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject298')._huntingQuerycontentId298),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 298",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject298')._huntingQuerycontentId298)]",
-                "contentId": "[variables('huntingQueryObject298')._huntingQuerycontentId298]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject298').huntingQueryVersion298]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject298')._huntingQuerycontentId298]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Suspicious Files in spool Folder",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject298')._huntingQuerycontentId298,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject298')._huntingQuerycontentId298,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject299').huntingQueryTemplateSpecName299]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SuspiciousSpoolsvChildProcess_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject299').huntingQueryVersion299]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_299",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Suspicious Spoolsv Child Process",
-                "category": "Hunting Queries",
-                "query": "// Look for file load events for spoolsv\nDeviceImageLoadEvents\n| where TimeGenerated > ago(7d)\n| where InitiatingProcessFileName =~ \"spoolsv.exe\"\n| where FolderPath has @\"spool\\drivers\"\n| extend LoadFileTime = TimeGenerated\n| distinct DeviceId, LoadFileTime, FileName, SHA256\n// Join process data associated with spoolsv launching suspicious processes after image load\n| join DeviceProcessEvents on $left.DeviceId == $right.DeviceId\n| where TimeGenerated > ago(7d)\n| where TimeGenerated < LoadFileTime +5m\n| where InitiatingProcessFileName =~ \"spoolsv.exe\"\n| where ProcessIntegrityLevel =~ 'SYSTEM'\n| where (FileName1 in~(\"gpupdate.exe\", \"whoami.exe\", \"nltest.exe\", \"taskkill.exe\",\n            \"wmic.exe\", \"taskmgr.exe\", \"sc.exe\", \"findstr.exe\", \"curl.exe\", \"wget.exe\", \"certutil.exe\", \"bitsadmin.exe\", \"accesschk.exe\",\n            \"wevtutil.exe\", \"bcdedit.exe\", \"fsutil.exe\", \"cipher.exe\", \"schtasks.exe\", \"write.exe\", \"wuauclt.exe\") or \n// Processes with specific FPs removed          \n(FileName1 =~ \"net.exe\" and ProcessCommandLine !has \"start\") or \n(FileName1 =~ \"cmd.exe\" and not(ProcessCommandLine has_any(\".spl\", \"route add\", \"program files\"))) or \n(FileName1 =~ \"netsh.exe\" and not(ProcessCommandLine has_any(\"add portopening\", \"rule name\")))) or\n(FileName1 =~ \"powershell.exe\" and ProcessCommandLine!has \".spl\") or\n(FileName1 =~ \"rundll32.exe\" and ProcessCommandLine != \"\" and ProcessCommandLine !contains \" \")\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation,Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject299')._huntingQuerycontentId299),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 299",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject299')._huntingQuerycontentId299)]",
-                "contentId": "[variables('huntingQueryObject299')._huntingQuerycontentId299]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject299').huntingQueryVersion299]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject299')._huntingQuerycontentId299]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Suspicious Spoolsv Child Process",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject299')._huntingQuerycontentId299,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject299')._huntingQuerycontentId299,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject300').huntingQueryTemplateSpecName300]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "PrintNightmareUsageDetection-CVE-2021-1675_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject300').huntingQueryVersion300]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_300",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "PrintNightmare CVE-2021-1675 usage Detection",
-                "category": "Hunting Queries",
-                "query": "DeviceFileEvents\n| where Timestamp > ago(7d)\n| where ActionType == \"FileCreated\"\n| where FolderPath startswith \"C:\\\\WINDOWS\\\\SYSTEM32\\\\SPOOL\\\\drivers\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looks for any file creations in the print spooler drivers folder."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation,LateralMovement,Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject300')._huntingQuerycontentId300),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 300",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject300')._huntingQuerycontentId300)]",
-                "contentId": "[variables('huntingQueryObject300')._huntingQuerycontentId300]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject300').huntingQueryVersion300]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject300')._huntingQuerycontentId300]",
-        "contentKind": "HuntingQuery",
-        "displayName": "PrintNightmare CVE-2021-1675 usage Detection",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject300')._huntingQuerycontentId300,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject300')._huntingQuerycontentId300,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject301').huntingQueryTemplateSpecName301]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SuspiciousFileCreationByPrintSpoolerService_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject301').huntingQueryVersion301]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_301",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Windows Print Spooler Service Suspicious File Creation",
-                "category": "Hunting Queries",
-                "query": "DeviceFileEvents\n| where TimeGenerated > ago(7d)\n| where ActionType == \"FileCreated\"\n| where FileName endswith \".dll\"\n| where FolderPath startswith \"C:\\\\WINDOWS\\\\SYSTEM32\\\\SPOOL\\\\drivers\\\\x64\\\\\\3\\\\\"\n   or FolderPath startswith \"C:\\\\WINDOWS\\\\SYSTEM32\\\\SPOOL\\\\drivers\\\\x64\\\\\\4\\\\\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "The query digs in Windows print spooler drivers folder for any file creations. This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation,LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1574"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject301')._huntingQuerycontentId301),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 301",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject301')._huntingQuerycontentId301)]",
-                "contentId": "[variables('huntingQueryObject301')._huntingQuerycontentId301]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject301').huntingQueryVersion301]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject301')._huntingQuerycontentId301]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Windows Print Spooler Service Suspicious File Creation",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject301')._huntingQuerycontentId301,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject301')._huntingQuerycontentId301,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject302').huntingQueryTemplateSpecName302]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MITRESuspiciousEvents_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject302').huntingQueryVersion302]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_302",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "MITRE - Suspicious Events",
-                "category": "Hunting Queries",
-                "query": "let weights = dynamic({\"Low\":1, \"Medium\":3, \"High\":5}); //Assign weights to the risk levels\n//Low risk events\nlet lowRiskEvents =\n    DeviceProcessEvents \n    | where\n        (FileName =~ \"powershell.exe\" and ProcessCommandLine has \"-command\") //T1086 PowerShell\n        or\n        (FileName =~ \"powershell.exe\" and ProcessCommandLine contains \"-nop\") //T1086 PowerShell\n        or\n        (FileName =~ \"schtasks.exe\" and ProcessCommandLine has \"create\") //T1053 Scheduled Task\n        or\n        (FileName =~ \"installutil.exe\") //T1118 InstallUtil\n        or\n        (FileName =~ \"msbuild.exe\") //T1127 Trusted Developer Utilities\n        or\n        (FileName =~ \"nbtstat.exe\") //T1016 System Network Configuration Discovery\n        or\n        (FileName == \"mshta.exe\") //T1170 Mshta\n        or\n        (FileName =~ \"netsh.exe\") //T1089 Disabling Security Tools, T1063 Security Software Discovery\n        or\n        (FileName == \"net.exe\" and ProcessCommandLine has \" start \") //T1007 System Service Discovery\n    | extend Weight = toint((weights[\"Low\"]));\n//Medium risk events\nlet mediumRiskEvents =\n    DeviceProcessEvents \n    | where\n        (FileName =~ \"regsvcs.exe\") //T1121 Regsvcs/Regasm\n        or\n        (FileName =~ \"arp.exe\" and ProcessCommandLine has \"-a\") //T1016 System Network Configuration Discovery\n        or\n        (FileName =~ \"ipconfig.exe\" and ProcessCommandLine has \"all\") //T1016 System Network Configuration Discovery\n        or\n        (FileName startswith \"psexe\") //T1035 Service Execution\n        or\n        (FileName == \"net.exe\" and ProcessCommandLine has \" share \") //T1135 Network Share Discovery\n        or\n        (FileName =~ \"netsh.exe\" and ProcessCommandLine has \"interface show\") //T1016 System Network Configuration Discovery\n    | extend Weight = toint((weights[\"Medium\"]));\n//Higher risk events\nlet highRiskEvents =\n    DeviceProcessEvents \n    | where\n        (FileName =~ \"net.exe\" and ProcessCommandLine has \"config\") //T1016 System Network Configuration Discovery\n        or\n        (FileName =~ \"net.exe\" and ProcessCommandLine has \"time\") //T1124 System Time Discovery\n        or \n        (FileName =~ \"w32tm.exe\" and ProcessCommandLine has \"/tz\") //T1124 System Time Discovery\n        or\n        (FileName == \"cmstp.exe\") //T1191 CMSTP\n        or\n        (FileName =~ \"netsh.exe\" and (ProcessCommandLine has \"portproxy\" or ProcessCommandLine has \"p\")) //T1090 Connection Proxy\n    | extend Weight = toint((weights[\"High\"]));\nunion kind=outer lowRiskEvents, mediumRiskEvents, highRiskEvents\n| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, Weight\n| summarize Start_Time=min(TimeGenerated), End_Time=max(TimeGenerated), Weight_Sum=sum(Weight), Processes=make_set(FileName, 100000), Commands=make_set(ProcessCommandLine, 100000) by DeviceName\n| where Weight_Sum > 30\n| sort by Weight_Sum desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query looks for several different MITRE techniques, grouped by risk level. A weighting is applied to each risk level and a total score calculated per machine. Techniques can be added/removed as required."
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject302')._huntingQuerycontentId302),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 302",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject302')._huntingQuerycontentId302)]",
-                "contentId": "[variables('huntingQueryObject302')._huntingQuerycontentId302]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject302').huntingQueryVersion302]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject302')._huntingQuerycontentId302]",
-        "contentKind": "HuntingQuery",
-        "displayName": "MITRE - Suspicious Events",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject302')._huntingQuerycontentId302,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject302')._huntingQuerycontentId302,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject303').huntingQueryTemplateSpecName303]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AnomalousVoulmeOfFileDeletion_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject303').huntingQueryVersion303]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_303",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Unusual Volume of file deletion by users",
-                "category": "Hunting Queries",
-                "query": "let relevantOperations = pack_array(\"FileDeleted\", \"FileRecycled\", \"FileDeletedFirstStageRecycleBin\", \"FileDeletedSecondStageRecycleBin\", \"FileVersionsAllMinorsRecycled\", \"FileVersionRecycled\", \"FileVersionsAllRecycled\");\nlet relevantAppIds = pack_array(int(20892), int(15600)); // App Ids for SharePoint and OneDrive\nlet timeWindow = 7d;\nlet timeNow = now();\n//\nlet riskyUsers= // Look for users with risky sign-ins\n  SigninLogs    \n  | where CreatedDateTime between ((timeNow - timeWindow) .. (timeNow))\n  | where isnotempty(UserId) and isnotempty(OriginalRequestId)\n  | where ResultType == '0'\n  | where RiskLevelDuringSignIn == 'high'\n  | project UserId, RiskLevelDuringSignIn, CreatedDateTime, SessionId=OriginalRequestId\n  ;\nlet hasUsers = isnotempty(toscalar(riskyUsers));\n //\nlet deleteEvents = // look for file deletion activity and scope it to risky users\n  CloudAppEvents\n  | where hasUsers\n  | where TimeGenerated between ((timeNow - timeWindow) .. (timeNow))\n  | where ApplicationId in (relevantAppIds)\n  | where isnotempty(AccountObjectId)\n  | where AccountObjectId in (riskyUsers)\n  | where ActionType in (relevantOperations)\n  | extend SessionId= tostring(RawEventData.AppAccessContext.AADSessionId)\n  | where isnotempty(SessionId)\n  | project UserId=AccountObjectId, AccountDisplayName, ApplicationId, SessionId, ActionType, TimeGenerated, ReportId\n  ;   \n //\ndeleteEvents  \n| join kind=leftsemi riskyUsers on UserId, SessionId\n| summarize Count=count() , (Timestamp, ReportId)=arg_min(TimeGenerated, ReportId) by UserId, AccountDisplayName, ApplicationId, ActionType, Time=bin(TimeGenerated, 5m)\n// look for only those scoped users who have generated an increase in file deletion activity.\n| summarize TotalCount= countif(Count > 50), (Timestamp, ReportId)=arg_min(Timestamp, ReportId) by UserId, AccountDisplayName, ApplicationId \n| where TotalCount >= 3\n| project UserId, AccountDisplayName, ApplicationId, TotalCount, ReportId, Timestamp\n| extend NTDomain = tostring(split(AccountDisplayName,'\\\\',0)[0]), Name = tostring(split(AccountDisplayName,'\\\\',1)[0])\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Impact"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject303')._huntingQuerycontentId303),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 303",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject303')._huntingQuerycontentId303)]",
-                "contentId": "[variables('huntingQueryObject303')._huntingQuerycontentId303]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject303').huntingQueryVersion303]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject303')._huntingQuerycontentId303]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Unusual Volume of file deletion by users",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject303')._huntingQuerycontentId303,'-', '1.0.2')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject303')._huntingQuerycontentId303,'-', '1.0.2')))]",
-        "version": "1.0.2"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject304').huntingQueryTemplateSpecName304]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DetectMailSniper_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject304').huntingQueryVersion304]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_304",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Detect MaiSniper",
-                "category": "Hunting Queries",
-                "query": "let dateRange = ago(10d);\n//\nlet whoamiProcess = DeviceProcessEvents\n| where ProcessCreationTime >= dateRange\n| where FileName =~ 'whoami.exe' and InitiatingProcessParentFileName =~ 'powershell.exe'\n| project DeviceId, whoamiTime = ProcessCreationTime, whoamiProcessName = FileName, \nwhoamiParentName = InitiatingProcessParentFileName, whoamiParentPID = InitiatingProcessParentId;\n//\nlet netProcess = DeviceProcessEvents \n| where ProcessCreationTime >= dateRange\n| where FileName =~ 'net.exe' and InitiatingProcessParentFileName =~ 'powershell.exe'\n| project DeviceId, netTime = ProcessCreationTime, ProcessCreationTime = FileName, \nnetParentName = InitiatingProcessParentFileName, netParentPID = InitiatingProcessParentId;\n//\nlet mailServerEvents = DeviceNetworkEvents\n| where TimeGenerated >= dateRange\n| where InitiatingProcessFileName =~ 'powershell.exe'\n| where RemoteUrl contains 'onmicrosoft.com'\nor RemoteUrl contains 'outlook.com'\n| project DeviceId, mailTime = TimeGenerated, mailProcessName = InitiatingProcessFileName, \nmailPID = InitiatingProcessId;\n//\nmailServerEvents\n| join netProcess on DeviceId \n| where netParentPID == mailPID and netParentName == mailProcessName \n| join whoamiProcess on DeviceId \n| where whoamiParentPID == mailPID and whoamiParentName == mailProcessName \n| where netTime < mailTime + 4h and netTime > mailTime - 4h\n| where whoamiTime < mailTime + 4h and whoamiTime > mailTime - 4h\n| project DeviceId, EstimatedIncidentTime = mailTime, ProcessName = mailProcessName, \nProcessID = mailPID\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for usage of MailSniper Exchange attack tool."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,CredentialAccess,Collection,Exfiltration"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject304')._huntingQuerycontentId304),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 304",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject304')._huntingQuerycontentId304)]",
-                "contentId": "[variables('huntingQueryObject304')._huntingQuerycontentId304]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject304').huntingQueryVersion304]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject304')._huntingQuerycontentId304]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Detect MaiSniper",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject304')._huntingQuerycontentId304,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject304')._huntingQuerycontentId304,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject305').huntingQueryTemplateSpecName305]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AccountBruteForce_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject305').huntingQueryVersion305]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_305",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Account Brute Force",
-                "category": "Hunting Queries",
-                "query": "DeviceLogonEvents\n| where isnotempty(RemoteIP) \n    and AccountName !endswith \"$\"\n    and RemoteIPType == \"Public\"\n| extend Account=strcat(AccountDomain, \"\\\\\", AccountName)\n| summarize \n    Successful=countif(ActionType == \"LogonSuccess\"),\n    Failed = countif(ActionType == \"LogonFailed\"),\n    FailedAccountsCount = dcountif(Account, ActionType == \"LogonFailed\"),\n    SuccessfulAccountsCount = dcountif(Account, ActionType == \"LogonSuccess\"),\n    FailedAccounts = make_set(iff(ActionType == \"LogonFailed\", Account, \"\"), 5),\n    SuccessfulAccounts = make_set(iff(ActionType == \"LogonSuccess\", Account, \"\"), 5)\n    by DeviceName, RemoteIP, RemoteIPType\n| where Failed > 10 and Successful > 0 and FailedAccountsCount > 2 and SuccessfulAccountsCount == 1\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query searches for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded."
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject305')._huntingQuerycontentId305),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 305",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject305')._huntingQuerycontentId305)]",
-                "contentId": "[variables('huntingQueryObject305')._huntingQuerycontentId305]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject305').huntingQueryVersion305]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject305')._huntingQuerycontentId305]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Account Brute Force",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject305')._huntingQuerycontentId305,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject305')._huntingQuerycontentId305,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject306').huntingQueryTemplateSpecName306]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "RemoteFileCreationWithPsExec_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject306').huntingQueryVersion306]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_306",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Remote File Creation with PsExec",
-                "category": "Hunting Queries",
-                "query": "// Find PsExec creating multiple files on remote machines in a 10-minute window\nDeviceFileEvents\n| where TimeGenerated > ago(7d)\n// Looking for PsExec by accepteula command flag\n| where InitiatingProcessCommandLine has \"accepteula\"\n// Remote machines and file is exe\n| where FolderPath has \"\\\\\\\\\" and FileName endswith \".exe\"\n| extend Exe = countof(InitiatingProcessCommandLine, \".exe\")\n// Checking to see if command line has 2 .exe or .bat\n| where InitiatingProcessCommandLine !has \".ps1\" and Exe > 1 or\nInitiatingProcessCommandLine has \".bat\"\n// Exclusions: Remove the following line to widen scope of AHQ\n| where not(InitiatingProcessCommandLine has_any(\"batch\", \"auditpol\",\n\"script\", \"scripts\", \"illusive\", \"rebootrequired\"))\n| summarize FileCount = dcount(FolderPath), make_set(SHA1, 100000), make_set(FolderPath, 100000),\nmake_set(FileName, 100000), make_set(InitiatingProcessCommandLine, 100000) by DeviceId,\nTimeWindow=bin(TimeGenerated, 10m), InitiatingProcessFileName\n| where FileCount > 4\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query detects remote file creation events that might indicate an active attack using PsExec."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "LateralMovement"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject306')._huntingQuerycontentId306),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 306",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject306')._huntingQuerycontentId306)]",
-                "contentId": "[variables('huntingQueryObject306')._huntingQuerycontentId306]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject306').huntingQueryVersion306]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject306')._huntingQuerycontentId306]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Remote File Creation with PsExec",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject306')._huntingQuerycontentId306,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject306')._huntingQuerycontentId306,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject307').huntingQueryTemplateSpecName307]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ServiceAccountsPerformingRemotePS_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject307').huntingQueryVersion307]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_307",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Service Accounts Performing Remote PS",
-                "category": "Hunting Queries",
-                "query": "let InteractiveTypes = pack_array(                                  // Declare Interactive logon type names\n    'Interactive',\n    'CachedInteractive',\n    'Unlock',\n    'RemoteInteractive',\n    'CachedRemoteInteractive',\n    'CachedUnlock'\n);\nlet WhitelistedCmdlets = pack_array(                                // List of whitelisted commands that don't provide a lot of value\n    'prompt',\n    'Out-Default',\n    'out-lineoutput',\n    'format-default',\n    'Set-StrictMode',\n    'TabExpansion2'\n);\nlet WhitelistedAccounts = pack_array('FakeWhitelistedAccount');     // List of accounts that are known to perform this activity in the environment and can be ignored\nDeviceLogonEvents                                                         // Get all logon events...\n| where AccountName !in~ (WhitelistedAccounts)                      // ...where it is not a whitelisted account...\n| where ActionType == \"LogonSuccess\"                                // ...and the logon was successful...\n| where AccountName !contains \"$\"                                   // ...and not a machine logon.\n| where AccountName !has \"winrm va_\"                                // WinRM will have pseudo account names that match this if there is an explicit permission for an admin to run the cmdlet, so assume it is good.\n| extend IsInteractive=(LogonType in (InteractiveTypes))            // Determine if the logon is interactive (True=1,False=0)...\n| summarize HasInteractiveLogon=max(IsInteractive)                  // ...then bucket and get the maximum interactive value (0 or 1)...\n            by AccountName                                          // ... by the AccountNames\n| where HasInteractiveLogon == 0                                    // ...and filter out all accounts that had an interactive logon.\n// At this point, we have a list of accounts that we believe to be service accounts\n// Now we need to find RemotePS sessions that were spawned by those accounts\n// Note that we look at all powershell cmdlets executed to form a 29-day baseline to evaluate the data on today\n| join kind=rightsemi (                                             // Start by dropping the account name and only tracking the...\n\tDeviceEvents                                                      // ...\n\t| where ActionType == 'PowerShellCommand'                       // ...PowerShell commands seen...\n\t| where InitiatingProcessFileName =~ 'wsmprovhost.exe'          // ...whose parent was wsmprovhost.exe (RemotePS Server)...\n    | extend AccountName = InitiatingProcessAccountName             // ...and add an AccountName field so the join is easier\n) on AccountName\n// At this point, we have all of the commands that were ran by service accounts\n| extend Command = tostring(extractjson('$.Command', tostring(AdditionalFields)))   // Extract the actual PowerShell command that was executed\n| where Command !in (WhitelistedCmdlets)                            // Remove any values that match the whitelisted cmdlets\n| summarize (Timestamp, ReportId)=argmax(TimeGenerated, ReportId),      // Then group all of the cmdlets and calculate the min/max times of execution...\n    makeset(Command), count(), min(TimeGenerated) by                    // ...as well as creating a list of cmdlets ran and the count..\n    AccountName, DeviceName, DeviceId                            // ...and have the commonality be the account, DeviceName and DeviceId\n// At this point, we have machine-account pairs along with the list of commands run as well as the first/last time the commands were ran\n| order by AccountName asc                                          // Order the final list by AccountName just to make it easier to go through\n| where Timestamp > ago(1d)                                     // Included to restrict the scope for the custom detection page\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for any Service Accounts Performing Remote PowerShell."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "LateralMovement"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject307')._huntingQuerycontentId307),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 307",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject307')._huntingQuerycontentId307)]",
-                "contentId": "[variables('huntingQueryObject307')._huntingQuerycontentId307]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject307').huntingQueryVersion307]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject307')._huntingQuerycontentId307]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Service Accounts Performing Remote PS",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject307')._huntingQuerycontentId307,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject307')._huntingQuerycontentId307,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject308').huntingQueryTemplateSpecName308]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "AccountCreation_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject308').huntingQueryVersion308]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_308",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Account Creation",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n// Pro-tip: \n// There are many different ways to run a process from a file - e.g. by using full path, env. variables, ~1 annotation, more...\n// So, to find executions of a known filename, better filter on the filename (and possibly on folder path) than on the commandline.\n| where FileName in~ (\"net.exe\", \"net1.exe\") and TimeGenerated > ago(3d)\n// Parse the user name from the commandline.\n// To have case-insensitive parsing use the i flag, to have non-greedy match (e.g. CreatedUser as short as possible), specify U flag:\n// \"kind=regex flags=i\"\n| parse kind=regex flags=iU ProcessCommandLine with * \"user \" CreatedUser \" \" * \"/ad\"\n// Filter rows where user could not be parsed - e.g. because it was not a user command, or the /add commandline switch was not specified.\n| where isnotempty(CreatedUser)\n// Every net.exe executed will run net1.exe with the same commandline.\n// in this where clause we remove such rows, as they duplicate the number of results we have without adding any value.\n| where not (FileName =~ \"net1.exe\" and InitiatingProcessFileName =~ \"net.exe\" and replace(\"net\", \"net1\", InitiatingProcessCommandLine) =~ ProcessCommandLine)\n// If /domain is specified, so the user is created on the domain controller.\n// Also, any prefix that's longer than 1 char will also do the same, e.g. /do, /dom, /doma, ....\n| extend CreatedOnLocalMachine=(ProcessCommandLine !contains \"/do\")\n| where ProcessCommandLine !contains \"/add\" or (CreatedOnLocalMachine == 0 and ProcessCommandLine !contains \"/domain\")\n| summarize MachineCount=dcount(DeviceName) by CreatedUser, CreatedOnLocalMachine, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looks for the creation of user accounts on a machine using the \"net user\" command."
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject308')._huntingQuerycontentId308),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 308",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject308')._huntingQuerycontentId308)]",
-                "contentId": "[variables('huntingQueryObject308')._huntingQuerycontentId308]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject308').huntingQueryVersion308]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject308')._huntingQuerycontentId308]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Account Creation",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject308')._huntingQuerycontentId308,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject308')._huntingQuerycontentId308,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject309').huntingQueryTemplateSpecName309]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LocalAdminGroupChanges_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject309').huntingQueryVersion309]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_309",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Local Admin Group Changes",
-                "category": "Hunting Queries",
-                "query": "let ADAZUsers =  IdentityInfo \n| extend DirectoryDomain = AccountDomain \n| extend DirectoryAccount = AccountName \n| extend OnPremSid = AccountSID\n| distinct DirectoryDomain , DirectoryAccount , OnPremSid , AccountCloudSID, AccountUPN, GivenName, Surname;\n // check for any new created or modified local accounts \nlet NewUsers =  DeviceEvents\n| where ActionType contains \"UserAccountCreated\"  // or ActionType contains \"UserAccountModified\"\n| extend lUserAdded = AccountName\n| extend NewUserSID = AccountSid\n| extend laccountdomain = AccountDomain\n| distinct NewUserSID, lUserAdded,laccountdomain;\n// Check for any local group changes and enrich the data with the account name obtained from the previous query\nDeviceEvents \n| where ActionType == 'UserAccountAddedToLocalGroup' \n| extend AddedAccountSID = tostring(parse_json(AdditionalFields).MemberSid)\n| extend LocalGroup = AccountName\n| extend LocalGroupSID = AccountSid\n| extend Actor = trim(@\"[^\\w]+\",InitiatingProcessAccountName)\n// limit to local administrators group\n//  | where LocalGroupSID contains \"S-1-5-32-544\"\n| join kind= leftouter    (NewUsers)\non $left.AddedAccountSID == $right.NewUserSID\n| project TimeGenerated, DeviceName, LocalGroup,LocalGroupSID, AddedAccountSID, lUserAdded , Actor, ActionType , laccountdomain \n| join kind= leftouter        (ADAZUsers)\non $left.AddedAccountSID == $right.OnPremSid\n| extend UserAdded = iff(isnotempty(lUserAdded),strcat(laccountdomain,\"\\\\\", lUserAdded), strcat(DirectoryDomain,\"\\\\\", DirectoryAccount))\n| project TimeGenerated, DeviceName, LocalGroup,LocalGroupSID, AddedAccountSID, UserAdded , Actor, ActionType  \n| where DeviceName !contains Actor \n// Provide details on actors that added users\n// | summarize count()  by Actor \n// | join ADAZUsers\n// on $left.Actor == $right.DirectoryAccount \n// | render piechart \n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This hunting query searches for changes to the local administrators group."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject309')._huntingQuerycontentId309),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 309",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject309')._huntingQuerycontentId309)]",
-                "contentId": "[variables('huntingQueryObject309')._huntingQuerycontentId309]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject309').huntingQueryVersion309]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject309')._huntingQuerycontentId309]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Local Admin Group Changes",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject309')._huntingQuerycontentId309,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject309')._huntingQuerycontentId309,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject310').huntingQueryTemplateSpecName310]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "RareProcessAsService_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject310').huntingQueryVersion310]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_310",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Rare Process as a Service",
-                "category": "Hunting Queries",
-                "query": "let LookupTime = 30d;\nlet WhiteList = pack_array(\n\"svchost.exe\",\n\"mssense.exe\",\n\"msmpeng.exe\",\n\"searchindexer.exe\",\n\"microsoftedgeupdate.exe\"\n);\nlet GetServices = materialize (\nDeviceProcessEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, StartedChildProcess = FileName, StartedChildProcessSHA1 = SHA1, StartedChildProcessCmdline = ProcessCommandLine, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName\n);\nGetServices\n| summarize count() by ServiceProcess, DeviceName\n| where count_ < 6 \n| join kind = inner GetServices on ServiceProcess, DeviceName \n| join kind = leftouter ( \nDeviceNetworkEvents \n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, NetworkAction = ActionType, RemoteIP, RemoteUrl\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| join kind = leftouter (\nDeviceFileEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, FileAction = ActionType, ModifiedFile = FileName, ModifiedFileSHA1 = SHA1, ModifiedFilePath = FolderPath\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| join kind = leftouter (\nDeviceImageLoadEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, LoadedDLL = FileName, LoadedDLLSHA1 = SHA1, LoadedDLLPath = FolderPath\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| summarize ConnectedAddresses = make_set(RemoteIP, 100000), ConnectedUrls = make_set(RemoteUrl, 100000), FilesModified = make_set(ModifiedFile, 100000),FileModFolderPath = make_set(ModifiedFilePath, 100000),FileModHA1s = make_set(ModifiedFileSHA1, 100000), ChildProcesses = make_set(StartedChildProcess, 100000), ChildCommandlines = make_set(StartedChildProcessCmdline, 100000), DLLsLoaded = make_set(LoadedDLL, 100000), DLLSHA1 = make_set(LoadedDLLSHA1, 100000) by DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query looks for rarely seen processes which are launched as a service."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1543,T1543.003"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject310')._huntingQuerycontentId310),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 310",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject310')._huntingQuerycontentId310)]",
-                "contentId": "[variables('huntingQueryObject310')._huntingQuerycontentId310]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject310').huntingQueryVersion310]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject310')._huntingQuerycontentId310]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Rare Process as a Service",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject310')._huntingQuerycontentId310,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject310')._huntingQuerycontentId310,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject311').huntingQueryTemplateSpecName311]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ScheduledTaskCreation_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject311').huntingQueryVersion311]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_311",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Scheduled Task Creation",
-                "category": "Hunting Queries",
-                "query": "DeviceEvents \n| where ActionType == \"ScheduledTaskCreated\"\n  and InitiatingProcessAccountSid != \"S-1-5-18\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for any scheduled task creation event."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Persistence"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject311')._huntingQuerycontentId311),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 311",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject311')._huntingQuerycontentId311)]",
-                "contentId": "[variables('huntingQueryObject311')._huntingQuerycontentId311]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject311').huntingQueryVersion311]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject311')._huntingQuerycontentId311]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Scheduled Task Creation",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject311')._huntingQuerycontentId311,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject311')._huntingQuerycontentId311,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject312').huntingQueryTemplateSpecName312]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SAMNameChange_CVE-2021-42278_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject312').huntingQueryVersion312]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_312",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "SAM Name Change CVE-2021-42278",
-                "category": "Hunting Queries",
-                "query": "IdentityDirectoryEvents\n| where TimeGenerated > ago(1d)\n| where ActionType == \"SAM Account Name changed\"\n| extend FROMSAM = parse_json(AdditionalFields)['FROM SAM Account Name']\n| extend TOSAM = parse_json(AdditionalFields)['TO SAM Account Name']\n| where (FROMSAM has \"$\" and TOSAM !has \"$\") \n        or TOSAM in (\"DC1\", \"DC2\", \"DC3\", \"DC4\") // DC Names in the org\n| project TimeGenerated, Application, ActionType, TargetDeviceName, FROMSAM, TOSAM, ReportId, AdditionalFields\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "PrivilegeEscalation,Vulnerability"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject312')._huntingQuerycontentId312),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 312",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject312')._huntingQuerycontentId312)]",
-                "contentId": "[variables('huntingQueryObject312')._huntingQuerycontentId312]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject312').huntingQueryVersion312]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject312')._huntingQuerycontentId312]",
-        "contentKind": "HuntingQuery",
-        "displayName": "SAM Name Change CVE-2021-42278",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject312')._huntingQuerycontentId312,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject312')._huntingQuerycontentId312,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject313').huntingQueryTemplateSpecName313]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DataDeletionOnMulipleDrivesUsingCipherExe_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject313').huntingQueryVersion313]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_313",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Deletion of data on multiple drives using cipher exe",
-                "category": "Hunting Queries",
-                "query": "// Look for cipher.exe deleting data from multiple drives\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"cipher.exe\" \n// cipher.exe /w flag used for deleting data \n| where ProcessCommandLine has \"/w\" \n| summarize CipherCount = dcount(ProcessCommandLine),\nCipherList = make_set(ProcessCommandLine, 1000) by DeviceId, bin(TimeGenerated, 1m) \n// cipher.exe accessing multiple drives in a short timeframe  \n| where CipherCount > 1\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Impact"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject313')._huntingQuerycontentId313),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 313",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject313')._huntingQuerycontentId313)]",
-                "contentId": "[variables('huntingQueryObject313')._huntingQuerycontentId313]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject313').huntingQueryVersion313]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject313')._huntingQuerycontentId313]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Deletion of data on multiple drives using cipher exe",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject313')._huntingQuerycontentId313,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject313')._huntingQuerycontentId313,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject314').huntingQueryTemplateSpecName314]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DetectMultipleSignsOfRamsomwareActivity_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject314').huntingQueryVersion314]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_314",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Check for multiple signs of Ransomware Activity",
-                "category": "Hunting Queries",
-                "query": "// Find attempts to stop processes using taskkill.exe\nlet taskKill = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"taskkill.exe\" \n| summarize taskKillCount = dcount(tostring(ProcessCommandLine)), TaskKillList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 2m)\n| where taskKillCount > 10;\n// Find attempts to stop processes using net stop\nlet netStop = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"net.exe\" and ProcessCommandLine has \"stop\"\n| summarize netStopCount = dcount(tostring(ProcessCommandLine)), NetStopList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 2m)\n| where netStopCount > 10;\n// Look for cipher.exe deleting data from multiple drives\nlet cipher = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"cipher.exe\" \n// cipher.exe /w flag used for deleting data \n| where ProcessCommandLine has \"/w\" \n| summarize CipherCount = dcount(tostring(ProcessCommandLine)), \nCipherList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 1m) \n// cipher.exe accessing multiple drives in a short timeframe \n| where CipherCount > 1;\n// Look for use of wevtutil to clear multiple logs\nlet wevtutilClear = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where ProcessCommandLine has \"WEVTUTIL\" and ProcessCommandLine has \"CL\"\n| summarize LogClearCount = dcount(tostring(ProcessCommandLine)), ClearedLogList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 5m)\n| where LogClearCount > 10;\n// Look for sc.exe disabling services\nlet scDisable = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where ProcessCommandLine has \"sc\" and ProcessCommandLine has \"config\" and ProcessCommandLine has \"disabled\"\n| summarize ScDisableCount = dcount(tostring(ProcessCommandLine)), ScDisableList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 5m)\n| where ScDisableCount > 10;\n// Main query for counting and aggregating evidence\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"vssadmin.exe\" and ProcessCommandLine has_any(\"list shadows\", \"delete shadows\")\nor FileName =~ \"fsutil.exe\" and ProcessCommandLine has \"usn\" and ProcessCommandLine has \"deletejournal\"\nor ProcessCommandLine has(\"bcdedit\") and ProcessCommandLine has_any(\"recoveryenabled no\", \"bootstatuspolicy ignoreallfailures\")\nor ProcessCommandLine has \"wbadmin\" and ProcessCommandLine has \"delete\" and ProcessCommandLine has_any(\"backup\", \"catalog\", \"systemstatebackup\")\nor (ProcessCommandLine has \"wevtutil\" and ProcessCommandLine has \"cl\") \nor (ProcessCommandLine has \"wmic\" and ProcessCommandLine has \"shadowcopy delete\")\nor (ProcessCommandLine has \"sc\" and ProcessCommandLine has \"config\" and ProcessCommandLine has \"disabled\")\n| extend Bcdedit = iff(ProcessCommandLine has \"bcdedit\" and ProcessCommandLine has_any(\"recoveryenabled no\", \"bootstatuspolicy ignoreallfailures\"), 1, 0)\n| extend ShadowCopyDelete = iff (ProcessCommandLine has \"shadowcopy delete\", 1, 0)\n| extend VssAdminShadows = iff(ProcessCommandLine has \"vssadmin\" and ProcessCommandLine has_any(\"list shadows\", \"delete shadows\"), 1, 0)\n| extend Wbadmin = iff(ProcessCommandLine has \"wbadmin\" and ProcessCommandLine has \"delete\" and ProcessCommandLine has_any(\"backup\", \"catalog\", \"systemstatebackup\"), 1,0)\n| extend Fsutil = iff(ProcessCommandLine has \"fsutil\" and ProcessCommandLine has \"usn\" and ProcessCommandLine has \"deletejournal\", 1, 0)\n| summarize FirstActivity = min(TimeGenerated), ReportId = any(ReportId), Commands = make_set(ProcessCommandLine) by DeviceId, Fsutil, Wbadmin, ShadowCopyDelete, Bcdedit, VssAdminShadows, bin(TimeGenerated, 6h)\n// Joining extra evidence\n| join kind=leftouter (wevtutilClear) on $left.DeviceId == $right.DeviceId\n| join kind=leftouter (cipher) on $left.DeviceId == $right.DeviceId\n| join kind=leftouter (netStop) on $left.DeviceId == $right.DeviceId\n| join kind=leftouter (taskKill) on $left.DeviceId == $right.DeviceId\n| join kind=leftouter (scDisable) on $left.DeviceId == $right.DeviceId\n| extend WevtutilUse = iff(LogClearCount > 10, 1, 0)\n| extend CipherUse = iff(CipherCount > 1, 1, 0)\n| extend NetStopUse = iff(netStopCount > 10, 1, 0)\n| extend TaskkillUse = iff(taskKillCount > 10, 1, 0)\n| extend ScDisableUse = iff(ScDisableCount > 10, 1, 0)\n// Adding up all evidence\n| mv-expand CommandList = NetStopList, TaskKillList, ClearedLogList, CipherList, Commands, ScDisableList\n// Format results\n| summarize BcdEdit = iff(make_set(Bcdedit) contains \"1\" , 1, 0), NetStop10PlusCommands = iff(make_set(NetStopUse) contains \"1\", 1, 0), Wevtutil10PlusLogsCleared = iff(make_set(WevtutilUse) contains \"1\", 1, 0),\nCipherMultipleDrives = iff(make_set(CipherUse) contains \"1\", 1, 0), Fsutil = iff(make_set(Fsutil) contains \"1\", 1, 0), ShadowCopyDelete = iff(make_set(ShadowCopyDelete) contains \"1\", 1, 0),\nWbadmin = iff(make_set(Wbadmin) contains \"1\", 1, 0), TaskKill10PlusCommand = iff(make_set(TaskkillUse) contains \"1\", 1, 0), VssAdminShadow = iff(make_set(VssAdminShadows) contains \"1\", 1, 0), \nScDisable = iff(make_set(ScDisableUse) contains \"1\", 1, 0), TotalEvidenceCount = dcount(tostring(CommandList)), EvidenceList = make_set(Commands), StartofBehavior = min(FirstActivity) by DeviceId, bin(TimeGenerated, 1d)\n| extend UniqueEvidenceCount = BcdEdit + NetStop10PlusCommands + Wevtutil10PlusLogsCleared + CipherMultipleDrives + Wbadmin + Fsutil + TaskKill10PlusCommand + VssAdminShadow + ScDisable + ShadowCopyDelete\n| where UniqueEvidenceCount > 2\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query checks for multiple signs of ransomware activity to identify affected devices."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,Impact,Exfiltration"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject314')._huntingQuerycontentId314),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 314",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject314')._huntingQuerycontentId314)]",
-                "contentId": "[variables('huntingQueryObject314')._huntingQuerycontentId314]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject314').huntingQueryVersion314]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject314')._huntingQuerycontentId314]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Check for multiple signs of Ransomware Activity",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject314')._huntingQuerycontentId314,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject314')._huntingQuerycontentId314,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject315').huntingQueryTemplateSpecName315]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DisableSecurityServiceViaRegistry_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject315').huntingQueryVersion315]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_315",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Disabling Services via Registry",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents\n| where InitiatingProcessCommandLine has_all(@'\"reg\"', 'add', @'\"HKLM\\SOFTWARE\\Policies\\', '/v','/t', 'REG_DWORD', '/d', '/f')\n  and InitiatingProcessCommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', \n  'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource')\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Search for processes modifying the registry to disable security features."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject315')._huntingQuerycontentId315),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 315",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject315')._huntingQuerycontentId315)]",
-                "contentId": "[variables('huntingQueryObject315')._huntingQuerycontentId315]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject315').huntingQueryVersion315]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject315')._huntingQuerycontentId315]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Disabling Services via Registry",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject315')._huntingQuerycontentId315,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject315')._huntingQuerycontentId315,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject316').huntingQueryTemplateSpecName316]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "DomainDiscoveryWMICwithDLLHostExe_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject316').huntingQueryVersion316]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_316",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "DLLHost.exe WMIC domain discovery",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName =~ \"dllhost.exe\" and InitiatingProcessCommandLine == \"dllhost.exe\" \n| where ProcessCommandLine has \"wmic computersystem get domain\"\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query checks for dllhost.exe calling WMIC to discover additional hosts and associated domain."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Reconnaissance"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject316')._huntingQuerycontentId316),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 316",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject316')._huntingQuerycontentId316)]",
-                "contentId": "[variables('huntingQueryObject316')._huntingQuerycontentId316]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject316').huntingQueryVersion316]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject316')._huntingQuerycontentId316]",
-        "contentKind": "HuntingQuery",
-        "displayName": "DLLHost.exe WMIC domain discovery",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject316')._huntingQuerycontentId316,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject316')._huntingQuerycontentId316,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject317').huntingQueryTemplateSpecName317]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MDEExclusionUsingPowerShell_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject317').huntingQueryVersion317]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_317",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "PowerShell adding exclusion path for Microsoft Defender of ProgramData",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where FileName =~ \"powershell.exe\" and ProcessCommandLine has_all(\"try\", \"Add-MpPreference\", \"-ExclusionPath\", \"ProgramData\", \"catch\")\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject317')._huntingQuerycontentId317),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 317",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject317')._huntingQuerycontentId317)]",
-                "contentId": "[variables('huntingQueryObject317')._huntingQuerycontentId317]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject317').huntingQueryVersion317]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject317')._huntingQuerycontentId317]",
-        "contentKind": "HuntingQuery",
-        "displayName": "PowerShell adding exclusion path for Microsoft Defender of ProgramData",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject317')._huntingQuerycontentId317,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject317')._huntingQuerycontentId317,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject318').huntingQueryTemplateSpecName318]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "IcedIdSuspiciousImageLoad_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject318').huntingQueryVersion318]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_318",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Suspicious Image Load related to IcedId",
-                "category": "Hunting Queries",
-                "query": "DeviceImageLoadEvents \n| where InitiatingProcessFileName in~ ('rundll32.exe','regsvr32.exe') \n| where FileName endswith '.txt' or FileName endswith '.pdf'\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to IcedId ransomware."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject318')._huntingQuerycontentId318),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 318",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject318')._huntingQuerycontentId318)]",
-                "contentId": "[variables('huntingQueryObject318')._huntingQuerycontentId318]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject318').huntingQueryVersion318]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject318')._huntingQuerycontentId318]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Suspicious Image Load related to IcedId",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject318')._huntingQuerycontentId318,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject318')._huntingQuerycontentId318,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject319').huntingQueryTemplateSpecName319]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LaZagneCredTheft_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject319').huntingQueryVersion319]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_319",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "LaZagne Credential Theft",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where FileName =~ 'reg.exe'\n| where ProcessCommandLine has_all('save','hklm','sam')\n| project DeviceId, TimeGenerated, InitiatingProcessId, InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query can be used to locate processes executing credential theft activity, often LaZagne in ransomware compromises."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "CredentialAccess"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject319')._huntingQuerycontentId319),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 319",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject319')._huntingQuerycontentId319)]",
-                "contentId": "[variables('huntingQueryObject319')._huntingQuerycontentId319]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject319').huntingQueryVersion319]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject319')._huntingQuerycontentId319]",
-        "contentKind": "HuntingQuery",
-        "displayName": "LaZagne Credential Theft",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject319')._huntingQuerycontentId319,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject319')._huntingQuerycontentId319,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject320').huntingQueryTemplateSpecName320]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "LogDeletionUsingWevtutil_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject320').huntingQueryVersion320]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_320",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Clearing of forensic evidence from event logs using wevtutil",
-                "category": "Hunting Queries",
-                "query": "// Look for use of wevtutil to clear multiple logs\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where ProcessCommandLine has \"WEVTUTIL\" and ProcessCommandLine has \"CL\"\n| summarize LogClearCount = dcount(tostring(ProcessCommandLine)), ClearedLogList = make_set(ProcessCommandLine, 100000) by DeviceId, bin(TimeGenerated, 5m)\n| where LogClearCount > 10\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query checks for attempts to clear at least 10 log entries from event logs using wevtutil."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject320')._huntingQuerycontentId320),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 320",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject320')._huntingQuerycontentId320)]",
-                "contentId": "[variables('huntingQueryObject320')._huntingQuerycontentId320]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject320').huntingQueryVersion320]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject320')._huntingQuerycontentId320]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Clearing of forensic evidence from event logs using wevtutil",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject320')._huntingQuerycontentId320,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject320')._huntingQuerycontentId320,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject321').huntingQueryTemplateSpecName321]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MultiProcessKillWithTaskKill_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject321').huntingQueryVersion321]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_321",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Stopping multiple processes using taskkill",
-                "category": "Hunting Queries",
-                "query": "// Find attempts to stop processes using taskkill.exe\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"taskkill.exe\" \n| summarize taskKillCount = dcount(ProcessCommandLine), TaskKillList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 2m)\n| where taskKillCount > 10\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject321')._huntingQuerycontentId321),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 321",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject321')._huntingQuerycontentId321)]",
-                "contentId": "[variables('huntingQueryObject321')._huntingQuerycontentId321]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject321').huntingQueryVersion321]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject321')._huntingQuerycontentId321]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Stopping multiple processes using taskkill",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject321')._huntingQuerycontentId321,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject321')._huntingQuerycontentId321,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject322').huntingQueryTemplateSpecName322]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "PotentialCobaltStrikeRansomwareActivity_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject322').huntingQueryVersion322]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_322",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Potential Ransomware activity related to Cobalt Strike",
-                "category": "Hunting Queries",
-                "query": "// Look for sc.exe disabling services\nAlertInfo \n// Attempts to clear security event logs. \n| where Title in(\"Event log was cleared\", \n// List alerts flagging attempts to delete backup files. \n\"File backups were deleted\", \n// Potential Cobalt Strike activity - Note that other threat activity can also \n// trigger alerts for suspicious decoded content \n\"Suspicious decoded content\", \n// Cobalt Strike activity \n\"\\'Atosev\\' malware was detected\", \n\"\\'Ploty\\' malware was detected\", \n\"\\'Bynoco\\' malware was detected\",\n\"\\'Cobaltstrike\\' malware was detected\",\n\"Echo command over pipe on localhost\",\n\"Known attack framework activity was observed\",\n\"An active \\'Cobaltstrike\\' malware was detected\",\n\"Suspicious \\'CobaltStrike\\' behavior was prevented\",\n\"Suspicious process launch by Rundll32.exe\") \n| extend AlertTime = TimeGenerated | distinct AlertTime, AlertId, Title \n| join AlertEvidence on $left.AlertId == $right.AlertId\n| summarize by DeviceId, AlertTime, Title, AlertId\n// Get device IDs\n| join DeviceLogonEvents on $left.DeviceId == $right.DeviceId \n// Creating 10 day Window surrounding alert activity \n| where TimeGenerated < AlertTime +5d and TimeGenerated > AlertTime - 5d // Projecting specific columns \n| project Title, DeviceName, DeviceId, TimeGenerated, LogonType, AccountDomain, AccountName, AccountSid, AlertTime, AlertId, RemoteIP, RemoteDeviceName\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution,Persistence"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject322')._huntingQuerycontentId322),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 322",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject322')._huntingQuerycontentId322)]",
-                "contentId": "[variables('huntingQueryObject322')._huntingQuerycontentId322]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject322').huntingQueryVersion322]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject322')._huntingQuerycontentId322]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Potential Ransomware activity related to Cobalt Strike",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject322')._huntingQuerycontentId322,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject322')._huntingQuerycontentId322,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject323').huntingQueryTemplateSpecName323]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "QakbotDiscoveryActivities_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject323').huntingQueryVersion323]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_323",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Qakbot Discovery Activies",
-                "category": "Hunting Queries",
-                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName in~('mobsync.exe','explorer.exe')\n| where (FileName =~ 'net.exe' and InitiatingProcessCommandLine has_all('view','/all'))\n     or (FileName =~ 'whoami.exe' and InitiatingProcessCommandLine has '/all')\n     or (FileName =~ 'nslookup.exe' and InitiatingProcessCommandLine has_all('querytype=ALL','timeout=10'))\n     or (FileName =~ 'netstat.exe' and InitiatingProcessCommandLine has '-nao')\n     or (FileName =~ 'arp.exe' and InitiatingProcessCommandLine has '-a')\n     or (FileName =~ 'ping.exe' and InitiatingProcessCommandLine has '-t' and InitiatingProcessCommandLine endswith '127.0.0.1')\n| summarize DiscoveryCommands = dcount(InitiatingProcessCommandLine), make_set(InitiatingProcessFileName), make_set(FileName), make_set(InitiatingProcessCommandLine) by DeviceId, bin(TimeGenerated, 5m)   \n| where DiscoveryCommands >= 3\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion,Discovery,Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject323')._huntingQuerycontentId323),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 323",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject323')._huntingQuerycontentId323)]",
-                "contentId": "[variables('huntingQueryObject323')._huntingQuerycontentId323]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject323').huntingQueryVersion323]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject323')._huntingQuerycontentId323]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Qakbot Discovery Activies",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject323')._huntingQuerycontentId323,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject323')._huntingQuerycontentId323,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject324').huntingQueryTemplateSpecName324]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "ShadowCopyDeletion_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject324').huntingQueryVersion324]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_324",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Shadow Copy Deletions",
-                "category": "Hunting Queries",
-                "query": "let CommonRansomwareExecutionCommands = dynamic([@'vssadmin.exe delete shadows /all /quiet', \n@'wmic.exe shadowcopy delete', @'wbadmin delete catalog -quiet', \n@'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}',\n@'del /s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk', \n@'wbadmin delete systemstatebackup -keepVersions:0', \n@'schtasks.exe /Change /TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" /disable', \n@'schtasks.exe /Change /TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" /enable >nul 2>&1', \n@'reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /f >nul 2>&1']);\nDeviceProcessEvents\n| where ProcessCommandLine has_any (CommonRansomwareExecutionCommands)\n| project-reorder TimeGenerated, ProcessCommandLine, DeviceName, AccountName\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Impact"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1490"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject324')._huntingQuerycontentId324),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 324",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject324')._huntingQuerycontentId324)]",
-                "contentId": "[variables('huntingQueryObject324')._huntingQuerycontentId324]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject324').huntingQueryVersion324]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject324')._huntingQuerycontentId324]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Shadow Copy Deletions",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject324')._huntingQuerycontentId324,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject324')._huntingQuerycontentId324,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject325').huntingQueryTemplateSpecName325]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "TurningOffServicesWithSCCommad_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject325').huntingQueryVersion325]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_325",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Turning off services using sc exe",
-                "category": "Hunting Queries",
-                "query": "// Look for sc.exe disabling services\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where ProcessCommandLine has \"sc\" and ProcessCommandLine has \"config\" and ProcessCommandLine has \"disabled\"\n| summarize ScDisableCount = dcount(ProcessCommandLine), ScDisableList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 5m)\n| where ScDisableCount > 10\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query checks for attempts to turn off at least 10 existing services using sc.exe."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "DefenseEvasion"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject325')._huntingQuerycontentId325),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 325",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject325')._huntingQuerycontentId325)]",
-                "contentId": "[variables('huntingQueryObject325')._huntingQuerycontentId325]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject325').huntingQueryVersion325]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject325')._huntingQuerycontentId325]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Turning off services using sc exe",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject325')._huntingQuerycontentId325,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject325')._huntingQuerycontentId325,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject326').huntingQueryTemplateSpecName326]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Detect_CISA_Alert_AA22-117A2021_Top_Routinely_Exploited_Vulnerabilities_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject326').huntingQueryVersion326]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_326",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities",
-                "category": "Hunting Queries",
-                "query": "// CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a\nlet CISAAlertAA22117A= dynamic(\n[\n\"CVE-2021-44228\", // Log4Shell - Apache Log4j - Remote code execution (RCE)\n\"CVE-2021-40539\", // Zoho ManageEngine AD SelfService Plus - RCE\n\"CVE-2021-34523\", // ProxyShell - Microsoft Exchange Server - Elevation of privilege\n\"CVE-2021-34473\", // ProxyShell - Microsoft Exchange Server - RCE\n\"CVE-2021-31207\", // ProxyShell - Microsoft Exchange Server - Security feature bypass\n\"CVE-2021-27065\", // ProxyLogon - Microsoft Exchange Server - RCE\n\"CVE-2021-26858\", // ProxyLogon - Microsoft Exchange Server - RCE\n\"CVE-2021-26857\", // ProxyLogon - Microsoft Exchange Server - RCE\n\"CVE-2021-26855\", // ProxyLogon - Microsoft Exchange Server - RCE\n\"CVE-2021-26084\", // Atlassian Confluence Server and Data Center - Arbitrary code execution\n\"CVE-2021-21972\", // VMware vSphere Client - RCE \n\"CVE-2020-1472\", // ZeroLogon - Microsoft Netlogon Remote Protocol (MS-NRPC) - Elevation of privilege\n\"CVE-2020-0688\", // Microsoft Exchange Server - RCE\n\"CVE-2019-11510\", // Pulse Secure Pulse Connect Secure - Arbitrary file reading\n\"CVE-2018-13379\", // Fortinet FortiOS and FortiProxy - Path traversal\n\"CVE-2021-42237\", // Sitecore XP - RCE\n\"CVE-2021-35464\", // ForgeRock OpenAM server - RCE\n\"CVE-2021-27104\", // Accellion FTA - OS command execution\n\"CVE-2021-27103\", // Accellion FTA - Server-side request forgery\n\"CVE-2021-27102\", // Accellion FTA - OS command execution\n\"CVE-2021-27101\", // Accellion FTA - SQL injection\n\"CVE-2021-21985\", // SQL injection - RCE\n\"CVE-2021-20038\", // SonicWall Secure Mobile Access (SMA) - RCE\n\"CVE-2021-40444\", // Microsoft MSHTML - RCE\n\"CVE-2021-34527\", // Microsoft Windows Print Spooler - RCE\n\"CVE-2021-3156\", // Suco - Microsoft Windows Print Spooler\n\"CVE-2021-27852\", // Checkbox Survey - Remote arbitrary code execution\n\"CVE-2021-22893\", // Pulse Secure Pulse Connect Secure - Remote arbitrary code execution\n\"CVE-2021-20016\", // SonicWall SSLVPN SMA100 - Improper SQL command neutralization, allowing for credential access\n\"CVE-2021-1675\", // Windows Print Spooler - RCE\n\"CVE-2020-2509\", // QNAP QTS and QuTS hero - Remote arbitrary code execution\n\"CVE-2019-19781\", // Citrix Application Delivery Controller (ADC) and Gateway - Arbitrary code execution\n\"CVE-2019-18935\", // Progress Telerik UI for ASP.NET AJAX - Code execution\n\"CVE-2018-0171\", // Cisco IOS Software and IOS XE Software - Remote arbitrary code execution\n\"CVE-2017-11882\", // Microsoft Office - RCE\n\"CVE-2017-0199\" // Microsoft Office - RCE\n ]\n);\nDeviceTvmSoftwareVulnerabilitiesKB\n| where CveId in(CISAAlertAA22117A)\n| join DeviceTvmSoftwareVulnerabilities on CveId\n| project-away CveId1, VulnerabilitySeverityLevel1, AffectedSoftware\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Execution"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject326')._huntingQuerycontentId326),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 326",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject326')._huntingQuerycontentId326)]",
-                "contentId": "[variables('huntingQueryObject326')._huntingQuerycontentId326]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject326').huntingQueryVersion326]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject326')._huntingQuerycontentId326]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject326')._huntingQuerycontentId326,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject326')._huntingQuerycontentId326,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject327').huntingQueryTemplateSpecName327]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Punycode chars lookalike domains_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject327').huntingQueryVersion327]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_327",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Punycode lookalikes",
-                "category": "Hunting Queries",
-                "query": "let AsciiLookalikeChars = @\"([\\u0430\\u0435\\u043E\\u0440\\u0441\\u0445\\u0456\\u0443\\u043C\\u043D\\u0455\\u0442\\u04BB\\u0501\\u03B1\\u03B5\\u03BF\\u03C1\\u03C7\\u03BA\\u03BD\\u03F2\\uFF41-\\uFF5A\\uFF21-\\uFF3A])\";\n// Function \nlet NormalizeLookalikes = (s:string) {\n  replace(@\"\\u0501\",\"d\",\n  replace(@\"\\u04BB\",\"h\",\n  replace(@\"\\u0442\",\"t\",\n  replace(@\"\\u0455\",\"s\",\n  replace(@\"\\u043D\",\"n\",\n  replace(@\"\\u043C\",\"m\",\n  replace(@\"\\u0443\",\"y\",\n  replace(@\"\\u0456\",\"i\",\n  replace(@\"\\u03C7\",\"x\",\n  replace(@\"\\u0445\",\"x\",\n  replace(@\"\\u03F2\",\"c\",\n  replace(@\"\\u0441\",\"c\",\n  replace(@\"\\u03C1\",\"p\",\n  replace(@\"\\u0440\",\"p\",\n  replace(@\"\\u03BF\",\"o\",\n  replace(@\"\\u043E\",\"o\",\n  replace(@\"\\u03B5\",\"e\",\n  replace(@\"\\u0435\",\"e\",\n  replace(@\"\\u03B1\",\"a\",\n  replace(@\"\\u0430\",\"a\",s)\n)))))))))))))))))))};\n// End Function\n// Function\nlet SuspiciousPunycodeDomains = (T:(TimeGenerated:datetime, Url:string, UrlDomain:string, ReportId:string, NetworkMessageId:string, TeamsMessageId:string, Source:string)) {\n  T\n  | where UrlDomain has \"xn--\"\n  | extend DomainUnicode = punycode_domain_from_string(UrlDomain)\n  | extend Lookalikes = extract_all(AsciiLookalikeChars, DomainUnicode)\n  | where array_length(Lookalikes) > 0\n  | extend Normalized = NormalizeLookalikes(DomainUnicode)\n  | where Normalized matches regex @\"^[A-Za-z0-9\\.\\-]+$\"\n  | project TimeGenerated, Url, UrlDomain, DomainUnicode, Lookalikes, Normalized, ReportId, NetworkMessageId, TeamsMessageId, Source;\n};\n// End Function\nlet EmailFindings =\n  EmailUrlInfo\n  | project TimeGenerated, Url, UrlDomain, ReportId, NetworkMessageId, TeamsMessageId = \"\", Source = \"Email\"\n  | invoke SuspiciousPunycodeDomains()\n  | join kind=innerunique (\n    EmailEvents\n    | project NetworkMessageId, EmailTimeGenerated = TimeGenerated, ReportId, RecipientEmailAddress, SenderFromAddress, SenderMailFromAddress, SenderDisplayName, Subject, DeliveryAction, DeliveryLocation, ThreatTypes\n  ) on NetworkMessageId\n  | project\n      Timestamp = TimeGenerated,\n      Source,\n      TimeGenerated,\n      ReportId,\n      NetworkMessageId,\n      TeamsMessageId,\n      Url,\n      UrlDomain,\n      DomainUnicode,\n      Lookalikes,\n      Normalized,\n      Subject,\n      ThreatTypes,\n      DeliveryAction,\n      DeliveryLocation,\n      SenderDisplayName,\n      SenderFromAddress,\n      SenderMailFromAddress,\n      RecipientEmailAddress;\nlet TeamsFindings =\n  MessageUrlInfo\n  | project TimeGenerated, Url, UrlDomain, ReportId, NetworkMessageId = \"\", TeamsMessageId, Source = \"Teams\"\n  | invoke SuspiciousPunycodeDomains()\n  | join kind=innerunique (\n    MessageEvents\n    | extend ThreadName = column_ifexists(\"ThreadName\", \"\"), ThreadType = column_ifexists(\"ThreadType\", \"\"), MessageType = column_ifexists(\"MessageType\", \"\"), MessageSubtype = column_ifexists(\"MessageSubtype\", \"\"), Subject = column_ifexists(\"Subject\", \"\")\n    | project TeamsMessageId, MessageTimeGenerated = TimeGenerated, Timestamp, SenderEmailAddress, SenderDisplayName, SenderObjectId, SenderType, RecipientDetails, GroupId, GroupName, ThreadId, ThreadName, ThreadType, IsExternalThread, MessageType, MessageSubtype, Subject, ThreatTypes, DeliveryAction, DeliveryLocation, ReportId\n  ) on TeamsMessageId\n  | project\n      Timestamp = TimeGenerated,\n      Source,\n      TimeGenerated,\n      ReportId,\n      NetworkMessageId,\n      TeamsMessageId,\n      Url,\n      UrlDomain,\n      DomainUnicode,\n      Lookalikes,\n      Normalized,\n      Subject,\n      ThreatTypes,\n      DeliveryAction,\n      DeliveryLocation,\n      SenderDisplayName,\n      SenderEmailAddress,\n      SenderObjectId,\n      SenderType,\n      RecipientDetails,\n      GroupId,\n      GroupName,\n      ThreadId,\n      ThreadName,\n      ThreadType,\n      IsExternalThread,\n      MessageType,\n      MessageSubtype\n      //| where IsExternalThread == true // Use filter if only external threats are in scope\n      ;\nunion isfuzzy=true EmailFindings, TeamsFindings\n| order by TimeGenerated desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Punycode lookalike domains in Emails and Teams messages"
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject327')._huntingQuerycontentId327),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 327",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject327')._huntingQuerycontentId327)]",
-                "contentId": "[variables('huntingQueryObject327')._huntingQuerycontentId327]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject327').huntingQueryVersion327]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject327')._huntingQuerycontentId327]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Punycode lookalikes",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject327')._huntingQuerycontentId327,'-', '1.0.1')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject327')._huntingQuerycontentId327,'-', '1.0.1')))]",
-        "version": "1.0.1"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject328').huntingQueryTemplateSpecName328]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for RMM tool execution following Teams messages_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject328').huntingQueryVersion328]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_328",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for RMM tool execution following Teams messages",
-                "category": "Hunting Queries",
-                "query": "let _timeFrame = 30m;\n// Teams message signal\nlet _teams =\n    MessageEvents\n    | where Timestamp > ago(14d)\n    //| where SenderDisplayName contains \"add keyword\"\n    //          or SenderDisplayName contains \"add keyword\"\n    | extend Recipient = parse_json(RecipientDetails)\n    | mv-expand Recipient\n    | extend VictimAccountObjectId = tostring(Recipient.RecipientObjectId),\n             VictimRecipientDisplayName = tostring(Recipient.RecipientDisplayName)\n    | project\n        TTime = Timestamp,\n        SenderEmailAddress,\n        SenderDisplayName,\n        VictimRecipientDisplayName,\n        VictimAccountObjectId;\n// RMM launches on endpoint side\nlet _rmm =\n    DeviceProcessEvents\n    | where Timestamp > ago(14d)\n    | where FileName in~ (\"QuickAssist.exe\", \"AnyDesk.exe\", \"TeamViewer.exe\")\n    | extend VictimAccountObjectId = tostring(InitiatingProcessAccountObjectId)\n    | project\n        DeviceName,\n        QTime = Timestamp,\n        RmmTool = FileName,\n        VictimAccountObjectId;\n_teams\n| where isnotempty(VictimAccountObjectId)\n| join kind=inner _rmm on VictimAccountObjectId\n| where isnotempty(DeviceName)\n| where QTime between ((TTime) .. (TTime + (_timeFrame)))\n| project DeviceName, SenderEmailAddress, SenderDisplayName, VictimRecipientDisplayName, VictimAccountObjectId, TTime, QTime, RmmTool\n| order by QTime desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Correlates inbound Microsoft Teams messages with subsequent execution of common Remote Monitoring and Management (RMM) tools (QuickAssist, AnyDesk, TeamViewer) \non the recipient's device within a short time window. This pattern is associated with social engineering / tech-support-scam intrusions (e.g., Storm-1811 / Black \nBasta) where attackers lure victims via Teams chat and then convince them to launch an RMM tool to gain remote access."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,Execution"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1219"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject328')._huntingQuerycontentId328),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 328",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject328')._huntingQuerycontentId328)]",
-                "contentId": "[variables('huntingQueryObject328')._huntingQuerycontentId328]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject328').huntingQueryVersion328]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject328')._huntingQuerycontentId328]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for RMM tool execution following Teams messages",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject328')._huntingQuerycontentId328,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject328')._huntingQuerycontentId328,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject329').huntingQueryTemplateSpecName329]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Hunt for alerts correlated with Teams messages_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject329').huntingQueryVersion329]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_329",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Hunt for alerts correlated with Teams messages",
-                "category": "Hunting Queries",
-                "query": "let _timeFrame = 30m;      // Tune: how long after the Teams event to look for matching alerts\nlet _huntingWindow = 4d;   // Tune: broader lookback increases coverage but also cost\n// Seed Teams message activity and normalize the victim/join fields you want to carry forward\nlet _teams = materialize (\n    MessageEvents\n    | where Timestamp > ago(_huntingWindow)\n    | extend Recipient = parse_json(RecipientDetails)\n    // Optional tuning: add sender/name/content filters here first to reduce volume early\n    //| where SenderDisplayName contains \"add keyword\"\n    //          or SenderDisplayName contains \"add keyword\"\n    // add other hunting terms\n    | mv-expand Recipient\n    | extend VictimAccountObjectId = tostring(Recipient.RecipientObjectId),\n             VictimUPN = tostring(Recipient.RecipientSmtpAddress)\n    | project\n        TTime = Timestamp,\n        SenderUPN = SenderEmailAddress,\n        SenderDisplayName,\n        VictimUPN,\n        VictimAccountObjectId,\n        ChatThreadId = ThreadId\n);\n// Distinct key sets used to prefilter downstream tables before joining\nlet _VictimAccountObjectId = materialize(\n    _teams\n    | where isnotempty(VictimAccountObjectId)\n    | distinct VictimAccountObjectId\n);\nlet _VictimUPN = materialize(\n    _teams\n    | where isnotempty(VictimUPN)\n    | distinct VictimUPN\n);\nlet _ChatThreadId = materialize(\n    _teams\n    | where isnotempty(ChatThreadId)\n    | distinct ChatThreadId\n);\n// Find first-seen chat creation events for the chat threads already present in _teams\n// Tune: add more CloudAppEvents filters here if you want to narrow to external / one-on-one / specific chat types\nlet _firstContact = materialize(\n    CloudAppEvents\n    | where Timestamp > ago(_huntingWindow)\n    | where Application has \"Teams\"\n    | where ActionType == \"ChatCreated\"\n    | extend Raw = todynamic(RawEventData)\n    | extend ChatThreadId = tostring(Raw.ChatThreadId)\n    | where isnotempty(ChatThreadId)\n    | join kind=innerunique (_ChatThreadId) on ChatThreadId\n    | summarize FCTime = min(Timestamp) by ChatThreadId\n);\n// Alert branch 1: match by victim object ID\n// Usually the cleanest identity join if the field is populated consistently\nlet _alerts_by_oid = materialize(\n    AlertEvidence\n    | where Timestamp > ago(_huntingWindow)\n    | where AccountObjectId in (_VictimAccountObjectId)\n    | project\n        ATime = Timestamp,\n        AlertId,\n        Title,\n        AccountName,\n        AccountObjectId,\n        AccountUpn = \"\",\n        SourceId = \"\",\n        ChatThreadId = \"\"\n);\n// Alert branch 2: match by victim UPN\n// Useful when ObjectId is missing or alert evidence is only populated with UPN\nlet _alerts_by_upn = materialize(\n    AlertEvidence\n    | where Timestamp > ago(_huntingWindow)\n    | where AccountUpn in (_VictimUPN)\n    | project\n        ATime = Timestamp,\n        AlertId,\n        Title,\n        AccountName,\n        AccountObjectId,\n        AccountUpn,\n        SourceId = \"\",\n        ChatThreadId = \"\"\n);\n// Alert branch 3: match by chat thread ID\n// Tune: this is typically the most expensive branch because it inspects AdditionalFields\nlet _alerts_by_thread = materialize(\n    AlertEvidence\n    | where Timestamp > ago(_huntingWindow)\n    | where AdditionalFields has_any (_ChatThreadId)\n    | extend AdditionalFields = todynamic(AdditionalFields)\n    | extend\n        SourceId = tostring(AdditionalFields.SourceId),\n        ChatThreadIdRaw = tostring(AdditionalFields.ChatThreadId)\n    | extend ChatThreadId = coalesce(\n        ChatThreadIdRaw,\n        extract(@\"/(?:chats|channels|conversations|spaces)/([^/]+)/\", 1, SourceId)\n    )\n    | where isnotempty(ChatThreadId)\n    | join kind=innerunique (_ChatThreadId) on ChatThreadId\n    | project\n        ATime = Timestamp,\n        AlertId,\n        Title,\n        AccountName,\n        AccountObjectId,\n        AccountUpn = \"\",\n        SourceId,\n        ChatThreadId\n);\n//\n// add branch 4 to corrilate with host events\n//\n// Add first-contact context back onto the Teams seed set\nlet _teams_fc = materialize(\n    _teams\n    | join kind=leftouter _firstContact on ChatThreadId\n    | extend FirstContact = isnotnull(FCTime)\n);\n// Join path 1: Teams victim object ID -> alert AccountObjectId\nlet _matches_oid =\n    _teams_fc\n    | where isnotempty(VictimAccountObjectId)\n    | join hint.strategy=broadcast kind=leftouter (\n        _alerts_by_oid\n    ) on $left.VictimAccountObjectId == $right.AccountObjectId\n    // Time bound keeps only alerts near the Teams activity; widen/narrow _timeFrame to tune sensitivity\n    | where isnull(ATime) or ATime between (TTime .. TTime + _timeFrame)\n    | extend MatchType = \"ObjectId\";\n// Join path 2: Teams victim UPN -> alert AccountUpn\nlet _matches_upn =\n    _teams_fc\n    | where isnotempty(VictimUPN)\n    | join hint.strategy=broadcast kind=leftouter (\n        _alerts_by_upn\n    ) on $left.VictimUPN == $right.AccountUpn\n    | where isnull(ATime) or ATime between (TTime .. TTime + _timeFrame)\n    | extend MatchType = \"VictimUPN\";\n// Join path 3: Teams chat thread -> alert chat thread\nlet _matches_thread =\n    _teams_fc\n    | where isnotempty(ChatThreadId)\n    | join hint.strategy=broadcast kind=leftouter (\n        _alerts_by_thread\n    ) on ChatThreadId\n    | where isnull(ATime) or ATime between (TTime .. TTime + _timeFrame)\n    | extend MatchType = \"ChatThreadId\";\n//\n// add branch 4 for host events\n//\n// Merge all match paths and collapse multiple alert hits per Teams event into one row\nunion _matches_oid, _matches_upn, _matches_thread\n| summarize\n    AlertTitles = make_set(Title, 50),\n    AlertIds = make_set(AlertId, 50),\n    MatchTypes = make_set(MatchType, 10),\n    FirstAlertTime = min(ATime)\n    by\n        TTime,\n        SenderUPN,\n        SenderDisplayName,\n        VictimUPN,\n        VictimAccountObjectId,\n        ChatThreadId\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Correlates Microsoft Teams message activity with downstream Defender alerts on the\nrecipient (victim) identity, surfacing potential phishing or social-engineering chats\nthat are followed by alert activity within a tunable time window."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,Discovery"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1078"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject329')._huntingQuerycontentId329),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 329",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject329')._huntingQuerycontentId329)]",
-                "contentId": "[variables('huntingQueryObject329')._huntingQuerycontentId329]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject329').huntingQueryVersion329]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject329')._huntingQuerycontentId329]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Hunt for alerts correlated with Teams messages",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject329')._huntingQuerycontentId329,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject329')._huntingQuerycontentId329,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject330').huntingQueryTemplateSpecName330]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Identify acting user for reported phish_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject330').huntingQueryVersion330]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_330",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Identify acting user for reported phish",
-                "category": "Hunting Queries",
-                "query": "let ExtractInternetMessageId = (af: string) {\n    coalesce(\n        tostring(parse_json(af).InternetMessageId),\n        extract('\\\"InternetMessageId\\\":\\\"(<[^>]+@[^>]+>)\\\"', 1, af)\n    )\n};\nlet ReportedMail = materialize(\n    AlertEvidence\n    | where Timestamp >= ago(7d)\n    | where EntityType == \"MailMessage\"\n    | where Title == \"Email reported by user as malware or phish\"\n    | extend AF = tostring(AdditionalFields)\n    | extend InternetMessageId = ExtractInternetMessageId(AF)\n    | where isnotempty(InternetMessageId)\n    | extend Recipient = tostring(parse_json(AF).Recipient)\n    | extend Subject = tostring(parse_json(AF).Subject)\n    | extend NetworkMessageId = coalesce(tostring(parse_json(AF).NetworkMessageId), NetworkMessageId)\n    | summarize arg_max(Timestamp, *) by AlertId, InternetMessageId\n    | project AlertTimestamp = Timestamp,\n        AlertId,\n        InternetMessageId,\n        NetworkMessageId,\n        Recipient,\n        Subject\n);\nlet DeletedItemsActivity = materialize(\n    CloudAppEvents\n    | where Timestamp >= ago(7d)\n    | where ActionType in (\"MovedToDeletedItems\", \"MoveToDeletedItems\")\n    | where RawEventData has \"AffectedItems\"\n    | extend Raw = parse_json(RawEventData)\n    | mv-expand with_itemindex = AffectedItemIndex AffectedItem = Raw.AffectedItems to typeof(dynamic)\n    | extend InternetMessageId = tostring(AffectedItem.InternetMessageId)\n    | where isnotempty(InternetMessageId)\n    | extend ActorUser = coalesce(\n        tostring(Raw.UserId),\n        tostring(Raw.ActorUserId),\n        tostring(AccountId)\n    )\n    | extend ActorIp = coalesce(\n        tostring(Raw.ClientIP),\n        tostring(IPAddress)\n    )\n    | project AppTimestamp = Timestamp,\n        ActionType,\n        InternetMessageId,\n        AffectedItemIndex,\n        ActorUser,\n        ActorIp,\n        AccountDisplayName,\n        AccountObjectId,\n        ReportId\n);\nReportedMail\n| join kind=inner DeletedItemsActivity on InternetMessageId\n| extend RecipientNorm = tolower(extract(@'([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,})', 1, tostring(Recipient)))\n| extend ActorUserNorm = tolower(extract(@'([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,})', 1, tostring(ActorUser)))\n| extend RecipientActorMatch = case(\n    isnotempty(RecipientNorm) and isnotempty(ActorUserNorm) and RecipientNorm == ActorUserNorm, \"Match\",\n    isnotempty(RecipientNorm) and isnotempty(ActorUserNorm) and RecipientNorm != ActorUserNorm, \"Different\",\n    \"Unknown\"\n)\n| project\n    AppTimestamp,\n    AlertTimestamp,\n    AlertId,\n    InternetMessageId,\n    NetworkMessageId,\n    Recipient,\n    ActorUser,\n    RecipientActorMatch,\n    Subject,\n    ActionType,\n    AffectedItemIndex,\n    AccountDisplayName,\n    AccountObjectId,\n    ActorIp,\n    ReportId\n| order by AppTimestamp desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "Identifies the user who acted on a reported phishing message and compares that actor with the original recipient, helping investigate delegate or shared mailbox reporting scenarios."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject330')._huntingQuerycontentId330),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 330",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject330')._huntingQuerycontentId330)]",
-                "contentId": "[variables('huntingQueryObject330')._huntingQuerycontentId330]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject330').huntingQueryVersion330]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject330')._huntingQuerycontentId330]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Identify acting user for reported phish",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject330')._huntingQuerycontentId330,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject330')._huntingQuerycontentId330,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject331').huntingQueryTemplateSpecName331]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Inbound Sender Domains Failing Email Authentication_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject331').huntingQueryVersion331]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_331",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Inbound Sender Domains Failing Email Authentication",
-                "category": "Hunting Queries",
-                "query": "// Inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, Composite Authentication).\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend Auth = parse_json(AuthenticationDetails)\n| summarize TotalInbound = count(), MessagesFailingAnyAuth = countif(tostring(Auth.DMARC) == \"fail\" or tostring(Auth.DKIM) == \"fail\" or tostring(Auth.SPF) == \"fail\" or tostring(Auth.CompAuth) == \"fail\"), DMARCFail = countif(tostring(Auth.DMARC) == \"fail\"), DKIMFail = countif(tostring(Auth.DKIM) == \"fail\"), SPFFail = countif(tostring(Auth.SPF) == \"fail\"), CompAuthFail = countif(tostring(Auth.CompAuth) == \"fail\") by SenderDomain = SenderFromDomain\n| where MessagesFailingAnyAuth > 0\n| top 20 by MessagesFailingAnyAuth\n| project SenderDomain, MessagesFailingAnyAuth, DMARCFail, DKIMFail, SPFFail, CompAuthFail, TotalInbound\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, and Composite Authentication), using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject331')._huntingQuerycontentId331),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 331",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject331')._huntingQuerycontentId331)]",
-                "contentId": "[variables('huntingQueryObject331')._huntingQuerycontentId331]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject331').huntingQueryVersion331]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject331')._huntingQuerycontentId331]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Inbound Sender Domains Failing Email Authentication",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject331')._huntingQuerycontentId331,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject331')._huntingQuerycontentId331,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject332').huntingQueryTemplateSpecName332]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Automatic External Email Forwarding by Type_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject332').huntingQueryVersion332]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_332",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Automatic External Email Forwarding Overview by Type (Mailbox Rule and SMTP)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Outbound\" and isnotempty(ForwardingInformation)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend FwdInfo = parse_json(ForwardingInformation)\n| extend ForwardingType = tostring(FwdInfo.ForwardingType),\n         ForwardingUser = tostring(FwdInfo.ForwardingUser),\n         RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])\n| summarize ForwardedMessages = count(),\n            ForwardingUsers = dcount(ForwardingUser),\n            ExternalRecipients = dcount(RecipientEmailAddress),\n            ExternalDomains = dcount(RecipientDomain)\n    by ForwardingType\n| sort by ForwardedMessages desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises automatic external email forwarding across the tenant by forwarding type (mailbox rule versus SMTP forwarding), using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114,T1020"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject332')._huntingQuerycontentId332),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 332",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject332')._huntingQuerycontentId332)]",
-                "contentId": "[variables('huntingQueryObject332')._huntingQuerycontentId332]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject332').huntingQueryVersion332]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject332')._huntingQuerycontentId332]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Automatic External Email Forwarding Overview by Type (Mailbox Rule and SMTP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject332')._huntingQuerycontentId332,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject332')._huntingQuerycontentId332,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject333').huntingQueryTemplateSpecName333]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "First-Contact External Email Senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject333').huntingQueryVersion333]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_333",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "First-Contact External Email Senders",
-                "category": "Hunting Queries",
-                "query": "// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\n// let ExcludeDomains = dynamic([\"contoso.com\", \"fabrikam.com\"]);\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(SenderFromAddress)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend SenderDomain = tostring(split(SenderFromAddress, '@')[1])\n// | where SenderDomain !in~ (ExcludeDomains)\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\n| top 20 by FirstSeen desc\n| project Sender = SenderFromAddress, SenderDomain, FirstSeen, Messages, ThreatMessages\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists external email senders seen for the first time in the period (most recent first), surfacing new first-contact relationships, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject333')._huntingQuerycontentId333),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 333",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject333')._huntingQuerycontentId333)]",
-                "contentId": "[variables('huntingQueryObject333')._huntingQuerycontentId333]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject333').huntingQueryVersion333]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject333')._huntingQuerycontentId333]",
-        "contentKind": "HuntingQuery",
-        "displayName": "First-Contact External Email Senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject333')._huntingQuerycontentId333,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject333')._huntingQuerycontentId333,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject334').huntingQueryTemplateSpecName334]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "New External Sender Domains Carrying Threats_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject334').huntingQueryVersion334]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_334",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "New External Sender Domains Carrying Threats",
-                "category": "Hunting Queries",
-                "query": "// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\n// let ExcludeDomains = dynamic([\"contoso.com\", \"fabrikam.com\"]);\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(SenderFromAddress)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend SenderDomain = tostring(split(SenderFromAddress, '@')[1])\n// | where SenderDomain !in~ (ExcludeDomains)\n| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Messages = count(), Senders = dcount(SenderFromAddress), Recipients = dcount(RecipientEmailAddress), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderDomain\n| where ThreatMessages > 0\n| top 20 by FirstSeen desc\n| project SenderDomain, FirstSeen, Messages, Senders, Recipients, ThreatMessages, LastSeen\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists external sender domains seen for the first time in the period that already carried threats, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject334')._huntingQuerycontentId334),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 334",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject334')._huntingQuerycontentId334)]",
-                "contentId": "[variables('huntingQueryObject334')._huntingQuerycontentId334]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject334').huntingQueryVersion334]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject334')._huntingQuerycontentId334]",
-        "contentKind": "HuntingQuery",
-        "displayName": "New External Sender Domains Carrying Threats",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject334')._huntingQuerycontentId334,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject334')._huntingQuerycontentId334,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject335').huntingQueryTemplateSpecName335]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top External Domains Receiving Auto-forwarded Email_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject335').huntingQueryVersion335]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_335",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Outbound\" and isnotempty(ForwardingInformation)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend FwdInfo = parse_json(ForwardingInformation)\n| extend ForwardingType = tostring(FwdInfo.ForwardingType),\n         ForwardingUser = tostring(FwdInfo.ForwardingUser),\n         RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])\n| summarize ForwardedMessages = count(),\n            ForwardingUsers = dcount(ForwardingUser)\n    by RecipientDomain, ForwardingType\n| top 20 by ForwardedMessages\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the top external domains receiving automatically forwarded email, by forwarding type, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114,T1020"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject335')._huntingQuerycontentId335),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 335",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject335')._huntingQuerycontentId335)]",
-                "contentId": "[variables('huntingQueryObject335')._huntingQuerycontentId335]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject335').huntingQueryVersion335]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject335')._huntingQuerycontentId335]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject335')._huntingQuerycontentId335,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject335')._huntingQuerycontentId335,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject336').huntingQueryTemplateSpecName336]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top External Recipients Receiving Auto-forwarded Email_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject336').huntingQueryVersion336]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_336",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top External Recipients Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Outbound\" and isnotempty(ForwardingInformation)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend FwdInfo = parse_json(ForwardingInformation)\n| extend ForwardingType = tostring(FwdInfo.ForwardingType),\n         ForwardingUser = tostring(FwdInfo.ForwardingUser)\n| summarize ForwardedMessages = count(),\n            ForwardingUsers = dcount(ForwardingUser)\n    by RecipientEmailAddress, ForwardingType\n| top 20 by ForwardedMessages\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the top external recipients receiving automatically forwarded email, by forwarding type, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114,T1020"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject336')._huntingQuerycontentId336),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 336",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject336')._huntingQuerycontentId336)]",
-                "contentId": "[variables('huntingQueryObject336')._huntingQuerycontentId336]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject336').huntingQueryVersion336]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject336')._huntingQuerycontentId336]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top External Recipients Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject336')._huntingQuerycontentId336,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject336')._huntingQuerycontentId336,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject337').huntingQueryTemplateSpecName337]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Users Auto-forwarding Email Externally_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject337').huntingQueryVersion337]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_337",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Outbound\" and isnotempty(ForwardingInformation)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend FwdInfo = parse_json(ForwardingInformation)\n| extend ForwardingType = tostring(FwdInfo.ForwardingType),\n         ForwardingUser = tostring(FwdInfo.ForwardingUser),\n         RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])\n| where isnotempty(ForwardingUser)\n| summarize ForwardedMessages = count(),\n            ExternalRecipients = dcount(RecipientEmailAddress),\n            ExternalDomains = dcount(RecipientDomain)\n    by ForwardingUser, ForwardingType\n| top 20 by ForwardedMessages\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the top internal users automatically forwarding email to external addresses, by forwarding type, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "Collection,Exfiltration"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1114,T1020"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject337')._huntingQuerycontentId337),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 337",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject337')._huntingQuerycontentId337)]",
-                "contentId": "[variables('huntingQueryObject337')._huntingQuerycontentId337]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject337').huntingQueryVersion337]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject337')._huntingQuerycontentId337]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject337')._huntingQuerycontentId337,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject337')._huntingQuerycontentId337,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject338').huntingQueryTemplateSpecName338]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Malware Detections Over Time_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject338').huntingQueryVersion338]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_338",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Malware Detections Over Time (SharePoint, OneDrive and Teams)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nFileMaliciousContentInfo\n| where Timestamp >= TimeStart\n| where isnotempty(ThreatTypes)\n| make-series FileMalwareDetections = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query shows the daily volume of file malware detections in SharePoint, OneDrive and Teams over the last 30 days, using the FileMaliciousContentInfo table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1080"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject338')._huntingQuerycontentId338),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 338",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject338')._huntingQuerycontentId338)]",
-                "contentId": "[variables('huntingQueryObject338')._huntingQuerycontentId338]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject338').huntingQueryVersion338]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject338')._huntingQuerycontentId338]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Malware Detections Over Time (SharePoint, OneDrive and Teams)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject338')._huntingQuerycontentId338,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject338')._huntingQuerycontentId338,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject339').huntingQueryTemplateSpecName339]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Malware Detections by Location_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject339').huntingQueryVersion339]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_339",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Malware Detections by Location (SharePoint, OneDrive and Teams)",
-                "category": "Hunting Queries",
-                "query": "// FileMaliciousContentInfo records malicious-content findings for files in SharePoint, OneDrive and Teams.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n// FolderPath segment [4] is the SharePoint site or the OneDrive personal location where the file resides.\n| extend Location = tostring(split(FolderPath, '/')[4])\n| summarize FileMalwareDetections = count(), DistinctFiles = dcount(SHA256) by Location\n| top 100 by FileMalwareDetections desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query surfaces malware detections in files stored in SharePoint, OneDrive and Teams, grouped by the site or personal location where each file resides, using the FileMaliciousContentInfo table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1080"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject339')._huntingQuerycontentId339),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 339",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject339')._huntingQuerycontentId339)]",
-                "contentId": "[variables('huntingQueryObject339')._huntingQuerycontentId339]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject339').huntingQueryVersion339]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject339')._huntingQuerycontentId339]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Malware Detections by Location (SharePoint, OneDrive and Teams)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject339')._huntingQuerycontentId339,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject339')._huntingQuerycontentId339,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject340').huntingQueryTemplateSpecName340]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Malware Detections by Workload_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject340').huntingQueryVersion340]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_340",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Malware Detections by Workload (SharePoint, OneDrive and Teams)",
-                "category": "Hunting Queries",
-                "query": "// FileMaliciousContentInfo records malicious-content findings for files in SharePoint, OneDrive and Teams.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| summarize FileMalwareDetections = count(), DistinctFiles = dcount(SHA256) by Workload\n| sort by FileMalwareDetections desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises malware detections in files stored in SharePoint, OneDrive and Teams by the Microsoft 365 collaboration workload, using the FileMaliciousContentInfo table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1080"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject340')._huntingQuerycontentId340),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 340",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject340')._huntingQuerycontentId340)]",
-                "contentId": "[variables('huntingQueryObject340')._huntingQuerycontentId340]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject340').huntingQueryVersion340]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject340')._huntingQuerycontentId340]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Malware Detections by Workload (SharePoint, OneDrive and Teams)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject340')._huntingQuerycontentId340,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject340')._huntingQuerycontentId340,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject341').huntingQueryTemplateSpecName341]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Malware Top Families by MDO Detonation_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject341').huntingQueryVersion341]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_341",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)",
-                "category": "Hunting Queries",
-                "query": "// DetectionMethods \"detonation\" indicates a Microsoft Defender for Office 365 Safe Attachments detonation verdict.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| where tostring(DetectionMethods) has \"detonation\"\n| summarize Files = count() by ThreatName = ThreatNames\n| top 50 by Files desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by Microsoft Defender for Office 365 (Safe Attachments detonation), using the FileMaliciousContentInfo table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1080"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject341')._huntingQuerycontentId341),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 341",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject341')._huntingQuerycontentId341)]",
-                "contentId": "[variables('huntingQueryObject341')._huntingQuerycontentId341]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject341').huntingQueryVersion341]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject341')._huntingQuerycontentId341]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject341')._huntingQuerycontentId341,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject341')._huntingQuerycontentId341,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject342').huntingQueryTemplateSpecName342]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Malware Top Families by SharePoint Antivirus_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject342').huntingQueryVersion342]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_342",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)",
-                "category": "Hunting Queries",
-                "query": "// DetectionMethods \"Antimalware engine\" indicates the built-in SharePoint Online antivirus.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| where tostring(DetectionMethods) has \"Antimalware engine\"\n| summarize Files = count() by ThreatName = ThreatNames\n| top 50 by Files desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by the built-in SharePoint Online antivirus, using the FileMaliciousContentInfo table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1080"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject342')._huntingQuerycontentId342),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 342",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject342')._huntingQuerycontentId342)]",
-                "contentId": "[variables('huntingQueryObject342')._huntingQuerycontentId342]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject342').huntingQueryVersion342]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject342')._huntingQuerycontentId342]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject342')._huntingQuerycontentId342,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject342')._huntingQuerycontentId342,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject343').huntingQueryTemplateSpecName343]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "File Scanning Coverage_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject343').huntingQueryVersion343]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_343",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "File Scanning Coverage (SharePoint, OneDrive and Teams)",
-                "category": "Hunting Queries",
-                "query": "FileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| summarize FilesProcessed = count(),\n            FilesWithMalware = countif(isnotempty(ThreatTypes)),\n            FilesNoDetection = countif(isempty(ThreatTypes))\n| extend DetectionRatePct = iif(FilesProcessed == 0, 0.0, round(100.0 * FilesWithMalware / FilesProcessed, 2))\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises file scanning coverage in SharePoint, OneDrive and Teams: how many files were processed, how many were found malicious, and how many were scanned with no detection, using the FileMaliciousContentInfo table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1080"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject343')._huntingQuerycontentId343),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 343",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject343')._huntingQuerycontentId343)]",
-                "contentId": "[variables('huntingQueryObject343')._huntingQuerycontentId343]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject343').huntingQueryVersion343]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject343')._huntingQuerycontentId343]",
-        "contentKind": "HuntingQuery",
-        "displayName": "File Scanning Coverage (SharePoint, OneDrive and Teams)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject343')._huntingQuerycontentId343,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject343')._huntingQuerycontentId343,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject344').huntingQueryTemplateSpecName344]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject344').huntingQueryVersion344]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_344",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware Detection IP and Geo Position",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\" and isnotempty(SenderIPv4)\n| summarize count() by SenderIPv4\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| project SenderIPv4, Latitude, Longitude, ['Malware Emails'] = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises inbound email malware detections by sender IP address with geographic coordinates for mapping."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject344')._huntingQuerycontentId344),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 344",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject344')._huntingQuerycontentId344)]",
-                "contentId": "[variables('huntingQueryObject344')._huntingQuerycontentId344]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject344').huntingQueryVersion344]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject344')._huntingQuerycontentId344]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware Detection IP and Geo Position",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject344')._huntingQuerycontentId344,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject344')._huntingQuerycontentId344,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject345').huntingQueryTemplateSpecName345]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware Detections by Sender Country_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject345').huntingQueryVersion345]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_345",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware Detections by Sender Country",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\" and isnotempty(SenderIPv4)\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Country = tostring(GeoInfo.country)\n| summarize count() by Country\n| project Country, ['Malware Emails'] = count_\n| sort by ['Malware Emails'] desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises inbound email malware detections by the sender IP address country, derived from the sender IPv4 address."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject345')._huntingQuerycontentId345),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 345",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject345')._huntingQuerycontentId345)]",
-                "contentId": "[variables('huntingQueryObject345')._huntingQuerycontentId345]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject345').huntingQueryVersion345]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject345')._huntingQuerycontentId345]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware Detections by Sender Country",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject345')._huntingQuerycontentId345,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject345')._huntingQuerycontentId345,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject346').huntingQueryTemplateSpecName346]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware Detections by Threat Classification_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject346').huntingQueryVersion346]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_346",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware Detections by Threat Classification",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\n| summarize Count = count() by ThreatClassification\n| sort by Count desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises inbound email malware detections grouped by the malware threat classification (for example Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject346')._huntingQuerycontentId346),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 346",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject346')._huntingQuerycontentId346)]",
-                "contentId": "[variables('huntingQueryObject346')._huntingQuerycontentId346]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject346').huntingQueryVersion346]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject346')._huntingQuerycontentId346]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware Detections by Threat Classification",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject346')._huntingQuerycontentId346,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject346')._huntingQuerycontentId346,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject347').huntingQueryTemplateSpecName347]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Attacked Users by Malware Threat Classification_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject347').huntingQueryVersion347]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_347",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Attacked Users by Malware Threat Classification",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\n| summarize EmailCount = count() by ThreatClassification, RecipientEmailAddress\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\n| sort by Count desc\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query surfaces, for each malware threat classification, the recipient most frequently targeted by inbound malware email."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject347')._huntingQuerycontentId347),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 347",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject347')._huntingQuerycontentId347)]",
-                "contentId": "[variables('huntingQueryObject347')._huntingQuerycontentId347]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject347').huntingQueryVersion347]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject347')._huntingQuerycontentId347]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Attacked Users by Malware Threat Classification",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject347')._huntingQuerycontentId347,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject347')._huntingQuerycontentId347,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject348').huntingQueryTemplateSpecName348]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top File Owners Holding Malware_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject348').huntingQueryVersion348]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_348",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top File Owners Holding Malware (SharePoint, OneDrive and Teams)",
-                "category": "Hunting Queries",
-                "query": "// Groups by the file owner, or by the SharePoint/Teams site when a file has no individual owner.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat('Site: ', tostring(split(FolderPath, '/')[4])))\n| summarize MaliciousFiles = count(),\n            DistinctFiles = dcount(SHA256),\n            Workloads = make_set(Workload, 3),\n            SampleThreats = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\n            LastSeen = max(Timestamp)\n    by Owner\n| top 20 by MaliciousFiles\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the file owners (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, using the FileMaliciousContentInfo table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess,LateralMovement"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566,T1080"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject348')._huntingQuerycontentId348),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 348",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject348')._huntingQuerycontentId348)]",
-                "contentId": "[variables('huntingQueryObject348')._huntingQuerycontentId348]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject348').huntingQueryVersion348]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject348')._huntingQuerycontentId348]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top File Owners Holding Malware (SharePoint, OneDrive and Teams)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject348')._huntingQuerycontentId348,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject348')._huntingQuerycontentId348,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject349').huntingQueryTemplateSpecName349]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "First-Contact External Teams Senders_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject349').huntingQueryVersion349]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_349",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "First-Contact External Teams Senders",
-                "category": "Hunting Queries",
-                "query": "//This query lists external Microsoft Teams senders by the date they were first seen over the last 30 days, surfacing recent first-contact senders.\nMessageEvents\n| where Timestamp > ago(30d)\n| summarize FirstTimestamp = min(Timestamp), arg_max(Timestamp, *) by TeamsMessageId\n| where IsExternalThread == true\n| summarize FirstSeen = min(FirstTimestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\n| top 20 by FirstSeen desc\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists external Microsoft Teams senders by the date they were first seen, surfacing recent first-contact senders."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject349')._huntingQuerycontentId349),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 349",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject349')._huntingQuerycontentId349)]",
-                "contentId": "[variables('huntingQueryObject349')._huntingQuerycontentId349]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject349').huntingQueryVersion349]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject349')._huntingQuerycontentId349]",
-        "contentKind": "HuntingQuery",
-        "displayName": "First-Contact External Teams Senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject349')._huntingQuerycontentId349,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject349')._huntingQuerycontentId349,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject350').huntingQueryTemplateSpecName350]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malicious files shared in Microsoft Teams_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject350').huntingQueryVersion350]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_350",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malicious files shared in Microsoft Teams",
-                "category": "Hunting Queries",
-                "query": "//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where Workload == \"MicrosoftTeams\"\n| where isnotempty(ThreatTypes)\n| top 20 by Timestamp desc\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject350')._huntingQuerycontentId350),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 350",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject350')._huntingQuerycontentId350)]",
-                "contentId": "[variables('huntingQueryObject350')._huntingQuerycontentId350]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject350').huntingQueryVersion350]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject350')._huntingQuerycontentId350]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malicious files shared in Microsoft Teams",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject350')._huntingQuerycontentId350,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject350')._huntingQuerycontentId350,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject351').huntingQueryTemplateSpecName351]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Microsoft Teams External versus Internal Thread Exposure_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject351').huntingQueryVersion351]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_351",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Microsoft Teams External versus Internal Thread Exposure",
-                "category": "Hunting Queries",
-                "query": "//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\nMessageEvents\n| where Timestamp > ago(30d)\n| summarize arg_max(Timestamp, *) by TeamsMessageId\n| extend Thread = iif(IsExternalThread == true, \"External Thread\", \"Internal Thread\")\n| summarize Count = count() by Thread\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject351')._huntingQuerycontentId351),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 351",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject351')._huntingQuerycontentId351)]",
-                "contentId": "[variables('huntingQueryObject351')._huntingQuerycontentId351]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject351').huntingQueryVersion351]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject351')._huntingQuerycontentId351]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Microsoft Teams External versus Internal Thread Exposure",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject351')._huntingQuerycontentId351,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject351')._huntingQuerycontentId351,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject352').huntingQueryTemplateSpecName352]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Teams File Protection Summary_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject352').huntingQueryVersion352]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_352",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Teams File Protection Summary",
-                "category": "Hunting Queries",
-                "query": "//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365: files scanned, files with malware detected, and files scanned with no detection.\nlet base = FileMaliciousContentInfo\n    | where Timestamp > ago(30d)\n    | where Workload == \"MicrosoftTeams\";\nunion\n(base | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 1),\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files with Malware Detected\", Ord = 2),\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files Scanned - No Detection\", Ord = 3)\n| sort by Ord asc\n| project Count, Details\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarizes Microsoft Teams file protection: files scanned, files with malware detected, and files with no detection."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject352')._huntingQuerycontentId352),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 352",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject352')._huntingQuerycontentId352)]",
-                "contentId": "[variables('huntingQueryObject352')._huntingQuerycontentId352]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject352').huntingQueryVersion352]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject352')._huntingQuerycontentId352]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Teams File Protection Summary",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject352')._huntingQuerycontentId352,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject352')._huntingQuerycontentId352,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject353').huntingQueryTemplateSpecName353]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SecOps Mailbox Override Count_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject353').huntingQueryVersion353]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_353",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "SecOps Mailbox Override Count",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where OrgLevelPolicy == \"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\n| summarize ['SecOps Mailbox Deliveries'] = count()\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query counts inbound emails delivered to the SecOps mailbox by an organisation-level allow override."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject353')._huntingQuerycontentId353),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 353",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject353')._huntingQuerycontentId353)]",
-                "contentId": "[variables('huntingQueryObject353')._huntingQuerycontentId353]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject353').huntingQueryVersion353]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject353')._huntingQuerycontentId353]",
-        "contentKind": "HuntingQuery",
-        "displayName": "SecOps Mailbox Override Count",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject353')._huntingQuerycontentId353,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject353')._huntingQuerycontentId353,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject354').huntingQueryTemplateSpecName354]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "SecOps Mailbox Overrides by Threat Type_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject354').huntingQueryVersion354]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_354",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "SecOps Mailbox Overrides by Threat Type",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where OrgLevelPolicy == \"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\n| extend ThreatType = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\n| summarize TotalEmails = count() by OrgLevelAction, OrgLevelPolicy, ThreatType\n| sort by TotalEmails desc\n| project ['Override Action'] = OrgLevelAction, ['Override Policy'] = OrgLevelPolicy, ['Threat Type'] = ThreatType, ['Total Emails'] = TotalEmails\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query breaks down inbound emails delivered to the SecOps mailbox by an organisation-level allow override, grouped by threat type."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject354')._huntingQuerycontentId354),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 354",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject354')._huntingQuerycontentId354)]",
-                "contentId": "[variables('huntingQueryObject354')._huntingQuerycontentId354]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject354').huntingQueryVersion354]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject354')._huntingQuerycontentId354]",
-        "contentKind": "HuntingQuery",
-        "displayName": "SecOps Mailbox Overrides by Threat Type",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject354')._huntingQuerycontentId354,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject354')._huntingQuerycontentId354,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject355').huntingQueryTemplateSpecName355]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Recipients Receiving Threats Delivered by Override_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject355').huntingQueryVersion355]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_355",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Recipients Receiving Threats Delivered by Override",
-                "category": "Hunting Queries",
-                "query": "// Recipients with the most threats delivered via an admin or user override, with the override share and type breakdown.\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend OverrideType = case(\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\n    \"(none)\")\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\n| summarize TotalThreats = sum(PerType),\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\n        by RecipientEmailAddress\n| where OverriddenThreats > 0\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\n| top 15 by OverriddenThreats\n| project Recipient = RecipientEmailAddress, TotalThreats, OverriddenThreats, OverridePercent, OverrideTypes\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the recipients who received the most threats that were delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject355')._huntingQuerycontentId355),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 355",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject355')._huntingQuerycontentId355)]",
-                "contentId": "[variables('huntingQueryObject355')._huntingQuerycontentId355]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject355').huntingQueryVersion355]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject355')._huntingQuerycontentId355]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Recipients Receiving Threats Delivered by Override",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject355')._huntingQuerycontentId355,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject355')._huntingQuerycontentId355,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject356').huntingQueryTemplateSpecName356]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Sender Domains Delivering Threats via Override_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject356').huntingQueryVersion356]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_356",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Sender Domains Delivering Threats via Override",
-                "category": "Hunting Queries",
-                "query": "// Sender domains with the most threats delivered via an admin or user override, with the override share and type breakdown.\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend OverrideType = case(\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\n    \"(none)\")\n| summarize PerType = count() by SenderFromDomain, OverrideType\n| summarize TotalThreats = sum(PerType),\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\n        by SenderFromDomain\n| where OverriddenThreats > 0\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\n| top 10 by OverriddenThreats\n| project SenderDomain = SenderFromDomain, TotalThreats, OverriddenThreats, OverridePercent, OverrideTypes\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the sender domains whose threats were most often delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject356')._huntingQuerycontentId356),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 356",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject356')._huntingQuerycontentId356)]",
-                "contentId": "[variables('huntingQueryObject356')._huntingQuerycontentId356]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject356').huntingQueryVersion356]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject356')._huntingQuerycontentId356]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Sender Domains Delivering Threats via Override",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject356')._huntingQuerycontentId356,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject356')._huntingQuerycontentId356,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject357').huntingQueryTemplateSpecName357]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject357').huntingQueryVersion357]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_357",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detection IP and Geo Position",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\n| summarize count() by SenderIPv4\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| project SenderIPv4, Latitude, Longitude, ['Phish Emails'] = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises inbound email phishing detections by sender IP address with geographic coordinates for mapping."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject357')._huntingQuerycontentId357),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 357",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject357')._huntingQuerycontentId357)]",
-                "contentId": "[variables('huntingQueryObject357')._huntingQuerycontentId357]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject357').huntingQueryVersion357]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject357')._huntingQuerycontentId357]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detection IP and Geo Position",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject357')._huntingQuerycontentId357,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject357')._huntingQuerycontentId357,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject358').huntingQueryTemplateSpecName358]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detections by Sender Country_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject358').huntingQueryVersion358]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_358",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detections by Sender Country",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Country = tostring(GeoInfo.country)\n| summarize count() by Country\n| project Country, ['Phish Emails'] = count_\n| sort by ['Phish Emails'] desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises inbound email phishing detections by the sender IP address country, derived from the sender IPv4 address."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject358')._huntingQuerycontentId358),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 358",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject358')._huntingQuerycontentId358)]",
-                "contentId": "[variables('huntingQueryObject358')._huntingQuerycontentId358]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject358').huntingQueryVersion358]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject358')._huntingQuerycontentId358]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detections by Sender Country",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject358')._huntingQuerycontentId358,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject358')._huntingQuerycontentId358,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject359').huntingQueryTemplateSpecName359]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phish Detections by Threat Classification_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject359').huntingQueryVersion359]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_359",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phish Detections by Threat Classification",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\n| summarize Count = count() by ThreatClassification\n| sort by Count desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises inbound email phishing detections grouped by the message-intent threat classification produced by Microsoft Defender for Office 365 LLM content analysis (for example Invoice, Gift card, Payroll, PII gathering)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject359')._huntingQuerycontentId359),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 359",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject359')._huntingQuerycontentId359)]",
-                "contentId": "[variables('huntingQueryObject359')._huntingQuerycontentId359]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject359').huntingQueryVersion359]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject359')._huntingQuerycontentId359]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phish Detections by Threat Classification",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject359')._huntingQuerycontentId359,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject359')._huntingQuerycontentId359,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject360').huntingQueryTemplateSpecName360]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phishing Detected by LLM Content Analysis_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject360').huntingQueryVersion360]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_360",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phishing Detected by LLM Content Analysis",
-                "category": "Hunting Queries",
-                "query": "// OrgLevelPolicy exclusions drop phishing-simulation and SecOps-mailbox deliveries; remove them to include those.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and tostring(DetectionMethods) has \"LLM content analysis\"\n| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, ThreatTypes, DetectionMethods, NetworkMessageId\n| top 100 by Timestamp desc\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists inbound phishing messages that Microsoft Defender for Office 365 detected using LLM (Language AI) content analysis, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject360')._huntingQuerycontentId360),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 360",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject360')._huntingQuerycontentId360)]",
-                "contentId": "[variables('huntingQueryObject360')._huntingQuerycontentId360]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject360').huntingQueryVersion360]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject360')._huntingQuerycontentId360]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phishing Detected by LLM Content Analysis",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject360')._huntingQuerycontentId360,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject360')._huntingQuerycontentId360,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject361').huntingQueryTemplateSpecName361]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Attacked Users by Phish Threat Classification_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject361').huntingQueryVersion361]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_361",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Attacked Users by Phish Threat Classification",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\n| summarize EmailCount = count() by ThreatClassification, RecipientEmailAddress\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\n| sort by Emails desc\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query surfaces, for each phishing message-intent threat classification, the recipient most frequently targeted by inbound phishing email."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject361')._huntingQuerycontentId361),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 361",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject361')._huntingQuerycontentId361)]",
-                "contentId": "[variables('huntingQueryObject361')._huntingQuerycontentId361]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject361').huntingQueryVersion361]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject361')._huntingQuerycontentId361]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Attacked Users by Phish Threat Classification",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject361')._huntingQuerycontentId361,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject361')._huntingQuerycontentId361,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject362').huntingQueryTemplateSpecName362]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Quarantine Release Percentage_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject362').huntingQueryVersion362]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_362",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Quarantine Release Percentage",
-                "category": "Hunting Queries",
-                "query": "let Quarantine_Releases = toscalar(EmailPostDeliveryEvents\n| where Timestamp > ago(30d)\n| where Action == \"Quarantine release\"\n| distinct NetworkMessageId, RecipientEmailAddress\n| count);\nlet Quarantined_Mailflow = toscalar(EmailEvents\n| where Timestamp > ago(30d)\n| where DeliveryLocation == \"Quarantine\"\n| distinct NetworkMessageId, RecipientEmailAddress\n| count);\nprint\nQuarantine_Releases = toreal(Quarantine_Releases),\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\nRelease_Percentage = iff(Quarantined_Mailflow == 0, 0.0, round((toreal(Quarantine_Releases) / toreal(Quarantined_Mailflow)) * 100, 2))\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query calculates the percentage of quarantined emails that were subsequently released, out of the total quarantined."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject362')._huntingQuerycontentId362),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 362",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject362')._huntingQuerycontentId362)]",
-                "contentId": "[variables('huntingQueryObject362')._huntingQuerycontentId362]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject362').huntingQueryVersion362]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject362')._huntingQuerycontentId362]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Quarantine Release Percentage",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject362')._huntingQuerycontentId362,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject362')._huntingQuerycontentId362,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject363').huntingQueryTemplateSpecName363]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Automated Investigation Outcomes by Day_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject363').huntingQueryVersion363]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_363",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Automated Investigation Outcomes by Day",
-                "category": "Hunting Queries",
-                "query": "let AutoRemediations =\n    EmailPostDeliveryEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"Automated Remediation\"\n    | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\n    | project NetworkMessageId, RecipientEmailAddress, Timestamp;\nlet EvidenceVerdicts =\n    AlertEvidence\n    | where Timestamp > ago(30d)\n    | where EntityType in (\"MailMessage\", \"MailCluster\")\n    | extend extra = todynamic(AdditionalFields)\n    | extend networkIds = iff(\n        isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\n        pack_array(NetworkMessageId),\n        extra.NetworkMessageIds)\n    | mv-expand nmID = networkIds\n    | extend lastVerdict = tolower(tostring(extra.LastVerdict)),\n             threatAIList = extra.ThreatAnalysisSummary,\n             threatInt = extra.ThreatIntelligence\n    | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \"\"),\n             verdictTI = iff(array_length(threatInt) > 0, \"malicious\", \"\")\n    | extend ThreatDetectedFlag = case(\n        lastVerdict in (\"malicious\", \"suspicious\") or verdictFromAnalysis in (\"malicious\", \"suspicious\") or verdictTI == \"malicious\",\n        true, false)\n    | extend MailCountInt = toint(extra.MailCount)\n    | extend Weight = iff(EntityType == \"MailCluster\", coalesce(MailCountInt, 1), 1)\n    | summarize IsThreatDetected = any(ThreatDetectedFlag), WeightSum = max(Weight) by nmID = tostring(nmID);\nAutoRemediations\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\n| extend isThreat = coalesce(IsThreatDetected, false), effectiveWeight = coalesce(WeightSum, 1)\n| extend InvestigationOutcome = iif(isThreat, \"Threat Detected\", \"Clean\")\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, 1d), InvestigationOutcome\n| order by Day asc, InvestigationOutcome asc\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarizes daily automated investigation outcomes (threat detected versus clean) by correlating automated remediation events with alert evidence, using the EmailPostDeliveryEvents and AlertEvidence tables."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject363')._huntingQuerycontentId363),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 363",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject363')._huntingQuerycontentId363)]",
-                "contentId": "[variables('huntingQueryObject363')._huntingQuerycontentId363]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject363').huntingQueryVersion363]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject363')._huntingQuerycontentId363]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Automated Investigation Outcomes by Day",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject363')._huntingQuerycontentId363,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject363')._huntingQuerycontentId363,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject364').huntingQueryTemplateSpecName364]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Automated Remediation Delivery to Action Latency_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject364').huntingQueryVersion364]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_364",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Automated Remediation Delivery to Action Latency",
-                "category": "Hunting Queries",
-                "query": "let deliveries = EmailEvents\n  | where Timestamp > ago(30d)\n  | where DeliveryAction == \"Delivered\"\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n  | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\nlet remediations = EmailPostDeliveryEvents\n  | where Timestamp > ago(30d)\n  | where ActionType == \"Automated Remediation\"\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n  | summarize FirstRemediation = min(Timestamp) by MsgKey;\ndeliveries\n| join kind=inner remediations on MsgKey\n| extend DelayMinutes = datetime_diff(\"minute\", FirstRemediation, FirstDelivery)\n| where DelayMinutes >= 0\n| summarize ['Avg (min)'] = avg(DelayMinutes), ['P80 (min)'] = percentile(DelayMinutes, 80), ['P90 (min)'] = percentile(DelayMinutes, 90), ['P99 (min)'] = percentile(DelayMinutes, 99), CountEmails = count() by bin(FirstRemediation, 1d)\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query measures how long after delivery Microsoft Defender for Office 365 automated remediation acts on a message, reported as daily average and percentiles, using the EmailEvents and EmailPostDeliveryEvents tables."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject364')._huntingQuerycontentId364),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 364",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject364')._huntingQuerycontentId364)]",
-                "contentId": "[variables('huntingQueryObject364')._huntingQuerycontentId364]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject364').huntingQueryVersion364]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject364')._huntingQuerycontentId364]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Automated Remediation Delivery to Action Latency",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject364')._huntingQuerycontentId364,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject364')._huntingQuerycontentId364,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject365').huntingQueryTemplateSpecName365]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Automated Remediation Efficiency Over Time_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject365').huntingQueryVersion365]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_365",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Automated Remediation Efficiency Over Time",
-                "category": "Hunting Queries",
-                "query": "EmailPostDeliveryEvents\n| where Timestamp > ago(30d)\n| where ActionType == \"Automated Remediation\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize Count = count() by bin(Timestamp, 1d), ActionResult\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query trends the outcome (success versus failure) of Microsoft Defender for Office 365 automated remediation actions over time, using the EmailPostDeliveryEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject365')._huntingQuerycontentId365),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 365",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject365')._huntingQuerycontentId365)]",
-                "contentId": "[variables('huntingQueryObject365')._huntingQuerycontentId365]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject365').huntingQueryVersion365]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject365')._huntingQuerycontentId365]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Automated Remediation Efficiency Over Time",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject365')._huntingQuerycontentId365,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject365')._huntingQuerycontentId365,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject366').huntingQueryTemplateSpecName366]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Automated Remediation Manual versus Automatic Approval_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject366').huntingQueryVersion366]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_366",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Automated Remediation Manual versus Automatic Approval",
-                "category": "Hunting Queries",
-                "query": "EmailPostDeliveryEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ActionType == \"Automated Remediation\"\n| summarize count() by ActionTrigger\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query shows whether Microsoft Defender for Office 365 automated remediation actions were taken automatically or required manual admin approval, using the EmailPostDeliveryEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject366')._huntingQuerycontentId366),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 366",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject366')._huntingQuerycontentId366)]",
-                "contentId": "[variables('huntingQueryObject366')._huntingQuerycontentId366]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject366').huntingQueryVersion366]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject366')._huntingQuerycontentId366]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Automated Remediation Manual versus Automatic Approval",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject366')._huntingQuerycontentId366,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject366')._huntingQuerycontentId366,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject367').huntingQueryTemplateSpecName367]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Spam Detections by Sender Country_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject367').huntingQueryVersion367]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_367",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Spam Detections by Sender Country",
-                "category": "Hunting Queries",
-                "query": "// Inbound spam detections by sender-IP country. Country is from IP geolocation and is approximate.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\" and isnotempty(SenderIPv4)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend Country = tostring(geo_info_from_ip_address(SenderIPv4).country)\n| where isnotempty(Country)\n| summarize SpamEmails = count(), SenderIPs = dcount(SenderIPv4) by Country\n| top 20 by SpamEmails\n| project Country, SpamEmails, SenderIPs\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarizes inbound spam detections by the geographic country of the sending IP address, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject367')._huntingQuerycontentId367),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 367",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject367')._huntingQuerycontentId367)]",
-                "contentId": "[variables('huntingQueryObject367')._huntingQuerycontentId367]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject367').huntingQueryVersion367]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject367')._huntingQuerycontentId367]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Spam Detections by Sender Country",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject367')._huntingQuerycontentId367,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject367')._huntingQuerycontentId367,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject368').huntingQueryTemplateSpecName368]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Impersonation and Spoof Detections by Sender Country_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject368').huntingQueryVersion368]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_368",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Impersonation and Spoof Detections by Sender Country",
-                "category": "Hunting Queries",
-                "query": "// Inbound impersonation and spoof (BEC) detections by sender-IP country. Country is from IP geolocation and is approximate.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\n| where (DetectionMethods has \"Impersonation\" or DetectionMethods has \"Spoof\") and isnotempty(SenderIPv4)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend Country = tostring(geo_info_from_ip_address(SenderIPv4).country)\n| where isnotempty(Country)\n| summarize ImpersonationEmails = countif(DetectionMethods has \"Impersonation\"), SpoofEmails = countif(DetectionMethods has \"Spoof\"), SenderIPs = dcount(SenderIPv4) by Country\n| extend TotalBEC = ImpersonationEmails + SpoofEmails\n| top 20 by TotalBEC\n| project Country, ImpersonationEmails, SpoofEmails, SenderIPs, TotalBEC\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarizes inbound impersonation and spoof (BEC) detections by the geographic country of the sending IP address, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject368')._huntingQuerycontentId368),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 368",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject368')._huntingQuerycontentId368)]",
-                "contentId": "[variables('huntingQueryObject368')._huntingQuerycontentId368]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject368').huntingQueryVersion368]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject368')._huntingQuerycontentId368]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Impersonation and Spoof Detections by Sender Country",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject368')._huntingQuerycontentId368,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject368')._huntingQuerycontentId368,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject369').huntingQueryTemplateSpecName369]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Recipients Targeted by Impersonation or BEC_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject369').huntingQueryVersion369]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_369",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Recipients Targeted by Impersonation or BEC",
-                "category": "Hunting Queries",
-                "query": "// Recipients most targeted by impersonation / BEC, with distinct senders, a sample of sender domains and inbox delivery.\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\n| where DetectionMethods has \"Impersonation\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize ImpersonationEmails = count(), DistinctSenders = dcount(SenderFromAddress), SampleSenderDomains = make_set(SenderFromDomain, 5), DeliveredToInbox = countif(DeliveryLocation has \"Inbox\") by RecipientEmailAddress\n| top 20 by ImpersonationEmails\n| project Recipient = RecipientEmailAddress, ImpersonationEmails, DistinctSenders, SampleSenderDomains = strcat_array(SampleSenderDomains, \", \"), DeliveredToInbox\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject369')._huntingQuerycontentId369),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 369",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject369')._huntingQuerycontentId369)]",
-                "contentId": "[variables('huntingQueryObject369')._huntingQuerycontentId369]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject369').huntingQueryVersion369]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject369')._huntingQuerycontentId369]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Recipients Targeted by Impersonation or BEC",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject369')._huntingQuerycontentId369,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject369')._huntingQuerycontentId369,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject370').huntingQueryTemplateSpecName370]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top accounts performing user submissions - FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject370').huntingQueryVersion370]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_370",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top accounts performing user submissions (FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend RawData = parse_json(RawEventData)\n| extend RecordType = toint(RawData.RecordType), SubmissionType = tostring(RawData.SubmissionType), UserId = tostring(RawData.UserId)\n| where RecordType == 29 and SubmissionType == \"3\"\n| summarize count() by UserId\n| top 15 by count_\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top accounts performing user false positive submissions."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject370')._huntingQuerycontentId370),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 370",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject370')._huntingQuerycontentId370)]",
-                "contentId": "[variables('huntingQueryObject370')._huntingQuerycontentId370]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject370').huntingQueryVersion370]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject370')._huntingQuerycontentId370]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top accounts performing user submissions (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject370')._huntingQuerycontentId370,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject370')._huntingQuerycontentId370,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject371').huntingQueryTemplateSpecName371]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top Inbound Subjects FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject371').huntingQueryVersion371]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_371",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FP) - Top Inbound Subjects",
-                "category": "Hunting Queries",
-                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient before counting\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\"\n| summarize count() by Subject\n| top 10 by count_\n| project ['Subject'] = Subject, ['Emails'] = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top 10 subjects of inbound emails submitted as false positives by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject371')._huntingQuerycontentId371),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 371",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject371')._huntingQuerycontentId371)]",
-                "contentId": "[variables('huntingQueryObject371')._huntingQuerycontentId371]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject371').huntingQueryVersion371]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject371')._huntingQuerycontentId371]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FP) - Top Inbound Subjects",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject371')._huntingQuerycontentId371,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject371')._huntingQuerycontentId371,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject372').huntingQueryTemplateSpecName372]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top Intra-Org P2 senders FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject372').huntingQueryVersion372]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_372",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FP) - Top Intra-Org P2 Senders",
-                "category": "Hunting Queries",
-                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient before counting\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Intra-org\"\n| summarize count() by SenderMailFromAddress\n| top 10 by count_\n| project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top 10 intra-org senders of emails submitted as false positives by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject372')._huntingQuerycontentId372),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 372",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject372')._huntingQuerycontentId372)]",
-                "contentId": "[variables('huntingQueryObject372')._huntingQuerycontentId372]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject372').huntingQueryVersion372]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject372')._huntingQuerycontentId372]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FP) - Top Intra-Org P2 Senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject372')._huntingQuerycontentId372,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject372')._huntingQuerycontentId372,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject373').huntingQueryTemplateSpecName373]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top email (P2) sender domains FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject373').huntingQueryVersion373]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_373",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FP) - Top P2 Sender Domains",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain = tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\n| summarize count() by P2SenderDomain\n| top 10 by count_\n| project ['Sender Domain'] = P2SenderDomain, ['Emails'] = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top 10 sender domains of emails submitted as false positives by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject373')._huntingQuerycontentId373),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 373",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject373')._huntingQuerycontentId373)]",
-                "contentId": "[variables('huntingQueryObject373')._huntingQuerycontentId373]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject373').huntingQueryVersion373]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject373')._huntingQuerycontentId373]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FP) - Top P2 Sender Domains",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject373')._huntingQuerycontentId373,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject373')._huntingQuerycontentId373,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject374').huntingQueryTemplateSpecName374]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions - Top email (P2) senders FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject374').huntingQueryVersion374]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_374",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submissions (FP) - Top Inbound P2 Senders",
-                "category": "Hunting Queries",
-                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient before counting\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\"\n| summarize count() by SenderMailFromAddress\n| top 10 by count_\n| project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the top 10 inbound senders of emails submitted as false positives by users."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject374')._huntingQuerycontentId374),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 374",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject374')._huntingQuerycontentId374)]",
-                "contentId": "[variables('huntingQueryObject374')._huntingQuerycontentId374]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject374').huntingQueryVersion374]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject374')._huntingQuerycontentId374]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submissions (FP) - Top Inbound P2 Senders",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject374')._huntingQuerycontentId374,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject374')._huntingQuerycontentId374,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject375').huntingQueryTemplateSpecName375]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions Trend - FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject375').huntingQueryVersion375]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_375",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Email Submission Trend (FP)",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nCloudAppEvents\n| where Timestamp >= TimeStart and Timestamp < TimeEnd\n| where ActionType == \"UserSubmission\"\n| extend RawData = parse_json(RawEventData)\n| where tostring(RawData.SubmissionType) == \"3\" and tostring(RawData.SubmissionContentType) == \"Mail\"\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"User_Email_FP\"\n| project Count, Details, Timestamp\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises the daily amount of user false positive email submissions over time."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject375')._huntingQuerycontentId375),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 375",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject375')._huntingQuerycontentId375)]",
-                "contentId": "[variables('huntingQueryObject375')._huntingQuerycontentId375]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject375').huntingQueryVersion375]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject375')._huntingQuerycontentId375]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Email Submission Trend (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject375')._huntingQuerycontentId375,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject375')._huntingQuerycontentId375,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject376').huntingQueryTemplateSpecName376]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions by Detection Method - Phish FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject376').huntingQueryVersion376]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_376",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Submissions by Detection Method - Phish (FP)",
-                "category": "Hunting Queries",
-                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient so the verdict is read once\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish'\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(Phish)\n| summarize count() by Phish\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises user false positive submissions by the original phish filter verdict on the reported message."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject376')._huntingQuerycontentId376),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 376",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject376')._huntingQuerycontentId376)]",
-                "contentId": "[variables('huntingQueryObject376')._huntingQuerycontentId376]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject376').huntingQueryVersion376]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject376')._huntingQuerycontentId376]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Submissions by Detection Method - Phish (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject376')._huntingQuerycontentId376,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject376')._huntingQuerycontentId376,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject377').huntingQueryTemplateSpecName377]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions by Detection Method - Spam FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject377').huntingQueryVersion377]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_377",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Submissions by Detection Method - Spam (FP)",
-                "category": "Hunting Queries",
-                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient so the verdict is read once\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam'\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\n| where isnotempty(Spam)\n| summarize count() by Spam\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises user false positive submissions by the original spam filter verdict on the reported message."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject377')._huntingQuerycontentId377),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 377",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject377')._huntingQuerycontentId377)]",
-                "contentId": "[variables('huntingQueryObject377')._huntingQuerycontentId377]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject377').huntingQueryVersion377]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject377')._huntingQuerycontentId377]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Submissions by Detection Method - Spam (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject377')._huntingQuerycontentId377,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject377')._huntingQuerycontentId377,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject378').huntingQueryTemplateSpecName378]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "User Submissions by Submission State - FP_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject378').huntingQueryVersion378]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_378",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "User Submissions by Submission State (FP)",
-                "category": "Hunting Queries",
-                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend RawData = parse_json(RawEventData)\n| extend RecordType = toint(RawData.RecordType), SubmissionType = tostring(RawData.SubmissionType), SubmissionState = tostring(RawData.SubmissionState)\n| where RecordType == 29 and SubmissionType == \"3\"\n| summarize count() by SubmissionState\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises user false positive submissions by submission state."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject378')._huntingQuerycontentId378),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 378",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject378')._huntingQuerycontentId378)]",
-                "contentId": "[variables('huntingQueryObject378')._huntingQuerycontentId378]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject378').huntingQueryVersion378]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject378')._huntingQuerycontentId378]",
-        "contentKind": "HuntingQuery",
-        "displayName": "User Submissions by Submission State (FP)",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject378')._huntingQuerycontentId378,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject378')._huntingQuerycontentId378,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject379').huntingQueryTemplateSpecName379]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Largest Malicious Email Campaigns by Cluster_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject379').huntingQueryVersion379]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_379",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Largest Malicious Email Campaigns by Cluster",
-                "category": "Hunting Queries",
-                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize Messages = count(),\n            Recipients = dcount(RecipientEmailAddress),\n            SenderDomains = dcount(SenderFromDomain),\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\n            SampleSubjects = make_set(Subject, 5),\n            FirstSeen = min(Timestamp),\n            LastSeen = max(Timestamp)\n        by EmailClusterId\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\n| top 20 by Messages\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Threat Mix']=ThreatMix, ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query surfaces the largest malicious inbound email campaigns, clustered by EmailClusterId, with one row per attack wave, using the EmailEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject379')._huntingQuerycontentId379),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 379",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject379')._huntingQuerycontentId379)]",
-                "contentId": "[variables('huntingQueryObject379')._huntingQuerycontentId379]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject379').huntingQueryVersion379]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject379')._huntingQuerycontentId379]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Largest Malicious Email Campaigns by Cluster",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject379')._huntingQuerycontentId379,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject379')._huntingQuerycontentId379,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject380').huntingQueryTemplateSpecName380]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Blocked URL Clicks by Workload_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject380').huntingQueryVersion380]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_380",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Blocked URL Clicks by Workload",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nUrlClickEvents\n| where Timestamp >= TimeStart\n| where ActionType == \"ClickBlocked\"\n| make-series Teams = countif(Workload == \"Teams\"), Office = countif(Workload == \"Office\"), Email = countif(Workload == \"Email\"), Copilot = countif(Workload == \"Copilot\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises blocked Safe Links URL clicks over time broken down by the workload the click came from (Email, Teams, Office, Microsoft 365 Copilot)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject380')._huntingQuerycontentId380),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 380",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject380')._huntingQuerycontentId380)]",
-                "contentId": "[variables('huntingQueryObject380')._huntingQuerycontentId380]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject380').huntingQueryVersion380]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject380')._huntingQuerycontentId380]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Blocked URL Clicks by Workload",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject380')._huntingQuerycontentId380,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject380')._huntingQuerycontentId380,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject381').huntingQueryTemplateSpecName381]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top 20 Malicious URLs by Clicks_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject381').huntingQueryVersion381]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_381",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top 20 Malicious URLs by Clicks",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| where ThreatTypes != \"\"\n| summarize ['Click Count'] = count() by Url, ThreatTypes, ActionType, Workload\n| top 20 by ['Click Count']\n| project ['URL'] = Url, ['Threat Types'] = ThreatTypes, ['Action Type'] = ActionType, Workload, ['Click Count']\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the top 20 URLs carrying a detection ranked by the number of clicks registered, with the threat type, click action and workload for each."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject381')._huntingQuerycontentId381),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 381",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject381')._huntingQuerycontentId381)]",
-                "contentId": "[variables('huntingQueryObject381')._huntingQuerycontentId381]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject381').huntingQueryVersion381]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject381')._huntingQuerycontentId381]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top 20 Malicious URLs by Clicks",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject381')._huntingQuerycontentId381,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject381')._huntingQuerycontentId381,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject382').huntingQueryTemplateSpecName382]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Top Clicks on Malicious URLs_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject382').huntingQueryVersion382]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_382",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Top Clicks on Malicious URLs",
-                "category": "Hunting Queries",
-                "query": "// Top 20 malicious URLs by click count, with threat type, click action and workload for context.\nUrlClickEvents\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| summarize ClickCount = count() by Url, ThreatTypes, ActionType, Workload\n| top 20 by ClickCount\n| project Url, ThreatTypes, ActionType, Workload, ClickCount\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query lists the malicious URLs that registered the most user clicks, with threat type, click action and workload, using the UrlClickEvents table."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject382')._huntingQuerycontentId382),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 382",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject382')._huntingQuerycontentId382)]",
-                "contentId": "[variables('huntingQueryObject382')._huntingQuerycontentId382]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject382').huntingQueryVersion382]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject382')._huntingQuerycontentId382]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Top Clicks on Malicious URLs",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject382')._huntingQuerycontentId382,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject382')._huntingQuerycontentId382,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject383').huntingQueryTemplateSpecName383]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URL Click-Through by Workload_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject383').huntingQueryVersion383]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_383",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URL Click-Through by Workload",
-                "category": "Hunting Queries",
-                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| where IsClickedThrough != \"0\"\n| where isnotempty(ThreatTypes)\n| summarize ['Click-Through Count'] = count() by Workload\n| sort by ['Click-Through Count'] desc\n| render piechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query shows malicious URL click-throughs (where the user proceeded past the Safe Links warning) broken down by the workload the click came from."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject383')._huntingQuerycontentId383),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 383",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject383')._huntingQuerycontentId383)]",
-                "contentId": "[variables('huntingQueryObject383')._huntingQuerycontentId383]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject383').huntingQueryVersion383]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject383')._huntingQuerycontentId383]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URL Click-Through by Workload",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject383')._huntingQuerycontentId383,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject383')._huntingQuerycontentId383,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject384').huntingQueryTemplateSpecName384]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "URL Threat Protection Summary_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject384').huntingQueryVersion384]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_384",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "URL Threat Protection Summary",
-                "category": "Hunting Queries",
-                "query": "let clicks = UrlClickEvents | where Timestamp > ago(30d);\nunion\n(clicks | where ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\") | summarize Count = count() | extend Details = \"Malicious Clicks Blocked\", Ord = 1),\n(clicks | where ActionType == \"ClickAllowed\" | summarize Count = count() | extend Details = \"Clicks Allowed Through\", Ord = 2),\n(clicks | summarize Count = dcount(AccountUpn) | extend Details = \"Users Clicking Links\", Ord = 3),\n(EmailUrlInfo | where Timestamp > ago(30d) | summarize Count = dcount(Url) | extend Details = \"Distinct URLs in Email\", Ord = 4)\n| sort by Ord asc\n| project Count, Details\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query summarises URL threat protection activity (Safe Links click outcomes and distinct URLs seen in email) as a set of headline metrics for the selected period."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject384')._huntingQuerycontentId384),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 384",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject384')._huntingQuerycontentId384)]",
-                "contentId": "[variables('huntingQueryObject384')._huntingQuerycontentId384]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject384').huntingQueryVersion384]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject384')._huntingQuerycontentId384]",
-        "contentKind": "HuntingQuery",
-        "displayName": "URL Threat Protection Summary",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject384')._huntingQuerycontentId384,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject384')._huntingQuerycontentId384,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject385').huntingQueryTemplateSpecName385]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Malware URL Detections Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject385').huntingQueryVersion385]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_385",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Malware URL Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\"\n| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)\n| where MalwareMethod contains \"URL\"\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by MalwareMethod\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises inbound email malware detections attributed to URL-based detection technologies over time."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject385')._huntingQuerycontentId385),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 385",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject385')._huntingQuerycontentId385)]",
-                "contentId": "[variables('huntingQueryObject385')._huntingQuerycontentId385]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject385').huntingQueryVersion385]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject385')._huntingQuerycontentId385]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Malware URL Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject385')._huntingQuerycontentId385,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject385')._huntingQuerycontentId385,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject386').huntingQueryTemplateSpecName386]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Phishing URL Detections Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject386').huntingQueryVersion386]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_386",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "Phishing URL Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\"\n| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)\n| where PhishMethod contains \"URL\"\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by PhishMethod\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises inbound email phishing detections attributed to URL-based detection technologies over time."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject386')._huntingQuerycontentId386),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 386",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject386')._huntingQuerycontentId386)]",
-                "contentId": "[variables('huntingQueryObject386')._huntingQuerycontentId386]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject386').huntingQueryVersion386]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject386')._huntingQuerycontentId386]",
-        "contentKind": "HuntingQuery",
-        "displayName": "Phishing URL Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject386')._huntingQuerycontentId386,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject386')._huntingQuerycontentId386,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('huntingQueryObject387').huntingQueryTemplateSpecName387]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "QR Code URL Detections Trend_HuntingQueries Hunting Query with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('huntingQueryObject387').huntingQueryVersion387]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.OperationalInsights/savedSearches",
-              "apiVersion": "2025-07-01",
-              "name": "Microsoft_Defender_XDR_Hunting_Query_387",
-              "location": "[parameters('workspace-location')]",
-              "properties": {
-                "eTag": "*",
-                "displayName": "QR Code URL Detections Trend",
-                "category": "Hunting Queries",
-                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet qrMessages = EmailUrlInfo\n| where Timestamp >= TimeStart\n| where UrlLocation == \"QRCode\"\n| distinct NetworkMessageId;\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Url\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where NetworkMessageId in (qrMessages)\n| make-series ['Phish QR Detection'] = countif(parse_json(DetectionMethods).Phish has \"URL\"), ['Malware QR Detection'] = countif(parse_json(DetectionMethods).Malware has \"URL\"), ['Spam QR Detection'] = countif(parse_json(DetectionMethods).Spam has \"URL\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
-                "version": 2,
-                "tags": [
-                  {
-                    "name": "description",
-                    "value": "This query visualises inbound email detections involving URLs embedded in QR codes over time, split by the threat type of the detection (phishing, malware, spam)."
-                  },
-                  {
-                    "name": "tactics",
-                    "value": "InitialAccess"
-                  },
-                  {
-                    "name": "techniques",
-                    "value": "T1566"
-                  }
-                ]
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject387')._huntingQuerycontentId387),'/'))))]",
-              "properties": {
-                "description": "Microsoft Defender XDR Hunting Query 387",
-                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject387')._huntingQuerycontentId387)]",
-                "contentId": "[variables('huntingQueryObject387')._huntingQuerycontentId387]",
-                "kind": "HuntingQuery",
-                "version": "[variables('huntingQueryObject387').huntingQueryVersion387]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('huntingQueryObject387')._huntingQuerycontentId387]",
-        "contentKind": "HuntingQuery",
-        "displayName": "QR Code URL Detections Trend",
-        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject387')._huntingQuerycontentId387,'-', '1.0.0')))]",
-        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject387')._huntingQuerycontentId387,'-', '1.0.0')))]",
-        "version": "1.0.0"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('workbookTemplateSpecName1')]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MicrosoftDefenderForOffice365detectionsandinsights Workbook with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('workbookVersion1')]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.Insights/workbooks",
-              "name": "[variables('workbookContentId1')]",
-              "location": "[parameters('workspace-location')]",
-              "kind": "shared",
-              "apiVersion": "2021-08-01",
-              "metadata": {
-                "description": "Gain extensive insight into your organization's Microsoft Defender for Office 365 protection across email and Microsoft Teams by analyzing and correlating events. \nYou can track detections and insights over time including: metrics for phish, spam, and malware, URL and URL click detection details, malicious file detections, Microsoft Teams collaboration protection (impersonation, voice phishing, and malicious URLs and files), post-delivery detections, user and admin submissions, system overrides, and actions taken by security administrators."
-              },
-              "properties": {
-                "displayName": "[parameters('workbook1-name')]",
-                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"\\n<table style=\\\"width:100%; border-collapse:collapse; border:none;\\\">\\n  <tr style=\\\"border:none;\\\">\\n    <td style=\\\"text-align:left; border:none; font-size:28px; font-weight:bold;width:1%;\\\">\\n      Microsoft Defender for Office 365 Detections and Insights\\n    </td>\\n    <td style=\\\"text-align:right; border:none;width:1%;\\\">\\n      <img height=\\\"40\\\" src=\\\"https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b\\\">\\n\\t</td>\\n  </tr>\\n</table>\\n<table>\\n<tr>\\n<td style=\\\"text-align:left; border:none; font-size:16px; width:10%;\\\">This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.<br>It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.<br> The workbook uses data from hunting tables streamed from <a href=\\\"https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables\\\">Microsoft Defender XDR</a> via the Microsoft Sentinel Connector. Keep the data in the <a href=\\\"https://learn.microsoft.com/en-us/azure/sentinel/configure-data-retention\\\">Log Analytics workspace</a> for as long as necessary to get insights over an extended period, based on your organisation's needs.</td>\\n</tr>\\n</table>\\n\\n> \\n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \\\"...\\\" located at the end of the tab list on the right side.*\\n> \\n\\n---\\n\\n\\n\\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view.\"},\"name\":\"text - 2\",\"id\":\"d2b45ab8-a1c1-43d2-853d-290640bf4c94\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b52e081b-490e-4f30-a6e8-d047ec40df7c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::all\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"fdc46b38-9d1e-42ac-9277-c6ff62e9ccc6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultWorkspace_Internal\",\"type\":1,\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationsmanagement/solutions'\\r\\n| where name contains 'SecurityInsights'\\r\\n| project workspaceId = tostring(properties.workspaceResourceId)\\r\\n| take 1\",\"crossComponentResources\":[\"value::all\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"6e647d99-1a32-4bca-8147-403b5d37d773\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| distinct subscriptionId, location\\r\\n| summarize by value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\\r\\n| order by value asc\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"d57bcdf5-aec7-4f86-904c-67171864919b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resources | where type =~ 'Microsoft.operationsmanagement/solutions' | where name contains 'SecurityInsights' \\r\\n| parse name with \\\"SecurityInsights(\\\" label \\\")\\\" \\r\\n| project id = tostring(properties.workspaceResourceId), label, selected = iff(id =~ '{DefaultWorkspace_Internal}', true, false)\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"\"},{\"id\":\"2e238f92-709c-410b-93e0-60eab6150a75\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":7776000000},\"key\":\"2e238f92-709c-410b-93e0-60eab6150a75\"},{\"id\":\"165f2f4a-e49f-4561-adc5-d0527a4caf32\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Granularity\",\"label\":\"Trend interval\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{ \\\"value\\\": \\\"1d\\\", \\\"label\\\": \\\"Daily (1d)\\\", \\\"selected\\\": true }, { \\\"value\\\": \\\"7d\\\", \\\"label\\\": \\\"Weekly (7d)\\\" }, { \\\"value\\\": \\\"30d\\\", \\\"label\\\": \\\"Monthly (30d)\\\" }, { \\\"value\\\": \\\"90d\\\", \\\"label\\\": \\\"Quarterly (90d)\\\" }]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"1d\"}],\"style\":\"pills\"},\"name\":\"parameters - 1\",\"id\":\"0021e733-42b4-461f-8f6c-14e6e765389d\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"3d26d949-bba8-486c-9af7-2b85bd5c8ab0\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Executive Summary\",\"subTarget\":\"1\",\"style\":\"link\",\"key\":\"3d26d949-bba8-486c-9af7-2b85bd5c8ab0\"},{\"id\":\"a5f95467-84c1-4d8b-858c-7819339af748\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Malware\",\"subTarget\":\"2\",\"style\":\"link\",\"key\":\"a5f95467-84c1-4d8b-858c-7819339af748\"},{\"id\":\"b6c93de8-16d9-4c90-999b-837935de5645\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Phish\",\"subTarget\":\"3\",\"style\":\"link\",\"key\":\"b6c93de8-16d9-4c90-999b-837935de5645\"},{\"id\":\"9e006e81-4fd4-40b9-9d20-3705dd6c17ad\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Impersonation & BEC\",\"subTarget\":\"15\",\"style\":\"link\",\"key\":\"75f1e28f-e95a-4810-af40-6b47b35cda46\"},{\"id\":\"df2c53b4-b6ed-4151-95fb-b3f08b849b84\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Spam\",\"subTarget\":\"4\",\"style\":\"link\",\"key\":\"df2c53b4-b6ed-4151-95fb-b3f08b849b84\"},{\"id\":\"fd2006c9-39b5-43ac-b05d-47309ee22deb\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Teams & Collaboration\",\"subTarget\":\"14\",\"style\":\"link\",\"key\":\"fd2006c9-39b5-43ac-b05d-47309ee22deb\"},{\"id\":\"ee01f95a-c5f7-4864-82e8-54a164741ba2\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"File - Malware (SharePoint, Teams and OneDrive)\",\"subTarget\":\"9\",\"style\":\"link\",\"key\":\"ee01f95a-c5f7-4864-82e8-54a164741ba2\"},{\"id\":\"9df30067-3266-48a8-b9e3-d65952098d46\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"URL & Clicks\",\"subTarget\":\"5\",\"style\":\"link\",\"key\":\"9df30067-3266-48a8-b9e3-d65952098d46\"},{\"id\":\"b4be0ac3-3f48-44a8-b4b6-b46e17c710cd\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Top Users & Exfiltration\",\"subTarget\":\"6\",\"style\":\"link\",\"key\":\"b4be0ac3-3f48-44a8-b4b6-b46e17c710cd\"},{\"id\":\"e1d34091-7b3c-4e2d-a032-8be82a989313\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Detection Overrides\",\"subTarget\":\"7\",\"style\":\"link\",\"key\":\"e1d34091-7b3c-4e2d-a032-8be82a989313\"},{\"id\":\"a1e6264d-8f85-4a94-9ffd-eee36c04a0d5\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Post-Delivery & Quarantine\",\"subTarget\":\"11\",\"style\":\"link\",\"key\":\"a1e6264d-8f85-4a94-9ffd-eee36c04a0d5\"},{\"id\":\"08c43a4f-f502-4813-9b8d-3f6b0b62b2fd\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"False Negative(FN) Submissions\",\"subTarget\":\"8\",\"style\":\"link\",\"key\":\"08c43a4f-f502-4813-9b8d-3f6b0b62b2fd\"},{\"id\":\"638d931f-f319-4914-b72d-8d68e914c7d4\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"False Positive(FP) Submissions\",\"subTarget\":\"10\",\"style\":\"link\",\"key\":\"638d931f-f319-4914-b72d-8d68e914c7d4\"},{\"id\":\"b2920bee-c32a-4fdd-9d32-b004db2f3ac8\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Operations Center (SOC) Insights\",\"subTarget\":\"13\",\"style\":\"link\",\"key\":\"b2920bee-c32a-4fdd-9d32-b004db2f3ac8\"}]},\"name\":\"links - 14\",\"id\":\"5c9a1d6b-c248-432b-a1c0-496337635775\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Defender for Office 365 - Protection Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Microsoft Defender for Office 365** is a comprehensive security solution designed to protect organizations from advanced threats targeting their email and collaboration tools. It leverages a multi-layered approach to safeguard against phishing, malware, business email compromise (BEC), and other sophisticated attacks.\\r\\n\"},\"name\":\"text - 13\",\"styleSettings\":{\"margin\":\"0\",\"padding\":\"0\"},\"id\":\"46119f93-fad9-413c-8e10-7615c6fdde2f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\n\\r\\n// Get all mailflow detected as clean at time of delivery \\r\\nlet EmailEventsClean = materialize( \\r\\n    EmailEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \\\"Inbound\\\" \\r\\n    | where ThreatTypes !contains \\\"Phish\\\" and ThreatTypes !contains \\\"Malware\\\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\\r\\n    // this alteration is due to the threat types being updated directly within advanced hunting.\\r\\n    //| where DeliveryLocation != \\\"Quarantine\\\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\\r\\n    | project NetworkMessageId,ThreatTypes \\r\\n); \\r\\n// Get all mailflow detected as phish or malware at time of delivery \\r\\nlet EmailEventsThreats = materialize( \\r\\n    EmailEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \\\"Inbound\\\" \\r\\n    | where ThreatTypes contains \\\"Phish\\\" or ThreatTypes contains \\\"Malware\\\" \\r\\n    | extend MDO_detection = parse_json(DetectionMethods) \\r\\n    | extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n    | extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \\r\\n); \\r\\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \\r\\nlet EmailPostDeliveryFiltered = materialize( \\r\\n    EmailPostDeliveryEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") or Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") \\r\\n    | extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n    | summarize arg_max(Timestamp, *) by Key \\r\\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \\r\\n); \\r\\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \\r\\nlet CloudAppEventsFiltered = materialize( \\r\\n    CloudAppEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \\r\\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \\r\\n    | where SubmissionType in (\\\"1\\\", \\\"2\\\") \\r\\n    | project SubmissionType,NetworkMessageId \\r\\n); \\r\\n// get the number of threats caught in mailflow \\r\\nlet Mal_Phish_Mailflow = toscalar( \\r\\n    EmailEventsThreats \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \\r\\nlet FP_ZAP = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ThreatTypes !contains \\\"Phish\\\" and ThreatTypes !contains \\\"Malware\\\" and Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") \\r\\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \\r\\nlet FN_ZAP_Successful = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") and ActionResult in (\\\"Success\\\",\\\"AdminPolicy\\\") \\r\\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats unsuccessfully cleaned up post delivery. \\r\\nlet FN_ZAP_Unsuccessful = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") and ActionResult !in (\\\"Success\\\",\\\"AdminPolicy\\\") \\r\\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// join the administrative submissions to clean mailflow to find the additional miss \\r\\nlet FN_Admin_Submissions = toscalar( \\r\\n    CloudAppEventsFiltered \\r\\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n    ); \\r\\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \\r\\n\\r\\nprint StatisticName=\\\"Effectiveness Post Delivery\\\", Value=abs(round(((toreal(toscalar(FN_Admin_Submissions))+toreal(toscalar(FN_ZAP_Unsuccessful)))/(toreal(toscalar(Mal_Phish_Mailflow))+toreal(toscalar(FN_ZAP_Successful))+toreal(toscalar(FN_ZAP_Unsuccessful))+toreal(toscalar(FN_Admin_Submissions))-toreal(toscalar(FP_ZAP)))*100-100),2))\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"statSettings\":{\"valueField\":\"Value\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"heatmapPalette\":\"greenRed\",\"thresholdsGrid\":[{\"operator\":\">\",\"thresholdValue\":\"95\",\"representation\":\"green\"},{\"operator\":\"<=\",\"thresholdValue\":\"95\",\"representation\":\"orange\"},{\"operator\":\"<=\",\"thresholdValue\":\"90\",\"representation\":\"red\"}]},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"tagText\":\"Phish / Malware Effectiveness - Post Delivery\",\"valueFontStyle\":\"superLarge\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"id\":\"62de2a91-a809-48ec-a111-e697d556b2b3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\\r\\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\\r\\n| where Action == \\\"Quarantine release\\\"\\r\\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \\\"Quarantine\\\") on NetworkMessageId\\r\\n| summarize count());\\r\\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \\\"Quarantine\\\"\\r\\n| summarize count());\\r\\nprint\\r\\nQuarantine_Releases = toreal(Quarantine_Releases),\\r\\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\\r\\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Release_Percentage\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},\"showBorder\":true,\"sortCriteriaField\":\"Release_Percentage\",\"size\":\"auto\"},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"statSettings\":{\"valueField\":\"Release_Percentage\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"heatmapPalette\":\"greenRed\",\"thresholdsGrid\":[{\"operator\":\"<\",\"thresholdValue\":\"5\",\"representation\":\"green\"},{\"operator\":\">\",\"thresholdValue\":\"5\",\"representation\":\"redDark\"}]},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"tagText\":\"Quarantine Release Percentage\",\"valueFontStyle\":\"superLarge\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - 1\",\"id\":\"858ac1a4-8828-45e9-968c-d3cfc1216c64\"}]},\"name\":\"TopNr\",\"id\":\"1369c97e-848b-475a-b447-3a435cb7a1f1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**Effectiveness visually represents the protection given by Defender for Office 365 against phishing and malware in email messages.** <br>\\r\\nWe consider messages that your users report, as well as decisions that are made after delivery.\"},\"name\":\"text - 9\",\"styleSettings\":{\"margin\":\"1px\"},\"id\":\"25e2e19e-aefb-4e37-b28f-b4138d63e109\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\n\\r\\n// Get all mailflow detected as clean at time of delivery \\r\\nlet EmailEventsClean = materialize( \\r\\n    EmailEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \\\"Inbound\\\" \\r\\n    | where ThreatTypes !contains \\\"Phish\\\" and ThreatTypes !contains \\\"Malware\\\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\\r\\n    // this alteration is due to the threat types being updated directly within advanced hunting.\\r\\n    //| where DeliveryLocation != \\\"Quarantine\\\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\\r\\n    | project NetworkMessageId,ThreatTypes \\r\\n); \\r\\n// Get all mailflow detected as phish or malware at time of delivery \\r\\nlet EmailEventsThreats = materialize( \\r\\n    EmailEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \\\"Inbound\\\" \\r\\n    | where ThreatTypes contains \\\"Phish\\\" or ThreatTypes contains \\\"Malware\\\" \\r\\n    | extend MDO_detection = parse_json(DetectionMethods) \\r\\n    | extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n    | extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \\r\\n); \\r\\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \\r\\nlet EmailPostDeliveryFiltered = materialize( \\r\\n    EmailPostDeliveryEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") or Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") \\r\\n    | extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n    | summarize arg_max(Timestamp, *) by Key \\r\\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \\r\\n); \\r\\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \\r\\nlet CloudAppEventsFiltered = materialize( \\r\\n    CloudAppEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \\r\\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \\r\\n    | where SubmissionType in (\\\"1\\\", \\\"2\\\") \\r\\n    | project SubmissionType,NetworkMessageId \\r\\n); \\r\\n// get the number of threats caught in mailflow \\r\\nlet Mal_Phish_Mailflow = toscalar( \\r\\n    EmailEventsThreats \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \\r\\nlet FP_ZAP = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ThreatTypes !contains \\\"Phish\\\" and ThreatTypes !contains \\\"Malware\\\" and Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") \\r\\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \\r\\nlet FN_ZAP_Successful = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") and ActionResult in (\\\"Success\\\",\\\"AdminPolicy\\\") \\r\\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats unsuccessfully cleaned up post delivery. \\r\\nlet FN_ZAP_Unsuccessful = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") and ActionResult !in (\\\"Success\\\",\\\"AdminPolicy\\\") \\r\\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// join the administrative submissions to clean mailflow to find the additional miss \\r\\nlet FN_Admin_Submissions = toscalar( \\r\\n    CloudAppEventsFiltered \\r\\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n    ); \\r\\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \\r\\nunion withsource=Table \\r\\n    (print StatisticName=\\\"Mal/Phish Mailflow totals - Minus FPs\\\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \\r\\n    (print StatisticName=\\\"Admin Mal/Phish FNs Submitted\\\", Value=toreal(FN_Admin_Submissions)), \\r\\n    (print StatisticName=\\\"Mal/Phish FPs Reverse Zapped\\\", Value=toreal(FP_ZAP)), \\r\\n    (print StatisticName=\\\"Mal / Phish Successfully Zapped\\\", Value=toreal(FN_ZAP_Successful)), \\r\\n    (print StatisticName=\\\"Mal / Phish UN-Successfully Zapped\\\", Value=toreal(FN_ZAP_Unsuccessful)), \\r\\n    (print StatisticName=\\\"Effectiveness Post Delivery (%)\\\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \\r\\n    (print StatisticName=\\\"Effectiveness Pre-Delivery (%)\\\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))) \\r\\n| project StatisticName, Value\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Value\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"StatisticName\",\"sourceIdField\":\"Value\",\"targetIdField\":\"Value\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"hivesMargin\":5}},\"name\":\"query - 7\",\"id\":\"9e09ff94-8092-49c7-860f-341049e1398c\"}]},\"customWidth\":\"50\",\"name\":\"Effectiveness Nr\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"31081a73-9a54-4668-9e26-ad7347f1e06e\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**Quarantine release rate by detection technology.** \\r\\n<br>\\r\\nFor each detector, the share of its quarantined mail that was later released (Release % = released / quarantined). A high rate can indicate false positives worth reviewing.\"},\"name\":\"text - 1\",\"styleSettings\":{\"margin\":\"1px\"},\"id\":\"e9848043-03dd-4ada-9e73-238067463f74\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Per detection technology: the share of its quarantined emails later released from quarantine (a high rate can indicate false positives). Top 7 by release rate; detectors with <10 quarantined excluded so the rate is meaningful.\\r\\nEmailEvents\\r\\n| where DeliveryLocation == \\\"Quarantine\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods)\\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0]))\\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\")\\r\\n| where FirstSubcategory contains \\\"Malware\\\" or FirstSubcategory contains \\\"Phish\\\"\\r\\n| join kind=leftouter (\\r\\n    EmailPostDeliveryEvents\\r\\n    | where Action == \\\"Quarantine release\\\"\\r\\n    | distinct NetworkMessageId\\r\\n    | extend ReleasedFlag = \\\"yes\\\"\\r\\n  ) on NetworkMessageId\\r\\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \\\"yes\\\") by FirstSubcategory\\r\\n| where Quarantined >= 10 and Released > 0\\r\\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\\r\\n| project ['Detection Technology']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\\r\\n| order by ['Release %'] desc\\r\\n| take 7\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Quarantined Emails\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Released\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Release %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"name\":\"query - 2\",\"id\":\"1bbae9d1-d6f8-446a-817c-8fdc2df83d4c\"}]},\"customWidth\":\"50\",\"name\":\"Quarantine Overview Relese\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"36fd8f20-ece7-4889-9fb1-f5b85b97b45a\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec Protection Insights\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"1d8e22e0-22f7-453e-aed2-9e56ace1363a\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Protection details\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis Overview provides an executive summary of your Microsoft Defender for Office 365 email security posture: the volume of mail processed, threats detected and filtered (phishing, malware, spam), overall protection effectiveness, and the mix of threats targeting your organization. Use it as a starting point, then drill into the dedicated tabs for detailed investigation.\"},\"name\":\"text - 13\",\"id\":\"24cf577c-e12a-4747-95a7-1c19bee17397\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5c0f0101-0a11-4b22-9c33-000000000101\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ProtectionView\",\"label\":\"Protection view\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{ \\\"value\\\": \\\"Table\\\", \\\"label\\\": \\\"Summary table\\\", \\\"selected\\\": true }, { \\\"value\\\": \\\"Tiles\\\", \\\"label\\\": \\\"Detailed tiles\\\" }]\",\"value\":\"Tiles\"}],\"style\":\"pills\"},\"name\":\"Protection view selector\",\"id\":\"5c0f0102-0a11-4b22-9c33-000000000102\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let base = materialize(EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize arg_max(Timestamp, ThreatTypes, DeliveryAction, OrgLevelPolicy, OrgLevelAction, UserLevelAction) by Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress));\\r\\nlet agg = materialize(base | summarize\\r\\n    Total = count(),\\r\\n    Filtered = countif(isnotempty(ThreatTypes) and DeliveryAction != \\\"Delivered\\\" and OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")),\\r\\n    FMal = countif(ThreatTypes has \\\"Malware\\\" and OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")),\\r\\n    FPhish = countif(ThreatTypes has \\\"Phish\\\" and not(ThreatTypes has \\\"Malware\\\") and DeliveryAction != \\\"Delivered\\\" and OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")),\\r\\n    FSpam = countif(ThreatTypes == \\\"Spam\\\" and DeliveryAction != \\\"Delivered\\\" and OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")),\\r\\n    Deliv = countif(isnotempty(ThreatTypes) and DeliveryAction == \\\"Delivered\\\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\\r\\n    Blocked = countif(isempty(ThreatTypes) and DeliveryAction != \\\"Delivered\\\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\\r\\n    Clean = countif(isempty(ThreatTypes) and DeliveryAction == \\\"Delivered\\\"));\\r\\nlet pd = materialize(EmailPostDeliveryEvents | where ActionResult == \\\"Success\\\" | summarize MalZap = countif(ActionType == \\\"Malware ZAP\\\"), PhishZap = countif(ActionType == \\\"Phish ZAP\\\"), SpamZap = countif(ActionType == \\\"Spam ZAP\\\"));\\r\\nlet sub = materialize(CloudAppEvents | extend R = tostring(parse_json(RawEventData).RecordType), SCT = tostring(parse_json(RawEventData).SubmissionContentType) | where R == \\\"29\\\" | summarize Adm = countif(ActionType == \\\"AdminSubmissionSubmitted\\\" and SCT == \\\"Mail\\\"), Usr = countif(ActionType == \\\"UserSubmission\\\"));\\r\\nlet Total = toscalar(agg | project Total);\\r\\nlet Filtered = toscalar(agg | project Filtered);\\r\\nlet FMal = toscalar(agg | project FMal);\\r\\nlet FPhish = toscalar(agg | project FPhish);\\r\\nlet FSpam = toscalar(agg | project FSpam);\\r\\nlet Deliv = toscalar(agg | project Deliv);\\r\\nlet Blocked = toscalar(agg | project Blocked);\\r\\nlet Clean = toscalar(agg | project Clean);\\r\\nlet MalZap = toscalar(pd | project MalZap);\\r\\nlet PhishZap = toscalar(pd | project PhishZap);\\r\\nlet SpamZap = toscalar(pd | project SpamZap);\\r\\nlet Adm = toscalar(sub | project Adm);\\r\\nlet Usr = toscalar(sub | project Usr);\\r\\nunion\\r\\n    (print o = 1, Name = \\\"Total Inbound Emails\\\", Count = Total),\\r\\n    (print o = 2, Name = \\\"    Filtering Totals\\\", Count = Filtered),\\r\\n    (print o = 3, Name = \\\"        Filtered as Malware\\\", Count = FMal),\\r\\n    (print o = 4, Name = \\\"        Filtered as Phish\\\", Count = FPhish),\\r\\n    (print o = 5, Name = \\\"        Filtered as Spam\\\", Count = FSpam),\\r\\n    (print o = 6, Name = \\\"    Delivered with Detection\\\", Count = Deliv),\\r\\n    (print o = 7, Name = \\\"    User/Admin Blocked\\\", Count = Blocked),\\r\\n    (print o = 8, Name = \\\"    Clean Emails\\\", Count = Clean),\\r\\n    (print o = 9, Name = \\\"Post-Delivery ZAP Removals\\\", Count = MalZap + PhishZap + SpamZap),\\r\\n    (print o = 10, Name = \\\"    Removed by Malware ZAP\\\", Count = MalZap),\\r\\n    (print o = 11, Name = \\\"    Removed by Phish ZAP\\\", Count = PhishZap),\\r\\n    (print o = 12, Name = \\\"    Removed by Spam ZAP\\\", Count = SpamZap),\\r\\n    (print o = 13, Name = \\\"User/Admin Reported\\\", Count = Adm + Usr),\\r\\n    (print o = 14, Name = \\\"    Reported by Admins\\\", Count = Adm),\\r\\n    (print o = 15, Name = \\\"    Reported by Users\\\", Count = Usr)\\r\\n| sort by o asc\\r\\n| extend [\\\"% of Inbound\\\"] = round(Count * 100.0 / Total, 1)\\r\\n| project Name, Count, [\\\"% of Inbound\\\"]\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Name\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"3fr\"}},{\"columnMatch\":\"Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"3fr\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"% of Inbound\",\"formatter\":3,\"formatOptions\":{\"palette\":\"green\",\"min\":0,\"max\":100,\"customColumnWidthSetting\":\"2fr\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"ProtectionView\",\"comparison\":\"isEqualTo\",\"value\":\"Table\"},\"name\":\"query - option 1 grid\",\"id\":\"5c0f0005-0a11-4b22-9c33-000000000005\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Emails\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| summarize Count = count()\\r\\n| extend Details = \\\"Total Inbound Emails\\\";\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"greenRed\"}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\"}}},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"blue\",\"compositeBarSettings\":{\"labelText\":\"\"}},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}},\"chartSettings\":{\"xAxis\":\"Count\",\"createOtherGroup\":0},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}}},\"name\":\"query - 1\",\"id\":\"84e8d60b-7937-46f5-b2f4-a1a4adf06c9f\"}]},\"name\":\"Total Inbound\",\"id\":\"1aeed046-9ea5-4583-b966-722847997fc7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Filtering Totals\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| where isnotempty(ThreatTypes) and EmailDirection == \\\"Inbound\\\" and DeliveryAction != 'Delivered'\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| summarize Count = count()\\r\\n| extend Details = \\\"Filtering Totals\\\";\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\"}}},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"redDark\",\"compositeBarSettings\":{\"labelText\":\"\"}},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"name\":\"query - 1\",\"id\":\"bae9a200-589f-4ca6-a3cf-f1110f644c49\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Total emails detected as Malware\\r\\nEmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| where ThreatTypes has ('Malware') and EmailDirection == \\\"Inbound\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Emails Filtered as Malware\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"red\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 4\",\"id\":\"0984d05b-fd2c-48e1-835f-41afc5a2385a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Total emails detected as Phish\\r\\nEmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| where ThreatTypes has \\\"Phish\\\" and not(ThreatTypes has \\\"Malware\\\") and EmailDirection == \\\"Inbound\\\" and DeliveryAction != 'Delivered'\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Emails Filtered as Phish\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"orange\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 4\",\"id\":\"ced2d054-76d1-40df-a412-0bc86a6c3336\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Total emails by detected as Spam\\r\\nEmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| where ThreatTypes == 'Spam' and EmailDirection == \\\"Inbound\\\" and DeliveryAction != 'Delivered'\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Emails Filtered as Spam\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"yellow\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 4\",\"id\":\"14456a0d-f5ac-46a0-a007-c72c7c40c58f\"}]},\"customWidth\":\"50\",\"name\":\"group - 9\",\"id\":\"d4e69885-f1b2-4c2b-85c2-188a6708dc4b\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\" \",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and DeliveryAction == 'Delivered'\\r\\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Delivered with Detection\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"red\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"394d1ed4-7089-4291-bc80-f9948e3be6a9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\" and isempty(ThreatTypes) \\r\\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\\r\\n| where DeliveryAction != 'Delivered'\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"User/Admin Blocked\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"gray\"},\"tooltipFormat\":{\"tooltip\":\"Emails blocked from being delivered because of User or Admin overriddes\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"c29a2268-67d1-4958-a9a3-696384075987\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| where isempty(ThreatTypes) and EmailDirection == \\\"Inbound\\\" and DeliveryAction == 'Delivered'\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Clean Emails\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"gray\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"89a02ac7-971c-4672-bf5d-64709c479536\"}]},\"customWidth\":\"50\",\"name\":\"group - 8\",\"id\":\"761e74d4-279e-465f-ba47-5eeec4cf05d2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Post-Delivery ZAP Removals\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailPostDeliveryEvents\\r\\n| where ActionResult == \\\"Success\\\"\\r\\n| where ActionType == \\\"Malware ZAP\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Removed by Malware ZAP\\\"\\r\\n\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"red\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"b06666bc-6ec0-49e7-a332-77e278d2320f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailPostDeliveryEvents\\r\\n| where ActionResult == \\\"Success\\\"\\r\\n| where ActionType == \\\"Phish ZAP\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Removed by Phish ZAP\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"orange\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"6fbac01b-0c42-46dc-8ca8-68e285593a45\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailPostDeliveryEvents\\r\\n| where ActionResult == \\\"Success\\\"\\r\\n| where ActionType == \\\"Spam ZAP\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Removed by Spam ZAP\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"yellow\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"7bd27a3b-be13-4ca0-9964-0f872f826b45\"}]},\"name\":\"Post Delivery\",\"id\":\"4d20339e-5215-4edf-99d6-728cac183d16\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\\r\\nCloudAppEvents\\r\\n| extend Record= (parse_json(RawEventData)).RecordType\\r\\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Reported by Admins\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"50\",\"name\":\"query - 3\",\"id\":\"7490fa3a-e287-4fc3-b025-8772b9edb601\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\\r\\nCloudAppEvents\\r\\n| extend Record= (parse_json(RawEventData)).RecordType\\r\\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\\r\\n| where Record == 29 and ActionType == \\\"UserSubmission\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Reported by Users\\\"\\r\\n\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"50\",\"name\":\"query - 2\",\"id\":\"7af222dc-fd74-40ec-8ab7-741e179c07bf\"}]},\"name\":\"Reported\",\"id\":\"8151e242-1c30-4550-ae9c-83f159e1a456\"}]},\"conditionalVisibility\":{\"parameterName\":\"ProtectionView\",\"comparison\":\"isEqualTo\",\"value\":\"Tiles\"},\"name\":\"Protection - Tiles view\",\"id\":\"5c0f0103-0a11-4b22-9c33-000000000103\"},{\"type\":1,\"content\":{\"json\":\"## Most Attacked Users<br>\\r\\n\\r\\n**The users most targeted by inbound email threats across all threat types (malware, phishing, and spam) in the selected period. Concentrated targeting of a few individuals is a strong signal of deliberate campaigns.**<br><br>**Recommended action:** Prioritise these users for security awareness training, tighter protection policies (for example the Strict preset), and closer monitoring - they are your highest-risk people.\"},\"name\":\"exec vap banner\",\"id\":\"1fe431fb-cc96-4e81-b164-3a1a3823ebeb\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query surfaces the users most targeted by inbound email threats across all threat types (malware, phishing, spam) for the selected period, so SecOps can prioritise the highest-risk individuals. Similar to a \\\"Most Attacked People\\\" view.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| where isnotempty(ThreatTypes)\\r\\n| summarize\\r\\n    ['Total Threats'] = count(),\\r\\n    Malware = countif(ThreatTypes has \\\"Malware\\\"),\\r\\n    Phish   = countif(ThreatTypes has \\\"Phish\\\"),\\r\\n    Spam    = countif(ThreatTypes has \\\"Spam\\\"),\\r\\n    ['Last Seen'] = max(Timestamp)\\r\\n    by ['User']=RecipientEmailAddress\\r\\n| top 10 by ['Total Threats']\\r\\n| project ['User'], ['Total Threats'], Malware, Phish, Spam, ['Last Seen']\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Malware\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"145px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Phish\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"145px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Spam\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"145px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Total Threats\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"145px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"exec vap table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"2dfd91b1-b8d3-4a72-aaf4-a30a1886bed7\"},{\"type\":1,\"content\":{\"json\":\"## Detection trend over time - grouped by {Granularity}\\r\\n**Represents total emails, total detections, total user submissions and admin email submissions over time summarizing the data per {Granularity} interval**\"},\"name\":\"text - 14\",\"id\":\"ddbbdaef-b374-42a8-821c-7fcd7ee53ba9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails, total detections, total user, and admin email submissions over time summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet scaffold = range Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran;\\r\\nlet baseQuery = materialize(EmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where isnotempty(Timestamp));\\r\\nlet sub = materialize(CloudAppEvents\\r\\n| extend Record = (parse_json(RawEventData)).RecordType, SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29);\\r\\nlet zapbase = EmailPostDeliveryEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ActionResult == \\\"Success\\\"\\r\\n| where ActionType == \\\"Phish ZAP\\\" or ActionType == \\\"Malware ZAP\\\" or ActionType == \\\"Spam ZAP\\\";\\r\\nunion\\r\\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \\\"Inbound\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Inbound Emails\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Phish') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Emails Detected as Phish\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Malware') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Emails Detected as Malware\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Spam') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Emails Detected as Spam\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \\\"Intra-org\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Intra-org Emails\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \\\"Outbound\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Outbound Emails\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where isnotempty(ThreatTypes) | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Emails with Threat\\\"),\\r\\n(scaffold | join kind=leftouter (sub | where ActionType == \\\"UserSubmission\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Emails Reported by Users\\\"),\\r\\n(scaffold | join kind=leftouter (zapbase | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Emails Removed by ZAP\\\"),\\r\\n(scaffold | join kind=leftouter (sub | where ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType == \\\"Mail\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Emails Reported by Admins\\\")\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\",\"seriesLabelSettings\":[{\"seriesName\":\"Total Inbound Emails\",\"label\":\"Inbound Emails\",\"color\":\"green\"},{\"seriesName\":\"Total Emails with Threat\",\"label\":\"Emails with Threat\",\"color\":\"redDark\"},{\"seriesName\":\"Emails Detected as Phish\",\"label\":\"Emails with Phish\",\"color\":\"redBright\"},{\"seriesName\":\"Emails Detected as Malware\",\"label\":\"Emails with Malware\",\"color\":\"red\"},{\"seriesName\":\"Total Intra-org Emails\",\"label\":\"Intra-org Emails\",\"color\":\"greenDark\"},{\"seriesName\":\"Emails Detected as Spam\",\"label\":\"Emails with Spam\",\"color\":\"gray\"},{\"seriesName\":\"Total Outbound Emails\",\"label\":\"Outbound Emails\",\"color\":\"greenDarkDark\"},{\"seriesName\":\"Total Emails Removed by ZAP\",\"label\":\"Emails ZAP-d\",\"color\":\"orangeDark\"},{\"seriesName\":\"Total Emails Reported by Users\",\"label\":\"User Reported Emails\",\"color\":\"lightBlue\"},{\"seriesName\":\"Total Emails Reported by Admins\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"bcbefa48-f553-4290-acff-2691caf898ea\"},{\"type\":1,\"content\":{\"json\":\"## Bad traffic (%) - Inbound Emails - grouped by {Granularity}\\r\\n**This represents bad traffic (% of emails with threats) compared to total inbound emails, summarized per {Granularity} interval over time.**\"},\"name\":\"text - 15\",\"id\":\"30761bcc-b1a5-45e2-8c0a-22388fbbf16c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalEmailCount = count(),\\r\\n            BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, {Granularity})\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| project Timestamp, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"508036a8-d969-44c2-b2d2-c62d99999197\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec Protection Details\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"e6edeeeb-dcde-41d0-88c7-97ef773403b1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Collaboration Protection Posture\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Defender for Office 365 protects Microsoft Teams and collaboration, not only email. This snapshot shows Teams threat activity for the period.<br><br>**Recommended action:** Review the dedicated **Teams &amp; Collaboration** tab for impersonation, malicious URLs, risky senders and file threats in Teams.\"},\"name\":\"exec collab banner\",\"id\":\"3d78a6aa-51d4-4cab-93d1-26dff86fd667\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Headline Microsoft Teams / collaboration protection metrics for the executive summary, with per-interval sparklines so the collaboration threat trend is visible at a glance. Messages and URLs are counted per distinct Teams message.\\r\\nlet gran = {Granularity};\\r\\nlet me = materialize(MessageEvents);\\r\\nlet cae = materialize(CloudAppEvents | where ActionType == \\\"TeamsImpersonationDetected\\\");\\r\\nlet mui = materialize(MessageUrlInfo);\\r\\nlet uce = materialize(UrlClickEvents | where Workload == \\\"Teams\\\" and ActionType in (\\\"ClickBlocked\\\",\\\"ClickBlockedByTenantPolicy\\\"));\\r\\nlet fmc = materialize(FileMaliciousContentInfo | where Workload == \\\"MicrosoftTeams\\\");\\r\\nunion\\r\\n(me | summarize Count = dcount(TeamsMessageId) | extend Details = \\\"Teams Messages Scanned\\\", Ord = 1, Trend = toscalar(me | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(me | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Teams Threat Messages\\\", Ord = 2, Trend = toscalar(me | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(cae | summarize Count = count() | extend Details = \\\"Teams Impersonation Detections\\\", Ord = 3, Trend = toscalar(cae | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(mui | summarize Count = dcount(TeamsMessageId) | extend Details = \\\"URLs Shared in Teams\\\", Ord = 4, Trend = toscalar(mui | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(uce | summarize Count = count() | extend Details = \\\"Malicious Clicks Blocked\\\", Ord = 5, Trend = toscalar(uce | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(fmc | summarize Count = count() | extend Details = \\\"Teams Files Scanned\\\", Ord = 6, Trend = toscalar(fmc | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(fmc | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Malicious Teams Files\\\", Ord = 7, Trend = toscalar(fmc | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S))\\r\\n| sort by Ord asc\\r\\n| project Details, Count, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"name\":\"exec collab tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3175aee5-56d2-4cb1-b1c3-75be683e6ffb\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec Collaboration Posture\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"39b0921f-fcef-49f4-8d52-0dcd1f33045b\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Emerging Threats\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n<p style=\\\"font-size:16px;\\\">With more sophisticated adversaries and new threats emerging frequently and prevalently, it's critical to be able to quickly identify and react to these threats.</p>\\r\\n\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️Activity Profile: Email threat landscape</b></p>](https://security.microsoft.com/threatanalytics3/f186e4b0-28df-499a-901e-c64768b6d0dc/overview?filters=tags%253DPhishing)\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️Activity Profile: Automated business email impersonation campaign uses parallel aging report and payroll diversion lures</b></p>](https://security.microsoft.com/threatanalytics3/3eb53378-892d-4695-a497-25d0a54181ee)\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️Tool Profile: StealC</b></p>](https://security.microsoft.com/threatanalytics3/4d837c12-1db4-49c8-8466-219198d40b9b)\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️OSINT Profile: UNC1151/Ghostwriter phishing campaign targeting Gmail accounts</b></p>](https://security.microsoft.com/threatanalytics3/b1a7e5e7-4b43-4758-8805-f714a131161a)\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️Activity Profile: Encrypted message campaign targets real estate/financial sectors</b></p>](https://security.microsoft.com/threatanalytics3/651d669a-4721-42ab-bb96-509e94b5bfd9)\\r\\n\\r\\n<br>\\r\\n<a href=\\\"https://go.microsoft.com/fwlink/?linkid=2323913\\\" target=\\\"_blank\\\" style=\\\"font-size:14px; padding:10px 20px; background-color:#003366; color:white; border:none; border-radius:5px;\\\">\\r\\n<b>View all\\r\\n \\r\\n</a>\\r\\n\"},\"name\":\"text - 10\",\"styleSettings\":{\"margin\":\"0\",\"padding\":\"0\"},\"id\":\"0c781e85-af9a-41a6-9cf7-b3bb9a09d5d0\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec Emerging Threats\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"4f8886d3-882a-4c14-ab7f-a37bd302e32f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Microsoft 365 Secure Email Gateway Performance\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n<p style=\\\"font-size:16px;\\\">Using multiple vendor email security products can offer diverse detections. However, our comprehensive end-to-end approach—spanning prevention, detection, posture, investigation, response, and user training—delivers a unified and effective defense that matches or exceeds the efficacy of siloed Secure Email Gateway solutions.</p>\\r\\n\\r\\n[<p style=\\\"font-size:18px;\\\"><b>Learn more</b></p>](https://www.microsoft.com/en-us/security/blog/2026/06/15/microsoft-defender-email-security-benchmarking-key-insights-from-one-year-of-data/) \\r\\n\\r\\n<br>\\r\\n<p style=\\\"font-size:16px;\\\"><b>High-severity email threats missed per 1,000 users protected - February–April 2026 (Microsoft Defender email security benchmarking)</b></p>\"},\"name\":\"text - 12\",\"id\":\"94c804f9-2860-4768-be59-fb31a4ff22d7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"datatable(Index:int, Name:string, Value:int)\\r\\n[\\r\\n    1, \\\"Defender for Office 365\\\", 194,\\r\\n    2, \\\"Mimecast\\\", 478,\\r\\n    3, \\\"ProofPoint\\\", 483,\\r\\n    4, \\\"HornetSecurity\\\", 813,\\r\\n    5, \\\"TrendMicro\\\", 1151,\\r\\n    6, \\\"IronPort\\\", 1274,\\r\\n    7, \\\"Barracuda\\\", 1585,\\r\\n    8, \\\"FireEye\\\", 2107\\r\\n]\\r\\n| project [\\\"Email security solution\\\"] = Name, [\\\"High-severity threats missed / 1K users\\\"] = Value\\r\\n| order by [\\\"High-severity threats missed / 1K users\\\"] asc\\r\\n\",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Email security solution\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"High-severity threats missed / 1K users\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"min\":0,\"max\":2107,\"customColumnWidthSetting\":\"60%\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}],\"rowLimit\":10,\"sortBy\":[{\"itemKey\":\"High-severity threats missed / 1K users\",\"sortOrder\":1}]}},\"name\":\"query - 11\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e54fd5bd-17e2-40dc-897d-8a3bb21116ff\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec SEG Performance\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"1f3a7e2b-0a1f-48ba-9da3-e7531d500938\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"id\":\"ab3756d3-3f60-4024-9376-0f1a7d47ac13\",\"type\":1,\"name\":\"text - 18\",\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Stay Current\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n<br>\\r\\n\\r\\n- **Threat Analytics (Defender XDR)** — live, tenant-specific threat intelligence and recommended actions: <a href=\\\"https://learn.microsoft.com/en-us/defender-xdr/threat-analytics\\\" target=\\\"_blank\\\">aka.ms/threatanalytics</a>\\r\\n- **Microsoft Security Blog** — campaign write-ups and threat research: <a href=\\\"https://www.microsoft.com/en-us/security/blog/\\\" target=\\\"_blank\\\">microsoft.com/security/blog</a>\\r\\n- **Microsoft Defender for Office 365 Tech Community blog** — product updates and reporting guidance: <a href=\\\"https://techcommunity.microsoft.com/category/microsoft-defender-for-office-365/blog/microsoftdefenderforoffice365blog\\\" target=\\\"_blank\\\">Tech Community</a>\\r\\n- **Latest features in Microsoft Defender for Office 365** — <a href=\\\"https://learn.microsoft.com/en-us/defender-office-365/defender-for-office-365-whats-new\\\" target=\\\"_blank\\\">What's new in Microsoft Defender for Office 365</a> \\r\\n- **Share reporting feedback**: <a href=\\\"https://aka.ms/mdoreportingfeedback\\\" target=\\\"_blank\\\">aka.ms/mdoreportingfeedback</a>\\r\\n\"}}]},\"customWidth\":\"100\",\"name\":\"group - Exec Stay Current\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"5e22c565-cd2e-41f3-8d5a-0735af67c93f\"}],\"exportParameters\":true},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Detection Overview\",\"styleSettings\":{\"margin\":\"0\",\"padding\":\"0\"},\"id\":\"3f2cc277-9eb3-486d-a1f8-9fa5374a3d80\"},{\"type\":1,\"content\":{\"json\":\"# Malware detection insights\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **malware threat** (such as viruses, spyware, or ransomware) within its **URLs** or **attachments**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"text - 13\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"81f28ffc-b69e-4960-a61c-cac17a012ed6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of inbound email malware detections for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet mal = EmailEvents | where EmailDirection == \\\"Inbound\\\" | where ThreatTypes has \\\"Malware\\\";\\r\\nlet inbox = mal | where DeliveryLocation has \\\"Inbox\\\";\\r\\nlet malTrend = toscalar(mal | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(mal | summarize count()), Details = \\\"Malware Emails\\\", Ord = 1, Trend = malTrend),\\r\\n(print Count = toscalar(mal | summarize dcount(RecipientEmailAddress)), Details = \\\"Users Targeted\\\", Ord = 2, Trend = malTrend),\\r\\n(print Count = toscalar(mal | summarize dcount(SenderFromDomain)), Details = \\\"Sender Domains\\\", Ord = 3, Trend = malTrend),\\r\\n(print Count = toscalar(inbox | summarize count()), Details = \\\"Delivered to Inbox\\\", Ord = 4, Trend = inboxTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"malware kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"20c06dd3-5025-4b2b-960e-ff012f5d2343\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Malware Detection Trends, Threat Classes, and Malware Names\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend, threat classes and Malware types. \\r\\n<br><br>**Recommended action:** If malware volume spikes, confirm Safe Attachments (Block mode) is enabled for all users and investigate the top malware families below.\"},\"name\":\"text - 14\",\"id\":\"1f09c6ec-b2de-4aa9-bd8e-81d11c92ebd4\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detection Trend\\r\\n**This visual displays a per-{Granularity} trend of email malware detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for malware threats.**\"},\"name\":\"text - Malware Trend header\",\"id\":\"e90b714f-de84-4571-9a60-b3b2f3bd09dd\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents \\r\\n| where ThreatTypes has \\\"Malware\\\" \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize MalwareDetections = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, MalwareDetections = coalesce(MalwareDetections, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"MalwareDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 0\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"350d0aa3-c093-4105-a150-c20111ac2912\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detection Trend - Advanced Threats\\r\\n**Not all threats are going to be easily recognisable, that's why Microsoft Defender for Office 365 has advanced threat detection methods, that use virtual sandbox environments to detonate URLs and Files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Malware detections of these advanced threats**\"},\"name\":\"text - Malware Advanced Threats header\",\"id\":\"12e07248-ada4-41d9-99cc-824eb65cff79\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Malware'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand MalwareMethod = ParsedMethods.Malware\\r\\n| where MalwareMethod in ('File detonation','URL detonation')\\r\\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\\r\\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\\r\\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\\r\\n| sort by MalwareMethod asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"File detonation\",\"color\":\"redDark\"},{\"seriesName\":\"URL detonation\",\"color\":\"orangeDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 9\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"ebcb6f29-02be-4dd0-b792-cd99285c29d4\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Threat Classification\\r\\n**Summary of email messages detected by Microsoft Defender for Office 365 as malware, grouped by type of malware (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware).**\"},\"customWidth\":\"33\",\"name\":\"text - 15\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5638fc51-0830-4675-87d4-82f03df17bbf\"},{\"type\":1,\"content\":{\"json\":\"### Top Attacked Users by Malware Threat Classification\\r\\n**Displays the recipient most frequently targeted for each malware type (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware) in inbound email detections.**\"},\"customWidth\":\"33\",\"name\":\"text - 15 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d2e3903b-4984-40da-a437-3d6a2b121e23\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Threat Name\\r\\n**Summarises email messages flagged by Microsoft Defender for Office 365, grouped by specific malware names detected in URLs or attachments.**\"},\"customWidth\":\"33\",\"name\":\"text - 15 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6c0bebcf-9838-4385-ab3a-30db6c994284\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by threat classification of the malware threat in the message.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where ThreatTypes has 'Malware' and ThreatClassification  has_any(\\\"Adware\\\",\\\"Downloader\\\",\\\"HackTool\\\",\\\"Ransomware\\\",\\\"Remote access trojan\\\",\\\"Spyware\\\")\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Count = count(Key) by ThreatClassification\\r\\n| sort by Count desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"33\",\"name\":\"query - 11\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"acb98530-8e3a-4383-b42f-8fd74b1c3fbe\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Malware detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where ThreatTypes has \\\"Malware\\\" and EmailDirection == \\\"Inbound\\\" and ThreatClassification has_any(\\\"Adware\\\",\\\"Downloader\\\",\\\"HackTool\\\",\\\"Ransomware\\\",\\\"Remote access trojan\\\",\\\"Spyware\\\")\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\\r\\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\\r\\n| sort by Count desc\\r\\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"TopEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true},\"statSettings\":{\"valueField\":\"RecipientEmailAddress\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"auto\"},\"chartSettings\":{\"xAxis\":\"RecipientEmailAddress\"}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 5 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d9b46c97-91ce-4d64-aca6-3126ac49c0ff\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.\\r\\nEmailEvents \\r\\n| where isnotempty(ThreatNames) and ThreatTypes has \\\"Malware\\\" \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| mv-expand ThreatName = split(ThreatNames, \\\",\\\") to typeof(string)\\r\\n| where isnotempty(ThreatName)\\r\\n| distinct Key, ThreatName\\r\\n| summarize Count = count() by ThreatName\\r\\n| top 15 by Count\\r\\n| project ['Threat Name'] = ThreatName, Count\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"xAxis\":\"ThreatNames\",\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b9a4b34f-f54f-4d6e-bb20-81925d0f5540\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"group - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"82853a93-e11f-4e4a-80f4-733850a1d3ff\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Malware Detections by Delivery Location, Detection Technology and Sender Infrastructure Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain malware detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Malware. \\r\\n<br><br>**Recommended action:** For sender IPs or countries you do not do business with, consider connection filtering or geo-based rules; verify the detection technologies catching these are enabled.\"},\"name\":\"banner - Malware Delivery Detection Sender\",\"id\":\"cba6403d-e2b1-4fe8-af52-57e5c2aa8e54\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by delivery location\\r\\n**Visualizes counts (per {Granularity}) of malware detections of inbound emails by delivery location: Quarantine or Failed (rejected with or without NDR)**\"},\"name\":\"text - Malware Delivery Location header\",\"id\":\"95be7f48-40eb-4154-91d8-20f7033f2ff5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Malware' and EmailDirection == 'Inbound'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalMalwareDetections=count(), Quarantine=countif(DeliveryLocation == 'Quarantine'), Failed=countif(DeliveryLocation == 'Failed') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, TotalMalwareDetections=coalesce(TotalMalwareDetections,0), Quarantine=coalesce(Quarantine,0), Failed=coalesce(Failed,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalMalwareDetections\",\"color\":\"blue\"},{\"seriesName\":\"Quarantine\",\"color\":\"orangeDark\"},{\"seriesName\":\"Failed\",\"color\":\"redDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 10\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b2c19e58-2123-490b-9631-c0b238c582e6\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Detection Technology\\r\\n**Visualizes counts (per {Granularity}) of Malware detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**\"},\"name\":\"text - Malware Detection Technology header\",\"id\":\"f3c2691e-4f32-4109-9524-8a11719e4425\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Malware'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand MalwareMethod = ParsedMethods.Malware\\r\\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\\r\\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\\r\\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\\r\\n| sort by MalwareMethod asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"66\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 8\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f00c1ce0-e55e-44c0-8bf0-4af662ccef89\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.\\r\\nEmailEvents \\r\\n| where DetectionMethods has 'Malware'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand MalwareMethod = ParsedMethods.Malware\\r\\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod)\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = MalwareMethod, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"34\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"590880a9-1cf7-44ae-b4de-2f65bc700b5d\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by SenderIPv4 Geo Location\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Malware, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"name\":\"text - Malware Geo Location header\",\"id\":\"19d78b48-af58-4bee-abfe-57efb1eba125\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by email sender IP address (SenderIPv4).\\r\\nEmailEvents \\r\\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_\",\"size\":0,\"showAnalytics\":true,\"title\":\"Malware Detections-Sender Heatmap (IPv4)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"count_\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"count_\",\"sortOrder\":2}],\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"GeoInfo\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8cb46ec0-ac2a-41d1-bf8a-0b8585d1fefc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Malware Emails'] = count_\\r\\n| sort by ['Malware Emails'] desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Malware Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"GeoInfo\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 1 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b6a0355a-2b8f-48a5-8edc-58f4f7f8180a\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"Malware-Detectiontech-Deliverylocation-SendingInfra\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"2692cb5e-825c-45c1-bd3a-096b55e8d760\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Malware Detections Top attacked users and top senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders. \\r\\n<br><br>**Recommended action:** Apply the Strict preset security policy to the most-attacked users and consider adding persistent malicious sender domains to the Tenant Allow/Block List.\"},\"name\":\"banner - Malware Top Users Senders\",\"id\":\"bc5b37a4-71e4-4a2f-b0ba-b3dd87333391\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections top attacked users\\r\\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Malware. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**\"},\"customWidth\":\"100\",\"name\":\"text - Malware Top Users header\",\"id\":\"cb87a026-ad03-45cc-887e-ab460490d9a5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails with Malware detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(ThreatTypes has \\\"Malware\\\") by RecipientEmailAddress\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| where MalwareEmailCount !=0\\r\\n| top 15 by MalwareEmailCount\\r\\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Malware Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - Malware Top Recipients\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e7ffef62-f85e-4188-8ab9-d90a5c666c30\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains with Malware Detections (Inbound)\\r\\n**Displays the top 10 sender domains sending inbound emails detected as Malware. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Malware Top Senders header\",\"id\":\"93390807-25b2-4bea-9648-98e821da8ec6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \\\"Malware\\\") by SenderFromDomain\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| where MalwareEmailCount !=0\\r\\n| top 15 by MalwareEmailCount\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Malware Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"BadEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - Malware Top Sender Domains\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"eaa45734-2df2-4a5e-b35b-1295e00cb46f\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"MalwareTopAttackedUser-TopSenders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"4e0900ab-e7e4-4cf1-93a4-7e86bca20782\"},{\"type\":1,\"content\":{\"json\":\"# Phishing Detection Insights\\r\\n\\r\\n---\\r\\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Phishing threat** within its **email content**, **URLs**, or **attachments**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"text - 24\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fe82d665-fa9e-4fc2-9ba9-7e2eabb9a04b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of inbound email phishing detections for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet ph = EmailEvents | where EmailDirection == \\\"Inbound\\\" | where ThreatTypes has \\\"Phish\\\";\\r\\nlet inbox = ph | where DeliveryLocation has \\\"Inbox\\\";\\r\\nlet phTrend = toscalar(ph | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(ph | summarize count()), Details = \\\"Phish Emails\\\", Ord = 1, Trend = phTrend),\\r\\n(print Count = toscalar(ph | summarize dcount(RecipientEmailAddress)), Details = \\\"Users Targeted\\\", Ord = 2, Trend = phTrend),\\r\\n(print Count = toscalar(ph | summarize dcount(SenderFromDomain)), Details = \\\"Sender Domains\\\", Ord = 3, Trend = phTrend),\\r\\n(print Count = toscalar(inbox | summarize count()), Details = \\\"Delivered to Inbox\\\", Ord = 4, Trend = inboxTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"phish kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5debf0b8-4384-485b-8a7f-71ead592718a\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%;\\\">Phishing Detection Trend, LLM Content Analysis, Advanced Threats, and Threat Classes\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends, advanced threat detections, LLM-based content analysis, and threat classes.<br><br>**Recommended action:** Review the LLM-classified phishing themes; enable Safe Links and impersonation protection, and prioritise awareness training on the dominant lure types.\"},\"name\":\"text - Phish Section1 Banner\",\"id\":\"ce5e489f-c83b-4bc8-9e63-b08dfb5ef31f\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detection Trend<br>\\r\\n\\r\\n**This visual displays a per-{Granularity} trend of email Phish detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Phish threats.**\"},\"name\":\"text - Phish Trend Header\",\"id\":\"429ef4d2-61a9-40d0-940f-2212ddce22ce\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections over time summarizing the data daily.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has \\\"Phish\\\"\\r\\n| summarize PhishDetections = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, PhishDetections = coalesce(PhishDetections, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"PhishDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b0d170ec-331c-4ad0-8ce6-258704cc5345\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detection Trend - Advanced Threats<br>\\r\\n\\r\\n**Not all threats are easily recognizable, which is why Microsoft Defender for Office 365 uses advanced detection methods, including virtual sandbox environments to detonate URLs and files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Phish detections of these advanced threats.**\"},\"name\":\"text - Phish AdvThreats Header\",\"id\":\"425476e0-066a-42ee-afb9-5dabc612a3c8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| project Timestamp, RecipientEmailAddress, NetworkMessageId, DT=parse_json(DetectionMethods)\\r\\n| evaluate bag_unpack(DT)\\r\\n| summarize [\\\"File detonation\\\"]=countif(Phish has 'File detonation' and Phish !has 'File detonation reputation'), [\\\"URL detonation\\\"]=countif(Phish has 'URL detonation' and Phish !has 'URL detonation reputation') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, [\\\"File detonation\\\"]=coalesce([\\\"File detonation\\\"],0), [\\\"URL detonation\\\"]=coalesce([\\\"URL detonation\\\"],0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"URL detonation\",\"color\":\"orangeDark\"},{\"seriesName\":\"File detonation\",\"color\":\"redDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish AdvThreats Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6b62347a-b162-49e6-891c-07697af22dd9\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - LLM content analysis<br>\\r\\n\\r\\n**Microsoft Defender for Office 365 uses Language AI for Phish and Business Email Compromise (BEC) detection. These models are progressively learning from thousands of real-world phishing attempts and analyzing all messages classified as phish. Furthermore, it incorporates advanced Machine Learning and Natural Language Processing (NLP) techniques to read, process, and understand email content the way a human analyst might, yet in a fraction of the time and at a large scale. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-defender-for-office-365s-language-ai-for-phish-enhancing-email-securit/4410446)**\"},\"customWidth\":\"50\",\"name\":\"text - Phish LLM Content Header\",\"id\":\"c23460b1-e025-4f6c-b2d5-3f78c0c9afc6\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - LLM Threat Classifications<br>\\r\\n\\r\\n**Microsoft Defender for Office 365 uses purpose-built Large Language Models (LLM) at scale to provide AI-powered email and collaboration security. Our solution now parses language to understand and identify attacker intent and classifies threats at machine speed – keeping malicious emails out of your inbox and giving security operations (SOC) teams a new level of insight into adversary techniques. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-ignite-redefining-email-security-with-llms-to-tackle-a-new-era-of-soci/4302421)**\"},\"customWidth\":\"50\",\"name\":\"text - Phish LLM ThreatClass Header\",\"id\":\"1d723c26-501f-4385-9331-957ab7ae5019\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails detected as Phish by LLM content analysis detection technology in Microsoft Defender for Office 365. \\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has 'Phish' and DetectionMethods contains \\\"LLM content analysis\\\"\\r\\n| summarize count()\\r\\n| sort by count_ desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"thresholdsGrid\":[{\"operator\":\">\",\"thresholdValue\":\"0\",\"representation\":\"red\"},{\"operator\":\"<=\",\"thresholdValue\":\"0\",\"representation\":\"red\"}]},\"tagText\":\"\",\"valueFontStyle\":\"auto\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - Phish LLM Content Count\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"86a301c5-2bc0-436a-982c-861beee7c9ab\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by intent of the message.\\r\\n// Microsoft Defender for Office 365 LLM analysis is analyzing email messages to understand the intent of the messages. These threat classifications are then used in filtering decisions.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has 'Phish' and ThreatClassification  has_any(\\\"Business intelligence\\\",\\\"Contact establishment\\\",\\\"Gift card\\\",\\\"Invoice\\\",\\\"Payroll\\\",\\\"PII gathering\\\",\\\"Task\\\")\\r\\n| summarize count() by ThreatClassification\\r\\n| sort by count_ desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - Phish LLM ThreatClass Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d547b730-f174-4f78-8998-02f24453304e\"},{\"type\":1,\"content\":{\"json\":\"### Top Attacked Users by LLM Threat classes (Phish)<br>\\r\\n\\r\\n**Displays recipients most frequently targeted by inbound phishing emails, grouped by threat classification (e.g., Gift Card, Invoice, Payroll). Helps identify users at higher risk for phishing attacks. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish LLM TopUsers Header\",\"id\":\"4ba9d9eb-d88d-4e5d-ba58-a740559677f7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Phish detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has \\\"Phish\\\" and EmailDirection == \\\"Inbound\\\" and ThreatClassification has_any(\\\"Business intelligence\\\",\\\"Contact establishment\\\",\\\"Gift card\\\",\\\"Invoice\\\",\\\"Payroll\\\",\\\"PII gathering\\\",\\\"Task\\\")\\r\\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\\r\\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\\r\\n| sort by Emails desc\\r\\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"80px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"query - Phish LLM TopUsers\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"51599ab2-db69-4195-b4e9-2828729ec35b\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"group - 5\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"25c47f6a-3525-435e-90cf-357f02fb2fed\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Phish Detections by Delivery location, Detection technology and Sender infrastructure insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Phish detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Phish.<br><br>**Recommended action:** Verify anti-phishing and Safe Links policies cover these delivery paths; consider blocking sender infrastructure from regions you do not operate in, where appropriate.\"},\"name\":\"text - Phish Section2 Banner\",\"id\":\"6876063e-6a4f-48ea-829d-4486922783dd\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections by delivery location<br>\\r\\n\\r\\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various delivery locations: Quarantine, Junk folder or Failed (rejected with or without NDR)**\"},\"name\":\"text - Phish DeliveryLoc Header\",\"id\":\"b5045aab-1b4b-4d35-af41-a6315d36e864\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\" and EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalPhishDetections=count(), Quarantine=countif(DeliveryLocation == \\\"Quarantine\\\"), Junkfolder=countif(DeliveryLocation == \\\"Junk folder\\\"), Inbox=countif(DeliveryLocation == \\\"Inbox/folder\\\"), Failed=countif(DeliveryLocation == \\\"Failed\\\"), Dropped=countif(DeliveryLocation == \\\"Dropped\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, TotalPhishDetections=coalesce(TotalPhishDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Quarantine\",\"color\":\"greenDark\"},{\"seriesName\":\"Failed\",\"color\":\"green\"},{\"seriesName\":\"Dropped\",\"color\":\"green\"},{\"seriesName\":\"Junk folder\",\"color\":\"orangeDark\"},{\"seriesName\":\"Inbox\",\"color\":\"redBright\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish DeliveryLoc Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e839848c-d176-4251-bbb4-1c2e1103ed2d\"},{\"type\":1,\"content\":{\"json\":\"### Phish detections by Detection Technology<br>\\r\\n\\r\\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**\"},\"name\":\"text - Phish DetTech Header\",\"id\":\"149bf1b3-80cc-4e82-ae5d-ddee0f6b0cd9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls in Microsoft Defender for Office 365.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"createOtherGroup\":15}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish DetTech Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b0b16329-e1a6-4138-871e-76d57a60b978\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarized by individual Phish detection technology/control in Microsoft Defender for Office 365.\\r\\n//Each detection technology is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\\r\\n//The where clause excludes deliveries to the SecOps Mailbox and by the Phish Simulation system.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = Details, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish DetTech Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5270ba04-599f-4940-805b-687f7475bc70\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections by SenderIPv4 Geo Location<br>\\r\\n\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"name\":\"text - Phish Geo Header\",\"id\":\"ddd0c12f-1bb1-4d7d-afb4-f28bcfcd7c4b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by email sender IP address (SenderIPv4).\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has \\\"Phish\\\" and isnotempty(SenderIPv4)\\r\\n| summarize count() by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish Geo Map\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"85ea7223-7d77-43f5-b0d9-e0de7c898758\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where ThreatTypes has 'Phish' and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Phish Emails'] = count_\\r\\n| sort by ['Phish Emails'] desc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Phish Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish Country Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f561209b-15a6-442e-af10-63e375088209\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"group - 25- Phish delivery locations-detecion tech-sender infra\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"10f3e3eb-b330-4955-952e-01eff69405e9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Phish Detections Top attacked users and top senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Enroll the most-targeted users in security awareness training and consider blocking persistent phishing sender domains.\"},\"name\":\"text - Phish Section3 Banner\",\"id\":\"f46ed4a8-e2b5-4ccd-ae38-efc571bfc791\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections top attacked users\\r\\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Phish. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish TopUsers Header\",\"id\":\"96d9b543-070a-42d4-bbed-3f5cf79ca7ce\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails with Phish detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),PhishEmailCount = countif(ThreatTypes has \\\"Phish\\\") by RecipientEmailAddress\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where PhishEmailCount !=0\\r\\n| top 15 by PhishEmailCount\\r\\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Phish Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish TopRecipients Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"25100115-78d3-4144-b44e-613b44f02484\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains with Phish Detections (Inbound)\\r\\n**Displays the top 10 sender domains sending inbound emails detected as Phish. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish TopSenders Header\",\"id\":\"e7fcb7fe-4bca-4153-a9b0-8ded135b1c64\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain), now including the Phish confidence split (High/Normal) and the aggregated phish detection methods seen per domain. Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\\r\\n| extend PhishMethods = parse_json(DetectionMethods).Phish\\r\\n| summarize TotalEmailCount = count(),\\r\\n            PhishEmailCount = countif(ThreatTypes has \\\"Phish\\\"),\\r\\n            Phish_High = countif(ThreatTypes has \\\"Phish\\\" and PhishConf == \\\"High\\\"),\\r\\n            Phish_Normal = countif(ThreatTypes has \\\"Phish\\\" and PhishConf == \\\"Normal\\\"),\\r\\n            PhishMethodSet = make_set_if(PhishMethods, ThreatTypes has \\\"Phish\\\") by SenderFromDomain\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where PhishEmailCount != 0\\r\\n| top 15 by PhishEmailCount\\r\\n| mv-apply S = PhishMethodSet on ( mv-expand m = S to typeof(string) | summarize Methods = make_set(m) )\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound, ['Detection Methods'] = strcat_array(Methods, \\\", \\\")\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Phish Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish (High)\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish (Normal)\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"BadEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish TopSenders Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"717bfce8-b5d4-4900-99db-4ba0c503591d\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"group - 26-PhishDetectionsTopattackedusers-topsenders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"553afca2-caa1-45b1-bec0-dca426b5be46\"},{\"type\":1,\"content\":{\"json\":\"# Spam Detection Insights\\r\\n\\r\\n---\\r\\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Spam threat** within its **email content**, **URLs**, or **attachments**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"text - Spam Tab Intro\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a693a05a-a772-4ac4-9863-07ad0d1b7092\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of inbound email spam detections for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet sp = EmailEvents | where EmailDirection == \\\"Inbound\\\" | where ThreatTypes has \\\"Spam\\\";\\r\\nlet junk = sp | where DeliveryLocation has \\\"Junk\\\";\\r\\nlet spTrend = toscalar(sp | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet junkTrend = toscalar(junk | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(sp | summarize count()), Details = \\\"Spam Emails\\\", Ord = 1, Trend = spTrend),\\r\\n(print Count = toscalar(sp | summarize dcount(RecipientEmailAddress)), Details = \\\"Users Targeted\\\", Ord = 2, Trend = spTrend),\\r\\n(print Count = toscalar(sp | summarize dcount(SenderFromDomain)), Details = \\\"Sender Domains\\\", Ord = 3, Trend = spTrend),\\r\\n(print Count = toscalar(junk | summarize count()), Details = \\\"Sent to Junk\\\", Ord = 4, Trend = junkTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"spam kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cadd5331-1db8-4ac8-bc99-42cd5227ee51\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Spam Detection Effectiveness and Trends\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Effectiveness and per-{Granularity} trend. For effectiveness, we consider messages reported by your admins and decisions made post-delivery.<br><br>**Recommended action:** If legitimate mail is marked as spam, review the Spam and Bulk thresholds; if spam is leaking through, tighten them.\"},\"name\":\"text - Spam Section1 Banner\",\"id\":\"1093f3b6-cea7-4f54-9029-f9aadd79ca9f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query calculates the effectiveness of spam detections without edge data.\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\n// baseQuery _FN_Admin_Submissions_SPM\\r\\nlet _FN_Admin_Submissions_SPM = toscalar(\\r\\nCloudAppEvents\\r\\n| where Timestamp between (minTime .. maxTime)\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\\r\\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\\r\\n| where SubmissionType in (\\\"0\\\")\\r\\n| summarize count()\\r\\n);\\r\\n// baseQuery _FN_ZAP_Successful_Spam\\r\\nlet _FN_ZAP_Successful_Spam = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and ActionType == \\\"Spam ZAP\\\" and ActionResult == \\\"Success\\\" and Timestamp between (minTime .. maxTime)\\r\\n| summarize count()\\r\\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\\r\\n);\\r\\n// baseQuery _FN_ZAP_Unsuccessful_Spam\\r\\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and ActionType == \\\"Spam ZAP\\\" and ActionResult != \\\"Success\\\" and Timestamp between (minTime .. maxTime)\\r\\n| summarize count()\\r\\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\\r\\n);\\r\\n// baseQuery _SPAM_ZAP_FP\\r\\nlet _SPAM_ZAP_FP = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") and Timestamp between (minTime .. maxTime)\\r\\n| join kind=leftsemi (\\r\\n            EmailEvents\\r\\n            | where Timestamp between (minTime ..maxTime )\\r\\n            | where ThreatTypes contains \\\"Spam\\\"\\r\\n            | project NetworkMessageId, ThreatTypes)\\r\\n            on NetworkMessageId\\r\\n| summarize count()\\r\\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\\r\\n);\\r\\n// baseQuery _Spam_Mailflow\\r\\nlet _Spam_Mailflow = toscalar(\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and ThreatTypes == \\\"Spam\\\" and Timestamp between (minTime .. maxTime)\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count()\\r\\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\\r\\n);\\r\\nprint\\r\\nEffectiveness_PostDelivery = abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))/(toreal(toscalar(_Spam_Mailflow))+toreal(toscalar(_FN_ZAP_Successful_Spam))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))+toreal(toscalar(_FN_Admin_Submissions_SPM))-toreal(toscalar(_SPAM_ZAP_FP)))*100-100),2))\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"heatmapPalette\":\"greenRed\",\"thresholdsGrid\":[{\"operator\":\">\",\"thresholdValue\":\"95\",\"representation\":\"green\"},{\"operator\":\"<=\",\"thresholdValue\":\"95\",\"representation\":\"orange\"},{\"operator\":\"<=\",\"thresholdValue\":\"90\",\"representation\":\"red\"}]},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"tagText\":\"Spam Effectiveness (without Edge data)\",\"valueFontStyle\":\"superLarge\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - Spam Effectiveness Stat\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"036851c1-489e-4fda-8059-850c161578b3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\n// baseQuery _FN_Admin_Submissions_SPM\\r\\nlet _FN_Admin_Submissions_SPM = toscalar(\\r\\nCloudAppEvents\\r\\n| where Timestamp between (minTime .. maxTime)\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\\r\\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\\r\\n| where SubmissionType in (\\\"0\\\")\\r\\n| summarize count()\\r\\n);\\r\\n// baseQuery _FN_ZAP_Successful_Spam\\r\\nlet _FN_ZAP_Successful_Spam = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and ActionType == \\\"Spam ZAP\\\" and ActionResult == \\\"Success\\\" and Timestamp between (minTime .. maxTime)\\r\\n| summarize count()\\r\\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\\r\\n);\\r\\n// baseQuery _FN_ZAP_Unsuccessful_Spam\\r\\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and ActionType == \\\"Spam ZAP\\\" and ActionResult != \\\"Success\\\" and Timestamp between (minTime .. maxTime)\\r\\n| summarize count()\\r\\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\\r\\n);\\r\\n// baseQuery _SPAM_ZAP_FP\\r\\nlet _SPAM_ZAP_FP = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") and Timestamp between (minTime .. maxTime)\\r\\n| join kind=leftsemi (\\r\\n            EmailEvents\\r\\n            | where Timestamp between (minTime ..maxTime )\\r\\n            | where ThreatTypes contains \\\"Spam\\\"\\r\\n            | project NetworkMessageId, ThreatTypes)\\r\\n            on NetworkMessageId\\r\\n| summarize count()\\r\\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\\r\\n);\\r\\n// baseQuery _Spam_Mailflow\\r\\nlet _Spam_Mailflow = toscalar(\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and ThreatTypes == \\\"Spam\\\" and Timestamp between (minTime .. maxTime)\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count()\\r\\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\\r\\n);\\r\\nprint StatisticName=\\\"Spam Mailflow Minus FPs\\\", Value=toreal((toscalar(_Spam_Mailflow)) - toreal(toscalar(_SPAM_ZAP_FP)))\\r\\n| union (print StatisticName=\\\"Spam Admin FNs Submitted\\\", Value=toreal(toscalar(_FN_Admin_Submissions_SPM)))\\r\\n| union (print StatisticName=\\\"Spam FPs Reverse Zapped\\\", Value=toreal(toscalar(_SPAM_ZAP_FP)))\\r\\n| union (print StatisticName=\\\"Spam Zapped Successfully\\\", Value=toreal(toscalar(_FN_ZAP_Successful_Spam)))\\r\\n| union (print StatisticName=\\\"Spam NotZapped\\\", Value=toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))\\r\\n| union (print StatisticName=\\\"Spam Effectiveness Post Delivery %\\\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2)))\\r\\n| union (print StatisticName=\\\"Spam Effectiveness Pre-Delivery %\\\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + (toscalar(_FN_ZAP_Successful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2 )))\\r\\n| project ['Statistic'] = StatisticName, Value\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Value\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]}},\"customWidth\":\"50\",\"name\":\"query - Spam Effectiveness Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8d456ea2-f04a-4d71-95c6-fbaad8c2d2f2\"}]},\"customWidth\":\"100\",\"name\":\"Spam Effectiveness\",\"id\":\"82812b88-e7f7-4be0-9d13-8e7a7d8c0c4e\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detection Trend<br>\\r\\n\\r\\n**This visual displays a per-{Granularity} trend of email Spam detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Spam threats.**\"},\"name\":\"text - Spam Trend Header\",\"id\":\"b5574a88-430b-4cca-a76e-9a0b07e9da2e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where ThreatTypes has \\\"Spam\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, SpamDetections = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SpamDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Spam Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"09b7d330-1683-45c4-ac0e-8141580d13b5\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"group - 6-Spam-detections-trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"25273f47-8201-4565-8815-1d059ee8abb6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Spam Detections by Delivery location, Detection technology, Sender infrastructure and Bulk insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Spam detections delivery locations, detection technologies used for detections, sender infrastructure and Bulk insights in inbound email identified by Microsoft Defender for Office 365 as Spam.<br><br>**Recommended action:** Raise the Bulk Complaint Level (BCL) threshold for noisy sender domains and consider blocking high-volume, low-value bulk senders where appropriate.\"},\"name\":\"text - Spam Section2 Banner\",\"id\":\"b82f442b-a3a0-44f7-82df-2fd4a9594992\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections by delivery location<br>\\r\\n\\r\\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various delivery locations Quarantine, Junk folder or Failed (rejected with or without NDR)**\"},\"name\":\"text - Spam DeliveryLoc Header\",\"id\":\"a6326d97-56cc-45fb-8019-e0c3346968f2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Spam\\\" and EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalSpamDetections=count(), Quarantine=countif(DeliveryLocation == \\\"Quarantine\\\"), Junkfolder=countif(DeliveryLocation == \\\"Junk folder\\\"), Inbox=countif(DeliveryLocation == \\\"Inbox/folder\\\"), Failed=countif(DeliveryLocation == \\\"Failed\\\"), Dropped=countif(DeliveryLocation == \\\"Dropped\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, TotalSpamDetections=coalesce(TotalSpamDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalSpamDetections\",\"color\":\"blue\"},{\"seriesName\":\"Quarantine\",\"color\":\"greenDark\"},{\"seriesName\":\"Junkfolder\",\"color\":\"orangeDark\"},{\"seriesName\":\"Inbox\",\"color\":\"redBright\"},{\"seriesName\":\"Failed\",\"color\":\"red\"},{\"seriesName\":\"Dropped\",\"color\":\"redDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Spam DeliveryLoc Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"97f89032-34e3-40ff-bb88-42d195aea095\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections Detection Technology<br>\\r\\n\\r\\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**\"},\"name\":\"text - Spam DetTech Header\",\"id\":\"935ea90d-8430-49d5-b942-3a7b319a603e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where DetectionMethods has \\\"Spam\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - Spam DetTech Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f31ec0d1-04e1-4b2b-9b98-27289ca34b84\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections summarized by individual Spam detection technology/control in Microsoft Defender for Office 365.\\r\\n//Each technique is counted individually via mv-expand over DetectionMethods.Spam (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Spam\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = Details, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Spam DetTech Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"95e40479-f0bc-41ff-8191-634b606d3632\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections by SenderIPv4 Geo Location<br>\\r\\n\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Spam, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"name\":\"text - Spam Geo Header\",\"id\":\"614d1c3f-df6a-4659-b170-7b466c66d66f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4).\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where ThreatTypes has \\\"Spam\\\" and isnotempty(SenderIPv4)\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_  \",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"SenderIPv4\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"name\":\"query - Spam Geo Map\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5519d715-dc79-45f8-8ed5-a63a253c45e3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where ThreatTypes has 'Spam' and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Spam Emails'] = count_\\r\\n| sort by ['Spam Emails'] desc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spam Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"SenderIPv4\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"name\":\"query - Spam Country Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5078dc24-e8be-4943-98fc-6527968e1e3d\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections Bulk Insights<br>\\r\\n\\r\\n**Displays the distribution of inbound emails across different Bulk Complaint Levels together with Top 10 domains sending Bulk email (grey mail). Helps identify patterns in bulk email complaints and assess potential spam or unwanted message trends.**\"},\"name\":\"text - Spam Bulk Header\",\"id\":\"cd7b3cbe-a6c1-422c-ab37-4afc26002d5d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotnull(BulkComplaintLevel)\\r\\n| summarize count() by BulkComplaintLevel\\r\\n| sort by BulkComplaintLevel desc\\r\\n| project ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blueDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - Spam Bulk By Level\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"021c022b-aa67-427d-9e1a-688af7aed5d4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotnull(BulkComplaintLevel)\\r\\n| summarize count() by BulkComplaintLevel, SenderFromDomain\\r\\n| top 10 by count_ desc\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - Spam Bulk By Domain\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b1835e0f-f9ad-44c3-bba4-cf9a9546d09a\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"group - 28-Spam-Delivery location-Detection technology-Sender infrastructure insights\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"307d3d03-93ae-4c8f-b68b-f833ee7d38e8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"\\r\\n<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Spam Detections Top attacked users and top senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Review the most-affected users and the top spam sender domains as possible block-list candidates.\"},\"name\":\"text - Spam Section3 Banner\",\"id\":\"4c34ed7b-86da-4ee1-8a69-f96c213a4340\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections top attacked users<br>\\r\\n\\r\\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**\"},\"customWidth\":\"100\",\"name\":\"text - Spam TopUsers Header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"be708ad5-51fd-4a54-b1bc-f912e12b4a01\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where EmailDirection ==\\\"Inbound\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),SpamEmailCount = countif(ThreatTypes has \\\"Spam\\\") by RecipientEmailAddress\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount)* 100, 2))\\r\\n| where SpamEmailCount !=0\\r\\n| top 15 by SpamEmailCount\\r\\n| project ['Recipient'] = RecipientEmailAddress, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spam Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Spam TopRecipients Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6e7b357d-6792-41c5-83fc-efae31afe2ee\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains with Spam Detections (Inbound)<br>\\r\\n\\r\\n**Displays the top 10 sender domains sending inbound emails detected as Spam. Helps identify external sources most frequently associated with spam content for prioritised monitoring and mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Spam TopSenders Header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1d1bdb8d-9619-488b-935a-3791ad73f096\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount = count(),\\r\\n            SpamEmailCount = countif(ThreatTypes has \\\"Spam\\\") by SenderFromDomain\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where SpamEmailCount !=0\\r\\n| top 15 by SpamEmailCount\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spam Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Spam TopSenders Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"253efada-ca89-49c5-b1e3-e42ac005b938\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"group - 29-Spam Detections Top attacked users and top senders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"d4cc057f-c9b7-40b9-85d3-52f90767d1f5\"},{\"type\":1,\"content\":{\"json\":\"# Email Impersonation &amp; BEC Insights\\r\\n\\r\\n---\\r\\nThis tab focuses on the highest-value email threat class: **impersonation and Business Email Compromise (BEC)**. It brings together impersonation and spoof detections, sender authentication (DMARC, DKIM, SPF, CompAuth), supply-chain and partner-compromise correlation, and first-contact / new-vendor senders - the signals that precede targeted financial and credential attacks. It is the email-side companion to the impersonation insights on the **Teams &amp; Collaboration** tab.\"},\"name\":\"text - impersonation bec description\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"id\":\"fda8ccd5-fafc-457a-a6a2-05b504be1023\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of inbound email impersonation and spoof (BEC) detections for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet bec = EmailEvents | where EmailDirection == \\\"Inbound\\\" | where DetectionMethods has \\\"Impersonation\\\" or DetectionMethods has \\\"Spoof\\\";\\r\\nlet inbox = bec | where DeliveryLocation has \\\"Inbox\\\";\\r\\nlet becTrend = toscalar(bec | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(bec | summarize count()), Details = \\\"Impersonation / Spoof Emails\\\", Ord = 1, Trend = becTrend),\\r\\n(print Count = toscalar(bec | summarize dcount(RecipientEmailAddress)), Details = \\\"Users Targeted\\\", Ord = 2, Trend = becTrend),\\r\\n(print Count = toscalar(bec | summarize dcount(SenderFromDomain)), Details = \\\"Spoofed Sender Domains\\\", Ord = 3, Trend = becTrend),\\r\\n(print Count = toscalar(inbox | summarize count()), Details = \\\"Delivered to Inbox\\\", Ord = 4, Trend = inboxTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"name\":\"bec kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"91fdd28f-31c4-4f94-b60a-12cd97d44ddf\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Phish Detections Business Email Compromise (BEC) detections\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Business Email Compromise (BEC) detections Impersonation and Spoof.<br><br>**Recommended action:** Enable mailbox intelligence and impersonation protection for frequently-impersonated users and domains; consider adding confirmed look-alike domains to the Tenant Block List.\"},\"name\":\"text - Phish BEC Banner\",\"id\":\"e3b2232c-8056-4913-a652-64f70e228750\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Impersonation detections Trend\\r\\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Impersonation detection methods by Microsoft Defender for Office 365. Helps track impersonation attack patterns over time.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Imp Trend Header\",\"id\":\"e95667df-3bcd-4023-9e8f-99ed05bc4bf0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has 'Impersonation'\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ImpersonationDetections = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"ImpersonationDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Imp Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"61fa166d-f300-42a6-a324-de18b3fdf4c1\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Impersonation detections by Detection Technology\\r\\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Impersonations.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Imp Tech Header\",\"id\":\"09e1a866-f344-4a92-a3bd-8c3c3c5d598d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where Details has \\\"Impersonation\\\"\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Imp Tech Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6cd5662f-13b4-4a9b-afe7-0a6343e3ab5c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish - Business Email Compromise (BEC) - Impersonation detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\\r\\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where Details has \\\"Impersonation\\\"\\r\\n| summarize Count = count() by Details\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = Details, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"graphSettings\":{\"type\":0},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Imp Tech Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"73499618-e842-440e-a555-cd8849093884\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Impersonation detections by SenderIPv4 Geo Location\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Impersonation, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Imp Geo Header\",\"id\":\"189a1ac1-f275-4697-880b-7ffae1e5d263\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections summarizing the data by email sender IP address (SenderIPv4).\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Impersonation\\\" and isnotempty(SenderIPv4)\\r\\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \\r\\n| summarize count()by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_  \",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"name\":\"query - Phish BEC Imp Geo Map\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"574b61ad-ec2d-4517-93c5-d0e9bd14f2e9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where DetectionMethods has \\\"Impersonation\\\" and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Impersonation Emails'] = count_\\r\\n| sort by ['Impersonation Emails'] desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Impersonation Detections-Sender Heatmap (IPv4)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Impersonation Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"name\":\"query - Phish BEC Imp Country\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e53b7dbc-4683-4309-b879-c7be68599159\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Spoof detections Trend\\r\\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Spoof detection methods by Microsoft Defender for Office 365. Helps track Spoofing based attack patterns over time.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Spoof Trend Header\",\"id\":\"8db0f1b0-49bf-43a2-9f9f-164eb9530629\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has 'Spoof'\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, SpoofDetections = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SpoofDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Spoof Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9a308cd9-bf05-4287-b0d5-54636d081a82\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Spoof detections Trend by Detection Technology\\r\\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Spoofing.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Spoof Tech Header\",\"id\":\"28c9c15d-d22f-4412-9efc-868b95082668\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily by various Spoof Detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where Details has \\\"Spoof\\\"\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"yAxis\":[\"Count\"],\"seriesLabelSettings\":[{\"seriesName\":\"[\\\"Spoof external domain\\\"]\",\"color\":\"redDark\"},{\"seriesName\":\"[\\\"Spoof intra-org\\\"]\",\"color\":\"orangeDark\"},{\"seriesName\":\"[\\\"Spoof DMARC\\\"]\",\"color\":\"yellowDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Spoof Tech Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1a1328fc-5404-4dff-99ed-3a30082a4cbe\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish - Business Email Compromise (BEC) - Spoof detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\\r\\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where Details has \\\"Spoof\\\"\\r\\n| summarize Count = count() by Details\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = Details, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Spoof Tech Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"f7df9892-85b4-49c3-8739-873b745183a3\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Spoof detections by SenderIPv4 Geo Location\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Spoofing, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Spoof Geo Header\",\"id\":\"3c83e7f0-5391-4b1a-bb5b-de0d17488efd\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections summarizing the data by email sender IP address (SenderIPv4).\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Spoof\\\" and isnotempty(SenderIPv4)\\r\\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \\r\\n| summarize count()by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_  \",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"name\":\"query - Phish BEC Spoof Geo Map\",\"styleSettings\":{\"margin\":\"15px\",\"padding\":\"15px\"},\"id\":\"122d860c-ab0d-475e-b29e-2955020680c7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where DetectionMethods has \\\"Spoof\\\" and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Spoof Emails'] = count_\\r\\n| sort by ['Spoof Emails'] desc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spoof Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"name\":\"query - Phish BEC Spoof Country\",\"styleSettings\":{\"margin\":\"15px\",\"padding\":\"15px\"},\"id\":\"9d0111bc-8d01-4a99-9009-645dc02c3bed\"},{\"type\":1,\"content\":{\"json\":\"### Supply-Chain &amp; Partner Risk (Possible Partner Compromise)\\r\\n**Correlates the external domains your organization emails most with inbound emails from those same domains that carried threats. A trusted partner or supplier domain suddenly sending threats is a strong signal that the partner may be compromised - a common supply-chain and business email compromise (BEC) vector.**<br><br>**Recommended action:** Verify any flagged partner through a trusted channel before acting on their recent messages, alert them to a possible compromise, and consider tightening inbound policy for that domain until confirmed clean.\"},\"customWidth\":\"100\",\"name\":\"text - Phish Partner Compromise Header\",\"id\":\"2c62c576-3b05-4663-ae2e-4f961d7409c6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) \\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Outbound\\\"\\r\\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \\\"@\\\")[1])\\r\\n| summarize count() by RecipientDomain\\r\\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\\r\\n| join (EmailEvents | where EmailDirection == \\\"Inbound\\\" and isempty(ThreatTypes)==false) on SenderFromDomain\\r\\n| summarize max(OutboundCount),count() by SenderFromDomain\\r\\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\\r\\n| extend Bad_Traffic_Percentage = todouble(round(IncomingEmailsWithThreats / todouble(OutboundEmails) * 100, 2))\\r\\n| top 15 by OutboundEmails\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Outbound Emails'] = OutboundEmails, ['Inbound w/ Threats'] = IncomingEmailsWithThreats, ['Bad Traffic %'] = Bad_Traffic_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Outbound Emails\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Inbound w/ Threats\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"60ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish Partner Compromise\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1aaa047c-1108-4288-833e-61ca35b5495a\"},{\"type\":1,\"content\":{\"json\":\"### Top Recipients Targeted by Impersonation / BEC\\r\\n**Lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, showing the number of impersonation emails, how many distinct senders were involved, the top spoofed sender domains, and how many of those messages were delivered to the inbox. Helps identify high-risk users (often executives or finance staff) who may need extra protection or awareness.**\"},\"customWidth\":\"100\",\"name\":\"text - impersonation targets\",\"id\":\"b1e7c2a4-9f3d-4a6b-8c12-7d5e9f0a1b23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top recipients targeted by impersonation / BEC, with distinct senders, spoofed domains and how many landed in the inbox.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| where OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")\\r\\n| where DetectionMethods has \\\"Impersonation\\\"\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize ImpersonationEmails = count(),\\r\\n            DistinctSenders      = dcount(SenderFromAddress),\\r\\n            TopSpoofedDomains    = make_set(SenderFromDomain, 5),\\r\\n            DeliveredToInbox     = countif(DeliveryLocation has \\\"Inbox\\\")\\r\\n        by RecipientEmailAddress\\r\\n| top 20 by ImpersonationEmails\\r\\n| project ['Recipient'] = RecipientEmailAddress, ['Impersonation Emails'] = ImpersonationEmails, ['Distinct Senders'] = DistinctSenders, ['Top Spoofed Domains'] = strcat_array(TopSpoofedDomains, \\\", \\\"), ['Delivered to Inbox'] = DeliveredToInbox\",\"size\":0,\"title\":\"Top Recipients Targeted by Impersonation / BEC\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"showAnalytics\":true,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Impersonation Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"name\":\"newviz - impersonation targets\",\"id\":\"afe28369-af82-47ae-846d-179bd86b660e\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"name\":\"group - 7 - Phish-BEC-Insights\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"b7971cd9-d086-47c7-8f66-50956b9c56c3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Phish Detections Sender Authentication details (DMARC, DKIM, SPF, CompAuth)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Sender Authentication checks details in inbound email by Microsoft Defender for Office 365 focusing on the various Sender Authentication standards: DMARC, DKIM, SPF, CompAuth.<br><br>**Recommended action:** For domains failing DMARC/DKIM/SPF, verify your own outbound authentication is published and enforced (p=reject), and treat persistent external spoofers as possible block candidates.\"},\"name\":\"text - Phish Section5 Banner\",\"id\":\"90d7a338-d943-4398-b788-bfd4f93007d4\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections Sender Authentication Trend (DMARC, DKIM, SPF, CompAuth)\\r\\n**Shows counts (per {Granularity}) of sender authentication check outcomes (DMARC, DKIM, SPF, CompAuth) performed by Microsoft Defender for Office 365 on inbound emails. Useful for monitoring authentication success and failure patterns over time to identify anomalies or potential phishing risks.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish SenderAuth Trend Header\",\"id\":\"4a0ab90e-55dd-4fa6-82c3-0edc57ce0966\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof- DMARC fails summarizing the data daily.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend DMARCFail = (tostring(parse_json(AuthenticationDetails).DMARC) == \\\"fail\\\") \\r\\n| summarize DMARCFail = sum(DMARCFail) by bin (Timestamp,{Granularity})\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"DMARCFail\",\"color\":\"orangeDark\"}]}},\"customWidth\":\"50\",\"name\":\"query - Phish Auth DMARC Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"79920d30-01d4-4412-b994-853e50c9d7d8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof- DKIM fails summarizing the data daily.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend DKIMFail = (tostring(parse_json(AuthenticationDetails).DKIM) == \\\"fail\\\") \\r\\n| summarize DKIMFail = sum(DKIMFail) by bin (Timestamp,{Granularity})\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"DKIMFail\",\"color\":\"yellowDark\"}]}},\"customWidth\":\"50\",\"name\":\"query - Phish Auth DKIM Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"bf09ffd4-eee0-42f7-a507-1cf54d9c365a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof- SPF fails summarizing the data daily.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend SPFFail = (tostring(parse_json(AuthenticationDetails).SPF) == \\\"fail\\\") \\r\\n| summarize SPFFail = sum(SPFFail) by bin (Timestamp,{Granularity})\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SPFFail\",\"color\":\"purpleDark\"}]}},\"customWidth\":\"50\",\"name\":\"query - Phish Auth SPF Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"4d66fe13-9904-45cf-8783-f3ee984f3a66\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof- Composite Authentication fails summarizing the data daily.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend CompAuthFail = (tostring(parse_json(AuthenticationDetails).CompAuth) == \\\"fail\\\") \\r\\n| summarize CompAuthFail = sum(CompAuthFail) by bin (Timestamp,{Granularity})\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"CompAuthFail\",\"color\":\"blueDark\"}]}},\"customWidth\":\"50\",\"name\":\"query - Phish Auth CompAuth Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"0968b828-23fe-4fa2-a5ea-8ab39362457f\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections Top Sender Domains with DMARC Failures (Inbound)\\r\\n**Displays the top 10 sender domains (P1 and P2) for inbound emails where Spoof-DMARC detection triggered. Includes total inbound email volume and calculates DMARC fail traffic percentage per domain to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish Auth DMARC Domains Header\",\"id\":\"24d4689a-eb6d-49f5-85a8-fcadca409f7a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and DMARC fail traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalEmailCount = count(),\\r\\n            DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \\\"Spoof DMARC\\\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\\r\\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where DMARCFailCount !=0\\r\\n| top 10 by DMARCFailCount\\r\\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['DMARC Failures'] = DMARCFailCount, ['Total Inbound'] = TotalEmailCount, ['DMARC Fail %'] = DMARCFail_Traffic_Percentage\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DMARCFail\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"DMARC Fail %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish Auth DMARC Domains\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"642814ad-9d24-4be9-ae10-3578e89da05b\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections Top Sender Domains with Spoof External Domain Detections (Inbound)\\r\\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof External Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish Auth SpoofExt Domains Header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"993fdc34-354b-412e-be39-facbde4f4f0e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof external domain detection traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalEmailCount = count(),\\r\\n            SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \\\"Spoof external domain\\\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\\r\\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where SpoofExternalCount !=0\\r\\n| top 10 by SpoofExternalCount\\r\\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof External'] = SpoofExternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof External %'] = SpoofExternal_Traffic_Percentage\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spoof External\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spoof External %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"SpoofExternalFail\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"Spoof External %\",\"sortOrder\":2}]}},\"customWidth\":\"100\",\"name\":\"query - Phish Auth SpoofExt Domains\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"69ca3799-d2d5-4896-b3a5-1eeba46f0b46\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections Top Sender Domains with Spoof Internal Domain Detections (Inbound)\\r\\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof Internal Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish Auth SpoofInt Domains Header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3fa33c5d-0eba-471f-b47f-0c12c1f770d6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalEmailCount = count(),\\r\\n            SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \\\"Spoof intra-org\\\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\\r\\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where SpoofInternalCount !=0\\r\\n| top 10 by SpoofInternalCount\\r\\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof Internal'] = SpoofInternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof Internal %'] = SpoofInternal_Traffic_Percentage\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Spoof intra-org detections by Sender domain (P1/P2)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spoof Internal\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spoof Internal %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"SpoofIntraorgFail\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish Auth SpoofInt Domains\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"ae0c65c7-68ea-4d50-b177-1effeaf1c045\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"name\":\"group - 8-Phish-SenderAuth\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"8077779a-4da8-46be-8032-626bd8c36dbd\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">First-Contact &amp; New-Vendor Senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nExternal email senders and domains seen for the first time in the selected period. New/first-contact relationships - especially ones already carrying threats - are a common precursor to phishing, business email compromise (BEC), and supply-chain attacks.<br><br>**Recommended action:** Treat brand-new domains sending threats as high-priority review; verify any that claim to be a known brand or partner before trusting their messages.\"},\"name\":\"phish fc banner\",\"id\":\"05b83435-c7ed-48a3-919e-388b2e599726\"},{\"type\":1,\"content\":{\"json\":\"### First-contact external senders<br>\\r\\n\\r\\n**External email senders ordered by when they were first seen in the period (most recent first). In tenants with longer history this highlights genuinely new senders.**\"},\"customWidth\":\"100\",\"name\":\"phish fc senders header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"c57dffb4-dfdb-4a1e-93be-16fa9e856a0d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists external email senders seen for the first time in the selected period (most recent first), surfacing new/first-contact senders. In tenants with longer history this highlights genuinely new relationships - a common precursor to BEC and supply-chain attacks.\\r\\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"fabrikam.com\\\"]);\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend SenderDomain = tostring(split(SenderFromAddress, \\\"@\\\")[1])\\r\\n| where isnotempty(SenderFromAddress)\\r\\n//| where SenderDomain !in~ (ExcludeDomains)\\r\\n| summarize FirstSeen=min(Timestamp), Messages=count(), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\\r\\n| top 20 by FirstSeen desc\\r\\n| project ['Sender']=SenderFromAddress, ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, ['Threat Messages']=ThreatMessages\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"phish fc senders table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d1ceb0ac-2dad-49af-b416-a3376a7b8513\"},{\"type\":1,\"content\":{\"json\":\"### New sender domains carrying threats<br>\\r\\n\\r\\n**External sender domains seen for the first time in the period that already carried threats, most-recent first. A brand-new domain sending threats to your users is a strong early-warning signal.**\"},\"customWidth\":\"100\",\"name\":\"phish fc domains header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"bd29bbe4-cde2-499c-a1d0-e2cc51f7733d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists external sender domains seen for the first time in the selected period that already carried threats, ranked by most-recently first seen. A brand-new domain sending threats to your users is a strong early-warning signal for phishing and BEC.\\r\\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"fabrikam.com\\\"]);\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend SenderDomain = tostring(split(SenderFromAddress, \\\"@\\\")[1])\\r\\n| where isnotempty(SenderDomain)\\r\\n//| where SenderDomain !in~ (ExcludeDomains)\\r\\n| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Messages=count(), Senders=dcount(SenderFromAddress), Recipients=dcount(RecipientEmailAddress), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderDomain\\r\\n| where ThreatMessages > 0\\r\\n| top 20 by FirstSeen desc\\r\\n| project ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, Senders, Recipients, ['Threat Messages']=ThreatMessages, ['Last Seen']=LastSeen\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Senders\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Recipients\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"phish fc domains table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7da952d5-5ae2-4b2e-a5cf-c78b11bda4f8\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"customWidth\":\"100\",\"name\":\"group - Phish First Contact\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"90e5248a-2c35-48f3-869c-c45c631c6fbf\"},{\"type\":1,\"content\":{\"json\":\"# URL Detections and URL Click Insights\\r\\n\\r\\n---\\r\\nThis tab provides insights into **URL-based detections** in email messages and details about URL clicks performed by end users on URLs identified as **malicious**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"text - 24 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"2156430d-fec6-48bb-a9a8-3166182f6993\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of URL threat protection (Safe Links clicks and URLs seen in email) for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet clicks = UrlClickEvents;\\r\\nlet blocked = clicks | where ActionType in (\\\"ClickBlocked\\\",\\\"ClickBlockedByTenantPolicy\\\");\\r\\nlet allowed = clicks | where ActionType == \\\"ClickAllowed\\\";\\r\\nlet blockedTrend = toscalar(blocked | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet allowedTrend = toscalar(allowed | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet usersTrend = toscalar(clicks | make-series Trend = dcount(AccountUpn) default = 0 on Timestamp step gran | project Trend);\\r\\nlet urlsTrend = toscalar(EmailUrlInfo | make-series Trend = dcount(Url) default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(blocked | summarize count()), Details = \\\"Malicious Clicks Blocked\\\", Ord = 1, Trend = blockedTrend),\\r\\n(print Count = toscalar(allowed | summarize count()), Details = \\\"Clicks Allowed Through\\\", Ord = 2, Trend = allowedTrend),\\r\\n(print Count = toscalar(clicks | summarize dcount(AccountUpn)), Details = \\\"Users Clicking Links\\\", Ord = 3, Trend = usersTrend),\\r\\n(print Count = toscalar(EmailUrlInfo | summarize dcount(Url)), Details = \\\"Distinct URLs in Email\\\", Ord = 4, Trend = urlsTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"url kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d5e2326a-a5dd-4217-bb75-0e337d75d306\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Insights on URL-Based Threat Detections\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain URL based threat detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends of URL-based threat detections, QR code detections, and URL scans activity by locations.<br><br>**Recommended action:** Confirm Safe Links is enabled for email and Teams; investigate QR-code and URL detection spikes for emerging campaigns.\"},\"name\":\"text - 13 - Copy\",\"id\":\"ed3468e7-1936-45fd-9168-93010a662302\"},{\"type\":1,\"content\":{\"json\":\"### Trend of URL-Based Malware Threat Detections<br>\\r\\n\\r\\n**This visual displays a per-{Granularity} trend of emails with URL based Malware threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for malware threats.**\"},\"name\":\"text - 13 - Copy - Copy\",\"id\":\"77e7bbac-d752-478b-bce9-06bb1bd12bfe\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware URL threat based detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Malware'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand MalwareMethod = ParsedMethods.Malware\\r\\n| where MalwareMethod contains \\\"URL\\\"\\r\\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\\r\\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\\r\\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\\r\\n| sort by MalwareMethod asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"79ef5e7b-57a6-4519-9899-18fd8cae5e68\"},{\"type\":1,\"content\":{\"json\":\"### Trend of URL-Based Phish Threat Detections<br>\\r\\n\\r\\n**This visual displays a per-{Granularity} trend of emails with URL based Phish threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for Phish threats.**\"},\"name\":\"text - 13 - Copy - Copy - Copy\",\"id\":\"48923812-5440-4f47-8881-273f14cbfb8e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phishing detections over time summarizing the data daily by various Phishing URL threat based detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Phish'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand PhishMethod = ParsedMethods.Phish\\r\\n| where PhishMethod contains \\\"URL\\\"\\r\\n| summarize Count = count() by PhishMethod = tostring(PhishMethod), Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct PhishMethod | extend d = 1) on d | project Timestamp, PhishMethod\\r\\n| join kind=leftouter (agg) on Timestamp, PhishMethod\\r\\n| project Timestamp, PhishMethod, Count = coalesce(Count, 0)\\r\\n| sort by PhishMethod asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - 8 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b983b361-6c2e-47d5-b2c5-edd9caa6a55d\"},{\"type\":1,\"content\":{\"json\":\"### Trend (per {Granularity}) of QR Code-Based Threat Detections<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of inbound emails containing QR codes flagged for Phish, Malware, or Spam via URL-based detection methods. Helps track QR code abuse patterns over time.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3d8b75e1-6e1d-44eb-b1fc-78d3db7feb71\"},{\"type\":1,\"content\":{\"json\":\"### URL Scan activity by Location (per {Granularity})<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of URLs scanned from various locations within emails (e.g., body, attachments, QR codes). Helps identify where malicious URLs are most commonly embedded.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b275b28c-e441-4c19-9055-256d5d45c69c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" \\r\\n| where DetectionMethods has \\\"Url\\\"\\r\\n| join EmailUrlInfo on NetworkMessageId\\r\\n| where UrlLocation == \\\"QRCode\\\"\\r\\n| summarize [\\\"Phish QR Detection\\\"]=countif(parse_json(DetectionMethods).Phish has \\\"URL\\\"), [\\\"Malware QR Detection\\\"]=countif(parse_json(DetectionMethods).Malware has \\\"URL\\\"), [\\\"Spam QR Detection\\\"]=countif(parse_json(DetectionMethods).Spam has \\\"URL\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, [\\\"Phish QR Detection\\\"]=coalesce([\\\"Phish QR Detection\\\"],0), [\\\"Malware QR Detection\\\"]=coalesce([\\\"Malware QR Detection\\\"],0), [\\\"Spam QR Detection\\\"]=coalesce([\\\"Spam QR Detection\\\"],0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"graphSettings\":{\"type\":0},\"chartSettings\":{\"xAxis\":\"Timestamp\",\"xSettings\":{\"dateFormatSettings\":{\"formatName\":\"shortDatePattern\",\"showUtcTime\":false}}}},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6c2a7724-d3c2-42b2-b8da-7acbcd0666c6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises where URL's have been scanned identified from various locations in emails\\r\\nEmailUrlInfo\\r\\n| summarize  count() by UrlLocation\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5640dbd5-4085-4f2a-8fb9-e4112233e99e\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"group - 9-URL detections\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"b572d79b-17a0-48ac-9a43-4f20324cf998\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Insights on URL Click-Based Threat Detections\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain URL click based threat detections in emails as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend of blocked URL clicks, time-of-click URL scans by workload, malicious clicks allowed, top clicks on malicious URLs, and more.<br><br>**Recommended action:** For blocked-click spikes, verify Safe Links is set to not allow click-through; investigate workloads with high click-through activity.\"},\"name\":\"text - 13 - Copy - Copy\",\"id\":\"6d37617e-911e-4ce6-a10d-4749486738ea\"},{\"type\":1,\"content\":{\"json\":\"### Trend (per {Granularity}) of Blocked URL Click Events<br>\\r\\n\\r\\n**Shows the count (per {Granularity}) of blocked URL click attempts and click attempts on URLs with detections, grouped by threat types (e.g., Phish, Malware, Spam). Helps track user interaction with malicious links over time across various threat types.**\"},\"name\":\"text - 13 - Copy - Copy - Copy\",\"id\":\"9e477950-bedc-4cc0-9863-df07d124806c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Generates a time-series analysis for blocked URL click events from the 'UrlClickEvents' table\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(UrlClickEvents\\r\\n| where isnotempty(ActionType)\\r\\n| where ActionType has_any(\\\"ClickBlocked\\\")\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, BlockedClicks = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"BlockedClicks\",\"color\":\"blueDark\"}]}},\"customWidth\":\"66\",\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"366e80d9-f6ed-43af-91e5-3d04cdcf692d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of click attempts on URL's with detections split by the different threat types identified\\r\\nUrlClickEvents\\r\\n| where isnotempty(ThreatTypes)\\r\\n| summarize count() by ThreatTypes\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a356eac3-62c2-4fc9-a4d9-3b05b13848df\"},{\"type\":1,\"content\":{\"json\":\"### Trend (per {Granularity}) of URL Click Actions by Type<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of URL click events categorised by action type: Blocked, Allowed, Pending Verdict, Error Page, and Clicked Through. Helps identify risky user behaviour and policy gaps.**\"},\"customWidth\":\"66\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a91fe7a6-f507-48f7-bbcc-61dc4f998ba6\"},{\"type\":1,\"content\":{\"json\":\"### URL Clicks by Workload<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of URL click events grouped by Workload (e.g., Outlook, Teams, Copilot, Office Apps: Word, Excel, PowerPoint) Helps identify which applications are most frequently used for URL interactions and potential risk exposure.**\"},\"customWidth\":\"33\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"ce05fa08-6e68-4c02-a0bf-2be6cdfae935\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises different URL click event types by action (e.g., blocked, allowed, pending verdict, error pages, and clicked through), summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(UrlClickEvents\\r\\n| where isnotempty(ActionType)\\r\\n| summarize ClickBlocked=countif(ActionType has_any(\\\"ClickBlocked\\\")), ClickAllowed=countif(ActionType has_any(\\\"ClickAllowed\\\")), PendingVerdict=countif(ActionType has_any(\\\"UrlScanInProgress\\\")), ErrorPage=countif(ActionType has_any(\\\"UrlErrorPage\\\")), ClickedThrough=countif(IsClickedThrough == true) by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ClickBlocked=coalesce(ClickBlocked,0), ClickAllowed=coalesce(ClickAllowed,0), PendingVerdict=coalesce(PendingVerdict,0), ErrorPage=coalesce(ErrorPage,0), ClickedThrough=coalesce(ClickedThrough,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"66\",\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a12b4c78-7d18-4adc-86e0-54395d6a996a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises where URL clicks scanned by the Workload the click happened from\\r\\nUrlClickEvents\\r\\n| summarize  count() by Workload\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 5 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3237cd55-1d5c-41a9-a8f2-1d46c61a709e\"},{\"type\":1,\"content\":{\"json\":\"### Blocked URL Clicks by Workload (per {Granularity})<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of blocked URL click attempts grouped by Workload (Email, Teams, Office, Microsoft 365 Copilot). Helps identify which platforms are most exposed to malicious link interactions and where user awareness or policy enforcement should be strengthened.**\"},\"customWidth\":\"66\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1f209a83-3d50-4bb8-9a79-a365a50a4142\"},{\"type\":1,\"content\":{\"json\":\"### Click-Through Activity on Detected URLs by Workload<br>\\r\\n\\r\\n**Displays counts of click‑through actions on URLs already identified with detections, grouped by Workload where the click happened. Helps identify clients/platforms where users are most likely to proceed to risky URLs and prioritise awareness training or policy tuning for those workloads**\"},\"customWidth\":\"33\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"33592db8-0ff5-4d8e-bd8f-0201b81a4584\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises blocked URL click event types by Workload (e.g., Email, Teams, Office, Microsoft 365 Copilot), summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(UrlClickEvents\\r\\n| where ActionType ==\\\"ClickBlocked\\\"\\r\\n| summarize Teams=countif(Workload==\\\"Teams\\\"), Office=countif(Workload==\\\"Office\\\"), Email=countif(Workload==\\\"Email\\\"), Copilot=countif(Workload==\\\"Copilot\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, Teams=coalesce(Teams,0), Office=coalesce(Office,0), Email=coalesce(Email,0), Copilot=coalesce(Copilot,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"66\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"80241767-0f69-4e2e-9889-3bf1f48e4f02\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of click-through activities on URL's with detections split by the source client\\r\\nUrlClickEvents \\r\\n| where IsClickedThrough !=\\\"0\\\"\\r\\n| where isnotempty(ThreatTypes) \\r\\n| summarize count() by Workload\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fde29b46-2896-4bfc-bb61-09436696d738\"},{\"type\":1,\"content\":{\"json\":\"### Top clicks on Malicious URLs<br>\\r\\n\\r\\n**Displays the top 20 URLs associated with detections that registered the highest number of clicks. Includes ThreatTypes, ActionType, and Workload to provide context on the nature of the threat and where user interaction occurred.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"22bda63a-626c-47de-9a76-ad665ef87862\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the top 20 URL's that have a detection associated with the most ammount of clicks registered \\r\\nUrlClickEvents\\r\\n| where ThreatTypes !=\\\"\\\"\\r\\n| summarize count() by Url, ThreatTypes, ActionType, Workload\\r\\n| top 20 by count_\\r\\n| project ['URL']=Url, ['Threat Types']=ThreatTypes, ['Action Type']=ActionType, Workload, ['Click Count']=count_\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Click Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 10 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a044fd4e-7be6-4a11-974c-b54e417c2a81\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"group - 31-URL clicks\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"75e543f6-08c0-42ed-9869-ecd61b721d34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Top Risky Users Clicking on URLs with Threats\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and identify users who have clicked on malicious URLs detected by Microsoft Defender for Office 365.<br><br>**Recommended action:** Enroll these users in security awareness training and verify Safe Links policy coverage for their mailboxes.\"},\"name\":\"text - 13 - Copy - Copy - Copy\",\"id\":\"19487811-a94b-4537-877e-61ac7e287c21\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Users Clicking on URLs with Malware Threat<br>\\r\\n\\r\\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Malware. Helps identify individuals at greater risk and prioritise targeted security awareness training.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"78e10621-0e98-44c4-8399-810c19f138c2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 users with click attempts on URL's with malware detections\\r\\nUrlClickEvents\\r\\n| summarize TotalClickCount=count(),MalwareClickCount = countif(ThreatTypes has \\\"Malware\\\") by AccountUpn\\r\\n| extend Bad_Click_Percentage = todouble(round(MalwareClickCount / todouble(TotalClickCount) *100, 2))\\r\\n| where MalwareClickCount !=0\\r\\n| sort by MalwareClickCount desc\\r\\n| top 15 by MalwareClickCount\\r\\n| project ['User']=AccountUpn, ['Malware Clicks']=MalwareClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Malware Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"25ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Clicks\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Click %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalEmailCount\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad_Traffic_Percentage_Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 18 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a7ae8a75-ca7f-49be-8cad-d1451a3bd396\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Users Clicking on URLs with Phish Threat<br>\\r\\n\\r\\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Phish. Helps identify individuals at greater risk and prioritise targeted security awareness training.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"90d9a0c3-970a-4998-be62-3b3b84bb0f37\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 users with click attempts on URL's with Phish detections\\r\\nUrlClickEvents\\r\\n| summarize TotalClickCount=count(),PhishClickCount = countif(ThreatTypes has \\\"Phish\\\") by AccountUpn\\r\\n| extend Bad_Click_Percentage = todouble(round(PhishClickCount / todouble(TotalClickCount) *100, 2))\\r\\n| where PhishClickCount !=0\\r\\n| sort by PhishClickCount desc\\r\\n| top 15 by PhishClickCount\\r\\n| project ['User']=AccountUpn, ['Phish Clicks']=PhishClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Phish Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"25ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Clicks\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Click %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareClickCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalEmailCount\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad_Traffic_Percentage_Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 18 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d46877d9-03af-463a-b406-bb4c601dffeb\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Users Clicking on URLs with Spam Threat<br>\\r\\n\\r\\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Spam. Helps identify individuals at greater risk and prioritise targeted security awareness training.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"dc66e020-0932-4346-8e20-6a2dc78de7a9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 users with click attempts on URL's with Spam detections\\r\\nUrlClickEvents\\r\\n| summarize TotalClickCount=count(),SpamClickCount = countif(ThreatTypes has \\\"Spam\\\") by AccountUpn\\r\\n| extend Bad_Click_Percentage = todouble(round(SpamClickCount / todouble(TotalClickCount) *100, 2))\\r\\n| where SpamClickCount !=0\\r\\n| sort by SpamClickCount desc\\r\\n| top 15 by SpamClickCount\\r\\n| project ['User']=AccountUpn, ['Spam Clicks']=SpamClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spam Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"25ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Clicks\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Click %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"PhishClickCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareClickCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalEmailCount\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad_Traffic_Percentage_Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 18 - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"734ee45e-4dff-4ca1-b17d-02389086b17b\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"group - 32-Top clickers\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"ee6c3413-28be-49a1-a89d-bf5fce7acfa4\"},{\"type\":1,\"content\":{\"json\":\"# Microsoft Teams Collaboration Protection\\r\\n\\r\\n---\\r\\nAs email defenses mature, attackers are shifting into **Microsoft Teams**, where messages bypass secure email gateways and carry the implicit trust of a colleague chat. Microsoft Threat Intelligence reports Teams-based phishing and voice phishing (vishing) rising steadily through 2026, most often as **IT help desk or technical-support impersonation** from external or newly-created tenants, used to steer users toward remote-access tools and credential theft.\\r\\n\\r\\nThis tab shows **Microsoft Defender for Office 365** protection for Microsoft Teams: threat detections and impersonation, suspicious external senders, malicious URLs and clicks, malicious files, post-delivery ZAP removals, and user and admin submissions across chats and channels.\\r\\n\\r\\n**Recommended action:** Treat unsolicited external help desk or IT support contact as suspicious. Restrict inbound chat from unmanaged and consumer tenants, allowlist trusted external domains, remove or restrict remote-support tools such as Quick Assist where they are not required, and enforce phishing-resistant MFA for all users (Conditional Access with authentication strength), prioritizing privileged and administrator accounts first.\\r\\n\\r\\n[<p><b>Disrupting threats targeting Microsoft Teams</b></p>](https://www.microsoft.com/en-us/security/blog/2025/10/07/disrupting-threats-targeting-microsoft-teams/)[<p><b>Cross-tenant helpdesk impersonation to data exfiltration: a human-operated intrusion playbook</b></p>](https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/)[<p><b>Help on the line: how a Microsoft Teams support call led to compromise</b></p>](https://www.microsoft.com/en-us/security/blog/2026/03/16/help-on-the-line-how-a-microsoft-teams-support-call-led-to-compromise/)[<p><b>Email threat landscape: Q2 2026 trends and insights</b></p>](https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/)\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"text - teams description\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5c0f0100-0a11-4b22-9c33-000000000100\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Headline Microsoft Teams protection metrics for the selected period, with per-interval sparklines. Messages are de-duplicated to the latest record per Teams message.\\r\\nlet gran = {Granularity};\\r\\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\\r\\nlet zap = materialize(MessagePostDeliveryEvents);\\r\\nunion\\r\\n(msgs | summarize Count = count() | extend Details = \\\"Teams Messages Scanned\\\", Ord = 1, Trend = toscalar(msgs | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Messages with Threats\\\", Ord = 2, Trend = toscalar(msgs | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where ThreatTypes has \\\"Phish\\\" | summarize Count = count() | extend Details = \\\"Phish Detections\\\", Ord = 3, Trend = toscalar(msgs | where ThreatTypes has \\\"Phish\\\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where ThreatTypes has \\\"Malware\\\" | summarize Count = count() | extend Details = \\\"Malware Detections\\\", Ord = 4, Trend = toscalar(msgs | where ThreatTypes has \\\"Malware\\\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where ThreatTypes has \\\"Spam\\\" | summarize Count = count() | extend Details = \\\"Spam Detections\\\", Ord = 5, Trend = toscalar(msgs | where ThreatTypes has \\\"Spam\\\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where SafetyTip == \\\"URLMessageWarning\\\" | summarize Count = count() | extend Details = \\\"Messages with URL Warning\\\", Ord = 6, Trend = toscalar(msgs | where SafetyTip == \\\"URLMessageWarning\\\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(zap | summarize Count = count() | extend Details = \\\"Post-Delivery ZAP Actions\\\", Ord = 7, Trend = toscalar(zap | make-series S = count() default = 0 on Timestamp step gran | project S))\\r\\n| sort by Ord asc\\r\\n| project Details, Count, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"name\":\"teams kpi tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b2c476ca-4141-43b4-9d4e-98470aa432fc\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Microsoft Teams - Collaboration Protection Overview\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Defender for Office 365 extends its protection to **Microsoft Teams**, detecting malicious messages, URLs, and files shared through chats and channels. This tab summarizes Teams message detections, link-safety warnings, post-delivery ZAP, file scanning, and user/admin submissions.<br><br>*Scope note: the Teams message tables surface metadata for external-conversation messages plus internal messages that contain URLs, so counts reflect that scope rather than the full volume of Teams messages.*\"},\"name\":\"teams overview banner\",\"id\":\"2f71360f-1673-480f-8361-5afc83aee67d\"},{\"type\":1,\"content\":{\"json\":\"### Teams threat detections over time<br>\\r\\n\\r\\n**Volume (per selected interval) of Microsoft Teams messages detected with a threat by Microsoft Defender for Office 365. Spikes may indicate a targeted Teams-based campaign.**\"},\"customWidth\":\"100\",\"name\":\"teams trend header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"0ac71d4e-8ecb-4d17-9fd3-10754007ec07\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the number of Microsoft Teams messages detected with a threat over time, de-duplicated to the latest record per message and summarized per selected interval.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId | summarize ThreatDetections = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ThreatDetections = coalesce(ThreatDetections, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"xAxis\":\"Timestamp\",\"seriesLabelSettings\":[{\"seriesName\":\"ThreatDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"teams detection trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"937f3bc6-21f5-4f4c-ab72-78f08f32c5bd\"},{\"type\":1,\"content\":{\"json\":\"### Threat type breakdown<br>\\r\\n\\r\\n**Split of Microsoft Teams threat detections across Phish, Malware, and Spam.**\"},\"customWidth\":\"50\",\"name\":\"teams threat pie header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"645a39ae-843a-47db-8016-6082ef37744d\"},{\"type\":1,\"content\":{\"json\":\"### Thread exposure<br>\\r\\n\\r\\n**De-duplicated Microsoft Teams messages split by whether the conversation includes external participants.**\"},\"customWidth\":\"50\",\"name\":\"teams thread header\",\"id\":\"a1a48f9a-8593-4ab5-8824-5998c643e844\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query breaks down Microsoft Teams threat detections by threat type for the selected period, de-duplicated to the latest record per message. A message flagged for more than one threat type is counted under each, so the split can exceed the distinct message count.\\r\\nlet msgs = MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId;\\r\\nunion\\r\\n(msgs | where ThreatTypes has \\\"Phish\\\" | summarize Count = count() | extend ThreatType = \\\"Phish\\\"),\\r\\n(msgs | where ThreatTypes has \\\"Malware\\\" | summarize Count = count() | extend ThreatType = \\\"Malware\\\"),\\r\\n(msgs | where ThreatTypes has \\\"Spam\\\" | summarize Count = count() | extend ThreatType = \\\"Spam\\\")\\r\\n| project ThreatType, Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"teams threat type pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"029b4ecc-cd95-4385-a251-8ab194add8f4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\\r\\nMessageEvents\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| extend Thread = iif(IsExternalThread == true, \\\"External Thread\\\", \\\"Internal Thread\\\")\\r\\n| summarize Count = count() by Thread\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"teams thread pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1581f447-9b3e-4857-84b8-e78b5df65ac5\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Overview\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"283f36b2-5c54-4afe-9a87-33d4796bd5b7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Teams Calls and Vishing (Voice Phishing)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Voice phishing (vishing) over Microsoft Teams is the fastest-growing collaboration threat of 2026. Attackers impersonate IT help desk or support and call users directly, often after a chat lure, to talk them into granting remote access or entering credentials. Because a target must be online to answer, malicious calls cluster in working hours. This section surfaces Teams call activity, when calls happen, and callers using support or brand-impersonation identities.**<br><br>*Interim data source: Teams call activity is currently read from Microsoft Defender for Cloud Apps call telemetry (CloudAppEvents). It will move to the dedicated CallActivityEvents table once that table is available to stream into Microsoft Sentinel.*<br><br>**Recommended action:** Treat unsolicited help desk or support calls as suspicious. Confirm any request through a known internal channel, and never grant remote access such as Quick Assist on the strength of an inbound Teams call. Restrict inbound calls and chat from unmanaged and consumer tenants.\"},\"customWidth\":\"100\",\"name\":\"teams calls banner\",\"id\":\"9815bdc9-9e10-4e84-9164-783092b4ccb0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Teams call and vishing headline metrics for the selected period, with per-interval sparklines. Interim source: Defender for Cloud Apps call telemetry (CloudAppEvents / CallParticipantDetail).\\r\\nlet gran = {Granularity};\\r\\nlet calls = materialize(CloudAppEvents | where ActionType == \\\"CallParticipantDetail\\\" | extend R = parse_json(RawEventData) | extend CallId = tostring(R.CallId), UId = tolower(tostring(R.UserId)));\\r\\nlet susp = calls | extend Local = tostring(split(UId, \\\"@\\\")[0]), Dom = tostring(split(UId, \\\"@\\\")[1]) | where Local matches regex @\\\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\\\" or Dom endswith \\\".onmicrosoft.com\\\";\\r\\nlet reported = CloudAppEvents | where ActionType == \\\"CallReported\\\";\\r\\nunion\\r\\n(calls | summarize Count = dcount(CallId) | extend Details = \\\"Teams Calls\\\", Ord = 1, Trend = toscalar(calls | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(susp | summarize Count = dcount(UId) | extend Details = \\\"Impersonation-style Callers\\\", Ord = 2, Trend = toscalar(susp | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(reported | summarize Count = count() | extend Details = \\\"Reported Suspicious Calls\\\", Ord = 3, Trend = toscalar(reported | make-series S = count() default = 0 on Timestamp step gran | project S))\\r\\n| sort by Ord asc\\r\\n| project Details, Count, Trend\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21},\"showBorder\":true,\"size\":\"auto\"},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams calls kpi\",\"id\":\"be8946d9-1eae-405c-b8df-cee2242cb44d\"},{\"type\":1,\"content\":{\"json\":\"### Teams call activity over time<br>\\r\\n**Distinct Microsoft Teams calls per selected interval. A sudden rise, or calls outside normal working hours, can indicate a vishing campaign in progress.**\"},\"customWidth\":\"100\",\"name\":\"teams calls trend header\",\"id\":\"1b49c98f-e5d9-457c-b058-a195e89eac0e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Distinct Teams calls per interval (interim source: CloudAppEvents / CallParticipantDetail).\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"CallParticipantDetail\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend CallId = tostring(R.CallId)\\r\\n| summarize ['Teams Calls'] = dcount(CallId) by Timestamp = bin(Timestamp, {Granularity})\\r\\n| sort by Timestamp asc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"xAxis\":\"Timestamp\",\"seriesLabelSettings\":[{\"seriesName\":\"Teams Calls\",\"color\":\"blueDark\"}]},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams calls trend\",\"id\":\"7538b3ca-b96d-421a-9cdc-69b8aef4b185\"},{\"type\":1,\"content\":{\"json\":\"### When calls happen (hour of day, UTC)<br>\\r\\n**Microsoft Teams calls by the hour of day they started (UTC), listed 00:00 through 23:00. The bar length is the number of calls that started in that hour across the selected period. Vishing calls cluster in working hours because the target must be online to answer, with the heaviest malicious-call activity between 14:00 and 20:00 UTC, Monday to Friday, according to Microsoft Threat Intelligence. Use this to baseline normal call timing and spot unusual off-hours spikes.**\"},\"customWidth\":\"100\",\"name\":\"teams calls hour header\",\"id\":\"6bc095e9-fe0d-4f6f-81bd-f3374d758229\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Teams calls by start hour of day (UTC), all 24 hours 00:00..23:00 in order (interim source: CloudAppEvents / CallParticipantDetail).\\r\\nlet data = CloudAppEvents\\r\\n| where ActionType == \\\"CallParticipantDetail\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend JoinTime = todatetime(R.JoinTime), CallId = tostring(R.CallId)\\r\\n| where isnotempty(JoinTime) and isnotempty(CallId)\\r\\n| summarize CallStart = min(JoinTime) by CallId\\r\\n| extend HourUTC = hourofday(CallStart)\\r\\n| summarize Calls = count() by HourUTC;\\r\\nrange HourUTC from 0 to 23 step 1\\r\\n| join kind=leftouter (data) on HourUTC\\r\\n| extend Calls = coalesce(Calls, 0)\\r\\n| extend HourLabel = strcat(iif(HourUTC < 10, strcat(\\\"0\\\", tostring(HourUTC)), tostring(HourUTC)), \\\":00\\\")\\r\\n| order by HourUTC asc\\r\\n| project ['Hour of Day (UTC)'] = HourLabel, ['Teams Calls'] = Calls\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Teams Calls\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blueDark\",\"customColumnWidthSetting\":\"360px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams calls hour\",\"id\":\"c36a9909-5570-4fe7-8efc-1b9b4745713a\"},{\"type\":1,\"content\":{\"json\":\"### Suspicious callers (support and helpdesk impersonation)<br>\\r\\n**Teams call participants whose display name or address looks like IT support, help desk, or a well-known brand (for example \\\"Microsoft IT support\\\", \\\"Help Desk\\\", \\\"Office 365 Support\\\"), or who dial in from a throwaway `.onmicrosoft.com` tenant. Origin shows whether the caller is external, an external throwaway tenant, or inside your own tenant. External and throwaway-tenant callers are the primary vishing risk; own-tenant matches are frequently a legitimate internal help desk and should be confirmed rather than assumed malicious.**<br><br>**Recommended action:** Prioritise External and `.onmicrosoft` callers, confirm none are legitimate, and warn the users they called. Genuine IT support does not cold-call staff over Teams to request remote access.\"},\"customWidth\":\"100\",\"name\":\"teams calls susp header\",\"id\":\"aa420b5f-efd2-4da5-ab41-192031f62ed1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Suspicious Teams callers by impersonation-style DISPLAY NAME or address (Attendees[].DisplayName / UPN), with Origin from the org's own accepted (EmailEvents inbound) domains - no tenant-id anchor. Interim source: CloudAppEvents / CallParticipantDetail.\\r\\nlet suspRegex = @\\\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\\\";\\r\\nlet ownDomains = toscalar(EmailEvents | where EmailDirection == \\\"Inbound\\\" | extend RD = tolower(tostring(split(RecipientEmailAddress, \\\"@\\\")[1])) | where isnotempty(RD) | summarize make_set(RD, 200));\\r\\nlet calls = CloudAppEvents\\r\\n| where ActionType == \\\"CallParticipantDetail\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend CallId = tostring(R.CallId), JoinTime = todatetime(R.JoinTime), Attendees = R.Attendees\\r\\n| where isnotempty(CallId);\\r\\nlet callAtt = calls | summarize Attendees = take_any(Attendees), JoinTime = min(JoinTime) by CallId;\\r\\ncallAtt\\r\\n| mv-expand Att = Attendees\\r\\n| extend Caller = tolower(tostring(Att.UPN)), CallerName = tostring(Att.DisplayName)\\r\\n| extend CallerDom = tostring(split(Caller, \\\"@\\\")[1])\\r\\n| where isnotempty(Caller)\\r\\n| extend SuspName = CallerName matches regex suspRegex or Caller matches regex suspRegex\\r\\n| where SuspName or CallerDom endswith \\\".onmicrosoft.com\\\"\\r\\n| extend Origin = case(CallerDom endswith \\\".onmicrosoft.com\\\", \\\"External (.onmicrosoft throwaway)\\\", set_has_element(ownDomains, CallerDom), \\\"Own tenant\\\", \\\"External\\\")\\r\\n| summarize CallsPlaced = dcount(CallId), FirstSeen = min(JoinTime), LastSeen = max(JoinTime) by CallerName, Caller, Origin\\r\\n| extend OriginRank = case(Origin == \\\"External (.onmicrosoft throwaway)\\\", 0, Origin == \\\"External\\\", 1, 2)\\r\\n| sort by OriginRank asc, CallsPlaced desc\\r\\n| take 10\\r\\n| project ['Caller Display Name'] = CallerName, ['Caller Address'] = Caller, ['Origin'] = Origin, ['Calls Placed'] = CallsPlaced, ['First Seen'] = FirstSeen, ['Last Seen'] = LastSeen\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Calls Placed\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams calls susp table\",\"id\":\"d1c4df7b-db07-4c4c-bc71-dfd8623cd704\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Calls and Vishing\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"1d133411-9b5c-4ede-8502-68b3b02262e4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Teams Impersonation &amp; Identity Deception\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Defender for Office 365 flags Teams messages where a sender impersonates a brand, a specific person, or a trusted domain. Impersonation is the entry point for most Teams social-engineering: attackers pose as IT, executives, or Microsoft to build trust before delivering a malicious link or request. These visuals expose <b>who is being impersonated, who is being targeted, and the infrastructure (display names, look-alike domains, and URLs)</b> behind the campaigns so you can hunt IOCs and coach at-risk users.<br><br>**Recommended action:** Treat the impersonated display names and look-alike domains below as IOCs to hunt, and prioritize the Microsoft Defender alert *Microsoft Teams chat initiated by a suspicious external user*. Teach users that a Teams display name is not proof of identity: verify the real sender domain, and confirm any help desk, executive, or Microsoft support request through a known internal channel before acting.\"},\"name\":\"teams imp banner\",\"id\":\"7ff04ff3-9f2d-4a49-8383-2b542d78fe9b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nunion\\r\\n(imp | summarize Count=count() | extend Details=\\\"Impersonation Detections\\\", Ord=1),\\r\\n(imp | summarize Count=dcount(FakeSenderAddress) | extend Details=\\\"Distinct Fake Senders\\\", Ord=2),\\r\\n(imp | summarize Count=dcount(TargetUser) | extend Details=\\\"Targeted Users\\\", Ord=3),\\r\\n(imp | summarize Count=dcount(ImpersonationType) | extend Details=\\\"Impersonation Types\\\", Ord=4)\\r\\n| sort by Ord asc | project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams imp tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e37f94d5-9bcc-432e-aa66-25831603c228\"},{\"type\":1,\"content\":{\"json\":\"### Impersonation over time, by type<br>\\r\\n\\r\\n**Trend of Brand, User, and Domain impersonation detections. A spike in a single type often marks the start of a targeted campaign.**\"},\"customWidth\":\"100\",\"name\":\"teams imp trend header\",\"id\":\"09907f5b-5c20-4a7e-86d3-c89153c4df98\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp | summarize Count=count() by ImpersonationType, Timestamp=bin(Timestamp, {Granularity}) | sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"100\",\"name\":\"teams imp trend\",\"id\":\"757204b1-e900-4217-a2ff-2224a033fdcc\"},{\"type\":1,\"content\":{\"json\":\"### Suspicious external senders (impersonation and throwaway tenants)<br>\\r\\n**External Microsoft Teams senders flagged as likely impersonation: throwaway `.onmicrosoft.com` tenants and/or help desk, IT support, security, admin, or account/update-themed display names. Attackers rotate through many such identities (for example numbered `ithelpdesk<n>@...` addresses) from newly-created or consumer tenants to pose as internal support, frequently before the Defender impersonation detector assigns a verdict. This heuristic complements that detector.**<br><br>**Recommended action:** Review high threat-rate senders, block the sending domains, and remind users that genuine IT support does not cold-contact them from an external tenant; verify any such request through a known internal channel.\"},\"customWidth\":\"100\",\"name\":\"teams susp senders header\",\"id\":\"5df4af86-49e9-4fc7-b6ad-76d3ef3f7da6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//External Teams senders flagged as likely impersonation: throwaway .onmicrosoft.com tenants and/or help desk / IT / admin / update-themed display names, ranked by messages carrying a threat.\\r\\nMessageEvents\\r\\n| where IsExternalThread == true\\r\\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \\\"@\\\")[1]))\\r\\n| extend IsOnMicrosoft = SenderDomain endswith \\\".onmicrosoft.com\\\"\\r\\n| extend SuspName = SenderDisplayName matches regex @\\\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\\\"\\r\\n| where IsOnMicrosoft or SuspName\\r\\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\\r\\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \\\"Throwaway .onmicrosoft tenant + helpdesk-style name\\\", IsOnMicrosoft, \\\"Throwaway .onmicrosoft tenant\\\", \\\"Helpdesk / IT-style display name\\\")\\r\\n| extend ThreatPct = round(todouble(ThreatMessages) * 100 / TeamsMessages, 1)\\r\\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages, ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\\r\\n| sort by ['Threat Messages'] desc, ['Teams Messages'] desc\\r\\n| take 10\",\"size\":0,\"title\":\"\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Teams Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Threat %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":100},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams susp senders table\",\"id\":\"dd1d79d8-f591-4aae-bd44-6ad23a3e0ae4\"},{\"type\":1,\"content\":{\"json\":\"### Who is being targeted<br>\\r\\n\\r\\n**Internal users receiving the most impersonation attempts. Concentrated targeting of a few users is a strong signal of a deliberate campaign - prioritize these users for security awareness training.**\"},\"customWidth\":\"100\",\"name\":\"teams imp targets header\",\"id\":\"43112ad1-ebc9-42fb-9ebd-0dbaa862ed45\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp | summarize Detections=count(), ['Distinct Fake Senders']=dcount(FakeSenderAddress), Types=make_set(ImpersonationType,3), ['Last Seen']=max(Timestamp) by ['Targeted User']=TargetUser | top 10 by Detections\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams imp targets\",\"id\":\"cc4b3f98-bfcb-4741-9abb-9ff099eb946f\"},{\"type\":1,\"content\":{\"json\":\"### Impersonating senders<br>\\r\\n\\r\\n**The identities behind the impersonation, grouped by fake display name, sender domain, and type. Attackers rotate through many sending addresses under a single display name - Distinct Sender Addresses exposes that rotation, and a high count is itself a strong bulk-campaign signal. Use First/Last Seen to scope the campaign window.**\"},\"customWidth\":\"100\",\"name\":\"teams imp senders header\",\"id\":\"99859796-7b69-42e7-a27a-541e0ba86cb2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the identities behind Teams impersonation, grouped by the fake display name, sender domain, and impersonation type. Attackers rotate through many sending addresses under one display name, so Distinct Sender Addresses reveals bulk campaigns that per-address ranking would hide.\\r\\nlet imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp\\r\\n| summarize Detections=count(), SenderAddresses=dcount(FakeSenderAddress), Targets=dcount(TargetUser), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by FakeDisplayName, FakeSenderDomain, ImpersonationType\\r\\n| top 10 by Detections\\r\\n| project ['Fake Display Name']=FakeDisplayName, ['Sender Domain']=FakeSenderDomain, ['Impersonation Type']=ImpersonationType, ['Distinct Sender Addresses']=SenderAddresses, Detections, ['Targeted Users']=Targets, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Distinct Sender Addresses\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams imp senders\",\"id\":\"209439a0-5be3-4e41-abe9-695552730dc8\"},{\"type\":1,\"content\":{\"json\":\"### Display names abused<br>\\r\\n\\r\\n**The identities attackers pretend to be (for example \\\"IT HelpDesk\\\", \\\"Microsoft Support\\\"). These are the trust anchors of the social-engineering lure.**\"},\"customWidth\":\"100\",\"name\":\"teams imp names header\",\"id\":\"e645578b-7a52-4d38-9d83-f5c500bbfe1a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Distinct Senders']=dcount(FakeSenderAddress) by ['Fake Display Name']=FakeDisplayName | top 10 by Detections\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Distinct Senders\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams imp names\",\"id\":\"d723d72b-4e7c-431b-ae7b-980879c8bd75\"},{\"type\":1,\"content\":{\"json\":\"### Look-alike sender domains<br>\\r\\n\\r\\n**Sending domains used for impersonation - watch for typosquats (for example rnicrosoft.com for m&rarr;rn). Add confirmed domains to your Tenant Allow/Block List.**\"},\"customWidth\":\"100\",\"name\":\"teams imp domains header\",\"id\":\"98040a5a-bbd5-4c95-b976-5630ce48b282\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Display Names Used']=dcount(FakeDisplayName) by ['Sender Domain']=FakeSenderDomain | top 10 by Detections\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Display Names Used\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams imp domains\",\"id\":\"94b9fa45-c889-46a7-8b80-92e5d280ad3b\"},{\"type\":1,\"content\":{\"json\":\"### URL IOCs from impersonation messages<br>\\r\\n\\r\\n**URL domains that appeared in messages sent by impersonating senders. Threat actors deliberately mix legitimate domains (for example microsoft.com or google.com) with their malicious ones to make the lure look trustworthy, so treat this as a review list - not a blocklist. Investigate the unfamiliar or look-alike domains and block only those you confirm malicious; never block a well-known legitimate domain from this list.**\"},\"customWidth\":\"100\",\"name\":\"teams imp ioc header\",\"id\":\"d5f4886c-7c7e-4c6f-94ca-569cabda5ede\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists URL domains that appeared in messages sent by impersonating senders, with a breakdown of how many carried Malware, Phish, or Spam verdicts. Threat actors mix legitimate and malicious domains in a single lure, so review the unfamiliar or look-alike domains and block only confirmed-malicious ones.\\r\\nlet imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ChatThreadId = tostring(RD.ChatThreadId);\\r\\nlet impThreads = imp | distinct ChatThreadId;\\r\\nlet impMsgs = MessageEvents\\r\\n    | where ThreadId in (impThreads)\\r\\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n    | project TeamsMessageId, ThreatTypes;\\r\\nMessageUrlInfo\\r\\n| where isnotempty(UrlDomain)\\r\\n| join kind=inner (impMsgs) on TeamsMessageId\\r\\n| summarize ['URL Count']=count(), Messages=dcount(TeamsMessageId), Malware=countif(ThreatTypes has \\\"Malware\\\"), Phish=countif(ThreatTypes has \\\"Phish\\\"), Spam=countif(ThreatTypes has \\\"Spam\\\") by ['URL Domain']=UrlDomain\\r\\n| top 10 by ['URL Count']\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"URL Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Malware\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Phish\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Spam\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams imp ioc\",\"id\":\"958ac65c-d56d-4a80-ba83-2ab33e8b1e2e\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Impersonation\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"c49582db-6318-423f-b806-91cbeb625ea2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Malicious URLs and Link Warnings in Teams\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nTracks URLs shared through Microsoft Teams, messages that triggered a Microsoft Defender for Office 365 URL safety-tip warning, and the outcome of Teams URL clicks (allowed versus blocked) captured in UrlClickEvents.<br><br>**Recommended action:** Enable Safe Links for Microsoft Teams so links are checked at click time, and prioritize *User clicked a malicious link in Teams chat* alerts for investigation. Treat a blocked click as an attempted compromise: check whether the user went on to share credentials or run a file, and reset credentials where warranted.\"},\"name\":\"teams url banner\",\"id\":\"e3ec4d65-8d1f-4303-bd8f-eb1ae521da41\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query surfaces Microsoft Teams URL-sharing and link-warning metrics for the selected period. URL-warning messages carry the Microsoft Defender for Office 365 URL safety tip.\\r\\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\\r\\nunion\\r\\n(msgs | where SafetyTip == \\\"URLMessageWarning\\\" | summarize Count = count() | extend Details = \\\"Messages with URL Warning\\\", Ord = 1),\\r\\n(MessageUrlInfo | summarize Count = count() | extend Details = \\\"URLs Shared in Messages\\\", Ord = 2),\\r\\n(MessageUrlInfo | summarize Count = dcount(TeamsMessageId) | extend Details = \\\"Messages Containing URLs\\\", Ord = 3),\\r\\n(MessageUrlInfo | summarize Count = dcount(UrlDomain) | extend Details = \\\"Distinct URL Domains\\\", Ord = 4)\\r\\n| sort by Ord asc\\r\\n| project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams url tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b71382c7-c0f7-4f9d-9d21-e0a8bf9504ff\"},{\"type\":1,\"content\":{\"json\":\"### Teams URL click outcomes over time<br>\\r\\n\\r\\n**Allowed versus blocked Microsoft Teams URL clicks (per selected interval) from UrlClickEvents where the click happened in the Teams workload.**\"},\"customWidth\":\"66\",\"name\":\"teams click trend header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"30818e0d-6c4b-4868-896a-ac48cb3cef86\"},{\"type\":1,\"content\":{\"json\":\"### Click outcomes<br>\\r\\n\\r\\n**Distribution of Microsoft Teams URL click actions by type.**\"},\"customWidth\":\"33\",\"name\":\"teams click pie header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"5a882138-2241-4527-80b8-9983c5807050\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Microsoft Teams URL click outcomes over time (allowed vs blocked) using the UrlClickEvents workload filter, summarizing the data per selected interval.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(UrlClickEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(UrlClickEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(UrlClickEvents\\r\\n| where Workload == \\\"Teams\\\"\\r\\n| summarize ClickAllowed = countif(ActionType has \\\"ClickAllowed\\\"), ClickBlocked = countif(ActionType has \\\"ClickBlocked\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ClickAllowed = coalesce(ClickAllowed, 0), ClickBlocked = coalesce(ClickBlocked, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"66\",\"name\":\"teams click trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7a2f5559-1e3e-412a-addf-c3bf6be98502\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows Microsoft Teams URL click outcomes by action type for the selected period.\\r\\nUrlClickEvents\\r\\n| where Workload == \\\"Teams\\\"\\r\\n| where isnotempty(ActionType)\\r\\n| summarize Count = count() by ActionType\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"teams click pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"889c6bb3-438b-4575-84f2-084c1b5fd1f4\"},{\"type\":1,\"content\":{\"json\":\"### Top domains shared in Teams messages<br>\\r\\n\\r\\n**The 10 most-shared URL domains in Microsoft Teams messages, with the number of messages each appeared in.**\"},\"customWidth\":\"100\",\"name\":\"teams top domains header\",\"id\":\"dcb8c87c-087e-4d69-b7b7-0329296293ff\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 URL domains shared in Microsoft Teams messages by volume for the selected period.\\r\\nMessageUrlInfo\\r\\n| where isnotempty(UrlDomain)\\r\\n| summarize UrlCount = count(), Messages = dcount(TeamsMessageId) by UrlDomain\\r\\n| top 10 by UrlCount\\r\\n| project ['URL Domain']=UrlDomain, ['URLs Shared']=UrlCount, ['Messages']=Messages\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"URLs Shared\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams top domains table\",\"id\":\"7561adb0-1fbe-41ce-a924-a27bcd4c5c12\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Malicious URLs\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"6d47c309-be9e-4b21-940e-7c7b282e5dc2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Targeted Users &amp; Risky Senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nIdentifies who is most targeted in Microsoft Teams, and profiles the external senders and domains behind risky messages - URL safety-tip warnings, first-contact senders, threat-carrying domains, and low-reputation link infrastructure - so you can spot anomalous senders before they succeed.<br><br>**Recommended action:** Prioritize the most-targeted users for phishing-resistant MFA and awareness coaching, and treat first-contact external senders and low-reputation domains as IOCs. Restrict inbound chat from unmanaged and consumer tenants, and allowlist only trusted external domains so unsolicited outsiders cannot start a conversation.\"},\"name\":\"teams risky banner\",\"id\":\"0aa13d73-2e13-487c-a7c4-d90464a554d4\"},{\"type\":1,\"content\":{\"json\":\"### Top targeted users (messages with threats)<br>\\r\\n\\r\\n**The 10 users receiving the most Microsoft Teams messages that contained a threat, expanded from each message recipient list.**\"},\"customWidth\":\"100\",\"name\":\"teams targeted header\",\"id\":\"827dc0f6-2bb2-49b9-acf8-d7b400238594\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 users receiving Microsoft Teams messages that contained a threat, expanded from the message recipient list, with each user's total Teams messages received and the share that carried a threat. Messages are de-duplicated to the latest record per message.\\r\\nlet expanded = MessageEvents\\r\\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n    | mv-expand rd = parse_json(RecipientDetails)\\r\\n    | extend Recipient = tostring(rd.RecipientSmtpAddress)\\r\\n    | where isnotempty(Recipient);\\r\\nlet totals = expanded | summarize TotalMessages = count() by Recipient;\\r\\nexpanded\\r\\n| where isnotempty(ThreatTypes)\\r\\n| summarize ThreatMessages = count() by Recipient\\r\\n| join kind=leftouter (totals) on Recipient\\r\\n| extend ThreatPct = round(100.0 * ThreatMessages / TotalMessages, 1)\\r\\n| top 10 by ThreatMessages\\r\\n| project ['Recipient']=Recipient, ['Threat Messages']=ThreatMessages, ['Total Messages']=TotalMessages, ['Threat %']=ThreatPct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams targeted users table\",\"id\":\"79481d1b-617e-46df-b555-9f7240932dd0\"},{\"type\":1,\"content\":{\"json\":\"### Top senders of URL-warning messages<br>\\r\\n\\r\\n**Senders whose Microsoft Teams messages most often triggered a URL safety-tip warning.**\"},\"customWidth\":\"50\",\"name\":\"teams warn senders header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"ef71d7dd-4442-4992-977d-d550aad4533c\"},{\"type\":1,\"content\":{\"json\":\"### Top domains in URL-warning messages<br>\\r\\n\\r\\n**URL domains most frequently present in Microsoft Teams messages that triggered a URL safety-tip warning.**\"},\"customWidth\":\"50\",\"name\":\"teams warn domains header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"6f41a4ba-f832-4947-ad27-cd6b8015bd63\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 senders whose Microsoft Teams messages triggered a URL safety-tip warning for the selected period, with each sender's total Teams messages and the share that carried a warning. Messages are de-duplicated to the latest record per message.\\r\\nlet dedup = MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId;\\r\\nlet totals = dedup | summarize TotalMessages = count() by SenderEmailAddress;\\r\\ndedup\\r\\n| where SafetyTip == \\\"URLMessageWarning\\\"\\r\\n| summarize WarningMessages = count() by SenderEmailAddress\\r\\n| join kind=leftouter (totals) on SenderEmailAddress\\r\\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\\r\\n| top 10 by WarningMessages\\r\\n| project ['Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Warning Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"teams warn senders table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3fa023af-79e3-407f-ac20-b0aa6e3ba511\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 URL domains appearing in Microsoft Teams messages that triggered a URL safety-tip warning, with the domain's total message appearances and the share that carried a warning.\\r\\nlet warned = MessageEvents | where SafetyTip == \\\"URLMessageWarning\\\" | distinct TeamsMessageId;\\r\\nlet totals = MessageUrlInfo | where isnotempty(UrlDomain) | summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;\\r\\nMessageUrlInfo\\r\\n| where TeamsMessageId in (warned)\\r\\n| summarize WarningMessages = dcount(TeamsMessageId) by UrlDomain\\r\\n| join kind=leftouter (totals) on UrlDomain\\r\\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\\r\\n| top 10 by WarningMessages\\r\\n| project ['URL Domain']=UrlDomain, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Warning Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"teams warn domains table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"68811015-1383-48ad-86da-4f8f9d39e4c4\"},{\"type\":1,\"content\":{\"json\":\"### First-contact external senders<br>\\r\\n\\r\\n**External Microsoft Teams senders ordered by when they were first seen in the period (most recent first). Note: some flows tag internal-domain senders as external - to hide your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**\"},\"customWidth\":\"100\",\"name\":\"teams fc senders header\",\"id\":\"0f131ff3-d6b2-4187-b86c-ca3493594b54\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists external Microsoft Teams senders by the date they were first seen in the selected period, surfacing recent first-contact senders. Messages are de-duplicated to the latest record per message. In tenants with longer history this highlights genuinely new senders.\\r\\n// TIP: IsExternalThread may still surface senders from your own accepted domains. To hide them,\\r\\n// uncomment the ExcludeDomains line below (add your tenant domains) and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"contoso.com\\\"]);\\r\\nMessageEvents\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| where IsExternalThread == true\\r\\n//| where tostring(split(SenderEmailAddress, \\\"@\\\")[1]) !in~ (ExcludeDomains)\\r\\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\\r\\n| top 10 by FirstSeen desc\\r\\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"Threat Messages\",\"sortOrder\":2}]}},\"customWidth\":\"100\",\"name\":\"teams fc senders table\",\"id\":\"4e10a78d-8858-4dbb-9db0-e7b7d7e7636c\"},{\"type\":1,\"content\":{\"json\":\"### External sender-domain risk<br>\\r\\n\\r\\n**External sending domains ranked by threat volume, with the mix of conversation types (1:1 chat, group chat, channel), threat breakdown, threat rate, count of messages carrying low-reputation URLs (domains on commonly-abused TLDs such as .xyz, .top, .click, .shop, .zip), and first/last-seen. A domain that is new in the period, skews toward 1:1 chats, or shows a high threat rate is anomalous and warrants review. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**\"},\"customWidth\":\"100\",\"name\":\"teams anomaly header\",\"id\":\"a91295db-8192-4828-93c5-408436e4b0e1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query ranks external sender domains in Microsoft Teams by threat volume for the selected period, split by conversation type (1:1 chat, group chat, channel), with threat-type breakdown, threat rate, and a count of messages carrying low-reputation URL TLDs. Messages are de-duplicated to the latest record per message. New, 1:1-skewed, or high-threat-rate domains are the anomalies to review.\\r\\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\\r\\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"contoso.com\\\"]);\\r\\nlet suspTlds = dynamic([\\\"top\\\",\\\"xyz\\\",\\\"click\\\",\\\"link\\\",\\\"shop\\\",\\\"online\\\",\\\"site\\\",\\\"live\\\",\\\"icu\\\",\\\"cyou\\\",\\\"sbs\\\",\\\"rest\\\",\\\"quest\\\",\\\"cfd\\\",\\\"bond\\\",\\\"buzz\\\",\\\"fun\\\",\\\"space\\\",\\\"monster\\\",\\\"work\\\",\\\"tk\\\",\\\"ml\\\",\\\"ga\\\",\\\"cf\\\",\\\"gq\\\",\\\"dev\\\",\\\"app\\\",\\\"zip\\\",\\\"mov\\\",\\\"info\\\",\\\"win\\\",\\\"loan\\\",\\\"men\\\",\\\"stream\\\",\\\"country\\\"]);\\r\\nlet suspUrlMsgs = MessageUrlInfo\\r\\n    | where isnotempty(UrlDomain)\\r\\n    | extend Tld = tostring(split(UrlDomain, \\\".\\\")[-1])\\r\\n    | where Tld in (suspTlds)\\r\\n    | distinct TeamsMessageId;\\r\\nMessageEvents\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| where IsExternalThread == true\\r\\n| extend SenderDomain = tostring(split(SenderEmailAddress, \\\"@\\\")[1])\\r\\n| where isnotempty(SenderDomain)\\r\\n//| where SenderDomain !in~ (ExcludeDomains)\\r\\n| extend ConvType = case(isnotempty(GroupId), \\\"Channel\\\", array_length(todynamic(RecipientDetails)) > 1, \\\"Group chat\\\", \\\"1:1 chat\\\")\\r\\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\\r\\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\\\"1:1 chat\\\"), GroupChat=countif(ConvType==\\\"Group chat\\\"), ChannelMsgs=countif(ConvType==\\\"Channel\\\"), ThreatMessages=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \\\"Malware\\\"), Phish=countif(ThreatTypes has \\\"Phish\\\"), Spam=countif(ThreatTypes has \\\"Spam\\\"), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\\r\\n| where ThreatMessages > 0\\r\\n| extend ThreatRatePct = round(100.0 * ThreatMessages / Messages, 1)\\r\\n| top 10 by ThreatMessages desc\\r\\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Threat Msgs']=ThreatMessages, Malware, Phish, Spam, ['Threat Rate %']=ThreatRatePct, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams anomaly table\",\"id\":\"bcd6746d-8298-495d-9d6c-2fadc6cba569\"},{\"type\":1,\"content\":{\"json\":\"### Suspicious new senders (no threat verdict yet)<br>\\r\\n\\r\\n**External sending domains with no threat verdict yet, but that are either sending low-reputation-URL messages or showing unusual volume. These slip past threat filters - watch for new domains skewing toward 1:1 chats, an early social-engineering signal. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**\"},\"customWidth\":\"100\",\"name\":\"teams newdom header\",\"id\":\"9e3844f4-befc-4b76-a8cd-ca53fdf51d41\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query surfaces external sender domains in Microsoft Teams that have NO threat verdict yet but are sending messages with low-reputation URL TLDs or unusual volume, split by conversation type. These are early-warning senders that have not tripped a detection. Messages are de-duplicated to the latest record per message.\\r\\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\\r\\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"contoso.com\\\"]);\\r\\nlet suspTlds = dynamic([\\\"top\\\",\\\"xyz\\\",\\\"click\\\",\\\"link\\\",\\\"shop\\\",\\\"online\\\",\\\"site\\\",\\\"live\\\",\\\"icu\\\",\\\"cyou\\\",\\\"sbs\\\",\\\"rest\\\",\\\"quest\\\",\\\"cfd\\\",\\\"bond\\\",\\\"buzz\\\",\\\"fun\\\",\\\"space\\\",\\\"monster\\\",\\\"work\\\",\\\"tk\\\",\\\"ml\\\",\\\"ga\\\",\\\"cf\\\",\\\"gq\\\",\\\"dev\\\",\\\"app\\\",\\\"zip\\\",\\\"mov\\\",\\\"info\\\",\\\"win\\\",\\\"loan\\\",\\\"men\\\",\\\"stream\\\",\\\"country\\\"]);\\r\\nlet suspUrlMsgs = MessageUrlInfo\\r\\n    | where isnotempty(UrlDomain)\\r\\n    | extend Tld = tostring(split(UrlDomain, \\\".\\\")[-1])\\r\\n    | where Tld in (suspTlds)\\r\\n    | distinct TeamsMessageId;\\r\\nMessageEvents\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| where IsExternalThread == true\\r\\n| extend SenderDomain = tostring(split(SenderEmailAddress, \\\"@\\\")[1])\\r\\n| where isnotempty(SenderDomain)\\r\\n//| where SenderDomain !in~ (ExcludeDomains)\\r\\n| extend ConvType = case(isnotempty(GroupId), \\\"Channel\\\", array_length(todynamic(RecipientDetails)) > 1, \\\"Group chat\\\", \\\"1:1 chat\\\")\\r\\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\\r\\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\\\"1:1 chat\\\"), GroupChat=countif(ConvType==\\\"Group chat\\\"), ChannelMsgs=countif(ConvType==\\\"Channel\\\"), ThreatMessages=countif(isnotempty(ThreatTypes)), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\\r\\n| where ThreatMessages == 0\\r\\n| where SuspUrlMsgs > 0 or Messages >= 5\\r\\n| order by SuspUrlMsgs desc, Messages desc\\r\\n| take 10\\r\\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams newdom table\",\"id\":\"8036a5b7-b5b3-4af4-912f-bb092bb01b89\"},{\"type\":1,\"content\":{\"json\":\"### Low-reputation link domains in Teams (IOC radar)<br>\\r\\n\\r\\n**URL domains shared in Teams that use TLDs commonly abused for phishing and malware (for example .xyz, .top, .click, .zip, .shop). Ranked by message reach, with first/last-seen. Review these domains as potential indicators - .zip and .mov are especially deceptive because links read like file names.**\"},\"customWidth\":\"100\",\"name\":\"teams tld header\",\"id\":\"d48921f4-233c-4e0f-a97b-83e1bcaed399\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists URL domains shared in Microsoft Teams that use low-reputation TLDs commonly abused for phishing and malware, ranked by the number of Teams messages they appeared in, with first- and last-seen. Treat high-reach or newly-seen domains as candidate indicators of compromise.\\r\\nlet suspTlds = dynamic([\\\"top\\\",\\\"xyz\\\",\\\"click\\\",\\\"link\\\",\\\"shop\\\",\\\"online\\\",\\\"site\\\",\\\"live\\\",\\\"icu\\\",\\\"cyou\\\",\\\"sbs\\\",\\\"rest\\\",\\\"quest\\\",\\\"cfd\\\",\\\"bond\\\",\\\"buzz\\\",\\\"fun\\\",\\\"space\\\",\\\"monster\\\",\\\"work\\\",\\\"tk\\\",\\\"ml\\\",\\\"ga\\\",\\\"cf\\\",\\\"gq\\\",\\\"dev\\\",\\\"app\\\",\\\"zip\\\",\\\"mov\\\",\\\"info\\\",\\\"win\\\",\\\"loan\\\",\\\"men\\\",\\\"stream\\\",\\\"country\\\"]);\\r\\nMessageUrlInfo\\r\\n| where isnotempty(UrlDomain)\\r\\n| extend Tld = tostring(split(UrlDomain, \\\".\\\")[-1])\\r\\n| where Tld in (suspTlds)\\r\\n| summarize Messages=dcount(TeamsMessageId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ['URL Domain']=UrlDomain, ['TLD']=Tld\\r\\n| top 10 by Messages desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams tld table\",\"id\":\"30d5588e-010c-474a-9c53-74b73dcc9676\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Targeted Users & Risky Senders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"6fef737b-cb4e-4a51-9ced-bf11754a6b33\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Teams File Protection\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Defender for Office 365 scans files shared in Microsoft Teams. These visuals show files scanned versus malware detected, and list the malicious files found.<br><br>**Recommended action:** Investigate each malicious file below and confirm it was quarantined and removed from the SharePoint or OneDrive location backing the chat. Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, and use attack surface reduction rules to block executable content delivered through collaboration.\"},\"name\":\"teams file banner\",\"id\":\"2f01c905-dd65-4a13-9f67-c70402b2c175\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection - for the selected period.\\r\\nlet base = FileMaliciousContentInfo | where Workload == \\\"MicrosoftTeams\\\";\\r\\nunion\\r\\n(base | summarize Count = count() | extend Details = \\\"Teams Files Scanned\\\", Ord = 1),\\r\\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Files with Malware Detected\\\", Ord = 2),\\r\\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Files Scanned - No Detection\\\", Ord = 3)\\r\\n| sort by Ord asc\\r\\n| project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams file tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9f555c51-1680-47ef-94d4-b1f8cf9dce3b\"},{\"type\":1,\"content\":{\"json\":\"### Malicious files shared in Teams<br>\\r\\n\\r\\n**Files shared in Microsoft Teams that were detected with malware, with owner and file details.**\"},\"customWidth\":\"100\",\"name\":\"teams file table header\",\"id\":\"4cd3274e-0c61-4722-83b7-1fccf8a94a57\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365 for the selected period.\\r\\nFileMaliciousContentInfo\\r\\n| where Workload == \\\"MicrosoftTeams\\\"\\r\\n| where isnotempty(ThreatTypes)\\r\\n| top 10 by Timestamp desc\\r\\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams file table\",\"id\":\"135e0e7d-7110-40ee-a377-1a5992b2ef9d\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams File Protection\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"8ecc1bae-4a06-4b1c-8952-59fb434b7cbc\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Post-Delivery ZAP Insights (Teams)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nZero-hour auto purge (ZAP) removes malicious Microsoft Teams messages after delivery. These visuals summarize ZAP volume, type, result, and the senders whose messages were most often removed.<br><br>**Recommended action:** Confirm zero-hour auto purge is enabled for Microsoft Teams so newly-weaponized messages are pulled after delivery. Investigate senders with repeated ZAP removals as likely compromised or malicious accounts and block or restrict them. A rising ZAP trend can signal an active campaign that slipped past delivery-time filtering.\"},\"name\":\"teams zap banner\",\"id\":\"136cfb4e-d2a5-4db0-9771-6b6380011ba0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes Microsoft Teams post-delivery ZAP (zero-hour auto purge) activity by Microsoft Defender for Office 365 for the selected period.\\r\\nlet zap = materialize(MessagePostDeliveryEvents);\\r\\nunion\\r\\n(zap | summarize Count = count() | extend Details = \\\"Total ZAP Actions\\\", Ord = 1),\\r\\n(zap | where ActionType == \\\"Malware ZAP\\\" | summarize Count = count() | extend Details = \\\"Malware ZAP\\\", Ord = 2),\\r\\n(zap | where ActionType == \\\"Phish ZAP\\\" | summarize Count = count() | extend Details = \\\"Phish ZAP\\\", Ord = 3),\\r\\n(zap | where ActionResult == \\\"Success\\\" | summarize Count = count() | extend Details = \\\"Successful Actions\\\", Ord = 4),\\r\\n(zap | where ActionResult == \\\"Failed\\\" | summarize Count = count() | extend Details = \\\"Failed Actions\\\", Ord = 5),\\r\\n(zap | where Action == \\\"Moved to quarantine\\\" | summarize Count = count() | extend Details = \\\"Moved to Quarantine\\\", Ord = 6)\\r\\n| sort by Ord asc\\r\\n| project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams zap tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"06980411-5e6b-4aa4-a746-351cd2b12dae\"},{\"type\":1,\"content\":{\"json\":\"### ZAP actions over time<br>\\r\\n\\r\\n**Microsoft Teams post-delivery ZAP actions (per selected interval) split by Malware ZAP and Phish ZAP.**\"},\"customWidth\":\"66\",\"name\":\"teams zap trend header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"7fc1cfcd-3a9f-45b1-9f39-3820fce23c03\"},{\"type\":1,\"content\":{\"json\":\"### ZAP by action type<br>\\r\\n\\r\\n**Distribution of Microsoft Teams post-delivery ZAP actions by type.**\"},\"customWidth\":\"33\",\"name\":\"teams zap pie header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"9bc0d0a3-876a-49d7-9046-31764511ca38\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Microsoft Teams post-delivery ZAP actions over time by ZAP type, summarizing the data per selected interval.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(MessagePostDeliveryEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(MessagePostDeliveryEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(MessagePostDeliveryEvents\\r\\n| summarize MalwareZAP = countif(ActionType == \\\"Malware ZAP\\\"), PhishZAP = countif(ActionType == \\\"Phish ZAP\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, MalwareZAP = coalesce(MalwareZAP, 0), PhishZAP = coalesce(PhishZAP, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"66\",\"name\":\"teams zap trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c78a509e-324f-4a8c-b2e7-bce3e0d20667\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows Microsoft Teams post-delivery ZAP actions by type for the selected period.\\r\\nMessagePostDeliveryEvents\\r\\n| summarize Count = count() by ActionType\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"teams zap pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cfc94695-fb02-4b6c-a223-f79f7b947379\"},{\"type\":1,\"content\":{\"json\":\"### Top senders whose messages were removed by ZAP<br>\\r\\n\\r\\n**Senders whose Microsoft Teams messages were most often removed by post-delivery ZAP.**\"},\"customWidth\":\"100\",\"name\":\"teams zap senders header\",\"id\":\"f8677ffe-007a-41ca-81de-1ae5dd19d06a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 senders whose Microsoft Teams messages were removed by post-delivery ZAP for the selected period.\\r\\nMessagePostDeliveryEvents\\r\\n| where isnotempty(SenderEmailAddress)\\r\\n| summarize ZapActions = count(), MalwareZAP = countif(ActionType == \\\"Malware ZAP\\\"), PhishZAP = countif(ActionType == \\\"Phish ZAP\\\") by SenderEmailAddress\\r\\n| top 10 by ZapActions\\r\\n| project ['Sender']=SenderEmailAddress, ['ZAP Actions']=ZapActions, ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ZAP Actions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams zap senders table\",\"id\":\"50c9a883-6442-40dc-b84f-57adfbb46a38\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams ZAP\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"f5cc2425-e5ae-4520-9a97-2e4c2c447dcd\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Teams Message and Call Submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Teams messages and calls reported by users, and messages submitted by admins, for review by Microsoft. Sourced from the submission records in CloudAppEvents.<br><br>**Recommended action:** Encourage users to report suspicious Teams messages and calls so Microsoft can tune protection, and triage admin submissions promptly. A cluster of reports naming the same sender, display name, or call identity is an early signal of a targeted campaign: pivot those identities into the impersonation and risky-sender views above to scope it.\"},\"name\":\"teams sub banner\",\"id\":\"54cbfb29-2626-4b65-8cb5-a42ff4b41e63\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes Microsoft Teams message and call submissions reported to Microsoft for the selected period, split by user and admin reports. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\\r\\nlet sub = materialize(CloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType in (\\\"ChatMessage\\\", \\\"TeamsCall\\\"));\\r\\nunion\\r\\n(sub | where SubmissionContentType == \\\"ChatMessage\\\" and ActionType == \\\"UserSubmission\\\" | summarize Count = count() | extend Details = \\\"Messages Reported by Users\\\", Ord = 1),\\r\\n(sub | where SubmissionContentType == \\\"TeamsCall\\\" and ActionType == \\\"UserSubmission\\\" | summarize Count = count() | extend Details = \\\"Calls Reported by Users\\\", Ord = 2),\\r\\n(sub | where SubmissionContentType == \\\"ChatMessage\\\" and ActionType == \\\"AdminSubmission\\\" | summarize Count = count() | extend Details = \\\"Messages Submitted by Admins\\\", Ord = 3)\\r\\n| sort by Ord asc\\r\\n| project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams sub tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"419ed645-ebc1-4df1-b9f0-c744403ab494\"},{\"type\":1,\"content\":{\"json\":\"### Submissions over time<br>\\r\\n\\r\\n**Microsoft Teams user and admin submissions (per selected interval).**\"},\"customWidth\":\"66\",\"name\":\"teams sub trend header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"6a795b0a-82e2-427a-8ac0-abfb5bb5e447\"},{\"type\":1,\"content\":{\"json\":\"### Submission mix<br>\\r\\n\\r\\n**Microsoft Teams submissions split by content type (message or call) and reporter (user or admin).**\"},\"customWidth\":\"33\",\"name\":\"teams sub pie header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"1f4c55f8-7290-4b6f-b02a-e3134568b9ff\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Microsoft Teams message and call submissions over time, summarizing the data per selected interval. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\\r\\nlet gran = {Granularity};\\r\\nlet sub = materialize(CloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType in (\\\"ChatMessage\\\", \\\"TeamsCall\\\"));\\r\\nlet minTime = toscalar(sub | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(sub | summarize max(Timestamp));\\r\\nlet agg = materialize(sub\\r\\n| summarize UserReports = countif(ActionType == \\\"UserSubmission\\\"), AdminReports = countif(ActionType == \\\"AdminSubmission\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, UserReports = coalesce(UserReports, 0), AdminReports = coalesce(AdminReports, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"66\",\"name\":\"teams sub trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7dcb03da-de96-4388-90a4-0a3f3ca98dc6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the mix of Microsoft Teams submissions by content type and reporter for the selected period. Only completed user submissions (chat and call) and admin submissions (chat) are counted; submission triage/timeout lifecycle records are excluded.\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\"\\r\\n| where (SubmissionContentType == \\\"ChatMessage\\\" and ActionType == \\\"UserSubmission\\\")\\r\\n    or (SubmissionContentType == \\\"TeamsCall\\\" and ActionType == \\\"UserSubmission\\\")\\r\\n    or (SubmissionContentType == \\\"ChatMessage\\\" and ActionType == \\\"AdminSubmission\\\")\\r\\n| extend Reporter = iif(ActionType == \\\"AdminSubmission\\\", \\\"Admin\\\", \\\"User\\\")\\r\\n| summarize Count = count() by SubmissionType = strcat(SubmissionContentType, \\\" (\\\", Reporter, \\\")\\\")\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"teams sub pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"84a0141e-51de-4423-acb0-3c4342a49bf2\"},{\"type\":1,\"content\":{\"json\":\"### False Negative (FN) User Submissions by submission State<br>\\r\\n\\r\\n**Microsoft Teams messages reported by users as missed detections, broken down by submission state (for example Rescaned, Graded). Tracks the processing status of user reports.**\"},\"customWidth\":\"50\",\"name\":\"teams sub state header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"1b2bdffd-69b0-41b0-bdda-b242b7faaec0\"},{\"type\":1,\"content\":{\"json\":\"### False Negative (FN) User Submissions by Triage Verdict<br>\\r\\n\\r\\n**Microsoft Teams user submissions grouped by the verdict assigned during grading (for example Phishing, NotSpam, Spam). Shows how reported messages were graded and highlights detection gaps.**\"},\"customWidth\":\"50\",\"name\":\"teams sub verdict header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"bdb97e09-44d2-41ad-a99f-931e4a8169cc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows Microsoft Teams user (false negative) message submissions by submission state (for example Rescaned, Graded), to track processing status.\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend SubmissionState = tostring(RD.SubmissionState)\\r\\n| summarize Count = count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"teams sub state pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"139ce840-5fc2-44d1-9872-91b37a74f0e7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows Microsoft Teams user (false negative) message submissions by the triage verdict assigned during grading (for example Phishing, NotSpam, Spam).\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend TriageVerdict = tostring(parse_json(tostring(RD.GradingResult)).TriageVerdict)\\r\\n| where isnotempty(TriageVerdict)\\r\\n| summarize Count = count() by TriageVerdict\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"teams sub verdict pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"538ce4a3-a1ff-4b8d-a466-2173edbb2cd7\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 P2 sender domains in FN User Submissions<br>\\r\\n\\r\\n**The sender domains most often reported by users as missed Microsoft Teams threats. High-volume domains are candidate sources of malicious messaging.**\"},\"customWidth\":\"50\",\"name\":\"teams sub domains header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"9b8db0c7-2bf2-4077-ae20-60146001bf23\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 individual P2 senders in FN User Submissions<br>\\r\\n\\r\\n**The individual senders most often reported by users as missed Microsoft Teams threats.**\"},\"customWidth\":\"50\",\"name\":\"teams sub senders header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"ffbe90ab-129c-47fa-9dac-50cab528ad55\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 P2 (envelope) sender domains of Microsoft Teams messages reported by users as false negatives (missed detections).\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend P2SenderDomain = tostring(RD.P2SenderDomain)\\r\\n| where isnotempty(P2SenderDomain)\\r\\n| summarize Submissions = count() by ['P2 Sender Domain']=P2SenderDomain\\r\\n| top 10 by Submissions\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"50\",\"name\":\"teams sub domains table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b18192fb-26a8-4bd1-9b07-7aeab496eae3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 individual P2 (envelope) senders of Microsoft Teams messages reported by users as false negatives (missed detections).\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend P2Sender = tostring(RD.P2Sender)\\r\\n| where isnotempty(P2Sender)\\r\\n| summarize Submissions = count() by ['P2 Sender']=P2Sender\\r\\n| top 10 by Submissions\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"50\",\"name\":\"teams sub senders table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7ead0a01-2b56-4225-b625-554b09350013\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 users performing the most FN User Submissions<br>\\r\\n\\r\\n**The users who report the most Microsoft Teams messages as missed detections - useful for recognising engaged reporters and spotting over-reporting.**\"},\"customWidth\":\"50\",\"name\":\"teams sub topusers header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"fb893cdd-d6d3-431a-a1d2-87652571a10d\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 admins performing the most FN Admin Submissions<br>\\r\\n\\r\\n**The admins who submit the most Microsoft Teams messages as missed detections.**\"},\"customWidth\":\"50\",\"name\":\"teams sub topadmins header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"14fca69b-e152-4a5d-bd2c-020c34c2226a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 users who reported the most Microsoft Teams messages as false negatives (missed detections), with each submitter's email (from the submission record) to disambiguate users with similar names.\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterEmail = tostring(RD.UserId)\\r\\n| where isnotempty(Submitter) and SubmitterEmail has \\\"@\\\"\\r\\n| summarize Submissions = count() by ['Submitter']=Submitter, ['Email']=SubmitterEmail\\r\\n| top 10 by Submissions\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"name\":\"teams sub topusers table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a171a35b-35b0-46ce-a916-052a54101126\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 admins who submitted the most Microsoft Teams messages as false negatives (missed detections). The admin's own email is not present in the submission record (that would require the Identity table), so the Submitter ID (object GUID) is shown to disambiguate admins with similar names.\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"AdminSubmission\\\"\\r\\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterId = tostring(RD.SubmitterId)\\r\\n| where isnotempty(Submitter)\\r\\n| summarize Submissions = count() by ['Admin']=Submitter, ['Submitter ID']=SubmitterId\\r\\n| top 10 by Submissions\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"name\":\"teams sub topadmins table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8bf37c2b-067a-4341-a192-2aa45699c3f7\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Submissions\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"eeea53a4-69d9-426e-bf9f-1789cd73bfed\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Recent Threat Detail\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThe most recent Microsoft Teams phishing and malware messages, de-duplicated to the latest record per message, for investigation.\"},\"name\":\"teams detail banner\",\"id\":\"4bdd917c-721f-450b-b455-45cbd5f59cc5\"},{\"type\":1,\"content\":{\"json\":\"### Last 10 Teams phishing messages<br>\\r\\n\\r\\n**Most recent Microsoft Teams messages detected as phishing, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**\"},\"customWidth\":\"100\",\"name\":\"teams detail phish header\",\"id\":\"9bcf96c1-a958-4515-b171-10ec2f3ba660\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\\r\\nMessageEvents\\r\\n| where ThreatTypes has \\\"Phish\\\"\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| top 10 by Timestamp desc\\r\\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams detail phish table\",\"id\":\"3675d08f-1165-4f47-a633-e432cf96e3d5\"},{\"type\":1,\"content\":{\"json\":\"### Last 10 Teams malware messages<br>\\r\\n\\r\\n**Most recent Microsoft Teams messages detected as malware, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**\"},\"customWidth\":\"100\",\"name\":\"teams detail mal header\",\"id\":\"6b9d66d2-8d89-47b0-a72a-5ee8623082dc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\\r\\nMessageEvents\\r\\n| where ThreatTypes has \\\"Malware\\\"\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| top 10 by Timestamp desc\\r\\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams detail mal table\",\"id\":\"d6e76d0a-7eee-4c05-8e92-10f9622b5ab3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Detail\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"1e9c879b-d6be-4d36-9068-b5438abf7dd2\"},{\"type\":1,\"content\":{\"json\":\"# Top Attacked Users, Top Senders, and Automatic External Email Forwarding\\r\\n\\r\\n---\\r\\nThis tab provides insights into **Top attacked users, Top Senders** in inbound email messages and details about **automatic external email forwarding**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"6\"},\"name\":\"text - 24 - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f1a60054-44b1-432e-be7a-9d7d114ff5c7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Top Attacked Users and Top Senders Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides key visuals that highlight top attacked users – individuals most frequently targeted by inbound email threats as detected by Microsoft Defender for Office 365. Offers insights into top email senders and sender domains across inbound email traffic, helping identify patterns and potential risk sources.<br><br>**Recommended action:** Apply the Strict preset to the most-attacked users and review the top sender domains as possible block-list candidates.\"},\"name\":\"text - 13 - Copy - Copy\",\"id\":\"ff220902-30b8-4aef-9b79-14c913a1b2d2\"},{\"type\":1,\"content\":{\"json\":\"### Top Attacked Users<br>\\r\\n\\r\\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam, Phishing, or Malware. Helps identify high-risk users for targeted security awareness and policy enforcement.**\"},\"name\":\"text - 13 - Copy - Copy - Copy\",\"id\":\"58f34b9f-824d-4fcf-b2aa-d7d380aa08d5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 users that are receiving Spam, Phishing or Malware emails\\r\\nEmailEvents \\r\\n| where  OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\" and EmailDirection ==\\\"Inbound\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods) \\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \\\"Malware\\\"),PhishEmailCount = countif(FirstDetection ==  \\\"Phish\\\"),SpamEmailCount = countif(FirstDetection ==  \\\"Spam\\\") by RecipientEmailAddress\\r\\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| top 15 by ThreatEmailCount\\r\\n| project ['Recipient']=RecipientEmailAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Threat Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Malware\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Threat Emails_2\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Threat Emails_2\",\"sortOrder\":2}],\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"100\",\"name\":\"query - 28\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e9459e78-6b43-4ef2-9596-32169d95c610\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Senders of Inbound Emails<br>\\r\\n\\r\\n**Displays the top 10 sender email addresses from external sources delivering inbound emails. Helps identify high-volume external senders for monitoring and policy enforcement.**\"},\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"id\":\"eb4590a7-57c7-4728-af62-3d798afe6f2d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 senders by inbound email sending volume\\r\\nEmailEvents \\r\\n| where  OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\" and EmailDirection ==\\\"Inbound\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods) \\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \\\"Malware\\\"),PhishEmailCount = countif(FirstDetection ==  \\\"Phish\\\"),SpamEmailCount = countif(FirstDetection ==  \\\"Spam\\\") by SenderFromAddress\\r\\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| top 15 by TotalEmailCount\\r\\n| project ['Sender']=SenderFromAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Threat Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Malware\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20}}],\"filter\":true},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"100\",\"name\":\"query - 28 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e4272979-1073-4c1e-9b1b-b971bc3efc33\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains of Inbound Emails<br>\\r\\n\\r\\n**Displays the top 10 sender domains from external sources delivering inbound emails. Helps identify high-volume external sender domains for monitoring and policy enforcement.**\"},\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"id\":\"7ab63415-17ce-47f1-a614-e5e6edbe472e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 senders by inbound email sending volume\\r\\nEmailEvents \\r\\n| where  OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\" and EmailDirection ==\\\"Inbound\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods) \\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \\\"Malware\\\"),PhishEmailCount = countif(FirstDetection ==  \\\"Phish\\\"),SpamEmailCount = countif(FirstDetection ==  \\\"Spam\\\") by SenderFromDomain\\r\\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| top 15 by TotalEmailCount\\r\\n| project ['Sender Domain']=SenderFromDomain, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Threat Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Malware\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20}}],\"filter\":true},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"100\",\"name\":\"query - 28 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b593da94-b735-4fe3-a82d-18c90156e506\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"6\"},\"name\":\"group - 10-Top attacked users and top senders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"3e41cc1a-166e-4094-bc66-7e26a918b2e9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Automatic External Email Forwarding Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Email forwarding can be useful, but can also pose a security risk due to the potential disclosure of information.**\\r\\n<br>\\r\\n\\r\\nUsers can configure [<b>Inbox rules</b>](https://support.microsoft.com/en-US/Outlook/mail/use-rules-to-automatically-forward-messages) in Outlook or set up [<b>SMTP forwarding</b>](https://support.microsoft.com/en-us/office/turn-on-automatic-forwarding-in-outlook-7f2670a1-7fff-4475-8a3c-5822d63b0c8e) to automatically forward messages to external recipients. You can control automatic external email forwarding from cloud mailboxes using [<b>Outbound spam policies</b>](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding) in Microsoft Defender for Office 365. \\r\\n**Attackers might exploit this capability to compromise your organization or its partners.**<br><br>**Recommended action:** Investigate external auto-forwarding - it is a common data-exfiltration path. Consider disabling auto-forwarding via the outbound spam policy unless a business case is documented.\"},\"name\":\"text - 8\",\"id\":\"b04d1590-98e3-4650-9172-33e75561e1e5\"},{\"type\":1,\"content\":{\"json\":\"### Automatic Email Forwarding by Type<br>\\r\\n\\r\\n**Displays counts of outbound emails automatically forwarded to external addresses, grouped by forwarding type (e.g., SMTP forwarding, inbox rules). Helps identify forwarding behaviors that may pose data exfiltration risks.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c7cb7917-eaf4-4a1e-989a-75f4b6182851\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Internal Users Forwarding Emails Externally<br>\\r\\n\\r\\n**Displays the top 10 internal user accounts that have automatically forwarded emails to external addresses (regardless of the forwarding type used). Helps identify potential data exfiltration risks and enforce forwarding policies.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5a5d5a8c-c195-45db-a878-e6ac908cc919\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises automatic email forwarding to external email addresses by forwarding type\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| summarize count() by ForwardingType\\r\\n| sort by count_ desc \\r\\n\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"15094d98-add2-4b50-a0df-ee91fd34c6fb\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| summarize TotalForwardedMessages = count() by ForwardingUser\\r\\n| sort by TotalForwardedMessages desc \\r\\n| top 10 by TotalForwardedMessages\\r\\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"TotalForwardedMessages\"]}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"73d66038-2ea0-449d-9aeb-a1bd4b207d7f\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Internal Users Forwarding Emails Using Mailbox Rules<br>\\r\\n\\r\\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9a7b5fc3-da23-4e95-87df-542a5e3f6320\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using Mailbox Rules\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| where ForwardingType ==\\\"MbxRule\\\"\\r\\n| summarize TotalForwardedMessages = count() by ForwardingUser\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"TotalForwardedMessages\"]}},\"customWidth\":\"100\",\"name\":\"query - 30 - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f8d7b85d-944a-493f-a143-7e18277846c9\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 External domains Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\\r\\n\\r\\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cda99a50-b7c4-4d95-ac61-7231080a3f5d\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 External Recipients Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\\r\\n\\r\\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"72b01575-c33e-457c-98db-ea755c003bf0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 external domains who are recieving automatically forwarded emails using Mailbox Rules\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \\\"@\\\")[1])\\r\\n| where ForwardingType ==\\\"MbxRule\\\"\\r\\n| summarize TotalForwardedMessages = count() by RecipientDomain\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"823dec28-48b5-4be3-8e68-04301a952a62\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using Mailbox Rules\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| where ForwardingType ==\\\"MbxRule\\\"\\r\\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"14804990-bfc9-43b7-8c8d-95c2cf32ee56\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Internal Users Forwarding Emails via SMTP Forwarding<br>\\r\\n\\r\\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fa04b313-5756-4ff7-9ee8-ec61e6b382cc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using SmtpForwarding\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| where ForwardingType ==\\\"SmtpForwarding\\\"\\r\\n| summarize count() by ForwardingUser\\r\\n| top 10 by count_ desc\\r\\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=count_\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 30 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"bed8e717-4ea7-4f71-aaa7-b70a31f4dc88\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 External domains receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\\r\\n\\r\\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f76bc717-3cf8-4d8d-92fa-3f2024065f8f\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 External Recipients Receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\\r\\n\\r\\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"2190c799-ab4f-4bd8-87e1-f9c5c224cca4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \\\"@\\\")[1])\\r\\n| where ForwardingType ==\\\"SmtpForwarding\\\"\\r\\n| summarize TotalForwardedMessages = count() by RecipientDomain\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c3be87b3-8ce8-40f2-ad92-0651bed71117\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| where ForwardingType ==\\\"SmtpForwarding\\\"\\r\\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fb6b0113-f5bb-46a7-994b-92ebc3c7881d\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"6\"},\"name\":\"group - 34 - Automatic email forwarding\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"02c91ebb-4f92-4843-a73b-6dea7a6ac2bd\"},{\"type\":1,\"content\":{\"json\":\"# Email detection action overrides\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into admin or end-user configured **detection overrides** where the message was detected as a threat by Microsoft Defender for Office 365, however an admin-configured policy or end-user setting overrode the detection action.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/understand-overrides-in-email-entity) \"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"text - 13 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"ae594968-00b9-40b8-b5dd-052a27440afb\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Admin configured Detection Overrides (Allow)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track emails subject to administrator policies (e.g., Transport Rules, Tenant Allow/Block List) with an \\\"Allow\\\" action, overriding Microsoft Defender for Office 365 detections (excluding SecOps Mailbox overrides).<br><br>**Recommended action:** Review Allow overrides that later carried threats and remove stale or overly broad allow entries - they weaken protection.\"},\"name\":\"text - AdminOverridesAllowHeader\",\"id\":\"3d70a304-c590-4156-a6d4-da147fe106ab\"},{\"type\":1,\"content\":{\"json\":\"### Admin Overrides (Allow) Trend\\r\\n**Displays the count (per {Granularity}) of emails where an administrator policy with an \\\"Allow\\\" action overrode detections (excluding SecOps Mailbox). Helps track the frequency of admin overrides over time.**\"},\"name\":\"text - AdminOverridesAllowTrend\",\"id\":\"a4ee104a-a0a1-4725-a60f-deedcc91af70\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to an admin policy with action of allow independent of action taken, summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Admin Overrides\",\"color\":\"blueDark\"}]}},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"79928e9e-48ed-4d08-8ff7-c21fe027550e\"},{\"type\":1,\"content\":{\"json\":\"### Total Emails by Admin Override type (Allow)\\r\\n**Summarizes the total count of emails subject to administrator policies with an \\\"Allow\\\" action, grouped by the type of override. Helps identify which policies are most frequently allowing emails.**\"},\"customWidth\":\"50\",\"name\":\"text - AdminOverridesAllowByType\",\"id\":\"855fce09-2000-4d16-8521-8b4eeddfae00\"},{\"type\":1,\"content\":{\"json\":\"### Admin Overrides (Allow) by Override Type and Threat Type\\r\\n**Details the count of emails allowed by administrator policies, categorized by the override type and the detected threat type. Helps assess the risk associated with allowed emails.**\"},\"customWidth\":\"50\",\"name\":\"text - AdminOverridesAllowByTypeAndThreat\",\"id\":\"a2613078-b427-4b23-aca0-21989b1944db\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by OrgLevelPolicy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 16\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b21a0329-8f52-45c2-81f2-6df65c134673\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override and threats type found\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"0bf4cbe6-7c84-49d4-801c-d955762b5699\"},{\"type\":1,\"content\":{\"json\":\"### SecOps Mailbox Overrides (Allow)\\r\\nThis section focuses on emails allowed specifically due to the SecOps Mailbox override policy, typically used for investigation and analysis.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/advanced-delivery-policy-configure) \"},\"name\":\"text - SecOpsOverridesHeader\",\"id\":\"f582dc86-4c40-4cdd-ba0b-ec6ef8820a27\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to the \\r\\nEmailEvents \\r\\n| where OrgLevelPolicy==\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by OrgLevelPolicy\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"auto\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8ad2fea4-dcd0-454e-a4d4-b5275c86fd9b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails delivered to the SecOps Mailbox by threat type\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy==\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":1,\"showAnalytics\":true,\"title\":\" \",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"52c04df2-69b5-46e4-a000-7c6d212a132a\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 15 - Admin Detection Overrides - Allow\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"9b9baf2f-fd5f-41b6-8368-b515f8de4fd4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Admin configured Detection Overrides (Block)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into email messages blocked by administrative policies (e.g. Tenant allow/block list, Antimalware policy file type block), overriding detection actions defined by Microsoft Defender for Office 365.<br><br>**Recommended action:** Confirm these blocks are still needed and consolidate them into the Tenant Allow/Block List where appropriate.\"},\"name\":\"text - AdminOverridesBlockHeader\",\"id\":\"6157683b-cce7-4165-886f-0da73e25ce86\"},{\"type\":1,\"content\":{\"json\":\"### Admin Overrides (Block) Trend\\r\\n**Displays the count (per {Granularity}) of emails where an administrator policy with a \\\"Block\\\" action overrode detections. Helps track the frequency of admin blocks over time.**\"},\"name\":\"text - AdminOverridesBlockTrend\",\"id\":\"699820b4-a984-45cc-ab2f-607c3c8569d4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \\\"Block\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Admin Overrides\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - 5\",\"styleSettings\":{\"margin\":\"10\",\"padding\":\"10\"},\"id\":\"9ef5e7fb-843e-439b-b4f3-9b0bb149e74b\"},{\"type\":1,\"content\":{\"json\":\"### Total Emails by Admin Override Type (Block)\\r\\n**Summarizes the total count of emails subject to administrator policies with a \\\"Block\\\" action, grouped by the type of override.**\"},\"customWidth\":\"50\",\"name\":\"text - AdminOverridesBlockByType\",\"id\":\"5694a7c0-1ee5-40b4-ae2b-263d189c4b4e\"},{\"type\":1,\"content\":{\"json\":\"### Admin Overrides (Block) by Override Type and Threat Type\\r\\n**Details the count of emails blocked by administrator policies, categorized by the override type and the detected threat type.**\"},\"customWidth\":\"50\",\"name\":\"text - AdminOverridesBlockByTypeAndThreat\",\"id\":\"6e309742-37c0-4ad5-9b9a-63643059bfaf\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to an admin policy with action of block, summarizing the data by type of override\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \\\"Block\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by OrgLevelPolicy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"eabc80ed-d0e9-43d2-ab13-a5af478f11c8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data by type of override and threats type found\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \\\"Block\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 7\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1661bfa6-d8fd-4387-a334-1bc027a3f6d1\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 36-Admin Detection Overrides - Block\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"7d514e9a-f67f-45a6-ba1b-6492348cc18b\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">User configured Detection Overrides (Allow)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track email messages subject to user policies (e.g. [Safe Senders list defined in Outlook](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365#use-outlook-safe-senders)) with an \\\"Allow\\\" action, overriding Microsoft Defender for Office 365 detections.<br><br>**Recommended action:** Educate users that safe-sender allows can bypass protection; review high-risk user allow entries.\"},\"name\":\"text - UserOverridesAllowHeader\",\"id\":\"4d41c560-0e73-40c5-b610-33e9500e88c4\"},{\"type\":1,\"content\":{\"json\":\"### User Overrides (Allow) Trend\\r\\n**Displays the count (per {Granularity}) of emails where a user policy with an \\\"Allow\\\" action overrode detections. Helps track the frequency of user overrides over time.**\"},\"name\":\"text - UserOverridesAllowTrend\",\"id\":\"9432efff-9f03-4d74-8781-02be8b2d07fa\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"User Overrides\",\"color\":\"blueDark\"}]}},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"02da1d33-e477-479d-bdd3-95ab1ad7c75c\"},{\"type\":1,\"content\":{\"json\":\"### Total Emails by User Override Type (Allow)\\r\\n**Summarizes the total count of emails subject to user policies with an \\\"Allow\\\" action, grouped by the type of override.**\"},\"customWidth\":\"50\",\"name\":\"text - UserOverridesAllowByType\",\"id\":\"006a2e87-b1b6-4cc3-a763-ceebaa86b340\"},{\"type\":1,\"content\":{\"json\":\"### User Overrides (Allow) by Override Type and Threat Type\\r\\n**Details the count of emails allowed by user policies, categorized by the override type and the detected threat type. Helps assess the risk associated with user-allowed emails.**\"},\"customWidth\":\"50\",\"name\":\"text - UserOverridesAllowByTypeAndThreat\",\"id\":\"7c34bb4b-46c0-4054-9596-3dfd010bb036\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override\\r\\nEmailEvents \\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Allow\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by UserLevelPolicy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 16\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d1d9021d-e6bf-47b1-bdd2-438a212d2767\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found\\r\\nEmailEvents \\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Allow\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1acd913c-c945-4a58-b04e-d008ca53ffe3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 15 - User Detection Overrides - Allow\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"c939060e-6a8b-49ff-951b-a3abddbd9fb4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">User configured Detection Overrides (Block)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into emails blocked by user-configured policies (e.g., [Blocked Senders list in Outlook](https://support.microsoft.com/en-us/office/block-or-unblock-senders-in-outlook-9bf812d4-6995-4d19-901a-76d6e26939b0)).<br><br>**Recommended action:** Use user block trends to identify unwanted senders that may warrant tenant-wide blocking.\"},\"name\":\"text - UserOverridesBlockHeader\",\"id\":\"be6c6a3e-08ee-47c5-b8e7-6a1078dd17d1\"},{\"type\":1,\"content\":{\"json\":\"### User Overrides (Block) Trend\\r\\n**Displays the count (per {Granularity}) of emails where a user policy with a \\\"Block\\\" action overrode detections. Helps track the frequency of user blocks over time.**\"},\"name\":\"text - UserOverridesBlockTrend\",\"id\":\"7cd77d54-2e2b-4d23-a6a9-4bd6bca2642a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Block\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"User Overrides\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - 5\",\"styleSettings\":{\"margin\":\"10\",\"padding\":\"10\"},\"id\":\"0b21b66c-001d-4b3d-b47f-f3a420ccaaf8\"},{\"type\":1,\"content\":{\"json\":\"### Total Emails by User Override Type (Block)\\r\\n**Summarizes the total count of emails subject to user policies with a \\\"Block\\\" action, grouped by the type of override.**\"},\"customWidth\":\"50\",\"name\":\"text - UserOverridesBlockByType\",\"id\":\"fd513501-5e9d-45d9-9d0d-cd546002b8cf\"},{\"type\":1,\"content\":{\"json\":\"### User Overrides (Block) by Override Type and Threat Type\\r\\n**Details the count of emails blocked by user policies, categorized by the override type and the detected threat type.**\"},\"customWidth\":\"50\",\"name\":\"text - UserOverridesBlockByTypeAndThreat\",\"id\":\"4fbfa876-47ed-4c3b-81ee-1c40b982cecd\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to a user type policy with action of block, summarizing the data by type of override\\r\\nEmailEvents \\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Block\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by UserLevelPolicy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d3fccaa6-80fd-419d-bb37-aedf67263419\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data by type of override and threats type found\\r\\nEmailEvents \\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Block\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 7\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e5e74ce1-fa67-45ea-bc80-97237342e370\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 37-User Detection Overrides - Block\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"0c1d327a-c2f1-4b9b-b210-53c808b53b48\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">User &amp; Sender Override Detail (Allow)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nInbound messages that Microsoft Defender for Office 365 **detected as threats but delivered anyway** because of an admin- or user-configured **Allow** override (phishing-simulation and SecOps Mailbox traffic excluded). **Total Threats** is all detected threats to that recipient / sender domain in the selected range; **Overridden Threats** and **Override %** are the portion delivered due to an Allow override, and **Override Types** names the specific overrides responsible. **User-configured** overrides come from the recipient's own mailbox junk-email settings in Outlook / Outlook on the web (the mailbox \\\"safelist collection\\\") &mdash; the **Safe Senders** and **Safe Recipients** lists and **trusted contacts** (\\\"Also trust email from my Contacts\\\"). **Admin-configured** overrides come from the **Tenant Allow/Block List, Exchange mail flow (transport) rules, the IP Allow List, or allowed sender/domain lists in anti-spam policies**. Use this to spot users or domains where overrides are letting threats through &mdash; candidates for policy review or a Tenant Allow/Block List (TABL) block.<br><br>**Recommended action:** Focus on the users and sender domains with the most allow overrides - these are the biggest protection gaps.\"},\"name\":\"Overrides - User Detail Header\",\"id\":\"3b0e83f3-f340-4b95-85c5-831783e8abc2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top recipients receiving threats that were delivered due to an admin or user override, with the share of their threats that were overridden and a breakdown of which override types caused them.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend OverrideType = case(\\r\\n    OrgLevelAction == \\\"Allow\\\" and OrgLevelPolicy != \\\"\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\", OrgLevelPolicy,\\r\\n    UserLevelAction == \\\"Allow\\\", strcat(\\\"User: \\\", UserLevelPolicy),\\r\\n    \\\"(none)\\\")\\r\\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\\r\\n| summarize TotalThreats = sum(PerType),\\r\\n            OverriddenThreats = sumif(PerType, OverrideType != \\\"(none)\\\"),\\r\\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \\\" (\\\", PerType, \\\")\\\"), OverrideType != \\\"(none)\\\"), \\\"; \\\")\\r\\n        by RecipientEmailAddress\\r\\n| where OverriddenThreats > 0\\r\\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\\r\\n| top 15 by OverriddenThreats\\r\\n| project ['Recipient']=RecipientEmailAddress, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Overridden Threats\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Override %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}]},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"StatisticName\",\"sourceIdField\":\"Value\",\"targetIdField\":\"Value\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"hivesMargin\":5}},\"name\":\"Overrides - Top Users\",\"id\":\"d7e169a2-808a-4bbf-86ee-5be561c690f7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top sender domains sending threats to users, with the share of those threats that were delivered because of an admin or user override and a breakdown of which override types caused them. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend OverrideType = case(\\r\\n    OrgLevelAction == \\\"Allow\\\" and OrgLevelPolicy != \\\"\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\", OrgLevelPolicy,\\r\\n    UserLevelAction == \\\"Allow\\\", strcat(\\\"User: \\\", UserLevelPolicy),\\r\\n    \\\"(none)\\\")\\r\\n| summarize PerType = count() by SenderFromDomain, OverrideType\\r\\n| summarize TotalThreats = sum(PerType),\\r\\n            OverriddenThreats = sumif(PerType, OverrideType != \\\"(none)\\\"),\\r\\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \\\" (\\\", PerType, \\\")\\\"), OverrideType != \\\"(none)\\\"), \\\"; \\\")\\r\\n        by SenderFromDomain\\r\\n| where OverriddenThreats > 0\\r\\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\\r\\n| top 10 by OverriddenThreats\\r\\n| project ['Sender Domain']=SenderFromDomain, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Overridden Threats\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Override %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}]},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"StatisticName\",\"sourceIdField\":\"Value\",\"targetIdField\":\"Value\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"hivesMargin\":5}},\"name\":\"Overrides - Top Sender Domains\",\"id\":\"0eda3153-10ea-4d4e-80ca-7e5ad99e9883\"}]},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"Overrides - User & Sender Detail\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"d5f38e54-a3c7-4df6-b569-bbabe85e1a36\"},{\"type\":1,\"content\":{\"json\":\"# False Negative(FN) Submissions insights\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into email message **False Negative(FN) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message reported to have **Malware, Phish or Spam threat** within its **content, URLs or attachments**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"8\"},\"name\":\"text - 13 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3b243dca-89ce-41e6-bccb-9ceb0953aa2e\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">False Negative(FN) Admin submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into email message **False Negative(FN) Submissions performed by administrators** in Microsoft Defender for Office 365 where the message reported to have Malware, Phish or Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Prioritise admin-submitted misses for policy tuning; recurring sender domains may be block-list candidates.\"},\"name\":\"fn admin - section header\",\"id\":\"64420254-0dae-4495-bd55-fc49e5bc1ed0\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions per-{Granularity} trend by submission types \\r\\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment). Helps to monitor where detections were missed and later submitted by admins as false negatives to Microsoft.**\"},\"name\":\"fn admin - trend heading\",\"id\":\"5f2de929-6f32-4079-a031-cbf689c15b29\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of admin false negative submission by submission type.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(CloudAppEvents\\r\\n| where ActionType contains \\\"Submission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| summarize Admin_Malware_FN=countif(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"), Admin_Phish_FN=countif(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"), Admin_Spam_FN=countif(SubmissionType == \\\"0\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"), Admin_Malware_URL_FN=countif(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\"), Admin_Malware_Attach_FN=countif(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\"), Admin_Phish_URL_FN=countif(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\"), Admin_Phish_Attach_FN=countif(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Malware (Mail)']=coalesce(Admin_Malware_FN,0), ['Phish (Mail)']=coalesce(Admin_Phish_FN,0), ['Spam (Mail)']=coalesce(Admin_Spam_FN,0), ['Malware (URL)']=coalesce(Admin_Malware_URL_FN,0), ['Malware (Attachment)']=coalesce(Admin_Malware_Attach_FN,0), ['Phish (URL)']=coalesce(Admin_Phish_URL_FN,0), ['Phish (Attachment)']=coalesce(Admin_Phish_Attach_FN,0) | sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalAdminSubmissions\",\"color\":\"redDark\"},{\"seriesName\":\"Phish (Mail)\",\"color\":\"redBright\"},{\"seriesName\":\"Spam (Mail)\",\"color\":\"orange\"},{\"seriesName\":\"Malware (Mail)\",\"color\":\"redDark\"},{\"seriesName\":\"Phish (URL)\",\"color\":\"purple\"},{\"seriesName\":\"Malware (Attachment)\",\"color\":\"yellowDark\"},{\"seriesName\":\"Phish (Attachment)\",\"color\":\"purpleDark\"},{\"seriesName\":\"Malware (URL)\",\"color\":\"yellow\"}]}},\"name\":\"fn admin - submissions trend\",\"id\":\"1b61155b-92a1-4533-9561-2e85e9a4dbf8\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions by submission types \\r\\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment).**\"},\"customWidth\":\"50\",\"name\":\"fn admin - by-type heading\",\"id\":\"bbaa9ff9-a95d-495a-a44c-6b4cae888a24\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions by submission State\\r\\n**Displays the total count of False Negative(FN) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**\"},\"customWidth\":\"50\",\"name\":\"fn admin - by-state heading\",\"id\":\"b060c706-342a-4b2e-b81a-920bf4d8c5d9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false negative submission by submission type.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"Submission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| extend Admin_SubmissionType=\\r\\niff(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Malware (Mail)\\\",\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\r\\niff(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\",\\\"Malware (URL)\\\",\\r\\niff(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\",\\\"Malware (Attachment)\\\",\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\",\\\"Phish (URL)\\\",\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\",\\\"Phish (Attachment)\\\",\\r\\n\\\"Other\\\")))))))\\r\\n| where Admin_SubmissionType!=\\\"Other\\\"\\r\\n| summarize count() by Admin_SubmissionType\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"fn admin - by-type pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9d9d714a-357b-4ac3-bcb7-33601d3c3108\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false negative submissions by the state of the submission.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"AdminSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType in (\\\"0\\\",\\\"1\\\",\\\"2\\\")\\r\\n| summarize count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn admin - by-state pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"169f0f1c-1f1e-44fb-965e-850733f01879\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN)/False Positive(FP) Admin Submissions by Triage Verdict\\r\\n**Displays the total count of False Negative(FN)/False Positive(FP) Admin Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**\"},\"customWidth\":\"50\",\"name\":\"fn admin - triage-verdict heading\",\"id\":\"3df841be-c1b0-4d61-8e38-316a34a48bd1\"},{\"type\":1,\"content\":{\"json\":\"### Top Admins Submitting False Negatives \\r\\n**Displays the top 15 admin accounts that submitted the highest number of false negative messages (missed detections) via AdminSubmission. Helps identify key contributors to threat remediation and potential patterns in detection gaps.**\"},\"customWidth\":\"50\",\"name\":\"fn admin - top-admins heading\",\"id\":\"e1e966f4-1f4d-4377-97c6-e2077fc0b8fa\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false negative or false positive submissions by the verdict of the submission grading.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"AdminSubmissionTriage\\\" \\r\\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \\r\\n| summarize count() by tostring(TriageVerdict)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn admin - triage-verdict pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6df0db72-f9db-444e-856a-4369921d199b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top admins performing false negative submissions\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \\r\\n| where Record == 29 and SubmissionType in (\\\"0\\\",\\\"1\\\",\\\"2\\\")\\r\\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\\r\\n| top 15 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fn admin - top-admins pie\",\"id\":\"b5ccb4a1-9783-47cf-bf21-ded924f1a200\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions by Top Sender Domains\\r\\n**For each top sender domain that admins reported missed threats for, shows the domain's MDO-detected threat profile (emails with threats and the Malware/Phish/Spam breakdown), the count of admin FN submissions, and the submission rate (Admin Submission % = admin submissions / total inbound from the domain). A high rate can flag a domain whose mail is frequently reported as missed.**\"},\"customWidth\":\"100\",\"name\":\"fn admin - top-sender-domains heading\",\"id\":\"1a481c97-ac85-4b62-a86d-51b33b5a8e68\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 sender domains that admins reported false negatives (missed threats) for, with each domain's MDO-detected threat profile for context.\\r\\nlet subs = CloudAppEvents\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"2\\\",\\\"1\\\",\\\"0\\\")\\r\\n| summarize AdminSubmissions=count() by P2SenderDomain;\\r\\nlet domainProfile = EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalInbound=count(), EmailsWithThreats=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \\\"Malware\\\"), Phish=countif(ThreatTypes has \\\"Phish\\\"), Spam=countif(ThreatTypes has \\\"Spam\\\") by SenderFromDomain;\\r\\nsubs\\r\\n| join kind=leftouter (domainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\\r\\n| extend AdminSubmissionPct = round(AdminSubmissions * 100.0 / todouble(coalesce(TotalInbound, AdminSubmissions)), 2)\\r\\n| top 10 by AdminSubmissions desc\\r\\n| project ['Sender Domain']=P2SenderDomain, ['Emails With Threats']=coalesce(EmailsWithThreats,0), ['Malware']=coalesce(Malware,0), ['Phish']=coalesce(Phish,0), ['Spam']=coalesce(Spam,0), ['Admin Submissions']=AdminSubmissions, ['Admin Submission %']=AdminSubmissionPct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails With Threats\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Malware\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Admin Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"120px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Admin Submission %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"110px\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn admin - top-sender-domains table\",\"id\":\"e56bed92-b0fb-4b76-90f3-169f4206418b\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions by admin Detection override types\\r\\n**Displays the top 10 cases where emails were submitted as false negatives by admins, even though they were initially detected by Microsoft Defender for Office 365 but delivered due to an admin policy override. Includes details on PolicyOverride, PolicySource, and DetectionVerdict for deeper insight into override behaviour.**\"},\"customWidth\":\"100\",\"name\":\"fn admin - override-types heading\",\"id\":\"293c174c-0197-4cf8-bbce-36fe42e5cf1b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was a admin policy override\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| extend Admin_SubmissionType=\\r\\niff(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Malware (Mail)\\\",\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\"))),\\r\\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"2\\\",\\\"1\\\",\\\"0\\\") and PolicyOverride !=\\\"NoOverride\\\"\\r\\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\\r\\n| top 10 by count_ desc\\r\\n| project ['Policy Override']=PolicyOverride, ['Override Source']=PolicyPolicyOverrideType, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn admin - override-types table\",\"id\":\"97799422-53e0-4e3b-8103-297fd1c744eb\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"8\"},\"name\":\"group - 11-Fn Admin Submissions\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"45a1c185-4fbf-4e83-832e-1f20af427796\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">False Negative(FN) User submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into email message **False Negative(FN) Submissions performed by end users** in Microsoft Defender for Office 365 where the message reported as having Phish, Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Recognise engaged reporters, coach over-reporters, and use graded phishing verdicts to tune anti-phishing policy.\"},\"name\":\"fn user - section header\",\"id\":\"ca0b48e6-8bd8-4f99-956a-f9c72cc870db\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions per-{Granularity} trend by submission types \\r\\n**Displays counts (per {Granularity}) of False Negative(FN) User Submissions grouped by submission type (Spam, Phish and Attack simulations) . Helps to monitor where detections were missed and later submitted by users as false negatives.**\"},\"name\":\"fn user - trend heading\",\"id\":\"60ac8608-7875-45e6-8c83-e6bd0c34af8b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(CloudAppEvents\\r\\n| where ActionType contains \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| summarize User_Phish_FN=countif(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\"), User_Spam_FN=countif(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\"), User_AttackSim_Submission=countif(ActionType == \\\"AttackSimUserSubmission\\\" and SubmissionContentType==\\\"Mail\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Phish (Mail)']=coalesce(User_Phish_FN,0), ['Spam (Mail)']=coalesce(User_Spam_FN,0), ['Attack simulation reported']=coalesce(User_AttackSim_Submission,0) | sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalAdminSubmissions\",\"color\":\"redDark\"},{\"seriesName\":\"Phish (Mail)\",\"color\":\"redDark\"},{\"seriesName\":\"Attack simulation reported\",\"color\":\"green\"},{\"seriesName\":\"Spam (Mail)\",\"color\":\"orangeDark\"}]}},\"name\":\"fn user - submissions trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"29355816-6cba-4264-938e-b0b27afdcb12\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions by submission State\\r\\n**Displays the total count of False Negative(FN) User Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of user submissions and identify bottlenecks or errors.**\"},\"customWidth\":\"50\",\"name\":\"fn user - by-state heading\",\"id\":\"6a4b32cc-b7e4-47bb-b1b9-f415df7e629c\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions by Triage Verdict\\r\\n**Displays the total count of False Negative(FN)/False Positive(FP) User Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**\"},\"customWidth\":\"50\",\"name\":\"fn user - triage-verdict heading\",\"id\":\"1427e34f-be44-4517-ae73-cc4776a49fe7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false negative submissions by the state of the submission.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"UserSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType in (\\\"0\\\",\\\"1\\\")\\r\\n| summarize count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - by-state pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a6151271-e925-4804-a3c1-06afee27c026\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"UserSubmissionTriage\\\" \\r\\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \\r\\n| summarize count() by tostring(TriageVerdict)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - triage-verdict pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6ff319ea-b5c5-4e33-9e5c-065aadbf465d\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions of already detected Emails (from Junk folder)\\r\\n**Displays the total count of False Negative(FN) User Submissions where the email message was already detected by Microsoft Defender for Office 365 and the detection action was configured to deliver the message into the Junk folder of the user mailbox. It breaks down the result based on the original detection verdict determined by Microsoft Defender for Office 365. Helps track the user submissions of messages that already had a detection. Consider changing the detection action to Quarantine to avoid these submissions.**\"},\"name\":\"fn user - junk-folder heading\",\"id\":\"d6338907-489d-4c88-b82f-260fc0f9d302\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where DeliveryLocation == \\\"Junk folder\\\"\\r\\n| summarize count() by ThreatTypes,User_SubmissionType\\r\\n| project ThreatTypes,User_SubmissionType, Emails = count_\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - junk-folder pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c13452cb-e864-4f01-8623-51f3ea13bbbc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId,UserId = (parse_json(RawEventData)).UserId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where DeliveryLocation == \\\"Junk folder\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods) \\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n| summarize TotalJunkSubmittedEmailCount=count(),PhishEmailCount = countif(FirstDetection ==  \\\"Phish\\\"),SpamEmailCount = countif(FirstDetection ==  \\\"Spam\\\") by tostring(UserId)\\r\\n| top 15 by TotalJunkSubmittedEmailCount desc\\r\\n| project ['User']=UserId, ['Junk Submissions']=TotalJunkSubmittedEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Junk Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fn user - junk-folder table\",\"id\":\"b242f301-c9f7-41f9-aa73-03848bd58eae\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions - Admin review status (Mark and Notify)\\r\\n**Displays counts of False Negative(FN) User Submissions that were reviewed by admins and marked with a notify action. The Mark and Notify action also can be taken automatically with Automated investigation and response (AIR). Helps track cases where admins confirmed user reports and communicated the outcome, supporting transparency and user trust.**\"},\"customWidth\":\"50\",\"name\":\"fn user - mark-notify heading\",\"id\":\"784bf171-53ae-4907-b2b0-7fc5039df231\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions accuracy vs Admin review verdict\\r\\n**Displays counts of False Negative(FN) User Submissions (Phish, Junk, NotJunk) compared to admin review results. Highlights whether submissions were Correct, Not Correct, or misclassified comparing user submission type with the Admin decision using Mark and Notify action in Microsoft Defender for Office 365 (e.g., “Phish reported as Junk”, “Reported but not malicious”).**\"},\"customWidth\":\"50\",\"name\":\"fn user - accuracy heading\",\"id\":\"3d137383-6436-4213-9824-72f424b67290\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises user submissions where admin also performed 'mark and notify' action on the submission\\r\\nlet ReviewResults = CloudAppEvents | where ActionType == \\\"SubmissionNotification\\\" \\r\\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\\r\\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\\r\\n| mv-expand element = Properties\\r\\n| where element.Name == \\\"AdminReviewResult\\\"\\r\\n| project SubmissionId, AdminReviewResult = element.Value;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\\r\\n| join kind=leftouter ReviewResults on SubmissionId\\r\\n| extend UserReportedAs=iif(SubmissionType == 1, \\\"Phish\\\",iif(SubmissionType == 2, \\\"Junk\\\",iif(SubmissionType == 3, \\\"NotJunk\\\",\\\"\\\")))\\r\\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\\r\\n| extend Reviewed=iif(isempty(AdminReviewResult),\\\"Not Reviewed\\\",\\\"Reviewed\\\")\\r\\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\\r\\n| summarize count() by Reviewed\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - mark-notify pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7bb7d116-bd61-4e46-81dd-d634a31e7369\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises user submissions type compared to admin review verdict. \\r\\n//Eg. User reporting a phish but admin review is 'not threat found'\\r\\nlet ReviewResults = CloudAppEvents | where ActionType == \\\"SubmissionNotification\\\" \\r\\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\\r\\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\\r\\n| mv-expand element = Properties\\r\\n| where element.Name == \\\"AdminReviewResult\\\"\\r\\n| project SubmissionId, AdminReviewResult = element.Value;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\\r\\n| join kind=leftouter ReviewResults on SubmissionId\\r\\n| extend UserReportedAs=iif(SubmissionType == 1, \\\"Phish\\\",iif(SubmissionType == 2, \\\"Junk\\\",iif(SubmissionType == 3, \\\"NotJunk\\\",\\\"\\\")))\\r\\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \\\"Correct\\\", iif(AdminReviewResult==\\\"Phish\\\" and UserReportedAs == \\\"Junk\\\", \\\"Phish reported as junk\\\",iif(AdminReviewResult==\\\"Junk\\\" and UserReportedAs == \\\"Phish\\\",\\\"Junk reported as Phish\\\",iif(AdminReviewResult==\\\"NotJunk\\\",\\\"Reported but not malicious or spam\\\",iif(isempty(AdminReviewResult),\\\"Not Reviewed\\\",\\\"Not correct\\\")))))\\r\\n| extend Reviewed=iif(isempty(AdminReviewResult),\\\"Not Reviewed\\\",\\\"Reviewed\\\")\\r\\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\\r\\n| where Reviewed==\\\"Reviewed\\\"\\r\\n| summarize count() by ReviewedAccuracy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - accuracy pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8af1b9f0-995c-4c58-9960-8e69c6960987\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 P2 Email Senders domains in False Negative(FN) User Submissions \\r\\n**Displays the top 10 P2 email sender domains of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per domain to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"fn user - top-p2-domains heading\",\"id\":\"78dab1f9-09ec-46e2-aee4-f256e368cdd5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top 10 sender domains of inbound emails submitted as false negatives by users.\\r\\nlet TotalInboundbySender=\\r\\nEmailEvents\\r\\n| where EmailDirection ==\\\"Inbound\\\"\\r\\n| summarize count() by SenderFromDomain;\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize UserSubmissions=count() by SenderFromDomain\\r\\n| join TotalInboundbySender on SenderFromDomain\\r\\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\\r\\n| top 10 by UserSubmissions desc\\r\\n| project ['Sender Domain']=SenderFromDomain, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"User Submission %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"12ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - top-p2-domains table\",\"id\":\"6e6a59d4-70e1-4d85-bebb-6bb23d25d2d9\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 P2 Individual Email Senders in False Negative(FN) User Submissions \\r\\n**Displays the top 10 P2 individual email sender addresses of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"fn user - top-p2-senders heading\",\"id\":\"a6e8fda5-dd05-49ed-87e2-16443495396e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top 10 sender email addresses of inbound emails submitted as false negatives by users.\\r\\nlet TotalInboundbySender=\\r\\nEmailEvents\\r\\n| where EmailDirection ==\\\"Inbound\\\"\\r\\n| summarize count() by SenderFromAddress;\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize UserSubmissions=count() by SenderFromAddress\\r\\n| join TotalInboundbySender on SenderFromAddress\\r\\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\\r\\n| top 10 by UserSubmissions desc\\r\\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"User Submission %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"12ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - top-p2-senders table\",\"id\":\"878fd15f-2607-4d6d-b919-0b4bea6a1850\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Intra-org Email Senders in False Negative(FN) User Submissions \\r\\n**Displays the top 10 email senders of intra-org emails reported by users as false negatives (missed detections). Includes total intra-org email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"fn user - intraorg-senders heading\",\"id\":\"87a51814-7f01-42e3-aea2-4136c869d39d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top 10 sender email address of intra-org emails submitted as false negatives by users.\\r\\nlet TotalInboundbySender=\\r\\nEmailEvents\\r\\n| where EmailDirection ==\\\"Intra-org\\\"\\r\\n| summarize count() by SenderFromAddress;\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Intra-org\\\"\\r\\n| summarize UserSubmissions=count() by SenderFromAddress\\r\\n| join TotalInboundbySender on SenderFromAddress\\r\\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\\r\\n| top 10 by UserSubmissions desc\\r\\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Intra-org']=count_, ['User Submission %']=UserSubmissions_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Intra-org\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"User Submission %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"12ch\"}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - intraorg-senders table\",\"id\":\"38edca4b-a403-41e8-8c2b-7c0595e93b7a\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Intra-org Email Subjects in False Negative(FN) User Submissions \\r\\n**Displays the top 10 Email Subjects of intra-org emails reported by users as false negatives (missed detections). Helps to highlight high-risk intra-org email sources.**\"},\"customWidth\":\"100\",\"name\":\"fn user - intraorg-subjects heading\",\"id\":\"52b0bc5b-7e54-4a5b-a487-8a736a8c2397\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Intra-org\\\"\\r\\n| summarize count() by Subject\\r\\n| top 10 by count_ desc\\r\\n| project ['Subject']=Subject, ['User Submissions']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Subject\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"70ch\"}},{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - intraorg-subjects table\",\"id\":\"ee2c1d2e-3d4e-4024-8422-985b22cb7475\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Detection Overrides defined by Admins in False Negative(FN) User Submissions \\r\\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to an admin-defined policy override. Includes details on OrgLevelAction, OrgLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**\"},\"customWidth\":\"100\",\"name\":\"fn user - admin-override heading\",\"id\":\"0dd9b3ce-9716-42bb-93de-495f0af2d075\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an admin definded policy override.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where ThreatTypes !=\\\"\\\"and OrgLevelAction!=\\\"\\\"\\r\\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\\r\\n| top 10 by count_ desc\\r\\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Override Policy\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"48ch\"}},{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - admin-override table\",\"id\":\"100de6ca-beb0-44d7-a715-449a389e9e8a\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Detection Overrides defined by Users in False Negative(FN) User Submissions \\r\\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to a user-defined override. Includes details on UserLevelAction, UserLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**\"},\"customWidth\":\"100\",\"name\":\"fn user - user-override heading\",\"id\":\"67057c7d-c0af-4373-b23a-4001fbced888\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an policy override.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where ThreatTypes !=\\\"\\\"and UserLevelAction!=\\\"\\\"\\r\\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\\r\\n| top 10 by count_ desc\\r\\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Override Policy\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"48ch\"}},{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - user-override table\",\"id\":\"1b97f7d2-152d-4eb0-bfac-e161fbfa4046\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 users performing the most False Negative(FN) User Submissions\\r\\n**Displays the Top 10 user accounts that performed the highest number of False Negative(FN) User Submissions (missed detections). Helps identify individuals most engaged in reporting suspicious, malicious messages and potential patterns in detection gaps.**\"},\"customWidth\":\"100\",\"name\":\"fn user - top-users heading\",\"id\":\"7799a0a0-a835-4080-b59a-736b08ad809e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 users performing false negative submissions\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType in (\\\"0\\\",\\\"1\\\")\\r\\n| extend UserId = (parse_json(RawEventData)).UserId\\r\\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\\r\\n| top 10 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - top-users pie\",\"id\":\"44838734-43a0-4301-9ddb-a644c7ec509a\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 users performing the most User Submissions of Attack simulation messages\\r\\n**Displays the top 10 user accounts that reported phishing simulation emails during cyber security awareness campaigns. Supports evaluation of cyber security awareness programme effectiveness and identifies highly engaged users.**\"},\"customWidth\":\"100\",\"name\":\"fn user - attacksim-users heading\",\"id\":\"8a96e90f-765f-40c0-8476-30c97d43c328\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top users reporting the phishing simulation emails.\\r\\nCloudAppEvents \\r\\n| extend Record= (parse_json(RawEventData)).RecordType \\r\\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState \\r\\n| extend UserId = (parse_json(RawEventData)).UserId\\r\\n| where Record == 29\\r\\n| where ActionType == \\\"AttackSimUserSubmission\\\" \\r\\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\\r\\n| top 10 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - attacksim-users pie\",\"id\":\"ab648c4a-4c46-4c73-96f0-784c9bcef961\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"8\"},\"name\":\"group - 11 - FN User submissions\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"348ce24a-7cbc-4b66-a471-dfe3827bed2d\"},{\"type\":1,\"content\":{\"json\":\"# False Positive(FP) Submissions insights\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into email message **False Positive(FP) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by administrators or users.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"10\"},\"name\":\"fp - tab description\",\"id\":\"78e2df52-a0d2-499a-95fe-708f67db5ad6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">False Positive(FP) Admin Submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nAdministrator submissions represent escalated false positive reports submitted by security team members rather than end users. These typically involve more complex cases requiring expert review, such as recurring issues affecting multiple users, business-critical communications being blocked, or suspected policy misconfigurations. Admin submissions carry higher priority and can result in actions as allow-list additions or global policy changes to prevent widespread user impact.<br><br>**Recommended action:** Review recurring false-positive sender domains and consider allow entries or policy tuning to reduce business disruption.\"},\"name\":\"fp admin - section header\",\"id\":\"02d54e9c-e989-4cde-a128-68a6381ed9d7\"},{\"type\":1,\"content\":{\"json\":\"### Admin Submission Volume and Type Breakdown\\r\\n\\r\\n**These charts track the volume and composition of administrator-initiated false positive submissions. The trend chart shows submission patterns (per {Granularity}) across Email, URL, and Attachment types, while the pie chart reveals the distribution among these categories. Spikes in admin submissions often signal systemic issues requiring immediate policy review, as admins typically escalate only the most impactful or recurring problems.**\"},\"name\":\"fp admin - volume/type heading\",\"id\":\"103b8362-a10f-4b46-a757-8290c4269a5c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of admin false positive submission by submission type.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(CloudAppEvents\\r\\n| where ActionType contains \\\"Submission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| summarize Admin_Email_FP=countif(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"), Admin_URL_FP=countif(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\"), Admin_Attach_FP=countif(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Email']=coalesce(Admin_Email_FP,0), ['URL']=coalesce(Admin_URL_FP,0), ['Attachment']=coalesce(Admin_Attach_FP,0) | sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalAdminSubmissions\",\"color\":\"redDark\"},{\"seriesName\":\"Admin_Phish_FN\",\"color\":\"redBright\"},{\"seriesName\":\"Admin_Spam_FN\",\"color\":\"orange\"},{\"seriesName\":\"Admin_Malware_FN\",\"color\":\"redDark\"},{\"seriesName\":\"Admin_Phish_URL_FN\",\"color\":\"purple\"},{\"seriesName\":\"Admin_Malware_Attach_FN\",\"color\":\"yellowDark\"},{\"seriesName\":\"Admin_Phish_Attach_FN\",\"color\":\"purpleDark\"},{\"seriesName\":\"Admin_Malware_URL_FN\",\"color\":\"yellow\"},{\"seriesName\":\"Admin_Email_FP\",\"color\":\"redDark\"},{\"seriesName\":\"Admin_URL_FP\",\"color\":\"orangeDark\"},{\"seriesName\":\"Admin_Attach_FP\",\"color\":\"yellow\"}]}},\"customWidth\":\"66\",\"name\":\"fp admin - submissions trend\",\"id\":\"326762ca-1f2b-48e9-90d6-ff2aa6a75e95\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false positive submission by submission type.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"Submission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| extend Admin_SubmissionType=\\r\\niff(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Email\\\",\\r\\niff(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\",\\\"URL\\\",\\r\\niff(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\",\\\"Attachment\\\",\\r\\n\\\"Other\\\")))\\r\\n| where Admin_SubmissionType!=\\\"Other\\\"\\r\\n| summarize count() by Admin_SubmissionType\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"33\",\"name\":\"fp admin - by-type pie\",\"id\":\"be925c4c-5718-4385-8e82-59c57b975ac5\"},{\"type\":1,\"content\":{\"json\":\"### False Positive(FP) Admin Submissions by submission state<br>\\r\\n\\r\\n**Displays the total count of False Positive(FP) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**\"},\"customWidth\":\"50\",\"name\":\"fp admin - by-state heading\",\"id\":\"2b2acb67-c070-48bd-acf1-025c05aae8b5\"},{\"type\":1,\"content\":{\"json\":\"### Top Admins Submitting False Positives<br>\\r\\n\\r\\n**Displays the top 15 admin accounts that submitted the highest number of false positive messages via AdminSubmission.**\"},\"customWidth\":\"50\",\"name\":\"fp admin - top-admins heading\",\"id\":\"52206f40-fae9-460f-97b8-2cf9b633098f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false positive submissions by the state of the submission.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"AdminSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType == \\\"3\\\"\\r\\n| summarize count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fp admin - by-state pie\",\"id\":\"96133d9e-24fb-417e-a3cd-df98dda4c60a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top admins performing false positive submissions.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \\r\\n| where Record == 29 and SubmissionType ==\\\"3\\\"\\r\\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\\r\\n| top 15 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fp admin - top-admins pie\",\"id\":\"da7b4c89-904d-4917-b6cd-04b32e02d4a1\"},{\"type\":1,\"content\":{\"json\":\"### Admin Submission False Positive Malware Detection Breakdown\\r\\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as malware.**\"},\"customWidth\":\"100\",\"name\":\"fp admin - malware-detection heading\",\"id\":\"69d649e0-86fd-4c08-afd4-e6c200b11c86\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Admin false positive submissions whose original verdict was Malware, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Malware.\\r\\nlet total = toscalar(CloudAppEvents\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n    | extend R = parse_json(RawEventData)\\r\\n    | where tostring(R.SubmissionContentType) == \\\"Mail\\\" and tostring(R.SubmissionType) == \\\"3\\\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \\\"Malware\\\"\\r\\n    | count);\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\" and DetectionVerdict == \\\"Malware\\\"\\r\\n| extend DetectionMethod = iif(isempty(DetectionMethod), \\\"Not specified\\\", DetectionMethod)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\\r\\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Malware FPs'] = Pct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"% of\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp admin - malware-detection table\",\"id\":\"607eb19b-1ded-488d-98db-8b23f9e90967\"},{\"type\":1,\"content\":{\"json\":\"### Admin Submission False Positive Phish Detection Breakdown\\r\\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**\"},\"customWidth\":\"100\",\"name\":\"fp admin - phish-detection heading\",\"id\":\"c1f1e12f-d0aa-4023-9172-8182772b3331\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Admin false positive submissions whose original verdict was Phish, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Phish.\\r\\nlet total = toscalar(CloudAppEvents\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n    | extend R = parse_json(RawEventData)\\r\\n    | where tostring(R.SubmissionContentType) == \\\"Mail\\\" and tostring(R.SubmissionType) == \\\"3\\\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \\\"Phish\\\"\\r\\n    | count);\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\" and DetectionVerdict == \\\"Phish\\\"\\r\\n| extend DetectionMethod = iif(isempty(DetectionMethod), \\\"Not specified\\\", DetectionMethod)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\\r\\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Phish FPs'] = Pct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"% of\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp admin - phish-detection pie\",\"id\":\"b6c074f9-affa-41a3-802a-53541394ae73\"},{\"type\":1,\"content\":{\"json\":\"### Admin Submission False Positive Spam Detection Breakdown\\r\\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**\"},\"customWidth\":\"100\",\"name\":\"fp admin - spam-detection heading\",\"id\":\"f0f2adb9-34af-4df0-90e6-087a265bedf6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Admin false positive submissions whose original verdict was Spam, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Spam.\\r\\nlet total = toscalar(CloudAppEvents\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n    | extend R = parse_json(RawEventData)\\r\\n    | where tostring(R.SubmissionContentType) == \\\"Mail\\\" and tostring(R.SubmissionType) == \\\"3\\\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \\\"Spam\\\"\\r\\n    | count);\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\" and DetectionVerdict == \\\"Spam\\\"\\r\\n| extend DetectionMethod = iif(isempty(DetectionMethod), \\\"Not specified\\\", DetectionMethod)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\\r\\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Spam FPs'] = Pct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"% of\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp admin - spam-detection pie\",\"id\":\"e877d9c9-3bd3-4368-997e-945f18ffcf5f\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains for Admin False Positive Submissions<br>\\r\\n\\r\\n**Lists the top 10 sender domains of emails reported as false positives by administrators (legitimate messages incorrectly flagged as spam or phishing). Helps identify domains frequently misclassified.**\"},\"customWidth\":\"50\",\"name\":\"fp admin - top-sender-domains heading\",\"id\":\"37680101-7e4b-4bcc-9e7e-0ccd2d914881\"},{\"type\":1,\"content\":{\"json\":\"### Admin False Positive Submissions by Original Threat Verdict<br>\\r\\n\\r\\n**Displays all administrator-submitted false positive emails by their original filter verdict (e.g., spam, phishing) and policy override details. Helps identify which threat categories are most often misclassified.**\"},\"customWidth\":\"50\",\"name\":\"fp admin - by-verdict heading\",\"id\":\"879e81ad-00a6-4a10-bcb6-56879133bb9f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 sender domains of emails which are submitted as false positive by admins\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType ==\\\"3\\\"\\r\\n| summarize count() by P2SenderDomain\\r\\n| top 10 by count_ desc\\r\\n| project ['Sender Domain']=P2SenderDomain, ['Emails']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fp admin - top-sender-domains table\",\"id\":\"42844dc9-4418-487b-a5ad-31e1f6b4b487\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| extend Admin_SubmissionType=\\r\\niff(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\" ,\\\"Email\\\",\\r\\n\\\"Other\\\"),\\r\\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\\r\\n| top 10 by count_ desc\\r\\n| project ['Policy Override']=PolicyOverride, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fp admin - by-verdict table\",\"id\":\"3ebbd402-06ef-45a7-b4ee-c5938b98b540\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"10\"},\"name\":\"fp admin - group\",\"styleSettings\":{\"showBorder\":true},\"id\":\"b6215b53-c181-4693-a14f-441809f65f38\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">False Positive (FP) User Submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into email message False Postive(FP) Submissions performed by end users in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by users. User submissions are critical feedback mechanisms that help security teams identify overly aggressive detection rules, refine security policies, and reduce user friction. High false positive rates can erode user trust and lead to security fatigue, so monitoring these metrics helps balance protection with productivity.<br><br>**Recommended action:** High user false-positive volume suggests over-aggressive filtering - review the affected senders and adjust policy.\"},\"name\":\"fp user - section header\",\"id\":\"0d93d7ee-a61e-43b7-bdcd-172bd79ad050\"},{\"type\":1,\"content\":{\"json\":\"### User Submission Trend\\r\\n\\r\\n**Displays the volume (per {Granularity}) of false positive submissions from end users. A sudden spike may indicate a new detection rule causing widespread misclassification, while a declining trend suggests improving detection accuracy. Monitoring this trend helps security teams respond quickly to detection issues before they impact user productivity.**\"},\"name\":\"fp user - trend heading\",\"id\":\"c3f8ae45-0498-4fa8-b9d1-35e926932639\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of user false positive submission by submission type.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(CloudAppEvents\\r\\n| where ActionType contains \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where SubmissionType == \\\"3\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\"\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['User FP Submissions'] = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"User FP Submissions\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"fp user - submissions trend\",\"id\":\"847032f5-56a8-4681-9665-9e917c7c9355\"},{\"type\":1,\"content\":{\"json\":\"### User False Positive Submissions by State<br>\\r\\n\\r\\n**Displays the total number of user-reported false positive email submissions grouped by their processing state (e.g., pending, completed). Helps track submission workflow and resolution progress.**\"},\"customWidth\":\"50\",\"name\":\"fp user - by-state heading\",\"id\":\"7bd03278-7734-4fbf-a502-95b42e90160e\"},{\"type\":1,\"content\":{\"json\":\"### Top Users Performing False Positive Submissions<br>\\r\\n\\r\\n**Lists the top 15 users who reported emails as false positives (legitimate messages incorrectly flagged as threats). Helps identify frequent reporters and potential training or policy adjustment needs.**\"},\"customWidth\":\"50\",\"name\":\"fp user - top-users heading\",\"id\":\"7e2b987b-325d-4f69-8d6b-fafd6676a03a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false positive submission by submission state.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"UserSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType == \\\"3\\\"\\r\\n| summarize count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fp user - by-state pie\",\"id\":\"df79d08b-3eac-4101-a3f2-3a4a3bf450ce\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top users performing false positive submissions.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType == \\\"3\\\"\\r\\n| extend UserId = (parse_json(RawEventData)).UserId\\r\\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\\r\\n| top 15 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fp user - top-users pie\",\"id\":\"ec7505d8-3a70-4bde-a985-baf5a0c4ec34\"},{\"type\":1,\"content\":{\"json\":\"### User Submission False Positive Malware Detection Breakdown\\r\\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection technique that flagged them. Malware quarantine is admin-only by default, so this table only populates when a custom quarantine policy lets users view and report their own malware detections - it is usually empty.**\"},\"customWidth\":\"100\",\"name\":\"fp user - malware-verdict heading\",\"id\":\"693b1072-5ddd-49d0-a0f5-2bba4c287edf\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//User false positive submissions whose email was originally flagged as Malware, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Malware.\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has \\\"Malware\\\"\\r\\n| mv-expand Technique = parse_json(DetectionMethods).Malware to typeof(string)\\r\\n| where isnotempty(Technique)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"22ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - malware-verdict table\",\"id\":\"10ea55bd-937e-454d-b6cc-a9dccfdf3417\"},{\"type\":1,\"content\":{\"json\":\"### User Submission False Positive Phish Detection Breakdown\\r\\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**\"},\"customWidth\":\"100\",\"name\":\"fp user - phish-verdict heading\",\"id\":\"6dd14abb-2772-4271-89d8-8c0dcdbfd9e5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//User false positive submissions whose email was originally flagged as Phish, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Phish.\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Technique = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Technique)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"22ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - phish-verdict pie\",\"id\":\"57049aad-eb17-4e65-a8a4-b5d05b0501cd\"},{\"type\":1,\"content\":{\"json\":\"### User Submission False Positive Spam Detection Breakdown\\r\\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**\"},\"customWidth\":\"100\",\"name\":\"fp user - spam-verdict heading\",\"id\":\"5479b2ed-b629-41e7-9857-c91191b09c8f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//User false positive submissions whose email was originally flagged as Spam, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Spam.\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has \\\"Spam\\\"\\r\\n| mv-expand Technique = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Technique)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"22ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - spam-verdict pie\",\"id\":\"45a2122e-0281-4602-906d-a0406ed20d54\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains for User False Positive Submissions<br>\\r\\n\\r\\n**Lists the top 10 sender domains of emails reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify domains frequently misclassified.**\"},\"customWidth\":\"100\",\"name\":\"fp user - top-sender-domains heading\",\"id\":\"2751fca4-3ac5-45fe-a965-8c811018926a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 sender domains reported as false positives by users, with each domain's total inbound volume and the share of it reported as FP (a high rate flags a domain whose legitimate mail is most often misclassified).\\r\\nlet totalByDomain = EmailEvents | where EmailDirection == \\\"Inbound\\\" | summarize TotalInbound = count() by SenderFromDomain;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), P2SenderDomain = tostring(R.P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| summarize FPSubmissions = count() by P2SenderDomain\\r\\n| join kind=leftouter (totalByDomain) on $left.P2SenderDomain == $right.SenderFromDomain\\r\\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\\r\\n| top 10 by FPSubmissions desc\\r\\n| project ['Sender Domain'] = P2SenderDomain, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"18ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"FP Submission %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - top-sender-domains table\",\"id\":\"c69b126d-9f25-44a0-b96d-601d89a563f1\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Senders in User False Positive Submissions<br>\\r\\n\\r\\n**Displays the top 10 email senders whose messages were reported as false positives by users (legitimate emails incorrectly flagged as threats). Helps identify senders frequently misclassified.**\"},\"customWidth\":\"100\",\"name\":\"fp user - top-senders heading\",\"id\":\"b39966ad-2b40-4144-ae3f-c7ac6b9fb97c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 email senders reported as false positives by users, with each sender's total inbound volume and the share reported as FP.\\r\\nlet totalBySender = EmailEvents | where EmailDirection == \\\"Inbound\\\" | summarize TotalInbound = count() by SenderMailFromAddress;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize FPSubmissions = count() by SenderMailFromAddress\\r\\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\\r\\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\\r\\n| top 10 by FPSubmissions desc\\r\\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"18ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"FP Submission %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - top-senders table\",\"id\":\"077ab610-58ed-4d23-886c-dbf912cef2d7\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Subjects in User False Positive Submissions<br>\\r\\n\\r\\n**Displays the top 10 email subjects reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify common patterns in misclassified emails.**\"},\"customWidth\":\"100\",\"name\":\"fp user - top-subjects heading\",\"id\":\"a5b939e1-0fbf-4ee1-a6a3-01fa7639af3a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 email subjects reported as false positives by users, with how many distinct recipients reported each (a subject reported by many users is a broad misclassification pattern).\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize FPSubmissions = count(), DistinctRecipients = dcount(RecipientObjectId) by Subject\\r\\n| top 10 by FPSubmissions desc\\r\\n| project ['Subject'] = Subject, ['FP Submissions'] = FPSubmissions, ['Distinct Recipients'] = DistinctRecipients\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Subject\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"70ch\"}},{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Recipients\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"18ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - top-subjects table\",\"id\":\"71d5c290-f5d0-493c-b821-b5345dbe7312\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Intra-Org Senders in User False Positive Submissions<br>\\r\\n\\r\\n**Displays the top 10 internal senders whose emails were reported as false positives by users (legitimate intra-org messages incorrectly flagged as threats). Helps identify internal communication patterns causing misclassification.**\"},\"customWidth\":\"100\",\"name\":\"fp user - intraorg-senders heading\",\"id\":\"1d38f458-dfde-4608-ad7d-ee8628e85ee7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 internal senders whose emails were reported as false positives by users, with total intra-org volume and the share reported as FP.\\r\\nlet totalBySender = EmailEvents | where EmailDirection == \\\"Intra-org\\\" | summarize TotalIntraOrg = count() by SenderMailFromAddress;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Intra-org\\\"\\r\\n| summarize FPSubmissions = count() by SenderMailFromAddress\\r\\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\\r\\n| extend FPPct = iif(isnull(TotalIntraOrg) or TotalIntraOrg == 0, 0.0, round(FPSubmissions * 100.0 / TotalIntraOrg, 2))\\r\\n| top 10 by FPSubmissions desc\\r\\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Intra-org'] = coalesce(TotalIntraOrg, 0), ['FP Submission %'] = FPPct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Intra-org\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"18ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"FP Submission %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - intraorg-senders table\",\"id\":\"b6699a7f-897a-4016-ae2c-d816f3a9492b\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"10\"},\"name\":\"fp user - group\",\"styleSettings\":{\"showBorder\":true},\"id\":\"2ad3311e-e92b-4a49-bdd0-775f085c4587\"},{\"type\":1,\"content\":{\"json\":\"# File Malware Detections (SharePoint, Teams and OneDrive)\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into malicious file detections across Microsoft collaboration platforms such as SharePoint, OneDrive, and Teams.\\r\\n\\r\\n[<p><b>Safe Attachments for SharePoint, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-about)\\r\\n[<p><b>Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-for-spo-odfb-teams-about) \"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"9\"},\"name\":\"filemal - tab description\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cefcac88-f373-4748-b0ea-e7600f63edd7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Microsoft Defender for Office 365 value for files in SharePoint / OneDrive / Teams: total files processed, how many had a malware detection, and how many were scanned with no detection. A per-period Trend series feeds the tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet base = FileMaliciousContentInfo;\\r\\nlet counts = union\\r\\n(base | summarize Count = count() | extend Cat = \\\"Total Files Processed (SPO/ODB/Teams)\\\", Ord = 1),\\r\\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Cat = \\\"Files with Malware Detected\\\", Ord = 2),\\r\\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Cat = \\\"Files Scanned - No Detection\\\", Ord = 3);\\r\\nlet tagged = union\\r\\n(base | extend Cat = \\\"Total Files Processed (SPO/ODB/Teams)\\\"),\\r\\n(base | where isnotempty(ThreatTypes) | extend Cat = \\\"Files with Malware Detected\\\"),\\r\\n(base | where isempty(ThreatTypes) | extend Cat = \\\"Files Scanned - No Detection\\\");\\r\\nlet trends = tagged | make-series Trend = count() default = 0 on Timestamp step gran by Cat;\\r\\ncounts\\r\\n| join kind=leftouter (trends) on Cat\\r\\n| sort by Ord asc\\r\\n| project Count, Details = Cat, Trend\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"name\":\"filemal - MDO value tiles\",\"id\":\"843e58a9-6324-4a90-a652-bfb0549e79dc\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"9\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">File Malware Detection (SharePoint, OneDrive, and Teams)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section monitors malware detections in files stored across Microsoft 365 collaboration platforms. Microsoft Defender for Office 365 and built-in SharePoint Online antivirus work together to scan files uploaded to SharePoint, OneDrive, and Teams. Understanding file-based malware patterns helps protect collaborative workspaces and identify potential security risks in shared content.<br><br>**Recommended action:** For repeat file owners or sites, investigate possible compromise and confirm Safe Attachments for SharePoint, OneDrive and Teams is enabled.\"},\"name\":\"filemal - section header\",\"id\":\"373fe4e5-fc90-49cf-93ba-c8b100efce57\"},{\"type\":1,\"content\":{\"json\":\"### File Malware Detection Trend<br>\\r\\n\\r\\n**This visual tracks the volume (per {Granularity}) of malware detections in files across all Microsoft 365 workloads. Spikes in detection activity may indicate targeted attacks or emerging malware campaigns affecting collaborative platforms. Regular monitoring helps identify unusual patterns that require investigation.**\"},\"name\":\"filemal - trend heading\",\"id\":\"30145585-8998-443a-b6ec-062d136c621f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(FileMaliciousContentInfo\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Files']=coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"tileSettings\":{\"showBorder\":false},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Files\",\"color\":\"blueDark\"}],\"showDataPoints\":true}},\"customWidth\":\"100\",\"name\":\"filemal - detection trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d39cea9b-75a8-4c29-bfdb-2e0db855e98a\"},{\"type\":1,\"content\":{\"json\":\"### Malware Family Analysis - Defender for Office 365\\r\\n**Provides a breakdown of malware detections in files scanned by Microsoft Defender for Office 365 (Safe Attachments detonation) across SharePoint, OneDrive, and Teams. The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify dominant threats and their spread across collaboration platforms.**\"},\"customWidth\":\"100\",\"name\":\"filemal - family MDO heading\",\"id\":\"4e330873-f732-4d37-a7b0-dced08b019b0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes File malware detections by Microsoft Defender for Office 365 (Safe Attachments detonation) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\\r\\nFileMaliciousContentInfo\\r\\n| where tostring(DetectionMethods) contains \\\"detonation\\\"\\r\\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\\\"Site: \\\", tostring(split(FolderPath, \\\"/\\\")[4])))\\r\\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\\r\\n| sort by ['Files'] desc\\r\\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"RawinfoVirusInfo\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"RawinfoVirusInfo\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"RawinfoVirusInfo\",\"createOtherGroup\":15},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Files\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"filemal - family MDO table\",\"id\":\"c3fbb1c9-be67-43b9-9a32-7fb265a84ffc\"},{\"type\":1,\"content\":{\"json\":\"### Malware Family Analysis - SharePoint AV\\r\\n**Provides a breakdown of malware detections in files across SharePoint, OneDrive, and Teams caught by the built-in SharePoint antivirus (Antimalware engine). The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify prevalent threats and their spread across collaboration environments.**\"},\"customWidth\":\"100\",\"name\":\"filemal - family SPO-AV heading\",\"id\":\"331a8361-6e81-4615-b33a-97ebb3e31529\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes File malware detections by the built-in SharePoint antivirus (Antimalware engine) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\\r\\nFileMaliciousContentInfo\\r\\n| where tostring(DetectionMethods) contains \\\"Antimalware engine\\\"\\r\\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\\\"Site: \\\", tostring(split(FolderPath, \\\"/\\\")[4])))\\r\\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\\r\\n| sort by ['Files'] desc\\r\\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"chartSettings\":{\"xAxis\":\"RawinfoVirusInfo\",\"createOtherGroup\":10},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Files\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"filemal - family SPO-AV table\",\"id\":\"bbcdccd9-eedb-476a-a0e7-8504f8770229\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Location<br>\\r\\n\\r\\n**Displays the number of malware detections grouped by specific SharePoint sites or OneDrive locations. Helps identify which sites have the highest volume of detected threats for targeted remediation and security hardening.**\"},\"customWidth\":\"50\",\"name\":\"filemal - by-location heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c5668d6e-7c0e-4ce3-9509-ca93dda3efad\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Application<br>\\r\\n\\r\\n**Summarizes malware detections across Microsoft collaboration apps, including SharePoint, OneDrive, and Teams. Helps identify which applications experience the highest volume of detected threats for targeted security measures.**\"},\"customWidth\":\"50\",\"name\":\"filemal - by-application heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"07e64ca9-04a2-44b2-a044-e927bc73ef1b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists total Malware detections of files on SharePoint, OneDrive and Teams by the location (site or personal path) where the file resides.\\r\\nFileMaliciousContentInfo\\r\\n| extend ['Site / Location'] = tostring(split(FolderPath, '/')[4])\\r\\n| summarize ['Detections'] = count() by ['Site / Location']\\r\\n| sort by ['Detections'] desc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"filemal - by-location table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3ce3ea65-a4df-450f-871c-8956d59818a9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams summarizing the data by the Microsoft collaboration application (workload).\\r\\nFileMaliciousContentInfo\\r\\n| summarize count() by Workload\\r\\n| sort by count_ desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"filemal - by-application pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"003afc8e-0403-4aa9-9084-a3c2e435216a\"},{\"type\":1,\"content\":{\"json\":\"### Top File Owners Holding Malware\\r\\n**Lists the users (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, with the count of malicious files, distinct files, affected workloads and sample threat names. Helps pinpoint the accounts and collaboration locations most affected by malicious content for targeted remediation.**\"},\"customWidth\":\"100\",\"name\":\"filemal - top-owners heading\",\"id\":\"c2f8d3b5-0a4e-4b7c-9d23-8e6f0a1b2c34\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top file owners (or the SharePoint/Teams site, when a file has no user owner) whose SharePoint/OneDrive/Teams files were flagged as malware, with distinct files, workloads and sample threat names.\\r\\nFileMaliciousContentInfo\\r\\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\\\"Site: \\\", tostring(split(FolderPath, \\\"/\\\")[4])))\\r\\n| summarize ['Malicious Files'] = count(),\\n            ['Distinct Files']  = dcount(SHA256),\\n            ['Workloads']       = make_set(Workload, 3),\\n            ['Sample Threats']  = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\\n            ['Last Seen']       = max(Timestamp)\\n        by ['Owner']=Owner\\n| top 20 by ['Malicious Files']\",\"size\":0,\"title\":\"Top File Owners Holding Malware\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Malicious Files\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Distinct Files\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"name\":\"filemal - top-owners table\",\"id\":\"36d9a683-9f9d-4a70-84d9-ec351542f827\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"9\"},\"name\":\"filemal - group\",\"styleSettings\":{\"showBorder\":true},\"id\":\"50886cd9-87bf-4a84-bd80-d7f44441b3f7\"},{\"type\":1,\"content\":{\"json\":\"# Post-Delivery &amp; Quarantine Insights\\r\\n\\r\\n---\\r\\nThis tab covers what happens to threats **after delivery**: Zero-hour Auto Purge (ZAP) remediation of malicious messages already in mailboxes, and quarantine management - what is held, released, and by whom. Together they show how effectively post-delivery response contains threats that reached the inbox.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"11\"},\"name\":\"postdelivery - tab description\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"93371620-d968-4987-bddd-6c9b9e5a0344\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Post Delivery Protection offered by ZAP\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into Microsoft Defender for Office 365's post-delivery protection capabilities through Zero-Hour Auto Purge (ZAP). ZAP is a critical security feature that continuously monitors delivered emails and automatically removes messages that are later identified as malicious. These visuals help track ZAP effectiveness, response times, and remediation patterns.<br><br>**Recommended action:** High post-delivery ZAP volume means threats are reaching inboxes before being caught - review pre-delivery filtering and detection latency.\"},\"name\":\"postdelivery - section header\",\"id\":\"b22ee5f1-a2dc-4509-92a3-1dbcad3a6ee7\"},{\"type\":1,\"content\":{\"json\":\"### ZAP Post-Delivery Actions (per {Granularity})<br>\\r\\n\\r\\n**Shows the count (per {Granularity}) of emails that were remediated post-delivery by Zero-Hour Auto Purge (ZAP). Helps track how often threats are detected and removed after reaching user mailboxes.**\"},\"customWidth\":\"50\",\"name\":\"postdelivery - zap-actions heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"af1aa73f-d952-4827-bcc9-b97a19016829\"},{\"type\":1,\"content\":{\"json\":\"### ZAP Actions by Detection Type (per {Granularity})<br>\\r\\n\\r\\n**Visualizes the count (per {Granularity}) of post-delivery remediation actions performed by Zero-Hour Auto Purge (ZAP), broken down by detection type (Spam ZAP, Phish ZAP, Malware ZAP). Helps track which threat categories are most frequently remediated after delivery.**\"},\"customWidth\":\"50\",\"name\":\"postdelivery - by-detection-type heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8eb38cb1-4e2d-435a-81be-e661c9b89ff4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailPostDeliveryEvents \\r\\n| where ActionType has \\\"ZAP\\\"\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Zapped Emails'] = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Zapped Emails\",\"color\":\"blueDark\"}]}},\"customWidth\":\"50\",\"name\":\"postdelivery - zap-actions trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"dd60fd71-4e14-4b38-ad22-39f1e3e3f55a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailPostDeliveryEvents\\r\\n| where ActionType has \\\"ZAP\\\"\\r\\n| summarize [\\\"Spam ZAP\\\"]=countif(ActionType has 'Spam ZAP'), [\\\"Phish ZAP\\\"]=countif(ActionType has 'Phish ZAP'), [\\\"Malware ZAP\\\"]=countif(ActionType has 'Malware ZAP') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, [\\\"Spam ZAP\\\"]=coalesce([\\\"Spam ZAP\\\"],0), [\\\"Phish ZAP\\\"]=coalesce([\\\"Phish ZAP\\\"],0), [\\\"Malware ZAP\\\"]=coalesce([\\\"Malware ZAP\\\"],0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"50\",\"name\":\"postdelivery - by-detection-type trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"511f4a43-9f56-48ad-a644-b72722af82d7\"},{\"type\":1,\"content\":{\"json\":\"### ZAP Remediation by Destination<br>\\r\\n\\r\\n**This visual shows where ZAP moves malicious emails during remediation. Post-delivery actions can send emails to different locations: Quarantine (isolated for admin review), Deleted Items (soft delete), Junk Email folder, or back to Inbox (for false positive corrections). Understanding these patterns helps evaluate ZAP policy configurations and ensures malicious content is properly isolated from users.**\"},\"name\":\"postdelivery - by-destination heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"dc7b9b6c-36fb-4ae4-a3e8-ff11da681c97\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailPostDeliveryEvents\\r\\n| where ActionType contains \\\"ZAP\\\"\\r\\n| summarize Quarantine=countif(DeliveryLocation has 'Quarantine'), ['Deleted Items']=countif(DeliveryLocation has 'Delete'), Junk=countif(DeliveryLocation has 'Junk'), Inbox=countif(DeliveryLocation has 'Inbox') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, Quarantine=coalesce(Quarantine,0), ['Deleted Items']=coalesce(['Deleted Items'],0), Junk=coalesce(Junk,0), Inbox=coalesce(Inbox,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"name\":\"postdelivery - by-destination trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cbb737ef-1c7e-4b3e-af26-a553fe6147c9\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"11\"},\"name\":\"postdelivery - group\",\"styleSettings\":{\"showBorder\":true},\"id\":\"e436ecee-8886-4179-a578-9e4a42e75b9e\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Quarantine Management and Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides comprehensive insights into quarantine operations, including release patterns, detection methods, and threat categorization. It helps security teams understand what types of threats are being quarantined and monitor quarantine release activity to identify potential false positives or security policy effectiveness.<br><br>**Recommended action:** Investigate high release rates - they indicate false positives or risky user releases; review quarantine policies and release permissions.\"},\"name\":\"quarantine - section header\",\"id\":\"c4862977-6670-4716-8109-252a361d7478\"},{\"type\":1,\"content\":{\"json\":\"### Quarantine Release Trend<br>\\r\\n\\r\\n**This visual displays the per-{Granularity} trend of emails released from quarantine by administrators. Monitoring this metric helps identify patterns in quarantine management and potential areas where policy adjustments may be needed to reduce unnecessary quarantines.**\"},\"name\":\"quarantine - release-trend heading\",\"id\":\"8526a5e0-c6a4-44e3-b00a-5e135374f58e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of emails released from quarantine\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailPostDeliveryEvents\\r\\n| where ActionTrigger has \\\"AdminAction\\\" and Action has 'Quarantine release'\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Quarantine Releases'] = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Quarantine Releases\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"quarantine - release trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3625d1f1-f34a-4cbf-a78f-eb2e5506bad4\"},{\"type\":1,\"content\":{\"json\":\"### Quarantine Release Percentage<br>\\r\\n\\r\\n**Calculates the percentage of quarantined emails that were successfully released compared to the total quarantined messages. This metric helps measure engagement with quarantine and assess the effectiveness of quarantine policies.**\"},\"customWidth\":\"40\",\"name\":\"quarantine - release-pct heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e3a9502c-9030-4621-b248-55cdf69f81ae\"},{\"type\":1,\"content\":{\"json\":\"### Quarantine Release Analysis by Detection Type<br>\\r\\n\\r\\n**For each detection technology, this shows the share of its quarantined emails that were later released from quarantine (Release % = released / quarantined). A high release rate flags a detector that may be over-flagging legitimate mail - a strong candidate for policy or rule tuning. The Released count shows the volume behind each rate.**\"},\"customWidth\":\"60\",\"name\":\"quarantine - release-by-detection heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"976fc90f-bf46-4315-b05e-4e501b37b869\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\\r\\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\\r\\n| where Action == \\\"Quarantine release\\\"\\r\\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \\\"Quarantine\\\") on NetworkMessageId\\r\\n| summarize count());\\r\\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \\\"Quarantine\\\"\\r\\n| summarize count());\\r\\nprint\\r\\nQuarantine_Releases = toreal(Quarantine_Releases),\\r\\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\\r\\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))\",\"size\":0,\"showAnalytics\":true,\"title\":\" \",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Release_Percentage\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},\"showBorder\":true,\"sortCriteriaField\":\"Release_Percentage\",\"size\":\"auto\"},\"statSettings\":{\"valueField\":\"Release_Percentage\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"heatmapPalette\":\"greenRed\",\"thresholdsGrid\":[{\"operator\":\"<\",\"thresholdValue\":\"5\",\"representation\":\"green\"},{\"operator\":\">\",\"thresholdValue\":\"5\",\"representation\":\"redDark\"}]},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"tagText\":\"Quarantine Release Percentage\",\"valueFontStyle\":\"mega\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"40\",\"name\":\"quarantine - release-pct stat\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"64e157ce-2f6a-423f-9ce5-eade8b6f41d5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Per detection technology: the share of its quarantined emails that were later released from quarantine.\\r\\n//Release % = released / quarantined for that detection technology - a high rate flags a detector that may be over-flagging legitimate mail (potential false positives). Detectors with fewer than 10 quarantined emails are excluded so the rate is statistically meaningful.\\r\\nEmailEvents\\r\\n| where DeliveryLocation == \\\"Quarantine\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods)\\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0]))\\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\")\\r\\n| where FirstSubcategory contains \\\"Malware\\\" or FirstSubcategory contains \\\"Phish\\\" or FirstSubcategory contains \\\"Spam\\\"\\r\\n| join kind=leftouter (\\r\\n    EmailPostDeliveryEvents\\r\\n    | where Action == \\\"Quarantine release\\\"\\r\\n    | distinct NetworkMessageId\\r\\n    | extend ReleasedFlag = \\\"yes\\\"\\r\\n  ) on NetworkMessageId\\r\\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \\\"yes\\\") by FirstSubcategory\\r\\n| where Quarantined >= 10 and Released > 0\\r\\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\\r\\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\\r\\n| order by ['Release %'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Quarantined Emails\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Released\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Release %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"60\",\"name\":\"quarantine - release-by-detection pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9a6d21b7-7542-4ae5-8f3f-b18474b52a20\"},{\"type\":1,\"content\":{\"json\":\"### Malware Email Quarantine Analysis<br>\\r\\n\\r\\n**These visuals break down quarantined malware emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple malware detection techniques including file detonation, file reputation analysis, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-malware policies and identify emerging malware tactics.<br>The line chart shows per-{Granularity} trends across all malware detection methods, while the table provides an overall distribution of detection reasons.**\"},\"name\":\"quarantine - malware heading\",\"id\":\"59f84161-a010-44c2-aec1-b72ed98ccdff\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of malware emails that are quarantined, summarized daily by the detection method\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has \\\"Malware\\\" and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Malware to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"quarantine - malware trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a54a8daf-0be2-4c0e-a8d7-4ff0e0879fd2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of malware emails that are quarantined, summarized by the detection method\\r\\n//(QA 2026-07-14) mv-expand over DetectionMethods.Malware (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has 'Malware' and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)\\r\\n| where isnotempty(Malware)\\r\\n| summarize count() by Malware\\r\\n| sort by count_ desc\\r\\n| project ['Detection Technology']=Malware, ['Detections']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"quarantine - malware table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b5d0d022-cf41-47e5-ae06-cf2176b47758\"},{\"type\":1,\"content\":{\"json\":\"### Phishing Email Quarantine Analysis<br>\\r\\n\\r\\n**These visuals break down quarantined phishing emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple phishing detection techniques including impersonation protection, URL detonation, spoof detection, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-phishing policies and identify emerging phishing tactics.<br>The line chart shows per-{Granularity} trends across all phishing detection methods, while the table provides an overall distribution of detection reasons.**\"},\"name\":\"quarantine - phish heading\",\"id\":\"aca50104-cb68-4a8f-82ee-ea8eee25fe14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of phish emails that are quarantined, summarized daily by the detection method\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has \\\"Phish\\\" and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"quarantine - phish trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"57151360-0577-45ce-8fc6-10a3790865ce\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of phish emails that are quarantined, summarized by the detection method\\r\\n//(QA 2026-07-14) mv-expand over DetectionMethods.Phish (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has 'Phish' and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Phish)\\r\\n| summarize count() by Phish\\r\\n| sort by count_ desc\\r\\n| project ['Detection Technology']=Phish, ['Detections']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"quarantine - phish pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"df78c64b-76f6-4980-80df-d0d432e780a5\"},{\"type\":1,\"content\":{\"json\":\"### Spam Email Quarantine Analysis<br>\\r\\n\\r\\n**These visuals provide detailed insights into quarantined spam emails categorized by detection methods. Spam detection technologies include advanced filters, general filters, bulk email filtering, reputation-based systems (IP, domain, URL), and mixed analysis detection. Analyzing spam quarantine patterns helps fine-tune spam filtering policies to balance security with user productivity and reduce false positives.<br>The line chart displays per-{Granularity} trends for each spam detection method, while the table shows the overall distribution.**\"},\"name\":\"quarantine - spam heading\",\"id\":\"e131910f-0233-474a-a9b8-9f70a49246cf\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of spam emails that are quarantined, summarized daily by the detection method\\r\\nlet gran = {Granularity};\\r\\nlet baseQuery = EmailEvents\\r\\n| where DetectionMethods has \\\"Spam\\\" and DeliveryLocation == \\\"Quarantine\\\";\\r\\nlet agg = materialize(baseQuery\\r\\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"quarantine - spam trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5762bcc7-bbda-4a3d-91cf-de18fbdd2775\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of spam emails that are quarantined, summarized by the detection method\\r\\n//(QA 2026-07-14) mv-expand over DetectionMethods.Spam (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has 'Spam' and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Spam)\\r\\n| summarize count() by Spam\\r\\n| sort by count_ desc\\r\\n| project ['Detection Technology']=Spam, ['Detections']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"quarantine - spam pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"2995f55b-17f9-458b-8630-e0370d14522a\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"11\"},\"name\":\"quarantine - group\",\"id\":\"430294af-c68f-4427-8b55-d552a3d89d42\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"# Security Operations Center (SOC) Insights \\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides a view for security operations. Combines incident response metrics with investigation insights to evaluate the effectiveness of both automated systems and manual interventions.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"13\"},\"name\":\"soc - tab description\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fd65243c-514c-4813-978f-fb908226d049\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Security Incident Response Metrics\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Operational efficiency insights.** Tracks incident volume, resolution speed, automation efficacy, and classification accuracy to evaluate SOC performance.<br><br>**Recommended action:** Track mean time to close by severity against your SLA and investigate any severity trending upward.\"},\"name\":\"soc - incident-metrics section header\",\"id\":\"f92c3e24-3e0f-4f4c-8ee9-3ec60832f7b1\"},{\"type\":1,\"content\":{\"json\":\"### Email Security Incidents<br>\\r\\n\\r\\n**These visuals display the per-{Granularity} trend of email-related security incidents, as well as the proportion of email incidents compared to the total number of incidents in Defender.**\"},\"name\":\"soc - email-incidents heading\",\"id\":\"c1cf6796-6071-4d2e-bf2c-c5e8d2a99a12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Filter for incidents that have at least one Email Security alert\\r\\nlet gran = {Granularity};\\r\\nlet OfficeEmailAlerts = SecurityAlert\\r\\n    | where ProductName contains \\\"Office 365 Advanced Threat Protection\\\" or ProductName contains \\\"Microsoft 365 Defender\\\"\\r\\n    | project SystemAlertId;\\r\\nlet agg = materialize(SecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| mv-expand AlertIds\\r\\n| where isnotempty(AlertIds) and not(Title startswith \\\"CC_\\\")\\r\\n| extend AlertId = tostring(AlertIds) \\r\\n| join kind=inner\\r\\n    (OfficeEmailAlerts | extend SystemAlertId = tostring(SystemAlertId))\\r\\n    on $left.AlertId == $right.SystemAlertId\\r\\n| summarize arg_max(TimeGenerated, *), AlertCount = dcount(AlertId) by IncidentNumber\\r\\n| summarize Incidents_Number = count() by TimeGenerated = bin(TimeGenerated, gran));\\r\\nrange TimeGenerated from toscalar(agg | summarize min(TimeGenerated)) to toscalar(agg | summarize max(TimeGenerated)) step gran\\r\\n| join kind=leftouter (agg) on TimeGenerated\\r\\n| project TimeGenerated, ['Email Security Incidents'] = coalesce(Incidents_Number, 0)\\r\\n| sort by TimeGenerated asc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Email Security Incidents\",\"color\":\"blueDark\"}]}},\"customWidth\":\"75\",\"name\":\"soc - email-incidents trend\",\"id\":\"e23cfcda-1017-4fd0-ac71-8a861c450f71\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Categorize incidents: Email Security vs Other\\r\\nlet AllAlerts = SecurityAlert\\r\\n    | extend SystemAlertId = tostring(SystemAlertId)\\r\\n    | project SystemAlertId, ProductName;\\r\\nSecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| mv-expand AlertIds\\r\\n| where isnotempty(AlertIds) and not(Title startswith \\\"CC_\\\")\\r\\n| extend AlertId = tostring(AlertIds)\\r\\n| join kind=inner\\r\\n    (AllAlerts)\\r\\n    on $left.AlertId == $right.SystemAlertId\\r\\n| summarize AlertSystems = make_set(ProductName) by IncidentNumber\\r\\n| extend HasEmailSecurity = \\r\\n    AlertSystems has \\\"Office 365 Advanced Threat Protection\\\" or \\r\\n    AlertSystems has \\\"Microsoft 365 Defender\\\"\\r\\n| extend Category = iff(HasEmailSecurity, \\\"Email Security\\\", \\\"Other\\\")\\r\\n| summarize IncidentCount = count() by Category\\r\\n\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"soc - incident-category pie\",\"id\":\"baae2150-1b04-43b4-9713-48fd3cc6247f\"},{\"type\":1,\"content\":{\"json\":\"### Average Incident Time To Close (minutes)\\r\\n**This visual displays the average time, in minutes, to close email-related security incidents (per {Granularity}), split by severity, so you can see how resolution speed changes over time. Reference SLA targets: High 60, Medium 120, Low 240, Informational 480 minutes.**\"},\"name\":\"soc - time-to-close heading\",\"id\":\"e23ccc6c-b0f0-407b-8e01-d8b69c40a745\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// SLA thresholds by severity for email-security (MDO) incidents\\r\\nlet SLA_Variables = datatable (Severity:string, TimeToResolve:int) [\\r\\n    \\\"High\\\", 60,\\r\\n    \\\"Medium\\\", 120,\\r\\n    \\\"Low\\\", 240,\\r\\n    \\\"Informational\\\", 480\\r\\n];\\r\\n\\r\\n// Identify MDO-related incidents via alert correlation\\r\\nlet EmailSecurityIncidents = \\r\\n    SecurityIncident\\r\\n    | mv-expand AlertIds\\r\\n    | where isnotempty(AlertIds)\\r\\n    | extend AlertId = tostring(AlertIds)\\r\\n    | join kind=inner (\\r\\n        SecurityAlert\\r\\n        | where ProductName in (\\\"Office 365 Advanced Threat Protection\\\", \\\"Microsoft 365 Defender\\\")\\r\\n        | extend AlertId = tostring(SystemAlertId)\\r\\n        | project AlertId\\r\\n    ) on AlertId\\r\\n    | distinct ProviderIncidentId;\\r\\n\\r\\n// Get latest incident state for each MDO-related incident\\r\\nlet LatestMdoIncidents =\\r\\n    SecurityIncident\\r\\n    | summarize arg_max(TimeGenerated, Classification, Status, Severity, CreatedTime, ClosedTime, Title) by ProviderIncidentId\\r\\n    | where ProviderIncidentId in (EmailSecurityIncidents)\\r\\n    | where not(Title startswith \\\"CC_\\\");  // Exclude non-email incidents as needed\\r\\n\\r\\nLatestMdoIncidents\\r\\n| where Status == \\\"Closed\\\"\\r\\n| extend TimeToResolveIncident = datetime_diff('minute', ClosedTime, CreatedTime)\\r\\n| join kind=inner SLA_Variables on Severity\\r\\n| summarize\\r\\n    ['Avg Time to Close (min)'] = avg(TimeToResolveIncident),\\r\\n    CountIncidents = count(), Breached = countif(TimeToResolveIncident > TimeToResolve)\\r\\n    by Day = bin(ClosedTime, 1d), Severity\\r\\n| order by Day asc, Severity asc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Day\",\"yAxis\":[\"Avg Time to Close (min)\"],\"group\":\"Severity\"}},\"name\":\"soc - sla-by-severity trend\",\"id\":\"3f7d1f17-8d2f-4a1b-a97e-17973812ca6f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Closed Incident Classification (True Positive vs False Positive)\\r\\n\\r\\nThis visual shows the distribution of closed email-related incidents classified as True Positive versus False Positive. It helps assess detection accuracy and provides insight into validation trends.\"},\"customWidth\":\"33.3\",\"name\":\"soc - classification heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"48db10ce-8246-4f5e-8b68-f618d9c7f77c\"},{\"type\":1,\"content\":{\"json\":\"### True Positive Incident Classification Rate\\r\\n\\r\\nThis visual displays the percentage of email-related incidents confirmed as True Positive. It offers a clear measure of classification accuracy and highlights changes in detection effectiveness over time.\"},\"customWidth\":\"33.3\",\"name\":\"soc - tp-rate heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"34a84dbf-609a-407f-afef-f1592eb4a92b\"},{\"type\":1,\"content\":{\"json\":\"### Incidents Automated vs Manual Closure\\r\\n\\r\\nThis visual illustrates the proportion of email-related incidents closed automatically versus manually. It provides visibility into operational efficiency and the impact of automation on incident resolution.\\r\\n<br> ⚠️ *You will have to review the underlying query and add any automation system specific to your organization.*\"},\"customWidth\":\"33.3\",\"name\":\"soc - auto-vs-manual-closure heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"a1fd9136-7a12-4d80-b3e1-e2704a84f734\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Build a list of MDO-related incidents by cross-referencing SecurityAlert\\r\\nlet EmailSecurityIncidents = SecurityIncident\\r\\n    | mv-expand AlertIds\\r\\n    | where isnotempty(AlertIds)\\r\\n    | extend AlertId = tostring(AlertIds)\\r\\n    | join kind=inner (\\r\\n        SecurityAlert\\r\\n        | where ProductName in (\\\"Office 365 Advanced Threat Protection\\\", \\\"Microsoft 365 Defender\\\")\\r\\n        | extend AlertId = tostring(SystemAlertId)\\r\\n        | project AlertId\\r\\n    ) on AlertId\\r\\n    | distinct ProviderIncidentId;\\r\\n\\r\\n// Get only the most recent state of each incident, ensuring it's MDO-related\\r\\nlet LatestIncidents = SecurityIncident\\r\\n    | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\\r\\n    | where ProviderIncidentId in (EmailSecurityIncidents)\\r\\n    | where not(Title startswith \\\"CC_\\\");  // Exclude incidents unrelated to MDO (e.g., DSPM)\\r\\n\\r\\nLatestIncidents\\r\\n| where Status == 'Closed'                                     // (Optional) Limit to closed/fully classified incidents\\r\\n| summarize Count = count() by Classification = iif(\\r\\n    isnull(Classification) or trim(\\\" \\\", Classification) == \\\"\\\",\\r\\n    \\\"Not Set\\\", \\r\\n    Classification\\r\\n  )\\r\\n| order by Count desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33.3\",\"name\":\"soc - classification pie\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"cfa5b7c5-50cc-4b3b-8bba-1a93c57bff43\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Identify MDO-related SecurityIncident IDs via alert correlation\\r\\nlet EmailSecurityIncidents = \\r\\n    SecurityIncident\\r\\n    | mv-expand AlertIds\\r\\n    | where isnotempty(AlertIds)\\r\\n    | extend AlertId = tostring(AlertIds)\\r\\n    | join kind=inner (\\r\\n        SecurityAlert\\r\\n        | where ProductName in (\\\"Office 365 Advanced Threat Protection\\\", \\\"Microsoft 365 Defender\\\")\\r\\n        | extend AlertId = tostring(SystemAlertId)\\r\\n        | project AlertId\\r\\n    ) on AlertId\\r\\n    | distinct ProviderIncidentId;\\r\\n\\r\\n// Get latest incident state for MDO-related incidents\\r\\nlet LatestMdoIncidents =\\r\\n    SecurityIncident\\r\\n    | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\\r\\n    | where ProviderIncidentId in (EmailSecurityIncidents)\\r\\n    // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\\r\\n    | where not(IncidentName startswith \\\"CC_\\\");\\r\\n\\r\\n// Compute true positive rate among closed MDO incidents\\r\\nLatestMdoIncidents\\r\\n| where Status == \\\"Closed\\\"\\r\\n| summarize\\r\\n    TruePositiveCount = countif(Classification == \\\"TruePositive\\\"),\\r\\n    TotalClosed       = count()\\r\\n| extend TruePositiveRate = iff(\\r\\n    TotalClosed > 0,\\r\\n    TruePositiveCount * 100.0 / TotalClosed,\\r\\n    real(null)\\r\\n)\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"statSettings\":{\"valueField\":\"TruePositiveRate\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}},\"tagText\":\"True Positive Rate\",\"valueFontStyle\":\"xxLarge\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"33.3\",\"name\":\"soc - tp-rate stat\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"eca235aa-38aa-46dd-a569-74dd8f83b2f0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\\r\\n//Add strings for your automations if you rely on any other application/system\\r\\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\\r\\n\\r\\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\\r\\nlet EmailSecurityIncidents = SecurityIncident\\r\\n    | mv-expand AlertIds\\r\\n    | where isnotempty(AlertIds)\\r\\n    | extend AlertId = tostring(AlertIds)\\r\\n    | join kind=inner (\\r\\n        SecurityAlert\\r\\n        | where ProductName in (\\\"Office 365 Advanced Threat Protection\\\", \\\"Microsoft 365 Defender\\\")\\r\\n        | extend AlertId = tostring(SystemAlertId)\\r\\n        | project AlertId\\r\\n    ) on AlertId\\r\\n    | distinct ProviderIncidentId;\\r\\n\\r\\n// Get latest status of each incident and count closed incidents by who closed them\\r\\nSecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\\r\\n| where ProviderIncidentId in (EmailSecurityIncidents)\\r\\n| where Status == 'Closed'\\r\\n| where not(Title startswith \\\"CC_\\\")          // Exclude non-MDO incidents from DSPM policies\\r\\n| extend ClosedBy = iff(                       // Add strings for your automation systems\\r\\n        tolower(ModifiedBy) has_any (\\\"system\\\",\\\"azure\\\",\\\"automation\\\",\\\"playbook\\\",\\\"microsoft xdr\\\",\\\"microsoft defender xdr\\\",\\\"created from alert\\\"),\\r\\n        \\\"Automated\\\",\\r\\n        \\\"Human\\\"\\r\\n    )\\r\\n| summarize ClosedCount = count() by ClosedBy\",\"size\":3,\"showAnalytics\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33.3\",\"name\":\"soc - closure pie\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"a4bc160f-1ba6-4779-86cd-ef44422f1e29\"}]},\"name\":\"soc - incident-insights group\",\"id\":\"3083ac4d-0bdd-4db7-a5f0-0d41cb67a4eb\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"13\"},\"name\":\"soc - incident-metrics group\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"18ff8970-e5f6-4c51-918a-aa693a45d18f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Investigation & Response Actions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Remediation efficacy analysis.** Compares automated (AIR) and manual admin actions to evaluate response times and investigation outcomes.\\r\\n<br><br>**Recommended action:** Reduce AIR pending-action latency by reviewing why approvals take long, and increase automation where it is safe to do so.\"},\"name\":\"soc - air section header\",\"id\":\"5e0b06c8-7774-4eb4-8b7f-572b3732de84\"},{\"type\":1,\"content\":{\"json\":\"### Automated Investigation and Response (AIR) Actions (per {Granularity})\\r\\n\\r\\nThis visual shows the per-{Granularity} trend of Automated Investigation and Response (AIR) actions, including the number of successful and failed attempts (because of prior remediation).\"},\"customWidth\":\"100\",\"name\":\"soc - air-actions heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"05f14dec-e76c-413c-83a0-31a05dce65e7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query attempts to show AIR Efficiency Over Time by displaying the number of successes and failures over time\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionType =~ \\\"Automated Remediation\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Count = count() by bin(Timestamp, {Granularity}), ActionResult\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"AlertId\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"100\",\"name\":\"soc - air-efficiency trend\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"ae2a1850-5b7e-49f7-bac4-d888053ab49b\"},{\"type\":1,\"content\":{\"json\":\"### Automated Investigation and Response (AIR) Response Time After Email Delivery (per {Granularity})\\r\\n\\r\\nThis visual displays the average (per {Granularity}), 80th percentile (p80), 90th percentile (p90) and 99th percentile (p99) time needed, measured in minutes, from email delivery to AIR action. It serves as a SOC metric to monitor responsiveness (security team members reviewing and manually approving AIR Pending Actions) and identify potential latency in automated incident handling. If the latency is high focus on reviewing why reviwing AIR Pending Actions takes longer time for admins and consider <a href='https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation#configure-automated-remediation'>auto-aproval of URL, Files and Email clusters. </a>\\r\\n\"},\"customWidth\":\"100\",\"name\":\"soc - air-response-time heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"98c66d9e-efdf-40fc-b8b0-be35d7fd97a9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// SOC metric: Daily average/p75 delay (in minutes) from email delivery to AIR action\\r\\nlet deliveries = EmailEvents\\r\\n  | where DeliveryAction == \\\"Delivered\\\"// delivered emails\\r\\n  | extend MsgKey = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n  | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\\r\\nlet remediations = EmailPostDeliveryEvents\\r\\n  | where ActionType =~ \\\"Automated Remediation\\\"// automated remediation events\\r\\n  | extend MsgKey = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n  | summarize FirstRemediation = min(Timestamp) by MsgKey;\\r\\ndeliveries\\r\\n| join kind=inner remediations on MsgKey\\r\\n| extend DelayMinutes = datetime_diff(\\\"minute\\\", FirstRemediation, FirstDelivery)\\r\\n| where DelayMinutes >= 0\\r\\n| summarize ['Avg (min)'] = avg(DelayMinutes),\\r\\n            ['P80 (min)'] = percentile(DelayMinutes, 80),\\r\\n            ['P90 (min)'] = percentile(DelayMinutes, 90),\\r\\n            ['P99 (min)'] = percentile(DelayMinutes, 99),\\r\\n            CountEmails = count()\\r\\n   by bin(FirstRemediation, 1d) \",\"size\":0,\"aggregation\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"FirstRemediation\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"FirstRemediation\",\"sortOrder\":1}],\"chartSettings\":{\"xAxis\":\"FirstRemediation\",\"yAxis\":[\"P99 (min)\",\"P90 (min)\",\"P80 (min)\",\"Avg (min)\"],\"showLegend\":true}},\"customWidth\":\"100\",\"name\":\"soc - air-latency area\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"900383f1-6443-4d50-b15d-26e4ac11b255\"},{\"type\":1,\"content\":{\"json\":\"### Automated Investigation and Response (AIR) Investigation Results Trend\\r\\n\\r\\nThis visual displays the per-{Granularity} trend of AIR investigation outcomes, categorized as **Threat Detected** or **Clean**. It helps track the effectiveness of automated investigations over time and highlights patterns in threat detection.\"},\"customWidth\":\"67\",\"name\":\"soc - air-outcomes heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"d1cabfbe-6040-4b6e-9ce5-f48e9973dfc9\"},{\"type\":1,\"content\":{\"json\":\"### Investigation Actions Taken: Automated Investigation and Response (AIR) vs Manual (Human)\\r\\n\\r\\nThis visual shows whether actions taken after an Automated Investigation and Response (AIR) required manual approval by an administrator or were executed automatically. It provides insight into the level of automation versus human intervention in post-investigation remediation.\"},\"customWidth\":\"33\",\"name\":\"soc - air-auto-vs-manual heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"2f98514b-0172-4c4e-ba25-9a5e4138c570\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// AIR investigation outcomes by day: ThreatDetected vs. Clean\\r\\n\\r\\n// Step 1: Deduplicate automated remediation events by message and recipient\\r\\nlet AutoRemediations = \\r\\n    EmailPostDeliveryEvents\\r\\n    | where ActionType == \\\"Automated Remediation\\\"\\r\\n    | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\\r\\n    | project NetworkMessageId, RecipientEmailAddress, Timestamp;\\r\\n\\r\\n// Step 2: Derive threat verdicts using AlertEvidence\\r\\nlet EvidenceVerdicts =\\r\\n    AlertEvidence\\r\\n    | where EntityType in (\\\"MailMessage\\\", \\\"MailCluster\\\")\\r\\n    | extend extra = todynamic(AdditionalFields)\\r\\n    // If this is a mail cluster, use provided NetworkMessageIds array; otherwise wrap NetworkMessageId as a single-item array\\r\\n    | extend networkIds = iff(\\r\\n      isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\\r\\n      pack_array(NetworkMessageId),          // create a single-element array using pack_array\\r\\n      extra.NetworkMessageIds                // use the array as-is if it exists\\r\\n    )\\r\\n    | mv-expand nmID = networkIds                // expand to individual message IDs\\r\\n    // Derive verdict from LastVerdict, ThreatAnalysisSummary, and ThreatIntelligence\\r\\n    | extend \\r\\n        lastVerdict = tolower(tostring(extra.LastVerdict)),\\r\\n        threatAIList = extra.ThreatAnalysisSummary,\\r\\n        threatInt   = extra.ThreatIntelligence\\r\\n    | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \\\"\\\"),\\r\\n             verdictTI          = iff(array_length(threatInt) > 0, \\\"malicious\\\", \\\"\\\")   // any item in ThreatIntelligence indicates malicious\\r\\n    // Mark as threat-detected if verdict is malicious/suspicious or threat evidence is present\\r\\n    | extend ThreatDetectedFlag = \\r\\n        case(\\r\\n            lastVerdict in (\\\"malicious\\\",\\\"suspicious\\\") or verdictFromAnalysis in (\\\"malicious\\\",\\\"suspicious\\\")\\r\\n                or verdictTI == \\\"malicious\\\",\\r\\n            true,\\r\\n            false\\r\\n        )\\r\\n    // Weight mail clusters by MailCount; default to 1 for single messages\\r\\n    | extend MailCountInt = toint(extra.MailCount)\\r\\n    | extend Weight = iff(EntityType == \\\"MailCluster\\\", \\r\\n                        coalesce(MailCountInt, 1), // default to 1 if MailCount is missing\\r\\n                        1)\\r\\n    | summarize IsThreatDetected = any(ThreatDetectedFlag), \\r\\n                WeightSum       = sum(Weight) \\r\\n    by nmID = tostring(nmID);\\r\\n\\r\\n// Step 3: Join remediation events with verdicts and aggregate by day\\r\\nAutoRemediations\\r\\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\\r\\n| extend isThreat      = coalesce(IsThreatDetected, false), \\r\\n         effectiveWeight= coalesce(WeightSum, 1)\\r\\n| extend InvestigationOutcome = iif(isThreat, \\\"Threat Detected\\\", \\\"Clean\\\")\\r\\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, {Granularity}), InvestigationOutcome\\r\\n| order by Day asc, InvestigationOutcome asc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"67\",\"name\":\"soc - air-outcomes trend\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"18552ccb-d8d4-45c4-a3cf-072203df9325\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\\r\\nEmailPostDeliveryEvents\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ActionType == \\\"Automated Remediation\\\"\\r\\n| summarize count() by ActionTrigger\",\"size\":3,\"showAnalytics\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"soc - air-auto-vs-manual pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"03bc6e3c-05de-426d-91d8-b48a36b4ea74\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Post-Delivery Actions by Admin\\r\\n\\r\\nThis visual displays the number (per {Granularity}) of emails where an administrator performed a post-delivery action. Actions are summarized by type, including **Soft Delete**, **Hard Delete**, **Moved to Junk Folder**, **Moved to Inbox**, and **Quarantine Release**, providing insight into manual intervention trends after email delivery.\"},\"name\":\"soc - post-delivery-by-admin heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"a0961ca9-da58-49c4-9a1c-873c5569bed9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of emails that had an admin post delivery action, summarizing the data by action type\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailPostDeliveryEvents\\r\\n| where ActionTrigger has \\\"AdminAction\\\"\\r\\n| summarize [\\\"Soft Delete\\\"]=countif(Action has 'Soft Delete'), [\\\"Hard Delete\\\"]=countif(Action has 'Hard Delete'), [\\\"Moved to junk folder\\\"]=countif(Action has 'Moved to junk folder'), [\\\"Moved to inbox\\\"]=countif(Action has 'Moved to inbox'), [\\\"Quarantine release\\\"]=countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, [\\\"Soft Delete\\\"]=coalesce([\\\"Soft Delete\\\"],0), [\\\"Hard Delete\\\"]=coalesce([\\\"Hard Delete\\\"],0), [\\\"Moved to junk folder\\\"]=coalesce([\\\"Moved to junk folder\\\"],0), [\\\"Moved to inbox\\\"]=coalesce([\\\"Moved to inbox\\\"],0), [\\\"Quarantine release\\\"]=coalesce([\\\"Quarantine release\\\"],0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"name\":\"soc - post-delivery-by-admin trend\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"d2ea8eac-a3db-46b0-bcb4-3abbb95ba4ad\"}]},\"customWidth\":\"100\",\"name\":\"soc - post-delivery group\",\"id\":\"ebca14d5-954d-4e35-a225-cb0f8a3ea81b\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"13\"},\"name\":\"soc - air group\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"0a05394d-f813-4408-ac4d-8f481ae34c0b\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Top Malicious Email Campaigns (Clustered)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Groups malicious inbound emails into campaigns (attack waves) using the Email Cluster ID assigned by Microsoft Defender for Office 365, showing one row per campaign with the message count, distinct recipients, sender domains, threat mix and sample subjects. Helps the SOC understand the scale and shape of coordinated attacks rather than viewing individual messages in isolation.**<br><br>**Recommended action:** Pivot on the top campaign clusters to hunt related messages and consider blocking shared sender infrastructure.\"},\"name\":\"soc - campaigns heading\",\"id\":\"d3a9e4c6-1b5f-4c8d-ae34-9f7a1b2c3d45\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Largest malicious inbound email campaigns clustered by EmailClusterId - one row per attack wave (messages, recipients, URL clicks, sender domains, threat mix, sample subjects).\\r\\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\\r\\nlet clicksByCluster = UrlClickEvents\\r\\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\\r\\n| summarize UrlClicks = count() by EmailClusterId;\\r\\nlet qrClusters = EmailUrlInfo\\r\\n| where UrlLocation == \\\"QRCode\\\"\\r\\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\\r\\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and EmailClusterId > 0\\r\\n| where OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Messages = count(),\\r\\n            Recipients = dcount(RecipientEmailAddress),\\r\\n            SenderDomains = dcount(SenderFromDomain),\\r\\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\\r\\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\\r\\n            SampleSubjects = make_set(Subject, 5),\\r\\n            FirstSeen = min(Timestamp),\\r\\n            LastSeen = max(Timestamp)\\r\\n        by EmailClusterId\\r\\n| join kind=leftouter (clicksByCluster) on EmailClusterId\\r\\n| extend UrlClicks = coalesce(UrlClicks, 0)\\r\\n| join kind=leftouter (qrClusters) on EmailClusterId\\r\\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \\\"QR code\\\", \\\"\\\")\\r\\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \\\", \\\"), \\\", \\\"), dynamic([])))\\r\\n| top 20 by Messages\\r\\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['URL Clicks']=UrlClicks, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":0,\"title\":\"\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Recipients\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"URL Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"name\":\"soc - campaigns table\",\"id\":\"a2a391e1-0e26-4e0e-a8d3-26e3c7132079\"},{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Most-Clicked Email Campaigns (Recipient Engagement)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Ranks malicious inbound campaigns by recipient URL clicks, surfacing the attack waves that reached a mailbox and drew engagement regardless of raw message volume. The highest-volume campaigns are usually quarantined before delivery, so the clusters that draw clicks are often smaller, targeted waves. A non-zero URL Clicks count means a recipient opened a URL within the campaign's messages. Because attackers often mix legitimate URLs with malicious ones to build credibility, and a per-URL threat verdict is not available here, treat these as clicks on potentially malicious URLs that warrant review rather than confirmed malicious clicks.**<br><br>**Recommended action:** Focus on these clusters for user follow-up (awareness and, where credentials may be exposed, password reset) and hunt for related messages sharing sender infrastructure.\"},\"name\":\"soc - mostclicked heading\",\"id\":\"e9e41b47-0434-42e5-8b04-4170ab061b81\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Malicious inbound campaigns ranked by recipient URL clicks - the attack waves that reached a mailbox and drew engagement, regardless of message volume.\\r\\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\\r\\nlet clicksByCluster = UrlClickEvents\\r\\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\\r\\n| summarize UrlClicks = count() by EmailClusterId;\\r\\nlet qrClusters = EmailUrlInfo\\r\\n| where UrlLocation == \\\"QRCode\\\"\\r\\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\\r\\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and EmailClusterId > 0\\r\\n| where OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Messages = count(),\\r\\n            Recipients = dcount(RecipientEmailAddress),\\r\\n            SenderDomains = dcount(SenderFromDomain),\\r\\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\\r\\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\\r\\n            SampleSubjects = make_set(Subject, 5),\\r\\n            FirstSeen = min(Timestamp),\\r\\n            LastSeen = max(Timestamp)\\r\\n        by EmailClusterId\\r\\n| join kind=inner (clicksByCluster) on EmailClusterId\\r\\n| where UrlClicks > 0\\r\\n| join kind=leftouter (qrClusters) on EmailClusterId\\r\\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \\\"QR code\\\", \\\"\\\")\\r\\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \\\", \\\"), \\\", \\\"), dynamic([])))\\r\\n| top 20 by UrlClicks\\r\\n| project ['Email Cluster ID']=EmailClusterId, ['URL Clicks']=UrlClicks, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":0,\"title\":\"\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"URL Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Recipients\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"name\":\"soc - mostclicked table\",\"id\":\"1ffe8f97-ad79-47d9-9598-dd73ee54cd8d\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"13\"},\"name\":\"soc - campaigns group\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"b8f2a1c4-5d6e-4a7b-9c8d-0e1f2a3b4c5d\"}],\"isLocked\":true,\"fromTemplateId\":\"sentinel-MicrosoftDefenderForOffice365detectionsandinsights\"}\r\n",
-                "version": "1.0",
-                "sourceId": "[variables('workspaceResourceId')]",
-                "category": "sentinel"
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
-              "properties": {
-                "description": "@{workbookKey=MicrosoftDefenderForOffice365detectionsandinsights; logoFileName=Azure_Sentinel.svg; description=Gain extensive insight into your organization's Microsoft Defender for Office 365 protection across email and Microsoft Teams by analyzing and correlating events. \nYou can track detections and insights over time including: metrics for phish, spam, and malware, URL and URL click detection details, malicious file detections, Microsoft Teams collaboration protection (impersonation, voice phishing, and malicious URLs and files), post-delivery detections, user and admin submissions, system overrides, and actions taken by security administrators.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=4.0.0; title=Microsoft Defender for Office 365 Detections and Insights; templateRelativePath=MicrosoftDefenderForOffice365detectionsandinsights.json; subtitle=; provider=Microsoft}.description",
-                "parentId": "[variables('workbookId1')]",
-                "contentId": "[variables('_workbookContentId1')]",
-                "kind": "Workbook",
-                "version": "[variables('workbookVersion1')]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                },
-                "dependencies": {
-                  "operator": "AND",
-                  "criteria": [
-                    {
-                      "contentId": "EmailEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "EmailPostDeliveryEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "EmailUrlInfo",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "UrlClickEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "CloudAppEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "MessageEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "MessageUrlInfo",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "MessagePostDeliveryEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "FileMaliciousContentInfo",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "AlertEvidence",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "MicrosoftThreatProtection",
-                      "kind": "DataConnector"
-                    }
-                  ]
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('_workbookContentId1')]",
-        "contentKind": "Workbook",
-        "displayName": "[parameters('workbook1-name')]",
-        "contentProductId": "[variables('_workbookcontentProductId1')]",
-        "id": "[variables('_workbookcontentProductId1')]",
-        "version": "[variables('workbookVersion1')]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('workbookTemplateSpecName2')]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MicrosoftDefenderForEndPoint Workbook with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('workbookVersion2')]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.Insights/workbooks",
-              "name": "[variables('workbookContentId2')]",
-              "location": "[parameters('workspace-location')]",
-              "kind": "shared",
-              "apiVersion": "2021-08-01",
-              "metadata": {
-                "description": "A wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through M365 Defender Connector."
-              },
-              "properties": {
-                "displayName": "[parameters('workbook2-name')]",
-                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Microsoft Defender for Endpoint (Preview)\\n---\\n\\nA workbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through Microsoft Defender XDR Connector.\\n\\n\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b22a3bd7-19b3-495d-a0df-95a7a59d98ff\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"value\":{\"durationMs\":172800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"f0450560-ef16-4aa9-a3ad-7485dd909587\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"type\":10,\"isRequired\":true,\"jsonData\":\"[{ \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }]\",\"label\":\"Show Help\",\"value\":\"Yes\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":1,\"content\":{\"json\":\"\\r\\n|Overview|Device|Network|File|\\r\\n|--------|------|-------|----|\\r\\n|MDE Tables Last Data Received|Source of the AV detections|Internet Connected Devices|FileActivityCount per Device|\\r\\n|Daily Data Flow on MDE Tables|Get stats on ASR audit events|Count By Machine Group|Count by InitiatingProcessAccountUpn|\\r\\n|Device Heartbeat|Get stats on ASR blocks|Count By Network Adaptor||\\r\\n|Device where files are copied to USB Drive|AV Detections with USB Disk Drive|TimeSeries on Network Activity||\\r\\n|Device Internet Connectivity Status |List files copied to USB mounted drives|Top 10 RemoteUrl accessed over TimeRange||\\r\\n|Device Count by DNS Suffix ||Tor Clients||\\r\\n|Device Microsoft Entra ID Join status ||||\\r\\n|Device ClientVersion ||||\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 8\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"454d4e02-26ba-4195-ae30-94752bbf4603\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"preText\":\"Overview\",\"style\":\"link\"},{\"id\":\"3d902e84-3e5b-4631-85d1-c229ec2abf75\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Device\",\"subTarget\":\"Device\",\"style\":\"link\"},{\"id\":\"bbc20288-b398-4f63-b7a9-e3830213bb34\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Network\",\"subTarget\":\"Network\",\"style\":\"link\"},{\"id\":\"edab4a44-8ca3-4ba1-bede-4186f4376d28\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"File\",\"subTarget\":\"File\",\"style\":\"link\"}]},\"name\":\"links - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union \\r\\nisfuzzy = true\\r\\n(DeviceInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type= \\\"DeviceInfo\\\" | extend Description = \\\"Machine information (including OS information)\\\"),\\r\\n(DeviceNetworkInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceNetworkInfo\\\"  | extend Description = \\\"Network properties of machines\\\"),\\r\\n(DeviceProcessEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceProcessEvents\\\" | extend Description = \\\"Process creation and related events\\\"),\\r\\n(DeviceNetworkEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceNetworkEvents\\\" | extend Description = \\\"Network connection and related events\\\"),\\r\\n(DeviceFileEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceFileEvents\\\" | extend Description = \\\"File creation, modification, and other file system events\\\"),\\r\\n(DeviceRegistryEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceRegistryEvents\\\" | extend Description = \\\"Creation and modification of registry entries\\\"),\\r\\n(DeviceLogonEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceLogonEvents\\\" | extend Description = \\\"Sign-ins and other authentication events\\\"),\\r\\n(DeviceImageLoadEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceImageLoadEvents\\\" | extend Description = \\\"DLL loading events\\\"),\\r\\n(DeviceEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceEvents\\\" | extend Description = \\\"Additional events types\\\"),\\r\\n(DeviceFileCertificateInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceFileCertificateInfo\\\" | extend Description = \\\"Certificate information of signed files)\\\")\\r\\n| extend [\\\"Last Log Received At (Local Time)\\\"] = TimeGenerated\\r\\n| project Type, Description, [\\\"Last Log Received At (Local Time)\\\"]\",\"size\":0,\"title\":\"MDE Tables Last Data Received based on {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Type\",\"formatter\":0,\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Last Log Received At\",\"formatter\":6,\"dateFormat\":{\"formatName\":\"fullDateTimePattern\"}}],\"filter\":true}},\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\\nlet DeviceEventSummary = DeviceEvents | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceLogonEventsSummary = DeviceLogonEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceProcessEventsSummary = DeviceProcessEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\n(DeviceEventSummary\\n| union DeviceNetworkEventsSummary,\\nDeviceNetworkEventsSummary,\\nDeviceNetworkInfoSummary,\\nDeviceLogonEventsSummary,\\nDeviceRegistryEventsSummary,\\nDeviceProcessEventsSummary)\\n| join kind=inner ( \\nAllDeviceNames\\n)\\non $left.DeviceId == $right.DeviceId\\n| project-reorder Type, TimeGenerated, count_\\n//| project-away DeviceId, DeviceId1\",\"size\":1,\"title\":\"Daily Data Flow on MDE Tables over {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"xAxis\":\"count_\"}},\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo \\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| extend ParsedFields=parse_json(LoggedOnUsers)[0]\\r\\n| extend DurationAtLeast= format_timespan(now()-TimeGenerated,'dd:hh:mm:ss')\\r\\n| project DurationAtLeast,TimeGenerated,DeviceName,DomainName=ParsedFields.DomainName,UserName=ParsedFields.UserName\\r\\n| order by DurationAtLeast asc\",\"size\":0,\"title\":\"Device Heartbeat from TimeTange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let UsbDriveMount = DeviceEvents\\r\\n| where ActionType==\\\"UsbDriveMounted\\\"\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\\r\\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\\r\\n| order by DeviceId asc, MountTime desc;\\r\\nlet FileCreation = DeviceFileEvents\\r\\n| where InitiatingProcessAccountName != \\\"system\\\"\\r\\n| where ActionType == \\\"FileCreated\\\"\\r\\n| where FolderPath !startswith \\\"C:\\\\\\\\\\\"\\r\\n| where FolderPath !startswith \\\"\\\\\\\\\\\"\\r\\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\\r\\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\\r\\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\\r\\n| order by DeviceId asc, Timestamp desc;\\r\\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\\r\\n| where FolderPath startswith DriveLetter\\r\\n| where Timestamp >= MountTime\\r\\n| partition by ReportId ( top 1 by MountTime )\\r\\n| order by DeviceId asc, Timestamp desc\\r\\n| summarize FileCount = count() by DeviceName\\r\\n| order by FileCount desc\",\"size\":1,\"title\":\"Device where files are copied to USB Drive from TimeTange {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| mvexpand ConnectedNetworks\\r\\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)\",\"size\":1,\"title\":\"Device Internet Connectivity Status from TimeTange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\\r\\n| extend DeviceMachineName = split(DeviceName, '.')[0]\\r\\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\\r\\n| summarize count() by DeviceDomain\",\"size\":1,\"title\":\"Device Count by DNS Suffix\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(TimeGenerated, *) by DeviceId\\r\\n| summarize count() by tostring(IsAzureADJoined)\",\"size\":1,\"title\":\"Device EntraID Join status\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(TimeGenerated, *) by DeviceId\\r\\n| summarize count() by ClientVersion\",\"size\":1,\"title\":\"Device ClientVersion\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy - Copy - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"groupOverview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\\r\\n//\\r\\n//Get the list of AV detections\\r\\nlet avDetections =\\r\\nDeviceEvents\\r\\n| where ActionType == \\\"AntivirusDetection\\\" and isnotempty(MD5)\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\\r\\n//Get a list of file creations\\r\\nlet fileCreations =\\r\\nDeviceFileEvents \\r\\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\\r\\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\\r\\n//Join the file creations and AV detections on the MD5 of the file\\r\\navDetections | join kind=inner (fileCreations) on MD5\\r\\n| project-away MD51 //Remove the duplicated MD5 field\\r\\n| sort by Timestamp desc \",\"size\":0,\"title\":\"Source of the AV detections for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceEvents\\r\\n| where ActionType startswith \\\"Asr\\\" and ActionType endswith \\\"Audited\\\"\\r\\n// Count total stats - count events and machines per rule\\r\\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType\",\"size\":0,\"title\":\"Get stats on ASR audit events - count events and machines per rule for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceEvents\\r\\n| where ActionType startswith \\\"Asr\\\" and ActionType endswith \\\"Blocked\\\"\\r\\n// Count total stats - count events and machines per rule\\r\\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType\",\"size\":0,\"title\":\"Get stats on ASR blocks - count events and machines per rule for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query make a best-guess detection regarding which removable media device caused an AV detection\\r\\n//The query is best run over 30 days to get the full USB history\\r\\n//\\r\\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\\r\\nlet usbDetections =\\r\\n    DeviceEvents\\r\\n    | where ActionType == \\\"AntivirusDetection\\\" and FolderPath !startswith \\\"c\\\" and FolderPath matches regex \\\"^[A-Za-z]{1}\\\"\\r\\n    | extend ParsedFields=parse_json(AdditionalFields)\\r\\n    | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\\r\\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\\r\\nlet usbConnections = \\r\\n    DeviceEvents\\r\\n    | where ActionType == \\\"PnpDeviceConnected\\\"\\r\\n    | extend parsed=parse_json(AdditionalFields)\\r\\n    | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\\r\\n    | where ClassName == \\\"DiskDrive\\\"\\r\\n    | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\\r\\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\\r\\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\\r\\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\\r\\n| sort by DetectionTime desc\",\"size\":0,\"title\":\"AV Detections with USB Disk Drive for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let UsbDriveMount = DeviceEvents\\r\\n| where ActionType==\\\"UsbDriveMounted\\\"\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\\r\\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\\r\\n| order by DeviceId asc, MountTime desc;\\r\\nlet FileCreation = DeviceFileEvents\\r\\n| where InitiatingProcessAccountName != \\\"system\\\"\\r\\n| where ActionType == \\\"FileCreated\\\"\\r\\n| where FolderPath !startswith \\\"C:\\\\\\\\\\\"\\r\\n| where FolderPath !startswith \\\"\\\\\\\\\\\"\\r\\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\\r\\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\\r\\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\\r\\n| order by DeviceId asc, Timestamp desc;\\r\\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\\r\\n| where FolderPath startswith DriveLetter\\r\\n| where Timestamp >= MountTime\\r\\n| partition by ReportId ( top 1 by MountTime )\\r\\n| order by DeviceId asc, Timestamp desc\",\"size\":0,\"title\":\"List files copied to USB mounted drives for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Device\"},\"name\":\"groupDevice\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| mv-apply ConnectedNetworks on \\r\\n(\\r\\nwhere ConnectedNetworks.IsConnectedToInternet == true\\r\\n)\\r\\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet\",\"size\":0,\"title\":\"Internet Connected Devices for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| summarize count() by MachineGroup\",\"size\":0,\"title\":\"Count By Machine Group for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus\",\"size\":0,\"title\":\"Count By Network Adaptor\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkEvents\\r\\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)\",\"size\":0,\"title\":\"TimeSeries on Network Activity for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 0 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkEvents\\r\\n| where isnotempty(RemoteUrl)\\r\\n| summarize count() by RemoteUrl\\r\\n| order by count_ desc\\r\\n| limit 10\",\"size\":0,\"title\":\"Top 10 RemoteUrl accessed over TimeRange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 0 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query looks for Tor client, or for a common Tor plugin called Meek.\\r\\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\\r\\n// To read more about this technique, see:\\r\\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\\r\\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\\r\\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\\r\\n// Tags: #Tor, #MultiHopProxy, #CnC\\r\\nDeviceNetworkEvents  \\r\\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\\\"tor.exe\\\", \\\"meek-client.exe\\\")\\r\\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\\r\\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\\r\\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\\r\\n| order by MachineCount desc\",\"size\":0,\"title\":\"Tor Clients for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Network\"},\"name\":\"groupNetwork\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceFileEvents\\r\\n| summarize FileActivityCount = count() by DeviceName\",\"size\":0,\"title\":\"FileActivityCount per Device for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceFileEvents\\r\\n| summarize count() by InitiatingProcessAccountUpn\",\"size\":0,\"title\":\"Count by InitiatingProcessAccountUpn for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"query - 0 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"File\"},\"name\":\"groupFile\"}],\"fromTemplateId\":\"sentinel-MicrosoftDefenderForEndPoint\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
-                "version": "1.0",
-                "sourceId": "[variables('workspaceResourceId')]",
-                "category": "sentinel"
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]",
-              "properties": {
-                "description": "@{workbookKey=MicrosoftDefenderForEndPoint; logoFileName=Azure_Sentinel.svg; description=A wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through M365 Defender Connector.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Defender For EndPoint; templateRelativePath=MicrosoftDefenderForEndPoint.json; subtitle=; provider=Microsoft Sentinel Community}.description",
-                "parentId": "[variables('workbookId2')]",
-                "contentId": "[variables('_workbookContentId2')]",
-                "kind": "Workbook",
-                "version": "[variables('workbookVersion2')]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('_workbookContentId2')]",
-        "contentKind": "Workbook",
-        "displayName": "[parameters('workbook2-name')]",
-        "contentProductId": "[variables('_workbookcontentProductId2')]",
-        "id": "[variables('_workbookcontentProductId2')]",
-        "version": "[variables('workbookVersion2')]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('workbookTemplateSpecName3')]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "MicrosoftDefenderForIdentity Workbook with template version 3.0.18",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('workbookVersion3')]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "type": "Microsoft.Insights/workbooks",
-              "name": "[variables('workbookContentId3')]",
-              "location": "[parameters('workspace-location')]",
-              "kind": "shared",
-              "apiVersion": "2021-08-01",
-              "metadata": {
-                "description": "Use this workbook to analyse the advance hunting data ingested for Defender For Identity."
-              },
-              "properties": {
-                "displayName": "[parameters('workbook3-name')]",
-                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Microsoft Defender for Identity\\n---\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"6e647d99-1a32-4bca-8147-403b5d37d773\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"value\":\"\",\"typeSettings\":{\"includeAll\":false,\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"},{\"id\":\"d57bcdf5-aec7-4f86-904c-67171864919b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"query\":\"resources\\r\\n| where type =~ \\\"microsoft.operationalinsights/workspaces\\\"\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"2e238f92-709c-410b-93e0-60eab6150a75\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"ec13514a-7e54-4d41-86db-2805727a2fa7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"About\",\"type\":10,\"description\":\"\",\"isRequired\":true,\"value\":\"Show\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n    \\\"Show\\\",\\r\\n    \\\"Hide\\\"\\r\\n]\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Microsoft Defender for Identity Analysis Workbook\\r\\n\\r\\n\",\"style\":\"info\"},\"name\":\"text - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"About\",\"comparison\":\"isEqualTo\",\"value\":\"Show\"},\"name\":\"AboutGroup\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"48578fe1-da47-4a4c-b495-ce7fe24ce495\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"grpOverview\",\"style\":\"link\"},{\"id\":\"30e93159-8bf5-4006-820f-406ea10bcd17\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"LogOnEvents\",\"subTarget\":\"grpLogOnEvents\",\"style\":\"link\"},{\"id\":\"c40f76ed-94be-40ff-b65b-3fda306f2c3d\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"QueryEvents\",\"subTarget\":\"grpQueryEvents\",\"style\":\"link\"},{\"id\":\"38c88a53-f7b1-42da-83d6-0c809835eaab\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DirectoryEvents\",\"subTarget\":\"grpDirectoryEvents\",\"style\":\"link\"},{\"id\":\"0ad83579-c492-4c20-8db6-27883db5abc8\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Alerts\",\"subTarget\":\"grpAlerts\",\"style\":\"link\"}]},\"name\":\"links - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| summarize count() by LogonType\",\"size\":0,\"title\":\"Log On Summary\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"LogonType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"40\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n|summarize count() by ActionType\",\"size\":0,\"title\":\"Log On Status\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| summarize count() by Protocol\",\"size\":0,\"title\":\"Log On Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\"},\"customWidth\":\"30\",\"name\":\"query - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityQueryEvents\\r\\n| summarize count() by Protocol\",\"size\":0,\"title\":\"Query Summary\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\"},\"customWidth\":\"30\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityQueryEvents\\r\\n| summarize count() by DestinationPort\",\"size\":0,\"title\":\"Query Destination Port\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 3 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityQueryEvents\\r\\n| where isnotempty(QueryType)\\r\\n| summarize count() by QueryType\\r\\n| order by count_ desc\\r\\n| take 10\",\"size\":0,\"title\":\"Top 10 Query Types\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"30\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| summarize count() by Protocol\",\"size\":0,\"title\":\"Directory Events Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"categoricalbar\"},\"customWidth\":\"40\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| summarize count() by AccountDomain\",\"size\":0,\"title\":\"Directory Events Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 6 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| where isnotempty(AccountUpn)\\r\\n| summarize count() by AccountUpn\\r\\n| order by count_ desc \\r\\n| take 10\",\"size\":0,\"title\":\"Top 10 Accounts Activity\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"30\",\"name\":\"query - 6 - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpOverview\"},\"name\":\"grpOverview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| where LogonType == \\\"Resource access\\\"\\r\\n| extend FROM_DEVICE_ = tostring(AdditionalFields.[\\\"FROM.DEVICE\\\"])\\r\\n| extend TO_DEVICE_ = tostring(AdditionalFields.[\\\"TO.DEVICE\\\"])\\r\\n| extend Count_ = toint(AdditionalFields.Count)\\r\\n| summarize sum(Count_) by FROM_DEVICE_, TO_DEVICE_\\r\\n| order by sum_Count_ desc\",\"size\":0,\"title\":\"Resource Access Summary in Devices\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sum_Count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"45\",\"name\":\"query - 0\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| where LogonType == \\\"Resource access\\\"\\r\\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\\r\\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\\r\\n| extend Count_ = toint(AdditionalFields.Count)\\r\\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\\r\\n| order by sum_Count_ desc\",\"size\":0,\"title\":\"Resource Access Summary in OS\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sum_Count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"45\",\"name\":\"query - 0 - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| where LogonType == \\\"Credentials validation\\\"\\r\\n| extend FROM_DEVICE = tostring(AdditionalFields.[\\\"FROM.DEVICE\\\"])\\r\\n| extend TO_DEVICE = tostring(AdditionalFields.[\\\"TO.DEVICE\\\"])\\r\\n| extend Count = toint(AdditionalFields.Count)\\r\\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\\r\\n| order by sum_Count desc\",\"size\":0,\"title\":\"Credentials validation Summary in Devices\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sum_Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"45\",\"name\":\"query - 0 - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = IdentityLogonEvents\\r\\n| where LogonType == \\\"Credentials validation\\\"\\r\\n| extend TO_DEVICE = tostring(AdditionalFields.[\\\"TO.DEVICE\\\"])\\r\\n| extend Count = toint(AdditionalFields.Count);\\r\\ndata\\r\\n| summarize sum(Count) by  TO_DEVICE\\r\\n| order by sum_Count desc\\r\\n| join kind=inner\\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by TO_DEVICE\\r\\n)\\r\\non $left.TO_DEVICE == $right.TO_DEVICE\",\"size\":0,\"title\":\"Credentials validation by Domain Controllers\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sum_Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TO_DEVICE1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":10,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"45\",\"name\":\"query - 0 - Copy - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = IdentityLogonEvents;\\r\\ndata\\r\\n| extend Count = toint(AdditionalFields.Count)\\r\\n| summarize LogonSuccess = sumif(Count,ActionType == \\\"LogonSuccess\\\"),LogonFailed= sumif(Count,ActionType == \\\"LogonFailed\\\") by AccountUpn\\r\\n| join kind = inner\\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\\r\\n) on $left.AccountUpn == $right.AccountUpn\",\"size\":0,\"title\":\"Logon Summary by Users\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogonSuccess\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"LogonFailed\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redPurple\"}},{\"columnMatch\":\"AccountUpn1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 0 - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpLogOnEvents\"},\"name\":\"AttachmentGroup\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = IdentityQueryEvents\\r\\n| extend TO_DEVICE = tostring(AdditionalFields.[\\\"TO.DEVICE\\\"]);\\r\\ndata\\r\\n| summarize count() by QueryType, TO_DEVICE\\r\\n| join kind =inner \\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by QueryType, TO_DEVICE\\r\\n) on $left.QueryType == $right.QueryType and $left.TO_DEVICE== $right.TO_DEVICE\",\"size\":0,\"title\":\"Device Query Summary\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TO_DEVICE\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"QueryType1\",\"formatter\":5},{\"columnMatch\":\"TO_DEVICE1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"TO_DEVICE\"],\"expandTopLevel\":true}}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = IdentityQueryEvents;\\r\\ndata\\r\\n| summarize count() by DeviceName\\r\\n| join kind =inner \\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\\r\\n) on $left.DeviceName == $right.DeviceName\",\"size\":0,\"title\":\"Query Summary from Source Devices\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DeviceName1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 0 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpQueryEvents\"},\"name\":\"UrlGroup\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActionType \",\"size\":0,\"title\":\"Timeline on ActionType\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| summarize count() by ActionType \\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Top 10 Actions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"categoricalbar\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationPort\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\",\"size\":0,\"title\":\"Account Trend on Directory Events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationPort\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 0 - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpDirectoryEvents\"},\"name\":\"group - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = SecurityAlert\\r\\n| where ProductName == \\\"Azure Advanced Threat Protection\\\"\\r\\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\\r\\ndata\\r\\n| summarize count() by AlertName\\r\\n| join kind=inner \\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\\r\\n) on AlertName\",\"size\":0,\"noDataMessage\":\"Alerts\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"AlertName1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = SecurityAlert\\r\\n| where ProductName == \\\"Azure Advanced Threat Protection\\\"\\r\\n| summarize arg_max(TimeGenerated,*) by SystemAlertId\\r\\n| mv-expand todynamic(Entities)\\r\\n| where Entities[\\\"Type\\\"] == \\\"host\\\"\\r\\n| where isnotempty(Entities[\\\"HostName\\\"])\\r\\n| extend HostName = tostring(Entities[\\\"HostName\\\"]);\\r\\ndata\\r\\n| summarize count() by HostName\\r\\n| join kind=inner \\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by HostName\\r\\n) on $left.HostName == $right.HostName\",\"size\":0,\"title\":\"Impacted Hosts\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"HostName1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}]}},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpAlerts\"},\"name\":\"group - 8\"}],\"fromTemplateId\":\"sentinel-MicrosoftDefenderForIdentity\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
-                "version": "1.0",
-                "sourceId": "[variables('workspaceResourceId')]",
-                "category": "sentinel"
-              }
-            },
-            {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2022-01-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId3'),'/'))))]",
-              "properties": {
-                "description": "@{workbookKey=MicrosoftDefenderForIdentity; logoFileName=Azure_Sentinel.svg; description=Use this workbook to analyse the advance hunting data ingested for Defender For Identity.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Defender For Identity; templateRelativePath=MicrosoftDefenderForIdentity.json; subtitle=; provider=Microsoft Sentinel Community}.description",
-                "parentId": "[variables('workbookId3')]",
-                "contentId": "[variables('_workbookContentId3')]",
-                "kind": "Workbook",
-                "version": "[variables('workbookVersion3')]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                },
-                "dependencies": {
-                  "operator": "AND",
-                  "criteria": [
-                    {
-                      "contentId": "IdentityLogonEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "IdentityQueryEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "IdentityDirectoryEvents",
-                      "kind": "DataType"
-                    },
-                    {
-                      "contentId": "SecurityAlert",
-                      "kind": "DataType"
-                    }
-                  ]
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('_workbookContentId3')]",
-        "contentKind": "Workbook",
-        "displayName": "[parameters('workbook3-name')]",
-        "contentProductId": "[variables('_workbookcontentProductId3')]",
-        "id": "[variables('_workbookcontentProductId3')]",
-        "version": "[variables('workbookVersion3')]"
-      }
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
-      "apiVersion": "2023-04-01-preview",
-      "location": "[parameters('workspace-location')]",
-      "properties": {
-        "version": "3.0.18",
-        "kind": "Solution",
-        "contentSchemaVersion": "3.0.0",
-        "displayName": "Microsoft Defender XDR",
-        "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
-        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20XDR/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The <a href=\"https://www.microsoft.com/security/business/threat-protection/microsoft-365-defender\">Microsoft Defender XDR</a> solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.</p>\n<p>Additional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender\">GitHub</a>. This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.</p>\n<p><strong>Underlying Microsoft Technologies used:</strong></p>\n<p>This solution takes a dependency on the following technologies, and some of these dependencies either may be in <a href=\"https://azure.microsoft.com/support/legal/preview-supplemental-terms/\">Preview</a> state or might result in additional ingestion or operational costs:</p>\n<ol type=\"a\">\n<li><a href=\"https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api\">Azure Monitor HTTP Data Collector API</a></li>\n</ol>\n<p><strong>Data Connectors:</strong> 1, <strong>Workbooks:</strong> 3, <strong>Analytic Rules:</strong> 40, <strong>Hunting Queries:</strong> 387</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
-        "contentKind": "Solution",
-        "contentProductId": "[variables('_solutioncontentProductId')]",
-        "id": "[variables('_solutioncontentProductId')]",
-        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
-        "contentId": "[variables('_solutionId')]",
-        "parentId": "[variables('_solutionId')]",
-        "source": {
-          "kind": "Solution",
-          "name": "Microsoft Defender XDR",
-          "sourceId": "[variables('_solutionId')]"
-        },
-        "author": {
-          "name": "Microsoft",
-          "email": "[variables('_email')]"
-        },
-        "support": {
-          "name": "Microsoft Corporation",
-          "email": "support@microsoft.com",
-          "tier": "Microsoft",
-          "link": "https://support.microsoft.com"
-        },
-        "dependencies": {
-          "operator": "AND",
-          "criteria": [
-            {
-              "kind": "DataConnector",
-              "contentId": "[variables('_dataConnectorContentId1')]",
-              "version": "[variables('dataConnectorVersion1')]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
-              "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
-              "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
-              "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
-              "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
-              "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
-              "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
-              "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
-              "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
-              "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
-              "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
-              "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
-              "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
-              "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
-              "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
-              "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
-              "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
-              "version": "[variables('analyticRuleObject17').analyticRuleVersion17]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
-              "version": "[variables('analyticRuleObject18').analyticRuleVersion18]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
-              "version": "[variables('analyticRuleObject19').analyticRuleVersion19]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]",
-              "version": "[variables('analyticRuleObject20').analyticRuleVersion20]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]",
-              "version": "[variables('analyticRuleObject21').analyticRuleVersion21]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]",
-              "version": "[variables('analyticRuleObject22').analyticRuleVersion22]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]",
-              "version": "[variables('analyticRuleObject23').analyticRuleVersion23]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]",
-              "version": "[variables('analyticRuleObject24').analyticRuleVersion24]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]",
-              "version": "[variables('analyticRuleObject25').analyticRuleVersion25]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]",
-              "version": "[variables('analyticRuleObject26').analyticRuleVersion26]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]",
-              "version": "[variables('analyticRuleObject27').analyticRuleVersion27]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]",
-              "version": "[variables('analyticRuleObject28').analyticRuleVersion28]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]",
-              "version": "[variables('analyticRuleObject29').analyticRuleVersion29]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]",
-              "version": "[variables('analyticRuleObject30').analyticRuleVersion30]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]",
-              "version": "[variables('analyticRuleObject31').analyticRuleVersion31]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]",
-              "version": "[variables('analyticRuleObject32').analyticRuleVersion32]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]",
-              "version": "[variables('analyticRuleObject33').analyticRuleVersion33]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]",
-              "version": "[variables('analyticRuleObject34').analyticRuleVersion34]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]",
-              "version": "[variables('analyticRuleObject35').analyticRuleVersion35]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]",
-              "version": "[variables('analyticRuleObject36').analyticRuleVersion36]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]",
-              "version": "[variables('analyticRuleObject37').analyticRuleVersion37]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]",
-              "version": "[variables('analyticRuleObject38').analyticRuleVersion38]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]",
-              "version": "[variables('analyticRuleObject39').analyticRuleVersion39]"
-            },
-            {
-              "kind": "AnalyticsRule",
-              "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]",
-              "version": "[variables('analyticRuleObject40').analyticRuleVersion40]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
-              "version": "[variables('huntingQueryObject1').huntingQueryVersion1]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
-              "version": "[variables('huntingQueryObject2').huntingQueryVersion2]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
-              "version": "[variables('huntingQueryObject3').huntingQueryVersion3]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
-              "version": "[variables('huntingQueryObject4').huntingQueryVersion4]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
-              "version": "[variables('huntingQueryObject5').huntingQueryVersion5]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
-              "version": "[variables('huntingQueryObject6').huntingQueryVersion6]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
-              "version": "[variables('huntingQueryObject7').huntingQueryVersion7]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
-              "version": "[variables('huntingQueryObject8').huntingQueryVersion8]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
-              "version": "[variables('huntingQueryObject9').huntingQueryVersion9]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
-              "version": "[variables('huntingQueryObject10').huntingQueryVersion10]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
-              "version": "[variables('huntingQueryObject11').huntingQueryVersion11]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
-              "version": "[variables('huntingQueryObject12').huntingQueryVersion12]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
-              "version": "[variables('huntingQueryObject13').huntingQueryVersion13]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
-              "version": "[variables('huntingQueryObject14').huntingQueryVersion14]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
-              "version": "[variables('huntingQueryObject15').huntingQueryVersion15]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
-              "version": "[variables('huntingQueryObject16').huntingQueryVersion16]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
-              "version": "[variables('huntingQueryObject17').huntingQueryVersion17]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
-              "version": "[variables('huntingQueryObject18').huntingQueryVersion18]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
-              "version": "[variables('huntingQueryObject19').huntingQueryVersion19]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
-              "version": "[variables('huntingQueryObject20').huntingQueryVersion20]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
-              "version": "[variables('huntingQueryObject21').huntingQueryVersion21]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject22')._huntingQuerycontentId22]",
-              "version": "[variables('huntingQueryObject22').huntingQueryVersion22]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject23')._huntingQuerycontentId23]",
-              "version": "[variables('huntingQueryObject23').huntingQueryVersion23]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject24')._huntingQuerycontentId24]",
-              "version": "[variables('huntingQueryObject24').huntingQueryVersion24]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject25')._huntingQuerycontentId25]",
-              "version": "[variables('huntingQueryObject25').huntingQueryVersion25]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject26')._huntingQuerycontentId26]",
-              "version": "[variables('huntingQueryObject26').huntingQueryVersion26]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject27')._huntingQuerycontentId27]",
-              "version": "[variables('huntingQueryObject27').huntingQueryVersion27]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject28')._huntingQuerycontentId28]",
-              "version": "[variables('huntingQueryObject28').huntingQueryVersion28]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject29')._huntingQuerycontentId29]",
-              "version": "[variables('huntingQueryObject29').huntingQueryVersion29]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject30')._huntingQuerycontentId30]",
-              "version": "[variables('huntingQueryObject30').huntingQueryVersion30]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject31')._huntingQuerycontentId31]",
-              "version": "[variables('huntingQueryObject31').huntingQueryVersion31]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject32')._huntingQuerycontentId32]",
-              "version": "[variables('huntingQueryObject32').huntingQueryVersion32]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject33')._huntingQuerycontentId33]",
-              "version": "[variables('huntingQueryObject33').huntingQueryVersion33]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject34')._huntingQuerycontentId34]",
-              "version": "[variables('huntingQueryObject34').huntingQueryVersion34]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject35')._huntingQuerycontentId35]",
-              "version": "[variables('huntingQueryObject35').huntingQueryVersion35]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject36')._huntingQuerycontentId36]",
-              "version": "[variables('huntingQueryObject36').huntingQueryVersion36]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject37')._huntingQuerycontentId37]",
-              "version": "[variables('huntingQueryObject37').huntingQueryVersion37]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject38')._huntingQuerycontentId38]",
-              "version": "[variables('huntingQueryObject38').huntingQueryVersion38]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject39')._huntingQuerycontentId39]",
-              "version": "[variables('huntingQueryObject39').huntingQueryVersion39]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject40')._huntingQuerycontentId40]",
-              "version": "[variables('huntingQueryObject40').huntingQueryVersion40]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject41')._huntingQuerycontentId41]",
-              "version": "[variables('huntingQueryObject41').huntingQueryVersion41]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject42')._huntingQuerycontentId42]",
-              "version": "[variables('huntingQueryObject42').huntingQueryVersion42]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject43')._huntingQuerycontentId43]",
-              "version": "[variables('huntingQueryObject43').huntingQueryVersion43]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject44')._huntingQuerycontentId44]",
-              "version": "[variables('huntingQueryObject44').huntingQueryVersion44]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject45')._huntingQuerycontentId45]",
-              "version": "[variables('huntingQueryObject45').huntingQueryVersion45]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject46')._huntingQuerycontentId46]",
-              "version": "[variables('huntingQueryObject46').huntingQueryVersion46]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject47')._huntingQuerycontentId47]",
-              "version": "[variables('huntingQueryObject47').huntingQueryVersion47]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject48')._huntingQuerycontentId48]",
-              "version": "[variables('huntingQueryObject48').huntingQueryVersion48]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject49')._huntingQuerycontentId49]",
-              "version": "[variables('huntingQueryObject49').huntingQueryVersion49]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject50')._huntingQuerycontentId50]",
-              "version": "[variables('huntingQueryObject50').huntingQueryVersion50]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject51')._huntingQuerycontentId51]",
-              "version": "[variables('huntingQueryObject51').huntingQueryVersion51]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject52')._huntingQuerycontentId52]",
-              "version": "[variables('huntingQueryObject52').huntingQueryVersion52]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject53')._huntingQuerycontentId53]",
-              "version": "[variables('huntingQueryObject53').huntingQueryVersion53]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject54')._huntingQuerycontentId54]",
-              "version": "[variables('huntingQueryObject54').huntingQueryVersion54]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject55')._huntingQuerycontentId55]",
-              "version": "[variables('huntingQueryObject55').huntingQueryVersion55]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject56')._huntingQuerycontentId56]",
-              "version": "[variables('huntingQueryObject56').huntingQueryVersion56]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject57')._huntingQuerycontentId57]",
-              "version": "[variables('huntingQueryObject57').huntingQueryVersion57]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject58')._huntingQuerycontentId58]",
-              "version": "[variables('huntingQueryObject58').huntingQueryVersion58]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject59')._huntingQuerycontentId59]",
-              "version": "[variables('huntingQueryObject59').huntingQueryVersion59]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject60')._huntingQuerycontentId60]",
-              "version": "[variables('huntingQueryObject60').huntingQueryVersion60]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject61')._huntingQuerycontentId61]",
-              "version": "[variables('huntingQueryObject61').huntingQueryVersion61]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject62')._huntingQuerycontentId62]",
-              "version": "[variables('huntingQueryObject62').huntingQueryVersion62]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject63')._huntingQuerycontentId63]",
-              "version": "[variables('huntingQueryObject63').huntingQueryVersion63]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject64')._huntingQuerycontentId64]",
-              "version": "[variables('huntingQueryObject64').huntingQueryVersion64]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject65')._huntingQuerycontentId65]",
-              "version": "[variables('huntingQueryObject65').huntingQueryVersion65]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject66')._huntingQuerycontentId66]",
-              "version": "[variables('huntingQueryObject66').huntingQueryVersion66]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject67')._huntingQuerycontentId67]",
-              "version": "[variables('huntingQueryObject67').huntingQueryVersion67]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject68')._huntingQuerycontentId68]",
-              "version": "[variables('huntingQueryObject68').huntingQueryVersion68]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject69')._huntingQuerycontentId69]",
-              "version": "[variables('huntingQueryObject69').huntingQueryVersion69]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject70')._huntingQuerycontentId70]",
-              "version": "[variables('huntingQueryObject70').huntingQueryVersion70]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject71')._huntingQuerycontentId71]",
-              "version": "[variables('huntingQueryObject71').huntingQueryVersion71]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject72')._huntingQuerycontentId72]",
-              "version": "[variables('huntingQueryObject72').huntingQueryVersion72]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject73')._huntingQuerycontentId73]",
-              "version": "[variables('huntingQueryObject73').huntingQueryVersion73]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject74')._huntingQuerycontentId74]",
-              "version": "[variables('huntingQueryObject74').huntingQueryVersion74]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject75')._huntingQuerycontentId75]",
-              "version": "[variables('huntingQueryObject75').huntingQueryVersion75]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject76')._huntingQuerycontentId76]",
-              "version": "[variables('huntingQueryObject76').huntingQueryVersion76]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject77')._huntingQuerycontentId77]",
-              "version": "[variables('huntingQueryObject77').huntingQueryVersion77]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject78')._huntingQuerycontentId78]",
-              "version": "[variables('huntingQueryObject78').huntingQueryVersion78]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject79')._huntingQuerycontentId79]",
-              "version": "[variables('huntingQueryObject79').huntingQueryVersion79]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject80')._huntingQuerycontentId80]",
-              "version": "[variables('huntingQueryObject80').huntingQueryVersion80]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject81')._huntingQuerycontentId81]",
-              "version": "[variables('huntingQueryObject81').huntingQueryVersion81]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject82')._huntingQuerycontentId82]",
-              "version": "[variables('huntingQueryObject82').huntingQueryVersion82]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject83')._huntingQuerycontentId83]",
-              "version": "[variables('huntingQueryObject83').huntingQueryVersion83]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject84')._huntingQuerycontentId84]",
-              "version": "[variables('huntingQueryObject84').huntingQueryVersion84]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject85')._huntingQuerycontentId85]",
-              "version": "[variables('huntingQueryObject85').huntingQueryVersion85]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject86')._huntingQuerycontentId86]",
-              "version": "[variables('huntingQueryObject86').huntingQueryVersion86]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject87')._huntingQuerycontentId87]",
-              "version": "[variables('huntingQueryObject87').huntingQueryVersion87]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject88')._huntingQuerycontentId88]",
-              "version": "[variables('huntingQueryObject88').huntingQueryVersion88]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject89')._huntingQuerycontentId89]",
-              "version": "[variables('huntingQueryObject89').huntingQueryVersion89]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject90')._huntingQuerycontentId90]",
-              "version": "[variables('huntingQueryObject90').huntingQueryVersion90]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject91')._huntingQuerycontentId91]",
-              "version": "[variables('huntingQueryObject91').huntingQueryVersion91]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject92')._huntingQuerycontentId92]",
-              "version": "[variables('huntingQueryObject92').huntingQueryVersion92]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject93')._huntingQuerycontentId93]",
-              "version": "[variables('huntingQueryObject93').huntingQueryVersion93]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject94')._huntingQuerycontentId94]",
-              "version": "[variables('huntingQueryObject94').huntingQueryVersion94]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject95')._huntingQuerycontentId95]",
-              "version": "[variables('huntingQueryObject95').huntingQueryVersion95]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject96')._huntingQuerycontentId96]",
-              "version": "[variables('huntingQueryObject96').huntingQueryVersion96]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject97')._huntingQuerycontentId97]",
-              "version": "[variables('huntingQueryObject97').huntingQueryVersion97]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject98')._huntingQuerycontentId98]",
-              "version": "[variables('huntingQueryObject98').huntingQueryVersion98]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject99')._huntingQuerycontentId99]",
-              "version": "[variables('huntingQueryObject99').huntingQueryVersion99]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject100')._huntingQuerycontentId100]",
-              "version": "[variables('huntingQueryObject100').huntingQueryVersion100]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject101')._huntingQuerycontentId101]",
-              "version": "[variables('huntingQueryObject101').huntingQueryVersion101]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject102')._huntingQuerycontentId102]",
-              "version": "[variables('huntingQueryObject102').huntingQueryVersion102]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject103')._huntingQuerycontentId103]",
-              "version": "[variables('huntingQueryObject103').huntingQueryVersion103]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject104')._huntingQuerycontentId104]",
-              "version": "[variables('huntingQueryObject104').huntingQueryVersion104]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject105')._huntingQuerycontentId105]",
-              "version": "[variables('huntingQueryObject105').huntingQueryVersion105]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject106')._huntingQuerycontentId106]",
-              "version": "[variables('huntingQueryObject106').huntingQueryVersion106]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject107')._huntingQuerycontentId107]",
-              "version": "[variables('huntingQueryObject107').huntingQueryVersion107]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject108')._huntingQuerycontentId108]",
-              "version": "[variables('huntingQueryObject108').huntingQueryVersion108]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject109')._huntingQuerycontentId109]",
-              "version": "[variables('huntingQueryObject109').huntingQueryVersion109]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject110')._huntingQuerycontentId110]",
-              "version": "[variables('huntingQueryObject110').huntingQueryVersion110]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject111')._huntingQuerycontentId111]",
-              "version": "[variables('huntingQueryObject111').huntingQueryVersion111]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject112')._huntingQuerycontentId112]",
-              "version": "[variables('huntingQueryObject112').huntingQueryVersion112]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject113')._huntingQuerycontentId113]",
-              "version": "[variables('huntingQueryObject113').huntingQueryVersion113]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject114')._huntingQuerycontentId114]",
-              "version": "[variables('huntingQueryObject114').huntingQueryVersion114]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject115')._huntingQuerycontentId115]",
-              "version": "[variables('huntingQueryObject115').huntingQueryVersion115]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject116')._huntingQuerycontentId116]",
-              "version": "[variables('huntingQueryObject116').huntingQueryVersion116]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject117')._huntingQuerycontentId117]",
-              "version": "[variables('huntingQueryObject117').huntingQueryVersion117]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject118')._huntingQuerycontentId118]",
-              "version": "[variables('huntingQueryObject118').huntingQueryVersion118]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject119')._huntingQuerycontentId119]",
-              "version": "[variables('huntingQueryObject119').huntingQueryVersion119]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject120')._huntingQuerycontentId120]",
-              "version": "[variables('huntingQueryObject120').huntingQueryVersion120]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject121')._huntingQuerycontentId121]",
-              "version": "[variables('huntingQueryObject121').huntingQueryVersion121]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject122')._huntingQuerycontentId122]",
-              "version": "[variables('huntingQueryObject122').huntingQueryVersion122]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject123')._huntingQuerycontentId123]",
-              "version": "[variables('huntingQueryObject123').huntingQueryVersion123]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject124')._huntingQuerycontentId124]",
-              "version": "[variables('huntingQueryObject124').huntingQueryVersion124]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject125')._huntingQuerycontentId125]",
-              "version": "[variables('huntingQueryObject125').huntingQueryVersion125]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject126')._huntingQuerycontentId126]",
-              "version": "[variables('huntingQueryObject126').huntingQueryVersion126]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject127')._huntingQuerycontentId127]",
-              "version": "[variables('huntingQueryObject127').huntingQueryVersion127]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject128')._huntingQuerycontentId128]",
-              "version": "[variables('huntingQueryObject128').huntingQueryVersion128]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject129')._huntingQuerycontentId129]",
-              "version": "[variables('huntingQueryObject129').huntingQueryVersion129]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject130')._huntingQuerycontentId130]",
-              "version": "[variables('huntingQueryObject130').huntingQueryVersion130]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject131')._huntingQuerycontentId131]",
-              "version": "[variables('huntingQueryObject131').huntingQueryVersion131]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject132')._huntingQuerycontentId132]",
-              "version": "[variables('huntingQueryObject132').huntingQueryVersion132]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject133')._huntingQuerycontentId133]",
-              "version": "[variables('huntingQueryObject133').huntingQueryVersion133]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject134')._huntingQuerycontentId134]",
-              "version": "[variables('huntingQueryObject134').huntingQueryVersion134]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject135')._huntingQuerycontentId135]",
-              "version": "[variables('huntingQueryObject135').huntingQueryVersion135]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject136')._huntingQuerycontentId136]",
-              "version": "[variables('huntingQueryObject136').huntingQueryVersion136]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject137')._huntingQuerycontentId137]",
-              "version": "[variables('huntingQueryObject137').huntingQueryVersion137]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject138')._huntingQuerycontentId138]",
-              "version": "[variables('huntingQueryObject138').huntingQueryVersion138]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject139')._huntingQuerycontentId139]",
-              "version": "[variables('huntingQueryObject139').huntingQueryVersion139]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject140')._huntingQuerycontentId140]",
-              "version": "[variables('huntingQueryObject140').huntingQueryVersion140]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject141')._huntingQuerycontentId141]",
-              "version": "[variables('huntingQueryObject141').huntingQueryVersion141]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject142')._huntingQuerycontentId142]",
-              "version": "[variables('huntingQueryObject142').huntingQueryVersion142]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject143')._huntingQuerycontentId143]",
-              "version": "[variables('huntingQueryObject143').huntingQueryVersion143]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject144')._huntingQuerycontentId144]",
-              "version": "[variables('huntingQueryObject144').huntingQueryVersion144]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject145')._huntingQuerycontentId145]",
-              "version": "[variables('huntingQueryObject145').huntingQueryVersion145]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject146')._huntingQuerycontentId146]",
-              "version": "[variables('huntingQueryObject146').huntingQueryVersion146]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject147')._huntingQuerycontentId147]",
-              "version": "[variables('huntingQueryObject147').huntingQueryVersion147]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject148')._huntingQuerycontentId148]",
-              "version": "[variables('huntingQueryObject148').huntingQueryVersion148]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject149')._huntingQuerycontentId149]",
-              "version": "[variables('huntingQueryObject149').huntingQueryVersion149]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject150')._huntingQuerycontentId150]",
-              "version": "[variables('huntingQueryObject150').huntingQueryVersion150]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject151')._huntingQuerycontentId151]",
-              "version": "[variables('huntingQueryObject151').huntingQueryVersion151]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject152')._huntingQuerycontentId152]",
-              "version": "[variables('huntingQueryObject152').huntingQueryVersion152]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject153')._huntingQuerycontentId153]",
-              "version": "[variables('huntingQueryObject153').huntingQueryVersion153]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject154')._huntingQuerycontentId154]",
-              "version": "[variables('huntingQueryObject154').huntingQueryVersion154]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject155')._huntingQuerycontentId155]",
-              "version": "[variables('huntingQueryObject155').huntingQueryVersion155]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject156')._huntingQuerycontentId156]",
-              "version": "[variables('huntingQueryObject156').huntingQueryVersion156]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject157')._huntingQuerycontentId157]",
-              "version": "[variables('huntingQueryObject157').huntingQueryVersion157]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject158')._huntingQuerycontentId158]",
-              "version": "[variables('huntingQueryObject158').huntingQueryVersion158]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject159')._huntingQuerycontentId159]",
-              "version": "[variables('huntingQueryObject159').huntingQueryVersion159]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject160')._huntingQuerycontentId160]",
-              "version": "[variables('huntingQueryObject160').huntingQueryVersion160]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject161')._huntingQuerycontentId161]",
-              "version": "[variables('huntingQueryObject161').huntingQueryVersion161]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject162')._huntingQuerycontentId162]",
-              "version": "[variables('huntingQueryObject162').huntingQueryVersion162]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject163')._huntingQuerycontentId163]",
-              "version": "[variables('huntingQueryObject163').huntingQueryVersion163]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject164')._huntingQuerycontentId164]",
-              "version": "[variables('huntingQueryObject164').huntingQueryVersion164]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject165')._huntingQuerycontentId165]",
-              "version": "[variables('huntingQueryObject165').huntingQueryVersion165]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject166')._huntingQuerycontentId166]",
-              "version": "[variables('huntingQueryObject166').huntingQueryVersion166]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject167')._huntingQuerycontentId167]",
-              "version": "[variables('huntingQueryObject167').huntingQueryVersion167]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject168')._huntingQuerycontentId168]",
-              "version": "[variables('huntingQueryObject168').huntingQueryVersion168]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject169')._huntingQuerycontentId169]",
-              "version": "[variables('huntingQueryObject169').huntingQueryVersion169]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject170')._huntingQuerycontentId170]",
-              "version": "[variables('huntingQueryObject170').huntingQueryVersion170]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject171')._huntingQuerycontentId171]",
-              "version": "[variables('huntingQueryObject171').huntingQueryVersion171]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject172')._huntingQuerycontentId172]",
-              "version": "[variables('huntingQueryObject172').huntingQueryVersion172]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject173')._huntingQuerycontentId173]",
-              "version": "[variables('huntingQueryObject173').huntingQueryVersion173]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject174')._huntingQuerycontentId174]",
-              "version": "[variables('huntingQueryObject174').huntingQueryVersion174]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject175')._huntingQuerycontentId175]",
-              "version": "[variables('huntingQueryObject175').huntingQueryVersion175]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject176')._huntingQuerycontentId176]",
-              "version": "[variables('huntingQueryObject176').huntingQueryVersion176]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject177')._huntingQuerycontentId177]",
-              "version": "[variables('huntingQueryObject177').huntingQueryVersion177]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject178')._huntingQuerycontentId178]",
-              "version": "[variables('huntingQueryObject178').huntingQueryVersion178]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject179')._huntingQuerycontentId179]",
-              "version": "[variables('huntingQueryObject179').huntingQueryVersion179]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject180')._huntingQuerycontentId180]",
-              "version": "[variables('huntingQueryObject180').huntingQueryVersion180]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject181')._huntingQuerycontentId181]",
-              "version": "[variables('huntingQueryObject181').huntingQueryVersion181]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject182')._huntingQuerycontentId182]",
-              "version": "[variables('huntingQueryObject182').huntingQueryVersion182]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject183')._huntingQuerycontentId183]",
-              "version": "[variables('huntingQueryObject183').huntingQueryVersion183]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject184')._huntingQuerycontentId184]",
-              "version": "[variables('huntingQueryObject184').huntingQueryVersion184]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject185')._huntingQuerycontentId185]",
-              "version": "[variables('huntingQueryObject185').huntingQueryVersion185]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject186')._huntingQuerycontentId186]",
-              "version": "[variables('huntingQueryObject186').huntingQueryVersion186]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject187')._huntingQuerycontentId187]",
-              "version": "[variables('huntingQueryObject187').huntingQueryVersion187]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject188')._huntingQuerycontentId188]",
-              "version": "[variables('huntingQueryObject188').huntingQueryVersion188]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject189')._huntingQuerycontentId189]",
-              "version": "[variables('huntingQueryObject189').huntingQueryVersion189]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject190')._huntingQuerycontentId190]",
-              "version": "[variables('huntingQueryObject190').huntingQueryVersion190]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject191')._huntingQuerycontentId191]",
-              "version": "[variables('huntingQueryObject191').huntingQueryVersion191]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject192')._huntingQuerycontentId192]",
-              "version": "[variables('huntingQueryObject192').huntingQueryVersion192]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject193')._huntingQuerycontentId193]",
-              "version": "[variables('huntingQueryObject193').huntingQueryVersion193]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject194')._huntingQuerycontentId194]",
-              "version": "[variables('huntingQueryObject194').huntingQueryVersion194]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject195')._huntingQuerycontentId195]",
-              "version": "[variables('huntingQueryObject195').huntingQueryVersion195]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject196')._huntingQuerycontentId196]",
-              "version": "[variables('huntingQueryObject196').huntingQueryVersion196]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject197')._huntingQuerycontentId197]",
-              "version": "[variables('huntingQueryObject197').huntingQueryVersion197]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject198')._huntingQuerycontentId198]",
-              "version": "[variables('huntingQueryObject198').huntingQueryVersion198]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject199')._huntingQuerycontentId199]",
-              "version": "[variables('huntingQueryObject199').huntingQueryVersion199]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject200')._huntingQuerycontentId200]",
-              "version": "[variables('huntingQueryObject200').huntingQueryVersion200]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject201')._huntingQuerycontentId201]",
-              "version": "[variables('huntingQueryObject201').huntingQueryVersion201]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject202')._huntingQuerycontentId202]",
-              "version": "[variables('huntingQueryObject202').huntingQueryVersion202]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject203')._huntingQuerycontentId203]",
-              "version": "[variables('huntingQueryObject203').huntingQueryVersion203]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject204')._huntingQuerycontentId204]",
-              "version": "[variables('huntingQueryObject204').huntingQueryVersion204]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject205')._huntingQuerycontentId205]",
-              "version": "[variables('huntingQueryObject205').huntingQueryVersion205]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject206')._huntingQuerycontentId206]",
-              "version": "[variables('huntingQueryObject206').huntingQueryVersion206]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject207')._huntingQuerycontentId207]",
-              "version": "[variables('huntingQueryObject207').huntingQueryVersion207]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject208')._huntingQuerycontentId208]",
-              "version": "[variables('huntingQueryObject208').huntingQueryVersion208]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject209')._huntingQuerycontentId209]",
-              "version": "[variables('huntingQueryObject209').huntingQueryVersion209]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject210')._huntingQuerycontentId210]",
-              "version": "[variables('huntingQueryObject210').huntingQueryVersion210]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject211')._huntingQuerycontentId211]",
-              "version": "[variables('huntingQueryObject211').huntingQueryVersion211]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject212')._huntingQuerycontentId212]",
-              "version": "[variables('huntingQueryObject212').huntingQueryVersion212]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject213')._huntingQuerycontentId213]",
-              "version": "[variables('huntingQueryObject213').huntingQueryVersion213]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject214')._huntingQuerycontentId214]",
-              "version": "[variables('huntingQueryObject214').huntingQueryVersion214]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject215')._huntingQuerycontentId215]",
-              "version": "[variables('huntingQueryObject215').huntingQueryVersion215]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject216')._huntingQuerycontentId216]",
-              "version": "[variables('huntingQueryObject216').huntingQueryVersion216]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject217')._huntingQuerycontentId217]",
-              "version": "[variables('huntingQueryObject217').huntingQueryVersion217]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject218')._huntingQuerycontentId218]",
-              "version": "[variables('huntingQueryObject218').huntingQueryVersion218]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject219')._huntingQuerycontentId219]",
-              "version": "[variables('huntingQueryObject219').huntingQueryVersion219]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject220')._huntingQuerycontentId220]",
-              "version": "[variables('huntingQueryObject220').huntingQueryVersion220]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject221')._huntingQuerycontentId221]",
-              "version": "[variables('huntingQueryObject221').huntingQueryVersion221]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject222')._huntingQuerycontentId222]",
-              "version": "[variables('huntingQueryObject222').huntingQueryVersion222]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject223')._huntingQuerycontentId223]",
-              "version": "[variables('huntingQueryObject223').huntingQueryVersion223]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject224')._huntingQuerycontentId224]",
-              "version": "[variables('huntingQueryObject224').huntingQueryVersion224]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject225')._huntingQuerycontentId225]",
-              "version": "[variables('huntingQueryObject225').huntingQueryVersion225]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject226')._huntingQuerycontentId226]",
-              "version": "[variables('huntingQueryObject226').huntingQueryVersion226]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject227')._huntingQuerycontentId227]",
-              "version": "[variables('huntingQueryObject227').huntingQueryVersion227]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject228')._huntingQuerycontentId228]",
-              "version": "[variables('huntingQueryObject228').huntingQueryVersion228]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject229')._huntingQuerycontentId229]",
-              "version": "[variables('huntingQueryObject229').huntingQueryVersion229]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject230')._huntingQuerycontentId230]",
-              "version": "[variables('huntingQueryObject230').huntingQueryVersion230]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject231')._huntingQuerycontentId231]",
-              "version": "[variables('huntingQueryObject231').huntingQueryVersion231]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject232')._huntingQuerycontentId232]",
-              "version": "[variables('huntingQueryObject232').huntingQueryVersion232]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject233')._huntingQuerycontentId233]",
-              "version": "[variables('huntingQueryObject233').huntingQueryVersion233]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject234')._huntingQuerycontentId234]",
-              "version": "[variables('huntingQueryObject234').huntingQueryVersion234]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject235')._huntingQuerycontentId235]",
-              "version": "[variables('huntingQueryObject235').huntingQueryVersion235]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject236')._huntingQuerycontentId236]",
-              "version": "[variables('huntingQueryObject236').huntingQueryVersion236]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject237')._huntingQuerycontentId237]",
-              "version": "[variables('huntingQueryObject237').huntingQueryVersion237]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject238')._huntingQuerycontentId238]",
-              "version": "[variables('huntingQueryObject238').huntingQueryVersion238]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject239')._huntingQuerycontentId239]",
-              "version": "[variables('huntingQueryObject239').huntingQueryVersion239]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject240')._huntingQuerycontentId240]",
-              "version": "[variables('huntingQueryObject240').huntingQueryVersion240]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject241')._huntingQuerycontentId241]",
-              "version": "[variables('huntingQueryObject241').huntingQueryVersion241]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject242')._huntingQuerycontentId242]",
-              "version": "[variables('huntingQueryObject242').huntingQueryVersion242]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject243')._huntingQuerycontentId243]",
-              "version": "[variables('huntingQueryObject243').huntingQueryVersion243]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject244')._huntingQuerycontentId244]",
-              "version": "[variables('huntingQueryObject244').huntingQueryVersion244]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject245')._huntingQuerycontentId245]",
-              "version": "[variables('huntingQueryObject245').huntingQueryVersion245]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject246')._huntingQuerycontentId246]",
-              "version": "[variables('huntingQueryObject246').huntingQueryVersion246]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject247')._huntingQuerycontentId247]",
-              "version": "[variables('huntingQueryObject247').huntingQueryVersion247]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject248')._huntingQuerycontentId248]",
-              "version": "[variables('huntingQueryObject248').huntingQueryVersion248]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject249')._huntingQuerycontentId249]",
-              "version": "[variables('huntingQueryObject249').huntingQueryVersion249]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject250')._huntingQuerycontentId250]",
-              "version": "[variables('huntingQueryObject250').huntingQueryVersion250]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject251')._huntingQuerycontentId251]",
-              "version": "[variables('huntingQueryObject251').huntingQueryVersion251]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject252')._huntingQuerycontentId252]",
-              "version": "[variables('huntingQueryObject252').huntingQueryVersion252]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject253')._huntingQuerycontentId253]",
-              "version": "[variables('huntingQueryObject253').huntingQueryVersion253]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject254')._huntingQuerycontentId254]",
-              "version": "[variables('huntingQueryObject254').huntingQueryVersion254]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject255')._huntingQuerycontentId255]",
-              "version": "[variables('huntingQueryObject255').huntingQueryVersion255]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject256')._huntingQuerycontentId256]",
-              "version": "[variables('huntingQueryObject256').huntingQueryVersion256]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject257')._huntingQuerycontentId257]",
-              "version": "[variables('huntingQueryObject257').huntingQueryVersion257]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject258')._huntingQuerycontentId258]",
-              "version": "[variables('huntingQueryObject258').huntingQueryVersion258]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject259')._huntingQuerycontentId259]",
-              "version": "[variables('huntingQueryObject259').huntingQueryVersion259]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject260')._huntingQuerycontentId260]",
-              "version": "[variables('huntingQueryObject260').huntingQueryVersion260]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject261')._huntingQuerycontentId261]",
-              "version": "[variables('huntingQueryObject261').huntingQueryVersion261]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject262')._huntingQuerycontentId262]",
-              "version": "[variables('huntingQueryObject262').huntingQueryVersion262]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject263')._huntingQuerycontentId263]",
-              "version": "[variables('huntingQueryObject263').huntingQueryVersion263]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject264')._huntingQuerycontentId264]",
-              "version": "[variables('huntingQueryObject264').huntingQueryVersion264]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject265')._huntingQuerycontentId265]",
-              "version": "[variables('huntingQueryObject265').huntingQueryVersion265]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject266')._huntingQuerycontentId266]",
-              "version": "[variables('huntingQueryObject266').huntingQueryVersion266]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject267')._huntingQuerycontentId267]",
-              "version": "[variables('huntingQueryObject267').huntingQueryVersion267]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject268')._huntingQuerycontentId268]",
-              "version": "[variables('huntingQueryObject268').huntingQueryVersion268]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject269')._huntingQuerycontentId269]",
-              "version": "[variables('huntingQueryObject269').huntingQueryVersion269]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject270')._huntingQuerycontentId270]",
-              "version": "[variables('huntingQueryObject270').huntingQueryVersion270]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject271')._huntingQuerycontentId271]",
-              "version": "[variables('huntingQueryObject271').huntingQueryVersion271]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject272')._huntingQuerycontentId272]",
-              "version": "[variables('huntingQueryObject272').huntingQueryVersion272]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject273')._huntingQuerycontentId273]",
-              "version": "[variables('huntingQueryObject273').huntingQueryVersion273]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject274')._huntingQuerycontentId274]",
-              "version": "[variables('huntingQueryObject274').huntingQueryVersion274]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject275')._huntingQuerycontentId275]",
-              "version": "[variables('huntingQueryObject275').huntingQueryVersion275]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject276')._huntingQuerycontentId276]",
-              "version": "[variables('huntingQueryObject276').huntingQueryVersion276]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject277')._huntingQuerycontentId277]",
-              "version": "[variables('huntingQueryObject277').huntingQueryVersion277]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject278')._huntingQuerycontentId278]",
-              "version": "[variables('huntingQueryObject278').huntingQueryVersion278]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject279')._huntingQuerycontentId279]",
-              "version": "[variables('huntingQueryObject279').huntingQueryVersion279]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject280')._huntingQuerycontentId280]",
-              "version": "[variables('huntingQueryObject280').huntingQueryVersion280]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject281')._huntingQuerycontentId281]",
-              "version": "[variables('huntingQueryObject281').huntingQueryVersion281]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject282')._huntingQuerycontentId282]",
-              "version": "[variables('huntingQueryObject282').huntingQueryVersion282]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject283')._huntingQuerycontentId283]",
-              "version": "[variables('huntingQueryObject283').huntingQueryVersion283]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject284')._huntingQuerycontentId284]",
-              "version": "[variables('huntingQueryObject284').huntingQueryVersion284]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject285')._huntingQuerycontentId285]",
-              "version": "[variables('huntingQueryObject285').huntingQueryVersion285]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject286')._huntingQuerycontentId286]",
-              "version": "[variables('huntingQueryObject286').huntingQueryVersion286]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject287')._huntingQuerycontentId287]",
-              "version": "[variables('huntingQueryObject287').huntingQueryVersion287]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject288')._huntingQuerycontentId288]",
-              "version": "[variables('huntingQueryObject288').huntingQueryVersion288]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject289')._huntingQuerycontentId289]",
-              "version": "[variables('huntingQueryObject289').huntingQueryVersion289]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject290')._huntingQuerycontentId290]",
-              "version": "[variables('huntingQueryObject290').huntingQueryVersion290]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject291')._huntingQuerycontentId291]",
-              "version": "[variables('huntingQueryObject291').huntingQueryVersion291]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject292')._huntingQuerycontentId292]",
-              "version": "[variables('huntingQueryObject292').huntingQueryVersion292]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject293')._huntingQuerycontentId293]",
-              "version": "[variables('huntingQueryObject293').huntingQueryVersion293]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject294')._huntingQuerycontentId294]",
-              "version": "[variables('huntingQueryObject294').huntingQueryVersion294]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject295')._huntingQuerycontentId295]",
-              "version": "[variables('huntingQueryObject295').huntingQueryVersion295]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject296')._huntingQuerycontentId296]",
-              "version": "[variables('huntingQueryObject296').huntingQueryVersion296]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject297')._huntingQuerycontentId297]",
-              "version": "[variables('huntingQueryObject297').huntingQueryVersion297]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject298')._huntingQuerycontentId298]",
-              "version": "[variables('huntingQueryObject298').huntingQueryVersion298]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject299')._huntingQuerycontentId299]",
-              "version": "[variables('huntingQueryObject299').huntingQueryVersion299]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject300')._huntingQuerycontentId300]",
-              "version": "[variables('huntingQueryObject300').huntingQueryVersion300]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject301')._huntingQuerycontentId301]",
-              "version": "[variables('huntingQueryObject301').huntingQueryVersion301]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject302')._huntingQuerycontentId302]",
-              "version": "[variables('huntingQueryObject302').huntingQueryVersion302]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject303')._huntingQuerycontentId303]",
-              "version": "[variables('huntingQueryObject303').huntingQueryVersion303]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject304')._huntingQuerycontentId304]",
-              "version": "[variables('huntingQueryObject304').huntingQueryVersion304]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject305')._huntingQuerycontentId305]",
-              "version": "[variables('huntingQueryObject305').huntingQueryVersion305]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject306')._huntingQuerycontentId306]",
-              "version": "[variables('huntingQueryObject306').huntingQueryVersion306]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject307')._huntingQuerycontentId307]",
-              "version": "[variables('huntingQueryObject307').huntingQueryVersion307]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject308')._huntingQuerycontentId308]",
-              "version": "[variables('huntingQueryObject308').huntingQueryVersion308]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject309')._huntingQuerycontentId309]",
-              "version": "[variables('huntingQueryObject309').huntingQueryVersion309]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject310')._huntingQuerycontentId310]",
-              "version": "[variables('huntingQueryObject310').huntingQueryVersion310]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject311')._huntingQuerycontentId311]",
-              "version": "[variables('huntingQueryObject311').huntingQueryVersion311]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject312')._huntingQuerycontentId312]",
-              "version": "[variables('huntingQueryObject312').huntingQueryVersion312]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject313')._huntingQuerycontentId313]",
-              "version": "[variables('huntingQueryObject313').huntingQueryVersion313]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject314')._huntingQuerycontentId314]",
-              "version": "[variables('huntingQueryObject314').huntingQueryVersion314]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject315')._huntingQuerycontentId315]",
-              "version": "[variables('huntingQueryObject315').huntingQueryVersion315]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject316')._huntingQuerycontentId316]",
-              "version": "[variables('huntingQueryObject316').huntingQueryVersion316]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject317')._huntingQuerycontentId317]",
-              "version": "[variables('huntingQueryObject317').huntingQueryVersion317]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject318')._huntingQuerycontentId318]",
-              "version": "[variables('huntingQueryObject318').huntingQueryVersion318]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject319')._huntingQuerycontentId319]",
-              "version": "[variables('huntingQueryObject319').huntingQueryVersion319]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject320')._huntingQuerycontentId320]",
-              "version": "[variables('huntingQueryObject320').huntingQueryVersion320]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject321')._huntingQuerycontentId321]",
-              "version": "[variables('huntingQueryObject321').huntingQueryVersion321]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject322')._huntingQuerycontentId322]",
-              "version": "[variables('huntingQueryObject322').huntingQueryVersion322]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject323')._huntingQuerycontentId323]",
-              "version": "[variables('huntingQueryObject323').huntingQueryVersion323]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject324')._huntingQuerycontentId324]",
-              "version": "[variables('huntingQueryObject324').huntingQueryVersion324]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject325')._huntingQuerycontentId325]",
-              "version": "[variables('huntingQueryObject325').huntingQueryVersion325]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject326')._huntingQuerycontentId326]",
-              "version": "[variables('huntingQueryObject326').huntingQueryVersion326]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject327')._huntingQuerycontentId327]",
-              "version": "[variables('huntingQueryObject327').huntingQueryVersion327]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject328')._huntingQuerycontentId328]",
-              "version": "[variables('huntingQueryObject328').huntingQueryVersion328]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject329')._huntingQuerycontentId329]",
-              "version": "[variables('huntingQueryObject329').huntingQueryVersion329]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject330')._huntingQuerycontentId330]",
-              "version": "[variables('huntingQueryObject330').huntingQueryVersion330]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject331')._huntingQuerycontentId331]",
-              "version": "[variables('huntingQueryObject331').huntingQueryVersion331]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject332')._huntingQuerycontentId332]",
-              "version": "[variables('huntingQueryObject332').huntingQueryVersion332]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject333')._huntingQuerycontentId333]",
-              "version": "[variables('huntingQueryObject333').huntingQueryVersion333]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject334')._huntingQuerycontentId334]",
-              "version": "[variables('huntingQueryObject334').huntingQueryVersion334]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject335')._huntingQuerycontentId335]",
-              "version": "[variables('huntingQueryObject335').huntingQueryVersion335]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject336')._huntingQuerycontentId336]",
-              "version": "[variables('huntingQueryObject336').huntingQueryVersion336]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject337')._huntingQuerycontentId337]",
-              "version": "[variables('huntingQueryObject337').huntingQueryVersion337]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject338')._huntingQuerycontentId338]",
-              "version": "[variables('huntingQueryObject338').huntingQueryVersion338]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject339')._huntingQuerycontentId339]",
-              "version": "[variables('huntingQueryObject339').huntingQueryVersion339]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject340')._huntingQuerycontentId340]",
-              "version": "[variables('huntingQueryObject340').huntingQueryVersion340]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject341')._huntingQuerycontentId341]",
-              "version": "[variables('huntingQueryObject341').huntingQueryVersion341]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject342')._huntingQuerycontentId342]",
-              "version": "[variables('huntingQueryObject342').huntingQueryVersion342]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject343')._huntingQuerycontentId343]",
-              "version": "[variables('huntingQueryObject343').huntingQueryVersion343]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject344')._huntingQuerycontentId344]",
-              "version": "[variables('huntingQueryObject344').huntingQueryVersion344]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject345')._huntingQuerycontentId345]",
-              "version": "[variables('huntingQueryObject345').huntingQueryVersion345]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject346')._huntingQuerycontentId346]",
-              "version": "[variables('huntingQueryObject346').huntingQueryVersion346]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject347')._huntingQuerycontentId347]",
-              "version": "[variables('huntingQueryObject347').huntingQueryVersion347]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject348')._huntingQuerycontentId348]",
-              "version": "[variables('huntingQueryObject348').huntingQueryVersion348]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject349')._huntingQuerycontentId349]",
-              "version": "[variables('huntingQueryObject349').huntingQueryVersion349]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject350')._huntingQuerycontentId350]",
-              "version": "[variables('huntingQueryObject350').huntingQueryVersion350]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject351')._huntingQuerycontentId351]",
-              "version": "[variables('huntingQueryObject351').huntingQueryVersion351]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject352')._huntingQuerycontentId352]",
-              "version": "[variables('huntingQueryObject352').huntingQueryVersion352]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject353')._huntingQuerycontentId353]",
-              "version": "[variables('huntingQueryObject353').huntingQueryVersion353]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject354')._huntingQuerycontentId354]",
-              "version": "[variables('huntingQueryObject354').huntingQueryVersion354]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject355')._huntingQuerycontentId355]",
-              "version": "[variables('huntingQueryObject355').huntingQueryVersion355]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject356')._huntingQuerycontentId356]",
-              "version": "[variables('huntingQueryObject356').huntingQueryVersion356]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject357')._huntingQuerycontentId357]",
-              "version": "[variables('huntingQueryObject357').huntingQueryVersion357]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject358')._huntingQuerycontentId358]",
-              "version": "[variables('huntingQueryObject358').huntingQueryVersion358]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject359')._huntingQuerycontentId359]",
-              "version": "[variables('huntingQueryObject359').huntingQueryVersion359]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject360')._huntingQuerycontentId360]",
-              "version": "[variables('huntingQueryObject360').huntingQueryVersion360]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject361')._huntingQuerycontentId361]",
-              "version": "[variables('huntingQueryObject361').huntingQueryVersion361]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject362')._huntingQuerycontentId362]",
-              "version": "[variables('huntingQueryObject362').huntingQueryVersion362]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject363')._huntingQuerycontentId363]",
-              "version": "[variables('huntingQueryObject363').huntingQueryVersion363]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject364')._huntingQuerycontentId364]",
-              "version": "[variables('huntingQueryObject364').huntingQueryVersion364]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject365')._huntingQuerycontentId365]",
-              "version": "[variables('huntingQueryObject365').huntingQueryVersion365]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject366')._huntingQuerycontentId366]",
-              "version": "[variables('huntingQueryObject366').huntingQueryVersion366]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject367')._huntingQuerycontentId367]",
-              "version": "[variables('huntingQueryObject367').huntingQueryVersion367]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject368')._huntingQuerycontentId368]",
-              "version": "[variables('huntingQueryObject368').huntingQueryVersion368]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject369')._huntingQuerycontentId369]",
-              "version": "[variables('huntingQueryObject369').huntingQueryVersion369]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject370')._huntingQuerycontentId370]",
-              "version": "[variables('huntingQueryObject370').huntingQueryVersion370]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject371')._huntingQuerycontentId371]",
-              "version": "[variables('huntingQueryObject371').huntingQueryVersion371]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject372')._huntingQuerycontentId372]",
-              "version": "[variables('huntingQueryObject372').huntingQueryVersion372]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject373')._huntingQuerycontentId373]",
-              "version": "[variables('huntingQueryObject373').huntingQueryVersion373]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject374')._huntingQuerycontentId374]",
-              "version": "[variables('huntingQueryObject374').huntingQueryVersion374]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject375')._huntingQuerycontentId375]",
-              "version": "[variables('huntingQueryObject375').huntingQueryVersion375]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject376')._huntingQuerycontentId376]",
-              "version": "[variables('huntingQueryObject376').huntingQueryVersion376]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject377')._huntingQuerycontentId377]",
-              "version": "[variables('huntingQueryObject377').huntingQueryVersion377]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject378')._huntingQuerycontentId378]",
-              "version": "[variables('huntingQueryObject378').huntingQueryVersion378]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject379')._huntingQuerycontentId379]",
-              "version": "[variables('huntingQueryObject379').huntingQueryVersion379]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject380')._huntingQuerycontentId380]",
-              "version": "[variables('huntingQueryObject380').huntingQueryVersion380]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject381')._huntingQuerycontentId381]",
-              "version": "[variables('huntingQueryObject381').huntingQueryVersion381]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject382')._huntingQuerycontentId382]",
-              "version": "[variables('huntingQueryObject382').huntingQueryVersion382]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject383')._huntingQuerycontentId383]",
-              "version": "[variables('huntingQueryObject383').huntingQueryVersion383]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject384')._huntingQuerycontentId384]",
-              "version": "[variables('huntingQueryObject384').huntingQueryVersion384]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject385')._huntingQuerycontentId385]",
-              "version": "[variables('huntingQueryObject385').huntingQueryVersion385]"
-            },
-            {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject386')._huntingQuerycontentId386]",
-              "version": "[variables('huntingQueryObject386').huntingQueryVersion386]"
+                "id": "8f47d55b-34a6-5d13-a89f-315b1a2a4f53",
+                "name": "MicrosoftDefenderForOffice365detectionsandinsights",
+                "content": {
+                  "version": "Notebook/1.0",
+                  "items": [
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "\n<table style=\"width:100%; border-collapse:collapse; border:none;\">\n  <tr style=\"border:none;\">\n    <td style=\"text-align:left; border:none; font-size:28px; font-weight:bold;width:1%;\">\n      Microsoft Defender for Office 365 Detections and Insights\n    </td>\n    <td style=\"text-align:right; border:none;width:1%;\">\n      <img height=\"40\" src=\"https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b\">\n\t</td>\n  </tr>\n</table>\n<table>\n<tr>\n<td style=\"text-align:left; border:none; font-size:16px; width:10%;\">This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.<br>It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.<br> The workbook uses data from hunting tables streamed from <a href=\"https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables\">Microsoft Defender XDR</a> via the Microsoft Sentinel Connector. Keep the data in the <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/configure-data-retention\">Log Analytics workspace</a> for as long as necessary to get insights over an extended period, based on your organisation's needs.</td>\n</tr>\n</table>\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n\n\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view."
+                      },
+                      "name": "text - 2",
+                      "id": "d2b45ab8-a1c1-43d2-853d-290640bf4c94"
+                    },
+                    {
+                      "type": 9,
+                      "content": {
+                        "version": "KqlParameterItem/1.0",
+                        "parameters": [
+                          {
+                            "id": "2e238f92-709c-410b-93e0-60eab6150a75",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "TimeRange",
+                            "type": 4,
+                            "isRequired": true,
+                            "isGlobal": true,
+                            "typeSettings": {
+                              "selectableValues": [
+                                {
+                                  "durationMs": 3600000
+                                },
+                                {
+                                  "durationMs": 14400000
+                                },
+                                {
+                                  "durationMs": 43200000
+                                },
+                                {
+                                  "durationMs": 86400000
+                                },
+                                {
+                                  "durationMs": 172800000
+                                },
+                                {
+                                  "durationMs": 259200000
+                                },
+                                {
+                                  "durationMs": 604800000
+                                },
+                                {
+                                  "durationMs": 1209600000
+                                },
+                                {
+                                  "durationMs": 2592000000
+                                },
+                                {
+                                  "durationMs": 5184000000
+                                },
+                                {
+                                  "durationMs": 7776000000
+                                }
+                              ],
+                              "allowCustom": true
+                            },
+                            "timeContext": {
+                              "durationMs": 86400000
+                            },
+                            "value": {
+                              "durationMs": 7776000000
+                            },
+                            "key": "2e238f92-709c-410b-93e0-60eab6150a75"
+                          },
+                          {
+                            "id": "165f2f4a-e49f-4561-adc5-d0527a4caf32",
+                            "version": "KqlParameterItem/1.0",
+                            "name": "Granularity",
+                            "label": "Trend interval",
+                            "type": 2,
+                            "isRequired": true,
+                            "typeSettings": {
+                              "additionalResourceOptions": [],
+                              "showDefault": false
+                            },
+                            "jsonData": "[[{ \"value\": \"1d\", \"label\": \"Daily (1d)\", \"selected\": true }, { \"value\": \"7d\", \"label\": \"Weekly (7d)\" }, { \"value\": \"30d\", \"label\": \"Monthly (30d)\" }, { \"value\": \"90d\", \"label\": \"Quarterly (90d)\" }]",
+                            "timeContext": {
+                              "durationMs": 86400000
+                            },
+                            "value": "1d"
+                          }
+                        ],
+                        "style": "pills"
+                      },
+                      "name": "parameters - 1",
+                      "id": "0021e733-42b4-461f-8f6c-14e6e765389d"
+                    },
+                    {
+                      "type": 11,
+                      "content": {
+                        "version": "LinkItem/1.0",
+                        "style": "tabs",
+                        "links": [
+                          {
+                            "id": "3d26d949-bba8-486c-9af7-2b85bd5c8ab0",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Executive Summary",
+                            "subTarget": "1",
+                            "style": "link",
+                            "key": "3d26d949-bba8-486c-9af7-2b85bd5c8ab0"
+                          },
+                          {
+                            "id": "a5f95467-84c1-4d8b-858c-7819339af748",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Malware",
+                            "subTarget": "2",
+                            "style": "link",
+                            "key": "a5f95467-84c1-4d8b-858c-7819339af748"
+                          },
+                          {
+                            "id": "b6c93de8-16d9-4c90-999b-837935de5645",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Phish",
+                            "subTarget": "3",
+                            "style": "link",
+                            "key": "b6c93de8-16d9-4c90-999b-837935de5645"
+                          },
+                          {
+                            "id": "9e006e81-4fd4-40b9-9d20-3705dd6c17ad",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Impersonation & BEC",
+                            "subTarget": "15",
+                            "style": "link",
+                            "key": "75f1e28f-e95a-4810-af40-6b47b35cda46"
+                          },
+                          {
+                            "id": "df2c53b4-b6ed-4151-95fb-b3f08b849b84",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Spam",
+                            "subTarget": "4",
+                            "style": "link",
+                            "key": "df2c53b4-b6ed-4151-95fb-b3f08b849b84"
+                          },
+                          {
+                            "id": "fd2006c9-39b5-43ac-b05d-47309ee22deb",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Teams & Collaboration",
+                            "subTarget": "14",
+                            "style": "link",
+                            "key": "fd2006c9-39b5-43ac-b05d-47309ee22deb"
+                          },
+                          {
+                            "id": "ee01f95a-c5f7-4864-82e8-54a164741ba2",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "File - Malware (SharePoint, Teams and OneDrive)",
+                            "subTarget": "9",
+                            "style": "link",
+                            "key": "ee01f95a-c5f7-4864-82e8-54a164741ba2"
+                          },
+                          {
+                            "id": "9df30067-3266-48a8-b9e3-d65952098d46",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "URL & Clicks",
+                            "subTarget": "5",
+                            "style": "link",
+                            "key": "9df30067-3266-48a8-b9e3-d65952098d46"
+                          },
+                          {
+                            "id": "b4be0ac3-3f48-44a8-b4b6-b46e17c710cd",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Top Users & Exfiltration",
+                            "subTarget": "6",
+                            "style": "link",
+                            "key": "b4be0ac3-3f48-44a8-b4b6-b46e17c710cd"
+                          },
+                          {
+                            "id": "e1d34091-7b3c-4e2d-a032-8be82a989313",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Email - Detection Overrides",
+                            "subTarget": "7",
+                            "style": "link",
+                            "key": "e1d34091-7b3c-4e2d-a032-8be82a989313"
+                          },
+                          {
+                            "id": "a1e6264d-8f85-4a94-9ffd-eee36c04a0d5",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Post-Delivery & Quarantine",
+                            "subTarget": "11",
+                            "style": "link",
+                            "key": "a1e6264d-8f85-4a94-9ffd-eee36c04a0d5"
+                          },
+                          {
+                            "id": "08c43a4f-f502-4813-9b8d-3f6b0b62b2fd",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "False Negative(FN) Submissions",
+                            "subTarget": "8",
+                            "style": "link",
+                            "key": "08c43a4f-f502-4813-9b8d-3f6b0b62b2fd"
+                          },
+                          {
+                            "id": "638d931f-f319-4914-b72d-8d68e914c7d4",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "False Positive(FP) Submissions",
+                            "subTarget": "10",
+                            "style": "link",
+                            "key": "638d931f-f319-4914-b72d-8d68e914c7d4"
+                          },
+                          {
+                            "id": "b2920bee-c32a-4fdd-9d32-b004db2f3ac8",
+                            "cellValue": "Tab",
+                            "linkTarget": "parameter",
+                            "linkLabel": "Security Operations Center (SOC) Insights",
+                            "subTarget": "13",
+                            "style": "link",
+                            "key": "b2920bee-c32a-4fdd-9d32-b004db2f3ac8"
+                          }
+                        ]
+                      },
+                      "name": "links - 14",
+                      "id": "5c9a1d6b-c248-432b-a1c0-496337635775"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Defender for Office 365 - Protection Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Microsoft Defender for Office 365** is a comprehensive security solution designed to protect organizations from advanced threats targeting their email and collaboration tools. It leverages a multi-layered approach to safeguard against phishing, malware, business email compromise (BEC), and other sophisticated attacks.\r\n"
+                                  },
+                                  "name": "text - 13",
+                                  "styleSettings": {
+                                    "margin": "0",
+                                    "padding": "0"
+                                  },
+                                  "id": "46119f93-fad9-413c-8e10-7615c6fdde2f"
+                                },
+                                {
+                                  "type": 12,
+                                  "content": {
+                                    "version": "NotebookGroup/1.0",
+                                    "groupType": "editable",
+                                    "items": [
+                                      {
+                                        "type": 3,
+                                        "content": {
+                                          "version": "KqlItem/1.0",
+                                          "query": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n    // this alteration is due to the threat types being updated directly within advanced hunting.\r\n    //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n    | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n    | extend MDO_detection = parse_json(DetectionMethods) \r\n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n    EmailPostDeliveryEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n    | summarize arg_max(Timestamp, *) by Key \r\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n    CloudAppEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n    | where ActionType == \"AdminSubmissionSubmitted\" \r\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n    | where SubmissionType in (\"1\", \"2\") \r\n    | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n    EmailEventsThreats \r\n    | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n    CloudAppEventsFiltered \r\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n    ); \r\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\n\r\nprint StatisticName=\"Effectiveness Post Delivery\", Value=abs(round(((toreal(toscalar(FN_Admin_Submissions))+toreal(toscalar(FN_ZAP_Unsuccessful)))/(toreal(toscalar(Mal_Phish_Mailflow))+toreal(toscalar(FN_ZAP_Successful))+toreal(toscalar(FN_ZAP_Unsuccessful))+toreal(toscalar(FN_Admin_Submissions))-toreal(toscalar(FP_ZAP)))*100-100),2))",
+                                          "size": 1,
+                                          "showAnalytics": true,
+                                          "timeContextFromParameter": "TimeRange",
+                                          "queryType": "advancedHunting",
+                                          "visualization": "stat",
+                                          "tileSettings": {
+                                            "showBorder": false,
+                                            "titleContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "leftContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 12,
+                                              "formatOptions": {
+                                                "palette": "auto"
+                                              },
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "graphSettings": {
+                                            "type": 0,
+                                            "topContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "centerContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 1,
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "statSettings": {
+                                            "valueField": "Value",
+                                            "valueAggregation": "None",
+                                            "colorSettings": {
+                                              "type": "thresholds",
+                                              "mode": "foreground",
+                                              "heatmapPalette": "greenRed",
+                                              "thresholdsGrid": [
+                                                {
+                                                  "operator": ">",
+                                                  "thresholdValue": "95",
+                                                  "representation": "green"
+                                                },
+                                                {
+                                                  "operator": "<=",
+                                                  "thresholdValue": "95",
+                                                  "representation": "orange"
+                                                },
+                                                {
+                                                  "operator": "<=",
+                                                  "thresholdValue": "90",
+                                                  "representation": "red"
+                                                }
+                                              ]
+                                            },
+                                            "iconSettings": {
+                                              "thresholdsGrid": []
+                                            },
+                                            "numberFormatSettings": {
+                                              "unit": 1,
+                                              "options": {
+                                                "style": "decimal"
+                                              }
+                                            },
+                                            "tagText": "Phish / Malware Effectiveness - Post Delivery",
+                                            "valueFontStyle": "superLarge",
+                                            "tagTextPosition": "bottom"
+                                          }
+                                        },
+                                        "customWidth": "50",
+                                        "name": "query - 5",
+                                        "id": "62de2a91-a809-48ec-a111-e697d556b2b3"
+                                      },
+                                      {
+                                        "type": 3,
+                                        "content": {
+                                          "version": "KqlItem/1.0",
+                                          "query": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))",
+                                          "size": 1,
+                                          "showAnalytics": true,
+                                          "timeContextFromParameter": "TimeRange",
+                                          "queryType": "advancedHunting",
+                                          "visualization": "stat",
+                                          "tileSettings": {
+                                            "titleContent": {
+                                              "columnMatch": "Release_Percentage",
+                                              "formatter": 12,
+                                              "formatOptions": {
+                                                "palette": "none"
+                                              },
+                                              "numberFormat": {
+                                                "unit": 1,
+                                                "options": {
+                                                  "style": "decimal"
+                                                }
+                                              }
+                                            },
+                                            "showBorder": true,
+                                            "sortCriteriaField": "Release_Percentage",
+                                            "size": "auto"
+                                          },
+                                          "graphSettings": {
+                                            "type": 0,
+                                            "topContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "centerContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 1,
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "statSettings": {
+                                            "valueField": "Release_Percentage",
+                                            "valueAggregation": "None",
+                                            "colorSettings": {
+                                              "type": "thresholds",
+                                              "mode": "foreground",
+                                              "heatmapPalette": "greenRed",
+                                              "thresholdsGrid": [
+                                                {
+                                                  "operator": "<",
+                                                  "thresholdValue": "5",
+                                                  "representation": "green"
+                                                },
+                                                {
+                                                  "operator": ">",
+                                                  "thresholdValue": "5",
+                                                  "representation": "redDark"
+                                                }
+                                              ]
+                                            },
+                                            "iconSettings": {
+                                              "thresholdsGrid": []
+                                            },
+                                            "numberFormatSettings": {
+                                              "unit": 1,
+                                              "options": {
+                                                "style": "decimal"
+                                              }
+                                            },
+                                            "tagText": "Quarantine Release Percentage",
+                                            "valueFontStyle": "superLarge",
+                                            "tagTextPosition": "bottom"
+                                          }
+                                        },
+                                        "customWidth": "50",
+                                        "name": "query - 1",
+                                        "id": "858ac1a4-8828-45e9-968c-d3cfc1216c64"
+                                      }
+                                    ]
+                                  },
+                                  "name": "TopNr",
+                                  "id": "1369c97e-848b-475a-b447-3a435cb7a1f1"
+                                },
+                                {
+                                  "type": 12,
+                                  "content": {
+                                    "version": "NotebookGroup/1.0",
+                                    "groupType": "editable",
+                                    "items": [
+                                      {
+                                        "type": 1,
+                                        "content": {
+                                          "json": "**Effectiveness visually represents the protection given by Defender for Office 365 against phishing and malware in email messages.** <br>\r\nWe consider messages that your users report, as well as decisions that are made after delivery."
+                                        },
+                                        "name": "text - 9",
+                                        "styleSettings": {
+                                          "margin": "1px"
+                                        },
+                                        "id": "25e2e19e-aefb-4e37-b28f-b4138d63e109"
+                                      },
+                                      {
+                                        "type": 3,
+                                        "content": {
+                                          "version": "KqlItem/1.0",
+                                          "query": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n    // this alteration is due to the threat types being updated directly within advanced hunting.\r\n    //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n    | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n    | extend MDO_detection = parse_json(DetectionMethods) \r\n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n    EmailPostDeliveryEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n    | summarize arg_max(Timestamp, *) by Key \r\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n    CloudAppEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n    | where ActionType == \"AdminSubmissionSubmitted\" \r\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n    | where SubmissionType in (\"1\", \"2\") \r\n    | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n    EmailEventsThreats \r\n    | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n    CloudAppEventsFiltered \r\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n    ); \r\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\nunion withsource=Table \r\n    (print StatisticName=\"Mal/Phish Mailflow totals - Minus FPs\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \r\n    (print StatisticName=\"Admin Mal/Phish FNs Submitted\", Value=toreal(FN_Admin_Submissions)), \r\n    (print StatisticName=\"Mal/Phish FPs Reverse Zapped\", Value=toreal(FP_ZAP)), \r\n    (print StatisticName=\"Mal / Phish Successfully Zapped\", Value=toreal(FN_ZAP_Successful)), \r\n    (print StatisticName=\"Mal / Phish UN-Successfully Zapped\", Value=toreal(FN_ZAP_Unsuccessful)), \r\n    (print StatisticName=\"Effectiveness Post Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \r\n    (print StatisticName=\"Effectiveness Pre-Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))) \r\n| project StatisticName, Value",
+                                          "size": 0,
+                                          "showAnalytics": true,
+                                          "timeContextFromParameter": "TimeRange",
+                                          "queryType": "advancedHunting",
+                                          "visualization": "table",
+                                          "gridSettings": {
+                                            "formatters": [
+                                              {
+                                                "columnMatch": "Value",
+                                                "formatter": 0,
+                                                "numberFormat": {
+                                                  "unit": 17,
+                                                  "options": {
+                                                    "style": "decimal"
+                                                  }
+                                                }
+                                              }
+                                            ]
+                                          },
+                                          "tileSettings": {
+                                            "showBorder": false,
+                                            "titleContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "leftContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 12,
+                                              "formatOptions": {
+                                                "palette": "auto"
+                                              },
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "graphSettings": {
+                                            "type": 2,
+                                            "topContent": {
+                                              "columnMatch": "StatisticName",
+                                              "formatter": 1
+                                            },
+                                            "centerContent": {
+                                              "columnMatch": "Value",
+                                              "formatter": 1,
+                                              "numberFormat": {
+                                                "unit": 17,
+                                                "options": {
+                                                  "maximumSignificantDigits": 3,
+                                                  "maximumFractionDigits": 2
+                                                }
+                                              }
+                                            },
+                                            "nodeIdField": "StatisticName",
+                                            "sourceIdField": "Value",
+                                            "targetIdField": "Value",
+                                            "graphOrientation": 3,
+                                            "showOrientationToggles": false,
+                                            "nodeSize": null,
+                                            "staticNodeSize": 100,
+                                            "colorSettings": null,
+                                            "hivesMargin": 5,
+                                            "edgeColorSettings": null
+                                          }
+                                        },
+                                        "name": "query - 7",
+                                        "id": "9e09ff94-8092-49c7-860f-341049e1398c"
+                                      }
+                                    ]
+                                  },
+                                  "customWidth": "50",
+                                  "name": "Effectiveness Nr",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "31081a73-9a54-4668-9e26-ad7347f1e06e"
+                                },
+                                {
+                                  "type": 12,
+                                  "content": {
+                                    "version": "NotebookGroup/1.0",
+                                    "groupType": "editable",
+                                    "items": [
+                                      {
+                                        "type": 1,
+                                        "content": {
+                                          "json": "**Quarantine release rate by detection technology.** \r\n<br>\r\nFor each detector, the share of its quarantined mail that was later released (Release % = released / quarantined). A high rate can indicate false positives worth reviewing."
+                                        },
+                                        "name": "text - 1",
+                                        "styleSettings": {
+                                          "margin": "1px"
+                                        },
+                                        "id": "e9848043-03dd-4ada-9e73-238067463f74"
+                                      },
+                                      {
+                                        "type": 3,
+                                        "content": {
+                                          "version": "KqlItem/1.0",
+                                          "query": "//Per detection technology: the share of its quarantined emails later released from quarantine (a high rate can indicate false positives). Top 7 by release rate; detectors with <10 quarantined excluded so the rate is meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\"\r\n| join kind=leftouter (\r\n    EmailPostDeliveryEvents\r\n    | where Action == \"Quarantine release\"\r\n    | distinct NetworkMessageId\r\n    | extend ReleasedFlag = \"yes\"\r\n  ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Technology']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc\r\n| take 7",
+                                          "size": 0,
+                                          "showAnalytics": true,
+                                          "timeContextFromParameter": "TimeRange",
+                                          "queryType": "advancedHunting",
+                                          "visualization": "table",
+                                          "gridSettings": {
+                                            "formatters": [
+                                              {
+                                                "columnMatch": "Quarantined Emails",
+                                                "formatter": 0,
+                                                "formatOptions": {
+                                                  "customColumnWidthSetting": "130px"
+                                                },
+                                                "numberFormat": {
+                                                  "unit": 17,
+                                                  "options": {
+                                                    "style": "decimal",
+                                                    "maximumFractionDigits": 1
+                                                  }
+                                                }
+                                              },
+                                              {
+                                                "columnMatch": "Released",
+                                                "formatter": 3,
+                                                "formatOptions": {
+                                                  "palette": "redDark",
+                                                  "customColumnWidthSetting": "90px"
+                                                },
+                                                "numberFormat": {
+                                                  "unit": 17,
+                                                  "options": {
+                                                    "style": "decimal",
+                                                    "maximumFractionDigits": 1
+                                                  }
+                                                }
+                                              },
+                                              {
+                                                "columnMatch": "Release %",
+                                                "formatter": 4,
+                                                "formatOptions": {
+                                                  "palette": "red",
+                                                  "min": 0,
+                                                  "max": 20,
+                                                  "customColumnWidthSetting": "90px"
+                                                },
+                                                "numberFormat": {
+                                                  "unit": 1,
+                                                  "options": {
+                                                    "style": "decimal"
+                                                  }
+                                                }
+                                              }
+                                            ],
+                                            "filter": true
+                                          }
+                                        },
+                                        "name": "query - 2",
+                                        "id": "1bbae9d1-d6f8-446a-817c-8fdc2df83d4c"
+                                      }
+                                    ]
+                                  },
+                                  "customWidth": "50",
+                                  "name": "Quarantine Overview Relese",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "36fd8f20-ece7-4889-9fb1-f5b85b97b45a"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Protection Insights",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "1d8e22e0-22f7-453e-aed2-9e56ace1363a"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Protection details\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis Overview provides an executive summary of your Microsoft Defender for Office 365 email security posture: the volume of mail processed, threats detected and filtered (phishing, malware, spam), overall protection effectiveness, and the mix of threats targeting your organization. Use it as a starting point, then drill into the dedicated tabs for detailed investigation."
+                                  },
+                                  "name": "text - 13",
+                                  "id": "24cf577c-e12a-4747-95a7-1c19bee17397"
+                                },
+                                {
+                                  "type": 9,
+                                  "content": {
+                                    "version": "KqlParameterItem/1.0",
+                                    "parameters": [
+                                      {
+                                        "id": "5c0f0101-0a11-4b22-9c33-000000000101",
+                                        "version": "KqlParameterItem/1.0",
+                                        "name": "ProtectionView",
+                                        "label": "Protection view",
+                                        "type": 2,
+                                        "isRequired": true,
+                                        "typeSettings": {
+                                          "additionalResourceOptions": [],
+                                          "showDefault": false
+                                        },
+                                        "jsonData": "[[{ \"value\": \"Table\", \"label\": \"Summary table\", \"selected\": true }, { \"value\": \"Tiles\", \"label\": \"Detailed tiles\" }]",
+                                        "value": "Tiles"
+                                      }
+                                    ],
+                                    "style": "pills"
+                                  },
+                                  "name": "Protection view selector",
+                                  "id": "5c0f0102-0a11-4b22-9c33-000000000102"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "let base = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize arg_max(Timestamp, ThreatTypes, DeliveryAction, OrgLevelPolicy, OrgLevelAction, UserLevelAction) by Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress));\r\nlet agg = materialize(base | summarize\r\n    Total = count(),\r\n    Filtered = countif(isnotempty(ThreatTypes) and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FMal = countif(ThreatTypes has \"Malware\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FPhish = countif(ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FSpam = countif(ThreatTypes == \"Spam\" and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    Deliv = countif(isnotempty(ThreatTypes) and DeliveryAction == \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n    Blocked = countif(isempty(ThreatTypes) and DeliveryAction != \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n    Clean = countif(isempty(ThreatTypes) and DeliveryAction == \"Delivered\"));\r\nlet pd = materialize(EmailPostDeliveryEvents | where ActionResult == \"Success\" | summarize MalZap = countif(ActionType == \"Malware ZAP\"), PhishZap = countif(ActionType == \"Phish ZAP\"), SpamZap = countif(ActionType == \"Spam ZAP\"));\r\nlet sub = materialize(CloudAppEvents | extend R = tostring(parse_json(RawEventData).RecordType), SCT = tostring(parse_json(RawEventData).SubmissionContentType) | where R == \"29\" | summarize Adm = countif(ActionType == \"AdminSubmissionSubmitted\" and SCT == \"Mail\"), Usr = countif(ActionType == \"UserSubmission\"));\r\nlet Total = toscalar(agg | project Total);\r\nlet Filtered = toscalar(agg | project Filtered);\r\nlet FMal = toscalar(agg | project FMal);\r\nlet FPhish = toscalar(agg | project FPhish);\r\nlet FSpam = toscalar(agg | project FSpam);\r\nlet Deliv = toscalar(agg | project Deliv);\r\nlet Blocked = toscalar(agg | project Blocked);\r\nlet Clean = toscalar(agg | project Clean);\r\nlet MalZap = toscalar(pd | project MalZap);\r\nlet PhishZap = toscalar(pd | project PhishZap);\r\nlet SpamZap = toscalar(pd | project SpamZap);\r\nlet Adm = toscalar(sub | project Adm);\r\nlet Usr = toscalar(sub | project Usr);\r\nunion\r\n    (print o = 1, Name = \"Total Inbound Emails\", Count = Total),\r\n    (print o = 2, Name = \"    Filtering Totals\", Count = Filtered),\r\n    (print o = 3, Name = \"        Filtered as Malware\", Count = FMal),\r\n    (print o = 4, Name = \"        Filtered as Phish\", Count = FPhish),\r\n    (print o = 5, Name = \"        Filtered as Spam\", Count = FSpam),\r\n    (print o = 6, Name = \"    Delivered with Detection\", Count = Deliv),\r\n    (print o = 7, Name = \"    User/Admin Blocked\", Count = Blocked),\r\n    (print o = 8, Name = \"    Clean Emails\", Count = Clean),\r\n    (print o = 9, Name = \"Post-Delivery ZAP Removals\", Count = MalZap + PhishZap + SpamZap),\r\n    (print o = 10, Name = \"    Removed by Malware ZAP\", Count = MalZap),\r\n    (print o = 11, Name = \"    Removed by Phish ZAP\", Count = PhishZap),\r\n    (print o = 12, Name = \"    Removed by Spam ZAP\", Count = SpamZap),\r\n    (print o = 13, Name = \"User/Admin Reported\", Count = Adm + Usr),\r\n    (print o = 14, Name = \"    Reported by Admins\", Count = Adm),\r\n    (print o = 15, Name = \"    Reported by Users\", Count = Usr)\r\n| sort by o asc\r\n| extend [\"% of Inbound\"] = round(Count * 100.0 / Total, 1)\r\n| project Name, Count, [\"% of Inbound\"]",
+                                    "size": 3,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "table",
+                                    "gridSettings": {
+                                      "formatters": [
+                                        {
+                                          "columnMatch": "Name",
+                                          "formatter": 1,
+                                          "formatOptions": {
+                                            "customColumnWidthSetting": "3fr"
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "Count",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "3fr"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal"
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "% of Inbound",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "green",
+                                            "min": 0,
+                                            "max": 100,
+                                            "customColumnWidthSetting": "2fr"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 1,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "customWidth": "100",
+                                  "conditionalVisibility": {
+                                    "parameterName": "ProtectionView",
+                                    "comparison": "isEqualTo",
+                                    "value": "Table"
+                                  },
+                                  "name": "query - option 1 grid",
+                                  "id": "5c0f0005-0a11-4b22-9c33-000000000005"
+                                },
+                                {
+                                  "type": 12,
+                                  "content": {
+                                    "version": "NotebookGroup/1.0",
+                                    "groupType": "editable",
+                                    "items": [
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "title": "Total Emails",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Total Inbound Emails\";",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "gridSettings": {
+                                                  "formatters": [
+                                                    {
+                                                      "columnMatch": "Count",
+                                                      "formatter": 4,
+                                                      "formatOptions": {
+                                                        "palette": "greenRed"
+                                                      }
+                                                    }
+                                                  ]
+                                                },
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1,
+                                                    "formatOptions": {
+                                                      "compositeBarSettings": {
+                                                        "labelText": ""
+                                                      }
+                                                    }
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "blue",
+                                                      "compositeBarSettings": {
+                                                        "labelText": ""
+                                                      }
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                },
+                                                "chartSettings": {
+                                                  "xAxis": "Count",
+                                                  "createOtherGroup": 0
+                                                },
+                                                "mapSettings": {
+                                                  "locInfo": "LatLong",
+                                                  "sizeSettings": "Count",
+                                                  "sizeAggregation": "Sum",
+                                                  "legendMetric": "Count",
+                                                  "legendAggregation": "Sum",
+                                                  "itemColorSettings": {
+                                                    "type": "heatmap",
+                                                    "colorAggregation": "Sum",
+                                                    "nodeColorField": "Count",
+                                                    "heatmapPalette": "greenRed"
+                                                  }
+                                                }
+                                              },
+                                              "name": "query - 1",
+                                              "id": "84e8d60b-7937-46f5-b2f4-a1a4adf06c9f"
+                                            }
+                                          ]
+                                        },
+                                        "name": "Total Inbound",
+                                        "id": "1aeed046-9ea5-4583-b966-722847997fc7"
+                                      },
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "title": "Filtering Totals",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| where isnotempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Filtering Totals\";",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1,
+                                                    "formatOptions": {
+                                                      "compositeBarSettings": {
+                                                        "labelText": ""
+                                                      }
+                                                    }
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "redDark",
+                                                      "compositeBarSettings": {
+                                                        "labelText": ""
+                                                      }
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "name": "query - 1",
+                                              "id": "bae9a200-589f-4ca6-a3cf-f1110f644c49"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises Total emails detected as Malware\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has ('Malware') and EmailDirection == \"Inbound\"\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Malware\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "red"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 4",
+                                              "id": "0984d05b-fd2c-48e1-835f-41afc5a2385a"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises Total emails detected as Phish\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Phish\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "orange"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 4",
+                                              "id": "ced2d054-76d1-40df-a412-0bc86a6c3336"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises Total emails by detected as Spam\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes == 'Spam' and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Spam\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "yellow"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 4",
+                                              "id": "14456a0d-f5ac-46a0-a007-c72c7c40c58f"
+                                            }
+                                          ]
+                                        },
+                                        "customWidth": "50",
+                                        "name": "group - 9",
+                                        "id": "d4e69885-f1b2-4c2b-85c2-188a6708dc4b"
+                                      },
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "title": " ",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and DeliveryAction == 'Delivered'\r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Delivered with Detection\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 0,
+                                                      "palette": "red"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "394d1ed4-7089-4291-bc80-f9948e3be6a9"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isempty(ThreatTypes) \r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| where DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"User/Admin Blocked\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "gray"
+                                                    },
+                                                    "tooltipFormat": {
+                                                      "tooltip": "Emails blocked from being delivered because of User or Admin overriddes"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "c29a2268-67d1-4958-a9a3-696384075987"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailEvents\r\n| where isempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction == 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Clean Emails\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "gray"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "89a02ac7-971c-4672-bf5d-64709c479536"
+                                            }
+                                          ]
+                                        },
+                                        "customWidth": "50",
+                                        "name": "group - 8",
+                                        "id": "761e74d4-279e-465f-ba47-5eeec4cf05d2"
+                                      },
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "title": "Post-Delivery ZAP Removals",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Malware ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Malware ZAP\"\r\n",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "red"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "b06666bc-6ec0-49e7-a332-77e278d2320f"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Phish ZAP\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "orange"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "6fbac01b-0c42-46dc-8ca8-68e285593a45"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Spam ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Spam ZAP\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "min": 1,
+                                                      "palette": "yellow"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "33.3",
+                                              "name": "query - 3",
+                                              "id": "7bd27a3b-be13-4ca0-9964-0f872f826b45"
+                                            }
+                                          ]
+                                        },
+                                        "name": "Post Delivery",
+                                        "id": "4d20339e-5215-4edf-99d6-728cac183d16"
+                                      },
+                                      {
+                                        "type": 12,
+                                        "content": {
+                                          "version": "NotebookGroup/1.0",
+                                          "groupType": "editable",
+                                          "items": [
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Admins\"",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "palette": "none"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "50",
+                                              "name": "query - 3",
+                                              "id": "7490fa3a-e287-4fc3-b025-8772b9edb601"
+                                            },
+                                            {
+                                              "type": 3,
+                                              "content": {
+                                                "version": "KqlItem/1.0",
+                                                "query": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\r\n| where Record == 29 and ActionType == \"UserSubmission\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Users\"\r\n",
+                                                "size": 3,
+                                                "timeContextFromParameter": "TimeRange",
+                                                "queryType": "advancedHunting",
+                                                "visualization": "tiles",
+                                                "tileSettings": {
+                                                  "titleContent": {
+                                                    "columnMatch": "Details",
+                                                    "formatter": 1
+                                                  },
+                                                  "secondaryContent": {
+                                                    "columnMatch": "Count",
+                                                    "formatter": 12,
+                                                    "formatOptions": {
+                                                      "palette": "none"
+                                                    },
+                                                    "numberFormat": {
+                                                      "unit": 17,
+                                                      "options": {
+                                                        "style": "decimal",
+                                                        "maximumFractionDigits": 1
+                                                      }
+                                                    }
+                                                  },
+                                                  "showBorder": true,
+                                                  "size": "full",
+                                                  "styleSettings": {
+                                                    "borderStyle": "rounded",
+                                                    "backgroundColor": "colorGray100"
+                                                  }
+                                                }
+                                              },
+                                              "customWidth": "50",
+                                              "name": "query - 2",
+                                              "id": "7af222dc-fd74-40ec-8ab7-741e179c07bf"
+                                            }
+                                          ]
+                                        },
+                                        "name": "Reported",
+                                        "id": "8151e242-1c30-4550-ae9c-83f159e1a456"
+                                      }
+                                    ]
+                                  },
+                                  "conditionalVisibility": {
+                                    "parameterName": "ProtectionView",
+                                    "comparison": "isEqualTo",
+                                    "value": "Tiles"
+                                  },
+                                  "name": "Protection - Tiles view",
+                                  "id": "5c0f0103-0a11-4b22-9c33-000000000103"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "## Most Attacked Users<br>\r\n\r\n**The users most targeted by inbound email threats across all threat types (malware, phishing, and spam) in the selected period. Concentrated targeting of a few individuals is a strong signal of deliberate campaigns.**<br><br>**Recommended action:** Prioritise these users for security awareness training, tighter protection policies (for example the Strict preset), and closer monitoring - they are your highest-risk people."
+                                  },
+                                  "name": "exec vap banner",
+                                  "id": "1fe431fb-cc96-4e81-b164-3a1a3823ebeb"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query surfaces the users most targeted by inbound email threats across all threat types (malware, phishing, spam) for the selected period, so SecOps can prioritise the highest-risk individuals. Similar to a \"Most Attacked People\" view.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where isnotempty(ThreatTypes)\r\n| summarize\r\n    ['Total Threats'] = count(),\r\n    Malware = countif(ThreatTypes has \"Malware\"),\r\n    Phish   = countif(ThreatTypes has \"Phish\"),\r\n    Spam    = countif(ThreatTypes has \"Spam\"),\r\n    ['Last Seen'] = max(Timestamp)\r\n    by ['User']=RecipientEmailAddress\r\n| top 10 by ['Total Threats']\r\n| project ['User'], ['Total Threats'], Malware, Phish, Spam, ['Last Seen']",
+                                    "size": 3,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "table",
+                                    "gridSettings": {
+                                      "filter": true,
+                                      "formatters": [
+                                        {
+                                          "columnMatch": "Malware",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "145px"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "Phish",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "145px"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "Spam",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "145px"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "Total Threats",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "customColumnWidthSetting": "145px"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 1
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "customWidth": "100",
+                                  "name": "exec vap table",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "2dfd91b1-b8d3-4a72-aaf4-a30a1886bed7"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "## Detection trend over time - grouped by {Granularity}\r\n**Represents total emails, total detections, total user submissions and admin email submissions over time summarizing the data per {Granularity} interval**"
+                                  },
+                                  "name": "text - 14",
+                                  "id": "ddbbdaef-b374-42a8-821c-7fcd7ee53ba9"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query visualises total emails, total detections, total user, and admin email submissions over time summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet scaffold = range Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran;\r\nlet baseQuery = materialize(EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where isnotempty(Timestamp));\r\nlet sub = materialize(CloudAppEvents\r\n| extend Record = (parse_json(RawEventData)).RecordType, SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29);\r\nlet zapbase = EmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\" or ActionType == \"Spam ZAP\";\r\nunion\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Inbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Inbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Phish') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Phish\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Malware') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Malware\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Spam') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Spam\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Intra-org\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Intra-org Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Outbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Outbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where isnotempty(ThreatTypes) | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails with Threat\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"UserSubmission\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Users\"),\r\n(scaffold | join kind=leftouter (zapbase | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Removed by ZAP\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"Mail\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Admins\")",
+                                    "size": 0,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "linechart",
+                                    "chartSettings": {
+                                      "xAxis": "Timestamp",
+                                      "seriesLabelSettings": [
+                                        {
+                                          "seriesName": "Total Inbound Emails",
+                                          "label": "Inbound Emails",
+                                          "color": "green"
+                                        },
+                                        {
+                                          "seriesName": "Total Emails with Threat",
+                                          "label": "Emails with Threat",
+                                          "color": "redDark"
+                                        },
+                                        {
+                                          "seriesName": "Emails Detected as Phish",
+                                          "label": "Emails with Phish",
+                                          "color": "redBright"
+                                        },
+                                        {
+                                          "seriesName": "Emails Detected as Malware",
+                                          "label": "Emails with Malware",
+                                          "color": "red"
+                                        },
+                                        {
+                                          "seriesName": "Total Intra-org Emails",
+                                          "label": "Intra-org Emails",
+                                          "color": "greenDark"
+                                        },
+                                        {
+                                          "seriesName": "Emails Detected as Spam",
+                                          "label": "Emails with Spam",
+                                          "color": "gray"
+                                        },
+                                        {
+                                          "seriesName": "Total Outbound Emails",
+                                          "label": "Outbound Emails",
+                                          "color": "greenDarkDark"
+                                        },
+                                        {
+                                          "seriesName": "Total Emails Removed by ZAP",
+                                          "label": "Emails ZAP-d",
+                                          "color": "orangeDark"
+                                        },
+                                        {
+                                          "seriesName": "Total Emails Reported by Users",
+                                          "label": "User Reported Emails",
+                                          "color": "lightBlue"
+                                        },
+                                        {
+                                          "seriesName": "Total Emails Reported by Admins",
+                                          "color": "blueDark"
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "customWidth": "100",
+                                  "name": "query - 1",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "bcbefa48-f553-4290-acff-2691caf898ea"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "## Bad traffic (%) - Inbound Emails - grouped by {Granularity}\r\n**This represents bad traffic (% of emails with threats) compared to total inbound emails, summarized per {Granularity} interval over time.**"
+                                  },
+                                  "name": "text - 15",
+                                  "id": "30761bcc-b1a5-45e2-8c0a-22388fbbf16c"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, {Granularity})\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| project Timestamp, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                                    "size": 0,
+                                    "aggregation": 3,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "linechart"
+                                  },
+                                  "customWidth": "100",
+                                  "name": "query - 4",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "508036a8-d969-44c2-b2d2-c62d99999197"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Protection Details",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "e6edeeeb-dcde-41d0-88c7-97ef773403b1"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Collaboration Protection Posture\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 protects Microsoft Teams and collaboration, not only email. This snapshot shows Teams threat activity for the period.<br><br>**Recommended action:** Review the dedicated **Teams &amp; Collaboration** tab for impersonation, malicious URLs, risky senders and file threats in Teams."
+                                  },
+                                  "name": "exec collab banner",
+                                  "id": "3d78a6aa-51d4-4cab-93d1-26dff86fd667"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//Headline Microsoft Teams / collaboration protection metrics for the executive summary, with per-interval sparklines so the collaboration threat trend is visible at a glance. Messages and URLs are counted per distinct Teams message.\r\nlet gran = {Granularity};\r\nlet me = materialize(MessageEvents);\r\nlet cae = materialize(CloudAppEvents | where ActionType == \"TeamsImpersonationDetected\");\r\nlet mui = materialize(MessageUrlInfo);\r\nlet uce = materialize(UrlClickEvents | where Workload == \"Teams\" and ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\"));\r\nlet fmc = materialize(FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\");\r\nunion\r\n(me | summarize Count = dcount(TeamsMessageId) | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(me | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(me | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Teams Threat Messages\", Ord = 2, Trend = toscalar(me | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(cae | summarize Count = count() | extend Details = \"Teams Impersonation Detections\", Ord = 3, Trend = toscalar(cae | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(mui | summarize Count = dcount(TeamsMessageId) | extend Details = \"URLs Shared in Teams\", Ord = 4, Trend = toscalar(mui | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(uce | summarize Count = count() | extend Details = \"Malicious Clicks Blocked\", Ord = 5, Trend = toscalar(uce | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 6, Trend = toscalar(fmc | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Malicious Teams Files\", Ord = 7, Trend = toscalar(fmc | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+                                    "size": 3,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "tiles",
+                                    "tileSettings": {
+                                      "titleContent": {
+                                        "columnMatch": "Details",
+                                        "formatter": 1
+                                      },
+                                      "leftContent": {
+                                        "columnMatch": "Count",
+                                        "formatter": 12,
+                                        "formatOptions": {
+                                          "min": 0,
+                                          "palette": "blue"
+                                        },
+                                        "numberFormat": {
+                                          "unit": 17,
+                                          "options": {
+                                            "style": "decimal",
+                                            "maximumFractionDigits": 1
+                                          }
+                                        }
+                                      },
+                                      "secondaryContent": {
+                                        "columnMatch": "Trend",
+                                        "formatter": 21
+                                      },
+                                      "showBorder": true,
+                                      "size": "auto"
+                                    }
+                                  },
+                                  "customWidth": "100",
+                                  "name": "exec collab tiles",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "3175aee5-56d2-4cb1-b1c3-75be683e6ffb"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Collaboration Posture",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "39b0921f-fcef-49f4-8d52-0dcd1f33045b"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Emerging Threats\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<p style=\"font-size:16px;\">With more sophisticated adversaries and new threats emerging frequently and prevalently, it's critical to be able to quickly identify and react to these threats.</p>\r\n\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Email threat landscape</b></p>](https://security.microsoft.com/threatanalytics3/f186e4b0-28df-499a-901e-c64768b6d0dc/overview?filters=tags%253DPhishing)\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Automated business email impersonation campaign uses parallel aging report and payroll diversion lures</b></p>](https://security.microsoft.com/threatanalytics3/3eb53378-892d-4695-a497-25d0a54181ee)\r\n[<p style=\"font-size:16px;\"><b>🛡️Tool Profile: StealC</b></p>](https://security.microsoft.com/threatanalytics3/4d837c12-1db4-49c8-8466-219198d40b9b)\r\n[<p style=\"font-size:16px;\"><b>🛡️OSINT Profile: UNC1151/Ghostwriter phishing campaign targeting Gmail accounts</b></p>](https://security.microsoft.com/threatanalytics3/b1a7e5e7-4b43-4758-8805-f714a131161a)\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Encrypted message campaign targets real estate/financial sectors</b></p>](https://security.microsoft.com/threatanalytics3/651d669a-4721-42ab-bb96-509e94b5bfd9)\r\n\r\n<br>\r\n<a href=\"https://go.microsoft.com/fwlink/?linkid=2323913\" target=\"_blank\" style=\"font-size:14px; padding:10px 20px; background-color:#003366; color:white; border:none; border-radius:5px;\">\r\n<b>View all\r\n \r\n</a>\r\n"
+                                  },
+                                  "name": "text - 10",
+                                  "styleSettings": {
+                                    "margin": "0",
+                                    "padding": "0"
+                                  },
+                                  "id": "0c781e85-af9a-41a6-9cf7-b3bb9a09d5d0"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Emerging Threats",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "4f8886d3-882a-4c14-ab7f-a37bd302e32f"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Microsoft 365 Secure Email Gateway Performance\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<p style=\"font-size:16px;\">Using multiple vendor email security products can offer diverse detections. However, our comprehensive end-to-end approach—spanning prevention, detection, posture, investigation, response, and user training—delivers a unified and effective defense that matches or exceeds the efficacy of siloed Secure Email Gateway solutions.</p>\r\n\r\n[<p style=\"font-size:18px;\"><b>Learn more</b></p>](https://www.microsoft.com/en-us/security/blog/2026/06/15/microsoft-defender-email-security-benchmarking-key-insights-from-one-year-of-data/) \r\n\r\n<br>\r\n<p style=\"font-size:16px;\"><b>High-severity email threats missed per 1,000 users protected - February–April 2026 (Microsoft Defender email security benchmarking)</b></p>"
+                                  },
+                                  "name": "text - 12",
+                                  "id": "94c804f9-2860-4768-be59-fb31a4ff22d7"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "datatable(Index:int, Name:string, Value:int)\r\n[\r\n    1, \"Defender for Office 365\", 194,\r\n    2, \"Mimecast\", 478,\r\n    3, \"ProofPoint\", 483,\r\n    4, \"HornetSecurity\", 813,\r\n    5, \"TrendMicro\", 1151,\r\n    6, \"IronPort\", 1274,\r\n    7, \"Barracuda\", 1585,\r\n    8, \"FireEye\", 2107\r\n]\r\n| project [\"Email security solution\"] = Name, [\"High-severity threats missed / 1K users\"] = Value\r\n| order by [\"High-severity threats missed / 1K users\"] asc\r\n",
+                                    "size": 0,
+                                    "timeContext": {
+                                      "durationMs": 86400000
+                                    },
+                                    "queryType": "advancedHunting",
+                                    "visualization": "table",
+                                    "gridSettings": {
+                                      "formatters": [
+                                        {
+                                          "columnMatch": "Email security solution",
+                                          "formatter": 1,
+                                          "formatOptions": {
+                                            "customColumnWidthSetting": "40%"
+                                          }
+                                        },
+                                        {
+                                          "columnMatch": "High-severity threats missed / 1K users",
+                                          "formatter": 3,
+                                          "formatOptions": {
+                                            "palette": "blue",
+                                            "min": 0,
+                                            "max": 2107,
+                                            "customColumnWidthSetting": "60%"
+                                          },
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "useGrouping": true
+                                            }
+                                          }
+                                        }
+                                      ],
+                                      "rowLimit": 10,
+                                      "sortBy": [
+                                        {
+                                          "itemKey": "High-severity threats missed / 1K users",
+                                          "sortOrder": 1
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "name": "query - 11",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "e54fd5bd-17e2-40dc-897d-8a3bb21116ff"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec SEG Performance",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "1f3a7e2b-0a1f-48ba-9da3-e7531d500938"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "id": "ab3756d3-3f60-4024-9376-0f1a7d47ac13",
+                                  "type": 1,
+                                  "name": "text - 18",
+                                  "content": {
+                                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Stay Current\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<br>\r\n\r\n- **Threat Analytics (Defender XDR)** — live, tenant-specific threat intelligence and recommended actions: <a href=\"https://learn.microsoft.com/en-us/defender-xdr/threat-analytics\" target=\"_blank\">aka.ms/threatanalytics</a>\r\n- **Microsoft Security Blog** — campaign write-ups and threat research: <a href=\"https://www.microsoft.com/en-us/security/blog/\" target=\"_blank\">microsoft.com/security/blog</a>\r\n- **Microsoft Defender for Office 365 Tech Community blog** — product updates and reporting guidance: <a href=\"https://techcommunity.microsoft.com/category/microsoft-defender-for-office-365/blog/microsoftdefenderforoffice365blog\" target=\"_blank\">Tech Community</a>\r\n- **Latest features in Microsoft Defender for Office 365** — <a href=\"https://learn.microsoft.com/en-us/defender-office-365/defender-for-office-365-whats-new\" target=\"_blank\">What's new in Microsoft Defender for Office 365</a> \r\n- **Share reporting feedback**: <a href=\"https://aka.ms/mdoreportingfeedback\" target=\"_blank\">aka.ms/mdoreportingfeedback</a>\r\n"
+                                  }
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "group - Exec Stay Current",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "5e22c565-cd2e-41f3-8d5a-0735af67c93f"
+                          }
+                        ],
+                        "exportParameters": true
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "1"
+                      },
+                      "name": "Detection Overview",
+                      "styleSettings": {
+                        "margin": "0",
+                        "padding": "0"
+                      },
+                      "id": "3f2cc277-9eb3-486d-a1f8-9fa5374a3d80"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Malware detection insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **malware threat** (such as viruses, spyware, or ransomware) within its **URLs** or **attachments**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "text - 13",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "81f28ffc-b69e-4960-a61c-cac17a012ed6"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of inbound email malware detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet mal = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Malware\";\r\nlet inbox = mal | where DeliveryLocation has \"Inbox\";\r\nlet malTrend = toscalar(mal | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(mal | summarize count()), Details = \"Malware Emails\", Ord = 1, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = malTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "malware kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "20c06dd3-5025-4b2b-960e-ff012f5d2343"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detection Trends, Threat Classes, and Malware Names\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend, threat classes and Malware types. \r\n<br><br>**Recommended action:** If malware volume spikes, confirm Safe Attachments (Block mode) is enabled for all users and investigate the top malware families below."
+                            },
+                            "name": "text - 14",
+                            "id": "1f09c6ec-b2de-4aa9-bd8e-81d11c92ebd4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detection Trend\r\n**This visual displays a per-{Granularity} trend of email malware detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for malware threats.**"
+                            },
+                            "name": "text - Malware Trend header",
+                            "id": "e90b714f-de84-4571-9a60-b3b2f3bd09dd"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize MalwareDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareDetections = coalesce(MalwareDetections, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "MalwareDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 0",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "350d0aa3-c093-4105-a150-c20111ac2912"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detection Trend - Advanced Threats\r\n**Not all threats are going to be easily recognisable, that's why Microsoft Defender for Office 365 has advanced threat detection methods, that use virtual sandbox environments to detonate URLs and Files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Malware detections of these advanced threats**"
+                            },
+                            "name": "text - Malware Advanced Threats header",
+                            "id": "12e07248-ada4-41d9-99cc-824eb65cff79"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod in ('File detonation','URL detonation')\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "File detonation",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "URL detonation",
+                                    "color": "orangeDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 9",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "ebcb6f29-02be-4dd0-b792-cd99285c29d4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Threat Classification\r\n**Summary of email messages detected by Microsoft Defender for Office 365 as malware, grouped by type of malware (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware).**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 15",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5638fc51-0830-4675-87d4-82f03df17bbf"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Attacked Users by Malware Threat Classification\r\n**Displays the recipient most frequently targeted for each malware type (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware) in inbound email detections.**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 15 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d2e3903b-4984-40da-a437-3d6a2b121e23"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Threat Name\r\n**Summarises email messages flagged by Microsoft Defender for Office 365, grouped by specific malware names detected in URLs or attachments.**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 15 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6c0bebcf-9838-4385-ab3a-30db6c994284"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by threat classification of the malware threat in the message.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has 'Malware' and ThreatClassification  has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count(Key) by ThreatClassification\r\n| sort by Count desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "33",
+                            "name": "query - 11",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "acb98530-8e3a-4383-b42f-8fd74b1c3fbe"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Malware detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Malware\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Count desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TopEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "statSettings": {
+                                "valueField": "RecipientEmailAddress",
+                                "valueAggregation": "None",
+                                "colorSettings": {
+                                  "type": "static",
+                                  "mode": "background",
+                                  "heatmapPalette": "greenRed",
+                                  "thresholdsGrid": []
+                                },
+                                "iconSettings": {
+                                  "thresholdsGrid": []
+                                },
+                                "tagText": "",
+                                "valueFontStyle": "auto"
+                              },
+                              "chartSettings": {
+                                "xAxis": "RecipientEmailAddress"
+                              }
+                            },
+                            "customWidth": "33",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 5 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d9b46c97-91ce-4d64-aca6-3126ac49c0ff"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.\r\nEmailEvents \r\n| where isnotempty(ThreatNames) and ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand ThreatName = split(ThreatNames, \",\") to typeof(string)\r\n| where isnotempty(ThreatName)\r\n| distinct Key, ThreatName\r\n| summarize Count = count() by ThreatName\r\n| top 15 by Count\r\n| project ['Threat Name'] = ThreatName, Count",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Count",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "xAxis": "ThreatNames",
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "33",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 3",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b9a4b34f-f54f-4d6e-bb20-81925d0f5540"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "group - 3",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "82853a93-e11f-4e4a-80f4-733850a1d3ff"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detections by Delivery Location, Detection Technology and Sender Infrastructure Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Malware. \r\n<br><br>**Recommended action:** For sender IPs or countries you do not do business with, consider connection filtering or geo-based rules; verify the detection technologies catching these are enabled."
+                            },
+                            "name": "banner - Malware Delivery Detection Sender",
+                            "id": "cba6403d-e2b1-4fe8-af52-57e5c2aa8e54"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by delivery location\r\n**Visualizes counts (per {Granularity}) of malware detections of inbound emails by delivery location: Quarantine or Failed (rejected with or without NDR)**"
+                            },
+                            "name": "text - Malware Delivery Location header",
+                            "id": "95be7f48-40eb-4154-91d8-20f7033f2ff5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware' and EmailDirection == 'Inbound'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalMalwareDetections=count(), Quarantine=countif(DeliveryLocation == 'Quarantine'), Failed=countif(DeliveryLocation == 'Failed') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalMalwareDetections=coalesce(TotalMalwareDetections,0), Quarantine=coalesce(Quarantine,0), Failed=coalesce(Failed,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalMalwareDetections",
+                                    "color": "blue"
+                                  },
+                                  {
+                                    "seriesName": "Quarantine",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "Failed",
+                                    "color": "redDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 10",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b2c19e58-2123-490b-9631-c0b238c582e6"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Malware detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+                            },
+                            "name": "text - Malware Detection Technology header",
+                            "id": "f3c2691e-4f32-4109-9524-8a11719e4425"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "66",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 8",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f00c1ce0-e55e-44c0-8bf0-4af662ccef89"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nEmailEvents \r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod)\r\n| sort by Count desc\r\n| project ['Detection Technology'] = MalwareMethod, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "34",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 2",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "590880a9-1cf7-44ae-b4de-2f65bc700b5d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Malware, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "name": "text - Malware Geo Location header",
+                            "id": "19d78b48-af58-4bee-abfe-57efb1eba125"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "title": "Malware Detections-Sender Heatmap (IPv4)",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "gridSettings": {
+                                "sortBy": [
+                                  {
+                                    "itemKey": "count_",
+                                    "sortOrder": 2
+                                  }
+                                ]
+                              },
+                              "sortBy": [
+                                {
+                                  "itemKey": "count_",
+                                  "sortOrder": 2
+                                }
+                              ],
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "locInfoColumn": "GeoInfo",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 1",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8cb46ec0-ac2a-41d1-bf8a-0b8585d1fefc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Malware Emails'] = count_\r\n| sort by ['Malware Emails'] desc\r\n\r\n\r\n",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malware Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": [],
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "locInfoColumn": "GeoInfo",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - 1 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b6a0355a-2b8f-48a5-8edc-58f4f7f8180a"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "Malware-Detectiontech-Deliverylocation-SendingInfra",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "2692cb5e-825c-45c1-bd3a-096b55e8d760"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders. \r\n<br><br>**Recommended action:** Apply the Strict preset security policy to the most-attacked users and consider adding persistent malicious sender domains to the Tenant Allow/Block List."
+                            },
+                            "name": "banner - Malware Top Users Senders",
+                            "id": "bc5b37a4-71e4-4a2f-b0ba-b3dd87333391"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections top attacked users\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Malware. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Malware Top Users header",
+                            "id": "cb87a026-ad03-45cc-887e-ab460490d9a5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails with Malware detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(ThreatTypes has \"Malware\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malware Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - Malware Top Recipients",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e7ffef62-f85e-4188-8ab9-d90a5c666c30"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains with Malware Detections (Inbound)\r\n**Displays the top 10 sender domains sending inbound emails detected as Malware. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Malware Top Senders header",
+                            "id": "93390807-25b2-4bea-9648-98e821da8ec6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malware Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal",
+                                        "useGrouping": false
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "BadEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "2"
+                            },
+                            "name": "query - Malware Top Sender Domains",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "eaa45734-2df2-4a5e-b35b-1295e00cb46f"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "2"
+                      },
+                      "name": "MalwareTopAttackedUser-TopSenders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "4e0900ab-e7e4-4cf1-93a4-7e86bca20782"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Phishing Detection Insights\r\n\r\n---\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Phishing threat** within its **email content**, **URLs**, or **attachments**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "text - 24",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "fe82d665-fa9e-4fc2-9ba9-7e2eabb9a04b"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of inbound email phishing detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet ph = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Phish\";\r\nlet inbox = ph | where DeliveryLocation has \"Inbox\";\r\nlet phTrend = toscalar(ph | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(ph | summarize count()), Details = \"Phish Emails\", Ord = 1, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = phTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "phish kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "5debf0b8-4384-485b-8a7f-71ead592718a"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%;\">Phishing Detection Trend, LLM Content Analysis, Advanced Threats, and Threat Classes\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends, advanced threat detections, LLM-based content analysis, and threat classes.<br><br>**Recommended action:** Review the LLM-classified phishing themes; enable Safe Links and impersonation protection, and prioritise awareness training on the dominant lure types."
+                            },
+                            "name": "text - Phish Section1 Banner",
+                            "id": "ce5e489f-c83b-4bc8-9e63-b08dfb5ef31f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detection Trend<br>\r\n\r\n**This visual displays a per-{Granularity} trend of email Phish detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Phish threats.**"
+                            },
+                            "name": "text - Phish Trend Header",
+                            "id": "429ef4d2-61a9-40d0-940f-2212ddce22ce"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\"\r\n| summarize PhishDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, PhishDetections = coalesce(PhishDetections, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "PhishDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b0d170ec-331c-4ad0-8ce6-258704cc5345"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detection Trend - Advanced Threats<br>\r\n\r\n**Not all threats are easily recognizable, which is why Microsoft Defender for Office 365 uses advanced detection methods, including virtual sandbox environments to detonate URLs and files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Phish detections of these advanced threats.**"
+                            },
+                            "name": "text - Phish AdvThreats Header",
+                            "id": "425476e0-066a-42ee-afb9-5dabc612a3c8"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| project Timestamp, RecipientEmailAddress, NetworkMessageId, DT=parse_json(DetectionMethods)\r\n| evaluate bag_unpack(DT)\r\n| summarize [\"File detonation\"]=countif(Phish has 'File detonation' and Phish !has 'File detonation reputation'), [\"URL detonation\"]=countif(Phish has 'URL detonation' and Phish !has 'URL detonation reputation') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"File detonation\"]=coalesce([\"File detonation\"],0), [\"URL detonation\"]=coalesce([\"URL detonation\"],0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "URL detonation",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "File detonation",
+                                    "color": "redDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish AdvThreats Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6b62347a-b162-49e6-891c-07697af22dd9"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - LLM content analysis<br>\r\n\r\n**Microsoft Defender for Office 365 uses Language AI for Phish and Business Email Compromise (BEC) detection. These models are progressively learning from thousands of real-world phishing attempts and analyzing all messages classified as phish. Furthermore, it incorporates advanced Machine Learning and Natural Language Processing (NLP) techniques to read, process, and understand email content the way a human analyst might, yet in a fraction of the time and at a large scale. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-defender-for-office-365s-language-ai-for-phish-enhancing-email-securit/4410446)**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - Phish LLM Content Header",
+                            "id": "c23460b1-e025-4f6c-b2d5-3f78c0c9afc6"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - LLM Threat Classifications<br>\r\n\r\n**Microsoft Defender for Office 365 uses purpose-built Large Language Models (LLM) at scale to provide AI-powered email and collaboration security. Our solution now parses language to understand and identify attacker intent and classifies threats at machine speed – keeping malicious emails out of your inbox and giving security operations (SOC) teams a new level of insight into adversary techniques. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-ignite-redefining-email-security-with-llms-to-tackle-a-new-era-of-soci/4302421)**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - Phish LLM ThreatClass Header",
+                            "id": "1d723c26-501f-4385-9331-957ab7ae5019"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails detected as Phish by LLM content analysis detection technology in Microsoft Defender for Office 365. \r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and DetectionMethods contains \"LLM content analysis\"\r\n| summarize count()\r\n| sort by count_ desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "stat",
+                              "statSettings": {
+                                "valueAggregation": "None",
+                                "colorSettings": {
+                                  "type": "thresholds",
+                                  "mode": "foreground",
+                                  "thresholdsGrid": [
+                                    {
+                                      "operator": ">",
+                                      "thresholdValue": "0",
+                                      "representation": "red"
+                                    },
+                                    {
+                                      "operator": "<=",
+                                      "thresholdValue": "0",
+                                      "representation": "red"
+                                    }
+                                  ]
+                                },
+                                "iconSettings": {
+                                  "thresholdsGrid": []
+                                },
+                                "tagText": "",
+                                "valueFontStyle": "auto",
+                                "tagTextPosition": "bottom"
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish LLM Content Count",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "86a301c5-2bc0-436a-982c-861beee7c9ab"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by intent of the message.\r\n// Microsoft Defender for Office 365 LLM analysis is analyzing email messages to understand the intent of the messages. These threat classifications are then used in filtering decisions.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and ThreatClassification  has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize count() by ThreatClassification\r\n| sort by count_ desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish LLM ThreatClass Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d547b730-f174-4f78-8998-02f24453304e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Attacked Users by LLM Threat classes (Phish)<br>\r\n\r\n**Displays recipients most frequently targeted by inbound phishing emails, grouped by threat classification (e.g., Gift Card, Invoice, Payroll). Helps identify users at higher risk for phishing attacks. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish LLM TopUsers Header",
+                            "id": "4ba9d9eb-d88d-4e5d-ba58-a740559677f7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Phish detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Emails desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "80px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish LLM TopUsers",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "51599ab2-db69-4195-b4e9-2828729ec35b"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "group - 5",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "25c47f6a-3525-435e-90cf-357f02fb2fed"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections by Delivery location, Detection technology and Sender infrastructure insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Phish detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Phish.<br><br>**Recommended action:** Verify anti-phishing and Safe Links policies cover these delivery paths; consider blocking sender infrastructure from regions you do not operate in, where appropriate."
+                            },
+                            "name": "text - Phish Section2 Banner",
+                            "id": "6876063e-6a4f-48ea-829d-4486922783dd"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections by delivery location<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various delivery locations: Quarantine, Junk folder or Failed (rejected with or without NDR)**"
+                            },
+                            "name": "text - Phish DeliveryLoc Header",
+                            "id": "b5045aab-1b4b-4d35-af41-a6315d36e864"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.\r\n//The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\" and EmailDirection == \"Inbound\"\r\n| summarize TotalPhishDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalPhishDetections=coalesce(TotalPhishDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Quarantine",
+                                    "color": "greenDark"
+                                  },
+                                  {
+                                    "seriesName": "Failed",
+                                    "color": "green"
+                                  },
+                                  {
+                                    "seriesName": "Dropped",
+                                    "color": "green"
+                                  },
+                                  {
+                                    "seriesName": "Junk folder",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "Inbox",
+                                    "color": "redBright"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish DeliveryLoc Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e839848c-d176-4251-bbb4-1c2e1103ed2d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish detections by Detection Technology<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+                            },
+                            "name": "text - Phish DetTech Header",
+                            "id": "149bf1b3-80cc-4e82-ae5d-ddee0f6b0cd9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls in Microsoft Defender for Office 365.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "createOtherGroup": 15
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish DetTech Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b0b16329-e1a6-4138-871e-76d57a60b978"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarized by individual Phish detection technology/control in Microsoft Defender for Office 365.\r\n//Each detection technology is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\n//The where clause excludes deliveries to the SecOps Mailbox and by the Phish Simulation system.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish DetTech Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5270ba04-599f-4940-805b-687f7475bc70"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections by SenderIPv4 Geo Location<br>\r\n\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "name": "text - Phish Geo Header",
+                            "id": "ddd0c12f-1bb1-4d7d-afb4-f28bcfcd7c4b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address (SenderIPv4).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish Geo Map",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "85ea7223-7d77-43f5-b0d9-e0de7c898758"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Phish' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Phish Emails'] = count_\r\n| sort by ['Phish Emails'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Phish Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish Country Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f561209b-15a6-442e-af10-63e375088209"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "group - 25- Phish delivery locations-detecion tech-sender infra",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "10f3e3eb-b330-4955-952e-01eff69405e9"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Enroll the most-targeted users in security awareness training and consider blocking persistent phishing sender domains."
+                            },
+                            "name": "text - Phish Section3 Banner",
+                            "id": "f46ed4a8-e2b5-4ccd-ae38-efc571bfc791"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections top attacked users\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Phish. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish TopUsers Header",
+                            "id": "96d9b543-070a-42d4-bbed-3f5cf79ca7ce"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails with Phish detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),PhishEmailCount = countif(ThreatTypes has \"Phish\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount !=0\r\n| top 15 by PhishEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Phish Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish TopRecipients Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "25100115-78d3-4144-b44e-613b44f02484"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains with Phish Detections (Inbound)\r\n**Displays the top 10 sender domains sending inbound emails detected as Phish. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish TopSenders Header",
+                            "id": "e7fcb7fe-4bca-4153-a9b0-8ded135b1c64"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain), now including the Phish confidence split (High/Normal) and the aggregated phish detection methods seen per domain. Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\r\n| extend PhishMethods = parse_json(DetectionMethods).Phish\r\n| summarize TotalEmailCount = count(),\r\n            PhishEmailCount = countif(ThreatTypes has \"Phish\"),\r\n            Phish_High = countif(ThreatTypes has \"Phish\" and PhishConf == \"High\"),\r\n            Phish_Normal = countif(ThreatTypes has \"Phish\" and PhishConf == \"Normal\"),\r\n            PhishMethodSet = make_set_if(PhishMethods, ThreatTypes has \"Phish\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount != 0\r\n| top 15 by PhishEmailCount\r\n| mv-apply S = PhishMethodSet on ( mv-expand m = S to typeof(string) | summarize Methods = make_set(m) )\r\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound, ['Detection Methods'] = strcat_array(Methods, \", \")",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Phish Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish (High)",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish (Normal)",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "BadEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "3"
+                            },
+                            "name": "query - Phish TopSenders Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "717bfce8-b5d4-4900-99db-4ba0c503591d"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "3"
+                      },
+                      "name": "group - 26-PhishDetectionsTopattackedusers-topsenders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "553afca2-caa1-45b1-bec0-dca426b5be46"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Spam Detection Insights\r\n\r\n---\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Spam threat** within its **email content**, **URLs**, or **attachments**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "text - Spam Tab Intro",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "a693a05a-a772-4ac4-9863-07ad0d1b7092"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of inbound email spam detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet sp = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Spam\";\r\nlet junk = sp | where DeliveryLocation has \"Junk\";\r\nlet spTrend = toscalar(sp | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet junkTrend = toscalar(junk | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(sp | summarize count()), Details = \"Spam Emails\", Ord = 1, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = spTrend),\r\n(print Count = toscalar(junk | summarize count()), Details = \"Sent to Junk\", Ord = 4, Trend = junkTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "spam kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "cadd5331-1db8-4ac8-bc99-42cd5227ee51"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detection Effectiveness and Trends\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Effectiveness and per-{Granularity} trend. For effectiveness, we consider messages reported by your admins and decisions made post-delivery.<br><br>**Recommended action:** If legitimate mail is marked as spam, review the Spam and Bulk thresholds; if spam is leaking through, tighten them."
+                            },
+                            "name": "text - Spam Section1 Banner",
+                            "id": "1093f3b6-cea7-4f54-9029-f9aadd79ca9f"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query calculates the effectiveness of spam detections without edge data.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n            EmailEvents\r\n            | where Timestamp between (minTime ..maxTime )\r\n            | where ThreatTypes contains \"Spam\"\r\n            | project NetworkMessageId, ThreatTypes)\r\n            on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint\r\nEffectiveness_PostDelivery = abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))/(toreal(toscalar(_Spam_Mailflow))+toreal(toscalar(_FN_ZAP_Successful_Spam))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))+toreal(toscalar(_FN_Admin_Submissions_SPM))-toreal(toscalar(_SPAM_ZAP_FP)))*100-100),2))",
+                                    "size": 1,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "stat",
+                                    "statSettings": {
+                                      "valueAggregation": "None",
+                                      "colorSettings": {
+                                        "type": "thresholds",
+                                        "mode": "foreground",
+                                        "heatmapPalette": "greenRed",
+                                        "thresholdsGrid": [
+                                          {
+                                            "operator": ">",
+                                            "thresholdValue": "95",
+                                            "representation": "green"
+                                          },
+                                          {
+                                            "operator": "<=",
+                                            "thresholdValue": "95",
+                                            "representation": "orange"
+                                          },
+                                          {
+                                            "operator": "<=",
+                                            "thresholdValue": "90",
+                                            "representation": "red"
+                                          }
+                                        ]
+                                      },
+                                      "iconSettings": {
+                                        "thresholdsGrid": []
+                                      },
+                                      "numberFormatSettings": {
+                                        "unit": 1,
+                                        "options": {
+                                          "style": "decimal"
+                                        }
+                                      },
+                                      "tagText": "Spam Effectiveness (without Edge data)",
+                                      "valueFontStyle": "superLarge",
+                                      "tagTextPosition": "bottom"
+                                    }
+                                  },
+                                  "customWidth": "50",
+                                  "name": "query - Spam Effectiveness Stat",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "036851c1-489e-4fda-8059-850c161578b3"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "let minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n            EmailEvents\r\n            | where Timestamp between (minTime ..maxTime )\r\n            | where ThreatTypes contains \"Spam\"\r\n            | project NetworkMessageId, ThreatTypes)\r\n            on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint StatisticName=\"Spam Mailflow Minus FPs\", Value=toreal((toscalar(_Spam_Mailflow)) - toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Admin FNs Submitted\", Value=toreal(toscalar(_FN_Admin_Submissions_SPM)))\r\n| union (print StatisticName=\"Spam FPs Reverse Zapped\", Value=toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Zapped Successfully\", Value=toreal(toscalar(_FN_ZAP_Successful_Spam)))\r\n| union (print StatisticName=\"Spam NotZapped\", Value=toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))\r\n| union (print StatisticName=\"Spam Effectiveness Post Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2)))\r\n| union (print StatisticName=\"Spam Effectiveness Pre-Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + (toscalar(_FN_ZAP_Successful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2 )))\r\n| project ['Statistic'] = StatisticName, Value",
+                                    "size": 0,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "table",
+                                    "tileSettings": {
+                                      "showBorder": false,
+                                      "titleContent": {
+                                        "columnMatch": "StatisticName",
+                                        "formatter": 1
+                                      },
+                                      "leftContent": {
+                                        "columnMatch": "Value",
+                                        "formatter": 12,
+                                        "formatOptions": {
+                                          "palette": "auto"
+                                        },
+                                        "numberFormat": {
+                                          "unit": 17,
+                                          "options": {
+                                            "maximumSignificantDigits": 3,
+                                            "maximumFractionDigits": 2
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "gridSettings": {
+                                      "formatters": [
+                                        {
+                                          "columnMatch": "Value",
+                                          "formatter": 0,
+                                          "numberFormat": {
+                                            "unit": 17,
+                                            "options": {
+                                              "style": "decimal",
+                                              "maximumFractionDigits": 2
+                                            }
+                                          }
+                                        }
+                                      ]
+                                    }
+                                  },
+                                  "customWidth": "50",
+                                  "name": "query - Spam Effectiveness Table",
+                                  "styleSettings": {
+                                    "margin": "10px",
+                                    "padding": "10px"
+                                  },
+                                  "id": "8d456ea2-f04a-4d71-95c6-fbaad8c2d2f2"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "Spam Effectiveness",
+                            "id": "82812b88-e7f7-4be0-9d13-8e7a7d8c0c4e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detection Trend<br>\r\n\r\n**This visual displays a per-{Granularity} trend of email Spam detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Spam threats.**"
+                            },
+                            "name": "text - Spam Trend Header",
+                            "id": "b5574a88-430b-4cca-a76e-9a0b07e9da2e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpamDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "SpamDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "09b7d330-1683-45c4-ac0e-8141580d13b5"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "group - 6-Spam-detections-trend",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "25273f47-8201-4565-8815-1d059ee8abb6"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detections by Delivery location, Detection technology, Sender infrastructure and Bulk insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Spam detections delivery locations, detection technologies used for detections, sender infrastructure and Bulk insights in inbound email identified by Microsoft Defender for Office 365 as Spam.<br><br>**Recommended action:** Raise the Bulk Complaint Level (BCL) threshold for noisy sender domains and consider blocking high-volume, low-value bulk senders where appropriate."
+                            },
+                            "name": "text - Spam Section2 Banner",
+                            "id": "b82f442b-a3a0-44f7-82df-2fd4a9594992"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections by delivery location<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various delivery locations Quarantine, Junk folder or Failed (rejected with or without NDR)**"
+                            },
+                            "name": "text - Spam DeliveryLoc Header",
+                            "id": "a6326d97-56cc-45fb-8019-e0c3346968f2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\" and EmailDirection == \"Inbound\"\r\n| summarize TotalSpamDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalSpamDetections=coalesce(TotalSpamDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalSpamDetections",
+                                    "color": "blue"
+                                  },
+                                  {
+                                    "seriesName": "Quarantine",
+                                    "color": "greenDark"
+                                  },
+                                  {
+                                    "seriesName": "Junkfolder",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "Inbox",
+                                    "color": "redBright"
+                                  },
+                                  {
+                                    "seriesName": "Failed",
+                                    "color": "red"
+                                  },
+                                  {
+                                    "seriesName": "Dropped",
+                                    "color": "redDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam DeliveryLoc Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "97f89032-34e3-40ff-bb88-42d195aea095"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections Detection Technology<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+                            },
+                            "name": "text - Spam DetTech Header",
+                            "id": "935ea90d-8430-49d5-b942-3a7b319a603e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where DetectionMethods has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam DetTech Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f31ec0d1-04e1-4b2b-9b98-27289ca34b84"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections summarized by individual Spam detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Spam (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\"\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam DetTech Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "95e40479-f0bc-41ff-8191-634b606d3632"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections by SenderIPv4 Geo Location<br>\r\n\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Spam, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "name": "text - Spam Geo Header",
+                            "id": "614d1c3f-df6a-4659-b170-7b466c66d66f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\" and isnotempty(SenderIPv4)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "locInfoColumn": "SenderIPv4",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Spam Geo Map",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5519d715-dc79-45f8-8ed5-a63a253c45e3"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Spam' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spam Emails'] = count_\r\n| sort by ['Spam Emails'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spam Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "locInfoColumn": "SenderIPv4",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Spam Country Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5078dc24-e8be-4943-98fc-6527968e1e3d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections Bulk Insights<br>\r\n\r\n**Displays the distribution of inbound emails across different Bulk Complaint Levels together with Top 10 domains sending Bulk email (grey mail). Helps identify patterns in bulk email complaints and assess potential spam or unwanted message trends.**"
+                            },
+                            "name": "text - Spam Bulk Header",
+                            "id": "cd7b3cbe-a6c1-422c-ab37-4afc26002d5d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel\r\n| sort by BulkComplaintLevel desc\r\n| project ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blueDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Spam Bulk By Level",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "021c022b-aa67-427d-9e1a-688af7aed5d4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel, SenderFromDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain'] = SenderFromDomain, ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Spam Bulk By Domain",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b1835e0f-f9ad-44c3-bba4-cf9a9546d09a"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "group - 28-Spam-Delivery location-Detection technology-Sender infrastructure insights",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "307d3d03-93ae-4c8f-b68b-f833ee7d38e8"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "\r\n<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Review the most-affected users and the top spam sender domains as possible block-list candidates."
+                            },
+                            "name": "text - Spam Section3 Banner",
+                            "id": "4c34ed7b-86da-4ee1-8a69-f96c213a4340"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Detections top attacked users<br>\r\n\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Spam TopUsers Header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "be708ad5-51fd-4a54-b1bc-f912e12b4a01"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection ==\"Inbound\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),SpamEmailCount = countif(ThreatTypes has \"Spam\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount)* 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spam Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal",
+                                        "useGrouping": false
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam TopRecipients Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6e7b357d-6792-41c5-83fc-efae31afe2ee"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains with Spam Detections (Inbound)<br>\r\n\r\n**Displays the top 10 sender domains sending inbound emails detected as Spam. Helps identify external sources most frequently associated with spam content for prioritised monitoring and mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Spam TopSenders Header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1d1bdb8d-9619-488b-935a-3791ad73f096"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(),\r\n            SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spam Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - Spam TopSenders Table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "253efada-ca89-49c5-b1e3-e42ac005b938"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "4"
+                      },
+                      "name": "group - 29-Spam Detections Top attacked users and top senders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "d4cc057f-c9b7-40b9-85d3-52f90767d1f5"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Email Impersonation &amp; BEC Insights\r\n\r\n---\r\nThis tab focuses on the highest-value email threat class: **impersonation and Business Email Compromise (BEC)**. It brings together impersonation and spoof detections, sender authentication (DMARC, DKIM, SPF, CompAuth), supply-chain and partner-compromise correlation, and first-contact / new-vendor senders - the signals that precede targeted financial and credential attacks. It is the email-side companion to the impersonation insights on the **Teams &amp; Collaboration** tab."
+                      },
+                      "name": "text - impersonation bec description",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "id": "fda8ccd5-fafc-457a-a6a2-05b504be1023"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of inbound email impersonation and spoof (BEC) detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet bec = EmailEvents | where EmailDirection == \"Inbound\" | where DetectionMethods has \"Impersonation\" or DetectionMethods has \"Spoof\";\r\nlet inbox = bec | where DeliveryLocation has \"Inbox\";\r\nlet becTrend = toscalar(bec | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(bec | summarize count()), Details = \"Impersonation / Spoof Emails\", Ord = 1, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(SenderFromDomain)), Details = \"Spoofed Sender Domains\", Ord = 3, Trend = becTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "name": "bec kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "91fdd28f-31c4-4f94-b60a-12cd97d44ddf"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Business Email Compromise (BEC) detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Business Email Compromise (BEC) detections Impersonation and Spoof.<br><br>**Recommended action:** Enable mailbox intelligence and impersonation protection for frequently-impersonated users and domains; consider adding confirmed look-alike domains to the Tenant Block List."
+                            },
+                            "name": "text - Phish BEC Banner",
+                            "id": "e3b2232c-8056-4913-a652-64f70e228750"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Impersonation detections Trend\r\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Impersonation detection methods by Microsoft Defender for Office 365. Helps track impersonation attack patterns over time.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Imp Trend Header",
+                            "id": "e95667df-3bcd-4023-9e8f-99ed05bc4bf0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Impersonation'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ImpersonationDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "ImpersonationDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Imp Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "61fa166d-f300-42a6-a324-de18b3fdf4c1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Impersonation detections by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Impersonations.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Imp Tech Header",
+                            "id": "09e1a866-f344-4a92-a3bd-8c3c3c5d598d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Imp Tech Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6cd5662f-13b4-4a9b-afe7-0a6343e3ab5c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Impersonation detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "graphSettings": {
+                                "type": 0
+                              },
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Imp Tech Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "73499618-e842-440e-a555-cd8849093884"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Impersonation detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Impersonation, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Imp Geo Header",
+                            "id": "189a1ac1-f275-4697-880b-7ffae1e5d263"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish BEC Imp Geo Map",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "574b61ad-ec2d-4517-93c5-d0e9bd14f2e9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Impersonation Emails'] = count_\r\n| sort by ['Impersonation Emails'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "title": "Impersonation Detections-Sender Heatmap (IPv4)",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Impersonation Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish BEC Imp Country",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e53b7dbc-4683-4309-b879-c7be68599159"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Spoof detections Trend\r\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Spoof detection methods by Microsoft Defender for Office 365. Helps track Spoofing based attack patterns over time.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Spoof Trend Header",
+                            "id": "8db0f1b0-49bf-43a2-9f9f-164eb9530629"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Spoof'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpoofDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "SpoofDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Spoof Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9a308cd9-bf05-4287-b0d5-54636d081a82"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Spoof detections Trend by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Spoofing.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Spoof Tech Header",
+                            "id": "28c9c15d-d22f-4412-9efc-868b95082668"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily by various Spoof Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "yAxis": [
+                                  "Count"
+                                ],
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "[[\"Spoof external domain\"]",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "[[\"Spoof intra-org\"]",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "[[\"Spoof DMARC\"]",
+                                    "color": "yellowDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Spoof Tech Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1a1328fc-5404-4dff-99ed-3a30082a4cbe"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Spoof detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish BEC Spoof Tech Pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px",
+                              "showBorder": true
+                            },
+                            "id": "f7df9892-85b4-49c3-8739-873b745183a3"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections - Spoof detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Spoofing, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish BEC Spoof Geo Header",
+                            "id": "3c83e7f0-5391-4b1a-bb5b-de0d17488efd"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "map",
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "none"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish BEC Spoof Geo Map",
+                            "styleSettings": {
+                              "margin": "15px",
+                              "padding": "15px"
+                            },
+                            "id": "122d860c-ab0d-475e-b29e-2955020680c7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spoof Emails'] = count_\r\n| sort by ['Spoof Emails'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spoof Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "mapSettings": {
+                                "locInfo": "LatLong",
+                                "latitude": "Latitude",
+                                "longitude": "Longitude",
+                                "sizeSettings": "count_",
+                                "sizeAggregation": "Sum",
+                                "labelSettings": "SenderIPv4",
+                                "legendMetric": "count_",
+                                "legendAggregation": "Sum",
+                                "itemColorSettings": {
+                                  "nodeColorField": "count_",
+                                  "colorAggregation": "Sum",
+                                  "type": "heatmap",
+                                  "heatmapPalette": "red"
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish BEC Spoof Country",
+                            "styleSettings": {
+                              "margin": "15px",
+                              "padding": "15px"
+                            },
+                            "id": "9d0111bc-8d01-4a99-9009-645dc02c3bed"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Supply-Chain &amp; Partner Risk (Possible Partner Compromise)\r\n**Correlates the external domains your organization emails most with inbound emails from those same domains that carried threats. A trusted partner or supplier domain suddenly sending threats is a strong signal that the partner may be compromised - a common supply-chain and business email compromise (BEC) vector.**<br><br>**Recommended action:** Verify any flagged partner through a trusted channel before acting on their recent messages, alert them to a possible compromise, and consider tightening inbound policy for that domain until confirmed clean."
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish Partner Compromise Header",
+                            "id": "2c62c576-3b05-4663-ae2e-4f961d7409c6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) \r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Outbound\"\r\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| summarize count() by RecipientDomain\r\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\r\n| join (EmailEvents | where EmailDirection == \"Inbound\" and isempty(ThreatTypes)==false) on SenderFromDomain\r\n| summarize max(OutboundCount),count() by SenderFromDomain\r\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\r\n| extend Bad_Traffic_Percentage = todouble(round(IncomingEmailsWithThreats / todouble(OutboundEmails) * 100, 2))\r\n| top 15 by OutboundEmails\r\n| project ['Sender Domain'] = SenderFromDomain, ['Outbound Emails'] = OutboundEmails, ['Inbound w/ Threats'] = IncomingEmailsWithThreats, ['Bad Traffic %'] = Bad_Traffic_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Outbound Emails",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Inbound w/ Threats",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "60ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish Partner Compromise",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1aaa047c-1108-4288-833e-61ca35b5495a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Recipients Targeted by Impersonation / BEC\r\n**Lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, showing the number of impersonation emails, how many distinct senders were involved, the top spoofed sender domains, and how many of those messages were delivered to the inbox. Helps identify high-risk users (often executives or finance staff) who may need extra protection or awareness.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - impersonation targets",
+                            "id": "b1e7c2a4-9f3d-4a6b-8c12-7d5e9f0a1b23"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top recipients targeted by impersonation / BEC, with distinct senders, spoofed domains and how many landed in the inbox.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| where DetectionMethods has \"Impersonation\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize ImpersonationEmails = count(),\r\n            DistinctSenders      = dcount(SenderFromAddress),\r\n            TopSpoofedDomains    = make_set(SenderFromDomain, 5),\r\n            DeliveredToInbox     = countif(DeliveryLocation has \"Inbox\")\r\n        by RecipientEmailAddress\r\n| top 20 by ImpersonationEmails\r\n| project ['Recipient'] = RecipientEmailAddress, ['Impersonation Emails'] = ImpersonationEmails, ['Distinct Senders'] = DistinctSenders, ['Top Spoofed Domains'] = strcat_array(TopSpoofedDomains, \", \"), ['Delivered to Inbox'] = DeliveredToInbox",
+                              "size": 0,
+                              "title": "Top Recipients Targeted by Impersonation / BEC",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "showAnalytics": true,
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Impersonation Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "conditionalVisibility": {
+                              "parameterName": "Tab",
+                              "comparison": "isEqualTo",
+                              "value": "15"
+                            },
+                            "name": "newviz - impersonation targets",
+                            "id": "afe28369-af82-47ae-846d-179bd86b660e"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "name": "group - 7 - Phish-BEC-Insights",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "b7971cd9-d086-47c7-8f66-50956b9c56c3"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Sender Authentication details (DMARC, DKIM, SPF, CompAuth)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Sender Authentication checks details in inbound email by Microsoft Defender for Office 365 focusing on the various Sender Authentication standards: DMARC, DKIM, SPF, CompAuth.<br><br>**Recommended action:** For domains failing DMARC/DKIM/SPF, verify your own outbound authentication is published and enforced (p=reject), and treat persistent external spoofers as possible block candidates."
+                            },
+                            "name": "text - Phish Section5 Banner",
+                            "id": "90d7a338-d943-4398-b788-bfd4f93007d4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections Sender Authentication Trend (DMARC, DKIM, SPF, CompAuth)\r\n**Shows counts (per {Granularity}) of sender authentication check outcomes (DMARC, DKIM, SPF, CompAuth) performed by Microsoft Defender for Office 365 on inbound emails. Useful for monitoring authentication success and failure patterns over time to identify anomalies or potential phishing risks.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish SenderAuth Trend Header",
+                            "id": "4a0ab90e-55dd-4fa6-82c3-0edc57ce0966"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof- DMARC fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DMARCFail = (tostring(parse_json(AuthenticationDetails).DMARC) == \"fail\") \r\n| summarize DMARCFail = sum(DMARCFail) by bin (Timestamp,{Granularity})",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "DMARCFail",
+                                    "color": "orangeDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish Auth DMARC Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "79920d30-01d4-4412-b994-853e50c9d7d8"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof- DKIM fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DKIMFail = (tostring(parse_json(AuthenticationDetails).DKIM) == \"fail\") \r\n| summarize DKIMFail = sum(DKIMFail) by bin (Timestamp,{Granularity})",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "DKIMFail",
+                                    "color": "yellowDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish Auth DKIM Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "bf09ffd4-eee0-42f7-a507-1cf54d9c365a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof- SPF fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend SPFFail = (tostring(parse_json(AuthenticationDetails).SPF) == \"fail\") \r\n| summarize SPFFail = sum(SPFFail) by bin (Timestamp,{Granularity})",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "SPFFail",
+                                    "color": "purpleDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish Auth SPF Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "4d66fe13-9904-45cf-8783-f3ee984f3a66"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof- Composite Authentication fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend CompAuthFail = (tostring(parse_json(AuthenticationDetails).CompAuth) == \"fail\") \r\n| summarize CompAuthFail = sum(CompAuthFail) by bin (Timestamp,{Granularity})",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "CompAuthFail",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - Phish Auth CompAuth Trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "0968b828-23fe-4fa2-a5ea-8ab39362457f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections Top Sender Domains with DMARC Failures (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails where Spoof-DMARC detection triggered. Includes total inbound email volume and calculates DMARC fail traffic percentage per domain to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish Auth DMARC Domains Header",
+                            "id": "24d4689a-eb6d-49f5-85a8-fcadca409f7a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and DMARC fail traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof DMARC\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where DMARCFailCount !=0\r\n| top 10 by DMARCFailCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['DMARC Failures'] = DMARCFailCount, ['Total Inbound'] = TotalEmailCount, ['DMARC Fail %'] = DMARCFail_Traffic_Percentage",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "DMARCFail",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "DMARC Fail %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish Auth DMARC Domains",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "642814ad-9d24-4be9-ae10-3578e89da05b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections Top Sender Domains with Spoof External Domain Detections (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof External Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish Auth SpoofExt Domains Header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "993fdc34-354b-412e-be39-facbde4f4f0e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof external domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof external domain\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofExternalCount !=0\r\n| top 10 by SpoofExternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof External'] = SpoofExternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof External %'] = SpoofExternal_Traffic_Percentage",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spoof External",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spoof External %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "SpoofExternalFail",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true,
+                                "sortBy": [
+                                  {
+                                    "itemKey": "Spoof External %",
+                                    "sortOrder": 2
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish Auth SpoofExt Domains",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "69ca3799-d2d5-4896-b3a5-1eeba46f0b46"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phish Detections Top Sender Domains with Spoof Internal Domain Detections (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof Internal Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - Phish Auth SpoofInt Domains Header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3fa33c5d-0eba-471f-b47f-0c12c1f770d6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof intra-org\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofInternalCount !=0\r\n| top 10 by SpoofInternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof Internal'] = SpoofInternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof Internal %'] = SpoofInternal_Traffic_Percentage",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "title": "Top 10 Spoof intra-org detections by Sender domain (P1/P2)",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spoof Internal",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spoof Internal %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "SpoofIntraorgFail",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - Phish Auth SpoofInt Domains",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "ae0c65c7-68ea-4d50-b177-1effeaf1c045"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "name": "group - 8-Phish-SenderAuth",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "8077779a-4da8-46be-8032-626bd8c36dbd"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">First-Contact &amp; New-Vendor Senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nExternal email senders and domains seen for the first time in the selected period. New/first-contact relationships - especially ones already carrying threats - are a common precursor to phishing, business email compromise (BEC), and supply-chain attacks.<br><br>**Recommended action:** Treat brand-new domains sending threats as high-priority review; verify any that claim to be a known brand or partner before trusting their messages."
+                            },
+                            "name": "phish fc banner",
+                            "id": "05b83435-c7ed-48a3-919e-388b2e599726"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### First-contact external senders<br>\r\n\r\n**External email senders ordered by when they were first seen in the period (most recent first). In tenants with longer history this highlights genuinely new senders.**"
+                            },
+                            "customWidth": "100",
+                            "name": "phish fc senders header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "c57dffb4-dfdb-4a1e-93be-16fa9e856a0d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists external email senders seen for the first time in the selected period (most recent first), surfacing new/first-contact senders. In tenants with longer history this highlights genuinely new relationships - a common precursor to BEC and supply-chain attacks.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderFromAddress)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), Messages=count(), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\r\n| top 20 by FirstSeen desc\r\n| project ['Sender']=SenderFromAddress, ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, ['Threat Messages']=ThreatMessages",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "phish fc senders table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d1ceb0ac-2dad-49af-b416-a3376a7b8513"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### New sender domains carrying threats<br>\r\n\r\n**External sender domains seen for the first time in the period that already carried threats, most-recent first. A brand-new domain sending threats to your users is a strong early-warning signal.**"
+                            },
+                            "customWidth": "100",
+                            "name": "phish fc domains header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "bd29bbe4-cde2-499c-a1d0-e2cc51f7733d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists external sender domains seen for the first time in the selected period that already carried threats, ranked by most-recently first seen. A brand-new domain sending threats to your users is a strong early-warning signal for phishing and BEC.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Messages=count(), Senders=dcount(SenderFromAddress), Recipients=dcount(RecipientEmailAddress), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderDomain\r\n| where ThreatMessages > 0\r\n| top 20 by FirstSeen desc\r\n| project ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, Senders, Recipients, ['Threat Messages']=ThreatMessages, ['Last Seen']=LastSeen",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Senders",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Recipients",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "phish fc domains table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7da952d5-5ae2-4b2e-a5cf-c78b11bda4f8"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "15"
+                      },
+                      "customWidth": "100",
+                      "name": "group - Phish First Contact",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "90e5248a-2c35-48f3-869c-c45c631c6fbf"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# URL Detections and URL Click Insights\r\n\r\n---\r\nThis tab provides insights into **URL-based detections** in email messages and details about URL clicks performed by end users on URLs identified as **malicious**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "text - 24 - Copy - Copy",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "2156430d-fec6-48bb-a9a8-3166182f6993"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//KPI summary of URL threat protection (Safe Links clicks and URLs seen in email) for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet clicks = UrlClickEvents;\r\nlet blocked = clicks | where ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\");\r\nlet allowed = clicks | where ActionType == \"ClickAllowed\";\r\nlet blockedTrend = toscalar(blocked | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet allowedTrend = toscalar(allowed | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet usersTrend = toscalar(clicks | make-series Trend = dcount(AccountUpn) default = 0 on Timestamp step gran | project Trend);\r\nlet urlsTrend = toscalar(EmailUrlInfo | make-series Trend = dcount(Url) default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(blocked | summarize count()), Details = \"Malicious Clicks Blocked\", Ord = 1, Trend = blockedTrend),\r\n(print Count = toscalar(allowed | summarize count()), Details = \"Clicks Allowed Through\", Ord = 2, Trend = allowedTrend),\r\n(print Count = toscalar(clicks | summarize dcount(AccountUpn)), Details = \"Users Clicking Links\", Ord = 3, Trend = usersTrend),\r\n(print Count = toscalar(EmailUrlInfo | summarize dcount(Url)), Details = \"Distinct URLs in Email\", Ord = 4, Trend = urlsTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "url kpi strip",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "d5e2326a-a5dd-4217-bb75-0e337d75d306"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Insights on URL-Based Threat Detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain URL based threat detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends of URL-based threat detections, QR code detections, and URL scans activity by locations.<br><br>**Recommended action:** Confirm Safe Links is enabled for email and Teams; investigate QR-code and URL detection spikes for emerging campaigns."
+                            },
+                            "name": "text - 13 - Copy",
+                            "id": "ed3468e7-1936-45fd-9168-93010a662302"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend of URL-Based Malware Threat Detections<br>\r\n\r\n**This visual displays a per-{Granularity} trend of emails with URL based Malware threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for malware threats.**"
+                            },
+                            "name": "text - 13 - Copy - Copy",
+                            "id": "77e7bbac-d752-478b-bce9-06bb1bd12bfe"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod contains \"URL\"\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "query - 8 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "79ef5e7b-57a6-4519-9899-18fd8cae5e68"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend of URL-Based Phish Threat Detections<br>\r\n\r\n**This visual displays a per-{Granularity} trend of emails with URL based Phish threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for Phish threats.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy",
+                            "id": "48923812-5440-4f47-8881-273f14cbfb8e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total emails with Phishing detections over time summarizing the data daily by various Phishing URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Phish'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand PhishMethod = ParsedMethods.Phish\r\n| where PhishMethod contains \"URL\"\r\n| summarize Count = count() by PhishMethod = tostring(PhishMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct PhishMethod | extend d = 1) on d | project Timestamp, PhishMethod\r\n| join kind=leftouter (agg) on Timestamp, PhishMethod\r\n| project Timestamp, PhishMethod, Count = coalesce(Count, 0)\r\n| sort by PhishMethod asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "query - 8 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b983b361-6c2e-47d5-b2c5-edd9caa6a55d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend (per {Granularity}) of QR Code-Based Threat Detections<br>\r\n\r\n**Displays counts (per {Granularity}) of inbound emails containing QR codes flagged for Phish, Malware, or Spam via URL-based detection methods. Helps track QR code abuse patterns over time.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3d8b75e1-6e1d-44eb-b1fc-78d3db7feb71"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### URL Scan activity by Location (per {Granularity})<br>\r\n\r\n**Displays counts (per {Granularity}) of URLs scanned from various locations within emails (e.g., body, attachments, QR codes). Helps identify where malicious URLs are most commonly embedded.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b275b28c-e441-4c19-9055-256d5d45c69c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\" \r\n| where DetectionMethods has \"Url\"\r\n| join EmailUrlInfo on NetworkMessageId\r\n| where UrlLocation == \"QRCode\"\r\n| summarize [\"Phish QR Detection\"]=countif(parse_json(DetectionMethods).Phish has \"URL\"), [\"Malware QR Detection\"]=countif(parse_json(DetectionMethods).Malware has \"URL\"), [\"Spam QR Detection\"]=countif(parse_json(DetectionMethods).Spam has \"URL\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Phish QR Detection\"]=coalesce([\"Phish QR Detection\"],0), [\"Malware QR Detection\"]=coalesce([\"Malware QR Detection\"],0), [\"Spam QR Detection\"]=coalesce([\"Spam QR Detection\"],0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "graphSettings": {
+                                "type": 0
+                              },
+                              "chartSettings": {
+                                "xAxis": "Timestamp",
+                                "xSettings": {
+                                  "dateFormatSettings": {
+                                    "formatName": "shortDatePattern",
+                                    "showUtcTime": false
+                                  }
+                                }
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 6",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6c2a7724-d3c2-42b2-b8da-7acbcd0666c6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises where URL's have been scanned identified from various locations in emails\r\nEmailUrlInfo\r\n| summarize  count() by UrlLocation",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 5",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5640dbd5-4085-4f2a-8fb9-e4112233e99e"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "group - 9-URL detections",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "b572d79b-17a0-48ac-9a43-4f20324cf998"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Insights on URL Click-Based Threat Detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain URL click based threat detections in emails as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend of blocked URL clicks, time-of-click URL scans by workload, malicious clicks allowed, top clicks on malicious URLs, and more.<br><br>**Recommended action:** For blocked-click spikes, verify Safe Links is set to not allow click-through; investigate workloads with high click-through activity."
+                            },
+                            "name": "text - 13 - Copy - Copy",
+                            "id": "6d37617e-911e-4ce6-a10d-4749486738ea"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend (per {Granularity}) of Blocked URL Click Events<br>\r\n\r\n**Shows the count (per {Granularity}) of blocked URL click attempts and click attempts on URLs with detections, grouped by threat types (e.g., Phish, Malware, Spam). Helps track user interaction with malicious links over time across various threat types.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy",
+                            "id": "9e477950-bedc-4cc0-9863-df07d124806c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// Generates a time-series analysis for blocked URL click events from the 'UrlClickEvents' table\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| where ActionType has_any(\"ClickBlocked\")\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, BlockedClicks = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "BlockedClicks",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "query - 4",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "366e80d9-f6ed-43af-91e5-3d04cdcf692d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of click attempts on URL's with detections split by the different threat types identified\r\nUrlClickEvents\r\n| where isnotempty(ThreatTypes)\r\n| summarize count() by ThreatTypes",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "query - 4",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a356eac3-62c2-4fc9-a4d9-3b05b13848df"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Trend (per {Granularity}) of URL Click Actions by Type<br>\r\n\r\n**Displays counts (per {Granularity}) of URL click events categorised by action type: Blocked, Allowed, Pending Verdict, Error Page, and Clicked Through. Helps identify risky user behaviour and policy gaps.**"
+                            },
+                            "customWidth": "66",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a91fe7a6-f507-48f7-bbcc-61dc4f998ba6"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### URL Clicks by Workload<br>\r\n\r\n**Displays counts (per {Granularity}) of URL click events grouped by Workload (e.g., Outlook, Teams, Copilot, Office Apps: Word, Excel, PowerPoint) Helps identify which applications are most frequently used for URL interactions and potential risk exposure.**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "ce05fa08-6e68-4c02-a0bf-2be6cdfae935"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises different URL click event types by action (e.g., blocked, allowed, pending verdict, error pages, and clicked through), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| summarize ClickBlocked=countif(ActionType has_any(\"ClickBlocked\")), ClickAllowed=countif(ActionType has_any(\"ClickAllowed\")), PendingVerdict=countif(ActionType has_any(\"UrlScanInProgress\")), ErrorPage=countif(ActionType has_any(\"UrlErrorPage\")), ClickedThrough=countif(IsClickedThrough == true) by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickBlocked=coalesce(ClickBlocked,0), ClickAllowed=coalesce(ClickAllowed,0), PendingVerdict=coalesce(PendingVerdict,0), ErrorPage=coalesce(ErrorPage,0), ClickedThrough=coalesce(ClickedThrough,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "query - 1",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a12b4c78-7d18-4adc-86e0-54395d6a996a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises where URL clicks scanned by the Workload the click happened from\r\nUrlClickEvents\r\n| summarize  count() by Workload",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "query - 5 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3237cd55-1d5c-41a9-a8f2-1d46c61a709e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Blocked URL Clicks by Workload (per {Granularity})<br>\r\n\r\n**Displays counts (per {Granularity}) of blocked URL click attempts grouped by Workload (Email, Teams, Office, Microsoft 365 Copilot). Helps identify which platforms are most exposed to malicious link interactions and where user awareness or policy enforcement should be strengthened.**"
+                            },
+                            "customWidth": "66",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1f209a83-3d50-4bb8-9a79-a365a50a4142"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Click-Through Activity on Detected URLs by Workload<br>\r\n\r\n**Displays counts of click‑through actions on URLs already identified with detections, grouped by Workload where the click happened. Helps identify clients/platforms where users are most likely to proceed to risky URLs and prioritise awareness training or policy tuning for those workloads**"
+                            },
+                            "customWidth": "33",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "33592db8-0ff5-4d8e-bd8f-0201b81a4584"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises blocked URL click event types by Workload (e.g., Email, Teams, Office, Microsoft 365 Copilot), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where ActionType ==\"ClickBlocked\"\r\n| summarize Teams=countif(Workload==\"Teams\"), Office=countif(Workload==\"Office\"), Email=countif(Workload==\"Email\"), Copilot=countif(Workload==\"Copilot\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Teams=coalesce(Teams,0), Office=coalesce(Office,0), Email=coalesce(Email,0), Copilot=coalesce(Copilot,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "66",
+                            "name": "query - 3",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "80241767-0f69-4e2e-9889-3bf1f48e4f02"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of click-through activities on URL's with detections split by the source client\r\nUrlClickEvents \r\n| where IsClickedThrough !=\"0\"\r\n| where isnotempty(ThreatTypes) \r\n| summarize count() by Workload",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "query - 2",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "fde29b46-2896-4bfc-bb61-09436696d738"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top clicks on Malicious URLs<br>\r\n\r\n**Displays the top 20 URLs associated with detections that registered the highest number of clicks. Includes ThreatTypes, ActionType, and Workload to provide context on the nature of the threat and where user interaction occurred.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "22bda63a-626c-47de-9a76-ad665ef87862"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows the top 20 URL's that have a detection associated with the most ammount of clicks registered \r\nUrlClickEvents\r\n| where ThreatTypes !=\"\"\r\n| summarize count() by Url, ThreatTypes, ActionType, Workload\r\n| top 20 by count_\r\n| project ['URL']=Url, ['Threat Types']=ThreatTypes, ['Action Type']=ActionType, Workload, ['Click Count']=count_",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Click Count",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 10 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a044fd4e-7be6-4a11-974c-b54e417c2a81"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "group - 31-URL clicks",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "75e543f6-08c0-42ed-9869-ecd61b721d34"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Risky Users Clicking on URLs with Threats\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and identify users who have clicked on malicious URLs detected by Microsoft Defender for Office 365.<br><br>**Recommended action:** Enroll these users in security awareness training and verify Safe Links policy coverage for their mailboxes."
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy",
+                            "id": "19487811-a94b-4537-877e-61ac7e287c21"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Users Clicking on URLs with Malware Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Malware. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "78e10621-0e98-44c4-8399-810c19f138c2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 users with click attempts on URL's with malware detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),MalwareClickCount = countif(ThreatTypes has \"Malware\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(MalwareClickCount / todouble(TotalClickCount) *100, 2))\r\n| where MalwareClickCount !=0\r\n| sort by MalwareClickCount desc\r\n| top 15 by MalwareClickCount\r\n| project ['User']=AccountUpn, ['Malware Clicks']=MalwareClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malware Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "25ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Clicks",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Click %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "25ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TotalEmailCount",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - 18 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a7ae8a75-ca7f-49be-8cad-d1451a3bd396"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Users Clicking on URLs with Phish Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Phish. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "90d9a0c3-970a-4998-be62-3b3b84bb0f37"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 users with click attempts on URL's with Phish detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),PhishClickCount = countif(ThreatTypes has \"Phish\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(PhishClickCount / todouble(TotalClickCount) *100, 2))\r\n| where PhishClickCount !=0\r\n| sort by PhishClickCount desc\r\n| top 15 by PhishClickCount\r\n| project ['User']=AccountUpn, ['Phish Clicks']=PhishClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Phish Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "25ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Clicks",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Click %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "25ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareClickCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TotalEmailCount",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - 18 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d46877d9-03af-463a-b406-bb4c601dffeb"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Users Clicking on URLs with Spam Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Spam. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "dc66e020-0932-4346-8e20-6a2dc78de7a9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 users with click attempts on URL's with Spam detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),SpamClickCount = countif(ThreatTypes has \"Spam\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(SpamClickCount / todouble(TotalClickCount) *100, 2))\r\n| where SpamClickCount !=0\r\n| sort by SpamClickCount desc\r\n| top 15 by SpamClickCount\r\n| project ['User']=AccountUpn, ['Spam Clicks']=SpamClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Spam Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "25ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Clicks",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Click %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "25ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "PhishClickCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareClickCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "MalwareEmailCount",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "TotalEmailCount",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "count_",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "50ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "100",
+                            "name": "query - 18 - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "734ee45e-4dff-4ca1-b17d-02389086b17b"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "5"
+                      },
+                      "name": "group - 32-Top clickers",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "ee6c3413-28be-49a1-a89d-bf5fce7acfa4"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Microsoft Teams Collaboration Protection\r\n\r\n---\r\nAs email defenses mature, attackers are shifting into **Microsoft Teams**, where messages bypass secure email gateways and carry the implicit trust of a colleague chat. Microsoft Threat Intelligence reports Teams-based phishing and voice phishing (vishing) rising steadily through 2026, most often as **IT help desk or technical-support impersonation** from external or newly-created tenants, used to steer users toward remote-access tools and credential theft.\r\n\r\nThis tab shows **Microsoft Defender for Office 365** protection for Microsoft Teams: threat detections and impersonation, suspicious external senders, malicious URLs and clicks, malicious files, post-delivery ZAP removals, and user and admin submissions across chats and channels.\r\n\r\n**Recommended action:** Treat unsolicited external help desk or IT support contact as suspicious. Restrict inbound chat from unmanaged and consumer tenants, allowlist trusted external domains, remove or restrict remote-support tools such as Quick Assist where they are not required, and enforce phishing-resistant MFA for all users (Conditional Access with authentication strength), prioritizing privileged and administrator accounts first.\r\n\r\n[<p><b>Disrupting threats targeting Microsoft Teams</b></p>](https://www.microsoft.com/en-us/security/blog/2025/10/07/disrupting-threats-targeting-microsoft-teams/)[<p><b>Cross-tenant helpdesk impersonation to data exfiltration: a human-operated intrusion playbook</b></p>](https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/)[<p><b>Help on the line: how a Microsoft Teams support call led to compromise</b></p>](https://www.microsoft.com/en-us/security/blog/2026/03/16/help-on-the-line-how-a-microsoft-teams-support-call-led-to-compromise/)[<p><b>Email threat landscape: Q2 2026 trends and insights</b></p>](https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/)"
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "text - teams description",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "5c0f0100-0a11-4b22-9c33-000000000100"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//Headline Microsoft Teams protection metrics for the selected period, with per-interval sparklines. Messages are de-duplicated to the latest record per Teams message.\r\nlet gran = {Granularity};\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(msgs | summarize Count = count() | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(msgs | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Messages with Threats\", Ord = 2, Trend = toscalar(msgs | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend Details = \"Phish Detections\", Ord = 3, Trend = toscalar(msgs | where ThreatTypes has \"Phish\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend Details = \"Malware Detections\", Ord = 4, Trend = toscalar(msgs | where ThreatTypes has \"Malware\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend Details = \"Spam Detections\", Ord = 5, Trend = toscalar(msgs | where ThreatTypes has \"Spam\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 6, Trend = toscalar(msgs | where SafetyTip == \"URLMessageWarning\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(zap | summarize Count = count() | extend Details = \"Post-Delivery ZAP Actions\", Ord = 7, Trend = toscalar(zap | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+                        "size": 3,
+                        "showAnalytics": true,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "name": "teams kpi tiles",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "b2c476ca-4141-43b4-9d4e-98470aa432fc",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      }
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Microsoft Teams - Collaboration Protection Overview\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 extends its protection to **Microsoft Teams**, detecting malicious messages, URLs, and files shared through chats and channels. This tab summarizes Teams message detections, link-safety warnings, post-delivery ZAP, file scanning, and user/admin submissions.<br><br>*Scope note: the Teams message tables surface metadata for external-conversation messages plus internal messages that contain URLs, so counts reflect that scope rather than the full volume of Teams messages.*"
+                            },
+                            "name": "teams overview banner",
+                            "id": "2f71360f-1673-480f-8361-5afc83aee67d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Teams threat detections over time<br>\r\n\r\n**Volume (per selected interval) of Microsoft Teams messages detected with a threat by Microsoft Defender for Office 365. Spikes may indicate a targeted Teams-based campaign.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams trend header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "0ac71d4e-8ecb-4d17-9fd3-10754007ec07"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the number of Microsoft Teams messages detected with a threat over time, de-duplicated to the latest record per message and summarized per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId | summarize ThreatDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ThreatDetections = coalesce(ThreatDetections, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp",
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "ThreatDetections",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams detection trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "937f3bc6-21f5-4f4c-ab72-78f08f32c5bd"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Threat type breakdown<br>\r\n\r\n**Split of Microsoft Teams threat detections across Phish, Malware, and Spam.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams threat pie header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "645a39ae-843a-47db-8016-6082ef37744d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Thread exposure<br>\r\n\r\n**De-duplicated Microsoft Teams messages split by whether the conversation includes external participants.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams thread header",
+                            "id": "a1a48f9a-8593-4ab5-8824-5998c643e844"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query breaks down Microsoft Teams threat detections by threat type for the selected period, de-duplicated to the latest record per message. A message flagged for more than one threat type is counted under each, so the split can exceed the distinct message count.\r\nlet msgs = MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nunion\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend ThreatType = \"Phish\"),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend ThreatType = \"Malware\"),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend ThreatType = \"Spam\")\r\n| project ThreatType, Count",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "teams threat type pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "029b4ecc-cd95-4385-a251-8ab194add8f4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| extend Thread = iif(IsExternalThread == true, \"External Thread\", \"Internal Thread\")\r\n| summarize Count = count() by Thread",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "teams thread pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1581f447-9b3e-4857-84b8-e78b5df65ac5"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Overview",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "283f36b2-5c54-4afe-9a87-33d4796bd5b7"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Calls and Vishing (Voice Phishing)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Voice phishing (vishing) over Microsoft Teams is the fastest-growing collaboration threat of 2026. Attackers impersonate IT help desk or support and call users directly, often after a chat lure, to talk them into granting remote access or entering credentials. Because a target must be online to answer, malicious calls cluster in working hours. This section surfaces Teams call activity, when calls happen, and callers using support or brand-impersonation identities.**<br><br>*Interim data source: Teams call activity is currently read from Microsoft Defender for Cloud Apps call telemetry (CloudAppEvents). It will move to the dedicated CallActivityEvents table once that table is available to stream into Microsoft Sentinel.*<br><br>**Recommended action:** Treat unsolicited help desk or support calls as suspicious. Confirm any request through a known internal channel, and never grant remote access such as Quick Assist on the strength of an inbound Teams call. Restrict inbound calls and chat from unmanaged and consumer tenants."
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls banner",
+                            "id": "9815bdc9-9e10-4e84-9164-783092b4ccb0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Teams call and vishing headline metrics for the selected period, with per-interval sparklines. Interim source: Defender for Cloud Apps call telemetry (CloudAppEvents / CallParticipantDetail).\r\nlet gran = {Granularity};\r\nlet calls = materialize(CloudAppEvents | where ActionType == \"CallParticipantDetail\" | extend R = parse_json(RawEventData) | extend CallId = tostring(R.CallId), UId = tolower(tostring(R.UserId)));\r\nlet susp = calls | extend Local = tostring(split(UId, \"@\")[0]), Dom = tostring(split(UId, \"@\")[1]) | where Local matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\" or Dom endswith \".onmicrosoft.com\";\r\nlet reported = CloudAppEvents | where ActionType == \"CallReported\";\r\nunion\r\n(calls | summarize Count = dcount(CallId) | extend Details = \"Teams Calls\", Ord = 1, Trend = toscalar(calls | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(susp | summarize Count = dcount(UId) | extend Details = \"Impersonation-style Callers\", Ord = 2, Trend = toscalar(susp | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(reported | summarize Count = count() | extend Details = \"Reported Suspicious Calls\", Ord = 3, Trend = toscalar(reported | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+                              "size": 3,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Trend",
+                                  "formatter": 21
+                                },
+                                "showBorder": true,
+                                "size": "auto"
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls kpi",
+                            "id": "be8946d9-1eae-405c-b8df-cee2242cb44d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Teams call activity over time<br>\r\n**Distinct Microsoft Teams calls per selected interval. A sudden rise, or calls outside normal working hours, can indicate a vishing campaign in progress.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls trend header",
+                            "id": "1b49c98f-e5d9-457c-b058-a195e89eac0e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Distinct Teams calls per interval (interim source: CloudAppEvents / CallParticipantDetail).\r\nCloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId)\r\n| summarize ['Teams Calls'] = dcount(CallId) by Timestamp = bin(Timestamp, {Granularity})\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp",
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Teams Calls",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls trend",
+                            "id": "7538b3ca-b96d-421a-9cdc-69b8aef4b185"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### When calls happen (hour of day, UTC)<br>\r\n**Microsoft Teams calls by the hour of day they started (UTC), listed 00:00 through 23:00. The bar length is the number of calls that started in that hour across the selected period. Vishing calls cluster in working hours because the target must be online to answer, with the heaviest malicious-call activity between 14:00 and 20:00 UTC, Monday to Friday, according to Microsoft Threat Intelligence. Use this to baseline normal call timing and spot unusual off-hours spikes.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls hour header",
+                            "id": "6bc095e9-fe0d-4f6f-81bd-f3374d758229"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Teams calls by start hour of day (UTC), all 24 hours 00:00..23:00 in order (interim source: CloudAppEvents / CallParticipantDetail).\r\nlet data = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend JoinTime = todatetime(R.JoinTime), CallId = tostring(R.CallId)\r\n| where isnotempty(JoinTime) and isnotempty(CallId)\r\n| summarize CallStart = min(JoinTime) by CallId\r\n| extend HourUTC = hourofday(CallStart)\r\n| summarize Calls = count() by HourUTC;\r\nrange HourUTC from 0 to 23 step 1\r\n| join kind=leftouter (data) on HourUTC\r\n| extend Calls = coalesce(Calls, 0)\r\n| extend HourLabel = strcat(iif(HourUTC < 10, strcat(\"0\", tostring(HourUTC)), tostring(HourUTC)), \":00\")\r\n| order by HourUTC asc\r\n| project ['Hour of Day (UTC)'] = HourLabel, ['Teams Calls'] = Calls",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Teams Calls",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blueDark",
+                                      "customColumnWidthSetting": "360px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls hour",
+                            "id": "c36a9909-5570-4fe7-8efc-1b9b4745713a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Suspicious callers (support and helpdesk impersonation)<br>\r\n**Teams call participants whose display name or address looks like IT support, help desk, or a well-known brand (for example \"Microsoft IT support\", \"Help Desk\", \"Office 365 Support\"), or who dial in from a throwaway `.onmicrosoft.com` tenant. Origin shows whether the caller is external, an external throwaway tenant, or inside your own tenant. External and throwaway-tenant callers are the primary vishing risk; own-tenant matches are frequently a legitimate internal help desk and should be confirmed rather than assumed malicious.**<br><br>**Recommended action:** Prioritise External and `.onmicrosoft` callers, confirm none are legitimate, and warn the users they called. Genuine IT support does not cold-call staff over Teams to request remote access."
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls susp header",
+                            "id": "aa420b5f-efd2-4da5-ab41-192031f62ed1"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Suspicious Teams callers by impersonation-style DISPLAY NAME or address (Attendees[].DisplayName / UPN), with Origin from the org's own accepted (EmailEvents inbound) domains - no tenant-id anchor. Interim source: CloudAppEvents / CallParticipantDetail.\r\nlet suspRegex = @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\";\r\nlet ownDomains = toscalar(EmailEvents | where EmailDirection == \"Inbound\" | extend RD = tolower(tostring(split(RecipientEmailAddress, \"@\")[1])) | where isnotempty(RD) | summarize make_set(RD, 200));\r\nlet calls = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId), JoinTime = todatetime(R.JoinTime), Attendees = R.Attendees\r\n| where isnotempty(CallId);\r\nlet callAtt = calls | summarize Attendees = take_any(Attendees), JoinTime = min(JoinTime) by CallId;\r\ncallAtt\r\n| mv-expand Att = Attendees\r\n| extend Caller = tolower(tostring(Att.UPN)), CallerName = tostring(Att.DisplayName)\r\n| extend CallerDom = tostring(split(Caller, \"@\")[1])\r\n| where isnotempty(Caller)\r\n| extend SuspName = CallerName matches regex suspRegex or Caller matches regex suspRegex\r\n| where SuspName or CallerDom endswith \".onmicrosoft.com\"\r\n| extend Origin = case(CallerDom endswith \".onmicrosoft.com\", \"External (.onmicrosoft throwaway)\", set_has_element(ownDomains, CallerDom), \"Own tenant\", \"External\")\r\n| summarize CallsPlaced = dcount(CallId), FirstSeen = min(JoinTime), LastSeen = max(JoinTime) by CallerName, Caller, Origin\r\n| extend OriginRank = case(Origin == \"External (.onmicrosoft throwaway)\", 0, Origin == \"External\", 1, 2)\r\n| sort by OriginRank asc, CallsPlaced desc\r\n| take 10\r\n| project ['Caller Display Name'] = CallerName, ['Caller Address'] = Caller, ['Origin'] = Origin, ['Calls Placed'] = CallsPlaced, ['First Seen'] = FirstSeen, ['Last Seen'] = LastSeen",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Calls Placed",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams calls susp table",
+                            "id": "d1c4df7b-db07-4c4c-bc71-dfd8623cd704"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Calls and Vishing",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "1d133411-9b5c-4ede-8502-68b3b02262e4"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Impersonation &amp; Identity Deception\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 flags Teams messages where a sender impersonates a brand, a specific person, or a trusted domain. Impersonation is the entry point for most Teams social-engineering: attackers pose as IT, executives, or Microsoft to build trust before delivering a malicious link or request. These visuals expose <b>who is being impersonated, who is being targeted, and the infrastructure (display names, look-alike domains, and URLs)</b> behind the campaigns so you can hunt IOCs and coach at-risk users.<br><br>**Recommended action:** Treat the impersonated display names and look-alike domains below as IOCs to hunt, and prioritize the Microsoft Defender alert *Microsoft Teams chat initiated by a suspicious external user*. Teach users that a Teams display name is not proof of identity: verify the real sender domain, and confirm any help desk, executive, or Microsoft support request through a known internal channel before acting."
+                            },
+                            "name": "teams imp banner",
+                            "id": "7ff04ff3-9f2d-4a49-8383-2b542d78fe9b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nunion\r\n(imp | summarize Count=count() | extend Details=\"Impersonation Detections\", Ord=1),\r\n(imp | summarize Count=dcount(FakeSenderAddress) | extend Details=\"Distinct Fake Senders\", Ord=2),\r\n(imp | summarize Count=dcount(TargetUser) | extend Details=\"Targeted Users\", Ord=3),\r\n(imp | summarize Count=dcount(ImpersonationType) | extend Details=\"Impersonation Types\", Ord=4)\r\n| sort by Ord asc | project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e37f94d5-9bcc-432e-aa66-25831603c228"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Impersonation over time, by type<br>\r\n\r\n**Trend of Brand, User, and Domain impersonation detections. A spike in a single type often marks the start of a targeted campaign.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp trend header",
+                            "id": "09907f5b-5c20-4a7e-86d3-c89153c4df98"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Count=count() by ImpersonationType, Timestamp=bin(Timestamp, {Granularity}) | sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp trend",
+                            "id": "757204b1-e900-4217-a2ff-2224a033fdcc"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Suspicious external senders (impersonation and throwaway tenants)<br>\r\n**External Microsoft Teams senders flagged as likely impersonation: throwaway `.onmicrosoft.com` tenants and/or help desk, IT support, security, admin, or account/update-themed display names. Attackers rotate through many such identities (for example numbered `ithelpdesk<n>@...` addresses) from newly-created or consumer tenants to pose as internal support, frequently before the Defender impersonation detector assigns a verdict. This heuristic complements that detector.**<br><br>**Recommended action:** Review high threat-rate senders, block the sending domains, and remind users that genuine IT support does not cold-contact them from an external tenant; verify any such request through a known internal channel."
+                            },
+                            "customWidth": "100",
+                            "name": "teams susp senders header",
+                            "id": "5df4af86-49e9-4fc7-b6ad-76d3ef3f7da6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//External Teams senders flagged as likely impersonation: throwaway .onmicrosoft.com tenants and/or help desk / IT / admin / update-themed display names, ranked by messages carrying a threat.\r\nMessageEvents\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \"@\")[1]))\r\n| extend IsOnMicrosoft = SenderDomain endswith \".onmicrosoft.com\"\r\n| extend SuspName = SenderDisplayName matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\"\r\n| where IsOnMicrosoft or SuspName\r\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\r\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \"Throwaway .onmicrosoft tenant + helpdesk-style name\", IsOnMicrosoft, \"Throwaway .onmicrosoft tenant\", \"Helpdesk / IT-style display name\")\r\n| extend ThreatPct = round(todouble(ThreatMessages) * 100 / TeamsMessages, 1)\r\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages, ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\r\n| sort by ['Threat Messages'] desc, ['Teams Messages'] desc\r\n| take 10",
+                              "size": 0,
+                              "title": "",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Teams Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 100
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "showAnalytics": true
+                            },
+                            "customWidth": "100",
+                            "name": "teams susp senders table",
+                            "id": "dd1d79d8-f591-4aae-bd44-6ad23a3e0ae4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Who is being targeted<br>\r\n\r\n**Internal users receiving the most impersonation attempts. Concentrated targeting of a few users is a strong signal of a deliberate campaign - prioritize these users for security awareness training.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp targets header",
+                            "id": "43112ad1-ebc9-42fb-9ebd-0dbaa862ed45"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Distinct Fake Senders']=dcount(FakeSenderAddress), Types=make_set(ImpersonationType,3), ['Last Seen']=max(Timestamp) by ['Targeted User']=TargetUser | top 10 by Detections",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp targets",
+                            "id": "cc4b3f98-bfcb-4741-9abb-9ff099eb946f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Impersonating senders<br>\r\n\r\n**The identities behind the impersonation, grouped by fake display name, sender domain, and type. Attackers rotate through many sending addresses under a single display name - Distinct Sender Addresses exposes that rotation, and a high count is itself a strong bulk-campaign signal. Use First/Last Seen to scope the campaign window.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp senders header",
+                            "id": "99859796-7b69-42e7-a27a-541e0ba86cb2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the identities behind Teams impersonation, grouped by the fake display name, sender domain, and impersonation type. Attackers rotate through many sending addresses under one display name, so Distinct Sender Addresses reveals bulk campaigns that per-address ranking would hide.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp\r\n| summarize Detections=count(), SenderAddresses=dcount(FakeSenderAddress), Targets=dcount(TargetUser), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by FakeDisplayName, FakeSenderDomain, ImpersonationType\r\n| top 10 by Detections\r\n| project ['Fake Display Name']=FakeDisplayName, ['Sender Domain']=FakeSenderDomain, ['Impersonation Type']=ImpersonationType, ['Distinct Sender Addresses']=SenderAddresses, Detections, ['Targeted Users']=Targets, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Distinct Sender Addresses",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp senders",
+                            "id": "209439a0-5be3-4e41-abe9-695552730dc8"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Display names abused<br>\r\n\r\n**The identities attackers pretend to be (for example \"IT HelpDesk\", \"Microsoft Support\"). These are the trust anchors of the social-engineering lure.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp names header",
+                            "id": "e645578b-7a52-4d38-9d83-f5c500bbfe1a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Distinct Senders']=dcount(FakeSenderAddress) by ['Fake Display Name']=FakeDisplayName | top 10 by Detections",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Senders",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp names",
+                            "id": "d723d72b-4e7c-431b-ae7b-980879c8bd75"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Look-alike sender domains<br>\r\n\r\n**Sending domains used for impersonation - watch for typosquats (for example rnicrosoft.com for m&rarr;rn). Add confirmed domains to your Tenant Allow/Block List.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp domains header",
+                            "id": "98040a5a-bbd5-4c95-b976-5630ce48b282"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Display Names Used']=dcount(FakeDisplayName) by ['Sender Domain']=FakeSenderDomain | top 10 by Detections",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Display Names Used",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp domains",
+                            "id": "94b9fa45-c889-46a7-8b80-92e5d280ad3b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### URL IOCs from impersonation messages<br>\r\n\r\n**URL domains that appeared in messages sent by impersonating senders. Threat actors deliberately mix legitimate domains (for example microsoft.com or google.com) with their malicious ones to make the lure look trustworthy, so treat this as a review list - not a blocklist. Investigate the unfamiliar or look-alike domains and block only those you confirm malicious; never block a well-known legitimate domain from this list.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp ioc header",
+                            "id": "d5f4886c-7c7e-4c6f-94ca-569cabda5ede"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists URL domains that appeared in messages sent by impersonating senders, with a breakdown of how many carried Malware, Phish, or Spam verdicts. Threat actors mix legitimate and malicious domains in a single lure, so review the unfamiliar or look-alike domains and block only confirmed-malicious ones.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ChatThreadId = tostring(RD.ChatThreadId);\r\nlet impThreads = imp | distinct ChatThreadId;\r\nlet impMsgs = MessageEvents\r\n    | where ThreadId in (impThreads)\r\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n    | project TeamsMessageId, ThreatTypes;\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| join kind=inner (impMsgs) on TeamsMessageId\r\n| summarize ['URL Count']=count(), Messages=dcount(TeamsMessageId), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by ['URL Domain']=UrlDomain\r\n| top 10 by ['URL Count']",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "URL Count",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams imp ioc",
+                            "id": "958ac65c-d56d-4a80-ba83-2ab33e8b1e2e"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Impersonation",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "c49582db-6318-423f-b806-91cbeb625ea2"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malicious URLs and Link Warnings in Teams\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nTracks URLs shared through Microsoft Teams, messages that triggered a Microsoft Defender for Office 365 URL safety-tip warning, and the outcome of Teams URL clicks (allowed versus blocked) captured in UrlClickEvents.<br><br>**Recommended action:** Enable Safe Links for Microsoft Teams so links are checked at click time, and prioritize *User clicked a malicious link in Teams chat* alerts for investigation. Treat a blocked click as an attempted compromise: check whether the user went on to share credentials or run a file, and reset credentials where warranted."
+                            },
+                            "name": "teams url banner",
+                            "id": "e3ec4d65-8d1f-4303-bd8f-eb1ae521da41"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query surfaces Microsoft Teams URL-sharing and link-warning metrics for the selected period. URL-warning messages carry the Microsoft Defender for Office 365 URL safety tip.\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nunion\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 1),\r\n(MessageUrlInfo | summarize Count = count() | extend Details = \"URLs Shared in Messages\", Ord = 2),\r\n(MessageUrlInfo | summarize Count = dcount(TeamsMessageId) | extend Details = \"Messages Containing URLs\", Ord = 3),\r\n(MessageUrlInfo | summarize Count = dcount(UrlDomain) | extend Details = \"Distinct URL Domains\", Ord = 4)\r\n| sort by Ord asc\r\n| project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams url tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b71382c7-c0f7-4f9d-9d21-e0a8bf9504ff"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Teams URL click outcomes over time<br>\r\n\r\n**Allowed versus blocked Microsoft Teams URL clicks (per selected interval) from UrlClickEvents where the click happened in the Teams workload.**"
+                            },
+                            "customWidth": "66",
+                            "name": "teams click trend header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "30818e0d-6c4b-4868-896a-ac48cb3cef86"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Click outcomes<br>\r\n\r\n**Distribution of Microsoft Teams URL click actions by type.**"
+                            },
+                            "customWidth": "33",
+                            "name": "teams click pie header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "5a882138-2241-4527-80b8-9983c5807050"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Microsoft Teams URL click outcomes over time (allowed vs blocked) using the UrlClickEvents workload filter, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(UrlClickEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(UrlClickEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where Workload == \"Teams\"\r\n| summarize ClickAllowed = countif(ActionType has \"ClickAllowed\"), ClickBlocked = countif(ActionType has \"ClickBlocked\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickAllowed = coalesce(ClickAllowed, 0), ClickBlocked = coalesce(ClickBlocked, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "teams click trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7a2f5559-1e3e-412a-addf-c3bf6be98502"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows Microsoft Teams URL click outcomes by action type for the selected period.\r\nUrlClickEvents\r\n| where Workload == \"Teams\"\r\n| where isnotempty(ActionType)\r\n| summarize Count = count() by ActionType",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "teams click pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "889c6bb3-438b-4575-84f2-084c1b5fd1f4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top domains shared in Teams messages<br>\r\n\r\n**The 10 most-shared URL domains in Microsoft Teams messages, with the number of messages each appeared in.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams top domains header",
+                            "id": "dcb8c87c-087e-4d69-b7b7-0329296293ff"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 URL domains shared in Microsoft Teams messages by volume for the selected period.\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| summarize UrlCount = count(), Messages = dcount(TeamsMessageId) by UrlDomain\r\n| top 10 by UrlCount\r\n| project ['URL Domain']=UrlDomain, ['URLs Shared']=UrlCount, ['Messages']=Messages",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "URLs Shared",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams top domains table",
+                            "id": "7561adb0-1fbe-41ce-a924-a27bcd4c5c12"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Malicious URLs",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "6d47c309-be9e-4b21-940e-7c7b282e5dc2"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Targeted Users &amp; Risky Senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nIdentifies who is most targeted in Microsoft Teams, and profiles the external senders and domains behind risky messages - URL safety-tip warnings, first-contact senders, threat-carrying domains, and low-reputation link infrastructure - so you can spot anomalous senders before they succeed.<br><br>**Recommended action:** Prioritize the most-targeted users for phishing-resistant MFA and awareness coaching, and treat first-contact external senders and low-reputation domains as IOCs. Restrict inbound chat from unmanaged and consumer tenants, and allowlist only trusted external domains so unsolicited outsiders cannot start a conversation."
+                            },
+                            "name": "teams risky banner",
+                            "id": "0aa13d73-2e13-487c-a7c4-d90464a554d4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top targeted users (messages with threats)<br>\r\n\r\n**The 10 users receiving the most Microsoft Teams messages that contained a threat, expanded from each message recipient list.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams targeted header",
+                            "id": "827dc0f6-2bb2-49b9-acf8-d7b400238594"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 users receiving Microsoft Teams messages that contained a threat, expanded from the message recipient list, with each user's total Teams messages received and the share that carried a threat. Messages are de-duplicated to the latest record per message.\r\nlet expanded = MessageEvents\r\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n    | mv-expand rd = parse_json(RecipientDetails)\r\n    | extend Recipient = tostring(rd.RecipientSmtpAddress)\r\n    | where isnotempty(Recipient);\r\nlet totals = expanded | summarize TotalMessages = count() by Recipient;\r\nexpanded\r\n| where isnotempty(ThreatTypes)\r\n| summarize ThreatMessages = count() by Recipient\r\n| join kind=leftouter (totals) on Recipient\r\n| extend ThreatPct = round(100.0 * ThreatMessages / TotalMessages, 1)\r\n| top 10 by ThreatMessages\r\n| project ['Recipient']=Recipient, ['Threat Messages']=ThreatMessages, ['Total Messages']=TotalMessages, ['Threat %']=ThreatPct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams targeted users table",
+                            "id": "79481d1b-617e-46df-b555-9f7240932dd0"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top senders of URL-warning messages<br>\r\n\r\n**Senders whose Microsoft Teams messages most often triggered a URL safety-tip warning.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams warn senders header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "ef71d7dd-4442-4992-977d-d550aad4533c"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top domains in URL-warning messages<br>\r\n\r\n**URL domains most frequently present in Microsoft Teams messages that triggered a URL safety-tip warning.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams warn domains header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "6f41a4ba-f832-4947-ad27-cd6b8015bd63"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 senders whose Microsoft Teams messages triggered a URL safety-tip warning for the selected period, with each sender's total Teams messages and the share that carried a warning. Messages are de-duplicated to the latest record per message.\r\nlet dedup = MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nlet totals = dedup | summarize TotalMessages = count() by SenderEmailAddress;\r\ndedup\r\n| where SafetyTip == \"URLMessageWarning\"\r\n| summarize WarningMessages = count() by SenderEmailAddress\r\n| join kind=leftouter (totals) on SenderEmailAddress\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Warning Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams warn senders table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3fa023af-79e3-407f-ac20-b0aa6e3ba511"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 URL domains appearing in Microsoft Teams messages that triggered a URL safety-tip warning, with the domain's total message appearances and the share that carried a warning.\r\nlet warned = MessageEvents | where SafetyTip == \"URLMessageWarning\" | distinct TeamsMessageId;\r\nlet totals = MessageUrlInfo | where isnotempty(UrlDomain) | summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;\r\nMessageUrlInfo\r\n| where TeamsMessageId in (warned)\r\n| summarize WarningMessages = dcount(TeamsMessageId) by UrlDomain\r\n| join kind=leftouter (totals) on UrlDomain\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['URL Domain']=UrlDomain, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Warning Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams warn domains table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "68811015-1383-48ad-86da-4f8f9d39e4c4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### First-contact external senders<br>\r\n\r\n**External Microsoft Teams senders ordered by when they were first seen in the period (most recent first). Note: some flows tag internal-domain senders as external - to hide your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams fc senders header",
+                            "id": "0f131ff3-d6b2-4187-b86c-ca3493594b54"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists external Microsoft Teams senders by the date they were first seen in the selected period, surfacing recent first-contact senders. Messages are de-duplicated to the latest record per message. In tenants with longer history this highlights genuinely new senders.\r\n// TIP: IsExternalThread may still surface senders from your own accepted domains. To hide them,\r\n// uncomment the ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n//| where tostring(split(SenderEmailAddress, \"@\")[1]) !in~ (ExcludeDomains)\r\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\r\n| top 10 by FirstSeen desc\r\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true,
+                                "sortBy": [
+                                  {
+                                    "itemKey": "Threat Messages",
+                                    "sortOrder": 2
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams fc senders table",
+                            "id": "4e10a78d-8858-4dbb-9db0-e7b7d7e7636c"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### External sender-domain risk<br>\r\n\r\n**External sending domains ranked by threat volume, with the mix of conversation types (1:1 chat, group chat, channel), threat breakdown, threat rate, count of messages carrying low-reputation URLs (domains on commonly-abused TLDs such as .xyz, .top, .click, .shop, .zip), and first/last-seen. A domain that is new in the period, skews toward 1:1 chats, or shows a high threat rate is anomalous and warrants review. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams anomaly header",
+                            "id": "a91295db-8192-4828-93c5-408436e4b0e1"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query ranks external sender domains in Microsoft Teams by threat volume for the selected period, split by conversation type (1:1 chat, group chat, channel), with threat-type breakdown, threat rate, and a count of messages carrying low-reputation URL TLDs. Messages are de-duplicated to the latest record per message. New, 1:1-skewed, or high-threat-rate domains are the anomalies to review.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n    | where isnotempty(UrlDomain)\r\n    | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n    | where Tld in (suspTlds)\r\n    | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\"), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages > 0\r\n| extend ThreatRatePct = round(100.0 * ThreatMessages / Messages, 1)\r\n| top 10 by ThreatMessages desc\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Threat Msgs']=ThreatMessages, Malware, Phish, Spam, ['Threat Rate %']=ThreatRatePct, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Threat Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams anomaly table",
+                            "id": "bcd6746d-8298-495d-9d6c-2fadc6cba569"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Suspicious new senders (no threat verdict yet)<br>\r\n\r\n**External sending domains with no threat verdict yet, but that are either sending low-reputation-URL messages or showing unusual volume. These slip past threat filters - watch for new domains skewing toward 1:1 chats, an early social-engineering signal. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams newdom header",
+                            "id": "9e3844f4-befc-4b76-a8cd-ca53fdf51d41"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query surfaces external sender domains in Microsoft Teams that have NO threat verdict yet but are sending messages with low-reputation URL TLDs or unusual volume, split by conversation type. These are early-warning senders that have not tripped a detection. Messages are de-duplicated to the latest record per message.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n    | where isnotempty(UrlDomain)\r\n    | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n    | where Tld in (suspTlds)\r\n    | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages == 0\r\n| where SuspUrlMsgs > 0 or Messages >= 5\r\n| order by SuspUrlMsgs desc, Messages desc\r\n| take 10\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams newdom table",
+                            "id": "8036a5b7-b5b3-4af4-912f-bb092bb01b89"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Low-reputation link domains in Teams (IOC radar)<br>\r\n\r\n**URL domains shared in Teams that use TLDs commonly abused for phishing and malware (for example .xyz, .top, .click, .zip, .shop). Ranked by message reach, with first/last-seen. Review these domains as potential indicators - .zip and .mov are especially deceptive because links read like file names.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams tld header",
+                            "id": "d48921f4-233c-4e0f-a97b-83e1bcaed399"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists URL domains shared in Microsoft Teams that use low-reputation TLDs commonly abused for phishing and malware, ranked by the number of Teams messages they appeared in, with first- and last-seen. Treat high-reach or newly-seen domains as candidate indicators of compromise.\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n| where Tld in (suspTlds)\r\n| summarize Messages=dcount(TeamsMessageId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ['URL Domain']=UrlDomain, ['TLD']=Tld\r\n| top 10 by Messages desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams tld table",
+                            "id": "30d5588e-010c-474a-9c53-74b73dcc9676"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Targeted Users & Risky Senders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "6fef737b-cb4e-4a51-9ced-bf11754a6b33"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams File Protection\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 scans files shared in Microsoft Teams. These visuals show files scanned versus malware detected, and list the malicious files found.<br><br>**Recommended action:** Investigate each malicious file below and confirm it was quarantined and removed from the SharePoint or OneDrive location backing the chat. Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, and use attack surface reduction rules to block executable content delivered through collaboration."
+                            },
+                            "name": "teams file banner",
+                            "id": "2f01c905-dd65-4a13-9f67-c70402b2c175"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection - for the selected period.\r\nlet base = FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\";\r\nunion\r\n(base | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files Scanned - No Detection\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams file tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9f555c51-1680-47ef-94d4-b1f8cf9dce3b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malicious files shared in Teams<br>\r\n\r\n**Files shared in Microsoft Teams that were detected with malware, with owner and file details.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams file table header",
+                            "id": "4cd3274e-0c61-4722-83b7-1fccf8a94a57"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365 for the selected period.\r\nFileMaliciousContentInfo\r\n| where Workload == \"MicrosoftTeams\"\r\n| where isnotempty(ThreatTypes)\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams file table",
+                            "id": "135e0e7d-7110-40ee-a377-1a5992b2ef9d"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams File Protection",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "8ecc1bae-4a06-4b1c-8952-59fb434b7cbc"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Post-Delivery ZAP Insights (Teams)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nZero-hour auto purge (ZAP) removes malicious Microsoft Teams messages after delivery. These visuals summarize ZAP volume, type, result, and the senders whose messages were most often removed.<br><br>**Recommended action:** Confirm zero-hour auto purge is enabled for Microsoft Teams so newly-weaponized messages are pulled after delivery. Investigate senders with repeated ZAP removals as likely compromised or malicious accounts and block or restrict them. A rising ZAP trend can signal an active campaign that slipped past delivery-time filtering."
+                            },
+                            "name": "teams zap banner",
+                            "id": "136cfb4e-d2a5-4db0-9771-6b6380011ba0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes Microsoft Teams post-delivery ZAP (zero-hour auto purge) activity by Microsoft Defender for Office 365 for the selected period.\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(zap | summarize Count = count() | extend Details = \"Total ZAP Actions\", Ord = 1),\r\n(zap | where ActionType == \"Malware ZAP\" | summarize Count = count() | extend Details = \"Malware ZAP\", Ord = 2),\r\n(zap | where ActionType == \"Phish ZAP\" | summarize Count = count() | extend Details = \"Phish ZAP\", Ord = 3),\r\n(zap | where ActionResult == \"Success\" | summarize Count = count() | extend Details = \"Successful Actions\", Ord = 4),\r\n(zap | where ActionResult == \"Failed\" | summarize Count = count() | extend Details = \"Failed Actions\", Ord = 5),\r\n(zap | where Action == \"Moved to quarantine\" | summarize Count = count() | extend Details = \"Moved to Quarantine\", Ord = 6)\r\n| sort by Ord asc\r\n| project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams zap tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "06980411-5e6b-4aa4-a746-351cd2b12dae"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP actions over time<br>\r\n\r\n**Microsoft Teams post-delivery ZAP actions (per selected interval) split by Malware ZAP and Phish ZAP.**"
+                            },
+                            "customWidth": "66",
+                            "name": "teams zap trend header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "7fc1cfcd-3a9f-45b1-9f39-3820fce23c03"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP by action type<br>\r\n\r\n**Distribution of Microsoft Teams post-delivery ZAP actions by type.**"
+                            },
+                            "customWidth": "33",
+                            "name": "teams zap pie header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "9bc0d0a3-876a-49d7-9046-31764511ca38"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Microsoft Teams post-delivery ZAP actions over time by ZAP type, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessagePostDeliveryEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessagePostDeliveryEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessagePostDeliveryEvents\r\n| summarize MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareZAP = coalesce(MalwareZAP, 0), PhishZAP = coalesce(PhishZAP, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "teams zap trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c78a509e-324f-4a8c-b2e7-bce3e0d20667"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows Microsoft Teams post-delivery ZAP actions by type for the selected period.\r\nMessagePostDeliveryEvents\r\n| summarize Count = count() by ActionType",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "teams zap pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "cfc94695-fb02-4b6c-a223-f79f7b947379"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top senders whose messages were removed by ZAP<br>\r\n\r\n**Senders whose Microsoft Teams messages were most often removed by post-delivery ZAP.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams zap senders header",
+                            "id": "f8677ffe-007a-41ca-81de-1ae5dd19d06a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 senders whose Microsoft Teams messages were removed by post-delivery ZAP for the selected period.\r\nMessagePostDeliveryEvents\r\n| where isnotempty(SenderEmailAddress)\r\n| summarize ZapActions = count(), MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by SenderEmailAddress\r\n| top 10 by ZapActions\r\n| project ['Sender']=SenderEmailAddress, ['ZAP Actions']=ZapActions, ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "ZAP Actions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams zap senders table",
+                            "id": "50c9a883-6442-40dc-b84f-57adfbb46a38"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams ZAP",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "f5cc2425-e5ae-4520-9a97-2e4c2c447dcd"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Message and Call Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Teams messages and calls reported by users, and messages submitted by admins, for review by Microsoft. Sourced from the submission records in CloudAppEvents.<br><br>**Recommended action:** Encourage users to report suspicious Teams messages and calls so Microsoft can tune protection, and triage admin submissions promptly. A cluster of reports naming the same sender, display name, or call identity is an early signal of a targeted campaign: pivot those identities into the impersonation and risky-sender views above to scope it."
+                            },
+                            "name": "teams sub banner",
+                            "id": "54cbfb29-2626-4b65-8cb5-a42ff4b41e63"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes Microsoft Teams message and call submissions reported to Microsoft for the selected period, split by user and admin reports. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nunion\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Messages Reported by Users\", Ord = 1),\r\n(sub | where SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Calls Reported by Users\", Ord = 2),\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\" | summarize Count = count() | extend Details = \"Messages Submitted by Admins\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "tiles",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Details",
+                                  "formatter": 1
+                                },
+                                "secondaryContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "min": 0,
+                                    "palette": "blue"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "style": "decimal",
+                                      "maximumFractionDigits": 1
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "size": "full"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams sub tiles",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "419ed645-ebc1-4df1-b9f0-c744403ab494"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Submissions over time<br>\r\n\r\n**Microsoft Teams user and admin submissions (per selected interval).**"
+                            },
+                            "customWidth": "66",
+                            "name": "teams sub trend header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "6a795b0a-82e2-427a-8ac0-abfb5bb5e447"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Submission mix<br>\r\n\r\n**Microsoft Teams submissions split by content type (message or call) and reporter (user or admin).**"
+                            },
+                            "customWidth": "33",
+                            "name": "teams sub pie header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "1f4c55f8-7290-4b6f-b02a-e3134568b9ff"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises Microsoft Teams message and call submissions over time, summarizing the data per selected interval. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet gran = {Granularity};\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nlet minTime = toscalar(sub | summarize min(Timestamp));\r\nlet maxTime = toscalar(sub | summarize max(Timestamp));\r\nlet agg = materialize(sub\r\n| summarize UserReports = countif(ActionType == \"UserSubmission\"), AdminReports = countif(ActionType == \"AdminSubmission\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, UserReports = coalesce(UserReports, 0), AdminReports = coalesce(AdminReports, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "teams sub trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7dcb03da-de96-4388-90a4-0a3f3ca98dc6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows the mix of Microsoft Teams submissions by content type and reporter for the selected period. Only completed user submissions (chat and call) and admin submissions (chat) are counted; submission triage/timeout lifecycle records are excluded.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\"\r\n| where (SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\")\r\n    or (SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\")\r\n    or (SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\")\r\n| extend Reporter = iif(ActionType == \"AdminSubmission\", \"Admin\", \"User\")\r\n| summarize Count = count() by SubmissionType = strcat(SubmissionContentType, \" (\", Reporter, \")\")",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "teams sub pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "84a0141e-51de-4423-acb0-3c4342a49bf2"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative (FN) User Submissions by submission State<br>\r\n\r\n**Microsoft Teams messages reported by users as missed detections, broken down by submission state (for example Rescaned, Graded). Tracks the processing status of user reports.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub state header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "1b2bdffd-69b0-41b0-bdda-b242b7faaec0"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative (FN) User Submissions by Triage Verdict<br>\r\n\r\n**Microsoft Teams user submissions grouped by the verdict assigned during grading (for example Phishing, NotSpam, Spam). Shows how reported messages were graded and highlights detection gaps.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub verdict header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "bdb97e09-44d2-41ad-a99f-931e4a8169cc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows Microsoft Teams user (false negative) message submissions by submission state (for example Rescaned, Graded), to track processing status.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend SubmissionState = tostring(RD.SubmissionState)\r\n| summarize Count = count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub state pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "139ce840-5fc2-44d1-9872-91b37a74f0e7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows Microsoft Teams user (false negative) message submissions by the triage verdict assigned during grading (for example Phishing, NotSpam, Spam).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend TriageVerdict = tostring(parse_json(tostring(RD.GradingResult)).TriageVerdict)\r\n| where isnotempty(TriageVerdict)\r\n| summarize Count = count() by TriageVerdict",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub verdict pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "538ce4a3-a1ff-4b8d-a466-2173edbb2cd7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 P2 sender domains in FN User Submissions<br>\r\n\r\n**The sender domains most often reported by users as missed Microsoft Teams threats. High-volume domains are candidate sources of malicious messaging.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub domains header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "9b8db0c7-2bf2-4077-ae20-60146001bf23"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 individual P2 senders in FN User Submissions<br>\r\n\r\n**The individual senders most often reported by users as missed Microsoft Teams threats.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub senders header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "ffbe90ab-129c-47fa-9dac-50cab528ad55"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 P2 (envelope) sender domains of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2SenderDomain = tostring(RD.P2SenderDomain)\r\n| where isnotempty(P2SenderDomain)\r\n| summarize Submissions = count() by ['P2 Sender Domain']=P2SenderDomain\r\n| top 10 by Submissions",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub domains table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b18192fb-26a8-4bd1-9b07-7aeab496eae3"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 individual P2 (envelope) senders of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2Sender = tostring(RD.P2Sender)\r\n| where isnotempty(P2Sender)\r\n| summarize Submissions = count() by ['P2 Sender']=P2Sender\r\n| top 10 by Submissions",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub senders table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7ead0a01-2b56-4225-b625-554b09350013"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 users performing the most FN User Submissions<br>\r\n\r\n**The users who report the most Microsoft Teams messages as missed detections - useful for recognising engaged reporters and spotting over-reporting.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub topusers header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "fb893cdd-d6d3-431a-a1d2-87652571a10d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 admins performing the most FN Admin Submissions<br>\r\n\r\n**The admins who submit the most Microsoft Teams messages as missed detections.**"
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub topadmins header",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "0px"
+                            },
+                            "id": "14fca69b-e152-4a5d-bd2c-020c34c2226a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 users who reported the most Microsoft Teams messages as false negatives (missed detections), with each submitter's email (from the submission record) to disambiguate users with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterEmail = tostring(RD.UserId)\r\n| where isnotempty(Submitter) and SubmitterEmail has \"@\"\r\n| summarize Submissions = count() by ['Submitter']=Submitter, ['Email']=SubmitterEmail\r\n| top 10 by Submissions",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub topusers table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a171a35b-35b0-46ce-a916-052a54101126"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the top 10 admins who submitted the most Microsoft Teams messages as false negatives (missed detections). The admin's own email is not present in the submission record (that would require the Identity table), so the Submitter ID (object GUID) is shown to disambiguate admins with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"AdminSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterId = tostring(RD.SubmitterId)\r\n| where isnotempty(Submitter)\r\n| summarize Submissions = count() by ['Admin']=Submitter, ['Submitter ID']=SubmitterId\r\n| top 10 by Submissions",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "teams sub topadmins table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8bf37c2b-067a-4341-a192-2aa45699c3f7"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Submissions",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "eeea53a4-69d9-426e-bf9f-1789cd73bfed"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Recent Threat Detail\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThe most recent Microsoft Teams phishing and malware messages, de-duplicated to the latest record per message, for investigation."
+                            },
+                            "name": "teams detail banner",
+                            "id": "4bdd917c-721f-450b-b455-45cbd5f59cc5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Last 10 Teams phishing messages<br>\r\n\r\n**Most recent Microsoft Teams messages detected as phishing, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams detail phish header",
+                            "id": "9bcf96c1-a958-4515-b171-10ec2f3ba660"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams detail phish table",
+                            "id": "3675d08f-1165-4f47-a633-e432cf96e3d5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Last 10 Teams malware messages<br>\r\n\r\n**Most recent Microsoft Teams messages detected as malware, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**"
+                            },
+                            "customWidth": "100",
+                            "name": "teams detail mal header",
+                            "id": "6b9d66d2-8d89-47b0-a72a-5ee8623082dc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "teams detail mal table",
+                            "id": "d6e76d0a-7eee-4c05-8e92-10f9622b5ab3"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "14"
+                      },
+                      "name": "group - Teams Detail",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "1e9c879b-d6be-4d36-9068-b5438abf7dd2"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Top Attacked Users, Top Senders, and Automatic External Email Forwarding\r\n\r\n---\r\nThis tab provides insights into **Top attacked users, Top Senders** in inbound email messages and details about **automatic external email forwarding**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "6"
+                      },
+                      "name": "text - 24 - Copy - Copy - Copy",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "f1a60054-44b1-432e-be7a-9d7d114ff5c7"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Attacked Users and Top Senders Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides key visuals that highlight top attacked users – individuals most frequently targeted by inbound email threats as detected by Microsoft Defender for Office 365. Offers insights into top email senders and sender domains across inbound email traffic, helping identify patterns and potential risk sources.<br><br>**Recommended action:** Apply the Strict preset to the most-attacked users and review the top sender domains as possible block-list candidates."
+                            },
+                            "name": "text - 13 - Copy - Copy",
+                            "id": "ff220902-30b8-4aef-9b79-14c913a1b2d2"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Attacked Users<br>\r\n\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam, Phishing, or Malware. Helps identify high-risk users for targeted security awareness and policy enforcement.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy",
+                            "id": "58f34b9f-824d-4fcf-b2aa-d7d380aa08d5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 users that are receiving Spam, Phishing or Malware emails\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by RecipientEmailAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by ThreatEmailCount\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    }
+                                  }
+                                ],
+                                "filter": true,
+                                "sortBy": [
+                                  {
+                                    "itemKey": "$gen_bar_Threat Emails_2",
+                                    "sortOrder": 2
+                                  }
+                                ]
+                              },
+                              "sortBy": [
+                                {
+                                  "itemKey": "$gen_bar_Threat Emails_2",
+                                  "sortOrder": 2
+                                }
+                              ],
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 28",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e9459e78-6b43-4ef2-9596-32169d95c610"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Senders of Inbound Emails<br>\r\n\r\n**Displays the top 10 sender email addresses from external sources delivering inbound emails. Helps identify high-volume external senders for monitoring and policy enforcement.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "id": "eb4590a7-57c7-4728-af62-3d798afe6f2d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by SenderFromAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender']=SenderFromAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 28 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e4272979-1073-4c1e-9b1b-b971bc3efc33"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains of Inbound Emails<br>\r\n\r\n**Displays the top 10 sender domains from external sources delivering inbound emails. Helps identify high-volume external sender domains for monitoring and policy enforcement.**"
+                            },
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "id": "7ab63415-17ce-47f1-a614-e5e6edbe472e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by SenderFromDomain\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Threat Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Bad Traffic %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 28 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b593da94-b735-4fe3-a82d-18c90156e506"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "6"
+                      },
+                      "name": "group - 10-Top attacked users and top senders",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "3e41cc1a-166e-4094-bc66-7e26a918b2e9"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Automatic External Email Forwarding Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Email forwarding can be useful, but can also pose a security risk due to the potential disclosure of information.**\r\n<br>\r\n\r\nUsers can configure [<b>Inbox rules</b>](https://support.microsoft.com/en-US/Outlook/mail/use-rules-to-automatically-forward-messages) in Outlook or set up [<b>SMTP forwarding</b>](https://support.microsoft.com/en-us/office/turn-on-automatic-forwarding-in-outlook-7f2670a1-7fff-4475-8a3c-5822d63b0c8e) to automatically forward messages to external recipients. You can control automatic external email forwarding from cloud mailboxes using [<b>Outbound spam policies</b>](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding) in Microsoft Defender for Office 365. \r\n**Attackers might exploit this capability to compromise your organization or its partners.**<br><br>**Recommended action:** Investigate external auto-forwarding - it is a common data-exfiltration path. Consider disabling auto-forwarding via the outbound spam policy unless a business case is documented."
+                            },
+                            "name": "text - 8",
+                            "id": "b04d1590-98e3-4650-9172-33e75561e1e5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Automatic Email Forwarding by Type<br>\r\n\r\n**Displays counts of outbound emails automatically forwarded to external addresses, grouped by forwarding type (e.g., SMTP forwarding, inbox rules). Helps identify forwarding behaviors that may pose data exfiltration risks.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c7cb7917-eaf4-4a1e-989a-75f4b6182851"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Internal Users Forwarding Emails Externally<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded emails to external addresses (regardless of the forwarding type used). Helps identify potential data exfiltration risks and enforce forwarding policies.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5a5d5a8c-c195-45db-a878-e6ac908cc919"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises automatic email forwarding to external email addresses by forwarding type\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize count() by ForwardingType\r\n| sort by count_ desc \r\n",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "15094d98-add2-4b50-a0df-ee91fd34c6fb"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| sort by TotalForwardedMessages desc \r\n| top 10 by TotalForwardedMessages\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\r\n\r\n",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "TotalForwardedMessages"
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "73d66038-2ea0-449d-9aeb-a1bd4b207d7f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Internal Users Forwarding Emails Using Mailbox Rules<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9a7b5fc3-da23-4e95-87df-542a5e3f6320"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "TotalForwardedMessages"
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 30 - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f8d7b85d-944a-493f-a143-7e18277846c9"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 External domains Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\r\n\r\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "cda99a50-b7c4-4d95-ac61-7231080a3f5d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 External Recipients Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\r\n\r\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "72b01575-c33e-457c-98db-ea755c003bf0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 external domains who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "823dec28-48b5-4be3-8e68-04301a952a62"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "14804990-bfc9-43b7-8c8d-95c2cf32ee56"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Internal Users Forwarding Emails via SMTP Forwarding<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "100",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "fa04b313-5756-4ff7-9ee8-ec61e6b382cc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize count() by ForwardingUser\r\n| top 10 by count_ desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=count_",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              },
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 30 - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "bed8e717-4ea7-4f71-aaa7-b70a31f4dc88"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 External domains receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\r\n\r\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "f76bc717-3cf8-4d8d-92fa-3f2024065f8f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 External Recipients Receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\r\n\r\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "2190c799-ab4f-4bd8-87e1-f9c5c224cca4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c3be87b3-8ce8-40f2-ad92-0651bed71117"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Forwarded Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              },
+                              "chartSettings": {
+                                "yAxis": [
+                                  "count_"
+                                ],
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "fb6b0113-f5bb-46a7-994b-92ebc3c7881d"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "6"
+                      },
+                      "name": "group - 34 - Automatic email forwarding",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "02c91ebb-4f92-4843-a73b-6dea7a6ac2bd"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Email detection action overrides\r\n\r\n---\r\n\r\nThis tab provides insights into admin or end-user configured **detection overrides** where the message was detected as a threat by Microsoft Defender for Office 365, however an admin-configured policy or end-user setting overrode the detection action.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/understand-overrides-in-email-entity) "
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "text - 13 - Copy",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "ae594968-00b9-40b8-b5dd-052a27440afb"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Admin configured Detection Overrides (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track emails subject to administrator policies (e.g., Transport Rules, Tenant Allow/Block List) with an \"Allow\" action, overriding Microsoft Defender for Office 365 detections (excluding SecOps Mailbox overrides).<br><br>**Recommended action:** Review Allow overrides that later carried threats and remove stale or overly broad allow entries - they weaken protection."
+                            },
+                            "name": "text - AdminOverridesAllowHeader",
+                            "id": "3d70a304-c590-4156-a6d4-da147fe106ab"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Overrides (Allow) Trend\r\n**Displays the count (per {Granularity}) of emails where an administrator policy with an \"Allow\" action overrode detections (excluding SecOps Mailbox). Helps track the frequency of admin overrides over time.**"
+                            },
+                            "name": "text - AdminOverridesAllowTrend",
+                            "id": "a4ee104a-a0a1-4725-a60f-deedcc91af70"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to an admin policy with action of allow independent of action taken, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Admin Overrides",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "query - 3",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "79928e9e-48ed-4d08-8ff7-c21fe027550e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Total Emails by Admin Override type (Allow)\r\n**Summarizes the total count of emails subject to administrator policies with an \"Allow\" action, grouped by the type of override. Helps identify which policies are most frequently allowing emails.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - AdminOverridesAllowByType",
+                            "id": "855fce09-2000-4d16-8521-8b4eeddfae00"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Overrides (Allow) by Override Type and Threat Type\r\n**Details the count of emails allowed by administrator policies, categorized by the override type and the detected threat type. Helps assess the risk associated with allowed emails.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - AdminOverridesAllowByTypeAndThreat",
+                            "id": "a2613078-b427-4b23-aca0-21989b1944db"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 16",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b21a0329-8f52-45c2-81f2-6df65c134673"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 2",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "0bf4cbe6-7c84-49d4-801c-d955762b5699"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### SecOps Mailbox Overrides (Allow)\r\nThis section focuses on emails allowed specifically due to the SecOps Mailbox override policy, typically used for investigation and analysis.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/advanced-delivery-policy-configure) "
+                            },
+                            "name": "text - SecOpsOverridesHeader",
+                            "id": "f582dc86-4c40-4cdd-ba0b-ec6ef8820a27"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to the \r\nEmailEvents \r\n| where OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "stat",
+                              "statSettings": {
+                                "valueAggregation": "None",
+                                "colorSettings": {
+                                  "type": "static",
+                                  "mode": "background",
+                                  "heatmapPalette": "greenRed",
+                                  "thresholdsGrid": []
+                                },
+                                "iconSettings": {
+                                  "thresholdsGrid": []
+                                },
+                                "tagText": "",
+                                "valueFontStyle": "auto",
+                                "tagTextPosition": "bottom"
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 1",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8ad2fea4-dcd0-454e-a4d4-b5275c86fd9b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails delivered to the SecOps Mailbox by threat type\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 1,
+                              "showAnalytics": true,
+                              "title": " ",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 4",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "52c04df2-69b5-46e4-a000-7c6d212a132a"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "group - 15 - Admin Detection Overrides - Allow",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "9b9baf2f-fd5f-41b6-8368-b515f8de4fd4"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Admin configured Detection Overrides (Block)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email messages blocked by administrative policies (e.g. Tenant allow/block list, Antimalware policy file type block), overriding detection actions defined by Microsoft Defender for Office 365.<br><br>**Recommended action:** Confirm these blocks are still needed and consolidate them into the Tenant Allow/Block List where appropriate."
+                            },
+                            "name": "text - AdminOverridesBlockHeader",
+                            "id": "6157683b-cce7-4165-886f-0da73e25ce86"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Overrides (Block) Trend\r\n**Displays the count (per {Granularity}) of emails where an administrator policy with a \"Block\" action overrode detections. Helps track the frequency of admin blocks over time.**"
+                            },
+                            "name": "text - AdminOverridesBlockTrend",
+                            "id": "699820b4-a984-45cc-ab2f-607c3c8569d4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Admin Overrides",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 5",
+                            "styleSettings": {
+                              "margin": "10",
+                              "padding": "10"
+                            },
+                            "id": "9ef5e7fb-843e-439b-b4f3-9b0bb149e74b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Total Emails by Admin Override Type (Block)\r\n**Summarizes the total count of emails subject to administrator policies with a \"Block\" action, grouped by the type of override.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - AdminOverridesBlockByType",
+                            "id": "5694a7c0-1ee5-40b4-ae2b-263d189c4b4e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Overrides (Block) by Override Type and Threat Type\r\n**Details the count of emails blocked by administrator policies, categorized by the override type and the detected threat type.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - AdminOverridesBlockByTypeAndThreat",
+                            "id": "6e309742-37c0-4ad5-9b9a-63643059bfaf"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to an admin policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 6",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "eabc80ed-d0e9-43d2-ab13-a5af478f11c8"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 7",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1661bfa6-d8fd-4387-a334-1bc027a3f6d1"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "group - 36-Admin Detection Overrides - Block",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "7d514e9a-f67f-45a6-ba1b-6492348cc18b"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User configured Detection Overrides (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track email messages subject to user policies (e.g. [Safe Senders list defined in Outlook](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365#use-outlook-safe-senders)) with an \"Allow\" action, overriding Microsoft Defender for Office 365 detections.<br><br>**Recommended action:** Educate users that safe-sender allows can bypass protection; review high-risk user allow entries."
+                            },
+                            "name": "text - UserOverridesAllowHeader",
+                            "id": "4d41c560-0e73-40c5-b610-33e9500e88c4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Overrides (Allow) Trend\r\n**Displays the count (per {Granularity}) of emails where a user policy with an \"Allow\" action overrode detections. Helps track the frequency of user overrides over time.**"
+                            },
+                            "name": "text - UserOverridesAllowTrend",
+                            "id": "9432efff-9f03-4d74-8781-02be8b2d07fa"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "User Overrides",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "query - 3",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "02da1d33-e477-479d-bdd3-95ab1ad7c75c"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Total Emails by User Override Type (Allow)\r\n**Summarizes the total count of emails subject to user policies with an \"Allow\" action, grouped by the type of override.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - UserOverridesAllowByType",
+                            "id": "006a2e87-b1b6-4cc3-a763-ceebaa86b340"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Overrides (Allow) by Override Type and Threat Type\r\n**Details the count of emails allowed by user policies, categorized by the override type and the detected threat type. Helps assess the risk associated with user-allowed emails.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - UserOverridesAllowByTypeAndThreat",
+                            "id": "7c34bb4b-46c0-4054-9596-3dfd010bb036"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 16",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d1d9021d-e6bf-47b1-bdd2-438a212d2767"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "sortBy": []
+                            },
+                            "customWidth": "50",
+                            "name": "query - 2",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "1acd913c-c945-4a58-b04e-d008ca53ffe3"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "group - 15 - User Detection Overrides - Allow",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "c939060e-6a8b-49ff-951b-a3abddbd9fb4"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User configured Detection Overrides (Block)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into emails blocked by user-configured policies (e.g., [Blocked Senders list in Outlook](https://support.microsoft.com/en-us/office/block-or-unblock-senders-in-outlook-9bf812d4-6995-4d19-901a-76d6e26939b0)).<br><br>**Recommended action:** Use user block trends to identify unwanted senders that may warrant tenant-wide blocking."
+                            },
+                            "name": "text - UserOverridesBlockHeader",
+                            "id": "be6c6a3e-08ee-47c5-b8e7-6a1078dd17d1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Overrides (Block) Trend\r\n**Displays the count (per {Granularity}) of emails where a user policy with a \"Block\" action overrode detections. Helps track the frequency of user blocks over time.**"
+                            },
+                            "name": "text - UserOverridesBlockTrend",
+                            "id": "7cd77d54-2e2b-4d23-a6a9-4bd6bca2642a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "User Overrides",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "query - 5",
+                            "styleSettings": {
+                              "margin": "10",
+                              "padding": "10"
+                            },
+                            "id": "0b21b66c-001d-4b3d-b47f-f3a420ccaaf8"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Total Emails by User Override Type (Block)\r\n**Summarizes the total count of emails subject to user policies with a \"Block\" action, grouped by the type of override.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - UserOverridesBlockByType",
+                            "id": "fd513501-5e9d-45d9-9d0d-cd546002b8cf"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Overrides (Block) by Override Type and Threat Type\r\n**Details the count of emails blocked by user policies, categorized by the override type and the detected threat type.**"
+                            },
+                            "customWidth": "50",
+                            "name": "text - UserOverridesBlockByTypeAndThreat",
+                            "id": "4fbfa876-47ed-4c3b-81ee-1c40b982cecd"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of emails subject to a user type policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "query - 6",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d3fccaa6-80fd-419d-bb37-aedf67263419"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Total Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "query - 7",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e5e74ce1-fa67-45ea-bc80-97237342e370"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "group - 37-User Detection Overrides - Block",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "0c1d327a-c2f1-4b9b-b210-53c808b53b48"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User &amp; Sender Override Detail (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nInbound messages that Microsoft Defender for Office 365 **detected as threats but delivered anyway** because of an admin- or user-configured **Allow** override (phishing-simulation and SecOps Mailbox traffic excluded). **Total Threats** is all detected threats to that recipient / sender domain in the selected range; **Overridden Threats** and **Override %** are the portion delivered due to an Allow override, and **Override Types** names the specific overrides responsible. **User-configured** overrides come from the recipient's own mailbox junk-email settings in Outlook / Outlook on the web (the mailbox \"safelist collection\") &mdash; the **Safe Senders** and **Safe Recipients** lists and **trusted contacts** (\"Also trust email from my Contacts\"). **Admin-configured** overrides come from the **Tenant Allow/Block List, Exchange mail flow (transport) rules, the IP Allow List, or allowed sender/domain lists in anti-spam policies**. Use this to spot users or domains where overrides are letting threats through &mdash; candidates for policy review or a Tenant Allow/Block List (TABL) block.<br><br>**Recommended action:** Focus on the users and sender domains with the most allow overrides - these are the biggest protection gaps."
+                            },
+                            "name": "Overrides - User Detail Header",
+                            "id": "3b0e83f3-f340-4b95-85c5-831783e8abc2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top recipients receiving threats that were delivered due to an admin or user override, with the share of their threats that were overridden and a breakdown of which override types caused them.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n    \"(none)\")\r\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n        by RecipientEmailAddress\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 15 by OverriddenThreats\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Overridden Threats",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Override %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "graphSettings": {
+                                "type": 2,
+                                "topContent": {
+                                  "columnMatch": "StatisticName",
+                                  "formatter": 1
+                                },
+                                "centerContent": {
+                                  "columnMatch": "Value",
+                                  "formatter": 1,
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                },
+                                "nodeIdField": "StatisticName",
+                                "sourceIdField": "Value",
+                                "targetIdField": "Value",
+                                "graphOrientation": 3,
+                                "showOrientationToggles": false,
+                                "nodeSize": null,
+                                "staticNodeSize": 100,
+                                "colorSettings": null,
+                                "hivesMargin": 5,
+                                "edgeColorSettings": null
+                              }
+                            },
+                            "name": "Overrides - Top Users",
+                            "id": "d7e169a2-808a-4bbf-86ee-5be561c690f7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top sender domains sending threats to users, with the share of those threats that were delivered because of an admin or user override and a breakdown of which override types caused them. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n    \"(none)\")\r\n| summarize PerType = count() by SenderFromDomain, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n        by SenderFromDomain\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 10 by OverriddenThreats\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Overridden Threats",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Override %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ]
+                              },
+                              "graphSettings": {
+                                "type": 2,
+                                "topContent": {
+                                  "columnMatch": "StatisticName",
+                                  "formatter": 1
+                                },
+                                "centerContent": {
+                                  "columnMatch": "Value",
+                                  "formatter": 1,
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                },
+                                "nodeIdField": "StatisticName",
+                                "sourceIdField": "Value",
+                                "targetIdField": "Value",
+                                "graphOrientation": 3,
+                                "showOrientationToggles": false,
+                                "nodeSize": null,
+                                "staticNodeSize": 100,
+                                "colorSettings": null,
+                                "hivesMargin": 5,
+                                "edgeColorSettings": null
+                              }
+                            },
+                            "name": "Overrides - Top Sender Domains",
+                            "id": "0eda3153-10ea-4d4e-80ca-7e5ad99e9883"
+                          }
+                        ]
+                      },
+                      "customWidth": "100",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "7"
+                      },
+                      "name": "Overrides - User & Sender Detail",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "d5f38e54-a3c7-4df6-b569-bbabe85e1a36"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# False Negative(FN) Submissions insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **False Negative(FN) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message reported to have **Malware, Phish or Spam threat** within its **content, URLs or attachments**."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "8"
+                      },
+                      "name": "text - 13 - Copy",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "3b243dca-89ce-41e6-bccb-9ceb0953aa2e"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Negative(FN) Admin submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message **False Negative(FN) Submissions performed by administrators** in Microsoft Defender for Office 365 where the message reported to have Malware, Phish or Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Prioritise admin-submitted misses for policy tuning; recurring sender domains may be block-list candidates."
+                            },
+                            "name": "fn admin - section header",
+                            "id": "64420254-0dae-4495-bd55-fc49e5bc1ed0"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions per-{Granularity} trend by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment). Helps to monitor where detections were missed and later submitted by admins as false negatives to Microsoft.**"
+                            },
+                            "name": "fn admin - trend heading",
+                            "id": "5f2de929-6f32-4079-a031-cbf689c15b29"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of admin false negative submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Malware_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Malware_URL_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Malware_Attach_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\"), Admin_Phish_URL_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Phish_Attach_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Malware (Mail)']=coalesce(Admin_Malware_FN,0), ['Phish (Mail)']=coalesce(Admin_Phish_FN,0), ['Spam (Mail)']=coalesce(Admin_Spam_FN,0), ['Malware (URL)']=coalesce(Admin_Malware_URL_FN,0), ['Malware (Attachment)']=coalesce(Admin_Malware_Attach_FN,0), ['Phish (URL)']=coalesce(Admin_Phish_URL_FN,0), ['Phish (Attachment)']=coalesce(Admin_Phish_Attach_FN,0) | sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalAdminSubmissions",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Phish (Mail)",
+                                    "color": "redBright"
+                                  },
+                                  {
+                                    "seriesName": "Spam (Mail)",
+                                    "color": "orange"
+                                  },
+                                  {
+                                    "seriesName": "Malware (Mail)",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Phish (URL)",
+                                    "color": "purple"
+                                  },
+                                  {
+                                    "seriesName": "Malware (Attachment)",
+                                    "color": "yellowDark"
+                                  },
+                                  {
+                                    "seriesName": "Phish (Attachment)",
+                                    "color": "purpleDark"
+                                  },
+                                  {
+                                    "seriesName": "Malware (URL)",
+                                    "color": "yellow"
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "fn admin - submissions trend",
+                            "id": "1b61155b-92a1-4533-9561-2e85e9a4dbf8"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment).**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - by-type heading",
+                            "id": "bbaa9ff9-a95d-495a-a44c-6b4cae888a24"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions by submission State\r\n**Displays the total count of False Negative(FN) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - by-state heading",
+                            "id": "b060c706-342a-4b2e-b81a-920bf4d8c5d9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false negative submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Malware (URL)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Malware (Attachment)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Phish (URL)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Phish (Attachment)\",\r\n\"Other\")))))))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - by-type pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9d9d714a-357b-4ac3-bcb7-33601d3c3108"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - by-state pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "169f0f1c-1f1e-44fb-965e-850733f01879"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN)/False Positive(FP) Admin Submissions by Triage Verdict\r\n**Displays the total count of False Negative(FN)/False Positive(FP) Admin Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - triage-verdict heading",
+                            "id": "3df841be-c1b0-4d61-8e38-316a34a48bd1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Admins Submitting False Negatives \r\n**Displays the top 15 admin accounts that submitted the highest number of false negative messages (missed detections) via AdminSubmission. Helps identify key contributors to threat remediation and potential patterns in detection gaps.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - top-admins heading",
+                            "id": "e1e966f4-1f4d-4377-97c6-e2077fc0b8fa"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - triage-verdict pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6df0db72-f9db-444e-856a-4369921d199b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top admins performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fn admin - top-admins pie",
+                            "id": "b5ccb4a1-9783-47cf-bf21-ded924f1a200"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions by Top Sender Domains\r\n**For each top sender domain that admins reported missed threats for, shows the domain's MDO-detected threat profile (emails with threats and the Malware/Phish/Spam breakdown), the count of admin FN submissions, and the submission rate (Admin Submission % = admin submissions / total inbound from the domain). A high rate can flag a domain whose mail is frequently reported as missed.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn admin - top-sender-domains heading",
+                            "id": "1a481c97-ac85-4b62-a86d-51b33b5a8e68"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 sender domains that admins reported false negatives (missed threats) for, with each domain's MDO-detected threat profile for context.\r\nlet subs = CloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\")\r\n| summarize AdminSubmissions=count() by P2SenderDomain;\r\nlet domainProfile = EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalInbound=count(), EmailsWithThreats=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by SenderFromDomain;\r\nsubs\r\n| join kind=leftouter (domainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend AdminSubmissionPct = round(AdminSubmissions * 100.0 / todouble(coalesce(TotalInbound, AdminSubmissions)), 2)\r\n| top 10 by AdminSubmissions desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails With Threats']=coalesce(EmailsWithThreats,0), ['Malware']=coalesce(Malware,0), ['Phish']=coalesce(Phish,0), ['Spam']=coalesce(Spam,0), ['Admin Submissions']=AdminSubmissions, ['Admin Submission %']=AdminSubmissionPct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails With Threats",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Malware",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Admin Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "120px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Admin Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "110px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn admin - top-sender-domains table",
+                            "id": "e56bed92-b0fb-4b76-90f3-169f4206418b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) Admin Submissions by admin Detection override types\r\n**Displays the top 10 cases where emails were submitted as false negatives by admins, even though they were initially detected by Microsoft Defender for Office 365 but delivered due to an admin policy override. Includes details on PolicyOverride, PolicySource, and DetectionVerdict for deeper insight into override behaviour.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn admin - override-types heading",
+                            "id": "293c174c-0197-4cf8-bbce-36fe42e5cf1b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was a admin policy override\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\"))),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\") and PolicyOverride !=\"NoOverride\"\r\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Override Source']=PolicyPolicyOverrideType, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn admin - override-types table",
+                            "id": "97799422-53e0-4e3b-8103-297fd1c744eb"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "8"
+                      },
+                      "name": "group - 11-Fn Admin Submissions",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "45a1c185-4fbf-4e83-832e-1f20af427796"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Negative(FN) User submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message **False Negative(FN) Submissions performed by end users** in Microsoft Defender for Office 365 where the message reported as having Phish, Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Recognise engaged reporters, coach over-reporters, and use graded phishing verdicts to tune anti-phishing policy."
+                            },
+                            "name": "fn user - section header",
+                            "id": "ca0b48e6-8bd8-4f99-956a-f9c72cc870db"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions per-{Granularity} trend by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) User Submissions grouped by submission type (Spam, Phish and Attack simulations) . Helps to monitor where detections were missed and later submitted by users as false negatives.**"
+                            },
+                            "name": "fn user - trend heading",
+                            "id": "60ac8608-7875-45e6-8c83-e6bd0c34af8b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize User_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_AttackSim_Submission=countif(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Phish (Mail)']=coalesce(User_Phish_FN,0), ['Spam (Mail)']=coalesce(User_Spam_FN,0), ['Attack simulation reported']=coalesce(User_AttackSim_Submission,0) | sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalAdminSubmissions",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Phish (Mail)",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Attack simulation reported",
+                                    "color": "green"
+                                  },
+                                  {
+                                    "seriesName": "Spam (Mail)",
+                                    "color": "orangeDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "fn user - submissions trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "29355816-6cba-4264-938e-b0b27afdcb12"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions by submission State\r\n**Displays the total count of False Negative(FN) User Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of user submissions and identify bottlenecks or errors.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - by-state heading",
+                            "id": "6a4b32cc-b7e4-47bb-b1b9-f415df7e629c"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions by Triage Verdict\r\n**Displays the total count of False Negative(FN)/False Positive(FP) User Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - triage-verdict heading",
+                            "id": "1427e34f-be44-4517-ae73-cc4776a49fe7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| summarize count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - by-state pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a6151271-e925-4804-a3c1-06afee27c026"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - triage-verdict pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "6ff319ea-b5c5-4e33-9e5c-065aadbf465d"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions of already detected Emails (from Junk folder)\r\n**Displays the total count of False Negative(FN) User Submissions where the email message was already detected by Microsoft Defender for Office 365 and the detection action was configured to deliver the message into the Junk folder of the user mailbox. It breaks down the result based on the original detection verdict determined by Microsoft Defender for Office 365. Helps track the user submissions of messages that already had a detection. Consider changing the detection action to Quarantine to avoid these submissions.**"
+                            },
+                            "name": "fn user - junk-folder heading",
+                            "id": "d6338907-489d-4c88-b82f-260fc0f9d302"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| summarize count() by ThreatTypes,User_SubmissionType\r\n| project ThreatTypes,User_SubmissionType, Emails = count_",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - junk-folder pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c13452cb-e864-4f01-8623-51f3ea13bbbc"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId,UserId = (parse_json(RawEventData)).UserId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| summarize TotalJunkSubmittedEmailCount=count(),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by tostring(UserId)\r\n| top 15 by TotalJunkSubmittedEmailCount desc\r\n| project ['User']=UserId, ['Junk Submissions']=TotalJunkSubmittedEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Junk Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Phish",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Spam",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - junk-folder table",
+                            "id": "b242f301-c9f7-41f9-aa73-03848bd58eae"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions - Admin review status (Mark and Notify)\r\n**Displays counts of False Negative(FN) User Submissions that were reviewed by admins and marked with a notify action. The Mark and Notify action also can be taken automatically with Automated investigation and response (AIR). Helps track cases where admins confirmed user reports and communicated the outcome, supporting transparency and user trust.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - mark-notify heading",
+                            "id": "784bf171-53ae-4907-b2b0-7fc5039df231"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Negative(FN) User Submissions accuracy vs Admin review verdict\r\n**Displays counts of False Negative(FN) User Submissions (Phish, Junk, NotJunk) compared to admin review results. Highlights whether submissions were Correct, Not Correct, or misclassified comparing user submission type with the Admin decision using Mark and Notify action in Microsoft Defender for Office 365 (e.g., “Phish reported as Junk”, “Reported but not malicious”).**"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - accuracy heading",
+                            "id": "3d137383-6436-4213-9824-72f424b67290"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises user submissions where admin also performed 'mark and notify' action on the submission\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| summarize count() by Reviewed",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - mark-notify pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "7bb7d116-bd61-4e46-81dd-d634a31e7369"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises user submissions type compared to admin review verdict. \r\n//Eg. User reporting a phish but admin review is 'not threat found'\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \"Correct\", iif(AdminReviewResult==\"Phish\" and UserReportedAs == \"Junk\", \"Phish reported as junk\",iif(AdminReviewResult==\"Junk\" and UserReportedAs == \"Phish\",\"Junk reported as Phish\",iif(AdminReviewResult==\"NotJunk\",\"Reported but not malicious or spam\",iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Not correct\")))))\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| where Reviewed==\"Reviewed\"\r\n| summarize count() by ReviewedAccuracy",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fn user - accuracy pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8af1b9f0-995c-4c58-9960-8e69c6960987"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 P2 Email Senders domains in False Negative(FN) User Submissions \r\n**Displays the top 10 P2 email sender domains of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per domain to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-p2-domains heading",
+                            "id": "78dab1f9-09ec-46e2-aee4-f256e368cdd5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top 10 sender domains of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromDomain;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromDomain\r\n| join TotalInboundbySender on SenderFromDomain\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Domain']=SenderFromDomain, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "12ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-p2-domains table",
+                            "id": "6e6a59d4-70e1-4d85-bebb-6bb23d25d2d9"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 P2 Individual Email Senders in False Negative(FN) User Submissions \r\n**Displays the top 10 P2 individual email sender addresses of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-p2-senders heading",
+                            "id": "a6e8fda5-dd05-49ed-87e2-16443495396e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top 10 sender email addresses of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "12ch",
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-p2-senders table",
+                            "id": "878fd15f-2607-4d6d-b919-0b4bea6a1850"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Intra-org Email Senders in False Negative(FN) User Submissions \r\n**Displays the top 10 email senders of intra-org emails reported by users as false negatives (missed detections). Includes total intra-org email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - intraorg-senders heading",
+                            "id": "87a51814-7f01-42e3-aea2-4136c869d39d"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top 10 sender email address of intra-org emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Intra-org\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Intra-org']=count_, ['User Submission %']=UserSubmissions_Percentage",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Intra-org",
+                                    "formatter": 0,
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submission %",
+                                    "formatter": 4,
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    },
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "12ch"
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - intraorg-senders table",
+                            "id": "38edca4b-a403-41e8-8c2b-7c0595e93b7a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Intra-org Email Subjects in False Negative(FN) User Submissions \r\n**Displays the top 10 Email Subjects of intra-org emails reported by users as false negatives (missed detections). Helps to highlight high-risk intra-org email sources.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - intraorg-subjects heading",
+                            "id": "52b0bc5b-7e54-4a5b-a487-8a736a8c2397"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize count() by Subject\r\n| top 10 by count_ desc\r\n| project ['Subject']=Subject, ['User Submissions']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Subject",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "70ch"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - intraorg-subjects table",
+                            "id": "ee2c1d2e-3d4e-4024-8422-985b22cb7475"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Detection Overrides defined by Admins in False Negative(FN) User Submissions \r\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to an admin-defined policy override. Includes details on OrgLevelAction, OrgLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - admin-override heading",
+                            "id": "0dd9b3ce-9716-42bb-93de-495f0af2d075"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an admin definded policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and OrgLevelAction!=\"\"\r\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Override Policy",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "48ch"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - admin-override table",
+                            "id": "100de6ca-beb0-44d7-a715-449a389e9e8a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Detection Overrides defined by Users in False Negative(FN) User Submissions \r\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to a user-defined override. Includes details on UserLevelAction, UserLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - user-override heading",
+                            "id": "67057c7d-c0af-4373-b23a-4001fbced888"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and UserLevelAction!=\"\"\r\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Override Policy",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "48ch"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "User Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - user-override table",
+                            "id": "1b97f7d2-152d-4eb0-bfac-e161fbfa4046"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 users performing the most False Negative(FN) User Submissions\r\n**Displays the Top 10 user accounts that performed the highest number of False Negative(FN) User Submissions (missed detections). Helps identify individuals most engaged in reporting suspicious, malicious messages and potential patterns in detection gaps.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-users heading",
+                            "id": "7799a0a0-a835-4080-b59a-736b08ad809e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 users performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - top-users pie",
+                            "id": "44838734-43a0-4301-9ddb-a644c7ec509a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 users performing the most User Submissions of Attack simulation messages\r\n**Displays the top 10 user accounts that reported phishing simulation emails during cyber security awareness campaigns. Supports evaluation of cyber security awareness programme effectiveness and identifies highly engaged users.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - attacksim-users heading",
+                            "id": "8a96e90f-765f-40c0-8476-30c97d43c328"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top users reporting the phishing simulation emails.\r\nCloudAppEvents \r\n| extend Record= (parse_json(RawEventData)).RecordType \r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState \r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| where Record == 29\r\n| where ActionType == \"AttackSimUserSubmission\" \r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fn user - attacksim-users pie",
+                            "id": "ab648c4a-4c46-4c73-96f0-784c9bcef961"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "8"
+                      },
+                      "name": "group - 11 - FN User submissions",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "348ce24a-7cbc-4b66-a471-dfe3827bed2d"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# False Positive(FP) Submissions insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **False Positive(FP) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by administrators or users."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "10"
+                      },
+                      "name": "fp - tab description",
+                      "id": "78e2df52-a0d2-499a-95fe-708f67db5ad6"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Positive(FP) Admin Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nAdministrator submissions represent escalated false positive reports submitted by security team members rather than end users. These typically involve more complex cases requiring expert review, such as recurring issues affecting multiple users, business-critical communications being blocked, or suspected policy misconfigurations. Admin submissions carry higher priority and can result in actions as allow-list additions or global policy changes to prevent widespread user impact.<br><br>**Recommended action:** Review recurring false-positive sender domains and consider allow entries or policy tuning to reduce business disruption."
+                            },
+                            "name": "fp admin - section header",
+                            "id": "02d54e9c-e989-4cde-a128-68a6381ed9d7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Submission Volume and Type Breakdown\r\n\r\n**These charts track the volume and composition of administrator-initiated false positive submissions. The trend chart shows submission patterns (per {Granularity}) across Email, URL, and Attachment types, while the pie chart reveals the distribution among these categories. Spikes in admin submissions often signal systemic issues requiring immediate policy review, as admins typically escalate only the most impactful or recurring problems.**"
+                            },
+                            "name": "fp admin - volume/type heading",
+                            "id": "103b8362-a10f-4b46-a757-8290c4269a5c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of admin false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Email_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_URL_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Attach_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Email']=coalesce(Admin_Email_FP,0), ['URL']=coalesce(Admin_URL_FP,0), ['Attachment']=coalesce(Admin_Attach_FP,0) | sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "TotalAdminSubmissions",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Phish_FN",
+                                    "color": "redBright"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Spam_FN",
+                                    "color": "orange"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Malware_FN",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Phish_URL_FN",
+                                    "color": "purple"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Malware_Attach_FN",
+                                    "color": "yellowDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Phish_Attach_FN",
+                                    "color": "purpleDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Malware_URL_FN",
+                                    "color": "yellow"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Email_FP",
+                                    "color": "redDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_URL_FP",
+                                    "color": "orangeDark"
+                                  },
+                                  {
+                                    "seriesName": "Admin_Attach_FP",
+                                    "color": "yellow"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "66",
+                            "name": "fp admin - submissions trend",
+                            "id": "326762ca-1f2b-48e9-90d6-ff2aa6a75e95"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false positive submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Email\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"URL\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Attachment\",\r\n\"Other\")))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart",
+                              "chartSettings": {
+                                "createOtherGroup": 10
+                              }
+                            },
+                            "customWidth": "33",
+                            "name": "fp admin - by-type pie",
+                            "id": "be925c4c-5718-4385-8e82-59c57b975ac5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### False Positive(FP) Admin Submissions by submission state<br>\r\n\r\n**Displays the total count of False Positive(FP) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - by-state heading",
+                            "id": "2b2acb67-c070-48bd-acf1-025c05aae8b5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Admins Submitting False Positives<br>\r\n\r\n**Displays the top 15 admin accounts that submitted the highest number of false positive messages via AdminSubmission.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - top-admins heading",
+                            "id": "52206f40-fae9-460f-97b8-2cf9b633098f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of admin false positive submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - by-state pie",
+                            "id": "96133d9e-24fb-417e-a3cd-df98dda4c60a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top admins performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \r\n| where Record == 29 and SubmissionType ==\"3\"\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - top-admins pie",
+                            "id": "da7b4c89-904d-4917-b6cd-04b32e02d4a1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Submission False Positive Malware Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as malware.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - malware-detection heading",
+                            "id": "69d649e0-86fd-4c08-afd4-e6c200b11c86"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Admin false positive submissions whose original verdict was Malware, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Malware.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Malware\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Malware\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Malware FPs'] = Pct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "% of",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - malware-detection table",
+                            "id": "607eb19b-1ded-488d-98db-8b23f9e90967"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Submission False Positive Phish Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - phish-detection heading",
+                            "id": "c1f1e12f-d0aa-4023-9172-8182772b3331"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Admin false positive submissions whose original verdict was Phish, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Phish.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Phish\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Phish\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Phish FPs'] = Pct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "% of",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - phish-detection pie",
+                            "id": "b6c074f9-affa-41a3-802a-53541394ae73"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin Submission False Positive Spam Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - spam-detection heading",
+                            "id": "f0f2adb9-34af-4df0-90e6-087a265bedf6"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Admin false positive submissions whose original verdict was Spam, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Spam.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Spam\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Spam\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Spam FPs'] = Pct",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "20ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "% of",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "14ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp admin - spam-detection pie",
+                            "id": "e877d9c9-3bd3-4368-997e-945f18ffcf5f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains for Admin False Positive Submissions<br>\r\n\r\n**Lists the top 10 sender domains of emails reported as false positives by administrators (legitimate messages incorrectly flagged as spam or phishing). Helps identify domains frequently misclassified.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - top-sender-domains heading",
+                            "id": "37680101-7e4b-4bcc-9e7e-0ccd2d914881"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Admin False Positive Submissions by Original Threat Verdict<br>\r\n\r\n**Displays all administrator-submitted false positive emails by their original filter verdict (e.g., spam, phishing) and policy override details. Helps identify which threat categories are most often misclassified.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - by-verdict heading",
+                            "id": "879e81ad-00a6-4a10-bcb6-56879133bb9f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top 10 sender domains of emails which are submitted as false positive by admins\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType ==\"3\"\r\n| summarize count() by P2SenderDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - top-sender-domains table",
+                            "id": "42844dc9-4418-487b-a5ad-31e1f6b4b487"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Email\",\r\n\"Other\"),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Emails",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "40ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fp admin - by-verdict table",
+                            "id": "3ebbd402-06ef-45a7-b4ee-c5938b98b540"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "10"
+                      },
+                      "name": "fp admin - group",
+                      "styleSettings": {
+                        "showBorder": true
+                      },
+                      "id": "b6215b53-c181-4693-a14f-441809f65f38"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Positive (FP) User Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message False Postive(FP) Submissions performed by end users in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by users. User submissions are critical feedback mechanisms that help security teams identify overly aggressive detection rules, refine security policies, and reduce user friction. High false positive rates can erode user trust and lead to security fatigue, so monitoring these metrics helps balance protection with productivity.<br><br>**Recommended action:** High user false-positive volume suggests over-aggressive filtering - review the affected senders and adjust policy."
+                            },
+                            "name": "fp user - section header",
+                            "id": "0d93d7ee-a61e-43b7-bdcd-172bd79ad050"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Submission Trend\r\n\r\n**Displays the volume (per {Granularity}) of false positive submissions from end users. A sudden spike may indicate a new detection rule causing widespread misclassification, while a declining trend suggests improving detection accuracy. Monitoring this trend helps security teams respond quickly to detection issues before they impact user productivity.**"
+                            },
+                            "name": "fp user - trend heading",
+                            "id": "c3f8ae45-0498-4fa8-b9d1-35e926932639"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of user false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where SubmissionType == \"3\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User FP Submissions'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "User FP Submissions",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - submissions trend",
+                            "id": "847032f5-56a8-4681-9665-9e917c7c9355"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User False Positive Submissions by State<br>\r\n\r\n**Displays the total number of user-reported false positive email submissions grouped by their processing state (e.g., pending, completed). Helps track submission workflow and resolution progress.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp user - by-state heading",
+                            "id": "7bd03278-7734-4fbf-a502-95b42e90160e"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top Users Performing False Positive Submissions<br>\r\n\r\n**Lists the top 15 users who reported emails as false positives (legitimate messages incorrectly flagged as threats). Helps identify frequent reporters and potential training or policy adjustment needs.**"
+                            },
+                            "customWidth": "50",
+                            "name": "fp user - top-users heading",
+                            "id": "7e2b987b-325d-4f69-8d6b-fafd6676a03a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of user false positive submission by submission state.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "fp user - by-state pie",
+                            "id": "df79d08b-3eac-4101-a3f2-3a4a3bf450ce"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the top users performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "fp user - top-users pie",
+                            "id": "ec7505d8-3a70-4bde-a985-baf5a0c4ec34"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Submission False Positive Malware Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection technique that flagged them. Malware quarantine is admin-only by default, so this table only populates when a custom quarantine policy lets users view and report their own malware detections - it is usually empty.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - malware-verdict heading",
+                            "id": "693b1072-5ddd-49d0-a0f5-2bba4c287edf"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//User false positive submissions whose email was originally flagged as Malware, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Malware.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Malware\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "22ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - malware-verdict table",
+                            "id": "10ea55bd-937e-454d-b6cc-a9dccfdf3417"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Submission False Positive Phish Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - phish-verdict heading",
+                            "id": "6dd14abb-2772-4271-89d8-8c0dcdbfd9e5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//User false positive submissions whose email was originally flagged as Phish, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Phish.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Phish\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "22ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - phish-verdict pie",
+                            "id": "57049aad-eb17-4e65-a8a4-b5d05b0501cd"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### User Submission False Positive Spam Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - spam-verdict heading",
+                            "id": "5479b2ed-b629-41e7-9857-c91191b09c8f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//User false positive submissions whose email was originally flagged as Spam, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Spam.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Spam\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Sender Domains",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "22ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - spam-verdict pie",
+                            "id": "45a2122e-0281-4602-906d-a0406ed20d54"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Sender Domains for User False Positive Submissions<br>\r\n\r\n**Lists the top 10 sender domains of emails reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify domains frequently misclassified.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-sender-domains heading",
+                            "id": "2751fca4-3ac5-45fe-a965-8c811018926a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 sender domains reported as false positives by users, with each domain's total inbound volume and the share of it reported as FP (a high rate flags a domain whose legitimate mail is most often misclassified).\r\nlet totalByDomain = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderFromDomain;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize FPSubmissions = count() by P2SenderDomain\r\n| join kind=leftouter (totalByDomain) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Domain'] = P2SenderDomain, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "18ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "FP Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-sender-domains table",
+                            "id": "c69b126d-9f25-44a0-b96d-601d89a563f1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Senders in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 email senders whose messages were reported as false positives by users (legitimate emails incorrectly flagged as threats). Helps identify senders frequently misclassified.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-senders heading",
+                            "id": "b39966ad-2b40-4144-ae3f-c7ac6b9fb97c"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 email senders reported as false positives by users, with each sender's total inbound volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Inbound",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "18ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "FP Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-senders table",
+                            "id": "077ab610-58ed-4d23-886c-dbf912cef2d7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Subjects in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 email subjects reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify common patterns in misclassified emails.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-subjects heading",
+                            "id": "a5b939e1-0fbf-4ee1-a6a3-01fa7639af3a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 email subjects reported as false positives by users, with how many distinct recipients reported each (a subject reported by many users is a broad misclassification pattern).\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count(), DistinctRecipients = dcount(RecipientObjectId) by Subject\r\n| top 10 by FPSubmissions desc\r\n| project ['Subject'] = Subject, ['FP Submissions'] = FPSubmissions, ['Distinct Recipients'] = DistinctRecipients",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Subject",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "70ch"
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Recipients",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "18ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - top-subjects table",
+                            "id": "71d5c290-f5d0-493c-b821-b5345dbe7312"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top 10 Intra-Org Senders in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 internal senders whose emails were reported as false positives by users (legitimate intra-org messages incorrectly flagged as threats). Helps identify internal communication patterns causing misclassification.**"
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - intraorg-senders heading",
+                            "id": "1d38f458-dfde-4608-ad7d-ee8628e85ee7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top 10 internal senders whose emails were reported as false positives by users, with total intra-org volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Intra-org\" | summarize TotalIntraOrg = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalIntraOrg) or TotalIntraOrg == 0, 0.0, round(FPSubmissions * 100.0 / TotalIntraOrg, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Intra-org'] = coalesce(TotalIntraOrg, 0), ['FP Submission %'] = FPPct",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "FP Submissions",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Total Intra-org",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "18ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "FP Submission %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "16ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "fp user - intraorg-senders table",
+                            "id": "b6699a7f-897a-4016-ae2c-d816f3a9492b"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "10"
+                      },
+                      "name": "fp user - group",
+                      "styleSettings": {
+                        "showBorder": true
+                      },
+                      "id": "2ad3311e-e92b-4a49-bdd0-775f085c4587"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# File Malware Detections (SharePoint, Teams and OneDrive)\r\n\r\n---\r\n\r\nThis tab provides insights into malicious file detections across Microsoft collaboration platforms such as SharePoint, OneDrive, and Teams.\r\n\r\n[<p><b>Safe Attachments for SharePoint, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-about)\r\n[<p><b>Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-for-spo-odfb-teams-about) "
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "9"
+                      },
+                      "name": "filemal - tab description",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "cefcac88-f373-4748-b0ea-e7600f63edd7"
+                    },
+                    {
+                      "type": 3,
+                      "content": {
+                        "version": "KqlItem/1.0",
+                        "query": "//Microsoft Defender for Office 365 value for files in SharePoint / OneDrive / Teams: total files processed, how many had a malware detection, and how many were scanned with no detection. A per-period Trend series feeds the tile sparkline.\r\nlet gran = {Granularity};\r\nlet base = FileMaliciousContentInfo;\r\nlet counts = union\r\n(base | summarize Count = count() | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files Scanned - No Detection\", Ord = 3);\r\nlet tagged = union\r\n(base | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\"),\r\n(base | where isnotempty(ThreatTypes) | extend Cat = \"Files with Malware Detected\"),\r\n(base | where isempty(ThreatTypes) | extend Cat = \"Files Scanned - No Detection\");\r\nlet trends = tagged | make-series Trend = count() default = 0 on Timestamp step gran by Cat;\r\ncounts\r\n| join kind=leftouter (trends) on Cat\r\n| sort by Ord asc\r\n| project Count, Details = Cat, Trend",
+                        "size": 3,
+                        "timeContextFromParameter": "TimeRange",
+                        "queryType": "advancedHunting",
+                        "visualization": "tiles",
+                        "tileSettings": {
+                          "titleContent": {
+                            "columnMatch": "Details",
+                            "formatter": 1
+                          },
+                          "leftContent": {
+                            "columnMatch": "Count",
+                            "formatter": 12,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            },
+                            "numberFormat": {
+                              "unit": 17,
+                              "options": {
+                                "style": "decimal",
+                                "maximumFractionDigits": 1
+                              }
+                            }
+                          },
+                          "secondaryContent": {
+                            "columnMatch": "Trend",
+                            "formatter": 21,
+                            "formatOptions": {
+                              "min": 0,
+                              "palette": "blue"
+                            }
+                          },
+                          "showBorder": true,
+                          "size": "auto"
+                        }
+                      },
+                      "customWidth": "100",
+                      "name": "filemal - MDO value tiles",
+                      "id": "843e58a9-6324-4a90-a652-bfb0549e79dc",
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "9"
+                      }
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">File Malware Detection (SharePoint, OneDrive, and Teams)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section monitors malware detections in files stored across Microsoft 365 collaboration platforms. Microsoft Defender for Office 365 and built-in SharePoint Online antivirus work together to scan files uploaded to SharePoint, OneDrive, and Teams. Understanding file-based malware patterns helps protect collaborative workspaces and identify potential security risks in shared content.<br><br>**Recommended action:** For repeat file owners or sites, investigate possible compromise and confirm Safe Attachments for SharePoint, OneDrive and Teams is enabled."
+                            },
+                            "name": "filemal - section header",
+                            "id": "373fe4e5-fc90-49cf-93ba-c8b100efce57"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### File Malware Detection Trend<br>\r\n\r\n**This visual tracks the volume (per {Granularity}) of malware detections in files across all Microsoft 365 workloads. Spikes in detection activity may indicate targeted attacks or emerging malware campaigns affecting collaborative platforms. Regular monitoring helps identify unusual patterns that require investigation.**"
+                            },
+                            "name": "filemal - trend heading",
+                            "id": "30145585-8998-443a-b6ec-062d136c621f"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(FileMaliciousContentInfo\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Files']=coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "tileSettings": {
+                                "showBorder": false
+                              },
+                              "graphSettings": {
+                                "type": 0
+                              },
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Files",
+                                    "color": "blueDark"
+                                  }
+                                ],
+                                "showDataPoints": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - detection trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "d39cea9b-75a8-4c29-bfdb-2e0db855e98a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Family Analysis - Defender for Office 365\r\n**Provides a breakdown of malware detections in files scanned by Microsoft Defender for Office 365 (Safe Attachments detonation) across SharePoint, OneDrive, and Teams. The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify dominant threats and their spread across collaboration platforms.**"
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - family MDO heading",
+                            "id": "4e330873-f732-4d37-a7b0-dced08b019b0"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes File malware detections by Microsoft Defender for Office 365 (Safe Attachments detonation) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"detonation\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "tileSettings": {
+                                "showBorder": false,
+                                "titleContent": {
+                                  "columnMatch": "RawinfoVirusInfo",
+                                  "formatter": 1
+                                },
+                                "leftContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "auto"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              },
+                              "graphSettings": {
+                                "type": 0,
+                                "topContent": {
+                                  "columnMatch": "RawinfoVirusInfo",
+                                  "formatter": 1
+                                },
+                                "centerContent": {
+                                  "columnMatch": "count_",
+                                  "formatter": 1,
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              },
+                              "chartSettings": {
+                                "xAxis": "RawinfoVirusInfo",
+                                "createOtherGroup": 15
+                              },
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Files",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - family MDO table",
+                            "id": "c3fbb1c9-be67-43b9-9a32-7fb265a84ffc"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Family Analysis - SharePoint AV\r\n**Provides a breakdown of malware detections in files across SharePoint, OneDrive, and Teams caught by the built-in SharePoint antivirus (Antimalware engine). The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify prevalent threats and their spread across collaboration environments.**"
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - family SPO-AV heading",
+                            "id": "331a8361-6e81-4615-b33a-97ebb3e31529"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query summarizes File malware detections by the built-in SharePoint antivirus (Antimalware engine) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"Antimalware engine\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "chartSettings": {
+                                "xAxis": "RawinfoVirusInfo",
+                                "createOtherGroup": 10
+                              },
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Files",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - family SPO-AV table",
+                            "id": "bbcdccd9-eedb-476a-a0e7-8504f8770229"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Location<br>\r\n\r\n**Displays the number of malware detections grouped by specific SharePoint sites or OneDrive locations. Helps identify which sites have the highest volume of detected threats for targeted remediation and security hardening.**"
+                            },
+                            "customWidth": "50",
+                            "name": "filemal - by-location heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "c5668d6e-7c0e-4ce3-9509-ca93dda3efad"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Detections by Application<br>\r\n\r\n**Summarizes malware detections across Microsoft collaboration apps, including SharePoint, OneDrive, and Teams. Helps identify which applications experience the highest volume of detected threats for targeted security measures.**"
+                            },
+                            "customWidth": "50",
+                            "name": "filemal - by-application heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "07e64ca9-04a2-44b2-a044-e927bc73ef1b"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query lists total Malware detections of files on SharePoint, OneDrive and Teams by the location (site or personal path) where the file resides.\r\nFileMaliciousContentInfo\r\n| extend ['Site / Location'] = tostring(split(FolderPath, '/')[4])\r\n| summarize ['Detections'] = count() by ['Site / Location']\r\n| sort by ['Detections'] desc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "filemal - by-location table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3ce3ea65-a4df-450f-871c-8956d59818a9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams summarizing the data by the Microsoft collaboration application (workload).\r\nFileMaliciousContentInfo\r\n| summarize count() by Workload\r\n| sort by count_ desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "50",
+                            "name": "filemal - by-application pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "003afc8e-0403-4aa9-9084-a3c2e435216a"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Top File Owners Holding Malware\r\n**Lists the users (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, with the count of malicious files, distinct files, affected workloads and sample threat names. Helps pinpoint the accounts and collaboration locations most affected by malicious content for targeted remediation.**"
+                            },
+                            "customWidth": "100",
+                            "name": "filemal - top-owners heading",
+                            "id": "c2f8d3b5-0a4e-4b7c-9d23-8e6f0a1b2c34"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Top file owners (or the SharePoint/Teams site, when a file has no user owner) whose SharePoint/OneDrive/Teams files were flagged as malware, with distinct files, workloads and sample threat names.\r\nFileMaliciousContentInfo\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Malicious Files'] = count(),\n            ['Distinct Files']  = dcount(SHA256),\n            ['Workloads']       = make_set(Workload, 3),\n            ['Sample Threats']  = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\n            ['Last Seen']       = max(Timestamp)\n        by ['Owner']=Owner\n| top 20 by ['Malicious Files']",
+                              "size": 0,
+                              "title": "Top File Owners Holding Malware",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Malicious Files",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Distinct Files",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "filemal - top-owners table",
+                            "id": "36d9a683-9f9d-4a70-84d9-ec351542f827"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "9"
+                      },
+                      "name": "filemal - group",
+                      "styleSettings": {
+                        "showBorder": true
+                      },
+                      "id": "50886cd9-87bf-4a84-bd80-d7f44441b3f7"
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Post-Delivery &amp; Quarantine Insights\r\n\r\n---\r\nThis tab covers what happens to threats **after delivery**: Zero-hour Auto Purge (ZAP) remediation of malicious messages already in mailboxes, and quarantine management - what is held, released, and by whom. Together they show how effectively post-delivery response contains threats that reached the inbox."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "11"
+                      },
+                      "name": "postdelivery - tab description",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "93371620-d968-4987-bddd-6c9b9e5a0344"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Post Delivery Protection offered by ZAP\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into Microsoft Defender for Office 365's post-delivery protection capabilities through Zero-Hour Auto Purge (ZAP). ZAP is a critical security feature that continuously monitors delivered emails and automatically removes messages that are later identified as malicious. These visuals help track ZAP effectiveness, response times, and remediation patterns.<br><br>**Recommended action:** High post-delivery ZAP volume means threats are reaching inboxes before being caught - review pre-delivery filtering and detection latency."
+                            },
+                            "name": "postdelivery - section header",
+                            "id": "b22ee5f1-a2dc-4509-92a3-1dbcad3a6ee7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP Post-Delivery Actions (per {Granularity})<br>\r\n\r\n**Shows the count (per {Granularity}) of emails that were remediated post-delivery by Zero-Hour Auto Purge (ZAP). Helps track how often threats are detected and removed after reaching user mailboxes.**"
+                            },
+                            "customWidth": "50",
+                            "name": "postdelivery - zap-actions heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "af1aa73f-d952-4827-bcc9-b97a19016829"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP Actions by Detection Type (per {Granularity})<br>\r\n\r\n**Visualizes the count (per {Granularity}) of post-delivery remediation actions performed by Zero-Hour Auto Purge (ZAP), broken down by detection type (Spam ZAP, Phish ZAP, Malware ZAP). Helps track which threat categories are most frequently remediated after delivery.**"
+                            },
+                            "customWidth": "50",
+                            "name": "postdelivery - by-detection-type heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "8eb38cb1-4e2d-435a-81be-e661c9b89ff4"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailPostDeliveryEvents \r\n| where ActionType has \"ZAP\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Zapped Emails'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Zapped Emails",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "50",
+                            "name": "postdelivery - zap-actions trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "dd60fd71-4e14-4b38-ad22-39f1e3e3f55a"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType has \"ZAP\"\r\n| summarize [\"Spam ZAP\"]=countif(ActionType has 'Spam ZAP'), [\"Phish ZAP\"]=countif(ActionType has 'Phish ZAP'), [\"Malware ZAP\"]=countif(ActionType has 'Malware ZAP') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Spam ZAP\"]=coalesce([\"Spam ZAP\"],0), [\"Phish ZAP\"]=coalesce([\"Phish ZAP\"],0), [\"Malware ZAP\"]=coalesce([\"Malware ZAP\"],0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "50",
+                            "name": "postdelivery - by-detection-type trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "511f4a43-9f56-48ad-a644-b72722af82d7"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### ZAP Remediation by Destination<br>\r\n\r\n**This visual shows where ZAP moves malicious emails during remediation. Post-delivery actions can send emails to different locations: Quarantine (isolated for admin review), Deleted Items (soft delete), Junk Email folder, or back to Inbox (for false positive corrections). Understanding these patterns helps evaluate ZAP policy configurations and ensures malicious content is properly isolated from users.**"
+                            },
+                            "name": "postdelivery - by-destination heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "dc7b9b6c-36fb-4ae4-a3e8-ff11da681c97"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType contains \"ZAP\"\r\n| summarize Quarantine=countif(DeliveryLocation has 'Quarantine'), ['Deleted Items']=countif(DeliveryLocation has 'Delete'), Junk=countif(DeliveryLocation has 'Junk'), Inbox=countif(DeliveryLocation has 'Inbox') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Quarantine=coalesce(Quarantine,0), ['Deleted Items']=coalesce(['Deleted Items'],0), Junk=coalesce(Junk,0), Inbox=coalesce(Inbox,0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "name": "postdelivery - by-destination trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "cbb737ef-1c7e-4b3e-af26-a553fe6147c9"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "11"
+                      },
+                      "name": "postdelivery - group",
+                      "styleSettings": {
+                        "showBorder": true
+                      },
+                      "id": "e436ecee-8886-4179-a578-9e4a42e75b9e"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Quarantine Management and Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides comprehensive insights into quarantine operations, including release patterns, detection methods, and threat categorization. It helps security teams understand what types of threats are being quarantined and monitor quarantine release activity to identify potential false positives or security policy effectiveness.<br><br>**Recommended action:** Investigate high release rates - they indicate false positives or risky user releases; review quarantine policies and release permissions."
+                            },
+                            "name": "quarantine - section header",
+                            "id": "c4862977-6670-4716-8109-252a361d7478"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Quarantine Release Trend<br>\r\n\r\n**This visual displays the per-{Granularity} trend of emails released from quarantine by administrators. Monitoring this metric helps identify patterns in quarantine management and potential areas where policy adjustments may be needed to reduce unnecessary quarantines.**"
+                            },
+                            "name": "quarantine - release-trend heading",
+                            "id": "8526a5e0-c6a4-44e3-b00a-5e135374f58e"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the daily ammount of emails released from quarantine\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\" and Action has 'Quarantine release'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Quarantine Releases'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Quarantine Releases",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - release trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "3625d1f1-f34a-4cbf-a78f-eb2e5506bad4"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Quarantine Release Percentage<br>\r\n\r\n**Calculates the percentage of quarantined emails that were successfully released compared to the total quarantined messages. This metric helps measure engagement with quarantine and assess the effectiveness of quarantine policies.**"
+                            },
+                            "customWidth": "40",
+                            "name": "quarantine - release-pct heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "e3a9502c-9030-4621-b248-55cdf69f81ae"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Quarantine Release Analysis by Detection Type<br>\r\n\r\n**For each detection technology, this shows the share of its quarantined emails that were later released from quarantine (Release % = released / quarantined). A high release rate flags a detector that may be over-flagging legitimate mail - a strong candidate for policy or rule tuning. The Released count shows the volume behind each rate.**"
+                            },
+                            "customWidth": "60",
+                            "name": "quarantine - release-by-detection heading",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "976fc90f-bf46-4315-b05e-4e501b37b869"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "title": " ",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "stat",
+                              "tileSettings": {
+                                "titleContent": {
+                                  "columnMatch": "Release_Percentage",
+                                  "formatter": 12,
+                                  "formatOptions": {
+                                    "palette": "none"
+                                  },
+                                  "numberFormat": {
+                                    "unit": 1,
+                                    "options": {
+                                      "style": "decimal"
+                                    }
+                                  }
+                                },
+                                "showBorder": true,
+                                "sortCriteriaField": "Release_Percentage",
+                                "size": "auto"
+                              },
+                              "statSettings": {
+                                "valueField": "Release_Percentage",
+                                "valueAggregation": "None",
+                                "colorSettings": {
+                                  "type": "thresholds",
+                                  "mode": "foreground",
+                                  "heatmapPalette": "greenRed",
+                                  "thresholdsGrid": [
+                                    {
+                                      "operator": "<",
+                                      "thresholdValue": "5",
+                                      "representation": "green"
+                                    },
+                                    {
+                                      "operator": ">",
+                                      "thresholdValue": "5",
+                                      "representation": "redDark"
+                                    }
+                                  ]
+                                },
+                                "iconSettings": {
+                                  "thresholdsGrid": []
+                                },
+                                "numberFormatSettings": {
+                                  "unit": 1,
+                                  "options": {
+                                    "style": "decimal"
+                                  }
+                                },
+                                "tagText": "Quarantine Release Percentage",
+                                "valueFontStyle": "mega",
+                                "tagTextPosition": "bottom"
+                              }
+                            },
+                            "customWidth": "40",
+                            "name": "quarantine - release-pct stat",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "64e157ce-2f6a-423f-9ce5-eade8b6f41d5"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Per detection technology: the share of its quarantined emails that were later released from quarantine.\r\n//Release % = released / quarantined for that detection technology - a high rate flags a detector that may be over-flagging legitimate mail (potential false positives). Detectors with fewer than 10 quarantined emails are excluded so the rate is statistically meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\r\n| join kind=leftouter (\r\n    EmailPostDeliveryEvents\r\n    | where Action == \"Quarantine release\"\r\n    | distinct NetworkMessageId\r\n    | extend ReleasedFlag = \"yes\"\r\n  ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Quarantined Emails",
+                                    "formatter": 0,
+                                    "formatOptions": {
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Released",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Release %",
+                                    "formatter": 4,
+                                    "formatOptions": {
+                                      "palette": "red",
+                                      "min": 0,
+                                      "max": 20,
+                                      "customColumnWidthSetting": "90px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 1,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "60",
+                            "name": "quarantine - release-by-detection pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "9a6d21b7-7542-4ae5-8f3f-b18474b52a20"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Malware Email Quarantine Analysis<br>\r\n\r\n**These visuals break down quarantined malware emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple malware detection techniques including file detonation, file reputation analysis, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-malware policies and identify emerging malware tactics.<br>The line chart shows per-{Granularity} trends across all malware detection methods, while the table provides an overall distribution of detection reasons.**"
+                            },
+                            "name": "quarantine - malware heading",
+                            "id": "59f84161-a010-44c2-aec1-b72ed98ccdff"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of malware emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Malware\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - malware trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "a54a8daf-0be2-4c0e-a8d7-4ff0e0879fd2"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of malware emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Malware (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Malware' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Malware)\r\n| summarize count() by Malware\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Malware, ['Detections']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - malware table",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "b5d0d022-cf41-47e5-ae06-cf2176b47758"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Phishing Email Quarantine Analysis<br>\r\n\r\n**These visuals break down quarantined phishing emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple phishing detection techniques including impersonation protection, URL detonation, spoof detection, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-phishing policies and identify emerging phishing tactics.<br>The line chart shows per-{Granularity} trends across all phishing detection methods, while the table provides an overall distribution of detection reasons.**"
+                            },
+                            "name": "quarantine - phish heading",
+                            "id": "aca50104-cb68-4a8f-82ee-ea8eee25fe14"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of phish emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Phish\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - phish trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "57151360-0577-45ce-8fc6-10a3790865ce"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of phish emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Phish (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Phish)\r\n| summarize count() by Phish\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Phish, ['Detections']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - phish pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "df78c64b-76f6-4980-80df-d0d432e780a5"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Spam Email Quarantine Analysis<br>\r\n\r\n**These visuals provide detailed insights into quarantined spam emails categorized by detection methods. Spam detection technologies include advanced filters, general filters, bulk email filtering, reputation-based systems (IP, domain, URL), and mixed analysis detection. Analyzing spam quarantine patterns helps fine-tune spam filtering policies to balance security with user productivity and reduce false positives.<br>The line chart displays per-{Granularity} trends for each spam detection method, while the table shows the overall distribution.**"
+                            },
+                            "name": "quarantine - spam heading",
+                            "id": "e131910f-0233-474a-a9b8-9f70a49246cf"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the ammount of spam emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet baseQuery = EmailEvents\r\n| where DetectionMethods has \"Spam\" and DeliveryLocation == \"Quarantine\";\r\nlet agg = materialize(baseQuery\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - spam trend",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "5762bcc7-bbda-4a3d-91cf-de18fbdd2775"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query visualises the total ammount of spam emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Spam (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Spam)\r\n| summarize count() by Spam\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Spam, ['Detections']=count_",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Detections",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "30ch"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "filter": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "quarantine - spam pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "2995f55b-17f9-458b-8630-e0370d14522a"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "11"
+                      },
+                      "name": "quarantine - group",
+                      "id": "430294af-c68f-4427-8b55-d552a3d89d42",
+                      "styleSettings": {
+                        "showBorder": true
+                      }
+                    },
+                    {
+                      "type": 1,
+                      "content": {
+                        "json": "# Security Operations Center (SOC) Insights \r\n\r\n---\r\n\r\nThis tab provides a view for security operations. Combines incident response metrics with investigation insights to evaluate the effectiveness of both automated systems and manual interventions."
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "13"
+                      },
+                      "name": "soc - tab description",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px"
+                      },
+                      "id": "fd65243c-514c-4813-978f-fb908226d049"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Security Incident Response Metrics\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Operational efficiency insights.** Tracks incident volume, resolution speed, automation efficacy, and classification accuracy to evaluate SOC performance.<br><br>**Recommended action:** Track mean time to close by severity against your SLA and investigate any severity trending upward."
+                            },
+                            "name": "soc - incident-metrics section header",
+                            "id": "f92c3e24-3e0f-4f4c-8ee9-3ec60832f7b1"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Email Security Incidents<br>\r\n\r\n**These visuals display the per-{Granularity} trend of email-related security incidents, as well as the proportion of email incidents compared to the total number of incidents in Defender.**"
+                            },
+                            "name": "soc - email-incidents heading",
+                            "id": "c1cf6796-6071-4d2e-bf2c-c5e8d2a99a12"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// Filter for incidents that have at least one Email Security alert\r\nlet gran = {Granularity};\r\nlet OfficeEmailAlerts = SecurityAlert\r\n    | where ProductName contains \"Office 365 Advanced Threat Protection\" or ProductName contains \"Microsoft 365 Defender\"\r\n    | project SystemAlertId;\r\nlet agg = materialize(SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds) \r\n| join kind=inner\r\n    (OfficeEmailAlerts | extend SystemAlertId = tostring(SystemAlertId))\r\n    on $left.AlertId == $right.SystemAlertId\r\n| summarize arg_max(TimeGenerated, *), AlertCount = dcount(AlertId) by IncidentNumber\r\n| summarize Incidents_Number = count() by TimeGenerated = bin(TimeGenerated, gran));\r\nrange TimeGenerated from toscalar(agg | summarize min(TimeGenerated)) to toscalar(agg | summarize max(TimeGenerated)) step gran\r\n| join kind=leftouter (agg) on TimeGenerated\r\n| project TimeGenerated, ['Email Security Incidents'] = coalesce(Incidents_Number, 0)\r\n| sort by TimeGenerated asc",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "chartSettings": {
+                                "seriesLabelSettings": [
+                                  {
+                                    "seriesName": "Email Security Incidents",
+                                    "color": "blueDark"
+                                  }
+                                ]
+                              }
+                            },
+                            "customWidth": "75",
+                            "name": "soc - email-incidents trend",
+                            "id": "e23cfcda-1017-4fd0-ac71-8a861c450f71"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// Categorize incidents: Email Security vs Other\r\nlet AllAlerts = SecurityAlert\r\n    | extend SystemAlertId = tostring(SystemAlertId)\r\n    | project SystemAlertId, ProductName;\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds)\r\n| join kind=inner\r\n    (AllAlerts)\r\n    on $left.AlertId == $right.SystemAlertId\r\n| summarize AlertSystems = make_set(ProductName) by IncidentNumber\r\n| extend HasEmailSecurity = \r\n    AlertSystems has \"Office 365 Advanced Threat Protection\" or \r\n    AlertSystems has \"Microsoft 365 Defender\"\r\n| extend Category = iff(HasEmailSecurity, \"Email Security\", \"Other\")\r\n| summarize IncidentCount = count() by Category\r\n",
+                              "size": 3,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "25",
+                            "name": "soc - incident-category pie",
+                            "id": "baae2150-1b04-43b4-9713-48fd3cc6247f"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Average Incident Time To Close (minutes)\r\n**This visual displays the average time, in minutes, to close email-related security incidents (per {Granularity}), split by severity, so you can see how resolution speed changes over time. Reference SLA targets: High 60, Medium 120, Low 240, Informational 480 minutes.**"
+                            },
+                            "name": "soc - time-to-close heading",
+                            "id": "e23ccc6c-b0f0-407b-8e01-d8b69c40a745"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// SLA thresholds by severity for email-security (MDO) incidents\r\nlet SLA_Variables = datatable (Severity:string, TimeToResolve:int) [\r\n    \"High\", 60,\r\n    \"Medium\", 120,\r\n    \"Low\", 240,\r\n    \"Informational\", 480\r\n];\r\n\r\n// Identify MDO-related incidents via alert correlation\r\nlet EmailSecurityIncidents = \r\n    SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for each MDO-related incident\r\nlet LatestMdoIncidents =\r\n    SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, Severity, CreatedTime, ClosedTime, Title) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    | where not(Title startswith \"CC_\");  // Exclude non-email incidents as needed\r\n\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| extend TimeToResolveIncident = datetime_diff('minute', ClosedTime, CreatedTime)\r\n| join kind=inner SLA_Variables on Severity\r\n| summarize\r\n    ['Avg Time to Close (min)'] = avg(TimeToResolveIncident),\r\n    CountIncidents = count(), Breached = countif(TimeToResolveIncident > TimeToResolve)\r\n    by Day = bin(ClosedTime, 1d), Severity\r\n| order by Day asc, Severity asc",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "chartSettings": {
+                                "xAxis": "Day",
+                                "yAxis": [
+                                  "Avg Time to Close (min)"
+                                ],
+                                "group": "Severity",
+                                "createOtherGroup": null
+                              }
+                            },
+                            "name": "soc - sla-by-severity trend",
+                            "id": "3f7d1f17-8d2f-4a1b-a97e-17973812ca6f"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "### Closed Incident Classification (True Positive vs False Positive)\r\n\r\nThis visual shows the distribution of closed email-related incidents classified as True Positive versus False Positive. It helps assess detection accuracy and provides insight into validation trends."
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - classification heading",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "48db10ce-8246-4f5e-8b68-f618d9c7f77c"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "### True Positive Incident Classification Rate\r\n\r\nThis visual displays the percentage of email-related incidents confirmed as True Positive. It offers a clear measure of classification accuracy and highlights changes in detection effectiveness over time."
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - tp-rate heading",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "34a84dbf-609a-407f-afef-f1592eb4a92b"
+                                },
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "### Incidents Automated vs Manual Closure\r\n\r\nThis visual illustrates the proportion of email-related incidents closed automatically versus manually. It provides visibility into operational efficiency and the impact of automation on incident resolution.\r\n<br> ⚠️ *You will have to review the underlying query and add any automation system specific to your organization.*"
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - auto-vs-manual-closure heading",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "a1fd9136-7a12-4d80-b3e1-e2704a84f734"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "// Build a list of MDO-related incidents by cross-referencing SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get only the most recent state of each incident, ensuring it's MDO-related\r\nlet LatestIncidents = SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    | where not(Title startswith \"CC_\");  // Exclude incidents unrelated to MDO (e.g., DSPM)\r\n\r\nLatestIncidents\r\n| where Status == 'Closed'                                     // (Optional) Limit to closed/fully classified incidents\r\n| summarize Count = count() by Classification = iif(\r\n    isnull(Classification) or trim(\" \", Classification) == \"\",\r\n    \"Not Set\", \r\n    Classification\r\n  )\r\n| order by Count desc",
+                                    "size": 3,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "piechart"
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - classification pie",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "cfa5b7c5-50cc-4b3b-8bba-1a93c57bff43"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n    SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n    SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n    | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n    TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n    TotalClosed       = count()\r\n| extend TruePositiveRate = iff(\r\n    TotalClosed > 0,\r\n    TruePositiveCount * 100.0 / TotalClosed,\r\n    real(null)\r\n)",
+                                    "size": 1,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "stat",
+                                    "statSettings": {
+                                      "valueField": "TruePositiveRate",
+                                      "valueAggregation": "None",
+                                      "colorSettings": {
+                                        "type": "static",
+                                        "mode": "background",
+                                        "heatmapPalette": "greenRed",
+                                        "thresholdsGrid": []
+                                      },
+                                      "iconSettings": {
+                                        "thresholdsGrid": []
+                                      },
+                                      "numberFormatSettings": {
+                                        "unit": 1,
+                                        "options": {
+                                          "style": "decimal",
+                                          "maximumFractionDigits": 2
+                                        }
+                                      },
+                                      "tagText": "True Positive Rate",
+                                      "valueFontStyle": "xxLarge",
+                                      "tagTextPosition": "bottom"
+                                    }
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - tp-rate stat",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "eca235aa-38aa-46dd-a569-74dd8f83b2f0"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\")          // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff(                       // Add strings for your automation systems\r\n        tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n        \"Automated\",\r\n        \"Human\"\r\n    )\r\n| summarize ClosedCount = count() by ClosedBy",
+                                    "size": 3,
+                                    "showAnalytics": true,
+                                    "queryType": "advancedHunting",
+                                    "visualization": "piechart"
+                                  },
+                                  "customWidth": "33.3",
+                                  "name": "soc - closure pie",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "a4bc160f-1ba6-4779-86cd-ef44422f1e29"
+                                }
+                              ]
+                            },
+                            "name": "soc - incident-insights group",
+                            "id": "3083ac4d-0bdd-4db7-a5f0-0d41cb67a4eb"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "13"
+                      },
+                      "name": "soc - incident-metrics group",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "18ff8970-e5f6-4c51-918a-aa693a45d18f"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Investigation & Response Actions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Remediation efficacy analysis.** Compares automated (AIR) and manual admin actions to evaluate response times and investigation outcomes.\r\n<br><br>**Recommended action:** Reduce AIR pending-action latency by reviewing why approvals take long, and increase automation where it is safe to do so."
+                            },
+                            "name": "soc - air section header",
+                            "id": "5e0b06c8-7774-4eb4-8b7f-572b3732de84"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Automated Investigation and Response (AIR) Actions (per {Granularity})\r\n\r\nThis visual shows the per-{Granularity} trend of Automated Investigation and Response (AIR) actions, including the number of successful and failed attempts (because of prior remediation)."
+                            },
+                            "customWidth": "100",
+                            "name": "soc - air-actions heading",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "05f14dec-e76c-413c-83a0-31a05dce65e7"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query attempts to show AIR Efficiency Over Time by displaying the number of successes and failures over time\r\nEmailPostDeliveryEvents\r\n| where ActionType =~ \"Automated Remediation\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by bin(Timestamp, {Granularity}), ActionResult",
+                              "size": 0,
+                              "showAnalytics": true,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart",
+                              "graphSettings": {
+                                "type": 0,
+                                "topContent": {
+                                  "columnMatch": "AlertId",
+                                  "formatter": 1
+                                },
+                                "centerContent": {
+                                  "columnMatch": "Count",
+                                  "formatter": 1,
+                                  "numberFormat": {
+                                    "unit": 17,
+                                    "options": {
+                                      "maximumSignificantDigits": 3,
+                                      "maximumFractionDigits": 2
+                                    }
+                                  }
+                                }
+                              },
+                              "chartSettings": {
+                                "xAxis": "Timestamp"
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "soc - air-efficiency trend",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "ae2a1850-5b7e-49f7-bac4-d888053ab49b"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Automated Investigation and Response (AIR) Response Time After Email Delivery (per {Granularity})\r\n\r\nThis visual displays the average (per {Granularity}), 80th percentile (p80), 90th percentile (p90) and 99th percentile (p99) time needed, measured in minutes, from email delivery to AIR action. It serves as a SOC metric to monitor responsiveness (security team members reviewing and manually approving AIR Pending Actions) and identify potential latency in automated incident handling. If the latency is high focus on reviewing why reviwing AIR Pending Actions takes longer time for admins and consider <a href='https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation#configure-automated-remediation'>auto-aproval of URL, Files and Email clusters. </a>\r\n"
+                            },
+                            "customWidth": "100",
+                            "name": "soc - air-response-time heading",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "98c66d9e-efdf-40fc-b8b0-be35d7fd97a9"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// SOC metric: Daily average/p75 delay (in minutes) from email delivery to AIR action\r\nlet deliveries = EmailEvents\r\n  | where DeliveryAction == \"Delivered\"// delivered emails\r\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n  | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\r\nlet remediations = EmailPostDeliveryEvents\r\n  | where ActionType =~ \"Automated Remediation\"// automated remediation events\r\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n  | summarize FirstRemediation = min(Timestamp) by MsgKey;\r\ndeliveries\r\n| join kind=inner remediations on MsgKey\r\n| extend DelayMinutes = datetime_diff(\"minute\", FirstRemediation, FirstDelivery)\r\n| where DelayMinutes >= 0\r\n| summarize ['Avg (min)'] = avg(DelayMinutes),\r\n            ['P80 (min)'] = percentile(DelayMinutes, 80),\r\n            ['P90 (min)'] = percentile(DelayMinutes, 90),\r\n            ['P99 (min)'] = percentile(DelayMinutes, 99),\r\n            CountEmails = count()\r\n   by bin(FirstRemediation, 1d) ",
+                              "size": 0,
+                              "aggregation": 3,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "areachart",
+                              "gridSettings": {
+                                "sortBy": [
+                                  {
+                                    "itemKey": "FirstRemediation",
+                                    "sortOrder": 1
+                                  }
+                                ]
+                              },
+                              "sortBy": [
+                                {
+                                  "itemKey": "FirstRemediation",
+                                  "sortOrder": 1
+                                }
+                              ],
+                              "chartSettings": {
+                                "xAxis": "FirstRemediation",
+                                "yAxis": [
+                                  "P99 (min)",
+                                  "P90 (min)",
+                                  "P80 (min)",
+                                  "Avg (min)"
+                                ],
+                                "showLegend": true
+                              }
+                            },
+                            "customWidth": "100",
+                            "name": "soc - air-latency area",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "900383f1-6443-4d50-b15d-26e4ac11b255"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Automated Investigation and Response (AIR) Investigation Results Trend\r\n\r\nThis visual displays the per-{Granularity} trend of AIR investigation outcomes, categorized as **Threat Detected** or **Clean**. It helps track the effectiveness of automated investigations over time and highlights patterns in threat detection."
+                            },
+                            "customWidth": "67",
+                            "name": "soc - air-outcomes heading",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "d1cabfbe-6040-4b6e-9ce5-f48e9973dfc9"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "### Investigation Actions Taken: Automated Investigation and Response (AIR) vs Manual (Human)\r\n\r\nThis visual shows whether actions taken after an Automated Investigation and Response (AIR) required manual approval by an administrator or were executed automatically. It provides insight into the level of automation versus human intervention in post-investigation remediation."
+                            },
+                            "customWidth": "33",
+                            "name": "soc - air-auto-vs-manual heading",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "2f98514b-0172-4c4e-ba25-9a5e4138c570"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "// AIR investigation outcomes by day: ThreatDetected vs. Clean\r\n\r\n// Step 1: Deduplicate automated remediation events by message and recipient\r\nlet AutoRemediations = \r\n    EmailPostDeliveryEvents\r\n    | where ActionType == \"Automated Remediation\"\r\n    | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\r\n    | project NetworkMessageId, RecipientEmailAddress, Timestamp;\r\n\r\n// Step 2: Derive threat verdicts using AlertEvidence\r\nlet EvidenceVerdicts =\r\n    AlertEvidence\r\n    | where EntityType in (\"MailMessage\", \"MailCluster\")\r\n    | extend extra = todynamic(AdditionalFields)\r\n    // If this is a mail cluster, use provided NetworkMessageIds array; otherwise wrap NetworkMessageId as a single-item array\r\n    | extend networkIds = iff(\r\n      isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\r\n      pack_array(NetworkMessageId),          // create a single-element array using pack_array\r\n      extra.NetworkMessageIds                // use the array as-is if it exists\r\n    )\r\n    | mv-expand nmID = networkIds                // expand to individual message IDs\r\n    // Derive verdict from LastVerdict, ThreatAnalysisSummary, and ThreatIntelligence\r\n    | extend \r\n        lastVerdict = tolower(tostring(extra.LastVerdict)),\r\n        threatAIList = extra.ThreatAnalysisSummary,\r\n        threatInt   = extra.ThreatIntelligence\r\n    | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \"\"),\r\n             verdictTI          = iff(array_length(threatInt) > 0, \"malicious\", \"\")   // any item in ThreatIntelligence indicates malicious\r\n    // Mark as threat-detected if verdict is malicious/suspicious or threat evidence is present\r\n    | extend ThreatDetectedFlag = \r\n        case(\r\n            lastVerdict in (\"malicious\",\"suspicious\") or verdictFromAnalysis in (\"malicious\",\"suspicious\")\r\n                or verdictTI == \"malicious\",\r\n            true,\r\n            false\r\n        )\r\n    // Weight mail clusters by MailCount; default to 1 for single messages\r\n    | extend MailCountInt = toint(extra.MailCount)\r\n    | extend Weight = iff(EntityType == \"MailCluster\", \r\n                        coalesce(MailCountInt, 1), // default to 1 if MailCount is missing\r\n                        1)\r\n    | summarize IsThreatDetected = any(ThreatDetectedFlag), \r\n                WeightSum       = sum(Weight) \r\n    by nmID = tostring(nmID);\r\n\r\n// Step 3: Join remediation events with verdicts and aggregate by day\r\nAutoRemediations\r\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\r\n| extend isThreat      = coalesce(IsThreatDetected, false), \r\n         effectiveWeight= coalesce(WeightSum, 1)\r\n| extend InvestigationOutcome = iif(isThreat, \"Threat Detected\", \"Clean\")\r\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, {Granularity}), InvestigationOutcome\r\n| order by Day asc, InvestigationOutcome asc",
+                              "size": 0,
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "linechart"
+                            },
+                            "customWidth": "67",
+                            "name": "soc - air-outcomes trend",
+                            "styleSettings": {
+                              "margin": "10px"
+                            },
+                            "id": "18552ccb-d8d4-45c4-a3cf-072203df9325"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger",
+                              "size": 3,
+                              "showAnalytics": true,
+                              "queryType": "advancedHunting",
+                              "visualization": "piechart"
+                            },
+                            "customWidth": "33",
+                            "name": "soc - air-auto-vs-manual pie",
+                            "styleSettings": {
+                              "margin": "10px",
+                              "padding": "10px"
+                            },
+                            "id": "03bc6e3c-05de-426d-91d8-b48a36b4ea74"
+                          },
+                          {
+                            "type": 12,
+                            "content": {
+                              "version": "NotebookGroup/1.0",
+                              "groupType": "editable",
+                              "items": [
+                                {
+                                  "type": 1,
+                                  "content": {
+                                    "json": "### Post-Delivery Actions by Admin\r\n\r\nThis visual displays the number (per {Granularity}) of emails where an administrator performed a post-delivery action. Actions are summarized by type, including **Soft Delete**, **Hard Delete**, **Moved to Junk Folder**, **Moved to Inbox**, and **Quarantine Release**, providing insight into manual intervention trends after email delivery."
+                                  },
+                                  "name": "soc - post-delivery-by-admin heading",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "a0961ca9-da58-49c4-9a1c-873c5569bed9"
+                                },
+                                {
+                                  "type": 3,
+                                  "content": {
+                                    "version": "KqlItem/1.0",
+                                    "query": "//This query visualises the daily ammount of emails that had an admin post delivery action, summarizing the data by action type\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\"\r\n| summarize [\"Soft Delete\"]=countif(Action has 'Soft Delete'), [\"Hard Delete\"]=countif(Action has 'Hard Delete'), [\"Moved to junk folder\"]=countif(Action has 'Moved to junk folder'), [\"Moved to inbox\"]=countif(Action has 'Moved to inbox'), [\"Quarantine release\"]=countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Soft Delete\"]=coalesce([\"Soft Delete\"],0), [\"Hard Delete\"]=coalesce([\"Hard Delete\"],0), [\"Moved to junk folder\"]=coalesce([\"Moved to junk folder\"],0), [\"Moved to inbox\"]=coalesce([\"Moved to inbox\"],0), [\"Quarantine release\"]=coalesce([\"Quarantine release\"],0)\r\n| sort by Timestamp asc",
+                                    "size": 0,
+                                    "showAnalytics": true,
+                                    "timeContextFromParameter": "TimeRange",
+                                    "queryType": "advancedHunting",
+                                    "visualization": "linechart"
+                                  },
+                                  "name": "soc - post-delivery-by-admin trend",
+                                  "styleSettings": {
+                                    "margin": "10px"
+                                  },
+                                  "id": "d2ea8eac-a3db-46b0-bcb4-3abbb95ba4ad"
+                                }
+                              ]
+                            },
+                            "customWidth": "100",
+                            "name": "soc - post-delivery group",
+                            "id": "ebca14d5-954d-4e35-a225-cb0f8a3ea81b"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "13"
+                      },
+                      "name": "soc - air group",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "0a05394d-f813-4408-ac4d-8f481ae34c0b"
+                    },
+                    {
+                      "type": 12,
+                      "content": {
+                        "version": "NotebookGroup/1.0",
+                        "groupType": "editable",
+                        "items": [
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Malicious Email Campaigns (Clustered)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Groups malicious inbound emails into campaigns (attack waves) using the Email Cluster ID assigned by Microsoft Defender for Office 365, showing one row per campaign with the message count, distinct recipients, sender domains, threat mix and sample subjects. Helps the SOC understand the scale and shape of coordinated attacks rather than viewing individual messages in isolation.**<br><br>**Recommended action:** Pivot on the top campaign clusters to hunt related messages and consider blocking shared sender infrastructure."
+                            },
+                            "name": "soc - campaigns heading",
+                            "id": "d3a9e4c6-1b5f-4c8d-ae34-9f7a1b2c3d45"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Largest malicious inbound email campaigns clustered by EmailClusterId - one row per attack wave (messages, recipients, URL clicks, sender domains, threat mix, sample subjects).\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n            Recipients = dcount(RecipientEmailAddress),\r\n            SenderDomains = dcount(SenderFromDomain),\r\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n            SampleSubjects = make_set(Subject, 5),\r\n            FirstSeen = min(Timestamp),\r\n            LastSeen = max(Timestamp)\r\n        by EmailClusterId\r\n| join kind=leftouter (clicksByCluster) on EmailClusterId\r\n| extend UrlClicks = coalesce(UrlClicks, 0)\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by Messages\r\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['URL Clicks']=UrlClicks, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 0,
+                              "title": "",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Recipients",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "URL Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "soc - campaigns table",
+                            "id": "a2a391e1-0e26-4e0e-a8d3-26e3c7132079"
+                          },
+                          {
+                            "type": 1,
+                            "content": {
+                              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Most-Clicked Email Campaigns (Recipient Engagement)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Ranks malicious inbound campaigns by recipient URL clicks, surfacing the attack waves that reached a mailbox and drew engagement regardless of raw message volume. The highest-volume campaigns are usually quarantined before delivery, so the clusters that draw clicks are often smaller, targeted waves. A non-zero URL Clicks count means a recipient opened a URL within the campaign's messages. Because attackers often mix legitimate URLs with malicious ones to build credibility, and a per-URL threat verdict is not available here, treat these as clicks on potentially malicious URLs that warrant review rather than confirmed malicious clicks.**<br><br>**Recommended action:** Focus on these clusters for user follow-up (awareness and, where credentials may be exposed, password reset) and hunt for related messages sharing sender infrastructure."
+                            },
+                            "name": "soc - mostclicked heading",
+                            "id": "e9e41b47-0434-42e5-8b04-4170ab061b81"
+                          },
+                          {
+                            "type": 3,
+                            "content": {
+                              "version": "KqlItem/1.0",
+                              "query": "//Malicious inbound campaigns ranked by recipient URL clicks - the attack waves that reached a mailbox and drew engagement, regardless of message volume.\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n            Recipients = dcount(RecipientEmailAddress),\r\n            SenderDomains = dcount(SenderFromDomain),\r\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n            SampleSubjects = make_set(Subject, 5),\r\n            FirstSeen = min(Timestamp),\r\n            LastSeen = max(Timestamp)\r\n        by EmailClusterId\r\n| join kind=inner (clicksByCluster) on EmailClusterId\r\n| where UrlClicks > 0\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by UrlClicks\r\n| project ['Email Cluster ID']=EmailClusterId, ['URL Clicks']=UrlClicks, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+                              "size": 0,
+                              "title": "",
+                              "timeContextFromParameter": "TimeRange",
+                              "queryType": "advancedHunting",
+                              "visualization": "table",
+                              "gridSettings": {
+                                "filter": true,
+                                "formatters": [
+                                  {
+                                    "columnMatch": "URL Clicks",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "redDark",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Messages",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  {
+                                    "columnMatch": "Recipients",
+                                    "formatter": 3,
+                                    "formatOptions": {
+                                      "palette": "blue",
+                                      "customColumnWidthSetting": "130px"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            },
+                            "name": "soc - mostclicked table",
+                            "id": "1ffe8f97-ad79-47d9-9598-dd73ee54cd8d"
+                          }
+                        ]
+                      },
+                      "conditionalVisibility": {
+                        "parameterName": "Tab",
+                        "comparison": "isEqualTo",
+                        "value": "13"
+                      },
+                      "name": "soc - campaigns group",
+                      "styleSettings": {
+                        "margin": "10px",
+                        "padding": "10px",
+                        "showBorder": true
+                      },
+                      "id": "b8f2a1c4-5d6e-4a7b-9c8d-0e1f2a3b4c5d"
+                    }
+                  ],
+                  "isLocked": true,
+                  "fromTemplateId": "sentinel-MicrosoftDefenderForOffice365detectionsandinsights",
+                  "contentProvenance": {
+                    "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+                    "packageVersion": "3.2.1",
+                    "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c",
+                    "contentVersion": "3.2.1"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "packageKind": "Solution",
+        "packageVersion": "3.2.1",
+        "packageName": "Microsoft Defender XDR",
+        "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c",
+        "contentKind": "DefenderWorkbook",
+        "displayName": "MicrosoftDefenderForOffice365detectionsandinsights",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','e39952df-ba60-50cf-80f6-76f7a2ebf57c','-','3.2.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','e39952df-ba60-50cf-80f6-76f7a2ebf57c','-','3.2.1')))]",
+        "version": "3.2.1",
+        "contentProvenance": {
+          "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender",
+          "packageVersion": "3.2.1",
+          "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c",
+          "contentVersion": "3.2.1",
+          "requiredWorkloads": [
+            {
+              "workload": "mdo",
+              "dataTypes": [
+                "EmailEvents",
+                "EmailPostDeliveryEvents",
+                "EmailUrlInfo",
+                "UrlClickEvents",
+                "MessageEvents",
+                "MessageUrlInfo",
+                "MessagePostDeliveryEvents",
+                "FileMaliciousContentInfo"
+              ]
             },
             {
-              "kind": "HuntingQuery",
-              "contentId": "[variables('huntingQueryObject387')._huntingQuerycontentId387]",
-              "version": "[variables('huntingQueryObject387').huntingQueryVersion387]"
+              "workload": "mda",
+              "dataTypes": [
+                "CloudAppEvents"
+              ]
             },
             {
-              "kind": "Workbook",
-              "contentId": "[variables('_workbookContentId1')]",
-              "version": "[variables('workbookVersion1')]"
+              "workload": "mtp",
+              "dataTypes": [
+                "AlertEvidence"
+              ]
             },
             {
-              "kind": "Workbook",
-              "contentId": "[variables('_workbookContentId2')]",
-              "version": "[variables('workbookVersion2')]"
-            },
+              "workload": "sentinel",
+              "dataTypes": [
+                "SecurityAlert"
+              ]
+            }
+          ],
+          "requiredDataConnectors": [
             {
-              "kind": "Workbook",
-              "contentId": "[variables('_workbookContentId3')]",
-              "version": "[variables('workbookVersion3')]"
+              "connectorId": "MicrosoftThreatProtection",
+              "dataTypes": [
+                "SecurityAlert"
+              ]
             }
-          ]
-        },
-        "firstPublishDate": "2022-05-02",
-        "providers": [
-          "Microsoft"
-        ],
-        "categories": {
-          "domains": [
-            "Security - Threat Protection"
-          ]
+          ],
+          "requiredWorkspaceFunctions": []
         }
       },
-      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+      "condition": "[parameters('DeployDefenderWorkbook')]"
     }
   ],
   "outputs": {}
diff --git a/Solutions/Microsoft Defender XDR/Package/testParameters.json b/Solutions/Microsoft Defender XDR/Package/testParameters.json
index 3f2e24cc00f..5914695ae20 100644
--- a/Solutions/Microsoft Defender XDR/Package/testParameters.json	
+++ b/Solutions/Microsoft Defender XDR/Package/testParameters.json	
@@ -21,28 +21,18 @@
       "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
     }
   },
-  "workbook1-name": {
-    "type": "string",
-    "defaultValue": "Microsoft Defender for Office 365 Detections and Insights",
-    "minLength": 1,
+  "DeployDefenderWorkbook": {
+    "type": "bool",
+    "defaultValue": false,
     "metadata": {
-      "description": "Name for the workbook"
+      "description": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification."
     }
   },
-  "workbook2-name": {
-    "type": "string",
-    "defaultValue": "Microsoft Defender For EndPoint",
-    "minLength": 1,
-    "metadata": {
-      "description": "Name for the workbook"
-    }
-  },
-  "workbook3-name": {
-    "type": "string",
-    "defaultValue": "Microsoft Defender For Identity",
-    "minLength": 1,
+  "DeployDataConnector": {
+    "type": "bool",
+    "defaultValue": true,
     "metadata": {
-      "description": "Name for the workbook"
+      "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
     }
   }
 }
diff --git a/Solutions/Microsoft Defender XDR/SolutionMetadata.json b/Solutions/Microsoft Defender XDR/SolutionMetadata.json
index 9922475c50c..97645c1ef11 100644
--- a/Solutions/Microsoft Defender XDR/SolutionMetadata.json	
+++ b/Solutions/Microsoft Defender XDR/SolutionMetadata.json	
@@ -1,20 +1,21 @@
 {
-	"publisherId": "azuresentinel",
-	"offerId": "azure-sentinel-solution-microsoft365defender",
-	"firstPublishDate": "2022-05-02",
-	"providers": ["Microsoft"],
-	"categories": {
-		"domains" : ["Security - Threat Protection"],
-		"verticals": []
-	},
-	"support": {
-	  "name": "Microsoft Corporation",
-	  "email": "support@microsoft.com",
-	  "tier": "Microsoft",
-	  "link": "https://support.microsoft.com"
-	}
+  "publisherId": "azuresentinel",
+  "offerId": "azure-sentinel-solution-microsoft365defender",
+  "firstPublishDate": "2022-05-02",
+  "providers": [
+    "Microsoft"
+  ],
+  "categories": {
+    "domains": [
+      "Security - Threat Protection"
+    ],
+    "verticals": []
+  },
+  "support": {
+    "name": "Microsoft Corporation",
+    "email": "support@microsoft.com",
+    "tier": "Microsoft",
+    "link": "https://support.microsoft.com"
+  },
+  "version": "3.2.1"
 }
-
-
-
-
diff --git a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForEndPoint.json b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForEndPoint.json
new file mode 100644
index 00000000000..2a99e786b21
--- /dev/null
+++ b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForEndPoint.json	
@@ -0,0 +1,3889 @@
+{
+  "version": "Notebook/1.0",
+  "items": [
+    {
+      "type": 1,
+      "content": {
+        "json": "## Microsoft Defender for Endpoint (Preview)\n---\n\nA workbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through Microsoft Defender XDR Connector.\n\n\n"
+      },
+      "name": "text - 2"
+    },
+    {
+      "type": 9,
+      "content": {
+        "version": "KqlParameterItem/1.0",
+        "parameters": [
+          {
+            "id": "b22a3bd7-19b3-495d-a0df-95a7a59d98ff",
+            "version": "KqlParameterItem/1.0",
+            "name": "TimeRange",
+            "type": 4,
+            "value": {
+              "durationMs": 172800000
+            },
+            "typeSettings": {
+              "selectableValues": [
+                {
+                  "durationMs": 300000
+                },
+                {
+                  "durationMs": 900000
+                },
+                {
+                  "durationMs": 1800000
+                },
+                {
+                  "durationMs": 3600000
+                },
+                {
+                  "durationMs": 14400000
+                },
+                {
+                  "durationMs": 43200000
+                },
+                {
+                  "durationMs": 86400000
+                },
+                {
+                  "durationMs": 172800000
+                },
+                {
+                  "durationMs": 259200000
+                },
+                {
+                  "durationMs": 604800000
+                },
+                {
+                  "durationMs": 1209600000
+                },
+                {
+                  "durationMs": 2419200000
+                },
+                {
+                  "durationMs": 2592000000
+                },
+                {
+                  "durationMs": 5184000000
+                },
+                {
+                  "durationMs": 7776000000
+                }
+              ],
+              "allowCustom": true
+            },
+            "timeContext": {
+              "durationMs": 86400000
+            }
+          },
+          {
+            "id": "f0450560-ef16-4aa9-a3ad-7485dd909587",
+            "version": "KqlParameterItem/1.0",
+            "name": "Help",
+            "type": 10,
+            "isRequired": true,
+            "typeSettings": {
+              "additionalResourceOptions": []
+            },
+            "jsonData": "[{ \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }]",
+            "label": "Show Help",
+            "value": "Yes"
+          }
+        ],
+        "style": "pills"
+      },
+      "name": "parameters - 2"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "\r\n|Overview|Device|Network|File|\r\n|--------|------|-------|----|\r\n|MDE Tables Last Data Received|Source of the AV detections|Internet Connected Devices|FileActivityCount per Device|\r\n|Daily Data Flow on MDE Tables|Get stats on ASR audit events|Count By Machine Group|Count by InitiatingProcessAccountUpn|\r\n|Device Heartbeat|Get stats on ASR blocks|Count By Network Adaptor||\r\n|Device where files are copied to USB Drive|AV Detections with USB Disk Drive|TimeSeries on Network Activity||\r\n|Device Internet Connectivity Status |List files copied to USB mounted drives|Top 10 RemoteUrl accessed over TimeRange||\r\n|Device Count by DNS Suffix ||Tor Clients||\r\n|Device Microsoft Entra ID Join status ||||\r\n|Device ClientVersion ||||"
+      },
+      "conditionalVisibility": {
+        "parameterName": "Help",
+        "comparison": "isEqualTo",
+        "value": "Yes"
+      },
+      "name": "text - 8"
+    },
+    {
+      "type": 11,
+      "content": {
+        "version": "LinkItem/1.0",
+        "style": "tabs",
+        "links": [
+          {
+            "id": "454d4e02-26ba-4195-ae30-94752bbf4603",
+            "cellValue": "selectedTab",
+            "linkTarget": "parameter",
+            "linkLabel": "Overview",
+            "subTarget": "Overview",
+            "preText": "Overview",
+            "style": "link"
+          },
+          {
+            "id": "3d902e84-3e5b-4631-85d1-c229ec2abf75",
+            "cellValue": "selectedTab",
+            "linkTarget": "parameter",
+            "linkLabel": "Device",
+            "subTarget": "Device",
+            "style": "link"
+          },
+          {
+            "id": "bbc20288-b398-4f63-b7a9-e3830213bb34",
+            "cellValue": "selectedTab",
+            "linkTarget": "parameter",
+            "linkLabel": "Network",
+            "subTarget": "Network",
+            "style": "link"
+          },
+          {
+            "id": "edab4a44-8ca3-4ba1-bede-4186f4376d28",
+            "cellValue": "selectedTab",
+            "linkTarget": "parameter",
+            "linkLabel": "File",
+            "subTarget": "File",
+            "style": "link"
+          }
+        ]
+      },
+      "name": "links - 3"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "union \r\nisfuzzy = true\r\n(DeviceInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type= \"DeviceInfo\" | extend Description = \"Machine information (including OS information)\"),\r\n(DeviceNetworkInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkInfo\"  | extend Description = \"Network properties of machines\"),\r\n(DeviceProcessEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceProcessEvents\" | extend Description = \"Process creation and related events\"),\r\n(DeviceNetworkEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkEvents\" | extend Description = \"Network connection and related events\"),\r\n(DeviceFileEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileEvents\" | extend Description = \"File creation, modification, and other file system events\"),\r\n(DeviceRegistryEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceRegistryEvents\" | extend Description = \"Creation and modification of registry entries\"),\r\n(DeviceLogonEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceLogonEvents\" | extend Description = \"Sign-ins and other authentication events\"),\r\n(DeviceImageLoadEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceImageLoadEvents\" | extend Description = \"DLL loading events\"),\r\n(DeviceEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceEvents\" | extend Description = \"Additional events types\"),\r\n(DeviceFileCertificateInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileCertificateInfo\" | extend Description = \"Certificate information of signed files)\")\r\n| extend [\"Last Log Received At (Local Time)\"] = TimeGenerated\r\n| project Type, Description, [\"Last Log Received At (Local Time)\"]",
+              "size": 0,
+              "title": "MDE Tables Last Data Received based on {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Type",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 0,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Last Log Received At",
+                    "formatter": 6,
+                    "dateFormat": {
+                      "showUtcTime": null,
+                      "formatName": "fullDateTimePattern"
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "name": "query - 9"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1",
+              "size": 1,
+              "title": "Daily Data Flow on MDE Tables over {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "timechart",
+              "chartSettings": {
+                "xAxis": "count_"
+              }
+            },
+            "name": "query - 2"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceInfo \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| extend ParsedFields=parse_json(LoggedOnUsers)[0]\r\n| extend DurationAtLeast= format_timespan(now()-TimeGenerated,'dd:hh:mm:ss')\r\n| project DurationAtLeast,TimeGenerated,DeviceName,DomainName=ParsedFields.DomainName,UserName=ParsedFields.UserName\r\n| order by DurationAtLeast asc",
+              "size": 0,
+              "title": "Device Heartbeat from TimeTange {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc\r\n| summarize FileCount = count() by DeviceName\r\n| order by FileCount desc",
+              "size": 1,
+              "title": "Device where files are copied to USB Drive from TimeTange {TimeRange}",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FileCount",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "red"
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 0 - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)",
+              "size": 1,
+              "title": "Device Internet Connectivity Status from TimeTange {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FileCount",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "red"
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 0 - Copy - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain",
+              "size": 1,
+              "title": "Device Count by DNS Suffix",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "gridSettings": {
+                "filter": true
+              },
+              "chartSettings": {
+                "showMetrics": false,
+                "showLegend": true
+              }
+            },
+            "customWidth": "30",
+            "name": "query - 0 - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by tostring(IsAzureADJoined)",
+              "size": 1,
+              "title": "Device EntraID Join status",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "gridSettings": {
+                "filter": true
+              },
+              "chartSettings": {
+                "showMetrics": false,
+                "showLegend": true
+              }
+            },
+            "customWidth": "30",
+            "name": "query - 0 - Copy - Copy - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by ClientVersion",
+              "size": 1,
+              "title": "Device ClientVersion",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "gridSettings": {
+                "filter": true
+              },
+              "chartSettings": {
+                "showMetrics": false,
+                "showLegend": true
+              }
+            },
+            "customWidth": "30",
+            "name": "query - 0 - Copy - Copy - Copy - Copy"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selectedTab",
+        "comparison": "isEqualTo",
+        "value": "Overview"
+      },
+      "name": "groupOverview"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\r\n//\r\n//Get the list of AV detections\r\nlet avDetections =\r\nDeviceEvents\r\n| where ActionType == \"AntivirusDetection\" and isnotempty(MD5)\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\r\n//Get a list of file creations\r\nlet fileCreations =\r\nDeviceFileEvents \r\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\r\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\r\n//Join the file creations and AV detections on the MD5 of the file\r\navDetections | join kind=inner (fileCreations) on MD5\r\n| project-away MD51 //Remove the duplicated MD5 field\r\n| sort by Timestamp desc ",
+              "size": 0,
+              "title": "Source of the AV detections for {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Audited\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType",
+              "size": 0,
+              "title": "Get stats on ASR audit events - count events and machines per rule for {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting"
+            },
+            "name": "query - 1"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Blocked\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType",
+              "size": 0,
+              "title": "Get stats on ASR blocks - count events and machines per rule for {TimeRange}",
+              "queryType": "advancedHunting"
+            },
+            "name": "query - 1 - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query make a best-guess detection regarding which removable media device caused an AV detection\r\n//The query is best run over 30 days to get the full USB history\r\n//\r\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\r\nlet usbDetections =\r\n    DeviceEvents\r\n    | where ActionType == \"AntivirusDetection\" and FolderPath !startswith \"c\" and FolderPath matches regex \"^[A-Za-z]{1}\"\r\n    | extend ParsedFields=parse_json(AdditionalFields)\r\n    | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\r\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\r\nlet usbConnections = \r\n    DeviceEvents\r\n    | where ActionType == \"PnpDeviceConnected\"\r\n    | extend parsed=parse_json(AdditionalFields)\r\n    | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\r\n    | where ClassName == \"DiskDrive\"\r\n    | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\r\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\r\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\r\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\r\n| sort by DetectionTime desc",
+              "size": 0,
+              "title": "AV Detections with USB Disk Drive for {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting"
+            },
+            "name": "query - 3"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc",
+              "size": 0,
+              "title": "List files copied to USB mounted drives for {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting"
+            },
+            "name": "query - 4"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selectedTab",
+        "comparison": "isEqualTo",
+        "value": "Device"
+      },
+      "name": "groupDevice"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mv-apply ConnectedNetworks on \r\n(\r\nwhere ConnectedNetworks.IsConnectedToInternet == true\r\n)\r\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet",
+              "size": 0,
+              "title": "Internet Connected Devices for {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting"
+            },
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by MachineGroup",
+              "size": 0,
+              "title": "Count By Machine Group for {TimeRange}",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "name": "query - 0 - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus",
+              "size": 0,
+              "title": "Count By Network Adaptor",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "name": "query - 0 - Copy - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceNetworkEvents\r\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)",
+              "size": 0,
+              "title": "TimeSeries on Network Activity for {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "timechart"
+            },
+            "name": "query - 0 - Copy - Copy - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceNetworkEvents\r\n| where isnotempty(RemoteUrl)\r\n| summarize count() by RemoteUrl\r\n| order by count_ desc\r\n| limit 10",
+              "size": 0,
+              "title": "Top 10 RemoteUrl accessed over TimeRange {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "categoricalbar"
+            },
+            "name": "query - 0 - Copy - Copy - Copy - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents  \r\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc",
+              "size": 0,
+              "title": "Tor Clients for {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting"
+            },
+            "name": "query - 5"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selectedTab",
+        "comparison": "isEqualTo",
+        "value": "Network"
+      },
+      "name": "groupNetwork"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceFileEvents\r\n| summarize FileActivityCount = count() by DeviceName",
+              "size": 0,
+              "title": "FileActivityCount per Device for {TimeRange}",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "unstackedbar"
+            },
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn",
+              "size": 0,
+              "title": "Count by InitiatingProcessAccountUpn for {TimeRange}",
+              "queryType": "advancedHunting",
+              "visualization": "unstackedbar"
+            },
+            "name": "query - 0 - Copy"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "selectedTab",
+        "comparison": "isEqualTo",
+        "value": "File"
+      },
+      "name": "groupFile"
+    }
+  ],
+  "fromTemplateId": "sentinel-MicrosoftDefenderForEndPoint",
+  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
+  "xdrMetadata": {
+    "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215",
+    "instanceId": "4fffade5-9b6b-51af-a33d-97641e240595",
+    "version": "3.2.1",
+    "schemaVersion": "1.0.0",
+    "displayName": "MicrosoftDefenderForEndPoint"
+  },
+  "contentProvenance": {
+    "source": {
+      "path": "Workbooks/MicrosoftDefenderForEndPoint.json",
+      "sha256": "c78f1eb16db8df47a263a39839809e2d98feb3cfb1dc5bcdc7da5c8863aff74a",
+      "contentId": "sentinel-MicrosoftDefenderForEndPoint",
+      "originalMetadataVersion": null
+    },
+    "conversion": {
+      "tool": "sentinel-xdr-migration",
+      "version": "0.1.0",
+      "reviewRequired": false,
+      "queries": [
+        {
+          "sourcePath": "/items/4/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "cb071c1659672fa84632cfaacb3165d49765a22282541afece8c51bba08f4b54"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "union \r\nisfuzzy = true\r\n(DeviceInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type= \"DeviceInfo\" | extend Description = \"Machine information (including OS information)\"),\r\n(DeviceNetworkInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkInfo\"  | extend Description = \"Network properties of machines\"),\r\n(DeviceProcessEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceProcessEvents\" | extend Description = \"Process creation and related events\"),\r\n(DeviceNetworkEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkEvents\" | extend Description = \"Network connection and related events\"),\r\n(DeviceFileEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileEvents\" | extend Description = \"File creation, modification, and other file system events\"),\r\n(DeviceRegistryEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceRegistryEvents\" | extend Description = \"Creation and modification of registry entries\"),\r\n(DeviceLogonEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceLogonEvents\" | extend Description = \"Sign-ins and other authentication events\"),\r\n(DeviceImageLoadEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceImageLoadEvents\" | extend Description = \"DLL loading events\"),\r\n(DeviceEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceEvents\" | extend Description = \"Additional events types\"),\r\n(DeviceFileCertificateInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileCertificateInfo\" | extend Description = \"Certificate information of signed files)\")\r\n| extend [\"Last Log Received At (Local Time)\"] = TimeGenerated\r\n| project Type, Description, [\"Last Log Received At (Local Time)\"]",
+            "resolvedTables": [
+              "DeviceEvents",
+              "DeviceFileCertificateInfo",
+              "DeviceFileEvents",
+              "DeviceImageLoadEvents",
+              "DeviceInfo",
+              "DeviceLogonEvents",
+              "DeviceNetworkEvents",
+              "DeviceNetworkInfo",
+              "DeviceProcessEvents",
+              "DeviceRegistryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceEvents",
+                "ahTable": "DeviceEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 67,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceFileCertificateInfo",
+                "ahTable": "DeviceFileCertificateInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 20,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceFileEvents",
+                "ahTable": "DeviceFileEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 60,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceImageLoadEvents",
+                "ahTable": "DeviceImageLoadEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 44,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceInfo",
+                "ahTable": "DeviceInfo",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AadDeviceId",
+                    "ah": "AadDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AssetValue",
+                    "ah": "AssetValue",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AwsResourceName",
+                    "ah": "AwsResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureResourceId",
+                    "ah": "AzureResourceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmId",
+                    "ah": "AzureVmId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmSubscriptionId",
+                    "ah": "AzureVmSubscriptionId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ClientVersion",
+                    "ah": "ClientVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "CloudPlatforms",
+                    "ah": "CloudPlatforms",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceCategory",
+                    "ah": "DeviceCategory",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceDynamicTags",
+                    "ah": "DeviceDynamicTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceId",
+                    "ah": "DeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceManualTags",
+                    "ah": "DeviceManualTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceObjectId",
+                    "laType": "string",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "DeviceSubtype",
+                    "ah": "DeviceSubtype",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExclusionReason",
+                    "ah": "ExclusionReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExposureLevel",
+                    "ah": "ExposureLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "GcpFullResourceName",
+                    "ah": "GcpFullResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HardwareUuid",
+                    "ah": "HardwareUuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HostDeviceId",
+                    "ah": "HostDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsAzureADJoined",
+                    "ah": "IsAzureADJoined",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsExcluded",
+                    "ah": "IsExcluded",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsInternetFacing",
+                    "ah": "IsInternetFacing",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsTransient",
+                    "ah": "IsTransient",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "JoinType",
+                    "ah": "JoinType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LoggedOnUsers",
+                    "ah": "LoggedOnUsers",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "MachineGroup",
+                    "ah": "MachineGroup",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedDeviceIds",
+                    "ah": "MergedDeviceIds",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedToDeviceId",
+                    "ah": "MergedToDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MitigationStatus",
+                    "ah": "MitigationStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Model",
+                    "ah": "Model",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSArchitecture",
+                    "ah": "OSArchitecture",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSBuild",
+                    "ah": "OSBuild",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSDistribution",
+                    "ah": "OSDistribution",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersion",
+                    "ah": "OSVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersionInfo",
+                    "ah": "OSVersionInfo",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OnboardingStatus",
+                    "ah": "OnboardingStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OsBuildRevision",
+                    "ah": "OsBuildRevision",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "PublicIP",
+                    "ah": "PublicIP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RegistryDeviceTag",
+                    "ah": "RegistryDeviceTag",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RestrictedDeviceSecurityOperations",
+                    "ah": "RestrictedDeviceSecurityOperations",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SensorHealthState",
+                    "ah": "SensorHealthState",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Vendor",
+                    "ah": "Vendor",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": [
+                  "ConnectivityType",
+                  "DiscoverySources",
+                  "DlpInfo",
+                  "FirmwareVersions",
+                  "Site"
+                ]
+              },
+              {
+                "sentinelTable": "DeviceLogonEvents",
+                "ahTable": "DeviceLogonEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 51,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceNetworkEvents",
+                "ahTable": "DeviceNetworkEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 47,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceNetworkInfo",
+                "ahTable": "DeviceNetworkInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 18,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceProcessEvents",
+                "ahTable": "DeviceProcessEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 70,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceRegistryEvents",
+                "ahTable": "DeviceRegistryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 45,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/0/content/query",
+          "sourceSha256": "cb071c1659672fa84632cfaacb3165d49765a22282541afece8c51bba08f4b54",
+          "targetSha256": "cb071c1659672fa84632cfaacb3165d49765a22282541afece8c51bba08f4b54"
+        },
+        {
+          "sourcePath": "/items/4/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "eca4ca05cd64deeb3cc30440c5025651b0634c6772a2f25dfc040a66dbdb0c59"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1",
+            "resolvedTables": [
+              "DeviceEvents",
+              "DeviceInfo",
+              "DeviceLogonEvents",
+              "DeviceNetworkEvents",
+              "DeviceNetworkInfo",
+              "DeviceProcessEvents",
+              "DeviceRegistryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [
+              {
+                "kind": "synthesize-type-column",
+                "before": "Type",
+                "after": "Type = \"DeviceEvents\"",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "Preserve a direct table summarize grouping with its native table label"
+              },
+              {
+                "kind": "synthesize-type-column",
+                "before": "Type",
+                "after": "Type = \"DeviceNetworkEvents\"",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "Preserve a direct table summarize grouping with its native table label"
+              },
+              {
+                "kind": "synthesize-type-column",
+                "before": "Type",
+                "after": "Type = \"DeviceNetworkInfo\"",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "Preserve a direct table summarize grouping with its native table label"
+              },
+              {
+                "kind": "synthesize-type-column",
+                "before": "Type",
+                "after": "Type = \"DeviceLogonEvents\"",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "Preserve a direct table summarize grouping with its native table label"
+              },
+              {
+                "kind": "synthesize-type-column",
+                "before": "Type",
+                "after": "Type = \"DeviceRegistryEvents\"",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "Preserve a direct table summarize grouping with its native table label"
+              },
+              {
+                "kind": "synthesize-type-column",
+                "before": "Type",
+                "after": "Type = \"DeviceProcessEvents\"",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "Preserve a direct table summarize grouping with its native table label"
+              }
+            ],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceEvents",
+                "ahTable": "DeviceEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 67,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceInfo",
+                "ahTable": "DeviceInfo",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AadDeviceId",
+                    "ah": "AadDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AssetValue",
+                    "ah": "AssetValue",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AwsResourceName",
+                    "ah": "AwsResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureResourceId",
+                    "ah": "AzureResourceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmId",
+                    "ah": "AzureVmId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmSubscriptionId",
+                    "ah": "AzureVmSubscriptionId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ClientVersion",
+                    "ah": "ClientVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "CloudPlatforms",
+                    "ah": "CloudPlatforms",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceCategory",
+                    "ah": "DeviceCategory",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceDynamicTags",
+                    "ah": "DeviceDynamicTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceId",
+                    "ah": "DeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceManualTags",
+                    "ah": "DeviceManualTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceObjectId",
+                    "laType": "string",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "DeviceSubtype",
+                    "ah": "DeviceSubtype",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExclusionReason",
+                    "ah": "ExclusionReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExposureLevel",
+                    "ah": "ExposureLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "GcpFullResourceName",
+                    "ah": "GcpFullResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HardwareUuid",
+                    "ah": "HardwareUuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HostDeviceId",
+                    "ah": "HostDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsAzureADJoined",
+                    "ah": "IsAzureADJoined",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsExcluded",
+                    "ah": "IsExcluded",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsInternetFacing",
+                    "ah": "IsInternetFacing",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsTransient",
+                    "ah": "IsTransient",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "JoinType",
+                    "ah": "JoinType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LoggedOnUsers",
+                    "ah": "LoggedOnUsers",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "MachineGroup",
+                    "ah": "MachineGroup",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedDeviceIds",
+                    "ah": "MergedDeviceIds",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedToDeviceId",
+                    "ah": "MergedToDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MitigationStatus",
+                    "ah": "MitigationStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Model",
+                    "ah": "Model",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSArchitecture",
+                    "ah": "OSArchitecture",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSBuild",
+                    "ah": "OSBuild",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSDistribution",
+                    "ah": "OSDistribution",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersion",
+                    "ah": "OSVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersionInfo",
+                    "ah": "OSVersionInfo",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OnboardingStatus",
+                    "ah": "OnboardingStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OsBuildRevision",
+                    "ah": "OsBuildRevision",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "PublicIP",
+                    "ah": "PublicIP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RegistryDeviceTag",
+                    "ah": "RegistryDeviceTag",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RestrictedDeviceSecurityOperations",
+                    "ah": "RestrictedDeviceSecurityOperations",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SensorHealthState",
+                    "ah": "SensorHealthState",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Vendor",
+                    "ah": "Vendor",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": [
+                  "ConnectivityType",
+                  "DiscoverySources",
+                  "DlpInfo",
+                  "FirmwareVersions",
+                  "Site"
+                ]
+              },
+              {
+                "sentinelTable": "DeviceLogonEvents",
+                "ahTable": "DeviceLogonEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 51,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceNetworkEvents",
+                "ahTable": "DeviceNetworkEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 47,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceNetworkInfo",
+                "ahTable": "DeviceNetworkInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 18,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceProcessEvents",
+                "ahTable": "DeviceProcessEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 70,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceRegistryEvents",
+                "ahTable": "DeviceRegistryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 45,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/1/content/query",
+          "sourceSha256": "eca4ca05cd64deeb3cc30440c5025651b0634c6772a2f25dfc040a66dbdb0c59",
+          "targetSha256": "50094cc183cf03326fb949dc42895a44a6520bd5f4b7b6db4711c4962a66fcdc"
+        },
+        {
+          "sourcePath": "/items/4/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "dec86c7d5ffe294904662836a11ecc397064af1d9a9199ad42876901a2eab07d"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceInfo \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| extend ParsedFields=parse_json(LoggedOnUsers)[0]\r\n| extend DurationAtLeast= format_timespan(now()-TimeGenerated,'dd:hh:mm:ss')\r\n| project DurationAtLeast,TimeGenerated,DeviceName,DomainName=ParsedFields.DomainName,UserName=ParsedFields.UserName\r\n| order by DurationAtLeast asc",
+            "resolvedTables": [
+              "DeviceInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceInfo",
+                "ahTable": "DeviceInfo",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AadDeviceId",
+                    "ah": "AadDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AssetValue",
+                    "ah": "AssetValue",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AwsResourceName",
+                    "ah": "AwsResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureResourceId",
+                    "ah": "AzureResourceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmId",
+                    "ah": "AzureVmId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmSubscriptionId",
+                    "ah": "AzureVmSubscriptionId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ClientVersion",
+                    "ah": "ClientVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "CloudPlatforms",
+                    "ah": "CloudPlatforms",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceCategory",
+                    "ah": "DeviceCategory",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceDynamicTags",
+                    "ah": "DeviceDynamicTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceId",
+                    "ah": "DeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceManualTags",
+                    "ah": "DeviceManualTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceObjectId",
+                    "laType": "string",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "DeviceSubtype",
+                    "ah": "DeviceSubtype",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExclusionReason",
+                    "ah": "ExclusionReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExposureLevel",
+                    "ah": "ExposureLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "GcpFullResourceName",
+                    "ah": "GcpFullResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HardwareUuid",
+                    "ah": "HardwareUuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HostDeviceId",
+                    "ah": "HostDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsAzureADJoined",
+                    "ah": "IsAzureADJoined",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsExcluded",
+                    "ah": "IsExcluded",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsInternetFacing",
+                    "ah": "IsInternetFacing",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsTransient",
+                    "ah": "IsTransient",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "JoinType",
+                    "ah": "JoinType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LoggedOnUsers",
+                    "ah": "LoggedOnUsers",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "MachineGroup",
+                    "ah": "MachineGroup",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedDeviceIds",
+                    "ah": "MergedDeviceIds",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedToDeviceId",
+                    "ah": "MergedToDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MitigationStatus",
+                    "ah": "MitigationStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Model",
+                    "ah": "Model",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSArchitecture",
+                    "ah": "OSArchitecture",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSBuild",
+                    "ah": "OSBuild",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSDistribution",
+                    "ah": "OSDistribution",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersion",
+                    "ah": "OSVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersionInfo",
+                    "ah": "OSVersionInfo",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OnboardingStatus",
+                    "ah": "OnboardingStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OsBuildRevision",
+                    "ah": "OsBuildRevision",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "PublicIP",
+                    "ah": "PublicIP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RegistryDeviceTag",
+                    "ah": "RegistryDeviceTag",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RestrictedDeviceSecurityOperations",
+                    "ah": "RestrictedDeviceSecurityOperations",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SensorHealthState",
+                    "ah": "SensorHealthState",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Vendor",
+                    "ah": "Vendor",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": [
+                  "ConnectivityType",
+                  "DiscoverySources",
+                  "DlpInfo",
+                  "FirmwareVersions",
+                  "Site"
+                ]
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/2/content/query",
+          "sourceSha256": "dec86c7d5ffe294904662836a11ecc397064af1d9a9199ad42876901a2eab07d",
+          "targetSha256": "dec86c7d5ffe294904662836a11ecc397064af1d9a9199ad42876901a2eab07d"
+        },
+        {
+          "sourcePath": "/items/4/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "cba61d36521eb072066130d1cbab27278c9861ed65d909e2a9c502181e38a901"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc\r\n| summarize FileCount = count() by DeviceName\r\n| order by FileCount desc",
+            "resolvedTables": [
+              "DeviceEvents",
+              "DeviceFileEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceEvents",
+                "ahTable": "DeviceEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 67,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceFileEvents",
+                "ahTable": "DeviceFileEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 60,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/3/content/query",
+          "sourceSha256": "cba61d36521eb072066130d1cbab27278c9861ed65d909e2a9c502181e38a901",
+          "targetSha256": "cba61d36521eb072066130d1cbab27278c9861ed65d909e2a9c502181e38a901"
+        },
+        {
+          "sourcePath": "/items/4/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "912cfbffa687f4226ddf118e66791f628a1592a4bd7627f19ce264cbe4ccde76"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)",
+            "resolvedTables": [
+              "DeviceNetworkInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [
+              {
+                "kind": "dynamic-cast",
+                "before": "ConnectedNetworks",
+                "after": "ConnectedNetworks = todynamic(tostring(ConnectedNetworks))",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "`ConnectedNetworks` on `DeviceNetworkInfo` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)."
+              }
+            ],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceNetworkInfo",
+                "ahTable": "DeviceNetworkInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 18,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/4/content/query",
+          "sourceSha256": "912cfbffa687f4226ddf118e66791f628a1592a4bd7627f19ce264cbe4ccde76",
+          "targetSha256": "f5fe20ba4db33ddaf9c052f9645f90125dbc1374705c2d21fbe91fc9df6b1666"
+        },
+        {
+          "sourcePath": "/items/4/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "f03a1744e0f501490a81b97857c3aa74b69548ffe25982c7c77267dd005c03d1"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain",
+            "resolvedTables": [
+              "DeviceInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceInfo",
+                "ahTable": "DeviceInfo",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AadDeviceId",
+                    "ah": "AadDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AssetValue",
+                    "ah": "AssetValue",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AwsResourceName",
+                    "ah": "AwsResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureResourceId",
+                    "ah": "AzureResourceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmId",
+                    "ah": "AzureVmId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmSubscriptionId",
+                    "ah": "AzureVmSubscriptionId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ClientVersion",
+                    "ah": "ClientVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "CloudPlatforms",
+                    "ah": "CloudPlatforms",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceCategory",
+                    "ah": "DeviceCategory",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceDynamicTags",
+                    "ah": "DeviceDynamicTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceId",
+                    "ah": "DeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceManualTags",
+                    "ah": "DeviceManualTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceObjectId",
+                    "laType": "string",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "DeviceSubtype",
+                    "ah": "DeviceSubtype",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExclusionReason",
+                    "ah": "ExclusionReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExposureLevel",
+                    "ah": "ExposureLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "GcpFullResourceName",
+                    "ah": "GcpFullResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HardwareUuid",
+                    "ah": "HardwareUuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HostDeviceId",
+                    "ah": "HostDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsAzureADJoined",
+                    "ah": "IsAzureADJoined",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsExcluded",
+                    "ah": "IsExcluded",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsInternetFacing",
+                    "ah": "IsInternetFacing",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsTransient",
+                    "ah": "IsTransient",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "JoinType",
+                    "ah": "JoinType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LoggedOnUsers",
+                    "ah": "LoggedOnUsers",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "MachineGroup",
+                    "ah": "MachineGroup",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedDeviceIds",
+                    "ah": "MergedDeviceIds",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedToDeviceId",
+                    "ah": "MergedToDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MitigationStatus",
+                    "ah": "MitigationStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Model",
+                    "ah": "Model",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSArchitecture",
+                    "ah": "OSArchitecture",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSBuild",
+                    "ah": "OSBuild",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSDistribution",
+                    "ah": "OSDistribution",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersion",
+                    "ah": "OSVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersionInfo",
+                    "ah": "OSVersionInfo",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OnboardingStatus",
+                    "ah": "OnboardingStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OsBuildRevision",
+                    "ah": "OsBuildRevision",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "PublicIP",
+                    "ah": "PublicIP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RegistryDeviceTag",
+                    "ah": "RegistryDeviceTag",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RestrictedDeviceSecurityOperations",
+                    "ah": "RestrictedDeviceSecurityOperations",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SensorHealthState",
+                    "ah": "SensorHealthState",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Vendor",
+                    "ah": "Vendor",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": [
+                  "ConnectivityType",
+                  "DiscoverySources",
+                  "DlpInfo",
+                  "FirmwareVersions",
+                  "Site"
+                ]
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/5/content/query",
+          "sourceSha256": "f03a1744e0f501490a81b97857c3aa74b69548ffe25982c7c77267dd005c03d1",
+          "targetSha256": "f03a1744e0f501490a81b97857c3aa74b69548ffe25982c7c77267dd005c03d1"
+        },
+        {
+          "sourcePath": "/items/4/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8a4120b5b6750a3b83db7afbe9a189cf46d4f62b4223e74b9e2b6dbe9494741d"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by tostring(IsAzureADJoined)",
+            "resolvedTables": [
+              "DeviceInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceInfo",
+                "ahTable": "DeviceInfo",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AadDeviceId",
+                    "ah": "AadDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AssetValue",
+                    "ah": "AssetValue",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AwsResourceName",
+                    "ah": "AwsResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureResourceId",
+                    "ah": "AzureResourceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmId",
+                    "ah": "AzureVmId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmSubscriptionId",
+                    "ah": "AzureVmSubscriptionId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ClientVersion",
+                    "ah": "ClientVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "CloudPlatforms",
+                    "ah": "CloudPlatforms",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceCategory",
+                    "ah": "DeviceCategory",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceDynamicTags",
+                    "ah": "DeviceDynamicTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceId",
+                    "ah": "DeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceManualTags",
+                    "ah": "DeviceManualTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceObjectId",
+                    "laType": "string",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "DeviceSubtype",
+                    "ah": "DeviceSubtype",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExclusionReason",
+                    "ah": "ExclusionReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExposureLevel",
+                    "ah": "ExposureLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "GcpFullResourceName",
+                    "ah": "GcpFullResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HardwareUuid",
+                    "ah": "HardwareUuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HostDeviceId",
+                    "ah": "HostDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsAzureADJoined",
+                    "ah": "IsAzureADJoined",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsExcluded",
+                    "ah": "IsExcluded",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsInternetFacing",
+                    "ah": "IsInternetFacing",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsTransient",
+                    "ah": "IsTransient",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "JoinType",
+                    "ah": "JoinType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LoggedOnUsers",
+                    "ah": "LoggedOnUsers",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "MachineGroup",
+                    "ah": "MachineGroup",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedDeviceIds",
+                    "ah": "MergedDeviceIds",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedToDeviceId",
+                    "ah": "MergedToDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MitigationStatus",
+                    "ah": "MitigationStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Model",
+                    "ah": "Model",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSArchitecture",
+                    "ah": "OSArchitecture",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSBuild",
+                    "ah": "OSBuild",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSDistribution",
+                    "ah": "OSDistribution",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersion",
+                    "ah": "OSVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersionInfo",
+                    "ah": "OSVersionInfo",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OnboardingStatus",
+                    "ah": "OnboardingStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OsBuildRevision",
+                    "ah": "OsBuildRevision",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "PublicIP",
+                    "ah": "PublicIP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RegistryDeviceTag",
+                    "ah": "RegistryDeviceTag",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RestrictedDeviceSecurityOperations",
+                    "ah": "RestrictedDeviceSecurityOperations",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SensorHealthState",
+                    "ah": "SensorHealthState",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Vendor",
+                    "ah": "Vendor",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": [
+                  "ConnectivityType",
+                  "DiscoverySources",
+                  "DlpInfo",
+                  "FirmwareVersions",
+                  "Site"
+                ]
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/6/content/query",
+          "sourceSha256": "8a4120b5b6750a3b83db7afbe9a189cf46d4f62b4223e74b9e2b6dbe9494741d",
+          "targetSha256": "8a4120b5b6750a3b83db7afbe9a189cf46d4f62b4223e74b9e2b6dbe9494741d"
+        },
+        {
+          "sourcePath": "/items/4/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7a37ccf7aa76480b785bdac593d936c36ed796379e4bf977c7b7dcf705e897e8"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by ClientVersion",
+            "resolvedTables": [
+              "DeviceInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceInfo",
+                "ahTable": "DeviceInfo",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AadDeviceId",
+                    "ah": "AadDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AssetValue",
+                    "ah": "AssetValue",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AwsResourceName",
+                    "ah": "AwsResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureResourceId",
+                    "ah": "AzureResourceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmId",
+                    "ah": "AzureVmId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AzureVmSubscriptionId",
+                    "ah": "AzureVmSubscriptionId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ClientVersion",
+                    "ah": "ClientVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "CloudPlatforms",
+                    "ah": "CloudPlatforms",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceCategory",
+                    "ah": "DeviceCategory",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceDynamicTags",
+                    "ah": "DeviceDynamicTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceId",
+                    "ah": "DeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceManualTags",
+                    "ah": "DeviceManualTags",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceObjectId",
+                    "laType": "string",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "DeviceSubtype",
+                    "ah": "DeviceSubtype",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExclusionReason",
+                    "ah": "ExclusionReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ExposureLevel",
+                    "ah": "ExposureLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "GcpFullResourceName",
+                    "ah": "GcpFullResourceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HardwareUuid",
+                    "ah": "HardwareUuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "HostDeviceId",
+                    "ah": "HostDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsAzureADJoined",
+                    "ah": "IsAzureADJoined",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsExcluded",
+                    "ah": "IsExcluded",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsInternetFacing",
+                    "ah": "IsInternetFacing",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsTransient",
+                    "ah": "IsTransient",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "JoinType",
+                    "ah": "JoinType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LoggedOnUsers",
+                    "ah": "LoggedOnUsers",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "MachineGroup",
+                    "ah": "MachineGroup",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedDeviceIds",
+                    "ah": "MergedDeviceIds",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MergedToDeviceId",
+                    "ah": "MergedToDeviceId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "MitigationStatus",
+                    "ah": "MitigationStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Model",
+                    "ah": "Model",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSArchitecture",
+                    "ah": "OSArchitecture",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSBuild",
+                    "ah": "OSBuild",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSDistribution",
+                    "ah": "OSDistribution",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersion",
+                    "ah": "OSVersion",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSVersionInfo",
+                    "ah": "OSVersionInfo",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OnboardingStatus",
+                    "ah": "OnboardingStatus",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OsBuildRevision",
+                    "ah": "OsBuildRevision",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "PublicIP",
+                    "ah": "PublicIP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RegistryDeviceTag",
+                    "ah": "RegistryDeviceTag",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RestrictedDeviceSecurityOperations",
+                    "ah": "RestrictedDeviceSecurityOperations",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SensorHealthState",
+                    "ah": "SensorHealthState",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Vendor",
+                    "ah": "Vendor",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": [
+                  "ConnectivityType",
+                  "DiscoverySources",
+                  "DlpInfo",
+                  "FirmwareVersions",
+                  "Site"
+                ]
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/7/content/query",
+          "sourceSha256": "7a37ccf7aa76480b785bdac593d936c36ed796379e4bf977c7b7dcf705e897e8",
+          "targetSha256": "7a37ccf7aa76480b785bdac593d936c36ed796379e4bf977c7b7dcf705e897e8"
+        },
+        {
+          "sourcePath": "/items/5/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "6b320fcd4664c4fc0b85ff9b5228b9b2ef070cd26d61f7c926f40a1692bc91c1"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\r\n//\r\n//Get the list of AV detections\r\nlet avDetections =\r\nDeviceEvents\r\n| where ActionType == \"AntivirusDetection\" and isnotempty(MD5)\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\r\n//Get a list of file creations\r\nlet fileCreations =\r\nDeviceFileEvents \r\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\r\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\r\n//Join the file creations and AV detections on the MD5 of the file\r\navDetections | join kind=inner (fileCreations) on MD5\r\n| project-away MD51 //Remove the duplicated MD5 field\r\n| sort by Timestamp desc ",
+            "resolvedTables": [
+              "DeviceEvents",
+              "DeviceFileEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceEvents",
+                "ahTable": "DeviceEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 67,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceFileEvents",
+                "ahTable": "DeviceFileEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 60,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/0/content/query",
+          "sourceSha256": "6b320fcd4664c4fc0b85ff9b5228b9b2ef070cd26d61f7c926f40a1692bc91c1",
+          "targetSha256": "6b320fcd4664c4fc0b85ff9b5228b9b2ef070cd26d61f7c926f40a1692bc91c1"
+        },
+        {
+          "sourcePath": "/items/5/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "54a5903992c02e06d5661fa8b75928719789d9bf7bd22d33703ddbecfaea6a5b"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Audited\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType",
+            "resolvedTables": [
+              "DeviceEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceEvents",
+                "ahTable": "DeviceEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 67,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/1/content/query",
+          "sourceSha256": "54a5903992c02e06d5661fa8b75928719789d9bf7bd22d33703ddbecfaea6a5b",
+          "targetSha256": "54a5903992c02e06d5661fa8b75928719789d9bf7bd22d33703ddbecfaea6a5b"
+        },
+        {
+          "sourcePath": "/items/5/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "e899e87ad3b910c7f0902b224d463322a896feacc37c4154f0f7acb5d6348fa2"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Blocked\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType",
+            "resolvedTables": [
+              "DeviceEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceEvents",
+                "ahTable": "DeviceEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 67,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/2/content/query",
+          "sourceSha256": "e899e87ad3b910c7f0902b224d463322a896feacc37c4154f0f7acb5d6348fa2",
+          "targetSha256": "e899e87ad3b910c7f0902b224d463322a896feacc37c4154f0f7acb5d6348fa2"
+        },
+        {
+          "sourcePath": "/items/5/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "580fe67b33189f9c01eb8cb2bebf84e340292ab2b8a103996c6f02b3f717ba50"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query make a best-guess detection regarding which removable media device caused an AV detection\r\n//The query is best run over 30 days to get the full USB history\r\n//\r\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\r\nlet usbDetections =\r\n    DeviceEvents\r\n    | where ActionType == \"AntivirusDetection\" and FolderPath !startswith \"c\" and FolderPath matches regex \"^[A-Za-z]{1}\"\r\n    | extend ParsedFields=parse_json(AdditionalFields)\r\n    | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\r\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\r\nlet usbConnections = \r\n    DeviceEvents\r\n    | where ActionType == \"PnpDeviceConnected\"\r\n    | extend parsed=parse_json(AdditionalFields)\r\n    | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\r\n    | where ClassName == \"DiskDrive\"\r\n    | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\r\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\r\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\r\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\r\n| sort by DetectionTime desc",
+            "resolvedTables": [
+              "DeviceEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceEvents",
+                "ahTable": "DeviceEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 67,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/3/content/query",
+          "sourceSha256": "580fe67b33189f9c01eb8cb2bebf84e340292ab2b8a103996c6f02b3f717ba50",
+          "targetSha256": "580fe67b33189f9c01eb8cb2bebf84e340292ab2b8a103996c6f02b3f717ba50"
+        },
+        {
+          "sourcePath": "/items/5/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8c15e02b4b3be1407b61906ddae6bb9d6429c336dbd0b5027b5a0c35ea44b62b"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc",
+            "resolvedTables": [
+              "DeviceEvents",
+              "DeviceFileEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceEvents",
+                "ahTable": "DeviceEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 67,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "DeviceFileEvents",
+                "ahTable": "DeviceFileEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 60,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/4/content/query",
+          "sourceSha256": "8c15e02b4b3be1407b61906ddae6bb9d6429c336dbd0b5027b5a0c35ea44b62b",
+          "targetSha256": "8c15e02b4b3be1407b61906ddae6bb9d6429c336dbd0b5027b5a0c35ea44b62b"
+        },
+        {
+          "sourcePath": "/items/6/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "b2226a146819d8000285fa40a96140dffee3c7c1eb5e2b3077645a4faebc5edb"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mv-apply ConnectedNetworks on \r\n(\r\nwhere ConnectedNetworks.IsConnectedToInternet == true\r\n)\r\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet",
+            "resolvedTables": [
+              "DeviceNetworkInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [
+              {
+                "kind": "dynamic-cast",
+                "before": "ConnectedNetworks",
+                "after": "ConnectedNetworks = todynamic(tostring(ConnectedNetworks))",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "`ConnectedNetworks` on `DeviceNetworkInfo` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)."
+              }
+            ],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceNetworkInfo",
+                "ahTable": "DeviceNetworkInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 18,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/0/content/query",
+          "sourceSha256": "b2226a146819d8000285fa40a96140dffee3c7c1eb5e2b3077645a4faebc5edb",
+          "targetSha256": "3a5afcba5624d5c6401700184df39429dbd655db6c5a2a89ebd7f8b9eaa0d746"
+        },
+        {
+          "sourcePath": "/items/6/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "555e81a53301f1436689be365393c0717603321a3a02713b352688cd6870a5a3"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by MachineGroup",
+            "resolvedTables": [
+              "DeviceNetworkInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceNetworkInfo",
+                "ahTable": "DeviceNetworkInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 18,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/1/content/query",
+          "sourceSha256": "555e81a53301f1436689be365393c0717603321a3a02713b352688cd6870a5a3",
+          "targetSha256": "555e81a53301f1436689be365393c0717603321a3a02713b352688cd6870a5a3"
+        },
+        {
+          "sourcePath": "/items/6/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "294004b280db138149291a40c8f2b78c1f74ba4f777c17615dd3bab7ff7ee1ea"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus",
+            "resolvedTables": [
+              "DeviceNetworkInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceNetworkInfo",
+                "ahTable": "DeviceNetworkInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 18,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/2/content/query",
+          "sourceSha256": "294004b280db138149291a40c8f2b78c1f74ba4f777c17615dd3bab7ff7ee1ea",
+          "targetSha256": "294004b280db138149291a40c8f2b78c1f74ba4f777c17615dd3bab7ff7ee1ea"
+        },
+        {
+          "sourcePath": "/items/6/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4ef3cca1b95083fc63a7cfb368e3643b91981f5872c0d95a3210368f25a90e52"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceNetworkEvents\r\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)",
+            "resolvedTables": [
+              "DeviceNetworkEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceNetworkEvents",
+                "ahTable": "DeviceNetworkEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 47,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/3/content/query",
+          "sourceSha256": "4ef3cca1b95083fc63a7cfb368e3643b91981f5872c0d95a3210368f25a90e52",
+          "targetSha256": "4ef3cca1b95083fc63a7cfb368e3643b91981f5872c0d95a3210368f25a90e52"
+        },
+        {
+          "sourcePath": "/items/6/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8dc392ae6633cd2ba0a9af11c23ff3a89577b60d158bd3088ab543673d6a8e0e"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceNetworkEvents\r\n| where isnotempty(RemoteUrl)\r\n| summarize count() by RemoteUrl\r\n| order by count_ desc\r\n| limit 10",
+            "resolvedTables": [
+              "DeviceNetworkEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceNetworkEvents",
+                "ahTable": "DeviceNetworkEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 47,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/4/content/query",
+          "sourceSha256": "8dc392ae6633cd2ba0a9af11c23ff3a89577b60d158bd3088ab543673d6a8e0e",
+          "targetSha256": "8dc392ae6633cd2ba0a9af11c23ff3a89577b60d158bd3088ab543673d6a8e0e"
+        },
+        {
+          "sourcePath": "/items/6/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "16f00d253ed14ae4b7d545d8eee5ac6f5c1efe63d726dd2f252d67c444c8b801"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents  \r\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc",
+            "resolvedTables": [
+              "DeviceNetworkEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceNetworkEvents",
+                "ahTable": "DeviceNetworkEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 47,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/5/content/query",
+          "sourceSha256": "16f00d253ed14ae4b7d545d8eee5ac6f5c1efe63d726dd2f252d67c444c8b801",
+          "targetSha256": "16f00d253ed14ae4b7d545d8eee5ac6f5c1efe63d726dd2f252d67c444c8b801"
+        },
+        {
+          "sourcePath": "/items/7/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ca8c7d543e78b0b3c17cf5f2cd4e3d459290279886383482e7e154b5baa63e69"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceFileEvents\r\n| summarize FileActivityCount = count() by DeviceName",
+            "resolvedTables": [
+              "DeviceFileEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceFileEvents",
+                "ahTable": "DeviceFileEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 60,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/0/content/query",
+          "sourceSha256": "ca8c7d543e78b0b3c17cf5f2cd4e3d459290279886383482e7e154b5baa63e69",
+          "targetSha256": "ca8c7d543e78b0b3c17cf5f2cd4e3d459290279886383482e7e154b5baa63e69"
+        },
+        {
+          "sourcePath": "/items/7/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0eb0f818ef22a8c48bd3b16196cbab8d64a694c7a4f96632ef9b69ecdd96afd7"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn",
+            "resolvedTables": [
+              "DeviceFileEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "DeviceFileEvents",
+                "ahTable": "DeviceFileEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 60,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/1/content/query",
+          "sourceSha256": "0eb0f818ef22a8c48bd3b16196cbab8d64a694c7a4f96632ef9b69ecdd96afd7",
+          "targetSha256": "0eb0f818ef22a8c48bd3b16196cbab8d64a694c7a4f96632ef9b69ecdd96afd7"
+        }
+      ]
+    },
+    "requiredWorkloads": [
+      {
+        "workload": "mde",
+        "dataTypes": [
+          "DeviceEvents",
+          "DeviceFileCertificateInfo",
+          "DeviceFileEvents",
+          "DeviceImageLoadEvents",
+          "DeviceInfo",
+          "DeviceLogonEvents",
+          "DeviceNetworkEvents",
+          "DeviceNetworkInfo",
+          "DeviceProcessEvents",
+          "DeviceRegistryEvents"
+        ]
+      }
+    ],
+    "requiredDataConnectors": [],
+    "dependencyReviewRequired": false
+  }
+}
diff --git a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForIdentity.json b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForIdentity.json
new file mode 100644
index 00000000000..e197b366ef1
--- /dev/null
+++ b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForIdentity.json	
@@ -0,0 +1,5443 @@
+{
+  "version": "Notebook/1.0",
+  "items": [
+    {
+      "type": 1,
+      "content": {
+        "json": "## Microsoft Defender for Identity\n---\n"
+      },
+      "name": "text - 2"
+    },
+    {
+      "type": 9,
+      "content": {
+        "version": "KqlParameterItem/1.0",
+        "parameters": [
+          {
+            "id": "2e238f92-709c-410b-93e0-60eab6150a75",
+            "version": "KqlParameterItem/1.0",
+            "name": "TimeRange",
+            "type": 4,
+            "isRequired": true,
+            "value": {
+              "durationMs": 1800000
+            },
+            "typeSettings": {
+              "selectableValues": [
+                {
+                  "durationMs": 1800000
+                },
+                {
+                  "durationMs": 3600000
+                },
+                {
+                  "durationMs": 14400000
+                },
+                {
+                  "durationMs": 43200000
+                },
+                {
+                  "durationMs": 86400000
+                },
+                {
+                  "durationMs": 172800000
+                },
+                {
+                  "durationMs": 259200000
+                },
+                {
+                  "durationMs": 604800000
+                },
+                {
+                  "durationMs": 1209600000
+                },
+                {
+                  "durationMs": 2592000000
+                },
+                {
+                  "durationMs": 5184000000
+                },
+                {
+                  "durationMs": 7776000000
+                }
+              ],
+              "allowCustom": true
+            },
+            "timeContext": {
+              "durationMs": 86400000
+            }
+          },
+          {
+            "id": "ec13514a-7e54-4d41-86db-2805727a2fa7",
+            "version": "KqlParameterItem/1.0",
+            "name": "About",
+            "type": 10,
+            "description": "",
+            "isRequired": true,
+            "value": "Show",
+            "typeSettings": {
+              "additionalResourceOptions": [],
+              "showDefault": false
+            },
+            "jsonData": "[\r\n    \"Show\",\r\n    \"Hide\"\r\n]"
+          }
+        ],
+        "style": "pills"
+      },
+      "name": "parameters - 1"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "### Microsoft Defender for Identity Analysis Workbook\r\n\r\n",
+              "style": "info"
+            },
+            "name": "text - 0"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "About",
+        "comparison": "isEqualTo",
+        "value": "Show"
+      },
+      "name": "AboutGroup"
+    },
+    {
+      "type": 11,
+      "content": {
+        "version": "LinkItem/1.0",
+        "style": "tabs",
+        "links": [
+          {
+            "id": "48578fe1-da47-4a4c-b495-ce7fe24ce495",
+            "cellValue": "Nav",
+            "linkTarget": "parameter",
+            "linkLabel": "Overview",
+            "subTarget": "grpOverview",
+            "style": "link"
+          },
+          {
+            "id": "30e93159-8bf5-4006-820f-406ea10bcd17",
+            "cellValue": "Nav",
+            "linkTarget": "parameter",
+            "linkLabel": "LogOnEvents",
+            "subTarget": "grpLogOnEvents",
+            "style": "link"
+          },
+          {
+            "id": "c40f76ed-94be-40ff-b65b-3fda306f2c3d",
+            "cellValue": "Nav",
+            "linkTarget": "parameter",
+            "linkLabel": "QueryEvents",
+            "subTarget": "grpQueryEvents",
+            "style": "link"
+          },
+          {
+            "id": "38c88a53-f7b1-42da-83d6-0c809835eaab",
+            "cellValue": "Nav",
+            "linkTarget": "parameter",
+            "linkLabel": "DirectoryEvents",
+            "subTarget": "grpDirectoryEvents",
+            "style": "link"
+          },
+          {
+            "id": "0ad83579-c492-4c20-8db6-27883db5abc8",
+            "cellValue": "Nav",
+            "linkTarget": "parameter",
+            "linkLabel": "Alerts",
+            "subTarget": "grpAlerts",
+            "style": "link"
+          }
+        ]
+      },
+      "name": "links - 8"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityLogonEvents\r\n| summarize count() by LogonType",
+              "size": 0,
+              "title": "Log On Summary",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "tiles",
+              "tileSettings": {
+                "showBorder": false,
+                "titleContent": {
+                  "columnMatch": "LogonType",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "count_",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "auto"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "maximumSignificantDigits": 3,
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                }
+              }
+            },
+            "customWidth": "40",
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityLogonEvents\r\n|summarize count() by ActionType",
+              "size": 0,
+              "title": "Log On Status",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "30",
+            "name": "query - 1"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityLogonEvents\r\n| summarize count() by Protocol",
+              "size": 0,
+              "title": "Log On Protocol",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "barchart"
+            },
+            "customWidth": "30",
+            "name": "query - 1 - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityQueryEvents\r\n| summarize count() by Protocol",
+              "size": 0,
+              "title": "Query Summary",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "barchart"
+            },
+            "customWidth": "30",
+            "name": "query - 3"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort",
+              "size": 0,
+              "title": "Query Destination Port",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "30",
+            "name": "query - 3 - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityQueryEvents\r\n| where isnotempty(QueryType)\r\n| summarize count() by QueryType\r\n| order by count_ desc\r\n| take 10",
+              "size": 0,
+              "title": "Top 10 Query Types",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "30",
+            "name": "query - 7"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol",
+              "size": 0,
+              "title": "Directory Events Protocol",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "categoricalbar"
+            },
+            "customWidth": "40",
+            "name": "query - 6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain",
+              "size": 0,
+              "title": "Directory Events Protocol",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "30",
+            "name": "query - 6 - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10",
+              "size": 0,
+              "title": "Top 10 Accounts Activity",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true
+              }
+            },
+            "customWidth": "30",
+            "name": "query - 6 - Copy - Copy"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Nav",
+        "comparison": "isEqualTo",
+        "value": "grpOverview"
+      },
+      "name": "grpOverview"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend FROM_DEVICE_ = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE_ = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by FROM_DEVICE_, TO_DEVICE_\r\n| order by sum_Count_ desc",
+              "size": 0,
+              "title": "Resource Access Summary in Devices",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "sum_Count_",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true
+              }
+            },
+            "customWidth": "45",
+            "name": "query - 0",
+            "styleSettings": {
+              "margin": "5px",
+              "padding": "5px",
+              "showBorder": true
+            }
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc",
+              "size": 0,
+              "title": "Resource Access Summary in OS",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "sum_Count_",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true
+              }
+            },
+            "customWidth": "45",
+            "name": "query - 0 - Copy",
+            "styleSettings": {
+              "margin": "5px",
+              "padding": "5px",
+              "showBorder": true
+            }
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc",
+              "size": 0,
+              "title": "Credentials validation Summary in Devices",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "sum_Count",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true
+              }
+            },
+            "customWidth": "45",
+            "name": "query - 0 - Copy",
+            "styleSettings": {
+              "margin": "5px",
+              "padding": "5px",
+              "showBorder": true
+            }
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let data = IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count);\r\ndata\r\n| summarize sum(Count) by  TO_DEVICE\r\n| order by sum_Count desc\r\n| join kind=inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by TO_DEVICE\r\n)\r\non $left.TO_DEVICE == $right.TO_DEVICE",
+              "size": 0,
+              "title": "Credentials validation by Domain Controllers",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "sum_Count",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "TO_DEVICE1",
+                    "formatter": 5
+                  },
+                  {
+                    "columnMatch": "Trend",
+                    "formatter": 10,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "TimeGenerated",
+                    "formatter": 5
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true
+              }
+            },
+            "customWidth": "45",
+            "name": "query - 0 - Copy - Copy",
+            "styleSettings": {
+              "margin": "5px",
+              "padding": "5px",
+              "showBorder": true
+            }
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn",
+              "size": 0,
+              "title": "Logon Summary by Users",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "LogonSuccess",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "LogonFailed",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "redPurple"
+                    }
+                  },
+                  {
+                    "columnMatch": "AccountUpn1",
+                    "formatter": 5
+                  },
+                  {
+                    "columnMatch": "Trend",
+                    "formatter": 9,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "TimeGenerated",
+                    "formatter": 5
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true
+              }
+            },
+            "name": "query - 0 - Copy - Copy"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Nav",
+        "comparison": "isEqualTo",
+        "value": "grpLogOnEvents"
+      },
+      "name": "AttachmentGroup"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let data = IdentityQueryEvents\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"]);\r\ndata\r\n| summarize count() by QueryType, TO_DEVICE\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by QueryType, TO_DEVICE\r\n) on $left.QueryType == $right.QueryType and $left.TO_DEVICE== $right.TO_DEVICE",
+              "size": 0,
+              "title": "Device Query Summary",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "TO_DEVICE",
+                    "formatter": 5
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "QueryType1",
+                    "formatter": 5
+                  },
+                  {
+                    "columnMatch": "TO_DEVICE1",
+                    "formatter": 5
+                  },
+                  {
+                    "columnMatch": "Trend",
+                    "formatter": 21,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "TimeGenerated",
+                    "formatter": 5
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true,
+                "hierarchySettings": {
+                  "treeType": 1,
+                  "groupBy": [
+                    "TO_DEVICE"
+                  ],
+                  "expandTopLevel": true
+                }
+              }
+            },
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName",
+              "size": 0,
+              "title": "Query Summary from Source Devices",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "DeviceName1",
+                    "formatter": 5
+                  },
+                  {
+                    "columnMatch": "Trend",
+                    "formatter": 9,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "TimeGenerated",
+                    "formatter": 5
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true
+              }
+            },
+            "name": "query - 0 - Copy"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Nav",
+        "comparison": "isEqualTo",
+        "value": "grpQueryEvents"
+      },
+      "name": "UrlGroup"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActionType ",
+              "size": 0,
+              "title": "Timeline on ActionType",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "timechart"
+            },
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc",
+              "size": 0,
+              "title": "Top 10 Actions",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "categoricalbar",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Trend",
+                    "formatter": 9,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "TimeGenerated",
+                    "formatter": 5
+                  }
+                ]
+              },
+              "tileSettings": {
+                "showBorder": false,
+                "titleContent": {
+                  "columnMatch": "DestinationPort",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "count_",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "auto"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "maximumSignificantDigits": 3,
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                }
+              }
+            },
+            "name": "query - 0 - Copy"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn",
+              "size": 0,
+              "title": "Account Trend on Directory Events",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Trend",
+                    "formatter": 9,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  },
+                  {
+                    "columnMatch": "TimeGenerated",
+                    "formatter": 5
+                  }
+                ],
+                "rowLimit": 10000,
+                "filter": true
+              },
+              "tileSettings": {
+                "showBorder": false,
+                "titleContent": {
+                  "columnMatch": "DestinationPort",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "count_",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "auto"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "maximumSignificantDigits": 3,
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                }
+              }
+            },
+            "name": "query - 0 - Copy - Copy"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Nav",
+        "comparison": "isEqualTo",
+        "value": "grpDirectoryEvents"
+      },
+      "name": "group - 8"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName",
+              "size": 0,
+              "noDataMessage": "Alerts",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "red"
+                    }
+                  },
+                  {
+                    "columnMatch": "AlertName1",
+                    "formatter": 5
+                  },
+                  {
+                    "columnMatch": "Trend",
+                    "formatter": 21,
+                    "formatOptions": {
+                      "palette": "red"
+                    }
+                  },
+                  {
+                    "columnMatch": "TimeGenerated",
+                    "formatter": 5
+                  }
+                ]
+              }
+            },
+            "name": "query - 0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] == \"host\"\r\n| where isnotempty(Entities[\"HostName\"])\r\n| extend HostName = tostring(Entities[\"HostName\"]);\r\ndata\r\n| summarize count() by HostName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by HostName\r\n) on $left.HostName == $right.HostName",
+              "size": 0,
+              "title": "Impacted Hosts",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "red"
+                    }
+                  },
+                  {
+                    "columnMatch": "HostName1",
+                    "formatter": 5
+                  },
+                  {
+                    "columnMatch": "Trend",
+                    "formatter": 9,
+                    "formatOptions": {
+                      "palette": "red"
+                    }
+                  },
+                  {
+                    "columnMatch": "TimeGenerated",
+                    "formatter": 5
+                  }
+                ]
+              }
+            },
+            "name": "query - 1"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Nav",
+        "comparison": "isEqualTo",
+        "value": "grpAlerts"
+      },
+      "name": "group - 8"
+    }
+  ],
+  "fromTemplateId": "sentinel-MicrosoftDefenderForIdentity",
+  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
+  "xdrMetadata": {
+    "contentId": "200c5dd2-9786-5619-8425-4508a238d76a",
+    "instanceId": "baa399d3-2174-5938-b0b8-b91aed73090a",
+    "version": "3.2.1",
+    "schemaVersion": "1.0.0",
+    "displayName": "MicrosoftDefenderForIdentity"
+  },
+  "contentProvenance": {
+    "source": {
+      "path": "Workbooks/MicrosoftDefenderForIdentity.json",
+      "sha256": "45a02cbd2d0a3a4e0afb535dc2611623bb4da4ebc855a97aadc5012dfcba5068",
+      "contentId": "sentinel-MicrosoftDefenderForIdentity",
+      "originalMetadataVersion": null
+    },
+    "conversion": {
+      "tool": "sentinel-xdr-migration",
+      "version": "0.1.0",
+      "reviewRequired": false,
+      "queries": [
+        {
+          "sourcePath": "/items/1/content/parameters/1/query",
+          "status": "removed-scope-helper",
+          "outputPath": null,
+          "sourceSha256": "49d6e69eb90170912b1e70a4d8c01d3f19d11b10c46b8a72ba0fda4cfc4a6257",
+          "targetSha256": null
+        },
+        {
+          "sourcePath": "/items/4/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "55a24358602dc66ce19b7782a2471bb4683aaf0ba29be08d45b6bb880ff431c5"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityLogonEvents\r\n| summarize count() by LogonType",
+            "resolvedTables": [
+              "IdentityLogonEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityLogonEvents",
+                "ahTable": "IdentityLogonEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.966,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "FailureReason",
+                    "ah": "FailureReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastSeenForUser",
+                    "ah": "LastSeenForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LogonType",
+                    "ah": "LogonType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UncommonForUser",
+                    "ah": "UncommonForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/0/content/query",
+          "sourceSha256": "55a24358602dc66ce19b7782a2471bb4683aaf0ba29be08d45b6bb880ff431c5",
+          "targetSha256": "55a24358602dc66ce19b7782a2471bb4683aaf0ba29be08d45b6bb880ff431c5"
+        },
+        {
+          "sourcePath": "/items/4/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "067b2c84ac76d39cb98d782766a2333ad321ddacc62067c5df38887181e45e4d"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityLogonEvents\r\n|summarize count() by ActionType",
+            "resolvedTables": [
+              "IdentityLogonEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityLogonEvents",
+                "ahTable": "IdentityLogonEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.966,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "FailureReason",
+                    "ah": "FailureReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastSeenForUser",
+                    "ah": "LastSeenForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LogonType",
+                    "ah": "LogonType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UncommonForUser",
+                    "ah": "UncommonForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/1/content/query",
+          "sourceSha256": "067b2c84ac76d39cb98d782766a2333ad321ddacc62067c5df38887181e45e4d",
+          "targetSha256": "067b2c84ac76d39cb98d782766a2333ad321ddacc62067c5df38887181e45e4d"
+        },
+        {
+          "sourcePath": "/items/4/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7c73b3f858780b841d5fba68530dbbb26f27d300f7361a9a061778d92fb9c233"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityLogonEvents\r\n| summarize count() by Protocol",
+            "resolvedTables": [
+              "IdentityLogonEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityLogonEvents",
+                "ahTable": "IdentityLogonEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.966,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "FailureReason",
+                    "ah": "FailureReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastSeenForUser",
+                    "ah": "LastSeenForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LogonType",
+                    "ah": "LogonType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UncommonForUser",
+                    "ah": "UncommonForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/2/content/query",
+          "sourceSha256": "7c73b3f858780b841d5fba68530dbbb26f27d300f7361a9a061778d92fb9c233",
+          "targetSha256": "7c73b3f858780b841d5fba68530dbbb26f27d300f7361a9a061778d92fb9c233"
+        },
+        {
+          "sourcePath": "/items/4/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "1befee06de450f1c956c230d76282dfcd8bcc7ad5aeee4572ee7be4e00e6b446"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityQueryEvents\r\n| summarize count() by Protocol",
+            "resolvedTables": [
+              "IdentityQueryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityQueryEvents",
+                "ahTable": "IdentityQueryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.962,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Query",
+                    "ah": "Query",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryTarget",
+                    "ah": "QueryTarget",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryType",
+                    "ah": "QueryType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/3/content/query",
+          "sourceSha256": "1befee06de450f1c956c230d76282dfcd8bcc7ad5aeee4572ee7be4e00e6b446",
+          "targetSha256": "1befee06de450f1c956c230d76282dfcd8bcc7ad5aeee4572ee7be4e00e6b446"
+        },
+        {
+          "sourcePath": "/items/4/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "9b7fb90da715b52749eacc4717c0c990df3c4e0e0f2ad5b4fac65ad03d11c060"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityQueryEvents\r\n| summarize count() by DestinationPort",
+            "resolvedTables": [
+              "IdentityQueryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityQueryEvents",
+                "ahTable": "IdentityQueryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.962,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Query",
+                    "ah": "Query",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryTarget",
+                    "ah": "QueryTarget",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryType",
+                    "ah": "QueryType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/4/content/query",
+          "sourceSha256": "9b7fb90da715b52749eacc4717c0c990df3c4e0e0f2ad5b4fac65ad03d11c060",
+          "targetSha256": "9b7fb90da715b52749eacc4717c0c990df3c4e0e0f2ad5b4fac65ad03d11c060"
+        },
+        {
+          "sourcePath": "/items/4/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0bf43ca58f71de576ba70f30204105613730ef6cd702cc81907a2c1e6b5cd59a"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityQueryEvents\r\n| where isnotempty(QueryType)\r\n| summarize count() by QueryType\r\n| order by count_ desc\r\n| take 10",
+            "resolvedTables": [
+              "IdentityQueryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityQueryEvents",
+                "ahTable": "IdentityQueryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.962,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Query",
+                    "ah": "Query",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryTarget",
+                    "ah": "QueryTarget",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryType",
+                    "ah": "QueryType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/5/content/query",
+          "sourceSha256": "0bf43ca58f71de576ba70f30204105613730ef6cd702cc81907a2c1e6b5cd59a",
+          "targetSha256": "0bf43ca58f71de576ba70f30204105613730ef6cd702cc81907a2c1e6b5cd59a"
+        },
+        {
+          "sourcePath": "/items/4/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "da0561e7b7b85a5ffc136ef633eaf6f028048926a86d01dfcdccc6891e1000df"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityDirectoryEvents\r\n| summarize count() by Protocol",
+            "resolvedTables": [
+              "IdentityDirectoryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityDirectoryEvents",
+                "ahTable": "IdentityDirectoryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.958,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/6/content/query",
+          "sourceSha256": "da0561e7b7b85a5ffc136ef633eaf6f028048926a86d01dfcdccc6891e1000df",
+          "targetSha256": "da0561e7b7b85a5ffc136ef633eaf6f028048926a86d01dfcdccc6891e1000df"
+        },
+        {
+          "sourcePath": "/items/4/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "48f1ecdc776d5c0bdfcd89c5a335be3400a2c18039c376121e09e25d4910f77e"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain",
+            "resolvedTables": [
+              "IdentityDirectoryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityDirectoryEvents",
+                "ahTable": "IdentityDirectoryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.958,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/7/content/query",
+          "sourceSha256": "48f1ecdc776d5c0bdfcd89c5a335be3400a2c18039c376121e09e25d4910f77e",
+          "targetSha256": "48f1ecdc776d5c0bdfcd89c5a335be3400a2c18039c376121e09e25d4910f77e"
+        },
+        {
+          "sourcePath": "/items/4/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "039424d4269139394a41c8dcbe93cb5fa865c0e3e89d43d42fb643efd99e9204"
+          },
+          "conversion": {
+            "sourceId": "/items/4/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10",
+            "resolvedTables": [
+              "IdentityDirectoryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityDirectoryEvents",
+                "ahTable": "IdentityDirectoryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.958,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/4/content/items/8/content/query",
+          "sourceSha256": "039424d4269139394a41c8dcbe93cb5fa865c0e3e89d43d42fb643efd99e9204",
+          "targetSha256": "039424d4269139394a41c8dcbe93cb5fa865c0e3e89d43d42fb643efd99e9204"
+        },
+        {
+          "sourcePath": "/items/5/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0e4caaa2fa2339e0e70034afd7cddf1bd4e0761cc6a7b97a83f451d19f2c61d9"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend FROM_DEVICE_ = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE_ = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by FROM_DEVICE_, TO_DEVICE_\r\n| order by sum_Count_ desc",
+            "resolvedTables": [
+              "IdentityLogonEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [
+              {
+                "kind": "dynamic-cast",
+                "before": "AdditionalFields",
+                "after": "AdditionalFields = todynamic(tostring(AdditionalFields))",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "`AdditionalFields` on `IdentityLogonEvents` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)."
+              }
+            ],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityLogonEvents",
+                "ahTable": "IdentityLogonEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.966,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "FailureReason",
+                    "ah": "FailureReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastSeenForUser",
+                    "ah": "LastSeenForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LogonType",
+                    "ah": "LogonType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UncommonForUser",
+                    "ah": "UncommonForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/0/content/query",
+          "sourceSha256": "0e4caaa2fa2339e0e70034afd7cddf1bd4e0761cc6a7b97a83f451d19f2c61d9",
+          "targetSha256": "c38504885307007f07519caf94ce7aaa1441dacd4846f25ca0560e8f74294922"
+        },
+        {
+          "sourcePath": "/items/5/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "cf5dfc7f0546da39e3160c42cb08180cf9895010fc87e20605c6cab1fb41b8ba"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc",
+            "resolvedTables": [
+              "IdentityLogonEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [
+              {
+                "kind": "dynamic-cast",
+                "before": "AdditionalFields",
+                "after": "AdditionalFields = todynamic(tostring(AdditionalFields))",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "`AdditionalFields` on `IdentityLogonEvents` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)."
+              }
+            ],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityLogonEvents",
+                "ahTable": "IdentityLogonEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.966,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "FailureReason",
+                    "ah": "FailureReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastSeenForUser",
+                    "ah": "LastSeenForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LogonType",
+                    "ah": "LogonType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UncommonForUser",
+                    "ah": "UncommonForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/1/content/query",
+          "sourceSha256": "cf5dfc7f0546da39e3160c42cb08180cf9895010fc87e20605c6cab1fb41b8ba",
+          "targetSha256": "722edffddc2c2ecdba4c445ee7bc3dcca7a45681dbae2a4e12d132ec818815cd"
+        },
+        {
+          "sourcePath": "/items/5/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "face3925daef834748ae615b3b724b42fa01fd32f45cd635cd9bc34d21fdab66"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc",
+            "resolvedTables": [
+              "IdentityLogonEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [
+              {
+                "kind": "dynamic-cast",
+                "before": "AdditionalFields",
+                "after": "AdditionalFields = todynamic(tostring(AdditionalFields))",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "`AdditionalFields` on `IdentityLogonEvents` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)."
+              }
+            ],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityLogonEvents",
+                "ahTable": "IdentityLogonEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.966,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "FailureReason",
+                    "ah": "FailureReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastSeenForUser",
+                    "ah": "LastSeenForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LogonType",
+                    "ah": "LogonType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UncommonForUser",
+                    "ah": "UncommonForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/2/content/query",
+          "sourceSha256": "face3925daef834748ae615b3b724b42fa01fd32f45cd635cd9bc34d21fdab66",
+          "targetSha256": "731034da096ef9aa77e61b7b88398d990171271e063bde690c25485b7c9bd630"
+        },
+        {
+          "sourcePath": "/items/5/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4121acbd6129bcc13fcacd66f2b1dc1c2ffb5af9bc48a9993f35ca3184c2f992"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let data = IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count);\r\ndata\r\n| summarize sum(Count) by  TO_DEVICE\r\n| order by sum_Count desc\r\n| join kind=inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by TO_DEVICE\r\n)\r\non $left.TO_DEVICE == $right.TO_DEVICE",
+            "resolvedTables": [
+              "IdentityLogonEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [
+              {
+                "kind": "dynamic-cast",
+                "before": "AdditionalFields",
+                "after": "AdditionalFields = todynamic(tostring(AdditionalFields))",
+                "count": 1,
+                "source": "deterministic",
+                "reason": "`AdditionalFields` on `IdentityLogonEvents` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)."
+              }
+            ],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityLogonEvents",
+                "ahTable": "IdentityLogonEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.966,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "FailureReason",
+                    "ah": "FailureReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastSeenForUser",
+                    "ah": "LastSeenForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LogonType",
+                    "ah": "LogonType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UncommonForUser",
+                    "ah": "UncommonForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/3/content/query",
+          "sourceSha256": "4121acbd6129bcc13fcacd66f2b1dc1c2ffb5af9bc48a9993f35ca3184c2f992",
+          "targetSha256": "88594929c3dcf1ae71e28826629dc327f865b84d18b0cb0e109282efe00ce1e1"
+        },
+        {
+          "sourcePath": "/items/5/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5cfa1f00c5592101c3949fb5c9a4c844ca075b1967d5a978cf33e245e73f8570"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn",
+            "resolvedTables": [
+              "IdentityLogonEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityLogonEvents",
+                "ahTable": "IdentityLogonEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.966,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeviceType",
+                    "ah": "DeviceType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "FailureReason",
+                    "ah": "FailureReason",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastSeenForUser",
+                    "ah": "LastSeenForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LogonType",
+                    "ah": "LogonType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OSPlatform",
+                    "ah": "OSPlatform",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UncommonForUser",
+                    "ah": "UncommonForUser",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/items/4/content/query",
+          "sourceSha256": "5cfa1f00c5592101c3949fb5c9a4c844ca075b1967d5a978cf33e245e73f8570",
+          "targetSha256": "5cfa1f00c5592101c3949fb5c9a4c844ca075b1967d5a978cf33e245e73f8570"
+        },
+        {
+          "sourcePath": "/items/6/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "3e17d55a70ce3cd304a47fd8785547f8446c7b115405e059c535d74209fb2b84"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let data = IdentityQueryEvents\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"]);\r\ndata\r\n| summarize count() by QueryType, TO_DEVICE\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by QueryType, TO_DEVICE\r\n) on $left.QueryType == $right.QueryType and $left.TO_DEVICE== $right.TO_DEVICE",
+            "resolvedTables": [
+              "IdentityQueryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityQueryEvents",
+                "ahTable": "IdentityQueryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.962,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Query",
+                    "ah": "Query",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryTarget",
+                    "ah": "QueryTarget",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryType",
+                    "ah": "QueryType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/0/content/query",
+          "sourceSha256": "3e17d55a70ce3cd304a47fd8785547f8446c7b115405e059c535d74209fb2b84",
+          "targetSha256": "3e17d55a70ce3cd304a47fd8785547f8446c7b115405e059c535d74209fb2b84"
+        },
+        {
+          "sourcePath": "/items/6/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "95283f26751ec86c6de1459cfe97ee649f8481a6d6418fc78507f088d94f2de9"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName",
+            "resolvedTables": [
+              "IdentityQueryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityQueryEvents",
+                "ahTable": "IdentityQueryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.962,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Query",
+                    "ah": "Query",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryTarget",
+                    "ah": "QueryTarget",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "QueryType",
+                    "ah": "QueryType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/1/content/query",
+          "sourceSha256": "95283f26751ec86c6de1459cfe97ee649f8481a6d6418fc78507f088d94f2de9",
+          "targetSha256": "95283f26751ec86c6de1459cfe97ee649f8481a6d6418fc78507f088d94f2de9"
+        },
+        {
+          "sourcePath": "/items/7/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4f8e6bd76cd92a3db0fd896f091c319f1f0b942ce7dbbbaa6472f1f04c13a5f2"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActionType ",
+            "resolvedTables": [
+              "IdentityDirectoryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityDirectoryEvents",
+                "ahTable": "IdentityDirectoryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.958,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/0/content/query",
+          "sourceSha256": "4f8e6bd76cd92a3db0fd896f091c319f1f0b942ce7dbbbaa6472f1f04c13a5f2",
+          "targetSha256": "4f8e6bd76cd92a3db0fd896f091c319f1f0b942ce7dbbbaa6472f1f04c13a5f2"
+        },
+        {
+          "sourcePath": "/items/7/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "3f319e748402bcf0ba8649c89a5383c670424c4cc5a63a5ed81106203cebc26c"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc",
+            "resolvedTables": [
+              "IdentityDirectoryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityDirectoryEvents",
+                "ahTable": "IdentityDirectoryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.958,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/1/content/query",
+          "sourceSha256": "3f319e748402bcf0ba8649c89a5383c670424c4cc5a63a5ed81106203cebc26c",
+          "targetSha256": "3f319e748402bcf0ba8649c89a5383c670424c4cc5a63a5ed81106203cebc26c"
+        },
+        {
+          "sourcePath": "/items/7/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "afc2fa77334567ca35b171baeda269dde85f980999bdd6be7054bd7767516154"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn",
+            "resolvedTables": [
+              "IdentityDirectoryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "IdentityDirectoryEvents",
+                "ahTable": "IdentityDirectoryEvents",
+                "identical": false,
+                "verdict": "Review",
+                "score": 0.958,
+                "columns": [
+                  {
+                    "sentinel": "AccountDisplayName",
+                    "ah": "AccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountDomain",
+                    "ah": "AccountDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountName",
+                    "ah": "AccountName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountObjectId",
+                    "ah": "AccountObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountSid",
+                    "ah": "AccountSid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AccountUpn",
+                    "ah": "AccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ActionType",
+                    "ah": "ActionType",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Application",
+                    "ah": "Application",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationDeviceName",
+                    "ah": "DestinationDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationIPAddress",
+                    "ah": "DestinationIPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DestinationPort",
+                    "ah": "DestinationPort",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "DeviceName",
+                    "ah": "DeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IPAddress",
+                    "ah": "IPAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ISP",
+                    "ah": "ISP",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Location",
+                    "ah": "Location",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Port",
+                    "ah": "Port",
+                    "laType": "string",
+                    "ahType": "int",
+                    "relation": "castNeeded"
+                  },
+                  {
+                    "sentinel": "Protocol",
+                    "ah": "Protocol",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountDisplayName",
+                    "ah": "TargetAccountDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetAccountUpn",
+                    "ah": "TargetAccountUpn",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TargetDeviceName",
+                    "ah": "TargetDeviceName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/2/content/query",
+          "sourceSha256": "afc2fa77334567ca35b171baeda269dde85f980999bdd6be7054bd7767516154",
+          "targetSha256": "afc2fa77334567ca35b171baeda269dde85f980999bdd6be7054bd7767516154"
+        },
+        {
+          "sourcePath": "/items/8/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "37f8548ab5ffd9ba6937928d97cdecd6c65534cbb1b0d114712f74133de4673a"
+          },
+          "conversion": {
+            "sourceId": "/items/8/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName",
+            "resolvedTables": [
+              "SecurityAlert"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "SecurityAlert",
+                "ahTable": "SecurityAlert",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 32,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/8/content/items/0/content/query",
+          "sourceSha256": "37f8548ab5ffd9ba6937928d97cdecd6c65534cbb1b0d114712f74133de4673a",
+          "targetSha256": "37f8548ab5ffd9ba6937928d97cdecd6c65534cbb1b0d114712f74133de4673a"
+        },
+        {
+          "sourcePath": "/items/8/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5f33bbfe47586c729e16cc1bf5de5b4a28ecf8fb6b6c2337e357a6bfbbe7c778"
+          },
+          "conversion": {
+            "sourceId": "/items/8/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] == \"host\"\r\n| where isnotempty(Entities[\"HostName\"])\r\n| extend HostName = tostring(Entities[\"HostName\"]);\r\ndata\r\n| summarize count() by HostName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by HostName\r\n) on $left.HostName == $right.HostName",
+            "resolvedTables": [
+              "SecurityAlert"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "SecurityAlert",
+                "ahTable": "SecurityAlert",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 32,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/8/content/items/1/content/query",
+          "sourceSha256": "5f33bbfe47586c729e16cc1bf5de5b4a28ecf8fb6b6c2337e357a6bfbbe7c778",
+          "targetSha256": "5f33bbfe47586c729e16cc1bf5de5b4a28ecf8fb6b6c2337e357a6bfbbe7c778"
+        }
+      ]
+    },
+    "requiredWorkloads": [
+      {
+        "workload": "mdi",
+        "dataTypes": [
+          "IdentityDirectoryEvents",
+          "IdentityLogonEvents",
+          "IdentityQueryEvents"
+        ]
+      },
+      {
+        "workload": "sentinel",
+        "dataTypes": [
+          "SecurityAlert"
+        ]
+      }
+    ],
+    "requiredDataConnectors": [
+      {
+        "connectorId": "MicrosoftThreatProtection",
+        "dataTypes": [
+          "SecurityAlert"
+        ]
+      }
+    ],
+    "dependencyReviewRequired": false
+  }
+}
diff --git a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json
new file mode 100644
index 00000000000..5daadeab4ac
--- /dev/null
+++ b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json	
@@ -0,0 +1,77565 @@
+{
+  "version": "Notebook/1.0",
+  "items": [
+    {
+      "type": 1,
+      "content": {
+        "json": "\n<table style=\"width:100%; border-collapse:collapse; border:none;\">\n  <tr style=\"border:none;\">\n    <td style=\"text-align:left; border:none; font-size:28px; font-weight:bold;width:1%;\">\n      Microsoft Defender for Office 365 Detections and Insights\n    </td>\n    <td style=\"text-align:right; border:none;width:1%;\">\n      <img height=\"40\" src=\"https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b\">\n\t</td>\n  </tr>\n</table>\n<table>\n<tr>\n<td style=\"text-align:left; border:none; font-size:16px; width:10%;\">This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.<br>It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.<br> The workbook uses data from hunting tables streamed from <a href=\"https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables\">Microsoft Defender XDR</a> via the Microsoft Sentinel Connector. Keep the data in the <a href=\"https://learn.microsoft.com/en-us/azure/sentinel/configure-data-retention\">Log Analytics workspace</a> for as long as necessary to get insights over an extended period, based on your organisation's needs.</td>\n</tr>\n</table>\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n\n\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view."
+      },
+      "name": "text - 2",
+      "id": "d2b45ab8-a1c1-43d2-853d-290640bf4c94"
+    },
+    {
+      "type": 9,
+      "content": {
+        "version": "KqlParameterItem/1.0",
+        "parameters": [
+          {
+            "id": "2e238f92-709c-410b-93e0-60eab6150a75",
+            "version": "KqlParameterItem/1.0",
+            "name": "TimeRange",
+            "type": 4,
+            "isRequired": true,
+            "isGlobal": true,
+            "typeSettings": {
+              "selectableValues": [
+                {
+                  "durationMs": 3600000
+                },
+                {
+                  "durationMs": 14400000
+                },
+                {
+                  "durationMs": 43200000
+                },
+                {
+                  "durationMs": 86400000
+                },
+                {
+                  "durationMs": 172800000
+                },
+                {
+                  "durationMs": 259200000
+                },
+                {
+                  "durationMs": 604800000
+                },
+                {
+                  "durationMs": 1209600000
+                },
+                {
+                  "durationMs": 2592000000
+                },
+                {
+                  "durationMs": 5184000000
+                },
+                {
+                  "durationMs": 7776000000
+                }
+              ],
+              "allowCustom": true
+            },
+            "timeContext": {
+              "durationMs": 86400000
+            },
+            "value": {
+              "durationMs": 7776000000
+            },
+            "key": "2e238f92-709c-410b-93e0-60eab6150a75"
+          },
+          {
+            "id": "165f2f4a-e49f-4561-adc5-d0527a4caf32",
+            "version": "KqlParameterItem/1.0",
+            "name": "Granularity",
+            "label": "Trend interval",
+            "type": 2,
+            "isRequired": true,
+            "typeSettings": {
+              "additionalResourceOptions": [],
+              "showDefault": false
+            },
+            "jsonData": "[{ \"value\": \"1d\", \"label\": \"Daily (1d)\", \"selected\": true }, { \"value\": \"7d\", \"label\": \"Weekly (7d)\" }, { \"value\": \"30d\", \"label\": \"Monthly (30d)\" }, { \"value\": \"90d\", \"label\": \"Quarterly (90d)\" }]",
+            "timeContext": {
+              "durationMs": 86400000
+            },
+            "value": "1d"
+          }
+        ],
+        "style": "pills"
+      },
+      "name": "parameters - 1",
+      "id": "0021e733-42b4-461f-8f6c-14e6e765389d"
+    },
+    {
+      "type": 11,
+      "content": {
+        "version": "LinkItem/1.0",
+        "style": "tabs",
+        "links": [
+          {
+            "id": "3d26d949-bba8-486c-9af7-2b85bd5c8ab0",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Executive Summary",
+            "subTarget": "1",
+            "style": "link",
+            "key": "3d26d949-bba8-486c-9af7-2b85bd5c8ab0"
+          },
+          {
+            "id": "a5f95467-84c1-4d8b-858c-7819339af748",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Email - Malware",
+            "subTarget": "2",
+            "style": "link",
+            "key": "a5f95467-84c1-4d8b-858c-7819339af748"
+          },
+          {
+            "id": "b6c93de8-16d9-4c90-999b-837935de5645",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Email - Phish",
+            "subTarget": "3",
+            "style": "link",
+            "key": "b6c93de8-16d9-4c90-999b-837935de5645"
+          },
+          {
+            "id": "9e006e81-4fd4-40b9-9d20-3705dd6c17ad",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Email - Impersonation & BEC",
+            "subTarget": "15",
+            "style": "link",
+            "key": "75f1e28f-e95a-4810-af40-6b47b35cda46"
+          },
+          {
+            "id": "df2c53b4-b6ed-4151-95fb-b3f08b849b84",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Email - Spam",
+            "subTarget": "4",
+            "style": "link",
+            "key": "df2c53b4-b6ed-4151-95fb-b3f08b849b84"
+          },
+          {
+            "id": "fd2006c9-39b5-43ac-b05d-47309ee22deb",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Teams & Collaboration",
+            "subTarget": "14",
+            "style": "link",
+            "key": "fd2006c9-39b5-43ac-b05d-47309ee22deb"
+          },
+          {
+            "id": "ee01f95a-c5f7-4864-82e8-54a164741ba2",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "File - Malware (SharePoint, Teams and OneDrive)",
+            "subTarget": "9",
+            "style": "link",
+            "key": "ee01f95a-c5f7-4864-82e8-54a164741ba2"
+          },
+          {
+            "id": "9df30067-3266-48a8-b9e3-d65952098d46",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "URL & Clicks",
+            "subTarget": "5",
+            "style": "link",
+            "key": "9df30067-3266-48a8-b9e3-d65952098d46"
+          },
+          {
+            "id": "b4be0ac3-3f48-44a8-b4b6-b46e17c710cd",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Top Users & Exfiltration",
+            "subTarget": "6",
+            "style": "link",
+            "key": "b4be0ac3-3f48-44a8-b4b6-b46e17c710cd"
+          },
+          {
+            "id": "e1d34091-7b3c-4e2d-a032-8be82a989313",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Email - Detection Overrides",
+            "subTarget": "7",
+            "style": "link",
+            "key": "e1d34091-7b3c-4e2d-a032-8be82a989313"
+          },
+          {
+            "id": "a1e6264d-8f85-4a94-9ffd-eee36c04a0d5",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Post-Delivery & Quarantine",
+            "subTarget": "11",
+            "style": "link",
+            "key": "a1e6264d-8f85-4a94-9ffd-eee36c04a0d5"
+          },
+          {
+            "id": "08c43a4f-f502-4813-9b8d-3f6b0b62b2fd",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "False Negative(FN) Submissions",
+            "subTarget": "8",
+            "style": "link",
+            "key": "08c43a4f-f502-4813-9b8d-3f6b0b62b2fd"
+          },
+          {
+            "id": "638d931f-f319-4914-b72d-8d68e914c7d4",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "False Positive(FP) Submissions",
+            "subTarget": "10",
+            "style": "link",
+            "key": "638d931f-f319-4914-b72d-8d68e914c7d4"
+          },
+          {
+            "id": "b2920bee-c32a-4fdd-9d32-b004db2f3ac8",
+            "cellValue": "Tab",
+            "linkTarget": "parameter",
+            "linkLabel": "Security Operations Center (SOC) Insights",
+            "subTarget": "13",
+            "style": "link",
+            "key": "b2920bee-c32a-4fdd-9d32-b004db2f3ac8"
+          }
+        ]
+      },
+      "name": "links - 14",
+      "id": "5c9a1d6b-c248-432b-a1c0-496337635775"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Defender for Office 365 - Protection Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Microsoft Defender for Office 365** is a comprehensive security solution designed to protect organizations from advanced threats targeting their email and collaboration tools. It leverages a multi-layered approach to safeguard against phishing, malware, business email compromise (BEC), and other sophisticated attacks.\r\n"
+                  },
+                  "name": "text - 13",
+                  "styleSettings": {
+                    "margin": "0",
+                    "padding": "0"
+                  },
+                  "id": "46119f93-fad9-413c-8e10-7615c6fdde2f"
+                },
+                {
+                  "type": 12,
+                  "content": {
+                    "version": "NotebookGroup/1.0",
+                    "groupType": "editable",
+                    "items": [
+                      {
+                        "type": 3,
+                        "content": {
+                          "version": "KqlItem/1.0",
+                          "query": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n    // this alteration is due to the threat types being updated directly within advanced hunting.\r\n    //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n    | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n    | extend MDO_detection = parse_json(DetectionMethods) \r\n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n    EmailPostDeliveryEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n    | summarize arg_max(Timestamp, *) by Key \r\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n    CloudAppEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n    | where ActionType == \"AdminSubmissionSubmitted\" \r\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n    | where SubmissionType in (\"1\", \"2\") \r\n    | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n    EmailEventsThreats \r\n    | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n    CloudAppEventsFiltered \r\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n    ); \r\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\n\r\nprint StatisticName=\"Effectiveness Post Delivery\", Value=abs(round(((toreal(toscalar(FN_Admin_Submissions))+toreal(toscalar(FN_ZAP_Unsuccessful)))/(toreal(toscalar(Mal_Phish_Mailflow))+toreal(toscalar(FN_ZAP_Successful))+toreal(toscalar(FN_ZAP_Unsuccessful))+toreal(toscalar(FN_Admin_Submissions))-toreal(toscalar(FP_ZAP)))*100-100),2))",
+                          "size": 1,
+                          "showAnalytics": true,
+                          "timeContextFromParameter": "TimeRange",
+                          "queryType": "advancedHunting",
+                          "visualization": "stat",
+                          "tileSettings": {
+                            "showBorder": false,
+                            "titleContent": {
+                              "columnMatch": "StatisticName",
+                              "formatter": 1
+                            },
+                            "leftContent": {
+                              "columnMatch": "Value",
+                              "formatter": 12,
+                              "formatOptions": {
+                                "palette": "auto"
+                              },
+                              "numberFormat": {
+                                "unit": 17,
+                                "options": {
+                                  "maximumSignificantDigits": 3,
+                                  "maximumFractionDigits": 2
+                                }
+                              }
+                            }
+                          },
+                          "graphSettings": {
+                            "type": 0,
+                            "topContent": {
+                              "columnMatch": "StatisticName",
+                              "formatter": 1
+                            },
+                            "centerContent": {
+                              "columnMatch": "Value",
+                              "formatter": 1,
+                              "numberFormat": {
+                                "unit": 17,
+                                "options": {
+                                  "maximumSignificantDigits": 3,
+                                  "maximumFractionDigits": 2
+                                }
+                              }
+                            }
+                          },
+                          "statSettings": {
+                            "valueField": "Value",
+                            "valueAggregation": "None",
+                            "colorSettings": {
+                              "type": "thresholds",
+                              "mode": "foreground",
+                              "heatmapPalette": "greenRed",
+                              "thresholdsGrid": [
+                                {
+                                  "operator": ">",
+                                  "thresholdValue": "95",
+                                  "representation": "green"
+                                },
+                                {
+                                  "operator": "<=",
+                                  "thresholdValue": "95",
+                                  "representation": "orange"
+                                },
+                                {
+                                  "operator": "<=",
+                                  "thresholdValue": "90",
+                                  "representation": "red"
+                                }
+                              ]
+                            },
+                            "iconSettings": {
+                              "thresholdsGrid": []
+                            },
+                            "numberFormatSettings": {
+                              "unit": 1,
+                              "options": {
+                                "style": "decimal"
+                              }
+                            },
+                            "tagText": "Phish / Malware Effectiveness - Post Delivery",
+                            "valueFontStyle": "superLarge",
+                            "tagTextPosition": "bottom"
+                          }
+                        },
+                        "customWidth": "50",
+                        "name": "query - 5",
+                        "id": "62de2a91-a809-48ec-a111-e697d556b2b3"
+                      },
+                      {
+                        "type": 3,
+                        "content": {
+                          "version": "KqlItem/1.0",
+                          "query": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))",
+                          "size": 1,
+                          "showAnalytics": true,
+                          "timeContextFromParameter": "TimeRange",
+                          "queryType": "advancedHunting",
+                          "visualization": "stat",
+                          "tileSettings": {
+                            "titleContent": {
+                              "columnMatch": "Release_Percentage",
+                              "formatter": 12,
+                              "formatOptions": {
+                                "palette": "none"
+                              },
+                              "numberFormat": {
+                                "unit": 1,
+                                "options": {
+                                  "style": "decimal"
+                                }
+                              }
+                            },
+                            "showBorder": true,
+                            "sortCriteriaField": "Release_Percentage",
+                            "size": "auto"
+                          },
+                          "graphSettings": {
+                            "type": 0,
+                            "topContent": {
+                              "columnMatch": "StatisticName",
+                              "formatter": 1
+                            },
+                            "centerContent": {
+                              "columnMatch": "Value",
+                              "formatter": 1,
+                              "numberFormat": {
+                                "unit": 17,
+                                "options": {
+                                  "maximumSignificantDigits": 3,
+                                  "maximumFractionDigits": 2
+                                }
+                              }
+                            }
+                          },
+                          "statSettings": {
+                            "valueField": "Release_Percentage",
+                            "valueAggregation": "None",
+                            "colorSettings": {
+                              "type": "thresholds",
+                              "mode": "foreground",
+                              "heatmapPalette": "greenRed",
+                              "thresholdsGrid": [
+                                {
+                                  "operator": "<",
+                                  "thresholdValue": "5",
+                                  "representation": "green"
+                                },
+                                {
+                                  "operator": ">",
+                                  "thresholdValue": "5",
+                                  "representation": "redDark"
+                                }
+                              ]
+                            },
+                            "iconSettings": {
+                              "thresholdsGrid": []
+                            },
+                            "numberFormatSettings": {
+                              "unit": 1,
+                              "options": {
+                                "style": "decimal"
+                              }
+                            },
+                            "tagText": "Quarantine Release Percentage",
+                            "valueFontStyle": "superLarge",
+                            "tagTextPosition": "bottom"
+                          }
+                        },
+                        "customWidth": "50",
+                        "name": "query - 1",
+                        "id": "858ac1a4-8828-45e9-968c-d3cfc1216c64"
+                      }
+                    ]
+                  },
+                  "name": "TopNr",
+                  "id": "1369c97e-848b-475a-b447-3a435cb7a1f1"
+                },
+                {
+                  "type": 12,
+                  "content": {
+                    "version": "NotebookGroup/1.0",
+                    "groupType": "editable",
+                    "items": [
+                      {
+                        "type": 1,
+                        "content": {
+                          "json": "**Effectiveness visually represents the protection given by Defender for Office 365 against phishing and malware in email messages.** <br>\r\nWe consider messages that your users report, as well as decisions that are made after delivery."
+                        },
+                        "name": "text - 9",
+                        "styleSettings": {
+                          "margin": "1px"
+                        },
+                        "id": "25e2e19e-aefb-4e37-b28f-b4138d63e109"
+                      },
+                      {
+                        "type": 3,
+                        "content": {
+                          "version": "KqlItem/1.0",
+                          "query": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n    // this alteration is due to the threat types being updated directly within advanced hunting.\r\n    //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n    | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n    | extend MDO_detection = parse_json(DetectionMethods) \r\n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n    EmailPostDeliveryEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n    | summarize arg_max(Timestamp, *) by Key \r\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n    CloudAppEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n    | where ActionType == \"AdminSubmissionSubmitted\" \r\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n    | where SubmissionType in (\"1\", \"2\") \r\n    | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n    EmailEventsThreats \r\n    | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n    CloudAppEventsFiltered \r\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n    ); \r\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\nunion withsource=Table \r\n    (print StatisticName=\"Mal/Phish Mailflow totals - Minus FPs\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \r\n    (print StatisticName=\"Admin Mal/Phish FNs Submitted\", Value=toreal(FN_Admin_Submissions)), \r\n    (print StatisticName=\"Mal/Phish FPs Reverse Zapped\", Value=toreal(FP_ZAP)), \r\n    (print StatisticName=\"Mal / Phish Successfully Zapped\", Value=toreal(FN_ZAP_Successful)), \r\n    (print StatisticName=\"Mal / Phish UN-Successfully Zapped\", Value=toreal(FN_ZAP_Unsuccessful)), \r\n    (print StatisticName=\"Effectiveness Post Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \r\n    (print StatisticName=\"Effectiveness Pre-Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))) \r\n| project StatisticName, Value",
+                          "size": 0,
+                          "showAnalytics": true,
+                          "timeContextFromParameter": "TimeRange",
+                          "queryType": "advancedHunting",
+                          "visualization": "table",
+                          "gridSettings": {
+                            "formatters": [
+                              {
+                                "columnMatch": "Value",
+                                "formatter": 0,
+                                "numberFormat": {
+                                  "unit": 17,
+                                  "options": {
+                                    "style": "decimal"
+                                  }
+                                }
+                              }
+                            ]
+                          },
+                          "tileSettings": {
+                            "showBorder": false,
+                            "titleContent": {
+                              "columnMatch": "StatisticName",
+                              "formatter": 1
+                            },
+                            "leftContent": {
+                              "columnMatch": "Value",
+                              "formatter": 12,
+                              "formatOptions": {
+                                "palette": "auto"
+                              },
+                              "numberFormat": {
+                                "unit": 17,
+                                "options": {
+                                  "maximumSignificantDigits": 3,
+                                  "maximumFractionDigits": 2
+                                }
+                              }
+                            }
+                          },
+                          "graphSettings": {
+                            "type": 2,
+                            "topContent": {
+                              "columnMatch": "StatisticName",
+                              "formatter": 1
+                            },
+                            "centerContent": {
+                              "columnMatch": "Value",
+                              "formatter": 1,
+                              "numberFormat": {
+                                "unit": 17,
+                                "options": {
+                                  "maximumSignificantDigits": 3,
+                                  "maximumFractionDigits": 2
+                                }
+                              }
+                            },
+                            "nodeIdField": "StatisticName",
+                            "sourceIdField": "Value",
+                            "targetIdField": "Value",
+                            "graphOrientation": 3,
+                            "showOrientationToggles": false,
+                            "nodeSize": null,
+                            "staticNodeSize": 100,
+                            "colorSettings": null,
+                            "hivesMargin": 5,
+                            "edgeColorSettings": null
+                          }
+                        },
+                        "name": "query - 7",
+                        "id": "9e09ff94-8092-49c7-860f-341049e1398c"
+                      }
+                    ]
+                  },
+                  "customWidth": "50",
+                  "name": "Effectiveness Nr",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "31081a73-9a54-4668-9e26-ad7347f1e06e"
+                },
+                {
+                  "type": 12,
+                  "content": {
+                    "version": "NotebookGroup/1.0",
+                    "groupType": "editable",
+                    "items": [
+                      {
+                        "type": 1,
+                        "content": {
+                          "json": "**Quarantine release rate by detection technology.** \r\n<br>\r\nFor each detector, the share of its quarantined mail that was later released (Release % = released / quarantined). A high rate can indicate false positives worth reviewing."
+                        },
+                        "name": "text - 1",
+                        "styleSettings": {
+                          "margin": "1px"
+                        },
+                        "id": "e9848043-03dd-4ada-9e73-238067463f74"
+                      },
+                      {
+                        "type": 3,
+                        "content": {
+                          "version": "KqlItem/1.0",
+                          "query": "//Per detection technology: the share of its quarantined emails later released from quarantine (a high rate can indicate false positives). Top 7 by release rate; detectors with <10 quarantined excluded so the rate is meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\"\r\n| join kind=leftouter (\r\n    EmailPostDeliveryEvents\r\n    | where Action == \"Quarantine release\"\r\n    | distinct NetworkMessageId\r\n    | extend ReleasedFlag = \"yes\"\r\n  ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Technology']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc\r\n| take 7",
+                          "size": 0,
+                          "showAnalytics": true,
+                          "timeContextFromParameter": "TimeRange",
+                          "queryType": "advancedHunting",
+                          "visualization": "table",
+                          "gridSettings": {
+                            "formatters": [
+                              {
+                                "columnMatch": "Quarantined Emails",
+                                "formatter": 0,
+                                "formatOptions": {
+                                  "customColumnWidthSetting": "130px"
+                                },
+                                "numberFormat": {
+                                  "unit": 17,
+                                  "options": {
+                                    "style": "decimal",
+                                    "maximumFractionDigits": 1
+                                  }
+                                }
+                              },
+                              {
+                                "columnMatch": "Released",
+                                "formatter": 3,
+                                "formatOptions": {
+                                  "palette": "redDark",
+                                  "customColumnWidthSetting": "90px"
+                                },
+                                "numberFormat": {
+                                  "unit": 17,
+                                  "options": {
+                                    "style": "decimal",
+                                    "maximumFractionDigits": 1
+                                  }
+                                }
+                              },
+                              {
+                                "columnMatch": "Release %",
+                                "formatter": 4,
+                                "formatOptions": {
+                                  "palette": "red",
+                                  "min": 0,
+                                  "max": 20,
+                                  "customColumnWidthSetting": "90px"
+                                },
+                                "numberFormat": {
+                                  "unit": 1,
+                                  "options": {
+                                    "style": "decimal"
+                                  }
+                                }
+                              }
+                            ],
+                            "filter": true
+                          }
+                        },
+                        "name": "query - 2",
+                        "id": "1bbae9d1-d6f8-446a-817c-8fdc2df83d4c"
+                      }
+                    ]
+                  },
+                  "customWidth": "50",
+                  "name": "Quarantine Overview Relese",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "36fd8f20-ece7-4889-9fb1-f5b85b97b45a"
+                }
+              ]
+            },
+            "customWidth": "100",
+            "name": "group - Exec Protection Insights",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "1d8e22e0-22f7-453e-aed2-9e56ace1363a"
+          },
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Protection details\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis Overview provides an executive summary of your Microsoft Defender for Office 365 email security posture: the volume of mail processed, threats detected and filtered (phishing, malware, spam), overall protection effectiveness, and the mix of threats targeting your organization. Use it as a starting point, then drill into the dedicated tabs for detailed investigation."
+                  },
+                  "name": "text - 13",
+                  "id": "24cf577c-e12a-4747-95a7-1c19bee17397"
+                },
+                {
+                  "type": 9,
+                  "content": {
+                    "version": "KqlParameterItem/1.0",
+                    "parameters": [
+                      {
+                        "id": "5c0f0101-0a11-4b22-9c33-000000000101",
+                        "version": "KqlParameterItem/1.0",
+                        "name": "ProtectionView",
+                        "label": "Protection view",
+                        "type": 2,
+                        "isRequired": true,
+                        "typeSettings": {
+                          "additionalResourceOptions": [],
+                          "showDefault": false
+                        },
+                        "jsonData": "[{ \"value\": \"Table\", \"label\": \"Summary table\", \"selected\": true }, { \"value\": \"Tiles\", \"label\": \"Detailed tiles\" }]",
+                        "value": "Tiles"
+                      }
+                    ],
+                    "style": "pills"
+                  },
+                  "name": "Protection view selector",
+                  "id": "5c0f0102-0a11-4b22-9c33-000000000102"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "let base = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize arg_max(Timestamp, ThreatTypes, DeliveryAction, OrgLevelPolicy, OrgLevelAction, UserLevelAction) by Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress));\r\nlet agg = materialize(base | summarize\r\n    Total = count(),\r\n    Filtered = countif(isnotempty(ThreatTypes) and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FMal = countif(ThreatTypes has \"Malware\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FPhish = countif(ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FSpam = countif(ThreatTypes == \"Spam\" and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    Deliv = countif(isnotempty(ThreatTypes) and DeliveryAction == \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n    Blocked = countif(isempty(ThreatTypes) and DeliveryAction != \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n    Clean = countif(isempty(ThreatTypes) and DeliveryAction == \"Delivered\"));\r\nlet pd = materialize(EmailPostDeliveryEvents | where ActionResult == \"Success\" | summarize MalZap = countif(ActionType == \"Malware ZAP\"), PhishZap = countif(ActionType == \"Phish ZAP\"), SpamZap = countif(ActionType == \"Spam ZAP\"));\r\nlet sub = materialize(CloudAppEvents | extend R = tostring(parse_json(RawEventData).RecordType), SCT = tostring(parse_json(RawEventData).SubmissionContentType) | where R == \"29\" | summarize Adm = countif(ActionType == \"AdminSubmissionSubmitted\" and SCT == \"Mail\"), Usr = countif(ActionType == \"UserSubmission\"));\r\nlet Total = toscalar(agg | project Total);\r\nlet Filtered = toscalar(agg | project Filtered);\r\nlet FMal = toscalar(agg | project FMal);\r\nlet FPhish = toscalar(agg | project FPhish);\r\nlet FSpam = toscalar(agg | project FSpam);\r\nlet Deliv = toscalar(agg | project Deliv);\r\nlet Blocked = toscalar(agg | project Blocked);\r\nlet Clean = toscalar(agg | project Clean);\r\nlet MalZap = toscalar(pd | project MalZap);\r\nlet PhishZap = toscalar(pd | project PhishZap);\r\nlet SpamZap = toscalar(pd | project SpamZap);\r\nlet Adm = toscalar(sub | project Adm);\r\nlet Usr = toscalar(sub | project Usr);\r\nunion\r\n    (print o = 1, Name = \"Total Inbound Emails\", Count = Total),\r\n    (print o = 2, Name = \"    Filtering Totals\", Count = Filtered),\r\n    (print o = 3, Name = \"        Filtered as Malware\", Count = FMal),\r\n    (print o = 4, Name = \"        Filtered as Phish\", Count = FPhish),\r\n    (print o = 5, Name = \"        Filtered as Spam\", Count = FSpam),\r\n    (print o = 6, Name = \"    Delivered with Detection\", Count = Deliv),\r\n    (print o = 7, Name = \"    User/Admin Blocked\", Count = Blocked),\r\n    (print o = 8, Name = \"    Clean Emails\", Count = Clean),\r\n    (print o = 9, Name = \"Post-Delivery ZAP Removals\", Count = MalZap + PhishZap + SpamZap),\r\n    (print o = 10, Name = \"    Removed by Malware ZAP\", Count = MalZap),\r\n    (print o = 11, Name = \"    Removed by Phish ZAP\", Count = PhishZap),\r\n    (print o = 12, Name = \"    Removed by Spam ZAP\", Count = SpamZap),\r\n    (print o = 13, Name = \"User/Admin Reported\", Count = Adm + Usr),\r\n    (print o = 14, Name = \"    Reported by Admins\", Count = Adm),\r\n    (print o = 15, Name = \"    Reported by Users\", Count = Usr)\r\n| sort by o asc\r\n| extend [\"% of Inbound\"] = round(Count * 100.0 / Total, 1)\r\n| project Name, Count, [\"% of Inbound\"]",
+                    "size": 3,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "table",
+                    "gridSettings": {
+                      "formatters": [
+                        {
+                          "columnMatch": "Name",
+                          "formatter": 1,
+                          "formatOptions": {
+                            "customColumnWidthSetting": "3fr"
+                          }
+                        },
+                        {
+                          "columnMatch": "Count",
+                          "formatter": 3,
+                          "formatOptions": {
+                            "palette": "blue",
+                            "customColumnWidthSetting": "3fr"
+                          },
+                          "numberFormat": {
+                            "unit": 17,
+                            "options": {
+                              "style": "decimal"
+                            }
+                          }
+                        },
+                        {
+                          "columnMatch": "% of Inbound",
+                          "formatter": 3,
+                          "formatOptions": {
+                            "palette": "green",
+                            "min": 0,
+                            "max": 100,
+                            "customColumnWidthSetting": "2fr"
+                          },
+                          "numberFormat": {
+                            "unit": 1,
+                            "options": {
+                              "style": "decimal",
+                              "maximumFractionDigits": 1
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "customWidth": "100",
+                  "conditionalVisibility": {
+                    "parameterName": "ProtectionView",
+                    "comparison": "isEqualTo",
+                    "value": "Table"
+                  },
+                  "name": "query - option 1 grid",
+                  "id": "5c0f0005-0a11-4b22-9c33-000000000005"
+                },
+                {
+                  "type": 12,
+                  "content": {
+                    "version": "NotebookGroup/1.0",
+                    "groupType": "editable",
+                    "items": [
+                      {
+                        "type": 12,
+                        "content": {
+                          "version": "NotebookGroup/1.0",
+                          "groupType": "editable",
+                          "title": "Total Emails",
+                          "items": [
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Total Inbound Emails\";",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "gridSettings": {
+                                  "formatters": [
+                                    {
+                                      "columnMatch": "Count",
+                                      "formatter": 4,
+                                      "formatOptions": {
+                                        "palette": "greenRed"
+                                      }
+                                    }
+                                  ]
+                                },
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1,
+                                    "formatOptions": {
+                                      "compositeBarSettings": {
+                                        "labelText": ""
+                                      }
+                                    }
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "blue",
+                                      "compositeBarSettings": {
+                                        "labelText": ""
+                                      }
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                },
+                                "chartSettings": {
+                                  "xAxis": "Count",
+                                  "createOtherGroup": 0
+                                },
+                                "mapSettings": {
+                                  "locInfo": "LatLong",
+                                  "sizeSettings": "Count",
+                                  "sizeAggregation": "Sum",
+                                  "legendMetric": "Count",
+                                  "legendAggregation": "Sum",
+                                  "itemColorSettings": {
+                                    "type": "heatmap",
+                                    "colorAggregation": "Sum",
+                                    "nodeColorField": "Count",
+                                    "heatmapPalette": "greenRed"
+                                  }
+                                }
+                              },
+                              "name": "query - 1",
+                              "id": "84e8d60b-7937-46f5-b2f4-a1a4adf06c9f"
+                            }
+                          ]
+                        },
+                        "name": "Total Inbound",
+                        "id": "1aeed046-9ea5-4583-b966-722847997fc7"
+                      },
+                      {
+                        "type": 12,
+                        "content": {
+                          "version": "NotebookGroup/1.0",
+                          "groupType": "editable",
+                          "title": "Filtering Totals",
+                          "items": [
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "EmailEvents\r\n| where isnotempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Filtering Totals\";",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1,
+                                    "formatOptions": {
+                                      "compositeBarSettings": {
+                                        "labelText": ""
+                                      }
+                                    }
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "redDark",
+                                      "compositeBarSettings": {
+                                        "labelText": ""
+                                      }
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "name": "query - 1",
+                              "id": "bae9a200-589f-4ca6-a3cf-f1110f644c49"
+                            },
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "//This query visualises Total emails detected as Malware\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has ('Malware') and EmailDirection == \"Inbound\"\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Malware\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "red"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 4",
+                              "id": "0984d05b-fd2c-48e1-835f-41afc5a2385a"
+                            },
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "//This query visualises Total emails detected as Phish\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Phish\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "orange"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 4",
+                              "id": "ced2d054-76d1-40df-a412-0bc86a6c3336"
+                            },
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "//This query visualises Total emails by detected as Spam\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes == 'Spam' and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Spam\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "yellow"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 4",
+                              "id": "14456a0d-f5ac-46a0-a007-c72c7c40c58f"
+                            }
+                          ]
+                        },
+                        "customWidth": "50",
+                        "name": "group - 9",
+                        "id": "d4e69885-f1b2-4c2b-85c2-188a6708dc4b"
+                      },
+                      {
+                        "type": 12,
+                        "content": {
+                          "version": "NotebookGroup/1.0",
+                          "groupType": "editable",
+                          "title": " ",
+                          "items": [
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "EmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and DeliveryAction == 'Delivered'\r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Delivered with Detection\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 0,
+                                      "palette": "red"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 3",
+                              "id": "394d1ed4-7089-4291-bc80-f9948e3be6a9"
+                            },
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isempty(ThreatTypes) \r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| where DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"User/Admin Blocked\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "gray"
+                                    },
+                                    "tooltipFormat": {
+                                      "tooltip": "Emails blocked from being delivered because of User or Admin overriddes"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 3",
+                              "id": "c29a2268-67d1-4958-a9a3-696384075987"
+                            },
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "EmailEvents\r\n| where isempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction == 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Clean Emails\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "gray"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 3",
+                              "id": "89a02ac7-971c-4672-bf5d-64709c479536"
+                            }
+                          ]
+                        },
+                        "customWidth": "50",
+                        "name": "group - 8",
+                        "id": "761e74d4-279e-465f-ba47-5eeec4cf05d2"
+                      },
+                      {
+                        "type": 12,
+                        "content": {
+                          "version": "NotebookGroup/1.0",
+                          "groupType": "editable",
+                          "title": "Post-Delivery ZAP Removals",
+                          "items": [
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Malware ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Malware ZAP\"\r\n",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "red"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 3",
+                              "id": "b06666bc-6ec0-49e7-a332-77e278d2320f"
+                            },
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Phish ZAP\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "orange"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 3",
+                              "id": "6fbac01b-0c42-46dc-8ca8-68e285593a45"
+                            },
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Spam ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Spam ZAP\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "min": 1,
+                                      "palette": "yellow"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "33.3",
+                              "name": "query - 3",
+                              "id": "7bd27a3b-be13-4ca0-9964-0f872f826b45"
+                            }
+                          ]
+                        },
+                        "name": "Post Delivery",
+                        "id": "4d20339e-5215-4edf-99d6-728cac183d16"
+                      },
+                      {
+                        "type": 12,
+                        "content": {
+                          "version": "NotebookGroup/1.0",
+                          "groupType": "editable",
+                          "items": [
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Admins\"",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "palette": "none"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "50",
+                              "name": "query - 3",
+                              "id": "7490fa3a-e287-4fc3-b025-8772b9edb601"
+                            },
+                            {
+                              "type": 3,
+                              "content": {
+                                "version": "KqlItem/1.0",
+                                "query": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\r\n| where Record == 29 and ActionType == \"UserSubmission\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Users\"\r\n",
+                                "size": 3,
+                                "timeContextFromParameter": "TimeRange",
+                                "queryType": "advancedHunting",
+                                "visualization": "tiles",
+                                "tileSettings": {
+                                  "titleContent": {
+                                    "columnMatch": "Details",
+                                    "formatter": 1
+                                  },
+                                  "secondaryContent": {
+                                    "columnMatch": "Count",
+                                    "formatter": 12,
+                                    "formatOptions": {
+                                      "palette": "none"
+                                    },
+                                    "numberFormat": {
+                                      "unit": 17,
+                                      "options": {
+                                        "style": "decimal",
+                                        "maximumFractionDigits": 1
+                                      }
+                                    }
+                                  },
+                                  "showBorder": true,
+                                  "size": "full",
+                                  "styleSettings": {
+                                    "borderStyle": "rounded",
+                                    "backgroundColor": "colorGray100"
+                                  }
+                                }
+                              },
+                              "customWidth": "50",
+                              "name": "query - 2",
+                              "id": "7af222dc-fd74-40ec-8ab7-741e179c07bf"
+                            }
+                          ]
+                        },
+                        "name": "Reported",
+                        "id": "8151e242-1c30-4550-ae9c-83f159e1a456"
+                      }
+                    ]
+                  },
+                  "conditionalVisibility": {
+                    "parameterName": "ProtectionView",
+                    "comparison": "isEqualTo",
+                    "value": "Tiles"
+                  },
+                  "name": "Protection - Tiles view",
+                  "id": "5c0f0103-0a11-4b22-9c33-000000000103"
+                },
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "## Most Attacked Users<br>\r\n\r\n**The users most targeted by inbound email threats across all threat types (malware, phishing, and spam) in the selected period. Concentrated targeting of a few individuals is a strong signal of deliberate campaigns.**<br><br>**Recommended action:** Prioritise these users for security awareness training, tighter protection policies (for example the Strict preset), and closer monitoring - they are your highest-risk people."
+                  },
+                  "name": "exec vap banner",
+                  "id": "1fe431fb-cc96-4e81-b164-3a1a3823ebeb"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "//This query surfaces the users most targeted by inbound email threats across all threat types (malware, phishing, spam) for the selected period, so SecOps can prioritise the highest-risk individuals. Similar to a \"Most Attacked People\" view.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where isnotempty(ThreatTypes)\r\n| summarize\r\n    ['Total Threats'] = count(),\r\n    Malware = countif(ThreatTypes has \"Malware\"),\r\n    Phish   = countif(ThreatTypes has \"Phish\"),\r\n    Spam    = countif(ThreatTypes has \"Spam\"),\r\n    ['Last Seen'] = max(Timestamp)\r\n    by ['User']=RecipientEmailAddress\r\n| top 10 by ['Total Threats']\r\n| project ['User'], ['Total Threats'], Malware, Phish, Spam, ['Last Seen']",
+                    "size": 3,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "table",
+                    "gridSettings": {
+                      "filter": true,
+                      "formatters": [
+                        {
+                          "columnMatch": "Malware",
+                          "formatter": 3,
+                          "formatOptions": {
+                            "palette": "blue",
+                            "customColumnWidthSetting": "145px"
+                          },
+                          "numberFormat": {
+                            "unit": 17,
+                            "options": {
+                              "style": "decimal",
+                              "maximumFractionDigits": 1
+                            }
+                          }
+                        },
+                        {
+                          "columnMatch": "Phish",
+                          "formatter": 3,
+                          "formatOptions": {
+                            "palette": "blue",
+                            "customColumnWidthSetting": "145px"
+                          },
+                          "numberFormat": {
+                            "unit": 17,
+                            "options": {
+                              "style": "decimal",
+                              "maximumFractionDigits": 1
+                            }
+                          }
+                        },
+                        {
+                          "columnMatch": "Spam",
+                          "formatter": 3,
+                          "formatOptions": {
+                            "palette": "blue",
+                            "customColumnWidthSetting": "145px"
+                          },
+                          "numberFormat": {
+                            "unit": 17,
+                            "options": {
+                              "style": "decimal",
+                              "maximumFractionDigits": 1
+                            }
+                          }
+                        },
+                        {
+                          "columnMatch": "Total Threats",
+                          "formatter": 3,
+                          "formatOptions": {
+                            "palette": "blue",
+                            "customColumnWidthSetting": "145px"
+                          },
+                          "numberFormat": {
+                            "unit": 17,
+                            "options": {
+                              "style": "decimal",
+                              "maximumFractionDigits": 1
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "customWidth": "100",
+                  "name": "exec vap table",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "2dfd91b1-b8d3-4a72-aaf4-a30a1886bed7"
+                },
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "## Detection trend over time - grouped by {Granularity}\r\n**Represents total emails, total detections, total user submissions and admin email submissions over time summarizing the data per {Granularity} interval**"
+                  },
+                  "name": "text - 14",
+                  "id": "ddbbdaef-b374-42a8-821c-7fcd7ee53ba9"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "//This query visualises total emails, total detections, total user, and admin email submissions over time summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet scaffold = range Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran;\r\nlet baseQuery = materialize(EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where isnotempty(Timestamp));\r\nlet sub = materialize(CloudAppEvents\r\n| extend Record = (parse_json(RawEventData)).RecordType, SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29);\r\nlet zapbase = EmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\" or ActionType == \"Spam ZAP\";\r\nunion\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Inbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Inbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Phish') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Phish\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Malware') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Malware\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Spam') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Spam\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Intra-org\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Intra-org Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Outbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Outbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where isnotempty(ThreatTypes) | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails with Threat\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"UserSubmission\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Users\"),\r\n(scaffold | join kind=leftouter (zapbase | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Removed by ZAP\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"Mail\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Admins\")",
+                    "size": 0,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "linechart",
+                    "chartSettings": {
+                      "xAxis": "Timestamp",
+                      "seriesLabelSettings": [
+                        {
+                          "seriesName": "Total Inbound Emails",
+                          "label": "Inbound Emails",
+                          "color": "green"
+                        },
+                        {
+                          "seriesName": "Total Emails with Threat",
+                          "label": "Emails with Threat",
+                          "color": "redDark"
+                        },
+                        {
+                          "seriesName": "Emails Detected as Phish",
+                          "label": "Emails with Phish",
+                          "color": "redBright"
+                        },
+                        {
+                          "seriesName": "Emails Detected as Malware",
+                          "label": "Emails with Malware",
+                          "color": "red"
+                        },
+                        {
+                          "seriesName": "Total Intra-org Emails",
+                          "label": "Intra-org Emails",
+                          "color": "greenDark"
+                        },
+                        {
+                          "seriesName": "Emails Detected as Spam",
+                          "label": "Emails with Spam",
+                          "color": "gray"
+                        },
+                        {
+                          "seriesName": "Total Outbound Emails",
+                          "label": "Outbound Emails",
+                          "color": "greenDarkDark"
+                        },
+                        {
+                          "seriesName": "Total Emails Removed by ZAP",
+                          "label": "Emails ZAP-d",
+                          "color": "orangeDark"
+                        },
+                        {
+                          "seriesName": "Total Emails Reported by Users",
+                          "label": "User Reported Emails",
+                          "color": "lightBlue"
+                        },
+                        {
+                          "seriesName": "Total Emails Reported by Admins",
+                          "color": "blueDark"
+                        }
+                      ]
+                    }
+                  },
+                  "customWidth": "100",
+                  "name": "query - 1",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "bcbefa48-f553-4290-acff-2691caf898ea"
+                },
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "## Bad traffic (%) - Inbound Emails - grouped by {Granularity}\r\n**This represents bad traffic (% of emails with threats) compared to total inbound emails, summarized per {Granularity} interval over time.**"
+                  },
+                  "name": "text - 15",
+                  "id": "30761bcc-b1a5-45e2-8c0a-22388fbbf16c"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "//This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, {Granularity})\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| project Timestamp, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+                    "size": 0,
+                    "aggregation": 3,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "linechart"
+                  },
+                  "customWidth": "100",
+                  "name": "query - 4",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "508036a8-d969-44c2-b2d2-c62d99999197"
+                }
+              ]
+            },
+            "customWidth": "100",
+            "name": "group - Exec Protection Details",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "e6edeeeb-dcde-41d0-88c7-97ef773403b1"
+          },
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Collaboration Protection Posture\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 protects Microsoft Teams and collaboration, not only email. This snapshot shows Teams threat activity for the period.<br><br>**Recommended action:** Review the dedicated **Teams &amp; Collaboration** tab for impersonation, malicious URLs, risky senders and file threats in Teams."
+                  },
+                  "name": "exec collab banner",
+                  "id": "3d78a6aa-51d4-4cab-93d1-26dff86fd667"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "//Headline Microsoft Teams / collaboration protection metrics for the executive summary, with per-interval sparklines so the collaboration threat trend is visible at a glance. Messages and URLs are counted per distinct Teams message.\r\nlet gran = {Granularity};\r\nlet me = materialize(MessageEvents);\r\nlet cae = materialize(CloudAppEvents | where ActionType == \"TeamsImpersonationDetected\");\r\nlet mui = materialize(MessageUrlInfo);\r\nlet uce = materialize(UrlClickEvents | where Workload == \"Teams\" and ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\"));\r\nlet fmc = materialize(FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\");\r\nunion\r\n(me | summarize Count = dcount(TeamsMessageId) | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(me | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(me | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Teams Threat Messages\", Ord = 2, Trend = toscalar(me | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(cae | summarize Count = count() | extend Details = \"Teams Impersonation Detections\", Ord = 3, Trend = toscalar(cae | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(mui | summarize Count = dcount(TeamsMessageId) | extend Details = \"URLs Shared in Teams\", Ord = 4, Trend = toscalar(mui | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(uce | summarize Count = count() | extend Details = \"Malicious Clicks Blocked\", Ord = 5, Trend = toscalar(uce | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 6, Trend = toscalar(fmc | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Malicious Teams Files\", Ord = 7, Trend = toscalar(fmc | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+                    "size": 3,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "tiles",
+                    "tileSettings": {
+                      "titleContent": {
+                        "columnMatch": "Details",
+                        "formatter": 1
+                      },
+                      "leftContent": {
+                        "columnMatch": "Count",
+                        "formatter": 12,
+                        "formatOptions": {
+                          "min": 0,
+                          "palette": "blue"
+                        },
+                        "numberFormat": {
+                          "unit": 17,
+                          "options": {
+                            "style": "decimal",
+                            "maximumFractionDigits": 1
+                          }
+                        }
+                      },
+                      "secondaryContent": {
+                        "columnMatch": "Trend",
+                        "formatter": 21
+                      },
+                      "showBorder": true,
+                      "size": "auto"
+                    }
+                  },
+                  "customWidth": "100",
+                  "name": "exec collab tiles",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "3175aee5-56d2-4cb1-b1c3-75be683e6ffb"
+                }
+              ]
+            },
+            "customWidth": "100",
+            "name": "group - Exec Collaboration Posture",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "39b0921f-fcef-49f4-8d52-0dcd1f33045b"
+          },
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Emerging Threats\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<p style=\"font-size:16px;\">With more sophisticated adversaries and new threats emerging frequently and prevalently, it's critical to be able to quickly identify and react to these threats.</p>\r\n\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Email threat landscape</b></p>](https://security.microsoft.com/threatanalytics3/f186e4b0-28df-499a-901e-c64768b6d0dc/overview?filters=tags%253DPhishing)\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Automated business email impersonation campaign uses parallel aging report and payroll diversion lures</b></p>](https://security.microsoft.com/threatanalytics3/3eb53378-892d-4695-a497-25d0a54181ee)\r\n[<p style=\"font-size:16px;\"><b>🛡️Tool Profile: StealC</b></p>](https://security.microsoft.com/threatanalytics3/4d837c12-1db4-49c8-8466-219198d40b9b)\r\n[<p style=\"font-size:16px;\"><b>🛡️OSINT Profile: UNC1151/Ghostwriter phishing campaign targeting Gmail accounts</b></p>](https://security.microsoft.com/threatanalytics3/b1a7e5e7-4b43-4758-8805-f714a131161a)\r\n[<p style=\"font-size:16px;\"><b>🛡️Activity Profile: Encrypted message campaign targets real estate/financial sectors</b></p>](https://security.microsoft.com/threatanalytics3/651d669a-4721-42ab-bb96-509e94b5bfd9)\r\n\r\n<br>\r\n<a href=\"https://go.microsoft.com/fwlink/?linkid=2323913\" target=\"_blank\" style=\"font-size:14px; padding:10px 20px; background-color:#003366; color:white; border:none; border-radius:5px;\">\r\n<b>View all\r\n \r\n</a>\r\n"
+                  },
+                  "name": "text - 10",
+                  "styleSettings": {
+                    "margin": "0",
+                    "padding": "0"
+                  },
+                  "id": "0c781e85-af9a-41a6-9cf7-b3bb9a09d5d0"
+                }
+              ]
+            },
+            "customWidth": "100",
+            "name": "group - Exec Emerging Threats",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "4f8886d3-882a-4c14-ab7f-a37bd302e32f"
+          },
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Microsoft 365 Secure Email Gateway Performance\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<p style=\"font-size:16px;\">Using multiple vendor email security products can offer diverse detections. However, our comprehensive end-to-end approach—spanning prevention, detection, posture, investigation, response, and user training—delivers a unified and effective defense that matches or exceeds the efficacy of siloed Secure Email Gateway solutions.</p>\r\n\r\n[<p style=\"font-size:18px;\"><b>Learn more</b></p>](https://www.microsoft.com/en-us/security/blog/2026/06/15/microsoft-defender-email-security-benchmarking-key-insights-from-one-year-of-data/) \r\n\r\n<br>\r\n<p style=\"font-size:16px;\"><b>High-severity email threats missed per 1,000 users protected - February–April 2026 (Microsoft Defender email security benchmarking)</b></p>"
+                  },
+                  "name": "text - 12",
+                  "id": "94c804f9-2860-4768-be59-fb31a4ff22d7"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "datatable(Index:int, Name:string, Value:int)\r\n[\r\n    1, \"Defender for Office 365\", 194,\r\n    2, \"Mimecast\", 478,\r\n    3, \"ProofPoint\", 483,\r\n    4, \"HornetSecurity\", 813,\r\n    5, \"TrendMicro\", 1151,\r\n    6, \"IronPort\", 1274,\r\n    7, \"Barracuda\", 1585,\r\n    8, \"FireEye\", 2107\r\n]\r\n| project [\"Email security solution\"] = Name, [\"High-severity threats missed / 1K users\"] = Value\r\n| order by [\"High-severity threats missed / 1K users\"] asc\r\n",
+                    "size": 0,
+                    "timeContext": {
+                      "durationMs": 86400000
+                    },
+                    "queryType": "advancedHunting",
+                    "visualization": "table",
+                    "gridSettings": {
+                      "formatters": [
+                        {
+                          "columnMatch": "Email security solution",
+                          "formatter": 1,
+                          "formatOptions": {
+                            "customColumnWidthSetting": "40%"
+                          }
+                        },
+                        {
+                          "columnMatch": "High-severity threats missed / 1K users",
+                          "formatter": 3,
+                          "formatOptions": {
+                            "palette": "blue",
+                            "min": 0,
+                            "max": 2107,
+                            "customColumnWidthSetting": "60%"
+                          },
+                          "numberFormat": {
+                            "unit": 17,
+                            "options": {
+                              "style": "decimal",
+                              "useGrouping": true
+                            }
+                          }
+                        }
+                      ],
+                      "rowLimit": 10,
+                      "sortBy": [
+                        {
+                          "itemKey": "High-severity threats missed / 1K users",
+                          "sortOrder": 1
+                        }
+                      ]
+                    }
+                  },
+                  "name": "query - 11",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "e54fd5bd-17e2-40dc-897d-8a3bb21116ff"
+                }
+              ]
+            },
+            "customWidth": "100",
+            "name": "group - Exec SEG Performance",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "1f3a7e2b-0a1f-48ba-9da3-e7531d500938"
+          },
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "id": "ab3756d3-3f60-4024-9376-0f1a7d47ac13",
+                  "type": 1,
+                  "name": "text - 18",
+                  "content": {
+                    "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Stay Current\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n<br>\r\n\r\n- **Threat Analytics (Defender XDR)** — live, tenant-specific threat intelligence and recommended actions: <a href=\"https://learn.microsoft.com/en-us/defender-xdr/threat-analytics\" target=\"_blank\">aka.ms/threatanalytics</a>\r\n- **Microsoft Security Blog** — campaign write-ups and threat research: <a href=\"https://www.microsoft.com/en-us/security/blog/\" target=\"_blank\">microsoft.com/security/blog</a>\r\n- **Microsoft Defender for Office 365 Tech Community blog** — product updates and reporting guidance: <a href=\"https://techcommunity.microsoft.com/category/microsoft-defender-for-office-365/blog/microsoftdefenderforoffice365blog\" target=\"_blank\">Tech Community</a>\r\n- **Latest features in Microsoft Defender for Office 365** — <a href=\"https://learn.microsoft.com/en-us/defender-office-365/defender-for-office-365-whats-new\" target=\"_blank\">What's new in Microsoft Defender for Office 365</a> \r\n- **Share reporting feedback**: <a href=\"https://aka.ms/mdoreportingfeedback\" target=\"_blank\">aka.ms/mdoreportingfeedback</a>\r\n"
+                  }
+                }
+              ]
+            },
+            "customWidth": "100",
+            "name": "group - Exec Stay Current",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "5e22c565-cd2e-41f3-8d5a-0735af67c93f"
+          }
+        ],
+        "exportParameters": true
+      },
+      "customWidth": "100",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "1"
+      },
+      "name": "Detection Overview",
+      "styleSettings": {
+        "margin": "0",
+        "padding": "0"
+      },
+      "id": "3f2cc277-9eb3-486d-a1f8-9fa5374a3d80"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Malware detection insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **malware threat** (such as viruses, spyware, or ransomware) within its **URLs** or **attachments**."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "2"
+      },
+      "name": "text - 13",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "81f28ffc-b69e-4960-a61c-cac17a012ed6"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "//KPI summary of inbound email malware detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet mal = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Malware\";\r\nlet inbox = mal | where DeliveryLocation has \"Inbox\";\r\nlet malTrend = toscalar(mal | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(mal | summarize count()), Details = \"Malware Emails\", Ord = 1, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = malTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+        "size": 3,
+        "showAnalytics": true,
+        "timeContextFromParameter": "TimeRange",
+        "queryType": "advancedHunting",
+        "visualization": "tiles",
+        "tileSettings": {
+          "titleContent": {
+            "columnMatch": "Details",
+            "formatter": 1
+          },
+          "leftContent": {
+            "columnMatch": "Count",
+            "formatter": 12,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            },
+            "numberFormat": {
+              "unit": 17,
+              "options": {
+                "style": "decimal",
+                "maximumFractionDigits": 1
+              }
+            }
+          },
+          "secondaryContent": {
+            "columnMatch": "Trend",
+            "formatter": 21,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            }
+          },
+          "showBorder": true,
+          "size": "auto"
+        }
+      },
+      "customWidth": "100",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "2"
+      },
+      "name": "malware kpi strip",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "20c06dd3-5025-4b2b-960e-ff012f5d2343"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detection Trends, Threat Classes, and Malware Names\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend, threat classes and Malware types. \r\n<br><br>**Recommended action:** If malware volume spikes, confirm Safe Attachments (Block mode) is enabled for all users and investigate the top malware families below."
+            },
+            "name": "text - 14",
+            "id": "1f09c6ec-b2de-4aa9-bd8e-81d11c92ebd4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detection Trend\r\n**This visual displays a per-{Granularity} trend of email malware detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for malware threats.**"
+            },
+            "name": "text - Malware Trend header",
+            "id": "e90b714f-de84-4571-9a60-b3b2f3bd09dd"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize MalwareDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareDetections = coalesce(MalwareDetections, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "MalwareDetections",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 0",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "350d0aa3-c093-4105-a150-c20111ac2912"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detection Trend - Advanced Threats\r\n**Not all threats are going to be easily recognisable, that's why Microsoft Defender for Office 365 has advanced threat detection methods, that use virtual sandbox environments to detonate URLs and Files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Malware detections of these advanced threats**"
+            },
+            "name": "text - Malware Advanced Threats header",
+            "id": "12e07248-ada4-41d9-99cc-824eb65cff79"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod in ('File detonation','URL detonation')\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "File detonation",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "URL detonation",
+                    "color": "orangeDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 9",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "ebcb6f29-02be-4dd0-b792-cd99285c29d4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detections by Threat Classification\r\n**Summary of email messages detected by Microsoft Defender for Office 365 as malware, grouped by type of malware (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware).**"
+            },
+            "customWidth": "33",
+            "name": "text - 15",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "5638fc51-0830-4675-87d4-82f03df17bbf"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top Attacked Users by Malware Threat Classification\r\n**Displays the recipient most frequently targeted for each malware type (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware) in inbound email detections.**"
+            },
+            "customWidth": "33",
+            "name": "text - 15 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "d2e3903b-4984-40da-a437-3d6a2b121e23"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detections by Threat Name\r\n**Summarises email messages flagged by Microsoft Defender for Office 365, grouped by specific malware names detected in URLs or attachments.**"
+            },
+            "customWidth": "33",
+            "name": "text - 15 - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "6c0bebcf-9838-4385-ab3a-30db6c994284"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections summarizing the data by threat classification of the malware threat in the message.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has 'Malware' and ThreatClassification  has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count(Key) by ThreatClassification\r\n| sort by Count desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "chartSettings": {
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "33",
+            "name": "query - 11",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "acb98530-8e3a-4383-b42f-8fd74b1c3fbe"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises Malware detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Malware\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Count desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "TopEmailCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "statSettings": {
+                "valueField": "RecipientEmailAddress",
+                "valueAggregation": "None",
+                "colorSettings": {
+                  "type": "static",
+                  "mode": "background",
+                  "heatmapPalette": "greenRed",
+                  "thresholdsGrid": []
+                },
+                "iconSettings": {
+                  "thresholdsGrid": []
+                },
+                "tagText": "",
+                "valueFontStyle": "auto"
+              },
+              "chartSettings": {
+                "xAxis": "RecipientEmailAddress"
+              }
+            },
+            "customWidth": "33",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 5 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "d9b46c97-91ce-4d64-aca6-3126ac49c0ff"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.\r\nEmailEvents \r\n| where isnotempty(ThreatNames) and ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand ThreatName = split(ThreatNames, \",\") to typeof(string)\r\n| where isnotempty(ThreatName)\r\n| distinct Key, ThreatName\r\n| summarize Count = count() by ThreatName\r\n| top 15 by Count\r\n| project ['Threat Name'] = ThreatName, Count",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Count",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "xAxis": "ThreatNames",
+                "yAxis": [
+                  "count_"
+                ],
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "33",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 3",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b9a4b34f-f54f-4d6e-bb20-81925d0f5540"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "2"
+      },
+      "name": "group - 3",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "82853a93-e11f-4e4a-80f4-733850a1d3ff"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detections by Delivery Location, Detection Technology and Sender Infrastructure Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Malware. \r\n<br><br>**Recommended action:** For sender IPs or countries you do not do business with, consider connection filtering or geo-based rules; verify the detection technologies catching these are enabled."
+            },
+            "name": "banner - Malware Delivery Detection Sender",
+            "id": "cba6403d-e2b1-4fe8-af52-57e5c2aa8e54"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detections by delivery location\r\n**Visualizes counts (per {Granularity}) of malware detections of inbound emails by delivery location: Quarantine or Failed (rejected with or without NDR)**"
+            },
+            "name": "text - Malware Delivery Location header",
+            "id": "95be7f48-40eb-4154-91d8-20f7033f2ff5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware' and EmailDirection == 'Inbound'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalMalwareDetections=count(), Quarantine=countif(DeliveryLocation == 'Quarantine'), Failed=countif(DeliveryLocation == 'Failed') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalMalwareDetections=coalesce(TotalMalwareDetections,0), Quarantine=coalesce(Quarantine,0), Failed=coalesce(Failed,0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "TotalMalwareDetections",
+                    "color": "blue"
+                  },
+                  {
+                    "seriesName": "Quarantine",
+                    "color": "orangeDark"
+                  },
+                  {
+                    "seriesName": "Failed",
+                    "color": "redDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 10",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b2c19e58-2123-490b-9631-c0b238c582e6"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detections by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Malware detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+            },
+            "name": "text - Malware Detection Technology header",
+            "id": "f3c2691e-4f32-4109-9524-8a11719e4425"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "66",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 8",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "f00c1ce0-e55e-44c0-8bf0-4af662ccef89"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nEmailEvents \r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod)\r\n| sort by Count desc\r\n| project ['Detection Technology'] = MalwareMethod, ['Detections'] = Count",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "34",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 2",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "590880a9-1cf7-44ae-b4de-2f65bc700b5d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Malware, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+            },
+            "name": "text - Malware Geo Location header",
+            "id": "19d78b48-af58-4bee-abfe-57efb1eba125"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_",
+              "size": 0,
+              "showAnalytics": true,
+              "title": "Malware Detections-Sender Heatmap (IPv4)",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "map",
+              "gridSettings": {
+                "sortBy": [
+                  {
+                    "itemKey": "count_",
+                    "sortOrder": 2
+                  }
+                ]
+              },
+              "sortBy": [
+                {
+                  "itemKey": "count_",
+                  "sortOrder": 2
+                }
+              ],
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "locInfoColumn": "GeoInfo",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "none"
+                }
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 1",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "8cb46ec0-ac2a-41d1-bf8a-0b8585d1fefc"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Malware Emails'] = count_\r\n| sort by ['Malware Emails'] desc\r\n\r\n\r\n",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Malware Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": [],
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "locInfoColumn": "GeoInfo",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "red"
+                }
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - 1 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b6a0355a-2b8f-48a5-8edc-58f4f7f8180a"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "2"
+      },
+      "name": "Malware-Detectiontech-Deliverylocation-SendingInfra",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "2692cb5e-825c-45c1-bd3a-096b55e8d760"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malware Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders. \r\n<br><br>**Recommended action:** Apply the Strict preset security policy to the most-attacked users and consider adding persistent malicious sender domains to the Tenant Allow/Block List."
+            },
+            "name": "banner - Malware Top Users Senders",
+            "id": "bc5b37a4-71e4-4a2f-b0ba-b3dd87333391"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detections top attacked users\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Malware. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+            },
+            "customWidth": "100",
+            "name": "text - Malware Top Users header",
+            "id": "cb87a026-ad03-45cc-887e-ab460490d9a5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total inbound emails with Malware detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(ThreatTypes has \"Malware\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Malware Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - Malware Top Recipients",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "e7ffef62-f85e-4188-8ab9-d90a5c666c30"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Sender Domains with Malware Detections (Inbound)\r\n**Displays the top 10 sender domains sending inbound emails detected as Malware. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**"
+            },
+            "customWidth": "100",
+            "name": "text - Malware Top Senders header",
+            "id": "93390807-25b2-4bea-9648-98e821da8ec6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Malware Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal",
+                        "useGrouping": false
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "BadEmailCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "2"
+            },
+            "name": "query - Malware Top Sender Domains",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "eaa45734-2df2-4a5e-b35b-1295e00cb46f"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "2"
+      },
+      "name": "MalwareTopAttackedUser-TopSenders",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "4e0900ab-e7e4-4cf1-93a4-7e86bca20782"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Phishing Detection Insights\r\n\r\n---\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Phishing threat** within its **email content**, **URLs**, or **attachments**."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "3"
+      },
+      "name": "text - 24",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "fe82d665-fa9e-4fc2-9ba9-7e2eabb9a04b"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "//KPI summary of inbound email phishing detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet ph = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Phish\";\r\nlet inbox = ph | where DeliveryLocation has \"Inbox\";\r\nlet phTrend = toscalar(ph | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(ph | summarize count()), Details = \"Phish Emails\", Ord = 1, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = phTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+        "size": 3,
+        "showAnalytics": true,
+        "timeContextFromParameter": "TimeRange",
+        "queryType": "advancedHunting",
+        "visualization": "tiles",
+        "tileSettings": {
+          "titleContent": {
+            "columnMatch": "Details",
+            "formatter": 1
+          },
+          "leftContent": {
+            "columnMatch": "Count",
+            "formatter": 12,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            },
+            "numberFormat": {
+              "unit": 17,
+              "options": {
+                "style": "decimal",
+                "maximumFractionDigits": 1
+              }
+            }
+          },
+          "secondaryContent": {
+            "columnMatch": "Trend",
+            "formatter": 21,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            }
+          },
+          "showBorder": true,
+          "size": "auto"
+        }
+      },
+      "customWidth": "100",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "3"
+      },
+      "name": "phish kpi strip",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "5debf0b8-4384-485b-8a7f-71ead592718a"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%;\">Phishing Detection Trend, LLM Content Analysis, Advanced Threats, and Threat Classes\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends, advanced threat detections, LLM-based content analysis, and threat classes.<br><br>**Recommended action:** Review the LLM-classified phishing themes; enable Safe Links and impersonation protection, and prioritise awareness training on the dominant lure types."
+            },
+            "name": "text - Phish Section1 Banner",
+            "id": "ce5e489f-c83b-4bc8-9e63-b08dfb5ef31f"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detection Trend<br>\r\n\r\n**This visual displays a per-{Granularity} trend of email Phish detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Phish threats.**"
+            },
+            "name": "text - Phish Trend Header",
+            "id": "429ef4d2-61a9-40d0-940f-2212ddce22ce"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\"\r\n| summarize PhishDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, PhishDetections = coalesce(PhishDetections, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "PhishDetections",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b0d170ec-331c-4ad0-8ce6-258704cc5345"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detection Trend - Advanced Threats<br>\r\n\r\n**Not all threats are easily recognizable, which is why Microsoft Defender for Office 365 uses advanced detection methods, including virtual sandbox environments to detonate URLs and files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Phish detections of these advanced threats.**"
+            },
+            "name": "text - Phish AdvThreats Header",
+            "id": "425476e0-066a-42ee-afb9-5dabc612a3c8"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| project Timestamp, RecipientEmailAddress, NetworkMessageId, DT=parse_json(DetectionMethods)\r\n| evaluate bag_unpack(DT)\r\n| summarize [\"File detonation\"]=countif(Phish has 'File detonation' and Phish !has 'File detonation reputation'), [\"URL detonation\"]=countif(Phish has 'URL detonation' and Phish !has 'URL detonation reputation') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"File detonation\"]=coalesce([\"File detonation\"],0), [\"URL detonation\"]=coalesce([\"URL detonation\"],0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "URL detonation",
+                    "color": "orangeDark"
+                  },
+                  {
+                    "seriesName": "File detonation",
+                    "color": "redDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish AdvThreats Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "6b62347a-b162-49e6-891c-07697af22dd9"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections - LLM content analysis<br>\r\n\r\n**Microsoft Defender for Office 365 uses Language AI for Phish and Business Email Compromise (BEC) detection. These models are progressively learning from thousands of real-world phishing attempts and analyzing all messages classified as phish. Furthermore, it incorporates advanced Machine Learning and Natural Language Processing (NLP) techniques to read, process, and understand email content the way a human analyst might, yet in a fraction of the time and at a large scale. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-defender-for-office-365s-language-ai-for-phish-enhancing-email-securit/4410446)**"
+            },
+            "customWidth": "50",
+            "name": "text - Phish LLM Content Header",
+            "id": "c23460b1-e025-4f6c-b2d5-3f78c0c9afc6"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections - LLM Threat Classifications<br>\r\n\r\n**Microsoft Defender for Office 365 uses purpose-built Large Language Models (LLM) at scale to provide AI-powered email and collaboration security. Our solution now parses language to understand and identify attacker intent and classifies threats at machine speed – keeping malicious emails out of your inbox and giving security operations (SOC) teams a new level of insight into adversary techniques. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-ignite-redefining-email-security-with-llms-to-tackle-a-new-era-of-soci/4302421)**"
+            },
+            "customWidth": "50",
+            "name": "text - Phish LLM ThreatClass Header",
+            "id": "1d723c26-501f-4385-9331-957ab7ae5019"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of emails detected as Phish by LLM content analysis detection technology in Microsoft Defender for Office 365. \r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and DetectionMethods contains \"LLM content analysis\"\r\n| summarize count()\r\n| sort by count_ desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "stat",
+              "statSettings": {
+                "valueAggregation": "None",
+                "colorSettings": {
+                  "type": "thresholds",
+                  "mode": "foreground",
+                  "thresholdsGrid": [
+                    {
+                      "operator": ">",
+                      "thresholdValue": "0",
+                      "representation": "red"
+                    },
+                    {
+                      "operator": "<=",
+                      "thresholdValue": "0",
+                      "representation": "red"
+                    }
+                  ]
+                },
+                "iconSettings": {
+                  "thresholdsGrid": []
+                },
+                "tagText": "",
+                "valueFontStyle": "auto",
+                "tagTextPosition": "bottom"
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish LLM Content Count",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "86a301c5-2bc0-436a-982c-861beee7c9ab"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections summarizing the data by intent of the message.\r\n// Microsoft Defender for Office 365 LLM analysis is analyzing email messages to understand the intent of the messages. These threat classifications are then used in filtering decisions.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and ThreatClassification  has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize count() by ThreatClassification\r\n| sort by count_ desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "chartSettings": {
+                "yAxis": [
+                  "count_"
+                ],
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish LLM ThreatClass Pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "d547b730-f174-4f78-8998-02f24453304e"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top Attacked Users by LLM Threat classes (Phish)<br>\r\n\r\n**Displays recipients most frequently targeted by inbound phishing emails, grouped by threat classification (e.g., Gift Card, Invoice, Payroll). Helps identify users at higher risk for phishing attacks. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish LLM TopUsers Header",
+            "id": "4ba9d9eb-d88d-4e5d-ba58-a740559677f7"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises Phish detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Emails desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "80px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish LLM TopUsers",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "51599ab2-db69-4195-b4e9-2828729ec35b"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "3"
+      },
+      "name": "group - 5",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "25c47f6a-3525-435e-90cf-357f02fb2fed"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections by Delivery location, Detection technology and Sender infrastructure insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Phish detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Phish.<br><br>**Recommended action:** Verify anti-phishing and Safe Links policies cover these delivery paths; consider blocking sender infrastructure from regions you do not operate in, where appropriate."
+            },
+            "name": "text - Phish Section2 Banner",
+            "id": "6876063e-6a4f-48ea-829d-4486922783dd"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections by delivery location<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various delivery locations: Quarantine, Junk folder or Failed (rejected with or without NDR)**"
+            },
+            "name": "text - Phish DeliveryLoc Header",
+            "id": "b5045aab-1b4b-4d35-af41-a6315d36e864"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.\r\n//The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\" and EmailDirection == \"Inbound\"\r\n| summarize TotalPhishDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalPhishDetections=coalesce(TotalPhishDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "Quarantine",
+                    "color": "greenDark"
+                  },
+                  {
+                    "seriesName": "Failed",
+                    "color": "green"
+                  },
+                  {
+                    "seriesName": "Dropped",
+                    "color": "green"
+                  },
+                  {
+                    "seriesName": "Junk folder",
+                    "color": "orangeDark"
+                  },
+                  {
+                    "seriesName": "Inbox",
+                    "color": "redBright"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish DeliveryLoc Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "e839848c-d176-4251-bbb4-1c2e1103ed2d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish detections by Detection Technology<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+            },
+            "name": "text - Phish DetTech Header",
+            "id": "149bf1b3-80cc-4e82-ae5d-ddee0f6b0cd9"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls in Microsoft Defender for Office 365.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "createOtherGroup": 15
+              }
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish DetTech Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b0b16329-e1a6-4138-871e-76d57a60b978"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections summarized by individual Phish detection technology/control in Microsoft Defender for Office 365.\r\n//Each detection technology is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\n//The where clause excludes deliveries to the SecOps Mailbox and by the Phish Simulation system.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish DetTech Pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "5270ba04-599f-4940-805b-687f7475bc70"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections by SenderIPv4 Geo Location<br>\r\n\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+            },
+            "name": "text - Phish Geo Header",
+            "id": "ddd0c12f-1bb1-4d7d-afb4-f28bcfcd7c4b"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address (SenderIPv4).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "none"
+                }
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish Geo Map",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "85ea7223-7d77-43f5-b0d9-e0de7c898758"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Phish' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Phish Emails'] = count_\r\n| sort by ['Phish Emails'] desc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Phish Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              },
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "red"
+                }
+              }
+            },
+            "customWidth": "50",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish Country Table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "f561209b-15a6-442e-af10-63e375088209"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "3"
+      },
+      "name": "group - 25- Phish delivery locations-detecion tech-sender infra",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "10f3e3eb-b330-4955-952e-01eff69405e9"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Enroll the most-targeted users in security awareness training and consider blocking persistent phishing sender domains."
+            },
+            "name": "text - Phish Section3 Banner",
+            "id": "f46ed4a8-e2b5-4ccd-ae38-efc571bfc791"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections top attacked users\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Phish. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish TopUsers Header",
+            "id": "96d9b543-070a-42d4-bbed-3f5cf79ca7ce"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total inbound emails with Phish detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),PhishEmailCount = countif(ThreatTypes has \"Phish\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount !=0\r\n| top 15 by PhishEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Phish Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish TopRecipients Table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "25100115-78d3-4144-b44e-613b44f02484"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Sender Domains with Phish Detections (Inbound)\r\n**Displays the top 10 sender domains sending inbound emails detected as Phish. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish TopSenders Header",
+            "id": "e7fcb7fe-4bca-4153-a9b0-8ded135b1c64"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain), now including the Phish confidence split (High/Normal) and the aggregated phish detection methods seen per domain. Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\r\n| extend PhishMethods = parse_json(DetectionMethods).Phish\r\n| summarize TotalEmailCount = count(),\r\n            PhishEmailCount = countif(ThreatTypes has \"Phish\"),\r\n            Phish_High = countif(ThreatTypes has \"Phish\" and PhishConf == \"High\"),\r\n            Phish_Normal = countif(ThreatTypes has \"Phish\" and PhishConf == \"Normal\"),\r\n            PhishMethodSet = make_set_if(PhishMethods, ThreatTypes has \"Phish\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount != 0\r\n| top 15 by PhishEmailCount\r\n| mv-apply S = PhishMethodSet on ( mv-expand m = S to typeof(string) | summarize Methods = make_set(m) )\r\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound, ['Detection Methods'] = strcat_array(Methods, \", \")",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Phish Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Phish (High)",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Phish (Normal)",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "BadEmailCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "3"
+            },
+            "name": "query - Phish TopSenders Table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "717bfce8-b5d4-4900-99db-4ba0c503591d"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "3"
+      },
+      "name": "group - 26-PhishDetectionsTopattackedusers-topsenders",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "553afca2-caa1-45b1-bec0-dca426b5be46"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Spam Detection Insights\r\n\r\n---\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Spam threat** within its **email content**, **URLs**, or **attachments**."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "4"
+      },
+      "name": "text - Spam Tab Intro",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "a693a05a-a772-4ac4-9863-07ad0d1b7092"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "//KPI summary of inbound email spam detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet sp = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Spam\";\r\nlet junk = sp | where DeliveryLocation has \"Junk\";\r\nlet spTrend = toscalar(sp | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet junkTrend = toscalar(junk | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(sp | summarize count()), Details = \"Spam Emails\", Ord = 1, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = spTrend),\r\n(print Count = toscalar(junk | summarize count()), Details = \"Sent to Junk\", Ord = 4, Trend = junkTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+        "size": 3,
+        "showAnalytics": true,
+        "timeContextFromParameter": "TimeRange",
+        "queryType": "advancedHunting",
+        "visualization": "tiles",
+        "tileSettings": {
+          "titleContent": {
+            "columnMatch": "Details",
+            "formatter": 1
+          },
+          "leftContent": {
+            "columnMatch": "Count",
+            "formatter": 12,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            },
+            "numberFormat": {
+              "unit": 17,
+              "options": {
+                "style": "decimal",
+                "maximumFractionDigits": 1
+              }
+            }
+          },
+          "secondaryContent": {
+            "columnMatch": "Trend",
+            "formatter": 21,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            }
+          },
+          "showBorder": true,
+          "size": "auto"
+        }
+      },
+      "customWidth": "100",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "4"
+      },
+      "name": "spam kpi strip",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "cadd5331-1db8-4ac8-bc99-42cd5227ee51"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detection Effectiveness and Trends\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Effectiveness and per-{Granularity} trend. For effectiveness, we consider messages reported by your admins and decisions made post-delivery.<br><br>**Recommended action:** If legitimate mail is marked as spam, review the Spam and Bulk thresholds; if spam is leaking through, tighten them."
+            },
+            "name": "text - Spam Section1 Banner",
+            "id": "1093f3b6-cea7-4f54-9029-f9aadd79ca9f"
+          },
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "//This query calculates the effectiveness of spam detections without edge data.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n            EmailEvents\r\n            | where Timestamp between (minTime ..maxTime )\r\n            | where ThreatTypes contains \"Spam\"\r\n            | project NetworkMessageId, ThreatTypes)\r\n            on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint\r\nEffectiveness_PostDelivery = abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))/(toreal(toscalar(_Spam_Mailflow))+toreal(toscalar(_FN_ZAP_Successful_Spam))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))+toreal(toscalar(_FN_Admin_Submissions_SPM))-toreal(toscalar(_SPAM_ZAP_FP)))*100-100),2))",
+                    "size": 1,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "stat",
+                    "statSettings": {
+                      "valueAggregation": "None",
+                      "colorSettings": {
+                        "type": "thresholds",
+                        "mode": "foreground",
+                        "heatmapPalette": "greenRed",
+                        "thresholdsGrid": [
+                          {
+                            "operator": ">",
+                            "thresholdValue": "95",
+                            "representation": "green"
+                          },
+                          {
+                            "operator": "<=",
+                            "thresholdValue": "95",
+                            "representation": "orange"
+                          },
+                          {
+                            "operator": "<=",
+                            "thresholdValue": "90",
+                            "representation": "red"
+                          }
+                        ]
+                      },
+                      "iconSettings": {
+                        "thresholdsGrid": []
+                      },
+                      "numberFormatSettings": {
+                        "unit": 1,
+                        "options": {
+                          "style": "decimal"
+                        }
+                      },
+                      "tagText": "Spam Effectiveness (without Edge data)",
+                      "valueFontStyle": "superLarge",
+                      "tagTextPosition": "bottom"
+                    }
+                  },
+                  "customWidth": "50",
+                  "name": "query - Spam Effectiveness Stat",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "036851c1-489e-4fda-8059-850c161578b3"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "let minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n            EmailEvents\r\n            | where Timestamp between (minTime ..maxTime )\r\n            | where ThreatTypes contains \"Spam\"\r\n            | project NetworkMessageId, ThreatTypes)\r\n            on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint StatisticName=\"Spam Mailflow Minus FPs\", Value=toreal((toscalar(_Spam_Mailflow)) - toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Admin FNs Submitted\", Value=toreal(toscalar(_FN_Admin_Submissions_SPM)))\r\n| union (print StatisticName=\"Spam FPs Reverse Zapped\", Value=toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Zapped Successfully\", Value=toreal(toscalar(_FN_ZAP_Successful_Spam)))\r\n| union (print StatisticName=\"Spam NotZapped\", Value=toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))\r\n| union (print StatisticName=\"Spam Effectiveness Post Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2)))\r\n| union (print StatisticName=\"Spam Effectiveness Pre-Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + (toscalar(_FN_ZAP_Successful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2 )))\r\n| project ['Statistic'] = StatisticName, Value",
+                    "size": 0,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "table",
+                    "tileSettings": {
+                      "showBorder": false,
+                      "titleContent": {
+                        "columnMatch": "StatisticName",
+                        "formatter": 1
+                      },
+                      "leftContent": {
+                        "columnMatch": "Value",
+                        "formatter": 12,
+                        "formatOptions": {
+                          "palette": "auto"
+                        },
+                        "numberFormat": {
+                          "unit": 17,
+                          "options": {
+                            "maximumSignificantDigits": 3,
+                            "maximumFractionDigits": 2
+                          }
+                        }
+                      }
+                    },
+                    "gridSettings": {
+                      "formatters": [
+                        {
+                          "columnMatch": "Value",
+                          "formatter": 0,
+                          "numberFormat": {
+                            "unit": 17,
+                            "options": {
+                              "style": "decimal",
+                              "maximumFractionDigits": 2
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "customWidth": "50",
+                  "name": "query - Spam Effectiveness Table",
+                  "styleSettings": {
+                    "margin": "10px",
+                    "padding": "10px"
+                  },
+                  "id": "8d456ea2-f04a-4d71-95c6-fbaad8c2d2f2"
+                }
+              ]
+            },
+            "customWidth": "100",
+            "name": "Spam Effectiveness",
+            "id": "82812b88-e7f7-4be0-9d13-8e7a7d8c0c4e"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Spam Detection Trend<br>\r\n\r\n**This visual displays a per-{Granularity} trend of email Spam detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Spam threats.**"
+            },
+            "name": "text - Spam Trend Header",
+            "id": "b5574a88-430b-4cca-a76e-9a0b07e9da2e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpamDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "SpamDetections",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Spam Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "09b7d330-1683-45c4-ac0e-8141580d13b5"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "4"
+      },
+      "name": "group - 6-Spam-detections-trend",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "25273f47-8201-4565-8815-1d059ee8abb6"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detections by Delivery location, Detection technology, Sender infrastructure and Bulk insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Spam detections delivery locations, detection technologies used for detections, sender infrastructure and Bulk insights in inbound email identified by Microsoft Defender for Office 365 as Spam.<br><br>**Recommended action:** Raise the Bulk Complaint Level (BCL) threshold for noisy sender domains and consider blocking high-volume, low-value bulk senders where appropriate."
+            },
+            "name": "text - Spam Section2 Banner",
+            "id": "b82f442b-a3a0-44f7-82df-2fd4a9594992"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Spam Detections by delivery location<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various delivery locations Quarantine, Junk folder or Failed (rejected with or without NDR)**"
+            },
+            "name": "text - Spam DeliveryLoc Header",
+            "id": "a6326d97-56cc-45fb-8019-e0c3346968f2"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\" and EmailDirection == \"Inbound\"\r\n| summarize TotalSpamDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalSpamDetections=coalesce(TotalSpamDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "TotalSpamDetections",
+                    "color": "blue"
+                  },
+                  {
+                    "seriesName": "Quarantine",
+                    "color": "greenDark"
+                  },
+                  {
+                    "seriesName": "Junkfolder",
+                    "color": "orangeDark"
+                  },
+                  {
+                    "seriesName": "Inbox",
+                    "color": "redBright"
+                  },
+                  {
+                    "seriesName": "Failed",
+                    "color": "red"
+                  },
+                  {
+                    "seriesName": "Dropped",
+                    "color": "redDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Spam DeliveryLoc Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "97f89032-34e3-40ff-bb88-42d195aea095"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Spam Detections Detection Technology<br>\r\n\r\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**"
+            },
+            "name": "text - Spam DetTech Header",
+            "id": "935ea90d-8430-49d5-b942-3a7b319a603e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where DetectionMethods has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "100",
+            "name": "query - Spam DetTech Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "f31ec0d1-04e1-4b2b-9b98-27289ca34b84"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spam detections summarized by individual Spam detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Spam (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\"\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Spam DetTech Pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "95e40479-f0bc-41ff-8191-634b606d3632"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Spam Detections by SenderIPv4 Geo Location<br>\r\n\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Spam, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+            },
+            "name": "text - Spam Geo Header",
+            "id": "614d1c3f-df6a-4659-b170-7b466c66d66f"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\" and isnotempty(SenderIPv4)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "locInfoColumn": "SenderIPv4",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "none"
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Spam Geo Map",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "5519d715-dc79-45f8-8ed5-a63a253c45e3"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Spam' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spam Emails'] = count_\r\n| sort by ['Spam Emails'] desc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Spam Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              },
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "locInfoColumn": "SenderIPv4",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "red"
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Spam Country Table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "5078dc24-e8be-4943-98fc-6527968e1e3d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Spam Detections Bulk Insights<br>\r\n\r\n**Displays the distribution of inbound emails across different Bulk Complaint Levels together with Top 10 domains sending Bulk email (grey mail). Helps identify patterns in bulk email complaints and assess potential spam or unwanted message trends.**"
+            },
+            "name": "text - Spam Bulk Header",
+            "id": "cd7b3cbe-a6c1-422c-ab37-4afc26002d5d"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel\r\n| sort by BulkComplaintLevel desc\r\n| project ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blueDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Spam Bulk By Level",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "021c022b-aa67-427d-9e1a-688af7aed5d4"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel, SenderFromDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain'] = SenderFromDomain, ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Spam Bulk By Domain",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b1835e0f-f9ad-44c3-bba4-cf9a9546d09a"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "4"
+      },
+      "name": "group - 28-Spam-Delivery location-Detection technology-Sender infrastructure insights",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "307d3d03-93ae-4c8f-b68b-f833ee7d38e8"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "\r\n<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Spam Detections Top attacked users and top senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Review the most-affected users and the top spam sender domains as possible block-list candidates."
+            },
+            "name": "text - Spam Section3 Banner",
+            "id": "4c34ed7b-86da-4ee1-8a69-f96c213a4340"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Spam Detections top attacked users<br>\r\n\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**"
+            },
+            "customWidth": "100",
+            "name": "text - Spam TopUsers Header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "be708ad5-51fd-4a54-b1bc-f912e12b4a01"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection ==\"Inbound\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),SpamEmailCount = countif(ThreatTypes has \"Spam\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount)* 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Spam Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "40ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal",
+                        "useGrouping": false
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "name": "query - Spam TopRecipients Table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "6e7b357d-6792-41c5-83fc-efae31afe2ee"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Sender Domains with Spam Detections (Inbound)<br>\r\n\r\n**Displays the top 10 sender domains sending inbound emails detected as Spam. Helps identify external sources most frequently associated with spam content for prioritised monitoring and mitigation.**"
+            },
+            "customWidth": "100",
+            "name": "text - Spam TopSenders Header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "1d1bdb8d-9619-488b-935a-3791ad73f096"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(),\r\n            SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Spam Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "40ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "name": "query - Spam TopSenders Table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "253efada-ca89-49c5-b1e3-e42ac005b938"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "4"
+      },
+      "name": "group - 29-Spam Detections Top attacked users and top senders",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "d4cc057f-c9b7-40b9-85d3-52f90767d1f5"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Email Impersonation &amp; BEC Insights\r\n\r\n---\r\nThis tab focuses on the highest-value email threat class: **impersonation and Business Email Compromise (BEC)**. It brings together impersonation and spoof detections, sender authentication (DMARC, DKIM, SPF, CompAuth), supply-chain and partner-compromise correlation, and first-contact / new-vendor senders - the signals that precede targeted financial and credential attacks. It is the email-side companion to the impersonation insights on the **Teams &amp; Collaboration** tab."
+      },
+      "name": "text - impersonation bec description",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "15"
+      },
+      "id": "fda8ccd5-fafc-457a-a6a2-05b504be1023"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "//KPI summary of inbound email impersonation and spoof (BEC) detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet bec = EmailEvents | where EmailDirection == \"Inbound\" | where DetectionMethods has \"Impersonation\" or DetectionMethods has \"Spoof\";\r\nlet inbox = bec | where DeliveryLocation has \"Inbox\";\r\nlet becTrend = toscalar(bec | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(bec | summarize count()), Details = \"Impersonation / Spoof Emails\", Ord = 1, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(SenderFromDomain)), Details = \"Spoofed Sender Domains\", Ord = 3, Trend = becTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+        "size": 3,
+        "showAnalytics": true,
+        "timeContextFromParameter": "TimeRange",
+        "queryType": "advancedHunting",
+        "visualization": "tiles",
+        "tileSettings": {
+          "titleContent": {
+            "columnMatch": "Details",
+            "formatter": 1
+          },
+          "leftContent": {
+            "columnMatch": "Count",
+            "formatter": 12,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            },
+            "numberFormat": {
+              "unit": 17,
+              "options": {
+                "style": "decimal",
+                "maximumFractionDigits": 1
+              }
+            }
+          },
+          "secondaryContent": {
+            "columnMatch": "Trend",
+            "formatter": 21,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            }
+          },
+          "showBorder": true,
+          "size": "auto"
+        }
+      },
+      "customWidth": "100",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "15"
+      },
+      "name": "bec kpi strip",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "91fdd28f-31c4-4f94-b60a-12cd97d44ddf"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Business Email Compromise (BEC) detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Business Email Compromise (BEC) detections Impersonation and Spoof.<br><br>**Recommended action:** Enable mailbox intelligence and impersonation protection for frequently-impersonated users and domains; consider adding confirmed look-alike domains to the Tenant Block List."
+            },
+            "name": "text - Phish BEC Banner",
+            "id": "e3b2232c-8056-4913-a652-64f70e228750"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections - Impersonation detections Trend\r\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Impersonation detection methods by Microsoft Defender for Office 365. Helps track impersonation attack patterns over time.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish BEC Imp Trend Header",
+            "id": "e95667df-3bcd-4023-9e8f-99ed05bc4bf0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Impersonation'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ImpersonationDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "ImpersonationDetections",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish BEC Imp Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "61fa166d-f300-42a6-a324-de18b3fdf4c1"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections - Impersonation detections by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Impersonations.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish BEC Imp Tech Header",
+            "id": "09e1a866-f344-4a92-a3bd-8c3c3c5d598d"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "100",
+            "name": "query - Phish BEC Imp Tech Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "6cd5662f-13b4-4a9b-afe7-0a6343e3ab5c"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Impersonation detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "graphSettings": {
+                "type": 0
+              },
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish BEC Imp Tech Pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "73499618-e842-440e-a555-cd8849093884"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections - Impersonation detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Impersonation, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish BEC Imp Geo Header",
+            "id": "189a1ac1-f275-4697-880b-7ffae1e5d263"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "none"
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish BEC Imp Geo Map",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "574b61ad-ec2d-4517-93c5-d0e9bd14f2e9"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Impersonation Emails'] = count_\r\n| sort by ['Impersonation Emails'] desc",
+              "size": 0,
+              "showAnalytics": true,
+              "title": "Impersonation Detections-Sender Heatmap (IPv4)",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Impersonation Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              },
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "red"
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish BEC Imp Country",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "e53b7dbc-4683-4309-b879-c7be68599159"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections - Spoof detections Trend\r\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Spoof detection methods by Microsoft Defender for Office 365. Helps track Spoofing based attack patterns over time.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish BEC Spoof Trend Header",
+            "id": "8db0f1b0-49bf-43a2-9f9f-164eb9530629"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Spoof'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpoofDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "SpoofDetections",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish BEC Spoof Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "9a308cd9-bf05-4287-b0d5-54636d081a82"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections - Spoof detections Trend by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Spoofing.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish BEC Spoof Tech Header",
+            "id": "28c9c15d-d22f-4412-9efc-868b95082668"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily by various Spoof Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "yAxis": [
+                  "Count"
+                ],
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "[\"Spoof external domain\"]",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "[\"Spoof intra-org\"]",
+                    "color": "orangeDark"
+                  },
+                  {
+                    "seriesName": "[\"Spoof DMARC\"]",
+                    "color": "yellowDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish BEC Spoof Tech Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "1a1328fc-5404-4dff-99ed-3a30082a4cbe"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Spoof detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish BEC Spoof Tech Pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px",
+              "showBorder": true
+            },
+            "id": "f7df9892-85b4-49c3-8739-873b745183a3"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections - Spoof detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Spoofing, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish BEC Spoof Geo Header",
+            "id": "3c83e7f0-5391-4b1a-bb5b-de0d17488efd"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "map",
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "none"
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish BEC Spoof Geo Map",
+            "styleSettings": {
+              "margin": "15px",
+              "padding": "15px"
+            },
+            "id": "122d860c-ab0d-475e-b29e-2955020680c7"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spoof Emails'] = count_\r\n| sort by ['Spoof Emails'] desc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Spoof Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              },
+              "mapSettings": {
+                "locInfo": "LatLong",
+                "latitude": "Latitude",
+                "longitude": "Longitude",
+                "sizeSettings": "count_",
+                "sizeAggregation": "Sum",
+                "labelSettings": "SenderIPv4",
+                "legendMetric": "count_",
+                "legendAggregation": "Sum",
+                "itemColorSettings": {
+                  "nodeColorField": "count_",
+                  "colorAggregation": "Sum",
+                  "type": "heatmap",
+                  "heatmapPalette": "red"
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish BEC Spoof Country",
+            "styleSettings": {
+              "margin": "15px",
+              "padding": "15px"
+            },
+            "id": "9d0111bc-8d01-4a99-9009-645dc02c3bed"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Supply-Chain &amp; Partner Risk (Possible Partner Compromise)\r\n**Correlates the external domains your organization emails most with inbound emails from those same domains that carried threats. A trusted partner or supplier domain suddenly sending threats is a strong signal that the partner may be compromised - a common supply-chain and business email compromise (BEC) vector.**<br><br>**Recommended action:** Verify any flagged partner through a trusted channel before acting on their recent messages, alert them to a possible compromise, and consider tightening inbound policy for that domain until confirmed clean."
+            },
+            "customWidth": "100",
+            "name": "text - Phish Partner Compromise Header",
+            "id": "2c62c576-3b05-4663-ae2e-4f961d7409c6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) \r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Outbound\"\r\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| summarize count() by RecipientDomain\r\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\r\n| join (EmailEvents | where EmailDirection == \"Inbound\" and isempty(ThreatTypes)==false) on SenderFromDomain\r\n| summarize max(OutboundCount),count() by SenderFromDomain\r\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\r\n| extend Bad_Traffic_Percentage = todouble(round(IncomingEmailsWithThreats / todouble(OutboundEmails) * 100, 2))\r\n| top 15 by OutboundEmails\r\n| project ['Sender Domain'] = SenderFromDomain, ['Outbound Emails'] = OutboundEmails, ['Inbound w/ Threats'] = IncomingEmailsWithThreats, ['Bad Traffic %'] = Bad_Traffic_Percentage",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Outbound Emails",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Inbound w/ Threats",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "60ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    },
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish Partner Compromise",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "1aaa047c-1108-4288-833e-61ca35b5495a"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top Recipients Targeted by Impersonation / BEC\r\n**Lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, showing the number of impersonation emails, how many distinct senders were involved, the top spoofed sender domains, and how many of those messages were delivered to the inbox. Helps identify high-risk users (often executives or finance staff) who may need extra protection or awareness.**"
+            },
+            "customWidth": "100",
+            "name": "text - impersonation targets",
+            "id": "b1e7c2a4-9f3d-4a6b-8c12-7d5e9f0a1b23"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top recipients targeted by impersonation / BEC, with distinct senders, spoofed domains and how many landed in the inbox.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| where DetectionMethods has \"Impersonation\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize ImpersonationEmails = count(),\r\n            DistinctSenders      = dcount(SenderFromAddress),\r\n            TopSpoofedDomains    = make_set(SenderFromDomain, 5),\r\n            DeliveredToInbox     = countif(DeliveryLocation has \"Inbox\")\r\n        by RecipientEmailAddress\r\n| top 20 by ImpersonationEmails\r\n| project ['Recipient'] = RecipientEmailAddress, ['Impersonation Emails'] = ImpersonationEmails, ['Distinct Senders'] = DistinctSenders, ['Top Spoofed Domains'] = strcat_array(TopSpoofedDomains, \", \"), ['Delivered to Inbox'] = DeliveredToInbox",
+              "size": 0,
+              "title": "Top Recipients Targeted by Impersonation / BEC",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "showAnalytics": true,
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Impersonation Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "conditionalVisibility": {
+              "parameterName": "Tab",
+              "comparison": "isEqualTo",
+              "value": "15"
+            },
+            "name": "newviz - impersonation targets",
+            "id": "afe28369-af82-47ae-846d-179bd86b660e"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "15"
+      },
+      "name": "group - 7 - Phish-BEC-Insights",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "b7971cd9-d086-47c7-8f66-50956b9c56c3"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Phish Detections Sender Authentication details (DMARC, DKIM, SPF, CompAuth)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain Sender Authentication checks details in inbound email by Microsoft Defender for Office 365 focusing on the various Sender Authentication standards: DMARC, DKIM, SPF, CompAuth.<br><br>**Recommended action:** For domains failing DMARC/DKIM/SPF, verify your own outbound authentication is published and enforced (p=reject), and treat persistent external spoofers as possible block candidates."
+            },
+            "name": "text - Phish Section5 Banner",
+            "id": "90d7a338-d943-4398-b788-bfd4f93007d4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections Sender Authentication Trend (DMARC, DKIM, SPF, CompAuth)\r\n**Shows counts (per {Granularity}) of sender authentication check outcomes (DMARC, DKIM, SPF, CompAuth) performed by Microsoft Defender for Office 365 on inbound emails. Useful for monitoring authentication success and failure patterns over time to identify anomalies or potential phishing risks.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish SenderAuth Trend Header",
+            "id": "4a0ab90e-55dd-4fa6-82c3-0edc57ce0966"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spoof- DMARC fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DMARCFail = (tostring(parse_json(AuthenticationDetails).DMARC) == \"fail\") \r\n| summarize DMARCFail = sum(DMARCFail) by bin (Timestamp,{Granularity})",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "DMARCFail",
+                    "color": "orangeDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish Auth DMARC Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "79920d30-01d4-4412-b994-853e50c9d7d8"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spoof- DKIM fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DKIMFail = (tostring(parse_json(AuthenticationDetails).DKIM) == \"fail\") \r\n| summarize DKIMFail = sum(DKIMFail) by bin (Timestamp,{Granularity})",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "DKIMFail",
+                    "color": "yellowDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish Auth DKIM Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "bf09ffd4-eee0-42f7-a507-1cf54d9c365a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spoof- SPF fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend SPFFail = (tostring(parse_json(AuthenticationDetails).SPF) == \"fail\") \r\n| summarize SPFFail = sum(SPFFail) by bin (Timestamp,{Granularity})",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "SPFFail",
+                    "color": "purpleDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish Auth SPF Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "4d66fe13-9904-45cf-8783-f3ee984f3a66"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spoof- Composite Authentication fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend CompAuthFail = (tostring(parse_json(AuthenticationDetails).CompAuth) == \"fail\") \r\n| summarize CompAuthFail = sum(CompAuthFail) by bin (Timestamp,{Granularity})",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "CompAuthFail",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - Phish Auth CompAuth Trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "0968b828-23fe-4fa2-a5ea-8ab39362457f"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections Top Sender Domains with DMARC Failures (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails where Spoof-DMARC detection triggered. Includes total inbound email volume and calculates DMARC fail traffic percentage per domain to highlight high-risk sources.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish Auth DMARC Domains Header",
+            "id": "24d4689a-eb6d-49f5-85a8-fcadca409f7a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and DMARC fail traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof DMARC\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where DMARCFailCount !=0\r\n| top 10 by DMARCFailCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['DMARC Failures'] = DMARCFailCount, ['Total Inbound'] = TotalEmailCount, ['DMARC Fail %'] = DMARCFail_Traffic_Percentage",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "DMARCFail",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "DMARC Fail %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "40ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish Auth DMARC Domains",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "642814ad-9d24-4be9-ae10-3578e89da05b"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections Top Sender Domains with Spoof External Domain Detections (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof External Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish Auth SpoofExt Domains Header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "993fdc34-354b-412e-be39-facbde4f4f0e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof external domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof external domain\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofExternalCount !=0\r\n| top 10 by SpoofExternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof External'] = SpoofExternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof External %'] = SpoofExternal_Traffic_Percentage",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Spoof External",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Spoof External %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "40ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "SpoofExternalFail",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true,
+                "sortBy": [
+                  {
+                    "itemKey": "Spoof External %",
+                    "sortOrder": 2
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish Auth SpoofExt Domains",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "69ca3799-d2d5-4896-b3a5-1eeba46f0b46"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phish Detections Top Sender Domains with Spoof Internal Domain Detections (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof Internal Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**"
+            },
+            "customWidth": "100",
+            "name": "text - Phish Auth SpoofInt Domains Header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "3fa33c5d-0eba-471f-b47f-0c12c1f770d6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof intra-org\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofInternalCount !=0\r\n| top 10 by SpoofInternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof Internal'] = SpoofInternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof Internal %'] = SpoofInternal_Traffic_Percentage",
+              "size": 3,
+              "showAnalytics": true,
+              "title": "Top 10 Spoof intra-org detections by Sender domain (P1/P2)",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Spoof Internal",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Spoof Internal %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "40ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "SpoofIntraorgFail",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "query - Phish Auth SpoofInt Domains",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "ae0c65c7-68ea-4d50-b177-1effeaf1c045"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "15"
+      },
+      "name": "group - 8-Phish-SenderAuth",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "8077779a-4da8-46be-8032-626bd8c36dbd"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">First-Contact &amp; New-Vendor Senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nExternal email senders and domains seen for the first time in the selected period. New/first-contact relationships - especially ones already carrying threats - are a common precursor to phishing, business email compromise (BEC), and supply-chain attacks.<br><br>**Recommended action:** Treat brand-new domains sending threats as high-priority review; verify any that claim to be a known brand or partner before trusting their messages."
+            },
+            "name": "phish fc banner",
+            "id": "05b83435-c7ed-48a3-919e-388b2e599726"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### First-contact external senders<br>\r\n\r\n**External email senders ordered by when they were first seen in the period (most recent first). In tenants with longer history this highlights genuinely new senders.**"
+            },
+            "customWidth": "100",
+            "name": "phish fc senders header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "c57dffb4-dfdb-4a1e-93be-16fa9e856a0d"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists external email senders seen for the first time in the selected period (most recent first), surfacing new/first-contact senders. In tenants with longer history this highlights genuinely new relationships - a common precursor to BEC and supply-chain attacks.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderFromAddress)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), Messages=count(), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\r\n| top 20 by FirstSeen desc\r\n| project ['Sender']=SenderFromAddress, ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, ['Threat Messages']=ThreatMessages",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Threat Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "phish fc senders table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "d1ceb0ac-2dad-49af-b416-a3376a7b8513"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### New sender domains carrying threats<br>\r\n\r\n**External sender domains seen for the first time in the period that already carried threats, most-recent first. A brand-new domain sending threats to your users is a strong early-warning signal.**"
+            },
+            "customWidth": "100",
+            "name": "phish fc domains header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "bd29bbe4-cde2-499c-a1d0-e2cc51f7733d"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists external sender domains seen for the first time in the selected period that already carried threats, ranked by most-recently first seen. A brand-new domain sending threats to your users is a strong early-warning signal for phishing and BEC.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Messages=count(), Senders=dcount(SenderFromAddress), Recipients=dcount(RecipientEmailAddress), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderDomain\r\n| where ThreatMessages > 0\r\n| top 20 by FirstSeen desc\r\n| project ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, Senders, Recipients, ['Threat Messages']=ThreatMessages, ['Last Seen']=LastSeen",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Senders",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Recipients",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Threat Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "phish fc domains table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "7da952d5-5ae2-4b2e-a5cf-c78b11bda4f8"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "15"
+      },
+      "customWidth": "100",
+      "name": "group - Phish First Contact",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "90e5248a-2c35-48f3-869c-c45c631c6fbf"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# URL Detections and URL Click Insights\r\n\r\n---\r\nThis tab provides insights into **URL-based detections** in email messages and details about URL clicks performed by end users on URLs identified as **malicious**."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "5"
+      },
+      "name": "text - 24 - Copy - Copy",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "2156430d-fec6-48bb-a9a8-3166182f6993"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "//KPI summary of URL threat protection (Safe Links clicks and URLs seen in email) for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet clicks = UrlClickEvents;\r\nlet blocked = clicks | where ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\");\r\nlet allowed = clicks | where ActionType == \"ClickAllowed\";\r\nlet blockedTrend = toscalar(blocked | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet allowedTrend = toscalar(allowed | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet usersTrend = toscalar(clicks | make-series Trend = dcount(AccountUpn) default = 0 on Timestamp step gran | project Trend);\r\nlet urlsTrend = toscalar(EmailUrlInfo | make-series Trend = dcount(Url) default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(blocked | summarize count()), Details = \"Malicious Clicks Blocked\", Ord = 1, Trend = blockedTrend),\r\n(print Count = toscalar(allowed | summarize count()), Details = \"Clicks Allowed Through\", Ord = 2, Trend = allowedTrend),\r\n(print Count = toscalar(clicks | summarize dcount(AccountUpn)), Details = \"Users Clicking Links\", Ord = 3, Trend = usersTrend),\r\n(print Count = toscalar(EmailUrlInfo | summarize dcount(Url)), Details = \"Distinct URLs in Email\", Ord = 4, Trend = urlsTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+        "size": 3,
+        "showAnalytics": true,
+        "timeContextFromParameter": "TimeRange",
+        "queryType": "advancedHunting",
+        "visualization": "tiles",
+        "tileSettings": {
+          "titleContent": {
+            "columnMatch": "Details",
+            "formatter": 1
+          },
+          "leftContent": {
+            "columnMatch": "Count",
+            "formatter": 12,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            },
+            "numberFormat": {
+              "unit": 17,
+              "options": {
+                "style": "decimal",
+                "maximumFractionDigits": 1
+              }
+            }
+          },
+          "secondaryContent": {
+            "columnMatch": "Trend",
+            "formatter": 21,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            }
+          },
+          "showBorder": true,
+          "size": "auto"
+        }
+      },
+      "customWidth": "100",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "5"
+      },
+      "name": "url kpi strip",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "d5e2326a-a5dd-4217-bb75-0e337d75d306"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Insights on URL-Based Threat Detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain URL based threat detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends of URL-based threat detections, QR code detections, and URL scans activity by locations.<br><br>**Recommended action:** Confirm Safe Links is enabled for email and Teams; investigate QR-code and URL detection spikes for emerging campaigns."
+            },
+            "name": "text - 13 - Copy",
+            "id": "ed3468e7-1936-45fd-9168-93010a662302"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Trend of URL-Based Malware Threat Detections<br>\r\n\r\n**This visual displays a per-{Granularity} trend of emails with URL based Malware threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for malware threats.**"
+            },
+            "name": "text - 13 - Copy - Copy",
+            "id": "77e7bbac-d752-478b-bce9-06bb1bd12bfe"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod contains \"URL\"\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "100",
+            "name": "query - 8 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "79ef5e7b-57a6-4519-9899-18fd8cae5e68"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Trend of URL-Based Phish Threat Detections<br>\r\n\r\n**This visual displays a per-{Granularity} trend of emails with URL based Phish threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for Phish threats.**"
+            },
+            "name": "text - 13 - Copy - Copy - Copy",
+            "id": "48923812-5440-4f47-8881-273f14cbfb8e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total emails with Phishing detections over time summarizing the data daily by various Phishing URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Phish'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand PhishMethod = ParsedMethods.Phish\r\n| where PhishMethod contains \"URL\"\r\n| summarize Count = count() by PhishMethod = tostring(PhishMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct PhishMethod | extend d = 1) on d | project Timestamp, PhishMethod\r\n| join kind=leftouter (agg) on Timestamp, PhishMethod\r\n| project Timestamp, PhishMethod, Count = coalesce(Count, 0)\r\n| sort by PhishMethod asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "100",
+            "name": "query - 8 - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b983b361-6c2e-47d5-b2c5-edd9caa6a55d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Trend (per {Granularity}) of QR Code-Based Threat Detections<br>\r\n\r\n**Displays counts (per {Granularity}) of inbound emails containing QR codes flagged for Phish, Malware, or Spam via URL-based detection methods. Helps track QR code abuse patterns over time.**"
+            },
+            "customWidth": "50",
+            "name": "text - 13 - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "3d8b75e1-6e1d-44eb-b1fc-78d3db7feb71"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### URL Scan activity by Location (per {Granularity})<br>\r\n\r\n**Displays counts (per {Granularity}) of URLs scanned from various locations within emails (e.g., body, attachments, QR codes). Helps identify where malicious URLs are most commonly embedded.**"
+            },
+            "customWidth": "50",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b275b28c-e441-4c19-9055-256d5d45c69c"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\" \r\n| where DetectionMethods has \"Url\"\r\n| join EmailUrlInfo on NetworkMessageId\r\n| where UrlLocation == \"QRCode\"\r\n| summarize [\"Phish QR Detection\"]=countif(parse_json(DetectionMethods).Phish has \"URL\"), [\"Malware QR Detection\"]=countif(parse_json(DetectionMethods).Malware has \"URL\"), [\"Spam QR Detection\"]=countif(parse_json(DetectionMethods).Spam has \"URL\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Phish QR Detection\"]=coalesce([\"Phish QR Detection\"],0), [\"Malware QR Detection\"]=coalesce([\"Malware QR Detection\"],0), [\"Spam QR Detection\"]=coalesce([\"Spam QR Detection\"],0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "graphSettings": {
+                "type": 0
+              },
+              "chartSettings": {
+                "xAxis": "Timestamp",
+                "xSettings": {
+                  "dateFormatSettings": {
+                    "formatName": "shortDatePattern",
+                    "showUtcTime": false
+                  }
+                }
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 6",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "6c2a7724-d3c2-42b2-b8da-7acbcd0666c6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises where URL's have been scanned identified from various locations in emails\r\nEmailUrlInfo\r\n| summarize  count() by UrlLocation",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "query - 5",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "5640dbd5-4085-4f2a-8fb9-e4112233e99e"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "5"
+      },
+      "name": "group - 9-URL detections",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "b572d79b-17a0-48ac-9a43-4f20324cf998"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Insights on URL Click-Based Threat Detections\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and explain URL click based threat detections in emails as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend of blocked URL clicks, time-of-click URL scans by workload, malicious clicks allowed, top clicks on malicious URLs, and more.<br><br>**Recommended action:** For blocked-click spikes, verify Safe Links is set to not allow click-through; investigate workloads with high click-through activity."
+            },
+            "name": "text - 13 - Copy - Copy",
+            "id": "6d37617e-911e-4ce6-a10d-4749486738ea"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Trend (per {Granularity}) of Blocked URL Click Events<br>\r\n\r\n**Shows the count (per {Granularity}) of blocked URL click attempts and click attempts on URLs with detections, grouped by threat types (e.g., Phish, Malware, Spam). Helps track user interaction with malicious links over time across various threat types.**"
+            },
+            "name": "text - 13 - Copy - Copy - Copy",
+            "id": "9e477950-bedc-4cc0-9863-df07d124806c"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// Generates a time-series analysis for blocked URL click events from the 'UrlClickEvents' table\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| where ActionType has_any(\"ClickBlocked\")\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, BlockedClicks = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "BlockedClicks",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "66",
+            "name": "query - 4",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "366e80d9-f6ed-43af-91e5-3d04cdcf692d"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of click attempts on URL's with detections split by the different threat types identified\r\nUrlClickEvents\r\n| where isnotempty(ThreatTypes)\r\n| summarize count() by ThreatTypes",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "33",
+            "name": "query - 4",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "a356eac3-62c2-4fc9-a4d9-3b05b13848df"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Trend (per {Granularity}) of URL Click Actions by Type<br>\r\n\r\n**Displays counts (per {Granularity}) of URL click events categorised by action type: Blocked, Allowed, Pending Verdict, Error Page, and Clicked Through. Helps identify risky user behaviour and policy gaps.**"
+            },
+            "customWidth": "66",
+            "name": "text - 13 - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "a91fe7a6-f507-48f7-bbcc-61dc4f998ba6"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### URL Clicks by Workload<br>\r\n\r\n**Displays counts (per {Granularity}) of URL click events grouped by Workload (e.g., Outlook, Teams, Copilot, Office Apps: Word, Excel, PowerPoint) Helps identify which applications are most frequently used for URL interactions and potential risk exposure.**"
+            },
+            "customWidth": "33",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "ce05fa08-6e68-4c02-a0bf-2be6cdfae935"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises different URL click event types by action (e.g., blocked, allowed, pending verdict, error pages, and clicked through), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| summarize ClickBlocked=countif(ActionType has_any(\"ClickBlocked\")), ClickAllowed=countif(ActionType has_any(\"ClickAllowed\")), PendingVerdict=countif(ActionType has_any(\"UrlScanInProgress\")), ErrorPage=countif(ActionType has_any(\"UrlErrorPage\")), ClickedThrough=countif(IsClickedThrough == true) by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickBlocked=coalesce(ClickBlocked,0), ClickAllowed=coalesce(ClickAllowed,0), PendingVerdict=coalesce(PendingVerdict,0), ErrorPage=coalesce(ErrorPage,0), ClickedThrough=coalesce(ClickedThrough,0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "xAxis": "Timestamp"
+              }
+            },
+            "customWidth": "66",
+            "name": "query - 1",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "a12b4c78-7d18-4adc-86e0-54395d6a996a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises where URL clicks scanned by the Workload the click happened from\r\nUrlClickEvents\r\n| summarize  count() by Workload",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "33",
+            "name": "query - 5 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "3237cd55-1d5c-41a9-a8f2-1d46c61a709e"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Blocked URL Clicks by Workload (per {Granularity})<br>\r\n\r\n**Displays counts (per {Granularity}) of blocked URL click attempts grouped by Workload (Email, Teams, Office, Microsoft 365 Copilot). Helps identify which platforms are most exposed to malicious link interactions and where user awareness or policy enforcement should be strengthened.**"
+            },
+            "customWidth": "66",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "1f209a83-3d50-4bb8-9a79-a365a50a4142"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Click-Through Activity on Detected URLs by Workload<br>\r\n\r\n**Displays counts of click‑through actions on URLs already identified with detections, grouped by Workload where the click happened. Helps identify clients/platforms where users are most likely to proceed to risky URLs and prioritise awareness training or policy tuning for those workloads**"
+            },
+            "customWidth": "33",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "33592db8-0ff5-4d8e-bd8f-0201b81a4584"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises blocked URL click event types by Workload (e.g., Email, Teams, Office, Microsoft 365 Copilot), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where ActionType ==\"ClickBlocked\"\r\n| summarize Teams=countif(Workload==\"Teams\"), Office=countif(Workload==\"Office\"), Email=countif(Workload==\"Email\"), Copilot=countif(Workload==\"Copilot\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Teams=coalesce(Teams,0), Office=coalesce(Office,0), Email=coalesce(Email,0), Copilot=coalesce(Copilot,0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "66",
+            "name": "query - 3",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "80241767-0f69-4e2e-9889-3bf1f48e4f02"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of click-through activities on URL's with detections split by the source client\r\nUrlClickEvents \r\n| where IsClickedThrough !=\"0\"\r\n| where isnotempty(ThreatTypes) \r\n| summarize count() by Workload",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "33",
+            "name": "query - 2",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "fde29b46-2896-4bfc-bb61-09436696d738"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top clicks on Malicious URLs<br>\r\n\r\n**Displays the top 20 URLs associated with detections that registered the highest number of clicks. Includes ThreatTypes, ActionType, and Workload to provide context on the nature of the threat and where user interaction occurred.**"
+            },
+            "customWidth": "100",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "22bda63a-626c-47de-9a76-ad665ef87862"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows the top 20 URL's that have a detection associated with the most ammount of clicks registered \r\nUrlClickEvents\r\n| where ThreatTypes !=\"\"\r\n| summarize count() by Url, ThreatTypes, ActionType, Workload\r\n| top 20 by count_\r\n| project ['URL']=Url, ['Threat Types']=ThreatTypes, ['Action Type']=ActionType, Workload, ['Click Count']=count_",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Click Count",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "query - 10 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "a044fd4e-7be6-4a11-974c-b54e417c2a81"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "5"
+      },
+      "name": "group - 31-URL clicks",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "75e543f6-08c0-42ed-9869-ecd61b721d34"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Risky Users Clicking on URLs with Threats\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track and identify users who have clicked on malicious URLs detected by Microsoft Defender for Office 365.<br><br>**Recommended action:** Enroll these users in security awareness training and verify Safe Links policy coverage for their mailboxes."
+            },
+            "name": "text - 13 - Copy - Copy - Copy",
+            "id": "19487811-a94b-4537-877e-61ac7e287c21"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Users Clicking on URLs with Malware Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Malware. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+            },
+            "customWidth": "100",
+            "name": "text - 13 - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "78e10621-0e98-44c4-8399-810c19f138c2"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top 10 users with click attempts on URL's with malware detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),MalwareClickCount = countif(ThreatTypes has \"Malware\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(MalwareClickCount / todouble(TotalClickCount) *100, 2))\r\n| where MalwareClickCount !=0\r\n| sort by MalwareClickCount desc\r\n| top 15 by MalwareClickCount\r\n| project ['User']=AccountUpn, ['Malware Clicks']=MalwareClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Malware Clicks",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "25ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Clicks",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "20ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Click %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "25ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "MalwareEmailCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "TotalEmailCount",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "name": "query - 18 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "a7ae8a75-ca7f-49be-8cad-d1451a3bd396"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Users Clicking on URLs with Phish Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Phish. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+            },
+            "customWidth": "100",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "90d9a0c3-970a-4998-be62-3b3b84bb0f37"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top 10 users with click attempts on URL's with Phish detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),PhishClickCount = countif(ThreatTypes has \"Phish\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(PhishClickCount / todouble(TotalClickCount) *100, 2))\r\n| where PhishClickCount !=0\r\n| sort by PhishClickCount desc\r\n| top 15 by PhishClickCount\r\n| project ['User']=AccountUpn, ['Phish Clicks']=PhishClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Phish Clicks",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "25ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Clicks",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "20ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Click %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "25ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "MalwareClickCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "MalwareEmailCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "TotalEmailCount",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "name": "query - 18 - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "d46877d9-03af-463a-b406-bb4c601dffeb"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Users Clicking on URLs with Spam Threat<br>\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Spam. Helps identify individuals at greater risk and prioritise targeted security awareness training.**"
+            },
+            "customWidth": "100",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "dc66e020-0932-4346-8e20-6a2dc78de7a9"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top 10 users with click attempts on URL's with Spam detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),SpamClickCount = countif(ThreatTypes has \"Spam\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(SpamClickCount / todouble(TotalClickCount) *100, 2))\r\n| where SpamClickCount !=0\r\n| sort by SpamClickCount desc\r\n| top 15 by SpamClickCount\r\n| project ['User']=AccountUpn, ['Spam Clicks']=SpamClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Spam Clicks",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "25ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Clicks",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "20ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Click %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "25ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "PhishClickCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "MalwareClickCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "MalwareEmailCount",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "TotalEmailCount",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad_Traffic_Percentage_Inbound",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "count_",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "50ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "sortBy": []
+            },
+            "customWidth": "100",
+            "name": "query - 18 - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "734ee45e-4dff-4ca1-b17d-02389086b17b"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "5"
+      },
+      "name": "group - 32-Top clickers",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "ee6c3413-28be-49a1-a89d-bf5fce7acfa4"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Microsoft Teams Collaboration Protection\r\n\r\n---\r\nAs email defenses mature, attackers are shifting into **Microsoft Teams**, where messages bypass secure email gateways and carry the implicit trust of a colleague chat. Microsoft Threat Intelligence reports Teams-based phishing and voice phishing (vishing) rising steadily through 2026, most often as **IT help desk or technical-support impersonation** from external or newly-created tenants, used to steer users toward remote-access tools and credential theft.\r\n\r\nThis tab shows **Microsoft Defender for Office 365** protection for Microsoft Teams: threat detections and impersonation, suspicious external senders, malicious URLs and clicks, malicious files, post-delivery ZAP removals, and user and admin submissions across chats and channels.\r\n\r\n**Recommended action:** Treat unsolicited external help desk or IT support contact as suspicious. Restrict inbound chat from unmanaged and consumer tenants, allowlist trusted external domains, remove or restrict remote-support tools such as Quick Assist where they are not required, and enforce phishing-resistant MFA for all users (Conditional Access with authentication strength), prioritizing privileged and administrator accounts first.\r\n\r\n[<p><b>Disrupting threats targeting Microsoft Teams</b></p>](https://www.microsoft.com/en-us/security/blog/2025/10/07/disrupting-threats-targeting-microsoft-teams/)[<p><b>Cross-tenant helpdesk impersonation to data exfiltration: a human-operated intrusion playbook</b></p>](https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/)[<p><b>Help on the line: how a Microsoft Teams support call led to compromise</b></p>](https://www.microsoft.com/en-us/security/blog/2026/03/16/help-on-the-line-how-a-microsoft-teams-support-call-led-to-compromise/)[<p><b>Email threat landscape: Q2 2026 trends and insights</b></p>](https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/)"
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "text - teams description",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "5c0f0100-0a11-4b22-9c33-000000000100"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "//Headline Microsoft Teams protection metrics for the selected period, with per-interval sparklines. Messages are de-duplicated to the latest record per Teams message.\r\nlet gran = {Granularity};\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(msgs | summarize Count = count() | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(msgs | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Messages with Threats\", Ord = 2, Trend = toscalar(msgs | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend Details = \"Phish Detections\", Ord = 3, Trend = toscalar(msgs | where ThreatTypes has \"Phish\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend Details = \"Malware Detections\", Ord = 4, Trend = toscalar(msgs | where ThreatTypes has \"Malware\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend Details = \"Spam Detections\", Ord = 5, Trend = toscalar(msgs | where ThreatTypes has \"Spam\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 6, Trend = toscalar(msgs | where SafetyTip == \"URLMessageWarning\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(zap | summarize Count = count() | extend Details = \"Post-Delivery ZAP Actions\", Ord = 7, Trend = toscalar(zap | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+        "size": 3,
+        "showAnalytics": true,
+        "timeContextFromParameter": "TimeRange",
+        "queryType": "advancedHunting",
+        "visualization": "tiles",
+        "tileSettings": {
+          "titleContent": {
+            "columnMatch": "Details",
+            "formatter": 1
+          },
+          "leftContent": {
+            "columnMatch": "Count",
+            "formatter": 12,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            },
+            "numberFormat": {
+              "unit": 17,
+              "options": {
+                "style": "decimal",
+                "maximumFractionDigits": 1
+              }
+            }
+          },
+          "secondaryContent": {
+            "columnMatch": "Trend",
+            "formatter": 21
+          },
+          "showBorder": true,
+          "size": "auto"
+        }
+      },
+      "customWidth": "100",
+      "name": "teams kpi tiles",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "b2c476ca-4141-43b4-9d4e-98470aa432fc",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      }
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Microsoft Teams - Collaboration Protection Overview\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 extends its protection to **Microsoft Teams**, detecting malicious messages, URLs, and files shared through chats and channels. This tab summarizes Teams message detections, link-safety warnings, post-delivery ZAP, file scanning, and user/admin submissions.<br><br>*Scope note: the Teams message tables surface metadata for external-conversation messages plus internal messages that contain URLs, so counts reflect that scope rather than the full volume of Teams messages.*"
+            },
+            "name": "teams overview banner",
+            "id": "2f71360f-1673-480f-8361-5afc83aee67d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Teams threat detections over time<br>\r\n\r\n**Volume (per selected interval) of Microsoft Teams messages detected with a threat by Microsoft Defender for Office 365. Spikes may indicate a targeted Teams-based campaign.**"
+            },
+            "customWidth": "100",
+            "name": "teams trend header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "0ac71d4e-8ecb-4d17-9fd3-10754007ec07"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the number of Microsoft Teams messages detected with a threat over time, de-duplicated to the latest record per message and summarized per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId | summarize ThreatDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ThreatDetections = coalesce(ThreatDetections, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "xAxis": "Timestamp",
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "ThreatDetections",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "teams detection trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "937f3bc6-21f5-4f4c-ab72-78f08f32c5bd"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Threat type breakdown<br>\r\n\r\n**Split of Microsoft Teams threat detections across Phish, Malware, and Spam.**"
+            },
+            "customWidth": "50",
+            "name": "teams threat pie header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "645a39ae-843a-47db-8016-6082ef37744d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Thread exposure<br>\r\n\r\n**De-duplicated Microsoft Teams messages split by whether the conversation includes external participants.**"
+            },
+            "customWidth": "50",
+            "name": "teams thread header",
+            "id": "a1a48f9a-8593-4ab5-8824-5998c643e844"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query breaks down Microsoft Teams threat detections by threat type for the selected period, de-duplicated to the latest record per message. A message flagged for more than one threat type is counted under each, so the split can exceed the distinct message count.\r\nlet msgs = MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nunion\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend ThreatType = \"Phish\"),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend ThreatType = \"Malware\"),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend ThreatType = \"Spam\")\r\n| project ThreatType, Count",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "teams threat type pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "029b4ecc-cd95-4385-a251-8ab194add8f4"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| extend Thread = iif(IsExternalThread == true, \"External Thread\", \"Internal Thread\")\r\n| summarize Count = count() by Thread",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "teams thread pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "1581f447-9b3e-4857-84b8-e78b5df65ac5"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams Overview",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "283f36b2-5c54-4afe-9a87-33d4796bd5b7"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Calls and Vishing (Voice Phishing)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Voice phishing (vishing) over Microsoft Teams is the fastest-growing collaboration threat of 2026. Attackers impersonate IT help desk or support and call users directly, often after a chat lure, to talk them into granting remote access or entering credentials. Because a target must be online to answer, malicious calls cluster in working hours. This section surfaces Teams call activity, when calls happen, and callers using support or brand-impersonation identities.**<br><br>*Interim data source: Teams call activity is currently read from Microsoft Defender for Cloud Apps call telemetry (CloudAppEvents). It will move to the dedicated CallActivityEvents table once that table is available to stream into Microsoft Sentinel.*<br><br>**Recommended action:** Treat unsolicited help desk or support calls as suspicious. Confirm any request through a known internal channel, and never grant remote access such as Quick Assist on the strength of an inbound Teams call. Restrict inbound calls and chat from unmanaged and consumer tenants."
+            },
+            "customWidth": "100",
+            "name": "teams calls banner",
+            "id": "9815bdc9-9e10-4e84-9164-783092b4ccb0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Teams call and vishing headline metrics for the selected period, with per-interval sparklines. Interim source: Defender for Cloud Apps call telemetry (CloudAppEvents / CallParticipantDetail).\r\nlet gran = {Granularity};\r\nlet calls = materialize(CloudAppEvents | where ActionType == \"CallParticipantDetail\" | extend R = parse_json(RawEventData) | extend CallId = tostring(R.CallId), UId = tolower(tostring(R.UserId)));\r\nlet susp = calls | extend Local = tostring(split(UId, \"@\")[0]), Dom = tostring(split(UId, \"@\")[1]) | where Local matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\" or Dom endswith \".onmicrosoft.com\";\r\nlet reported = CloudAppEvents | where ActionType == \"CallReported\";\r\nunion\r\n(calls | summarize Count = dcount(CallId) | extend Details = \"Teams Calls\", Ord = 1, Trend = toscalar(calls | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(susp | summarize Count = dcount(UId) | extend Details = \"Impersonation-style Callers\", Ord = 2, Trend = toscalar(susp | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(reported | summarize Count = count() | extend Details = \"Reported Suspicious Calls\", Ord = 3, Trend = toscalar(reported | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+              "size": 3,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "Details",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "Count",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "min": 0,
+                    "palette": "blue"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 1
+                    }
+                  }
+                },
+                "secondaryContent": {
+                  "columnMatch": "Trend",
+                  "formatter": 21
+                },
+                "showBorder": true,
+                "size": "auto"
+              },
+              "showAnalytics": true
+            },
+            "customWidth": "100",
+            "name": "teams calls kpi",
+            "id": "be8946d9-1eae-405c-b8df-cee2242cb44d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Teams call activity over time<br>\r\n**Distinct Microsoft Teams calls per selected interval. A sudden rise, or calls outside normal working hours, can indicate a vishing campaign in progress.**"
+            },
+            "customWidth": "100",
+            "name": "teams calls trend header",
+            "id": "1b49c98f-e5d9-457c-b058-a195e89eac0e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Distinct Teams calls per interval (interim source: CloudAppEvents / CallParticipantDetail).\r\nCloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId)\r\n| summarize ['Teams Calls'] = dcount(CallId) by Timestamp = bin(Timestamp, {Granularity})\r\n| sort by Timestamp asc",
+              "size": 0,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "xAxis": "Timestamp",
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "Teams Calls",
+                    "color": "blueDark"
+                  }
+                ]
+              },
+              "showAnalytics": true
+            },
+            "customWidth": "100",
+            "name": "teams calls trend",
+            "id": "7538b3ca-b96d-421a-9cdc-69b8aef4b185"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### When calls happen (hour of day, UTC)<br>\r\n**Microsoft Teams calls by the hour of day they started (UTC), listed 00:00 through 23:00. The bar length is the number of calls that started in that hour across the selected period. Vishing calls cluster in working hours because the target must be online to answer, with the heaviest malicious-call activity between 14:00 and 20:00 UTC, Monday to Friday, according to Microsoft Threat Intelligence. Use this to baseline normal call timing and spot unusual off-hours spikes.**"
+            },
+            "customWidth": "100",
+            "name": "teams calls hour header",
+            "id": "6bc095e9-fe0d-4f6f-81bd-f3374d758229"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Teams calls by start hour of day (UTC), all 24 hours 00:00..23:00 in order (interim source: CloudAppEvents / CallParticipantDetail).\r\nlet data = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend JoinTime = todatetime(R.JoinTime), CallId = tostring(R.CallId)\r\n| where isnotempty(JoinTime) and isnotempty(CallId)\r\n| summarize CallStart = min(JoinTime) by CallId\r\n| extend HourUTC = hourofday(CallStart)\r\n| summarize Calls = count() by HourUTC;\r\nrange HourUTC from 0 to 23 step 1\r\n| join kind=leftouter (data) on HourUTC\r\n| extend Calls = coalesce(Calls, 0)\r\n| extend HourLabel = strcat(iif(HourUTC < 10, strcat(\"0\", tostring(HourUTC)), tostring(HourUTC)), \":00\")\r\n| order by HourUTC asc\r\n| project ['Hour of Day (UTC)'] = HourLabel, ['Teams Calls'] = Calls",
+              "size": 0,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Teams Calls",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blueDark",
+                      "customColumnWidthSetting": "360px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              },
+              "showAnalytics": true
+            },
+            "customWidth": "100",
+            "name": "teams calls hour",
+            "id": "c36a9909-5570-4fe7-8efc-1b9b4745713a"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Suspicious callers (support and helpdesk impersonation)<br>\r\n**Teams call participants whose display name or address looks like IT support, help desk, or a well-known brand (for example \"Microsoft IT support\", \"Help Desk\", \"Office 365 Support\"), or who dial in from a throwaway `.onmicrosoft.com` tenant. Origin shows whether the caller is external, an external throwaway tenant, or inside your own tenant. External and throwaway-tenant callers are the primary vishing risk; own-tenant matches are frequently a legitimate internal help desk and should be confirmed rather than assumed malicious.**<br><br>**Recommended action:** Prioritise External and `.onmicrosoft` callers, confirm none are legitimate, and warn the users they called. Genuine IT support does not cold-call staff over Teams to request remote access."
+            },
+            "customWidth": "100",
+            "name": "teams calls susp header",
+            "id": "aa420b5f-efd2-4da5-ab41-192031f62ed1"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Suspicious Teams callers by impersonation-style DISPLAY NAME or address (Attendees[].DisplayName / UPN), with Origin from the org's own accepted (EmailEvents inbound) domains - no tenant-id anchor. Interim source: CloudAppEvents / CallParticipantDetail.\r\nlet suspRegex = @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\";\r\nlet ownDomains = toscalar(EmailEvents | where EmailDirection == \"Inbound\" | extend RD = tolower(tostring(split(RecipientEmailAddress, \"@\")[1])) | where isnotempty(RD) | summarize make_set(RD, 200));\r\nlet calls = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId), JoinTime = todatetime(R.JoinTime), Attendees = R.Attendees\r\n| where isnotempty(CallId);\r\nlet callAtt = calls | summarize Attendees = take_any(Attendees), JoinTime = min(JoinTime) by CallId;\r\ncallAtt\r\n| mv-expand Att = Attendees\r\n| extend Caller = tolower(tostring(Att.UPN)), CallerName = tostring(Att.DisplayName)\r\n| extend CallerDom = tostring(split(Caller, \"@\")[1])\r\n| where isnotempty(Caller)\r\n| extend SuspName = CallerName matches regex suspRegex or Caller matches regex suspRegex\r\n| where SuspName or CallerDom endswith \".onmicrosoft.com\"\r\n| extend Origin = case(CallerDom endswith \".onmicrosoft.com\", \"External (.onmicrosoft throwaway)\", set_has_element(ownDomains, CallerDom), \"Own tenant\", \"External\")\r\n| summarize CallsPlaced = dcount(CallId), FirstSeen = min(JoinTime), LastSeen = max(JoinTime) by CallerName, Caller, Origin\r\n| extend OriginRank = case(Origin == \"External (.onmicrosoft throwaway)\", 0, Origin == \"External\", 1, 2)\r\n| sort by OriginRank asc, CallsPlaced desc\r\n| take 10\r\n| project ['Caller Display Name'] = CallerName, ['Caller Address'] = Caller, ['Origin'] = Origin, ['Calls Placed'] = CallsPlaced, ['First Seen'] = FirstSeen, ['Last Seen'] = LastSeen",
+              "size": 0,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Calls Placed",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              },
+              "showAnalytics": true
+            },
+            "customWidth": "100",
+            "name": "teams calls susp table",
+            "id": "d1c4df7b-db07-4c4c-bc71-dfd8623cd704"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams Calls and Vishing",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "1d133411-9b5c-4ede-8502-68b3b02262e4"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Impersonation &amp; Identity Deception\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 flags Teams messages where a sender impersonates a brand, a specific person, or a trusted domain. Impersonation is the entry point for most Teams social-engineering: attackers pose as IT, executives, or Microsoft to build trust before delivering a malicious link or request. These visuals expose <b>who is being impersonated, who is being targeted, and the infrastructure (display names, look-alike domains, and URLs)</b> behind the campaigns so you can hunt IOCs and coach at-risk users.<br><br>**Recommended action:** Treat the impersonated display names and look-alike domains below as IOCs to hunt, and prioritize the Microsoft Defender alert *Microsoft Teams chat initiated by a suspicious external user*. Teach users that a Teams display name is not proof of identity: verify the real sender domain, and confirm any help desk, executive, or Microsoft support request through a known internal channel before acting."
+            },
+            "name": "teams imp banner",
+            "id": "7ff04ff3-9f2d-4a49-8383-2b542d78fe9b"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nunion\r\n(imp | summarize Count=count() | extend Details=\"Impersonation Detections\", Ord=1),\r\n(imp | summarize Count=dcount(FakeSenderAddress) | extend Details=\"Distinct Fake Senders\", Ord=2),\r\n(imp | summarize Count=dcount(TargetUser) | extend Details=\"Targeted Users\", Ord=3),\r\n(imp | summarize Count=dcount(ImpersonationType) | extend Details=\"Impersonation Types\", Ord=4)\r\n| sort by Ord asc | project Count, Details",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "Details",
+                  "formatter": 1
+                },
+                "secondaryContent": {
+                  "columnMatch": "Count",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "min": 0,
+                    "palette": "blue"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 1
+                    }
+                  }
+                },
+                "showBorder": true,
+                "size": "full"
+              }
+            },
+            "customWidth": "100",
+            "name": "teams imp tiles",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "e37f94d5-9bcc-432e-aa66-25831603c228"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Impersonation over time, by type<br>\r\n\r\n**Trend of Brand, User, and Domain impersonation detections. A spike in a single type often marks the start of a targeted campaign.**"
+            },
+            "customWidth": "100",
+            "name": "teams imp trend header",
+            "id": "09907f5b-5c20-4a7e-86d3-c89153c4df98"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Count=count() by ImpersonationType, Timestamp=bin(Timestamp, {Granularity}) | sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "xAxis": "Timestamp"
+              }
+            },
+            "customWidth": "100",
+            "name": "teams imp trend",
+            "id": "757204b1-e900-4217-a2ff-2224a033fdcc"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Suspicious external senders (impersonation and throwaway tenants)<br>\r\n**External Microsoft Teams senders flagged as likely impersonation: throwaway `.onmicrosoft.com` tenants and/or help desk, IT support, security, admin, or account/update-themed display names. Attackers rotate through many such identities (for example numbered `ithelpdesk<n>@...` addresses) from newly-created or consumer tenants to pose as internal support, frequently before the Defender impersonation detector assigns a verdict. This heuristic complements that detector.**<br><br>**Recommended action:** Review high threat-rate senders, block the sending domains, and remind users that genuine IT support does not cold-contact them from an external tenant; verify any such request through a known internal channel."
+            },
+            "customWidth": "100",
+            "name": "teams susp senders header",
+            "id": "5df4af86-49e9-4fc7-b6ad-76d3ef3f7da6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//External Teams senders flagged as likely impersonation: throwaway .onmicrosoft.com tenants and/or help desk / IT / admin / update-themed display names, ranked by messages carrying a threat.\r\nMessageEvents\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \"@\")[1]))\r\n| extend IsOnMicrosoft = SenderDomain endswith \".onmicrosoft.com\"\r\n| extend SuspName = SenderDisplayName matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\"\r\n| where IsOnMicrosoft or SuspName\r\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\r\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \"Throwaway .onmicrosoft tenant + helpdesk-style name\", IsOnMicrosoft, \"Throwaway .onmicrosoft tenant\", \"Helpdesk / IT-style display name\")\r\n| extend ThreatPct = round(todouble(ThreatMessages) * 100 / TeamsMessages, 1)\r\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages, ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\r\n| sort by ['Threat Messages'] desc, ['Teams Messages'] desc\r\n| take 10",
+              "size": 0,
+              "title": "",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Teams Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Threat Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Threat %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 100
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              },
+              "showAnalytics": true
+            },
+            "customWidth": "100",
+            "name": "teams susp senders table",
+            "id": "dd1d79d8-f591-4aae-bd44-6ad23a3e0ae4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Who is being targeted<br>\r\n\r\n**Internal users receiving the most impersonation attempts. Concentrated targeting of a few users is a strong signal of a deliberate campaign - prioritize these users for security awareness training.**"
+            },
+            "customWidth": "100",
+            "name": "teams imp targets header",
+            "id": "43112ad1-ebc9-42fb-9ebd-0dbaa862ed45"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Distinct Fake Senders']=dcount(FakeSenderAddress), Types=make_set(ImpersonationType,3), ['Last Seen']=max(Timestamp) by ['Targeted User']=TargetUser | top 10 by Detections",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams imp targets",
+            "id": "cc4b3f98-bfcb-4741-9abb-9ff099eb946f"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Impersonating senders<br>\r\n\r\n**The identities behind the impersonation, grouped by fake display name, sender domain, and type. Attackers rotate through many sending addresses under a single display name - Distinct Sender Addresses exposes that rotation, and a high count is itself a strong bulk-campaign signal. Use First/Last Seen to scope the campaign window.**"
+            },
+            "customWidth": "100",
+            "name": "teams imp senders header",
+            "id": "99859796-7b69-42e7-a27a-541e0ba86cb2"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the identities behind Teams impersonation, grouped by the fake display name, sender domain, and impersonation type. Attackers rotate through many sending addresses under one display name, so Distinct Sender Addresses reveals bulk campaigns that per-address ranking would hide.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp\r\n| summarize Detections=count(), SenderAddresses=dcount(FakeSenderAddress), Targets=dcount(TargetUser), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by FakeDisplayName, FakeSenderDomain, ImpersonationType\r\n| top 10 by Detections\r\n| project ['Fake Display Name']=FakeDisplayName, ['Sender Domain']=FakeSenderDomain, ['Impersonation Type']=ImpersonationType, ['Distinct Sender Addresses']=SenderAddresses, Detections, ['Targeted Users']=Targets, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Distinct Sender Addresses",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "teams imp senders",
+            "id": "209439a0-5be3-4e41-abe9-695552730dc8"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Display names abused<br>\r\n\r\n**The identities attackers pretend to be (for example \"IT HelpDesk\", \"Microsoft Support\"). These are the trust anchors of the social-engineering lure.**"
+            },
+            "customWidth": "100",
+            "name": "teams imp names header",
+            "id": "e645578b-7a52-4d38-9d83-f5c500bbfe1a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Distinct Senders']=dcount(FakeSenderAddress) by ['Fake Display Name']=FakeDisplayName | top 10 by Detections",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Senders",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "teams imp names",
+            "id": "d723d72b-4e7c-431b-ae7b-980879c8bd75"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Look-alike sender domains<br>\r\n\r\n**Sending domains used for impersonation - watch for typosquats (for example rnicrosoft.com for m&rarr;rn). Add confirmed domains to your Tenant Allow/Block List.**"
+            },
+            "customWidth": "100",
+            "name": "teams imp domains header",
+            "id": "98040a5a-bbd5-4c95-b976-5630ce48b282"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Display Names Used']=dcount(FakeDisplayName) by ['Sender Domain']=FakeSenderDomain | top 10 by Detections",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Display Names Used",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "teams imp domains",
+            "id": "94b9fa45-c889-46a7-8b80-92e5d280ad3b"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### URL IOCs from impersonation messages<br>\r\n\r\n**URL domains that appeared in messages sent by impersonating senders. Threat actors deliberately mix legitimate domains (for example microsoft.com or google.com) with their malicious ones to make the lure look trustworthy, so treat this as a review list - not a blocklist. Investigate the unfamiliar or look-alike domains and block only those you confirm malicious; never block a well-known legitimate domain from this list.**"
+            },
+            "customWidth": "100",
+            "name": "teams imp ioc header",
+            "id": "d5f4886c-7c7e-4c6f-94ca-569cabda5ede"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists URL domains that appeared in messages sent by impersonating senders, with a breakdown of how many carried Malware, Phish, or Spam verdicts. Threat actors mix legitimate and malicious domains in a single lure, so review the unfamiliar or look-alike domains and block only confirmed-malicious ones.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ChatThreadId = tostring(RD.ChatThreadId);\r\nlet impThreads = imp | distinct ChatThreadId;\r\nlet impMsgs = MessageEvents\r\n    | where ThreadId in (impThreads)\r\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n    | project TeamsMessageId, ThreatTypes;\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| join kind=inner (impMsgs) on TeamsMessageId\r\n| summarize ['URL Count']=count(), Messages=dcount(TeamsMessageId), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by ['URL Domain']=UrlDomain\r\n| top 10 by ['URL Count']",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "URL Count",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Malware",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Phish",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Spam",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "teams imp ioc",
+            "id": "958ac65c-d56d-4a80-ba83-2ab33e8b1e2e"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams Impersonation",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "c49582db-6318-423f-b806-91cbeb625ea2"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Malicious URLs and Link Warnings in Teams\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nTracks URLs shared through Microsoft Teams, messages that triggered a Microsoft Defender for Office 365 URL safety-tip warning, and the outcome of Teams URL clicks (allowed versus blocked) captured in UrlClickEvents.<br><br>**Recommended action:** Enable Safe Links for Microsoft Teams so links are checked at click time, and prioritize *User clicked a malicious link in Teams chat* alerts for investigation. Treat a blocked click as an attempted compromise: check whether the user went on to share credentials or run a file, and reset credentials where warranted."
+            },
+            "name": "teams url banner",
+            "id": "e3ec4d65-8d1f-4303-bd8f-eb1ae521da41"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query surfaces Microsoft Teams URL-sharing and link-warning metrics for the selected period. URL-warning messages carry the Microsoft Defender for Office 365 URL safety tip.\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nunion\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 1),\r\n(MessageUrlInfo | summarize Count = count() | extend Details = \"URLs Shared in Messages\", Ord = 2),\r\n(MessageUrlInfo | summarize Count = dcount(TeamsMessageId) | extend Details = \"Messages Containing URLs\", Ord = 3),\r\n(MessageUrlInfo | summarize Count = dcount(UrlDomain) | extend Details = \"Distinct URL Domains\", Ord = 4)\r\n| sort by Ord asc\r\n| project Count, Details",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "Details",
+                  "formatter": 1
+                },
+                "secondaryContent": {
+                  "columnMatch": "Count",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "min": 0,
+                    "palette": "blue"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 1
+                    }
+                  }
+                },
+                "showBorder": true,
+                "size": "full"
+              }
+            },
+            "customWidth": "100",
+            "name": "teams url tiles",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b71382c7-c0f7-4f9d-9d21-e0a8bf9504ff"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Teams URL click outcomes over time<br>\r\n\r\n**Allowed versus blocked Microsoft Teams URL clicks (per selected interval) from UrlClickEvents where the click happened in the Teams workload.**"
+            },
+            "customWidth": "66",
+            "name": "teams click trend header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "30818e0d-6c4b-4868-896a-ac48cb3cef86"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Click outcomes<br>\r\n\r\n**Distribution of Microsoft Teams URL click actions by type.**"
+            },
+            "customWidth": "33",
+            "name": "teams click pie header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "5a882138-2241-4527-80b8-9983c5807050"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises Microsoft Teams URL click outcomes over time (allowed vs blocked) using the UrlClickEvents workload filter, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(UrlClickEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(UrlClickEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where Workload == \"Teams\"\r\n| summarize ClickAllowed = countif(ActionType has \"ClickAllowed\"), ClickBlocked = countif(ActionType has \"ClickBlocked\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickAllowed = coalesce(ClickAllowed, 0), ClickBlocked = coalesce(ClickBlocked, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "xAxis": "Timestamp"
+              }
+            },
+            "customWidth": "66",
+            "name": "teams click trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "7a2f5559-1e3e-412a-addf-c3bf6be98502"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows Microsoft Teams URL click outcomes by action type for the selected period.\r\nUrlClickEvents\r\n| where Workload == \"Teams\"\r\n| where isnotempty(ActionType)\r\n| summarize Count = count() by ActionType",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "33",
+            "name": "teams click pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "889c6bb3-438b-4575-84f2-084c1b5fd1f4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top domains shared in Teams messages<br>\r\n\r\n**The 10 most-shared URL domains in Microsoft Teams messages, with the number of messages each appeared in.**"
+            },
+            "customWidth": "100",
+            "name": "teams top domains header",
+            "id": "dcb8c87c-087e-4d69-b7b7-0329296293ff"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 URL domains shared in Microsoft Teams messages by volume for the selected period.\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| summarize UrlCount = count(), Messages = dcount(TeamsMessageId) by UrlDomain\r\n| top 10 by UrlCount\r\n| project ['URL Domain']=UrlDomain, ['URLs Shared']=UrlCount, ['Messages']=Messages",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "URLs Shared",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams top domains table",
+            "id": "7561adb0-1fbe-41ce-a924-a27bcd4c5c12"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams Malicious URLs",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "6d47c309-be9e-4b21-940e-7c7b282e5dc2"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Targeted Users &amp; Risky Senders\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nIdentifies who is most targeted in Microsoft Teams, and profiles the external senders and domains behind risky messages - URL safety-tip warnings, first-contact senders, threat-carrying domains, and low-reputation link infrastructure - so you can spot anomalous senders before they succeed.<br><br>**Recommended action:** Prioritize the most-targeted users for phishing-resistant MFA and awareness coaching, and treat first-contact external senders and low-reputation domains as IOCs. Restrict inbound chat from unmanaged and consumer tenants, and allowlist only trusted external domains so unsolicited outsiders cannot start a conversation."
+            },
+            "name": "teams risky banner",
+            "id": "0aa13d73-2e13-487c-a7c4-d90464a554d4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top targeted users (messages with threats)<br>\r\n\r\n**The 10 users receiving the most Microsoft Teams messages that contained a threat, expanded from each message recipient list.**"
+            },
+            "customWidth": "100",
+            "name": "teams targeted header",
+            "id": "827dc0f6-2bb2-49b9-acf8-d7b400238594"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 users receiving Microsoft Teams messages that contained a threat, expanded from the message recipient list, with each user's total Teams messages received and the share that carried a threat. Messages are de-duplicated to the latest record per message.\r\nlet expanded = MessageEvents\r\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n    | mv-expand rd = parse_json(RecipientDetails)\r\n    | extend Recipient = tostring(rd.RecipientSmtpAddress)\r\n    | where isnotempty(Recipient);\r\nlet totals = expanded | summarize TotalMessages = count() by Recipient;\r\nexpanded\r\n| where isnotempty(ThreatTypes)\r\n| summarize ThreatMessages = count() by Recipient\r\n| join kind=leftouter (totals) on Recipient\r\n| extend ThreatPct = round(100.0 * ThreatMessages / TotalMessages, 1)\r\n| top 10 by ThreatMessages\r\n| project ['Recipient']=Recipient, ['Threat Messages']=ThreatMessages, ['Total Messages']=TotalMessages, ['Threat %']=ThreatPct",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Threat Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams targeted users table",
+            "id": "79481d1b-617e-46df-b555-9f7240932dd0"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top senders of URL-warning messages<br>\r\n\r\n**Senders whose Microsoft Teams messages most often triggered a URL safety-tip warning.**"
+            },
+            "customWidth": "50",
+            "name": "teams warn senders header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "ef71d7dd-4442-4992-977d-d550aad4533c"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top domains in URL-warning messages<br>\r\n\r\n**URL domains most frequently present in Microsoft Teams messages that triggered a URL safety-tip warning.**"
+            },
+            "customWidth": "50",
+            "name": "teams warn domains header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "6f41a4ba-f832-4947-ad27-cd6b8015bd63"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 senders whose Microsoft Teams messages triggered a URL safety-tip warning for the selected period, with each sender's total Teams messages and the share that carried a warning. Messages are de-duplicated to the latest record per message.\r\nlet dedup = MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nlet totals = dedup | summarize TotalMessages = count() by SenderEmailAddress;\r\ndedup\r\n| where SafetyTip == \"URLMessageWarning\"\r\n| summarize WarningMessages = count() by SenderEmailAddress\r\n| join kind=leftouter (totals) on SenderEmailAddress\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Warning Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "teams warn senders table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "3fa023af-79e3-407f-ac20-b0aa6e3ba511"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 URL domains appearing in Microsoft Teams messages that triggered a URL safety-tip warning, with the domain's total message appearances and the share that carried a warning.\r\nlet warned = MessageEvents | where SafetyTip == \"URLMessageWarning\" | distinct TeamsMessageId;\r\nlet totals = MessageUrlInfo | where isnotempty(UrlDomain) | summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;\r\nMessageUrlInfo\r\n| where TeamsMessageId in (warned)\r\n| summarize WarningMessages = dcount(TeamsMessageId) by UrlDomain\r\n| join kind=leftouter (totals) on UrlDomain\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['URL Domain']=UrlDomain, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Warning Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "teams warn domains table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "68811015-1383-48ad-86da-4f8f9d39e4c4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### First-contact external senders<br>\r\n\r\n**External Microsoft Teams senders ordered by when they were first seen in the period (most recent first). Note: some flows tag internal-domain senders as external - to hide your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+            },
+            "customWidth": "100",
+            "name": "teams fc senders header",
+            "id": "0f131ff3-d6b2-4187-b86c-ca3493594b54"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists external Microsoft Teams senders by the date they were first seen in the selected period, surfacing recent first-contact senders. Messages are de-duplicated to the latest record per message. In tenants with longer history this highlights genuinely new senders.\r\n// TIP: IsExternalThread may still surface senders from your own accepted domains. To hide them,\r\n// uncomment the ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n//| where tostring(split(SenderEmailAddress, \"@\")[1]) !in~ (ExcludeDomains)\r\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\r\n| top 10 by FirstSeen desc\r\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Threat Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true,
+                "sortBy": [
+                  {
+                    "itemKey": "Threat Messages",
+                    "sortOrder": 2
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "teams fc senders table",
+            "id": "4e10a78d-8858-4dbb-9db0-e7b7d7e7636c"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### External sender-domain risk<br>\r\n\r\n**External sending domains ranked by threat volume, with the mix of conversation types (1:1 chat, group chat, channel), threat breakdown, threat rate, count of messages carrying low-reputation URLs (domains on commonly-abused TLDs such as .xyz, .top, .click, .shop, .zip), and first/last-seen. A domain that is new in the period, skews toward 1:1 chats, or shows a high threat rate is anomalous and warrants review. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+            },
+            "customWidth": "100",
+            "name": "teams anomaly header",
+            "id": "a91295db-8192-4828-93c5-408436e4b0e1"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query ranks external sender domains in Microsoft Teams by threat volume for the selected period, split by conversation type (1:1 chat, group chat, channel), with threat-type breakdown, threat rate, and a count of messages carrying low-reputation URL TLDs. Messages are de-duplicated to the latest record per message. New, 1:1-skewed, or high-threat-rate domains are the anomalies to review.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n    | where isnotempty(UrlDomain)\r\n    | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n    | where Tld in (suspTlds)\r\n    | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\"), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages > 0\r\n| extend ThreatRatePct = round(100.0 * ThreatMessages / Messages, 1)\r\n| top 10 by ThreatMessages desc\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Threat Msgs']=ThreatMessages, Malware, Phish, Spam, ['Threat Rate %']=ThreatRatePct, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Threat Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams anomaly table",
+            "id": "bcd6746d-8298-495d-9d6c-2fadc6cba569"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Suspicious new senders (no threat verdict yet)<br>\r\n\r\n**External sending domains with no threat verdict yet, but that are either sending low-reputation-URL messages or showing unusual volume. These slip past threat filters - watch for new domains skewing toward 1:1 chats, an early social-engineering signal. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**"
+            },
+            "customWidth": "100",
+            "name": "teams newdom header",
+            "id": "9e3844f4-befc-4b76-a8cd-ca53fdf51d41"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query surfaces external sender domains in Microsoft Teams that have NO threat verdict yet but are sending messages with low-reputation URL TLDs or unusual volume, split by conversation type. These are early-warning senders that have not tripped a detection. Messages are de-duplicated to the latest record per message.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n    | where isnotempty(UrlDomain)\r\n    | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n    | where Tld in (suspTlds)\r\n    | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages == 0\r\n| where SuspUrlMsgs > 0 or Messages >= 5\r\n| order by SuspUrlMsgs desc, Messages desc\r\n| take 10\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams newdom table",
+            "id": "8036a5b7-b5b3-4af4-912f-bb092bb01b89"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Low-reputation link domains in Teams (IOC radar)<br>\r\n\r\n**URL domains shared in Teams that use TLDs commonly abused for phishing and malware (for example .xyz, .top, .click, .zip, .shop). Ranked by message reach, with first/last-seen. Review these domains as potential indicators - .zip and .mov are especially deceptive because links read like file names.**"
+            },
+            "customWidth": "100",
+            "name": "teams tld header",
+            "id": "d48921f4-233c-4e0f-a97b-83e1bcaed399"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists URL domains shared in Microsoft Teams that use low-reputation TLDs commonly abused for phishing and malware, ranked by the number of Teams messages they appeared in, with first- and last-seen. Treat high-reach or newly-seen domains as candidate indicators of compromise.\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n| where Tld in (suspTlds)\r\n| summarize Messages=dcount(TeamsMessageId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ['URL Domain']=UrlDomain, ['TLD']=Tld\r\n| top 10 by Messages desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "teams tld table",
+            "id": "30d5588e-010c-474a-9c53-74b73dcc9676"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams Targeted Users & Risky Senders",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "6fef737b-cb4e-4a51-9ced-bf11754a6b33"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams File Protection\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Defender for Office 365 scans files shared in Microsoft Teams. These visuals show files scanned versus malware detected, and list the malicious files found.<br><br>**Recommended action:** Investigate each malicious file below and confirm it was quarantined and removed from the SharePoint or OneDrive location backing the chat. Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, and use attack surface reduction rules to block executable content delivered through collaboration."
+            },
+            "name": "teams file banner",
+            "id": "2f01c905-dd65-4a13-9f67-c70402b2c175"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection - for the selected period.\r\nlet base = FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\";\r\nunion\r\n(base | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files Scanned - No Detection\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "Details",
+                  "formatter": 1
+                },
+                "secondaryContent": {
+                  "columnMatch": "Count",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "min": 0,
+                    "palette": "blue"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 1
+                    }
+                  }
+                },
+                "showBorder": true,
+                "size": "full"
+              }
+            },
+            "customWidth": "100",
+            "name": "teams file tiles",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "9f555c51-1680-47ef-94d4-b1f8cf9dce3b"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malicious files shared in Teams<br>\r\n\r\n**Files shared in Microsoft Teams that were detected with malware, with owner and file details.**"
+            },
+            "customWidth": "100",
+            "name": "teams file table header",
+            "id": "4cd3274e-0c61-4722-83b7-1fccf8a94a57"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365 for the selected period.\r\nFileMaliciousContentInfo\r\n| where Workload == \"MicrosoftTeams\"\r\n| where isnotempty(ThreatTypes)\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams file table",
+            "id": "135e0e7d-7110-40ee-a377-1a5992b2ef9d"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams File Protection",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "8ecc1bae-4a06-4b1c-8952-59fb434b7cbc"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Post-Delivery ZAP Insights (Teams)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nZero-hour auto purge (ZAP) removes malicious Microsoft Teams messages after delivery. These visuals summarize ZAP volume, type, result, and the senders whose messages were most often removed.<br><br>**Recommended action:** Confirm zero-hour auto purge is enabled for Microsoft Teams so newly-weaponized messages are pulled after delivery. Investigate senders with repeated ZAP removals as likely compromised or malicious accounts and block or restrict them. A rising ZAP trend can signal an active campaign that slipped past delivery-time filtering."
+            },
+            "name": "teams zap banner",
+            "id": "136cfb4e-d2a5-4db0-9771-6b6380011ba0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query summarizes Microsoft Teams post-delivery ZAP (zero-hour auto purge) activity by Microsoft Defender for Office 365 for the selected period.\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(zap | summarize Count = count() | extend Details = \"Total ZAP Actions\", Ord = 1),\r\n(zap | where ActionType == \"Malware ZAP\" | summarize Count = count() | extend Details = \"Malware ZAP\", Ord = 2),\r\n(zap | where ActionType == \"Phish ZAP\" | summarize Count = count() | extend Details = \"Phish ZAP\", Ord = 3),\r\n(zap | where ActionResult == \"Success\" | summarize Count = count() | extend Details = \"Successful Actions\", Ord = 4),\r\n(zap | where ActionResult == \"Failed\" | summarize Count = count() | extend Details = \"Failed Actions\", Ord = 5),\r\n(zap | where Action == \"Moved to quarantine\" | summarize Count = count() | extend Details = \"Moved to Quarantine\", Ord = 6)\r\n| sort by Ord asc\r\n| project Count, Details",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "Details",
+                  "formatter": 1
+                },
+                "secondaryContent": {
+                  "columnMatch": "Count",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "min": 0,
+                    "palette": "blue"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 1
+                    }
+                  }
+                },
+                "showBorder": true,
+                "size": "full"
+              }
+            },
+            "customWidth": "100",
+            "name": "teams zap tiles",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "06980411-5e6b-4aa4-a746-351cd2b12dae"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### ZAP actions over time<br>\r\n\r\n**Microsoft Teams post-delivery ZAP actions (per selected interval) split by Malware ZAP and Phish ZAP.**"
+            },
+            "customWidth": "66",
+            "name": "teams zap trend header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "7fc1cfcd-3a9f-45b1-9f39-3820fce23c03"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### ZAP by action type<br>\r\n\r\n**Distribution of Microsoft Teams post-delivery ZAP actions by type.**"
+            },
+            "customWidth": "33",
+            "name": "teams zap pie header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "9bc0d0a3-876a-49d7-9046-31764511ca38"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises Microsoft Teams post-delivery ZAP actions over time by ZAP type, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessagePostDeliveryEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessagePostDeliveryEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessagePostDeliveryEvents\r\n| summarize MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareZAP = coalesce(MalwareZAP, 0), PhishZAP = coalesce(PhishZAP, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "xAxis": "Timestamp"
+              }
+            },
+            "customWidth": "66",
+            "name": "teams zap trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "c78a509e-324f-4a8c-b2e7-bce3e0d20667"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows Microsoft Teams post-delivery ZAP actions by type for the selected period.\r\nMessagePostDeliveryEvents\r\n| summarize Count = count() by ActionType",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "33",
+            "name": "teams zap pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "cfc94695-fb02-4b6c-a223-f79f7b947379"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top senders whose messages were removed by ZAP<br>\r\n\r\n**Senders whose Microsoft Teams messages were most often removed by post-delivery ZAP.**"
+            },
+            "customWidth": "100",
+            "name": "teams zap senders header",
+            "id": "f8677ffe-007a-41ca-81de-1ae5dd19d06a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 senders whose Microsoft Teams messages were removed by post-delivery ZAP for the selected period.\r\nMessagePostDeliveryEvents\r\n| where isnotempty(SenderEmailAddress)\r\n| summarize ZapActions = count(), MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by SenderEmailAddress\r\n| top 10 by ZapActions\r\n| project ['Sender']=SenderEmailAddress, ['ZAP Actions']=ZapActions, ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "ZAP Actions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams zap senders table",
+            "id": "50c9a883-6442-40dc-b84f-57adfbb46a38"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams ZAP",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "f5cc2425-e5ae-4520-9a97-2e4c2c447dcd"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Teams Message and Call Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nMicrosoft Teams messages and calls reported by users, and messages submitted by admins, for review by Microsoft. Sourced from the submission records in CloudAppEvents.<br><br>**Recommended action:** Encourage users to report suspicious Teams messages and calls so Microsoft can tune protection, and triage admin submissions promptly. A cluster of reports naming the same sender, display name, or call identity is an early signal of a targeted campaign: pivot those identities into the impersonation and risky-sender views above to scope it."
+            },
+            "name": "teams sub banner",
+            "id": "54cbfb29-2626-4b65-8cb5-a42ff4b41e63"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query summarizes Microsoft Teams message and call submissions reported to Microsoft for the selected period, split by user and admin reports. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nunion\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Messages Reported by Users\", Ord = 1),\r\n(sub | where SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Calls Reported by Users\", Ord = 2),\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\" | summarize Count = count() | extend Details = \"Messages Submitted by Admins\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "tiles",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "Details",
+                  "formatter": 1
+                },
+                "secondaryContent": {
+                  "columnMatch": "Count",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "min": 0,
+                    "palette": "blue"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "style": "decimal",
+                      "maximumFractionDigits": 1
+                    }
+                  }
+                },
+                "showBorder": true,
+                "size": "full"
+              }
+            },
+            "customWidth": "100",
+            "name": "teams sub tiles",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "419ed645-ebc1-4df1-b9f0-c744403ab494"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Submissions over time<br>\r\n\r\n**Microsoft Teams user and admin submissions (per selected interval).**"
+            },
+            "customWidth": "66",
+            "name": "teams sub trend header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "6a795b0a-82e2-427a-8ac0-abfb5bb5e447"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Submission mix<br>\r\n\r\n**Microsoft Teams submissions split by content type (message or call) and reporter (user or admin).**"
+            },
+            "customWidth": "33",
+            "name": "teams sub pie header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "1f4c55f8-7290-4b6f-b02a-e3134568b9ff"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises Microsoft Teams message and call submissions over time, summarizing the data per selected interval. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet gran = {Granularity};\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nlet minTime = toscalar(sub | summarize min(Timestamp));\r\nlet maxTime = toscalar(sub | summarize max(Timestamp));\r\nlet agg = materialize(sub\r\n| summarize UserReports = countif(ActionType == \"UserSubmission\"), AdminReports = countif(ActionType == \"AdminSubmission\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, UserReports = coalesce(UserReports, 0), AdminReports = coalesce(AdminReports, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "xAxis": "Timestamp"
+              }
+            },
+            "customWidth": "66",
+            "name": "teams sub trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "7dcb03da-de96-4388-90a4-0a3f3ca98dc6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows the mix of Microsoft Teams submissions by content type and reporter for the selected period. Only completed user submissions (chat and call) and admin submissions (chat) are counted; submission triage/timeout lifecycle records are excluded.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\"\r\n| where (SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\")\r\n    or (SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\")\r\n    or (SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\")\r\n| extend Reporter = iif(ActionType == \"AdminSubmission\", \"Admin\", \"User\")\r\n| summarize Count = count() by SubmissionType = strcat(SubmissionContentType, \" (\", Reporter, \")\")",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "33",
+            "name": "teams sub pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "84a0141e-51de-4423-acb0-3c4342a49bf2"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative (FN) User Submissions by submission State<br>\r\n\r\n**Microsoft Teams messages reported by users as missed detections, broken down by submission state (for example Rescaned, Graded). Tracks the processing status of user reports.**"
+            },
+            "customWidth": "50",
+            "name": "teams sub state header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "1b2bdffd-69b0-41b0-bdda-b242b7faaec0"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative (FN) User Submissions by Triage Verdict<br>\r\n\r\n**Microsoft Teams user submissions grouped by the verdict assigned during grading (for example Phishing, NotSpam, Spam). Shows how reported messages were graded and highlights detection gaps.**"
+            },
+            "customWidth": "50",
+            "name": "teams sub verdict header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "bdb97e09-44d2-41ad-a99f-931e4a8169cc"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows Microsoft Teams user (false negative) message submissions by submission state (for example Rescaned, Graded), to track processing status.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend SubmissionState = tostring(RD.SubmissionState)\r\n| summarize Count = count() by tostring(SubmissionState)",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "teams sub state pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "139ce840-5fc2-44d1-9872-91b37a74f0e7"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows Microsoft Teams user (false negative) message submissions by the triage verdict assigned during grading (for example Phishing, NotSpam, Spam).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend TriageVerdict = tostring(parse_json(tostring(RD.GradingResult)).TriageVerdict)\r\n| where isnotempty(TriageVerdict)\r\n| summarize Count = count() by TriageVerdict",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "teams sub verdict pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "538ce4a3-a1ff-4b8d-a466-2173edbb2cd7"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 P2 sender domains in FN User Submissions<br>\r\n\r\n**The sender domains most often reported by users as missed Microsoft Teams threats. High-volume domains are candidate sources of malicious messaging.**"
+            },
+            "customWidth": "50",
+            "name": "teams sub domains header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "9b8db0c7-2bf2-4077-ae20-60146001bf23"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 individual P2 senders in FN User Submissions<br>\r\n\r\n**The individual senders most often reported by users as missed Microsoft Teams threats.**"
+            },
+            "customWidth": "50",
+            "name": "teams sub senders header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "ffbe90ab-129c-47fa-9dac-50cab528ad55"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 P2 (envelope) sender domains of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2SenderDomain = tostring(RD.P2SenderDomain)\r\n| where isnotempty(P2SenderDomain)\r\n| summarize Submissions = count() by ['P2 Sender Domain']=P2SenderDomain\r\n| top 10 by Submissions",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "teams sub domains table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b18192fb-26a8-4bd1-9b07-7aeab496eae3"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 individual P2 (envelope) senders of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2Sender = tostring(RD.P2Sender)\r\n| where isnotempty(P2Sender)\r\n| summarize Submissions = count() by ['P2 Sender']=P2Sender\r\n| top 10 by Submissions",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "teams sub senders table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "7ead0a01-2b56-4225-b625-554b09350013"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 users performing the most FN User Submissions<br>\r\n\r\n**The users who report the most Microsoft Teams messages as missed detections - useful for recognising engaged reporters and spotting over-reporting.**"
+            },
+            "customWidth": "50",
+            "name": "teams sub topusers header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "fb893cdd-d6d3-431a-a1d2-87652571a10d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 admins performing the most FN Admin Submissions<br>\r\n\r\n**The admins who submit the most Microsoft Teams messages as missed detections.**"
+            },
+            "customWidth": "50",
+            "name": "teams sub topadmins header",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "0px"
+            },
+            "id": "14fca69b-e152-4a5d-bd2c-020c34c2226a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 users who reported the most Microsoft Teams messages as false negatives (missed detections), with each submitter's email (from the submission record) to disambiguate users with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterEmail = tostring(RD.UserId)\r\n| where isnotempty(Submitter) and SubmitterEmail has \"@\"\r\n| summarize Submissions = count() by ['Submitter']=Submitter, ['Email']=SubmitterEmail\r\n| top 10 by Submissions",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "teams sub topusers table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "a171a35b-35b0-46ce-a916-052a54101126"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the top 10 admins who submitted the most Microsoft Teams messages as false negatives (missed detections). The admin's own email is not present in the submission record (that would require the Identity table), so the Submitter ID (object GUID) is shown to disambiguate admins with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"AdminSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterId = tostring(RD.SubmitterId)\r\n| where isnotempty(Submitter)\r\n| summarize Submissions = count() by ['Admin']=Submitter, ['Submitter ID']=SubmitterId\r\n| top 10 by Submissions",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "teams sub topadmins table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "8bf37c2b-067a-4341-a192-2aa45699c3f7"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams Submissions",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "eeea53a4-69d9-426e-bf9f-1789cd73bfed"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Recent Threat Detail\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThe most recent Microsoft Teams phishing and malware messages, de-duplicated to the latest record per message, for investigation."
+            },
+            "name": "teams detail banner",
+            "id": "4bdd917c-721f-450b-b455-45cbd5f59cc5"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Last 10 Teams phishing messages<br>\r\n\r\n**Most recent Microsoft Teams messages detected as phishing, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**"
+            },
+            "customWidth": "100",
+            "name": "teams detail phish header",
+            "id": "9bcf96c1-a958-4515-b171-10ec2f3ba660"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams detail phish table",
+            "id": "3675d08f-1165-4f47-a633-e432cf96e3d5"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Last 10 Teams malware messages<br>\r\n\r\n**Most recent Microsoft Teams messages detected as malware, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**"
+            },
+            "customWidth": "100",
+            "name": "teams detail mal header",
+            "id": "6b9d66d2-8d89-47b0-a72a-5ee8623082dc"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "teams detail mal table",
+            "id": "d6e76d0a-7eee-4c05-8e92-10f9622b5ab3"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "14"
+      },
+      "name": "group - Teams Detail",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "1e9c879b-d6be-4d36-9068-b5438abf7dd2"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Top Attacked Users, Top Senders, and Automatic External Email Forwarding\r\n\r\n---\r\nThis tab provides insights into **Top attacked users, Top Senders** in inbound email messages and details about **automatic external email forwarding**."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "6"
+      },
+      "name": "text - 24 - Copy - Copy - Copy",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "f1a60054-44b1-432e-be7a-9d7d114ff5c7"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Attacked Users and Top Senders Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides key visuals that highlight top attacked users – individuals most frequently targeted by inbound email threats as detected by Microsoft Defender for Office 365. Offers insights into top email senders and sender domains across inbound email traffic, helping identify patterns and potential risk sources.<br><br>**Recommended action:** Apply the Strict preset to the most-attacked users and review the top sender domains as possible block-list candidates."
+            },
+            "name": "text - 13 - Copy - Copy",
+            "id": "ff220902-30b8-4aef-9b79-14c913a1b2d2"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top Attacked Users<br>\r\n\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam, Phishing, or Malware. Helps identify high-risk users for targeted security awareness and policy enforcement.**"
+            },
+            "name": "text - 13 - Copy - Copy - Copy",
+            "id": "58f34b9f-824d-4fcf-b2aa-d7d380aa08d5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 users that are receiving Spam, Phishing or Malware emails\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by RecipientEmailAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by ThreatEmailCount\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Total Emails",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Threat Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Malware",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Phish",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Spam",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    },
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    }
+                  }
+                ],
+                "filter": true,
+                "sortBy": [
+                  {
+                    "itemKey": "$gen_bar_Threat Emails_2",
+                    "sortOrder": 2
+                  }
+                ]
+              },
+              "sortBy": [
+                {
+                  "itemKey": "$gen_bar_Threat Emails_2",
+                  "sortOrder": 2
+                }
+              ],
+              "chartSettings": {
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "100",
+            "name": "query - 28",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "e9459e78-6b43-4ef2-9596-32169d95c610"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Senders of Inbound Emails<br>\r\n\r\n**Displays the top 10 sender email addresses from external sources delivering inbound emails. Helps identify high-volume external senders for monitoring and policy enforcement.**"
+            },
+            "name": "text - 13 - Copy - Copy - Copy - Copy",
+            "id": "eb4590a7-57c7-4728-af62-3d798afe6f2d"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by SenderFromAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender']=SenderFromAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Total Emails",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Threat Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Malware",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Phish",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Spam",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    },
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "100",
+            "name": "query - 28 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "e4272979-1073-4c1e-9b1b-b971bc3efc33"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Sender Domains of Inbound Emails<br>\r\n\r\n**Displays the top 10 sender domains from external sources delivering inbound emails. Helps identify high-volume external sender domains for monitoring and policy enforcement.**"
+            },
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+            "id": "7ab63415-17ce-47f1-a614-e5e6edbe472e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by SenderFromDomain\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Total Emails",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Threat Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Malware",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Phish",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Spam",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Bad Traffic %",
+                    "formatter": 4,
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    },
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "100",
+            "name": "query - 28 - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b593da94-b735-4fe3-a82d-18c90156e506"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "6"
+      },
+      "name": "group - 10-Top attacked users and top senders",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "3e41cc1a-166e-4094-bc66-7e26a918b2e9"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Automatic External Email Forwarding Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Email forwarding can be useful, but can also pose a security risk due to the potential disclosure of information.**\r\n<br>\r\n\r\nUsers can configure [<b>Inbox rules</b>](https://support.microsoft.com/en-US/Outlook/mail/use-rules-to-automatically-forward-messages) in Outlook or set up [<b>SMTP forwarding</b>](https://support.microsoft.com/en-us/office/turn-on-automatic-forwarding-in-outlook-7f2670a1-7fff-4475-8a3c-5822d63b0c8e) to automatically forward messages to external recipients. You can control automatic external email forwarding from cloud mailboxes using [<b>Outbound spam policies</b>](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding) in Microsoft Defender for Office 365. \r\n**Attackers might exploit this capability to compromise your organization or its partners.**<br><br>**Recommended action:** Investigate external auto-forwarding - it is a common data-exfiltration path. Consider disabling auto-forwarding via the outbound spam policy unless a business case is documented."
+            },
+            "name": "text - 8",
+            "id": "b04d1590-98e3-4650-9172-33e75561e1e5"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Automatic Email Forwarding by Type<br>\r\n\r\n**Displays counts of outbound emails automatically forwarded to external addresses, grouped by forwarding type (e.g., SMTP forwarding, inbox rules). Helps identify forwarding behaviors that may pose data exfiltration risks.**"
+            },
+            "customWidth": "50",
+            "name": "text - 13 - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "c7cb7917-eaf4-4a1e-989a-75f4b6182851"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Internal Users Forwarding Emails Externally<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded emails to external addresses (regardless of the forwarding type used). Helps identify potential data exfiltration risks and enforce forwarding policies.**"
+            },
+            "customWidth": "50",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "5a5d5a8c-c195-45db-a878-e6ac908cc919"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises automatic email forwarding to external email addresses by forwarding type\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize count() by ForwardingType\r\n| sort by count_ desc \r\n",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "chartSettings": {
+                "yAxis": [
+                  "count_"
+                ],
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 30 - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "15094d98-add2-4b50-a0df-ee91fd34c6fb"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| sort by TotalForwardedMessages desc \r\n| top 10 by TotalForwardedMessages\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\r\n\r\n",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Forwarded Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "yAxis": [
+                  "TotalForwardedMessages"
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 30 - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "73d66038-2ea0-449d-9aeb-a1bd4b207d7f"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Internal Users Forwarding Emails Using Mailbox Rules<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+            },
+            "customWidth": "100",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "9a7b5fc3-da23-4e95-87df-542a5e3f6320"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Forwarded Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "yAxis": [
+                  "TotalForwardedMessages"
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - 30 - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "f8d7b85d-944a-493f-a143-7e18277846c9"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 External domains Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\r\n\r\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+            },
+            "customWidth": "50",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "cda99a50-b7c4-4d95-ac61-7231080a3f5d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 External Recipients Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\r\n\r\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+            },
+            "customWidth": "50",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "72b01575-c33e-457c-98db-ea755c003bf0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 external domains who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Forwarded Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "yAxis": [
+                  "count_"
+                ],
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "823dec28-48b5-4be3-8e68-04301a952a62"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Forwarded Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "yAxis": [
+                  "count_"
+                ],
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "14804990-bfc9-43b7-8c8d-95c2cf32ee56"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Internal Users Forwarding Emails via SMTP Forwarding<br>\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+            },
+            "customWidth": "100",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "fa04b313-5756-4ff7-9ee8-ec61e6b382cc"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize count() by ForwardingUser\r\n| top 10 by count_ desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=count_",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "chartSettings": {
+                "yAxis": [
+                  "count_"
+                ],
+                "createOtherGroup": 10
+              },
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Forwarded Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "query - 30 - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "bed8e717-4ea7-4f71-aaa7-b70a31f4dc88"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 External domains receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\r\n\r\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+            },
+            "customWidth": "50",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "f76bc717-3cf8-4d8d-92fa-3f2024065f8f"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 External Recipients Receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\r\n\r\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**"
+            },
+            "customWidth": "50",
+            "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "2190c799-ab4f-4bd8-87e1-f9c5c224cca4"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Forwarded Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "yAxis": [
+                  "count_"
+                ],
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 30 - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "c3be87b3-8ce8-40f2-ad92-0651bed71117"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Forwarded Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              },
+              "chartSettings": {
+                "yAxis": [
+                  "count_"
+                ],
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 30 - Copy - Copy - Copy - Copy - Copy",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "fb6b0113-f5bb-46a7-994b-92ebc3c7881d"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "6"
+      },
+      "name": "group - 34 - Automatic email forwarding",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "02c91ebb-4f92-4843-a73b-6dea7a6ac2bd"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Email detection action overrides\r\n\r\n---\r\n\r\nThis tab provides insights into admin or end-user configured **detection overrides** where the message was detected as a threat by Microsoft Defender for Office 365, however an admin-configured policy or end-user setting overrode the detection action.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/understand-overrides-in-email-entity) "
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "7"
+      },
+      "name": "text - 13 - Copy",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "ae594968-00b9-40b8-b5dd-052a27440afb"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Admin configured Detection Overrides (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track emails subject to administrator policies (e.g., Transport Rules, Tenant Allow/Block List) with an \"Allow\" action, overriding Microsoft Defender for Office 365 detections (excluding SecOps Mailbox overrides).<br><br>**Recommended action:** Review Allow overrides that later carried threats and remove stale or overly broad allow entries - they weaken protection."
+            },
+            "name": "text - AdminOverridesAllowHeader",
+            "id": "3d70a304-c590-4156-a6d4-da147fe106ab"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin Overrides (Allow) Trend\r\n**Displays the count (per {Granularity}) of emails where an administrator policy with an \"Allow\" action overrode detections (excluding SecOps Mailbox). Helps track the frequency of admin overrides over time.**"
+            },
+            "name": "text - AdminOverridesAllowTrend",
+            "id": "a4ee104a-a0a1-4725-a60f-deedcc91af70"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails subject to an admin policy with action of allow independent of action taken, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "Admin Overrides",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "name": "query - 3",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "79928e9e-48ed-4d08-8ff7-c21fe027550e"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Total Emails by Admin Override type (Allow)\r\n**Summarizes the total count of emails subject to administrator policies with an \"Allow\" action, grouped by the type of override. Helps identify which policies are most frequently allowing emails.**"
+            },
+            "customWidth": "50",
+            "name": "text - AdminOverridesAllowByType",
+            "id": "855fce09-2000-4d16-8521-8b4eeddfae00"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin Overrides (Allow) by Override Type and Threat Type\r\n**Details the count of emails allowed by administrator policies, categorized by the override type and the detected threat type. Helps assess the risk associated with allowed emails.**"
+            },
+            "customWidth": "50",
+            "name": "text - AdminOverridesAllowByTypeAndThreat",
+            "id": "a2613078-b427-4b23-aca0-21989b1944db"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "query - 16",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b21a0329-8f52-45c2-81f2-6df65c134673"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Total Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 2",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "0bf4cbe6-7c84-49d4-801c-d955762b5699"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### SecOps Mailbox Overrides (Allow)\r\nThis section focuses on emails allowed specifically due to the SecOps Mailbox override policy, typically used for investigation and analysis.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/advanced-delivery-policy-configure) "
+            },
+            "name": "text - SecOpsOverridesHeader",
+            "id": "f582dc86-4c40-4cdd-ba0b-ec6ef8820a27"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of emails subject to the \r\nEmailEvents \r\n| where OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "stat",
+              "statSettings": {
+                "valueAggregation": "None",
+                "colorSettings": {
+                  "type": "static",
+                  "mode": "background",
+                  "heatmapPalette": "greenRed",
+                  "thresholdsGrid": []
+                },
+                "iconSettings": {
+                  "thresholdsGrid": []
+                },
+                "tagText": "",
+                "valueFontStyle": "auto",
+                "tagTextPosition": "bottom"
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 1",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "8ad2fea4-dcd0-454e-a4d4-b5275c86fd9b"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails delivered to the SecOps Mailbox by threat type\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+              "size": 1,
+              "showAnalytics": true,
+              "title": " ",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Total Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 4",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "52c04df2-69b5-46e4-a000-7c6d212a132a"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "7"
+      },
+      "name": "group - 15 - Admin Detection Overrides - Allow",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "9b9baf2f-fd5f-41b6-8368-b515f8de4fd4"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Admin configured Detection Overrides (Block)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email messages blocked by administrative policies (e.g. Tenant allow/block list, Antimalware policy file type block), overriding detection actions defined by Microsoft Defender for Office 365.<br><br>**Recommended action:** Confirm these blocks are still needed and consolidate them into the Tenant Allow/Block List where appropriate."
+            },
+            "name": "text - AdminOverridesBlockHeader",
+            "id": "6157683b-cce7-4165-886f-0da73e25ce86"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin Overrides (Block) Trend\r\n**Displays the count (per {Granularity}) of emails where an administrator policy with a \"Block\" action overrode detections. Helps track the frequency of admin blocks over time.**"
+            },
+            "name": "text - AdminOverridesBlockTrend",
+            "id": "699820b4-a984-45cc-ab2f-607c3c8569d4"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "Admin Overrides",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - 5",
+            "styleSettings": {
+              "margin": "10",
+              "padding": "10"
+            },
+            "id": "9ef5e7fb-843e-439b-b4f3-9b0bb149e74b"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Total Emails by Admin Override Type (Block)\r\n**Summarizes the total count of emails subject to administrator policies with a \"Block\" action, grouped by the type of override.**"
+            },
+            "customWidth": "50",
+            "name": "text - AdminOverridesBlockByType",
+            "id": "5694a7c0-1ee5-40b4-ae2b-263d189c4b4e"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin Overrides (Block) by Override Type and Threat Type\r\n**Details the count of emails blocked by administrator policies, categorized by the override type and the detected threat type.**"
+            },
+            "customWidth": "50",
+            "name": "text - AdminOverridesBlockByTypeAndThreat",
+            "id": "6e309742-37c0-4ad5-9b9a-63643059bfaf"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of emails subject to an admin policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "query - 6",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "eabc80ed-d0e9-43d2-ab13-a5af478f11c8"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Total Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 7",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "1661bfa6-d8fd-4387-a334-1bc027a3f6d1"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "7"
+      },
+      "name": "group - 36-Admin Detection Overrides - Block",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "7d514e9a-f67f-45a6-ba1b-6492348cc18b"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User configured Detection Overrides (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section consolidates key visuals that track email messages subject to user policies (e.g. [Safe Senders list defined in Outlook](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365#use-outlook-safe-senders)) with an \"Allow\" action, overriding Microsoft Defender for Office 365 detections.<br><br>**Recommended action:** Educate users that safe-sender allows can bypass protection; review high-risk user allow entries."
+            },
+            "name": "text - UserOverridesAllowHeader",
+            "id": "4d41c560-0e73-40c5-b610-33e9500e88c4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User Overrides (Allow) Trend\r\n**Displays the count (per {Granularity}) of emails where a user policy with an \"Allow\" action overrode detections. Helps track the frequency of user overrides over time.**"
+            },
+            "name": "text - UserOverridesAllowTrend",
+            "id": "9432efff-9f03-4d74-8781-02be8b2d07fa"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "User Overrides",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "name": "query - 3",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "02da1d33-e477-479d-bdd3-95ab1ad7c75c"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Total Emails by User Override Type (Allow)\r\n**Summarizes the total count of emails subject to user policies with an \"Allow\" action, grouped by the type of override.**"
+            },
+            "customWidth": "50",
+            "name": "text - UserOverridesAllowByType",
+            "id": "006a2e87-b1b6-4cc3-a763-ceebaa86b340"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User Overrides (Allow) by Override Type and Threat Type\r\n**Details the count of emails allowed by user policies, categorized by the override type and the detected threat type. Helps assess the risk associated with user-allowed emails.**"
+            },
+            "customWidth": "50",
+            "name": "text - UserOverridesAllowByTypeAndThreat",
+            "id": "7c34bb4b-46c0-4054-9596-3dfd010bb036"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "query - 16",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "d1d9021d-e6bf-47b1-bdd2-438a212d2767"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Total Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              },
+              "sortBy": []
+            },
+            "customWidth": "50",
+            "name": "query - 2",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "1acd913c-c945-4a58-b04e-d008ca53ffe3"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "7"
+      },
+      "name": "group - 15 - User Detection Overrides - Allow",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "c939060e-6a8b-49ff-951b-a3abddbd9fb4"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User configured Detection Overrides (Block)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into emails blocked by user-configured policies (e.g., [Blocked Senders list in Outlook](https://support.microsoft.com/en-us/office/block-or-unblock-senders-in-outlook-9bf812d4-6995-4d19-901a-76d6e26939b0)).<br><br>**Recommended action:** Use user block trends to identify unwanted senders that may warrant tenant-wide blocking."
+            },
+            "name": "text - UserOverridesBlockHeader",
+            "id": "be6c6a3e-08ee-47c5-b8e7-6a1078dd17d1"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User Overrides (Block) Trend\r\n**Displays the count (per {Granularity}) of emails where a user policy with a \"Block\" action overrode detections. Helps track the frequency of user blocks over time.**"
+            },
+            "name": "text - UserOverridesBlockTrend",
+            "id": "7cd77d54-2e2b-4d23-a6a9-4bd6bca2642a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "User Overrides",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "query - 5",
+            "styleSettings": {
+              "margin": "10",
+              "padding": "10"
+            },
+            "id": "0b21b66c-001d-4b3d-b47f-f3a420ccaaf8"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Total Emails by User Override Type (Block)\r\n**Summarizes the total count of emails subject to user policies with a \"Block\" action, grouped by the type of override.**"
+            },
+            "customWidth": "50",
+            "name": "text - UserOverridesBlockByType",
+            "id": "fd513501-5e9d-45d9-9d0d-cd546002b8cf"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User Overrides (Block) by Override Type and Threat Type\r\n**Details the count of emails blocked by user policies, categorized by the override type and the detected threat type.**"
+            },
+            "customWidth": "50",
+            "name": "text - UserOverridesBlockByTypeAndThreat",
+            "id": "4fbfa876-47ed-4c3b-81ee-1c40b982cecd"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of emails subject to a user type policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "query - 6",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "d3fccaa6-80fd-419d-bb37-aedf67263419"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Total Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "query - 7",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "e5e74ce1-fa67-45ea-bc80-97237342e370"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "7"
+      },
+      "name": "group - 37-User Detection Overrides - Block",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "0c1d327a-c2f1-4b9b-b210-53c808b53b48"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">User &amp; Sender Override Detail (Allow)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nInbound messages that Microsoft Defender for Office 365 **detected as threats but delivered anyway** because of an admin- or user-configured **Allow** override (phishing-simulation and SecOps Mailbox traffic excluded). **Total Threats** is all detected threats to that recipient / sender domain in the selected range; **Overridden Threats** and **Override %** are the portion delivered due to an Allow override, and **Override Types** names the specific overrides responsible. **User-configured** overrides come from the recipient's own mailbox junk-email settings in Outlook / Outlook on the web (the mailbox \"safelist collection\") &mdash; the **Safe Senders** and **Safe Recipients** lists and **trusted contacts** (\"Also trust email from my Contacts\"). **Admin-configured** overrides come from the **Tenant Allow/Block List, Exchange mail flow (transport) rules, the IP Allow List, or allowed sender/domain lists in anti-spam policies**. Use this to spot users or domains where overrides are letting threats through &mdash; candidates for policy review or a Tenant Allow/Block List (TABL) block.<br><br>**Recommended action:** Focus on the users and sender domains with the most allow overrides - these are the biggest protection gaps."
+            },
+            "name": "Overrides - User Detail Header",
+            "id": "3b0e83f3-f340-4b95-85c5-831783e8abc2"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top recipients receiving threats that were delivered due to an admin or user override, with the share of their threats that were overridden and a breakdown of which override types caused them.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n    \"(none)\")\r\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n        by RecipientEmailAddress\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 15 by OverriddenThreats\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Overridden Threats",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Override %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              },
+              "graphSettings": {
+                "type": 2,
+                "topContent": {
+                  "columnMatch": "StatisticName",
+                  "formatter": 1
+                },
+                "centerContent": {
+                  "columnMatch": "Value",
+                  "formatter": 1,
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "maximumSignificantDigits": 3,
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                },
+                "nodeIdField": "StatisticName",
+                "sourceIdField": "Value",
+                "targetIdField": "Value",
+                "graphOrientation": 3,
+                "showOrientationToggles": false,
+                "nodeSize": null,
+                "staticNodeSize": 100,
+                "colorSettings": null,
+                "hivesMargin": 5,
+                "edgeColorSettings": null
+              }
+            },
+            "name": "Overrides - Top Users",
+            "id": "d7e169a2-808a-4bbf-86ee-5be561c690f7"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top sender domains sending threats to users, with the share of those threats that were delivered because of an admin or user override and a breakdown of which override types caused them. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n    \"(none)\")\r\n| summarize PerType = count() by SenderFromDomain, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n        by SenderFromDomain\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 10 by OverriddenThreats\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Overridden Threats",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Override %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ]
+              },
+              "graphSettings": {
+                "type": 2,
+                "topContent": {
+                  "columnMatch": "StatisticName",
+                  "formatter": 1
+                },
+                "centerContent": {
+                  "columnMatch": "Value",
+                  "formatter": 1,
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "maximumSignificantDigits": 3,
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                },
+                "nodeIdField": "StatisticName",
+                "sourceIdField": "Value",
+                "targetIdField": "Value",
+                "graphOrientation": 3,
+                "showOrientationToggles": false,
+                "nodeSize": null,
+                "staticNodeSize": 100,
+                "colorSettings": null,
+                "hivesMargin": 5,
+                "edgeColorSettings": null
+              }
+            },
+            "name": "Overrides - Top Sender Domains",
+            "id": "0eda3153-10ea-4d4e-80ca-7e5ad99e9883"
+          }
+        ]
+      },
+      "customWidth": "100",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "7"
+      },
+      "name": "Overrides - User & Sender Detail",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "d5f38e54-a3c7-4df6-b569-bbabe85e1a36"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# False Negative(FN) Submissions insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **False Negative(FN) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message reported to have **Malware, Phish or Spam threat** within its **content, URLs or attachments**."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "8"
+      },
+      "name": "text - 13 - Copy",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "3b243dca-89ce-41e6-bccb-9ceb0953aa2e"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Negative(FN) Admin submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message **False Negative(FN) Submissions performed by administrators** in Microsoft Defender for Office 365 where the message reported to have Malware, Phish or Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Prioritise admin-submitted misses for policy tuning; recurring sender domains may be block-list candidates."
+            },
+            "name": "fn admin - section header",
+            "id": "64420254-0dae-4495-bd55-fc49e5bc1ed0"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) Admin Submissions per-{Granularity} trend by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment). Helps to monitor where detections were missed and later submitted by admins as false negatives to Microsoft.**"
+            },
+            "name": "fn admin - trend heading",
+            "id": "5f2de929-6f32-4079-a031-cbf689c15b29"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the daily ammount of admin false negative submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Malware_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Malware_URL_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Malware_Attach_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\"), Admin_Phish_URL_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Phish_Attach_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Malware (Mail)']=coalesce(Admin_Malware_FN,0), ['Phish (Mail)']=coalesce(Admin_Phish_FN,0), ['Spam (Mail)']=coalesce(Admin_Spam_FN,0), ['Malware (URL)']=coalesce(Admin_Malware_URL_FN,0), ['Malware (Attachment)']=coalesce(Admin_Malware_Attach_FN,0), ['Phish (URL)']=coalesce(Admin_Phish_URL_FN,0), ['Phish (Attachment)']=coalesce(Admin_Phish_Attach_FN,0) | sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "TotalAdminSubmissions",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "Phish (Mail)",
+                    "color": "redBright"
+                  },
+                  {
+                    "seriesName": "Spam (Mail)",
+                    "color": "orange"
+                  },
+                  {
+                    "seriesName": "Malware (Mail)",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "Phish (URL)",
+                    "color": "purple"
+                  },
+                  {
+                    "seriesName": "Malware (Attachment)",
+                    "color": "yellowDark"
+                  },
+                  {
+                    "seriesName": "Phish (Attachment)",
+                    "color": "purpleDark"
+                  },
+                  {
+                    "seriesName": "Malware (URL)",
+                    "color": "yellow"
+                  }
+                ]
+              }
+            },
+            "name": "fn admin - submissions trend",
+            "id": "1b61155b-92a1-4533-9561-2e85e9a4dbf8"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) Admin Submissions by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment).**"
+            },
+            "customWidth": "50",
+            "name": "fn admin - by-type heading",
+            "id": "bbaa9ff9-a95d-495a-a44c-6b4cae888a24"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) Admin Submissions by submission State\r\n**Displays the total count of False Negative(FN) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**"
+            },
+            "customWidth": "50",
+            "name": "fn admin - by-state heading",
+            "id": "b060c706-342a-4b2e-b81a-920bf4d8c5d9"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of admin false negative submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Malware (URL)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Malware (Attachment)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Phish (URL)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Phish (Attachment)\",\r\n\"Other\")))))))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "chartSettings": {
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "50",
+            "name": "fn admin - by-type pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "9d9d714a-357b-4ac3-bcb7-33601d3c3108"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of admin false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize count() by tostring(SubmissionState)",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fn admin - by-state pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "169f0f1c-1f1e-44fb-965e-850733f01879"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN)/False Positive(FP) Admin Submissions by Triage Verdict\r\n**Displays the total count of False Negative(FN)/False Positive(FP) Admin Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**"
+            },
+            "customWidth": "50",
+            "name": "fn admin - triage-verdict heading",
+            "id": "3df841be-c1b0-4d61-8e38-316a34a48bd1"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top Admins Submitting False Negatives \r\n**Displays the top 15 admin accounts that submitted the highest number of false negative messages (missed detections) via AdminSubmission. Helps identify key contributors to threat remediation and potential patterns in detection gaps.**"
+            },
+            "customWidth": "50",
+            "name": "fn admin - top-admins heading",
+            "id": "e1e966f4-1f4d-4377-97c6-e2077fc0b8fa"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of admin false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fn admin - triage-verdict pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "6df0db72-f9db-444e-856a-4369921d199b"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top admins performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "16ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "fn admin - top-admins pie",
+            "id": "b5ccb4a1-9783-47cf-bf21-ded924f1a200"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) Admin Submissions by Top Sender Domains\r\n**For each top sender domain that admins reported missed threats for, shows the domain's MDO-detected threat profile (emails with threats and the Malware/Phish/Spam breakdown), the count of admin FN submissions, and the submission rate (Admin Submission % = admin submissions / total inbound from the domain). A high rate can flag a domain whose mail is frequently reported as missed.**"
+            },
+            "customWidth": "100",
+            "name": "fn admin - top-sender-domains heading",
+            "id": "1a481c97-ac85-4b62-a86d-51b33b5a8e68"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top 10 sender domains that admins reported false negatives (missed threats) for, with each domain's MDO-detected threat profile for context.\r\nlet subs = CloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\")\r\n| summarize AdminSubmissions=count() by P2SenderDomain;\r\nlet domainProfile = EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalInbound=count(), EmailsWithThreats=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by SenderFromDomain;\r\nsubs\r\n| join kind=leftouter (domainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend AdminSubmissionPct = round(AdminSubmissions * 100.0 / todouble(coalesce(TotalInbound, AdminSubmissions)), 2)\r\n| top 10 by AdminSubmissions desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails With Threats']=coalesce(EmailsWithThreats,0), ['Malware']=coalesce(Malware,0), ['Phish']=coalesce(Phish,0), ['Spam']=coalesce(Spam,0), ['Admin Submissions']=AdminSubmissions, ['Admin Submission %']=AdminSubmissionPct",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Emails With Threats",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Malware",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "90px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Phish",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "90px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Spam",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "90px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Admin Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "120px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Admin Submission %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "110px"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn admin - top-sender-domains table",
+            "id": "e56bed92-b0fb-4b76-90f3-169f4206418b"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) Admin Submissions by admin Detection override types\r\n**Displays the top 10 cases where emails were submitted as false negatives by admins, even though they were initially detected by Microsoft Defender for Office 365 but delivered due to an admin policy override. Includes details on PolicyOverride, PolicySource, and DetectionVerdict for deeper insight into override behaviour.**"
+            },
+            "customWidth": "100",
+            "name": "fn admin - override-types heading",
+            "id": "293c174c-0197-4cf8-bbce-36fe42e5cf1b"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was a admin policy override\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\"))),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\") and PolicyOverride !=\"NoOverride\"\r\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Override Source']=PolicyPolicyOverrideType, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn admin - override-types table",
+            "id": "97799422-53e0-4e3b-8103-297fd1c744eb"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "8"
+      },
+      "name": "group - 11-Fn Admin Submissions",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "45a1c185-4fbf-4e83-832e-1f20af427796"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Negative(FN) User submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message **False Negative(FN) Submissions performed by end users** in Microsoft Defender for Office 365 where the message reported as having Phish, Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Recognise engaged reporters, coach over-reporters, and use graded phishing verdicts to tune anti-phishing policy."
+            },
+            "name": "fn user - section header",
+            "id": "ca0b48e6-8bd8-4f99-956a-f9c72cc870db"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) User Submissions per-{Granularity} trend by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) User Submissions grouped by submission type (Spam, Phish and Attack simulations) . Helps to monitor where detections were missed and later submitted by users as false negatives.**"
+            },
+            "name": "fn user - trend heading",
+            "id": "60ac8608-7875-45e6-8c83-e6bd0c34af8b"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize User_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_AttackSim_Submission=countif(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Phish (Mail)']=coalesce(User_Phish_FN,0), ['Spam (Mail)']=coalesce(User_Spam_FN,0), ['Attack simulation reported']=coalesce(User_AttackSim_Submission,0) | sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "TotalAdminSubmissions",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "Phish (Mail)",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "Attack simulation reported",
+                    "color": "green"
+                  },
+                  {
+                    "seriesName": "Spam (Mail)",
+                    "color": "orangeDark"
+                  }
+                ]
+              }
+            },
+            "name": "fn user - submissions trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "29355816-6cba-4264-938e-b0b27afdcb12"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) User Submissions by submission State\r\n**Displays the total count of False Negative(FN) User Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of user submissions and identify bottlenecks or errors.**"
+            },
+            "customWidth": "50",
+            "name": "fn user - by-state heading",
+            "id": "6a4b32cc-b7e4-47bb-b1b9-f415df7e629c"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) User Submissions by Triage Verdict\r\n**Displays the total count of False Negative(FN)/False Positive(FP) User Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**"
+            },
+            "customWidth": "50",
+            "name": "fn user - triage-verdict heading",
+            "id": "1427e34f-be44-4517-ae73-cc4776a49fe7"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of user false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| summarize count() by tostring(SubmissionState)",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fn user - by-state pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "a6151271-e925-4804-a3c1-06afee27c026"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fn user - triage-verdict pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "6ff319ea-b5c5-4e33-9e5c-065aadbf465d"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) User Submissions of already detected Emails (from Junk folder)\r\n**Displays the total count of False Negative(FN) User Submissions where the email message was already detected by Microsoft Defender for Office 365 and the detection action was configured to deliver the message into the Junk folder of the user mailbox. It breaks down the result based on the original detection verdict determined by Microsoft Defender for Office 365. Helps track the user submissions of messages that already had a detection. Consider changing the detection action to Quarantine to avoid these submissions.**"
+            },
+            "name": "fn user - junk-folder heading",
+            "id": "d6338907-489d-4c88-b82f-260fc0f9d302"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| summarize count() by ThreatTypes,User_SubmissionType\r\n| project ThreatTypes,User_SubmissionType, Emails = count_",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fn user - junk-folder pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "c13452cb-e864-4f01-8623-51f3ea13bbbc"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId,UserId = (parse_json(RawEventData)).UserId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| summarize TotalJunkSubmittedEmailCount=count(),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by tostring(UserId)\r\n| top 15 by TotalJunkSubmittedEmailCount desc\r\n| project ['User']=UserId, ['Junk Submissions']=TotalJunkSubmittedEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Junk Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Phish",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Spam",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "fn user - junk-folder table",
+            "id": "b242f301-c9f7-41f9-aa73-03848bd58eae"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) User Submissions - Admin review status (Mark and Notify)\r\n**Displays counts of False Negative(FN) User Submissions that were reviewed by admins and marked with a notify action. The Mark and Notify action also can be taken automatically with Automated investigation and response (AIR). Helps track cases where admins confirmed user reports and communicated the outcome, supporting transparency and user trust.**"
+            },
+            "customWidth": "50",
+            "name": "fn user - mark-notify heading",
+            "id": "784bf171-53ae-4907-b2b0-7fc5039df231"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Negative(FN) User Submissions accuracy vs Admin review verdict\r\n**Displays counts of False Negative(FN) User Submissions (Phish, Junk, NotJunk) compared to admin review results. Highlights whether submissions were Correct, Not Correct, or misclassified comparing user submission type with the Admin decision using Mark and Notify action in Microsoft Defender for Office 365 (e.g., “Phish reported as Junk”, “Reported but not malicious”).**"
+            },
+            "customWidth": "50",
+            "name": "fn user - accuracy heading",
+            "id": "3d137383-6436-4213-9824-72f424b67290"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises user submissions where admin also performed 'mark and notify' action on the submission\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| summarize count() by Reviewed",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fn user - mark-notify pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "7bb7d116-bd61-4e46-81dd-d634a31e7369"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises user submissions type compared to admin review verdict. \r\n//Eg. User reporting a phish but admin review is 'not threat found'\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \"Correct\", iif(AdminReviewResult==\"Phish\" and UserReportedAs == \"Junk\", \"Phish reported as junk\",iif(AdminReviewResult==\"Junk\" and UserReportedAs == \"Phish\",\"Junk reported as Phish\",iif(AdminReviewResult==\"NotJunk\",\"Reported but not malicious or spam\",iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Not correct\")))))\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| where Reviewed==\"Reviewed\"\r\n| summarize count() by ReviewedAccuracy",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fn user - accuracy pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "8af1b9f0-995c-4c58-9960-8e69c6960987"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 P2 Email Senders domains in False Negative(FN) User Submissions \r\n**Displays the top 10 P2 email sender domains of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per domain to highlight high-risk sources.**"
+            },
+            "customWidth": "100",
+            "name": "fn user - top-p2-domains heading",
+            "id": "78dab1f9-09ec-46e2-aee4-f256e368cdd5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises top 10 sender domains of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromDomain;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromDomain\r\n| join TotalInboundbySender on SenderFromDomain\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Domain']=SenderFromDomain, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "User Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "14ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "User Submission %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "12ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn user - top-p2-domains table",
+            "id": "6e6a59d4-70e1-4d85-bebb-6bb23d25d2d9"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 P2 Individual Email Senders in False Negative(FN) User Submissions \r\n**Displays the top 10 P2 individual email sender addresses of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**"
+            },
+            "customWidth": "100",
+            "name": "fn user - top-p2-senders heading",
+            "id": "a6e8fda5-dd05-49ed-87e2-16443495396e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises top 10 sender email addresses of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "User Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "14ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "User Submission %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "12ch",
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn user - top-p2-senders table",
+            "id": "878fd15f-2607-4d6d-b919-0b4bea6a1850"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Intra-org Email Senders in False Negative(FN) User Submissions \r\n**Displays the top 10 email senders of intra-org emails reported by users as false negatives (missed detections). Includes total intra-org email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**"
+            },
+            "customWidth": "100",
+            "name": "fn user - intraorg-senders heading",
+            "id": "87a51814-7f01-42e3-aea2-4136c869d39d"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises top 10 sender email address of intra-org emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Intra-org\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Intra-org']=count_, ['User Submission %']=UserSubmissions_Percentage",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "User Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "14ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Intra-org",
+                    "formatter": 0,
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "User Submission %",
+                    "formatter": 4,
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    },
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "12ch"
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn user - intraorg-senders table",
+            "id": "38edca4b-a403-41e8-8c2b-7c0595e93b7a"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Intra-org Email Subjects in False Negative(FN) User Submissions \r\n**Displays the top 10 Email Subjects of intra-org emails reported by users as false negatives (missed detections). Helps to highlight high-risk intra-org email sources.**"
+            },
+            "customWidth": "100",
+            "name": "fn user - intraorg-subjects heading",
+            "id": "52b0bc5b-7e54-4a5b-a487-8a736a8c2397"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize count() by Subject\r\n| top 10 by count_ desc\r\n| project ['Subject']=Subject, ['User Submissions']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Subject",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "70ch"
+                    }
+                  },
+                  {
+                    "columnMatch": "User Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn user - intraorg-subjects table",
+            "id": "ee2c1d2e-3d4e-4024-8422-985b22cb7475"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Detection Overrides defined by Admins in False Negative(FN) User Submissions \r\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to an admin-defined policy override. Includes details on OrgLevelAction, OrgLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**"
+            },
+            "customWidth": "100",
+            "name": "fn user - admin-override heading",
+            "id": "0dd9b3ce-9716-42bb-93de-495f0af2d075"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an admin definded policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and OrgLevelAction!=\"\"\r\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Override Policy",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "48ch"
+                    }
+                  },
+                  {
+                    "columnMatch": "User Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn user - admin-override table",
+            "id": "100de6ca-beb0-44d7-a715-449a389e9e8a"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Detection Overrides defined by Users in False Negative(FN) User Submissions \r\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to a user-defined override. Includes details on UserLevelAction, UserLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**"
+            },
+            "customWidth": "100",
+            "name": "fn user - user-override heading",
+            "id": "67057c7d-c0af-4373-b23a-4001fbced888"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and UserLevelAction!=\"\"\r\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Override Policy",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "48ch"
+                    }
+                  },
+                  {
+                    "columnMatch": "User Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn user - user-override table",
+            "id": "1b97f7d2-152d-4eb0-bfac-e161fbfa4046"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 users performing the most False Negative(FN) User Submissions\r\n**Displays the Top 10 user accounts that performed the highest number of False Negative(FN) User Submissions (missed detections). Helps identify individuals most engaged in reporting suspicious, malicious messages and potential patterns in detection gaps.**"
+            },
+            "customWidth": "100",
+            "name": "fn user - top-users heading",
+            "id": "7799a0a0-a835-4080-b59a-736b08ad809e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top 10 users performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "16ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn user - top-users pie",
+            "id": "44838734-43a0-4301-9ddb-a644c7ec509a"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 users performing the most User Submissions of Attack simulation messages\r\n**Displays the top 10 user accounts that reported phishing simulation emails during cyber security awareness campaigns. Supports evaluation of cyber security awareness programme effectiveness and identifies highly engaged users.**"
+            },
+            "customWidth": "100",
+            "name": "fn user - attacksim-users heading",
+            "id": "8a96e90f-765f-40c0-8476-30c97d43c328"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top users reporting the phishing simulation emails.\r\nCloudAppEvents \r\n| extend Record= (parse_json(RawEventData)).RecordType \r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState \r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| where Record == 29\r\n| where ActionType == \"AttackSimUserSubmission\" \r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "16ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fn user - attacksim-users pie",
+            "id": "ab648c4a-4c46-4c73-96f0-784c9bcef961"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "8"
+      },
+      "name": "group - 11 - FN User submissions",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "348ce24a-7cbc-4b66-a471-dfe3827bed2d"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# False Positive(FP) Submissions insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **False Positive(FP) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by administrators or users."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "10"
+      },
+      "name": "fp - tab description",
+      "id": "78e2df52-a0d2-499a-95fe-708f67db5ad6"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Positive(FP) Admin Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nAdministrator submissions represent escalated false positive reports submitted by security team members rather than end users. These typically involve more complex cases requiring expert review, such as recurring issues affecting multiple users, business-critical communications being blocked, or suspected policy misconfigurations. Admin submissions carry higher priority and can result in actions as allow-list additions or global policy changes to prevent widespread user impact.<br><br>**Recommended action:** Review recurring false-positive sender domains and consider allow entries or policy tuning to reduce business disruption."
+            },
+            "name": "fp admin - section header",
+            "id": "02d54e9c-e989-4cde-a128-68a6381ed9d7"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin Submission Volume and Type Breakdown\r\n\r\n**These charts track the volume and composition of administrator-initiated false positive submissions. The trend chart shows submission patterns (per {Granularity}) across Email, URL, and Attachment types, while the pie chart reveals the distribution among these categories. Spikes in admin submissions often signal systemic issues requiring immediate policy review, as admins typically escalate only the most impactful or recurring problems.**"
+            },
+            "name": "fp admin - volume/type heading",
+            "id": "103b8362-a10f-4b46-a757-8290c4269a5c"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the daily ammount of admin false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Email_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_URL_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Attach_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Email']=coalesce(Admin_Email_FP,0), ['URL']=coalesce(Admin_URL_FP,0), ['Attachment']=coalesce(Admin_Attach_FP,0) | sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "TotalAdminSubmissions",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "Admin_Phish_FN",
+                    "color": "redBright"
+                  },
+                  {
+                    "seriesName": "Admin_Spam_FN",
+                    "color": "orange"
+                  },
+                  {
+                    "seriesName": "Admin_Malware_FN",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "Admin_Phish_URL_FN",
+                    "color": "purple"
+                  },
+                  {
+                    "seriesName": "Admin_Malware_Attach_FN",
+                    "color": "yellowDark"
+                  },
+                  {
+                    "seriesName": "Admin_Phish_Attach_FN",
+                    "color": "purpleDark"
+                  },
+                  {
+                    "seriesName": "Admin_Malware_URL_FN",
+                    "color": "yellow"
+                  },
+                  {
+                    "seriesName": "Admin_Email_FP",
+                    "color": "redDark"
+                  },
+                  {
+                    "seriesName": "Admin_URL_FP",
+                    "color": "orangeDark"
+                  },
+                  {
+                    "seriesName": "Admin_Attach_FP",
+                    "color": "yellow"
+                  }
+                ]
+              }
+            },
+            "customWidth": "66",
+            "name": "fp admin - submissions trend",
+            "id": "326762ca-1f2b-48e9-90d6-ff2aa6a75e95"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of admin false positive submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Email\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"URL\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Attachment\",\r\n\"Other\")))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart",
+              "chartSettings": {
+                "createOtherGroup": 10
+              }
+            },
+            "customWidth": "33",
+            "name": "fp admin - by-type pie",
+            "id": "be925c4c-5718-4385-8e82-59c57b975ac5"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### False Positive(FP) Admin Submissions by submission state<br>\r\n\r\n**Displays the total count of False Positive(FP) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**"
+            },
+            "customWidth": "50",
+            "name": "fp admin - by-state heading",
+            "id": "2b2acb67-c070-48bd-acf1-025c05aae8b5"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top Admins Submitting False Positives<br>\r\n\r\n**Displays the top 15 admin accounts that submitted the highest number of false positive messages via AdminSubmission.**"
+            },
+            "customWidth": "50",
+            "name": "fp admin - top-admins heading",
+            "id": "52206f40-fae9-460f-97b8-2cf9b633098f"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of admin false positive submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fp admin - by-state pie",
+            "id": "96133d9e-24fb-417e-a3cd-df98dda4c60a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top admins performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \r\n| where Record == 29 and SubmissionType ==\"3\"\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "16ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "fp admin - top-admins pie",
+            "id": "da7b4c89-904d-4917-b6cd-04b32e02d4a1"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin Submission False Positive Malware Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as malware.**"
+            },
+            "customWidth": "100",
+            "name": "fp admin - malware-detection heading",
+            "id": "69d649e0-86fd-4c08-afd4-e6c200b11c86"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Admin false positive submissions whose original verdict was Malware, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Malware.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Malware\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Malware\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Malware FPs'] = Pct",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Sender Domains",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "20ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "% of",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "14ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp admin - malware-detection table",
+            "id": "607eb19b-1ded-488d-98db-8b23f9e90967"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin Submission False Positive Phish Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**"
+            },
+            "customWidth": "100",
+            "name": "fp admin - phish-detection heading",
+            "id": "c1f1e12f-d0aa-4023-9172-8182772b3331"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Admin false positive submissions whose original verdict was Phish, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Phish.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Phish\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Phish\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Phish FPs'] = Pct",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Sender Domains",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "20ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "% of",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "14ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp admin - phish-detection pie",
+            "id": "b6c074f9-affa-41a3-802a-53541394ae73"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin Submission False Positive Spam Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**"
+            },
+            "customWidth": "100",
+            "name": "fp admin - spam-detection heading",
+            "id": "f0f2adb9-34af-4df0-90e6-087a265bedf6"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Admin false positive submissions whose original verdict was Spam, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Spam.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Spam\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Spam\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Spam FPs'] = Pct",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Sender Domains",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "20ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "% of",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "14ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp admin - spam-detection pie",
+            "id": "e877d9c9-3bd3-4368-997e-945f18ffcf5f"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Sender Domains for Admin False Positive Submissions<br>\r\n\r\n**Lists the top 10 sender domains of emails reported as false positives by administrators (legitimate messages incorrectly flagged as spam or phishing). Helps identify domains frequently misclassified.**"
+            },
+            "customWidth": "50",
+            "name": "fp admin - top-sender-domains heading",
+            "id": "37680101-7e4b-4bcc-9e7e-0ccd2d914881"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Admin False Positive Submissions by Original Threat Verdict<br>\r\n\r\n**Displays all administrator-submitted false positive emails by their original filter verdict (e.g., spam, phishing) and policy override details. Helps identify which threat categories are most often misclassified.**"
+            },
+            "customWidth": "50",
+            "name": "fp admin - by-verdict heading",
+            "id": "879e81ad-00a6-4a10-bcb6-56879133bb9f"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top 10 sender domains of emails which are submitted as false positive by admins\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType ==\"3\"\r\n| summarize count() by P2SenderDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "fp admin - top-sender-domains table",
+            "id": "42844dc9-4418-487b-a5ad-31e1f6b4b487"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Email\",\r\n\"Other\"),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Emails",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "40ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "fp admin - by-verdict table",
+            "id": "3ebbd402-06ef-45a7-b4ee-c5938b98b540"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "10"
+      },
+      "name": "fp admin - group",
+      "styleSettings": {
+        "showBorder": true
+      },
+      "id": "b6215b53-c181-4693-a14f-441809f65f38"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">False Positive (FP) User Submissions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into email message False Postive(FP) Submissions performed by end users in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by users. User submissions are critical feedback mechanisms that help security teams identify overly aggressive detection rules, refine security policies, and reduce user friction. High false positive rates can erode user trust and lead to security fatigue, so monitoring these metrics helps balance protection with productivity.<br><br>**Recommended action:** High user false-positive volume suggests over-aggressive filtering - review the affected senders and adjust policy."
+            },
+            "name": "fp user - section header",
+            "id": "0d93d7ee-a61e-43b7-bdcd-172bd79ad050"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User Submission Trend\r\n\r\n**Displays the volume (per {Granularity}) of false positive submissions from end users. A sudden spike may indicate a new detection rule causing widespread misclassification, while a declining trend suggests improving detection accuracy. Monitoring this trend helps security teams respond quickly to detection issues before they impact user productivity.**"
+            },
+            "name": "fp user - trend heading",
+            "id": "c3f8ae45-0498-4fa8-b9d1-35e926932639"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the daily ammount of user false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where SubmissionType == \"3\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User FP Submissions'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "User FP Submissions",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "fp user - submissions trend",
+            "id": "847032f5-56a8-4681-9665-9e917c7c9355"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User False Positive Submissions by State<br>\r\n\r\n**Displays the total number of user-reported false positive email submissions grouped by their processing state (e.g., pending, completed). Helps track submission workflow and resolution progress.**"
+            },
+            "customWidth": "50",
+            "name": "fp user - by-state heading",
+            "id": "7bd03278-7734-4fbf-a502-95b42e90160e"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top Users Performing False Positive Submissions<br>\r\n\r\n**Lists the top 15 users who reported emails as false positives (legitimate messages incorrectly flagged as threats). Helps identify frequent reporters and potential training or policy adjustment needs.**"
+            },
+            "customWidth": "50",
+            "name": "fp user - top-users heading",
+            "id": "7e2b987b-325d-4f69-8d6b-fafd6676a03a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of user false positive submission by submission state.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "fp user - by-state pie",
+            "id": "df79d08b-3eac-4101-a3f2-3a4a3bf450ce"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the top users performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "16ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "fp user - top-users pie",
+            "id": "ec7505d8-3a70-4bde-a985-baf5a0c4ec34"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User Submission False Positive Malware Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection technique that flagged them. Malware quarantine is admin-only by default, so this table only populates when a custom quarantine policy lets users view and report their own malware detections - it is usually empty.**"
+            },
+            "customWidth": "100",
+            "name": "fp user - malware-verdict heading",
+            "id": "693b1072-5ddd-49d0-a0f5-2bba4c287edf"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//User false positive submissions whose email was originally flagged as Malware, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Malware.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Malware\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Sender Domains",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "22ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp user - malware-verdict table",
+            "id": "10ea55bd-937e-454d-b6cc-a9dccfdf3417"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User Submission False Positive Phish Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**"
+            },
+            "customWidth": "100",
+            "name": "fp user - phish-verdict heading",
+            "id": "6dd14abb-2772-4271-89d8-8c0dcdbfd9e5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//User false positive submissions whose email was originally flagged as Phish, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Phish.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Phish\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Sender Domains",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "22ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp user - phish-verdict pie",
+            "id": "57049aad-eb17-4e65-a8a4-b5d05b0501cd"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### User Submission False Positive Spam Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**"
+            },
+            "customWidth": "100",
+            "name": "fp user - spam-verdict heading",
+            "id": "5479b2ed-b629-41e7-9857-c91191b09c8f"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//User false positive submissions whose email was originally flagged as Spam, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Spam.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Spam\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Sender Domains",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "22ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp user - spam-verdict pie",
+            "id": "45a2122e-0281-4602-906d-a0406ed20d54"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Sender Domains for User False Positive Submissions<br>\r\n\r\n**Lists the top 10 sender domains of emails reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify domains frequently misclassified.**"
+            },
+            "customWidth": "100",
+            "name": "fp user - top-sender-domains heading",
+            "id": "2751fca4-3ac5-45fe-a965-8c811018926a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top 10 sender domains reported as false positives by users, with each domain's total inbound volume and the share of it reported as FP (a high rate flags a domain whose legitimate mail is most often misclassified).\r\nlet totalByDomain = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderFromDomain;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize FPSubmissions = count() by P2SenderDomain\r\n| join kind=leftouter (totalByDomain) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Domain'] = P2SenderDomain, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "18ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "FP Submission %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "16ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp user - top-sender-domains table",
+            "id": "c69b126d-9f25-44a0-b96d-601d89a563f1"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Senders in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 email senders whose messages were reported as false positives by users (legitimate emails incorrectly flagged as threats). Helps identify senders frequently misclassified.**"
+            },
+            "customWidth": "100",
+            "name": "fp user - top-senders heading",
+            "id": "b39966ad-2b40-4144-ae3f-c7ac6b9fb97c"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top 10 email senders reported as false positives by users, with each sender's total inbound volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Inbound",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "18ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "FP Submission %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "16ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp user - top-senders table",
+            "id": "077ab610-58ed-4d23-886c-dbf912cef2d7"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Subjects in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 email subjects reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify common patterns in misclassified emails.**"
+            },
+            "customWidth": "100",
+            "name": "fp user - top-subjects heading",
+            "id": "a5b939e1-0fbf-4ee1-a6a3-01fa7639af3a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top 10 email subjects reported as false positives by users, with how many distinct recipients reported each (a subject reported by many users is a broad misclassification pattern).\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count(), DistinctRecipients = dcount(RecipientObjectId) by Subject\r\n| top 10 by FPSubmissions desc\r\n| project ['Subject'] = Subject, ['FP Submissions'] = FPSubmissions, ['Distinct Recipients'] = DistinctRecipients",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Subject",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "70ch"
+                    }
+                  },
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Recipients",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "18ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp user - top-subjects table",
+            "id": "71d5c290-f5d0-493c-b821-b5345dbe7312"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top 10 Intra-Org Senders in User False Positive Submissions<br>\r\n\r\n**Displays the top 10 internal senders whose emails were reported as false positives by users (legitimate intra-org messages incorrectly flagged as threats). Helps identify internal communication patterns causing misclassification.**"
+            },
+            "customWidth": "100",
+            "name": "fp user - intraorg-senders heading",
+            "id": "1d38f458-dfde-4608-ad7d-ee8628e85ee7"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top 10 internal senders whose emails were reported as false positives by users, with total intra-org volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Intra-org\" | summarize TotalIntraOrg = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalIntraOrg) or TotalIntraOrg == 0, 0.0, round(FPSubmissions * 100.0 / TotalIntraOrg, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Intra-org'] = coalesce(TotalIntraOrg, 0), ['FP Submission %'] = FPPct",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "FP Submissions",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Total Intra-org",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "18ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "FP Submission %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "16ch"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "fp user - intraorg-senders table",
+            "id": "b6699a7f-897a-4016-ae2c-d816f3a9492b"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "10"
+      },
+      "name": "fp user - group",
+      "styleSettings": {
+        "showBorder": true
+      },
+      "id": "2ad3311e-e92b-4a49-bdd0-775f085c4587"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# File Malware Detections (SharePoint, Teams and OneDrive)\r\n\r\n---\r\n\r\nThis tab provides insights into malicious file detections across Microsoft collaboration platforms such as SharePoint, OneDrive, and Teams.\r\n\r\n[<p><b>Safe Attachments for SharePoint, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-about)\r\n[<p><b>Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-for-spo-odfb-teams-about) "
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "9"
+      },
+      "name": "filemal - tab description",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "cefcac88-f373-4748-b0ea-e7600f63edd7"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "//Microsoft Defender for Office 365 value for files in SharePoint / OneDrive / Teams: total files processed, how many had a malware detection, and how many were scanned with no detection. A per-period Trend series feeds the tile sparkline.\r\nlet gran = {Granularity};\r\nlet base = FileMaliciousContentInfo;\r\nlet counts = union\r\n(base | summarize Count = count() | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files Scanned - No Detection\", Ord = 3);\r\nlet tagged = union\r\n(base | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\"),\r\n(base | where isnotempty(ThreatTypes) | extend Cat = \"Files with Malware Detected\"),\r\n(base | where isempty(ThreatTypes) | extend Cat = \"Files Scanned - No Detection\");\r\nlet trends = tagged | make-series Trend = count() default = 0 on Timestamp step gran by Cat;\r\ncounts\r\n| join kind=leftouter (trends) on Cat\r\n| sort by Ord asc\r\n| project Count, Details = Cat, Trend",
+        "size": 3,
+        "timeContextFromParameter": "TimeRange",
+        "queryType": "advancedHunting",
+        "visualization": "tiles",
+        "tileSettings": {
+          "titleContent": {
+            "columnMatch": "Details",
+            "formatter": 1
+          },
+          "leftContent": {
+            "columnMatch": "Count",
+            "formatter": 12,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            },
+            "numberFormat": {
+              "unit": 17,
+              "options": {
+                "style": "decimal",
+                "maximumFractionDigits": 1
+              }
+            }
+          },
+          "secondaryContent": {
+            "columnMatch": "Trend",
+            "formatter": 21,
+            "formatOptions": {
+              "min": 0,
+              "palette": "blue"
+            }
+          },
+          "showBorder": true,
+          "size": "auto"
+        }
+      },
+      "customWidth": "100",
+      "name": "filemal - MDO value tiles",
+      "id": "843e58a9-6324-4a90-a652-bfb0549e79dc",
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "9"
+      }
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">File Malware Detection (SharePoint, OneDrive, and Teams)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section monitors malware detections in files stored across Microsoft 365 collaboration platforms. Microsoft Defender for Office 365 and built-in SharePoint Online antivirus work together to scan files uploaded to SharePoint, OneDrive, and Teams. Understanding file-based malware patterns helps protect collaborative workspaces and identify potential security risks in shared content.<br><br>**Recommended action:** For repeat file owners or sites, investigate possible compromise and confirm Safe Attachments for SharePoint, OneDrive and Teams is enabled."
+            },
+            "name": "filemal - section header",
+            "id": "373fe4e5-fc90-49cf-93ba-c8b100efce57"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### File Malware Detection Trend<br>\r\n\r\n**This visual tracks the volume (per {Granularity}) of malware detections in files across all Microsoft 365 workloads. Spikes in detection activity may indicate targeted attacks or emerging malware campaigns affecting collaborative platforms. Regular monitoring helps identify unusual patterns that require investigation.**"
+            },
+            "name": "filemal - trend heading",
+            "id": "30145585-8998-443a-b6ec-062d136c621f"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(FileMaliciousContentInfo\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Files']=coalesce(Count, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "tileSettings": {
+                "showBorder": false
+              },
+              "graphSettings": {
+                "type": 0
+              },
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "Files",
+                    "color": "blueDark"
+                  }
+                ],
+                "showDataPoints": true
+              }
+            },
+            "customWidth": "100",
+            "name": "filemal - detection trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "d39cea9b-75a8-4c29-bfdb-2e0db855e98a"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Family Analysis - Defender for Office 365\r\n**Provides a breakdown of malware detections in files scanned by Microsoft Defender for Office 365 (Safe Attachments detonation) across SharePoint, OneDrive, and Teams. The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify dominant threats and their spread across collaboration platforms.**"
+            },
+            "customWidth": "100",
+            "name": "filemal - family MDO heading",
+            "id": "4e330873-f732-4d37-a7b0-dced08b019b0"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query summarizes File malware detections by Microsoft Defender for Office 365 (Safe Attachments detonation) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"detonation\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "tileSettings": {
+                "showBorder": false,
+                "titleContent": {
+                  "columnMatch": "RawinfoVirusInfo",
+                  "formatter": 1
+                },
+                "leftContent": {
+                  "columnMatch": "count_",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "auto"
+                  },
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "maximumSignificantDigits": 3,
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                }
+              },
+              "graphSettings": {
+                "type": 0,
+                "topContent": {
+                  "columnMatch": "RawinfoVirusInfo",
+                  "formatter": 1
+                },
+                "centerContent": {
+                  "columnMatch": "count_",
+                  "formatter": 1,
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "maximumSignificantDigits": 3,
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                }
+              },
+              "chartSettings": {
+                "xAxis": "RawinfoVirusInfo",
+                "createOtherGroup": 15
+              },
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Files",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "filemal - family MDO table",
+            "id": "c3fbb1c9-be67-43b9-9a32-7fb265a84ffc"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Family Analysis - SharePoint AV\r\n**Provides a breakdown of malware detections in files across SharePoint, OneDrive, and Teams caught by the built-in SharePoint antivirus (Antimalware engine). The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify prevalent threats and their spread across collaboration environments.**"
+            },
+            "customWidth": "100",
+            "name": "filemal - family SPO-AV heading",
+            "id": "331a8361-6e81-4615-b33a-97ebb3e31529"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query summarizes File malware detections by the built-in SharePoint antivirus (Antimalware engine) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"Antimalware engine\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "chartSettings": {
+                "xAxis": "RawinfoVirusInfo",
+                "createOtherGroup": 10
+              },
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Files",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "filemal - family SPO-AV table",
+            "id": "bbcdccd9-eedb-476a-a0e7-8504f8770229"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detections by Location<br>\r\n\r\n**Displays the number of malware detections grouped by specific SharePoint sites or OneDrive locations. Helps identify which sites have the highest volume of detected threats for targeted remediation and security hardening.**"
+            },
+            "customWidth": "50",
+            "name": "filemal - by-location heading",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "c5668d6e-7c0e-4ce3-9509-ca93dda3efad"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Detections by Application<br>\r\n\r\n**Summarizes malware detections across Microsoft collaboration apps, including SharePoint, OneDrive, and Teams. Helps identify which applications experience the highest volume of detected threats for targeted security measures.**"
+            },
+            "customWidth": "50",
+            "name": "filemal - by-application heading",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "07e64ca9-04a2-44b2-a044-e927bc73ef1b"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query lists total Malware detections of files on SharePoint, OneDrive and Teams by the location (site or personal path) where the file resides.\r\nFileMaliciousContentInfo\r\n| extend ['Site / Location'] = tostring(split(FolderPath, '/')[4])\r\n| summarize ['Detections'] = count() by ['Site / Location']\r\n| sort by ['Detections'] desc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "50",
+            "name": "filemal - by-location table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "3ce3ea65-a4df-450f-871c-8956d59818a9"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams summarizing the data by the Microsoft collaboration application (workload).\r\nFileMaliciousContentInfo\r\n| summarize count() by Workload\r\n| sort by count_ desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "50",
+            "name": "filemal - by-application pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "003afc8e-0403-4aa9-9084-a3c2e435216a"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Top File Owners Holding Malware\r\n**Lists the users (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, with the count of malicious files, distinct files, affected workloads and sample threat names. Helps pinpoint the accounts and collaboration locations most affected by malicious content for targeted remediation.**"
+            },
+            "customWidth": "100",
+            "name": "filemal - top-owners heading",
+            "id": "c2f8d3b5-0a4e-4b7c-9d23-8e6f0a1b2c34"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Top file owners (or the SharePoint/Teams site, when a file has no user owner) whose SharePoint/OneDrive/Teams files were flagged as malware, with distinct files, workloads and sample threat names.\r\nFileMaliciousContentInfo\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Malicious Files'] = count(),\n            ['Distinct Files']  = dcount(SHA256),\n            ['Workloads']       = make_set(Workload, 3),\n            ['Sample Threats']  = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\n            ['Last Seen']       = max(Timestamp)\n        by ['Owner']=Owner\n| top 20 by ['Malicious Files']",
+              "size": 0,
+              "title": "Top File Owners Holding Malware",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Malicious Files",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Distinct Files",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "name": "filemal - top-owners table",
+            "id": "36d9a683-9f9d-4a70-84d9-ec351542f827"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "9"
+      },
+      "name": "filemal - group",
+      "styleSettings": {
+        "showBorder": true
+      },
+      "id": "50886cd9-87bf-4a84-bd80-d7f44441b3f7"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Post-Delivery &amp; Quarantine Insights\r\n\r\n---\r\nThis tab covers what happens to threats **after delivery**: Zero-hour Auto Purge (ZAP) remediation of malicious messages already in mailboxes, and quarantine management - what is held, released, and by whom. Together they show how effectively post-delivery response contains threats that reached the inbox."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "11"
+      },
+      "name": "postdelivery - tab description",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "93371620-d968-4987-bddd-6c9b9e5a0344"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Post Delivery Protection offered by ZAP\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides insights into Microsoft Defender for Office 365's post-delivery protection capabilities through Zero-Hour Auto Purge (ZAP). ZAP is a critical security feature that continuously monitors delivered emails and automatically removes messages that are later identified as malicious. These visuals help track ZAP effectiveness, response times, and remediation patterns.<br><br>**Recommended action:** High post-delivery ZAP volume means threats are reaching inboxes before being caught - review pre-delivery filtering and detection latency."
+            },
+            "name": "postdelivery - section header",
+            "id": "b22ee5f1-a2dc-4509-92a3-1dbcad3a6ee7"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### ZAP Post-Delivery Actions (per {Granularity})<br>\r\n\r\n**Shows the count (per {Granularity}) of emails that were remediated post-delivery by Zero-Hour Auto Purge (ZAP). Helps track how often threats are detected and removed after reaching user mailboxes.**"
+            },
+            "customWidth": "50",
+            "name": "postdelivery - zap-actions heading",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "af1aa73f-d952-4827-bcc9-b97a19016829"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### ZAP Actions by Detection Type (per {Granularity})<br>\r\n\r\n**Visualizes the count (per {Granularity}) of post-delivery remediation actions performed by Zero-Hour Auto Purge (ZAP), broken down by detection type (Spam ZAP, Phish ZAP, Malware ZAP). Helps track which threat categories are most frequently remediated after delivery.**"
+            },
+            "customWidth": "50",
+            "name": "postdelivery - by-detection-type heading",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "8eb38cb1-4e2d-435a-81be-e661c9b89ff4"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailPostDeliveryEvents \r\n| where ActionType has \"ZAP\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Zapped Emails'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "Zapped Emails",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "postdelivery - zap-actions trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "dd60fd71-4e14-4b38-ad22-39f1e3e3f55a"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType has \"ZAP\"\r\n| summarize [\"Spam ZAP\"]=countif(ActionType has 'Spam ZAP'), [\"Phish ZAP\"]=countif(ActionType has 'Phish ZAP'), [\"Malware ZAP\"]=countif(ActionType has 'Malware ZAP') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Spam ZAP\"]=coalesce([\"Spam ZAP\"],0), [\"Phish ZAP\"]=coalesce([\"Phish ZAP\"],0), [\"Malware ZAP\"]=coalesce([\"Malware ZAP\"],0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "50",
+            "name": "postdelivery - by-detection-type trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "511f4a43-9f56-48ad-a644-b72722af82d7"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### ZAP Remediation by Destination<br>\r\n\r\n**This visual shows where ZAP moves malicious emails during remediation. Post-delivery actions can send emails to different locations: Quarantine (isolated for admin review), Deleted Items (soft delete), Junk Email folder, or back to Inbox (for false positive corrections). Understanding these patterns helps evaluate ZAP policy configurations and ensures malicious content is properly isolated from users.**"
+            },
+            "name": "postdelivery - by-destination heading",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "dc7b9b6c-36fb-4ae4-a3e8-ff11da681c97"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType contains \"ZAP\"\r\n| summarize Quarantine=countif(DeliveryLocation has 'Quarantine'), ['Deleted Items']=countif(DeliveryLocation has 'Delete'), Junk=countif(DeliveryLocation has 'Junk'), Inbox=countif(DeliveryLocation has 'Inbox') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Quarantine=coalesce(Quarantine,0), ['Deleted Items']=coalesce(['Deleted Items'],0), Junk=coalesce(Junk,0), Inbox=coalesce(Inbox,0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "name": "postdelivery - by-destination trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "cbb737ef-1c7e-4b3e-af26-a553fe6147c9"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "11"
+      },
+      "name": "postdelivery - group",
+      "styleSettings": {
+        "showBorder": true
+      },
+      "id": "e436ecee-8886-4179-a578-9e4a42e75b9e"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Quarantine Management and Insights\r\n</td>\r\n</tr>\r\n</table>\r\n\r\nThis section provides comprehensive insights into quarantine operations, including release patterns, detection methods, and threat categorization. It helps security teams understand what types of threats are being quarantined and monitor quarantine release activity to identify potential false positives or security policy effectiveness.<br><br>**Recommended action:** Investigate high release rates - they indicate false positives or risky user releases; review quarantine policies and release permissions."
+            },
+            "name": "quarantine - section header",
+            "id": "c4862977-6670-4716-8109-252a361d7478"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Quarantine Release Trend<br>\r\n\r\n**This visual displays the per-{Granularity} trend of emails released from quarantine by administrators. Monitoring this metric helps identify patterns in quarantine management and potential areas where policy adjustments may be needed to reduce unnecessary quarantines.**"
+            },
+            "name": "quarantine - release-trend heading",
+            "id": "8526a5e0-c6a4-44e3-b00a-5e135374f58e"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the daily ammount of emails released from quarantine\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\" and Action has 'Quarantine release'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Quarantine Releases'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "Quarantine Releases",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "100",
+            "name": "quarantine - release trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "3625d1f1-f34a-4cbf-a78f-eb2e5506bad4"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Quarantine Release Percentage<br>\r\n\r\n**Calculates the percentage of quarantined emails that were successfully released compared to the total quarantined messages. This metric helps measure engagement with quarantine and assess the effectiveness of quarantine policies.**"
+            },
+            "customWidth": "40",
+            "name": "quarantine - release-pct heading",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "e3a9502c-9030-4621-b248-55cdf69f81ae"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Quarantine Release Analysis by Detection Type<br>\r\n\r\n**For each detection technology, this shows the share of its quarantined emails that were later released from quarantine (Release % = released / quarantined). A high release rate flags a detector that may be over-flagging legitimate mail - a strong candidate for policy or rule tuning. The Released count shows the volume behind each rate.**"
+            },
+            "customWidth": "60",
+            "name": "quarantine - release-by-detection heading",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "976fc90f-bf46-4315-b05e-4e501b37b869"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))",
+              "size": 0,
+              "showAnalytics": true,
+              "title": " ",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "stat",
+              "tileSettings": {
+                "titleContent": {
+                  "columnMatch": "Release_Percentage",
+                  "formatter": 12,
+                  "formatOptions": {
+                    "palette": "none"
+                  },
+                  "numberFormat": {
+                    "unit": 1,
+                    "options": {
+                      "style": "decimal"
+                    }
+                  }
+                },
+                "showBorder": true,
+                "sortCriteriaField": "Release_Percentage",
+                "size": "auto"
+              },
+              "statSettings": {
+                "valueField": "Release_Percentage",
+                "valueAggregation": "None",
+                "colorSettings": {
+                  "type": "thresholds",
+                  "mode": "foreground",
+                  "heatmapPalette": "greenRed",
+                  "thresholdsGrid": [
+                    {
+                      "operator": "<",
+                      "thresholdValue": "5",
+                      "representation": "green"
+                    },
+                    {
+                      "operator": ">",
+                      "thresholdValue": "5",
+                      "representation": "redDark"
+                    }
+                  ]
+                },
+                "iconSettings": {
+                  "thresholdsGrid": []
+                },
+                "numberFormatSettings": {
+                  "unit": 1,
+                  "options": {
+                    "style": "decimal"
+                  }
+                },
+                "tagText": "Quarantine Release Percentage",
+                "valueFontStyle": "mega",
+                "tagTextPosition": "bottom"
+              }
+            },
+            "customWidth": "40",
+            "name": "quarantine - release-pct stat",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "64e157ce-2f6a-423f-9ce5-eade8b6f41d5"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Per detection technology: the share of its quarantined emails that were later released from quarantine.\r\n//Release % = released / quarantined for that detection technology - a high rate flags a detector that may be over-flagging legitimate mail (potential false positives). Detectors with fewer than 10 quarantined emails are excluded so the rate is statistically meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\r\n| join kind=leftouter (\r\n    EmailPostDeliveryEvents\r\n    | where Action == \"Quarantine release\"\r\n    | distinct NetworkMessageId\r\n    | extend ReleasedFlag = \"yes\"\r\n  ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc",
+              "size": 3,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Quarantined Emails",
+                    "formatter": 0,
+                    "formatOptions": {
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Released",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "90px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Release %",
+                    "formatter": 4,
+                    "formatOptions": {
+                      "palette": "red",
+                      "min": 0,
+                      "max": 20,
+                      "customColumnWidthSetting": "90px"
+                    },
+                    "numberFormat": {
+                      "unit": 1,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "60",
+            "name": "quarantine - release-by-detection pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "9a6d21b7-7542-4ae5-8f3f-b18474b52a20"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Malware Email Quarantine Analysis<br>\r\n\r\n**These visuals break down quarantined malware emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple malware detection techniques including file detonation, file reputation analysis, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-malware policies and identify emerging malware tactics.<br>The line chart shows per-{Granularity} trends across all malware detection methods, while the table provides an overall distribution of detection reasons.**"
+            },
+            "name": "quarantine - malware heading",
+            "id": "59f84161-a010-44c2-aec1-b72ed98ccdff"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of malware emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Malware\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "100",
+            "name": "quarantine - malware trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "a54a8daf-0be2-4c0e-a8d7-4ff0e0879fd2"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of malware emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Malware (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Malware' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Malware)\r\n| summarize count() by Malware\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Malware, ['Detections']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "quarantine - malware table",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "b5d0d022-cf41-47e5-ae06-cf2176b47758"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Phishing Email Quarantine Analysis<br>\r\n\r\n**These visuals break down quarantined phishing emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple phishing detection techniques including impersonation protection, URL detonation, spoof detection, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-phishing policies and identify emerging phishing tactics.<br>The line chart shows per-{Granularity} trends across all phishing detection methods, while the table provides an overall distribution of detection reasons.**"
+            },
+            "name": "quarantine - phish heading",
+            "id": "aca50104-cb68-4a8f-82ee-ea8eee25fe14"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of phish emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Phish\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "100",
+            "name": "quarantine - phish trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "57151360-0577-45ce-8fc6-10a3790865ce"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of phish emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Phish (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Phish)\r\n| summarize count() by Phish\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Phish, ['Detections']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "quarantine - phish pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "df78c64b-76f6-4980-80df-d0d432e780a5"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Spam Email Quarantine Analysis<br>\r\n\r\n**These visuals provide detailed insights into quarantined spam emails categorized by detection methods. Spam detection technologies include advanced filters, general filters, bulk email filtering, reputation-based systems (IP, domain, URL), and mixed analysis detection. Analyzing spam quarantine patterns helps fine-tune spam filtering policies to balance security with user productivity and reduce false positives.<br>The line chart displays per-{Granularity} trends for each spam detection method, while the table shows the overall distribution.**"
+            },
+            "name": "quarantine - spam heading",
+            "id": "e131910f-0233-474a-a9b8-9f70a49246cf"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the ammount of spam emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet baseQuery = EmailEvents\r\n| where DetectionMethods has \"Spam\" and DeliveryLocation == \"Quarantine\";\r\nlet agg = materialize(baseQuery\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "100",
+            "name": "quarantine - spam trend",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "5762bcc7-bbda-4a3d-91cf-de18fbdd2775"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query visualises the total ammount of spam emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Spam (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Spam)\r\n| summarize count() by Spam\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Spam, ['Detections']=count_",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Detections",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "30ch"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal"
+                      }
+                    }
+                  }
+                ],
+                "filter": true
+              }
+            },
+            "customWidth": "100",
+            "name": "quarantine - spam pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "2995f55b-17f9-458b-8630-e0370d14522a"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "11"
+      },
+      "name": "quarantine - group",
+      "id": "430294af-c68f-4427-8b55-d552a3d89d42",
+      "styleSettings": {
+        "showBorder": true
+      }
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Security Operations Center (SOC) Insights \r\n\r\n---\r\n\r\nThis tab provides a view for security operations. Combines incident response metrics with investigation insights to evaluate the effectiveness of both automated systems and manual interventions."
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "13"
+      },
+      "name": "soc - tab description",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px"
+      },
+      "id": "fd65243c-514c-4813-978f-fb908226d049"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Security Incident Response Metrics\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Operational efficiency insights.** Tracks incident volume, resolution speed, automation efficacy, and classification accuracy to evaluate SOC performance.<br><br>**Recommended action:** Track mean time to close by severity against your SLA and investigate any severity trending upward."
+            },
+            "name": "soc - incident-metrics section header",
+            "id": "f92c3e24-3e0f-4f4c-8ee9-3ec60832f7b1"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Email Security Incidents<br>\r\n\r\n**These visuals display the per-{Granularity} trend of email-related security incidents, as well as the proportion of email incidents compared to the total number of incidents in Defender.**"
+            },
+            "name": "soc - email-incidents heading",
+            "id": "c1cf6796-6071-4d2e-bf2c-c5e8d2a99a12"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// Filter for incidents that have at least one Email Security alert\r\nlet gran = {Granularity};\r\nlet OfficeEmailAlerts = SecurityAlert\r\n    | where ProductName contains \"Office 365 Advanced Threat Protection\" or ProductName contains \"Microsoft 365 Defender\"\r\n    | project SystemAlertId;\r\nlet agg = materialize(SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds) \r\n| join kind=inner\r\n    (OfficeEmailAlerts | extend SystemAlertId = tostring(SystemAlertId))\r\n    on $left.AlertId == $right.SystemAlertId\r\n| summarize arg_max(TimeGenerated, *), AlertCount = dcount(AlertId) by IncidentNumber\r\n| summarize Incidents_Number = count() by TimeGenerated = bin(TimeGenerated, gran));\r\nrange TimeGenerated from toscalar(agg | summarize min(TimeGenerated)) to toscalar(agg | summarize max(TimeGenerated)) step gran\r\n| join kind=leftouter (agg) on TimeGenerated\r\n| project TimeGenerated, ['Email Security Incidents'] = coalesce(Incidents_Number, 0)\r\n| sort by TimeGenerated asc",
+              "size": 0,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "chartSettings": {
+                "seriesLabelSettings": [
+                  {
+                    "seriesName": "Email Security Incidents",
+                    "color": "blueDark"
+                  }
+                ]
+              }
+            },
+            "customWidth": "75",
+            "name": "soc - email-incidents trend",
+            "id": "e23cfcda-1017-4fd0-ac71-8a861c450f71"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// Categorize incidents: Email Security vs Other\r\nlet AllAlerts = SecurityAlert\r\n    | extend SystemAlertId = tostring(SystemAlertId)\r\n    | project SystemAlertId, ProductName;\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds)\r\n| join kind=inner\r\n    (AllAlerts)\r\n    on $left.AlertId == $right.SystemAlertId\r\n| summarize AlertSystems = make_set(ProductName) by IncidentNumber\r\n| extend HasEmailSecurity = \r\n    AlertSystems has \"Office 365 Advanced Threat Protection\" or \r\n    AlertSystems has \"Microsoft 365 Defender\"\r\n| extend Category = iff(HasEmailSecurity, \"Email Security\", \"Other\")\r\n| summarize IncidentCount = count() by Category\r\n",
+              "size": 3,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "25",
+            "name": "soc - incident-category pie",
+            "id": "baae2150-1b04-43b4-9713-48fd3cc6247f"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Average Incident Time To Close (minutes)\r\n**This visual displays the average time, in minutes, to close email-related security incidents (per {Granularity}), split by severity, so you can see how resolution speed changes over time. Reference SLA targets: High 60, Medium 120, Low 240, Informational 480 minutes.**"
+            },
+            "name": "soc - time-to-close heading",
+            "id": "e23ccc6c-b0f0-407b-8e01-d8b69c40a745"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// SLA thresholds by severity for email-security (MDO) incidents\r\nlet SLA_Variables = datatable (Severity:string, TimeToResolve:int) [\r\n    \"High\", 60,\r\n    \"Medium\", 120,\r\n    \"Low\", 240,\r\n    \"Informational\", 480\r\n];\r\n\r\n// Identify MDO-related incidents via alert correlation\r\nlet EmailSecurityIncidents = \r\n    SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for each MDO-related incident\r\nlet LatestMdoIncidents =\r\n    SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, Severity, CreatedTime, ClosedTime, Title) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    | where not(Title startswith \"CC_\");  // Exclude non-email incidents as needed\r\n\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| extend TimeToResolveIncident = datetime_diff('minute', ClosedTime, CreatedTime)\r\n| join kind=inner SLA_Variables on Severity\r\n| summarize\r\n    ['Avg Time to Close (min)'] = avg(TimeToResolveIncident),\r\n    CountIncidents = count(), Breached = countif(TimeToResolveIncident > TimeToResolve)\r\n    by Day = bin(ClosedTime, 1d), Severity\r\n| order by Day asc, Severity asc",
+              "size": 0,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "chartSettings": {
+                "xAxis": "Day",
+                "yAxis": [
+                  "Avg Time to Close (min)"
+                ],
+                "group": "Severity",
+                "createOtherGroup": null
+              }
+            },
+            "name": "soc - sla-by-severity trend",
+            "id": "3f7d1f17-8d2f-4a1b-a97e-17973812ca6f"
+          },
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "### Closed Incident Classification (True Positive vs False Positive)\r\n\r\nThis visual shows the distribution of closed email-related incidents classified as True Positive versus False Positive. It helps assess detection accuracy and provides insight into validation trends."
+                  },
+                  "customWidth": "33.3",
+                  "name": "soc - classification heading",
+                  "styleSettings": {
+                    "margin": "10px"
+                  },
+                  "id": "48db10ce-8246-4f5e-8b68-f618d9c7f77c"
+                },
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "### True Positive Incident Classification Rate\r\n\r\nThis visual displays the percentage of email-related incidents confirmed as True Positive. It offers a clear measure of classification accuracy and highlights changes in detection effectiveness over time."
+                  },
+                  "customWidth": "33.3",
+                  "name": "soc - tp-rate heading",
+                  "styleSettings": {
+                    "margin": "10px"
+                  },
+                  "id": "34a84dbf-609a-407f-afef-f1592eb4a92b"
+                },
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "### Incidents Automated vs Manual Closure\r\n\r\nThis visual illustrates the proportion of email-related incidents closed automatically versus manually. It provides visibility into operational efficiency and the impact of automation on incident resolution.\r\n<br> ⚠️ *You will have to review the underlying query and add any automation system specific to your organization.*"
+                  },
+                  "customWidth": "33.3",
+                  "name": "soc - auto-vs-manual-closure heading",
+                  "styleSettings": {
+                    "margin": "10px"
+                  },
+                  "id": "a1fd9136-7a12-4d80-b3e1-e2704a84f734"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "// Build a list of MDO-related incidents by cross-referencing SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get only the most recent state of each incident, ensuring it's MDO-related\r\nlet LatestIncidents = SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    | where not(Title startswith \"CC_\");  // Exclude incidents unrelated to MDO (e.g., DSPM)\r\n\r\nLatestIncidents\r\n| where Status == 'Closed'                                     // (Optional) Limit to closed/fully classified incidents\r\n| summarize Count = count() by Classification = iif(\r\n    isnull(Classification) or trim(\" \", Classification) == \"\",\r\n    \"Not Set\", \r\n    Classification\r\n  )\r\n| order by Count desc",
+                    "size": 3,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "piechart"
+                  },
+                  "customWidth": "33.3",
+                  "name": "soc - classification pie",
+                  "styleSettings": {
+                    "margin": "10px"
+                  },
+                  "id": "cfa5b7c5-50cc-4b3b-8bba-1a93c57bff43"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n    SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n    SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n    | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n    TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n    TotalClosed       = count()\r\n| extend TruePositiveRate = iff(\r\n    TotalClosed > 0,\r\n    TruePositiveCount * 100.0 / TotalClosed,\r\n    real(null)\r\n)",
+                    "size": 1,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "stat",
+                    "statSettings": {
+                      "valueField": "TruePositiveRate",
+                      "valueAggregation": "None",
+                      "colorSettings": {
+                        "type": "static",
+                        "mode": "background",
+                        "heatmapPalette": "greenRed",
+                        "thresholdsGrid": []
+                      },
+                      "iconSettings": {
+                        "thresholdsGrid": []
+                      },
+                      "numberFormatSettings": {
+                        "unit": 1,
+                        "options": {
+                          "style": "decimal",
+                          "maximumFractionDigits": 2
+                        }
+                      },
+                      "tagText": "True Positive Rate",
+                      "valueFontStyle": "xxLarge",
+                      "tagTextPosition": "bottom"
+                    }
+                  },
+                  "customWidth": "33.3",
+                  "name": "soc - tp-rate stat",
+                  "styleSettings": {
+                    "margin": "10px"
+                  },
+                  "id": "eca235aa-38aa-46dd-a569-74dd8f83b2f0"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\")          // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff(                       // Add strings for your automation systems\r\n        tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n        \"Automated\",\r\n        \"Human\"\r\n    )\r\n| summarize ClosedCount = count() by ClosedBy",
+                    "size": 3,
+                    "showAnalytics": true,
+                    "queryType": "advancedHunting",
+                    "visualization": "piechart"
+                  },
+                  "customWidth": "33.3",
+                  "name": "soc - closure pie",
+                  "styleSettings": {
+                    "margin": "10px"
+                  },
+                  "id": "a4bc160f-1ba6-4779-86cd-ef44422f1e29"
+                }
+              ]
+            },
+            "name": "soc - incident-insights group",
+            "id": "3083ac4d-0bdd-4db7-a5f0-0d41cb67a4eb"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "13"
+      },
+      "name": "soc - incident-metrics group",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "18ff8970-e5f6-4c51-918a-aa693a45d18f"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Investigation & Response Actions\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Remediation efficacy analysis.** Compares automated (AIR) and manual admin actions to evaluate response times and investigation outcomes.\r\n<br><br>**Recommended action:** Reduce AIR pending-action latency by reviewing why approvals take long, and increase automation where it is safe to do so."
+            },
+            "name": "soc - air section header",
+            "id": "5e0b06c8-7774-4eb4-8b7f-572b3732de84"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Automated Investigation and Response (AIR) Actions (per {Granularity})\r\n\r\nThis visual shows the per-{Granularity} trend of Automated Investigation and Response (AIR) actions, including the number of successful and failed attempts (because of prior remediation)."
+            },
+            "customWidth": "100",
+            "name": "soc - air-actions heading",
+            "styleSettings": {
+              "margin": "10px"
+            },
+            "id": "05f14dec-e76c-413c-83a0-31a05dce65e7"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query attempts to show AIR Efficiency Over Time by displaying the number of successes and failures over time\r\nEmailPostDeliveryEvents\r\n| where ActionType =~ \"Automated Remediation\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by bin(Timestamp, {Granularity}), ActionResult",
+              "size": 0,
+              "showAnalytics": true,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart",
+              "graphSettings": {
+                "type": 0,
+                "topContent": {
+                  "columnMatch": "AlertId",
+                  "formatter": 1
+                },
+                "centerContent": {
+                  "columnMatch": "Count",
+                  "formatter": 1,
+                  "numberFormat": {
+                    "unit": 17,
+                    "options": {
+                      "maximumSignificantDigits": 3,
+                      "maximumFractionDigits": 2
+                    }
+                  }
+                }
+              },
+              "chartSettings": {
+                "xAxis": "Timestamp"
+              }
+            },
+            "customWidth": "100",
+            "name": "soc - air-efficiency trend",
+            "styleSettings": {
+              "margin": "10px"
+            },
+            "id": "ae2a1850-5b7e-49f7-bac4-d888053ab49b"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Automated Investigation and Response (AIR) Response Time After Email Delivery (per {Granularity})\r\n\r\nThis visual displays the average (per {Granularity}), 80th percentile (p80), 90th percentile (p90) and 99th percentile (p99) time needed, measured in minutes, from email delivery to AIR action. It serves as a SOC metric to monitor responsiveness (security team members reviewing and manually approving AIR Pending Actions) and identify potential latency in automated incident handling. If the latency is high focus on reviewing why reviwing AIR Pending Actions takes longer time for admins and consider <a href='https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation#configure-automated-remediation'>auto-aproval of URL, Files and Email clusters. </a>\r\n"
+            },
+            "customWidth": "100",
+            "name": "soc - air-response-time heading",
+            "styleSettings": {
+              "margin": "10px"
+            },
+            "id": "98c66d9e-efdf-40fc-b8b0-be35d7fd97a9"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// SOC metric: Daily average/p75 delay (in minutes) from email delivery to AIR action\r\nlet deliveries = EmailEvents\r\n  | where DeliveryAction == \"Delivered\"// delivered emails\r\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n  | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\r\nlet remediations = EmailPostDeliveryEvents\r\n  | where ActionType =~ \"Automated Remediation\"// automated remediation events\r\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n  | summarize FirstRemediation = min(Timestamp) by MsgKey;\r\ndeliveries\r\n| join kind=inner remediations on MsgKey\r\n| extend DelayMinutes = datetime_diff(\"minute\", FirstRemediation, FirstDelivery)\r\n| where DelayMinutes >= 0\r\n| summarize ['Avg (min)'] = avg(DelayMinutes),\r\n            ['P80 (min)'] = percentile(DelayMinutes, 80),\r\n            ['P90 (min)'] = percentile(DelayMinutes, 90),\r\n            ['P99 (min)'] = percentile(DelayMinutes, 99),\r\n            CountEmails = count()\r\n   by bin(FirstRemediation, 1d) ",
+              "size": 0,
+              "aggregation": 3,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "areachart",
+              "gridSettings": {
+                "sortBy": [
+                  {
+                    "itemKey": "FirstRemediation",
+                    "sortOrder": 1
+                  }
+                ]
+              },
+              "sortBy": [
+                {
+                  "itemKey": "FirstRemediation",
+                  "sortOrder": 1
+                }
+              ],
+              "chartSettings": {
+                "xAxis": "FirstRemediation",
+                "yAxis": [
+                  "P99 (min)",
+                  "P90 (min)",
+                  "P80 (min)",
+                  "Avg (min)"
+                ],
+                "showLegend": true
+              }
+            },
+            "customWidth": "100",
+            "name": "soc - air-latency area",
+            "styleSettings": {
+              "margin": "10px"
+            },
+            "id": "900383f1-6443-4d50-b15d-26e4ac11b255"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Automated Investigation and Response (AIR) Investigation Results Trend\r\n\r\nThis visual displays the per-{Granularity} trend of AIR investigation outcomes, categorized as **Threat Detected** or **Clean**. It helps track the effectiveness of automated investigations over time and highlights patterns in threat detection."
+            },
+            "customWidth": "67",
+            "name": "soc - air-outcomes heading",
+            "styleSettings": {
+              "margin": "10px"
+            },
+            "id": "d1cabfbe-6040-4b6e-9ce5-f48e9973dfc9"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "### Investigation Actions Taken: Automated Investigation and Response (AIR) vs Manual (Human)\r\n\r\nThis visual shows whether actions taken after an Automated Investigation and Response (AIR) required manual approval by an administrator or were executed automatically. It provides insight into the level of automation versus human intervention in post-investigation remediation."
+            },
+            "customWidth": "33",
+            "name": "soc - air-auto-vs-manual heading",
+            "styleSettings": {
+              "margin": "10px"
+            },
+            "id": "2f98514b-0172-4c4e-ba25-9a5e4138c570"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "// AIR investigation outcomes by day: ThreatDetected vs. Clean\r\n\r\n// Step 1: Deduplicate automated remediation events by message and recipient\r\nlet AutoRemediations = \r\n    EmailPostDeliveryEvents\r\n    | where ActionType == \"Automated Remediation\"\r\n    | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\r\n    | project NetworkMessageId, RecipientEmailAddress, Timestamp;\r\n\r\n// Step 2: Derive threat verdicts using AlertEvidence\r\nlet EvidenceVerdicts =\r\n    AlertEvidence\r\n    | where EntityType in (\"MailMessage\", \"MailCluster\")\r\n    | extend extra = todynamic(AdditionalFields)\r\n    // If this is a mail cluster, use provided NetworkMessageIds array; otherwise wrap NetworkMessageId as a single-item array\r\n    | extend networkIds = iff(\r\n      isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\r\n      pack_array(NetworkMessageId),          // create a single-element array using pack_array\r\n      extra.NetworkMessageIds                // use the array as-is if it exists\r\n    )\r\n    | mv-expand nmID = networkIds                // expand to individual message IDs\r\n    // Derive verdict from LastVerdict, ThreatAnalysisSummary, and ThreatIntelligence\r\n    | extend \r\n        lastVerdict = tolower(tostring(extra.LastVerdict)),\r\n        threatAIList = extra.ThreatAnalysisSummary,\r\n        threatInt   = extra.ThreatIntelligence\r\n    | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \"\"),\r\n             verdictTI          = iff(array_length(threatInt) > 0, \"malicious\", \"\")   // any item in ThreatIntelligence indicates malicious\r\n    // Mark as threat-detected if verdict is malicious/suspicious or threat evidence is present\r\n    | extend ThreatDetectedFlag = \r\n        case(\r\n            lastVerdict in (\"malicious\",\"suspicious\") or verdictFromAnalysis in (\"malicious\",\"suspicious\")\r\n                or verdictTI == \"malicious\",\r\n            true,\r\n            false\r\n        )\r\n    // Weight mail clusters by MailCount; default to 1 for single messages\r\n    | extend MailCountInt = toint(extra.MailCount)\r\n    | extend Weight = iff(EntityType == \"MailCluster\", \r\n                        coalesce(MailCountInt, 1), // default to 1 if MailCount is missing\r\n                        1)\r\n    | summarize IsThreatDetected = any(ThreatDetectedFlag), \r\n                WeightSum       = sum(Weight) \r\n    by nmID = tostring(nmID);\r\n\r\n// Step 3: Join remediation events with verdicts and aggregate by day\r\nAutoRemediations\r\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\r\n| extend isThreat      = coalesce(IsThreatDetected, false), \r\n         effectiveWeight= coalesce(WeightSum, 1)\r\n| extend InvestigationOutcome = iif(isThreat, \"Threat Detected\", \"Clean\")\r\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, {Granularity}), InvestigationOutcome\r\n| order by Day asc, InvestigationOutcome asc",
+              "size": 0,
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "linechart"
+            },
+            "customWidth": "67",
+            "name": "soc - air-outcomes trend",
+            "styleSettings": {
+              "margin": "10px"
+            },
+            "id": "18552ccb-d8d4-45c4-a3cf-072203df9325"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger",
+              "size": 3,
+              "showAnalytics": true,
+              "queryType": "advancedHunting",
+              "visualization": "piechart"
+            },
+            "customWidth": "33",
+            "name": "soc - air-auto-vs-manual pie",
+            "styleSettings": {
+              "margin": "10px",
+              "padding": "10px"
+            },
+            "id": "03bc6e3c-05de-426d-91d8-b48a36b4ea74"
+          },
+          {
+            "type": 12,
+            "content": {
+              "version": "NotebookGroup/1.0",
+              "groupType": "editable",
+              "items": [
+                {
+                  "type": 1,
+                  "content": {
+                    "json": "### Post-Delivery Actions by Admin\r\n\r\nThis visual displays the number (per {Granularity}) of emails where an administrator performed a post-delivery action. Actions are summarized by type, including **Soft Delete**, **Hard Delete**, **Moved to Junk Folder**, **Moved to Inbox**, and **Quarantine Release**, providing insight into manual intervention trends after email delivery."
+                  },
+                  "name": "soc - post-delivery-by-admin heading",
+                  "styleSettings": {
+                    "margin": "10px"
+                  },
+                  "id": "a0961ca9-da58-49c4-9a1c-873c5569bed9"
+                },
+                {
+                  "type": 3,
+                  "content": {
+                    "version": "KqlItem/1.0",
+                    "query": "//This query visualises the daily ammount of emails that had an admin post delivery action, summarizing the data by action type\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\"\r\n| summarize [\"Soft Delete\"]=countif(Action has 'Soft Delete'), [\"Hard Delete\"]=countif(Action has 'Hard Delete'), [\"Moved to junk folder\"]=countif(Action has 'Moved to junk folder'), [\"Moved to inbox\"]=countif(Action has 'Moved to inbox'), [\"Quarantine release\"]=countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Soft Delete\"]=coalesce([\"Soft Delete\"],0), [\"Hard Delete\"]=coalesce([\"Hard Delete\"],0), [\"Moved to junk folder\"]=coalesce([\"Moved to junk folder\"],0), [\"Moved to inbox\"]=coalesce([\"Moved to inbox\"],0), [\"Quarantine release\"]=coalesce([\"Quarantine release\"],0)\r\n| sort by Timestamp asc",
+                    "size": 0,
+                    "showAnalytics": true,
+                    "timeContextFromParameter": "TimeRange",
+                    "queryType": "advancedHunting",
+                    "visualization": "linechart"
+                  },
+                  "name": "soc - post-delivery-by-admin trend",
+                  "styleSettings": {
+                    "margin": "10px"
+                  },
+                  "id": "d2ea8eac-a3db-46b0-bcb4-3abbb95ba4ad"
+                }
+              ]
+            },
+            "customWidth": "100",
+            "name": "soc - post-delivery group",
+            "id": "ebca14d5-954d-4e35-a225-cb0f8a3ea81b"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "13"
+      },
+      "name": "soc - air group",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "0a05394d-f813-4408-ac4d-8f481ae34c0b"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Top Malicious Email Campaigns (Clustered)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Groups malicious inbound emails into campaigns (attack waves) using the Email Cluster ID assigned by Microsoft Defender for Office 365, showing one row per campaign with the message count, distinct recipients, sender domains, threat mix and sample subjects. Helps the SOC understand the scale and shape of coordinated attacks rather than viewing individual messages in isolation.**<br><br>**Recommended action:** Pivot on the top campaign clusters to hunt related messages and consider blocking shared sender infrastructure."
+            },
+            "name": "soc - campaigns heading",
+            "id": "d3a9e4c6-1b5f-4c8d-ae34-9f7a1b2c3d45"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Largest malicious inbound email campaigns clustered by EmailClusterId - one row per attack wave (messages, recipients, URL clicks, sender domains, threat mix, sample subjects).\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n            Recipients = dcount(RecipientEmailAddress),\r\n            SenderDomains = dcount(SenderFromDomain),\r\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n            SampleSubjects = make_set(Subject, 5),\r\n            FirstSeen = min(Timestamp),\r\n            LastSeen = max(Timestamp)\r\n        by EmailClusterId\r\n| join kind=leftouter (clicksByCluster) on EmailClusterId\r\n| extend UrlClicks = coalesce(UrlClicks, 0)\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by Messages\r\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['URL Clicks']=UrlClicks, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+              "size": 0,
+              "title": "",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Recipients",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "URL Clicks",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "name": "soc - campaigns table",
+            "id": "a2a391e1-0e26-4e0e-a8d3-26e3c7132079"
+          },
+          {
+            "type": 1,
+            "content": {
+              "json": "<table style=\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\">\r\n<tr>\r\n<td style=\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\">Most-Clicked Email Campaigns (Recipient Engagement)\r\n</td>\r\n</tr>\r\n</table>\r\n\r\n**Ranks malicious inbound campaigns by recipient URL clicks, surfacing the attack waves that reached a mailbox and drew engagement regardless of raw message volume. The highest-volume campaigns are usually quarantined before delivery, so the clusters that draw clicks are often smaller, targeted waves. A non-zero URL Clicks count means a recipient opened a URL within the campaign's messages. Because attackers often mix legitimate URLs with malicious ones to build credibility, and a per-URL threat verdict is not available here, treat these as clicks on potentially malicious URLs that warrant review rather than confirmed malicious clicks.**<br><br>**Recommended action:** Focus on these clusters for user follow-up (awareness and, where credentials may be exposed, password reset) and hunt for related messages sharing sender infrastructure."
+            },
+            "name": "soc - mostclicked heading",
+            "id": "e9e41b47-0434-42e5-8b04-4170ab061b81"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "//Malicious inbound campaigns ranked by recipient URL clicks - the attack waves that reached a mailbox and drew engagement, regardless of message volume.\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n            Recipients = dcount(RecipientEmailAddress),\r\n            SenderDomains = dcount(SenderFromDomain),\r\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n            SampleSubjects = make_set(Subject, 5),\r\n            FirstSeen = min(Timestamp),\r\n            LastSeen = max(Timestamp)\r\n        by EmailClusterId\r\n| join kind=inner (clicksByCluster) on EmailClusterId\r\n| where UrlClicks > 0\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by UrlClicks\r\n| project ['Email Cluster ID']=EmailClusterId, ['URL Clicks']=UrlClicks, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+              "size": 0,
+              "title": "",
+              "timeContextFromParameter": "TimeRange",
+              "queryType": "advancedHunting",
+              "visualization": "table",
+              "gridSettings": {
+                "filter": true,
+                "formatters": [
+                  {
+                    "columnMatch": "URL Clicks",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "redDark",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Messages",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  },
+                  {
+                    "columnMatch": "Recipients",
+                    "formatter": 3,
+                    "formatOptions": {
+                      "palette": "blue",
+                      "customColumnWidthSetting": "130px"
+                    },
+                    "numberFormat": {
+                      "unit": 17,
+                      "options": {
+                        "style": "decimal",
+                        "maximumFractionDigits": 1
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "name": "soc - mostclicked table",
+            "id": "1ffe8f97-ad79-47d9-9598-dd73ee54cd8d"
+          }
+        ]
+      },
+      "conditionalVisibility": {
+        "parameterName": "Tab",
+        "comparison": "isEqualTo",
+        "value": "13"
+      },
+      "name": "soc - campaigns group",
+      "styleSettings": {
+        "margin": "10px",
+        "padding": "10px",
+        "showBorder": true
+      },
+      "id": "b8f2a1c4-5d6e-4a7b-9c8d-0e1f2a3b4c5d"
+    }
+  ],
+  "isLocked": true,
+  "fromTemplateId": "sentinel-MicrosoftDefenderForOffice365detectionsandinsights",
+  "xdrMetadata": {
+    "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c",
+    "instanceId": "8f47d55b-34a6-5d13-a89f-315b1a2a4f53",
+    "version": "3.2.1",
+    "schemaVersion": "1.0.0",
+    "displayName": "MicrosoftDefenderForOffice365detectionsandinsights"
+  },
+  "contentProvenance": {
+    "source": {
+      "path": "Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json",
+      "sha256": "19bad5117876f5ea343e61de59a5c3bded01b6f1269d8d4e0fd17312d77140c3",
+      "contentId": "sentinel-MicrosoftDefenderForOffice365detectionsandinsights",
+      "originalMetadataVersion": null
+    },
+    "conversion": {
+      "tool": "sentinel-xdr-migration",
+      "version": "0.1.0",
+      "reviewRequired": false,
+      "queries": [
+        {
+          "sourcePath": "/items/1/content/parameters/0/query",
+          "status": "removed-scope-helper",
+          "outputPath": null,
+          "sourceSha256": "5946994a15739302ed2d73d8352ad7807cf022400d0fb4ada7deacc6a80a4362",
+          "targetSha256": null
+        },
+        {
+          "sourcePath": "/items/1/content/parameters/1/query",
+          "status": "removed-scope-helper",
+          "outputPath": null,
+          "sourceSha256": "e9fbb9e0bbf1476452fd4bc3e09a7a3dce06ac3b0a38295589d65cc2d059d7df",
+          "targetSha256": null
+        },
+        {
+          "sourcePath": "/items/1/content/parameters/2/query",
+          "status": "removed-scope-helper",
+          "outputPath": null,
+          "sourceSha256": "9ca49dd832750c2f8405091b4a93879c6da739076995018fd31782ebf5340075",
+          "targetSha256": null
+        },
+        {
+          "sourcePath": "/items/1/content/parameters/3/query",
+          "status": "removed-scope-helper",
+          "outputPath": null,
+          "sourceSha256": "5c2a7488f97b3194e989f65b1ac348498bcd9c7451ae1e2302b349a68647aa03",
+          "targetSha256": null
+        },
+        {
+          "sourcePath": "/items/3/content/items/0/content/items/1/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5747115a77dbcf964a42a96f3c7e0dcb3c951fcba765c6c39eb83b68b46fd144"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/0/content/items/1/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n    // this alteration is due to the threat types being updated directly within advanced hunting.\r\n    //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n    | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n    | extend MDO_detection = parse_json(DetectionMethods) \r\n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n    EmailPostDeliveryEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n    | summarize arg_max(Timestamp, *) by Key \r\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n    CloudAppEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n    | where ActionType == \"AdminSubmissionSubmitted\" \r\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n    | where SubmissionType in (\"1\", \"2\") \r\n    | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n    EmailEventsThreats \r\n    | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n    CloudAppEventsFiltered \r\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n    ); \r\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\n\r\nprint StatisticName=\"Effectiveness Post Delivery\", Value=abs(round(((toreal(toscalar(FN_Admin_Submissions))+toreal(toscalar(FN_ZAP_Unsuccessful)))/(toreal(toscalar(Mal_Phish_Mailflow))+toreal(toscalar(FN_ZAP_Successful))+toreal(toscalar(FN_ZAP_Unsuccessful))+toreal(toscalar(FN_Admin_Submissions))-toreal(toscalar(FP_ZAP)))*100-100),2))",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/0/content/items/1/content/items/0/content/query",
+          "sourceSha256": "5747115a77dbcf964a42a96f3c7e0dcb3c951fcba765c6c39eb83b68b46fd144",
+          "targetSha256": "5747115a77dbcf964a42a96f3c7e0dcb3c951fcba765c6c39eb83b68b46fd144"
+        },
+        {
+          "sourcePath": "/items/3/content/items/0/content/items/1/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/0/content/items/1/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/0/content/items/1/content/items/1/content/query",
+          "sourceSha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965",
+          "targetSha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965"
+        },
+        {
+          "sourcePath": "/items/3/content/items/0/content/items/2/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "21e6d6c3e7e489c5001e4b39a81275956d155e2d380328eb2f4ae61e973db708"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/0/content/items/2/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n    // this alteration is due to the threat types being updated directly within advanced hunting.\r\n    //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n    | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n    EmailEvents \r\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n    | extend MDO_detection = parse_json(DetectionMethods) \r\n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n    EmailPostDeliveryEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n    | summarize arg_max(Timestamp, *) by Key \r\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n    CloudAppEvents \r\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n    | where ActionType == \"AdminSubmissionSubmitted\" \r\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n    | where SubmissionType in (\"1\", \"2\") \r\n    | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n    EmailEventsThreats \r\n    | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n    EmailPostDeliveryFiltered \r\n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n    CloudAppEventsFiltered \r\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n    | summarize count() \r\n    ); \r\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\nunion withsource=Table \r\n    (print StatisticName=\"Mal/Phish Mailflow totals - Minus FPs\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \r\n    (print StatisticName=\"Admin Mal/Phish FNs Submitted\", Value=toreal(FN_Admin_Submissions)), \r\n    (print StatisticName=\"Mal/Phish FPs Reverse Zapped\", Value=toreal(FP_ZAP)), \r\n    (print StatisticName=\"Mal / Phish Successfully Zapped\", Value=toreal(FN_ZAP_Successful)), \r\n    (print StatisticName=\"Mal / Phish UN-Successfully Zapped\", Value=toreal(FN_ZAP_Unsuccessful)), \r\n    (print StatisticName=\"Effectiveness Post Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \r\n    (print StatisticName=\"Effectiveness Pre-Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))) \r\n| project StatisticName, Value",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/0/content/items/2/content/items/1/content/query",
+          "sourceSha256": "21e6d6c3e7e489c5001e4b39a81275956d155e2d380328eb2f4ae61e973db708",
+          "targetSha256": "21e6d6c3e7e489c5001e4b39a81275956d155e2d380328eb2f4ae61e973db708"
+        },
+        {
+          "sourcePath": "/items/3/content/items/0/content/items/3/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "85ed7ec77cc8bf2b0ea05d753a5eb3285800b15fae28dac80145460883f101c7"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/0/content/items/3/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Per detection technology: the share of its quarantined emails later released from quarantine (a high rate can indicate false positives). Top 7 by release rate; detectors with <10 quarantined excluded so the rate is meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\"\r\n| join kind=leftouter (\r\n    EmailPostDeliveryEvents\r\n    | where Action == \"Quarantine release\"\r\n    | distinct NetworkMessageId\r\n    | extend ReleasedFlag = \"yes\"\r\n  ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Technology']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc\r\n| take 7",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/0/content/items/3/content/items/1/content/query",
+          "sourceSha256": "85ed7ec77cc8bf2b0ea05d753a5eb3285800b15fae28dac80145460883f101c7",
+          "targetSha256": "85ed7ec77cc8bf2b0ea05d753a5eb3285800b15fae28dac80145460883f101c7"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "54c5da330fa9d7f225441bf1d9d0a714ca10e676ddc26acfa7c972e1037bbf69"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let base = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize arg_max(Timestamp, ThreatTypes, DeliveryAction, OrgLevelPolicy, OrgLevelAction, UserLevelAction) by Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress));\r\nlet agg = materialize(base | summarize\r\n    Total = count(),\r\n    Filtered = countif(isnotempty(ThreatTypes) and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FMal = countif(ThreatTypes has \"Malware\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FPhish = countif(ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    FSpam = countif(ThreatTypes == \"Spam\" and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n    Deliv = countif(isnotempty(ThreatTypes) and DeliveryAction == \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n    Blocked = countif(isempty(ThreatTypes) and DeliveryAction != \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n    Clean = countif(isempty(ThreatTypes) and DeliveryAction == \"Delivered\"));\r\nlet pd = materialize(EmailPostDeliveryEvents | where ActionResult == \"Success\" | summarize MalZap = countif(ActionType == \"Malware ZAP\"), PhishZap = countif(ActionType == \"Phish ZAP\"), SpamZap = countif(ActionType == \"Spam ZAP\"));\r\nlet sub = materialize(CloudAppEvents | extend R = tostring(parse_json(RawEventData).RecordType), SCT = tostring(parse_json(RawEventData).SubmissionContentType) | where R == \"29\" | summarize Adm = countif(ActionType == \"AdminSubmissionSubmitted\" and SCT == \"Mail\"), Usr = countif(ActionType == \"UserSubmission\"));\r\nlet Total = toscalar(agg | project Total);\r\nlet Filtered = toscalar(agg | project Filtered);\r\nlet FMal = toscalar(agg | project FMal);\r\nlet FPhish = toscalar(agg | project FPhish);\r\nlet FSpam = toscalar(agg | project FSpam);\r\nlet Deliv = toscalar(agg | project Deliv);\r\nlet Blocked = toscalar(agg | project Blocked);\r\nlet Clean = toscalar(agg | project Clean);\r\nlet MalZap = toscalar(pd | project MalZap);\r\nlet PhishZap = toscalar(pd | project PhishZap);\r\nlet SpamZap = toscalar(pd | project SpamZap);\r\nlet Adm = toscalar(sub | project Adm);\r\nlet Usr = toscalar(sub | project Usr);\r\nunion\r\n    (print o = 1, Name = \"Total Inbound Emails\", Count = Total),\r\n    (print o = 2, Name = \"    Filtering Totals\", Count = Filtered),\r\n    (print o = 3, Name = \"        Filtered as Malware\", Count = FMal),\r\n    (print o = 4, Name = \"        Filtered as Phish\", Count = FPhish),\r\n    (print o = 5, Name = \"        Filtered as Spam\", Count = FSpam),\r\n    (print o = 6, Name = \"    Delivered with Detection\", Count = Deliv),\r\n    (print o = 7, Name = \"    User/Admin Blocked\", Count = Blocked),\r\n    (print o = 8, Name = \"    Clean Emails\", Count = Clean),\r\n    (print o = 9, Name = \"Post-Delivery ZAP Removals\", Count = MalZap + PhishZap + SpamZap),\r\n    (print o = 10, Name = \"    Removed by Malware ZAP\", Count = MalZap),\r\n    (print o = 11, Name = \"    Removed by Phish ZAP\", Count = PhishZap),\r\n    (print o = 12, Name = \"    Removed by Spam ZAP\", Count = SpamZap),\r\n    (print o = 13, Name = \"User/Admin Reported\", Count = Adm + Usr),\r\n    (print o = 14, Name = \"    Reported by Admins\", Count = Adm),\r\n    (print o = 15, Name = \"    Reported by Users\", Count = Usr)\r\n| sort by o asc\r\n| extend [\"% of Inbound\"] = round(Count * 100.0 / Total, 1)\r\n| project Name, Count, [\"% of Inbound\"]",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/2/content/query",
+          "sourceSha256": "54c5da330fa9d7f225441bf1d9d0a714ca10e676ddc26acfa7c972e1037bbf69",
+          "targetSha256": "54c5da330fa9d7f225441bf1d9d0a714ca10e676ddc26acfa7c972e1037bbf69"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/0/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5ea9001623bf807401855ab2dc1227cc2028df25607fe48dd189eed3403c66cc"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/0/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Total Inbound Emails\";",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/0/content/items/0/content/query",
+          "sourceSha256": "5ea9001623bf807401855ab2dc1227cc2028df25607fe48dd189eed3403c66cc",
+          "targetSha256": "5ea9001623bf807401855ab2dc1227cc2028df25607fe48dd189eed3403c66cc"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "11024d9cb81b049a21e345bc5524f772f9154ffa2308755d5e91d7640e03a000"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/1/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "EmailEvents\r\n| where isnotempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Filtering Totals\";",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/0/content/query",
+          "sourceSha256": "11024d9cb81b049a21e345bc5524f772f9154ffa2308755d5e91d7640e03a000",
+          "targetSha256": "11024d9cb81b049a21e345bc5524f772f9154ffa2308755d5e91d7640e03a000"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "28cafb2e50cec0219284436da53500fb14de8f6f152b78f9fb7b46de674ef36d"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/1/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises Total emails detected as Malware\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has ('Malware') and EmailDirection == \"Inbound\"\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Malware\"",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/1/content/query",
+          "sourceSha256": "28cafb2e50cec0219284436da53500fb14de8f6f152b78f9fb7b46de674ef36d",
+          "targetSha256": "28cafb2e50cec0219284436da53500fb14de8f6f152b78f9fb7b46de674ef36d"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "317de152ba920fdf351f7321099fdeabdc9976846d339eb9b88fdde797cb3eea"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/1/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises Total emails detected as Phish\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Phish\"",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/2/content/query",
+          "sourceSha256": "317de152ba920fdf351f7321099fdeabdc9976846d339eb9b88fdde797cb3eea",
+          "targetSha256": "317de152ba920fdf351f7321099fdeabdc9976846d339eb9b88fdde797cb3eea"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "2c92c916613af150c9fb9002575262812efe51a25f3e895f7b13c48cd2cd5f75"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/1/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises Total emails by detected as Spam\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes == 'Spam' and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Spam\"",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/3/content/query",
+          "sourceSha256": "2c92c916613af150c9fb9002575262812efe51a25f3e895f7b13c48cd2cd5f75",
+          "targetSha256": "2c92c916613af150c9fb9002575262812efe51a25f3e895f7b13c48cd2cd5f75"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "6d26ede06beed91a44a33f5e92d356dbda265fb9d28a08085a8b9c1a20ab222d"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/2/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "EmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and DeliveryAction == 'Delivered'\r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Delivered with Detection\"",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/0/content/query",
+          "sourceSha256": "6d26ede06beed91a44a33f5e92d356dbda265fb9d28a08085a8b9c1a20ab222d",
+          "targetSha256": "6d26ede06beed91a44a33f5e92d356dbda265fb9d28a08085a8b9c1a20ab222d"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0dd446cd43e873feeeb05f3fb5d66fee5c565c5b31ea65512c4e667343eeae2e"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/2/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isempty(ThreatTypes) \r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| where DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"User/Admin Blocked\"",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/1/content/query",
+          "sourceSha256": "0dd446cd43e873feeeb05f3fb5d66fee5c565c5b31ea65512c4e667343eeae2e",
+          "targetSha256": "0dd446cd43e873feeeb05f3fb5d66fee5c565c5b31ea65512c4e667343eeae2e"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "07b6448883cc7e806585aa65b32d23f9885de98f00db547259bf3abc51782695"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/2/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "EmailEvents\r\n| where isempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction == 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Clean Emails\"",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/2/content/query",
+          "sourceSha256": "07b6448883cc7e806585aa65b32d23f9885de98f00db547259bf3abc51782695",
+          "targetSha256": "07b6448883cc7e806585aa65b32d23f9885de98f00db547259bf3abc51782695"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "e1a57a032e584b925d55abf853598511c207c992fba71727c350eb2fbe9a7955"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/3/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Malware ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Malware ZAP\"\r\n",
+            "resolvedTables": [
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/0/content/query",
+          "sourceSha256": "e1a57a032e584b925d55abf853598511c207c992fba71727c350eb2fbe9a7955",
+          "targetSha256": "e1a57a032e584b925d55abf853598511c207c992fba71727c350eb2fbe9a7955"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "bfe851f071babb9c7bdb272265c227c0e5b412e8a2b45f2e650105234bed34d4"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/3/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Phish ZAP\"",
+            "resolvedTables": [
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/1/content/query",
+          "sourceSha256": "bfe851f071babb9c7bdb272265c227c0e5b412e8a2b45f2e650105234bed34d4",
+          "targetSha256": "bfe851f071babb9c7bdb272265c227c0e5b412e8a2b45f2e650105234bed34d4"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a3d38b001812d4243757f54d219cc3483324bfe96169a973957f48e8f38b9661"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/3/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Spam ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Spam ZAP\"",
+            "resolvedTables": [
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/2/content/query",
+          "sourceSha256": "a3d38b001812d4243757f54d219cc3483324bfe96169a973957f48e8f38b9661",
+          "targetSha256": "a3d38b001812d4243757f54d219cc3483324bfe96169a973957f48e8f38b9661"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/4/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ca205c791cd98cc9ca1dd117e21f72b3ec9297eac3d66edc502ea235b2c00771"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/4/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Admins\"",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/4/content/items/0/content/query",
+          "sourceSha256": "ca205c791cd98cc9ca1dd117e21f72b3ec9297eac3d66edc502ea235b2c00771",
+          "targetSha256": "ca205c791cd98cc9ca1dd117e21f72b3ec9297eac3d66edc502ea235b2c00771"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/3/content/items/4/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7e3420b2827239bf920fb9719d44a299424cae3a7814795abbc9c07efbae589f"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/3/content/items/4/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\r\n| where Record == 29 and ActionType == \"UserSubmission\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Users\"\r\n",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/3/content/items/4/content/items/1/content/query",
+          "sourceSha256": "7e3420b2827239bf920fb9719d44a299424cae3a7814795abbc9c07efbae589f",
+          "targetSha256": "7e3420b2827239bf920fb9719d44a299424cae3a7814795abbc9c07efbae589f"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "29e1433c6e19b5452fe2be9b62bcf61ad37e29d746484dbfa5a645054e30a3cc"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query surfaces the users most targeted by inbound email threats across all threat types (malware, phishing, spam) for the selected period, so SecOps can prioritise the highest-risk individuals. Similar to a \"Most Attacked People\" view.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where isnotempty(ThreatTypes)\r\n| summarize\r\n    ['Total Threats'] = count(),\r\n    Malware = countif(ThreatTypes has \"Malware\"),\r\n    Phish   = countif(ThreatTypes has \"Phish\"),\r\n    Spam    = countif(ThreatTypes has \"Spam\"),\r\n    ['Last Seen'] = max(Timestamp)\r\n    by ['User']=RecipientEmailAddress\r\n| top 10 by ['Total Threats']\r\n| project ['User'], ['Total Threats'], Malware, Phish, Spam, ['Last Seen']",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/5/content/query",
+          "sourceSha256": "29e1433c6e19b5452fe2be9b62bcf61ad37e29d746484dbfa5a645054e30a3cc",
+          "targetSha256": "29e1433c6e19b5452fe2be9b62bcf61ad37e29d746484dbfa5a645054e30a3cc"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5c341f1f2dbee19255c01125ce8be61b3a9ae6e65b982e4170f53e132c40148f"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails, total detections, total user, and admin email submissions over time summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet scaffold = range Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran;\r\nlet baseQuery = materialize(EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where isnotempty(Timestamp));\r\nlet sub = materialize(CloudAppEvents\r\n| extend Record = (parse_json(RawEventData)).RecordType, SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29);\r\nlet zapbase = EmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\" or ActionType == \"Spam ZAP\";\r\nunion\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Inbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Inbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Phish') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Phish\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Malware') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Malware\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Spam') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Spam\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Intra-org\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Intra-org Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Outbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Outbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where isnotempty(ThreatTypes) | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails with Threat\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"UserSubmission\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Users\"),\r\n(scaffold | join kind=leftouter (zapbase | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Removed by ZAP\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"Mail\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Admins\")",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/7/content/query",
+          "sourceSha256": "5c341f1f2dbee19255c01125ce8be61b3a9ae6e65b982e4170f53e132c40148f",
+          "targetSha256": "5c341f1f2dbee19255c01125ce8be61b3a9ae6e65b982e4170f53e132c40148f"
+        },
+        {
+          "sourcePath": "/items/3/content/items/1/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "134d3d4d6893f1d88c14e42b7976e21006dabba9d3fc71dd58a55e0ca52db645"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/1/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, {Granularity})\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| project Timestamp, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/1/content/items/9/content/query",
+          "sourceSha256": "134d3d4d6893f1d88c14e42b7976e21006dabba9d3fc71dd58a55e0ca52db645",
+          "targetSha256": "134d3d4d6893f1d88c14e42b7976e21006dabba9d3fc71dd58a55e0ca52db645"
+        },
+        {
+          "sourcePath": "/items/3/content/items/2/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "554088d9c128e08443f51fecd276d5435baaa56ab9f2dd744e1325fc0c0d4132"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/2/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Headline Microsoft Teams / collaboration protection metrics for the executive summary, with per-interval sparklines so the collaboration threat trend is visible at a glance. Messages and URLs are counted per distinct Teams message.\r\nlet gran = {Granularity};\r\nlet me = materialize(MessageEvents);\r\nlet cae = materialize(CloudAppEvents | where ActionType == \"TeamsImpersonationDetected\");\r\nlet mui = materialize(MessageUrlInfo);\r\nlet uce = materialize(UrlClickEvents | where Workload == \"Teams\" and ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\"));\r\nlet fmc = materialize(FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\");\r\nunion\r\n(me | summarize Count = dcount(TeamsMessageId) | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(me | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(me | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Teams Threat Messages\", Ord = 2, Trend = toscalar(me | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(cae | summarize Count = count() | extend Details = \"Teams Impersonation Detections\", Ord = 3, Trend = toscalar(cae | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(mui | summarize Count = dcount(TeamsMessageId) | extend Details = \"URLs Shared in Teams\", Ord = 4, Trend = toscalar(mui | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(uce | summarize Count = count() | extend Details = \"Malicious Clicks Blocked\", Ord = 5, Trend = toscalar(uce | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 6, Trend = toscalar(fmc | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Malicious Teams Files\", Ord = 7, Trend = toscalar(fmc | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "FileMaliciousContentInfo",
+              "MessageEvents",
+              "MessageUrlInfo",
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              },
+              {
+                "sentinelTable": "MessageUrlInfo",
+                "ahTable": "MessageUrlInfo",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              },
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/2/content/items/1/content/query",
+          "sourceSha256": "554088d9c128e08443f51fecd276d5435baaa56ab9f2dd744e1325fc0c0d4132",
+          "targetSha256": "554088d9c128e08443f51fecd276d5435baaa56ab9f2dd744e1325fc0c0d4132"
+        },
+        {
+          "sourcePath": "/items/3/content/items/4/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a691b608e29297a7398550427e7dc2331253dfba5a35075418caf680155de8a8"
+          },
+          "conversion": {
+            "sourceId": "/items/3/content/items/4/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "datatable(Index:int, Name:string, Value:int)\r\n[\r\n    1, \"Defender for Office 365\", 194,\r\n    2, \"Mimecast\", 478,\r\n    3, \"ProofPoint\", 483,\r\n    4, \"HornetSecurity\", 813,\r\n    5, \"TrendMicro\", 1151,\r\n    6, \"IronPort\", 1274,\r\n    7, \"Barracuda\", 1585,\r\n    8, \"FireEye\", 2107\r\n]\r\n| project [\"Email security solution\"] = Name, [\"High-severity threats missed / 1K users\"] = Value\r\n| order by [\"High-severity threats missed / 1K users\"] asc\r\n",
+            "resolvedTables": [],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/3/content/items/4/content/items/1/content/query",
+          "sourceSha256": "a691b608e29297a7398550427e7dc2331253dfba5a35075418caf680155de8a8",
+          "targetSha256": "a691b608e29297a7398550427e7dc2331253dfba5a35075418caf680155de8a8"
+        },
+        {
+          "sourcePath": "/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "1fd59e604c53e89e68e79492437b58352dad05c2a44a165056a653932c3b7412"
+          },
+          "conversion": {
+            "sourceId": "/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//KPI summary of inbound email malware detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet mal = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Malware\";\r\nlet inbox = mal | where DeliveryLocation has \"Inbox\";\r\nlet malTrend = toscalar(mal | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(mal | summarize count()), Details = \"Malware Emails\", Ord = 1, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = malTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/5/content/query",
+          "sourceSha256": "1fd59e604c53e89e68e79492437b58352dad05c2a44a165056a653932c3b7412",
+          "targetSha256": "1fd59e604c53e89e68e79492437b58352dad05c2a44a165056a653932c3b7412"
+        },
+        {
+          "sourcePath": "/items/6/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a1eb72881852a12eabc2a4e37363a0520a5c4aaccb1e097ace271ca50e8a6674"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize MalwareDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareDetections = coalesce(MalwareDetections, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/2/content/query",
+          "sourceSha256": "a1eb72881852a12eabc2a4e37363a0520a5c4aaccb1e097ace271ca50e8a6674",
+          "targetSha256": "a1eb72881852a12eabc2a4e37363a0520a5c4aaccb1e097ace271ca50e8a6674"
+        },
+        {
+          "sourcePath": "/items/6/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "16d0ddfd2281229a57f0213b0c71fdee484fd1ce15b8992838ab99c69a595c38"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod in ('File detonation','URL detonation')\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/4/content/query",
+          "sourceSha256": "16d0ddfd2281229a57f0213b0c71fdee484fd1ce15b8992838ab99c69a595c38",
+          "targetSha256": "16d0ddfd2281229a57f0213b0c71fdee484fd1ce15b8992838ab99c69a595c38"
+        },
+        {
+          "sourcePath": "/items/6/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ddd5a7b2f07acbb2d84ca0dc89914b9f9ddc7f535c41e33aa91935489274b85e"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by threat classification of the malware threat in the message.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has 'Malware' and ThreatClassification  has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count(Key) by ThreatClassification\r\n| sort by Count desc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/8/content/query",
+          "sourceSha256": "ddd5a7b2f07acbb2d84ca0dc89914b9f9ddc7f535c41e33aa91935489274b85e",
+          "targetSha256": "ddd5a7b2f07acbb2d84ca0dc89914b9f9ddc7f535c41e33aa91935489274b85e"
+        },
+        {
+          "sourcePath": "/items/6/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "81cc0526ceb03ef05cb2fbe47616c4a345f2a417d517a6677ad6177d152f6ecf"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises Malware detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Malware\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Count desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/9/content/query",
+          "sourceSha256": "81cc0526ceb03ef05cb2fbe47616c4a345f2a417d517a6677ad6177d152f6ecf",
+          "targetSha256": "81cc0526ceb03ef05cb2fbe47616c4a345f2a417d517a6677ad6177d152f6ecf"
+        },
+        {
+          "sourcePath": "/items/6/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "d68a7f96d43935aec5025b38ac8131bfd1d3c0837ec91420c2cbdb973c9fa347"
+          },
+          "conversion": {
+            "sourceId": "/items/6/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.\r\nEmailEvents \r\n| where isnotempty(ThreatNames) and ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand ThreatName = split(ThreatNames, \",\") to typeof(string)\r\n| where isnotempty(ThreatName)\r\n| distinct Key, ThreatName\r\n| summarize Count = count() by ThreatName\r\n| top 15 by Count\r\n| project ['Threat Name'] = ThreatName, Count",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/6/content/items/10/content/query",
+          "sourceSha256": "d68a7f96d43935aec5025b38ac8131bfd1d3c0837ec91420c2cbdb973c9fa347",
+          "targetSha256": "d68a7f96d43935aec5025b38ac8131bfd1d3c0837ec91420c2cbdb973c9fa347"
+        },
+        {
+          "sourcePath": "/items/7/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a3b8e175fb3ff34541f46d149a29711925d5c482a9f9a14d3e5e56f0519e8faf"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware' and EmailDirection == 'Inbound'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalMalwareDetections=count(), Quarantine=countif(DeliveryLocation == 'Quarantine'), Failed=countif(DeliveryLocation == 'Failed') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalMalwareDetections=coalesce(TotalMalwareDetections,0), Quarantine=coalesce(Quarantine,0), Failed=coalesce(Failed,0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/2/content/query",
+          "sourceSha256": "a3b8e175fb3ff34541f46d149a29711925d5c482a9f9a14d3e5e56f0519e8faf",
+          "targetSha256": "a3b8e175fb3ff34541f46d149a29711925d5c482a9f9a14d3e5e56f0519e8faf"
+        },
+        {
+          "sourcePath": "/items/7/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ea45ad99cb7085ff2484337c2af41b5f3afd1e84af0f00116d84c2357866a972"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/4/content/query",
+          "sourceSha256": "ea45ad99cb7085ff2484337c2af41b5f3afd1e84af0f00116d84c2357866a972",
+          "targetSha256": "ea45ad99cb7085ff2484337c2af41b5f3afd1e84af0f00116d84c2357866a972"
+        },
+        {
+          "sourcePath": "/items/7/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "f7b64dc5f98dfd385c0290d39bc1dfc121067b1f882585a454e846d26e593a75"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nEmailEvents \r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod)\r\n| sort by Count desc\r\n| project ['Detection Technology'] = MalwareMethod, ['Detections'] = Count",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/5/content/query",
+          "sourceSha256": "f7b64dc5f98dfd385c0290d39bc1dfc121067b1f882585a454e846d26e593a75",
+          "targetSha256": "f7b64dc5f98dfd385c0290d39bc1dfc121067b1f882585a454e846d26e593a75"
+        },
+        {
+          "sourcePath": "/items/7/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "de21119c9350ed8012e9d56b9475896ed6a277ddc4d58d82498528462c86f523"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/7/content/query",
+          "sourceSha256": "de21119c9350ed8012e9d56b9475896ed6a277ddc4d58d82498528462c86f523",
+          "targetSha256": "de21119c9350ed8012e9d56b9475896ed6a277ddc4d58d82498528462c86f523"
+        },
+        {
+          "sourcePath": "/items/7/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "248b79ce9222fc7113a366302ad0ae54dbc8b1b66c1fe05c66642d477a537621"
+          },
+          "conversion": {
+            "sourceId": "/items/7/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Malware Emails'] = count_\r\n| sort by ['Malware Emails'] desc\r\n\r\n\r\n",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/7/content/items/8/content/query",
+          "sourceSha256": "248b79ce9222fc7113a366302ad0ae54dbc8b1b66c1fe05c66642d477a537621",
+          "targetSha256": "248b79ce9222fc7113a366302ad0ae54dbc8b1b66c1fe05c66642d477a537621"
+        },
+        {
+          "sourcePath": "/items/8/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "02debf99cc2c7a9ebd4aeee5dbd979ab4b7fa66aba6f9735d97d6a9b8d85eee8"
+          },
+          "conversion": {
+            "sourceId": "/items/8/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total inbound emails with Malware detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(ThreatTypes has \"Malware\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/8/content/items/2/content/query",
+          "sourceSha256": "02debf99cc2c7a9ebd4aeee5dbd979ab4b7fa66aba6f9735d97d6a9b8d85eee8",
+          "targetSha256": "02debf99cc2c7a9ebd4aeee5dbd979ab4b7fa66aba6f9735d97d6a9b8d85eee8"
+        },
+        {
+          "sourcePath": "/items/8/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "26285dadd9f5d6729ee69b02f40cae580343f7d64ba34be7561a557015bf71f7"
+          },
+          "conversion": {
+            "sourceId": "/items/8/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/8/content/items/4/content/query",
+          "sourceSha256": "26285dadd9f5d6729ee69b02f40cae580343f7d64ba34be7561a557015bf71f7",
+          "targetSha256": "26285dadd9f5d6729ee69b02f40cae580343f7d64ba34be7561a557015bf71f7"
+        },
+        {
+          "sourcePath": "/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "fd37ee40dbe163b31caf52d4916ff7bb4feb10641478cd97cb31eae0f8073381"
+          },
+          "conversion": {
+            "sourceId": "/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//KPI summary of inbound email phishing detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet ph = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Phish\";\r\nlet inbox = ph | where DeliveryLocation has \"Inbox\";\r\nlet phTrend = toscalar(ph | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(ph | summarize count()), Details = \"Phish Emails\", Ord = 1, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = phTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/10/content/query",
+          "sourceSha256": "fd37ee40dbe163b31caf52d4916ff7bb4feb10641478cd97cb31eae0f8073381",
+          "targetSha256": "fd37ee40dbe163b31caf52d4916ff7bb4feb10641478cd97cb31eae0f8073381"
+        },
+        {
+          "sourcePath": "/items/11/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "22eeb06bdd1b73c37db5b37e411b66901b8c19dabd2331ad63989fc967dbded0"
+          },
+          "conversion": {
+            "sourceId": "/items/11/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections over time summarizing the data daily.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\"\r\n| summarize PhishDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, PhishDetections = coalesce(PhishDetections, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/11/content/items/2/content/query",
+          "sourceSha256": "22eeb06bdd1b73c37db5b37e411b66901b8c19dabd2331ad63989fc967dbded0",
+          "targetSha256": "22eeb06bdd1b73c37db5b37e411b66901b8c19dabd2331ad63989fc967dbded0"
+        },
+        {
+          "sourcePath": "/items/11/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "e2139803441267d6d5a75748527dae86ec2356277870279716138ce6249f943b"
+          },
+          "conversion": {
+            "sourceId": "/items/11/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| project Timestamp, RecipientEmailAddress, NetworkMessageId, DT=parse_json(DetectionMethods)\r\n| evaluate bag_unpack(DT)\r\n| summarize [\"File detonation\"]=countif(Phish has 'File detonation' and Phish !has 'File detonation reputation'), [\"URL detonation\"]=countif(Phish has 'URL detonation' and Phish !has 'URL detonation reputation') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"File detonation\"]=coalesce([\"File detonation\"],0), [\"URL detonation\"]=coalesce([\"URL detonation\"],0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/11/content/items/4/content/query",
+          "sourceSha256": "e2139803441267d6d5a75748527dae86ec2356277870279716138ce6249f943b",
+          "targetSha256": "e2139803441267d6d5a75748527dae86ec2356277870279716138ce6249f943b"
+        },
+        {
+          "sourcePath": "/items/11/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "3be6f32b1bea4e814d3af53af70937deae7fe43a38787044f0d9aaa62b82a3e8"
+          },
+          "conversion": {
+            "sourceId": "/items/11/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of emails detected as Phish by LLM content analysis detection technology in Microsoft Defender for Office 365. \r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and DetectionMethods contains \"LLM content analysis\"\r\n| summarize count()\r\n| sort by count_ desc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/11/content/items/7/content/query",
+          "sourceSha256": "3be6f32b1bea4e814d3af53af70937deae7fe43a38787044f0d9aaa62b82a3e8",
+          "targetSha256": "3be6f32b1bea4e814d3af53af70937deae7fe43a38787044f0d9aaa62b82a3e8"
+        },
+        {
+          "sourcePath": "/items/11/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8e13aacf6471de483b3d738bc1059c5b4827ea403e259262b6b9d4d40c50575c"
+          },
+          "conversion": {
+            "sourceId": "/items/11/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by intent of the message.\r\n// Microsoft Defender for Office 365 LLM analysis is analyzing email messages to understand the intent of the messages. These threat classifications are then used in filtering decisions.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and ThreatClassification  has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize count() by ThreatClassification\r\n| sort by count_ desc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/11/content/items/8/content/query",
+          "sourceSha256": "8e13aacf6471de483b3d738bc1059c5b4827ea403e259262b6b9d4d40c50575c",
+          "targetSha256": "8e13aacf6471de483b3d738bc1059c5b4827ea403e259262b6b9d4d40c50575c"
+        },
+        {
+          "sourcePath": "/items/11/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "05d1791b6b26ff87d2d0fcce94f77886a64e67fb5833619e961bc1fe838c7eb9"
+          },
+          "conversion": {
+            "sourceId": "/items/11/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises Phish detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Emails desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/11/content/items/10/content/query",
+          "sourceSha256": "05d1791b6b26ff87d2d0fcce94f77886a64e67fb5833619e961bc1fe838c7eb9",
+          "targetSha256": "05d1791b6b26ff87d2d0fcce94f77886a64e67fb5833619e961bc1fe838c7eb9"
+        },
+        {
+          "sourcePath": "/items/12/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a350de491b28676fcbbcec5c504cb3ca4a1db5ae48d8c97aa987f59490874575"
+          },
+          "conversion": {
+            "sourceId": "/items/12/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.\r\n//The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\" and EmailDirection == \"Inbound\"\r\n| summarize TotalPhishDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalPhishDetections=coalesce(TotalPhishDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/12/content/items/2/content/query",
+          "sourceSha256": "a350de491b28676fcbbcec5c504cb3ca4a1db5ae48d8c97aa987f59490874575",
+          "targetSha256": "a350de491b28676fcbbcec5c504cb3ca4a1db5ae48d8c97aa987f59490874575"
+        },
+        {
+          "sourcePath": "/items/12/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "9d9d374c3e06afb3823fffd4bb0baed757cc16db6eccfa43861ceb816b1937f4"
+          },
+          "conversion": {
+            "sourceId": "/items/12/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls in Microsoft Defender for Office 365.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/12/content/items/4/content/query",
+          "sourceSha256": "9d9d374c3e06afb3823fffd4bb0baed757cc16db6eccfa43861ceb816b1937f4",
+          "targetSha256": "9d9d374c3e06afb3823fffd4bb0baed757cc16db6eccfa43861ceb816b1937f4"
+        },
+        {
+          "sourcePath": "/items/12/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "183eb747b5a3e5ee38cdb0646009188239f08691ecb6b880734bf1f4b43ea273"
+          },
+          "conversion": {
+            "sourceId": "/items/12/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections summarized by individual Phish detection technology/control in Microsoft Defender for Office 365.\r\n//Each detection technology is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\n//The where clause excludes deliveries to the SecOps Mailbox and by the Phish Simulation system.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/12/content/items/5/content/query",
+          "sourceSha256": "183eb747b5a3e5ee38cdb0646009188239f08691ecb6b880734bf1f4b43ea273",
+          "targetSha256": "183eb747b5a3e5ee38cdb0646009188239f08691ecb6b880734bf1f4b43ea273"
+        },
+        {
+          "sourcePath": "/items/12/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "6e4843db67a97358acb924a864ec43d2e272004210b1434b1b59eb5637bf768c"
+          },
+          "conversion": {
+            "sourceId": "/items/12/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address (SenderIPv4).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/12/content/items/7/content/query",
+          "sourceSha256": "6e4843db67a97358acb924a864ec43d2e272004210b1434b1b59eb5637bf768c",
+          "targetSha256": "6e4843db67a97358acb924a864ec43d2e272004210b1434b1b59eb5637bf768c"
+        },
+        {
+          "sourcePath": "/items/12/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "e22a42e2a2616c1db95f3b9835e72d66cf7970467d685eb93f809b3dfa7ec2ff"
+          },
+          "conversion": {
+            "sourceId": "/items/12/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Phish' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Phish Emails'] = count_\r\n| sort by ['Phish Emails'] desc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/12/content/items/8/content/query",
+          "sourceSha256": "e22a42e2a2616c1db95f3b9835e72d66cf7970467d685eb93f809b3dfa7ec2ff",
+          "targetSha256": "e22a42e2a2616c1db95f3b9835e72d66cf7970467d685eb93f809b3dfa7ec2ff"
+        },
+        {
+          "sourcePath": "/items/13/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0812c949bb0b46ba42d3e3ec829df7f982196eca2b0229a93cfaa5be2364d28a"
+          },
+          "conversion": {
+            "sourceId": "/items/13/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total inbound emails with Phish detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),PhishEmailCount = countif(ThreatTypes has \"Phish\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount !=0\r\n| top 15 by PhishEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/13/content/items/2/content/query",
+          "sourceSha256": "0812c949bb0b46ba42d3e3ec829df7f982196eca2b0229a93cfaa5be2364d28a",
+          "targetSha256": "0812c949bb0b46ba42d3e3ec829df7f982196eca2b0229a93cfaa5be2364d28a"
+        },
+        {
+          "sourcePath": "/items/13/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "d836b1df0d0b4884a6160c9fc03c03c79bf537737fbf3f403b07c08467d4987a"
+          },
+          "conversion": {
+            "sourceId": "/items/13/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain), now including the Phish confidence split (High/Normal) and the aggregated phish detection methods seen per domain. Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\r\n| extend PhishMethods = parse_json(DetectionMethods).Phish\r\n| summarize TotalEmailCount = count(),\r\n            PhishEmailCount = countif(ThreatTypes has \"Phish\"),\r\n            Phish_High = countif(ThreatTypes has \"Phish\" and PhishConf == \"High\"),\r\n            Phish_Normal = countif(ThreatTypes has \"Phish\" and PhishConf == \"Normal\"),\r\n            PhishMethodSet = make_set_if(PhishMethods, ThreatTypes has \"Phish\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount != 0\r\n| top 15 by PhishEmailCount\r\n| mv-apply S = PhishMethodSet on ( mv-expand m = S to typeof(string) | summarize Methods = make_set(m) )\r\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound, ['Detection Methods'] = strcat_array(Methods, \", \")",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/13/content/items/4/content/query",
+          "sourceSha256": "d836b1df0d0b4884a6160c9fc03c03c79bf537737fbf3f403b07c08467d4987a",
+          "targetSha256": "d836b1df0d0b4884a6160c9fc03c03c79bf537737fbf3f403b07c08467d4987a"
+        },
+        {
+          "sourcePath": "/items/15/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "6b196b757eb3f8aeef37ebdc74006b81a1a30b2d070a678ba80b8765f7c5143b"
+          },
+          "conversion": {
+            "sourceId": "/items/15/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//KPI summary of inbound email spam detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet sp = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Spam\";\r\nlet junk = sp | where DeliveryLocation has \"Junk\";\r\nlet spTrend = toscalar(sp | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet junkTrend = toscalar(junk | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(sp | summarize count()), Details = \"Spam Emails\", Ord = 1, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = spTrend),\r\n(print Count = toscalar(junk | summarize count()), Details = \"Sent to Junk\", Ord = 4, Trend = junkTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/15/content/query",
+          "sourceSha256": "6b196b757eb3f8aeef37ebdc74006b81a1a30b2d070a678ba80b8765f7c5143b",
+          "targetSha256": "6b196b757eb3f8aeef37ebdc74006b81a1a30b2d070a678ba80b8765f7c5143b"
+        },
+        {
+          "sourcePath": "/items/16/content/items/1/content/items/0/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a28e74bfbbd4ebedca74681ae5fb0ce2a86f234832b90e21cb0c4e5e7b007f65"
+          },
+          "conversion": {
+            "sourceId": "/items/16/content/items/1/content/items/0/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query calculates the effectiveness of spam detections without edge data.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n            EmailEvents\r\n            | where Timestamp between (minTime ..maxTime )\r\n            | where ThreatTypes contains \"Spam\"\r\n            | project NetworkMessageId, ThreatTypes)\r\n            on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint\r\nEffectiveness_PostDelivery = abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))/(toreal(toscalar(_Spam_Mailflow))+toreal(toscalar(_FN_ZAP_Successful_Spam))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))+toreal(toscalar(_FN_Admin_Submissions_SPM))-toreal(toscalar(_SPAM_ZAP_FP)))*100-100),2))",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/16/content/items/1/content/items/0/content/query",
+          "sourceSha256": "a28e74bfbbd4ebedca74681ae5fb0ce2a86f234832b90e21cb0c4e5e7b007f65",
+          "targetSha256": "a28e74bfbbd4ebedca74681ae5fb0ce2a86f234832b90e21cb0c4e5e7b007f65"
+        },
+        {
+          "sourcePath": "/items/16/content/items/1/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "238ae09c435a5406518596dc18426054e6d6dfc9d7c4df50704b41b1780cd2bf"
+          },
+          "conversion": {
+            "sourceId": "/items/16/content/items/1/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n            EmailEvents\r\n            | where Timestamp between (minTime ..maxTime )\r\n            | where ThreatTypes contains \"Spam\"\r\n            | project NetworkMessageId, ThreatTypes)\r\n            on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint StatisticName=\"Spam Mailflow Minus FPs\", Value=toreal((toscalar(_Spam_Mailflow)) - toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Admin FNs Submitted\", Value=toreal(toscalar(_FN_Admin_Submissions_SPM)))\r\n| union (print StatisticName=\"Spam FPs Reverse Zapped\", Value=toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Zapped Successfully\", Value=toreal(toscalar(_FN_ZAP_Successful_Spam)))\r\n| union (print StatisticName=\"Spam NotZapped\", Value=toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))\r\n| union (print StatisticName=\"Spam Effectiveness Post Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2)))\r\n| union (print StatisticName=\"Spam Effectiveness Pre-Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + (toscalar(_FN_ZAP_Successful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2 )))\r\n| project ['Statistic'] = StatisticName, Value",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/16/content/items/1/content/items/1/content/query",
+          "sourceSha256": "238ae09c435a5406518596dc18426054e6d6dfc9d7c4df50704b41b1780cd2bf",
+          "targetSha256": "238ae09c435a5406518596dc18426054e6d6dfc9d7c4df50704b41b1780cd2bf"
+        },
+        {
+          "sourcePath": "/items/16/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "fe5a749c7e0a653d852395156da4cd7e7ce7ff1762e665d4cd777999277abeea"
+          },
+          "conversion": {
+            "sourceId": "/items/16/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spam detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpamDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/16/content/items/3/content/query",
+          "sourceSha256": "fe5a749c7e0a653d852395156da4cd7e7ce7ff1762e665d4cd777999277abeea",
+          "targetSha256": "fe5a749c7e0a653d852395156da4cd7e7ce7ff1762e665d4cd777999277abeea"
+        },
+        {
+          "sourcePath": "/items/17/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c0470a13c60b55b6e4ce12d21e152594a1a40feb0185e87be6b806d9bb639e2b"
+          },
+          "conversion": {
+            "sourceId": "/items/17/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\" and EmailDirection == \"Inbound\"\r\n| summarize TotalSpamDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalSpamDetections=coalesce(TotalSpamDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/17/content/items/2/content/query",
+          "sourceSha256": "c0470a13c60b55b6e4ce12d21e152594a1a40feb0185e87be6b806d9bb639e2b",
+          "targetSha256": "c0470a13c60b55b6e4ce12d21e152594a1a40feb0185e87be6b806d9bb639e2b"
+        },
+        {
+          "sourcePath": "/items/17/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "01dd1fe6bc4a32ab61b2b9850669c2026f1acca5ebbbdb9b26ba708a81f1af1e"
+          },
+          "conversion": {
+            "sourceId": "/items/17/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where DetectionMethods has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/17/content/items/4/content/query",
+          "sourceSha256": "01dd1fe6bc4a32ab61b2b9850669c2026f1acca5ebbbdb9b26ba708a81f1af1e",
+          "targetSha256": "01dd1fe6bc4a32ab61b2b9850669c2026f1acca5ebbbdb9b26ba708a81f1af1e"
+        },
+        {
+          "sourcePath": "/items/17/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "084647209d37f116cf1a204d17143575d79adf54e3f8450baca8fd358dc9b509"
+          },
+          "conversion": {
+            "sourceId": "/items/17/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spam detections summarized by individual Spam detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Spam (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\"\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/17/content/items/5/content/query",
+          "sourceSha256": "084647209d37f116cf1a204d17143575d79adf54e3f8450baca8fd358dc9b509",
+          "targetSha256": "084647209d37f116cf1a204d17143575d79adf54e3f8450baca8fd358dc9b509"
+        },
+        {
+          "sourcePath": "/items/17/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a7de4ffc8f7eb27db97b364965b34b9ec8a07e8fcfe5d069b5bf7a8d34a22b4d"
+          },
+          "conversion": {
+            "sourceId": "/items/17/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\" and isnotempty(SenderIPv4)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/17/content/items/7/content/query",
+          "sourceSha256": "a7de4ffc8f7eb27db97b364965b34b9ec8a07e8fcfe5d069b5bf7a8d34a22b4d",
+          "targetSha256": "a7de4ffc8f7eb27db97b364965b34b9ec8a07e8fcfe5d069b5bf7a8d34a22b4d"
+        },
+        {
+          "sourcePath": "/items/17/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "abe3f3e14822dc6298e344ededd703ec24e2997b07a30f795a42767adc476f0b"
+          },
+          "conversion": {
+            "sourceId": "/items/17/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Spam' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spam Emails'] = count_\r\n| sort by ['Spam Emails'] desc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/17/content/items/8/content/query",
+          "sourceSha256": "abe3f3e14822dc6298e344ededd703ec24e2997b07a30f795a42767adc476f0b",
+          "targetSha256": "abe3f3e14822dc6298e344ededd703ec24e2997b07a30f795a42767adc476f0b"
+        },
+        {
+          "sourcePath": "/items/17/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8a63fd07272a42368011810f1c3cb00be81d94a86868e94a0fc0747bda98aa3f"
+          },
+          "conversion": {
+            "sourceId": "/items/17/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel\r\n| sort by BulkComplaintLevel desc\r\n| project ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/17/content/items/10/content/query",
+          "sourceSha256": "8a63fd07272a42368011810f1c3cb00be81d94a86868e94a0fc0747bda98aa3f",
+          "targetSha256": "8a63fd07272a42368011810f1c3cb00be81d94a86868e94a0fc0747bda98aa3f"
+        },
+        {
+          "sourcePath": "/items/17/content/items/11/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "51704280a4a6d8449a6de591364095c8ac023580aad92e90748958c6811c2326"
+          },
+          "conversion": {
+            "sourceId": "/items/17/content/items/11/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel, SenderFromDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain'] = SenderFromDomain, ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/17/content/items/11/content/query",
+          "sourceSha256": "51704280a4a6d8449a6de591364095c8ac023580aad92e90748958c6811c2326",
+          "targetSha256": "51704280a4a6d8449a6de591364095c8ac023580aad92e90748958c6811c2326"
+        },
+        {
+          "sourcePath": "/items/18/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "78adf2f996597251405ce011ccd04e54e1dda00c5b7d4912c5e05cd125f7609d"
+          },
+          "conversion": {
+            "sourceId": "/items/18/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection ==\"Inbound\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),SpamEmailCount = countif(ThreatTypes has \"Spam\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount)* 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/18/content/items/2/content/query",
+          "sourceSha256": "78adf2f996597251405ce011ccd04e54e1dda00c5b7d4912c5e05cd125f7609d",
+          "targetSha256": "78adf2f996597251405ce011ccd04e54e1dda00c5b7d4912c5e05cd125f7609d"
+        },
+        {
+          "sourcePath": "/items/18/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "bc7b742b68f85605fbb44ce79e3a721dbf9258eb6bf68430e710e92e5f704da3"
+          },
+          "conversion": {
+            "sourceId": "/items/18/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(),\r\n            SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/18/content/items/4/content/query",
+          "sourceSha256": "bc7b742b68f85605fbb44ce79e3a721dbf9258eb6bf68430e710e92e5f704da3",
+          "targetSha256": "bc7b742b68f85605fbb44ce79e3a721dbf9258eb6bf68430e710e92e5f704da3"
+        },
+        {
+          "sourcePath": "/items/20/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c4f105af76862707cad18ad90f0cc5ca9122667bdb580b6150b0a122ab85fb8b"
+          },
+          "conversion": {
+            "sourceId": "/items/20/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//KPI summary of inbound email impersonation and spoof (BEC) detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet bec = EmailEvents | where EmailDirection == \"Inbound\" | where DetectionMethods has \"Impersonation\" or DetectionMethods has \"Spoof\";\r\nlet inbox = bec | where DeliveryLocation has \"Inbox\";\r\nlet becTrend = toscalar(bec | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(bec | summarize count()), Details = \"Impersonation / Spoof Emails\", Ord = 1, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(SenderFromDomain)), Details = \"Spoofed Sender Domains\", Ord = 3, Trend = becTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/20/content/query",
+          "sourceSha256": "c4f105af76862707cad18ad90f0cc5ca9122667bdb580b6150b0a122ab85fb8b",
+          "targetSha256": "c4f105af76862707cad18ad90f0cc5ca9122667bdb580b6150b0a122ab85fb8b"
+        },
+        {
+          "sourcePath": "/items/21/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "19c8169c55a32ba881163427e6775f54646e428c4c7d3f183237dfc4f5b80122"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Impersonation'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ImpersonationDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/2/content/query",
+          "sourceSha256": "19c8169c55a32ba881163427e6775f54646e428c4c7d3f183237dfc4f5b80122",
+          "targetSha256": "19c8169c55a32ba881163427e6775f54646e428c4c7d3f183237dfc4f5b80122"
+        },
+        {
+          "sourcePath": "/items/21/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0a348831425415001b2848be6a4ab1393cd02e0d34042fca75837862b9f42dd8"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/4/content/query",
+          "sourceSha256": "0a348831425415001b2848be6a4ab1393cd02e0d34042fca75837862b9f42dd8",
+          "targetSha256": "0a348831425415001b2848be6a4ab1393cd02e0d34042fca75837862b9f42dd8"
+        },
+        {
+          "sourcePath": "/items/21/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "222ae168c6cb938f7b93b895788a390fb029a32e1664cb2789bc5fab6aeb11b5"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Impersonation detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/5/content/query",
+          "sourceSha256": "222ae168c6cb938f7b93b895788a390fb029a32e1664cb2789bc5fab6aeb11b5",
+          "targetSha256": "222ae168c6cb938f7b93b895788a390fb029a32e1664cb2789bc5fab6aeb11b5"
+        },
+        {
+          "sourcePath": "/items/21/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7230d3dec852957a1977bc5cbd58bddca882e80fe7bdbecaeed68093d065df5e"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/7/content/query",
+          "sourceSha256": "7230d3dec852957a1977bc5cbd58bddca882e80fe7bdbecaeed68093d065df5e",
+          "targetSha256": "7230d3dec852957a1977bc5cbd58bddca882e80fe7bdbecaeed68093d065df5e"
+        },
+        {
+          "sourcePath": "/items/21/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5b2791d69e5d49a1e94edfbf28e6131f53002bb9255f81ba6d9f55db046704d8"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Impersonation Emails'] = count_\r\n| sort by ['Impersonation Emails'] desc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/8/content/query",
+          "sourceSha256": "5b2791d69e5d49a1e94edfbf28e6131f53002bb9255f81ba6d9f55db046704d8",
+          "targetSha256": "5b2791d69e5d49a1e94edfbf28e6131f53002bb9255f81ba6d9f55db046704d8"
+        },
+        {
+          "sourcePath": "/items/21/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "83698c8e41887bef4abd2fe97ab3f556741c929628fb05d4d18e88a223c9df41"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Spoof'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpoofDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/10/content/query",
+          "sourceSha256": "83698c8e41887bef4abd2fe97ab3f556741c929628fb05d4d18e88a223c9df41",
+          "targetSha256": "83698c8e41887bef4abd2fe97ab3f556741c929628fb05d4d18e88a223c9df41"
+        },
+        {
+          "sourcePath": "/items/21/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "37a68140432a447f5c7af8dbdfda9bca62395fb84ec1e8a0ae8f005d73404490"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily by various Spoof Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/12/content/query",
+          "sourceSha256": "37a68140432a447f5c7af8dbdfda9bca62395fb84ec1e8a0ae8f005d73404490",
+          "targetSha256": "37a68140432a447f5c7af8dbdfda9bca62395fb84ec1e8a0ae8f005d73404490"
+        },
+        {
+          "sourcePath": "/items/21/content/items/13/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4c9ff00bc3a99712b53534750ac48fda121b96ced9fbcdfaaa69da335fc6d14a"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/13/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Spoof detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/13/content/query",
+          "sourceSha256": "4c9ff00bc3a99712b53534750ac48fda121b96ced9fbcdfaaa69da335fc6d14a",
+          "targetSha256": "4c9ff00bc3a99712b53534750ac48fda121b96ced9fbcdfaaa69da335fc6d14a"
+        },
+        {
+          "sourcePath": "/items/21/content/items/15/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "6d4e09079b6dccedc1d063269c18eeb986714a2bc0117b85d554b879415d29d3"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/15/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_  ",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/15/content/query",
+          "sourceSha256": "6d4e09079b6dccedc1d063269c18eeb986714a2bc0117b85d554b879415d29d3",
+          "targetSha256": "6d4e09079b6dccedc1d063269c18eeb986714a2bc0117b85d554b879415d29d3"
+        },
+        {
+          "sourcePath": "/items/21/content/items/16/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c1be2cd17e75ae46d3684fbb36345ffe412cf242cd59f72b21e72389fbf833ba"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/16/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spoof Emails'] = count_\r\n| sort by ['Spoof Emails'] desc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/16/content/query",
+          "sourceSha256": "c1be2cd17e75ae46d3684fbb36345ffe412cf242cd59f72b21e72389fbf833ba",
+          "targetSha256": "c1be2cd17e75ae46d3684fbb36345ffe412cf242cd59f72b21e72389fbf833ba"
+        },
+        {
+          "sourcePath": "/items/21/content/items/18/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8de5a8ad15b74c19ef2783d043cf7c817e8c56340e9adbcf8abe387915d09ae6"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/18/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) \r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Outbound\"\r\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| summarize count() by RecipientDomain\r\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\r\n| join (EmailEvents | where EmailDirection == \"Inbound\" and isempty(ThreatTypes)==false) on SenderFromDomain\r\n| summarize max(OutboundCount),count() by SenderFromDomain\r\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\r\n| extend Bad_Traffic_Percentage = todouble(round(IncomingEmailsWithThreats / todouble(OutboundEmails) * 100, 2))\r\n| top 15 by OutboundEmails\r\n| project ['Sender Domain'] = SenderFromDomain, ['Outbound Emails'] = OutboundEmails, ['Inbound w/ Threats'] = IncomingEmailsWithThreats, ['Bad Traffic %'] = Bad_Traffic_Percentage",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/18/content/query",
+          "sourceSha256": "8de5a8ad15b74c19ef2783d043cf7c817e8c56340e9adbcf8abe387915d09ae6",
+          "targetSha256": "8de5a8ad15b74c19ef2783d043cf7c817e8c56340e9adbcf8abe387915d09ae6"
+        },
+        {
+          "sourcePath": "/items/21/content/items/20/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c0d35624bc2b22f0fae34301c14aa1cddba46b1c14c9ba76ae471c7de9f59f39"
+          },
+          "conversion": {
+            "sourceId": "/items/21/content/items/20/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top recipients targeted by impersonation / BEC, with distinct senders, spoofed domains and how many landed in the inbox.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| where DetectionMethods has \"Impersonation\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize ImpersonationEmails = count(),\r\n            DistinctSenders      = dcount(SenderFromAddress),\r\n            TopSpoofedDomains    = make_set(SenderFromDomain, 5),\r\n            DeliveredToInbox     = countif(DeliveryLocation has \"Inbox\")\r\n        by RecipientEmailAddress\r\n| top 20 by ImpersonationEmails\r\n| project ['Recipient'] = RecipientEmailAddress, ['Impersonation Emails'] = ImpersonationEmails, ['Distinct Senders'] = DistinctSenders, ['Top Spoofed Domains'] = strcat_array(TopSpoofedDomains, \", \"), ['Delivered to Inbox'] = DeliveredToInbox",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/21/content/items/20/content/query",
+          "sourceSha256": "c0d35624bc2b22f0fae34301c14aa1cddba46b1c14c9ba76ae471c7de9f59f39",
+          "targetSha256": "c0d35624bc2b22f0fae34301c14aa1cddba46b1c14c9ba76ae471c7de9f59f39"
+        },
+        {
+          "sourcePath": "/items/22/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "58b9016775f366c2cf992c083592ff71ae2135da153677b3f824c46f7a957ae1"
+          },
+          "conversion": {
+            "sourceId": "/items/22/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spoof- DMARC fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DMARCFail = (tostring(parse_json(AuthenticationDetails).DMARC) == \"fail\") \r\n| summarize DMARCFail = sum(DMARCFail) by bin (Timestamp,{Granularity})",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/22/content/items/2/content/query",
+          "sourceSha256": "58b9016775f366c2cf992c083592ff71ae2135da153677b3f824c46f7a957ae1",
+          "targetSha256": "58b9016775f366c2cf992c083592ff71ae2135da153677b3f824c46f7a957ae1"
+        },
+        {
+          "sourcePath": "/items/22/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a28a9af539c2397ac3fd1c84ef7c2783d5a479e471df73be7ca43caace84e681"
+          },
+          "conversion": {
+            "sourceId": "/items/22/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spoof- DKIM fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DKIMFail = (tostring(parse_json(AuthenticationDetails).DKIM) == \"fail\") \r\n| summarize DKIMFail = sum(DKIMFail) by bin (Timestamp,{Granularity})",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/22/content/items/3/content/query",
+          "sourceSha256": "a28a9af539c2397ac3fd1c84ef7c2783d5a479e471df73be7ca43caace84e681",
+          "targetSha256": "a28a9af539c2397ac3fd1c84ef7c2783d5a479e471df73be7ca43caace84e681"
+        },
+        {
+          "sourcePath": "/items/22/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "41d09c9e789532d07dc69ecc411bc68133aafd96989cf4e02eeb42b33d2c8d01"
+          },
+          "conversion": {
+            "sourceId": "/items/22/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spoof- SPF fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend SPFFail = (tostring(parse_json(AuthenticationDetails).SPF) == \"fail\") \r\n| summarize SPFFail = sum(SPFFail) by bin (Timestamp,{Granularity})",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/22/content/items/4/content/query",
+          "sourceSha256": "41d09c9e789532d07dc69ecc411bc68133aafd96989cf4e02eeb42b33d2c8d01",
+          "targetSha256": "41d09c9e789532d07dc69ecc411bc68133aafd96989cf4e02eeb42b33d2c8d01"
+        },
+        {
+          "sourcePath": "/items/22/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ea61c1a26e95808521fbe8cbdbdcf1d04ea9085ee24a39412cb680dc728a73c3"
+          },
+          "conversion": {
+            "sourceId": "/items/22/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spoof- Composite Authentication fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend CompAuthFail = (tostring(parse_json(AuthenticationDetails).CompAuth) == \"fail\") \r\n| summarize CompAuthFail = sum(CompAuthFail) by bin (Timestamp,{Granularity})",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/22/content/items/5/content/query",
+          "sourceSha256": "ea61c1a26e95808521fbe8cbdbdcf1d04ea9085ee24a39412cb680dc728a73c3",
+          "targetSha256": "ea61c1a26e95808521fbe8cbdbdcf1d04ea9085ee24a39412cb680dc728a73c3"
+        },
+        {
+          "sourcePath": "/items/22/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c77a0ff030a3dd2b738f7fd66ac24d6eabd640f0edcfad21a2e4de669dff53f7"
+          },
+          "conversion": {
+            "sourceId": "/items/22/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and DMARC fail traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof DMARC\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where DMARCFailCount !=0\r\n| top 10 by DMARCFailCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['DMARC Failures'] = DMARCFailCount, ['Total Inbound'] = TotalEmailCount, ['DMARC Fail %'] = DMARCFail_Traffic_Percentage",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/22/content/items/7/content/query",
+          "sourceSha256": "c77a0ff030a3dd2b738f7fd66ac24d6eabd640f0edcfad21a2e4de669dff53f7",
+          "targetSha256": "c77a0ff030a3dd2b738f7fd66ac24d6eabd640f0edcfad21a2e4de669dff53f7"
+        },
+        {
+          "sourcePath": "/items/22/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "47768c7215fdf1bf634a0a9b52fe50f8e37e04820aed240d40b792a2e944cd9f"
+          },
+          "conversion": {
+            "sourceId": "/items/22/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof external domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof external domain\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofExternalCount !=0\r\n| top 10 by SpoofExternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof External'] = SpoofExternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof External %'] = SpoofExternal_Traffic_Percentage",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/22/content/items/9/content/query",
+          "sourceSha256": "47768c7215fdf1bf634a0a9b52fe50f8e37e04820aed240d40b792a2e944cd9f",
+          "targetSha256": "47768c7215fdf1bf634a0a9b52fe50f8e37e04820aed240d40b792a2e944cd9f"
+        },
+        {
+          "sourcePath": "/items/22/content/items/11/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7dce088cd958bf29049a469802daad4299c5cba83a4f3703a93131ee18525824"
+          },
+          "conversion": {
+            "sourceId": "/items/22/content/items/11/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n            SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof intra-org\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofInternalCount !=0\r\n| top 10 by SpoofInternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof Internal'] = SpoofInternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof Internal %'] = SpoofInternal_Traffic_Percentage",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/22/content/items/11/content/query",
+          "sourceSha256": "7dce088cd958bf29049a469802daad4299c5cba83a4f3703a93131ee18525824",
+          "targetSha256": "7dce088cd958bf29049a469802daad4299c5cba83a4f3703a93131ee18525824"
+        },
+        {
+          "sourcePath": "/items/23/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c5790761884246424b5b0bb4f99d1c87fc14a5ba40d87397d14df2e97c4c963c"
+          },
+          "conversion": {
+            "sourceId": "/items/23/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists external email senders seen for the first time in the selected period (most recent first), surfacing new/first-contact senders. In tenants with longer history this highlights genuinely new relationships - a common precursor to BEC and supply-chain attacks.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderFromAddress)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), Messages=count(), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\r\n| top 20 by FirstSeen desc\r\n| project ['Sender']=SenderFromAddress, ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, ['Threat Messages']=ThreatMessages",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/23/content/items/2/content/query",
+          "sourceSha256": "c5790761884246424b5b0bb4f99d1c87fc14a5ba40d87397d14df2e97c4c963c",
+          "targetSha256": "c5790761884246424b5b0bb4f99d1c87fc14a5ba40d87397d14df2e97c4c963c"
+        },
+        {
+          "sourcePath": "/items/23/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "3b57a1805ed80603ed532a37c949b325e6089df1020df9f12dc3173efc2de493"
+          },
+          "conversion": {
+            "sourceId": "/items/23/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists external sender domains seen for the first time in the selected period that already carried threats, ranked by most-recently first seen. A brand-new domain sending threats to your users is a strong early-warning signal for phishing and BEC.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Messages=count(), Senders=dcount(SenderFromAddress), Recipients=dcount(RecipientEmailAddress), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderDomain\r\n| where ThreatMessages > 0\r\n| top 20 by FirstSeen desc\r\n| project ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, Senders, Recipients, ['Threat Messages']=ThreatMessages, ['Last Seen']=LastSeen",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/23/content/items/4/content/query",
+          "sourceSha256": "3b57a1805ed80603ed532a37c949b325e6089df1020df9f12dc3173efc2de493",
+          "targetSha256": "3b57a1805ed80603ed532a37c949b325e6089df1020df9f12dc3173efc2de493"
+        },
+        {
+          "sourcePath": "/items/25/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "b4352c617373ee0d8c94c692bce5613e67cb7612fa7922e78ac78634aa714714"
+          },
+          "conversion": {
+            "sourceId": "/items/25/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//KPI summary of URL threat protection (Safe Links clicks and URLs seen in email) for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet clicks = UrlClickEvents;\r\nlet blocked = clicks | where ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\");\r\nlet allowed = clicks | where ActionType == \"ClickAllowed\";\r\nlet blockedTrend = toscalar(blocked | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet allowedTrend = toscalar(allowed | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet usersTrend = toscalar(clicks | make-series Trend = dcount(AccountUpn) default = 0 on Timestamp step gran | project Trend);\r\nlet urlsTrend = toscalar(EmailUrlInfo | make-series Trend = dcount(Url) default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(blocked | summarize count()), Details = \"Malicious Clicks Blocked\", Ord = 1, Trend = blockedTrend),\r\n(print Count = toscalar(allowed | summarize count()), Details = \"Clicks Allowed Through\", Ord = 2, Trend = allowedTrend),\r\n(print Count = toscalar(clicks | summarize dcount(AccountUpn)), Details = \"Users Clicking Links\", Ord = 3, Trend = usersTrend),\r\n(print Count = toscalar(EmailUrlInfo | summarize dcount(Url)), Details = \"Distinct URLs in Email\", Ord = 4, Trend = urlsTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend",
+            "resolvedTables": [
+              "EmailUrlInfo",
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailUrlInfo",
+                "ahTable": "EmailUrlInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 7,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/25/content/query",
+          "sourceSha256": "b4352c617373ee0d8c94c692bce5613e67cb7612fa7922e78ac78634aa714714",
+          "targetSha256": "b4352c617373ee0d8c94c692bce5613e67cb7612fa7922e78ac78634aa714714"
+        },
+        {
+          "sourcePath": "/items/26/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "9daabfabfcb9f9a343c05b6a9a3628be01341908ce2121be22d85a4883057a46"
+          },
+          "conversion": {
+            "sourceId": "/items/26/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod contains \"URL\"\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/26/content/items/2/content/query",
+          "sourceSha256": "9daabfabfcb9f9a343c05b6a9a3628be01341908ce2121be22d85a4883057a46",
+          "targetSha256": "9daabfabfcb9f9a343c05b6a9a3628be01341908ce2121be22d85a4883057a46"
+        },
+        {
+          "sourcePath": "/items/26/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c6bcb12df3ef848861601923d5e929e0aca00db63f4ee330eca357d9ad0d23f3"
+          },
+          "conversion": {
+            "sourceId": "/items/26/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total emails with Phishing detections over time summarizing the data daily by various Phishing URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Phish'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand PhishMethod = ParsedMethods.Phish\r\n| where PhishMethod contains \"URL\"\r\n| summarize Count = count() by PhishMethod = tostring(PhishMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct PhishMethod | extend d = 1) on d | project Timestamp, PhishMethod\r\n| join kind=leftouter (agg) on Timestamp, PhishMethod\r\n| project Timestamp, PhishMethod, Count = coalesce(Count, 0)\r\n| sort by PhishMethod asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/26/content/items/4/content/query",
+          "sourceSha256": "c6bcb12df3ef848861601923d5e929e0aca00db63f4ee330eca357d9ad0d23f3",
+          "targetSha256": "c6bcb12df3ef848861601923d5e929e0aca00db63f4ee330eca357d9ad0d23f3"
+        },
+        {
+          "sourcePath": "/items/26/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "136feab1afc6191911f3781f8201b9e02054f87628fe384f51b0053e4b212071"
+          },
+          "conversion": {
+            "sourceId": "/items/26/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\" \r\n| where DetectionMethods has \"Url\"\r\n| join EmailUrlInfo on NetworkMessageId\r\n| where UrlLocation == \"QRCode\"\r\n| summarize [\"Phish QR Detection\"]=countif(parse_json(DetectionMethods).Phish has \"URL\"), [\"Malware QR Detection\"]=countif(parse_json(DetectionMethods).Malware has \"URL\"), [\"Spam QR Detection\"]=countif(parse_json(DetectionMethods).Spam has \"URL\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Phish QR Detection\"]=coalesce([\"Phish QR Detection\"],0), [\"Malware QR Detection\"]=coalesce([\"Malware QR Detection\"],0), [\"Spam QR Detection\"]=coalesce([\"Spam QR Detection\"],0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailUrlInfo",
+                "ahTable": "EmailUrlInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 7,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/26/content/items/7/content/query",
+          "sourceSha256": "136feab1afc6191911f3781f8201b9e02054f87628fe384f51b0053e4b212071",
+          "targetSha256": "136feab1afc6191911f3781f8201b9e02054f87628fe384f51b0053e4b212071"
+        },
+        {
+          "sourcePath": "/items/26/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "3629b626438ea9a517079ccccb7998cfa0f2f23d6b901a435b17db6fa975f169"
+          },
+          "conversion": {
+            "sourceId": "/items/26/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises where URL's have been scanned identified from various locations in emails\r\nEmailUrlInfo\r\n| summarize  count() by UrlLocation",
+            "resolvedTables": [
+              "EmailUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailUrlInfo",
+                "ahTable": "EmailUrlInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 7,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/26/content/items/8/content/query",
+          "sourceSha256": "3629b626438ea9a517079ccccb7998cfa0f2f23d6b901a435b17db6fa975f169",
+          "targetSha256": "3629b626438ea9a517079ccccb7998cfa0f2f23d6b901a435b17db6fa975f169"
+        },
+        {
+          "sourcePath": "/items/27/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "de9936de60014beaf4994b55a62748796df10357de12757d8a45935de883aa77"
+          },
+          "conversion": {
+            "sourceId": "/items/27/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// Generates a time-series analysis for blocked URL click events from the 'UrlClickEvents' table\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| where ActionType has_any(\"ClickBlocked\")\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, BlockedClicks = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents",
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/27/content/items/2/content/query",
+          "sourceSha256": "de9936de60014beaf4994b55a62748796df10357de12757d8a45935de883aa77",
+          "targetSha256": "de9936de60014beaf4994b55a62748796df10357de12757d8a45935de883aa77"
+        },
+        {
+          "sourcePath": "/items/27/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "d64b0ab24acbc83afb51a6cdd483334e3fa2104a6254214d051b53905d37212d"
+          },
+          "conversion": {
+            "sourceId": "/items/27/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of click attempts on URL's with detections split by the different threat types identified\r\nUrlClickEvents\r\n| where isnotempty(ThreatTypes)\r\n| summarize count() by ThreatTypes",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/27/content/items/3/content/query",
+          "sourceSha256": "d64b0ab24acbc83afb51a6cdd483334e3fa2104a6254214d051b53905d37212d",
+          "targetSha256": "d64b0ab24acbc83afb51a6cdd483334e3fa2104a6254214d051b53905d37212d"
+        },
+        {
+          "sourcePath": "/items/27/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "744fd3158cce723e09e1dc24686787d492bae7d213699246837e5936806f0197"
+          },
+          "conversion": {
+            "sourceId": "/items/27/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises different URL click event types by action (e.g., blocked, allowed, pending verdict, error pages, and clicked through), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| summarize ClickBlocked=countif(ActionType has_any(\"ClickBlocked\")), ClickAllowed=countif(ActionType has_any(\"ClickAllowed\")), PendingVerdict=countif(ActionType has_any(\"UrlScanInProgress\")), ErrorPage=countif(ActionType has_any(\"UrlErrorPage\")), ClickedThrough=countif(IsClickedThrough == true) by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickBlocked=coalesce(ClickBlocked,0), ClickAllowed=coalesce(ClickAllowed,0), PendingVerdict=coalesce(PendingVerdict,0), ErrorPage=coalesce(ErrorPage,0), ClickedThrough=coalesce(ClickedThrough,0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents",
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/27/content/items/6/content/query",
+          "sourceSha256": "744fd3158cce723e09e1dc24686787d492bae7d213699246837e5936806f0197",
+          "targetSha256": "744fd3158cce723e09e1dc24686787d492bae7d213699246837e5936806f0197"
+        },
+        {
+          "sourcePath": "/items/27/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8429ae089810f55dc95903d431c16664edf954083e661b7a073a232c8f4eba90"
+          },
+          "conversion": {
+            "sourceId": "/items/27/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises where URL clicks scanned by the Workload the click happened from\r\nUrlClickEvents\r\n| summarize  count() by Workload",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/27/content/items/7/content/query",
+          "sourceSha256": "8429ae089810f55dc95903d431c16664edf954083e661b7a073a232c8f4eba90",
+          "targetSha256": "8429ae089810f55dc95903d431c16664edf954083e661b7a073a232c8f4eba90"
+        },
+        {
+          "sourcePath": "/items/27/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "eaf620ac0615ffcdfc3897483b5032a495ab79fd549ab9632890d43ff5829b7d"
+          },
+          "conversion": {
+            "sourceId": "/items/27/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises blocked URL click event types by Workload (e.g., Email, Teams, Office, Microsoft 365 Copilot), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where ActionType ==\"ClickBlocked\"\r\n| summarize Teams=countif(Workload==\"Teams\"), Office=countif(Workload==\"Office\"), Email=countif(Workload==\"Email\"), Copilot=countif(Workload==\"Copilot\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Teams=coalesce(Teams,0), Office=coalesce(Office,0), Email=coalesce(Email,0), Copilot=coalesce(Copilot,0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents",
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/27/content/items/10/content/query",
+          "sourceSha256": "eaf620ac0615ffcdfc3897483b5032a495ab79fd549ab9632890d43ff5829b7d",
+          "targetSha256": "eaf620ac0615ffcdfc3897483b5032a495ab79fd549ab9632890d43ff5829b7d"
+        },
+        {
+          "sourcePath": "/items/27/content/items/11/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0bf2451c7dfd76eee94ff4124828ce2b680dbd19e088d2349a438a86a150e1d1"
+          },
+          "conversion": {
+            "sourceId": "/items/27/content/items/11/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of click-through activities on URL's with detections split by the source client\r\nUrlClickEvents \r\n| where IsClickedThrough !=\"0\"\r\n| where isnotempty(ThreatTypes) \r\n| summarize count() by Workload",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/27/content/items/11/content/query",
+          "sourceSha256": "0bf2451c7dfd76eee94ff4124828ce2b680dbd19e088d2349a438a86a150e1d1",
+          "targetSha256": "0bf2451c7dfd76eee94ff4124828ce2b680dbd19e088d2349a438a86a150e1d1"
+        },
+        {
+          "sourcePath": "/items/27/content/items/13/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "38b2d7e0174c44ebdbf8a4c715c5adfbd101c732af0b9d346b36583eeee59f5a"
+          },
+          "conversion": {
+            "sourceId": "/items/27/content/items/13/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows the top 20 URL's that have a detection associated with the most ammount of clicks registered \r\nUrlClickEvents\r\n| where ThreatTypes !=\"\"\r\n| summarize count() by Url, ThreatTypes, ActionType, Workload\r\n| top 20 by count_\r\n| project ['URL']=Url, ['Threat Types']=ThreatTypes, ['Action Type']=ActionType, Workload, ['Click Count']=count_",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/27/content/items/13/content/query",
+          "sourceSha256": "38b2d7e0174c44ebdbf8a4c715c5adfbd101c732af0b9d346b36583eeee59f5a",
+          "targetSha256": "38b2d7e0174c44ebdbf8a4c715c5adfbd101c732af0b9d346b36583eeee59f5a"
+        },
+        {
+          "sourcePath": "/items/28/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "db5f05baf90ec7c16a38f3233a08b5a6e7269dce3e582c57e664ddc428032b2c"
+          },
+          "conversion": {
+            "sourceId": "/items/28/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top 10 users with click attempts on URL's with malware detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),MalwareClickCount = countif(ThreatTypes has \"Malware\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(MalwareClickCount / todouble(TotalClickCount) *100, 2))\r\n| where MalwareClickCount !=0\r\n| sort by MalwareClickCount desc\r\n| top 15 by MalwareClickCount\r\n| project ['User']=AccountUpn, ['Malware Clicks']=MalwareClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/28/content/items/2/content/query",
+          "sourceSha256": "db5f05baf90ec7c16a38f3233a08b5a6e7269dce3e582c57e664ddc428032b2c",
+          "targetSha256": "db5f05baf90ec7c16a38f3233a08b5a6e7269dce3e582c57e664ddc428032b2c"
+        },
+        {
+          "sourcePath": "/items/28/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "07a9bf36177e24ca6af9f2a2db7e5a2de3717ae986fee891f6a70908ec57aad0"
+          },
+          "conversion": {
+            "sourceId": "/items/28/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top 10 users with click attempts on URL's with Phish detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),PhishClickCount = countif(ThreatTypes has \"Phish\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(PhishClickCount / todouble(TotalClickCount) *100, 2))\r\n| where PhishClickCount !=0\r\n| sort by PhishClickCount desc\r\n| top 15 by PhishClickCount\r\n| project ['User']=AccountUpn, ['Phish Clicks']=PhishClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/28/content/items/4/content/query",
+          "sourceSha256": "07a9bf36177e24ca6af9f2a2db7e5a2de3717ae986fee891f6a70908ec57aad0",
+          "targetSha256": "07a9bf36177e24ca6af9f2a2db7e5a2de3717ae986fee891f6a70908ec57aad0"
+        },
+        {
+          "sourcePath": "/items/28/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ed27048ae55d9fc1d918d46c209d96cb434835c7cac40c7ebb48ad64b1f8529d"
+          },
+          "conversion": {
+            "sourceId": "/items/28/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top 10 users with click attempts on URL's with Spam detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),SpamClickCount = countif(ThreatTypes has \"Spam\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(SpamClickCount / todouble(TotalClickCount) *100, 2))\r\n| where SpamClickCount !=0\r\n| sort by SpamClickCount desc\r\n| top 15 by SpamClickCount\r\n| project ['User']=AccountUpn, ['Spam Clicks']=SpamClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/28/content/items/6/content/query",
+          "sourceSha256": "ed27048ae55d9fc1d918d46c209d96cb434835c7cac40c7ebb48ad64b1f8529d",
+          "targetSha256": "ed27048ae55d9fc1d918d46c209d96cb434835c7cac40c7ebb48ad64b1f8529d"
+        },
+        {
+          "sourcePath": "/items/30/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7112638b0b50795d443ced8d00eaa0c220c8aa565ac8be30f20061f075662eaf"
+          },
+          "conversion": {
+            "sourceId": "/items/30/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Headline Microsoft Teams protection metrics for the selected period, with per-interval sparklines. Messages are de-duplicated to the latest record per Teams message.\r\nlet gran = {Granularity};\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(msgs | summarize Count = count() | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(msgs | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Messages with Threats\", Ord = 2, Trend = toscalar(msgs | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend Details = \"Phish Detections\", Ord = 3, Trend = toscalar(msgs | where ThreatTypes has \"Phish\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend Details = \"Malware Detections\", Ord = 4, Trend = toscalar(msgs | where ThreatTypes has \"Malware\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend Details = \"Spam Detections\", Ord = 5, Trend = toscalar(msgs | where ThreatTypes has \"Spam\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 6, Trend = toscalar(msgs | where SafetyTip == \"URLMessageWarning\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(zap | summarize Count = count() | extend Details = \"Post-Delivery ZAP Actions\", Ord = 7, Trend = toscalar(zap | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+            "resolvedTables": [
+              "MessageEvents",
+              "MessagePostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              },
+              {
+                "sentinelTable": "MessagePostDeliveryEvents",
+                "ahTable": "MessagePostDeliveryEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/30/content/query",
+          "sourceSha256": "7112638b0b50795d443ced8d00eaa0c220c8aa565ac8be30f20061f075662eaf",
+          "targetSha256": "7112638b0b50795d443ced8d00eaa0c220c8aa565ac8be30f20061f075662eaf"
+        },
+        {
+          "sourcePath": "/items/31/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "addfc8701d3b8ad0712bae67511363b79bc36017bc20156253fc121355e30cb2"
+          },
+          "conversion": {
+            "sourceId": "/items/31/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the number of Microsoft Teams messages detected with a threat over time, de-duplicated to the latest record per message and summarized per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId | summarize ThreatDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ThreatDetections = coalesce(ThreatDetections, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/31/content/items/2/content/query",
+          "sourceSha256": "addfc8701d3b8ad0712bae67511363b79bc36017bc20156253fc121355e30cb2",
+          "targetSha256": "addfc8701d3b8ad0712bae67511363b79bc36017bc20156253fc121355e30cb2"
+        },
+        {
+          "sourcePath": "/items/31/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "115d80895a5be2c85508f27e76a48f554b8cd9365d1d7821be31df99aeff3468"
+          },
+          "conversion": {
+            "sourceId": "/items/31/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query breaks down Microsoft Teams threat detections by threat type for the selected period, de-duplicated to the latest record per message. A message flagged for more than one threat type is counted under each, so the split can exceed the distinct message count.\r\nlet msgs = MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nunion\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend ThreatType = \"Phish\"),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend ThreatType = \"Malware\"),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend ThreatType = \"Spam\")\r\n| project ThreatType, Count",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/31/content/items/5/content/query",
+          "sourceSha256": "115d80895a5be2c85508f27e76a48f554b8cd9365d1d7821be31df99aeff3468",
+          "targetSha256": "115d80895a5be2c85508f27e76a48f554b8cd9365d1d7821be31df99aeff3468"
+        },
+        {
+          "sourcePath": "/items/31/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "0b301a80d30871d06c44e6d360d25e6e9e7d0385f8f0f6ab0cde02431fb234ce"
+          },
+          "conversion": {
+            "sourceId": "/items/31/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| extend Thread = iif(IsExternalThread == true, \"External Thread\", \"Internal Thread\")\r\n| summarize Count = count() by Thread",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/31/content/items/6/content/query",
+          "sourceSha256": "0b301a80d30871d06c44e6d360d25e6e9e7d0385f8f0f6ab0cde02431fb234ce",
+          "targetSha256": "0b301a80d30871d06c44e6d360d25e6e9e7d0385f8f0f6ab0cde02431fb234ce"
+        },
+        {
+          "sourcePath": "/items/32/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "01f7e898b2228c641a96135b46d26b76ebd38ccb2cc77194e679106c0154294a"
+          },
+          "conversion": {
+            "sourceId": "/items/32/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Teams call and vishing headline metrics for the selected period, with per-interval sparklines. Interim source: Defender for Cloud Apps call telemetry (CloudAppEvents / CallParticipantDetail).\r\nlet gran = {Granularity};\r\nlet calls = materialize(CloudAppEvents | where ActionType == \"CallParticipantDetail\" | extend R = parse_json(RawEventData) | extend CallId = tostring(R.CallId), UId = tolower(tostring(R.UserId)));\r\nlet susp = calls | extend Local = tostring(split(UId, \"@\")[0]), Dom = tostring(split(UId, \"@\")[1]) | where Local matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\" or Dom endswith \".onmicrosoft.com\";\r\nlet reported = CloudAppEvents | where ActionType == \"CallReported\";\r\nunion\r\n(calls | summarize Count = dcount(CallId) | extend Details = \"Teams Calls\", Ord = 1, Trend = toscalar(calls | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(susp | summarize Count = dcount(UId) | extend Details = \"Impersonation-style Callers\", Ord = 2, Trend = toscalar(susp | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(reported | summarize Count = count() | extend Details = \"Reported Suspicious Calls\", Ord = 3, Trend = toscalar(reported | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/32/content/items/1/content/query",
+          "sourceSha256": "01f7e898b2228c641a96135b46d26b76ebd38ccb2cc77194e679106c0154294a",
+          "targetSha256": "01f7e898b2228c641a96135b46d26b76ebd38ccb2cc77194e679106c0154294a"
+        },
+        {
+          "sourcePath": "/items/32/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "45ae98d1a73726b46e2511bc40a832e3d6d221c4c29c58d4a43fb54689e57a3c"
+          },
+          "conversion": {
+            "sourceId": "/items/32/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Distinct Teams calls per interval (interim source: CloudAppEvents / CallParticipantDetail).\r\nCloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId)\r\n| summarize ['Teams Calls'] = dcount(CallId) by Timestamp = bin(Timestamp, {Granularity})\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/32/content/items/3/content/query",
+          "sourceSha256": "45ae98d1a73726b46e2511bc40a832e3d6d221c4c29c58d4a43fb54689e57a3c",
+          "targetSha256": "45ae98d1a73726b46e2511bc40a832e3d6d221c4c29c58d4a43fb54689e57a3c"
+        },
+        {
+          "sourcePath": "/items/32/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "f7d325b8dc2aa51f9d96727937d73c8db51a5767cac539e81286497ec8653911"
+          },
+          "conversion": {
+            "sourceId": "/items/32/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Teams calls by start hour of day (UTC), all 24 hours 00:00..23:00 in order (interim source: CloudAppEvents / CallParticipantDetail).\r\nlet data = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend JoinTime = todatetime(R.JoinTime), CallId = tostring(R.CallId)\r\n| where isnotempty(JoinTime) and isnotempty(CallId)\r\n| summarize CallStart = min(JoinTime) by CallId\r\n| extend HourUTC = hourofday(CallStart)\r\n| summarize Calls = count() by HourUTC;\r\nrange HourUTC from 0 to 23 step 1\r\n| join kind=leftouter (data) on HourUTC\r\n| extend Calls = coalesce(Calls, 0)\r\n| extend HourLabel = strcat(iif(HourUTC < 10, strcat(\"0\", tostring(HourUTC)), tostring(HourUTC)), \":00\")\r\n| order by HourUTC asc\r\n| project ['Hour of Day (UTC)'] = HourLabel, ['Teams Calls'] = Calls",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/32/content/items/5/content/query",
+          "sourceSha256": "f7d325b8dc2aa51f9d96727937d73c8db51a5767cac539e81286497ec8653911",
+          "targetSha256": "f7d325b8dc2aa51f9d96727937d73c8db51a5767cac539e81286497ec8653911"
+        },
+        {
+          "sourcePath": "/items/32/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "adea6f30b1b69be99c7f0316549d391e7bcb33b5e633f0574119f2d9214996e1"
+          },
+          "conversion": {
+            "sourceId": "/items/32/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Suspicious Teams callers by impersonation-style DISPLAY NAME or address (Attendees[].DisplayName / UPN), with Origin from the org's own accepted (EmailEvents inbound) domains - no tenant-id anchor. Interim source: CloudAppEvents / CallParticipantDetail.\r\nlet suspRegex = @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\";\r\nlet ownDomains = toscalar(EmailEvents | where EmailDirection == \"Inbound\" | extend RD = tolower(tostring(split(RecipientEmailAddress, \"@\")[1])) | where isnotempty(RD) | summarize make_set(RD, 200));\r\nlet calls = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId), JoinTime = todatetime(R.JoinTime), Attendees = R.Attendees\r\n| where isnotempty(CallId);\r\nlet callAtt = calls | summarize Attendees = take_any(Attendees), JoinTime = min(JoinTime) by CallId;\r\ncallAtt\r\n| mv-expand Att = Attendees\r\n| extend Caller = tolower(tostring(Att.UPN)), CallerName = tostring(Att.DisplayName)\r\n| extend CallerDom = tostring(split(Caller, \"@\")[1])\r\n| where isnotempty(Caller)\r\n| extend SuspName = CallerName matches regex suspRegex or Caller matches regex suspRegex\r\n| where SuspName or CallerDom endswith \".onmicrosoft.com\"\r\n| extend Origin = case(CallerDom endswith \".onmicrosoft.com\", \"External (.onmicrosoft throwaway)\", set_has_element(ownDomains, CallerDom), \"Own tenant\", \"External\")\r\n| summarize CallsPlaced = dcount(CallId), FirstSeen = min(JoinTime), LastSeen = max(JoinTime) by CallerName, Caller, Origin\r\n| extend OriginRank = case(Origin == \"External (.onmicrosoft throwaway)\", 0, Origin == \"External\", 1, 2)\r\n| sort by OriginRank asc, CallsPlaced desc\r\n| take 10\r\n| project ['Caller Display Name'] = CallerName, ['Caller Address'] = Caller, ['Origin'] = Origin, ['Calls Placed'] = CallsPlaced, ['First Seen'] = FirstSeen, ['Last Seen'] = LastSeen",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/32/content/items/7/content/query",
+          "sourceSha256": "adea6f30b1b69be99c7f0316549d391e7bcb33b5e633f0574119f2d9214996e1",
+          "targetSha256": "adea6f30b1b69be99c7f0316549d391e7bcb33b5e633f0574119f2d9214996e1"
+        },
+        {
+          "sourcePath": "/items/33/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "f15fa2300c726b24caf7db43d4483d40bfa9c508dad7d012d13d0689566276dc"
+          },
+          "conversion": {
+            "sourceId": "/items/33/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nunion\r\n(imp | summarize Count=count() | extend Details=\"Impersonation Detections\", Ord=1),\r\n(imp | summarize Count=dcount(FakeSenderAddress) | extend Details=\"Distinct Fake Senders\", Ord=2),\r\n(imp | summarize Count=dcount(TargetUser) | extend Details=\"Targeted Users\", Ord=3),\r\n(imp | summarize Count=dcount(ImpersonationType) | extend Details=\"Impersonation Types\", Ord=4)\r\n| sort by Ord asc | project Count, Details",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/33/content/items/1/content/query",
+          "sourceSha256": "f15fa2300c726b24caf7db43d4483d40bfa9c508dad7d012d13d0689566276dc",
+          "targetSha256": "f15fa2300c726b24caf7db43d4483d40bfa9c508dad7d012d13d0689566276dc"
+        },
+        {
+          "sourcePath": "/items/33/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "e4967734b2d441e44f883920b0ec6cee9b07bcd3dd1722796181f6cc8d7b4a72"
+          },
+          "conversion": {
+            "sourceId": "/items/33/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Count=count() by ImpersonationType, Timestamp=bin(Timestamp, {Granularity}) | sort by Timestamp asc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/33/content/items/3/content/query",
+          "sourceSha256": "e4967734b2d441e44f883920b0ec6cee9b07bcd3dd1722796181f6cc8d7b4a72",
+          "targetSha256": "e4967734b2d441e44f883920b0ec6cee9b07bcd3dd1722796181f6cc8d7b4a72"
+        },
+        {
+          "sourcePath": "/items/33/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "da62afa3f1cca75722bef666f99f46a05ef7fda8f457f474bb01ca554ca4fd09"
+          },
+          "conversion": {
+            "sourceId": "/items/33/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//External Teams senders flagged as likely impersonation: throwaway .onmicrosoft.com tenants and/or help desk / IT / admin / update-themed display names, ranked by messages carrying a threat.\r\nMessageEvents\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \"@\")[1]))\r\n| extend IsOnMicrosoft = SenderDomain endswith \".onmicrosoft.com\"\r\n| extend SuspName = SenderDisplayName matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\"\r\n| where IsOnMicrosoft or SuspName\r\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\r\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \"Throwaway .onmicrosoft tenant + helpdesk-style name\", IsOnMicrosoft, \"Throwaway .onmicrosoft tenant\", \"Helpdesk / IT-style display name\")\r\n| extend ThreatPct = round(todouble(ThreatMessages) * 100 / TeamsMessages, 1)\r\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages, ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\r\n| sort by ['Threat Messages'] desc, ['Teams Messages'] desc\r\n| take 10",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/33/content/items/5/content/query",
+          "sourceSha256": "da62afa3f1cca75722bef666f99f46a05ef7fda8f457f474bb01ca554ca4fd09",
+          "targetSha256": "da62afa3f1cca75722bef666f99f46a05ef7fda8f457f474bb01ca554ca4fd09"
+        },
+        {
+          "sourcePath": "/items/33/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4d3ec85cc0801652beb4defc4e3777955efe5ec50549c942a5a385a9b752862e"
+          },
+          "conversion": {
+            "sourceId": "/items/33/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Distinct Fake Senders']=dcount(FakeSenderAddress), Types=make_set(ImpersonationType,3), ['Last Seen']=max(Timestamp) by ['Targeted User']=TargetUser | top 10 by Detections",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/33/content/items/7/content/query",
+          "sourceSha256": "4d3ec85cc0801652beb4defc4e3777955efe5ec50549c942a5a385a9b752862e",
+          "targetSha256": "4d3ec85cc0801652beb4defc4e3777955efe5ec50549c942a5a385a9b752862e"
+        },
+        {
+          "sourcePath": "/items/33/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "661bce15fae66ae69300a1fda934232c266282b027c5336106bc81493c8db7a5"
+          },
+          "conversion": {
+            "sourceId": "/items/33/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the identities behind Teams impersonation, grouped by the fake display name, sender domain, and impersonation type. Attackers rotate through many sending addresses under one display name, so Distinct Sender Addresses reveals bulk campaigns that per-address ranking would hide.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp\r\n| summarize Detections=count(), SenderAddresses=dcount(FakeSenderAddress), Targets=dcount(TargetUser), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by FakeDisplayName, FakeSenderDomain, ImpersonationType\r\n| top 10 by Detections\r\n| project ['Fake Display Name']=FakeDisplayName, ['Sender Domain']=FakeSenderDomain, ['Impersonation Type']=ImpersonationType, ['Distinct Sender Addresses']=SenderAddresses, Detections, ['Targeted Users']=Targets, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/33/content/items/9/content/query",
+          "sourceSha256": "661bce15fae66ae69300a1fda934232c266282b027c5336106bc81493c8db7a5",
+          "targetSha256": "661bce15fae66ae69300a1fda934232c266282b027c5336106bc81493c8db7a5"
+        },
+        {
+          "sourcePath": "/items/33/content/items/11/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "9aa119251148521f6bf62b87e883cb0d526be3da9dff9369bb312a8b9b8038fa"
+          },
+          "conversion": {
+            "sourceId": "/items/33/content/items/11/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Distinct Senders']=dcount(FakeSenderAddress) by ['Fake Display Name']=FakeDisplayName | top 10 by Detections",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/33/content/items/11/content/query",
+          "sourceSha256": "9aa119251148521f6bf62b87e883cb0d526be3da9dff9369bb312a8b9b8038fa",
+          "targetSha256": "9aa119251148521f6bf62b87e883cb0d526be3da9dff9369bb312a8b9b8038fa"
+        },
+        {
+          "sourcePath": "/items/33/content/items/13/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "200ad476ad60916ec0c869e71215911864f3e643c551fe8c5f061b783620c30f"
+          },
+          "conversion": {
+            "sourceId": "/items/33/content/items/13/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\r\n         FakeSenderAddress = tostring(RD.Sender.UPN),\r\n         ChatThreadId      = tostring(RD.ChatThreadId),\r\n         TargetUser        = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Display Names Used']=dcount(FakeDisplayName) by ['Sender Domain']=FakeSenderDomain | top 10 by Detections",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/33/content/items/13/content/query",
+          "sourceSha256": "200ad476ad60916ec0c869e71215911864f3e643c551fe8c5f061b783620c30f",
+          "targetSha256": "200ad476ad60916ec0c869e71215911864f3e643c551fe8c5f061b783620c30f"
+        },
+        {
+          "sourcePath": "/items/33/content/items/15/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "987795e44176c715791378d800d09c992d12ec43b3c5821dacdabb5729189bc3"
+          },
+          "conversion": {
+            "sourceId": "/items/33/content/items/15/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists URL domains that appeared in messages sent by impersonating senders, with a breakdown of how many carried Malware, Phish, or Spam verdicts. Threat actors mix legitimate and malicious domains in a single lure, so review the unfamiliar or look-alike domains and block only confirmed-malicious ones.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ChatThreadId = tostring(RD.ChatThreadId);\r\nlet impThreads = imp | distinct ChatThreadId;\r\nlet impMsgs = MessageEvents\r\n    | where ThreadId in (impThreads)\r\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n    | project TeamsMessageId, ThreatTypes;\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| join kind=inner (impMsgs) on TeamsMessageId\r\n| summarize ['URL Count']=count(), Messages=dcount(TeamsMessageId), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by ['URL Domain']=UrlDomain\r\n| top 10 by ['URL Count']",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "MessageEvents",
+              "MessageUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              },
+              {
+                "sentinelTable": "MessageUrlInfo",
+                "ahTable": "MessageUrlInfo",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/33/content/items/15/content/query",
+          "sourceSha256": "987795e44176c715791378d800d09c992d12ec43b3c5821dacdabb5729189bc3",
+          "targetSha256": "987795e44176c715791378d800d09c992d12ec43b3c5821dacdabb5729189bc3"
+        },
+        {
+          "sourcePath": "/items/34/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "de4a3cd15b54b7bc12fceea891f3299f9d34e1ac844bcec0579f42f31b1f608a"
+          },
+          "conversion": {
+            "sourceId": "/items/34/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query surfaces Microsoft Teams URL-sharing and link-warning metrics for the selected period. URL-warning messages carry the Microsoft Defender for Office 365 URL safety tip.\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nunion\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 1),\r\n(MessageUrlInfo | summarize Count = count() | extend Details = \"URLs Shared in Messages\", Ord = 2),\r\n(MessageUrlInfo | summarize Count = dcount(TeamsMessageId) | extend Details = \"Messages Containing URLs\", Ord = 3),\r\n(MessageUrlInfo | summarize Count = dcount(UrlDomain) | extend Details = \"Distinct URL Domains\", Ord = 4)\r\n| sort by Ord asc\r\n| project Count, Details",
+            "resolvedTables": [
+              "MessageEvents",
+              "MessageUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              },
+              {
+                "sentinelTable": "MessageUrlInfo",
+                "ahTable": "MessageUrlInfo",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/34/content/items/1/content/query",
+          "sourceSha256": "de4a3cd15b54b7bc12fceea891f3299f9d34e1ac844bcec0579f42f31b1f608a",
+          "targetSha256": "de4a3cd15b54b7bc12fceea891f3299f9d34e1ac844bcec0579f42f31b1f608a"
+        },
+        {
+          "sourcePath": "/items/34/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c8b131c029c45551133d982f401722e3b74a3c7c21d34a1d6825bab48599ad96"
+          },
+          "conversion": {
+            "sourceId": "/items/34/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises Microsoft Teams URL click outcomes over time (allowed vs blocked) using the UrlClickEvents workload filter, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(UrlClickEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(UrlClickEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where Workload == \"Teams\"\r\n| summarize ClickAllowed = countif(ActionType has \"ClickAllowed\"), ClickBlocked = countif(ActionType has \"ClickBlocked\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickAllowed = coalesce(ClickAllowed, 0), ClickBlocked = coalesce(ClickBlocked, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/34/content/items/4/content/query",
+          "sourceSha256": "c8b131c029c45551133d982f401722e3b74a3c7c21d34a1d6825bab48599ad96",
+          "targetSha256": "c8b131c029c45551133d982f401722e3b74a3c7c21d34a1d6825bab48599ad96"
+        },
+        {
+          "sourcePath": "/items/34/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "6204df8da919ae7f5bd8f4e048027dad32c967701d8b6e1e34e0ab741503f1e4"
+          },
+          "conversion": {
+            "sourceId": "/items/34/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows Microsoft Teams URL click outcomes by action type for the selected period.\r\nUrlClickEvents\r\n| where Workload == \"Teams\"\r\n| where isnotempty(ActionType)\r\n| summarize Count = count() by ActionType",
+            "resolvedTables": [
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/34/content/items/5/content/query",
+          "sourceSha256": "6204df8da919ae7f5bd8f4e048027dad32c967701d8b6e1e34e0ab741503f1e4",
+          "targetSha256": "6204df8da919ae7f5bd8f4e048027dad32c967701d8b6e1e34e0ab741503f1e4"
+        },
+        {
+          "sourcePath": "/items/34/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "36ec75051923aaa5623d7d1a4b2d36e0e93f54392269c6d32de58db718c0866a"
+          },
+          "conversion": {
+            "sourceId": "/items/34/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 URL domains shared in Microsoft Teams messages by volume for the selected period.\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| summarize UrlCount = count(), Messages = dcount(TeamsMessageId) by UrlDomain\r\n| top 10 by UrlCount\r\n| project ['URL Domain']=UrlDomain, ['URLs Shared']=UrlCount, ['Messages']=Messages",
+            "resolvedTables": [
+              "MessageUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageUrlInfo",
+                "ahTable": "MessageUrlInfo",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/34/content/items/7/content/query",
+          "sourceSha256": "36ec75051923aaa5623d7d1a4b2d36e0e93f54392269c6d32de58db718c0866a",
+          "targetSha256": "36ec75051923aaa5623d7d1a4b2d36e0e93f54392269c6d32de58db718c0866a"
+        },
+        {
+          "sourcePath": "/items/35/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "62029ecfef97ec15504028257c2a5d2f94ce8a1d9764529436f166426143fd61"
+          },
+          "conversion": {
+            "sourceId": "/items/35/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 users receiving Microsoft Teams messages that contained a threat, expanded from the message recipient list, with each user's total Teams messages received and the share that carried a threat. Messages are de-duplicated to the latest record per message.\r\nlet expanded = MessageEvents\r\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n    | mv-expand rd = parse_json(RecipientDetails)\r\n    | extend Recipient = tostring(rd.RecipientSmtpAddress)\r\n    | where isnotempty(Recipient);\r\nlet totals = expanded | summarize TotalMessages = count() by Recipient;\r\nexpanded\r\n| where isnotempty(ThreatTypes)\r\n| summarize ThreatMessages = count() by Recipient\r\n| join kind=leftouter (totals) on Recipient\r\n| extend ThreatPct = round(100.0 * ThreatMessages / TotalMessages, 1)\r\n| top 10 by ThreatMessages\r\n| project ['Recipient']=Recipient, ['Threat Messages']=ThreatMessages, ['Total Messages']=TotalMessages, ['Threat %']=ThreatPct",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/35/content/items/2/content/query",
+          "sourceSha256": "62029ecfef97ec15504028257c2a5d2f94ce8a1d9764529436f166426143fd61",
+          "targetSha256": "62029ecfef97ec15504028257c2a5d2f94ce8a1d9764529436f166426143fd61"
+        },
+        {
+          "sourcePath": "/items/35/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "dffcadfd238a9e7b7648a27145cc7af9367c36cac839e2a0d4d5da8f0429a048"
+          },
+          "conversion": {
+            "sourceId": "/items/35/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 senders whose Microsoft Teams messages triggered a URL safety-tip warning for the selected period, with each sender's total Teams messages and the share that carried a warning. Messages are de-duplicated to the latest record per message.\r\nlet dedup = MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nlet totals = dedup | summarize TotalMessages = count() by SenderEmailAddress;\r\ndedup\r\n| where SafetyTip == \"URLMessageWarning\"\r\n| summarize WarningMessages = count() by SenderEmailAddress\r\n| join kind=leftouter (totals) on SenderEmailAddress\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/35/content/items/5/content/query",
+          "sourceSha256": "dffcadfd238a9e7b7648a27145cc7af9367c36cac839e2a0d4d5da8f0429a048",
+          "targetSha256": "dffcadfd238a9e7b7648a27145cc7af9367c36cac839e2a0d4d5da8f0429a048"
+        },
+        {
+          "sourcePath": "/items/35/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "d6b04c158fd6f88e4f82f99f6e2b0ab2819bdef7f05cabd7eedb790785f672ef"
+          },
+          "conversion": {
+            "sourceId": "/items/35/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 URL domains appearing in Microsoft Teams messages that triggered a URL safety-tip warning, with the domain's total message appearances and the share that carried a warning.\r\nlet warned = MessageEvents | where SafetyTip == \"URLMessageWarning\" | distinct TeamsMessageId;\r\nlet totals = MessageUrlInfo | where isnotempty(UrlDomain) | summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;\r\nMessageUrlInfo\r\n| where TeamsMessageId in (warned)\r\n| summarize WarningMessages = dcount(TeamsMessageId) by UrlDomain\r\n| join kind=leftouter (totals) on UrlDomain\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['URL Domain']=UrlDomain, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct",
+            "resolvedTables": [
+              "MessageEvents",
+              "MessageUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              },
+              {
+                "sentinelTable": "MessageUrlInfo",
+                "ahTable": "MessageUrlInfo",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/35/content/items/6/content/query",
+          "sourceSha256": "d6b04c158fd6f88e4f82f99f6e2b0ab2819bdef7f05cabd7eedb790785f672ef",
+          "targetSha256": "d6b04c158fd6f88e4f82f99f6e2b0ab2819bdef7f05cabd7eedb790785f672ef"
+        },
+        {
+          "sourcePath": "/items/35/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "95180a15fb5a1004fcd60cd3fe6ba3b87f78e527c750d1d34c9dd1479c5b7bca"
+          },
+          "conversion": {
+            "sourceId": "/items/35/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists external Microsoft Teams senders by the date they were first seen in the selected period, surfacing recent first-contact senders. Messages are de-duplicated to the latest record per message. In tenants with longer history this highlights genuinely new senders.\r\n// TIP: IsExternalThread may still surface senders from your own accepted domains. To hide them,\r\n// uncomment the ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n//| where tostring(split(SenderEmailAddress, \"@\")[1]) !in~ (ExcludeDomains)\r\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\r\n| top 10 by FirstSeen desc\r\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/35/content/items/8/content/query",
+          "sourceSha256": "95180a15fb5a1004fcd60cd3fe6ba3b87f78e527c750d1d34c9dd1479c5b7bca",
+          "targetSha256": "95180a15fb5a1004fcd60cd3fe6ba3b87f78e527c750d1d34c9dd1479c5b7bca"
+        },
+        {
+          "sourcePath": "/items/35/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "a4b746884de5bb6d00bda9112992bd181df314fcbd1fc660bf27f346bc48659f"
+          },
+          "conversion": {
+            "sourceId": "/items/35/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query ranks external sender domains in Microsoft Teams by threat volume for the selected period, split by conversation type (1:1 chat, group chat, channel), with threat-type breakdown, threat rate, and a count of messages carrying low-reputation URL TLDs. Messages are de-duplicated to the latest record per message. New, 1:1-skewed, or high-threat-rate domains are the anomalies to review.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n    | where isnotempty(UrlDomain)\r\n    | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n    | where Tld in (suspTlds)\r\n    | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\"), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages > 0\r\n| extend ThreatRatePct = round(100.0 * ThreatMessages / Messages, 1)\r\n| top 10 by ThreatMessages desc\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Threat Msgs']=ThreatMessages, Malware, Phish, Spam, ['Threat Rate %']=ThreatRatePct, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+            "resolvedTables": [
+              "MessageEvents",
+              "MessageUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              },
+              {
+                "sentinelTable": "MessageUrlInfo",
+                "ahTable": "MessageUrlInfo",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/35/content/items/10/content/query",
+          "sourceSha256": "a4b746884de5bb6d00bda9112992bd181df314fcbd1fc660bf27f346bc48659f",
+          "targetSha256": "a4b746884de5bb6d00bda9112992bd181df314fcbd1fc660bf27f346bc48659f"
+        },
+        {
+          "sourcePath": "/items/35/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "f2a08f578478be075836e68925004bcec49cde95c39255ae9e47d528567de15a"
+          },
+          "conversion": {
+            "sourceId": "/items/35/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query surfaces external sender domains in Microsoft Teams that have NO threat verdict yet but are sending messages with low-reputation URL TLDs or unusual volume, split by conversation type. These are early-warning senders that have not tripped a detection. Messages are de-duplicated to the latest record per message.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n    | where isnotempty(UrlDomain)\r\n    | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n    | where Tld in (suspTlds)\r\n    | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages == 0\r\n| where SuspUrlMsgs > 0 or Messages >= 5\r\n| order by SuspUrlMsgs desc, Messages desc\r\n| take 10\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+            "resolvedTables": [
+              "MessageEvents",
+              "MessageUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              },
+              {
+                "sentinelTable": "MessageUrlInfo",
+                "ahTable": "MessageUrlInfo",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/35/content/items/12/content/query",
+          "sourceSha256": "f2a08f578478be075836e68925004bcec49cde95c39255ae9e47d528567de15a",
+          "targetSha256": "f2a08f578478be075836e68925004bcec49cde95c39255ae9e47d528567de15a"
+        },
+        {
+          "sourcePath": "/items/35/content/items/14/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "9481873a44f8ed6dfbf0fd5482557b2162572334750bd1d4a742f46c0109f2b5"
+          },
+          "conversion": {
+            "sourceId": "/items/35/content/items/14/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists URL domains shared in Microsoft Teams that use low-reputation TLDs commonly abused for phishing and malware, ranked by the number of Teams messages they appeared in, with first- and last-seen. Treat high-reach or newly-seen domains as candidate indicators of compromise.\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n| where Tld in (suspTlds)\r\n| summarize Messages=dcount(TeamsMessageId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ['URL Domain']=UrlDomain, ['TLD']=Tld\r\n| top 10 by Messages desc",
+            "resolvedTables": [
+              "MessageUrlInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageUrlInfo",
+                "ahTable": "MessageUrlInfo",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/35/content/items/14/content/query",
+          "sourceSha256": "9481873a44f8ed6dfbf0fd5482557b2162572334750bd1d4a742f46c0109f2b5",
+          "targetSha256": "9481873a44f8ed6dfbf0fd5482557b2162572334750bd1d4a742f46c0109f2b5"
+        },
+        {
+          "sourcePath": "/items/36/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "4b63c2185466fb2c0dbb2ac9cf40db7e8cc9937e1fe634739b699730519de15f"
+          },
+          "conversion": {
+            "sourceId": "/items/36/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection - for the selected period.\r\nlet base = FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\";\r\nunion\r\n(base | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files Scanned - No Detection\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/36/content/items/1/content/query",
+          "sourceSha256": "4b63c2185466fb2c0dbb2ac9cf40db7e8cc9937e1fe634739b699730519de15f",
+          "targetSha256": "4b63c2185466fb2c0dbb2ac9cf40db7e8cc9937e1fe634739b699730519de15f"
+        },
+        {
+          "sourcePath": "/items/36/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "dcb287d16b575c18bc08e9b93108034de2a21143f6c2cffc4d6afb357f0467c9"
+          },
+          "conversion": {
+            "sourceId": "/items/36/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365 for the selected period.\r\nFileMaliciousContentInfo\r\n| where Workload == \"MicrosoftTeams\"\r\n| where isnotempty(ThreatTypes)\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/36/content/items/3/content/query",
+          "sourceSha256": "dcb287d16b575c18bc08e9b93108034de2a21143f6c2cffc4d6afb357f0467c9",
+          "targetSha256": "dcb287d16b575c18bc08e9b93108034de2a21143f6c2cffc4d6afb357f0467c9"
+        },
+        {
+          "sourcePath": "/items/37/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "d56012dfdfeab7ea980d7397bb06f4dc4f525632b6e855c3f630cb3bdfe53004"
+          },
+          "conversion": {
+            "sourceId": "/items/37/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query summarizes Microsoft Teams post-delivery ZAP (zero-hour auto purge) activity by Microsoft Defender for Office 365 for the selected period.\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(zap | summarize Count = count() | extend Details = \"Total ZAP Actions\", Ord = 1),\r\n(zap | where ActionType == \"Malware ZAP\" | summarize Count = count() | extend Details = \"Malware ZAP\", Ord = 2),\r\n(zap | where ActionType == \"Phish ZAP\" | summarize Count = count() | extend Details = \"Phish ZAP\", Ord = 3),\r\n(zap | where ActionResult == \"Success\" | summarize Count = count() | extend Details = \"Successful Actions\", Ord = 4),\r\n(zap | where ActionResult == \"Failed\" | summarize Count = count() | extend Details = \"Failed Actions\", Ord = 5),\r\n(zap | where Action == \"Moved to quarantine\" | summarize Count = count() | extend Details = \"Moved to Quarantine\", Ord = 6)\r\n| sort by Ord asc\r\n| project Count, Details",
+            "resolvedTables": [
+              "MessagePostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessagePostDeliveryEvents",
+                "ahTable": "MessagePostDeliveryEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/37/content/items/1/content/query",
+          "sourceSha256": "d56012dfdfeab7ea980d7397bb06f4dc4f525632b6e855c3f630cb3bdfe53004",
+          "targetSha256": "d56012dfdfeab7ea980d7397bb06f4dc4f525632b6e855c3f630cb3bdfe53004"
+        },
+        {
+          "sourcePath": "/items/37/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "b2e02ff93ae4800c4296fa4e53f2e91f2124a861d267f8c3f37eeac9bf1406f0"
+          },
+          "conversion": {
+            "sourceId": "/items/37/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises Microsoft Teams post-delivery ZAP actions over time by ZAP type, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessagePostDeliveryEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessagePostDeliveryEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessagePostDeliveryEvents\r\n| summarize MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareZAP = coalesce(MalwareZAP, 0), PhishZAP = coalesce(PhishZAP, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "MessagePostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessagePostDeliveryEvents",
+                "ahTable": "MessagePostDeliveryEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/37/content/items/4/content/query",
+          "sourceSha256": "b2e02ff93ae4800c4296fa4e53f2e91f2124a861d267f8c3f37eeac9bf1406f0",
+          "targetSha256": "b2e02ff93ae4800c4296fa4e53f2e91f2124a861d267f8c3f37eeac9bf1406f0"
+        },
+        {
+          "sourcePath": "/items/37/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "6797ba254b49a324742a1644fa0f7b25f1ca5ec2dbcc89de72f01557f3fa6e51"
+          },
+          "conversion": {
+            "sourceId": "/items/37/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows Microsoft Teams post-delivery ZAP actions by type for the selected period.\r\nMessagePostDeliveryEvents\r\n| summarize Count = count() by ActionType",
+            "resolvedTables": [
+              "MessagePostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessagePostDeliveryEvents",
+                "ahTable": "MessagePostDeliveryEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/37/content/items/5/content/query",
+          "sourceSha256": "6797ba254b49a324742a1644fa0f7b25f1ca5ec2dbcc89de72f01557f3fa6e51",
+          "targetSha256": "6797ba254b49a324742a1644fa0f7b25f1ca5ec2dbcc89de72f01557f3fa6e51"
+        },
+        {
+          "sourcePath": "/items/37/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "5b242c6518220d383b9aaf3c3c322115b22b7599436fa6aa50afb33584cd5ca7"
+          },
+          "conversion": {
+            "sourceId": "/items/37/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 senders whose Microsoft Teams messages were removed by post-delivery ZAP for the selected period.\r\nMessagePostDeliveryEvents\r\n| where isnotempty(SenderEmailAddress)\r\n| summarize ZapActions = count(), MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by SenderEmailAddress\r\n| top 10 by ZapActions\r\n| project ['Sender']=SenderEmailAddress, ['ZAP Actions']=ZapActions, ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP",
+            "resolvedTables": [
+              "MessagePostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessagePostDeliveryEvents",
+                "ahTable": "MessagePostDeliveryEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/37/content/items/7/content/query",
+          "sourceSha256": "5b242c6518220d383b9aaf3c3c322115b22b7599436fa6aa50afb33584cd5ca7",
+          "targetSha256": "5b242c6518220d383b9aaf3c3c322115b22b7599436fa6aa50afb33584cd5ca7"
+        },
+        {
+          "sourcePath": "/items/38/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "74c47338b18595934a5cd4d8876022224fd7af6ac94bd7800a49d61c645afbcb"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query summarizes Microsoft Teams message and call submissions reported to Microsoft for the selected period, split by user and admin reports. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nunion\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Messages Reported by Users\", Ord = 1),\r\n(sub | where SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Calls Reported by Users\", Ord = 2),\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\" | summarize Count = count() | extend Details = \"Messages Submitted by Admins\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/1/content/query",
+          "sourceSha256": "74c47338b18595934a5cd4d8876022224fd7af6ac94bd7800a49d61c645afbcb",
+          "targetSha256": "74c47338b18595934a5cd4d8876022224fd7af6ac94bd7800a49d61c645afbcb"
+        },
+        {
+          "sourcePath": "/items/38/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "6afdeb4bbcf6ec7dab9d2f4a84fad1abc3b552b5228a31eb14a60f5e6ec0e6ee"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises Microsoft Teams message and call submissions over time, summarizing the data per selected interval. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet gran = {Granularity};\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nlet minTime = toscalar(sub | summarize min(Timestamp));\r\nlet maxTime = toscalar(sub | summarize max(Timestamp));\r\nlet agg = materialize(sub\r\n| summarize UserReports = countif(ActionType == \"UserSubmission\"), AdminReports = countif(ActionType == \"AdminSubmission\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, UserReports = coalesce(UserReports, 0), AdminReports = coalesce(AdminReports, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/4/content/query",
+          "sourceSha256": "6afdeb4bbcf6ec7dab9d2f4a84fad1abc3b552b5228a31eb14a60f5e6ec0e6ee",
+          "targetSha256": "6afdeb4bbcf6ec7dab9d2f4a84fad1abc3b552b5228a31eb14a60f5e6ec0e6ee"
+        },
+        {
+          "sourcePath": "/items/38/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "d5f5be5c1701660a6b52e02e0a43917c49bed7cc2745efdb9436e3b7ca68aebd"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows the mix of Microsoft Teams submissions by content type and reporter for the selected period. Only completed user submissions (chat and call) and admin submissions (chat) are counted; submission triage/timeout lifecycle records are excluded.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\"\r\n| where (SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\")\r\n    or (SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\")\r\n    or (SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\")\r\n| extend Reporter = iif(ActionType == \"AdminSubmission\", \"Admin\", \"User\")\r\n| summarize Count = count() by SubmissionType = strcat(SubmissionContentType, \" (\", Reporter, \")\")",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/5/content/query",
+          "sourceSha256": "d5f5be5c1701660a6b52e02e0a43917c49bed7cc2745efdb9436e3b7ca68aebd",
+          "targetSha256": "d5f5be5c1701660a6b52e02e0a43917c49bed7cc2745efdb9436e3b7ca68aebd"
+        },
+        {
+          "sourcePath": "/items/38/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "20e3b3ec8989478391f8c351684f4697b1865b0cce1f6b155f62529395a26344"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows Microsoft Teams user (false negative) message submissions by submission state (for example Rescaned, Graded), to track processing status.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend SubmissionState = tostring(RD.SubmissionState)\r\n| summarize Count = count() by tostring(SubmissionState)",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/8/content/query",
+          "sourceSha256": "20e3b3ec8989478391f8c351684f4697b1865b0cce1f6b155f62529395a26344",
+          "targetSha256": "20e3b3ec8989478391f8c351684f4697b1865b0cce1f6b155f62529395a26344"
+        },
+        {
+          "sourcePath": "/items/38/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0acd8c2aa4ba1955856bf9c4c749ddee5d172f2f6d549331427e5e7ea4978fd6"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows Microsoft Teams user (false negative) message submissions by the triage verdict assigned during grading (for example Phishing, NotSpam, Spam).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend TriageVerdict = tostring(parse_json(tostring(RD.GradingResult)).TriageVerdict)\r\n| where isnotempty(TriageVerdict)\r\n| summarize Count = count() by TriageVerdict",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/9/content/query",
+          "sourceSha256": "0acd8c2aa4ba1955856bf9c4c749ddee5d172f2f6d549331427e5e7ea4978fd6",
+          "targetSha256": "0acd8c2aa4ba1955856bf9c4c749ddee5d172f2f6d549331427e5e7ea4978fd6"
+        },
+        {
+          "sourcePath": "/items/38/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "04d009f7216f66a76abb64250089d8989722f096714424cc35cb7b9e3c1590bf"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 P2 (envelope) sender domains of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2SenderDomain = tostring(RD.P2SenderDomain)\r\n| where isnotempty(P2SenderDomain)\r\n| summarize Submissions = count() by ['P2 Sender Domain']=P2SenderDomain\r\n| top 10 by Submissions",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/12/content/query",
+          "sourceSha256": "04d009f7216f66a76abb64250089d8989722f096714424cc35cb7b9e3c1590bf",
+          "targetSha256": "04d009f7216f66a76abb64250089d8989722f096714424cc35cb7b9e3c1590bf"
+        },
+        {
+          "sourcePath": "/items/38/content/items/13/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "d9fc4429458d6768986d75534c7e5b287febb131f98df1013b36157ec0453cdf"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/13/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 individual P2 (envelope) senders of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2Sender = tostring(RD.P2Sender)\r\n| where isnotempty(P2Sender)\r\n| summarize Submissions = count() by ['P2 Sender']=P2Sender\r\n| top 10 by Submissions",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/13/content/query",
+          "sourceSha256": "d9fc4429458d6768986d75534c7e5b287febb131f98df1013b36157ec0453cdf",
+          "targetSha256": "d9fc4429458d6768986d75534c7e5b287febb131f98df1013b36157ec0453cdf"
+        },
+        {
+          "sourcePath": "/items/38/content/items/16/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "2b779b661ef05861dc698417ce4c3ace11bf5e24c7112b669570d79957640189"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/16/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 users who reported the most Microsoft Teams messages as false negatives (missed detections), with each submitter's email (from the submission record) to disambiguate users with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterEmail = tostring(RD.UserId)\r\n| where isnotempty(Submitter) and SubmitterEmail has \"@\"\r\n| summarize Submissions = count() by ['Submitter']=Submitter, ['Email']=SubmitterEmail\r\n| top 10 by Submissions",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/16/content/query",
+          "sourceSha256": "2b779b661ef05861dc698417ce4c3ace11bf5e24c7112b669570d79957640189",
+          "targetSha256": "2b779b661ef05861dc698417ce4c3ace11bf5e24c7112b669570d79957640189"
+        },
+        {
+          "sourcePath": "/items/38/content/items/17/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "97fd2970619fa0b5a172a616deaa5a9f27f21eab634de028226e1114c1adfefa"
+          },
+          "conversion": {
+            "sourceId": "/items/38/content/items/17/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the top 10 admins who submitted the most Microsoft Teams messages as false negatives (missed detections). The admin's own email is not present in the submission record (that would require the Identity table), so the Submitter ID (object GUID) is shown to disambiguate admins with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"AdminSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterId = tostring(RD.SubmitterId)\r\n| where isnotempty(Submitter)\r\n| summarize Submissions = count() by ['Admin']=Submitter, ['Submitter ID']=SubmitterId\r\n| top 10 by Submissions",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/38/content/items/17/content/query",
+          "sourceSha256": "97fd2970619fa0b5a172a616deaa5a9f27f21eab634de028226e1114c1adfefa",
+          "targetSha256": "97fd2970619fa0b5a172a616deaa5a9f27f21eab634de028226e1114c1adfefa"
+        },
+        {
+          "sourcePath": "/items/39/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "0fb110cc01724b5f264e5aaa5c0a3e6b4be6050260a6e29a9a0d2c7fe21ed919"
+          },
+          "conversion": {
+            "sourceId": "/items/39/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/39/content/items/2/content/query",
+          "sourceSha256": "0fb110cc01724b5f264e5aaa5c0a3e6b4be6050260a6e29a9a0d2c7fe21ed919",
+          "targetSha256": "0fb110cc01724b5f264e5aaa5c0a3e6b4be6050260a6e29a9a0d2c7fe21ed919"
+        },
+        {
+          "sourcePath": "/items/39/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "4b9639f39ccb32743e168a2b1d02e8703a134387a8f8e80a368b383c8f831333"
+          },
+          "conversion": {
+            "sourceId": "/items/39/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId",
+            "resolvedTables": [
+              "MessageEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "MessageEvents",
+                "ahTable": "MessageEvents",
+                "identical": null,
+                "columnRenames": {},
+                "note": "no cached schema for either side; catalog renames only"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/39/content/items/4/content/query",
+          "sourceSha256": "4b9639f39ccb32743e168a2b1d02e8703a134387a8f8e80a368b383c8f831333",
+          "targetSha256": "4b9639f39ccb32743e168a2b1d02e8703a134387a8f8e80a368b383c8f831333"
+        },
+        {
+          "sourcePath": "/items/41/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "9d59f8c46ce5618c306f4f088c16dcdfa3d0640dea57a088b167b93dd2a8ea24"
+          },
+          "conversion": {
+            "sourceId": "/items/41/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 users that are receiving Spam, Phishing or Malware emails\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by RecipientEmailAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by ThreatEmailCount\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/41/content/items/2/content/query",
+          "sourceSha256": "9d59f8c46ce5618c306f4f088c16dcdfa3d0640dea57a088b167b93dd2a8ea24",
+          "targetSha256": "9d59f8c46ce5618c306f4f088c16dcdfa3d0640dea57a088b167b93dd2a8ea24"
+        },
+        {
+          "sourcePath": "/items/41/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ac961ffab2badfb22671c80ef61f1487dcf566403fc4dce05933d1e41062b334"
+          },
+          "conversion": {
+            "sourceId": "/items/41/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by SenderFromAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender']=SenderFromAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/41/content/items/4/content/query",
+          "sourceSha256": "ac961ffab2badfb22671c80ef61f1487dcf566403fc4dce05933d1e41062b334",
+          "targetSha256": "ac961ffab2badfb22671c80ef61f1487dcf566403fc4dce05933d1e41062b334"
+        },
+        {
+          "sourcePath": "/items/41/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "fceefa84bd5d3373ad7b9ec5550c32752c299351566c94db662127b239a08d89"
+          },
+          "conversion": {
+            "sourceId": "/items/41/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where  OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by SenderFromDomain\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/41/content/items/6/content/query",
+          "sourceSha256": "fceefa84bd5d3373ad7b9ec5550c32752c299351566c94db662127b239a08d89",
+          "targetSha256": "fceefa84bd5d3373ad7b9ec5550c32752c299351566c94db662127b239a08d89"
+        },
+        {
+          "sourcePath": "/items/42/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5e0116bf9f5d0bc3393442882c18bcbcb7c7de3552a08ca36ca34e74b571b4ca"
+          },
+          "conversion": {
+            "sourceId": "/items/42/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises automatic email forwarding to external email addresses by forwarding type\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize count() by ForwardingType\r\n| sort by count_ desc \r\n",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/42/content/items/3/content/query",
+          "sourceSha256": "5e0116bf9f5d0bc3393442882c18bcbcb7c7de3552a08ca36ca34e74b571b4ca",
+          "targetSha256": "5e0116bf9f5d0bc3393442882c18bcbcb7c7de3552a08ca36ca34e74b571b4ca"
+        },
+        {
+          "sourcePath": "/items/42/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7dbef8b884dd43cc125e9c117b67264abeaae9d61cfd118b9d6716b4651bafad"
+          },
+          "conversion": {
+            "sourceId": "/items/42/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| sort by TotalForwardedMessages desc \r\n| top 10 by TotalForwardedMessages\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\r\n\r\n",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/42/content/items/4/content/query",
+          "sourceSha256": "7dbef8b884dd43cc125e9c117b67264abeaae9d61cfd118b9d6716b4651bafad",
+          "targetSha256": "7dbef8b884dd43cc125e9c117b67264abeaae9d61cfd118b9d6716b4651bafad"
+        },
+        {
+          "sourcePath": "/items/42/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "17f3884ff63e526609f3cf6853e35fae3eb67888c3b17c22d44641353f4c1886"
+          },
+          "conversion": {
+            "sourceId": "/items/42/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/42/content/items/6/content/query",
+          "sourceSha256": "17f3884ff63e526609f3cf6853e35fae3eb67888c3b17c22d44641353f4c1886",
+          "targetSha256": "17f3884ff63e526609f3cf6853e35fae3eb67888c3b17c22d44641353f4c1886"
+        },
+        {
+          "sourcePath": "/items/42/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0051da9da84fd58c4227dfa6801a0fc16a44d77c2e336d0b1aad7995862f15bf"
+          },
+          "conversion": {
+            "sourceId": "/items/42/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 external domains who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/42/content/items/9/content/query",
+          "sourceSha256": "0051da9da84fd58c4227dfa6801a0fc16a44d77c2e336d0b1aad7995862f15bf",
+          "targetSha256": "0051da9da84fd58c4227dfa6801a0fc16a44d77c2e336d0b1aad7995862f15bf"
+        },
+        {
+          "sourcePath": "/items/42/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "63f1fbdcafb468c66e1febf1482a7f3463d594eeb4394214aafb0e20b6df5551"
+          },
+          "conversion": {
+            "sourceId": "/items/42/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/42/content/items/10/content/query",
+          "sourceSha256": "63f1fbdcafb468c66e1febf1482a7f3463d594eeb4394214aafb0e20b6df5551",
+          "targetSha256": "63f1fbdcafb468c66e1febf1482a7f3463d594eeb4394214aafb0e20b6df5551"
+        },
+        {
+          "sourcePath": "/items/42/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7a240719dc0518ec4cd9fbb8458bdba5043dc188e73ccc4079238ff38a3f5ded"
+          },
+          "conversion": {
+            "sourceId": "/items/42/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize count() by ForwardingUser\r\n| top 10 by count_ desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=count_",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/42/content/items/12/content/query",
+          "sourceSha256": "7a240719dc0518ec4cd9fbb8458bdba5043dc188e73ccc4079238ff38a3f5ded",
+          "targetSha256": "7a240719dc0518ec4cd9fbb8458bdba5043dc188e73ccc4079238ff38a3f5ded"
+        },
+        {
+          "sourcePath": "/items/42/content/items/15/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "f419065f15e2b1933db7f5ad38dcbc907dc999bbe3c10400a02732e1b85ef9e9"
+          },
+          "conversion": {
+            "sourceId": "/items/42/content/items/15/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/42/content/items/15/content/query",
+          "sourceSha256": "f419065f15e2b1933db7f5ad38dcbc907dc999bbe3c10400a02732e1b85ef9e9",
+          "targetSha256": "f419065f15e2b1933db7f5ad38dcbc907dc999bbe3c10400a02732e1b85ef9e9"
+        },
+        {
+          "sourcePath": "/items/42/content/items/16/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4e4912f05c0a6b730d36f0571fe9b520d19c6cc77048e7a7d827ac38cde51ece"
+          },
+          "conversion": {
+            "sourceId": "/items/42/content/items/16/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/42/content/items/16/content/query",
+          "sourceSha256": "4e4912f05c0a6b730d36f0571fe9b520d19c6cc77048e7a7d827ac38cde51ece",
+          "targetSha256": "4e4912f05c0a6b730d36f0571fe9b520d19c6cc77048e7a7d827ac38cde51ece"
+        },
+        {
+          "sourcePath": "/items/44/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "98841a54452a812aa4fb1d340d18cc6ad07db86fec6ead416e83493936120eec"
+          },
+          "conversion": {
+            "sourceId": "/items/44/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails subject to an admin policy with action of allow independent of action taken, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/44/content/items/2/content/query",
+          "sourceSha256": "98841a54452a812aa4fb1d340d18cc6ad07db86fec6ead416e83493936120eec",
+          "targetSha256": "98841a54452a812aa4fb1d340d18cc6ad07db86fec6ead416e83493936120eec"
+        },
+        {
+          "sourcePath": "/items/44/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "08eb36cc6b166e767c0298ceac0436bd7dcd8ee1529950c0900e62f533436c43"
+          },
+          "conversion": {
+            "sourceId": "/items/44/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/44/content/items/5/content/query",
+          "sourceSha256": "08eb36cc6b166e767c0298ceac0436bd7dcd8ee1529950c0900e62f533436c43",
+          "targetSha256": "08eb36cc6b166e767c0298ceac0436bd7dcd8ee1529950c0900e62f533436c43"
+        },
+        {
+          "sourcePath": "/items/44/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "479581dfceba4451dbdf7519a43485982e518fc2508e7008a552d26c58474d10"
+          },
+          "conversion": {
+            "sourceId": "/items/44/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/44/content/items/6/content/query",
+          "sourceSha256": "479581dfceba4451dbdf7519a43485982e518fc2508e7008a552d26c58474d10",
+          "targetSha256": "479581dfceba4451dbdf7519a43485982e518fc2508e7008a552d26c58474d10"
+        },
+        {
+          "sourcePath": "/items/44/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "605f590cbbd6fdc3484113461d66c5d0b477e6bb4bcb108ce19b4a38d770fc97"
+          },
+          "conversion": {
+            "sourceId": "/items/44/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of emails subject to the \r\nEmailEvents \r\n| where OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/44/content/items/8/content/query",
+          "sourceSha256": "605f590cbbd6fdc3484113461d66c5d0b477e6bb4bcb108ce19b4a38d770fc97",
+          "targetSha256": "605f590cbbd6fdc3484113461d66c5d0b477e6bb4bcb108ce19b4a38d770fc97"
+        },
+        {
+          "sourcePath": "/items/44/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "fd049e88fa8087c8310c7c8f5921ae01ae9d30c2f378b8dfc0c987bc882bdc55"
+          },
+          "conversion": {
+            "sourceId": "/items/44/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails delivered to the SecOps Mailbox by threat type\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/44/content/items/9/content/query",
+          "sourceSha256": "fd049e88fa8087c8310c7c8f5921ae01ae9d30c2f378b8dfc0c987bc882bdc55",
+          "targetSha256": "fd049e88fa8087c8310c7c8f5921ae01ae9d30c2f378b8dfc0c987bc882bdc55"
+        },
+        {
+          "sourcePath": "/items/45/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0191481702bf99320c3c3ad445bb2e8a562c98b46d86efa5a17bcf9b1ef9eb94"
+          },
+          "conversion": {
+            "sourceId": "/items/45/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/45/content/items/2/content/query",
+          "sourceSha256": "0191481702bf99320c3c3ad445bb2e8a562c98b46d86efa5a17bcf9b1ef9eb94",
+          "targetSha256": "0191481702bf99320c3c3ad445bb2e8a562c98b46d86efa5a17bcf9b1ef9eb94"
+        },
+        {
+          "sourcePath": "/items/45/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "01b0947f0335fa298b8afea14dcc5e146680f766523ab941ff94b982afb7d45c"
+          },
+          "conversion": {
+            "sourceId": "/items/45/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of emails subject to an admin policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/45/content/items/5/content/query",
+          "sourceSha256": "01b0947f0335fa298b8afea14dcc5e146680f766523ab941ff94b982afb7d45c",
+          "targetSha256": "01b0947f0335fa298b8afea14dcc5e146680f766523ab941ff94b982afb7d45c"
+        },
+        {
+          "sourcePath": "/items/45/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5308d5b51d6cc5c05ec341e7da32f8f3291d9f0a9c86842f71f9522be78e0d26"
+          },
+          "conversion": {
+            "sourceId": "/items/45/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/45/content/items/6/content/query",
+          "sourceSha256": "5308d5b51d6cc5c05ec341e7da32f8f3291d9f0a9c86842f71f9522be78e0d26",
+          "targetSha256": "5308d5b51d6cc5c05ec341e7da32f8f3291d9f0a9c86842f71f9522be78e0d26"
+        },
+        {
+          "sourcePath": "/items/46/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8eb5d94e482fa58347a8ce7121a05ac0d42d087646d610ed7268b982f821a6df"
+          },
+          "conversion": {
+            "sourceId": "/items/46/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/46/content/items/2/content/query",
+          "sourceSha256": "8eb5d94e482fa58347a8ce7121a05ac0d42d087646d610ed7268b982f821a6df",
+          "targetSha256": "8eb5d94e482fa58347a8ce7121a05ac0d42d087646d610ed7268b982f821a6df"
+        },
+        {
+          "sourcePath": "/items/46/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "634ea17d6cce9c0c9779764b703ddc1cfce8f66aa5d6c9124e913e33f368e4e3"
+          },
+          "conversion": {
+            "sourceId": "/items/46/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/46/content/items/5/content/query",
+          "sourceSha256": "634ea17d6cce9c0c9779764b703ddc1cfce8f66aa5d6c9124e913e33f368e4e3",
+          "targetSha256": "634ea17d6cce9c0c9779764b703ddc1cfce8f66aa5d6c9124e913e33f368e4e3"
+        },
+        {
+          "sourcePath": "/items/46/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "39177dbcea32c9061429809d0735bb1ff809bc2050b5c20fe60cba294737ba07"
+          },
+          "conversion": {
+            "sourceId": "/items/46/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/46/content/items/6/content/query",
+          "sourceSha256": "39177dbcea32c9061429809d0735bb1ff809bc2050b5c20fe60cba294737ba07",
+          "targetSha256": "39177dbcea32c9061429809d0735bb1ff809bc2050b5c20fe60cba294737ba07"
+        },
+        {
+          "sourcePath": "/items/47/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "98ae122b7b16d93a3b04c8c4bff31071fe303ddbb0395a629a7c77f0d4094a4e"
+          },
+          "conversion": {
+            "sourceId": "/items/47/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/47/content/items/2/content/query",
+          "sourceSha256": "98ae122b7b16d93a3b04c8c4bff31071fe303ddbb0395a629a7c77f0d4094a4e",
+          "targetSha256": "98ae122b7b16d93a3b04c8c4bff31071fe303ddbb0395a629a7c77f0d4094a4e"
+        },
+        {
+          "sourcePath": "/items/47/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "038df3e31a9bd7d87478d0db455c54d07eb82935fe7f53a11faaddaefd310858"
+          },
+          "conversion": {
+            "sourceId": "/items/47/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of emails subject to a user type policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/47/content/items/5/content/query",
+          "sourceSha256": "038df3e31a9bd7d87478d0db455c54d07eb82935fe7f53a11faaddaefd310858",
+          "targetSha256": "038df3e31a9bd7d87478d0db455c54d07eb82935fe7f53a11faaddaefd310858"
+        },
+        {
+          "sourcePath": "/items/47/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "11597c350853d749382e4f898978edbdfc528bb6930690b985201cd197737a43"
+          },
+          "conversion": {
+            "sourceId": "/items/47/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/47/content/items/6/content/query",
+          "sourceSha256": "11597c350853d749382e4f898978edbdfc528bb6930690b985201cd197737a43",
+          "targetSha256": "11597c350853d749382e4f898978edbdfc528bb6930690b985201cd197737a43"
+        },
+        {
+          "sourcePath": "/items/48/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "dab1d4deeaa36005a3c935359196c47841107592a702f815bfca3087aecfa108"
+          },
+          "conversion": {
+            "sourceId": "/items/48/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top recipients receiving threats that were delivered due to an admin or user override, with the share of their threats that were overridden and a breakdown of which override types caused them.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n    \"(none)\")\r\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n        by RecipientEmailAddress\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 15 by OverriddenThreats\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/48/content/items/1/content/query",
+          "sourceSha256": "dab1d4deeaa36005a3c935359196c47841107592a702f815bfca3087aecfa108",
+          "targetSha256": "dab1d4deeaa36005a3c935359196c47841107592a702f815bfca3087aecfa108"
+        },
+        {
+          "sourcePath": "/items/48/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "cfe62517a4c1056dead45ef4655eb3a7bd13844272f2e92522e92c06be146eed"
+          },
+          "conversion": {
+            "sourceId": "/items/48/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top sender domains sending threats to users, with the share of those threats that were delivered because of an admin or user override and a breakdown of which override types caused them. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n    \"(none)\")\r\n| summarize PerType = count() by SenderFromDomain, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n        by SenderFromDomain\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 10 by OverriddenThreats\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/48/content/items/2/content/query",
+          "sourceSha256": "cfe62517a4c1056dead45ef4655eb3a7bd13844272f2e92522e92c06be146eed",
+          "targetSha256": "cfe62517a4c1056dead45ef4655eb3a7bd13844272f2e92522e92c06be146eed"
+        },
+        {
+          "sourcePath": "/items/50/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "6020e0927daa1fef5e01740cf193e8b6b53be2df55ce4d097d1b9e9af8fe5603"
+          },
+          "conversion": {
+            "sourceId": "/items/50/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the daily ammount of admin false negative submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Malware_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Malware_URL_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Malware_Attach_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\"), Admin_Phish_URL_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Phish_Attach_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Malware (Mail)']=coalesce(Admin_Malware_FN,0), ['Phish (Mail)']=coalesce(Admin_Phish_FN,0), ['Spam (Mail)']=coalesce(Admin_Spam_FN,0), ['Malware (URL)']=coalesce(Admin_Malware_URL_FN,0), ['Malware (Attachment)']=coalesce(Admin_Malware_Attach_FN,0), ['Phish (URL)']=coalesce(Admin_Phish_URL_FN,0), ['Phish (Attachment)']=coalesce(Admin_Phish_Attach_FN,0) | sort by Timestamp asc",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/50/content/items/2/content/query",
+          "sourceSha256": "6020e0927daa1fef5e01740cf193e8b6b53be2df55ce4d097d1b9e9af8fe5603",
+          "targetSha256": "6020e0927daa1fef5e01740cf193e8b6b53be2df55ce4d097d1b9e9af8fe5603"
+        },
+        {
+          "sourcePath": "/items/50/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "07335ac977d13181fb7d411d158bfab30b680d3644e16c8211f384e3413e14a9"
+          },
+          "conversion": {
+            "sourceId": "/items/50/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of admin false negative submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Malware (URL)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Malware (Attachment)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Phish (URL)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Phish (Attachment)\",\r\n\"Other\")))))))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/50/content/items/5/content/query",
+          "sourceSha256": "07335ac977d13181fb7d411d158bfab30b680d3644e16c8211f384e3413e14a9",
+          "targetSha256": "07335ac977d13181fb7d411d158bfab30b680d3644e16c8211f384e3413e14a9"
+        },
+        {
+          "sourcePath": "/items/50/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ae9cfa969dc3fa98eecab3e33895123d8ebe2e0ea45d848719aa31ccee2930e5"
+          },
+          "conversion": {
+            "sourceId": "/items/50/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of admin false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize count() by tostring(SubmissionState)",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/50/content/items/6/content/query",
+          "sourceSha256": "ae9cfa969dc3fa98eecab3e33895123d8ebe2e0ea45d848719aa31ccee2930e5",
+          "targetSha256": "ae9cfa969dc3fa98eecab3e33895123d8ebe2e0ea45d848719aa31ccee2930e5"
+        },
+        {
+          "sourcePath": "/items/50/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c117a2d84bd97df6b74b225278f0777be5c7fc23787241ed897c31080ddccf20"
+          },
+          "conversion": {
+            "sourceId": "/items/50/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of admin false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/50/content/items/9/content/query",
+          "sourceSha256": "c117a2d84bd97df6b74b225278f0777be5c7fc23787241ed897c31080ddccf20",
+          "targetSha256": "c117a2d84bd97df6b74b225278f0777be5c7fc23787241ed897c31080ddccf20"
+        },
+        {
+          "sourcePath": "/items/50/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "d5c27998417b90d3c5b0a62e92cb1ec067b53953072483c45c3702ea26d0128f"
+          },
+          "conversion": {
+            "sourceId": "/items/50/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top admins performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/50/content/items/10/content/query",
+          "sourceSha256": "d5c27998417b90d3c5b0a62e92cb1ec067b53953072483c45c3702ea26d0128f",
+          "targetSha256": "d5c27998417b90d3c5b0a62e92cb1ec067b53953072483c45c3702ea26d0128f"
+        },
+        {
+          "sourcePath": "/items/50/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "1cdb86b390d21c72e50df9d4bf8b62fe908de31edb727f5e9a63b5f4917a9f4b"
+          },
+          "conversion": {
+            "sourceId": "/items/50/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top 10 sender domains that admins reported false negatives (missed threats) for, with each domain's MDO-detected threat profile for context.\r\nlet subs = CloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\")\r\n| summarize AdminSubmissions=count() by P2SenderDomain;\r\nlet domainProfile = EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalInbound=count(), EmailsWithThreats=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by SenderFromDomain;\r\nsubs\r\n| join kind=leftouter (domainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend AdminSubmissionPct = round(AdminSubmissions * 100.0 / todouble(coalesce(TotalInbound, AdminSubmissions)), 2)\r\n| top 10 by AdminSubmissions desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails With Threats']=coalesce(EmailsWithThreats,0), ['Malware']=coalesce(Malware,0), ['Phish']=coalesce(Phish,0), ['Spam']=coalesce(Spam,0), ['Admin Submissions']=AdminSubmissions, ['Admin Submission %']=AdminSubmissionPct",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/50/content/items/12/content/query",
+          "sourceSha256": "1cdb86b390d21c72e50df9d4bf8b62fe908de31edb727f5e9a63b5f4917a9f4b",
+          "targetSha256": "1cdb86b390d21c72e50df9d4bf8b62fe908de31edb727f5e9a63b5f4917a9f4b"
+        },
+        {
+          "sourcePath": "/items/50/content/items/14/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "747ee111c8ee30f787f5d503bfcead7f08e4c84dbc62cc750e1dddae76ee1f70"
+          },
+          "conversion": {
+            "sourceId": "/items/50/content/items/14/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was a admin policy override\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\"))),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\") and PolicyOverride !=\"NoOverride\"\r\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Override Source']=PolicyPolicyOverrideType, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/50/content/items/14/content/query",
+          "sourceSha256": "747ee111c8ee30f787f5d503bfcead7f08e4c84dbc62cc750e1dddae76ee1f70",
+          "targetSha256": "747ee111c8ee30f787f5d503bfcead7f08e4c84dbc62cc750e1dddae76ee1f70"
+        },
+        {
+          "sourcePath": "/items/51/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "190c560e0a844d97439beaa78531501c980cbc57205552ed4d3aa74a75432544"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize User_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_AttackSim_Submission=countif(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Phish (Mail)']=coalesce(User_Phish_FN,0), ['Spam (Mail)']=coalesce(User_Spam_FN,0), ['Attack simulation reported']=coalesce(User_AttackSim_Submission,0) | sort by Timestamp asc",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/2/content/query",
+          "sourceSha256": "190c560e0a844d97439beaa78531501c980cbc57205552ed4d3aa74a75432544",
+          "targetSha256": "190c560e0a844d97439beaa78531501c980cbc57205552ed4d3aa74a75432544"
+        },
+        {
+          "sourcePath": "/items/51/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4ec67e14891fb4eaee26027655c919bee250246646f01f91837f1d93fcf5b17a"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of user false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| summarize count() by tostring(SubmissionState)",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/5/content/query",
+          "sourceSha256": "4ec67e14891fb4eaee26027655c919bee250246646f01f91837f1d93fcf5b17a",
+          "targetSha256": "4ec67e14891fb4eaee26027655c919bee250246646f01f91837f1d93fcf5b17a"
+        },
+        {
+          "sourcePath": "/items/51/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "bbbfd512ecfb4772f33fb2eda6f71e470f9a2e5e6c6d87a727113a0d863b8e53"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/6/content/query",
+          "sourceSha256": "bbbfd512ecfb4772f33fb2eda6f71e470f9a2e5e6c6d87a727113a0d863b8e53",
+          "targetSha256": "bbbfd512ecfb4772f33fb2eda6f71e470f9a2e5e6c6d87a727113a0d863b8e53"
+        },
+        {
+          "sourcePath": "/items/51/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "17b36c25f276a7ff82978008d44a8988234315b3d3762b20f04960e92adafd3f"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| summarize count() by ThreatTypes,User_SubmissionType\r\n| project ThreatTypes,User_SubmissionType, Emails = count_",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/8/content/query",
+          "sourceSha256": "17b36c25f276a7ff82978008d44a8988234315b3d3762b20f04960e92adafd3f",
+          "targetSha256": "17b36c25f276a7ff82978008d44a8988234315b3d3762b20f04960e92adafd3f"
+        },
+        {
+          "sourcePath": "/items/51/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "87241ae8c69a092670d36b458c788b767ceb248dfa85cc4bf364e80f6eb9757d"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId,UserId = (parse_json(RawEventData)).UserId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| summarize TotalJunkSubmittedEmailCount=count(),PhishEmailCount = countif(FirstDetection ==  \"Phish\"),SpamEmailCount = countif(FirstDetection ==  \"Spam\") by tostring(UserId)\r\n| top 15 by TotalJunkSubmittedEmailCount desc\r\n| project ['User']=UserId, ['Junk Submissions']=TotalJunkSubmittedEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/9/content/query",
+          "sourceSha256": "87241ae8c69a092670d36b458c788b767ceb248dfa85cc4bf364e80f6eb9757d",
+          "targetSha256": "87241ae8c69a092670d36b458c788b767ceb248dfa85cc4bf364e80f6eb9757d"
+        },
+        {
+          "sourcePath": "/items/51/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "7bca4d4dd4db1c3c3789edf2817216821aa859846d5291dac6f29c0cce09a15d"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises user submissions where admin also performed 'mark and notify' action on the submission\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| summarize count() by Reviewed",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/12/content/query",
+          "sourceSha256": "7bca4d4dd4db1c3c3789edf2817216821aa859846d5291dac6f29c0cce09a15d",
+          "targetSha256": "7bca4d4dd4db1c3c3789edf2817216821aa859846d5291dac6f29c0cce09a15d"
+        },
+        {
+          "sourcePath": "/items/51/content/items/13/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0a164920cbdf7d1d27cb8a5e2753d3e3ba1565f10f2476c9daf3732e7f4e51ca"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/13/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises user submissions type compared to admin review verdict. \r\n//Eg. User reporting a phish but admin review is 'not threat found'\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \"Correct\", iif(AdminReviewResult==\"Phish\" and UserReportedAs == \"Junk\", \"Phish reported as junk\",iif(AdminReviewResult==\"Junk\" and UserReportedAs == \"Phish\",\"Junk reported as Phish\",iif(AdminReviewResult==\"NotJunk\",\"Reported but not malicious or spam\",iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Not correct\")))))\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| where Reviewed==\"Reviewed\"\r\n| summarize count() by ReviewedAccuracy",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/13/content/query",
+          "sourceSha256": "0a164920cbdf7d1d27cb8a5e2753d3e3ba1565f10f2476c9daf3732e7f4e51ca",
+          "targetSha256": "0a164920cbdf7d1d27cb8a5e2753d3e3ba1565f10f2476c9daf3732e7f4e51ca"
+        },
+        {
+          "sourcePath": "/items/51/content/items/15/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "2ff628e131399a7d636349ebdd421d29f7a21434c2690d04e68577c870b425ed"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/15/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises top 10 sender domains of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromDomain;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromDomain\r\n| join TotalInboundbySender on SenderFromDomain\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Domain']=SenderFromDomain, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/15/content/query",
+          "sourceSha256": "2ff628e131399a7d636349ebdd421d29f7a21434c2690d04e68577c870b425ed",
+          "targetSha256": "2ff628e131399a7d636349ebdd421d29f7a21434c2690d04e68577c870b425ed"
+        },
+        {
+          "sourcePath": "/items/51/content/items/17/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5a3bd5ba09ef5bdeb326e9c37633cca5ab76566d5e0023bdbca7ba8ba22b9ed2"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/17/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises top 10 sender email addresses of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/17/content/query",
+          "sourceSha256": "5a3bd5ba09ef5bdeb326e9c37633cca5ab76566d5e0023bdbca7ba8ba22b9ed2",
+          "targetSha256": "5a3bd5ba09ef5bdeb326e9c37633cca5ab76566d5e0023bdbca7ba8ba22b9ed2"
+        },
+        {
+          "sourcePath": "/items/51/content/items/19/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4242a874bb7bfd3b4571641f2f448a2cfabd00415c8cdb14a2da887b60e8c94d"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/19/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises top 10 sender email address of intra-org emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Intra-org\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Intra-org']=count_, ['User Submission %']=UserSubmissions_Percentage",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/19/content/query",
+          "sourceSha256": "4242a874bb7bfd3b4571641f2f448a2cfabd00415c8cdb14a2da887b60e8c94d",
+          "targetSha256": "4242a874bb7bfd3b4571641f2f448a2cfabd00415c8cdb14a2da887b60e8c94d"
+        },
+        {
+          "sourcePath": "/items/51/content/items/21/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "076baa0f569360603bcad7368056a253218abf225d4fa285b14ac64612a7793d"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/21/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize count() by Subject\r\n| top 10 by count_ desc\r\n| project ['Subject']=Subject, ['User Submissions']=count_",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/21/content/query",
+          "sourceSha256": "076baa0f569360603bcad7368056a253218abf225d4fa285b14ac64612a7793d",
+          "targetSha256": "076baa0f569360603bcad7368056a253218abf225d4fa285b14ac64612a7793d"
+        },
+        {
+          "sourcePath": "/items/51/content/items/23/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a64a3faaafc023d58d21107ed15f6257956f5c6120e99ca38ec9259db46d029f"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/23/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an admin definded policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and OrgLevelAction!=\"\"\r\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/23/content/query",
+          "sourceSha256": "a64a3faaafc023d58d21107ed15f6257956f5c6120e99ca38ec9259db46d029f",
+          "targetSha256": "a64a3faaafc023d58d21107ed15f6257956f5c6120e99ca38ec9259db46d029f"
+        },
+        {
+          "sourcePath": "/items/51/content/items/25/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "dc2fe8fc6f590d33ed0ddb60662f0fb9b243333bfecd10a332b96772a03ee33c"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/25/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and UserLevelAction!=\"\"\r\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/25/content/query",
+          "sourceSha256": "dc2fe8fc6f590d33ed0ddb60662f0fb9b243333bfecd10a332b96772a03ee33c",
+          "targetSha256": "dc2fe8fc6f590d33ed0ddb60662f0fb9b243333bfecd10a332b96772a03ee33c"
+        },
+        {
+          "sourcePath": "/items/51/content/items/27/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ce551d10e6dee3b5d32931fbe168fbc33bdd09db68897a54df679c31dd10ab25"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/27/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top 10 users performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/27/content/query",
+          "sourceSha256": "ce551d10e6dee3b5d32931fbe168fbc33bdd09db68897a54df679c31dd10ab25",
+          "targetSha256": "ce551d10e6dee3b5d32931fbe168fbc33bdd09db68897a54df679c31dd10ab25"
+        },
+        {
+          "sourcePath": "/items/51/content/items/29/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "2435d71ca693e67251e18f93be23b59a6e745fe1ab1559e8ce1cbaae6aa797a2"
+          },
+          "conversion": {
+            "sourceId": "/items/51/content/items/29/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top users reporting the phishing simulation emails.\r\nCloudAppEvents \r\n| extend Record= (parse_json(RawEventData)).RecordType \r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState \r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| where Record == 29\r\n| where ActionType == \"AttackSimUserSubmission\" \r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/51/content/items/29/content/query",
+          "sourceSha256": "2435d71ca693e67251e18f93be23b59a6e745fe1ab1559e8ce1cbaae6aa797a2",
+          "targetSha256": "2435d71ca693e67251e18f93be23b59a6e745fe1ab1559e8ce1cbaae6aa797a2"
+        },
+        {
+          "sourcePath": "/items/53/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "1ec8d0bdae64ae23b8670d90f62e063d73e0a031c151d4f3f9881998ee3b677e"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the daily ammount of admin false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Email_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_URL_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Attach_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Email']=coalesce(Admin_Email_FP,0), ['URL']=coalesce(Admin_URL_FP,0), ['Attachment']=coalesce(Admin_Attach_FP,0) | sort by Timestamp asc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/2/content/query",
+          "sourceSha256": "1ec8d0bdae64ae23b8670d90f62e063d73e0a031c151d4f3f9881998ee3b677e",
+          "targetSha256": "1ec8d0bdae64ae23b8670d90f62e063d73e0a031c151d4f3f9881998ee3b677e"
+        },
+        {
+          "sourcePath": "/items/53/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "84ff7dba1257d1b322d0a5fcb61924e0e174fd65efd56c5b916de7f53ef8a1c1"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of admin false positive submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Email\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"URL\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Attachment\",\r\n\"Other\")))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/3/content/query",
+          "sourceSha256": "84ff7dba1257d1b322d0a5fcb61924e0e174fd65efd56c5b916de7f53ef8a1c1",
+          "targetSha256": "84ff7dba1257d1b322d0a5fcb61924e0e174fd65efd56c5b916de7f53ef8a1c1"
+        },
+        {
+          "sourcePath": "/items/53/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "a127712060a9efb1387daff4836de6b7b66b5b366fa16c37da5d5145c0241908"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of admin false positive submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/6/content/query",
+          "sourceSha256": "a127712060a9efb1387daff4836de6b7b66b5b366fa16c37da5d5145c0241908",
+          "targetSha256": "a127712060a9efb1387daff4836de6b7b66b5b366fa16c37da5d5145c0241908"
+        },
+        {
+          "sourcePath": "/items/53/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "e47978375215d7dd1f8eab2a73be26e59388ded6590c4d3e051fa81fb53b4076"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top admins performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \r\n| where Record == 29 and SubmissionType ==\"3\"\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/7/content/query",
+          "sourceSha256": "e47978375215d7dd1f8eab2a73be26e59388ded6590c4d3e051fa81fb53b4076",
+          "targetSha256": "e47978375215d7dd1f8eab2a73be26e59388ded6590c4d3e051fa81fb53b4076"
+        },
+        {
+          "sourcePath": "/items/53/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "4e0eebac5a1e8e0252ddc22b1f32bbb64c350e4bd68c5be2f2b372eb332793eb"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Admin false positive submissions whose original verdict was Malware, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Malware.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Malware\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Malware\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Malware FPs'] = Pct",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/9/content/query",
+          "sourceSha256": "4e0eebac5a1e8e0252ddc22b1f32bbb64c350e4bd68c5be2f2b372eb332793eb",
+          "targetSha256": "4e0eebac5a1e8e0252ddc22b1f32bbb64c350e4bd68c5be2f2b372eb332793eb"
+        },
+        {
+          "sourcePath": "/items/53/content/items/11/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "942f49b9d76b441e429e52472521cf70bea50866823f8deeed6b466b36bfc6cd"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/11/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Admin false positive submissions whose original verdict was Phish, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Phish.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Phish\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Phish\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Phish FPs'] = Pct",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/11/content/query",
+          "sourceSha256": "942f49b9d76b441e429e52472521cf70bea50866823f8deeed6b466b36bfc6cd",
+          "targetSha256": "942f49b9d76b441e429e52472521cf70bea50866823f8deeed6b466b36bfc6cd"
+        },
+        {
+          "sourcePath": "/items/53/content/items/13/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "e3d2d9612489838c00ae7aa00cdb34680ec8f9305ff4207e31683850c63bb299"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/13/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Admin false positive submissions whose original verdict was Spam, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Spam.\r\nlet total = toscalar(CloudAppEvents\r\n    | where ActionType == \"AdminSubmissionSubmitted\"\r\n    | extend R = parse_json(RawEventData)\r\n    | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Spam\"\r\n    | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Spam\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Spam FPs'] = Pct",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/13/content/query",
+          "sourceSha256": "e3d2d9612489838c00ae7aa00cdb34680ec8f9305ff4207e31683850c63bb299",
+          "targetSha256": "e3d2d9612489838c00ae7aa00cdb34680ec8f9305ff4207e31683850c63bb299"
+        },
+        {
+          "sourcePath": "/items/53/content/items/16/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "cca5d9e2b3d5e82f36d0925d5f0729efbb674450d043ae44c758063734b8c1a9"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/16/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top 10 sender domains of emails which are submitted as false positive by admins\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType ==\"3\"\r\n| summarize count() by P2SenderDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails']=count_",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/16/content/query",
+          "sourceSha256": "cca5d9e2b3d5e82f36d0925d5f0729efbb674450d043ae44c758063734b8c1a9",
+          "targetSha256": "cca5d9e2b3d5e82f36d0925d5f0729efbb674450d043ae44c758063734b8c1a9"
+        },
+        {
+          "sourcePath": "/items/53/content/items/17/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5bcc51c8dd3bc4ca8453963c5fda413933c9c7797654ac4e6870c319eb5cb597"
+          },
+          "conversion": {
+            "sourceId": "/items/53/content/items/17/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Email\",\r\n\"Other\"),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/53/content/items/17/content/query",
+          "sourceSha256": "5bcc51c8dd3bc4ca8453963c5fda413933c9c7797654ac4e6870c319eb5cb597",
+          "targetSha256": "5bcc51c8dd3bc4ca8453963c5fda413933c9c7797654ac4e6870c319eb5cb597"
+        },
+        {
+          "sourcePath": "/items/54/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "67eab6668c5bbeaedd89ff5dd96d450db4dbb474face6b42c169077a2131f8bc"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the daily ammount of user false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where SubmissionType == \"3\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User FP Submissions'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/2/content/query",
+          "sourceSha256": "67eab6668c5bbeaedd89ff5dd96d450db4dbb474face6b42c169077a2131f8bc",
+          "targetSha256": "67eab6668c5bbeaedd89ff5dd96d450db4dbb474face6b42c169077a2131f8bc"
+        },
+        {
+          "sourcePath": "/items/54/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "8fa077a5e7acb929d4f838162f74ec00683d1dc97909896cd41a43f6095193e1"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of user false positive submission by submission state.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/5/content/query",
+          "sourceSha256": "8fa077a5e7acb929d4f838162f74ec00683d1dc97909896cd41a43f6095193e1",
+          "targetSha256": "8fa077a5e7acb929d4f838162f74ec00683d1dc97909896cd41a43f6095193e1"
+        },
+        {
+          "sourcePath": "/items/54/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "06dfd0f0530c4081e868b6e444c344f00b01c0da62fbeaf59b1819d0ebfbdd56"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the top users performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc",
+            "resolvedTables": [
+              "CloudAppEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/6/content/query",
+          "sourceSha256": "06dfd0f0530c4081e868b6e444c344f00b01c0da62fbeaf59b1819d0ebfbdd56",
+          "targetSha256": "06dfd0f0530c4081e868b6e444c344f00b01c0da62fbeaf59b1819d0ebfbdd56"
+        },
+        {
+          "sourcePath": "/items/54/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "74d2514387026a9cbca80d7c6632732f497e6a9326931485517d26a115bc1098"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//User false positive submissions whose email was originally flagged as Malware, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Malware.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Malware\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/8/content/query",
+          "sourceSha256": "74d2514387026a9cbca80d7c6632732f497e6a9326931485517d26a115bc1098",
+          "targetSha256": "74d2514387026a9cbca80d7c6632732f497e6a9326931485517d26a115bc1098"
+        },
+        {
+          "sourcePath": "/items/54/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0a98d004faf373375334191fda0147f3af0812c7ae871251a5728f1ffa5e72cd"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//User false positive submissions whose email was originally flagged as Phish, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Phish.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Phish\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/10/content/query",
+          "sourceSha256": "0a98d004faf373375334191fda0147f3af0812c7ae871251a5728f1ffa5e72cd",
+          "targetSha256": "0a98d004faf373375334191fda0147f3af0812c7ae871251a5728f1ffa5e72cd"
+        },
+        {
+          "sourcePath": "/items/54/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "3ef8df7f0af5e964483dd0d200d7015e761031dc4284f6c843af47858e0b56f0"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//User false positive submissions whose email was originally flagged as Spam, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Spam.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Spam\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/12/content/query",
+          "sourceSha256": "3ef8df7f0af5e964483dd0d200d7015e761031dc4284f6c843af47858e0b56f0",
+          "targetSha256": "3ef8df7f0af5e964483dd0d200d7015e761031dc4284f6c843af47858e0b56f0"
+        },
+        {
+          "sourcePath": "/items/54/content/items/14/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "01d2c3a9084d16561d96d52b2a9f43158cd0b5805f1bd1503f19bd79fc1fd0b1"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/14/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top 10 sender domains reported as false positives by users, with each domain's total inbound volume and the share of it reported as FP (a high rate flags a domain whose legitimate mail is most often misclassified).\r\nlet totalByDomain = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderFromDomain;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize FPSubmissions = count() by P2SenderDomain\r\n| join kind=leftouter (totalByDomain) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Domain'] = P2SenderDomain, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/14/content/query",
+          "sourceSha256": "01d2c3a9084d16561d96d52b2a9f43158cd0b5805f1bd1503f19bd79fc1fd0b1",
+          "targetSha256": "01d2c3a9084d16561d96d52b2a9f43158cd0b5805f1bd1503f19bd79fc1fd0b1"
+        },
+        {
+          "sourcePath": "/items/54/content/items/16/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "dee4810b520a32ee3eda3665ec91442f6b1b94e403bf850472313c0b0b92cc89"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/16/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top 10 email senders reported as false positives by users, with each sender's total inbound volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/16/content/query",
+          "sourceSha256": "dee4810b520a32ee3eda3665ec91442f6b1b94e403bf850472313c0b0b92cc89",
+          "targetSha256": "dee4810b520a32ee3eda3665ec91442f6b1b94e403bf850472313c0b0b92cc89"
+        },
+        {
+          "sourcePath": "/items/54/content/items/18/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "e855970dd652ea06edb6c39d05056de221c92079455389ff1c874c674260434e"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/18/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top 10 email subjects reported as false positives by users, with how many distinct recipients reported each (a subject reported by many users is a broad misclassification pattern).\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count(), DistinctRecipients = dcount(RecipientObjectId) by Subject\r\n| top 10 by FPSubmissions desc\r\n| project ['Subject'] = Subject, ['FP Submissions'] = FPSubmissions, ['Distinct Recipients'] = DistinctRecipients",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/18/content/query",
+          "sourceSha256": "e855970dd652ea06edb6c39d05056de221c92079455389ff1c874c674260434e",
+          "targetSha256": "e855970dd652ea06edb6c39d05056de221c92079455389ff1c874c674260434e"
+        },
+        {
+          "sourcePath": "/items/54/content/items/20/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "574a57a292b61a545e06d553089b20c675d2deeebd757cc4041f71ee296658f2"
+          },
+          "conversion": {
+            "sourceId": "/items/54/content/items/20/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top 10 internal senders whose emails were reported as false positives by users, with total intra-org volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Intra-org\" | summarize TotalIntraOrg = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalIntraOrg) or TotalIntraOrg == 0, 0.0, round(FPSubmissions * 100.0 / TotalIntraOrg, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Intra-org'] = coalesce(TotalIntraOrg, 0), ['FP Submission %'] = FPPct",
+            "resolvedTables": [
+              "CloudAppEvents",
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "CloudAppEvents",
+                "ahTable": "CloudAppEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 37,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/54/content/items/20/content/query",
+          "sourceSha256": "574a57a292b61a545e06d553089b20c675d2deeebd757cc4041f71ee296658f2",
+          "targetSha256": "574a57a292b61a545e06d553089b20c675d2deeebd757cc4041f71ee296658f2"
+        },
+        {
+          "sourcePath": "/items/56/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ee6b26c853c749ddefdc422e3bf84d8957cfc20ec68caf97ea50c45a86fe6b8b"
+          },
+          "conversion": {
+            "sourceId": "/items/56/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Microsoft Defender for Office 365 value for files in SharePoint / OneDrive / Teams: total files processed, how many had a malware detection, and how many were scanned with no detection. A per-period Trend series feeds the tile sparkline.\r\nlet gran = {Granularity};\r\nlet base = FileMaliciousContentInfo;\r\nlet counts = union\r\n(base | summarize Count = count() | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files Scanned - No Detection\", Ord = 3);\r\nlet tagged = union\r\n(base | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\"),\r\n(base | where isnotempty(ThreatTypes) | extend Cat = \"Files with Malware Detected\"),\r\n(base | where isempty(ThreatTypes) | extend Cat = \"Files Scanned - No Detection\");\r\nlet trends = tagged | make-series Trend = count() default = 0 on Timestamp step gran by Cat;\r\ncounts\r\n| join kind=leftouter (trends) on Cat\r\n| sort by Ord asc\r\n| project Count, Details = Cat, Trend",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/56/content/query",
+          "sourceSha256": "ee6b26c853c749ddefdc422e3bf84d8957cfc20ec68caf97ea50c45a86fe6b8b",
+          "targetSha256": "ee6b26c853c749ddefdc422e3bf84d8957cfc20ec68caf97ea50c45a86fe6b8b"
+        },
+        {
+          "sourcePath": "/items/57/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "3f30b8073c8b9cfd3304c7294b4171f12b9760e27160c598bcf9843a95234022"
+          },
+          "conversion": {
+            "sourceId": "/items/57/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(FileMaliciousContentInfo\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Files']=coalesce(Count, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/57/content/items/2/content/query",
+          "sourceSha256": "3f30b8073c8b9cfd3304c7294b4171f12b9760e27160c598bcf9843a95234022",
+          "targetSha256": "3f30b8073c8b9cfd3304c7294b4171f12b9760e27160c598bcf9843a95234022"
+        },
+        {
+          "sourcePath": "/items/57/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "87a79048564af89105306f9f0eb6e49d2877f0cb1fe9e4fdbe325666b51b4ff7"
+          },
+          "conversion": {
+            "sourceId": "/items/57/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query summarizes File malware detections by Microsoft Defender for Office 365 (Safe Attachments detonation) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"detonation\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/57/content/items/4/content/query",
+          "sourceSha256": "87a79048564af89105306f9f0eb6e49d2877f0cb1fe9e4fdbe325666b51b4ff7",
+          "targetSha256": "87a79048564af89105306f9f0eb6e49d2877f0cb1fe9e4fdbe325666b51b4ff7"
+        },
+        {
+          "sourcePath": "/items/57/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "9ea07eb7836f2e2b1040b6b6e44a86a4c61d61e49c16dc1428c6fc2bb7b6d9d6"
+          },
+          "conversion": {
+            "sourceId": "/items/57/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query summarizes File malware detections by the built-in SharePoint antivirus (Antimalware engine) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"Antimalware engine\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/57/content/items/6/content/query",
+          "sourceSha256": "9ea07eb7836f2e2b1040b6b6e44a86a4c61d61e49c16dc1428c6fc2bb7b6d9d6",
+          "targetSha256": "9ea07eb7836f2e2b1040b6b6e44a86a4c61d61e49c16dc1428c6fc2bb7b6d9d6"
+        },
+        {
+          "sourcePath": "/items/57/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "83eaddab2b108a2803044a325510009d0047dd94858008d869c8659b7ceb14cf"
+          },
+          "conversion": {
+            "sourceId": "/items/57/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query lists total Malware detections of files on SharePoint, OneDrive and Teams by the location (site or personal path) where the file resides.\r\nFileMaliciousContentInfo\r\n| extend ['Site / Location'] = tostring(split(FolderPath, '/')[4])\r\n| summarize ['Detections'] = count() by ['Site / Location']\r\n| sort by ['Detections'] desc",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/57/content/items/9/content/query",
+          "sourceSha256": "83eaddab2b108a2803044a325510009d0047dd94858008d869c8659b7ceb14cf",
+          "targetSha256": "83eaddab2b108a2803044a325510009d0047dd94858008d869c8659b7ceb14cf"
+        },
+        {
+          "sourcePath": "/items/57/content/items/10/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "ddfe37ebdf81dc3035d9491a0fc453cd230d183059224a86193e44f1e852f98f"
+          },
+          "conversion": {
+            "sourceId": "/items/57/content/items/10/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams summarizing the data by the Microsoft collaboration application (workload).\r\nFileMaliciousContentInfo\r\n| summarize count() by Workload\r\n| sort by count_ desc",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/57/content/items/10/content/query",
+          "sourceSha256": "ddfe37ebdf81dc3035d9491a0fc453cd230d183059224a86193e44f1e852f98f",
+          "targetSha256": "ddfe37ebdf81dc3035d9491a0fc453cd230d183059224a86193e44f1e852f98f"
+        },
+        {
+          "sourcePath": "/items/57/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "change",
+            "querySha256": "c0af2e879bb305a1ab536cf7aa9a94c0da845893774b6af9441c54e7e26c20d8"
+          },
+          "conversion": {
+            "sourceId": "/items/57/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Top file owners (or the SharePoint/Teams site, when a file has no user owner) whose SharePoint/OneDrive/Teams files were flagged as malware, with distinct files, workloads and sample threat names.\r\nFileMaliciousContentInfo\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Malicious Files'] = count(),\n            ['Distinct Files']  = dcount(SHA256),\n            ['Workloads']       = make_set(Workload, 3),\n            ['Sample Threats']  = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\n            ['Last Seen']       = max(Timestamp)\n        by ['Owner']=Owner\n| top 20 by ['Malicious Files']",
+            "resolvedTables": [
+              "FileMaliciousContentInfo"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "FileMaliciousContentInfo",
+                "ahTable": "FileMaliciousContentInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 17,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/57/content/items/12/content/query",
+          "sourceSha256": "c0af2e879bb305a1ab536cf7aa9a94c0da845893774b6af9441c54e7e26c20d8",
+          "targetSha256": "c0af2e879bb305a1ab536cf7aa9a94c0da845893774b6af9441c54e7e26c20d8"
+        },
+        {
+          "sourcePath": "/items/59/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "edac2c04a18e08b3c8a7fdfe6e239e2d594008e09c07b78183ace649b0afcd49"
+          },
+          "conversion": {
+            "sourceId": "/items/59/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailPostDeliveryEvents \r\n| where ActionType has \"ZAP\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Zapped Emails'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/59/content/items/3/content/query",
+          "sourceSha256": "edac2c04a18e08b3c8a7fdfe6e239e2d594008e09c07b78183ace649b0afcd49",
+          "targetSha256": "edac2c04a18e08b3c8a7fdfe6e239e2d594008e09c07b78183ace649b0afcd49"
+        },
+        {
+          "sourcePath": "/items/59/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "81205f70e013612c81806cbd61ce60b78f4bbfaf406cc4b71f15d729ffe318ed"
+          },
+          "conversion": {
+            "sourceId": "/items/59/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType has \"ZAP\"\r\n| summarize [\"Spam ZAP\"]=countif(ActionType has 'Spam ZAP'), [\"Phish ZAP\"]=countif(ActionType has 'Phish ZAP'), [\"Malware ZAP\"]=countif(ActionType has 'Malware ZAP') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Spam ZAP\"]=coalesce([\"Spam ZAP\"],0), [\"Phish ZAP\"]=coalesce([\"Phish ZAP\"],0), [\"Malware ZAP\"]=coalesce([\"Malware ZAP\"],0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/59/content/items/4/content/query",
+          "sourceSha256": "81205f70e013612c81806cbd61ce60b78f4bbfaf406cc4b71f15d729ffe318ed",
+          "targetSha256": "81205f70e013612c81806cbd61ce60b78f4bbfaf406cc4b71f15d729ffe318ed"
+        },
+        {
+          "sourcePath": "/items/59/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "b092296adbbd8f13d3ba1dd7ce16b3d4430acf7e0c5b9245dcb65e8305634561"
+          },
+          "conversion": {
+            "sourceId": "/items/59/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType contains \"ZAP\"\r\n| summarize Quarantine=countif(DeliveryLocation has 'Quarantine'), ['Deleted Items']=countif(DeliveryLocation has 'Delete'), Junk=countif(DeliveryLocation has 'Junk'), Inbox=countif(DeliveryLocation has 'Inbox') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Quarantine=coalesce(Quarantine,0), ['Deleted Items']=coalesce(['Deleted Items'],0), Junk=coalesce(Junk,0), Inbox=coalesce(Inbox,0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/59/content/items/6/content/query",
+          "sourceSha256": "b092296adbbd8f13d3ba1dd7ce16b3d4430acf7e0c5b9245dcb65e8305634561",
+          "targetSha256": "b092296adbbd8f13d3ba1dd7ce16b3d4430acf7e0c5b9245dcb65e8305634561"
+        },
+        {
+          "sourcePath": "/items/60/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "f80a170b71ca7aea90a853d397c7cc66efc0727f7e8b1136c999be841598810a"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the daily ammount of emails released from quarantine\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\" and Action has 'Quarantine release'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Quarantine Releases'] = coalesce(Count, 0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/2/content/query",
+          "sourceSha256": "f80a170b71ca7aea90a853d397c7cc66efc0727f7e8b1136c999be841598810a",
+          "targetSha256": "f80a170b71ca7aea90a853d397c7cc66efc0727f7e8b1136c999be841598810a"
+        },
+        {
+          "sourcePath": "/items/60/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/5/content/query",
+          "sourceSha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965",
+          "targetSha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965"
+        },
+        {
+          "sourcePath": "/items/60/content/items/6/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "3bc615d6bc4814e663b33dee2194e9c20b3664fea51cf465413b5931bebbb30e"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/6/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Per detection technology: the share of its quarantined emails that were later released from quarantine.\r\n//Release % = released / quarantined for that detection technology - a high rate flags a detector that may be over-flagging legitimate mail (potential false positives). Detectors with fewer than 10 quarantined emails are excluded so the rate is statistically meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\r\n| join kind=leftouter (\r\n    EmailPostDeliveryEvents\r\n    | where Action == \"Quarantine release\"\r\n    | distinct NetworkMessageId\r\n    | extend ReleasedFlag = \"yes\"\r\n  ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/6/content/query",
+          "sourceSha256": "3bc615d6bc4814e663b33dee2194e9c20b3664fea51cf465413b5931bebbb30e",
+          "targetSha256": "3bc615d6bc4814e663b33dee2194e9c20b3664fea51cf465413b5931bebbb30e"
+        },
+        {
+          "sourcePath": "/items/60/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "613f59e248e2eab9ad627bc17fd671a48892e3ba03cd55291062e0247cffde9b"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of malware emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Malware\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/8/content/query",
+          "sourceSha256": "613f59e248e2eab9ad627bc17fd671a48892e3ba03cd55291062e0247cffde9b",
+          "targetSha256": "613f59e248e2eab9ad627bc17fd671a48892e3ba03cd55291062e0247cffde9b"
+        },
+        {
+          "sourcePath": "/items/60/content/items/9/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "f038b8c64ee2b6006197ae4f79bfbcaa804bded2a217d5a1cb1cbdb9fe7c3ea2"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/9/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of malware emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Malware (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Malware' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Malware)\r\n| summarize count() by Malware\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Malware, ['Detections']=count_",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/9/content/query",
+          "sourceSha256": "f038b8c64ee2b6006197ae4f79bfbcaa804bded2a217d5a1cb1cbdb9fe7c3ea2",
+          "targetSha256": "f038b8c64ee2b6006197ae4f79bfbcaa804bded2a217d5a1cb1cbdb9fe7c3ea2"
+        },
+        {
+          "sourcePath": "/items/60/content/items/11/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "25b86347cd154b8e771535c9325c88198b601d431805ca0e7ed7ff6ab2c07f74"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/11/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of phish emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Phish\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/11/content/query",
+          "sourceSha256": "25b86347cd154b8e771535c9325c88198b601d431805ca0e7ed7ff6ab2c07f74",
+          "targetSha256": "25b86347cd154b8e771535c9325c88198b601d431805ca0e7ed7ff6ab2c07f74"
+        },
+        {
+          "sourcePath": "/items/60/content/items/12/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "d60acc2675082cf943ddec5d9e20e15c2062248cd551c8496e15c7eace2fbe40"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/12/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of phish emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Phish (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Phish)\r\n| summarize count() by Phish\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Phish, ['Detections']=count_",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/12/content/query",
+          "sourceSha256": "d60acc2675082cf943ddec5d9e20e15c2062248cd551c8496e15c7eace2fbe40",
+          "targetSha256": "d60acc2675082cf943ddec5d9e20e15c2062248cd551c8496e15c7eace2fbe40"
+        },
+        {
+          "sourcePath": "/items/60/content/items/14/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "b16218774694e423515732434466775a515223c7db107d015853617ad6951203"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/14/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the ammount of spam emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet baseQuery = EmailEvents\r\n| where DetectionMethods has \"Spam\" and DeliveryLocation == \"Quarantine\";\r\nlet agg = materialize(baseQuery\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/14/content/query",
+          "sourceSha256": "b16218774694e423515732434466775a515223c7db107d015853617ad6951203",
+          "targetSha256": "b16218774694e423515732434466775a515223c7db107d015853617ad6951203"
+        },
+        {
+          "sourcePath": "/items/60/content/items/15/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c48959232f63cbd06ace85302b75f0cb07dda479598e7c91e8d8b2cb01080ddc"
+          },
+          "conversion": {
+            "sourceId": "/items/60/content/items/15/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the total ammount of spam emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Spam (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Spam)\r\n| summarize count() by Spam\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Spam, ['Detections']=count_",
+            "resolvedTables": [
+              "EmailEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/60/content/items/15/content/query",
+          "sourceSha256": "c48959232f63cbd06ace85302b75f0cb07dda479598e7c91e8d8b2cb01080ddc",
+          "targetSha256": "c48959232f63cbd06ace85302b75f0cb07dda479598e7c91e8d8b2cb01080ddc"
+        },
+        {
+          "sourcePath": "/items/62/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "b672a1c614ecc913ceba44e3d5b057d66e99529dfbf5d584fc6eaa6b4ebceb11"
+          },
+          "conversion": {
+            "sourceId": "/items/62/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// Filter for incidents that have at least one Email Security alert\r\nlet gran = {Granularity};\r\nlet OfficeEmailAlerts = SecurityAlert\r\n    | where ProductName contains \"Office 365 Advanced Threat Protection\" or ProductName contains \"Microsoft 365 Defender\"\r\n    | project SystemAlertId;\r\nlet agg = materialize(SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds) \r\n| join kind=inner\r\n    (OfficeEmailAlerts | extend SystemAlertId = tostring(SystemAlertId))\r\n    on $left.AlertId == $right.SystemAlertId\r\n| summarize arg_max(TimeGenerated, *), AlertCount = dcount(AlertId) by IncidentNumber\r\n| summarize Incidents_Number = count() by TimeGenerated = bin(TimeGenerated, gran));\r\nrange TimeGenerated from toscalar(agg | summarize min(TimeGenerated)) to toscalar(agg | summarize max(TimeGenerated)) step gran\r\n| join kind=leftouter (agg) on TimeGenerated\r\n| project TimeGenerated, ['Email Security Incidents'] = coalesce(Incidents_Number, 0)\r\n| sort by TimeGenerated asc",
+            "resolvedTables": [
+              "SecurityAlert"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "SecurityAlert",
+                "ahTable": "SecurityAlert",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 32,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/62/content/items/2/content/query",
+          "sourceSha256": "b672a1c614ecc913ceba44e3d5b057d66e99529dfbf5d584fc6eaa6b4ebceb11",
+          "targetSha256": "b672a1c614ecc913ceba44e3d5b057d66e99529dfbf5d584fc6eaa6b4ebceb11"
+        },
+        {
+          "sourcePath": "/items/62/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0510124e9e2e0050312b7e85075f4ede40a20cde14a6c7e228ff3c5ed7a8a7fa"
+          },
+          "conversion": {
+            "sourceId": "/items/62/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// Categorize incidents: Email Security vs Other\r\nlet AllAlerts = SecurityAlert\r\n    | extend SystemAlertId = tostring(SystemAlertId)\r\n    | project SystemAlertId, ProductName;\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds)\r\n| join kind=inner\r\n    (AllAlerts)\r\n    on $left.AlertId == $right.SystemAlertId\r\n| summarize AlertSystems = make_set(ProductName) by IncidentNumber\r\n| extend HasEmailSecurity = \r\n    AlertSystems has \"Office 365 Advanced Threat Protection\" or \r\n    AlertSystems has \"Microsoft 365 Defender\"\r\n| extend Category = iff(HasEmailSecurity, \"Email Security\", \"Other\")\r\n| summarize IncidentCount = count() by Category\r\n",
+            "resolvedTables": [
+              "SecurityAlert"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "SecurityAlert",
+                "ahTable": "SecurityAlert",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 32,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/62/content/items/3/content/query",
+          "sourceSha256": "0510124e9e2e0050312b7e85075f4ede40a20cde14a6c7e228ff3c5ed7a8a7fa",
+          "targetSha256": "0510124e9e2e0050312b7e85075f4ede40a20cde14a6c7e228ff3c5ed7a8a7fa"
+        },
+        {
+          "sourcePath": "/items/62/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "c7c7df7094a339e5e22d115c7ee5595eadd1b0dc2f137af7a5581c6dfde09212"
+          },
+          "conversion": {
+            "sourceId": "/items/62/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// SLA thresholds by severity for email-security (MDO) incidents\r\nlet SLA_Variables = datatable (Severity:string, TimeToResolve:int) [\r\n    \"High\", 60,\r\n    \"Medium\", 120,\r\n    \"Low\", 240,\r\n    \"Informational\", 480\r\n];\r\n\r\n// Identify MDO-related incidents via alert correlation\r\nlet EmailSecurityIncidents = \r\n    SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for each MDO-related incident\r\nlet LatestMdoIncidents =\r\n    SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, Severity, CreatedTime, ClosedTime, Title) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    | where not(Title startswith \"CC_\");  // Exclude non-email incidents as needed\r\n\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| extend TimeToResolveIncident = datetime_diff('minute', ClosedTime, CreatedTime)\r\n| join kind=inner SLA_Variables on Severity\r\n| summarize\r\n    ['Avg Time to Close (min)'] = avg(TimeToResolveIncident),\r\n    CountIncidents = count(), Breached = countif(TimeToResolveIncident > TimeToResolve)\r\n    by Day = bin(ClosedTime, 1d), Severity\r\n| order by Day asc, Severity asc",
+            "resolvedTables": [
+              "SecurityAlert"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "SecurityAlert",
+                "ahTable": "SecurityAlert",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 32,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/62/content/items/5/content/query",
+          "sourceSha256": "c7c7df7094a339e5e22d115c7ee5595eadd1b0dc2f137af7a5581c6dfde09212",
+          "targetSha256": "c7c7df7094a339e5e22d115c7ee5595eadd1b0dc2f137af7a5581c6dfde09212"
+        },
+        {
+          "sourcePath": "/items/62/content/items/6/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "493db12dce8505fe5fc8a428b0234b0edab5aa969ffed85eba0979392066de07"
+          },
+          "conversion": {
+            "sourceId": "/items/62/content/items/6/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// Build a list of MDO-related incidents by cross-referencing SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get only the most recent state of each incident, ensuring it's MDO-related\r\nlet LatestIncidents = SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    | where not(Title startswith \"CC_\");  // Exclude incidents unrelated to MDO (e.g., DSPM)\r\n\r\nLatestIncidents\r\n| where Status == 'Closed'                                     // (Optional) Limit to closed/fully classified incidents\r\n| summarize Count = count() by Classification = iif(\r\n    isnull(Classification) or trim(\" \", Classification) == \"\",\r\n    \"Not Set\", \r\n    Classification\r\n  )\r\n| order by Count desc",
+            "resolvedTables": [
+              "SecurityAlert"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "SecurityAlert",
+                "ahTable": "SecurityAlert",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 32,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/62/content/items/6/content/items/3/content/query",
+          "sourceSha256": "493db12dce8505fe5fc8a428b0234b0edab5aa969ffed85eba0979392066de07",
+          "targetSha256": "493db12dce8505fe5fc8a428b0234b0edab5aa969ffed85eba0979392066de07"
+        },
+        {
+          "sourcePath": "/items/62/content/items/6/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5223b5ffad53a8e07a06758ad06c08ee75ba11e8f5a50644108e80cb8123de41"
+          },
+          "conversion": {
+            "sourceId": "/items/62/content/items/6/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n    SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n    SecurityIncident\r\n    | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n    | where ProviderIncidentId in (EmailSecurityIncidents)\r\n    // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n    | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n    TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n    TotalClosed       = count()\r\n| extend TruePositiveRate = iff(\r\n    TotalClosed > 0,\r\n    TruePositiveCount * 100.0 / TotalClosed,\r\n    real(null)\r\n)",
+            "resolvedTables": [
+              "SecurityAlert"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "SecurityAlert",
+                "ahTable": "SecurityAlert",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 32,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/62/content/items/6/content/items/4/content/query",
+          "sourceSha256": "5223b5ffad53a8e07a06758ad06c08ee75ba11e8f5a50644108e80cb8123de41",
+          "targetSha256": "5223b5ffad53a8e07a06758ad06c08ee75ba11e8f5a50644108e80cb8123de41"
+        },
+        {
+          "sourcePath": "/items/62/content/items/6/content/items/5/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "cbf34290f39ff95c283975a7fd08261058cd70b52ac8e2fd3aa333fb11ed8820"
+          },
+          "conversion": {
+            "sourceId": "/items/62/content/items/6/content/items/5/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n    | mv-expand AlertIds\r\n    | where isnotempty(AlertIds)\r\n    | extend AlertId = tostring(AlertIds)\r\n    | join kind=inner (\r\n        SecurityAlert\r\n        | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n        | extend AlertId = tostring(SystemAlertId)\r\n        | project AlertId\r\n    ) on AlertId\r\n    | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\")          // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff(                       // Add strings for your automation systems\r\n        tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n        \"Automated\",\r\n        \"Human\"\r\n    )\r\n| summarize ClosedCount = count() by ClosedBy",
+            "resolvedTables": [
+              "SecurityAlert"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "SecurityAlert",
+                "ahTable": "SecurityAlert",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 32,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/62/content/items/6/content/items/5/content/query",
+          "sourceSha256": "cbf34290f39ff95c283975a7fd08261058cd70b52ac8e2fd3aa333fb11ed8820",
+          "targetSha256": "cbf34290f39ff95c283975a7fd08261058cd70b52ac8e2fd3aa333fb11ed8820"
+        },
+        {
+          "sourcePath": "/items/63/content/items/2/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "db26d96be276c8946212e0211434d4267fdf79ce1261ad7974477d966fb1c7f9"
+          },
+          "conversion": {
+            "sourceId": "/items/63/content/items/2/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query attempts to show AIR Efficiency Over Time by displaying the number of successes and failures over time\r\nEmailPostDeliveryEvents\r\n| where ActionType =~ \"Automated Remediation\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by bin(Timestamp, {Granularity}), ActionResult",
+            "resolvedTables": [
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/63/content/items/2/content/query",
+          "sourceSha256": "db26d96be276c8946212e0211434d4267fdf79ce1261ad7974477d966fb1c7f9",
+          "targetSha256": "db26d96be276c8946212e0211434d4267fdf79ce1261ad7974477d966fb1c7f9"
+        },
+        {
+          "sourcePath": "/items/63/content/items/4/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "ba98b4288543b6bc2c36341afad18fd44fddec3ef80da5315adaf5fb63391815"
+          },
+          "conversion": {
+            "sourceId": "/items/63/content/items/4/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// SOC metric: Daily average/p75 delay (in minutes) from email delivery to AIR action\r\nlet deliveries = EmailEvents\r\n  | where DeliveryAction == \"Delivered\"// delivered emails\r\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n  | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\r\nlet remediations = EmailPostDeliveryEvents\r\n  | where ActionType =~ \"Automated Remediation\"// automated remediation events\r\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n  | summarize FirstRemediation = min(Timestamp) by MsgKey;\r\ndeliveries\r\n| join kind=inner remediations on MsgKey\r\n| extend DelayMinutes = datetime_diff(\"minute\", FirstRemediation, FirstDelivery)\r\n| where DelayMinutes >= 0\r\n| summarize ['Avg (min)'] = avg(DelayMinutes),\r\n            ['P80 (min)'] = percentile(DelayMinutes, 80),\r\n            ['P90 (min)'] = percentile(DelayMinutes, 90),\r\n            ['P99 (min)'] = percentile(DelayMinutes, 99),\r\n            CountEmails = count()\r\n   by bin(FirstRemediation, 1d) ",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/63/content/items/4/content/query",
+          "sourceSha256": "ba98b4288543b6bc2c36341afad18fd44fddec3ef80da5315adaf5fb63391815",
+          "targetSha256": "ba98b4288543b6bc2c36341afad18fd44fddec3ef80da5315adaf5fb63391815"
+        },
+        {
+          "sourcePath": "/items/63/content/items/7/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "5014049df6a062e39d058ec8a8dd718242035db12af272e5181956a41da6fadd"
+          },
+          "conversion": {
+            "sourceId": "/items/63/content/items/7/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "// AIR investigation outcomes by day: ThreatDetected vs. Clean\r\n\r\n// Step 1: Deduplicate automated remediation events by message and recipient\r\nlet AutoRemediations = \r\n    EmailPostDeliveryEvents\r\n    | where ActionType == \"Automated Remediation\"\r\n    | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\r\n    | project NetworkMessageId, RecipientEmailAddress, Timestamp;\r\n\r\n// Step 2: Derive threat verdicts using AlertEvidence\r\nlet EvidenceVerdicts =\r\n    AlertEvidence\r\n    | where EntityType in (\"MailMessage\", \"MailCluster\")\r\n    | extend extra = todynamic(AdditionalFields)\r\n    // If this is a mail cluster, use provided NetworkMessageIds array; otherwise wrap NetworkMessageId as a single-item array\r\n    | extend networkIds = iff(\r\n      isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\r\n      pack_array(NetworkMessageId),          // create a single-element array using pack_array\r\n      extra.NetworkMessageIds                // use the array as-is if it exists\r\n    )\r\n    | mv-expand nmID = networkIds                // expand to individual message IDs\r\n    // Derive verdict from LastVerdict, ThreatAnalysisSummary, and ThreatIntelligence\r\n    | extend \r\n        lastVerdict = tolower(tostring(extra.LastVerdict)),\r\n        threatAIList = extra.ThreatAnalysisSummary,\r\n        threatInt   = extra.ThreatIntelligence\r\n    | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \"\"),\r\n             verdictTI          = iff(array_length(threatInt) > 0, \"malicious\", \"\")   // any item in ThreatIntelligence indicates malicious\r\n    // Mark as threat-detected if verdict is malicious/suspicious or threat evidence is present\r\n    | extend ThreatDetectedFlag = \r\n        case(\r\n            lastVerdict in (\"malicious\",\"suspicious\") or verdictFromAnalysis in (\"malicious\",\"suspicious\")\r\n                or verdictTI == \"malicious\",\r\n            true,\r\n            false\r\n        )\r\n    // Weight mail clusters by MailCount; default to 1 for single messages\r\n    | extend MailCountInt = toint(extra.MailCount)\r\n    | extend Weight = iff(EntityType == \"MailCluster\", \r\n                        coalesce(MailCountInt, 1), // default to 1 if MailCount is missing\r\n                        1)\r\n    | summarize IsThreatDetected = any(ThreatDetectedFlag), \r\n                WeightSum       = sum(Weight) \r\n    by nmID = tostring(nmID);\r\n\r\n// Step 3: Join remediation events with verdicts and aggregate by day\r\nAutoRemediations\r\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\r\n| extend isThreat      = coalesce(IsThreatDetected, false), \r\n         effectiveWeight= coalesce(WeightSum, 1)\r\n| extend InvestigationOutcome = iif(isThreat, \"Threat Detected\", \"Clean\")\r\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, {Granularity}), InvestigationOutcome\r\n| order by Day asc, InvestigationOutcome asc",
+            "resolvedTables": [
+              "AlertEvidence",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "AlertEvidence",
+                "ahTable": "AlertEvidence",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 40,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/63/content/items/7/content/query",
+          "sourceSha256": "5014049df6a062e39d058ec8a8dd718242035db12af272e5181956a41da6fadd",
+          "targetSha256": "5014049df6a062e39d058ec8a8dd718242035db12af272e5181956a41da6fadd"
+        },
+        {
+          "sourcePath": "/items/63/content/items/8/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0226dd4221a3b939b75d850f4478883a00977f3e7d87c446a924b2cfb3ceded0"
+          },
+          "conversion": {
+            "sourceId": "/items/63/content/items/8/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger",
+            "resolvedTables": [
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/63/content/items/8/content/query",
+          "sourceSha256": "0226dd4221a3b939b75d850f4478883a00977f3e7d87c446a924b2cfb3ceded0",
+          "targetSha256": "0226dd4221a3b939b75d850f4478883a00977f3e7d87c446a924b2cfb3ceded0"
+        },
+        {
+          "sourcePath": "/items/63/content/items/9/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "914013b498753b6c0292c45e127dae55a5c25f727e651e9cd6a17c5cd31f6f9c"
+          },
+          "conversion": {
+            "sourceId": "/items/63/content/items/9/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//This query visualises the daily ammount of emails that had an admin post delivery action, summarizing the data by action type\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\"\r\n| summarize [\"Soft Delete\"]=countif(Action has 'Soft Delete'), [\"Hard Delete\"]=countif(Action has 'Hard Delete'), [\"Moved to junk folder\"]=countif(Action has 'Moved to junk folder'), [\"Moved to inbox\"]=countif(Action has 'Moved to inbox'), [\"Quarantine release\"]=countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Soft Delete\"]=coalesce([\"Soft Delete\"],0), [\"Hard Delete\"]=coalesce([\"Hard Delete\"],0), [\"Moved to junk folder\"]=coalesce([\"Moved to junk folder\"],0), [\"Moved to inbox\"]=coalesce([\"Moved to inbox\"],0), [\"Quarantine release\"]=coalesce([\"Quarantine release\"],0)\r\n| sort by Timestamp asc",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailPostDeliveryEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailPostDeliveryEvents",
+                "ahTable": "EmailPostDeliveryEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 15,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/63/content/items/9/content/items/1/content/query",
+          "sourceSha256": "914013b498753b6c0292c45e127dae55a5c25f727e651e9cd6a17c5cd31f6f9c",
+          "targetSha256": "914013b498753b6c0292c45e127dae55a5c25f727e651e9cd6a17c5cd31f6f9c"
+        },
+        {
+          "sourcePath": "/items/64/content/items/1/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "aef89150f39c48e8af94fb3ed7258e8e02bf8d0af7ec1ad00cdecc1db1758fa7"
+          },
+          "conversion": {
+            "sourceId": "/items/64/content/items/1/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Largest malicious inbound email campaigns clustered by EmailClusterId - one row per attack wave (messages, recipients, URL clicks, sender domains, threat mix, sample subjects).\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n            Recipients = dcount(RecipientEmailAddress),\r\n            SenderDomains = dcount(SenderFromDomain),\r\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n            SampleSubjects = make_set(Subject, 5),\r\n            FirstSeen = min(Timestamp),\r\n            LastSeen = max(Timestamp)\r\n        by EmailClusterId\r\n| join kind=leftouter (clicksByCluster) on EmailClusterId\r\n| extend UrlClicks = coalesce(UrlClicks, 0)\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by Messages\r\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['URL Clicks']=UrlClicks, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailUrlInfo",
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailUrlInfo",
+                "ahTable": "EmailUrlInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 7,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/64/content/items/1/content/query",
+          "sourceSha256": "aef89150f39c48e8af94fb3ed7258e8e02bf8d0af7ec1ad00cdecc1db1758fa7",
+          "targetSha256": "aef89150f39c48e8af94fb3ed7258e8e02bf8d0af7ec1ad00cdecc1db1758fa7"
+        },
+        {
+          "sourcePath": "/items/64/content/items/3/content/query",
+          "parameter": false,
+          "resolutionEvidence": {
+            "actor": "kingwil",
+            "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved",
+            "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb",
+            "decision": "accept",
+            "querySha256": "0af7c322d60d2eaebbf2682473849eb391620da706669fd90fe8d98a4cd85070"
+          },
+          "conversion": {
+            "sourceId": "/items/64/content/items/3/content/query",
+            "artifactType": "workbook",
+            "status": "converted",
+            "convertedKql": "//Malicious inbound campaigns ranked by recipient URL clicks - the attack waves that reached a mailbox and drew engagement, regardless of message volume.\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n            Recipients = dcount(RecipientEmailAddress),\r\n            SenderDomains = dcount(SenderFromDomain),\r\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n            SampleSubjects = make_set(Subject, 5),\r\n            FirstSeen = min(Timestamp),\r\n            LastSeen = max(Timestamp)\r\n        by EmailClusterId\r\n| join kind=inner (clicksByCluster) on EmailClusterId\r\n| where UrlClicks > 0\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by UrlClicks\r\n| project ['Email Cluster ID']=EmailClusterId, ['URL Clicks']=UrlClicks, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen",
+            "resolvedTables": [
+              "EmailEvents",
+              "EmailUrlInfo",
+              "UrlClickEvents"
+            ],
+            "mappingTier": "1to1",
+            "renamedTables": {},
+            "renamedAsimTables": {},
+            "diff": [],
+            "schemaMap": [
+              {
+                "sentinelTable": "EmailEvents",
+                "ahTable": "EmailEvents",
+                "identical": false,
+                "verdict": "Hard",
+                "score": 0.98,
+                "columns": [
+                  {
+                    "sentinel": "AdditionalFields",
+                    "ah": "AdditionalFields",
+                    "laType": "dynamic",
+                    "ahType": "string",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "AttachmentCount",
+                    "ah": "AttachmentCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "AuthenticationDetails",
+                    "ah": "AuthenticationDetails",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "BulkComplaintLevel",
+                    "ah": "BulkComplaintLevel",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Cc",
+                    "ah": "Cc",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ConfidenceLevel",
+                    "ah": "ConfidenceLevel",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Connectors",
+                    "ah": "Connectors",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Context",
+                    "ah": "Context",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryAction",
+                    "ah": "DeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DeliveryLocation",
+                    "ah": "DeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DetectionMethods",
+                    "ah": "DetectionMethods",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "DistributionList",
+                    "ah": "DistributionList",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailAction",
+                    "ah": "EmailAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicy",
+                    "ah": "EmailActionPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailActionPolicyGuid",
+                    "ah": "EmailActionPolicyGuid",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailClusterId",
+                    "ah": "EmailClusterId",
+                    "laType": "long",
+                    "ahType": "long",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailDirection",
+                    "ah": "EmailDirection",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailLanguage",
+                    "ah": "EmailLanguage",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "EmailSize",
+                    "ah": "EmailSize",
+                    "laType": "int",
+                    "ahType": "long",
+                    "relation": "compatible"
+                  },
+                  {
+                    "sentinel": "ExchangeTransportRule",
+                    "ah": "ExchangeTransportRule",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ForwardingInformation",
+                    "ah": "ForwardingInformation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "InternetMessageId",
+                    "ah": "InternetMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "IsFirstContact",
+                    "ah": "IsFirstContact",
+                    "laType": "bool",
+                    "ahType": "bool",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LastEventExecutionTime",
+                    "laType": "datetime",
+                    "ah": null,
+                    "ahType": null,
+                    "relation": "missing",
+                    "suggestion": null,
+                    "suggestionSource": null,
+                    "note": "no direct AH equivalent; flag for review"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryAction",
+                    "ah": "LatestDeliveryAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "LatestDeliveryLocation",
+                    "ah": "LatestDeliveryLocation",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "NetworkMessageId",
+                    "ah": "NetworkMessageId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelAction",
+                    "ah": "OrgLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "OrgLevelPolicy",
+                    "ah": "OrgLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientDomain",
+                    "ah": "RecipientDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientEmailAddress",
+                    "ah": "RecipientEmailAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "RecipientObjectId",
+                    "ah": "RecipientObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ReportId",
+                    "ah": "ReportId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderDisplayName",
+                    "ah": "SenderDisplayName",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromAddress",
+                    "ah": "SenderFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderFromDomain",
+                    "ah": "SenderFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv4",
+                    "ah": "SenderIPv4",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderIPv6",
+                    "ah": "SenderIPv6",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromAddress",
+                    "ah": "SenderMailFromAddress",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderMailFromDomain",
+                    "ah": "SenderMailFromDomain",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "SenderObjectId",
+                    "ah": "SenderObjectId",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Subject",
+                    "ah": "Subject",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatClassification",
+                    "ah": "ThreatClassification",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatNames",
+                    "ah": "ThreatNames",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "ThreatTypes",
+                    "ah": "ThreatTypes",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "TimeGenerated",
+                    "ah": "TimeGenerated",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "Timestamp",
+                    "ah": "Timestamp",
+                    "laType": "datetime",
+                    "ahType": "datetime",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "To",
+                    "ah": "To",
+                    "laType": "dynamic",
+                    "ahType": "dynamic",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UrlCount",
+                    "ah": "UrlCount",
+                    "laType": "int",
+                    "ahType": "int",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelAction",
+                    "ah": "UserLevelAction",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  },
+                  {
+                    "sentinel": "UserLevelPolicy",
+                    "ah": "UserLevelPolicy",
+                    "laType": "string",
+                    "ahType": "string",
+                    "relation": "exact"
+                  }
+                ],
+                "extraInAh": []
+              },
+              {
+                "sentinelTable": "EmailUrlInfo",
+                "ahTable": "EmailUrlInfo",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 7,
+                "note": "schema identical; no column changes"
+              },
+              {
+                "sentinelTable": "UrlClickEvents",
+                "ahTable": "UrlClickEvents",
+                "identical": true,
+                "verdict": "Easy",
+                "score": 1.0,
+                "columnCount": 16,
+                "note": "schema identical; no column changes"
+              }
+            ],
+            "recommendations": [],
+            "confidence": 0.7,
+            "unsupported": [],
+            "validation": null,
+            "blockedReason": null
+          },
+          "status": "converted",
+          "outputPath": "/items/64/content/items/3/content/query",
+          "sourceSha256": "0af7c322d60d2eaebbf2682473849eb391620da706669fd90fe8d98a4cd85070",
+          "targetSha256": "0af7c322d60d2eaebbf2682473849eb391620da706669fd90fe8d98a4cd85070"
+        }
+      ]
+    },
+    "requiredWorkloads": [
+      {
+        "workload": "mdo",
+        "dataTypes": [
+          "EmailEvents",
+          "EmailPostDeliveryEvents",
+          "EmailUrlInfo",
+          "UrlClickEvents",
+          "MessageEvents",
+          "MessageUrlInfo",
+          "MessagePostDeliveryEvents",
+          "FileMaliciousContentInfo"
+        ]
+      },
+      {
+        "workload": "mda",
+        "dataTypes": [
+          "CloudAppEvents"
+        ]
+      },
+      {
+        "workload": "mtp",
+        "dataTypes": [
+          "AlertEvidence"
+        ]
+      },
+      {
+        "workload": "sentinel",
+        "dataTypes": [
+          "SecurityAlert"
+        ]
+      }
+    ],
+    "requiredDataConnectors": [
+      {
+        "connectorId": "MicrosoftThreatProtection",
+        "dataTypes": [
+          "SecurityAlert"
+        ]
+      }
+    ],
+    "dependencyReviewRequired": false
+  }
+}

From afa01a80f7a7a252ac83f4fa2cf0d4590b6c4b96 Mon Sep 17 00:00:00 2001
From: kingwil <5839248+kingwil@users.noreply.github.com>
Date: Wed, 14 Oct 2026 20:23:14 +0100
Subject: [PATCH 2/7] Preserve existing Sentinel content alongside new XDR
 workbooks

Restore the complete existing solution selections and regenerate the additive 3.2.1 candidate package.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Data/Solution_Microsoft Defender XDR.json |   446 +-
 .../Microsoft Defender XDR/Package/3.2.1.zip  |   Bin 243596 -> 554561 bytes
 .../Package/createUiDefinition.json           |  6128 ++-
 .../Package/mainTemplate.json                 | 43971 +++++++++++++++-
 .../Package/testParameters.json               |    45 +
 5 files changed, 50107 insertions(+), 483 deletions(-)

diff --git a/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json b/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json
index 418bfdf88ef..b885e61138a 100644
--- a/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json	
+++ b/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json	
@@ -2,14 +2,448 @@
   "Name": "Microsoft Defender XDR",
   "Author": "Microsoft - support@microsoft.com",
   "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
-  "Description": "Workbook-only authoring candidate for Microsoft Defender XDR: Defender for Endpoint, Defender for Identity, and Office 365 Detections & Insights. Includes the Microsoft Defender XDR connector prerequisite for panels using connected Sentinel SecurityAlert data. Detection rules, hunting queries, playbooks, and Sentinel workbook installation are excluded. Live installation and runtime qualification are not established.",
+  "Description": "The [Microsoft Defender XDR](https://www.microsoft.com/security/business/threat-protection/microsoft-365-defender) solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.\n\nAdditional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on [GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender). This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)",
   "Data Connectors": [
     "Data Connectors/MicrosoftThreatProtection.json"
   ],
-  "Analytic Rules": [],
-  "Hunting Queries": [],
-  "Workbooks": [],
+  "Analytic Rules": [
+    "Analytic Rules/PossiblePhishingwithCSL&NetworkSession.yaml",
+    "Analytic Rules/SUNSPOTHashes.yaml",
+    "Analytic Rules/PotentialBuildProcessCompromiseMDE.yaml",
+    "Analytic Rules/SolarWinds_TEARDROP_Process-IOCs.yaml",
+    "Analytic Rules/SolarWinds_SUNBURST_Network-IOCs.yaml",
+    "Analytic Rules/SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs.yaml",
+    "Analytic Rules/AVdetectionsrelatedtoUkrainebasedthreats.yaml",
+    "Analytic Rules/AVTarrask.yaml",
+    "Analytic Rules/AVSpringShell.yaml",
+    "Analytic Rules/PossibleWebpBufferOverflow.yaml",
+    "Analytic Rules/Campaign/Jupyter-Solarmaker/DeimosComponentExecution.yaml",
+    "Analytic Rules/Campaign/Macaw Ransomware/ImminentRansomware.yaml",
+    "Analytic Rules/Campaign/Sysrv-botnet/MaliciousCMDExecutionByJava.yaml",
+    "Analytic Rules/Command and Control/C2-NamedPipe.yaml",
+    "Analytic Rules/Credential Access/DoppelPaymerProcDump.yaml",
+    "Analytic Rules/Credential Access/LSASSCredDumpProcdump.yaml",
+    "Analytic Rules/Defense Evasion/DoppelpaymerStopService.yaml",
+    "Analytic Rules/Defense Evasion/QakbotCampaignSelfDeletion.yaml",
+    "Analytic Rules/Defense Evasion/Regsvr32Rundll32ImageLoadsAbnormalExtension.yaml",
+    "Analytic Rules/Defense Evasion/Regsvr32Rundll32WithAnomalousParentProcess.yaml",
+    "Analytic Rules/Discovery/SuspiciousCommandInitiatedByWebServerProcess.yaml",
+    "Analytic Rules/Execution/BITSAdminActivity.yaml",
+    "Analytic Rules/Execution/OfficeAppsLaunchingWscript.yaml",
+    "Analytic Rules/Execution/PotentialKerberoastActivities.yaml",
+    "Analytic Rules/Exfiltration/FilesCopiedToUSBDrives.yaml",
+    "Analytic Rules/Exploits/MosaicLoader.yaml",
+    "Analytic Rules/Impact/AnomalousVoulmeOfFileDeletion.yaml",
+    "Analytic Rules/Lateral Movement/RemoteFileCreationWithPsExec.yaml",
+    "Analytic Rules/Lateral Movement/ServiceAccountsPerformingRemotePS.yaml",
+    "Analytic Rules/Persistence/AccountCreation.yaml",
+    "Analytic Rules/Persistence/LocalAdminGroupChanges.yaml",
+    "Analytic Rules/Persistence/RareProcessAsService.yaml",
+    "Analytic Rules/Ransomware/DEV-0270/DisableSecurityServiceViaRegistry.yaml",
+    "Analytic Rules/Ransomware/DataDeletionOnMulipleDrivesUsingCipherExe.yaml",
+    "Analytic Rules/Ransomware/LaZagneCredTheft.yaml",
+    "Analytic Rules/Ransomware/LogDeletionUsingWevtutil.yaml",
+    "Analytic Rules/Ransomware/MultiProcessKillWithTaskKill.yaml",
+    "Analytic Rules/Ransomware/PotentialCobaltStrikeRansomwareActivity.yaml",
+    "Analytic Rules/Ransomware/QakbotDiscoveryActivities.yaml",
+    "Analytic Rules/Ransomware/ShadowCopyDeletion.yaml"
+  ],
+  "Hunting Queries": [
+    "Hunting Queries/Appspot Phishing Abuse.yaml",
+    "Hunting Queries/Campaigns/Bazacall/PayloadDropUsingCertUtil.yaml",
+    "Hunting Queries/Campaigns/JudgementPandaExfilActivity.yaml",
+    "Hunting Queries/Campaigns/Jupyter-Solarmaker/DeimosComponentExecution.yaml",
+    "Hunting Queries/Campaigns/LemonDuck/LemonDuckRegistrationFunction.yaml",
+    "Hunting Queries/Campaigns/Log4j/DeviceWithLog4jAlerts.yaml",
+    "Hunting Queries/Campaigns/Log4j/Log4jVulnRelatedAlerts.yaml",
+    "Hunting Queries/Campaigns/Macaw Ransomware/ImminentRansomware.yaml",
+    "Hunting Queries/Campaigns/Macaw Ransomware/MaliciousUseOfMSBuildAsLoLBin.yaml",
+    "Hunting Queries/Campaigns/Qakbot/QakbotReconActivities.yaml",
+    "Hunting Queries/Campaigns/RobbinhoodDriver.yaml",
+    "Hunting Queries/Campaigns/Snip3MaliciousNetworkConnectivity.yaml",
+    "Hunting Queries/Campaigns/Sysrv-botnet/MaliciousCMDExecutionByJava.yaml",
+    "Hunting Queries/Check for spoofing attempts on the domain with Authentication failures.yaml",
+    "Hunting Queries/Command and Control/C2-NamedPipe.yaml",
+    "Hunting Queries/Command and Control/ReconWithRundll.yaml",
+    "Hunting Queries/Credential Access/DoppelPaymerProcdump.yaml",
+    "Hunting Queries/Credential Access/LaZagne.yaml",
+    "Hunting Queries/Credential Access/LSASSCredDumpProcdump.yaml",
+    "Hunting Queries/Defense Evasion/ClearSystemLogs.yaml",
+    "Hunting Queries/Defense Evasion/DoppelpaymerStopServices.yaml",
+    "Hunting Queries/Defense Evasion/QakbotCampaignSelfDeletion.yaml",
+    "Hunting Queries/Defense Evasion/Regsvr32Rundll32ImageLoadsAbnormalExtension.yaml",
+    "Hunting Queries/Defense Evasion/Regsvr32Rundll32WithAnomalousParentProcess.yaml",
+    "Hunting Queries/Delivered Bad Emails from Top bad IPv4 addresses.yaml",
+    "Hunting Queries/Discovery/SuspiciousCommandInitiatedByWebServerProcess.yaml",
+    "Hunting Queries/Discovery/User&GroupEnumWithNetCommand.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Attachment/ATP policy status check.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Attachment/JNLP attachment.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Attachment/Safe attachment detection.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/Authentication failures.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/CompAuth Failure Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/DKIM Failure Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/DMARC Failure Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/SPF Failure Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/Spoof attempts with auth failure.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof detections by Sender Domain.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof DMARC detections by Sender Domain.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/Top Spoof Intra-Org detections by SenderDomain.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Custom Detections/Message from Accepted Domain with DMARC TempError.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Custom Detections/Message with URL listed on OpenPhish delivered into Inbox.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Custom Detections/Potential OAuth phishing email delivered into Inbox.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Custom Detections/Potentially malicious SVG file delivered into Inbox.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Audit Email Preview-Download action.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Bad email percentage - Inbound emails.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Calculate MDO Efficacy.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Email sender IP address Geo location information.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Hunt for Admin email access.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Hunt for TABL changes.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Local time to UTC time conversion.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Mail item accessed.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Malicious email senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/MDO daily detection summary report.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/New TABL Items.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Top 10 Domains sending Malicious Emails (Malware+Phish+Spam).yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Malware).yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Phish).yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders (Spam).yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Top 10 External Senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Top 10 Targeted Users (Malware+Phish+Spam).yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam).yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Total number of detections by MDO over time.yaml",
+    "Hunting Queries/Email and Collaboration Queries/General/Total number of detections by MDO.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Automated email notifications and suspicious sign-in activity.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/BEC - File sharing tactics - Dropbox.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/BEC - File sharing tactics - OneDrive or SharePoint.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Email bombing.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Emails containing links to IP addresses.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Files share contents and suspicious sign-in activity.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Good emails from senders with bad patterns.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for email bombing attacks.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for email conversation take over attempts.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for malicious attachments using external IOC source.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Hunt for malicious URLs using external IOC source.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Inbox rule change which forward-redirect email.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_CountOfRecipientsEmailaddressbySubject.YAML",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_Countofrecipientsemailaddressesbysubject.YAML",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_CountOfSendersEmailaddressbySubject.YAML",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_SummaryOfSenders.YAML",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/MDO_URLClickedinEmail.YAML",
+    "Hunting Queries/Email and Collaboration Queries/Hunting/Top outbound recipient domains sending inbound emails with threats.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Detections by detection methods.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Mail reply to new domain.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Mailflow by directionality.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Malicious emails detected per day.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Sender recipient contact establishment.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Spam Detections by Delivery Location - High.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Spam Detections by Delivery Location - Medium.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top 100 malicious email senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top 100 senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Zero day threats.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Email containing malware accessed on a unmanaged device.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Email containing malware sent by an internal sender.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Email malware detection report.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detection Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by AV.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by Safe Attachments.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detection Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Delivery Location.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Detection Technology Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Detection Technology.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware detections by Workload Locations.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware detections by Workload Type.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Top Domains sending Malware.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Top Email Malware Families.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Top Users receiving Malware.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Zero-day Malware Detections Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Communication from suspicious external users.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Communication to suspicious external users.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Expanding recipients into separate rows.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/External malicious Teams messages sent from internal senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for malicious messages using External Threat Intelligence.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Inbound Teams messages by sender domains.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious Teams messages by URL detection methods.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious Teams messages received from external senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Microsoft Teams chat initiated by a suspicious external user.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Number of unique accounts performing Teams message Admin submissions.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Number of unique accounts performing Teams message User  submissions.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Possible partner impersonation in external Team messages.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Possible Teams phishing activity.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Potentially malicious URL click in Teams.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Rare Domains in External Teams Messages.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Suspicious Teams Display Name.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin submission of Malware and Phish daily trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin submission of No Threats daily trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Admin-User Submissions Grading Verdicts.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams blocked URL clicks daily trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Malware ZAP .yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Message with URL listed on OpenPhish.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams message ZAPed with the same URL in Email.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams messages from a specific sender by ThreadType.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams messages with suspicious URL domains.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Phish ZAP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams post delivery events daily trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams Spam ZAP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams URL clicks actions summarized by URLs clicked on.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams URL clicks through actions on Phish or Malware URLs summarized by URLs.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams User submissions daily trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams users clicking on suspicious URL domains.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 Attacked user by Phish messages.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 external senders sending Teams messages.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 External senders sending Teams phishing messsages.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 sender domains - Admin Teams message submissions FN.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 sender domains - Teams user submissions FN or FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders - Teams users submissions FN or FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders of  Admin Teams message submissions FN.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 senders of  Admin Teams message submissions FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top 10 Users clicking on malicious URLs in Teams.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top accounts performing Teams admin submissions FN or FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top accounts performing Teams user submissions FN or FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top domains outbound sending Malicious Teams messages inbound.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top external malicious senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Malware.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Phish.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top External Sender domains - Spam.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Top malicious URLs clicked by users in Teams.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Total number of MDO Teams protection detections daily.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/URL click on URLs in ZAP-d Teams messages.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Spam and Phish delivered to Inbox due to Admin Overrides.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Spam and Phish delivered to Inbox due to User Overrides.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Top policies performing admin overrides.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Top policies performing user overrides.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with Admin Overrides - Allow.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with Admin Overrides - Block.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with User Overrides - Allow.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Total Emails with User Overrides - Block.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detection Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location - High.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location - Medium.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Delivery Location Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Detection Technology Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Detection Technology.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Possible device code phishing attempts.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Top Domains sending Phish.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Top Users receiving Phish.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Zero-day Phish Detections Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Campaign with randomly named attachments.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Campaign with suspicious keywords.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Custom detection-Emails with QR from non-prevalent senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Emails delivered having URLs from QR codes.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Emails with QR codes and suspicious keywords in subject.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Emails with QR codes from non-prevalent sender.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Hunting for sender patterns.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Hunting for user signals-clusters.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Inbound emails with QR code URLs.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Personalized campaigns based on the first few keywords.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Personalized campaigns based on the last few keywords.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Risky sign-in attempt from a non-managed device.yaml",
+    "Hunting Queries/Email and Collaboration Queries/QR code/Suspicious sign-in attempts from QR code phishing campaigns.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Group quarantine release.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/High Confidence Phish Released.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Phish reason trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Phish reason.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Release Email Details.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine release trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine releases by Detection types.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Spam reason trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Spam reason.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Remediation/AIR investigation actions insight.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Remediation/Email remediation action list.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Bulk Detection Top10 Domains.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Delivery Location.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection IP and Geo Position.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Mails with BCL.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Tech.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top10 Domains.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top10 Users.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top15 Domains Details.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Top15 Users Details.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detection Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detections by Detection technology.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Display Name - Spoof and Impersonation.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections by Detection Technology Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections by Detection Technology.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation Phishing detections trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Referral phish emails.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof and impersonation detections by sender IP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof and impersonation phish detections.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections by Detection Technology Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections by Detection Technology.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Spoof detections trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Top Domains with BEC Threats inbound.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/User not covered under display name impersonation.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submission Trend - FN.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submission Trend - FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Method - Phish FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Method - Spam FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Detection Type.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Grading Verdict - FN-FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission State - FN.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission State - FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission Type - FN.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Admin Submissions by Submission Type - FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing admin submissions - FN.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing admin submissions - FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing user submissions.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Top Detection Overrides - Admin Submissions.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Top Sender Domains - Admin Submissions FN.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Top Sender Domains - Admin Submissions FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Total Submissions by Submission Status.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Total Submissions by Submission Type.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User reported submissions.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submission Accuracy versus Admin Verdicts.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top detection overrides by Admins.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top detection overrides by Users.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders domains.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org P2 senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org Subjects.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Admin review status.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Grading Verdict - FN-FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Submission Type.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions from Junk Folder.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions Trend - FN.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Attacked more than x times average.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Malicious mails by sender IPs.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top 10 percent of most attacked users.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top 10 URL domains attacking organization.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top external malicious senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Top targeted users.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/End user malicious clicks.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/URL click count by click action.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/URL click on ZAP Email.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/URL clicks actions by URL.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/URLClick details based on malicious URL click alert.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/User clicked through events.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/User clicks on malicious inbound emails.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/User clicks on phishing URLs in emails.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/Malicious Clicks allowed (click-through).yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/Malicious Emails with QR code Urls.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/Phishing Email Url Redirector.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/SafeLinks URL detections.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Malware).yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Phish).yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/Top 10 Users clicking on Malicious URLs (Spam).yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/URL Click attempts by threat type.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/URL Clicks by Action.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/URLs by location.yaml",
+    "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by Admin.yaml",
+    "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by Location.yaml",
+    "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events by ZAP type.yaml",
+    "Hunting Queries/Email and Collaboration Queries/ZAP/Post Delivery Events over time.yaml",
+    "Hunting Queries/EmailDelivered-ToInbox.yaml",
+    "Hunting Queries/Execution/AnomalousPayloadDeliveredWithISOFile.yaml",
+    "Hunting Queries/Execution/BitsadminActivity.yaml",
+    "Hunting Queries/Execution/MaliciousUseOfMSIExec.yaml",
+    "Hunting Queries/Execution/MaliciousUseOfMsiExecMimikatz.yaml",
+    "Hunting Queries/Execution/OfficeAppsLaunchingWscript.yaml",
+    "Hunting Queries/Execution/PotentialKerberoastActivities.yaml",
+    "Hunting Queries/Execution/PowerShellDownloads.yaml",
+    "Hunting Queries/Execution/SuspiciousAppExeutedByWebserver.yaml",
+    "Hunting Queries/Execution/SuspiciousMshtaUsage.yaml",
+    "Hunting Queries/Exfiltration/FilesCopiedToUSBDrives.yaml",
+    "Hunting Queries/Exploits/CVE-2022-26134-Confluence.yaml",
+    "Hunting Queries/Exploits/MosaicLoader.yaml",
+    "Hunting Queries/Exploits/Print Spooler RCE/SpoolsvSpawningRundll32.yaml",
+    "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousDLLInSpoolFolder.yaml",
+    "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousFilesInSpoolFolder.yaml",
+    "Hunting Queries/Exploits/Print Spooler RCE/SuspiciousSpoolsvChildProcess.yaml",
+    "Hunting Queries/Exploits/PrintNightmareUsageDetection-CVE-2021-1675.yaml",
+    "Hunting Queries/Exploits/SuspiciousFileCreationByPrintSpoolerService.yaml",
+    "Hunting Queries/General Queries/MITRESuspiciousEvents.yaml",
+    "Hunting Queries/Impact/AnomalousVoulmeOfFileDeletion.yaml",
+    "Hunting Queries/Initial Access/DetectMailSniper.yaml",
+    "Hunting Queries/Lateral Movement/AccountBruteForce.yaml",
+    "Hunting Queries/Lateral Movement/RemoteFileCreationWithPsExec.yaml",
+    "Hunting Queries/Lateral Movement/ServiceAccountsPerformingRemotePS.yaml",
+    "Hunting Queries/Persistence/AccountCreation.yaml",
+    "Hunting Queries/Persistence/LocalAdminGroupChanges.yaml",
+    "Hunting Queries/Persistence/RareProcessAsService.yaml",
+    "Hunting Queries/Persistence/ScheduledTaskCreation.yaml",
+    "Hunting Queries/Privilege Escalation/SAMNameChange_CVE-2021-42278.yaml",
+    "Hunting Queries/Ransomware/DataDeletionOnMulipleDrivesUsingCipherExe.yaml",
+    "Hunting Queries/Ransomware/DetectMultipleSignsOfRamsomwareActivity.yaml",
+    "Hunting Queries/Ransomware/DEV-0270/DisableSecurityServiceViaRegistry.yaml",
+    "Hunting Queries/Ransomware/DEV-0270/DomainDiscoveryWMICwithDLLHostExe.yaml",
+    "Hunting Queries/Ransomware/DEV-0270/MDEExclusionUsingPowerShell.yaml",
+    "Hunting Queries/Ransomware/IcedIdSuspiciousImageLoad.yaml",
+    "Hunting Queries/Ransomware/LaZagneCredTheft.yaml",
+    "Hunting Queries/Ransomware/LogDeletionUsingWevtutil.yaml",
+    "Hunting Queries/Ransomware/MultiProcessKillWithTaskKill.yaml",
+    "Hunting Queries/Ransomware/PotentialCobaltStrikeRansomwareActivity.yaml",
+    "Hunting Queries/Ransomware/QakbotDiscoveryActivities.yaml",
+    "Hunting Queries/Ransomware/ShadowCopyDeletion.yaml",
+    "Hunting Queries/Ransomware/TurningOffServicesWithSCCommad.yaml",
+    "Hunting Queries/TVM/Detect_CISA_Alert_AA22-117A2021_Top_Routinely_Exploited_Vulnerabilities.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Punycode chars lookalike domains.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for RMM tool execution following Teams messages.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Hunt for alerts correlated with Teams messages.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Identify acting user for reported phish.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Authentication/Inbound Sender Domains Failing Email Authentication.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Automatic External Email Forwarding by Type.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/First-Contact External Email Senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/New External Sender Domains Carrying Threats.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top External Domains Receiving Auto-forwarded Email.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top External Recipients Receiving Auto-forwarded Email.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Mailflow/Top Users Auto-forwarding Email Externally.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections Over Time.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections by Location.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Detections by Workload.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by MDO Detonation.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Malware Top Families by SharePoint Antivirus.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/File Scanning Coverage.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detection IP and Geo Position.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Sender Country.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Malware Detections by Threat Classification.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Top Attacked Users by Malware Threat Classification.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Malware/Top File Owners Holding Malware.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/First-Contact External Teams Senders.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Malicious files shared in Microsoft Teams.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Microsoft Teams External versus Internal Thread Exposure.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Microsoft Teams protection/Teams File Protection Summary.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/SecOps Mailbox Override Count.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/SecOps Mailbox Overrides by Threat Type.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Top Recipients Receiving Threats Delivered by Override.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Overrides/Top Sender Domains Delivering Threats via Override.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detection IP and Geo Position.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Sender Country.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phish Detections by Threat Classification.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Phishing Detected by LLM Content Analysis.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Phish/Top Attacked Users by Phish Threat Classification.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Quarantine/Quarantine Release Percentage.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Investigation Outcomes by Day.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Delivery to Action Latency.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Efficiency Over Time.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Remediation/Automated Remediation Manual versus Automatic Approval.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spam/Spam Detections by Sender Country.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Impersonation and Spoof Detections by Sender Country.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Spoof and Impersonation/Top Recipients Targeted by Impersonation or BEC.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/Top accounts performing user submissions - FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Inbound Subjects FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top Intra-Org P2 senders FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) sender domains FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions - Top email (P2) senders FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions Trend - FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Detection Method - Phish FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Detection Method - Spam FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Submissions/User Submissions by Submission State - FP.yaml",
+    "Hunting Queries/Email and Collaboration Queries/Top Attacks/Largest Malicious Email Campaigns by Cluster.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/Blocked URL Clicks by Workload.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/Top 20 Malicious URLs by Clicks.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/Top Clicks on Malicious URLs.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/URL Click-Through by Workload.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL Click/URL Threat Protection Summary.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/Malware URL Detections Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/Phishing URL Detections Trend.yaml",
+    "Hunting Queries/Email and Collaboration Queries/URL/QR Code URL Detections Trend.yaml"
+  ],
+  "Workbooks": [
+    "Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json",
+    "Workbooks/MicrosoftDefenderForEndPoint.json",
+    "Workbooks/MicrosoftDefenderForIdentity.json"
+  ],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft Defender XDR",
+  "Version": "3.2.1",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [
@@ -20,7 +454,5 @@
     "XDR Workbooks/MicrosoftDefenderForIdentity.json",
     "XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json"
   ],
-  "Playbooks": [],
-  "XDR Detections": [],
-  "Version": "3.2.1"
+  "XDR Detections": []
 }
diff --git a/Solutions/Microsoft Defender XDR/Package/3.2.1.zip b/Solutions/Microsoft Defender XDR/Package/3.2.1.zip
index 0a6451bf26c6489089275d34b3c568200a287935..4b523235a4d68ba01efb3c61d87a86098cb5b95c 100644
GIT binary patch
literal 554561
zcmV(+K;6GkO9KQH000080A`|2UHE1J(sp(L0B^4Z02crN0Aq4xVRU6xX+&jaX>MtB
zX>V>WYIARH?7i!9BS)4d_<zmz9elF4Tcn1#1H7bdO%IbyNmP?c7Ri)mt5_y;L^uE!
zBf_KHJ%EH}+H9U>A8nsx?HqTH3kWhZrEo9^@<)}DKp-wBK0ki0-}#^a=l?;-oBvA%
zGZxb~Z^@gP)~R~i>6lO2F-_={#VpZn`g<l>I}ow`PIbENUc28)C7W}$=$uGKHT!sW
z$|gMFnv0};kwu#S9JhZ{BKem$dw8uGO~QytxYh*^q)=j_+sAnB(i!Z*b0!rR2^?Ix
znEg7XlEzFksouOL{}VnU<V_%w37-}p5b}nrU-<7-hHu`I35^un%fA^@#e>qX@xzd*
zK=M@EEC1g-o)RU4zue~1k#y0Xay`q&nPM^!i3SOQZ173U|F^DLqItriPE3_%vU4t`
zLYeP=b>Fqse0uwaEO@AAf4O~gFiJn&z9BQlr!$@Z{oihr+vMACe-fI#{q|dO88NCD
zk!->w(Sqn1BNGutV!@Ls8MBFyjPOKh8b$C4e6K{5!2`V|aIXLFfB(Pa3ME<jlKlOO
znRCOX)IWCI^O|RU_yM(K%su6`J(=p{@AqH(-BUJUNyy~C_PhV%^r~a8gO_Q?;V#@1
zfxEhyG08|wmt@Sy-|rH!NC;OdE8h*hqwQFAl)bvUdxb}vgLg^Fq^3N<=LZpSMcke3
zk@UU<<NJbZ!(H9X82NktB*Z-j`5&iO#T_jci*}r&8P^C4GRgI_GtLxGm{J`*19-Pm
zDKrb<Haht)T7&&jE3{|cEnde&NK#zdNt>{Qjw7bXQe<%RJee{DUz;nE<A_PEI%i41
zLzZYoXc7`h7bFr>MJ7_j_|j7;!Yt5=EV!QWgsgu?qB5>QC|az!6_n6%7~*oL5&0p5
z&!^<C8IznTxI2}lsgN2jM+430%-jyMf6VMJ;8EeO9=Z!Bl7J?FjETsSkN{%8=lX|i
z{KuebZ}(sOU3<e7$PV^LCE)J1$qj%=vQ#Lpg<O&uRfLj2M3H%+L`=v(?URRW&LWYr
zkc^iV!P%E|#T275n4vV*yyHN`ahAZ5pj{*%8;GO8zy0<j+)=ay!4<!~VZkgBk(k2u
zGsVKU-+pTl%vB*kP45`ocF0nAt|VB37^^Bom(H|@cc?_n;PLc~DOUUzuEe;WG3k~p
zPsradjgl@cSXA#T3&h}}6R|0cI##c@;L`~A8ydAVld<aT5~ZnTL`V{YRwR<CEYff#
zS|HCX0(=RQh?GfczX*iV>Mh8Dw#nZS4CF#2@CL~bH#e8$lxj*&%u5uK9ABOlHy(;W
zt=u<0i~0XnY|hhxh1ChErY#EwAzL)%sMWsx)?Oe<@CyYRythZb{q`3j@5Vyh;U@$5
z<T#<xQuBaZWf8-Vhh6x5Wm)0zhX?Qttc~h<;F^CwXH+I626aZqBGYRSc2Aw+BRQSA
zOa2$Rf0kUeKmOxfA%`N^HCwgaSyeVJZ>^<GmykD-DUr#5T}m<Mq1n{`UOs}9O@<Hd
z9jlAnM(N~NE?@PbAJXV7QGh7bSqOQjQW`MTN!`^u6!a**iAT;>IR(CjM-Dz0Qy$=v
zlSnMooAQDGDE|1*vdAJ4(6!=<nWlib)i1!t;$g_pcKLya033IcJ+feA$~57+*a#vq
zCDbBMkz5p&yDQ%k*kxStam1WG^}wyW7y7*vS$gmODQKJbpSS{Ozj;fv%*rQn|Fr*b
zCoU|u92#ZQEuk^o)tf2P=f}U~k5axXy-e|t;<e<kZXe6|IOQjxaYa=9l@QSlho^Xh
z`gFo0uscD!7vLd!Mm1sZOrV}XxK~yN1cg8p1NFed%DDrP7(E7O|N9iJV7U{qWU6O7
z6(R2Iw&4kP_qx0PsGLHwe`ZYSbs(7uuzTNp|Nf?m%r`03GrVFTl7Q-+^5WdtZS!#N
zo6>6d(gpPIH03R8xBsQz?RQ(<!&bNV&F(+mtb4nAkG;jk7rwv~5yv8FpGuLQibYa6
zI-+A1!Qt!CkVZ6MGZBTxCAr4;LuhFkJcfc$iZlchb-|;EMDX545|toPLWKHCNGL5S
zPqbRUa9H>=jWPz`zWIAh(;WlI9kV=kzNs#NZ+6>rIDC)T<95kk{u^2rlqYIOi*vDH
z(tg+G;qD%BpRL8;?(QDh;hM#Go|H<(b}Wj%`JcB&=C^O&-oE)}kHBI0t3C3~?VG*Z
zH+U!Ozx~f|c6Y1Dw%F#9h4*ztSz?7sDj#Hl_7A5$lxFE?m524`3>IKnuEi5*36^O4
z{#FlT#)`SOhpnn=cg<6lMq=p<00rC5y^Z8S;GfJ`aQ9Apy7!CxX20b0A)C-F(ugZ7
z#(Q^A;NP5a#b(dVSGS)K3Hv7rsFd8;!n$IO?pP`Q2Twv$xji&HxmMLrZ&;j0U=2z(
z<*-7GpF{(;+kRxjdR*$xfT~~M51zSBSv$)E*E1l}NzNhkhiqJx*O$Exck_5Y_lJ7{
ze?r{Oqw**A&t73g{MDe)gYwTk(%j-k(dZfD@<CyP+IRkvj+Wp=t$Bx4xU|U$O+p?5
z(A^Gf{6HFj|AYEa5t_o6EF=*fyRd~d^CY9;m<HzEWhtI%&Lp33V+j6<w?{S2of!|W
z?$Oi#;bjAcGDy(+U=OYU*!QLk9a;#B*mvtpZIos}H3gHIfm_a0b<I?6e=pzaD<9)o
z;FFtW`e)XW^$Ni$T-N_09zA=V>dQrdT;$}TSF<9h;*WoPnK213ut322J$=PhuN*Xv
zXvl83MjPYNBfoa<uija&rP(L_<uCMxebVnD5!}~u0!{gQ2BbM1T*H~M&H-{tM6Fpf
zE5XQebgoVQACX~X4qVFzB6vZjw20B!#1r!b;+JdVo4NJeCdU)a<U_ISJ-E9GpF&6n
z)|82h8q}=Z{CHUkZ%s2E(j>rOl?fgcJ0L`%sz|F~?Mqi^^_8|Fp4|0(zf!o!x-ZHA
zzZcT6Hwj`vkr{n;FNlF>$s{kQh#m}%xj0bAp1g&jF?Z(G6aVL9!v5-2zBUX~bpr2y
zt+MgCJ)-JrrIP(jBiM+ocYcxs4uJST%;!xil&=2nR3znq%6~qrSk~X+*Q%8K&Ni=1
z)IDY5Ze~aALPlW5q7-u%Q_Aru3?Y~l14vcl!)ghkZ;Yn05LfE`?8E2OgVI!L0tp!N
zO>QasTlj_GaXB_>$=9=}b*6>nG;-1J7N~Jt;$OG4ze=26p**ked*fAstl6MoZ~HKr
z@PLuQ{)n71o1!xYzKe3*JLN;Ga?KO1f2y^s^A7^$b6}~g)bC;Gu}_*M3bJr^5t=oK
z+p>^Tn(*IIfqkRM=VeypH3@}d6=5;u(Mo>nhS3;<rWhdj9Tq0q)Iv%IzDqJCYz`uA
zliS2u72x*Vk+Awwa=jtuki+FMJVg*?5bu5q7Q2LKHr!-7<7&1?R7zu$%!+BWppxy8
zk5}jT0sJ?Jc=;mmFUlje2S@XOiwtAFtaKZD_nr&%6&(xfWtSwf!{d}mB@*kN%>{@J
zZ;U6?{I2YEK3<)hXM_u?-8};PNh@R#pEJ3v+yRsy;Gr~(c|ue+j=6%+tJ))KsWgjG
zK9YwnlSi!#ArF|qn{b(Ga|+|P3aM6g;k^aC=7WFy@de)ZyTHE_lDtpCOTiOe`!eo7
z*)l#R3t@INEnK9)A@^S9ud;IACt(W0AjjbxZDE&V)Pj7NGl{h!|7L=3knsiEa4baz
zT0+n8ALPR5N_*Da8QL&%2L6$A2C*Bim$f5j@MOsOsH~%u+eBIzrHo%NLM<+wdv2XJ
z$g;B#A+%ORfBxlvwaK67F4vp<dHlE*lYi~S{-nvj{tmy^<j?P{2_}EFo}`iuAlinI
z)#u%NOof(x`<1+cKRdpV=GNQs#-3=I`ZU!tftr8+<)$46zw+=emqJ1@PX467ngYgh
zv1a{tzY~9*cK@YNm?9*X*6uPP-ji!%1pdS{=t6SMi~&`fvd^F8$&@`VQi!iENrY(&
zP~R1M)0n@wpqy1|?RUunF-`dIwvz4i100jv>msp2#M^b%ZRcXDc22I(cgepwv0AB?
ztoyTx@idBDc_^4lG?~#kBO-D2W+bM`vJ#wf84$A#9bcbaKs^f-piPZ4GZ8X&^<PX%
zA<1IKgPAKHRCL0kCE?RVNEU9$TyZF<)6l*C_|x^}ha2b6KtbY+)eqc$6M&m3rao)T
zB1*JCl;byN;zSXuln6KlyTv7S$g1eni~^v>OL8K`B2-%PJJ!BUE+ABDEo!KpCZt8m
zRlh;$Xi&1_NK88_OH?X!%bvW2^^`oIQOj6ZTy?5vf&=o3&lR<eXUsox>f3y3A}~Ce
zw)Bj(;Cs9tR#7fn!Hn{x1&`b^^@_Rf@AnS&hx>!hW}#oFrG6<O=f-J7-eo)r$)ywl
zQ;_qHQz>Gu7-^A<)AzM6hNm;xp%Q&niQ7t|K!nUh3&@y(?v6#sCy+(sam+%%ezYVM
ztu0E%D6!N^4D2_Eld=#hoEb?onF?jKFURl8E2`Kw@S;5V%>_&{03t4~$^~rQ^jECn
zJOF%e{e8)L(WA}^+W+t}8Pitk*2-p=%CN?za`XQ9>h$WvC5c%q<g$eoYEZeBGFkib
z7(UtZFdpaxQpndLqVgA>go-@&@Z{{n37R}`s91ahRr?l???0uH;F^4&QE6gkbFP=S
z$rW^ruq0qmQeNE&CR{SMEbRie;X~R={|*#Gc6$8|n^Oq7wy4%LxMQ*vu{o1;%2Z3i
zjW6KFtKbZBt)>i6RhEo1sdNj9JVGI4d#2;4d`nP)VtbVEmPAA+Gb*)6rk#V{WD<tM
zfR2abeHw(LU>t-!+TB0uO(uu^$!4)Ws@EcV_wnlbh9uUSA2Z0q)^8Jy8iw=y!9x*4
zY~MV0j_^}9=K-^}_<OX$U%~7H%=<pT4DRXm$IJIuKYjT5n7AeH%iP~@DzqOE1Eys_
z7At7~jz{bj>i+chL5)y9{<)mr!`K1~!S4Kc2UYM8d&THf?O;D>f^S>c^J`4ws%WeU
zjy|gxD<+}-lP5-G*xzT0C>9jrs!n`ua5t~mq_Ci4C4&~2DJ#}<zuWJ3y8TZ7u;YAH
zuwYE!r4=m4Oxj3c%UMOO%v_{HHfuK=ZUTQdR7$GuoXl&--{CXE-@~G5le2Y2I(sJE
zVk3j5H<@S*=9_#yQ>JGI4l|0I{6zC^Q$i;bQvwv?cW}D=zJC)OGTHeL&ytC-=hlJ*
z5u-A~23kl=5`ksCrRX4088qN3ciAblxa<+0?m?O2l!YykV1`{0rUQss8dr89vM40j
zhVy9ugVI>;1mR4qxWoGVPr58ad_s`P9^n&0=affq`><YfSEE?8kF}YD$6*%l5S$Ec
zUQQl@0>`@r#0_B<v9P77x>K!*kf!Ziu@-tIBH3_A=x7sb_&NpO|9Zxvi2R&I36pfp
zqdN1s`Qtp_)r_mOB&c~=P@7rXxJ%vCzr4fB@;<w~x4iev`rhE;{xhq)JM1WYQ3_sE
zO9re}d08!2-;C?qRUswQ7KMUKrCT%!ZPE`u4d$!`r*8H8NBg4<um4`RMg{Qx6AMfd
zSWJkE^5sA_s9CUaO2*j)h(Dk*3L3HD@ROh4gA@j>;o<(E{?uQ$If{Ymd@HpPT2mP2
zA|@t7XWGLbh|fY#tL1yBN_SPTA#ed11GOUHHgv{h5pa`8MiK!%YtSbJ-ATaTFe!zZ
zote4eJYBEO)blChu`tOAkwBMN4%Pah_H=3HAG36+ncOp~cmX*WL*PTLKYu~x9emG$
zfW&z*6B=_!PCyxGlmRaby#K(7O4)M&0->o96nsl*MzLN5ew7CT0-72Xh}1I%q#U-N
zREmgCplcn!Fx6|8e}yGe@Gs#RV_WYE8E2km)}gA_X3}uZq~=&s&Vg(MRtM7D1hAAQ
zSrjb^O9GKWMAur6S`g?Gj|45BDzAgVON1iG@WtDGsFc$sW5yDa3b-Xn6o;}b2qqhu
zWm1~XLQLd9AG+h&Q6R{Ex8K|J(y24YeHO<Ym&_GSl!(1JVZBCVxC7|SGlm-_$~427
zl@L>igCU{;67UI{RY3BC#nd*FV35WYs^h$_7dr6_#%x6}lyqPvvH8aGUWM4Dhm=Az
zpbH{%c_Y<MQYi`FG@|NE9sfw@)G6R(N`e@THJK&k5*QEAs;VDigC;<10XjkQDNiWq
zsWcl$T+Pe|jjcBr*(tHX0NWMVuh&Z@=VUB&!ZcxX*OGagm@iPFe=k~Niik9aAzn3=
zQ>GPsHnVv)gT-^6WS;=$z!hRira-I1HC>&L76cYQ3FI=>!f3i+**2tXMR}olwh0D{
zv6c|>bI!-Wx9xJ>COMAFMhn6a0}K$*W}le3iCj@*)uBCt8fX~L$dIILdIi*(5kBd+
zzzqv8dFnx#K3xjf^z9gz5o<@SFF*<0WJpq;vRr8zv*P$NuK{Y8GGe9LoHdn{B4vq6
zS)e+Qs}&3ND|lHV5RvM{s<lW(XBe`B5$pF_gZ)X^8V<X(bvQa2w+==$2!ey*@bDnm
zFoNpLvz`jzX}hG$m`SX?39~q@A4;QVtu#SMEJ{&GZwXei%(9p!EyGX8!qOg#wKuTU
zDncVA2+act7^J^V%*m|8frqfzo>9?)^_K$e16Z#a-syO0u4no1ps5G00<}Hv0~5et
zpJsf_;bKKg7%Y#7g;NaHSi_;zA>=G$V~ga@V{UZBT)F0KLxa)AHUajD#%Y96T!!`w
z>?~)AW)f;OGwrN*7rFsxon~>0h7J5TkPMTAuu-6kdVYO;eT~lr+!~r;NXPONDlH<G
zRDJ_tnM{IKm=rhbVg-9>1(YkCjOk^!CnsKGm|H&rdTdsWqxBn<3AvP>sk$3I_IT!m
z*9_uGO2Ccd3m7wSvVnF=5hx+Y$1`y-$EL7a`&foid!?S`^SPnkQK#4I^t&BXB+g_t
z)&$j6A!-H#`c?tbPI3DCaW0m$GSyjxirb<Y)p2oa*zf}+(&V&NBIf;f*uef`e1f;X
z@MO^MR37a=F8<5K&AZ~FYqYppDsGXdI&RxX0zlMekN(!`{g$y`ia=fI{gs$rG2&KG
zDR<n;z@S{tVcCilE&XW2yF;CY3kX_rlFNbs-1CBaf7`|Wv)(Rl-@N}6%xE%&l@72X
zzcVRXAzdoMOg&n0mIaT(+c)jo<SZd34t{~*3~=|$jj7TQEr%qfI+!uzUQVFyKI9Oq
z1JBxBrV{f<<$>|}D$DH3J(`-))gLZkD=Vota3Dz_gbaCty2yB}W>3KIc{y%x`Dj;8
zx<`QG4cv;dYDKm8_BQFYU4*gM>hB+pMz=|S<)ee!WU%tl;cYT3e{|5@AFWs3MN)-9
zlO>plVv<Ao%T>8anVgG&MkU7POwZs@!_8EZEX09qV>ZS{p#duQ_AxY6R0f8&88`?;
z24N&yJL@)rN?rnLdJPOKe99TddiA=k##IBSbo!8?{76YbuhShsRY44d@M#1kw&u}W
zhMNj%3=B?jA7K__PQ7ke71mkUQnmrfwH7J9UA~55<<G0XM%1#rTFdoV%PR)$8dDaP
z3Iy_6spNAWu_+5NpaRKGrv{o}@KOz-ZgVdRmOybIb}hUbxPQ>V-LPh?v*hZp^lmIP
zIiYb%`4o1&XhKd|#Qdbi4xhDhw89!kXbnK>3!|orv9KHpxJ~SVr34a22W)5+DE-$c
zkugo~TsCdO6Pg5IwC9VHoarJBWzqy-!kKCUqGB3F#ErQ?my;|YPD<e(euKQ6kf|j_
zQEhUKqXaTNmW<xn00d9wB7#ar6E3bqMo3^0VlyD14JlDP=9mp*8f_EoumcY4Hbj<<
zC+tj~+!vM%on_`M9cSfyMt?!^hV5;)cAu3p4uCMq%~)2TjTaIJX6WKglQB;yb~CLr
zn?7Im(K`UIySv|sx#m-3$w7~jMLY(38vd@NMO**G`!ff{LNndMCKB@+Sj+A|YSV^Q
zoz-4fY^vsR&?i?}5=POWPtIb<xSoR(Pmae4xDye1Zvt9AG)g0iy*MmtfvXps6KSOa
z`3#tZA+2!mZ-{Tefv4x^goCim>=zp`vY|iZ2Aa`?w8IGIyZo3JVY%j7)LOwxy~snc
zB%{%QM5K*qmRSNbd0N0_louzO*bx>LTe^{!?Lyo%MEhN@5JhnxCnBa1m|K?={cqd5
zT7Td66IUI%`=F5_{wRFt3M^M)YkX;y(nVs^+io%2G#*oL$--vgFmIRUd0X>$p3qAd
zYGywwj&I*4?;<fRb(20bjMiJ31bZC0&QxlBfD>15a0XM{ObTL2eqpBBz+`*yCDf1C
z-m|vR^0^q~8Uke}0LR;8&8H?^UaIgY3>-9nY$!>pZ%6>P70&H~Tslk|FkR0kQlxTr
za8>rsEY)RX8oI$;!iW));xc3LQDvisRFQtS*MHzfi#!nwfC7>|oGe8mHszYfaJmH>
z+bn*uJh5S%W(iPk<Q^r1j44N%f(mfkM+mMjR-+(Qxni;-773HZ7be8`pmS-<1M>*g
z9Z$kXOf76-VN{8v=+w>UMPYAvD}b_E+CmX7c*t7r1?3gA_um8r?(Ni~%_@UBYpvdK
ztqhUiv6X85Yy9a-t=`e#4r;)W(NnW1;#1gtZ@|@ns#P19BRlWTZmxIDB3;m>^&~hQ
zL+7}w4l!g4xRw@9HG<wC*B9?xRSR^C7=A2!X0BFhw_qWZ){@&$_Q)8hnIYB-G1##!
zTA&bqmFVvj<&*A?AYfdc#TPC2$T)wWHq7e+)LB}32s^_-nliBRk#Kux^|4Pd8pf;<
z6PLbCthR)LL!2|nCnljQCdGAeKgXcC84~BXCE$|PUxr*7bW$i`H$9!&zM0#k`t7C}
zd+IDcvy7?7X{yLMsz^|2zo>wx^$}ARcmAw5)EmhI@MGVSOC}9z0{J)Ny2GqLSTdmL
z-C<_M;#LCV1Zf1TJLSx{>~6iF2@WeuN{X9CDf(HeA8wNm#Vv<S@hKRi7{FxU(c6eg
zDU<@Uj4&c#3Ur}J&h%yiu_6$%VD+w+;y0kQg-8Z0H4{#;E?7=Xd#{GG2-w2XNtuLf
zncG~^&&Tl~A|g8{{oP^!qFRy91P6s-xv-7yx^ie_`)ZTpQho_nsA51GYb_Ia5T+FP
z*|{9y=o!G&&6C1NQc0{a@Bz2UnW@LKCvr1P4Z&9+1&R-^XaXpd{CJHfJ9(b~(@aQq
ze!PCaYc&Iwx!%D?<`{hSMUpb)6z6z}33-2VacmC437(Anc>Ug-1TO}OH_&&+T)`w7
zCaMc}0bO1za7yM>a%QZJQYANZ)9s;h<^jCsXo*F(NkX|&5H$KsglPeHVO0Z7(<ry^
zFgljs+sa)*?4IV&1I3sOTBXpSHy&2WpUM?_^~UnF#43)k3^^%^NtTt?PY0>IIb*%S
zWz)Pd*OIk`oOT?JJJ;R*{{E&Nr#fpWt(*%Us{dee%%q@7JL`%2@R5d1Q0bJ%xCV_3
zICNXZ3@H2T9Kyon(LA_=`rn-embYP23TDQ|^b`Jj*DMT&Fgw{uOAclK$VLniUP_>{
zID%SWAj>i6yr7>>@O0!hxd4Qj3Ahjiep`AQaGIT)-e`2#?sf;ex5<CMpjvaP-U&H9
z>~9!?brxX)!3Fs1DYsk+*YC)w<Z~aeYeXfcsdO_|YfyP?2wq|dVTjLfb|?4(|E^S*
zm>PAF5D=eXF%4bQ+iJC3EEJT`1hBh(ynctmy+F*_A7Jl<*-l)+v1*fdnT9=u7Wo&;
zvK{6$+gxGWTR}|*EvKfo1vj{5$~Hy8p1<QdOTaFKqC9|Lya$r8ej^IKOgQtx+Lb>5
z#XdRH3euRzu>h;ywmalql<z-5hnoqp3-W$WL$_aVzNMyLXO+vxBvToU$j>6mOnbMT
zm0+^D5J1F$R{cn5M9oVP*f#xs)?CD-OhpdXTtffiI^{5lohK{D<g6|jT##JdEeW_E
zEtv0Mxrs5AIf*EAu@l%>(Y^#D7>q{~fV&1pQyh4JHr|JXq53kn*uG7UvyfXoh6kKP
zA`8pbr*qCZ1EbO9b{??wpcy||$z$e!wFdj64pgc|9JFAE!lhf0m^uy_&eXpHara-u
zV1HBu-oE@&E8Nz|MbELU%>Mpg0(iVu>G4{{<83--S7#Z;6()FbGlPoT5-0Pef+n~6
zm)!HNq_|pUcVE+YfyZ<8Sm(wCG%G~>j#aAbONZF2-fz*^vlU)NO<1YTlSXjt5{wta
zl7Vm4xnAzpiV!^n-^@G5#yQsolKc6r(lg>31q>H}`iz4r4azEpj<bPGr}h0ZRojJZ
zT)_G|7*=241BvG^VAJSgRqCiyeYK^g1xwMXT2PmdPYXed7DQ*DPkjSD4e+q-<Kw4#
ztgq;rP|z#6VLe)BJ&B9{AG^ZI%VHC^I`;Cqer5V}MI>MHz<JZFUB51VKV~zSc55bW
z<|DHpzKGsXf@LQ6OHrL>E7?a@u@o8n+{Q7N1U(4qY9UBEqc*pQ)hO<=Z|&@v$@1P6
z_sDl}oAw%)*H9P`VK*{{#3ZCTkemoo5=GtojljRaTv5Ol&($7TFw>p(yCWky7gLcK
zdPy_T7eBQhXn|75uLoB$YLa1NG$>K7ndB4_ujNq(&?y1FqQ>$Zm(z@yo{12txZy0A
zK+1z9Hv5{hW?MQJVJ>9WI>xFa&JyhuJ(o%wkz#fWnVL#mOXbJ2ksf$q3__Kto>9Y_
zaE?o7mt_yButaDa(W-EM^~y*X2MW~b5nN5Z1zk>)P{hAtD+2`6@86A~@L#5k^!LbM
zj~wigUU!f5dgR|oZ%~}V-q5e^hQ3iVpmzGkNDl+6kDYw5H-u*xZP+av)LDRJmv(L!
z)~>z=Pgh~|vE1z9*oe%)AdCvpV8+=Tb&Z0WPpsU8czF!pASLD%nqt_N%Vdd&>t57)
z!S8q{4=#3YdcDCutRp&AZ^^%y7?PEB`!>Om+2mh(Z;AO=;TIaU<8IPq8gAbJR|0&0
z`^E+0+qcQOj~!bQSIa%31WB;^7igCla-}&7$%XB~YorlrwQrO6?P=SX#$353T+nGb
zt-sCOW{GW4z&x9!q+xl603)z!!A&dK4ui9HC=O%PAWSiVKf{%w=KdE=ofT20H|rSF
z=HCNl967;er22ywgGSUl86G6t8EE>h@=Z2ESyTr@8Xi4cL<eKfstk5>CdWb~Z3wwq
zYxJn&D(0Yw4$s-bleA(Mk73{EY0F-D)5xi_eC7(4ryE29rQxomq<-Y|n^=2HB}^Gn
zNLH1Xf|<!nSbFc$m?#>%J-5j(GahMX>+&5@3;c=t&8j!kCKwjMdq5{k=3I&dB#H4X
zJrnXR`B7vECl~zgPDIo;K>`>bsrLk*$X>Z+?y^O}JF@q<=`lHV)|;GSB>}vmyxY_@
zAd)$!<ch(d2w8uj*I>{vPOSoxI2;F=t}rNKC9sw|Yr?3`B!p}6q-g2d9Wrk@$r)u_
z%n62|nrkAtE*66zx$dTwTfO;i7oVP(nlRwWv+cYt>t-yPfTyOPz=Pf!HjSvQ)Y^y<
zeD+1c!7_9Msl0v_oV#TT)$&+pm@t4;HDYI@H3fm2dlzQ16HAaN>j{8XXIA^1{*6u(
zR;G`*nXyUz)p3KT%W1o3M1A6j9f4J<We0izGhbe<X<s)<sZt9eL*RLY$%V$BF*X{6
zD>4m5pyg&gN4`*kk*fvIOWDfZfXI2K0tyjul6MtXM|c&<F5H95oV)h1HjTbI^VTPj
zU4n%QIZPp;BPu8;A220n)*u$;+hQ>`*AN`4AEEmVR(Ht14Q&ZP+@MLX3nC#b(HOOV
zTvBb4%ei!nEj@<j&MD%l3|p%v_rQ8AeQxq6mHWcA0{xd-BGSi@#(>QW=t9JF<1R*>
ziFRO+Kqj4hcPY#oBVwpUyyG4iEC&Y-1|!l6l(DE-N+IuYUp`oaYGj1vk%n|^`9&69
zbvv$d8KhE#8Fr*3p-o}s*WNVb>P#>f6^;c1Z(+5Rib7Asm`0jh<1p0v;dj`$U<q>j
zSD1BF22D;Y{p(m<QI<_vnU!{Wo{%JqnS_esb?xuCwHLduy}BX)b9vV^e_3mFr=!)o
zug7y37y5Y5S+qc~ou#JkZm+_NT74|Xqq$+Q*O>*hjs2&2Q<^E|^%49#Y8;-;EY~6m
z!<3ELfZi<i>A9NkG7SQnn|bL{#7w6-7_Su?=^WrWPwxt<i_7FeZwK0h*>>N>OwgE{
ze<uolo2B+Irj@4lFe>e**fPPBDSBNSp5t0)I_G*uL$QE@-(^meQa><<Puw+*t>Tr&
zh~l{&i-$?181)pEcWz)UMSxlw158fZbn}`ZjVqh07Q5g{s<i8vE-YLslQmw^vF3b8
zZ&I!|MoZY#ryry51!Ke?Of?lmCY_t!@TmLeV~@oj`R4_OOYb8Gf(_Q&`kV3#EuiSi
znE$%wpm9V)cEfeVK6m6pP<?1sRqt#qO#c8xAA@HVn#%H?8|@VVoopqkZST*OF15)q
z#%1i$&iZs`G2~mO`e5akI9doYx5mxJ@*z;47sw%6+y~T5wpYjQ{pZ)Ks};dQC6;f&
z;x*PPgi<I7Dm^hnyH>4alH<)kT&%QG7HS{!&1crnpA+D+&SWI?iKar6%NbX=4Ihs)
zRiANPx$P#{BQqAIu;a@K4H!w?Qx^;gtJQ!`KosQCHgpHr%2?@jw4I5?32m(*@=4jU
z9+L|QcnVcA>Kg*=@OUOd!%*faz07!orP^p)ar*J<%xx#`cCkveC`}a!xmj=xDq*}N
z|NTNu^fe2x7ai#x;HPk7rA(DM9I;$JyaQHFraHaB!LT<x?2YyZ-CnmlJnVMY*G&I`
z6PaDLte9YjOd0HnqBITe2G!GL&Rc9E(snAFkYwjQ2=SwgaC{s7VT)}pse~d9A;}G7
zU3NEPnw2qMXZH6LhRTDeF6k1x>mj`sFj;SCuyXfLNTu*QJ%NU$9O)X$lCcI^!cGN#
zrQPx<nb12%9Ah|v!S+IG0!>vg45~VGqtsRV{!;**e%PvuNo2c<&G4u|3fLu0akQgL
zv6KE#Gr&EX{-a9xy6VA08yTii+>0_Hp^}YfyO--)46CE58?Xp!ovo9FhU1)E(j<g2
zI};w&&n8m2{U=)mjv;_t^Jz@URTh<s$fjJ+vN0-L{Q8H#b`<;<%CyIw*i>4BucKNl
zW^xMUF|JS?iS}=fJI9wdgB}vn|LThFe_in8SDI@0-=O#FZ%*F7rXcV3GKNy!zd{c#
zx<H_V?4I+M{P*8zG8f4mm%(htcw9HCZRty6fIWO(6Z|T-{yM~OGei99UIUE*f2}Eb
z7K`LG3+`OGkP+&4SrT|#0Z*8m&!4t3r!tj1rV>U~RtHkrX=lizQJGT)v&%4(Jch6;
z)PS_fcUX4sf}AGk588f@6jv=cWN0XmSr%)Ql>qMrhXjCi!e(^Nk)xwX*@uR9HYa~E
zXYcp67UXqi{>`J=7Jzdx9sX9Gf$b75An;;ni_P@mcX=kr&Vu%`E}pI=prF?QgyymS
zYSo(^R01%&H%(;4bq5*$SRXWT{5blU_^<b_X5;BmT4w=(9kPB^<QxrD{miwmJVn!h
zS4=%^0_dI|W{1yY>TczppDu*)2d3Vd;XPG;G>G9VHfPcl;hCIKnK15a=kad4S5{}b
z{vtQ&Kbrofi|cn8kFdqy{KNS>?#DKLy43xp1e*_wjlUkZ;Pog99ce{mJcBI1l^Vvr
zFvx9WXR7HO%dHKo!I@6_+YZuRoq2m(CUI3I-t#~bSABve<Z~*~)-}w7V@3mE7$b9W
z*lKnleY7PhSY8|i8HSc!)rpDxx?xFM4aPb%idSMh=E+Qm&~U}o$Iex~<tCud6?A~k
zN+nZnY#;nxl0!*%Vy}kW>TrLr&ZO6M!qWjMw&9;FtNV!&fxoDK?}<AgtJo;&*YW~P
z;26NdkV-wB4QOJsx@+&4&;Yy@*kRWZvEtO^f_@wFQby{o+_Gk{+E>^dyw;kZqI2p(
z_fS_5n+BUKF<d9eK;j3ljcA7iQj${brPGBd71w%O9cAh&ee;nj)pTvC7MPakVu&Rw
z-u8{T&J5FaD#QdWAy=G@m4nwXHDkg9aw;GZ;>lQSL|<iIQ=>|C?0LzKkVM@Rk)?n`
zc%itI6IW=&Wf?K519m5rN2RXbx@ugSgUdRTKPUYb@REg>JoQv~_H?P9(~^Oh)7s&9
z4Y*OL8c&OA5R>*fzP!nI-u1OsYw8f8wG)u3+~D|MVa~e<M5H>gYAsUH8HVg&#QMF~
zV1E*}hQlsx9gdF1t%DH_g5Y2{JUj@tHH}m2@OgBzEma_r;QImXev=#==sU6&c!~Hw
zZ_-)~g6H)8rQV_~HzMnv=^Zi4^65sv`$5@3BUGa$hk{2vh0*qpkGLl>i-lZ*%6xzi
zwID6sdJD16q)dqs;Rh<`P~(+M$wzE!wXOGlP<YrR6guvNwFCx;LOA&P_yQpUgh7DB
z71r1ngupuUEoOa}a0u!E8~c%P+N&x&YMLqxzgQJ+JH~3Anv2X3<l3Z0&&AY_$NSW?
zajRIU7NwV(vjJ`sl^3QL?b=2>W-=&5WK5@a&R7DIs3tVfTd&^g9fphMN@~m%pxVf}
z()?hs5lNB<u~((Huv~aRg^bM@6`~CAG=khwe(_dctwULDy7R<!+FZkc8Q1>p2bcXO
z`L=ul<qR%n4V!O?cEIA*#Hyi)#taX{GFaE0G3E(<0ekSk>*V^g7#feEpGuKqH;?`O
zCk@+;FBlG*NOD@9RKGgO9&#dZ;OY4};UF*@el|72%t;H=fC*_soW?6En;DC#bqwQu
zq?)$iM8q_Lc-SSC*p6ld;|Hk2=9Su%VYv!hli^b-T|kNAcuA;R&_$x!k*<_Rj_#GF
zG?>5hq+q&GGy73-{ENhPotc-@eCWb;7QmxVGAJuJWf2squ&`hS!1NO`-GR+^c1ey+
z%epVab=0(Up%a8{{RhSeQ){t+2_mX2zR-zpuOu(q;?I<7lOWS#G6C*hnnjw-X$1ZL
zij4LM4S&m&nX6$wMp_~k<|H&*mrAU4D5Ra4dtGEJPF%(GS;Do+P>h%47iMbwO?2HO
zj-M`xV?|L)+~mdMyex_Z8@mB7WhO&A%h?VME0c32Fj#`gj#wlx-OGKk_2zG#37+>z
zQ<i6gVbq8s|7NB^nEmyfYOMIb5Oai~A9yx`aTD(7esBN@`VHHIkY*%=W7zzO=^V^1
zT7X1`c!Q?q+`u=oQjDz>w;rT*W`mAzE=ejP9xRC=aWUMeevsG*^39N|G@?set|5{M
zpJsNI;zUvBqkVHtCzfn&hL4V)7V}W|@?of^oUQ0DyJ0j|-{6PlB&T)+j`{}axAFt?
zk-l)|50eS7jturk^#K^Cu^y*sbFf=y9_h!Q&M#X~72PV{k{{qcUDgPm(XiK)9Dl<H
zTZ~!ChkaWjYgcw@jnw*Ue9^irgx-+W#agGH-CO<ns6anf<P#1-D=EiR3g~#o>Ry<|
zn$Pnqo<5%{u_B@JA=~N2)H)#SczrP`dXqdheN8I`r+6_h*lQ4LpJYHsiRHO#B}B|H
zLWnormrk2}#1T)XQ}O=yc2Y1*guFPuI@u$q|8aJ)N3Jg~_K=hZUdpzDx6W)*F01eC
zOSzFO3H@NR5ox43R~e1CnH;NW<U&LkCdQh3(lWG83NlA)7B>V#W1xQd-7&Z#UP8*F
z8r|xKVXoF0WdCt?u?f5lo(<kmA}<zOweqsTZm<b(4WAFVP$VxFU3F$)t}nma1hz)c
z23sJI7mKVqQz1s6c|<kuQgg<#AE50w$6MfuiC4Oy-J0G$>%U?npH1sO;CgK-;Ofk2
z+(0!Wf)2t_5(=ZNWJ}&Z#0E@U(|)&e+3Q^Pcm1I8pz&%C6YMP%Tk8?At<{B=KN=Fu
zy{=`FS4Oy({an6A+}}wNoBrNiLkwk)>#ZDjL3va<c55~5p%>sA!|2K2e)v3g`BvF}
z{0fl2BK&I*e&hw=JkgT2gq%Jd%8#CvQs*#(;8m$_gpIw<9M1()3JQ|3)ruzMI0zV)
zft#JtylA7yZdjbYms0p4x_atqX$J3haxP{Mk-+Z+r)>~ZWds{O3@0EvC#P4tkY3c1
zPp80O3FFmhg|w((Nw>pq($r4sHEe(n%Y2+^EAkmm^4QVPZwb?Mc8ixlBvV<Wx7BhP
z_B?<b!Tj;+9E)zu9H9>>OHhv$<&0+P%2_fNpZp-bx8+DTJ~#>*AzsKB#yAync2f2;
zAgKWu?t7UY`~lNW)k@tBqPM@b=rw|+X^POzhq11RmL^8JTdR2oK2Tc`w3<&%!OneM
z;0LpVt;KBn`seSBET0Ci%`Af&)|nYQhLTA0pybljX0%Ro;y!<aTZY3Xm89UPIpBku
z2`2>>cAOkoX!oJmm|Cuc8Dbhna)4dEBq`WoJb9?@b9>7^hjpgY-ccv-lu4NX2T~Oi
zT<954NurnT2bE3Bv5jd+w4?wbvh%MXg>sC-PJ-J7k1M5ir!k=nUJ({HJ)62S8=zA!
zCnGnkGb49GqX5Q*F%&5bx4bz0Kp4Cr8u%eG9yTZ+7u<V%_vkoR;q(ImDkXG2-9YLw
z+y&AbvzFbxm(V1tbp9vOl_XiJ_5df?jF%+=&8D;M4FS~JiBwJ-6@7~2dnQOEY#OvQ
zZQc(|51IqhDbom-@0mEeEI)ZkgPLgf+2wp#^mT46+UiV|{oqE<ABQo|r(a|5tRG+<
zHqlfpKQ>k?gD}k0Lzr;3y{6ug4=CLnzdI+vj3!f0O}xXS=77k-0w0_uG|_~@3;-DV
z8{C<u$sLf$t`o_NbSg%5rh?8zKqF%TYe7EVoS1(HB7t#7-o}$YUEb$7oC6b5NPe);
zfDnpfD}ZPJ9ol@T%4Gp#M<Z<pvy*$jrjZf^yU2NhKN&Ccvn^&!GU_mHQa7fFP0fG|
zn<r?6Sn=}-b_AONrYvFsBr8ha<9+d@;1n|>;E6JO`qu8zqgs<fusLxc|1&!j^HY;L
zYGh-PHSpY%15}wMJaD0#0F)g@!<l*ih>h)4rFAB2ia9>zVje%+_Nd>?ZQDZ3B)OgE
zWm1EhM2sr15t$VbPsl$rDk=P&ZL9XGGqD131Pn<P1xhw<wX_zvAFvG?=V%xyKr{uT
zdPx?K;XOMicJG1Dt=u3N15BHnwH&L1mG9+KE``#ToNCz|_|}<I`H3xzLvyBC>`5;+
zD1BlXws6cSrt=cEK-<GjiK1a>L(?;69iGlHI6MUJhMboio`)TsEoRLajcTs*>~-BB
zDBPRO09dzcTN=2X3&R@mU$J`Szh0*__EYRRdb*^_Swa3*s<OA+wVVB9qtGCvm8?k+
zQKjJLnA5f_8+&<m3P!6{O5^rz^3H|5A5ym9JB@|7dz()H(kz(S!MS?5G74xMiD@VQ
zD75FC2r2N4gZ&X6ky5E!{ni-f^0orZxVP}$Th4oGnT<r@u)vV2*;r5+sutKPEq70<
z#gi6Xtuq|<dV}s@TaA?c`qvq-+hT37i6<B9%F|-nZ`fkW8(!?H%46wYyRO=|$=QS~
zMMf475yPp1L6n6IK9d9j3FT?k->7^6@9+c;M7q*!Y(L!v9!4lIg`t>mUpOupZrona
zez8Ybd)j_`n-KE9OeDj;N$8-l1exT&z?e<E*6o`%+>W^jEY;gLx5>^GOCuUEa{FfW
zOXC#a6VO0sd1Fv}_f=;+51nza37vs^uqTaiuyq>4ZNM8-8F@YGtIl|}GrmA)9Bx8q
zc(m9Lw@zhPGkr7a0xtHdDqdB^m#B)PXRa!awpCT!ysC%Sh{aQTAN$?<)x!;yQwF&K
z!&tttIN*M_VXDF;ge40YpVt)q3q%6#uB8#955)tOh%#H333?h*gVAej@CjF1ul|*0
z7FZB*Ltq4v(>x0Q@#=h&Ywzg_HGVF!EUd0Q4343EDuhlb8&_IdPG&x~4EHb{h54q0
zMoXoO%oLGa-Qh$5NycnO=N#j4Nm%rq5sg|=y@v813d?<z(Fwe%#zf}!Yb|Oy{Xk4M
zgOp^DcP}cUf!MF;qw%v!pRU^Fdr8xo>){Aj9vk+yyn)C^YG@@R+uS;V{W{BBZdPhH
zs%$(Lryu-)?CGjpE*<+k&C7Yj<X#DjXP)`zgSC45e6@&iT$HIvO9a@%rZvb6hb|47
zQhb`Uc!K@EbFTfgwe1g^S=#rfB;^IM$H%AFe43mk=I?h*(<Z>P)}G(@C!_@h=uk6m
ziG*-mv;wMPDN<kT3HzgFqVP)uvb_aS`*jv-JSs{z<B3#eKly>${xgKydiiWI^6Kx)
z9gBEuDT`@v=cgWY|DcJD7?K4%1!^~i%o<R1Qzm+u^FZ@BuUcLe)Rq>Z?bn$cwzZtL
zJPG6!@#GF?FP7)k`oY{`GxgaQ%4A#NRcAsGHU)*d0=7!R(tRRlp`q=&e?&kp$VWJ+
zGkx{F5P5C}(<`>|%tVoaDJO*>vh*~-@1WaE2u{CPEL*Da4thQq3D%k<et^}WCR!~J
zA1HxTD8<JxnRKmnw%JLy4TD_YALJ}0fgNf{?+n#ao*(lA!6vuaeoi9Wim`zYj1}aX
zv^4wHG{xtoQ)eGeh!U9${G_=K8q{Z-Yr8V9-g+VB%x2d=^hf)^UokTq?i#sm`6T9p
zp<irb0l<bqIea#tMCs&c^o~BqIo>e!SZDgdFttlyD0YlXiy04Q@DdhOhAqiLE?J<>
z8}S3chGrtZQa0Ng8a}8qDRFW7;nx$Gbp2s+l}AZ&h1merczK<Te`A54T*SfC<s$H@
zA?TY&hrh|Eh~%-k@e&#>;PJQBx;yXzCNU{O?kLh+qT{9V38$w^KfJ;TU%;Us-DEpR
zHmH~mpB_mjfc7G_(oxMYx;ABAIgtEd=IH4$160_q-3sFWhDkur*wXM>7jrAN6FG;q
z&TTvW@axB`b1XMzAy4p8y+G&i>4N&`#bNC`4l}WnB(}C%`>^i*3Xy5ku9KTQdAqLT
zJX&e!DbGysgQi|HT{!)?xQsi8e661s+_vhkIwSg}wgIHcbs~tFo{7*C_WDh%09u`%
z7d|eTZ3S1Y<d`5w$<k;E**f6bGwaw7ss_zO6_1FXQBAla5x-;6l29uXm@lf)_~MEr
zg3P$m!ZsQJlM556iDa1x5n!v~7#uU56n+EjjoS&sVa+g{0EZ*2V~qcCk<iFj0np*F
zi9mGwWT)6(JEig3cKZYg8F-~YJ4lz?im#DBmg!O#s1>3gn2nkUGutJ+XNHnv(<`(J
z=Z)$(DQVlmRcG|wPP#8lVJsGf6o%4t9C3xoRzC=9P!|ACNHAljIURY6P%N#_h=nLk
zb+)y(TAhJ;T%{#%VCM%uo$VUa*N#4O^SS(h?Vw@v49gBB3MX6<4gh0fsKa;Ntis<b
zvkH;W+zJn-y1<XOwa)DD&?gvwf~jcHCgFJaoZx80^9sny8?2wMta~p=;B%nJ;ZYL}
zJbh0Ru84a(_1aPWv{qfOusP~B88!|qJh4ocB^FDZz6JAW23_zDwiZ!!rWgLkq(E27
zXR_d^*F;GDzVhf~&M6ceVxVjSJ;EW=BC%`;TZ*MRa{(r;S87Id^z-?6GLaBUvLvPn
zowAUGY|cH^xE?)Sj^GRiLOay$kp;tiQzQgBpQT#Yua;E3AY8))vpU|Wk)3u&gH2#o
zf%^}`Zed%g@T~g5>)?6fH80nHL}1&hJBPL7(22Fk7J8fkchtx{1A9Oa0rl0$-psy}
zqdGGT$arEy>qT6I+yLX9A8d^p7XC2IYhcwW6Zo<HO*zlYUcvtY_TLSov5l5Exs?JY
z1x4W6xE+o%+~Of_NBh38IbIU*aowNa(U?a-WxR8oXik3SGE;t7V~_S53D|Ymn|w8l
zKLgh>xIm1|sl<4UyXM3RKTk(aL|{7AL_%N?n+C3j5>?Xi&psFpn+N}cjl=(%P8ccn
zC|`@9X*rapFM@{{&&#p(QV?Nxi`PW0T^XyEit=fy95xd4<$TSPTObW{ypH^0ZDUEo
zqoZww-iu0I_qtv0fGnIgn5CPDNKBU=m13{k-DYU6?(*S%>2jtz5b%;BQripM-je{=
z6J&eO5wZ^%qpuLPZ?)FZ7x(2qUXovgyo&@4^Nq?+7PQyxHw~aOMriE%I%{;c_A0Qp
zu9Y*T@VZOWgr!BDeWH!?ihA9_=FocsC-wu}!HWj&!bzAXwt?^k0l5Ao7eu&DSK3$Y
z%ku=^VIvKLb)BbQVIa5(W933Za@lwNH#?^A|2rvSBkbL+HDc?`l&uTDdO~G0Q)GV-
zjRrJ7(U_syg|DhPTo!Jx7qwqA06(rw>-4J~_qSO)77acXh8wbzQ<0hUzxjB3b>u<K
zHKQ#koZM)fzSlk2=8)7EhN57yC*+`{J207&EV)a>B57p_|7Vu#-R)Jkb*7q3ZZHsW
zoF#VhnWdI5rW)k5qd3Xc6Sxl>$jSOOVyO>q7fdNSWeoz{k!QeZv2nN^H6CuLP+ub4
zdUa-#-hWD|aj{Dis(1p3V=0wXGa|*p6Uuts2BNGa2Qjg=A+f>0R->xURL^_27K<*v
zsvu1@IPMrL#o)f6)@vfC`JWKe79-KiM3F+oxo}OHR*qFW^ZYE)EQ<IP`tChpvEM)}
zt^n`Lc=p$btZv?Y3s1+qUqx%<s2zK~Iukl)Hpa2?Zh(8&gmW!zp(mIQn%Ms_7f}{7
z*qZYQP>#m3nC?qyi#2AwY-SJaMdKxQzix)ZvDX_mo5ZmSwra|Ct(dkLexpsm&xE@n
zxK$Z6<kxB(HE^en|Coff*>|aR9Etmd6)*5(5}t6)u|xnmSRV{KctYXRWnexkMvfyU
zP1hroLEvBS=Z2RGB2$5gA{YZOWeJm*n3(`u5F!VDfV|#-jAHh1EF^;&O^VR5$n;uq
z`f|LBr>Q<k6JT6t66U8Y9>eoYhz<MGAb^4x1>}hEhCq(hP3$;~c>-e{Vy=|GGPhpS
z@-#_FRR82(Br3WpDnb>R&`2?ouqoAi4tZ{AKT3t-=A-Q`1nM0=EqEa(PBsAE!{-lP
z*r{HzTYjl^CU7p@tl*SNoiIswoHD6wj~~<sR`$4ji}QrnMkI0qnvgL9F9bzN$w{WP
zC{ZwyD;TP`b8>pM3kHIgd^%+kM#lipjgzD$&Nl^Y`Al3_vcYZg8|KT~0W>7!Dvjup
zfNbzIIG`r^T<l<LE#-dK2hxr3Qp?CpXrTGr7yEgy--x6U(BG))Z14x9P@m~~iX=~$
zQUC|kdPb%uK&;M0(xuQW(VRxnvKoyxZUwA$6uT#=H6m%0N&!v^q-7PK&LA&|O7ROt
zQ@1i(LkqSNqi<eRzF%ib=?Y8QY)l!ZRaN&8D-2(de7f9`*{l_jScYbwe@8KfM$LpR
zppb1w6EawF-ggO2Q%0p36H)BBtC1GuSqx3?i38~vGjyH(A(@HHUj(c9@U1hcbX^2n
zjMz`DjReKno<KWj)|R~zH^p!%Eddi9B+P(TLVaapa*Ly>{W`NrM%1g3C9uL>K`X=v
zahQj#b=CeVg!{t=_NketF1poBXsH@YT5(UxaVIl~)yWl}0#0HCDr7F@?NohJnCQT|
z?AWu$wz<Y$W81cE+qP}nwr$(CjWhe4eIM>yUh-AvPp6aAUtI;u`6PnncOlcS{I3*t
z*YR=E_8cfPX4f$Su=NJq_b-f@c8cL^SD|Y88)E_i9A})}%e$2M>s!`VO&D;PX-33=
zzK-h`govOye{p;;DSTjoXSh=)=8juL8Jfoz$FC6o-oUknn%Z+hs<byC*v~c#Y7&%)
zhzuRevBsCt4|rDTF=^2<cS7C=DVovf+u8FB(jjD~kY+)wAC|QDEr*fA#1Lltbtjtk
z;<DI_?Ro(ub7{xJAZH~M(@}dci6rDTwjM;vLIz+n+;D2W)o_Wfv6~qJE$c?J+K|sr
z97*mNaDZlT0pM3?m-V3#M^o*?T9%0b+C~e{JV;4ka17oVVExc^!Xfk)n#+<Wpb{Il
zQuR59t@W>zv7vzlOhj=Uh<neEYRh>NA&=)ipReYv^$YRL(oWD`*5utdi%$vaUjM3j
zra8RN;p|(DHnD0u;bO7@Jr1*CIAekVofC-;gT0f3x{L2?ElH7Fi%y=gpt(!L6l}l*
zK2MDbGu85-rK%&X`#$$u5>guKxnxUtMzA9fT{}s`M%IV25ZSSqDpQ+uG`woe6=c|y
zlc3Iw9f4Y|)_x3lLWiLhWC)bq1qS_uA!ze1a%clP9vAx+q$FD`PRhi{Z(E|j;PR&6
z_mz^7%=f0w$F6$A6>1?`VfnkR%jD}yw`Hch*pT6J2k3(-mQXRXvK_A_v39PW2lIVF
zq9&jUIq9AlS}}dwFRB*YOMo6oop7n6Z2-{yv5-m+O?+%OHpg9!E(IQz=)iijn!x1N
zs~_ZK`ODMX{<C=@210ETpEB%!eA=m3750bd#v|Tw@ma}d9%<8EYAs+2Rk9$|km8MF
z&XRuHe98truiHnn)GY&3bcO65GwzBUu3|+8KZkjLZU1q-cDXSG;RfnSd16_S$CA(I
zC4mg!59YBqr}C6}gzAlh80RJMMbrH-0yKZ!dy>fmXX2hM@a<oiN0i0>0-qC#Z!T<Z
zqD#zw_YtPD+H;?y|M1@U9Z-hN6WDOM7_nDC46*|`Gau-v(lBVn8E-xY>QiG&8YrH1
z0;TTu_dIR~Z=Z^y;j-yHb((I_EOrLo_df2l1Kop&HfaeaZfnh|!gA0i4#uXeq;-BP
zgA?|MVBYcJ8JYcey#S1qS#P8Hyq-8Wsq&bM(K+h!dWvgpSx&FudKkWaZ?>;=L)I5_
z=fUFEO~(Fvca0OxT+xM+G6vpwT^2uCn7XC}rA0F=+jiYT-5dW#XVQ!e7@<UdP?MhF
z#5aYF*-*I+rh=t2*%3&Kg92V(j@@Y8PMKd!>`fg`zRlpC`9{p)Ci0lpAff@Gpglp)
zB3KT?Syo2){1j3_o9^Z#Z&3N}HTugD)KPY*)8ulgYdtI=J*2^pHdCvH6s~jH1eZ(C
z|01qLJ7YjcMyIw59?Kd=A6E@hc;E!A*1Tcux!<CZ-nDOe7gDR>B)D3<VdmMt;(BvR
zJa^XV@-WSyCvITQ8@R&zNhQ=M;vlfV{ee1NxTp;M_ZL=kOhb%xsFmds<TkKv_)yI<
z{U|2XID%O->n+aT1?P0zGVsS{B&AA;b^>WJJsF+CX*da_e*NFSgT6>=^jZLLmYtWD
z1Bsn0*c_8RGa!x&$?V)QdHBBz<cQFyKyGM(K-_+tQVj0{nPQLwV4QuArR*JaGRxCX
zgJ}$uXmY80vHuc?5TrRa(&5%_tWh0TqfRj#KDJE4*(W_Lc@EE|Z3}@0$0^y1la4MR
zO}m1Dq*982yhqAeHrT-qoo>0ETTo5EU;(Pyjk)$Je>82I^ZT^HCeNj)d`E(1Ow){&
zCz+@gv}8oFnCe3T4CNcIH>MPf4t8{5=+Q00mTV!0i;OauPyPBp@$0xst%X|Y|4sLL
z)|}x;;Fd);JuqXJwxA9TOy#ehg2<3ttE0gJoXhN@sh!~YnsyOn6#Lm9q9iJr3^o|!
zaIs3JPhmgp6qr9nFq63kvm0T0vePp|YJ_inMd`0paBuB!Ty|?FshgY+4Z7Xa1BP$D
z8YHdrm|{ZMNvYo^mBasv>}9<KA5yu18lRU5uV%^SoxOJ#)@Uvn+1D(HfihdKA$>w%
z2X+cZ1?~XYNI4C~dY$n$i?y@^Gd1q4Xz^n@f$qr&e&zAV@gg%&@xr_{xs{y*0o5|H
z)dTr5=OY2v&erp^5^}hYoCfvi)J1A^5`x6V5;@HWd^R3>XQtUIhnk|vj7yM$`9-14
zEG4e9K0t%+{pLS!dQSu!^}jlRApM5v&)Fi`@E9Ut{@?wAM1BxzeOe+-#&+ixlDB=i
zYA8)YKiimTn$_cjDq(APcW2Bwq$Xi+A2<t*2&EN_IRR8qWpL6e<wso3dDt*mWe{3a
zTX^!J)nu4Hmux3AAJrO;Bag(MWI~o8T^(I4##>d?!EplhzISalhSAMvX}?UyQ7j=V
zdXXM^n!Mr3xR)O<2MeB!mD~tl)>=jn{qLp_r@)PjuoS#Yo0^#iqi5o2Mlj$$T!<z0
zF)cz=F)E2y9!3i`tG|I4laHCRY(<{wsc2+oh~aGNh^@A!sYfPY_1?9gj%_)N=m~>*
zf=ymm9?;5<4oP#Lxw5wbO2ObAFBW|J)bpHCs(J1$D<~X~U}N)}k^h=CAu!(i_w@p5
zMNvh$5jT}$TZK_&Tg;FSnHgf4VYQt|U8Na{gfvInm8!d6FOt-z!$j4~3>`50I9fij
zvTa=!={A4Ocs4PDj2+XE1bZ)qxebW(#S^w;10BtRXN|&9#ATs9rsXX_7ELGHz!v<}
zv5=h|$B_UobZR0!Zh-re#4cfdAM~=y2qLsIVD$;o<Qx-f<>2Zpg)ShwL$=65XtyEw
zS$BF=G>d6trzd!|vmkR(y37h8%6IRq#*tt=W&ncW0&X7kJuqG`KZZ{NIy%TypL2Mq
z)%>qEEu`{O{Kh$uxOfr~v8TKJ6@wp{N$zZCu|MKxnUeg$7!6FJDAWX*8;*Ael37pr
z=xBm6=L3JN$F*$r9@vcJ!v;MEk#s#DL&py`-)vymLb7|!M%CY#^5V=v<%%0w(N1kw
zE9u~08AzE))hG|g+2U5?xA}q*4<dWJ`H4uGJte~C74wl5`jDtKLgb~U$Vky^fb`zU
z$RRBY4J>e81~?M<Of2T{r>!1YJwI$0b8$Fx*rbmM$Mpjdej-(QUGiJFPcd!2ge=#b
zirr|Y{s23&>2({UU?_|V@FwdIj|NH<jRpSY6rq57!NMz&oY-G~Up?IG3yur6a0BMG
zkT*X@F`d}f%VJNas=iJ(-D>ik+)R|m0M5*Z#9auK_Ui+asNv+R6vIfV_mNDXjhn*#
z2E@KcC<)spQp+bv9g{ZSsCY0pVxsETredfOCJHwn)uea#KSFZZ*?dWcmcjUhJ_rE;
zRAB4NB3<@s{-(>SmnQdzVO%VN;RbUckAti6^mRb#W47L)0%pfl*K$)dF+cX8s89T4
zEQs$X$%V()S9F^%7TF4phm?|o@#!K9uFZ`ZbS~~ZHA$;yN&J$khv+mJLRXtCCDn`z
zm7|tf>R;!#A5WyA&qFOSw9V{D#QP;~2^d9wCu;4|Be4y0(~_Esa$&aYW@t1nGZHi}
zeXL*FC?QUSWP)1L+w!na<ogo990urNU16`QHjW~-FB<SLM*};_*Pg9t(oXS6fp@_f
zz4&fGO(`jS5_NM%ZEl}0?ADU1{*qC(r9rWYzD1jQG}t%7DWu1YU+vWe{Of!z>tg^{
z$Im**5XAz%mkd5OiyPzjx)oaGyaEe7yNc}tPp>7b@UOBOt$}DIEvC(8&SNW5WXjG4
zYUelyZgdx+(&{dBqQI->R^4p1TdlY|95W_;*}&jswcMS`Z)Pz@NyFkl4Y#dkD&ib_
z^cbeSIOF)qG?=!T`g-ODjC6oGU><m(@K4xQV(=(uF=WxbB_g*=P+a$s9I`_kZs3r^
zirbg@&p3_*mJt(`Kr)A7rX2N*&1Uy|!Mn3bg`^ibqR=^cieu4f^Bk1#JWw}DQc%m!
z4*aMF=#MRq2Fer7yuipGk0E_jd!lOtDr-|Z_aBO=z(>X9ts8Ew>Z6Akn-JC7TEb8%
zSK_I8*DvcWU^DkE4+Wteqqr*X`@qKShTOv5I~({Qzj??+$Ymi}a^I-cOrZ^R=((Ha
zv_oF1YC2JtVYc;~XDk^?xuhwou7mUxwp*y71_>BO+bYihyW7j&SNIR<AUG(HQ&krj
zg2msaSE~uQa*o#YOG`3p`A!uhmOoac)eRQyR<F(HV`2N1E08JCJz-78{Q#}$p$t+o
zdl+Y*MI-b33_=h$;Xvk!nTOL(H`@5H_6x2BQRo^H=}QhQ^EMPq3z{-`x2_YgQIagE
zWh<HsZ@#xM{8LAigef`#Z(I}MIwT?Z@^k*#EL^&<MN%RbF1kG%!js0x{0%O*%F&aW
z`pouel0)+j*L~1dQ@ZWIE|+<JFg8~y0gjSZwuu6*A<y+v+L0=AYF85SqsP`2%$F6_
z__?Hcu5OMgzHrZq$8fL4lNAqRj*&-_cGg*pLiKzo&6rFt!5ZO889;g>F|mnJGM<d-
zC2L)GBAH+49v*3Irc29ja}Be5DtvOVaB{=!j2Q(X0)&_F5oWEpQ2KU*t!S*C5zO15
zkYQUraybpHjQ5Uj%k9^$LFG&P0g0qo!T4nBBVp^DlBQxQL{O!4!%FD*7BcP(GGX9q
z_^_GKt`U;>eKDxOB&cI~V05Bs`x!IJiBym{gO0*%vEO<y8KIRdl1mG*aB>n|G&s<o
ziIPo@;SdP$;O2QMDQWZy>oh$<(JT#=BViKvNfrY?{}{A(;K{?uSQ?5ph^Ic~kOV(F
z)@@eshJ^h5o`<SHmKa7{MPi6yqx|a+t1tILy4L6l(&Zm4*bXHE^w>Ug!Lll6Z_5kU
zZ0{Q7Zkog`q<`HaGvlj_gdR?=DPP_%kg=!W0bke7`nD2Ix;-aIZn#cbJ#%L9F1zx)
zLJeXW0&i8w^eUAw|9IzBif@{iUw-=ubQChy-?3&2(*6=XoS%cCq6i|n-41370Jp)M
ze$6|*`Jj8mij)0LSDFV#cU59ds{T&I%Dh0Bz#sl*wpvfo364(0g&m`Rl-_DCbt9~@
z8a8fL(j5HuvEm`5fMju~i80zk^Q64=uFLnoU4fo**|(!n4f_*fO(WQl*4$JH-$dbp
z{0rj@nFf`O0TL^A`1n+S6S!~Pg7>JpEX6rXbxbgie@PVn>IS>XBz{Ojg4t;op11j?
zsEO8H=|9YDpp3vmWs;_a=wj%PBQts*GeIEIZg(kpzFXVDuivJ>+d&>dTjv;oH7SvO
z_Ix*9AX>|5-Skuyog*L4-~yv8L@5$1tIV9#fheo$LPr;BujGvi5~)OSXkq=ASOV^K
z4{`_9xqMPNS5YPPr=BGO5BG-g!#;zuZC67ZB_TtY!k7Cm`2v%G1#$@Jm~i2*cQ;@r
ziFSHFwbSRIq^tk!d@bIWP{d>dW^AhG2#tnBi6;_ej*ZPO9iRpuFN(TlSWWS*uqsM)
zPd5d>)qQ7P@V&GFIl)q+KwaRHw_rwgkpUFYR<WOQG174t6X_75e_(+SrKWJB81#e{
z@ql^0EgDPoD8|pB23XX(*}5q>2AtHKYO4m?(N(h7NC8(KOuR`(9BFCK;G$?EEl|b|
zH`CaQQOBryYrwS5ApuTj%wuse_Et4rH>2BrU;$wNarry8fV7Ai$C)OcJ}qfBof4{_
zk*8!rI%qd=<aZ3`KuUtR+!9KEDOtDuWc)l=Od^E)N3a72xk{_zNwUOi+5y(5bsr-^
zmOg=)Mw%zq4s6bpP2W#))%itKXb^Z|62?X^L(fx{C(`O)Y(<^}MEA{_o8Yb90)l4m
z6L<0p?lHUum0sj1M3RAb#Gd<Oq3x5g2ridED~HBCN;O>fie8pm5*CaxC+_YY@XQ{P
zu_E`wEPT&Qv)Tcy#|B^?*<^rcpMVXc@A;&zZj&2s#mn{MAFQ-GUfLHSQtIHQme5TX
z3p04bcrXbDm1RW6UsXJ2cI<NF<4~6@l(GZ?Fm~gDX&l+~c>kL5CG3|09Jc&CKk1%R
zUFzLD{(MR^7WYhT#F<>Vu+}&4EQ#SP?ohv!kPhauH!C(X;Erhe736jS8sv=<TZ;}<
z_6uvc$qI$nTFXFDV#KK{|ARO1M$yd(sET@a55xs6SRS}cq^!&+rzs6XRD+?&d7Vn2
z_q7tPHF}=<{4zNEQ_S3eNw6GzWNh-{hf<8P&hZ>l-XjOr&oIyxbb*w_c<W(~*SU(W
z_cd&E`?uejJ`fE&F!OyH;XgFRZ32`j8UBZ{d4+x3MJxB!@nxOdP}4#|v*j<=x&%3Y
zhWB7u17ZFvt0r&@j{)_9ZQ(?+N6>0BjK{!nQr51+p<Rfj73IE~AqyXYjIUybgo1Ae
z(2Ig7Xb-wj(sA3m0Ss89pnW@30*OTRF<mQ%b#q0Jb#t%383b`3^b*&jE`(5NkAbUw
z4<eRfwl}P?D<DTt{6I29H)Yf}FvbOX0gy$M=!!n7R^0gvT_NHbzVqrBGmXW4IM8C$
zwosT-qh!R1N`cd9g$g<yAEk4SFJQTk4gG8C)?0E}YWdKZcL3m=m=VRCg98e&rj0v-
zo+vU|F}KkUYv>!G=EHgUhyKFQlySsEvprT+v*$M}Zz}Nm)QL2xbk!y@qW??@=XE!t
zS{XXoW5kUt{EqShjt`dHvIm*vLDC@Eiy(ith_vocYs1hh_AdbU(7WsSd1>`2mrJjm
z(VxW_AtSAZob}9RxB#z9!+a--075mk*siw24>#=U+>Q;lESW(2x5QB5I0+Dx(qY<(
z3n!|SLO-5Zx(WpqeyN6=>-HV1!)y1OGab8^TdGRNgnRB^>h|vs{(fH;?dwx|_Z{YA
z9t`h4zZ!slc3$e21(DLbm$34NO~oA5(^Zd=4?NoIJW|sONR{tWflHWjyBR#q#2p*Z
zrRopxZOB6Wzg(ah44e#`dwb*n#v%|K`ESpONY_?~KX(a^NS=Fq^xQaBQ2L`c03(gT
zY9%FX?K?`09x08OX~DlREt5gV_Fr`BBK9Z9=gJ2=oEl=SaIfttaPVxKQU2kqu&vWI
zWY|D3VV!EU620$I3?E|cC)_#nCsyg6xs`q!$H+*)A84eRqVOR6{C;w(Fr4Hxve~HY
zlJ@|C5^BA8{~rKyL4u}eG0H{^5!}BkP)Hmq_ua{8r34l?T6}f;60w9C(+~m}uKpH8
z4u}=eiB&LyWYAbe`J&X4CKi-Jz2g1lgiKY;c+0#v>K+>6dALww%2)xMfOQBI5sFZ<
ze{V;_WlUt*vJR!Z2zAm32@*>si%3e}LT8!bZ9~2RQbL62m3K{(Jol>j&Y&$#mtkBH
z=nvo!>)v6Ma)?r))CQ*lC+VS0i(_@VQa=vbg)J(X%-GOlI*~zk6;LxK|8&PBdl6)t
z7e43EwB0$#p*Ib82AETnYoRr4IbUgeNRdTmJ{(pvJ-WfsM;*39MkR|=0X1VTUSg4B
zS#f9=EAsV|j}os)^kya#`lJ5TLMSC(0>t^EtanRovk!bHN=dqdQg8ff8R5_|E@MXd
zM?31^U2MiAFBH439Ch)P@%PyzTD6-GG$Z{&|NY0;=}jb$>qJo0&jkB2<~B4@eCxbr
z7$c@%IhNw@J}S+4vPWPt#jE_^^uVhBCvze8QNPYsj3E2ls&2w|`2@Drhq^%uu0>nX
z!1?}Oqe2W%0K9Z)mce$)qNk-U1B(jC>>>DlSgW)Tl_iH>H>4`hX3*G}kEfCHZ20$p
zF@uvG(lk?^TWawl-NVtvk>WepNEz;Y(pIktO{VzTuSRvW2!(%UA=>pe(Tqm9Zf4To
zz9N>A1Snb$QITI&DxTr=e4@yIqeP3>+4V(W1I4%8IG~D8i45H7c&K-q?ig(OiEUsd
z<@|<qnP>>;`SVVU95J(6b#&y9cS{m69G{Iug!msY-15utM3&?g5?L6H)$!HAh$pV@
z#=Trf=TIz+xr<~fNlQsB3)B*@93^n?C44}7F5_s?>TAgv5R3+lEQiT{5<P^l<{+Ay
z;xPw%@L-ub$~pVHCejd%dQz?3D<`>bHaxFK<Osy!#t-#`g1>4BbopOST-~itsum1y
z=bMA|(35+%%bvOIB_yponIx(>XRp0LgF|Yq3Lb(*2qW?Wj}5Pe{lpTK1*Z-cNe#Em
z+|QBAD}FIgMyXkx%g4B!TK1po(rEfe@puYx{sG#P86(fKe`m|6INM=5{Fqv;Pp8uG
zG;*ff97SCxNReWnGf5=7+?{63_?Fb+0M=bQiQ^zRS!i&vS@e7uP^4Z5g^r6?6`?9>
zId&_Eaq5BhIR9f}GPsRsD3$8x+G|-zkl<lR-G6jlaKUgWF2Oy08+Z!{qNDB7Xo93&
z(*U%Oh*>8i6*U&GigUmQ%~ds20H!d&)-dO8!ZLxGEW$&16>h(&{CdmTeXp!$afq{>
z;bAqkhViEZ%lEi#C2PNSgV&MUf1(Dk5U}mZjue|C^&tvW1VOa8ezftiPwC>S#T++a
zPR|C|HfWj3C;CP2hMjVuDVI6Y=08>;R9vbrlLRo@H+-!yw+HQ)5#^)laT|tF8!xbX
zo#Qh|z8|yzy;o>}LmUdXCCx19aTnAOsqzUh?s1n24YRRwesoq=xu|Ts2MQ-6{xtPh
zko8f!E0bTsy(GD$Hs&blrS-Gni1$tW>&x-6zhuPBNLZ*D$XTUCdn5>~gzTV^kMozG
zr0XCj3MmeYzl;JsWdMePsv<IApz9#S#~=_4sp`Bk;6j!C1mco0zw~yz>^=KN134@?
z@{Ew80Sp53UueGYzlr)@rJP0%xU~|d7z*S03!cmPrORpYUL#Em-IRePCz`ZeeD;fM
zqU+D8bqTx~Uiz<~`-&3jrI3T8P!Q2|19VKj#tPMLFtL)qwrJSbzYDIvcq6c>o<+D2
zka@23SKFU5DFBnKH!()#T16aPowcE-wGSEU+rUL(rcTTkLBF%oS2jwzK>Ah9u=V*p
z=%KxWE0L8x(pjTGF&fv&o6_$sq{%;+CGZDIVuPs4mq;4|O~V1y`G}oaqQnZI4~hm<
zMO;7t{vE`AhNjl@p@C|@o{FOhp3_7uMuBC%n2477L7~lfO-{wVmQK%h>6G@;4aB@X
z$7m?Gi%5DydwRg{)ReqU47p~Qb|$RCZPcigv7Ae-Sr&YTU|p*`+C3v)ULSqViap_-
zlN04Pso0DZzTU&@5t|uE3!#&6NA$j<EU&kaa)idSQUq%}j9_i@L&N}nrl+4P;g_j{
zReD4p6Fx-rUx7c{pr`C?12t_RHk$WrESHgjfPKjK^Mddbp}&9Ip)b(yXCTsYc&;<D
zd>2P;so{m}yIke0B#pZF|8ecgR6iI)QjBSrT8J$&p|up!NDS~B<26KBgr5{*G6_6B
zK3cvQDd1RO>#3!u_DN0CFU;)49?N_>Xl>+k<JTr);ONCSvNieJD@224xFZ+dyOpv1
zB~KntD&Yd)@Q=-YL4N~|{)5dvWZp1+j)LePANF+|@@y5rmWOrA4w2v6$n`T(tIp3K
z9iXeAbTe^oN*e{m=yxgm+Bkc{U=!g0JK?0V#(1@TejfTprFA*($lFrn_c2~c)egO3
zq(%0@lCs+hMu!KSK%22J(Y$;q==-~O9QL5m8d|TlP)itD0;&W6e7>VKhk92SpN(;c
zUo!wwURyGQ1CEo=Ap8NOUPQ?qMmn`C-VsR5cu?8G@88qKUx8p1RZ1uBdrbgJ{K?9(
z#*%C~HXQ@#v`n5$3MFg=v1O&C1sTE^21HC>1P<CgfZl2Wk4@<eWMBT&%D;f@R|0h$
z?SNYj-l#SbUn*ciR>STN6;h9)vcJ7~RqR~7XncKb>$ZNmw@f$A1j#0XpQI+-g7lL~
zzbg9aQY*4%pMxJtuq}iOA=zU?L*(8OBSS0E5&ZfI38rDtl!3bOln@XNtL_t)VOgqJ
zLK!W?md~)2GsZY%K_Qf}w@IG?jfGX$6G!Ir?I1m7(*!usfFz2GGTLu)vaBZwxyrAb
zjKs*T$(0_;#2rva_X+vm&OBc<0P}cUpS78#37vW1WO+Ew!ep{Xz&el4YkRnRTU$wj
zUQ9Pe_TII$kY{XYu#%%Su!BXAclpoGtVSY`%VP5H+zB$a0jzT<blG`)5R`KnE7rqK
zft%20F|1Z%25t-RoHGBJGv57hbjyN{vvu7=XHbvP4$zEPjg~9IdGt3dQI8zXL-(Qv
zh5gHu6&9$D`~V?rF##DAC|6IdB^|FC=&29vX!|zKe6{{-F``GpsWMIa1o2MV`!NdF
znMGpDa3FV@`KvYaZvUKX>dT-!XtRVlgsonlqA#*S2dR~os#)6LDUI>5=)$xr)}uRJ
zP6vtSoa5mGpaq-gq0~m|ny7N8Wy5ytn1Y%MK&%9F&m5NEQwA%QOb<nZ;jC%9ZSgy|
zo~>f0Fw_zY%${?VjJL=j)n2=R6u$oStAWH$Bgi2f&eX*nSObP{x}88F8^I*ekn*CC
z9`$ITGKd|my6dxD<XP2Fd*Dw766q=^DEKSloHdpo(U4K`Qm8as>n1O=d&No{7<ebi
zVuGmu$bJ`r08<-EhCR;zJgOK@&8$qsG?}3v&B9I!4VHnBiF&Cl3ZD^`GpDP}fvixp
zh`3nF%PRyKmHYVz2DG#+f?^N}UpiK28HHkj&QMRJUUd>yCGjuo+WX~quEvFICvku<
z?R`UNJvua@97PbdJ}IyP8@X3r4@Oxz_ET^Pwa~dorD{1;!10l;m3`Lz@5h!>3_>ww
zZ@JaLe%ULNnP1ODVpy|(8cW!z<2XN1lA@Ik*U*2(p=<9Yzv56~Uf0ut;WQmG&L?Cs
zbjOSp8$(Ht(&J)IhM7MEUl>xwlL)IHwA?H?UxQ4ME~c@`m5fP_*s1a(E({Bio@9o*
zCDw+sR*J%9{>{I>aGdxiDYZ}H3e$mmC6GsPYdb`xje$P8X`bn3tNjh456J0Jt}wy@
z6rSTeMZ)#wGmoACo($OaA+Q<Ll|DQ+%Iv4P8YYP6;X^<G>dx(wlOOVK7o?buSW8kM
zq<O|lJLU4I=i*uXq2c_!i<cK|<4h3DKpXZWWy_C=PTy74iih=d1=KXOHC%wTZeGH>
z+dg4}_n5{x=GA&zT>;m5Azf<@v1hev+2iKY$Yms3#^%C|>L+XGjFREqVyVLdHao3?
zpU)i=zl^@GITeGZ?V$&RPb?Bsi`UzTNE9=8REA%W09zFnXaLu-?2$lI>^Mm1xy>ox
zc3<&XqjnZX78L}1D}y*OVS`5)Ug{HOa(A2}|F|q)l>6L2xyaM$4suzhW_GIw?dyiJ
zL-fb<$uG@-Q%2i2>(cgz&YNfVD5fh#8emw4(szvP@bL`a0(I~-9G%!4)5%Lz^~2iW
zFQ>@yr`|J)g}<scNRZgq-vGeEN?=RtxAep?3Gg9A8&haxcm*+f?lYG0|LD!f5lmW7
z%A$E4I?TR49?Eb4Rx{;y_-eE%S<o(W&@p;rwb5qlrTz*(0?PQkg?ZgK*|8G($eRa@
zj)?2>xD7IW5JK_|#SZ07)lm~Tm8MX@(P5qje*o&mh1T`rl!B0)Yn1MS$PXKR^VbF@
z)Dp)^cxG0)*t<KCDoXEqVKyVbOydUxoge=?FKUl9f_3Q)<a+6#lF%KOF6E=|iP&WW
zLsvy_zc-KZ)l6qjP^dU!>$SAe-=d^Bh-+enku7p*eIKnWKI)f~ytvi6yPWN_&U61W
zS3!oO3LcR`UrO_YB(F&FzWV(9vAHq#z#OZ4dP#cbQGF;vqR1nN1t7XgGCj=}hTdSB
z{Wrgz1}B}A;99!M+)S0GY4-E6#NJ#%3ChIPakTr#^PosxEIQ|agPV5dLC##F@ZsU;
zjY8}w(;o1+X(o}E4NIuGqezYA!P!@Y29d^(i+XVuRrdAZmXwLew(f|dG>Tb$!-@xB
zgF0hTRkF8JUpzHuoQR#-S-=%PFa=2zUJ4~EM@|4Z@A2)N@|l`mZAnf0k^*bVK0{c&
z1?&#-uwtargcxBywk>OJ)q4;u{jg6F%}-OMtLKMP@5~JoB3@+fD8L*TUQ~N*jy#ED
zb)AmbkabOwHt`Dw9h8cqcG$PI$sj9}*`U#QPaR;L#ou63uUUO0?<ZfuPYN-6_|AEl
zRBsjZ<t0DYt)k&Wzu`|ak78Xh(VV}4n-L1IGDQq47a>_N<o?u%&=))i7mxTfACvBd
z%OYRKQT9TlTo6Ma(yCnQEGK~_Aoy6|ny`Gv>FD7inRK$H9@IbsT`10_aHgtwuVx_T
z>YpY+uRTd=NF-svz2%jurmtShrbPq8?3$;GUpE*Fs@(VMXp=nMRy2AT=1`3lxl%Rh
zrT1+0Cv8^&J!Ak;OXeqBD)bGMgFBe26*%JU^M@jPNk#$d$bA<-#G3#<PouF&3QHgA
zD*(STDc)tqBtk7#*{i)j4Qvbz2ta6p$PUH$l~p_kXPhOm09J4vWVd~FCBQ!JH#r`1
z%@=>xsfoRcT@1`d(`K0465UI!^ZUFVbC32}BW6j3NOj96`;y?d2&N55g7ny}fklW$
z=rsc@aE3H}*DoYS2jJ9;+%x7BY5aQNmx^oeF`#m1G#}(ZrR|qQ87pXGG^?RpVd2wN
zHzY4Ev0eCSvaZuCm`;w!(@K^B*!r05KiHXGz^zaNtf7Mn)$JMXzO=bp=fzsz-*wUL
zKFy#&|3V}*p(lRzF$0}vCz&%p{{_<mFw0(e$UwqMkDVSH)1BSf_{VvMXu3eq!a%ly
zSWh}zdkXfbCjPBv=ug2BOvkhN@R=4N%B0o%z|<8&*5TKz%gVq=y28`#)uBn_f>?bv
ztw^(t%Aq&ji2}J~W3~8^Ebrm7&d_Uv_JGAs4==&Qy}q*}<oBX1As3`d!VqL^?Iz;a
zLWXRcQ&a8u^RK;}gk^^POp=Xgi-BXsaGD8b?HoTo_VocRX>aXhzFXm7CDeJDMM4x$
zPZvDfWF;l#c~XsnO_3}9LINHld`3lvBWWCW8PMH8EwoX&%(55mg0CIjLe>ya{9<0y
zejgNaQ#9=$tHEhLQB$6;#FTu#t-JFwzm56Klg8EFC7*evSVVg8Jo2mqxBH5RU4vnX
zqz3~1c&Irc@FWxRLHNU2;gu6RIPy`FGN7T$Fl>>PW^j~1UJgj$Kv)ghX95CAfd+j5
z?j6-l=)HZ^p-fVT%u%|PZai+md3D;cM8rB$@!@-WZX4H4V%vzW;w{2eq$y7;beW)S
z593@+nOqo^lit(%Be;?eDRiQb8Z7@qFdQ^QF(8dTvA51drj$0NmnmK{k6<t=Nj@>o
ziZ)vP<w3Qe`~bfD22nZ81sFUg%Js_*M*AnUMTK3e5xjKSv;aLz<qCS*ahb;lp(r3e
zI>>W{nSft@22lV=@`1rG-2TorTYehn!^s7NcCH74bC6I8(t7L}KEkH!8^Ml<F6h^%
z`a^^7LVNy@O>F{Gc$enGY8h-o7@e*yb)8QJJ6^w5h5sA|l`%5sl1B&QwzK*;O36Yf
znGw>sHXgoF50F~H4Gxh)xqxCkh9D9_^i<aNU)gJ-0G`Gf2N#0@#&UbBDxK9UG9`QL
zNgrOXoH6oX6@e+%1kYy2MgudFqTQOabmyQW@GU)W=hW{9U4*yw<+1be{vBMR0TyBK
z*kPfsNVA<}v)^tvT8w=-9Ap!7I8R|Bgm4>DaB-eRF&{UoDF|s+!$iWx0xtW<$D2{i
zrlwadF;$6uw!{>y#cJclnA-01lS4RQVpGV~dzFE&eFpRRuYcQYwb-afjlIF%2OnV(
zTk7=!ki3H>q|CyG(zNKwycNYttWPjWds}DMIat3dcG84CcL@|n5J1<oVG&(y&{H7;
zM$n7_9!M}GCCr}zrJoQuX^x|57-NubDSU(O&aQH;H+lN)>g=TXVjs$&yfCx<&FekC
z{^zeR*XI*3)hiZQ@iNIo5FDi1#HdiNFFFOy;z9+qivEiBCtj`EqAv>`JLO>_V9!~M
znJ4HW+YF&8pIW1!P2o*D@udDZEQ>r@Rqjyui74HJjb6)x3rYHP{)965(Pwk37yi6;
z^D~8G6h$uK8nymcph_?VksYpG)pO^)DPiOR*Vsq||49qXfN9-wCRGfZU0pjP_RSFw
zI1p4?<beWN^zLVo>rq|KaP(oL^nH{uAKbB!zeI1Etx9kHj&n|@%5P9`FP2Su=y=26
z2G_90Z%ufces=c=f58Rsa9>E4E-!{PX>2osR1L$Q;^T@$BZsj;+k#YU9DvPcsKy9{
z-o@w^m#Qca^JK9{Qg>hqIRS<!j@H7dm&NW+rmdUzhAJjKx3odP%i`$aIGUeb#KcuB
z^cbkeNTx0Y2{P-`YPaV8j$p-f%fR%F+=0<?Ya`@32p(`EjTfXsJC57EBXIt66C%oc
zy(8{kQRI`wM@F3LHS0?hJ_gAAC#Y>sy;eX9(Vn1>$z-A9rH4Zd-jQ(^lvC6`@OE@^
z7Zk8HdOvUF8sOqzKHtNG882vzfg^FW*}L|I@&e0y8Pv};c#C(MX(FqMTZ6kF!e$^G
ze&Wf5eK~|S>=Bddx}mmG8?B2ofMTBg94;aX$s<KNs|}_--<F3YES+0m5&Rt3;t)}<
zJnROWs{8>SAjK}x)OaY!ixf-w=<qhG+u;Rr%}(QL%=@q0_(cY2Z~^k^*vBatjAp&c
z**J2OSaJ7rjsklpci=P)z6Vb&Hqfu*d0DK}DH|rzo0zeU*n!r+tO~IM4@k;mspk$4
z$ucPIW1;-YK&=OaC-8;<r5<WSyQ{!2kL9BDB^t35jzs<*Dd7;RJ<^}q0tZ|07`oeF
z!k8Y9jXP5B6+<9PTySFFY23GiI_EBsSe~B&87nZ(Igt=}WO+I5&w6DNw`aZ6)0e`m
zFr?6_E8XXxxzM*Xk5EBajHdIr#J=LIMCz4lE$r8d7PORt-PT4@f)b3SbQyo=X57eb
zR#%q!&~GSKft<><NJrfgL!Vi8S>&ujTceoFu_E6=C<U(jI8v7udE+ij7s(kJ$+a|G
z{lw3xaNM>rmD`)^Xa0^We{$UU8`X2DeA~{Kk`Y+`Pr715cR0N5)Xi^7M~@36=jJL8
zAoXR*R7)WkB?aAdfCBfNJ66G+HSNS^wUa?=uuLWHzo5L21(UV=mv--xBW(q(i0H2A
z3CsLAE6*wz$5m32ynNtnVi=LTyHviBBBF|mnzzV{gLk-ei4;v;7Y9jlzUbR4xR06S
zEPo$vYDQYXjH3ry>^DFm*T=nVvGqPI9Pk%dojTBogZSte4Y(=%VC!ayG;X%4S)Ed@
zHm-&9zzB&}t3s@lDJGghbgUZ^Tr`<f$YEGQI_`8EAjK?V8OkEpfbrlwCDe|L9%EoO
zDsfm+ayLo0Lgm)}gpx}5O$nd#gXR}vUJor`B-MMXA7Y%F`UG|IpJ0rHRUJiQ%ntPH
zhcTm~i76M3a$i-ZDj2!;J5Ww4+oW14Usm?f_g1a#g2in3A!-ls31S5Oc=$>I3M_Os
z4##|}>0f|w>9~~I<a%o~Jq4|UKDqZpukmeE=55s;DpZHr1Oy+;4=ETk*8A;Z2o+6^
z+0~GA=x$8D`tu1M3?^iGeST8bT0#&mB|=rxOZ?IZ{zid7u;9+I{%_6Chdi7RF<tIJ
zsKK?sd352JORDtlC2^vp@W@zNIi^al-W$+!&19dr*x~lTrMw*%%4VIE2-pyH1FiD%
zO?_m#K6M73Y&z%Ubep+lS^Pr|Zb4`C5~g`|dO1*3(r~4GG-*)nBt>Ajj9)zRqc(n>
zX-;^Kxa<@<!MEOd2UP>jBEVR{tADPY-~hl{dVBGPKtD-upo`_XRuN7hd@4pBpx$O<
zZIVn-PRp|kjEr5;olsf}@7%A_-1Ko``t$4za2N*)ZV)1C{xa&Q%^mdCZtAl3-M)4R
zm^2s+8*_fpdH$UwiehYwHv>ez-eHQjv$KQLqu7ptO0QyCx#(g&(I;^0cRwWKrsoAq
zcpgR3qDV91vUl>9E=FeP?Hz1t+PgDtv0?@IP?f2r0=?M14>}yI5<q7~7gB_Jz@0Vx
za5U*D+0#&-y3B*ETy4wMSLdC0A9H)bZPq!yvu;G|<eId;#@d_~@rYvyVeb1}x_aj^
zL#5i$?dTX1wn|>$MpNu_Owv6}_iOw^q$0_u1D*vY&J&qWUP8ho0VN@Q4Y9qM61=!_
zQ=~NhXqV(z(Fn<~s1H(5#6<`#D%X0(CeZLM)vt@-(;dIwN<B|W7<t_?!!#iu+J>#e
zyn3vlhsfUY6vc>nddadLQ~7G~riNVy-wd^6Mc5_9VXg6(2ymqzFuXq>n)JaOgt?e)
zcE->l+1`VZ>@r%-KqB}iDg7o08m<=}k?Z1c8(p%IOXRNipNL2T4+q5lpOvPjds5$X
zR8tG_SQ=JI;=E77aQB@|xl^8bHi9%U-uppbnl+7sGub!2Q-#<k{&O$1sz=H{-s&8A
z8GxXL9pDg5@|>s=14c1?ETI;j;4@)*wj-`^5>tH$l;t(NGzda`bL4{1;ykM%fM=)u
z(_gJ7z6Db^{GInYY!Joz)MIElJ_|$ygJul!x-tI1AMsG=ytWqVb9Xt1ZSl~Uq9xu;
z;UyFctZLsa=)<+!v;Rs1Y7kiRpC@lXTlC3Itu@q3riW{Cbq0hpiUu;UjdEGEDll+_
zQEyVt$#r8sP|};++#4f!g80>NSXRxq--1Zr)~N}yXK*@lws?JaSyJrpv3a?|kxM_b
z!<f=bAFjX5UQqgeApK(ons&FA5z8)ilfyebd@vz8N9LZly_gp~;nr_-MS^D6<@Ew~
z6XPAK(*inF=zY>OZuYDvdW*s?7-!PbMVV=hfSl;F9j=%Zc>?vZf2V_R>u!54M)Eip
z+D3tM+N>m_KcOj|zb2!CM{a~n!%gi}J8t5A=b-|yQDID>Us1UZ{Wt96F0h{st^DoP
z6;SnUhQQ_8X@|%tMhdG&2+^>(Xd)g=WSv!L04(qV`T9>`@u4}q^XQi?JS`iacE)p2
zda}Z`{eAd!2&$b=!6`NU*~T6)p99anmqXVR7pmrPtpYCR1QF*ew;TKex7x~H6nIn}
z*FZ>KoS1c9Fw#9XV<db~bumXs0F3TU-a~`}e$|_;n$P<Al<gwR;rRxB<4htFN6O@+
zq4;~X9X&pnNSxkn*h9TctHe+V_S(N$UZiZkfj<ATL^3d6;|H;7m0l;f&eX0u+Xvnu
zemUMuT<;UMq5e54$(7|taym(inR_f?O>@9Ix5ux&hW8{>x*27jjt%N<O<sC_Ecv<N
zwszpGlSG*+Cz%F*tYV<Pzcd7_RJ5j1^5LXRq@##7nYdz=W|qw0QYVp4*&NOw6zFpH
zkYSGG+p~w!)Mxualtg$<YCU`ay{3~-pzKqw_ASLjs9;qhbtsm@(-5Vvj(tN}!XCuS
zxJP=ykx7Bh#E1K~aE>+E!9Bas0Be)>%NmD|oeX(aUgyk<tI|f(jArVYBA@vTn&YAP
z8_%LEx-Gw{Wo_NI8q}34_><Q|B~MJNO*&k8;#Ib~x#oxX;ZVMf0cGUJ2EU6^fO;K8
zONMonZ}D*EqJwVpmaD1~ZQgarNHb<#)jZMorcL!Kp*pxVe(Rroe+v{)e0@9X3V+?9
z;y}IfAk(l3n?6G>L{s0gBVBy{(q?u1dpq7A=VC+pEGvBM)tC}DH`o$XYcB)XJh2f<
zFyLYM5^}U*`Q&))#>Tkr>TvvIML%-2ml<JL4cH~+3y~Ex??4ZQ!UhrWxH@}Z*v&s`
za#Q<YZM()tOp<?b|4xp}39fP}RKuc$)nzcyjRB9aXV0|DD&`9^PQK5eOUXUhO-JsB
zDS<UyO{U=(PNwZMzy@o<6!w%-qq?sbz?bXQrZy!TRkDKi+gTPBlO3g&(uc=D`=-a~
zmVKj>c3J?|=#5E^N=oxRG4TRYHdFVKgG@|-5uj@notgO;sKBtS)K2x!pIF#aE<|1X
zhsX)k26NJ&G6;xkd&)Pwr53@v*z<AgBnSfKI9eSyAaj~xpMSy2H<>wePJ1M6BP13B
z)fohNMXK~9`ndRfELAPR)zi7@Eia#dLkv4fBQ4Jq9ss<@ectwz<}RcybQ(-JX3;Nk
z&SkMG7}H35KhwG|Y^lvw>T>N@U&Qx(!3nD1An)w)yF_-zN)&JYxVWxgA^floHBu|~
zdjs7!O1psju3tT`-hfUu`hb4co$Pdfw%W9BS+|IAY}T@OQ+(DQ^a!+kSOm@DEqAB=
z6g4=Dx#@Hs`?*x;cn;r7R>yu!+zRTTrFo^XP_JaMMvtC@6$sD_Wn51K*R=Ww)Sj!3
zci6P2^t^ssO>g#|<+N)(2*GV8W4fRFeObL!_UwPd@~Gdu!%RO(y;St<s+`b5-1+=G
z(f)j2=zQbJ{(n)m%2C-^Q{UhKfsaZ62)|LaR(fXEibhtpmcN0u{~J;}*<}@z#cogX
z>gD$a7nTlMj#*lIEO9%PGi)&vjdg+Ju{G@K8>|PuQ_iGJaWt9O)fDh{10By=p`ewv
z-xe>Mh(*_4RM0xZj`6063x;vW^E2?{?C`Mk<E`Uu$}_Iw<NUA$2M1?!^K;qKqvdnI
z6>~4#ZNt;d3b!-%^KxD7rDE;V`MLFF6Ez=(oG{;0b#-;Ikpp&pvk_yXGa>MC?X&qC
zmKdYs^^Yfav)j$o2KQT|qr=DP!`L(WTRQ4T^ZR?`8D9x^80mB74xE)$XRIRx&-w=J
z@yA=~+WN-kV*qw*v&ZA(`T2T}=j-*=<iJlk_Klt=TBH^4=lrFmW{0b@-OJ&@)-5-~
z+r#ByMAc`_-9uqxYs%+mqUXc>^W&!p_o!-fEaob2Ym3J%b)`i}xR&R8ZfZ&ej;G7&
zAmJMCTD$A*`;GuCL&fI1{r7M$q~`ll_~$Oh;^O}LX}~98<>t8OV?e8;$IC@!-KVX?
z>*YCP$MfZt;^&oVnKrR)u$|VWW?MV^tm4Q0!}j62d&$P;z9S@qwQ5P(2G`nVd;IGw
zYV%7J4(`YPVfGr&`unYh7LUK@XYYCILj33H+3!0>*oVZWX>(cm=dB|n!^f1hW_y!|
zsf_4+Y5?x)IOpf<`C8|CN8If3HTB2y;fAM^l4rBCy{GKzda0+$ec{I1C-b)F`ynIe
zr%%!4bLU6>#|ZMbEK9Tk`tRRmu__Z!A@(1|qXVouKUyE&#iLhK;=36iBb9ESYnwap
zTbnI$C`3VEJtHAqZ8kL;7(Z7RHb1G%JDy*!FFHTRtUs+M-?&F`bRO&*_~SpfuWqb1
zha*oNw<|3>JD+b@ZeI%n74|;A<7(`9K72WNxtbcNV7+>Jz1waHak1eMCE3~jjwnWW
zKkyEm`P7aU`OMhXNpd#m>Uf)Yt{v>|iDP{_cCoqE@%kAU`1)S?^9k#&Xk>UpRPfj6
z!Hwc4r^SW!=S}KsV?)ITcN(!FCujBMe6%zqXBz%v;_c(hq5Ws8V`ZjcqNSxq=lI$7
zrCRGF^CICyf%{>DB!#TK&EutgYX`Zl!(-`O3in6%^O&nUru!}83FY0V%U!`{yMW#Y
zN1JQ2=cgn_XMok^>O<uP&gCL%si<+svjyP{54Y(P@zL$GZ(B1No~NPf)b2s$=Kcel
z9uiM%+BN3qK(4V$FedB^Qr^kU>!(ir>(k@u_3a|-^;W>c=_Q};<@a_jK0AL7u)@{&
zw6|T&oPBvidAdBH-4}P46UA+BZ+&l6+~pmR*^wRX9an!{bf~yoeG6|#_gFq1HyyUw
z$F9_zn0R|QtP~nkNSwIXm=yY0xYWE?Jdw01spB5f{sy#|9qCnr`5Z-J@AA2NeNXh{
z>}+#xdhg(RoBr1B`+P5CB4+>Yfb@+J?*9GxBjfoumsF|4hX-e;;O%N^M@t#+=Ibt!
z;rsB$$Gt;luE(9#JAdbg=VpCNMrY9G9`3@=`uj;M<5MU8K4mbwa{5Q=T3gI}E1PC|
zBj*16>C^Z<m;JRQ$Ij=KeVkQihUfF0m4~*i=e=a)1bv5=)-wxs;uiW7$-$t9apx=t
zA;x!S>CR<AcuPl6tvDR_hm4E=%miw=!~Jbl$NMn+HE|m6=a{0zrRID8S<2_>>!#d0
zW^U)lcI9x-=Ej;<qJqb}Kj$-|1n=&!Cfi%sE4@5rahT@@_~-r1qzAy`jvZH^@#iJ4
z3xg+XM5l6R$p%;DwWs2DK0hFNzp&bDxND7HjF24L_-I$`_<UVWEhK%<_}o3&ct2cC
zC6M>n9Bpk?gyeYtx!YEVqLUHr67+r#IYC($dmxa)?K$-RX-<kecrPPz_uFdG`FRFD
z?EZFssVPH!f8TJi(f+-E&C4-6x<H&syIhM$EmA+7DYyReDMkZ3+gr;nM<<ExoHqfV
z5*{~v+28M;7mKd<H9cSL$u%cFZE7IiJrJ7uov$+|JYF}T-TAzOD<@r#2VTTKWI$Zi
zBqQ%PHupcKM|?dm$3E{bHy0&6j56I&-)9uJgu6oQI+dmegh%pJcC<<Mw#ki!n)!D{
zXC-mjVD5|GZ#x}2#7j9n)-G@|D)k2~#}<bVIfmakoc(c&DIGjgUa><7cvsLoi8ABn
zZ6BwV-ZN&E<me?&emXOO8X!N0SN9XhEFH)!F*N|&#kYYR8}Uy=3AD-xDpus`&4~r%
z&fP*RXG6#=IobWACkGUke~Rda_rsA{P887hA0417ZqOz5IwbTyUQv}dkhNzwy%x6P
zESBN1mP8p`<dyOr<n*m+dxEY?O6cz2T%k4uC?e}x34^ZQkb~K{+@PuGg4|O2KVMOw
zH;}Vubq!>TRpj@%>L~p3BeK(#wAxHPF0Y1=k7Z=^4j=B2kN<o2n<tb&=5J6US8Bg?
zO8+%|&=yM&StHYyKSOl>OOUFI1Vx2t)oE_J{omD;-|P{0D59L0lG=ZX{pb-?@~c@g
zdZ7ym$j-V@A6if!BglV#p=IlY7+(bC*rl*36Oa>1Un;|wiixYVCG~#JC?Y+%v-`hg
zp$w?2MfH5Rg9xN$<k@^Fu$?Keaaa1CGk!C9x?*Trd7G7_GLwkx+TtnX3zJVH;?NY>
zJpT{cmhJzb*)snZx~Udaf$dtJZT}x4G-iGU3;K8&t3J|S658y_Q%tM4%?fY&paYXy
zhu+_MW6P|uhYq1oVD|w03$c9<#R+Sa*n3Rv|7f`lT-U5xqKUtvL<%t$%REO8m&<pE
z93TFL{qGgqa{L$ezgH~0)30u2fd!=_PF;ET_jmVH+BzqF0|6v8F~Q)e`n_1sC!sb0
z_ur^E@Yej!ygx_u!UyT^!5lfG@MSTo(x+Z=*C|TVDM)Vm5q5|YM)qkzt73(TLUA}G
z7<bc-IXcpZGqNQDxVzzk+)AYbrkV+(I=n@H2%iq4K0k5q4rWeyeqNvVN_cuY670rL
zD|jLmetsX_5FbzX&)u}l9pxudpsBa8sWh)DgM!%xg6RH4f2zUFEaZf&`sbs}ADAGn
zL%{0MH-#jw$YEyoAJD{SeEE$`AJVv%rmisF-(g9GwUf&w=GP78r`6B#lQtxpS2;Za
zn^1ELxWT#kQX#%6dchUgNfG)0f^vs0ju78B_p>6H64qeqn29G*F9zHUj=RQVa|8`*
znc&$k(Pr>}v4?y10&B*Nj+A@CM_C}gNsvDf6mtI}I(7dCQO}`a(;*-C>9%&B+<s<o
zoB5`orY|K0>5Vb*Jr=x`FivLaoepz__#RF6GC<TzlF+8Y3(1f4eh}3{D!Ov?Vt8<y
z39*2w%(z@ejk4q2p3o=QAMYMOh4{WK9PhXIg5N;m-oM2cJG7dzA)FP=R!y;(lcpak
zg|cf7A1vn219_fqH{1tD{000Uwyrv^s;y}&DIhA{Al)D-Ee(fmkd}@^cX<V=LwAF8
zcXtRJ8tDdUkQ7Pte*1t5_x*i;yWDHd%rnnCGi$TY&)*yV{Jr7T&4!HsTyN+|H^`YY
zK%>xOgH10F-t=STYFzQTWTpLLPWOxavAqPvyW(H3ILkqsteHQMqrWAIugv^Q11G<!
ze*a8R)7CeQEU4fm2c$A9Gt6J#x?~%^F7|^m9Kv<1HQ@cPV=apDg!~)>0<M?ngxmvs
z6aIWD)G1dbq=yZ0Fq!hx`h3!or{#|?KchaVAS}J;#K99E#kr3`IJ@-ZD@Dkgd)HQC
z*u$)xW62L94Df#TdQO=<+OXg4BX}!D1^xQ4a1_^vWq>ofIqZW6*N6Q$+mc<~P$}um
ztosmDnxUnZvkT6SQyrt`D~t8wjea3!`WpbIzX1?0cmsfH7ywwos|%$gx$6Brd6F@^
z45k`Th|2-^AK?G>^$M=uFPGjlet!A%CXVyJ-RcE%>w7|*CT^*jNI^R+R0ys_yp1_E
z%lsE#t}o_=2fw{~@Y}1^H(u4afO!>C7lR}FX-W;PM-V%No)?vv+6h8DG-S@K5v;gW
zckd>J=6|P<>0^p>Hb`sPfjmM=Kh}QSv91pdks#JiDgDK&bnW3wkB_SEUkRsBPaudG
z*N44H5XcWiH6TIAV*3{dSH$1ofpF`aNK+LuN{wj}lKSEk#rd$)+w4)v8e^J8y|pPQ
zZ$NPOxWPkIW;*k!56;2`s%AhME}Y_+13e3Dy<-gF>3Hu%QJLG8NDTw7dh!rIUqg0~
z^aipFUI1i0DD4=pebl27D+6MQD(1q{%%juz2r3?(uih8*F|<4(VDRdPC07B17d|Yx
z&<YPka)l_O59@)b7*en@@lQALDzcc9YltW-a4EBg)Z`M1x_=!T157n%eglw{-AvK-
zrqGuL!nbbfk=yja8Vxwt@V8-`G6MH#6U5L&VC!I|vqYQ^*_nLjU9g9PSxdIxjWXUy
z6W#G<kW_pRM3EEDbG`L0k%v(%u50tl336AXbo9J!26a#tQlcs<D;c3Sz>m=YKLV+(
ze(^igV2~Il^7t5e8Zx-@UOQHPVl?{DMR!OhTpWk|B#R&se6hEMHp|#Un{tDu|1Ut9
z5P_;e+~~N64iD0K_Qk6Rvb2gr1ur(2k+p|j2M&_nu)=>_46uUfH7m?1sn-pn^D}H<
z3fIQ9aLQN_dovW{|NN5PhO>^v`tI7;cg1%@3*`3=64mD?%Zt}QHJ}_+0%i#;9D-@D
zU7FgM7nPE~h~s}_AIKFb7vu-E+QpMUaDtsyw`97BZ$g{NK_P$&TPjTsUw$y$Kk)-)
z#gli9Kam7FaUkBs)j_uoHpcV-&=j29@A<BOe^kG`s8&tWz;TpW^?*yYT&9nLy5aF5
z<v$VpUN?+;bRcq*;y~tj#`F`)-&p(nOHYK);Xw_#PCO-dj*D+C_d;lMS}JJSdo}#W
z|BtBk@ZswefV5W9;MxTw%hg5jYzvR?3GlrjN+=gYAxon9!h3XZ|FL~9PqeYy1(4~(
zSYP2_Ft(xi_p?dHo>TXE#;>369?g2OhQEXRNLH>{9A~0KyAw*`+N5fgrOMF6STrbg
zUTZKjDJ(^^`15l`2RIB)>E0F>@H1K!+=7h9{*KelUW)@;4yY>MC9493q2Hmsnnd#O
zTU<e#5_E6AETp&MCc24Q_h;c2spSyjRkh|5dy%V)fdcf(%Yc6t`$B;&?BPMny75K9
z!mel<6Yi6M*`Tvv^C`Y;MolOKf1dHZt*x6?%L@8ILoJ!asCd-a53ScHpy=;2K_Eun
zkO3AKC4Dz(eSbK*ijM>P4j#0e7r4f9fu)UANt_`uX7U3x5awXlUf(a@Zl2Vwu<~Z8
z<<Uq`RIOq}h(<yqp#)~ySdvANXqbM-?D2Q8FM&4;HxyQahxoIieU6}9)zfN5HV^X-
za6pGDC7*h&9}f~Knz9Ptk9&T&Dc{(NMwpK23aM6s%xOrh`w{War@cilb8%iyRcQ0N
zk6Ku!q+@W>`r`G9mK^w;{?iPXsWGubaLAV=N>xwU`Q#@pVu|e?qe_q+T=RR#YU^z-
zlbX^3Rm8PrT{;tHzx?t<o4zYF)tA??aJ4^=y?l%L&e84xu&&I<E35n8Q_PA-|0cY(
zD($DS?CBMkp&>NV7=#{qeF>BC9_%6~R)RF(9tEtNevlQY$~F%5(D!hOZ>-AE^`=x!
zQz4eyYsv<m=WzYJaIb@q@{bjyf~+S!NA=Q7L}&#k^o+>S!V)VfO?Z5+FId0yTs#SP
znpZurbkDK{g)vUmnvIh4a~FQRa%nbwVV-#ZQDKjc*rh1zryc5yxz#@Zu~j+<TTh;a
z3>4dl$ZA)=M$1|G$NrhaYe^%2c!raiskX7LD-Q@QcRpC^Il9q4wnODcXH4><k5Jq;
zSnhM`dR&DVPbQ{a_%hm0w|9xa$L99v&EE}ZmISd{#o4fIrp6YRRcm(-)vK;NT6-hY
z%H_uD9O$DD3=w%HW+nM4>5bKs15{>SIV%n`6Lc?7tF5d40v672)&DvQ$jJMk$xSo!
zI5oL7%b_G`E)scb4AfAXx4Sf_Q(NmW`0?6%z(U&;nD=7%iAr#I_23*xLesU-xoGwB
zc4Hni_g?HfS9{x<KC~C6UP;_3FZv)~+E8{@&i9f)%G`Sxd#I5Kg9^G*YD18471wcX
z%+F;sk_RwjYL1k1@ljW1*~06T9<nKI>iQ|>UtW$HzE-+9rcCR(8|xX=3$Vv!sb?;#
zzh|6_fm^=nLWV-{qO@%Kr4mGOp8wjB%Rj5EQ|EzGE~+ApcE9u<T)sa1(NVx_qYttN
zFS0$(kg0{Xjy^+2ydVunN0I5}_aL-0RAgnYDJi7i)g*924%mB597E~daBvt-=-q-~
z_B6NPc|L=|fsZ6rkvm4iMwk2|A~#aUI^P=Wty%gw2YrXazd1WAy)fLCwRmOmj{$h(
z=vkqew4oSJhv-1CedKzm3#^RT2D%K~3YJLT-xt)Va{;U>^Y~>r{r;PV>G1HFEjTMq
zn~u*$8u4As#I$RGt=TU=LE{X@C^#5=fy0uh1Bc~4TY4Mmt823%$W0i0nNa9-NzsnS
zy~{mTF*&l?Wb^b53{cB$WBVHbpz2L`a9X6f!hPTMO2x!*SdP{sZ0XqUhOEzisySIA
z$AK;Wb#I%C_8DFRV-VQCbs(Y9U(NyB!AEAqorT4!*7I`T`HlMp_F~5G$C9l9kDW=~
z>*Z8D$fkC6JyP+&Otc}`m%|$q3^6Ep-c`eI;|0UN+vWR_pF7n0&o5Q&6#}Hm8+alh
z+Jwjl(uufY16j>}<)Qzi>zsbD9XRF%kiEQ&<~9g`VVPc0#Em0^)?BRgE#atif54a(
zwkvh#Z>Pn(?;nxc@l(3-;?B%4#e~qzdQ)h`(8&_C_%>~`<@exSNjUrs`3Wft)kzOw
zs^E8A`o3LgN_8~VKyIpwo^FlEDo*d;(Do5!NA*NL7Z*EsYOJ&D0U^ss1gxFKLwGf<
zfn{uN$o9f^E@0UC@ZQC{ziOh(;YFyfVl;{;lz7K(S(bL3=eSE4cQxDe{A#I7<i`8*
z2n;91%f0JuwW5+mRkPZZ5)mn-co-zj8o11nU#b>JI`6|wp;=E9#K-_LKz(W<0@_he
z^}N0&0CQGh$r^pRIR#&^xEd~l?hE{N^ld4|nDplkpk~%IL{Ntmc5Rb5wq9~h>-gsy
zh-aNRWKM1{@cqPTu|ArU2jen>WT}@Yd7xy1rs<sYtX&PZwE=b%rEjF#k1l>cPYH-)
zrGvhk?5GquDLlw=GQyK(+;mcOch@o#=W|as`YOOAE^b)9GObo_%N}gaD({Y~vilkn
z)rznaQTtSyx>!Su>-cXi?kV2O{i;Sk`$`B$GlUw~v3P6S_+nkjtpP6Msu>=}U(3tl
znV5=Tr}9tFw6*%iqn52?K~e;I#3>gs#2l?GKw>_*hR$=0!k(dJ9Mv3x?m4fE9ya$u
zNk(>-?<V0x^f`;djH{3eU|Y{3Z@`6cZ5l#VBB?9Z;cC{F8@f$dyH?a&W$g4d5s2-Y
zum6C-mIAPrdru>^Bwdct^+1JJrp|4m%>z=ZF1<_Ii|W1}C-6HYaPe1;>^1&zj#;bT
z_?pEGc~L}MBlU?aMz7!xN7ILwoUZu*B22A+sH(jU4k5ezxOl~F7Lvyy!3`!VNr7iN
zsrp5KLj<W0)Yc*LG{~$814UIBbfYTOWlDR!fkrhh7=q}vaHLWAFtWDGUjO`aJs`e3
z=TIiL!g8u@(Bct`+)DEk$6zA?&v9==fvQQQ8ybRbTgP9b?G{d73*C6qL6|2YmMze-
z8PABSSKIX8V9cb66075HmC@R+(+5RK?-;V1f1vmrx*peZ&AzZu9IsES^d>5WkD90v
zyUhfmGv_P!Qx~bV*`n*?k?j}3{oOP}>toxOarZ%E3ocpWUn|&F^1WsyGm!DvWFQt2
zM4k5!Ede&ey5CNR%PnQCei`n$CR{3`vkcO$d&#RQz|lNe50~+5?2lJ!9p?CwU%s8Q
z;wRuhl1o^i4}Gkr`)ncLNl*6iI?iW*U!=caF;FlohL)KTHo!wvBdG=-IFyvlSgDuU
zJJmbUa$MdbSp$)zx;{fZQtZbB4rpRyL0nFq{sTjndL)44*KB`d>n>j|GkWfT)a5j`
zvAxxrZBv9dOZ}CQp*6V)E+Y#6FX9EN#;0j)IX^RXVL2Ul6Q~aoJ9Dzxmsw031JSU6
zVflE`M1PXj$*2UuRY;<kT_&`chj3)1zt*HrK5l}~DpRu)YX<(#^Ca--6&MhsPu%O2
z<tXBa-Dqb*&@7_=K@@QC!v4FgbxBWl!$rNQ&w;tJMRHxQKs&@~dNz)!HJfMq=-%Jd
zKr4||9&wcskun;Ha70VCVi^3U;iFO50{kRX8WJ2&CbLV!5x^Ju%~*@A4)lz&D`9Oj
z`CNJHNtgxr#ZyY0p7}O_87#M6Rs@$Z5v$W+boa~?4Q?39yK&FZ@y<Sa{@;wmTIBdn
z!52Gt0NJ<Lv#g<>G>&Abomy)l1wb$<{3p0->sv>~;w2%}no`S*1w2rYRk4B&b5#U9
zS7A@z(jVr7i+6WXM-gmd@{I|P*MhP=o=FLr7<5!t?`D3X(TS!0_ztZ!S6O^8{w%Q@
zpcUy+_>z7vEB~Objyxw70ADne>!#Si7z1la1H@3Q(y&1ljwc&~smeYtgQL#XDpduS
z(YSvf2Ij}2jb@nddoFlJ3Bquxvcfh#P{;I~Xb%ZV5gqdIg#c3Vw_dp63))0XO?mAi
zY2CRfgrm4-kPv68c7Or)b^X5PZ@>y8>aW>)W4T_1Jr1=)&)Ad-mm&MbH0}!@08$}F
z?7W}8TLt6L(K9U$_)xnnWGSwN@sq?pjER%58SU9rCsZNo4&Z#j_wFPcQHfo?c}yX+
zu^Ra5jkee{&$7&UliJz7Er1qe!dtXd_I~14SPUSQJm<z6oJRUWF&e*s)eTFb9_}Z%
zm`@*$i&Cu=m8l|1ye~+7$VKq3RB`6p_!UOn)!cyGt)usfV|c|$1l6lN(vT<PQo~$*
zSZY8F?7F0S_Z5lN@Bht7MR2@{yi9a<xyx{#nam3A9&s!~vWs7VLHQf0YWEK}r48nq
znt?JLR+A9Yk5Es}IN20!rQTX74WIKkKn7ZPf65v_%n5pHtCX>qIpM^SpYWUMWEA*~
ziy0o`B>+G`x;B^0#ciat1tMQ$+1;)@9uq8P6vFIb1-vum$2{73ysmn5t$J^2RV5UE
zHa%OdFL#ufLSh3eK3l$!-m`Bvx&C)edxX8z+yW7nLRA1qFZiHEhf$Fq<<#OEQI+&i
zbC?aNpYe^Lx@Y%4zKzG+W;MVh?Bn4lEMWQwT;&+`&v`n6<&(ZZ%iwn1GPJ;$o~wE(
zpVTEuJ|4}XOcc|aLerVdhf~ISx5XV%pxU5y=T9~D=1qQ?O{AylV-r5-t~gLlgx=U#
zziSmz*|Vcyc61|#U}dtjic1rZBl#uUvkAJ$GEH@_vYFmYBH*44QDCCL=GM*W!&4$v
zBRTfgI1Z<;!RACE%Z$wAW;o;foIrl?kKM@+#sPa91-g6>w049L6*N;DbtgSqc-94t
zPD-6Gx67<4L~YD;-xlEaM0Cp}s3`dAnolN`$UIuM1o)+u?hg&EhUW#?G;imZWIb7K
zBvED<c=isupsywi>cYYR0%yJeTloFew&vNe?i@J4Ni8An*!V!2gz|NGHn?{lSI_cc
zM`)xAfUC~aVPD^E&860sH`b4eOlcFTlz?BeZ&K(ATcKj+E?YavVO)=vZT7;f9R8lQ
zjRiN<+F4Gx<M|Y?2g}@;em1Ee>0N2D29to-I_61_KB6#Og2#(FZ_zP~WVEGb(DaUS
zJjjf=7-Mh&t;iyz$T$L{^>vH5z==MRbSL|9P^#hsrc*+@m1Q0*GrFx|V|*KYA7toC
z2!4fA)%XT$xbf-8eb~<TcYvJ*x{RncHHhMmmXgLa=|Mx-?1|WF(j>o-TEzv(Ij(nJ
z_ZD4sJ4J|u&tYzs9Iq8Uh*vryE~3usE3-MeuQ#MeLCWjaN_&5(mCQ+q+@4#}{)9J?
z%}&KT!dO@GX_c`sXm%!OTVizvnix!b5p%t@GO)GzDMBc^jO67OZu1jl4JuwPhI!tK
z6c_q6)^OFM$K<f*x!pXkYQ5z&N1NkYu-ha(RDh;)>PXu)4KV}SMv>8P_6C9J^!4Uf
z|4w!T8SgR>k<aHA%ynWk(|X@h7W&@u^v?8LR*cB0s|zZn<nt9og$E3$h{Rsju3${U
z_+WV@;}ZgUi^F*-GHBg1rEQ!O|KWQmTH9@CX-~Aa)%O^admH4ar76t_bOLEq$J=r2
zO6DH42>X=IAV<A1U1{k=@iomb#FCXBx0;Z|F*2o)VDsQCi8GtFa6;?g)abz?%DjCX
z%8`b{BV)qKXf~OgNDL=|46g6oq)KkiopaRd5Ppi=g<Nu7j!Fy2?5}mJ4B6uLukvkQ
zT7?<GEotmxp7cxZW&jq$3}HG&Sd5V;?n`5O-Vlf(&d=hFhm#^Bv=^+O)h;gJFi83o
z@S&S83|^1ipb0h{;cD-?Um4{bl;p3J;!SJU68>XJ%)gBC*Ao4*=b=@_b!@o#`0G5c
zr&}jX(zwfkn*xF0O8|%ULNGKO!_gunc=++s6b(?X&q+%0@zW%!DFPqeou<hlI81&G
zabGvVxU;ZDW=Un%WN%K)xj16}P_%efMP5Y^*L~kYLZE8mo^&RAD$Lhv+lU&?&UQ|D
z3y##~gDRU!g?nnH5yJ{yEcU=U4Ak2rzQu*6Ki}aXpqD$4%Pp<RC!I&w5K|<1{k$TW
zR)OF?m0|KFi@m5}GA$2LReNyGK|tTO##0n7mE90tNljD%_D#Trf-!=>V{C7@hFB_B
z-b5oixaqKOuS;V@R>YS#zqswU%1*}r^{;DcJp80I*UZAQjCdm`%|&0<<`1v*tUO$V
ztAGXB!1p$GD5H`BHG`Y84N_;EG$~4-<o7eI_BC5M6`F+oZ{tR!t`ZKCE+!MIJC#PD
zsnEq=T+3K1_W}~cb@v{Sn_hT4<dwr%#I-YB^im3vWV$7N0<X5{pqsIp6JBo{A~bp^
zjcYFc8k>lA7M+(UT+i_QkxB%4=*wslu3)8j?4XX+$R=S}g8YU{P02u0zBJcRPhP-y
zW{%2u+Pua)Z{cG^0}9fnx@KD6K`_jDO38RU+fSo)D4rKTUWy^4t)Sf6gQL~)rnfis
zk`Q>Mc;|piJ`H?v4mqw%)4KyIDncsH80cuba2|K0YW85E@!i?E#eqoRt6WuNam1$-
z6Hadp7W)r^dA4I{rGUu`C%0jng^cNnp|L38@6a{nDongpVrNDok?UA5Tn}+ypSlCA
zrcRoA##B%MTSm^JWRX`EW^d?Y!C53tMIaum=(jubVH6u3kD98mNUmF9fix3BLiBbH
zoQprp7z4m6xPJ>Q!-^WxaC0?cS%r^`pmNdt=d<xVBqR&6I{@^HC~qH#@SScV+&M&J
z@G8bO&ReZ#uqabap?(9cS(W7pjI^#3PM}Lg8%&StQSqfwB1(EaNhC+WiD;wi^XUlV
zI;7%GNSbjATN=~g^WKLyI+CHQ`sd;;I}tf4e~yP%c>$<WGlOxAh^hW+l1+KJ)`U-K
zK<zYk4G!kCk4tIF>E{fjcTT>rGV&WR2eoEfspPTNw4=J9InN2>!k)&?SDz=pF|MO{
z!Tq&0!!VxlyBS;_A4{-Ix$*aBs+=IBZL65hV}Sp9{2txXM(51biZ$(G3gIj_g+u}7
zxo#QNq;3;Ms^VQR^I<GFUaSxhqR$1Fg;GHT!-bmbrxw)xA3rG#rfr9V@%``9fvrp;
zmX(#+kJe^{fe(7BuH<IQ4BQvOXr>_jlv4$(AUA9k$V-J&i!U#@!)E{9S!U*JJg*}d
zcf-ivZ5Igc;<wvm8xlsIv^h_3+zsS$$g?1hoehjf8&q@8?519ihCI6Ui*@1K5nDNx
z?5V!3pR1e_7sh8654auda`wp>POFL@-98XS!$<|BryLp&Ih<RX7>MQI)lmk4-dw`6
z9EN9xn#JGonDQzocV%D;(@V6X`>Ih`5pOX%-8tV%k<nO*bjQ&H`TOH?`XyDAw$Ly+
zZiwe&-5NB8uD2gpFe23yZxfi7$KF->Qj|GCF3o&)*@A8}w<I24qU#b4$fLejcM>j5
ztq7zkND9Ir(v#K&<?`enobJZlTZ{z)CkuZYIHWo}vT&l7+BEYu-#&yR(dGI~-a0LT
zU$#QrMI^V&tb9!mD&|Dx_jo`tXw<5h$++p8r8+j1Xu24Y{nsV^H=0+h<LBzwlxMLT
zM&le`VHVWQ+4`S!>j7Y<z_}&+^am~~sb2#8xHeGK^VGa(uu>dD$~Yc<*fypWy$gd}
zw!TvORJI!V6Z|6!zPj>w<@_n))$80SyOU{-zWD_Fd?Dx0+67h0HcBIC)0s>5QqVuo
z?aTI1x&hu(O8$9M(BaIN#Zc8_?M^XO4&vI#8U}NAv*RP|zyFZ!;h>&n{#(#dSh{35
z2F4pBK}%v3(cCQT3|pR`^;g;c0a!>|<_-%zy)=_?tq(ViqQ2;g{93uOon1_0wMeqT
zPL{g)=y!NUzK=26A5_gMQ6xX{cOPDk--C}YtXAj74*CfAPm%cPJ(wEPTLqL!g|^{2
z1+(QBXv6>`Lu5`@dM#r{eBu*0ZwhA#ffL(n*>=59(f)M4UYodX{rj!~2U7Nq!)!?|
zO<Jw7dyuV!z_=Fv-_Qwk`KF?_qc+V!5tR+-gLM1*@Qp|28CyN8DM;tD7GwX26aBi*
zCBIxN3pI~mRYMtO6m`Aoxm?l9%6WYZMQ=p7zZHa*=L%C4!mh0sZWrmGUdt~=pOhOu
z6HcV-sE46wa;*bzD*rNC>3B(%h)!<ciNA5bGephWhPv-*{u*Pr@g<P!g~P94>*76p
zYY29zopQ~}D1o1yon5$UW*KyR#rXNE2#B5L#^vqCjT#@nCG}!{vsmNyEDq)lG*Zph
zvw^HRya8gu=XNJ1(w#=?iKRtmM?LEvU}O`=6frQkV%`ogq?Pj~L-5N#J*w$cd22_U
z+)RoNEv|}Fv7YkVDt8>#@8Wj`z&gnN2dvAJT88m1s3Y#EY~dnpZK{LJ;mi^zbyNzP
zt*MdIcSy@xz%baDSeDujD!7zSxwXkGk*-rFLKLc552U6S;UDU_S{CS1cHx(L_?0)A
zI<*QnBp}SKEp9xQqHF&@qLL?dHc7Z3U1dCaVnfLHv2jnv<G9eo6ds;})v_F%6Y*%&
zzaef#>N3Y^<B=bU$hIGgjwycCI#X)?u{HF{?`V$7{Z2vRKg9XY9jJNr(!C#BD$$dB
zLraaJ&P{h4R*-xLiGP>$x$un+1x{Z6N6nGbW@mM=?BkvWV3{k)-4J)tYZ3ihBOq@%
zjcL=l8wab;#%Yh5l$C3%9Se0`m;mL{1>rBV0l3OEf~>@%Y6RDzQf;g|;eO1qiwNz6
zS=%E?_s7kEQtaFENmn7?nBb{N!Rf{IH!5kTHAv&IuK=u7LiQuM&CLjEzRB}O{Mc_-
z|9I%r(QbsOQdri``<n`F!C~Cikfk;kUCh|{@t+^Hq{hRQ_fuLX^hJ+8pAF%hNbi*Y
z(REteDCN|g%hi;JEtCm+bROf_m<5@9JB&0ErNL5?_y?drnW<R0VKv{xr>Gba=%1{z
zXIxkjtJ|i$A&J6pN{<)(*W8R%E%}gnoV~KJq3?An<>1098=2Bam}@PxjO)qy$2zy?
z1J_Nfo09WKG&t3U_cXHSXA`nA=yHsDO9-&_B0u#VOuM*ISX#C8Dgvrl27P6Y`MJHZ
zCp6Z_o(gboK`${B!Ta!k(_^-^6SpP!Ikx1abHutdR0299&y_EA%qWoTem5W@m#KI>
zxl0U;VhmgCf#0^-Y-W^(Q|fGm79O>90!_{Q9g3+u&kLF$M%?iD(H{PNi?~1FAZ9&|
z;25aF8Sc;j?7W%?MR?4yAoVUX#gBkLD7+_6L5LPoCt-uGD+nAh$>t9J3d+l3XF$ac
zJ#~?gz!>_4IF(?dipDLVsy7jK{Hf|4oHMx(7QOY%32UD$>eKf+*iaIbug6cL{PUbF
z75i3)Wf)phNifF`9x!X<WNUe6?MW`4nS@S!#(4(-tA*e;JDR(v608UlFYCwxkg@1L
zkrwXk=GB@Yk|nnQ{b<?kzNxf42xUBk`NPc^)~fW}1^rjp&UW<D&>LK34olkTt@^!T
zH|V5Cw6P&ZM`@!`V2&L5EV^uY2oC4%K80ib!;}py_9C5$P|BpY^?W)Z^WpVp3d#z~
zv9X)ZCF4nN$~jpu6rI%(0MfSup4iFGiZ>U-Jc6W>7gnYXiYvoZAxEHWL+jpwt-E0?
z9lXY;mBT}bRv(QY_^R#2^F*}hce%4S^XIhW<|^U2L)=Y*Y!!i~Yab2|)^q{i=+vk(
zk+<u4t;T5mc(Yl4q$$Nk_=BY`MTXXO<X|T>Ox9!`qf#f~z#%o)sHwuH=48-yd=%3b
zaG45NGIdRDHyfAm%h?_DHA=HgW6p9mC*_L^A@8?9*theu*va-E!Nb7c+=&P@xT{k<
z$U97yWqnxH*=aucN_o<SS%g6ula1m6)gP~Af{QO2Y?L4|pKoKG3;l{gdU{cPC`VpY
z>P%`d*En3D`&9JSjGSW{YYzSpz<;)KaBiY(Q)XVQ)SBLT4ugmkw@o^n>?uh7BZ!ND
zdC56*Q-*fg3UgMr9%-4cSzJIF4d&*X+R9qVs;8yH&V4b?x~#mX9PET@D#y&>Hv_~i
z@}ca)?@B0g$%#8Rw5w(XCt<hIs4@!*k--l0-*Y}Ta!CG<nnkFIV3tgzOLZt|)g;w}
zGV#{e)A!}!o_U`FP5OS~U%t<)>QrzZQ&67ryi$vm2A^-dZmQ3@bPl2|)dTX#^4{+Z
zUIk|u&a|sxVS8A^u~}!C;HVm@XLIH0G~(<78Wp_qw@_!Ss-S6(2M7$!6`RU8HHkO3
zsAO*xBDTqSL)?v)AKqaiu#1`s_SY15fh?urDkWCx>ggg#p8?@-AOG&p<7av`BBp-M
zVJVfXqUO*Y$OhY<4GdYBeh0dl^gGE5H#-5g3Rt&@><phQJmZvsHf*=78##D6-o#=A
zRuq~iv<%Jb<YOMzwT?;<3^F5HbrGO6BO)q>003|ZBmSL}erBg|C2`>m@~RA7m@T`~
zX^e59%9e6rmV|;!F2GnI?{AXVcr2sI4d)X|lwCF=tx};x2=Ft@%ba4=18fSh@%ck7
zX(LzygZu|(-}BUhn=FBs-6Sld^YYi%Y&QXE(9Cd0yfpHp$DeOR?KM8NlEhQR70ZW~
z>RdLV{J?4alNqog2xLa25~KEh;lPE^phY%ak=6jWvC8(UtQhh<5VV_7((fwBe@NAv
z0-2mEcG(DP8T5r>#KalJPmQ(ECI(9p3f|U_3NK%3TK@7?Zc=m<pYb?ryyBGx4Y}Z^
z?gF4k$726Or-sS1ZJng@#7Ao8B#?c9T~eG++PRm8v0A#@*RttPi&TQ!4<#5%ZkCDX
zDUxiOm%-Hj#IU!{;7M_Yc|Dm@Giw19x!+)Gr+&P))2PYAQ#t{Q7(yn~oNAVKe$!Q#
z(-8M;&%2%8eq&$~Gj)1*BS|b>QB;4xwhf0eW246wfMyQoKWGNZWx|+zJlkwLkd(g3
z)e{Ne!d?$7>-Vrp16KSUydccx!_|;Z_Cu4WG5J8d8B-RZ7wqC3*D{gQ^H%XH+H=iZ
z8dCI@LP40M5^JP|4oc+Isg&I?8HSR4+YFRQS!ldWQQkD(?aAt&o3+9&*<7+>c)7Ya
z5aMohix^XV)s45RD@D?ET%-j*7^oSeol&Yhb&7ra*!3wg=$dY^Fxx6T87tqWj6#lu
zw*j5yiajKE1oig99a{q3D2v3Oyd3+vjaZJU%_w1U_KkM5YJ4t`+^%?lIMtHWz%tFz
z_rY&j0?4)8V9abX4pAtN)jC@ob>JAivko;9!J+Z1<Vg7t*Z}K#xWaG>$FHM{&0pN<
zz^OqHpOKlYE0^E1nqF+recGhGdS_(Ur;@tnP~8@u)lP#WGlP1r6n|d7t-C514hWc*
zjynQIqe**zUd6#v&TJqhdpw6c%Ri&Ub>05IbmizvZdOzkm5%Ic0&bjIlE&K+tC`lk
ziSOMx140X39_`|Q|3a|oLtVVtBIsC(?95d}$A4S-6hhVk$wahd?jeg}<*)=$Drw9I
z23%j((z0M${l8ilKui5N2t#jRmu(b;qc~wqY1$_(hU4?;vwZRYs6StMX|`r*KFb#@
z<arJ~S>Za_>?u<<%r^@O?hJ_b9$^`k)X`XZ$c?ba&^Hao$;Ca9ccs~w_b%msct=gj
z9%(o#n^Y5AqNI@zh|rxsUC>I$e9iS*LcoC-36NI@zva~&onCe7PiyGCv?%|W2H#>W
z&E{P*9Pf4yppEjq_g6&-bj4U>EDGSHQ&bscrAdbB$6FoRI6wEb_WhsM)=yrJW`Vm|
z&{I}`hPQVQ{X8K=wrWvj%?(I6iqt!J<_}YO8Q!wVoF@t9jSd@sS!OZW!kCY$o2!kX
z$aHtMmxij7C>}d#Z2Cf>f@WNFSzBigN%<<E4rl^$kpEC1FyftsD&xE|;tFIso1tIC
z?GHZWbM9vDgv~`&=I@jbLx?F;kmS4%=a+;zdR*?@#@V=d6~|u9)&I&^GpGJ?3zZyn
z^4Sdf$eOuc{Npma36hMF|5guqi;*7g2=RG2Vp)n;WrdsTvS3L~cdZG4G~$u&L__tQ
z8ka;myxyo3+C)b}^m4YktgX@S9jqsVHJ7*jdFVw(8A;-0{1fC<dYwKh>QID&-p(3b
zphU}s%>Au_K$4?3s0G@f=HLW~OR>evj3ZU#dX$}v0)vL=ZoS)i4i>mYC2LA_d`ICx
zFEh86a;tX2DAm}z1BmY3@#Ma~p&bp~hs}MhCx|(8K}Uu3)~$-8)@TMNfP^jm-85bg
zTGP<Jo0ZY%KpUiL<5fT*Dst1ovIlUjWgQe5b9T4dxk5YBM!#fpps*MUijm{xmRMIS
zRHq+DN&KqC{NxU(^bj?hp2d?2I5<&a$mLBHbAZ>m%Cvxn(XIX#Dp<s^N5pM8tCBwE
z^|MTYMOzu7I64TV{SH8_ygTVke-IAUP!6xHJH?DCnB$M7&#xrhkM^(Nj7Wcg_*Vug
z+LPve+!lZk2x9gy3`SED<ash@;h`y>GyxYwI1i$PO&`IgaD~Hom0bFta*NE%pje(V
z5}e5nt%|upZwxyAcVuz&OxZKCH*y>`hb&-jyaO5?nXO(m-Hh}PVtFvF#$7VlHfgra
z9tbq*>vSRL@Gv_wwVIGSzW+k3fg*!P^6#{SRf4H9wqIT+E3GeidK`h5_k$XIVhSZ5
z`r~Tg?#e+8<BtDgz|w<URwFn@TWFw&jP*I8nZWp&&zh@1O$fRjPYQHt$W<&ytQZ;V
zw0cQphvw;vCfb$)Uok|?xMlFG<yHm%`kAul@ujtrX=&LeQ(8DKCxX%+(1FH-|IW=q
zhT(-|-2~G#n{|5KBz7CYMp{~fLLxS5E6k27)LX%+SZR{i>K0-3Y@_oLM;_k=g7W}3
zV-9gU02Wf-rMkZjPb%%)E>l~)+=Qf#=P~@2lAz^wK2O{M&MzGI8*#M((;6uwXb0M*
zqjX|zv+N599x+zT>N`61d^jYlU?7Wb8N-5`)qbRxr(VwEH7F9zpy{;meWa~_vQEg&
zB>T2C2d*lt<?Hxo>2k+A%)o&Kd?|D8v!QC1j|^ZH(Bu!8<&x2#o+2bNP|wc{e9eXe
z@B0-6C=_j$=Q32Fdz%Au{)samSnC1PlcU>+X770Vq}O!_u?8jG^l`1YQ*^C4x!$8S
z<DB$Ijo&F+qc25Ao1(F*dL$$Ur?rZw6A5LbZ9lvHPc!{=G|%BVXD!?KvqBk&Iq*wm
zZ6ie{t@0Ouc(Fmb<(KmZ;UoK*3p{*A!Mx25{4|(ei`F*dridQ_GL6)wxx;>|D-(?q
zc~JZ*hrH3R<CNs8Tf^l6+o|0(U*pikZ*!#5MdH1MaMre7#Sxk*5i^dZ`p#}x*G>j7
z6li8R0%fun{JxB;kCrE5<#6>_ibyV_o8mc$Lc=T3ZLsIA2$nhmAKy+7?D4H-s1y7W
zPLiNXM@_>StwOykXx(0fK=t@f^_5zVuS&68I-qbh{<pVTrnvrKE_4F*!}W;f&)8d_
zYng9a9c^PFkU(>9aF^K(RPZE+i_ZnI0(P5n_l{{OHyE7i1Q8`Di=2;JQ)P}{E!`}Y
z8?T&K*rAcQqfN20%62A9xTVR=H9XELKmnz@DMqXdv{&yJfXkG$J48MWC(E|rufP?)
zX7YNt`g4vOcuypGDSN=3o2=ySkWkAsQT?;WQacH}{gii^O9*i-!tA`;^=00~Q=30<
zNdV-1>4N#kA$$chNGuCgKK{f)i5cO3$n!OTcd?7^jI&EALdi5QPSe=-<#Kb)-Bz}@
z3Bb1Y(N+=yj)6eu8#iBEhNk;OX&a5lRRf%!^}Y?uX&T#FNiEH4#JQ*{ClLZvkYT}j
zSOvLmRrTwHF@{8vvK>5$^B>0frKdiF1|vYFw)H7UEtzgR)mB}@XMx6qZv&cXMpslr
zn3ZelG(m%O;jpIh_p}q%a+f0Ncjg2ew=$@CKkT6<lCcaMMIDLX7W-`fB3$-QNMHx#
zNu_Q4q-4#S0T(1a%&jWZ77J-#ELMr|(}&To!%s{Yw_W$ht@+TBO+p=sX;&KVc2)M?
z=wQZjOQMiWFG8TF86AU-JAXIvZb^omizf8yC_OWrGRb|+k4)JwI~j5=U>BI!?_enh
z+ZoVeEM>TfEm0FbE4n6wY$g+B+tE))5PsZr(|?{e+a|n~&6tB?r(v8HOY(EVn7Ygh
ztv)E9xVZo*H%21Yx7jz%zM&mgYBqWkp*iq-+u6+p2Vu<PybAZzK|l*<6h$Ho7ylC0
zcW1J*+JB+HO5^$z2c`N<4B`o6E1YRaIJnYL115mtSfsZK25xpiJ2?G4K6g)gfXYR(
zBnBfww<PivBcNa$8qxl;erqR9-llw3VI!c7MXMHMN=qV}Du+Ist^)&Oo9f$vF>pf&
z_KXlzmh-3=vc;aqFUFL;px%Ug_n=K&V4}n07KDCHUhi^o*(K=LbtOl-%&k~lwv3ry
zcANdr9cBscZYmEBSNwvB^S_aCIUp1FC3zWzNK2Z+;XbQ77rU}<NxLPX$*7S!2zrFn
zrW`KExeVOz(XV^kT>jx(g%3#Cx2OwJ#R7a#Toft=ufcpS)4G`Q6U61Jqi44r7Z=yc
zJd^1ZvF@jyjg{Bj>jTJGo}c&@0<SUHf7|c_qDY=$*_1rBm{MUwv}s#1-X{_)#&#dL
zRZ-o54cyIs58Q3aK-Dt23yq4v$GvdN3Z*m-sQBR@698^;P`JGs66m`5TNqD)SHR!G
zguR*`Kp0pG?^N9YkbhfkV0X`r*m-YhQ=u`j>N%y|7D@(fRCt{H?v%idg~Mmu+pu~1
z?-i<JX4yht4bGvOmXUlS4!Mxu@4T+oxzc~j;ZSRHcW^upw{8gG$Egs;UOw&8+A)&8
zQY&#C8KC(t%=pup!LIJVb}lE2>xHL=YBY_9WJf^6^5UlC4t9kj04xw?-ReLz;%O~M
zjR}W`5zaDn-0E~{lfC(B{%cM!{w4X-UG&GjglAW@cN{n2YERKC>QTp*=$0Fei&?_|
z2mX455k2xJDm<y0ZupeymgTuUs8!a<xy{n^bmsCA`j%&f>wxxkyK@iXSHeCM9NE)s
zxvtL-8Gel|M8_qQK(I1nfDsv|dkIM2Ls)eO+QQIKHimc7dpwnty~^yR19iAIL!M_3
zMNNU~e)nEQK3sDUITd?;6Y873O25M%B9N9^uGfTc{er>mJp(M?dEH}kvHA?5Sg6#!
zfij`Qp`X$S!N7F{r9|<aN_+wQRN_2lNfl76qvuNd<CBP<6S22ni?X}d-gUx<Tuu+w
z1{?i1jdBWg@)x{pU#dMqUCGh`2GJz9*DsopW0^~H=cJHKh&7lhpI}0t8V}oT|8pX=
ziZttw|A5nJG=E#wp^f#VQFz5kHJswtuu`%oy8HRjGEmz$Z{Op{SXI(9rMJ?3+TT-$
zE7P{XmK-2kID(D*?s{MU+kT#QZaRk7L&^ml=wug8Wg;&Tl%&Em!Zim5-uFoPd<Qg*
z$dk}~o=-7YCl;SbT27~cwi<t{7<!`sZoBmFRjzI^bV&|BnD%RJ<E0#m8R+xZ;tzqo
z_0Gk&KvzDM!CM)V_dFo>(NZ(>0OH6RJ{6<zYf!J#+`01f(<>ZroRQ|g$Z@kQ02fn#
zATBMJlnt1L-Sgjti%SqlA{QxNWm#*!MH~_v#j5UN{q~rIMFr@rSN`HpYnzMJ9!x$1
z1~tV&$|mCo%~6%X;|h_lv@3`Ew(nNr#=3;;(*#d+-$qaJaf&ImjZHb%JmB4~yDuRC
z!Z%-I+o_7whpf-XFHI*qQ|Ds2Wnz^)2N+`M6W*o~7SpKnp=qs9z42pZbwX89x_x3N
zbZ~BWgDwE7#cy{O>Ke_M=@uE|LCZtYjUT<qVc7_=h%{~`XSyTsL>L#*z_O^y=i+?g
zG!gR=Z;!%@Nr_S=dNtOx0R^9%H<j_{9=!&*CbXpH<Wf)!X(4tP<5Di;m7H1OasLL4
zr=sJbx15SlpzWky6f?^gKB*M#I2#c&6Hr$_&3LUm?y_5JXA@$XQ7);Z9h(m72tTN(
zNxz#XRRef^?SEb$0pd~rZ9G9J;DGg<gbcb{I;Aq(<?&+~xWJ#Ayd7h);_c=l*icRv
zLQQbb|E;-XSqfj2{<W*w<$l>wuP82?y^_4Y?67zQF<*e#4W%C})6F7NiJ(}bu0Dxc
z9!yXF@LKUcm4r;LwBVA);(?Q+QM4h3I^8|-pL-%<zKe$h5r`5j3qB2t^oPQk^zA(h
zx_*!eBNidVVw$|(QbAFE+s8WSLl#`akM4c$!FL``7_V*qY1ZewsNwMfUH(MEdp9JR
zj(K}sHPcE(d$^cQYtK`oz>-I>GT1E@9sbfwK4;SU9As|T;;!_qvW&jn-$@gNMkciB
z3cD~R4!6b%oDwl<S;rr^$VDXCVwsGDJ;ZK5X(e(AE-~Qyp`z*yscS;O%InqjMpcuS
z34O_R#2fB9xyKhprZ_$LUb5q(%fmi!9nqnF!MyX3oiD2kDpR+(B^%y5IQ7^GqZ#!L
z{zDD(Rjt7A@Ac!*k$kpY9l@Nn`r*LoW3GcQ^m&}Uc=K?f$#jg{wkPyTT=a})%kE==
zdjliBYqi1Xr|3kDHgykMrmeZO6F4jq-6&_V4UEv3x^8#S2)7}^@)~<D`2oz8b?=c0
zfwfDxe#iW7Gx}2B$b?pA{uO3^4yIfjuG97Nna!pf7b}<B;av`OY(H4&jNWq$JrBcm
zK)T3Wwms*|L(fWCmwmcOopi^g4j+%)*a8vq^;#@zQOG6#8M7o<4qQB_m+ml4P>jk4
zT>6jGe_Xm`CEQxJ`0SbcVXgcS8xvTB1k^BH&txt<Snz!k+u;2Z?Yki+Ty!5hY*AQz
z=JiDJp3o6Ia>K((hZNgMt8=fziT--P0PFug9=x6)%cs$eZ%9`+d-$q*uMs|Haz8a)
zq2yJvndNgw`4j30+W#0(wf~TK^5F5)oqy0!4@3r{UVrGswcN-sK1W`j7}Wy|7B2tK
zdWW1t?r(1|?oA-PD*Ryiz9Gs+t8v-lq6NWi2)WcUgmvxXe=thaknTz(@F4}g;8kt9
z<PiQtZ6D*YhVMNjNwziK*~kD!WwvoSlr@Iiu0g6X++1bZBtJ_YF;1!R(L(Hf=6y>(
zBnOh3@%pM|hU29?`gZAwOQX9OUGl@mPOuRv65M^2W24nW@Mg%XVA}RkuuVMPscbsj
z&@*N2;obt_>D=0+bNVs%mNrSO)~th!@uPEjc(<1Pwfe<+<BbSY7a2R>HavdB1jFpw
zq)<iQVvr?U3G{8oBJtcDTS^%c_kv&vBDqV#E1h~!^YZH!)s=l|Rd19@<-5@pLiFRB
zp|R;cyd-xVcYathx%)=UwFa_G!#(mP6dIZiCwu2KT)1;iL<-$teB4i5PYs$awMdYK
zcx@7&EZVvu<ryn-_9l*Ri~h$_Xzs_FRQa4`3$CzwOC7@{$JMumyt|8y%TKrP!V~!r
z6JFh(ec#iU#C*)pg0Ermp3>YW{Kolxg1N(b<_XJla6>JB7yzBV*t^)*V;wu(2()BS
zwHdP5(3q^$&d)1lAt?Y(GcqCM3;@CVdE$S3<8HV<(+MV&e<)Of?-*M5O=+~q)a5(;
z>>+QS2m=7LAE|(~8pA(t1ACD=Vq0L7MDp;+Tw%7-zQNQP8Qv%rzVFle#K)18^-!KC
z*c`Xfa@oLTBO>WH;MiSIV$ZeFLN72cTpeqNkEfJnB?Qhh$0>8io9f1e|4fi*k>o5R
z%^EH_go(`dN;Vv8nN^HiKOandHim7`vtO8Whdl|Od**&hvF)?y`cy0b4cDJPRkH7(
zj(8FbR?(LPsEsxJu6NQYYuB8$-{zaHx)LSSC7`3Ae3z`4-)qvFfSQ$@ornYffw}T7
z7xp1Gmj|?<8*x6<>fw)~`k-PuNcdKy;l6Tnp3m+#R$M%-yLqnYn;<W@R1>a&g<0Y}
z(79VuDw4Yh)*j9LXb~rrab|FUeRnyrMu<f%A2%HwzV5<L$-YiAFT>geg@W+!J}p}b
zv)hR!*viA=`ANRjy<c~f-tfKfQt@^O9g?;!mLKlIaX@jB{+xmQqKT#M{)$^LRef$6
z$}lmZW4-9J+%s!ogm;MCO%4hXczzH>OfI}WuCrkH5avjK3Xt1A{+!P1fiF*d;uX7S
ztv%jglKj(u;8A@{z^qn*)~Lu);d#o2dl-^iz!vo4D^=$+?YYq8AJp0RR6e}oEa_X@
zY({J3sM&}Jf{VT40D(m9?T}d89U>I1(~*LY8eM;wkd(ZLN?28reU=;jz0vb5v63i7
zIC|_{hdq~2J}}SWWpmrNx;8$|;npU{ku-jV<l!WoZ6Wi3msT1{$UKb0?_Xwl>2>;`
zP;))j0F4+?>)}pL9BQCY+icN)3KvVtb<D`hE%RZpEQyP$f20J`36LqiS#Lv98dDz<
z?<^rVj+WT8<Of=_8QFZ+T0OWaqZ8-ye3QlGk^AIFb*b^zCsH4C47fgo9&7Mkf~=sX
zN1avLA<bl;rS_tPr^Fm2I4FPRi|#)7&Up|~t-=kIV+*42{59mw=$Ha=)xZLimy9G#
zC)DO)b1}$_Wb!EJ61)8y^?PO6(Y*0tg`jUDL0A5~>$LSxLYsdvex*Qp+s-ParBFSa
zaGtGwTBRb^XRQ$^{kZBUK_pJPfKBj=ER1h9UCCtj?+{{&F(QMstC$Yne2Z>eXUVik
zmiX7_9K-i4ngl{7sLU(EPK<C?7=%+dI&AX#fqz7PQnf|t#IeNg?#BQ@a@B`+>C&G<
zkM~`Cw!k3-q_Om`zC8Sw4Xr<Uq+m@@`8m;u?@U^=n0MrdEWNXsnvaO)|0W#3i%Ml3
zU@jz<XoWs5@z=Jv5A8+@`(gLZOpawkAF3AmD{nJ;=Et&Ybgpgg)sRpa6<;O0Y^r2V
zJg@AAl&cntiVqe+ZA1D1o9~CXA}%kws@#i$)G!(kRm!3l%|Y*Wsm)nP%p1gZgZF-t
z)Bk#TCHD=XmPwRBFy_Ti$BZxL2~xfO2t~9`gtXgVnI8%9|FB&4E`WPASD`DDMrfop
zA+<h&VHy(#&$O0J_5}Xb_S1K0mRk3_E)XziK&!}VPd4ufibN$TgQC(5AwS-9H|acm
zPfYd*k4wCpwULlQRjw^1JJ{!Aj;C5c^E2`c*0Hn?Q9?~64KFYy-Uwonf5Ml=6cUK_
zMtvJDXcqxT;XO)B#f!Q0PU-%0Du<{v1O!<JZX?PBN`z&nL9pHSlM_KgHh5D`7mqjP
zVu3T9kaqQ1&hZPBsXf=s@wPqkZ;#JThmEN^anB3Wau(ekbj3bRY;Yj!UA5o)wQ_n-
z-s4_tqrkm2dkrza&dMie`+m?T&Hcea#I_$+af(0L(T;x;*ftL}=4Bc@ij|t*X*T$m
z_3DMosQe_Dlko6g_ZV~4@4kFH6jVhsS?)BvOSq5MntvE_9CzVr&7GYwNqP0%zo0do
z$bPwRamMPTQoK_jj-=+p@Mhwp6GX7B0I`SWESkzsNi*ZTKWSHDGjLwUpf_a(7gv0K
zWvUp9b>y1}r_sOSiddLWobg!v#%P^iM@T}7=Js6I*N91a7d^fic&2{!6m9%0UD<>%
zrD}Px_Ey_LaUK-&T`QV3O==jtF3z#0z)BWZGp=moT${u!!OXf!nO!)Z4S%vJqI{f4
znA=C|!r1gCEJEQi_#oR9Rj+&frRS51e#$z?>+N@y%=UqW_U8ZmV0)3+74~#_Rq#B7
zXj$$g$$NE<-gZE@eft7gXuCA3KT`aCf#|#|;&Cflqr5*|?nQK1QB+rJTtCa&Mz{JR
zX6vs`HJUWjRQh4AgDvYM&C3^v`sI!4Z_((h1buBRd|LQfHgQgNDIrv^4cWu$f1&5$
z3u@$kQszH5gt%&QDy4pYg(_RoK6m*%F2VEY{pI7BqTY=Bi!STAZ^`n5U-C0T$Od0A
z?|*p@7ezt(I%r&qVJGo^JXNN9$#L=S0iF-fuXJ|v<zPW0JIOBwxeGn1MJok(i_VWW
z9{jAY=!%G}o?!hkOy3>y?Q?KDzs6iqJcelQ%y@xxQvtVUqW(JT(edDTgtG@@d#$+e
zxpeEp_}!(EzQu~?-=0&{f}Tiy=v<C_`t_XCXh7#*aU<^Z^*6sn#*mpdk%fNYmow}V
z%bz61dht>JLv8;pwue{m^}=JGE0Rp{pz*J$dH;&L4=Z|(e$wV;{pUT2r($9|<>U62
z;jN&Rz8*JdmK)dk%YVb2FLacAr|$2J@uv!zl6cy2M0m0;ZrQoKkSAt&>^2-ry99r1
z`Yp+4HC<0|pUgJs1>#Dc)ZyE?y!PpVj92iyOZPuK>mhz^o>(dppJJPnZ@HmL-ECu%
z#O~;$L$TC(hE(7Ey{UsFjG!rqX(MDG9HrII$mGzo^}1@{$1A`4^jzHE;?<r#dL-dk
zo^t${M+Y}~qFQhBTrzqX_#R>GMZFDDb6VTcvnKty<NBS}F!ayQnhdH@Y+3y#puO<%
z@SXjO932<f?n%V75y*=i`g>sxNk0k>vKD1Cb6=iknpUQMNvxhGrTLeB@$dqZ&Js>Y
zjv!b5{UTacspZ#ac~M*HwUax-mM!O51C*~AS0v%`<VKJOoGd(7Qa*`Jo{Ko9bDP?Y
zc)tw25*d8jO=PRX3pN73;Cz`Ie!Li*S^D+Y7|(}i$#&hpBoi*h;zizLc7#5ZAvk-i
zjx=<X!QY?7sbOzXt>yS=SroyP`9~1cW5LB44Jw<m^$v0@H}q|<H{MkiFJbHQ-$RZN
z2N^1)n%BwpgG-q^K0$8+70C>!#hAzyh>^aDUy;fqzbg=B>pq}7cUJpB!xk&_NG+{s
zeX}>GVA3I9wri3Iv7hBVL~KPyd5{LXH$Oj+u4Ze4C2NQro%v{KY??=j`yurQl%CL9
zrySvFwTO4Ejpq_`-@ch1KlrfekK7bidiJb9m0`s>Pik)uDIJ63<Bl)WM<V9|_;=RS
zta~q|f3OxM4J|!ccXa4{Qjm<=G<z)F=R#^z^`7P*8jaoDsR-}%_SIu+XJ)Hdtg?=j
zh4qHgf*kkoVW~B<QKtaD6mJ^c2Z0Q1BH0~f&aMrDOavId9e8E<Qjc)jgLYmdWaLXF
z6DT;gG{(HJZYprrgi9@V8P7qJfKMP!N#<UaF%6T3*ojbPS0>8Qm5?Fom<scDM!xyM
zM86L*-KL)BQ<t?Bjh(&Rs`~y#`6{n!2v2e}QKAd4SJD78^&gSk`t$?Vz--olF9r{a
z61TiDz+b2<$MJ;6M>|d;{_XhCl-;i8mx_+LC?F-8dN|wk1A+Uitl_KoDI=JpaWb5$
z)Ja8{!`@yfW~i7$r74j52gt06!rNc5`mh%}U5!~-jhba1#J+p7-PD)+Y)v+PcS{Mg
zO`w4Ro63=Q7lGvibLx8p=Afvgt)>8_G<Vat{)``%=O<9q2WeG6I?ob?Y)^Bzzr?!Z
zN?EqX?1rs(u@D3(OBl4;pGka;)+IA_&>F`{b*y6vS^u0(%e__pOlDm;hmw1nV-oRm
zR5ls+mPMJ=?0w1S;6Vcs>~0ZBR`9@v>)=<oag@|Anok1kqsEa_zi45b+9!=8E*|&=
zC?g;f3o2!NtW$<V#v!RBS8P(g7qs=WgIrTW{}=M7<qq;l)7GoUGhQ766%zX2g0|BQ
zGHO)xuaH0abnr%6w;ep5XnE~Kiq^IZtZ9d>`4Y5E0<3{!y@Ee|ZD0;zN^a);*wyw_
z{j^z4kSN#emyPwm-+xRES+~?X6mN~FFxe$&d-%v~EvwKcDrB|NxO|z(QB7O6Iebdu
z%&^(5==&o)S4e0xuJ5C8@rE5m@5%G1g{xF)%O5tm?7uWr@H?j3UHj=FkNI&<o=5v#
zrGf;#$LNC$tQ=pX(ffBmrn){#4z4Du)QBnE|DnRpyBgQt5&ygiTl4&<Ocw|8%Onzx
zgAwYw7o!4SViAoe1cU@-{}0zdD8F7^sn%ZAYTrw(_B$>FwLEe+p<+VW7^<>g4nO=y
zcqkhZ0fYK*5e^0RU@!!VehUP@UsWylVqJ`47+<Em`|1Q<iEUF$W^&eK8A8j?!-wSM
zIF59g{oHlHT%W5X4o<Tt#F=^7KD)b?a4*a?vNSF3Csd$+z;1;+&OZxP5POO}YEwQF
z=+nm!$cArZfha?MICpgUaqvCnV@CfV4zlLx_Ub2SWAh*&p6a2VEth;c<t!Sy4}2_6
zE{7jZ(SM-y)I+L9xi~{3cH=_%@&Lt5BZm{gB%0tyf;c0HyDC^}irHNIL5F&U0`iX;
z4Tz)oxES8tA}Y}o&(WAZrXsGehe#0c06k5pJwY~R$RbE!SCwubGae8pv%vOp)_`bX
zLD9+*vOWBuDy)Z0qL9nXbV^5rfnI`kxY!dUtBD#TcwfCfoC#l#PjrGI&WJ62K1Arr
zkOW|j7%KUo^M9p0pz{i<A1$80Rv)q8&aEH*6nOe}^i84Od*js5M>6G-z<u^l^gE{v
zfySRx#z=rpzFG%wG4*bV5O_>-IvNg1*yzR?vC|RbENTGHI8;c=Y`I`6>#>l{gh2yw
zmf5ZhJ&>SHeM*?r=X}Qrh!Ba(dZkLd83c^Zkrr`u-~g)t^yA+>;>xp?hY`5J|9b!n
z=-GvB^I4ki4n0K~U9F+;9mAWe>~5nGJ4r(w(Z~X9!`WhF-v#_hkl+KJF<3(H`A<G!
zN*^<z!npgVNgY6o8S`%bNswSjp(hJoN9=}CNwK7C92!F-2B=eu>R;n2iT(x_R~`Y|
zpK6p(?vu|l9t>~l7v$Z&;_!J9X{{dSg_IM+yM`6DHboi|GM{)dLrf{<*pD99Ml7Ko
zwXDI}M&#%jW&TgJytIwj$%rKvWi$&sy=kg#XvQ49FTys6M7R$kkB`NOt!$1-Wlf#w
zBIbW4%;7=wE6fZN{nRrCe!)1YeeQ}0-S^bhn>!eef6R!GpFV!5A-(#-RsGiwT!aD%
zTU~lEa2LMsfi)Y7XRy=cA`@!ELW366*9h%BECjHT2gD<fm`TLK?NWr><%m7pOdrx;
z3X2sYG2gF*yzxQRP8YWsmnYPJY(G%(;0N>(OOj}Jx<=N+z}BtQpLaZvKhCBW0l7!d
zt3Q|SyqilR)FbMzP)4DUQsPg{wU{ER*YDTJ0$BvUF2WuYM@2a;>;g(nPfp=eY>Ani
z>6kg&o^9&XMl3m#^XKn+&0Z*Kwl-(z=|7Q5Y~!FvsnI!-T*!d3ahTR8*|X8n+34u>
z*T!$BHKe<K!yNKOJw%y2q40~lsb`MQj<q^1y-7b0Tb=8kB#Hg$92w0T5;H68M{1Qz
zH2e-Vp&#+x<Xh6?n$21E*dPDpxYh`HOt<)S_v3Kpy7bE?q?(G<DBA-=eYn1d?{dOy
z^#yy^yvlERM*_;7b<G5MB+Byy&W6OHv&<}SDjN*+5Z1t1m^cQg-Zy_JYJXk)IW7Y_
z9+N<ulvKK$qrZYX3JLBfI9m|mBjC0oCfoz^jm(ZnEN5_hJGywp)Pt^M(u<BdDT`Qc
zrL3Ifr)5fPE!!ruljW&)<x<Eezf{*WD_NT;D;y@fadwrlWDXdeG^xDjR(`tK-Q>OU
zU9clZ|08Vdk>H!{|9c*QAD;YX8MvGf`|}-aAm1ztci7_>p5)<76MJGr7B4=(41d16
zeDCq69XYu8WjJhoHTnNSnZuv7FU^h}4@te}!4nP~5(T4vElwgG+6OBsTHhuM;b^=R
zCv)NLJeT7gZa5cH&ffFj17))>UyTXnmU~6<m~jE<%B~X|$o)9{>sRal&$r<hSKdd#
zhJC-~j7lDy{Cpc>8>e577h=l*4`o2`^x^WuuI$_->18vqdNGUok;JyrjhxOO=`*Bv
zVZ-?`CxbI=f|xlM%z<Qw0r!r|zMR+-M&V4E`~Lf8r`yeW?|rk`Fw4G6e+}Pa-=}Q6
z@fW;HiRTnOyoP`xqVlFtH_VRte&(t3Wd2vT8hCFuRr#THwzgcuL2iZMyh06|bahYN
zRQI2=pYg$Z51rKpg8c4oID@tN!9t-XuztrLmY>5=%uKVzA*tl58Ry^>F~>$!X<#Yo
zEv$FXI<S$^af5M<A9>Dx#R$X}9edW54qkGY%UrZdl^0lK7k?&E<q-Y`1(kvgzOuA3
zJ_o;*QcTLX>1&o^iXHF37c0LCL$MRvjnmwzIMb5DRCW&VWk11`H(++Pg-w~*u)fl+
z9&QPTwbW2#wtU>Phha#zs=}0(M^%NXs>1Z*RhYJ4Se6Sj<*qAxbg?X~*i@dKMHQx^
zB2K&0+{1#pMQlZCKwd#?g;@|=VOFsfdx@<We)@5E_tX6kSWJj`+aVOoDi=PO)U;O{
zLSg3a1Iz5c))0!BAOhuhugBFTRJ?-ZD&9ifx#5=rVIjCp!C^0)Arpeac?IzpPdFe*
zOfZBtSaWn4@Fxenvp$ov5xeC9K@O3adg6No!G8vdrp43K)0v%U4b#E$__!`+O!!<H
zA#p<k9yaz2HH3nSdYTe6058@VqjJ7fc}7u;FGW>m^i>UQQ8qT@gcxvNy$}4Yyt!dd
zFl7d?Y^eEaL=V@^X0O}sw(4bqFqS1XQA^Rzu@)YY(I7nN)eW5^XU_1H+9$t`j_h{F
z9#{_UJ66+a_Zn`~bsCOsx7uCDZnp>h)__<Yn+))v-M4#<R(D{w8rW@EE#fx2{m~Kl
z8#emQfnzlX7HRheP1CfSPP^Z0w@A0$ZuA<s@7M#}wEG>?aR<0>Hyqn+wOeG+Xgj#o
zAB>KEJN@&Bt=397iF_`XJ?mG1h2akuW~U2&$|q@lPfu&HfBs4;oo&b^{1+vi5+U)_
zKTkQVzCMr5$}jS@`bCyZ62H{`C7cxZgt_0rjxA(HMUWkl^iKONq2(1MR6#<|u4I)<
z##?a7s6eH!04gmX>u((M>w`+>j-XNo6FY-So1OWe2UIF)a|y{-pwiM(Q?_t-yyE0V
zPh}MH-lm}UR)xLG7Wm$}(09yz5n`YG`CCre^ANiE`<kNfQJWmgV~p{H_m_d5@absV
z%6t@V9xSL-c465XR4O(ZZGj!-^*SbDZjK#oN^=kEW`!NeRsnX@s<5Ly<>dlhrr3Ko
zqn;CfRA2I`AMhy^<o4?NZ39ZndKf;KRKHgXD7A9;fMxby8K6W~QgZ1rLN<2@aw*IL
zoeg5j9XQWAh)$=(0sP3DBkW2NAdD=SQjjnL<`kj=35f$qoHGQk@MnR~MVL#As{2V)
zYLNs?y_7N-5tv!d4D8<uph~>}sBVUYN#YTxY&>7Vu*zUgvQu9|jJAfFENu7@-c&B<
zSGZ^)wQ50?VI|_lx`hmMdv(2sWMAk9{)Ai{APd`{Qv;;)r6D)q(-8xt3h)#c)DxYf
zrt@b=u%e!}Js4)m$3#v@5Dr@SH2BYeK81>;)mR`g;WN)c+_q-{ycB}RB|4en&qOPW
zm}1W(>Rv#cnN869J8`<`$HS8fl0@gIGu1u0cBs_PN{%SAy_vJ5KtzDrIGTvM^RT#+
z!rg9%O73Um3(*jo!zCkf@%!g@mqQo~>XATSRS;Rdj&8y?L*}>zbveNja?YVANW7vL
z_V^S0L7>}u#%aZ`<3Q!~S<!#pZ}s4VM}<swS-m|o#eRgLr68~{6>B`8r>g58qLEL}
zYc;78l%h;3@J0IoY@RI1@-&?|#+qv_zEg&TuzTlg60{_D>hq<`p{WX;M~R)1Ib9O%
z!nnNi#fA?*KTrmE9s|ZdlleKaC`+fdttGYVG~E|yxC$jMWgdz#(PZh8vV)Kdc*ZjS
z6JVYT9XQR-W(IZ0Reb=JGQ=4jAq43PGg{n+>pP^fORB(PBdBQ=U7lHLQY&y%`NXN2
z1%Ry5g|iH8A<Pl#Q)+Z{W{c4g^eFqL@9V^RDHT%Ubf_%QB7J+IG|^)Vy;+}RC~6<$
zv;|p*;s-wY>sqVyM(GSi(SyWE=y=R!@hmB?!x7O{{nhhcX|Nux<@GXe`6h%RERle*
zgO@=XD)nQ+g;Z(d!tN!frq(bz1#N;1g5ErQD=c+dpFq<l*!Kw&;aA4WGPtrHEl*MO
zf1RgTPOB1ZF%N>slZE_GYpYj7dMe#j1}o9RkW|L>VzHun%es|PoysR6>kFmI)pWQ%
z2?eF4ms&42!^$h+m3Spo;h^ir>$PM5iM{KPV%?Ya+=B~rPk#bbaQ-We5nVQ_-Z-tV
z59habg!40)*cr~>%;NeyaDGXPcSyE^^V9OE;QR{CKR`IY?834`jOgYj`7HqcJU(I)
zt<3@cO=<37C9ME{*)9P1+ZDjSpWsmL;Q&%*iii8_i;q_yf4X}JC#P}q)8!kF7hTrE
z@WG_=y;^v`ox3M2v;V5#eVzT>r9_~`+(6OXKvOd1!Q4>hcPHS!52by6x>N<YbmrM(
zft=`Eas9>jIF;zHGaNVwf_EONoR8Q?;*tQObj0@~mW~E>X+X$45eX_)0Fe<8L2zJC
z>Sn`i)SG6VJYqo~iGiWu@MjVj9%SCfV<HRz9R~nIq``GN-fe{j+Qp1nvp`4#;A@BT
z;A|qNUb0J2%lm9h<z!~5E^!aL6C6m+#`Rv)bseW|W2<d-vF&th%XXT$(H%5hw{N;-
zu=;g^-5H-REL=3f0*#KsQBs5SBWH{3yL8Nm^UmX{gx66SfKd|^k2WAV8roJU&{BgR
zi5wC+^M{Z2nd5~eyP{Y}EG8G;m<Lo&rU;P6;SU$hbdxIZayyXY2Rfcq<tV-m#PJOS
z7S~^hz2fqn6K0v+LRppsxrQ}5v$H$IVzx6)Q|ex$GswSZ_P$xPq>AC(RAN<H&#$3m
zRSf4_h~a!`fHD3W+$2SB@+<OLfxMrwH`{5>z~}8V4J&+hgCwfh+!q7$mQ5%(PW$VF
zdF>s+ybLCG2J<$vuRIT!SJJ)}lC8kJrM0Gt&8=c{4-d>MyRd8x=9RVCZ2{or^*tuh
z-W<T&l;$2*&kDekodN)_QvrDU2JnWTeth@o<M2Kz$Xx+=D_R&%(WLUdS^%$;yALe0
z{{{fOXl@`!hbCDB+nmMFT}GAS3Z+YB<IvKJir#DS?J0$82tt1P_~ASeMe1WV!GQxI
z!hk%Ej%p)?KUi3hG4^=kGJX_~Q`_S+C%)tcga{im&OFK%E#-tb+)g)j2;{`o^H5(*
z#DgxWL|(YyqTb|irV1V=;lht($|d;}c!;u-1h=PaP`~5btIlx+`DN)%71wmQaZN8+
z=lx)?zjWc#eL{cDL1!!IuhZ^U&|m6bRnf1i=vP61&j|}v(BI2cP}CorZ?4qjr@-4-
zNbt<_Na@qZ4~HqHR}LlLUUe!Y`L%|HF5B{MoX*!rk~=#h$r()Sj3jSn=zAU{xul^r
zBwHcLX?avga)l%xAd*~mVc8|ibD>>%3lur8-!X~K<|y)}H21J_Rw%OU7NE%83PpZ4
z6!||MhM(@PKmPdB&leBiNLj(jE9w}|)ua}_S~$6zyBRFA|CZon2=0rg35vofbv{O@
zS+ImKC)1i%L7*$20Xfp#XT8u6e!acwB*A8D(6ou^;&!uP4&3gb)3IFFY&3d<cDLVd
zLn+YFQNzS;&n9-KZw+wA!A-l<HmweBnaxhq!cEo4wA*;lY~ZFj7}yRbCT^2XXVC9s
z(``0P$bdXL>bJYZ?BQ<5#2wPKT+3-Vj??PnX4kR%-HvM1c1>b+O&52}f!#3sEz9gX
zjSe(yHeDQLP1aobBw+jz16!k`PS++@*J(7GO{d?px}@#&8fMGs5x3vz_PV2^Kd;NP
zdwbPMBGtE7ol{6R8(&_$YaN0;I=a2;RAH;x>R5%X9x8(Ujpy2|;Oi=KHRoTIfpj-e
z=T&7Ots+;~i?o8TE4Xoa&Q$24LtZVqxNO?Fak^h0UF`0NE@m*XGrG8$-RF7G#gcZn
zkZgr6rsYwgixs+ffaqe`g=Keiv9wun3#>7Zi<m@rbF6VwntNDBE38rW3b4jrg*EO4
zYrOc`A)zTu1Oz1PNdD<_fGHyo+~w$umv21v?6Nk74<?oH)k2NE+?`>W{Z|DwCJMAJ
zO3P*(94>xFiy0JEgH=`1xg|*Os7nc|sRc7aa#aTI2?uaFoM>kwhR{diE{eHMMPM6{
zadxSYE1cr$4YO|c>uN{@6-KN(hCR1PV1zkpqXf6cOuwX#%A|lzvlFfe(Ce_PC|nQr
zg8zNGcnHa*YnHy}U*37x2@90|GNHmJ!C$cqFMPlPQx@PS{d33}wSVT(-An8^^Ixb>
z0{#2K52$w$RXcr8EfRddpTnOw%$W%p@OjkwiU<<O@a+oHi{_S^QVU$}F5r)F1Xqb<
z&;O+mwu}3_6vn2(hWB_%JtbgtjwBZnN~6NjT95}=oKCJ)YXar=LKQtdTYfZA9dm^$
zW&c7a3t66)N=~~-_U~LP%PMexHaa@}wej0&4e11LH_Rbl)U%Yy6AHh$oAv1N+3{)C
zd*j-Z)OAmiH2-vtjAjjqnHBabgJ`n-cc^(<Lo1C=N1364TFu@AU`3ccUzd@#LI4jG
z0Zh%iZxa5ynfln4dks2m_d9PXZ|ur^f7XbXstn-XK)4JYUB0x`W_bY1eD?n2L+xM6
z8TR5Y-}rk_)csd(C0{<3+&I0jZzb>TXeG~JVrMJ)W=EFiv67cOGKOR;D|uQTm6g1*
zk{_UzyzIiVwUvCE<M$SJ@;p9b61~ms<eSpm!%AA&$z{L5PTsHV<a@G{-{T;_;`7@!
zgfFXG_+V1YUacX#pS$=kv#*H0Z9{ls>k21MWEVd}H!Sh|5RR0Lcr|4gPZ@m#k}w#E
zGTWOuL?D&h7@BGCaHK4o+*Oyb>k=E@=%{-@F7Eg5oHCJk@P@fOq%AqJJ%R&ojzXIe
z;&MX3I`8ses*UzyW={|n(QC&6pZPUJ{TlN4cuX9FGc*$<5Qs?o42>94LVMyf&q3Jp
z_>+41D$__C@g;O)f*%Q*@_;}`B>5tfGE^LbOlpX_2uDUb01o2FrSDUv>(aPElu}Vw
zvC}9*8w%G+Jvc@<IK~Xh(TPa^42i{OVYoanR2e-%3{~llv-(b8!jekt1x$$6=S)Q5
z2W)@7=iK}L7s|Trdf4_)w?l39U%LH)j=9JGbUXa0Z@(iG{788Kw_9dCo}TwueExwt
z<m^JX3(2N(R)Vf24C7&DzQ`o+@h1|TEG{Y=I;bmxwctE}MU2lR3D61J8Hm^lf{1(d
z6)=qjnz1yPD&#2}_gHS3=<15~Fd_0RB;gcshW_0nt~^T)(>eNgH4bMh&%nFHY&yjO
z{evKDj;<E^UrX>*Tj_fZ-OVhI+BbJKq{ed?7RIZgtHttLTZs09T4;V^pJ15*d`2sm
zQ$zQJVc3LF4Ox_(+|w!fD`8+5BTfx9oh;a74dL)}U3XHorbLCKRftlBD4`=6(D9fA
zpwD8$Jy@O_nFg&2QF;bMDVgtdpRiJ+)2d*ltbY}(RHY`}DFbA*&41+#kQM&+74WxZ
zW5|uu|N8h_e@FZ+gNdE-x6Ldi&x5~}v{Z#;EBtL~m8q(!Rn^oE4}UAWu<RdyTVt`>
z0)NZnBPP+`9Dm!C<{nnk3V)M>0{m@I;ct7w--bTetA-Qed2btoTUNR7!K9|WS`2QG
zy8$e-uZUI{TmnBzOd#|)^T0%GQ4i{DeHBDb1-absACz-apd1*~mq59iM&-UDB)1DD
z*J#&;8Ylq+Wdt@cQiElTXVk&WCJL4FLr-=#Ht-lzCZvIxV}#!@Y;4$%#86JHra9<#
zc0=uw3iNZbPy0y*m{{L4F}(YL|Bl)BcXK)6te$9o{l)h*00)0@Dl^)IKwcPa{Qcbz
zcXeHNLW%k8=P;Bg`M|zFJj&Rc!|yT%a}9=<)w;s*Djcth45OS~7q6osD5t|AxUy9L
z6=o6ObT~UeuEOzNG&1ZNs}eRUBroe<h2&L8UWMd^D@heex89_3;|#t&k~i29$;)73
zXC!Ykd&~16c_r;#A=wJaOUt7|@+u_n0Fk`13(NkIyi!)IEik=2j$#sn%`v@AY3^Z7
ztuQ^=Y!rZc%|?al?FH4l<3do&Bfk*Ke>Zbo68!W?0@veDZyVxU(ZKM@l;XWwkWX=+
zy*aE1;B~`%SjOROzAma<Q~6V)3XMe7MnP`Cr;DQn#OGZz$A_F<NKUXsQ#?l&i9tV&
zuvu!pAs$XR<PeuKovrTj=W76sT1LCyZJnWyM9e%X5G1u@Tq4X6We&B$)(BwV6noUB
zd?rwobMCAR&J<Ti0UDrGDr;W4lTXC*S9;3bbPsoipX&7#J%D6D)-gMJwK-Frfns8S
zdxireLI5O9fC@BYK9-<dBUY~`23Ab?lK=!V8qxJ{Nr+>L?FnT>C=H;Z<WT6ERPdpr
z0V)91^k4Un(_tv}<adw?_W}7t*v{o6xp5#2YIKz15)dlg&Y?n5X3ID#>CYoJV=%J%
zLMTsN$tQ|k`cdm}`r>l+tB4?I<w=5xQze9xmBJa9d^*L<`2eXBCRm(|j+8t{M+$u^
zY?MTuveV{W*fyUr`N?O17yc#Amlv0)DD_D5w{l7P7MNoB?0m^*c2CQfq_&!mFM)ZM
zO~ZHJ{Gn7HzPxrK43yJ#Q(|`j>}9u}`965;Q_iktI#<+s>WlUj?y@YLjLDoI32~G$
z%L`kVY?i-redA@q_K5_UjW-q3wOER(9DyZ8mfj7XDMIO073x}S<<F{Q8}{lT>u)Wd
zc^<tAhvK!w34Y)<_P%<U;7iLX{Fb=MIDO|wRL0LdkE}xauSZ}jhorYDy2Pn(b8SmL
z`~tEo`yB_L&wm9+Xh1lKgfY)CJ%QD1JPycMorxlJWk}iBBY7FOvxe|Uxj<hLiK!>R
zcpFe>#n8Iccwq*5ua0j?OE4nZg;)D{m$CH3WVNU8!eJHE=C_huP-ZJ_x#Y~H<Hboa
zn+@e_PT9Cr>!|&^d6Z3MZQAp7``Q|10(&9UQc9n4JDI0k^}rOYQ<RNwiJa&o_mFtX
zUqAPefN-C%OOFfU+=K#KV_(ZM!<Andj%?+@xcr`s@m#)CC6?Ybuzdx70K@y&cZg}G
z(B&;WVlw&I*(YXGc;b1yVoF0qA>qm|CM}Q3FQ)Q~IY7Ud@{7yXo-xmYyKUhxlgnyM
zW0_<6EL8Wh<VN%sA2T2khi2l(SITQ3HDI7z`pJkwyp8VSt{d{6fyrlr=Iu<-yew?r
zEOMJ^R&FzUahtg!bjsmO>T^bzj3@LPcbaMDOwXj+y<Vr8X8y*pEPz+#H1oHaKbIt^
z=@9WJDhT?__!EQJ@FDkbaEpV_aGwf<<Km323PDv~1hzL5kYSg*$d0Cz2x)*X4V6L#
zo*P0E>`^vWPsN3cZS2SJW8`i_AuQexxJO-;h!t)Gd^VmSL2zJC5Mg8RKH$EjQ~HNC
zc1$s&{w%B$39m>vb2yJ65&<u#4DkR?Op-$kJQ$7Kndi+BVK$!ycuc}v)RH5IKQWKv
zB&lfnYc~>y+cTJmB8-oZ#52JHS%fg;bLdil1Z6fsX2Wb~nau(?gn4t2s*u$4w8IGj
zsdE<^HcL4H>7`6%s8xbT3ovw7ubw2Nj1XElm8=*<-&2n)!moV@=hk821j<G(9=uRk
zFj(xgJIuvY(4o@BOFh?8jUB!FWA8l}GX)~d5o!fK{&jj049^@wZ@KvG`|l}}<RiY6
zC#R#M|2+l@e!yW)ulDp#oqePJ*78}&xRtPB))K7LR(hKB>&SLfQEnrPAb8N0<Fn&D
zzmY}_<vORNd`OZZ_DrOmR7$@s?^U78%IIixv_aL#eY&gsK*y8HOXa!iMy5PTzHN7q
zY{Td!_rOq_-{AU-OFbFdf%lsxI5S2~-)nU8@0o8ZD7kV)2|Y?S5LvX`e|0aE485!X
zg?(qrT{)V;q2vVsh14;38$cn8kKF-<4UcZm1Spg}K8J)WKw)XYsZ!=vDRU1HP$<2)
zYz-)sJHu~-5Ht&I`OPg5f{m%}Weu$m0@*Z+5CXG82=;;y+)Sqwrs7A;1fPOQ?~P*v
zX3oS+D%|VE2F(0DU|9gK3L8koUD^|3hs7%~5+nd?y|(y+Q8cvNgXtTtsI;~-K^!RR
zhNZ;z=g6W?g~G_A<gG|@?rB@Pm<vg!C?GZ<=FuICxR5|r>owT#Z?TP^P!LZ{Fz92j
z>5nlBp@34B^Jt2r#T?(+Wd3k5q|=9FgcpMFRdh!mxrA_3;S-y>)LzJKVenoGt9-z0
zelj{TuD<}lLOHv`auTLlCDOR{?}8{xuD*($N0$cV2}jvl7muoJr0|Ej!QhtS3e4^S
zn8Td++;d2v6YA-wpTH0dXF>gwGa+#x^$*K-h(p64L%2RuF`|muTl^Wu$)iGohPZqN
zfJc(wMa{n?&*x~0Ka&SR<VniZ-fT1)jZ;+~@X>~feOHfmX05*NB<z7sz6zbtRuZkY
zum%K3d+loDUJY3ol$0}ce}9*-o-39<`6<zdhV+$D^1QrJise#6%^GSz=MpJ!^)dS%
zPyKAlnd6K`45mt!s_1c5br6ZRw_Xt!&pfH23e;6kkB$s5qvtdTmE)E>N~Y^uec(@P
z-!rr^i&nEMJV*U(N&HBpn7j`a7sNpTl2{{cG&*ANOpexL&+`MW1Hhq*9^}(@vtRuV
z%Xr*M4sUuU9i3TNX4Ag@LUyIC(6dbC(TiyI>@9d%;k*xtJK3)u+E>IQl4$*1`z~Q?
zf{uD%Wl_l-5YA;86<At<9Ib$`0_DsObTT@MHkNQfM?dm#G2>k7a*ICqs69t?%y>Ys
z=ed}Avw(;^QB0tK?RtUNBPpcTPrcRYzw6pjJN)4g56@HYtJl#mTrWW=YnM}No;RIp
zNnNj{w6nHepK42EUW*y8rN^t5TGVQpi)byihNsqV%_?B2Y>Z|;BG{fFpAuUo#3$g8
z1rU02iiOuM!QmgB=du1>dY*rmo|@kk%%<;_RsOrhz<;--u-~PZ_3yIxk;RUmX5c?j
zdktFrXlDYqAjTv<48J2__|aaA2(O{ILaqXT4=^=!>eLdQa;~SooL>Y1o@X8bO5mqT
zhXuLTh01e4$>*x1+Uc6PFleXUds8szqg{pKmz7n8e`<&2DUlfbJjxg)ltp5#Q6e^v
zgb3zKRSI1(KY`)p1@KRESNt=JkKOUl4b4-}gnyPb5r%{-{4*_&3jeI|&qKsNOD`^4
z<DUhV*lmDMvk;;*w*Wpjrn;BKvjRS4vsDCqwkqIrFTm$*6zFhydlkDOyqo_GKjJrz
zfVOgGXj1cDF9O=i-vyQh@LCbjCkV|6=$JAL;X?k*@~D{TjK5IKQdi#7^)J<|2#C+2
zyyb8%f=6U=$%sVcG2Fk;MoiyOaaDiihQ^}8W(rP~I2aQt;MxTJLYbpd-!cb%pltR9
zP*|8{I;F7+u7Y=lIs{-VY^%r)=Dy@Q;K-hzjoAH!AeTc4Pq0~P-dqaCWT<}$r7;z<
z3oOC3kMrzWL|JB`laeE%76*dtsRKZT?nE3f1wWz|7~Mfckggb@g<A@sRWA?MAb|3w
z>b=2?X?iNcXiq^-shpfB?_a41sB?7uJAT9<lVc@@)U8lj$03fFolsXn2gi#rDn!Yb
z<J$36DBPhk)E?(#z^y`ys?efuDFN=c9bvTZ=%BY`-mVhPR#84%rsa60R_^5^27Fw<
zfR($otCc&8kKL`@8y-QP$;w^!7#I?+tlVjNR95cF%6*7d?$V3P)>iIKkF(pDy<3F_
z>ed!!?~SSMWi_qL-m=*)GJCfxv-e)i-j}8U@^tQ~|JEaY+Bs7)scNs+&fU)62bKl!
zs_fiXs@5xn@qopc#OcE^0>L@Rr#^`zdUS5Di@W<M-__ZOeT;$>kbxqNcDOChrt!dm
zB0~mj2!auHa0Ta2;=vEN<Tm$2eJYG6pV!+C>2-+NG+JHPG1~10Hu{}`W%N4Ow(VZK
z-S63D?8nJDy|bOTUPlt3015@`u!J&nGtYslfVT4NR=K?76TzQ}qgRN~DIHy!$c6D!
z1qVTxq84Q_n+YNo9_mljb8H+qr@G{vg;mdi1#mHkPo)P8ew`<}Y~1l^G#dE=tn9}%
zROTN9A`PK^+&382BsIKGY5|$re7Y}c_Fg%q0{ip<^t1%UdL4ZVxHSv7K(}FnH>FwV
zE{m!&F4fD8shVZTmZmBkFYq^z=OwoSjP3*eJ7x)rYOa4@ua7xD8+-MB@YDZ%`tQVR
z@MN=L8*&%hbEGo<N2^PM+!JL&mzOIyZog0uB8+A-;Hd>GUZTQ&`}FbS|NJfSB2Qo;
zp33)o>ld}VxZCSutLHX*1JY?WNvq*Fren98mecC@Q(XYP4pZ9=@eE$IM4r6ockPP=
z`GMPSx}AY#clzy)*))6oe%mIUW~<-r5XWrnNS^eX4cF{DodL!jbKrD)1JlM`*KOFi
zX|>urk`H`);`tA)vJ<Kdd1Rn_WsbM8r$6lk73hZfGnsfZXt??qyyXE2q1W7Az@!@*
zm)9Tfk@^-v2Kq>x4+KBL`W|-T>FMcgCJdVd@@&i>>&(WYt}1Vc`u#<-XEd9=B=5dG
zA=rNi$V`wz{#A@=Vu!x|$4qbGs+vixjJ;mF-?gm1*>^15>oo?0UcciK2g7hVZMW6J
zPQz&ptZvV24jPT#!0t5qR?8)p*>tT&qI=_D#-w;GH?`IJ@kkhEGG37v-xUd}oqo%~
zgLcR0n%Fg(4bnH-gNA9~zH2r*cF(lTg)r1|;o$&=N1)-SAK!iYI9$v;4Zo-450Qdo
zu0N?QkB{pbvo`{wcjP)G=&U!*I)UJaM`A>=%Z3MWm3T~qA>ftp@gfYUcInLxdx9x5
zAopp&r&JJOzz2XKX3UxeLK;!3)3b@3dI@GN`p0Md#|CR7gPJ1=FS(dEIU$Zq1I@AG
zPBGHx*3D*JsK<;&#B@EmK1*AACA$E9NJ{gO1~VbK#GZQPztth=vX0x1W0~D<8+Yw~
z4>z5b-EnXScW}$Z9mgHuhSjk9u1N-+X203AoF=iGPP^^2P1|<iU=w0^iEcthR#26)
z+7`_47-3%`8;jIlN+!hfNw6!OO?S^IA*ro)(WDT^fMY~i<QIx*HkzG!qggjw1G8(W
z1Bsx*;I0vpG8C!g2NIt$?3eG-vvk4}*qKdB_5xOgfH>%CHua5r745(Hun<YsusSN0
zqg$HllTE;bhT5crW|gM;JGO1d{|9@tg5ZmX-L-UK+2&$$X|7)t#iLz*ma3j&`|~aK
z!P>Z<vi_=uWxOQi;q`xCUl#OMc^*8J*MVUMy~VycrgAc~lv4gkxY_#Bs0%ut;yM*#
zMnv80v=T4B9S*Mnb1N+>ZedS?OU-ApXSPaHo(eoBOqL^EucH&~7k0YAD|{{_`SKvd
zq{Le`>U>D~8N>oJql{XXm`SI99<l5K>B}jpV~c@msPj>WPF8m~5X8|bp3i;w@c;(5
zljZc!rwi)IN6x?zEJnEX+u)Kmw?Mpo&U29!U|}gpng-O{qU~iVAx1Jubuyjviu+nv
zG)+4s<loQBnXTfbb$Ivstl9bUSh^Rn_tt&fnpdT=XXiAll4rk+hub&o+7?dN3+9CR
z5ccZg)@*bt7q|4d)pmEji&n-BobTdCp0i(zpzJD<b>-rgjV=PN_5v<$?Ok2mviR8D
z#cf0M@tIuQ$|Ara;mXA=Esx5@t#WZYL>ITxi_6w7Zh46NHm+>#LZ`F#7Ord?Q{Bs|
zS-G;wW~a!Nty8(O?WedU_kH5s;rWyVV1ogR^&59->*P$$q{_Wsm$pv+y1y)dSLM>S
zkI-#BnS3>wzDM8-fF`pkW(IUcWvyJms!#$FjJFWa?Fo)B3J46Hg8)oB8?offgjR_h
z)+*c^N<sPoQRODtO!d^7>-Qo3J|3t-lSGik1vJ5r1d%TjYEgKZvS0#ut=#lH;*3=S
z%`m$*cBYh35mq<TwJ24>Zp4UGE^2XR?kN>EXD%JjbYpRb-tz#FFL>&Eqy~ahNxmVz
z{f0>rFzlh3j7oWmnLUAOmeCrdvVX(>?SLpV0fei&0iU7|!;9fi@ij->m4qp(Qn4u{
z_XtZpBRP_@0K603MQ0=MvZg%h7v(ymM5$qrd?a4&ArKZ7<ukdGK|DK5UPIFfp3*V#
z>)6u-hlFV55Zac9ECQ9mAy>9Q9%Y{ud#VzvdL;-F3&Cxw6iKbqNi|A3UW)HWELwP{
zBCrjmc4_xZSZwRfX5DPmZNToQBrwJ^>Oj=L;qt(c6Jj{r_dTMOKJ7M;#EjE~2{UG*
z{^ST6`c#N|C}jhT*|x`h;!tcP=IDRHwtud@8NUC8vX)s-vG(`dKi%HHTf8*Gn^epN
z4K+{HqvQiBP|$|4So>_~e`@F~3iU{n>WT3Km^(DO8kjl8VjrtVGlR0Rfnxy3@B~gg
zRH}fh5_Y&K+=U(Ahr251CnzU(wFaUoneqT;EL>fPC?hCaW#SDj!Jw5<VP48?Z{`p*
zI#TX&qa!t`3~bxPmt^K)!~<kZF>*aT7J6DxmUvf$Z=GZ(K3F20-zxFS(GlXoh-EZ|
zZ4OhW+E4N5==4<a_0tpz68l^T3WW&X--)nOun|Bd;AqW&_4xOhkWkV#<N$Ivps<T0
z#shQ`XLq3NU+CmG+3>g)|LnHa1)ZKchpS^nw@T|!Rg8Vsq`_5MhkWcSUio$I@BL<X
zXtXNmEA_8}zN#F?Zz;ROvK0c(-!A}tb#{fmviR5?`r6P+@l4QHSxZq!xPrdY@~EJ%
z3i>)k=&SVNvV9HLqGS9v7+9wet?F!nfo)86FUx0zfyrjK2m|X@7}#DgFlF$9;~W^l
zqS^SyL9lMl+)V1+>jlBO`8&X}02J8@1Y3Y$qoeCD_5`yr;1^&lM}Lrj8xEceM85bQ
zSGZFMr9l>h(b3t6-7rLO;LXvk%5`8i%w`QO&L{!#h)Q_uLv$k1B|2R`3y?!yg=on5
zHRy5XK~RGgVN2L`!NLyJU}J(yeN=eT%7af}=uLn&P&*dcoCgkN3SrR!pBm|!0^CQL
z%Y$i{4@0xKM6`w;si2UuISCjkFz5RbYo4LYpRWyI-!QxVPG`i-rAxgLYb{;sk61f-
zsn_UsvLPvt^RO&$Tq2LV@fS#WfJ)(c=mUqS=x8RQi<z82Qw_@|BufRF!X$-o2e?ZB
zK#PK9l{tG64(q_{1B7)9i8vcEg`-CBRs@m)tOs;MEY`*Vj)mn8XX-R7vj8-eshSGp
z<8fXZl6)}CY}OmCdc&+wXP%_KM~nytGG@L5D~=KAsY1s{sACamR0iPD;LF0c7y~nE
zzu6n&la<Ii0l36CMWP^P60FeWC)0RER8O-AtT_ePM`0@;I9IiQK^-p^s1U$G(B_wb
zs(j!|4Ix-q%K&>`oMc>sR3lb^5b5r1h!UZaAko_nIjZoN3V(T_*rN)6i9}Il*UtJ^
zg&xIIuD1F4>aAzjUOoWB(eDNDm+r3kOBNry<1ZT?ke>;EDQlz%30L?_S{@btQsFO$
zh`*FxT(-tvHa}%=1ITm>p_A?wfXv2J_p+W=fQ)SRiU65j1<33%C`r4N4<+}(l1S~h
zo@%?7Gdq)7_j)0jUjC-AEC5Bef@G?=q@1{<rO=^_pdkfx@JA9Den20oN5;fa1vIHm
zVrb$JLW{73^-lLiNbV>4p?eDeN)<}9O(;>>aGYqPLa<XQ&<n)AkC>c`)xp)ol?q|d
zh-6ftuAr(ip=L(u6qh3v5(iSKZFF>`lEsIp$)YOhzu-<>fo1`$KqkIiXazd2Krm`Y
z6!Y8u!z*es6%n$Q%D7kIFKcqX<>53{(zh!9W!JK%nfbbolvz`dYsiiL47E?QUwYr{
zbj>PqCiSn1oT(yb-V$=Nd`^ZF;tL=*y<L%;EIxKeZZ<qeKNE6O)|L?xu8^CwJSya-
zLT(NbxhcK4>=ZdueB#~)t?3owD!nbxnvJRMWeu&+8rkd@p*8&qt=S7&^MB*d7MGWJ
z>SH=)L*ltt#3OL`jRQ9QoC%s#yw?lZ^z-+EWdSI%6=1UfZ1j{umZzd7Jj%u-P=!E=
zlS~9RVqrrFu!x}qs5dGJz!)AM(+pt4!c6(ygOSyx3^N;CAY#A(-AH9<wFqHI&kYE5
z8H3}yL}CgK_!i`aA_6LsVu+LRJox_<|IPzs^T6jZ*fQi(g7{2Y0l}Zc^mCLwa_<qM
zI8<qxR9-w}hYLxVMG6oaj0Bxh4+lsPsbV-{E72MH5amIOLPO$AXaP~F(jcTnozkLc
zkOEAFx&XoevykTuUKdIkgc1TSIsyd{q9+xl07;^vl!3^i3<vX^@RHSJXmKvFsESq(
za;`PH^(mEftPJ%kpBVAz6ylEHH^dnkYLwyEKUDv8qbZj}8mhva9tL8Bx%xz@0F;o|
zXgNo)o}*|%f9AN8C76M-u?85*U>E8Ud+IDdak8$)Ob960*t3%%EM=ZC80v1)zG?R0
z)B3Eb!Ygu%@MP7&Szje*<?fv_F+_ri0!VJ0WGG1mo9quZxg`#rO|zTLd_T|?Xs<&2
zc|F-h`|ILaB?CGhlR$fFb5%s+uc|s!a6iG>b2WSf0yV0@l@|(Jc}`%Y*Qmgc^q^H0
zb5f;z7FBk#R47Ny^ORC)9ei5KITX8!N(GgkJ<FGt+EigHn}Z+AXHGb6y#V;p-xd7G
z;$wI4W5YA)Gl3sv?E)d;3j9dRqXIuF@Z%7{kJ5|F*5F6!v-vjoN52rM=x>34Y)o}8
z%V>pv$mXC3{}@#G$6oM{k7O(!gO>Sm#vIRUnKx5BCLf@*z=g#i8<2Oci)_4kKxB|J
zW0RWrdI6C^{{FBmfY%C$P{1S>Nq>TH=BPpm@H?DAx^M!=4m7;_@BvYnQbOZ}y4*=v
zw}xw&fT1(T^Ug->Zyd7oK<X!OYy%s;s@`MA^=gQ+Ip-BZ(b=RXGbYcJF+P|v1_pMI
zJ`y9UP@)T;Ktlss!hL@h_*{^37WQbpK+%GM)QW-Bl7XT%1I3HRo{aACvb17$&o`<k
z(my4~W^_~=9VG`Zv}rF{@&81a6Gaoi_-M2I@0>Dp62&O|sK=#zjKWr3`lw)$n>(;l
zp!0JyI=WM80X;f}L~Xh6%doG5C4JQ-5Bfkk19Sd*i~Snoe=;T0q66=_=aAqI%SjCl
zf4FGYHtKB(D^LmBZtlWA?iAJ-$tL>iQ{Y8^>IMY>Lj@)54@&rfjwcn6@DdeBY6Y!R
z>(tSPCQ>_M=-Y!G#LT)cgFKkc{#m1$Iy`6GZ|)WCFtg2!@x7Ao(gy5X>;vGuvC6rW
zcuvv7YX~SJRRXWwB(^{`a_8{@AtALF)~^f40g!nES%u#X&m^fF!r!2rqHn1;Ca6z=
zx3Q4mndgzxr;i^h1oGv=ua=EGVBUBE1ahz|0-43f?g-?DMxbXxAj=x!Lc$dSxwPI)
zG4)pPCUq4|W~&nX-#lk89>{F1PnZ=K3V*rqtS#zUNc=A;SJRw_WVnpSFUn~LN$OK>
z_WB)Zch)TKi~Ky2KNC(N|C@pHMVQ$z1ow_I+T?iX$ADmXe;E}FpN_Vv%tzto;UbWw
z7niLO$X#rg+kldTLilj71t_^O)xE5&6(}jqMgb^kHY!l^SwP8OsGM9dKE)oNg$CTv
z0QR<nv{p1Sd@`kouNIS3+-L6?D*||Zm}JB^_D}$tz9^290wR}zN?jyJ`1pwt2U&B3
zqiruNOG3o==t;j09;l&o!mJt!!&GX>e-e}M(xUy@h`sap_<QuisHB?s@tT43q7enC
zJVzu@286g3+E)rZObn2sww%<gmWU>T+u=y*8_8!+O9FZ~?2!l+&_$fEUn&n>61!Vz
zk&Gic&k7F8cxDJ$+@K?gCzjC3m1l08MdM6-vn;|`0xUc<0C+KaWrl05WD3S_t>_9y
zvJi339@9+pI);HWu-_06FA&Ajm}k5@SAv;0VonpoVc;h`PjsYN)RXK6H%|8Te3Efz
zniaNPVcQ<;XN^n)j>K{X9~?&)kC=L}_hoL2P%w)^c~LAYY&-R@!nP}HyBMgAcYu7r
zsEYEdu<Z)luCVP2+m8QL(Y1TWwpWaWU?%(e*tXf&5!=q>V`pr8Q)A-uVB4h)x*_2T
z+fK`)!nP}H`v9@+@{7wJvF*|p@GYS2T!vyA%Y4yip}LoawSu;#*(`##n-#RZ7ifDp
z6TU906xx168#i&@&3_>l<O3!_1#V~QWHe=ys`z@r?PmU#u`Gbs8gToB7kMeYxekUE
z6XGDsRFtenj59Kj#^t}!P<b8#E;?cvS0SbsL-J5axyjvR`c9SH6R`4`Ab~hWHe?R<
z_!zQiB1vF8rqdatns<TX$`r|ZXwb_i9(azb+Xl%%rNs7U0Rg^5=QG6u5gd4P_`_^8
z&76+%Fi)O9f=`L0QzBG$QICwNq*EaGL@bpDl>`ecAA*QIJY)7GQNxW0pFq}BZ?60W
zqUd4=ip@QO;2|v}uwCa*j0B4tii`YmZnmV4P`wRuoWdxAeyvF)YR@ea5G*)TZZpa|
zK(k3XGhl`pHt{?I8%l&v)FDPRKt`C+)mR+~BOZxTMbK2|(PCLf;kqm$^ijJ>{6efy
zw&CKupDJmI_eSFrj+cII)|h5iNJ~USpPZZ&0NIE#a3W|u`62j>Mn@LG;xSAlT7!aU
z2#u7xQ|Lx;3a%tYbW=6hB%j(?DkK}IWj$WHL#ut!L`#-~i@Or`B~=!VvVWZ%hwc)`
zHFTVIrZ`Rj@fo-{tjeH?==lGDo7w+4j+xC#rh5D|CbC4U3CB}f+|DL}oJr~xw-j?B
z$rN($7Pp1)n&MW}*TpG|Tf%z9XTbJ9k(f=VIG}$J{glL?3AjX@MB{N9YTp!Y2qI6i
zQ2S;B{zXk=8oBCF+%m1np`KU~gkL3~CI6TaX3y6~gI7`G-x9L^2I}_ZG>X1wzFu9w
zUOV?*qu*O|uc`-_{#SwJhXR&o%$=f8soLge?D#B%y|-8oaK#7$$Nv`q?NZSa+kkdi
zeC!U|ZD=HUCeW^|p(-R?fp%$mRG?i2+8rWjS9)>Tz8>Iyj8EGDc+Ennt+@q&w=vbd
zEV31VCrz^mz%wfVZ!ZAeyPNyrg)^n>A~biu@eouqXI>`t?e(H`X8s<rEPz*q(!Im>
z=W)Pi%t1Fy63?S!@GiNBQh2VaR;TLmp%a)cry6F1fGAz*4g@+!4u4{hCl|RCrj0_w
zo}!%&kUuoMeHWr1;tWCEJ1U||e?Srt6VALjU{#KSvJz-m6hB%+)=VNBGgUngSwy$S
z0{J*l_4sgHelY403E*`Xjzjgy)0@|jMWw(n?-i|xjO1wMCzt?W0aE-Dm#b=ki<Zzm
zmDZPhaj7Tup%wr&Dn=~CJ1HQNIyseM3VIj6SB38a6+%@K;gCV~%Jh>C4YVl^djQ8l
z&yWm9X2jBW&&q&g?_%DgMelhdXtnYEBwZdaC5X`x=!Z6iJW!W>p+bt2<B(oB#cr6(
ze+u#Ah}LoK_);5CxQxxS$EWa$<J21f_kmu3c(Y**9msiHkCgtnc3i)39C#DJNYURz
zA`^EYmBB~M#zbgfNu`2zLXPinAc&I=yY%7OLkJE&c$ASWK;-y|GKW8<iNZfkI1Z3R
z=SXrP1IorHD{uSNFn^1H5*1|$9bW%HGk)MIQY&<hsOz5O))K6LQWFM1y<`0+Nb4$`
zdYXYKh%z8N0F#7%MLIq?d~F2JB!8+%&82RIzZYqOm-q~SuOdi`1jacnE^M36nAB#t
zf<}p+tuz__aA9`3;oU_jYU=k=D&}yY!APekiW2=o2pWAmJFX!yv%*nK2FEsPh%$$K
z;mL<;@Wkn9G5|cORk6i!<G1C#3Vnx~rvULPtT-Q8djD)7R8<ABf}u8nq3&RV5fYqQ
za<H3lqFylPk~10boE(!!*NLxzy~0t=K|ZY1Y;^J=r*@TlIQ_4JoDKzYdg)ZL@us{%
z!q~+#&l&%l_%7JIZ^?(BXGo){g9=D|F(7f-P6HN-7XT8?U4g_bK6VEZH?-qC6OdTe
zmKGAOfW)OWr^;+wWwt#)AhGn~vNe#n-axkvK4=yqdFB@Q;Ko$<vUXPZpfp=W_+YET
z2ls*x{^YvUCKtXhKBzbj%ErIw25%fFY~@VQq~g6^ps<y{2P_NVRRM+j2<N*Gs13EF
zzejf@0MG76g8l=|;EVy;4*~9jIJ2mkMjKTi8wd+~fK2+7*a}aJus${002K@ZtU}hN
z*oz{uu#YY3QQ-0nMF<igmPF7o<js{F2}!VrEX-6vP&**%JdQn4LsTkDxS$a8MjpBM
zsF;)-phoV@JRBey@ZT};jWsx_XI)qyH0)yyBJV(@kO);1fuibLfJ^x#aCtC|LdOjF
z5A-VF9y+-+Ps6A|h>Ba1kE>1T(wigU2LwA&)FM(J(P!v_g|Uhx(CDH7+dmHDB7qSi
z1SHRo<p`}OuxvyzQ6Lwb5bG4%0Y5`G5FJP&LK-vFRZmp|B|i1Wr+`X=F#6k2DHOV9
zHg|}FPX0E$J`GV#4kG#tmvkF7^oygYL$L=QR@_C`m$w(X(Wwq&{M+za6Hzad6QZ!%
zIQVWRp#O<PyQ&^*C~%Bmwi6xexZqG?@mbUquuN?jW^axHnCT2tAuzKcJ@UE`$|vZB
z-a!!deJ_qKo#4kr-<En6%$O3B=I3n0hJ>Kdw@hc5O{9K~!RU0yls;wY5j4e2>!t2&
zKwvFYlOR^9DE2ca+*7O4*_6tFobg~>kMy`cY?$3{sT|LtSYT&G@z#od5jOSZbHLH1
zYRpphFLVOn>k|*+07CM`COUSohK~76LTYXeDJN*A!R=H+=QWr!6r=rJ5S{tALjNlC
z?^{pr`Wl1KF1ZK0&bkK6;NaH^L|cdanT=Lebu{&_LjEe`uR{JR<nP-KAzU`RfXU$n
zkiXWh$X^y8yCZ)a8fKme`73K23kg@qUs@g&@>d~$hlu=@UR<_D{>oZKw!r{fg=k%C
z3k+~$s(V>QD-2MY?IH}YU15NG!2s_#C^W_1-$`JRfMX#;T%MA*Ub3>CGe?uU_j+N#
zcK(L2EP&Sv17bQ=xQ)gqsH+lMaz>DXq=a0A_(^JiCQ_giZ828?H0b<4(G-7Cf1heF
zB|;^XAyXh3(CHL5K>+C#RApg7AaDwK<dJAZ;}(CpROHZz-2y6s?jzIM_h>O|fy~K$
zv(xFHH5#qc5&O$6mXc!ejtAp@wl8CLjDNf&B&bKuIv~Ye0Su4G1ykp!*Z4E4*MFQ%
zEfN4m70cEq0W#5)vY7+{Pl*eIUjzJ+FbDYM4Dn!$1pNb`q#Ffm%J~OA=4?4m5Bks9
zqAa0mG@RLB-_;OBoHtQ&n|r!dC;*WHF<@;`!D-H%;VHG@xGcy6Tt0~d&=wJy@4>lS
zoI*awn8fhzM|7?Toeg~^!oVqn(1k*u;sF*>tL5v_14~8xpzVSeDj0{=S<X*}cRwbQ
zL$16<!!@z?Xm+QM2KnLxz%#u2G43HsGNI+U2)iR+WPojX@|V%k|2rBzeK$I)HEQu)
z=!6!7LqTC}iBk8{bv(l`v`;>Z{~l5YqFdR?Qu$AFdJ2^l0fL9@hl@d2;`20>)KSmU
zlhYb-GCV&~SsXnoBy=Xu+jv@w2%pDv6HOOyjoSa(`0W%jVI=yW=zfyJJWkg4e<A%L
zI!7k~@jYylhk%U9mxcbp?b90i%ki&jAdJzd{@Zr|@*SThp*_{F2lSuk@r-<}XkGlG
zR19QNd9{HmsdmSIIX?Xr;zpx~LTMB|()g_k4m|oRz+5D_pWy5`Ng2@b814r|Oun(|
zj~QFdHwh13#=bxoY9}lUs)?C(Uk2X`_mjP1hMi6o^*nu3kfm$WY}>YNW7@WD+qN-n
z+qP}nHm7ad`g?yT;#{rkcSU7pJy}ZqRx|KJeJ-u<ePNze(t9`pzCg=dZ4~{YC1PZ|
z)>HsF!Sig*o?1zj+=7gR*^w6^?7=~6xBdd`9EH}8ztX86`{nIXBDN+t9%M9)6+v{Q
zn!2%H-i{EgDnNioh@|=Td@^R7ft5~J%Zxh__^j>zO4|ND&@U{4B_$h`f+St3lpX2I
zNQ801q^_0r|2@bJx~T#Bct6-1lbbn`C0{=c#Ako<82t9?pvHjo2?VWk*|2Z`uz&vX
zE|uN{9K>^65}xnl{wLpysJsAG(jkja5CunI#xP2k9K9kS9E$imky@?fK@FuuM*^ZJ
zP^A3_+78tkomXGrULH5Y6qxdNyU6x5$xx{QYFF6+*zfA1uz!wo@XRG~l2ix>NHQFS
z34xTj0@H$FRg3+O`hRJYZ<MN0PMJtyyEQLCOFv1fKvqu(UE|^Da&lv16lW30gK^Kh
zlCY4t<#t1;?G1>UjZJlGGmh_p;}bwmBpS@Zu~~{Z0SOl093>}iodCm%bLIY(!AkJg
zm-eqaR~}|>(3&!%Z#tsUut{wL<~S!z3D+|P1!td<fz)jH;V~lkR^@Z5l==eE(M|g4
zKuJB4130>fw3Ezr!a$Ih2sNw|m6E+HRmkofy%4{um7EnA{3&3x#DKRksF-QC;C!$J
zB4II9_|&DHAI5@ma;Gb%5)m2zSw>92uM_FQ>Oe%_^#P`|M6VkH4e~}Zn~p0v6&=jL
zTJR%+V9R=|ct7Sak?(sTVeyhR$d4E^mE<Hm4cey9DDeVhH!HHR<R<u3c`^}9|JCrV
zxTup87%6qOY7cJ3QxJ*kLNaYFii<PR&t6Y+RM8jk|36Z7ii2y#!{wW9UCuXmN76Yz
z^#V+^`>|_@cHE>b<vjo0;SLX3FQbDP(d)_nr=9vZb3Qf&{nieN$)|;;EZVg(!r~uS
z12SzBb{^LqacD?r_m*`Dc8vaG|3epX*+TP!evicHK76Vfmf-FuLny;H*_u6$(hl-0
zXC9xCT}yb%8GNQ0j<|lepuZj*pe}3M-|{n1gx#4M2>buIy$>7fFb5Kl&I$z<QVrtw
zk*!47hYIBF4`F{cY+?n{mbK@Oz0|4{HtX8L@AF@83rmxrPw_gfpid|2c_;ePOA55~
z6?{d-7B)Q3)v@$=QAM|IRcmJNJ3aL7vSD|YAKEGF6u<|tOBg?!BEqZ)x)PiRvNLM;
z@ciC;<kd7k7*I>&h1jKVI!nH%5he`_$Io+8$vrWq5@Fz*WX?olq6q+<Wkt-M5RsTz
zDOKm8g!93TaZZreHxuXk-p%UI@2ZhpI(lC2f4bV=_74Xv1U7@Y+dDswcM4y))HI*!
zXqehs;;_DdO+=$&=ECj(Y@WA=wUBSLeT?pXR{b+hdt-ZMun#i+6&5OUpH~JHQe~aF
z97vzB9A$#UFI}P>Vlf5XV2YkQPeX}H!fS#Ot1v9EGAN!$9<JXN$?SzH-{?R2kdY8Q
z<v_)_bFdq}Nkf$8qx%zgbPgc?_u>(=b~p7VV=uUD=ONMVN0g$L0~J%Y9|9ae{LfR_
z3*+9LWCajzMW8yh1?2zF*{d`K<ri;M1L1$90x+Zp7y>;|y1Yw&O`q+ed>aRiyNz%M
z!Rm4lE=c`<@`)I(`wjM=d`64&cdbgt@fVu~l`(~FDKcuwvda|!X;lzy&6Vbc`!{%;
zvHlB~N|)cJ-c>@8zw?O6)6W*bMB13vCE(}PhL0WnZ9~H<i!hdFl^M>VNHb#Z2W&q`
z5@6&7{~8J#xOG9F6}>b(o@3CIVQG7Oosw9g7K#*NhbnN?Cn{x46SMD|DXE|6M~U*o
zthOz+eJH<C2y>}4a&O+dtFK2G^Xp&BeNb&R;=b#1$|)0?=#`xQ=<xq$+FxE~%tkU8
z`ub+WUSmeO#Dsos0NzjG72>T=Pcwl3f++!031Z-}UD1worSEqEyc;7nRScCVBjgji
zoqx%r!p%9&qiOyYlt;sO-5U@yoVB6%Aho{F0TYBH#S@d+R%lr;hfrD_w?UoJblCG~
zO}gW+>Y=qx@B+@!`Ns_#xK3nB@BK5PVVK0^VaWOp{D8s$=dp0<OqfV=C=%>^27%`v
zo?3YI4jM<OQpgvly!`gCe;#{|bRb7Qm+r}Pi6Gq}$B=e%n**QaCp%@^oLPKaJi)<P
zWF)!{&Wpy7Wlsw9IIz}EO%o0k-4NzY6qKKsSOzUx5LtS92_xbL5TS`6X-pfuy~U0N
zCaoPaq3yerZfKXa^nf3p=D{?88jC$zo~i8p4N&e<YwAx2$i*hzocT*5)>tBEXRE6X
z_!YEHF!@fFdmRolYMu~5gNW(+`9*N2s{!QW!O=W8Su`O>e>gNP!9pCE#bMLXVbzb%
zxzq%aSzjQP%YzmoEg6<i1?`q3-S<8eXpRI$6~Gf$7y7NWVy}h`O*#~YmE{%|iR2Im
z>_xjV>7!p3cw}4%hnyEN9A$gF>c4}k3sEZX-07HneTU>E4fXALI&Xcl*$^!Y<LU1&
z_xGuMDPmKPz$|RI^bE;mc|4od%d9Lo$WUri^c_eWn4wIRJIc)H&DA6uQ3QXuN~K4Q
zJ%^G5q%92V{llir4To-IPL@?XjAsWgJIX?o6SRJ}2Ix8OKjMHNgq~S~{c8ifWSNhY
z9Mey~dx*O1$UdW-DjQzfo602S*b6u<-xsdj3A*4cIZ!`g6iO0^>y)2J<T;yJ2xvP&
z^3ufOT%>c6bKbc45zZd5z#OO9`6o^V=@%)YMgY;03?sVDKL$-T?mg+ihfMGj`vMB-
znpn#Lwi9`vDP%HJo!_kC%A8}>qd&4m)%R!x@N+h8DHBFX(`V_mLc0^Mt$vw~17i7M
z=6g5YOiWD`rDxJg6uH}c;_TG+zqv0LJM$N=ohq+EP}fJzPQVFl-di9I(O$;7@AbPk
zbFs}Lxp`tc``0D#FES37L_Mrok~(wjaNVZGeY4r1!$oQ$#wW)riwa++C<OI|eYw)8
z)|xJ-vw?f_l={$-Qmo5iviUV>igVvS{Bj{6g<Pa?19DH3X5m!W75xeyK)3MinrozA
ze!8Zs&lmVe|3^9z0QK8!p+ofBY@t)&n945f7XDx9;Tmak7iF_e@ewK;&r_>S@jr&5
zwmgy~oc4{U7U^{?UW=q2{%?5^$>P_S;L)M1wjbd$_Dj*}iS&HYdAF`ygzxwEfAn-N
zaTf%-Pbhdg9naUuO+_XwpcV(DMkPfY5kw-NCw;~8=)n6C1@zm<EU12p*#X~A8pP9&
z2o|RS?2LyW2oKy;3M6ByGzD{7+mTsh&(%miR+tOfvEL)t#l@W)KrQ@_#G4vb{1vbt
zF2j&D(03KVjnu#&oRKJb&ACC(ezOm+DO>2+z;N^}=myx*uca-jqr__n7%-D%ArhEB
zd7ipJEkGWPCjd=bR@@&46&`FGOI~~VC}%Xc4__owBh?1<tY0x{MiGaUK@~SAAVtWY
zFbx!ffCp-p5Tf!ulJJcXumwcfQsr6C7%`SFSR$Qg!vE_hx7%&c7KaU~<p*kiy0d{f
z!R4v?<muAg`Xwsyxyh)VnFDkB1UNn}h*5+A#6rWP@$G7d5`aV?yr3+Swmh1*6H^1o
zff9}Xwp<WZ2{#bVKXk&F|7aY$?9KNU9+yqCOtf%5=mK0#sR7EZWuuJ6a#^!cldGb{
z&W5zSlZb1UT73#-AB=&Vn)N6Re5m%gS@fUeSS4}hV#Sh(F78C)7%D@7I$YWWMU6St
zHy=^VZMXUNApMdJYX!sFU}U5W?4&7LuC?t{IW@7#L&dac&0yVhB_28b5Y;{&ajqrN
zO!=RmK)f(6>SQ;Q)-+30pCSZu%^A@08e4o=A@aN&;%4<V{bW`6dX~Hz=lX#%-O4iW
zc4C8wo3=%P#N^u0+f75?B}KQWIuk^Cg8abv;Six)e1MzEEQZO{hBb0=bsD8HGMB#i
zV@uR6IcKFMsQp5mc=QC!MKx8@0<y@l@%;jd5`3Z>Tu@csAgssRja7Pmb`<5Lr{{-v
ztr+@Lvb{;b`kZ~`DUbvnF+qg4w0t>O5H*71!a+JXsEH$Z$3LNXwUzPw<h?>JL!VJ)
zGmAv1HWCJ8V(oko{k(&Xf_ksQYQQ0VwNonF_*J2FzVB8GTB)EP4;el~bZvSr4*IY~
zeu=lH4{3|*)NcP~a<X3T$=}i^`O1KKyvgqAbDc4v3y25i^B;!z>7GNWnmTB4!H{^^
zDTw3EQWN!izZOM!Wa}$^YQdXge6QNZXB`eN&ZHiig_2hXIZFp>-TsBH?U7C{=jjGY
z_bAy2<1Re%qV>C#nZz7oPkz$jjqlv0&Eygo0=e3*H@eem-*|i`Zp>g+rHYeh(8SkT
zMzI)VuOhB+2+>CqI$nj0No)fb83BikEvmrAYaFO=A+!^~dy)znE0C2^v4)I=gN|lx
zvYxcG&LL>HJ7{bmv_l|jjsSRYt}45C1OYnkX|6UTU;!J?v1gk3b2EdDHDeHL4u!HI
z9ube<>@QY0j%+vYw4>fzk8m$P-CQ&a=1luCNJH&bHV9T|AZ9=9QKX|IR`ePX@3(>v
zIV9~(Li@nWio1*hNFxJcFcsU#WaXxaDS7GhI(>vyg4r+eTO%#aL{e`CgVQ>gQ}RC0
zW`Y0{t-XoDcmPiwDcBKgIW*$WMIQnll%q{91QcwvSrJ>Aa|x4BquLnl;iAAm$kqHc
zO@D=sv3vN7VT>6K0R?;xP@bZFfPBI1(j=Vc&2xwOh**Ts3QjBWLG(AU4Y-bX0bs!t
z&-LGI4Z*{0H9J`_p%4|0<ng`L#C#kGFc`R=3GIGWhM<>rRK_a>0UTyRAAYKcA3-UV
zGG(+egZ5;8-4F#dB~Dxl5vUTQIz{>)4mo&weZdX;L5Ms{gH@Cg1wtkR=bR*-G*NA|
zr1)WNxS3((<8XD#p^bBXt50AIfqJXPJz{rj$ih))yF)`5a5ij{C7MEHf=d(S+QJ{v
zCsW1X^EsoXd?ft3xq2x@&wX({-J@wo=n;Em3T?;u_9fj(fj4XhP07qAf`+rj1M}-%
zOH>`i$-f-MDx`M)IP5f;`+f9+q}Af(RXv?UbrB|C_roq}Pbfc>;Jlp?9=(<4oVL!k
z->HDG5E$#>KILR9f`#Bt<VS#06$*+f#{ZO@CQWTA`6o#63=SC_`k8~cmA4+eSsw%1
zT5|{U97R0YofB@<F_im&MhE(!6KhSbk0N*!I%EPQxo*o*|1ohP4gz26_PVPN1=|`=
z5~{W(5lG_SA*a)+aK5@K!Yx`oBu<LbNqaPlPl8hLO4fWThJ8r;91rLUSFxhe6obt7
zO!jr0$j(-o{HRo(iXnw%%_&M0caH4kv+HMazR)^-D!%ZU^9c!qGhgs=b1REA4r_u@
zlgnC!B`gSMo~0cbR$a+w0p47qVl40N5sJeVQG$c@@N28iL1(W62Yo@7&|w7qu=f@#
z8#$U!0MTb=FGn=7$Ch2d&oled{3+5a^YV)nU2-^lKX*XdxHo{Ju2a`oazdCIS8OhG
zf27<YMUO{kPZR>4>m@|h0<5p}KZ)i6c`_P<FGiafwZi;6h<vj9MSY{6%lIMx0NS><
zLFLp#Z>!?{=;tWH!=9!|Uuc$lS<#_0=VAl8<##LOs7vn`Wb)bNns=>dxcd!x(T(84
zj=!J!rF;Tsy49`Eue}6YO`Zl_6a8+9&p1Tyi~*;lgJ^}iQQQAeNyk;7wuW1J?Y!sL
zKx{c$q?TX2GlM}Q9jkfwo~$O$?>!{QakCh?1W<|miY!+vw1@5hXqb=Vfq*4qy%|Ji
zxR=G!y&tVle<2TajSQn&H%?nrhBBZT1>qPz1y9oAI^Su8R4A@;iaf-_?b!c97eT?G
zpvAwxBJv5S?uje510sekb}I@6yi8Lyg26IF#fn!*cT94BM_@m?x2$X(<={W88?)}7
z6|=V+*-8$vFRx!3*TZZxCIA53;6rv9;pkL8ZJnRO6cJGCn$_<QadiPwzICVgQ{>98
zvrcVK>7k*pja|&)LW)kJ1t1&7H9sXi3hVrhuZ(p^c!>%Y1-^@@JmJ~o4<>#Pp?*M4
z_qPg7GFcy6;?sC!1UijZZ}!3IpPU=OHFV2x(L6L1F(Xa3J#lc1KR((qiepKn^@Zly
zzxE^c`41^iYSQBX&+&{LwY%M=tA#=CIP|%EfYTA*v)IsiSXy#YI%_RstI-)T3~)Yn
zcK<!yN$6xpFnc=Vch<`7J!4N&X!WIZzP>^O&p{3&WJaO!BqKD}QAe2^_t*GGR^^sB
zU-Ls@(0+R6gW{yp&U=8_*q&KIdY9fMCgN867*wb}(j4lgYPh?|up{Daq2e+Ezu$Sa
z`j4c9^ka=;pq`}s3}^aa?Bz=i$VK35l;iM0qXyTD+Qs>8iK{8&)IZTO0cl}QtCX?T
zYq6EDThh~H`Oon^fp7yeZPdMrP&KWkcYtBB%wA;W(Hf+hsyxy@_NO5veD~8RuK4i`
z1?^y+gfg}QkFI*4jZJNT&)P9%q~`t{4_3Yn#Q->20jB@9y^N{qT#kLqEWLU`@BrFf
zlh=zSPQrLEhCYp&8Tj40aCXt=>5*AZujbT<dg0GNY8T!lN5Shz{(*lI-FlrX{=vlO
zOk6azz?Zoq{Hl=6xD#@{>zR(sY>aW|ttDt$g+4LTX4xS!ohnkmnd-;3U*^_YR$;cn
zsqD0*Gymg9sy1B^16^TwP{C1ujG-oTP|+S-lM#%bTCBr@-m*%6Q0u|E+IVjb={Fs0
zr8DVh`N<M!Y7^6I+GzU8vYO~6HZw66`tIXpCR?7}@vBC9)ovviKF^K%k^p+iZe$=I
zGS<sN46hY&qzf1@DL{3aUJUAZVM&Y#KD-TtVeUi-1;GMX;QNX24!oGC6UO4exj0O{
zdbsoCnm%E&b*lL1PsfaHko&wp{@+r^E%HwHbqC)n!pd*8@8BeSq~U@^Y9>qLaf5o<
zJgFf2FEhHv0RRt{Bdbi4v6B?|(5Y|?t<WcfHBEA&@k({n#FhL^NSApN2BY1)m-v#a
zB#2T#@Pxdg#yV=aAej=Ul990Qb|@XJje==4;m~Pyr9#4xR{ZQ6<nmUiLJW9#{tO!M
z-%apPZy;3R!(sxeu0M&|>gnFi2zYM1l^{zW{zH1<vzG{$F|1eNWlZ`vIM5bQPKfMn
z0xV2tNGT5NRN_(UAXCVU0)qCE2!N<zAKqd6>6)TH<;0gAGzi4h(6q>|0=FpoM{5#9
ztXNRUM5;3;a~RS;OvdnlVzFa8LY_~;e1$%BnI2J28!jWaR&qh^2s)eqN)=)3Me8lQ
z-xlA}_4&GOL6FIb4!nJ=2MKvKVqa~8ys05fdtOwW1VPL?eBv6U!F3GeaR{MpSx{;y
z@E?M%dG_|CsDG7$goi-soTz<r5xlCV`V=RXfiO8PIQD^$!EXhkb8wOnU&26TXY_=l
z@rBtq4evN#ByzjLYTr1L73A~qL1cd3K}~*p*B8&_${NW-w%4UxN*lp{z<X8es|#Yi
zlh~%rh--{#YnuA{RoT;Bib=w7sZr}0#)2dVJDr7<&?zq%6IF%N3^0+IdZZ`*BAxBA
zBrAzrbad6P&elnmd*!k(LC~|LLB|u3psB*W_@1YTO-5SJI}X{4?()z^ec}|D{pFvS
zfZ!5!r5KcwlCd8&Ku_ul^^Q-0fT>p`&okJ&Foy1ZThrmkCV=tQbK{;zRbNYW+EV`A
zNEYm~&#^}2C`<AH$a^#_$l>3?)Pr{4ewJTB3tLVknARa>NEus-s^aPcR3o^cBcTfv
z>ypa>cbANxI*7^M5F3Azi06ZtgG?IJhekIwy(Z#f3|mKkQv@+;()jwFT)d%Tql&hb
z@Dn+yKd`C;oZR8<%Et)J)q20@(UXhXE%wk^wIN-FJ%5$1hO_Bv29M&+*T{251kPsa
z+etvX?7B}@a323=qWp+6y#XuL!AigHt#YP&I8^pG5M`eH2^pk+JR&6#Uy7XCe`eL<
zbtj7DCuQvqjww1c&unT>gjzlfc&?s};<x8Foe1WMNs$Lx6&0WF)AQ$&t~I&LliT>k
zpr+8)QsyYxlFWNdx;)$2DSy4lYqijpH7Bm*CxA}hVV3qohO7ORLbv<QW2D|mN<~PN
zinmd^a)~~Pep_p61e;PzF=^F)`hog7RS!j#H*Tf7fqoSgtLj}i%c%Nrw2Jpf)&B4=
zuT<}Q40%EVzfR$ex=6cb^+;A*X>ddXa+|N5VD?>%0Q8^%x8*sa+i$#yvDdqB^x5X#
zy4ix)&ZcE`EckT0-o9Th`zZqGS=FG(*3rW>>d!SFW`z|13KYh`An<$SF@=ZyULL`H
z0S|rR83`N$fjcA53Ewf9;wiF?E%!z?TLv^Xb^A!hdl=@=iYO~$BGK>K13p(#o(#6`
zGbAErOpH&P5T8D39tuz>@qJpe-O(1nK=8WUCv1N93r3F5?shHK<)~Pa6RG<?j1;xm
zk9^lKyJ@B98yj98=IfIOcq%`Y%v<3JarVYLijE=loG{>PG;bOVn}ph^N&dXteluPx
zvBzS^L`SKkgfFuKRk}(kt)#bl8am+@8CiXvR{0!G?aZA#6?>Nk8K)?8JsmXuY&jUH
z7lm%%FB?PF=fxonp~i<zr;XBz-xl%3QuO9aRG{JcVo)=^MVRgYMnCJ3iz5Tn%+z{U
zbs<j%7(@iM&NOexVrVUkX|b#M<DjHfD-1h5(=}TDk)W))vO!mB^~yS4hd8M^A)g}?
zQ^K+~5O$&DBC9#{C+w=RybQPs8i>%<unL_T2YR^yakxOC9^4evp3-6;1=mmC@IFFA
zOH$Ex?T%7sUX0zDIvZ=~QOa^hZisR=K~8QZ5Lh8tSFsHQVN3~x?BmA3(Up_+^M~!;
z?|JwK@7MHyJN4TuYyhd~Ony|~UU+TlsvG8uICxY7KY>32U7D$}sJA4uu@+1kPctiD
z2bI<{A1@vJy5aKb{r1bAIc>G$^g8NN2Vc0poFhaHjWpu}7H&VCDGDx<p=d{7#ZE3%
zm6|CcaSRdi1cdHC0VHg~m$?m$nbdw1d%d%_EIK)jCE6Y_U}6k13Yp#g8$&j8eNi%0
z6ndm=Hkr7;M4q933Ur+6GE65YyZcyHc7eo)GJ+HIe4x_1R<}>8+8O(v08FMbO;3Dw
zCXf!!Yd_|^GeI>wo5M?W>lGhNp5jyecz93GJZUUCGj^8PV=AN8{+ccHV4LlFQevz9
z8I`as`%l;=ecpN{JlDUB&Jh;bV9Gi@L)#q!s<JHNg){?w#>+B-gbtJ{C=d!AWKjtf
z@f`Ug;+1J0jU(0wH{Fw|lG8ifl}EBKQ0P#O2@l}n4&XKX8GPjXXXDw=N9mIV|HzN_
z$A4qJ{0?4xhw%Vk{}VWcX9WL-)b%>;le6Qg&ffg*W5@)~el47Y|K7M-5D8RNniP^z
zNxOwxu!Jd0lQZx&6y<kMRHxtyyQ-U-dK_hMLZ_fYO)VAcHI#)1h8yTXO<nXg)PE_%
z7Ah2`TFRYP+3XWT8U0>so&7Ji1*3Na=d7n5w9GMjgPUJz{~7UdB0Kb}L`Az@H_xRp
zvbZFFcy^;<HR1y$0=;T>qfumO7!%=eVsQIhB7=KlhGA#-li8P`{HB=ZoBjFF#D9f~
z92B#K#NYOY;tL8JH;EQ(QIdM3<WJWJ_+j(+4jz&<OJW9Nyb!^FkNx=lO!KAYX?;8m
z;jY_S5l8`W2$9gk`SnF_L)kAmtMr0n)RZSt*C(NlQMDC(s?hF2{XvO1St!KHRKuHJ
zg}e<fDIfc|17{SvO)kz9g$ELq6Hp)o`*N!(U^;I@PcLCPvX02g?LzPzJ~r4E5Jhl+
zNP2XcGL(m|kv*6XYbDN8@Fns@VYUH<*zv{c$Ecd|F)PU7Ud2*!l9nNTLhW;}$bna8
z3S>2;Z-%@~y>ZkV-7B<43w3AUJ>b_>o{j#Zu|$R+0uJ@y$dATcf4939{W*AfmP2=O
zj@ji)?-k;9b#P>TK&VJ?=%^`ID4$R=X`HaYl}VO)kMlca@ky==kkbJWGbFcE(`}Q?
zEzO+s&Fxaf`8O+vLg1pfIQkgAKlZtbE2qrk;i!fi8oD2Q`crVw6pm?Kqi-xr$?N2F
zp4Gw2*nLxI9`h*;q~1~L&FSiyfRUYD+GtW_+tri=ZI>`)Tyr13C6e3o8Y5}Us5Ql0
z;=HY$l{2f+NPppbZ0=gLmM5gQJYkpQ*`pX3#mvHae}PO{`~+U|Ep#qX{$n2+2&hdO
zaNLK_#fEJg(k92tXq`!USMyA^%N=ZEsOR&Zr1<f=nKU!HbL~Gsj!kovFL(*P8Nz^l
z9?W07B#~p{Ae;RfK;M(7@Emz#9xPzWtqJou@D3E86xwT>o-J;>LVCNoWWuMjq=cKH
zo&6|auJ!sD#{B%6xJo%3%=PDH;Z<~mMce0nsJP@bb)+MauKdxeL*0_Sj$@l>%X1db
z`KeNn(D}Uj(vd7^#x-az{X`<w^CnY^b6t9tma~4*oxaDD`;r&MVU^301>UOpSW^ce
zR&)Atv%r^nE#+}A3q9YYbE`Fh<yHl^xPW{Rh$oVMz2%UB%zKV#FOaMiRSQFe!l}_1
z2-2rI$0N~Ip$@{fkGZzK!c6xUbT3m{bGGl2IUXW5tG|hQdTL7O-4t_<$L49e+JA-<
zb8TF@ALeY=h&F!52vUv*^lC>6>5}^~==3r7Y*)$MlvbqKHtJDc(Y&gx%xJHIx7@qE
zy6@-A)?)_qaruAa$eFrM&&US9qFR}m1Mxy61Wjt|K{Pdqq5aaAIHRTn+I3~kk&B?#
z3i<>ACzyLHL_$@3JEzocYKR3!er3aeCBD;fO2OM?F(?%wg5WViup-zWe3%uoEi!?~
zW6I%Kf+3>x;es?f^@uU&gbu^tHx$$O<5S*vlIUwzt1L=ty;;l@Q0x0XS-L4(`t^1&
zNRR%qnmvQ-R3-v><D94c)UHgY0{rUk_jPcvOrLvGJM?1jQNBTq%MVaE^$%Ui$A0vK
zv>9w0`4Yrg+%{bb7|a#2>>8RJ-mTS-@L&nwjg7Cem;Tc1QgaBcrDTpe8S#&9Lj0Xy
zTgP`WSYYn@;8yi1T|I^|?i)1b4$_Q6Zqx9;P`q9{uIO<WeMemD30@+81oBnKaGhG(
zgEoUp)U!;}OVknF`YIk8sJW9PoN2Z@m=e(E3P=`ZY_d|YPi7951{X_5O*D_@WR5~%
zn*P@-R^NjI6}b_Hhh9ykH4-oX)@#_bfsD$GfrgR#4oYhQ);r0Px&m);6>DjOUshF0
zV+^(_q^!E#Z)l>l#uRUjGO6NN4O!M6U~2h~R28C4Xv|xVHAXZ?m|E~AG2m`d9Uwlx
z*1KVG&p8e!N`Kcb{FUBLUBX8Ac|Ym~Z!n)utL?z^?M7=@xdb0B0@(f=3<FN&-!j%?
zF!)aa@jX2<Bp<mCMzAGKkRpg9h=wtIx30V)7O=u6B$V)o0>g`;Jd3d*U8;}w*eJDe
z528yPh;082nT@}vp@JXEWgh3c-$Gzt^IP4yEp1tP`l&62BReGOj#_K3LIp8P(3CFR
zgwO<BCOjq#1Poax9T|lv`+%psy^);Q#>z%Ttn6gBr%6CEv2fenmd=R*(dD^<Si$BT
zA+t=c2sd<zn8}=9G~l&?s=UB{=%k`SmSkm7ta71!V6seV>nj|1^l7hu$-W*Gb?}zV
zj?RU!Zo>Z!5QteHo-7_uQ3rp~?Q|=*iV2O&sD3kP_}cW;fLgt>xW>iPn8xKS(}c!F
z%dmWM?qR$Z##RrrRjy~O56u_2t-G1Zb{1>&yv?T{JzH(yN<@!UWf-ir^vJ-zv;S%{
zY!jNEZt~z6b>})&;HJ7guB#cuQ?G5MxvB=N8+^LZ<MeAR@8zkeedMRlCsq4>$QL6{
z_jU&IV?N5FymE6@YAx2351S11Rt3?O1@bT)G1enL&}WEyU-htC5YQ;5s0A<*gZ-Z2
zg!p(9=g$9)X@gl6Q=XRfksxN9umcjL<4Um3LIK#tr6nd10C)i&V;}G@wGR;yhrXD}
z?hzWA)AYj`vkOE~w`hh00Fahcq<`3-FTpAX&({hA)X9WuVS7xr*dfnbEO0e>R&M$?
zVPSW=>4V*UcB$|KGexRYFu9pJWjY6LnqnYB)5Hr%%WO<jdh(uJRm*d!>cr!q@pngy
zZKTW)p+p%c<orHYMj*8Ye;tU2MNcJDwAfw~L&GB+76!)p6}g&8?3i{mK5TS$;{@$S
zpZ>ZM{0lOqmDTfazPAl<dT#7GF`R14*s<UL`Z)|#4_a>=PvLP{TgCbk@fQhRLG@zR
zg**knNbruC05Uhi%p9E8zUZ4rVh#Pzk$|$ah7)*j&zas^Tf<o~a?<}A6Q%g~;YT<t
zfFXa9y@?lNCM~CP)uX#Pcz1cy_Z#}@ZoNkcFgpaH`gnPsupCvfVc4%p_Gk5U*$=oY
zu{0ONEX8p1q}s507A7>8f;Ey+>{rlIe{JLBOMxa3{wRLnDN=Qu`9e}d1oL?t44%dy
zhq{`V#_bVa<6rcTg-@0TLu9drs%yU$YF(uJ#|;u3bRdt9_CU`Ca)bh!a$f&9ezk_u
z!?WdbdJR-CH~u>!PluwpyZIS<7ZgRt`vz3{Tfn6K)xU~QNBB&>LVteKTQ>SLFE8bl
za((Dlrt5XX8dtC`e@rg)_P<2W;1VA@woZks9P>i#Joj#s&G&b+ll06XHI(%XTi<xB
z+R@=}(IPvM{uSy$GOO#<s;FYk{=SJDhMX<S8=J#pZ`i~_wx@>e&P4tFPW#-a3q<OF
zQQQzx3_hLcLGv|K_t;$bsO7H&b@my|2{**=*Y^p@+v}9$%VZRBUh(pD|CqQw8z}+U
z#hfz(d|YhLNj}H8XNYf-9Vf?jTL#bI=UEU#Oq9`A7z1`72uZd8=qz05Py!{#>t7Vg
z2fd4+{m+%qavLt~c1vpaQF%wDceQ_vPjNK|ZLbPV<Tg{p@VJOB3&sw)Y`99?Khu1V
zI;snucpEm`z4XH*taY54kwL*yS{E`A+-rpI;DPUJR=9E<@|@?52vF-3R{kbYrQGdT
zMN7A#d(69#p6K2ie#<sXT(s~)-LOyFqUSol8k*rr|3cOcbHJM}RVbID|L;EuWm#sp
z&hy}mb;!jU=|&sz8RgHXbfwck=Mvz$JwtAfz1s-BSNAz-`*0qyUT(g<7~U#v#7Frr
zg>_&fUuy*u2DFQ#72^eLkEmneKE$ivh2PrTY>v-T5tpUj`q6^+64E&g5!!ELI6|@A
z%MZ2KIU<^oL5dJ<#)Gj3ux(yKa^}exS-(E!ZUWnN;=OvuGkO^M)Q&OScB_9v@hlU=
z9hhX&kAe6rL>9s_1lObnQ8Ri0D~Xm)qS-^Xpp0zgB6^YnBa3fVvqxnhGm6@HJaWZ|
zY4=qS)&|!c#|8h#9-`pd*Gx{|!y!XIsJ$y=Et_Yo5+)lkqUM?;sQN~Tk7)t!v=spB
z{1R|mP0#61fT+oQ(Y5f<`bH?#sTmqVxxfN{0?B0x=`I4WYa5c#?xJt*PzJd%hGVQI
zit-8>T4Q+hQUL+ydd{2Eze!A=z)G&{1(7~>k85Yict=Re4UmE?VIfq|8yvJK=%f#W
zOQy&p6y+o1*1o{6@F_|k8`#~vkUB2{%;pGB5F(Xub`{_eV3m7%I_&TV+%-=@A_6`d
zjq$vE#}!bPDC%DOqgfEz6-t@=yWp$W0XocGvk7m9;t8&Jm-3AgV(`!!7673cpVN()
zMQd>`q(kB`InXc(;A0%;oEX61Z`eedyc$%J;E8+Uw4g)lzZt$}OUXNWV!Vt~B7V-|
z^z6#R^KTsQh4ApLr<qN()F##on#j>Z(NN1D@gQSpCiBy%v74!>euh5B73!J}_yrlw
zvO{_jHX(1oPHnnEzy7^mnN=g=e*R74T=Vc{2;ON#&hH_nsqb2{Sv&b|Mg(ZPjwv_I
z^au*zMP0BHB<Kt=nvFuV1iT?83U!n&DM;bgQPP0Sx(P@Fe)l9M$zuKJpQP1FzKuV$
z@2{deiG<K&(>jlo7Fue=8WKse=-Gv@7;y03eNo6d{%;#+eK@O}PPf-ebD4vTaF>vl
z>E=v*0uY_O-H~R}xNCgIwzRuVh)>~PXrV^?JfoMd9A4$cjHUmUkXjNAMrsQABiD(y
zIs;Ro@upIS4+XOCwM=%(aI>e)VPs#kjz3j1-?T2KvS1{Cn8^cMj*RC@4hlpvgFyvj
zWvrQXS=cumb-bQzN#7gncXU-|m9aO=Ezw)9gvKWKi6ULQYe}jxQ8Q_{?Dkt3B!d11
z+xFS*Iji&rS2<K&x7HCb`jYkr7cA+jSbw6CrDPJ8%p@gidP95rXa;ClJ>tRh#J&l%
ztXTaXHrk_4zhTrX_~zhIO7`Q6BJUh#I?xyd)1^Ih5MrL-Sn`of&ojmjJ!54O<)cqc
z|1M2=z4T-50w$93(rO2}G)YP~=#JQeSh`8<0XaWEB~139{A}y?h5qkl`-P^;rbu%z
zXwSL2x$6vxAM&5{yjyx>1RSq(<A*RG4A!CHhxG23(m~fyq`oyK&jOKtW_!_QO{e8{
zZ2NTULYp<>BPRm6qw7L1fz~5vJ@h9Y^TZSLWN_aZT_cQJBpa`V(<Irq$*DIH=*iuC
zFKuCzO#)wP8ZWpJT8OU8cwA=eCIDDRn*70H;4ZpvoZQ=(Q}T-k0O<Jy{y5iSi0${{
z{ZttP6^N$RrH|8QXmGZvesecH?h#n}n)S69>+rsW+6hu@7uMwtePdehl<py>UY9d@
zQV^tuB$QsxP2T`l{x8k0KS=6RCkyHO439|6l&`WaqRLXq^(96>t45%u!8t+C<xQR-
z9W$RD*zMAtJnJeU7xB__V9ea|Dz*xy9&D_P_|t5!Bk(t2sJY!eCHXuWc})v{rFe$q
z_)dLu*@c_qI$iBafP>?VL&@(+P-Ewawa#2yIH-w|g{R_XM&Y45R4gm`eY_}aLznt?
zHG!xi?uaF)h1pjQrtjj<%!*cHbXBwGjGdSn*&n0xT*f}zNI+I2->Jd4qv4%JUawn#
zlBwaDPMB%-HzL^DIBbUJtZK{4@!!m1BnMQlNpE~j3B|Q6BD$WO7T)NRaU{p)&ohdy
zb_(k=%7DP+n$yg&rtVBi-3g8Mg=UJp(JZ89Gskn5>hzk^is7sUeBHEY>J+wEdDM0*
zp_$~vQZi-mhb1hB;p2L&KP8~IPY4eFl2*>$J^+sni5Yl@F<ub`(4<r<1ab^FSlOtY
zx8u4vhI1M=F2>Oqv2W~~5T-aI$LpxK@0tV4fx=Q*842rZm?qdOrY5N^P8?zZM~Pg{
z#QTPH8e5(KAtvVeYYG_e-^JuL&v$=L+do@}knMwnpWb7izASs3Dti!mv?#rdXb5p8
z?fzA^n+_1}WCGk1L*yjK%ACsho$lh*UwXatJWerJgf2%8N*;NMkuwe;$4JUwX5td^
z0YVWwsiHzu@Ff#OXwG`N%2b6nQiU~T)D@!xfFXm$sNE6x67p{*;zwP7na!t1jJV3L
zc20>OYU^3b%8-6;Vq-%E1&x1pH-Bi8^Wiet%O(_>Lo0rSS3+e^<U;*E&Ln-#4XM8$
zi+H0u(BKN}ay|DK;rG4IbK!nSzRyd(-xmqV72XhCmdP{uL>$H8lVUyiL;S77IbpOs
zh=!Dyv;4}+C)-&3^@+5@>OB8*h4an_XZO?8yA)kG?~U<poHq*gy#|1f6J<+%cGiVd
zJSfttnq|vPPPy2e<qtZ4YAPpu7R1(C6wGc)d%ZiZoHug$ct0H-{I<^iF@|a;-Bz*A
z&B7;6U*?}Pp93fdyV9j^7W%w0@n?5`T;Su^`o4Mlk%EPCdbzyLd2P{+8PqO(Mv2l3
z;j4#syx0+jvN#(fT2N&Bu_T|GSngdkQH^%%M_P5?+3h?(rulKbx|TP&#;)NOezn7A
z0bd#04U<oSyRsYnnU0vN#KvkiA|G+Iq$v%=<>LEjR+rV=W3S-ge8(C+A<9hvjR_b|
zwcf1fb#ivTV~*47!r`jrV6l{qwscbDNwK{IU7~3}W@(n*grnPL``TZ1@Q{batPPF!
z;E`4^+pV^{d5XJgYW80hI%ZdW_Eb-j?2TC!GMMzQSaau*uHrZjtK``4@X>|;b?1+S
zoMxF5X!h<H8aEwq6T3@m6@QU1>vnR-0HMQPaHq!LE^)Uc1s?j|ng|E)a&S|J<`)V*
zdw>T$x8?8XfOS)V?RfvHMC4ibSiu+HhN_o5I_N#Egnkays^Aw|bvALwT)%lfWP;cl
zR492>q$ssj6Mlxt_KI;8hyUa2f=@Y8h%jyBL)-&(2>6o!%!gV(W=8G)jD`bVG+Q*T
zv-+wr%53!U$zpxf^9m=dh(f4Q8}tM8?)VcvxgM~0n@kID&WLWXPC0iugz+%!wuD$i
z2sbpZk^49f{ob>5=InRnESfEQ)M`h?3QcuhD|>SLYawR~spymvQ(Zbs6(FzH$W;U0
zL&9hCKLt*@;j%BEAV+$l6p#U5#1PL9WDan+=<E|SR*l;?@g)M-9@6e<U#iW_s>pAQ
z;~R6Iik~}pTkHiPZY5D<iQw4bfEvMbSL3i3Uw{$7>}?}HH4nwFu?3E!2pSTq>`s0~
z<2*p)3D(5EgQHYa3Hy>Bmhg%JAyZHK4JZ52+r@QJYnnvwCx;I@hX(4Oe#(u7`{n4g
zx{eN?b$yg2#kEB|lgc@$R*JvYyT=nCD|n<iUC~js``=8%rzIYs5!Jx>(ZYWf3xldK
z^Ih|+Y2Q-NyGI%Am_AdRJP#6cizd4Dz}34F+D5-ZD1&|%VuLO3aQ6w-)?j{@1l&L=
z&!I_v%$o@<2QyLm=us7J^w&1;z)hS^Zp~iRtrpS`(^p4Il@bH+t>CHPHxPsT{ywej
z&uWfmc8+coTK-<tS`W<ZJV{YKp8O&&8+Xft+nM)mA6|O<+s(a#x2Kfa{qM~=?8`xM
z55^?@foW%q75WLCHA-X_+y|c#x{}9;93_}#wFc0Eo89B)r7pRACC$lHp`Ip;lv<OT
zp=vV}9(W*p$wggiXnv7ji*_H1Fe$+i6M5Z-@TjUM;T9>N@APb0cq&K!_(LYHnAM4h
zt+}j|Da~Weg#sS|TXj4X5f*4a&}ieOwF|u|+~ojl=<n1Jpf(h)6j~BL8hT`?ZWq;b
z_Oj<gk&0dRN^DGKvuE`RXZ14YHP0EMo-kEymEt^B0Iui;0w%_ZWdL{Vm9}~#<b@-y
zxOKuqbG@&#xAp0Dg|nKM7=~QmmU*O?(M>AaT6@Zb`Sr@D!Vjk?@>3vN-r!kl-n%zz
z7a$`IL@Ig(H$Lsfc^!m??mMisidCDVCSC|Nc1@Q<P1k1!lSHx^Ep=q?iJ6kg(;w(t
z<n>(AoO^|<Jnf34iQ;}fsr|qW62V)M*52ClG>`T+W&E%zV-1gSyrlEcCm{$C=eY6a
z-VO(gSa=0POv#+{i)*3#5ghSthB$AYaH_jCgSDRf^cPUYQC%dyS0wop9;17StzYC)
zmE!S(C9<{PCkEO^I*&`P&NB~>5%~h#8h1BobIJ(SwTvG?G!~+K@9~v2qPvJ4|E2a_
zpUd$QQ3dFm(ItJvh1LQlN_e{pchh=9Jl?--Gv5r@^6mQ>NVQ+1A5r-$S4}SNFXOF$
z5~qd4MTAHy%JV54hkEZ13u&x@l0O;`YVq!kdA?vutVRJI^2eV_Z|5me1Sg&pDH=@Q
zUY-I@egi>^H&8u$>FTe5aFbR9(r!2?()(+;LFViEqq*vW63GlggKky)zH*i?fO6CC
zrI-ShoG<~^B@4fMYGif`qquTLr@#$&ud$^y4C4vp!HGD^()-o`Y0ww?3Qgejg?om$
zasCq8AZd}+WD`QAJ)L{o`VyS_Vd;{Vz$%L~hhlZ)(?SE8X^yIL3-v`!^~GEvEyZlE
z%Z=CfVlmugW#i8rhsC0Ik-I$@+l=Q4Yg<0sh-Mr}7BRtDmB&H-PpmErQIM$d!{@fy
zXE|%yv*D;ih#eseywMV#Ob9fEv-}9?dXN2o&>rYHpU{z&3>Ckp8KGUC<*!{FVuF85
zVPWpPjqtdgY&R8cEK!Wt&IC^pxNzMEDMbd*IxrTr5GPXF<sq84RQ(=sT)31eGel}G
zoGHLDI@vK#qh)tXPx$FZ$Uku4z|OvKsXD%=&OHF}=g!xC!IKM~&`<~r@XJ;#{L&UI
ze@VS2=XcC<pUWe0mrA|}(MB<mOB;D%!3@-@cK1(mzcr6;cPv*8w$2eA{9jeVzDKBy
z#XosnK2R~MW$2!kLnF_Jw}cwuT<I_71M~<K_rp43*PwTQGM`3w3OT+{`*HYi;Iju~
zK33!GF;U>2XC}0+f#1K~E_s<>!rxc)`A_YMDQ*%tWObXO+3ut>_fpLA_E^12Sj>7X
z{_Nmkv9f`|J`B|{{h2ENtj;s&*D0%5;UD}pI{y5bvxm+%n0GPJFjxQ7F>5U|i23K5
zfknqdCj?t+yq+Nhs}+J(6O5&c$Z33QdC7<#6CzU2xx>tqwbV_~7a$O_I9AvEH6~xd
z9^ryRn*Oc}h+bhd>p3vHZfkn7YkFLdc=zVduJmnjTV_U=6$pB}wBCu~xPjLAqFCWv
zQAf*@R{s!>G<vKVu&ft~?)x!E_Ly?F!|R=A%YS`mQs+0f{;`wbO6As3>bAc{e{SdT
zEYIXCIeaY>qL_1jmV#W*7rL$P-cYa4|A}}cT!e1FH)oc~vDQ2Mjr>WsfDThn+yMD_
z8^>w1_hrgK=+C$pf<~Dyt*|>mvI^L?^rRjP4kDGyxhjglzHK@shW2cq%1Ol0#hnT@
zS-~9Ac|4cHA9))%JHU&x6v}2R{EydO_88Pz{D*WA1EyZ8doJFOA32;JuO-)D;BV}`
zD1at6=_I5ib>x>VLBF7fX^}=?Tg&IIiPdpS+tYJcWi#VYGI>ZcqMGcHU2q%Jb%t^?
zm_zZA0Ya*PwpLhML=Cmn$1v(f<_+5RMEtt!L3Qz{$?ZxKP3-Y*HF03;N<b@bJfTyq
z;Kf<aBc<96628!?=S`HABH(gx$96e+JV&rc(^nMric=9aXT+bcC;nAybr*2;N?3KN
zzj@l~q~dEoz@wFA&ZUhnfZwG)PG4@XH$MYUTCfobnQ=q{IS@l&3>4Ac9W?e51d#E3
z&p@W(MLH`Ou;tKff#K<rxsZIq_~o;}#+BZ)Lm_j9b&^R63smgQ4p8&mb<^CpY}ib>
z1TzFJn1}hnwH?O(xs+Ma&Njkr!6pPErw9~9bJ&Qu^$J!?Y*PW(yCe4iKq<+5d;YI$
z?IyE^^EA{f?e;eM`MgdrSR37K+G5PDNn&=fAu+5WA@{$ri#72ZyL0mW(;*crdHKJw
zi^XJa4m~gbU+n&A>PvBLeU*>db<KdM<)Ir4Eiv}s4u!|X=4~Q-A$L#y`YmS2Rqecg
z4G{YF?J%QfD092y*Vvsi8n?~eJv$MW?@)yX$~!#baN6U@xF<y+qG8eN1H`09Jvztt
zl9r?KC+Y?~6%<*beo<hIsSmp@biALmSuoNXjh@6@Ah^dP4~qzJ*vz-nP$XKAocsX}
zB{=^!>s^9tFa6XxB=X0>=~(e!D|Q^E)#-JIEBxyi8*f35a4jTU!9Q;Mb8okb3P7B!
zS~<_ogRp9`JW$RG0WJqJ5GPQ=;AoNoJQNP^gNDAvIAgI&NYUq;3$lw%l1bo6&$LPH
zY|(KTwWIP4TBIl;6q$v9ek#|ocP7QmX%+d8R5HzBv7D%iO~K*Yf1!et5@zW48Zd>F
z8j&8pnK)_Z$^0~$00$1*Mx5C&pgvg$bo-xcf(0_@c4kpP^Q7qG%E`}>p-LUfPG1j;
ziezXHi%}i~3(;>F3$?OH2w?=!OK@4^Z~3HY@yUV(<S-6LTpgh12ni!{B~jUGZ0s*U
z_L`v<ZXBSYPjtZK7$|<Gm_EXti0v?sEE+<`yFSYqs8fkL7Wu`lgOZN;c~+N~($Y4Z
zm*8y8D*dIiJ;5GKw17#SE&^$oKfiYuNOT24Uc<Q^kuD?SllL&}s#UotDkEzZO_YNj
z%A2e^mbT<@e`pIiaS(PaL$c$T^2V#6t<dWGJLB{nxYFS#Gvy`KkDe%@yo$$3aQ2UF
z1l+raYWv&~u5rkCbKXonKA+QG-Hp=N<zT3d_Om8-ppenMU*wmuq_a{&`-i}g?Fh-}
zI%;Tc1YR@j+B!v2oQ%5{jXlmBFdKdWpU7eSHWYXC<c>F>_}Dt<aC3BSICo!kTuvTU
zV?VF@zI7tTyYAam6&J2(7xr7E>+xI6?YSr(2D`!P%8YcI)PvvI5|IoG1kjQ*CWp-5
z3+NmLl{4)@&+6hq=U&G^pZe8ZZH8an-46g|i>c5Y1YNvm(4MpJr#%e#)!pL74!U>G
z2CXuBF>kKu_Y}NT0UxCX?(D#KS=e(e=<`lYI7$%uwoy7WA@+xt93FA<W?7vw>P$~0
z%qh2yuQYl^+a&XsO0#wTf$57F-bR4WmbU*nY{GJZ%(=H-zA4dSmobE}7f;Ybx`k80
zhp<e5R+%8lS~oM~JV2o~Dj}-Yd@p5kqH7L^=;Ot!^nea~fv^3+x!Ur+E|*J$EmQD>
zi~(Jq!a7=AloNdEzt&CV?;QUmnQIbU3+zs49HMH>8yer=U7U$vY~$EqdrozH*ZuYs
zM(1fZT51Tr?zGg6JN_q8n5_^vjVZ{`8tDos>fl)W-d{5cY9^!uL$QJhorn8hxGj<c
zCDOsie(^Ohr&!bK=B!*^rpt+;MzTV8lqI;Q(0t?@FrH^StZ@avd7D1|i~^a*$tDP#
z9v_5R8}-6qKJu8+&8fQb!g}SW@JApfXwv&XCM|K!-X(I@37b+I19aCz*V8y^Zqd?p
z$G3D4?^}gmpoaFX*nHFSXY+_}F{Lr`)E&6<2L9{DxdXs6s#=}A?uTa&vpY6y<>h&J
zhU;V>v)z9Wt}2H_^k-J;rO4$ui)`j_Tb8$3Tjw#?QX3)!jL*<5lCT~3v~k#4nn?0!
z#DGSdO9)?{N~wUV)cAH5{K)3X4U-2mB04lI%uUzC$AsoD7QFs_q#Fr;&^<u9X5p2{
zo+9%~@dkoV<w9*mS(0QdO-zk)69~PvQ#meD<g3{1?>bbhTcS2EOTr{f=#+IHXe`!M
z$;CKI#!kLbspZUtI&yzIzLTXWNf~iCiO`jDcRU4&#P_l|vpyDqw~B@T=^OGrc~@56
z(P@~2oqMbL>zAmD)*~UeXLl^!YDY#s$Tq(9V=5ThE5V1=Gww@5iXHI?&?8h$%QpPU
z?}>0IWP5DT*Sa=9d^p<4!cOR~GxW*pszS2XFy@V?VKo=V33o5V{&@$($cn_%0$J*#
zwvVi}jWm=D3IH0#u}~{1i-R(4{x&Hp%}Ey7k+3$i;Vf$gl(*R0dX{B7Rg(CtuQtC6
zaC(zvN(o4RA)G0zi8oSWWX-8%zDW6tVXMXT!2;LGfJEY|?3P^`9y+7`^n{~z9O#+!
z`rWGG04HqHf!BfYlWm)i&^XR#(4QgRFa8~uv^5D(W%P5;Qapi?G^duYku3Gud2~92
z7)2LxlizY8#fR3KE7Y+F7Hs(mpHn=Uj{MDOhjTsQ%>aUO`T9RZCfc{En}hsl;I5~B
z;~Q^?1*m@}kPX1=-t5n#WhaS#Aw#fPj8GhV^Is_(hlJwQT^Dn3{JC?e3Wm!CtOTbG
z_4(c#WNjBSiCK;5*!_*I<Q!($#2g-m>gk7v%HOIarMqYXDpumZ9~*Lrk<b`SQhM6a
zKr^mkP28cSPcG)l1?&3D41iop4OOehaoL{JdD+c*+5dB8ufvD6QTY=R+;I0?B%gkr
zyJ#gjVqll^a<NlaMcndz@zb_Q$`gz%M<g3Rml7q2|6}W#!t4HmZPK{0?WS$)6Weyu
z*l3)_wr$(CZQHhOC->xk-|lzc&fEFsw`cauTC-;MaoV9#5Y5hX=tK9d4U>+OsGQOZ
ziNix#c6bTK4tQG=yX(@UEJSGJTy4^7?t329-l}tfL7sar{y+vlqEa7-Z?(t-Ew?*=
zycYrttnaN0{7CbS8h01>lb`*ATM#Wwu{#k=V;OeZf^2{P*5J=jUldmNOqjy?I+-L3
zZ_jCu9~r(kJsGXb+hmE-)9Gs<%k_g#6Yh=?(v5ftTyVcdb|6dM76n@<UXRI%XG~Ge
z>7%v8`hTJu&$w>QnA77XrHHnGcbigE-U(6sVD2tjjpeZzY7`^$#7WIPX@%<TQ($p@
z)TnIdLKt-^Yez;LP3#*Hq-uO=)YJ2S{8OSQ&<}(?ies|X)OmXSiwTC!OC;*g>p6PO
zHLHJV8hVD{uu~I^+zGHtaTyvg7#t>BG*1w)YAfAdB;Oq2`%f4F<}EeFfzjT2_jA;n
z(!Uc-SYl4zanRtfhJSpMAk2D2*ydj4@opoO^ZwE@iCW2**q@55la8`msy3<AMpU~m
z)XPLnh&DRUaauT>w#UAZSG!8Rf;*}wxGP&NF~820WC9|B*JFomQ|`4!Pwdqf#MTGO
zmD}Yw*i6%yPVUuE7b7E2!j(%6=Tnuz)Zt(6j=(dccD367+DFPvw3H8s9qTwQMU2t)
z`5VU^qS7!f-Sus*yf1L(ncJMQqz$a#iLctL{JeHbs_rkf^4geV5wZG5R?Xf%T>3G7
zBsDz_B+sUROHAR~>F<nikEOQj4OLxYTMyUhHDZ62tq(AdMviTz{QV0!*iH%PW;W|)
zwn%gtU$T<Vw`^BTRwo`jXgy#F$5sbuzRv9qU8TC{zdnb{I>tT0h%|@ThkL^3<*ul1
zRpHowf?bzgh;_c3+c+bXQ+;%73EclWIa}u~A|HH4krnaB9xc^$^puCUV=orxh)QY1
z^Tcl~_vBeFc%p7x=eS0|jtp-CU{Z=0PXY(XZb5AnALRyxf}Tf}u0`u@-C<Q2cfg#l
zX|gEmDaidGHjHLihV`p@<jz?2nRFt0h5I5<f>3odSa}6Fg*Cs4JPJY=5Ht{(GgEC*
z2r58)5MoGVvJna0%;ZWFX<v7%OHSkvJ9q_H49a!f)Gvtaj@0?mmC?I`tuKMVnVBO5
z?2GH!V<o7(r*>E6a8N2$dw)q?u#9w;06kSbW}`K9=F{+R5!cn6&*uO_bq|ApNGXY0
zw#Z0kctUk6xWduZ(xr!w-lxeY>`pU=g|uqV*?VcOR5<KXmd4C5Z(-8>?Wh#p-%B8U
zRvn?wBd38jDfg9Is$DaePuO66<iQH6#hGQ<(6WjtvGLtD4-znP{BdnS?t~KX4?n=-
z*=vpLuz<inXf;X`!>z-4Z}G=PLl1wEgdmZFzi-eKs83wm2!Biiiq{h<g?GMboqv|W
zBj6O(uxS$EU*^GCxUMbOT46KWMJ#3Te6x(!z14tw$OW!qf52<rzHU<_(Bp^PzgJR^
z{>v0<EaVt)zu9YCT{C`;#=c;r9$(<Rm}OWqrd~Vz$6NMGSMHENp9^`J6eJDRT2vJJ
zQWgN_K*~2Mgay}iL9@9i7pHKhNt&||R-RFjb3$)~B-dX59#q7|jOxOTo8u5CdM_>+
z#0(V>lf2XC7kZO85<I92Mznj=#mRNngaD&R$jvuwYY?f)nYZv!iJ#pb#+U?_-oA;@
zA%y?v5>(8%A02Nqg>b%Tk?eXUj)$H*)=t*#wX7iof+^wm9d!f4DuK`)5T_aKp)A(e
z7tJ+kOeZuG9zWgx-W=#IO`!X6Ubq-XiK26I1*RBbuGQ#gTm4E&N*_mgGCC12$AP9$
zRd#>S)8L-GE#qcy`?y9ynhblVdxor)funK9xaL8Fj0bw~EmR5fkx&5hA@ddU5sE!C
zmQ9oJZ)BS+!PUF`>xF)?1_l05(@7PB!$ViGNz2~+dH=hi(eiPQXLB>P@=XjpSJa;3
zU#|3G9lzf?8kT-Pu7;vCk6%#?OyBAsR{5~qn_rvpA6)M8pYrW(iWhGD$$ItXfmG&~
zs`9kFKeIlD#WAv8WFCio@#5y9N?bG=Yl?vLw>}GC5B@h{mud9-?}xvcE#II<`+rZI
z;8COO5Qo+hPU2?Aqv&uj9PhDn@RoTmjbk453cMdZElthf=jE3#S1OdlPt7bGnEb8y
zp<I~nJl}~;P2J+JjE<|8k`S1kACO>4N=@C?Ky^;m_>{U50XoZxJn*O5<Ig6SPRrYn
zd{>>vpGX#`;Q*A28Y#x)p7<`_;*9}l>Jp+2mNP!l-8lg9Z7{)QvD5r5_8#w}vr_mk
zAE^|K3*AW5*fKdYCbHZTCvI=(QMGB-7m*I8$OF(>QZUIyFiBkWs6uxUuA7SL!|5=t
z)C!XmXM-x^cazuZ!ir@x<5Yn+{=jY7w5?OUQy4x!C*V4}IS6j2$aU^0V)X0N)d=<S
z9FQWIeG~A*=O-_Jggzn>4Acm%s3ck}<TpWcwpH`5+B0hu^2D3ff0VN<s|}A>F?xs=
zA($s8!a|quTNs~8%bzf<m@Zpzj$)CsSEn|_Ln>qnd-n8*!EX98MPZ>2;M`&b{Qho-
z^Bk#*g;RR{vw=zVc8h840=xW3wFsduI;E_BeMrYs8SYD1FF7=Fgrv!@meG>=3(S-K
zo_autqI#3EB}Yf27bmUi;^0xYai_jYDY7>lk7B9&0K%*E{oLnUB(3LSO1E#nrF!ap
z6|*qOJipzFQmLh&rZj8WdH=;KZB+1yF$yHN?KF_fQX~r@&?(s@aPRmW%&ZT<i(n%}
zzkHm5uaCIC9;Uy@xI6h}yjP_4Ydpn*#k^GMa%FsWRuPl8G9EiOT)@OM$K@t^y`HA-
zWYVSZeq&m7k)7QFpZO#_c6K&FDB@&%c9&F-#gtN6M*5^)Yj=*Dz4xie#)vR8jhV`A
z?R1_>;}W1wseI|W&~;6aD)dV+`a}+b3)<XF7fQ2f3EOsLI{eh%dx62EX-RpVA@hx2
zGc_C}a@_oRMmIa$LoY+b&2GD858@rEkq0Lnp*`B(q`LR2*fhMguhQC|wKQYBRL$Dn
zkf@?Ur>SM8{H`c8U10Jeemc=%|K{ZbRFkz2Q5Iqy^%b>y^6G9X1=_iv#KU^Ycv5Mx
zr!6F#wUS$7PKM(CC74Ea5(nvw>*dFuL4_S(4c(%D>p#b^icf6uqR(7zsp(;{)4Qfs
zE{n7kO}BsY92^{MTqnr5z6?v{TD8IFDeIi41er`H#`P=1$@YpI=K$Bd)uP81=5kke
z9y_oP4fAcJ(pg5EYTUk4E>4s4VWrQby1%=%3v&BS-mdX3;c3ch#`VGwnGZPiq^Eh)
z7C(BBLZf}%o1XFNJKx@V6JH$|D&2SJc|?ahMcnxZ{@t$H|LMemR@Z{qQSZ6!_-{Rc
zORjhZec@!D&lh^_t7P3verl3&@)w9DHL2+ln6w>0H}fi1uU?wEU5@(KLs`{cbTxGz
zz>P>z<y(z?iwM;{H4V9%|LM~6siw34HU2*3j`EKYN1cwyA@b#4pPro_QT?uIuGaoe
zjW|kiZAs;aH##c>@ZFcG{AbDcC@89~2$P%660Vad3d?1OMjN-ap23A<n2J@Y)1d*8
zCukPjr=g4VZM8<D^aq^1vmy_*O2>2d>Jx`j!$zEhd0!PIL!0>)?0-AHC1~>io<4WK
zb`aI1!i+fsUcAVs(uLZiS~dm?^&RYT*lI-V8sK1B5puO2!1O-Xv|P)A2`GX@FT?2m
zeyXIXgf17~@vbL;>Du3VN0DyL+R&@pt<_bsg^H``FHm{YmDF2r0lOF&P!3A2X0@#*
zg0bBfI17MaDzz@})E}*B_iUNe-1M}urft;v(|}E=0k}~S`Y=b&%+D!Ya%t%&a0)nB
zq<TE73d1aGc7K079c62Ww??`d++m-ZD57<?eE3TT-O5ky`Lk@=tyqce9MLBJ9|4M%
z1s-$#fYs``S(dlIP=Cu3jF$#?G&5qU^|*lb9~)miC6!VWo-bAj3YKY`o**hwWC998
zO||H@<Uj=pb}Wp<R8{9EC}9-T=}*!iffmFApGri$z|*sSNdYv)4G9oDC$B()7n*)T
zCXrZ<E7=+z`JE-s{R#t#sxbWLRE$)O&OIcA{r<8)4iFvu7-up;)cCdx6`>%4-^lGK
zqED64Bk|JG1X(N2`s_zmh1EoiKDl>KBFCzOJp+CDJfz$HMR5M~2n}f5=jK#V1Gl%q
z70PKP=t(ghz<v0Y7%pF#4;*O9xC^4)sZiOOpEAPW!5cV$_=BD-qG5ftt+W(hgY0?d
zhCvs~*2caUA3az?otlOhE!;lCd9e(n+yW>IMU2-+hLIbnPV?s3xvCpTbmFf&miaDI
zbC(;MbK#vf@hm1@f2yFAx^C_%eHv}B2vM^ErRMIjK&g2L{RYeGk-LJEh3dkqQ9`%%
zpoaO)UfrrON+Mx0TP!Q}_^vYzU~r({h^zRX$n%hv32QB|;+*wzW%R&lU_)||`F@RF
z3vj=C{#b)NLS3(1@>m+EON*xPeIoQZhi6<E4ZlrIXi<O`OJutyT0m2t?xcm2E~!E;
zs&TFK1LRf!&)8?`0BPOrgA8OraN3iU03mRx@RQ^y<cc>fQSV}Wove$B^(T4J!Uq?2
zjn~>5e%v$?Pqc`1%;iXtmape*r~5Vj`CtUc^)3Fb?~`K}&$EH##!uFnrTmKz@Ielo
z3ms)Xf`2mo6!DJu7i>Mir35``jG-a51^kbMZl=Ko;}`@kNe}Dec=D||YkHG?go(7t
zyG8o>0lMz+Vo;IBRvwWoT~!POQda#{Ul^fx1c(u^l&9TeN|xx#fEb~d0nQ8;TN#KE
zj`Mt-SFiEGRGoWPETZb)hTw)$5)OtrqwMu~7u0wc&{;7#9Gy6SaJNDD^scrRsQzMf
z_}kJ`{3|M3^*;8zP&I2CAsQ!w1YP@eo8EdFE!)QBNZ~bSU08s@-~-Dauj5{^Hd^2h
z#f*z(7bUClPrAi?$R@=b))O^p6V$n7)IoW)_7a^@5-nbSD1oeu5v1G<-&YNncUhHF
z$+?RUN%jI2&ephvJm~j18^#dRwK9gj^mZ_|ib(++-YDWPZuV#wUnTt;Vu98XEB#6?
z-aEk!$PHKtGPFl-%aToU<iji*u7pdsJln@@6In-;cb`#M$&Zuum#3SSPL&~;BSJXn
zIb@%jZj)|ANk7}3i0|A{GgB8>$B3YDO=qM@0jxS7MqP`BYv*ksQnT70faiI^<Y7x0
zd#8BRdjS-kE3?Tz3kA}1EL*JZ3&Agy&^GB~8^C2NAU5gd2sU5vqAwl@FNiC0QhzB`
z^JxI#MV}$kB7mgg3tj}7T@bhr(y3&0IpEq-^Dy`}7vwv$Big3pjMZa|-NSr>J+43E
z!ynrX97rzG-*3?ylzOzh8&Ep)3G?WFsy?CKPh;|>#r0IC+q&mfl!HQSA+&>VDTJ+H
zHbQT>wI-noY6)WbU9g@E)$CDHWVL$7yUk#Nh-9pe`LbSxC}%Bg4P#@Jz>AXw;-X>}
z!#oy|PnO`euGtvBG{om(WS11v)?1ztgvmE*|A2;ub|}zALz6z1b_}~1+>Qm6gA^=B
z?o6B5Xv(kz5lpv45d1P1>C0U2q8wLzrD{+)pt(qfymJ7bBA~f5hY*;n@|Rc%BdD8}
z`o;SqMpbilOp^z?#f-lB3%>bXNQh<#OQ+$lN&zQAxGb8xIpsAyv_v~~Ql7M0R16-W
z4fEKQeWNbl@*XyYs6IvFSH$v_Cx7F#I}XBg3tJ&adUm!%KJDj5jqAUgzY@paF;8cd
zMi<6ql~?XY#(SsK)j0*n%HnlUoXgKGQ<_N&&!`sFCZ1BGxr*a^O~zZBzw|A|4*3tb
z4dG)p8+g-V#69;Hg7W=wIpT$rh$k4g@$<#Vi-<*F$9IfyO>p>E-4u#Jag<$e)<!O0
zq&FcmP&xd>ObsPBVPwTR3Gj-Y00hQ<g`f0S_*u(OYX+ArZRG*OPnv=CFD_7L0EFmi
zbx#M5gF*5c;Et)kfgT_bSCF?{G)^oYo<b~sI{bcsbk+#u5qo9ICO2z)XX9pyDHU1@
zGDHK&nB^m<&ke-*o1^C}!B5^#mQ2JD^Cz?-13}S21GY@mXxP3tmtKvJkpOH&c|DA?
zFZG}();^{rOm~WrBpGJmw|xToldZviR!NaiJ`JF-B#)+^RdHkHM5B0(erd+52&V`d
zeBk>Hd{k_tD~NRwZO6Oo);W@X5+E$UwhEu0gGw))yb6Q-(ng^KOIthH{Jw>@@x3Sn
zzDsPh7X%N?x&dhmO<O(T0cvE`<^rR17=1yyHU(YS=+Af^)9LLWsr9N9<^ipnzT!oP
zuC@kAxTlV6Dfa<sDHZm6G=`}HxlIp~Tr;+B%p%blmG9Oo{*V}~b$Rj@;(lKEf#G)w
zLQ($moX*NzX#frrHpD7IYkETtSAxBE#iCzQp_~8`ZbBsN7&VMxxSSt0NMYqU0{~3g
zYftvutC^@+Of#Yw*b8v=l-{_x^29pg1#bo%_#$R6I{80+ae6c{UB4y*8`Eu~DoB~B
zanI^bucP{QEe4e9J3!AAH}M=s;`>gP$SYr1dZmR}7)$hg(}CR7(y&gUMW3|)VuI2R
z@%Sd=C6?z%?26@WA<)mCX6u-6Z=V!;uL|q03On^gt?Y_xaO;C-Tfb3q7+$pglnuvD
z1!$hnfej-S3G2VY#Ld~Fk+Xl35{WM9+#jxmITFxB9)M1g=)QAYn969=>*S5#faOT=
z2r3_9M#sdbmG9VK^%hyvZLf9A8Wc?l3X6;XOT&Y>K3D0ubIt@4izcMI((Y$h7g!bg
zpNMnkDMelhshC8q4>At|W=nXdk4R9$nEPA-lOrk_(dq~-RacH<G6$!&u{<2Us%YTg
zk0KBr8q0mb!%&KrayfKdjQE5=UAX`u3(`;uAUqt+`F@$<2q&@+W7%jkcSFj^YO0np
z?#x>9*LqIPdXDS(*0^&yN{l8oJeBw&Rt9eME$5WMGbsHu5k%Uv&6ayUtvY)4UY08l
zF4L5$F;hk;q;jSefGb+WjnWcHvM*Bo&<R-+@@o~XZsf+J1oPHoW{2|G)P$l#-gr{Q
zS6PDsEau(2$zhM(-h^XkZMAdyGOWdf=Vs|88Qgj@#L1l5ta9ntmB9eCx!D!V6+AsN
zcVa_x$-W4}ott+oeO=3;>I&}X0cv&>U7edjg1~0nlwhqG6gR`*&kuYANW;00;~Xum
zqDJyRn8U;`cm0kzk&a`C2QzK!x=wMVBB59LW{`f1GfGfwaI3OcC$ql<b#rW<!}Pkn
zo`M8#)$;7^kdIy#NZR*ZzCidr#!;U@yBrT!*}U2Qk-~af<r-hpQrbJp%o>P>xg`S4
z0q`bmO8VlZ`g2_6fxJ{G@Fs0C+1dg0^nWD|YnynLO#Iz&=bAN(jV55$wn|GdG9$1u
z$KH6NXuHP5fuqp?^dZ2`n-#l=xGy$UGwYibmS(${W3MfloRe6h;oy~W$FvYOn_93A
zDC4Y_3m<>y>x|a;v9t1X(kOwMh4aa|4{8|krJl{wnmw@9Mkpnj`z@;lf+y{C$fCsW
z!qYKhUop`}3U?xhpQn!UXV%UfGmC>fE2;zrgs*M$CQZ!xuw>LT3zLe2?S*xP_2JrS
z^KZ7-3S+%vxQ<egM?4tG-vYw1j1Y;>0-U_(G>TWyk@XRChxb2PyTa4o-_Iy^C*~aQ
z?(9O8WoFK3yyw$ho%TlbXINdR6@n?CMSwF1(6)Kh8HRCMY@?#osfK9f$%c8<Ns!LC
zd+n<qb>+*K-R1B^mkS3`jzG^9+4%C@8=4obJPN=NaMZ%L4gO|Bcux~pLlWN5yuGyR
z_i@O?wMw-COGx64*%{6hk+w*<Yb}{BzMU!K9aP+RFAF=aJ|^*y$1cvfen3mJt0l4d
zYKK#~>*Ct0$-sxSitzmz!&<9N-TNADjnIq0*5C6f9}zQJJG?ES>AWUfS#FSbWyV|%
zVI-IR0|ZS$M!k1p*z-*Rf*`mAWvnVK#NQzjK~m;(Huxxl+L^hzRvZ;a%V?<hAX8wx
z!}GepH)(jc*prWKUySLeCNivV_P4Er++S!#Ke1c7KS1GHskJEj^`e+aJv;?BiwXLN
zFgD63ice9rze_tKF{)Gwmx{o+x#@PNCqk|6rV>?`SO?cdb3R3U8`!Va=;#<#<9RVJ
zvXsD%@1TvBJKtJdv4S$Z+rKz;SUR0f+(}&M&sQ78Ou(}^m%AtSnN#?`jFezb{Qo1R
z`?t(hT_h5W3k_3x=?DdokNzx!nna>aG1!5KB1Ldr*YN^l`nJFIGFL}h{@cu!-h=(R
z*TixuFHqnYZ_eMVF)j+yG)bywd(KM0Hyko4M<QgpLtNW(E_QCfL>-4HMx;@v6`q9`
z6@f(r)mO;We1%MOe-4L?QZ?~c$kdn&?EqrFLS{yebn(rnR=<f}rUNI=?2N!t!@~fz
zsT%q6BWC^QnqjI@N1--MUCfCETvpEa9jSgTx(7d;1D=arc+5%{Zr1|9^%r;bjrD)I
zE5@oX?&`7FiTkU|f*wxFurG1zL}1AYXtJShs>TP7oW%J@Plo>^CwV~J)fUC%UqRVy
zT9P(1sN0@Jm*X0PGd0J%gfy-D7AFakX9N<tc9QpNo;DBmm^_G3^;OH8&NRI$N1Bz@
zuH5^qH^@#X0&eHmhek4toUC`)?|F)r+(}8hsAka)6#g#$xkuudychlgs^!hi%w3F-
zB3Odv@#sQ4W;x?Z2|7>ZZK_fHM$$9L5yD3hwG<U&ieD040T>8=gT@Q_{v199FVi-#
z1^&UU)>Agy7x^>2vX4BkWc#ct6p1r5_GIHS%)J(986`<Ac<~>INq;|N#1<y?EK<XE
zRB`UbWV7bHwu#fVCx8OHWcS0wxMh#xRsGvh{-wF+{32ueMiJOJxTB~lq=52X>m_iX
z+A9z7dBhP2kD!ZnzUEzoZ3$_gcPf@87x<6k#EChqA~T>a*$39Alax<xo`0Be;dcpb
zoN8#C<SN)jX~iA72w)#WP#iy$4ej5K$};pB$~B^Td{?0xy8S5cGQMBUVD08e1Ph2^
zBny<GEwK2C8wVC&S?1GREhS65%fR9*j#<_LH`^Roe4+nt4N&RE*ROWgTen!81m<ZC
z9v}nC5ZRxBh0%(E@#>HI+39(wdZgL9jl_=+oHnmVX*Xk;jKzLs*Swx%9IaX$7=EZ#
znX<a)2g6q4y=Hr{`eCP?;qdMUwxbWVUSpi?WR?8Q1d?rB62&e;oCeugU*em|??M4=
zJap-t$%)gqK)-h&p(qW5{`*gVgXRo-O=c(>gce^uwt*DoB2;&7%*c;8?FQ4@Z_LUT
zkfBmy;!@AD+&Y~y-|P@PUzff=aJasH3Ltv;TYjkDZL`#E9@{;9+)-A%o#xy`s_mEE
z1bMs)yE%eDH)h0V9D%&!-WQ=F@tA%y(2ns5iTE^gEGP>xEM%XN87@@fW8Y=q@fz0=
zc5mH1gDE|>leY}K;XMkgfec#4`j@24<C|E!f+nKcLVVsJIddL{I(1l-%%RBW2sx4Z
zanm?l`Ex`PrHg#IOmCea24t1B3tM6{&b}42;GF98LB&q`#oz(s#Q<#U%)oYw3JC0d
zYuipX;nL98b&5maStUk$y%@nJ8j#b_wbT<Jj7!gV9m5j$#cUg$mx0AZo4Hy_;jPnh
z@wTDawjm~><B&c={lHcks+WF`*B_ZnocQ#KrQu`t!VG!HcxLHF!uWC7oBNw8i9r7c
z|3j$^wT>&!z>(^arjX&)mHSZUFSY(;1sIG)o!#Qilr>6NwUp0@(AIjeoSVVN;lXt@
z6^~m*6sF9-S}*Qd-eUSmHXTm68`&m>zx$s*rDF~>h`yU>IgbP)@=I&A($&%sTyQgV
zx<5X9ZxMgG-TU6*$MH1SL~787j$YE>1%~HTa=Z2^*^nz~>rjdk$&$J)B^Leu%YALo
zin?#PMj&t~`jl&L<EgFXE-MX#=Iy9@<8S=~OuQeA^KJw=zC}Dv)D8*@smxJx%@a;@
zIyG<HcYRyg^dBz<fj6#e9bw7)FNAGBKk<77A6Fk59}so0KL-0obzEKC&H8ijBS*Co
z6~I2|h>!D67wU^<gXWqTN+bWA5R~6ykQH7jJdZAOBt_0{cNqdd2=G~IRsmI3rMjEP
zXYZfKkUE>k2Rhoo3>xVEl|j!aTZ9zRahHG-|K9G94;G|nl)%~#_Vs&P@EO+hDC)8$
zYCABFf;PTz9dbLPz}*7>-N)N)A;*=dtd+%O%3k{TQo(Uc0RdmY9`i&)=AQRIl`h+|
z80+ABJx**VnhLxn>43?UjG9-+#cPm$3+7McQvOJGL785-36UkCY)W7g<#G$e?+-0e
z#hu9aKWLc<@P<u7sDCU^GP4<1rHm(xF83z@yv7p%5#ulLmHuCURC0Q-1K1x;2F8Cn
zy&bSWD)|Mz*cq)HoAph8%4oHQ8zm4X^D!#Sm@gb;B^!-rCEtUGfT=tA7)4P}NGcq3
z7>hFIdz_5KEdT|7-b~|jyS5y}<8hm!Wrt=FFA2$H{E#GB|J#(}<mNAWM(f9)(MaPw
zv%P`FY3EVx@6HbTU7D#CW+q$wQ)dxGn?c28=BW=B>>9YUGf6?K<=<c3=09HPw$utj
zi7l@wq4Jve`3Br=x+fPB(6(ldZqakw^g%vkn?}Sb1W#mS6u#yMDA8r4<;pF}7G0V{
zKiKI+z!D4Sc9Ij@y)70tGDHly6gPrI_9gTT3F6h?)vt?sIPjFJx4#fMfuYkJ#!b-<
zu#V&`*%EeXtWvC4a=?)&r(^KVFUVKT49q`)lqf%h)4_rxvPx&qo9mr}d4Ehtw-<lT
zp-!!^J+U#!Qe?CrZA29xm;D!w8-&n}I3UcbDeTwd?5-1^g^T<X_MF8mN{=YGC67?5
zm1mJv$wgA-hnKkslp!<|IDZFOT4=hw>QDZboQ^fFI5}Y-S!#ERJ}Yt5Dpja0nu~e?
zFO^2j$Hbc^k|4*Jzxy*~>wL;!J5G4RRYKOgHU)aa(>;F}<4%y=ug#-=L{)@s$|bUz
zgC}$Pi;f<h(6Tfd&ULg>3n(ffUbO0J#eRk%E-1h11dE)6t=qVRjg@w=9mE5BqRA>>
zJ<+xh%Pe3|)ETG<O-j_&S{-Tw_CzHzqtx9qJM=lJWb#_adx6fetvfqoKDMh1-`l&;
z)0?A0btl(8%JsD8E)tnJ({932SeoV{kBzrrZq9=+x^R6zLlY?KFdsk_b);eBYrusY
z`ACe%sZ-%=#bK#<wo*UquK`%WB>P#F{BI{D0ECqH@Hc9JcO&{9ir{O0k(2SI@16oh
z1-oBJi8WgxE$B+xVBW}2E<E<BdmP~TXH^{5W&`TH`oXq9uVvQ*Lin=!Fk3Oqyx#Fc
z%s(WZgYdsML-~{9pjeS=(EPKAtR^UdzGjpL^I>Q(=REMpqVCCtg~D1+Vox2GGFht+
zYhAeMDxh~IU0nic0gkV0ela<AUrbJRX-+DT$>CE0`i-68)I1=k^b3C+nSNxr3=Sz~
z^f{zTe$f^M1^LTqA_XY{lI8xA-h^J+@{IR1D@DgA7#88^R-n%X+RTqT@g%#ACb;R>
z-#g4t%H}*;MN7*5o4FbNR~@q9vkOU>+ZZs|sl6`Jbt5-)P`$k7LBU+U$sv^I*C@@0
z2O+@x+m!3Kcu{z_bZwq053mTN?{}p2&T{G)U&;rtc%`SL_DVO${K4ng2U5mM#YdLH
zO6FAxY6OrR*k^U&OT||!HB=5Gn@pEj|3+dLEJ?qhc@z+utKUW`j1m>z6aBI&8g$|x
zmv1vkEI3uKqXmo=*Mp7yRqO85Is!L@w^u{8M+wodnx(SAIjhTEDrR;qTv-8eFttG7
z`1)dJalkL8TbP53qg3534g6wf234~Fy~3~ZbBWw@vrT`ETt=gHJpId^q`yGMV0r|c
zqnb?FU29|j`?zAONo;|cdL1=j?%3qDcs9<(vwp1D{c#$p@E+-xEKYB#5zOpW0sg*}
zNUdX$2=11YNb0T>(BgEKFN@oXkCcHHI{_^YV8Py~3vc_f*pBY54gWS`x`0#n9AKda
z)Gz>~zDiXKc0k=<t~#+c-E9yOR)~{w*qkw;>%$HEtHNDu4uIzK-0V<S;lVXRS0UTV
zhbiBrob;Tn=wGOA{KA_@?+(2a{sm41{L3@qI({cR#oyd6zZH2HWn11(4lbINCc={m
z{1u^!ZI}14iRYq!VlEw+5YG`iZYgTmUz0hx%eY}e5sCKeY?gPO%n2<3Q+SpZ*8!=`
zs8HIysAevlH(Y{3aT}vgKnkxy?5AYd-MO&tU~S{%ATF=&V5)%b*D3pd+5EfgXh2-a
zT=oy}l>M>M8p3~<0c~dbuCDXhp>IGX<IpNK0Q}m-`oOQ9EHWSshpi5a?W&V;!!spc
zBLHw{{@aFPrF)4JnLf7Ee~eR<AqyGFEYm<3Nk)NqA>9$04h=An2EAYX&}?^EWOZV8
z0HCJ#KYxq2UC<u-!)p6{1(zzUxg%#QLv<pz1DONr-+(al{8F{)iMNBvCAXO=_|VZA
zWita@ARN1QJaAq!RsRbWgxgC$_BZWLSuX38OY`nYFJ?`ra*hmoe!IK0kBBu5X++Y^
zE6!yqxHVLuBiIO(;oS0QTRM>Trq5_?X^TC);b}}_2YK6@Q5JR#pPL+(Nf}en^l-bf
zsT3(6<k(T~gSXDivPGjy_16qMdnHPJ593pgWkAhg=k?^jS1S+0fl}+}52N_7jxd!a
z(jh2W^ox;3pIQFPbY~E^A4WM6+gQQr*rgqOm@b<Yf@Mx-Og{wYfQTIm`J)9rN4al5
z#%3`{C0r~&28okGCG&UU!Z;YJxaUbGaoVaBtBg@6WV*SRb%uF_^%o@TNe0FQ@<fiS
zJ`j?n0b`=)FZ3Y*W#a1=@w2t4)Zqx=xdq1+=y{>p0hZtiJ(>5tYLc}vf7Y!NEmDG!
zD!}i>?g5Z`auC;+IXcjnSQ1wyhqcD0sF^DBP9zO^?MpI&cb4Kml&%eMoXbt_0F1`p
zGA4R63n4u#usy|T@xb^($qnkJzqqA7IB<)M3l#8iIX7SK#W3z&-}=+O42qN06&>TX
zVg4*zJ<(A9iQv&fP~(;^&ZcCVbWp%8<YPRqR50WHl|5{hWH0^U!4I+pUh_iOJTm6M
z1jqZSo8z;`<XL#@vDtB(F%7Y@3HsX-PsRvUJJ(VQ03IVXVlO@X;F@rRDv)YO*QdG1
zsMo(^kV$Kmq6Jb7*@-~EOckM>glpGeY;UsxBUIsjeIFwma<Y*=HmK{JRia-}NQHJa
zZUv_+o^l5WJi_<6p?{9!I=+9TUWaQm9vaOp?_{JNZ&U9#Cs*hN92%9#5>JlLq1SS<
z*h0RcyI9IItL-+6frX^Qj*_^Q2kydOgPVCI@Og?Ww@PqM8g+uDTX;ETSVTB|oz~8O
zr!|@LstY`=4B%<){0#!0)+F$>PWo(*7c1~{Gn`4*El!$&oYQ?;j8Q2d(51mNz@@_9
zrKGo_=&+X9ClQ~PsDZthMjIiY9@4U_{*v*Ni%>gLUc%l`9Cuz|%xhBlWVkhbi!uLW
ziJA#)A=6!uh05A4LI?IP$emC?8c9}u0K3SgSmR{7LMHR-s_HP2;a|iUyRnvhQq2$P
zF(YK&IJ`6^{OQTz#!K#RtGhR#>@1dhx~~_x9?el({OCcHKQ(d5Z2b5AyTYTq@pg%#
zRvue>_o>cuX!wYK0ebLs?XZE<T(Ka@N8EPME1hjEJiMR+-ZHQ5JHCn<e$j(Ept(yn
z113TErg9kn_8o(`B6W~hG>oga&8aT~yiu+|R-tp>y9Q|jqoAOIS4cCjreMbCPl`Pc
zu<n(6S+D0NHc}c*tq^x>2tuvEcW=n58Nx=(KgxA9wz*PDmb#jNRcII^oh7WU#x<}C
z#cDh$?Xrw+(g5zExEcZy<US(O61Cisee>|a>XgB#r(=n)GDF#T34{kZlLR*Yk&rdP
z0-3=w=2cj9;8ypvmnlQ@#%B+9<%%*40()x3>K*HXmfL@;Jg9!H<XC<JhaI#2$=RW^
z?l%*@Oh5(UimiX}4ZbU}-`npjZ|_d)W<vT_;r`p9EXT0*b?&>*+9|<wz&GW3fUYj(
zKE6Kj(n(d(B~jiU?cE{+iMv-HMDJO;r1uQ+y`9K-+TK!EEYBHz*aV+>wSB#vi~=(V
z0*k1UL2_Ufm|V(scw;`#juJ6e;>v{k%PKg9qJnoFdb!rbl_1+l+d<ltMFRu64_s^^
z<WhrkAZ-{TR`Lu^&+S9$JUf7y@|gD$0sSe~d#330FZ)rCFs0}X+E(gZKVLgnAE)7)
zDLQMQt3Ky02DCln56}Q~QvGeW$PAkuZ!UdDtxb@yQY(akucVBX2)uy0n{rkefi$WO
z(511Ab=CkqO+c3}p|i|y^uj0o=ghxuLDC3x>1d#cRG%RF^>f)3^I*V&O82#r$iuia
zAA7lF>4ps3aJR0NapPRt)jipq>_ons#K0z%<PIfjJ*DyS^;{bt<VSa@i5SK(R*B+>
zlur|$*H*W$t+h+QkcIz{=JNphQEU(zMZ$R&hxqIF-W_E)N$us?!Q4u%PM5~5T&;W6
zH5}Tm2l6$j7oAqCW2!Kq{?2x5rP~^DP1E=zCafjm{5uG|wfPYw;wHV~-8KYlrn`iu
zu!hGWn_Oy}aMbMMIly3d5sAS(^4MH>9pH~;+rF(;>#zL7aaj*CE9(e#&b6!Jot7S2
zna6%GL!p$&ep<X3is1we>vw^V(3SbX1qw40UnMA}t?vmm!1QX@G?wq#XZKmdWL05o
zii_Ct4Sle}Z8RKNXU8}Uq;wqLb=fRR3udiag}`wvzVBd-p7u4}W-zCuXk^KHu!s}R
zk!h_uWUcyYt%k;N&AMNKaVP1QboeMxS&O%5r5eWSAO()@Vb>JGN`SM|q`8Bon!5gW
zi^)`tuNSmi;(c7|{Ni+nZYF?-XeNk9N(<uZ7SstsJBVwAVNNsJ4t<J2>ebusiDVo>
z1N}<ErgtS{CvipPaekw$1(O)?vGPZ&vrUL4^f}Fi(`^RD84CP7&6YF6=iMAFue}lf
z8@k|?H|j-iZ#&q-Q`QvbT8HLDaG#z6w{3u{4&X?J9F9xs{2I;qUv`LhJ)6W9=Y!-$
zCp&_?JDO1db_<y{8?a5-lcWs@dgi$zO;AV~QRNyVk@*CpkWad+U;WJrC(Hgj5Fb^(
z@6N-F-;5_1Mj4JGa_opy)C{u5Pxl8L8O)zXZ*L}O3q6iBry~Mi1sZ$zbr~^G$*LMj
zT%IBovb-qmRn(I|eNR6K!L{kZFmr1oVXWm{a|e3Q_6Kxftgov$o02Gl$G7#g9yokM
zh3ci_fqeqG|M~=a=-YbR&4&6-O%po>Mke$!N%sIFjZVXXBzp4kTqTq1p{)M$to~bn
zL)+#BVU?LqlTRP+W(0rIOuzH7QimVhBeExV*M;1FAjt^ul?cf&u&!491Fi5|swNI^
zub8-bKKjbJNW*rQ+x+uxDXr<A)WKh-td(HXwGr!juPd%&ht9v*t_kk&auF)7?*>ly
zK%5ubc$DMEIZ6%8)$$)WI+e(7aoC^{R#$u@KOLJ&9OGa`mnA4m{OqFj6Oboc=9rX2
zmJKr2ha$-`8T{0oE!4)Wb=}DZy*Zj4LjN=gQkx`r9A0#GfvCkvlU(Mv>X;C*A~8ld
zq2>oOkog(D1=3S_i#*gyJ|P^I=Qhi)eVFU%Q)>p>?mTOrEhu5jD3K>^1pRn<yeL7*
zl1rq-0EQjycjXm*U=$~cKS_ttJV01x;#JjZ4*qF*lB==~N6R!jU>il@k-N;V3l*$l
z=VkN+i_JHL>pBx;CkDGbmVb4;Jt|zMor?XQdl=tDI8JNRihWALRk`KD6uI?}G1u{q
z6Xh}2napzZimRI=4$v15&emQy_g9eSbNV@rm^7Z<MuIzAf(T2cTPXQwc|PAtpOlku
zD*EF!Y6Md$&Bdp}&KUL$^x0z9L)UEF3n7+Xz56z*#5wMm!E3U^gU=c5AJ`kRlwR)8
z^8j8eey%&1Z}7-=PHVKiy`LksgcgCEQI6(7ZIB!-<u~cWJ*M`vz5dB-iE5_nlb;kV
zgNe4s9!U~{;hCPGNN#cMlH3%a!G!UFeLxD84P|oF!&tQK=tRuWJjzLt05TZ&hnCO}
zEhkG=%wXWug%%@p#;*<+fvbCUBO)jHly@bhHY=hhWum9aCGGg}-mLmpy;_Uy67@4B
z{VR_ElEO&d`)CHNw<2wKxD56^p(t1PF{?yBOgQmc<*Tzy^u>_Dkp-lc^EuKausDO5
z^z~KCAbRy8v*WZUWAl7L2ZHAtF~7P9<t!(r(>)_zkKwB@hSB|pu&~0V-TE*V_eknK
zLq_0R*E(m%)rHMRR14t1rRWi`r%>2AD-m#Vf`swE-=a~jm{_%uRhJwR2I#r28MDe(
z8gk#wm0GmF{XR{E8Ua#AY`;f=c4w6pdE_$yvZyE!!A9VImy-OZ<ZLX19m%L1SPYBb
z7pvMRGk;IOR!)dJxTa8cF#ofx{AXGHEDZD8KlipLzm4u2_{hXcoCtj5-&QYC3WPtw
z1|uR$5eIwd5v)NuBCt*c!|%^u6C$w&3821#C)gm?*(_D3@DMp~>;*L?wCv9m1~hG0
z`W|EWq;x}h>`eVK2%hR<(7IY8UJ^=@pyB`3fjTU|UmV@kNJ5^JW3wq->us=xvks=N
zb)Btg0_P<2gqjAuG__)FjilH@ZXszqsTXF5FVB9LZuEy@;z1cus`{5(?-0gSaCElN
z%;xesA)|ka`iG*;5#pb&2?P56JxW+T^mywKuj0gb5^}A6aULx<95J!ro@k>IJn*s)
z(Wf}IGHlO>_H*xCx2G!VqH@88=&)34NFS^UYdn4(S!l>E?V*@{6kk<c7hRT6*G~(j
z{{EAzbs{QJQI)g{x_?2hU4_$nA3@wN&A}dm>07dMM^Z%}kH6&~*V+VOx3aa1F&<lq
zH_i{NE1O-S21g<rJJ88J`YGuP!vcHX9&ah<gcpA_@%9l}lG|{F89h<bEn(}Z@6`B<
zOrbtK@t}Ac>HagsQv@9)2))I~I*^wG5fJeiR5({^$=TNZe%VhC*Eiyvd$)Jmu8DB~
zzHyG+P&R-IOS@S&B}VCXoKg+P3~K@%hTcX=RJ5%n(XQFu$=`kaUIcmUiGr1A3f=#T
z*6p<v$Y&=t@POx2J?hI#HA*V!+TLS<I*<RNJgD9O0fmM}C{RO8Jx<8?;Y^*=cB-Ej
zU!=xr@)pZH<w56B#aye|hw;dm>g~`c$n&Z|e!q9O!XMVdi`{z&E4_vE%1URD6h#$=
zKLoN)JD?5CBYSHxH%Q{?CpddytrH~njMrz4D$4iP&j!vOis(xh%}|DD6iy`*<$FXL
z>>YnpMdB=u|2PxELZ!^bcG7y2g~PhXMqiVIxED@<#V|EJLkP}YY03f}e!ZhRl3le0
zOAXZ}au(J{33xf$L<$GvFr?i#JN1l@wF+I4*JxzFvBT}S(qR2zL|o9|>hp6+7yLjr
zbv4p2d*GFFVQ%0h$>r)CV?QkZ0j9RyeEqc)S+WV6T09+3o4?pc@%p-K(ts~}=Zzq1
z4=hlUm6Q>eIi|;|0ROaBH?peVNfIlSsw-K|jXc;N<MwE=)c*`Bv8PI92iZ1uoYh>B
zlb?m{!6_K4@RqH}L%*HU!@mM+9em$>igNPVM3h-3GjyJ@<R?jcl17E#`8|uZkR!Cz
zAsKKI9pfazx5(tOu5bkP!Vx|C!jt!cXk+g&R-t|Z_9vnAbe{ut{6@{Z$R9U4FzisH
zu%6|ld}y{^*A(-bUx2#?;N#`HjjtoMnly8~dt&nfchQYeGr;L$SSVO*@KAe(WG{+W
zQ4LmiDhqo^)gJ>JJ^qWhiZadRfF_8!+>_a)(2zCjF^d6<ZWJgzy83;P?;R{Xtlrt~
zche4-aP6Hwa=v~X>s|_xI)%}1;>^?B@+|v5Xqi6RVuT*EtKJ?v8S?%jSEJ0nxEdm>
z9jL%*qJlVpzenf-Bok!IR&+DA=Z>iu8N(-QCWk&R7T=B0vL^wQzy%H1I&?6^o*3V6
z2OlMq!I^QK+pikiLh5jr1rDr|`A0@?teowaBkd2gThk{z8fX7DxQri)_mjTTlE$4m
zs7PqED5(f4i(}c_{>A%cQY6E#YYD-CgBN_{`Fx4b{=rWb^s}ANRFm!&@-uF;qCc%(
z=lT&m^UR+T-BiCk{t4Tx+*I8R-`MJaAW^5>UL&Jkx#9<)abW~_u`Z|yvAih`45(33
zAnKPJmerS-lq&&K%A#87Q^&vYvbvieDpr)`z?@Q67c;}DYM5`YS60`cmrtfyn5>9I
zTj>Sa^FZ|CFT1BcL$nGJ_VdGI{z3g0_DLEy)_mc}k`;cs;-<%GbFL?pWdx#ML{{H)
zUv6zQ7hy3wv%yiwXz5^X0TXAmR;20Z113K$@MRJx9JCRBS4C@k-JO_*VO)bXPFa{#
z`(1fNzffspsp(dQTQWGIUBquaa9ZMTa9Sk*E%xCBei`vDiC_EM`5I#85s5c7o7h?u
zC6Ps8@LC}wK*Z#mSQ3=@eUkcgCtqrABL%dOQ*{BCwS1ESEDdOsCPbPvy!Fa=Yad-2
zs+N5Bm^-n7p0pjM+Wc8KO=&{M6Ar_rnd!gx%kmSvp2tndYy=QG=XMp6O3aWyq<L|O
z)^k21x3$Ct{o5y36fzI`$P(D+@Zkk%JneW0-{{w3AtlL+-)j#rGZ<@zlGJ{{aS&x(
z3S~s9iRBBoO_AscQq0XrjD=vlVpjEY1u0s1eUOwXA)@@6DkSLj7exQvSKwrH|HIbh
zayt3n$ne$tU+?vwXy5l05aSwN^OZr9bWaENdUh}GF~L^ymzNYGlXp+YukY={j$Bg8
z(=!u5cBDtaY?@=1@cQ-*I~kEw6rB~Yagi|N13_&d`;?IT&@<E*AZ#EOp_%n9o%Kpt
zY}Gpr1DeV5of|@$)3Fa4G!GnHKW?FzGV~t3+bmZc60)m~Nu}Mx;4C=UOOY*R1D__?
zQXO!5sBNl8C-DQh-{GV!3C#y+*^<dG9)5MRp5VvCU{VJ#Y8)x3vpx_H8sRZ#Nu+pW
zDpDzC7kwwaB&bHRR+anyI>?2ZUlovaNTp89NeOzJ79Z&RmH!Whfo_^qShSGE07&{p
zf#~ZDcTh}nK+f4{9_CyVH=6>Q!RbAZdsPNJO(&F@Ge>2R439yOjB=0+M7uD2=MeP5
zql<^~H&;nbW-4vQGch=Udjo^JVwo6kuJ<9wx|Ay8ed|r{Osx^ns_y7YB3R?TW0UT|
z?s?(LS&p^Kv<pX$#`KBDozBhF^6iaQ2<XChWc3V-Zg20G<LYNsd<QGnz|F_Wj?2t^
zqj|W~Q^I<(zwvdzS5mj8YU#G2Y<6lg@dWX?ue4#$bffURe^G>&Oq2tM%7f7*?G?tN
zgnnWnSb!6MgtmZ7n>_|jg2oJDe&>&OQcI(!ipXftydHXI7?K)-f7Ox9;2%Q5BOWfe
zgP}V1S8B(pegLP&x)yZDve_%XUU8SBW$l*pMgX672?|WQ(__*K9@b*f3XU%@*a1tc
zP=dwx9E_tnhixPkPoNDBCs(z6Xw5P3pQnzm&Ncwz6>+2Asu1L=*Ug5S;ty2i9a?=<
zDo*u3jd1J6kZSXoT1$ge7m;eqkr=Ie_yE5c4K2mWRKkZ^u-Q|&*XACFh-y6YMoWW-
zVs>3w24smbUg@D_i=IKWV(IV8Ku6$6=QyLpy3#1dl(fJg=P$dIp5SsU3q7Q*A_30d
zuuByR-#S23z;{6D`lfvNV(3M&wx2cpB~drx4U<GQTL6vKH#pSO{3lC)MCT{@#obgH
z?s_d@&I;8DUWb8@_v{xC@>XZ&xcH4MRb>Jp?<@UTVaQqG7vy~%R#7p7biD!YYg(%H
z7==3%6R&Oj{%{9(wv2LSb5<>dDe1g45__pt52c}Z^_-HzeK4mogp}z~iO~1UKFSL7
zmDfbp*?igxkQs2mYm!A+Ru@4Zjq#n<gK7p*;Bh%wyXEoD%#|NM)TzZ@fy5U1j=5ZH
zoc(o&yaODni}Wn>j@*c8ELwohH#ac|hrA*5!)nT0AZdq3UsKVdXKqwk+?5QeK+D;W
zTm>Z+wV>_HQ8+2&gqlKMASvgD&Tkm0fC8nU$9D9^?{B_~2IE-VuNoKq0^o&Ary!pa
zSV}jW-7UG=Es2>K<!=GSDZnb&Qb?m0x(o+fiNt#OpoCi33pXxB=y6hN5Tx)~1=;s^
z-wC*5CWaAf2?B9Scko5`sAt|x4o3hCtzLqEIY5k0c>D}?_7dyb@~al==Ec7tW-X>a
zSG4DfHagEkK<M;Z#LhW|_;6)AkXd1D*`BNP6ZrKi60LnS{qpZ$Y~_YwA0%uI0Zdq)
zF^O+`m=DECyjAx0#=mBb3(vPED+mw&gz={Hh~@-cN-ZhTUqI~zE#1CWQ`<DSS>Y8n
z{`+6H=lxpk--+uIW!^(NdF<~FC&*)-S{bygO4o0YMK%{mk)5t})H@L{-(52~N_zLm
zFaNoTk5X<&1Y)P?9>TOe6a^kAq)G+4wk&b$K*pvUMzZPDixwAa+E}VKXiRiA2J2TF
z-SUp=hZDdASi5*WB|l&0c%>ySns}MJ&QxJ1k3ZK$FNgiyd!dY%H@rOVsSj{1uVP<D
z1mw262?_jmm0)w2psl1`7wKtwCnE5ARD}0mn1a``dvCT~4OQ;<?8{(6fuEDs3|-`@
z^h$+DEhXct9_xj=VMIv8>A!)W2?fR6!*Q1Ad9GT=xDEc479A+n!a$Q2{Qfa;AP|ZY
zpfNHHcYBTYM)ed&R3uXt*w?$G$xpYxsqo@&*j`-9(H6hi9K4#HhuZi}w^+5S6Qav=
zTdgD=Y;FpS>uJ`j$wAlkL?8VOEvVY3%B=iJ()`|C3N`;h)SRMTZ9DZn`ii_B%QQbA
z)P!RA$R{+IY+w1~Z$M|JHaY0<>tfHa>h~+7?495uXxw8i{`ImgjO&0Lhu7FsD&*K_
zX$*vy_qXrEZfbNoT-W3_RDDh7tVbDH*!Q9m7?qemOy4NCZv^V<Hw4ZfE}bgE(Q(5Z
zg2_UB8znxkTn!}8MDz@0Vt{`IFV7S1A@c&`sWs9F`9iNWA~c_#_;lgc_Qdr4z6*4w
z!|&R=l;>gNffr@l_GOSFrtpck-5%P3bTi-ejqZg%fhyrCG9m;&H_^7X>9Jl$NxsYp
z`HyNmu?wmzfmQ_G4)@jHIzOJANDs>#Lb*bJtVfU_K`Z|8PLXKS!viu3+Rnjk^++83
zqCc~VuB=IYd6ZfuVKSvA(GSex&;qXWN~ffgo{A}Q)p&|0Pa-IaB|dCHb=8Mf2TsaY
zHligjw9#iA)a#S5hZ1FIO^Q`$_jYdWKC%leZ-Lpkp0U1Ff>jC(NmO`&G+R|ro_qr9
zNd;*MtcC#EJB^TU=}r-RaT!HFeYTTU?j{qlIH*0F>I^a)1sCi6Ocdr{j#xe(Z%Y$p
z$-lJ|i!4JI%A_`<iNa|E>W;DMSC7&l(qjvBj=v|p2^S;#8kKAZ@uAQx5E$@t`5<r%
z^+*JmBM`<wiBrptaWdpaf=A2>@w|ws1@#<W4jX~DgQbcoouJ0;b!?l2Y$MyaNlKCO
zi)Ha@_GPa|w<fKl(!$Mcj5JjsfxG$Y)+rx)>F#pHR@dXxQ7&Y-qG6m7m`y?t_Dqrw
zS6r<v{L!zRJw119x!MHQr}>;aj>_)s#t5~J{0I_N7OYg04aC3;Z56NwEIL*La{M$5
z&CPLvH(CSyKtpy&1HAuXLcIlUMm@3uBV!=v@%-wTE)c;p2IetEDkrny0e_VzvAv0B
z?C~9tq>YyX{<4n9F5P7pa0?IQWqT^R#|9iNZ8*REuFkxnbY9U$<`SnrFXh#$UOI=`
z#uw#wT^qb@uAL(U$)FO=Cro$mhVq)>v-nP06NrfC6_i3v9SVk=t9kZE*a6@J?u-4w
zFZ}qFef<~obshScSBuFq%kURXU6e_sho*)}wj<4B!i#;A4(bB`Wygd?a|^gKrWi`|
zEI*MjQeDPC=YkIp@V5N>IKPkaB1-M5hkAM_D%Dd;efK|9eRFi(U-V_{G<IV(wr!)a
zZKr8$+iaZ1HX7Tu+1Pe7pL~Bavu6H(>#cXsz3-g8_u1!O8btVoxuYd*T#EMgY31Xk
zdliH5AC`s1NsqZE@)`}2@@e#rOw&*gCbP(ODShXQ+Q`elurI<RuP6(Um12vLvG#LZ
zFR)Vid&Gs%0@mRTd^lWzu|XW=Gh}v(XcIXRcQIGt#%K!7rJA9?`a%L>J;;~OC0F-a
zR6C;kn@U8FvoC0nCg5#Yb_ywsG<<U5kvcbIUr%vbDR+si$4FATt{IAdHGM^_8xpV}
zUaJ#n#81<(4bQnoD`%JC8`ZPJPwrNV9W^cm&|_xd0kDxNS}JVnICv?z$)Sd&A%$x3
zg_r<(G%a1B=}vc?<CR*-$f(+4?vqQLJ*(a=^6rys?v=AY{_4zg6aaP>v@B2sd17Ee
zS4I1TJL+{}-|KN=Z@|0YwUE@9lQ(({uIyceV0!*ouAs@`j^={AO1C6qaMZMRw6RoM
zUlaBdt!^XK+iVImhBXhOd=8KKA1iby$=aV{eUwMWIJABUXHAkwI2y-?U|v{+J;TSy
zbN(Q<r@wq&M6vyUe#h|XNtc@tgIj25q|`ae$y8c_um?QemHU7tG$cSo4H7}Ez_iKC
zPe-|E=e^s~)D+rAm~H(r<_>(+o?rEM%DI5eC6!0{PNF#*3|w%9b5BrX{UP&(`ieI`
zYokV2@*8eli@Lh$!w5_IUzqUaGXg=-8>X~Sl~A2HZ)+x38*G@c?Q3++(QY(0)PIn^
z;2B=WMALV+jD<Z6DsZ$6k1N=1^tHnIa%aWFn7=R5EHv%~V6hWv+Aa&0LKG!u@!5W>
ztuK3GPh2g9hzosCe+B!ONXznmv|Bf8>r&X9*_*b7oNBM@0AA&esxWTLoNW}Vp6Q||
z-2zJ}i0xM<bn=tN*RM1tw6kGf<}@QL27f#aWGcN`pT;d*d;4kVz|Dp6r|;nQq!7z<
zF$^S({P!)=4`bM&Uwx;w4z``VX^<^Y{3(xLye*(pX_F6wJXHR=xvgVS9W3v?cD%m^
zpKHACLGJx*VmRr%ga%(vJ@{%v*tXaiymFUqG-dRf3wrkIZ1mdHhE&)X8`HYcH<?%K
z8U2A!Uddj5Zq9K1LSD1#<6glI<cs=M000eIMN&Ue8~0h|-!N7z)~r(3tpWh3wZcXF
zbT~bJgZB^ATfMeKU7ODsiAl5PG_1<zbO*eLX7+G=HxX8Vj+hl*4ZlF3;IHMqu|KSB
zKApaaR<Tn<tlaT;_S{JtbjMrhFKnMiVT=_%b`#eOlgABpd0s3YtM3GpJk@wx1m+g5
zFGtGy^nv!TLybMnz(X*MtLMyG@3N5HSu3F{cuHD+Nz{fN!Ya~l>S|2NwB$nBa&kx^
z7yA$z0v^3J_%&1?_Cl)2;%ICBiBwk*|Bx^qr%Vz#w8Fmfe)VFIn_TjO#$7VG*k<yt
zw=v?_Pt|AuiG2p+DO-e=6A5AoE#!hFzJ=U0DKwB5mb8k;k?Gq*4ZCu57v=m!h&!JM
zF(|SMM`bVsMq=MEtcJK(m8=&?r-<PWwS|@wHTKz8C(+(Z_P=^Mr7W{6dOInhUOQ<Y
zFxF(N@m{h`zB#-sD-%+Jd%se$g>?R?!Ta0h{I@*H0r6^MnRO9l>)yZG9>0xc_Y}(_
zu9^vK(qz(v7o$7@4Ek!*<#lN27;}0gGG{N<$Z|In67TP8fOt3M%2;nAYTTui`!EOa
z6G^v#pBUm5S%s}K2=y$!Zx~lC)Tt`k3H-!L(yhO}4QAaO3P10mI!~L&LADB571Tku
zl)=69F`v>|aOGJVIJ}RZU+PGH5uF}+STUrrDP26bI!C;(x0ct0q3V(SmGtd$s@pm)
zBD+^F67nbYrDA%yjI{QpF(5NxImuZ}dsO?29%5rhtw6gBlY#sDDS)D2bijv$6$Ork
zY$mS%Y28?I*BUP0IlW_(lg^(kJ4FKZQ(%`G2Z$zFZ3%rDGdmd*HIfJ_qErQm6fHnB
zv&a_TyZv}a7GA$C1IRljKu-GB21AmUh3J}GXt%rxn{RA-^^U2yQ!<3;VG2Qr72-M>
ztzTONae}zu8GO3&PjuGpbsA&SgtB7v`wmTRi1|unWIbxhj;8xOBM>p=zRyiXj6BH!
zU_T;o>gT5w`>2)rdYvNkLZ;$$I!bq5=vd|%i6{0Z;jG-&ndTib=C3e4ksx;C1UXI7
z=&knMRB{rA8ShjN)$JqPzCPEft)ka<w=itcUf)B7dNdNJDY5)x$suV)zRZyr?Dtt$
zN+Vai9nNH7y*`pnO2%*-S^7uB`Hnb0Nge~+o3!8?;+sy&u~g_I951a;f$!=vB{0XD
zjDJ1lC1o=%;8eeb@j+X`ULJ+`5jEO(rO+opGb|7}MTd7YWnMLTVk-2DW<aaW$bOo6
zFCr_+%oPLv92c`y4wITPqt-aqKfYU<8R4Ic>pL(4pG-QhetYMCOtTmg<6<o$vE+f)
zG$wP&dq|f=C{c7OJb<w2!jJjUlF{b-W%xlMgRaK7o^_bQrc<n#WW47ggXKtTCa>uf
zjU&>5`JmiQ8y>KUgl_iJyQD<1n8<WCi)K%B(u(~$%9g#(r!(4a!Aw_Hgt9p!qDSX7
z3&=NjZG#O?d=5xc<Xp@DzG0Kxp$(RLnliNiDLtfqwjOk<N_vZ!*>&itk^1%#Qp-tF
zf!2e~@IJd9)_m0b{z&7ZS|q@cHRvb`SG2`WJVNGe!{;5(h+LW4C<%U}HEJ}Ljv37S
zyWU0n9qXWx%12tg^1;PK<jto*7<z(d*1hgn{bKMXq)Al&Xf)qyIzQ6k$!S|<=V*&Q
z$_YloV9=$nb|~2K>jP(&hTBT_|1>5h2t%rJ&a$k<(Ei+&q7-ajeR(z01GfbKmFx8o
z^(L&NF^dBK&Iu#qJNPSx<t_M(<@uotGMfWtn9%vVK?>zWfA4`KE^B}zvxKe;%a?W{
z9YyAEvhw0(lA8GJ>yb?fo@pLPYxWe6SN!(`E^CUa7FNo~0bP=@K1$CQb%j2^N)dw@
zpi}L4q2wBW$v_6^va|l)Sl7ifo%`#mxJYDCgybn!n!(EKlWDaVt%2FTBE_N#&cK>k
z`2eZHg0b%7uU00eXnBsnE}|j>y4)qmV(6@{g||N#W3}CN#XH+cGx`+FjICc>d1wUI
zN@26(z=gO$8?@GCw@HuYFKB|w)H;26sNTo7Odh_amPLYg_Quym!SW(WJDnf~nY7(M
zIKAs*#-fPijnnCT)XSYSl|#v`8f?v6l+7l%oj)}UGruy(=7Z|4YY>w$0sad@G@s8E
zO=T}6P(C|Dgw|0*>=&D4yK6|D2OOh#ng~?~Q!&Btl@HY~>1pES^p%U8CW$)zY$pp>
z(-+ZsahK6vNLA4#P3`X+RTvAtT8?zY>%17w_F|npl@4}xko6kyg&nDt^R=LK832a%
zRuZM_3a(TXTxDmkKs>35eUA)1RMyz(>m7=qa|-L6UfC6*bsIl-^#A5Ch}P>ST+ubP
zJSJY<f$E~;xqsdQ_=9fomw<H9w5OHSUm7(LW3579HnecoqUJc%2nZe*F{c#W&1P*C
z?sXN9^rt}HXseL2B&b?7<zsEDXj?J$Uhpgr#lg+uf0<tzJ*y-jRP(iW1|+b5W>)ch
z)5)(Hc_M*C0^f3t8JhGp4H$lGNZZymw|HzhbZFVOAf?q0HS2jNc)FbZ%5ZVV`%%kX
zSvKqPuype{$zDBs+uZx3=?{Cgyvb78(Sb|{hgvpOgY9MFyo6h+Hqlx_c2oZKI^tZG
zO^Ds%WdEkwYL(oKZJPPTMS<NykT%!UT7y5&Jh+l)mr4%Q^aM?(rqlk6#9Dyzf{FmW
zQ1tFEtK^mX@Q;5SRJ;GvHRYq<BY*r+{20lm4>in1YdCdK)6SOxh`^oZiK*|C4>l21
zSE_?%Qxw!l_2$M8Hf1g5%7D7PC3As8RBD#N>fT%aNHGD#D1#M<QRQj@7jp)y_DTVl
zz5_R!S<bE}{Grzx8YiRnIETYJoOaEhACsmJfo=9}FtqCgww+!Jc$^YACt3W=3&mqL
z+g}M)eZkH1)eT=WcmiPF&2Eq76w63damF>p&%6Qomir1n#@GtsQK$7X{!jgz6sv_h
zBmAPHF?ZsjHl!47?BwOKx_dF~`1x$`bXrg-^getnFU97?&gPcD9|+o@YDQyYE0nAQ
zOCGEq|GS(0KMfEG^)`dHuH)Z#9{?%p?QM6^$ALk2WikhLi2EBl%(w!*RytKpQHY}L
zgIGU7i-sRH5j;rR^7&8dm?67jb`hhXFp+v}rNmgyXrKC8>!=)K0q|LBd?;lvPnM+f
zd{n{J@9so&K!FNu08Sj#Y=o5-wK4cCz~YD|{2HhO8a`nek*zhH_XLr4w!tal%A)-*
ze;X;w2X&#QPJbJ1e;a`=&&Y=v&o$yOIi_|3N%!#I-am;`*Q?VD?^#%Ry+O*VQw=SL
z-cRZqNJxF!hG|c2z$eUPcWa#BdAs&C50)EO=S7eRbjNYr-b75pgDILsRzK|+iGF9Z
z-VH+W$V2f?CmcfGP&7=2i%n9J1EF#!519!}4Gb%O%>Mc1MJ3F_ft=r7ZL_@H8%=BO
z$7y;KNkbS&U{S=}az*97I=aXI%pD4qNs}yLhMbt?vL{&2ob)CKc^6gORum)cDnp8q
zI`DxI&!qY#^`#W9_ez-zG^)6nPEUAxbb5Cxp~+{4xBvLfuut330lP_+pFcu%X9)CU
z0T%(&14U-rmynT?z=eNS;(BGp3}e`h8hr+=vE|&wW8<zano742)<D3Me44=@<YA1|
z?~`SLe6lPs4HW?u96T`W<WOS25D>L^kWZFH?l+|yGLLY#KT^G!YY%Yc>D13|_q3~x
z;MQ1Rrvm+-t1}5OH8!Jg;6=#PE~^XI%)F)Jz3<-j2#-AcRa}oUzMxI^Ttfzh(qGr!
zZ!j}yAjxU`pbM4D+#W=pD*mc>=8!kYZh(|?u)@R+$<`F6fVmUl?K8rw#04iytFR`o
z4YcSPu%<%&^TBQv)28M;qC>>{>e#=)SlC~*!wo!}dN<;1qaHklfClkS3o;+DQsr=K
zTSb=EN_r>MucWvr?FmO+C{wQqLn;mzx6?y>O?in$)a@Up%1=bYE%i4gC;alcauQT>
z0<8aIEPyfFkghadt4F<2o2eZ(_5-O=7b5b)|Gc$d2It?rn6Kk-5MdAw5|r<?ANw~Z
zk-1R2w&=eO$lw^!3ws1OXsJ9h^EJ9CNa#;rPPE)g@8w8&C0zynrL)fP?I;Abl*}|v
z_kf<r8ecsu4ai1>i;3z69fzn&PW+vcb6_b_0so060RFQa@n>wky4Mgn$j07{pB>OO
zgKl+SxkNa^RDDw&ggOGStzQ*rt13h*fNilrTg#VH+4kDpcPluybb%(yB}JioUBqQJ
zc4r$#C(Rq|3?Ja4xacdVXr{!0%jBP(9~y~U+e<u2TpOMiPjlk^*V{B^wq|>`=|V>)
zy{kMPKM}_mALRSz2u7|@jsh(1=VkYb?*qgN3BGu*$REDEO|%Evr@^))!rTv#7jou3
zm3V4RKNDfUauC=&s-|_0uhGXgO%9;8sPGefH!zcglQ$q6^01^Z@@PLt(9)L)0{iJL
zuq-INb5{HdTI~1tXL!0&0*tKqSH9tD$tcx!At8%$@uhp<vfV1kyybe}dPCb>bzv^|
z5os7cz=CNyMlg^)|K)?3G8=I>6&K+7`8J>cVl*s|qBx~LGA99L{uskV8l4gBwv{ix
zwRG7DeZbT6g_JHS{qMWI2kHeK%xwC3DpMTn&t9KkTZJI+d%@E<{&T|Ga|@qypw-g6
zqetU_i`D!6(a-O74}n_=0TN%EK#uQdXdEP@uHI+<1<vH~F%dPZVLf^2jSh^wQ|^>-
zQT*>6zTZU>DAr!_J5W0CpNm0gY+h(~7*ip#U%@hqQdWf@oA6NAF;Au%B94B2guRq(
zi0@J1`1+^L-PWTGt@pl~_YtSFP;c^`{q{N2MU_!^WECO|?-R8SF*6(`QeZrUlrulF
zlpdI8D!#&KtlguX$>%$GK=|T7QmSn2F8`>J*=9Aahj*V}K)G^Sl!*H6Sjs(#^%LdK
zexiJ-Na_^;<x2r5KWScZmRf1{Gl?es+}Ely`^u_daDR{s@FIulPhR9Wt=uQnJS6l>
zXKsaFmf66LjMsvpx|<jiGdZZkO4uVkul?9q(K`)+n2)~_mROhXsCi6QEYCID=~&)E
z(&T~{dV(=D81-ft{5ir0_riZ-^YPqeZ>#Ggzux!Z`NLT|^n>Rs0qe)s&W9D&!-);N
zdIS8ZG0h>DjVbiS`1_u5pR?7lvwZ!1_Z(`=q@}wKC9n*qEMOUf&Jkr$07Z8OYJtv>
zLl*UqEMOVpI*0DK788;R*)XSa9zZQ1<^vdLB?+H-$em5_onI+kVrY7}yM&EvMh($`
zL{atHG5G9K(E<si2T?2MI{ZOGl4s{ZRvm#phljDKn1ZJ1_Mb{`a?dQi|4aFnDnBV-
z-hY%Y2PP)SMtsP8VTk{<9aJ?8>UTw5QCf7(o*#TQZ@Qw#Dcn<QLFDjGP`vp%IWNl)
zSoCP9&13wk@&0Ao6+r+V%b8Z1vOU#@dvNMc=6K%^Gm&+hr&Bs-$|eppe9G!^CS!&9
zdXi)f95%8B54ejVgq(z_#@+@(8z?Drz<9=#kb*s4ko1kDC-uJ0Cn%11#uz=H+#zCn
zBR?_Zj&Bmi4a`!mCh_olcjKmHAcV2N9<sJAnOjPS0VfS8Y<6-e#DBi7PueM2Q?gpZ
z%r40Y^fw_8Q7cGL0oqv+3BjS8H6Mj^FjBwi<p5-S{<OFQDRW3d-eYY377YF;_(JM-
zR1vh;Nn|u!vcyH*$7NxsapHiZa&{=0C<&m=iCw0UnioJBe`(8BYH;n?WlOlaOD<!-
zP|nnqzG~yaa}SfD1ns5zitkLc11;UPzIUCvWwZ2K!NRW<*#isXIz}}5sPCqv6(goB
zFM~|wm~=<ks#eH>f9tDfRMd8~wGJ}<tzvjO^e)PVfYMm+7Mf`{t!X<tN(U#)#KwK7
zs?_G%7o^|KLDSz0u#g>yEc5>cm&Rlt!t+Ch3Ubjiz=Y~qACnj1Z!b;jhBwo^*WffK
z8Jj1XvF>Q}m=`Q%dI7$>$#3Nu{~Xi_xvd2AL9K$au9xhJ16Q@`@8Wj_u3f`!Y038W
zUmWASgj|*>NyOG+-!26Py}EN4PF~X8_|bDT5ND&`5oRk{XEC%4UT`l9>OBiGip<Vo
zjt^vvj0-X{-mBv5472nBQ=J`PsyoIl&=xAt_5w_G$5qV@6<EU)$wrkz7f^I8L>yET
z7u0cUY(%a!L|7rfpkQIP+FjX>Er&?_Txj--B#xWsY$bpD1mP*eb~o@G7!4P`2IU3I
zb5(eMz)Vk`SHc3~hK2k5f&u!TNlfe9u%*36xADLX?je1a;Sfbd@ZX%V45oWY_>Na@
zN@ICiOT$(4c&l7$(#WV|8+jZY;Hn|mLD5Dd!@@p1pMNxwvlSF{tu3yS^%zYuk@9<o
zQ0CY!yGy2k>}J*>iCqj965hjA9JTWJMT)S{AwX}GnULU(_1Cg-z?axp=#cmU-;j9K
zjCkkzg+n{os0wWY(lMZu8bu3qQUOy^S@P&IV;#^*C1r`Kh={8A?4**?RP`)HMea*g
zZR&iw?dVgI%<M6+PI2fTP<3o%b+Kb^YJA*AkiE$WWO=vio?5vy8AN`~h5mj~#F2NI
zEyt(SW_oD8yrYdk?4>nv=e8zhe=9+(NUA~fcV#dsLZBr-&c70`Pqh?OEUREu(MWmh
zJNbqsB#Ejvlt$)XYo;cON++bon_wG^Z<*)T5UuuG<c;RqtKR5`C{I^#w;+lW3>BT7
z__?vRw4~5!zFHLWzhCs68q9<GG={n`=b@A(&_rZosH~I$k&I>iO-sq(LN5AN&o4B2
zn(QGzX1|byZG@W;xNnqw`*^`M#LT#iem6ZcU;fd!@`J$>c9q7T?s3$3>=UKY9Ret=
zN#`fmZ)SEIE<hMaLDa4y(WVE4fp9tj;{|P&#Z1Z(kNN{ZEYfiLY}0Do<{3_`nNApN
zkWF16^Jpm>G$PPpe~a}K1%$_=n>lT=<P>$eEF_kBUT?)Rg|xg$%22l7lT%*sO;b77
z?*Z{B8M}HP*zM8p!gS+~B6<XJOc_400W1U`PnOv2M2}DU*q+cNse#uGa-EZ<Lu+p|
z_G6)I%zDnAEsyR;5lanBc@Dw{1}#HfH#>UDeRW#yM{SZ7`yZt4X|c?WK>`T69f+U_
zi3k_GaaOFYvb+dCuqHRq3oaP^uD{%+BS0N75L5^v+5K~@inyXd9Yp&gm5H=88;|F9
z(Z`7F3u0kCqNC02ArsdO@!Up1WWnfCNf-dnrm%mN_z!d4SezDA;R7^K`7YQ2Q`(aW
zp(OGhp`@I>glBwl3rPmVIdtE@6(DV2PClJGz}s>?rBR3_k)wTn+~6l=FeiX>2QRP{
z5fhG0#KoPtlA{iAs6ed%4wVMD6?`0%N2TG5i<dw{=Yf#I>f_`5nWaj7Z->mpe670H
zx1A5Lct>8!o&(J6Jr*wXz#s5azjh(vOEblCbV7}QE9jp`CFY%NQY(ai@b7B5O(Kc7
z?r<?Rq=YShHMi=pL=($Rw-5)JyAX{b5qaMhI-wX}54mV2vzK8CX}kS;EwELl{6=bp
zg;g7#m`dM!@xY*~$43AuZin-g;n;Ok7{LEg#cT6I|7;5Vb<b7=sP@q=75p9%CRt`G
z7fQ-)e_CI!OiiE1N_V?U?C-P#L5R8i48kN$*<T<ClRyx*c>{0D!ft^eX!pAhETOXP
zxw-dNa14FgboR&#SM&$2Uqbe5gZKRRcGdsVeGM2?KI2EeV{IH#PK(X1F+cb0N6n7;
zG4oJ{c=3YslEsg{&^#vCp6GK=tY>sqzuwcO8}zuC2Y>3tAL~gaGYn2E>AKfJ?4_^r
z=mE;42duW+cP*6!H<u_oia_xIS0J33o^fd6K<Ehsgb#y~Y+Te8KSimfu#XRgfr4$O
z5f!DNtp4!OX-F8h$W)z3Vlcc-cZ{7m8*aZu5YetJtA6gTE)h#$h+$y1zdWPlh#)fz
zCl9Zbh$M|i!}DTB0xt%^9%wTP_A4JC^ENkfbuAs=Kk(>2*<Zv<WbnRINvQ~E^PHy&
z{(jkyF98B3|NApw;nZcNfZr<|@O#C56Zu^x`TNuFl~96+zMJk?!ux$OLj>@9_2mJ6
zFTH`h7{t(3xX>53YfG|Tb)R$yc68ZgH3Lg+$1as3tm<?jd~*wz7e*C*y1rcbnDVLI
zh}hTj-C`H*q=+L3cb`A@Y1}VD7;@NO!v^1sJ4ixL8rST}=?|0xXx*0lej9{PEQ=t+
zVgA#bh4kp9554+=<Q|iPf7LLbe-|-YxT<md-IFD%CLnN_BpG3qr%=HnWP^NH5z$eB
zU3(H=IRHBwrE6o`C~WYjc$|-*w#&QdTXd%#P3rftGuo3MNvkXpagIY#9|&ya>}))f
zi-oZ=xn@KA-|IhPG4UA-HkvYR;P9{khewe`WTH%R;xiUX_4g`I>7ezzREv0NpWe6e
zPeUK%xI6;m8a-ovqQUb(KL@9V=LW;V=&34ceIi1mJYm>LqG{a9h*Wf(rhmMB?k|6{
z>)1wrGn$soLTe{Hp2IyR!wOdA`hVB8Ol;+Or7KcR{N74ntUOdm>A={JlSK-k!sKdx
zKbJPO$<+kvYdVgFnwW)}o81a_I-hcQH4gh&qH#y<3LwEO(^5^$sV<+*8`Rsb{Tea$
zj*4Fy?KwLA`GS4dXyK%_Vi_H#`7hU(Nn=nnPnCs1=Ig)0jFiGGgeKDZI?<Wlf{Of%
zq{4an_nFmS2^iSagE6%KSX@jN#EptqT5l|2CC?go$x?t(jd%@UR71o_Y=JVlR>%mj
zK9QNlX<)=_0HYf4E+%4)cj+@VyeNwqAwZBs`hXy5i}g(+Ag<vewxN{onlc`@TN&5Z
zBW%bKI-InbOfQXS@=dFI1=(jf=`KgDU8KoCp^<8GyS!9GhTJF0h{AE!${-iV7cyHs
zQFgqBF7%B&_3>R}&xavArdQ@gPTyu@4RJS6&ew(=9$pc`KaSo0@TXLalfoszYYm8g
z{szqxBi)DWLKocfltep&_GUU_6n5_wUP)CF{kPs<<HUax?lBeA;W`J@VFAj)eC6a>
z6Bgv6f)^weSSzRwuvTyfv1HEVT2KdItsv$gIvAijz*^BjQk&IEaBRmC)jKTLfDLG%
zBc7O>gj;o4WoodsZaBYq>C+w}@Fh;6Q}3w8X(kWJ_F!h-1<X;~O>@J=^{p**O#RJc
zYZtr{COJ+HoggeEGk^A`DUEto?#^ALN4q}K5||t6xe4L#oH$&ySCvVEOa@A0!iZQ?
zHvHZ!(xKM-eWBJ>aM#0-L|cnoS6BF2q%!<nA?$!rJ*JkC2_N<Cq8e_%^|uYEci?si
zEu};)RQ%00V0J$mCq3dbbo>|6*KMYmMeGu0&#Fi`bVcl%gzfB(zs^8*6~iyVDe#D6
zLSFO+&B0lOH_<2`fnGcVvkYBU<z@Yx_xIf1Ze{i<J-o&7^wksxD{tP*^k@+)NK)gZ
z^m<`#Z2patl&Z(y4q#)>+mR8cNvTHnZ3mgo`#N$$JSPNNbBr&7EhXm1D(;ouTVcSz
z9(!_H4G>ybK8W6o5|NL6<TXX&rlTunBX@5~4GX3{FGr0Zc&)Tx;DdWbvOx#Jx?o$9
zoKTF$vO9-#v6CQLHYs&{OPq+^vW5hUcTorI2;31S8^Wm<X_GdOLPbv#2g;h(`>kB4
z&iMqPb@_i5xY)_3eAi6ED9+-AFLh!4X(rr_D1Pq0Y?o(rm>i|}fwb)tcYhWWkXs-h
zfYFvwmqj6h0j(M$!9bAmFc5ekACPpPS4mn8!rvBX+v~Le&Nv2Hz!?{T^?<;z4#xmA
z1?XD_{;;KdFtCz(Nmni*f_viNX7fMHFO79~&*|M8Zb$TVg3n?JT%C$$Ka$(80@F9_
z*QTT;#}b-s@eyA8{f)?H#39avxm*v}I6YwszO<qS0KAu&mua1S{ueMC&-kV*XUiU)
zL_E8a7@{^H$@Zn6biz%Xu=X~H@20(CUL<_n?!c{yy12yQ%XYjdzv~jAILq0xaR&YJ
zFzGGiQ0-UcRVcxmVh&$~9z8_J*!-*Ooy|jzFpqDIOu^am<t1XA&SDYwR=E6KYN{-R
zQ`M(h7&^sjma1IM1hqUAix!_VUy!G}0>OWkEpa}Cb#@I8-Ji=sf7EsSQs%~4p?|yz
z^FV^U#ZVx=o(DQ1bu1y8eNMG32{cg)E2qz|Nag!dE>u{+7jN;GpX`P=ATXFa?K1h!
zZ+ZIti!}Y}jv7v>j#Xn2{K}jzz}v$8`ddkXib(r_@VvSo*AR<G#;l&P&8RS}IR4}3
z6TU3XamRVw;S}%HeEnfYQmB&k?U|*x$=kX+#eN<}qo%Sf-uU$M6y<?f>Ke<v5XD8{
zdBQlbeX|5&H#0xoTafxQJe$TOSjLBxr;{V3N!-w%V@F98b@FSnJYO)1WOg|pz#WH7
zOeFL&0vP<qVUBU~B*iV|yduq=Yy{Bh`W5slc<$$oly5d&@cajtg>_45U)B;<v(k)~
zBCH)M3n&&Nj+HBE8zt8z3HNKYE0<H7F<y<DjPzU8PN1cAF>*rHMw^LT5Y2X$$&;t1
zC(<djYc=KmX<JJ^WNb)xid8l^ZfWr;Y76-;*$gd_0>00HRGxX0ed3nI2*{KbfTcyL
zOEh+Hd#tE5tM{hZRkzb^04KP!FaszdO+O>S1d?lkPmT839H-N5P}?1UYN8vn-cagQ
zD?YZ_M<*TnfFWSq$MzF$KUgD8_?)}QANZN3NE}R}8jZC4mHOVR-tpZtEwA}FP~JOn
zT>Sjl@Sek}Ui{g`)dIhlyjk(E5OvvHqt^D-wbs^?_1?f9!-e9lUTuo4IhaV`xIOQ|
zwz>up4>8K~iY-wda$1oOX4c_y&7nH^q@Q>>$M>dk_$)LJUM?;MZPe>b3>P^G_c7>+
z_y-Za^u{5<5#-Aw8s)qXmH>w95nN8JS2c3-QR3s3KQF2To6z6;dXXXh0GkW!>$*e;
z-8&lhmtlzd!6;T0Y;cI%c;pL*%a@JEz79-OeoCQ!YQCP=tviTyZDe%+ri?EEm@ml=
zZd3xOgFzlycWu|z{kLK`lR`5n)57V#i0e`5=nYA6y^GLxd^IG5oF=`;U=I>_*Qqj`
z$9^E&uqU8<Fue9g&WI8bTjbzW%3Nl|iB(?_>OPdlmh_`!p@}u6-{i?|hh@||zLc==
zH{tger;%n55B(F)B=5D_?9zAOoY71hAWHpRI>C9L;_${IT9Sdr?Fxgdz=Vay9|ecv
zuVB~Q%kp>R>fmYW>cHyupzloe*buh;xrTQ$6DU&dPC${`n-E(9T(5l@fH2m+a&<s`
za{wqxtHm%F8U#xStcN2No4M|vs&{76!3_1Zmx<u*qTp?Ro`R9Y*dfDm?emRl{y{!M
zvK*nyiIa)q?eTX$MW+`|UnbYwpYqg<$A%KCZqx)g*s=8k9oz?$;KVCcVx6;6|DFYW
zPuaiElZFNE90~G3Q;uqDmqAscE32UAxfzNu;w`00KI<)=Pm8tTb89|LE;Fi_OpS+!
z(zdhaQvGAeEnUq${-#aCM-9q~pA4P;**3QL9IVJKEm;KEVJ;O=yV4OX%1A7z0d@$M
zu0}J&CL-sqRL)_g1+W;lPXHgB{sP5j3(F?fKI|21V)Q&#t}d7Pg43D-wCG$%kc;Ph
z@WbXJb~*!{EOy1kW{KoA=7X=OcvXom!*JeF9H<tj3SzSQe^aW)%vxIRYchN6b}Mt!
z{qfa{3Rw{4>%`0D=snfK#CV&VlGT&6uCWIx@tSIc78Iwu6W4X$^DKrYFL~YF>e=8>
z%;KP#$v8-Vm$t}2&HteeU2VDIbkc#nH_(@aH@GOkFAp8{f6O0;=9C^Du?&YlQbxsS
zd&WmronrY{k^NfuNWW^Q?Iq!$PuZSFE}h<ayk^nAair!G@1ywEJfFC{V`~d&<6owB
zFTd<FH39$d$>mSXYD`mB3}9Ac0JAc(_brzVFMncImL_vrXseLbn;>=j`6i%7S;<HP
zz8xzb_7Yo~61f+0%b`j5rA8)+n#^`r8+J&)`!e@6#}I;IB%%9g=JxZumY4R*<+SPu
z>)Hkon!joA;U;_Zy_lzyB|WI}FHA)t-tgX7XjQ4qN;oel_`hB7P*Ul(J*n{@u(MG9
z`bp5a{ryiuw_PblkYf`0$*bqq&n<~mP&7)tD?nQ?J9b4lnKW^c89L+C3JP$5;$?55
zUQHBa=zxc_c}TAB>Kp!SHQ3`fKXjLh*)Fa-AUTX3FeGs7221-q8mAm5X_Pqp7ZBms
z=y4TBo+2}iOu__r&#Tj#Q1;Ro#zzvubNu@jLi&bQ;D`56w*d!`!>0qN@6!PU6&guT
z4cKeG01lw-8vj1kpgy1l;k<KoyHv$S+V759!9lDC5JY6k&lUu74z_SRzAyq5=M1>*
zd-69pdFwTaj~c?FYFxA&6N{fOoGSV>f#C`YR(|2e;9a01IyeWV*M##=`-rUG)b3*V
zp6yA)GtCJi<Jok;vo93AjQ8^#CU2ILZ+=_}AY<)YO0GuQ$Z?{)5G^i28{}3nA_F^{
zk9~X=uNh_(D6f88hP?76qCZX?CG(b<Wa%AN5<SM(DfXxyton-xY@51cCM0Y47!KH&
zG%A)2K=)-~n{b9FhBOVZQ@MW;U?1*0P1TfJ)t4vQEIbrIxHu~jv;mj@9-L8sy8g?5
zr^f)U|8hX9YGXbti#RI-v?}&CErq-)obFLH;||b80NaAle3A>0(|M2zU9gJS{yMCB
z_2?RT7IYqOva;9|A&uf<Hc^c(CHs)9CAeCXQ^Y|JsKEph79#7|#A_7`jnX~-5cud&
zJ2}3e3iYb%bEtxgmhMC}z;*;yd~Qcw#0d}38m;?mjgI+MPzO{1$!k$i?R#UZ**6-6
zxO;I;K-JH!C}5pZ%d21stZNFW1E8ui4?b%o0ZOip@p5^Hx;f5hCIGNPN4v}C>QDO0
zF#^4zTc~NU16%PtwqT*vgX=;(9g1{rin!Ng@k>*k&a}%?bKSyd!q-L8C}Xl-2<`^a
zyiXskw2H1pMk5w5#&^#hL3NytSJww8pWOh4OJfi>L&G_LPOF^^jM(60C5J|RCM@R9
zgf(1Jl9I>FKKu=kpra6&%Sf1kgjEq4m7O=fh=95uUbPu#0i<8aq__i3b4W7oQ*6lw
zRY{Xv#UIn9Na7|H&v12Gu6_>rryU&z>5_jAY38V8PMoJ^V=OkrCMPd0UF9EmHZu2B
z6}N}=d7}Qk?yepNlM-jlXcqG;9u*QR`p0Dw_xcZQf^|Q;m%iOXAN>)ejF))di8&$V
z9JZ9gBKW-t?sD!c6)3ZY5$W`E*`L%F@lon6YD&BCPwZ1efpw^P)`n9~!yiwHb>KE^
zJg1!XGuHucI2u%-sCWbWvOeUH1NS3m*J-S1z4#%MQeCC-fERG?IAniLw{R*fIb>Hl
zWN(E_7@h~U)UdfNEDD5wKRh*mF;Lzj0QZ<|U4Z7hp3%iT7UE)JE;O9lxQA{L)7^57
z_Ry5tTKf`S6ub^eUB+<ntX@$(oga+?1L^fdF>OQxyhg(tp0mTdaKO7^b6%qjc6gjJ
z^xtUH;pb>mW^oAt5cf=Aw5iV>;jonC5EyN$7<0dwUr6`Q=G9!lyZan%@&HIqB^Vzc
zxJMJ1N59bm(h+3Ywrpzx5iKuf802*&qgD%Quf{M*>_b|+6~X-2^xhp)Y3KJ4=&bv)
zslY`qSUnIt-I=R`)0UyMs0AoHedd<jA1}gy7k{Ka;w{ZHeA^+Fo-$j;&5eA#yb#($
zrr-Vb{p}=uymW}6(*FZm2f<>I=!pjA*OJ@mbg(mj4h>X_uJ78Pzb1nPPDu!b*g+KS
zg9^LPJ^ytE25g^}0FkIy*6N`}p>xt7^11oTrZO~p-|S_~yl%2|5<#@u@U~oM15_q+
zDJ=vJ^kce|d&r2g)hQPDESxO?*^R|ZRswouYvNIO9!)P2MIGEw)PxQk8k0VI?@K73
zvyYFXu|P{|)ma(fbr5o0k>z(K9^`JPmb*jLWZ!GzIXLp7o!;G8w+-eRGYC7;Z#8I~
z*Z!I%^u1D$^}AG~u;E~kwj-IxF$sa<45kMO%;wKfC6rnRVZINO%0mS$a!#SnSLs3F
z4*Chux+N}Y1|Iior#B^9x%SpmtzD=bZom(JHxokj8>n`DJMUt&PWt}f1&WQ#YN{Qm
zAePm<g6W^++wzlq7l>h41LV5^Am4&kAeI=QmH_$I6>JT@*Ph_C%9cEx_zrkAcS=4@
zI=dyIA^DxO5~j$K_del_E#y7ISg$cF)#-TzW+fgkfXR=kPjTvt^|)faz8`*O9XY+;
za`s>G1RlNC^}g46&$xr1mQwt5Pkg#95t0<Ke`lY|xfS)e)lTHowwPl0Ci^3K*E5s{
z&C?ur-&L-{e|33~=?{I%g_?L$7owF@TtmhvNzb!cib-Ja4bmKtS&?(i0xZz*1&JI`
zGTnyA)3be(5-;B<wr}Jic~})IVieC9wZ-^pK_l=}pa(v43HqmJPO+k-sDPPW@pD{%
z00F(61pU)9haZ8VJZufsf77pNPxM*Lk%3}vfq~4!ENBxcIG*DaP@_MLR)kZX?u~B>
z6s2ipeVV?`$(WPg&bmR5<IoXGH{|(@U^9an3!LRD8FYk5!$NecAXX8+U;CcC^;xD*
zWVl3wd{4OYL_UawnrUcuQ<9_&R-W}b^r^3ek96?wd#@{Jo`ajL+7>OLs{ojuEyLA=
zpj2-`*9%vtbMZ>oYnw^r!w**dn)^8r5HsOM+JUkg)M(Azbja@bCn;LgS?hJnNPHT^
zaH?-CUSu7b-}Z0P>iop6(yd)Mtv6_a8A<GOarX3{D5SwdWpxI_h@1al8p_^c#uH9?
zqZN2-zD@Fb351}l3PJ8?x5bYhs9>P2zfUqpfh+%j3YN>_R~6w0Ojp$5<kHkxmEc5<
zCF*o&t^*Z}mY!<jA2sF@2dy0qt^8NS{Wf?gJ(Z(H(yIG1DIEb3=Q-%?7g`)t*Tri7
z@G-pOwS9*#J78@aej_Qly32b%jdo1?C>{Pk=OD3?XoqRO>?PK2FI<$y(U6daR*K9O
zo<)aMyA4n6CX9r}f8If#NKOzf1kgy?t6qN^d?IgRsZ6(@MU8QDx%g3uTqkfJ@^LiR
z$bKEyDk_!qFefu+@Mp_Wj5wD{nG^uuv^{2YU>P9z^SfzG`zTR{p7%8#rmsUgz+6^7
zns9FwPvq`9ELm<GiCs?;k;9n?W>eO_Kdcze2TqZyZPCJ%n)fR?W2KL~>}RcIsr+m`
zH$+g213A3`$mz0UjFr^Pl|Zd+l`Sv%r_1s?nX=gf?Q>o^Oid|$s61@3mRM_zQVSVc
zEKREW<-sR>^5eNIZ_zR2q9~T{UYA+%^sL29@zjTEu<c{YV4Y)9*Dl|8bu)miS*EoP
zL>2Uj%pu%2ZW*6+^I2paLi&rA<s3$VMNhbG6Hnf6zFs(6zq`4uF9CSpofznti+lpK
z$!ItS$D6ZIk0o$N(%1Nht(w0(ILl@YjAL*pwnbm8GiAZ@(8|Z(O`!W7_VnFS1?=Tm
zjrYvPE&g5kX#)uv`0p2L?R1FSzRxc-U)Hf+!1DC7-Qen*^UQm%%Ts4%YV_nssp`C9
z<I|L4qm^>wp3VJh3q+ZV4uR_DiBh2hPSp3t-|4?bmlYd<6Q#<cQW>FA37ja5vWIm@
z!3jm}Y{t{*RiHU9Wcz6k7q+E@YV6>(YU@D@5bi2i!l%3=6X}?f`2F$|=gP(9#vIiC
z+BMhciO$c;;_4%hgV26@0vld`>UNFB5Z_EPlh|>J%n?+?4{e!Wj^ZILw{Nd=5&=)k
zV6h0)3D6{+7NDFcS4Ll?U=1z`co{!6$)5i-NhdKj4j?T$0cnxZyjusO2hb$<O?z}M
z!1B!8=oJd?2b}=KwEgGP2eI=<Iq<M4;4n)2@TBLk-03Cl7Q-SqO>lUIrTH=7m}Eb@
z+NL<|v;q%_{&zA~_{ZYbW#*Y{E0vUYMs99*d{-0p`{O|4l!b&adw%`gNnlGqk$JMq
zv5vF2b{WGV<>d~zJJ}?L^Vv13H#9L+RS|oJ@cS=5ZBF5JYBxcxlmA9df{b~9IZv|m
z6W;_=Hxg|UFiPBu^FB?h(xLc)FDiYTeHI~IRzod$U2vXlA7o>92C&NGcNVaYq4O{e
z=(^UK%4p*5)T92_T)GU?J=eA2|1|pqp^I0jpDkgLFB*7ZJ|jc?8JR!_u|{^_5}{AE
z7RH=N2ZQ)it<{B5H*r*C8BL+A_Y-qIl?0r2nn88WNZkJ7So9NlsdPNf8y>_qJ|vBZ
zEs;4wx!-J1dvqIz4t3Lg(sg<Wr2`90ARZZicy<B+^m`MF$ckP_9qef{{O)pWF0PLv
z?O)Z5t}N3d`xk7LEees1$w@1zjf>Rb8)$DuZSb8k*qs2M*Uw8vU{NUrjXZ)>=w3=E
zPwYU&_d(h)0j2waaU8V2%Sr+FAMde3VqFsBu|xHW@MY~evh}_)^NPb%rcSdQXW9!J
zOYuCp&!A29YX23jr@NyX7!xl|EH>b3buvl=gq|?N@6pPpHerUcI6;@<0Z8HHJG-3B
zuZ7aiOjw5t#hvVy88b(8_XjFpE>+o-e|@0$3x|ry4T`K&=oREf{fs&H38&35!GWG(
zR?;HuLT^KU{uI?eGJ5yD2A%W$M)joAqmtD@4CmiD2b2|FrM*t_9qL>AYk>cUm{E(B
zp)!kK8fC8sct4OqK#YXbH{{JBh0a{Kp@=)b2_sAnLnK0-OotZ2j>mmXJ=sIWk2z^G
zwJ>T%dtP0Hr3_&JiR}Ohp;=6#fwKbMg6o_FWh@(Gro;Uo2{cB8H2eE)Hz8?egz?=`
z0Ws3GOspB+NbB>DczQvw__}{4c??Yu$b0<#YBvi_;p@crC4C5bvcM$=6|8zmR#Gn~
z`D@2#1dK&KkFKKF>afPfgDt=PbiWUpAN{7b?!y6ulgt^1LAW1-hvN)u<k16*y!XN}
zGzFU0M=jsi5L{&A&0Wb|&T!9KjL)9Zqp=c6nH6vD{7Zl-Sxy(__ZVyVug#IT>VG~+
zwlba+PTsT)`LWr_<)P=0a|p>rfvf4+*p!BIl3z{5E*LYXI0=e5E6D~eZSi9Z+2aZ?
zUB|Y)Hc+|rI~kk0pMStF;~&ygfR$As9s-QsfxqvWdgM7`ih*J3`9${V$G(PBZ?n)E
z!j4S5xjp&LDNb**YHxAn`bFvy$BDP&w<a+ADs}t}QZ54UeR;x=lRncYz2>=cq%Cc>
zD;l&|k=Ujkc&pr$y7;3e4t7e{>^b3@>9@TjCnx75Z2^H_tf-sp@>LBMP4_|S$^loh
zj9lC+X7j6R5bmYejhzN!e`Fwn8Rhwme&u3b=P>D)b1t6jfBVzHT%%SkT9M2UMQ2dC
z4(1Zt2xrYtZ5`MM6dH{&gGy<m%H7+sB8^inT$hbpwJLOL{8^*?Cg4k`Zg_QI8^0jV
zuR_iTm_D2yXohNPW$}Y8V2xc>*d5k9@WKyz6)L7MGw|e0?U?QfDo%r}Buedh@w?i5
z%(I7a<5fV3fCTdYi8)W;pfgP?;+yjbTum4z`j*jQ+0@WBaaQ-od`g^zB(zD*Yi?GV
z?K_mz99pHBMc%!7TlDNOu2u6)7Eck2+hdQOE$_euIEv&kP+LkF4Orf6$$dR<hPuvw
z7nky7<9;#U)tX;#KVy_&5TFh0!%rFBxe2a?{F18OeZi??7%gXN%c-M65YmV9MP2HP
zx|feT@fR$8oO#5aeYlzf7`wnG9Eenssr+P^i(#UcN+M1eGjAdPSf>6kYyZv?ir-7o
zn=y6hT;6|6W0QpJHzvQ|&tzP=i*k{6{zRHdcEtUs5>sF(jq*eIFZ%7W&9iP|yQKmy
z7pR387l#qu+h#t?%8nL|@8IImVqao7AAv54y{t|Q;jknu-Z#?5quotnL?n9FgawOG
zDWe7Z-(9_Va&+_7R^A!oJ8hsR-QMztC2LEW%6+V@Ogn`3CZ6+0-nTf2sB|`Y0-H}B
z1;fGNCgEPhStV>rbeJPX=YFCBfd^FkLI32)MpJe8G>hYcDqno$LN%Z8Jd}9p%`kWK
z$_eU3hjPW+%hLxN82_;p1!G90OK_cL<}=3~d=Hmo(Z|*nO#cIU_Qeu&F-Ub0%JOsG
zsYob2Su}m%Fx5H!pk7VK89e>ZZaLTVdaf;$MbU757plbr;`BQ1bkbZ*my2htd6RLX
z`UURV)a>q^e{rW`h`9^T`^l{=_Q|!79(V6sV$DcDlT!j)z>%ghZoO&W(9w$PPNJe~
zt>6-KpjNY=IwsFKy_eE@^M7XWyj8l&g5;rXvBVGv=3ws80?D96v?NBi1`LXidN+Lg
zA12w0<-O+a($lmzthKV7QT<bbT@fN(K9gFx`cQYLsW9)KN8;%7NaX4pI)68{&D955
zw=XzH>QYC*k<i3?snklDkG|cPt~h|+wVh^nBGQZCjaC2AY25eRH24gN*w{D2Y0I&L
z4ot={Q0W=`H(t@2D746p1U-7RNelh)Kc<$dl+{jP>3orL#YO+<SB4bRk^?ivo&Fv2
z)m>X$D+-8;J9~bgwLAU4+O6O(A<UU?ci2LZ%V1oQI{6wkva2SCsk~ykagG@%4(pS)
zDr($<?Mvfo*K+jy{#zEi_6%oU^6+@ji|HQ=S^X~AEvI>-lMd7fFMYhp0lYCh8B4R@
zM*Mj1OU>wN+&F-gMp((}6UgeH-s)gSXlpLY@TSKxbS4n7I4m-lbY$ZXN2GJzjr<PO
z{0=Vr^ItK)V9t4@5u>obIj=Efo0K}fJSpdV3uJ4{N<1;1NCv#@4s*mhHRE`k+=^)^
zMzM3@!KsLZ*6hC6tv+?GV8xc<Ixq9cRBGR6g*3)<=IQI!x4UNEx|`K9^<XO^TYua&
zO=q;7BE4W-zajV%zskzzIOa?KZwL-Ug8FdSpU+~u?SPAbG&u6rxpKayca$h$tzN(r
z!tkYJ^_M(0oehtSoaj!zVK;9^4Z9aA?+IgrLBBBC$usN*bb~`z%iYLEDqMlRs$~=v
znm`~CO$?F3k3~vKQ=;KSR1^~+jr$Qf0ckvdwxSJ4;{l(|LrLIc;Y5*B45uW+=9Td$
zP$W(R>P};$h^uC_G|GS7TTw-`agqOEAU~%}n!zu{o)M{a+4LMdEEmC3gasZNL8n-5
z(ma;(Pt2a)<&|`5hDf>a6fc-3FcXbD;Z%3K5SzAD#-~9tVh>!C*+aaL)k@BA{|n@F
z`YE)Wx^rd5lq1rP7CX+@+x;UBxabOS)1f@4<gD5{7i@@q6N0#m<2*EN;UJ&XnHgXI
zi8*hJbR!n#LBrhW9#8wr#$rduuw>;zB)+2fCxtAV2$fEqtMp=T(_DZu&!1)@$!7m~
z2P+cK52g99%zlknLEt{tc`^^jBjhQxVqBiu22xst4KT(5#A(cs+n$rwW(NAZ<_7u$
zhFg}CxZ4c~%dT1^XJc4{m<IZGplyNP!O6nOjsD&MhFb<cMsBEo{cLLM*%ysT=$!BS
z=ceKh&MuTKi&+>@I<%!eCK28}L0^VS4Sfg1O>z&8!DrN~qcfZjE3(fRE+M}~zHO|%
zrVx@s@r2R0+<nlh+@}8ZcQi}(2fs}iur$zH1%Wysmp1fwAIbm5*enzR(TNU={wf{<
zLD9c-PDohXrc24-6Qdtd7*23p`>zMTM`hwaxgPUc!&96SYHx}J+WqeT@z`(~3+3!r
zKu?Ym`J0m`bbA@v_(L3E*6^TeXo#t3;-P*HCisUys3kyP=IA#`fko1boeY9H6>2(t
zX#uJ_wCrg8n&tp#8-5>Xb1&!?>=vIQPM}jBcAaio5X`sjOrlu+4m<Gfeuq1@_Tg_T
z`V8QpZ5zWJ&FRQB+bvt{uRN}`_2@B)J4`ky0rI<az414Yti*1-h>1fry7Q16AeyoQ
zehS~|CgM3;oLTmqOe2c~dcMpm9W7d=ujsrup^P<emwDyWS4M@tt*xRNJg3CBE{Z#@
z*5sp+Vf6eu(=>)iMK2Z7Ul7;d#ru^9=E_5!Tip;lT{XP~XJ`}Cc>}+U^Fm#PU0Q+o
z0{Dq?83H@Y!aB2=x+?Hlo}S^{Cc@M^kx%8?0WeCeM|E>nMW&}K(%vN6j{ZHzP(tY8
z=mb6>)yXo>x{aEypT+mwrzV^U*TVB<T1B5Zu%~sy4xe%Pg`p3Abzne4szSQ7G2T8W
zstq&(B2$)KBszmDyD^T_pCN2{#w+_+y9w#YU>f7W7$tS0C%1ebD;k`+7q}sIKHQIl
z$iX2+&$<QL84|oHNxwC*G%nHwWc$HeUOSw<Z_mIIdf&3rn*0lV1>G;wjCQnAGwn)e
zt-kBDHRGmM^3<vc+q2Brp&;8vFb5mLZwbI?zRlu^RXs)LiDtT2GlIhs9m@JXkSVw6
zflTS&)?1c2y6V>kWXcwn?W%<BDj-wxx2#Pj<k_(@sMoO-yW=%XOt+)EKd8;NXXm+V
z=ed7esoU<@ppT2dLs^+J>W=^~CjI1c{QBzOVtmu;uE!t)I}cs_(v6e7bpB8_b<6IF
z-z0aZXjnk0*H|+NwEMAJhmeW=T8ZQSyxn1rB!@+9)n0vN6-4~tZ~4uJnSIL_H0)=^
z9(qA2fEf5_x5K5}ZUFt{(=*)Tw%T-*c&cbq%TB5P90pw3oABUpc{`1PVI^C_(dWgu
zzNg>Q*idTR5`6f^_!BD|9P1-g*b6Rr_k#CuHf!3ZY?%-BOC#_ogZ@|M9q8ZW;CEO^
zYL(EgB+BvT=qke95iqxSt-uRBZiig<_?~a%vQ$n|T<P>Nh?l$)Z<hhRvMG}Y%F{+*
zqzAi#Eda&p*UpX{t0dEiQXF<^3!WSzu^QS~5ANEb8X=oHbkYpIeb$lFqPxSp?-Vp&
zOyQ}zmo8`@IKg20#{7?kJqSZ0z9Z9AvKj$>g$70Jvv_@D2DT(`xL2!WbTxMv*pdj=
zZ*>XZ>VPewk67QdDz;-}R&QbpjR&@*dl=oFpeiUn6iVC<Qe3a~Ca7vz`ogF5K_HG?
zZMk|q>WWcjXD&4FB@O3n`J6zFkOve0iNTKf8&Yb(SAx>|G?c5#2GxCGv)@b1nj?mp
zt%$mJUhsl<2wgf!KgSo2wRQQN`pl&2U}__=9up=)if_fZ^3S#Y(qx%z5L~>ou3P`B
zTtoj8dL1POvF1;>_vlk9ZIkD@wh;K$71B*?3;8~G=rR>IW57m-!=)v9M-Pe;eL6Va
zHCAJ|kvC%?o6Ed9hCMQrOD3p~S#ZZNJeLu`Tp+=pm<t_q5f8vz=m6#t%mWQhh6w(|
zTtYkCr-`k^Jvvm2Ut#U0*#jYf($s(oOMvsg*!s$-x|(Q7+?@cyf)kwJ?hb+AF2UU)
zxVyVsu;3Eh-QC^Yf;$(O!}s2wnKl3KTDN<j?%GwgcXyLFVUa&FjY>Xy!&4HTl>2~r
zvY3CpX<6P<NRBRwk+^$hwyIv`E9J-cyvMH=kxbq0L0h11O{PA)loB;#N$J5KNr`Gg
z&a5U<mOR_-FH%T71{?o7I0UzmcRMJ&;EY%<gY||Tii1Zi)}e{^Liz~LxGPCQn#N~t
z<{UY<E66(&xu5Tun3IxlVM#c83iMY|#Xf(uvILTa8Ko(bRY!r2$BBCRj>4;Fdj>;1
zayA90V&=F%xpNn0V{gx4!7r4VJ%TjZ#yttPOdnhI{s>M){_gvWj_%rLnNq`DoJ5UI
zHJSiC+-PdV+yAACQF8sK^fz+0D;CNWtgj^!T(o8R%#tSxVdQK;1c^(42u2rRFVv_k
z1Q!4ilq@AFNg^-#h@jMocv*7`$-K7x0zt_~1eKNcmi5AvUtmf)=oIfhs9j&Y=?|!T
z#)Gqg#BJPS&*$P>6>H4FrqwDY^>H865xxc{-HfBZQH2DHOH6}o3r|f0%kEX(epfNk
z??~lkoaLv7M`y3hKXp1q)l&e$)ztzBF4$89OB)(XNZ{S9Z`BiBEz&(LfZ$rt*SW$H
zUXRtOl(&pNV>inX`UNCS-LSK0<eF8K8pJs%tSirOuA2VlyG-?J7hjfu>`t42p<TLv
zKZw##MopS@8a=cjZ5q2rtF2vK2I06}LI=0Iguw^<Iyd-Mk~yWLm015oLz)<&_ECKK
z75i^Q34NO{0CvFcggEl&-qJY^Ow1V7RO1g@+@1%gZY3>DC8=N=^(f^I4mdEqJ${$K
z=`}mD5|jtg>>YxB;K7g<u&?yqBAF8kjk94*$ZDAxNsHZ-1%JaL6>S-JcL}^+nvm9h
zX_MM~kOey}fGqS{2VpTJ)puJ1WMR$3PK&}`>w_$;HBj_-*o@Hw&}wP}?Bj2ZpWL#`
zjcmRKH(LiazqSC^^`OcH##h1jT(f!wAM^!aeKAW`AS!aSG-<UHUmP>}cG}@!x|cww
zB2Sce!eY9l)##z<b>9$`V$h0oULk_B@Z|Z$g$!j^N3w&W)E;wA7`VFhZ?H$YlD(@Q
z;lyAGw@p><6OP{QSA`YmgQjKPQ2sfqpm%RtJ=`W<S6#W41R9az)5%fc<u#@qos(eC
zk|*iEZCM7D<&YsB5NiEKVD=ip9y;hho4>yKaIQtTDQnGmX_kEz9B5hU<y*1xBg{Y#
z*0y$i*K3`+9Jtz!`X+*T_RU}W+PC>t^7A9@sEp%?mHn{#WWUdVd*u%21-V3$05#-c
zR$}PQhd{~v5GZ!K`h;@E)^@spKsm(CRFlg5PoNxHdsN7Cl&8>cryI5d?6extCqL8-
z+LZ$CMta<<v&CUfjicrTDds|otHSZsmd=lJFit6S!yT%>D3g(^!W;yBn<VD;Deifz
zCUKgCKee~&ai5#sI%k!j6`&88%1V|z`WS-n#}MFj^qs#OTf^x9vUv(uSWQY87{W41
z?x@PksrZotg|?&cht-iQ6L+{QE$m_fx2_7ej%7Rs<5I$P-z39pG<ncx_@;5*fPWW<
zpuMHr_;+0+8Lt>s<}QpyxpI}Sj6X^1LCm!q^JHL2?7_cS{pVre^eS-OO0a({{*n7O
z+MKJ0{W_F{#Q8ERY9FNQAt?c?=+PRD+2_v^!#;*sm5U}dVEA8}6~G4y%+Nl2gjoq%
zcAtlvRXpW}<`*rM<o}zAX-lY|GKB2KM<AIbE?@x3;s&{VY0}a`+O$|mqvRFcF||6N
zk=vVasJpCX4qej-6J_{75Qh&08NyQSS6&Dn5(BOx$s}<|B6s*ekgzp&<+m1vChd}i
z%pO1?ifqSUpE;{4H0ch?H~mxOY=+6`jl2FWxx>^*^l^^5j-Cm{3yYB%G<P^U)nLPT
zJzc?RJqp}+UTA?b{o}PIqZJ8x3fir1aBn2vut$CET6UwYu3#NMSZOHq4n3x*p{%?e
z<I0h7e;K#o<@Ysj%8Q4KBL~Jd>(_Nu5sukUwt&;JEKnjbbet5P@y~DdSSwUxn`i6U
zIR#5?f3%T)XQZ^X<%_m{%&MVBw2nRRYPY~Qj~{#n0!@v5{R|=F(lF2twnEI;t}>>z
zL1ioGs+S2e#V^z}%PPk2HN<puN}Qh9K986=7*(z)MDSMYH3Hl@s7^H0?asZ?g8Zns
z=k-%|7esw&`G`FoeQ(s<|9e5cV}yzLS4@xZi7eHd<9VA5^sN2<k>W_qwtpW4AJ^xr
zdj78D{^+xWdK)XLIQ8alYJILRNkTgSmyPNW8h`$+7Ba*5J#aI%D)ra*%&5Le`AG|<
zAGw6a<?ilT7{#XP&wpu8nuR}SC{2POeu?u%l=abAitv5hFET4XNuxMvI>v~vGzlS7
zl|DW0c|4zCV>81p!U15tjuc00u#HWaO%LbC3CDV{P&8ky%mtJP877=|n~~*l#p7H3
zVt%z?hhH9Xx>Yp$bnKUUQ^9uU3ZdCuu@$PyXcQ3nZr$n7(^gefyEuJ+iNYF@mJ8s7
za~0RzqTyBr=krf$ki<zaHryt(hIG<k740bsWIGiuB1HZgREArOP@#cOouR<=^2H4|
zLw=V58*i~IMt<qZG{AYsWmmChpC6yrXf>`bu?e%H0hZ!VrH`d3i=}D=EJayhDJ~`I
zD<v5z0ZZ|2dF}@5poOUvpaYo-z*6ijR@__G8ZLGZR<I6I&@rrjMz>L^<`?NOP0!o2
zV0sxrS7DT?ot4Oaw!jsg|91!6Ba0CI@^5w5Pho=Zi;ocGTs?3A`rog%Gh#5%R1mDE
z7AWS-FSmP2Ou<&EDHbD41<K%V)Z$M|RxrC|Y=G^bhd4e#b~Chtg>b)$WQV_=u>7fq
zGtjj`{2ll@30y(nfIIF%0>+3Jl>)vb7)?6QrQh4q5GVChZ1Up5E3qt$%Sl{P^5^NB
zKaQJlebU@188d+c8=OiFXOW@&l2y_$L<y%Ot0FK03U^VYL5gJmzL#N@W){{Y!OMDC
zv3Gt@*+QeA*R-qDkKN*tF>8rqWY7wQ{J?uAw1q<Jsq>iFbw$r!ue?eU_Rb9t9{5Ua
zNd$A9`ZuIeo{ja=&|Q?L5MF4>pJ7@Ihxf_F>9Kceek8F3$~vg<wd+@RRUx`+UP*OX
zwt4Cr38owl!Ix>hMiacbaZklxoqF;GlUqcWh%es01D|*Tqol}=esDd{>0Pr~HGm{~
znM!rw-{jm#UbQSFMc?TW!nEV^Nt>`eet<?-)ZtI6VseiVKc#&twc(^DoJspU+%0eW
zO*l|uE|3=;^@{q}w7wODB`I$XCemm`=!G)x3^7hE1LjJ+dyubK-UfR5Owiy6M~_uI
zP{%i*uNyCoy}F4GvReP;kwxanX@ra#@+sY6LAXf`=J7lUuHy!P^UEv%&bwT;_u~Me
za{;jGNA|7O_^s9tR{f}Jh^xzSo<-Z2?sx%YlqQ#OUQ{)Q3z6RT#-4WD9<&RGQU#P~
zxIR#e`GbBkcM(usEMcx|UF9j~|2IMSkI^h>7<&UM27WY{^gG@9XZLhP@jTP}prRSH
zU<O-stua6H?qeU|c>(&Kjym5oh_c&S@LYHzM=8^%x%?jhlbi;3Htk-qL23-VVYehf
zZPg2f9<!IunL=un;iQWF5%w=A(mj%IG8hwyqJJA!zPKujSSWI+qdvCdqz?lY7onpU
zes_q>@I(Xb`zrw|IUDke*iBVO4?$oM%u&&{?(XJ4$~x><p1OyO%}ZN$iT6sV>nL>8
zwtE%eLMOS)vy4z&E0%M8xprHt;i=9DnaxyTm`w;j&wvtXIHT_!Pt6Pm*av&7WLIay
z9L^>Wja(*YVeSi!%TTBf-f&|^yEZTOLtabMuc!61kOoH_ct2n~Q1fx$R;H*P^q>jl
z@K&A&ttlHh_m<P+0ywuFBw~i>Q8yApWd1Zo$(Y4A9Fw$7W&jr|%RJa8ZBo4K1w(qF
zjpsCBW9Gze>w3x$kRtwVwrfPqUevxcO@#~){NhHe=NJ;lK+vu_hbSG2pp!zMi9>?!
zRT~s|<_e1DGe26Vp6S|vuna!aeA`(4vdht>1Z!r}s$a#fbp(lGdrZi1?}X;$CJb}j
zD&JD9HBH$_ima;mX5Hd>u@wSK8q01{fR2@bq{=`PaNZ%Cr7&kjs`yfM#J?-^mAg>L
z=q6Ospi|vhEwO=y!)**g8Jhd$n!R55xjHG!g)NxmwA(}nDCQ72P3i6GY(}HRW1o!R
z;Fy@Y^5mBY-Gtk;4O?Eqm7B}|Xp4BeUm&ub1FwAMI2k__8UcfgFFi+9EVK#iVjR<s
zjQys?_Vdm4X4NTdF4XnL4Gjgg2}dWf<B2ykoJ2D=QJCCWl%e9=cqcSR)c|jDl&d9L
z8@??+s=pfCmtdEH&h1VCXWmTG20}XiHT6{q^tk%I$guiZE7IL2P(=bW$M-Q+DZ)l+
z6vw4ueOxVy5DJ^5JwShIQ2=;rQ&w=fqG@d1APw+!Eeeyef_N>8kL2Gdjlh!GVja5|
zF1IRrv|txt6wuJmF4^LjjAM~BHJh9@g3Aa+7(K@UcHj-;cTx?!d%-kt-FfV1(7!TL
zxM*lSPn;uU$$k1IdvyhI;q(@TqGcn;V{e-Bho++5gU($#VZ|CT7c)M&)-rLN;}{p3
z2t5YT@9CH&H;5hh>Rkl6X(6DEfMVy1eZ^wCvqNIx#&N!)SIgLfRHKXXYefRvW`MPA
zX@QC$!Fu@r&`kp-){6I>c9(4%0tu9ccZ7wn7v|<<t9dpJF8Sl`E3;t<*|<fF%bA4E
zo<GrRnq}kMrABNfTVG!9FFt|AZy^`ZYm%=P)($sGp`{q0)A7<NGo|TCab_Oes(KE~
z^U(84gL%Gw7VIhDy4vnMA1R1wN85dP|BUl8&6E&C@Q{m>)RfD=8`I5;zs}*mw(Tpb
ztc}6sqCWF-hL=4my0qZ^PUWWHgZBPX;fc#<vjj3{qgJC79;bx7zivg->w8CVb=8Lt
zcPx!CM3(`IJsG~9uGWj!1KOQ0ZeQS$+^hfSE$1?tD4gGYfqbZ&`|UTq^ZUp5hCD5N
zo3+^1N(nvvKHZ?B0T>&n7m%-Ys6NfZo<H<l4fy3KIIYh2yDZw7N<I$V>O*~4x6Vcs
zUe03@WJL<BPvblSaAkyj?f$}-UA{6+^(Lb{C(!FcRS(IXg$?^Gmr|w<5Wg)uY9Sm7
zu1dstnyE_Mz#nO6G1TMb!%_{j88cnJRcRiCC}?ZSnSD*~UoC(a<}r_*ItfyM%$;Yi
z77*524op!Y%at90gr~<?QN>s}xfykYw?>xfuLMpY$n%`9b@VPxHS<Yi&no`n5&QMh
zb9Qg4=5G1~XB~0NT=S^xj6`oOMJDtnb&(xl#y-r2qq)x|^E!6&duK2;@F}|%YS_~=
z?F-5eln}S+0Fi7oHdn$*;mY^J9TCafs%E>&sOh@VDfV~pC8CP;rjEj*`XR%N{lBE-
zFRf)+sRxhHX(mhENVAc0#68MrCf%4t#NUk)(uit?lWT`dOzfGh{bl9wjS}4T=ej8C
zk<VgeRU4Fz=Z7d0t_9h{tZI_1YMw!g0vU9A=+4N}7KO|9RL#9hXwnBmj;aV0rf?Le
z!SNxnUfLR2FMFH37XEBcn`0~$#+M_zvXkLwyec^RJV;>$OzF<ylF63uh~j&(9eSNi
z0__(IsN1-%PTkpBL~D(lQrq4JD9v}p!>&-KcKAx=p;3p|m$?d`z>hNQ=n<)uVSNH7
zdJnMnTeMEnB3;KeSGKUy?=UJvU-{jzi(IGHofOcV8;n*7<&zKuU|3x(R6yx(f|05x
z%7ruqU%a<C_NeUJA@s`>=Rf)Hw`27GCXDNmL*^xcl)Z$5u$ZNp_?{^Vixn$*-{P2^
z%6QGXll?e`T4FL<a`3&jC5=sp%@kQtw*8yM@AMUzdkHpLt=1Zg0-zg^cwV%0S-Moi
z%e%zSg5O$Yo~@t+%Xl#E0L4(GAdPG?L9xKiU$R!bz|F8#CX^Vj@KkhjL|7-%ibn-n
zBm>WjR^qD;Nt%1%CTiE%Y8&3&Xl<{zb!wwSyE8=L<tH89UBTeiJ<PFK-S8c!+HHH-
z*L=Lju_C2`{l1y3L3*rR1>Ip(VU+kDYK{HG0tcxoac^~9O3Zb!Zao(}W2o&c+q~+s
ztWCC8;qZ_;h8q#hMF&lnJf^iD>A#)7BF}Jt%*gp;MyE7dPQZ+uff-c*zmnEe^YUJf
zT2RsBazdUlr&zL=Yy`gf%>K|#-KUu>(t<MdnIQDfZ|>e=x{Z$8=5gRfG?|`UB=Icb
zMLI$b;o*zpn{Ok$4`}g;m@UZKHOuaek+;CF=fC=$dQ-$QL;k`vvcoI>T2Ej`6Yf`o
zkSg)rMC)P9gEw4JQm5J5jwI%U4{Vc)%uA$2B$k*Z_Q%%p=%`10=nS=iBZPS#cys<k
z<eK2Gg3fF`CQJo|gOK9l{o*5KL;h@bzi>HxQ88dK`-aycpP^!@G_V@Yhla;r3n~W|
z7bg`LKZ9!UX=tj=S_gvac1}2PR`jigf*khTR7Zj)ViD(ugN!(dJDwrPt+n{iTI>n0
zM}xUYX+UKMVy0rMnWdrE$U$vGpR=5Uaa81Aah&!v6+_m(T}Cj$-@#MZHhOPWl5C~H
z1xfH*S&O^dGV+5NllqyiZwOPWFM-5|2cY>Hime6W+3GRVrh7i?F`LsxM!isr^~T$1
zfow;cUqRb^oIF9era=Et<K3A6+F#?EPCIWM&WNMo+oRs;3amA2+pZD`eg#mo6UW%H
zVBuiKzbI?^Dz(V8!7o}*gD#QjZ%p4I2JJ4X9<hB<7gB<HJ(eMVkl>Bsz=A~IWA+|X
z+g=|x*St;z_}{Ksi1XQqNhYSOHYpzF8pe*Q>q)f)ZZ%h3t*osVp){|_dhVBN8MBh`
z4cRVLY6xbO_PaRT-^S}R<prQ3B9^k_onIf-rRcwys^v_EFz>rF<Gy&>IEBo!m1OPt
z2?tw63!^{mud(!b(GPl=rmJ*oU^ZQp3#}F5h$A=sSnYbV(=!%PP>pJ0q(<%Y3VqQG
zdnuh{<k{)?${^V?0ABBK#tFLyd>!!GYXa0!&Mntaf@*P;&kQ3?Awfp&XsRKVxH;i;
zA)ux|$*-jvKgDT9Fd1_rukV8BraphwZLv1-Q<;B<cKiLE8r5UBkDGQdi>}IpNq74*
z<C(dWLRdgrcndl4sG&{`ag`=DFw=xX1I>FD#I0x=XHOz;3pWOHyeJ{t`Z3fimDVdP
zpK+|uwY&O|k2Dv2HH@Arq><}aNkA!hyX>SPsvPf1Me$2$6`Ec>x*ngt_cF2`-(c|h
z=bo9-npHT<l)ofBBXLCv;nhf@>UU&xdajuAJGM(Rni?`Yh`ks)7LF1~OA>c2T*(SX
zrzLpQn}$PwBmYh_MXUV7brni=9(_FE!=3xGBVz1M$t|j1cz|iK3U&SVEbny8eK}-5
z{nVrMFP{o|yPaTh_1nwU<nO!6i=NtE7C*|h`b4u=khG0!X2zdEPof6-@ciM&7v72z
zj2l{#vWp;Hm1#s#)iff~vScz^5yLh-Sz_9JA)`Xz6AeiNpD0$vm_=MQYKVp!Ra7;!
zTr;d3_(b)@WkngII=iZxe!nuc{(WQLQ{}oQNOCAccPLBQQqAOk((=K4aYUPi9=L6}
z@iSp%uDMYbOT75jr!wF=$E97U@QRbGywkk=On2Ral9djTQcgD*$u1HfpS^Mpd9`GM
zZ#O+0t(5(zdNA5%c)D?L6Am%?waq$|8U7HOsAS3Sc-naC<z{Eg$K(AO_Ko1}lqfpp
z<$dMl&L^f5<mhAnjd%cTt@3%~E@wlpIE|-YQA?SdI3ggwU+8^NWH%zd7o)N%|BcQ0
zi<GVX&zhJ1?w|I89QbdWz(u5+m;cUgd^8x|e{6*(Y<}_4BDlp|rtYnN44BMDe*gM%
zdHmW>d@RpSOtds`=YKIs|2@BZXqH)E&z%0yoGeO#&%(bb3UAN+Bc09y2ozJK(okzO
zKQs#<P<AkHMG|iXkWMjyYuqPYkn_#=m+T`O0BFtMA9B<VpB@OEw&*h>bsE!~tkUJ6
z#m8B;D{UBlz^q|5<UL2Ajks-%>i#Eo7@zwu2XmPpZ_fpLQ8yAXf8`K<CUwGO`nKu~
z4Wpg_BZ`f3w+UX7)dmgY7~m=7GXPJKR9^0iRUspn9)To57tT`^&I5RgO)S-7>_0sC
z8HBQ3a<h=XB=93~hXsjHvawL}lK$+KM51N#J))v`6oV(HFro>hFS07aPd37WMv-52
zz(tKM^jgVO<jP`oSyyY8dSN$&h#*h8zwi*fomPH-UdnH@vE^lbc@-Gw_jVdHA{q2L
zy28MURon{_ePfNm9~YBznfn?M0D!m<)pKV8+v^C57ZWuo$%cJQxjos_*!K6Zs*`1}
zWH3Rbn5=`uwQGSNe$*i9Qt)TqMC_qJH}dKQE4RUy1*|z|+b1mxt<Eb>_3s;oEhrpr
z2c<t@2=WA!fy_|0Uu>E8H|(qI?@FnFVj0FrJo%Iczt`N#kw5X}cnWI3wrxRkuE%gz
z$<g~IqVt1kxK+HXj`@red{y5{vddwQi=N`A68TRyjOrNt7IC#=^SGx!G+JitGJ%jY
zuM*crtZI9ih_YvyL9PRH0={4p@Q9sj*pnJRrlJbl;3RsdZ|z(iIL8nbuqyBKVXAs5
z`tRPgJ>i&+*l;H5nX-QcIR%}pi~pe7Xj~`E?IH0t^_KTkKY~g6D&Z8cldKK9Jf&<%
zFPHICWEN&QR`)YoHHkIki=jwT6ru)OO>O~iEHVkc1qFU7f9Kgi@O9);B@=N)IroI`
zuh00*zX{wXq;aQ^aOI<r;2PE#tSz7BQ%+R{qMfaTjd-#dB2%`w#Pu50=E{dMm68-Y
zN@KBbcQw@1r<I5TQm*2Gi;b}-Oeeh&-y^x=knV4nYkjJ9bZxS)js5N9+WWyf<&xvj
z(|0T<tyjIMTJDiMm9gCtTCT&n{_L;4aol{j#Qmgvxm+v2P~vzDJXuRGs`X>;I{&bF
z1B*P2x{aHLl;M-z8Dr(c{I3#tGb<9C^2??0{Ki4%ZGO##QXIrm0phFbq}l7AK7!1K
zO41aQcd!PZq|=H=U%|H_j1G!;Cf7GMsDl_@_o%<<Wf%Q8`+c#vV5(a@sVXVb>j91$
zVuylAg@o}Iyv!l3AVsJ&MD32P4J%zS%|v%2GFYA5+nHvP_RSLFZ5%Jq2iUJ*?;nie
zO{D?bcpmN@*sqTvmsLrZRUeE2v}&v}!zNjrWIjl;4Ujv@)DLne>FOVQX-uq7oKilL
z{{3w37vD8zJyG%CY}0|Pauq&d_9xtc($Wze!aNZ}&lw@7rrzGG9YOn$jzT7~usE%B
zwYbf39N6A|@FEU`7?~~3W^hc!11Q0JPQnv<6jvYDDc9xPexV%lr>x)lkozk_e^4Qz
z@qWc;@ZA9>k+nSBBEJXwdC}MgT%QU3pvhOf-lqb1t6ww3?6ZjZFjjx8fBGzy*A$YM
ziCZNn!WyvjnN;+d%paz#RBOm$yDk1qSDhgYG3SXy*4K>Y{UM{jLfuoxt&is__PCl+
zzu(&y&NPU?#>5O#hDJiRSqtOh|A$06TkP4sRn`D!Aiop*97($as`zI!elt$FYx2N^
zm$;OGTcj39Z^7RR<GS`DNc5P5!}|O6P2oE4jri?B>xw3z_oisRKzo^Sg`tJh7av`Z
zj7i6aA`i66gEyp85&=n#RlJ+Nx%k*~>LQ@m*_ti^Arm6yF)HFSkM)^;EMyqMVj0a=
z7KyG?sclm$#B`mGp`f5>&x<gy9(8BJ3x{bL<ezG_re-T<or4~-KGW4=s?F6$5-JZN
zfsx@n|CL*S`F)EE5~)j7?|DC<)v3HI@BYbQ7^KP5mF%(>Suq8>7PGqi+EkS8+-Hty
zbyX+SPz<C(D+M4GE*ThODyc?UF;Sx$MGRqU4P%!9Y^A0@Tqdm&U8DlUEr;at86TsU
zz%4roqnCv|m<>ZjJwvJrtr|zCh}iV}^j9?xE%QHR<HRcZf{=m7a@yPK(&xo<Vc1Ji
zULLJ3N{m3S`!gBSeUu&_nH)}E3Tlq#E(+RFCa$V$0*k`|?%H+OoxkJkTZ&1$xt60>
zQWr<7yS84swZ_a#L^KUjFz3OadkLB^*W<_$$iI4&lCm&RGl%$iIN{#DwQ)XfZgjr+
z35>o!hwSdYb>4fwZtgO^1FZu{p-jH$B|MG-?Va+tMe4Z`(y&JMc6FRb@9t)v3UK7w
zBpm1d5jn%>%>hK~R*ybDwS7Lljct?f#?2rBzt%YXg!cnYIq403S3bAfnaGjCa|k#r
z_NjqDMpAdkOA650vI7*5hLPf(QHEd}?AyWK!YlER4a&JW^&I{@x$Pney9|Oq4dFcD
z{ACUa@zz!v<>!!Hy5^PVBj&O-YFo)sw>wPdXKk-z$L`YgBjx$BQ*~k(x$40paI0j+
zCBr*g{%s=tXP7B+jVK^zeue>ZW)OoGKeNWdC=8G@GNQ>#(#h%{a)yH6RDYJOvN*|j
zuz3gA!<DH?heqlHSYJi<!td<FgwQ4ee6Od#*IsrH6rROHe0NlC`Xbqb4|Ig#_sbC7
z@|dLB?6gKOX-mBR5h&D2&#S&#)%HBl8wBy|t@*`)$=U~O!<i+@rbL>?+j-$+!(S2b
z3v(kpbd%`9MHO7xeVXq24xw!PPH)8N)!TX#ygMNCo&p<UTWma+IT>=j6;tE5Z6EOR
zv`$oGiw~3*XfKCHXUalJ#fy{){^;%yiTQYI!)Cyx_B#(e)Ni#wc}7Hso4(A@HBs?a
zXp^jS-$+Ni_UCfmz)~oAKNdWQH=B~0>9>_}IYk71b0yIlulS*T=nnpAUrnbM9X>G0
z@E>K6GauTKbLtxjwG{{To~l@Px<0d&@27+Ih6gbOnZUn1)N>rw9E$4eiHRy?)Za%S
zrAXp?*yDS?jxkPB2K~^jaf(DcF<!D3ZW>*RMLQUprJ@Lg!RX<J*EhL?evewvlSFW=
zXJ)=oHbxq^SZm~E;ub-mEqzBs?+vdgg3}}A)^m<bk;$*owbTF;`+0Cg8YF!lg{5U!
zVx90WnD^?QqxvbS>e%akmv6tv%I4ves`KAjH{-EL3G?weKL^V%R{h68{K@vltpUO+
z4MCF621(zS^Lul_-&bAFHVja?QUYsE&d=4}CTMEDM^SPnP7{aB0KkY+2mm8NX-zI^
znK(*PBCG?|o_xigJOGS@Tyrc)JC#>d6?8lk`9KD}E+%k`mUf$ib5qXZJ&||?)q>NY
zya$HCc`Y$N<KlXjY6b_h$CnHjvlyKWqxM9cMPoho{n9z_Lh*R@M_3;{*2zs-Q9@Jg
z(9=p(Bb92NAvs1cSBtEFq*%|@WLrxXzc(OV5w5F89LF_}TvNa_vz#Md`50r}#~97Z
zY6{89#Or`D<^jpGLR9NxjMEEp*v^Z@DXOJ}A=&_Vlc+`W4i?5*M#h%O4N*}3wtL{<
zB0oIf9=l4x@yuv@d2+U$C&0n=DK!|u!8c$qWIjhaa39E*XFM7)@gABi?|Q*1!rJnI
z24{i(W#QNm+C48hK)WkksjPI3L9wPauZ>aChuM}W3Bj|IyNQJRNWVx+zubbiOz&nA
z8;S<Y^ZlmbJLM>xX#)zSvt&Q^tq61=iK4t*j=Vt9won2S`;gb$8W#Myb`IOgbFdrH
z)QvSPDf<E)>VWK4w|#)CJiy2<e*=tcyL$vX4-is60Y(Okj@p2MstPc&z5t#|(H0oE
zdWV0U#DE%vgLB;DqJ|E{gbHLtfZKJAFQJCJ*6wU|Uw5)oG<qq~q~5fYgpC?5XmzUI
z<1&Lm{*zEiiZ%xB5BGB7??sxfnS9qxhGy(okM<svH&9nqWwCoIY6$v~-sO`3bCm-S
ztSte6VD<VW$qH()?Q|CKqP>&6SyH@}@psNey=Pa?9pSyqBGm7m*#dO=Wi;-vF7Z`1
z?sb0hEuJM-8=UlRmdeEFy5#wD`byKCGxNXCcV*X5#1|g%kXs4b@4Eh1`_0$6m^nRn
z7Cr9ChMEWM#x_ao3`Z+PQ1u!5@~sRt?Ii<EIqco{e~@eVJ`m001JUkj@ZAAK^Pt8=
z+R-tRL=iv`*HQI%J70%=`vn;`bCdIBe^dyx)#ltDMVr`GZd!9KP?djZcwC9dfIxRZ
zfk#7Ssx`3~*ywMzOSLRMaWvYKTKcYRko`s$@;iv`B!3SNmdhA{fRGfMbh5}Tqm7$2
z%aJiCf!@ReSaO<68%j8zbn@Lb?SEyS0D7;$o$ER?NwFPQu|4It`+4}5&E{7cQ=`ig
zZfZRf$@|FRaz~@86(wJMFRhU$i{-Tlx=S(kTheFRVN<`Os)QrkKN{d;>4HABFw-9q
z|NRkh5uYS_Aq}>?&cvwTBh+a<{As<rr$Wlxhg&R(#mgMk0>VKbV6|WA0aQi$Y7>5^
zbKr85c5}i*5qKvN_+PWo_sHSlhp=}%hw~Sd9S~c{`vBaVMf6?>zfYP3-os5t>1*3p
zyw&#t_)C`=;>Qn)bXf%KvaPBbWU4ap%alY|e*q|;3Me07%3l7RaxbsuVk`ESAI=x(
zKj#aSMfzBV2@<mUmP2Q4IjqFif})|cs;POt@HI!E?Lmr@somzlMbqe_<b-O|cnB0Z
zY;KyWw-5VUcg@8UG<T2lADP~VA|+?~{1S2MRj*?a|Kw>;jDQID=T9CM)b~Gmgmft0
zdH0ZaOMv$s-(e@Pbbd|C(rbmaP@3{HHUe@3Uc<tEiYV4`^%s$JRczrSmKtgOvJcB-
zU9!+sP!8YAZajC&MAG5Lbzqa-T}<|&`$~js7_A)S3uI5mA(!X+zkgW{+l4v2^PO(w
zhce#xHv>|Cj^X-ehM@>M!53)NI4cROXGLiw6e01Y1|o*pzby}-2%ab#{?1_+I+VjN
za0Ga=;Ngd^olt35Fq)S<1b8xch*M>fQzgKY$+A2aN`G7al%pMw4rnGE2>!_+k!@P|
z^Bk#L+xlm8I9u@#_A#yI4ekku3E)Y+72OhVamt+1<lK^|>3d4kbugz%H?%3ni!g7u
zIMi*_m?Z6+F3uKKOXo2b&iGHQj`ecx(t7jAEhGA}Z5<a3hYV*`K|)ehy!#|lHlyPM
zN26}uYbql*sP=m1XN97Hg=@^_yy?^70bBM7k>8Ud-1E4W1U6jH+o2~Q2Q9JXm-Mn&
zaAu?K5VEc&SWVvlKmOF}kN?-7YTfG4S^TWi>#bSxi{J&=41L}jZgL^UOSasiXN|CD
zA!*LEC8lOi6m`sXO>xh%m=`+?iUMQhtLSqfU>8zgKSVvf5jsbC;X^OJh3XDo5&God
zq+WP({k8Q>dFWZg>7Yd)IDeGe?Ao~0aVC>fje2A-*40PjL&{qe_IwC@+Bd#je@Mkw
zW1O>@ZPghFz6ByIPTkHDyD=|*(KEMp&fa9-7(Lwh*lTsGw8xzpUT(zIwpF&FnV~Q<
z1X6NV>R5^0#+~icv1RP_xSy4O;MdBF#X07Jv<_p#o#Z~T+0k{kGPkBXfVu)xy;@d|
zvHddKZfUz1$<y%Uavtylg5x*4eZwjKL3h1_^0Ca55`Dwrv(bLDWwgI%i-|%nAKox|
zB=*eVG3J&yccam6PlAa;hE*{R=NKkT4B~rhVe}n-=cdtdB}aB^gXgb0JMtVESlqT-
z9}xDp$z1k}c&;3LPsx-wMpTqdLRyp_tkV~fduvEjfxsGwudPQ!ICQ_0|Itpv<tqvF
zNbj$)>XTKuhxvSZeX=LCG74+MV`#FP^9}Zw++$|~EFS?zl;=)7y=TP3M@|CkmIgp?
zd2Tp(;g|>@w|&<saVLHwb>5>-%tlP<6?*muM;AigbUW81NIO)1;=suy#cT`*wdXCp
zcVvw9j?S)o2KVI@Yl(PIT`#+1^4=##oxVP0=1=mU^+-L?x)m+lYBAaqJwwhrvpUij
z2NGPO&b7VmP0x>L>gqAs4rhYpU3OK=x_B7YX2aIsGh`Ja%0vc29_y8F$?=a~PbBO<
z_EbxR$sAZd|KpxlV?KGnl&dH~L6z(;g()!Lh>3xPCOh<ZZU=)(S+#Hh8Cx&zXEdo+
zrm&a}%#t-XQoVnLW@Ajfl_C~}E|bNOzeo<UMX2nw(7KBLJGYi2us&GJcV0UQn!0M(
z-`kj?TaTg~YM&-<UIc*9p$Y)Py^iY{S=FdLeri<m2g!3SsdGT!w8p+@q6sZNwyV|=
z9zFm7{NxqQD^UpY4g__udry-8k;k^dXl=I<6ricOR^Csr{RVYA;53IU_-?4W4sGWi
zCz&$ci#5=WvUz8J3S9u&4X%VGW!@%^lu3nHmZlohE>#aCp1(}(%;<C@L(#N6fOTpo
z@gcok_!kxO$ApKQNEXAdw7&GSY<xF^6?@fd@V4spEozwRXxM_J;aGG!v1UF@STc}A
z(CC3ALZ+EyO{l?!Q33cOW+c-V6w@ERh;Uu$@|=!{s^+pYfd;T+ML+Dy6w)##(z2CU
z71qsA4NB6JknNUJ=Y%r*IJTmb-=0b&&CGvxqvOg*D}3O6Rp!h>#o~2^LBj|MW>7tc
z7HSux`kq1Isat=y_!Jadic5aGxkR)*UOy(Cu$J`e=Hly|YAl>TpggHOhk#1=K^EnI
ztp;T;%j^R{(g5FiOal1MRoMu3OgY{YU>pxs#p>0^>j4gw#kQIX-D#yhT?HIZ^k0C1
z8k7^b$w@OUKrt<R`G);K>bj0*sc1A)f=8vN2KP7exZo5m;?z?HEm;z-mBW{!7L%-F
z1xt_O9KWaR7Ij-?bbDUZa8fSaS1kc%I|&F=7cCH`0JS7~AWS`F0K3s8X|tec1H#mX
z)Hb3Hgh@>k{1<`FN0`)rET5cLMx9s2_nUSJ=B8zMzHTU62}{1CELIzL)_idotJqVf
z3(LvaXAMD9#Hzk^G0A-~R<qDYvO-g?;t!tEuNA2Jbau&#+n!=SO>_JuqWV&+{h`u0
zO^SWLIfN1w+7gvJ0MUw7R?^S$>Sji&cBd==T2%+Qkma8=$I&$BVJddkhd;9G@JvIp
zUK%{Uhv*mKQS^w~#i%M1vEZ!I@aw{$$C1>D7Qd=e8lQi_5g|zi7O|nVoP3hoJ!FF4
z{}qem4QhPp-QHkMUe0Ioz*+h+O`$Uty5}tyQQ>r|^bNo4rEeKtg$>%!3;g`TB369m
z`j;wpwCCw;**4b-FO&k(fF1=KwymPGX+v$bkTPu&2eu7GHac)JJ1f+Wjrh=$_%cRF
zISKC&h&^OaYx#kiuXF*F?U$rk>&^JjmOX^E9Q=M7!6A{T*?Bo`;~>M!%nev4Ty>ew
zw!@TY=<b`z6q$p?74U|(U2&}-eoy8<wHn^5%K>^bA&SN`>*G$h#I9?XCU;ik=@THs
zG{b?Lm_@qZl*ncib>bY!*OYk3691R(@q|6rF~uu$TYw_UU>h3zh<?mR^oh!>#D`1c
zVu0v-B0Z_oKB?b58RPKZ6F9b87JR22j!vina&`foME2Lhf-@*74cP*^wBf6w2)#WB
z_uc006JE`tm%f7J*T<H)WvRG|qLTv87!qcdKVNkOO(tCtPFx^7#J>*p{M8U#NQNX?
z7dtDXs4qzYP|PH@E>rgtSjXmje!0K5hcMQymK+wxoT&jyYC<B1W@c)g!{u}8l19fa
z46~`pT(MO`QC<+WgsXC#+gbz&A+aE%E$n{`;yCzoY(M^lilc>K?vU6N7L@eKFhi=F
zt|+5JSSt~v1ghL&qY*{suZSfk{ZbA%u*X8yT_t)P%vdHH3OTnMmtJ7D&lR}oONAP&
zUG;FyS9K&KoP_jvMxUi*aSs;!4%rH`1J<;7sA5A#VvHx0ma~L-KU3|&KVzy}HnipI
zhAdsS@7r3Bn)17C5Uha_9aN8-3T!Abj2(bo!GYW3fM11~{B@myBIY+oLpue`cj5)W
zd>7Pqn<g$37tBnAg)o5XtAOeQIOZYb4k1pF4q3lu+^@_}7vI>)`?;=p=_&e)B*QI9
z`hi7{L-gk-^|*kN2Flav)4V=6$HwWO-XgK!?9z~HieRUu)a-^F6tx9VOPJk$aQ=9w
zS|yS8x78NY4a2jCM~+1YVd9tn3V5S#pXW$W_0ko(3pUAZS85Fja9Zi5FNSTpDFNG@
z=`D-zmR!XsL)^n<;X0bPtN0khQ_1#=5J=)EDfKN^&0sWlwq)R(*BXL5iybZtSWe*F
zAIr(9)GA`A6rCGbPE+u?O0>C3z-DfqI@VyfT@*}EjU<GX1rmmkQZ(<Rw9qWB{~t|3
z%$OJ`IiViMzE7hXz{_R>g^s)4WCzI})|nZWqa>YcER(fkixXKB;Z}Sq^!px2%?V6=
zmI5x)d~kCO>#$d!)j>>6Zr=qU?jWe_<{&uoW5Dma!bU>gTWAyb?~f{0@lnTzZcxKt
zk5Y$)qhF>*?~wOOI9XO5D%f5)4!U-t)AoMcG#xjMX)S7KP&y``@wJ+=KM}eb55Kl{
zx;BEgk}S1GC5#PiU4?yVnL{imgp#j4heqdau0OMo#jyE^EZ!h&nA>huwl5De(I>lY
ziN_~ZnnP!sd-9I$Z7b(7IHJ}{dtvhj$U19M_Jw*L2+l!nJgIGgePx%>LP7U1*xrtG
zfxLn)CgOX#ZkKoxxe!O?JCBoljTLXm6wfxt{%R^aHB<{@UI0M#lq3Mv`Eg0~${K7l
zLqJ9oCylbAh$`pr<V_JjZ@@UgOP(94-Bou05Hopf#F3q@H@=p{VEENwc#{7nR{EgK
z)a>SihSpQq1gyrc2|A<6(r_ILxAL0qzpV+X!9#XP|13M+zTC4j+xvukB{;X`+=SBn
zmJ@+WQqytJ)68ztd*Lrlnd7^NL?MLnq|D46ppNl(&&7{|L>XOCDspXUekf{9omxF(
zEErjSnAh^Bo^p-o=T;>tFG!F4`1y~4D-Ht#mnKcJB1`h@0bTnm*SJ#5F;SJ^m^S9_
zF&K(arIG!}|0InEM`0=BR0CcI_Qs8WP@!#$jBPX`wx`l6ZZgNje5FjESj89^J1}M@
z5LjOPaF-_$goZ)Ey<JOyI(&7tvjw}V<1Je-_uAizH4j#|SGI2S53&Y$`v(QaXo+!5
z7Ne=dRYN@K4hyF_>W<KL2>Rq-NG55?i=4am#GrPUms70F`;<`SKGn#SdVx45)rc9I
z*hk?k{G)L8No83sPK7KSD4Z#L$}3jQD+UT@3{s-mW~eU6g62U>_F(mZL=*%nc*+RB
z#o>PIeiEd}0@vm6!NXd1F2xve!M^@#$bQ1$BmLBM1}VTd+fSDx&`m)NmQ?yK1w~VN
z{vshitQ7-AGp6WkZpCwq#5R*!kWUFWS1bhaQHX{5D8#}k8_S5PMnM6ESaNyE-<ndt
zfkLb^X0bs;lO>omZErMWF#z3QG!ogniePNwU@C?XS{>}k&5w#a-NPi?mK%%XzX!yU
zvjF6%2tpc3jcV=sJ;JKz+I_3l0$yv^TNp}{ykSKRKkvgF{RaYd!(X5l%!p|J8yKfE
zoZShemL`4#7r5=-8Y|zy3-wR2_SI9-FRS2Be1mH5!-?wVQtxGJp^jXx^c;zJC1lBX
zPT!V`Yz74qxNwOf&Fo-b;Dkz!(?>^jg0zrd>2n5MZ&@U~=l2%=WHyty6rFZKuOa#f
z(hVBnqlFiXXTy$;;)-&2acvNiQ6f_vCdbb8=!hNAa7P#V9C0o<SaB?TzTTy*UT+ez
z`sgKCk^|yXtz*0kh@~Y4pqJoR=s(S{e?WX%DR8`YNb@ZB<Y)&%ZE&;5U3enth0Y`M
z^^ML4(37|1GE~p=9{lseMSaNPF;&sh(6JyH#SqQkU3Z%wl81TU)lsORNJp+&@k7n&
zI7ha{J&V=CgHID{By1F=&nYF(@5RrXLPkz0T@pxl<>p16c7z>F$0#?Un-h2zW7qyg
ztx-?d(KPQqgl}d)p3fy=Znx(C;<;?WNAm!W$4ooBX-SF%*Kn=_XKlS5m2f{+_Y?bf
zvmgIdf1vhrl*a}`^$7BL!kImGNz^dmN4l?F0t`te01Seh9~{mu=^v{Gn{X4r;d)2{
zEhz#4hpLS@aI_M(1!lX>;EXd6C}6^Ee-to-?34oS7@@Y~Nf4(!7=93ut;(tNPW>5R
zg{d{i!PS<&((7}p96O8(WN<=uZ!2W?JUC>bx^#<JjgOB~NQ(?E)#j7rV3TJ_xIWQl
z^hGo_{^sJ96ZzdLVe8FQv$3Hx+Y)2~t)1Gz+3e659Y#n0DiYF=Tw7N%P?yc#Jp&k7
ztRF^}`G=7;L$j&{7+K~Y*1Smaf^@Pf&^r}Vn6!GQBVw*e{fnURgL#^N_)B?pxOsJ6
zxvWm6qeq5DD<u}6)8|5GOlmK{3v)SE-%2tka*!DWT^ewNosXuIGwG-DD_*`>vqY)z
zTl)8m;}zI_coo|pUPX@z`#j)PY%7X?YU5=d3nGeYluqKpB6?gM2a5QhqOXj-yl$uN
z_-a&c8k0u*KDrW<gEKlf+Mm?NWLTBuCmJ%V!lGF7qVkRKx$=JyNfSzfZe&0)K6}-b
zv3OpIf;+@T-@CtL!Wj(Rm@`vWp+s%2$!r@%P-_GEaGy&1fpDcx@r*O*qo53Y4>v{W
zZMoQ<dEsqQh7CmQZ-0qjpfbvJA5dlzNO|Puxt^kh_e{p*R$|r^HO~>*-uW9MurD_D
z@`K-A7Thfz^^4e@N(%*Q_8IYWK%(?71Fy-Fj@7m)-2D|%YYGAc(#aE7y(8BBS$}BK
zcf|`u9Xw~SWBhPO5kZ@e-kRgVGi0~^0Nf!~?t}h`8ph<Xc5lkz?b&`bENp%Rt5c<6
z6=+!41dN@xU{FO82xwTi)_zm%;6K8%o*gOQt+NIajy2$Xnp0czh^^dX)QyKET|n1X
zcvNF-$`A{q40mcZx>Vu!WMShvmeP#iU<q>?{#p@&TZCjgyagU8@+%%4w<dc<annrv
z=_JCJqtlDI;&IANJ8Co$f0g|Z^LX^!gNtJG-94nVhUt#44-2^`j5f1zj<C4xvVP5P
zW&8Ud1i4v%*2)nh+~GRCraM-abuztCP;6CwW>uC2-Q_Ih<BEBJr|gH+O8<~r^&^yN
zfYj0iq}C$vtN5x9skLi~CHr2fz)?ZYBexDnEyc!<(w$->OM#6?p^X63>`J8`hYL`%
zy9R1@jNkTb2F}VO*8Z6;YAN9lYatG2G_ehBWcO?Yj>UH9cLYwu)oAQf)IDeaO35~-
zyQ-x;TGa@+{TRbh1~7){#*tuP498j{Mm_6=O|5lNw;!D#L|$brU`Kd9vm-UTppU@%
zjE>v@RjEz6;Gxa?p-sC(b8!k0e8$|cT<fUr4LJ<k_2{m~HZ=x#J06RO^~1c@2Ta6s
zZI=44NjzZJ><n~2&hrkbE@qnj$RVJa_7NH@QHFf1OC<EMe{L&S&dYeLhOzJDMFhP0
zf(93!S{$s^i&Avp#lomY8G|;wY1_k7xK$ZEB<M5J3Kzo+K;ej!>sB<{q@(mG->j{?
zGTf#i(aFxdP>~Wdq@l}l6Z9dGSSPWUaUkgd*9u7)aIHR@Ilri@Mj^2pH<Ln&!K?_w
zJO@4%vcqUv6D}};mEssRf*%2SA1wVN@B8Ax3F@KwijzDnT~F9sKis1OPcP7t;r~z>
zm}(G*agVp-`G*1-H7_7pA|SqhN)EFhd-E3SwF-v14=cvS{5AZ>um$7z6|RJoSR%0X
z1U^K{n6_b`hrv}FHioZo#XG&UV_%BuBoqveOifdf{Trmt={d>)9xiFB#knfX&oPfw
z`U9c>uY=}>7;varfwiqQhc+{_1w3&~*J(2}#*Zdn-8p~*w5c!O0yQvQpaynDy3?<^
z(|>X!ljZt%1*6C^P=R(d8gl^1zJW{<+4+h+oWea#YCVso92};%Ow5<cY>AAFMiB$U
zM=$yjpXD!kB>b+>W{AJZ-1JZd<?TIuDyW9op+)$fD(XHB9eO)uc-eaSnZP{qMFCUN
zc8+-F!>BI!Fsdc1YWlyHi5CDyH7TE{dxfYwAR<!4-F1T9K7jK80M0<S4`-vNjj5;2
z{b%;+%R<z6=<s<3h3Ezc?sDKTtXY>@*W0PM+b(IZ9MH)#Bb;cO8Oh^&O;h6adhUnQ
z*8Ff@vF~|rwG@W<Yl7{L_ZbcjVM8_|z_|_tQPt89PStiq<;uh5X=$mPN)!*BkEk=)
zKyXz+w|=+c9IexWd@f#t_vm4dwhwpT_%@&k5%+Y)a#3MT-zmJf!1^;=%=(mL;pJ=@
z<eIu17#o|A<wypNafC5S0yL8_y4b9qL!K1}*#K4W7?~4oZnbO=MB;DUp#M5X+Jor(
z`|gGcC#y{UxAOyju#d#9qe<*&l(3$F*l%&pjl4Zk{UxvNR)<&5f&0O2H<k-t`zU2G
z0(GPZe=?{j>+;@D5+m+K-GA6MF`)PreAr#s``(I*K;>;P$k7vYA5E_hStr4-{<bJ_
zJ>BAr!blj4BhU1X@|olz(4(4Q)(g$0-vQ!)N#G~t8kXLzz=di_jY6@pN$8(_*yLKI
z#5dzlU@gCn3ohQCo`N_@Y~E4nep}>&7&?L^%=o|d7C4C3G-kfX+}0SLl=Tbodb+&z
zW0$i{Q>xJ#auUyO`+n}-c051d)E*_NKFZOG?rrmoav>~a2i}&<r40G&e>;qf_~o;s
z<b_>b1A&8+sN908X6`47=Pve29N%=&q~a0gA)<F*Pb2;|yRDv4+ToezQu+e_SB`pm
zOx+H;7R=dP`(H2_=TDAshzLHd+RU4<_Hx534h`U#(u1}meD%%2{=x$;VOCxT$V0tZ
z^=)Kt_xH(9em|&|rz%j<CBpWt8o)b4f8?%hV!dIF7kaAXsG4yRS3<%UCZDJUi1)HM
zQ^QhP@Zr?DFCAgtwyH<W``z9U!B6Q{whb(&(P8)qgocNG@iJcIM|7W7coPy*iEXSr
zWQs#Us3TE~T>JA>6mMy<nufABg#3y6kbf`S_g1=Z^<n}xipRv(lXRTt4a(};DxfUV
zI(BhD0A}*oT`<M3{&uw0>p$k?_(rg}3=W1=Em=7g@?*e>ebko6<5K2XzVv%bYg+V|
zuEl1k!wHI+IP_y8Ti%Ba=Cng1pl-Y!pcKs{#gT0A9-}Kkr`8coo%d;%vO_u&A4HQ2
z&`UiEAS+&!iSGB8mE(0vlkfZKQCyaZ(soKK=jdg>s_YEM7FceQ*D*&ny<QF-ZE=JV
z4kSNPGVwB#Ix;paevnLt>DDa*_UX+~g%B)J_C5xfYyx>n4=mX+JXb^Tuv!>htEHqN
zN5yAZ1OH8Oizmvf;q_QVoDS^AKGSIUT4X(+_VY=!1X3Bfd7h`_o=LQU;eyv3k|sww
z>bZxDxj1!$(wc97JW%<F@%JDD`=kh{)Fw(2ts(|>_PwN<;ZQ|imz5SuAC4ysS$$)W
zs2LA0OD(gXTYI2E-c*obm=zK#!{5ax%jw1l`}ZH>7_UAo@Z!IuV?@PnufzFeN%d_V
z1{?8Q;O)kX*W!-w8Rz!{CVZ$Uw=+Fl(TD}2D_=W9s=y(cPiXNnI^JAB0ezcNTQ;Fg
zQJ~sg3_E7gyUq@DvbZ0+8H`5RxU0UPXYr=fOKwkHDiu?0@x3omqnG%_naRWGi4Z$*
zpSE}R{{kd(Sf+p+EXeyeW!yEzdkD^qOj~dELGoOhsat06=5I)l0skm-jCNG$ur1AT
zp{?UP9JuXsh;QS*uS=fBwQM?ATLKJt6+o52bOEXi*_M<7U1I^&29VAzv949=E-f!_
zH-;^*p6gmmBQ;vyAn#w(tDYf$3y03phHZXkewP_O|1@l4ZKU?7=Vmor?m^z#jPN<l
zu5=^l56eI<Us^-X8McM{?)S#T)(-OLb)H!-CQ?M}y<gR>mn?WFhoQ{@Wzqt1IvrrG
zw>><h)Rb5cfw$L0pP*8Yi6F+3A;(Hgj9IK9e#+rPrG7M?eFM&2p#D^C@CF*sz5(Yh
ze8a$MlfY^}c$cq+dD1+aQwf&V;PgJwwBiJuD$t;A$s}nhht_#Zay!qJ+Q-n0n(ytk
z>a<y$(};sFvdHn|Bk5w5Gx-ObO7R?>R;wApoq?QEwg8RdY`dZ1c__cdEo=(AH-3nE
zF;AANS~gs#nPhMw41!I#2v32|(yDRp;64v<q#6_ZOM;|f_#9IHcfZ{Jk4E@d`p>9Z
z7>#@&u+`!~U=5>^kX3*-!~sC#vyoa_QCR+GPO$Oo3(c|Z6l3WQirk!kV@Dd#_~@3~
zarN)}i@o!hT*)!l;@rnQnIC;z`A-7k<>Y&4hfs=(@3pR*-9`dwgq(`VQ-koWS!QM(
z5ud6G2*<9FH^!pVN!8}B%zoI30(^l?m`|&{jhN?Zr*)n{D(G}UGfV*Vvf3}?-9TN8
zB0BwlczVb1x|;WGxM^%Pw(T@llQeddG)7|^JGN~bjnkyD8Z@?T+i3KxegFRN`zc@6
zkz>}(UNhHqYQEEM4`07*X1Cq-BnnvWN3UiP6BEX5`N^p)vWiCf9Il!p3=DYf^N?Q5
zHcsQ1@O=ba=C$!XbV|r3=~OxWtPN&5SD8qA>1Tg(_xo@gy>70lf^HgK(#nvDabp>W
zATkin5L_}yE_YbVg;p(Fw0Z4^Jgi{n`%Ql_koM<~zQnaRWVL6T%Uvf@53WcD?t-hp
zL2wlq-!$x+QHejKtwJod4m_364pgE!vg<kZ#E19+Gcvz+6u>NZ_8ZV9Xhm!)pm%qC
z2#8#0*=6wbvKPEbu5X$l&s3Nbe(DsxH_gg&jqcbp_j----KySxPhyJWJ-WjgfB(jA
z#Dwy5P?&rZuOXf0y*+>Y`%|jPih9_3%4}jwX^Pvd|E&snY)XAyd&6q8KwL|GUkmb`
zx49nmw3hPHELXFWf8pPEV+Dh5zuuF_M5?!6ceaIH7wKkI#3mcoI0;%zDF1w421sxe
zigj1|Ik;@}{{tO&T2$nS1LxINX*CM-?6*Okssu01djs2_w2#_m1EU9sdL4HC<Np+n
z)WGAW7Ve5TdXqtrKth=MNG)n9EGm4)ez3p{I{W>lrv%t_gXF=Whqj58oO*N+699Tx
z15ZgW0!{rLS|dh9mzB9ZLuX8315kFEGl4l~^E0F=EkSde6WDV;y(}V`4Rj&M*9F+E
zk6X<s6N_Rtm(gfGXf;_a*;tw&KnlZ+%g(*CTM0ROwiGM+%6i@<B(lG0H6*$JQNa7&
zx{9ChC|cDOP`qx)Ucp0A(PO>P$p|8)PtU9yvV-bxX7->tb55fiZN^;&26hMRKDa%)
z7mp;hZR@F$>tuYQQGJ3<r_@rQ6&|@Sw{Mx%_|_MF0rN&y<P8`wUcga1NO*+1&F`^Q
zH_2b~H)$t%(iQP9O>!g+Jep;mkG`$K#*f6}L{OHLkWKvC#p?Sv@_2|0H}P~@OM0=5
zM$r%C1E<AtJTjJJC_1ywq%@b>T`XQ#I7;?P8Vq$XZSA+NGr3f5K+URUe3MC8U!slY
zhpoY^_jR6iS`F2Ex94p6M!`tWO*LbfoKrFpUbOV%QjG&T9)o-6HrSUuB*~3aQD?-9
z>n2L>Iz$|yU-gMN908L~o%p9B;rFBI`0FtJ-ci@H=5d$SftFSk%9Ra&`<c&_o_efP
zl+<bM>wOuSv|4*lGe|KHXLi+lXqzHVBMxb)8Bsbk-x}~MIeap1N~R)WExNze2(+v1
z%?z<X$SP@XnPjGG_fh}j@3&xLqwXt;6^eCkyVE>PCupuys4HpIVech4Tt_fi5lWu;
zr~#UFe2jdAR4j~m-kTAADVe;sLomaiwV&_f4z7pkqB{&$?&XFCwy5V4B~SxhMZX<_
zG-#6>8hCQp4gsi}&3wQ847PMWGYV9%CVF42?OnVy5>wA9?X8PNE){!OR2mt8;l1m_
zJ&(E8=mwzp)J&$m)>9W>ok4SB^K+_C%ALcPI{^+E?hs8kJEAUg7c!;=2ny9%Rb{!%
z5$;;SsMwmjDUg#+QZ2W6M3<;Um+w6<TQXKpaMcu?(HoWu(*=U(Wt`k<Nz643zDPM7
zVIKxprfb+gFx39^?$lxLnnw|VlCSNdzuih?%O1O487F>85K5v?Jhv?=ghgxk?62-f
zCdDcC^q&Ck53aCYy`SjrWLA2FE#uxEJARBrs2JoMEOp0UVn=3p6ReDuHAur3Doq2J
zToi&2h9J9qZ~s~h!&8)=TjW#ZAho6_<2kq<pyfvkA+3xiJ%zs+QP6D6wf1*I@;cgE
zw7F~;Sw!>N10;UX`Y-`CeBIv%SDzSr*Klt$fqRglIly>51Ay1lr8#6YpH!6?D0-tD
zKhz|vN_8!CSWkd{aCljM<1hWb-38sYQemy-+aq+B`okUidGg!G(}l?APRvVnb3^qh
z5T#=o2}Vl_Ca;)LE`dB6Z{ZhmFvcei#`wZ?Oc(%yS{%UmC>^DCwWN1}?SLPnMOPhC
zx7SH4-<5Cz=z;p2z-E-~7WD0w)Ly6Hm|r!S!_g6^f@*ksZAfKV4t&S7$qcIR{|t3p
z3+?G{WKKT`Eg2Tp+CtWjHY6<FuZ1Ib|IoJq+!Ufm>c%0<AJP?<fE&5o41Uo%y6s;J
zHt^Pgn0C<}@zw;et)E3M)BcgUTl2aTTBs8jQvccc`Q;L<7~TXchW{9uh^eYaZvu*8
zs8~2+ZFpjUP;UqrkU`9;zLEfI3<&_m@O3|+F_Z=E;DU^p+Sxd947adh1PdU7B0Tm8
z^as9jWtW4ly@Tzic!-)vm@S=O_Z%1D5S-B;D6cQIdEiO9MikjmZ(Sj$=KF-J4+{^L
z8y^R{WLbnPtHoG4r`nvZLU&;15ePq0<O*-JCi{Y{ZNAWuUx)}_p9d2B`gMe{3WpO@
zxqJ;73scQlLl|+~X^5h&>Cf^8jhgd3Sj4dHY9wJBUM*(3NYwCsQ@GjwPhi})d25fu
zQkp-??v~VXYco3>^X)Sl;oA$ID)?8kXtIvi;-G#CGb!)7tIRuzA-;8eo}wC>Y`n9v
zlJ_Bc9!036HhI2f2%-a;SUZ_!0zMiK^Dnji8nH>Z@fK^tRCNVaoQSbjnlpYN?1rih
zjf?P?TtcE?x9h*ZKMSIv%W*PA<0xN<8umcuV0V@bNaNPrKSJM?P$&sT#EBo8?zA|A
zXnMZ2<_t8qPz6X~56BKj1~D*lS#=oZT<~q91>yBaT{Z7@dTO5!WMDls!;cHu#?^zF
zI<p0!(;wFZ$x~NIjOPHlP}kkls@+pCQ|EXeVf9}9#ieSK4`mKmGtoORE1&-lD&ONw
z$@@f%8uny9ztOk(cau=sQVl_sV#Fwq+WRg8!c?mR-x0Rf#M~o}{am!hjP{a*T9nsy
z)Y(ysrY<(@%-nF=I&Ov7jj=VMf@$H=mazpRYG~>HwX><*1oaNq1cNYPwR$gyk*j%>
z=}zy^p)*LTbmp68-1z7fMnZSu&W<n0?g?VIOr?={Xg=IJM<-)idXw;a{n=N>k9X^W
z!MI2HC=#A(Nd-YP#Eoiir5!L?H%tWBulV@p5z0{f{c`x2Wl{nOq7KY$QFN{|19VM5
zs#N{(r7~Kq*@oe&e2TF4Z0IgKY8=hz-5?B)z|+w-j_4P>O-3po5y3Ye8=Vn&Qif;~
z(Y~;`LMgR+XKp0tsDxs<+X(414q@j;8(yd^b9J~xYSPW3FL2;515F9|GDr<fP5|d0
z8Y>-YkRKd`HarCIWw?m^nO2ioP|8#HB9in6svu>97=hAaTKfpvTI^5m>8nU(|DJA`
z;%hRY6e6v8)n0c!5v21R_-usX8NWT=A0(AIak!6mIP*W+F_xCPw@H&IDOPeoT8#k(
z&&hhsrTgVWb%(Cgrg8F5SP}6YLy*8OUWx;v`@c}t@;z0{ayIo+d8IOoKvl3r<7X03
zttpocr$klam#G5PT5+6ALxRkI)mm}R4>mVs8H?ft2U;-oBLh%B>IlWAaK)DXD&Kz~
zqMh1uP{4l3T~*3WuU&-3@lW1+g3$aGN_&2GBB54K4ymXn^K>n$YLYd+99y3AfXn%z
zHY#<rv|!12v=bUFhh<cjVt#B(Z}cz3mUh?<a;A>DuY+LXsPyK)?X?k>H<!m^VNxOO
z)|hntKYky(v-hyFNV=cQ3CtB7_g347K>Q+Vv@{I2-we5o7JmPncaC4(H;7uQI*a$z
z=92!+w)?_@kws7Om5>*5e785A=w&7gw|D%h4T1?tp!Fq#HGup0hK{28`LHzQi45JE
z7d^{D9ig5&Y_swUId}!d!7CVMU=j$dpg6FClmSvu+R{+K3QkZ3w6Vyw_QN-@pYhOu
zy_@h(0NgzcuNa4U9*yZ}hTIqQbr?_6yIdh;zHwLI9`h|;08gF{ASFix%zou)k`Y41
z61>TP0^oD&k@5*-LB25|z*hk<lxeB^yp$i60~fYrcK`V@3k4xPWgs3b^9Vi(u^R5v
ziOBpc4!W>FrxVzvR5D<dryGalC7t<%@B1*xO6aBagKmjbMBLB)atN@=J-sFUpR^+3
zqUfLtR6w`(KT+Tm;{VAilDVf2?alwZlfo4ICFZm%LXm9apJF6a$oLROgZvTfGx!h&
zkQuOO44DZ)Ul|7UmB4>rl<@<61|Vs_pSpF<(Il3Dc+{u4cQKA+AFxd)k>rpIR|b>#
z)V|cjdL_Q*@1empwX8#t+hgtdj|6|um6mh0V_G_KWffpze^9kas$r)L?LV@39@@gZ
z>(VoI_wl&`FezrDE!{^*MDxFgcByZQb^2YIm|}u&^SXA{k$nCF0EjhSNA@kmNmggT
zXE*-y{OIpStDLom@zxHCoIPLUV6^Wrb)bp!bnjomBVWIR;98E*a2J%0CbbFjmYz&+
z@J?~ghaUqEgdXFjsZR#oyMv#GR{lZkO3)2fqfh$Xk@;je#_jN3usJOv5Z_p}v=8s^
z14?fe-iMK~oBaFa(5jIffzlEl7M3yU{;*||I8|*($Ihiib~3b=8;Tq6C$s89{sWGm
zC0QXsoO`iLe(y$j$E>(^5a!ai9}4UY_e0HV_slO<>-l(WJ|gFEg~8kbS_5QDKx=?s
zY0WTPj*d*d=WmWSWxz0H0M;6q+lPLZUdYQ+Pa_Hq0CtRgV8@t{$=}2i?bgcM9N?++
zw!}^VZbV&#6{zLaNST6-S^(<kh$ta7jy*(Vh<pc+c^{GH-ug=n_|GY_`_C0sV>VFI
zy9q7!xlmY6PIx#oEys&j7D#L~xu>u>Di9hPDS6)OJiMIp-DU|GC~#(BkRRRcyJt2^
z95HUrz3zM4`*^42ch966G?g~?)Ebrx{IO<l=08$Zt70Kt#v&g4&n>kt-8T34-YKUr
z!)Yb=r-?p{^;zzXdZPB!Hw-DW&oO&tmhwCb@ya}sI`mSF0Ru0NqJ*#QQ0q?<!6!v+
zZ7V$6AL4ddvCF1nZ)8an7E&OWinqFs-(HffMt;wc971;S1FkE{i#|iz=1yVb4K7aR
z3LTs7HPV~QsP?Fh!rkKbJU|2td32+JcF?CRU=P|Vl#8bkj7zV`z0qmRu=E|CxF<C8
z2+?6CKR{ggk~UFBF(W+UHGZ2ylzHxm2q>WhjWa;GzJB>HC$ilhsOp~5A7a{0>fI3G
z-ACXb(@p8T=Aj^jt>XN^$0`K)SpBF6Vgr0=AAw^P!=7@pigFWttYTbdV6W*GZfSM9
zW`zI(n4&FBP!95l`Qs9rg*y}H%Z7kk8`-;?tRTX+X`c~S;oHf5@Ytcg`5M)%LT3w_
z3xQeqgAKp3TYSO7$gjkxgilU`?-6|0Uv9-jsr@Oaww9G9%=WY15AZqLN<VU8b(>6!
zG0@7*IwlRhB#eHh@YIR3q+a)Cc1^e;+QcE_`4<lDRz0+ob<$mayRV$oM$NkB3=wd}
zFLj>Qu|;RlXR6nH)}&+i#!$#jt%(Tn#JZf8-`%)FalK?#QH2bO_3j_+B|;9{!^~91
zJVw%KfgEl#@e#>718fg*+0@kuUs`JEZV|^`;vyO{Bd)%i`%8OqS^Guobrjxz{VN0b
zZLnqlzYV?mnr(s_1(xhEWErl?FD{i|V82cA54F>q7&4ZQ+1BWGS3Cmp8bT0$@!*Ka
zt{UR?KexqC|K?rPQ--prD8BnGh3kZ5))08%eTB&?_qyH-+8p8GSVrx<Jzkf2!QwL?
za@s8Yx-ad<<ZA`HY1S~-oLzPRBhwpbJ}N9w?#}4I=KfbV<JB6jzlVWcgURwBG4m`#
zApT%~L7PYXtHb4ll9#`g5TCORljl|RZcOPbg#&+!(w0Kthb=z39<f*mOw7BIJvgf8
zuYD|)enOK2au5{$|7KUj+k&27_#YtbH-_)#$^E%H9Gd*$2x_B9@ZQMOJvyNOT%XgD
z^6mGr#`!iw|HQH4QfUK1ICMwKvh#l(M^pdIo+51klOdL1GGw;8ZVDhnECDh^g}=zP
zs>l`mgHmZbj*P7S#b0&GH+~LKdUb7J|IX4H+>$QSslrt++PCO|pQw5`#7=s=tpr$_
z4&~=V+@A{gcdTc9oKvUnQ6m}`x*$AlcrnnQAnrc8nM@B5pZ+8Q?rClAa+mKiLF7Fb
zi%q4Kr4d9WC`(h!up^gyPIq{z<Jlw+j|j7#x!7Bi{wC3lwbN0A!x$H?@adq{nV(Dt
z(yeL$+3C9=#D|+ereXSL(9T<`l65=IEd&4U-%nW7=I|ZI|0UhTAVG}&{cPX)X+7^x
zv~3_sEi#+jQ4B1R5(IsX4_Xf1&%=ugsHCv}S)V04^7vQJ*RPvq8@=|Ob|n^cBF<%?
zUF;)Zf;{A&ej<S^MHM9y(`M^PzBnpLpLRFxy9o;`4{h@HA|0~VruaOeu@C|6CR1Yx
z0Gk8SLv@p2A%m2ZYEz3XY>{|PVat!}(fC1bV1V)hfWT4L)wrI4F7X2B65T^DtCKGQ
z#s9UA`*#p%>a%MpmTq5DltNt_0Dc>|^-r<Zu^Lriod34iWA<m^X_mU>{=sVq9e-3S
zdoReFhZalAWySTpuA!7{ec!=zq8AQWm`-h@PS2^9)=o-XcgSz#=lGs1MJ>&;qWNXd
zj`v(l@}h%QZOta{Lr}NJ>RB_L6)I5cuIgTUh{`^~_h>F4vbQNw>^A)3Q)mYy>i6|6
zI2bIHdK+K$e!Sf?vWE=Fqt!SB_JRH1VPO9^dd)C(VkLe!;Qy9tk8^KGa0gSu)Oxz6
zx?1@zSuQ{$X{-yV5R&Su;p?hfHB+5KutqK>v36X<YNX?#OUrY;_{nbB$EmXe^jZ*N
zpXF9MCO$nxp4aN%mhp>`_2>kllloq=0N}Z?u|Vc_$<!z+cXVS`k36U8zan@9Zi~1c
zu)-*K2G|@CzAuF&s!;?3UpyV5O0&93Gr%q)f2ww_n*2;ynyfd_6b+!Lt6Uir6Bcwa
zndC7Q1Or1Zc;~od$NI)SWtKP@;|VPOS&5l(C<U4n2Ri1a2Rx(3qpuM{h47vNX7ce@
z=-L0}2Zi)Ql3QN#>8R_xPy7vyo6>XI(jhRLQ7~){D(Is0@w829(m|~z7zyWyM+qC<
z%P9C($F<l=N7#Pd$bk^Cj#&A})Tx2xYOmHJL5LaUpYDhfS}DyV5Zk2_m}YMV0L4LN
zdqEcEzXVF<(Ml`=gQS7khD!v`cFFL5cqKmkH(<8Y;#eCJSi!SRDi>^Ozc84fZb?KV
z3!L6VDlr0P#l{vP#z(<}2^#9u*WDeCZZ(?mWTo`^UeaV{?Bk}oyK;05uyCsNGYeN&
zSU0nBk!W*+4Qnd{!uId@?<iayEet=PJ6j)^ezBZG@L(M_re05mv+!u~3=C|Amc5JZ
zJ9O`eH;AaYXM=S4$PdV)+F>VdhfA7-^6QM<*D{0>2w<vO9!B|tM4L#FGuO2I8$uBC
z4<uD8s}CZ}e*7i=;Jl_Bird>BA3(U+RNV17UD_+&I^m)BI{&k9p8p=~e8TcQg(k<b
z#yC?^#jUwL4$v#l3p#C<w4zW<?!j^oD}q#skC@CLEgRMf*$a;pak_K{0_N<<)R;ZZ
zKt5;{TUi?O<z`Pm9?T2I-~1R+)|aFBA_KpiI=hM4)pXTK3adRXY^C~?WXG;#DrK6;
zmhJm;$F6J=n3o+)4OnIJHg)UP1?wlK`Wz(+$8Y&P`orF<UsK+`pi)lR*yy(3*iTJV
zUx(eNO#TuY$lYQZMnW|8wB$vzyP&ZYR*Gdp5g~Af?)~FM^;gLDP;2#i@#~an#h*2p
z{LBJp)pkciPEpX0(!V@{5}nIsR8Z*(3_6d-kwth)%RvV{nlQX{Y~m20=U%vh3u_PA
zylKh(NG$|R%f4p*^AF9Q838^x&u;y}m1-r6q;ttXS+Yt>|B`H&H=z1vU>f~AY^=P3
z9L06o?uNP2n@!!oG~yA!PcUkTfWRxu%6a)m{Y344W0G?|45pCIpt`2sGFfiK8@f8-
z34Cr$h~LTxso!aYP+sMCsic#RHK>1>^fqP9M(Ta{(t}TqG{Xs5%Ax6ock^h=ak1i^
zrDhljF+0ftl{6q-ii!LSCHbiJMrKd~0bNfm1T~8Pf|dugIwT*#+@F}p-d$lOzAzNP
z{gHeGo@Nk+0=U29XEddLy4HJ55kP)-@xE?o-TclEmQLqFD_qu#tmQ&~a5Bh95G9I=
z;#Ip7rNGZtm{8!mWAkI+H>FdqOM)AIN|2Um9%Yl1{_dFcXy3;ARa#~=t-u({q4Gvl
z(^nCKK#>#sRT}f<yy%M$7zKL)qhOD^CW(M6=><T+cHIUqw1zGK6zuaQ|Jihb)vN+T
zOUyT54-T0HY(b^Pv*(}6)(}<N7S7r|wT#=#WN7r|22Y~uXR5DT$M<Rc*#uYw;Yqx`
zoslE352&|DFYk(}K^W&fqm<Hg1T#yF8?r3_$Ds1LTsrO8?e1G^*ZXB~=BaHvv?ENq
zl(PjWW`58uMGjyFH$}SOrl^&EMFwb!bb+SmP;_!mW>O7Mc;Ps^;5k^B%scdf8)gT<
zPFMNKA)9Qw9NHmU--k5CY2xKiYckpClLt=EveVAF%S?4WIU<<oa1~uP$;xiXbxpSP
z;`oI=!E~W=hDCXf=0(3MUKaF4wceAK;B%pobXakU`U9hxti(#_&MMgp`CYj<%h&gv
zkXUxJ$m-oPc??Y%mC|HHARTNmU_*OW*vFrzvbL#~aPS85M)x@<JzRcQ^pNCG?5Osu
zw0@KTb&xW2x(uRa6tmPIYv+^G)q%2?G3i8(-G@>oeob-#KGJO#)3;09<ggfVvyP^7
z{F1+_@t5|CDQG%%R1S=GkCMWC{?M_7<sSBj%I%-_>sDPf&cjG1D(IQ7m+D`??3;Ud
z*4JRn9QxC`%doem@j<l}NA6Y2@K8(?ZNeO1as)Py6D_-pPqqfQQyoN_$~{uphufM`
z@oFG&tdY*0am@+NR6dVq<h7b1tLOrgpVtaZzN8C74LqQ9a{)-i@<`RDWYs3{8D0Kd
z)L^#op#}g}P^DUX7g<RyBytM3YN0M;Ld2lj8$Rg8OOF^?nQ9#;iCK^M&e?NU1YJ)T
zoe!mc>RFp&y|T2SS@oXSxmz24aUl6rl`0aus-5)mXk*kye1q@i;H3zO9m<|WI^`&3
z=Wuy3%Mm_gjm-*o+RXC^7b$%ANAXX|AFL}o?E?nQmd2s>Sv=)cO7%bUXppQ&QE>7)
zml$MGt?i^vbpST?IhTm>d;_j##yYJV@NQuvnlr=LPUXjHzXjdFK0)q!aj|v2`JtgJ
zv%Pei6P##^&c1%BGb3G9JomNEu0g(Ke9t*>`^9#JRZb$Zg8Dxn+lvD)w|wjqy_9;A
zBYZyo!4Pg4h_52S<*VH_^TaoXJIB5Kecc?li~3Zn<%uqia0u&#tz--37bjEa_pBp(
zcX7Jn=_{Qh)B*|EBQDq@YS<&}UdV8EkQ<$HvLmNrNtsOHPPlzed=VeoQ2k5CZ$sju
zcr(*&<Y0?7_5yL5!<cPHL;Hi80?FR3HwRGl*ESj*J?f}z2aq)6bI+clhRIMldMeGH
ze>0&22+`r`+kWc7_Vq!{e%s%1S>q)O*Up*6xa<P}dN(<Msk_lyd_vWJuD~Z)T*DP}
z-1>OoGe_56$A^pOQhq#ygI#c=Y}@#hl7FLk4l^y8F4_@3L5O*qE)3ZNQ^o7~y*tOD
zQ-2lX`K32{8x^efzc?=)FFc%{h7NAb@>@L3S(4mkCr!zf_WGC^*K4zzH*-FZv(P24
zhx$2lmqMSu^JcZdeb}&<PiLsD`)iNDy2?D{^|&{w)uC=0W~7}p4qaLr9W|6hs#{By
z(|0K!_1|O{JvY;quiI;#p)xf(D_TMkS>FVpF$epa=Cw0VlA`kCzW<}peyh70Qk<=`
zTeX8nJ$^Ud+|Uk-d0G*`VK3<vRJyqLkng(t<hHiqB=nMddPPS@nq-eix+qocCHJ=*
zr_Ka6JrflNb~`_;hvO&XXI-B-?TSGo@qK0Js{N!pp~N&L+SgtlWG2a^5Yt~jIQ?m(
zVbF^K4x3a4Ac(}0lB+Z|Ka&pwI$CA&0&A)QFo%t!EMze^`<cEBOTSc%>y(oVX(^6k
zLYXd^kSw_}SmxTDl`R=buvQ9p@6si4NI9MfTo5Xfr4u4cp3x-gZ0)RGaK~<H&^ikp
zTg>FNvp}wiukED={m!a{@PPFx3GGbt5rPm1=#=QaJV@w6PNMye5vN(92b!IK`>+Zf
z{BWY<yW~sxYW#(ELxy?FBxc8IU3tXRbm(gV+NZ9|)v=P_?TpY0zo@m9rN#wm#0IfQ
zPSU~M!YCkQk}L45^>4sNHypZRdpc$OD)15GLv#I?IDZ0cXiiC6!Pb@&Ru?1-iuT3?
zOn*gEQb-&rp?mH!6XA&4oU-qf2}7f(L&hURyHfQAc%Q#eOCl#o1N#eUB6xqHX3(y$
zv!qM}HurRK_9Yp1Ao>u*obI(<US?&j!tf`ieh4^xtl7abbS_>At|tuZ>+6V}a9<<l
z7DsQyqupk(fsFNcp}u$H&6NG>S3bIib%Yn3?L?0aX(Bc{$5>S&LeM+(J%!-bt}Dnz
z7@laCx#ryLwJ_MI-cKX*c}PNN5e=qMclCBAd%*m|FF~g`3jtPTd5SDfVK&uSj$+C8
z{#77EC4sla<h)_8a`hznpt`1NtfBq;aFxnKVppj@mbLtcN@XQ2&82vziEdk;g%&1e
zoSakCLG43Y)awko{(()w`+9{0QQzHS0p|}j3Kp)UuN3dNbn}%b5udH9evIXmY1DJk
z&sWy{D67X(ZE$gK#`-!Jf$v_9?OWR3(bxpb2UF@BwxJ!fF_7{3sTux7$QG>&jD`4s
zv5*%%PzyjYyZ~6pwp-stRo?~By8gTLgvUO__gjdl-TB}H=s^7@fF!O@e-zRFbV2#O
z)9H=AUf#c++#>;*LQX)}ii1`6Fl9gOb3fj+G)Od$zB#;R_?`{R0;f|K{OcJa4VV8f
z`JX(<XGFd{Q;w0GWPf=h%J3^_*3J(hB4_sftcF3Ksu-!|4f>=5ag~8GowWcc(+&HE
zQ%WoG*?s^K4Cv?-jTjU_1Vc_FdTvwC5x(r~Fp#qD01Qob6r6fMr4Ucm2_^f|m*Q5F
zNvaTe%A>Zk%Z~uRZO&sO{6)^Y1o3~G&PF(h#z8Y~%76?q!oV2MYF#!+&&Zx=OLCHS
ze~2!NKV|HF_QOw+iZ{r2UarWPax80WLQnjLn=Y_3TgV+9>wE_7_sl}w>0Tsb$hs30
zu!F^b8+p8;;l~D}@TKREL&)oW`L3F}-pLas<WIG~jI%x<eNq~s2vUelC*fmi%;Hk`
zY!z#P`P*Tc)Mgfd50-xd@WJn2b;<M<63b~xu+tJn(N#s!z#3#^VMnTq>Gnoyb-NI<
z04-NvBv^;O{TFZhFHU!4nr@jCECr&1TF0bgKP^PB<}+`hlp$?luzpcNaBt#dQQ-Es
zpA;`lz&&n_-g?o-Xt(wYW?8tU8$z{<jecbg(!|Wk3w_-9p$^KPuMk~dmpJCjzyBuD
zUAoJbv!axIfc#t|4Eprp@($}JWfcC9sVyad6exy$J^St5IVrmon|!m*PyC{iR#NF-
z+j#M)Iq0bn4>=g9Mo{XQPC}=*UKg=))F^>y*My;z#G!Q4C3dR-xp90-aI~w)f6=aT
z>Wx+=b5h`FSN3q@x@2P@+Vxt8{i*2g+rncJP#qj30&UonF*su3X&3%_D0L?>*L%O?
zdi8<^oPOyJq+dEaata*bX1|DcXu~`QwNxh(3&6gjY)iB3I%23wC?8$>>pqhfbB!8%
z!k281rD;3(=-nxN<P!>G@|6p?EDN8-`lYiUs!_eCaV~CDmCNbBr-0w*2n^A04-7Jl
zsBs+vft`B*$iN6Zm8=1P3@V5z47xnd(IXan3l7Xc9z)y+IFBJ|B%3_dla84?S_odJ
z_CsFx3AJ<SSD5VbfNPWBAX`p>vrqY%`#$d&GTycTeg)moOOx-kY5NbVOH@ej0DDr8
z$6A*8{&9VO)fPgqEuR`bs10{X{QSoYJ~6H`7qgZv3EpYJ^LCH2n&o?El)qK$3PI*w
z&^M$0bT+<Re9_#O9Nb<q9&Ytp+pGdNqv-YMyK&q!5cR7V^@=04XSrrsHdnW?B7t!o
z@N$2Q!O^-y>Rekuw5~BQ|J0FkjmdJ2z{^1<dcUdsvihmcFdtL64D6mixxjjspZ7@0
zXCwJqS1xd0Y+|S-)N{)H@?D|{Izr8eARAir#k(j}RzNr-%mK4zbu*&+qb1ydshiWQ
zK3(%fTRJ*lQA)RKq=MzPcZ3{9Q)kY+c+D~zCNwcGZz{h$mI1xQ<u{<0*fcY#2gKT!
z8~_iO3n#1%FAQd=|4f*%bhSzdgELoN0TxF}xc-_m#N>7cm;BWW{U3Zdo?e5IrNo11
zFLS;lV83m5GN#mPINQxWikr&YwHeCVS?7p_n$Os)mrK;TH+oJpM*nN|L9+VjyX#?O
zI(;x%_<zBE@nrr>ObMy~9b3j+_|1sqL}UM*SZkl<SSbDYt+Y|l_G)P<WoVj+*H&FV
zP0!`09F_ux#M~ck%0#{`IJn3CwGgVQ5BIA$<>1tWpWxI4C0&<DzzFmcXph8Q!j6~2
zj&oSMW|OU{I~)&jgJxtaSI}&MJkFpIAdeGa3kmSWeAx2RSk*Je)Di5oWj6Z+fP&b=
z+@Bm<;^Ui7nD!m_JT|CQQ->Bkl@+H?c6QcZixh>l#;e8#|NW;#Z`|>gIdB%*X7aQ)
znxTq1jfsyQI0uy~ppqO?w8!Wkp!UH?O8H7>LzwxYc%r>&v{zjA+{3R~<KDro!JKEn
z0DwW3<T4|v)d)mEKOM>cKu5hnvS;6<;KL^C|D`6HXgCpbO&c&@P%oJ}=kCE8u+y~a
ztZ(<jGQ$&dkLuouN1XfQn7>oCb4-~2WSG#E<U?zo%1*IX6B?U5`8fJ-t#F2B9J=|6
z|3)lt*)h-399vfcQ)JE@?I&2`t_04p&eK}@1msvN0Xf$G^dINcKh6O*HwBS93)#+U
zHuWkr{&5X}_-3C61FCo@aClZsQFo%FVo*ggC_@9$C)GS;%{q2z2W==#uX@}+i2gt8
z8~J=Zo2BrNs*?LV4D~-gt9=~?jV==cF#JxkQX5_Nu>DiJ<B$^6VK`lnS2|1gglce{
zC<x)3AjdebsJuIYj8SquHU!ty%vY+I&eBsZ>}*U;{lVNp+!u)S9lNc+G6DSfXdAj5
zKOi+I&m;UwH|Kx#>0(Vz>M}Rw42%}OWKGrmLV)5VOHKQx9w$H4>5v>V?7>6y+U=UE
z-}|wa?yLSbotwz?Ozu*z;u{mG#Bu%l08_5_?1<3IW9Z**zsjFy^$<gJm**^&{(n~3
zrza4!j%G<2o*{+;w3Xrh*cTXd-=FX5hP}V)32i{m$zv<fSe%I<kmHj@ZGyE=8ub%4
zjR-$6HG*!Z6~B>)SXb}265Gd1)qJC%10l51)Kp*YfW^%pa}5?DN6D~xaC%9|DgSCo
z&88}Hd(}vfuAE1ZB>oaBJow{nA9jMy-E2hcg$+mO<JyrwzH=2l&~+#>aKra6w%e(n
zWYWZd>Gk@TKA*aQ^0QZqai_i+Yys*wtX(@fv-+3Ddf2Wa)Z*cyw#=hL2roxz`(d2|
zTuq3#tA3{orbN)&RR;7YA+mi9NM|EDm{oHgd?FO&N0Rrv0YE}@^cLe`8-~rqAt|r4
zryQuN38u*FfRaIZZ@2;#uzBtQ5>R>yHCrmRYOp_*Uf4T%<@3+VWJ4&u(CnaLz;_3c
z{6)Ig=~oAgn^vFlAZa=x$~4AnG^vrs7h|#0ADcrE!OaS6di5{>DBM};k3--}1y~tG
z_t-@DwDKH(c#y^8WN2P`pM1OZM&w>Lo8zo|P(4e!U@sb@Fk1Cl&hjE=rWb;_n=#ug
zCFx#My~srP>$B@XapUzZzYqB?T>}yu?et@;vJe&{N{?3Mohh+ealr866-REmN&L#+
z(w1?^q?c?~QqoKR<B)YdJ0eynPn_I;l;@lmL>EVyyF@#ahsZ-N@Kwj?_#;C06!4)!
z`3TT4f?7DRyd7adX0Bh|$@3L=rZLyT`kKxn9!Y<g@AL#Jh!<!#eRrOA%hpi%W4+R9
zGM<1gOC$qXz<BWqhiSv}&p{uAzzXE#B*dUraxGFELj_6STA=7g8AVHTR|koY*NP&u
zP6cjK`~vUx+bybt?})>@2IL1II_u3Luvs5i1p6*v5w_ljM}&d2syCpAd7wDAqdKnv
z_b?9^F?g*Z?_e_iZNtzy>>V7P_4ggK?|p3hec{Yhh_3EMwIj*yGt@hU(e<nUyGQ(c
zV!+NhZ&2Vq#}^F0&LP++lifH}Iuau6*5~VVOX6m70dc#d<&_2}o2o_b5!9D;0v}?%
zHoJcX7z>D-d`IZ0^?3nXT-YkjN>x*HTz6vk^N#miQyLqI)Qc-cU+%%m&Qq|mb5Yv_
z5m0uX0?JNfyTNs>p>+Vndj4UjTVkta;VO{Oi(=F(g#uJxDJo5LDoujQ+{7i%E*y;(
z@xi5*`Cgu6Mg({>C>)Jk{8RMiF#^b;@oOIw&-W1r<<=ea`<UFJ-%LaQ5}U=F;q}vu
zy`b4O5ZcLqHa-6h-~QPK%?^ybuY<k4?P^PpfVX!Y@b+F|Z&#^rR{_ZTnR~?zvoR1B
zvKnk1`YRt%6O2l;T7|GyV5i;rSEU^Qc{Yzf<QOOPxLY%@H0{dAhqy5dD&pC!gj=tR
zQb-(`gg<HN3I9@A`<*tJT>s)BFBmJtoVA|0A<(GB#**jyK?eE#!IU)iA8|u+p#DzX
z)l~4!KH0@1frA|3zpmphB5ZLc<Ku+T8_Vmn9+Y87ABEr)EyMD<W`b*H!~0@mxdFt^
zOx!xvyM$>q?;~<yUQG`a8i7_MkH|p%_lF7nx2IfEtplY4rP9W#-~73y46y;m*YrZ3
z_r>*&{_n4tP@@7ep4VTH-*>w$d7aAlKC#UDNI^H=rVSB>{iI#TwD&p*T^hii(l&Mw
zVKm!Q7QSp8F*sq<EGMnOozM;uvN|FW?MM;pNbg_G{S0wuiYy8aD)aLIqknhwnZb3I
zK^{PZI4kyZLFOlrBoAVqWzh9;j^4BQI`5DIuHW{6`mHEwFPn6vf-c$<*Od$XmbQUJ
zRpP3v-D553q6mniZBPc{Xs@HA67Rot(j31>o<TrARIdu=1@Tv35u0+U^jmyhe`Jl}
zj?*e^p4=wITC7x*>V_FNCeB$Mr9UVMQ<6J#!>%Wr3#WAk+DI}gP3=56H;(+vEs+4s
zE*+5Ef}wG*z}H~=E|cTX)AGI3V{xPP9M0})1$^W0;DW6hs77OT)wo;%FJv`Pjk*S(
zmM5Q<0|oO-(9#4~d7DJT@19ehIUqk?ssXIlmT6Fkx9p&u!$7gR;=FBjm<Rt>%fY|Z
zaeTbewZEDce|?8EOrHldpwUiV0`Y_8hGtf1iphrQNox<p*&?@7ue_sPFZ}$AKg*)A
zuwFFN15p}UQrK7D|AjtQ>^+{S8o}mr`FAN0^y!1k<t}i!?5oBV1C+~MzyM!@A1jg{
zD}aiU`)wL;OLs>PaD`=g0z}rX9*`@+u%~A>*kQS=mp1&stA&T>Ud|p8($L38`pP5Q
z<i6dj?l>MS;XZCDSdaTNt(@Pm>Y$Q`y{x4)v^TLgKmHr1_<!P?f}Q`wH|Dp1_{PIH
z%O%*y5J4YrZ<KpsR=bgt;Ai`H;cQ>`6_I7d;yYRwdRX<!x$S^>ca(<Ak(JDq*dn+p
z^~g!bkFmt9>o!I`ksf)*DOj<`BFA|zHNitBI|e}P9)TRa6>wg8jphhGQhC#=QCmz2
zY}ke)ef<Aj+3sT>hnt+f*BbpNa&1E2AmzN5Ypy#bwGf)A6qv{$9Wz5tFa={4V_?i8
zgMmdHz(g~Es(U)Bs3p0m1)S(>;e$M6+)#JQV+R2DgPB0aJo1S9jd@r*sHXi%?OD_G
zmW}fg!;)5CPbx#Qu#cf>rRa(3m9Z_6BSjX`>2D)Tpv2r0K{nTnu(-vUgvCp-wt;GF
z2y))<_NL`dC9QB)S4oS1F!v$T<=R?xmf~Q;vy52MyhPGHkl|IVtQAU@p%<|>j@&k~
z$jWUUBM_|;W=bmVi5C`9X27wGgXdU29Sp<CXBHEMLSBDC1znk^ja=ljhwQt-tMBWl
zgEso`*Vg(PQ2q$G**wWXYm~_?$3tp}v-B2WZd!@USuVw<VRPMx70fvnn3yx_6v7vn
za7z6KN5Pnbvpc5Bt>J(u7;_-ILmV+&ogrKuNZaEom~)|F?HFx6gK8XEoP-C0U<y@y
zK8yOOA$I-SwGA6|q7_8)dAwpmpKA2_!OML<&!*o5x%hK1?3<cWXI`9Xv_#?k45QkS
z?-Gp8P%tqfDa9K~Zh-97r?_>jyN{uu%dp#%ulfT6;$<(Wj%Fo_#Aya}yD?LqBR-UZ
z+^6T@oUuwpa7kzR%#1oD+b9HY+~s+Fbw<LJwPSRB6ocMrPoaKmJW@wi>#qvjekoNT
zv3vCg3o7KnQp77&142_JwAN0xU#@vy%8wV_EjE1x8Imvc5)?>w^13b_j_<W0{&ntU
zL)3uQlL)fc80pL4Nh=Rr!&lNadpBz?BAZY2N(R9%^7Y0Jmj^&t{P!JMhtcjV<KKoA
zhWdTu-+jjJNWJ~>|0xls<Lot^!M9Ka=db@3@E;5{av&Ame~dw_3D{&q|Ak(D1j#M`
zK*ej_EEfLd4tD93VklBfvuFaD{3wjZqqAhA8q)=Ju(;lNA;pP7=H)NK`7S1lNtvHE
zuMFrd0@QDhD^K`e>wozPY3L&IgleEn4|y<b<LS>Dnh}DLT+RjU$MrtUFq~s8&f+zJ
zk`f%=M2FX_i`7sxa{iS&<Qq~M6CTa7n7Di?Uf<B6q0$rkkZbAK{%=`fs^<?=$n39T
z=Btk80@I8PlJX)u%7K#_KrNB?3#cW&><phE1Gxe_KrMk!!D&my2`=bx@E6*v&+rZB
z5t?_169AAvkP;{+n5jmMC`TL6_JO>SupJm<_)fu5N^M)c;j+j-!yI^)4=y|V4)IT=
z$Aw-EWVXc7{bvJXiasBYA1ab;bj7q+-zQr*(=jiL&xff#9I9ft-AIk6W(DZ>iNzOF
zI`ZG*UNno_S+;=2|N2r|bd8qlC^ON?;ryJS=?eVOdLuKQJ|a$Q*Gw`M+<4-%W(!xj
zyPpDSs>DLZ7_3d-ix=lxhX)Ij-aRoS466Mz##`$8*^`SmuWxMd)4A4pIuNbQ@Naz+
z^Af3JP5{Dq&%^kHW8wf6r9n_)Omb4tKFnacd=FK9d!2k&_8slIf$%!|bINNo{2;e2
z+BLX<*acJfgWs2i0qTAipzg^?L_5_*JAtmriEKlmBD|VRu!@KOoD<+%CM`H6bAY>G
zxW5#AN1W#8UPuuWvbCE}nYbcwQ=kdmU7M&OSeK6&<x{)aWkB3oGv~ArZfBUhTW`yK
zW?FkgqAH*yHda_)KA#uZu)h9*`bOYnFxD@3T?$(D(Am$T;Jw`b_Kjy?8qFteT9#R8
zltrnX)Ki8&4)xX_xFiYY_lB^H-YiKUa4jmaFpq$*mi%yXzR06Z`&;-j>a5Yig^xlB
zFP#kKk1CI&FAzlp(r%Jp`CfSJC_DY$v7i`lV@64qy&Ntv8&3a1ESY42x|wfoYYUB8
zwxLjInkzV?Vx%buon^2|xScyHXhT@YBXAOf2pwh6@*BP0E<0^dhXJFRz7pY(KaSL%
z0NmkqwM_te$Hz!h)a!8ZIR4DpJT8gSSqUQ7YVl)byuwKOL=3+KPKH-gd`g;wFF!)?
zcLnpx0+lJkGcdl+bSQJ74GKayLIrAk*ibabCKiL{LZA8^YYS-+)8f!p&^Qs+YinV!
zCbpS8INt$MeTN<@V7-^w57l4PdJDEGfUrrV?yQx^fBDa4q`wH}cM-KsK2cQkvseQb
z5ge|Up7~)GYp|Ng$FL&orS+ako}oF$R~ATbcw_>sMl;iP7T;b{?t3<-tMwk5euHnn
zvCQ$}-D>(hWxl*+XYu`!smf_%x_RO44!D6SZ@<}SBc|s|DGy6&)LBB`2)iBIX3{6o
z+GXZ1r@>B=ViRcRN=7i{n=nTeapDY=9y|ZA6Apj0|JSocGyk7b^)24R#%%oxR^%1a
znj=+I0w&nE{c6<{QS_V;9DQu<8Dsbbu&^Qma@nb^Nxyd+0av?Up;@v$c4S-ZzXK^f
z$~8+AGD)XqV5ENo%txF#z<f|lCF8IIVEz<vG=)oGtjS>L0!(eTxV}q<xE1t*14ai>
zsfix|+Gd#oGpPdoAo0>V^N8P?yGr|{zGv<p>c(^6pi_;oQprNihfC*ch`4_nh;v=0
z#=5^{3;AHI_yyJf(PZ;uB9G(5G%Pbv5gV7C8*Bjyr|{>bB67ZQtq;llKHb&;2_I|t
z)6r~?xTBuXva9~o5A;4JFrx)CNjA|Se4Xs#TWen}!QLMkHl<r!yi4`^g-^mGSSF^=
z+STGdxqFy-o@e=ObGV^uZ-?b!^oB7}u<h9Rvth$fVRFOoW(bh>b|~xj#2^$IU72HT
zb(fiGs=QDydURA<+slWfx3VN27fVt|0h!-EV-#<aF(U-Bk4%ZcX@ggg*!vv!@_yQZ
z?6%V!|MT@bt5D0pv_vD-aKdT&9A%EHTfelgyNw$)cOl5z06ihD1dd61>1>s<>s1ii
zk5Vcg&1MQ?DP;V#gvtMr7Q4GAP*m-MZ4ZhI{2yCQjAyvQvQV7*<$pXJu?k-xcPbNT
z!!Y~;XX=qC&O_^=kvzI-?mqc+dVWHg?hL0-dc&R8ahP6RU=(|9BOQAs0@pV(;QFRf
zG6S(j+ITL6lLojRyPj+;nQ{!c->y#T26MjCrEo&aa6U`Oj+IL+mt&V#LpB#SM93~#
zs5gA`J8CX02#6Ak&i7|3qYo24I;+Q#r^f3F?sxBZd}|RBg|FxcQ&hUh6XY>BGcJ!!
z`!c&})BM={y7Hvf%;7K+>|~`GXa_AMd&YgbRBP6ogY3EPC)g|36F5e2-)?k&+M8uN
z=_J$NKh#pKFb+9}?_7&`E3ioBF^^aXbz5m;;Ca|`86mE2GwGy43?oQzt0R4@<K+X=
zyv=I3t|9=<57+JQf&zcxU1yO^BsT0m^~D|7#F=R*cG-SENEBF6m=k$gXaBuar*N#0
z*)mS>uy424vE)wV+p9OwV!*w0fz@=udg)l8K6k_8B1o_L1+j{U_8k%0+MmznF!2Rl
zZ?tCC36Ecans9ulXQ~65WA~g*I+tekiI@>R=K1Ti8gb{6JA0{ce`3ov&y#q4t-unr
zg3uC~0(ksc;PLacTqcOA+t@n-<EJ6W(vi*rj~_3qz3z7vf!I7k?LHEC{2{>jXBv>6
zW?6SrjRt+MYmq~Y4qc(2lu`9OSEFVGMikV(KFzbU0&il4kSMl?N+uq7@^(*@n*6(%
zF2`d>S%50M881%zl?5uH#1bxtaaKjbi|9{pc?Z2(b8ylK%c)^L1IsBkMhA)!r#W*X
z_h!VSEDevGPRa-jg<m@Dc)T&f;2cIB1SO(|U$zU~WLhdoM2Z#n>?cdE%uC^9af@$c
z9*GP#dq(Eke=SzZ`k{o^pl$fq$ZP<$CDbx-jfCg#s#?Gm!}S|z*Tq(lY$_;i7=*f#
zWL6Ls-&}fawWQ|>+iY050@u{{mTYQzZPyyRZCOIslI)j$=%TEisfjgVMI#}%2ayk_
zruy5eb6*Wtp*w3UzdDak6HzolS+|iJ?Js#)QV-js)~PM05X^CoEn^f_{ZYelwW12J
z^&e4LV`Q<cj<ct&A*)lU7kK{}iC@^k<qkS`d3<k@@Ep6VWTC2BkbGue%$ZQL4nD;z
zXu4(-uUQt4?Rs{qe75z36=ylwYh@~ElEBTx6!eDFrttWSETq{$1~jU;1!iG-SmEoK
z`>877>&wAk$J}%DV(#`qnNeex?MNWk`Rn$WEzrsysAeVH_A3R&je?r^(=ofi#Ib89
zQO<Wd9KPNgy|{xa!J+44_?&V62{Zx2$#lO6mkIodjeF3&ml+OJO}$tEAmM?B0xrI~
zhto5}R8+Tt(^DZ1*~AO@E*${e#tpIv_-+*|&_QUWaLI+6N#>4s{d*omU<9qb3QeH1
z?lTHVJ;$Z=*w9=p6G}+8;_XAM)m!!JmE+_ZcM8k8N4#HzvcO-|MbIDO7Vn36N!8Jl
zuLmZc-A-)PCt}Yg&mX?DEV$&KW?nrVd-r!ddfoY~5b+{@6v*j5SCH`Si(OHVFR~5_
z`4lH-Mv#EsAw5imB0(=Se4BjL=gS>6e87Iyewf_gVxEm|wnY)U`tAAy3-ng^aXj=5
zsW{~TA^kfSI`It2PQI2yr;UYr+dT7QV}n>{74XVl+Q2J6x^7{`RW4ti6$v11aCx;Q
zcmX%oUaNTVI~D74w^v~qja}Wt7;(7si{-2}xVKqd-m72TGdw7s?c=$X6A$C0cCV;6
zJ&$dkt+keRqO`xVKLymyK-*NHN;?jv@452F4Ka#or7L6`OPL(Sw6SK>`hKaycUtz@
zGtw~qt7-bZ{`b*&fQhTyAp2bpt-lFiDIgwUv_2m$M;?(I?yZ&UWoH;-kDOp(8D&2?
zE3W{?qqz@^hmk`pXTVBx|CeEUaqTEUqlo*cx0%;(()A$F&0?>(po+zdOY9A!fEu3I
z$nxWfYitE7XJo~@LYC{opUPyOj0x1jr=+6KanJid<VO{h_m|K)^@TQz4-GJ15uZj8
zH%nC&j`gnjkN9~^#~sh-iH4bapr#{+4+eTU*Mp8?$?UOc><91zU)*t^&fP<y6j-7#
z;IbP1&(NED?$axm(SY<XB!3R5>IA52U^;a^KD@Yytg&XPr+gl;Cx{v|Xhs6v&;Mx7
z>9$`Pu&-IIsZBN8FB_)SH-zccTw8An-g4d4F=y5B=Sha{RmDF~8Ct6=&;b6v;hw8I
zoX^i_Y<B3{H?5<zWa{Bk*>l@KuI$(bBeQEZY}o=I&betbaLKCn)sqRqYSsF=otEZ&
z7I-7*U1Q%}(jQs-7t+>2>!$s$?^|i^g8b?~5KK;a$n~B{SmxZ>LTYm{mM?$hS;%-e
z$>!6?*Rac^&#g9X;W;O3C3?-_g#;=L^yfDzJFO|G*jwy(qwF3+;$o7LJ)TtyZ?5eN
zCB%B8URw?7;zsr5Z*C{Nf+&|fc}Bk8b}TyhN~c-T1AQzFkj4T#``Z3OtIi&;KCUYj
z`fn+3^lH>=YsoR^-Ak)bp+l6^Q@i^lOaiWoHrr2<P8bFRuslWyy@=)Qsg;c;M8Ekj
zH$<U?N1JyE2G6D!7AIbHmFnM6%F=<^P~re)qtG-snqIRZ-xQb)OVgj4RAri1PsP@j
zB^>J~{Ug6sDtTE}46H*^O$ME6Q&N$USQw&HvlIO;sTlt`D+<IeL$yz<kJonD8gmWS
zpR39z*)a!>R-We(4_401mkY;cq`>VeT^SW_XebFJ-k3b|>L<CoSH*i;=sH!}j~nbW
z7eNilW>m#e`oX?HUU}P2;r!fHl54|ptzU}BndripDA~zVA{h@Cy9j^4<vLba+~Pm}
zaX{qqaeJsdqe^yv^2+FOQ~3YNB|Ai6@h4;*C(%Mm)uHwdQMNwhabZInI-1Ir!VYSd
z^i#HgRYnrc$I^ZRPLM9*UbOF?Y2&p@8>0XWzLMh@6I<c4d72Q>_*3f(x^<BjG0Xwn
zUmOOBG$^$DZv%fol;j|Fou6^-5-<Klu?ElROFC(NA=4z|!uf3`A85t|1Bh#5YZ+d7
zv0u1IsV@S_?tq{F9Tv?U<k+xxEuxC>B3T&_RSl&AL{)nhbzW*IsM|<+0~_cpfr`Gg
zioTc6QqZj3DAIArdBcw?-qsBRYnU~&!5d?yR$;coPEKbQ5k!n4s>J0&HxhmBX5k@@
zdsV?C7Iw(<s&i?ZKOHPd8wzyqGS{m(2KSPZlcB1x0eC2)jTpt(W2CIehq%9#S#RJ_
zUQA^L0-<8f>Z-j-s+e&k&!?t>K!-ENq61Ja&w}9=n;>0xYf++rybrz-oiH0C#zeCn
zMzRYM51R}!TIT)4lZ0)tah()tY{Df%MyH@p{}|g~nAT-8`mab)xdwgtKDd49!#N05
zIyFs^dj3Vap4JSJgCYJkst3Bz)(>UUL3_Ag(t7Aym~*9i+geO3FU~Bcc$f_db&;g;
z%uvuDghh}zX6#u0-yK(tFI`L?13CxsO?!!KPB!Lvh42R*_C`3wZBB!Pf~=@TXR*Hm
zw_-?QbV8v-L9^jbVblB^d60al2gc#0ryF4>!>hgME)uzfN>MpoWr?<A(yxf>*~|1&
z2({wP*_CPkm;<@>E*A%nM37oIW<~eb!$*A4GAQ4glN5KA7~ygN6aBQ)@la`2?5n5%
z?XTs&><)iey*FYvPVZ8*guG`Q{88IJ%1<dJi6P`fR}_PDcBX1K5d5f%6vKaqvCKor
zJX0AtmPg9{N@ExF03n<{lBfEzRlbPx%@(Bc<I}6h!7q^W#B>wxJ=9zG&qzN(WFmI>
zMRrnROG;a7Og5ZX6d!pDw$<Vd(1%Twndt8JJBK5l!CsM>t>`WCsQp<txJJW-<KHXq
zu;(2kH0)Pgn}rT|89N37fud8Y@GN}v5kg7}rl_GuRrBr|sXHH#(XqJQk9dH*lZ-GB
z-5FkiE8@OEDa8LH>l>r<Y@&7>G-=Exjomc1)3~v1G`4Nqwrw=Ft;V*k#yR)%e(PK3
ztaW~-&7XTRv**(6U6@X@*Yhtj@o>8<XDZmzApqQ{em_$%j-@Gv4Ap#Km72;i1R>ew
z@8RNGfL`0jDm}#x#<QdM!0h^mWl9x$E_2t#tryX9?b~LMeh}VHbUdC_t`k$a*PXXA
zPBSia>GwTERBkm<9(6N8z}H<$^AMk_yP?u1UjE|!eJ<}cyoPex?Ox;&$LodFsbS~5
zTxqQAt5o1s!WHxvXjR;Xk-Bdr5TXsg8>?pt>OGaN&&$yeIyjdH9_B|7o2u`6f9Smc
z-9;Z7t6|X))c!1YijVeL=%k*Pi(Bb@&DLRE>vUt~C|{jSRL+~ZkS<Q*Qo)I!skNWy
zun<YI_K^H`(ICZ?d&wbkANnrLg$2Ct_*Fa7@|z>aMvzahuKX~p?Kgqmy{4^4mP;hJ
z%;JS+W?E)><%MR)P4jTEs}rb=F`kiARmH_|Q?tF&@zHQ1x8>~0>u_%n;=}20a&ip`
zm$qX1!_yn(DP4EHZ-#vjlE|ql7(xe%`kUDoe&?ANG3S631HKAKF+UqsmJZ^Ta2k^n
zg7w^k&XwZMfiGwrdN{%JQKOnkb1wu)&~9QU<<#y2XQT5Pt3@?wBQy^y<sd|H`BFF(
zaV@QmGj-}$OZdq40Mt>;6fpM%+nqleN;SnQ?pp%i@9c2hp6K>$J<kk(G`QXw9#s0L
z2MRD3`-xQ#nn4{(qyI9}mhJ6h%+DveTgI#B7$^Dh3Hd-aImaiEj3~!1BvjKeOvS{E
zP21r(`Z}+i)pYlA7uWoyxdUQ0>ArUr!&HMLVnQsv)3-9VaYs0%VkM>#xZ6#c3M#`2
z&VhCew_>Y*Bi_<tSvnw3r50GR(uvHmZq6#m%<%*l8U+?~7hKmhE8~r4ODTcQ@ImEj
zL!oW7WctnOz5G=c(+Oj#J5-5x+C)NS9N%^xWR=OjhpXJ^*SRRcz&SD({Wiu_EvXlz
zE&$M)swl7@YGn0r1e7gnWC3OahefR@My=@K#h`kGg<8RZu>w?9IK$z;>fwRZ{(<5>
z0yXfFeF$mj|2Sa3E!zS;k{;?E@WJ`XlMCEu8e*?COw5g`>$20eIrI`R#fsOsOpp*)
z)CkEnM??@dg3QBLyE1hGbFPx$4i`8Z%clJ7SUe>@mGp|8v)#m$O>OsJ*<v7nLr3)d
z^(03UscLJ>Hcs)zP$l}+`BxpYQ^_B=1A}v*?+vgE>;Xsb=Yisqa;y^0K?1M~q=Pt=
z;y8d^kTsS8yWH=1%R3uZd5~iYaI)zHqNxk@={c61Qts)3vy<$|Aqk{tf)<jQ+2q3r
z!-shluiol(;~4-eZ7K)xs12>BO&8CvS+Tpp_LB2$!N{7qAdea<#Axq?EqecYE$q8x
zEpSo7zYpbli~Z~%5V*HD)ASYD5$uU1uim=Fv~?bCj`=b<_GkuqU(@q3DVfYkGew1=
zi<eLb6InT&{S`}Cu(0!+`G^kEHWbB%a+ym&m(n*)iE|6MN_64AlF=@3_h-F541}ac
z@i}o+Q*)Mnbze9^y1EKd46$=x1$S|G@h&}4mDwup+u#_s-(;g$Ck;FBc$H_w80b&8
zvu|-4d2nPrb$l4u=ht($FjcTx-<=+Nw=>mRJp1(O#$<tc9{eW>Gum+bnrM#ML$(qN
zgcp@(%IwoZM#bL!yQ38vn&}#jKRD#*<?1Qt#><p^1MhE`*J<IVak(5MmuI1~g|dzL
zw^`(L_8iqpYnOLeg!2yOdog!q{d_X(tVXYn?+3k^?FpvlI^gL{D;uWO<&YAC$9NFu
zh3&QI>nY1pNsNp#eoBwb57TiwFQ!cR?kwA&Vi|WdNAww;=x@0WY`dz|H(p$TXE{56
znF268Se7|};koJB=i-!bT(S~^eGj3sR8X@pfwJXym`-zi8np07ppru!1OzGpAmBoy
z&dX}@MmEhUbRJ-mW$R|_1VUf|*%iC?vsBP$L$1o%WpOu=MxWXoJv24C5h+UcZf)>?
zB4sOQ2h(u)^1!_*Q*c4KgwB2@vm(qYgmZUcJwT^^<@)7o9j}EQrO7$6)6BieYMf~<
zBTjB_R04q$<jSJHQ>TF_V7=)XU~PwE)y3Br!>ZEQ_7A3x1p>k{at%Okhr9lw3f_8{
z&6vTt2A}!Y+1pyu7B%I)$cEVY-W<r8E?RdMD@Z5bt-ieCslV?@ZN|Ird`S(vw4X7p
zv!Qx^iQ{m1U6NNfF)T?C_hl<D9bjQ4(Q>DB6mOktiWf9wp<;}{M6MyYNDr03-`ZTd
z{?bTLSV$ya<H7#X&xXo(2;=5+l~6_6&zdT`R4WMQ#YSA;U$b*JRI?LSzoS3#``QJw
z;?X6z0&oaWRRM?KymqIz97^qv-T;7kl`T|l$<%BC%xj?hnlW#>o>Hsa%wjwUa1Z)j
z5cgo*&C(m>(jAn2P9)jY&blr(EAXhrGO)n=*QsYPP5><!fxy7p-^~3R9!bg8AcK--
z_?#*Cy2ugB;+1%bJu(ytfn3@fp1g{k{K6C?1Rx_j8;BgWATshBL`M1plVR)3`a%_i
zx!b9fO9($Ol0KKCj>AHB9@1gjeERWnJQ8LTv_Ws(6A)K@np*K1eS7rut=@I=7Z{m#
zUT%gRqGK1Sa%Wy-p8*b5zKnO`Gx2pXD#`067BlN!+G1SfxnaVH8nXzu)O(gu)6I#^
zb)qZ9tE!$fp!6(rl54BQEg+zo8*11~w)ZT-f1ivo_NMuMfg|}Em!jG)ZlS3zwP&yK
zSA-R!?q!t7mUrq#;a;wD9-g!@>SYt0wA1Et2{lhy^@#I{K7pXa|8O)GVdH1m!L;oC
zW&{Jy$4y2rn1{<~w}_H<>9$$ks55?g_ANt2K&^|oc>bt6Q?;X!m8biAE0vkA-97RC
zA?MtY*xVmUgg`zbEX*HPJK{`D$^AHJY~2dE<g6MS90l9_k&z9j=W?2SE+?!r-nr6k
z>jKJ5SOmoL@30M)WUZ5hq);BKqnBH3Cz$YpsB{lDl!6w1B^gIqJ1iDC=c7Y>t6_qx
zoklGSo1YubFOgS(_!xKt5Fh(#qOs(Vtb}8d4jjZrs1;?@6^v{hZNwD}4dMlaWiv7j
zdxJJ$h3Y0^4s~hj@V*(eX&Jn<%AFHVZ7AH!c8<Z9{fUC!{9abclJ~RTGWzkoX~Kk#
zhC$c&9CkjTy<c~Ok-mEF54nx@e%QK?_A;2DTX?Lt9+55)^Y0M4FEoU^SUMI4(ytT=
z8^`xA%RHmyI+R|jsfM$(mQzwN*d3ujfPCnJqWw1NfV7(x(Iyr>cY(hR;)6yAT~MlQ
z+J;3%aEEKU;sL6Su+tw8RR<)lc7nuJ54h@2fVlejeP1u6ny538v=b0lEm1c)<FzY=
z%%$Df0Hvk_>xNrR!c7ML*i&rQeH#j&=W$O;?}nj*O^}R4LT0{yx;M!j6WP-ar4dt#
z6i`?fT!I!C?31lv>N|$zE1jqDaT~a>eyL1yt_PJz|92nafHi5dH!WO`H1)V84sHE1
zsSdp{&wK4m`q8zl-FFqhVBP9e56+n`&?}~y4nROdTbD&SRSM%>S9A6=wh28MX7k#3
zEt{oyJUdn3TefO|ZyC~q(>MeUi(dQ<J??_dlDOT{&h40lo$4E9jTNaf)!(%EC4@mE
zQHvk|tHmuT2>xyo{9T>=n$>QXz516M_z=M-3?|$KPM)_$c8f>kZ?NXXhiStt8ih4G
zBN8?$*YoD2m6<?$%Poc2p7Ozo`}^jWEHez%;<oPcVy^yjH@yTOl|Kj;NYxmut%mbZ
z)xerwmGzV-_Lqa!bZfq1Kx=)gOgWDwxE!b--SbMW4=blzX4RHkCu807^fbh%jhr_S
zxYRmq>RNI`)1wk5xgP#l4QBVKm+R`e^A_hKkw{A~z3X7Sbw1Mg>H8wA%{vI%DBj1A
zpTgwdt6hnpcP4MM<cNCOry(#Kv0VrkHRL;TN);Wj*1?&DI8+Ea_YFhwFb|Z*FOh~9
zKZnGyzp8=m<&<8~y(}C`bc2%@CQ`#5_~%!qWo}}x$v34Zl^hkSYuvD4`yWyTl|Z2K
zGc7!mxvjH;>Nw*6@DXiscS3oeS#3(u?ytV%nEgDr!3omX$5rrh#eu@^$xJ6x!tVe7
zHSOo2FSYGS)kfSZc~*bza=d*_aw%En-Iut!ERd<pRgUe&aX;dL!p*8oYu@N$oHyGp
za!oLy87S@qbX}YsJyLb!Yw2b;TYSU3f$UO~Wz5o}D<OLbRBa&Et<3l}up96s6o!|b
z`}z9&csd%+`BY!(+&<GWPcI``8Qk$mf|;a1-QAE7X9+9#fz$6v#uz$@rbwT9_*zS%
zEtcLTT(DD|C2VloPWBij9LS7>VE%3>FclOqUOg`gEHGYU6m=%-3QVgG)2r|LOw8<p
zS($&BoAphu!e_R4U6-KJZ>sz2kJ<U4kJg9$os+B6zc}9jEjiHk;U<vv$`?y%P^@e$
zt;=M3J6up3FHPaxMsGhCF7HK(5b4PKJqv_(#fUHqrRi4H#lVtQL%10HQ7MFNlJ!eP
zfYXAhQFhRfrfwZ8*!yhCC8-%?$Djdeh_;`;3F`=<j=`6q8gOX;jip(`4n0{CGf?$$
z!tW`;JHL(-c`ia`Ml;PKuGhwd(!knIs?q~Kx|}`w)CB%|66hyw9Lx<8-&{cA+jVnq
z5g@)@fyB3HChn>@Za{pK@02j|CF5KFlA)ZzLJkt&kOA>c-5e&v@XJ~_O7o)(<hL!y
zcs8o3b_EvM&Q^HWdN<|F5e+86HyzZrpOLNmE|AJUx)flcH@>gpfY8Lv`Ysr)1h3fS
zPgp~~skNY0y6G!NT+xK4^r{!?FISIaESc7`qKcu!1{-;(?TRowX|`OQIKsc|Q;h}<
ztD}r5Ep9I4-r$INn~)ucCgX69Wp}|75T6`69UeUnNMzjXM_sZ9C+Oc8RO@$C|ISue
zRcPr-nFp&X0N+_t1bnC7M6XkI#ft6(@SO|Hs`YWI^?=BTN<MLaTHeYaRY`3=$qdv#
zy)=M`R2ime^)c%NnM!lBirCO2cjzPTjkwMW)u$UTmp+qkst1{<cUVb<6p6C#6mK@0
z?z4e$Np(x3)!cG`aZUXvP(5n%Ec+eYh?w^h&>)C*q`E@dCs5rG8S>3vaX+Tz(dem{
z_x#j>_DsCAZN4F>9Y>In@`jhGWS2QNQ&wKrx|+K{bS(pr!IdHi8I%TAS^+X;DF9Nk
z%v{XKT+INPk|gUnVqR<Aq)a)ErMMLM8%@u_yW&?DmJS6Kb;3(^fL#)JQNK9a&+T%D
zOV4vZH8SGPpWrP9<QF;97WVd?HonqlusKLqL7efgi4wdgOIf@wbt^0!HJ%&Y2FK!H
zxSy_!2++El2$5aX$n@JMN9{jVa-@!ek$Z3l&s@2l$-D;QKK_<=gRl|HV|>1uEG`MP
zVC*4AHo-wAS>xpGz74FI-@(DJIcj_cQ_G2}#4qM0_bu?Cx~M4oR8V~^ylcJq`!!aj
zlJk|CZmGBK$2{G?eW<MS<Cnf+tyX$2vV{D?u(Cw&7QgfsS#`bo%I4Lud~3c#mVbAD
z7##8cRxEormRAo>{JW5wvjqQE;Q^mo#h%KuP$3`f%wH7kELsE-$0b3)I+eCP3gA(U
znF+x}e}g1d;v@lJEq;GDp+>hDDQsS-VvpSc+~<)1;<2WQyuiZNf{nx|SNomMar*_<
zXz7>E)6Ja7W0s4{^Jw4KyBpvIG}wOlD4%KhVmVKOcJ<A^{xOqWt<A6YfCT1QDtY=X
z2B(_EExPx_$J|3wWUL9^7~Me&0#9gCi9y&%Pm-3~P5RhEVb-4V|ImTg39$#S<rQ4|
z1i|$1x-zs-2bg^dPGhteZr-H#e)#dx7aB~~afS@K#o+Xbkoqe_QWx1&Thx^8Kcgni
zi=%)P9%f&iHHd$4?&p5*G~59QA-?WFEDHZ0r3K|k8Nxq62eF~+>!2Lz2m{($?Q6?0
zjhqU1Hr$kRJOT7K$ir~BzAMS&9^r{H(8IGE5l^A<E|&cr8WFbFr@h%@|7rHcH7TRa
z{f5RcCwcx<g}}}9Plx74qEzhf%Sr;dqsY>CT!PtOOlLzd6+~|%C(#5ow?04fI0!u^
zM4WA1y(6Nc@_3)yxo^RL$T#hFnkJxc^1aJEn&Gb-*>--O?eXEwO2GUQKQ^Cn1DpYc
zGIoU%bLxqA+7x;3U`e3s0%}SeaDEvIdy_&cR_F_X^Q*upSsEu<3Ni_b6qj}?ainL%
zst(veTsQ;Z!aeF4%=GM~=ot=u7$tv&;dUZ>bbO_zGoJX{yQZ36bl8-!_kee2h@+T^
zJ>tsNvYr*B4euX&CGJmNieMURy4K=bx+yyxfsL1(WCRYdE0a_vnT^i7zdrMCdf|Q-
zg5YIBvcSs{!4mIwP|}(EEP{x468<{qmN{m&zgY=9pXlE8iF&)o>#{NBtF>pvN9&qH
zjJb|j)%^Ty^A`l@EUUeqG@i>9QyrXDI9s6=8G6JSONE&!o<!iH*A>!T-e)o(mj=Nm
zQ!=jnC@;~<E!CjU5nr2-%VKQBew0s_R1z&?n?!8%&<-!?1{(lfKv0L1fE9|Z>>UJL
zshCP&g_ao&%Hs^mK`T_Jw02a5vobqcbzou+tWZND$bmLF?a!%XoLM+5|2J&(DZ5vn
zN|%YzI!x<X#_GPqs@*XTkPF-Zxd6&qts}m5s}ek|>njrF0GxQB2;*cT9(WOvJaKnn
zZTwXWY~Kvcl_r7!rjqTKF48c&>fE!sSMvGfa-tKwyf+;Ycfz(Msu7ZK!)`Lxl^4q{
zn0HYGwfp+;RZ`t5QNru~n>=KPSAvLEaAL2A3^?cBx;V88BFF5XhZ$5b)pD|BDP0sZ
zU4!Fllj~^%AL3{&q>*E;LZ4R2@X;U+<q04TDG?8)nT=jXXt&lz5VwJmGGyHxK+W{G
z50v6i`{Qd5)J%5cElsj*O`v8nvH$BQ6I^G{RE}UdbO36m4RCj5RqZ<z2mMVPJl1Ww
zXjziOnCU&ePkhPBJWz8eyBTRp^tD&MY{0jn)mf*qDT>u`kp9^-A|&|=_b-Y@%YER|
ze1C6;D|!Mg%Xo7*ci<=rj9r{SB?0l-gE4JL1jE(A#jDn4znHeysyD^2+6OAf3TOFo
z#>E%7lugRmO*rS5GK<?jNfmQJN&%?yQ(6OnDw)5sN*K&TF_Z1<@x_BlB|=I8s8Whg
zf#J5v%0Y~(E$we1fNqaw%eY_89UV$HSshB5ThRlcBgRb!zfQnOH3jqrey<lIBi!Cw
zPU|q~9Dbx>u4ckGpZXaaU(*+!(S3~901bUEEj$wgF9ax8W1;^c_2z4ka&^*l%AXKN
zsSOrZ0OOU2heHLQkqDQ<JcQGQGK^laCfb*P>c>hBr_(ng@E$c<%ldMTM_*Wx+})Tm
zi>+rdnQ(_-5lQitO%k9Q6u<|h#OaAE8HmfI=&<UEKS9|{u*Yd@-yevk1FK&Ea-{7F
zqP9f~Z3>#IQq<9nemWgJj-5Kms>^i`n<?B&cgDg?*F9&R>=tNB(Ir!QK4h@TR(_IL
z-uiME`$8<@BFeG)Z`t0<?prh=y^!&m8cY><hC}%J(4a~5BHdWTL)wV>6mIa(J*~DW
zy2M`(3M$%RCHvlFSyDs%(w~8C<`%II_it8Tflw(_eZvj^mi9VfPY3TS3g)0FH9qs9
zmcwia*^EW5i{|Lm&6p8frGqvFFh*t>bzN~($kVJ5IT^Xu+6Z4m+E_dnj`v9c4J@4t
z=XR5qPBU>SP`}hUh3;N9x7+E}*S9Yvr*TWkTC+`=XYfz?&bO+3h6S#+ZktTJ-|PUb
z>9zrAP4G4>jzgW9|90FB{kKWoX7S(60IjiS(98`KTsO&3wqPl?1>N-jp)u18LlaF3
zX2eN~aF!%dNu)`FSD6sc*HIF;$`U=Gm(B{gj!e*qnrHd5q*Y{R7ip?sIw9Mg$3f7j
zuhr4=9Kt+q+kA4dp-I~`LhhLwOS<gSNHk2M4q2R$DZHgQCh5cqkr*g75eG_5kXF`U
z0jUX6P-<cpUaXu{3`k9ICl~zeS*ym8`3qZpz-<Xsm#id^7MZoc!d+>QHK=*_uU-NL
z^2kxY!7A&mh%(cI4J*RvzRj`MM1CSLQjPK_mwgB(AGOnciNO}~d}<`GmI*C!gNT*Y
zv{1Vvl;{0$#yT3#wiq9`0b1||+NEtnaE*B}l5XB$x0NvewjMuIL6rpe+}2MwIMcH=
zhR{5Z7BB>Sj*lIbP9EKp;h5|0^OW#@J|SgcZR0RFqoA~EX1i7!Ib^wF3^&3r#Eu*h
z*FTEU4tkLHv&i6O2G8A6X0G9-#0V$oe*5!3IPcVAX}Eo%g9yTquoj0;759#aRvGYY
zZ^e%P(+0;lzfP12jJJnm1jgID8<f=;l9aO=03*!=i{MksNK+|!x-6uNZm5r1!6+)n
z%@7NK90Zs=z^=973Zf8VC^1E!>}K|FH4RlRb=cxLC+pV~JL0X$`U)!EZ6i|@)&J@|
zHy3gUtI>JWrdHH0M9{Dj#J3{)UJ;!VBL(r&*Iw0&?VKbJPLzw&pR4Ly5nO^7;awsZ
zfy84;kcE(<yhI9E2q{T`h+zs<q=Z@oGC_h&IsbN9aZ6D(rrkCGCB#KNh}+%VRekEJ
zq0R+cN18Yta;<b5@ueRsB>Rp%Hk`@k&1JoyGTC^c6q`avEvP~5O`Aq^RUzB=ye&wJ
zQC2Yw?~vg_Ico^Be~pb+hwk9!^RMFmz(V?3j_e(ATbm#ZHD@uoEa)@;q*z-%i`}n)
z8y}-&TV0biIC*{!ZgB7Pr49frU<M$-GE8Z4JzRz`3;-4%YKS^Ym^uKk;P_NXQJ=OF
z(N^-AM>PYB$gc@N^y*)lp8n0F{F=yaF;ny&wclSUzBoI(uKy^{HeM=CBiB)fGE{r>
zLXcJNtm<;1rU$D^cvO3R&B1P$C~%SFqR+hy%I|0#ze-6aW#ob*oqBK9wZX0ZBX2Dc
zO0%iX5w|3dQ)(?*;UKC+!G~}4RTnMk!psJJMqfX#<ku{u#ufz!vnb^ogJ{`~Xjyfw
z#7i5W{2LxI1#ph}<U!}S09Jz*IL8IRITjryEEOj%1<rAOtRe$ki`9`BRdZT?F|hj6
z3PIe^<}-i0bBg0;(42`wR5bsySd*+iSK|mGfRH8}fHZY~l=GIL1<js#wup`r@uP=@
z5lox!6~=k+<jYS2VO)34?@gG=|AtILXlbV`aEQkQLj#BS{v<l7n_Xi##D8?LF-fi~
zdt6f%nZ487xhmEqI;4nYR}b$?yo!4!_ap$+8-09!Z{v4+tNjVe1{aYp9Psey6B8D$
zP_GC=2=oEBZgj+hIzyrYldAS@;x%yD?WYL9Jo!R5_KaT2MnCdiqoK=iR_79-q5zHK
z)3FSwlRQW>7byR=Y2SnvC;pwsXeHKf&FM#IF37W@1UDtKvOKZ+esSlHi_FWOjIy#Z
zW=#LqQBp}}B{fKpJf6Ed^ej6XI7C>1%Y6xM(EWyrMNeQv&DfP1PJfg9PJ9p(#8<={
z#HXCWhsZn@-$VOlPd6A+9sojL3IHI4GTbX%4&+IIF_ZAV%#d|)kadr*bsWCb?d)YZ
zk#n%M2h4UrslrYL0U_p_{^{Z5oLD&3_OUH4`loN-Qgb6?wTdbAOk^ZRq2y%_Qdh$d
zVj?yLR=M<*I_sd8;P5eD3$Gzbe(LA?Vk)`{s#})-uj<uT=ncvhF8r4(6fLuEv9YRr
z7dzKAh+458`6+$5JQ$no_fki%0++kVVStJ|xMA6S<#p&wiEC6xl@K`y*(@)XbV85G
zwP31sSoaFVRu;*vpR?BDLo9oK%5|2cf8aSjQAk_U#xdFK$GMNJLC8=lrKEzPLc}m=
zKSS1ra(}=aC9b1QK}Z|nUMllIxhvtiXPTUC#cSzS$K(B`1Kl&)p#9kan=S(E&kkUJ
zE{*9{i~p|Pxs?!GD)+(CW;-cN)SD<>1QJ7YRDxN>=B10Jx!Q%Y)kr8hhhuY(qKf`9
z!q9f>3m)szF2%0E*y5m@Lc`|ddEQE%f0Sj9`|jIdzgrP&psz1IA9Yx3uk}eB6d<x2
zYnC)FHVV=0mIeKjhwV4~%iqyIZ$8_8Yr;rYv)#l&lrye$#zjxrrQ7SqWa`Gr($^5)
zux5^x`tEYv&1PAn8;6(bVo?Rptvhq|>O(CX+*a)R`yP9m18d49nrfosUHpyAsYK?r
z!Uc~9)`*=CiE!p9r8MCmOBV87R;%vm`WQ+RJ2%9yURo#ow{DRbH|Cspk)H7Y|E2X^
z@E4vNvhyv5EAE5GHD?BKhQbW@ulDQP!*3Muw5WREA-fNzjJf)Lt#9~#hgVUxbes7$
z&j`aVtVXv_vxPmo+uQ=+^luv+7H;UChGU%M<NED`R$W69)HRs6s?g37Cri+~g#<NE
zU`>Wdy+pV!xP{NqOMj3o&ZaKDJy?8v+Ms~e%YKD8!RIp<85+uzZdzx_vN?|C_xmd1
zSDf~%_n0<j>liUM2LQK(`~bKW^b4dBQTxO12Y_2rlNepHSlw%&gRJNk2US8VKYt~<
zIpSwP%<%Oqzrk%-<nQ5M<?D&dCHxnE{dw~xn~K?p6|5^|(eu0WFEqh?+FYNTKtr1x
z7SVR2@+gQ~#ZFD+VU4FVj*)h#?4RU!uxR8mABQIh^`Y!8*qM*GVYgY4v2c#xC%bwv
z%{j7upu4qK!n`evb4g+krNY5%t?S>+h8)qDtovk1nh-KcUbSJDfm;mQHL&&lgIq`1
z5$1qHR+h~{JQ^8A6zbN&g>-rS9C_{GdpviKP%+k(3s&%o{c>u35GX<Pw}071(xXdK
zU38GiiVNeYPpWv4O-#&R_)Qnjd*JZfrT+t>uGRvVgGP;2Bt2`e<1<tv)M?nNW1Shq
zDX_I`Cc9fHds~5?qv?IE#HYb&dYm1vCy~d1<J{u_a-0Vo@cfU(dmLUZaF;?nMz<-R
zszN3NRTwTE(ORXm$cj(0JS4CLj1f5J$sKYVgZHSF9p{dib>b%RfS5-VerjAbQD1Iq
z%$GQ=s0S;=Nj3TvLG87^&xqhVEn6c<hCDhQGJL$uLtxYc1~}fh=TF|>B0C8pqlEMG
z2MId8U0l9JBBpzP5zg-ee*AD`b_0F}e%SQl#m0N<e0l-?_22u~#zox7sCRnoH(!GE
zKwmPbt>07nNUyT|87=V;G#tnqeRQ<$vTwr{PzwBm>;dKkuMEasKHQAot&r=fXTWTv
z$8Zm-AGflNp}jvWnK{3FJbhGn_x<SNdB4@sH+KC;=RJraMVOOl6wJmH#|}Xiqx(bq
z?8QQ|g}fle)flq&v#rwC?JR$J3zK7i&VARDW%lj^*|X6hmu@B8GQe<mGRBmxtQRZ+
z-owJk0`FlTa@6${B$X|5fC+_AWmqN3VkOEzB9vB<%Ianjp~Tcs#XhGIkXvNOVv7G@
zl&C?KB!bUvX(q8JeGaevfjUF=&#C?fo?YpDZ)~K7*<4pCyKtZ48BVq#@tgIbo;iUi
zy?$eKCxi$a){az>Scn_55ZLX&n3?a->@`1ewpk@+q?W>IMfK3W5QJcpk3|$xjbOS|
zs`gXvI#sCG?EH?+2cpt}G%A<cf=!KX@H6<YmrYzJtO=j&@HFm1Tx;GTFPnc*eSR2X
znNs=mg-RLMfGL?gBa+2@yH+-b`QLOY$6)IFw-6=U5JS^(4ZsQ+TOsNP;lL0O4n!`m
zK_D$>MW&)af~bY>FC*;-a3DA4@2|CgPJ^l&<jXlaL6HL;Kyzus&~ZfQr2MS2Ui0|`
zNMYFM^n-&l#kTx#lHM;)#%7e*K1Dof%u9)t0=+rX!KyMuXq`V)2i_cMGgkLJTNE&e
zw}K_~S4#ydnG-F~&l4OM)TYr9iSv#6DrVI3`I__Uy(BF<xr=dME%Yk*1r7V3iAPGe
zc`gZmB+i`3wZ_vJP;e-z&^=m(tX#PhT8*ynnqjfrf=BysNs_9`j=h*PyLn0+qoJ!F
z>n*6B+QWYRmY$F$i3F=q7jgp?<#HRSYdb>NbG%zZ$hfYj82zk+?+S4gHGcKeP$Js>
zjON>T2|Cx0?u`V<1KqL%{B-})^rGWXZLIfL(#b4uW^ynn=OJQK_X>X}=ywg5y{tHB
zspl+g0?Bi;B=U8wt)UCVYhXAN*_H@U@cN<yrIghE^h5&%@73f=pX^#6RPY{c^U37a
zn+udPP})xC;v}r-8zGa=a2rX6(S!MXxh(&V7rt^p(*uE?49W^ZMsn8L`#m3l@qFq=
z70ZsQ9KrHNZHwK?*u!geT33taJ*Sp}s~y*M#T)jiInbNkLHNW5sG&{dMD%AJi0>m@
z>M^3D@KrcB!w%u*CI+pKl;M(zs)EG3vp!e~i`cL&Q3657<M2VuBh-=}?bcv|_~yza
zLv7tLLtOnaAj60VWEcrzG)e)6ksx3g(HHc@B=*Mu)E;vvrrbQIm0z@y-W-t#RJvn;
z@>CfZ^Am!o367{5)8%~>%YbfbQXx^Uvk%_C0jk3~gx~JI8q6=i3xhO9)<OSMs+l!{
zw`8LBK=cT>`H{Zjw=Mk}@jm>;S`lyG!yqo~3zO#Erfxj<w9lf}m}|97f)_voe3&(0
zxW_}YzMi|HvSqVA5J3cfQB~|h6*#fB7tM7Sr8rJ=z~hA_TL3Ygr4UWMtDh~gE!Co*
zePJNjAVoS`|C#5*1X$E{)#=O+x71v~qzH|%7-942Y93R~^6UNHU%`;Lq}tF+5b#HR
zA9bOT1UN(r761(G10Kk8sSO(<A!rMTP<#k!s#c)jys<}UgpchNttjak!Ri&w?l<Ng
z`O4{Y`{l$5v*p~j?$3NBPk}fi<UZ^(j&Hvm^C%1N+igH5hY@i8Qg>`1pet2rChriE
zin>ZVG129IU}0C4m0mwWc2m+hD0z7aK6&r_<q*U-CP927gUX^85J)p5M*F%s03`|L
z5G0TW+RLa@&P5KH4yfFI3kBGAzvwu~=#9qthOa^!y{j;RrDNV{1<5vCzp0oQfBD^i
ztD*;(l`SoIlk9Z-*N%4P^Oh#;r24e_bj7KSF0oI2j*5^0ON+aZYC-cS^Ut3nf|tYf
z&uH{=ygv2Zxp@4vt&OO|gj%*gdPIpGf$U!VX&Y+2b7p#xsi)SWZl$Um`e>BHU<=)*
ztLBeaM-4zYT{Qs04b{P}3IGmh9dOT4kJVI&*Hr)%W00C^=%5Oxb5^|K;L!~Dn|b^v
z_dTBUZ<W_w0Sr(e?W%QVUM#Dns4U&%E0%*Hg0z`$6)LPYZ6hq&h)y$FBZfMlvHYvU
zyw6t-LrSud+x5%bcK5sZV*7Qd^l{06Dh}va+X7Pprlv8X!mY!;=k9<3>B8-Qh&8G7
zJKcrGVd!kA2*YO?9rbDB+L?`9C&szg#d3esTCmkF8(y$gJb;TF+x*c0v*6SqxB#SH
ziUK{1&tt24i{b(GvI+q0$BYH#aRq>SSqFAJ$})2*+|n>x#<33)tL+SjZyjj%Iaw0Q
z(MKIeJm^vI+>oGhuNbx!*R%erM72xbp0O(Z+v6G`q%*fs_uMO-f4D)Ckp6j=M|84u
zqqvvRYI7p%?O+$xRfQ22B`pBMota0Jw(H}9&UKev(4&U~Pm8N@L=ELR8Un@!sFDsp
z-nYB@7UEUJvl*kMi~HkaH=2k0k@7ogT;QL)@Xocu=Zgiw8CPDUU~tH*cJ9xp0w2<8
zn$L{Smd)uDU`NJyYTSQAe0>?3ee?T1UK^V1?Wuh1@C%@MI&g|TV<X`o#-Tsq)dgZi
zaQ!?dzA2AggvXc7oPQIBR(jf`sgl)1;64LJC30RbakmzOg(n<+a<tfkHt3=I-1v+n
ztOYr?mMi!jOarQ45P>_Bb=$#2F&CRm#+3J^>UZ#?{;cX#ZQx2v6LaVHCw+&=3$H=U
z!vyt8GFv95DkSgds`0M)>-ki}94N&0)S>9PK{l9|U2J@Y&Qv*qYg2@Eav7Y}6wc^T
zQ++HH`jqWY6E%@F;q>FECSZT7@TA*%Bbmgye>s9lx3~%?MLvfzmHspwhq^uxA0^yC
zEj=hTqHt-2>vwMz>@No@O^6CmX^^eA3;ilq2seN~^A1Z$Q(Q<BNTlx9a1m2y+bI94
zHQ~PpgznKut(CIK&mG(U6<E4lhTm*Vznv(NY<~R-f8HGMJmQ?d-?<>RGoenmhePS{
zOK^`r^ds_WmLBtphs;6S#ghGwIcP07&mQDZ?Q9=rrPbya{l_C}R$x?r9O-kP`TX+V
zJ*w5G!s440>!z4NE`7CVARn@@M}CakO`LOC)klCS#wEWRO~&2NPQFO4j7GtZ6dn#e
zkwComv;Suq4a~lSZgI$^x)xkPZC&-#SOtQuxkrqF5fx>LLg$<Cs0-a&#j?8mNrv2`
zFpjloT%!5}dV44Y7nJEC$^$6$5a9~h-qqrJO?N7#jHb<2y4P?;s@o4nlbkmN9T2J+
zhSQdC7}Y3)2Q{jj-3z+5*S~@)R=Rh9RikFDX%4G-gt?Viu3<N4&|uQ8NY?In^Jl|K
zzeWNaEMpqFi*MSmdF_vv#>wA{N5k-ii!#c*a$#ure++ZAjIM+mMFVWso=e~GW9^Sx
zFYT17#@1&g?J(ullm8WkkqQ12h5skcm=5z_d_%0bvz=Y>G3;hXAcN-SeL~m5c1`qn
z>jhBwY|gYg-n;s$3T9TTUt*RKNdI)5++xq;VuFi|y^Uer8=F^$N?eEY=pKT(8=M=O
zwMeOLo!YLBlR65BevsmGrPLM%Uoq;M)ZP^tkR|niTPefE@sk|nwzNabbz=FSKEGKg
zo7!j<G7;Y{dS+p5E`P2%JwsjuNnKSSsY_F3X%LXQG=a2ik0aEg66zvQ=tc(})yzX%
zw>c~CPR=)4MwTMnjf1!=|1?iBHec-9;I$>6E-ap}neGGK34rEs3BHaCp-Kv>n5FKS
za_gMQ%^sS?s4ZQ)1Aa^G{8!pkLll!fHMq!5Cfw7r1pW<_Q4Q3QrRL}0rfOV5>Y&TL
z0i@fTer*f@bbC`k_Kr#7S5FjD2QGK{SmmMtEw-G(M6HRpDL}!x<{gVMcBYv=!Ol^F
zo!&85;n+le*$TS8RjI}?aJ(I7Q##%&AMv3+Ezt0caYU?~B8pkNx8wfa$*aaWssETq
z#=3(jo3n#@011ChzI`-hyVcf*IlL8Tq%h}<#jW0>ziV`Wg8RwuCY?KKZ<Imm<Q<x2
zFLorKo?S;G11-|;o+Z&gi4YM0&i=1t7mBoA)lX*EnL`K0jprzv*12!I7lIibI;&kQ
z8b`PLL#O)&0$mtg4SjS<>O461>`tqliJm?mBd=PPG|x@)H#;|to>Urwf~0OXfZJD*
z@Z?i^i}vES+8OA*UR#}vpQ(Sz(0LXXaqNf6w&l$4r9+Th|KkwhG0``T&kC0_E0+Q;
zrn;=zfeB6S8<XM+?un!)ynH#k{Ha;Q`2}r^x^u9o6mUz#0K?DEiT?Dm0%--pKfpnd
zXA-T96RiZ5j{@b+a~-z3qQqK1pygv;6T)DUfVHv#+>l8Bmh>vKJ(2t5wP0QsN*D}P
zh(&~y0N)r`V2q%eQdJh|DJ-j9&DHQvG9>XCn}OO3S8na_jVJ^+s?QynEf!IDjdyg{
z`F%BbQleecx=yxl$9Rs~Eh5XdSu@3DIUc!K$i|ttDg^z%#G?xqs4n#`@EmR5V5ELz
z%+q{r%mgWO=G;B9M<zjxcs)Ua4IlAC_#QhQLlVy1Bo7EL4TKlQQ_Cu}EyVU1F;iLo
zA?7cyM0n?ToXBl7<<rh<p)}P04&3D^Bg`M(cXfpH%~s-sx`>Xj;1Pw^!cO-Sb*EI)
zcPum9@3L~<W=xn@L_P|G^!y3X`-eWPjOs=ni`h3}9JO{r*?7z%G-paBqJ2k{6t8SU
zo!8D<`+KNm_&hAcYcqNR{l@XN;A~a6e~(3(6=YEVVE8UMD{wWEUG2?t`YH4EsUrUU
z7$JSC)|^W>7E$hI>>u(Wtx^_}RY?T1Yv12MU(Vr4t!Cz&Z}_NB=GxW+O4bK@#mcnf
zXZT$|DmXfk)XphAWg1_}k=p8tD&Pj_Y@5)U4EAmcILqiCr6Lo5TyAW{Zh^@MvoU5>
z_4P$qdvB()rH8TNZ9%{OP(Lkc%Fj=_{&MSsRjHg@?#MA!hpU=|Xhfl%1og)*kzOaT
z!K_XiiP_n0pJ(B7+e_RSktp$H_f8BaWNfv;crrt$OJJ?8aQlxOV&13oJhn{|jWt2A
zlcA-+0%6@|ejbXYS3=hIH^j$PYjWLpOZFH>9P(W(Z*p{#k0Sj)(GxT0!U(yqwMJN8
z?QlQ5+Xa7AgLtksi0682-vgVG?+Mt932d^Rak8DD&G_Sk8&Q@Gm?@z@;i(Nk`D@n+
zP_Dq`66;DE*5xA<ibo~`*5Wb?D!Mwo?%z!XyVB+!&Zw-@X@QF8D84B>tkNr)i5ueT
z*O5^iq6WdfkDQqet)+ayo5Y9*LYwszj<FVZ3GzLvdx)-Dy3_b)=WXdF@@Q!yu3xH)
zUgjSNT_+@PlNSt*e3k#wr~AF~0^f>`J~vNP5lgbqdWNry%q{V@Ue}z;gfwlg@N(8$
zn!s#mZg*9S<-CG(*{j50uLVO9+t9AGLK0e*Pr!dJ=)?=Zv;s?KVGKEWhj6rfh^av5
z$=gZUq<VBK{G)?Zv6)6=``P7-eeN;ckq~Bvf(#TAE-`1SfrC80Kj8a+GPi746nNRm
zCako7*t+p%tA8vuAr|{<Sg#pP8|Q6zlX8;u$_15IYCGEHxW!Q%;K0peOz&AuQE+Eb
zID9{4tXxg!t@Tw$3hQu|9J!bA+Txmk{SkhzKA&-d3mkLVFD8xx;RshdJ-o0<7nvyD
zHAc?}Y#V6_a+}?wP%#(piBzXI@(N-nN=#y-k!jJZZ>?Kj`t*De#u3~%5I(ztB>T)%
znW{tUYGecPsQ@6HS7M;ZO?)7Y1`xRcngf61F?}>3dolnKP7nDmzcQTQxzX|iT#$y0
z2x!Rf>WIs1xOM1=PhkJW$3M>EW#W+*F}J+0Th$DBr+zCqN_R%Whc`$+&l|_uyc*%=
zh%O5j5#D!b(z`m`MYXb$E?pgGqA38f5eY9%!(Hwm5>H@t)^-`^Cz<(t5)Q}#Q<fg?
z!#poB?p$aa6nY^8`?Y|Qa8ewhZYU8e9v6RdrG+?+L6V+Xdl7djiXe#xzV=frTiiVw
zEzH63CdC0nsy#~IQql-?SsVc}#>_{Vwy`$H5_2uLyDUxv@r`Hwv#a3h`$3Y|Z@f;E
zk1foCNhhL7&)6^ZU2t`Cn?!0Lb)&8T<Z_kPWD)}|7X{#QCBdtek*a}QE<4<goS&L(
z;{{)}Cm8+$vT+K9V3z-%6jNRLzY@CNvwN9ueJ77GabIs8cZ>M5ut2KXFRV3#On9@1
zbVw+^+#Tx~B55%M+`su(Lu*W}Sn#1t<jWt(xKAXQB_bH?eurQRn8VY={YabMyeonv
z$*xc6Bjh?sS-bjD{DlWTo<y{BD;1^Tf4M6u!iF{0<U*s85g!PPtNYeUWh{Xd7HtFa
z0h?co3GNK80o@_ojxF|A82s2TuQ@&p#zWkc6Ipei61U|X_v9cVb2*njM`NGGh=9OF
zH0TiqzS2?*5FWx$ObFhV3ldR^69K@5_@NxOe~Xo_IMqO!e<|SPbSnZu(*?g$G>9T`
zFoo>zXq?}T!vpDhN#vZL!+%`0md=S~F%(l~dB|Z=8fIoFW{blpiR7IAkaxNZ=Pe4~
z8W2OL6i6?5$%e`h^w7<kkdbYi=6T}$F8v6t0fnfq(|;^pI7(XWhKy9Ra|^tHLHyVj
zOdZuHiTf3~hcFNxDA>oYBkiF7m4eTK&ia@*;@#sdsZHlR;I(}S?7HUGcl|cC@;-<o
zid((KZf(LQo6{~EEfUYA4(`IfPVgchBm{_nga8>m1%5yXkO72%mv0veViyV^>Fyte
zS=>V8y$P9${X#t;-JOoa93HDL*qf=!P*fbo`DV$Vy#~5C_v<eq?e(aOzb;0)OW#_s
z13c_yWDEavui?2_<f2qaJi1dzogj;R3W8$_iWkvWDx=z(P!<I{kN*YQ!Qsx9ql*OJ
z;?M>1w@qIu#SRhNL}^>V^sa;Scfv}Hx)Hx-R^}ni{&tF+W8RVN;f^gY;+|c1Rzs`U
zK3lx`4vJJB{e~g)Sl8w`hi}RFa7!s1c?lV$1~6F2a9OPQU}Ihm*BMcIu@~_gkF6-b
zS~%-}wSNBs_X~H`I;`fcF6?wH+GLoDvt7HnGh!hCnG<+U{%(ghK#3$#*o8zVN(Syz
zm+Hz`MaNs#E80ZNw**MhTpSinZNHmuUm$KA!H&+JZ}jH`3lIf{nWD~rbwc6eLr3yP
zJ-m0#9Bu#0?@(_0`Uabc{JW-<K-L*Ir{9`}>>??`;ofz-u{WcAan5R8t|=CN%WxvS
zlB!Nu+eWWx=Xq9eZ{m6E3D^BDdyBo%!5_+Cz4_JUr^Wa+rroJ5ua8%QY%xN%k>)jh
znF<AV6LwOtX5Y~T3Pq;MbCr>zDju|-Z^f}U^`kkn5JEIHF8B8)kYrtZ(la%I@x1$9
z{fdtpAuQ7MhEHAhR+I-pJi!3?F+VHruhaV+5ZM(nx`Z73JXp!c$*%Wy(2xQm!8zXr
zzzJ9q`17};O`^JhVvZySue@z`!cVCmJ$XnE@frS!l<(WRUiMW6DPjvbB6)T0QkjpO
za}qhf^tYh7h1j_)GiBT2Ho`x}T%>;h*vw}JXkyWG7>zfE^FecfCMH@*^e2(@4*;7H
ze%@u(q*dV5&yUs|j5`6<)~Jng>hA-mk^2hkcq6G1P7o68u6vi2d|RGdE<*A&`;!-A
z!2+jLyHdHBSt7DpY@GFziHVU-?bl0A5Cj%>hdZi9dizT2L{s49Ea6GqsZuuV*!?2v
z*QYbQjuVW^_UR!6Ily>|h5+`<vtrI;p!-y3j6d*yiQR$&)!S?a<7dPZA>AgY=3XyN
z;Ds)uvk+h2u@3@&*vxn^WUX$<7d6V-BbwhZo7>$EevFQiT+yM|e9n;}%(@@VPdgSX
z<@U8bVkO2^@y9~^gwM&Eck$Ey0;X54p^36cRO{{LKQegyUUla{=c0L4biYKF#`9m+
zzf_9*!$ca~V)v7=WWEc3B3t%+<Nwu7gCisa^yV=;uGw6o7`#?Cz}&{%ep$hFR08zz
zND82j(;Bw*Qb2DKU{E_$2iBePuRBoRww5Ey^_v`{94We5H~&VdK_fnmAZ{*mevKiY
zMtQ!~`&pfkzJJEy1FO{rSjaEMLpsBF%?ikuj)G0nS@%U|*&a+-M@E_7FWgviH42tR
zX^Yn>!m`2G<B;*nDp14!;%EJed<(wlBj%=olZj;)SrrlyG1>gkfetzg91*L3+IV-t
z$Lo}e<9Rf~&87_GC5ZEG6?!u!FAHk@dlZJ%XOHbn^e~oRMWE|Ejz>@!jlWeGp;;&@
zR+{=rU5{4Ai&>TQz1>}ra`3&GC(FuaR&9#{YyF%^emO7(#_zj_S8u8v(lU(XM2w;`
z2I01^?(Z>4$ZsQ)%?f+E&aM3le%QM$>jKvkR)N968loGQMPOP`4nGsm9he7gj4^Y{
z>jkF^fvT7z0aQgk6+HzpWlKI_z7~`N*0hq?v=XQ)9=R2XX|uf-el?hQ0=cEHfLpqt
z{%(l%uEhB9yfp>>x;&(C)0&%{XgpF%Nxmr$<)&7we4m?qx1+3Grn!u=_+ZDdID?WV
zxX%5a;xe1CWq^`BEa?%tut)Q0D|bSzhJd9bTY-})zWd!fJnFq!r%NaSiD`!t6}q~H
zOF%Q^WkCRm2_R4$)S4(jDth*N2q$9dtk0z0gSsF1C#t^JGm2{u2oLxxSIXTQ=7sD(
za9jH4$dAB0aqz1d;A-1aSds)n?_2Q+!C*X4kBX>|=s-k-Td{cqw-RS(2FO%~7z4+y
zKOU6n>Ho_TQjFdYK_&EopdtHvvu0|MH`D#@JrUYVW2ST1O(9XbGZlWXR=RCIm|Jrq
zcG^DV_ubPoIjLgDtFCqS8<+MyG}g6LcSeJX0<MoGJMKAI6_FEh=L%VXLjA9$hFnw)
zOR|DAw_cjNXR#-6ew<4&WMu0SW%rWTX@PdMPpLs8_I4yHE7-DXH*WjE3oO?^oP+|}
z3@GlC7og8*$z5=%I~*A9lLP+B?~Mk$)y_&m+OHsyU<M$uJx7WN@eIj6Tp6mrQ{71j
zf8T9B<ND%s$omYITHbRt%YU0U*vs|ZbBI`m`Ysa*8q<?UKk8w_gV#?cHqW-_DoS{J
zK2IZ^Ex;a%$=ZDHWH7~@MaUGVWwcaep!)3jkg0spx^PNH8*Q<edt+eN-9sb;qxEV^
z_oUN?9G>_~SOk<uJ!+KT!NzPsd3JkcsKzth1$d(-p=u*i=_x7_3#yC^+74;Zypgy%
zN<-ei7R2B_)xVE#KI8fAbWA5u!Cs#RilPNEq3^P8d#|K(gV<4FHwQ*nJZ2wHA+(5~
za;DHsA5Ah+O!V+?HHW)KjWzXnyOCb4h1Owi4|W~|G&yjra&AllgQaUP>lyYpudols
zkzzy!`w?<j4JQ*Z*HCQG1MvBQ2XSJZBmrExh)1Cu+3J69OSLAztJ~nhR@aFJ<^c#8
zRt`Ww^rkCLK4r@vRscfS!4A_93)29dg#ntzjS8IJ`O(UQFV4W82}mcJ+Wqt8-xA@P
zJn}_)SLe?y+us#l#qJ(gK`m&;Vr$n_&huQ8^&6nj(|1AJ%D=lO3YvxrcR>@tQ^DH0
zU}Iv#$qJe*nTda`>3ZJVu`q98!tP*~HRBy+jvZ({V}mopirP!VwBG+k{j4S1b+Kec
z0<zJH#Rs~y$hUkqwl;^0@KHZ->3*uENayf#CT{NXCE1953O($Y(Kg=;<0WE);jH5@
z2&n!Ce&!AK-1ou$jb!NXBQLyUbO!$c<JEh6iRuG-4)VGpkGBY4BaD$2=Jk`ofCxje
zK4fj3&o02m3?Xi1NmAEY@jPYXw^&<=pk*~Y>(-)-4XC3#pQ)nxT^^M1Ewl^`5#Izd
zM1(qNafKmzR+fZ3JrHGYe%5K|3@sFjT$TzJ?N#y)Mg?V95|#QJqH@l~ui%+mJnw4B
zw(a7{a{+>XjuRmGi=4x*de)f<o&$pa+@x%qxO^KZ8(6x|w20~0=c3NPfV&H7Tyzce
zE71tQc7xhY^t<MvC-{2}ydYo1SF1`k?kO$%z9}8FrdHf>63?a7q60pm6-#jsacR3>
zVUZu}v;r6Y{uSeKk@OQRWOE71`xWL*No&ZPZNtA?osIX+)qmL=86913HV+4f;nCJT
zT$j&(+tPI=s~)@Z6R}^f;Q)5HB_hH9cyYd1TMtR|uuW$pcq`%_QeRR02dAm5p=Bj+
zWkchN<m<=As&x3QGI8f8r>`Owb0T)FVnV4eKAF&GD0fVMLZfNHv)R!cSdA~x3q_)L
zdity`SKTepNTqLN4=x}J#m-z0R;*KST*etfQBFc?+_2pno8SWGSBZK-R3!jp#C|ES
z0RxQKFMtv2UjyG;M%w$I5v#Y4wc@C+s4h02AqQ&iQu1GOmy+ioxkNN%tDcnIO&z)`
ze~I<u`Pn~s#pWGWn)6fj3yPKT*2Mnh6@R_%Z4>A0(J47$Sv-@i43j+~3ptZ}h?Hjj
zvJdQYW;0*V?T>61(B<=_()kSqP4ZU4aIpPBv;YQ$=~s*dP0yg@_C$mny)FI0`yuVw
zuMz0>QF{j=^^qs%LH@VuU7+3B<rq@VZeBdU=wF2AHoj(01mXT91^=h{*zi=eHhFG&
zqb~uCXaxz|@$-zXZ04EH_0<f&UfQ}P-tczFK;a$<P`D=<7Ka)L_ap-w#bsoxP<*El
z6h8Y|5cX}*QC~{Ec0Pjz^zCVkKohmGG^ik!#0-zE*S8nA<SB0Akg3x_DSz%$DJAYF
zBgW<tPQ1BKYy)0HhnJf#A+3Ih!#PTHV3~CSc@#u-c~>9a0kQ_fsOpQ@kuFWbB>2rE
zw<7t~Z@V)k>0zcA0@#5Ncq>uyXkwAApX^X`=eE`eJZyjY$SvWXy~4fu%c&r|kO>-3
zTqksUB|E&y`+1LunsP^|p-)jKN9^~1obY|BG0>#-p|7prl)+da4-O75M=FEOH|~k$
z-@n>^dilq=k&JXeSi7w)@MLmi(mN1P1EH-zyo3G2g}x8W?UP#gqZZ<$rXG#~7fi@M
zpP#EDKt~aj<fL3JSl$s*yqWg>|F>TbJ4ZT$_cow~bG*(OgC10JgBRN|(LO<$Eb{5Y
zBRTQ6L2(smflzB3AofN(eQitzGR{tb*lUuUtCd)w1)x^cNr<ZYvD3l!hTd|HTaabt
z3RqSKG`E}#<K+ei0}x-ZPZG=hW4{)cX`B2UbA%b@JVvd>oWKR1QYJYKg1ZmwYyt_h
z-p$5lF>M2^h5tGX;7#06nO(7Js;#}Bzfub2{U^vDi&d5+e@Sj}Kl{w11cXbp4v8{^
z_`FzZ1t<x<BAVi^Z+A<c7kRTCDWiON=#!z4`7&KyAw{PN#5|({ME=GiFT@(~28R&T
z<n#0%P3kZ4ATw-uzAK8N3gJONNm%<0LF)aJGo2K)H~JeoZi_fUzLMZU0oeJU(%RgG
zz?jJ)w6JUpy5+Dc_Js81vd;bwQP&h5Y1cJl+qONiZ5tCi6Wh+j#>6&eqKR$WPC8B|
zHaf}Q?|1XB)t7zI&vQ<nvv<|5DhQ&y3pAqt+GgJW+Gc0XwL?&C;SBOF0GELw(!wD6
zuWbgCu~XXYNT&SrV5^+)pD~yWXdu>5Awe0Lk0Fal4tJV|<9uyl7~mnGn0E~FU%2{@
z>XBJF`|)Q^?KFAnQ3z>4mxZ67Up!d=X_f}Ihru+3k0eR|!Sv9ogX)L|N78$O0J2l>
zWzA^Dv{x(mSNI<bZnaa~r3p9ma>1O!Or?+Dj%cLfb87ks%f~m$=To>3eE+`#bccIx
zjTj*YPlkNw<<3+-)KDz2U!;;^p$1dQ2Rb8qayO4}c@i}JrfE_xypp~5CR&66k5Ff{
zh(IrO&ED&2o^F-Ki*Ujudhg*b+UKDV#;3Zk>&NL$)OY!{#`*!2;;SH#$J?1%d%dah
zp~nc|<Dge6>g&ZRYT_$A0{vE>Qb)@XT}MRETljIG)&FP|-orseHSlK>xV%ic<PYvC
zF|;5z8A#GixAPHWz&AKE!S|F^KG%X;3wz8QhD$}DMaVb9DOocx4!pFwhs6^3SLRz+
zqC6t#g)uHZ1Vfx^W_-v%$!nH?!(_fr+Li?kopv?gN@o$%ojRI7?d+xaT65*LJM%&N
zpQZgq(Sm2dobebZ3W+`pl&L<y8jB$J<Bb8EM$~ZnB8i1Trcjxb{U%&WZX<MvIa%Xv
znFLy))eZ({^M-oABC@)?naMg=Spv>UG@<zCkH7?f9&!TXBUChFMCq#<w+i2cm;X(O
z7-e4fQ<})!B3ZC^N}Lofl0HnGnI5R<LBI<yGi9iFg$%2BMGgOFjS%~vf(wVWD;H#q
zzyz{J=--El)xn7UPr=o<Z<lfDF}VNzY?&w)<cJbBtaG^T(7I}J>)7c~?@g}@Tqtq8
zLBD9{dm6JQRguF=e<y38@|}+J*P=WslaoqgWf~moyd1J?$&M4OdK-Tf`96?}CR4ea
zUPGOv2~x00;RGtt+R75a&y;S<Uxm)^<Xrn)g~ukI6a=;(zvA<1LbJ}ypT6BKRy^OJ
zLPzUlKR8#&aS?)Fa0J^??FPerP*RGFL2ucIghoXkl1ZRWRnO%=^OBKxf=FTE<*YRq
z4`C(79sG4|)7I@B;g9j$v{uQW6?k*=x4-2f4)X=HcpyUni6GE9{xCXMfUr<d@n3qj
z$SjxaKdI0a*~S$ro00~643Oq&<~zpHH>y+Ugq1rFYRfB?M1Spl&TQ}1p|D^7{z;4F
z2_mX2OTIp_(^cm9=(d{C(JAVTc^KMvqoK+<$W#p?(D`$>z=t;l`bhPwhP1gI^_3*Y
z9l?;o1&$8xl0)@q9r2KTR=jn^$QoEK(vPYaEu771qAaIaM^HM^oR?7N;vb^}Sk?(2
zw27|65Biev*M+Y1!n7xTTNu5Bdzg4AtEki<3{G6&;Lo;E>lRw`<n8ROS-||E4E$%K
z2-2k9=vzm={KxX#<bYTnK<mH=2w2~11p(`U94~)TUjE1O09#%u3LVLmLE`SPHW20}
zYVaSQM>fMwR*Qx94A?(DcM#l$Be>~E&iQ4%T*Xhjs|(Zav8nx-Ot|XmUf81(UY?<_
zOa$Tb@R|aTocwXR&qvJjxodMR<cD_|up46TLmH)&aX-KFZ20oenm;f8sptBm^A!?w
z-rNW9dz3IhjC4l}o(GAc<SIV`6c7EL$a*kj@?}_>&g&x?&x4X_T_X3PtXIelZ)2gH
zZ^dR$d3RH1peKG;z_R1g<RT05cbqk;yq#j$wnY%^OYd#%MIbZ4LZKS8tQ8I)Mr(e6
z@gY#EnRl~5ge@BJ4@vW^eW_Q9oxg#5_AMouV>Ns5)1Hb0ANUG~--Ms9)0Y}BmqGa^
z2h0J%EhmMHH!ozB$paFamEWIPZXk*B`j5;nACjYbql8nyNQ@ppRX4vOf^_gqm59~z
zke|UOME!od2%>ZGW*GMym@&>j6Mr`DuIq|9NdJ>Q4gv~tcgPC-@2BO9S6&BBb?a2#
z!QEFCk3N_9W<`_`Y$cV}mtu5nbCoJwgu`Gj;UZTyQ4rGGh4V>?Uv;h<FMrm7;Q4;v
zTz(6`xqSv?sr1T}e}1f~RO`SRM%N|Qj$ysui}N7)#foFX1%d}0%x;-Y)v+wVBl%%k
zK2tROtH04&zI*~<EelWSHAx(*Pp2rJe)A@^udFJVmT#)Qj-5-$QBlO_v!X!-v<na_
zGA}g9q-fq57*3DiS@UPVr$$Q(f#Jv9NoKeg5~3#)l>S6d!I5)g_Gm{fFLTYIKFQpP
zp+Uk`;|4;cvmc_$q>UYmD8BcAx8plKgd9xq5JFO;`kS@Y(Rq?6vR)!dbu=%KTB3Cp
z`%2Aucy-^G(O$TySpm29<VO>k_RkE?!|#l#evD<)wor$fOXgf;u0+&U9?r}TZ!hUY
zaGZy%CvF$>K^X4HiyO?Gytx{!$u{ll;!cM8pHaQFK)UnJZljsVPuCr^AnuZU^dMdk
z)bd9q^faR7f9M|KcrAT+;~P_~1lYbV(ru617W4z<dCTisCa$Q<5v?x0PGCXCn{2I?
z&J69#A;}YHWSSNeVpCX_DQus394Fh?z8x(&`@nL9oIlkLtrEvfiWLV1JA@IAWHzlB
zI6gpU0`8e4Vnrfmei4^JF$bMl=!SF~K1SXVoh@a4Q7k}$7rrKAiieAYZusdXCzO(5
zYX3O7yI>4T-)XfkAmrPjdSGb0wEjU?*&HjRY8UBO2&$0kVXHw!xL;xT56~a^A_N5N
zJ&8_}*ib)<f_y1ww;`D&E&sJlS7GZ<xAK8Fvi0LB5F>ucZM|ymmfkq+bKJ=1xwi1d
zsL$_q_X9#<(rq6N1fsVJbo#*jr$jxnXc6eVbbM?T5b0D1iY9*0Ic7ScQe6CLUv*u-
zVf>bq^5<b&C6V`#q*JUZI5b|B&DOEu#578aK*)Q1>F!{(p(KzpwyPwc)Bx6-0OvKj
zgE72zJhR=?k-lo~GwZ;=kmVk@yke2OMY^}~A_L}iZZeA#izvXQY7(gZez*jZeE~Zc
z|Fv!^^-RXj;2=Wbf|Ua3J~7b9W#|hGTv3Eyi^2O^2h@;|=led%Kc6VSCO~s;{XLeE
zm0w4<99!$;>Vp>dIm|TdMo|6S_uw9{Eqh#f9ZLbT<-%LaFEm3IcbcPoD3WtW0vLj5
z`^D0f7Xu*+!!-PYk^t7}^6%)6hA<p9H*3KlVo*s~_voJrNuD~cfDROxnzJcwZ7;>=
z0{j3a?fd1&P~y_pfH_YAYyU$Cz@V**s8C&x)1tKaRr^Wm&qI{{Y4(fr7wZK;9<|8K
zN5*RHL|sP0LlOMo1hGrnU!V703UIkUTOt@7_CoB25i(tJg00NGHHbqaJ5Bl*T8tBn
zfcA=}w|g#+2StCwI#y~d!kj!@NV8WV|H0>JS_qPt?zjb!Fd>^WWmYPm24rMue+IM9
zmDT~M+Lip%fR!p$av*EFc?(6Qpuj}BtBS>Dj5n$C5~6TH1p9Jh-@totTff_v^I+%f
z?deHkn8uUt9#YzYtT7l8_Y)X<@4ewjeN<^<#2#ddaA%CZ)|E6tM`Aoz`_rn3&Q@U8
zIvDLzI7`E_C3x-<kc!@%L-pxY*ekK~Pa3mXl@fsj%d41gXy?JxQbLp-%qhRV2!dS}
z)!)1IyO-0>Ve&wUOk_JsDY1nxdSVQ*au7#^)k}WikJ9@!sU_$WlmbSTCkd}iED(s|
zNRB)ND@u#}N&AN0U;I1RVnIY$jsfU60n2-i@a7WLac(q+`IBfB!%HqI=NW_~-rOGN
zhWv_6vz8&M8Mm<_of*Gu-I)I0z=iC^BzAA@U|r4NlY;N2l+9+SH|FtlzxRYDC|W_n
zy}Qs@lE2yl-}40XT3FC5!`qV5Sg=4ilo=QuR-s`=sT!G=Th^J$dc%9tmb+eC^_1LP
z8*%LJ)nK@|4e*Qyv77d*HiT<Co=Sk_p5Ghxt5ip(Ep}6$O4O}(|II#b*ZQDnRc~I!
zYsXBWL~0Fg=YU2jHo6-q!dSUk0iaO|%+P!{_q<al$@@VB3Pv-`L?XUIv?Rvtwn&f^
zX61LwGPc2o2_V@|o+Pcf2)*knTEM8&&&}S`Nq)T>J>(Rm$}{M67wcN>Hg(Ij9;iB}
zF;=k}EZ-Ea{fvlLb$$TXDB3%6ni6dpV7yQU9}tzTP~Oz`LXmtEKa-D*(A&9X%)%U$
zIP-Vf8#UdMlt!bIt--61-8v!j8@_x=se8a!rJ4=DtchZriK1snr|0D0$4yTXk;B3k
zz)duG6>u{C>?-$C%L8ss#@+)JSnQ?dSm2w~r3qv8NRa9DMp)q8A!g3))Q8w^XvcXv
z3fr7dZX&>3kEL=L7C!We+I2DiF=@1H92V;}BDVfMW+DUWBZM2<X19DS7US0agAUnQ
zJNMYZ^63yQw^8tZXwT^0DyYx9$$+(n<IdtZQ*AWqmV7`-WdWcRGM~88#qUT^q)u37
zq_ihX#gTM;Nw`vTa~t))`w*nY{}J9>zm(cO9{9M{o#~Ys{ae4eFBcaiAUgWjUB$Id
zCvc|H>`}S*5t2Vr-w%*bg}m~!?GjKn|CjdK(^k_taqu19OAnz;*kn5cPNmT!N@0qI
zt_2!2paq(3XaJD)9k9}wOsyj$o}eaCdZOw(2|{=&yoT~6@UkxXzI%x0iT?h9Bv5DG
z)@nZe{mmQq0_YuiVE`)7*4jY@TEqPSA}h!>>jcD(dpfT9P_O&^$BthZwD#2zQm)F^
z9Mckkx;s8V68Y@Tcj+CDxUO7Gl!0I8v`+X*UQ>RTKA65fE!ovhcS06qKCRm|!c-Xq
z32iZywFj)pSOB3Mb{-`JY-3~a3l^3fc5MVv;&rYBlO7EW5}<N9#a{RT;=vMp#-u=G
zf|NAWnK`{3!CMGyUF)1!%Ddq}5ma(uVOh(XB7bEJOkGAUzhZiV^F~>!G`|ZZX(bcS
zhF!~0_%&O2y;Xyo-LYk{<{QI0z41#aN;2_k|5ussgDpes`{xvb8w~c!$hXWm5^-8P
zX}sucg`m21@or!sPBq`Tq4sj|vE){Yb}8R&Z=rnnSFGO?<#|(k`7p7B2*s_|3i2De
zUe!Lm52{*4Ah;?<pL2f!o4X5qzqBBU5ezg3QDHQiUSAUAGt_6ueC9N+Ai}Kw8I(H!
zEf8YBsi+L~QD)bSz8nXaG?A-$DB(WJKZ&YA2`V+4M(y&))YlG6y^&L-t_o;5>hnR%
zVcI=VUJUX!=?2xyD;&CYDY|w44Wj&RwUSfkX{^B3ogUu-@e>xT68Rs^7IjWzM)Vdc
zzh9RGtNxp5I+Ix1TSb0-^GVOC_PzUKL1x^#T_=2qIgvl*OZA{j=ifebeG1oIf;N@8
z%B*2j%^1K77%-e6lm8()U{em9Vv){!>d)=CIS<-X!;rq>xT~HJB?gwVNs{6iw);U%
zh~j|j@e?VEI_n4S=p1BcqAv+nL((10Cqv2J@_PRvvp=Vd`jz`DM@y6Xt^gtcOO&3m
zmoc&B_uN#gaX)qZrmX$K+$cT@D=vi(2c<bnYA|^Lnj~#9TCTG<PADUp#XW!+1!3Yy
z;9K@!_--;~i1KF?zhJsMc=BD#Pqy7aVgZFff_FcbHNOE&PsPlGde~FJYumm#Nbjrh
zF=G4BnZQrd;q@fwc#r8FGhDNiEr5w2X8(_yh4TJTzLM^hv2c5wn*lVD=peTq-i;EJ
zhnxJUUP0GUU9^bxaOV{{&naVe_?3;Q$HMg(z%giEg_xSbji`Z-f%ppnrSug%uVnXO
zqXA?7b-*#ct)Kx;H3gfXcrl-cqgX#OPxehEQud(@Wk}=r=|~wGjXO(ZG5U8mJ48=#
zo*PL_ZU^_z05Y_vP#N+l0~+WZERI=a16stgU9MZGYGjr7Y;5fy+?%Fe3GZqUS9PNa
z;;Qz3m|_}eJM8@caaH*Q-rwcCzyF8N3kFQ6*Ev#YF?MICE`fR{S=;}Vr*h|gNlWUo
z)l;oFzU>Cm-!_Ic-F-efT+Yd6(={GddMc2VFI!-jN2^RD`p3kWS6<Pejf^r#9rhqx
z!4O8k@@=cu#%wN6PT}%W8z9M1epQR>FgsU34w3!MzG9SmDzn@9Bt*jh{x|UTg5MrU
z{ifl&bfn#I<)ybhhFl{4#a;sLLT6zXz|l&KA?WhZ7gj|IM(ZC{gK$<s#n0{b3`s?~
zOBP2o!n!9a<>>@yc%_K)egA<^l$#1~#DD8$k52?vY%yul5Z4O>-QORQ#}J?t3dzPa
z(hqAjYSz~8<<!ekkEjv;iy3xUNF9CXQvewLJAK3HGbvr-)QNTk<@@chCF<4>m63Hx
zaFYf)Wp)p~DC#Sr$4o>GYT9o0YrMP;q??M){hLlBj(ew#0@>jD16gY9m&=<ZnM5Th
zE*#~7r4LkFi>S&h{VxEZ=s^kvY^9S)l(&dnUA~Ij1EmsL+QZu$E(P*OOo)()aT}j&
z<UA0ZAuBtmwWmzd+|0%`R-7|uHAeIfb?Nc=lw=o&V1ae1`z@HH@*v8)53zvB0VhUf
ziYX-r!U?xpik1xW3LXWR<{ysN!3p+}qd}7V>v{+5d-F+QAd-(lQMkD<VpGyA+EV}=
zh?m_<`}VH7&eVSMOV4U;uazOjE-zm#XZqJGdvI-=e+^ZS;hcvhjKh|<0{cbNj_D}v
zpr^)8uQ%+T_3x+9=MZZbMfch)ujf#Fm-%g1Aap+Ts<Z~2j!4*Ld7XPtE^Wua3B!`j
z;HQ#|yX2pnt8Xq9h(VGvd#*ORRpRThlXz5uB$xY-lMWm=*j5U+TeP%Q`00Q$4W~MZ
z9v62Qvm)W|qI+LBzQIZ)eYa!dxwj-_PdyUw7p&hh`~6?PqsHFKlUuz*Le-%KPGhdE
zAt7(_+SmV{qZ~8dgVi|<!~!&GG(%I_=E1H;RIR$G65UDKa_{mIu|lphO^x8`Rlsrw
zN_wr)0%-6;1W?jBw(tmH@t(9Gtqw*lf?X3Kb)r;_`qX82@bfdUU@ZLX8}>FMIa0hE
z+rP)40Z7sX;y4DHov@;w`)TSRiilNpo{+jot*bIN_1`zL_xBsX_b~U%3Fcv|d~Qxm
z=%+GSDIv=UeD=JIon3@`D_BJDrY4WLW_6XiUVbPQ=#L}vr9RV*s$jOfLYCm<s_w6`
zISeQrzJcc~tyK&Wwkyq%lr=rIyApX<zF6e4mAts^g=pPm-YQCkrMAk)8!PvOenQpX
z*j{{Hv2|trX&cI79v}x<pT`Y4-O=Y<6WlA5*$#|@H~HpRemMi3hZl9$@~-!W>unv6
zGtrX!j+D7PNr#DYeb<vq*Xhp{d#GF`w(1VwwE~@_h}%M1p=Jeh+BjU<(Ic{_$QgG?
zmV~ko>h{@Suy84g6a`^a880XXX&SMV{!-_n5Y+c~r4-^_d0t_{o})g4zc&cT3bID#
zLFK_;QvC3UPM{;mQtT%hX8JDRC)#b`AQ1pf3{mr>>`#rY`6vIG+FtCLO19*jEEfYe
z(^q%^#jOIvDfkEth1*}dFGcNeAb^PM+bp_0<K1S8f6KrqLQ{lKy-<d4j(O1U)WH}{
z;ahphP8Lr|R1J?$bNB#L1MI#53`}T$j&S@T^T{fVGWrFRvzWz(94P@eKtf&_^NuG;
zNQI&B)IcxflqgF)NQB$IRSNs=970~JYnY3OF<NO-OBae!{A0=+J(Fr-c9WOX#uFE&
z^M(TNVlGw`bi;PRfw2DB*g`g+bS*;G&{DxT+>l#}%2Hgh|4JSsD3u*RWe#JA_D?P^
z>NOMlkzZsI`LuS1@XB$FVp)K6@!qo4OJ3&`>z=9&8e^pqm%>fqs-6Q;??yh&n~bQY
zG<jBMcc`M@s1O}5B)7eeyj3BWJA7bpIm$GW?B_BfTc(5ch%=C3_ZHE*L}9$5ht3mT
zAw%mC;~1VSFAZ4xJESB3YH{9FU`<yo!AY$Ur?Y5VAWZ~9nv3(&qWD}PqK{BGIbll6
zpkLigdFZyVF!X}}vz6e%j{W`xJA8>Z|9+CD0Ss*+f;<Kls3gObFfA83_Fw&Xy_;ym
zfUz1vEb#ny7g(?%dNR`;ca`hZPyS;6$aEIJW_LQBTjMF=+k&7E7N5Uor#lFJoEkk7
zw_ZMYZz>BmEDBlc>yc*uq*A04S5WnA66oyx$cGTc@Q-Q1lOv+E_Tonu6GVVUdr_?v
zFLo7oK5Hz3)g04Abc47pj-IUIoy;~>8S|)RFWI-vPD=Ogx4ha}qZ~4#tKCBTDB5R~
za90P5_8$-={Vb-E$Yvh09x5(@exq^)ifNkDapzT#;HTE@TL;P?32{`yik(#ysE$Z6
zd_(@iNA{9jj1*`%NAlYH+B*YpS^lW?YUB`ln$i-9;$i0YI;4LrNrP&T2&cq>$x<D^
zI+APgmD4PR9?c_bfaJZIgG$)L$m4=HPIWDmBtfs}O8TLdLG1SmWlT_pJ0G3PdmQ0{
zK_~aqhwmYvdNTYB3VFkhub6LE(tzEU!udf29pVQ)MwjT5!AR<_?7f+aL^d$#KIxML
zR8HM<C@dxv1qXf6$338!9T{g=QGwyvL>}=R#jo!Q7s**+%oL*voZ5R%Qmxb3Njf95
z;=($V?k1CLZD}&yR0+?6rc%oQ@Q}aKK0EZrAx<^0341~wXcx{fMx{75$I0j)3<+kQ
zd=O-;Q9Pb%uzHvm<M~4<)?-$tU(KZ(#B0B)tEs<mTla{>TA5YP@A|u~a6BCk>HB_A
z{tGO%YI8B+a3STuPo`q!Yq<oV(0Nn-74#WFA^zKCkd)3K!0)C0I(9mF9%$wcM=|5k
z<bodImbhBHCvBn-tDE8h-*A&{MQn~8D<{I%ZB1F#Rdfk1$%r!TeCUN`gcc@CMSKNy
zFN1Q;qx01AKC$D{|M~8XS^wc3R^P3Qhu!xy0I>qQsc^lbxdIZt9hsVRhFt2yZ%)p#
z*1QQ!7DIR(oQH!HVmih}4iPo~<s{JSh<r2X#;9fSw6!)7|3bur%a5IN1Uei%rglN+
z)ViOWTip281vGwm8&>jR_$K@;rYt*K-W?X`<b6l&BX@pBFpSRpS^q`!t@O4C@f>~9
zdPiKEK(wOYr{m2_d%@%zS~+rwO?4XSmVTn*btN%%d)Qp+mn8R*um|~!W$~6a|9g76
z%IUYSEmODmt8)q<VDa)D=Pg_qU1vY1vmG|`aI^@KCI`nG6OkF;@Qw(;hpLptj79<h
zJ$L0YW@mpr4oau|2oyagW{fxOS9l{QZ`;H;E}7E*9Eq=1pUTRn#8@-&A;4@;m(+Sv
z{`rO^sq7$xxhyE~x4=9A({g2D!g1K`<=fo~&V<f{8iDuZTJA!1P8*39&GG)5jBK$v
zF6SC0+|RZ7hM_4+m9%N>9)#M<vVCe=$L}`#SlGSRW^>W=Ej2Y&-UMeAjz_F}pJ8lw
zDp~i}yJ%$FURcW715?H9t^)M(>T@dAY%qlkBzfGQ>|3t~B9Vh9v%9EX-=(}5sfs;M
z(-1Ul%I4T6RZ(uGvqmj@qul9|47#MV<##SUo?!gCuXYM|Gdl1L7sXKUUlo5Uh{AD&
zx-1ZNOiAtb4}PRssLXrqd(H-y>iaHj4lRRk`wLf_F=}sWH@>?YV&8|)cIjp&X}cm}
zaVc;z=ZZ}>Gw0SeT`fhjK*7u_yB42w>oc4ybcOz*JCDuBsTzu=*Hp;Ml`m`UwGB69
zvU6~^&A_HuVr>@WeZ%(3a@aRNmwiD}2~+4TMhc#}E7cXjQPmMz%Ijy7S*|g?jwUVn
zOoe2+XkPM?IReP(@|8d-oBC_s2h;WYUrch80`bi#ae%F4QdgL(6vv`P3E-N_2z`U&
zG$>fg+}?$%OmPS(SO|!^yCLFdA5{|@M07((rYKlbAp_bZbZH=mVZTDvn6RZwiy~Ef
zE)hN5B8OuOa^_iOzx8qP3I}DJYWR}S?!Nt(xEg&4r#A!gGQa)~=5p8b9E%xj-@LU9
zcY#@K(Q(K{DYm)c{^pPKS!^<!aeo*r_`G7H&6VvQ_)&*%)=m_%!>QP9X=<j7<wS}T
zau*qAac$<8xY4YYcByqkiyAQcTxN;m{#Ju+s<$!_xbD4Z#$3kI$B)r64U~eJP*{8}
zutjv=6_!k<sko)gorYJ~o8(tas$JOzOX%n)bDx7V+N9~`8XuH-#VDR$fAV`4B2;8s
z+KsruorEYS$DJqN5(!SiLGCF2)ulf0HmcIDnlk_Kci{(id|CXtDiJ-^XFAzM6>jZ?
z=G8>8)R|ic+@;T*p-WKV+FA0FoD%6l#58!nKhm~+CDTKGJf}2Okmy$g%E1l6UgJLu
z*7BDr<}r@PK*?T0Iy}njXw<)Y=Y3@>VMC`E?0F94%eNS(Abn-<MTL1v&>hiH8l&+P
zpG1cZQ~9Xd3h4Nng_sWfk;_uD^u><Z(6ygjHQ!&<2`5_^#P$f=z*_bxDk(3pJW#&u
z$Z4Q-n`yvdpF@6IzCz=?6YF4RY+yXPBn;##zX#NDslM2Rc+41N=<Zpsw+IciZ=hAq
zxy`pSAt~VY+>E=iF9hBZF@GD2gG~*|*DW9`ez>V4w6a6TaWje@o!6-Qc>Il7qw4Cp
zKv={KIAEU9J)qsyh(Q!;x>&BK93*0?t!rPx`dC)=+Nb{&Se81RjT!#A39((ht0jW!
zHw11DwhzN|48L^;9m^C9gOcC5H*2I0*^IQSOc}h2t@1m%?||CYc^Ch|kNLLu{nB$b
zlVWKOOKfgBH#J7t53(Fi@5R}$98Te9LkGRM3%DJJ6kTGI*2)MLISZ<JjEN$8%RCkU
z`hK!z5IvobzbcDfykYI!A*Nn_Gmc&yG(@VPgw8*LRg}&9vwl8XV5nyl80$iwS>_KI
zP+Dy_>HpnAL3a3J<xHE)&Ylk)`!7z(+cvouQta5w?)|9dCN2*uU+ofe&A|)S@3N%Z
zla}&Fy$Uj-KO8qEYEbVB9$vK|96<1aKku?t3a*(bBs)k$B~;-m6q!Rhx62^1F)v0+
zr*W=8dC*Ta&)mDL1)Ruxja2wS=JZ+aXZ5D?f;mvefyev|i>aSK$Al>lnLXXiRI^VP
z^v@(Ur~jzZ)*~Fj$cQv$ifFK>Hm4Wq?c&!RyrVYVhEph-vsKpBw#gx90;%&^sF@5U
zbgRjkta->(eX=e9z}Crb$Ii|5e_ow3qfYM&GCWR?<u&<l?D%sF|J?1szRx%&v4y9f
zC+wdaF+0H%$%bFCPv9YXmd551ak_b8w)G|dNn&Bx?@8PV06Ig$1C-@@6!Jwp$%*BU
z+urpi&psux{I5g~4=Fb1;La%zW+j6Ch>rh+E(E~>@QO2!r!*4DZLXb9_6^#KB75D#
zdLKf29{^fWXMrs85olKf`mpyS(8rh79A}ZnKO5$d^{*RvXc*d>8$*6AJB>3)iTQ?y
zWn?n7<a>$rX^ooBCii0EyKo^eB;%n*`RDP)O?Z=<Xu<%5_AdLl5D3Zj$K+p15W=tJ
z&ApG{gu-ONtPvwdt(>!E3MwT=4pa2kl4EW*x4@x&O3}pDL|ga?*gX)n0ozKVEmtt)
z`VDLh!S><Mzfl{18I@Q4Mz)BZ92Dh-TyMc>`~^A+k=Ny&V9!T35I}Arph%ESBs-8~
z(uv;gAO4Cqyj^FXa1R+uNKlZo(=kdO-{C-s%Fm$C?ghR)r6{l0$9O;ev!g$!?n0Wz
zjF3CNc{@*Gt)l;+*})Q5rlc0z4+g<RTkyaUaCOa)M0H1OUAFo|ZU!j~J7d@-<7D(T
zr-&!N!^><$`*sg}$;Ist53)#0N#H3t=hkQ)@99Y%L7jBBRN8cTh6A9f<psQP)<;;}
zV}MdrqV6%8Onq^g@qdaKQyDTi0n~%P|F!462ubXjCN4Qp@#<S|C^n<(C*e2IuYX~M
zo{o!F2<N4spZ>nW)pHtCsg%}13|9%TG(1K$UKyyVKQ&Od<qbZ3N*=>NTg80DMdMpE
zo~jHdwhpmB#yCYm?aWmw=oj6!9v~K!1b>PemYiEOc>thqS<}`YF-y8}LjY>aIqY8}
znwFEB9uZddx|Nbzc3|ZGd-Y@vpjV&R^vfs%^y+_rUVRd`#70X>(|@mCVME*SYc;+X
zTfXTS=n&q5{|WN+`&9p2;Q{_3_@ucYc3kRmlNn|CVtb3Ku$^=-Z_#$j>3O`@_UXW>
zX3Z>e>Q)YVKhwu@X8|6&ss_Fg1jR*(6@L8+YxUZbQ;{LvvgVj>O#$8w8g{ZSxj+$N
z8bt##jH?a`H8iQiVzJYPEXA_mO>kg3CdsUo*oab{n60fRtMt68mj#XT3REkY58%=<
zs}%fiMPnAJKZ#4LwX<2&0;|JKjajm=me-;uziXXZ76-B#R~sxeOh|?XGIPR&)HK^S
z-|b+8c9mvK3?4R{92&&ro*weive65t(gs~=z`~>-q5W3MMIo%&LB`07g{tv%b&LcC
zzHWY0yx07*guDRq^L5p(>n>ed3eg&oKXDQ2%zHrwL=7{heH&?`9>qO+nGcyk&NWbo
zcKatT2ue-f*!m9A0JT%{8>P#0lh;otydARG3{3J<`~SHUmeZs=Pa}+ap+{vKdVozV
zQYc*a7JM4heE}DR3RUaCsd~!2h;~D_b2+Ox0`H6+aUKP4zkzRA=g1fVoO@FPk;PMd
zqt&H}V4SmNS93cRIt{R1P+@M<h)=zakEk4xyhxaH)|O!JAIlsN6P%(LH4)ksTW*rS
z6}+z%+~d1dHjBDnuqT>~;+vjN34yHWTW4ky#V3xkwaZCK8Xhf$Qy>4<ClYg~f9)Y&
zrP6C=K>e`TCV2g&fqAijel~^(HJqh%wot_EF>J=c7N5avq&<3mf+!??H><9oNw>9?
zAz}G8(y=6-hhzH>y9*OT!1`}EnLpdN#raBEqaWxMZXfY(=%<RuGZ|bWnT!nCv<r`~
zh6yQ_k82kup|+#8AIgf3lMKuiediS-N-^`R*Tj!)r1l&Dj&vX|R|z5aDVBc&XJ`<D
z%3`tNXYqAGnmFU>ptiiFem|WZ^&`vufe&wT(co8}nvVZx&l|~#aH#K3`)Ln<`-Zi+
zP)1nn<pai=0@wSL$vtciwaq+iH~5wcMk`E~i-{9VBqi!q6@zJ^_y-COp~52?GGE#T
zdfDDW?!0-zs%^8kJil=K;*5oy*EoDGG^vO0BN)v7*L$J{l5V3m!V+sPX4$*}8<fV@
zY_@~9<l2cFIQ$7LDK%f|DQRz=1VPb9m51n4IcD{o05=(y_hPlLzm~?*#tqJ=)uyXU
zVH@rd0<z7_TW4Mytuumn0KqJUC64j90e=YMWPHQF-*o;c9+%N;7+LlAa0ibq_;O^a
zRT{T@#3;=G{O(q_G8%hZ=KqbKyv9cb%~ODn6}T~?oyz}KNXfGCEyz*xFIPHF%8Yb#
z!|y1fD3>fkE&(31kqTtk_8mHmH5EY$G?4kYQsSJ_x?{e4SeF!xLy4#zS6v%iZ0bPx
zuD$)fkt6y?T|<EM``RsH;u*U7OK3v#@Op4~<~bxGuwe0Wm)7t0-Nq=mmp1L&#+fD8
zG40ZyGBIO<N;?|wqCfewXq+n*CC~#U$#5A(wKI3|YdeO4)aksij&h7$D@Uv79{xYz
zEfw$1ZBkZQdDE|*2B_+K#ZtRK*Rx5Aj&9$Z;+;I{O7-t}IU@s-5vtkDLx(asqu1A?
zW*Q$xJm{rqf;!bquGSI#B8L$I5ZMt{w&D$G9<LM6mA}ORGiie@amW)RlJf1S=XvDv
z2F6E0!0>CydU6f$$RBpuI+#j;%0M(i6jY1{{r1TW{5Z)S!G$*d1*@8{_%g|oi<=NB
zaD&|6(!D8uvuGUD-Gh&EE!@@l^>J}<<m`<I8<BPcKwBUdylnAA^?&&{I%!P868Lp<
zD-J}dyC#YA%xQ0cYDDSxTxPmWHi4b;am-W*fZ5d;yTYV>ZsqAsk-8vl)wy2ooxPyF
z_&$Uq=_tGjZ4othRmKYhzV6?7ovZBpecvQhGxXqmW7OM1o4L*0ik_xl@~#<A+ro)0
zGq3>T4L7MkG}YlFAJbr<xyoaZ99<rYm4<qE9_U2JphknB%}~)DWB&_tMk+!ZBws40
z{nl)%FyIqPIwc4*v~U2cv2V^+!H79h+PQkw_tmduAfJyokhO#-gp9CK7^YNM(GN4P
z0lGd!RsOrVg?<?oRQ^WxjhP%Qqz%h&!4UfI`UoIw0`j*xR#vHcbIB+%Hcc0ngKX(p
zq?96IxU|Bu@l*>DCyr3ApL1&5`ebldSA#6Kg6>gPQSQ@SJ3gTmY%tXu-E<+BsI>GA
zD!@HtTJRw1Uo*`2at3KGXS8A-hMY{-5;)X6w4_JEZDfbUqk1*=%~03AC}WkZO<Wi*
zE9Ns_<XJorbgJ}7f2fP@!6CgVJhTi67FVF7Kw^{0P8}hW%w$Oo8xqln#P^YkI@ZS0
zp9G&F0jns1d`!C7B#scDM2={mScoMMFB+gdx2JN39X7GiSI{Pi1pIbm%?MBd?YQNe
z6KclA4nTqU?K08V?>X+UAofF_Caf<ae4qyWXM1~F7tof^Et4|5<U{{Sv8xl_CAZbV
z+&!%|ZjnnRpcv`p%p;+N6ewBE%>B6^(WoB4IoQLAIld;>fL@>45Ltm%W|rqphZ1I`
z8iex53V0iIAs8gy)gRNpwQlM5;^=%Fi}Kz_`2FI+O7zycRxq~PlpfLg?@#nicl|P!
zEQ}HnbJEIWIvg?!(O;@g{+)_36pG~Iv*6jJNq^2?+}a~VW0{cM2%$vSOjwEBVm}kO
zWq-zmtAV34Fqs5MRz9eUTRKFk8jwW5;ZrpIlB@&*@4i!Lexx)zu2rgzaE(fX7S^N$
zw6Lth(xWhhTA}f^OlHRGUT(rAIF@dKT*KzB)Ab)MMe{B@@+zwWkJub@m8;Rv7(2=~
zSZBN#@(H4o$ugpL_I(hpbpD78SSZ!Fy2xtJU#jM-Ih`#B4;_8cp8B06`1iCbAAhrk
zGotL=zVUiJf7E@lENu7N&RRX$v<k0?8eB@2ft=e(iBH8C_%)!w4=Dr-Y1nOgSpMP+
zoPKlGE6aj~uNwPwDmsC0rWqSxafMsql(_e8G7XYG7S{W?P9?@=!cXJ@PfFl{OZxBm
zMgMz#u&Ref(DQ?-8<4<|;RiSU0;~G(`GX%~j_kJK)QZsTl%xLZ0wh7h%X;!r%1GqZ
zKhX>izWU5Fa{Y#S3X+n)TKebYb`X?xcpg32O)6LU)&to}v4}z<!p`75lT;s+)?vYq
z(1Wel<5^7!n-KMxUorz+$~*rUCRFTAo)qj+!*Xi7_2oJD<cX^!(PYRphw?{xV~&$H
z$1F!OfCGG}*yD0%lT`VNeQ+sKT1C5#WjXxk;^xjg5F3(J46rKEJUmv{oH1w3H70lt
zJ?Yd>Ind>1wuEXZ>G<h&`SR@{u=4EDu&_aUTvZda$3@l7EF&g1f{Q_WoQ}QFhEYuI
zzf-laa>}*E(V|k-mWx&bwBSiaO@f`5mKK$p+!mDt>_a0I7i!K2OmIUF<?w3qU!i6C
zikC~)<7mZ3JWt=YmBp#{qeEc+qGuMOWoR%WiAPD3<jB8cqVp0@ON~8|;aN3fopHHr
z?V3zI;hZ-CW+xgp?asczzq56}2`<20gfU}2t5qP&heZ90&1%>6m_Fil<GbQYllF&j
zOK;kKf=SX^;juCtvyEocmeC%D{*A2n%lH{|AT@#xBr?XZ-!15R-6nxP9+@pME2~_C
z--lEF@T`0<bAYh}x$phOvhzS%sUAtiurFB7$Djz604pQof7z7Q&+DSjuk}5@x17_i
zBmDPxDXH%zoHH#NCSikx-#3Q(C-F6db*YNPqPt|TM9&<1%lhxuet1PGwx0GDq6U-o
znX!PGW)Hy)y!5Y-^6zw+MCoo-M}pNg_m$q%pVZ!Ir{=^mE)Zd4R^Da&ffUea?&zV*
zB#*ce^7sso3}}n=y2+m0VrBe<rRu{2mBI4ZIQ7B|TE64Ojog|HET|G?NWV7Z8MFce
zeIDaGb(rJ-jT9mr>AJx*gL<T}3D6K7eb_kxj23)Yhh<>}mcYpcx`1$83hSY{ck`j*
zwusLrZ*@*<%VM)?Kr2$hxku+_Vu^USOmbsn>z{|sD^~+DKDM5`c<fdv-z2~xIc#lc
zJIXdkr1$490W+IZ5~9MtY4b{We!~2n8>_XzZH?U!Li2b)0+`+a+X=qgD|bWqqT`sJ
z2{lrg3#aRiHxrSm-SE1}Pq{hDmYykV8%bgc1cEEDYjqK~2c+<cQnj7rE^~-@$)3m^
zjsmiv(10NzJnvk7Fvk@gv_Z)rijLWh5I>28D7V&b+aOJj?i3BTy1Aj|9m}(e?qqI9
z|K=dzDr=V4hXBQE9!o&nR5XVBHX55-i>k{bvzIRU>Lh%UNjpikEOi;8q?y%1?p(oc
zU{9DVSd@xlW%@LZ>^R0QlA<q9{<UT@-|*DPK0u5TFOdzSL|Wqb0)2^X3OMyE5#Cp?
zjB`AabtjxPBCv4}M6jgs{?lrvlLp}`D^Or3GSiT&&N3bJl*R%38?s0QqWPzsA$DKz
zVN(^gM>5gh@9OUE7~*io&Ojjtch8f1KQr4;1tQ~s0l$a_Xai5cap41_2e<KlF3V$v
z{|rZ1euo~QjcGbP4~;yUT&-KrY(Hml(v2ju{(}KfQO|+2e#+x+yoLBsHp~&C6n+-u
z_6m2>{pRZ~H7mXKRX%?I9>RRVmWn1Q-w+AI9r}&c2_|;kUYdy?LyR)-b?FyRN?6XI
zJVE2#U5C?^r5Snj`!G_eHM}Ov;C#ea+I3CP)_mL6pwXvn`4p{AYyWO>quu#$Wu>r<
zNJJ}%Z*Y$}19L9xsYKqtL0!Zlm*qKymoPO+oWMu%xBMA4;!gj;z%$1po;FnTg)OdH
zfT4Lq@ysTh7f;AoC!ypaXh(x3<AQdyq>(RSStECpAPZ{P7&67KyrdCmM+azzX|?|I
z7(5DR|HH=u0`p-qtjGSgVr4udvD86jd?5$<SbR#M8R`IB<X<*n4!gU4<<)wf*I0sq
z((E?_MOnCr!>bcYYfsoNoeuxhve}B6drgqM4qzYpw>B&E%n%);tBf#3vHuwI-)WbW
zoZP{tqxuz8e$YuPpYNsL3A^UvnKNC)nBCVUIWmhGQPJeTBWszNQ7}n70@}Q+fBvBT
z>CH@D{QK|U_DZcv#n0)FMHGJ}H$>1f+#*tic|IFV-Pt8}<7yIJUIBo=`#ATdd|s*5
zrO6riw<&dPFT6@;ByYGi10G2df4jvtI<`;@ZW(+mV_JS_>xyP|9>e_@q}xs@P*$re
zFHP;ZnI><sqM}rRGMRxt*on*u3n;Z>pNp3f-?~wiklaRF;Zn5D<$o(>d2X<C82e);
z_$JMGF{}+Ijtu-w3B16z5Aw|kF6c%cm<83(U?PYhcniqXEeV3RUhp#_LkeI59jSp#
zAb1NWFnuFtIo=5e6e#NN25R_w{&O`^?^)*o$yR%Oc>1~hgsuNd?K$5%giQzTR4eK5
zK1#8h{9V0t5?M=QNDv)WD?G%OP>OtkQ$=(uS)6d5tz9e)kF8j;1>R<C)6O&qmDM&u
zq<gj)ETvKI{XE_4Jx+V+G!b~q*gm2E^)$d94egN3df75(>{&o6Wh5qy^Ym>Ecy*=+
z6bE+iR%kNtXTm&npn9n}eo0<udPV;k&zHXy*%i7#bV-)JAN|^P5F_DsnFE)BrF6eB
z9(yz81>S!;1$C<i`3-5mw6dN%%_ibJg&Ft84ebWvSPcg4eEoe{HNP+p+Bu<;{Zcf1
z<jDzwKSXn)Gj=Xe1h>GjEa`d<Ps$=_0!Fs@#_MCYsSSt2q0Z2*5o5YLf02YVJG6BY
zqm=bik)m8nj*!AXXURkib|wxIyOTLI%a!?H;5JH%w7bE21ib|bFt{bgp|?12ZoU4i
zTjd!9Y)5)M_Z9?n5urF`NifTMYvZ4O1T<z6yWjkb5WsCbKbaz){{}oQ0nGe=3&Dwk
z?8SeRG2i+p)c%QK_yo&W_!-Q&vd1`*h@o;!p|r^TGpA~ZP6M%5sj6|Cm8oGN!8mCB
zj62Bjvu)^BcBehDQxrsg6A67^%$Lc8<z;hmO*#T-w@$9afjlbx_oj)9Sty;+ieiiF
zM3}5Xo<%TRoXM_hE+}tFj^Ii_{=zt;a8pNjMhHhX(p~8H<wFq?nWqs5_uOuh&Rlt>
zlXZ<2W=caa?UI1!yid7JBC(}gxME{by0;wO&{L-yxMC2CM<j-YQ{O`wwUDFttC=q}
zYI2ZBER!<ok6<VrXcKNojkDW;@_{17lb3-nrr|AF2a!lVDCs03NK>~G)T5}+ZnI@q
zFM~Gj6<egiDqEdy4W!MxPijMCAdr=@;Eg@2B+AIE{zC>`ejA-IUOb3&;sCdmjOjrd
z81G-gro8nXr*9m=#=w*zeEZU(zCwWUr|+cDSwwV=a~UDxWm@G(?@w04psRLqIgg-@
z!y4z3Z_0KoHY+%IQv~c<GVEM*x?L#TV&yP|R2u(X%!>bA%<Nje4keAC)CbVT3`%|2
zkZ1qzVrI_rohRsUOsiJ)=c>>I)lI6^|8+oRnvoIeTH;kKKgIe7UzfMn!*1xFojq4B
zuRQo=thYT|@119@P)XOfDp*`_P&1sFv)+aRUmULb@^8_LW4nAZz$1MWgbfwK%33yt
zL|cbilLP=%skcnJ>DKlo8k=FnZQqDDv6+l}tuMrG;%rH09Xkcq>_{)0|L$`@cW&1A
zMVb)a-8{!8g8%bJ8}K>xKy4+p9(M^bF_2Y>twcwOqX{hvxmrgGmw*I)s3WA0wrWE8
zi@@MSL`1Ij(+)nq`SEAE#d?2+*qH{B1+bBrFx`(z=-@#ZZ|6m)6dBNQH@*{h1O+E9
z-tV$J7t;8B1h)DieVRg75k6nj47tpa@aLG?Q4~i!e}z1yP0B;D*qeq>{^?RZH~<Cn
z<Qw|U38<}qz~->IQ{p|93BY7~dWKv@VFr7;|C{1F3<$)ZELkOW_hU%ZPYf`G@`&-A
z%`j&EafzUZj(S<75Ge@%CyY0TBT-l_GER<S_j5k>UP-HV(Sfv^Gd0+&5WWAC2&oT;
zW6Fo=;7aY?xzL(vE1{>}b9?Zh-vv91NGn+mdin?HvlfkYPZ(dtnv{vy*;Kfj!6QxI
zCgO#;J4&EGc?HLH@*4?E51z)l_fuYKN$tdEE1?VK*O?<t(s{c?f8^gvj0GdxYmYa8
zz?Ya{y5ox9zQDc=mzAT?F-I(4rHfnZ^XI{(&)>L?mgkMgQ8AtLbiEUcx<!2VjgY+)
zl*m$?(_G*vpPOOkx8=l+(!O@?yV5WS=E;L@<vK4cq;s#SFulo)pjT&F3)W8-U;N7=
zeWXY;k_c=L&;7p=t(%CP{}SGY%t*w7dZ!7j!ahys?yoa>Xh^djp#w6}pD&~@+8ZB_
zDi={6hZ~~~f`9IA7ZeFS09YQ>@=B0p@;q5jEa@+WlpT`LG8x`Pe~%97m)@P$s)r~W
zL4SIJR?33z)`e}(tg7*F(eW7~ufv?BIWW?WL>}95jgk&5ZHmu!Yde>Vqw%!${UcDG
z+3D)jH^?oIBZIUo1@>vOmBb^!oyUA?Jj)(7Qq1E7Cl>kdlpw~PAPH2S3rYo2;ss+z
zj-LwDl4iWJfo<_ANx_2=Te(r1SLZgL;`8|Sqf_hk{Pwh7#kREHsV&2*QgJLKm+Sb}
zbG^iu{uCASPvS_SK@4aV4W`7ki6C+uLjuNTH*YLDrS=({YY*5<6O5P5_rLlNt$utj
zU);UD5}5l98Jt8k)u|;1qT91o*YkC!_S|lj27;mEsMtJ-vswTArb6VoW>{u&isy{$
zRq}6(mlRPgi3=W@>gLxVv3qGzZclL^&g9`PF0MSkK8}R=L3WtEB|`4`8Jo98oo-lK
zx%x<k0c{dq_J@(5wSdT8W9i;*Np=~(yqQ~<!nWiAkRiOud|K|UX;qLbgy+X=^!!N?
zA^zL0h*DS#^-50fClN72zDS6M*EzR(?6}nc$c`y+kJsq1#2B(~&S`&DnXzTha4VS>
zVzSikPBK>+F)v<v;8Hosj~Iok;R9;N&%Ts9`#g=K4Xr*|sb8A7B8PIGpCp<DCuw0&
zi71-H@kX}kzq2_S=fAUge!*YS(jh_e;EqkE_*mARF;NmUV^JrB@xe{h;%HqF?ppi0
zeum({VO;@geZTv9`dZ8=*F^L1d*Pb3Iw;kTqPOvmpbQl?O5xS<T*-XUIn7tp6ucE?
zNz5BP+q|PnNra<neGu{z@*m)ot%`x4nAzkN_ab=_1R+J<d-krTf8mdP8N_@&93_4v
z02BSWdDFhm$J0*kL~!r26c?^zzJNdup!FP1-E*M!7rLCUNH69WUxr9N={V`^VUVO%
zw^!0+r`N|!{>wEONsr&E*4IT|fFp`mAeJf8?zG|f9LT@k?^r41Z%Tdl+zQMWxVT!!
z0nHn!Gu73912zjUh;6&c%UeH?y)1Ocm&|RD1oICCuOPvRu3q>OhXEVTktc#zhEb!A
zI|pvJ-q||beOG`PiaPtf<w4@?4?GLh#NJ~|VLD%=JgCG!U9AFAiAC>#Tc+zv&w2AX
za__0TQct}HJS=pQ)UH-U(lG8p^W0}o0e>VTt?V<AFGj6rjG2S9w-I-}YFDf+&P-|x
zHW26dEHZSR1vD`)2<G_0c{}8j-yGgOQUI`$j>n0mP2NO44@I_LM>w-Qi2}m>LMsG6
z?(@ia`n}abc@m$rd-JA6=gKoWUQVc22cihr!CJy!hw9&6^NO=<0b#&7kvKu_fFvo-
zfs5=0CNs!f|3@MFSBep_5%<*?+_fdUSRqta5~BTt4>`(-rszQNOWhE_l3B^(Zy!(+
zTEx>i*86~7x6H^PqvF8V>*)GU&|deK<8>ZV<oh6C=j6H<u@rk)G~SRN^t->W(h$I^
zsfIB$H>H%+syzEN{tYwwbUC#;XQ(_m!qPY)#!fcl;}1uOEfDrW`B@UE205{clovYL
zlvfzKUr@XzYOxexW-R-;_oFfay@De6SQ%uWqT)EIDiM)|#s`zJxffYUeTEP-berQ8
zT{++jDS{C@(`P2u<!QC)+_x<56<X1Azs7mHh%C$ZaWB=BU{loDu1nrBkjm=}jx-wA
z-&?nwQXYO4u0a8p%=mrfr(1zVs+nQMzGD=O3#p2A)d)1bMdHt|DP=4KiWhR~*_)3x
zX&8~PbDJO?0xTc~DSUt3Mlf7#{D_op5cP09L~>;@@Bl*jlW2l(iep*tmezN6q=4#O
z2*V`e6G#_Xil*l;%K)w|KsP9sDP$Kly02Cirv3|)G~Lz_2NWby$i@)!07)FJ5Y_c<
zE1D$s<y>GeubcpZ`vK&=aii-evrPU>ed+V|r}MR>_fYDWq@T_Y%VULey-a>S9qLZn
zO2b<N?1TrC+VN~q{7~YHoTElKK~&Hr?^aQd5gMsRWa}I&NzN=;)=TV^7=pgyv#HLR
z(2}?g@UBKh5Le)CRo9qG>bFw#8y(9x5g2(=<pdY}>?#)r4RghR`-$R8v0qG_<XkE+
zzPN&LORP`Vy01m-BSB-bn2g`biuxf9)i8UZ4-7wiozX@>adr{PD#_Q=@M{VF`%p|^
z{r)KlXl{AonK0xHuKaWXxaznru~O|{yzVC~_P^*!r@!8NaVsbW*Z7r{&iY0A@g#ji
z{SByCo*~;eT^SQO4d8hxqNJO05DCfVtvG)f4)E+(sYyP#mP+l85OJfRpvEK15<7?{
zASnAMaGOH9Hi;1?{l_Cfs)O(@dr^5(*vj9auYh<2n4z^``!ZzN{}3;3GKGY^bE_#e
zI=1P(A`J=i1niA;w&T;EcAYlN@Is(K0mykompI}YC+{{=3p5ryd7~uc3=N>kaRaR_
zW+G`N40PmCHcdI})YBpU`_2?4nwOpe!Ef&j<l2L>5u(wN%n}T96jfpu!-Ioq<U4$~
zrhk=`I0nJd*WEiUA)_ukG0Hk}kIn2bB;8lHPlVoGR%n_|;CEoOgV&-sr&y008b0N?
zjMy&xo&bzWMOKnLoZ#m%K#3r>`V7hY-sQK1M)g9}{xLK>t2W4f*Pf(dj{BdJ(yvxa
zNXOkTk2i{BRKd<YaYD)@CTZL$CTyk0ixon59x#G*iYa5aJhrdy)y26`Xc&1E1^-9Y
zSB1sZM9V^u;O_43?rs5syE_DTcXvq80KwfQNN{&|cXtn-v*$nee&4-s^RORg*6!)9
zs#UAHtl;!|;QiV`wB91}W1je@wi<p_&;YMBZBoB5-7b;0RGlB}U4bQ(ZzIeYmO5_=
z4Jk#LBMY<{hr8EKY|CS8kGfP#RRzaXrUFFAm@B7_!fP<bRVlg29Lebiu{DCn2Up2r
z8v7*e-yY;50bX7gZ0yj0DF48q8+^*C{-iEW!}8B)M?E;|jf#a6SKN$Q3io?kaC~=r
zuHMLVqu-Vn(fmk<JX}K(ozq|=vSXwU>1PCcj~x}<F<lzqN5=WBvkuYJxh}syO@+3U
z&Y)zhNxZ(wd|>(|;LW@(*q#POo6JPW5@}%4IJv9pII}dGebo)>H?`H{%7>PJ%km;Z
z9kZ3#kmmBRyP&gvW2Z>d_5B#$!Rt7)F=XOG<IW_Xg5@4B5`x&k7SV4-3&KRR_HF<3
zEt;8F8qw~lF%i%Gc32dtnF<f^v3)>ZUREHj9t>l3Fr13(hoa`NOiAaWA8YGHX$1YW
z*iKyxxkC))wZy`t#;nJ^X8w%2vk@8@O+=Cl1W5^nkar2%@6hH~Urk8zh|H6`?!9BR
z-u>j>I3w`jI|h3{H#&pIYZW%V+_Nwe*?(Pr5$iU<y-XH{CEPuZGNDw0&leBU@{MFQ
zXZ;%$ER7H#R=h2&IT;DlHiOq=X@&5pn%x@B5D)dp?awl!<E-u~D2-9|s?h9Wf<$-f
zspO<5!XD4<q~z4z6A}&ldmNRNfqxGYovee6`r=_O856RLk}(op(`{}(Ads(yM62I?
z*-&7Eqtv;xDFcX)p4>#@(a3C4EV|1N<%=)ju1g`6M(9;sX@>~phV*>{+10T<WNV(6
z7uoa22nES6H9PlWRKe)6f8_i{&>v$7ppU;na@C0>n5Dq5m<DMDcWdlErsS&S(?;{s
z`=wkyOw*pO37<X-dn5FHpgMa&f=TF)k*A}h44~g^-|stJlAk+<GYtBHw_U+}(MpYW
z+)>=t(`bQ2u+NQzle2au!8waW8#=V=IXuQ4gVtJxXwDh;8O$aWE(qd6O&G0=u9h`p
zzw_M7r2myiK#+@UG7Blb&kJer1l|LSi2Zs6K_b-it&7d*a62BQ@~0rv>ItfkJ?cHA
zCLs*jvI`czkOChM%2%V0P|v&)o*d7>DQ-{u`;*7_9|)JlAM#Gu>hV!#qVz<#eyx68
z=W1d;{z5(eMj^;<ssSnSsK`juVK9sq&(rFW=)`2+DERZ1hp6T_4h@!RuS7kn`!Srf
z-W255#_;6wo)eg+G&PpLS&PEe9L@3*iqM9r*!~dC^Bh$|;uSAQkG`e2J-NOL)vPNv
zUp3aFnfN<7y}X{FJ(L(v^>lpVUH;3H^$5d;<Wjag9d)8Jm=;2-EP(MB*EYTu;-9_<
zvP-&9DZU1CR*7+zLSDiYAy@O11v~G*ff78v=&zMbj{=Vf0q`|S1SE$)1P?D+({dp|
zer$5<vX|k^B(cDJ((OBpm{;v@;Dcv3<z8A;iyc*?{0plOe2hO^yvdnMdI$xMLtGN8
zV<T{KR#<&ce6c(;|3&6Va`y0g+|nmbCtEG{OuhcpQBu%!wtpSKP+jkdKKtRz3wQB!
zsrS`H71LKaQXSG_Tutoc{&c3#@pSfCv>KMA@eP`sig{gMKXN|jiGY7n%(_s#79Odn
z?0V^p*$n+yMgTL%j>jjXZbgqNf#I-M8{5h6DIT`yJA6XK&;UfiN}s~~6<X|`UQA^^
zN0fG4Yw35vor3`4Nw`kr{Or1@*X);gq2~${w4BhlC_}+#4wn%8;#FxW)~EZVQ1{-s
z^UllSSDo?5TiFGx%fM|t4A|HL+5<8zwc001i3fNA4DOozNh}-V@5cEBNBM$V?FFK?
zI>cvNK~*P9*8IOq+)5uCVZy85=$;(e<ax)}=iwr5lbry095ro@8qMrUhC$#6Qu(R7
zyZ_3?)j|$J`@9|f>{jh>xmedXWa?8e;vgUw??;lk$)-X_vEtK6L{u6(KV8;y67$vP
zsQZI*gT`%_q`&^k>}W4Wtmi29P;8SlUn)YJ5k5_7BjNqqLe8ap%Rx!+p+x#eoi!kS
z4p9pCujIG9JrT#p(^SaR7B_M?PAR&cHF8DcWP%>z;a=7U5_Ba_WG#y-c_p)Z!}wik
z?GC2Pp+u}?qm)Wb)=H0<vh5Uuq3ztTCUF!Yj|=IwW6R7@?b2cYlE)x2c}0IY*C|m%
ztS?tYhq$kC+8n1W_twBtpcwx8pFNKK@<Ln%y?;nh6C~SGN1xTt_Prr4-U~a~$`FIC
zQk@COv5~w@iKG_kxvBD>(NAAq*CTv7_6Evw39&+*6e1<@9d6WP@vuqCu1KE!C#z2}
z{Em7=pZ&|du7%{6d(q@^DE&yyiaTqg`Tjtj*-{(P3g=s<8z9e%8JJ3vaWu*W3OUlD
zmlQ$@QVy!23*A^csdD_`-Q3b_+rMfYPg0#nbd9@(V_k>EZ%R6Uwa>pYE=fCoP-N$x
z*)ajXsYhDs`l#@@B`8l`88NBIIM<p9Zj|9$T`HE?fS0JMK@iin5vB?y^qm|V<qudi
z{IV~)Ay#JjRcuSEwT{fg`Osy#+Hzu>yB}izgvUA#`WIQvn(nyMbu2o^FMgq4yb=#1
zp)UlY`xw7ARnkw4sW0n}x&wlQ(3?#9BwjU1MC>X`8Atm|lxOFd_k+;8NQF~j;-wm0
zHQgDMuj3YegptKiA_UmwDWt3UGN|3`#H+h!%3rrk3vKqUazG4KMYS&sC2|f0a`s-B
zq~xLYOq0p`=@gEfOe5MUD2q={O*ocpiTPf})k0<V;D!(irYB8OCCBVR9@4_k32yYN
zRdPjCGoK5CyTHdlne_Qfmityl_ckr$v~|;)E>>l7zqJQ$^KK8C_l4(N6quSmX-oG_
zC4JgUNcxK7pKUvR-2hNj9DjhK3iVCRHi6OEn1Up1);Esu9NlkE+W!99E7x}eT-0vt
z&kV`t6JLcituk4k<;NP93@mO}Z19t&WaWiw`a2zdqwsThAYf5trzZ&PkR&fVU;Qn9
zS1+7r)!G{Pt>o7hTV+{;{km&kQf2w2qh@pXPK9V*UsTOA?Wwiq1e)kQ(By_+X_3^(
zv!xW5ZdchwIK`ZO&)3m|hv2eMr8hyi`ya>0MZ&+gle@nGsQ+G7(fwC3BSJhe2;qY(
ze66DIN#$)FcRG6OuFH6^g=BRW^x%jvai2wK%X`20kOXm<(;2s7yY23YJu)0xMH8Yv
zrF+%esHTcpUPUX|CqeR7K-|4FIXyD{<KWz|gK8?%_6vBd#?=<5GK^ohKI$k}p)ef3
z4kJ1>G0+(C$oQ6aI`LZ{{c#Xk^^KG5n{}Qrd_^&eSjhvYzdb?jWy{gW!O>uuZ=>a(
zj~C9gF}^$vrcv>RKKNafoMla+pSKNx{?$eTY3#Bbsyww(xR>j-)FxZ(9iAuW5JVIK
zie|-YgS4-0B-@SNq;o9_-073`)iDSW#(CEwer!e6Upw<v3oQdE{pSKiOO$&3E0K0v
zTv*9%=asOC%%v<iDjVC`EXJ1-X4!$^3hHzlHb!ofrqDzNA;BS{2<?MH<s-ara)=#t
znhj`}ydENPHTLW=e_G=*)l1edb0#e0hV)9aDI@e{Nq2vK`9l%V7L83?nB=FG96*7=
z+aG~i8L(RK+iMnYe`qnGcH%`~;tcaER2;1aHRJM}D<6gT75U%PU!QBzc>k5xw|B>u
z8vmy^;f=+ATnEj(c7!$ULlo+FnV1BrD9k*S37$;xaH6!V$QUa4Myw|s1J7lT9E*_8
z9Hf(Tp6mm$pP|AB1r|~sN@DAoj;$mD%OVaCJ%s)k>OG#rRR~S|Owhsq79uSiIq}9i
zKi{60bk`{BU-pBXrXXZK$ulv1o@Elh_)iG4&-Q?{0|z8$f_UARV(9pY`N2<IBS!t?
z8aY$w(60z4eHcOLx(LgHq11nRt&QMH*su8rN`gb@p?yBZXz~>swG$KVG);%{un&i}
zDu%wgBKSCF@<_ZvA=y$dql5n`y&LW<pWT77N5%F@whI~}M29nqx?85bsf+W=s$*5)
zO}Gd?T4p$^E1N9860I;|;~j2X+Uyp!!MfL45<NpRuJoVQ(d%AC(isck0Tg_zI6%Sw
zoe{EVCt&5*1A>2xnqXTQziP4I>o%z?D}GO8)mi|J_WRIAQw6OGUSsu3%Ob>v==ISV
zetE+5i2a~}6$0Plm($C;H6go;ea2hYI5lDxm(|s?0pQ{}MO{N7=yE|XK^_rN!os9f
z7BQ1Zjs36M%IE|Yuz1FBL<zjsdh1z!0uFgGhBfv&$Cr=#@V^>PVx3NtBpxzf#ksNc
z`LBd*YZyD?$4ZFXZ#cckCK*A_$ABM}e9hq0yRL9)wWM5sc;^0)FGk=>i<A+sXgX!1
z6Xl5QV9%3(+8F6mru+o<gS6m1rMnK}ui%qaNr-<8vyBCVg|bGJYP;cxnB|NMF;1<&
zBTka;zLoUUTlRA;Zz>_o5T47Dg9LcQAC*FOkGxxK+G85Nve2!+l7Bgi7;;r3_`8SD
zzWH~wYX8{3eBAhfk&Ahqrd4kN9|b33Zm1;bd9hTHx!e3BB|LDn`3i39OH)2=3T`%L
zXW9nW@i#X)X@tt@G^GB=RAI^1pL2G?d0d4zD+q3DiN@}H8_b;sX4!mJCJ7R_qtu(H
z8uANG1f1}O*Cx^8ND`w+f*YFr1K`P%zYcY*m<Xgr9#?&-f1%=5XT98YohZC#z0rQB
z8rf0h`z@=))|bMrk>iCwF-g_pY#E~W2iS!j4}ejup%gg>UbV$=dSDc*rG95rcO(TQ
z6CRFM*x8*8ro%(&xD2)fegsqCIwB8R(@VTTJy=tr%valJKkFda*859Z>THkMB(`yh
z1b9ejJ%>z2k2@^yR;u!ZbmOrO1CQ4gXWWf{*AfCOVQ|pk)--0(LX$m=$i7_;mkyZ=
zVn>?STMX8(#+UTAnZMQIbUY8@yC+&j*fK-fuCnb)WwNfAs?3r_c+KFv3Pv4-v&jx=
z1-uJwuiy=^phsWEzWe+Q)DCx$J8P6*`8|DU=$;wiDnuPx2uJ1~NXn^Fg_%*#QP^PK
z8{A5Uaq6K(e=%`xFg`+}Ram^0swl?%HL4T!A}ld^2ED40lVx%tvh0)_#y+qQm*PH-
zk+dvYoMe{<O#M4mhmccG*`p~=iO97gYegtm6HA3i!I7RkgU%=;Me)(N(|+h&>l>Ux
zKPA^{`d9msxzE@#8%<6@YSLrt_B~wXZLq<s8ziEPSW-}sjkSRfsPnV%HYtsyrA}Tr
z!PYRR8ff#kcVjlNr_HO~3y4)%vaN?!Zb0+)cLtETq4Il`-Kr7oH=Qr;6;$>WI(xFf
z{f<Ls+2d`he=A)1REBYRhk?WEPix$wnst%CAE%F>ff4RJuApUeB9kem-c(5oM?q=r
zhMuEQ6V++cD5XxF$#p95S?5yvG>G0!#>imW?bGZ7k?Bmooksmuljsib=-@=w0E7V+
zqpTjIAH_}NZ^tvto^%1v2nu9$yKQ;u_Gnj9(8+u$8wjgkm))s&zLgjAkqh#`5SI5l
zKcl<-L+0H5l_*i38{x6NE{yxY!1g$Q5frBAA^aQ~kC&llj<+-1S@yGPkgjHl-TnvO
zg3Rt@A+7cJB`15AMzZvLq}jrmg;xex$t;+9e?`#K16y_!oIl*hW|^Y|GAjyAgR=N?
zk$3-(8x_GzZa40GCNG81VN@a&(&U-Y$*0E~wY`;Yt=#HB1Rp4$qD`u&Zw?`EAZ7e|
z4z%DE<(Tu;7sGP~4~(D6c1m<d6hRCApoDp&av?4TOSbk<&lRXW6HxmP6{b~gz29g|
zFWCapE?;|}-U)m*KWQX7tG*6CTM0XSE2+qTvBecyJ$q=*0WL&%Mx^G<a!ty*$CFNQ
zoy-hTS_o#XNBpX4g~-6%ETSJaLiG+!Q7`)puLW%h4_;~Ave{yGKyJL4Iz^=ikqq&B
z7QG7MMg@DgH(MI^ji#78#L#8W6Yp+;FQeuWzRB$U>-N$I^o<SR+U%|Yxi-5}4GJnM
z5&ePPds{Qauo<l@6>x3F7#g-=SK@~=CYw#Lo&yR$4j0Hji{oy@VoQnhm_3odLY?j|
zgcdVRo$k@y<gchNMA0OG?!Ct0p4dD)$Eo5sfDm`_0KKMYYRC#53jwwV23#r!*6Z^W
z72U+fbZCRap`Fk=BkMGlJwaxTyDiI1Fu(K5@0@2x($_@pbxvdO;O$~B`Ea$vNl%Bg
z93SJ{7&>!1H3ZRl4A33A8A0xaW`>Rob!~im0Q&8uhU?l>HiO&?sk;6J`l=hX7J0cg
z@tgqg>&XCm6ME5{$cT%TL^jroQsK6#OOuX_rS#^t(3-<Y-lUxq8?Z;ov6emFf+6tj
zTy&DQ#)ed_H%2vnzn3QAyfM$a`#uo|zmN27F$+O2zly>f<t_17;;t|VA|R~$HaNPx
zi?AU{ZDFO}=c9fb-jCty<$+8gZn!i6GGn>#U|P88pGp^&^KWa7@SR&=*}Pgr*|dS-
zzhN_D@H6tHBFzFi8*wV2$6_{{I8sHCba0d=J8V|emfhMjBBs4Wpin){1wqXYvXd$h
z;qqwXW+ktg`4L6ucR;zMHF&NSr%HRtiRhy)98G|Y7+jSSiQJB==Nvklc25s;%aK>a
zH&QqRSweT~METou)S}J5#RaP3jT5-Ax|ppx_F|CzihN-ptI`@Jtlq|-Q-Dy~!VwXq
zTc#tl`;<#$hmwm0xB>%p0G$WS`edPDbQNqKa0QBRg1OOyTR%UWV+Ot;x_@&kC<zO$
z<`vWjCT_DWhVMLS1qHe8f9D6vB8hS@dkqqaV)v)zDYd}dQ014j+gW*MHJ{HtDEiGJ
za9ljZHxp+tEqKniWEv%`vz@*$-uF;q6Z!oh2JV?GY2R(RM|p*b?zpQviXjnOzFQd{
zjFCdAgXzVG8e!7s&mK0PLj3*-&pm|DTAAzU=oDf<Udw``aISP*KDFdEFcebtE$rNh
z7pgQ^BrxMmEGxp6t=HxA>a5iGf-IqzZF%E@rEyG)qD85x_?PVU<KR7U8?tgu?Dj$G
zbM0MDd{xV!>~!`Vw0<coNIq_LK1*q~0w%ge&VCVkQaKX*(j_S_gZ_4b!-tn9iS=*#
zra7L=e~cAP$hNcy?s|4e`&os#oW^awY{bK-E)Qkq+7ICu+Jg)Otsuj|sfPD6;Cq^9
z1PlWkz=<t;ssZvn5oFV)J-db2h22*1+5+x%=q6BRFs&^=Ywbm5Z_^M|s|Mu0-Ck2t
z`$Kkh(5bG4qi&6dis5?k$y-LyT92p@$4%sbKqf@RcVx+AQ(V}UumV1&T^Fz^T2Y5b
zLzn|LvE(B%UMnaU+uaS5fM6cn7@YHfdtq`qTs1Y${xZcxIC`{2XDI<BA0-T{5IW^S
zA}5$zm=dlasZi(`<AkDfsDjqtDCYzJj!WKHu~hr8T65O{bDOxB;O>OsRBMR1u?sE+
zG0wi*D&4fa#w6RZyxnphOzl@sB+6vCA-_XZpFf+8)61rJxOJj@(>Xz(_8)kA7AY1_
z!ddWopBB$w6yP2)sWVApsqradLB(PLalKwG?}4&<u25E>SU8Br>$1IC{{CedES>I_
zs@#KGG&>pWgP5xpIHo$;?~iPQ%MSR1PgS^kSL3g{EVf<W2Gdmrj0UjhL>@TVW9ya@
z{6cJoa3Fqh$KGJZ)|vQX--ivSdwp~vwV{jcV$QUItx6{6dhm!~xe&Y!?{^Xj(ktUB
zSn_P(@44<mWH)eKHFI~L)ORMH?YaVUk$ffeOh$HD)o<lr&Fy&f0i*OBu0nHM)+I0%
z$-V7bvr0H0JBKOPvYBO{(uAv!1|+nqC@isNReLLZX8N?bL+b`MB*-*9G4MIPEZxTT
zlPVo<^_%Ng1dVm7MA<G?c7wFp_xoacJh-zV&z<0%@F#Q&7moG1J|MRMB^^ragJ7q!
zJfv|uVkS~YLMe-1fb4kuZyhK2Z^S}++g0=%TkGeoSt}M96uc`+-6aY1EL)Qdh|@Gb
zVr-dI@Lw?sjRDu)@(w6KaBkfB0O28&qXULjMWOGHlP`l2qTrse-OYOHcu=jg9P3k#
zUCo2<d{8#;017m;3|X%Mp};QCq4+La^8uj1*8u<p=Ir?Ej=YafF{e0oIW&)z;v+F&
z_)a)&11AX&i+J`%5l^j+<972<(5iYT`%;PGeCA!VUH{UAF4pNwsgM^m+~dnehImgU
zYAq%MiZ!|;>27?PoQXWj^vqrs--p5YIlP}E;i;Iux^B~_7xTt}?k)$gf1}o6dA{Md
z9h{>}j9R@O+@jB|_=Ucp^>YjQvyEzc^On?eB{Ku-=NaK(O?Fh%-~X8^+2O!Wd}G@n
zuiXaeFJR*i@&Sf98N+-8A^w(!_;_Hs>uYIchbVdo_^*BER9VGldUh>R&0!b6_I@|`
z3S%HUu@rk^kT8SBW#3E`@&wgCiKs^Z<6YtXOYNHy>`Cc&h&?tJ&nYny>@m_kw+T$c
zr%CDaBwhG?J0(7AiVFYeRmS;Ehvr1!n%<4$-)paS_eZW9MXLSB3s|ROUYzYA^l!^I
zB8XKYh-sT`@8DmT*)vQ$@;o=$t;QJ8WS+DHaDoKLrN1+NR~CpWg{(W!yR1Lfs0H_d
zKJVbHU82|O{L2OY=#3BQ1JnWR98`x|P45(-4n{y7ARZBx*JNvfI%vb5S2bmp;&;$v
zSWld60PpFZ35W+Py03OP)~CE@I^YA---w1i!tR}B+`FF`x{#qYZ5f|)W6?6m<Zpfd
zc<gIe(J^FfZObw_)f4K`AF7vf`2R>2pJd;!HP{1mn&i2Yb=b=jv4sYeE!4BV*aCd{
zU(%22c<r?PkM!D+N^L~GNL%Q{e7iskJJpDhV|@kx^7pi~$qX)KHFJ4@#TwDhmm{xb
zd|~;UC8_0fte1uszE^r}tFLiNIrYP;zjDiKL<jimsybTzPN`*Qs}H2U{pNZXONViF
zjvfpZRPyL2BB8s2_$6qh{b05!dW?Lo8ek8xkAMiPZt)uLy=a?fa~OX&2Zby-$ez$s
zB41%i&mcKg8uqb_n5-O`e&vtEb0W?NPU%Jr#gCEM#*h}20N+p99LP%DCMnj>YHW%;
zMKv#mWt#m}AGowyGor+ktKib}4mE%qcZa*}{5~NkNtkk$q9U{WIKC@=#H$_!KFoz%
zINj?!YPJ8rnH&699#f<t_7~_Gqb?(d=`BdSa|aYe&^gSZ1)RgvMkkyFqpP_+z&VV^
zVdY3aV+86|T3rwLB((;0i=i$OK!PB{Cw3suAMVp<Xh?s26dJqO1GZa&$AZmWJNyU4
z+eKFZ_g|&#1a^Gnh7+)epCCf7BO$cV?Wu1347-H1zr%X|t=v%&BKR<e7KlCYX+%bY
z*&~SA%$JPKA^MK?OLOAaZL2k@X^)%Viti+id46TW;g5E_7x);qV9=Slej$jnod8l3
zc?FG8U(k23scGY{Vy8vq`2mknUeF77sY$)2o{OA9zrs;!xhyvW{P27%@n}b7*~7|c
zi#ycM*&%+CaGaMgD2aJ=y?Npd=}yBP;Dj})#{L~2#`-@Ei!br-n-%V<bB27t(1eUU
zW^gXER@m%pT3mXv^&@Si1a79fOwPsxP2-=2q|cqX5R?2VR1eWZ!)~x{1s{>mqd$8z
zgvlpc#b~*hhk-?D%1is)Vt%>%h!XhYo~dl|wf5+r&8N<~p+k0)&$-MpJ7dab1FyB<
zSibx8*^>mpX539m^AU^~u14^Z9iKDOE?cow-WNF>SssSEdl(}^BB1cY`@VMf^da{4
z0F?my48p9yr8J>HC3tWE$888Sl078>fLYbxKd0HNpAN#nLutE6wE&eM2W}XjQIYaA
z!!f3eMOlxF28%O{j1zL&9hnvjVpr*dODnTznV#ch(=y8R>3uJ_uneogfe6Q~PQs1;
z#8isyi4!U}rHN)>hpCS7zz~JyvY!@53&AP{wIB8GfP$UH?ah>1buKK=)E(kuIqW<7
zqIltWB__qfIF;nH8(HxtOm$aNKcRVW)fZM+J6Nq#s9+J*K|hY$;ed&#Gk*AeQwMpH
z)6qRLiCW`vyhPx_w=!X9Z+qT*0lH;y05^IAxX~N5UXQhb^_pvW(pWpXDl!GE*L#j>
z7y3L)(0ZMA84%Rm*tX0Qu|X0BaC%S<fYS}&gcAV2GJ-!GaTRg4etOWyC;|RrqBWlP
zn$-6puNZ#)*ZGLCz)6FDEkwBuB3nzuaZlJREbz=fqD!$6$`{4P;r-)IT}cY2oKMlg
zBA9w_F-5|e&`D!*N(G1F$M@HuDK!4Zg;9_?j?iGSLcw7r2u-Y8z@PlHg}TJ?xGGij
z7ip_HF0WrN>@to2+OB)9r~|__31A~`^X=qFgzzdfQbp&zHa(?F)ur1IwI+G@ze^35
z+blnyJP!T9IpAPRp5VQ<`yC*Ko0OP;ekd%zeCav95}5vuhD}4{P&7c}@6a?&^7DZ6
z@Pm*PMUpB!E|YC#PYjO03>-DC&92dU-b|Ue_E_oiF7(i4-pHVHvw4)pA6-xpC+*Me
zdM@j@>P(h74bJC;p?<0K&kVDWo~+;on;F<cd%;!XH&ir-H_)^e0JqCc2e@5=Nvgqd
zc_rdN>{y?Yyf|y~4-<gfY2>A=+m)V%bHEqrx)lBaR@*GF+D23gy-X4<B%Lw@FR#E)
zyHgXGx?cKS>I&SwXLle2*7WWu9R8G4<h~^1R<E4p*a|N(6x^#fjA0Csiq_36DmdY5
z2L)QLvQ)mo!kS!*ZJ>TWgu2<0KwCb|H^5)<?9m<lKqx;%g-00er}s&<t{(LdI4<vI
zGVhx@?#UOtlpax-Np8jSu{p?eipB~DH_vCQ;i-(Y6@4{>v8+4&vnzTep~#2p28%-C
zhJVw_sVkFG%&zEWkmaj_($DAImBi5*TWg}0^t-Ik*W>TqH$HS0cZ?b`PtfP|gln?0
z)0Wp~j;9Ki!sO4Jt8<=7r_h|5L<mI-oBh#WK3JQ6=qlhU!ntEpXXXN+v+zIA$p!+Q
zqgvi80O(8xflgdR^L5!#0Cal!;hdz|Ih;zN!BdvbG$|l{*@d%{OYB!@nT;cR6;%YT
z7^e0oefm<_NvaLU2BV2m5&B6D5soIVIO;?xP!QH*Hez^Y$Ei->^MyHu(=-=F9o^OU
z*>b6s?~Xj9wLMuBbtOJ?Jgh~DJ*`Z|5vQ5vjwTK$ue0{l3Jg`xTUoSJCsCCN_tVn0
zyiLIs1x7Gwo0mN)3&;hijWDN#NOUYw2<PAjjOVoy%EGwb-eo6dq09OCZ1&`HwBSfs
zq|)2gNTSnUKUMHTew6R9)0hA?vQj9+uB1d?j36~p<%*`eI}@1_$~m=2KP}@qR5zD?
z%$m)pw~wrL-e99(dLBw_xu9~|-TT$Rhus$Dmef*Nv)3xK4k*G3yV3Ak_)+v-CaT)_
zXux()>J;8@M;_(V^Hv{RF_?CRU>&{}J)q^#*Qvg0f$$34wxb=r#|J&69<qnF)_9Er
zcJDknlY&nGFEf@gR>MAc<nV^(A}ie2m|dNE%5QP3=YVqdz*yu`LjbddvUmgQ1MOOG
zIc16DNl)qyS0fLx$5B@Vm47Qh`XQnH1}p7cn^>Fm=PSo+8SbO6^$f22dy4#<fl*J1
zJ=bR}@5otY@-fG$zlVik;ruf}g`OPiLB!}CN_=23`d8a@HY$)It3Lt|tk<097iqP;
zJh*~Z`S2y|KtQSy1f=Hwm%Wt&>@8#!cuaO4#NIfqD~x^`a^GsuEMz1#1B7H4xJR!|
zZbWw}vDvyEGWuD1Ibhvee!xo1!-T%gbIr3Vv$=E5P0_Cn!Qc$BbuD2DuJK)$?Kc>r
zxh_?Zv6j+LwnZ6XNNQIAiJCOe3!7?u4XRR=TmKqYlm@GhCE2$@+=_HFLw*SPE8mwM
zP<mNY=TtFt=iUM9R5i@z49Wo(`0vCueH3CcJCb3RQ~CHyvoWwKzw5v=x9(?yM5nx&
z%`x~?NjTEMzO@s~V+-}%)>-wC86xkg{B3XLn~q{43@HCTCwvJ^E6D>rayV^onhy8m
zLg@(7A0xuyGWNXR&#}&BS~E$0Y#^eIfDU~M&{6lDp~D1_XUG6~hV%#U80B}6JhQrD
zxB^_LUTd0nY#mPsl4s&UaC;zLFocl4C*Gs~g=Oy;TJ`9=pCoa1<dL%OMc@{f`}qOm
zuIq*>F--`ePsrw@>5!OR4HiF~rJXtBF^2w23d8g_l$Jfg8&R3O8G_}u3w3<d=Me5r
zD#iXk=17fLKad6`3qKKmhMoF7J!~1@mwlkWUaEJkjg5W-<#e2ck_Izc5vb!wlUB-t
zOnw|42fMr(rGbk7EFV6TSe0F_A<Ts0j(Rt^T%>39Hyh$s94C}Yk0lrgi%fYj^;}H7
zt2F3QX>NwiURWcUq5}k4feJvNy{Vj)BTZ@C(FO$CY;(^=joV6)K<lM(Lg}&LsR8`{
z$p(OK>}UhOpZP%Budkt#atf`woAcjShfLdtyHpn-KSMEvRJTL4tI3SM>~FYJN2=4w
zU-hsNoN0#fD0>Miu_C0NfX~YuBlP8~!n3pv)X9owt=BatY98zYDN(^)lztnMV3*m?
z%cw?5@cKY@)cs*2+PUJCO0(u%gB<@9Jhls)s_4^?1FJGK<vKOd6WAl~W3`F|Pq+t>
zda_$5wYrz?e(8j5W`dRTm3JwLy0Af%^NeM-`!Ez*&kfE()`y|QK}PDh_u#KG0qBKw
zU81vEfUqTF3KF(}<yi~}TX=x5RXCG4SVa*B2wTx#OlPo4?Z@ksA~`MN0ZS0e5NN7{
zZ79e%enD@;ykVFoqR$Z4FF33q%gxgWlH9|*r~SSOb)UrHR|$R5OE@m%3O+&;v1q3~
zj+)<!W=$}G1bT3B>?>Tvap^&nNiN-Twu%wG)nrsjUh?(BHuXuA=CoKK-H#)%i522j
z=K8-$iUagOI|t9H{fCwe>qvWMJztI5piclFA_*Bx48ToL1#@yUy-z8iHzFzX=~$FL
z|Ee678;8>4YBp!Ka*YlhRS|aDJ-}RpgJfS1G7~0wqV*NEm{WTOY|Bh8U)T>au2Vfl
zb;)HiX{R;hd2m~}aSThYbMx4c=uqC2y_WmqC`$^q!#r74w2U_z*wJYvrNoGkm+!9g
zSqBV<A*eqf2sx8;@9%R3OTo$D;h}fVIb!Go!}*1yLyaYG_ls7Vi&x*!tu1Lb7;hxb
zw^a9gwrvWxUfEAU+|d;!$rIkKSBd>s5Lbny!)dobB_rR&*@@?6*}BdM-H`d<85SWl
zm8N254Yhozaj{}|PtskJa8D<~Ho?SpLVvG|0t$Xg#_+*g7144(W&>pWq0=yR*12)?
z5hKSDOJ48VDn^2@)*4QE_KRuh3lIt{3QU95!j=mylc+NTD_^YxSoz8ivu%tijd`cQ
z$}hJsebG>P09Jm*RY6UAMGd|gbMm(d(pP|CCJKsYN63-B<^`Rnh`Qs35$Ut!Ztjd1
zC`yUkBN$E1jysN&(3{oHYwY8Alfb<)N&B(nm<hnA9^hV+Gz!w-z6v(^Pc4TOnsgvP
zu1fn{R0gtv=fMEMP)(%&1w&<Z{uc}d9q|Bm&W!&lrO!>hy(*eJa0Bd72i(1^>q>wt
zg?za7L9ZzrV<EiO+lN*o4KpQ0q6Am}4LXlcaeNMaP<@`d`+Pd;Q&j^nNF6dq>psa4
z<7iM6pbgA7`NyXn_fBqKv;04-?sc_Dt7UNKGkb!da;E2-k*u$+DRG*1hTGp&!l$mE
z(%Cd#Oj`L+_=kAA_kF>L4?9$jFFVjq-XJ~x1f<88q;2W~Av_8RfFAD}GS`e&k_KS5
zo|Brbz9qyW?9qlp8b6@5kep3ARZv9pKAd|mtJGSH7H5)@TcK<G`2pVeIMoTRtHW;Z
zzM%c#7a$L=nJ;@eIR1V=Zx5YxnC6x$=3i{pajhsm<ZY9|YZ_aaUbs*dR#t#p6T_>L
z>_UO=shy_9Lw^+6K=r}#vV9S;MAp&}_}T1zgZDb0vlbZcH+X<2YTk5JYB_<`YH`UU
ztbbkmQ|h~t0f;BV2x!Yl&I@QqS_sX5W-CY9rP#s5p7^AWxW^e)kp?H(8<^BVCQNMF
zJ4lrMwKR-jP$08)nOd)3Gjn$(w$;>BKl8=ZaXWRdyCC>$&kU90_6)R>5vVvppyGT^
zHDCe&EfN4|w?#rAn$bT0*Q|grY+)?J|3{BuH1WIzEUY&m>|;pod8=+GU@Q1vlzs+Z
z5{ki}E${Z{z4nK!>cCT7^J_x~M?L<xw7lE!4?Bo=UCfKJ$#F9G;0CW4-{I2DuLBl;
zvBK7woKrJpDFhEcDuM+kCY3^bWXBoJ&=uGBBI098{7yfYA@0h(vqn0Mp>8?#wEpu%
zkG%2>i3CYvB%OdH7V#v@46D8feFI2hC^@3Ox=~MnB!)@aNvWIAirOjmypVNWHO(dd
z1Y||jCtv@<>HRwalj9uZcWE?v5-Iz5+a$X6WwTsiN&I1eEw_f7r;Pe|Y~Hu;b#dr*
zf3D??bOpj4J8oxkYTE>L8P&~im&a9J5B`${qQ~UVGt)6?rP~7WXGkjWn|*A)+wWn5
zx^HKrekN)iE-~0dE(FhiE9f}}KP1+xQM%SmKPcVQ^(y;zu?HH;D;tEKWl_+^lFt6%
zQZ7RJe00&=#e}7jS<zKV|IJ-m@BT_%zuO^zex~)T0zC!h()E9#=k&t^qRJdkFOxe~
zmh*g|#Q!p7HN|G7QZU9s@Afd0jSUV*;MnLMV2p^NhSH5s`r18^gxEU(V#wGa*r3PI
zfdIgU77#;@fo8I&)B`bOSnM==kJCXM_yH}KK@dYWl^?sS?TBS1YC<%vjA!jtQJxfX
zj`@t=;?fwzuZrKoJ%OVNhs$tj;$14F7tZ>KWSX<aXc249(dGO%Gm5`!zv5tAG?S-Z
zkPAL<!oXEq>zdn((UUonvbq;=rvyk4{j8^UM3gQ@@ycpVh2S>ubHw@ETB?!RKETkK
zc9x%!7iQe@)=K&jy3$^TW;w&KlF{9%L@(s5ivtZY8inf0jjbvtS7QKANk1d@<wk-D
zGfZ)y6#LA)nC2G&^l!HP<Y=jK7SS=~g8htsjT^t*8oZ@t!l|3|+=dE^@*{bQ-0^tU
zYIvK|R;5aL=O&_v3&h&NO2vPzT6+M@p2Uj*V73iI7XeVIMW9l~ap9cy<Tkzl%to{E
zJ!vYjsI1e9eXxiFTo<*22wv`~^@H)oaVb#$c<=md{YaZ&AW4z<_ID!cZ1l?0cgPf%
zhK!u-O#TtLH|6kldP3s74nBMr`Th>|5Q#N<DEp~ALrWwYE14r?{JV`*I0~LnqJx^4
zL02+so7xJrdm6a(yD7H|LZr{?%GW1TZmeaM!ttG|fOG5S&I7|Uak=Mpd{Kmi)a@Kd
z-6RY)MviUU0n^`OwXEa`Z%bJ%oed&FkAo5yP%82owyANr7N-fUee2E~tF+6sZa~k0
zA77#Xgt_BDe2hcKd!e$P%ZdZQ+){{m8?qcafOtt+K33sj=_Xznwp+<d1~j3dzXMj2
zHjMA?h-6ie-#_f)1rdU&j>(;14#_?-g|ZKr-Zp(@Y4d{T*Z(^&J+?i)Y3%XpWR=&X
z86!lvTTt5aS)Cx4F~<p>e>utaEY-;{%vra6+(acIu!?g$iSkQ~Xr^;cYidsYDSfU}
z@E&IXLF*0GGP032uk*4?IU;j~$MmYr!p#Vln$q1*Y5joX!;vlW<!@#Jq1)Sk5Ea@n
z1jCxukdVJ~<*7<Y7mQ=)_FQ0DUp4E}^}7}1Djet5UKhuPZ-{MJGzj_5^u|MBb@X2U
z$knFc;u8CZ*{E7CV*ZQvlhWNYIWlYhtXo^yGC{9O%(!plT9u`VlF4a;Xq0X|S{oF9
z^d*&&iAM-c9k3(i_JejLG`SicU`L_^I@e11z++Kppw6{qRFMalTVHrseg!X=9#B4f
zpnT03_>Tx&m5}(^6MkF+M%_*aLa3K>b?c)6>91IsXio7?L0j%3>B)TIW4!wC3nimq
z{hP)Puiz$tRgQ>KtcQ3cd07o(c;;j}OzjT>DiPKlk6@Ttlu;?oH@$g<DkU(N+afW3
znV(D2y+`rPm3Ok}0zbWseret|YRn4^FfiwoBBmyGp-vU25|5salV%eO_?Cq->F2z_
zlaik14?2E^$tuSW?M@ZW;&-`3SHzJWZC*fhy<PZQyB+!1JD_UKIccj4dD=J0FH4X~
zz2#_rS7TePl<$iaK;v-~KZoLVNj=b?8R-S%Lu4Sp(@*%C^cMO_Lh89U`dPI7XDh|l
z{Eq{3Y!0KB-_o6v-Tn)|4D@qVt7xORK7CQ{pfKC3wcO?G#lNl3J)==ptqFf3uR@-x
zuBMG(*vG#;7iiIRrA~JH{(hK}>3bpDTokAI_sgQ#dK2=x{Ag!Xlx~eG`a5JL_X3CD
z1o6ext1`rlqh(8ybqU?e2VGY;JvWVA3;O_4BTc4DS;jZNWIM!avksSQ90pHT>Wqw&
z4sti4?~FNj+Sd+wZrY!`XELXS(gW`ImBV};6m+aY2^D@^poSn{cbzNcC@*QgpbN=%
z-tmLu6+xEAIVguLTiKJw7)Ln9aNGy$l+K0zQ&f!66ksx{1;Wnbe$Qtzs>iiGWBejZ
zmp$kj7%v-CEakj*;MtP#N8G;N19B^1O6SYOr2q?0zuZ(PD4Tb0{y0o3;7GLRRVnh2
zKcu`E2Ht@()a));;TtI%UJ&mqI&2tzCq|QMGy?<4Bc(dA$}t9?HKcjSXsHgQq^uyH
z2aLO_#Yr<!Pz{N>y;0`m(VSGiwOBVc4nc^3isrvSw{r{n1`Q>+yTHV9P1fdm)n4?8
zz8b|6PPd!atx$4Mo7S;~BDbyx89r6W8ZTPUOr+wFKzmwRY!&NH;FG`JdR^)-Y+5$7
z_rZfnu)ZTa)S_NmVZ0N`gcdf`*J1LOcM<vaTGyORh+IZtuv5(1yiF>kKyQ2jFc6{p
zECQg9E3i@yRwZrVi57uz@I+p))lrCC5T!#7G!QL5b;nSn>CYgB0uFQ+4B!gJkJ*CU
zPF}e3CmI=Yw7l=so}bmj%a@j^s~-lZLSMY-1@s9Qmd3JRACO+%_|WON!ODdRq6O}t
ztD*B%bIqv<zEs$5l<U1i*M6l!G@>VFzA5EjU!lJ(M2#rAD#gwt2+ZY+N8gsg!fB~q
zh$=laCTG!J@>HQoI7hFqulMRXS>{gpUTyen^5S$X1&2!AH}4jOjg8{6V1xI)g9OQ7
zUC9IKaiwH<PzXHu*(k=e^jDeZCpX1K*>^M<KKpxO^XEBQ>!GL%;x<b~)A@9jX4*IN
zZR+a;f{t0p0KDcQJI1Jb+!CayBHO&ZCV4*<x`!``FNJESNfvU@PVj;$R`!a4<Ry}`
z-_wXsV}eT{@BVydvR!6(#_3)|&0?Zqq({$V%zQL)qX>e?A!FSCj(bN!i1g<UnA9)<
z>)t3ebbhCch<9Uqs?F<(h}cn4{AX%)ojSMe-}6}81&g=7MS{o#ycmuafN#uf&-y?C
ze4_{88+f)>*BZ0iz-u|>cslTzZ8hEz`?g2`UjsyPg@GC((P5vV;RD1Od|`FP;MkE~
z09%=;!6p|95y)^T2^bC`LVY4aT0iYDEc}DsOx1j#Rta{l7Od1sX6svWOuZ@ghsxVL
zpNJ@zqsASbM&o>1ukSu<sIMUaB`3~8{==qE<oObklbk-9t_zoCk!4f(fs@g6z+tCU
zTTWyfT#U#iGY3kR`brNZOL0`)i^-YWS?K@`<6_*5rWB5<w>K5WuewdSHTcr>$)*#$
zs{o!QU<45*-qpMvtF6R>4I_{EUq+uxXO-Z8O;`~5^iHl>SOZxAg8H-zmg6jqn>#>v
zWVPP7meSX5qUC&mhj~<I&-&CaA%3WTj$}1<F)j}f&JIa1BQ2ZQ$j}X}jHC9TVatFZ
zQE&qUl5Wh0$hcw^Rv@H<saF;sQB`;K8=+|)bdosY&sF0dxK~GX`3uJo`6}Q@VQB>Q
zedlGFe*=BrG63YJXBb=Sj?4ofcY&=jjp6uga0$*_$E6dL*lGxLcV<*N-OZkKD19&N
z!%IfX(w8@ZruQ#BH8@@LtGF#qp;6tPlb4cC1L&d$q=Y8oBF2R$>#~&|a23%D)QBG!
zS|fVN?H+FQGfB<M$kstL(&PzWXBHUo(6MA>^sWo^#8PT7Qc+&T|6&@K3VH5<CZKf>
zm284OAY<i2H$zjM_`<Fwf)k_A{!i->ekm#8yh7qz`Tns6TZR$RH%rg*`uufs7SpGg
z@Z?v37X_eaDPdv{>$a&2Qk@62l0SkGUV{h`R<5R}p<6nYN|ia?oJ5=m+(=9VW09X`
z^KNzBn>zhxx=QDeabGU+jV7g47WOB>YrM)IO}~e9U>ondWbPu6(~sg{@qIkG@-$e&
zgJrZ>T0}By?7yFOx9c_xCQs?bR#CbGy%bLZyHET;FNGh}OF0Mi{%TE6B!Q@KqamP|
z;?A+`L|<nL>ZL5-NM`1=q7DM-b6G4v?@t^DunV;(vk>9;YQY+}XG}&8{lwpiX~Q)o
zhai+YvuNp@Q)koCtRRHH@A)@K9L_E~*kFX1U00)c0p<QSAnz++P^&ey?6{4)(3!m9
z?oqoWv})tQ_5=EwgyEWW*+t;(eb-c^kT}$l$U9<a4Vlo89i|gEqOfe#QTgZKRNB!*
z6;v`?q5@UEt@*SJV~G^a0sgLHI-$sjRtbVfcQ7M$(J=$e!rdUag}jN=k1x`c0|@=-
z{o0QYB9F|FMWVUXho(nIV=k^4+Rs-Ht^Lo|*A`Uz6T|e23{~}vj3sz;OKI|W&|`;g
zkwAL&GQ&06yK$xHnKh!fUac<wCS<DMCP^yDDyh{3><`8(vt#ZljXm|i{=i^Ud#+)!
z0@}9g&db;OTEDM~MJ;B{gNkMi6s<maJ{w0x7q+a!vLRB=(KVri6&(IyNYb|pK6n3U
z3~(vndjDu%ooiI~8$l?%Ak4NEF7(U$(44evtS^au9bTeC8Djpd<S!S``X5BBQDSr;
zjpYFvhM(LWZ>7!HaV*&cAW?qR7~e-P^=RLWLOtxCN^I6@cxrP)R>kk6n#SO}O=^Kj
z_l)0(JtXN36yX%Z;MG`9i+SWj93;Unc%Try11%<r07)U+Jn&?ce)?9+X>3DNTlL3B
zH<6Q+ClXx8iy_G-mR%W+f-pWpL>G~gl|KiLbD?IpI?S)P-~ig;VEYjW-Sf{<CSPcO
zA&=l(nHth7YQ+e$`3&gp#RNxz5B{Ap+Ji%43-g`f&72hAD$1hKi1F)riet5PH^e#B
z(LD85slDS{fpimGA#np0dLHCSRbHAsa|AZxYM{`k)}?0}Dodb3mz}}AcC>;oi5V{v
zw17I(dULk|*31yq(smGf^bpm{Xg;n;J%ZBXnY}MglTi^*Z%(qj^2G!fc^=IUc+JJh
zY+8o{uF8JB2=*6*148X<F}iZ!0`@lS8g!PuFKhq!ab;5GS<Zgjr&efhtEFP?d_omA
zG$I!NZFcT-3ue9f1k8@5UQ0B?yvr~guCN*Iv!A{sVyIk5CxE?%nTLH#k+e({$j)C8
zQyQS>r!Vu(XI1OKDk=3LL(V{#6l?H-@@F-#2FE@}*yg@@%3D-m%c03Jjc_L0$uum?
z1ZE0@En-!3gi!U>zjCC{6Qd(qw3YpQsy}4NNm#|twb0I~c2jPk?A7{}fr(wqWv$`Q
z3$lDM01c%H1kN=n>&IZgMQ8n3ZtgRYu3blSHZiX8Ez{TnkcAn{EeQL@>5MIE|IKq%
zbq^Xz!Cf|OPDmzPb0d%Qfgl8GNJ`@$3IF*Oe<Lb2L%fG|%FYJff?OTzLlj|+Yg$=n
z4jDsRk<t<^g*CHNY!q(6*H7;5OkM7u@<!@=4wZOI^#<2Dq_8RsXNOs0Mn<j%Fd@Go
zDH4TjP1Euvot1B=<pxgov)c`&j~)zRueyAMC}a0v-6gl$n^>FM|3r(p>;Z2j@p<$;
zR8nHvX9u6zh8TWNFOXCuk<sGHFB?~h6!`5Xo?zB507X#7&-5)uyF9hXPLusl37!h+
zlkHHCr4hvQP_=B!EAB67=EiB_w%KLnH@tRrQ?Au-eJY0j-&SbaDVUlD^e#X7^2iPe
zh{_E}QZ3WrXk?^z8W-tK%JM_46;D!WeX|Uy1le<IXF(^DtXxeYV9!kfNRCz+@Yskf
zh~$_TRa`8eLd(M+XuBA-0w)s71jvuha)D>`Vi#0)wbOyTiL>DzQc>VQl;M7t>fOo)
zEoTeyHKFw%-n1G%>?u+?cnNeCo}&(2R`0g)W(&-(XjZ6D{kDCBPldAQd9!la87XsJ
z6#7L$dVLOepeu3ghT_b$gS$-1biNm|Z^*1OM;qPKVC2bEC5y=_EAy&~GBQGpZ%e=<
zd46(K8P7Ua512;QcX(%E4`7|TqkVv2&tW-B#|48RaP;^wnF;BpS-4;O`mikYnw2C;
z-p<!Lp|^i7V1aFuWg%<;VbA1`C|Do+8mJlP6RNp{JczWt(1^KC*xuSW&KN_qv+(E{
zdwmL1BP8SL_Ih`~wX^Wx&^82JS4}u4ja0Xp>p<SW%AS2F6}dn_y0{jq^*j;#xP_Ng
zjo(?bk+DYb<9QyF_NoEZl2iXqu3P&IALmPiAM#|e&+?mhK%_IDcH{76(NBXvEGhYX
zk`9Oq3p=S{jqJ4H+YpTB*G4tgxSQ4XHol4!N7MRkq0DGYXL^w2rQCzPGhMbyQ+ni!
znSa4gfBuCzts;&k4D`04Z{b&RumM-Z5)AgfxWN(aK%MtV%-wuE8oLPcwjoAKK%CL#
z&rKkhX%pR&lBls1sEUis<|Om>h(3-}%I2gvDU+-FQ7b)KXyXT~WMJONf<`4RcLyYz
zETtZj>)+zJesLm+GaCWIx-D?D=DIxf7If}f>MtQQ8!u5c^@VZxyVaL896ef27iXIo
zy!+Mpomtk0>1pu(VN#qepuTl@sHMe7rl!5ON%QJw#N7#uVgJ<H&(xuU|7Upk@B!2C
zEK<y7;Z>0z<oYGc-}**Gf-vHO&)a+Jz3fi>EQdHF;B7O+K!ayHsy`+Bz7RJzab7F=
zZF7Ln{POgDHWO1w$Vd<LmLBb9x)93uS5f`;yH62cxIR?~?tOEB)VM&^>L4_F5DbmQ
zfmp9(=+UWH)y!^hlp<Jgy^xMB7=`M3P3PMFg-$@8olFq{GY<9UfTisG$MD%F%hxAE
zW5i$f8^3af{`nn-xP<IL$bOv)x)M~T;+A^YmWk4@xLljHuSZlR+2WHTd32F2aqyxu
z{zxeL=rj1rSl`V*by;oGHsFTPOdXDbrDzLoOO9a4l*lFom=z&lFhL)Z8!{6cwqrhM
z+I}(k`&(Afj!rfBGWq81yYxmLg#r`m&%2<>{7ox<F{qN4pHq|OM?=T_^Z`-{KadFq
z8kS^kAN_JY9|iM0&pw-errBJDyF?mT(^*WCOrSCF5s<=gkhmeDh;Dv=u2;oy*#3I6
zjMCOv@OK!s4gcOw;@o?1ZY6S=m)yjIKT_Wj_DX5wo7co>1HyG%v!#>M;{rYxzxa<|
zt$6fN-e%&hljNc|P5S?uA<p7NJqC06n{i!BP_(DC74~W+Sj|W=%)bp^3V<Oy=yY`T
zKhjO((oPd?nfMT-3J#s$eNu_GTk4Hz`$-)^hKewK5Ntlv85oSoz{@m?ux^)}_9}2;
zwmeKI6hQlZl3Rj3;-j~9_|_AvghCWvC|)@$nW08gF7;M|7eWfQU;z!kXE{Zf9Ot#W
zN6T`8eBuu>%i<qt7Wa3fbFf%_-JXr0I^CG_`eW2syM!T_!FZ$d5J=NzVMBY!L4&{F
zo|dOq8vCAyXI4Npu=E+6+lZWOCFk==J3b!?9`EvYTqOK)KR=-LWtp7ktkn>KXDsbs
z<U~C946&iey>#$IFVdMvgYTT32rx8p5vVQ07dzIwRD+qyXoMoI=Kd~o288fx@x+&&
zhj6=kED21mzlxY|_(+(8wi%@r&^ANY)>z3DL!`U{Y%`_jk)uK~YVN=SPE}sn<lZrb
zFkgy4B>!ygFx`xre1WUzKu&WOmwR3nR1c^7uMkomEa1VjlAB_$?5y@jm9)U(0}(Y*
zTm7vEa{ndC<CJ^xk-ACz>VlKs?(fQr(M-iEC6Nsr5eTU>Yb;hRo4acYIKASgGaTHH
z#@#2^=zq~ljfXkgIC%uTu@waZ&N#$8I)_!?Gdf;H#@c-(#ukAuJzWp_(mG9z6qGSU
zGxfliwpxiy6_ojH`+8@dX0;*}^<LLwW)pGqz0ZvMcnv1$A-1FomFiA9-IkhVh5pA>
zAo5)Xg%ghDm>6G^r@|pT+El;xy?{0r<yhCH=gLQ-ZwZs6mq(n;&yyEqV%oOR-7Q8f
zcS^4Hrb?Eu(uWU*|6%JJgCp&tZYQ?wiPf>q4kn)1w(W^AF*~+x+nQ*?iEZ1tdGEbd
z-=FVC|LLc?y6Wt+&tChiwbx@F+@TDhdLx)-=(tJ9zl>i@dZWteGCBl!W>7kM{Qf{K
zvG}}$Yf1G-#=7=NyW-*TWd)Wf$ZI^ADSdaC!8OTI$SKWT(_f~1v`8DE?D*lu=Np(8
zmHs-ceINBV6KlvshHhPd*_5vcK=Q`*1Jc$jy?j7V9Y(rTYHl-FUV;O?IYIsHjcodW
zwcMRLgZ1fh6pHtN7$AgQsZwGZA^h`rUh*I^I1BLnTe%c(-(K0o{kAjwHlN=R5j<gf
zw-K+#u3x=Sx+LbbP#RmuZSgm2L;i8i?(`9EJU?{`NhE+tD1mH^N#ofuZCI1e5sT%W
z#FMUR;_F`kU{5{2Z*aWQ5<CenJ|7HOw<EvpjN$T|cyctI=k7ZtMo8qR2wnJc+i?-(
zgVZ%21qs#tLUJ;iY9F^-pJ9BgMjF;$9oEu+Ns+z;>W$=lJzs+8zr9HlTbLI)Skw{4
z7gUBVHn<#c6tKO5DlUFel$+b_bB{D7j#q3)k=u*st%;qd1H?Jt<Eu%YVul!fy>Cj_
zU71wQgjUSctuL*u5Fq^oryJ+Y37h~&rYcp~zXmyY$8uhN9Z{W60lPyV>4yb=Bp!8s
zu^!hieam2aoy~zA1CcGi6h`wUJ6i>a$@TbmhEUL%Ha>jX81;PC-A|2!qLyOz$it%k
z+yAV3L<$P4ka*rJuy~h{tRJLf{R&a}`kP&%(}~<~gRvPsrq3l5<aZU&ztz<YDd(H8
zb2@7!;+F5Umd*wse=jjT!r%)XE%9&Lt~36cVb)B<A(J%Vz@PS(IN&(Lmwa8w4exxT
zmweg~S0b$M3*KQ<pxsN&3x1<lc;wd}lvYD7PTEw+Sz{NU!9iQ1j+1!`7Dw!gm{Wk#
zpUl&kbUh=+-1|ojB1_jTOb)mOa#UWSWP^R@r-HW6Q5aRJ46;fuDFwrm9jPw1Vg+~p
zS`>o|LkQ<LUJ}&50_Vj3ZQZXo)&6ZrL5|J_cD_*V(0^>12FCIw4XVEuhM5c883ir1
zqyO1S*TC+zrJp=#XEAntH+0ADZwp$)DV~BaIc7<$;+lMJ>ti78+!5F>-^U+;pAJtx
z>l&GY6eDF73L8q~*ydhUntrJoYoYhu+RSzch*e?5WmoGnB;O)Vw4OhjM`W<J3m*k(
z`YMBD?yQj=BF52eP}?jSq#C82vcOk$+P)Th$Mq`E8k&G9<8!0@v_(LP;B!joaY0bG
z>blOrNLuHc!daB+z{rw<)Xf_@2uh^!K`Aj2lY$2>sA$5o*C{-VL8Kvb(x^`_QHMjX
z6j#@w5cZA}myGNO1iT$m5l}M*7j9ZY+-83|JY2v*Tvnf){`4^*{P;0E{6B#6-RM7n
zBW`0Y{R3No%;*c?pw*$FdB=q>e*qj<v^sjJvsff_Z9b1!LiGOtj#Q;Ne{^(QDvPKQ
zU(g`M9dfpW_Tki0bQqr4&&>9_JtU4D!(wxOWPTfqx=U<CK3>rqx||xF{RC`C14X1z
z8>HYX*S9wQwTOnrpcW)tffg1nJx0k2JLDD)(=w@5H%d9}HWCu6#kAL(s3drFsss}t
z?b{n%;n@#*(WWySrm)#oXT&U#@psAaR6J{O%UwZKwq0VhhWns8h(Q}$DEF{bTL$Z|
zC=XVCMcIgx%nSvcW%X<O!x=S4%YH6z)i;rUITO`?Rj1&IuL`{eo03MZ)11MKhoy|w
zBQ(*le`eFTPpB2#gjiDD^}~%=%-G{#U}R#k`XQ{B*jw{THcIV$7n4=aVYK?2hjggg
z`lMccT7-Q78&`;Ia{^jSv?NhTKKBG;1gAfx1C35ZHMWI5BD22&VXxMn<|wWyCPS|X
z!CSS4qFx+-h;W;FQ#zrh{@31JT!I*>{ljrn<w=4I@{Gk@{4b$HoBm7a+GdcS$t-#3
z0&y(b06t44%x^<mziu7A+@WTt2V;o3MdWpIm^!<!gdRM>Q?MovH;w+jI3*0Q{CCGW
zO^1+;@qyp{)-J8T7>8O?E#N5<{T+0y84EFpuXEn<C`pC15z`Tz>FU4OQbLOY>yUmi
zaVCH~ES~ziIjqj|HH?IDvmvRlC|nk7qf@K08ab~bM)iuEUOH1aLm`J9p1n-P`b5;;
z=_;pKtT344+=ehuKqlb~yk4&huii-$Ji$n54z^%DeBrO@*>7{w&rN-tV__hwjO+te
zahkEJ90yfRXvg^rhk{<QQnMTJQq$fNKb}Q@tfSH}ZQPDO1$Ie)h4vh*bv{|l6#?3o
z5wLidL#~3A1Z|jR7+$Bkk19E{1=t`RaN|atl479`h7Ki|$}qv4(GYmMZD9?G5We!|
z$QIZS84r%8Qj1=xG>w}loyp2>Zb}>mRiXlZq){6jLMfaAh-KpqjQNVg%ymFe%wqau
zxGPC+fop8;?tgJOYW<1>1W^k}-E@}xX!$D+E`%Z@FmSwfe%))3E^8;ccgw;fO=6Fu
zA|qcr3zFyy_iVuOu8<$KV$57~NHa=JJ;_{-jN2*(Y(R(|oDLJ7lj6zidfoiOXOWz1
zAQ3!hwW|}FL50l_J$o1yItuNF;;!IAWel@?`RQJ;yCLJCGn?j>uh(z`D1hQ64-pnO
zWHjXtbN(a9l*@Kw9*<2_05yj2fF>XOZYPpBU?q@*$94RN4E6=yrnUIN&C?;`il)8f
zdr4Jj!ck!9QtV3a?r^!QAB!R3O1#RU6TDT5E7YLW<gNi+t$tdc-Vhiqu4?B>GJs#E
zfg+<Xbt!;E!o}h11VI*baGBA&b*R0BAZolsBhvY5PlRFqYfp~0788m9Ug9vTyDa%Z
z<h)PcXZy~lzX<A})oue~0`69~Jz^eikD%`8ErV$fUV=Umb4VC>aOB0*zHnr_|4Fw=
zD}lr9f*@=4S6CE5MvpiJGaSM_Av+kPo5E9nk*3Oy5UAwz9z{h5rSm~FESp$%7(o#O
zhGtv~Uzg@bsjPDzYdyp%-`v0{f&9S#P<!dtf2bX6O)EbM7+Y%ah1yjd#Gyzi=vv>u
zPJR`K)07G0AgHCU3<`t#uOwoh;VHP21CC;9x8x1_db-7?*?66xxoY~fLX}hWDEVSb
za}Nc5R2;s>)pB#c7e0A2if}QTsWO<hn4^89Q`hVXBb;vcbO*(wUa8rx{tI~`#x_?<
znk2Y0&Xjq<z5F8+z&&;YtvINEyQkMTX@|A8(wVj*jbrg<tFQ&~^If_ty-vZEeAPC{
zu0QlQmj5ngSLD>Km!^7QS4NG%+G7^aU!k>ubT!X}DXi)+$1O0O;QY)@gPH*o705Qq
z9kPwWR{oQwB%EA38A6J34KCGkKmiHPxkuEp1nW13Q{uD9o?-PHo@Xiwp`+^(|L_-j
z*7-uuI{%?()TRG`=uUf6;}?2HTlxZ`;iuuPf>MM3wSVp5r_D9}BhanYL~WADtzS*L
zzQ7iI&CK@+L01vguBL*T=ym=)o4%h~ozklcrPMvwVO)d=m-v?E-hCz2*oE0(WW6R4
z4~wHk3((jl+LB%?MWk*E!9M^#@%#4qG{|Yk%ah(Qh3p`?-D(TNpWQUdXI4dH(_gp1
zH8Ymhsv;QPSDi1?n@dH93!V)tWd!HhSfp*-<UFS$)H!j$O2m#lJl;kA$|g1GCN&Ld
z8rm_pn)Dnv4>t_&d%{ezn><lREwdw5?E{(#bBgFsQhfc~Y<1Kp9}EQIw3zh=t`u`1
zX&#c@p7!Cd>CsHdOG;X4#!oON8YxsW&#7<BvgYBA-)~T}ia)iR#Yv@=(h{$fBeg-`
z#ANQONTIphNQsoubN}W*#=J4!u$9K+4U1PWQV>^SM9E?SGNld>qkZVd<17&v3s<h~
ze`}a!(9unHG?XPxgtD15^h{_!S%HUmh}saNqiSVJcH7jYwW+eRWb{8|HPLehjFoM{
zVsXKx;j%_(=|Fv7<Y*VBvWgBiWybCGm@#}`fTt)=sKfT{C}{}42oTLt>7ek>jS&`>
z)#Vfe$(${VjcH0R=NyYo{{|6wEH`L`;`e9YQLK@x(DR|CYtNUXrPs?|N~MY7pZH&;
zj_TQtV+TXWi6uSnw@EqhB?{Rmb8{!Se7-k#IVB2PnY(QY3Uik~mLE%Lm@wRYyuN-*
zR=odDS$D4c85>GdUNh$T4<r0T<BQDwzGZsRnfB=Y`>|!jjJs)d(tHl|PbEq$@%&+m
z-{!}2!9ddvi?6o!cjObvS=ly&;Dnz(v&Nf35Fl@J{NUGIIhbvoDV7MXnuM#Knk_%w
z@$kdJ7w5DUaNvV8ZGIHRm4Rbqd8MziNBU{*8ZvZ?r?-bUwB6b3`TJ0n$su(TWsI7Y
zx)vK*S&ca4b|)OLL(VD`acDBEHwYI5bh^8se!u^VSPq?;4U#kO{xU;<T6LH7S$Wn^
z?)h!Mluo=Ja9oBRdnP35SCPE2_8iI27bfr<mT<tNTZ-Gr8>IW~NOyP8N6*YbZE1u^
zD4%QUeA`{*<9z}h?dnadH-3ZB{dQ;B?|nA|E|35U&iMnNY9A_^=}2qbxRspu$O?{j
zd4$evmz^f|@-qTwyAeTgl$q6B#pf+1w;>Z)Wg5qvP!e{(=L{EG<e^EZ^iS_C?Laa(
zJCWT4a{|6L&Z)LEOhH)a*W)_cGjY~Pu<@Q;0tWO@Eu_Ho-=q*z5J`Ryb2F+UuM4&O
z^JdMW8Dj_$R=oqNQh`VFAG}a9$Ehuyz+J?ZSGtTma|a%fgWo~|q&>4N8m(eNUz28T
zQb?}GIFq5BdF9#KZy(D5{K|(BUR}0iZy-mSQ^lQ4(%jsgw~JRgF=3}1E-h|gs)53n
zEu4t;jmVOiVp=jq0I*7%`ErQV3r_@EBk>Ie(yREkH9RO-?ioE~B0G47R&bO@3KjMI
z2ZeoL<A5*`G4TyVu#83&*^GB43#67%*$a(yZ_uciyQibhAg$3jGD>-NW_B^I@pVdh
z5DZLBiZtGC0$+fHq{Y;yrUI0U26sD9b6gQr;0cPnh-{H*l0ruQP<wZC_?F@cmjG`g
z=0>WPn3Ocm#u+9HDT0H6i{<7Ru4lrt16N*r)+5N{$tMCF{h2VL$pX~GH=!t@(ZM$5
z4BPP>7v*O`M$YaV7puuVH2+uc?{=1A4wzav0GR`TCUpiBHR+5mDf>f^FD-yvHUU2A
zs3;rV+cR$N((y87#`;c*-$!$S`%0i`!$bL5>h3PqyUnxDx5v*sYpV`y01mn1%iiNL
zEzZJo77`3=|0rsUz<!Ssd94k)N9s{t3_~LRa)Vq1lD;#5A-r;?B{x-q>Z*e^fKKIY
z|8i{ghl;0Wy(fbXJ9tzQv&nmaE%W3Ygv~SlfSQR_D)*lOl?EMbE&S-UIGkEl23K`I
z%=EvBrizi5B>Kga6UyM#RodY4I-SOT`olb}@P1kcGMoZfCQy0_QLH1nk)K?RON7dr
zx5%;H8`~u%&$Jf0B6{Lp_ci0@Zh7oyMOTGW>Swn$-J?H2AS}e*uu~NaV2&WAwA0HT
zg#B%f@ej?H7B*0K0`XsMTffb_8ZYGW9Qhn}-%`Ozr+RL_^37<c{(Vd!dt+wrU9Ey^
zC__;2GM5fcm^>yA^z8t%OSKU2UX3I($BZ!@dVG70p9k2`5krSskVY6!l0Lu8dG4AQ
z-*vIK(C~(yN^44GQ~W@X_fac9o6D0p73eXee8D{8RCZ~cl?vS)7-yi+qGMxeW}rM*
zRBf$iJic&VI#thBi}1|i*&nOYRHI27vAS#8`)Ws=0yylEd;aX1P0;Mgu@+VIMo<_E
z881SMuifs2ObJ&o6DtcKc#>ks<qpg#&Jv~0#YENs$Kz{SAl{8tA_TskPj{Ms>bOIH
zbaMfH_?5&H0v93^Wsc;6`sO~9ap<DX;pj!GgE2q(eMM=ahep*jH^cQFalZ8lneHm&
z@b4o9dn4AuBQyAda8Pt3;JlIcJz|RbayIP^`4m@?MDhQn*3Jy6?eQ!xRig4$Uz}tc
zKev<U81v0b=CtFS@hu}*m=bhuJnV_D5~r66as=#BBsg!wV|#INY@#|<4d_$9ZLT|W
zb&osJw@i)8|6c7dzJJmDhfl!OE40Ay@H#`Kh_j8rI2W<mA`q}wIq>o;>eZ5Nm2#$F
z@qsnf&@0~FK>b$C=2*+$H_>u=78j0ieKFix-`E=r>Vinxyz1N($)=|DiDwKPRj^!N
z&0MjP!ejoO{;n{=M0>!D*J-|;#AO2i$tZ2OH^mHD?T0gx{Z^vktJpqII!BTW7yITv
z6{Be`?Z?VI`|8sOvZhT#JSW+G9zO?KYtL6z4Tc<!1zCk0AEOj?4V4qtc_KbmvPc87
zXS8M;$&uht&f;|2)<Jk_6Z|EOP@zK#T`I^JzK;MB8KZzeY$AVJP)^H`p0PplL*>{<
z7ZNvvuvcgH=EoR{D$B2uuR?d@ccKzbc%?sE{4y8&bvZoSjVx-NT*xZ{q_aSI@s043
zaSN0AATZ9!wNS?t&<HL=O1b8hnP8&{hB4MxkLW2*>S2`Dt0x@4K6Mfdmu|gD*eiGr
zu5pU-yUD?JOmGkp)kK_R!!>+{jjK?YL(FO`{>?yMTf2XR_CQ8G*giyfz}tNM-1v^V
zq(0;6YAD*6zZhtP4_z9k5ka<=^g_&4wyn5%<A{oiqMeOllq1f_2|kTnO5{a>Iu!DC
zPsBn4Vud?F-%Ruw9(Qv;jjcIZ_?$DxW|W!9moE9tPo5ASt8v#tro752*X`DIUeJ|4
z8*O128Onz8hq(to`==MKtMDj?!K%Fx!#jHK(duNsIwxSP{Mc+=xzg1O=bOlia*BLk
zhxLO0;49Rdef&}^mv*l4VAnw{5Lf9kwKm^&o?h-YWuAV(tT3V`&R}C15bJAYvFyT;
z@soO9SJZvAEv5Ve?H%p?YVNk%)XM&(!djA-trM1QlWO_K1u1d#Z!Ly~oxutzC1}pm
zSzO|45HkcKOv&cBImVX{-oZd39mfMi;<0G=3jY8tkk!C>Z`%QCMxzv)%bXc0CRtu)
zl@5oPEM9h!oBR@=&>*<YapmcMkb6~IrM{Xu7&En4H>}7EvkL?sBcG3kG>r9U_wn0k
zi@O7s{z4d?6{qC(S|j5(`hj<bw`d|7J`ch=Xy+%rr;Z%n0Ou}xddgl`U5lGEElsS_
zca7#82yHwE2Lh&LWr<c>kR~5#0MEKEBo?rKNnqsOUsia|c1wR3X|17T$@6|sj^5Oo
ziXhWFI2iEAx{IkV^%D_^Up7FYi;#VW|9U}ekL%+&v*CAWv2wMBJDqQ2*B`Mn2wgUU
z9uj9mI)nPd7Jm6$Y<Ka1TJCy!BsbJ^bX?xy*k-qI1=7i78*u<cbd5ID0eui&mBd+$
z|G0=wlHsq<4n1RQ&<d$lCJB+niNmQoJ`l+g0CUgrtKC#@MJFiKg2}bnwpdx~NIWnz
z;xQ}&j3Ff&3l?6%H^`50ILW^so%cMM2Fl}?%PF{b$#tz)pECef?@H}Y&|+lQM?f{&
z+zv<)0w*4Sma1lo78$)?Iq8jNS6ec?Dy%cwJ9KxoB@?#^w0d!o<%0Zk#p@L0AYjtX
zW_!bB(J!RBtAzPg*nT41W%gNPpXYRX3R;G<2ncKfi0l?(H-#Fr)!#%QnCMvwoTScX
zsCiw%3Gp2+(j>mE$RlZY8>d$ruh=0$sVLAJug{emeK~`fPXOP$)BAd?#G__Y$$>$C
z%2#U)<2srkcGQIX6=pJ%M8^SsFHGrX=`qUjDL3hu6d!I3E1*T0RrGt^%puc(w4Eko
z7N=T#gKARi>rl9<&^PP#we&WyPxQ}o)!i0)@N)rF?*6Y@_b;t5e388mUQ99x>l%Qi
zBt)@P2P9yC>?+wgk~&o}Ant#N*NNd)_sF;XFiA6otCjeXRO<|KUiBcOg@J1`;i(nG
zj^rmNeSFi13!en_hJF`Lqx%tJps6efVG#eVPkes-HFYuoz3Fp6VVXLSJT2KAAPIzi
zo@m`kNuqdDAsp{JGo>gk5h2(}PxQf#RMozQrD0aB(Enxc*0z7tPV!6@1Iz#AHaSQ<
z$8pBnPQ;5=^e6nnD<y-V6`jGqSZSV+sLZf@+W$9nVVnyOiZI{E)D9*HN(>NTpqs-c
z$e~GLCQo?^PYKOz_*|sIZlXUG1LWXSn+a2@1+=A8X@kON(@g9+<~4a@x4aCAOTN`1
zWXVdQCqydlyAD1}K=8)S4MTi;va^6E&1qp2cO_TEA^Y%l3I1gkNCwqbK+zEw9ZCtS
z)Pd(v_(Q~FD!+JBPC3ad=XP(zLVi3#qJv2poLbq|@b<JECfq+62NlVu=OTl!0gjj7
zh8Hkmz`BjGv^%)n=(sy`G^C|^Lk<oy4fvSxuoS3z8xUor@#fZr`YAGAKz?`1)Jp)h
zPD00nfl(?SD5W-g?Y|}dvu&S;1+6=~^X-^p<xphG)z)d5{r*TQNnH4r61lup*o8L#
zXH)bQ0wyz!O<V38VxA8>I$9*klitEC&2eOv6@FNoQK<DM@fN=rc+bx@P*#-}ymfX<
zJeN=mcZ*$`T8?Q+ac%aFQ;o1@x=y}M;9Z~z_gbw)blZ-CSQb{i;SIxzoo?hivI=k8
zdW+sp{@<N=#+v|+?EQhVd8}$|M&0brkL$^i;RwU7rM>PqrkzfjjHOeSh+PXI#$_KR
zy^9w399UmSA>&}L{6$L`lZR`J4gfFSuQ@^4P<jDP=wv2hP1_O%r|l&yc<<2v*bfZQ
z)OdrNYfn>yUuy1UJZDuY{dsIYy=X!How2QFCl}c+Q`*he=3yB7(qJPWU#lap?QzU-
z<3bcei{`7^TZ_5<ESlE{?@}Q<99p+6BvR8KR2c+=Xgz<NRA=rPT=2hMN`Yng(P9^=
zP+s4|Q5_7J<NA1CF|GnmuF%E7<n=UK<Q4#28}$wc{dhNDtVfUJ*!~7)+gx@Q|8dzK
z9*H%s$;E)=KM!V*Puje8^Gk@cDNtfd*pK44X!Ku{ch)tL_8uN{RtQzSyL#olUhv@f
zfYH!H2eTDcdlpl{1{D1ZyX~;}$2}1}NV<%1^!Nvxx_arB2deOxnNwZ02GccAbsZ`K
zNgcW(VQw&y4C5lqz!%#GWRNEcMxzm$qv2T!7(JA3E}Z`IhAic*8FqW&(+sv=%I(z1
z?&IdrK>XCEP5$RgUn))aLrFt&vgs;D=gKZH+t+D%>Td_5`hiD=Q;6!L%u35Y-pNYN
z%nh2Z=<T`2EYA!m*a~^iFb8KaQt@CD+CSe3Xp1z(YNT)CFCSxTDq<rVH<=t&{z`vJ
zRPG?G)&9mYXX*4$;o%={yGqG3xF2f#+_7a*YDVR14<2|!{KyLaYn<_S7sp<xf2giF
zrOW)ycH%zH31{TYZ*m7S0O^8diwi1a#KO<@g33UMwYJ=iC2uG}yHk9Eq7CzsPh!?-
zw!624Cc6mljF~4tqK+z;4PjfohNfW%oZ_UGFR`ar_7{KI=}KRr-erUhmBJdatKPq6
zUJ{|x;4cZd0uc_Hz4s32SWVfzl^3apj)!DQ{B1j68nOniIKSaRwJz@uh4@dB7}L;v
zcr&Y~Vo`YuImF9-N#HCCGaE#{_-Cp^MuRR2yiXO3gb{iqzq|}-=%FaxE=DHPT=H!f
z`UVgCBKXD&@w(!VOE2tCto!Vw!aYS=TrX#bw-U9!+Boa)VrwTlrp~f~MmYnQudlDB
zAhrZ{BbCieSt`F1>BV*B#IZe#qSl2|@7CIb%(dozA=@Rd&V(rax~~VqOYD`_D<)R5
z6b+;wl0~22&Kf!4RV|W``YwUllh)woD7G3!g4U;H(-}vr1eSXoIJ!=wMgQt%;IGCb
z5|R?~mx1GX6+#ZcA43rPW8>m?jo`Th0L`hnr9#B%U~~oDfKCfLBaMjJ88H2@TT5HK
zpOMRx*7HK_XLo+!fjPB5wHV?|)1;HX^-$?u?UAjsMsM4<^9lGSltKL&JM`$z%o%K8
zkJ*VU+>gBmKy#3ftnMG;w6*>@wI9Ch`9$V$H1qO48#ntkVdFS=4c~@*$4l;3vir@t
zOaL)+@`cO{?wmcr&x12#UngGwRFc9lfPT*l=I#z|?RiKOq*(WHxK_hjTUMV5_fGox
z9u@B-k8Ph^#4>>=vkCU>S&n_{JhdQ@YmD~FfYI^r>een%caE?qF@?<oanyeNtwzKu
zSj*Jc-RHi)UWX7*olcH`E;_Nh$WB`m^<1PHTf$wJ{fFy#zX$RkC&6vXv@V>agCE5_
z<+R4<)-djj*<MJUqknG-8M`$YH9p`Q6Y|6Iefs?3h~VlI=H5Lag6r-#h0W>jZitFI
zXWR`bpxg58ag*={msqaZNwkR(SY};`*hbvTZ21DvRAjS>=+-e~2fjlCG>|*e|2z>*
ztL8$D<8d9NY~X(ARbaLHEB^cIZ2XHg$9a%4GRfp`nBy$0a<tjbE}xQ{3<zKNWhFHF
z#+TYLws^3->B>5}fFaOKW@^pCdJ|fOmVQVE*It!byD2n@HLV=dW<0M8x9@(nvCfMz
z>~{|`k`NBRm!N#{x=+@kJ1eJtMP_|rtbNA5Ym}FGNB4N_V)ArRevK~K3gE3W=Ci2~
z_j|QXf>ASX;d4{vxTBL>#MdOrp}`Vf;=wOsi>^!?)mD69HUls_fYcZAX4+j$ba-JX
z=dwme1zCRhMxlkip2j^blWLwz&Ye8JQMQGDl{`-#aON2r#*p#6?B0p0%oZiOK9e<5
zr&bzq*)YTusH&Mpk{(0y!uT~;4z=uL8wfGsR3{CXLxxB>ivM*87!pC=?i0~A!K7w8
z6dT<qr7Q{c;tFcaWh5XwaXmI?AjWvo-J5S{LxgwoaPaR90JZ-39FCstlUC9z5#Gn6
z4H==jdW1nIXr0@Jj6r}tX#nr@N<_t_2u(i-W)&xk3$;2c&S^QY7tx->$<b!#7%+pL
z^9_ZI1h-+C8v?_Hh634n&9kIcKX;^<OQQdiA|sGCA^&Yd5g$!aA1}_CFe>rCeMwB?
zYDp0<kd%fiZGsXZ-YlEP%uJ33-?00*R@h;=@PXQQ#vvUO{Lr(g>O{$5@vc8|TrbSD
zflap{dxGa}VF0WCV=5w=W4##42Ut){#Po|+F*1I$tStwvSylB1r9HwO@}E3}&<`Y^
z=Ep^sWV=o(I9~LP8pQ!`8O9~do*xMvPI5gTfi)_c8MZB|uGTc+7M~eo(D+7|Ht&|Y
z1y<vR)99~rTQgPkHwvdKfqaSUWT<-9!A_y}&i<hzTZTyM5j`7=y<=!fs`D#2qmmZ$
zmJR&HwpEIg^rek9tFz!u6|>;4X;3=P++S8z0UTC79F<C?GzDjrwy+o#L=}V%kJnNm
zFo_@bKK`3~29cWQRLa>X<29EJ{}9PAIWWz)Tn4w9@Jy)__6z$$c_8MhmXh%ov7;}o
zu0sgwhT95BfZZVilU%j?VT=!i4E@DL)}U#ZxySw=kv+euX1c!@X8Q$YYd`=UM+SaB
zDa{gRv>zM~a?~l<T%n(OESrZ0!MVy!M7tF8oRP*us=<ZRgmLQypvR#6e|ktaP+tFK
ztBm6n^*J<hkxUGv04yZBa)j-7(!pj>qojs&F#UiU^a1Bv2rX~ZSCZ@&8JVn+v;s>M
zyF<(xYG9lFS^E^JJl^%MG8J0S#1oEHNPKnsg7{^9RVRq5*Jt{MePS?Onzk91a@oB4
zH`3f3;gZvz(Iz)>43CN5$Q6m#F7Mnj*f!?=9XiXt_4^v~$Y@WzE{2w+GW)Au8>SA$
zmo8Q7G1FT!p-Qzgd)wu?SFOU%65pZK8f6P{koOJO4*uvx|L{WcL(8gcxuDCh>1LXh
z5%<PdZ|AXq&DbYEUs`OkF8fQ6#f+FnXeTy}-F9NZ_TG5{@@(T@If@Ma6IZ(R6Y{nK
z-F|FFjb`WwR|yQ>wLz}eGjQ!rHJ@8cn)95!VuA63KaUUNTv~PY=AGp)M>pU!y+=~Z
zylz6_ato7NV&`0yT1dFPn8@l#iorc1O8W8mW>v3YXJd(aXCrJEi-i2BMW89#hZ579
zBt{$Sty!JJ@Jm;6ufA`7CwI%&=tD`UKu_rrhoHS(SSU1qt-0`8sg;$p!KH>Wp*`w3
z?dhqrlK9v{VYB%6-(<GA^`ITm;DzA<ukLYpTUxbVgKG%^@6o3B=L{D;QDgH-ZfVkl
z8grBL4c-Rx3Zqx&zBfU-Ch&Q?PTouZdzD6%7b@z3GLbSh_~##Fab0JzGax&=#a`O{
z$_rG!4#SpITG&*u2*dKl2ARBg*XRs00$wZRqtBUSKnyuSAkz~gB#6+ey4rPRB8L!`
zJRE-ZwB}Z#>Y|}S(JNm$77u!^*3jSCc@@%)k)w9nCM;N%iztylQ+)yFq+2!31yAgw
zTu_T=vrX^(Tya*l5{-0Ur#~nZV}J|B1-tTgC7Qm}7{r4STj0zs@pKwaUG7^fYi*7b
z-5`jTqQ@<;e0g1~1sL^V-6suiBdIsz*773D(?Vy=5UjA{z<;d$5oHu0OB{&ciJ2no
zL0w8CJvGN59{i1X7<Ay65dQrizZn}w4LhAE>_A+&v>|HkQ6`otK-Lg>$;+jR`%(?}
zUp0YIaS)UFl2e^M2F_{T1x(a&^>IfFp2;F|lhhmsk+t|z9TqP1gV@|4nN?D8UyHT4
zo0ZyG&+wV3$EaOrC)X{^#C3H6pQG=V!4)~4qvRk~k6Kj8V;v&q28nRF7QJb5Wkl7y
zxGXxQ4F-D|Tas(sesiq7;Lvb7EvH*xihmcKIK<_XFaabEr&qg<uiyPsnzHWDf=7r8
zQ`p8{gZfz}Wgz9uTgMCXHF*-r7xx<^c+>0<Uy^>A@UM~$-^V|Rk)vkeaqas{s}a6z
z22+G{+X)LE4k}I70NMCASRDRyk<uB2=Zd?t;ezZ&=n}`pft;tc99#aB@n<uhoZ73&
z{4M;O@2`Jy%BzY4C7LaZ$7#cGFMNNs*cIW4Qg(Ke+DaN)s@YjxK;Y_yi?h!#wE1~d
z=9eQq{!`PNxCfnGEAlOfu6U<;kE?XMxw}<Z3Q_R?aH(+QT9f6o(%jd3Ek8dYs9Th7
zJZdi{yop&E-Yq1rv9jgRX~pI_;gJ4_1|*r)yriAAqGZTISsN=ie<>MgV+WgPQ8vj{
zv0V`(OlR<dW0a?$=~l<V_W7{Qc=qKPN{;rPU+KLDlJMoWF&pq7+*O$n{Y+DHlw2?M
zXH%#F_#4Akf<}zVvRmkXmaq{JnrU54RVutI9;Cri^n!41rmej8ISEF87Fq10<4h>V
zEM@VQ-}=!Ad~S@BDlFz9UTMndXW2m<Kbv#-I`1Lw#lg+<FBme%i8<gV-`#UovH?mH
z^nBFVXtZmEWRis^=WY5v_-{JWfq*q$o-?r_EM{AzN{wg;OFxDiI)=mND&_=Mm#8~h
z@T?BVm!X@apQcbwH+*M2kNnO6^`piXK!NJw=dEAFCp9+BS|q=HNvGHI1CHeb_CH3g
z)>?IOlp+_6lXpsO?G&9z!5?i#GIuF9_PS1#zi6OttLF5p=d|s7BjK9Ns_ZRN=$keC
z+U)Gx9KLW{OwpR{IeG=dvVQTBcJXq7@5B$A>5uw1HO=!{^DUA`q73sxdIXt^OCgTe
z2ZejP(;65f);soeoN1a)w{|-LzGS523VXU1S4Xa*MVN8nw&7x@g^4a&w*i{Qmdtv@
z4aXLk^)DCFg`6i%HbuQpi3<22vzr~hIT)CA;edx>aL>X4H_w^gm*1KDloS)FmY4=V
zQ=gIQeIfi)Z<;?8E4~38qd#IvER_puEIuIB<Ee9yG0W*z|I~mgmlaGqLWw7%oGyHe
zN{|JSmS!EHu&Qh#)7?dC&a8c`*L4a|{)#BXlF2BpExJuEuQg>@UkJW+%eP>dS?+T_
z>F<(#8A&iQRoIO)+)UsDu#BSO`K#xN9k1s$Qz$%hTph*h!o3%)^ZleGYrECAMCBS_
zwngQ<&q%@AUfGVVV1vbgw_P1lrd(kH?t~4y5!bx)dkfLzd1LYrP=&fSaV<UXP8ZN%
z)B2ZoM?x(vitAi@)6lf18S5`&Wh*aEfg*G}3Gc$Zc5AI_1#ZG>-bcm`_3>{`w&X8i
z2BTTI+}n8p?=8z%=^m#p(O@JY$*Ur@GWdTN5mX&_v!f@>5~^m83Uh)YQvD9ccXFJa
z#x5}(S2N=~cU3QL8>Ss+@$OLL#2=vZ=dLj@9xzRE5`pI58m>(7P5EExe|C>=fhWH!
z{VX>fD5>V^P2AU^`SvfW=#GQ_mix>EBPW!#KkdyYnp)(TtoE9lTLo3|&Qk<wqT6yn
zOEM^7r)Og+Yl#2E0?f^KZU}_&kDHkc0V7KzSRx(cMJcw1Z@<xoMGw|krGfB_&B%D-
zL6-0-CP;VS3b6FJPIE>RYJZ-fBf@ual&@35yi7=0L(;ifQ5VuR;yd{uqNu-v^{Tq*
z#2~oiF>AR>G$@Qk5n61xdP{B-GT1kWNKSa%UJZ;f4FUO8{F)ugW2_RMPc7ug<uh<`
z+?1TPvS64Ayu2K9yR`LuK+d#TC9>HW@`rY~x(?R%>tBC<cEJH0d1F?*DiY4|V-j{J
z8;|~sC7pZ(l>Y;ZDMb_YfF|-TCNh+vR<ghtxZ{R<B90*~d-qfcn?Zu*<4eMFcg^Qe
zQz;mH@Skd+QknE9yeG0GEr4FILFhnUs4JR<#gO5u#SYFE%ba1CJG_W#T=}WBz%P_8
zcK(EWE|U02e1fNHc{4(OLQ15R0+6ncybi}tXm^>YC(2hM{6{ee5@VNTpB&1w4z{zf
z%sU6JYDK7m)VsC7no@VYv!lrcm}{}{!5+?LdfN}tMi%(-wfcy_oR9iSE1!;CI0Egb
z$C|)jb)%(T6{lXTiF!}D6?Wl#a;TYe^L7i|pJrF<&Dne-PolJz7x+oELu+=w-?0-u
zcki>X86f{ddU$X!={zM$7C79CiS28KNm-AKdbb(BuJn@ny91z35mf^;0BCnZ;Ah8j
z($7_Lh3n_rYV!R9yrf^$p|Hsi#_G2?yO<wq5r^)A4DE=O$D^@FN}MnIaPb9M5Jv`L
z5ERTeADFLy|0ddG5s-1V-8?;VcCV3NFJf%c5A;sTS5N5|AT~s~g(XNvtQd(n#F+e^
z7wM}Wc35q_^}U|f4e&)-P2AhYjOre@ot9y>#!Tr%YArkXhBA!AI0yr9R-?Weee%iT
zVIl$drBvy)em;*5hrdA&@xH&8mc=%XzA0-~S}Zq<@j~KpAfp_)5O9=Q6DI~7aK~T-
zFB|5CGUT+SrWOb2rr=deBF)X@uaC*LbZ%=yE49?GuX04KzJb}^D%G_Tb2{bw2d5Jo
zFf=0C@URc+N%5a~{JFAO<@#+Zl%7?cPO~vC@zs4^+`=?YOP;U2_+CKIJN(Am@;|0h
zWaBt{jR|QQb&eio%k;mz<&^BkG6ynD=7*Z43l22rtu7m}_jfA<kY9#S%nKx*OzCEn
zpQm0amIuS273yY!p*HJ2brAd@m5mcg+<c%$Zq0h4+?PN<+?uOi<m_{te~75x0pez6
z6BdY|P?zf`$?FYqNz-<s*3cFudaRss@3*?O)~iaFPb5FEFs>j<wr<}#cExxnZ(tKw
zT&THulH6%##4h!{>%g2)e!CFt5gjZ?puX4t2C4xLQl#Q#M^@3WJLckXKIkmL`ba>)
zyvc2l1=;W`RzTd3A8wYDl&<njTB+lZ8#F~L&3P2AKgTcL$Xz6iG9%*egtucivtt{@
zLNdBBWF1$NSlQKDJ!<l0E7kd|FQysdX`sj<X*X9H_P?Qen-#7K&iyv!()b|qjEl>*
zfbp3!8pL3?^I2sypXB)Z#25%3&AsY>Ky`(}^fuH}=x|NOhEc&LJYDwny|N95?0`>_
zwp~2~kdric$x%Pb>1$?!324c#Xc&Hp&VazrmwuHHsLwlmcVe2S!48n2_v^LjyWuVf
zJMsjHX4dO?g;o>Fo1>A@7~$}@PJ7CxpvtpjcNgDA@hxT+QIv^hK+8%%q%%qJ%R~+Y
zK^)P(ZT5i?&ffBP>=a9lLj0$pSmmF(X^ldFMxrkl`PMVvWNrukz75tgo;is6Y98@}
zdCjElM9v#*L&z8xd~{MU@tJJ9C?Desq|cI>L(x+k@%K{%agFlJ?6U5HN^$?{kty;x
zNUox8gkw=o?e1V`)!M|@Rx8^$2*pf|fkRQqZSyOqW}-F73cx$yz92WJmh1|<18mT<
zQnL-~{h>N=up&%}1MuiCAF8UT>p%uc-q>@PI~>x7<)}DTv+3IprF0V~s9A%z+@w6>
ze<?-B=2y7wpAoN?;BA)W>T;SnZ?&zfy2!}bk!ydgVvzYu>7Dr=x&G3jt!s9pt2D!o
z<6c=rt4&W1vLR?tqwwT7wD+!&Qp(2|{<%@|^#;1Xg}Z&$TkN}Nc3u{!3(Lv>!24gX
z?y^WvUyjP*Gpnhx)Wm3YYv9ex=iHn-E=OwUV9W56Oxi=3Qmkgz({UKr>n|CmqLwlB
zO_rXD-^sieS8if^B2T+YtKiWlFE)UfBta7MOAtgb#2j@%9S96?WL??lqwGV-sCM-@
zql{WhQ{);$1G$LS2VBP}O<0`IHy-L^R?_dS?|N`8m$*1xy^>Av2D1A-R&UK8Ap-+I
zj9jf?z@Cj9UK8+nv9YkdNF;r?PhLt|n9i~VJ}|HLEt3KU27*Oii;5=+8jKRq9{`6!
z5#+JVc8A)bB&9oS!?uh@?L+X#{5?+2o>e|+aLjaf)C1)FHOCyU{6;vvi^=$7VX2NR
zqUr6|^sWlpcNOz7=Nr#cQLUd+6AWHb`7|=UTpTTaKv&i=h?qIwe=D??3y>7D9~GtD
zFHJQ60zXx033qhgk`+dWOTTxJ#cl+5*Zin^4{GWQ^Qmcuv@K&yd#FHF>AB%kaV}kd
zfzceDVIW}NLorNn8ynmPJjk7Oeu$Uj|5~7Z{?%0lZB)p~XYBpuN4}A7P?#R={pYcS
zHOVLJhNeW0Y)INKv6dD@Q3;!Ng~AV9F=;O<898BaiAK|K6&Rqlw!f+MVid7<EO6)N
zJ!^c7-pvZz_{@fRl9%w$7!`WEaCh`4y7*wF=AJM|asQlvzBqt9A_?J|xDg=<RDE@0
zgBA;&N2%R)qIbwJon55A*A;)nZ7)^Fib3&!_2Nj?MiHm<6WIG$cpKm)oRc?u_G(PG
zBP@UsaPpPS`VHS?rT=|CeUNsS@i)-&G!tXV7%&{X&qA*ka4AO#@vU}8rfTU7OL(<T
z!duX3s0LrcpB$wN_?T&Tz5|2Kt~yW5|4N64NghUT+1+yTL>flB){c$UdQl@OH(PGG
z?obsDzTS59yp|SCkE9m8`|z0eQMpJO1sCQu(>1ah^5}bR`RPEiNL1SO{`AGNu$<46
z+rTwf7kbk-oo<J&x#n;DqO5KFwbgo+T%IVY+riwMVmj9X>AuRS=N@nhZP-g@<jGxc
zi{YbUks7QNj5M+&hVI!tGK%G}P67+n#2Y*$@wzFCdXXum-P=Lf{D&Zl%K{5-?^|)D
zb(ur<cafcM-6B*he?VsKshsL$x<Naftq0rRbFEu4eJrXAU<|_{vR<jop&vw}4F;G6
znBW7Y-21hmT-@0OEBx*1;Eyh3<u<~peI~Aah(v%&Wa@suzPoVjJFu%Vp1SO1ELOVn
zcnYDuTzBD)$J%Qm6JoO(lT=V5j*?G;MEW0qjiqkhG3nD;@^a$hWwfkR^Z|uQ&F{@H
ztCF1Gd<X9LPc!DRGNdN{^*oy*{8Z;<smjVqZ9cFp7UP%o9T@>(;d3*W28fO13ck&H
zCcU6&bJVc1eZn=m!KcYma_e=>`W9Lgk^eDFV!<}R{~5}VWwm_Ude0xJv((7WHgn0}
zI=i)hLo^-sWZ*y_h=8ja?sz}hB6UUNm`Vw!iFsyupK>yxoSWyj%1lCP3KDw9kz<n^
zdB%=NL~OqtkC1uPl}=tUC^1MFY`CN4KUje(pplV5e7!2m`+p+FWw8G%VvKlUoZ3n7
zr6>46s=4QBWFH-DR#N|FK?F+nzPpV1p~Z1pYPpR@l8F6y>Dq)h8w&vU(wRzAwcq+?
zIO=j1v8$F#b^J9+BTA27KA9G%ZJ1OvR@6$4jMftnkpzfns1&blg-_G0?-aK8MFw<4
zOi|JXWQ2QP;?~v<+74I{Ivs5F1<<_4nsh&5H%XjqeY;!j1bK8Dc*Ymik2!;PcG+m=
zeoddy6~m?)rj%}pk-p##WsXvZTRGD4&P)tp6wHc^u$7&ng`wJ<&V$cYeS4)^sN0^Q
zxycOYow6fbCM0@KLxT_77<VCRqL$fbobuGc>+=pK4VeP8IVQHcGnI&PYt#}h1uE2i
zf2J-i`!-HwVx6LY{nXkm2%T+>HV_l6DcKNQNXjSv^PCbIpUNNO`?CPU5F<X0X=bP@
z(*fDQ_CvYRq7u(IT?lu6`L$?2C$N<`(9mO5uN<Mm%gV7))OL#X!hX8O6C5mP{>#T}
zHTO$a?TH?i!;2JX%{&Hc%TW^QpLC#>ckD@Og}ZbSE2PtHPAe^gHka)#YOBeP!pGo^
zMt$bmluR)X`Hp8}+{J%7`~XS4k@HyKr84TnZ(YR$71gq-5m=MyRhAW8D`dL-mrJLw
zQeoD+TONz?TaA~zAPa!l_DCFTh$a$NJ(sL1+IQjW2Dj9is7Mdf%Qx4{76wS`Dzxx{
zC-%NNpQQUp^03^*x4dG2L|M9^+)z@I|2IovpLL^eWzT$L4A0L})je{Bq{9BdW3uA{
zC6jY0HQj5D{MRqc^P`!33^xU8ao3IuNJ7~qJ$;AJdtwxMg;$_l%iKp63F;&Tt$?cc
z5%R-TwS2f8vzbK-dQ967+E>-Ep9fVRJHMA&FlG@TH9Ruc+L!c2qPj2&Hmd$4W&jHw
z#%8$Ep%P8gRKdtw$QH+OMA!m4gfV5;o8XK&n~C7{<^xPC!l>NN{duy-GHKwe!)RRe
zQf{O@GjaouVbbl7&|*Zf4JTp&XG*KR_()~MX~ky$T29e^L1Jb5e9mR|sZ3ejykdz2
zUt+`G%o-51H#`Aq6MFhi9kcflvG8!6l5d9OY5ovxr@)}d3~t`-6it>(0C`?t6N*fo
z#^wM{Zu00Km$VTRUEm=GTUZIfY}R-?tqN&*Jxse-%1*zH#=qTTwK+@lCm64+Z78U@
zJ+05?FBE*)^&WR@y?$PPKIMEaeZKmAKAK~NUUN==qxYaQI6nc)j7!2M)vUdY3B1h9
zMtL<iZKKI1CQ{`L4V$z@H@hW|k5|D-^~5~R9;g%^2$eKUe1d#UpK>_TsNRJ_Ua;_h
z^x*d=`vj)$V2)6xVQu0zKa($c4<FmqM|KNngYfv@Xy8Fmogaq9xg88TMa}(?W*z~(
zm7LNVfv`DB+m^sTRBeA6C`8yn9k`SenOI9C^odZ-mhHq3K0!tk*S4~N&7n{^4kPXM
z5;nK!0FN9~X*O7DO7gMWQ?9@H*~g*n0j~HO%Qs>u-k@Cru}9a<0uc679|!*P!QMX8
zWro_v%Y?IT%Y8x4bbWs3sIgrg-I6GqNOafvv=6cLD6o}4RwNfA<=>wnHG{M-x(LNP
z+iZ7qfgwMm{o=@k+WNYL{SOmPEjA@!{v3-2y3Z@`TMm+>Qf2~s6j+CmVcI^|QNHo%
zyrWMb!_rJ2fV@{^i*I?+=RiAvNPIr0F=lk-;Ds-6$_e`#S$$!uUOr?Nh+dKt^MUZj
zRXh@Enc8jVBqezlW&VjvLGeE5cTOaZP;2T*DHL*w3)kw2x-3C=u@+iMX_AeB&lFkW
z#v!13*$s2*QM;L})p}C@eW7lp27jR$m9Y_P4BQ8qrVd<eX)ev&7`-p}Xt3`WZW}jq
zP%m}5f^E630-;tLj=eH^J=ydvp_S1z8*H=adOw8&xvVT#Zm}8j+!6N~A!S}xg*yHW
zp$ZAL1HKdk$4gq$S)fjS3*fLOl)baQ-gMXSk$x#}It5khyWvr05oRVFta14`X&>42
z5jrNT!DcoP4Q6cnLB%H?E9_|c9~2)<1>lP6+sa#JR$b#am7F5X6ui(!K~2C-RIvHy
z^W~=!Knnf>sWlji45L)?1ifSn0x26p8MEZDlEyfXD?2|ED-ytvTKl;(?3`Q@{GV<(
zjuf@mdVn>$0Jl)^JDNCJ(!_fS5U`(*3zkvI%5My{9926_YOL~vZjc*8woO@!6~R4*
zd!Ca)CIiZU)kbj1cAD)pqEKkdZ1-Z*(a~|4vH<OvDsAFQiX=?NAWk~Oupdgb#GVYM
zKB6Kk2*$UL2S9*A&7BkcBIfWu1{obgNDP>X1~kX7D9L%I$Pkmh=KC8y$D`|qh+Ymo
z+(HpFP-}x%rf~ef(={=?sLZh+w~Nq);{tKJ3`Dvqp7;GeUOzpWM|UAbBxircKGZg7
zEC|Y%D-pFKYGoVx(BHAs-_&jM;6wA^!2Ee|#7yO_%O7PvvQsf*ZuF_R=#iy;ePf5#
zfWy^N2w7Ohe5Y@93D~61D>6(!>esRscBez-TyMd&iy(FCj5!2QK$-g}#P56kKv$;l
z%rMuy<BXi6i#MnH4TwLQ*37O?u!nXq8o=;sPoKet<2mR%lxhCa;!2rJ{<G^(!<{W?
z0^fB&HRB?JT_}#9dOHC<ZS=v0GM*Z}E8O{Ej*`nVjZADwC*Ek`P}COVZ)KVl&H(jR
zW3P!UaQuPw0<cA1_zA3Br=!kkEC2CJ%s~=Wov{p>tOF7s>L;dk3?r1s4Zb+UbY1I6
z_NIFbjovKJ0F^nS7)CAl>wUp5>+^Mna{}bFdzFrJ!nHx{9ubPeJvPZ_c7OaO&VSo-
z8&EoJ09?s@@iCp9*LU}Cp0{T^s{A;nj^N&)6d|4QV=!5GM6McM3B^$YTHTWb^7e74
zbt1f^e`@0A{zmJj(7}yJb%!08-h+r=S>s9_QBCcc^LFPfGt(~DryVQ1!%F@wOdGAa
z)88Nm9fNI&)78p4-QLTc%432vzSqUp12GkC?N_>?;id~wC6L##Y(GH}r<xRtcz)cM
z&M4kT^{zBAK_~xkf<KH{UzPW=6*wSFgO00LB`f-Rulm{Z@nq-Z;Qw*E`3Vsa%m<`2
zm)$bz>&JynL;r;6mrWRC1BJ?p#_38ZUt`|qfy0FtbcvcXDE%sKgQRwdmPagr+)Py1
zbI^0yjygz2*0nQf|55%e`9jvM30i|YJ2(XaY;C+7942FLThq_486$6ry(g<J*|ro#
ztg`tLz%Mr4@Jxt&ClkJ|cCRQ{Gvg#8P3ve0rqRD@(HupaDfKP@(DcAo3vqja4}Szq
zFuf8(D?$GhWJk`3VHnPnS1XFB*C}KnBKTQ}SL$}TVtfnlrJ5g(<}v9gu{yk+Am%&?
zEWfkK9eLV`N`jLAH<T{_ejfF01%)@zb_KCZLav2pL^N$QoCThGxliO%WxR^DL^G>o
zyxueDe&5Q_aH$<*q2Zj9Njw8j!h(+zxeQEva}+X*urJ+ug~DlVhU>XW5Q>ueu70sl
zef+^St0UoY@{yu7VnS|8NNu>rk>F0kO47}rD?J`9H1yOc2a2khKg=j!lK6q#D5DxE
zdt#}b(L2xhVwDS}%IbH@*st+UeYgOg=NfN*$g<y|VG?*sl^A;kk151$;gA;uLA++Q
z`%Gg&;@>qt;{^gy$Z!7@g@O6YRKWj)g50af!4EM|f6EP%h4N(CiAj80Pw2CY`H%2}
zXItejH_%ZtHwa=&h=@=)AqWC|3VZrM*p{C=4svx>hk^e=D|XG~LRR?UZuBajW-tH(
zY|BS-U~pCp5e-`>{}{SpD#oM7&-1n3=oI|NqFaOJq*?=V=)1X7F_XJa$dEz;9tDq}
zLuTLen3Tt`ClV6c6MUggg35*yugaqBTI*d$M;w32czozjf~X<$DRsG%wd9~|bxj&f
zkSdzu!l68vb3$dpm4_kS{{f~zS-<<KN^&g*6wf^AHhQI2(Use(S7qKV@;EJPep#p6
z4FOG7x?;p#9cztGhaRqNHLf-NZOcj}#j@Wy(n?df=_YzFeb5fjVsF@#6Ml#StL(>Y
zPU3X66(R)^pNA-`+qR-w2Ak)h4l@g!hk9-IuuGfuwk;J;GVp3f-blq8sdzi1;$4GY
zxC{2)U5XpkrTl3TgEKe?CcZ1@n_8$jl$zLv@E}%T1lV^phNDQ+jmV~kX?0!5kEFVt
ztCHpPHg6EV*5RNOV9E1@6kJdSgrQ0ei|fk#J7H!gYYDTo$dXuq7oS*V`wfazZjMF5
zPeKFxd6AGf?UM~bI&aC3q^MYQpugSf0TE>(@WW;xf`Ba9HlOEKVbcmW3dKmY27>#4
zKdg8p8_WS;Ms+vN;eY|5H2wr*8)j(~=W}#IA||}Kiw6eU=XMHco>4Xd^E8&iuu|R)
za6>P2pwOa5-7OwO;8DD)Eh6(c0U<14Np^9#jYn5K()`e2Ay@%3Y!Tw)fO-sjI@R^i
zH&{Te?L8<o56I3sYq>`dO8{)?774ioUHrh5)b0R!m&MhV0GNM*XG%s8x4^Fb1jqmZ
zLb(Dp$|q)lqJ+$5auV7vOo-;tKe|=_g&=dr2tWK4C55jAu5Lw`GS9-6?dsSkjt2A~
zBQgW3`IO#W)FjnGj5@a4xX0c8eMM%oVVALTPi^^*>ZE>?&t9=}mI%W@^asT&C^Wc;
z=gUMWB`fp8{v0wy19+g4GU=|Jq@wG2No`WgL1^sEuILm?&PT6X;98Q0nOftnSa{zU
zO565I+`R9qzVtd2BePlCU)LHB6a7OV9eAyL1ZQ5|w?or!ctL#OUc2C|TkExJYwuhu
zV|!g!KzAw7RvKn)ca|=;Mm0iA9BRIaEnTxQ(QOTfhNkN}2@M}eLpQ!F5k}AGIjD7L
z+XUj^;FqjaqS6TS^jXHwW^Qc2ND(KOT&Fin;{s#|5No)m;^J%@K?%-WQq?X6q6Q3}
zv+^thp^-~(%Yp&ETEb;skdy)nz|!+L&r%`Plo{j&5<ZjW^eGkAe*8A>$qp*3G)uA>
zNHIy4ed6u=lx7zxTJZN6Z0ri$C9R$!$Og$~+_aoPl^pIR!f68GZlyWfJe$wCcX;kI
zA}#X_{0T)lDaw2qf+9*fi@1`c(sz$W(z2s7q{Sxjp}PQjBnjPMnrm1dCX`s<0L90?
zABNa7EEYI+7)7rCI3x)!zpW@9)TMAFXQ_ZSCj>H?FrA@g%GU>8rt#mGa1Zg4b|jv(
z<&Ao$z7`vSZ<pG&^8=Ml_VC`0r4m{3Tku~`tD!hXia-1AK-D+#{2a5-3*~7g5}@OD
zX@|AUrw(a53%HNigVUrsWa2E{o9_Mk?v?sOk9+zapQ7Ey)K2<aA12esAZN+h;pleD
zk82E$V7SPI{`ba{NxSRq>|8X1ABUwek?(3U-azI}m8^5y+LiR$y&^?8{knv|jV@ca
z7XCUr>?&SS+gov+^UH@PHu}5cB?e*OM23$wBVgE~RKtPm8#tuCZ+LcS_&0=D3jVZF
zU_2mv$*V=kjVFyNwxx_O<Tbi2j7Ey;dY!7CFrnETIgu^fe?~=`AG3=T-0Xni$Dc{~
z3G5c9=v}RThkI$Bm6dFU$~^n8B!zHxTv<P<VV3U7Fojlpz`5m49OXHt7lpQtH4j3#
zIxa-ErWW>$NHb}qy8({{yY;NS&la7)r>fYqcJ_X(#7_{L^6DZN!7LSX<T|b;5BUiS
z@fx&(`Ptc|tOBx%q0f~k3}N&<TU_pJ-l)M$Uo!)2`2etKlwe|+E;gw{j6gSZW|%wM
zZT!$_?J+JHclKC?BW|<BTKlRdZ&nit!>8=oI2F$-c;hr+^0nt+*HhtyTEK!Z!oFvE
z*fPN=GB61?H5xdf?^}jv-Tw=v_gw;qnxYM;x1@a0b>QGClyKV}+%U*_`%i;@FtvWE
z@G`~M_K|}i-A9sMa>s1q#Hd}eH3vuiQ+0mSKQzZk^Ha}hQh$_(3ir77;4s(rL*Xy%
zQb4Ue<JJ{FMNZ1vg65a#4QLUsmoq~cEcT{6V>vfL;3g)&Z*x4|f{6$T1K+bv4SUQa
za3YyFu#5<M5bzzm)<glj)f1`b{Hfv-wojtq5}lJ=ILT_OC1C+oXB8;_NF`KoTi5#T
z??1kvSDV~m-`DBXRrNs0n+bS>C)s$AH3wPa%==i?8TAa?z*#zcHdZHUQ^nwMeD$-l
zYo58+D<^YT<Nck1(AkToJv?P^>maFM2l6zHpRq3(Be=Pd=CzC=Ysg@e;iIWRUH24y
zdC@HBFQJpL0$NegIX|r=o!gq@A}?Z=i2JhtET{pLXDx^QU~8Bvab`N60jnhrmBvCW
z0=kP(AlAlv{P#0P$~jrQRmPKtWO*lo*1*c0y%$E#r%#&ZyvWk>q#hZ`uiF%`XrPPh
zB$WGrqjvvJ_5;faeHZ(B2&j}}VG<Gto4VnU(DFl#TgyJs$C)_oIX$iWB&%M>8((27
zUPO6u6GfsJX(%gNn`WfoZMI0_QXM?;DB}-1p~Sdcuq@gax|GQl!(XSV)f0bVmla2`
zL0dLOh+9bxg0gPc(#4=)0eKX0Lil<Zg@H}N!0lg?){d^pp{sCxP`hS@^Oj!9FTcS^
zEYtF%kg%@&)V+_3WOwFdflsW!v?3hYRs=T)!$DwZ*wcM*Zy4FO)p$C)!=6@Vs^+bl
zrFw>Eo5VLU)4@*zvk3OI$il8^dbUP%YIg6>k=1_ttac90SJrf>GN+rW6sw9>B0R84
zL#UT6_78g5GJ3r~>brDTc8L<%lS1)<)+S4Ji7`B_2prSlHmTOR9YxMnY4uG2%5Ayv
zFS5L9)yubBbHPtgZaR3GEfLLl*dCfS4qZVu<ka~hhHPP$rg8wpDb8vAIhwHyL*QMC
z@@2w`ZxJ}Di2%nRVilnfE-)!t0!b@p74g2yofkoL6oOX0#+sESmXb=*3IpO;nn^J;
z0v%fs^Dv2Q1KTdMLxT{H**nnut}K#DBlWNH#ScB@PE^tUO6b6es<&-3*E$jQ`f7TL
z{<<VNNlOUvljZ0IiNR`NKW89TF)HNxEa(55ElczZcT=*S`?j)ud&qCT9WXbtJZxz!
zz?N=X*w?9t4J~pt(~OKLvL6rmZKcO|&s`fpTlXZ?`t@+zI<XyBsLvIEI#rgw_$`k1
zSM0c92%B_!ld0Sy>vM=SdtVK)e{iHF%d7wURO?QHOy2y)lhh+FKZ}1)zjEt<-4Vq4
zXQ#(Rpr0hx%+@-BSWiYVkAr-)hes*f%D?oMZ!aU%eP(;u&<zt?z6Lh6rjA1`FibDB
zJ%c$nmn{0E<|_*queTH~Ds|^(sk2|2+h~&4`vzDQEh007@X-ugk!gUHhmU>Ru&_sT
z-PL_&S;iw0E$UI-l3%}#FRPJS|0PlDM_&BMi~lOco<8xwaqdkz@OCB~M4A@rA=5Ck
zZ3Z#EHS7hEhAk2~juD0|^8AOZ+PlRYYgiXJ8g@P6+vh3-qCO#zEBrc^MoP*7M$nf?
z=DZOjsPp!_Elr?q*5}<FGiG`<dDgvM7{=~wU3|^+G~#0&A{AK{VK}fT!$#!TLFj5)
zVAGqwCIvqJ^6j~Wer8z*>ufzJd5{$u1R&-99XlF~T7z(IAtD5BaM)86Ss3$ZaQxEg
zyfJIDiAHNNMI_16nMe+`swIL(VV0A{Sqzagvz*3Y$X=j*fHun|Wm5#1`CkQVM5r<@
zp|yNX##wrZ{>+j^?XBh#oq-4aJT5+=oXz;qKu)<)g&)kyjz>~>=W!L?X5$lA9oIgS
zai6+g04C#+?O`im43i*YppS?GodraH2v6G~!Jt_YeCq3IlI{*+>Lwd6`t>Fe3MWM=
z^ee=^l}or8h)(-{X4%U$%Fr=vl#j6HKLY6dF<yL>Q`0wyGV?3BhtykL7I;|gugMg>
zsy0|}x_b9@@A;<QX<d_27-$m(ZDY&FPATt>)q@R71@fN-WfAR*&OUj}Qox)n24sN2
zxFG6yDq%ki!Tz{LHhwuT+O;QH2=mT!z9J<|C(kN>7xDuCDp!d3D(An-CjY_n$@L&U
zHUE;ULaDvo)c7AO)Yp^cT-Mgc%PUu_eE;wSYzCo^SeXL}wq3CJHdHhW-1AjpZJJTW
ze{N{IN|78HA1blt<N^<abEA4B9Qz&t^PNdJUKm&o3pGqa2xq8M9S4y|uoif>XHz|5
zQTX_7KDb<zfA)wU<K?((WcEh49)CpUmwlI+oV>}}yIAJ$^?jUQ!mG9I>6*V><!R7)
zB=;n3Ud*lke&LAVjo!Q+$KsE{P-KV!J6^YUcHK(*mLXf0oSV5kxXXCg7AS#3G}E>T
zHUbYKoe>**jE30uA}ewuPxmx(AN*mtr*SRh1MZ9~qE1D9<AQ&j&Ny@QR++|z;~QaM
zGwd05h%GzRaX?LiHQxzrn|aiAx)EMR|JirIG=ASTzLvqqvV|1YzBtd><;EUwO9Otk
zSb)cxGlov!Ayh(?=Yo|=SZRTk051(}yRxFhJvG;)V6msbJ7W<SAhW}8#35HCNx7Md
zSQk~1?|FPY^ejoTizDHE`&C?&8;QR#>%x7H5c9;PUma<o9hfe$u&Xl*Tf~TPpald6
zCZ(Qhnx^UNHw02w=b+b35I1<z6mLOt0n}hAUqv|!S$xht$+V!-%43bn?-mX_#n{gY
z#8O72<Zvd-5eGCmka?CZ6AB*}d7R~O8CSgY8rBRi0|*Z;Cz?R%oabGI={`j7<=?8(
zLcw-{_&}X-hTJc^ScIU?0SA!0|CfTy{dti=^<^g9+UJZvjY5V32s*dmuzv-+F7j-?
z06$7iR5p@cqGDMr<U*<)`iS7*aB867azP5dX+?KxwWO#|cw%5NaPWid^Pp><l~`+C
zcjEP`TSaxlz;lUaIG9k)g!>`Hp63FzYdM<bYt$!qf$Daa(AC}T$VF=pEm|}XVrP>-
zi;X@czCwJLb2eAKLQLg^HD9XtV;t>ou!-fBt#uwD`~3r<AK&K$u9%N+Sst>qBs2C=
zP6&S+(`*SL(78qU{%V_!nk1c$OwfU@X;WlOI;j0>A%8g5R;@!<lC5fxw{#}a^AKMt
zT==Je%~R3rx#?-UOOWUX0&&mykfCpQqV<C~zS+OHH+#RA3T5rAbVR$YYFn#urCMvN
z@#~L<uI<7M`1&2YgB4-l?ut;Lh)2+a?I;%aN!eHBullGjcIO(_jUpB~297*n>gk?`
zJreks`WmrA$8kbayQ-5>T|@2Yer-`qc}ncdlVh^(1<`puHH3^!+=><E16==k3eNr|
z*`e#ew9DUUo^Z0qQciE)6%|7wOXD)*hM*vi^$;emBX7(1U7z)#Y5JO{x!AA+19%h!
z`;O&d-(#MkQ{u7EdB~0}Ye~DMSbA&7Sw^b?BoEOu@xq4HEcReyM$BJ#eQyAmjDS#h
z+40L_Q41=KpSsri8b$dVi}DSFvi6>SZE3!{48ANuzI94+p}O1OQH~#VZ(EC<qa1(t
za{To4$+BSF*^VeVB1yr9pDlOf)9;p-%lJ$gpDDx7lul^xojp|uv2540ut6gOTf}BK
zFzo>AhHo=X1AbL>kJ{Sz*`kWB05~~*pDk4V%x&prEvEUJMgq)SQ22zAj(rpKKg@H2
zkQkclZ66X2)gW_YrPB69B>syrR`i7>2|%bhk0~ou*FI&|jzfSB4w}co!NGRgKOu7|
zzU}!_jKnEC_0YjV-D2?)J2>F45zsr91v)qo4UpYEIGCb?0|;0Ef6H=oaG*pjI5?21
zx7%DiJo3ZptIx1@XM4vygF23lBjSSzd1zoiAU<}P!AKDJM6-e&Jq`cz_N9CV@W3u@
zP4A+b80A68-)W#kV~KdIFIXOfu@iqmir9AICmD!PI9xyxWBlzWv{?`is92Ev6PQwN
zZwkIRL&r$v<!`N?sZ;hnS@;5kzbI94RU4SCoz+=a+^kgjp&qWBX*E@J|G4pq!i$=d
zPYla3sZvzrJjx=nOyGf~wY;7*-cr;kT9A3tZShK_q93<a?=r28Z}t~?oJtzuO0QRl
zh!gHkjX&@e-B<;u^LPwzavnZxS~ph?>12AP3aO~EUkA3*451%=FV)OyLyR3YWCa#k
zX+!7oRoY-)xee9yZ=L|Ty1Aws)hoKH*=lNT*4c{DB%}rV?>=g2U7sxJi#LOW5T(+F
zqkAK8W02?SdEH|N*{ep-;hF$a(%RhpuM^Jb>Uo|t8Wi=RQaRhXZO7^0k_WD9l3%Xv
zQ?qE)J{kHo`t*CBK-R3r+U@s!DH6I82ET{Vr$r2k{&=xFlTFHkNDFvaB@0`g9bk{R
z5fG0EwSB|YJs?kxq(C?c;RM2Dr|w6;<*dLSft|1QDSGwlHIjP*@uRVbi|I;OUqMS!
zgIch=B@K$J`xYsK1M!lf=R;AZ3qE?%muIE<A@vw?vR5l4&fzAu;X8I7vkNZ!LdjK3
z9FTyU_Y0eY(@^366P=KVp;vMGNhmSmIWP-l980(xWm83K8jVyBn~n1(LHm-;W6n5C
zz<`<a)(-n$BVtZYL=8Infin<WgfC_@%kv`~dJyL>2tDjG$Hal=(I~K4Wa?K6O(-ht
zEMXW=b(tL;Ts<PTSV606>}u<YQxAd9M-cbiQVB$Y#mJDj<G3HwZp1w(NK`N5ZVy^e
zi&R2R`typy&oX=#S=7LePJ9R|sA1pIB5WACL21YgBV>21@LL(xZ9Ia>=Ni-k(j@GZ
zI(VI^lYI`8B_IjX*DJg^BxANsXcNjkp-q%4wr0km;<6~&{E!EdJQw%@oR>#O{5@A@
zh}8UFULlOkt#}ptg2{Yayopx}=ARS_Ks#*0SKw;2ZvdoU(9Wm6sM24Rhfp|icjF<n
zGqR1PR4v)xyU$K@09jY=h20rGX;gPL7Gl%XLu?VMVJ~D3Hf+z;tT41q%f9jbjqr-J
zxq7All9h-gNp(94(mW}^cVy1OY?j9V0C8xFF3#fc48;YyINL@7Tyl3TRrQSrueopn
zHAQg>*9;uN=W$+wL{X5G!nMNE^El5^jtRqAA>)TL5$P6A=m=itl|4c?d&|Fjl4YNG
z(>|ryMT!>u<;nfxFT*pCY)RG4f=hjn4U)~kM?NA@B?qbruTw@ag+{~G2~CkUD8Tsd
zxTt~lT~%CKz0!GPBM>XwvhpS|<{3SgQ{F4f*p}-s4Qq}=uw{S~m?-eEO-T?sx<Sm)
zdknG+oX4Gv10LeKp%Ky<TBdwS;3YR15zm0_1(121!ojVAb!}vO@b*&+A)mJ{q<t-p
zqEN3W)a%2qS03t-3kG=nT}f_=etdttjXOLBR|_0l0hxVVrVA2&+W+x=k9GfV(6AS9
zyvUPI3Zoxt7x7||b7w`Jbi!$o`2L5!1Ypawgm`;d3clxgUBAA2wM|v+WUDo`zqcy7
zu`CH0<Q|jB;U?g}icM4fx_kL>-E>GfaWDz@Hos<!)%-mvMvwHn@<`tq+$*}3@67DO
z^Dn<%R#h(l-HNSF;25Um5*+A`fi0go*z@%eYp&zFBr*(2{Tqm_1;QLP?IM1wQtOuT
z=PQ!VmLSVLd#M0HaE|>@g%;w6J%Tq<p3MQj+yCLG=b%)TZK|Y92viDu<{Zpgvl-kC
z@i|K_QNl>hQ9khoKFgLMh;qp-XC%QFS)M2;BM6}L1qj+)cqGXs7i>TT|Nq&0*X6j8
zD_!(e;F<6d$*Cl9N!;3&XRFmMTifbxT2gx=#_mugG7}^=QH3&q62*!3iFt(+`vvqY
zdX#yR6Du!3;!-!Viln6Sk2Y0E<Q<vo@~v-8we8BVPLfJVCf18Z32Eh~1#lK-V6&k`
zIWJ0K=WV3J9|)u~;?^tOD`@6NQZGu9x6^T67Fv!y`tjBIaVK=PfPS+H3=;}T1Lr~j
zX=-6OHW3{{BD*Fx7O^fDQ!-O)reb3!){Ss&gZQl6M><!h5beYq)E2RFaM@ZQ1MySq
zZ=&-SjP#eI%etOd-<+L64?*Sz=he+=s|C|ydY0tH#aZ(cQ#&Fp%0lc1FYvo1kS>DK
zqC~O~@&dm?xtbwFGVx5zJ>s)VGNak-0*SFB73zD2v14N#H0g|%P<4z;=%#yMD56u>
z!-1VRh}*7@a2imQxXedh8b;KnF-iOJ1-JUrMw4mZ{(GA*N(i?`$s)^Z>y=p4X4Cy3
zzo4U6uYNd&RTrxb+f6~2tY<ILyto!lY~^?mx>cT&1h%=bDykssQ|qTiX;nqO5I@g~
zYspYtS$YMbVq?<^6TS{ZQNi;Nk*&@d)_!wUs|tgJE<dMg&N;LG=fD52b;UUVO^wJD
zrN%&Rt0ILAW-8KKRC|%V7gk0c9NrjhfVA?b=kVo`DJX?Aer@Gob(BCJVb75eF2X?B
z0*FuhmEOlkl3mQQnxm34o(exkclX~QP~1?SPb*Xx2xc_rh@ct2M!Y1bND;*HoMF#)
zvFqIaBQestk9;T&3tdRpfqWa1FnW=XV$X9>?1v-?3HNPh&rIhcmIm}$GMx$lhjx2(
zW1{4MlAF;RZcKp%7Pn1YBah#pznqKpt253&5o43O)IeKRz)GpIj%|~1i@vho_bt^j
z5L8mSec@;wNGPv_+|hLQx5`ov*Fbey<gDsus!xlO8=30cVt*{fnFQL19J5jw{?IM=
z*G7t$M@-2D^UX}^&TVwGII}tx{r>4KYZ8#`nq0i)AK=XU`@gj6#EW89ziDtk5<1fs
zJ})Yv!bqcaQP;(E39_btjCVB>Q`j+R^!JsRHz1zvP#?JowGs9Lg5t=fC<>f}a~{$d
zw5^A=Z!QbXR3eGaXfKbb#%a5O;T@*BxmL2u&@nn#@Tw;uL2ILJH+FUtanZ_(LL;g#
z`AphaGczSCpvYhrtIxpce7K`V?<hm~YS!F>Qt!y@<_M;>(WGJb<au_%XH>+GPT)WA
z(Gyx*a7`w8Rtcnk^Yo8dT3eKq5~?e~*zb$Xc>kQ-ltrGm|9<(>x*(tk!-=4OeM_n<
z5wg0HI(2L;U-6|m&sN*o?wsO&{gq&f_U9SjnVpLHI7~v%MyV5GgwrrWQ5;9ec2gH)
z-}7wDw<T53u|<l6O9}FCJ1{g$n$M4i3UtG(&@fvK$qyQOG;s|`1YTn|l9vfsy^F<M
zmKi;ets{PVaXPWYr}dnaY+|WzYGSF6>3G1)py>3vTyBDC!7y79dez(o2M)M<<$yE3
zm|`yX--uT?Au)@2f>;zWgt^a9Li`Ak5Zk^V2Vt0odzE^|kfcfmGNm0O!B_9=ffH8C
zLj#h-mM>y_-@};Jkw<)W>So9Hxg^1NKh|pLwf`C2`a@p3WdgvGWmr-rpvClRnEY%@
zmU2U(LsdPVu58pqD_P=3hXZ_a22;^$iaLXu&Il?0TB+Vm9;(R(G;;S4g&*Bhrn8lv
z%vBPcx{r1j)#CVZOcEEdB#04qVjm@#$H<M`D0E{^JwLgRAoIS5Rmfcyvi!YTE?l4D
zFbxRud~o}CK1Z=lQ{?$!YP)ITrj2FjK=i$bn4UJIXOIV7Mh{z>{9Ob@4o&uOd8!D|
zUcx$kqCISI59^Pknk)g&4KQ<}Y_)Q1!`Pv11BbMuWNkptUwJ89d9yl`URv$!HsW>!
zgE$POVUMnOI|Fl4Usk_s3B(g%0GH0Xu`vqwzE0S8Q!Ff2ShJ#59zB?Yi4wxdd|npw
z5@_r;iSKbo;(LN94D7(;C?FUTBXEKuH)aUqD2QD*j6AkgI>xarJ=h9Et<^}#D8#7B
zI-2vc3yM5mhFk41!5L!za1(xG{bfN)Sj-upSpR!51NAe9RVYg91<7*GtfP{HNTjI&
zi&FeQxLtqz?sel{9G_|<_<uxmN_-ppge1sGaDp)Nd_+?0AQE_v&%A&~0sdU@u+2fG
zc@B1HdsRH^hmfDgk8|Bj*IPm**bCNZsKJeow84uGXf;$TZBe13$&Xro(`(-~zJK+y
zU^H0!o+x$Jc~PDnYu}W`)H~mm#eBZOOR8MMmH0ITPc7LW3fDUJR6t@o8%Gs3PJFw+
zKU9(SH&I0I0`*k<Q#@!^Sv`^e7LVG+RL|582dM3?pti=B-UZ5Dl$_62plszgH}cMS
zdHuO<{DOImYzF|A1S$jA@3$pLxsMq5Yl=C$MgH>0iz6IS#GEid*!3NhBnd_ib-Cl%
z9%t??1X4r35u!^IzSbyI_a>9BS53y%q&0C^-|-p-GX`A4agsWTha#I&gn8s50ycZb
zIJeUvv1uPm{dk2=J&FA=#PMLPjbLq$A2D!<5_>o&$$o`rU4Hr=@egwa)l=60Rgqt(
zifEz`&Zr_ik_ldW^wma&c~$MmaC$`E>UdNHTn`girB+SQx>=?unTh;pN*HBXRcA9=
zH&fPqQ3#sMB&2IQuUWIUl2r$<Ew6ZD%&HOwmHTEG=C6BCDmwYPV*b|(hGPH_|IrFW
z^7`F%^nT(5o*N_XkN{!Fi%=9g9EAb%LlW3Y96osbbaRv_I0?(%XAA<-mj+DV=o@;w
z3;KI-$&bU=m4qf>fx7)1211OZRmd3qqg0)wM^o^%X_=$Sl3e^PqUB+qN;aV5iB%OA
zY4~Y1^-pqRO&58c%^}RB4RBIYV=<!~Lh;*29hpO()ifuIitkp|`0DY7pZNvczba(O
zap(P*N+Z1O&6Q-7k$!js9{uHF5AT$5y+<SS*fY1SbG<*B3|O08rMtvw`fg|^#Ky>v
z;}qc-+bFXA1O-u;hB)*S8rpYtb4hRP%k%fx`XetIx5!Gvf>8IG#7HvPRmT~qT!f<5
zHlc1md)0~zS)!*Ci{!=ZLKcQL&HAhhUR;!9ewk5=7DdT2;J~S@Be+fK1>+M7UKW2I
zt5C_stS;fQm!E)$UhW}10pN)Qyi>a}Mao|J`F4}^>dachR9fSv4w&7cnS(KAQ^!q_
zlOztpEM&kngHh^62~8;rDSouE7@gc$FVEX7wC$cc{tOHi4-wj6eKvqdLmDuab!8wy
zTdp_CKl0+`EG?|3@bSKb@9-Tc-S4vbJGFPl+E6dQQs1?t0}_JEk*e@ifAhx^>y`fK
zN6R%QLSGhX+nqEm8I?^`<inS)-A;)lV4jkB_wLFI3Nt7Qy&^SCj3}sQUO!O(fG2wH
z<fHaqY6gw^J6Sp5SwA50&0?xr>$+PsoxIp<q5!|(Gxh_o%Z&Cbmd}<|oz)y9oqo9E
ztYBRH{37Ey>sKk<AIoZNA|(NEB~ukG4FY*MxdpDJAJnSvLS~74PD0o9P{_g%VK4Pj
zVzU@=oAHoFaTNN|=XRmNIcWTIM35M}^OoN$tD>G)pSNE;PJb6Sg-{X8o3RT(E#2z-
zOTFK}BGk{IlbZQFgjTA~gr4d<DA<pi`x38^JL#^SL@A$x_A0>PhYNGJ7v?1=wU$KG
z-{<}0=#TU|)o0J!<}27q&MZH0TsuyX<AX&VyTC~5*eLM07y5P-xpw@JsDIbj;~!#I
zk+^uZ?Hifs;l0KRICkoBk0&VcJR9NI_fhP-9N7*}(;&vS&--L-?kY*-$D-y*QCtb9
zP9u+q8E6h#&a(FS1Bp_fb8F2rzZdUWZAK0Sxwq}#YT!N+Tu<|gf205CLi!UzuO#sX
zlq||`{?)cUF9>8J4uzm^vGg^2h**KQ{kTObT|qdb+!^;905IQoc8_}Pc-KPtzn?*{
zpX8h<sv0#GC|O<B(teF4*H8q^Jq$l2>&PlWXVF9lbo1D60?qeEp!q2dIKw1D+)aFh
zDP@RoFG4(}e&{4A4P)m{Hp}6R4uZ&={OxudPp+4<u||p=QF6+&_re3$u|;YhSrcz@
z2<(2i!0r`6-EqL;#K#`8LmQ~N8AeIM8S+w}reRD;crR&3db?*kt+Uy!{<7U_ElKeA
zc^Ox~8XdM5E-(zXo`_+#ziS0DOOI9>WJN<O<FVD4za{M5+mgVQ^zNLO6gaOg_&XKa
zAQWR(ERvib33=hD-=DL#KyL`g)`{iV_QZ0Jdq#<V9lv>M>jG+bYdU%($N0b_ykTJW
zKmqSnEaSZ4(^O-Y5#imjK%s95q;eHAW&KtZT0M6M&+`|iy^p1j@9dnxK<x2>JY<JE
zyLixHywS`{yML2ea!Nix21@vI<;d^`BfI^;?qM(a`&}Bt_;K42?8Zv<ncyhi7W3xR
zuXb!kaec?O9mhvu#5{x@j8TFyM}gxd7^k+2BfKr|m1A4ol*Xp?XQ(YA9Ba{}6&}}C
zx+<7~u2>C}7{C}n3@B%i^hY5V`dnIlC`L=ytT|N$y;YO8v4uMnv#c%zeIdwXBj|^%
zWqUb&W70hjQ<{V+hYXGcVaN9ni4z+|j5Ejc6Nf&0;PD1heaEeI?yBXrhRL!gf~mXB
z{L~8Lw3wx^x)iv!^Q^Xx{*+x@p8W{tK`!AfP?#vos?OUvOe|$poQs^Jsu!o$Gx5QI
zs-ZskmaahHUB(m~p)3#vRt9nB%o{nWrJ?HV<%6cON>h;n^v2=HO2`*G<9RVlO-Gjj
z|9sx;8KE{Q^k?5$CVtdN(@o%`Yqgvf6{^y=TgLxxtNARe>K%Lso7U2%=#kSVXBcW&
z-G=<k?$(N|V`V#Xp5Jhol_|O6?<!uu(>aIKB1~38b`1PYd#*f6<<Qz(JDk2p(!lUW
zD|+orf$QDCK~Jrx)|(-~xf2E6ZgxG%N7G|#fC&2Alg_;^bi@A4ZmNnZxIXN(<F<_0
zyT)U6ni~b=FMCsFJMd~fFXBCEE_p}FlH43MTTf8SiT@rS^x(&!2jl(fF6Oo!RfG50
zs`?u4uif=p|Cgq_Z=(9%X<)`#{uzG;2P4E+XoS#O>256$p%W%4<q=AJh7pc!8^tk8
z5Kf3qecSV6hdn5eBS1ZVnzzMVds~IG71hODd+PTI-|&5pq?EXb65=52Ck{$DwGpEP
zyFub79B-cC%X%{>Q-gTnWru7~{ud!+019f7=)_x<$=_EO-8>Q2$w_MrI62u2ARuL8
zBZ-7gZ38wP>*PfARvKJRPK4b7U<q|)ot$*C%blD|tdkQ+`wV{-rFC*5)=KaRS0^XR
zhriE_B<wFk<Bk}?Tas8W!5_S{&xZuDM{J)U5{53qgkls&0eF82vze2GcI@uRAoS<+
zmr7^288D+*6%5ZX0trJ2gy8aATIS}w%nCM<HY1tRTK=R`k4r)wE9G1mU!<cP(rQ+7
zQeHvq?&d5S6%ZYC6C-bEP-sey>6Ea9@c%|j{|6X@o<f5ySwxTfOTP`|LcO=Exg5KZ
z&RNt1S{PCjqDyErF5@X#<e(7S9a@8ye!=8QfR~SZ{T;L^2C=VJ7qf=H`e<HeI-Sp8
z%mdspP;oUeyn6bz3L(_4pGv_HF==|M=2M#!Hf)c{2FD%VgI-A7#ao3qGCSh#s3QX-
z=x`=F=5@0V-qw9ki@(A2i{zb!pj|VY#BGz!?i#RTKvAH=7z2<SbQ=ci!WSIMoaL$}
z_^X#oEUR-lDt$VS#4?X6(GFY+fK*)h_PFLDV4fqYN2@=XN=PDZy1j=v!^(5Gs7ZOV
za!l=}F~{UOw;0nu$3(DpH|lg}4<@7cWeaiZUd=PGPG!4`SfYe6A97+kEQvs<h)_b~
z7-5$(-*rRI{XSyx02JOeP`D?cf1jrC*Lw+O6)87h-`_7dSoCR+*x=zHK~C(5d6LZK
z)OrD4HM97{y5=pew}EDsd|s3)N0LajOV|`V$xwNdZqAw##;rMEi8Wk*EeQE#YUTVQ
ztFtMPc}wncsHg-KE~$h>Jh4jtKI7LCUI>#XQ;FwSR+|O#cUG24`8lf~Ik<o$*Oz6n
z09$wsTZIb*<8%oESyZe5$j%4=*|B3U^^yQlPC|rJAEVfIW0b~(Fb0^=IKA)Bc^7VJ
zN^%O2NX@^{**t}sQ)9Pk_HWKEq*vO|C=|n)DH(MYh^73xhIFk6(Kf22OT4QpIXklw
zQt`it;k|qD<GW|DS>L@`B-5-CJN4b0^B>v<mliR*Ad5fGiv@c&pN}C=TX8<&^)<M|
zHRGFgda6g&^Its^lM3st)hN-CwjbiJTFJ;ghg(}pR?vEDO?T~UaxHrM9jVFj@oD#^
zzSnkuW8JLMpAry6U$WlldL0C80t~}moik8ASh|@1`Rx4Nn+2u3s?tUNPO6jUQjQcD
zE~MB|=S5X(O>=BT)#{Yl#RV_*0==1Ynvq;SYy7gqg%s`n=d<%(k=MKuDxfMP``IRd
z+G-CinL2R%o}IlVSKK0bZozS_J2Pn+ORUS{+M1HtO?%2;!)I9mDo3!BG;^5WSTyGZ
z%t(v*=?3fb^Q>C8LW3fYZ;gJl$2Gd``lK=`LtV%fu@-ZSEdUW@@v<yL-UeY#J(Cyo
z*|YPP)_Xo<MG4F{LY~z?{f4(KE310ts=hgY_Jdfo7w5)88o%Dx+UZ<q@*H{1wV2W5
zCVS22WdW<D`Qf);urB{)#itpx)(2J$;t$M+8{G){nmb<czF|J=Bq`T6w6RyURiJ;A
zcMu*UjTW=PD{J?#+NrRMVMo0<udM6Kj9yyT(EXy!F0z^69)u3dy?qTii?6x$_U#ja
zEt|@+kkX|pgz!mbR<%e#Y_6pQEeKTMD}gyri))L5)+(z5I!q3!!4)tLT&<vP0*q|+
zo}QEGJHSk(d2wy-YV-Fc`+96IZ<F9puBdSa-STXC1d%BH4e>|bZilI!MH5*1=KP0=
zOkCaFJ3s#L^1I49f_<R5Y<rS`Fukc&Foo22<}m|_0+UK1jE;`#qU0n$Y8G*+sCRt)
zZ)0UgZ>r<t<FjGSosF}ix}IpVUBmyj#emSTi|vVhe0+T3*fw%(`*;GdD#Kjpe1Yb|
zss`hlu<Vc?v92%-^|=Fn6x=$RS)gZL)FWuMPicoM6e$s$M>1l18P$MDpYU1%EZS=R
zSPEqmG(0&cDha|Ly5;`bn6hG-7q8^=l2-u2Y6f5?Xz0}S`={GiCKESoS)0AAHp#Q_
zOW*d{o#d@>BG3bJ@s@vpSG13#qsSg<we@?gw#qFp7XL*ttKT&BR*N|=Ux8~v4oy~k
zUR1&!DGi-PT^G|OCd_5|w?}&Qrrniyw>R2e5cv*u5RPJwaLNd<I>spSZR!M$A4Z9A
z&)?a6aM1J*n*Kr4KWO>~P5+?jA2j`grhm}%51Rh&HGLr*!*dFLe!(UsB<RLA^FuaU
zRA6(GI2xgOJXJdHa=qL_)*8K78#x5#$~s!v8KHVxFMh17j-#g6n@zO!t(pZx+iMQe
zI=B9l=xmrvTfP1GWaU<Cv&e7Ojc?S(u~nl#7WD>$T49~prm?O<2BxGom+x=Q4&2hL
zWc{19P1mh6YprQ%MU{hz->&&3rI!tD?Wd#y_bk+e@7-l>N{$|IX{>*<HreQ3_5xbQ
z3K{{8dii89qq&%BiM}3k+94XT1BFXTUdfTJgD7^U@s>cvcJ4O;Dw<F}1<~6Mo~VF`
zZ?cP7mS&X9>IRGGt-vX||CB(*Tk!gh5Ag0Wb!&S2%UunByN&*d81@5BT$I|FK(Y@9
z#Xb#Cnh?Sw>M}QVo9Lf)G#bO+nkcBqjT|?LBE-WqL^$C#ikah~h=(L(5w$7i+fbeK
z@Oc7_H_Q<u;7anV1DR3sn~-I&Hb5;&Al(3Iw;ifZurpeu<V0pX(|#{W^T;i^$Dp~!
zMXw1Sp&}#PW_i9^8POuTJtQhgd_Tk_iV*hf1V}F-LM7lRCU#<nJZ8k@_e@mMpVCco
z)ovbh0?8~Pe!k{qCXxbmpkMdR^tV2U<q>&eM>40~DP!sKZ1-K{o`91qE!zd?4YQkW
zmTj~zau@@Fl`!a#Hc2x2Rpk|h(`z>g=eslAI!7DmzhV_zouz&JcHC{EP&-aS2JGBU
z5P1mu6eB`yjv@y;eq=MpOZ@wYhQ&*wVFLt%mIUUK%Us-BdyRW_eK+({9HPjzA?`Ks
zQ4~2oa+vMMoJS-{`f;y^XoUSnBZxeC-}Q;@MIhH8tLsFw!SyoYHAr}UemrO-!;qza
zGM1wjVj~xol9JljCz{)9-57@v6WfMMfO&FGrfb6!UX!en&@#~hIEP{2wI$>T>*(9(
zua4Uw1kuW@$f}z@<K8%1y2uLn9#k5URqz^#qr*y|DHRK^WDqi+m&LpUX1xu<7u=EX
zg(PxQjNJqgkJt#~6ixz`A~$82#D0w9eu(ong1gwtgVkS|>`~<dJ_63TjyQM>0`)-5
z?1f5;2H%rXa0?E%o%NRmDaowPW_%)IEv>Z3VeX64dLbdSM<oYYLNgT>WfR%(<9Dx*
zSBmRKbn=MMP6E#jSR5ihpcG+0O;BVzkg1A#9uDFl657~f7uq|Ala9mQktBcLg8XC6
zyxhTlZp_oyW60~uWepd&@d?P^vh-*WR<9aqi%KFn@yW<9X6?Ji*QH*DE`M12o+x$J
zc~O3uYu}W`)H~mm1-J^<zNE@EWOiSJZZy6<lzKGsaANnjjVf!LrgndKs3PreqKMuD
z>Z$mrc+jk|dLsWV9<@uUo~a)uU%3hgv>m%q;YQYcM2}OKQ}12ljOe~1kfxeZdiY+u
zF?#PwQ0ej)#h&TCQ*!og36nhjiaHqv?~Iq$N5Y`^9TZtpG}x_D8;5BW+n$R&%sqtd
zG(`y*VzJAd*e9IWfZx5n0B0Cs8?EEM1i1AA`?wad+N!Ekr;ns}@qA8Vo1qAc9A3;v
zNsL|OkudR`m;|=>IoMUrDeM{2%~?8Yvgc&84UFC!i+GPC+V{~3n;Xh}yOT|CCz`h8
zwk<==N|t8n&gfI%c1LYwnN_up^lrpb-E!C5MJ$6C)TUI$p}*o+xy$sg15ryYf?z_j
zOvx()Jz7Xz)~^j*shP3vi$X4ACWTYmc}+O8m1sA3ZF$8LV^-JMzjg0PMJHdaBz2ps
zU0x@<z1CCD;nZdhvN3lMPTT~=NgN?JbfcIO4=4TH5%+!-HD9hUu4OZpz0Vl9V!H(m
zYo)$%wz+W5&b}9Hbx=w6j|H41@`Mms^mLm!^qm-om$)bUhm}05j;4SU(AQ>_CAs)p
z_*!8nNT=@c1OiV<8xE~JxXFz*UF3B(&w1OaM(QabWdcY(&7&_NG1*>?9FO_p=^v4@
zq)4khKs${I$^!V*9K}W%NqgQBhJDG5Y<Ee}-BU;(dxEbutZUox5wE^(&a>SCg<_v$
z8;3DU?Svxiq$!G=*g=7ZlfVv`7kGDd0!TO2%k%fx`XetI!|_T@Qt%En$!uh1qK*eh
zc~eBKZKl<JvY{2}j1>PsUd%3JS!mL%&br{mMM>tD8MSCplq{PGC)g33$@PK>2hHq4
z{3%%_#353`eJD34SjYSMl7xe&%&IG^<QHOw1hI<zuq3;yPP(h}APo~Ajq0{Aw?n-)
za4>VImm-!11mVDsQR0L)3KJXzGzeG_q>n_H=;t-+Br|$>-liyRH<Zpx`nVxMqFUoR
zGW!4ccpJK3Y_ETR<i*QbT3Aov<9G-A{2i!S@3Q$jwK^*X_ey;?CWDl!@Kk?O#}n(7
z{-{RFHD6r+7H->}G%XpGP2~9AS=N`X(M*XXteld0_io4w3Ueq5y&^SCjVP#om-nN@
z^|b3R3aIJSZ>oQYSJm{&NA17V6dN7r<R^q@eSU>Ei>Yd@YqTDAhhOj+`+?VGM*9`Z
zXUnPvzP#r{_J&!(xcK=+#&g!MQrLl))z}a}01iZ^b=VRG49E5lYRPtSq5HlQv(WJo
zqhSob<_JZc`G^D_aea?spL?I#fe**0@z0TKcDp;Fe^x(%4nEo7l>U6wwp-o?yEx{B
zW+P~K2B)`Lx#dh~jiLnvUfuIu{S2y<L0B$yDfO}T6t;djp}KwHXaAiPE|UlTGf9Ih
z@S2B<?mjO%MP0Ov#z?wWx4#DUsj=HI7~c*fMqP|}lyHP&?4dYHDGGcyjDv_f++%mq
zZUqETr+67Ew4KDe;3_DyWFhXWq3@H3Z{K2Bn(`7-0*t{6;dZ^?z;GvTR+SdGpT$?a
zDsR)Hi;~|6-nHX_E(+;(cq!?o1;S9Ld{J%6o0ouQU0L%2<|Knmzc2~FDml9*!WOIT
zq{5E6#se$5HdIq73lonf9FYL%id>f>l6WD)B&BX(+b;9jJxDFRHIdAPAR++6r09Ax
zIaUq}a%#P-!7RNhH?Q``_7+sU4-H!jf$OYcvWE<xq~xvLLM*yS;WAd)mtb$c6RK`A
z#zi6H%@%on1e4gzp-f%7QZyNs?+YEn5=%_RV_&z-qdBNyqAum9Jq79@!|XDFUK_4*
zUl!xrMU9G$^X-k?F}sV8aUE*AfCVQ(h_D+n6my55Ac{yD63%>vzs&O&PK17DAh@2p
z7HD3ImWFxS?sQ<UPGNpH$M5ePpDayfEpkTN@Rl+lj-Th7WpF;6`g_q_??GwZ<)Ock
zD{!MrKyB4s-2#adc|NyO$Y8<{#?(VeLNKCfOky7g%#O)JMoGGn43iv0$f2<SIW!(0
z*M!CGGq%#RL*_BtL$OCV!Zb=z5=03~BhTYJWM0Ih#}iwrVgbe5mY5R3xT69UZTq)6
z+!4_t&&j;v-{?QOfshHISCZx!N*3ie|7zQw7X-f(v5vZ#Cit*sMr)uYB9iYt!V+|5
zoo7~NMv%1e#au_&-D|*Pwdd4N_1fXC4|!~JElnYn6A@G(-RcC@{#=fxAL$6jg9^Y_
zTn0L#JgaJ8^=ERLHi%#JM&cJS^)P2)f}(&CggJLmL;^^^6j0ak2==gj7vs)w=GItv
zl&DZ@#a1t115XfJpyZTi?*)XdBkXFFnGQq+rjd%PIi8XmE8!NY1%QB;mVgil=)h&M
z$QeAGmswF}b*95;8z2F_Nq`rQE&#4=k!w;)%9*+(*({q~oI+N3@t3ZRN~}3x<RJG3
zB#c*R1ei&+<ShcOzT`JT?&Tlm1vFn5G8aS1g_DMIE8!K0&#<X9&|zK{(|MiWs8nLm
zJP6X&qMBz^NbHSFEhcUXAG?*@%t<9aH#wXJ$u8RyfWb?i!Lgqd9~xuSTBJ>fe5IJn
zbfku%YA5$A5ABFBANfwo5GFoGiIY&2#*WJ!H^Ibq9ze_5#z)uebAQ=Bx0YmleKb&w
zft9GQTs*ins~65GsuTwDCX^GFtNmH~z_Rpc6%Iu-GuqMKh`%N5-P@ADh4Sv4mlU}A
zFZeq(N5Zqmibaxh#j)4x%~|`r*Z<>_hW4+!CcPSd^VII>U%o)4bjl1>ux4aJ{TdzT
znD?+-EtC+Q7V(OU853oC!w{+*flQHNj;!BG%iYRZJ77H@f$MRHTHItTW3IVzMmgw4
z2J(;{?rh>ghw&{sj75igS%8I8aAM{No{|qhoM*2d*=DfYMa6|$B)cH!6qgM5^Kx#F
zjlggL+`_(nuLg`Y^iIXRIiYt=ei-mD@%)gXAdFpv9qOaVODW<h;hsZM?((e|36+<%
zn;qT|n+%;ngtaeb?07R(p{FUeSm%|n<$)s?uI+LLu33d61~tt}Oa6}qpMiwk$3+V@
zO$}Jd;;rs5EoNC=0B}bLStI!4ZG~w$b2}HO9p)q~i5Q9lCq_7m5)^wrL0%X;goR#e
z$HC_#PIu66=dRim8rjy`k&jQUXJS%7;8qs6)*m4hzp-w?QYM6f(kG7lc_X1bS}(+g
zPTj{VuD5|jlVNtn+l%naTorql-mQI#@0)p04$}MA3mn7`ExjLP@NMSvYnHZK%9uwa
zaBDGax6-!jdpsqKAWEVb;h6d;akz&#b_um@KZ(8QL7j#%x`hj9pUy#sDYgADMKn%A
zgzW?}GBOYOZW`NR5Hcs-oVQ0Fyw=O<oR?KGli?8m51Gz?XMOwq^9G!1>LLgs!*NxU
zL^_N(#IOsARQMRGT9Hpm!BpA*X-=x@8|&mG>oh0{Ijc<g6=aX#HY$rLuw@>7`~CCd
zlM?}<NkFkMaIC|6s(DeQV<ezt0l9<fOwqU<efPt&*Uu-`cYl8Q!^C=X{sI^;rt@cu
z`Vu1e7xQ_3gXkp)(NOK2l=V!wFq?kSqAa--Ql-B_BtAzXu{H%sXvVLR%$44-Zz4q<
za4~C~dUJ5;Fy1;`(riX%kg{Bcg_c|>YVc37=_-v{YA{9!Xg~$FiHIa9Dj$1yZW<Y1
zt<uTKTTZ5xTI}cGkWC61VQ_K+%eus`)~z++R6ttFOq@gNi`(C4>iAu<3q~SJnU7ME
z0ySnx5DAEjY(MdBoN&i>cNMPm=ku3JRKFSEua|B^v2{&NPAFKg19&c#@;NWFf=#5}
zCo>SppA?6`q!_bO&V|w@JyaPu+UKOa0@jJm`ITU?o|>8Ft<9mYYgrjOM~HZ(81iTs
z8c9*4@Q2Yo;c^3-9!`zsdhCl$bArsRTS3C9oHT>`Nme!`R~)IS)I~I+i}92!a!{e{
z4p~l1>SHqSz{|(|P7hj@L)llmBGr-nQ{_9-N?>o;1Na({A~qZugH^N6EU_+H8W$On
zekuhQ(WL3Wo@K3-ZrTMV`!KFM4>~42sBhJoXm-WjSyu+OkwGuSbU?ncj`7ayjkkSo
z^yXN<I%@X|m$+oWG@Hh4)9o%CkTXG9U}72zh%?xp3=*O*m{BClRZYXJO6wCSX=<0-
zrA}%oTQ*6Z)cQL1VTE7AHUcZp;T9+5&B`&go5mcI>)c{Y{~VKg+uhhCkXog>+=t-N
zh(mCuT+K5u6=u7OzmA=hF*iz)=TMAr8e^0MHbIU{SsXHq8S4>l9I`6x9P=lv(A_}2
zmAZ)`;N2_uZ!Y?|NA%z3<L+sYA}j*#&b8>k?`Hxw3iZRSn9XXQ=h+1ZIy3>(@6<al
z3ysu;Znr)v)RyZg<;pkqyEa*Z{QBVEX;w}-v+|<20_5lwZ#-#AfqKhl1VSkRb!ffH
zs(Oh^B=-yG%R`tU_Y&9jT#6#w4-k$W50SukQGnCX=B^us0M*{yn>g5;s5kY-n#kk1
z??7Blv%3UV2(!IzH^^<Xq&L=7X#kt$Ns}&0x#fGxl~97)=+lPRc5DA)yKFC~^Q9@%
zc<cv3$Wr7blp$=p9*TLCqB!Qv_7jSe)V^m%4B7Gj`S1U`c1fVj((Q4Nnby9tNYYWY
z_ep0Vo@~S>_%$RI=uFEY^V)r6URyHdEssMZnct4Ne&l4`9X!WLi4z12rJijg?2-Tx
z&&7ywCrZ4OrI<SVx=<y*=YXtpgn@ANB`e$9H<|q)C074-uI_qej+5cr5c?Yi0ZKiL
z5hk&Vh?g)FQIC4mXMP;9FZaeYSFT&pflU94kPP<1X)K0#CsJd%#n-SJ>$;X2?YH4L
zK9K7l$n_s1x&Fu{wPO*4GCv616ggfZF1Q4dl!wSBfrmZrk;JDDa>1ds*V_u=W+^NG
zqa@^)13obFA8xN(-d+cW{@vm}$^5eCP*Yw%I5-ak{&&ORja+GWrtx0`GYdT&$AJ?e
z9$^<@Y;#0>-$#^15svNHi~4zFcB*GDq5XdlvVVQKcKZ9dvj5*s)gMm};6yQT2z5~E
zhCaeU9HJ<)6BMQ?;STqi8+f0mroY>)0-v9fyPx#LLyXuu*6g#hQJZlWuV&J3HKE!N
z<s`8Hg08mGg~VsNl;7)+zTj(1UvS7yu$Sxv!|P+GX$nG|1P)<{Q<ov^J0Xfa>LX_J
zIAIP>T^>Kk#q)^r6zuR6{t9lc&m(t1S6<m5iNTT=w#sHuEBN3NZ$_n=^8O_G+^r)y
zH~;e0Ml_C1`WKoL;c$CCK+1#e-KtNGUEQtR_mYr7I=>+D5ccdCB~ch78YVo5{5W>}
z_>PLdj52s=q*|{RcR;9#nxM*rfXjU!5H;D^WgxYPC3fm00J%U$zmR%9NfGvli{dm+
zkrQB^#J*<-Zv3bf@xhKbfYa_5oF*3F07}zyC#K^7M!OF%T5qcN075g)&fNuS5YLV%
zi&2u=KEiGkqQnMnP8@gvvm=K@?p|)mF93w5ugkk%hvNV=H=;3he1@3orU+xlMKMn)
zih?MKeLHf4Ao}udLvyuc1qZ;{0dV%n0B23y_W@`IVnz>(uo;$q@Y;xjq=D$Q00@%v
zit-~B_-hXWh4oUAikiqivW2DS^9P!Z%Q835K4hvo6~+q{Z7kvZt=ai4*P;wHg9pF#
zBp!qOXJu8{tS$*E%8Ri|3K0>qQ9XhOWvq@Hp6A8&j)bq>qwpN!crK)4^s$W*W~q$H
zLLTvKJ8}u834gRGyul5BK;Nls07_^rAOI8u*9I>5CAii9{<UA_2h`mI`zCsd_G70?
zzb{ywaZBwRSeJ$@jicB_kq_wcn0hD*y%_$JgxGf?k9fPb96VA$oi+q~Jy<%qGUI4E
zk47F3QyckS>>!*t1SN@|AjWOxggA<L`ncofmI^fo6x}ZG`{v?3pyvQup^t&%i3NUX
z@%I=6qdg@0dUJa;POMkWq0&?~(YZUVFI^Enpy$f&g+D78e+~+<z>xM?eeVN3*IpPK
z;^+J^xy0}5&aTU%z@~^KHbXe{IZE7^BRBSa+qHwprr`lUcjxo>b5c#eXxyAhYq=6H
z*DJUcPVVa@?>G2DKNI%;1H|ofg1E^Ywgt#-qYE%*w&OtZ%!t_zgmA|ww(S@N*k{ys
zsh5a8Z=U^C@`XPaeBqK(`&=@HTdzUMJUZ7oZ1vBr2Bi+SlauF)P+aTaU0*?E-4u(`
zD#{BoQ{S)F)kMOkF{NAbKwTCUw<<C<2=0JTkdm^@8vV99wVqjZxu^sywdy1=m&3@i
zCa;fGEg0jo{H8GusMjHyo50lrio7H^SG<Lnys1wmqHRgknT0F@|DG1JA?bRel}>4n
zpnawDJ*Rb1o}QenV;TG_FG1;t1hE<?sJm2Omc`-%xVQD-=_RoE<yOMeqU53$l?+*A
zh6TFzS>0rp1=|HL#V~<#3pl*>Qn&q;{O}D2VGRd47b$b~g3aYcFZsbqt!Eo@`s4;#
zA<a3No!-X!Fx+=z$O#&_)DHvXC4g!P0uK@Hav&lN92R0bru)u`HMfdIE$5_75v%uY
za??JQd*VG@7m_LxE@o}Ske9>=q(yusGDlMLdGtPxBVf%`Zz<k>EggNmsKIfD_@C5b
zm>t#PSJMf}nr%vV)jZFZFo91*z5h#OtNNSs%WA=|*F?Vux_3tM+jqv~=(JFM8t|t}
zsukY(qubHvOHDzl2}Xvl<EKwW#!2DeUzV7wOUBn3)bYfajb-n5%^YSzEM1qB-=0p%
zhj*RoC)UduEvDJ*LYDZCtiDv=j+)Mml7|hGhApku%pcb6-B|jtHa%Fk>}}J7=~_%p
zp<A;E!ck|#^_f0MM8TzF+9u!cm!)jnLZRp_!TlxD8m{VI^_k$IQ}f;_Z?2H#*H6W=
zw7t9W+YKd}9b!uev2jR|<Jb|Pdm|Ki9!G&giRULij(xIi4%kk@TIE_wZh901XQ1<F
zeE=w@r7F-!Lc`>&jhhNco3_oW1feQ$DM6N`%i>!5X$<M9Q=^ojCe~$fZB0R#W?5Bd
zGg>$KjjrK3%x3S4{5@xrCPAslhQqZur6nyX6*rX?sZv$6Xf11FW)cjM*9ekbtZ?W_
z_V1%2t@+I2A2?mq*?UM&RjSlV+^TAlrpMOxWg%3O8Rx*NUYEpV7%xhTT$7T+{B7;>
z>rR|pBzdB!EtWVuq%OfIPCbS&2@(`h$3-FYd7RqBNp_aH2zH;bgO=|YvHMgmqW;oO
znnl!da%b^!B2=zyW-QSfnR(;Xtm7g!2xBXR?8y>&`uMg{(%T5)vT-E)u}dgWTe{Of
zd0DPZ82g=CPo2h3{O{>76^`!TNEMI-Q0@Vp#adJWNsiuCe3(yXV)>&z(I52NLgchj
zJ<$nl*Qb0^bEoSw6#;XKO)1f}2WRavQL(8@h-pidlog@aBaJ|LJ^xDZlx2I10_EUi
z)oF*+G>f8gr@bR(Np6k?D<L<W{O_@7Zjd@iHrSi{zP#B+dvAGVeIe1_OXTg(AqX5l
zDCFusQ}4|9_519<Ho0U;%H7BdVnou&MK~lJML1x{3FCxCK@tQuzmM#qgCXejqM?>%
z(YN0}M@_oTed5oOFb*AvTw`_=ARN*VMQIQq-;VttiK!pZKK{&IC3*Z<)I2GQt3Se!
z8u>#Eu=$!f%i3=&tNB!aHEX5k-;4JwF&R(cbW@pnZ2Px5-w&dYymDUgZ}cDCOh5^t
zSJ0gqgOWx0&A-~V=LNy<M6w^1o2SjvQ!}GAILq!O#gH;kJnJSYWeRh<Dp~2hrW_jY
zCcWhJs%m;WNJF%B;vtYBn^?BdCaao2elk{lV=bSXwb_SWKwP4dWm1ym(7dSb3~D<Q
zmA#j~1L=IZp0x((UP9TdvgV5<&#Fsk0>%#TL&}+TG=ExhkS>m;##0MCAsk&<1zW!L
z^hgmKau-#t8zB+-hbWmbxlSvy5WSHL>yM-&iftAW&x;U?F%Ub%5lX@+LP^SS8hf@K
zvb!-lj<1xAT3x?`Pfp$l1ODo$)$wG$Vgtg;&|(VE&=rlryu+2dX+A8GI@fd|oLWCu
zJYD3X;Ix=!bpb~0ewV5RrJB|WwiW<qhl~&)oi!>fnH5u#L(ptdTJxe-X@5nUFK7X@
z+uP=BkZS`ou#`js6PqNl&5`djhHy#(6uHzxHfPiiDYxSwxM%#S5OR_HB*iRN>vI)-
zjXoOHu$ZS8aN<6-jv8-^5&F^nG*wK-@u_(4SZm-g&q9wF>5SPzwU{0?{}w$;Kqqhe
z+5LL|{<TLDZX7SzOzNtjzF%&Erx2gN{Frtdix<YRYctPAw!^TDxKH93qsaHTZ_}8C
zEP9}$<IgXDIGh~oPmVvo{NXkS$Dd#Ru-UoM)-R3?_0PkpvBOhC&FS`0yqg>v@EPs)
z%t%r@PE&>v=NuAwr6D4|9U_OOK4vlXg1(RCzRrv{=PwRN#@Zv}&H0O4oEUG;Uu<+>
zw6()|q5gF^E_QcZs44B87V||p&+jZ^zz4M3!veD)NV(&oIEG+<pQb1ZBM+q>=W&En
zk35uaA|%Ett9f7VJ*X?|P7tk=-{Kf))%gw1l3qJ-pqM`$PL<uAD(1Xy%jCAf!J@0*
z@#$j6L6k&pgj_ELuq$y9@i{>eNxaw#T<nMGoh)O*sb@ma)EOdmF_^4H33e;x{5~E~
zp=uz7WA`u=*3r2mY!&D3v9L(>@vg%3A<rt=n!(dnW)~OW3_Jz!TE1Y-IoCDc8W>wj
zatc-wUKvIiuoDZU(Y%HHf%Q&dnCn7-Gjh<n4VZ?~uWxD3GE`YTqa$!;%y1CJ1o0$b
z2*;_9BA-MkrG!y}?Klk|M#MA?S{uYm8>`=8k3V<y91nc&G7?^wb9&{#c4d@371=Vt
zhS?;|u(X*(Lehu3LRvOgZvuD~Xd=6N_A9p2Z3%p7D}M_MAl~b7tBm0*wE3u0G)s>v
zUcb8})jOW^DWBCx>p5W*h^EUEbu318?#Qk5bZkdWtaG>Xc!)~wn=CiN4flp-fQ5S#
zG=>&dfS+y^zj<nR(8K~K(k(NDh@3m>G#8i(Jre-CICncw)FcQ%M(3!PV2n;P68r(*
znc4}WOmAG>niQ0H)f}2uSMLk7y55Zpr(<Y+?7)mAP~Xm;xj($LxeG@D#v{|W!8A=a
z1`*#K!@L_9@=y}lnOquRH*zpxC}u83IN>oO+_918hY^orMr=RXi(IP0dbL|xMerCe
z?m<#D3H-;~ZzQE#$*aP*{$Qf27}571>M?0`Cw$bgmon;M<oP&3*l{^ZxEG_8(1dZE
z;#44=?wvdcNrAT)%ldf>y`xl~9lh!x2|o%+Sbub4opvh?j}W=;R4(pxeIwa;WU#l9
zk4LH*m63<#b|WWukA4}dH)v{OS-E$SNO^hP+#Y1+^^6~C_6~yc)`D|?OMb4x^U|^D
zq3vC<+7-#@m?i*XSy9&C-l)$2K+AA_EnPt<{gXmmySJmu9u*XKr%c3@cwrnP<}x4Q
zC=O8K5g$36Cj<wno#0@P%EZgr!zvT~_CI@N;^k~_%7m8^&!av=Hctq`p_8HnhbgkD
z<5DLLLz@K;s7z$DFHV_QI;4X#@mS32`lH)}GSNxpuzNK^cY1R*qC3o6s}bF5ma7q+
za=TO`bj7XM-)U+~HKMsf3^iiK+-|H!m?4*rZT0rVD35n@8l5|5=kC{>Y`42K2Yuw0
z`bfLCzc_v5C45OmdGT56BX`p$3|Vn!LL%Wd4SX7+AmRjJ=G!Q7!Voz;O*u&&YGeOF
zV{0R%gvKWHX|Hj$ksXF%7{gSM2;m^%D6%~l1#XbAh<X7_`jnD~xY}LE)xOBeszz`N
z5?U)F&L8<T`YWF?Pz5E=!nPr^jjC_z4pMyA`e?=ZOtCj|D}`Rj_&!C5Qt@17znJqf
zE7&P?>P!?vRCQKRf5N$Nnav@I2e0OwW+cyVtYQZFHS&@Zb|YvzZ%pD%WD%gL)GV6w
zlG8<537w;f9h|J=(v*>@T?S5(#=2S?MEh2RvnC~(F*M`X#*}mkLP;gH;CY!95E5pU
z{C&o+f2SjCfks9WljbB7T$%|C>uLs3x1xFx7pYjE6g#IN?Nr)cRyNc@{TNv>4^~R8
zWDpi>`$^<s&qp-m4B?1)D0X6wyeLXs?#FTHZe<sF(OK0tv{!B#m`HPLot!M$T;h9>
zL8{l6T<oG7Nr)tOm)LM>cgam<9SLqI#ZM|q9fNVhs`-pSNUcz$Aq@gAt;?*cixMV0
zt6DP!BwLv+vKh~T6zN)bW^-FbGtYV$mv^#E^zR(%hb&DKj9AJNgo(pZ>?IsIK}upC
z`2n%_kRl})JY0Nyowob%$JS_KRf{qu6n61!a4hI0xZ6VZ50~-N0{E7f9s_c}o}F25
zU!H#>ja!VjVey1gK8Jxe<X#IPL<DVEOvLvegpo~KtN?N>gW)fM*RrMp+b48KM02vJ
zbiTK<vz*ucx1U<<W=5tNJraowVXle_*y5*x21f$IlQO#^Q~l#F$G_VZAC=av#mX#W
zHyto4En_y7jStcYm|RSHCK~11Z233Y?Ekfnx)U_QE+vkoH=NI&PP18SO*x)e3i7BZ
zJ&%qjiU6_udzKy<eKa{td*q|daLry0xtN;%NRs^}jGa$@F)SPg`%;h3Qx$5NJVosm
zRR83cr%hAsScT><^E&CDp8WE(JMORA4cPOAtX0E1leVRT1(5;kwJXPKZiBrN9F1b^
zx?AP*ALNGqsljz_FlFsPg=7xpiA^YS83BAg0Y8HiAmVvpK*A*Qovl*g{n&^sjS$+G
zmRHDMy*Jlf?CL%j0;?&S8;trBLDq@P%N|Jf`;ziNP_7Gktx6(GlUJXUGQUCBq!iro
zl4buE!kHf8ZiTaixp9(kj40zS!f{LyahQ#`OQ{cDBhTBvaJJnd_NBAct67rSm6XVh
zb<J-KfqW0kD|+8hzz9y)@1GxpvHKOql$US6a@Z@PADHg0Q2|ZaF`h1G?=-j@b*b@4
zmODs$UC~ZXNw+fV50-sf(eEz8UBjo@&cY@VAC!Sr&~@t-IY@#BNl<$flm+pN6m#3J
z<;xu3S1-ml`JZ+w#)pi=K7h)60)k)Sazuckfre4yI0+*-jqcMEv{n$-9wO-`lh=vz
z8SK?X6x-Z)aYT?yJ%He)9*TmPB8q()cn%HHWb-(4>*v?6OcWi6hVaw#Jfl}uLnUkI
zItU?y0<<Ox+_~>FK)y9trEFFg*2&4wuV0~rKz^<keQ<IDVzab<HWdBB2cmdCNm49o
z(FY2BsJc{(Af-u>x0pephPxkRY*JY#CqRBkf%Eg^M5nmg<8JA@4HeAJ#TJly%x~2H
z?d&UY9Y4UH%}~l|fN+!~h{Pm9o)ZL4<fcI!?~3sM&*v|d#3`~Wz>26O=0<vhqc<ew
z)~jrGRq6FoTS%!*da)(IaztHHnF0v>6DbW!l1oZf2rK1WXg(qayv~5fcTUPHu>C3x
z25h?*B>|DW!xs3v_Oa^QQ|sq47kgXUZjBOxAeA$KW682w7=0#23UaHZvjvD6zLhUD
zwqo<gZ*SfTE4z#(7Yc&W6ag}=HBBkQv8eQ!ED!%4c394pP*y0(NqM9P@~hy~M`{*z
zF`ep(@suobK%d$0DK(mcRn>ehXS0>2#mgfj7__ZNw$HZ3=Rat<naQz+mG1J4ivRz4
zKD%=t%6!-bp%MLD<|2pf%8vY8=6C7AVkUSC;LoFZnaxy|+VM>=$a!`=fdgNqdVoFk
zgFZ3ksb5*<&bEFkq2tb^8H2g+G{kXPH`@KMz8k7>wb?-jgp`VAC)~CZ<_28XiDqlG
zeHd<tL3e%@w~Xi%oIc`+Gdtt8ooRREx~}xL$e=^8F$O(pl0L}$PUQhG`+|+W=$(1o
z&r1wN$xu^P@I=+5s_2W?RkK{x1b=n!WC5joZr+%KsC7A41NFv%iyDw9E8mv*)WN&%
zxNg+K+=g1x{?#9#W&-hvls7BK)NUGcOs;c_G5vE){B3vR-~WXy>Oz%UCZpe{#J4DO
z>uR2X^);LC&Z*&Z*K-4ch@jDSoe(8S=p&nZUdTe9d3GO9a=?M@8V9D;AEj%cZ-p+S
z^#4|Ay4TzZAcjkwN(tizuzQd)fppZPtrIAKMBWjoA?d)3RZ1N|OZqXf{_@(Q1>>FH
zv}RdR0(vH`v-besN^Y!N<!D+D5_>LF7+Z$YkyRF-!4%6dEj8{Lv)*ztt$qh-<akwQ
z7o_IaUtS~8E!~wiKBk&ySD<Q$8aRBb7ZxScIms?&%Tgsco~hia@0K$U2N4gE6MF%|
ze#%hn1QCio+p$RyxSs89mGe(r>uSE`{`-OCkWg;84~Je!vD4&+f>dlW9F8noS7^qJ
zmTI?}ZgOPHZMVHnt+$t4!gd5fpq79{xK<};U}GCFgYc%Eezb_PrAsriLSe|mBq0>B
z(1&b3QGyc6V`K+O;v~#*lk~nhF7)&o^V;TiSe~i?W?bht(N!2)de8D=)tp|=ioCeU
zcy$KjDGQlqW&NsctY(vo3z5sM=4A#F7dJB<Z;&(Zi5ka~uZGM`HGB@CUQAELQ)^Y|
zmwt8n9`O%z7_FK$SpZ^~%-T-X)9#dZUlBM#u;~iT=k=@cK(}6aoA}~;EjKRH&I9ld
zHtOwD$nap!3GAt3t=o$11V(9@UA@sKFD^Q2Q`h@>ERuUJE!%O39=B?CZz+VjYpG1#
zSJ{j`%>eCdsS2BvmffLuUl*yknW?|G!|lAM+in{J38q-oszFiFx|i2AGBH+;<h-K%
zNNIicKuhe7id58GI#3_Ko&+3Q1<ORcw)BQEPkkOH$PWof5>AZbD2|a6r7WU^`#gy5
zC`m}q#XZUqvcZRzBFtWFE<=on5;%%oFLGSuV{9Xw;t)kq<RCZnQU}u{O`->(%Yr-c
z4zfg3$LB6gh=CkLiLFElF=tBz3Gu8u@n-Q`3lZHm8xg|z`HK`F%wcaXJ{WIpD?E(6
zy1IdF1P6082eDyWv0>NJLlQ?`;sp*0sLK%!nU4~e`iL_YQ$hmb`)qsZVM#j0zr41d
z7mP2nj}7IChMH$}n#LZ{i8^24W>N;Gk$b%neJ2p-_hwF}*87YY=BoA%o2p~Y`V-IR
zm9n*I(-lb;)mW~@r9kO^;(^s-#ID!dV^I?N+(7|%7{Zt*C~;DX!iae+2~(bg&Nk}}
zSN|JIW*tLalT3YNy>7k85-LC;qLRtOTFW7gT~LTN8c0xCNBs2SbYdk1yP3$qvP%dM
zYweEJv0l?AE2g}y8f=Jc6$~aKl1_%P<u?|eCY&+OcDu?u|G3@IPuz$ij<JI<1=Yaz
zedPK9^BKT^V!9K#a|0o5n$6(u7&tkll(y=wH7g+>Hm;<53Exg!TpOfkZ6IC>DW?>E
z*v>`V@$nWjt8Yf?R{e9CH=mX2$6sE<X*w=FiAY7M!2IQP+b<ED*nqCr^9Hp8kYd{L
zMAod$h_|d;zrLh)aT?#UYVmHrUO1HQBp1R9Y6q+0B4QkVm0ME(I*|1?let!iS!-5O
ziCe2mP3%pU&8%o?xwfjMYh>0lUT88D3cps<kqCz*^UEHxK=t&W<N1+3Jo}JU%_!ym
zfto&ai-D_9`uoR7jvBXiby<}4cckX$Qif@8r9amc>i_${e3O#A;{W{TR(X_y-BC$W
zmxQ5<5%Z{vu$#Cji5Nj4p$TPn5Cn9;{DA5Je*NkR9O&=4l>lH-iz0?iYKc_RNF+u`
zxH|WT2e+y38fX5O4z!tPtE{QZHkrS(P38yKW(iQ0+L4cN>Jk*CNsKsl9M|<c9>@GX
zQ02?$g<{lkL|1!7jwgQTvM^4N6A~LpN+^m6_F!6U&&4#2<GxAx04muts6-+R9}Tob
zU?o=pOf>1}UXUfA4{GFU8v!s8iZ?1!BzxDQNPyO+D6jH@u!*7EX&}19h)zV%p!yBe
z{*DqTfhp6X<ZIC<FN#w4PW42>Mkbnjs0&M}cn!kjtWa=i*#%TfTx%DZqDP^u_`tx@
zE#Bzi>%b@@Zi;|;Vc>)u#g4-fraVBzu^GZ4j&T%(Uc|}HY(WY;Yy^==1#D;^cyn1?
zOMi{H8kbc#*bkucLqw^JH0b@Lqe8?qn(!lW;L5G4_BD*PF(&kFM<C%gRs{K}0LoWV
z?8+@6+h})FE*8FZwh(c5Hgbd6>Rp^pF~?yT15X}j6k$qj6i0!FSZasNadBh^yHWnn
z&a6N38Au2ap(DRR1!pH9p;Va!Obr)^OSN5E-Y>cJq#JbcL`9Bm>IZtvCWh|FmIi>g
zfgQadaU<dbn19LaW;DR$cq2c`=c)>;fvNz2O`Hv1m0n3o2z}Z`V%^R}Z<|>ca$}DP
z>v(rY>>%Kg&0>@WK%(c76vYnrk;iOI8BK%OW&8D~3xap>sgvncd|yR6e#1N&Trrj)
ziO@9hEK5^fO4>5xwrOQ1xuZ8cK1}L_;Ynbg0BymqTeI}MeQ#Fc`2i=?LxBtCi<HKQ
zU=|}UvHisHA{?=FXHr!wP00&Gh`uoIcX7LPZ)-|weo+93MhHnt#(}PXqYvnb4$hib
z=ZcQzue@X#ttZy^WeF}ga>1oUEqdFAaSa?Ykj3Ig%2WxzB=0jIvw;`q60vzf=F1r)
z`$y6J`r1hBq#Qt5sc(l6fDN%3l%l|46oU?(kgd2ro5dBY`X5RaSiZ8KKCWEaPal7N
z{p!<4vACZ;%GLe!QOUobJ|;JxKI%3;eU#$wr;k4^>bxkfCZ9eE-2CLz$LGa7%ZnPG
z2_5d!$7l0-^$qloO@K;~=aWw#&x>nbo);Og_=^?(^iePIr;pc{8NK}Uk<90Lri^Bv
zK9Z7u`UqaPPao5g|6?K8k3M}|RM5G!C{_0jK^tD0u}>f81x#Q@@=qUO_k8-uKg^42
zQ7-q%_D_Ka@zzmp`zf&_6!0KInA$EPc9J4D;Q?hS;j!oM^;T=|qTWZZE~WNs*Pd1V
zxi=d0Tz&5E_2<sT=RTKwH;o=9jRx?&3qI0iV6(4W@;797L(Fg7V4JE0#}oO!I+Hhg
z--slK_thz`4)Jw0{9NV$33xd>FN+Jnyz6Sj*$+qm1~oKgJ7eHX-4jg>FRShYaE^k=
z@>wf7z4g{wj`6E-#PycdET%7Ddu;Vo!S3&(sJTL_RP$5Yq`3-aqs{LJ51;Ab+th`(
zl{V$<PE2v!1k*4=A#);x38N?qxQ%@5#Xbv290%ln{A=3ys$FYJN77P=v;m51>5|On
zTmyktsYv6FHC^LD_Zju7?HqLGdLd=Lj~wPxgdGwi5~VJ37!GLQkkA&+wT%Vgf$g{>
z5bqRqw!*4xSc==Gg~TwCL8TMr)tDGg4{&fOiFpismeEUVo|77U^ak!s2(TbD6+Jt$
zX=j#pZuv0@eTjgHT4Z4W5lpH}e3lj^6=}n)>atkm4DudS;8nS(FX5BgtunRit>mPx
z9h1mI9;AT5NfM!$gfSvs;1k~_*uh)H%}TGDmK~mH5M!ZJM#`n%P~p;hNgIRy=fD3y
z(=8)nER^3t)4m$cu~n{!W`oJ)9Ug>(y+m_Ct#{V$rgmo-J1ftwfVCfzca#O?a*s)!
zTlNz)ZJ9y?vUjvwsxB48w%uFxLi`~4n~KWtR_#OY+W8^n`LWBA2-#`sBg`U>5*DS%
zc5Nq#9D@A_@AVp7;vZ?1ulAIY>en`B%~!2vb?CCjbflrQASSg@GW5*Lx5YDsSCq59
zq@aALN{T@)DcBJ8fP^hqY)MJ=^s`4b>iJdbgWSWmIic!_+Sax)gIX~W+u!a?S>q3q
zHmR@NA+#n&b(w16?d(jAY!^FW5F$GbVuZQNQ5;2J`%aw{M;xbpmWz9H)bs%p;I7`x
zWg}NXU9e-iM-LP}uu%L)e95+X@T~OYj4%cqbeRqPIPT8&a>}?HCpbVZBs0fJN>P#o
z4zgqH1wkCJ(AzG~x&t<9x%EKoS|MWU+|sVC1hlFuXhuL#?eAIv-zxb<R@EZ87rY9H
zAzsx+=(FsDk(b=qdK2U7l;+!37cVrQtBAJ(!42F%5LHd;MaiLR(O2o#?5QRuJf@&@
zQI;zdk7YT^A4E)a-Gq_ABams4Lckmc1tdU(1%c1gD2#$V9BFVf_1FH1T44c6CPutk
ze@lp@S0L>7&%nyu9qS#<#>P-**tqP}MKDj6Z>Yu$Ga&63RlMuV4}W_C!~W%|sI?*3
z7Zo?``l^|~J&_HGr%!%)I@T<dlFm|rA9<o8Ox}IzR-rp(KsF|9ujy_5N0Z*xv3Kqm
zwlPi_<|s^f0Eq=16o;6i#K#;vA$3XQJS5oMa|GI4o)LRRnuk93v6lwOj;M{W%Nc+a
zW5g*7oFsG|=Jk~B1JZowNOO=xUQ3ftm&>*Tl9k8n{UFU7E0(lYU0)XRmebDT0XkdV
zew*^btV3{rKP!tohl{h)7Bi7ri7rGc*%2!k^m>TyR)#SOU|({<HMKdUj+NA6!`!i(
z1ALtrM`7eRh{QNS*!Mydg&{|QLukm|D5UOIq1><y9DC&+=u!%9Af-CCGDS-QWmU}z
zL3D`F){*<9A+H<QI<pze-e*kgBm!0}4u&CN#_Ss~Yf@ft*e5F%bH{?{?wFn;?%09r
zAe+Y#!kA(dd2x&)$EHr4I$lKYLz`|^RjuYq+@oe<G$NNa^47ftrCpQ|qDGU9N^ODm
ziAFYOsi`wJ5x@<nowAp;Ox`^*mTw7rCu)6n&PzzO2Hz{#C|R*ca(+}o$oJ8(`Lni2
zug}NUiDTOn%RTO4xrdef=Bd4eU(G0FrmqsK;E$FY5t=KJ+O!=y2)_DLmj1IRzdRjO
zBt&dsJ88=FMhGRoB?`l5{r1T(Pse8QOSiJ!Nu2I3!(Jt7*WZ~$J(}*w*eZi@*yH0^
z-CujJ{WUi3pu6}s-4)Z@<0>z?#2B<p=2P+k7|-q1<GTH@)P@qq@%?LQp1uD)wPGmt
z9yiCkw<Q6I(KyN8Y37ezY;U~5)ZKmnV$!P5MMEDOfnkgJ3TzBJrv)V;;SmXaL`j$;
z948z_lrY2`>^sCum=^~-)(%XX(0kVnMB|^CX0RtcA+}jeZ0eynv<aj}j!?n_7kP=7
zL^w(8)C(V*o*?(muCxSE+r~PAqO07EhR|>N7WzTIiV^LgUu0Z2=#|<~GmuNs$o#!Z
z4qCxIXa(jH9CU(%POuxDz&Hs$W1Zlj;2ad3gM#zfDmc3qb{P($Fk~^Zfd&8rG9$ru
zfRY5$z;;-g@?^()j$k!>AT<Zt{yepu-K{tc0&crDvSZIh*uw#exND<;xQvDo;~|M3
zn|dR*%&xQ>sBB~91`6*=x9K%}3)QAq!-!_nD>1IvbPH{$*N8P})S7M;2d(BFv>Iap
z4ob~Iskx(4(>HE>{wmEEHJF0~>fnGnIG{dT{cPvhB@c6seU30oQ-mpTP~wCP*{&DG
zb`&H|m^>)t)kRG}hLB+P2zuo_pdNNS<VFccI3^AvQOr=1`YGihp(()|tE>jvQ3TOh
z&x<@KNg+`$)_GYp)cdWPiV%{2JgZbDWCln{P;RCodPC()xze%1)n%5#G(g}+VV#`x
z8a+9g=*%fPkzR5$CzU{cLNJJI1So8;MM^**0wQH81FEtq@IGY#09{lfI)PZU$a79E
z79w+BeQJ(UqW)jbYM$rW1)ouFm3&^5btOBa^7qVjb~*vgECBl1{B-nQ{&5UCvd9cu
zbHX6KosJ4~Z8w<6sEH!2IRsT$Cnqo8T9-VZgI00{fzKklT}DZcs>K|-0At~0Rm{Zf
zpPa}zOHi`P8Oh<58NbeN5EUvqvuZvgA|nmZT0u-rRdZe{wX!a*Ny)5|Pm7u(La9*F
z3rL_RCa~nf06+v#HLXtvu-lp>DsseJu_d6`lM_&&bPNeR>n-v(BSg;vtZNP#;*6`g
zLgqH(u0(^C$-Ue}muv3k_EDPU5W+Dpsv0q#XYb*N`p;+QVkX{`Tro*WtICX7giQgR
zyGW*41!{ezDRp7%s75Y<Q6#TAbF>Wo`&Nu{A)v}MgJo(4(pmkNZ!Nv-BIOjVVVAVy
zKeb+SNKr@YCPNkUNbZTnY)WQCSasm{Vpc7tzzD22grL;Qvr2sxW+zxNh4gt7IUgLl
zQtF1(X3_nUyQNytOX%8P7J?bDs-W72N#I6&;XpqPG;3KY2)%&rTT(?dUkxfbyhvuX
z^}~y2Vuz4CS9|s7d3$JsnE|${uzZjO&`Q*b*R5fiIG!|CDG`xAFSGYq&h>nVCC#e3
zBz0k!&eE)`y8HZZzn}l%_sJi=%c^oQ7bld;*QqRB@JnwW|Nbob!|%`LfB5C-vaaXV
zH)m(p*Vm^lWRMoqGd@F$>P*|n&XT;iICE{+KXdFeJ3M1eb4WFZn&wbb6RM%Pvt!lA
z=ddS{Twt-0#6IeLJ#YeuxP1Nr?s9pCe`68raxo<{B*Bc3b7BUY0$u=HV^S1XcNkP~
zX5%v_IuqZF>>kqHL!Is+=o>QohPoX?O~;V#STlUES?Ul$2u%LQx-70OGPu8*PYO0y
zE>A_c+{<E`Rs3$_^v;~%4913v8LBTif{vie;u?|uvguC<K|fH=8LA7^_M;h=&~x<3
zn3EZ+C;=+WzqsNKk$m;)pi}_VyNw|{bG<WhpQ^ownpV+2Tm*%XY!s0htcXIr9xI#f
z9)&AMh%H0=u$WL`$}2M=$?i<7^r@ZNj%_0wf~aufx+tcehiv^nA@J_R7W^kpm`Eku
z->}B5IpuH)OS*FrD$a8ml``jL25B<IkqAi*L;&o2xEklAyn=eGQ%j}(k|G!5h%F=`
zru+!RhXau_a8T2t6t${8D6wnvoVnBLqUtedsMbe#IF{z87mYUw%S?if|0478>d%X+
z{!U%$vMK%AV%A8hN1}VHSj-#C^>@4$i6&%9G&vj1JOT~jOj3MIte;AeGj*aEbPfIy
z)!LL?HO%#IjJ6n0$s&i=?GC*~ON(J-V109ZJn0T%b!`7F2H6a+8<*9N(Oo{qb)DJk
z9IOOi-DV~vPR2}w(oTZ6ZW7k@=H92mh*i1Owosu2<I{m}GacO?-TQ=S-_>nqLpU48
zr^3I@R2Y5P>pVd8V14s8o9ir(KfivZKKTD2CAepAy+1m~1_byT73#SO*3Hev{oC~{
z!Hsg8BLcL@?@TRHF{7KK4o5~U+uPMB`fg5W7Z`|ou1nQ-l}}ss>Wk+i0DWK71b_8X
zA!c<hN2TSpzP~|D*}!GufS3qz(ktH{cejWj^AUeb8^&XLULYgJF08mRIw+eirY{sX
z%6HjCR>KR9Oukrg5Z_68vvN%BrZLCliU}FmCEKm__kSUax>!O(I|BUxN$YB!S?%)e
zCTB6lVL%DO4&*HM5{zP?N{AyI+Js=wO(k#F-W8bx>ww^Rf%62B-Lnq#)hM*oa&7(e
zo|o@4e!VUC!1`Qs^2(^JtnTP>%WT}r@;SROtd-j0Ju%Y62@9rGT@p#VBu&aA)<~;0
z)9QOo8L@S>9YRoGd_|SGfURqJ*^b#sC!&4HqMXexT5IXqz*5>WA-ti*Tv!1)*m-%c
z7h-O~HdCgAf|b7}!cGO#sqK=87Bf($<?=O-fO)<E_5@|SY<?Du55jCJGYVD{s{%uh
zu=ABX1;tqwszlF9QeT37^pZ#uQo6`<>ph%&f@-SM-Rg9hHVqyZY9Cn%%ztT;DY$9q
zc!8ZFCkQ=+BRfTr7dXf#DUCeBc@VO#V1%N<p~1XK`!+-l{#6b}5D_<q18pY|WW@bX
zrkTu!{X&{tb-NpJVOVcOazblLB#;p74N!#!3YtC@N~Uv?UCg#Y2#R?S!qp`w;@-L4
zP0_z7Y(hf^Zia}{1YzccC{CG&96R)}ZHJuN`;T&Jp_|*TO|uaun_7DGw+LTzb6m(r
zgY9y97f#pZhM=ujT~}1I1+Qzrmd&jx8(OV8@5stpweicyn>RWt&Ai%scF3Z)E{oo>
z^y?dE*XvLDwh8u@9I`C|pg3-K7f$Mhsh7|IxegFxr<fv=gf0rB)Q(cmrGB#A)z~Jw
zvyzgND^^_3M$*0t&ef5Vb;JuT-M#(XtZ+~Yy!^7;${)Y1Wc~Au@A$?Fuur_0a1>#W
z0Ci-7BHIa2U`H-by)eXh`-v23nMHQ1kywPz#j^B<YS?YBFS!!31gU2$%w?JzwDCdD
zNm*w!n}f6ZHuKw&2AV`91V?F1P~^uR!X)ug6uB7raU9VAdpyE>U|<(pu(DtiZm`w5
zX@QqJdbYdMPpxOo^{#_GplV1rEk)j9#ybsXD%k*M)<Q^iaA*k;T69OOC?zwCe~_g9
zBGqJ7XERziEr|+F2R@;_-?+>DJv(y~v{jg%0?DwxH*@@;QImXXPe$)Sn@zmOKptpH
zD(m9co%nO**)Kk^dB%5khuT0L%_&8c#XiDb<Rjwx4vI+P#F#J^rF%HqB=(El;TBM5
z^_ufvSzF9=V;Ie};o;B=Oj38;Q!5j>-o97u>z`$=w~5&K`k8u1+V|nV02S;#*f3AF
zEPwb;mfhjI{6ri-a#D;#6ek`>IPyaj;Uq#lj1r%vflsJ^9|++Ah($w$<@eIqBKL_9
zb|WwKg2Y8W^)bRE1(NY7M4rcR7zYXSlb&tkK#RM3T3iXICb`1f{#ApA|0=-5LZSc+
z@wQfJu=FiKBMYNY|AYn$F&I2a1=1tBD2r=&i*~H#+NzWa)Y+-^tbuR02tE#o)eeGH
zW9=j!y8&~utmL%LZzdZ1oPx=LNc3th;Nc+AlKcvKHkF`ouviGwxP+hrXj7#g<8c0p
zE;oqf>eTv{Q?jU9Q=>Hn@OQ$kVkTf#bzzZNb<Il?8VsGRESdu%7P1J46jM<3Ww9u=
zJzcX6D{Hm3sEYxrY#%oQuRc@t$s}4TKP|~~n1hAHg{uiFN-HS^oUQ}clo8mFJLL4_
zq%oz7`zD)8B&U>Gz8UL-5aJ>A0c19|#DOX-MN4e9&+}rzEJ&^_tEqX;0dRI>9f?QJ
z=5qz8I<;Qb)^(QWmcR!q?SpY?++|`<>r`h-%op3#DgaC`xtPVjv&tgxNtTO$2y}YM
ziCXWrmv3MaW;{P_r(k1b_2_n#tJ1?#KQCr!R!%K4gSq<00yL>6hl_PJ1O2UWGbj&>
zT+$hb&r0mi-sT(yMk|b}Mk<SVgjs{&Zr5=P-rXD)n*zNR{qu$<9$Ej;dl5&DpD-Gu
zm^(JYJi;h;0*u1Qvt!8aNt0c{AkBRYffecu18rV>ws(X;>TgGXHn;l%tTVC4&s!l?
zq6CgNw~NcE?%JYzjf|!j6B6fW<4UPhg6(VTDG1ROe+M?5qu1nG)cPH%iJ{&>MK2XB
zrG_)~==G`m?RaASte!xo-}1;P0pag2*>T6R4xbW8w_;dL{jUm2a<h7&1swhSl1b6|
ze+gmvZ}u<86YINTy1u0I%W*R=vhpe561Ye;!arD|*wMdd$Ku2Pclh#u)nM~qv)cN1
zbq4%eftW?PDpK84*1rqy<*%L4fL}F2`qxIa{Pm(JE^_`WWRvH=k}3JGV)pBt+{{V-
ztFC-82MYRM1!4QID!SlTh*!EUO7`nCCBH(1h4@5e{x&$BVEo`L78@9TJS}D&&^G*L
z%(x6n;;=?rZJgKYJ)=6)RH9dKsJSqyx~ToJ8X_yinsvBX-PEq3Tw*V-7{Sjgy8p5h
zkRSwbF&GHiTLXbr&F*?M%{t!#ou=2?decTt4VGpM$!awE7$It(t<mU!MSEOWv?X@Q
zt!1XGd1eYs36EkNuoyX<aD;82q9kG|qMW-fc4@M$D`rHxAAx!ZdMIgx?`wIoo8!)W
z>zP$87~?YtSLGA9jAZd*QCE<GZ3c6jca@=uu>Tu~4lSx_5C^DF^Rl=od9~byvvN`g
zunuj?NpMW#C`H_7F~WXGQDXZMB2Mh{DCUIPd`IGFGoSrgY^2MhtS3@#Cn|PJciD`#
z5d3;(%~jH0ujmR9aA?H*+Y{q@fAY&vC|HeR=;lA)DtGE<d*a`Nzu%C!R=E0ib=0-q
z|0c<n7bPAgD2W4xu<H;MQ$|q`ClTQ(PMpZ!=CJ#ZzU9O^f)fW6Wkzl$*3WOBADd_1
z_)({_sTyy}VC1SMLa;f4Y5?;nf}d^s8{2N9^Sy6u8>~ItN=RwtQc+iiGJ{S}&W8XI
zs#>#|N}34GD%`+`ntIw;`&L_=tVCI{gtKIw9jj&j<K%q?28_nCg}Qe~!s~0!XO@Fu
z*q~^;Vgi1C`+Q>k0QauQ+5V!;#EgRqQ-X;Zeq2eFa0<+ZRxMzsg$1ZS(MffINUb`X
zYTATqUVyn~0pE;Oq$!evt^{K6c6WxD_~DfiB-D<59;1}o4B<3LQRE~HrJfgJ7W$Fv
z?u^v0y9ve4=xjr^^I$GqtkzlVztdB(@n9DSvE{CJ3uuYLNZ8j9AK;q#--Q7L1nn3O
z^rP3O`gcgPz5XT|U<I1jWdwBlVCfYG58jA1c`ERRZ4Jqd>O!yUe<~K`&u^bwPsLgl
zDI>CaQOlARddNOiMF+p9s})u}8$K7;le&|$5}5}pDxi6)f|2{YgTNC%n6NuzSmJiE
zo`NxwlKKdopt@VXw;X$-A2bQ2C+*^>g2%_>zd`A5Z1GalvfS0}e2nRTe|z#L^{srT
zzZD^9G~JzyNFnXz_a%r7D_Iat4yMTltcZQ-U`yJ!R)ko~`xZ1V*S*Fm?M{+`&)K{r
zs27kpwqxY`p^b3LLlp6pA}5Ix9AZCoJhF`-V;Ehu+vmu1iH(zVbYvSt@iQS2kg~E8
zkSpN9uwZncwGqZZ+p_YaxT>r?yAm!r)#Rjgh6ojpSl2wyk@Rc`?~`>T<1NT^o^y#X
zYVP{Bo)-8ZC^x?2)m8hG5&QC{Eq*K-{Quc|*X_2EEM4$b(3fh7YK9a50=LXkt>a3U
ztGqfZ?XjJw*J-zxJ8qD0OcHDWw5*z`S@RC_hVvw|c0>ROTu6}=CCg6c52r{1alh=#
zx4(UJojU^PgtCP`^b}Y<zo9qu*7>i#we!D>3*+2*Rb*EXR-(`*9SorwRFKPR+z2>i
zS`bNFx-Lq!0yeFX&aFCRZWc`~4ZH&eqIt9CQ>o_<0-&MlWs%LP#_KCF4!Dqig!1Ya
zYO^%FkSc$Y^1@MPCa<z81G9hYPHMeWN-Da}S2F=39@jo8DLUaPv;-HAXoWl5Ik?6%
z_PV8L?sT*>?Eh7Fb6VHzfRkJGp>4KydO>`U8VSQC1){ZjTbw(8mWvfgeHMX{$YrTG
zfOtL=S{N-Wnx@){VbG9y<9O@1(f09SDO>Ca1e6jFvmiw>6&@mj28c4^A~*4{@1~(A
zg?k_|(Axa%CWfJ6x8412jLgqpzJ2}kv;XD%^6amFviI`ovkI<jDa-dC&JFuFsD93c
z^XuzhCPwNvdqiz3n3cS^Iw{rqhA~_!g-21z7|GFi6el&=lY^W^ZuSDoz?aCc^J3^P
z+fD$r<WHE0H_A10`K>x<ET2n$vv_U>%rchS16#|e>bvI(=m4I4BUsl7-ny>3=VNX*
z?f-fsdA7{tqEh8O(`%yd5o=vymH_<bc^5njX8ez(tWMuNpE@4K9q(Q3jr{6r!bXSW
z7CJ<;S)5Df&3W@_t^Q!j?hVDWO8Hg>o-n)g3dWNzZrlCYZQ&Z-!qjAHsoORGjO3Rk
zoU6L(LBp-#k;T|@c~({Da2^;vO5@Y)afAn~<6~^#Wijf5)j#zY-Nqr6MZbJF4o#D+
z_H~`N?O6fNc-_@CPxNTt>%yD&wsNNSnrO~YnD|nwO<R`J!-t;Q&$Ob%L_b=}>f<#n
zKPqg&qB?DllzQf#=X0Y!y=vr>VKwVurm$#V&nQ=p;jVRd>bwAgySHHZ=`GNy^D}LK
zp<jkeSI=18#;F;t(II?87oX~3tOxaSmodV1@%{Jo&n__k58a7P)wJZ(&Omfn{^=*_
zxOk{`ngwU}hy%TCbj!N)%~R$iwjO{VbsN-|`p^1}($Otxl~w&2ephqiz|gB-n<;|d
zU{czj>M1%Zx?_s2J<bnGaPIownxd<u;nu29CpvLC5oyGbU^qgA6OI^<TqIHvhn~+x
zgvk>?L=O<M4+@QTh3osoby30sj))Wz#R2wE7&D(?&kH@-Cr|b^sR+O1l?0y3KSQ4y
zMM3qjF)m4wS(8)Ad2P$N)5`FBjiYSYGz`KR<KNXdWu$<-%ToSO|ItM-Gs-_fa~1-g
z%!?oX31i<6!ygq$*}#ljz;PuWfxAObd<Tl-{0p5ge{^1IMC`5eT!LEDz?Ke4+5r)A
zJ(>(<cPPNit*M4>)N|=jZ9bX8&r8X(G~?jsDS@t78Cq(JU9D`L_j+dhN^${6!)2Z=
zDifSnHk_q7&*%)v#Z|VD3hVrXMWDR|QxGkkm+z*I{37|P%02^MNQYt>yfLe6CJYHS
zlPSdh8CnnJkFj9TKm?*`f0a6}JYl6Y<OE=CQC0q){Q*om8F;A_cXvA`fWx$Zs@Wd2
z?Ld)oFVcdRRk7m02kxBOrYxW$$@5RJvOdX{ju>7ACXWdaoH|TiXQr$gaR37ah8=}W
zxCVgK%U3@cylhSZid!L-v`X15&bLDo8wT;FXC0%PE_~QnhshbR&z8CcRj!(&yU_3w
zYfI9|dZaU1RL;<^368~VkyV*$2Lo%;7#lY9?(7_1;@6FNhE@(W<#eounKsKTi#$)k
z=x!kAw?8;aLDo*xLN+AZriTX1ZegY^<6^T2duy;Z25k$ku2(5c$>PeGfqEBQHeZea
zmZLPqBu#ykq@F;8k_5$m>?4l_#1m1R%7h)n&I1}FG+|fOS<OV}7|`+h8kX7DpPz59
zKzGVCaht6!{rr6JdyO-6>i=HQPtvwCIlU6zs&&xOCC7@;j~O|6ya;8#>b?5YHLY}9
z+)JUq>Aq_JK6v?^I%WW#Tz}Jj*#MV&L)NxdD`G<pc+j7|GCYE#g;g;?Y+kOzYpUzC
zdo7HROJ2GSDs;SfqwfvcyQabh-2^W{oCUDxx3ziO)z*&snrid|Qs}IQZTbFo<qwza
zHp8c)p4+;}I{c{xQZ<NEoAK{Ej$eL2DC&0D&2NkwaTA&p*ur*WHiQ*_SY|`%M`=Pt
zfD*<zBEBaPrD2G?Aokr5``q*5UA&jw?PT#u0kZ0LIl>2`QRI2*{85X;u-&zwU=G%9
zbX!Y%p%AD5`T^G<bs#hj0>a?-(h-7lT6{7<Dh1t8Ib0eFv3+U7)EunAnBpYCQ5rB5
za1SFwBZ=Zr_=v}e8~C6&C%w@;N)Sg0;@%R(W~qVQ4&}RPi<`aN2)A{%MB09D_Z$Ea
zcL(6^e3lPUv5|)fbCFCi22^Z>sF$Y5^E^Va@27(EJ;5aXyhqMy_h9WH80tvS4y>fH
z!w<5fm=dj&(4g1OdOqtPwn1(v<@h2mY}L?)qtx!(sZPhEZ6(?td!e1QkV9qOSGn!r
z^CGVRNKq@2b5KN8&}|zz-37I1DM1S7zp|=!J^z03hyQVYe*Ryz%N=Nklq0>HOADeR
zdeOC@*w@yVMtN=eXTd&<A`2H-qvelXhA;wUsZ1FZ6mXGoWqrv?=UT1`5ZAfNR->Iq
zMzOEo-2w;lMk<0*NDXdc`VnN-X)|cCS<Y41z4{7lHy!&+A?ILqv8)PLcY-}k?kW|^
zuW>&%Mn{e0kF~X-nZRvr1iOJllp(xc<HJio5GkQ)93qm)1d)_Sh=o+3C=|X-{WKCZ
zJP<sjWs})=-}SfM+Fj>dz~o$*JZ2ZphP^d)3cC2DjZ2N`Q)SZACPKYrHWBh@gU321
zoxW4JuXT@NAoNok0T6v7NcqaL^ImrA+0`v<d9F=4mT}}D(Z`UQP||rH-O|EdMu09B
zMrC_si`~0=qU@2%i>9|j&$7*<WWk$j`p^C^S$evL({02L-Lka~9MSDhDl>b32Byx~
z@~|g-+U?|Y&_y%P|9*Y@!t6fdyY3E-qI)#2>IL|2bT68H==^Jg?=%Q6brvauM6W@2
zmeqw^HhbEXYwzF=DxkyR_L{>^P>!C{Di`^R&1!bmdg><5nd4&YTy*Dp>bL{8xA!M{
zh<onx%aQqM9&LQ)mt#}*{^Z}UZyhrOCm$}`>1YApb&F0uT=rV{{=@{M*pGBNXFc<~
z=Ev8(>bu}C*E!%X8~1z9kTg=aLL7{>dlZT=z^zxtJYlRe->BgI05JA?AooSGKON`(
zSZed$GWsq+3>*6SyFmxZRvpxJHs-)N{Q`Aiytyw=1CP-WK!=D7;fg2`F-n8PMTAm`
zm>>j&RCqr1C8h)L!5xv5BR<%n-L4@p)M9-hxy(N6T&GgIp?mserEYain#93xtyyTB
zjHt>ym&zMcAkaKPBvB5GSJ{=yR18mm_nE28o^8-L>iI{@8etAvTrCGV6nIY;DqnFy
zGsr@*m+enAcuWx>zUz8axJWXdAmXJAC6Wn*1*0?um^kT$v>vU0N9*6gt$(cxur>jL
zOfl-UJNdBQ`8U<hu*(JlJ~SfwlfJYwl)c}dbR2mgM793b|I4ZJrQ>3Futz=rJ^RqM
z6><K)-_g{GPUD36X%ZurLPC;=xG15Fp(IUll1P@2Fx}I?1Lv|{Mk7ugz`wNCGz)gq
zOU$k?ZQ68@!osxGlIa+F1X_8gG0zyG8q=JiBX68U9WV=Wn!VB0ITW=pSn7<?N>!y=
zt+Ih@dzjija9L$lDQ9VWXR+1n6KZZKeS_&hccm*_G}}gT7^-waHY~}x$rd8N+2@8@
zZ>ma?I7p%-L=g+&hLT`jjwlL<D>0*S$eDL|#%Ewl(0;h#k}zzdYZrwk8Qo@K^m3Np
zW0^qoTCci%!x|~%X9)l|m~abKrj`s)3f3`MU?hX;Zd9P&btdf0$VWKP0pUPj8_|=s
ziElPv%bmhxx$!dAXZr|z#xjgut}}~`T+BVh)^yPS>CkQ1*dWGk?SZjJNg6#<&!E=U
zCZsAgk96Dd{$z;KIr(ro;?=a|oc=y-EJ)2a3bfN?80rZs$`+)@d=F#KQG(gtNV9gv
zzE68iPtN_O`?pgnC`&Z4WfBi3#7`(j0h2x=lDLR6nV>KUg20P>Eci|cq~~3vHCvTq
z){CBiYT@Dwscr*+zRMxE!OM3JSkt@w1s3bHMPE<@;OpprjiJ{u(k0k3l)rQU(pOyO
z`-pwI!$YA@h9n50n4yRU5WeomC=mdAK!m@skJ5k#7&Deiw?|NMG)o-K5|3n-7~HvI
z^3C8@-)OkdR);NwkE8kF{vMX^={6g^t$PdaH+W~Od!^%Wh&*3J9z#S%fEjifqB3GA
ziE$hyJZ2)=iMsLUHWI3%*N@nh-ge<dVCC0I>AKoKa&BM-HQ)d3GB5vo1!=B3w|TMX
z;9ykn+`kmGD1Iy!lXH+lEhe41zDk9P0r!mZ)<2ug@|%l4D)iIOSy}CKZP!JQSZiWT
zFbybTOazGVBtR^QLKK8P=90wBiw|S1IT|32@kkGMaW^+`3D1h|)olla>5Ka=bHMS|
zKHl0}+}gcW_Zz&o&BfBWQ3y*?N&>{=I6)+&5sF!iQR2x!crm8JXS>|ozrOid$0{p?
zZubtZk)Xp%9Nua!R25^qTuKV~>a2YYL;(eq%EmlSpj#_A2n7gpX@LS}x6VBKViV@o
zRdsIvE(kU+9L)g+pC%0@a#mR3?fC-yK)IsC(us2+1RbKdwPt^l7uEHx&UR~JzyZPl
zD277gr@;@RDAORST0y4a8=y=3EXyjp(hdsgtQIMqXS0kJ(6Es>ad3BN$aTJ$fsX{x
z<SK;SgjP4L{?X)_(oc8D8wVp)^T1_*BHmAy$#Om-$A};$aU60K@kk=V!xSZiQxt>=
zr%cd53i(i8rvt1tLzYL|yx?HGxz2C27YTsQ8RRgnGklwj-vEnU(s>QYA1vA4Dup?1
z7hBzAJF-pZxGVE|IqkDl8i^Kl7xq*2M0EnYH^g*XRBYLNslNt?k(OneB-8dg-B<oP
zl4iQ~Ds@sLLsPPa3ZF3*P3$N4OfIWmZt@~`o~Y5%3XoyiZGQZ<n7v%2`C4AJUyGR*
zn<hhg=nM!DR6n5iiXD19?X8{40XCG1FFX0rii0)yun__~#lQo4bLcm+^z@F@))TXf
zHa>4<&sIBa<HJn`YAs|!FB%E68Ka?ltJB}3S7!&qP&01dr-b=^V~Xpo_+55RpBvw0
z*VHNZ+tYNioOiUGAf`MFI1&M*mZ335i~^4jWxg+C=1NaK0gAegy!4>-betqX><NZK
z-;ELR{1mYmhbVD5lPvTCNqdIGBR$>0>FNI32;4wNrUdh!fidmhX#r4lCF`q&u`4&-
zyMpphrquFU={7aYtrw_0Z8aX9Pr1mhu2f(%b?#=kgB!i1sjO~Ml`R#Qd$zc0$=UK%
z#dDz3P0a#_7x*lL#+_2IluH5HP`N6#N+QL?;dBX9Zc3v5wV3?`k8A1sPNua#EfkI6
zTbfEWk{azlh)vHGF`eer=hqUdb!ep<X1Gau1Z!ssIi?;^L(`+UtLI5ktDR}yHC=bs
zDDqjpI5$*qM%4$#5mhBv1e$0F_%@#}i+rAy@(10%PPPIFV{mRjJq1u>t|!>eS*{rO
zR-h)P+068%kR@<ZTMucy;D#2EZ(53RR<u<y8(~G0zT`xN0g8p2BI08oF#&1xm`i2g
zxq=e+@Y;KmCcQtOzrOhy!64MxpkPXnS&Mh&c|KQfw-4K)%Ij$L)@}l)%9fVeJl6`O
zote3#Ozxu@jxmI(dKwCA)slDFvR1@@ee<(<+Z-!~G=AqCuuWjDvVB0Wtpc0$ybTps
zR~y}@LUnw-)yG%1Xv5j;^troKH?E1^*<A=I(6K@4K<#9_-J|+e{a#md<6v%8(oU^w
zDaiVG%Oeljk%#QDc*x+UI4lnti(EhUc!W4kBSg|fphS2sl9<LUO#&e1+&%YgBZ1Vy
zNja7PxAsds8<kPUZlFf28BL9Ah+w+nj5)DYh=*#C&Qe)te>6-9Dv{$Xr(&)3Jq$+~
zyR|garzP8CX8IH3<JgTM{b9%nLnIDk6el4?l#`e<pUX53cbS-<I@2+n1UL_ijIA_(
zT)KYrjU=dZc0#nrx)JmJ^&_^-<blU4pmFTEevCYixQGN^gksEMlq9jwgBV9Rz=s!?
zOpqCbqpTmW;U2K$a!V#(fx|(q$^H^HixWi63RwE;d#`?8<&7Lq7u`xqD#`n0muJi}
z#?P&EEhbe?uNj>LHJyM5+Yd0OUv?>{6CYuhL$9uSa$UEWuIc^X>mjl|BeoO75*46~
z`pjwhPb}|BZM?RhGzM?=l>#1Z^|E=gv4C$#w+z$M41i8L**>ifHh96zl6hRArQusW
z=JmHKFD3lBF*PN<y3)RfhDWU@*;tJmj9Hzo()u2<R*npi{iONc&Tn~Sxw{|B-JSQ+
z!9<0KdT9^@338<`5pg{VA$BR^K1)L;6Ue;q01Bx}B)G-l3JmKyeV3vlU8jobb$73$
zWZ>*;cmG(9pPnAZZY@Xd_wL$SW;L7R9umUAR&E?8JY>vA#E%&wK@^~vq#nXC;VuhO
z;ifw=b-c@4_^7e`HO8s+@EZtyaj~N4P?i+H@L4DcP`-Psye`X17T)GFZ_FqvbASb}
z*cCtmUf1<tSixD$<A@_11BgU~31Sh85ca*qOF}R4`wGHgLzj(D*dD2N$kz=RY_iYb
zOu6eE*xQ@m?r%6sx?8;U%dfYGuv=$?`@1f47~47SKnKL9WysM#8N<Z;6N_c5<39bZ
zQax<pLa#^iUaU^{ci4ebZh8-L3VUl0_=}<-bg5t%xhaGDoJ&L#j{q|P<AU&jyWSIU
z*LD3j59+TA1&O$i6U1a95n-N-5`rb*=K%9B1Hq5}x(81u)d9GhOj2*M@>9(xxwE5A
zr=dzA-qhqdQZ!i&BmM9qsa;b!_;yUfr#_7{Jkcf)QluJ?uE?TdMQdDl<<v<blD#3@
zZ2*sk<hS8)?XdaI@*7mh<w}#G)IPCJVkTtgR4SJMcwOXkI)mL)x4UIGR^+{0N^!nz
zLTZx*Nr^Dc@U@IzOF(#Jiz`&fGAk>H)cNa+XPUL8;Q&*~omvN`^3`>RV|1u{y>D=q
zI%(6n^G1UGibKvNm9<wVU{ZSXYB8q^s)%}Z8l(;_v|*J29aaH_HMG~{0Bf4k$R4?~
zT9i2)Ns4BARY8LC0-RY302u3x2NY@nu}6C(N4<V}u?+owm{Qjlk&is-`iOw&MI%m-
zNH7Tr4FV!|7FK(6b=oFM({d$Dg3USJ6Is_X&8?Ncl$%@4X9lL$nu{2+O+n&Z2p)r(
zQKGAP3Ch>mllOu_H(eZxu(1~jj?)l%jCqJ8EJ2i~F%l6Y7<+ykB;*l9*#0Qqckt9K
zjE<er7n+n}Cm;z_4SjV}k#39G7fMK0UT$5#fmb&)(ydSn&j^XcYB|feCKJpxG9MD`
zLB=qi7fR5stFo++O&>OZe(we4ZL>2gKb{SEt_R6@0z2^G8YJBeq=kAe#Ch}m+j+ID
zBc6vqWjm#J{f2GSRMP-zK{E^;(q{N|NZJhjZAvqR)$gxWS!@pH5qjuR7U*788?A@B
zC(3|0cwsG-v5WCJcFy|MUvztJQy8~8QTLspX4JIe<iln2_tsp)YJ1p^bQ?6zMtszw
zHgNzSkRSI6Xj0u9bf`=vBzA?%Q0Ri0BorxPK@gxMjXZ)A-xC7wdTZC>Po9qAXU3zn
z;e{I&n6&nOQCGK4)np^l#)Z|j_i!*ePVm+k5#9kjd@_w(5eb0^A#jZ+9!jD}AQ1$Z
zQb7XW=lfdm00p<z5ZiVrHI7!^kR{;1fRu29VQPT?JKU&`*zgW8>S0P;N*G0H?8B&&
z2vOlhh>MWL*bSHn{YMa<%I%i+-6OlsAZW`>y0Udr(?(&bp1%W0OG1hj_zLe0X&aM4
zbm3bHAj2#GrbtyvR}9$>9ygRq%#YhPU|acQ{hM_%30?1)q|$HFR-#JprFH2T*5_6*
zOVyG`dPQz0v()8)(9-ttD79>mTKYr(t%xmK+{UfUatNQApHl4kG(}MY^l>;!5ryQ7
z3{x6PpV7c|AK5RYePAlN`TcKT%jc%cZ?1z{=hoFhPM<CBg!TxAZ-y%H?(pI!!1nIL
zet@0b;N;qPCv4%++9Fi8`?`wj)q^tG=33ansdm@pFnHl>-3jYGd&leGtGNQd!|Pz^
z4?M(m5XQ0VVmCmpAA{AJ3dq1q5lQ1T5q=^G-^ptIVxvc3sF&TDBU3r2G`IQ9HE6!z
z|G0spNI4&z5*XnPBv@+%&Z$!Hz(~3<E{e&y^GjaIADj{buF@GmlPU`LjjkOTMvumE
zVWs~>Aom0NxMnf~It!C~tnu<l0m<dArMc|jQdupuKSqE5r!RcA64Hb#7&z#zmhzNu
zV5-Nd>$_>{BN2kF+>Il|fI@^*pCo>e5EeX`tz6zUhlZCP^5$)vzkzC}qncnN+q2pC
zzuix1b6(aHYTPQbd~qcU=Q=B^T*Wy-UeN67dZrK$bt=x;Eo3fjnxNP7#f9_k<?A1Y
znHlHw)+wuOHmd`*+FX?25@=Qy<y@*LH?y|Rop)yOK_W>LPjhjxd3ixDUWdt9e&d`{
zA#~~8H9Kh}AC+5C(d@(hj`)nO%371XxByY4SNf$RZWnZ(@zeJp&A?pbWnQOsoQ{0g
zFr|&=vfR^Yuw4?&i;McXozq=9|Bx;IZ|Ahz`w=N;Q<lYpBy!xWM7NSk+Ymeb-PX$M
zddBt<9MU%S`J=x2O<UPPz{rd0kGG}=StaNHCU4ia9v*&W@HyUYoCMa*HZaf=>0%ni
z0>yC<BO)Ld4}hO!#3B*NDD=aftjCSOp=+#fe(>sVkWPAOnym!B+RJKCi<a^UbX9rU
z!4oKebLpJAKe!6zU=p{OzfG#;NsT6H>9d+|fUj+8GU(Vy(gt_Z16wFS+-cqBd;zi3
zbHGU;P4n)&`}sL!%L5#0>70ML{oB+zukz*8IagrbsdHXltB-%n;5dUjL*2j^GYVi>
zDHrF?vziV~Y0p`yuEmZ(Hg(ER5+ttth8Du9yI(5KFO3s7$$_kXs(f}02nK34(by`1
zOeSw?k*>-esn6)IEuiV<-i}CTG;zHo5Ddj`;vo`yF-m+MAcAA!hmtTXAHe7Wi*%63
zeiLrFzns_G+|?xt&kxr3-OJm;t|0Zsx`nQ@M(woR)r!8SJot;enZhDPuxcUb1=4(H
zSJ%i+<=)t?OpKzQdw{A{HR0UuGU2vjV0ZC0)qE>rAe06vI^WI2pqwgSHt&DA{aafW
zoJY+kz|b`x;D~BI<O}F_`&(AEA7<I-_Cv;3ZQ-|h`=Mkyo*e!uWU13a!$1GMvOn=u
zG=H;vVSQNrt!;L?TC@d&xuf|s&le?Jw)JNKQa2x}_RsmO`SXfewYT5?ck`!^pPRqw
zvK^GaW$oYdynQB9=DoTBU`ne;Du)=f`VDFI0dRlz46hbdaXUJ@zZSDDNnppGxCVUF
z2kdt+KJR87PD3roTNXEH#<`Z?k^5l;<pTwP#j;*}okup?WFKF3X}Y~R$JX77%vz|C
zUGSu@FLi3&s0!88llkJa=D5^(-K~oL4EKQIHB<qX`X<n%4REL5ew@k0Rdo#+)6H2h
zfP77yKRB*_|If{>qKklk>pMqvy4SG3&=NAr|60tP%Q5@4wOB{gyN0T<mxQe0ZX8a)
zWa_+H$andxMN8mVkIv=gpt(~=^$55&*F4_sF$8PsA%rHcdBqy!fzEk(m&W;&_$Q~1
znY>PC+d17gotwSBdoGTyg8l~wkK*Ir&`NHFk=q3xw^4O(-3;AyZ*2u;X@Yj{{@|W`
zxUAP9e4|#;$%o5kwZWHWot%8QwAPfZ-IrHm$h$syFHD#97L1JrxidqhvcKgw=#5+|
zS<RGf&F?XD+;7at@b^8`tAUAtaS=u&6e#wR7?C6ZE|icXFQtNqoY5dmb}<paf;6E^
zmWkInUF3~=q&cdcTUkwZuo@`MXS9^5!&V^71OHhe9hoUYv-<t6o`YcTG|G@sq2aOB
zVg<{`C~tK-wQ`m%oh2k)G}Y<}C_71Cpr1{s#3!kW8>;Jc;YeD{ZpX5))d_o_no_=y
zHzJ>pWs8x1Oh`%)lPO1pMIoXw7l_lqPemHI;z4=Zc2LXJvbd(7rSr?Hk+q|i4y>Ab
zxpbpM)+ouaaJma-lU8r%=2J_cfm}9*yQYy4PE!@x5;77~N7UI+4gsw@>e5GD`lw4E
zb?KuneblAD8D07->#vuWtpaOIJC=3s4-N)Npw)ISouGbNL2p!D)(fDZT8?d7U#%e1
zkBgs#`g+te4~VwgS7S4>_dsEbu^-ZaMTiAJ?n6_864y%+V>s~`!!C<=QrLbTiLkfi
zX)Q&czI^qQQ&2&R5tVJ6rp6M#SEbZqbL~PknX)_a^L0`pFpYH6XN~$+|CYfga9>Q$
zoi~j~xs45`{Mxw7242@UO-`fIaz>TTGKVqB=*-C$0)%TworF|fs&(h{{Iizg%cTS*
zZg%Sk3ErmcGkA+Q_<almxUxyB>_|YTp!1sU9Ns+}i|iI8PCPdy$n$-Uh{P$PNyJd>
zOP6sfg`Xskk>P4RBT+NyJ@sj)H8Abq1Z)zh0k&P<+Eh^XtRqdM&`!OkNmm|8wM5|j
zUdWr-t@_<w44f`Rrcig*Vo;!jnnK;ewjVum->XM%Z?dfW_}%XCxsAG5)@8#Q3P^vJ
z3zfZ4j0s8YkDHQLDRcGD&%sDN6GOXvSHk%%({AmW;{5wb^|TX+4Q{%Dq~l`|1aT}8
zb}>gJA`~S&@KHoq<O|M|FbbalS683AsmI&&pxj-lOd~&Hh%+J)p@EAME(Kz#>qY^g
zAp^F_W3HWt<?d3e-~~u|uZ!FmY<H#Wx;q(2$*H#E%MGGeZEDu16g-&U)b9XUQ%g8s
zOWNAR3`i}V;6%AP0Mb+w(CN2RaMRvNnPn%J)ig()Vho_l5K^h+u^Ge#f{Y14g_WlM
zQAuUy`DdH+M==w=&ND!>6@U<UUVzL!%efXU8Reg9mL{-IoOd$zJgX|oufaE>IlJ1@
zrcGIT07f~{K$N9W#HR*rR!FhZ#Jj~xv8ClE^QrtI`AW^NVlx7F4CD*`EbUZDJfF=d
z%Zm+6S$ez%L|I;nU7p|o3CNN|sOzI74I{)OOt8m1?nc2wI9`mnF(f5c?OZnNUfuq8
zu4U9+lT-6i$?f9{v%7|CUtr@Off6@zo`R6hXbAut*r^S_qLMfkRVO^O&xPFdry)fi
zNtL4t-y;=GdwP`4Tiw0!tT(2DjhsjOG(cCaM$`Zk96O)xFdt5@A%|>*82|@4zvQMB
zYJ}~)IDHQFV}=?yGn)J;@K;yTsIqFNCF}YG7-X>5Q!$V^U6sv6f^0>L+l@txXJ1vB
z{YIqLxsrT9bRWvE-(ZFsbp{?bMNI;%^E_~o8^#!sNJ1KOK@fA(n5T*0(r3F^`C3BR
zz67BTprKJuZ^%1rJSr5iKBzm#w=u%xH<0zYKEUBoSZF&3Z>sTCck0j_M!4|3h)9Ha
z=pqt%9*TVyAvfhbjcGz?5IvMRZ0s^D#|LD)i*fTMw(jQIOyxhkzINizv(R=;W{z>7
z9sCX!ffmLKfpIhGfa0a%;${;5w6Jba)yap;#yny-z<LbcYLRs6Q&afQMg)Wk@|lpu
zYg%15zrKP6XzEsf|GHdEowt8^<^?*3#L+OZn_HsYi}ogT{Xk+F2^6_5Mg&WVs2@eh
zr9qN-%#&#%o`9;}SJEC*H;*OfE~B89;}8+%aug?lhk_(!#3wA`tRH*lZ913$8^-ed
zlXBrT$CK(`WA_47SUWY9oY!WiJMW0!>*KZ6mW_&w@$YIy87Zx0S;`;kKe{S3s9?~X
zg@7mX;)j32*!RQmN2Mhj)wflGEAa@r`D-9;ey;VeTjxKXy>?z2E1;t-rITG1_5YAX
zj;;ZgM^{zuELX*qbWZ={+3Sf>T9s;T?%K6{JTwJL7NZ#64z%`0dWII)05h1wDWqFn
z&8jvLZkHpjMX$lhZgCzOh5Akn{wJfC|81<BS?NfnRf~1mZ?!AsM$%=z$o?jU)#E}s
z%he3t?RVa`8Z_O3tFw?xsSs{345|k(IuxR_J^_b7>xvOz6==tua;0wQ&_}J8L+09=
zEgRy%AojAzRPr$>U1zgX4B`rlsnX_h<=5kMzNFceiO~c^D1h@6D75YaQu)oau~(5E
zjcN3MqstM6-t|MCg7r>#G=LCY3<QrZ3R&pK7`rZ`_)!)5C2X0xV`^+p#}>mx4^LLz
z9zwDK^&G}$G^Z_W;(8D37^1OUweb2r`nRIDf^O;rMdi5mtxMMela=?Z7O{+s_aDz*
z@0|m;Tf|W9-rNEeN^qb0I|U50&<<;VqYk3F{<lD?55x-l)oxx-SF^EcAX_)%1<hvK
zZn2jULcKlKf?z`nnnj>2mQ`*UGxuH$by5FEr>MF$;n4^(>WDiULB6691UANDZ6G*I
zVoY2Y1u|raP)ZPuNQnHv<-%jGC#c-T1_FnCoyT=UX5PCm#JZ4m8F`yf0P9d!qDXVd
z?wD~`jqL;E+l^B0@{|kY(<DVCU@l5hKS6%%;gn0y=h)wMgu5vTch9-Iez^C`y$fS^
z_{_Tr<5*zoqc{pFB8i9)q$)wa8-*lrT~7V@Q8VwZAGS6DFVjD0MdFdt>8_RG_Rp-l
zWsy51*<D-W2;N3-X&A@ROt|9`VIAXp*J~Xq?3+%W+Z!j75V!qSC(i8*ig~8~?wBw)
zThxg}A0}aLbFCcg%H~l_1Dr_Ydn84K#vCzEMu>6gODsGbhS6iC%f0g=*)C1yHiyD7
z-R+L)Zq229xOJEEgoH_eQieT5SjZ9eJRhY|l13~cksl@dW+EB0tkw7weWUK3lw^&S
z4vHPD-d&w$FvROAPt!PzqBNBV<A_2YOp0PxNaRu(2;n9IhxF-Wxag1haBJUlE3ct<
z=@63)xBY+6rLh%s^58zQgs=_0W!uu7sVyzj*vW^>wjf1r+4ceWEv?J_{Ylf%lMk15
z&wkS$x4WRfwhi*zCY!L2o`I_{z&xRG?4wX+G{S--7LybO5fv$8B-EPI*LD>)tM!50
zgK5CIN4x;Z0DOdjhfzY42ziolj}sCJ4j$8^d+_0*yXJOK7Mh>vZ05XOv3XX)<+gL$
z-Sr+n<zAZ2ATn&37jQ+fTb)=<JM)?+OQ^jv4^S~zd>?SXX=cQZyXD+@tBxoODO)y;
zH&hTRjPIvez7o%tOMUI#=?47Mg6FFO2F0X)%T2RYq?7Tot?gl%TUR;w)T-6O28q^L
za5FXP&_k=$B|JD^R<m1h(eWANq*Y;Gx&bAG($zMLlFn<F;S@ONmNR;*LhTgqBs9j!
zR37B&R#T$Z6fD}um#2{Fvxe{2e!d@^W%e0pIFw9c-Uo8ZY+;x-viVXLWxmkRV}(}+
z$Uib{Brr>*Ls|YA<Q%8u`BFMrHSQHGS8T*97!b}<<|W7rJpd1c0g5>b5G7uk5=LD4
z5DCaOcm<pMFJ_WE6V|Ng%AWYU`A=bOX`)iK2FwJXJFg%-5RUPgni#t(kT#TXBn5;;
zHA`JDrVEf9@)ab6O(nnOGui9`6}G84am1t(xyO3Opzc=bg>$`m-b=4aZ`5<oX+`^?
zU$C_bVQBpth|`<r=j{(F!oBW<L3EA0F#1d{R?MzVi;7;N{7*2z<CQ>YnTgS_L*83f
zKsE1h94bL`%;O3}*M`N9_ChzLSH5b|P_l*anYNg{U1#-i^u{`7Rb<Y%V|VLLbjIUB
zy8xBk(f-ygeBeoV20QV9v+&lw%v9l>ejMT4M^EOHgLA`{I;<y?xQP@Y36NymMMR`7
zVo8b-j|d^yr;PNIvEN0q*WQRbcrttUt$nYqab@o4r&J^N0Dj7lMoGXhMX@J6M7)Ti
zm~xCLOIg5JAPI@~8$U=jaQDF3BW3fvsqijM++GVvM()();6^YioKrRQd7(#s{jiQ(
zOJP_K@4|Fb!h;}<QRF2UWXu#X>`^3r*C#<3vm{L))rGlH#%z}PPM*t06(#R*jvgh=
zog~dQ{$wrh?CCikyu5>txLmQJ1sDV~EvVVah_(?7CsQpBZS(esQ1(sxhWn#t9KY7r
z+B-ZLAoHO8{n1PO&|c!^Qa_kD6ba6-FDMc+2@&z*7$ukzgsGqUoF=j0;X`?et@J{h
zZu$QG-nq@!Ih*>ojk@$ZQWk`!H}~6Qoh$}VP3-&WM`z#r$y`t0nN6en)aip5AFTWq
zd2vS_``HF|sbO#JeK>(;5nnplwwKMc{h|E`{pnP&5f0H7XqG}*6`WS%oz@j-+tjpa
zvHo_V|M|`xiOZ}$(|6Vq4t7e%gkqPt5(NMZAjI<#<qRXA6Q6jLBrNrI%5F<%rF4Fg
zS5$@7oWA&Fq9lQiHp_19qwZ}*t1a}}#sx8Otw6946b9L#YC3^(>aZgJq}bkW7QGrv
zsIf~w_(lTl1Q1dDxu8nqcit70f6{l!vdAHFL9uyPv|1^SICb#X=InL4-gvrVm_^-)
z18aNCV<Jrj3KNDAaT!KT2#T0TJQk&tN{%05Hs5J4&;Qhv>s#6=?AuVeWm_7+n!BBr
z;KYG>T`3CvtAZ;2_RiEP+=0q#|4Ux!G#l{m<lK3ygaKg3Y1T{^Z35*PG8!v?ZA&<E
zMVI?bZQcCCPA(HHi6l-CAp#N@Q-Nrbq$u%SNoeeb3FnUmyHgW*nyTfoFw0}o==MDs
zYsZ~8Rb2P5`G))M`;>GxcyGofgOL!ivZ6&*s))*QL8RC7_D6O8uI-Kbb-U}oDPZvS
zZ~7v?>k2sJb?*8JmodR8NVx|Gg^Q9n@=)S3KcW#yv5cPN8KK~U`W89N;eR|R4s=lH
zyWL#v_Ay}{vG&mcr+Buw(jl9Z$$97f^{Mv8AKQ4|bY3~0F`H$PL!L5$A9G2lkEolb
zh_F~7O2QC%ZsbeBn8!u5D-heo&TDTZ)z6Dx1`_8`zI@kkBs8yf0N3jkh9Tn-kk6Fo
z&R>8%+9dh4Q`xqR(dL#=iFX@P0)4yzJ;3f_V_nUmgV<uhFprSOQh;Jc5u(z=D8w!a
zF?Lz%`Fl(j@MV9_1SCgl=54nLvr4F6zvrawp@a>w^9LC6G-Wculp)tkfYUamC=ryS
z0CUO$FQy_09szg%+H+3j;<KFPOF8N9j}g=8W(~W0k(bWtK;=GOx(AcaUwi9v+P-;y
z-u-d?mAdA+_D;36_|DDx{^Yf1LJnG9@NRL#@B<rA`<)B?2W12AkK1=h2!8jS*N*5R
z1Qh1RZsMg3c_EDvVW0*v9HEFxfZ>FaO8*fK;O-qcIE#;m@Y6Pt)Cb<0<M-}^ch4i&
zI%|)o?D3R6z$rV7(>jQUUs8c7c9F+|5E0J{5DUEk1p#3=@dJ$AeKZR#aV}*67hetk
zQkucms)a7%=DG=JX^L1Mx-;TKauAdRd{sI!hv!!d%_b)oSM*A@XaOA<Q!aBgpbEzZ
zIg#=LKJKBHRQXc(;lPRsixZy<fkY^LM0}Sb>Ix6|O#&~7T<T)6$BgOtrFB!LT*`OP
znJEM&O$SHqIcfWiwyFKV?l_Wi8YT=$H}D{Hhd@kt9AOW0pK#Cf9wq*|zZ+DJf-Q!2
z3yse(K&vzmbx2!rQaTdii=ET;@oEZ(CbE*wS$4GobBbvt6jx^RY(@){Pwi;QJ*3MA
zCTPsr1K&T_!F3R9TYJ6WYZWZsdj~3eDb|ZX&C449)GO<nma57B!*1nPLQ+!@gtFIv
zLnOK?*#1&|ag?97k)Qs)=jC)*ae}&$OZ|W$KLGGT$R(nQ8zLNdG$1Z^T`zou({gYR
z9rC<XB*40glM;yY%}JS+Dk=Q3kR_lIv&HzS>6~gt{(Ln9+2g-gSs~SvFY5qUH6@cN
zMCYoEI?a}U`P@0pnF8tl`PY}vCr~ArWfp^jxE_GxNxZLSIfAY`&{6zStb1X*!+58&
zR&}F)&e|)={_W*RhQOmm@DOLM*^h@kY-5)C5%(CvAy5PP#6{FiJmgVIf-p(ApGHrB
zpkuIt9*C$zN=XBs5)>vPLBtCsVrh~hH;NN3BA=!5NYwGrJpOMahs)2T1JSX@yHaz!
zt1s$87dGIF8%so8U*c0oNF-Lv8Ds+1Ob2j@&S)idiEsr&44QdCGj?PRv;EpUZ#pH;
z2n7UTLL_d)QRKP6&59XfBnS`*I1@n{B%B93<@pA}dKdRQTX%2-nYm%C8ri1Fbpz?M
z8^Dbg5NckInx{)!tENs#Qwj12WblSTxKJBglY*2hC5W6m-8{A+l4J`V(g0&`7&>z2
znfOc>z<=@=2%g$tP+1e}YldGneS{`0VLVMj?jo85F(QE*Am&Cca<SxI>N6UK_#p*P
z7jIm$8>e9_UjALz^~Q-QbBBT}4_XhjFY9NiL(4Ws#bzY}YE(i6=o(iGX>s+j6U;Yt
z&NL9H)7r!2G`fQ@%}Q<5<}6a5;MXP@iIx#hK3vw{=r2?SdV{>nmQacM@D4W1`xEGn
zbK$5QFee`_)&J|1N`LxN$pUC?RE^@~!{y7e{!V{ogf!?H(6#ANF<(skLv{4i?oNEx
zIZcN7jKe4pI8Kr4LhjC#M2LpIk0kLuIA)|T?s1~`Z>$3x=-pgy-_m(Lr?ZjMJY<Oo
zLojNKI6)+07}3b1D3CG^Js-!O;7{!|-z9zAw{(~rvdH6cemu^f`f(12$>1;-p^QR-
zDT<_&h;SUBSSB8Fahiml#{$ayC!i%8Rp}uWWLG9UjuM7M$Rr}d4^e`{7_or(F=c5a
z#P)H5%5SLBb$^mV^IlEWcZN|}-zv{mRX(Rx#+^p!(cXg>d2vGv)qd;hLkQI>V5Y1k
zAmDw@gyQrw>EIN(-`N>drBi*I`0Z}>XJ=r5%@z#O+!+IHhXB!JI0g2<Rpp$W(Wa%c
zZmE7NZCZMEW;DZxTqepq-dW&ZDhD|pagg&<zP#=J?_jp1)TJTD0YQW?7ZKl+h{*^r
zuaR(FlBNOg!@-Y95D(6BI@nTbsangr$%?qUO$B@fCM2@iRG(zc^JDS^HxZOd^Xl#|
z=l}bE{$C3YXOP}0xG?0Rn%%Ypo$R)^^9;Bf#H2=K+D1+~hrcx@-QNAsHeGNHicu15
z7aUF1P1SEmL80)eb1i2}P`x#4XnN}`6<ibETL@>F!;zQKnc@qrqXh0GV|}(<!Z3i(
zM&~b7z91!w)y^l>8&geJq3B|3|5d*qDnUY-LDo-|ArXO`+Qu-H=i?`a>yI224Y=L&
zaDqMLV-_PqA!#*>666w|xIT56x5G_fFeKfDJDN@iydfPwT_Jh4%s|A}(?hj#F3oBL
z@jC-1`OYMkPCBDkfZU;_3KTPh?8=}8*)FxfdhYy1&X#36!?3oInom9SiX5a~vZdrJ
z;DK@|yt|NPy%1&@zjfpy%?mE)a#1yU&Ryd@GVDQ|`h+DZiajC_NqLHxM=27K@MBCV
zj{AD$-fE3A&g3;fl&EnAwMCCLY>DoWS|e(PUr(sI#!WV#t`gzADz1K(pXKbe9=w0B
z`0!N}a5i7fv_M#cLdV~DEBUKs>HL*uGnRj89#%C!&kA#xT`GI_OT9uy+;o3^{_0~J
z4c>_=eqMk5S6N->qMSIrcVA=$BqC^E1}2WI)E>D`!4pk-@zYEK{SvTYG#)-iuReZ~
zw`K2z_xQtPyu!CD25R9|Ufh~0d+jje(^RJEX^Mj0ew@k0RdwC1>V5b14-@AP4xZM;
z9^D^xH-2z>eb`u@>WO~wm)vQadCH-Ing^uc(SMWBH`9b)WCh^<R=u4%C+GwSMa=Qg
zN$=q7U{(A#c{_YsWfE0Is({4HIw6Ev=It*Q*H?cfbW%fTnlQD%w|u#4CY?-S&+YOm
zJm0X3jSf>k0#x0=R;TL>PwiL#+Uvl-b{o|XyZ<8<AK&Tg^y6z;fT4t5$&Y3uDi^oN
zS8OIvRjO%|G2ZIrMf*f=Mkdagi}BR)Cf(%rfieX5${Cu1oAEgLa5*|Q%0R2q$*OOa
z@weLo%RJmZ(yQ3YtI_7v=>Dumv`(wh{RsvajK-ZYh9CY&AzoLFtMj{)50{(A*|z@T
z-&&N;T~Rsq91p^B@FB8qOvh@q*Uh~WgxnPn<YTDv?+?|H`gD7=k<$m_qgAI4(MPMT
zv#$r$l8x1FRqIv@O9y``(*X2zPQU!;KmOq1kvuYRnB+zE$6K?xvP#b3I)#G%`ARN6
zGFp7>to4tcK8^CCdSxt7p0=wUq@Z!qL=NxCSJkyFl#>mH3vXvT)Y36>y!c>d6q%49
zkx`67MtnqM>Y*e^Lgafcpi%-Jx_A$8ey#oIsZ-ytdZe~fvy4XB*Rd3`yRmlFq436Q
zq?F^1+BL3Fneh6y7}HeHuIBk7t8!J;VU(#6ok}tiB$!4hh<JoZ<i&`lp@)1CB{5B9
zn0n&TbgH`Z0|N;B0K=e1>!?8;HK?No^@KDieZGQZ{M~C$-Dii&Qx7v^jmc4KI%-Wv
zt?8&W9kr$nTGQVjP)j+q&sP#J@)B_S;K)aWyAmbLWr!t_%eXI74*bP?Dl3L_=Ds>h
z?FD;4U8Sw#0aca}%_X8N^obiFH{uc)rd&irmmnF)PzokV<jJGva`gQieLqLv&lZ|X
zm(uIEs<^aNXZ?{msxL?N<*2?K)t96C@^#ghLu)ZCNPIyPf>`83u#WT*jXi<fm?zi`
zLK)!jG4S2t8hE#h(GaVw^Qt#szlRNs_9byScPVniP$Gh1tauorNO~bn+?aVXIbwSs
zI52t(B>djs-m|km^`Po15Qr&4rgSx%I&7s7qYj;wIlxJ!LtDtB!bFM{sNOnLPJ@0G
zS;=R4xhf>6@fm2r(1&~hTCi?TPnp-KWvGhhi!{4}SKt4h{Q=~|FHW(V$@2FX><=GK
zud8ZV{%~<ou9m=Ob>5;%cs{?73-s&Ti&v{^mgk=?pmP_iQX=&}s&dqz_33POi%h>!
z4e*};_TRh=_(j0ru9m7DZ~yx4wKYy#wq;db<O-C0QLTyv$`@?|>dLdl70MPU*R`T3
z^}+~K7ey)1tCJ`|G4(kLV$Tzy&oGar;?L^zq;6Ros!-*vxuQYKmgmm@%2)L$S4BQ^
zwg_L)HWUtNR~-0><zFOZcz~Z^XkM)<EyI^fI@gwutUp^bNsGnk_y~jGMtY!-9|jk>
zDG@=5s4fxJEkvq?)&Qz`+X56`uX+PH2GVhbS(jgyvs{tRWv~X9R3Gp#h;WD(`8+G7
zbDOUq!|xSc7@!d>k*q2K8Cor50qk>kA-!KVd;yj@3Fg4+jf0%5f=E3Iwa@c~%72UG
z7r1dXZVFK6*XPbp`J&8}B`PZ^n<?W{udL4*ReLiZPSUNjTFew+*<mo7@F%Awu*Wze
z=PR&UL4LtetCfa6)K@7c!VMCPl34nPgaJm08+pk0WfTOVD_yx$+^cow^^ZEx=x&#C
zgDp_`@09tl>9c`<k8T+qMcK|pjdGaUd8w=c)ybgc`PKQ<=^YAFWlS`u)ns5wv<hMJ
zntsmm8b>{+xB75ZiH<uH4QK2ww1(TFAPylx@rbi1aU&#YN)Vx72aXepq97$KbYm|L
z+&%2TFBfJm^qpW$zP1B57vb!7JCkr$7pT*tbF)Hp;0paL*DegRZbsLKb6UtNS_rj+
z@>JE=UnZ+kC6nu|1M8X`pKc}O8Pl;{W_=JIb~zk+RRlB;0gXB0ZUST`f*~45F_IzW
z3642W+~i?_HP)Thzsl^X?8BOd`}{7v%^;#c+1cv*utC_jEBIwA2|53u#Kw`pgU5%s
z*FgkLJNr4#?0i3?y_rnTyKhgX?Pu7>mwT24?~X8+SzKk^dYeaq`B&xmT`j7Qiu=P1
z&Tl6n*|<)AYqCYZhfN2AqYK(zRS(u^>OOv;6U7a1LPQcHDj@kG3oxQsq)5udO@&W*
zn6gK6cr}+vjoAaTNC<Koy+jmW^zatx9X-c$=Bb`D%6nj*lER$AJ+j1ZA^ihrO$pY4
z)L|<ceR}A$u!JJ0^yI^3w-w;DXo_*_a_V@MH5Clc$75tj4~#z?({CkEV_TE0bv>+E
zEC2XmziZ)exd(g^hS-mhCn-jRBmyN=GDKY_2=j0xqVys3j$f6@!-SPOZ<I~yVHJ?R
z20N~atcLA6oYGN9I8X1O*B_x*`3jmxLL(NW+(&|X5JZs#D2_ym0^-p?`f2EU_?wm!
z#%B5`J3KAfL2HJ6RZ8i4e`Q}_%ElS7_Lns7k{;F&A0AqS_|Da;dj*sp#fG(F!&=90
zU!6QSb5SfJ76$?)giu5hKSk6fK8mCpdr=gVkSBXc5sjCwMu)y>2r|H|joPJPq>9td
zaX#5jq8R#i%w5ss)a&q|++pBU4xWyXQYy#6*Ayx4W6M0ap<B=-p#erL;sg<q1c>s`
zMUm&bIL6dZ196|F(irm|d$p|N&G~JvmxJpm9>Z=B1&I5;L?nnfN@Br~q)`xXjD40q
zo;=#Df%=4~<xyA@Qmwc<X8kC9K3N0#v^hbBNrTJfEUQk}@R>A;m?rPt504_l_F8&R
zA+{;4#qahixQ7^fw0`}T#n^{+jy&wm6MMdp+=~&3S%3(WK8j@+BTRhk(j@R`=so_;
z)8dehm(O?Toqd#BV~ncozIVqay07EaakPMZ3s=X%eeNX2BuOx0DNhjbS%hL93zP)h
z<EigS8H5kvV*xc%!Rp$do{*2F*RpTP%W`n@8O4P8u8)EU5`d>^gc2!ZBzfq{komF4
z`S;*#c{{I`ebV_OBJ3NGIr<YfCVK4PTd{y-2lS=XH^pzocXHo*^XPuLmk;G|!E;i?
zGIAqCB#jVBBNtIhBg7(1eK#e7$MGSYC&gXn@ZOF5WZWlDL0))*Ch;^18HaV_^E5_8
zfJEt~6#1!#J%Ym^jnl{Sq#StZ9MG5YeJ!3tuOZJ(FprW1QASckn21pvNf)IF54h(M
z&MEm8jax@a^SA9<*+yVJdRV?8VfP3WdOBvZ!(l;uCgX_tDCROo1g9RNBJmIo1D8n=
zxvtwwcy_#fj*)L)+0Jovv3zTWlH=X+bncFWE5R&e*mZrB28<yR(g-C9VJPt=<35k#
z*cD%sdB}&Hq0iO^Q9mf>5cYWDN*I<j@eqlLk7(pG6beZr8dC1D?V*;2KBCRyrinP5
z{Ie_yNMt#hLw37NvQ*47#Q-7~0x6$ULtG=Av$M9&rn0j$bBwE;j@kz7+}NotDR6P<
zoR?ds1HaC1<Y(}AEp&sB)d)lKVK=eV6Q<jg3*D6d@SMN@{qhgLXMgw^I9r@~UP$0_
z`TfOmZ$6i@l1s#Hk^2AD3I^k1r5rUCT?o{S5D?*LZWl0YRJRl7;q&GyVQqt*<6yg<
z${-;LfN(HN5P<}mED!?Wz@uJ72&Vlg=3}PZ!?S6rU2AQUHo?QIdKEgS&t|jyW^%7o
zxjbK#`AjET9j42z3d%p#)}M04lpCo&RI(DRczMzAebjU_?+UsofoMtttf$U9xuA>6
zQO&*hBjk8>e$L8j;@o7_HJl01XZ5S*qA-~n&3;p%WOp4g?dbr`_`+u^^<Fo{W_!j>
z?#y-jMklRRt!m%X!!n~4oTIcTGN9$DlmDtzxAXk7bjpg(B%EmQ;_TL8MNWl7RatUT
z6);!`4z*k7M$%7Gr7Sk>UqfW1Rzx%Rs#$-LRNYM$6P^IS1}2CD%Mo#d5YbQ&B&bWG
zRJu5XLuUtqBee_%E6#aWNZ<__u|6w#$2ncf!udb{T+qd8MuCIv?-SsjF$+oGF7;K=
zT}HPX*F<|EY%|>rrHx+3iup!obB60Ct*^$Wckq`3&daqN=p&P$hr*fzN~Cl#p@;%K
z8i~9B(GaIdNGX6+hNjV>(DduAzH~lU6VVR3y?f2bcSqa|aB7xmwh(d&n?jdjey(7#
zP8*F)5zxTZ42FF{vzY+{&Sd3W6%>q+omKE-`!l_|axR@Y?4%5o3wdgx6}swVRxa{N
zXH@DY(w&SX*VS}2Yf|ghk3Q=V;WVr4s}tPxG~w=Y>mm)CVw_8dWedAl82QP>jCBDj
zr1iA&<5YRc>5LYqFbj6IbGxL8BJf-PtlgQ(!~v;E)m``If9Ki4`IIfhCEShq3Jy&u
zW#Z(EwncrEg4L1tC%psc<bxUnI+G<g^xEAqnmTwgV76%bPD}p1<K}50=|)<eQo`-?
zGi7pS{qVl|rIAm2LvLi&S+2)`%~n#Q<NvPXC5O7|;o_5$#EWGj5s9ThMBo_3faBtx
zn@a3OL4f6M&e%3>DlCw0PYrXPEnA(Py{%V$?Noyj_=Y2PTtM0^?^r~BsuE}i&;y!=
z4IHaC*BQTV3kO%;JTI&IlB;I7`Ydm8WV?D%NA9~nnze3$_=6zj5+}&R7$YLw5XFJ#
zqL>jWg-EFc*vI{a4tCqlk+LhoiEi?0wv<|DXU}D&F>{SL(oT^Y4?V==Q#5r<YVz!F
z?M&1&pr=Gp8#nrBBLJ!&>p7y}VAoAh?6b5ibDmLnTCV}qjss82vxU$D(h*3!(DiW?
zBSyRk5$5@ba*C1XCUL^tgb;BkTB=QMXxK6L7E7jk$R#j|y{&W?Jo3>bj;EA1-V!dl
z9sKPu(d}Z3b;HA<)I67B-%C)O1|A{-_fYJn9tuSo2Hf>Y82L|MWjN5@H0P_<snw6E
zW~qE4TlTB(*iPyj*fB~oprt&uzq+PnKLP1<_{G>8P14b6|Kr%xb+(>q@00cHI=(tB
zfnAQAJ9_A+-AS8TMUJx9nT+%U)N>;>=weSkT=wd*pV4($&zQ=c_a~OD0dcu)Yc{6d
z`OZRh_i*^xL-Wl9;_l>^^A2_uV3rcjWQZaj6GRe0P>fxUL=ps1=&>M7c4B+!89>(<
zk2@yeH0LY06!Jx1YA%<OXQ@F4S_u`_SXs?wF@;myyaY_s%5s}E1oO(Fvk(r2Em3CW
z;oUk^e5MO71v2RrZ#7l_ZR>=p9XNeKTX(D(w4uQ@4PsC5I7EaKj0hJ3F^U;P7s)h^
zJxsmmDah9F*j+bh_rSaSmaoVig<AX_3bkcrv_SZydnhTV;<KwOAck+A|0Q3@*2dF)
z!7N=}R;F!e^IYif80DY9a$&6C*OFFqx_oV&-&ci{i#JmF!vQ;T^-g|)#s8oG*!nnM
z<csQUa}om%S^Z`new~-fuc|A|t16$vDZPudemKqoD!f!uf&>>Bk$^}<i6DptUKH>+
zOhxkW>hy54o3l-)i5NMQl_{gKQyf&9{-%$Lqcr{PO4IJ9bGtHUiK7paZ{r+4O4lQ2
zH#ykZ9e5lQ0hW~n_+~;$5Cx-k#6#h^9(8?>J_e#KT9->NsI9xBfDfeM2oDNuOIX5a
z>ZK?ZL5hgWLKOQUV1V2pjfEts=tV6Z;Xhvq{-cmI_k;he0S#&>Ws{_hK}7?vN%mRx
zpg%RxN9l_f>MduMmDSXFwx~e02E$WrLQJ!naj2*VCmp;`AL|G5O`0uq8}81ab{Dwk
zCm7jc4sudy>ev3WvdU&NXCb9}ej#jp6g;g$Ahmq82GmreTb9crUl!o<*$U933K;5_
zp&LYD>@&o<j1Y0d0L5{bA}na+OE2Iu4)5h#(`)Dv06j|VQ?=cJ=h+IhW2S6Z#Ez<e
zfY=F>B=#^Ph$dij2{=cTc_|8U#C;wIVbVYHo|ySvjm8s2<#gr#W&wP4x&H{YIYMo|
zQK-$<v>L%ylH!P**iBa<(?CWkLooq*U_W7qk<>>C!;HBkkr81Bgx@G=M@P0fF#Klp
zCb}Dab1#gBs%{9K3BrWXh-2hR835LvASykEywDeJoN&U3JjC^W2<XhX5O_f7%%KK&
z6a*7WA14v<kPpL6s0dKP5{g1UBt8xjmeTYa0Ksg!=^qZ~^7QZUBX(sc?8@PwE0QuE
zWALqE3H*z~LzKBbq5(}w6sNAs<8M}WespxoQ{8AsBl)*$B>(oEn@6Mg$PpeLjzTvK
zU6#@ii8vLA_;G}&?-S%Qj=hNbX(-&UX%zQEw8<o{PsxWgiAN%EiA*R;!ze{0pdn(^
zWhf+x=aZOoH$Fzh-p-_Q1H)m0=;2M`Kr`~B0%BY9xFu|;==Gja{QX;+f;(O_{(?Qc
zF=m6ZwyI`%{%K!qljf8_B~2yLq{0YlP$BB=WB;@&CCYV8_Os>Wfnsp)w7~yKtUy~d
zM1pE;t#)Y-Lg{e2aM<mVmZcRS`=e9n*xc*v>Kdu=3eBZ$hu5w#y2C2ED~Of|;_@KG
z2+PPv1oHr~(8b92WfEX4<Cv3OlybFlA1H>_T5!8Z&fZ~ZS4Hm<9XlM{fvG(qz9-W(
zMM;W%L_|bT9K|le9+NTi1ddYrmDL5^ZzbAq1iODVYdZ|{K!a$$e5yE`p1r-ZR(^|-
zt=&^$B(SwJLdUq)gBjbq1OFAnTCpdnD|{bG5=Dqai9k#UA0+{0E)@}v0)8L6dZ(kt
ztbV_!)~<AOzhKrKt-Zs$WoS*uIHaD8Bg6o;LO2IbrqD-RN=9iMGN0fBT-*naL+uRe
zBZZ$ro#=issOu(V)cPKApD;#%L=3F&I3Oqqk`VbK71+g$VLyBl*7ti|{`WJ$?{%#|
z(fH9`UycE!4;(-$T#;bU6-b6GMI>S_TqPbDbExNf!i&O(4?}s}oppah{5QJczGGW_
zZ}6wR89HD9XuqaWb9}%0qdop;kAH*^P?vI%xIRZbAps&Zh!Mj?B7t$tY2c@+^uIbt
zUCG8@3!}~xKfxiED5Nn%BmsL;;4(yg%7kDdN!byj{v-_Y4-8T7ppukQ)9017Xer;T
z#z@gM#gCcb%heL-D@Tp++NiF<?I<tMYN7u$26bh3H-`3vrLpS?g2E&TfEX!333e%p
zLJ>+YO#Fo5$=ytpzn0oeuKVg#U{h5Y0UIKy)#8ROK)I{a3Mza0oZdP&v?u_jUMa9T
zx`F#m6$6QSwy@%^fu%DU@{sxx;aEyUA~2E1GD0DBaTE*TM#^Qlx2AnaRQiaC{7_i*
zc2;&akB=kKBQByy1O$120we;cnnIdD@}Q7$>V-tbCp~F7{%eELcM<EK4#MVW9zUAL
zzd`f(BSX<K^IR5&9AWGVM3^rSBT<S{pArvqPH7q++GKt|B>I@i{BZ#2!|P^fF;7L{
z`T=%PAQOQ|AQF@aED#p~2{HCq%+mwh;|GSHAJk%gpivz)dy|x<G>$?<A|Nj1K0~o9
zC2~2zEQviXx%f8B-VcX6-|M>m`c}B3*?V8!!~<Hr{S=P;5XBgPi!L}&nI9o4MH)t4
z=o2^jmZjydZuNdb`|W7;K3ctxDD>|bg)Rdb5f15*X&50ANQxk`2qlr{M?UeSuhM3G
zJrsI`HrTu$9)ym$D||1ah<mAv2!kkG&&4S4d5mKg_>A;bA8*rb_e)+$mgk>TCc5U%
zQ@w3sI;6<jOn+G==e5pwr!w$+^`6sOp^fPn<KNW=XvFi`j4n(0L;XkBG~M#b!IOFM
z!#`o{`(gN_vOXK*acf4d#ADgK|Ao$%KN=%)tJi4VWnT#T%LRj;wwQ8d!Mz)CT_<qU
zN!e<_fUPQv4~{NwZ|LpWnZqQft5V4mO&&H#Qq(t`pPi{roSn5|$LSK>z}eyomDzkX
zYgs#cEOS*sp>d8*$s@(&+&MebTDDe?AiG?q@K1epOqsOnl=LQJ{e`h;J3{BQ&K62K
zD&<VSsUV;~I%j8Q8iZU}^+5ZYpQQ6U_{yZU1M@y~p&cbdXG#~nluy%sG3p{dJ9FTK
z&>~<>i)w+T3t2AnMVYaggc10)JHpn;mJZM7(qLBsu2uK_q;&F|g)=t;`@dI<PdevZ
zogA;UTo=wo^A`|qUrXmkGUrq!@G}L#`UQl&a(cjy)2En9{O$b9T+s6RNA>2}nH>Oi
zK#ISw&<vycvJvUvdlhG3eyxgC2@?XR0p;rFQ;nM_b4UGHr)PwY&ToN%M?I+OhaplS
zKHH7a+1VQIovHJuFZ^1;f^}suk*8Iij%?x-Iv*Jn^76HrX#HYt;s+Wh%7s~Sx|bQO
z_9{c=lFl2`!`a!na?VsL1!L}%%e*oH4SBs}Yd1vO7g&P8jj2U_v+}Qte06o*%mb$j
zVM0(~!yDDXggro0*Rl_tzI*n^pC?+axYM)r0+@d56{8yt)7jZ`#%QIM5+oPVQ5J1?
zR2s8VHam-DS68yEtauIQiY^E78205^->WcXBRS0&ma(7uDD{D2mn8v;10JB*cca*s
zF=gC4l$Mt-+YJbtn9J;Qcb;hF+`xQ}9UM)n%}(URv>m|m8b&Ek;X_u8l$y84n4&~>
zSRv^r0S7^zntU%E+ZKe#C{AVIraB*}fn6<7{qQ_1WJk#}S5HIOY3YhKh-ZZN)A@(X
z79s@0)ZPsP`p@ngL$1(W6ikgZLK<i^u4Ud!$*k9=PF}6CRr(Rfaqi6MvA)+k56ZOn
z<g{(YT{yLAJ$Uc|9{xf7KJ7y@Csvv8z$u7G6Ll&N$MCf*>M?0STcZ;&?F`}?CzrXY
zVWL;_Q&YIzp!&b|cJI8BrS(hQ>goZt`m(-I^@b`?jn_wTnBShx=_mQIl-0*9Jv9Sq
zKd)DyzT&3!u;?#MeRnoUeeq-ciru(%W7=cu9*oH!9K2>Bzm^3Daq7}h^7QHO-809<
z_#8VIotc?BZnFxid<n>()|B7AJp|k}?LYZ&xn_OT;p?W1I)1&WxdG%^G984-_bcx}
z_kPztQFprYyP9k38EsVgu7c$coUDB~3HQq2a1ay4bbULe^SeR&$X4ysq~=OZhbf!W
zFaP<EKX`a^gSR!QsIjNZ>rq;DP}8e?`I9ZN^t<;Kh}X+1<Jzpz>!GWRB63m5Vq+=)
zQ(HOuZ|^oIbNVHlujX&FtA)x1v8bMBR~f7ewGzzFFA6PYHoti=asT;`i(JT;;zcHB
zVok^N^0uF8n_bc3N><~)sR4dfz)4fD{W@8d_3gX->T0GoPfBMc>}$<w|4T09Tf-`i
zVF6rcpJn;i+Hw>8eXaBgLL*$NdSleCiAcI(LOm4Ym?FYhisDd86fhZtE)Nr&9t@D5
zFZ&WZeC&v=+7Dfhi=w$wVb%+{BW8nvkh_<->ii|UvK}auzN1-Ki+pi)C@ttH6(6PI
zN0*AV`2+-o=W0_P1>$=N#QouX0<tjPQWiFbV%_eO50}H0aTJA*qVQ1^K8nKMg(%!P
z?m99tmV)|j;3F4HiijW*#h6nR$$*L^kx3l4aZPJ*rH|?P9hj*9rRkiqRX?b^R|Kga
z%YY#2^9T`<h6r;1A;u_^aUfmVkC@+p%yeGB1UtW|d|#jC>5E?`&f686XC-JDZDft@
zkwgd$LUJm~w#pdcoSkj1@$Af5$^w+o7SXAkCLLyB<#xH-2dZTN<)ARt7ZTh(Iu+J6
z{S56fVXsq18LOcxh*dRu&)Jz$jKIMN_y3t0#;Nn`o1b;Fs*3XKxpsURSH?pwMdisK
zf=^xFLC#P4^7de;3!iz!7o4Iv;Sv#7hKO;_P{Jj{N#IlJ^$DntsDeYI3P$#dCOj<L
z9rNH>Uhdqp-5uNAsNmE;&{o~JQSEKIX_MaR`Fveud688aI4+grSq*gs4T1i4Ee_Rc
zku9!(c8;%#LOHs+_7;e=V<xap(eGKNi@xJCtxYJXnV#!m+807R>;(k!yhuby5+Ejm
z0HvHHGGN@5Vkah>wJWSQzo-+6r9%y2w%dhh%s7LfJf-@U>mu^Ds^5x#=+)<(!WuA3
zVp=Z|?UFQ|HqU|cOs$Bi^Q>78lO~KWcjoyb1JZiE65B{WZS+!euM_{wAneR(mqoqi
zfn3K?0+X{a{ZR!si+>pZXHB^tQJ8RbBwLvPQcuXlOHi2l9wInO5XHWWI7`Dg;cmdZ
zhsQFj@H`vQtef5KtvxxzsXE^}x^JE>z-!`MwmfV$fO!LVn_UR~vUMR{Qn!t9hCj{n
zm3X#Xj(O3w!&O-^6xs!rgmT|D12N*yZhthUqAD*dI7&`Wm$WG5N7$~XZ|IGx@j0#N
zWOCkpX)<j;8!JD2eYsmn)|(@yEVU^=n*H_h#V?wiBTG;F?bqfTukmPGgHn5<p{Vw?
zxAjJ9UK#I=g73jDHbx=cBDL}FZjbv|?SbRy?&jdfYEC_2zrOkT>rL9PZ+;$als<>Q
zUc1_RU}Q;cHDc}~jhJrIw&UeK&UoFMkrQ4pXT5nGu1oc;KD_I1AA)7mEJ7_9Oin&r
zHXNJ%qi%{P@Pd{)*F9dJL*`*6nXY@*oDt^HrXjz+`FTS-^m^>SV~H~BUv1V+w<qKE
z*{i?%{KmR^D|Ct{jzz)L%sVal_YSI<Wea(jfNSMs=xx}3+_i<D7#3hJ+2MPCETI46
zZ(8fO_hPQL^7vcbJ+((mVM+F0Tds=b?5_H(rP+J^R)UA`&WhI;pzB{>Kxg}oRz75m
zwKY9U%~2|VE&97Gblo6eDDkL^NZ<nnZ0I5n?0g9&g6$U6zLm1|9Vm6%Ms8d4z;2N$
zazp`RjM5}c6GW3hAd&<WQ9?Kh8R1mMaZEk(z_S1j069u`)1w*Kx9pk;>9xj(OdU7?
zXR?xF>b#)YOvP*T8E=+F&ShCDvqwcM0F2j)p}njXbhsuYVtG}~<U%T9oWcQKoub@x
z!l2Ue8N(sw5e|`0Jiyp^60z8&DDf~$iHLb1lE;s(-&<ww>YUE^u5_9<8d<4R>7{-q
zOTU)hIkku~>uXMby}4cPW3;Pt-EY$>{1~mWMTu=1^}t$acLvp^{WV+F)v3CTvxSnc
zxybC1vjw%U*`|?k8xiH&7Q&yes%u#&)m8u3J4i>)n}4|Mytk3!W9<Fk4!!lbs-trd
zsqs_M#0og@_dP|kWhM{i-AqIxB9~C)2N6Sravw3yBINrac7@M<7spRdLQs;Mg6Jy2
zM@NfUzu!k(=<P+d1$!4V_{$36Tsj+WcKwWsd9gOOYVM`8?zQvYqt>f0#pM=ny%f`d
zM6<<fy=ER(iqXSekJ+W;CA}j}wKH4jP$Ar$Vs7)7x^gBP&zz>2y%C)Jb`G9>)rLc!
zCT^IdICVL4Qx}}FDMLvZNE8P+^8FOMag^LoL%h&mz0S)_fAxBeV)w4dz<K^ZWg#+N
z?WZzsSDB^1>q<?XwJO=T>pRN)PcumulU_EG>-?s3%qfrSRYAcsFILL0Ug>^ybjij?
ztK*3GP$G4y=(B10h$`ueG$t;Sh`S6UB0?9%(vOkvhSVpN#B4V{TL8kTu`Kmq>S*uo
z9E{jo^t`D!JKc85jR{64$ZMR@@E~NrgFtH?x&w3EyHXl1iBsd&ZoS<T=W|AN3){)A
zr>hxx$bJZYEHbuIa4bd8pl}$4oJ*0lG!V-iMk1p#XQ{%96sYVFQ<pE1al4O9n{;Io
zhABaAN+5G-6rm*IA(9@BqLgD6KSDOS?e6!yFyAcAejB^->lHe<^VK#{l+6db`}J-f
zlK=qgsN=6UT#M$RsWTJ+wz^EU2;f++zZ92Sy$SK(oug>eYk$_`_C}VgS#{n$!M3||
zJMSEC+%3=8L*BcgNU>m%htfnaL<r!9gODQPhe_hO!c7wP2)le)<9`ee4o>v-Li}zU
zbsJTAR8HStOy6af!e)PYhfbiM*;_(~IID*iso$Sil8th1HrxIEi5mNp53Nq1J2Vpi
z-Ydotvg_{r9wqU6#gO;?n)?Qi-^GIGhKFOpgJxy3s)gq7FSyiaVePgEIA?^qD2ZYp
zawnvSrJjp~6p2StmwFKEaCk@4NN|RcKVN{0hVpB*#=C@DO71lMXrQ`AoUCJp)4Z5E
zu;2}dPzSn|&R?IuLVe2RWs#@Z3>;A=M}v+>)&<o(%|@rVP|C!GvMe`&#S_im)aW&O
zykGocpS_y0t0zH0bg^^V9~tL&&gF<R>%vHNnW1HCsHb%2Cg;vGC4cKuAxm{SqgM{C
zhwVlMRV#RPR@ONqs@ZKjhO{)pxK=72P^tG;m&x{BV~|J0W0#WH<w=Anj{`(l=ph=1
z0tGJfeHPGIh6gi$>4?Z4E_!tJ^s%$Gc4Ah+M6V~cFw~;lYCQp3TQ&SkWg$?@6$56M
zEzz7?T*43GU~>*_o0>YWJ-yNOKHsXS?khd})@VKTc-3y8O}Df+a!ae5dmRSVI=k#^
zy4y+%!mAg_YqJ_Io&7nm)^HV>C+fybP11mW&#G$^`P;zt)(~h-8e>WG<Q)n7U?$-R
z-1vNxpAS~jlFm0iT<7N-4N*7437cjk0<SaH3XAv8@M~`g!O;G*!XBNk3*NR}!0m*;
z=526xe=S(C*;Ov`6`RS^Zq{rwPX<zHy$a*+jYMz{s!-zGol)G~&H{eUWRZXsVeu6;
ztsAVDF38V*w6>{PxIFu3ZDVT@i1u&F3a5V>2mvP_F8iGwdrpxk4d>*02lU-b!X26W
zfuxJaCEd*ut=}la_Y-M15c9Ze7?tXS=n(x#zFs%<`S^`@LY>>+cpnDm(ZlM35QO=F
zd}G5?^RT>QclNI}lii!1Y%5)NM|H&F4X^p#Lk1cyVmM`puqZ?cPJIMkHR9orxG{SO
zwO6;XWo_^BQLT5uV8#1c)A!cuD*WBLVMZbWn=rwtBR@+}pcS!ibuDl8+u0%mKgq0i
zY-!)x-J!ExPVYYHtcg@@az!~W7m9!z#2KAaDPNex#x<?M)O>!cE=sL4H^Wrh$e|HJ
zN&o<xi&uvZH>1epHT|6Bt70!bwk}3NKSp&}FY&n>5st8%M2PS-MvQTZ{4kZolL1fN
zhc*7TNnN&>^xkUG2`FcUq@p+7&tItt1;~taZfNPy@ritJGx8B5dc=r+J&b4<t!F@d
z_qSe5`;5_B6mtGbWo>#XCX;FZ7~HB2&-LMaTUWYB^Ya(kg3ey3yS4TpPP?b@-bHtd
zsf+D?yR{){eFge<cszTMdaK(DN8>Yp$?Grf1Zj?6bi=V3O!RaV-Z`)tsH#4$u@o3m
z@46na74({85fba+ZJrrvqVxWw6<$m;Pd;1@THbL>DWc<Ajqi1*wN=zEu#ZRG{!ZQg
zL6sG9p!7|5Xl3^o^n3E!K*&#`C`pLtq2T{#?@g2BMzS=)tDvJQ+ubRqPArOz5gsB;
zMlzGtWRginWXn_pg`$8e%uzH0ECHC4Ueh(wH<<q;(;{<>IZs_+t}ybRssf6|%+1`*
zxrK#DWzh}L1-gE3`<^FkLIozgv_0a+VaA;_q*NrIB8gM9A&HaYkf+61PPkVlFX}TV
zb-)0VB^jY2@<`;lf;gFLvy8f77!R4ejucCufMN+L-M(OkB|zuMi*^8VB?cw{%w(b*
zH1C5`34WayK&d2(Ih#XzCfPm^Pp2i=^5Fa+#;<VM1GTjB0@X>Tv?HAKI9wOt5!&RW
zeJq8f31%haq~1oXlrlS^kqAhX@QBbXjv>~Tkt|L_H%+6^=6BUX;JW&Jyh@|ycZ|T5
z;2);@y^+VIKC=!)o}|(XjfCe(x+FD^8`+Wqo25};M<k3wACd(IBuXQXh#=v1>QR;r
zl}Vq1ElGajKB1p8D@Q#IE^3?wW9Yl>tB3FRORfZ~`s<B#?Zyed;}C2{<MG&oGzdF!
zcM7As_dy;vZ}O!fqO={FP(<k0@6htsO=q)-ou;>}wv*GCldmns!&ARKc}4}NX6(oU
z^X0R^Y%aHX@&~odD<O*8@yMvw$NVT7uT9dU9Kv_pjXmFwoPY#r!U%N(N@6b(B(W1W
zWEoEr$2~OOI~=LUE>$0n(*q~t{wO`vTyJCa2pCN~H%&<r3QB00BqVW?m}J!Pc@~Pm
zjnjLWt^10m+XltIx?s8%lHU|d=TJ8k9?eK1C?(W)Lc&Doku;@Y7%&=V;$W$db`Q$J
z?thk;>j|)O47vVXA=k%1>%#<E4-fN0#(S~A@f|mGh=^UE(8$Il2oA9WmI>j8sqF?|
z#sTvAgF5?%%Q2?&7}I&U&3&IComu8Nv0x;DOx{!g<)QFXVh28BJjrO_^FsqY2o@T;
z;wZn}Q<UugWnH|tvU0&ib#^Gg-s$A~rT}#LnQ{!eQOmDGn>r*XHSkzvS{7M8UxSBO
zQ)+jyo=E`B67YlZwfbnnd53N$<;QdDStFyaY6}xO!V49KQCkTEJ+Dd|Usm}Xyc~=U
z=@kRNK%DH3pEed#MiNPxb*u(5xJZrRC4=;nZ5Ph1CuLFR&_;U6in&aNIWcHWY5i@@
zDljh;(xdLG%yEG0-eJB?OZ{)_;yqC#Ie~|H;CWGOhlEBkCp3*Bl0<Gs+`!IKJBztz
zyI&q2mZQ7HeGL<Sw$HR*B8ChK91^v-Zso!Db*g)fWc1pZ=;E<t@X&uxP%Z3Bet17>
z;loo4-mxz?IE$&S-ObVKz+O$8V%t#hYg$gq!WwpbV(s*Mr(Lw3m#I|Ksg4=v_>F#1
zMo8FfV(E=k&)Z+uF>pHZ>AP<|2>!M}%Df;BiK0@+qrRIaL_`54G_xHN1+GVYC-Vez
zyd+5m>ayd_^3C2Xv)xHLj+fB!68a>UklIo&etP+?L*6|~nAVN;g=j8IUY`whqfhgy
zZaN3p3oFM6YZ+eMt5{`_Mr}D>#NEzK*!<mlaa|7z{A#~Fn{M#UI!Re0=4ExQnjG{)
z<*#lVlW@4I*!8=GDCW&&zo}pQ#owMmg6cLIdH<pO44s&~{f4de;g`sQe=Ut*r_&T|
z2h#GrA+jCjuJ!518~q8KD{Z7Zg2L{1ecO-6<l@2_Mx+CX+oxzRKK*7Uo^Ac#;GGS1
zoxHtJY(>_uC%AO`QPSJ0H6yYIBV)v4_rLq-UcJS=dN}^~>S*m9$kBT5SmS$XZevvN
z=c7NGK)fR-@x-NW=GhKO<18f9ft(vG^oZ?6K(y&cf{8;b|A=z>uEbR?K4_!&=?hl9
z$D{kNC74IgHo0H!sO>|g30h)hJN>kg1-F*0dM~&nw_#R+jVe{tx%D$rAN4w<)l_Uz
zmq;^|2&-Z5MPadZQ!XJ}H-?g8g^%S=sD-%_b(7CKe$GnNtFowp0qNQ6fkS{9=c@XO
zdPH<Y#tD@kA@UQz^LJh3a6L*zWVvqA65O8Z^$K2-re{{vD^`gjz1B{?mDN=1x=W9_
z`)YzwBWkcF6l`HclgtSn;(L%R6;y4Bo7g1GQs4Gsp1Iy$<gL5RG)vQU#nNl*s_w5W
zrTe_&LQ)(bsHC02T7Z9?!Pvu~qH>p+txCmgeQy0FpI<Jd1Nw(c0qT;mm%x*<0{R=Q
zxBH{4z=1biu)5B(T;N1Qs6{a!s$r$?uww2~d_5MN9{6yLUL_mW@lJm1${FH6|L6ZL
z^--o5JB-7B{?Gq~PhYq0vFir*lC@-uJk85>{h$Byf1TZ8owbuX$q?*#p%-~1pk6?z
z>v$xNTuMSWqb^N?(2ebTm9<B@aAU*D^P!6#I9cl9m%HXfkH6B{chz)$y0391Nuty-
zX_mEFSKF;yoNG84HuyQ19ImEdy%YEQFmcSQ3N$`VE}*j;YB>KBzAJe5a$C*viinRZ
z7$dO|5a3{47<Kl=9`(jKIK1_uV$DG_1s{z!`>eI2BGyG)_1__ON%@`b$5*z8M&mZa
zZt|1uN9noE@3p_$z?aQvb3#9%_xj`d0;I9AHrko>WslkPYp#3^j*%^Id0LdhbGOy%
zsxak|_l~^kAFI;?J2>dG48$})dS*E@ds9^xrjR=-3c7FXT>F08L-U8Tt&6eW!I>^N
zo9O891GlP}+a4Ts!8c-=L+XOVBni3W1SA3SdMao@B8PLr1CKJ#5uq2vpZ0!2l&}%8
zD4cYz?udsE|1>|BI7nXi03w)*iGlmQS2(Y&6S(kI09yu(ZzspA?0A(Oud>5mWuqJ6
z;$m=lNL8p5B&61IL%H4!jrg=*lc`RY6?Il=QwsPu^ZMS<j;>=%GaXoHb=YPreJrt|
znc={07D_<Es+E3ocH0XceoVWO?j<<;DnW$y=2d;Z7<OPMu+dg}1RdK2+e0Fbh-FR^
zXEuprKP5EvBNE4fO(GG*X%Gi?9EJPl%yDe%l`Gu}6g@3?pGihJp!wcGb+V1o?Uk$C
z@CH29W!5r%E9$OM=<O8k*F;_&gLtjaATHaz0u8PV$w=8Eg@`NVptTZJDvAbN^rk{_
zRt6<|iPYn$<-vcEDzD#L%9&v=8aD0dS+2;+-NqyyMw}&}sI_B}5*i4XFd-<(Tt5(A
z5T%^^_v>je$uB;hx0`6%hGEnuXK->Ymz?sz+MPoBMh0o)$l5@<d}sf-uY%WYcC#15
z@5iC*7EI**Y40(kZ{pa-u1>9TRJv>@<{mWn?p1e2U3C20lBs*}Zl9nVoWsr}cQ=r5
zPq1(gi|<ClJ?uYNV22liGWHHguW>{yH6$$$)<k(^!`?g)N7L>W)9!F8?w9bF-m7W1
zw_rY<iFdRbcV!vAfgBmCpY6&;{CP=+r$NfdsvL-b`7x&?w1q<`k9?AdBq2ePxE^<X
z?(+C{aP(Qh^Q)Y%*<yf94}(bauKFH0Wt>+6f_=Xdc&fU6Z}3#sKM7A+Afk*jpKxyb
zgvNrCC=@Pn0!lp^`(7M~PY6%tU~ZeguL!0-mY?za!l?(Kpgls}`-i$}ZSIM62c^Dn
zu&a98L%Zs?Bi#L>lE56{?h)=D8t!V)GlIKO7-ih?F^n{XjOCmpu@e(Jp^0Dtb0Y9_
z+8gdZE1HUtvYH<r>YCtIVItku;Zbd`<}Vc2VlT^Tz75$%A@iNcp(KRpF6s)8Fu`0x
z9WO|uAm(1oKNqr{oWswEY*kN=*!GBRzW_Dv*421KxA%c=)sP?6xkr4vt2$Tj(l1P*
zdq-{Sy(XSR-SGhs?g;*jFs>H~o-&#cMs1H!M?@q_-Gqdx?Z>`|y(DCZz_@EX*bf47
z2Q?lR<+eQRQ$Tcxc@F|i^><7lQ{PSOB=r*#3ZD|ne3+&vBoPa}fJLe6#o;GGrrXAP
zA2fQTs5w&994Tr(ITSV(yK*b<nQu##0thMpwE;LDQ(fJt!PFCQh)lzw47J_`1brRJ
zwGN@x8{e$sJh{S69qtO^aViM4T}mRzs1-+k;<{-P($K#J=;^o?bapwgJ7k)i4?T7d
zf`A~Mj~P)cAx?J@tDAWW^C0C{SxLw1Gb5V%c1(#|Gv*Tg@jGSCeOb+)iz~5^7S37w
zx6Ick^B5UyS@)GTSG)7#2efrffHRx(IPp?J;?RL;)g&RY$00b{&uo^t+#W8X&yzJ*
zE{@wL&DELda5DMCY#yQAk$v#UK6rO6r+K)^bgb}yaP0Mu#_rixq<6!4x+72FjsUSu
zwklgYd3!Nz-grm$z<5U=@xPwPUg^}TW*;YWuTC;19+BzoZ0m#hIS4|f(Gj8Ege^w!
z)Uj<Yf|P-CrA;X1Az`886G~&|MX`uQ#10QnVK4nI&?$DP#irXqDSUYE7;As{Jg^kI
zz73TIq3wrh$VqCmj8HH1NaA{oP}_F0Bo#c0qHhD09%1N_1p7#W{V8GS;4s_~hu(OE
z-Zv5*bzlmLj?VQX7X6%lo<}VDiL|ACKrx1*NgQS&cZuV>oKV1{NybtloWRMFj8U5g
zw}7JZ_E%(TI&sLdteaiH=Op$tDuz&e$pnb_v7>B*_rRDd>c*0K>Ycd)H=Byvw0~WU
zQ7u13XJ|)G9nH5>uj`fMs+bwH6>Y*5IA&KR3|`I_)(ZEC)EV!XRqzIPS2^%g(dS_t
zGn?6jMV?Qn9oZ!DV@5(RNbHF5$d2zhyr(BX^jF8`94hw|F{3lzZR2^D@1V+|t4yW~
z-HE;pUp0z8;}<)z#m#QZ759Z_3p8Rx_M_PEP=~1^YR!=ng|w{HTN$qrUJPoHIO7{<
zJ-O3m{mH_QgD=O**d3;t??oM?ltx|@dX!L)*@OZIbIf@{SU_nSiqyAbcF-GhDhb;-
z;k3SCZcy9|FVEJI3R&Xt0_*Bja=S`}n_k0(T8ngD<;}IlAj@t6F6=2=u2?=V>T~Oj
zq%W>5am5yESxcF1F1o79dBv7XVTmk*>+eebZsgkqa#Hlwx^6FA>2Y)$qaO}ioi8`v
zlM#yp5!)FF13x3wPHhs=Fd&|t#v!L(>bdu;U(xd=d)NUBjI`J|N!yKdy<2a`OK)?K
zslEeux=-ZGcfJG0SI|u$KyHyY`Em;yINmJBo8^<=EW<-+aKEr5pixR0p(zarO+$~w
zL1vRMqG_C@B8vlHVt<RRmIcoxaQJ&(=SjZEn`?amD`*0I%MzZjL|(y?lU(0HdHtt<
ztl8q{5+A~`Enmk|&iDY#yKWK7aV%mz{j0o|Or(A%PBaC%{#aJL8(71OnMSE_DI;N;
zq=Y6xKo|`j!ZYDTZkPz}?w;$^nn*Km-me;i$x}l9FCoPI6OZnOC2)aVp`k?=lE#33
zqS6Nswzv4;fg!}Uy7Lm~E0%eY*G<KmQrd2AwuyAvQq4T6*@DgC>IBugrhMJm!~zvS
zxS!^gmG%6!RI0=_KSS5kveItB-`)2*budKJ+-a~%VQv7|S2^zJJ`bC4dFH!>+1w>G
zjv0ylOpwryvLNJ%&-hT~;cmO)|5`R8Da-eNh7HnQ^tfGGtS@+Os9qYe)KL4z)%pXL
zvv6afKK28gF^?SE{=@fHg4>0p<zm5BwRoiep`Sb|%0hgfu=G82r{M5rSv~qE+xEO5
z_#UeJQ7-5onyUR5H(CQphp<IHFCGE$c)wyRD~pDJ)bz-;S0B~i9|UZKM@hNh-^=zs
zT;`4VUUmEr*y_ZFkU0=WdY~U3He7e@Vb{xtI4<fh`M;0NHP{P5t;DJlHSp7mI%Tkw
z`7r6YPS4TVwUX-&u{MG&t)&2=q_!%CIU$-$R#<>$<VuIsBeej=W|dDQFRseP6@d6k
zayT!<M`bsy#6Q+Kf@<**$nq5@Go=4WFJW(0&@jG`*Yz6oMiL$ub8ER?H2G?w%&s#l
zfn*V)u1Q+un99V+E+SK?3n-Q>%JjY9n4<!8RMPgQY;2IULS;Rch0fJ%n1h(Is=Ai?
zwaQvmc`30x#sh-}49WN*kAhU7;Zd_#lpn|<uYr47o&b0@%ok+>>Mz+kW*5d_1Z!0Z
zfPmHqI8#?(D3rHmzFe`iIsYN4euV#f@BonDa*25fRD+KmJWyPw#^~WBlP<G-pZZXy
zVo^Dcv9FdWnhGS2veLb4)&;`v(y9bsr=lHji|2K<#^dFDd<03KIs!`wVLFH!aI+cy
zg)aB0h*KisC?+)Jf-uL8ND#5WiyXmYz8ClBaQ|3;?;^Gl82=G6Q9~YTbJIL{AlEG>
z<uvm~oAKVDcYq<3(p>MXCwY-K`P7awGe2Wqo~DA`f(==4*{jVaJKL&4Pr<VOzyG;n
z#d^VDiT%f!#ZdhrEnhS1m)FmwSso$&CFY%g5vpg_hs%5+FTYi;z6ti00G%!7u7+;s
z$y(<0S(Z|+LVpI#RF?}7VpsWlywTMp_LFBfqOj_G4%xcv>$(xkJk^`D+t&GVDL9OZ
zUPXF?!={jK!reik&m^lX7T2BJFV}pwUch4Pmh`GBlZ9ALWz+6fot(UfNFP5T<T|#O
zL|)($=GYmb2@MDf{g6a%Y^T%>V&>m}(o@dz#kHAETXufqD#8P~pFqcmfuC0lG8^_5
z&iCEpWnO@KPI4o`a95|J<Sd;uxXg=Fc)f1ea&>lQ*26yTQxE&Np&mA$TNf5&nyPZp
z)QLeg8>L&A1U$U@X=A>YB&=h}8;`AbxV7IseI-@8lL<xO6TOygbVA^ViVVerzR35<
znti4c%)I;M_4Ciyn_pf(?{!9=bDyt2-8tLlm26kFbzvpuZkgduY}a}PSG)0cR+URE
zpf;p>9j;gWRc<f+Yu$(y{&QOzoKrTRpMfVt+se>s!06nsC%DqkcEA>*PQ__|0nY3*
z^e}z>eEg1F6zYv`P{uE|6E?HY;6NxV6q34OV10{&{S8_i7I~pFeM4>VufAfS7I57@
zXNg!C4}NW*bOIs7nGe>l>LZ93eH#N_T7wGYq@d5?yQhC0m;7S|Be1P3_$`i$mbkjN
zm3zS!pzEG&b+`WFnj4m0t*g~yr-t=P9M*6x0PgPAg-vzHUffiN?#bkb$Zl*auJ`5s
z<0p6P<dof1wB5g(y8Cug=@$e8ou45Fm`QyA2lrz1-5?Cylo2O$6G9^qli20~$ugI*
zfQ7z@{ZC+X05*q1z_DGe_1_4TQGHYgMXyms!jxy93(ue#9=DMC>+^I+0h(F=-=C*1
zeK0ed{7H((zkT--6g`79KWZ6I%(nEGY|CtQnw%>Ct@|LX^6h{i1!c0p@k3oIXguu6
zgVysl9<<3dL8*6ORY^qb`YBC`A371CUgVQVL@x2;)DM$5^jW%BMDQ;9%fSf=`H}@_
zulnkjfuSA_VO%Gj>)KweNPDYF|N2T4Ao|ZNn6-syK>zoY<qN?F>5EZgQkAKwG4rfS
z?c81h=Iv#e=C7@!Y?_5AMEV|8W}>RfEtdIF*4W;(;rL8xE8N6oX%d7awL_agdTYYc
z%ptbxr?$_Sh?2ddxmB#TIyvB*`(s_-I8iIh@pb0do=ZiiL7w(U9Neg_Yv5JRWVgD>
zz0F91<BC!-O)}27c92n<WK6__26jf`Fo}qpW^odDo*hTo7Y8+PjbqMTTq0#QNWgm+
z+%XvOqqE?raTYW$`K=dai_ZowC1<~%+w!(Y>EH^C1IP1tEQm|9git3Ggn20^Jc}dF
z8BGJ5eG<<mbvljwe<v*mw{ig9iVyGN6g9hx7u0MIzo%O}0bAC-8*$4%-0E+OgM5?2
zt$%d5Jv!X(i(3W<7iVEY(+HFzloJ{|AxVOi6PqTUD{Plj=G@6p+J}CY(pVYs)C0@u
zg9mTWd<h3yi`Dy9(GCP|@H04Fh<V=RU;)y8wuX<+Qg-3YLN^lWjDR+?wo6OVT$TVa
zA$PMX*j$R`C~W1!Wu9JI(qjz`*&@9x%0)Q`GdCI<rA-rj02ZvSq0ALq<lG2aX*;xs
z(``4isx0X`KNZ&;^MJ;}CQ*=aLQ^{;EaQ}jAa!j!ahx;?4s<&`z6ou9xGZa7l~q2^
z!OW}DY@-{LS{t+5Ow3~x2GojK3I?h`cuSR-oC}yFW2H#y@U|O<{ZnG<jb=&tqGegu
z?QTu8yuLWMTuS5S+FRoF2K+dgQ*g3W?{#nL-Jc{Uz_kvFEwb|bDa_?l+y;M_6KXVx
zqdELeoG5L`+R;3_^HA<Fj60}7N5eDQl(_NciI{Z<-wU}iFZLf>sIV#*ZxHmFRjTK=
zsq<`R^%Dg3D;XpYI#3$R(J~u<$%aMLPTP1m&8*Ucr)O=haSNQZ-~^CarH9o_n9`rV
zGW9|iT8x@mKjn3k7ilAh1|D(wY%peUnhly6e9J4GI_SSTa4sx+X4&WV%#vw+`hCC*
zKIb+j_i5N-W;vZARa-^-C8mSEyQ^6C>g26;G3+TAWuLz46INOm{p#TzJs4Im6Q+E5
zFi`ONAK-G=kl^Vn`Q9r<@c0eeZ|@W_)}M!a4I1+fM@>0Jv$<il9E3c{z2C0G$~{Ow
zcS#F+zrhpRz~nfKr5%dIi4)>*!3m8bPU46sBuZQ_i$!e5L3l`c0j=bpQ(DkrVPB58
zpnG&Hc>xP=mljedbA;n&gxd_bk6e$$PUw=ziQF)B6VLOUFF;zrmGQY{1?<F8QaFgD
zfMa=-6OMAi?d62Q5;{r=-;R_ZfxreC;ajv(9c6^0jPM1@2txol^aTo1JEU1mSe7wD
z9p;h9b{X+KpE_PlnFzf@$_Ge#`WeN8dc~Gsj%WbAxs_M|1-DBDnVq?eCo%CTaHI0f
zCb2C7Vn-o!13wWw`x0yjupU0QPyl^6$^-|I31BFXBEeB4xV=cwUqMHS;M<W1@ajJb
z1V^L6(P;2F1%d%|9LNJA3PT>JG4T@a5$XjIiQ`a^nEII$Wm%f}*)16T`o{$F>PXZ$
z6c4&%X6$tSJg=J`hu?t0qRd7qQCmKKjZ5nZf*w<1Xwi9Iq-6z}2N%~v`2h(rw3%Tf
z8R*_*z<?kMC~qQAep^3w`LRS-KLPo@Fo<l&c1S2_LTHkvBo?6{cA9dR#}196Tlj`;
zo*|idM}c}pf23~nEfE83vDj6lQ?n_hg1qV^2)P4VK|)1%z}(CX1CZnw?&a^&=`J?N
zbBYYABfzl0(7i#HxYbN1*F^Vvif}QEMdUC}Y?}pyGRG!KngqlTqA+$mFG=E05s|Qc
zbIGBCftkpA(axRTX7#;0Eq{>#k+Z%x$xb!hm($K}!3F)+_syAVp6@4bFZz|WR0GGf
zsXKX$$g%n=l9<Xw@A-1Qd|FBFsh{$B-ar9oXSlN8%{TIKpl(DdPh&zU#4|==LYU7u
z@f_h~K|&K6-EZb_xY9PK0vaEQ?FK|LGO6?0bhoK12|NC~JW0QX&~j@sw!9xTt$w`w
zy)YYQx!IwTbDjR?>})pFyzJD6UA<CeMj4&a<knU9tI^f=f8BXqZEirh<lcjO?Dng+
z_Z_1NnN0@7?{^`~Cfek8a3%K}?J0y*!zXVqMtzw~MLE^M<0ZeJTj=qUpAw2jm%AsD
zgj3rkb|5lBeHN003PDmo_M#+?5}(?if&zMqT37cU%~zW^pSMvtCxPquiSLori5x<M
z*dxrL83GwQ&H_L41_b*@`rUh`-?flgVmb}e?)1Be6E)rGPQ2J{FD7ZYdz9EM&+eB@
zf~|;vhs@}xH)z>;Ga)!IGFwZC?=JFssjRq{VzKHo4jZ}}Q04$z=6qfON5_?EFs{}M
z;6AM|;b~U`s)2HN0{6BeuSGW9tje+Ex%C&YCl8$pSR;V#x3EN2a#f_M)<EK0aBBgi
zyiM7)ld&eBuf@!&OKVvcc~eU70OVC&il)j_P~Cy*DPap%q)0WQJO3eXF5z#!hU_1C
zbA2PpFZNk}N1xqSG1k`W`CNe36vm7gBi4B?5XHxeD@0N&3$C<3lHr8$e}fN}s<a7u
zU&ZCWh259O9uI{eEN}#&UJ{aor<^#UoA5AZ+y)77cg5sjcUnIqiP&a>5;Yi8Y`S9(
z5_7R4L!&`!{n)D4oCE1C(BfK4CNrUdzR+S;AwCRNqLnfrNS>P<&V~w6vQlfNUS@HT
zE^^7RjP$_m?Bz>5LyEakKTFef#nS6@>xH?{fQugs%T+emLzSpkWx=g~tn>6e5bTyl
zjf%N95gD*_H<#jC@$SkQ?k&tI!d;y$NHsrpRQIxo3F;G@#u1?zi%1f4hj_k--5~bd
zz>7aU({8tWjzqgVvBZpX$b3y|grSVLtD0aUbIy*+fw3s~1lL|0llXOW$l_r<;WN<E
zz~a}=EPLd%@VlabWtCuup@5wj@BuYvvRG?c&$m0<hxIMKjhr*0q3yYuPyB#Iga(mA
z;vn!zEMg~2!!-8%z1YX(r))JazS)^6u45I$Jg+S>oiZx+KC|zAm{&vgx0XU~r77fO
z28(7y9cOUQ!Scx<i-H84b-9p4`<UfT)O!)bsj1n<3l}Eb_S`TcA*SQYl8i9lc1i3f
z)D^Mq1h&}MZV$6lTdz85qB|JteI>DcxP;shYG#zqe8Nb-k4at%FB3^>wFO=`SPfIo
zHWia_tIKd9u`Z@jD1_j*nWpWjXN8-@V4?6_pA(t|F^PDPkc?$K2*QBb9{cp1b9-SR
zT!VL^nLDPW{TwN2k1TTsXPFzG%R{cFER4AwCBzdfB@{e!n3uW4W0ZMGMtwW|G-;+c
z<d{Aj$J}v8e<?fqOGqqz<heWY-0g{!hF+*?=-WPzh{u5CIDvFvapaSPWj?c0DpHT$
zMPYalk~@?#?w#8X1IzM%ti@Cil<xRH)~sSh11j%aCDkIBKr6YnxX9Rg(V$9Nss}NN
zB0gS~D@dIz0GErxVwSx0%=#2AUWlev_XsMBrBnl-sC_d(6#8qr-q#kf@&@{}hD!<Z
zdjZeWULkL4t!S>3E#8ws>?MvJy2R%kxDmNcn4S5=O%g^^Hwpzml=mbqs2d~Rq^JqT
z67Aj7mt0x`y<KNLZ#D<MbwzGZp0^*d+l`9AFObe{=sVLd)q2Uy;PTB^xhNX_n{{D5
zmfYt0mwR*@LA@M$2q*+r7Nf3D^s(O~EdNtpsWqkAc~&GqPBsq2k`X|)b;;^YByP(q
zB0jD#iDJ9jdQ&{C?Ce}0QB8?HY-M&TM|*&E^13J+NdnhaeGpbR={g0vLW9?>ZQ^cm
zRBbh=@NECOhajqNT|0UtPq=^b1ovPBYqt+V+HjeVynY;8FyBu&iM>z|>QfFh$0=bk
zPt%NN9(BS40>Im_mK_5A?Lbzx75{xXd}V54CELU{jK;Y`S&|T-CL`1h9TLSnB2jAd
zlqVUFh5toiG(}tX`4E~(S$4!{M|{@evk`gLEzp@f_>S1@P}uB9Y;`2R{mQXf{|X-{
z=KRp6F=L#F#0d!%flpY(C`o*7`-$z_PRb96%WlCIbqH8?14-1Uhh%&6L}_OZi1pus
z#(Wyai7NnHyD_1T2uU3IAxUG$iJiob(}QI|I}93=bWxuVj2To>M=W;4Vl5UMvKHL}
zis4yzL}EuIcGQx6&NKvH5EAR%-UA>;edao@D~Ro4<QTa6*#Rfargk8>Yjd9-hNtHS
zAI*ED>5=BfgSZ0Tnv`eD^z25;<A%PIrHm4fr9Pp42Bz%5Cs7(Xj_pLT8yw8xZ*sVI
z8RVG^JpvD9Rqmu#UV^za7wH%pq=$rrvzK7hDKjwdnk_tiWt}n!xgd55CkG<TWUUJ2
z4S`j@0Sf2fU^__b^~dWr-;rq_+ui16nv;Hp8r8$TKmO2c^!@L}K>B&JO6_d%+ss%q
z8Pd>OIvCvW&+v5cMbMRhuE4-`KAiu-Y&?C{C4b86V!c?LnrrC{Jc|2^YuDURW~rIw
zc2tjD;Qua0$^jt{P_U0Ed3Lc;Vs|XnpMG3Nzo+)us7mV(s?KAEsNYM5sNQlpOunV)
zlMoe6eav7nk3NU)G%vF0yini2WFLR~?vV@s-2UCc=jV{$40J{Y+cbz1#|=1%GuJ1S
zGMglEz)4^`Jc^kgc$sr+Jc@ztd*jeSh!EDNf`3%45{<N=@&jCBdt*|CW%os-x)1k*
zNGG9a;>B?gFizZr+Jrik5+=Niq#;X#B+imJOb-i1`@_925|!n4L!x~QItGpEKKvA*
z5wH#bhsT^lpx5sPIUZf>j1{vNkeysNyWm+_5b^BRI=(X0s(O#;aq_#4==JD+cSNs8
z^tvx78o^dO3|SI5Ht{1!kIG$-L{X3uo@BA(rXq8BcpKQdM&sDQajUNO(<x4YbO@r>
zQRXS|gL*Jk!QWe>RsBU1aFzK<?8U+%Hbk>iAsoU2<`LV;SQvOQ%MKSRed|$Hc=fXU
zU@cj3ZE<azsI+gsQ4gZpQ>I(!9wgVYv|{xFg=tciQ)EGUCbVAk2rGYAR_I$qM6^vB
zK@p>FNEj-Y<t?F`EG#jb{P*5*5M5V$es<l@$1sR3T0}j4htRr(QcZZXTI{RVR!%Iu
zuSsWl7{#8x?MB!rbhw|ou}w0c+l0nmN|MNRNaB0c=ZOeC$GrtMdR8<QBQLA@!IgV?
z0XHKX>i2Zoid$*-a_ntc&2JB(+HL`sS{H+hyly!HM|b^gKo$14tmfPFfDZSfjQSDb
z85iI?5D~^hPK1a8HxiLA#KHLT4>~gnY-x3%o|#Xl5L7L0QVBK{gLQq>2_AKV(~IUS
z(+bM<Y^nwI3g1&ND2si8ia|9ulZI{G>7!*^;evUU^F2xKza6YNSTSD{PCVMS_rOad
z7@Pz_9J4SZQ5-TtZ6_d1xGCY06J#EXY3wGSD*=J}h+F3$a2fYJ#}P!tZbB%dF-bVL
zNf`Q>9r-EshnbVMKz!>duvm|{bZYDL4Ir{tWezm3KO+w{V6~Tp_^HaTG|hwjUqZ-;
zN55goCJy~2177!XT|<aXk9dY5C4s?bpO%XSOG?RPV67Icf$a*pm>`>7ZJC|aU6XY2
z*ky$v<^TTr!|KN$k{{o&OjwVbhNYLl7%BZ_H`mkk1#A4_Ve;b-4_80FJ-uw2RsHDU
z!-Zf~ao!Oxq~-FVD9E~g$Q2nsDUpbuc!B@0X5dTOwN5g~rMN0d$+LtY-#1}Nxo*yS
zo&MuGUo<2ytgF0Q*CzdZUi3QO{oDG}G7+2$e$QV7ltV;w19TnR{9%@okM42X#lu~f
zFT|29Kze2gqLnJg<9XBmTe517-aoK~S0C}U72{GUYkxF0Wh%0irBOsOFZ2ivX+#oR
zFe1XhwzI$!oF7U&yE)qf4g~%PAC9uRu`V9A>jAJHOw1!CoyoTqkuEHpRzrTtxW&d)
zQF1}GZ=p<Br>rOhmr`G0P}M_N*Gg1mC91sSlK<b5G|8A#La7DdNT^q=dcVjEVTgdh
zfNfp$QvrP6Jx*8+E)Q^=z0l{2(hx)LDC12;>j2x=1-fa#@26ON8{Kz{yq_@m83Y4~
zE}+HQdZh==I(_r%<-?ah{qZ3V?HQ&Pvt9xvpylX%V!F98jSlJ~Kwn*-?b{vM5ghjZ
zc`nnU=}x$tI&r8Tyip5)KyH!tMlrkKX<~E~?WHniayo85<ok~FzN5L<AnrX-z43v4
z0?Snm)c>%S?7bjr<H%jq&59z9vo0*V#|GcA$b<Cugf*%Kxf!+#sMrCNOrNl3NWKI!
z%Er>4;*bAHX705vpy*8H{1}AZf4%%iFpF3d{HuR~G<ma-U!{-tksezP%}6G3;8ua*
z-&z{ScU;z;7HB$8R#Qp?#`#Yn$p9HX-1e-x-ug}5>M*~_b#C!Z*ys>Lcgya#@7TI2
z)q6K9YFqU1;-{DDa_#26W!d+HAF-GOo=XX3u}xUuyClgH+o!PzV=mJr+&AtyCLY5?
z9&nrxb`OciCgr8RxHKV&oZTrInaWDlQjeN4Q(h?CRySpZd8P(36d=M4a@6?_sl(tC
z5-olhF!E&q0L=pUFNG2~U9F~^3&@^|3AP{wm+aemwI~^6!D`AIWj5;<6zUs>c^j|-
z0=F!0zrMA?$aG0c=rBL>N?6@tk9D_}oi39=n`WuX>-RX2XocWNd@qXT#zbCEOU$JP
z$<t7hEk6{XjVLRt&Kt;EmKRr|Zt^+ujF)wt1Bol_<*HofwX}YuWs&98(%M-r?S=}R
zPDBAqhmSIRwP)7m3}0U8Wr7NyWN8ex!ZahXmoSn>iDTO$ONGCeAJvAffyesT7>Em8
zUaB$?$1Z8Vwyl4)@FA~rfAPagfaO=8TW=r*7?v?}a>?{q{mftutLBg_#6n^HJ<h6F
z3J?qDZ8uW3T(Nu(nhVUq2G9Dd(Aa9P#T>rHOfe_dZ@V<t1v2h->l;ZgAl4uUaM>;<
z)66&}<8I33<=GDP{m3U#47t3h$4C;0l-PmG9WO`&*U9de+ujf}7bT1{M}x=qRo(;P
z#>_){JPXicFEzK!7uGPDG;DVPlFh*g2=?PD2b?EPH_4LspBt(v>y#~61zDYXLfF!*
z=?pVQZGM-1?7e#*d8AN~LAv>4-l&avqsG!f51OLk9JcbjVynx67@=gH|F~oNDV(P*
z38xfXhDa3Lhnk*tUw~||`*fn-0n}^Ui&MekgoHliuu9#SBpFYLD{P)bzAxg4?Q>P>
z)8r{zLS{i^<*jpIKHmU?^sV(utF*z{QxRL;bTMg-*iM;RPe(X_i>54aZJp^m?nVgp
zGicI~GJb)?4(P<H`<Tg(Hrz70Ue7vbSnT|)%Pxuswp7y>TyoFnI;(8mShWzv3~w|z
zg-sHNykJG6U2U|-M_ySfx2F20O%Qc=f0}j`st*KdZQ>TB!t?AX^hg$ZE}`5D2@4aO
z@KiwJ7u$&w`|!75doI@!CrvDv1FR3UuP{`zszJb2@aT5)eA=N}4QkK2$%l(pFC}vk
zs4MrT+f!vY)*)&mZl!+usqP~u;_6;v4==1dLuUxB;)5RGqhD6V*~~KkoLO~KrK~wc
z9;mz#kFb?l*PnW|$eYur<${aq6>BbM_`*Zf&izW?o^?(UW)ha}K2#39hNG;0ra8|4
z^4RqQeC4qo`saG+yVtPC_||h6;5R}PCvPwMcRS(@++J|t*FzOu+pP_L8Y=%Yls$QS
zVN_(?@Kay1sq2Hz{(k&_ce&_iyXXdAvk!TZm464h8u!fYl!Ul~-tDX<H1%joKenH4
zP-y|*<nsdkA&aI}1bSPPgzkSxE#VgY1EW^14lrh^0I$YdjoK$2iwUsz@$tvJ-u$U4
zY+LaXlrMjlt_6=A|37Z&0o209`*QqoycXhpHqNdoyfEfS@UkRv(wHP72q6u6Ok(D_
zB+L>w@L5E&EIkbJG<0i^|9%&|xf@6X7v}jTUJ!7TPpSAi-QMZr0(`4wo1&QKg*f|?
zQ0A%<S8O5nhMA(c%B!+KAaw_%`R3J2^7!wQDi_aTkry~55J>sv_$2W>M&eK;i6=bA
zcjM0mHg7lW-!8@+f9w%!9<k;ZiZu@d5Kysn1PJ>b^J8z*B;{$!V<H4k2n_>9m@PsQ
z`8Lg>Ftpv_A-@|&Fx)Yd>sG?LA+D;+s6KJ(8}#V)N~C~H&66L^R&WfrTKM*$-awKr
zOI)%mVDT2nAt~xcTXD)vHI7W{@?r*kMr&ND#8U8F-o<d}w<ftuR&fDozIV^%-Og5W
zO?0<=SMovp{QMw@cpyla+JewjcqI1in4~QBIA@;77{B{eKVGdC`KH-^(_QWpGkk*!
zEnBV7E}1UYXkEQglQ=o+tm|KGiI3pXCyMlTOQ4<drC{~C67}t7-00H5C*2N3KvNbI
zn=+SBnz%sOOThs<Ow!O3nUfqI#7RsoLDiJ?D^qa)W&@hSdhMn-g<T8Vd?l(Ht}C!O
zUY=>V1egmzStV)^J$A%eN*DL*38>SohwX8NVLDsXY9|j*P@y)ZPV07s3idIQ8jqS8
ztG#-~QTO$`QAOS2PVYwR8<YHZyD7S{JH(OUrNR>oGObXa5$f9+i9#nOQS1lYk0U2y
z@h32~Z#y@3H^5Jt*VUo2<)UfN<5TT{p$SlSx2zjm{=chAhWlLV>qh(gTg>XT%7rp3
z-|2qTwDbqL8*PteX(WhEZI4jKViMaCCCp1*K|SAfhE(Y{6Aqxx0u3Lv^_OyiK&4G=
zJLIcZ;r{?BE`_m@r877J)S1qdjn^8a|0qiI^tsA8_}ifN;Y`K1PlQYun*yS0rBe!A
zmE)w~I@;aLZq$!=+NKt1J(VOFX3NzA?qf91z_hk_Y?T))MC{NIlYBX{P=6P8dKTnr
zZyQ4HBHb%B85@!LZ4_g`QlZ@8CbVLyn?>A9d}1>y2u;G2#7N^Mg3M-4;*L_q--*n?
zbk5s<p<ujTZ;2RX^}<k<$i=gLZ477s=1JcRfPFc}(6+PMU}!KM{q|d78UKxqi<XfM
zT3Jd*W%P}Juj7B<!1Z3dt3`9FAI>aqqUakr%+lDYn$tz!<=JV^3OWiK!QanjmOoLm
zVfi#VWtwY^A_!A)9!}m~;Qw#q>|KnrpBTj<h(&Xv3U}Uqc7FHGVp|gf&UV1MgF(Fw
z;FXaEpA7BZB3!(`rM~`ee2eIQ`(-oI&3OTjSrB<7&SFj|3vCinP}QZL@A%ZsA~*aL
zk>Hy{Qg0my?%P0n$zu|Qz_rLC0C7N$ze*Aw*@TA~rIb2}m+cV<{;I4S@{?HPS0G9J
zSGHVzZ~bk}DzF9>!g{8*^<><48}XfjPcAS8vBtV&tCavJ=CW1%Jb1t|@G|A9nFkLZ
zS^p}kl3bSS%6hzRO6%3SnhWdnUmw3Z>uCpjII2stxB%N8xNT!nnxy=Qc&gymKf10j
zS;6K4Y<w1xUCS|afX}Q-EChrW$TA7&x60+Y^>Z7=a4D`Wm;(%Q71GK3N-Q9Zpl*o%
z4p5b>%AyvXK}mnIa^Ys_rOY;ojOZVgyZ*gW4>*Gr2R&{(e1DP9vFC+O;M#=8K}2XA
zg+NchNsz`#EPQ5rbeQDI-3IRdS~emn%lBxrXdxbMn)V_RJU2FeBbNHyzj59FAnn&(
z+>i?PvF$(TkRgJQdR2=@`XBvZqJ*XIp*sbKH_PhLKiRhD1;O_iFQg)Tx>%ove}X6_
z*vwYDnO}8u0cDm62yscSt$%&|>P|sP8`vFgbYVQH2b;%WGf3Hr;VyvK*5<M**Yitx
zLi}awggA$fkkqSbl{a~6M)hQZHEYyoGEh#yS+FkGHRNp2;Z&*%Eh8?T0^s_zWLVh(
zcJ{IaI<xl3!RkP#vVc$ltr^c-q%V&sbdIQn(#Xh2B^l;|U2ad30{M^H;{(u{I>5}s
zPX~nD7?JcB$l=u=U1(0};&mof<spHDYb?D)PYO7dfVE9zWhJacU?_|95Fu72u5$4K
zyeztUyY#rw+s^SDhNVca&$pjGo1>Bv*A>Fg9Ku|lg61qHvCBN-@FZp2W5I~%Zo5JO
zzQ2FB$;=J)RE*JtwPld4ctc>4T0gir6g8flKEVg`0XuKYf|l~VTq$tp$n<LFoVDf@
zwMxn>_&46G?R28d+TMseTT}*<^zUp%<l5>>@rSr3SmrPmdKuxd?-ClhAxTnjvx-CJ
z#I_Se``Jukn)Spc*Jk(`kpJ#9)qhtqhuC4hhu6Ph##EhHi3-rQI%_x1_zXy+-;2UR
z&#vU!457fDV~W{-ef(->y@Dj)@}F9-J6<!=K&R9Ppx~XCNE85XqYlW(U1O}#J}$fM
zf=RAP+kJxFKlHMRMB+th;t(oaPN?TI5;=(=A_$x`PNF!==>6)|QU49z0BpI`8a{LP
zOR5wYn07eTnvk(w|K8$VxM-{uEQPy7sUhtp9B}%4Q?!^Hv(@PI$9Vrw(Hs75quKry
zBo;1-M76r=7}vHjuI(-XX}zJ|5}5WMcf7U^9EQdNJL4goJ`N=`@qmQab%_^ej_`z+
z`9AylPM=xNz?WQGE4XN8kjWVA9U~_bRpHKO)-o?(n@KkSxx4%Py&F#ivl8}k=SuoV
z#cfW{+aI34>df*|zWVJu6%3STr-N!v^jjwo-UF|;7yR~e?Q3m80}gC2YP@)I_k$e@
zsL55Y!x4_Z%GuJt-os%%HO%U)9zUDe8;95|(|_0%niyWQ*zobpJ{#JoyMbfhz84Dc
zg6v_Yz7azn_6+wOC!>slLf8)ojTk2^pp+z`8@evbqCK+*f#C7l!2c+GfZ~0F`<}^r
z0W)8#Lk8+ms)kn2sZMsjMmgIw$x4xSaKuAQM}c(h?VV6sJV%vJ(R9Y(N2X%;G_OmL
z**U6d7+>avlJ_AWiCCaD7_O<>Iz_b($KTFo*1xQa_woj}GBgd&;JN^H7_<usP(E6x
z$U@kohPM<GKlJ2m$oA5p)?`5N0<j%yAmxBDT9u1D1+R}H%javkmZjoG6zD%VVcE`+
zBxWV5#kJLaE*xR#JuoKIm|BzVoE}`L;c1w}NstmR$bivRfcu1qNR~McXF=qoad_{r
zVsAh(+d{jcy@RqGybD_&D+ZdnO4PtmS7yq2;dhHAdch|f0Y$e}+gn}NuYDio-QK;3
zxZtF>cXdqi#?tcb6Sb{xco|-SS8<Qu@Giddb%TxG6sViO`%U76iQ(25VfY9Os8Lq$
zz+d>Y9#Qo>{&~a`Jv_1FA$?fXkS0m!g(4$P8iL1?CkV^jfH2?pG7&g5Oyf^ND1L)g
z@7Bg-LA^kvLXaqm0z#cICd>~b5(~<xD?&esku36Pw!25OodL^UbVh5yHhuH^T`hJ<
zK_@OnQ3D?9+wTm+c`GaQLPnI$yaj19Lo=|HftAvNHBdrJ3E|v&)+kulTI!G;+*-Fl
zP#Wn0>Y%%_Y5b6esjiRG3Ze{pX5V!$TXwgmoZ<i+W-WpcRNXCwG<&wX8!d3p49Y(U
zg=srdF^H5R(xsrKnVV=I*a&6rBwe=tUR&Ud55(S~W*^N!YEDF@^L7jka7NK>=C_na
zfg6V*34+ijG;{(IId)83-(_Cl@Q{YlKH`zFq+hE}?m!60&4@OLH16R+#c<alRqe(h
zk%IB1$+eVd^17)Qn0(Kz7ajdx11&B^Q|0N9iqFiQI_*jV!``hU(2QzHPOTfp|7~42
zlA{Nx1ruQvLMRf<O7L|mtaVWcAhBlEwb9IkK+>B%^|@pt(O=}d0rQ1T(tuGysqjc*
z+l=_a@q90&nIDPIrl;IAS-(3OpvvcSQMD??$FNZ4qc(@B{Bwx!^$?!izwPF8s`yUE
zXUEYhbFWsJi2>i&HZzI|m^!%*49>m4^|_NdB=aaEG)*$X!YCsmafR>OLBcq_<DK<N
zR6rfX=3;ztJz<M<4LYUvx>B#gp=Uysk&{ThPT};=*3#2Ror_WwkoSbllnJ3+W<}Z=
z3A~JkSC|T;1qKU!RbkkHF%RhFRM(=G9qs{~exF;EvC$)d?l9eCl{N=gnhB4^zU`(Y
zwmqBB0Fs=#G$OvA@+^q6$YJ7+lirf^j2ueFivYNwk^jc<-w^3#Q7+2)^-MwysqXF4
zU6z@ZH}&=<BE8Hu0-RIb*FRVn-CGaMI?o{S$_R>Ld<v-JWPdR#hBX?ffEzEt2o}Ie
zW=?w0_7aOh$ViDUVg=7R)(7##68Qj#T|*Gd8YB3TC+Kyzy5WZEhC=zKCE_v%9WD$Z
z^l#&W3wBv>rV-)bD=!WMV9d@)lF@)r4>)~nUl1yM+ey4IiGq8M?HrvlH{sxN-6~w=
zX=1>#@$%~cPPZxE=?h_mn07-uI<@8)#f%cN4?)9Jve%KWaa279Cru@E-xy?SBD=00
z{tnVrW{dK}W~{hRpKfe^Rpo_Bv$ARUE5R106AyJ(nvK056zrbrlB%Y6-F;_WSS+be
zWy;Xg(=ClZ+*beD1IM<{W{^yDSM#S1YqGxXz@@r@SeRR8i5btwt>_#<F?Caf&W>p|
zHzZamtL90SqagG&7Yn|v_rokKcrLR6XhogpjaA`WkLUABNM3vuG5}wzaqA?b<Zs`B
zR;j)$7hKNrvg9f-r>ul@=f~eK1#6aU^~xB`c_l>gTFB>JHGi(~egIf4SCxXyKlI=G
zd#lU!@j)e4m8jv9+Wun$>IUgm_2b@EwX_UUHEqs*e_Zxj1<(mL|5<!&Hi!+@)HFRU
zi{?#R-BQe%{2W=6Od+qjos>;eE;l6T*%@-SJMR#;en5rehp8ZL7BE6xFC%d(d;%J@
zC<!v^aQ{HJ{ws9F9mB{+2gQ!c>Ga{ln<1nO4TpNCx`lX90?a!C%hQdD*|T$nz#(h{
z<(W);zyK{)KuYR~aX=cskD#>%mLVxhVFv+;!xpJ^j0eO;<i$K&FVvVAw|gJU?03bh
zi0l_Xy?ob=+l94aRW06u@G)j2929+;R{*ZMvNGSdj79F%dnRMDpDYBZV0zKp37fxr
zFRtrBfnV*nXOr!{Stm+of2~>^bmPBV^xKjGWmU23cMDO>o6CMnzxIp2J+pp<Oynx)
zy#G*s#V7!MYkl}3vY?qr&pJ(^gEAdpe;P-h*)zqrR1?2_2cpdOm(gczw^zX>?MARG
zA3|*SR&Wh3><_SIsg{6X8X3!%)Pm4r+tURDRVP$+4GiO5jXPp&0~B_V{lj8svrbOb
zFXh?jwb`Isy?&w2b2t(G={NiG;{_Zauz=f^f3)nuwos2=!|8EhNhsXD{=jl<``or3
zn)S{s_iW6x-d7@=yuBFqv#<5+T+uIjRsVXT8$Wq_q5o<8Z2h789r~<0f|yOR3K(zx
zE|_!f#Ednbk;7z?|BT!Kdez)3)mQx4zt8%^=mY6aA1E7bQ%o+|M<8dn5Anr^q&C}M
z8FonSr<euYb&`;TK6Sxw(I-*nWh8MT8q&mfnQPyM3{(1)8W)*X#7-HF%_v)>NSBdx
zJ$1Pzb(X+T`X(YXxS~KEIWX*!7*Q-&i}Jd*mg_~61DVV?Py#V>{*N^VNo)TJo%CMi
zGnr|!#noEMZ5C5sE4?TfzhXrS7#vr_C_kbM_#1t}WWZk|O^$*qTLG-YCEU(t68FAm
zL2D5oCBJK6E2h#T0yMms4ic?TO1rzkZr{t)Hy*Rrh2+B}j0>tPF-E`jUSS1_5l|eU
zOqC~VO%c&m1NM0Eg4k|J*UeAZ(ET`zs1rDZ*^W&pO<lr7>VTiP;Bl0uJj*_%Q|@39
zw_)hULhn3s1@HUe4u|*Kv9(W2X?>}xHL;t>9v1h0;@t9zh>t5-PN%irCd-}c^9<~G
z*DFzGr&635NFxTll&bh_C&RvadG@(1{0banW_!yNXYv9l$W#btD{bgO>lZ}v0kWD;
zcmU`W*?V~ujEZfpcxH_1O>v&O_pDCM0Y8TGY&ZC~m&HL1{>-N=;w&R}B3wd&ikn3|
zBs9xxVMk${arfTO=8++7-xGT4+5GU~>E9k(uI&cI4v9n0jN=CrpAL_k_Ov-&0t(hK
z8IW@rRc-C<d<M!ew6oR=z%r6P1ym(gofmTeGFT&$4}x=O1L;%B3{%js^gX(=|I3?~
zf0Zhqn^b1_;HO+g{OA)F9NR&~-krn~N45@EJh{_ht;glyhqWp(aabFNbdR@mnzVMC
znxIv(p1i$KRm}#>))z*?s&6=|@N3|<_H1bHb0)Q#K70>KZJqes=C<pSG@}loq3{V4
zc0kh1b;2N_Vd(GWA&eSSIHC?M_N{cq_bm6d?c5;v<x9o4ubuH*o%b)VpZ6rfdR3aj
z%%>Iv+Yh=y5^Uc)h$uKQjGt5%#P+8oL6$P#c5F)01Q_jDl#$34f(RA~AzVKb&i!-F
z7&t?A^e6}3UJmSxHlIKWl&k_r8Sp3rezTMg+hK@2uMW)O5IVl&1vat$FeKDZ1&OjW
zAdbzvFt($>PsOK~0QWnY4=n%5bLJb8{_unDCi}@TIq(6E?{Am-)CF^QnGY*EN_<C&
zZ=a*~kTyP^g;5&NgoHsB0G+c<BAaJ~+njo?2qT;M`$&7p%XDi=PvL$zGg-b6d}Hh~
zw~)R}9mQ=3vOIMs#6IlSgmYWoN^oK%fX%GAC_wh;en{4f_p;HBA9rTh_DF&*BlUGH
z33Z;mnpwPDvRn#*XHwEz<{vSzSw)|;-8z@!gnTRbd1jzapE4)Q3qhK7A>@l4S#K-S
zfs&ss;Dfq|XLPK?$m3O2^0f|~mJ!AnusU$do09n2*xijn9|+X)3hIx#oQ<)x*9D7A
z$$B@4b=by)R3{wIi5)v5w(EI>hLjN&ClQIW&}KAtX^?(W`<}U8Kap_{7USQrTNl>;
zLX>uA+v9@XYR+qWb8ATpH}MxOXnh(g)T3eUXqdYRDd2H)XqhZ<lQa!Ul5j>S^Eio}
zG$UL%QI>G-hN1uIWwO1_)dP!Ucp!a45*d8Y-2^fmk;5M2@cMRXOx{#?7sjBTqbzom
z#ded$@ZdS5DCWkopZR`5oG^<C^`nGDfoBt8d!fx8>boxcEF5IL&+Zt=RJW;TyD?=M
zNrNaOl)52_65l7>2TCCx#hkjkGnVa|&gzYpX<oJ@R@M_ypwG~omru@GMlD5@Kgeih
zuxCM{q|V-CArBKsFs;<o(PW)lPs(Ki3_c(<qQR`o?IKwkRP<8b(nP^2(@L>T*^!-2
zQZpoFbEz}b7=k29jjRCbq#V8x&V7Rf>RwlaH&_jIncic1sf-7{OTCo%4owM-9FN4n
z^^qm99l376Z92>wa!fCEXr8)ub3N0m{Iy=?FXSrUm#6N*gLa>?1uT0|QWWWRyEV=q
zJg|NSxMOTBNgaXdlgfp(`_?Og+1ykPr?QZBvGiK1R?-ElYq0(6WG(5sV(E2n<Gp$L
zL}zaS^~jBsZ`dsiBE<YnP*=KuJh92ORf{WuBgN(r2i92Ez`g(G`D1BPH^|~xVZ4pN
z925DhKCp_PPi`?i4n&_Un_1nm*iAj*QsN0aBQ&EaiG+xWC(^)<JU0syXCEz|RN#%4
z!HxPmr5oCb){Rs`5;eC6t^Q!}jE5|{iv|3Dtg9+lWu-0uQUTY#y@60iy69jaZTn_k
zv~C|`wUQil*|)C9RC;44&4MrvNMJ**2<{4!WNu1QUqswxam<`UxhFzyPq@?ILhAaY
zn42Mqdt*TmNMn_S7|t47h^pCHStLDRu!_e}5VSG6D*Ry_nD|O65#eU(M?xCjG>^4X
zRc6*Ta@Fae%8j*jt~yYWp0{DNqek^_@T$a~KI2;zQTnU&svgT0teU^mT9`kh4!D6+
z=K)F^y4YWFeT_vR)rESaK%-wc!!x2No710xCjx?&tENWyfZ?}K-t|ITmDWd<md^Gv
zdbX=@>`INk+TD1aj;Fb;xi^Al{k;b|rWk4~3+tcZ;yG^%U0DBI!Fhh(E3?N4&*TSc
z4V?-k)opJc|E}uxuzDxo7_;TI4H_ywqZ1p{d|j#CRDJFHJF5H4_xESpYfDeL#Ty^@
z>&d3Gy`K<iIEqs~^ZikoaFzdR{UHuVxwmPw_vPIK)!NOMRj2UNRuI=qvy?O9*bey5
zbDOX<bV$Uaz)7iZXQ6YbtLjN>h3l@WN5f0$s<vK2>fP>ue!SS>!rAYLy77LPnYWJG
z>EG_PaPzIu&cQ(rcYGk<fk|Dm_u^eGnp0!Uw+xy3pueyhmrlEKKmn=y)@wl<toA}3
zH`H|#_Gr8L#9-3MveRL&C2d824@m9{?6KSl#%zwSu?bt1Zc`!gL1_P1d+4t6Z9Zu3
z<N?^qNG&CY*2rmZcE*J3_%?A8n-c0Jl*FOq5gKLOOVhxmVYZKC^cXDE^KN?Z6109U
zttTiFLa5!k5qckOVZCOmBA70qU$<1rStnoKBqmKIF9qlFMUL0AmNsW#fVeK#DtnN?
zyt6}@8f+B><UdAB2XyM(dMz-sP%2QMZCEuIaH3-p;=rC+F9grmOUrTXnf1K<V7b(W
z3>PxmLQ48Hvh{~;61bo((v(Dg^OPmu_0lvAQj*x2O{g6vBoekmc$5TjN^KU>L)o3=
zhqjboJqaJZ8gNG1nE>9Jvu-}RJMGQ$$M62msvPtna0Ei;9O>(D`bO3FNS@Nt;QVt5
z+huVj9_2-I23g7U=>(?(47fZr0(;hfB&R?=gn8&ceO`W$k6>o{k9yN2U!sxXMR}`k
zL~Rzcp6Sql7eBph*JHN~uW}}ZO_};>A-8lp7`+3r1wg&?eERN{7x<<t)RaW0uF(nj
zaPuW8Umu0Kb`Q<o4p7P_(Ks)lf<5l1*$r2a(bt<kZxb%+W24?p4v$c*82xGl`@WJ2
z^GZ)xD{{AM=Fg%*g0i~l6na3*C7EQ=9y+y}x@Gem3%}r{v1E2zF*hQ%Cp|6U%zD$X
zW?j!Ly*Fpp6POmkWqdRq?dso%$)peHXb2`XB!hQwHB9e_vvK(wQQ-HM_3)wfCrN{5
z6=gw&$}v`}v;^k-jK{VQOXYxQqp$q_3GmZ9y4o8Nk2?X!`a4KYcX}c(fRp|}8Y8?3
zpbn1FvS=r01edy@`}O4U)m+}njd?4dp?u4(=BJar)&!|g1wt<Kpi<atX8jT6LR1`R
z@~Y`E__04W#?*qZ5xZ8J2XjCipvM}1U`y!)WiU2fzwu4U+eZAsw7mWC@y8tg`P+9t
zv1@$kTK)3tZ{Ka0aM_r$S3dgfyLN0P?c@N4)C&eoI(-$r2}8Ur1QPm?MBL2?Wllm^
z917xuap*;ko3bGLax7DTRpsjHplbivvrd1m)&deu%CwDFwe=LeKlLwXBU5QFttC3r
z3}W&S!zqTw380{@GpH@H2F;7AUJtuqWD`<^_GXr1W!u3_E!u#qR;ctBzG4d?FK^R@
zwf541Y~gw5-jsAPuqN$GG;WwRX~Yx9hA0*nIK?wxkO-m;v%raXoQ7E#ru&E?{ju9L
z!yP%?coK&xc!q4_Q_}}IIjiNw?BP6>kcd<}H&tz-0$di;RymkCAQoLn>$ny{^1_(r
zfr-48PWGG0W<`)2^bS+#Q5I32WF)X-24YA?SSB)(IezSlgtFL8_L;)&f_dE9`>$$9
z3<lE!dv{%JoV|RpSYys3vC%*_x&Lr`YU`<FM^zh7x)&_2aVp#Gbk({O$Q@NqTXAJN
zFaaUZEJe3G!$OM=5S_P#5<8V28(0*r|NOuHpa1Xw{XeY-|694XKIDsqv~6J;C3MGt
zsxf`o;##H$!z`s3GYx+9*Jf+dWul7#Z&3EFtg@Q3LMJJEu;1!|>d942<QSo(3M=~#
zi-|cIj~y={A#+?pd1RBs6Alq>Xu~?oLhn#9$JQU$`2v!>E^@FFW*dY!@R@^KoK#Bc
zhmoF;bhb)#M>+1Bl;g?*I0Y^h&p;*8PMCw!24p$CkY+MXGx8xcC$+iQhN9iB3+LA2
z+!rmYbvtie=-t?qFkaTFIG>--te@VzdeOsRgJIhwvYklWcVg}G-@}L2sU${Wi!<wa
zzRa6e0m&cA%tZ!l8|b=j2&x#s5lJ@Pja*(A>&4=<|JE63=bI{DqRvDSMGs$5f+;@i
z>$Uz`Hr5-_=<U~vbiE4n?`I=1OMb-ffiZWxwtYuLypQ{<nQb>?eiEiW@$EE)Y`Y1G
zl7tb5#a`-%NtRLXP`BTt?sB-Ft!F<S)tE;$=H6<|NhtMMRhX?!RU29F^XfCMvl2|1
zlL|=VHj}>5Ei^CK5<^yHXzPY6)%>81H|t>1;8<LPi#5ooI+#@^hhR%gYbFIDxNHa0
zc2~{lghmo1Wi2T8F3CI_+<m%Qvjl#iamoD*&W%d5BmZl!+@W^Xs6|oRgF1G)DoEL|
zt;-z?zER33ftjJ;I#<2urGaw3!TZxlK668Aqv1T<F|iTmHc9(QjS`l=-!-Yx!SV!c
zp>20ZIfVKOtNt+b69;|#_#7<Fx62)Llm2I~ltE@T%9OdD&lvF{#t02KC(I9G5>n2i
zEb<aJvkx8n2vPi<s&xTgzHPR1&}d#7ia%6_G-v|FC=>074Vnw7bh+xAZ0lY;iJZPR
zW6)#HA$<!B4PJAoK<RWWwUuY+P*8~lb_G;0@&aJ1)j}O+52YqX*ZCCl`CP7-tdORD
zvpc8Qf7As+C9OV8Yg%CL&NLmvqRX#dTXQrcRdAWUT-An73Vp~8y%1ytGSjhMvVvoz
z=CZ7W1&71=epc_~8tql4nxr=!N8QQM2Ht^3IC$3eNL?a>R`7-$ZHnaD`f#a5aoFz5
zgE%T~0)%$~gPWBQ{pUC8NP3D1)2!WtYSIH65vArk8M@_R>wna4d7G6VHym|30<W)e
zYsy9WK~$$NN{(ugKVF}K=ioay2T^UIk3LjS{PrFDcU0x;zuMZ{pWv(pTVVS`3uUa2
zyqfrxYw}X_aVkyfa&%PmM;|<DElF!}7-&%R^S{6`-H)`GqS3%Xp49uu(ce*r@@*(a
z<V|%;jR>Pj>I8O1oP-60hG9&iAmv14lv3Bt9O1@olE)1$kZqLdC`8w@Bafw&6FcFY
zP@aT@`I${@PMtIfLPkaMNg|8A-2&aZ54d$m=~Nz5W4xUx%c3~6iSU8;D)k)_I}sy{
z1+mAd&z<NCGUorFc#>c+E?`@#XieMxgO2$mX}MUiRV^OrfAph4I|%{aEUQQVWZRw>
z1m9!8r?SO$A)F02S_9#Xu*Jc{OrQ0Fr2lIdWGXY>-6F{JwO9(C_X9&)qAdt9g>!*b
z5a``v%+truUQ3^Qg@_qn=3u0jP}htcZDYMbYE`Vsy>BSjO<FERZ5TJVMV7vnq+5@l
zy|z{|Ae6|5h#J7Knp`UzsAPb?27q0aR}gF2u=m1Rl;A=tI|9dlEzHYHIY%}Kep!Yl
zRbE<kIUR7yfIE9*jHxf|#17JkgkeYt6$vF#5@y5?-NXw$my3w*<w@PnKz|*`TzzVw
z<>aXKFy-%jvyaM_IMhA5pq9hT;QNNkyCBm}xWM9><gaUGveQJQY+a+lY*pnY<ZW%&
z>e&Wwh7kcpJ5Oqz^uts4ymM?nb0`-n5n+%L>Ub%MJZ2NmVYbgx5%?lJJfDv#rNSiP
z>i<*cO7IdqJkXm9nEa#|yK%JDCWOIW!>(@KL*#<kBY!=d($>ZQ(MLy?ah^=LKmIoX
z_)_IL9VW4~X4VNgfmD`hzRE?>$e2scD^VMfn$w_N5spc~{@=v)PS&;oTiGx!Kz`?I
zQLh)xx1LO*?@u_d*y?gpn}$x4<!Wn+c5OZ%CYEq;$0Fs(*77)0<I?*jkx+`ZH~G9k
zZE?}Gx;AgS9!{#sws};xYi5H^ZObWSxB%_PHD*Fz;W8)kZQ>`PAT-WGlCYE#9z~Ju
zdn}>xUVc@39O~_#c-}nDK#?S4we*3p&y_P7-ZL4Z6WPtB_PGNp%+pn5pUtdz^mA-W
zWD>`tC-IqNqma(sGwp82d!a-q2}*+u*I(3>c;qUTA9#D!Kq!Nr;ta_#Bn*camt~Pd
zif;vcv=`oK8v)Y@wzQT4)^Tkhl@3iUG-QFFq1{)C`9j_4XZ_q0U4n3pfB=fMGuo<6
zwD#`YdX_2msCvDYsmil51$9d?fKTw(hYejpL{%fCQnv_d1P~6&dnSc30IB;2W?fby
zyEwUQnpOSi;Y09vEY7<#E-jZ2MM2i}LoKP362m`;7x)kH0tcTm0|WdMdRNZZl_2f+
zn$J&u#1c%xKez*bdHs9_{1ECAlnXZnzd+0$^20->(eb|ELgQS5gK!6k5l3kd@K_L$
z@r+PAOGy$XHc5o%^DyIa$l`;AZnZ1-k@XYur>Z^pa25Kn{Mog2+HH=rn>R;i$W_ll
zBR@f<+8HeMvC&W2t$vl-mWK~@ZEY(1t`?n9zMgNz7SgedNGF$RfYH_2VFr~~U481s
zfRq%oSz*I79hPJ`pvhn0Hm}XBjm83Phh}q5^IJf!hYyYIZ?tBKLCv3F=uGKy^XRG3
z>6Xl<=$78tm4zxkz?eV5x_u#+>?pEE>IC7L{GMSi)h~K72FluA)jwWzS<$=Cmccar
z@ENn%P`4-pa9%~WQKq}LdPU(D+)zB;sd&7xc)U~bc&a#pHJJl^Xjhl9I{>oB!|d=g
zYlx{?&$#P-J9HRhhDaa;0c|g8vp};2>lg|SM@o)SSv4<}TF#M5$2(PU6TY3S!w4U0
z7YsgVSD*YVGXH8fgB&Q3nx2a};@&-SxOMle1}!kYx4K?!+l#!+ApxZxq1?Ag;`p4n
zfuJmPoW%A0dxFmW7o=1PK_M_0J4T#r)XF@2y+N%u>oNVa+Jg9cys0FktKbhFfcxl!
z2Ty=s_rU`reyBkfw@K1P6JHw58tQ~$q)N-ipMxD9d(g4?Ps6Ps+_Vbx*WCqZaVKR-
zmIxBq)Fw0u1c_7OlZ-|pjzf=UX}n)>iaGuoApgwXi{jBf%cKivIYpb&4f?tdmqNM`
z7>K;E7z$>r*r#F0g_i@w(n?*WH-$5t6%y1#@EQa0rmU<Fa3hM3B3(Db2$_CFOfSF;
zB@b~W5RV&*R~1u(-VQy+PFOIjvIb*~`2hwL*cjNfQ4`n;PPxk>a<e${9hwl^2_fw+
z6(nJ<Ph#c^>UdG=hlg@<*|Nz|@5inmDG;i6wsi&ctFWyHZW?cZE6aIg{UrEWI-iKG
zkP+%%N;s%8UnmgRp;}mH#)Z-6D!2jTPNUq5T@;JkTtAgk&s5?e<{abONl<Gxprb{0
zENY}g_<m~WT^RZbyt>p$cqJ;Hrx4fx{N^(J<WI19ic}aeMCzBn>$eTh*oh+M!2YRd
z@&?gS%dPN&<qP#8M&u347f+--JP5aG;kEeKR1D=Dehu!Z>FHyx&7bJOH*j}FZ9`s5
z5_ePJo<Uv}eM<1r*g~4lid}y%-K0L`wXi-^Y&CjMDq$oqJOLmi%T4sWkR_q&p<ibk
zS%F`7KI#jGSYW;H7NVFpmz!U_xaj$XTGooC@84nBk!W=`>v>j4Z-nk^#6m35;{^(<
zwb9jPwy~i%6W$vz=BRDMI$2F%YBI2RiH~`0ZpyQ1N|9pu>?iBO9L#Ye>eZ%1x3jC9
z!!fH*kY_&`jXZp)w}RROQpfO|)s0%_TC~;)k>22DSLC(w(X*lvi$y*ku6;G{eVJv^
zRgJ4y`lYl|yBtZQ{j;IaBlqm%XU`!x@Inp!bRVY*J}VmZKsL+W@BwOQKmyV&s1@8>
zl4i%w&^>wldFDI6+HcRhk8Hz(ri47*g`b~wKW*&6vqCqI(l!HkqjFt$r;PSn0!>A6
zZQ-WPi;2lJycUgWjJ5NERqrL^EfggZQ35K>+VzwhWgph-dL{pfF;nvN73$c8S67v&
z2Z06JH@tVZK3y;%N$rnR%4#tnz8S7KefsuC1s$N;uF2sktI2uaxq^vF1d6)0)}Np0
zJ9b#ru$(k)jef?&SN)&+C;xv(kA~ivk5B?H8PF4a4^CNZy}<Z6M^eb^{2q8#^e$no
zuF|DpBf$pFi$?9*_R-Y6rFtV*t#Kc!K^WY8W+dFye=X~$*`1l?oXz0Nd!LnOU7v9^
z<~4lf_WGUPCm0-e^#J2tz!o|kFHYRhQ!U7Gc(Y!%+qhmYPvx)L$O^wF*ZQb$4-feJ
zY!cCUkF0+IUEKtBM2E!|;GoyCQu9cAwZ6!P2yz>b>j(+8%!?y*&`~f#?+2>FT#cq4
ziH^&4Fw8T#+Q)<1O2%>kjVju4hE*|Ww<n9elqg=sdg?C8lX4)dcSop#^^-h^uPPk+
zyezcI8)kUW)3ZLU&K4{9RA)Dn?M!~!H%h#7OQprF?Y>Ur`)-;hgh!l0ieE~YmuAEc
zUDx(_7JESXcxd+%sb|Qg(NH;C?Wkqgu2SI2Zwzz^M&yCy*uWNc@=5t@t|hmWSvRC)
zQuS2%e6GC6zBM=C9n~?1Ob}#yNg4<*CAQB6p>6;P*my(|8Zj?Os9+)evKXjfos-t$
zsMUzDK47oxq$pNCUlV>5Ez=F^4J$F$>!~aspwN?Ax7N<9y&rU!AZgqnPu%rNnBIO5
z9=rj^`=7)@G~&U7nf2hoUs%O^KfEX*%Bm@?e_0prt*7OJi)!!$60v=R-{8b}@W9BC
z`&vLI2dqh|5s*W})HY6J0MaQ}<>A#gW=}hL_QnAi&*ZUn7cLt+4xE(5gfl-PG)^gr
znUj(z^itms;zaQH-tz*=jHyOmKr<!aB?FoubwI-aSc8SoB?;87hQQd02fMl=pyRuy
z(pcsNIuu=Wr2mG`z_z@gW+m+7&Xx2NhHg!Mv5!lnJiS{^Y}~W*(e(NME2fR@b_x9X
z_Ckj`E1w9NXs~<f<ZLDj8oOz8LF1*iV7s^e4R&3IyKZw0Q*V!}%3+)CPzk=*7B_Zt
zC3o}YD#q`gv<WJ1oqrYzsMV)l$2`#Rt6Wa{*ZmVrNDsk@<PxfLn<ifg5R;E*_Lj*v
z3l1N51-DJUS;NNnCaUU9{$wTH8(s0ulW$hB;jP(pb`3eT69UIK?6AB0opo!`gS&!7
zf~ACcJRvjykF+$Q#A8X4#D2mk<83_DZsz<xyck7bi6mtX<vxjh$_W*oPnhfaBu(rr
zVxC};^Eo51AoAn>gRX35`(8{r$snyCrFKLxDlN)r<S^mU)E;{J9)qq99dz|`xw2kp
z9jS5}eZrP2md_!=MrjR&CYjqO`U>R;LqUzl<QlAO5{n^-O}n;O(|}LL2X+PSn9?Ey
z*h_Uv_QZPj6L7!g^FreCj!sWg>7lB%BUhiHj1P4|PPD500AfJftkmEkmz}cU;N?8)
zDDhf*a6PkX*#Iw>kd<tvb?nRhBjWd(Emshiw@%<Ttk12#NLQ0fnPd<tE9*v+V*-kk
zCg=K+tt2sOSyntRWd0-^jT*QPzy+eYWCbQ8m14lq@PxYaye=i#{`rFkH^rL0%CAab
z@>3b|R^5oS+U%yZE&)Aju7kFzp6_$ADAV`QsrnL=?x``#i>zXGQ?1ixU1@sOVUTP)
z_Y-LzxW{5a(||aMpAniyoWPkt;w)rN;-(%ySegeU7^$00E7j<y8XLLva9yfp`HWkn
zx4?|WY@O<noAp-HFR!0l=^{_xZ(Uil;j%hwc{!khCs+ZfcjZ4YLQuB>^ZU!|=Tc9N
zzDc6}n3KAj(9>V41y-b_2|$0~Vv)0vMOwEG;)HDSkJox@UReElHhH=ZBo`x5c{iFr
zTDD0{Id)FyzmK?d_|jM;(fu>LIma_;2u%N|)UT~K^Dor`a%J=dq+hDVC^P!&C&0#I
z2u5GdDEzHb57C8Kj>Bl4H;&64Q_UN>IZP+=E@q+k_5BuJR`ciJUiAuC9<HtbqV0vR
zF7x^l&!Bv{*7-)XH9=9qfSF36^r6M#FdpK!58g9oL#GxPo44AgjY*sC&P3ric)a{1
zPnWK|{24?8`Dn5zo<740+9Y1XDrS~HRf{pzuh|E)0^`Zd^6f2MQ0HH-b@|(dM$yyv
zjSyq^{E3&rD?-29Q=s%;9qo#(67%4M#Qiy4TrI`^0i`6x_D3`8;$(Z>d3AGBzn=W<
zwFQS1I>v)}u5GY8AfUz0-QjPqtyG<AhO@(<UOAyJ@{eG?MF$EHVc)SjJ*`FaZe8SM
zaf(@~PUV(U{zLsGBI}p`dp7t(`)2+6_DrWA{U3;7TpJ-_&%WMiCv>jM4oRN8z32}S
zB*fIkPu^a1qwwoVxBpJwUUYxJqwXF)d3#|@)~_dWcUWrQoV>m0?IV0cUhd-;$J-8G
zS2oiZ`NxyD7wt&T%*nhk{%y9Pwog~L`T^d-onpcAKY4r6ZX0+4+d@CkTV!nRY!q3W
zWNG_awGN$SV;s|vVdCXZwbBOfY6HkH&bM8K!%$zZ{aX?(s|HpEJ0GO~lwX9}h9_7x
z>Ks(3l<?jvGWG}^-jBJ@fq>zOuj@9zxA}eDmcGsRRf5axtzXI~$|SNI#V^C8r))Sb
z^I}Ih#1?KqsIUcL5%(aH#7jfRbM0{F_<?Vft>y)2_;85`KGvJG`@{NEF=umhb-jfO
z<uxnbPiauPsWauhzC^jMGKN_j(6zzPtw<x7PF*GamXlJdFnA?CSfcH+1-?ubU#Q5K
zihXGHBv-Ja#kuwKrI198bwlKDM(@Cmx`tzRasB_Z_qN+@BT3re|2=2#A&1p765k<2
z0^p~+RHxNeRhM?`veuHjd&ctANdid;uR(wXfRa@u&)I9)OWP~i6B+nsB1tMKDQ!#L
z$0Y%YKtz7w$;ilf$Zxr;+a*&rgEWhogOpQJ^2KTHdjJ((cwf4%1xev7VF8Kf)b}C6
z8W|{=i&h<wBc2)VcNT@bB2pZM+4Sa&f;y$T3KtACp}eeoeSARvnr3UkY6JyQ7x4V}
z?9xj-*i<Xl+NCB71E}$kOgZg_6EQb+;o_bz<wu`DhibSy1k(j!Lg+R1d_I6+1=Im2
zH%&lM&;}e5+(^j1o*k9<Z%c3I8u7}!0hGmClyj(*-AV<KPw^lM-oTOcQ+Bc*b;?^1
zyl~5yyW@O6yfKywvQKYlgvYFC;C9kQ9aITw4n6&rOyS_og69(^3mV5aVFaf#VwT_{
zk^7`T`ifr)JWzZUxVZ}o7%aG{%oTEtPFUZZ_D4pqZ}*M9#RkTh6UUmP9-a1v=5)L(
zzU<eMK_1Zn6l@slkk9u1L%dTP<F)bq>}z`VH9h;9o_$Tvz9ubwO{pt+b3aq=uukDo
z$;bNaQEKui<<)ghmr}EXXnSYVvrFllbt!#iP6?6U<=JcYrFhMRE~WBvYQ?E!&Sq>p
zn~V(VjwVKb<W7vqU@|sbcVsg*=sWJ%eZrupV!8G3p-<EC%%Y~#HwNyI8GSmM8WV_c
z=rMC<QG42V2D~cZiTG6r^;w!HqHuoB<_lQ;LLy4A02a^z^Nl<lCX0soDU2`{#vTsx
zoFp-YOm{frU9>)5L>ED;^MC#y_0x3O+O_q9w9JE^un10wCoYtEf1Q!D@9*XFXf|h_
zxO?pnLJ?^ams=2#8Pckk`&_;7xhCk3dU?Jc2Z?!&9K0!}`;*n_zMCG_kK*o}B@_a_
zSG8@?h4=TOQmme389fvJzd*l=;1TF%ymp*0fDPun|CVcMuie?}7OED+3aOrZo%HEF
z_~yVV4LI=whi}uZv|80ei4)i4V)xqZwy5e`z!J=&#A9*m#cB-_(gNbc$m8<_Sn!uW
zGSUCRZV$KbYJVnvco{;9LKwP-M?iz{>si|32l4eKoSDtvc=$K!1-PjQnI@}eA67Vg
zfm?K4C>X%Df-W4s>}h}xxJ8Pm&l#O_$12Yh&W`|K#8bpQPVhG#|2!ZU0dN#M6oOB|
z`BIpjCgDy~@E4hb@)IO4((HujDO*4ULx;o*I!C|YociD_!zdxRko$W|WY{iCAd;?A
z^4rZIA84UQXT>h=VV{OL63R8Q@68u1io+mHVs;%uwQ<F~EUS3UvB;AxL&nK=rxx*A
z)_{8fixYA2a>`E$^Lr^hGt^H6`E*jJXeHmz^p@laMk@z;;)6f)gBg6!_?SV?bRa5b
z@gef#9=zczw)Y>f*vl{om;=wr%cev5WDaON>#c%v>FjveKj<Cw{!I8T=;8WKcwFrx
z*%1FTNzys}E$?O5?35-~_ZVddu=Da~sAkj%48obM5cc_?JhVlVGNi=^vKP_3o=+|f
z^EtXdSD*bgdpJ#yERg|=TX;O1?bdysL@K5eb>lnmyCk0aN-CVC4CNvjrRiPJ@c%r1
z+wf4+SM%454jsRitIyWIdt4e_CRbt9Xvm6&4NCF3a7812bqi(U<pQYZH`j)|45LLl
zAFb0Y75<k>X5EH|5|2fjnC*MPM<|!&?oHoO&EC7I^=@fqX{-WVck&i%9sP3LpqCSQ
z{G3+n1$i$jAOJn$Ay^976Thm`-H+1=RbX+G)!XW_dfrSAz0%muCs(E#Mf>FHy!6AR
zd$d?+qE6}}&`TR#x=yN&h9eAsRKCZV0RSDUtdd>s$+gM9Rv6rOn&a~gHOoP6lX{}d
z9|T{wbqnzFpQY!^=C>f98@*)zAwg1EnbN9S2#C`AH7u7s4G6vQQMlRg+*$-yekN_F
zGv|uUX-Quj@V}_!eGqW=?0-lAa4XG-kXv1MDZm4!0Z6MsddkHqQLtWcMNd!R*)4#3
z_EgcY3g6(0?Z<54hqqak6^~~R=VMUCJCs_NdEiPj>#BFiHhO)bcc}0R3GB~ApDmaJ
zZERKQujQvlO@vL))itsr)dvxr#&3cuq-?!Uoh&?)Xu2}l&-P7D-2J^xYiSQ6c7)!o
zc8Baq+*?_X!BGivnucVlOMECSYw~2(Jy@dE^pAmi3VGH@)^E}?foUUT%Y0%VSO;dM
z8$(of)>d_}-}+O`=ZVV7f?qk9(;$t#Ip9p7oE-%3#a*jsPO#H-UEZ6aT=o*awEwR9
zCCG;K-!~dl)vlCIg;|S%4b{(AE0-j=m-Uc%b%nBtJGRn)Kt%yYkq(o54qY`$X`HNl
zSMg-yCf;Dv=#7nDrI%!VCG#n7<Y_%3HzD@LB+T45nYWM7X}E+V076I8kAb`3z4^$!
zrjYmXXUH`HQJ^8`QscpY|3)z7VwTq=3YXwnO|JMa<TbjfQmHwjI9PSc-^ZuC!MDp2
zeY<iAahAQr1;7JB8WI`hadulKDq35&`;djsV>j)Ki@-1p9<Uogn?+C9XhQ!}sr69H
zoc|}^{el2#Vi2nu$2eIN$Cz)yR{|P~#>~hY()}(AcD3A*VNRyD(Vq-lgZA8+F&WSi
z9ZcNGcs9dbx=r4at6tstPc`qCHv9g#Xt_)LV7=xWmm_Q3gP+f7`5JKr^O?i<E&mPz
zG9xM??DYBi^-05ZGkf8RpkdP!{eHupzHK$!84sJDDVbcqWep}x@`k;B(^IC^n>49z
z_02|+`P&5d2IjcmbZ;~o;p=*QKa@f=@k_n~UfNeJojDRTdtN(SdfF#vz5bv#81@V{
zGlxc>(uqNB>Kdc|c;LE|-efQy-J?&!ng4QkG$9DZi{GZ%0*h^2m~dbM<4?W+gCB0g
zetU7zdcptvPdLPu9enfYl=&<7K4;-&e+ZucC2V}Wd<(lhX5i%7k<TBv3HS`?cLvm)
zxoO2-I%t9W)I|ir!t?!j*ReR2DXW-fRwu6Ji9HS8$|lsiV|ML1>@Gd<dj}4RyR?jv
z{-nQTfAjxlWnLfuNX|JV;qiO~+7eFbGVhwXcW2yC2&jhG?4!SzcEs)=3v?8)B%7QW
zBr^hCVy*<Fg}U~VTTE~Y$plhO(-$L~8GqeRet5&VqH<mC{>Bm#Cln9=ADz7=bm>9@
zbnXSZLz#btJjKoxWF6v3I?~J2TXGV33FLGPE>EKnC{>Rfet_cLBFJCQl_5Vf8YNRk
zlhrr!ln|wNr8P{BT)IfY=&mLSLlXHuB0uKggbNSzD!n`VD>;S)>UT$fFYlXifX;7v
z@yE0Td<)KyldU)ePqMnKzq8&1ybw7{XtIpS9nXG_3RRWi>Esy1(0kV`zJuf`W)Cu9
zh6%U;2}K%O7dL$K&r|*Fd37KEaz@UUvzhma+})jr5rlW~cB(y4eB6HwfT7^z7*i6*
zsls<FZ{TuLaEkX^TgTPp<9)-x8k`IS*kW88qAO#xJjK59f{&G{wU}8FI>m_v_H1ep
zqd(}oeb%!KYdEDw-<%8}Ur5iG^hX10I-T{0JxtQ+FyH5&_cU?_=e{h42qd5LgGJSu
zCcpVApA)l*1eIJ)OOI7<Eh2V~-=+F9xnUqUt)tW&+nw|*HtriX8$eDf+cd@l*EAf<
znlQ(r)7faSTXV4I2#hJ;kZ3%eI#$mbkBzB485{lC&^D$cIx(0%wtJRoPp5W&w;HE|
zT%dC0jznkX(rKUe`^MOzw$Yzb)0i?yrfQCdv%WnVy4HBNI>Q7nP`J2U*Y-nYK=F=G
z3}QcaVyt_fYvQN<(-g#BJX`+$JEYnGjDgqov2(#jKqJ@9-&g?HfVrLj)h_YXRBsWm
zB;(i2MDnB~CGNz0jZLz=`1ld@0*sx-Fqk~Y>zlLkopzZ&BGo(XXS-6r(7q&?8zHkI
z`_>gpZ+?yoZHon3r=NB~>QH69E27s`e_9x+VKU;b>{MSy=-E`~521ZU^g8XcYIjlu
zv8nzr)E`3mLhd@vp=4g^9WoDHP9lzffeoCM2t&!z0If!A-m*&w$GUw8i>k8MS@p8q
zi^?|flgp_n!h!@zSXV506<&tHLzqz#yv_z7bT=}3X>0`u?tu`=)RxAE;NfboLh3$*
z2{qyC%s77aiufTvP1~&SL+H7gdIhIf#^V7Wxu&uD66RFimv;7<st(%P3)c4YqIl)Q
z70yVS77;@-MY(x+&RM=%eHC8ji&b)zkbOvC=5uZNlaLdrqWVg%U!D-Xq+Vwm>CGu*
zq|0hDrF?Z2kU#Rp)#s;8I<w`OpLJ(^P>I^<o}TP5M{k3(91W*!L~XV5@?qzq1w7N`
zSL6MBp*UOm{xMA$)blBFp~5@CEmS$=R6R0+iQ5gbn{4o$sL}V+4>?5alEc(-k`CKE
zjb3`yh3=b`{&Sk~uQZROL}$4e!Gu-HAy^2-k&z|qF2=s;wySTcz>WIbnqiLUrQ5y}
zs-)qKE0dhk`$`|b`umzbxJvJ<Vut!FC1^$Itrgf?e`zz^zQ;SuAJ6nfd|JkZR&&4V
zTwDZO+%5Hw;@)ao7WahpUfdQ{P+NSKnZRCJWguT%z~U>&d9bp&D)C=sm&%_gBVtJ5
zgjHJm5c9hKmFH0{o}f3hJd(5D%<|{TtbDGd&RBE<>intl=2@Qgb+qYeeYM1MxV4ix
zyfj_Qb81$wR%!Iq;La(HV&)=o>)`_a_!V{o_FsjUm&|<=yo(`I;``o*+H=S0=Fw5|
ziqSYZgiYExO@4*yiWfB455k-Mwo%n&&vjp1UA>skU&QfVyAGFXB0JS*i_YG`WPkjC
zR9XFl;(7<vUM-MaU8OIpzFJIJmiOnHcOQu)K-+W9FriInUUQyW+)a1GR}J(2yLig?
z9bTs_bk+5Tm_zH31OLjCxaqcGw{74eE_E^iu<79b$SXKT9M!s1aic@HI?!N;MbcW7
zpT_a6_PElG4s5+p{}&EYtEI|!I>7!uqdXx~tyuZaY8TFCd``octICfHmeMuz)l}vN
z$l9dr7b&+((^eOlL;eNVTIl^KH&GKWTK?*4i(+x4euDE{<X_^1MoG+fu=r~3#YOS6
z`D3DovR?3(!TFVwY*smOJ58phDSJ_XtUekgyjx_CX9wjvCAB-`?B^qEFf4I~cOcbi
z?BRwRcZ+w(Nz9Le!n|L^J0C3;zE><e8@fWlic;zdm2PlH{4o5uTvRYdWeoCcDfKVN
zN(+=4pfql(#S3kII4pW;-aa%+`1l1gvPL5NJkN;96W8Yby1kXztKUjq1L@4P0y2dk
ziQ)+^u^I1dyl1=a%kki!gLO;o+~k!d?|7qZ8qG`GI!Vl+79)~>j)*~ChKt)Bf~U&H
zfeM70U#CRpd5}UXI-f>`>zJHRcjd8zlQ_S29%dWx?X_J^x>c_$I*}1be(Ak+_nmf?
zQK7^V@aF8)rwJIiS)%=7l9MeB@N&8V$Upgq1T!g=q0`>Mo@jZ%OW?<o6A(|+K3{$`
zP9mRW%k|QG+T`DfS-Xwb4aqY`iDy~jKR}(<4k<zW$(J@<D!o{|c7+5iuQA8MMe7CU
zxK7iuykeJ}Dy(@7*pD}3@22yYJR9QqTs~W;5bWp}!is?HX<ZlMaY)rLr00H-&y8PK
zFR28Rt)E<0N<U94n@%gj|J*AlRy{;%!w|kAKCR+E;ju#HdtX54k$~r&)2=lK=8}DO
zaCrdaTa4VWY3wD8|IPy;fW_SnZvxoYhCNmQo-A<=(h=9~X8(n7Sa`~ZAkuJFeMRA`
zpx32<)<e9$i4!R&Vh;cbN6R=DBcfP(eLQII%DW`QSe=ybg?oqc&q>9zQxs@-h}cc=
z`gri?a{bY~_GaZ+l~VQ1N^AUD{gnc2s+G83su(ErCh{)5;4Pc6C}PpO$ZwM{BEmv&
zvn{LKtdd?I575Z`x$>W-cXd`BP(|IW+&bmyc(MX{UGcAP-bM3j;)+(gcFOek`go9a
zeRu@rRJx*IN2XHO+*|Vccu+GOw@zLk4@}bSLO}F2jvaTo@Oi9)%ileNF40VF3%&=^
z?3|Va)$?;y+ARN`&^f))98&Wp9>tve7`shT3JwbwW#AY=*}2*6rt63#OsJop05DR%
zg*2`PbB19cB0tFxEwfHn#u{8(E)2P`_uHN9fI^IyQ^K+gu5egVXxiLkq^BV^(pIC6
zCG0h(*1hJha1`Xr?=^U$<^KKU!8^e&7aSGf1XO#3k}1%;TrMG6w@5#T#1RnWcXQ=A
zS0sXIpL3PWnd?#F;(~xvr?`X$l^Hwh4!|FSukvF48WJr7+&H&;#HF{KJ>@b5RS;>!
zUCdWroP-ejunN8k@BjrXUkRYA@nRqlUP6En4Q|N-ocqAEGG)}gWmKKPwk4Y2uEE{i
z-7P@yKyY_=2p-(sU4py2y9KuZ!QI`xcalTSNq4_H`t`l{yz$1^f7V#csx?>DH`y${
zRh0lZMa1muO&iD;W1UZEzL~<HP%3>>3h%%JVwL)l)mzb$V-A5hvIOm{F{;p21HP>H
zK0iD~ooP+qK6T@5@8}X|3Elwv-I`Y(CGM*)@Gde)n)3&?XslwR^TjGa^@npM4x%M}
z(tg_`hNN?P$|;fWw;^t4C~df$zWEI6f=PWEwYanN@uH<_sq~;FGrqd8tUxa|1AL%{
zYcp47qu~dFN#>)p>rBt1rXfLU>joCj=WcQP<}>CUVfK<r!j6$p@U@C>-XCG}i+gtC
zv`@aRjye^FY>SR?z>JWUj@!h`O76nk11+vsL;5uafa<T&5it8Y?LErltOA*<A2H^Z
zzSmSx*-{XJxXYAdFwvq$yKPhFC{B6I&63h9G09YrH&gKw*PEVjR;ax{*1qa)yiUwJ
zHZF1~+vnil{PU53M=(jPVB_8^d#G9Rki>I#z;&4s(p<a)dfecOKx5d|U0W&Z3+dPu
zlTldnkmGMu@r39YS#Plx8qfoCH?rR&^T>v5&aAfyNKMtei6~D6eX$tuaFt3UnhjIN
z?k=ye-%(hZmrvWyoKBq)x|yh!=-(K<kFh4JTGSt*A&|B`9}iD*ZT`Xn2ZYQjNSS72
zr-O)FR-oCvS^|q%5Rb7fVgG|~F5KgY{{F{YMiKB=V6s3{BTcXi2fLJkiydQTzf!J&
zDlsM=IkQp_)6FFB%}#aaN|e}ud}~VC_BOT~B;9Lbsb-yI!Za*)lAv?!eHoJ)1*((p
zY~i^2Zba|nH)e5c**LgQbAeq4tb@FVY;eIIac|>VJlXj*j-zKozYHhE4e~L9vwJ{+
zVGB7MD1En2;@^0nZOobt{g{~OS-6vYR{-8aET0h(k1!c&iN7%qa+vOxf+enh2E(8-
zC>0gJ5_y3Tm_v{&*fYr-4=FFum0H~KU;$Yf9@<JC7oizRy+so(hd10xtP8GVKi_)B
z>#|gB9sj0T_NK%r{ODwqN$jlrWSx4mePL@R_WL3$lBkbh*Q5;h2BrEN%}0B+-4<!h
zGP#>Y=KhT?b{C9x{FSr-*#Nix+!t(GX#s}-w;M($m2jbg^wrW{!gtU$Cy=c$Hx_8!
z(3n0zfoPBL^Wa)k#25M*%2DlBqjRFbu38S+#%=Y~Dk1{Ijw|KHFkHYU%EB<il8bDk
zBVvMGKy9veShO5^JmxN5A@-Vk#SNffcW(%aS+2Z7u><=Uz&b+)pD$TgP=&Jb@BJ%e
z?Atu+1=+&7o$Dg_$R373TdX2^dNnQ^vcWLx;T6e--pxbS-A%&!%3YefL8K@%6#HMp
z-AXpgE#(gQyG_!xn~%6O#db?&%j8*CVRLUMbI1(THW||{-Rmlj6dQdjGO{Y7z)l%m
zWxgg<LH!Wc6n84r3Zt9&F^TF<@&v(gP&G^bAo{}WAfDnpA5TZYxt-J9dsS9ax1O_W
z>HzP!QzMyVXU9tX)BZ(%)!0pLf;vq;x1am7TS5j-kFS_Wyy5b|<U{{bA)a)z9n|BZ
z$?_97IL}zci)7IKm0Xr;gj7)S)hf-P%$5F|ac`?B_3rvRWJN*M1FULO!wB=P46!PI
zBD(H7Y$S%IV{f@nlKPc6nUPlzvB_a4PI=QM-}{+zw;f`W$8z){1UU_P-t8sUs!cLT
zc-fn8&C}%78BJDlRA-3w<3`#a_JF>LT69Ow(VHo|jEf8}#k|Um32zM{Q2ZW3#jVJ!
zLCT*)Ers?@Y0ul64yR=`x)<T_jadW~;2^TwjWhpwmvesu6xj+t9$w(tNZ1D=M@9xo
zQ#BEf{f~O)fQojzkqmelkF6-t1FpHK(U8e<z&LWyH+ZZM5l}|5noUhx;qy21Q75yu
ztT~-L^D{IbGU`qv;u{GTJB{}nn7$&~h=_Qw;$p^Vt}yr$+3AM|JOyziEob*VM~wh)
z?PD^_E3F+3@3ii-B5}*Wy@1zyv3{l$Y~gi05Z1wNhuI0C*A|Gj@i-5+o4C(jtjVBL
z#q%9exHf-|6_$9c4D(?cTRk%lQ@0yWwgtCvIAF{QDYl$|iEGnk7{VPRjc3@G!p^q3
z&g<(j<k6ecv*%<6=Si-rJq%otX05@5+&vz0y0KuGGwGA-$DYDX{9+n9_tolhsm&xb
z;CQ;CueEakQ`Su6q+8Ar1h)qzxd{oMeB1br8Lr0~_LFnBXW98O3U~nf%i9k=Uyk;-
zGI;9kzwLHgqVEs`HwT%Hx*bZ1WBgEtW|KoJN81U3DQUl4QOt$%661%FaJl&b_=Yy;
zpCURJMG0k%VN$ZweGw1_o_!XY<S+3Sb)rpA@*&1+tzsfn<x9X78DUqc*6tOYb2n{v
z?>3AM4{PN}XAioJ5ped(0c=?1ObW)+a-?iE+h=vV8Z1A+H-0NdAmq$ZDo|omuBT;l
zX8kgTJ(;A5lM%x{d-g=k>)~7nEB0#ag{80`FKol0jI~No1E#Krq5bySSk)8L%=hsU
zVU<U4Vd+fAQhnE+6Xxae3P*Z$>&>KcGk$)=`!@w#b>P`SYnNp46OJY63=a81-I!th
zbzC^(g-pv~_oBQZ$u+bq3!yvakAA*>`gWFn2ck$39YcdL2yf{6Q#|#>o->$-h1%o>
z5}5ZG1>U6}<VUa8D<qyO;hHI^o}HO~_(G#>?$?|n=d<OONP0<(4;9Iqu~l8pXI?s%
zCzc>~U20Bfz##frF`naTb0on|+iCrfN5J+_!-XExDMP~Q<(<GABlOLilCe{wfsb=m
z;v{u3tI6BX)Q6)f#4`i;b~dc5AxERaw%;slMUP284b?Hh>QBR^jcYB?$9Zd+Pf42C
zXXMQrggSi}G;qrNE~q{^dq&cr^)M$hN#73xk=<~duag|CILVv4PE7a0BB_2&6c!%0
z!Po*b9sAfIsc9aw!3asr{A0BSrj7#s^L@0)A`fE-8-6D2WU$N~=i0>%yxP`B+@l)2
z86`neCJS2F>X2ToK_yvx7t>Gt9Bx(HMHR7bb`}opjV`wccAtf^ONVELm0R4pXhByb
z49%;KV$*`dE<P1w))gUf?7|tE7I>a+qoiVNX})Nd*CSH&G(G3pF5+J>TI^Dkv5T4I
z!?x8B&qU8)hnFpmMCED>HL1G<D)Hl8Pc5*Od+<D;osiLaJjP+8ay%b6Z^5x^(Z%w1
zOr|E)r_<g)j%-(rt_%>LZ7`GfLPskgKDKGE2PRy6af_G1HMrm;xl+uFcH($p`I7%Q
zuBn+T+9F=<hk903!l%UrL~Xh+wjKZcbs{d#Ik*^X#Kayl@XdfJ>IaRgueADvrRv2_
zs8jW39J&({&x|7<@4#H&TL+QhZ*EB68-D?bS1h=3nZMt`GaeqIDyR<9foJ4t;c&%0
zZpJ$1@V~_rc^V2lGb+G~G23^g)#cyYaS6~mNOLPe>9ctHq;W6D7SY23EUTU?m2p6K
zg;g?3ro6!biIL(AaZcdev3A!$L@8whV_1r%o&sNR=|JOXLqei;=NC!S?Wt{o8gl_5
zPltrwfIcP+Ck8+HUg2DVfK1v3^%-<5@D3wuKmtu=)t%I)3w0|b0rARv>`_9Cg|f6K
z^}cl)ljFwqY@m(_{Ps4g7vB2IyL(=|j1{o&N=ZhXK%LG^iB!?x>)>ClN-aBX-p!CZ
zig}U3vkJRcGUaNI$^yStzn({$U_8|uZN-pQPn&svx7EdMCmW!37v#cg$L4|_a&FW+
z+UvGX6!3ndu)K_2hBRVIlVarq!-++7m#@;t@W{OSO^wGZ8JjrT+6|Sm#f@VEPTk`@
zM%CM}^AHh*6cMuI;VdlTVK<ln8xp}<OnsQUm9o{2Z1PEErS?i~5j67xDj{VGY?Px8
z=y>Pcc{C2D%hWF^Qsg7u&Y6?U>gqo7jx32yDB^%?TE0|H@ZKaA71vg|SAAM}i!3&h
zV!grP$fi8YnBg9OtX@;bjVhr0-J<p^I?!OLZ+N@5z3cL#ZPM}->Doj9_=a1(MR%4P
z4twVXeE69(;|*I{z4+j5TgiM;nUhI4<pexR^%$uNIMoH5X%dp9d#7b>*J(Mn3=dLd
zQEE~l`6canJ26NtY28+klJ}jU64K@RND}<KtygvxrpJrls-J6)jYpSqO_rFxY~F!h
z?Bx8085CIy*|lqQ(Del^JV6j)Py2KB2Y3mctec*e<*oR5u{hxE3RSoL1fJ_SAoQzV
z#j)xxpAo1C=#NU$BIVoJ&)%ab3Gt08K>F^1O-;>dq&(Es7w3;%Dp1;N2L4-7XP~W@
z4vQbrMSEA=*DaemwtM{!%t{kxS!(b0n;H~T?tKs@lUfXIBz5}A(!E{;x9>z@MRp4H
zG3)rM#ND0xli!D2;h)=ZtEs}?xoK-+?H&_}?Jk4aA9FnL0qI^S_hH6TBx&@Og1Ymc
zWL*(V-B5<cR7q3yi%~|rVE63>zU%p}&o+dG9i7jX)*77OmNQsf^m&j;d0OrmZFq>a
zYd+@A+m=y+{GL01Nso1K|F#n+vN>a7SQN+t@a_m=@lpU6u}m{$x$8Dup`mu^wrDAt
z{t|JVC8jpK#yZv-TqRx#7x6)-nr#5LGT{oH|8sUhL)adlEm21Jvrwv>OY`*eHPN^S
zbK6GJbG9m=CWf~#;SqQrtCq~&b3sW!qYfW{Xup`P6)v2H>@T}X5((_a^4aa0D7K9g
z1XQ4AT}e@7*@n{*irT8`8J9DT)wp(|a687;ww3Z=AIF%e>2WP-ne;`xcP)EzVGdr{
zO7A3oxli$Hy^6C#h)jLmC2Ril9Rzs=z4>Q9Z6evheW<nNX{?d=w7HxbB)Ws70o65j
zE7e-F_i1m&pD%7Lwt{+X_g&9WLc&vUM^;VpV+rpK&}jtC!}cGb=kDzoZv@6~Lh#xm
zV#r}=Jv>Vz&{iC$+6M~9jE6t;7*cx+gHn?k0xmfVFzAUL@g!OVc92`yiS<zm)%SVn
zy;<soN9zQ@0XMYmypUKqA1FXYo=`Lf1CFg9I37gfxh;>HpY=oN4IN}M3usWjeJY+A
zGCk8OUFM5eaadure4B`ZH@p<`9exj`i|)%xE}#4~_YUtMM=QxE((wrQ9Po>VltuzZ
ziS-BpCuAp^VW$0;ju*mPvX-}VZpizf6cj{SMFu|{2Xt%0cZwBUBa5BgNhS}sxATJQ
zn{4hU4x|$pKHBv!`ML&%2_F+2Z_A)xTWdF%ENRrZBREP}N-n!qSiYl<ij?ObRqnM(
zN@}jNQ6o7{2MGr^CfJspMr`#Wu?l_uxJwM3daFAcvk98DxC8jdt;Bk60zV5$CVyPk
zXz=PyDh{$Wa)Vh+WR4TcGGt2HEc!f7<z<BV49vB+sZ^2v)%y4wmoaK}U2acRHkqp@
zrQ!rr^}XY3>yP`FXr*}1+a!E+`QsnKH?cWYdr)-_&#Zl^Fp<Tv*{=su@F3<rB#Jxz
z_?NA{9#6N5BvX!PLNIz@E{YIqnqp`|Atn8y*m}KWnFUz8TY!b1)C$H0hdJ!ZyvO0`
zT4QtD5`Dy<mP10s{jp`WrP|aR{EEs(WyHix!GrdoF<rh2($KI#Ttri$8VIc*vtS{a
z%!puIr<IM-7OqI~$$_a~aXg@2h4~6!G`LROuf022Cl~j;rV1Uv=8YlNWjI81dYdV%
z)SKCjMM;=T!@urn#+#xglu_M<ty!}x3{88x3}4*ToQXUuzq7sC-p38|HNsv8!J#un
zFK3B36sGBvR+Vqna>|Ta)SZ`)kK|3v;7|!R2PaSG-SiEAnB}gL8ZS+{bC7rjMzv6t
zAcvXVUY*9`_B-&PoydBLjJTmoSK-Vb2y_yd5y86j#(w2g_vTaJo=U3MC=JF>r@<5C
z_;!g^2kNc!5NoCGqO8bC9?Fa3h(TlRUwXkM!8{Ejb20i1#iyYyJ$2dKrv(x(TiM!)
zZ8l?zNV3?#*=1<;P;<SL^M~#0d{JB$H9jY5)(pU=9`dvphuu!7+4gF$Zh5>^tgUA|
zn@nw<#BdW{XNW}^4idHDa&DI^7b~1eIv2vO`713Bod>A<{E%R~_EFG`m(D#{`R;2m
zWF_tQl)LX!geuLAIyn4B&fDTq6~#>7ox1Twe7#<EDW9U5`n*x0LS<qxo2u=>P0Av8
z9tuk_4FzNGJV0X3VS$2)EM-S8ai^Xkz{-_49e8XFaDl=s?`^FchsXEDF2Tyh^O<3D
zn$SATu)5gLx*icVRdfqBObaRui;%FoTKc9HV|%T^-L|>iHdGOK%rIPX3?2k5p7E|-
zo$LuAlI#H8>;P4C9#dwQ9R14==9eF!v-`tDBH}`EL&9*)bS`ryc7viPkSiyUX+l|D
zM|N}a!DL)uZ*%ek){vC*0*8`4lW+%y&HWAYFj+UEh5Zk_Mu!cZ42#y7XjSwZa3My_
z{f+Z5MSi;`hYb?}F6LjZ4*-{G9;V`N*Y{z=27rs@mn#t9GS9;_{O$TNY&ZvSvHo%m
zjF^g8#$(z7T+*mKkts8wi_|QeeIy|;v%rliNcqWGN~MFPdEmCy$x$h}{)-LzQEM*v
zY{eLjDy9Qr5~vtu|23{=jK=w210KEG^IAMK+%zmEVEademLisQzaj)=W6^vtzF<Aw
zcq*>|cVOf%&wl{=KXsL^gf8Cy3IiQZ_r%Nz(|;J=*i!FCVXsjRLhbInRdBAyc1USP
zXwJc?ddB#IHBgFLNxM4NXT%|UWWkfAQr&B$4vzH(%VHTUKWGce{P;lo;_Jk=1%9$}
zS;w{)94q`!SK3b(?!NX#0l?*%^wSju#~Sg|74yplK;-~jtBF5dL8ys2voPXyow~5m
z!WHk~sY&1J1sj(@hMRcx(_2cJ*JBa_R?orAYmnajr$zbO8lpG-X)*q`M(B-yTAaVF
zF?z$Fmf&w|f?ofpCH~u*qSyUt$^Euw=(T@Zs=uvSdQGXrkFwon>Qw`|S)iKT)-07v
zrcQu;FkcF=i~&|KZVf3~GO81-&rFX)@vjY753uz9vV{J!i2kyG|FSlw|8<n^zpU)(
zo)m#!vs-|hc+Jv(_!+6@YosE7S?>YXdYREwT|OWfqQ8a#{>$2!`fI|!tn9xmpT8`<
zDPIRGl$7uID%$n9l_pPyE#H-X<;jxfRJ9$W{A%VDGl9BF4Z7vKRiD`xmKMM>cK98r
z{EEcOG&sssD$`VTwbq?U^Waa;0Go04{!elb*fwh0{;<0raVjnMp9MUPOaC*>Vmx#f
z>=$efR+pus8KWF_`gLkn<32OsKU2ddpZ(y6Ew>pYY_9Dv^D%5;{rDR34}RMQ{xf@l
zsWTv&(;r{|@5ZPAz<#l=!0Iv8c4X4T`YlL+{a`T{I_v+38y4$EZRQ_t{v%En1%J5d
z`~@TDKqzt|tl9fe@c(8ES-=>DKewVbTi{H`F@UJtAEE^q<zfHKk7=J7(VzT;0rK<V
zPkyrh16VZi*~j7aiP%0N=oZ%hV2lmG7>Ylq?yy8C_F4iEE%`&#1`y<*wYOLdo$dQ)
zegJD<`6oYp|Hm*1q;d*FO*8S<JWx%nzs4X1jFI(oYOf`HMd0R?vmfvO5RCx@`TG$E
zY~3F@80Av`%#TT*8S<a}NCEQme*+^Pv_+}jV$B7dq+OoGqtc~56WSO?VOQH>ZYUGY
zT%VuFk}!n&qYTuN$u+vCk*9aKQN3>5fu<s5K8ASgh{AAetIDs=%xh&ho!HA#hQWt6
zfu=?S8pi0FSj^rvSjE24Jo89(mA#rwEN9`<aL$kcw8bpYP!f+A<5IdVs|Kx_aWksZ
z=%E<W{`EViecO4#h1w2#z|``9sTF=r4PF+5NKn8?z${0w+vSH(B=pfh$T&x69B|tL
z1fo0!A|?eQ^V<8!D8hm&Lgq<A<E{{VB9V^<BE~r)<Gxq|BH>@Zg^z!T_zKDA9f~gy
zN01psD1aOef+6NjDIrKC<xR>B$(RMAkmoB>1R~Xdq^}QIWDXf-59xABl8Dp=@+pep
ztwD(StPfLXY$R!7a0w(iAZFYKX~9%&N=CA;0Ddm3oRH4mg#+oHfLt7S9T0;+<q`S-
zeFNkT5PT$gVlXw-D<}s5qId-*0YG`LAYT9|`wxf`Fw-AU2>?X()jaCR#hNM+$rkie
zl*Zeii3FY%gFuxO_6LmxBpqIzj6j7RMFsUEV1an7(|nCP<@Hth0U5pO_>5Eq09pJ2
zp-Bq&{Q+qJKxnTZCjdzE6?6^&efa}ImlOsAi>0a3fQJM7B-o`*Sw;U!1ktB(py!o{
zK1?1V7VtmVBQPcghr+zF{{{dtzJeG4py5~0CIH0s2gIBh3<LWLngoEDUqP|}(6ncj
zaNR-YjJEgyrlfEkAg15!&FN7vuwIGO0Ek$;5?KfP6xH}jWB^N2`1%jX8UVt61@!<x
zHm@K;@J~^Le?Zuh!mQx0GuZ<`I3Mc<9C+AqBq0j{G3~z+>4D25tbQdD$(0y<2=_|l
z6tIlkuS5m`pz~MId-y!UsXri|#9(vySI{j0#QO@`1Ay*dK|KJ_1pqW(27cp1LEu4;
zGLQF4<V}~nzUM0uB#2K@pg{lFFoF1z!lV$dM0@}s{8tbH0Ob1$k^_KH{(uN1g$@6J
z0stU_R}ek`6v#hMxNx-^NKZnHm`5l9^1AlIiNTVHuS8IFD652DiRkzi4xoGe<8jFW
zfXx1YL=%ID|A24-AkkNl7XXC+3L-|zBMkWi5(CVHM6RaajH`~6=PL<_Ddv@kAmpbg
z*;gVTNF;?7Az#_Y)1xGjyb@6dfD&Fo-T;u!9}uaeaQq)oG5|#S3Ni<PQhtJJJ3hzz
zT6M{70xY0~Mr|B(tG>_ige$)y1TCv3c0>O6Spd~Jl~N9NL;jT!z|60a{nmmuNQo$`
zS8}(c)WU7A<knIu-rfBn_YXS%dC*V!wCaj}jp>(scCqPDoJ+kf?TT;i0Nd-*{xeno
zLgYUW0>~#I0;GRC``<$SnrDD~0wVbLv;X~T>K}RjDW8D5$6jOlC7=IIYyUU<zh(l+
zCm;gIf5+PY#s2p%>DOHbkk1ugl7Bz@-@l~)@r?bH&y<RP5sClOo&O)O|MeB+^}z(l
z=l@4y0g%r+fJiC+C7*Twlur^j<bR*_EBAB%l+Qnry(*#FzsjfiU-F6auk!he&VL^C
zTR!7YrGCfss)SVkDxanQDxa^Z`WGVqdC)KUoCC<`znT53fc(z$FZomh$mhSA{p%z2
zE6=~>Q{tBNzklujX8$UmzjoO#`7{T}=YRj&|Hb}QK7a4BU-C%<kk9{)o&O)Of0fT)
z&)9GI{1=h<FWvc>M^FvNcsiFhnErV6l@GHimzfDFkap#*eiri^h0l*``7<kW6Duw*
zPZlUYKN0hxptK>Zwb^W6v)fp{_6^$<GH5HVpsUrH4fl=qd=|AgP6BQux%T?3&70h&
zSiS?JKFdg&eKw8`GZMsbtOg8d)Cemyh*+A4+|Qw_CX4af8V#kuxegT=OTyS#Ha8CS
zuSTq$vu8!;xEZg1+zD8ZsKO~tLhBve`}wc38NloIiWvqNtzHw=-{>r8vQB^4sl2P#
zjJz?JFP%+C_OoG^5XW>Q=i49m)$ot%U!50ktzER1Zq*hhB`9UurY53mBmv`S4@Q?7
zFnLEhEY`72x=^JBO{DfV&8~WxOJ{Xl-$Q_i(+DzTQWk}-p!@nqTC1gHzrgiz4E{B3
zd2~bbEWuVMcEB^zCA-bdk30V1<s_^*aZ9wv8NbzfYPf``?)9=ERCgyXBLO6|nZ+z<
zI-E5V37AmLmEELL1=s!7VNaa_^?qEY1^wx&fb78<qlwNQ14FCtbf53yhft}lH`oMf
zm(@<@^L;^2?<FUY9r-BTm#C<ntF;mRIKR4UN;rS+bH$nbICca#A0uziNiSV^5v6I%
zVRq2EIR7<)RynrBzV<t}y>o3Eh;+}_AB9?b%ZF2hx(tcW8!T4|i#2S}w~n<_ebRxj
z2cU05RAKd~bT0fN^os6pGjstRe-sc6;?cs7Sqr^X;C7hf5@kzopT1yJ0+XfY->jF-
zFp<q+iKp#we;Mq23GZHQ-lv{8H?eNaNhn#&g>$JDGzm-imI%&st5urHrsWH`_8w#F
zETeYYG->it76ai9d2%m|ia2Gt$j*-Hppwv_8ouzOXpPM$Sfv0*#fFqtlIM__YJU+c
z<4Z|B#7eV>B?w}cs~>_4&zZYphD`faUJOZa`F$NZOg=yA%p^s++XhSAt>_Wm0wwH3
z%1l_DAK!`afgPLdf(D&-*4PEs7O_s!>2!5$mZ_X@`k_FkK<C{birxm>N~H)^rjRGc
zdkX+Hx!>Rn7JKV|7BJL#?+&vFIt@0@*ZbX63&dYX9R#ftaZojmm_V$V$wozxhmX`A
zlQyPSE@IIPlRY$N2o2$KJ6ZUY@Z4&X{OhyDaG(UTc%E!SON;mi+g=aEpy!=4wR1)o
zplxCu`!}4L@_b>8kA%CpkPop4KFY9+$;2fV^+Bf1aZU3ckJ}lBTJbTyBPq>l_vU9f
zrpL}^hXpWQg$A;&`{6KljJ09U`m2~VJENh4p5d!{To_}9jDGU4MKyDcY(`cl)`Q=9
zqgaJKN)4yA%G|1aNtQ@}JZC>vZVzDItcpI*?MO{?>p{YV`!`lx^AEdi6Td-thD$ED
z(0^2+a-0!#1-@WqI7=_j;66GSIh$%*!R4)ddU~Fs9Ir3USJ38mTgRNU4tC~;E$Q40
z!qS;L;IqL=RJ1zp(VN&$ky(OsmT}@l0krPD^iYP1WUuv6mQcxEqqDT6-n%<p*kX{a
zwOn}<Ped1H!CH+r2whKMg1Edu%9_@zcaEIymdxT^f_0~N8g7s8e&S>(kkZhb#)DUP
zoJ@h~%NFg<=40}xq<F{TdI05ergptB8IqX7dNVpf^jQNwO*yH%`1G!Yjsx{%rdhkz
zSrYkp*ZJic-qvgNKI_U`z2-Tl7p)Yo(fH2(+v8;ISX#&~A-;#a_zP0myHQ$#H-^W6
zMge)mJL)-w0*by|Pemi8HQ4!rkt&0?yK@aao3)c}pIE!pY-|rM(5SgrA`}!Wd%aHx
zzE^Qw2=G&_7=*n1?)*DOi}#FKJ0=@5a%}N^ZT`~@n(gO{wmT*uDK}0<*tOlHu}gFu
zS!`xnE*4`a8bl!y^#Bh5<($}Pj=|TF?T8)@>QMJ~=~4G0B0DQ<-MltvfI+I#mUThX
za+TzHLDjmB!CQ``$M++3^w5J0LQd|ne%d{x$&{FtfM^B_xWN&BJfLxwN~5CF-n5c!
zP|r!ouiqp-MT+R6=M57K=sk<t=xB8e!T-Xc<oh^m94m<-rMSX&CA6crCuK4cO_V?z
zP2W^J(AcPpNW=ucA1M;bzSgBj>twW?_7sOLy3Eqdb<f2yS{%OUG>Ec%xgKExsT`WY
zFt`1N<Qy%pR{4uw>%KFhZTz@CMocr{?fIO2d4(h&j$sno7Wy_Wc(k6wsCsi;(nF0+
z<b8e%h6LYPYQjdxulL6-$q^nLL`FmN!w>I|k4L)$TP}H)dE?goHun1QgUC5JNMDq8
zL0g&x=9`o4X^B3QT{Pcd3`?WyGhM8-&ZW4x`)D;@O7fn1%%7S~+jiY~i)eBZw%+!y
z#830V=Z={(BU>JuW1YBp%cW<EYp=$kxh)P1#mlTfru9umw*jmus<OXZ2w}b*rZenC
zfPJ^;Jb-t-{y~@0?UvCT&aZpTz>`09r6o&u>m;2m(Z>dJK3YFvS6)SDef?JXLB1sw
zm2Tm-P`GClanTZRmK%k@#CM@?r9aJtl3~x|tYK#zEU^7mq{EfF_N++9CdSkL>}M9U
z-YL8n1r`kdQAeTHMcs$?rUjP1K6oBeGx`MShnf|(J~)6j#3uK}HV*HmY^;@7MfjJo
zd~acSBWyYQE`_Jknd^fh5!8z1Gb|BUrQ`Eiox|<fsDnO7gXRNhyRY2NUOcNEPg_3W
z7u^wuW6YRh{{=IybJFk7tr#hs3=k$yecfVOk>45LoI+K64>1~A@n|OrSbY0d>DuO)
z7t)ZRk?72pH$UnIaQc1I<7a8UBjEjKENFag|DVl?q>dFTFl%3PTtfIQ@S;N$2~M+w
zk0Ic@ymFNf-{U%pB9O<G#<ggpir5_o5I$(G-b$d=MX#jBoz&2&9!ZNW*at7fO(u<!
zRHD&LmbliTQv%^=3v-HwtS6W4C7+14DK6&Lp>$RiNkb!nuaB-0!m1-NK-Abwv6M8p
zJC@rCS4i%Z1gF^xGzNXAUpUs>5-gI`B9BwD4j2}iO>vgKM>EDHRYKr>+q=HNu47jT
zYc-#XMmBMDd{iJFKYw1eDDy3zpDsd<!50*g9o+Q39g2=%+kEz0LeDp5z6)C5Zs>Kn
zuqgxEUT@-Re&szfJC{LCzv-pcb(RUntq84FLiZ1Mmt^vGH$O_1_Q@S7@;MQ2dxAuk
zB@!W>W#;GmbGSjw)^nfg$yM)Ke3_736W-cQV1VMG9PbZqwzM1DBy1F)GTyL9XZs$u
zL*eY(!7iYc!f#d-QGXjaYS5^VR>>XBvt_%@>R&#2L-*Z+<+SxHh(PXihIn3V^DNN0
z=&{B_ix+NgT3$w$b^1w#IZ96qK`czJY$&PSlyMa-Zu|8*$yMu$^F`iq@|9;ww$Rv;
zp%JL=kTcs4;#1RNnh)WiPg~qhQph{Ovv~6TU|gvRrL6lXdqSPIyjz{oc1?&tBY5gy
znpM3a5GH=>i5o03TU3Mz9LuTqlfn~<3sq|G7W5PDmcyu%;g4r_yQT1KO}dUJHqR8C
zE@*AEKLWnHY41Ixu<`CEHI^GmtON*Q;P1y4uV61ZXKbr#89$|S^9il%jg+lKYCTNW
zx)#ktrH=XZ;KzX5ckebbU#SR&yYXq@jB|tx>NGJVWI@b^Ak$e#9~MDt&6Zqd&;dn$
z6l5~Ow(o$d2TPue;Fc_hsNaVu@T78cv}_+?i#tzP5BRbV%JNRH=_nXAjzn4`<-SY2
zWO|=ctZX5^NT8RMJpOy5d?~j3kw_s@O*xf<hGbw|Q8|o5w*2Qx`B^iAC{jhKiuE61
z4smfF8jVfu0woJY7yQDt=RhPg;PedlX~_Y?JA`wOhJ~}+^@<PD?h<p}cN(&=bpl&2
zu&$lfmuHa~{)7*kgaxBAXaWy}5WweT86(j?CEf#T1b3f6^4rcOauvJ~E9t$N;FQB^
zYvIaIwCKDo>zzE8$Imxoo(wJ9KG4@I6Mx9Yv%YzvQo(n!+g6`22CkS{->Oq5apSz-
z6qrY?GdZYy`~H*X_$)NOxbj=Hbu1?wab&gLx7Om>iH&^D!;Tx>ppR!%J#0sSJx-VO
zK<b26O>WtK@}+?LbE>~AE=f6hSd0)m5ljAH`S|QQDD1V*sbRZ?eC?dw5}J|{-S!2V
zP0MUq6M`ua*9=)mVS(Ln1Xg!>fWZuW@Bz+8=URRTl$DTA$nxS>y}o^;-Rva$Z)NmR
z{p<km5q0;R8c4I=*idqB>1MlwT^(dly%A^)$>(l6Vu8mhE<>_r*S^IDY4UsPD1@t7
zLn$L*zb|qjvc}!(dSyeaJZ?{ae~jV-YHJ~n#>VMO1(f!H@EnB9sbw8-X!5Q}B7m-`
zSSG>J9={~wzTKMbW3Bw1^bQMbJkvh$P=RKNTRv}qzGq;cw3yU-)!ZFZte?m#+>&_$
zftk;wh(sYyvNu^L!a3a=V;e3KvuKxtxAfgd7|&f<M-{6wnI~1dfOAOx(c`H{K&MIv
z=&&6#^cxbc{{CfX_3}!LRVSk%jr5as)Ak5ib=}#WBeWZOXb-PE`40jkK0Fm40&nR<
zvQ3yOLhVRWc+1_$m|F<x-EO0r0STKL<y+0|6-(n)b<>HCxV}~*cXW4kTFS&G#^fKK
zti>4{aX)Ak98BKDLZi7nS}R{R)d(BMp4vd{8;uBFivgYGS(onS9?^uBcEegaau%0R
zXM$)gWO09R#n*1Pd0+8^>=u$YEn+KTEM-sgdH&1+o@H}4lDF|IFAVrN%4odX0k1+p
zM!|i+4r$9BSPI_Fpcf*;z>u}g!^m2;0-F}b)@DEDB+zQ1l;92PSG%!!nJ)IAmQ`Di
zT;=A{3dR(zY8mLc5iLZu1eIjll+PUOK^JB_Iu7QUPhVroFRgoKD^69;s;FDS(x}In
zUM_~qSB76KJl+H+;n`%PffMAsh+E#Qq^8|7zb%=JAKBaE%=T;>;bm({6!AG1ULpuW
zYfI4240IEycC4u1cigzKIRk;G$=@r{a;N{<Ec$?)TVFHSj$G}4RgM*H1fyFv*9vqc
zn+^Vy12Njd<3Z~H#EWOB_9ly5vzquE+eugC$!Tfr<grreF#7C$s*Gpak<sDf?k6J?
zt&hF|TTX1BH?VQKqZGG!smr!@jEeh>+IdUvxShE>H_t-5(#<IgQyo2&VXC)M+9rCB
zFF-Cgk;g@fJC|@r7R9;(Vc`dgw!#MB*H^l~mE7OyjIem8!)Lm$wfR}zJbnv-gkw>j
z@8J%RSxlV>IIQ*=@_}o&>CUT6pnvA#d+#Wux9-pOHZ{>3nP*khAjqzxJ#dNk8QR%?
z6%vne+_xHV&lXd%W&-0HcGt`m!`p^pw|AaQY^r^Yo*}4wE{gYx?Yy`(j)>Iw_Qm#c
zjBnePGRlD{)vkoS90CFz1GVtrpVg<)M$F6<d8ZPUW=m>X)e6fe&xUMsj}j<>gIj`H
zB<P%m45@>a0k1tT5Qhd<AS{}*DH$uWlt+LYt3J!$jZLO-7Egc(hXMLZa}lAVOZZiV
z+$v)nyIO1;qGv|2bQ@>;eM;=QiSTnL*FXsJ<1n`uHUMCh7zXaktFsQ`CE87iroN~(
zS~On1o9*+P(XY@s+H|1}-33j4Qn;io64ALKWC$;WjvVRT&Gs){=JXaySq|ar<Z0y+
zB%Wf#&G2H&Ri2raY*$UBI)YEkTq#}>`G>~Td~|7sZ&xw4vq-{k&vio%`h{`w4$7qC
z*=hTRXf?+a&D=B;jc@6N6qDC1iMT%F%yWe&mmnis5FHPJST^G-dibgPuk2TJy$^?H
z`HK4)->o<$C(ds;)m<OZX&QpOVGF6EXj=kY$Y|U%#j&XFJc<(Zrl2zllhLS5G$<sT
zK7e)&ffttY10;C=9g2k3X73{ju_~Aoe*ZCI!g3!1;4V2@yVXFNh~4J%b>dLV1Bpza
zA3~W>v|RX$<e2>u>^@>XYE_;CL->*du^KJ{9Y>ysk4W~Jek>XY{&o6hz6RW-<%M72
z4wxX-7hEi6(0va|P!oj^@Io?4=E!U(?oVz+`#fYfZs0u<Gi;s(P>!payU9Y7kL8C{
zC9lKL%(^~fmV10y{B}_gFSp%;)1^Tbxw{tcnPQYw5!mrzn<Y-#uRqstNH^B0IqHFV
z(WIhd-T7<W*F5K~CbjQ2LZybtF0%RLJbZz($B_xVVH>8s`F`hIM@>3+I5p668|NS9
zt2laZb~L!3Aa}vX(4paW_Bh1KESiDY)_VAssro-mkD@2Qv!V@+#C3kdDxVxKV9)~E
zo|4&RA0j8U2eW{yza8e+!PR-Iax1|;{hph5N*=sKTT1l^GdIyfQ$Qt7LF6r<_msjU
zg6e1QDZ^DYVy?GTcEMn#th}*`mpGHWQm;a79d!RP7+lFn(_@(DZl0u%7M-yZugj&|
z<?h|?#KlDR5;l)ZV)>N6^L=}imHdlyyHd?cO5VNV(otNn^YXz{*F<<cco0mJ@@>6$
zeSTxq&02>2Uj2L{fik+GbF80Hb2aFGDDBgx6|)Z8CF^ly%+$g2SzPsMJM5iRd7<5A
zQ^!1PyEjqfPUEq8(YJ0l#AJ%kZBY>&^$A3P3*VNF1|Wf9hFTwVI7<`5O=g!b%dNX_
z)jsd?*(b=5*p<<u>OfWOvv9-QcXVg=VdM>kK3&1(?3~FHSE@T2m+gN$;m_(+O>XII
zd7=k?FKwSsH7+aeep7+-+_*A(|Mcx`c<TB`hh%0tc{>;#(@r@k%#{>ZNCsDUW^Pt}
zgGX^N$oDdu{!u$0J;by7F(_8{J@*_K_TQL+BMGlHAq{ZhxN{c(S9V$lbzNU^!`$-B
zHD3a)e_RRppw!2Un^XDzWuS}XmWkevDOPcrI*k??{e7E6*)9vwyRU-$nI#db{M^o0
zcgB!wyC&N7q)6RwM|~19-=l`$#-Ok!GZUw!1`zAMBUd04*=1H2oc2eH@#RqRx>-O9
zFJ`(Xq{C^&R}!lV)Ut187Av?o(>^9a<buc^Iu5&;I7s)a-t-qKasAHJf9<%FlzKbs
z$gq91@8Eou!%`R4GJ)^vzDJgBgF@R;f3^pBc_ghyJ?*&BB)mUK<&x1|0Pr_yHr!qK
z&@+d6s`n<`-Lb)GRUldU_P4U0ShVHS*ACSltnTKZpB<|0#w0rS9lQ*i$>~hj6CLjU
zXx08ML(vBBdbs`XgZmH!qW!!3ef#(M@mbI#eSJZ>vvye3yR^7lpjj7oa&dz)HTk7m
z1Ls(-FhJa8ccAnJS`!attS(OJm_bHG5w3$q(N3jzLv7f{2#a>~JsLghVXN|;K7fma
zd$k?;+#8W-KtThoO=`!;CHveWcqaoIPdn&WS90Q@Mv0~X=j+@lz&EJK65h_BWF6fu
zFgPtoB3OLTw@)bILbBx;Q$x~X|BkSOUTSDnBG<#FZ{wD@C)xM0{NT|6-X74Y>IpUc
z1;YGkWNqj3m!@eCl14qe$s=-)i;ag(ym}#CJnRIwdJeX#eNi>S_q#JF`BWC2duw*A
zT5lS6A@hsFy_gua+s=O2WzoYK4Kk!uc5Jnn{Hn#V82DN|Q8<*%rFtit``Pc2C=Km-
zA&)jUcF>NMhqlD_i6H<xe=vU}3grbFu~|&JU#sEDx9Q5F6+c|gVS~rlZ(2LrduNa7
zH%slgHo=Wii#mPxf$mcbMGoAzL*7*n3}=>}%=XRTQKqY-wGOG`9FtXp^J-$e$k??G
zPGe$*L3`0JF2J1oYQUz$*a?`xhF4*g2F-ouhmz`!?*rmFl*vrCMzYqu)2nO?9Wu|2
z_97l<vw+bWvH3%8oa6nSJWdj69#2^hlvRdKYWZ?Z4F%7)huVZnTaa;DR6IRW!AFh0
z1Ukkz3E-eQqRBcPHBtvRn}q2vwbU$3XF-?C%PNjlh5fAmf|V!{kO;{#V|_VEqqjD$
z(qbj^IMQscR=T|K`CXeHxmq|Vas6R!mDi_fH24H=gbrU-FBULoR=+?(Iueh!{zk3v
z;qkMGqJH`L*CAAE!y~DWQgll$cnp#%*6YV7D6DN#<$W3nZ2Q=4{jNAwN>&=cHTq?G
z5lI$|rt{qs`ai07wbvP|*$$?HF;4|?S%AZ0S~q%@(5MJbpnq1CSAJHNnUz?xSGB=7
zW|_~~*~Xuj%jbsygA2?UC8IG}6n`BolNP3_*A^3I_fZh8YH|@^P5Yu2Y0Gf%;|fxS
znP4N%hXZz(#HX(dGGc7piSAgH$Icr#bGl$&;`ZI6#^+~~JLU#;MKbPUxIK_hG0x*Y
zFEihq?FQuO=FX@^Jig0kQMARuK7DhG;;Uq|i9aJ(Dj-QYFDf!zlFc!{9zog<WVI|>
z+doV|8Ep?e(<(`4VRjK(yHqH{(n+9xw~_Jn*_<_-77IOQ&)O75l9Q>xqPb6>`7mX8
z{{{?sjf^~lv|bqg02N_N<eo$lJ#n$c)Yus^MdEyetxUEm*;4wTc3wQc*XA4a<o$88
zE_sYwD)8eAgEiVmtW}Mj(wR00nC=D$T5qE0T1s}Vsbd)M)PkM<Lf|iH(?sfok@i7v
zysO>|ZLSQ+@;@ykBBCXZ{i+88WpKX;6W?d_TUCE-pyzypLkENc1ASlzX*S!MCXGDf
zP+TTuchgB4GEE3SqiX2?x!4lh_tQ|;^)wE~w!SIW(_jaS@mLy0%v+pJBRj_Qk?)50
za`Xk0x>#H?Re8JRGt?RgrH<$g6g;zL1<H2%VXmjy4aT4>^^j#^)xn*!FDGB`{4cSv
zCRF5UYS`$lK4opYwz!|yl(Y5AJh;2w_FUgQ$Q1Lh)TJwWot*}mX?Ig>zh$Waiy^c0
z)hU1J`K+zlI*1%0Tx`YrnQN10ZBHIOapM`em>x6CAFH^cY`|qd5B2Klbelw`xJj1!
z$fZX1P{IP<nKcE0k8hC{VSPfSoNpJ_pT}opICCQ3UiV{4Q(pleZo_d78%8MLoOn?W
z!{;A*@9s=3m!74DLRP9);&I0Vb?i>Cc_z6>M7KvM$;X!248JW^ICh#Me<*3JK6%31
z1nRs3RBs!NpU6TO4*S8sbpr~#soYVIvJ_7e4RY+wvAHv?#;u-|gc(%NoSC}nP-CGG
zHau9hDs3|78Psi#s{!UosATmGpXyKD_!L!oQK8!cl!uOo!8;vAt9xH?j?<QNW$_#<
zqU`%6(D!8SC9c_C=;Fy`vxPVjH>Es=u(vgsZlt3h&&%$(m(r-;ywRc}F=>w>J#9wL
z2x?l;k751d99DT(Mo>MkF=Z3e9GnUZL2>e(RH89P^jK+y+(4&!;dJ+5DX(*U#u0kg
zWnf8z!n;(p#hTkD7*=j;4&Tv{WpC^K{iEeUA!B%X%KWrk*pOk@NSeh)n#{*<O!AO0
zEr7$&u$<@5_qZ}Y?G0AOpMc^yZU!H~-&<x}QFmiX7f!H|0sAmE8%f@0d$FXA-gl?B
zUJq>pPDCrqrm>yg@lT!FjXs0*X}Pet#NOd3+bq_)`QKGB!C`c}SZkKV#&kE@bgDb2
zci}Cj(Bajmtf|equtTJcvimGPOZ}ji!mU(*w!9zCuIshmSLQL}X3e|SH@`FzT1X7v
z?a{uTJ66f#N&E3-WPuPmWvPgP)qPi1&8N}+NB&bAgF}JEW&SjC-mrnl3O2ma7guKc
z(#q}9&W+4E)8LWxxfUGaVnjbHwikafq<)?NBagMrlA$*pR2`~x=`<cMPx0>x6{=!K
zI;n}VaE8kBU}z?^1y;$&wp1doYJ+of`i0q{HhC=!%t+|?Z5<lgPC&!kH^sjEquOY3
z{9#T@jI07WmkvY)N;OC2#+*SOgtH@<nM+@Oibdlhm#h>Jpm0S=(UdnwCKw+G%Kutv
z45{`zsHL^ZIsCXK2h#BVpQXm!wS1g1=R|dZTab4lRvW$}y{s*O!(&q4*EiQ^Q>qwB
zh(vfNO-cOE#l~*!n}60CCG2i>e-;}-ZR!d^yTthbKYvY`b9{_a9u!aE@wkuTB~(WL
z1Ua+V>TnQ8$tY?BxPly+4AYrThjf$2zz8qq9HAsA;d&*@c<Tab^uwVBnDrZsRM}J6
z!W?N=kBN2Kex)^oV;f>o$axPG&gmV@I>6Zn13C)xm~rpM_&>=NRu?V?a8MFn<wsL&
z9oMc>alGv%GQuU_gFO*R0nxOm1s$yX+MWttPLRS|-X3<#xUXt4O*I+dz2)}Jhh)c|
z2qc-W0j5Pi1PyT#>f$LsY(-8Jv2plpds@rR!8pWXo+j9$YRK(G1a$=b#`JP655AFE
z=f>EUo$BR(sTF$hZ6uPyyic>eO3CIrnNmN1E?tT7*xyu)v10uE5Osn^=1HJsVj#Bf
zVzUnF{C$iw26*Q?d1ew59H+LQ8nD!!C~hNj;G4H%NXDHKXWej()kPnB?H5pJC?!&x
zSg-uzlnZARqSfnZ6nug$K2n$36{>PP{s@yJG1gKlYDz?)QqaOU6e---Ei9Y;MkrO1
ztle9Sbwo+^(q#MD!$-MZVaF@jbPH6x2wq$Fl8Xf%@RuN#RQHHn`G{5Nb=qTm1?WX{
z7N)t+H>ySIU$wu;F!q0x{!+oft59AjyoogKav5`td+7b374<AieK`8@Go`|OYIrx&
z8n%He`-ZZ97W~YHChMPdG%be|y7IGSaAPfWQtEKA_?bZ=zO=r{@<ln$P;r12o-an2
zOI-#z(M9b&x@m=v%MYKT|CYUpl5JxPVU)AYe1~$c+VZv29bx&fKCB4Uwd`Sif4|r5
znK1lje{ZDtXGu@OIXhg4J!vqho>J1N_X@6{MHRnU)u^|i4Sj$Cw~s;=-bv8krsCpp
zXvE>R*I@E#dpp=Dz2MJh>GXY2bgEcP%8WkRR=vb#14_jTJE8Is@*_ybX#aWt&WJtT
z%b`<qK=1`-O0zNAv=OAt@Pv0Y$x4&V%o<tI^I9XMRa@tF|CjVePJ8`$-3-)<ly*YJ
z=!kL^G=}z14+3ObduxH^I&0PI1}aWiTq@~C&pSz4?MW|cTQKB)mcflI%m1t<QN2I^
zSxZv>7AXxU)^gfv>V4Vj)2h&p)gIAC>txI!W%P9JV}o=@y^ulPnk)63mRP&sv=qs$
zhww>+Qttb%03U@nlhs&8NSfzZz&xradGIWC5I1;wqAZ`L<1LrRAxg8p*8}t1ynEkh
z1n=kgYf!fBj-j(-F*lGP)QIr44^(z|sI%u6)iWE_T6o{x(z(;M&z(ecWLV?mN1OSm
z{pZi6R(5r7oPk`<A$OBZ_~~J)J~iA4xGB_m{j+pb|6UY=DkX8}G$@7XKJw>5WaDdW
zmUGP4NPQkV0lSvQsZ&5*LAa;cRXrRZOtw$82C{)=ZX>-&Qx$rJ5Cb6qhmc9K2Y?DM
zQx1|7w?hJl=4=LJ16gm201hLwo>&(h6JOZ}6mG6X1Vnnps9Kbup^%ysI5!`m;113p
zGTcx;LS9io)o{5DA!a;KTxy`EO>PzeOS*Z`?uTsGvQTB13>QO}8IpleT`6$7tCZC|
z$r<oRu|+xVfm+Rn3L}Pi=AkI#`uVLIHa7}Z7de07=ASyx|K<_DJZ-W~|L*^xl*I9s
zLz0V)8%T~4M;gIawQ!9UOfT=fXWZ%dY(H>}eRCw;9;T>&^ZQ9;{9|t1NDO<gcZYt6
zj_3;Y6@%Trj$&2zUmESz#?~~NJakwS>o$HK&o`B(QS(|%O8DOtlcFXg@<jFSocEZa
z-;B|t(b)7PpsA_zZ9+-SYH$b`Q-4L^vAJt189&wWFJbOp5^>n)ta8L=p)ln5A-R|U
zx#+-C@(k4o(>|l)7le&x%FnaUf2+tQMg@(bZATg_sgjDGATdxCt%vg=PJk$VbZz^a
zUD*c^{xD?Kv7d*QWf2W$rd}t5q2&1bY&=qKsNd*5BjHQ*19Lb;G+eU!<F^gjCjpC^
zJHKCvLnG6%SJQ$*8OMcEu%3S#-8;pu*@YpAxfl&9RrUdaRR0@oEB>lO2ZTFh(|A`h
zErgI-6-yUm`uAD+j{#RnAY~S<b(D&<n_83?;nk|zZ~|`B{_)xw1HuRGD|i?$!eJ|X
zk2>ysci;*QW0No$!(-<9s$EVzZWX=B)@gkQcu4i<+(o&u95w;gvry4RLN4P5U4)}X
zqh^$8P!SR%@xA0{4n#L54O7})y%+pc0#X;>KG&CQ_^XbPUS>(ly0{~hFA>mv!R((2
zmVw@K{PDT_oXZ$3r*A8&%D^u8WUSfgJ_hhc5Qbjo8aEHwV6BDYDrxF%zv~uy&<~7_
z^UiJE#zsbE=M9Bq43=$)4!3(q93zZg-_frlYp59*<ikYN_|P7Z0m*^=M#=l0C?#UW
z8a{O5&;}Qj#i2mwLb-C2xJtCAUmA5yjlO;ZO%aie5y~zYuL6oQEGP>uHnl(tZ-vEH
zPWgO?^>#uk39Man{Pa&9X(wB>nZxChUMnB=;?jd?rQlgFZ+!_;pu-<BYQ_m@QhueV
zxmAu~%(YdE{l~;Pev|+j^o!!@H8a~e?_&(@6Dt=R2y{1fge^~ikbxIxwglfDmed?<
zYZ%w&=4F$I+ZOe$mC*Bo**<ooWzRagJE$l=S=8SDk4j4Y@ZAv&WgzF$0eJBH{O0uP
zSruP+;DO!YuW4I7*#Y-AOvY74fSXWH@KsquKEp_^!Q{rVN#qZKfJL1|Q@M;lfEFNp
zBtOVTMUc__!mBFC?t+OvtY<g1WR2SbLsF%DnOIUWkwdVz$xV!y&0mPbAeg^~l*QVT
zNIcvK)v^+At)5ni=DfEH+W7l5r(7|?v<PrJx}Z4$bPWfqmI%!o>QoXoX5FRgbdI`q
zuCdLY_O_6yge<_RXEERBSkFa#4)1a^oca_R-mLWHF9<Gtp0xekw3EkyYh*YvbPIZS
z%pJ<P$wm9HV{HQ!&9&K_&^bhy-jYn!jPyy<sk@!*l5w$K0|wa&=7d!9lu!R9E6#V~
z?L$wbnaj^p&mJ%|hcWkQB;sWeF3|U>Foi(GFyZi!af^YyrnUKzkWfzp(-*8EJ<d*P
z=gcz_T!{T$-f~<K>dsCZA>0b5QH2uR=vMKyj&!$=Be3HM%#m?wb#P@e^{sJ-6r{&I
zZ2>K_4y3OW;GlDW-PghIXT;f4P(%1i_(+MHz^w~Gm<Fq`0C#(O#3)j-M@WwG$!sa{
ztQrajttu%6)@@kzuR03})(}KZXcQfP7}(;r5_4Nq*7F;difpYEM_h^QJ=4i!!VqdL
zyI9~EzhVr0OG$r2P;tc;kTH9;C-<UpXN|}4c-$;}8fhtdmx8xK_R@fJez)4N**wx1
zrNH+Ci9ir=tc->Uv^0E1^&QZFunfD#XPDF|z=aV1c)c(D=NpJSQV$H)GD77PMCJ!F
zm3F<`?|Ss9awO;)Ri)umt(QkY{|9I96x?a_ZVg5qb!^+V(Xq{6Y}<CnwvCQ$+qP}n
z$(Qs0&eTlR)SQ``t9M`S_h#3#@T}z$gXX3&{~L6lB-EdWgzXDa6u+bf=}Pv~ZY^t`
zLtg=%)Wvo#0|J3*^XAD3nk%Z$60PUPEIU%;_nB8=O6e$yB80IE{!Mpe2iD$<u7k*N
z+S`-ePO-`y%MH^jARb<P%uWxNB|g=tt$?o+827OfnAId&Dhjy%ZD^%V+mOwLtcp8d
zXdI^^q2bO%!CpWP(5l=n|62bb*1B!7^c^yM@7g#uM@4hqApvV_T*r{p0V<#eT<v=|
zz2BTq?y_11h|0drR-bKF`?M%+G<b4SwM>gzZTXkz-08MEzn+v1U{;kf9MI+}&HvwA
zQqD|_)pxom9(nib_B(5NKC)}|Cg#Ih7O!D-{qdIc^NVed!^3)fmi~++RpG7sm(?a2
zN<*`RN|A^=`RWh7gt|17{Jf~{K#PrFS<(`cw!)S%rA%HsR9db<WzbFA8QLm;zj57?
z4(@HdWV>1TSKwp=l?KR<EFPr8Vx&xm6NW0?D+AMWIZ=nYZm5ukn$lM@j73_pY|mRu
z*JhHN+RHHBL1n2fsd^D&RP7|N#TTel4XYE?py~sD5|>g(KIF3jW=3i1cS@J_YW1L4
zRjB6Sy)0fF*7Y@R{a^g8stNc@_)>+m*p37f%L)TDez$Q3Zs`r@)&}>+Ck?0FB+;<N
zdhnkvlm|&6Qn3hU5g1D*JlIU1YB};FD~_5;N?d6(Uo+TEpKX^AQcOC{p4&rq0cYuk
zt$R07H}B$;uy%aZ?km*f4nPkbTg>%jEFOeoN8f%Y9HpAJk74!ZRcw6Xe^YcKM#zLy
zQUoRDZBsv%O9hPx3auWB!~RYd?S`Yg3~(SW#6XJ@A7gNn95jUTliol1U-21BJ=!zj
zSqRw4_@tJsenljIx2a=(&#>tH6cG67I9%E(9^YX7cmDu;B9~n7EvL^{6<fjEe-ULR
zuH{{L=+aYUJ2^=XTV9BwVFX%5CtCo^@EgvCiAD(BT=aZ$)#J<abU|87ok}^NQwn5?
z3|fvLuKcJBix#eq`o7mXvj5Xp3Hl^SfV)ywSgfN-F~o1DBzZYH&<H#J@xAKVd^i-x
zB6FkCk(NcPAd+IoCmifR#smk@M~%ya6ETTWp`e)nc9o~_2SNral7Bo<@9x!--ku!1
z>KfF!E_nET!PmET9gQpz3+5I}0Yw!d8TL^Bef5Rky}eLlQ;z0BGTawUi!3UmQb(%j
ziTV?iG1`oR5z+=#we+RTewspI%y2kJm6M%QHyeLI_8V3DRg!+l$f~&b%%1Qb^UV7h
zw=9nHk848pkVq(F7bH94v4Bb|iU01}o2%!%N~-ESYWf1%TN{(Gp>ce=3beSu9JG@1
zcs;6>WK#qyz@es+2?`sDIGXSri4i?~U_EtaA)0lG_*gTqlIoZopV@@uenXQpNjj}T
zV^y+#A^2LK+(;@Q2X@h$p`6Vo4B!RVG1cAMf=xzekqBuP^~ySF-!1xGX5alep6=2O
zI-`8(1EGic+yPQoy1|S{)#g2&p(nn^TkT&V-c(DzZs#jBV=UEvOqg11&VtuhMpW)t
z^(c-Y%udgV=Ri#UvKXUnE^qU_#nvA6wUYI!Y9}|5q@uk9$(B~7A7#PR1aqc081JOS
z7`BIaKh;u#zVp4D=oqgC(DB?cLw(l*30d;wHf;1bPMMXlJ?}uI-0^kLmMoP`omF34
zf(U7)nPQr*sUsW=d;lF|u3CM|6#CM-dDVRYKZNjoG7pAQK2x{w)cQEAgL;a8P)%JJ
z_Cc692UC;#m)oj{^OHEW;?C9h2p!jaimC{`NnK>~Kt$5}(+o_pYypDU*G)!;%c=63
z+q!jAF#&lyw|2bKm5Z#pHI(5`cEjx$7&sn6E@;y1ZN|QYq=Gl#>f^R3POpfdE16lO
zAJf?bU)@y5GfT7Cz(Zyz$%1St>{wf{%H@)F$|&NPW>T%1-9iJ|@-UU;cHm+BE47Cl
z2_91|5iMx>-xl{?4Nw_sE28S6B$@2$Dgz#Sb?P<bL%Wa|S1oGUfR)OUwH0S}G^+$t
zO_4a>5=kH;z(I>D!?O+bI)68Wbg93neYWf>%O<p3BHNrH+<H=9J%I<FJNQa(u|PNp
zM$TTPtpxk7ddIr?D7c}_vzdIrfi~iV>PcE`C|wY$N!dbgw2@?8(OEP(@MB{?xZ}>y
z#!AOkNn^QtJ}M5fQF*hWwtN+ONlT;;%^9X5HMvMpj6B-%@^q*JQoUoyhoy4K3%h9?
z=tvsL6cs^Km3+l&jN!7R-IMNF8OJTzt>a#?UC6~39d<SZA?v=%a<UhmgoOBS&5-Cm
zyhf=LQ_+MR4?~U2l4jQceTEWR^?_)w5lR<C$F-Gfx(#17Tq}wMm5b0;baD$i1O28Q
z7SV!l7AJ-E8O_ZGK+#qjB-z0<3oos(`~hMT9k%LzbY!;*jd;#&69LTOMP7>y`!PVC
z-h$iQE`n(LW7f#&3SQ`H6{EQNBX4@sOLa5pzOo~Xu!jdaf-KR5wxR)^h2~)x*EC^i
zX=M22K(Gz1)4ow|qpCjTz*bAisjO3O*5evVG)Lzt*F}0AfKwEQ{foQk7%l69T7;Wq
z3q9PYY=@OoU(HGUS#-q<Cgu;?Dt?`h2PW0p>^*gIA)g<a$Sx*_|8;BywRT>xH?I!3
z;APc1=3OS}^82#aeTx4%>R(m=a{+|Is@g}etcaR+v8b_hOA4$uK6a<Zb!l6s0?yhs
z6^lx)G}UYlJ<t}-THn0zPJL`wyU{ecr`xPr?@eqWK%~%tiVR-hM1!``^kkBzsMsNO
zDNjGN2WnJkH*s$Mu=v?~e>Ij|mTqO|?6KPt60#-cyhgIdL}Pxtp=SLq$uHG6Z*_XY
z%&L7=eER0KfjKNO_G=)}EHO#(ISa+Ea~Q<+b}@Xa!VPHhlF5zo^5`mT!m&z=;)p1>
zilu)vteaM7cW)C;j;&+&15SI|^qF$PdpA6}lv0@lf`7yDw!J=XzRt^+yF0yK->9#x
z1@MP+=so10)Dt^TyiesC?@xv1Rr$Qt7r=)vP#!-SvZ^P#a}4F<M^EGz4x}ZW1p~)w
zOw^N&nBLMKo4I3e3{G`#il%8vMyBgiT;G~1Pu9mKFPv=Tf+J=hSU=pc+!33@ad6|@
zPVU(S@O>@qq9O?wSa8^?f1c_Ug2cB{$+q|VV(90`lvy(#2|%WP_22&cbrR!(!|VOI
zviWM`LAq8|wes`p9cP^`mO!$Ewfc~c{@3{?XJ^~%yPT`bEP;aS?42v9tv=)rCX<g{
za)E#<i5;acGn!<ZW}*!niuI~bw<*aVkEhG5V@v;XjnC<Ff=y1}_zF~!Gyi7)3U6eL
zHXE#ZIM5tkR(_{9@%5SgJ8)T#0gdk=R+rV@c(<5OXw^q-wu7DR%Z*(d_6TVha-7b)
z5=<cNeVGFA%3s+yu+rv|J8$BVQ6&kuM;Zx<%r9VbdTRW-*f0P1#Hez7IK#aVUpw<=
zF4Qg~h0rfd5at-_a-Z-oPH>*byLxW#rrwP7_hte+(y#&ozmnTtjvObPo@}gT2yUaw
z@Ps;slzByR&Cf4#AhlTyL*1~!m&DP0kHG6#rtE*)BV1@HnB8%*ulECP8<<tL$kvdy
zk6uJ9HzhZJuc3zQ<wf&<4>fB%<S+k>quU7ldJO_13OD&`=MU;NnI|Zhr1PA-JA72?
zQ<8i0@y8p^c&c5we=SB@MY_pwJzI;8t0WKQ6own5RP!AWdHjl^FnKcu_DM0VpRK*e
zJ&#XoZ(Q0X<xW?ealFcL0o>$n$HUs!!`gpGHhYrZMbeR;krcl!!C5s|i7Z^Qp`&A*
zNS)Z^etJpHF&@>xdn(3=n+?X`WggN3t5?LwyW~xEAV?WZQK~|zv=jy2$;xQ3JVeYW
z!<CJa@0gM10N!s|rSpHIuzBS#GQ3qYnpavn4`6cWKKkj@8aW=}RrTE3M1PCesGU>J
zJ}M!*rz^KS0ASRunlG~{+;j|w>eOm6C!wOBO4f^QvC6vSWT;pGDsgj}K@UnSKEqX<
zIzGst)3~`OE~zc!tsi7GZF;DLXs`YZNAsXnHT#F?s6HJZH*h<ogCA2O9HPgj8jwUa
zA969ZC(5M}=#OEysIFfKE?f&9xE8GCi{M-fy8F3G*?b0vr;0&ko=>?HnSw50dWSLU
zJ0UQ^+f-qFUu3tK))2Rq32bXZ_NpV!jCAYKaVtS>N3(v8e0HDi!?OGqE*_*M?;~}k
zjo|OcQBItTZJ8FZBZcFoO`e1=h@vi6^$&HLF;^9zRt5^8CWsaI4A?IiJ6_yZ*Y=LS
z?|IUf>J!m}7jsW+Z>Q=LZ0uskbz4XtUcsQ7F#bI0k%*$I$2DIZ)^w<9$&N>|2K=4g
zh&3FQ1|yk+h*>S>SNry}p0_a)6EhK!?V>q!hN6nu#lfvAJZXxYGJCtrh_5ajgRHR8
zElnD^Zg)D{b7WJ@KLKjj6WMK3(y%F>Qz$uBDtNyO)JRCL0r9bUvE#WJ5F}og^)Qcm
zJS~Qz_>l#c_HfzR8FRSr{QM+kE5xI1jz!)UA7VrFT86vc+5#J%uxr{mq@QOqckqPL
z@D9&UU7?6Nq7vyb26W9DMRPd?!ZqOaKpwB?i#t8P9@A^2MP4C#8CAqI?OExT3+-5@
z_}8Kg-Y?ChwNg=><{1^|`EiLG`Q=P}V6yS>otv+=aIqf=Rw!D>ML7zPCX|8O7r>Uh
zwQSSRfMagLqK1GaRyD`sW_w-m>VUeRH#sDU=)DJd&=k?S!}d1nbbJLKzBujaS400W
zr<ileW@lx>d_Fkr;k3`56q?-}47%aG&^2G|HS2?X2nBp&4XXJ$$7ON|9Arj{$Jf0G
zH@G<@c)NeNih}~SJ&UWjBML0hK=|8UY)+%XJVk<66QLMtUpr!6bz9VfNubHRatpj(
z%JSx|B+#@I-QT;Dv|2qXaOk~I?rI}$DdG>#5~)_$XhF||tqi4<oGMP^MNk&=iv?60
zS(Y8OZ?PoP-p!5zOZlmNQM!}Cv`irWDtOV|`H+P`RIhM^+Bo)&xqjt-lVY1}iPw6!
zPBp0^%-Sb=LLzWEVC@;jM~02ZC)nd?zb6ikN;DC1rm3|I<6*uh{Z%9p8H^7m#f&i=
za`a9Xxu1VtjS@^L3|Txy*~EK*fFRAnKXy=N><a8HTT9*Ic+q2k`rIbJ&=SXnkb&IG
z-M;oMjbslU0M5{S&*#oW=S(dVUrqhX@`@mPe(RC5Pcu8G>ER|n#VFUEm?_^?3RIDR
z12fZmab+;rB)z#v617ridQx_Qut}DlhoL;LY#|K`%5?yOVI{jYtm&c7A9~ne$MEO(
zQak@22&pFOZiNB;V3#V1i$Huy2e%v6Zp^JYQ1v&jgF~5h?BUteK>`X{T@l`!w`lJv
zU?_6QT4f5|a?^jOm+PQTH<=Bl^c`)#0bUL~M1+`3D>U}Ix7Zq9DVY@URuO^ns|y{-
zKEHg~y}utokl@JY(X*M#eg3tk9~eS?u`5mCM-jUbA6H%9JsfMQxDGzw74SRjqOcy(
zO_f~*!T)Q%7|X!3kd1Z@oZPNhV+`kH!`=P3OhKp989L~uiZ{?3{ny!5W~n3<f7tVa
ze1MR@#->tBl!3Kmz1SChpuSRT-1o0kvPt<J40YK^^GZLdwh|82vNqUK#cIg{rCLUy
zgCpk-=CSL&if8N}$FU9y`t2Dy;m`}wMi4QWBVwQUYLofO7E$7=t`9u4r7H5HQ5w0I
zp=ULL`CrPi!&PWD()Gb~8qO8fv>@0p#Nk-yu+(zK2KN7;pr*sa|3*Qp*U0z>d!j#_
zynNkSlMMNuy*E5Jq2^8lnKcD@Uxh}IgN%BQ))mMbc4T{ATrEIc=>3&drN3gf+hW7^
zyRLZi8i+-ubsJcHh_~9$it1T9DBNcIo(v=2W!jQ}I^OzXlx<@h!D)5w${n)U94jiM
zrfkFl{Spr<;N-_TP(4di{ya8Z<#cBLA0XtC3eft0!$Gnv089(@n!ECg$oe@qThj{F
z>kp>3Q|m1DfQm=K*EniP$^Efoa4`7Ug6berPI&yy*gb(aV04ZuuQ!+>!<UzU>F<1Y
z3jUXRxwM+86zIe?JapeytAI|DPE_!NT6{2U^GzvxqcA{$P?XJi5Vh?*R5MDOn&jq*
zh<L#IfE;udHUi;?<z7#$QWCz$Y?B@<6QPgl`@#oKg}}z&;B2t&*RboCUXUz}B3XL`
zA9D}v=M6I!vf7->=$r<Jf@9YsaEKImTXr)MY|Ahz_&sj^4vRu`%20aJDMh(dot+Rh
zO~q`pWE%~<1V+;IFxLFmm02s?_KAno{8s6DHEKC6G%ziXV@V!|&N>k39ptc(NNUO7
zeU{4Cxb_^%rq}(f5$8#H%#HD3N-k`X!;{oU+#sJ<3~L%zf2kNXlbo?Nqe~2B;$f^P
z<3m_S^@NjgQpS$5ZA4fDh1NICRGwwo2Np@DSuh5hju<K=vO{o%Tx-r0@+E^yTBtVX
zVN3gZ8#iNBov)vQ)T@jUwFk3LN7R)ldXpt#X<CzwG|Q$S?Vp^4OhAX$Y$VU$T-z9t
z@{-Fk*j!jOd(+FsSMsC%QRnNF&rSyHD|t6lO%Qn;-)9>%?yXnoKvS6|GF49Uf8+D#
z?`ws>Ymh$@seMi%$>qa~9F0OmRbnWAhT%aJszpp5FLE<f!%dU}r#b2AWE4KzRN>I?
zbZ66CEni?agQPh(+iFS9N!<D6wA6OvKI~uysIDVFgsTViDw(bkoH02R=#@Nd<R^F+
znf=s;UP6fQI|mK5MrJ<$S%GJfIKWG2{J|iK9yU>F9ee<_HbK~Tj}DliHSK2R<x3m_
z!MKt7ZIbfay+rW6j6^L)5-ILUTY?iD(R;s^3pibKeCDt#fscoyl+0Hn{OuzEz-3&1
z%D{#nJk6X8V!V^OIWl?-`v7mxw<DZDxPkaFWcdGrFPKXEn2H-|8dEJrT!))X`XyTM
z-aH5khd$n%Fj4Wyuui<~%43L{&!4Vl=_svuNfdTZ+WbLh&rI4@LWeD)#{8IcQS`-a
zz0hWYKuwNPvwk@pS(W<Wt872^y$a{L9s$dQw$Mq%<BTw$-%bw0Uw3zTe6FvjRClZH
za+<z#e0j|V)(z)h;0zp>z{_a9KIki8)BnN-{vVOWo5S*}P(+b$Zwg;?ECIhTQMq@C
z?K<?HL2DW=`n^#LhKz21PDvcPefh{NVps^DFY?1}Gx+idhM-Kp{ynskP9&^gX--*T
zJHKt2ovtrt)KEg=AZCpQ2g=OG`1Wv-N{Q}xxVA%OmFn_#?|FxpIk*g2qbdAr$bE_R
z`PtUiA^+w&cY<WIXFxl-+i$s>@zmRp95ARhGJm<(f?D;q&2YQ+JgfGneNO6CRj_rD
z>0LP8{<k7sxi)WTdPDNWrB5e#!)FG*ydZhcchRlI{U(O``3LId8{_iH&j#DloZ{lX
zlnU{0WxylRx6<uu7T@}g%;cvgf}6~s0z%LHi{3{C7o474)H%0IZDLMhNeZzADcZgg
zS;VJA(<(r#xPdS0?l|nOg;{HxYz<-S>{ZxoM{f7`Hge>CZlo}Jq;2DgNHzbCZ#SV&
zk6B=N{*FlX(rK+8=Pc!#RI#H+Pf}#T&orA||6ym!IE}g(>loo9!}a7KHLaaAmXjZC
zo>C!vNaO}2h0W~27B<}557@rja`&M5*erJUmLIO#-*L^5c1gz9J)>y|`LjyhL&Y9A
zn(hBT&HU4u8UHo&yYrQnghK*|-zIu%tqP5G|1nnwBBe4zs|lmhmF9XQtDwPl5;dTR
zP%%lpVnUr(@O@4#oc0a<<kvn;@|90&T5ae!1k17K+N6|gWWGUAGw^5^{3U8Ge@r}i
zD-Gk3q0)Mz0jFtNcacNksb(}>EnkT|0uy_mx1MK*RoN~fLrt%s66AfdmKJ=Y#OgL&
z#-Z<)5SIzG-fRPVJ;+5#c6^mlcj~1IfO-FeaeoS|wsLzH0nM-D;|6gPZ{TxGgi~<O
zObdpn{#7!p?o_rg81Xjn63*=l$&G8#3D=muXaS0QR&75+DTiNs=R_&E$m=POB1^~(
zQgbIpb0Y-aZ<{2n@0;)v*%bJ)B!PXI$3cD2hLK`DEN&&JeQ(yoiQn?oVOWCC%H0`1
z?`^cYpb_|aFZwg`Ys)r*8_gXmuXiGRKqmFQ({x@e6>wYfXQ-p(18SZiCcvv6Ovb2O
zHgru3z1PMTerA64i6&Vr6?9l8iGr;s7`aY6CI|J8VEh&|;`E@s*i@NcZDz33iP3`<
zA5L`Vnl6Bx-9PL?1TkcWL2-+m75uUpQiDl{nXL&ca<;l)G_vIwOs4k2<TmN=ZdwmI
zABITG4@CP_vnAuHafzlz1~#a2#mce?ZZFQlUAVGP?198pm1q>%9m~xPVfQff8vES!
zB~{Ey{fF7igXEe?!+j^H5~H5UBt{emOeaUcP`d9lLcAF8SE;iQ`zIQifhEVqPQzc*
z@L^PV@!CbqHvCLq#QW$~wKrW=1XrElmsQj8KF(&ZAqd3~t)8B`1CaCuB$Hx{DVmjv
zr_%~V>VW{D&W{KSyPW_J8TI1)kHDSOvVzJMtQ1Q{4y<GROVQd-7Zx%)Y3R07jMCGb
z=s1fP=#AclH2lDlVX@81cGqE1UPv~{D|s3d<$yFQy_EExwwQAnCEguGzS>z10!mLQ
zPA0CEDIv6-=Pqn9iG!l*)M3Ff)R$J{&aZ%zPscr-Iz)dHx_PHe9&S#|x6{J`PM3mN
ziP@deh+B>uZJX6W+kUW@5U_97@M@rQB2N2&5l+lF664!2v)co*_q&(t+=$9+UZv%%
z!CBVd{`lHn%@0EZokaasV_>N(UR%Q-^jb7RNWYNzW)%3m7H7<xNFwOQIzG20D|7$<
zp#tSowwzDhkJ#yB9?ib9)Qk#w9WsbiN=V2<lCZD!@)&2<rq=4$@N7rPOsr}aT7B!L
z2=_~`#XHWQ7P2y$#{~O7Hpi+agMi9R#Mu3TKm6?qC-DymcY^pj2`dm{5eGLrmR-WO
zrvkpYQlGuRd>A-0*vEd~!DM;g??G9=<0veR^u2XlU1am~0?DM3P!EM2X0D&Rr6<RI
zS(saOTnJQk?Au#c(zQ)9bPRr1SDh*{zI*QtNA`_DAm*{Y9kpt9yC$Fpi;6Aebn|)=
z*ahzC`M-I@DFHTlwNjpJ%v+5W0L(P&G`=-nWv?dHjN6pBGh+%W-ye$Ix_U_Nn12a%
zJ4G{&j*5PXpr&NbFeOPAd#B>c8#0m6c``%Qhenv5I2PsQ$2mYqt+4vIqxxBl?)Fl%
z!R4>FN)`XWCd(h#WY(%suT`|q!>HpR=x$kH&UF!2tIKH-UU;HDSEI~n`)iz&8$mkE
zfQpRSd2qJWxU`C>G+BaoSd~|8uH0Il&4f^fFKAwK_I={fa>ko)rul(^&X<?MG`<KE
zjG-!1`v8Yf_vS#)uS`nK%YNn>UcM;FYdV7LZe3Z+W@aj%yIcMF?CW{Rp2dXm1h}Mn
zcZ(ul&=R$cG0>P?i5%gE#2~q6K{wE>r=;l*-W91030pEXq~~vrDwh4-<Fe(NgS~`(
zM5xi&7}*Y(OfmFrQu1(;^#ClYfrQ`CnNZ(0M;dVA9GTMHh+`EXZAZZ={$c6V$1y{Q
z;u4N9UJ_fcHcO1JHO$Lhp~3%38GW_2reXdyN1kSN0@W$0GOuV^l;Reo8qOn5;a_*y
z5n_{mtHhyzN`WUE@kC?Fsq$~n5tY$G4B2Xq&r6q`!>O_w=w*#jktJX1t1RKBQ3&5V
zH9jf)PPr+>=b3iJJZ7$I=O!e4tOo_G|4^ZkTnz(*$uTO7?d7w$?7v(O?#`JP+97is
zLrezhv2t`CYzSQMm;v!!-@u$ai4g4y2(k8k*@xW++dRJuVn6L>-*11m65O%SqZYhi
zf0-!&;rwQR`p|!YL3y2rC8CE`f?0bt4QKsI{`BtGbIj&c_~SbQ{_4HTA;_xu6E7of
z#i|I4+eyWi5eRbhY|GY`kVuD5(M&HL(_n)${W*)Eeb<|<^T2YN9}>U9+evZ7>&r5*
z&yl}^OUfZD)rI~;7^G^&A>MxXp4gAfA-g7K#@6}@ijseY!mMKR>-F?xdU?@y=lp}a
zekP&?|NbC}^6h}k$+?mFyFI4+f^K=?Z`Ff$;M9Bkb~+~~@3W=gb6RlG7I-LffsGjj
z8cYPQEy}KUIm&a23_QvaWF`0-CghVUTJC!D(u(~3!X`ojnV$i+DVlKVqL$FJ`>uxn
z*4J?o8+5x8v~Gq}K!F!OBPZNe5X+c;Gc{8pr7G(bUn8u1#8xS_I~?$WL{1@LC@R|8
zd(J74!gx>hj>mu$GCXK=?;8Er4a6%BgZ4{wKVd@(+;r0L7R_LGT;zJ#<FWr9`Hr~l
z2}+W_{I`9!{Z?#?1Vioc34LUgJ0l+||3P;%CcSTooI^3*3;HyEfII~3UTW`We^eEJ
zS48lCu+xI;uR*)yP<XVaU=oVZKEe-nBR>WB6JGP6U>e#m;x?070!oG;rtl$}Ct@!3
zy1x(-U157h6Il@vH)2kRc(_@=B1vHUNuO3{5xLUWuBGA$0_G@4foEzfdR57XPbwi$
z{a{`pLI+^}&A5WF?I@qdGf2HpF0+}$a#Is0fyp3!os$Zockb`+N8mvdLDCh67JeAw
zvFzXKD(&U=$SJ0h+CnFTk@6W2iy6TEKy8dKVlro^2Op$DK3M?<xmhTzTmFcm5C9pC
z9v#c5JW7EAN(AR`Ha7Cmf&#&04lcpIdtDrM7h;MKAmba%=v*WLhH9YXfK8kNc7;ec
ze=mxV>*?v~Hwt@zxB<T;I0bZ8=m1J<0!ftU3=e%;E;fIsu$Wk1**9FV7p4pn#<0G}
z=tm3J#zXwy(8%G)f!CSAk9>~P{tq%J>Efe>(4<jOwYoepF?VheiJe$+f}@{Tq#5Tg
z9d<6YPa@F+|HJpk^Eau~qJ0#AM%4frmwRItlGwPGl*TaO-<}zlJ&m-H+EBVAs?{mg
zU^p#i`hi=zrRDn5N@H^<!)MBNVBcs>*s?g(duJ_nmHMCmM^fQ!tYZON+RS1dyIuY0
z|Ik)p1(-tzvvWRhgyBXNz%wEXqDoBUG8I~)d_l{Vg={BHYImK81|FVg$}IjkB{Z}d
zAbUPx{oi#}^=EDnk>+c6WEhF|W7b&IQMM-|>?>QyHY@XI9<X_qs39SB6(i>g^Oy)r
zdd`?-3MZ!`S20qqyjjiqA?pSQm{xj`@vV%i&#|xS6>GyLW7nSF0j}||n@T)Udc~`F
zOHM*VL2X>c@l~n9j$tKqyL!zN+@ClJc1W=vpNG;}ejGSrfR+q@w1C0odC5Ctt>rxw
z>T?I}%2f)*LWt2y^dgXN$H021P~PgGXB)WHdP4mG6GUa@jpT>d?U}zEROp?iC;8;_
z5nDjop?}fwf8rtRBH)bI&~>4P5FDt(Nril2W~8Z)yr_MRFQC&I^U~6(%2;%dy-|u&
z<Ry~O7V0c5KF@;&C?oQ+vlcVzGOs_Q786d_IJ1%^jI^pDFJnFlRz~V85-(fMx2RUt
z;!)Dl%EDO(XKPGG@S1q~2kVAlOt9K4R-MjIlh~Ge)UMk9qs5-kCSyE^OG$zIxHXcF
zsuzU|SWgZ`3(-^nf+MW=($wu~HuKsn5ltU2FX{+(0`R)6!|LBGp8Ct>Nbu^M!ilgJ
zJyUegtGgLp<KLDm%<r;vnC!=N)VSnQut7GTu)0>G(43ZS*=Bh)mtl}Ku_z+{9qLIn
zYguX3RhBW}O|C6#<0A6^!RRFKh5f1a<yCR1FNsQaT=qP}sH#*n(O=DFThh|(YqI8E
zQIyeKq@0J9*}muHZGT7@ci}F(G7-b3J*skDFo`!}kQz!CW37;gj<PNjS7#;7QtVIq
zSx)y7+m0ThktOn<4E_4``S4~uuBpB~37*kL&OCU>Q12YTDwWJ|%L0WRZNgP{rI?S&
zy{&gfSyjb_<pLvGOLorG<UHLQeI}7?Xx?OK?%CCQY{+EMT(D-t)-bDa<srmdCLX`L
zrrwB)Ye{8aOMHrASxmJWNeOK{m2GoEE-DK3hW>!G!ILR2PCz?-7TwhJBRYFnVkQ{D
zUqP!qOYf|+SW!;&wTT)DF|)1`j%C}>zC<PBAan6_lQ42ed@$e=)L!l++!7j98+@lf
zu3NWtX7JiJY;gPfm6k}x>l>&r!c+hT`l2V5rC~RhP)D2onOvM^f4|-0;vDt3R>!+w
zw-rD%|6DawYzc=9QEjlS1fV{zhmdZlC&rv=)mBW?`aY%r9RF1fWhV0VtMdyS5A$4W
zb|`w~knFte9$TZhjBJ&O4R>)6ONoLkzD#diKUvUfT-Dfly0x@V0@1t0#2)6#>GElL
zW7c}Z$lSH6AvP@!18XqZ^i-X=DcE|tAeFHgtEvz&?5f<)6OEM8XAtBYizxp4mp@jT
z9Yk9)&Qf%uVpOur@;f!4su*dqKbww{Aii|Pg(h5O+Kyyc9%pcUdHfYNRd$BnO8n2Z
z+sjc3A6E_saZZR@15e+QO;gM4*_B5G>|%ZsmFJ3*F}7t>h5oQIMbkfhM$ILy1Pjm3
zK~sgj2wJ{%y$EA-cFzqnch@OH${#8`QeRC4@?RB2Q)!u=SUk%aMYiOI_ag1_EX}{r
zN68r}a2I_ix368}?oceV*3EWBMK-``(R%00I6b!dP0K4(q^s1FgD6d#C2|@ToC~TR
zj>;e~zABVuQ(jqd-r12LeDGtX>lj+4t9uLlv~bH@(69otgRr#dXZz%Jv(aA0Pnm~C
zkaJ4@WI$+6FjTK5DX49&Aak!Oc8CV&Kxcr;Z_32TJ=1N8_%bZ;82<2j0{pLSR>8``
zHF@gU>B*v;<Xu_xPJHxVD?899I+*&ug!cR~_EM~3-5Er^e!LkP_@Adoy{!0xOhEA5
zCMgI_p0HP6t65ngV}fklz8FkE=YhE-7;<QMM0ai^M55&IjRKT02eR^G^cOT-{V|9G
z)?iw!N2<>G6jAv=dw&#BYAn%&7U+loJOY1g05G*U`}R19&qzbD2r;na2tT{8SCkU7
z7#CVT95}ggGo!Gvp!S3aOhg`sj*+4W%T6!z=P94S_+p7Vbr__G3v!=479^xsDh@Ca
zEh-%!rvyQZw(6=eN;=#tIy$z(dwJ9Fl7Z{Q<;>s^|LiEJtnIJ%tmj|=O}v_ec)-}X
z6>Td9bwM&hOWOSfiIh6mbe|j<I{TKoDjC|R8QK?@)vmYm7%i2YM{g$OEre*EymV)y
zP%&*Np(Z;`<ObuyioXwPr0{zr2t6k5cfLAJKA6II?3ZuWiQ6rMa`3TC<6(llT6@8!
z5WSL#(#t6^hCu|TNDc`Bvm_#saP>XCOfKo$Jbvq3cS4ZbhzLb=P~u)Aj~XCKU@Cdy
zVm>3aY6*#vL*BrEu?&K3EcUqGX4MQoUvlyjQ?kDM++uWL_Eo*zI_X$!hR|s#M7P6U
z5Y+og2!+#IQhKj&Q4-@?__W*=LVAdHC0xK40Pb2N5{8qeQ=djSWH7SM`K(}n-y!`c
zGt0Y6rNbQf4ul?VIMy4R>*h)K;fQ-59zzUE;2Z1#x*DeK#NIVL0?*c7A#H-fX;$dx
z2Ftnx(3pKY@?(Ksgl)25G)K4D2ufmo7leC^)i;-~>&w@(gwyIYQlI-?e&po&xFEZM
zd$$kB!sIa7B6vF#xgNV(WFz`B3r5nf?V_(2fts?O2zsgf%K#&*q69BohhOX5kpF_F
zzMz&W7aGGPj+ntbjtchspLp@wIic>W>qlYyOg<h61Qakf@^Q>X2CC_>=6oT#_OE+f
zKl&6yp(o^Dw&w(#@j0?D;r~G`hAY9`rmqs(i1*~T9|*+R!Tu7v%|{~rOqMZ89lh4|
ze$miUIzhPsAU&b3-1ZAje`Ob?Aj-VmH*UY!$0xtNC>^|S<>f$*9F-Qo?+{PeLffI!
z?WEx{eRvGoB&7A_6w!Z*Y-Y)2(oEl2FYQiHa0r-c->Q(=OWSmV)8G`R%;S1zSG^U*
z_z2GdP0{Rx%lJYe16?1Douo7k9s?!$gi(=22>CQV(R(bO((*tu6Q^c<>sbK7Mo&Jh
zKQ^PAo`889F~_9o6)->8BDQCWhW>>L!rEqVlBn8MG=M~ajYrY0Pkpn2{;T&u#DW>k
z2fF2R*5Mz{-|e?`<7O_Jg4b^G7dD1qBh?Pui!>1rPu{_k;m=X-k<rs}+rI<wXCWtb
z918W`h%Ex{fIWIVd0MJJP9JJWTY^yzN$!7RtZ>8-KH+peSQEd{!3VNtcWD3wxl}NT
zFLAA3E2jEm=;yzRfK-*OtMDeX=$C<@C|pl0vQY+Mzz-+tb@}UzkP1~4u_s_{)1QPJ
zegThfG7t+1{unFb6`3bSNxK^f18|lc{o)}{qJ(~dNs!bm_}?LQ!T$-E0dgR_LY0d7
zt>}p<jQnQ6g9cU~K2<EW4eU;vN9Vr)U#?U(`D#lE|D0NqP?!2ocS|NI;)A$#Hz6=J
z;p^5Z32QB5eVVM&$Ij1cYwoq5nOWH0&j^tve_=atUPToVLtf?Y^l=Tso`CBpSPj8P
z%>lXtmb+X)^~ZvbcaE>hZpr!9SEkfIZY|ESZ*b7|)&~J(rZ54@{?#f-&U=TE-HiG|
zT}})e6wv3McYBE)S&-hv!+S5sC)BFfzmDadajyN`LZy%NLrmWwCnrd3ceA@6S2q(7
zjSqFF$)w29s(Ug4JE|jMk@=%;ZxXl!z8Io*igii*>{&T>?1`2u!#%FH3h|=*j5ifm
z4?3S9o{x_mC+7Xumd{p6>%><t6|!ttI@#OOre1KBY$42s?d$0hD`t+-rs!|WlAZ6`
zXTEFojYr-+2GcXPkE5~$(lYW|`sP6$T7!zB+TrYNbq`)9y3{VaYmK@$q05z^VjrtV
zf<3OQ21ZD498dkq3=OqAelKK033gXUldF1F(CLaSi(v&blCVjA{IkdIl8RL$;9#de
z1L=7wnLo$xIJ_-o8+blaS%;A*f{>69a};KzL}{r_xQBP&GD<d2(YMd9Q7y-N_|v_i
zv5ZRd5MK*64<5Bhe$P*zZ}DUj8YxBJ+=q8s)Cj;6cB^sa_(?I)g9X|`N5(>crZjU4
z&$efLe1kD|X?OIep+%JMo@g5nNxRCkdslwSd1>W&U9B|kyh{XQO3sf9q&=;(cn-Y-
zTQjrGPGHq;Y^?2Zc|^8epYBp-$>$Ph9s6*7i{<(0>E3R+@r4ZS!)`WnuB%bhyol}J
zOqm<^-U+NBQ`g3h;slIqc|zmlQpAwl1Cdkf`dXLv-_4{sZA#5HML*{C9noDkivJQw
z8pAXjZVfmhTen@W*b$p-L)!tB{Atik+$XT{;}p5Db4pXJKQTf#`KeH1^{iN}MkKg#
zw}4S^7{j5y7^|$IvC|J6$CAt;8^XhBj|!lk`2?1|fYF#sF+Se6zJ%4KWh*L^*b3ly
zj)R~fwMJH@W;o5}C{iz<wiru{L9Gq1@CXWPYs3ul-i^=<?KD=0;?E}6nrqQr6SbQS
z?Z$ILwZY1$;OyVpm-Hu5Bvnjj{!GjGak-t5ZTqOQqc;hEtj8NR$VE^-8|skc%BhzP
zNw<XcJ+kQ~m@w;Ka9c>8mv9<GRggj!!W4matVs7*={HQYJwdKNt9N9ki2rD83OlxH
zYx07-qofO_30h$yOV!nyFrp&^k{Ow;M%WBF!s~g`ojY6k1>_cqxI^sJaO*J+6qyc!
zL9R}-b5n0=U;syv+rMpjZHz~d32$g%j9B(;kmA%RMeAK0sHIP@o*xU$+{Ym6dmcrN
zTC1@-g8BtlHTb3?vMIQ&%frcd#I4o<&i-n9()}CNCR_2u9%;;biCuNZzZ;fjy0_Gm
zUB)NbZpQOPj*`RE>E8oSHJFLBOI3ZS&x|X*c&SH^Q5IMH&$##iOI+-EPDcsDMtrMH
zw}#nIcwL-80o{11oI89Kz}Su@uDSL2RtDNu)?I(W^EtdR-#1ok<a4Zj#2o^iJe5>T
z!%k=rC&er3g`I{bJDY{AcBw8WkmUMlZoMqmc1kRgUhLu3V#!Nms=1OpN)&xBs2;-|
zXg!~1il=o-1Z}GYQ#2Q+km}FT?2YsF#}#QRPA7(%^jlNQs*cCPty+d03Ts)#ug2kK
zWcWn(byWj`WJ=l<Vb>dFf@vomYD~_+xYJDxlFZ7kxX9voTZMkP`~4%h(_YbVVE9*1
zVE&#rlj-2+A4xbuLq?iChcG6nd`|RG1aQiuoPp<`i2W<t*At6_k4q@-00;fl9gxi*
z)G=p&%PUDQLFHg6$8ljdL4e3KEYzZpaGFlwW>^=BNdfa2327YarUy&e$LGOaM>6#X
zrBaw^8(el4M<b5stEv3exHZhVm|@i<m0`LUOG)P9&mOc`f=UDyRRU>yy{bzK7jBho
zNcsHknbZHL<JA7pVp`A)3V|}&EQ!nNPeh9?0sgE$@6nVeQfBB(avyO9_qveyxF>%m
z$;l)@G5^|VYk_ry1M)a}gY(a%p2{}PC3q6C+r3l(RjePg_fr3U#YN%V2OxkC#K5<2
zW*ag$aq@ZA>Ev3%Pgc0gLRs(|tob)~wiuMf;&65M4%((PC~W108PpXL*GE@3if5^d
z+E;@W$FC_xSj12BT?bmrJGt?p0MjNHXx7rlwE>uG8*{X2pKi3MYQV3#x;CR#j|vE}
zMY!#Ks6K_px^$B$7{eT!oosct$)>vQBmVQ28Y>7lqoG|jjS~M!Pz*L<mNlMmeQtXg
zOJSx9zL(u`IBySbgyytgr++rCxGl;-?Jb*(a6{L9LS!4Gd@ufNa3M6qq2B=yrUoM#
z+nOWJHXvFU$eq+tO;$oIk~whOY`}Db@DIc$lcbEUfdo2~HqH%{m~p_U*U_!e(>%4t
zX7@`VG~mI&^nDgt2`3lI%$_e{4wD-Bx#e)HoLQF(>9nP=_OC#6WB^<}9bsKPGbEah
zSFxH%epLC(^c5x&`0{ibbG8JPb%*EGO&^(w9D~c^M!P89C-!L(Dye<j^Frdo$EFs)
z02pOJosmJ=3Rzn)Yky76Bnl|9MOpgks5DbL5VsSiM2_1<FHad_xWpJiORjWk3ez)F
zWPq95?>rD5Q%5wq8!|aRGH9_|Kh1`CsqDQmA)j<<V3yk!P&`6AA*5^#S~`Usxciyv
z>sj;HQ;A0ZFGdf4y3gGr4AKMeJE5_A{Ap6ewy-@E7@K9jcK^gkR}@bI{;3sE6U}r|
zbE;%z$y!m0UN&Zxihs#Qsp)whCJ{eI0ZMCd%F9Tx(Fyz()A4B~@Ju$xSd-m(IEjAd
zd4AEHd`70-7q#j@{P6o9N-kvD*xUnWo4}r-Ah!ND_=M*jGK&GpLw_DSl$+>6xPK>f
z{Sr!qRg_h>5~^$Zh+|jDaD0D#n~EcHxl91spww>@%*Eu~<4W-uKu)R!r)&;|oWK{1
zWnJtPDdYqm@f#U|5E$%s9f@rzqO|TWQ@AW5DlK6X>PNy(V;8G?!7g?+D+cCF10J5%
z!wU^H_6n|We7QIpdqL{A4@3#2pbYO@#HnjaB$JE$8^n>IVI;27Cayn{zH87QuepW!
za)UB1H-}Di_0(@(^0@fhmj^rJr^@#^@OQvCUYwJ@m0pou^!y?A5xsUs)asd~4xx1e
zsJ|2)2G=C?vYb6;>ztNODPaOL<FAL6JAWA}5teixfV<IEno5^Jdf8IV+rVAksncFt
z!Wv0n<s}1*u4WSXTOj1(KGIfRz{;LoL8!sEaiGj<9t*5o$y*OCT*zPfWSQQ4_6sU5
z#}#z$F=ASZO>vX|@L=oN>DE6LbO<~Jqq@<^x>?IO<H@;Zx}RSac*_F%`N+B9^x2Xa
zS$Te2rVG@NX3#b9oKY>*E0^(FylaVk-tDFj=6W4V{te<)k;>Xt7*`^h&@wTYth2K6
zjE>~ptaTb@!<8YIp>Zw`uOJ9eG0fg{18B6~4`w?G(+AC-+fIm>lFBZwGwk-NP-9zk
z9#^`0+T^G$r-F)a+xgeO`)f!mqz0i5GS?QD`yC0RS}|`D&?Tq{Y0JWmzXNI={wCQc
zooi#y8?ahW&?}5(QnbBcisu9FQk{W!*HR6!wTUjJYc8Xz|E@lA<`C{F`+Cf_`!hdF
zCl_A({(&RsxDXZiGX&+C{2lLm55vUvv4ij|S!f&-ukdlfEupB=|FWAuJXtrbq@V4b
zJ(rKpAZLK|(tm?Vu~vdDtb<aFVPKn0IrpOZ^b8xg|2`20@)me<d^9Jw3cu>t-F@<@
z&Uu+w<o=X(Oiqak$}uYD(04rH8{*5uEPwkaa{pwlghqfw_yXIJTrX-&`LtQ@d2h$@
z+M7K({-<qzZwpGRJ?KA5vb)&<iAi6u3+x6pd;YE9K1aX{`3wnYFueqDKU{Gi#d7TL
zBe04&&d@Cau^H@KqaTt3IJ^oV4YH-$1*ycCK{SEPh5x!O3_?7ca3cV!$H!OuBTg_x
zTylzblfk@F`kf&r7LpwO>>=S7Z?xbMVZ96ZeK4Rlv5f^W#^fh*K<OgYqDB(&cbG_=
zMHCiJ((KUcGdq?yuR(Ju&1%W9%b+s@2-TTck=MBxYcIx{`ctjSn%wcPsGq8$znn}e
ziP|cx!z;Hqs#}@)QECO+sNLgfM%9VxB3Z>0YA(yDlJD>V7RM(wMZZ$>JMZpZCr#Na
z(;-9q15VjyoYzH{><q78N5!7r2OwDgoHK}Q?XFD`^#JwqNZiCh>8>eO-nM4l47nGm
zO%Nvl!2v%Lt;9)#+a6KJBdwHA=X}FzLpqu2?;hD->Ya2UU{mq&PH#mue6Z;Qcdyac
ziHQA>zgC()K;VmMO*)6{ltKQa=)4cZDK17i{eAaG&2%rUoovuq{VVVRM(Ec)6P$tu
zg9R?3W2=<~G_B5w?`~)d?e1tA-Qa&g5siSI{>XTQi|+hB5UOA(2hmXW26-8-{@{2H
z1hx%m&IA28@LJ<Xg71zVX%>PEkX2;Df}bIu8Uh;5hJilD-3?^?gTJ@S?J^lqPjR!k
zes}%xu8WMO#<v3p<Ey_zn7~;-@y@69z<@ImGx0dQLpweE9Wa+lDnSZMgb8PQG@Vk&
zl(sRtk1R*zp5E^Qb2q(xAg%j^>Ix5CpzH>zQoMPbx%sg0ms{=$Q;W4@;=v);_fE(u
z)x8HuH|3=O=1oY8_juxyL6!p~1lha&<dHfM6eZL_FKIScis{m~{xJI2%|Klha}3^=
zJx0+uxGTMsD<4_GFXWvC_-)h9t;-R&@$<NK^UaYmSm~S&J~v~Pt}Nb=B!N#9;j6_7
z%9R~RD`V*m8Jj4?$tuOeE{yrMbBC>UtD(sY;*gus6VY5Vt%u?nzpaEFTO%#Zihq!S
zD2sO!v%a48F0<$GV0GhnRC_Q-sD3&rDaR=E;VI0rWK$D~y5O@xT^KPDX-7VKM7|X_
zcoiJ#J|yfN6g5Vl`!N$y2GCi3sX9Iu%B8~SqkWj}p9XRK;kVRJ6Zu`a1*G$bJ*39t
zs22pXC|*_uho64cJJk{$g`5Nfb&aL06Wh^5?Q}fcMfcd>Z8X~M3TVnBQp#tc5k3m9
z&q|lauJ`$KAMcW{7i3z>I9+s7$IbHrb06n*PVUw;6gj9AmIomo0`9<lDv5N_DhgiG
z)J22K#<yd6W!16h6y=G-WnH3A-T(mvV+D*UHNe}iN}8hF=3k_~G6o9q#IBP&2qGsa
zqo81n2^;V#2zo=+#@Qw}QymAGwQ|hRI13H=${Me}Uvjtn0zNkuw;oEgsD*&#RE_x+
zr-EFGKs9>L7wSt8sO6s@v0^r4r=o>ss<u?JT`ATBrjofUkYCPMm^ZlXgZzH!18!Q&
z=b&?@O=qR;Lv<puo2_$HvZm&jbgl%jR)!_8$<geEE;bsdY523(3b((lM=(FcMdhDk
zI*d*o=Zqyhm+TEJJQ7H;f*!&$Lo4<!P;;)!ct_mbp;5<}t?JmrE;Rk4v90wo83#|9
zYW1+9()@@kQBK=3Y|;7}xDH-RK7*6mf`N%*=V=tMBV1%Fsy2fL=UPO9p+ZI};P^{~
zNYrZTJS6DVb>a;#c`aD?q3D(vVIt}3;PVI*%d;;|CqLk}D<I<-HFyA{R8dO5?NZy*
z6adnc7xK6^qHAgB)2Jjf_2ShS0<l6+a9vENBb8O4OmCCY=fSSA5akk>(+%4s)VY57
z?`4hi9EjV>nfvGZ%+F1YSsU!P=IaX?moXteTxGU%fjlHca<-cBfN4xtM<HzpfYE5F
zGTuOG$Fk5WUY(7UJsCImwoC+DQ1FMLD_tTi&*@#bLTZMY?>+MNEhvAdwZ05hCaBNq
z$e%68g4xsopQFkH@@n6l*d3*XOaN_UcBaIpe<S1b3~C72C?v+lQ?aPT9C|tysl+vq
zGM>Sm>LDG1GMl6O##X$Eb)gRxomU=?7WqfR=TT_RQ?(Lx!5f>4CH2sgNB{d9+LN?Y
z-NHkZ>PnXasNtuAzJ3mECbc6I^~*v{(6&^a@a{*y#_wfC)OyR%r%KR9dgW!i=N#ws
zHJAo(>Y2+u(@D3IN(z)FtcB*unXX@V3u2<n(B~S=4VIS{m45T}K1<wf=LK3SSQ4Q2
zz!mRc3krrV^Od-<-Cala=nW(8u6~XN{BcxZM`Qz&n}qzewlyc65CTi*GZZ|sFeD5}
z+csGvY;AYN64I@{Sjb~J&SBn;xR-`x&(5x{*gxu_pX91+<b$d|S`&Q6oqSdOD$o#X
z1|p3o{9IHely(i`m~jy<Vx3DiGB`U~bwml!B&xm>4kK3jfxZp@@Bvzbi{<4auD$XV
zY1n)epv;!O>vc33UU~W#yz~=crxD|_zn}h2w5q=F5O%cyLaVJ1eSnIa*qrOE2a&Fe
zJXOJ}nM__KdcXdJ@ClySbWY@w6^)({+T1ful(*}=e^^r!8;d;GWM5;oC%2JD(H1H3
zX=vnf7upMMO(mvD&xcpE$e91+O0SiVsb)OqGcuT!?BX`nhMnZ1t@%WL@PXdEs!RoD
zb~NtbJVRWV=s$AIs>{nct54%$J5r^$R%Ze!NJHg07%S#{Lz!mfi<Mx18If9+`6iiZ
zYoy3^7w{~b?jjrCC6(s+>+K95UqI@V;^uciZdzcU@5@de0OAODgnPVaQyrYE=<M$C
zG_fqg=jXJqT4oc3K8}6<P_`=Q<gr-fG<T}P-Fdckrh=cC45B9#MkJx$Yz1#g$H<_d
z4ewb;BbA+JUS-m}sMvrrKJRkK#krg7WI)c$#;Y%Zc9UhSLB+T?HnP+<Ao@(&4Rz~;
z=Cgl8fPF3iirA=%phXJ--OZqk{kGm3PD^+wOJFr#=}Jc!qwN8hzs$eSrdX=K&t8e7
z;JOY|`TY>o@{txwr^0Ik>DsQWI<u6FO0qupuaJACAUuLKVsu5(8QzlVRx695Y!Ona
z>ur7%nmY*<%wY0M3fl6|tM%YkBdk3!wmZ2M4cU(DikZU%xBmVqB(}mt!4Q{w!TnP9
z_i0BXx9w$=`5xj3HeCU9k`rtOcv3By0z9&eYRy4QvH*;lib_EO`_($z?uKj_4$h22
zH)-^|k`qur&kDVO;2(b%hXI4Wi-S<I;pPP5>}VYO@c@Fh(}Pgi=zp*O`K+Xp;rZhb
zTBh3|gc-<@(=EXe=@UtixyTH%YRfn{p9_c@RHm`G3t(w`Mq$vEG4?mn;Cj{-=uN8N
zSe;e{7>^SLQvwziGwFhVvTRr7(Hk0ba;>zwtWvzqWuG!5U@cQF&8msIRew)KDCs!G
z-y0BJk{pwXwI*cZ2OMmm4YtqyIlfA%7KTV}xG6!-;I4hW4V^r1ApBndyFf(0gge#N
zsLZH_P06ycrr0ueTuZ{9ZEF@&9cGX&H0VwRiaTf0+sZLDLd+Ir6w$~otZ{W&?>cc}
zF^P8KM3aNui4#x95I2m;?OmJU(kKd2f4l|s)vTrB(Mgb#W!3fKXoMUFKs&V1yg1Ay
zlY~JID!4h}@)nn8bj{+}r<5g~NwPCZ*3o(gMB4$;Zb}o6K(=xfn<$E5VZ#L1Mq9Tq
zv5ATe+fXe{GIiT(4t^+px=^aEAna`mUa!tl^I(iD(|Nl)NoX-ab&^n%W7kPSOV*>4
zgw}n+iuLT^(v~hy2bb2trOgpV2c&Rs+`nZLNg=L@ZBqt^L{q_zr&DZbrewRCY3uC+
zn;xG-qP2!YqG`y?)To9P(`HyRbPqd3GqKJXb2ZnKbgFa?iTCf2coroo&Lt-Fw-;yV
zBO6869lZSA85Us+@*S8LgoPCQktLHL71Hkc#C2Jc<VbzhVn7w5PzKTgJGwTcUp1Mq
zAPZ1A-=ev;JGpf6UUzb7lM~U&rB6pL?eP7&?1=S0ol&YYN^MLNkH9G9NQPk;j*AWE
zN?5a*iHWKz*fg19T2xULsdb!OhXuYDd^rcH+X+`*X}ROa7w>V$k2kr8I)41=@Z%i>
zUKfM2@TX(RJC=N7ns@{(x#2m)m1GA?uBKqkpf0vtVqwE#ilyteN;JJ=$seSu9N^w|
z!jYE^cMSRB9qt(NCg-4I$e#{F-eJjg4Ee&Jjv?<D@{MWY5isPYLlu*#4tAKVLcUB1
z+qR)$$+JwwvlPQ=&yeqf>sG!(!0HyE3~M-GX;hI^)n-^%WF2dadf2w9flbA7i7Q(w
zm7BY^HJ?F?7c|cv+UogUH*siHCix{wnG;1<Ki{JRmY=c_Tx6fS6s?=Xpr=(B^q7sK
z7%<SCTQq^7ScnN)Sb~SkCV=|wksx7c93_70Uo!}$6`zD`NcbnTKsbvp!k0lbp)bbc
z8dQjn%#C7tiVnvlPT1GKCsBC#k=*c-uSiPz{bNxCNNB3&`NSFd36SY|N>YZFwlPz9
zQ2zZ=91&>#G>wup_QT;}qn0W)r=T9hctKoNY`&heGBjVt%81~%GzIhqUc7#6r{JdM
z2iuanXE(JIyO$lRPV8=SO?P7Vev91|sX2_oE{{_Oc2M`z$;_S1yazIKyD*&XOU#-r
zc|;|cDVB*f&sDJ_DLS@HQ*mrY9Yc~k6V^Rsaq7gEl(mvJ0PCm}DYh>^K>L}|u(RAP
zChSgxXmb2J5n{=DbRtBDn6UKpbchKZV!|9zJYB?ut%wlH`XU7J6h)yf_Nb|0O=2##
zh+|??lbLMVu4Fn7GJ#XRLOBz-hP};_b(txef@N2gu%_!0Cd_uRrFyb%Gnr_53wv9$
zf{m7=*+PI_jrzc5li)W$@f|<#)7$2{x!#z>WW-Vy|B@Rp<0!M2{N}TprYqWWqtTee
zej;QqKY9K8gan_W#`UjBFyZ}w@`HxxrwvyqoSPWJi1&i78_zJK7TuLRNtRSB5n0BX
zqbS&RRTWG5k1VMT#@=M)jW)2b#Wp6Ec1GA9*qvbF-+hPPgJt_gni7s{%Vn+SPW&TC
zTk!Ab=+h<Rmb(OvplC|sA<HB)Um*PnOCCx&IADT^8%IfkNRWSoU^)pp90{a?0UASa
zlphWUT%JtEWYkA~h|)`j5*CP@$zvA#5j{pPqtInx8WZ?XbPlMyk%tKK*bVYS>R<bG
zLV^VO2_gU>7==TW_`{F{P!0fk9R>{`myE{5ABM^C(GkoN{v92GggY9skV3*?PD;;?
zj?h``N3oy!34?(p`675xj1uNfVn4k_1m+X6BtdCR{E$y6^@o=!i_y3w%yAU>t`AE9
zwb?f^8V9^pbe_h(o1$^d5|;MGdbmLZhSE_K`e_8#LWH60EdrE>+h`J_OMiIDk`%{&
za)rh$8VBrn7iWuoV=lTTW8{!9WO1uAC3{R$WzWH`Ya3W&mW&<Q(6CBmqFRc|9Om4|
znNoLkrZ&@2EznCPlh`9JXr*>}3dIQo+N?Q(1C&JQoVg#y335q@##85FnieaE@fe-^
zBR?Q9N+U!717+%>Ipb7&(c_o(acySw2Kf~hWKpQXl+I|Q;7?fZ&j&)^B#I^nUr?c;
z8sueiWR>h2->Wu^E=f`%yIl0jY9jO#Ev?4OR4Z}s^c9svCiJq-=Yw}7NzplDAs_z~
z+-W~A<=mpr2XL<+d^xSfP8BPZMq?yPqV&wthyvp{`a5&eqOrkz!9l)c1F;ALKCQv@
zKpUTk#Q#V00}JIZqnj5Y32sy0P1?z7z0@Bu?hNrQeG^Bcvz&brtjmafB;k;?JIlFC
z5~0^5bQ%3KY->1d&N>N|^gjsDJv7wHv8gwVeR|H)*5;<3=LczfS+`Uqwe+KE=Qrj?
z!DJM^C#lN?u#DVVdV5uMUg|nk*S3{cE#wYx#w|s^OaOh!SAmP6*%pg@zWVrED|xS-
z1iYbgtTzdLs3x0jC%u9Hc`r$C1+*Gvu0JBd8p8ILlwPew>lTIEY~n_TjbG{AQR|M{
z0&?k&+SZO5uua`b>rPsC(sq5)rX-l|$aP2V=^nYJMH`xZ{@A8DWZLcqR>d_nnJt89
zvFGh&=-!CLLmq(Klcn*u#uEFOP@0Q!P;ZOtCseWu^{6d7GIlJgVvU#zCdAV)Q6(Z<
zmf<jJK2|fwt2|r?r7?J(K}tRZS|5ZFk02Ae)PMUqCgCI?pxysN*grlpuAL9lY1hC(
z_E!;yRD8n2oRY#JF5yaj!V>`s6>asqavZse5)}TRSfwN-pn{zq6Y|59#n&V_I@*QC
z9~58+BUx*u>!;LlC}AFUR4_y<#KM*$yV&$xYBHv)PNS5_Ph8i(zz20Xp$#^nE=v4>
zCo>LMiiR->(djg`{g8h-@<ULAqEnPciAw?!A6E4BsOs)H^23T2x?eUyzBO)QN|9YQ
zk+{V3qJW}P6oWz*6@{{doPKzijdZ~0(+A@N|5S9If10Fh%zrJKc1Xhhm2U&+(Nh-t
zpnGN2A#N{O*}A!=t0s=R<(W7$qhA>pi5dn*4(fvj#b$0fq_LdPKgbyN1)ZX$ctiKO
zC7T0}@-(r_@&(itD8Y>QVoky<5caS*BL5xzJ@P|z<%je%U|t$cz$krK(s{E4=5vnR
zrJW2`qdb78{G3&mi=VVUio!~v(u!0mST;)nmbmPYe=tB&e^BEfo(-+Y!Y9mOYs`Dr
zzIJ%PH|3zePjk-P;RW{s?g@#otZjAP8MW>G%x7$^TbVl?q`jYb)$qHu6Q0HdNAYk!
z&v-Vt%};sV+&@gxy}jP@v28x{1^y8GH|31rZ~XK!JD`nc4IIy+Cw4Y0X>TW96YJD)
z`Z<5JzcVY)7dfx8g<V|-+9Kzv0Ni4a*J>Uyqu<t7M(TWJgj62*A#*QDoHqA#hSF;}
z%zS(C%};ViAx;9#mBYP+#Xd{k5r+kp&UfZNBf86-!s|HdmNt+8Mh<Ol)C!Lm5lIdi
z3w!(E{7|=2^Dou9tF>`U#frs@z9R9}9<JFU*<~ARwoXIUCHpA`FYSl1XzMw-)h^q5
zO;s0e50|W7W?26o+o+xCo9yA7%r!htYAI}ub}CCoZufAtY6Y`(*J`t7=BaB>DQt-t
zupyQG?Zp|U>n@u}uJSO}Y(^+tciEtF+1h4Q7r>+W6ZkDZpw$z?)Vfm!FYUJU@|Ybd
z@~CC`iTY4DuERW{S=iHc6>EwuVd8ooRt#HqiD%gsBahXG;wM5O&e8LH7ae}zM|ehb
zT<J=|jooqSPvJ~82(g;1!b)V3Y<(nxkRkjt$}HbgA#cf`RO!$q9uuWC{CKy{6M8G>
z2~{!;*>PR$$VA7Q&J=9962Xe1T9)THo@}_C^F#~hi7ippyz@jd?>w<#<YK9c<j)tc
zF{6|$qW$upp9q~V=X-|>^!;3`Iity(Iv>-BTt5-|^^;h<uV*ZV&}%YeU-N?w_I?^o
zoPZs2#E--2(VUcD&rGO~j*u)#1Eln`4r>&rpAX=Q$+}11^PtA%1KOE_lnjS4hnnWM
zUl)Tor&rxarbK(9Oo=X8l4=kOQ`@kyrnw4s6slm?P^b+*vfaqBb5)TQ4C|^fud&g^
z7IVe|Ve}dtc`KM7nLTA?JFU08^=8j)^XeK9vHVjM(<0n<!}S%^zzjwiV-BV+WmuD`
zge}W8v28NXG*wMfo#n`)%llcea*gvywBbcJ%onk4j)*pSA@++~f6ix!IMttC^lsqD
zJ(DHr`yY_Q2@bna5Rh@gp5?#f-#i28?jK4}FDMzs&%To+RW*zsE_xgr=6NbGVxFh8
z=mq#+OagxxJ_Bp+bc4u?!W6?Z{7jL?-?G1N7^oDUIZ;4=5dGX-`YHP%8}RoRy&qq~
z_?#%_Z*leLgFE0P=7<i@Pf{v|bCQqigs(t>WAokzJdDVLEG`~Ey~G^v;sfv%45@~m
z<FzEHEc%I&k#OI3tAiMzFiKGr2DgG$JVu-mO+qqGE~6B|u}-qe8TJN*d|U%!Ob)V<
z!P~3?q4~%FA44#mjQTD|!8tk-ZT|}yjekH>>vMDj5e~c;e>7%s5{222M+7ivqDg{&
z{rD~!Ai(RmMG0RDF-OnmpfmzL#1F*;c84n?mUJCx8I_tAF$lrBOf^V0<X~H+GFA-g
zd6wZ(!?>3?h6mto{%1xg@NjcPelktsRrI0}1CSztd<29DyEoxEScLd;I}no9n8mn|
zwUaT4ub`&{;A5cLbo)6b4G+ff0kbRd;l_fqf`$PgW*no;dsmPrkS&Km;sQ@5=~F*R
z{m{*4F%lJyoB6b}8E@&VJ0Z!HUdS$COWmp$`l|3Ty{#U@+~RW4tN6uF{Q7bH8V7Gf
zFDgq;+}VNr8V4@}-@Td{$X}!QDu@WJ3?uW8sSME%(cwjpSN|!90F>vVH<<q5r`t~~
zBw>06_*J(Ty^627H*#mj^2QI?`}~s0yl-Iq3r1BCU^cw|j3e`?-mQrWv6xpXoV&rP
ztqxI|(?mf;=Pq0|FiZ4-d%nv9^oi47B_x4&J0e#M3-vNOulNU1<`M4ajihNepdy~2
z;t+J+&)l7Olk5BBEt#5VqnKeiGiA}tRt;mjGl!G2=G3N+O&PsanWI`WN73Pyw{PNa
zOo{yNI=|%Vru=0sXQI{Z7VmYtGlBb~^>!3T8u6PULFHwU4PUPrzUXSZ!-p$pO=^O>
zspbMOYDO-4*~Q4Wd<B#nQ<-BqH*?|K?&=Q6RGd+qf(jBwMG|*f_m|BlbD7LW+yR8G
z3lPRJR+~eft)m0u71Ka~rL|4`I19eeP<gXCfPZr%bPpugtxS%S^!ih4m4<U8Sh6fz
zc2m{(0wlBDcm!;OIkqO^*!p;58>2*Q2P0w^pbsrhP{IJcn#8wTIYzCXgt=p+?Ba@;
zQ`@$vD$GzlGD)M}19bnWYHnIQH;>NZqROUD7}K$CPz7r)fNIFDicQ^NhNUvY^PI<I
zahXxV3e9V0bg2-8?MSvFd)RZChc(;NutjwROVp*Zr>c^sFDHo3=#mp)XLPxLqs!|N
zgNt{VBcnAlvOFIb!zw$Ljqx{_z+XW}Jc?q5k_e#3)6AMdD5$py7dJsg8FG7vutKnW
z7+%bNpRh0uZh4t;%&tkm{~jPeJxGuXkmN22IN%3E-1?P9==X{5UIn+vrwp8AMD3Un
zH|1_W9M?bV?D+Y~xR}Z3rBiwC{P_R<AOHLR`hWlL|M?=f>zu_A*iW7bub*7K9gvVF
zE*Z1uC(e)1{+GkcG#w|;PEPV10>`6V5qj)KqZ3h)<S^Fii6>hI(;Nva7KMw&CfJr_
zhFwE54a+g8MBNi`RRTlNe-Yr#$!SW4$@hw`zT$y0emLxJHmettGy-KWMb0Dvtv>7x
zOmxc1ROD9xXqp5;5|SWb0U~@4MWT1Hf8;iff&fuJGi{(?60>CeRZ^LwtEy>X%T_4X
z3|q%UvrVk%R3f@2TQXy<mf%wq1?BY5Q$~W9>km((mTJ1Pf@SJxShHOVTbf~DMYd(z
zqMGE`POIU4IDh-gr*eG1{_;|mb@}Ay%P2{2VxQ-q$acQmlrnq9&wTHQ%T+rYEW0BU
zlj+RFnxm;$Gj$7FmZW3Plr<u&vTVp?L&|#{y7BE8C@(Ya%+3cqN&ze>NlD61JU=9%
z>w^V~xoH${FgZh)sbSazYo;Ots+EHs$2PDo+051)-SMd1FRs2UXUcPeE@S4MUi9+r
zhS5w%-c8_#S111k{@<skimIr#tX}l8`J7(#zB&O3uP%CZOQyj!p7FQOfVoBDW?yKq
zN7XBS`gO=$0b)Y^N%Bk=n;~ZNBcus}>=E4kP+azef457|S?SKi327Z!LfXC{A-Sd{
zGfT(B14@&Lfo<0_v7<VUO(dJ@RC-K;#4Kac$q*$iXr5(R234_TDFkb-tYPAq9ww^k
zP*qZxsw~gv*2xe#?R7H5{mT%giwU?_ox`h}ImM%&Ny=`>EjnW{*Vct@LpQFaY{akJ
zL4Py}QXlebU9*rvx-Ef<n5XO-#}S=?n-}CViad`ykpLG89#*-P`565<x?$G<uL$|J
zAXFe`mn=-c>xG3Brx6C*8X1q{h`5*k`S1Ucj7bOyz_@Gz!Ui~96)g_XSm;a!$Pces
zlKR58e1Kw>jH57N0?3hLhvvD&{`24e19F$a;1EHR(D!_hmmosH^Pt^p7_-MhF2oRk
zSWMkZmH=QJ`{pu6Mcya|PHx1#g;0pZ4<bhEcO!{{iI{!^QOGJ-w|9)hA(!mtd99n9
zn;Gthg?N$_JlKg7M8gwBQj8PHIFa>}qA=z&1NMY(AkJ%GhlTFth{RWZIK)@%7W-iW
zw3uMPfW%SA@GT=Tjyw!;8Yg`;$D^&_MgQy%FL46f4+JxvRtwN&GT$S4AW2e|lq++W
zViaNYhB@(s#JB(X@Biz?IQ9bs(?f?f9*8rfS)ExwU&~#xTMbi>X3vwYxt64PHdZV{
z!XSNOhv_!<991To=PAnlzz6TW+Z~W0zs3&VhLnAK=7Xsl;#Qvt=*$874bo)7=R#P@
zLw;lctz6)*3YLD^){5{T1<JnnN6aNj3SVlbReY(!muGPld1sLyimxrT_*#Rn{~X03
zOZmm%r?*hVlFK4G6ydfQPRG1=S(l6N4fy_T9EE35%-fe0vmBfW-~L46n79*4_}99n
z7hhZO^&3BCuWuQAsmPKE-_2$o%fRu<6O-Rq7d;3Sf+Zb5sp$heb97IT{1<U*MJ>Me
zq9gw5@f2vS+Q{4*b{30NNlw<vP){d9U;iFNB+JlvD$|BWr>BwX>^^dqEg<0ya!<&2
zo5O5b4l+&pzFh{g-M9^Gv_TC|{?kbovW|a<@MYi@c&T;5w`CM&w56~v$6bRJpCpXO
zQ;9`h9f~%$%J=P`@};>CMjYL|^GCuns5w#hz>)E%+g&~sptSf4yWQO#1XK8s`K`#0
z1JGm+m*lAelQ3QLsP0fKn@qu)L|tszCdC#}9Y>L6+3=Pt4<DE!`TX_IRrOJ)M=nW0
z_Ecgr#laGhJ*-&{!8Ro-W~Q#nRF@=MwK_fW{R9Au9U_iu>Y(XYJy4}ciiT~~G_d5!
z#H5-@Tv=^+kF|>^p49+Z4SVS#kuQ2bo~Ps%y`01`3)6<`>P+JZ|1iYu3b&9VOF23$
zv^)Rp)yMwP5&F-6{|^Kz-vLT_=p9bR%=G~dC37i(2+JVwhb(ki=FKu2IGj8~^JeG(
zw6wLl*h10zjmDW392aKrI<xeT<cb`Rl39y+ZXkw<mdegtp#*V5!)$_u1)sYr;K^8c
z{$w)*bSM(LmvysfrcbUN^mMhU3iTsj6e#|QxtHi=G#Y_>`7LtFd1bZ*G#OKpX6{VF
z>jex0!--Gfsj8b-%G^sgZ*pda;3hSU;@djixEFz<8-|8eLl?6zishxeC>CW@Lx&Qz
z%QHQz>WaLBxunQr1PmBFG<@YEWec(v8CK@AV4nEqlB5X^*-h<K{(4EkB@7(Nnv50Z
zit@?wAic__d5lqTtvEWW+qUc=jA&HU$SW*6ICbUQxmP?UMy_(Jc3fNq)Q2gGs~b9Y
zsRA%Ao(dkt1WTr>6VEVRTV3G|u=vYm(sGY|1JXPrF&VK;H@ZwAu$WL<kqEFD)Q9Jb
z1it|ofFJlN$ihqbs@^ysWPt)ooMklB6QFN?hLYkZuYaGA;8V1;&NUba`1pHktU*rm
zWdh0%nX~4SwP+!nHuY(0=Et;TBAK7Nr?{?Sn%HKJiZ#oin8==mZI9@xsS%Z0i&|gQ
z_QJ`n=53qtr6q=C4uD=7=231vF4#1T^Itit3&5$2<LKI_{OJ>gfeVW=^KI^ycyv_y
z4;&qV6=^jqAwqG%MqfBLMqx_)5O_IsbTrC_D>$R0Bgl>7UIJeCwI73z?Eod?TPQLB
zqkl}oBpSh=eGbXthsaM8baVvq=SN3S<miZ`DRD1H02py}v>4vykB59xl}%1+E*q&^
zKcK5LMvb*ZE03uqdy3_GE_Mu?Va+xqObpq@E^%d(NV3AHvF&53ZhB1H+uN(qHh(#L
zn*-8-qstVSC!ilqpZgNdCSif_+z^mV8JG=Ey^F<1Ss;BD5)TX;aE6Symplfp#JXvS
zJ41pzqvZ^4%c@k2^-1iCbdgyyNazD*|BVB*1Vz0(b>_Rs72f)yGIa2*QguXvc{B>%
zOcfX)FR~Um0I%Gi9_(D7VhX$IwS<`&$9|X=fD1DdE)f~B4rdZL<*!MetE~oDCST1A
z38G<l8Ma7$s?wQ3aCCU|iOU*Qa0_KigE;3e*PA#Ry^2P}4`=%q-y`v5Jw8jb{__oA
zwdxri3*_F6dTXFmN~&stM3Dhd6o3>f!;W(=j%Bu79w}TXdsYVvS3Nyo!3!Qd&o1>5
z(ig105ZCa>SOZO>6@o-d)QB~aBATN^EEjLvp+KyK{Ll{Vp}h}4W2=2jB!`uHfwqVZ
zEl?WTAv3In#;`sD!wQAV9~)3(dqjn`P!wj66CMspZnCtkupFA=H!K{{(@~aeB!cDa
z`qkKngzo<M0gGaa<VpsmD%K@M$C{%!*fu1FJx`JqPp68isaw~WC|i`pS^+M%hgxoC
zV{M8$y-m>RM+l~zODv@}lD`bV@CxJG%YY<YuLQQMyfj=G4Iuyo5^~nI8-+;}_`(==
z#qum25S7BQUx|Aq!dbqJ1LB8uQaY%xrX+ci<iY$94AV%<=0z?9tq(y&1gU;HJq(AS
z9puJGSImEE`aoOBu?T`)f!F-jD<*LbFEA(v{3}>bHwryJ9-(vMG4!I;!J$JAsE9@p
zWqm-xWg#pm<&z*mkOi2)c*@8jp)*XQanYMcMt%SyvcrPt=6GW!ZblcjGP6SAdLr4b
z!Cc5cz_3P$jU8$+Y{^uXU0Y!e)$YLcWEZ!<ci)xj<C)`A$!;Vl9B_%p0l9^^tpyZU
z<fW;l`gRl!0OSm?kqP3-If{feOay=lmK=J_)XWL;0x}$CR5q<;PF80}YD+%(vI)`r
zk`Z9Hnh_MUCC8LC4^w7oSkp}z+r*F{K3efqhe|f3yC*1hN4X4Ig%z#Nd?eBsRkIz<
z**j{|8vSEITBDVUOfnqKU_e)un$=WDOH`Iq<vzs2ckG%40&p7r6R3M~1QV3_qe;Nk
z6B(FwUFmb?ei%c}TtDE7p{e9Xe_^-i6c|dEq=&z-^d^e03g})0K}Z->N%d;CY@nrf
zip0aOBl4}9Sm}soTlx#Toh_S9x5P1SnRTA8IZs|$DGTwArTPqZquS-D+D^YO(p)Vn
zTb)L~U#d^VJpLZ}A-eKIdJ3#aGy!-KXrn)+bX}O%sebY#V2R5P=e`^uX+~jJ&X^=_
zle8*L<Ez^0=eDJ#+e+-zyv7b5fQCu$*GYH3Nv`^)-qq7NJ?ChnvAgwp`8yl9)qL4h
z4YUKdnl+RGYpMj+R}3^)542=4a>svZA5%bWILFN8LYJsSh>BgwR<R~a|37>0q8zu4
zu8Y13M!ROYTdQI7eo4kt$9Ce3ckDzf*5p*JcuEC=V2jIal0&jB_daW?_B-r1+)r}q
z2f%CJ$W}|1T2z%2sT+6v0RHRuo0zDkf~lscs!FKls@m!C)Ci+j@=9!i(4C+Ek`!Dn
zDuZI6?mXc<42OPWBoCt%cZ;3JVGhC+NO#;N@aDRYya*ghc^#K>VeK%oV8wL;5;GTK
zmpKDpi~^YcoWwquuvq*h%#v7$cSQnq0U(XZ6eh7Ru-ZA-zM(q!g2qXd%t4%slH@ZV
z-{&~FiBZbcv+zikjv%BpQv}tZ*qkT$AkZau4Iv`E522LhTowlD6^0_R8^uMIKmyDl
zBYBZ6DR_Fyv_^v@noay>AaV9OOPb%An9-%1VG@U`F~!yl2NRzdkUq`Du1hI)G=q7T
zNrS+4M~UOu5(k%a*POGON8yE}(j3m55L{)!c#f7aKOcA*hyPpxKg(M>f*8}3PO2N~
zgSZ0tMe$6I`q=}LW1it>N0ee@rxzs4nO{!*C7?Uz><Vu3Nq1o+|GxNw+1Iq8NfTeA
zm+iKmm$G1E0oxTIRnarJGs~+qOyXy=XMg|gee;7-YS@}aqb9LxAVne|I3}$xrn84G
zk;y&b&L*fSpoNf4jSFY!zw7K+?P<5Gb0H2s+%CC^dP8KvjaBz`Ak%;}r9<hK(Ul0>
z^C3BHZrCU!_RHXVB0^&4UKlPSX3Xy|A<ph@BJJyJ_&gGR8;!#56A*UYlNENEM?EXh
zT&!pw!-nrG*t1;?Q{Qzp$E2EjS_Y(?D>xgrSBUi#%psR{Kh_@2t#E@}GQWLopd>Gu
zVqjpBWhyGde7Rjnj%)JD7iE4(ZemE*2oQ*WBlI)iVb9QSRe%BTmy4t*B}!Ce$$yb}
zhCYgLgy|8CNF7a>zBeLz&1z|$>@hJd-3h3vV#U!FY*@C59osjsqXmlY2deFP!6QB<
zmq{vY<e!<3goATKKHPC!ekipRAYEpq1cVj|1hCdQ1Vm(}lp?t!e`N!O197xdu<pLl
zz!-fHCj?>iCP`N(dr*9h>8_%C*l@vqtoQ^IL$|T+TSW6zO=a3P@2f}uo&cZId_}m%
zrt^xFegJ(Qk=Dym;S!W52S}^&DuuC7cY^M*_I7ztM1ShEZ&Af#9u2VT=ngh?K$-V+
zf_26BEb6+3=G+4>bxOVy8}*mKMm3zrsuxLWzB}$Ua4;GHpIk+`&28eY)QFp%GAd0b
zZ%usLeq#}oyCU&w^65-GkvwI1{Yvsb%ZHNxQNNYq&kfHd|3bc)pU$Qa#ABnaJp7rh
zgrmlWRcWiHL_MDk@l?>Cnx{e<-l-0X!X~j_i))r~r)7@xch83V0q;_O?7Bz$6cOsV
zj;SlyVLE}QNXMR`1=tCE+kni8fww!#<0(Bw8y=o8E}y366XdPX7m|q_;BEJ1xGu^^
z3fzQADNOMM1C`XX`Q3um>b^_g?pbR33PO9kgQT}UT~Fub;w|xK=w;KzaKoZ(>3-W&
zSPr7@VC(n?K9wDu_h%a={AYmHzIhsdJOhnEH5OiS<H(?>h}Pz1dgkbUvL1y!ao7()
zU_StRy{}be6W)4%&%r}*x(`R_ZbmwmcBr16?!n2{6?)w_!*t(i9-55(fJE$vC1Jl+
z0`}V{U;o#=;~yV*CN7h-zQo6)aob%OkH-BTjs1oCz`>u1WVt=@?)Ou|8Dt<G_zH3p
z@!OC^TuR!=vh+eN;O)Gc&od_Siix=0xL2+R;XyDI3cZx6_^iVo$_`!$q8zzfeiaeh
zv*I-)#e$?4^>aDT7>j>neH#E#C%;Z2KmRG?GU*>Z(CYgf|Fe)L@$l8Vv*8qEekn2q
zo%JW3w@F-lEZ@#O;0Aria**og>#MI}zWppbJSEN;e1R}JeKVr#85VVI?5Y&pQY-@#
zN-V6annkGLQe{teg{P#yx|JzK2>2Xvpld)WZHqf?CSe{Y1zV)WYSL(G+E5HVxiHk)
z54&Cw7(g0@MRSp$=h>$-;h4NiSrSZycl31c0?QJW!|~5-RYFRXR_HyR+1<jRwN%YY
zO|(Tr1mzogA&~)a)asnRR_AF-uEwa;0j172(Z@Vcq4QQucH{EzB`d6C#a<`-jNk58
zXGdDNM`F|+<pG3|ezJmq=MuxyjQ|Ix5r81Tu;*zCc2rk0eI+nWV>`M&?`Qj$TQvYr
z7mK~j6!HMD*msp(Ly<fjxLtEhowzz?D&%fs2EmRJ7}(Zz$5e>w>stlQ5iPL#8PNjo
z1}%_#7neBls05OqHL)AYi0u`ZjU_nvyB4qjde_LgasQBlemVX~jz6Dm2{~VjH0Nb=
zF{d_ILNhf;$K`)0Tp_7Efcjw$zD=@nOz$qZ!!>8TIAH!NSt36{aZ<qlJb*z2_Z3je
za7e;DglaU2V>x}no^r6n49!`BJpyZxEhCnHk02jy0Pe2ag7gsu0Zr<30P`VZC7|Ka
zFbO@vW1MTehl(I;G8A;z6Y+t1#4;4!$4v87Yy`}~Brr8>+RUUHAr3Q7FXn9R6o^QH
z-=(quwi2i)N0XFgZRCV$Gh(cb^wFaH&Ha3b{$oip0zN4Wi0my10q$~=F;ML=UuX=I
zjQ>Ab7U&nA8S##=Le?&`VPGMy=`lMn9Be4e!-i@a*j0T8Yf4}%x*ljjV2*m>y8sJW
z+qnD0`q<)#_)PjCo-P(hUG@?-a}A)a^f;U~4!QU&3?^#{Xkf|ea?hqSc^T}kA<8^^
z0>Ft|*I1%sZ2o?xbeCTiuRr5Os<oD1i@#?h`r=`}k|zhOv6;FKgJAsT;2JgU-#xI#
z9Zo}>(L2UC>7lT_XT9r)g4s8O=yYK)J&md^Gaam{nvM-ufjk<zimBphx<gGzW7|?1
zK3*wplVW9{p!T7spjJi_?N?B27X9xIHh!aaX^@x}=v1>@m0=^$HGoicv1@7uc8IFl
zs>=*R8^yFc5z{KF>WS^xCt>>t>-hL!9Y<8g5tVTawCf=}9+z>ptkGei58v#ZEZZC?
z3RNjnFf&bt4TCD!@d5=KB(N-vQWiKPob^#Wm+y?#+2-mz;!!^m#-(rA`zAq$dpCDr
zk{cxtierCrcr&Nq@qB;^_Eg-SRek?+SpJL=yALs#{hK&XAKCYJe-6yi_ZMNLoh&PD
zx{Bi{#KkHNY-|{WVbAax)&k4)sI4fT>7SeiT6j{uyZB<DpIFlJwrDA#ffE+~Zs3as
zym7}tu5wZPVjv>aR*+{m&l4Jw%I~M6m#*MMYp1vwB2g00MRDl0*&?{C%`=i-hZNBy
z$@~x!FXd<gP8P+|XEOwq`L7}-Q25HNV6^<<3zPUc`WuVVDhulhU5E2)oQ3&kl(9Kq
z7^s;i%ZvhqYLeA}!V*zy5%N5}(Ab@+#hcqPFvXGU+l~h*jsnxchQ}BtUckWNE$~$4
z5p`6DA4evvPXs6ZicBZ<v6}9b@pglBHexXw4L$+yqlOGtPrNm<pIGuP4ifYdu7oQ%
z-B;lDa}}mnaue2<Ojdm_?~0~CC!2d--Xqf)dS6~78_QL<Ok2pS`<zw%G@1gZTpl#_
z5HQIK0SB@EE@0`_{Wk&1fhK$n&mOOQxFG4>NQWTvzg`_%G7Jm0_?ht-{J!MU7|*XV
zPDQ&nXOJEwI$)jp0jwOjMnhL<@A~YQYk>L&l2w#YxMg5+?@0l-N3ZZrSxpGpP+8tq
z{VL1bN_HxK@7Jrm+<49Ek3Lo5j%zH<fSu%3JAg<Zmy4b=ZTr}r)t7d^`fSc(&?aUf
z9XM)H^}ulh$-g-W%PCHL#%oqkRD;e8cQZR|&<!9dh*df}!ihVw+;5HvnESb&ovhsN
zP|vU!RWP9%fsC*!_5z1s#dA!@^wod`bPV#iOK}Nglg6JLWcE>_x{VXiErca*ddgOt
zWFWas(;dQ_tlgH8<cDDADru*I*(_eBwn=S6!P34~{(BG-)x(s2PQg0X-v1|OAsf-2
zM_{0>BK0VOjw0wNg7y(XCCc!@n8X>|Z2%NMqXhdfvns2nj$-RsMA1!?V9j#^Y&gWk
z4)ZBCoxlj}z)>BAjNnyA1Fw=iDXt7B;0KD!nD!D6gBw%Ac+N3$o(jyBX1N;mOokoJ
zq}VX2ialQ^SaB`SG@0Yu);1Wm5$3A;8DXyO3g+svn=?)5pa7IuXs5mrcGViV6v+qU
zO9cr99H=>9P!xOT*$;#2RhmLt?Q4cUg4LryX~uF^z|@xzii%R<Q2<yPfasm%1>Vqa
zg-9hXC6oe2c@Ex8uoxlb{`FEl=qC#j#(CM~C5uU1pjT0p+`M=lCG<0TALhl~p-usb
zh}7glHMUpjP(H%c^mLmT*jAZ=4Wb3uQ#^t_-S-_^*LB@hPs@vJoyayMYv*|1N+V~x
zr0>d8j31JWQ5JsT>7`qKVr3fZCU)8-M<5f#wID0xF+>XP%f&Lpy}7s-*LAXteE2fW
z!Xyieu*7_;e7fk$V_8MX1X|}PYDGrEIE?4d(WU&YY>kTW*lSj&$(D{`u>A6jfs23m
z&!zC4TM4MNuW16^7s-s5$rx90Q-(a2!=Zu`SNfc#S+YnWn|;R8Bm=epk$8pjWuD5D
zQf2w(Yqx-l5P7SV<or$&)2YHyM1LYHBntuG&P%=?KVNqrD2FW$Z}o{A<n2a1$0mwq
zVd5(~@ER05jtwqvhNT#;;=5!F{%)IZI;U%RI&68K&28ryO*T7)?MgekGx6sW@Ok5S
zJnP9lXL4ieZ%QLc7)*9#yx`sJ$p0y4`<nPyml*-};p&2Al*I*^vn#pq-0b5gOD|#*
zp3Z5qKAIPGk<JvR=v-Bl8PcXLpT+ei{`6AmW`$TQ)D5QUnGJM<g=wv6kzf=KMhWo7
zQ%<xe1BG4_AIZf+f98dDFW+dCDzEC%C{;gOqfzRlQjmU=fUCRB9@@AH4>GkXeJhRI
z{q48A^{5@R-Nt=e)(2SC7hF%;mmo!8CAbDFC!En|ydtZgG3odaYBnDtHIFa;t;u;{
zl*y?uup>E-URB$@s_tJeI^qj-w852DCqG%A4Q2-c3oH!>4&ZmGj)NWIx!89VVp7Yp
zsIEL>a}n&Ks+4(xevmf3mcqGVNt#HZbGqGt)UgiMU<CVc1=gbeK>?b@B&q`a!D@+u
zjQw-TVz9e(u?uPwrCbeZrm4+JB|1P7heg7(?0^RPs9*udHMdC9=D?&Vy6!5DVq?wp
zG=LW%*tHA?yAE?S)h7<4_kh&=6q02(3@xqDnF~!GfHEuw;tj;%nm$LbgmE2iE0H;{
zPF}_Bo|{ZSK&Kw@!RE;o0coYn=5@H;uyyoCOHOY~PK_xyL$@*Jbhr96>^QBbf!kEN
z^Bm1MV{FkFTQnve-|_^HW}J%Q8O=CP*J?MKaayZ0nsJVQMfTRZf_6S<KS6SDp)d(Z
zl<x)fe2hn~=4+pv_WVJbHb-Mn{WID&hmiAV3_4A|XtZq}XZgq5`C+4>4*_8uZJXaF
z0)5@|Qkuk0*S<-JVcNQZH9yd>K}?1{-Sn`kxh7K-fL;s6nDk@Eq+cfKD;bdo5mopy
zN%uxEo>m09!4y|fh=-XCVVE>fv8zK=CUY#05>2rk?dTEc+XvOl7+G7+Q5DZr=L~u$
zjd*43F~+zGK`w{~CY3Lt&+^*Z7sf>*4TmyR5S^dbX2<jMegVb8+QZ{|Wh*cn62@R(
zN9X6&ScUof{G8i4A(Xku(fPR;fLws{^BFon|NC$6bNDUE(D^wJ9lc(Fm&f_}_ITbM
zJAQ!Q%voBZvsLNPiMNw9Z*`{i+ni}>x7Unse|8T(jsbHt-?B^`5Es()QVqKvak0%b
zMm*0Yis2pmIO?}Oj>EkIn*IPkU%Znx;niA3W|Wp^rr`y^jq?yw%p&2ulCms>d|=#d
zfWV(ve1tADu=$GI@hD)78~jCZZx}&TGRZze&dGkMbkl3}5;Zdv^a{zWO0C<i`Hk@D
ztm=Tr8bc1Z>#9--lTv56;5DK3uZ^1NwU{c0pQI!r*@QQ;AfFkQ^Dj%3xRX8$$T9-U
zx&jyoRqQ3o3zmwNs14A(^0YnDwJyc@@21yfEYqz_(kzT6I_BDZ*U&YmGk6-f??x5>
zDuWz9oz2j%8H`PxRl}4EIh_sY$`^fYj&<z}Km=}I%9#3k2-;DGu;%5`>AlTN*S+fl
zdoMS7-*QXp<)QpMQtE5nr&0G=Q&T5LAe1EC1c5TlRQ4lV+08EP&-XVJ%k=grrU&Df
zZU_<$BeqjC;wAb@MIz<Jo4#&g8xr*O!5(et_jhJv+buzzMJy-|9&9g@M0==OztRJ2
z5WR!1nnnr_Sf<;`-2=@C1I!1*Y-tDC&<@Y-w+|Zs7SxzC;Ic`!I+!H)UT140si}{L
zByY2{U7>eRadGLNk!6wW7}dWH5u^q<7oWP+#W{5JISl~{BupQ%>}C4Q3lz`6hVB^H
za7+(7#0~(Uiuk6h*{ZV*7IFmRtA0i>zT1QGegEm~uNyR5{AHM-_wPR-`MMy^vF2eu
zL$4$QDaFiOAZLj`(3^+=c-TFF^$7v%4x#!$x^Ic+sDNdG`Iajn!%ONx@HN98f!LEW
zCWTZh$5F^c6)M*0`97S#-`JOs-Eb`gw9KoC`BVyv;+id3{ykzbEH3&;0*2m)@n;c3
z5H0}IFNuXrpJs_1su)cjE3*M+jpG$U@I$f)Io4kUX+=4p+R;${q$*8p=0`C!6}{%z
ze|_P`n8^&s4KQ_d4;vnJu*)nRdy3-+p2-4T4IXj8mROq3*#wd)Pto}~KS$!YAioUJ
zBHIWUbYJ3ttRJCa$Av@w0gfI)^qOQvDWwbaK!ya@5B*iZcqMKiG$gtg2O>Xy+E&rL
zko^BPB%I37ToxF<hAox2*id{0yM_{AO;a`Br%co6ZtnAGhf}RlmB3~U7i@D_l~2NG
z#r2}l2Pk;p8U)QBFC%(nUum=iTZ%6fJ)rQDK%{N#I1xA{BDLhLQUTDRe3ch$@f`ie
z7ReW3LHTs{;>D*kXp2;ks=PB;uYTHEGM}TDXh8~=g*-X)WDB6)N#W$}Q8jlP<R3R8
zOKUx?w`%BSUm`Dzo4vxyPlaMO14UP(EM!coHHEMX%?=mMcBWHKEnCYrXF8qM8e%bv
z|4PCbeGX&)C8&UsWx+B8ZA@Ew<+kpyF@;T2ClSjjn{>XKA*G|2tY=GdI-=KYRZPMo
z#NVJEYsAY9%`3~VocEnXl}8PN5?z#Xc!x52J2P`GztoX%=i*~|NZnS~HR3bu(SaQ3
z!_?q&PS$D3Q+(A{7{$7-Qfv@k!472>)=bA%3`$MiFi(xgM|e%tZnOQrBn2W-RC3S)
z(3<2SN2sRBJP!XCNQ5(Va~;xa6z1sWx{naN1ir44aVtg+Em(1#fczWAz>ERY@+Hg)
zkUDY_`@np$_)C~2G4~yT7uRP6h@K3Ag9+zq0<a*JSmE939HKjkk~y$<QIdS-L;D;j
zH!(`N5*psfd`YiCxF_W_b1wKoH7GV`z&aA>k~_2z-X|iIvYgBIz+l2qBmh33aYJUy
zjO0bOq{UKTnGY4I*4f?wm`RYV+v<Wl6LntsUnHFjm3K_TwwQty%Ocp&7{es+Tx|Np
zqn4@>ojRkub6j}`c)L!;7WKcVVB(i0JiaU#&(SjGM*=T7oW0Nl^%GSVVGJB))56|%
zGug^N*G-VGy_;yW)uX`F1lRc>ZqrRt(*_x03!HXW%A27dE?=f3%h?sYFOzO>Whz;)
z$iTJik@?j!P6_=y`QdUcZ|onR&fdb+DQ|Hun*Kw;pof8wUHI^ybxJ+sSF8B`Pn!xr
z28CrI%1&p{&)<K0zrUMyq4i$c-?uusrIZQ9<=K&i;dSGmisMjzdR)nI+XhJKapTuB
zW&4WO_13<fjgseK$$Y`9@1!KpHfanOJQIF``iq{kyPHbqbPS(M8K67L&`0ncc<?fG
zgMmJ6aoX}MO*d?UJ=M~%;W7(5u1c|DTdqw4P4j*Cbj0Z#VQ$Lq8f4qjbWgeXJ&ET_
zkTGAqYZ$SB6L}4mW3Zoc77e{g7LYIsOskXEKfVEfWI3Kv`duVG1EjYMQeh=?;ON3H
zELx$6k&GK)g@*e&S%QGfCCZGE2;U@G)Gz>pV7y2{0l<Y?60Nwv0jhz@?$$6IlUzy+
z=<PBqu35H7GB!gYSX^k5rAfw3@Rij1fzazPX6Su6D(L1HQY<qP)yr{_C8c~l`Q`n^
zw3TivfpPmYm?jhww&x`ee=4|5zZsFjC8Zm(LIhne7bKSZCG%;`(29G7gIF)!@uZ|J
zL@vGt1tKT{&u0V@3VV+J;Dbjn(|=5^iz3axd+`EB2)Y39HC#Pkl>7gjCW{wdl+0gL
zANi6Zf+R~gJ?NI%E`iG;I7l)q3Sr$ca~#PP!X)J1@wLY+z9umZ<2mMY$1*+G3&T(q
z!?31D$E7p}!%_;$Zu)=>(kf6*H!Q_dF;g@X8-Yc!r}-w<1KXhrbxCj^pp^H0$28qw
zAPpVoI}W>P(q#t8>9Ds9qXNC><Xj!M5902aynp{;3iQtD91fZcIzzAC;WWA79`Vu}
zhHJZ`h<I?oxiwU#q<fBjU1lgxq9y-0PHqqvA#+sHE;QUYuH3JrL~WIc1|ff)yj}hJ
zw#jSdBxnxAMUtnC`RM=t@Bf27GX{7x4Io#kSV@)zoa$AwlzH)Zv-9u^x0IHt^pcc`
zspM$#@z*zS=a2=c>0)++BCwr`I3FH;CxY*Y52kR40IKh&`?wy$c^noDXUt~-cdlul
z`xORN5{{xpj*A4tibf0*9J3qDGJ=x;1N7|+Lsv9IQy<p#AZVVG{IDxR^=(b3nuSe8
z4Zs=F#ICNZ*fnk9*@T&jdJk;KV{x?L(6gX?B#Q+PlPUdp+UUw+U%b^umS>Z;aRskw
z4_}{$>!H!qKRz*ki)Va3LKU{AT9i@2pkLfX4C_uB(j}wqf*|l(kk5uVAneD{8X5<6
ztZ1lP#zbvX1LXzjqXB|q0~J7A>U}kzXKY^e_Dd4?m}IHR7}jBZGoHcYonI%B-_!r#
z3`80pU7TcW&T)-<R;+vaDdUerF9la`y$}x*0%k#|b^ba4ajhEJ@1^!Z8BjZ8JTZ4H
z^w4FttmDD}9kvF4dHFaNp--{BzA60{^DLxEJp8b%k?ygEQ;_*3`wEQ5S+B#+Z;H1`
zTzo8p+;~XRfUYi*oJSCGpNpg@lEv9QyZsDcMBB={rl8s{*zy}_@A|!py#QARDf}FZ
z=!!~Bta((yhHeq;IvT}}rFx7po4RBh+QSp%wD+6%x8;YBGO$!gN$s2TZSLWD12kN*
z>S5kc=Cwd$@{T+XeQoTya<pkioz!Xxu6iu4SuC6k!WcYdz>Ar~V9*fOH-EsM*(2ZI
z2)$~noDfI{S0r9dKAlyHX`qoP3g;}Q?9<uo(;3{Cgcb-y4lfFG4*J8t`6&zvL`ep~
z5dZ@6B?)Dn3$n_RC=$QFdxz!(bjV>m=bv1X{PU-?HBW-3ulI)0jsnMUfg=s?)a<-^
z^)>8mXf825dw3D|5?X*l*snlW9I_hpxXNSVLz)_~i;$hH9nm)p+p~2A2dZsgBd{Ip
zxUPd0Ezk_Z)OE#Rk33geiQ0z*o{rS3UACe)k#JI)w$=Pqvb3y9nzxqGtdQ_Lf_D(X
ztCd|(a3J7Wlq^$GX5%}KChYnA`3&(p`whwb8Il+F49VMix|VEh$)`gKbREvGS%$JO
z7v8o_vm&9ND;7djSdbO+ShpU$Liu&FjC}aAnShN$XqA(sE01NB_I^F!^f{!x7NMuI
zH7a~50fQ@L6lPp50S`kJ5w#6N<273eH|VcmIsq^sVQb7-7zas48S+?Opp;t<A;p|X
z7?&(k*o};(Nya@aNxVY&GEb#dqUO6G7Ma^2k+(|WcvsV@95zLN9Qx~;h0=cUAQH_r
zE~q3G^gPT_*dwm*G7tNX<70!FKK6*|U}77JX}Xqe2lgmMNGW1de7ck=n$m-}LSIP6
zsjPFUfFxMT7m&V78rpn*66+*zo38{o9=kHaJpt8t<y6b3up2pVD;xcwxac~!#mhYm
z^_Iom*dPQXmTO%1uyuQSvGB5Cuo-mI%Wbrf^E7jtC-TR$R^nM+a*H?gAJ0U;yo~sD
z44K@H<pxnRJ=SNQh5kU{p#_xQhvTn6rjG90+QGc)OBE-U8pher@;`;-1HC)E4d&aO
zB;@EJS>LmOJcR$;AR$Wz^khY2Q#D<ecpCOS%f*K3n%Fa#i#11cY|Uj<H}`1Vw|}{H
ztDi0;H<ytSM&`GNg}Wa(ea)nX9aseGCb(DXCc~~m1FV~NplE@o1zSz5BZge{Gh)cy
z9z(8#kZU@_daDXg97PgPoC7JZJD-8*CDEeWLD*H=gl_>R=XXb+&$dMBt_A4wviZ&#
ztz*><1*$6@{q_RL{mwG(r5hKaa6K<Q_!~HJDTwtjl}g=~vw8(mQe5ZX^Cb;oBwm!z
z&%zIP(;RusLdNEN8CS^?`3Z`XLOSch8qB1?PSP|>(kvteyHh+lZ5W=M<=B>D=?q)M
z2(aNWf*sBEv0*rtt7*2Q`~D+VYHvELYt-J>WdANjM@}J2&|^<hmbF97r`s?PT6CT_
z^<C>{>^t-yOOgSt#%zZE=Q0MBbOc0}WaupkBj%$?#z2$6d|{eTGX8&X82{ym-;UrI
zy^)d{$q|OBOg&REOhP=YdWMG$UpFxc3>6bgS505Hm}42E%Jlfy3f1dVrn5Mj8-uhu
zj1Y4V12JL0a<|*>B~V!hUaQon&Keg`g+Q>D8HKlB7yNWK6_=H`tM=4u+-kfcPgb#~
z4lnbfQAyl|duoY7y!;PYlBRnr$Wouqo&YG{7AlYk37fv<zzQw$kcAs>meQpJS)~4q
z7b*8#e#`&lUsU@lzY%})uj(z7-^mX~;D!;nL2xWJ9S#RNm}iW|4+FD-ll*}*_~xUR
zhw`xwzwtOdYTyrkqaFnJ@j3$ueFXe?5`Z5~vF@}HKbWJtj^R-3tG0y=%~Y}Hc?MRg
z##B|&nXf&5rA9+e<RV}Nr&(zm??tb%UwgM%lXzFSkUy{jR$yRkw&8k#>gm`~D8&YI
zG)%zZ%l8>m0?SkAeL%!KJ;g;yL|sVO&ESx|BDWuI0LO?|d0$?2ccXj}B^O^X`<luK
zbm>sG3xo2xO#G2>FU2I7Kt8W{K5h0J=5fMNjaC!c=-L#@T%iqDxH?nk{X;#<J>pqj
zQByq;g6)B;CeVKamT(cqw5XP<U6Cs<{AOO-df>9g5bZ~&()LDYjn$Ou1?dIYg@r7~
zO>){?<}o|Lx5S9t6fk2xK!2bEoKQ|z^bkzhX^S16;;ELdxtOWM!iK6l*s)cHZOb=p
zVkw?$kI>==#2uFrLw@)r^Z}!OE0*}GWEO|;ia$bN!Dgr+DJt=B;j;G#m|@c3130tW
zefQ<FKUsh;Zpr-Sp%?MrIgCEslOmPabcXT-kuvh8${Xgb&|(=CVG3wxb>NQ_-;$Uz
z!04~PYB0Zov7ixI=Ippk?-Pqfev~|6n~M?UHiai_(i-r1f{IgWlo62zz0f9}Ff`I#
z1{&N~+`s{um`){jKv(GX7&~y<u>-TAK|P~z@fd`QQ^p=JHCyqBVqnvC18lg4f*r;5
zu;ti+ZP=zqZRNz=G=-b=yNfRd`iUi#Yui?%23NRp_hN9>1%|WZt1CTtd5c7_h2Y+n
z1J*35Tr4}5jy15+86r^<&qZPAv)LY+vt*u;^g5)7CQ0UpkPj?J6X1J`rO##vD)V2b
z5~O$;7a2%5;xXii=^gX}03W~{dZ6?)<`4wQGAn~zy;FE5;TCQiJL%ZAZQJai<K&O+
zq+{E**|BZgwrx8(S!?b6ob#N!s=BGVsEcoocaAyVXl8)12s)u66n7}LlG4DNjAFwE
zpS^<0G<{X4m1}p``42Xk?Q*&B;s4nx8-g8jgHZnQ0^_XwlgL#%J^uiVBXy-vC;E#w
zxSI%wy~zf0NkylOt^WUpBJ?FREv8k1k3K)4NId(}dW!1yxRy+zz&`VtDEo6q$80gn
zLs!Qfdvf_zd((}^GgtYWIV)R&WQU>TyPA}v&>VhwJ>jV!6N@zE1+LR=Hfjw?ry!e*
zf9&JHbtiSQ$CRa-&qFDUbnwuHv{6-;Di3G>|ALH?67F*IRy{9v)7o!8G!03}XiXJ9
zyA43E;29qfG1q^hj4pVMgI_p~rw%SFxi~Kqh>go4tl!K1{qi_;LUdiX{a+F1voIFX
zqoI}N+)ZBVL&5l|E6Sc2EQ6-(&f3H55;!w>b*(*IY+oCMx|NQ7>#kEer;sl8rW9td
zt$Yllmk_HKC=rw#<`}j#mdzTHuSA$sV4JK!aRcuQO#u~XILU`XSaMh~(}}Yix3j6Y
ztbVchWq1Y*1>Dkq3!I)+3fnEk!*#LYb!C#f%+mZMc5mX^p_6&{j0p(BC1{8tii<45
z&jE{I96}<7sbFRPbXliOrJT{l7trjhUx!f1O=z@oEHcbmAqKtLd$gV3b|~k^rGgcu
z(zz^IZa<zLI8K$h!SVv8nhH8tvLz+?x_A=FfaW8MaK$G4z?v}zvUdJ1Md<?YCZvsK
z8}LB~yp{M}?}~|#FtDWuLLTklmd2Hs;5!pUp>-TO)hMjC8${?)A2-rna3a_oNgk|M
zvM?oJiiKV^*WxbxAp!hgqeEGg#S1fELtlM@BQzlGC~YNoVL0#<!33DidJ*>DWm(Aq
zb-g@mRwOQ2VOQD0D3`Q*<%T}zsA*)~4eYavEmv>i*9jWJb}HF^L!A+BGEsk{=Q0aC
z9!-;QP2MZS6Yr5BAEUW`d*aFiKJp%K*}v1NUTl;5e+YH0mxKkQCQ;w}b}w8S=TeZ-
z)_nDYkqVVx9jy9+y+-8;h}Q-Zd$3&d%LCnQ6Htt}e=ukZVpCnFsz~*5Ifh?G=OR`D
zO&PPDB<}L*XRtm{vq)5xOe8a!;Pf`pfA~L=p3K^#+9vU4O=9*d!%`%FmWdcQJg198
z6Y;IM2fE@3+ijdS$%Cn`*>hRcE&~PL7xP-AJGQWR#;m=ycs&p4*^-!RESXB{drcJ+
z^Z6-~$@wi`C}Y%nGzTuCWy_BAc9(>N=zNw}NCPmN3m*19Q7{WXJfv?sFN?xL&Y)-L
z!iVUG##MY~NDB@xlmou`&FO&4^Ua%V-5wj|_t(n)99zEZX6gHgalBev{>MO;B&)J2
zsw!LU<qJ2vN`Fr_fYGY7%@orwA1nHHBw@B(I*s}q5@2jqHjV?qn60Fb^*(>;Qr*;8
zheX)Lv*baCjN??MA)8PA(w4E;g(KHR7;6PXD1RtDf_vdS^}=kx6V^`*-0WI4!*2of
zj8rLVAOf)#_OrTb8Ud4?SGp!IotwO>M1R<{t1Kg1dbmMwI5f<BB}8+V2_wDmgZTj*
zC}AKieM&KNBbO24U12r*B$nJBC{O`wY@U*K=D>FM<86?kM?wsw0|*A?^kwv;$_GqS
za-br!HWf4}Oo>;b`XvZToF*(r{WyHz3?f6;c;iOY^G0>2%)eo7Y<YE8YuK~FEs320
zkbD})E}0(r^3^T1my1;~-^1detOUW)CdFCr((>#3U!d%HKycIWZ?*o+$y}rRWUc|1
zrq(!`+#CK!E;jaL=q2Pc8(R(B43Ty8#^xq^wL6l4R)!H%m!$eVYPdi;1^Rm{o((}z
zzT7S>{7fXI$9iJ=E`5N-mpV4s`J&%WH-!2&NT(>lveJvDTbczjJ%&qNYCb}8FTu2C
zBuq1*%W{2n@9#Zv5H`7U=1gWBy>YD;B|%RIQ}StaWc^m^j%>z!y*OHuaw##ZoT;5{
zr-sDjiWxI1FV3?Jl%>j;wGooE??HIa=HNN|=I+j`*3aDNcdxUiV2_6Y%$Voq?W@`L
z9fVF;{6an#)?xhJiG{vBlDe^ItIrdonyfO3oHQ?ig2cDbmz7yllZC`ceilQMruFxU
zME1{lm(*I-by!Nr8q+rjc5SiVs&kK(n^0jnF%BJP1^JUpz36{5>q>uUC!i~zmRn`#
zn6<Mc%J+$-$l7|9do`KlvcM9}Qjzlw`X5v-n9B5XkVWcw=M96Mohp(p1I`W$RohMT
zVyHA&<Jr0sx^T#bAck7}*C<0F)#ez8z%c&E;{&uw=fsL+-Tr#(^0Z{;JO@l6CL16)
z6KVOS#WF%*&^vig4O4xTPffQnzyrCUa&Ze_WQ~XA<V?@JzWy++oPJxW;Hhb@AYGAM
zCvWdAyiJ2)c>>>8Ue4=dB1K)c&=mWT2JUEpXBb0R$QJNiZ?ix*B!QGcE4PxYf0(u9
z3gJRel_78g@GY9&qt)PIv=`~)I{xUc8Ms`ge-6Wzltc)cv_C?;90Jbz4cET6Mr>ca
zSf2#5u}10(%Wl5-jsh(|vXrh8y&@RMP)l_RP&X8b9XZLW>4?`V1C=|1Mr8)nWamd(
z+3$0C2En?Vsj{bUODrD<hTw*>yMRDQ8Wx06_islmADe}7WhR9y;-BMP9keazhG<Qu
zr$#;)^OJ^PGLq{lW#z=8v&*Fkv(-Od>nO)c3I3P%Q%5Y&4&f)N>_QDpnVQ4K)ha(W
zg>u^U&;UjtEa*vC*T9eT+kx$Ri$n*sAU);jY|q(66Q^MLZ;-`<-~NP)A~Vs<fo!&8
zR~K4W<IdM_JzIzD*E&`=4D`sPl#Le?|9HyH{v{mY!o=ISD4tTQn5J!~w6`jZP3MjB
z+vXhI?||jt@VfMcUc$BQlf8|Jn~JH68rXQ@9&j9-T%dri{2sra7-`Xp=8jNT#N}Pl
zO%8lgZ1gUIOhs@X-eb3h#b=ahj#9(=SBAYa!9rVT$Cp^6(6Z3`%J)pB*$U2f1ovVY
zUx`5elPaBL{J((+)Bi6J$%7cE%xvoze7&7Ehq`J4yoG|(NqcTDIHQ$!9sA}U>c_Ov
zv$LLMq?@pq*aVp3+MAT;AelZ<a@OO?EyV}{b$cQG`-e!}qZjtxlYB_hDq^<!Sn4;h
zh1{wHoZuC`CCsT>{{pvJgN@z<(lw!;Zj=jiqh^*w%Od&#F8W7!zems4f>;7}k0lWV
z)f&3J6Qlo0$CsG>SA?AqOz_Kvh#4hlpmMz9<^Y`Wh0KTzm^cwFzSFxqme&z>_Xl^_
z$A<?hgm41V5v4(3!7BQ)MqQwOILJtVJ?6k*EwI&VD5-ZPH(a-xsy5#YAFQ&tl@(aA
zpN^QL{SNZpJ5c#4#53Y*`6g1u5rb532kGkv3MQ1hzomnrFjXIuzy&NbBo&jp|KQ_z
z;w*}T(+kWdvbPfj6crf~c*_K{gv&X(<N>g`Hec?nOftB^m-axiT6minX28Uzid+Mm
zV`H!Z(hwWrQG=Qx-N^Em94ix>F$#k&Va&mWz{^0@)|bO0%vEN2jEpVP(MMnFo9k`f
zg_WhB$+O~%Tq5n~AM>_o5zX^)UbPKD!t+AypyTQB)du2a-CJWY3p8#ie&05qFRk7r
zrAoy1w!nXy61wan3_c_ro{<8v{<0<0>q%=!sh0nWKhr-JK`*Cyy4gymb_nBN=F{#@
zt+dA2UtGt7Kaa~Jem+22BO7x3B;3*vXT5Rv{K~}My;brqUuB`{I(;L6Hgj5oylK~P
z%uJH_HY&32!Upa7Qb13qq3bK^P}^q=HZ*SZI%H;Oh|FK)eQ%KLbpkPr7|hm;D^Mc~
z4_}9Z!%S#T_48q?2Y4Kq-`CW?dWlAp2%8B6qQ>~mbDI8xZ|d)LzouVEEs9TDKo+MH
z1_-h^&|Yk)v&1;+t4wI01nqb{Tx8hB$fxj)ID@WEhlrl~1%*cRk+39<U$P9238INx
zt@Aa%ZpT{>$ML0DqfXTHm3v4Jx&wFw<4;(GL&MdkV9N5sGKsu`(y~?@(0te(&nTYL
zzv2U(K9or(JYYKGxx=kKJ6Y|%xqP_KvZ>h)po?!hSTkzSEmcYSTfL@M@u+Dk)u9HU
zFqVD;T?6BG^N1_RIFHpWz`=Bg54vY0w|fAj`Wx6*X}}%0xxGdfu+oaIa#AT~+u39f
zQ0lo8hM)?Q`tfFGJ^`Wv4j`0f62p#Q)H4a=hFpNBfzpY9j8^1JsWh~K-&_#MIM^!L
z1vVus&r#df=Z2vxYi$=l?Rz$FqGo&7*S}E8IlPpr)KLnK_6I|-JaPU~9;E!b_8yr9
zb6Nj&PaJ7J>l)V@6;|z%fYf23i+n;xtV?hBN|8W3iWx?}sAg?kUOex!t>Ut;#hfLt
zSJAvd9D_IMtR4u!`+oO@-hCumYQA*h=KF&NULMYzWj_Bk8}QqFjYG}&-{M6JdP9Nw
zyo=V-o&UoxR=++GN8F|K75V%=J;Krt-<~)TWLg(yyrs9WFT8*{_FFgSmJlJrD}v4z
zGQ&MyL)tHEsB}6Dgs+mwa~gNx+7toM<cR0wLRu2BKJ&+Fk)c)m^Xnp*EjCDw_*zy&
zE?+<*Y5#KNU;T^Np73>sIXzweL{({K@9NAuW-1BwVsCR9$l;QQF$V3%)$cD@b7TVd
z&&o~Qzf3*Fm7hI+2neKnsH@NHD_x+JfSxlnBk$3!zKfz`HJLx0RBQnP$?3gYxC*at
zU2=PShFr&<X>}KTFD6;=_<LgUj+P7@p%h|qv~Li^&s0mcqiqlt^~XUq=;5`1N`a@N
z&|nE8T+9@EMW><MM^p$zv1VN5B5HQr6adK$v<vF|V05YC;%~Y2+b7_Wr_1|>hOdHf
zZ<W~?>Nh1ZfwB_`w9kL}AvyoOCMXZjjsUvB1HWEKnIqRsljje-Wrj3F6m_@D8jvY1
z+p3b6z`Rs4jX1qqAz)o)f~%sFu=N>L>d(nziRM3h+`{u;Jm-MOWET0BnsYMs37M2)
zjj)&(Zdl_hi3$$g+Wd@1^`NNhcb#j_Xi|q(%ckyu|7^W_6ZH7?_LtRY<^+7r@_u#p
zV9nsyxwp)zweq@$I;jg=ADaJTUVA*#$0R%WC(oJ4Qc0)tzqNLV;=ir-Ak*!wQ4RsY
zYwzwP64`B?)g_>&Yy~0@TAPZ=zM^j1Vz{_j%`|iW#JB<?tvd~$5mcTL!cW)P28Buh
zt`*z%grM#ADjvkiHilW;n1gqMwAbq^glACQF}u770kQEd|NKARh`Fw!&=;;o#um5X
z=H~flp4G6kdp~w~kM>M4kv5+K@uA#3!QKR3z&4KHa4~T`Fa`udKdz4|KK2W(%sYK2
z<rh+qUV_b;@^=N9px8aN2CJm#a9smm5Eeb@R)Q_(&m8sQY-3;RHeMg`uCdGy&7#ZP
zq65<KR#t9O{dM#fYx}JX-Vs#)_2Szj49eS){4x%#X=m2G{m6ubhCaewP$ae{UPZ@(
zsud<ixBtmo)%EurouI?^nZ*%1$u*S9mR;Z4ErSR4fj3p%KM0BMx$fOW;MJ=?pjMGM
zh&69t5u_bX(u%DShkJvoTvu{Ya|>yMb@E-qC$)3To&{y!@Wd|R>tt-hMAp-Oc3J%%
z#YiSXH0Chnd62@ad;^w@d(AYxrdCJyM;y}xHkA{&*Q@7JF#8)PN~9CUiGrXDrE|Os
z;(v1H8!A^M!2D*J?nqXd;&gXyEt2n!n0=gu>!Dcol;IQBVZyo{S=|gbvajnMRmU5d
zJJ;5;b{z_HkjJ1k-qinX(NQLMOFUYqkLAx^OqW>RBwxY=uKq5LppnWIrY^rKx`$7N
z7g^{YPFnIgpZ@6k#3{MzNXs@&hsJwehS#$6TDeug%)k-3%8kNkdL1^LFFvVjprWTM
z@1$hl-#}HwVLHq=DASU>CAI%v$k|PIF@;xWKu6v|&^Ki`h@z%F{p76ETXuNz(}3s)
zt%~WQBEp6@_{Vt~_ckyl*hhH}S_{(*b~zK|sN=L5a-fyqK!0+<ijUFi!VHEGQj6RL
zcX6PsI+flK;kIL+1kzGsfC>-nn-TXVkKmv`G}{sKgp12gDhZ7xey6lP7)+DV9gjkZ
zS#Q$FT^n^sNc@giYtA687Q4SFF#HQ*gva|Y%xgv5d`CK{ekHvlRs7PTsWI}M7mJp}
z3l_{Z=oJ~2#zoNlYgAxs=*A(aYXa@d0PMgZ2CLiW(Psn1<ZkDHRBH9w=>m9_LJ-J-
z81$hX_ww!swhyo|OGX}LYwt&w1ilj)V6zBF^#2lPnHD^2%#G+{Ge3YCJ~_8i4FJrp
z`3-mpWSg++6#GhT=XkgTY|qpws%Kp~Z<|bFT4X1MkmNteIp~~<(sW7m2_cyE`T};e
z&#3iOCGT53KGHX{*95l?9b5{mFv;ko(pNRr2=0LW2o_H$UUh}F`{QQ)!A3;@{^1w^
zLuhcCe%Q{=PA6RpfWUV_T^y9nYqL?WI=q-|h=$3{gUMZrQ0{Xk5TbD+kj}Hszo7!2
zI;2h+z05eH<d4b<h26Aq6JKmf{P=wqXA&hs&kq|girvL++eQC!YDG;CW>0WYy4=F$
zDu#Kq%;)Tyh7l#b*R`rFgSvO<GlG1xv92tX48oe2uv}tI4pRDi{pL{i6gh-;-4!j7
z9&d#B(X>Odb^lK5i{d+fP4zYECBsM6Hupo`n-OQxJEZiJFt1;#^pkz&0?^h?vgY(F
zL&_^ZSi#p2?_pVYYnS#+M8FdrBw|NMHeg%6-!zu#+Zn=PpCiY&Mf6vCF9$(;$H6b`
zj|7!nj-b4Gwc~b|otE$_z@|Podm>>EeoHWBdUYE)K-7K`<u@qnhA?%}hSxvfC(B0m
z^0ljx>3vAGo{tddw<;UvJ!*azIGx_$^NbZoc=+>yC#OZS<ouXy{Ncw3vv|ef%2FvZ
zh8<TUsez>O_sv*$Dwr<5quT(*KMymwxH8pD+Lg8ck;72QRZ99T2yy>P@OjZ|k066B
z+aSw=Q9Hoia!%|Q>PIxF%Nb?N<MXpP*H!cfc~R1b$)g9y-6??MCFQt)xwhW$_F`L%
z-4mJhx6;OZwTH7;s{LSUnRjm%5^X*^4a3m3TxD~Qg8CtgtEYad{}Jk0s*)V1FMUjz
z+na25WvmnGg79jCL49g=-pT%|V{Y|&w&5aC4qnrC<$*8n>~sY)=SK%nbIkYMlo`nF
zLzmv*tX3naw|h_q-H#ELBw>_Yfs`A>P}uC(D0~u3F7pna%&^lgmc6tzT0)4D1M|C?
zh?nb)e$1(&8^7!+ptQ6F%AL90Rjs^1X6imxgU4LzWZp0;(7%^&H2h%_reiHAGDH0b
z@N3m+l*jcpcas9y*6}m0gbt4e>|+NX8M+$i?}w+nQp*cn=7zx%Pk4y)%YOnIv!5LQ
zvA1CjEpuev-%zfb1X`D}<M>ujyhd<%PGyeAz5`XB!gOB2-mUyi4;iAuN6d3ox7w@B
zNB*U-$;E2+q#iztpTGm#_iyD~YPEje!_<{Q*ro2G%92@x$qEB9T%tA)0{BOK8BDfu
zO*VLKE6PcwNxCuc{ChhnC{SDIAhcR0b@<xcQcut_1iZdzkCI6Lw?m9Ll?0;BCR_0)
zBOzK5@6!U-PWk{SEZ&uVOgLroXeN{FKC*C`NQ_mASs=2t<Nz$S+u+oZq04p32Tenp
z^H&0JKOH{!O|6iRp^_%}S7jiEKKfCP(odY_>}rs2l%^EACBv-pgQu7se$n+2qcVQ{
zEnE+R$0}TIRO$ayimxwF1I11|KbUPnv+@Kto}YZEwZuod#lvM@Sv2{m2LE;(s5^UD
z$S*rzg?bOv_uy&>Kh@2&28q<W9Lsu^*C_skBC|Cp<geR@W(QvK3WFN`2jEWjtbbm(
zHQt_=CL;eI*v;`@*v<I^yKR!1{we<-*p0%{E^G$ZwobiDE4fy%=3fXpm`<5j^LJ*@
z<9AQ?!x$z*IW&9r@QkX*Ms*h{=xX&#r`~Y9#s50^g(z(*rqXiTwp4k{jrr*@_)OPa
z%&<Ft|Mc&FgVNN+BH%XubKhwpnmC#yYPFl%8!+uS`f<I!YM4^!u|nY6;`|}^bff*;
z?Tt?RcokcK)Q<bVXm(~{(2Gmkx+>FGN}6D+9)G6P+8P*~in2Icq+0zI_l;v|hc|`D
zRM?+}zZ3L1svOtl0|oJJN@;aJfw=%xZ(esa*4`ekf2?HEa)@av;;mGfUM-u99Q`HK
zN~`b888F>AzL#!OUfo_K7{^y<PEqM=WA&0SFPKpP;Vv0n_O6D1eYhl!WR4mqj#Qcx
zN_rpkgj%swAMtem>_dyJHfr(cAMe@WkZi!izX&&h8w2QPbGqOL9!xG>tvX~(I{kvi
zvg5?<;|Uv{X<GeI%qMbqr3AZL({hk9-R#Wr)l-W8V1!a1+A|=T05O|5hC?oewSF~@
zCsr-3L6dewtfoGw8Ra#k$yPOLGqI84;s76ss1?*iR5e>IiCu-ljB!XLuhAq5Q$&D`
zH8R86M!cF;amTT@Eo^tFJ9fl23d`%dJY6tMRgZ;GoTntuwlNF<Q>jN4yPx#P?UyhP
zJDoY0be61c^@UH%eL+we@FON1IX=+=p0Zv~1itY&b=W2{(<R^*mx;bs0;>H_4GEm3
znwmvw*k~S)!bjL|ZFOPqUWte6+s)F^wG=ckPMO~0pjtjy(j@awk6{!2XGZV#iD%O(
z#J;re;~NVVT-QbUkXPMEXbIt`0CsP;unw-*bo7bGlNs4}2$9&0<>RCDMhOLt80F8Z
zY<R@RP-8=pdan!SB>i!FNqv-~j4#Z`o5@y=9p*p)F#ae(3ob~X+`3qlaYqTOOjjWP
zxaC8eR;|YdQKZkhe=1IE56?b`sig;98HO<2qgqkQB)N^E0b95`F_vZtQw>HG@BRo2
zzfHD1+#gqA+I^82))u-LD*B@YV`jd^S-D~`PP?!e_<*yO`%pjg9pq(JT0Q$wsBUkk
z7w1W&mvc+bX;+j9maWJ;ZRR)y@CKbfR(j89c<tPPm0WpWzVTbTofB@urfQxEETMG*
zW-}g0yyG{X0jm4M5|*%lDoUR(-TYF+bWtQJ$0wav864Bi9|<?JU?n78>S^;^5ml$T
z;#wdJTIC*jv*V^*S1>G03UzA#8pw1%+IPJdQ!LznW_kir@m@AGgb-H}>e{0RFx@US
z*!FT_WS7r`O6rsrU<J24w<UEY@!M2S*ri|WKr9|3^`_AA@~A4!4B2EJToF=B8vzPP
zcBf>YaspOV>LS9pO-9|x3zN1@$T{G(DFknvVntte5TRBZw*`GsB@44HFEf_PHH*__
zC7@^~Gf6xzp1<6cPktAxfcB#gK%zO8g}j;<cpYNo%9TLc@IQ$IUul?m!0^nKcJu!$
zamey3iY?714cBGPk`byCIfyXFeb<dhVusv)aJ40NCsir|cY(K{QWeC$H^WT_z{jHM
z6v(44TMa()URb6JK8rE$8#51O`B91Bj|=I5nHEQW$kZFfq0hn?)5<Zs&bDgO=pC6$
zwg#8Y5#0u9^?U|(s7gC{XM~=r%;@F|Ak5iM3hUE%9GoM`E;olhSQjD4&UN2cUYOr{
zH^6b$qlLVXvoH1xLomT#l;RKim0QRz@&-_znH6l89^xUhX>9TwHF-eFv1^rf185J^
zv)W5{JQ0-=a1YZshWR?EH{4f}-}dL;`QXUc`$XIzaUfUHk1hA~bWFfF6U$+fmC!Ma
zrm7Cg>=e8OG~AIg?8NQou!bYv-ls-NjwSyqbyS9i$$tuTs$je8B|t_rNjs@_FGjYk
z{oVgyAB1VZ2}1U4!7ck)vDYDM3Zfk(>q+_t@>Aml=R&(0>HMfL3qIT7UoVu){bj>&
zJx}535}zxgD$QSoMG^o%U!PTHCnQqwtu^$#?@q<4AIGzAI4r%#BVQ0m;Q0klA=NMV
zwhJMW6gtNt<-qVs_#Z!kt%t9T<XKcBgDL!uRWFu^6MuVy!xb#vQ#c!oj~G6_!WACC
z?(?zl2PCdbZeC<Fs=#|SW6)HR(G)|szF3p@8->SRkO>xQUKN=!s#e0vD!$g6j$^F&
ztr-xqw+fq5E3j$neTIo)DL9(75^I?kn43Cb0ELjKAEm!4Dm3)fYQ&^&-L{jkQAd>`
zy!O|^V}bZT*$yRg6(c|O$o?%Hs{w`lmT19S*|A4-jE;<R?Jg(2i*thhri<#{x_fTR
zl39K$EQ%bg)TwYnNQ0<U*=KRd^ej!+t^NRXo*O^Jso``~dqyz0#5f5*rb}x_wp#iv
z<blRE$-*sBy068|7gnMbetCbSa0cG>^#*?6)ezwV1G;_#WK?enkGHtT3}9_Cq*$oq
z`v8)ngtb+|W2R+u+q+$YMkYrUr;>IbjVoPh2;-Yn??b|n94r38`+)luJ2E-m){u${
zt?lP%Ju909K0uL*JUkdIBX?0MJ3KK1rHVT5_-Jh(SeJ9D_qFePBAz}_G<WyR_^Xo<
zCSoyLf3iVz|4q#1knGka7yxnuJt}N24}DMY-AX!Z?2yA$O^=Vy_^e`}<rVOIumMz7
zXL>03$Gc(j!pqRyp>8sMx6sGuYjUQLy5g8!9OBB$7QaTP8owh&Z-x7cqMf^*Jtx>!
zS;;LTLNL@0;zA!l*$sl5yKy)a__aC)J29%T24uvE7A2YO6EZd3ul7ffwVFs6X^&$-
z9jKX11|2XpbMP2rTYP+s>o*LVp$RJL)S1OA7oQ6#NlhXLs-vyyU7-MJoIMEnRqgG;
zA|mkdan%p!)!_=;x{PsJZfp-P6`Ep>UCG!9;Q`K?5nmDNW@pJppKgSOq6Uogg%+rx
ztFP`MEJTG@kMj{U=pCOl3=By7bjANeluIQ#@>&tC2iuoAfa)vlw$>VH|6{t3#%SvL
z<EtWyasKkcoFXP;is4mw`Fq(|Izi=-GBwSBrE%bpu`T$oD#fVd;+4zl{C-^<dv0z8
z-+!1Aa%og}DlUufh(>kOCDTJ2-A@5m+6x7eG<Sv3+CNN;wIVgU6cb+=O-|s+IB)x@
z4l{aVZNTdDbuX)dt#T<hpc&u5`zC{2!Uj6<zMmK{si1*Q{w0e^3H=c^C~*=`fj+H)
zF8o4fxY0)0M<xQLry%u&H5cuepg#b^IxQKgoBw@X5;-s)Dp+&a-Nn!iHs%$UK5O{N
zDEmx$Vx!ZNGX<33YDs-f3jNb~2)Z|$eL_Z{z8MBoKsj%loFzCbt{S6M%gL(;Lxwa;
zo}UK(I#HutS0@Qwa#-(6OH%VhWf!1=E|!Qvix%-`ec1KT+@r?QE1YUWu3DxAayLaP
z9e6|2y!1lW6`swC+p<vN`r?<n-wXYSV&)ImeXxWGP&Hj_8E-@rpYO_g&wrj2-<*mS
zRlF?nq&X8ZlfWKGH}9Gk&;vR8+u?d<e<Cuh6yMv`8M`o9P}!QdW4T$X^jC9!tpWZO
zmP`s`K`wYhwe`SlaFcfbtMFFj*4;K{!Glr!I@q_B(SXOR)-9~-_r3-adR(d&K}apU
z#@2gFaC4#vkE8o_GUGIm*1=A%gC;h+N~PW@Figc301Fh)?^(nKjx`^FF&lv;9Us-!
z-Zl8e%g(epcPJAWN49RUm$dbnTZ=?W&Wo4SEu-iX=F1~ILgqV?Ho|E5-<Nafotf{`
zwb5YyZws*O14nHCXRTCkkHy(uknD1Zu4*peB~=T35<B<{4Vd0Caj)ek`2OdB0?U8~
z5^2{TZQ%ZALP`wZI?b^?JYdv|QD6hd>H8*bN*?MklBc%m{_|p?feq}+!<R?q_2dfi
zy5if4=S?9R4q<Lem$!kyP@Z;%e}oyJUGv{=QrVq9&1-V?g@K`gfMp_x7W(DiCF3)}
z*RN~A+DTNIMdrwmfF^zZ@Sk@oPMNBK3rmvikVQZr7=UE5J@8LN7zUL8jQ?S~CDdmt
z_DC<bMCA!L2lT5t%hD?MCnK%E%(D)&6R^~*t>yLOoms@<9nWzC(`!Ra&5{~xXpymP
z#=4aU{swhelepT`w!(tdlq^!tQC16{31!)w-L;o<&dQP5DG!2uBHYuni1%uiEIQIx
zG@w69Pd0uBUgA456q$9pV5aD)8uuK0`1dmwTd*UBn&}TqylBPu_viMvDMO=hTIF#u
zaoJ=ZB|mh5s=y<C+VreU10ndh@Jw*c=)6>4qtfn2MdQhIoAqB}(cDE%ws&MVz{Ul7
zvN!cZ9hO-gwlUG*-%6N3YcrR6vnH0TI|^&d)gzUXc}*eOp)Wlt%z|maMK{<KwFWw^
z$jnefk(vz+B#yEfoy5Lc2pQpj^b$$c{5d6_B}Xzt`5QcUiN0D|sir>x5YO0&IH5~q
zaB%+vX$5^QVf4~W9<ZYiF0T6<o-{$rB$LR_p(69a7;i?KX|!yFWyY_ZGicyA*tLwa
zY@qM5&b)j#paEqHfhbRE&O%NayT`CwFMr*PYrHmUPijXgE9@t>%A{c%_0k`fi9UPP
zT50`44xe?JxP3x9=nIzn)pfuflDU$DKsOm{gtXyNHt%aioXeEwIdn`Xgx(3&H_4Tn
zan@oJh>cz&V5GStJtRFkF;B%XLHp+$uA8#Ro0$JPqa0XXldth^Q`O!}93CAOj?L0_
z=|8arVJ$vACK_?I`+IoISsT1*BQn`-mnV|-f-T(NcAzQfG&Rgt7lphiYVG_=A<1na
z71Y2Snh-!^RrOwrgFmpb|AVlAiY7c`YR?4x$uaGX|I>w6yjC>=4&8kk_4}9h5+-q&
z6ScLi(~|n+X1pYqP5k^3bBw_#eJz;wK%n~FPO5?Hm_jB?ahJKqPv6((en&`%RF72!
zq6~*qG0JpdLAv#?Yrkg)d>+iZv#F!t6vn51hP-alSUNAhN!3xshhqxej+ZzOqvTSy
zp7JyS7+xL8RSmE+(K**9PL2hy;sY8s4c~i_(I3o)^~JM%+XoQ;U=0ZQ>o1vRUoe;J
zLDQfvE|w}@k#-|8h69c1BzW|%%RRGHGl$Y~)*C^rRnAS9BP<tpugKj2#~5tJhhe+g
zdn+L16%l_t;U@VjusLLx;`C8)GFwHTQo>ijb3_9OL6ImM=J!=9m_DP;L+@8)2}=Jv
zA=XpGjnL5HlShnukTk;HjrFG8&zXhM5e^<FxQ~%Z4n=wUr!KK~9$v+7cXw#BMN+=K
z+Kce>Hh`wycU@Z8R^8D9y=+L*P!s39OFnb*)B&5vLo6*inZdq<i=zxX&S#FyTjfu$
z5A5FhAFKf5D8`lZ9j8m?&mj6Y;gc2KBfgWy97{cr0DAIIM@0>aY>@X^?}t;QxjLl=
znpqovCLk66g0pD!0`I9pnCmK!mQfK_#WiaRgCB3K-KWHF3h-r2O6xMQjzGO&8JwLh
zOnLIcnKOsode{`p@~h$>nIEPi!e7oX;+u){5IeH}T_dJhk$z6L0D{AoeW^IE0cu|_
z-3vik*C+60JwhzN0DGHJ#zR3x)I`6v1oAZy|JOb?H^r`1r<czeJp8Dfu`^z46VFZc
zv9seb5Gx>}0cCaL{!Tn|YUce;dPBXcjbR<xV)MA-tYmgUR`voW?+c{#ZUJl#T*^a5
zE7mEO6O#<}38BqZ0cIsZcUOW;YQ%l-Sr=_w=a{Wr;7ui{(ssfIh!Cav&4PbA)z#cB
zzU?soSauzs)0B<vxqSMF_DP_I81}SBDWVKA8iyEt%U5QK(H|(9@D{6jw7M{F=1<?R
zlNzCA+$*d=#0NXVw`D#V)g$X5>Yac57XsrkOJD|T!KS4H!;u#J?6QkPRq}EdG!u`W
zi%_gb(QrHXC?j<0T>2{5J~pu$E)E_iCmpj=chSwq%`G7OTGj>y2icVxeAo~m8XlnR
zf=wXSK3dFXq%UY3ZtFEQjhrjk_+T<>p)V(N^1@unD+oS@h3c`WaxV@!e7YvrsPRCy
z`K1)5P?)v)-FWC1Ot|9`VU~$4+2I4ubh^{ojYg*tF6>(<s4Jv@oa;bvSe&Py_`>1G
zXKV9l=$~-c2N#}F4^ykk)33}m8o(&mnxjmwB6rd4CpyT?=135?Z`DE420?HU$1Yy7
zk^g1;!!N_u<e|W~`{C#>GN&G=w;7lh`0uLU;#o=<!vVV55ly;Q3{RN#f|-n75f)%5
zFzPmll9*K7Fg?~?0~C@wox`d)7yi~_P?EE=4i9DTWvsB$Zr-6ukVQYCuB=NClxg3!
z{z{0!!!54hS|}<zHPo92vBE41)<IXiP>()N4=>PI%FZM#C|KC6tCbT*hmQn|#!N9>
z*h?TtA$~I9y1_|!KkSbDC2^?G^@8_+#X`RQknF{Kroa5S4e3C7=}a9&T%=~6&-pZL
zIbk7{*|EQ;w#iV%#K7v6Viz#uhYnG9)mPr5%0Nh;3KvsyxOW0HV0%8A!~UaIa-M{y
zWQQN@2_}G2k*`3}QNoSFTv)$^;(`JBWCUFb^hKiiInlX3;C_c9F}k1jPGc5!pN8QD
zJjBFV{VU^zI2BOAcY~X^rJ!y6>~YqH=OG8OZ&ewNu57;{nEv^3X2ZOHrr<(iW$R(v
z4~=}RuV+FGADu7Err}YpEa;%&WJ}i^r{O=P?Ugs}a?)bP*<VjMT11X^SKf+^iT}jE
zm=OX)dmJ{;Oz1w5gWF^J(X}t_MkO9$LmZGe7!w6p7_5_jX@d;*sQB5f5&#O0SWDXT
zDy)MJs1`9pK@xaT+c7lmFWKA_m_ZCzshzXWSq8tz&%OZeiJ8Jyo{qyg+Oi#aGw0bz
zyPuh?f~s}euCyNG6g+0h<D7voWt%=WqxKJ1hO(Z9&f=(bd<QJ~u~AI7zevb+J9M6r
z(Z1oqDVG1Js6JA<c!~wd($l-34Gty)-c)A)U0n+CxUN7H#*DK@sl80H88v)!)Jb+r
zV35)fdMwxi>GHNpI!KE3mBm<+aU6$EPyZ-&L&OMa6PFU!DGRuj@y5aNR`Ld;9ZB(v
z#G?^W5F~M0&)lO}W25<Tm|y9rq4Bh^Gz$kGT<+kWRtQf;DhN!YiU{{G8sz8so~Q4$
z(P~Km8MTlOI<Ny&-;k+(F1XCUpvqM1T0e@5?=FMs6-gx2N2g@2c~@W}0}+&rt~nZF
zAK|4Yco(B4>FWLceYfkX-tPA6t1TQh=<0w3$n#hGz2gJVIFNMuKsk(hF79vpEVA)e
zHsZyDQ#R7tnAl-|Qp1iUSA?|Ia7%O(O2foKu{3sa$ab9Z7gnMuCSpoDjyC*j*?gU0
zH>f=;q^W9HblCdbl^T_i0Ng2THMuHw#z)3mPN;hDNIC;j?=Qvt#w98@{Q>kwR*N<C
zCB9J723kCnVkRrFs-m~1yp{!QXR0K6GO^J*#Dn-G5Fh8lPSwv!PI^5-HGL4ePwrN#
zMkfE-ZA9Y{hFBT5^ux*7Rt|E~Y76Ma$OUFzyj(wa5H@${fDcuAPp*#N_Das50i2WY
zS(4e}0H#&WCagE7r*BX0jIX>e!<4eZdDr%12hq$@SE@wPdYdG2&!(4y!y$3Ewmx}?
zsmq94`5B2K0hBQop+C6|BP9%a5Ts*R(=ID`LVx>e$SOx=O{3UWwA<n1b$ocrlf_P;
zb?HZz%hmQ-9_Wili6f8m2flI8m+wSJ#H?nw{|8<SY^&+jA+AA;kOQor5{fWtr6A-K
zn%Kj27sS>LGx8k^smI{Vm8HP!zEn|6HtAR8bjadx1`}JOt-SEQT-BOp7m6C!4|7xQ
zDz-Z)86b4+&OLLdEcZxSDNm+5UXF~h(Hvrgs+aN-0#q!ex1|fFPW7G%%of41ba?I*
z<g+ZI&K7Ko<vV5OY&vBjl^X4BIaUk)WN$ye64*UqXk#rst0K$4nQjwV+qz5LvK;lV
zmp^L%!OgT|q$UanC|8t)gPKVpxHx42WPZXPzIi*jyU@k#6e-P!B(64E<yyCLdHPC>
z+%t6dsb_#L6q;$#P%QTZq2af7T}!B%^KTAG?oA8mfibVIK05%zZ$wGKN2Rx9RuzIu
z^dJzU;Hm_i1|YILf+I1^`Fs_JT%1^!{udc!FThtM2gIE^Lb`|AnXoil*vyk^6q%n&
zZ!)#WZ2ENm4eYoeaK;UUQ0<+w#9O;D0!bRFP_My27jql!kLwCaW{o(s1Lk|@57vvi
zsZF81h|O{oP?3%l`%6asAF0Seuo2wSwUD4dBZr99hi;WJK7)cW`(miyrr>j}5bZA>
zmBpINj0t$ueD}44iRhHV$^OPq##=)!l(ugA#cAp{`bQtSwrHs3x)A#S_rE6~f6u~Q
zsNjWO8^o+R*K>(75vH5x^h%-d3{IZaS0tTRmr?^8bV4YmbDbRPePTVxoOoJaZpiM$
zUK<-+&*8PnshWA1^(cc}Q5a_ZJx%^_S+XlpM@_&NP+r%JgEifi<AM{2V#*#Ymov+j
zX@9nC{i`b~7OrnCY`l_DUcyhBgsCaRtMXjSH`t7uF&4q#-SlwdK8TNSy1BIWb+CIl
z7?UQ;q@<=i3pc{jkXuqCfP(#!6Ek@on(z4|bChjc{iMWZrYfBZV0c53gmz4=-xg6j
ziwZLmFKJ~`|I9E-RM=zYxx5D8y8}?s%XPH@nz|Weq)TMCZ-hN$5s5~5i7R~{!#?y<
zPH7LV3{njTc%?_yVuA77F{_g)H$I#3`xL<QxSI}4(75n8?0^*}T7vSX^VjG@jpRDW
zP4l10aKN2S3b(OzcpYgWR)*E^8%)&>^G6zWvPj}CrJcRiKAr*FgIt`o7b^`!*crfW
zKdXc%tLko?y5*UDu3xum5q?iK=xBk@SnAo+TCFS$$?I#ZsA$jMX<KMIWn{KiURItf
zQCT-+sWj{5T7}2|uQa|_sL6T<lde4_s~-HYW2hcbX1hGp>MCkFWAH=>RX!Y7Fy+Xt
zd68F56!3}Rl_yRmR}!7e^!oGl+xs4`aO!jG2c1{QT!@U4zF+xJhF57VJ?Bh)!7z{L
zh0A_zSGxljV<b>!4sZXAv{-}BCk%syqka3E9`Bvxv(3n<zU?M;;KT6N+KK@C)QNkO
zBarp!3|}F<_Mt}?VX25CWj>z5sg4qz#`*seDxQ597RpKEn(hutPo_JJLsZ?H!M*PO
z?(uU*iPpr8-YB{-;T#@nZxb3)PRmnO%HJox`MzFqBscD>yqxZnC&wMwhM3KpaqdNz
zLPEk~cLcjxe*$D|FPIr5FA^rEyG7Rj9K7=D^)>tE(Tg4V1|m64XLtZtcJ4%ZA$<k+
z0q)7G`06D+L;=xrMHoS^Y)-(AA&l%}o~%-OCU9VDr8DH{`r%?X7QtMx-j{gPPOMnI
zAq!O@|1s=B<5w`=oh(y&qrQ9yz{OHe*j#0w9^V|%w#nPB^tagv`I67|r(JL_z`KxI
z+VWSrZbRAj_<og064hLrW#{-DRC%;3LrFfetlIVYKA6?%x7z{}(#G-!rFMUB0G~Ex
zLgo~7AJeLfckKL^&~h|i#omz>86#3;;tBR?OqYXe#z=q5?HLIXkLbr5QOfDd2qWh;
zs6hH#d;tE{j<W#6LX^8pQqu=e4mhF(%gsO6A|b-^U@zA8d0MO`QdP0J57@-eA91tM
zRvF6czeZbuP5=1+WfzInV_L3Sdihd^p=&_vR@;im@Q!bp%Na01d=;l9^^ZcV>r*Ka
zQjZ)2VUW}x?w*&hRu7;bCW_b3(apMXgPQ?y0=y4b0fqxFhQwD5^AJ}}I)9Wsb$Y|k
zaEJq9j@uwyWV6y>oW0fwSY9rCKE1u40iGXiG27GE{J3{dpFixftEAc{t=sc%`gYf&
zhfDtIdpAMl7PVe&<8Cux{h}d<k3n&R@CJSYQ@JJ&oSnSbz%U7-c(+}p`Kn*+X7`oR
zZ%#>3G{^LMe{lVF@w~&GfME;&=Hv&6wjWQHuLn^me6e-8?nf+3lG276yac4s*R#6!
z`QvXGmV9nubs2-pF4mq4dy^+XtkmM+L2?^b8G><RC1t*E^C)gnxT)7v83PtPnh1L5
z#_W4!)Nv$T_(QVrcjT<RS@|RP`_%;^<;F0-xZP*(pu3|E*RozfOIwonxzYpJ_<&e(
z^8p6T{&;(*RW|0q=8z>uM91{^aw{;ebI@5FxQWIP=vG+t#B}=tfo|AwNui|sCz#R{
zh_G_>DmJ<8GsPRsn_?ZiP5ign;a$}F1}a9oo(NM<)4*56ns19*8&AsSxfhDaN{n!I
z9RNSD5KMgg%q1Wq{lOF<1+hMo4&s|v^8xq6QRadRqSZzm@lc1DU;rOh7l4btccR|Y
zs>Lr1FM*RYcc5fIaia%63HLp<s~FG@8SJvJ->}ob&=CKz)aO|Y!XTZj%yZb2zDfCx
z+qu_FkZUi4p^hp&tO#t}<gFigKYVo$tcsPle7XN&bn)1^e|RR&0LXKTlGh!7jIEpl
zTc^f^NXSI{vrO7;fTUH^l6o=SH(GF=E|pf|iH}i6n4FSfW)e)_u(YgmQ(RRq%-~xz
zRfzphIx9#cL^a;t{}STI(lPg?zwN1a3A3444WcGs#Q&#S1vKEGV^(Q<aNw5s=iC_u
zNw-p7loczJu=V;U-4VY`Cf%E>T0FnDttIF;1{3zNtJUe(p_K=3G8GjPkXy-KLgNI9
z&3bd;AgFH#H|PF9SoeUR#1{ykg>rUYAek3I``cEUw44M<QQlq;H>m`_XSlo!XXQFE
z7+4CkB)1NTK1UgR$o9XICqJMnNF)VuDA=2AbR(<d@oa2;mNs^Xm5+hc%u3{rsh*3`
zi^#+79Cl~d`SZ)O3`d;<{ufT!P|dIt24tW+KMM%S3I_LAAzr2EL-UNNOT03#jdfuQ
zU6Z`IiqckfcwI;Giw&-_-0JFX0X3~wz*SMh2IJ&z_&9u&m7;D{3U@F_{pSeGzt_fS
zcN!)hg(gL#E3HMPv{%$R?y*k-w)AzMp^oSn$w4*?)|>^Gzj{qd<*i<);*}=dIVBEO
zW6JlWbm?!Yp$CNzk6zS*$nVSLhWCrUQ%@{fn`dnPai7$+4-FD$-kvfj;y;ZMb?Lvy
zi$t4sFy7N`4f^frE=~sqs15O%Dg<xg&QH~uwg$K7!e=kN8VsyB6R-Cu3<qaG^UoI^
zYWsNo;kDpvOjm%_{*@`Q)mRS_F!jA@F!jA0RA6eAuxc`O`Jokbw8xkaLhTciaE=}g
zH|r(#U)pw?DclIYi?zpDKSijO?yoY8nOJ&=lo$9tMV!^ztT4D#oCVbAu_F8YgE>Rg
zxR<YBrvLM2CFpHWID_Ahl<?QK^zYxR3G?xh-rFUm-#C?|3JRO+t^yJ?qfbRYcc0$b
zW3_IO8=CQxKaZGP_Ap=DFC}t%JR&VlY>~~(2o%&VB~yjz64q86Fnfb-saKS(ams0-
zFrih-FxydrqTHGh#@Y|{OKU5TWq6Y^wW1Byn=V0WksxuBhieK>u$x%N@A1mCx{hPG
znujvAp5q<Qty2%dA<)qCz~BB`k9F7JeDFkgF)oII^?c5ms}4OEg9}mK%FqC&)M*z!
zm*K!?nkA!1>aCAy4N&XuifLg{zPaEI!5M-}aSevRj-<Ttin;ni52*@>!t&9i4U$Qa
zjU!)ZM5U4|1Cu}<WQCOCnM4suyQK{hO(N;*Gqv!`8hBU^g!br04oQxHpkeBbkdENw
zbiZH3O)AI!Pkv-fL<J)(aO{C%rE{n9M_1f{VECfAmb7*omts^bP&GXWx)50i>m9i+
z<9hr;E4CoBgtPz&8iUdOSMlR_{WJNPJ&w%UN%?}^-Uq33yW|C|vAcM(6~QNo7Psb9
z7*Bqm@;_=P!%&DdpmY@v&##thyKTYge2G>C2a<9aOIx$}_!eKJCdphyoHCd+J?}KP
zY(a5)rA|pI(K_N?EEv~R6I=w^krP@gex=}I=8^Hq!)aucP~mWYo!=(rE<0(-=7whu
z!E`aHE6ZNda?`MIHt$`Q8^(?w3Y9@xrtAstAWPD%j`)0<^?wJ@Q%=k2DYUKP!P~%K
z12%XK1WG4Kp5eGti@B^&eD{n?MQ&h4!4;rL*O8a{IOT?TMG`0(=HQl;6PNM5xv=kz
z@X2^}3Drx>ShklYt2F_K3$iu^TpvRNzb)En;Xq;QW5HL5xre*3?0#0n-L{(Yh-y)g
z@*?JRagIfFY^h#))vy0GS<J@D^UMwk?8{4|^$HrJv+s;r{7kO=;{3eXpMTWD<K&Bu
znO#4wmM=`9-*@&F7pBVTWn64F2|Nn>U_~>)_Wq#k2$J!KE-Z=Fz@osF0}k`+g$*Dt
zW=cEOX2ZD8f4`tIhzOJ=aliSJtq5mTh%w{lTgMUdT_uc|8dcGKv3qe98L7uNIiG8w
z+43{^<%jiWuzS+fUWIi9hS~^AJ^lOB>iVYhE6=zr>W-A|#Yv4eIR^<mCWfZmrhd>T
zEdDzHVQt=SrLjChp$BIwVctA(p>`HQLUK@JTtP;J$DIbu_vw+6*X%(d8HfcyFLyu#
zv3g->ZOb0m*?I<Vz+0lD<!CO?ucKt?_NNzEHE#~{+gooTD);X5SBa{~BWF;r#zS{o
z!}o3j-;ox8-P;vnQ>V2<ZxUp~N5|7~odJxoi>SZa#wLXrALMSmT?h+|GJUE<!1(vJ
zJ9<<B2zTx_Pru|b9A4AV<5ph{n@yJSA^N*KEmdA8|M=e}_CBXE&?rSKMv&f0XvI2b
zNR)Xeygi8Q%8b95Ij@a<?9_}^5!hA0=G+R_v+POnRD$i~yjb>XO)SE>etX3b?t$5~
zc|kJzfH-Mu+w6XeNC#2EOvm&{Bnpj=o)l6Uqly!I;XN(?oy2*UZlp|KEN?_RSmhyj
zt5^O(QB&+Ah$8kEmeeEP9af~wO?Fj`zSWL)=J-q*%*NX3Juy(RPmp!Fhb~q+DE-3_
zf*gd<$w?CSvEhSpKQ;zQw*stPZ?f<LT9Xo4U5(&GY^2BX-{poEdZ5S_djbyJYpQwI
zaV}_1C)_VF>1jtV@4mu{5J%k=?VcE*>MGv05H)5%5$v#>pI|8#Lh$;te83S4aXh}F
z%Nd^lnT;GeC0K&~s+KL-pN$`%t7rkL0LGS0K)^a*Ep_6|@@EruOXLgtfL<LmP=Q}B
zlb_M)!Xt>zFU(qD+nW}k&TODkpd;^2$T0}p03Ef1c#mKw@c7(lgAf7KZ#cdECV(3l
z&O#s|ATNw>xFl7R-B~t^8&E?pciYysJT>fs^GD!Z&3ak*TDRLw{0?LVi=Hov#63E@
zJeH?O4%QIv8%ony2&Ctoo_K`d_ux@jJh4~|ey7JL2qY;aJwWxjKmuq;X3uz(GR4X#
z%?v+|FbgB!8K&~scM)`5ocOk9H$l)nT`&(<3@&~#<Y$dAE}uIqnZ0O%Q?`J+lT#61
zEV*$_UbloBs;IpRZIkRlg^_1c*yMJ+{(c`Q25`KX#aF?{@b)pOcgEBD>YufhtO<(X
zAV&A}DfF`(+ir#Gjz_pn7g}XQ&Vz;CWDKy>mx2D`E6z64!077?j?Tx4bDPdhw@Eqi
zd!G*XDp^F>#9)JZNlTQALFS>wUL0hH2V&`|dk30QugVLfL;l3tXSJ1K@%U`n9fb;6
z6XJE=F*o#E+@MTY<rGOpZBZtP*GQw|9%yuOnw^hm77&+=?^iC8QC{+$th?#qL%GFj
z<p=tRK>$f>=i(=!Jk`pM{CIqk@m?4vNh+g0CZwsy-YJ2ReJ_EH?hD{n?WWQ=e!sr6
zzYG|8`1CLt0xU~i<ykbDfBoD=aVoq<UI{tjBKP7Y$4q*POYL42T{)Owz*X{y39Nr^
zhqpXZl#<~^c1qh?9_bguqi5-%gQ#AWvHcf)qt@hhnMu;<88q5=R|eVgg%CQ!U%}Mg
zE#upJQdy3_`#R`)ou6(XqxJRm2l~lk&`{jWnXBP{^t7NC8wjFzXlVEyYl^+81XS-t
zG78*3^HZ>#)Cp9*Y^zwY0M<H?XJ|G54*;=1PQR@Ks#&$H!Q7Y5$CJ8wqi(*r+%`8~
zErh!D<=5Zo$UE^#7u|vLL>yXmH_W;l_1fFqiOynJ>Iy7@P9L5{;O$0*>;WQ-^eU)(
zVKsVDuD{Y8oMr_`Cs2@d&7dkOnrcc_vRN$M&R5@+seXNq`jy$~D@=`1yqSb5O7zuI
zWz@E(efeBVIacL+*{V4=Y2q6Ji_IGC9{Ay2xwB#|?bcPJU+EpF?7c(oEOFhh2?gwG
zV%&j;z8nAiO1$%{!(ZEArfaOmoP)kYvc;8`<ksVCX-OLT-C2^?nc6P6u%);>^!LcT
zNH_HApI;i(x##-tJd4r!ECLE%G`quEFSEH}8V<q4W(-?~?&2VDZLD$AbeU^2Q*&+{
za58RC?fo?^c#x*&KLdEURrwVVV<~)a7HvhlMVf~pAjsDV2vQ=13Y5b?2+&X22Wwoh
zUqldrE9MHsplOn)al}N{;d5SQWrd^yq<}Eq^jx4C{NpSJ&L%)15^_|4NF!u#lyq_%
zlNNdyEYL3z&C)y#q0^z{E&??25+W6IWI8qqQwqU8#xPPqMOv^1D&Sj~D@X>f>Bk8D
z?KPq)<E?8Y<eF0g04yz{3y9+pEKr<M>F~WZTFBEh38QR^8o*DKBc8zY$}9?M+zCT(
zIhp2<QIuTpyoko6;OK9!vFKLWl{#E{K8wx)?h!R`IPAuVlIe^@<K*VzfhcHFH@9Mv
zt&@;5({eoSV%;|#Y}p~hzV3L~H#J=&j$@dbafcmFq|T|9l-yXqkoXef(kyMTw&#i1
zNOHd*Rwm;h>y|Av(aa4{@1(N16+3FT-E)NAPPmL1Kqn+CO0`@hCzx;~<$LHzWf^Fu
z0GYP>aTB3M)~&qV7NF~LHwXyD%(V?{xn6(+%6+UkL7)drH-d0TrM*50MY+5h>ngqA
znRMJ(nR<eeC>BTK1<3?_R#wpf!aH^+RB$>;(l{MQJU@oLn5D7!By3-`y^w4&9-~tT
zfWfl}zz%+}CRRl^rvaLf9PO(S>^Dok%*HSH1&<|ajs68dDq&)k-Xhbv3<PqvCr<2D
zrQdM+at6~A#X<V96AI%$_yV1R985`Z@GCDa)9hUF=btk)Li>2XLA!4`8KABg1j)v~
zZO$*D8hr)H9auT^Q?x1BgM4s$f%(T7j8M&yybbvansptiyUht~KOn-e08`>@@7?Pc
z%jqmSNi4*P)@iYFK55+mpNk4TK1D&(4`d`(&7p*jGr-syWy36;HelQFxP?@<{YehN
zk7#|_mW#<@jbXPYUm(ipPxRkul%Vq{VW$xU-a@K6Rsx{yVYeSY1j&arq49dCt><LR
zbyFa2rt?BIC#u=}=(Yw%jW<SOo>P9HpjNE|%eKcua@u@hB&YqoLbQh#LIgh6;#<A<
z?IX>4eLu^0mgMB~(B^J{ZI^%~tNYmZd>`vx$UI88%^mN4NwShL^p)gT+1R(1Vw=7A
z3Nq|&qO9flhUw`Bwk=D;R%p4{^E@3Jt{LhU4Z^@1MA<F*)Id7BhAdmvad(ATF@!;s
z-5|<}8CoOAihIpTZWg|R5Zi965@8#c@0|eK9CCm0wei$$!t2t5n=9`xxHiWzh^=>A
zY`yQ&Yv6lkU^+T>sKK%2G8+d5wJ~SRr-V4fw%MJRUJqtGYkxEkLDKu%YxFc_e4XK=
zEzeeok;NgMudB0@)>NJRAQ>q8!3w#uQjtdx&-=}cOwmO|8rFzfhM20)4f-pOXSp(^
zl$Hq+%yW)r!eZZ)VQxMckllYnZI*EF`}Q)K7q~XpvBPzSEsF;@&_jw{kC`lRLms&L
z9o}9b?Y^NTX_>xWDAU)fEpnwjCCSee;>|NDy_8~iWn~kRd`XSY(E&diAB|9uvc*US
zP@X_2<l2gtAC_B4>5(GpdIlm*$?g=b0zNGwM$2%`@dEK_z!~H0_HU~DzPAFywFASW
zm|K>PEegPkX4}}X9cD9d;qmE%3!J`HOPodt2)IkMTd5{)QU&TN$j9DQv^9j?b=8eQ
z!qHZ(_H6H67MBW_&<t7}<1|5C8%ndvcUfE=W}@Z4y#|3{S%G`6Y&>whRQ)*H`%uMk
z+MXV}>@Mhsha;%5w2xh>&hp`<T7`IVr7Fdf&HCW5zlI75#noz5g++=JxGEP|d9|Zf
z_EYfI>U104mD20hl^AK;UQAuVnlfb-Yu-Zr{Hg+@uBJKILv~dx`-D{|voc0^Ut+QP
z6lhy1!P}b`-Q2PHk54{Ed1-SJtGpMp`QvWQAhZXBE=lCx_0ftRTyjnGNtzYUNWou8
zb)|QR7O>R4D<}+g?*xS;&e!_??ie`WpI<p}fW12^;oMtc&Y=czUBkl6qz1N(z`%jW
z2zCh#DAOFrq0Yn3g43{JDCy+&i+zxCE;tInGqlu@8kVs&%2K5$RoPjTK-86Mnuv5m
z7#adHuKm=^qAvnrUg4~;@9kM(JC?=*W@Ah9Y;1)F!Cn~nm|MDT7^ca6e~Z0y{mr$}
zV;*ksfih5tk6ZlW{Gmh%32fJ3t{-6CB^u-|q}V5x2@6j%4U2}pzmDKBIBnbtsPa4E
zt5CU9C?5z-`%CFbfoU4YWR~-j@|U)cML_5|Y=eYB$uv9pS4}fb$9a6Vr<^suk<*6s
zzW&Cp8^U*dlLLoBWxtH)1|Y<x_kJCKW+W^hI1RDvUG1d-2{zO0JWdH4HQ?Sd*oO3&
zABkw$>KfQxTClKm{FtU0-|F4*Q<{~%Q$3Mx8KW}EYuoK3=LLWuNvc9c$S&YQ`uMj!
zKgv-k8VlqeY!|Ok`7h?|u^UgxVW#WoF2}yEb8J!WV4`abTdw6>p5vMxC->FXsDeZ^
z0yIgivuzN0Gf6KcA593}>ndAX?qK79DDg5_Oy^P=b4jd{ruUNgu*;pOwk=FiWj*QI
zCIOPF%qH?AfWQtAH;OCoXxT=+Sz@uSYcdsq{hn7ENwd}4Mym6<<+{GD;ea!WElM@)
zdya`&sJToxEKhSDo^|2)82!u>o{6smkw>hG)<S?iok!B&Y<YolX&aE-qX|d*?bt#4
zG7@4hp4)A;V6;cHCXGcMp{SMUq7k@gLh|28vRI0abl8J6cK6VDH9Qs5W;?lRfV}(R
z5F~@}Ui~2Nt6<J@*S{bEj~h?kXo^tTM5!OQ7D{ilSV+-j*obE&JKwvbQDz-yX8_2$
zw*ZjoINZ~ik3)wuY?&m)zRqoIGR>llhK_GM@Pu0puo%9!lJridQ}M}2!_^|<{*sJ{
zM7|~|AacZ_Fyxs`Dc%qlYn={`>Rw;LW-g=dXRY};tBVbg^Vf!)O>;PLsuPEpw!;ZE
zv15RFDx^Lp7W1(gXm+5Rp5?K1k%I5M>RPL;Qc4vN3T(=&lKI*y0VM?=r{IYtG*P8U
z!iY~w>2OpAI~<``Do@|vdB!4IjL?r+20U6a<`R_=J*~qcF46q5C_i6F#Wmm)auGq6
zKX`B^U9iVwb`!ej)j!`4n=ng!J>=j>8QPi)A-N$!5~bMD8MOdu4~TQe3A0Mq2^Q!d
z3c*{wkv@OgxRXAAdiVOp=TBlUef}gj)8|hL)A{@<SbY9e*8lmFgmgZCdO0uRG(8`E
z{v<-lj6Q#Qn$Ds)E#RJjT|a+%GMnWm&^I<hKYpY<9)14wD!t^{t29cAL%E?oe=2v>
z=TDcDh)zC#BC}Z>DHHSOPbA}?KLK_2^QSQ5zt2S$&d;CbIdm>eGu8bDcmxk6?DMBt
z3R4@A`12>&te-#ekFzwNXJ3HFzQZ?epxmCIJ<2sZB$|gE?s(Xunt_QHgxCnULs>|;
zZ>~2rJ~Y9*7MDBUJS8{RAG?ySUViN=Bg9O7?Jml%9T#7_naq}1VZGAs0-w9X(FTXr
z2Z*jU(6R=YR`Ff?z;1^l`K%H_dOTYN9EWF>z@p@p%}>9}V(_MTp1jJ^F~n?<RR|FW
zB%G~JS0x+$=1hq~)zi=O_6^`RgN6K#LWrF=TjGa}tAcggd5O(prF5ySdS9ww`?@IF
zd@rh0b*XN$IseT@tLp=;_u64jz8bIg_M?9K{Z$QgBe1CJVVCJ1wg{uxbGU|W%k*vL
z5Z`ycg8BHaQAA4;L&*+RSYD|bNMo~*O(tYE<E4w;Iw)^7H?*v6K<VxPN@w4948b%^
zmonSNI<qOZbmC*;g$CA{<xoc_uC|RIdaE&nB`Qe^OSmzw+YKa>263crR*3i`8KQQi
zI9#I!#S7?M3T#;Ad>hdTn#H65H<5<lt<e2Jzezi^k|ym$(q80|Cy+e?jFp7vIXKiS
zV2>wZno$mZz$l-j^O&IkIDr{Y#>E5<zS|G`-S?fVhlb`8&%`FPHEacehkfGun3#@D
zY>imDb(f<8OR{FEbv-G4=F>!RHsx;X0S%U0x3uK_fB(<_+vNO-2v&;qMdFMTwrDah
zHxa?A{VaFWvUIStb!jYeY#-N~x88`2jT}ekJYK*)o@FWJa!X4vUiK3p_$*4ZsEBgj
z*uh1n0%+7*xtNO!G67neH>i+z1tGle8`(5%-(Z1<wJ@}?#XOD!=7m@@G(GTiV%eTG
z$m&W~U&EHGVZ!<&D}lmYKD7@J5Nu@u?BaP{HAYNg1&x(64bO=?!fjs8@XA8+mMA5L
zw6c)ONd}0Jd@CzUse5<UvA&#11#-#NsWqoh-BAlxYs^^*pNWO7wI-_K14=v9KnT2D
zF@diDQJMGlv*&4srMr%cwb1dg#SM;q&jXrBsE3xvt?+APwYc-dw5|gS@XPyA)bezm
zQ6aMOq*%tVS^;C0%pm`AdbX#PUx<yIwWUz{0~U5Su`uJ_9z`MJh96iCHay?KRuEDg
z1dfh1-!dJ?cbIG5>9FK2_q;kMFX)nMbY^+p%#fiejWf?v8WGUCyJw1UcFg!V$_t(e
z>pB<ybv!Q`k-}yBN9cJ%<2gijY#b4zh7>9-^)=!yRN#w<!LcEd2fz?S5OPw?GY(aY
zzDkm92ij_STcwoFv+PR%SG$Bv9rWIM*BM5@h+`7$7!HMSsvH0;2NUKvHV-}5a~`+=
z0Dk%1y|}M-oQP#Y8sSd6TNEA>Xi`^V$eX)$GY!45NyQg`StV=-JsGXv*5#I#6{zt9
z3t7Q$ZAIz*J`D83si^V&zVg);mF|ByZ8h<JUp6A{?teI4)g+XXq+H=BwXb5h{We(O
z)+eyumVHt^IL;!rBU7MClzZb&P~BA0^(*h~1J%spYwq^Y4#|91<?78i6Fyfx8?8P=
zPsO0c$4I>h83Tt-dbw})3AA>_<kVM4Qhl{#)$5a1_kFg96I<_MeH`NYgq#bbxY!zy
zrDvmGBMQ8(-FKj#XqFW+i(@z74z`G{W8bwX4s45Cx=Rh>Z3$4l{^k%%X>BYeQy0OM
zr0nug0x7vRw=FYtu;x(>TLxzkQo+ZZGDi<wLuckXqtFmYsrnfLDcwjQB>)g!OY^fZ
zR13*UMH;HZrAWE_O9oP^?C8>7emO~{8dMVdmx2!|^{8*&vuy#2eoV47jzP1^OPhU^
zz$oTm23%!_hh8rSFH)v?3c+5;m@DHvk01lENMy>tT+Zn$1$fbY%X2+l$Hcb+Y}uxZ
zJ=f*f(Ft|A;knef%c&V)ee2rB#of+Gy#+PXHAStWihEKi<ZFPj<p4xw;uBKk{#_!I
zL<x&7A|^Hp0mC#0i?85`bQvNA$;KSE!G^VZ2Y|7AD_Oc8*EPq`vBrH5TNbsjXZk+&
zbdBnMsGA;r;856-Ev(vQYIkjn(oiN=uVL%$ob9(@ZWH$fgdj1agTs;9j`f`~tWXp-
z?OrPSf0?vd5*41v1L57Qo%QVp!hRF={q~AylqUsz6o3H2(s>Z`0})N}V7cMrx=5$D
zhv<>6X(MDDwn8T@SMe{W+R9YIjUtTav_|c8du6F5059j6faA&m0|-|hqLPWb|KW70
z8UgnSJ7-m<GcqXg15v)~=r8*pPFKy|kns3kLwoIo^x)7v!yeGRZ-wrSzTmQMo_tqY
z)Y_L{)En33fI8pHb=mmdUTIlc-*{QVaXGr;vAx5CQ=v%o-Gf5;__%k1jIFtFzP6#}
zVc2O#UtT~F9NmX$fi#D2!Tps{uDPyziz$Q2`P;v6P_N%+1W@vZg8iFHEO{5jRO>b#
zO~W_$x(ihtN)HbV7^pt?^F!O0qo|%9mh<|#8N`TN%v{@!M1yJK2QUe}|8NUvZr*)2
zMiQ5BkGM9b#0|0K2ON8pFwAtz)`=M~(|7K-v0rAi{syLg(ePmCe<)^uUt>PesEK`7
zBiQnN4+q>auo;+vX9a;4n(koszq;99?&F&<`iq)+n*2rCn=try8{OI5->qQD*xxO%
z%GBQ})638=C%!V_cd8hS{7dJ7kS<^mi4QQlAPME{uMgYE-&{lwP7NAN{P$C<A58qq
zQ#7dO-+o;VCjMTtHkkPP{X85Ke=XKNI2mOy@!#u}J&;#=y{>`FaCcVrKwf!ZAL)U-
z(r3~J^2#?~r~`TBW~P6D6K=)1JCIjyX8MQae7nOg-Bt3+eYdPL%kf;7`B*bah%JaR
z8CaTwgTSJWrn4~Q!Tsj2yqS^dx1g{<y90ye{%<hqI9xL{tof#aEz@$a#|;fT#9-9*
z7<Y+3P*<)_T@l;&CYUQwQBUFu6uk-FN~g)4X)B%Qmsl&E`>RMR?IOK6D`Lhg%1XO}
zfw8i53=E8wWv!>NgdUtRXdtZIPXu)!tSnE_Kv?<q>vABh^qRGSu+s160ocMiEbIp-
zp$v4D`?;<MBG$07@Ab+ah*-T|*I-b)J1cu2Vm&b7b0A{%nY4k3_01RRK*YM4=^tRS
zTXF6VM68>c{$V)}M654J#JcZv5!bXhw``6r7KYfOM8|>dGOQV<=WCu5=<XIi*7}=6
z>b&)-^9)=i|Av4K4<vaW=MFV3-Nc3$aBTTR$Hem)4njMm+$A(5H=jIjeW!Y{{Azw*
zBT?B~PNq3}n#M5+(o976K(De?v4ToYAI2E|d6FXzAuthx^k%?2nu;9hBj6Yju>cSx
z&B!NF2(KB^qo?T6qfT>=9*q<aXUg-OjCqcN#f;=4T^poamyL``!7qVE2&twh$+Cr@
zIYrYMBw&NAZS!2@oF<5-am>kh&JmrE;;1=3nc4YyQt&vA#yp`MWqg)qMJ_vo1Cn!w
zW?;Ig@~NeeudTXta3Oy=gv?iPAul*#Q4Iab()oCT49##xG8c9l793J#qeqXPzeN)s
z&wxI3jvxUWr;{Y2B*yuC23>%$@GMUgG4GEap)gCQf(ex+B!)*4ei<(?6^XYPDtJPY
zA|C<AOJuIk3(hme_$ty%k};I=X<BehC>5!<(lk~Rm~oNTi-_!UVR6*TlUI;H<pOWM
ztu<Nf9z6o4Q<)VU?sZ=92}}%3drdEs+4Y*k9ie=l&r~YCYRtK4Fduc(?1>==-b?dV
z7{!pHdzR(}W;~8A;M@0~PhN>xxFB&p5)Vr9X~Ga;Q%I*b52jHLxubGKpyRn%HmZ>c
zNfI9C)%>hW)%RA6a4zx+(g<EpHHg+*fBqJguN$^0p#`jtdhAE&HP4GIq6La%#ADGL
zxfbThlq5tDU*US1<nt-d>V-h!IK7OcT<wNtCs;ZqQIe13TyW@0RyL#-N!c&CO7c0K
zK-c~@2iD+|JcnxKJ}oAEA$E3>!o$DMql_~-w>$~ctg%~g#^FJd6zG?qo`}^!;#jTG
zgQsc2BA7uE0|OA2s30Sfc`<?2N#zNY7a32+#pG~Q<(T^eHr_0YE~1#1^C4bmlouH(
z(gwRYjIz95-|xSheg9qX{j(^~<}-0B$;FwgoON)evwpuj4!-~Hc=r8=gGo`$@{{A^
z%gf87X<6uqrqg4d;CX&rX1hBM;&gm$Xoh{PYsZ><%&O+FY7SS;;i@KFKy$~3s*g`$
zEn@j{#Uc`GsI_Zg*E3QO#6N-`fjqHK5J8jqlq5Kv@k|^QQ34AB9snwKkf!I?7?g9Y
zS;x9}EcS}*9xl6wTiwIZH{9$SZg&h<9m8eEs^LTSK_IEZDIZ4(KS7i95|O2^RkfX9
zVa4(!r0H~)rPC<q*BhsKtUJdrHk>B7m~ado!ISh7lkRIPw-1JX;FvR9q`2-!H7tSm
zlqX_L5|&dk<0t5EhWKtESnEt3kVy`yQm?ZB9aw#ac`Ux6YVF~wRs6ewp%9jhVv@ic
zk&PZ7?p;A1qV<mcdz42(6i3Bkiy$&18JY5eXTK_G@+}EA3T`l~B#V^%66HVsJ}2?p
zbmKD@B%X`Pb?YkQ>ZFYnZ(I<8vq(@5zP+S-W#QGPTBzxohBZhqZUu&ceQKImD}O-W
zykX(hysq%Nd$z}Bp2xp(!eA#aoh1!HX3F8?n3uV7QO;wT*>}dXC}ku0rJC^!&M=-`
zfV46r**VmkAE94LSyrZj#B2_7s+8MOd8R@3VfcR1G!wO|J}4<ze6eB<c~(h+PSOAT
zoRMT66WHGWd|cj~=Hnclg5b@w2qN<F1J$x*?V~1TpJe0TrsU(n+i1%3f=p*4^hmJp
zMZ@a3=j^bm{SPu*UHPjtFP<q0OEx4QnkPz4I1n9cHr{dvI5<QV$Nw2GAdWsdMQ3|*
z2CBJxLqYmtXL}>`GGpiz=_3%d68N=9b4p^8l`T!lImbEAB6zOR4&x!2$I!9{Uz2L=
zAT7`2<knREH;0F#X7{DM6Xi)NoF*1cCx*k_hgS`(mA|?gow0s&+dA?EN53}U=<ef}
z5f-1-UMAJh&22;9)Qhh=_$tBb6<)u}BDrb;tlcM|*^{q21=4S4_wfsNg;j&McOQJ!
zhc7sC$e>;<-bOQY3f+JA`i0uS{~#G;u)fk7XdMCXUcW$9W#w!*+h(IzzixJ3;7hRk
zb_YfLSyK^z(tY#pim}SJZmR!nS1xFkl<r$)Db?qZ9F^+PX6P{bV_O1i0WUsDNW3T_
znk$5HQ~4sA@~0sDd@O#-(&?*GDi#uPH07^JvN_N2m0hG(g!2U?W#c1IqOV<GuZW6R
zj;)XHao41%Ue8urMUywIU)|SwFXmx!<<9n^I=8!O^eepsx4Ab9ze#=$KtZ~u@nu&&
zNtKPt-QLxmQa>&;ochFKn39jtbUytllepfqXdD&!w$;?b?*7kftj3&!PEE4Km6zn!
z<7{b38rRuAOJ<cV#pO}DN9IMkVfp>@DqzG8cGHH24=Tv{EJ9lj!CSA`2L`oVhZ1b*
zmX0kmu&~c8j(yK^H9{=Y2<hH^g>r7%+GgA!V)1KQaDY002CL~-+(Ot^%da|T(biD=
zdr`rsTZ83)%a9`9i7_Ctflkl%E@6kB=$iJI$0!gd2L=-!ndSVX{H45elB5ZL91waA
z^O7(qnPw;ds%fU_IFHZvMC6h03K@aqyMk4%fMA759F3C`_`<g<L}8i~7|x;-Lz{h6
ze_wKdLQjG;W{+h%my@XAk5z~Na<=z<7eT^nt*7Ya1<x)beknS3Trk<g<Fc#AVp6KW
zDO>GsO5)B@RJ4Grbv9OIeM`m-i&<%L9SO6VG~oy<8p<am1FTA!G*?)}P;DwK)dFQi
zEvs!9{6+xbpW|F;F6dI~DXVOCBhfy}0r`oNac!|XUb5C5L7W-*@6j8Y&V)6JgRPNw
zdLiZ&>;zdzC|H>bB5Wowouz#Y(=>q{DqmV<h@Qps9E>N@hE`oJz#=EicaaQ8GeS8S
z9fZ9p;~^l0vQRF1mXTrtcDf0X=8SM2$LIpS(i|+-t?uSWkFG6+wLWF3T6QRa7nf}n
z1mwrV2wmNDv=Hl#YhugOLhPB2j%^ZB&m^2XF1yPCjl|R}+ofT$5NKlU7)F1W@9F?h
z+6o9Rao<CDhuw3aS}U@0&Xi@dY%^G(tvmb(y_rSlf>*IXQNjd%3{?ozA!jYh0wvQK
ziN?v%qie69Yw*qFk`v}6G~on<z}rPJyD^5DMyRWUIOTB~V2kN4_Csc3U2|<q(_Buq
zA(vJ&AW<FEYuCL}ZOTz!OG<h4!^flgI>}p0+qb8oB}xE<Y2sAt4K33ssf{d$wLN7@
zKJHLS(^Au@gp9{qEI$3M7CkLOt!HFqHH_Q9=HS5!k2^&{a~eise$_ZKz_J=;1-k``
zt7%q+;RTDUa^A|T71AeRy#G$41f53-I|aEeofkYq2V^`xY~h1#$gk0@mE$2X&nZ9X
z-WwsU11Q#GAo&Jus;lnyfM#~Y4{r)Z{6gWDNX7}BkgP`-fIU%e$1GtVpL~q+a**PM
z^g?_j!2E&)JZ?02qglpe6O}^TSy8>CA_)DX#OXwof?mEJ+Y5cTF1Yo@#feHjlY+(l
zP0wk%p&3vI8+vGCE3_ykfoovb3pFn^4QdB>TIQBtb7%$y87Jo~y-eD2_M2H86{|#q
z6%0~I)f86X5mL5LsV<6;pf@fC+dE6avd^=K-*Zvev20@cgk#S#3AS7oU{BK>>}a0B
zL(_FF>&~xRpwiCLe4ceQ!)Gmlbgg8Yi-jF5KsHlY07os%AxdaGXS_jvo{_AGXfy+E
z?`>Jmy|p@(+FK`<7y1Nywr^sK1UB|O!@{=jd(^Q^?pf<G+#6dN=1s1Q-I-_0{4;@^
zN!KiK5atMu!XAfSAe;=UQ*<piZ8tUP2tBDZrZTcJR6R`v*_$LNO?a!}D3>xnXJ{^f
z3lQ!E2qwBC7CR*g;vXp&C?ZEJ%8MwWMb(n1;HX1n`{Jt1YMR=OFrDhhYqHbX-WOpN
zb(*T4zIpymrzI7#x1&r|WfX;?zaC^hG(Bh*aj6E~hSOZ_=2^t=txT;MeqeD*F=f7u
zEz`3xF>D=sB+z|}Fy@61{0k%<z1TJ67$q5Okzj;Tt9iV4BZ~Jt!CL{sm27s3q9{Cg
zp8u#?E-#<T(*m9Cm3Pz=z(70O13$pl#S+|EdoDt6MA_kpyBkLwyVs|iZhLxYSuXYi
zlVi)XUF=zbhq>zoHVYk_P<wE5zd84x($8I<ilssSp}4slo*9}>U|^ft7Pd&pu}?e~
zn<led-wBu<tTTBH#GC48Al}>v@kWIzAhGgj|9k14|99c8FSIZ4((lK%0TcfkFMnZu
z><UD{d;uZ{$w8;a<1D>|r)Z1&Q<^VB;n{hFo>XBGYA;z19^owy@zS4F#yO~*rCF45
zTEvS{8B-txI~S4O;jsw20D3-&&!J~i8EgTJWP<V|UA)058l0?w_yVGj=yDYaAU{Gs
za7yNR%`rez2&xcplqSMou1FC{@=KmI-R_~2IifLmoM$LX&}Ev5{7{p0o|QbITp{?1
zg;O$x!~lV9dl3~25eFhs^-aiZ#uEwX!WEc<xs11<CMeBNkO`O7mP>RbhEqhqq<K_P
zgoLOUO{KSVp3XDMPgeCoKpXQc<4F-OkPsk*adHh=<7u4E8G16CscH%ybMPEopaXI1
z$!w<l<Brht0$oONjD-Ka!ekhitPUnt@)Okw1%F7ETna%d1er+w9p#8zkSG>^h^P-4
zC+dCIy?g_ckns4Zo`T+y3sx>i`Bply3ZAA(7-dsL5}2#s=YTJjlre(N6F{{p`jldh
z$yb_i*j8eFb{6N#zyrz;yo>}O;(R1kgoOG%t_q(}9T9y4DI9%s0*&nRPJ}Jr)9rv!
zANyR_u*E$K`?_Oc*E2QW2rNp2b#A=(TG4H6afs!jj(0$@#ff%JH{bGDDNmHE9S-PN
zZ2woax-5NO4*PLa<Z5YiLOKnUV4!rsl5ig2c`KV0*q~CdU!zk{<8%HSm_!a<lS@(K
zGg6QSN(j|FS5907d{z!#AIWQnBlJ$)iPKA-9W+WnTCC^nu)%GCvjwzmF`%mU7bzui
zvvPq#9K3tZK#BkNv%SOj+K0mtdX`Q%m(o8RRx=?hor04D2h!%4e?<R&ws-Jv(V;m1
z{tXVmKg+lle?|rRH+2;LnS<C*xhj$`a`bP4ocd=g0?D6cFor*?NDY6E({vp3Kgnzc
z|DTdS(&Wz>S<FcMXIc4t#z?{cyx>_B{;7hP{0ZTZF4K(tISt955XeQGR21;yG!x?n
zCa_qlXM0C!(uxgnwpY!sjCI7}eeAG6UaO~6MKyX}zNclpgh{|et$|I>-a>-g?BQKD
zbF(guVy$iH`@6Lrf8L65B2+vv44!Rq=2lJK>^Q1-y0d>~`CieRI`mTKb*%EsZZvqC
zoiukgG~8B`!B%I?s{gxTSUWprUdugmS0~N>!BTf~*jzn`9WvDH=Dc~m^fWuBQ`*s;
zbC-CuR}2-tgM;T)+&r)0?0H?6&znsZ-fNxj?h1MhhtQqfLU$R+PA;OmIg0k}#!9>L
z?a=$qXHie3FW{bUIn2j8CmdUvO>y9{5L3<#!!l@a$C+0v@R=nK9g$&NQcJohot)0q
ztbg<b<#Wb(0%1J)2;^v4Je?PL#K4^_o07N<W{m`^rQwQG>XW7S4ZvTsEFEV&{{oz?
zt1hUW{Be|JDX@I%dm-jF^RZ>S6bG8^VWRss_k2#M#vdS@P%X9Y0;|x0gQx=u?4s(o
z%QkaV_f*_l#_>(Md#m6E^}TBlf4|>Q+x9;!t9qM#Kw1FCS97Jft&;uV6rr3V>Lqm-
z{2}hLY|+nyLIu&cO)oGh!GZ5EY#BPiK4la;e&7)vT7mA_cUZdkN7vYd4&WmXwgpBO
zBlPa=)5BWGSS?!!LM}&*=VWx`ydVN1Ie<#Q`CUX~*0d8%tHXqwCz=N4F^&R~p;%fr
zqOP~3dT+v;T-6$ZHG~whS>*_^0=zz|jG~)ObSO|}KSAc&X802*qZl+N7ZF%|DpMeC
zi)sNcE;&z-Zo#ktemBGfynFj}gnj{4W&sudltp5`0qo3x)&Lhb#%w=A??i85u2Ka4
z&!Uq`Vv|^VG%e$|=d%>-TXQ&kQ5uF=4muaU)wf4T6EAZo8O;f(=G)xIA=enTLMOzY
z9xxo5rfV_R_6);+fHGQVe~L}h+M#Mw!ZI-|wFSi1JUSA45;lm?POm4-0pKpo&0Vnl
ztI2i$J8gI^gINItp@Y{)<@LkScF}K%fnPl=V^r5S)<}$S`Hgr7r@}G1em+>J=3AZq
zYdX)~y?u&K#hXb(Mr75Zj+M1{T#!`-4M*d$N@4re;LI>g2}SE0T!`V_2_Ith_>#!n
zaupUAYX9KIV1#!mItAl3CB*?SRm%>2hjeXJ-Z<OS0C=xnger7+xcb`J-ifAFlvTN2
z>(MU*=<oOcs`kLMat{dkz3Sp<g>c_fCc6i+_|~vW>cMdqu^mx%2!Fp5)K!6QH|~tw
zMFOuNcz?U}?3JW{L;2aA?L6FvkhHCLgV%@4Z#aSMLs#bD1KCqnq^3iBU-PkTyBfAa
z?qZLJ6zhQ>SgvKex=HS^F4wSNmt?_%CXsS=`jm!x*MORvUMuKwlIFsB5%QBDcnN?M
z6UG4HMRA&*=O~WO1&vcRII0PB0#+vIlE*QYY&gMKL<chV7@5vu4*q+UvQyV0Jyb*z
zlxI9Ymwz^*zr87o9g0RSCn;i(&M8Wym?NU+q?hE9EYN>-DIx!*sBTB-WfqMgteS8F
zYB?v1X#{n&bmsx$UhUgc*Dk9Py@2E)jH87RG%k~>mCE}D246i{=C&!{7{o@0re|3+
zCE20^*Rv=;e+>1N50tDOcpwzKL&4T0DCXm+h=2!G(++DkqfiDX={#nj*;2_}<g68*
zjpRTDWVKG)B$2LRP`*-0iE`c^XlvU4s~qO2Y#9LoT8yFYwj@VFd^|A|Dwh`^3gT&Y
zgns799F*NgA}N;gT;yV+Y0RV!o);txrL9Ey5~meGvqiVOEnG)IjoHn&oLGhy*dgX2
zGqA;ojY(kXSoaOh)I-PMOn-pdZ{sAa&oo#?!J>WmDdN(z=WkxUc=CUvU!VN)WAkV`
zcv64{!+HMx!_hN&{y`8Mbd27;`t?xZK<fAqCk`ywG#l^dV(Y{5nh6L@WIR#|vm)gl
zmifpKMoFrU2^;|(mrl}bnOE6Q@2=EtSWT}5rSJ4ElKLvXUV524Qxnx7U^OSSRM5q>
zXTnDSNbmwncrGWqMdy6Bii#<jlCL?9W)V*cQP&f>4w~G_nmpOi`d>e5`{4s6?6;g3
z2d|%vkfCV}c4x^`y?s`$Q6H$J+7Rdzy*{e`S_6})np=Z^QV34o5^J(qa{=>5l107$
z+Pzx?p@?==8?r~!3(P;x;Bz9I?R2;?DLh-XD4rC>5$tpY63Lj(&Dnzjje}u%vU#?W
zkt=UC7uJR;<XO93INnr88og@Mc<bE{By2grH6@xYS5;R}Z6(&Wx~9%Tc)_{EgL>4^
z@=ZQy-mm4PLnxN>;<pLOe-j+?q&TRLhVuP9OQ!-BdRYlx?dn&#H^WkV6%#5b!EH<K
z2>k?^6W;)W-&uAe^n%oP$j9XcDc?)kvyqyc71Q;aB<JOnl@oZ{cTTjj;`TFeOCKR)
ziB?)QNOC%A4IWat$<na@kgj#HGqsG=dPgw23Lq;7Ta{90XQKezl<kX)^4Ic-9LZkP
zh@1Qy?u&PTV5-I4>XpDfcnS5b@|6r|-F-#tnrr0_z;zjCH;C5h=781>Xx&{#>x7Ei
z%gmrOT&7ctg>HaZpt;zh7R3Q|b<9HMIfhA@t8Iy0v;O8<VDteecWp;^SaL0YC}AFS
zrkkdv>(~!$iY?AK_H50-ju)7LW*Cma*G=;f=Arr-!aUqyn1`0f9r|BnI(v+sOF#bw
zdd2~1Qa*_{kyr&{Aa+uj2y8q9#&<3sX+&_y5s|R|2yV|fjlzfm1uIVzWdMLA=YWMt
z)a$4-9!2@$3AhH&(kLlZ_{F@+ah}qM#F!`JDB&V*!wDi)G>I9QC`gW;za1g|k<)n*
zT|iEkv>CSoh*I+?X0k6R;2}hJRH;`4RjLuv0g|=A;|eksB(<CaAU`KDSOi3q-v!@;
z*&zY~8Pw326L6ev-YQd8NPHVc8zo^z@*<nlVxDny&@{0?x|lRQhipCPyo3tnqmXUo
z5E7!JfKMV-SINGIi2~z;VChf51M>OHr^@#~B@kAiz+g;}xcX7Q$OxjdjghsCL9+7Y
z&Z2<FkgYzKJt$Jq9XW)VG8g<ItsN`YBZ+xdpk>M-aQ>nsDk9O304yGLG=|zV1EYI%
z1P{?kWkMhYBC4L2H7k;)gISiQA&^5<_>9E~5@@C5H)b6C-eu?H2vuN?M*N3{(W_d7
zoi$h*Ec%9uC|4=Gl4N{sQ$<@Si>9;PA}qLJs99lXVm~w(wut3p&-6@e1h!=`*9*BH
zJUD{`K$|d=yP&#a6}FB*84n*k%-hiJv%c7Ft2Py_w1#<~9WC9L&ePR^ej?|*Y2-ki
z=ii96--0`rE0Bd0__MkKVLE9&_;f-F8B*{$lULdgHt%;HeJc)Ch@wzlX+NssE3_u6
z?x#c#m*Lr^ku;IoP5=OS^Gj~$r|X=~Pdl#j%ekOWb>-B)x?%-TF7<F_Q<bX@6o+^?
ztoF}8HTtwu&+p0x<ZaG?j9k}j_NjS!Ic}dU5y7`?#ait$-|(teZt}govmb0k-od^8
zE4dvHKK9!tZ1A!F_CEI4aZQK3j@w<+zcm^OU#4D%-klAL%S|`*EoNgspcGrC!7(9@
zgALm=bw@L)VR(0#?AVqI8rku{8*MS`WGIpGd(sg7ATbJ%R;2c(B*1p~#5&uAaFGWm
zDc}?m1hE$(;vfjuG6dz6WarB9O!#*|P`)}j<!wqxDVF^1PVk!VYi?)<*rtYtE#h+Q
zIn2b=^L5(<aNhq4>uAvU2956<YkZsaykN1ce~)T+{?m;y0HEF>m*P$u3pl%e<y?w)
zL#Wxwx7{@~E6_3bH4S{*T}+HH#D-y5L^I8hQF@0(gf}Z-VTs@7=%D?<Z&C8g5V#G`
zh>D5Tg`>;*%9K$=dP2k<p7BW^M+AYRAE#LpMQ(ajl(gFs5_DW?R*^i~V@a;X5cRr?
z&NpLjXK4X`0VU=<1<YE+8m<FIxBW7tHpUtHuc#;~!`~&}|NGI=(SMaRX~;q)$j=GC
zj2D=K#eg#rOsEr77;FHgp{ByQtMN6w7!>9WVpU}jSS6yt4CJ}6dJw?sSww}QCd$!-
z&oe;3C<1G`Bn&DWK>2JBw}#hTq>Z0MWAOKfk>LzxP`&pN3gVQCXyf7%n0Z>Jnv74u
zK+`ZljJNtOq)9=ju(?c?8%xvWM9k#l(lAlIz`o{$Z}00MC?Ms&*+~?&S!j{abFk%e
zA6p@Hao`Y!U5A-GG((pW=fR1h$H#SApQ|28-4ki;frO4>-5$#W2pyvh$Ib|4BsrHR
zy2^k|NtP|7p;hjtbs3SQ(PUjRqc$75E7z?g_RCUhS^aH8O8&B8AwO-m(4Pz4plPcb
z8pf3y2)Y~<2zFH0IivR4SmCG9aIxs`m{E?ad@0S@NwaF4U1D`JWmO|QL78p5dnXDH
z*5o)`LBp<-!Y}c#>szq&mS%p0RxO3*D;~9nIO+^gz1@FI7C)&Srl{NPi4jS7)q}9q
z-mctjYNw(9tMblNE=jP5z|hg@%9eU+hskQUs`{FHvm(K_@*BRQu+}s1mN_U=md=B?
zO#WWJszdY$>6(U)+wXRS^iDR!_xo}}J6!S86>p;|S`o%iSG}P3`~R3Mkec!R52y9?
z*C89q{_KA^?ey>czKWpJEYccUqs(8bo3Cim<)5FfW1pXv%dl;fTG6r~+OO*MG6VmH
zdF+LBdf&UlhN_1fp`u(TcYyUS;w}%AcQGvwK0w9jOYV&J*?I@I#^4arnwepDeEHq+
zmn&@x>uYa|T>{qclo3FN>;a@v({5X&qao1I5a?((#B3+$DW)^mXC4l1U&j_990$y@
zutS((5|e9WtryE(0Qmp0ie29}{8!nnB?6mq%A*TWe8Q!3LB|kK2>d~&^`qd8Ah2v%
zIXoxq`yszn6+$9Hh+UXMPR3{qEr}A~QxI?g6<1;LafkJum$7XCa4)eML@r6j6ClqP
z8Hp0$eBT!GfS80GF<Z;jb%QV+^MLx;GQt4+JYZO30U;g)sIlw^huIE<@rOqk@6rcq
z-gn6%07z&hVSE3>de-+ya-vVGkTc6H1oN;9RV~A$@Aq3wZa~25dHNF-=?v)_6s)^F
z(5b&UN_96F3G%biH%2410yFeI9E3E$mTT$QCqaPyFw}gX2fpQmcUWX;>`ssv<o@n(
z6~Wi8Hpe$y{92;Q2nknhX<!TCv}i*7qg9@2Fu1L30A<ClZ2M>~-SJB9W6N<4qw2tF
zqxigZkW^N0(Uj;lbc9HQx;WE7go=us$6+l=1@rhES8|h-t7N=;fxaJCXPL<TOw*a9
z3RF*AMhQzVZ;RY?C0n=ed$#ZT4t4_v<R%W>9G76*(zzB8&!K_w;N+&`V?pf@e~Ww)
zl6kwlTU3JjwfjZpt?#pE+Umh|b`S)*>@=5d*ghG*;NWKrd!ganD|Qp4VlHD8f|VVb
zyA&}!ClTXS1i-;3@fsrLH<S~*hV)gUVyhCKZxj&a2Y7`?U&F3`y3VS;LRjoLijJ1X
zJzD0%DzoMaIkIax7LsqrZoJfDZD1A+sv_+^yx(7T9^C(Mx`L+Lkh{D4urfziS4NG#
z3oCBR1+tQy^W81SgG60@Dh9hRWEEbwDDQxsYcK)V(=r&jzMzq77eGSQFzkwTGc#oF
zxMP_+ZjpZ5Q?WHP-!groVLRX^wz#EZ5^x_ozHQrvYif+%Wxv#C?Z8OEJnx#MI`~c_
zgjL3c76DPJcsD)9^S20Sopl<FnrT{R!6;)?l}RLIm@64iJ_o~;@KacdqlMym#%~K+
zA}4Mqtb{w3ZM$B8U1CEP1k=Ml^GqDt)Yh~h2)Rxk99A*_0P<(BF?DTBOA6~MU|>ll
z-e`rACZryk`(R7jw($qecM$4t8A)wO$9GFq-Oh<TD7@Eu4a45p`ZFlJ>r|A!6inAJ
znQH{t;x2??(gRGm8(`nlJlCgQz+C$dtGh4isJ|`aX@}GBrtKRKyhkQzk8SfRMwf8b
zi95w&mgc|DNzsW&kR>foWf3I$e`O@g9%sqn5n$wvtcGQKg$RiZc>smC<&!v0FOPo^
zuKO>dytpm8Z`s}5m;#<=X~ZTt2$+p6>f1Q*T?gBasZnluf#E$orof>6%AY~|y}I^W
zsj)efWo`Yp83kEtzuOGbgX+6&*AJ@ip!yD~@14y=|AkfG&T%{_zt?*agYvueXHb6E
z>nMGd6D#mTV%eB_o{ueuxY!Fk4f_VSnc-=KnZX@af8V`+A(PvPIBjiZwhVgJ)`a1S
zN-Gr!X=XD{Ai`c$KLWb6h#nKIau)zAuW;-p5X3HT_!`CwG>tx@n2)0(ngTPqY^tR~
zw_|;!8Isw%;jcrP(!7}PC~M?GN)sURry{YnFd~D+Sfu=sHs;GTD<%uUXf9O3An=R?
z=g3S(&;z!%NOTS<ctp@VxB^MeFL+)=V@adtXr6>*8pRRGpkphN3IQow2Hi`O7?|7;
zPf+ALQh9i)UOz?&hq%zPG(nd<j<Jl2w=_d#_Vx&ZrQIGtAWG?OU;wj2%kvzHUFvdd
zQ76Q{MG3YYpOSzPn=}64z<?EQ12?b@M{=t`-ZM_l87!+bM3eMVx&c6_yNEON3yHy_
zcZ6O|qI@EPcD|XBX&J3@X*YK^Ff8|aAC_Hi1|x^9D0ZIOX;;}r6=H_ld;T`L6103i
zH@JIN+2*6^OkM=ezjVK3r3Iz=MDu}P@-dWNibx0xsvK+8i6{|qWK|=Fb-9|lPqOiE
zEdu=rJra09GeFsMRzF(u;M@1hn0dn2Q}kEedY8q|lQ3PAJpNr4OYA|-<bS78g3hCa
zoko!JOY|N_e29P^ztp4VK;G}emJu<p_dnElN*Q^lLQz_kKmob@<r7iZjO&LcBnKjs
zEOEAXsP@Q)vf{od343TmLAZUkr;r)wc?HW<bJF!lXpL~7;#bG-fXbYpy=rL;YUjG2
zLG65Kpv)Z#yEeF^)YCG!qkPFdA*GpNORW1DJ`)e^Ga-cbVMAPR?gzO3{%i<PPKW()
zy{RAe!`7d{e6<=;?`yiUJwhFuVrDy#>fY0EKp@pU2~3lFfzFLBQ2P3tYaKh+FMhzx
zSp=d2iT@tuQ4qyZ0r2*QLuhYS#_b2Yxd;hNf=$EUgIq}@i<F5g%76TQPU5%e#%C@F
zgnI`Y$NFHR8^%?>BN3hlVHLZlg&nVNewXyDJ0xaZO3AvZ>{7biD@=k4erEZ$XRrV}
zrtV?OFhd-8nuC3v20U;Ko0D}^&UJOKosY^kYHVC`+s!mh1I@2#!GknC{~6xpHZzTU
z<7ILP&Z4bh^Y)^GPq$`U_?AZD@5C68Se2(|dzWDTJJB`mFON|mmI$V49FtkjPs(4)
zJ10q+@W%n6=P)k`Bm#@m?BriH%`_e7@!6iRB7av%Yw~vmt6G699bn%XCnqrvi*|)5
zOp^jbmXH%en|)M&U-D=?DNcekW{+h%my@XAk5z~Na<=#VFO?<e-Rl?9V)P<P&e1<e
z22p8+5lZY;(VgRh$$lM|9Xu9OQJKEqW`v%ry7GxIwUuGBI!X0LwE<3;=87yDk3|wX
z(kNQxg#*j>%P@qzNTy>8%U(`GUMz4C&CsRntqOoQ;V7LKG@U~FUUkyI12m4Ha|Z;7
z;hceSE}!SpLdMx4qGVRgm38o47C(jJ(l~UqErZ;TiC7VDNXW(f$#B0*c?44wi<{uO
zO(z_hMWm1&Q<;rn1dRy7k3?)LQ9w*hZMlP*s<#7)--<_w#5^lx+fik5kJ97_y_MF-
za<HmNu-#YTkl|`Non`4X%K3@xA6T1;3FP(zdn0t^60D^VBrTOM7}1OiKX(XYmS!lM
zgVi#OVl|eG=e%eYk_N0xl4T?*IJ<VPy7uRPp2aADBzV33%1ur!=GfR{dWbDkGjYJY
z5c5DM+%|MZEd5~{)AM;263X+X_5AMj3k-`u1j0+0Sdv)nMKt9_7E!qvW#+_Kn1&&)
zU6isT@pN6dnLAFD-{lZMMKr6d*i&iU1;ct4LBv*m(6aPi#dIs}&GRHm#W8mv+9++Y
zu<MJ(+h``O;_qI+P|vAD^lWcArEr}o4OO=9XS^U$41GVVP<Kf`fRR>}jnK;sY~#9&
zWp~gv67SxWIIQ2u!#YYTV{hG%(Z8Y92I4J4gcMXV2)g)i)D4?EH(cAoSGQR?SJu|z
zMtjy_JFOR7C1tX%(q=DO9F?^WCgk-d<S6cAH4^1^jE^jmoIUM-BCZK3)$au^8MS(V
zw|(G^y_|!#N3z8=N3w&-x;+kKmuGgi&Fz@LWyz3ta|qrQo#S_QjlYV~P3pFS)yHWx
zCGjp9a;|4xxTyeE{T6#yf9~~=OnbN&&g1y@XJ!Y{v)7@w3!bqvs<8&!xaQ<YSvhcZ
z(=(`xsTR7}3VnusX6Tq}#0x^-)~xU@$8GPZilr8rqZAm%pr5sA-cMF4lB>kzO81=c
ztd@jD+U^SytIX<col^;yBILQ~%>>x1i4@Y{s;vAn&CcVLu$w0{JI;>lU#YPf2wgq-
z%wKmS+}J)aHBa}r#;`-J09&5pVb6C6Ce-q1U{W4>&K=$dPg|?Mz2-rJ&Z1y0ydTnV
z{bE<>NG>9=Lqzo(U!bOWr3E^R_&r~qHt{?|H$7|^mX0mkaIvQa9`=3Dq_(HInyo!-
zNJA+r5Q2aG0$x7;8`xn3H=F}UUmVHZ6I`9m0EZPk8&!I1S)P%Cpp~D53e6a21R~7;
z&(9f2<}rcnVgIbS?9(U#;6f7RDTzsT(CI=`S8fM?uPO9X@^P11T9M-GTF7|ZL0#IF
zG}-I_C?}?NBPcxv8mc`!TYh5e^zjWR1jzz#mJ_UTaY4lW=<%Q`r)cEWz|biQn$rb|
zB}k%%n?YXeMp^OohT`gdsKO$~CtQ{DTVBlzJ`=xo>G}Zcr}F|R`(!+pbp5i8HU`n?
z*3vAInCFxqG_Q}4wrX0MCDnB(*~UQXQIeeAXr^+|2%aP)UKA0{`zi&uHfMPpC7e!3
z)<Y5B6XkY<JU%}880F<4#S8h`3ek1s!F#I_xx@%<+xD@}O^z+yAds^q#MBHzC*Zzk
zYsLe&9!%29USHW@p+rU@F0Qp3!0~jYFUykSRQ*9H&%Cw3d9Y|WzYUo0+EZ{AsYCF#
zNc#8o;PE`4IzeD!%k%<l*{+Q}D>Sg?SyT_~km=!F&ieZ{tplYgB0**AUhQ)a5!ZE1
zr27>{NeKSb@c#wNR_6>V>rp<waM(zo81&l8BFPDzG#!U;gV#9tGhQi-9HW6pJ(pt5
z1J7~h_&9I_7i*^B8@^-s=GOr5?nc5n<uuw{MD<Esx0c{baRKI;%^$EUIri3{C;0xg
zzfiT4?s_Y1ut015V#^x4dAe46)k5sFhS^x&Qijp@`(;n|Kb-b=9xD|G^PwpYUowqs
zY3$p|rn@HBy|EVV0OdX7>>0_<dl?w-H&gw#lFUc<E=O|ni`{F-m-?mc=!69t*24hw
zOUg0v4GYr529#OUrur8Ba{bMLpT3Qs-e$)>6oR_LESH*^j|1*=Yz2mneM{pIZ3w~)
zbDPnDpgs`PzYamY9myB{FEX7yMz5p%d{HJy=*LWdF8IeGB;&fAq>zssG)0xSex*!b
za<Nk&GfR~K7=>9v;wsxWlqipNm6bXZeXH~VyoRfuk5CAyVln7CgcfzcsY1lL!Ga0f
z2&XQ)6Q`Fr<FmO;v|f_H!;IubHm5*eM;LhKB32qnP(FiLY)LvLF&txMzXKkol3W1v
zUP?J<TRHBpYF0YTg;2Ds=>u-K<oeFQ5jaZ5IOBPg7Z8d4m!F=<jPT$zpFnzMni4vx
z8T*0&!azO0oZg;}l~dgreHG^_7xDRy&}$CHX<DEt3BbET(Bh?eW}Zw*LdGy6xSl5Y
zd<s@Q5i4Fzt}yP27<Mx190a}NtnNys2Bv79<SBd`;C?zU@<{ZNk_2Mk<ps%rY){h!
zv{OmJzge2QTxB~E-8DjVles1~xNc$#Pypgm3o~D{9E;et#qK&{)LD)P)h<*353IBN
za3yXepU61n(M4&V6(_`6O<%aJh~*jqD~G81M~Hu%5wUl~!V~zBdI;)|W)Zkh+?D`@
z)s*doBYB3)s1`cd2m%9Je&Az5Lk}}Iur$puJ=^~ZYw1qmNZkc?-E}1v=*nfK@JzAr
zpw)d)KME3e8<KrdC!#>AghP*PUj;TSTR*DtB`Cu<X7gDbQ36Y+NM*QCQt-ThYST=h
zU1d`hnV}lN+TeTF2&y-|z_NZM$o$Q4gXQ!n&UYh-Um2jVn!rZP!HgYM*WXNwS(yi~
z8!E5?*;VChUWAx>K;^2zH%Ivv?lz#ihQX<-OH@@py#_061jk!K3+25njcgzz$PoxW
zLZ`TzJ=wr33bQA?8V__$JJQgjZqvu@@s5yw*aafnPjunPs{Q>Br`7Kw;e!mX*?=C~
z6^Sxp6EusoJ5$y2m+J9Xw2wW1fG+PYblF)r1AIBamm7Z`D16x#tam~%eaq9C9$-fY
zlcU2z9N4yv{m?Zm%{L9kv^%bLlqzZ(u5@Z$&XNX&FGWoAwNjwaJ<_n?Ny{~UHJEVo
ziiExE3W1(f6LG)k)jV`{<}!vY%L3)cH?Z%z3^Uu-2w|3On)HsZ=mu+I`-*N_$i=b^
zGyeOWCq=w~boU~@`X-b4Qv8S8y~uYYUfj_|?u3?3tbpLqGhvZiE+))yF=bBRX}TRS
z#~d{LmWH4AJK49d^mWvcreZG}Tc_G@)ac9obR#M~<7^IW`D=$*SXP*2)jhRk`C0vO
zN}^cl>7qhWM^k6s9;~6OKC2sjo9(AauX|2u)T+%@Ds{IzJ#^~MBVDCh_GSOW>2jw)
zDOOK673WTc{gmsn9?-7q@eS(ry=De=7tf$y5Bl}J*RQXqJoQtq?<#NI42fo#B*d=I
zO>AjyhzT_`9B70%+zg1VKk#r{8yU!whz=*}4QNyi;=8QB5+_T;l57qru03VSQiy}U
zm+d^eh0Ln*IBgRYm*PWhpi*y?Cwma5x8!ANKPr+($*DNpE>`xYZEq7UJH@|+Ou3#n
zK8TY8(R>gm*ZmA^^MP%CvoPiT7AGCg({)X^v2J=mY9kDL4kOqKz0hZ-&n<eFNo_xE
z<V3b%_#ex=OJRpg^Ayl=IfJkF<pk_X!2Y}hsYOsPQO<c%2A7h6BRUXxJ`jZxMbJDv
zLJ<G^1mzH4IgG)%yC5Kr%GR+;wOi3P^Sav@V8uzqL@M75K{8dzzpOc~5FlK1K+3`(
zbIudVMwQop{7B<D<0^KiimY-Qh;$*{)%>MsnW1j#VQ6CJ0F_SnTpU1dUrJ2NH*Mbv
z?14&GG*;2N<qdJBWK12tacM7s>N37D=v2*x-X&&V4=zW~%eAh^sBxN%d4?uYUZf)8
zag?J;G@iu3h|kfOC-W$QT;B=5thxXj{rDKYeg5hMJ<rPxFH_T^DOsSrh~l^m*j&ww
z;0sn;j!?=)v~RWPj?i1RD~k!Aiio?%$D4N@1Uo?ikJC$ZKp2yCx3}_Pr7una3xwGf
z8WN^4ndj1eaC{7ET&M0+#1;veM)ctQnK(DoJcXp?XM3a0-ybB&Ziz{FMHXSH!Yxhg
z>8SvbWRJ^I6-zLm#Zhsv3OYaA`}ecG!}t1!L-a3E@_*1ld!$Pmp*ZZ{z)C&s#A<4J
z_f{Uit9gA<c(8^SxY1xyYj$-v81Du@-fAom4<mSb|HElj(;BbfKE%DjK5(z?0|Wg|
z&CB3D{O!DldxauSv*L%vP45Osb@Ly5ah;t29eb(VK8>52!dp*BY)IR?kP$7eYsB>!
z_B`9e77GIGgLgG|1DCnnbxh|jQ@1J=P|i)Mi-EJ)8eI_zHk=GmMiK}QC}e4|9%V3-
zhNWN{eFUOo)3;3o?8?!BexeJHJBV}$Zq)L3Isq@W_^|YBL_x;MIZH2->PkimK9b@~
zEA~$11KDx>6Y(Yv%08zFB(9l)&mJbhJm(C(eeo;@$HochpGO}Te~i#kk<LcwNJNGj
zp`&~v{`?~X=?X+uA@m=|1i}Y#o*bbkYEq=BBg%y&-cpZ8C_m?*|E8BDW2hW{K7vFz
zGVU1>LVa_bP*d%Y2`#HsIN*?T5%J4X!7ft7rNDR})nz#ai`{f(;_HTQvjBU#Z(z$a
zJnWm)#+K$;ro*j3;}6_;2>Z98E6a0WQxL4~PG8SG6N(O$U)uWHcYeeF5{oC+odLoP
zcej&3Z1!tv=fCpH5$s<K8ydo(rl6XSCs_4aY~0EQtHQF&B@7<rMOyCN9X0g6N_l%%
zt440KQVw<G^L+L;W}T;tbS9qqxcEap4F|IL4V>A<FK{-CU(y5yC9g$={3VVq<S!AO
z%L*2${3Q<{m(ST=#`8k_^838}jfPD88>ET)W&Ve3KAb1=;TfT_-f5cT1<%Cq5W!je
zQpkU%vG`|9RIT!_-^D+SUx<InOm_Z{Nd7xb<@E?m#iG(kHW{Zx{xapN58w!2&gncU
zvc=MTzRTiYWPYn<8#EjXTf>OSLZ#zg3?}*xl+m!(p6wk0f`Ro9OHPmQC|I}4m)t0@
z$!`BO!J2BA5~`4cS|0Ca=w^+-WwXk|HZs&|Z3FP5I`=e9E<{l3Q$$J5o8XN|u=$)F
zLVuphvlNn5fw-{vE#}F%m>d*oxwn?QTo2LrNQY;CuFhn5{A{m0t<Uz_UHL1?-^ewF
zPFFD*8Vhg<yeg01(+ZwajxMK)*04Oyha>bd;cwHI371br;XyeYr>CuMj*u9`(+Me7
z7Hy6YLS4(rf{v~%UQOl_igvmULmNR*Ac$j8m2BKrfyGq`QT;0jhq0loxGzdV!tf0R
z;kGPSzlExJ{pJowHGp^8MG;?+@<uC&dyNY=X(MW%w?W45k+#D1_cbYaFZbX6p1&Kw
z$C_Bu>~xKhR!a}?Mg2tI|8QEaGq@tw%KnGbYDK|CwIcREoHo`@6Q9h-tDK6}n^vz`
zzQe{-FfR>nVl_=r;6-|gU-OxeUsT<V_qrKLg|}GVDBtJ+lU4%t0F%~A!VqM!oQWaG
z;$34=Uma7}1rZD=b6m?|*fV?&TfPk`%^Zr2kTB}dfY^?IhY>;esHhNz4MQ?INYYB}
z=NW^LSqokq_5=xqHovll5env@qC&3ej3XY2<k98xZQUKix35z06=DX(=E)o^T?&vm
zLT@KL=O~Y(8JfYTPc<voCPY}f1Z7qL7cj;uO4m6T)h(lQBte{H@dD*3jYy1nGL90?
z1+6-d#tDfZ1_qb#OO{S|gW!B_dX^PhIN%}0R^U3Ac$8sEY%^q`t+OFrwn~@10}3a0
z%!FKU^y|wN+e+*z*ihw8Y6mu3gNebOYVV~@AYQr8#J+{yQF(n=hL)<65ah1NqS;Jv
z{~0g1h!S{xkJ14;8=$iRIvb#~0Xn;v(AhVIu1-%&>`LLZ4LJRKq`}v+hPh6WEz1hh
zv}mPK9I&YdC$EO83UUt7L~j9ZH2_TaB7?`B(!Z5Hv5WfcX{JN$z{P<LxvWTNVP7{w
z90Zzg1c9ap-d$F|U#tk%-B1Ih@PF|9<x`XqMzW3qzB=_#Lt~idTuS;S{{<=jOEVC+
z&`75es742Hhkqo~S<F`xWB!QXFEGI#9--G29jFd9OXx%y^p_|zuZ0mD<ovv0F3-^{
zh1rWpjG}~rK9CB%9oiDTJDR2!Qt`-V98~gnffxsicys|aZ3@<DF?&FgAq>UQIZ*p!
zj$j4mw?UaM;vHisGt2W0J+!c4niN}H3o-HC0DC6a14=kEeg9#TS)?a?zXV*>e&{H}
zJ8h3qi~rV42e;&4&lk<4aLo;YWvKdkSG*PKyr7ea-2;+F!Y|{6xZm6-lq4(?4lIp*
zBFJ{rS(Z*CMbQ|@6*o(+xKcK@t5GO6(kE8h(^p3YSS2d|%o7eoCALaju5ZHP-sGVF
z_Qf->SjMbtpl!*!gTe8e%Y&oa<j8S{0z3uryvOV5NCr>EaD{xJ-kA^+%<Z1c55cv+
zcZ0%l{9`noPk+i}YME!zI4Yn6`fbfdckA^o5IuKMx=fAPw&!uI=^DkBYZ2^I+r+LF
zxF)02cU)&kDhEe9fujQ6$$A&;os-ISGg`H?Sv{B}b0H61(+w~UERHQ=>)5B9;ULs?
z*S3fgnCs%puB&_Pd{k<_vA$Qm)SRY*0|w$CP0s}!w@uBFOQ6J@z+${@y9(E^A<5iV
zN-`%l=1+hpyvkB#&Fq&~uGT}J@le9Npk2NU!-#TZIyTBFkyd}cL4Pf+uTq$Vg6U=X
z3}hAK4D7-AJg<-(X>|o(1)*+2)-p-#FH=^^r$ZoQZq4oXJh|X`5sg9hlnJX^)hM?D
zl{qbpvMGun#v3T=5FW0OnTjCw4xgqM%@jo<EAXo{0)LJSj26!_z;xo2O8q<_^t{Zs
z1xAP?^kV`OEJDPgCq+T%1eg>uxm;b_sH#g&z{=!(fCmt$;=J;>$T*veVWVs=()y(+
zh*Nrw_(x9X;@yhmOF-UW9Gnf{g%y)5osTDorg2PyH2V@M-Q+~?lF`iwHJ$pJjTv)n
zY!ThWe(1QEx|*dKfkAcGe%J_7rBCNefRUK)S+(1Rg1dDu<My5$sXqnyvwCB;_i)La
zswfjs<Ayx(fb;|;2j>7dovM7aB9VDgw89<!BhAj^RJuT%?NwtDqdnUbK*u~$=h}g&
zw23!#^2ygeBFdWpL8bLMnWHyyNZ?WMQY75c4@b?aH>RlCy=mE~m_J3jhTCGo>Mj_o
zyKr;ut3e}-eoa;TFr!rm%o4{*Gr_WftE9_g7wwJ8+6N$IJ&*!(-eZ2C+>Ss>5fw34
zyQr`7+l4%OzrZEDqlc>72QApkIZYErvc)w=B39&8#$oL8%+9dQ-c+bCT3_I#i}CaV
z0Q!yKYM9K<h|E>+m}{Uh*TrIP3S#NE*t@!CuZN;P#MFfIINrPUK#q_}dYyWAHejP4
z+O|z?9qW##Vaw$q_AO@NKo30{`iycjxWfkjN<v#w_=N1#w(m=sVv9{vM6oMn%9f<5
zjE?DL!m~=&gre|Ox(z0AxtxVcwUcGsqRcd0i(`#CI<{QHz@8bnSPv-;J>px$b|1E0
zBQ4{rRGNJCTIr|WY*Izm=^st2=4KV7ck0@PPiRT>Tj>r8cfnLyyNiR{WX#d8MBISi
z;n#*oCN#7E;k2^XHXCmggQseLPw`h(`3nVIKm%#ac=n1Elj`nE*o~@f@%y`3GD2_u
z`oyrELDa9d!@!~2dS>=KEOpc78h06XbzQ@j#yKXY>tdbQzHbBu4}CTmbH0=@r-K<k
z6zh%0Db)i4h8xYnR-jYt`L=;=KMX9>3S1hji=#GJZ*GOK`kj=^O1p|OhG^PfN|Oo}
zSobXFC*?0~V+#QHuon^rCDZKWUp37%9p~}cp0e6}E$hvzG%xToiPbOAe?EDIo+r5s
zqbzAthy6@B|H-oyPr%KS%!?Gw=GmB|ga3T;>QI?Agz-g*_iJ<SkPy<bDAU1W$*xnO
zj?mB2D-T}u2xUB<$AyHAr4-i8Ct17vf&A1+53EcsTWvf~mF4D-Rl|&O#D(2Ok|UR5
zY^RE`c*)5uO`<<IYm7MKXf}`G+3w(*cBN`KAeLr)#)VrTOoJE!%npGlR_74)x@J5w
zup8C$PN;xsW#l|*xk)pax*`K-Nr;vOq5HBZ2dfg)USxpfQj#d&UU2_~S-IedlIe^@
zV-?~LJdDAkQ8*cwW57iOLD2;73KAUMtj*^SGTY7Mqni#5!D7w~VnYB+4RR0b*a;ld
z(==TVi1x5mqYWmX85|Vlixq3*VAW<gl*=P37T4FBz<>iU`4l3q@hk#-n;$5$92{Kb
zxg{fF9d^t#@aXPV8j->ahWA8l{(RX+BkPr_m@FhiPzkk7X^j8*<dsOnwPWk8$Ge7^
zP3?*hI#+GA@o;U6S=Z)kanQ<E-^?k6Am~?UQ#~5a<K>CAdNuwNiDIx{UBMhBo?LF%
zUfZsExxzYMqz%LUm0ogL&EFc;lzngpBiK!Pmkma+%`-L_!CKQX7{LZ3*qt_l!Kdqf
z+rTu(_cTk_vCW+TTZCAcxR!%WTc^wjbb}FohizaWc}lf2N9hI65U5aX%hz_vysY2=
zLc~;(wa7AdLE^(YkWEA06gpug3EsQ~%yF)=l!f}))Bg2!SM-f7Xg8!f4JpGW@k4Cc
zfsXyq^s(s~T1dHJQf(cX`>rhLV4;?z0BhQ-`B?<$LogS&(-8Gv-QZ^mv6pUqshZ{$
zmg+3x_k5xH0o9mBOzgQ1!IsZl>}zoH>aJtix=xAdJ#6?y=^uG7_+;snhXpM#Hvwpt
zN@dCKW~3l!<#}FVCF6`hi0=RSIU~tDCRtQ0{#gY;pGFDTdZoWDB{9j?BPlJNwjE5S
zj;KB*AFo(pD+o<pAsLVRLOn|kzw$c<vsY(w+lbAS(WN&((m+NI+a~o>6g1}rayO7f
z4JLym)s3=(&kx1bJ5YrMeIBmLi7c<?1)qsuH{>fP<FQCqUbWG-?l-#CnHduEobrSE
z>IiAwsZeFgYfz$1%&kX8cJXE2PDK<(wkHXR7ez$#zD%_}*gS$%@v-<ROQ)|$My6bn
zEcd=;(s0PXKqn;Y!4BOM<#y!ZethyV%F98D7xJ|gl&cGM_f|ilu19Rm=h!r?5L?8f
zI54=21IkUVF++2l2hP8e$(?qV^ER3adVeXp2yL)vVCe(LXzf`xi_}qeJ4EgKdwl%=
z?7i!9+_;t|`YPD!-fg8OA@c&>T&0R}mCJkkbd}4;cI^}A*bWD7OtH-*bCXQTiiwHn
zcQ}7%Uap^HVgbD8T~5i$6ctfrDU$?1Z~<7CZ+$D|0dWHdhs>}rVJ^qivTPiBLFlo7
zc(!-QoL=wK+1k*2l>(_%;jX3lu5;f?48e*JKQy_p$2<g}FG%#Qil2wR>v>@)v0-==
z6O&Wyn?hofN=FDY5Qa-1_erCXzHnxgsMvf55n3lV-*OhMD2LQxDD9tG{~w)|(aLrW
z>-(~LHkZ9_#<ye1>sFxs$)}5^8CCSU89CIwZka3}p43Bp^68>_qT%#D>M|}ZQ8@sf
zq)dtzH2X5p8=X8<W}@-YQOLG6iCs|ej==-!`!;q7u`n?N$IK@oc04LV#)!MovAg=q
zPq%<cLtbtKtB=P2i1LU<aa7!FKz+|Drw`<tD4z&rYw_FwlB8Kw>ZVct>p$l-exKey
z3V!X$bzI2z(Ba%7mV>1O@OQ^Da6khOTas{#6XFTJD&1m0zSlnk@_moIMWwQ?qTj#J
zI7aX0Y#QZxrOWO@V$=t-E97(>1MTuG&A>`vH$bZcB=w3ox4JTiK8x}KDyFJ55||je
zFmeY;dyd|v^NhD?g7SLEWoa12kNr!W&c*ZDOxqqC5$?YxJe_AS6>5aKEHeySmCh{z
z<SU;rPg~X$z{QJs(q@P$f%#da<{F-`HR>ELoX(2)2GHj`o<j*?hz08b<iJy1g~4(<
zt<dmeD3&{m>5byCR%NGQFennhmtEZGV)0eADh*#xLqt(gk;qjL_Gf4oT|rqMWfqqA
zLv89PDJ$<p)0xcjG|{|EimVBU=Wtn_2;NeTC`+%v)I>Q?XA(ulo&oRqob3j9cL--8
zvjS|n7GxT^4)!^7FeO$P5=Knv+K<~qum<p6k+xSt-VxY(MHg+s-(3D3)|Rf*uGT;)
z;OFQMAlL?#Bvyji?g~s`WvNR6l*jc_*Nf>X1i#XGf#N8X{D#M}-UAdTye^+6MlJ4Z
z){C-sH;N8H^V=8b0?lZa%g^A&JAF&9)m1NOLAzAWu&HFCti@bs2)})C-h82Im{h|r
zlc1N}u=JV^|8u)9@K;#D#}hTF%bN$PXjOZqDrce#Ijgq}TmHwBQ9pG6CaEcPvUJSQ
zai>i+g1##SXeyfqZiN=FHruzYLqxG(E@mcdIqcSx-_f9<@wFqaavJtF(a&K$?P;dp
zwU1-faBJiPOVt3-Uvb0?EL8(b)yAKJrRq_$RKbCF+yH%I22!}h!IE(k6A_x21)+ht
zM+h-&%1E%<d-m`n*e(CSwgCN}(%)9@S0MBs0Q_DF>LY;PyVMIDW>D-~(!#{@DE28g
zFl8Zg7;_{c-cg7vnnqvO%V}FM+qI4rpR<BsomNJ1>1!F4ywyt2&(Nuo^fc3geg{&#
zGh7Iy`1q0eW=Oc>gg*AHzyLo_h?!wgEN#;!j_b1^3?H|jXALrct)Hjf;dcV$-=jNc
zE#`ml^{n*utVoH_{)k&8KP=q3b(%vyXMMmAxJ$JABwqv6={sshW9_ckeCL9@<UrFK
z`twxgF0?+@2@VU>QeN2pd`NT{5*_xhJ|C@}=LyaXTTm=y;9_F?J`M~@utDw6<}~mH
zcOSRXp%WccVVUUbvfS3TUeH&yJBsxxxM^R}Q2KYrzJ#(cwQ4h3Wrf03qqb`D1G=qh
zqBN7E2r0F{Kiz8-NOcW@lV)pM-ZfCOZM(M!r}SS<DVP^1+D5w=S0CzMVcd0-Yjbm&
zM#|Tk7a6C;@`r<_A=Edn#|NK`KAwyQXz+ti>?tkvqdhKtLJgCc5<8HiL5O8z%9(*}
zPHbXP60p!ZU_aAK8s`$dmJ_PTAx~ev9x3I#<1b}5?PKL#L5mHZ(;8{CfS>}pOK3=n
zrXEy2Ml4IesIuVKNw2pYdPAphlFF|X4ovh`LTM=|HublRDytg3&nW+*&+J*20z(~`
z`*81E6%$tnY=zp`yL-#IO*BD2*pWN9n8idG3hV~Vz{F$*W<pTREMhS)q*QX_5iFkf
z8b9|BnTd!OTLc~2N}fU;>lFmzeWe>gGzVxLETcK7OJJJA>+7x*m0}YmlQDXo7Vl<s
zI!5sS(K&jjbX+L7STE6T8Wprx);GM2CYQ117H(>|P3Y{QtfXp6j(aUJ!2(Yj0VYIP
zn3z;x8U!H@Y*P~In{L2Y(T_hWyKU)$It|rQP0FP@s=dcOQ*OtDXAI7=0?wYrW9N7b
zsx=tBMYCiH(`{bRtjHAw_M+|6dD7+!rDUuez4~?=JEXq7fA3&f+_z=%4NB56+ZU!C
zaOo2RJ0Z7VZ#Qw^dln8%W_#2lp&<v}k#F7BRVukw!uF#-4SV~}d%ISGOC7kqv$xK`
z_HGYHY?Mqib@*s>-noCYs;<_Oi`E_xog0Qj;UEr$Y6&0nvEbM~mxS7wnqi0u^982F
zb+Ki7wiJw6TzCi0Cu17ujaBA^A(2jLl&A!_m#-I$=&s59zOEBf-`3%cS?zLKEH(+H
z?(%c=_h@p7b!D2mO%+z5iHL-%<f5|olryO*%%YDQD3S6oEa7VC$88A*%oohy9=2Er
zdGDTwsk9928YXcK!(^dlAO6~i5)oZRVou{`nQXs4T6b5se&ZT>7!tlC<I;gjco;Gn
z7?fet3OFWSNO2%2$Bw}%b1a_<$9deoo&}1iHx@dT$(4-LnH=?xhb1xm^&yI`U6G^H
zg_y-)1Kh&D^TyJ2QZLkd>A82hU#`;dmtNJV_-)U7N74WA<c(D_Vj+DmP*8Om>$79E
z+8Qi_?_R}r{E$ekb`p*6PHM$~{$|S_>vQ@S^~CD5E?=8=S8YDzwmt0X4wLzm$?T<i
z)SaGjo<wki>23dT>F!fm=@Ib!V%JJLN~QQ3P3O~>nP%;H5lx~324Fr^imiLj#``8y
zXFI~ILv;f%(>DVvWY}`4j|l_sFf%;tQ3(louB7sjGl489f?d05K_?uP!G{v;tCX)5
zYTzaX@K&l{OXnN3y<1gg9JIYb+gtiGXnT6e4BFluy8Vt@+w&w91~p7<F~`NkvK-7@
z%fXIAm=V~HVVFnY*w#+Anasept+H~Jb9yV!w!Z!PvgSFgZ(q&mxCC>IFth}9tTkaH
zPbW#F;9D}8(1~oacr;&PK1-E6snlYuzk4`=pCX;<c{y^wIP(LW3xS0zY)ovEVrmKt
zD%&}h<C)YnRuR!2&;rp+qN`Sj%Ewv1M9KzWjcAI}Tdt9ZBi!W^9k+CwB;?c$7?!4E
zVL}~&nXouEEQ8yGTb4Bx2I(35{lfs5J+~3{E#f<4q>NZe`DIP?n?1>qgi;vjbTx~w
z%AglfPNyuI%mF)4juM*7qiGb=Oi|ws5aHWGgyB^z0|&$BFEqI@@X1%GX!uxFFzMX`
z9la8(91ZoYI{miS(k0E&$CLkFjczM9MBN0`RjGc5vM8#__J`_&!9($oJrsxFB(K%N
z<F=cq>6z4a7`7cqGjqAbG%#IkI2Lt?X_%(<$SDmLyyOci;y#bgb5v`gPjUn~o%+y>
za+IV6nq@KvzJw@Qet@FW0@x3((|HV5*gxk{Ce@X%Du#F^&Z9BV*Td({negfbI!&2k
zoB7+HuU?FxOGpb!7S7~q0)|6*J6HY!H^5#_<yT_W4cnZ{I~=`g`2AzIEjR7&UWwu8
z9gg088Lh{C_WCTeJ#H~<xKPc~CMKq4U}1|=;<!P;?QjE7ef5_^5vol^sJ6l(9ak|b
zDJ6AmO0XM<029lVn1w-zP0tUw@N5>!p%~Rh{M%5BYA?m8-bxOd?0bcgFRM~)SAOb!
zrE6!piG{lAW$K}>I8~NZt@Q9Q5)zB~ERHxWtJ#1a9MeMT7D0;!j??l6U6m?Iu4G<B
zptz^Wo@*Ql_2|2mIU-Dm!1OrwEHlK!F&JjVaWHW>6He#^oI3~X&Hs(&1(;gB_gTHe
z9u3GEQK+piZDIi{N7G*ErmRbARn?9))^Ln+8cML3qS+Y1t9q&q5M9?RpDR=8T=!F=
zdR_@InxaJ0!hvX&MYdA(TwKuvN|^l}*h%jq__aGRe<^rsI(DnW9WWjSE;lg^93K<M
zbTBhL6Pt$QR%kQoy7xd%a~NI&(^$J%t(DMD89ekth8pz+JJKIv7;%Yg*V%PPTPw49
zifBUP8yGzlwOcK~t-9ZfwZ8SP4yJHkx_ebV_@c{~W|Pky+Tbxd)7izHG4_qhhKg6n
zocAkm!?#a9U9{TVSe3gxhSZ4R)@J<hZB^8~H1VH&x~M+UAE*xWZt*^vK_}{u_poz(
zcmj`to}$0O?(yW)h58q)dF8(TTF4B_^r;@jlTR0~^6E4FQE6?%qd`q@JtO4@<K8q4
zxfYMjxBZQ~{w_6>ZP#;z;fL5XT?dnpc$m7jjU}-yI1Z#Ojz{O{tBv2Na+J*t8i$g-
zDUEm2H(VA7*9EkS@B>UdW?<@B6gyJ-u4Nm(B_26}*SF~#m9!s^y79YyqCw#p6b`7}
zu<g165mI5%Qv6Ek8$9~^+4Of&H-sxaR~Qs~Qc6s?;b30|7B-DAa4m~Dlx;xt4&L$G
zd&jju?y)$=O&M_C3m6tIlb8tG#ew1am^sAuDGNOzRxwqtYJ25;Y*u8q(<2(?Re@ih
z7X{^Cq|jxD$Lcd}>gL*G^?Y8WQ(8nE)i$SwW4%nXYns8VR|+o1So>Kc6@mlH`YIBt
zIDD?jY*m%`voq*~Rvph5IzBrCphA?ebe@P3$k5;+5(RuvwTLN$Dhp?4v>v0Z#;ETK
z>oK04t#-ezdCxpeL<F`VjsFql5sTuexY;nlGn&z<EMx}8I?VKY%GL@bRHdL<RKAxe
z|Mj198oy81-g8AE!yI(n+dNjY(|#=wMixOB{gTdZy8nFtWqj+E8Jg5J42NJsn2CvP
zNz9}NoGzX)O%jF<_x8Rrt#4hLE#>}oT1b|rUzFEplZvl5;YtaSBHDOho<xNlLRLCV
zR0yQR`QoEm517W$BzXo!wtm=8$ZBz)Rl8Vg$3w5m9dg@97J#fuTJU<8{UWRCePGei
zqG1tN9?<TFi~j3B|NmCvcF9#00`^NLMGSziY@#aVu$$giT+&m40azP@+gO0-@VjQz
zY99wMHr;TQa;5?$T{<BOZRh=gWE2`7qe~gj!0jC=v|4zBW{UL#?n?xkrLgoO8lx=A
zzf`nx=ir)w|IW@JDSJAF4n-Nnd3JV&p3i154FGm4GDUs}AUb7bR;WGPn^Rqh=qi%e
zHSn+h966e$c^<J?A{M9o3kD0kA-&7@7$j6%yJ>H`r}yZvEXxQC3)=?sF`+WV0rLWE
z5+0Z~HJP<ivpEE(-QtSuI_gU7TnE3INgmB2@QrBcqdE#8%f$wMljus-wrt60j>4Eu
zAh(U?ipX}{Vz^B+RQemv(cfh}%NqfPrHhrgYROV%t*RB7OFoD4m59Q<iOefGk0XAA
zWD=$sms6P(dx#cp5U1Uw%JD;+upq>~MFb`x4>7YS#ljP|Z%}IZ_u&eDaQ-;7y!`4y
z(v6Zc@V9AMgB`CcQZ0!p#Sg?;sq5PLh1%XP^hY-NO<u|PjTW500NF&{R31&|u?mBf
z3>C|+ekb`KvmE_SqnM>%%L`S1FQTkGpDr#wp1jg)q6cC9{ly=joAMSNYW^41$G^+s
zG8Op<b?$r_WqDCwQ`Xjsa*bB)G&_RAR=>oOs)AZI?v>HW=P&Xm?_K=C_%vG9)w?+Z
zujM4oZpzMjBT%zZcB4zjWf{Hs9Lr=<Ty{J8(7pB32>pbNaaFFX`y~wi8S0FDZCh&m
zaMSA)HG@0lFfgd@)qS*om+&-Y$FF5^on~Jef9n`M!B3z-Sh?-BL!VVcTLfhPUEcJs
zeV-OIR?R7T=!+6IJT67I`KDEtwg1L1+Rob1Sc&bHH#Sk_(HPdx_P4>+WdYcw)6!+%
zR%%k~F;5qs@4xki{olI7>DHw9nTpTvwZ`-Ljm*GHPbczoxwI6hTcmRq%hL=#IPLe3
zo;FwX-oOZ*nT9b&)~M`KZ99&NnD<)g$IR<_c=G9D>71xYHgu==1r;Ul_TGx4H<$Ff
zg=@;`gJ^btBH?Q_m%ujDol_MDpV28q*E_QdU;IpgC0)%a`s<TV7whME`!Kn&#g&)o
z^>c_}6cNw2CEPoK%94s8=xgyZOQ&xtSA%jhL{oW;UhDf}7;H=FttbYKBWB<GF2s4`
zyL{X29p?ZTB{L~r(Co{eNF{B9Uk;p-$0yb0$vA9Z$G&|jEoXSm$Nri@WgXt~vA^Yx
z8FH)FP3}$gJb2CXzO}X;G`6V<lWuE9Xy(I{XUH=4Dd?Lo`ZT@^Ciy(gil1-xZR0_l
z^WUX%wEpWvCZ8G2K6h0A&(_up4o3J#i5s!@HJ6(%*(|R+&D>V=w!c~1b<Q@<*k;)~
zQB~7+bTV*wHu*<!DKiyuhn>!Nz?gg;EWpU}k2cL+2E+-Z=VO-<8xt8?IB)_N+m;D=
z$PRZ+<M5dWD*!+mqRNx2SJ>u&WEooSM<W$YT8)FMil~)YiYiLp2~aK%J(h*pnr6yj
zLL73MCQ*^9roMC7akuEBWW)&!>S4#@9wwgUV;Z^^wuKk?G?Z>=-2;{70Y)FIm%o4n
zfiFM|w6qMd#v#@?#2W7))~L@2i1!?EoUwalKg`%m!)?vQ5MNxr!w>PrA-*`o7uWs_
z@x>v&cv!y6@9wD{;){>uMGx`CNAa46_~K)D%R_vznVKQKc!crAJp|DnSJY@*&-uXy
zkBH@20VJ#$o{b4NB@UR$Fbh1Baa)GmK7zV#Wi{6qWpd%|V@Oqc;vL40nm!(42x+%S
zl1G_q6Vt(_$0a6SXkzM`1WQM{QZPw8OAe8wA(Av?tqoag4=QV|iJs^)<FN*k$|JKA
zPtqR^;iTmU-w;k3!bw9oY3<JtP8z~VD|XKzoK#N45KelW9_S&Q^eA5Q5KejwZ+QqO
zHB&Q$lZJ58(k1g4!%4>;RbozH3mOp2JR3@xNE=h%64>;4V3>|89b-e)>&I4k)7=NP
zxM|=;#%L8dY8W;jO)*Ye5|eY2V$*dcCI(0&cU|mB%cX(oGfM^ov++=j^In*Zw;+e#
zk=pp|?AIQ1yDIR)B&_;y9*+^5E52Mr<2(g2U5RMJh^i=4#T??>D$Lz*|B5K*ahlIF
z332iWLd`JpG&w&zQv+$m$~8wbbi&glj3#i?hacHb5W4t^vUx1?AD^<HKAm0`#VmjJ
z^l3hy&C;wmpH>{m=RBQ0l?ndy-P1qjMVzKzp2A~2o#zs(`*D%tnzo+C@eMAY7*|a9
zBOt*qZw6vd;2xgO)HvS#{{BsChPE8bJb#)hGUlhnJWFtzGy|wQkCF+F5}fK@u@_pd
zXHXM+VHjdUJO}&K=GgHqOSm>OxGzUA)tx7)M%Hll7iohAsA+WbbM*hF^J<ohERE3?
zJpLM@z~gidHCh$zsLatkhp%92{+Jg!yp+%AR09j5{@aQr&61__BTD9KtS1WFuJbf4
zTg1>Ju3E&^2(cPrYXa4K+ky;ROMA&eoaJb$n7ZZHS)4`%Dj+G7(;3x=I!qxP#92Cx
za*1xzd4|$#LX(n%4+JDCa-dKx5}D=aXJ?!EtzXr(X<Jwgcmu6xK^R2^R9>Rc`!r3E
zpasS9E1<73-SdnVm*?o0G|3|c^N4cFVukGJwRIIywI<WWS9F8sNvwE`5rcOLzjB&O
z=vt(F4v-Kj_RWpGId{HP`wSvXCopi}OB)l{F>qjd7Pf8aIgV>eQyy{!yVfS&-@756
zdNY$Na6~HVtYAm=D=kT{m+l9;=vO0ZRmS=lDMe4S$hYJLo*SLY^U3)b^>)0m0wR@L
z@n`{t)M|vuOL`Th6?^iO-sm#}<QR427><s7|Mhj9UFsg~Bia2>jVtbP<^`sQB@GEC
z6d-$kK(Xh9gt?|~`Hp$`kiAz)DgIi=XstC3*{c<)_+~SDFRB^?iwIF(E=XPcfnLd#
z>#$s=OP3=$&E$k;LhZ+CsQT-#%6Tru;<9TgTgz9Mve`<MU%SofP<{BT@7NciLmlBz
zpJQ$YP!?V=OnuMC(xp5we9i-Nm38?DIWk)MYF|xlFRea9%i=M&jyhw3P9J?dskGdZ
zY`)n=UNv?N`pd<~lOE&#{W88+4EpuxK$lRsuae9Dw8i+p^chB@^X}cFaq~Cqpcl7n
z3+^5DpQz-ahiB;aT3(oD1$?J2`>ZO6t4SHEXRo9MpG8tR!cXqTVSe-cYqT{h_=$dR
zCwt02c?iyWXLnz{Z9I~b%yf)^h``5G2n!SD7?>I&#8L)kC~U&rkPRo<5{!PWR93W4
z*O#fPI<r)ngcEFuHrYG!hV$(qoNo#mU0x$adG6;Ge7t|~K@;7BZ^ixfL0H1Djn&uo
z(bz5X2fBOm>7v^|pt0*lP}NFRLS$+4yPe2Gp^gJA)UhZLL;Z$55FQUzNgiDS^KJ_C
z@=bReh5CT>;-giFJzKc0Vf)yU)WC!U0tZwwOid;TvkXso;Un;`{;5KRWyM1DR>gAf
z&e7Trj4b!K&KJkDKj&&DL4#DzqdRc0?t&K^Jgm>qNkBd3gxto0T0m<ZIN0|@h#g{4
zN7|ulTlYX~eJCE*JGM)gt-Qfj{eHHp_IURl#upz?erI3d<y7wMZ?|bTS*psay<>BA
za2y|XJ;}jL9m))T#|)ssOnvBP>TPl@`th4%w^~DAc+7VM4hW%`1a^q2No?#%)3-d&
zCoT^T-)gPV(-le9Tghc~1&Ris^Kf&NlveC%M`aytwqO_Wx1}yz^{8ywOmzz|(e=O~
z1;XtZ#kqoa9;69-M;M`FUzuFcAfS$cna2qxB5*L}u8BR%HVxmPcIb#BTA4K}<~|o^
zW2g?x^KO>sv9D6kVutB>4(7HkF>ySO179#KspmM{Fl-hM?xtn#rg}|Q2V~`Lf;B4D
z>fdlk4!)%ag7X{Kd$;CzYeNw8SsWFoOCgU?&FjB^JQ;m3Ki#Q&syDiC@K4n(HT-tH
z#_!BSH2^7A%+KJV+J8yq7c~2_Ls@05@BgB_b4u$k&vBJbZSc!2{WAlQV(?I{60re^
zyf07IBhkx!%NCMbJ|;eMFk#ZhzI1(T5Zf?m;8@hPhA{9ty}U^zA5`-LPr<oky}GT`
z??bz8tJPhDVNkB0p%W^uXu_rVJ8+UGlPz}GA^f`{M7;%4r+3q!T(6p+c@lva*z_I;
zZSSKE{|;$>+bY+`u49|TH%Jf|n1wvR#AY7$xi4_waEphwC8gs&0>m=}W)*)*^VI`E
zJoiTR*fGz?z8*tr5N4Y;c09+$Bn&+qNa<tAT~oTu_ASl_oA-X9&+n$itXY8r_W1!C
z!M#_sU<+@JbZ!w>><!smYFk^!i8h-vkF?a#<4}wTME79QFNo5Rc>I7(`iBR3K3e^l
zN#RS+^e~as!zA=fOeys+^9*X6Araj7j}YseZGuzw%)|$Qc0OnW_HGf+$G%KM&t)8z
zsm((l69FD2E2P*CEyE&)>x6#zNP*9LT&a76J`Zd4u`gN63=HlC0j7+Em@wgE-;*W|
z1MYCkBAin)c%JSSZ83P79s?43le207L_c;%*8qra=3>BXte2Gmv(ft*FdKK~nttGb
z=%dxmxy_{SF&q0_`j{A@g{cTEY`Bier0`7B^akC0(9Iu5HG=z5tOrE&sy%7YuD6Ip
z4TM<hj<q4(us<UMA{sq*;Ku{ku8&>G4w=gg)3kBuFouasJsbpt;lPrN+uZYga|2n=
z>Mw`N<tr<f+XUfOea(KAu*Xuf+^~3HN)Ws-urTq7jj3ld><URe>QZj8RnoVr?UnPf
zIX=2wWVDHimSs_eEXopWx`r-FuVj`*qA5FqF|K}9Y{ms;0I|G+Yfw~{!G_>uil~@I
zs%WoF1Xd9Hy3({jXJ<`cbth+MrELJwnX<Anx~7n-2-iYn6w2oom#{s9vcIte@fcmE
z*YXPB{fQnBZVjTW%iA7euEkN0DHVDs{b@P>@Z;>KAK6d8L6K!NO*09_mw$XZyLAEP
zypS`@Zm{}yGKa}{I#)R8f+hmjGX#~ZbunhZTogAWbaD%c<!K@!cn})@Bg!LPetCna
z%qk!J>vH|Sr)=%gf>O>ji%JQL@?ZZsr}6uA?LAjCo~y>a+dS4PJjeInf^NO5Q0W9D
zfSh@Q1(+Dj$IKA|8;(USj}U{dtnhXFUB&v=ZKXw){yHrrOVck(joL(+uFsSzUL!@c
zG2U_#6>_>!OZ=X2lONSHASGxQA5X49y?bUF#$SIxOdUL!r*TYYxqMdrQhoC*NfY@4
zqx=iZOCsRPG<)_hhGE;T`@_c*g**AN(D;)d3sLt1D*)3tnk3I+85Z3JQJ5wL2CVus
z%b0yF|Gt*6bw6WiEPl}aTwg|o{GlB1Uq7Dw^jvM|t^M;wy)XVzZBXd+c^s$L%G2}X
z(?aN>J*~$0RL#auog*YK+u&)Er*R}`A#?OaRvh^yIHt%b|58QU^Ep$X{_2#8azLD=
zSzTqfs;T`xqe(u4+FpvMaE#u|geC=2gM9jPoboT|w<s@0=sGGc;gI-vqP~NwqiR^=
z>UdHl`kT(1=BR)neC6?6-S<xNKW2GN9a?Yaqw`G_?BB|(NM7slHuvc%iD?0cD$TM8
z>W-^ZQKRiLIZdxX=x8kAc!L|`8^p4d3Pe>~GAS~cC=4gu4Z4=}i%j4sFUP;{Li9>_
zYB5pI^LI%>@!C$iw*??X4T3pTsVAo6V(JQl1vQBmO4D#DJLCfOYHcknBlJF#iC6+H
zQ}!-8oyiRSkH2L!na4DXiktsAf^yd7D$%-BrTBE$$jwTDZ&aUcWVx=8t=Fe2q@Brs
z&Se6MRahy3^>e{*2po`mKzweNFg1Hy3K%6)ng*em8q~zZvm8uaBg8^V0X3m%=siXj
z$<;MW=ya-tuo1ZSwp>bGSK3Me3(GwyN`#!jj;C8Gzb;@W8rN=rRX-Y(a6lIe8pSHs
z5z7KiG79LPj{N^neMu)1bb+R@MMi+(kf*KU)9pA!lqYE+r?cYb^p9-vo4k_o8#U&U
z+Df~hLA~kj0w~K<SC>6+Rj@AC)px8;-3y&`S4cN*Qa6Gw5Q~y_qcG2-k(${IfH$pc
z6%@5db53KLox+^AJDs-M8I3?LR$tqGkkJT%C8T=RPx2pWl%OwBA}&CoN#}6#K^r5K
zCe3)dDSxd;`0%8+!9Mw<9-qcC=kj#P?2M5y>XinqpPJ@;V2xY}lA@WUcUciTm!P=(
zMwyITckZ>yiSDAZbbF$+bs<irMysTkcrF#6<Gxa$?%EZ-;8;Fdr?D3VmM;T|i7y2v
z!tk*VN&DO~Lupu^;~4UQ)k?LoRjCW?rl)2i=)P^Sot?d_HslH-4fpdk=lpW>Yqd3{
zOnfO|FscI>K^oQ?;zD}S^<~5_n}z|DJx%kX(lU$qMk^ByBfvw*C0e43{;YwhTT&-F
zPROMZV9PKJOoZuT-?2>WGa{uBA(e)4gw_tbX=GEOLO`{8uid@ycWDU8LNh<qc2Fal
zN*1(uEf>u(;<S*H6lA=X!b<wII6|k5+qX8Y)t8lgQb^m;Lx3bV_&enhg{!sfm*Y49
zk$j#AJ;mD^N|tNdhUa5OEDsZA*_d)_V9N~rfSCay;vOvV12UBKCi>0h()bqk63BON
zhh4{ia_6=XdJx7?%k1es(!lYtQmdauQY-b}9pzxUN2`r8%cO>F1=tTA3loQ1*f&E9
zyCQTQZra54>|tx&rw?jRn`)^uXb-&lGK7fDcin5h<5pXCs?`e6F_g23=JK@t(Iw5%
z$CKY_d`&a?@nqcnWAVy2mr;JHud9Duyz1SIPW46AZ>?)aOZ{TnKDt<PEa+(+cVEW1
z)nLy>)U?)TpQ`m*-Q<%`7rj2(*XVv)*OVQj4^LX!FqAZDMxwrKnR`{i6aClVuR4U>
zy!QLs+RZdDDX*TJfp%$cv`Y^k{%ReqUTCn8a3)>sai3rk2!egX<X8lb<GB`d+~ANa
z#P;A3OTi=^s7RRdIjDeX()au1Gs&Z{WN8p{Fus-IwgQ1ss)l3G*~**dxfBZ35hYhL
zFQSR2G6H3bLLz$}<@?9~Rk`U{$T+%^*$vhMYtV{okbc{|;zfUuo{@U4cLHOCj&BL>
zyO?ldV8VsKj2aABZe{5EmO-t@n9ul4E+DvUoxRXi1uqWEAlR$#<<ZsQ%Zts<S#`S6
zU1O;VaQl2R$)w)qG-NZ`;vuW}=58G}i&u>{+9HmwZknb--PC{~x4iLE(qc+yZ<^YA
zlT6Cwt=zT&FzWNmG#2^aGPU`A*r*9@S4Qt7;%Tz`?A_UL3Oac&zrtpDvenyHqVqCM
zig#5l5THmp*`cd9X|7P{>cyr-kxow@zLIGkt&-_eVTF<sEVwW*afrl}2!feoc@Fp8
zPy|C<XT9^W)ZQRuxK!;_;l?_axHs?Mfhhxnckpn%gXZ1oUWGnI(8<9lYJ)4W@jnhl
z*;Yx(K=5^Vu0(RQTApKZg9wNz2T+vPl>}43n0ee4mT6Jbw&;*0zqee}DofsUDhSrn
ztU0VRydF!ke82)mLo39ga6(K>=3?J=A-C0ZLSIM{id9_2Lt1P7Go-cNV_K`q6}?Sb
z>k4)R&681*9OQ^W^9#7u=t}ldTB`(B74LYe?m}^t7i081DWDQ7z$YreOBlr^q*Yxw
z>g2NaNe#ey4WmSlVPm4}#>CZMU_P@cSiyPOzeaE8MHI&<ky2fsh<4sDT&<|>we`Fr
zS+`1ToXxUymI3JYZj)72&pX9OT+{Jf-)5L|>0x5J4)%RF#D<`rEiH#j-#sSywq6`}
zo~(*Ko~WMI=BjR$kXp*)y=9}SVegWS>IQ*t8H`{WK*ZPK98+e6*fl(EbKh};l_%um
zjIezR5>QFQgUdK=JMBube-IJ8A(eDUCB3J>=a5Qz@TsJGD30gcu`^~@SImAKF@X#n
z>4gmY#Fm)Y0mF=hHV&A<m`MWZ5q7+prz*RzWmN4s^K?N|+?;s&;8OI|1MHMF>bL=+
z9yhQlr2}kX1XF1-Y`L~D{eTlj<Pn-3-<~zP-1^>Q*62ePu3hs#U1=MEM=WfEs1Yh0
z9I$|5*LI0*H~|akJ=6w#RQaFl43xV`@qDPp$B?>t$f=vho4F||<Guj^ZbJr`*uuh;
znKq^l4T<N6rpfQ2uJHkFiubr3-d%F$!`dYWT-D*?s*WAgK0u`gsMN-v0V;KXP$}<d
zbvn~^O%_rY3qKT?*uICUZ4+!VZde|*LsyssRBG=~Dci;CfKp1&dMrRGPdFx#0mY%~
zg_t<h#f+K^yCkq|;&X2L1ONZP|9?OH|4_p50nq<9psAL{sEW7rpi&>+(GXH_R2>zC
zlByw2;76VpahiU)ZN|1P5r%UbN}TI&p$Ao=rMc{1=DEbF?x}rkKDvX70~;|}zlu4y
zvDIXi^V%Ad#+2oV(*&`b8O`%nIe;HfrYjL#Mw3gdC=b<?cZvz@8-@h}_YEZjh#)3+
zTmu`@voSHagPCg@*tTWh7>4wHP7XL6qL$;GR19dXrrqiUY`|WrX78mIz@p^r0=^1}
zZOJeUaS$3dCc-1w_k0r@7Lz`+gyDr7F!F;lujS0s?_D|G)-thu2mBSt$%1#U{_tU?
zP4*C29T9(AT>jmiZwZxuXKn^2{{engo(^5X8HoIk$XR1pf||m%u_T^{i5CdWgs^eo
zP-ar$anIpL1gGjqa*3w;79Rhu{d9Z!{s#bbS=9Y@0#O-;OD*Ypm_b?^;T#INx;Exg
zGD>}y*~B<Lt6{Iq`yFArC&GQ`6F)rG{Z+!aE9lDOHerlFU26bc84kgL6S&wGp)gE?
zF~h!xjG`k0U44^ba(mp>&PK<BW6ke9!9bgT0NAS|rp*_o2n@><Sh_64#A7Dteinr6
zsAXEh^4x)ra(nRAzPH71!(ScLZh7z!tlq?qd$YeM>id2#OHo+;t_K*_0K-~100#2=
z)raFiet&=D_gla>)2#UUW(&sFfhqr6Fk6(1z_dB$0dX*)j*po^Bo>C@bL!Y(C^uA4
zTK(mxTflgDng~U5OXGh;dBmbPDsDEQl4cb~w{ly*r)(|Wh^NyT&7#uF6Xn1Db57&;
z_fBu6TuTGH)d>&mz;F$TUFtJT0th5KCd1UGOb8}|kPYls18D03fwu01+^UmStK74#
zVRWHdWAs4{L5eP1YZ*){pU-A#RxAZ-Y2cNn#lmTZ=ZXHc1YId?Rtd%mSm>LUAlMB8
z2P*6aI513#Jy*EWasxYH#%Qz=QuSx9;Z*urQ2{8E9IWWNfbl%JrU|&I%Ry+|)s)_#
zYno-iZ&fIoD|`*sk7_1LCU**@+MUpfNte6Sme}y6#KZ$Al`lQ)Qq%B!Axv)*6#Afo
zBKzaBS^}lo2a8oBa`y+L+L^=3<HGZVL$C!T1VligV3!7%FyS&zEthPf8hvCji*Izx
zeLotj?R|9LKTC3eQ4KJvE!OJ5V%46KTs~?T)j(pkvM`}#GS}tUFie37vjt|v3vp;u
zVi}xM8u~|$y80Flt7WLG!=$cS)D(9DU4_CiZO1UNBLjhnBLW-<Ltri(;u?m<d>$U3
zeX&>Ks=b1)9<W61iku=L3#sq9n0QiP!fl3qQ%Y=dVz9usxa4B6LiUZEx*Nu-o$ZVP
zIdv!mArBZib;Q6aI|Log#l8Uy2PS~#neAaJMd*5#YZLPx>PinDn(qvpdH|c{0Gt|t
zQxExg8u+UQ{;G{X1AkTjXW*~;o}8qP^az(G4yo&5;z){tq!b69WqUTUr0s3UWE-$h
zx8bky@ERo4qoS`exG8MQqnKNvi3x)m2bO7I$L7A_Gsk9Rm3w%o^H={2b^i8;g!*iq
zQ;aBG*rnUHZQHhO+qP}nwr!iIZQHg_^GtvLWHOm#ZmM=tmvymUtY<BDuH0{hpct&P
zYPZH)F})WmLxUJr8x^Rv=FIww>zdb&#h$j?^&Sh=`0|Mv)?Q9-VHqc`xl~0BM<U}C
zGiZmZW@gss=H@?cJh_5Z5-Bnc|84yqt0|Bh)RX(hDPZ6x>Ur{@DaFptuVujbTJl->
zxrGxa?`}S$Q0FCi-PAS$&n+XJg@|$&DF7kRIewflueedK#^KMeYjS)Dlhybc`aY;5
zf1vP9t7r&-=FxeCn5B*2W~DMPUhZFt<3DFATvD5vLAYCA9Z#7jh&?XDVkwf}X=EQG
zMv=_+=Wb!z&Dg|wawn7MKo=9M&Ha;#pSc8=oQ(b%=lKj~HPX<(J)srA^49uGzo6(!
zhshnJR|UqC56qSZIPk<8{uHsidoT(8V?$->{}SABbz3##tS(pZ)zCh>?=&K(?x$_?
zgrf&O#7wEKmnZb6k~i$1i%znT<vn}`v*N6p;>)8rP`HlSnwi<yh{B39e!f!otHiKy
zQNIV0kB%YZ>^VoAJY@`FEJ#$hpG2>*myup=#8P@|L1Fz4L6q=BJn#`KcjY<0zSa?Z
zfg0FFp`0|gR9q}5O|4MNs6EvbcsBaJ#ER^nUVJ}p@&nHyD<Y{44%PD-mTqFfxSXU)
zE5FPC_q8SAJ;{CuqhIEer=C;<4p-mQygCU{gjC2vZynNx2cAC4QH?rUG$C>-8hrvQ
zdv4=TV`tl1z8JBudl$mfl1b>x-QsA046FhH{t4&aV4t05FP+b1$18?z%4N-lx8Bnc
zQ`hAr1?>X+*kd!ieEo4ExVXt-4LC_JD7A?26VXIkTQ>6w8zg}^Me<E#04yWy;*0q(
zWjBBr0eaTS#eMwTb2e<#&9E{?UnJAUlX7DCi|mQC<mTL<jKQ(?yLlD$>!?U3GjPsG
zYP7XnU*5iVK&!zz(KC|h(YZ(OZc=N}lAsdPJxLw_Aw-#$LRc-Pp~`m*5663}$5#8T
zneN9`Lw-~g2+bk*EW3-Z(faamf{xlfKbRPX?T*)Yosx;VUL419C%2$ns9Ry)f1EBY
zHC>ottjHIqyVykxU8dQodu?8lYpmpSsj-%to&MUO+RK$cM}Or^9Xg}rr75rW;T=Q5
zojS52-UnWq-XP46CF3uL))v-ewZ9H&`#k0+G^!x%jmHExxd$?7q?Jdz=MgS3%)&mm
zFuxg_q}_E$m?y9-6A)y1e_jl~bo@$WG#+lNv0zN0RT0Cw*0_2*N^OO5!~NEBMUMN~
z)K%cO-}QPIR#`9a3J-@T1L~Oa;kH-$D8#^1DtmT%vz0Zc@WP%CZx*A+-09<yzF*Xw
zByP3g+Hpxa*i+4y)(^lwUXC%FV#3KzxA+CSKEKrPj6+Woc(N8frd<0_n?4Fj7v!0^
zy0;%3C}cUTqu(5qN}BcC+K<y}$K63`i+UnDfTrwUZn>oww|&OgioAg?qo(^F41Wrf
zM(iIDwsxGlOIw{&Uf6!C;baT0{Jv;1NDe4VrJji2b?Kdh7kh2bbPIX8-B8zFX?yAj
zNo7L)$dtsNL$x5Er1D?od-l4Pj~rB%tchc__Db5lIGC7Vsg>PRkV;Cm>(-|WQzU6m
zcEX>|ZMUJ_i$~iDp1Af)6t1KCY;0NMY-G9e*_PK{+t2QpI+Gu7R5F*gPSL2yFH=c(
z_gv%VX=?~Qx_fM!<tA#LVscsb0<>4ye4`<a2w!!nYle#sGIwBNpA->?i<&#iFn;b^
zq1>1xdUwFGN!Py3#tssh)_t9x)NF)r-mDh7@sxbruvB!-ESc96U;LiLVD`tfT?t$d
zV2eZO))p}FV=-|P|H-~;_{H@}a7`evXOI7Wtj|?2^y5LG8#ua&J0BSOv90Vlu=^|w
z-S{A==a&*+2LU+x@qW;C{mdXJX9q#I_sf3J_5$ce<4@a*D3+4KmWz!IR+14>#7N&D
z<!gzsD8l%_+g*BOM>e=UmUT|Vn4ES`fXsLM2QGEQrSZfZqMXI&B4Nhn_OM6@omm{V
z!5@m`K4RIfrmE$eC+AhE9kYH9;hJDQp%SoP5wn(v`s4G-6`~ir`4R<qyyvi_wyBLl
z3^z#|sHruiP4zOIi(6Y?c{4LhGN#5FENVPZ8nwK~Z(bqoqKx1Y`&qaJe+H0a`i?mg
z!NWe1`~qoj&_l|J&>smw?Lz8`cg2tMx!DwC{3QATXg4*vD~#{=S9ac-qJl4{Dr8`_
z;a>Qx)$M<2--RUvOtv8l^cUBspLgKxdWUSy5wskmegmXrWiE_IIR^pKW*~90m89V)
zJ+cjhgrN5HlpfM;im5Un+e#~DUFK+ywd@bKXuCU|gur(4-fx?^-M#kpTdnM6(7h8y
zzaue-CSR4dw5)v~Frc|D*mSgCcQi770i+3@DV01Cb`2PllbU0)F)sYtxb9n8ZHgM8
zu@1lb^llQU&Jc~T69gLwDn`P<;7kV`9491+a7X1R;kvCZr;BG140nxORzh9~m*$~K
z2JiSaolur1)sj=~m))Yu>z6P&!ExzKe06I9^6M02B|Y#+a;f97b5Gj4;w)HR(IuA1
zC>H8;E#ZthLP)6&LVvXa42&8@;<uHeFr_A}qu``RPnF@9%U$AFFX^(EXn@FFA~)5j
z7Gy0UFtvc4`8Ec|9suQGHb(QpEAVZX4Ayz))=Fs9DbMUKg*m@B+xAdrMU}aBBFSH*
zYJ_nClxi_&DZ|V*&1G2(R;IXQ;vOqDi|l-@Hrs+cvNcPi#OfdEFB1E1)0UxHzSM%^
zCusUTB=px~k!DXXPy0y}(vxDbC!qP@*+r~b$1kk+;+eKrjkmV|6gPIZn?3f=%pNHm
zDqr7vZRu(*bO1~%s4ty+@*KVXl~9<X$0k1SvACw`s<t(e%Pbbl;`V*rCd1@ZI{z@J
zicO3WsMCD0g7#J!V}?67*t!Wj>|n<hp$h%cTzmh{8}$3rjlDEjk$mDOp0u+YZNxYl
zv+?f5^tqu8JN>EdY%~?NmaX+UP~)o{WX&22B|En$)<T!s1N6Yj37?K0%vi^Vihb=$
zxhJ9drFyUbmpB&bxpYbdG(~gDte`AMY4QZb;?)&j7ev8o10N5is5CWoF?l|nhm>)q
zv*+es!k<47cJoy~Ra4cu#XTCCz}0oM>K>k!yb1h!KW%0>T8AHREz8v_?W;<QzDXzF
zttZ{y-<y42j~r}b6{>1&erGIa!cHerCdxRZq`J3e8Yx|NV<cF*0Eg_8Cfi+4aMm&u
z<9hblouZYIx=#3S(8(8ka^Anw1m&-sK=Y$+esOE}&2L7f)_DIn^Yhz1aC+qi%)1|i
zW>2<g{P}JRT*Pkv=~xhtf5Kjrd(RvnJ3J9%7Zn)ozKr0?XXcsoO(*+Gd^xnf>}1Ze
zOO6<DG*(83>uhj1Ya?hQs=!hp+~<=V+MFQpyElJ%rwUq35_Sw&r+0e7V-&GM3<E6p
zA!LBUjieyP=!kQq_TDO6t6&}yr3gw|CP`m-yj`>GwwzR_USnr#v5WN=FKE(2QH-CH
z#2OFPuG3#~Oexbn>x$?=X#<XHowVE9@kG5<Q&UVW6-Ss7t3J%b3Op>*_z4U{!8bIu
zVAuBZ4vexj61prUr+tzS2beS@LgsK8|8}jVU38Y#cV97yja@L)iED5va_Q;~pelOg
z%N;$8<-r2s*J6(Dbi|I4GVZz=cVPEF{59Sx+GYshcEo7k13m9};|XgMZsAQyLvxxN
zQk;>R>gqW|d_FZ<D54sBdN__hR5HVt7yBr0cBR$4@b9d+I~PyVg6y5T-QIoZ$n+8#
zWX~sO>7yjd!<Wyj>we&N3K*4mS^WX?>MNS=ux56sm-?hh64&OZK?uB;5o)~gfI*(L
zo#uFIu<Z_`w6V($`-kz)_FC3L`CAM-Qlx4<J+$@p=Yp+mWqhXg11P0Ix&*FLXn$ah
zN^Wi*tPs%8S8dIDr?=VplG3$xT%}^rQ)FsyuVSC_p-S`4ti<RNP@m`8TBRrgvDAfe
z&C0y^TSNAXTp?72uVgpU>NpHbJ`1?{_nO3eezNZnum~j^GqV6XVKU)##EtYBd$i$V
zmED1gpBQ>o@p~noCjOkyK&{Px(f~c*@tcql>23cxY0*`u-7CLsx^8q5U9mWdBYsZT
zSS)!JRU805J7?;>#o>XH=bWGbh#u7$41)ev!PQrZ9awG!#*09fibv5;ZEnn_o<u8@
zmmy<h&kT%okiC}P8f&{y%2qgJHpFYt5Ed)`&8?44s<U569RTI;P179Rs6ESgTy(Af
zJAjoztK)$wOIO$sa_SE9eoM*WI+L@6)UdVhA%0F(<mD4vpkAaUy@T#qjFLrT<eaKi
z3bjB1;Y(JoBqH0HtqIkPvVbvz!dof@<6U8tJ?j9ev@2^;N(sCM3&|!-#L&nK502;F
z*a9;L-8uM`02lRlHp(L_HGg{2)+5tO&z1>#vU8KS*rW-aRM-B_R~0u&-BmJ*^~2h8
z0fW}+QroguOI^HnOFuHY_BJF5BiGq-$JT$T`9<yYse|JV&wQ(5GM5`n^qo*$P2X1u
zzq#u=Y93*_*#QG03=&WbV5~G_-3~#cj3GDxHrvHKIZu_7+tdlqf~q=~bnC7;`)f)1
zi?H22{JLpkNblP!_)b*c*;*b#=+j--$78Wc3T32yH=mzJ@#*VW`N(<!zCi)9Yz+d*
z34Q#o_^Ah9m^XFHz`LJ6`rx%B@FU_&l(&V8VhX*mm;B4AV&c)D^04hd3ck2weSE0N
zwEWG^(5~1jbsZ<%S*#)wc&?rC!6QP`B2z;GQG<k~(iF$niq&Hst)ieM`Iyw8fudhU
zT(kY7)+sLKNmm&#g)crzfmf!PF{rq5+HeJDnDgUT+S#G*fIe?zhyuI_qa=D2l;1_j
z(OVe0c=4v<`I$%MBRbQ?w@9jLJyx6+onF6Xl~R|#)odE*g`4|&2KtSvOCwm#OM7!w
zQIn{%7Q6z_&LuvVnk>;iX&LmZd_|}&yU}8trTz$`5H}?I$C)mPxX0ow@#KW{cGsmj
z71QcxdXXMay&JOQ!$C&cHvtT<e9N7|ur{>p4(cXjwl!VY=Yns_pxW&6MnRcISL3JV
zf1*o+J}yDe+G@7!wPRHYs2JvTS}&T5oi~TM?6gg_<rQ4n=>H2>xtBP{>}q)JEp6?p
z$-3HKh)Acu7M)2J52<Yts!hQ$rmYixhcvbkF5)WYiqwbh%f7eK&)Zfl($%tS`Dw!%
z)?|<W%dhC5(LB9c-a-Yn6?X+F?`wKt?JC(Pr>R$f?6Vrvcdq@=(}gS_%7Q+)ViInb
zcdaLbLmSAl*__R(>e=)Uwf7bRO#WL>ReR&(DH*_K)$Cbm?;-rL=f6ig`;Q3qB4_lm
zMULIJKa~ly%awY%tyKZjpb(frid_}_oR92y@KQZ~f2aL2ewA1|A;zxB?sJi<Xl=6I
z*1wk6N0!X-lN%LyS)cZt{a4QajPJVPT19br_=$n!9KR{0Pt@Dqv>MypzPg6B{c5Iu
zYg`f3<r;3iUffQh>|x*vGa37W0LqPV?3Hk(>Qu`TBv|#b4b%OSc)eOM1t(NnZiaA4
zjCcuJef=;x5+LuPun=D_wO&Mgpw=XNtKH_Fa8)UUVQUR#u>~a+i0!S#r45jJyVuq0
ze&hy0?tfRYriND!)qdRp6EvQINjMzhNe34*|0h9Hh-R3yYz|M*M04&m8Y_9XHli0Q
z%AP<Dkg6OQMO6gD&wl@}bVr>v(KTa|I+D@yg-?-`-`;t5F$qwQj}EE(`B&1+^_z`e
zi&aoGCrooCxL(qXdc0el9w|>AuywxztGg2fa*raq>WSx{lfAn|&p)Mb(rd{og29Fe
zLQ(_>R2TnPKmB>bW%L%SDRRx>$y9V;Wl16Ku*lkgva|6H))|1|k?}q<80i{s!jd!=
z4+=R8B&dJAo+#S1;d?_%ehM7PD$i>}(ETYi!%JKu>n!8WoiO`}c`gT<neJ<RnCGOT
zf3FQoAMXhNFD<k+%hwb4-0c@Bn}zXrd>EsO`VkA3+q-M+*n?0$d%G&RWCmV;Oi~uV
z$^uVSw($<{hV8BkJ7(499r<=K?V4Kwd=GcfECqG9v6ukt6IZS8&NKqkcg$W6aA<m$
zo*1oCd<S)0Up*|dHQj<Lc!-v_u*U<*Zvii;E9*2Ecwdi23!M{$|2i8CSMc<>{Z%Tk
zUGEgKd40lte)zx#aRdy17d<W`nDLk3xMF<3FJJz$HM+j2fv2DV4Kz0!O9P_cvDs2X
zBdSLsL#KGewt>e@XTfiz^1jM4nnK9Z2z|0>`@|dlgeO0#SER749S{MJ2_e~Hd!xNJ
zQg)%~e1b+E`gOlZ{Yx#Ym-fKjnkAuTmY?FYZT9}&N3FV~ladHF`njaa_=Q5h^2#_3
zh*FdPgQ9A~C`%mK1hc^IkAwLOx9a;fxOyM*Hc1uK6CRbj5`d__;HjfzzB4)~_ra1R
z&<mF-Qz0^C)laiej0e;Pl!ME`YPrGa%u`meIaqM8Vp`>M7P4s`fWAE9!H4xt@uvBP
zT*mp9+RgE@!ALsYYvw&8WH5lmBjvA#Ml<I#k1&n~pa5<9jcT)V{ypvZJ!=p3_#Jw(
z_<~2xOova%yK1_Ux{RL7{7pN$8D)7Z<<JFo(s%8?@yr{J3{HaP&6Y-&48{%_YgfGB
zGC|t$QoRS7_Z>r&N~FY%mNb-h!TR+~$_G#VL{4KOe0*eg8kT3UJ$2@KZZIvCN_A{c
ziTX+VV<r2%+hWrRZ#7sW0zwsiuWC%Vw!WiE$4J~@RbASq|B&jW(%)-^dweK%YIi{)
z?Vb&XR9JH;n1axKKlEOW{$?lNGD$KMM>uozW^Wp8cfZ^1madV^y{_A>qQybYfIH5<
zYyBj~$fy$pyp5ibIpbtO!NE*R+z#ljT4s$6_O4zkJ!yHEYEhN0PJ8v-iPErbl+!Ga
zB*P=d(5wj{e8ffMTyhQS?}PN^j)Qmo(=^QTuI<?jJA-%j$YY7D&@>5Q21i+V<+IH+
z=L1iA5<$xD{-~ySa?S1#Z#uOmgI~B6>6>P)NrkeLIBGLq5|P7n&(tz2?$V<S4e-?9
z2s=a>8++ryqJq@aQCKTg$Pb6_oA%AeUNUySHxbP8UtrcB#M_zpNKAehTjm55=5TI+
z+Ga-r+&I{^LY0PujyMjdVWbX?&rUJYyVXjlu`m6nV`!))jd7b6{4<GQ&kG@26|tqJ
zp7L0VtSI)j%DQ4ix+=*$GDDV3VLO9Fwa6gc@z|j60q|P$+BmpY3WE%qZ?8B#)T~7|
zaRIApx^a~qgb|7X7=j=lNOKjIK$C>kfT|Oad;#7-T726D(w6;i$>FlP#4>W)v->2d
zg0|W)hd4jUWS$_tzofEcRZXi+lGIAi{&SXK_qifxN_wS<S^GWC>${K=hy14#=sJBt
zJ25r~n{D_Qcw~MA3<rJjnf9UUPO%Bth6FZ8cwd=gWp=J#2U1<DCgek0HhtAhPN?{;
zD)wzUI^1LwczCA<Fn{b=qD_=kGR@HETu+)V??Sz#x|hTE$e9fJU)Jq6o+hsaSR?GG
zuD6u2wDVuo4`4P2vRMSb1L-{f-7KhJdi0m-jKQu5XqC@xigcja-g-ptKO?|h(bug9
zE{J9VvZL^ELXh_Q%HTDJ&B|tTpqXoY&<&EX$Xs`)#o{uzkh0qTS?3M$3lsL`SZ?Q9
z9@|=5z?%Jc@U`dhlYV({NB{G8JHs+J%G!1F?_E=ej40owSf!qrrXI`1DLREx%fGCr
z{-tY+U)Z|>Y6f5aPb|{R`SBCFXYw1}kAV*s?bYQ@j-%GNWY$hf?u*!cdUP4KExpPA
zhbm#5jE-3<TBG}axRRDpf0s$sP^*CkI@($Q`wFuGg{UR^hL0;HXsLKRzWS7^QO%AH
zftx0X0#JK@?P`gkvPHKmvEGy`fKAU|VJpo`I3JIq&<5$X{+dNMhk!ksRw-cD9CrdL
z4y&f1eh?n6Z6NPF8V+guIWI#FKEdeYLhosJ`4`^qV{sw;yP5eM-8A7ek(vcI*{R^U
zp-~uM*>ZEE;pd3?&;x0zINt6EX|On1J&~twV1>MY`3AbFZ;u=x3$Iq*UXLk{a;T_E
zQ{%1Zn6T7u3ZscsGriI|Pyh;P)fCgZTikB-WM=MxN+1W;S!I>d1PRqSdL{uE{URkT
zQJsa7YVh2PIMu8Z=@U^<;m{1^@#9%D%S2(oX>~iVhiCS1D^7J(3KbPFsRvi4C_j(`
z_;fOa4L7cp>=~#$Av%5j+&&Yk?6gJFoCO)OpYj5TNyFshVIaW#f$aVx=rx+|v(J#w
z5_6-mawOykX67i&b?7$ZwLnOkE#A9UQO+Fmr2V|=uCA)7&1W{6qNbo+=>Av(+<rRZ
zI4(pA)XtJyKG$_#esRBe@|4DsyN<pT1iq_Lnw9QPl9_^lV(ZpdqS*l4fN|EDB8DXC
zu>e<!%!i<xtc(I$FKsn1k%Gr^x^rrNqY<qAD3DTF*w>o>4?S+AwR6A#&wpq8mzyoF
zHy^zLzMwLeIFFRsr+*)F|9HI!tZUGcchE9uWwx4qvAajy7#n4<!TUrT%tJ?rreA9I
z@uGO~Bg*{&K^8a1UK$tX7kM((k}BEz$WtxS3{uN7qe%B_wT$dvptLL4qt!w$vQKK#
z0C3Qx9iC=XC*}3L8`QvDw%B91WP2wTGpC~@h6vQR{eP;v)S^xgn-VWj)AY?5=$X<6
z(t_!<XxoNcPu|WFeiJff?BtbC8ftkgZv@j>`M1)Gqq`RT0jx78!}j`W?$QDxwq))-
z5EU9nV`aBJHPQUk^9Ts*R*r;lN;Z%4&d~Sy^*{(Sj{dlF>G?&1rVq?^K0;}8`>!w-
z6Cp+=b)+8@wsxMKgq4LYVHc8_*z)gVWEvZL3ZvVeeGbJIH)1LHwqmJ1jakG7xPr6R
z*<sOR>ijEQ-G`}?2A3ER6ad=nx?vOs;`zg4m_=tc#LAdBGTKK8f>tM6VJkJ~7A&Z!
zQA$A}>sG3!YxQ_`IqvuIyf)Ffy4)%RWkp9znJ55!vyF9f4p~t`DyR#wQkM^dHCmwf
z`|yf2I!Ng2IL|#pU|bWU2I)}WR<0J2TDfbR--j*;gu2^kWBOOTkeb$3d#AhMQW~2|
z5au>zD{5=GWJ_w(8VJ4WRR^?pw9`uQH$a`4BPbtuX|4)n(<ul2Ca!&czv>T|>@5LH
z=Vq|ev{jD0aPqIINASQwhQrvH;6B!Ry4}Fe04vZQw?X)&x31=KY$@QXM0!nN520=?
zom87sbY0!x>mRD6au>{=t^*bk#UX*uDk>>j1~s~BF;^|5Qns(kVzo+^T&hJ&bX~y=
z6b(PnLzYv4KvlA|X_G&uN&;3ZOkG);yjt`8^wj@qKVZ!je?U*FA|`PgR<Fl*^-V>}
zn0cBng@U`m;6O|fyqJL|7#&MPD^ozi(~hLJUOEwG4eC@ZCAHevqn^u#taOdkKsCHe
zwGG(4NUNT+)X>B~b5!yBBbu;W-yTYOyl*V4vHdbjm31>O!|i39xdJY&k7gpyjb{!t
z5s+HMq`K<a`Zb7IYXRw!wNLnTy`-l?H!m-rvdx&mG7<l4Qdol7Qkk25H+gL7<~Ib0
zUBYCBF^H?ZP-RDJetyk+OHMLg7y$onU~?J>eVXe*^4t0XsaJLioR}=T)}?L7|8%Vj
zSR;WoTqp+1ehxjK50sH%TAAPyLp3)4gLN1&2G6C#v1<1^Ilg6YYV}SWZT}-qe;vua
z&7ry*V|&onMYTJ@Y=WsRHQamPfe)_n31QIV{Xl#TbmCenohyKFjk!1?@)yo5iSe4r
zY-7kNgfyu5KCM?u#052yGuAt<*_UIwsO%x`E(R)b0tW{n{D7A_+*e_jnfFw;*L*qE
zkD?+tlmSNuh_c~M5;~iXkPQ-t+u;sy$S+}+nb!PD<TKEFA@8b?AB<hAz2sYs*3}-9
z$MN%dBsHl$nYzw-4)}F6_2`=8XmSqBUWdz9S(Qpn%$+6GzOZ7#y}%l;$1#}QuCfGX
zqiAoBm)YY8FGt<*{txVK$7~Yr|9k`QAEDdj*n1K-<ciW>9~S8VY94@T7=%b(E-kym
z2)~Q<PDQ~SwPf39C$GElrv64!mH%|_a@Fz^v15NZwq)xpJ(_u|F#aGL#B;DilHSaa
zvNAN<q<h;DSRdq7IKuBcvaR&+2Orbs3>ti4>)5@;0clrS1v}f~%e6mYfj8(F{8q~k
z1IDle7{=}AFKY*ebLcSkKX`))$JP;liw)?5Z`t$kFZcrp=Z=mSrK{u6Mh{vZVkiZJ
zjja5!eug%T$DT8g7&yb@6++k1$u#u3AAHr?u1~Hr!Q8nmzv@20tI@B?%HGX6ixZ6*
z!wuv8yYo;07g>I5kmubh<!iq-sCe0R&#6TozR5Kemh3Dn**2!7Y%eCSgY{mDu7{^w
zDri2DVDbg`XneM(_EGOvOWCR^%su|4BcDS4u#1j7A$|70*AZn&y(IOa?K@&K=zW%q
ztr0o2v;EyUCimn<IrXq0yFZ$;Ar;0<B{aSI)CTUxs8rJ0MoAlKBS1nPCR!&?3kBXY
zOdHJ<=Q+ENT`uF>z*lFQA`;Mtz*J+MMV;8dqgnN&;}(T(k=)b(FYRoY7E`4%%(A5G
zQmi%@zL}f>=G0Z*)tYuqd=_~!JiJ^mx5RnCPDyiK3@U@rtSB6cF-_h(PK|Lzn(FxZ
zjP3HQQ5jc*)MrH^BrQ-ZB2iCkt<uwf3CidxQCH-e`@L>z$xHF}?EbV6iVWD$Iqqi)
zK+R#m*#N$v=gb!rlE!>$2!IC(ZH(&GWz4+Ll6rqdRoxQY8VF0e$QEKrOng=y>(C%R
z52D~#b@QEG-rjtF(4!B~!1ubldwsuSRr?GNHmJh>t&MrVoThuC`0WtS-FLdg-gdjn
zxXSr>7KnxBxtAeqW97YJs^)b)2N$)TgV7Hff2nJdYlL3N5&RxV@BI70>;@wvFrW-z
zl7Nd1q3#YOnPG&*6BG-57@3HBh8G!dWF&<xcoPC&uje`t1uVQkazWUNSK=CXf&pXq
zme!BpBS*rDi;hz8!55gZqr8Fb0z$Gjb7Qj&6y#wB;XkGKzW(<F+wI_n4wy7dr1T8o
z&(p-IkI11@QJIv?YP8R>CLFrL9kTk)ikMSJRRR*mo%I(R>-KZOQw5Hg&#$kse8I8i
zgSuX@Xk7ZIY#JOnVEuyw48?xGFEoB&D8qYfnxohku*3CYvbY;80q#y%js4KPhK36b
zAmn@8h6E=X*)<qViAcfiVRvkc;1U{7SXHXQ_53o=#@J$m$ozs88kD2O(CgINy_A)(
zD}ZIXC!h<T!dmH_`mkwnA+o9f>tU7bEAYgL5V;b7GjZh@=KM2eT|E2ksucDWM=FLE
z0uE?o?BDTcO1=&;<7M4K$SfYrGaiQKbM<!PND?~8asgOb-;IIMUobN{fkyN0>HEt2
zSObE{TEaJ6ehv2x7u#>Pe-nC~8hcWCW(wIpu)URiVxgefVY{d;>rF(RT`jIx)Q*j+
zfX@%MQ~7tfC~eyBigW9rO+hP-Ho}_oX1G&!??@_?e_4g+*Pd;s-1ghRT&%T~!>#gt
ztnd`r8wF%Ht%Ws{g>ff~;ZFI?QkpK{UfjcmkoII9H_MD_)UqHRZ1<WW$=FyK8ex&a
zg&1UXg*wPPjX|C>XoEppd0-cwem97}?K369aG;mY#iDg^q%U!yTuyEvwl3wRY_#cs
z$n?Ry$QKw)xXz;|8Y+8)-jWQN0QR2?7qMc=r2Jy{C(M>~Vo%YdPCHUq^*yesMM<%8
z<wz5Zpe+AVe(>Hx76zistL^RV&4zi)6!;OOf=kikg=e+b0C`|_FtG^UHOOB*U7+t_
z=Q^9mKBSTJ7M78pueX4_i?KG9+(_zUH`eji!b7{tgL<k(#q)Qqi@EOuyJcVW<SQ4k
z_#N6^(FK&X`FwHse%KG@^Es>dXn{CC%VnMTmHAyY?w0jZO6SN~h|y4FG~}BNPDf!N
zZ~lFNBPLi~r(U++uUbr1zcvp=AzKt=4E6t*IRqRRvT`p>)KK|8cI9NerPO+VA?L}N
z|3V?P+>`#_XE}fFmRjEepsKO-YXfUNYc5k|n_T#WF*3=9&QGjsr`xwvtHTS@*WL1x
zlPPD&qHHfmSj_a-_|{^eN(=3rX%jHMa?Fg54mFsONuiM*I$Iz{@yv0MPrEXZ=0=E8
z+Uz}LpsZ1)pQ_r_XUEKvZMltW8J8w4CbC)LU0RN3DvT3T??p^~2K_OPF4a>3)fK@0
z%%%oKs-asm6qlh<)w2KZMRT*7K{;4QsRD)r7OA41Ns9#QqYHDHGIjLiEKN7~yf(%X
zWQJydzi{Ym>IN1O6fA(U=W0e8i+KGK(i$Y}i&&Ofsi3=4N_M!V&(tmA&??{%aNjwN
z((N!Sw-~0$V=1Z7*w8Wp8kwMg<9-N|cNl(Go&g-{?QVM3ORaTns_n=B=3o4Sd!3bM
zD|Zd6oz#8@O5cm*iiG9Zyi<Eiw9my}U?p$?(edPK1=Kvuut)X$1Z8f<(@Pv>%{qM5
zewBTmX(f?gfxq?FDJi0ZX%_D%`f!8o+V{cHgnR?#w}#0{f6*-{hdD!RvE(C7n&E;i
zLa3#ZfkD5g8D?|+$=(_gTa!6W>?nL!{?$}P0)Gnd&(&CRewvLr)l47$+RuX};d4Ts
znz474ncz3vKVJJg?A$2u%p6mubjd)ISxOuJA{d0(Nx!L`3Rny?_E_<%1ed5XB%veD
zNeX~~LH;xXhMAY!kX`*rouWfCG)Js4gttDaBWi~QQvlnXS)=#XkxTQ({3i*{nd7xz
z|D+i=)QKy`$+It{*I^hgHFObAzVN^8ZvLdmEV*N%EYZ>x|1cUo@dD*xo@l5Ftk12v
z<caEXa5#;S?2H{J`z08|ZcvPFu$Fa#(#sWR|3j;vWcFP2`hs6coU%;WvB(n&HPK2p
z)ypU41xWbw#{l}pRe%AP9}vbaSmTO&0<eIr@YO!wN#rm?9$fFfkS-S~lX^AD2J-{!
z4sdb+fwZrh7hJ?V9e;?Y{DOYHItCgUbB8F2C*ksQa|_$8u(X@Y^_c4PoitYps<dkU
z<dJ!nK%EU~B+5j=@I+av#nxqzPll%y$wYCczl0DYo^0scbX3Qe(W?Hey45i+GLGjt
zDFyZ`m~AD&XbcfD?Q4Mf1wf)BDK9-XUMa7=%2EOy;5Lx=^fMOtv#=_pFkhX?EYcJ8
zs(l8!xm=k}&{Njj5&@TUP_W!wQeLP?N4SZ(FT>-IDk9QuF=$B(*ZQiMG+<W5AykZ>
z=oNu$5v$1&YM%Ii(H2kelr;qXoIxlm<T&M4@rwEPeao76QIv0=psWJR*zk$1r7PCF
zG-|5wA=}_06|mk{1{jLl)ZvB7Dc^jmPzr_Sln`v3o$t_m6s1fnEpJ-$z(Qvh@MMv&
zi2eF@j9ZRW^HyxM7G0=7Wu#gqs(k*s@XRDGUI(wFMK6-{Sq7nbNrpdRtZFqInQKlO
zaqfhF`b`uq+J95ZoW;d?EHz}>ccYb+AsP)uL|2}9thWONBTvCr42K_QrxEMTQ}hYC
zaD`eZ_13A?6S?lP`43W8P5qH!$|{JyZF(>KaKa+p&s}+m7hG;y%46@p>CY3Jpw!7j
zcj3a0%~CsG)72`}Pj3_YA7sd2Pb45Tp;t`p@4g|w3i;v~+J3=gyvO)T-sb{ftDwIc
z_QqMdJ<B+mR-TP<y+oU$Y>N<KDqoxK=8T0-+`<272q1oZKDDg@yx#im7+K8!j3I;C
zRh6RX60D|uH)^StUYivJw${NmyHwH9qpN!|S_ob$_i9whKMBn)*VFDM{)Y|?$Vi+S
zT<0%Nn1D#;x#I7z<oqWWP<$+A&|*pBOfT1M#KI;Xt$%oJAGLnArmwdkGkzHQc!`Nc
zq`6^H?h7}AI;UH&6BmEO6pvK-7(-*PzH$TcI6+ED-J?i$yqfJL>UBYHjR(JUcvjna
zO`td3YD3g`n`_+g#i2c>dV6@9T5I=;%V%!b!5>c+pgXC>BT?1f0``pBvxJ#X+v@v`
zI@h#n?;UNPKHZ@4v!E~KLbQ9}VModVhrfOC8AiTfe-6m2@RDvv<@}Dq8y{B5nl8Kp
z(%R~}Df<e*D_I4*Q)_4wAl_!~7;u%hJIc1{j7izD-jZTZyXr(MUx%R$i=+p}!5A7f
zv{1ZMnoArU2;3B97IN*dcQ3L@zjN8Qi*O1l9qQmc7~k<A`hzdO%+??1d@PrPaP+a~
zecgHEh4J<e#NB5&b5jyR`?W6szof?tR&u<FJKU!xmF<(JOF20g*iX2sz3lK20fOoF
zoum0?3&;E#tU6-g6@!xuc<La;c#PRs#%6D@@0s=*Wcxv5pECuY3HyhQ@qJe@8Q28Z
zs9E;7Hr)t_JX5Pj*6Cf2*Fxc|k|#eWegQjE;NC38PciTXh-i!65=DAp*{0gqx0&XI
zX%6+HzhG2{besmPUrUmdJ)%?;aZ2Qoo(hAenWi^72WhOMbfD^emodzgG1}?WD+4<(
zFmev0jEAMskaOFCB9+e>jz_+#W?lhL>;6x7Qd&Lg0wz<gQ&P930xXpYr@D|lVYMZ6
z9Z^;Ia>R>pBB4YJwQ*~=8fXg)I|&$EB@BaOECM**Q{(7xKxdmRh#!ZDP`_ZLIyU}x
z#hM4!B|jEqSE|?^@^IkzeqAIC6{&YDkhV5Y?{fV@!KmG;5&p7ZPwyp0N11K3fKhY^
z4DwQP#-@$|B3K_nio;q*xXB4{C9pE?)QMp0z+DqcY%B5L6qfhft7XBF{lpi}UBZp0
zbrO1r+tzg2t*N!9>hefkxvC?WR%)*B9dPZWK=mRzl5J#<3Jw!@;uuUzba)!v$IR;P
zYgJSM9`SZK0W4w$NLhI16et@+Gp(gYkit{O{IRY&AeHcJtrQ%t$NR<xcjzM+Zt1JF
z>)=uBmVs#7ge48RA|jwci;=RW>6+{dfS80S!$k@TXl*SxOX{d8lpLhiGCNwjQ<uPy
z$FF=;y5vNylv%<rv&4}r&;&emY<1p#93;{*Z}=B=jT4CuYQ&p&FH^HD>B51xBQqI`
zf(mqyB!Io{{ukcMt{aD~xeB6B$~9MOMn)Sv(x+gwQBkr;xkH`mL6Y0Wte!Ff6d{15
zE<pe-kTkjEym<=yA^tC0{|V!X=Nsq=$`}tiO($_8WrS3dj2bBd0tBeB!~gcjQ=}2q
z3Xcr2mBCp^cnL@sp7#uK@^Fsr0GVA~b5J2|tQZ3bv`$m*NMXcnQj~eybe8XEJWEH$
zSZtsRrqm?1bP46u-Wc&gW1|Z@6})r6K#j{?m=PoN#x<m?ObK~4V*e?=lH|yp`aUdl
z#9!K)B`PcWL@%O*hB@_#KDH@2{eDO9ac3X?;h{?W!O^-8{U6SdY)3M)cR1h`j|T4a
zEHp5qPO7lulLP!!?@w%o^VwEB2}_3g#HUSGcrDq<x9%nm%tGixo_Kxl{-E`Z*yfvE
zzI+pFD%xj1gJRWO3x|&*&dX6yEcr<dzq>nwNIJq~GyxW(8dL8ztxsSmLU1~|Eb>BU
z&{EjBs7{I_R+<sQJ{s!VsTjChNoRP=?m>`0(Ruqe%WNW>$Yvy)2#-PA-t8dcBI}Ka
zaJf-DCXsGtd#b!=_g51NN^1z=hx0RJ?%W$9&ZfQ|%Z+i5O0^?JaTs7^x|kD(Nb(I~
z&>?@|auG>xI(pHz==!L{mxk{ieh|=Zo@9L7=JGP!av6VAlI366@|UQYJHAr`RygHn
zK{-VZhr1)6<y!6zQ#XECI7zcR_{bfu0Q2k^#<<fafj8h9WwFK+Pn1tQ*ambAvtwrc
zC)_u{qjaLD19)M2)T7&-Kzh~qTNu9y?iOY*%*(`C7vdom;snrDhQ|7CuveEk2VG(Y
z*(dISCwQpdW9d_I<MbY6@M9<G<D~daz;>Sfv@6G{KP;RDX>ZuAD33F887F4fmjRl1
z3{${noldSiO#OwxW}3bUz-I4%%gzCtYr;<hG~Ke|;0KnR<O^oe6i4MMI@OMikwihX
zxfmPEF+sM<Y%j{}5l^$=G3r6$>hZzV(U6(?xD`mBPiF^G<}-5@Cncg`gn;q0(IOi}
ziD5snoEv_5B8TgMh4X#mPFyKS=o9hal=*OAu})Gk$Y8es3V4JQuZX5RQt*&RKjIXf
zB2Iu5X_Me!Wm8@>@bXF4#dE@jhwx(l-*aoRYeo^jUlbm|B=79lnBk&l55Ngd&Ju3E
zN#2zb|8paz0<w15k>Q>@<|{4tVlM?0F?ZM5mtz+j`Q8&w8Bk|VIJNb6fh^S<7u_US
zaSmI)8(lQY*SbvLCKzorX{18-U(-<3Kb9FMoX}GyZ1HA~ByN+C&Vc1Ay^#d9=+cFL
z$j^oDk>zqQ1ZujwZ~-j3V@ocwV|2gf)1ZbCzNbtzp@ggz_1byv|1@FL=43M@>`|jA
zlCPyY3_;O}B$MjqyK=^Wf?}Sq>QJ_fLbaq;<uX!-!;BdW2$+I(+-4qm%5cU)*wptg
znRXm<=imgl525xSXQvMg!d4_~*xh;8%=6?ZR#^@WqR+A5h6V=Pjyn77vIO_>JJ8N1
zhE{JnjL-&iD$kyWPPK1(N7;*zx|2yRhuv~q%F|x)J^CV<8ox)tQZvBZJqPEc8wXY!
z{hlv+b`(<GYK#~^f77)6<_&WHZpPC+Zg7R922E~wG9X^YPON$G;Py|87G0n}P|zJ%
zUxN3(fKvl)fdFfTnQO8<H<|*P_MiP?Zy`p?=3d7jY6hOS#4%}Fv)xcs0Vx?=6Ot>M
zGs-j2;UTJB0VoHC0(i+DuISFo1)U_Uu2E<|XE&fj2X{3+6OZ(h+(B*@$H%q+L|fEc
z7%*qB$G?7`sY(|?)_L}&hn>z#H)bl$H`TdkvzOo!e3iY9+_lM#+P?aKA%;zx-JvCQ
zSmISa38LHa*PFJd!ts2$^v}hk{V)XS<M?vvueJrd^xdOyN<M>K{xw`@gJ1mYBBHPp
zEZUZMC4&OCvH)AdMK_otql2RvbF}y_LHp1*(AxH@^naXA>f}_5gN(Ri4daka;5#CM
zJ0hhwzbtjKD~`CS(m5g3cz^$TL6MWhmm(6-`F%S}CBbiOa;=eMKK^-GIchxZP4i*A
z_3!z}G*WdF_V;MGq1TjSpWR^9RbfO4vjcC76y8~CJo!sT)`jX=EB{117AIpr3Q%L^
zZ8}E171!t{WV3pfm9>4RIT1wjIpln9yLjgHMNDBQEOr!YU5=h^(}Sq}nJ89U{)LN>
z&v%yIi@mNs>mvJk0SWaNWzaB<#6+oq`6ar`In9jH8!6!)I!0Qm&?GJYTXacg$uUpo
zwWIUOl5$#4URsM6RDz6A@=(z$t)aq(J)($)mN6tQA9M4#`s*`nw7B|_W*q55gy-y(
zif#jW;~<~Tn}1I8#3PGaB50vy?jbKHO~vIx<>e+NUdS}>$jYmb=GD^;SK021wgCQK
zIukNfS2N5y+91`S-V!AxQ$^%2fJMnt(8)ZU7jn3#nu%hhUW0_esR58bwy5KH!o_-2
z_ur}}p{Ih7u!l?vT>cDK3%ZP`im(s>sd<*je|eO_rVPlqJcz?<lbh+xD5s8?;Q*`*
zVh2yfj3kg!M@BTnICUCKfe+cIj-0}z#7AM4h&J&PFo_Ek;Vgk`GX_yUSq(-JPH3Z)
z)!O@NQy8}aQK`&au$Xs5QI8pGJc9j#HKRT>NR*m^LP<nv<|=BGPnL?0VMt;D-JO1N
zB9k60rot*F7CEJknUMuW)M^9w>7F=2yf`$afRX_lC}!c8U$Q!SgL^JmX%DVCvvLE+
z(EsA%36G{cVDv+X0B!Pc@uT^o-vZ)}s*ctI$bwgFSd8{}0gS`2iPgY)3{#q~GIs7U
zg^D6V?>Rx8$dhQ0KJxE}h9140w4rT}EDmwUR=5DQsi(N5kg#54FPXw3i<xaQ1EYbl
zlxn)g1a$KiW>#+-vj?`@g82kCZ&4!=PTFtfHR67@^qrIBkb#;X@`Fh`;j*n6Cz~C6
zvjut-8B0@2D>6p(3EV8g4paUZ^ooQ0HYs+6g$XjAS+m&dyJVa-VPS&&$6ytN7>>vm
z0Zj~%%6)kIwwDu_@$YDvaacFW3^}JHIk^SwGp;C8FsDw4Gq#AF)MT1c3;9bNUr7Q(
zZDP@miZX+W;i8%A@aFdhNNGlRZL2#sxQJ-wotJNFIfiD(h-Moa&A$O_hz}0?%DCBV
zPq1U`uw&2g6duEc0ZABfVO*ZZy_|N*0k}>GF-|}|H?^oQB0D%^lnz?;a*6?220I*b
zp9(z`6CO+$%e4vhTP;F;bhe=}V&^!4`I>maJL$9&X$^cEB-d<jjG<pVbzPVN`Tk3E
z4WB&EA31ZiQImM53NM=ToKRW#*oS<QRQzgiFz2yNKL0`wo!BOZ8f+h`jod1#MJLF<
z)EDyqO&_B8Mk;&3Avv&tTGq&m6$1tx3Go)gp0ahlJVf9#N()sE#gNoMXy*5yAy_&)
z>bU-sM8xZ%Q#))TF+bKObD+oISneeQl*VFxy9_48D|Cn>MJ{XR2V3jt7|NHye2ZUC
zUwhkeJ5(dG6TUoj5>O8pnp%+|Zfd+ifY**IH{Nr!xn|aP7iNE!{p2eLKxek9rN91^
zi@dyA-euVDSd>bC?{DK1<EG-DJxiWb$Gj$|3ihpFTAwqmvyVVD5Q<H@7Ng1*O_M=I
z7(i{nzd55KKZ&!v*a@&IJMda}m4((;L@+e627A33V9Kb!i2HNvsR1}W1*E%tVeKA6
z+CVDj?3}tH5$Uq5fh61@I}#9J6E!LTh)Pg^N0Ith608_88KkUweu!XKVBIY=j6Y0^
z()hVfM!|s)3Ap0~##C%Scr3wk9Ys6w$T*%0Fit`Qcg!`y49|(JUe>ceb#;V2ai?jU
zKH^APiKBSOnZtd&mWGLA&A-3s4A*LhDDjD1H55+r7T-SU^Ih3DdZaP&>i5=Zn2?B|
zh3F$PGcick7=a<0S{=G`DB45Tmv-%l4!+1P>EOSP;&)O{35WLyQOAbES2V-Jx9aLt
zeV_y)N2-`wDE}B0L2l|+vN#6aYJlN5#r@la-vYmFEO%ed?arXRLQFX22QUrQzD(C%
zpaP+*-CP+iduX)|MKL_`J3~$Qoefwt&bQztta!q`DtMZ=6Z)QbY}0n?nQAq%y42^i
zvi>+vrY%@h+5O`r<pjjcFYG|@bL5at#$*xK6e*LOz-13f&Gcq{*h;ox0<}jUaMXx`
zKx(ev$Qw~aQbSW>IHp4d`WLLO0{F&W>6P8}20BDRS17N{v6_T=_@3_1kzb=jPF1;O
zNB9tD57u>xwO*EDG*ym8re$JG3=x5fl{a;63=?@qZEL(p9jG4Mo*Ff46&&DX2G30&
z(V;U#rLDdZrlIC$7#Y<Z8|K{JJUu5a+G?%(ATO-Iaws{ysH7`=cCI-tuBE%-EP&7s
z^pwF+scv>5<evUqy#cNFDVj5tIlSec3bvoXIp<A9!2#_e8a0~pcw{}@Cs*(lZbjD0
zckII)jNHncj_KYzUet%NlJ<&*ZmAX(^Q=1TEx}9=v`3)qNxb0m60lP#T}{@(*!yvX
zeV>MBa|f@5&vWd<Ul9WT3+)LPk^fhC2WWj6xY}gjbL$$9v;jx?E}5=3(MAE2!!SNr
zVu-OY(eC(m+>gFOw!H!Bxr|r$qV;;LSGJy%ph;%9iC|Ey&?13gG+7u=Ik;ZGFAwWg
zEF^#-zHGSPCwdn^1Wz}7AKiy?b-x1YdZ?TWQ9nJwtp}~&z>g2Li=x40W~#@`0cv(M
z|1o<SsQgQ?w2PMz`dhW$hkLO6Abcteb#aTX*O|SCC`<$GjG{T)$nY2)43uTzTC|mg
zKOYo9X_pV~fLAmSe%`!+quh!B>7d$xLn^xsBiT&700#ronEhQ}%#8M(b8|eu>Z%9N
z!uJBV57li1Nd$iz6NFTS+Xha$uSf_n3tGhu0O=dVcL)KFYgkJt3=SXab=TtGhXBVh
zd{N=`pqP%IBCI=f+=rn3uI7$0*ch3I4K|$FS7{KSEaXH%o>{~ZgN@x>4VF>w3<N#F
zHmyc6gz_%T`TNsJ>7Jd@J}Yb4(S{c~GDHSxYqNnE@{fb<RY-n~b>|88Oc6<%CO1;|
zbWgz{4@fbs#$82%ElQ)pEouizg)QS{6qO^!98qMNCI9{r=p`}$I-n(WPP?EDwN@&`
z2oEJfoj`}N;giCPcQ;qx%xJXeDGhB)mfe=C%0FQBxRxz^yGQsVIUGi{1$nOJ>Y88r
z;1Pw2+6YXolvYQoV=W6O$Lmgi|8|>O0R4v){PryQy?z_(I~^UJkOBIS<8pkoOBTuZ
zsShTAsk}E(F0pMy3$kqlN3dJ}x7?V-S_?94ZkrWsA|u8$dB6tFAwzm1V(wh5(i#N#
zE-K0Aq8X0On-Vq+OQc_ttzL+!J9+4g-B8ZLkET?TCT4gjN*mi6)e++n@`E*`{<DxN
z*uEy<A*1(O@LvhI{UJad4JLUww0-=$lKIW=TjTlQTihVLTi4kld(Q4NxU1aL_LpA5
z1KRz4#~iyxpwaTXTtZ>*0TxQ|v=s2z(;cRG`}4nnb{r_5iH62gL|AY>;YQ+1m1oFX
zjKtrC1ztRab7~g5IH`>G(n%;&XrK;?g3j!}ny=VvNf8Ha9r>4opM9?_Ag{oS&p2TU
zHX!NYG&{`<2IiqcX(96a;sN*JG3fJF^TRfeyoxp0Ics9ir}=CVygt@vFbJfIhdBz+
zv|I4leqJM~WLkrP(kCNkEQ%^e76)1AH;AX?@6+|IMRqO&fADMjaNq{V0o)3CxHwVw
zK-i~%Z`_9d@a+1p|2h0Q<}vUOj~J*Mm}D!+KkXuMaDm;zD_$=Oi{zbyWP~O9jsHZ$
zT=oSh*h{I-^A`P9N#2|DgkO{rwqvsMlYF0Q5#WQw+oi0Lk6m;#z;6WJd(Mnw9oIBt
zEHgetK(_W0(HVP|eCAjZy5RvN-E>dgDPWW|kDv-m)Cpvcb>kpgC%=Szi8Uazno4=y
zZ$UraXi{0UN`l(!0cLsADD2EyY4=hIUUxru0GdQzvIB>ZQ9)Tx|Lbc_x7U?T+m`$B
zIGBDT_}Mh!>5RYQyG=XpbejhC@we$52M7tD%&y}Yr!!uAV$k_MuQ)t@3tY-lYzu&}
zPVQ#@o)u?9WjM_~jN={#7rf1KgT<h(68jAw!ZS6EbI|^2LGQcZ5XFU;=?;q2H`C2I
zB+661*{6kDPstTJAlZ_uJPVD2L^+SwPtd!U8UhMGm<IpmoT*fKDVk<$n5772$c0y?
zLYmPy&)8$S8Pge`KB}o)k~$IfgtL_F=ItRjNnZPwSM?MG?PJjQa-maRb?I=ILm{$r
z^Vc1u*<Bi)O7SM{U18#`ktImU^)G^uCqyC70AaR2oMh-7A`VkKAYMU&H};OVe_=u}
z@ycLg6(c8noC-LABlWZ?HUgsq&K|j42=5;0`l1UsvRO!mR~K^TNV^ZQMtnz2-@D~X
z?Fu)J05wb4Z#<~~h$zm8q|WRrK4@=bk=VO#+zj~t?V?E6G0^*eI7uhMZESO`lVm)P
zx>mOideQi?$u;!9B^(P}nYo<9GWDBs>_qz3o)wxB5UsMhW*MGh0klUR9R(`Gbl2io
z=HO_zv_l7K|LdaIg~xXi+OXKf=#N4wTMk%FodZAa0B5_#4_k1G;A3K-;oN#;H==p^
z&?xf{@c(Fhe;iPqN<+5XTxB@1v;$<3{w<v*P&dN)v(W<J_X&395h#&iE*iKya{rHp
zN-={J60%9Bs1uTM5JIiM2usiL@m}oge*xA&DZf;ghP;Eks~mQNe;=PtetsJK{GLP%
zJu6ERUX3{l14MtT+o=1&TYGvM{QUHE^7E(uRas7ov(wXrkvu&at70c%Ha=x3o))K+
zMIt&oi=sGW*mUgEf&epJ{d62<IW8s{&S(_i5*~p`kWI@$qszZc<D|rKimu~)TELJh
zhW0pZb-n%_{W=a9rHp>#_aSK+W0m-_?%3+rLcIsMulcvy*5ZVXNdo395^$s{kGUAX
zrwwjQ@)4)U=;_+z>)IEZ5XvnMs_f2NVaTG8gr0{Z(>1Z>S{@EGMlf?7O^Y0pQM&i7
z(7f$dxV^cdX=tdI)(g2(_}=oCuNGuFHe~0RGJX+0IXA{Nmh5S@Q~}?FHFGBI45IWT
z&q7udu%;`=&MQI@QJH7!ZB(rFsuZ_w6d_4dMuq(%&FaFC&0)fFJYjj9QS>1P?6zPz
zBx{Hmqtf;V`*blO`IjV4S!K)^<pf9q|Jz@4l1>wn$K~vwPt?tT6cF_c=gJ$k;Y;}Z
zRT^bgIgU#MKs`+%LOZ`q`@Cus%YM#NP1G26g)%=UaQRY#5Adu4U8tc#{r4AdPv5@y
z<&+QT;IcPFZ*#!<^}(?DAc3#PMVggtJSk`W58TWMFn%%Et|Ouge3;vZDWmn{jpdKu
z&$HjlPmR&<S$&Y#4>t$Z(3irlx@72g8{X|kb(@jfV!*Z<l*U-V%!g?x2j%}nWAcSz
zxfH~@sK=hNh)ffBf(GUgU==J%GM=EKWD~J2f*JIIw=bsnIs*%TIJc}kC(;|X$np{z
zfv-m9?H7D54B<_<1@j!L4Mi{4?pPi2L*AY~acAPhC2pqh_10E_5?vikdu3cE;@!H~
zpcfpz#At8S51Y<iYjLpkcvTN3$j+VRGi1B28r@27;eghenX3s~1t3=4(j{YC<Yx=C
zbvu-GCv<gpRCSYI)-7gZ!9Wrx`E2JYxp8}1n39Hmf2QPZhISr=*ic+-;yp4gvo*c?
z=Pt_D7OqT7RG2p}-by)l!^SNY1<x{>?GYb4reR@=_!=gTZQvjZG~4o->(j9JKvlzi
zLqWzK6`<d<k_B1z<*$IWZB&Ce9;c3bM&perYA-I?cw=<Ok94Da%HIL;&HMbacLNLJ
zOxLuZo}hp)RLqg7Nx{z4FY3-&nx*VXK*BFDE-8hQS$_5xO*2i$d2-p~4wg?#;b{4^
zq}5YE;=&|}N9h?H{p|)(l%*wxrGI8<ldtmc8wR-AS&$|4iFnS<Ra~+svco@J_I_Rt
z?6q;dCD0kipq`$VRCM!H_4kyI%+D>XuaIqyvotQVyjavpxw<Pf*`myHaEqIV`anls
z0r#Dt&FVFDJWyC!L$Q9Fg35{js}cwrxLlz!8?o|=<&Z%RbYt1K=_JVrg`Aw(MraZJ
zo!bmbk^*SL8^EBS(CY0g=hG|ht11z)=1X2P-koAXLP*$|(%PYQlEI{nxzA!a1=Skm
zaq)!@B=<0+NKWh%aN31`$H(s&xWB^qzyQM_o*f^fmst+(hz!y=!eq#9QZRO8IV$3k
z6+;xK*Q_Yx5%}UxvZ9D#?!&&9XXCgKo{eFaMsYqyogvhEs33Zjr7&&i$*l#ug)>J@
zKJb@ic}L@o>6#I<n2n>*2M_Qt!oC?09D0GSX)FqveV;?&SFCw1fVEw``T7-V7b<fS
zei49=bZPBRSl)(r29V@q-SU>}nk32G+J=b^tE)Ic?<esWfq>QdMq#>M!z>>Y@aCrA
zp3P86@)6@+v@qko@JY+Y3?R)>)s2vhCnO$${UC~<xpXwQ$QnDzJ2rxMQF|4X70a_)
zdDC>thof4)Jh>^5ZN`8)RBL5F&f`mPV2(9x=l*SKx@Fs*jXmG@uw|J92M!Cd<``5r
zozOA#$Cx3P&u;#=oa1r96!WE+u1N;-jB=mW^_y4=nQF}Z>>7@dc+4uOj^}HJWV)mz
zh>|#&bwf<a2t2qUA|j6g1!4VF;OV@t?>saZ%o>o?ISS&mU;RDgofrt@D+es6Q8vmm
z$f{a|Bq4bpI@Em3xY^ENz|*g;EK9z&%2vSG8W@a>z%94|r?o+^#w&b0;<(<?r}N6k
zRzhOhpbekZ??#HS!|Zvi$w^2KR1hTZlE7sf%x#&9%i}9HLK$6x%gN+w%Z|vcO54NZ
z`EYGJ4jfN@O#+rQYVI}4T|7dmw|t#+cE;p7ghD)c4D|Q(Ac9E(<hy(mR!i!(kk_}2
z-m1>*M&9&JAlDWa+^y}nTUv8F4wH~GsOg7{_yKlp;$bT^d>lkHzy{N3;Mq3wJ#vrb
zW_7&3B;z=lA-=m8ae?qEwNnVu7s}5CIC2>ILbIE6lboz9vcar_a@$|fx+p8NlyBYx
zC30_6SU-Rzm*W}<Pglvge^ehM@yd+=x4PHEnnQ?pekcWPMuq$&e0Nd`hPf0{0N#)S
zC8Q`(!B{%v0yYRm&D4}}O43rrbE??6I7h`KXJFSB@3aaK__0Bo)v}j^2C(OL^18)L
zQ}bLCN3LmLi<&MbZlGZrGOBrjru)HaXSqiquUC>}A+*^gYiSQlhx?-u?g1gcC0`(C
zyDfo!4X-G4Wl*mRPzls3YpxHj9ITi0g~7XuWvn#%H>|wMz;Fy7iYEcN?A5O~$9Dgg
z_v;+R5s%1IR(W_bzxDS?IvAqnpF>oXc}U9sW$%4lvNHr;1XVAJNfMX+msvttenHBs
zA-e3HUiJnbtxp3Lkyq;jO^IF7MK!3H)ICWS_5QbKhVAeo&(tu#R>NEu<Nf5NUc+F%
zXDmJXbl%oHxDLQ~8IXvIwsKH)YH5g|sD_~4(Wmo9BMtpy*;}mY_FP8~%E+zRrS_tT
zbdgNAa~xQ1{(MJn;xx+s02CUQb~mBCyEj4i7?|xm3zokPUxA-@c?V;gI$N{dG|jdf
z45Zrz4(%9EvUMcaE^%DSW#D~0N;$VhT2@{IUCFc7I35_^H{Rr*KNuY7v?XMdhqEDs
z3>Y$g*p_fueh+T>?E;Q{efBjjc3m005acuV7R<WbZviHjy_b#T?owE8hweQTMn&D+
z3}~sJ1BbwYZf@^j&sM26%_s=;(8mFDTx^+vk9}eq*o^|iv599zQTQMs(}okyvp;qR
zO1q((K=3xY;z~W>EXzEBY8RmXvlN);#4}ksic>bYOYrC<XV)ZQTjQfFy^ixN<uKPB
zgGk?Byv5J{*w(AT)QM+0I(C?+W6RNP9GE7-zRQBZWTtK#s~s#izv81oNq1Wj4-p()
ze9Z$$dH_iuHb{CmG_id+TpTp9gC=%2DYLrPJrIBIU#8rOv?mB@7*ZcIMgwfQ4#7lY
zF7|BAiagiVjPD^)esg84!QT?hDih=ya&KYTSfPsX_#WY^QcPF~=7pvd$%6<$q^q1}
zE1_?Jru*h9h8*;~#ud3{{NY#e=!zAkayri<`EZECkopf8^($ZSoQ)Zcg~|g0WECKB
zMRLm0I34X@`LTDIr@;)Xq3Epn+*i-A&~_Y;It;s^#;_GK6Z^L2<B<3!rNm?rp$~3l
zJ)2CDc-i85U+ZN{7SslsBQlxrpqwz7^3bA<j$KO^8L9hLAodjqK3E#=w&JQ4HfE%l
z=B&6o3#{>)4}OhlE_1Aq_*k=ufh{XAFwrav7{}ZobWIlN!Q;k51ac?viDj`GkpvYt
zhkHoaq}spxaA?6PH(_}J5yuc8bTv@u1Hc!6Z{(~1fU^T^A-%Fb9)W8WI;~D=&K$nR
z$?E9zh`U%VI#|_vlVl&Sf<cx%WZn^~RT;dY4(>@0I{97wy$|NYH9rUQ;X!HLyDrd8
zW4*6ZiWxGK5y!^Fq7k-iEyA9whuHINhuXfUd*qQ@Z5Cot*NH0KBUG2hpGrAqjjmCN
z&wUl5EiyTG4L)ti8UHRDXbTs@FKkPp!hCE2n3I@^_{+PeS54xFyIX0RNutnWShF+}
zTZH)7*E|aoGc=fG+J^4j=ZH2)fW|GuJXWGWzhw!>6y%O0(2CbWYr0}8Hy`N!SFEw$
z2#QAz+zo}nmI!_4iWI;n3WN>UF$LNLZs8rs3~NiMP8(YnWPlQ}^`JvF()>xxMCDt%
zlADagCmZC^>rBrT;e-GQ$#{~0qQ+x7V9Hm($s|rE9La<S5s?N=RBG>)wJm#`6=nUP
zVAklB{7@?q%e&&20m(BZ5zKZ@8KDt*)C_E_5sP6fa6{}<!^9qQB8}*Q5t`OxJl?ZO
zi(O~?HN@HNTdSv0SFIV@h*($am(Bdb*t{M(gBCwJl&tEY3c0G`j^Sn6{6ve<SqPn@
zxiGW&DoTvurTGuga(rQ*3s&~k%^@-uYrYqwDq_Xt!&J@Banx@Gku6Z;^6P^kvKJd}
z#Emt&)C_d1Yj8Y=5B$-mbN+vo9M9m%@s^C=Ucnw7EG1Gxtv!5t_g7f^mIzQY5A*OY
zK}K`4<{scioVWAfbIyn5kR0q=qN%Mz=CCpzBb<7F)8=h1v@#)8$2R_XD+Og64<FN^
zK5;w~`;kwvMO+Pg7C8KbrmfqS5qZW2X2-{tmTOPxYwl)NE?e_F2OPdUH;AxBJPQZZ
z(=c@-%d#vzFr&MimFpraO8kN)@ipMa|CNj<Ptf0{BnQv^l%ZELuhv`=t||dn2;_v2
z?VgnAicBU9*etWk$K&{zL_oYp<pYk7&(MFcJi}MnG)K>-Wri-M`G}$Ze>}SwwEV7G
zNX%GdFbCF82u=b1P6WxygX}9uWKxR$tUEm>DH$;cQbAaBE#?%tbck}6Frd&Cbpmi@
z$;Kz>L&es6#byX52TyOq1l#8|OMou7D6x7Eu)<HWv|zRCzj|fK<w?RT?&|`4o<a6?
zH7)JEUfH^So23myT8-#KN>AmRrmH)KhN<s(*z!FWGWAjHgnr;Nn`oxB3c)(ivsXU{
zdiK50v%?OLsvZ8KPVbjR5d)U*V21wV*~JcQ>?^V_ZlugQD&}_6M$W;IObFlTASqIL
zm1on@l{hkfTXtleK-Xb=Cn(J0G7g(`<`E<1l>1H*uu8(=FwLe#GOKyyWfvGl49*jQ
zTmq}hnDE9D*y_jGHEWzfyg4wYCP1XCydvWYAr)s95BDsXG{p*vc0qv6yIdVDDJzO$
zeVzawB~P^GX{e~8H&U_x7LTsxMi(9@{V>OjG>$5G2YyoV*ibm8Sb+i-WjR9u<0RK2
z<`tuyUB~PO;zsLs1&##8ptm(aB@9a%&i2N{K6gy)M8_T&24i-lV`9({Tn2pX8^pvq
z4MIXq;xKlf>Db{Dw<Wn}D!b|;!TOvd@l|$HG%R2%7}@3W;B%i_1=Q?hbZ)xAcCu!@
z3X7On2q0r+QOTn->nT}z3d=>1UBmBOj;v-YH)T{3;16{co|~TkAQLQ>V|TmPeKl>9
zNGHTKBTRkUz?NsYI0%7=z;}u6Yr5mz>tGjHRcajtvu2uu*@SIgS${}OpLJMX^V&rt
z{zP_Q!g4^Y<$1kwfelfRXJ1%~IP*a;YZ3?ZUcaA^F}&FjU0lV*mH1V;2Q4m9;p#7q
zc;F{A%6Ps)D9w%35#%jkX(>)hwI#IGzPq$OgBh-d1oI(z=&RIYf$4>TjxA<TY?(H}
zo*ppF97hlR!1JT%QQFg&yUTI6HVFPB<FRrHX&!zeCoW8?YI@5xDsmhAqk=a;j6@Sy
zn!9Fa_!XWD=ej!9f4$}evrSq8u|e@23C#SLJ&@%kFYBYu-|!y*M^VJbP#N$KnH;`%
zCWm{G!k{%(?m#MoZ*2?tCc^Fm&r3iZEut<QqPm5x!1OSohJj5#(wWK3$hN<O7w2O>
zM29W+^I(Q1AioX^kY_Vc2IoB7WrLlL-f^75*&*WM#Bs$p19{%AIpXRj$k)zIv`@b6
z1%U0(|BshFCHP<VBtv=}_2()dsWL~vd4AceG=z0^szS0-Lzh@rtx@dgw(<xRm!D7;
z2FZh86<<YN-Ls4_Kd4f?XkQ;{O9!(q+q|I)FAQQ`ynSnUNJq7s5Ccg&e{eX&M$PnL
zAE~ykM;5Wbk-~Pc<q?XBV_7(G4c9P8<Qeq7W3ulWKn_Qcz=>-Kn?o~6CRm>fxw%6d
z()v)@!sR(iryP23I{pg?c<w+2;>r{i;8d+n;0)22+kVor4mmh$n*IB6kpYZPx#fn?
zahysMz+ecrBp!1B5<`Ld+|on&wZRbm>ool$1Zfm;Z|fl(&XBAap8E=n45$x{^2`Vz
z0>nIlW|-x<j7%HMXTB}DA!RPvEf82vA%iE3(IiXa5aPhnC>~8kG=;F`u$0qDEQz0p
zdBWTY%aa+ZUl)!O9;33y%$v*Bc{LFpJp4pMH}C@|#HJGk*dh!<pO}ZENY^QGJU#Tk
z!!o}|lJnLw^KeaKP!*mT#lR?01qc(cnC7gQCj2=fF6ohp%MI4fr80B9A67!FYFDvb
z2vN2!$VK3z)&{Ba5v{B(N*~F+b3<V$0!8^ox}hvDb6;ia*5FIwx4tIC<Rt^G#N_!~
zyn-BGSqA>%m(^Ix>-^7ySpB2L>TZYU!<LZ4AaG5WMOY7Ah=ep5CXwM_V%uiK9Nlum
z4ffT?=4!lGhs3+-aLg>zVIgDK^E?Mzy6a<NyB_wLMJ$84cHpyvbKxd~!NIw3FV2Mx
zo$*cWbq$JF({p@Rze3mwa(2bi0#wAdmtn)-8<aSq@-;~frK@+PHx3)n@K`Xn3qQL#
z=LT_>ouF5x)HEx9!jeZuPb=M2_?Cl$!P!)rK1{-WuI{67W|D4)&AzK%g7kgOACfiF
zG-RNX#3Y&1mN^+})h(&~wmb?q`U$>Dui+RSfd&m^ja5f-0@SHkc)|ng0*uSD=jU<p
zWhNZ4WZmM4@)K;lAnzUb7~$Sr@|&=H92cNN6?=0NY&>&EC&AG29K&~A>^QE5EmwE2
zr)xeoY=fANPF>6O?lB<MSgY^kclZF}(`qP+HW_>&OG8T?6v9_SO;y1aLUCw(k6<P+
zq_`+^0)DqA=#5wkLSc=;ySB{ZP_DRo0VvETPFDnYz^tm530S5Tb|#kvq5nB8N|Bg%
zOlBxxC}j*5Lz$tR(P_xgG)-9u?!Eb}@tA!=K&{Cs#|ew^+m0N=vkiyXOv9l=ENofK
z#DS&}Y%|@oP1lNSZ`JAlIMI|<cF0we^^pJ|c|01iT$&7@!QvD*E_-}Qi9hDy4K-*-
z-`2h8N15}E7I(;l<Ip}yEgqcX(2@!B_}quKp@&*_4nA-Y$8-#v>XD8k(<0akg9sDX
zi!cieX4{$*5NbUvsq%v5knWd^SX;DwPLgm6cD72Ol*Qm!Zt6-4!6wBt1o<qQihwM6
zatowLNOI7ipt@`}q++%p7;9e0luYxGrArBuoYkr^MR_n-QLsXExTRsW`&_9x`*(G>
zZnwJdBrG4ijggtew>2ZgzGiCJats{@hUH<~4r%20k*5>(u+~_W26G`WrM>1}X1T~S
z*@y#S;Z>R?*=RNtx|i@cfEiu@9~{i=xGdJMND=$EQse8Ze*T2c>r$u9HU}r@*&_77
z+2+7FDf-Jf?ntRLH((pUoR1C^$Apby$hKF4h#Uh&1OXDbj0Y~JG^V^gVAL0?Ab=KA
zpro7f6fQg;=ev3{0TH$y3K=mOu&Wr{2w(`IfBRqG&Mnt>({1R%FLd8^qR`hO97L9b
zEfW%UYBs|bvo$?1-N17W)Xz=zw|&TN0&22p<qjYY(}v!>xE&}xwBDXRD=BzEt?i<e
zqVscf*_5eeKb2{Isead1nniO9_VBreFMC`i{GF9RS@}i?39sl1-sxK5u3Mm=-;g+o
zlI&)+0^hYSYactw<FtfdRt<8_NYY<&b1-bzn(Oggwfe58CtLYki*o23k)Y`3*)*m7
zet*q_PuI0RIMy|7Ff;~(JCXiF@<^h4%oJIaq>DaX#@lW9YIr0=Ygg{FdEUCkiPTL&
zZgD#5#x`}frgUr)I)XW@n<Cz=OS{p`RU~s=!Gs+c=6207xi7}IE(5q|Ht$p^%gg6^
z%wf@&F-z#~6H#qJJ%~f;?IFV~tkx};A$M-L?R)S>o{dI18&x~U?=aW9ROV3CcD=5(
zq8`{qi>oZ59kH?AIHQ94Ez24BU~C45WW_5+$}yQ-)XRC4GnT$%T^p#o`q!KboSm@4
z&gdaus9>uWz~9p?m}9G+{h?f4>@8~NY?8AAri=Rad|<k+_~Ex4g`a=mDCCTGMqWGa
ze4qBT^TlD7ZolLf=I_3`(>%wv?$%bP+4g7IZYSBkj;NB1KCrLla&rLMWt)DPrR96|
zN@F%6y)F82!F@Eu^bWGJ%*LCKt-A+Ub`fgtEr{V*Ot;;TVIy(~whS}Ee#mSLzA9ee
zM3zqNM`**p;EXYgDCOB+p-IlgaeBHLpA-pJpw(ra;$WjdFK>xj_E&m&4NfGq3ruy~
zHW9HKPEtxzq-)DY0mg`Z1s6C-sw>PQyn_Jq!ns!{T05YEi_=jwP56j3po=Cj(-pmt
zX*=G$c>B2?t#dRXdBHvdl-;jD>NmpoZqTauGR^@Xs%yqEB>oV&D_X4%Aa%#{gpstB
z;3FWT&tKTAm@E8I`!rbcr1#T6y8F%Kv*tSRU(V~N2s2QgliBBlrK9qy{fv+8s-Fhv
zXQWlxNZL1{?{k?+*0#mF50!q;8Yq81gpLg^dxPeuT6nQWe2YrP)B_BBT|pj;ytx>J
zH?KwI;1;a!HP|2A-Uj~@<*S@C%fLHPM1E+6?7vJ1xXE1hW~@*xb%OsI_*I?JWxmp2
zSep=3p*UJ7Hk|8D)gSIFGe6YL&)V$8&*!l0VLDdN{26Jj=`C-(gEfDS1X@=WK1RBx
zooMK^+3FA(gSJmhBUdlCC>?z|pYLJYTc&2&Id3)m@kl-T=+n9SwQ(8!R9}Z4i*9gr
zU!;*~lsjbid-y4X7iZK?i7vEnp8`gRyw7>}x!@~@lnaXHW=T=~9MV<X#dH<JZ#c)*
zHh2$GxF~dFxR+(&A6CWvPU7+%Rt5TLr)6P%?`5&Yk{ENmq3e+(K6>vA8QKG0b>BU6
z(hpfLn+ts!Zkw*}J41PU^-X%nNuGV;P(u$~?An$ABquiZA~V8)?pdxC*ak7Qd+dOy
zIL8FBPeVgjZiw?SWX;S6LC(k*!AITl&6RCR<Vx_A#5pP^ER3T#TnyJd*_>JevGF9y
zW(68glQM=(sf)aT9K?(NobtpKDq581$)&8!1hK$ST*%pEDy&6_$Tt-+qsnhXCP66X
zDT@Sc_QD%1rOhryEDod6F&Xx}F#r%SQdsrB6-QYG$gwel=|8GovjkBg6!D+n-w1pR
zh{sY$-^LYTd<7yfw2)ybSu$o-!0gQxj0<-V1BJ7W)g>v%IiWgWG<h6MRUW6h83@mV
zn9pw%Sf~2ET}YknN1mlSIwqQ~Vao~)OjxJ`4;iDr7lt&79w8jxiJ)k15m%{E8VkK<
zCt|eCNi;vb?tkdrG61~|d&`Ks8jywM+!bXXUt{)lB5IU;z}G|UCu-k@0EyXzWl>+C
z&Mn}$ktJF-JLnMKCyNe$M4+F<IstLjQ4@iVQ%D;wsm3d)SPfRYBFBI!S{e!{Yitu%
zI9F+Pqr=8%uID3H{U$}&9A;94cfxn_aq)WY9OYJ>%nv%sjo23PD2cEZFaukm#xU`y
zi>)ZqnC7{DM2*8C+BifP{Oh+pO4l5sr>FhDJwt|OI9PMBZVehI2MB2kr&4uL^v8h6
zC>p^c4iav%u7t<|7?pW2Op$=dEi$ixIT96dIs$o{w}@aV0AowZ2&af3D1dx2oRjTe
z-@pA`7*yApp84e$v1A1mM<Q^uO;cJOn@i4CMJ#=^<H@Q<V$Ub5EWdEFHcnI}6SU3%
ze*ZH!eyuUmRc;AKpU!17!)A$!h4Ay?<ap2)wEBxbI{SjDg;#eD>HPjl;tx>gkCN{?
z<&eLx@?Bt4jcSI0!^qOH<uV%+ra3r_4Bd4C%XRJh%#FqUo<P*uC&D>VjecW@vwF@3
zj58ijSYAkkvypUni2nZWbqo9~CRr1=``(ym^+Fp!&#K&BP|qd9ct2oI-tjF#PZAPa
z(=`i+0i-A=UW7e^G0cd^7&GjM>4&6%D?m>%-UrBYJIGVHmVQ&fQ{>V)z?}!UbLIYb
zfIGjbI4m~DhYfbxu5Rn5qhZZ<U2NGQ!(J3RSl5W@`kLq1;emv6E!er;5xQ5XQydWw
z0O;f|vMbCfMq#g~DKEVa;1m+TE#Xbx$N}8ku<aedO)(A!aC7w>Ie?pw#*g!s(%eJ#
z+@z7~g^m?q*NGf#`JRS7jYgPi)G`g`dK$6sF|f%K(e4ClN{9=jE)pk<uFStd5zoOa
zg}Ew?hLGEqAe_8QOJb_y3an%cSmO|lSPC#(eIb}8U&KS@wKyFO8y=fD;4zQItPpuB
zUtJ6l&Bi1ac;`TXn&bE@PtGCPG^=i%h%w?B_4w;GxnA3uD5E%KxSXa;6s$T^qnF^+
zL=t$RI%@}y=jPcnCV57uD*cDZlEJeQ%teDQ12?M#4J+|Yz>b9&+a7iCH5P%*ngDYd
ztof}FOy0Te08FNvy02>y)(q3cmTM7A{J_J0<Z8t74a*4+UYjcb%;tLi4lbLp5dX#<
zNzc)Cn4yR>@2KLean7uIup_L<x2!vgDpo$M!s~IR`z!DN%Cc=g*Mr05!Qt}WI$ZMI
z?V$sZjuC{Ri-Uj?Y!Q=UUk@WpneIgarH1Q1Mh2lR0LZP5z`f#+{499@@FTp(uIM8l
zgMFU4P<S2m$OVa8B9G9<0eIZBj1OLwd>jtI<LWtb03Hv(V<#c*A>)pQ@7s}W2UvF_
zA6vE;V9zl%%rw*0sBYPYK@PdS_m|tdHM=%t_7<PWGBv}uNQ6Vji?C%GF7^W3#?*#{
zu+;OZWqkMa;LC5U8i1A0+zdQ-liq8v8NFA~=G!VCGkVTa9xnO*?ejsE5*jJU8Drc^
z09}%x;aQ1zDq#RHE6}vg^n8MzXX5~}v;t<#T|-gMib<9hTsF?*P;zF*Ri<N*=qeDq
z%n*aA1w?sElY0eOd4+)X9e|`7N9Le0Ng+LM4DSZ=^!hx;YbIxyrIfSvlH`xLh=VwZ
z%h`qjpQuPnm4xsE3D#|5J&`6YmftBZe*JSwk`GzOMQ7e-(G^(;siaB3<?KA>Ar5<5
zGTpcF&KvkYH|+=!b!@{jLu~6-h%HYyu@AZYqQKWY!*Hl(tx7+%`wBH~yF?qR_3v59
zf-L*;SJ(hIDcC)}O{&;jM&pek4!s!G$fg*lA88YND$N`)(atY>GL^li{qzI{eE-E^
zmLz0Suru|Gx^o7(L7oI8{34PPK*=mW`-`TTrsF)h?1{|wD#LwAtEWJaG$u(rO3xsK
zyxky*vb4kyu6<@`ldtmc8wT6dS&$|4iFnS<Ra~+svco@J_I|GR+gEA>e5W?RH(~?i
z{WvYD=+LR^*(o1`hT*T;ut@^@AQ-LEa8~V=C&$O=1E30xy;h`01AAMMCBo&sm@vRi
z<dz9ncv~c#2~%5`kfMOF2T7<BhSQvcv(`@h{_S(HWpV8(4cW#t_Pkr1%NRjGI<yrg
zS;13|7wnqx@gXCitu4_ko95{K>t`aGpgI;H=%7)WBZq*-OeZ%ar+dp!FZMz;fLNVT
zJ7ubmd?PfOVPTVL5w;>L#2#ZlHd*Lso@qpGuv%EU`$lVFuU?qnYt7Zt6xu0OJ<b`B
zgwtBEP@e_peF}8Lk_7(G+sd;^maCW!VQ;QVuSh{E6kJYLUX_f~DxhbNR#Y*m#7ouB
z+Rl<1>S5%#zJndj)v-klhJ(lmacDD-8pQXB{uo2|(MxW~=K^Rwv>YqGBG(L&5&_9s
ziL#W<&sdVMyzFEf6>(j>`ZK5mrbyKczc5dgeIdLBK=^AiayR0`o+;mn4_7%OCDf33
zrXcoS(Lx<~292n>+T`9=2<dw+3iIB*qHC<K>OIu@oyTWMKKiT-kALOv9VHwf#~iU$
zm44@IX&yk94=+~0!Rq#aZ}n+b_CG)_GoZlF%Yv%~m%ZoDKUWm$k{CwT6U;z@pS^Bs
zo(+bR&8X4oFMi0X)z)}5+iu+uJoV64mZE<FIpL(La*qBbhoktURipEG4#kTp1GJ<v
zSI=EF+I7R#2K-svZyT{&k89Yk8(mmx!>;Revtw7~JKD0F<>v^5Hd6Xjbr;!u8n5;7
zXw^w|^r^}3Ge3TdR6p(U*f+z^UFGT_IheS>biBDTFSjM_Lc#Kw6|YIal19zF@-K)-
zC{=vbbm&aRz(su?Z=Fn8=hRePTvWfa$Emw9G1mqerkep@`hpo|7=@HzUDJVbh-#RG
zu8uw8IeKW>TIA}FQG$71`C`@*%-OuGa$TUe<(1g<;T(UKY?MT{JJ&V{5W}WG!jFiD
zB{!@W8>-R1_36(qixTkZ#^ek8T(Gj=7~PcvBwyn<Qt-)9&5d)Udev%OIOlC4a;|A*
zo!D7*?0F+uPZag%`w1Cx+Orx`>|FN5yjI_8QJz`ik*A&nRl1+S=KVc`C-FD&-ZHk`
z|0`gm$~V--`X|Xr2w{e9Ygi973tMJjVc*qFY<Uqi!_YA-H@e4g$TRT79@W#9ON;13
zhMse%3n(<FB@;Ucz#?%WQIXm|oI3!^W?&``0gsUNhBa!o2^~TG3Cr7>>;Tw8l9)@e
z3PT%$_tGqzq7eL*7(-Xt%>q&gj!x-_6~avlI(35Hv54gi{Nw?qD@i_LaAN%idDa|l
zh~6+7Psd0%v>|$(-5|r#hUir)oGk=?X?dD@vAyFg&`DfoSPa&d{_2JqhM^PUK#MeN
zX>Nc$rs<e^f#ZjkMqKMLy6lM$U8OB;;kG<>fzQZlCPKQjK|LRp%<}&Av(JB!JO*4F
z4nImtB7pw>d)eBVIG2TA?}zLi%*JbW7N_L^eN^YuWe=tr93GA~tS^db2bW>y)z@EV
zH*gVVVSTYR9pSd+@f2O3xNIYQ2GJ|UW%K66+iJbl%j`NP0z*P!mh;<il**TF9etIG
z(KxG@$xm>7l^`VUtrmtB1iww<jwrl9%d2iR``D5!n;mJQRB?*>o#l<;8lj@<-KN)B
zF2S~?*oGViH#l}McdbD}d?D=Gx%wy)Ig|6@udL*GD~qx=u|U2?RtNAbn<;8ayyjKk
z(5x{XHqVBQ67}<z#b$`!m!zB)L!{Q!5Iu+CXH;-C^W#YV&gEti^}X=oOCZg;68wuV
zpXY=5+H0lsCkUOMqF+TuOq6CRo=5OWfl|h(KziWc;#fA71u+D|!&SWRoT%E`UaAwD
zZ%GW!kIxh&*duX79kmCoF`CQOhPjO{ORG;YC*rC>`grv0dL-n9vMDbNI6y_NNByP!
z9aQ@n7m=HrjFgp!=ob#&aKuk#JzW0oKexxE`hXDsLS_;$Yz~7CSrywaR^<eQ8k`SX
z-G4M-SsiEbZNRdx&%VY`w)cX}IwhQ*$qJqDwBCw&*xOTdweaXVLp?PwI=w>37aUg;
zxkp6r45iZ~`PNujTdFJ)0*P|k2I!7br5U+Yk8~G%)QGS}^Z*mzWmtE8*YtEFB+mEH
zd{(=t+)k|A%3Wnwr<HA7SHw@ZtoI$&!tF<BiHaz;&ssxlpWLYbA)hiNQo~;}fc#$a
z;9_-U&~n3*%3~c0JkM;%^&gpYdWrO^96h)t1I;~}<;8UV@h9k2DTAp=QGowl9coj#
ziGb8vIR{GD6cLJkO_G?37Zp*@n|wC5VF8{8Hca!x>;~u0E%Q0|myX)wu3pZ|o#gg7
zEYd~Rqk*mg|CM1m*oth1Js^~f9NnXS=tiy^c6e%+XWqR<*Phv{)}BgiJiokJ*vy3G
zAxleuXBM1Pn%*X96zAh5>x!?SEQ(mJ0>yIhiYlf#Z*Z0C6|5;pVxI_~ScS;MX=4G-
zImT9C&0Sn$<plF=_YY%nnHKRZ8bsL9d;*YBgh|9A9O<@iu)rd|5j@z%RqGtjDj)3Y
z0=*Hg*KpoV^QG%5PLgR+!ZcXvz_s+u;zyctUJOZ+%+z5e+`W?-Uu4x0bX_@Yi&H3D
z?nDVo47w4ICnV&drws>5?vP%4uS<NCM{9zw8~R`W_y6<%{lEVM9seKM6y3y0B0P`E
z4CRbF$3w$YfHsmDcr1$0SHaZ`q$acGvxEbC%{^Umh&D%AJ|d~qGfp-Eraxp=!%N`n
z0*mj!(O1~l9>yXkdPIHQbg)Zw16$P7a9}bWGsD$j{YS33o{0GyEpqc)E%IGa<0aVf
zFVi@oh@d0}H@s*Cm<qwZK=O@qX<dM&vVcFXMOF`p>b*o%vlOW2uO$6^&cYg2g`)sa
zRW(h9h^57p(>BHBQPG@AZIHFwwAdM1y_2|Uy_Tk_T3=-bV}$zbWOOn_FWz6gsg%gM
zfm#lq9toB8sLP^<zVt=18Ilap>v$ZOmC=%(MpHPf8(L?}KD2>?XHHr_M{yigmWsFl
zIH=z)GXRf<GLOgo%N_!I!~AUy4qx^fHlg3M61`_7H%=&EwN*)69n689qPq|})p>jD
z?2vGq<bV4`O80`7-qO9{E+7IO{2lJNEE7h=4&2bjwibri3d{g|K|ruhd^5D&Ad0Nj
z;e?M|mRV{Mp5MjMs}~33@WD9TG7c{ldVi2%xbiJj&W7Jgh-nBX8CY+Ynsytqi3kO+
zbl;SWIYFl&@?0t!HD6_^gw&8VpJ(IA6ynGMl2e48h$B&CoTVd$E`Y$)`b4|hniuT6
z00t^7uqEWg(VX-mnroK7?A7Mp4-mg5jS1qX5|-Ll?nZq8IHhCevSxlpwRg;7H;<97
zX(t*wZPuyE=ZqwM5W)D<2ir<P-GHh`AO*p0(S7hrvZd{~NgD7nW(gMt=BLOOX&!k)
z&qkx13DyQ-3QV_Yf(KIU@)ot!zy~7kEPC^*<BamEb(Hv4)vp*S$7FI*=g1u8jHU0`
zcFolObbrmcWcG1m_{X-XF+t`Fvvk)H{w^JC@=Wd6QI*GYo6+AXk>|2ho?ASW3-@2+
z@pSw$7t!%A;!#{eCyef`bfTr&@*|XF^nraX)s9fx%XZllUS?_eUJcXNudl&DxVLp*
zL>I)i5@cnWjl1TJy~8H2?pyqwRUcVM4AUkAn;s$9awx^bc6{twlzNe821cYE)W`MA
zr$9GfJ8mQppH39FJorakH4N3<P*ienU(Sc5C=|fnBFs_OZLj2_#e5|88E&jPJ$*)j
z?ga2t!8y-OOSSc>Kykz)0&<q{j(~AWNbY1ZNu+FgDr{7u#h2`c<>+cUCaG|^Z+4~6
z`_66G&_rb+RJI{l5(AYpAOQ;<g=eq=jkwEK4%*M#Nzt&>aps4Hy(}(JF%3gj6arto
zA}Qr8t>Y|b=qAg*oOE~S4rbhyvuSx~eTIWM;_*0m!%jUd7Az2gBZn(R3)4NAp_?m(
zcf%qc-#Simxn{n*R=yhHZ{A&Nbf~wsIiKy8-YnPxxKghYY_wwq`BQ&Uv4Sg(oYPaZ
zVarmCZ_T+;W=VF#^8TBQa!bQ6vjK!Leumwwf7z4US8sUPBmV&R1pZsqBL5S1Sa50N
ze~hbX{FUZ&SEx$=tZoTsRmqkh7)BbJJN#VsDqo3)`9a+I4K~u6&0{e;0Ux%d1`;uz
zchUs$7>x$vguDON0%8TB?r0I#1L9!Ib$#qPA;m1REXyz=of)gh^jgo{ROHjQA@Hi0
zBsY+Wwq3e3&m^Hmu@+E@EgHC(*pY@cYUyF%xWr=XUAor1?aKFj^aPX(q-&e_U%wL%
z<!~>Iu$xFLbuWrM-_<a)A;Vc{>)6*lf(dbalUO#@y;U&+2hz&w=RjJy7t+dCEjHf&
zT2od&<I;U+%F1_a%xK)EnXJ;d0bwQBWJnG?!j*E^fA;E~VD^w|ETQ8VyrG4L+T@|E
zsDuIC7o@*!9^q_ShS``Em9OSHmdbY`q1&@p@6be$OJZ@8s|4UB8qB0iCuoQ_S2NIx
z^XwXk4NLNcp(KOQWzh|g0}IxaRAuOH$#qr|aSu_Np(5Kec_oSS-S{ePrUjZ4df0Vc
z3tKF(uot)ywp}AIUDKe<v+grNLp8<P(;L25HNnN~lhb?|k;3{IoHd-5TRdLQb)bI$
z^-3k6sR=7<$b(mpMC!*1CF%z(B-4WX&rR|;%TZo0#KFlAOaWERP`R|avtZsjgTO6c
zS}YOGj&zH%5Hr^av89_K_DrH-Qzx2DL+04becUOXnouRI3%;NJT6@~Rh0qipVhVXj
z1(vyTg3C=E=Jym%i7KuIRv?EtF0!IjnT-~+CW&<nnkPE{?@h%UHBP3v(C~j_07?{P
z9+I;EJ1YT0e8Y-@jMyuRhUf?%4beLm#*>((rJ$0eG-pLcKDiv*k%<BYuJdnf*1_v>
zF2~?Jql<XEcdVEu<z9oUchdDAL`e21CzGo!L$c+f+&r#OHk&-(&VLPT<kNBb1~QSs
z+em1$BdX9$aHQ|Yr>_V8*(|^1Yw+2=%S&`bV;V-~Ex;6INOrq|Qaf0Yl?nKLJW9F0
zPg+)1;I3%g?G4HM%5Ai<$Una^4??v+_U>@D_FC*|#GHMn<d=Jqdk8a#?%5i)1D9dT
zk6av((8AR7Jk2&qVEMu0Pz|a-xeW6x0xP9pHB@3qSFK?w?b}l7Hcu<BRPZq*0`E^e
zZ7@Xs!ew6*nzQdO-0=q@_ky6&8LGHr+M<}_MhoGfN!8nw85iNC9T|cv3&^L#Ie7?A
z1tIV{C^*j2xa8^vA0!oy+^?9yN=C+L%wTga8oG3??I%j9hRg8W3z_FZs$}B*Vr9pj
zWbnOXl2kf6Kn2y;tgLp*EPR4qMbhRjix=EHjiM|BYhOC2;KN@xE4spU{(>w0QYz&J
zDh^i&xiy3_0OQb8g06BFogZD5<)k<}J%!Nk^rSK)orKx=l%;rDoGOD7&bXZwn~r_T
z^(6?eY^ZU6;bG>ZY0hx<zRmkbKl2(y02Clo|NY(TA<*SZp;}DZ5W;X-UYww(r-UOn
zcS1W<$PVVidcSl;-wPdw`V6y(M%dD#5C>kM;eeSobtCG##D9c3Vq>c~Loax`db#PH
zPFx%I8!|)vdN&$u-i?(1yu1ruH4C}xYkzUIKa1rnJgnt4u*9C8s&*7<N>yKKhHr||
zTICR29x!-5EY}WIYqiSvGR|x571)4Vx!^$q6ptJ#2aASlgt!7~QX#zDVIUgozZ#0=
z8ge}>9d+c>)5gBqcn)H%HoxgmHR0sdqs2#~o)XI`+FB!(rLt-Z2zUWA@{O2`3)FDn
z0|0m69p?Kcuc$$9IbO6H{rMbm(#htF3NE-d`&+Y8+m`@-J|10oTBAmN?zbv}7_qdn
z->I^{qO#wqvcFiFYk>T#Hwf!wA&Gq~4y;ZGXs=KQY5A|4k0VRND39s3NgA@e{AIT9
zybQqR^>2(H5cA)<yCX}Mmv5y7R{w5!7&^?sEk>*xgmUZA+IFlqJ8gVp<$jmf+>-II
z+QB*wVYOX$E$?ktzS{lw#kmMz?rSyztYN*2!kxlNlzs-=+I^AxHO=(QNXL$4nb@MX
zh6CNE*l?IdLR}9G+kPAvNxOhBPyiJgOKBI5wUrjsSMOHX_lHR4BZ&VYXxD&XpG(Xy
zI71qv$H%}2aeVwdVI)01Zg3fvJUQjk<ibrLq4C&;9crGNO~$HnayAH`BA}c|pXhzt
zT^)Cab)`n^p6S$74@nRO3_F^oVJmPL_Csdl$nu!)yC#i7{~oWc_JUFP(g*T|rDxkL
zyqbEg&pnCPcq`moF%j6&0JBm=IG#z;Z62DlKc_J$&B|X#I>mq#Pf~%00W~QBWH8Io
z4d_AaD+{OPJeOOWyRAhZ%0WAJ%{Y|R@T!sQZ#)8}mFpXp;3O-+1+@7B4aINY3(_=q
z@q=j5rron;X+*wf>sEj@-8HZkS_}uou(3~UX6dFE+OGB(p{~^@7591|vone4sN)G;
z7bl3HO^s-j_mB=zKSM7Vor>rywibhdw#Nct;p;S4*ouOOU{N=u>1H;HwNTM=u;_ff
zLxrfe))%7bz`y~VMVM$QK2$faf`B?!6nRDX)1S-_v;hO1L(Ho@xUX4G;}Gby3Xb}N
z;r&<GnbMF|Ty*m9KUCR@w_~Ara~OY3%eds)zs#EPhQx{NybPTpaq?VX^No0^3Y%hI
z%bajHkj{W6BkVt;l!wcbgva)`NI1C7BQC($K~NL+A0qG)lN&Bw7{vmSJSVd!A_nj#
zE*QGW$z-9NFa^OVB@Ba>D(WrtIu-Sx;WiUR#o@)@>tvxHoXm^2`8i?fsJvQT@cg{N
zWP#9xgkL`MnhO}@U|6r-(^Dh@ck1_G2^;f(FQ_c%K;2sXgcUuR-ycp-`B-yXA8(Nq
z7(Ph^9--`OT-1wguq+i!I)3#6oi~SY@d2`Enej-<>zKlcqIQH=FRBNeo~o%X=eU5{
zUz4Jg6Imh7+zY6Pi}!pP%M|hA)~mE+NfM9R^ILxDCfJwM&GH#5g0m_hTZ~`h*@HG#
zC|2XMSFeFS@>~x0^4=|0dzF@)9i>@oZO7$+0JNuCmvgl>{hFN`aPpMJ7i*UJsC_!A
zUyl>dEh3`o;U8YrmsUReRjM9**&7pxu*;@}*gHg!9su^~4Dsa{r%OIsBiy!bpq?Rb
zNd85nSBHvNs4<`lMb)f{8#PahX)zJMa^^j;hcdYVLeWXiiWY&9VyS7Jgf9~U8LFFO
z6Ow|p(h|+jDzS$)N8z$pcL#<e%a?xHjTIL@5u|>s+WPQHoPw<e=4x=?x%rC`5bHND
zHh1fP=l=PveVQNb{73+p{0T%Il4-)(6?JZO7JHUj>x~0a*<(~)SP-xX<Fu43ue!B(
z%E+FGIoLR}_)E7=sG2cx*-w>Xx!H{&(g#C$-`2~-QQcQQzv2SkZC&enqvMV2k;R;Z
zbq>p+zc|@oIWB2ky!-p<xLSzCblewLg`+224Q6U%u9iLgJy?(~%ro?_V1imAwejfM
zO4#5b^U^3Gd}PI8GcUWXPLaJJlT^7%7tZZEX({x&W&Mif_^G$A(`3&L>`=_+`C+WU
z6ftCt2C9*T8PIxWOVxZUBxcF=sk#IE+Z?nbHa#IcFJ=+F$oVkGS*jdt;XBUtZqQD1
zw8rOlSr=C&KU(@ak1r9@T|&L?lh2***|rge0j3_cuw{o9CT196%{2_oq>*nL_T!E<
z5J*-mJi278R!1CbJ!nN`&>5gr4ZabPZ-75xV*tVri6+=uNpCja2t1H2<nd^<IeKiX
z1k1aH7Tl9`%KHESyW~^8_5QSZ$mWBf_p+mDW)M2e46$ZYhAqRP*w?9t1Ir_(6IhJ6
z-y^{AkOyte;Czp)F|cRi%I{5?J7C{|U3a62P=<*uah0xe$8h^b&KB(t6P80b2^b!P
zb)fPrR1VInJ0xfI=18G;FhtFm%;V$tKmqfDC9Gt}$3t{{{2R$>>%yB1*tyCK{p&RS
zf?j3`W%=BlS80%ag==u`93TH}N^$}_8$<6{0zt%ZPhfOB@j=rn(q#Hlb`OzVO&)=5
z_sPAcgKBSOt-*v$iQ)u(An9K;-_b+jV@hlfTYhL^pXed>Tr;$7#}63oM1t}NDbpL`
znmmRfs*~p{6h6S?G1trLm0MmBaM*{`NKy=gxrOEy>abdzDtZ*siF5Hy3WBpq1=Ejm
z0v@BS&7yLe9mgq;<={GeND`6@1}!1YwLpco%W3U*J0@Q{H_;T}8cmQ9z+NDx<uS-A
ztlvGpRmf?;aRt&I44JsGDC2#+>^1hR%igDR#Xl{*qM?nWMv<ez5GpnHwN;fGMP#LF
zhx<?1`y#&gt*X7O?0hpZY?K=t;H6~M#$K9>y>wOe#ga!{60SbgA~XP#N`Al`l<Y=X
z4yQwLIk#kC=pMf+ri;2-06+x4uEuowWHjQ;cGWXPS!MrfbZglsmdMM(t)aH!^VSvG
zw^W7IpSG^KqRc`QjnBHIvbw9Pt@@;O)ukndnnH%Mylj8iPKeC5xXdG=Ebof)>|e0x
zgyh_Dv4R?mc#MRYm^8qa13^MzU}2L4LEzf~u?W2j+-kS>=xj^c+fcEwASAj)ZS30?
z#TGMdObo-uVW34GF&Xjn0~K4vyv@JP>f}9ZNXQl`gdP?9nnpC+^eu`bPdBk;X&&YT
zfL>&II$@?2YOAK%fqkv|Ik2zog?;TqHbHNcNm<6}J}2V|iATUmC5^635F&S>Vf!mA
z<%X@E3sqBaBN7@HhZ4g238XB+C;En5Ll~xTeE|(ic11iNy?Oz8;Nwv$(2<(#SrI*R
z%XCc_J>+;jw3UHqmfZjtQ$1FgL3tWT>9E4Z^kGfiT)DFqLsW<d&}>X%Aj*>N2IKfE
zM^Oqgo&bCCGyv(iI6=P&SMMvvqfmJ=-l9}Ve?emt9&^PNnTS-}S(ei{<)FD3jRM%p
z!C|(%A}LZa;){MZ+^HZgvP7opJ>En+cM)G_kOY%=rOYPvh*ZY^GDBCOBP+)8>QSvA
z^B~E>FVLytihyN9j!~ROIVs9~8kW<X?U`$?o-|z@SEb}*5}#S2gZ03UuoZd~!!C>c
z$R&DUgeJ8fqiu_)$|%ZJE44A)a&CyF$JeD?maizntp(Ot%&4zs&akzb{{HSY3X?ee
zvUX(+=a<z$W)*<y&v|w56A-^}szmh!nB9MW_gc6*@W=>Oy~<HhPv`#M^Mp4faTCyl
z!8bN03oeJ^*#Mk~2mUfs+tN8|x3WC`cMhMCZkg?I{26IY>i9(;({_2TpU)SX2Vhj+
z8ZobnU$6p&{><gIDw_N6dGacavL*=h_dI!>HPeRu?cMW?G6nwJl{f!eE^qN*YVqz1
zUv<S;%*FJ#di^5KCD|o^c|g;rDZT6oqL3oZI3L}t6);~DV6@)3+4kFf^cunqE`Ys$
zhW?9i6}z~Kiz~jz#^b5j;)VN(OjH5BOB}CgJGR_57JgSwxyFdg$+qB%Rz0-wS(bNX
zq3V0SRlE>8MO|B52FOC(T2hhkBlFeA<O};;u*C+3$X;xt@j2g-n`ZUKoguQdm5-OZ
zSnJ8++R_K|Sk(87Em99G6a{BiRk8*5HVZDy^fl<;+#bi*+p@}Xy0teMiHubjhe%;z
zOP^KmIh!8y@#t^w5NtI(_#eEqs)yB!9iFEARR8u4g?wj{UaGCu#AkaGe+5rH?(Ygv
z-DgsS{eqRBr)iv}{bG{DWnU~L>DJwz2+%V88#I1VF7h8g4F>X=AZHmG7h4-HlQo|D
z@n~MwJ^FOs9*QCQc%&*HeLAn-_v2B$rj9<H*MGpR`m8+qbl&(RACJVWM{+$JeL8Qg
z4_-nXzl#MImlG71ZgOwpuScKGtI-`cKihfZ_vRDi(x}^(7oZGZ2MDJ3(WmojQNSIT
z_UeXO0(<s#D@9VV-u?B9<GR_m;b@5BM7&@}l({BW>>MuN6*-+_dsK^~Gtk_md^ESK
z^mYeI#z~#ZF#s5?I}M|NMxXQ7<p8PtW&(-piW+y%)wd(F<qq7IyXHu|Rffcsw3eNi
zJ+{b>xW^=cJFbcPTsW+X+kJq;s(3i7qLz>D!K%m^eL?ashvPzw%%eXp_CYN5jo{f%
zVyE(UGl=QyOvf5C9BeU-Vd7B}h-}Qz)lEZl?<?8HQ$7xeizw%pJ!y2&w4a_x(+v)@
zBq5W6ovB~iMx8okIF!utv%hGXX*$l6%bqa4C?iZstEYetf=LpO(lgMr_hcn{12%QO
zRWiD0B&wtf^lLgIBOc1!*<SRHq+gbqi|Xmrgm>HU@idP}s0>C;Lz3|8<1BUD`xbf}
zWWruUb9RGR)lme|Z#hjQ4Np#PDx=Uf92e{aeYj#GuWV6bajnriaNV7P-j&SIpOrTd
zMFEQ-E39%v7@|V(iqwV{=pu#ZNf;Yi%A%5`s2GzZfr$AMFnX}UjD1sZCT+NFlF7uj
z?TKyM#>BR5I}_)NZQHhO+qRRP|J2_1=c?bn>#pjqTF-hGZkjm-rrqwwe;hIUzX<)&
z<A|IlAe@RBR9Axp<RIwU@!<Fbx<{C44KQ*8^XT-BBv&YC4R6pZavz7t#}zSdVSfLR
z-U#cm`vkIkiXnDChCfhmvjklJ5#zL^Fs%gkU8&zaGlXvIu}GXyoxtb6d`GD(AyX1G
z_D?&+yy$I#3U+l-q)lkBvB>F<s#csuX6?YsSEUA*so#{n1?V|sp=~^+<1fJE$V=pG
z#A(?x#U(?Lwu1=~c|ucpg@EnmqzS^05M;y^HjFsv%}^>(%ox~u1kRyF+3B0@#b3Bq
z)`v6{?idW5q$08JQwzZXku2j4HOBPVp8h8KQm!mWX3=<VZ^R8Pof`F{ha|!FI<?CJ
zs?VFvExQ|dY|Y)cFqYu`YrQot^c6qH?VcL4%N^~17D-9k5iUu&FM7P`i~V&8pH_`5
zR-WT)y*@5A**wbctH7u{7_)Gq4T1Wvdg{Cw05&`{@cz4_?4NtuHq8x=cMW8l&7puI
zF~obK?ZKcn-X^Ux!|f*?=~7EZ6HUU$C2*H2_kVI+psm3gWh?&QVbJD~D+u*$3V4p)
z<AksL0gbb6`m9;8+yFpR%gf_5r3A0hHl0PSs13f#g~5&p*sKur`hxxnk&T}>M9FLl
z9_9c{#f%QiDnPdWP{Y{6{+2T^xJH)m4EVMeoHffY`~dYDSH5eAQpye$zo@VON9qg#
z$AsH18LxmaQag%iqw3~If!r&SrCpD*!Jy{bgNMNCNbYH~`~^-Dm;A}G>$_X#`4csk
z`>REAY_y%Ut?f*z?CHCN2JtA|KChaZ?w$6nUwXS47Hij!9jmF4zAp=nW5t;$8G|~^
zifv<It}h`ORrf9xopw^&>~r-c|E)0#@OTB%`J#S_E%JTxJDp@z+WW?L`i@Qj;LU;M
z6~C$cPdQs|HQZy-io=~tpW``;bo37ggDjy>UP^2%YH@rAH=XQZSjp*f3NH_1IQB1N
zvygBWXiLs4h<2m=k~Kx%5DlnVtjXn4JWpl}yv!wSFS_}4)lV)go3ekWGJY{3^UOa<
zUR%&dEBUm@duH?)UKS5*ak+fZhPpg(<wRnY5s5N><Y(4vL$n_Fj;coU+(y-A-z7f7
zu6I;MCBZRJq7{2)VbMq3v_%7Uu*t1Wh${>C6Eic?(}fB<=?W#Q9_83K{CGe>_+mW!
zsF!rt18=Q%pn&zleIAUwe3opfO9}%9A+BYTnB5M#H?i!+shbGA-kI{O<#i+5cvECR
zGDA9-lt&_}KAzmdb18`7qIzcT`eg)<-IE%!j}P|6rxc=2ErUOKc}M@=*l0?@92{kn
zK$fri#vfT&ndiYfGcSwBSmc|6S1C`mGg1;<nf3J?2HP<0I{i~}tPeIdT0FVB4Cq|P
zbdOH*68ILY{p(WL+{Q>{7PO}MBGgpZl4cuXD_0enIpfUExNJ9b{6Q|4%iX=7PQ2{0
zVwCUnTuiv7jKcK4j#dEKg*L+vy*r}u!X{k3c_O%`QX7N4S4384u9<LwiV>YLCk^YY
zcaC#5j$h1tn?K4SJpxrvpqqzqOTV=w#vPN;1{)pdBxEeN(9Jnm*p5lXpe%s<;z<0u
zydF3kvu!DMngdTcwphC17pX)uf${;&_MYSTmc4F+Gw$KR!DSZh`S83Ox1d^p*+-qJ
zc`}dk!S1VZ<MrS^V%7oX;BHHgy9Ts7`@|6W0W>DEo;$aMhC5btq!MGe+~^B4UIJoZ
z;whcDgzWZbS$Aq0u<w<zhO-X)+@g)s-T9sF%Rk&M|EnH0`TKzGKjd>t=eS7@d{y<v
zaVWLbL_U8aXH;B%UFo78;^BWH0^5MRLV}+657D`S=%`mq3io7|@z-0e*|^@LoOHY2
zx)7|siuY2iXqc{|IQah)$3iD^;4qFt`_SKLuJ)LvocVn>mZ1#0QPbi|$d^f206?@O
z+-J*1a!RT%x!pt-y?ZElTl>f`q|6FHA@+#up8HT9bk<+xMl&TulLIy#A8h{ku~mC|
zNctSjp6);>qr1~NLp^XyDWL&0d;-4y)k;h%Qe=KLozn3Y%O$me5J{oL@CW*X*-y1#
z;|UXge{f>wMmWN#C?Z@_dtoW&kVuK$d?yC$X`#9=id9sQgHPLy6r+HeGD3X?*o%f*
z^6o0+^5&^yLZ9z3eq#E2p8h5`{>3K*R^>HZc@1mj1)8KG;a0@986c;f!4F4#m6Ag8
z0rEW20Y*)%FU0#tC?^tT*ZXDVs3#?MtTfMoz4xb6baZso7~Z}#W!^LFAckm|gnX9(
zSdw5pisW!79RVc%UxMK+Tr%Yl#uvHH*~`l$Go_(c0Po*CCFUbvRUvp=jT%sx{ho=~
zLo*nklE#BFvVq&%?sCiFVeu8>K?g%NgCm3#%nw+1RrI9Fuw-@tx_X>jkg`9YY}ebm
zF!G3Xi3j$oFbV)LO!>F)9u~8#<V3iF;o)h$tlZ_BF|}2c5mSZk4g>qG3mf;}IOhqF
z#5>m%;>s`Y#@rSu?RtGB)KypvjCHP!7#>~~Yo(F_LBdG4vhj`ROD724yHb=w-<w~$
z-^<?%jV9fG*8wpD);%OE`G}%JSRdlE&A$OMAn?dM3*Wv^TUH!4Br@n;sMQqXNP(!d
z2D*u(++>tW8g+Ah#0=#_lF|trIMD<V5Cl;Cu~AnECZAx(dk>ph6BC*fkKB^oJrl%H
zpI7R{2#EaDdtgn*$>J|p-R<A!&xSJ2s8*+Ck*J!C%%iu=7MAZ||LR<g1<zy?MAWUY
zuSXS0TV}UDuP^7o8ATeoHG7MUlqyE!1Fe%JR$?*iVKkD%N^KWfuIO{unwsIDrkVxU
zOQ2<WjWxj5UQvFuI>`hM;xl#ZQTfPF9qjpb*x#@ZRWzMwYlKMcOoXZ3p{goE0ok_U
zVOr<9OAYO~ennKSKN_KyebiW)!M1foiZ<`zbUpDk+-m;{@g{q@rroQMoN<85un@h>
zyctiBj7S;{bK_KN%TwCD8}@~iMm9EnI+9%eqGtV|b%Q-jYh#V!we_-(;kTOAR+=@3
z7KMz70jrbTEptGsiKqHJEGBaD*-DbrAPE*}R$EBmCeyWY@8Y&PIRV@+I8!?~h$)S;
zh)D`Wj^)CO%=5DeQU4@03_^!M5lpeK!ogM0`D;0%)7_omk*sE7{Qwh0W#tWshr{jJ
zV0J3>K=c!XAK-oW(ih41IiN&`GkPWOg%m|tFo!G^;)9<XtU7V1`ZcwJ%4{ge1goNK
z-a7S8Ax)PXPgPlB%(eg`{+u`{KRtD}XeIvqHH0;?{_a`vNHkKbTI7R3(k|XvXcbET
z*Sv=oIDu5eq^Qh5#-6zXvo4foI!AperB_-=jb?qb`Qp!Yg@5&i>-EP?S<;LqHN#2V
z5&-7o#zHQ>_KYgT(vsB$$3TCQk)kQw)L^jIX?U?zBxACf$ylK0cPH8w*C6PWyPM-b
zqQ8rt$-3u!+l-un3uzQm;~gBCs}q!-No?rTY@ltp4PNz{G$*;+R(YOHRhVQ=%<>qm
zKNh9Uyp;wcO%;9aG-qAcq|p1H;JFa9GaJt`91}TBn&aH(1%{H!wu!#F-8J?6rXcHe
zmzu(~rm}WvwuVX0iuO$<IEyuFvBmxiv+_aihv+rwco>sW^?QQrvV)Zs7gWgdqJs7+
z0po<0XD_jB*&=G$Jo%KRuOOYzkG6f93Vf45nazY$1NW3w&fYXqsT8-gAXqUbT$N(l
z*{DF<nsZ8JHC$LOFvnW5bH*m;>E7rw34oz_lcD*uS0JC<Xu*24Md<2`s-^o0?4y=Q
zJdB0mqKi{SX^?@~oOVTOnGsVF1+C-NX-F0mqr^=1jHTVZ9TB0w6L&fI+L~&)$4RBJ
zbUaVXpOUN8o@VnE#gt&@e<L9#7Ii|2o^6dgY>E!jCnrn=#_W+^K;H=KaJ-oKLQhH;
zy7l_aGR^Sy$CZHh9r&8_(s-j3brqOjmT0v#hD@mKAvWg`Mw(S78}mG&{F{7@p!5~C
zC;oUFKhJ50r{S0)ToR!oS6@@qOTawb6Kz7jT2Mqi`#z>1K%1qDJQMK&`RN6Xhq<mb
zJLJD|$a?N^gZ<Y<MW)W!ij!&(OG!(bM5PzdPaV7hs2n@vIWB@C7kRi%8)RsicV5@M
z=Wn)8FXU;N6Eq1ixY05LM6(zO0q~{=qZk%*;zdcGyP#Sgx%YhqjZJ2vahCiO6)OQx
zGw**il$FAd^yQLK5Jr`)xB!tV({?1o@;HO-)yenR^qD#ER?__2ZVyNO2#V;^AE1dH
zxG^=(DKs{XZJ}ERLXBFQNjw*&b^lm2mud{DXq&Y94Vo$x<`=IX(XvIt>6%`wLTLbn
z{TKG-hdk^tg)0#U^dY5X2=dykD=sR(x#A02qxVXKw$wHq@FoKyZmK{#P4v)3#j^Rj
z@X!=~;Wod^OOCPr>2zs-#@@)(ylHubjB>S{auB8FYz)7^f-8cek1pHugD($aS(jIt
zmv?q71Q*J_YG8_ObRd|S=ROKAezt=29wXkrcVeA*TrbLBMc`iC<SHW_bA3kj=m^^`
z2eG2(jLg>xpd_mJYv64gwGF)N1u+Wb7Mh|hSa8MC@^0$tf`=Qa1vm_lA%>6)xHZ}(
zBzjdKGH|++Pls{Ciap)!o62MQU>|p)WK36e%A@#~2eikph*D#T7Wq-E!7adl#Enjt
zD!U&xBZVO($jzE1Q1Z*arI<uyp4xpI0;pJkoJ|mJAeetd9H5JQgdsyvb$YTmT^$NS
z&9#@ZC;|GYl&zZ3=a94IO%|dHA-M7pa!E7j9l36Zd1TNz*|EPdxL$x+XXV)x!2`m|
zuTi*SP!}X4v{bs=N~_e-+x)O^<@wLnTjkQF@Y<!;wR>w&E;&e^rncKva}bxIS8X@&
zzC`MaYg&iKU|blE_Mk?JPl|Ao8~$qB5||0!eXnY_S<Gb_f{%}Rk^~dtHLn+D3h{%6
zCLW1^jIo}xJ~7ltq#lLAHRCrNpmtv5Ydsua@C1re#2hrWLZTyfw^17Wubd_a_1uK)
zi1j&{MNNAiB(Q3<k3JDMyoHB=Qvxg+trXCcDMEHK(al)kZ>pno_`JD&OC1b)A0@Q+
zSl$@iTZbC1#kfP?aRHCWIKt3EHXsx)<p~PSVnUCvjtmpldwo*ki!rY{sm!Es@>zU8
z9ge?_0Akj0zV<R{6O=ZLoCM^DbMP?1qi{M!yaVW2XCgg@nCGArP9zg}#2EMB>g?^W
z4?Nu8J|nTz;ZY;>JqgIOaQ-&}w{CBc4yLg>TA=I^8Sr+r$OrUh7Oc*%?MHX3;P>2Y
zBDY$makWXZcg`cIRw77yd^aQm!BsNSjM;=UO!&C?P1m<8lNu?$Q)EmaX}9yHv3rC-
zAKtsOfA-YWU`vDWbtG#wH^C`*KkyoJ|Jp|o>M(H)&_Jp?C390C+2rg{=&0lsY}bua
z$DF@s^ZL+KQ941zQbWE&UA!pdn)*)9jgQELj5oRq&MM;5&5gZ<i|=Y#rkT1Ovi)v>
zE><Aocfw)(@)$fC72Ktpv+Y;e^v>ewS@@UlmgU?+4<$RJp+@8lH7$o-W0#?`#Pz0F
z{iX?cXO;TY`i4LTx;`2^S#BCU21?=;Mokz*?EV{y9(eYkiWd}&NIm7NjLjcusN~!J
zb$bVsnImVl%P{UR6*jO)<iha}0U8;CrAz+=$zi^KaKJu&%!t{1Akb69j1k9sq(Xtu
zHfL{|E{Ba<C#}^oM!T^uS`5KPx&^iiX_?34DE_q`kx>km+_7b0P^zn|rUv2JOBshk
zy*IL#f-7K;4Nsniir?u&4QVP@v~{ebkDT=%ahMM{-4~doZh8QY^@xCud6hQN9hf2t
z6Gjr#^w(=RX+1$@{F<4$oAVm-EE*`a>wXkWIM=OEVq%)UEbVJ0EaE{;7WeKvEQux*
zB4j+p_#BBMgz@e143LA#Lqy>;w4x`jFw^s)6BUFBa^|9x@2|VRLfRj|Zjj|lWs|Sn
zig;JG(&WYrKY%lx3jLMbp`RR_fxQ3tkqWk<xgp#7@8^h;Y`1eV{B$3}AaK0MOxT<k
z{8G6U5q(Y>RQ9w!;Xt75C`=8(N6i7c1D3m7K=sFhk9W3j+0DF+t?v{mGcK)cs#w1^
zn2Y0SAej+bpkhe9Hlk7M-$bG4tqjusvEH9b<P9M}5_L{Jzn$|d_jbn59>(Wz1IzZH
z|7J?w;yto9tBY7486TJC8cq&+PMogYMuTzRjC2deq4-uTqt%SHlCPBbAf`X;7#;b~
zuq`Lwt_{U<O^m<XF@;3_X@hvI>eV9nN_lm5WR}a%mT_9Om1i${`phVQ_waSnY3O*y
z+>xEhrKK`8xRUkwbx-j7Z>eju)Muz?(^3a~7G0%m_aZshKSmY-``|*vI|o!LOlQii
zld-w`RPV}_VC-d|LE^0jIGkJ4Y-r%^y1@~W2lI>2Qav-nUf^4qDAV1!$@KbOEmUPC
zW|r{$8OdKseZG0qKXgkg5w>5Z932?navJC!wXlbqQY+6(BKs&JTL2C&ZlS`2xI80`
z3>Q7lS8MLd9wsJSD7n-m4PQYy_8;4(Cfu*q&68V2hOZ0Q(0)UW_!?@7{y0V)7iH>z
z+2Y38@(O3nO%y+!%lUcc(7vwld<n#pO~_}HT$w7ANz|!U*&{kZ()rp_7#Z1>@SoZZ
zQuAR}MPKZ9F(w=~(>PA&Y4BJugShtc%Jez*g=q8UL3PQ<Ev%_-O_!iNIybf_cIVxI
zy8Xl?>+_!_bQcE?cWR-+pZ677OL$hHsqT*5z-@<x`kBzOy4BWa>-#P`^4yn;7@_TZ
zO2~O4coFn;g~$dp$>*iNWGyRgg2j8AVTSb4qYn<DQVdKR5}DO~W^clDf@7OYSL-S(
zx|E+ub;W;vv)AL=phSn>4Vn74v)D(n>O>F6@^hJD@CoZbhqR<GJ|&bA)CX=6v_^rr
z=0{ox5hsis{&Q292+ChY`=`YiFFW#3alkvoV7N=(Bx88!<P+YiBx~6mduPg}3bb=7
zfo0!&FnmQ^9n*DV)bvP`9<i!y6h#T~uiC=&Cn>DS24Cu>|I}NnpW<lmNJ&fB+%^*8
z#bnzreKW<*I`^~6wMH)AuKADKX%*)~Z28`jtk86D)fM`KERq`L;|}AQocN5kD9;U4
zv5^<8{5m7evjn1uuA1szTbl!y>YfZrQT9ElgozSb_pjuGUO+xtt>j)TrvemEMy7Db
zQ*e95IsZ=QH*UwMJE(YZdWoGBT2?HEvj@x_1@lisRjsi!_2^LAAO%?+wV}z%PyV4D
zim5mAxr?K3KvtQE3*2rMr!m7wq0t2F?;nUKz_71@Q8$74P1W((l0+yM)KgC%I~vq3
zA*@rFlHQo0sW0i;U7amF&O$r^wTxY&&E^If8eG@tm4W_Cp~<E^!h~DA;;N#p?~i@1
z{*_w2)hJ>oHKx6!?rPod=GmF<P4y+0@k!R37?sEg8dO;P(0q@|U_?6QKiv@?8h>=B
zCGR*yU|n*GqUDwvr(`HPUk?~k<({lR)QdVpZQ=ZOs=-a*TA(d^rZ!I5W>#H|VUy!O
zU2F&<=9g=yGhv}0SFb`z*u-7gR2~6gTS&9f10GVswi_MKfG{4d!cL7n^Au8_m2}pZ
z(!ZoW9ie|Pn4ZazbRVf6bqc>$RL)Qj|2|#hYG-%q1aD~v)4G;rlA0{j2pZ@8s5+@D
zPA7(%^c6137V_(euou*0n45l&e!2iTCET06=@W~q^K2$rtSqo%HZhO)rj;UJn5BiQ
z<dt$dOA~oI#6aBvDF__c>RXQX=0wMwKMCb>90L8q6pGc5mgFvENDMAnQaSlCvIw%w
z!1GPS29x#m#B%fTipCz`pj`NZ^Y}uz7w+$INzzGBIap4!U)W6$ATkaMwdf<9rV+Rq
z)`ekGz<f%FjU(LlU?~Q9!@wCyX!%jBg$Z}TXXKGK5V?DJmb@CbhC3J0ubQOLPxoRe
z$z1U7L5U@(jI$_{Nx9foUf4T(Xl3H56%Q|-{{J0^|CKXA=Th>QNatxtuby&Dv&F`o
zlwdj@^FYc9n@R1)O=eya794isPa!=VQB%&kGTNSj8Q}yuie2I4m^75yM!N)#A$GjR
z=0K6`2xd>-uw!$TGW!B@<os5$=^x-hD2&Iw8*tw|k#dmZs<D!0_<FsJ`^PB+GT&Yv
ze_hSU;F_5kidotv&&;~^H?BziYri{o?x(Z^V1=Db|4FvgPVm)XL+hw%WLYSfvP5R`
zYAMv<d4F#-^O~fJ1uT+|FBx*Nm)X4F$st6SB`h*q8sWTO!Ci$1FI$nnTYlC5gC6(s
z6GOxCDYV8~;rVH<6wcqw$9O^>t`Q;W-wnj~;mVP-h2LwcA>avH*A}yWB(S*zRDj#J
zZ|5p$@8f$SG~*3a4hMVjGZg6`)HT~6&Nd)h?D3z}QB7KdFOoTMU2VX0gYXT-0!Wfa
z+du*xN*m_}+?nyfsaMf1(9z!OW3&1-5S;K}U;=z7u;WP0)gIcchwLFS3AT=9lRTEs
zVw10&`{}QKZB6F2ceVz%cTSS5-&?_I##ic17Lhf<jP{q2Nu^C1EjFEayEJbj-50C3
zx1m)v4u4&>iW{4Iw99ZR>e$9WQ;hH@kxG#jMOf!qsx!eruS+w~+smjh@uW(KV(W$S
z5}zW+@TiNj2r@`uf}$rv-YbgI^;3imIYOZBaHQAU`Lnr$Fe|V}h;8I0Y2Bfy;oZ#_
zfXxi-!?^|Zz)HATG`0wPbB+mhcL^0A>dKYD!er+spUmOwMkol{5b!y<f9)5N2(l?;
z1oU36nX<*k-(nBqjl?iL`K<y>B+?>C7oBTGwF0b7%G4ETM(J6E9w*@Rb$ArlKor+7
zW8yV<?dX=Wi(%NUcL`|vigDurrY0{qnPN&teYe#*;M?fOT!`WDzOjXG>^6k<^p1q4
z=rAeI2jpgb;wPbowrDp|C8)nVQB5jo&{ok_xh+xQ(?%Ryi-+U;>)TYMkS(PH&;~7`
zO)wXia*nOVV^%X#EO=zIDXs%PFj<WVwIvZ!cto$#{h|<=xlJXu6#t}jK~3Rsid5Ml
zYE&=>Jpfi~C!t@r6l-Vu>>_S&4giss+M6|J6h7P{bpw!<C--6`ix6z@H;_};lt?BQ
zc{dCrLDQs8iq_6SiTayRABP$eBFBR=PZ!Peg%edL<Mlt(qYe4A4_772_n`)_pJ{jI
z(RalMrnlM`?hp-Fe_W-Wy~SbdI1&|9!9j#`LXXG!Lz(eu<va^aU`G7)ka8!up%P(n
z_Ys&IZKbJn8HAVZpZP1e%R6<NYfV@q8LZrB4Wq7HN?#}NETUJY+IvXl>nl)Im@W>a
z8MAA#)hjuN;l&HNJM9dkhs`N5jdnUQ_i;n+-Lx!gb&y*tzh3Y0wU|4wR<?>BL;JpS
zi?VySw*3jsXWq5rM4Ai7x_tzbc19Q2>Ao}*1glZ9LBO%%;3M_oB3`3+Ri4kQ+oXYf
zmt&z|UshS+)Q#4-63GMwQ>}>xYZH&yP}Y@tn_+r%Q35NVO-6(jp|^;E&ZdLfdgIk#
znj;Ur@8nohbXFr=>5*01&2Dihg!9_{cvENXc#;JGH0P?dbKzr0Q$!)%7qOSBKCi;>
z=z#hYIz*5-T9#Wy9{TucrQX^%)-w876=`0Z#(E@_$VeVh<pUgVmdtIU$=^bIw4$0U
z&W3E|x^JoP^65W~U|+`9iLud>>PaXy=ekWCii}gFfDmimr*rT<(%s<~1-s1^q!Zo{
zCC?b4`=Jo8yhz{GjbT@R0bfc#{T16LLZ_ECKyov@3oYNUj4iB#QiNe(t3xsO!213f
z(tGQ@EA0Q?d2)O-C%5{%>et<l@uALfNh@`K!Nr$RP=(PW!5fdvYx-sT5@QNRg%@Uy
zqy0`Rg#d}zZtMiMR3e?k3*L?np6z)(&n`(srycG|Zg+_!YFe8;<!*LBZPFLw0=w~t
zE$>!vo;~1&e1_y#2%Q9QKU`6tRuv)o1f+VQBSNP_bPk)~XrgooF^YD53TQ{A7or72
zI?)6&XZA}ok$>EY#7hn^J$|-2N{mFx;1jo4HyO+;rQaE1Vgbp~VNo1@(MAg%5!+KB
z(5pU`l{GE$5I1_^fW%9DSfw8AUB4xupi5kGZ3<)yk(H_0qdYT*3H6^xo4MkIQLx_R
zg0$87zyM>CbtuECvh_XfhT4S??x%-IB~e?2Wkh8!bG17?A4;tNXA-vrz=#@AV<;`3
zVx_1oqVPiu(8j@eVGeB3pr*s?d%r4EOa`)7ld}cZcC|KwW^?h2?{(md<z4`GhC@2e
zwWYBhf}WpV4#~@)FS$wC((9D0!+z_8{3uQXDAdmr5l5UXknNs49%-eVPWKB}8^Xy{
zfA`4#QtzY-0h{XUjl+{|?#{9g#HUf$C^GtoZXIm;0D>ulw*E}qE<gYSXu-@}cRLfm
z<DmWY2)p)HUp6Y7;QYs|hPr{HO(7!v!E+W;p0dF;o~+E@7_86nNjJ^Cx0Gi`5J2Mx
zUnnRx1L@-D9e}E*$`M&4_xpY&=bQS}>q+0SJ^|uu&3K9#*sn%*@B|f@k&q;tN8~)V
zg0Z_8EwS4|<i#L<V8H7(T&8A^1j(Kn-@d=@CZn$U@aLlcNb(PrKANbzc(-Hdv7_f>
zIFswu%!>IgJRhQ#pfX1ob?cz_?IKAUJ&?sa<_<qFhg)YD`~D&`eXEn(;Gu|8+$B^_
zeTsE-c`Su?&APC)TfAX>JmmMi5pqg&?*Y<Heo26N6Vl?z#{6WLVFw9C-qe8!N$LfL
z66UBGGn*kTec!%lH3a6atva8`4|T;6J#FjV9G&ydiXV-Dv^xvE)~McgG3q$H9Jy>T
zH(CTcBe#Xn(MYO}Jg#9ZQ4<iZMw9J@6VszJ+_Q1ej54!NqIw=&ux_JG?wmy1nBcXC
z$d0lBjTjot2?2Y^0{teKAJY>N!6+yJm_~mMkJm@`+L6R+FR3A#(pLjLv~_V8yD4;J
z*fTn!6@74qnOu#ZHl&zefs@@0LtXbq1Rnm3z>y$QtX^N?vlK45N*MF!_o_*fPI1&3
zam#dQuL&6426WVCQm%C-Z8$9jR;>ZJ1K|NNG8G;8H>e*h;mge6LF!Gan*AS_6m{o)
z^-7%Gx6{U_W07@vf;xGMVp<R7W8Kw_+1r!llK0n1cdIfjW$a$GQpe5n5py4o8f_h{
zs)^H3i7a<Qop~KVyHt|s!(|k_&VLFAkL%nH<yq85pc7Tb3>USC-*r?Ggf&n??o|Lj
zr>X$One~YHZn9d6(YSUryD%cBhy%oc6p5=)DhT@hWkxwBH&dPasFh;O-_clq6{spd
z_`Zu@_yl}zEN(p-0Z?;R7Sh&c6<ZW$b32RUcwdt3{CzUk7BuS<EB_=T118ef7BrhE
z)%_$BJ}8(Q&6pe1JLvoPy6pTan<%2Clp;-pBJF->LTEKyY$&gf#V9ISstQ@|70@6@
zvKz=$t|Y1M$WYH#{l~d@8zh`~_-obOzaHNme73SP$ncCP_Vc^<Py8;;d6J}cncv9k
z=o%a&{@bLc_3IxE)ww2h_G(>kqhl3b`WTw;9;M2eCrt8q_Uq=%isHQfXu5yyZHOf{
zD7vDd(pyN8UQQ!GPd+sVV~`Rh9AT8FoC$4jd~k<L-UB`U&^B1C)vU;g{8()oViY?1
z07N7T9gl^1`LFa8{ovZ$-6cA-6&-~hmxsFTzmG<iBQ>_ggMeu@S2sUg#<#1py~ZUD
z$;Uk#$_n^=kxg^9m)CWDt_9n6TvS~y(;o=cX=B=4dVRFj)R^#2%WK{4QUCchBPaF~
zn-m)=d~kXx$+*suZ(>ujP7qnaku(;_p5*F5(Jr)fNjY_(cie703z&)R#-9qV3ntgr
zVSsW(zTEy8aQ*0!JI1Y$2zKlV&4fAlg(Xu&^2B6I%J=%J%Y>96cA2`^cQTr~@Jk)r
z5nkI~JT}U&_tM59k;J>OR3ZKWkN=R6%vPoAcfgnpZOpsoT*bcyxxrw%#K85SY?p1E
z+xbuDGb82gVVldrl`Si`?XA8nbBU$2u34~kHVgd<K3eLF$Y4ifS(D$@uu?CbB$g;s
z+qR8%xGD^xA!gfL^6!$)u&&>$MWvhk>(3yYv_4Hyu4|Ek`qcv7?=Y8|gmT^nSE~Bj
znjtRM+Lg$59!t|MVy>Qv<&wna1hjtE*?wde6E<y?zwVlsx$y$fIIiLBWG_%l1@*23
zH#TtZGB*42;PF5;Y=!b~*coDb#JRV*;x3&I7bT=yJ+Y9-vaQ3tU2!iB$)2rUUGZ~g
zJ^dtC<)R*R{L!A^)9>V~>IZ>_Xwng>-+|`-Swm{qAdeXr;v&{Pagf8<NN@ctwbTCe
zov<4)GmrLf_=Jz*G`MJ9F0$>FoREgkXKIwKCpY`l?f+uQ+3_FcElQ?7;zXc_@yb_8
zi9MaNL=b+kJ`t&bx)y(<U6VZ+hm$mB=BlJ@cy!>7PKDUqKY6Vm1^oMMH6i%SBW0L<
z#YsQAv=ss-SuE1>WNjNNUCrELM3NbMy0i?^{p*RPA0{Pxx>lT{2AeBo^4dy{@%R%I
zSX1%Q6^gB*^o{19Min8)N`nfrWk|81*e$cPQ6A!Q0*r-cD6{6bi(X57nvV_k2vT3l
zA9JuK%-Px^O)3|w{+^;d^)&PKBC&PQeV0su>h<fAbzP^$%g1-uqHSIDqI%WmZX&ZI
zja|Nvi(CzG0PcwAcu#XJ%!B0O<N5p_6}8Ww({QEoCL|qzZRuR4KKSIZ%<{Bgx%|mv
z(X(95TmCPUA1rAEiT-9CPlbYkUY;VnXC1XvR<5~neY*uEXY`?YyF+G%ojhl40%m$v
z4GHwi6eCR%hP|<orIJB@d;E5gTN^~T{R1`jc|97DMLt1`1{{iyehI@vvn#5m&{!w`
zN|NTawjf^nLtWvz$Tg2bh3Pd<Ew;kL7IHe;38eiiG@^FdTL<aJ<zEef^}njIR#J|n
zo4r}(@)a7=Lx3_*^@MOS=e!ctKhm#fa&&)ilvNSJSe|tiS3t&W>7J^*!?0IJJoOD(
zfS>zB(+#(vvE{^8!VK_Omd3F=o1gCFt}8b^Ew81KWB9jnCRDT}mTSyg7?((v`-Kxw
zsW}!H!vs`RSUlYKtE`cyI>;RC_{ZOA>@%|ROz9^~pQU0E<a0W4YSZXFIr1iNFAu|t
ziNz)~5QNz}ac0L6Vfp^wg=>C*IF{H*W*(NPb!8rMFin6&nq+ifLAgYNCH!nDFlu0p
z(flrgx$Oy!L91#AX1&hoVl+B{rHp-Lt~9`SoG64+gLW~4H{|^4c2yp~!I@8BwZ&_d
z=6x>yq7?;uiDrGaGvZ^7n!Q@qeO79!JiH+}V;$#E$H508-cb$ZTJl$CyKWZ}kNVtL
zwvN@+;L$KKtL=OU!j-b7qw$f&N+LD3Wdx03=wGBKE6w_pGy1@XT!C%noR=eM4>gV=
zfw0y5C?YJ5AeJi1b8R}=3bI+93^T`APy4-7jJ+X-R9{ObEi4g%Gr4EKuCzvFZca#t
zx{5X(9GTdDAhTf_W;(chBLMw~z;8Bkt*yPgs45Md_p0&uEt1uAl6139@VrZZGuOg!
zF#=76L9z$~^%eTw#@QtrX{$VgepY3v1nJGDwLtucY~Dl*Itb7AfMv_N1#S#tDIQx_
zI><`05*;K9#|sY$vq_JK_?ad-_1Y{Rt+lno)7?3bmIl(i6MvMesP|?oBFdn&6;@+A
zac0yDx3);w$waHN)TS+-n$uejlE0elBxxZN(vyod25T^uAy@jLW@Jm4hRXR_1?`g8
zv2M?B;id}lds+s9-)`<9ytNWeoBiXyT>V5=0$snx18QOo_-c*N3Ix|ax$_fAC88J9
zXuy;Sp^OP|Yw|UP-c%AGq3eK>?r~@uH^&RhpWBk9)-%F%XuUZd%ww*XO~tIfPX8%(
zDp;7Nxq*sOiZR0U+flG$B-NNOAtS4()R;34HfV{c6inGW@SweP?u>JYZwj>BNsjaI
zb$P^i`gBb4EZpzQh2mcm-u#$fllXX~w(1Z5`||WgVW$a|<8i4KWO~zf6@TQQ`uzqG
zh38F@%$=sA_yuJ+J6mvlamldHFt2C0SD1IK$2q1W*>FNzhNF)#uVdL+gx8pNndW<l
z^an-zRAdUc7xWszUa3e;)<XU9rl}F8lp*t(gx&B}ny*m6<(ff^R=a+Mtq}!fto?07
z=jw)4q1NjxHKpo_@~ev4t(}&d@0d<*0{0iWnOWD?$f2sn@$d>`85C`Ahj6$xABi$M
zMDKIOW}CQRJe7Sp!&X>>e*RYzvoHY$gk)yMka)D|KxfTj0YSOui7%zTlLU#XAEZWx
zecyX%5T>^xFaL}DfKm65^A#?#^71Lek)Iy3B~b9ZiP$<0<VZ;ScO4Z##Y<H0?<Z1U
zAY)ID6ANG}tqpT;N<Kat*@<R8%&|y+i2nV2RT>qGr5wBgHvuhGtFEj_MrPfiv9KLo
zbEp&84!8Ri*<P7R_$N|VIvWc*mufEM&Xvuhw5!3ZcN!P9f+KpUcWzmp6@hs<I;LmF
zd!E?T_Tb$MU4td7QDUlI>00Rucjdw8f|C_SnZerBbBy?n^qMPzNF}<if{KI&V0E!V
z@mk+k;I-+fkj_IJ7X4=;;q?9ONCeBJd~`yOfuP3XVln9xL}WnN-YF5;g-DQm6FOm7
zF-3$_?Qt5`5{YQ72o7?3+Jw=3QT!?Q2&n8U)S>ha+7qkPl5vq46rhw!UuKz9Iz^_o
z(4)?VDb>sa+*7kXpc0V3Dd?v?`RG4M*86`D<<i+PkTQHUsF3<A7Mp&bqCWX!(v;0w
z&51vMG;zR($cXO$5KHB`Zi3#>JKu94;G~#FjY2C8qc7|^ph|O^J|8VpGK)lt3J^wZ
zIH`bQrKB>b_(d#b5n0=e>0S;?ZB<(tUYL&P0^~xT@`C>zwiRgnZk&b`Z8>gSiJ$Qz
z7TdJby}y4iHALeInZ`exIA92nFzModLk4gsI@tAqB4UY21c=9eL-sl$IWZ%O|0ZS*
z-l5>biD}_Zl^!(;`#>m6h9RX!;7BN@ej<M6@W2gD3^teEiOF;1-~7id96M|ii{JLu
zcs(T^OTZ@p3Iv*O7lq`D6Av^7%wOG~11vmhB>7>V^26$eX!QLQF%j&_l2JPm?$VPN
zqW`3VQ9tFc$bAO&_QZQ3c2I~y=GU*t9f$RJ2?9tc{)OY;Q5Jr^Fd8$Y0fIRGfn>kc
zfXb(D#*Z@ZROU^aU(BP(7y@dXD3$`j5HTdl6;6r~)u9nX>Ks8S;P1`Q@}+#eM&nV2
zeH?;|sMEkMUJ0kr+Ko}P6DS?TG3r|8Q{#DxO6!jGB&~m0PQ=#|V`HiQI2EK6Qu{O7
z*_F<6rxt8D%TPT^jnF)U0#wgpi{&%;b0$NG*##wnc$wbp(+DI5nJY6RIcZek_8lKq
zvtNM26|e|FFen-$kD`<=2mN%Hrm>mwn@6f^h$011i<|_oe|PtJ__~ul$mE&bU9c&e
zm592h;%Jb*?|CkU%#un-8YM>xXvhTl<TWn3rCN|)Wp?Gpj|Ax~z205mN+>?0*2czk
zgSm1}NO3qm9Aa*q{}5u<1G1=p5=E6rr1Bp6=E6Yc+26?X&1YB4T6ZXP>*Cad5VMy`
zcxRT#iEh6uKmCL6l4mE!V?pm1iY3@ItYhDhe=HR?^KACa9OJ9xy=~Gf<VevP&Gi}W
zB#6&xL5Z!t{?@R=mm1``@n38pPVlhK4pvxEhTESLb5ln}{>R|vt{TnCB+d`{XGd(J
z`FgC7+X;ydz|_Re(OWtynaOQ3i<Q=gD$uRJGVH}>>5%z#?^SjT%$f#?va5MJFG;SQ
z6Z~A2qhU>Q;TMhS&kI~{`0z<iwfM_hqu!8_tO%{HB~BM58m{D9#>uXnR$h{}@EgBM
zDhZOmN-i%;fY%qY8@>u2$uDQfE6I8v#H#ol<eo<wY1Za0?%#PQ37y-q)lr)lj9d`%
z2D4m~bHS03V%&l5_yI-Dm84IU_M2LXfgYY(e7W%|TGNfjVnfk~W$MI50gyj<QaOAC
zV9Y+jf?uAxU(BrqQOMwyB_PQQ`WHV4F@^xSZNc}Olx&xpAZPPidxejep(+!8zRhxn
z;=M9Vi0Z4aKO?@6kakznyAK%{3f1~ilOtM71QN<uzM_qUG$)`k2J%&ZY|j!22OnQ>
zA0CQ6D6YbJ?y<dUza_|hMWGj=5&>E>Lb~=;VcAGpEmM^;F1w}5HyHlRLlFB?P@DGl
zSJni(9wpW=iEy#A#XIje`>l|CV4hN<C?qLxcnsB>hqCi?#*4lPG!Jz;L33q#31!_l
z8ImM79h8<+gn|4>UY<N4b{;;aE-w1TD@4z0#}_s8*jGl8_3)cI%|*QLi)$NfCjaNZ
z7kC~k6WY+NtFv~LQIo-u8E0}t6YXZ8MQVhJ!eIf2jhNhU6gT9^^(9tXL3fH++JoIZ
z1YE#zkIfHMjib*f=YTTpMY2HG^RMLZg?+$3Opn0NCgHag1K-b?fr*~x$4{-3((5`L
z&|VtVU>yQ;A0AiKX?+yHDxj!BC8-uj_SR`2)dbZMe}y8(hvb8S-&&c8pz-R%ts87b
zJ~if>dMRbWUe9MRxw`ds`gsZxQCoUux{6vq`y4?xEp<-d!p(JNyDi?dHzQ{afr{O}
z_+;H$*|lfi6}9?i6h1$Bj1M=xPpG{JZFEzbg8J?kC$9oq^H}b<sq)lD>PtMk?7`N`
z(iCUki#@xV{C*=kR(Yx^U+336;70Y++}LmYD>{MU@|YCop^HhF1nx8P-=y@EH6`!y
zCp7iHaVee)${xwA8V8Sr`bpz1nw`4D$%p<Mb5{EbWotmewZR{h-oebWSk<i~Ox$5a
zoxKHq3SQ<<<A<Vk`(LhR<qGwQjcjo*XZU5Sq>H*3mi40Cv-r-4Ua5C|>NOWxn}6d?
z+DePT?V(aj)J#^sF_#OnpJblw<c`oW38GNzd6{GJaj!gDm7={?>y2xbsm5n*#VAdp
zFe`Cm|M3s)>$K_ORd@7DRss|oE~_~Xt7|sO=so$bP#*yNnKMXzi*?GtWS5_0>xpO-
z_l3F-VQ&hYGx``av?nL+!88M@6#41?2>tOyH-I(6ow_%L4kG#<4$pM)$w@n5A9UWn
zs2Y^bMYNPJRPhqQfJGhDpE!{^*f<Emkeg|Wdaq@{t$2mfIs0Wd>BOa*<51_U87>aF
zl6dnGxWbjV@MxAy%9T8%-iW-vfMfP7tC=nLyukZ`tP+b=cOng!tQ7`_T4j;D<H%)o
zc}cWcpV#R>d$h^-o%yJ5K2?iaGe%2OVz_bVsP^4ik%R9ZLk19?WQI>Hd?$L>uKB6R
zHN?>`_R9E^60h$1f<jJFMiN+r#wpG#IqaWzFjXlPo)5V27Fv8cft2E-Za9u5=05L_
z3}I3pi|-?eW^##?v!qgrum<|etX37~%DvHhR4G^ymi;kS%?>}jkI}FGHuDKhE2rAQ
zj9Pw-PnhTq)QOmhth(CFDa|eS`s5~eN7yiRAJjn`M4R^gHz*4|Fh@*7IG57#8nSkz
zCTa_Vb)zivva|xu^Ei>^=X(9azsGSWeUVowbO!4<h}w688+10G;JiWurC$#QcE7}~
zf~h68y<>1>?NUSq_=_Mt<GzW%??7_eyXgcvbBs{BU-C&x%k;f`8Fp6a`3gXYk3tt{
zJb=H@6MFDN>3Y&MZ4ulRQViTebpMx)_m|uaM*e;EoR^(0#b>;2`s?e;;AY<vBO7_}
zgQg14+YUTq5NCEbG+_a?pJQ~`xlb*pr`G-Y7oO;W02(@cj*daJ>n-97REV<B^zC0H
zWi%dBBchFFb7ur%6j92EK0R9X!Q(KdJPGllQR74+_9Y2bj{Ysb*ceOxs8In{Mz?es
z0_JRt9YctsgjU`|3ijdQyi2~g(Fadu&Fp={FuR@3mjuel1d53eZbCl+<VmE5^J3Rg
z2w<II98xdJ0UVy}z&VH)1U?jGcATmx^*QStW98+BFad}qW3@mdA-E<LwV{Yzk1S)i
zD*X)!oc>>SY~Rqtv^REA!aj=Rw^SapLBQg1{JbE7L7VBfIMjk(sWCxDEXEA9MwdpC
zdw)(SfnP96RBic&3wC=kc=cRJc{kMURA<<M2BMBB?zd16AdSWeV_SL>B;KmB3w*@y
zHKc`uk1xH}Rs))ymNH`xB<YMKSN=AiC3R7GN!ykW(>J$h!BF|!GIhJ-bPx5e&qR*J
zGqthD>hAA2@64A6`+x96R0o8$B<UM{F(eVb5puR++?-VhK=8ZMg5|&A>r75-i1$6f
z+>{@o2S!x4vgJY>y6=Nuc>9bRZL!gRq2~WEpx9e>y>aey7fT0FwJB;;8STBLm5>T)
z^TGnc*_2u=^imITo?YX_PE)7VNbx=GnX!LDf;}+3t6socCx|zuu_c_@a)`2W_7EQ2
zQ(C!h$(o->HJMmuMH%`XOvcJmt+9rDOyS5)$4eKZWiUHcQuEj7#b$T2nr)A+rNck2
z-n>Q^WnRbsP6=DC(QKXjn1Vcu9bZyJGw-np1&oaoVRvoOd(AHTgu<&$0Tw`AmHL0{
zF-K`VIE2Mrzd}*46)_Gw*c^?udY5w%DA|kJLs5xiph}o&KPOL;JEl&EZu|<ehDI1-
zP+b?wvd;gtk2=rqSLiJB(E`ymqv&4G<>%{3`~XC<+$kNM@bIK`o*3dtu3ks2>7u##
z0!32a?*@7i#L+~$xANp>$dxaA0ZzP!kOPk^E8hpynKp3WiIXoY*Eh$Y2xl)sU24sx
zjA~K>oLV@$1Kj4T%)*A7l`dv#uVAc19(AhDruEwrg`dT!%s|OCMZa|7hWnU7Lklgj
zM(}<OTbl}0pDVs{1n-IBzQ)88t4T|{H(pA6RY^r+ei>QV)@c;7hOKR*bN28UGBDCL
zgE+sDsqTZGCPc-B8hc(drDt0}j62*QBpxDXczz;HKug{hnbsyCg7M%9PCr=hmA)h8
z({iYfIpv;lK1Dmh@0(Z9=Z#tbg<zBtl6?nUXyYwO^hB2_Tj#gqK|4%_k?>^-VwyuU
ze)M^^^V3IYf;mG1on`S|;Qjvhv+u|CkBj2n_j@|IRr{Day2s~E(Czc!?9wmD=4Vy*
zX}9+Qary1ylv*@@FgPlaCA9NOq87wkJbNIlOu`Y>=&?5n=w%k`i#Y5XG(fhJV(ed-
zk?wbZQFAzjY@zbcJ?VzLIXYk_-9O+GQS;sNXY^smyJ9U*u4e`@u8z#m0Qu{^f}LVE
zIi`G|24t27Du5JEpa)Fk1uv54TI*|sCnn&h#m8iwqlZ>+^sb_qnqOXKu0O7-Re{+Q
z9d44YKC2yml4dm;<@`6`o&sv@)K?Z0Qpc8$d$LhEVGIhOE!LkVLt|wg;*YutupVC|
z8Ft}>z1}}=#-AF${b{>yq&~kJrAt<b-x}bZ=8L=ZYNa%Oiqd`ALL5`!;-YRRMou`L
z7)Z-6RcCUB)&vw7PA9SumDgE~7>SL&a}?ZqK_w<*x}qKb!Yc#<{A>x0$+Pg|W8d`r
z4VeG!;gXr2)LCM%{wQch{45UjhHGIfq*&`&#9X<T@zB(C0ZfPB0knoknL03cS3|Rc
zVp}php=#vcuwUKRSyW|tYjqwBBS(%N3@>M(Bpq!S%rvQB%Wgy4T|h@@;pyImy?83s
zFK_3utsnyfkEWy0+EyVclQFSm5Ord9&qDUA$X}PSS@m;l$m9jqMv&&;KOPzxDHA|+
zICvr%@~`y;rrLbYXc?0AMeS1tNTkRp5jvs7h8%Z*F=kZ+jTE7JeqBhop+`zd(SBKc
zpR%zxZ?jIwh<SA~;gwDZg|>80=NVH+TdETGTX4Ze$iysWWNQ;`0nKL1Qr%CM3HawI
zwYc|4wezGP`kXbS@&LE-GIR6>W{bN3ZT`r83o@i#?v8$vW@>hRw=mlU)($G+Hd+wW
zz(ss8q+4gr%%FKtZ<A=zJUh|DUH8{MUjij0AuvX=4F3vHae3Y#Vj5KDD8%b7i<F}7
z3m`^*BHkQ@Od5#8;bMk6dByj0*jMn15d(+F4DBro{tii)!VRy%6V~uaeIytI1R;{L
z(+Co1s8(|<<<FfcgPjAh6I?DrIKJ?N_0~TUC=-J>8ezh6z0EBKq)@Fo&7(#e8ymD1
ze6&3c#Tz|xS%iObC=v{^B>TckauIzg(=aQ@UH<IV{<vs!<B;LiA9hjID>(1^APp&c
zJ$?fUBR3gw7-D!K?Eex7|L)DQ-sJh-4kxqwUxEje7B7N0rA|DH<4MFPk{*t26sAPd
zd-P|xiSE7ryu`N$$G=aY-iH~5K=3^fb5&E;iRHW43)S(3{MCCS%Y}I6>7fW?af|}F
z3;NBWto$+Idv1|d?3W$SYZq{%k?Pv~=G<``-50&Hkd{Ss5KhOSFEDe)-D^ShF(Dr#
zph~UXYAAru>QclF!SAuIXY#0clHiy$b5wkl7dJGqI9IgS+!w3TK~q@XZ_)@Mz+Ggo
z+_C&X{5TOO%5D>e>~M#xMsnmen3pfM*scc3{gd$^HMnWtvKmP=WM*rS?-EVti&gJ2
zo6m$#7Sl_~NIc{=8dHq%j@x1QsBJ|ga1c~)d~}ZTClDRZCNjylO2%J>$m-6Mux=0T
z-+zl)8Jj}_2Z>bT6Py_r+L>~zec_4Xjm@}|%%$?@=f#~}&^g9cV{hPE$q#JP`>nL$
z7-in7G{NfnTVO951Zd>G<|WYT{`rR881JCDl{)q{JENF571r<$Ye%AHlSU0Ig^O(A
zL^L&wxn5@9X?o&EvA4M&%LSRrd*<Q!5$~7365>P2|NTgsgm(q+Md3B^`E$1q#H`Ur
z>R#4EBE8J5=Bh=VF5R1UplG#P6iJiE8BH`^w_B-($4mbMU9){l%VIou93-IXijfj1
z;Q(P5`jbEXGun9uCTC?AXYoems?}m$=|Fn5LIVmixXhnr;AJR3agUX0U;ysalqwS>
zs&bm^S{uZ{NGyVKV>)k=yTP5|Y0A|6<$87#{WV4HOmm!FJ{bG<KAM6N#pr0L%c<|D
z`QqJMhPUeP7dcR>ZA3};6I|J%s5hX{_|`=JAY+6VLo`Kzdp$K6968-g9VRCbjdeb4
zlYGNgo4v{J;b6>;QR+|PR-$S0(Y!%!HiUj*DPz+r`GA&Od)D5*fN5>i8!IYq-#SbX
zPL%Ld<9X_}(*$gA?P}HX8SXn3|GncVoxJ5)Bao{@$AiTCF)L^@R%eN{Rwl@5bb6R5
z(=KQ^mHCbzy_NaaK_5)7j0Mi%J=tapx_=&aNQjCMdOcmlVPOXanz6D_DAK=irEC>v
zk*!`W#RCQqFc>_nF8jE;->VTYf9^FH<h&du=0HO)itMR;yGeGCz@m+;hoBrqUX9#i
zb&Th^hqUY}*?Dc&nl1>WH%dz4)YM(=(#BjJtKFodv<_7-TU($?;FVCyusMsWK<H_+
zpzsDkrHaasr|C;8ZEnESKkYLcxb>R((@aUokO8Nn%aow1$dcqpz-axCyRSsO+dwcq
z@E<5fyDVOddTH=={J^ABoLE>8Gi-c961NH2-z>zv?hQ>-EEo_kFW{OL0<!nUAY(D9
z^+#!qCj=QykLDJ~!wn`xsoCwt@?|MxO{w_?lZ;x@M$>&wVor+-VP}8K|LQJ2jg49#
zS+C#zq{kS;`RQOCDcJDPt}sX4`#LD2`zfUk%{E@&70aQ3(Nd31G`DK*-P)h>*?GaJ
z7ED$IK@9%J_TJsV2&TLh+BuxLy(Ph}+KGyeA!LK<1ns!8<O9QBN0cmb{2u_nKtR7J
zG6JK2Ou{6Zz^_9N$>E2{PZM-}4Dsj3$57<>n4~G8mlFVtI6htt@ACUYKB>wsCpDLi
z)V&|jO&X)tTB41|)RH~L@;r(i!)92s4G9xNrkD~cn?#Zo<{JAxrs}T8w7b2%3T^Y(
zv$r`Q4LG{gz&ru{sDAECIGcn8!gE7FGG$;kJoPRXf64;svygaT*nl%+gkJI(xDxB8
zCGHFf@{E=XxGkGfF*YZ$E7C<~$snN*nEfpWXbFmXdFsq}5f$G0qB3-FTd6uB!7>^J
zZ>9<ikQdns9Dr9I)(5-Pr<lTFdM#mQrm-KU1>nNMgiAz*tiy!_PWfw+=W1&JmdRH$
zLxO18U4|{voT_wT5F8yIopV{E3T~n7X%L_J%k?IXCO<_J;)jd<i|<H$Y{qA4*MGj@
zn^rxeV}ab8QEvm3N=a31kSH<$iUN>gW7u)-#j(zo%OiygWzXhd;i{(xEO^0#=h>w`
zLHdHt7vdKF7+au8bV88mh#IjaQbc=ni1p%aHx!7ikRQ6CJ#_a0Xl=Fch~%(QFVGdS
zp#w@oH)Mvb&=|HyVA!B=`F#g!?2f3g6^g<Fa>BzQ$z7JV6P80;{DzeydOFIIokXyl
zUB8<8kkH+qK44Kyk*H+2u8MU@(Xr+z4z>-6Vb7Cf#nW9y)zrOfOq4y!Vx0h&yF)Fv
zv$3{Co!%$t^dkgQ&Lx&o8_8b=V0eY`?R7vBu2%xvRbCn{jFu1p0tq>5n?_+01->wb
zU9mh%2SlZC>{mjsL^#XsG$4N1B&CB2t0u{lBoF3?V3<}~HZP(Ov_1wA5v2NhdKeBt
zJIalZRLs9NeW0!6xd?*YfY<!iD<*LbFEA(v{3}>b8ik%8Pta%LG4!(3!J#7#sE8(!
z%Z7l2%R*RCmrsHOK^9;F<0&JDgw8OHrbTZanfL*S$PNplo98<-aSOVzjhPh+*AvO6
z2BVOFfMJag8#}JWuqC^)Ol^fZuJ#RFPY!Vl{PB;a`gq~^RI(ch3I|-`X+Y)>x3z-e
zio7(9RNsxl0f3wVHZnmxIY*JOhKT?$!IDFdnVLC4UO>j<jLPa-=45krq^{(XFPjj}
zFBt)Ls~tfxTXIZU^RUY-4Qsk7W1AQf#78Th>bR2ax`!ty^+34{I)xQ&&U_@&7*(?!
zE!jI7(i;8SinK->6`5o_Uci8^DmAOAkk+UyYvn%1<9F<u1p;sy{Q=ZHIf4mF{K+if
z>WK`@x~cSMMn6s=XRaS`#ZWD|(O=mdodQEiNqY2wr8iN0RY3P52tvZ3N@`ZSWdkj>
zQzRaLosipVVx?oAZRxLUzF0P!Zi!>uG3z{EbDq4iQWoMJOZ6G-MzzaHwVmNmq`6vE
zwmOaBuvDLldHgf-Lv-bb?kTV$(G1{4pp9Wo>AEtlQ}g6Wz!J)imOhS<w4ksnXG{{>
zCap@__^Ph@xqWHr_7Xd_tg(X!pk>ngZPMNElB>S0cXd6d=MrtScDLRxe`gD~n%{O+
z10BGvW(#G&mMVem6$9<n107k6-0@$!k13#boMYy4p-Zkrh>EFXt5}mI9TQoXFjXX3
zmI+mCS$TXsHNxm+b|qFp=#Gy+L@Aex@}L-~JB~OH!=c|8N&H~W-D1a~pMWq0(j9jR
zyt!;6F9L^>U&pyzSUQYMSb7<O#LR`*S;D{<BL${EA)yN<EEZn-aTE&iE{&ir0Hm=j
zg-PfNtai?|H&h2-&@c+3F^F?P6kYN0U4_w2h^AaU3y);(2tsNzMNkcjjd_9(0$p;~
z5F*n15K39XWnqwBVJITIQJBUNB*64ylBDsBf~RMe)~J(2)5LFj8P49qk|qZeGZyKl
zo5Ue2OfnVC!o(#Sq))T4ZBvRZMPrVkQ_nN)UgFrd#KGm<CFiW_Q8>w{G=VcG1lO!!
zI7YLOpAS3>{eR7XpXDv>L5!(NC&dl*UR(kEqIi~#`q@2_W1it>dz50bPR~f3FgKt2
zDWE$h>?_>lM~e%S@$Zvs%x<R@O`7<OPU~$w&t<{N0@f=)s-kCbXXaO_ABE3G&wl;%
zuKI^uYFL>@qa?9nAZa8ZIF4!`hNJr~k!5?rolQ_xK=UD+8W+yc|0uI#)u&yr&V@Mm
z<7&xG)axP(Hdfu#L6!!jDjjBS8H*BOeLf_i)eY-~#C92cABm8-a4&Qh5o6}Imk>vX
zn@IgS>pqW&-$uQ#`vint`_T%!%%P6qDK?fAhhfciCG42Cf~jlUiltM<eq08mgey2J
zwpWPt6wD!)c0ZRM&9!iYBx8Qt+CWK?GsVEbM6;==2=nE3p=?}7FI`dQr|2exWQ_oU
z_!mO201tbFJ{185z+X<HG?yq*8b|*m;Rt;e;RwS$7?Bn<Vd}<+=q0PA{%DVhZm5<=
zbs0;RDq+nqb!?fghAqXDRM(SD$MGKUF*%Q>!bX0@TqGQvEAru*<MLCkr2y$N&Lto;
zi6DTr%po8mGczfYJMtGcP&g2KI|a+`3l)sfdvQV#Mz5pk{Lvm1S7E9xsSeg`updh<
z!9-I{thxqK99fZ>vda7F!M`WK=Tu)2uCZBoMRGrYHjhZ{<tT6o@{<FkRe6>CP^ddW
z_gH$n+$*Ag?6hxC$zcxlux+Up)>J^5cT|E^$#o2B+nQp1177Me`A#(IFM*A!IFA)C
zQl|M{aIb-bQ3?3uD#}%E6NgeGHale$noQoB_*#Es5tRE%!uip~Ks=E=WqA2Y@?Z0Z
zlK)b^mEzZi=aPTOUd)TZ@Sb>V)Rl*SWpm-E(Xc9Y)s(2`vM!zq>QnPnnED6RK~dNw
z_A$L=F?U+#NPpkhaNprwYL8v_V4osF9oy1X30q7h@D!=o(G(9`o@;85Ini_0M|nJ@
zr>NoK@x%OSsy;!^99@%G<N&X`FT-__KT_Z(Ombn0Cm1NCp5}K8R%`KHy1Qqo>MIEC
ztq+o3`E)&<my5T=pP|#Li($i}tmuB#Q<x8;>|o{iJ3f^QIPcFICH!ZA*4{jgFV8?@
zP>h9_Y#bRB717$fOv@bIPu8QbB@X)*2<%&6ueY_TG~unc_Z-{?r+a&Z?rNlCZii~w
z=?0u^Ric+|GfcOg=C;Y$w@AdkT@v=460q-{eEs)tj(@!6nK+N8<t5%9ja_%4KN{cm
zXlyRj1`d88lI6C<yWdO+1IR$y@fGAI;x|4ExRlh$va~`i;O)E|k7FkCiix=0uvM-H
z;X%+93O$#p_^kaF$_`!$q8zzfei0Gdvf?Ep>4Z$r%I9(%GZubgZ5selC%KFQH~A&z
zGU=BVX!UK5|G=kF*nRa5Hk_1<&qb!7L3`496NTyL{O#NTZqRltTd8htU*7u3>a%eF
zlsJ9x1;Xg@n-OhCGpKE1Tc+TaVrZC9VqjHP3_>-VN*l5(JSF|rPNozg;B&-*MFUE1
zTU={1@slu0*<_l|k19<KD~h2f7lvB;VV5fc1DFPWT3saQd2}%lj>+>Wi@YP@9X;H*
zz*&jH;rOp?o<mCHR_G0$*^7liYboo6nrMZF2+CLVLLviTuhn_{TAimUxoW*q2b4N@
zqK~<!Lg!9QcIEPKB`eIcimguefZy(42YXt$2V&Ii<pG3|`e+3K$0nMiY997<%>zMz
zVaHJ<Y{|BwyOO8t+G=!t-p}ffD>VR57mGd56mk!+*w>X^LXq4axLvVymDnm~GURS!
z8o`$2Y1mX%OP7f3sw)M}9xbr=>CplYgBHlWi*p=#lmp3+s@M&A#P*!a#u+&H+ZwO{
zdRxi4@$Df6-F*B(HvVL^BIJB2(wvt~#GLA23Dwjf3oid%;R;FN0n`q2@J$rwV|shW
z9j-a!#R2o@(G0l}3ZoSM#{n2ba9;tX42L94e5gjFFwCYe*i#Oc7^5+ZutQ)C;#t6w
z?-Asq^}yYARggZSAfRPB9l(5uSq^BpH%vl@@EGS3@1Y>bk_-jiwM2ZN4ly)Ibum*M
z8EYQ1F!6K+>n78wLWsrm#}{+9bP7bIz~3@u0c<5uQG$-9EUqIb466}ib)=6P<u~{9
z0{!<Hi3#|mFd(uw#0R*`qnLqehq*#y7{&a5qgjeR@XUw@!U|cs%({Vv*t)|^PqVNl
zF$Zh1u3=ktEv!hMDXFTbc%I(tg%1H1vb1sE66<4yBjU5n5ApG0fs|#>VKbKi+H#M>
zQRR?}zxm$LQUV%Sva;N>;V8Qd*4Geao;?BJ#FcBDp<^_EA4!YLpA|3v#)}kdoqZO+
zk9zdQ?R+I49k50-b!`X1c<106CG8&`SmS`x5NGtj7$+?hw%=Iq+M{5$4Iz5GFqn=)
zWt-_1R%AuRnk_*d4OPZeaun5~x}~sHDGeX4l-8tJ=_shZZz-tdkwlvn6wRXl;b7w%
zwM(7EG*6|9Vap6_o~i(Zs*P=3(Xd5i*_3UjX-Y4q9YjnksH!ElW1EESJ*?xygLUjt
z8GBU5KG3d(@VH;b*)V#Cg*JS%^=R2<Pm-uinS`0HGpuP;!j|JnSR<ZcD3mhK>fx;S
z;<<b<R%ex~bB{;;Kp2;{Ved_X4)<<efJv^D+$xU!$>GgB29M`0RIrc5?O9egKZp5G
zAF+EMgW2!Id3w*jzngPl_P)OeBjwSu(z-2KmPBkUQ_sYjMi_Q9mtn;-bcdRf<mm3B
z(?APPs<&s?8v2DrHE)ZW5*j#R;qL~%XuumUILH+)YS$VfLTv?kc9SHcJ}LZu7WC2u
zoM`D3H$o(c!m%h0y;fTUm$h+Brk6fNG>T%^hr~+>Iszw)bmp=Vg3A1#A|_Dy%FSW4
z{NeMX@HzSm3#LUD);YTL$Co(vlPeUnF<%&{nMAXg0)%Q5mw>_<qSnOcd3vF-gQ>-<
z+tD$_k?oq611XL?-NKr~7$%O#z~RkvWabdLSBLLMCM-_`C;fs<kIG{;Tr1<P2kETD
zVpbY_0^Uaz8LXUmZDhZ&=xyjl=oGGmuW-7*g4@qmfBH4sgykj6s=mwaimE`DHTOKf
zM}{NxF26_`%N4gwUC1l@92NakngXX>9yE0yFv(H@2eJGv;LNT2F9MVU9q~0BJY4y3
zLZ*k24ngLBHQ%>n=%;M*SH@%T+mcIVJRh?-73G^bgR~&g4(rqoU}eiS>bgQ3*Jra_
z1Ju`%tb&NbEd!H#M^d;wT7_?B)r61@m9yKbUFGby$~qPQZr5vex$&CCFKw#A9amYJ
z4m-)KE&w8Zo=sZLwC-a!C@<}H_1Tz(piPW@+HusP>XzdMl7GDwmQxtHjMprns5+e)
z?q;^#pesO95UVuU!-?Co+^_cunA^FYJzBZnqK;-TDq%tu0vTat?06Qzl4I$X?#dqX
zXdmQpNO1{dlgh6RGJ7vk?cxNqgRsO+Pw~7-2FkW+xJG!(YS(3??2lmQ%4w&9*(_eB
zx=F2}U~XT_|GO6w)%}!y9)oqPzW-0oLe`@__rO3aMe1Gz?M2XD1Z^XNW+=m3V-m+~
zy#Y}C^b+j-%&IIub`)F3Ad;%<1S^i^Va*~swwOz?Zh4w#dX{WSqzA9s8+cX5lj6c~
z0)C)4k7>{GFt{<r562uM=c&M4DTb|3M`zelbc!{d%GhyLf+gE<be&nQX{>@#>tU{n
zpC0DwP%u~Li#gMT4hletg?8$Wu&b89rAX2lU&@Op;6RN5gCgBH&vqD8FQ-#Tt9{AP
zXRvytXd1JGr7-mwgrcIU@F)N*4M6mck`y=eTOd-2O9@Q@qdWm`CRhxga{u~FJ?KUg
z;)hAz<T(pTn4*_K5Z#=-3L<)i-uX#-IMgX15s{i)sKz!b9r8z*>W*p>4VyC4utpRQ
zJCZ}Nqq?qTs;a8m^5gO%TPCuGWbGX9TdL%2&*;1G6yt{^W|aBYJiT<yPb^PkUBym2
z=LlqixF%$d9EM2BeYseSxHlK~;<}7xfeRm}u^+{L>gSkmg-;iqJ1j0JnLz6tMJ<hq
zANt|=IXch&mA6Jkc<d!B(`09kVX*w!83Px8|6eoVJ2w|lX}8k|x=*7KFB3Da;-(Ba
zEP+D>CocCno5s;(3fb&qHjQFn3lItCD48YG?4%S~zWLfs;37oMd`c32CyD74;V7a%
zkrk5pfN$qSxBJi6-3H2Gg~MBU;yQV|QO7cgq!^gEk_x;A#g=7)%bR9Mnk~6D>4U%P
z=9`7n)jb_{cAoWB=NTO}JB6)FJGwUU=M(UG<9IyF$vsEe#*|-jBZ==Ft;u-7yIGU}
zGn?%z;(k4k39t`e&sa=Zn36I3nk_sx`?%4}3D^-&=XA6@nv=4~!W4$+SeB#_Qie63
z#pNdca4Ickg;*-I7);eN8)$=tX{l+EU=$8U4)DfPPShs@g<cUCWs8Nr<Av5QUvHGk
zuj<|?RX$t2QR-2pAia}-tHWjwtz3m$nOdc`mHO?z`|YkhYFll$_N^`J9jxjTt|x6v
zkRq@WT!W=YoYAMhB8#6s>3A1v*6$-V_b>j=<lHgJ<gqZYJvsMYRja+KzP(<w#}`=8
z1{YeL<k9+UFw^sxXDHaS0KZGNENl_S#;z?9of?KgRp|kni(nUJDbEx1Q)bhvDV!^o
zq@zse9IiGXEm#LjFoI3E0!vZ<pa6|S5)^^{V6{YE%>FfFA=q6Ou?tEQWwsibnWi)=
z<>&xW=%*3SvI83Ey@Cbo*W8ksHajLoQB_;ABoiyTqX4`B!M34U*tVFZ$S$!M{RT+Q
zPa#=$#n4g<ojFso1CWQsK)iuCT*K$+r7*6;Z6z`XmdUHQ-LuIA1a#^U7i^wf5il)u
z*}M+78`h3qZ^>zG$tf}AMrapf&f-=-4m(cmY2Y@M#d-E-oIbXwk1gtxj<0xvdoxbK
z@bqS!r)#zA%{aBy>CHI%zam>}T|qmauwNj#w@{dPBuF*_dOpM>SMs$_PJ4bYO`E+j
zsQl?|n_bAcHwHaUzNoit?q~V?+xdQ@p?3jc>}{KO6M?>LddW><kJr9Qh^CvWh85RS
zuts!-9aVR*tk^n}B!FJ?`k3^6$E2S})0bI99z;~(^Juy;it%wppleLBC5bqgnGl9a
zJsI07L}fC|a41nE(^B>xfxdcBt&EYS<s239Ol8iXx0w+yk3Gg17a_<galoW<?Yk@~
zt$lu&Mw#I-3l&7i$EDfv__$p_v9R{=xZbQ4m<{nmu&<-z<6^AB{C#}P?VJ$GoF?e_
zSPURrfaBv4IzImO)4K%z6~*ZIn1_yDPQc6K_;__Z@0uOo!f$3U&C%J4bm+ucOPV{K
zX?2$~o!RXb?e5R+*2mFfmf{+Qjy+;SnqI14+aWeKnZk(U*hJEteIG}4*W=jTE1>ER
z@Yl1qnN4`Ul#v-t^D|TN0^r7Zh$&`)a9)|R*oS;z+--osuUPyEoyTDF6}jV)#~3&G
zi{M^AfT&~=UqQ~vcByoym*^B#GZeH6$t+4O+pYPHa4{%4;IYP#!|k%Dl*6Qy87_ED
zX#KWQb9yPJ%Hby|2}pdz8<~(RhO_zSC34(Jmw99sfMs0*41^-~5+x~{ij^o0(7f`n
zKGLNw#rO}?>nzODtsG5bKg`fEm*%^Kt~ngR)4+W<iul(o$njz@LLXxon>;FpnJwgS
z)S)X^^wk{ex-b9{xP6|*)R#k0_A-PeFPDYh>&$f7yV|k$e4{rlcSgNDl%GdR-Ijf7
zWuGNAE#wG<l4LPKU>0VY^^>)-o?Y6U@2@MC>Fy||TjQ5D1c~|qTPqsz5^bd-k@Dho
zTeq-=1buC=M{D~1wb|I#OHhM=dFj@JZDo?E4^?Sbx`Pd(b?{ZyNZ|m>w5#0R(Tvc+
ze9+C7wv`QS``mt;pz(L0#)JWvP2&01B)RcATOvtCemEq#%hE0iy&H;)OMgISX|!fk
zzi%T*b#N|z>{1u!(9zY@2PhDK`haCG-DQp^ITqGbOT(I_JJ=$o2LM&X)osO;tyQp)
zJs4l{(}VHt4#xNW#o)&V%@%(dM(EwU_b7W^5a(DEKN+Ey83UP#nTbHo62G9=0Rix^
zZvfUO1grx>^?`I>6VFi!%L4PwS0D>7DF?yV3_Ap3Px6=)Qmh<DArn=oSf}TkaQ;5A
zYoFb4Ed;d8tBLs(3XAlTO<3|hVj(Op`b<2A-udB`h#~MNfaw>7LZ+X_Q8rXDnle_V
z0cMTk6+-YsH1RpsUjS)EIiT9!Q2sJin%K<GVrVjY#j*d|!i_PVX_oC_YN-y^9BN^k
z87g)p%k><cd8+I^;D9Z$Gz(`FNG3l;$H)8}iQ|IYJVcAEB4E&ci375Hgt{FU4*3T-
zdIZr+5~sP8F3<xR5?nv@R{-PXxPj1+=w2L%WdCVfMe{=P|4Wx}DowGOr@0C?WMX4Y
zawTkQl7|&VR$P}dMWO4t&!-(uwM10{o6(=J=CCT4_`#g(MWGK+@W3?)nm=Af^vG^$
zFaukPD-=DT@XLTm>)3H3a7sjKWw%NJK!=iflCsHj^odQPYhgjT7@VA344^GiK&tZ2
zV7=ODYsq+wPSJ#<EcSVF=A#vWdXEYxZ-c6Nu|fXlN@QuNr*-BP-RvoH{IJ?9to%?Y
zW@AuvRmwufq*7A|yHM?LQf+5A<kYgVY;~r?VW}Y&v-oG^hv>==-BVBjMYEK}2-+Cd
z^vZSJVPy(UQzrpSC_7sCG(ysXUb37mNobE=w^A_)j}U)@TC5Q-*EO#!zjEF!B&ytN
z5R~X5m%|q*qqQ?L=kjwM33o2umxt7@x~?9dVS^52OCP2RpYv#)mK@2IO^H#gsxrkI
zaV2a~W?)6POi80uS2g{y@%RWYiQ09x|3j1_5(GI1EdZ@a;&X&*8jVB$-#{W9p_@ye
zULrq1H<xXM;2H3Bg^XJ;a%jTR%LwFOKLlnBn3iilPC@EONazCd#lmYpjzaD`0xz!1
zQV=~E0tXY$)p%e*%CW*1t8<9%D2T?u-UU%~#fNqkMmHgvawRmpk;#l+f^bjrX(n9o
zg=$c2%z$+y&?R?hA-qpSC}jzk?Sa9Bp=1E~fW{4(En||T@r<T3fo0xRq*`WsJzyq5
zvaYKO4kqfnbgwfy=_>E&nrSczONK$PrZ9$y=h#?xi9-!pAu6?cd1t@!4)Ash6>HRg
zQozK|a(Mi#U^qszkRJ&=<8byu6Vy&rnfM`alvN9R-OXer|6DdfZd*4|XRCXGsS2+1
zUfiZlQd5Hru>wweQOX;kpUzLGBu>~@cwdedd&^VFf<*?dWrvKv&cZ37S4TgcFXfH>
zaxr)VS7&yMbJ6rS0fX*)LU!T9f3{HS8NXV^_dhfhfD8(=RFoZ#pr2nqz1!SPz0h(m
z_3yP#c9b%qcy@NO!tlEBzl!6K|8>8T<EjnFq{qh3BWd-Dmi3mtj(W*+yJWuL)%U0*
z&pK&z7d#_=g4&Coqr**Q;dFGLOCF%x%g}r99k};0bcKO_+~Tz17>cTy1Us^!V9jO*
zwrrVV$uw+}c#7h>_Tv$!6NI@bd(j|Um!@0F#qUTso`H<{@@>V41)Rt$upEQ^l(T5)
zbu@v5QD9m<diC>b@JG(ZlS{vo$Yp@^7DFnmXbc>kf6an93K)sG0aj?ZFQXX<$Xud~
z842)B6bBUpFbKwzDJTHAP)mY27dSvQP}tonhGUXs5(9cOi_=RMPokKOkPj9Y8pYEn
z<|g<;YJE@Wr5`f%E*}+i^MRzZm;~i=oW)TtUmtyVcQ&l0+lpY^?g*v{g@o;S#>1ad
zZqu(uq;N^;hRhK`m$L~8v;E5QX^qgFdxe8opSj~@lC}`J_!^{$pa49d5lATPIr_o}
zk6@<19bKmBG<k7y0wV-n0QeftpHK4re@>&xi4#QQlj2WqMiE{VN1Ps1L$8;>c@gYI
zF&2feYUl|LvK7L_=im6+V-{YLkow^m^SR?JJ=lq+$&#iS!@c8D>YZUJ1!Y%#Kssp^
zsG@3y<j9ywijFnUpx9Ad9jl&cQHk2b`xc;--};WJy1_siI?i`&chgK~F(jwM&dd)|
z^p2BraopaEyW{BHyZ1w&cTVSU(6XR2^ztp9MmO9eKJ$j*+O8lV4jgc94b4*0Jx3pB
zF-oFf#{V2fH;9Xn3Cd{~8m=5y?pKndwq}V2A%9(VySn9Vla$Iy&>V=1B$+biqW}7j
z|Anp?13a1vkZYz`iDoIB>UlKF^5XGk$Nn|9l;)}QqA3$oNzl>fkFVj*Arny3h3p0e
zU^^9YK0NwP1m6)COyLj#RNhbD;(GAMp`S7wGnaYXxu$;Z=NME;I0z;QP9qE}8Zb<7
z$Zjx;364Ar(6=X=Dk+*G->>UI&^#ykZdZitnu<yl1M8CPfit9zZB>=At((L#3DYI{
z8?Ye{#nFO8&w}!iOeQ=`Cimm1qbrMjapsLIPm{KB4zFnoU!VKyp;6U8J~4lbXM8?F
z6}F^W%%Xxpzt}_!%T5}ZOGe!VLEyC@mvwPK*o>pqH4bWD(NH_aM6FT-B`Im60fJ&3
z6+m3-eK{V-Y+UsAAqrbeGS_5u>#)2T2k>|&mr>xh^gkGYNW-IxqnM33u5rtXWlz7v
z{BdZd;A*WG;$cF-EC{vEj~x)#ijn;-*FH!cYR8Nx<_?7(I?tB1Ul^e6*5HTJhp`B4
zif!~wX}6dIpGIN#!?HxW`x;J4#^>x77>_}#!_IGtH&K{=&V$@|NK%Kc&Z2}z5OJT2
zC{3fu;2XRBbYMj5%Dbwd+Ai4g4zzdeUd2{`E1eX6mO)fWraD#}Dq&4E2(~SSV#|;n
z#+XTMvI_0t33A$-P5i6!Lu4{=rjW|CZ<%j%3(p&%;eu87lZrC01{#wr$m7sgW6y=7
zO*QJIR7-HxV|vL#;bh>4;3)%M%p3-T`mnyqJ@(A*`Tk1iRbAzTKsxwJ!uip~pioQ$
zjRb)|W+7!4gVDtR?n^>b1R{qM_z4I7;a`67y%bRr18@X@fLup@R_Bb&<0uHkzu&$^
zV*)y4KOFPFoRj40VzA^%Q1$h07;P_bbQd_L{z1*o^Ov`NYeRF6>Dj`IxRuZX6v93N
zU2({2(Bn!Ei4Uo2#Lj&7Xzhruu9=RhO4yT44QrlhVav8HEGeF%X}YRP8hhZm(sI;3
zB=B@Hz1n##iW3PZrD0voUnEP5i==r=8O_oRo=5NwB6zj1>j@47Jd2{)RFr9a$I%gc
zK7Kwz{LX$&Vt0hH3wwmJ+j_W^Y;DG;LsE3<k1tt_Vm}eywpFttp;rY9Au3GB964;U
z9=t-yWi$(1_*hNA#v!!wNz%E);zE1B9B}#^(q4<u)2uZrd?^8gYsx6hI9~!DhAJXz
zD~85PHWzNtw_rK}Fd$)TjF}&LQA`<fSdyYCw;V!>Igv0fnoMCgVm6Ip?qNy7IZ9^9
zG_y*Sd>6zbb2}t*=2JM{#dHdXP0=5R{<>s-X1}->iRLO7R5TUz+|5zgA+~EX2fLQ#
zVvXr8c8G3aVrr7E+lFa+W-mo#QbbdHdL~m;r3Yt@u1U<PY~fM?Nidf$AbnS6Xmj~V
zER(=BUkPwL)@6iy0;=)Csg_S+J#yYkHu_$1(PeIn(+v#uip6bg5CRhOH7<Ktxjn5|
z_^e^D87!ukYqXH_G;_@p`SPrmc$Sx3;SK%endq075&!H%CRby*LDWo(^%=*$+fjI^
z0j0O$_zRG!z5BK<U|zMQibs|j#@fvCKZWE2tvlQW^X(uBIa)~8-&jEI!hbeM$Qc9r
zXhmaP)@_?O3U(dC#+q#F*wL7c6-%*9#b#91H)z~fe_XlMPZyG#%g6{L{qAAmz73qd
zqEpTE41!f1+$&X`VOydeR&~>p{(tt~MLBLGOA~&TY)<rw#i^8VzsSvrm1N7KZP{j9
zbZ^914n`s~QN$1hR0Akd+@1boU*V7c1^g_2lzoyvPG;g-H&n4mkwq}V7Fm_Z8}f3_
zch32a5e7!M(!@G&$W=cBhuqyc<Vp&;rZa4CTk(mbSP_Z~BIQNrGf=%0TXZ`JyGonz
zHOS;xxA*yYMWpURfUYQ;uN~1MSKYQmb)}=<MgqCN^GtZ@CPgG&&r1*f22b1!)Or|7
z1-IqAo`D%DF7t21lt$2#AWrF(^ut{?MiH}+@rjtm+jNdtijuTY&blxMW2LZ@*(^(E
zSwsqcuY7XGc6@S<=Q^5Wa_kT*#Fobi_6(n4%kmuGFkH`M><NR~%l7KRYHuUie^;ub
zSRr%3v5#jwYloPRR&gM-)_LB<yB7D@YxK7{$zZJ}e2o6bJOM~LhDDZU=sk&I&d_nj
z0ZHIYn&#6?{0k1_KYsi39vq{WuB1kCgzX^Hz}76AkO1p}6<~{*HYTB^W8#>)%}j@T
zjx|80`{!1uZl5xp#opW)l+|INn0p+I37f&)ZoB8O$~yE~C7wEN96%KV!9r#fQGZ?V
z^U+8iR`RUc@Lc0m6Ay}H6&s!rWnMKNl4s$Dr(_{f{@W~_%{D%uN_{?h2Bdr|R)Jzj
zSoW<TR%k5`Rk(3yY2B5eiqxNpBIP?*--<uQ7u9=J-^jnkSM@7Y->DA<;)a2^K}sz3
zI^3S<V3Kj3JPytVvE+9g!B_9S+LTYV`;E)#NfUpF6LlxLkGC0U=mX)$vmpFvs&$9W
z_`yBX_biWMrn?Td3|q%R5Lj5J2G@1X<ji>bphiPa6e?gvr&*zm4}xoKM(>s*iTA||
z`7JMC2DXgNw)`N}0~321rP$)0feAQ#F~+$TI)O$Xf+FVm0T<;W>QcfkCx`46x&3$p
zI0nAThw`esAMiz%oL*!8Wu_v~l|$J&4$7A*@kc7W6w~k+@_8kbQM27BPg22ZbbG8S
zT^K@{E41MXS7+*cc&bPBjzpGM)PyG@ussN90{s_o2^Ud9i)yOc4+`*tHS^Ne9am3m
zgMM@#T3zY5F`EirP+ovtTFA2BB&W@39<mdBO^(QA0W<a^^at9(3FUBA4=I!#w%QSB
zf$o@wkGW19Z0V+lJy+-0b(rlEM+<y+pcdaD?zoH?V$pTPfTMmTm-uZdEN&w!eg}aC
z%c+8tswBdN%hqEMhDk#X5W;Tv-dETD@f3V<OW`+<f>``6X!PNnl&Qo<W0a?el#w@8
z-mu^nP3LhD&4BH!4*XH-TbfV~9R2lI4dGV`7BnXFobOlYeP*%9Pf{jqOEI$Cvhaju
zsDX$ls3fIE85wENi*4c=QzPAHput1M4eXGK=}=+^OpRU+u>*%4J22ihsAo_vo`Q05
z$lL?A;c5ZVENuIJh%MjJu&3Dpc04z9E!PgHs~wn|rgW43aCU8>?|E9ewyiX32*6di
z7lW%V2%H^XUFE?mY9vxD1oyTaxMoS^V%f2DERc<k5sA}eA`3&C&HB)Ur<07#E+dL)
znr1A5d|){`2D!JGGd@P}u=sVPNQ&o4k%4w2FGInY-eE5Q@&PQU2TD(4K|zqtvoff^
zA{|ii(bK4iB!A+4nOWeKY-M6$jA>LiLaYaYjxFXg$h&3X(C`8pQsz=?Am!QvDObG(
z#9FUb=5f8BMvvG?@^G3ZdgL+u4F$0A>eg^g)umb^`<|yCk}yT5a5!DSIdcKf|3x&r
zP-|nce)Z@_b!y4<XF^9kR@J>MPqfh(eJqc(rRA#guC095ZH}vU8dZ%I6YmhxzEabi
zl39=0nUdL-YG#~LcyrLiM^eBW=|!qpE(rCU{JqzM<vSNoR)6$)6hMZ?=t^d;zK?cz
zhCj`xJxAJ3PjytU<$lle2~XG$yvQQDWv}I<JN7#&IB2~)P$VZQ<KoHp5s%q+eJ)+j
zcI$M5pBbX|dZ_0Ae0<z#gC(dXH~z5s;Cix(nrCz38it8o=DOH2LmLMg^D);Lcd6%l
zu07a*?orGI$*J+@67_0P5?&>9u1i0#PC7e4TgcsINntn0ZkLIO>Lsm{ZPn9l5mJ2!
zMhdxZ8iYvlernr67K&|`<v|-v8BfoY(R|~BG2?j>Aw5<*#704N(C!B9?zw1pmz)&6
z5DoE^Dt*>60}smK6L%9VWyJG7J`_(@MGS36H#9%Mx(#lEmccOzbqzZvH(guvJVV<M
zY_j^xfh=t$S(;&&%WRQ~1q+R{^!~$5uAk>Zv8HRG$xR;Mz%(^%`L>OH+u&H!c^Epr
zrP+MdsvIcRs-J;k?S3fM&byT0iVZ)VDGcZ#c++M}NY2~DW+dO5+bm2eaBWW@l%?1>
z%8d+Y-zC7bEz=^Ud4Vg>09jpBCqiD5l0bPRbg9o~5K5Sfj7t@%nmQs`I)$8@_sVEy
zZpUaAS`KFx@h~?68(WkzOt|S`9#Y%YgOIwuen_q|i;Jd{k)x#4*R?u1N4Z`rHyE+x
zGfsJQExg@ZPB5iEdd0&xWXU+JEE&6H$nYKJ2exHm&D99D3})dV;0&9gO+(kG#HA0A
z5a&rnO?Nidb~cY{BipMsGCE$4_&*JYpM$lYbm-U?Gh2+s(CW`i14a}cuXGX;O{__L
zp+@?au#5AIfWUEa#xn|uX(#+b5ylB~3`^%h%#TF|<Ku2mUeyIUogbkSq-)w38Kair
zt6RgLPBr<pTD!q*w@5cErDy(&1*1==TA5A*ww)TSOuW$^1r&Nq7*cbD{wxZupS2<U
z<)Fh~2Afe&L&#t=+ON%Me2<H|br9}k3DxdDtZRtOdVUMDb@}eJFs+A<H{2rDa4JCG
zzFS8|(;dA=#uiVk+cef=3}<{E4gmMLXP&7)i~Sf^^E2^hxzFXijl034SkA*5d_J+=
zJ-j~CtauCH->(~7x(1f1dvzZ<PiGZYlpnYgiDB!Srt3C#J!WD{w=5i37RQcm29_0S
zhUHmLJQ=;Nm8r76l~%?kT;4E%iHrjCgpF3)z1r5wMu7PGSnq{MY`|2rgv3?wbvMO*
zH=2A(AlVd9oT`~nIoRu*@nytznnXnkZt()p-fIB&9<4<3g=}dj;%-O-H{{p~D8ZI)
zo0#~4hCRlaZrXuPhqOTZh>2;~hg#t=XNFq&W#|hKCdoZD8lxn=K~VzspRzvLAWf4H
z7Cz-DpT$vuj{iNHT)z4d<fvGZ7eHa696veh`bVItV$8}pPXtk!?8Qs;MjVJ>v{L+t
zb*?zUX0XguCJax6fv<vq3T725UuTDJZS%qARoc9yS*AzYAZ0QV@Bdwzgw0@`2A|ox
zYGnwco1!yohx>?+O3Ji8Y-k%SWi`#&7)mxznO$sW%PYBn72fB0u^JoG1ak?`uC7^b
zn_cUcPp_<9&g3T!W1o^Mev$LyA_}D~Pfhc9HQhjiJ)k}r9-R>p^|K;Qudy^We<}@v
z_3S|KUxTb~icZm|MHaqRUZ#2pmlJzD9ia}F!LKh`f{L&pcIUIN!BX)?!fG1TWyH#C
ze63F5MgjTBy_q~)On~LAi07mc{eol}xjn8H+vg+rZ!}m+OHpXBls+E#=76#F0gc>~
z`Cp#E_iHE}-uBnWp4%7d@V*b-*6@IS5X1KV`mcNNF1SbUf=6kO9n7(N*fX`V_=K#o
zgIGT}8LVE_gU`&SpFvA~LUQcjGczD1gU`&6neFaAGo?-cupMSx-3>y@JsjA~!j`XT
z*!Nk0t$=9M)=b;iH{^s~{pG;AvYK_p!D6A+{yOLBtPEEd(dxKJXNuk6xp1x6wn;)t
z3`_~pv1JE34mi~?qr@_tzz(?O?44_6b*FkcY1Qso=+lf$8_AkKDBq2eV*_JcQEe0?
z04wQr1i{6XlSh;ksd7;%Q{J7N)DA8uC;g~1q@`F;U8q`MBqU0}g$tdWh<-}{s*@Ap
zO9O-*MUGBRWaDb!CnsZca`Ma1A9MIE&Ctn-SfQ5?D4n02tY)`Z^QL#;eBL_m=Pp!U
zHHnwC%dk3*VPcBUNq{~8)4|u@zdLV9;`k=fY=VjF8rUM#!oKGKwE<xo(*sxYjeT!P
z^R8QRd$ximPr+Z$J}5_rTa<<!CYu~yY{TbF_+>!~OCC!f$r;b0l#Qi}8i7Bt{75Ew
zMY&`V2sszNUXuJGiouzTWLJ>;vR_j49I{$B8Jc_fGgYM)onBzcem<(||Ic}H1zrrZ
z>XC01Jy@A>NImyI=E+s#xqK$aDO{u|iAi=W>Hs$ptOj3}D2a?256L_RFCDFwxw_7-
z-AslJ506^?Txd~r{(jn=CqS=|eNK*NS(GTU<%Q8MkTs90EZazsFu*dB$P0Lc{FI5r
z-{Y#6Y8ItmQ_q%|Y-%|>L#KVoYI3efkm@cNd+EZ0H)VJ9E%)WRb#u$s)ob23+2CJX
zq)4vRvN5Y}tXe~zH0Mx|bhCphSD`w~{HEN^eNujIo9y%MX+C#O@VUfeCyM#npgU2b
zuWocyL`5ve*2h79Nsi7wF@P;ter-m^^?KA%%)?^m&i1k-w7Y8bE4_v3pm!{8)3y+R
zuyogGl`WyFEu49_3n^R-CF~O}wR3*YO^H_Suo`m?@-@kBcV3eHQqeb;q@h2ZC3%;r
z?W(yOipxX)h|G(0O|SmBiwd<x+{&TrTS6YcnnmDl8_k}uqD2W~wrT2EXMqQbmWKoC
z``9ulvkk-L++Ib`IPlC?KLgL~UU+6ZNY-~@2)|uRR#XTP5VyobaLbCG+#|K@;?O{2
zZ>ij<fWf{*?;)J3S$vFccufmi5npC}mSzA21h?omoo9%!DMVL7<se@GG?AkzVI0kX
zingTP-pFD5Aw)5sL`5_u1xI4^5mb}`!zsxHHZevSzmE8g<S2y6gJ$2(<12yq<(Fy9
z@^4TSN+cu7QOt>8vn?*ObPmB31uPFPXb`9SCa@JfQv9|0cKo%v=9{4zIGA$cVk@*Q
z>}!UPL!S`FfL7BFA0V>VxF=f8AJc*dX?pcN7zlcjYYJmRslss<^(C2ulo&n9;`(LE
z=t()c{S4iaesnDfDJ3xly38_1cIzZa)dp!CJ%H$?^8#@;k+G!}P&bVd(7Bt?L>rl_
z5sGP))P$I$8pfKEFTJa1a%!q7UcEvA$@$;Jz%JhZc<~0#oQqHMU>fD(z`6Kz_Cwj&
z$^y;iq42vnowGNy*&+{Vjh6+yxPd^{<8l^WzAQ)6id=gmrV&=F#3V%r>h{HNg#e>k
zA$D~M`Dh(^*$ln>ncRpzeoG268og{k)Q-ShU^VSm<xc^iKOb0YOr6d_B=P4X?eo#9
zlx^_wiWl}DZ_X}0%_-%19?s(nfyOpo*OIThFH5YKvotSCpmy=Csdtb?lL^n{Yxp$d
zG$OJ5Mnze6UzKR>Ki-_RzW$l#0zVZ6WY5(1+pLYHQv{p#)vI%I#Sw{P1b1lJg>ju7
z9$lt4XiAdX`s%%b4VD9afXD=2%~yPjXv_&1z~-};8{Wb%NxuF)EEISgZ{kn)@FsSB
z3n7VOAaO|LyrcOHu{lKHBc5ex2F65T<bEY(qgQXvKA>x!ur$ljL@H?|(Q;|S45KVB
zR=&GWXK#KGFX#PP^|~6L-S-;;TgU}W!tv*$pLr?KeLfn)pR+85cLGP-XzSPVpJ|k!
zt0-ZofHdZO8X+-)<^|W`if(?@>%1;6pV7*v8`dIaORh~uiw~7hdH1Mo#ab^kmL>}i
ztX-LE{lVIVb@Ki!M>m%dy+k+A<ur>XQ9@wrLpSA$y}9HGEYI`v7lNf>D$6Emf$~&H
z^CUs}JODkUkSYn}@f2$x<~U4m5Cx=6R#(8}gsC#NOL_)ChJcV^^-7(Q=>@QFhjDsS
zuhr(KOIPdS3SDpM6AP{J-m3FshqK`;vxB!^`}e$l>C<w?njAHs&VCrfw@GJ({P@F%
zZ*z1EZ<|GV5hb)}+{nVlBxbuQ2wpS~33Q4`kgHh!<KrUDIEjy|SG7{C8jb#SS=ps`
z$!IiswODg&d910fBO+|q@V{;`AiUVc`m`O5Mkl(aVO`TkV`J1mdQgF;ePdO&wVLhM
zg0>fH+Iq`cUXcEQCQx|W9EUX$+euXTBP5mIB5-7v1dE+ahc!OYzhMAtQzjmVa~Krj
z{?UsoGA2$k&Xb?FVY5Ze&VQc?yrLHod-=1)bcxo|8P7<OinaQ0+w`;D*T0t#yl-z^
zNycXx&w&i1Try(bdI!dC6IgNgN&3s_W0|Ei6X(hyPm{KXY3i4@bnEz(UipQqI{Tl0
z5lxd_kH3YJ<32jrw6*Wp(X9hXcV+gy3%BnUD`AV-E6C)We}T~}&#e|#cw8cb-<8N<
zZ;7Y8ecz`^@u?hhKA-XIBlu<=ZQaGQG#A!hVGvJ?BAxaPMDA0p-;{L?)OODUVIdS_
z$y|TxEfH-Wk+EZ3#!k^0Tg|65fM}-U**ev+<@p?2AtTt+Y#)2JMs-KGT`$-~AltXi
z!$SQBh<<?R2Z(-v=m&^?fanK^9)1Rhet_toDnu_-0QioAcj~FKiB_hQAEIQQgE0sq
zJp?9ks-WuCa5}<h1Dq{~D`J1p@tST3v>d(vF-Hx5hE6~F!0Wvm1gqE293*9q{)5bB
zYunpxOtM;3n-=2R^<!FUi0Iwik7==SAZv^#eVb{km0;zm0^HD_>!x?K_n?18+jJVe
zLK|&9YpPtB?CqLgQF_(THf|QhU5#+XV7=>G$vFOMF9rQ8>a(m5`_-Z9-8DG9%NHm4
zyqm94y`XLFeZ83@58d9^(}A-Z(JuH_H<TqLao%?lw~o$R7irX5Ia?XqddKeV2={Ik
z)3<JjTkVGJWBv9+8Q6`Z+7PjH7wgo{ES5WRdEdnbQAhZFiY7@EMwBE)739~K$#G+}
zpm9%DuKs3_p7w#hr_%Nr%y-UXE`PRLM0eexJCYvnVg2vC1Mad1b_|ZakHx>$^1q+G
z^4me#(s~h_9jGzQW0vi3V&G7-2)3B3W8bC@4g*4%M-66#t9Wf%ZEh;^6*6CzZ+`KO
z_l&gi3{N)#&%@jeU2Fwh!#>kZ>~WX4%%d8$_!G{d*a>bFp^OlASH>%zoQNPHDVzfg
zCDSI7Rgr-ZD<oqP7lIYH3ru{8&LMGJ#tEXABr8gIO{BlO<Vao~&|HP%hcTH<I1?2$
zXua}1WJg@eXeGwGRg%NNwq1*O9=1#^z!s%ICFOAJ6D`nO?lWRMz+y7*DQa&kyYz}U
zw6#eNyGts)<{1K2c6qi#Mxyw(AAuB^Ohopsf@cvZp}ZAv*7P&~DVvCdc4uiE(OVg3
zBFGD&={%Z35M3P*v8?nbPJf!^0;CPnPX4`BOjM7;^SqN|4@%X3^QS0iM)Qrue5-&w
z;pNvTE5ZmW)CJ~#O;n%=eOXzy9sXDIRV|AbN#_O65Y#bhv0Sw=oyHJg?i)E|VdNy{
zIpxQS_ekq-B-KMCIqjd;tOvEnPGHZzV4gbyJd4l{9P8p#@A0rGx1F$cBx%k*l7PpJ
zCwr+;ePub>M9B%#UMamLJK-r_(zWzX8s8_y`CVyu?okwL3E}-1cAhGqu;vFYGffTa
zj%Q-arWPht<Ji+J-S#x5n}I#>3Ga>nrsNZLFsv<HOA1)XreB{B=V6$G4cl<d&~mY7
zXuuro*x2)Q8|zH7ea<}+1p8+WHulI<x)uGy_QVhUC?5v)oO@u;$w5l0teCMPPaQWj
z(1O#;B#qO_?O3J9MNtxFBrmc#E#?`oIb2Gr=&!)M!@5Jr$Bmrk)fj+lb)GAgw0?YC
zCL!N6vPFiUZRvf$y<|qF8|id@CQ&XUcSQ%@rBgBR0txj69lw3|aa5D$h*pv`%5U50
z)FrP^#R3$>DHU`&m(k=BUjx|8$0$y3usH8g08J@ccclQ4*(^(ESwsqcpL9FMc62*|
zXM~nz1elma!<H4o*~&s}gv=to?OXmz;^(Ia0*O7ku)y1((BG9rFGAqwpd%m8c-B^~
zM*z+&sO%jMY0=m<$)a?=Y*(Sb%}GW;&){Q0S&PCnhNYEe=)I&>IL<ieZJbGrAk8Xn
znjgRYd2~O}PlNq=I{=6{rr|K(#kNB!w(Ky#o~HYlYt%F?$9KF9Nb3LqZ3_UkZk&>?
zdk?74Lx4hG1@I{e&ebfJ$?cnPlo-ZZ#)WRPBBN?sOFmUN(zvn7<!4cNyuhz6s;>)v
zJ{rjbL7oR2o@<;O;z8)<mkrN|GOrpB$@6BzQ?igK|816n=iY_~R4HIXIe0v6`65t|
z+LABFT6b}%vW;6o>#hS;r2b44Dc`vIR{SZxsNSmjM*c0ns$Zb`PJJ*QV87j9KS=0s
zP_W;UHM<-3w?~`qZX>C8)b;}qTnGKp%X=I}z3I0fh2$c56vGgw)Al3CID4Cc-uTrA
zAP>=<M)1}9t`7N~I{z#o{H8K=*l@n@hMupP1~x5jVoM7{9Dr+xWiZ{h2`8Fw9}o=C
za0{tGxrcxOHlte0p|*SS^Z1q*F#hcnec!Y>@im4$%ha&tGaCoKWnh!IfvNk%(agcq
zW51pr%_Y=vYih2NSFk;@G#23MW;di>K*87NJbn~#MGxd)U%1Bhu*UQn^Di?PP@N8|
z!EoH|_2{K^AxjY)yJ>hVS&>_e$5Ec71)t7}+hbMdsE5x?oh)m2Wgm*GMW+fwPsOKl
z9hIMU6nHi9BEcGJ>hlqx;X;>3|5ZhsRx{OpP-y$CnGvq;xO!q6xS;dU>Pp9r*<A03
zQ}&zWv^mX#Q%*na{Lu)O^5Q*gp)xdePBo@u&Eh(?0wchF;Ct9`4bP{<v;uFnQ^e+W
zo|{i-b@U1YX_T<&I%43v+%DL#GnWEEe|g~5tM5dnQm7*O#~dyKdBAhlXfcMKlg7Ox
zgqZF<Bd?j`Da7EEGEE)@vG`qh7{k7lKG35vFf)^y1zb5i2e)WCkBev)^SV=&NS-E?
zgS&S9l^Dd6GiBV1CF60*2JPESmSen|eDl{A%QQ3*h+N&6jWW6TrdO85et9|%(lxbj
z+L-Ml`*w)w>x*D5rv2O&jc$hV^$q9TJ<7HjVOzpxTktCj`Qn`zvyd{>dw|+Zjb8R8
zdF(sPUE>sYh)~=uHt|kTiMyxn+%{--U%+UO!5xKBTx|5D?Ahpp3%q9$KUi_sx4ETR
zu8%`4pxDyG5PQ0>W5=`tM{}6zm<Q%cCA}CwoLyV!d!AM<C@Yavk$+1#`+;j5h+Q2w
zLFIBMY9vxP;-Ks1DFwed<p|ZmS6hTrG6zVUCKFi}nrv2wCOn;FWOf-*MAI~5Q6fAg
zk3sk==1h3;B@^+h%;F+sm<$ANc`1O84f=N;&#J(`Tj>RuMfnxV_(aT(NKBN@GYZjr
zX@&}wgIz`Lp=ne^l7|1Duw8f|Tj9EnZZVyjA!eaNu;ti34s=(;ZeTeMbsXk650H58
z;Iy?Cnj73U*1uTj)w(>cH`A!A#XN#AJyBUh@^AF^QAF@HG>y7zt)6|)(+^3QqEk2m
zE?_rb0N{8L%`VhCSUISV>TGD{kW<yYEYFS67=0`cj-}<QQ>Cry)NPKdb{bWU<;X4&
z8iMXtYBp0c>+#r>%(hf(;*`R>gC;(b0^UiljPdF*DaMN!y6PSGdtNOA)vo-#U&CtE
zh$pK*`aB9sabtFl<f`laXeX`Ar}?z!NZSrgThA1q@Pz%qi!7pB_F6u=W4|HH=G`v2
zaE_9caq;B)h{tTZK9?>TyLGyef(PPW_Q86wXYIn?QMmw7=ZDQlz>`%hY+Lu4tJ|1S
z*9X^n4||;1m^daeY?E3xU!M_Rkj(BPnStcf_;ZOq&|i4#idQdS0l(NNTs?LGdk4|&
z?oye+dquXs1z}6Qqg5$SE9g19Z3|=SLjad0t&R}z1-dMc={9`bEd@aKAf_EO0Nr@u
z&kljM2LyVX990hu9&eP^1{G;gkp>m1pNgdNh4xge7PE`?^Y?!$8dfQ4^`eq|x_Xx8
zdW;$t=3c<D<y$89y^vzZHeBEFxXw*>Kn5H^hwwr1F|=(q-<C|hV~{Lu6RkbAZQHhO
z+qP}&v2E_Ly~nm~+qUP-^PV_gd_Oy)x;rwW>W<1QbFF0)F2o-x&<=Mjw4mu?Prj?3
zOpF#nIOCy2Q>+Ov=+jS_&@M7Dvw%7OFH-w23wVThF`gUG*lYDD6_XZ2%VaPM=wwuc
ziB^2vY=dlhBO(Ldkwt31jVOs2r;I@6Ur#6DU~%O$TawO%>xnVFXiI8o7*jig`2gd6
z0W5)m{B)3C?++xUfjO3-HTXKXykydnMlyRkVlPS*n^6$bZGnFr3NX<3r0)s=&Kpz=
z0Dknk*WA!rJn*oEZM!cN2KE2-l29?K**PQ!|16bgybMCMwbm9MwKg~b{B1paV?szC
zIQT-(D$Jx|Y;%-)G}^1{=>2*Y-)z<($piw1PDZ3Kd9I)j__WOig=fF>qWAUd>EOD}
zy&rkK8!~?mW{C#t-=EcTOTjBeEkfm3fieDt9~ezIU_Q6W)gAmYeMoaQ>;k;*_D3+K
zP!^hA(zohaVSzTwj<P$MCYFi$i}1Tnv)YcNR&t#F!4}%cHbJOPc1nlN+nS?;5EbE|
zjrj?)43@H1tRrV8Os!I;I&@g30|I6~+YCntbq_J31LHWB*2-u~_~Rf{Cg3e*+nNxL
zN63LxQCS?2!G4y<2zza~1s|r_+M67|ty_|xcc2+&J+X)Av__sZp+jdvTXxp83>oHn
zd!$&}^AHY)PJpmnOQ&n5g@bK@_3w1a4bZdJ-kW%hjMBU~6!`X%uQ%+Wl2}Wu5tG!1
zl_PrF+^2w9>Q!;bphU~(cYT&A7TlAp8S%uWP7`)|jU}jn^z^|w5>Hqj>=%(uxM2z<
zlwdtau%hD(6?j2T1(a?0-ho{Aq)6Adxv}MlVTJU0Pq=nQ9BFLuwhYM}eeqARve5+=
zdIm(vll3KCCr#4m66t)n=2jdGfYw9#5yxco@WkLT%XWD!7iVrQm#9oMbGrcEFhm>2
z8sj()J~-bntaeG7g?YG9l+IR;<<+2+`Ro+2zfQhtcV0#z=GphBTC-wJy*Y_%e~WIy
zOguQ%r7fiF6nhaVMMQ9C;={|4>s`{$c+75(Xrkt6s0x_g1W+}_?SXTTvZn+4pc1eX
z$3D|U#R^EI$mr+V-m9x(r0!{Vi_;yU+WaSOc{~8EL|3Yihe&%+IpBYor2oDV;YKlG
zqEGiG7Y3XFp!elc691TKa^;}j(T=~;Ozn!H*QxQ%m?NS>sD=<mL}c~9h5XsT92>GE
z3R70}9(x9n93hPpXoZ-k_h!)DA)IeX;bO@7BGNOJk9tW$?QN^{4F27<77nE~(&m^2
zjuh5sZ?ywKn|tgN>p?r(BC~4Xa=%nPf#cG%EB=nGPlk58ChL8pC?Er!Xe^WS@KEi1
zy45<5lfHSO;L$_Hqr%cy?_1{BL2`4<MT}RVoAwa%REme}QD`LMdDG;AH}aza89I>T
z*IU|g_u}IcY%hsPV6+mIamoEzC|~aNwMC>^r<x1#t3-rcbw7Je9fE424nZpD_*3DV
z%b-}o3;;-o9J+X!&oAvC^zVVyVGF0JvCkQf6=T${8_$cUdxUk13*236Y5lAA+|ZD(
zCuFVN+g&Stc||uJ4a7Xgou{qE!-2}Bw!1?i(cyQ_6Z*VbHi5_LyvB1vBwFUvMi}uB
z1J+93a+F(c!7QSPcMRJA8#ki<0*e<;l9ymE7AFzJLcJ}NK2_Vpi_|~*;G)(?`xZEY
z%e4tBvthdG=nJgP^{?JM6y+h_L7AM8ox{I>m<;t|#i`JyzXz5(c~p->e$}G!t=w3r
z3X*iiNtiAe35X$s6alAf6sxZxqCfh_cpABG-DQkC#8g=}q~T`qxy<svDUS*X5W_b0
z*uggp%e^d4XM~u!S1(YU;m(||ji+9K?*iGXi*F9Y3JmKGrVPuAVSyzhWe%oQQYww)
zzn#ZZQZHgX9t=mKGQCH^w^ita>jt~NWhe;XftuMBb5y49aGneAU@kr}WChuE{?NoJ
z+kaV#7HtP#T^m8OUl_sfLqIUk`Gl`7Q!@te>#$osHW2#*<op~Qvxk6Jf&&--%{S^A
z9y9*+jWgjS1Z9}C-of7w`!ks(+9qzpE0v}P^(o!E(vXtod#{=y4X}AiVDu$>@HP8b
z9SEF|9j6MGm8=EY*F+MlTvdJFx8N3FTV^KbAMF(KKoxLM*|CFIPfM}Y;4fA3koT=K
z$Pn-mY8FjWDt>SAACvIO<1-yEjckBV@}{k-nJHGR*@c(mx310u;d`?&*V_hnA9K+y
z2z%euS6inYnj!1jW+&aUyfft7(a0lbOzid~oLyo+K6kjIvRhb&4`8Sp#)3kcco2rM
zbOL>%6KZ<~4&5uW0ieo>8YiCA&W%YfT0x;rX@@HWzrwDe@7j*dTP8cZeE$AGVG?p*
zFLHovwIETuhCHA2LY-kLMj9Ca6FptuDmn1Kxw{tr&bPNM4Bw9xc>d_Q(#Dr~Z(lBN
zW_mh8$U7glD0{{(5N}WwZeq=Z@ZIH#-?Nd4t{RBxlRCPgvzOr|7>FY07TaeEIo0gQ
zO+dqxKbJ%m;uMDH5To{BrJsTj60|@m!Hw>qUkuVevN|=bNE}rZahe!xD`Q%Mh-gOn
zPS@Lx$~n?Ynw<P3TgLe*b4ReuF5ax*atyL_InAAuCAqkMD<nW!uqsJZh=|*3T)d*&
ziu;9wMo5fDD&trD^lPg{*EdKAwtU&UTorJUX?Xon$8h7NVKcM2erWS`u?B8x-L9Jt
zr`HxSG;E)V6GDpc3?Em_>Ob5_VQOrdPjXA1ivQO+L4)T+6J#$f8~UOECM}x4$5*U@
zT7sKS<_{zNED13rm*~&OM>NSpx<K6#e-C9(aEf<i=A7{thYUN(sU2=>UR*$uhbh$!
z3oJjrDlXDo?x~7Pm7PeUV)7aLgjl}C!CZhcCnu3U6e;6atSPIq(@=e8LxY55>5zxS
zF{8!@3x^<86wx>|Us96##>n76p_@7Sda`h9p4y26TtEFtBh2Zt)UVA}FLae*p(8P`
z*U4ADx<n@^YUIP4MYP{|e&c)VxjSdeyv2HpBbm0o-QtytB-m1JWk<nvaDAy9P5LqS
zRTSlJ)xnVR%fMzc{t?saBi-UT+T3!#!fmnLVg+{f%6ggX8#Jk8+M;a8rfS>aP|$_w
z@Ra01%h5#_xAM(2PM0*$aY1_R(-0czyH$+1sLG&|jW5n{s)^^#0oFE9*z)nCUacV>
zV9V%q4yv_fM-A4Ols%xq6Wqk=Jfa8l(QvBRB5ic(2BxfgWXmeA@F!V&BX`wsb`XY4
z!$wZp;qZZtp(NJ(f@Y$7#(K?u&)-&_$GFi>iIvCmyp8~I?R<amO0*O$;!zUyMu^Ux
zg0+>fSU0s>A6}EmTOphC#eTI@Z4L*PKdwPcJEo~a8m;auqpO9XFUDH81hTavmuq6Y
z@&v)fkA0d=jHlms%sIFS6B!OhwkIE&QBABU*WmfwSrOY?#5<Zlb8ffteK2tA(_(y0
zH%Rpw`F^ve1x34#II<o>ZHKjXOWYIli9|^4x?vc*?K;qM>VIK(!rNj%k|}eFEi;1^
z*^Xd_EWJRfPa@R=5uiYLP9OtyWO^Gz`NTZy?VVWLIswSGBQ;{O0u9r_hH}lgSMObs
zkw@6-j6-UMVF#SAN@c2=>&_g^U0G9e;^(;l>4d<i=kB7-Z6&OlNFLNAi@_!=7o5^Q
zj70TkRRZOF-83<Uh+ka52aqLPbMmC`D@B#RDfacxNk0s^lt=s2BHCK*xnn1UY`~HY
zrI}?eo#_X=XEMyd7oqyWH9F;~7}c2*MW%m#zW9H3hL@mB)vmLw6lvi_4M`&HKl(aM
zm;_5Lq@Z#|143^PPLhJHDR(~$SkLI&UEPU9@|UqPc|`@2S+YXP@g;TGfJrJ9(Ug2v
z6bL#)&6pR=cncF+=haee;apiN0FBmOeq;(kbVVV#LC2_a(0POvM#?~`Tl)Hj5wsTO
zIF<~dBqp85<4}{!Tn$FNs!T>9yTRN^{!ApAU?Z|{tmJQ|+UU;r-X?(X*zvTfuhXrG
zl$+IRFm>T>2ea%*?LCP!id^l_HXVlYX}FV#!$(|mz=V~Q7)}ttk(C%44!hDb2%~AK
z_>(0%IB27boS^!5C&&EM#KLq-a;4I;frfxaaJE*@3)wD{tq~RTuTq_m-qpQ#Q>&fC
zDJ~y9I&mwi2W6Y)9_-FG{R%dBdIw=Jp35X<t(Z4nLUEengcfb-&fP?%os>j){8bet
z#U<fwYtsmLV~`L$GM~4a7Y3#FYHI%Yoau^cA9Is9`qj>NVyUckoUtD3n=uruck>Zz
zPSfvh@?EPjdQqY?O6;^S=Z1~|%#bIk@wjR(DD|Y`oeSFr?&!t^>{|g=^v{~#mFp-U
zmEvv*bkXjO2WD0Xfq0}UAkX?oT%P>5lvj2I9zxWYxlQ3ZvV^>0L6j4wrp{$IdF&-y
zbjdzu>6{7v&m>0+h|Wlf*3(6ZQRfJp4pZ5TI~LJs3nusy(E!N_-FlFbHYtmw?hK&O
zHlFuZY|J=DKrd&l{}zdqrag8wTcG)Ih(*0vU`{{R<LR7xFF~_p8KBn8kuuzc(A1c*
zH=@YV7SgiJTee*L+yiPFzSsps(roYs=pbY&de9CG{stw1=|C(b|No;LX8rKR_C*G>
zfH{Tl=awZ_z9s#lA6&^tsYjl=C4ZnI)6U0jlM_UKx_o-xJ>jp9g<I+6`?=qdw{t@C
zCh1y4o>2n+UIl*NGMWRf0t)e<lxz}0_AYnMaepx5$-&$dqO8soh-0R0-0+>FQnjT7
z-(;rVaJPrGnPaXtu*62#Zlp8KH2O@j^V+*!p7$B<FqP~Nto;k=KB1&K@Ic$Wp}MW@
zb6X#$sU*S^m38InrVBd5id<B3wRm!i{tsBZF+Bd&<j=fS+1y4HWszk@3&d8AjTIcH
zJ&uk;<e~Ay9qSc~&tRIRI!pn+EYnp}gCHFudeI*yH_8-oNiVRlHT_aXEQyP@`sWMM
ztGxx~yTY4y8hp;dqJym+dt)@S0CX8jxX0C!u~!v|a>+c{H&=xI-W_??Bx?V@S2Zo5
zZhttpu!!(-A=`j)O3_L5KtlWKqPEF)BHa%pjX2|0cGTL}s#$CRjHY>p|HHS>I58o#
zUvwTTX&GJ})WRCL^YAE)RC0;}*8<H^N(W%k9d3qxuIlcs$NR3B<24^msIqRXx;1ex
zf)g`0axbByRl`NUfn~LI+-g;-xTFDh3H0|Hs{DBqWu7wQ$-_p<OuHh;QEG2X5E)+*
z@TN%pRk4j^(fR&G4?fjimq+t!?nKe!DQ3=AaFhhkmpQ{kXS<0=a?5AkxyTkiyU>gE
z#XDEtqu*~=6m5>yn-+hoeg~oc7EZ^hSsQ@>u_!u<d?=xb_9^8Nc)fbzU$8d_AqX!{
z`1f0{R*J8BF%(G!KHJR^xiwI|F13S8KSL?lKx%czDtmcM#_(6bnVN-zKLP-Iy1+HT
zcwqkgFV2{5P+J%FPK$w4a_j8qBn5cAbj!df-d_8&RA@+`AWy#sHfjfWWp51@1JZL(
zVvmich6b)ZP>3)Fg^AzQFG(>Hxv{syNm*hN8aw2I&#P;AgOCV7udO^Yjlkg0=lAQ)
z=*y7`kF}ET$cr9xp|qXLo2OJfv%cm5uVARGwA4psv&jaW28yEnANF7L!SSexE5~*i
zY4p`^`5I`jkW^}_#h%$b8^GO97nM~o6(Hz7C<kGhfLtX^UNa6vI}Z${<%g&@MFRf#
zi*K}5@3Fg4a*P4oTUYxU8&b^_%&?;m(U^Wo=%OhzfY9IrU)SFkLgSt~j!@B=<FU~i
z1h3Zl6jAP({Kf&nime@bvM*rF)=WF%l74(P$ebJG@o^}eBF*{YI9{(EMv0C0RBp#S
z2}3-XT8zDVLO7Ir0NP#c8G2wd3dzJFwN;C;p)=a>hmhuN>@9@%YLrm4fIpZRes5Hs
z59iHKC3b^dzhGM`)QD$C*<mEen!D$_LJq`{&J0rI-}vOCc#m!EyG;_QLysq_dJL6R
zWb`ge)+I}>iUJK!17Sq6EH~^)>WHJ)gO6nsmeZ3Vbs5*3>;N=nGwoDA8Z;?2Ia@@z
zWv(C%R+W1&4oaY3HXyWAZ!ao?11OJYg#RuCM(5+MImEoa+Yp@K`-cRZ3NH`H8NV8)
zC&Yq1IgP94sdslEFLrpVkCo93tM9A+u2%DP#vqSF<xC;W41ElTu*vt9t(^AAan>Sp
z8@AOdn=h_*pqvB3DxjH;al5rA9z3|&ruRcOmeKu<m5*Zk96}WT;68l)Ys`Xg_z=F)
zojO#yFwHmD)|p_z-BooA^z(K!bZ8%scwssS)<CMYGY$sdNT~fr=3mZSv8}$=+oHm|
z4@uFu9pw{%!rLRvM#lGU<;yvdEq=MUMB(rl`|dk)bYy$W#|Co|4}Nmk0IB1J0P~w6
zgBGkKo`_w*tt<X!7yi}{1mvCcoWKy9fqP7i(a`kQ5kzGAn;P(l$e+l_q!||772rtT
zlC$`+p^@&Ax7B(ZG1j2WKCtGX5nF+Gmb|Hb?ayl@ru83orX1g(X$duf=d!%O&ez}G
zpAZ$Ymaj(8ju0^~yHmO`dgKq2=4#wJT{&mF><Ok+Bcx>Vt(ukEFAYh>iZ-#^nqWDh
zAYTwOdX-ipkZPc*&`5enJB1ys=Uh!QtBA4;b;3{|WPYL<KZ(90>8^&+K6f155E76F
z^g89q6c`a@W=L-6rfd@hg!nuf#q1C7-C01XKvR|&Liy8xlB@<;4l`e)x|_K`G^LlD
z{Yg6d4g1Z_`IaGUnxDl$;(4Q=m!04908>^Z>7<PaovcgsyG6s-CQ^jO(-r*dO$OzW
zZl<%CC_})k?l@KmW14+mM6ob@XyAU3fk9TpC<Zb$j;{OSUbR}2!~^8o98Q)7Dqp0j
z&|R0Y2o9RVI+>Yii*RnZD~VyMe5ySud4FFoVoh6fNK4#YW~{K`T8Ak>^7kM;-66=B
z`Vlv$E%jL0yjO{e#x!)^lQ2zMjp}nL70&L${>ZHjOgB)v`Ela0M8vqrpoe5!0f*qk
zioG(a(Af?rsnbhJh#AV%gHHt57R<^8D(6#D)@Q8?skJQgTkZN7j4W|xzl=j~y@m1J
z=W&N0KgMs#UmHBdh04A~=UD;*wG@d2(;eS(-h4t{E=`SU9@UM>p(ZyP-pN<xH3MYk
zupMZY2tOw`lw`VX)NS=j(7pFoN-GF62HUyr^NdZ>?dz&F6D<NcTW%~ZO6|z_k?`*s
zixgSI;7@d<^grT7lIG<d?S8sxW}x~ObaS2{Z$PGqK5Mfxp71wEFjf58DwM8@sOAqg
zA##b8CPpSPE5zRK6<Z9~4ik3Q6eGK2VKj`jeV)(vf~vxZ;(r&YMQK*GJDpVUV2Tb$
z9=jPW!Gx@or!xhw_m)@yZKVN~uFGR`vzf~;e*vA}PX@rXTqVWOn?D<alyd;(ct?x3
z+B4j=mX?EZOyu!+{7=7nhPLyd7^-fnNpc?J^oWg(y(Hh54+l2Fz370z!EvIc!p+)H
zF4~U)wG+d57Y<kFC>gJMn|-o)3|Aj`a+a)2W2YxnZ2D};)0U|N+DWJ17{{R@9n}~@
z`xyrQBPU5j-PK9$g7ar;viWLu_voR(-dw;TAo+3gEk%I7O;*VOqZt3Ay99($_e4?_
zihpoU!J4)x+T;$br-uueW=EU^u010{k{KdIJ}SoN6$I-@O(?95d17lk!2oQis6Y&k
zCNdx0A8@>!vO_`T5q|p5I>T!`;RtLoNOwU3?*9buL2T)i09na$nCDlTfjkZ*qESsD
zv=L&4y?LW7%3q}s>VJxrE8ErzoY1j`hkVVNtP;ru@K#{2nzFqJ$D9V<(KH?uHy$5r
zb!7}T<49lDcASqaz0=+GEVsu-2&@$r)qAZN1X|Y@xaJcE$Wt2(+#v-!H2HR?eCHFf
zg#X?0btGOg)%HzXcf-x)37wxx`>OU*N7@)W3M&mCyN9;CL!;)9H}Ah5%>W4zLH%ts
zYF<UBvs9Dw6S|7fk1*YG`zt>Sya>4vLq^UoHkf28vcHP_6isDi1sXYvS)WZUpwq^k
z0IDj)fB&3dnH5qum4$G=>({JSwoL|n#}8Hkt~obT6SRM<z)4g${x_X!1iBF(8u}Z1
zZ1O&)QgAYLoOdVps*A`%RVw|;?$JCR$&B5+X9VUPHo^p~w2e^XtI{M{K8cC@>i^Ln
zZ^@9x`&Ams`f178FhIJTX$dsS7~1ikkCE)b6U)4Z#6jn|c)J}{QHrCl;2j<DpNm)|
ze#o}HjMzBIQ_NK-$dTM5hN=#~ULJA>99!Uyg>!m!B(G|`eY#qgi?p^0>&qvgmFP+z
z%Oskd83ZxAi0$2$ovs1=M4W7m<<2Hsge=;+OweRAUCq|^of6EA)}EEgpm}E9ou$CX
zOv~IL+O+mnXk74(OndG?dE2m>d1m#cE+;;!*<p>2b2jQ^S=IZIrd`2IJzw}*=OiIY
zeJ@IDM>N~y6p@OO7^jI9k;-qP;ef#ko-ZF4;D8}(-G%Q@Sg1jyK9(3`rir(U`?UM4
zm3Xd~tY2)No)#=P#^U`&pJ|pE`!ID<=nss0NH1FQZK_I5@Mwf2o^<FsIZ&WW2(?hu
zOHk0m*0hHH^a2|e^TZ`#{2XI*a?C{a%3d+x|LyZ=4{d@ve*9ymrvqeD)I?k2Q5Oqp
zzW@J&Q^tVlf|h@SzK&G;OlI^`ggr>fq(9+)a`eSG$5W2s>})J?828FNhU^oPt5Vee
z%KQZu0Q_N!>bo%YJUJyTRrg#Pp|I>Aev;Y<>Q5d&<e%rRB}>y=H_?j^PKZ9Lojb?$
zY#U3v<#i~dPT?d`gqeyu*Auj@6)|0z-%;SQ*(UjCj%N8nF+OL5H>l_bDcieB7#-sj
z8f#vP2_E7`GB*e$Qx9P`MG;o4?;R!;O$K})zy8D!uIv>;A(`$Y@9u`FbN=%pSp$LH
z1sXTjt>@o8tYegkXVwjRR__B3UURZXV4`-Km3ho`0ZF{i%U&u&SZ8USo9%;C<9(qF
zLGhYFvu0TLXu)-KArGjbk?$+T>i^IkRJ`GY=M&*K=E)H!+V?*;YiGAbcjPQJK_Iuv
z-5cDPt`4mb2lYcH$wkU&!XUxSBE6R)LL%0P1P5aA>Daq^lp6pUq`5_knkLGE^oljo
zJcZFLv~MtzPqxfa*eu<4%pD|td46gXSZ?Tv69t-DJ0^B}-^Ni>AvRRi8P@THf~y`|
z2HP<83|YL&AWlEzObod?knP8(bt%$#?Zd}g^Nq#}3D95rvBK92#@|~j_Vm5$bFtLW
z>d$mPGP2#}9G%`ObC}__I=EGHgN?<^T6H#=i0K2g(^6-iwYgk2qr+x$yXN!p^)vuK
zaJ16(`Tf2ZrhDDp<M(Q~u%y01W5@S&;&8{ik3$ace^;)0htsIGdAA+3a9LN|MX>nE
zV1jm>ZN17QgpRE3TrVfQVZ_Ip6Xt;E<HIKdz%`CKce4KB^6c08#MQF>%Rsqxyz-{E
z?OPwtz4peH{bAX+9S&HLASXoYze3ov%o|@Zsl6Oxai4w78Al-7?2LB8K4sWo>rcGM
z;AE$LXP{)60<yDixB+e!c&I#98W?tSucYgmoGu-Zm%$SMtr(VqwjyWY!=fKJFfOAT
zJDb}0bA#P|V(!EoZQ{OymcPZKdxVC;GJ~+;7#SEj|KUYS?>@swy$TI8Aw;KpkX?sz
zU67o_W*g@LhHi#JS4_RLFZ4l6(#Dh|TV-sLBS7QgTL}3L0mXova7nupTYW$DrP`<n
zk5Ekb-Du_5=mBYu@|dpZXuT?(H(2{iQeuE{=s5rc3CBpZ@1ceq9Du5i$b(uQejC|$
zQi^zyQu+{mKVq_Che0^*-h{i7G(<D<0C^lZP<Ir@_H47i7mp+sQT+CoI{+suxVyx#
z13b*l*tqGmX(rm~jW+l#nnXXDs?>cvkhMec`Iq|3@f#ed(bZ8X#r{nkw{aYhIEj1u
z0LD8C)@yEgXslm(iA}4d<_(KLlXtn-q6@W2AzM}Jqu`nLbaa%whsJxLl#e`^(&P|*
z)Mci8kcd8zNsBsiS<A#MWG;MiP3tVbsG5y3C}%DMt5h;KLbFU!$u{Wt!=GaXJ5P$}
zu}n7?!^yp{1WE?<ZyYl~qvrQZF<719_f}hWO#PKh;n8G4xJBC?6bqP&9b`kTO?J=k
zAKEs@4w&Jy__{VL&va;ELL1C=`S@hE@)r;|5TkHkuI%)UAEcJ+UoaaUFfn<2QF8*W
z|5j)hfFrp#7ssP^`}&OBV@*BUMKPW;3=OGw`N(vBQ<FRJUVOw@xIN%jbEHO<#V9Gk
z4u^xh#UG^1++VFcFHlVykW0vcs^OrfksBYk(u}l4ZpyD^ci4r+WTCT~Q4OToIpA8)
z4&rA69I2c7W&a+`tj|e_`Ad^DBxUbg7AD*`X>b++7Wim{H}IqmZmg2ata%Q2gVJc{
zT!U)SVIDvC9wkbp2Bbw5KLZ*x(`!ny_RK2SBQ!djN)tFQRKXb>JCB~1ZT|#V)O=&!
zbMX;|TMMw{EnQr1+W=Rzd7Xo)H15neudyA~c&4JsI!lN+DR}tiffGc0ZEW~XEcH%5
ztNVGEZa{cFC+*KO=azlk;mTs@_C6XUD2<d3y7=NV2d%B%`+$R!)z?pZ3eb=*0!?`G
zsYSz&tuz_AXyaF5NV6S<9j<9GPR6H`{li@L_+{_sgm5(MgIG(j6=5}%^?}4yd8ouv
zaMO|XP7*<=2h<vj<Bi^VYS9#wOn(+^8vH***S5Z&qn-iWoAjHgHBEagQr7dn3aXl$
z*_*J|=lv9QmtjAKGBtfso}<L};dO;`M3;GxE2Aft5Zy|8xR}Le2p~rfS`w2hFMpqt
zpq&@PegB}8!?(V!m=EW=#H!r(KB@VelQx?yc!KKUHIur;%LCa<V*i$pLu3zlMc6M{
zAlSz{14HqC*7McHq1X|~=Je`40e9W12ZlqE#d5Q1c@(z8t#!(q)G$;dP0~~kI?fiJ
zDOcT<upu!X8&1HHTr;dy#_RykMHh|U&}?nt>1yz?wkN*vdm!LoQH#KD?2PGdLH>K}
zPxo8~hNUr(-miH})!~;CP{BX1#VHIYJP8gzq~e54w8{r%HXEFAoFP@6%(<eJ-jKSU
zq>+Xd?dgtVo{9QmjW~vb516Hh5eM4IWIW;|(;S8^;fXXIDQa+|jG&^D!-#_MpH#B5
zGzTuZNB#E-#aoz#07&+NboiWL5(??X3lt}(uUGCjD$5l<d|5*+>3TpK5|MvqD}9Xr
zR68e}Q;kaWJM`OQDJRyM@k`PXSD9%h3sE5^-(7_7_$Zt0{J}XQBE^i6WC_^@XQ-+K
zVRDK%7nLGRM1`DD=pA4=a4--QGdFyQU}8xjq5qi3BPBx!K>^(;nw-DvWu{#iUOa-)
z#$&9n{lLk}MaS5D_FeH9KYo3w4$(GeOZos>mTGgBlT*9ItsgRdugH?7V;iGw2ZRpV
z<T2tepCW#N;mR%Hv_THoH!VjT1TFYO4w7gKX>It+@^b%9P|(lAEGs9kAo_7;-kRW%
z@^p*VDXE%w+okLO>mM&~^NBvb?TRQ~bkoEDLo*|Ut`l{M^=01Ga2MKlo^cCrmXh!w
zWAyzU^Lutxu78+yc$=-|Vix-3h6MNj&7j#7I!bNb7(U-NouDuMeaqAKz34r=J4faE
zad_4eJ7dy2F(*mB$AnSdVl`%wKU`7?w|u>h3P+>El_B5_nH={Rn?s4m!02SKFv3dm
zoK|&aq;H?eC34G(w-kx<|DsV7%`Bz2<ofbq0sFH?5LGj(;&;1on#G!I&O5nWY^mM}
ze8dZ4rZeQ9_1h*|cu-S}Gu5&Dyv&Ff>Obvhm8?_9&;OA(AG+FSF4(P9Pf=}I+s`XF
z{1F_vvczz`I^TzS9rSeKib>4Gwq+5EG^gdKg}pk}fdIIgDZFi+<JSb53~pmdpvN?6
zjQiKMhVXn`!5)5>?Pfbw%=zXbS$)(31y=@@GW@EqAKs3r^1a`(Q1RC*yMLGFUElZd
z_tSGae#qME8>UOk(~&O&w8M|<-I8sOfI%nuK&_o!Dp4-*{YHnNBoK=1$-+y<VoP@n
znIa(WEc`UXJg0D2wPQ;QgH4RMxu)k}Ju<YEMXmMQ*t%G{oM%2_B&=A#W@dnN^R<Cd
zW{vP>Z=>r2<N-6k+Nv1nu&d$#DuL`tIqZ6g5)-J!N-#O`^tjtF1dGDvqJVw@JG8|f
zkcLK)(ni)v9abR@V!pFn668Kfl>Hs-7}6LjucXAM1VXmcIvjQ%WcnUBU<-rkW^d|^
zvW!cKp`C)2Fi(&r9E2Ql-<qAWD`ECi2Q~3nO0XjK2Tiwae%VXimdK6t!XE&&ZNC>g
z0h{Nz)iR8v4`6G)#QP|+fiEQ#am`7&j879pB`bz=_2N|L%N;-@t9^bau65PF{=(~Y
zr?a}Z_^ixRcQ1e;`7o3In(l9OV0C4k_F#1u08z`(9A6-5R)VkwbAbV(=cBj+1szl0
zzxL+l(u@5gb=23-K%u&h934h=R4`yI<Tei62$e#RzPQb*eWrsgf&OD;0MTGzBOr;z
z$}7+=yat0%U4;8Uk6u7>pbRgS#0twI*fxzs=>5zl6!9Rg$?m^Ub>^1U4m(x6PEeKr
z5?c0>lW%CTq1^a<5i&^CGV*`j3EM{NyJm}32ip75Nt`SheL&7$p}V6<?JT%xoAP=S
z!|-jKLnVy_fX9w2$eS>gT`mQs(*ITSISM%4l2)DbaRM^vap|Sv9nEj(lVysNNSuUN
z<Op4G8a(aV5+``v?j;F$WeWVo5rs)y3Jcgw!pX^&k;Iv!$T=Y=r*~fmv{Xuj{o)-j
zB#12BcN-9ymWr!os(<5zT&ClJKqSyCI_Cd>EnZJf*TV3%2_GX(@LY$BTjlrL`-jU(
zwfSkYaR$}^VJTd5CqeHZIUbwq$Q&=Ri_gyH%QEv#`&09awVfBs&(mcPli+3n3rd!#
zR+a&MDvtU{p2X<f2u0iYM0L^gzlNlg4+W<i+WNSdVsEBju^>}Mgv|rRiRPd)iW8lT
zE|H)k;t<XebE0mbd>w;k;LHsPu|dn*&W<@r#t2A(^7otUTk-h{<vVHAkRh?JcjZkG
zN3lT=H?4GPY6QDcv_XG>A&x&El6+6fP{@zNLr_c0N&k)(8RxeTO9d8zWA?U<g+MEE
z)cN-4d|q5TZgL}0m2&bR2{#@0xBhQ`&Y||8il!WjKltDDI^NLIAy-w5C>h;{%)ExJ
zG&~I5t9#aov*5#8GrI@+O6{SgO4GE#OL(ZKXEKrdnIH<Cn_$wQ$K>wU*?h(QAdP0b
z>&p{ptg&%s?2aZ13BiRVXDv}(UmJ3%DQ@^zT4xQnya<1!N=m<uvvh&}l`I(c<hb;5
zER_UfUCE_T8z76TFjZj+d))mC@2axc&yTYvY<(Y=gvzw_eZF#HKZ$Bw=5RUW2mh+N
z4^(w1)^<JRoYI7b)bt{qKJINm6l|5n^9lqfD1y4uSBcS&KdEO1EmQ%Vfj}kJV5-y?
zl$WTGUJT7oeV=c5RqSku`<mZ8l9mip=-mWUNj)wpky>wbbbsqWbE+MAua$AKZw;;h
zp<S@96Ne9MwKW>i+ODV;>Yvf-ta&S6)4aCtAVRG!54MKjzq@^(aKGi;!1>$$$@rga
z@g44evPJB;#t>4=Q+adAZBwg`-Tu)1`&oXX2O`~tO8;&4GUwg*8=k1SB^n^~PK)Q@
ze|l!l11vayB7R#on5`kf-F1zFk~5|ivy$UWTnDD-vghw~G#-hC${RqQ&9YCZ@Ol(J
zjwrT*EuyIb0f>8sU;<L1G6Bv{wE(|yK8=IOFAPDDnsjP}pc2X4VMJujuv(9d6x2kh
zcp!_;vlIc=*ECHSzAS(ciBUyBBG~b5inBvDGTKLmR#AQt7U>6;V7ah)cf|aJynym_
z;)Qy}bR~k1^j---RLefBvVaZ-^>`S)xj4r6jhXP0=oUU|!j)_!00T=zUEnxzhp7GJ
z@qn8c8^W7;lIR9XD*%4QSP!5D>PCt(M{<}PXQrthK}Dyj2cpdQKZQMC(V{KmHH$81
zZ#3;dt>TNldv#d^QYFktvWZ`JffN=>?CeH~)k*Qp3r;-OMqBK-Hfw|f-Pazg?5w)P
zvBv3{cfr7NMbqV}$(tJd@vmSWmS}7m-1j0jByIW#)Jcx<suO6L7RO*^?n-N$iMao^
zenH$ceVYkP{(lOWe>x=Ot%nlhFS7~bOtUh8Otw$P_=`l9YTItmv#xE}Ai+k*>tM|~
z^u2&be9PGcv%n?Tf*eKjdO5)bI(jj#DS8hwV0JXJynPZVQH6JzCO~}Dl@<VdxE;t;
z99=T=967%;WKeHLY2#n(MZJGr@it5u`N{;nyP6;d;QV@hs&iA80d$hFdS!^67O9_<
zSw4p=JgH@@@5liv{ex76q9x9fAop()*{c&${`-%mm@@Jx;Ad%YsKfeiv|ON^>52QV
z;(D7!Ybp16KfSXUUA^>Jb}!Wgz>6_|2-XgbeElGoPBBT`4UT5z=h{u+@B9Amlv;>Y
z{N8$0f41tP_`R9)H=qy%7TQC~hwr~*JL-&vOOj?VV%f4DiqFy)kP#i#%O~=W8P2Fi
zRc1nPEOYNFmgxXZ4x7QoSW$>d^MRxof_PKA4fUXjit%do7<xF<JN@JTlPDr0*b}Pa
zQUlID*KNeb3EUgXT6E%BU2v{BZJ~r`opmZqMOZEKx0eSx9>gT1pCsc`m#JR#HeB7s
zXS3;Jj9LDaAzZa7hWDD%UY{4%&ahlOb*1K2B_+)WXLSHJ>jEWKT^sK__*QunK2Yqj
zxpxjEniP-B0*}=<)YsAuv3cJCFkQM8R2{vAo}Ga;(@GDhS+xC9UtH`O%yTr@{$6a6
zHQ2XB0j`c98ttV!mk>?HV8LWv;_*mKEyB^ro6Mw5n$94E4ZBJtLu`EfY=8|MC;z*D
zcZ+WQ7yUsO)Hn34Y$J@})$%$vye?;~x4g^@xVYSlyQ@waF~C9V>CDH<LO4bnmt)ek
zBh0z~=%)}Ry!<~fyQDGoO<yf08dZ%<93@UF&o7HuRmu4!z{dURL~5#34jFGf{WB9N
z+hZjLuoNc{lwG&-{ZH;_)Ju}*nFRlMPS43`TxKy%evbuQeq&p81$&=vOql5HuIr4z
ztzb6O;Oz>)Q~ugRH1xuH?w-qgcn3CpL?jlOzQ32r=ub3{%6Ut1@hk6UnJalw4qcCr
zlaaj5vvP@#d>$PhVSrM0;7S7>N#_gIRC~OYZ3;=np;TR9hO-pAms+6STJ~Yko@E|r
z50(O&M>mf2l*9SjgN9mzhl(?{(BNvL1fWkf*Bf$Anj!QbESQUDcPmO~i$OxPLff?{
z$?B9sEvm-<rzf_C*tn>$mh7JstA2i%qu11-(h*{|c*7`#JYQGHRQ*mIS~4Wl`reo!
zV4$IL=%K=f$Dvo{=fnR}yW_Bxi_>*Oe;k;@u%fv#=3dg|>r|*jpm(cK;#sSLhx_0z
z%UAeKOjp$?;s}&K0;1->Dogo7=}h6;%5*P&Y*!^6UN1pcR<A3N(Hx3wQQ+^X>TRvG
zgnN#+MV;VlIyX^sa(Qv3QBx0Wo+I^eekjP&X8SpsN~55+l`~3txwrXl&}D|e4HQmu
zIoy7p8|Q6(WSyd4sCrFB`IM=k?xNJ{ReF&YG%ORZRg~EGG5x$r9R&RGG1v$2_EzcV
z)G(a>3+AXh&_7x9Yy8yP8#n^t1_?{CfHU%U`eFLd?|$F!d3+K_FEHMAOc5|Tt0Zit
zF|0-*ol>A;YOV;Rs9s}9G!JWNL13cexinee9mwF$L46s-OKmeUuhDB`W0@OMJxj0(
z4UF$By#hPH(spBC=U(&eMCv{HK#EThA>^}pPd}XpEiGZt0p|P#a6vam;7&NiS1+UC
zk!h*H^7y3+hbKHcTo^$0Lu7<n;Q)mS{MXW-j+l}`_8@)I>AU^27}ppP!3%VQz)*o{
zO7ADCB%|cO=iyBP)Y_*w9~RU1D@B-H<npy004`*FTmBG?V9@l@PgZ~#EfqdHRO7iO
zc0K?k%hC<CG&ly^!CtbNkob7y53RN@m|Gee4Gl1ViRCc6n0u#uV}pAIITMYs4w<KI
znD1dH00N05s%r2h5S>Z1KlgnhPKeWQE?>~qJ}Q;JeIMS&8ztwY3+~p@>WXVD?KrNC
zON`;fKc5L_orQx#1>2ZNk^;e5lKSap!NUbpFXFGc;N7l@hL9sTHaLTbG!w?0IH_sU
zda2Ag>3yR#Zbe(|^n!7(`G2xNB&r#*hmrt;aJ|?=sxD17h1)ds8Y};pQ3Jnn)v+WS
zmqw0NPMjxPeYFPw%~7<ItyW)fkQ)`8Gwd{Sk9qhn`YY9cMKiZDn{Xm{^^w&f0WU6i
zV;+q|pyS2A<5)ahr^kXR+(#iM!smNu?<%zD=Ww;6`ZCN&tq3}-LD4jl9)hteAny6H
zu$9#X;e(}Hl+r1)lM2B5>oDPXnA5Iz!R-!%X{Qx`62LfY`D<3uGMj?MIBn=+b}gEs
z(?qs??L=K%Ud2?+ku@xU1~@bTCfqP@tOv(ahfvz2;MJA37}*ld<hj|q81r0*N<g#$
zTk4$cF&C<uXciqhqHc|N#Dvim5>Sy?4U|xxB+4P|eWU7yKE<sIG@E0lb3N;+iz+%c
zfoXVH&a7jHeHC&zM%yrCE29yB2Nell8Jc5b=GjXDcHRl&%Je^Zoxh2fRZ3E*2v9cT
zx;by_RDh(Qc|`~jq%4ZX68+)&Y4dxnB-}WK%qgWeH$29Ow8N(zzqf=I(;iX^B5$=N
zBKqcM14U1JN~Co!{g^9==J#%2225XW{2HIj+*a+)$rXdN5APv@1m=1sbn<3zya=V6
zix{oII`BS^W0+>~#jk^dKNX1mo7nro%Rlb3xE=quw*&m1sIJG68z<(kyN-UB?^oW|
zuY;F{Z+^eD_-Xu}9~Sz3mM*NHyN>)s%%8iD4i~f`OTZn-)u*_fok_Dd>r-s(!kcad
zyttp&FPg5sHBBtiAql%Oem{EmMf{!}9kIvzxScT@H1YAl&ygFF1OHFBnnwRmJhM-H
z=Y)`lxSbPD7djc{r7tiK5O~tdxE*s!8C#Kke!sA(_mP{=37V;sHQv{Hd&d!2x|Z5G
z#G_1Hq^SWocODzXsa_FiAsdj*zceJ9?CM!qd0D%<Q4=}b@?%p^rt0mLX)U^@!Rh52
z*X^BGt*uvPOxk84Pf{JwI_|$OECEaA;WezY4PfbNZynEpTVlp<RY-zfJlcq{1C3G!
ziudF1rT$|^;U%x}*`{Y89NH$RLW6*i<_8O^V`4p=$^{Bfk71o(ps#E}A)gUK;W_Nu
z`(ZKiAuF~gq-;?s^To}VzU6<eW<=+Xy%mcq;?Bvk9(HV+-hCV{x|pZNg5H++{1)Z;
zb(RF!fuh>++%m2WqZlH2!>m`EWp>Qq?tD)GCr9L`M4McUD7u7EQ`IZL=2vM<lBAik
z?wAJcP?K9W*_*0t1<rB-q|EWTLJhD=q%&-dbJkF_x$YS6gn%z5oyrQ4)i)0D-^&<-
zLDdt{QtMjEHdy7zU`G<#H3|3QNJXzS-W+1E>GXD|i+e*&`&xc|5gOA`5Xk1kJ5byC
zPuVR;s*BFth_>_&6UgIvf$*pyXPhC*)O+#d`&kNc_5&3CGNz3~fo>ruJ(wuz_IABL
z>vsO$=<u?z<av;>WmFqdL-1T8uZ#@3*ce$4&R3UCLeb=~N>^XVVlwBEjhic9H{;D3
zw7E)4Z~wQwX}@qH&!9nBOOIrpUAIwka>ONGXT?9U)kJ|yW21`|g|kt6KBa9xI4l-h
zNR7AC&zEaTdE_K5&7k*;Oz=u0)mRqpw7uFVS^~jxUad1Z1kMDgmC3F{m<J`~af-dh
zV!LAy81|2$seXtj7Wg<sgPDc**2QQomv!`9N=<){R(&A&iIh69-?nDm90H=b0l@99
zvj&Tptp3mNct+^SAUlzb-t_If&^@)H6pW=MVM-DV0^yrlYO2x>?^^G>6B+6#se0*h
zHs4c>R-KmdwA8B%jZHPHVhVqLlQJw^U|bZk2YC26&#Lvz0*tgfF1q#K1LG)coR3^^
zJEFgMT6it}VWU=ehqw#vfHb@M+cToH@+X+6MAY(;qA-=B7>x#CZwqH9#MPaI%kNdR
z3TN;ds|$nu(LubCLc_59bvQO2-9gm^MH~<~xYpgKT(LI{D?am0ht;>8T;%kpiPSD;
zp4*f0e<@>_XOyuJXMYpsA|c!+UrENHb0IId(C=J%=&@w>8ots_g@q0{8MxVE!ySd8
zQc~Zs9MP$6T?cnp5ypTGApQhrqdY_lFBR0zk2M3^vKCe=Nu6lA;rA}FC6@<nYu|7U
zKwvn^{J|agD^NNP*z3e#7;F46>&$zS0S$nVwzCyQzZi?GLslf{zP?p(n=X*ljwHOj
zS$(lJi=Cyi`5HxKnDuDV>7|{ft)-SfjJ!DxMYkR~UrTS0-;)!G<?s8~=$~jYy&tzN
z>)i$PTKMa)qe|&SX0Xycr8<aImjaF*dJw3cE6|1P8u?OC5{;3z7nDkb(+eKRk}Roi
z&;2%|!W2#Su^YT?!lb)q&2}_1qVrPY+&PvPIT$S+@e>gVI9%5yYWGr@h3&}UA~#9-
zHm&B<dC`(@-WB5Da)(A<Kr3IevmpvPHl(H(+dBfyZM)m40Ph?PwF%mYT`#T;qV7ny
zwIa?cT8m2>*5HPKLf5aiowOxsT4Fgg6Def}4>}R)%5k%4DBLnnh2g|53<avsB&G9X
zFRP1L4HFcsh}6=IKvC20RR9QnsmJDqWoU^hMpzYRN<}(;c_LCNxVq~T_H@eSU@5U*
z(1*fOyysajHpqf=?vkm)j23F1mW^>p7(+Od0TY+EvlpWGM5dXg0?$HZI+!P(AeaH7
zM9O~toTctW9&^4E&b+!KgDpV+Wqk9l9Iehly0-1LEqaWXV;cBgtgjDkO-pnEvM#V5
zX^E!XNEXM}0t}-;hK~=D7ma^)?8^Lakv4sm0t99Oho-w<zUYEbDc+{v5W7mVQXT+<
zTVrhgskMePG?w++d$pk~<ku;*zSLUfMR@D+lsT*)&BkzvPPxOHR$4eiqbszU{lg|N
zs7=;~o&Y2Q6E|+yihFq{xk*TIwaJ_E`G?7}(M83B7(Q6v?5fJ%9<l@BNjLj0`o1VY
z8W2Z7<9~{%Rg^e%Y(G`>vq!gJITu-MV&laEIjyRF`O@`ymHrr_=#wU~D;ICea!>&J
zlZ=3aaX?@Qb-aRk<d@&u2zm*kReqJTk|`%aFrr0dsHTv==k>~E?GhF;4jyaWn!d<9
z>>Beq;M$kg#oi}wqTTcUs;TVXhyJ4V%25Cp{$ab#X3H<Dx}c_)=Aawl#@o>5;XsWP
z+2N%~j-wZ^O{ix?pBBcp$_>jg^Z5aayq)vSMU!xDg@#iXYddJarY(UXJE{HY7wqDj
zfyh6E1^o~rP4$U1s(8YPE7_awx)4GQn|}ZX22;-)=(PBFr>H0mJL>eZ17qAr^sccL
zE9hgnLz5Be`F@7j-0T!)7eh*Oh-+ml8HBAr0>|-AW|(xDSdPGCSa65iSfyvy@&{G!
zvG8Dc<VSDpsb$QwSRCxGM6`M94g<c%ScRGFZTuquE$hzkabx$K_Thmq=C7zMpVULq
z0UzYwGFLtIwFQM1{j~)&A@h~P)CKe9v`>xfR~p$j+T(x+aR!8z&>FDDDoJ7f^W7Qq
zIVJjdxtQNK=%23jWw5WGT_DK&^M2vPaQBk=uWxYY=HxB?)w=$9ZHyu);wNAIdAD=^
z!WFg~M&8^MewupbG7&FZ{at2#xAT4p{d~8xA@2--H(1>98g82UBjekUlizN=xb(c!
z=`_{Vj5GIw3E!FwvL2KsDX^H61A^w<f(u$052qP^q7*a34;CHG!u{5O^AlDKH_SRT
zly!%t&QuHTx%IDM7)EqE-T~bm_)5x_uKM8fR@e!Y%Ho0}Xyo;PeeuHKvK@8K33{g*
z*ABh2mL>YxQ6rIAr<10oI)g_Q4GwV7$aul>f`-t{GzJSt6%N@Su3z6rxw+lC`=^zo
z-MV?}Ww5XmKmM6swB@^gKR2ZD-5RI#3onO3EVXCB+RHw~%9RT&7_0w^j@6ivdBwr0
z|F7uqr~ir$|My$8LBoGV$7=kq=--Q8PQzVKuZe0b9qra|v}s`KMI&N?w@fvdWoA}*
z$Y-};zcng*aFkA}<#Nn-sovNT*m#l-J+rwNn_Q5w|5G0$<08+Pb3k0hJEhIWU-Ely
zpUXYn-&cNpU`32ib7mZ$>SB$MNHF(Z2TnJrc!H+z`C=Hqp2)^>C>RidolW)LSWr0?
z#r2JZhl2(XSc>^!hTLWn@_I$e$#G5PWJjmqPbZ&nX58X{wlF6~x!A@#>9R2qg7yHi
z3rVnwN~Uf>v6otK1%cSa|Fg}F%3c7OV~OR=nB*)-EAm*w$(y|VB&77f5l7Bdh-KoF
zZX`;}=>r_&6lP}7Re4)f8eLKIb@8F~#}quKekGviFjR#38k>JRM8eG6i#DaZWTD|G
z8W$rc$Df`fjWgfna|s~;#4b&f6p@U6c!OyNFy7P5B{SNVm;0RrD(^w2kdlOoBl#ik
z7*QeFGpgJMlZf(x;nOFy@zHb4B#)>kY{y6cjh0{d^XoPy(UnqCpV=E7)ubn4k_H`>
zR?XuH3aLVOd%U5QFm!zg!jm&zwR@|30@@QA5olSvHDTh`b?h)gk$1wJB2|m!Oouf&
zvc=+U1kry}{HBUA6kp(-dJJmzyC1iA{Sn9hy8=)nnH@J2H2=n8`0Kn@w2%e9KoPd7
z$VoJNr$d9iG)gLogm<#^StYgPPAA5J?g?rMQd^28a#8KiA%1ibYAa;{SXqeoA^pfa
z^Q)x?jU+j!KaJ6WelU?jBEr$%dtezmQO;e04jgp!LKbgZhn<qEbCD__!JlZ`olU8-
zk)Ta%(058XboPSO{n)_i1lu{}RH1&cbR4rEnwC@Yc*TF9IFOm9{e2&_zC_D*^oS<`
zec$`SuIG}#sbux~q?6SEVU{qu1qddk%0?XPYz<zLJc3L{$CM`<I<n9?O8?NWyED^#
z{Aqk4TX)3PY(A|OY1IFheh!25K#+B<6wxf*Vk)gJywq-L*=8(+lqNv{OCVXY;kxn_
z_7Zj@z0HLf$Y`FJ$Pr+@MieL@6AqDWnCDBkFQW25sBf;5%t_gZ*3J?6P@uWf<HP-N
zt^K}bsdM;{!IQGMPvbJp)jF@;vxB#A)6JXf`*L<$MPokHcyKT=F;Qr#dKzxJV4Se;
z>8NAc!CfNB#@P%r!OIq7JiveK>a4*Yc5&>Wi%j?TH*xCv09qqTqf4hP{1EH>5^MD-
zI~gQ`I-FR6{Fzx~cFjjhDSJwUE-sQI1QZY+042+8?F|;}2p4<09usGxtDrrs@_JA1
zh2asl<s-BMcffVTVX5BhHQpCNpu%CC+>t8xZ{sCWLUFBXSB`-p={bqXnoFwrLMsA0
zcB!w8*9Ze!c5y2YG6vV5nFeW@_uA@pK8*K3<UYrYy%PMVx}vU9E=1(S`#%X89--f*
zq&?UW%UmnqCRzd&i&-=R@M?Lc_!IVJdfu&es6S?g6v3*6=|#6<DupA3LDr+fRcmwp
zQBmo`k~(zF5Jb$0N#zux-;JqcJIL*d4ndlvo>fO_t*_rLoRZt-*m-RPV>)VfTq~IB
z^tMGl2S^avBS=oSPo!Jc(6w~TL<1}^HUfVf!?e)gew&rTcR=5V)DZQLlKzYDHM|W^
zydNrvu$)ep)FzOO@_;yF#iMc25D68tos7|g=(wdcD>5gJ0TDmI`SIw(69s$6V803z
z%@i=C2hP#|1F}F(zo|-Y%hZ_$*@xl#$+BG5s{5d&VEM&L1msyIDLO&_{bNqjc|u@&
z|MQ#b=Cqg;=mZ3Bk;lNuCk}PX3bl{gkbRO*ew~u5!}sx26eXF?#^|X;-^+&eb1(U*
zuKjm1TV45^tSC>lgryo%56x4pCLGF+wHxn*100S}jqyJfCGhB@6ZG*w%|JbO?-)p5
z{NuqGz0Ns0LFO0)trUJOvx1R?<W);kaxQQo@)(|LwZlb3<_WZHz}KW6J4nkjHMtE`
z|J`UbZg*eFJ8_X_GH7Da4q_PXKfHQio&44H=&bdl+t!iKIQq4Oqx+9vF)W@oQ6}}!
z?QKKf)Qc}V_&UMrHD15YBDrb;oc$-D-IFgm1uAZ5|MAOkg;j%h_aA)ShtD{2$e>;>
z-p4a^0^R@c_Lbhie<wL)u)fwB=o|qb-o8S0Wz}qW+h${@e%<c8z?WeE?GB3gX<HG0
z-hcD{im|G;Zma*@P%dbdRN-4yDc$F>8kO$RX47H(`?dtu(!BUQCCQ?US)nbAo648*
zRJ;J;=c@c6&!%rGsaQ(H@l?De>E=Ac*A9_dLFWsWl#P!-iCz5y2W4C)YHYj29`{{}
z`t@w}RkU%#=JjK(4-yfT*Y502Q0Hz}t=&rRfo<Lyh2I80Q&5m@=zQ51Pf};2^0#+&
zuhfsr2&Y}R7^dVZp3bK~<jSsh8c*V~*tVK>@Vo!>2CK0Upi`54aqT6!^*CEvlGaVO
z&yrhZOL29S9*}vNZCHN)ypAzq55H+k!v_`Qd={fEhv1!8?5V{Z-(v(jrek8qrVb9d
zBXAfvzCnm%TM;{WsHU9T_O@BKXtDS?D+QQ3e*~}TR=b7ttyW)k!Q-t|`v-9;rd!GK
zzb2)~w{i?fZlIHo2bZuzpP7d7r*9CICkF->9+?&5S@lbG=UJMi;u}iXIm}DSp=6dn
z`&YxTZO{AW<AG!z`L<LHB;S_2ZUqD@Op<t#K7%iOw?Y(UX^G)1dS)53EB*JS08{8Q
znkD=j)z0NvT#9dWhyV2P;JdyB39t2@qSqH9zlg=9?AUS1RS%D=t{%%tsfkmz`rWj|
zU7)z^7_Qd&She>powPh=mB)1~-D=8(BfV&-I3qdOs<caUg+~lEuEI(!&`#8<+Lps_
z3?}?@Tu99YT`E0gm9K6r+eZahe&Te}c<hdsymd#wGXwuUeaEty^hOErHHuy@<h+8P
zAdd(GFLOzx&jhBk@{eJbrLaTQORF8xvt(X?^F;a3>dPf~<fQv9R)jQTRDjb#`kQhQ
zfu&FtDrC=cQl5dI?u;mRMl??nbOB#!0Uqm4cZ;K^H<rRWpR!CZJ4E5d<y!>-_3^MG
z-?Tj=!lvij*a?gX2exNomqaYEi4dO8?=zv1oSJ37G)xu(O{~jd^f&dc4#7%W8-gpl
z?+D&u{~V~-imF_2?b)o_qzkllhaaJLv-n)%Di$bCxwIcc71DJmcn7k;$aF^HNqY43
z#_Q(>cr&%+q&o?n2?9dk-GZ3i8p6yV%r`-t3IwCr;iiwnh}+mSeAh7yUod0HrPU@R
zYDm5I-7EE`9PjE$sg8d5c+_7fb!%z+?&xTVQ!v7`?NsX>Ez>w{oGhcppE4y^dsNc)
z)U+xglgSp3&+cA}9X&#wXH;d48MkGdg9mGS+zF!XX&B4-)#J#)mendN(JfG1PqQuz
zFIZkx^HyE0Eq%(2_rJ3^MdxwKPe88A=B3EdA(>1@9s6L{<k#xf%JGmy6igiU?~Res
zGblD=AjJl4s;}<uV4B&}et26}#Lq;xL~=pc8Oe8`0XUH5_RJD?_53O>szJ&ZvXjL}
z8JJ%YDw0-%x0+>4HBl?Xy%n`HD}vNNDm$HIDcC92V|$@bH#Kg3c5$MX&y-;CaMN?z
zeq>YTVatqM>_iU3g!&ftgUARX+hQ)g*D|;InnN>)=7OB_>@w}j+3#jaT&@xkRv<_f
zR8x9^$4L7^mAWV?L2q3QcK4QoRi9_Ec;KS2=eWcUiNJwl6YTh$;=nLH>=}V2BHQ;J
z=iaYdfYQ#gVxIRj!_$sHx>m9+<ie&4kj=C$K%kDzAx>E`=b{CEo{_waSv&)5?_F8W
zJ8N}1wYN!}APNZ%+|b4jp)L*r%fW6K2F!D85jg8@xVN@4?Au%!`y<bm@n_O<rb4si
zL0BL-3U@g4s0=cwPtmp5wEfhiBlNu1m?~yvsCt@7us2CjmWocpaiL^>!O>hAE<m`G
zMljhOx!4&=k+@<)S`h`}aZ$!8E9;hI1xGy~+h<p0R>Rb81?kj0-hiDx9()#5QLm}`
z>D$Ne^jgxCy**{BE~6n7yX!&rW7C6Xu~2HzT{zA4Zl1;B!OGNz6;ekqh8YiC?AU>e
ziRGF&Ak+*U!g&xq@-L7I^x`*=W3*(jMS_t|t@iQWXB6M@1n&@pYuW4s#c_1_viM%N
zTwOj<rv>_WP~Fi_00Qmf0mK1zE>^~!wdW%AMwT6pxchO$@dtgnnQmZ4j^pEy+5$U)
z>*K(o0TzBhT^@NZVeSy-etY3RRh+vz6)T7SV+nJ&0z0xjYGIeT4t7W+a7Y3l+ctOn
z(4*X?>s(#~@TUG5fH$`SywOwzB+(J=f2+dt|0currS=6;`n#cRz{S5N%3pdP`vMUl
zUjWEK3ec(XB+oA4Db~UMRPM`2Ms^;d=QS-t6D2DkBD@nJUd6L2o`X7An#Z|dWwIDo
zoB|Q}xrmAmPbBRE==mf$hn`Ip*#bDpB;-ehctcP$1X%;{1w<d&<(dhgI6{9BjLeG$
zV}PbWsz3$GQW-B-W{9N4rO4Z1_t41#u>>N{a}=lOGRtLtsIzRIS2&?UTktgsr$P$J
z0Rr0gA}$w_2O`z=osrp0q{^TRS6~k2if=(rP?jT_%aGMhNOUZRQ^tU#d0In+q^K89
zRkU=G&2uK6t?Gj`ZOrprq-C-|Qh<=o$u(e&7fCkf==p4>t0_eyAaZbl4&|-qvzd;M
zJ3=o@bQvcJlJWQ2Cc}k7b#S?opX*L&^M^voWk6CP!9?osxIpBB#EJYvvOeU3==a_9
z@*PY<Dw3mS3U+2LSh*b4Tj_BXyvWih&Zmf^Fjv3L!M;>M#t1r3!Kzimr!;a*z0y>`
zwvy|!w>Vc459m1XiU~mSe55r)Lh~M1(I?bL#I8gNM_(O4qx!rTU@HtvmvR>3P?!dG
zMBw1i^c?I5wh>y?VT`T|<9*PIZflDJmy15$!HO+Uv>S%`R>w+pqFnEAK*w_XziHHE
z74tIM4V$7?OBWN;YoIa)ssJoy&I5bi%4Vf)P%GGP(Fv&Wh4>X*B8P9urL6Ikl%!=P
zglb;uAg&TVD~E57)V0wVeb9H3>{8^1trCzH>m?txuq|-5fVM3MRM-A0V<c%;F0BxU
zA6{}$;{W{dVDyXeX*5Qs*>rO$^V6uF303J7f+PfhHYef={rTg;;eW&<dH($e9DsjR
zycU1NCHfD26#h|w*w2J6QY;Ge9}=AUM~8vrkBW@pkD96Bk4ctI67dI_&EWr2@_Uy4
zF(Zo^N&cuRpU*fc#UB?UkE1^{iOC;8hjf|c{Eulw{s1Buc~UX37iYN~Hz0xKQvG;v
zl%*YRh>r*L{3@;^0q<jv1@cxur7LQz=hb^!wwG{aFwtvZQ?R#`;5J8iSIyjRNTXb9
z8~XlXZO31BI8LOBCx;>OEy3Kn$=e-A{Z99e&#c}nde=}d^<KxSxa?MgcR5INZ%4yj
zbs208#;p6lpABp8z|0$kXYL!MxjR|vegT`S2eC(nn*D+|Z<d~B&vZ(AhI8)2M|(}G
z@I3-NuM_5ZgJ92_hJ4;`s_>oG`Tn7xHwXybJ1lgcf$S9`x?iB^uH9JaSH2s1-}x-w
zQR$;12px}y*c3!y$8Z^@0go^f!m=ET(R+@(T4A4AiqMf6#uc=rZ>3Yyxf=D4o}*&U
zxk!P=Q;b25R>iY<S;QQ|$?_>ly2h-rM76X+aVmYXioOB!*DTK_xhOsZX6w2OYOi=4
z?OCEu$ig7P!sQ`$T%TcTxB(_+=!zf|gc;%yniJ}!)?Z+?b>J}WnFRJx^}A);IjVP5
z+&j+kO}cxh;0E=*?-2jxNlR^e@@ZMs+Z+SZF<^YLP>Q=M*$+VxIw+!9QuiSq;y%k3
zyG2lF5`EVWsLcqbp~tafnFNQ7Gwg*lAR=<88MyaYy7+tF*@O<^BM-g>P8MVI;r)wI
zBV??WEhHdUpw@GW9l0opG?5%aB@p~B*_aLEnPD_E;r27b0QZ<cl;kK;o{hL4Eves|
zj3(E$#^4PhrD|3OLaZ=eAJtCL%`Q4bwcAgExwbj}q?J()T9AtvJU+E65O+m2D#}YC
zQe-+XY%srDasocQe=$Zsfhx0rihsysIp1LH%mLN_7dLXYAE6Jjw=h>3g7|0INiDG{
zTYEgM_}hzF2L7!%9KI-vBCG~o$k^(;Bc#cfxtEOQQD%g$2yr9~j-AMha9~o7Bir^J
z?z@3yg^y51>+MguX*xSpZ%SAumZP_T+?q#6a!<krk=p6aggG#{OLueM*#5=jy8n^2
zqL#s}0D{or+oS6GXuMtYTSDO14=ax9=EfR{5iY-z@8CoRMmNvXg>Jsn>Az<4{KNYf
z=tRDmEaF5}E$diWdoKi8SI`PHuBw#2Ujxnz%T}gnb3+I*ygL~~tRG(znLDAv@<J0I
z+!~CGE=4Ecyk?|41f*)!p>L6CjH??T4-7E8*DpdB8jV(8`*`roFlxxETCdIMmksE@
zJo&5M1E<v<kn(%o#qkQ^en*+?0m$N8X_fSYlRV~oTG@gAelJs3ZFIZ!VC23f@EU^m
z*Gtb{OZvBzpWWMz!+i`%+jeg7=H~KSP9Xc(l{xr8?kFoV+aqCUgxGa`13QuMaUddw
zO&U_icU<4J$vxKPS|02QEO^)kQm#&)(o*kQrsj6k3c5VY3K_fz`AHDG1h5nn&cVWq
zk}NwfP!gX@7^iM<+yLmLS(%_qktA55;Ur=a9V+fIGMyy?;`eH0r>R9nsK_KJr=mDl
zf411)-c`j$vXRTP3~@;36sJnek?c9yCAlOE^k02Q$bV_5+Yx%5#}lAclR-e8;AA<C
zppI7IJOJElVtbm}RaLSVkUWG7w2*?vWm>mVN8iBU>nE$+Hq{#gZggmRmd8_)FKXj@
z9vA1|Kz-E%6>0|_h$QY%qBRLh#3U|bz(F;z!v@VLmBF)Yo^a4?nZhm#-l1nB1wa9L
zqtmuQq-zkAZ*)?kLUae(nfCvxhB>ZUMgV}8V`#dqz>&a@Cuc(E@&b#3e3~DjA4NI`
zWw(_`if5vbxtLg%aHWG6C5a;CE77sUSq;$az%B0z)=@%Z_KPhij%83c!Xn}pb~te{
zp^k~o&@yZ@@+`s4N2vX_PQvC)gH=Qq-NR1<mrh^4d-Lk~|3W`M|LObo(RTQ}1Pw-r
z;+IcHr|SFz5*u`kKD_yPr0qcZ_>d<KEZ8icJSpVXhvhYsCNP=tNGr@5lsl^Oks*xI
zOdk_C1~@J|%kpJh<!*X+t#-p|dMhD)C-)K5SL5}v%k)%FR11LBp3q7`m)A~Zi~xY(
zr7hv5n(Pjo^K=yyQz0ea3Kq{|k(RQq=V~3av6BsWvZeLEJ?+Nf10?L%LX?MZPshkI
zj261H!l~XpFV}b%Q%Suc&<T2bRR6WcOrmS<4E}j3F?ma<$#%^p%pXY?&Hn55ZjA{=
zwxionJ(^x%aW#X_iE6gj;nt*xeAS|OUY19&)3uREaXPnW4+^vnhULi?`AS5ty47A-
z8>Ud?-Fo48(;aE`ste<7c0Yiy)d1I&Xt!KfT|c!ISlj8EJ`3Rm7s?*ALk*qS<iqy;
zMot<*u|kx;o{{2Li6KwR!{%tH-p^?^m1d#WwcypQepPrgEX6koVG<JD_2iDx50E+W
z9a!*t%WjNbk>(D$T3(Rqy;MCL>$zDmU2jQxUQJmwfhW7piBVPDeFkosV`MGCO6vwm
z!N#4zLn=2_8ulMDjlS(nFC)F)5sa=jkX3`NOX;(-RRC_P_T@$OYxP8dR4*EfoBA8>
z%Xffas^#7KmB2lC3C*qQl?>Lphia{Bua$dXuFD0#MQfdD57xTDT6dqVbyCIM$<3fO
zTy8RlM?S@z8a{TI!!TvOiFw2W&$1c!jV;_Y>u;_#j6UMzu3dJArO@)nLi1p9)3zPc
z#36MVb_5qVa19H40kx@NS)L`<P4htWQ2z`x54TA3(22N1|3;>>Z_rB>=f6Ow0xV5B
zCh;~Bs{jXLFO`Y3jpu;)F4Q9}28RL>W!4|V?U`V46f=Ne6<Mks0FdMyY+=gkb<`V=
zhJ1+>LW5^noR*q?v8Z#LXDlWO7U?8Th2(8`hDgmOF#{I`DbUOJV<fHwo0stg<aEi}
zycGbHn#T!OeL+-2!0xD1uSlp=i_!s-wZP-rWGq2yg#d&6oFw28kWGF|zXP{J3;;5y
zp*1HEINiQgrL0i)Z5VBwMmZ_Ue9p>wF3@4y#RBPKvg{nP^_+{!RHz<>Y%3#3h>oZ@
zi*;QU`W_|<oDUMEe+ChdFJHgVvHuwXT7eRSGeOzak9K25kezLftm6z)l`nS|QISBl
z`a<=f%w%`e5N6t4@VoMMtXPjE5qXK0A%}qZi_^G_Wj`o*JQ_BJ#x(<@dwK*9v9sER
zKuSb(JsodWtXv1PJj)^ghiLkY#WN(Wl?vaO3y6DHol_&!#2hXDhnCZ;UWC0hSUD_q
zrHZIlDZG+&a${FTS1608v;7zr{3tS<D6(-FSsXjW32|TtHnyniSlkaH5z<HJZ~)UL
z%;Y{+UAYQ7N1)=vhY0hoY4>zj+is^e%~sl&c~6g)?yKPGdO$yrbJ2Ekpx*QE<l66;
zJC`d^g|zW!bp_IO(s}U387UQ|;7hKqbRTTr?>+in9;(2iP+jRhs`(W<6V>!nSr3=Z
zvr8jsTWWg*0PyCQ!p=|D1)ZPtLg$xrL7$j9sC{+C+CaI~!<9|dp*m0;_;7d=pMPTQ
z(oQqKD;rR^1qU#4Q?tEG&CAPi`(#N5->Ma7b;x`xs$Pf5?;M@|Xc>8j@cJ(lc09z`
zZ=0|o#{TQa*xw{H9r8ME4^98t)=2m=?R4nfTUuOU`%&m{7l)KF?AVsTgm@md+`u+H
z!)BHh++(m~S1xE}$Af6J#jKa1MDh1z5&Da=QGm3fv^OmQcIgwFY!fm>9)hF*Q%DeS
zF9PEr2-k{&a!T@Z9e5_=JAjn0Nltl}5>m<~zkd+C5r&2zxfHw1GO$B@fdh}*m<6Hf
z+F+ayzrZ>gG`>OO`^p;MW<8HCmi6y(6V89Kkplqg9daq|rLjP;>le<Yct3=iy<*#a
z%W$ZPMQ9ih+wNmxMG>|v%OQqsN1U;HEF!#HVHQ^Q+X5YSKlmL;eno-Xij1g{SbcMJ
zRbQ1dil|74q=z$pwo4#_w4)zqdE1KIj;N?$w__yXxXP`faJ0t?T#JGAx^JCtb8hEZ
z32_0H&3OtoYsod-5Jq?7GL$wZIQp-+tRTbRrr-Vf=;-LbDws56p_1U|R9q$t%)nzH
zxFi$mkqUzkpmNmIcJ6w7ttbX<^9Hf1b_lEz(O?FOLV7(2*y?%Aq@yM-(3zO$VEtkU
zyy*%ssC@v{vpa+}ycIHS{8>DKcz+lf&S3`idmkg3WK6P+%S+(q>9}fgF$D)r%K<Uj
z8oQ9CC1KL%GSy)$?T`~WliyU1iTVZZ>Q4Cju?`XfQtg|)L{XPV4v7K}JD~`%6EPoC
zk8tdJ+!m1?`J8x<P82;pZqoW(_ekoWNNW!ybPVhESRFv<7;QLq#waK0xpL9f4rE61
ze4!kzYB#ORh@_k*>yjCD(a?RlZY8i^m0FAH?>bV7*DVkENw<aFvCu7;wyvS&T)73(
z<+wz!qx!)aP1MGUIE_|_#qNO_)wrsc(w?0xugBR3R<~1Dwde_|Y~%eqadfyQ$KeVX
zc9Rr-35VU>f~B`K^JBDXDYRelxI4sgZ-Dyk{{3w6gWh2py4{@^nS@tA2utn#%H5`S
z8v6G-I#Y)v!5#ufN3Sbe>S+Qd>)opBYwyh(1mDST_=dq+&mmgou*`Tir%9Fky?Rw6
z^c0zffsVWHc8ttkHpE|^s0r<1#ZOkejk;(J7(ZF{f_{1O_p=4kGyde$Ni+QoWkc1U
zC!bDw{rlyKX3%LD=?tw^=1=v_H>~XA&rjB&&rhml*mX*+Xjua7SM_=sfq%<5_EH7C
zAKYU{)#GKTsMg6nK)p-e<pJ_8r{&QTRE$68&gh=4_h4%b0U@248Ft6#-yMIt*0ylI
z^tRZCuzs(M0E)5)ERBY7*O-n5qN9Q6Xg`bDUcpn`<bKEl9J!&19YO@A+;Ol+xMdSt
z7-Ve}%Y88L|9us@zU%m}vs)_*Y%Z9HFJ$pEp@Iu~j(}3yA5>aD2GI!8maQs>=cIo>
z5|_F{NJI$Sg&E{zj3>~NECDeER7g{CO^c6vsQ04cwgH2CWvfBtlH?)<@NAirI0el2
zT>%fsN!Zh7>)57g5pH5ZS%@7gqBs<kV}nyd0wAby+(&1#9RTBx4=~<`4>Y*%3PS)U
zp_PE`C!f}%zQ+m^eNt1-ETa(YQQuUxY$pBXNe9Ud7O-ZX{y=3mL#6=*n{E$q>aT94
zx*v!H_1V~!qmen(j=})bh*9kLj)_A;DGsB^2tz?b$BXW<$kN)KATg-@-NPzEtX<=d
zZ-w}EM3pg;q1wv97Qt!JHt~;FMXJHzwxR*F7rXZDqqz#ltFVuqz&VWS1FLJr7gd0y
z_Ik^vWUrwkL^;&unFb<MToxjU8cB-IlXG0lO-im(eD~7&eq5hrGWRpfW(q1$KXDnS
zJiELra?`bZ-C-EGp&xqKryj^n0<bwg!LDNpgOb2w)OvJs)A6x{cF4bFJ_&`qUEVD^
zLH*kOqVm@7vS+&L!A*7$5MB0~%QkGETwDl<Glsp;3htG=2~sgv9EIRzhvqINr{`JB
zMa=*>#3bH8#QchKV&9RzN>uDrB8rUyqWS=@i0Eti)lb%W)mI3My+G0N(zwUVSXk}W
zTp>sHJ;ze=?fH$DT5KH5vO!&>+lODCEC&xh`E;@ZrrVOc`}?qVN7q-zt-ebyZYKn?
zmYj?IJ;#GYU4JSDzb|AJUbiUkfuCz|0XNe!IJrKflWQM?gsx%O73*eZ$lP(yGI!h|
z{dPyi)-poJ4vB$XDs1cs$Hat+5PPBPx|VMnoZaWR)YC385}g-)msHQb)1t7-h14Q|
zrAqYEW4wHi0M^;0!Dx`CO%{xbqpC_Gp=hoYpL_w1DH*4*#G{3hc`ojXwM0$aUbYh9
zIj-vm6#K-5EC_ahLmt>Ta+zxwlt#iNkIq&y7y#7I;A86hn3fdQRfd5jm3X5UO1Y4B
z(A)=K(zcC1Xug9`f5$*-Lpr`YqU!ce<U!%R*=rc~#@3%f;a#Vq><Yp3Et~rm#g6cS
zhRLLu2%q9GFakeh0p-4XkJa5*4eM{mdD_D?yz9os1MZPa*kjkdiqR#Ub@EQRm}SLp
zb5iyg3G%cPsVqsN|1BqZ{!N~aj=)CV%4%4(S4v7`$O9;&EuSYzc6t048M^-}F3P*2
z`&QlE4=E5BjzL_4DdjG9Sm<IJ`W|*Y+hD>8s1-auq`;v4s-Hpoy}tHatFZ-?<z4-^
z&4R47-)#=*LG|6X>j%|$P<;p0_ugir|IDgy?>HWm-<!RNLHXVKGbq37b(CF|6NiQo
zaa_!TAjFPGd>qigz@a5vZUqM6HoeE{?}xXqRB{{1)7DjHE7Gg3CJay1TB%G(Gn)wl
z4100&2<Xz1JtkfiE&yI$8Q4vL#I9(?8YT-gjjvE5CUF^00hwGi)ls3lTwhs^RQ7K8
zYot<|muDi*Te*<36oCAhOl&Qk$lx)SDSwoY`7+DPvxP)7mpWk(L`FhzWUd(W0Ie+(
zokI#9Nty>&Aj$cKD9U)EVAKN5(}+ytBqlj@Y(-Kb0A(xEy(~=t$qjshGT)KT!&CSA
z8<Yy*g;u2rx)e!*6)WD-3{~0NV<1brI|hL`WBVBcxEnb^;4$noUtouM5e^+ju<M14
zP)=OI#iKI@tOy&pg>5)iTLto-33AS1S!EGA%Pv(I08rh<f}@{E0ujAq^yVxs&LnB)
zyBV2QY?Vv9xwnB~xi|Z;>T;Wm9JZp|d3vW^XBX8LGu++tcPW&h6Z5$t+_TO$A5UlM
zB4GYi_$9AADD5ZO5ByY2p!5<WAuOnBtaT^iRPxB`Mn+A!2D(r3$*&y%{TMx!_JTG+
z*-PF$TH)Zk_bbjk8S5$gt8abClb30ftw|pLAy1U;LC@s>&f*lE$0<LFA?KIuJ&bsS
z03N^8qxL|4c>-HTa$Z0A)Ywxh=AGJ#(y0UrsO7Joh@&>IA37ri0GU*Yj|U^YM>dp|
z_hm`gLmLXh?T-iAG6OxY%`)|z^dk~FBOIXk_3=AcWuBpfdT9)5=enOk?R;!TnR`UL
zHiV-z(=vpke9k?gq?ut$tos>06OZjPA%*r~L)>ic2Xp<y*$|+d4*TI|Q$Os7tv`eN
zYPCguSJ#yr5aziIbJv4Z_kn>afmHW|+O`O&DXcA~^z}E_26nDr{9rTZF^CEz`CDAX
zG*03Y%-b6dp@Uh)+Yf$oNeN8orr{qzt|XGj+Qk(Y-~Toz$@^^MGZzHt-oeMQo=kMZ
zxT<#~>3I;=+&vxJ@%rZXNzb}RV%DXUteeU%rOUm>Bxv$8Cv*dgQ|#GhfE~+@Fbxb3
zhbE(fdX_85Iw<G5y4TJ}?Hjc=F1hV)nzn=H=d2Vo%g%p<ce%|?quzLx976DTD{bCE
zT#D(|Yztr0Dg3P*1Cp!q<m165xc{D+hViFw5S2>=vn)x-tPsztU#dIL(kvC<P{Ph(
zUQ$Q|mSp*}e>Du-_PlRC9!M|px25tXe_Qgp70A*7{+&tsED=%Jtq?_7T4Kl&^2{=3
zSNiWu5l_y_XEaOrH>#b>v$z!B=nnts<H2`7)t;aaZ(k{o(W^K;M}H?du+mB=l-#Sb
zJI5tg{W`8Xcr2%)c74Ck2|L$y6=%}bR?%kllIo2c2b^@xm3cgw$Ru>6RkY3v2cGTM
zQ3QFBY|oXRy@EudT;MXEp-a_UO@MbMP&O}FHih)P`lNveSQ10$4haCm1qbI`F)x&d
zOz;t6WLD0#ckn}=yny1$IdrrwgWUJ2ToLa`B;@=ly5FTdf*DHWO$gm)X9Ai<q*NW#
znT=rtEe7GIlAB5vkW<rm?x3dn?LgwU@+l&T$V=6BT)W)kEImT+mG`k4tZou~_ca|d
zT+ODlJe$Uac&7RX-lp;la{Gb55xQ~--cle*%hU@-EEh7)9caw59OZNHT1IiA$C8Ue
zl$}D#fptmpoTR1TH_lbp{ru1K1W`zWw{u*%EttbS7YE#ouwxrGraXwSpe7NnWpd(}
zkK37E%=3saQ7o<J4{u*#SOk&?FXeJcV!ap9RFrwl)M8Yb6BFqg241^3<45x8rf@rV
zoGic3A%MzwR(r9h%DW4W^*jc~R&m(z^j^nxtNhLLG|uEPcPQJae6g_W%f<V6ro7@G
z-oDb$=|lA6!E#FBCQ}-!ecz{|Byj?L|5#hy75o53T30qkuXFH?n~KZsu<In=zbScG
zzf*^GoYv0XrXg$hhE_X>w+s<dP$?30`Qd09w)bwh@rAE$vktCoyv42doKZKe7hEM(
zvaZT!FIyZ}wGJ-i^)BQ%*~M!l%k9aJER&qQ*!@IYLn*b}3tVz)?O?p!#k_G)2+;OO
zzPRB?_HbEu$6@XB%-+7aJrlSrIr47Lf_Kf}_`O5puj6!6x~)X@2^LRDvQLJbn|T**
zi@<8P#opJScX~*rJv@l!NpklyvxDfl)1kMIJ!5aH#v0qk4JSv*%G5XQz+ygTM&x5B
z3ONqBWny8FfJUKfIMIFPZSSdyl@?i`3=qbkpLJp0&sQpvtHk75_ne8mk%VR1?hBIW
z%<5g8Qwx`p@?7@j4A85o64KzRs{As`&y$Ss+Xpjy-k$4UtFbu<T|45LzwAc1wS8b4
zff)#cV~;r$JAoJAAoK_(%n2B^nTP`K9`Az}oz>r6^B_UzF`dikhb&sZ*tK<}kWB2r
zsDA4U)V8m+KxeUd;LFn`L13A7fGx{0vEy1k4h$OLFbr(w28M6A#^W|=Xk`T`_}4Gs
z<>S9)J8anv=YY|dM{@rJ*Jm@B!%C5lYrVB9&q+zp%1=UV&6wl_80P=`$DE||gh2MN
zf7V#`X`F)LLILF&Nl1R!>q1*s?vlSZ5c(;(+NYKdQ+!hknM`_Cmu@9(^!neciD|+J
zs)&J>Y7fs=pV%gSd@Be+p}^baBx+n<kh~u|JgCcQ7<oM~bb@Gmx*)LxN%e4Z$cx=7
zE5F`QT)z)pSaN*ARW-lW)uI$L`D-7p4`%&rUIJvFOePAhU$xP-LA1KHG)p8A1rvwu
z>tkfBnwEA+eH}`6Z6M7kNx^P4Q#oh^&r^~t%9s_qDg}2oXL%B*f}N3k2SxlqmfO?h
zarOKvE~-Jw7xJYQqMOKr4^|`ci50o78)8$~0z0NfAZJU2nN1^)iZE~u>ydj8&a%s$
zzOr<oMMfzuuJs$h@pP>(%TnM}^FgT2ytRgNx@ZNz4L0Akr{FBshu~e2^dIcO69ggi
zD7CR;2NXN5@8ZCTENlc0GpQSKGrG@Nf8S>fQJMx4)V}W3G55f@ZW=P(uXIWR`BN+Y
z7d%_NGpMRZ$N0iwqYTBM*VZ0MLD*S4aQH4njYB-+wP@rxqX7$ihK&Fs$GI0`>Qf&Z
zwiQ~TXNC5cFyP&fgmXG*w7rO$mAGy#!I$C!+%ua$VAl%lZ9Y%%{p)_AnjqcvURb(7
zYvW?88vA*=R!7wWcUsGBtZr$?=r2#Io;>+<vU~7Yr8wA+O>y{~X=E#B-&Qo;4YBU6
zwQvt0@44WoBtPHD!T7L|>UR}nK7MdHlG|VGopyYsU%H-2I5n^tQP3}$z$COBNE1sL
zcbLn}E&Ap9n*%<58$P{@j(scub&oqfvyBi_5en>3%fz8$2w)omnqlE`HUQKIfclpK
zsCSus(Z7-D>>KnpF3uNKf`r|W=`SVzID%wcmuDH|BL_`U=dE8U(^pvR48Y7vB>+TW
zo|2@__6;SfV_j#Z&Sl?feE_e)suyDvL8@2`x(;DwLpW7Ro*OKYuq`@u)tw}}#JQNw
zRigC@1Rmw2DDyc3_&UOXGnZUxBt^vxxY*KcN)kB6s(w=uWeQvX@LtA*;9D{7ZyHoO
z%!O36>*)h*xWf9*AP_iCCpZ^HT$I4X{?iZ7RYrISnol7;Gs_4&YY_VqoZg*|l~dgt
zea&-KNPfN}^j3g#nw2O{DMVLDSiEx2%+o1J$pl6O*R!;kPr<7vx#IQYO6Q*Buv4sa
zKzb*5)0J8c%+Ne7GWa&Y{cK(qvFsxwDRAEvCCLG7&$1M>Qw71lU6{LCWqSeL4MI$t
z`!=?OX=4Yh0K{hw=Aq$u4sl(F-*<~qZ#f>;yHFc=V4W4Cm3AZbL@t<!FDmz}JR#O<
z`Z8=qF4q`PIYie#M&fEl<ld1BPuh?4Lr{M_iy?&Kt`HE`Q?{2KDX@IbjL5?lr51KV
z8e+nt0CS%@hGE%(8-9Vcbg%44{RMW@btM<*%4MbPnR4Mlt4~1vC`r<9NcBaZh|*Fe
z1A0{Zn%J;v{iv}oK^ZPEpU;w*5m-89rszURDT)%R&2nk&s+y|74D|@slJDJsRBw8L
zRsBeU`P+1Z)%0l0cZ<ZYA}FjUu*Er;^P~FuyJ<PA^5FHU0$V1#x_pC+kW&v<xq9&J
zQND+}Ez@1g;Z)ZptE!$}V=HWt<1JYW)x9l^Yycyu5lB2juehE))xaADvnQh(4^6{3
zGSJh0)5qQMj*&U)8zQ?;^v#iV`%gZd)W6Gw4~ky1WqRyZB+JN6&@R&LOkK;L>c`)(
zUHtij>GJ-XE_(}SFkcSl%Z)#e)O^_$toO2DhE8B|lVZ;Vm!rocOkLN-VdPtm5!x2#
z#ywX%Dit-0RtB{$XGw#?my*+btrRGAk1Q%h+6j$cZA`d*MZ(>8g+Nd0iFnxXY7zM+
z_c_Oo<ACxLS~&E5j=Ad^gmA~TZFbLBbPF}HeMPrD<Z{_Yx%h1^(lS{<x_im5zR6|2
z#Q$)&7x|vRi+j4ry~r_%LkW%o8y30aW5O*TGw#vAFkQ+$d(iMZ8h)|c$-aH1uY-=X
z6?@g#I@NxoMqllxTT$t`;B!FB-<V=ySz%UH@2D-S&+7M65+_<umleu7+B)-gvWC9;
ztZ(ev>~4zmy63b;t=n9sQun*FgHGLhq_0$~zC8JKvfL?9iuKcN#kp7EZpw944`|oT
z_y+a*K_i3ui)YZU2mSiN>(@6^o_15N?<;QIj)-B|B*K0uZ0s0*gbA|@ObtRjVN>Fo
zkDP96BLZ0g(cwhB1&yi&d{_0?;$-DmQq2Lxbw`=965`<RWk1h;lv#Bir)`4b5<k=i
zDD_5patGk_mb^^eM`iLTH5H@nV&%@T?QOzkulU!HDc9r12XS%$nh)aSx}O1UKA_ES
z*G&1a#Yry+Ow%x3Y}x^U+6c#i#|d_#APTu13WwciP}>h1F_B#}{P)$}CEDT2Jq2)F
z!QtzDc?NzZK!09>)FPpms1PEp$fcCQ5gkf<J^+PM4bU7NA>jXhh6><UjuHs&E(wUE
zs&%YW?bfi(qUkmUv*KCIWh&nsK{8c^zicqBKoBlFpk!f?Ip?WDqpIuQU$JD)h34+m
z%qn*QNEfkv-Cr7(8JV^jMK<OhK<UiD#}sn=GGaTS?S>9@2Pj?HT1D%YH}Fg;P93pv
zX)hVo6~8g)RPBY{2WH>QT#jB=Yh8m;lPsNx9G%5QnMuauxIky|<SYS1e1Rq+oyRHU
z`cB1V-38d_$H(aX%Qw%^%c9!wDm5*dk_9TtI7uqP=6Yr%Ua;PBgfSu6zV)U%Lhtpi
zEYHMLGVUH9Z{Br4c7mu#vP*PGI9GLdxALgg7pGtggxQrE5@rdR7s`Kdd<<$_ukI7X
z7b%&>?C_V5^4!dd43d_AJQ(->{-i*5OGv_Nq6jM$ZfRmqPNWe@^|&fkqXdgt5|@Xo
zOy?gD{`~P^^o#jvg#IN?{|`Fsj&w;Ql!yI0Sg9vHuBJ|OZyoWw8rK&`hih<w8yyyn
zX4iCsi$3}BR%d~H7{Sv|KAqGxt%(ZW1-Li(2OhM4V1VE0c^RUIzh3n4PE^EMUjAiq
z+q(f$-TbFm++-&}$6o8OPwTd(@XiAgThjJEU_?il2Jr)qgTM{2!zslfL{|%+`rH@3
zXM6V<x>c)yYHliB41&eh=!#IV6=aBVk^()Tl%?f*RAeSCPr)?40-$3%woMXt73k1>
zX3B^=U^;{_YV|uigDACRR7Ex-nhSEyv&*!;l9N)5mH5)(-l=0Cdx3wFZ{o1(bCyEl
znkmHWVM6DH;OPCU(*gn;&p`h?x?21`Mn`2f8>1u13^hha#hLu`_ZXxr5LKnnf1D7Y
z4-z6hLeKT2C|5^ZNJ+e-9*<FRE<pdyE=kT&HT+@>iEtF}8IeMLdz?^H6Oail>r^-p
zkaH1>%Syp6GbEJ2_z=})H3f_PbY&8nR_Jny12eR+6IcNbZRTRf2proJ4mHFhcOJt2
zZRyJD9N0vH)!*ssv1d}zf$~dRfBVjF#b09i#JV#;hT-ma63ESdL+$)$aXE(li(x|p
z4Qd9e`Q!}iKFf_;`(QOKyIR5!QC?=%-rZ9}-&HB^?rPo0T~^AWj$&TS-Y2~GbeYZM
zQ&)@M)zfew%ikcFUH$@Rv-~AXVNmK?T&iD^_(J^>v$?8Zk*Qw_3b}kf9^|4Z<uAX@
ztKV3}<-asb^)K_^RrAq2RS(YyQ}s@>v?xU`e+LF<`Aez(nI`g|3DLExzkZYdaB(63
zB{S9e-(&UfG*j1Oa23l+W7TAm5%tSd=srLod^M-@w9FSv^Z6l9ep30ZmVMB0ENrC_
zQ-!L)y#!qJJyS-@Tl?|g2rL-b{InGG2#<nyyL!p30-OByU(#4p4^x>c)S#BfyV-QJ
zCf>4L<)~{J>a@1O@S{8TB1<nMDfJ0rq!4Z6jZColl8>N2FVtBI$*MqHSp1rZbW)xj
zmRYs8mZDro=sRS>vp?2nGCcnApgOHT9(23%S5mxFYYd&NLNc@#;F9sGI(|=T^OO#B
zInl6&<!K&`(d$&a&t9iOJrzfX)oh%cbh<f4attrdNV&3TdxSuBttJaPy0UmZnM+o*
zlWjJ%F^~cQk40Uwbz2jQ>k_j1H$aE6p{%?wOG3i%4F%!0D%ZS)x_I;EM&rhScha{a
zz9Q9)4vBkX7i_~u^gizz8NWluiqPM;q!c@a|Lz|7yTSO_0884PZfvCW(gXXV`OJLs
z>7-g`a7C__C!bF06$Kadig@zrq_uY1_Q_(hDyUe$Y5khjJ8V4#^U{hY*3$$9US*f~
zt(ZyqMc3VWubVBY@D{5Z)f*kmq_sdjm`NKYVIWzoW?~>&yl*J#>)RCeu?SMeJ>T&-
z4y-W1PUu2PGml{_BAj`Q64wjwu|*I*Dw@Ku<w!<{X;!QKBIiJvwGicKM<b!s=2zA*
zMsyA;D&(5Z1ro7L9$h`()!i|C`)UPWTg;%?Je`B5OB*DP(EBq{2vj8T49(!vr<+x4
z6ByPmL7A0?3m9X~(seFmb<5T{k|II!WPyr|#U#NZoy4gS5>{QrlawTn!v>d%OP)>l
zGr@(z4jd<PFclHQ4)r}u0>&{Tt{w5nHTjS(Tc^w3!wM&N%o({5=;zlfww2sfu%W7*
z)Fn1sV-tft)!j>*jCj>PllvBSM;-NDJ6h^a0?A#O$FrHl{&P_Z$r5<;h|<AyHki%^
z)7fA;8%$>p(scG!O;;x;mF-H~X<O#>?~nms%f`%gf?QQrf~I9Ft>R#tYGLvkQ&maM
zflc%d*sTTw(}T$1aj*1mtxxQueg}r_5tsUyx{%9?L=Fy3E5ei-p+%`-(%?R;->+8C
zb+^<2CHx=0eEkCDgp<6dfUizH)Y2H{g;0`yg?~XB|I#MnmKy0)8LH7C+!0q~I!nZA
zV9f6^`~@!9(GhxE!+{#AS;Ee=Lw^Y}^Hw^+LC!B)?(zc7GMK%XBq&Zf=mVM5+o3Jl
zyQ67#p%jl|CO{=m7KjV*h{qS;(`MkEma_*S8NyK#p98c%5eQabaTk>7GTD<unL9yf
znURAn+h*7iMubV|QykdBq>Kn|hvDM}v#3b;-4bxs`=O@{@3lR~9sFB69o$lYy;!u9
z!nHR9R#f%Pu6Qric?l<xy9XqVR9q$tdB43+7)g0716W%7M1t+6vpk!|8lo|PD{dED
zajk4@*Mm@OgioyWr>|xOSS2d|C{h7HCB8~rZf?Tj-V~t!{?#dXEEC>$(01hA!QuGT
z<-ze?3goy)1Wz=X@9=thlEDi(Tqz&ucP7OIdwV4FV+ifvxj`8?eicvW(;sq`TIMvK
z#3gjVysO#h?!4XwqUSzJmu+y@4FZ7;(_q-~9fCvV+SqrfZ*#^%&-aF;a&WX0I4a<s
ztPjE7JE>ehqg6MX)uTx=7m3KXeTo@%1a^pP;*bfBX=Iwd>kyCH>-c5Y)xCB;YBk?l
z->aR}oVJ1k4q}>R=h7UvP0dkDpt3oE$9UUzm7!rnlDRLGWKM3(AHbgQCeO4tbGN*5
zjUIX`B4y?U?ecXL#Y`aEb5X&F^7@Mn`fKHVRl+0`%r2{EAgh?*;14e5MQzDZURQ`!
zkm@F6EmOe$DrKd5Is!oE*4%C{(+g3Q@dQ*)m9VN)jSef&nbV>;pQ0Ez-at_Ydbm<$
zDuUEIVwzpFQxwUpz;Ch`;yH3~TAb!!(@8R>^m9tsd6jPqoDfIo`xGWvQpBO>Wl7i>
zASqOGxu&*pU6-1GmC5_S9zdXq^E%=p7kn;<jq<rn>z5&#Wb7P?E5YXS-OA)k0N&sN
zf(_t>m1lW2pPV6<B?+Nf{y9>*sfpevqni~OCJPN0bMCp=A*PMP$n!Dt4acyk#Z2FQ
z+!mx-pDvaRMsm7m^=_96?$*7GyL)o1|CGj`)f=<Bhb!b%4Vi!%H{^*2OAjRl1P8$B
zROh3WiOkcoLwET1EI&^&6$0_`pdO1H?Z*RY=$NPaTsxGNw(SkQeDY0<h>j*eP-$~c
z7U-QC5=0cdmI=4a(YRgp#uQciH?10#^QS@Aa9d7T(*<jF7jCb8J!pi{&zWu?X0+~r
zUD<K6T%v5?D(U0cWqaeQ_Q8;{-jD)wzQg=LxjhXjWn3mg@1k9m-@eIX=NGtS@7O`r
z-NjmPPzaW#oaBoejzq4=>x{$N=b63DHV0Fw!Wg?6PWm>UoeTiGjo^AVnY}GC*RjXk
zz#4N?Tg+{lSaw_Necf}XhvMJm)I{?nIk@wN94V9Rbn4w(!p1OiU6;8gHod^WjxQn{
zI^4n3i~<&goC%xWV~2k&p)DzVQg-V4_mxbs#iuD*>?)bEBWY@<V|JN}yp}bgD14Rf
zf=gU2XQ@){<r#Mvw=Lfh*kGQC9pAEWU{fEP5o1w6LWj8i<JN1GXMB}PQ><PqyQw#u
zRFQT1N878pSq0fSb!{sqv;z9A3<rg~;HqrG#UX4m5$I<kZ@};HYbzoXntAf+r1sag
z8*deZr<!<A`Bz=}D{Z=f2C{^U{0%A3>btLDH|n<K?;mFA7`^-JbIbJxQNP{}1BPzv
znYrU(Y1*zZgwL^Wng(_ZAuzFhADhGtLyKA>3i;s7`CQJNp3V5Ncy9v1m`MpZZVV4Q
z)MPjaT?@NmL>=3qKBMb+)CTX(oe);PRdQM7SJBQ8!}wF>Qo+*JJuAes>X)vw1q}DF
z7g7!-v;5h=8is9q-Zvi)wAbcKd2iliMTt+9t$u<2@%#;XnHGvhS;3}8ySZ}yA@U5L
zL6|3*ml>MP^NB!*|9Jjpq}>|Q`J%=9wYhgl1nF3`>tM0u*Qu?J(9bF=4_@>b<)WA;
zr7{~UDXg7OvI+SE`Kgs2Si4-d`gmSw&&}_vh8Y(~NWY5$M=o(}XBx41Dab5K<KG2u
zjW`!*Hc#N${@~kwrFu9ZmgZt6WLO|fgB$_O4gnUcb6~x05RV-EM$NnvCe5^pIZt_R
zvK*$a%pq73*s_4SFOLiGDnadK4z^rIQXSh1;lD5|7XmRdosoE=DgGeB7$O>Fka0Bz
zT*g3(CUIAg;OKUJKEIRMel8!=_E-cSb8ZnA2rLcAJ#1o+dUjwKrb&tMxK*PKE}t13
z6xEBBYvXX$W*DjE5toabYfa$5ftP#&jB6r~!M-gHHCPS~uIk)Uj98<dn+6`;-%BG?
zc){?V%gtXb`)E|XN)=Ou6a|%3+qA~`kLPb>8m>KC?>ydj%xr2`Qs`W_)z-s}FJ@hv
zZ{<O&T75TX3`o$g(WZVhnkUN>?d;U}4<t^&e{~IalzeizU3YD}`sGURe3`Wz_t$#K
zRW<*!RZZ0gZ*YR$W^~!$1lv4ggA=SX9fK2WaDv@yCm4LX9<~q6@WQ}wOcT4pqu3$D
z!NhkwY`Z4o7BwwS#69+bf#j*w&H`l@B1fP?bv<9(CG)C+L!gMMC2N^w?1ChthRCKR
zZ%Uo8mIQC#1Lk?xS;|uV+|mE_WmojAEoeVtCW{!yHVGr_xYWd9WQW)eEF)sVvYD|C
z%za-LG+pQ=DUCJV)qEO*^?}ai?JPpOuWpDl1@5I=U#hl!jiow^#RFfcA!P<Ph>Zi^
zBiISKk3$1aUeos+*EAWigU4+?(fUWRllf%nl!pZ^ZEn(_St*qjzMGShpq1x&Z7Z4N
z1Sq=y`^TK5^MvGax%g*IfIf{=@b#*ATSgL+ueYRhblNVNOv9)?C0Ez1utP%AR7fV1
zT}?ep0l(@y2D8^>a@%N|so14AKhm;{jJhuM6GYqd0=XMVst1!plIm7jiRXvn`W@)P
z5<U-C)kIcTi&D(wuN(4}lgUITE3ez=diPu1>dg#EM8U*ib9Ic2{#58P)io&51?Dy*
zBm2ZMZ-*jEC)@LsB#Sa;#jZ%T1K2zgRB=`QkZ033Bqvj$K$ZtzGif;FUtnh>-vJ$Z
zAj|EE!@YWb6&KYY<qP@J3d;3`x(BPDFh3x!5ejTuPJ|s2Fib7sW6Fdr3~m{o_sH>A
zD!J3%a^6N)!OmZbzJ-=9TDJ57W3=`xo5lJlyBnhR!#zGC7CK(&;)og+cBscNu`C-$
zei->QbbQ;t&zxTGv)M-1d=&zzMB%Qc_^$KZS`5J&7e7?FbjI8Tpf9ZGYb8IA0?+rO
zNMOV833g0IaA0zQO(I;*&5#=&dE8$bh4h7QhDOB}dn}<%>*glkqBZG|It-=#uhu`v
zOnWQaIjp~w*0VkBb<@8+Q(m_m?N2_PG}XwY*G<nM?{!OM`Q=I7#V4Omsu2xe?+2a6
zrL|P<0Z&pc_$kTH2YRD}yUI*7esC1BZAoGu6ufJ&kOYB^J;$-IV{nFP;6&K<36Cgs
zysd`a^*29V111e|xiRcMlKd?$Vj3rLx!8jGo>fL4h&Pco5kfcOxd9|e@>t8Jaq<0c
zbCSHzzB~$k<Cp7UA>SjHG0U-BEL?!UyOx1N68hK@4zrl!_?)c^w-}J`_0NEOzeV06
zEv!rL_Y0CF=-r%7<D#f!*?mZi`e1g6oK6y;U7lq*XbE%yv^qdiFNt%jk_EI`>H>sM
zWojf)F;rsY4wCi=z02k~YtsZ3b(eK&7|D<QBFX0b`D~_ikF5yz?^Bk|bC?R*LzR{p
zx-C=ZY5@7#5f)iXn*z9aIZxXRF&dbk$8xS=gsol|P;fdclLes9Su%$d!r%*59VmdO
zx^jaRWLlx&$B-;{mXL+yv6gA4p))Avz?WSvRI>OgTa|*ZXAvT(tVrZ42>UZMi!UH8
zk5miw^N^c5PIcy;csdh#k)?`vNs=`I@f_CKiQp|2h|uf;R83T{Y$i}#-ZJ35nA80L
z@2<mWM6D28o&}Lco{IxUT}&J+iX7^g!m}T@g<u2Vy&`R|7I|mE);qdvFZ}K4-(hd5
zJneE1=mma+UIW24h$M+znC+%O1(uq+;6Qm?Z*{eqj=}kr%}bQTkzfm!i24kWobW1r
z8XvW|uW8TA+C3;b1kG<x(FvN7yb!;F74PsZxs;_&NlCg?&Ty#YT<2o0BZS|c9yK>)
z4wI_;ItY5j11rmP_@CQtfxW^CKOV?QU0pp;Ma$ePRXP)u$XUK+IPyOpjQXJiFiB0S
zla+mjhC6l29`sEqKvUUNa4ocWb=babeMBVt<#J@gj@@pJ{4;eLD&N@SDyHGqCi*$-
zr(2rockR!ythm+lfu(8y=&$+23@lXxOV!q&fu-tEvsA$c?_mS<9WxZ%b6hMaGqJ-X
z6Vos<F!LS9F>FGeaJ}{H?t8FX_JLgi`aPk)E!?j`=-&bOy<Dh|0DkWgKXj=<a9{}w
zJC;vyK$w9Eji^hhD;&pv5X%)!<Ezc<w7oFfxsD~DvxHzBR!Xt9wTv`xwUqO7bSPJP
zmaB#S8CLP$a3NU54<DItMh<h`D8RlI8er#%Ff}ZKg>Bl7>jgB7qQ`CL*?`R7Xy>U<
z_`Lx6U(lSh5%WLTde+){)`UbTd&ISZAC?~7In1G$(>~w_%q7ZvQfvU~^bIwmu`*X|
ze{#uOa!<n>`tzh?7h0E9fWy+X=z{I*L!iSD=y3bu^Mlp%e9ou<yFf(0VRM4H2tDlB
zL4ZSpIM^U|WHS;5oOzF1=um+UGO<j2wJNr?Ef@4f?T%o*4sO~PG^G69(Jvt_OfA}s
z)@h+oYSb1@zCqU&O{8S<AY4lA`-ivc1(Hp}!pZWDHSg=F*|pwlxKsMCMlZ}06z?Kk
zjH`?4SLk<L<;K{YrV{;Hi!x`VTs=6b8eDzjx_@wG^zmRcK!fjmV2{?+AMEEcaEM_#
zrob-5XgH2#W5TF`ZRXgHMVydE);+c}{XmjJpr6HrNOH)-AATN5;k;unrHl4w<y}e2
zEtb<7X|#l(0=i46Nbn{fR53<0&(399@XNH<S^=%0L->-4D*_)(^j1J>DM&W;V@{-2
zjo#;kovUy5EYE<U4%B^kb}o~N%MWaY+PHP|mU|s<f*RNZH*isl@+jii3#ow}lNy+E
zPB66`i~12Ef*Frs^SoF1xxa~=$E@7J>ChJPB<fi0AXwfPsuDyBfX2Z#nuE9msyV#A
z?oN>*HgP%`qo1?#-Hc4f2>w4hLhq!E3ketNE!qvEg8FoR!?SpDmMCuFCWqUE%<jrg
zs;1;&?<LA<=nEsnj>9eNn1o{zh7k^JQ#d3ry^yV=AAeMO+sX}f7|E@g>a9Aet;ao8
zZqE<T7>s2le0!EZI}b;p+JMnpR!dee-4-Ru%R*9MFY7*?kv2D^kg>M+^6oBrNd0*K
z*+H}T(wfB$grtY8Uzm2tMBo_MjhF>zyNScVw{U1u+b6yg8Diiax#_VkL&=p8c02OZ
zaJKJ#wksi6%fRiEz4Z-jpZ4&Hjnj#u4j+w<I?s>R<<(kIXyXT>^T6;?xECLVY70N)
z&w^_QOgO~G#Ec^B(12s&cpkP)-xi!wi*f&+^U0V7dSmIBFvPPdiBlN>_ruRiN_1Cc
zeqZN_sUPd`#;i9vEhn3VRCmP@`fEHn!zwdPU8i)bkd((<W^$3yd(xQHBxX^c8%U9I
zH#Fg@>knHK4r#!t!F+7d2;$y-9}{62*fUJWGYpePmVN*CMx65aBIa|FG}~nN{n2{5
zdh~{S<Zi6+JsFqo=?ae`Dnf%$Y+511jvo;ma>B4{FhX4`Al!8yx2<Q1BI=EW4n=w)
zl58eM{m;V+AO2<+MOUvV(BYELV$cDuVc&UUDLScB`CfYFo$k$b68_3kjfmg2ymtis
zU!J_NG$R&L&jJNir?NgfR;#W-Gx+LRY{z$r)M~G#@zqJKDA3>R*kb*iej!IJzt;M-
zDRb5KkKC>wySl-2KBXf6K@N4VG0xK%9x(mg2bb+Xm6aR;<LCQk+L0o~RXm+ff5;VU
z$7wu?OXz@kS1Go>a5UbHRGr-jv+k=IfSQ3BS`o#TM*{3nuntqh$377dkmm^^9yt@p
zk|5aCo0eq4K^VL%&b~_cS|bK-69BIz`n6=fLE5`kX2wC<8>GFJKZCTVw#*>yeMYn2
z!<P1ZLAXH-6I;~vuwz*+rk>?u*LA27+OA=k55TakjBGQJgKk?z<x1o9PL^%;_~lv6
zb67vVp3!jy<``k93G!Gg!bX-&(pbW`L^>f8(M0hmzQkgd$@L^di?O<QcN{-uHdFKR
z!0qBR2yMnW<{r1PW19pMlUtD4&b3_MB&M;Bi1r?B5XB_AZimQtoXuNAR{(oNQIuYD
zkKCQbtw;2*SGVazjCdi%!gMX{5SL@hErt!tV79|7%Ni1c^pySn#{if;cUkH?_;<!g
zDzSpFvzq8Pe^MX;sW8ytdKO<9LC@oYOldrs19m|75~?fWX`GN;Qr`{`;p;+#;Z>{x
z2gCJKMJ^0{@)ar?F3Suiy=S1ImwcU}p?*|_-}Y)cBL(_+@aL*`JDDNsDj=^)^*f|R
zkyW-Y$_s;q;x1b#?t_uM77HJ?-b75_B(_Vj?LwHD#{?#!>0!gQi0hb!X<Cn*(qPF-
zz9b^v=BM)r)l%q_0zpit`e?=lO0yEpa!~+ZLY%JtfTF_^*bgqVc>-G4Z}T`8vgFH(
zAzm)$(HQ9K;d=8;czKErGb-6;e*EzAbOcR8SWvq3O|B+j_$cpY%3tCJxRtN+OTO-b
zUB1hEe0pW~`=8zRx@q5g$%jwx@aerRrS)NddjlHTKC>t`JjiBgJ0>P(Xkm*G$MwRH
z+0hoD`udwg5~^)UsCL33J*;F@LI~p8#KB(3L+n_dz%&XYZ2CdSxNp-)49Tdr;@^g3
zRJW3h>aAcP$-b8ud7YJFxAar*D_J{NRV?LI*P(|h<CIRRTFK#K#0BQ_SrRj%v)O<g
zoRCte8bOK%j#K@B%1RZd7osR*5Ztr$mUA3&IrRO~966Np(DWJhEi=N7Yfwxb*Ts&@
zD0d?_WX!$C*8EqbC_&Zgz0c|$_GmyhEQMP8QYsd(ay0d6Gi9AxtIBq)u!dt)kVt^W
z6wk&8Ue&SufT+A)#ayaNN2(o->UqgQX^K-t3kOR}C)vu-bACZmNMZI@U?=??&aeH6
z`Srq+)3IM3?vS!5^q7fB=mywvO&3$sH?e65W<@q7p7#aFY3_&Bz%(`<RvTAnCk-At
z6_G-H!HM)biee^^?YaA&XdBmTks*?jWC6X0q;~5Ua4YZka;|T6s)H(AXmhWO2VXY%
zl6>-Ohc<YOo~r2LP9OV9WkbcwMZx+RxZ&=TPbaN9w`S$mpCQ>}c(mz1+^v$DYZd>=
zr<3Z6x*!`+r^Wkt293x+-owf9%M%z1Iz~Uj>G9;#iToF|d1=1BDn$-y`ecjz$)}T-
zMRiSG(%Lo*4RV638PONUy=fX^EgqX~`-Z3fJ~@+Z&v&^IMA$Sv7dw&TW8&F17LIMf
z=Rnx};m90)vGIl?hpujrION)!l4L)5!=oYhJV2}PAjFPO4NQECU{{F1vuq=<_#-Fq
zx|zIDt@ei_Zv3Q1Gzc7nzyY}%cHLL7grr+kFF(Ed28;gf9Qyl+8{8AV#|?sgAp~}q
z;o?Aq7B-D2^el_Igl<9f4%YGOTgR0>?y(rgO%bxd4=Lsz71-gnheN{)Fm)X}AT;th
zU&mCvuI{z-v0aeeO^#@UR|$T7UY3NN3$D@*kL5L`>K4jk^?Y7tQ&PqZ)jFqwWBrij
zmn4T-uLN9-v9hzq(gg>a^+n8Oa`-}#*~%>OPoF{~q-uD+)bP`%091%mn$1(LfeZ~E
zB9*`gnTwcE$g=SCDXIG?sy?cxqPmYypRPB*Zg|fuOL+{sAW8lf7cq^KxLj<R;2Fuu
zRFonIWgTYvJ)s*HBxI!^d92?{TzvoAoFwnFjn7;Vh%g5k_d3IBPTH#yVPrW7qZiq1
z(f#M^Z{ut4%*Z63VYm)<9BN|6wgjfa2Tm8Co2C;*F7t1FXIeMinl0h}=d2Vo%g&|M
zXPbzx4&h1&5j@`d!90jdF}SRho2cYSF6Wbvaz9{_#FO+HB-#4rc3f7==d3)%S|=WQ
zsZYpVJy`&<(zM|9DSIxe?0ulok+NYCmln|Ofs6jX|NH;80=G3+RRq{Ck(LPnzVeC8
zltUN2qgc~ZfdW`7gS%*eNASC1)M|eYpl_<;D&$N$O1gAH1nMsO9mxq)K1OFEnSt3m
zmT0wTfo78R1D;Dcnq{!{Vv?XdF3u}jxg#*mz<*DlLQwW}3Jr4Y#Ci7gDSAGe!88Ea
zt;{9)A%N(lmRX_paBogkCZda2T-Lz9{x}LW%ZehVi9j^T*f|Cbydk|SZqZ37k9O1E
z^-S;4VOf?D8Wy$<8eoTr2#3@UvFWhTw24WrwUW(!FxoBe$gZJIW9K^f&0Mf}7K3d>
ztv;f>077pzu$#meGPh-GjTR_M$OK~BNFj-A$1R52EJxbjaD@IUl3CF#VA#4?E?2d(
zWLm3gM;3z3A$=tx@N6oIYMm!BTOg4}S<b{%q~$Gm3%4w%{Z^G5M7Bf22nUwKu@kWf
zQ;QJHeQpN^Ax7{eOu=`~9*0(^UtJ2ik?RcXZECH-iPv3Htrex0A1r4nt}EjgYFoe1
z>wNM`T!`e2S~&j#WD|8&MLeA+(hZ^+Dpr+#C)n#*fqo)!LbEGfP_}m(=lc6}a`N%u
zrP>oc2<uO$uYYaQTXd-TPpiv6iSjJt#Rzqt{2|VZvM!@@YsG~^t9Gg#L1L>Hi6Ane
zR*ie5Wb*5|SQNd&zZjoJtD1T@r(m_5Wcflj*6V?s4c&}N9hc{1@oOT|NqN?7<d^QF
zpGN3AWQ?nHUEQ0|`Ddup^Nn@M{=-8*XQ=7iA%l)VcCYTx{!_qcbi+T3@-oZM8++>*
zJ;6^PL6|=F+OE&4q8%Kv|0x#zvhTB!B(ge54}GFx!(+X4n>($vto=8B(l*wP#&X&2
z_+aBz9*trD?EV;()(K!&PD_`4TZ&1oVID4x@85gf{`YQox;ZKSLin%mmBjPw8<B&R
zo=n8AdTU8gH_zrY5r;WkIPABNj++v_H!wm^O~V)?Yowc$$BrvK=Dk|_KJ$7Wo_so4
zIVaMS4b7=@L3+u%t+)K>O_5%+P)1K5c(eNx3Ag230^3Y?PNg4wMyB9h@60aT_zMA+
zbUCN!PftFbY@XxY-Q>m&CC{?U=itLAV^-`+xOV`VB_%=7Rry1nP2W_e25Dx9r{W=6
zt-ln*V0)Ebi(=4t!0dZpg*b2gIp22s#JLBIlDXigBtO3;Qc2rjX9K6?!&}w*%Qzfg
z5B>O(QqJ(2ANp$sk#%^>5B)87)R1evZs&`Mp7&nz{L)g}9unJBx=D9cBNX%D!82qT
zx4F=_7y2~*98B^>mY087+_sJfe$M|C($M<<Oho!CCHb!%(f?O#=M4uve64XK)@{w@
zwj$ft>s~Xr)4bi@tnE8zTW4(h+B=Y0)AlqnFc_P7U7m?tdfefpGwv`ZUpWgfvVsR2
z<}O0V4TT?Ik2*GXL}cO64LxjICd47T%rlMq&pcQG0I~>GmRz;NwmT%XYq{@@lr(8I
z4ysC`rlS<4m%QVkT<v<)iP@TJbT`2dInC0z%w$zx+3mQW_fb&C4GrRB*JnO<d@H~t
z@+@p~KMY7DyvX_jRF?P9`&hmFB_s&kfMuXo%iwDqe2s&z@iX`u)i(nCJrCH=*e%(2
zGxox8TXQk^7gwL~gMV@GFAo02jX#5baqutRFWco;w^R@Q#Ygg@2mj)uc+G=<@iDyR
z!N1r{&EQ{rfd0i>aH2gfuhFiS^Ly(&axC8pAz;n$ZR{{p;E<XW)6h35vqi-02awlI
zXLCK(!G+iNAywgtpV4>Jv~d?*Nc(w`d_q0jF<or>Okl^4OiVn}!NL`u;8ZxiB?eE@
z;7J;y)`qCHI~BFocu&+f<FPuD^e409Pg0i#chc$)-{4Lf+)0BwY2(k}P8!@vYfjI>
zounsXa3?)Z3-sVldK9mDa3?*6w>-F$nyDGwNrO9S<(7Gj?xctARibWaa}qk3`ZlC8
z5jG})#jzQ%&@f$3xW<;O*N-jprgt0E;--O@8Kb4+sA1TAG|4z^;h2n>1e=~Guw%e#
zWS)n8VR<Ap18RwIU^X6-aefhI;~mK1_oOy{`t<uAbGuCNLIv#lXr7D_olCx4M3N!{
zGF^d4!-y&=Q~4bH+tSV5aR2hSU`bZYa{+$x7+lTJ^DI4j`c!tL<ttYl&Cm$T(kPz5
zL%)1WzXR9B70Ty{D84<W-+ekfE6Z8&?D)8t&t_R(9!)C_<Rg|%k41_<ygPn9FOw`g
zKZao)&kKR&^SI1#O<PZrWP$aFam92$0up@vFc5nJ_wals`|<9l_itJ=v}0f9#c?Ld
zn2*bOp5iQRI#4wprxP5fI8&`+Ke9aEASU*sD8i28yEq^=!){<%+_R~{0x^QA?u?}B
zS;N_1W(^vkrqL~q(ErNj)hw5JmY^MY{1rrjCD|Nuv`X4hQJ{GNw_s{s&r9WADrRJ=
zfCX{?Z6$)_>B{-xnz<UQiNdz$9%s5n3^n4aMqKp}%O18SP`<Yv$gtIF*DS<&fu@qF
zTU^bOEG|(AL79xqi2A6*6vBr%&!%x9&?1}XD9a}#)f{}VK;p6h3e_?dd2#gg={A1r
zmvwI17FGk^Kx-@rqqv03O9Wb<W+~#NBv@Pl`YKl~&q#T8gkEH65lfgyTo9T_WJj;A
zi<rngnJvGf1)8Uc<S|AR-X;9XNFktUp0PPVLIl5UZtU%`^IGgP9B#Uyfx|%9*zsHg
zho)~~+ZMj-dZsYNea>LlI>h^DH~3Q*GqDCoB)!fOc2vJoO?tiZJWxr$nx$4ntdEft
z^c0JHYrVj@(V;k+9F0-$#2ZT>l0J$@OE9EXB~+Y|i#V&;lc!{%z8SENQD+^)r=z(2
z{JQQwd5>-**!{jLSIlSB4^1Bn5;@o*0ND#df_*n~sAmRN;F|XzviCC8%U{VDt-Yoo
zd$k~yEViTf;;J&xh!A0VL#pHt<U*|7hkBc?+>Yol7ZZ|mc^+qxY_Gp7=Y`<Q+pZ;S
zt=?TyXVWOZcAeEn_3rP!hrS72;&PV+3^Ox?wD6o_68HfY9$}#oFczBYw97}xk<pS@
z`(kQ)YxNmgmOpcws56%6^wGzIO3Kw_^UW#pve9eMznpwL=rQhpS;qH@LBH-D$PyCw
zrMc`6Ta5oJ$1oZlb)O!Mo4?@%J-KFG@a(8RBF#e&W9YW33ubu<_hhkOWd?CMDMR+`
zwY1=~SV%+o!RIlUFP>k;JF|ixsP}eoOYtXn!C3F^Z>zVBNAe{zT_bdO7+}J=g&pb|
zm>4|5LWE|-ZHIXg9lm5MF#5GnS<yaSo@FxY%t~PrzF;e)$=)Y#_`cnR@0)~1>oS7t
z?|xCi$NL{XsG|GfTl0MVA=EHzV}02^8oQ<bKyyz%opjp=G<IDHs%oiHh^(xBzc2ET
zsN)_c>R4V8L;i+aAUqzjl03Qq=KTcd)ramb0`)zTiyy2&?AzS)3_HM<AO?1vkmHaD
ziit_NLoLJSe)I_Js~@DRP-iSeZ>2By^BG$Ej*-<C*ZFdvZqK-y3y>hC@#r%cSogt;
z4HnjC=pZCMbt7hDPAs6c4qY7hJi@MH5m(reXIo!@*809!SU<B~x@zYQy6V@{Rh7lN
zZ!kXjc<>Xwf|pa7vv01`ZqrnyR{NRN)xmK5pz}!%YU+??@GC|D4QlFLS5vPOYti@L
zJanx!3b;=Lm*dcJ2zEj{!o+lJ><crnd_QnJ7T$lYwMI`@Bw23-6Y&KI8i3Bj&8I|b
zv4<Uzb+lcBUB=&PS-5IZ>aw|P7GR>AfkP66+fj-O3Gcj@D(q*%2tD+j$v6o^;u@Ix
z%)t&1T}+r~V&Ae&BQS^^x%>g`%o-K*B{yfIs1Don^K8$DzDs?J8m8;JnAx_#j_WfV
z2ApC+eAi`$Vbf?ZH?1-^)qAq~Kvw1^*rP)3{w*KL!M1cqaDL<Z>{c9aZ3tp9OXBiy
zCFBvZdHwn0!RQzB(`PkL^?G*$`&3<1!*AEC{Igl81|Y?n`57!!x1Un^l;r1oq*Ye(
z{tIcHlTyF_j>~XrgPrYYpBaD@gN16{5*v`nw`IwCByxFR*<3Iyz)nD2>`-CjKzIQ*
z9NRES=vu_H1~>2~xx5J^A4Kze9)k0k<?6Oje;d+uTdeLX41;j}3>^@DK~g68UxAZ6
zo$PSJ4({JIF6teSI=zPm;d<Tt%+naGz^4B=XnP;6`*#TQ+f}%J=rXqH1cnoa2Br}U
zv13yo2Q1(?beY8>+Y-X{9s%MR9J7)?rMY!S5YN3{J$B6VL*I`PF&t`}Hg<j2!%h_W
zI20nlf_bL!s2y004La|ag+9NVma}FD4%p{As08<3(ULB_Gt#+5Tybm2W-V>)>?hi;
z&OFjoLyto+9uVDwO24#}hQQ-HtkT~-$n%4hkE!5+@J$~(g80~pd=nEwd`x|V*k<H#
z76cCv>zr?cQ})!vJArn-*9z?CMLa+BZ5sI=Ww1?c76sVhU{SIng6+sMEXVNND2N^@
z@c9;Z>McT_hrRmPx2$D`2J^!Z6Y50Rp*+BWFH9VT%w?A4Fh-og^7MJp7K5efF(9G0
z8LI|B^kX-44S?uoE(XlT=Cv|lHhMn;X5+J&rtdf)`oYTP%%&pnsf`0B0_+%(g$WNW
zY<R9o1^54d_TGKDZ6rw_eU)16_F7c1WLye2yVViy?(uA&=(c@qPoF>9j*hy4!UzP|
z04Q0pXCn4N&hO>+Nls)HuDp|?E~Mayo)Jl)s!+(P%KY-nOw%;IUN`S`^XE~G;9(T&
zo)NulPwKVn4LnhOLabHCS|4sWJ0m?K8a;R7#}n7Ck6p<Qnad2*v~lP#hKWl(90Y{n
zz><vH-1B{NO|qWlKlYW&msT#f3Bs-VnzL2Ho=eSg!{UJ{LGZ%B!o(*wrk>5PD<t)(
zOS#3CN#C-zm(Is}|LA6((Z(lQmPHk^C`+*E8oDUGmRS~wrtApDxcXCNGcG6tisdz2
zgQBtwHaI6!M8!B#MSEo;u%g)4m8JzcJ8Sx?J2^WmZ3FPml$Djy4TVrexE4I4P(HV~
zgzXuW{k0{Chv+iBk=H=)PxOFrYY=5!-u4i4EslCjsnA22otE=IzMuT?J^SHTD6)*k
zX(plg^7k(%I~QQi3pv5;7OVdsO<^)#P8AQjpozfs3_;~;U5ptx7sc%Wo$Mg7JWWId
z4?^SLqdd~(m)D5Oq{86emFxdAWh<8!lyat7R7zNs|Lw0SjX$R=@42S&R5kAH@>t9G
z9FM;R?Yyf{=>#Nzn0bQ*m>A5*%n<?`jzukx5Q8qQ@U{D{V%>FHX(da4mll$x>6KEW
z)}>6>XG-O-ks?~_Z#jtyIbN$JJ|^Add-V)R3EIV%lN(U)UYUmR-D||u!Gn1k$8?g*
zSJfZYFRzj`k*^u$S1>P$fGgAN)xR5tZM*L4FDHt3@_nKCC*K#M?gdr=rg1b%Ud1vj
zx(%W*O$rQL^;ecL`Br|uk+5~YVreX1>wa!7qe8we2mIZalONuw4ZXF0{#@^i@2d?8
zoxX|V^hO~)-@hz`9@@)lj4#z}{Lnc<^0Ez{CV3i1f)+AISF*~HUy@^rjPk3>+n!IE
zBK23NOq2uTEY0dFyH!o?&lyef3Dovdc?yT<vrK4GAT`LBKgKD)Lcd0NF+ev_aS4aS
zmlO3HR2@~r8dk@XN}|8+ylIXK7{WImPt|>&B!552>(rt3c0M>?SHb?HypH6J9&dA>
zo|2draH!HOi=ghfIu$kBE|cT*8ibC<5{@^xF}_7COQ}FqwI!1xgNed$!rh`9Nv~uA
zM|nB^eHWrv!c&WhdY=E16cn$`w0m0sL)0LcLzQ}BIxeQJAXre7c%d{6m$E}HP_Ne3
z+%iI+Gnt45)G}r7qSJ}Y(0~6uqscU;SybHqYXIe}%T=OvsY>zbu94fN0^g`Uo5*rq
zAzQCcRY*INe@$fqid9%Cf%S92UkCumJup7kOPHFy4F!x6DNTb=Obu#c;#m%+t`TA(
zrGT2yH1wWh7Rlu`OXzs4gs>5~_O@I~U02#l0Sn7LC`yE!z>cR|DSs|tCmPnUzp5V%
zN;t5K1&w0m>xgB6Mi~WmPe=Y=S3lCx2wk8tY>^RgIOJ)o_;lM35#>o*$nm7OJ$;{z
zewEiU{-DM@P+MvDJE%9^T>xcy>guvLtqRuVx_ZRw)HAM=?h5JpP3lI_1!7UsZWQKu
zFi<m_0r94Ft)ik9Y0ha(vs0M!cBkWZJA(np#qw+04>A}au!L04`bqwoMhUu#5^(_v
zO*(~>584=@G-<}u4f$(5!XGbYHrN+m)#KAx=3JgGn4KXq1~a8W>!+qU@3TfOB}vgt
z()+B4ol8($ex*#ttvmNx<wSQ;S-LZ#vvDC#rADiumv|~wKF589K;1VKJqIiwEokfo
zf#u6UV&Y4Ii7<TZL(o3A%upJZ=QxHuV6{?hY*pw2yPZ)p5p>_S*v`&ARU2|ek%s&E
zigSLk`L*1dQYO9>Fc{SVj35nb4RJ2K=;kuwmrcV!${weAQE8b)e5;j-CL_R8h$UK}
zi~gvIs2iqEbexb&Bfyqn7?=pt#lB;i*k?paAwnt*;|Q%CcH79NVugTe^;yHc@VPXE
zWT7)Z)OJuKno1V5cr6yqA>y=<qZDMkmcmN<v^YYi4eVQ+*6PPfJ}HFl=pjIm8+=ZA
zMB!>J`{g(eKqTKJLQnCghLYu)w&D4h5zE7bSvIDe8rU)eKVW7+h<E@?{D2H4y@}r0
zTpI3RFM)i|?69lypWM4Ggr0;k)G~XzkJRV*SgO@eBB_=7M`t;h?$K(a%rdEATLJb%
z$HK(n7WU21!mbEihnqHWJ-gpp_lZI6X;UqA293b0A4BliJnCNih+A#hsa7jM$53Ds
z&E;wPt4o@rFDJjz_=aZk%gM0&VgAYwmr;JHudDx@zv|P3j`c;=U#)8f3vn@RA6+as
z7WA|ZyDwwdYH$W3YFeAkK2__ry2%$`FJ}5^U!(hJT~l_9{&>;ShM}ZMGZOV<%iOC9
zp6E|KUUdkudF}VNG0fCwQeHkcecGkHrCoaZ^jGU>^+JP%gfr=4kNX6ZKoIO3CdVRh
z9M83w;|7OZA$Eoyv5-vCp^AhlpMnaQCbPItK9M{M%Pb9I3dXlm+?FsfO4V=(I$L?u
zG?zlLI-=xS=0!Bpsf<9`q7cZQNBREwe^qQc7BY^mWp<18z#6vV3Z~yCuXr90(lb)e
z^;Tqz(D5z7eHRl>3{1EXm{Eg4mRlM6zGYDBImR>I2?B!4R@n<(Rq*1l41&F4FVC(H
zUtX*SXVvLOxAmne!tI;UD3f}d)0E9*gNLmAo7;8REM7I*XahgGx@nvWbyGuz-0;Rr
zNsBR^d}wOxjWQ{dk8;xnz^KnJ(^%wx&(!Ak$68Hjvod-o5l@rtXYbyIQ_#_8`3*M9
zla1cK5}mhcQhcgvfk29+lP$XXkmibou3l_f6zTZn=_{G$(JGlf6;>!I!Ga3|6NgAl
zi6EFcmgjKa4MouVbykCqrS=9c!-Z<6ayQn##J!<|2c``4=-}a^gXaC|UWGnI(8<9l
zYCV+L;E#P#wq;V%C-^!%D3KhkmgiX9AOd{K0TktRCBYOpW*&EiWm?p<E!s!P?=2R!
zijp^-ih{K;Y7XlNujdjhAFzPY&<b%VoDdU}x!AW|h;22U&=-<~Vp*=@KCHF=*N3$}
zU|6e)72PGQbxC#vohPGAa*!hi&Cl^xqiZ=6(pm+uDu2gIbr*`GycnW4Ndc8ufj&_Y
zUcx9YDXr?lK_`}VHmLzvuVIwvF{}-AT^qRi6U=8e1}iu(``7I4yoll$B~q&E6VZ<Q
zg{xI+du=^03D&Iw8z+-2on%0|z29I})$>;V5!ZA)*S8twTzZ(8u7iEw4Y47pXG_cB
z(sz%EzO5I>y$7qJFDI&}m9eTD1*Dep_+ZhfYS`OEqq;%hTLvST2H^2^ILDM(A$ARq
z+uV2DVCf0@JUwi8VFD^?cybY^ZP2b1`zPVS>qANVP|^o-eD<NF2OmnhhvIn7J%cgZ
zLNWURVgeaD(hC{(i7hd)1BMw1Z5%LzF_Q$+BkXu1PgQhZ%c$CO<msHIxIXao$%W{t
z2iPiV)NunsJ#JuAN(Zuq5lp4Uu;tpq^aD;9kw<8D+&yY^vGu*jsL`h^T-(Nfy3#fR
zk673SQ6p41IA8(AuI&=rZ~_+62dEABtl~dc87TJ?;`vmKk3MwskV7|*H*!-_#(e__
z+=dJ=v4w>xGi^*A8WPVBO_M)BUE>4V6d!OqyuaYgr?pG=ysE?HRUJF0y{Ag`RH?Q9
zdaBd`Ql-43)#*&vHCaeqEc{SlV*4JZwoS0fxM6wJ4qajPRH?mFrEC|kB1$Pe>$wo6
zJmHu`1{8;`7h>X27c*)y?2^E;iO;#|_xb<({QnP={~t;?K7sWA4QZ-nF{<J%GgPTR
zKG6_Da8w-?#geKiPJkm%i#ScMc8%E9CBkq{Ly2?!EA*f$v^1Cf`!tt0)jhSZ%?I~T
zabPVc>u+KTFt(bka$Z|w(wwp!ahf1@JE3{rDhKcyWx5i<Wi-0PD&?V?@=h^<ebcZ&
z;O<Z|fCyr8$2G7aJsT5)JD9nqfo)p`j$ugO=j4FhA!<3^OT~cJYTB+&z#8tAYW6{D
z0nAIzHsq^-*p>{#5C@@QV<J3)ea|<sVKM15OBi0bh9lpDc`Yzczjp<^t<1#s2>dIM
zlR0#+{_<&sP0lc|IwJnOa`|_6z6GiLJ9E=#^6%+a<>}BBoIa8N5rH*^C8#NE8%yGO
zn0SG}Ob8nX4rL}49`_u6M0Bc-B$sTeyX5ij+E2Tu?|%YBmwDZ9D-xAqxYUxqhZ%&W
z5ze8It7~H}C8N}LnN1Ek_5Kp8VXv9@JHqrp3HPB-{PeQ!FB8UXNmm}X31bB6S_A3I
za0m{Zz{R!*g<%?u8TJE26df7q>Q08q?!2q5jgBXmHGk#_`n356z`Z)+wE4mmfnk{f
zOP7V1c+3Rd&jObnwM<J`p4+FR+?;&1?``pJ{Huf7Ef1c8H8Zipnc3e{>igMV7P7Er
zyY6XNJq>H_0O*t7FFzdn<o6Gk{C)%aW||d0-fobwwa=7)7tR*tA~0=^c|aUYsN-X1
z5Q&9h_?$X+7|Jyjl$QVabq5*`PZOb%+|u~>D34eaN5$<LR??*6=vJ`xXUbOcjd(hq
z&@3uZo+$s@UsD=?e(>~G3R>#3Tb=O04h+|j*rh(hBmhUUV=_!_%7kDd2w9)qswZtd
zA=1{pB)95>)hc+lHH<D*Yl!|(Ly)3N*IGo=%BPb_niUI)TAFyJ(_-N?!_!3nS(2_4
zH>)IL1uXPUOAzb^fddtG0~{D8#hxo%X}N(NFk>)SOR4%tuIW_zSy2HjlN_w*x`6RC
zxuFTb)a4*F?`lkM(GATq$Zu7sG*|crtRK}(l#K3`O0|7LD<)m;Qd?rfml6{Xs8qi6
zuuDzD^Mx?IbyVnsa*FIPpVa~?)jqOVH6r(LG^(w0Sb1D{o^S}ZAPE5xP$<}?0VYhi
zj8n@c>r#zAGoQsBVY$akW3@R(_xMqgJ&mfTQEjkR`z%)NDaqxtrcw1ttd<rgv`pr@
z92<ryFk!a9jCdgqZAvVIb4o-1$XQo+$zipKb#<7jtL8Putw>j)a7^1VOzg-&VB&}X
z2f`4T3x~LdVKJYF$7f&cHF4EmNmox;qPAsDk&uPd_gqXoDKOzS!@emcHaRg^;9FdB
z(OV(=W=`Et#;UFDjGj4lC<#KIFmvjNiBon6I+}}p12P<#K$>T^hp7~y>shW%%m=6|
z-6J%QOq_ZGn`KX&>WNcN`FQH{SM~X;*8c1BSIz$G^H)7)PEtpDgi8~L)b%iNB*l=V
z6bGJVdp5D8?X8Jq>$y<7<gfDZ3MSOEN?&DgQ`nYAF}Fe!69zR7EYrY_&3(gXj?Kt2
zc(||gSO4ql{Oykk^`CS+d0mo>8t_#^tlK58`Xymtj5XP)6t8D}zNWLY8gZq0ZQZeH
z(W)L#liM45dv=DH<aC-Vqp-?}j8U4+(W%bP)X>k)8r$)70-+*NGQxQ@p2iASQ6}I_
zP5L6EFgPT?@pvkv7@VWCGwt}$IBR}(h9VW;JBt-7qLX^;tg-{q%aZ4WL^`HX0u(L)
z{&E@XJ5|<^*XZo5oO~gZRzEPl`X`CLgRe4G77zjH3m&1FB{2oC5++7HeEsOd*=AI@
z%Gnu$omyj@`9$&vp1R3Kl*xROCV9kS2{Z7I?hLnPHb*=i%Q9UGgd<na{vt=|O@hYd
z#Qt-dTw$HDEHC%-7NHHjtp7^&6x~RMPT`NLfiEYJol6nncpAg}MQQToWPtv2ENFiD
zTHSSa*3NQPPoes<w$9;um7T2owaBJ9ybSPXP_BMHh4`sFh5bG+%0z4G5y!Vs%TZnS
z<wOaG%Feji+?<^)so^+8fBVKSRR$W}6}-UHBBMzTFM5EoX$)=*Xylg<<qOs~re)T#
zno{?&6gB;X5lDFv;e0~JwLj$S>|9ax3gF%pDat2lQKmslD^aaDTg|h8=*9ZgH4=ZB
zrPI-6{SG)yM47Y>7J7+>m&wv#s7tF@o_>Dw<F5mal&|F(zD@ZwuOvke9A0H-t(6``
zB|>Rl)(CAq4lavvRx64{qmj&uR+cw3qLck)aciqRl|}^bdMoCk%?#<=p^ZbE7@$Hp
z*mt;tecSYWTl$o7>p4P{>7?0sVDsWKy6(y;Ezk|f^P&w?XV)(elGesq3s8OuQj&)7
zA<7oCnl{@v2qHx+lk`f!2AGEE<}%`!U56ti7M$kl?2zO084R-xVXCixjxyOoD9ghZ
zeBy~{gPiRU$4+W~4SJ$~yQqRDVRD+2uxx43)!p-P8?G9}USbHmTnvlujEYtZN%@G&
zcv83kgkn)Cf;wr-k|*5a;fFI<4Xb`vMc@vr3HqX_Laz{fH48`AEqysT1;uXg<z#M#
zKFF+k<|agS;p7fGleCcOS85sX`ljR4vgu|R)xSnB>D&;7)h*qw^t9Dau&g<Ct!hfm
z%%4F0zC9h&EBR+Gi$A0Aw4Ac`^&n4hFb}JVfG<=pD~Eu-oV->SwuZ87-r5Uq{>gtp
z#zH~-ATtii-UZ5FS)R_{d4^2GI5*JC&fE`?S-#^Uoj}k~!+>b+oedwZ$Nl2##gcbl
z)nF)FsERPuz1HEyEo~F(Jj{082}J&`xuSaD&hP4twysg1`-%@s9lFYVI&i3cUW^VX
zQhBp`*N3u}J@nzln}rt-?_VAz`fevVBo8fzn~oB|O@(Y4TiiguoxDPp@zlh8^Cw8R
zpWg~GR%{N*qcM#)T<04xtDjmB{V1c8%PkLw(uA`%cn>E<I{9gHOK#DM{8Z2)%8Q6A
zviwHxzOy9F^>=I{x+kEn$n1^}^ScTX-{B!PyJfefwY8UZmvsfZNi?30KSiSifI^xS
zKS!ge$hSDXn^xXt8p)}fupV~lZ6q;CD&#NXZ6sr{lOUhu=``c*CN>tIlY(X=S?qMH
z+7jMpU=&oU<|Z#ldAVA*eNIQCSi-vrX`IVVC+w3h-<C|{c%x3CGybl*(KI$W;dJOs
zYv0?nzsu-a=D$^LLT8g(q!`Jc7Ib&tF*b`(LqNFzH(0A>SA0fKnr=WX>>EDCgs~9&
zu9Vne(s51h21fWS6TzjES)>>~cHlxCjFK;g08<5>F9#MExT)sA#hqY6^k31abwQ?Z
zb{JM(WN9+m7y90#kv$r@BO0k4Z$M4_SuL#|h+GRq&Q95*Vvxp07-UHp(Bpma^<w_5
z_YmaMBklGOWOqJ#2y#~w^1#8F9)j#4$m5st9)j#4$R2{6U7I}w*+Y=sy}E}Ww}c=&
z*59UBq#*^hO~=NjAt@$;NbDP&Voy3$1c3~E|6wx`cjMqqV+DwK>}iYVn5q9+zhgyF
zeJ=4i!U=6(Is{XjdzgsO#msR7%ot_Tcce*|R+ZX4K4+!Wt;fZi#5(9Lcxuo)Iif{$
zEl=OR8=y~9HjZ*Y%$uCFRm29yxRb=TploFV+bXmJot>@j>Ff+mWCqrClZr<X%M}tH
z<wZt|G*i^{_3<GZ2U8^OvinQ|B_1I06kXD57*AO)WQY{C6}p0&A0<YAcBVjl2)+Om
z?5v#DA^OM1U-htxg7V9;4h&dM_de*f=KfvwhcX3`X(Nn&N+-9EzaQ+p#BF8~TX2f~
zfJ;nF>0-t?!vUAf2ppSIOZFjn>u7_02;N>o@D^;NDwqgzOI4fcp0ki|yoq<W@b1nH
z5pa9jyI1bq?R|UIuDv!~=tCBzSyV(2?W3Z#)C3nW5P06MyR?`lQ8IcBK_t^GQ*jbq
zXE7uzXJu}3tmDyYzw6$jg~G~ljO+J$xlN#uONeDy4#9??5)%?Qm<h+hAt!-!7&oOj
z<hrd(m(Gj`<4#s*osb>`x>;eRn|&s)xpHad%aWRJ)O#yU<xFqr6okB#`C+vNbihtI
zA?0-tc%npph~CulKB%*yr)ZoeQITflQfm^XYf6F=Zit^1D25EysFC|>Q9~(N&GA7=
z`8=xOdUfwHje1L_^@{+B-oSTNinJ42LIzfV-O#o$F}wg%!!|Kzq3Z|SbePqr=W3@e
zR9Vj3sSEY&ci(nfIOj$6e4`}k<0t_?Cb~dHnsXY{teqttwOIq>C}|?R27{&v`fcMT
z+CgHiCgxMM{}iWF@n$lakE+vQT8h7*qJCi^d^u^B?@XLq^Fv8_DAK%uv*Gk~LbF`{
z347D&M|z`r`k5AVFgWktG#ECYOCBnGeX(6jtvlxk8EOmqv)oPoeEUupGK|90+0jFM
zlvPH(wI)KxtU)8q4WFtFqr80aGh9H$#wb=K2R#b4wXGY2dB0<TO?KT7jQbrz^)mkP
z@z;lbA^-UJ>w<ykQ{<t?(wtp$BC^5EnD;s}dKjC{i+P{(qRNI=+Zwt+ti4l0)@z!S
zo1ID;(YjXU7l6yleYm_Bj&b#^-dd|~^FmJ4pL+lJXBs8wDoVr!lvzrrpeCHs(P#kS
z^>rUz22g8Qf4nF~ODijb7hf-UN@JOGc{;lx4UGZZpjG{4msdMSd9gAFmR(z}@bc1n
zApiLI>xyw`iJQHrrCu$+wU(0ZlPvD9E#KYiSN1g{k3(aCT4iPHcTRKO2Ujj-HpNj=
zrpsMVi&EEZ8APKCK>SLXj9Yi!V~q(#*_+vBb|^KmP3+@-X)@i%X>S2LJ;je1ARCYV
z9If4H`^QMtKK|&>(A~ceUZ!9(-u@vb(`*typ?A?bBDQ~+TM6|3r}R?p^f>z6Jc-BY
zs2IDxn1iYFvj~f90bB~h*$}%inQNMk!*F0x6BEa_ap1Tnw!p6%P$JktSH{^05IlI;
z@iEJwv}BOoVl~X|&_l*34Z<+MG;jnafkQDRgkzTxPNnbr)LK@C_(&xXLR#g5dY&_N
zns#lus%85@$JPzePw99P%R-7FdP}2N<yM?6>p96%F7sS@T?$%2lD7)BY;Qd(?NwD$
zmZe1z%S5W`pBaMUp;`WfgcTlSYiTuHgL{UHZDK*_rX?}+O^O4{U?CAccSMhMuPoEE
zBi7x8jL~so#^nf05T(=Q1zZt@4+$C%zs%Sm@YRY@+z)I#EED5xHirAbjfY>_7Uh~D
z+zVjbeixwQKJXaYfM|OtEiL4Mg`=94mUa2SBbb?!d5fwX&zF<;#ih)?oDB58&epYH
zrT^PSeaEaPsTI(>=+4c7$MvZv6n*neLgU*a;`#BE>AD}>kpnG8s<-xc(DPNwjQchN
z_o}o{B6+m+!vYZq&m<Jvj>j;e+{TPE58JkDn8N0^Y531E-^SjQHf3k1WE@JR*7<l_
zzwf5O&1}rGmA`;emI-u$Rw!Hg8kLi@wZp4HUZ7>SozGm_y7d=vvB6!xh~b=)xxsBS
z!`!E0si(P`u?u7cGiRF`Wt2b~S3@0VrutuNL4JwWAyf}*X2v#v;QEv3iR}J*$sY6e
zZ@NKfgeJ#kXaeOjWH@jgiG9cLY&$ee-wTckVS1^*`jF<4{_4XLXy|hm0sHrNnTd!O
zyFgBxb=AT?b(dw26%<vojXOZ-PqCy)jYU!51Lx>6z3Ci0icdMpC=iRqRMCP9{Zt(+
zs%Bv7+5t}lgwi9$*X3+%2SwQ;^ohwN<|Z>R5w3}SY5UkVU1}3bd?w5T7Hf!TRFafy
zQPTA-x)L~t(`%VkIlJ{7Q(i*%Dj!%wvxN&UqtPW4meBbfLB3}coVsStX-U{^c)SC2
z9Z@~LM$ju!t)=ct-YSJAi`Z0!R;fZXib9{su@q5L?q-t0EJZX%6P2D)1%^FUu}vqq
zBq?tvveJ}+>xKlIArY9^o`(aEyI5L==Y`y0en@*od}~EK&B|{k<u<%XHLo_AIptjK
zo>4N|i;}Ll_gPgPf>(7(iWT~6dC?HfYw8<my;@gCt=oSQ7aQFPB{4eZ(yH73u4n6`
z%%^d2-aXDXQI$J)^osIRuB^WNq&{YK*%hH7m}lWI5DXIn837!ZVq&{NV41=U0@iQR
zolSaD#q5;9d7!B*2TL~JXV>A=3-FNL;gD@MS=g(8S%bakYj#FL5ZXU<@yCmnRiY@q
z_5S?F3pLL#zBX8ket@}3Ff)xHA-AFYK0D<780x9)!tH(hEQXsW4b(^EPwJu7L0P^C
zjh^t!z9!3)O%=CEuJka9i?vx;Hth7lEzC_+t&*GLaLx!dap3tjCLRwl3oR21DFTax
zCbf*C53L4-Z7vm*21(um2aEDcb(D3h-zspVobNgnK#6%&3Dv_i8zMNG${1FiV>m~@
z{rn!!6x;>2SQy2?G=osly5Og72u^Qkp#=S2DzxvV;#bsJ*9W?!Y7IPUxp@1otw!nk
zxihvbq+Um-v-5(!Ll+C!YA;LsIx1@<*Y#la!wt^S8wC>SRyj>j7}F7=)wJEHjPoje
zLzJU1lYdQRQpC5-9MZg;#{EM#D>GxQURnC(<0@~$b{LLHiEr}2!<73DCd{=k^<9A-
zli4<Ns4v}T=}gsGx@S^SEL>Q#QT-LVST2x(UTSL1sP($hQiDVp>Y2Y4b!>P(Wl+m;
zqiE|jrpEpmbZFn6&LR3>>3vUcdmA;?y`|$VUD%7BC(R05ZiiScJH%LEhs*|ywGEN(
zi0UAEEd(FRw|#+jsY<)B-e~!2HH4vVBL9D);<C&#Ux(f<DQG*W9XR!st)I~)1)Q+F
zLIwD$9e>5O>UVV|oC+&0grCa@-Pu(4YT{r4tca%V%&Cg2{SWwcMkrts|3ihfoi8p4
z&}MBmFZBa&lK#)W?^e$LA{FVB#qzWcH*LR_G8npbE6lbvR~cZg129V0RR`!kCd9$&
zSC8P`x9X49Bb$?qZm@3q(#oUPimz?|tUY{9BysyU<pb0|&FMEUzFy2e>Z0pZQPlbO
z(Ff)pwUxd=dUvwcjr+IOR~p>*dMNifR6*Ui!xh=1Hz-qhV08@2jr9-(JLu)Qm+NJ6
ztu%sOs`cFTyY-Rm)}YJwLanE!7wRJs>N%_I`T4{kpK!0DA77QQc_3jY*(MJy+gr%>
zSTT$?H3hV71*O1^JuRILh)NG{-9ET++q;t=+v~Lv;#KjM9hZR<88ahfm@v=9ff3pm
zB1?#6xWx3?Gw>|y+5EZYq<1S~FQeich*O}-X$M8+5r)4TI{t!O*L5Q7A(Gb;eAMZ5
zq)L9@>bs*P0=|4)1$XH9lJ(i|*|ccY1Q$~nW>XKmOg3LV+By0q;qer*_6t>WCkHpd
z2X#?Zo@ZEo{*+ELF11^_o}`Kz41*9-LIR;O{lCusU(X?vm-ISHr`eNn6<0%30m9q5
ziLJoqrbjq7%)rBhhdySEOKiKLB$jk|X!b19ibYy3ip|!;%tBHhXq-tZW>&(_@0F}W
zP`X4nG)Hu?jNcO<wa>HC=UKUPo|RVa43$jd?k@h}J6YVM+0}14xa$|OK_lny8Te3t
z5re^Sc4yyc3_t7h=C<lI3DfhpQ9|RlikeqNgABU|%g#-Ao2i=Ze!DT-VtEJpz`HNf
zgu1djW(2uW-lf&Yl?hT7pV9MkF!w@-i&Cr1I^0!9e=c;h>n>2$2RPbihVsXY`hoNm
z*4Hc;9{S@&qj8l(eDU>SZqyxKI)Ym(ANb6pG>-m?0sm+37=H$i@n?t95u<0WAG9C+
z2<Y$oF}=3IDgw_70%BR%v892Dv>EnI!^T$Ng~H?>A##o3wdaDq$6bR{rM7?~oF;yo
z%)=&+Uy}1-O7s$kn%o3Jc*sIbq;F&2wj?$~%b+2#JTKUPiC*ijHF{gb?{{e-S(;v{
z^lj_t-}<drL2^<=YZvHARLF5(zf;x7ECf=rfAK|Cu*EcvM#(E+-oC!K`kktL_LD2$
z2{4JO!n}vdofJsX*ARJJrq8*Lf}QZ~D1myNG8xg46jlFOK14i)XazXBaO+#J;--0>
zqh|txgHe{D^g1WXG=Y3QMTG00HAc11vYjx|yH@Sw)L_JyF7}!5F$seJ(&SSd2Hdka
z_dP=#nFByAn8zyGIoJ7y$@6u7SCHo`lt<%ftjxH4fc8|GQ&&u%2WR(Ni?bBeT}pAf
z2IanM_}KG32NMS*misoAE)xc~2@M~@QFX|rIQ1*uCO!EOMao5_b}c1^EzxWC=SqB@
zSLIGv$%mMUy_p+$g1eQ?oSlOWD^;qF?@}xCF8%6F^iwo$frs@V<~%~x#XI$QsPz?>
zl}qdh%<5{1?N?ldJk6e7^$s$3<Dz%emnGaKM@e6n@E}Ua9e5$U<x6|}XBuTvCdW`_
zaq~B`0UCVY;O+uza_hQlhng173T(&mO&7bIQA{kC;K24JW(Ko78Vb%#>&Q*ueU<6j
zq~ZNl=~9w<SVg+Z#kFINE|(H!TbyI&NrH*T7-l95a7au?gr0P*fFHl4-cN4tRme=A
z+Pe+j+#$2KNi0v=B*aV-f{9~#m`cyaoD<J;DG5U9^(fA&G|B2MJaD;^IpeplR`QV5
zO8Pn__f#?KDJcTSoOhYJrej*3iDh6pnD_?4)aE8OTpCJgdEBs;xzL{{cE8cC|CqV)
zyC*`Q8oy7Ce}sGUbIOb#hPD|<ikZV5pw`(qkPgR&>rg6KNL)u8xnT*pSZ8C6%Dh{r
z${q86O_M7Wrm>LOU_anU!+GgaZB#_lqPVBEESf5BY*SrFGh9@YJWaxAG=<o}BCP@i
zJCqwm`++Z7&srTFYEi&2S^Di9{Zi<ZwmE{Nw(5dR)eS+60?hzC$d_<NMI#6XX$`1a
zPVf!X6WH+4<{_au^d}9Qx<)!ZX*q|NR6uImY6$1(r!>hU=!0L<WTYx<Et<3<MgRAd
zW<cLbbS&j{8mS4+JBRJPkR<*&O|EeH3br${g=^b>V0f7Lfxv|OK4!iZV#_r`ZiIob
zjR(Lpk4@d`;NeQTRzxSlI&6NcB63weYN_6Axwy6rP&_=&!4QnyXcEb!s3OfS-ss9@
z)#tf-O54<j-zPI+KlRvm?0IQ)pc=&8BK!6f#x|SvSMdzm#G5ohvjbi5{@bIeBJh4q
zx%L~XfwWGam4R@rw7J6tf-}Q#SbcGo9T;7d5paFslY>yw+sEWFYv|mxiDPkwrSB3<
zLc_$qYuVT_Lt9eQW{f?6>!&}|`$K)BLw&e;9j*TS@6Z3W=YOdl{`T|xKN~ZxQ*o^h
z8~;rfm#N4HT`$$!D9ei`-24JXD(%0{`QK@FFhpNYRE6d*C&NaGW_0xDmAuVoF8;&#
zI#|@zrzzvKkfSuaEjybT!M|NJ-DrCu%joT&u}ntAWw(<*y0?BEpdXMiM0t^MTFkTy
zgMWoOBVXB;8b93hE^XyMI_0WDHE>uLmR5i_RA<0YiqlW9`s-2)N{?>7uav6!S-7}B
z?Xn1<1#f;^t4PAS(srvxy)f4SwDaQYMOo?({qaHxWjA5}sz%$z0cK{SRT`lCynV8Q
zqfS;ZD?!gLZGqjVEjY^Dq7RVa`~XudAKh!d|CHbTTYfg_L+%XrY?C>JS;Pu$!^AuY
zJxt6nz?6D6Hf*2xOgO%z^2ptrxXj>@$?HhoR3z%t-)MHFtdDmokfsNV<C{11XDYXd
z3O3fgXn#nV+Yve$)9gwLT>y}xM0Hs@+s@HvRXMXWoXQbL<2+SWDw#wDy^;x{(;^+y
zBH}7ds%r3!{z~~-u4P_CFjTlXfmr^0k|sG6(ER1&486Ra!?hf%@|3Dn21@XBFpGW!
z$Q>|EBCzeWt2Lb#JcU@id^&;4ls7S>Nj{;OO!#e;CLn`VmKRTifDUg0moH#D@1o}u
z7Mh-k9h*u_z|Y7mW?(Pmj$sEPv~2Up*AnH7{ZouD{Ts!Jwr#t2+qP}n-M_YN?zU~)
zwr$(C?cLb>^!uMVGm}hCa&9WA)J5HVldAQswLXterjlP&?bB@~weOa@wx}sM*GVAZ
zAh*8&#4q<>ij%GiTfSCp-hQ!vX>jyLxqZiGO2FQf#>^{LPZTU6z|qvYX2Mv5u7P+<
zJqbb*RD}_w!V(v%lk_OaDWi5%R|t?Pc`wH*BIh(4LpdfvltV+m?*4uK-b7uS1qOM#
z@B8=kd%2GAYW>L)_!A0eiStm2d*<KU@4s{V5!DUavaLFRRz};oSKDipt&w47TfBFS
zfn0QyD8{v>KuF40pI?&y@SuxZ;;xK~q-36qbfrpn-}O}swG!1b%_?bu30F`)%Qe<@
zd$gLT<@RXJTfp|~HT$#dYn3@YV*qrn=dJcwE}0+kC8!zb3Bf}29sj=UFSV&Mqo%}1
z*EIdI`n$(9g<J7l7OWa>YUzFpgi%hYPaeOrs`=Z76t_U?t$x`U#L{1i{|>7*rN;4l
zYV5^DA$H5yKj1Ae3c|(hdn%;-s^t|D)U6uh5|C_}=$T*u63C?>N*{vY!Kd#X4wM0$
z>3W6K3>dghQz`^YOYx!}6tr}3oP?H!vakr}#J7C=i<lt9jKJ$P54?5YLW;2Ee^{|q
zo(=&*{9Pg0s_k&-v9_;8YWA^J(_WMPgYv<eUAK%&!91cp2U+!|gRPB-Bcgm&plEfo
z6t|LdZy<UK>t&S`Gq06vI+u^<RuaA+Pxi#mv{lw%sLDH<Wh20FEY4ObB^U(B=unqK
z6mLGn>Xe>welFFkl&1(6QBfIBc)X{Z7T}O?iQZNzk`*627&v~wtcnkOTk59*xO$d`
zTOYe6avGbOQbrbS+v>|0>^tg%skrTcnzP9VzHR-eKn4%CAkcSrz=syPpib;l;m!jD
zj_!(P-2{FxxdsX4SoP>1R#q(}98M^_SZH@2Jh0jT-wTLscwLhF9#9BXfvZVkLRz_c
z@lF%?VfYIxSEWW|+Rko>EyyakyhYRd%g`kxF=)`6s!B?>v<4?7w#p@DC95O>*Lmuc
zQV}ukn?h@cB;izp0L~b$;(lsS8FJ<$W~yJ!R!W_jQheI;0t_@?>fa$vlzqY-)P+un
zTGp-8y9Q#SrKr3Om%>3?+z4Q%`(7*{6HJaJAr;ABVW~&bTQ40*^7gf=hEm$CYd>`8
zL93nN>d5-nD7%22%arm#Yi%XG8)tRjZ|CHd>MjO~lN}lbot^tFTKua?)w(;ZQx~9>
zwa_c<g)y8V779{}kYpDFTfYWjD{W9+(l!`=Jr5aJVO!UivoJFjhz#Wa#0qN=J9_#C
zzpXwy=D9^aFt<plAzXr5Ph_dl>h(<2dGSg53uC}L7mL$=@NBLp*?02`yl%-UNJ^5@
zT8FlSz=vILz$)pp$x;z{)-24=lqf5+xGuppns#{h@7fY_T#gI3d-=`t<ixkV3C$aE
zl>KyE?iOlWyJPiywA@8&C-v?GjR`ic^ia@)M;@fsCzM6E_W*Kh!DHuQiTp39S2#-}
zVjoDB2`o44CL2SpL6iZdeA7Ns;?CIN<WZLX4St}ea?9?Z93>*=3{W6PtaB}{>mcE|
z=kzwQxpJCsMMX$hL(X(CWx!q%2D_fH4GO2*{tsOG`_}>soq3h$XGD>O{quYtX!I(b
zWuKDFj*b_pU7n;am8Xu7V~%$&BZfw76X<Bl-iw7U_g_UdYISjU)>OiR@(Ge+>)VBP
zf*2i2D&OYwqahYPoVR1e5Q3Pih4$IRoBtkdfuyZN#60l{pp_Om!Fs1dX#g<Nf!VPP
z6FZlm@sI8o+6@wki#TV*KgAC>*L5OfRQYZQU9OtHq5&K)$Cm7y$R1C8m+8Gy^^jZ~
z5oETqWG#$LwrQVszpnRzm5&Jd?^_kS34uLmB<4lz`JUbGNZU&qSA*<7!S*ICZzml1
zzSQ$V`LJs#hVTUlSeigzUD}O*A0WzxT@@6CnF$JjZP~XAC>tw;bs+{D;X=*6mh2}p
z%0?I(8%Yy>ZX2y1g`#pY*Jnt?Aq8eplh`0)ZOeLpf*(xsCPg_mYDwNs9Gb0c+dyV>
zVX$DiW4#uOFcu($m){xYd9}*;+HD9KT=`;f>X3zI1)2Ivb@Uc*JJV6Mk)f=W_FRl`
z$WSd6H;u?L`$Fbxe$<hzue73{tXf-8{4w=<A}@HbMSkc${#(~q6+WumQ*00Z%Z_i%
zI`8741!}tv-cR5`Y8NAfD>oDR>x)=N%0RpXal^~U8h}fpCLNVEn7EE1YGkAd_Bq_>
zu+KBy$oUk0hS!_0xlG~xo34o#<TWJTQ0+*UjB6`sgnP!c%p!nY3im3X6%%8lT$)Ul
zB`3;mo_f7rr^8cHel58TLq(62Z{ZK4<I8yxYwSCn^c0t+l1eb`vZCQ=<3in|_9*v{
zPx1S2z8wKIdZXH)MvSN=v`sSQM2cxm<(fv%FLH(p*JSyoG9!g6sfw|-941>RWX3ER
zJP&fx5OX-lR{sxJd5igZlu;4dd{Dyz8)F8IjF}fY)7N)0wH=}DfzZVBP+_)s=DVsy
z=LW%fZ<X%4+mGz3uC}+U-(CLGkMrK{WovtN^^<FOaJVb}d*kVKv)9bAk0WbQ8?`!X
z=es&<s%OiD4A0?6&j@V7I!8<4LMNRx44Rrzy%NZ|*2U}5!T7|Pf?ou3>z~1I7K4cq
z7pVPs0FZQS9SdB_0aiF7J$a&=r~qhWg3{azfG~*FX8>HWLL7lKP{{%IFK8=4w%B?c
zLI1H^3+ormF;JrNi*;ln2fm?)b_zxgi|~k>jdU&ckzvN^ct<Lqy*uRKFmWWWaR9%{
zqwZ-u_LF4Dm*_#Ek=bOl8mzA^b9OD!w!DF}686+krJ$s7N8S0xy8RrV$-E#0i}$DY
zG~h<dA+LNu_bdt!)G<^s2LA!aa%m8UYja;`PW0S9P}tp|pU3%HjymQBpI-w2#qcPg
zpta#n?FXv|#ZZndxyU4frD6*Aey<N;mz+#oQ!GJ={&vj7%mM<3bqG{%QjC_tY}9D=
zQ&GpQ1y$~vhAln{VW)TP%Vs8o&L{_|l`GxU6$qCVcOeD$CzNBF^~qFl@$5FNQr^}4
ztmvNyIir=e5jAF2;_NUpTGlH<&f&$r<TEi@sB@Y^k<mv|4Em`SwFX5T;HGl{kL2Dk
z50wpa1oBJS$aUQ919nW8T3)vPD7<C{y%Zf=LbOb16mzVsQMLh==F0*xaMejQ(pv4l
z#dK{{fqdJo|2*|jgxsk6Ewi`<R0BE~wiGd%wLTklGy|!@`;4GIGPSlEZ`y01cQ#j-
zYd0|svLKh`rc20kEJd`EeDNoX+)nw;QyVW{U)(<iQQ}HDZIzkSY2<?6Tkkf&P_uB-
z*Fz&fiLgrPiMErrnLxazQwOrOb3@PNlob6!9xdP^4g~pXT`p2)hqXuw5VCWCqHED!
zN=FtAiAx<Ui2YzgMd<&qMn&p~+FOvLO5%=QcnB9MCFT_=EI~J?k$B1-RoIcir|of1
zEGmhQ8Aq641!n%P>4WSkU}YrExLV)d+N_^9Oja01$-fjkUhtss?k@|V0VNsEy$Vjp
z+V1Cn(6zzky$5UPuzlh0)AANna52`Y%np}1ap#(7D>||-KV+a;P`voWy_o$t<gx61
zntY`uk+{RiD||q)E?X<|J`4T3cC|ng8>t`XXI0UaOE=43<z`bWr*evthZ+e@K~KKj
z<hUOS@#-@OI%<m5erjdw^(W3C?Yr4WS<n^(8Bc@tFW)2y#)uN|fC!CSVUm>E$FUw4
zQy!Jh%R2=xzJditinjaz-3$RnS7+<h1=V@bT%o}=y>JO+WR?qF`1xhdupda73d>Jh
zHyfXrNH-%%vArB-CEru$UkipQDX?>*BV~GLni<|4X)q$6q?H^#TO>yF&UTbdzcP~M
zMU7J2>^)(ksy5ZiOl#?J;a|<N$-=gd$x!!_;V<?q?ja+Dz>lgfrl3B8{X2xE@w*bL
zJ&>8vtrlIbxl=O<+tsRI(M!bKyvqBhXT#-Y6{rIf0z9UK@}JqP%A&C5%-zyhem&jj
z{i`R02|pkM{EI{NTr(qvs&F32gnABVDe?4NPy3O(pdcfmRLgQc2k+$65XXIkPk5bM
z&;uxHmKdC{cAZI@B8h<xnH!@tw4M<fBodS&d7b5J{sqjr+~KWvxw@;iMZNi=t2v%l
zuI?{__gQDUO3#q`Np*4f>fs`V6497-!pT^0NUz46|1z+{!^ts(ONd6Pq0bu*Qwy$f
z?kH2v@uS*{#LH9_sob%(_#gCX8RGp(R_~X)P{Xa-&yT4I#Cj@U1Cx_~QJt9MTtSw2
zF^L)ta8Y(al(I=6BClEhR}Chi=l@-U!LTu>p7vX<`~IF1J}2s_9(`4w3H-qQ>%Fwg
z!Htf{%r#*`p9C_It+MVXdhshe`8%~sDT{I14p+1?-X(ezMfd1G!^R(&PzEXe)XQBs
zkHM5)$&n|5GsgJd+o0@$P0$5f5qB&}(~qX(Bjd{&hiYEdFKZkQ(E6hm;gtAK(&`D#
z<{LVHO+Hb*_pyDYM9+KRU@nl-SNs(jF7*UU$2!$g6<nKN^T-s{4Z!0vLa{S;oUALx
z8gzr{b(6EApO`wLJhMa*FS0DP=VsUw@<!pBY1ElP9iJzSQjS@vctqWwm@8wNze8RT
z1#;ybcJvB5qGZSq_1_Fz@#BwFfw1%0;pq$RbfKQuB~9`-&&TD2r0DNo{jg!pRn*V^
zJ=aLM-`B(f#6D`wX)3yLP}RiptR!b_{kkkO`XWPLg`=t#wX(iM8mD@oi$#+tl>l6r
zZnknBX<5ivjAp7V+fhw{7eP5!YBi?k$7);t*w*TdpAakbiY5u}Q83Le#|(fD8}~QH
zeg`Jkm6Vm68mm>%+u|sJ3U=?8e7_#`_p`Ukr)0bulU<}q*e(AS1l{q{dX#~w>KX?^
zgA6Iv<0HejhF$=;NPPDzp`b4m!WXr$E^kVRL1YD7LIr5+-jaFcvl*YD1*-l1yu+3&
zWeP!mt^+R2=RDz7^$!1W!Zq+O3I#i+n5rSu*L}i&DpHzP#!2Nq<m=p|iq`u&z(cX?
zs(di`WjLRzM8Y9>CBHV#&X-6#m8H$7tZvwHLqlX031U!iioVzxjyVrk2$rw47d&Xe
zr=?pYE5Bh^yJr&?uY*=nqZUbfZL=}Fq{5c4R<)aqD6}SxxOO3Z`T$B7ZGTZpon?OQ
zvf7+()rM492B$L~8eMV`yw>#Z4?BTg-t)hgf)B&ujI@Qvj_u1;uB|+(70+&+qIMT{
z+DuaxL3f_hXRWQo{Uj1x)Yk+cl&0j(=fBwf_+k@P+IbnyJ(#grYv%2@nuYu5Y(iqi
z&p~1adL#T{iOg}d0tbft%H@k0=mv$*2_KTH_~yJImm$8(HphQL20}?Tg(Cy(uZaNM
z711el<qPAikR7<t6RiIw2nYrQ`2TL=`0w@*dcn<PJe-IoWLZ&(VTQMu{w`Nnqw2!8
z0Mu9y(c)K4O^vAO!)eEVs57KqZgt0_zL?Y8jjJVx!!n{SQel0Txv=60#+&a*aKM$Z
zRSW1-{!zlC!<ovSTB_BAj|rHp`w1-kv3|B@sIwq9{yX^b0v7{Jd&8=-F2Vxtf@`<d
zB=d$X5uy4q2EkEv)k^Adf|8tKK$YZpHQU47<ATXH3hK&froMBU%wW3Jimi#5XWaD3
zsXeZCeUxXvck_%VU<T+CNT3MNoXjC0Rnyr*^^E+P`!A>J?TsfT(Y9>e-qR*ovPa}?
z%2fOSXmiihK|Jn{_2=+&CHo2}o<&!5Hr0-wX}pLLRV<mqdSNYWt=HuKK=Vn~!0*-p
zZ2QGMeu%MGxz~Ymt-naXy=}EGMxFT94$-m-Mi?JV{Xs?AIpOG}^)9)X&z<w#Hlh{r
zZ*PB1nmx!vB8ViD(4vpdpvG<^qA-0q6}J9i<C3@q55`*k_s^fNtsv~+TEhP*E4w1c
zzh3MP_Aw|~qfQc~@qCt_z`A0FKjL=9<g9-${<4OukC!tr8j^q3#yjmOddKJlc|DtC
z%ml!d?Qrc;8W(ZHv!2!)lH<=q0LvTpC^8$`7op&HT0Rlbh|s$+`oxZE1VWLa-7V+v
zN1e|?`KyALFb8n~GQ<DLEZk2y_63A@%ia=AW?|W;%GWoE_Jny3{j)EBL=}8|nx{`&
zh^#IAf9ZrrniIHGt<+r!*$Crn%6hBbwr4}F>B8&|g40lQz#&Tj6{4JtCIZKgoj;ci
z8ka;(!<rn1(fv^SL#PmQ36w3%KDNVB9fHxyrZE&Js#?O(l~6^jK)xy?7D2Mm_^@iL
zfw920lZ3-l#s(bX5FzlM8b^fzJKJtSebv7O?+Qg|;1X_^uX*5HBF2E-6few$8|IDg
z|L_)7rC(vdTU$NMg!>?RFuL@ke3c;|PAiS~Gh69EBIr<<Wn~qNtegYHu-=6g2lbAC
z15*%-5oBFy(;!!L{nA2gs_9U>tLxp}5kc{H$sV2C#hTA%rSy?D?O1f$(`u$G3(4JF
zwb9EIsv29adK9V_%hWQ^QEVf+)woPrr3seG^mv;c=6Q6yv#O{Ay`mimvspy}DCq=d
z^qA|vrdx{*p@nCRjgs68KvX-kbyD!SpC6l=6e3UHxus*QT_=v<ZR$xkk6BZT%ESE`
zwM|tl#nxh8fFLBr7%$?{#A<3FSyM+$Ve-M~E^(t|xN>C%J)E&0WQtGJLs%sJGKw9!
z0|AgDW2?*d;b0M#xkG$wtg)gr;KqFU67n^RlCE3?+p^=S=;$B^iGn!m?jixu96qul
zLiH{krdZRg9e4a9dS5f#K8L5wGi1_D7HC5G{Vmg?!>%^w9TuTo<JY($)hSVyv{W8x
z2bGVpAx1EdTiT-3>aEz~Gr!ibrj?yIbRnARdt&CdwKAY-RPQ(JtY+SiP`V9k@An3I
zw9_`9*1oHw8n@Ni{v|T<{f51}so8}0TVtrZm7dZ0>{z~<XFZ7dd5!G)Xi`hSmZu$Y
z=#&*@ZQiY6)7rmM(_5p@j9`c+*8gnAUCYKV-!yhek>`Pr;=(mQ^#SW0@y@=To?H`&
z<kK+$3d$Gj%)DMo7=<F;Sc;LGi|M)`q7RUQZm2?JL$W9a3TJx&{qX)xSZmaIVc=5e
z`57fcVKAl_%05NG@2m{`^#n8S3*I5fmq@_&NvUH%G!gS`43RQ$Q`ru3HqjE}Ec~<b
z9g~QO`t41m%5IOJ5_F{a(EO3-1G?UHEHc!My+HG~@nxm_k%Jr?yrcjtb(sjqMh<cN
z7tg#lwcObar0))7Z$#32htpo%0MMQEVv~%m6|S$<(wOuFYqvy$e&Zi}BY5>H%!MK}
zB~AxKB?7reu(s(Lg`nQ?>jTmTou8fWDomqnyc5&@hANT)5qGe7?}3JST5ee5{ZP7h
z;SVx;f9@CNr>Ku^mjW27komB`l;JJRpA)kRsN`sd2lExdR~sDxUKp=(dyl+P8?E0!
z_g_i{X;u@w>~0kh3nXbe#A#NmUfYdhbQ(vgbW9gYQ$yl(Eq+a?W*r1wmrPRxP1j6Q
zB~?cm520SujebOYW`Dj!o5yIgDlV9&Vul}}(o?-bTwBAb-8v2ue!^04ROI9>4fdL7
zJgp+KJik=EUXhPd;*YK#_9uUG-3pME!3(_D=_n9QEYjFN8&|+#>*aprDHJ>&*5XL$
zozj$RI-22J!!|-maLD8OFS6)@G0L`KO2b93@WwDo4Uy!S<Y%Z8Ly~0aq6^?j@J=Cx
zN}JO{3bopK@z4HI35nlc$|sW>mtxNkV$G10KV6c!p^_&b;7M#wb7vprk6a260zeit
zF6!2cBa#OS<S?|H0G#J}Fl4U4EUVeGx7v^@Nm`SGsWG8T(&RVJi5N{$Hj|DUJv_~O
zgC0l=toA7^OhN0z6b?-^O0HSPv6v4}lvyRQ8#=TzLRqyqs<772`p9qFc?sSUURN&=
zN4Db|AjvIf-yv4nYpFp-!|WqLFBIHtSQ#+#hwq^|qk3I-q4-@5N+T_kwqV@UW8q@Q
zZmMSe$%fEhMb!Z`FRhwIsiv#)@soy8Sa4X9T0->yRraAnjD@pg99|l?9aQEJgtiY+
z_8%w48M{VSWNj$AdNC#Uia~H8T$u_=1F+5M-E{Y0Ww*>|&z<RJ$zgR`j;yFaGAvEJ
z?4D}gcE56!BlsprFNf^1pT+5J1nzzGCWr0fYE+FNzAEXzoQW{jxmFE)dd}HZ)9|aB
z(!Vz(1PR$R%l2NIqI}4GHL23GaTUmgDU3hpa1_SuS@bME&MeT-@7ZT|?R-r{09gP*
zqd&n=1OVY*rhRuzviQ{Xw$dyv*oMPzxrWWlhuu{GkYt=CaW7?G^(y73%=r3g3`#YR
z^!T%4eZCPKHj7e8Ih8^&-|jA9P9KV>EY_~db!4L;@!35V#SOpzZ2wiE-UTdnxr%2Y
zt=v1AA?LHwt{K%Cx4s=sw^Vn<)1*xuyD~LyH}h*}2E%qqueSMN*QatTLYD`-F#I{+
zjf<!{Oy{HXVnT7o$e+X`27K+>tws)UkK3O0+t|t8b<1avjN*2nWZS}}?L_*o&=7cy
z&~(n_p=im74%BsiSf5iQ;}-S4ud$LA&a^qG@;hP>?9zujC4vUZ*vPGwLm%b}l&zJP
z@&AV!mG}QYTTJpAyUsrX+-h5wpO7ZkdH`4D>*&PyQmq5~qbSh!w=7G8x|s%CLu5g{
zY#0~&X{o)@Aq0CVIdsa3Iat9}aBH6lNa~N)+;6cT)22eYy6I>od!wf#m06-u6S2?X
zb1&2vPT5k7w7A*)AHpE2hOboR>OX`*#N2-fgLRGn6Jd}X4*35=yG1y;`x;oZt-Xbm
zdk2svrH?L9dZJI&pR<P#vQjYy$M!WwPqaNg#YBszjnJfy9=6<`oibA&Upe*f`Eva+
z9Hl9n+!jKPZv8DEb8JfV9Ivl#>|J42;5J9a!dJ)ps^x_beeyM92zM`$U=`H!2**J%
z(AlrQMWv~(yl?;tNRW5V5aKy+3pcmS4F&(u3dLc8#C-o`jBXcgy;ALnVz6dthLN`5
z%Cj^*YTAO&G*-c1K~fQf-lTtUw>+sgY4h?w^ZMXc`(%#rz(7ZaEEkdnt|N>okW@rD
zIbt3>P##51@3X`}Z!3>?*><7}y!+u5xUf#<%kI1Kq!VY2G7}cchAI(fVI;3H2O9Jb
zPZp;;RfL8Q(ki>>7X1s<jM~s7)gJ$^nV3;h*j+MS>REsjNfxp_BPT#aSGb^xpp;wa
zm?<h&85Buxim+s0f(-ea(?c3NhNy{3QiAP0tGqpU&S)~~oSWKiZr}v=UrvtDNZJF|
zZurkv+{e|ebgViL6e9L2zyLH8PQPhE5~K(C^rz}m4ec>VnY5PBt%M>xr0C?4gVV7j
zhEee|`lx^X%H3NL+2YPz?sx2w?_Z;Cf@gyk0c*W49$sc6BWHhNMAZc>HKpH!P{WOJ
z0y6ujTZ8yTHg3s6kfz*yxf8HI?)uDGGe*&h9}I%PTM)LanWh&Vo3aGEmH5$x$tm+h
zHIR5*q6$St_j@GJ$R5qi3W(&(DrL{$ZS0fa)J3KW=2Aedpyao)aF7zmlnPftdF4p5
z7c^}XCdya%|L0hG$NE{<6_r;5^yv#T=!ld4kjjC5SmQiYVZpSvXh%Q#z=+~wmwE|w
zhs07bG~>Cg?(9TBJsIi8cvoc`x}B>?;n~FZkCFal3<DS&ZpQnaK)0N3@+Agzf<c5x
zIB_x$V`fg<<$&GFg%~F(k8SU&%m1gn0<u@9WYF^2H97u&$}ZqJ+Nl0J8cbCgO+6bF
zw=5A_B7vx?TF8C#JQvh;UktBrsR{L*Ndl8{Ke}^}hS#akc7@Dj2AUwa^BU`wzp!a(
zi>mr?Td5!FG7>Mg`r{EFDsg9dmdW{5l*pL*z-21)qw*IPtbz`@s=h7*+pG0|Jqlve
z!3$J*OB$v-c-7{(L`P-uG+6vHpK@Ir(9%jWir=*Q`O*Z-KU0{o+itgMAVu7j4)9>X
z%#8U%8{3ly2o*{WC9b1hzMG}CQzEw(JCh0OsS4sfLTy73+;lIE4?oBebk_y~;AG>x
zdFyjT=z(j=tjI85m&8LZvle$5587L$F&_+g7>aOH2u+(t&aPlylPUxG>ZsS}RBP=k
zkoSe*kDg0e*`HW*)dl^T`w6nnv|&zSO)vP!;kF)qu07cYNKJ@JV+{}b4Tlp03_C-4
z@9RP0r|^6&Cf9DUWcHIeXJ$+{f02<X84JM;up@)wG)|m>f>#0sR1PhM=M^*JBF6~n
zwxB~iKy0>E(S0#(r$|!eM*4$<NGj~7qEORe02z<B;syN255}Y)B7zUO@}g(E?lpUw
zOnlSPlCwhHsG0oE=I+f8X4&iseS&C7aRom+ePTE?3hKI59RH&)SI|5D{Y2*^;9Y62
z#L4~)V)zcXmFOh<>pgO_AjDR>d`9>X>kC-^8T3F~J*<mA{kCM-w~vPZv{sXV{~pCp
z%lZA>+U%i#eWoT>VSzJ2Tu<M}mOz$63876DXC*{W6C&KxxA(f}w4d(`<ag;OSd|)I
zlF5cdyw*YN>InuFdixnx?0thAA1Eq0X=%V6KwKmYCtK1kiR6)cuAe|{XTvtJmzwuB
zwnKla(THZTr?R?c!9b;hGRBPUy04VADE~+X?IaU3Y>Bit<TM!Wf|VZ4QN%j~y-Mnv
zSBgRf&;=Arf-0Jj+Uw>`7K<`P%z!Q;Rx$rh$ZLe|@H<IWVJVtl0!s`$+7f0=+b2r(
z`$S@nLZ>#VvV6;q=)n%avUE>-4MoHV9UM@B%)M?DjbisF7j2G-RKKRVMXZihAKs>l
zn!5@XBsGz5+e1in<gvPOhHi^Al`gEle|Teb&~sDm)V!#$(|zSZL4=XDP>M9E@B=|F
zpF?-X<z*%pG%y)cb0j#$%`|fw-hH5bvq;hXAD(H+arx_SDJ&#r^QYWPv}~@<;y*re
ze;(LU_sAW-&$JV{8Jt=(20U9>Fe?i6iw`PtS7Ki<e)uWpk<YF}-jpnLpnLhso>lWc
zI|H{BGFRluEIof+5ItqQ_db=jf_!J*c1d{$4_U{ObC)m0nkDE6Ht@E{zh+rUUGc~r
z0NyC5VNlb$vrO<{X9ZBUMqXpE1~vu&Z^Hc%2-g;kLd-Ee?JhJcy<kg;U?Hd^#ZgAp
zh0)<h*=xwbF@6p(Oj@)6AE4On1Y$VTkejg~%*@M8zRvsV`4IV&GyHn+o~^g>!Ea(%
zU(-{vrzH|th1Ct4H!k$J#%tR++Uo3@T*L>Pccf3oL3Ro;&Rii7Y4FtPXU2rupb7<O
zvsgwvGtSV7k%vMUowR`+$nyHqkDDP-7==P0J9HaJa22;96ud+5=|rF?EnxD}=O4d~
z;55Jzf}929_RS_luK`RC^6eo%xD&!Ij+B>%v_LQ474nym?LA-Y{1KElJoY6v45Whg
zontV8geH9@pNOHG{zrS{SpbR4b={01*rDQ7Gi?OCOi5r!GD;{7BU|`^v?2B&k%U&Q
zlN?5}ccps85ZY^^)8T=&$}M@id##+MXDqgpbiG_hPz0**d)yTu@3Yi0-4D<)$J{V1
zEVV8AH<bH~igc3t&O0G(gOb>GQ*DE8zy!2njv;_CHx!9!>Gt3T(nXq07f4DcWn0)v
zXU8f+aXJuW0VS9w@S0!Ei;pdv(EcS-3=^Nmjb*D@PW2yLO^Sf4^Y{$Pq5&a`>H;0_
zQjhsRH5kk^#UDC)eYMTOV6Zp-fnvqmUr@gsPYA5R-zM>&e|%o)+|B;ogdyTF!-^|;
z;G9gb#wu(*GW#d<=>c~Njv`^7jUrXRZI<nr|7Xi*<DQ$I)e<#A1Z{vYUWwqDQ8O1t
zWoT`(4hq48rx;(D;a$frVokF}^wMm7^+(M}!CYAmQWt$^1&_9g4L>PwX#dtgjwwMI
zwg>NCKvXjYQbYfRGZhz?99Im9>E&P;ko`=sKSn|2;?^eu=f(KVe}0f}jj>baGKaUy
zGr{3$A?X3j>48V4Q!V&?si03Z#d*j|<(ryZB>r@(IhNK1%tEKJ|En2K7K)7#RyROz
z2+dCre+^;ASm;GnD7R+5J45xSo6RicxKRi}Z)I@{QN3T2(1U`!jj>iW>cH8)+v-oy
z6x8op(T_m_K~7GTF3mH%U9@c~G!7CcU?5mW6R~yZ`O!Ob-%X#$0o#)@KIAK6@Bb?R
z`=2<}_@eLf`xcA5Wg|FTyCVH+QNRa#2t=*Lfj?uP(>9E^&buhz>zeUz9z6dV&{_rG
zMbxNVVfJZ)&#Q*MqZ*A}<KI7zQD%ScNkBNj)mwqT;pU2_+2F6=l>x-GxSzdK4FE%c
zwr*(ZeJs#(7WI;IUAe)^@le8Bel_bdxyo&tD4#6kG0ngbMaYX<Q#1a$1U|-k0BZv<
z+f;Zmc`1EMgJI~h^NoM#Todij7BS62-?R&OoTX!o2<jn8^#GO{H#Bk&=_-Ou!u6Wo
zE?P^(V!qUpC}}AT;mQtAKGrwgf)4U3`yDl!hCAIioXI7lHc+rq`{nhtzus56y)%qF
z8*Z6(-t=2a&KuGlT%w(EZDNhtWu}4rebn5(f`^WWp|G<FBHPklr~3g#VRKoaYFgr3
zKt#Dzcy{0r2>6Bolyy9oJ!U3nn?opazO7~iLa0AvRLqfk=0!b^`GsIMeB3f2)E%;2
z$OXh~i>$aev1!XgAp0hn)9IyLhc1<sV{=+{3gALY&hchN_*5#T_22QF{1^rCNTpZC
z)Vu*D&w5j7y(A@XK1#`a(6$lPs?!zH7KEWZYOk&7d}=0W7+wl_UT)77+O!Cvf+eOc
zGx?Rp?lLeby*Ck#<&$p>jDd|f4urxRVT!K~;~&3$l@34yMa<ay31GO^&v%DHguRH>
z6pF2&%@v9-fro1t(`*GrPdkMKdyqZ@B$$|FF;y%bX?>R9ZE@oJjjE8-P6Yh)UY8#6
z5%STI2MA>U<GL9s;i0!x#RVowrQn?CadG@VEj)nn|83#@5AJ4%L&3wl_GPUCy_)7;
zf!I8gJxe__9cM|tO1wuSu4zV8G}tPqVuY;;hbj#+9n4sN##L~@lg;^;8O%;=O9rx+
zKzJ9<(i&j=%pPf~#@;QpkzKT;0A%hfSyYTwIF}gf4DQyga6G5wQX|7Z^c(Bwa&9gy
zL0cMNYak(9(7{!#6(|siW<@5>D_zEQ+-84*H-~(pm3emF_OrkS9(H(%vy^s5nw6sz
zoO8e_S>aEKG{G*8E?aQ{PCia$;Ld*E{}+ab3Qy*xf|hI$iw*-C@i(<?AzGy6^;_n3
z=!cCb;KSEL8!7eo@?=VLk(P^4BQ592<x82|BeM^Ud3j;O5=&gyXv<aq6peX_t>=hw
z#(`hTky<zu_8dedRX$3{dR#!hsJ&k)u(rr1b0}FId$XvR<@wb9xs54FSkiHBP9%wV
zQ0-vK3@}9q`{Nn*Vr*OLL>Y0FGPO5Rsz|C~P_g+b;BNoth7uh8A8zP;FwBW#dF_rT
z%`x+F@+Uun?cC@v3BOrrv8LD0zOP!kko8Y>i#=DG?cJSuH&#}et23vP@}83(ZMtzc
z{PJ0*luH?plS%9~?M8;H5}0@L>I{vNJRt+V|C(}mt1fca-Nhgam5(+}F_$g+1|{9N
zTxC+kA+H9cmd;G7&gtWD3MLpOAilFeT{ET-BRIlTVi%u5zTA29*VM5nT0AV`*de3=
z|GwX%$(Pd2lpH_ne*XBQPmx~W&L-_wLJbDb`bZ764ayuWfy&FEMJ>z?5>;HSai{)D
zrDR$#UgMbljTl@rkiG~0m|O_6s+_+l`)QQ-{`)hQW+e=1ARl_}3!&M^h1JTl`0kZV
zVM#QWbolz*<ir9Jorl<p8%_|Id3tL|Ew<Ft(*F7V{9WO*g4H9F71VvPO|YzDV9|FO
zSg~j8)t0qlYi1V(y=A4W?F^iVXrw7W`7dhpS^Ch4>fCi<x+k6}XLLRY_!eoLIvvx6
zSICoy!b`7S2P??RAnKhOGU`&-Q{AtS43}M@2?QsgP2Bt&QyL@mo^&$kho}tyLaA}9
ziMt%u?fo&FgGxc4pE0<l;|Z(VKsE4O93H7Dutm;)&NY~pd(-l2n6=%40;v<Dk>l@w
z&8ta9v<1Jid3{L-Wr1scYBi(|w_M4i%-kyG*D9#fCZgpotl=)9w)W6?`zxjcOfK83
zjVJ1O^Ttx1l<vtv^pReL2UfVcL)ZS0!bQ87M*O8tFS>@VTozU~eb3L&;IhM-{dQ6D
zK7tNE4`RKAE)W_XPF8Phkk%wr1mprdFb}W7vfZ9?e6tAn`G2E~sy@)g)>SxV4_()7
z8RQx<C51xa*fnu?Uh<g7|3(?MyO;*@b^xJnX85D7weX6NNOWeliIb|!xXUyRsm$@U
z=tr9LG|~PP%h$_2_@P$4x0f_jvHGvxdC{pmSfw`*9L)d07zY;iY>`4Nl>t9tC|cvk
znlB#`U=8n)Ma}Nj?`>W25Fb5+_n*L@04>C8XZtS5xvZh${{W1qQ&!y!E7M=|10Ro#
zGye(v%#$bf3TF2fvMfwXh~{>!azvYBGKW1bZF~Kpeyxy{7PzZ7==5r+dg_>b;1d}1
z3rUPL<{%g+0B)Lbmi%EdO!-7cZ3xDKK=NFEKD0l1B{1A;M0s8>d7eIXtyM&P3*n=7
z<-sxPWC6gO7)SVu6uck?%{)P2pjlii*`Ojq6;32TdVn8tk^alw?Ntfn8~qfL9E<#6
zWdqwQ%S=!rS#cCOn5ajpe<Q(+G7csKQ7Kt>sykf#r|4hoNf2;7)SFgvM7cICo=a|+
z9J4TrWW}O}#7B*agzM;MK4Nz}T@j4<-pIT)?`iDqMj7GaFb)dve?o#}FG~NMW`)Cc
zy1;Xy{7Pi2L#wAB(Wx=8bt@n)`jQ6aCo6ezA#VDC$odl#R;9Xk)LP=rRof!DXzKmp
z`e2QyWd&JX#szomfuJH(0XW0vo6D%q+mND1VUXTRL)YNR__Ip9FmnC`I#@ye31JC4
zPgs~Gw74b4If2b7->5m%=;yvnW|6C~;lDhpjmQygn1Pjx^r*jz5E%G_(o`Gre6-o7
z4?FrmehTdy3)@6y&~UNq%A~hW=}q~>qC2IyRLzw{OLSB-8(2BUsKm1raMo0DG$1gq
zBz`^P#3oqKT9?bOSce*QHs?#uQ}*t_F_n-297IG#F@Rx+719FAnsoQHEaG=se^tN^
z7alkN<y8&BvN)yzr7d%{O)pVYV>@Fl-JpUi-<fIOnFZue*8L1~{jPL%K#getjNBmF
z4zTi9f%-KP??)knFZw<`<y@^~q-JoP_gYUjtY^5AbIx?~!Yq>DLQQfo?KVLjbj*%w
zJ|o(c#!355+#TCazfROmuM51{^tNV$29tjOAGk)GliIHGX`L2%c5-8C+(KbqRk&vn
z=5RsDUw>*hgR96~HO8;_i`p((y3{y)N#d<x5pP%hw&{90aOIO$S%UE$q(DRY!amX+
zX!>c<;B*#|rrq(d-=F<oPA@%v%Zw@cL@nRuN^lKMP0QDa{x0{Rk0+7%&;BR9dOn^c
znX=<xv{N{%rYDMGRmytHSMFHDsm>cns&a_YOsP`s_+7~q`jMamY&TOLCWk=8_HI~V
zAye=|F|#8D#(9cD3G5-_jJDJ**pWP;NVT4i)*_=K4lNf+o!b<d6UCgYzzpqY`z<>K
z6fg$AS)Jy~WeMbMS5}8=xfOc1!TD?hi)!ed?ls*XC}a3O%?R3>P5Vas{Gy#S-NM!d
zpt~`=pybC<gA0Gus|0_vY9n*l?59ERWVToZPX}9}wyr}o#j9R@ZW-!|HLa%m*fVj=
z2t2~lPo@TWJSq0<&aipATWP0PM5_$%o}@wKtIGS!Bn2U|{Fn28&4_G2u0Lq#kLVy6
zLVS@vC=w$VTdWw&pMp_SL?2F%Ka|FO#79>}v17JZK^<d;C9xJ|Cbhnli9-JGHQXu3
z6*Buu%fBs|r>D$p@~$g&j2U^wvOj0yT$^ALLa__ZLez7OvmCO8QB-j+biem!a;+WH
zd>tpI&|tI90(ujZz+;}a8Aa3>Vb+Q72x$0xBI$`pWc<cgw9wqlqB_ZHf@Y5k*of7t
zf45wQ`EpJ(uW#)zzp~-5ZM(sNyl4#&;TcV`!JlZ6!P5}Ken*QzN!cQ%vRdsgooG@=
zLaYvp;rO#g5(J8C3w?3y!45`GBr;lL3;q4b(|OVc%lUdU(?+@HYMSjZKX>fya7Dcf
z0+rg77IS=2TEC63!;=~vS=vJ|U-|ci3+%(i*&EWkmAb_;EINa?U$&EgoE_Fd&=%I4
zs7W{MgB0$Ml5i;<%52u2JESy+2nW%?*10nFi+>ZX5eOSv{t^eYN$!&GqzM|C(|z*(
zf)sh3C2iZN#L2(C-8TBM7!vEhd*M$AoUXHYYFscVcbISGB+G8z+AMBcww_*YV@{lc
zDAk8dQPt#HiPr3928RFc>U^VpbA1DRLt=(Qz^*0}rS0^jkr8A_fdYS_Ncv>_F?CBp
z^Be`#dP5}WcY8<8`R%M!4J=2Pb91|uml;nj*y5#=5A@0e^%s}g;a=g>w)Gt*2}#+L
zBgY}*>G{ooN_qiF5pqa+3CJ6LI<#|U4<k@Cd`e}kwA==~d;jA;kuT;G!U{1wHkK{|
z(y0|;Tquv?(`hoAb7ecyu}F6J!%}(I3G}oL+!nl@p~JO~HKOee>#9sv!3p#fS|Qd#
z0xoxHS+c2lrdx0^h(jG0nzM?YKsQAsq$pydqq%U&9XmWg3L}~o04&$}4#093C=JH(
z<_oR@qZliTvdT0r{6!Ral{>X$9CM=N&hsItG}pA?iN)kX>nad$KvzcnY&|`Se>X!z
zP8ucka!GV$&ncatKIpWVHKhTwf}KImkk?X_PoLGaSWq9UO%WE)>`e*x0}n*Z4B<#>
z*B&HKPHqZJeUs=<Uh{coF6~%u5I!`XA%<wJ?(Y|Eq6OeN2hFotRzoV_A|8z6k5Q<P
zSPg@yZWG)R0g}AFZ-+|3yS9@t$VBl(eC9oVEkOD+0PRs)Km(aWt_ypZ`tpLTQM)ML
zEk<+s1SPF3OdvZqXuH*0t&$J$>q7=rdyE&7s8%t1h~RH05x72foq7{ahvE7moDK~Y
zxZaru*io#8RhFa^u~9kN$W~L1rq+zCJHH@#_uh!M-dzxQ9;#=RXfDfDO20v^q&$=f
z$89*Qmam-k!Y!O;WOqU2QG1Q<iGtdm1b&9xl&hvI&;dDTDiZwm{5Pw%bo@}Oo@tiI
z`AoS=J2Q+y#Q(}RH#iIjZ<Wznz=OzD2#=D_G{qQ|Lb;&eImrm#aOlu{$R@xRQ!zaQ
zY5tE%Z53DkVcfrqh+`eaZx=fW<y|zO{(w5dpFKd!1Cn@X6Q)wd^dj)5r`Ad^t0<i*
z5RftMV{P0p4&|dv6t`>QRSQkQDJe<5goa>6TMAn01D`FMWHT8r>w$D&+3!*Es=cw^
zNa3l)h6r;iT{j%29rd%Uvky)(mnt0K<~#`%vmQ0wKZ?^p*$Toj>}Qg`UL;?Q%*QCa
z<Q2K)&2QUqbxki4z0*s^C#^@tQix2iku_qb#Mn9|Vm^QPhCo)uLn%^=({AjMQITiC
z#SL4a(u`!*swq~<RL%MctR2hn>?~E)+s!3<>NEq(U&*U3%PYJ3l|B5ej<kWoM&HGc
zMeN;SNM<K{k%)7?x(x6@z<n=LD7*fhfj0-3cu<et(;pzfpdC>Ww%zveLe$Xek^z&P
z8RG3$h+i12_5^B2KDyz3&u%j0B8BXdVQp!dz#~1P8mvI%u-$zXwnkNUwK>Xb<IcZ6
zJTT@?P{5lT_Pdr?C$0_UgT?a`URt%C3g<J1Z8}nsnQAF}W_x3yNvrY91w}B(#T{NJ
z&J76~UvfAeO*Pf>0*t<K(X4fKSKrHIl56<m{)5br?Gx#nmITiI#1=avu3HsGspSUN
zfI1G2zsXg#kS$e#u}Ss3IeNIpjtKBzKtc3)z2^Ghp>yJ$H3#R;QseUCpb<xV`RDg)
zH~-jWMZ|=fJAkJtK*S0D&Vx)!gZNknmoP#6th00hJux0G91k<tZ4F&C9ur!gPX!L6
zr%wT-k?P|V&A)8ZW6UkV$ffCpJGsGMX94pQ2?;sz_DA>2G$*sw{dYnGORs<un^6aQ
z?+Ni|?WMUHQM=Lgo4pWTL_6->SX$vEtF($I^aq6bP=Df0Z*mz`kNOdyU|X26$_;iU
zIH&&)?|kD;cn*Pvw^HNXUCyhIH<qg22h#cZt;wAOU~G`&>quj|s?<@RNzDZ*!c1mU
z5L7I=(mrlp#I(okr`=+TC$eVfNkK`QNDZyV{gj?)HR@9arAcP!oPN^8oWsHUSP081
zjP{Bes|!*!6<j~6ta(ZC2VL#;*D4;CipsCW6#WFLnD|G&s1WZ|)pR2+F&>J3Griij
z)acZc`V9r3I24}DPF(5A^BUD_0kWcp!SlhRV8YX26w|6ecK{E16nuznWGZF8qrM`V
zqPWwHu|5;^xteetkzKQ8+L5FpoYxkT>R`RefseiHHSE@K%=tR#Q2uhPt86qSSQ;?l
zCj?Ui0XR{F?4jaE{KfhKY8zVzONO3n2Ecb9!6VxsEfU-Yo}>#2k^L=0O>kBohfbD5
zQ=WaCrY+o22ne4hjs_!VLv~_QMH5QM54?|suQ9h~I$6ouzptw4e(?DVGQ)^IcIQSP
zaiv+#C<kdR+VOY`qLp`OL<mY0tXIaxU<v<D2(rsxRf-Gd)G9ORPqJNFwE=jk0#Eqb
z;e~L705X31A_$UogFzj7JrPXg7wim@F+bEPwIk!z%Sf{9{!Hlk4ky*vm&OG_Gi~Aa
ziUHO`zk)?_lTV0ZCU%AKxQ<{`<Xy6plm+4EZITa!vo0dEnaJaM$#PM^MMyv_ot5Z1
zvuz+BUw%4wEWt;>+1Nu;b6K5Rnz5ZN(w77|>IF)nogXg+y=<kI7cBNk2mD{9A>4fN
zLaOjnxh9q`sJRedJ-aIbeWpOIlvIBPMH?{?mVc&*E}jEZAH`1`U-<jwPz_AU5MLtX
zVfHx_2SUY+7IG=x@ss<twnXlQ*Zhy&U<pMd39wn^c7`;Je6qwt{iTFg%f)6kTYLRc
zPgM4WL#dyhj1nsI24Q69O<Z^on7rF!K{>6vQi%h*14oDNZX+0=4SRO$hneK#YqN6A
z?!7zc{yT5~;?npk-VI*CM7&VmFsTVAm?io>{Whu;pt3HPLqy3=Xd5arm9NiRKcLVs
z^Ayn_W`gui48-(znqnI`%Y}O^3<#}gAe*SFcH=|RAR4H4d)au4i#jt<K&5zopE-or
zP%Mr0lx%hq=nR8Mz-$eqN)XH9O$`QEw}%QD&4m+ilYi<1J7EQa$?MXr<1Lf^94Y#d
zLj+r>D-l~*%ufqe<N2=3_c@~d5P0-(8Wz<+m6q)QXEd_u*CaK$@d4+R>pg`@Jiu4D
zmYpQ46tf`+7TiGUun~fwF{M(TmKU*`Eu-k~TvLN~;uxb-TfX2K>_qe-=edD#|Brdf
zsc0Z-!9f&@P*0`s@#X=e)2&EsWsJlfkbo07W{*KExhGa=A_Ur~q=je+6$c%J8LXV)
z$oGg~vgw>f;+&#WS3@2{CTj2L?hfhMtBCvagEC4NPyq*F8*WE`I$@&c2rtf9S3cs{
zvar7#NKcT(TzAzhh#aI4DF+#jAkiqU{*1s;mO@inlet4jiMi>W)%9+*%NbcO_3B2Z
zU5O`wRgH2&r67bY7?K%r7PhwfAClEMIxr&0l#>{Xbf#JvVU;><5C)WeGi<fwbyyY^
z<P5t;=)>=k%=egGv}4M;=D!J+FZXn6Zd*P1?cllKK-OF=qhIDjBqfuKP;e2*TWv>|
z7w9;)jSPIPYDc|YCA;$w#+I4!ag-zZ=A7$Gy7<XkuMG3FhndT*A^G_@G3{8e@Umgw
z4t2}3vG-W@*BtJZ`Nr%oHK1gKgvMBD4#L-8nN`1f4v@y;e5fl59A0YYVno1kave_H
zZq3{FxBK53ja~F3lFV)tG#kdxwS3u6dQTks0XEc?h^X#))*s_J8Npixo9-Jj^SyQJ
zB2Hv-A_x+R!Nss;rsAR6?lO3OIs_p)-(Yi1H0$CL4uKGjqn#w+z?Z7id<Oxpz@w%s
zPf^8R%xAHhg?4{(o>5ix<6mMuqZ#e#ALJ~Uq@+1TQoNl}RdYQ>C<f*q@rK;>t~qN%
z=``Hy%dGj?ZGzHc2|7}*_yB^^2`g`hJU&1#mV9XF6>z=rB?Yc{$CGJJvMB@TU;Ft!
zae!H-;^Jx;5Wlvub9hW}KY(0+S1Wa*qNFYf5XzHOBO5RQV-*e)@Kp2gY_Mkhxq!Lp
z2<nskI375fX>uT=Di^f{D=bx}DK`8-Pg^=o+y({Ma%Q$sHX~u*&NvhAmP5E48y@%Y
zV5*oLo(0YT`-<F_OU?T0>djvTR5>m4FkKF<JSZS#(jsKK;E8*<;H16wYo>(5-?W3c
zPV=$1t3Bs$%xCy?b@7m61-^;eyxe02=%}X`9f&u=h%HuxKF7aeFR<K-$GBtVq5w2-
zMzXpLqpXbOw$}23#8-}%DR&mY7k(4rt!h)4r10hd^D1;{CAe18m+EFT8|7Ky`ME=E
z#BmfJ4vENia!7cmN|_cS>?ZI5%_!+oKxP=No^pmswfZEQ=>Wh~N@n+96}oEY>?6JD
zw}$(b+hRzW;mf&g^fGC04K~p$o61nC@i`|WE#j6N)<`U&H+Mmt%;+U+x=a9-ZH9LW
zChuG^3Z(FmV`|wS3;ttshFeD<mToY9&h!l_HM>+vg3tEX;kC5yFHmk<>6~&~gxG}*
z=I8$P(|*p0&neDZNiqeyes+IsLVP?t6>jNYTl(PCP9SK=V3PYz813m|Qp1~|;=X=p
zVDm;0$u2CZgCQqJK6|v}`Gf2tM8xEv-17Y~K%qz<ZNLAx*-`CPZp{~Ay6m|g&aWBa
z4W|atp`y51v5#Q1u<<eO^gAOg&s{#W^-S1-T0LsrAoO#noNRY@<BdC8H1YbTYTqw5
zv`!VE<>VI1sFh)SCzt+7IqP~Y$lz!*K{T*<Zybva7FdFzq}g*IJK)tG;@QD#&%!92
zvzJU9we;)x3$)k5fJ?|jmslNWunO-aB(-Va=*(!drhWb(+;U1^N1^>^yWHs<Eg}CJ
z^ABy*$M@e*$UGY>-+S4$=7D)ExLdIg!~v2B0!9@RtpxhB3+fHqfwUnKEbT6*G`h!C
zI)!38$YYGMBD-s4b8~5llzHT7!ySafolX~)%#KWxTAFkR(9n*o)AVi3Bb_v0UG^;Z
z%4E!yC}P9<^Qz#|g&B%M-9Rs-u*EHrP_6h?{E>Jrj_p@IO%n4WB_WBI$p@C{7y1-z
z)fSz)EEOfh>%tRGg`(JXP5VTN><>By%6EVbWSHm(6WL0z>>k@8FE!=N?ous0tKPTD
z0NSklx}o`VJT&!sCD;Ai7=F6(Rqi*np58US6{d^!JW6TQ*Q*VnQ~K+kUgF?$&k+p<
z$5mXPr`9L$wfT|EF!zSuN#@DjU`Oe#A*ZWl$*%QN->oUf#z03^Oq}q1&8me9XvZYO
zFU5Q%#HR!rKVcW)+hfd!_5B&)v2v1PtF7h}QqxVzijX$^KvT7CC*Fv}4XPE6Wz<j7
z7Ot0Ce}6cYU_)U(^j|E~C~Z;l+#8G>Gkt7Q(#<=mLOn=L?Ijv0E|-_5%yMJj>Xfwu
zZN46$(zrDuU7saUIgv<DhYf~N{F$b`Ur1Tc4#N;1EFJT;M|p7*7+p6p=1^-=Tr_}Q
z6;Mj!MYQPF?fK``nMJ$ILOL?h4}!AGAZXdX{ca~;?Lkc$h<|xm7De)Fz*(bN8(;7;
z7L$rhi)KJVP&}`1-m^pTz3A1l{!j|DNwEEMW~2#&`@XJhMx`CQoO1ljS-MH-|I^hs
z1$o-T&5mu`*s*PUc5K_$f3RcQwr$(qv2A<DI`e*Y&c%0<sywMw^1FC0a?#!CX0sDG
zFz!4r1%4y2bY)L?k~@7DHcN=Mt-ls2&UFSqx(S`F?>Dv2`%_Vjsl2ak!dyaNu$u|f
zpmBILOw<J+rG{)3?BOu*b@0Och)u0^{#yld<AHpaPu}oNO}<Ovyq3A3)UpWurF>gS
zQ8;N-++W8;JSHsFrDD@Io82KWrEca}wlq`mwEwP*<dqil$kHpJW$hV>dn0uG8(HGw
zd|)Q7#&Q&gTTvUI#CY~8T+!)~IdXokbYYmFrP~xIC3`__kTCYJFqS`iLO*%(6mi=1
zl<5Y7=lX$_S-M@st#>q+*#jWH^=mHJ?U~A;ZQ?z^HJ7T#NHV>^!fplaXogsK*hf~K
zscVpnKD8e*Za}Pnbg(-t*f%aBG<)a>R}%bfFnVa<ZP}<kP*N6ad)8HEpRoHG4||<7
zrNcgl>&!hq^(vSj-d%3xIXb_q`;CI{m~4jMkwgSh=W;y-n2eJB$%tjd|5~#KeHDVK
z3G&kK7uP6feXNsks$EzllZn-FU|!xK>`9^B>v04-xYIB|IsqhE8Hd6Vg+A1p!2UO#
z|EWpF@dJvSnPswI$)c&AAjCd-@3h7~3^v`w{h@f%1Xq1uoc^y<myv3*urQ7zrowr9
z5i+4)m{gIRwomi8RYlV^9<&J2LB`Bg08}6%gQB`iUz(T(gt$Ufm<3;zUNi6t;jsgO
z{$Au4ETqU{q@HN&ffs2}0}J9or4FO1bHB9<rYKlvq(D$})JhrV5NBc6K8pylv~gZ}
zIToZGNTytOG!4r4Zf(iztI?cd9&U<^8pBB#cv*`wP(<u#Zw9zR&OZST-jo3a;KVh`
zg}(x}>rm&)rlp!Vy9xfBZczhu!+S-Bbwb2}J6=aL{H|gA<UV4fX5Y;uell*i6Y(4J
zmVRiPQ9QwLs4@x1m`30pdJZob+##L)ZIJEPb}lKFmk2i>0$Xv1L!A=1R5Ql73snsV
zj>hH&O`}uR)H9dQoRRrDX4)%-T`?#-ajW+t&rhc}gDcU##Pd)X<3!pb))h9S0bAx@
ztx%Ze5g%F2xm<SK{s#{`R8D10H1*@ceM_3drht<2Q~z&VJ~qO#PL(#O=?M_It)+Se
zN5mHx61Ehn28Gas>~b>-7f>NHYzURILObA?jZvb2d0aftz7YdC41}>oC5bTtDgb1R
za*%WF%lq!h+)iQ3#M3NQpCSM~$v(Vqntigsb3>=TRodvR5cj&uiR`JXG2&i^r?R0?
zIy<i!vhF=M{mwctzQ#?4^UZ}i1G|FU3S(d<H2XkNdp3jN>+lk`1S94KfBy9<afmSQ
z?~Y9GMUu!@{<*t9zGb`_7H1S4zBYX`Q+`I^;OeX{Wu4B-pRrAisT*jOY#)*=<+W3M
zk*r7O7K5yD6X{4LqAcn8E#kL}_Z7O^#;jv%yXR`AnYZ8;zZ}>0?z|kDkUPV^oT>w!
zfE+TimJ(|W1W-vu`7SIkh~hMqSS71frX@rv;1$0d?=Hl+6T7%l7rJiczQmJxuD)!@
zHs`B1cR!vR75wAKg98X2TlH4gg}I+F2KtuEI3orG{3`1q7oTb8%Ui*LcI3-VTi7j{
z#qriK2_TmS%yz1&aS6lPPAZyi=-oq{KDs@*<uTyR&4x?-J~@5_NC)RnJTAY?-y^XP
zDeIfYPn%IjE3o)9eKn{&tM`2HURr1el999vc{QcT@4%p$w8&S{f^xu){>x$sN#fQI
z_M%}&1{f1M+2Vm0wlqlc%f;wSOH%M^^W;^IVdAWyY1QpWQ}YZT`TJT4(IF9|6bKqq
z##{`5oQVf_5ws)J1cxr?KA~x;`(*MHB%2J^)|gkU`Y6xKN0pitH;M_)@n1D&*hk<O
ze_2n-IoaaT^vcH9`}f;5pQ0?|C0NqG0?o$_G@&sH`qlk2T?0azUnmSlb)s!!xxaBH
z`^-fA+F_QvXuuL(?KprE&r7Z^w4&GsS?iCqz)%Hl>j*n>>b(b@1_D=(ae$PQSL}Bi
zpaWiDoyqvbIt@d3|8^Z9n+H0ZZ3W^EMA(dXl$IG?4Ni0utaS7?eAUuzJUR1m>JZ@3
z6IKn9Yi|+o0G(k8VRdjqkp$2giLb5<Vo9hx?-ND9t@uR13G)EO@!0x%4HK^E-9zn4
zc*JHF#M;0;wVw#@$<2}~li7vy3gbfVI%Z-Kc2Tc!;`xm}Iv)b@68MeEOK%#F;KT2<
z8gC%fU61g$*f8|v7+a-Tl~js#nBqck9X@UA+ubbxT%v24z9f^2a62SS2>1*?_*B~}
ztPQRNJ6TXPuRueTeGY;5W3(%1-BbF8|B2nY7btrnEVOM;^#fBOCadvY0;at_+<DTh
zr0`#?12vG-2(Soqa-;Gf;JzxM1&W0SCeQfaAY=0|X-v-WV&HV805#^VHc8?B^z_B_
z7@@*Sp-XBBv=R)YqiWe}^ur}A;42;=DfpNvLE{7=&rPsx_<v{9fG7^xzl<{^Bg-=L
z`iacY39RME+7RB<q;#ez1Bhg+O<|878BL<zr9~fit=LimhxoyNyP{{40Z`>dQhom}
zNeqb*yin4wCp}KUKXNzJf;gRQ2AM@{F4V&4esk0#wtwvRt?&*ykW6c({y9BHvD#D<
zO)h+#0f+_ie&17S0JY-RdD)~V)wi=sw}f#1Ly3#GWs>hLmAi}`m;y$<`qx0Iv}V0d
z*dqe0?dzCUN|m1Sul+-88-UO*)B`K|5==?%mjJl?*kPS!#XsqsB$%;bVA)hx{6vFF
z7$K7rUvq{cw&w`j=dEN6vKHWII#a)UW(zhw2gH@mxqoo2926Dogd=?KH9Y%tZ|6*c
z-*)Q&?c9RLJsuQAc!bKE%*d}|{R-*z?5Cir3N&b%7yxvu5eRsN@B>xkRW<YS;jC^<
z@E+0M93_F+k)+7B4Xl&wWo51pBqfmt@j(eEGiITaWwom9N47Hbr3}me)|6~5sW;y;
z(iwpQna{6goR&#(>MBxCibli+wzUmDeytM3tex>-73!uFob^}AAP)5#nJQT+3VTY)
z&8ZD`0;=CEv`Z@Ie~O+h3JI307+#I2M)FE}TP?~j1e73m_IsM1ec@KOcY9j?v1e6>
zRkkQqd2GuQL?K{{2>zfIyiqQ&&M3JRu&x{{1rQr^w{^GEcT<2<3G6aA+;^BHECKU*
zH5J@T4eM6`mhDm&6%dU_AMr0OYGSI#@;JkykwV!YNdjN^=W>ls`8|i>US)x8LsATf
zjh)1h%aP);RDaE!?njYR(N)N|C=#p;SL6zjGm1@^tp<x#T)J;+10@M0$7_cp@+9`4
z5{`hAqc0+PP*6VUEeNA}KtzwVS2)?r1pNyrAE<IanS-dT^hTuWjeMb{63;E(yZb%W
zT^Im=h%I7cTAZ6sO9wKxzjuVgsj*E^SIj?I`2{&<3W4?_rrKcKZ+bHvIl~s*K@@`g
z$jO3qVs4+IWfEv;!s6ueHc8lE*UYA8wNZ_mRZ6fv!Se4Wj}mW1Rer7)vkslG)yjon
zhS-<M(ho!B_`dx@ywkEx&rjgt-Imnt!ZG4g>uf+8*G;)J6Tg#wXD+2WMV|<1UHVLU
zMc3>>QSahlt|R;WG;!jlk@L@_ion&~D#zfA&(S$Ccv@SZOIJ5DO)Ke@uvBDFO0ATj
za`Ca=E9ML7p`!QJPn5t&pNbELefD3AlSLI>9hKht(eh3<rWFkQl1yOzmjG-ttWf0s
zjuOx#g(5?g4(_M0lhb@t>-tIoG5BM#tH?DA#u-f4<Vuw8>Jjg`&>tJ#t%~r=mRegy
zqL2#VftIk*Vh$TM-1E7f$LksT2b9}0ibL2>o%xE|sOxoLl-fH~s<p$ilM$+fZmZ_M
z*$-|CTpUdeQdd<xPr_2msH305e}qG_o~lC7cvAWJYmZvBmd({X4#z2llCQn$ULBry
zEuAR0wMS|$eBq-OUqd=HzQMSli5F*W;V=Bn3@71eFFQNJ=@??B7+v5dqX`-DoFH;m
z3(eM<ZIOM(=3pUQfrF2$3cSIAHOQ#IspnrpSs)GO;HHL%caaOW>x8CT@=41CipAc^
zcz{~sSPiwRhGs){yIE(<e}VauOV4rk>IuX2&r#vdC3H#&mB!3@;Vc9M<ns2ppi_yX
zxmD#7&14k9&*9>bH$u<D+lJ|#tc=w)5p&P9HG+>a(EUziXmQU1=MJyLd+1-E)8Aqo
zWONb6v#1ZDn})BGV8fTt+kMF|MqcrZp!fO^S+SJSZljCTHDGDT36G<<ot=^>Z`A4H
zfB&GNLg{NZe2A13<DA{;MXKgId1rpU_>AifUGosjrPO2-Bs}_ZSqm(O$P6un&y4h5
z?>9{YOh2x?vgrhAuIkvxNwnDlXvJ12OEw&Gg<R;{ZMM6-wI{Vn&D5dyuuxzg0=7b`
zRl01fFDhfPCiJ?ceFH8o(1`!ocQZE?z1S+dd+d>G=>cS}jAa^CcnS(sq(a`ZAEWmm
ziVLo{T2?fx`&*hd#1I2<;dnIKO5%`u58SSV|DgG2g}>fXYSnion=Ykk5b2ZJf_SJ+
zqj8bzHCEUc=%gcTm=CH&zllv6v4~=#mzy0SNu}cyU^0HN?(0n3@Syavbf-)BFm%7b
zNIK_(z3*3^yc*O$iPL@Z1j)<K#`2O<Ox(jUkh~O$VizMzc<%1pYgB}S^Mh>;CimV1
zRIF?1o#SWHNufQ(&LCUVNq9$cTOnpJXH>?*!@}z3Eae&r4JQZwyF0zK8hQ+tUc!Wc
z%Og=Q{F?YeIDd>PA3G-@bvYt_^Y`a~yGztWRPTL%zG5mDAR6k8YX^c`GMpu@G<qLC
z&+=0Uyfd79{|!NFy-#}$LHq9c#OB}7oocd8wf9d)<us`Dad~QRJEx$sU1G&~G4Y{b
zfhI_Hca<p~Ao?$-&?cqCJvzC$d4icd?pLX;-*uU4Mm_FX{k0JTvylxlU*C{B)w1pm
z8{ZaG_ye6h|AnrKU8&mjVU3e=X|k@4`pfUus%QMz;Lh0D2vQP#{!COOuM_c4#NjBC
z9GtHRki+K)aLh@Xz!cmZPG0u>zR0PN%MVf~`Px~%;zGzqle}Pwg@P<P{x7U-b&|A<
zB=VOXwtV*HOel-$X6HNyxxM^Tbuu}UuL9n4K<3N{J#AlPUx+0^=GN{9IFr7E@0o{Z
zS9$7#6=gdgLZn0dV}am`-}givp3N}(FaeVENX)g^pVN^VTsIG^RP$|teCwG@*9J;d
zT!sjB*v#~Kk|Is;+o^=ah;!S7VJRj}Vs+Vod(M(zI5e6*nu;v+s(#lRbt2`sA^s!&
zdX#u6W-%a4JY(y+WBv&Zwqe?h&jTd-1(F<ea3(j_Tp$xPW0VD~(T*!z*19lzuvoRW
z43<&Nt3V&s0*=i`oTpCBdZn5K*6d_-*}!H59hzs_mSU-spCqa?9XqwnEuL%^;>y;%
z%5}rc8{t<gN@*mfQ*q|>gt*`wYJ`L-;_f>=%$Hx0%V7E(|9rn!zQ26GPkal^zv*)G
zFUaKDPZX021DH=dEIc4)#knD4#R%Re+B5tYO=|cfdFnVe7tjMOV3ROO6T+QG?%4bO
zxyM_1Kzpkiec@xh!Cb5#AUPF`#@A*dxP{vp(A=})rKyZAI<Uokud;EVGVR32WxA6e
za)?E%8;lA}C9n#E6+^e}4O{oAKs|vc*y})DfP_t;e6=BK@)1=aq9{(Y<Yf@TzP$#7
zz*oU&1LsvZWxyd%Phc0?N>>yrWlP(}HE%SvF*SKII4+2%n58GxQin1L`*`wl6BMLk
z-fS<1js^Q`!RHd(kzOcb=7;wD12kYKAk1EvB&amcF>{BT*J;v}{!Q_*fCZlkX!#S7
zKvqMCE(PtN(5q_(L;$ZEFZ-6t2lf;)ya9*Tb4kUXpZfr#I~##bNmjRBF;t6y(I>yH
z3zdD|#p~uK*(P`2`$<yl)h}azw(UTO<d5)$@T`*xZEOT-XJM=jD`Ep~=GRR`q(Rw(
zy>5pzy8PxaKv^?c)da;*vw!+=)X(Y7h|n4}NRzz1GtQ{<jv;M6*r{ZMc0>kwF)h7N
zQ;>P9aQk+d84pc*dMKJhqe}Xys%9k_QS(ZYD{GD<fe@EPb}0%MPLjxrE9C-=R<cal
zQC<xg{|jr7Hw2<BEsw%r!O+Fk{9#(l^!&%~h0RcQSD?9JvBinz5qK9ZCcQG_m4I!V
zX>!Xu#6^y0c{W_DlwMyU;YkSG_&4EY1-L6{MUEc^Sf$u=f8|(Ai*YjRuBxzd2^_6_
zJpMdyL&#t8!T_gb2s@Z5H_HHUrOiV+oN9k~(Rs~BGgV5!PzAf<K94G)vXb1`Kix!9
zXBCBv?$S=Sg_niTa)XSu(ds?I&XN(ZY=)`E%$Qq_v%Cow*TI+x-ki>;uV@rNjr39b
zph&vYH(UA?MJ)^g{x>r=Il9Zh>9#bbRt3I*@c&?e(lt=g-Io;B1C_j$^oNW-pKmyL
zL0&x1!S4PHG(vi+uSM3|t6nzu=RHF^8waHD;fCu$1`DKM+VW_IMm+p()xYkIX5gYU
zc<=~0SaLzOybs#qg}u4sH}7`|nbhExrW90|?Da=N$*9o!wg;va)op7J8-~4yR<O;g
zxVg9@{jR}omH%?h$jU@NmWxVFk$}KtG{pEhMp$2)aLWbTc@EgBbPcQj%fPVU&5VoU
z*{sw(YwTg!U}II(hAOs&5;Y=nhA1+~kKDy>5+yypSM57HxoT3Ob&Yxzs!t^+r#3f~
zoJ=@~G)@qUDt1l4MAJPPPCd9r*y_(}cdAGUT{h=TBh85k<fvL~bQ%Zg=W<%jx3KJh
zbavrO@!){EJ6v{5sQi7*A&^`v@v_v38;vkM-?H1d#m(W|0_0Yf3eCP=A8=VNFs9MZ
zru}yudcDC!YJ|hpP6d#mzfkZ^5t~-L7y1e`fF&?!wcL9depJcPbs6vL=LPa!Z5RIu
zO+(wp+8{vj$ohqY4y#U*{-wFS|F<H5&Yvaf7p414`{hy(O2n)G&MP#=e8{vh7Y{IQ
zOELrsf6ntf*d1Clgm<Xd%QA=&c>c8o(=zD3!KACtC6{54rHy8a;Se|5a{O6yPJ8uO
zX(#b*MLJn)TzHFa2kQ)3KDr@Y7>SLTe`GkmwMHZ@9~@q)hD)Q&N=U2jd(Q71Kc{dP
zTiovpj{SVR>tJLzT+8C?;rf$KoDy~uPFP#~_YMh0;uw3B$ru-V-KakQriL%BIJN8G
zru(kpk#|CP(<AJKYaV5_o>EjCa@&k??r2;jwE(#gv_4WDLWFnolN+waP|lGAiv&Lo
zR)PEq-XykU#=Q5ef34G`Su+)kxw8#VOPfPVuQ`-1JUqU!C0RNs51E&eKzarJI&Cfk
z(087^p~{Z&`oQ&uVm%5;$4DJhoxq+3QmS&QLDy=RQ_@Dq#5hM~Q_r$`QVIKJ-pTAs
zAk)x%mmM|1bT}HTu$x#LHOOf-mZFP|1k6Gre8cMtxIOB8{jZm(3*PAQ1IJid@L4H5
zyn0ivdA@!J$+ChANNVhHkd*`vi?M9di-;DIX5<gKnHW-fc?HNr{dYHMAQd_J!c85G
z2HV_$eRTR6kzr<|9q4mN$}7<I#XoqSY=NONWd?rmVtx60lQMU?0{IxY_HSPs-m4v9
z3m90Y;I2ZvNgba4;R1vQFNjW2{1p(CF@qR)fads=_@riH8{XhJYW5f6<8E|Pwk0v^
z2Lqa5cmuVt(xYz)x<Qz|g=PXWU+gRr{$3%m=kGz2jM=Jvl>|kV*#?SSo#?ADQGdLZ
zSJ-U#TTh)arna%uft_nUI&;hBmECjP>_<W|$)_@+g}WHypFq3TSem5iQU<pNeNfz2
zn}lwES(96KkoC(j>N4n<f1fY^9{U6`F<QOh**EO(QSj%mhReD@(@5aQ?bH>{A=FGP
zL3$*`u^*ntE7oB)(W5)Ni2?fU(JdISC-@IUix<W>1m@QEiv;Aym$>A;n~~chWkN19
z%XRo|Xxe`+_x*w}Vt8j3Y!bmz2zjFmg+3`44F4L{DLJW$l!v(Ru~ilMXiIG!TP|rp
z5Q>o8el0FQh#WHLKC%6AdipHp`SLr_+hyez!FI=M{&k!-7r<j7es5cmRqikl1J|ES
zez;(m#T!%{u<L=3mUXD9RDS@0ONJe@S)1NZElpt|Z0Jaz-00%G{`)8&hknp`C!7~?
zUvgxJA>M7%5@Cmj*wRNFvMlc_qj^a_BRF;rKx=bd;4wb6@awNg-IFOSr1#5(r=0p~
zdap_7pZsKIQ1n2Wwr!jNEI-H7Sg>eVoLqwFN-HgX0WSa9o69zKQvA@@!yq#cwH(Pn
zl)vfO=$SD-1Ak?Z^vdxLzM_NEW6i*aAKxpUV|&cmpdfz<mVW(Uk|KGNn9^*yO~gTa
z^98)(zP!Y6?d_PQBH@<?>{W;tQKw${2crBxnE^&NmX2Yd46_b`ay(84WA5SKU^8J8
zN_TkOCTHiv1@6qQwi@<hc#oM&7Ii*s311KU^d3vJM>X~z!$)sZ!>L{xk=6#`d|dHY
zlJiL&J)GD*R1&y|p}Y5f{SStZX9_LLc&~coV$Po6?7M389-P4U5(veC!TUJ<wS7$G
zhkDnHND&_^BK2=Un{YCtEcfH#4K>s=LQPA@*$Bxnl(mF(>^Rd&8gg^XIOV*ks@j5m
zGHLPlFD5z#A)tgnZJ;-Gs~nDE2%eL71xu&TrD5^%6$}&YyX%+sR>dt0z#rbco+p;l
z(PlgLs$gtJrl!5hra!4F|Bda;JiraLHAu_h!XWP&1R8uedELVJMMu4M{L!@Vg(Tr_
za`SPRONb9XC#FE`wY>^0LbQJ_u48BcirwfK8lRa*hNp~>?pXD9NE6i()+_bv*G-P2
zq3@Yp$1zc%k1)%QP!~rH)&Tp~`^WQMhQDG!&iV_;2Jo4>XxHfSBs1o9ReWgO`U|o%
zQLdL7DdE*)%MN)P$n1Dl@d_)TgDtrb;`8)<@Mwa;;*Djnqw89*=dbT<PoKmnuTTlT
z4(n`0tL8WlG9z)~h2}GUi2G}eKm68Oqd82f;c$X-jVyf?2=s(8I?o~rM`oC+>7fl0
zzu2w=iFd)Xt-I?c?pQKjJ)~Pn%)dA=N5T3+O`H~xP$PjN_87X@w;pS8$5R1=H7nSt
zp;Z1j23D`0$X&KYYoBAOu72%3Pg#ILD2SP97$a|@NhfbpUhgytC##Gv{vH~r7VkJG
z0mNbvSX_UX;EDr6fxabYB}V(^`lc=2n*zl89L+=??Qo@dU2i>9l3I;DQop5M0BqSC
z$V9*W4v1w2$6cVsTnQgzJ*&}9qbp5c#x>3=3|$1M(dsHCd$Y>|tgX6Ngu=>Ob_9Sg
z?$z1<bnFURH+eMdN=}+}0=!6MF}E<4HRJA-rUN<9zl9Rd(9lUs(nf4RglI8>z1pmB
z6$-r?B2u1%N9Fd%tA|(x5&~kEc2Jb&F24kT4YpWMGD9<v^R=}vh|4$&KGYQv{T_j#
zhys$WHm=~y*!2xXql_`15h?%iSxKw?;6{tC9(p%gB~9)2hN;Q29Y=<qjhU}ZCZ+FS
zqZgi9QBU>OObrzXTF5nP67<>l%V@8G%(VWK4h6yNK~kF04XJ40O9V{M$f!R$MZ8|L
z=!baZAprHrPD0bgH0e-@$qX<^Qi|A1nz*2Q<UV-J+ha!+o8BAVzVIj~jGBsUe&s4&
zE5oT}@bIi))Ffgh-%FjTI!1xu!eXEIatiR+m46^$Ek?z-1y3Hvv(U26sVkw3ycisZ
z#<e!PFs4gD8KeyFCr$bzHzB?XQK{5#lK7B%s)9do1Q}MK`j>>NHUY{Ft(_#Rw~Elg
ziKMh6?EufpS8hUD)+C&hg&~ibiXjav67B9|8K5@DDkpyRO4ri_^HeO?XftxZTZJ=r
zd{D~kH9G>+&YF|m3-LCl%(PkQ)v9yFTZzRJp=E76I_wA3M5&GG+|2g5C=ZVXn7EHD
zH|4j=jmcaw9&(-xEAxH{eK?+9H_tV{?@#T9_J`{9R=aNwgggT_$el(;9VOGgn@e)o
zDDgK7=^`G+%+bTAHu@9gU#OrnlOb9TQ2IMT^_|RgbH|nx0ge<Q53AJz6-6c^XHDsy
zj54NB9U~_xy)G@&#98@*QxP*@T6=~7C!tsM(V$I3??WQ_snPnlmvs|R4S`|BxYIry
z$%J%KiMh1&W<Mp++brK$oox#Zl;{ho7;2Kj>?W3to&B0YZmPRRRLm#74DJs^EZZP0
zspn%2NJZw`b5>YuT$O2cD+^(AT>71Dq<J-hbQVb5Wq)Cs&~`?XsV@b6(^BrLd)Ah~
z*Pt_7CohEeHkk-N<S2IWvBhAPsD(7SRy0%VB=NfqXX<D`Cz9`jPh*~b>g06BAV4d>
zx&CxrYt4Z8Vc=K4kIAc9V_9eQ@A&Sb#Km^$)Tb*7OR9ezrk~P7FXOHD^Ck>%mvJ-4
z!-iG;X#6J9ppRn%a29-xu8ZE2Y-atBRGpv~8z4=Cn0z(74Ccr_>UD<l_p;op1MWJf
zTY1^X7J)NY74$VSf12)HbM#1x-h({($Z~nM8f{78K=A<a!E`)Lj7)=A)-{F}W@zsv
zh5}a_pfM)on}sq%R<1+!?15_WP~4zR(tEgjuMn%KEf7Q>^mAZ5g!4<s$$g-6!tqh!
z8-=58(skaAvjLC^@&H00gH-Q{R=wO7#5E(Ne|l=H({RF}8N|z%VMdb<B$pTQp`eqb
zC8!!nZ961=w{eiRgS+05RZMke`|CGy89WAC{;KYk;R-?F)egxu&ZCU);zFrch{{@m
zoX}VVZLWDwv`Gkm8+eNHruVUgZVbW})27U4=>0&B$>l7?a`|uz%xC_Ph%I*9Qb4-Z
zP)qzLrJJqfjkc(FIN^o8uXTWb%Kq7r9v{#*AwK7oA&kVdd4Pp4<DI7^rc%OS`MkTf
zG=#D0mb+=qUG}83j3YaiH0C}lk?<w<fX_$99}{+EIEhGiiOM&WV;$0R^#UBt9iPW5
zG~ptqi@L!m>e}EPyb0;SY<SWj?o`PH9O@$(O}5CGrfngl5Zdf8ajGau`FD{cAL?%@
zo2&pelt)wxM&!DsTY?E~N?`V$NJ2sYi-n_Y4LEg^t~_q<2K4KCJG835at0BpU$>wf
z4a%&lMX#4P&B}t`0ZbDg7V{rt&Cz#{HRa{1$?a0*aRIung8XRG;;}gcsN^J9TV3+v
zurifehi_<W{i)@i9~*^aT^kDjU?*$Ps-&`ts$y_`nH5!idcY9t-kUO=2q<Iu5G3tx
zTy>JE12-C`vkY3ub$z9G$5<sfkm&7&r)=qOancbRb%DUt<R^w=?MnW7LA?|^_-3};
z*7DgNa+<2|Cb?-g)07Ma{)>o-`<kkj>qK@{^%N{C6zqw}icdoxV&=|$=HEdLT{IJo
zzQYBm3C=T15o38ng=9lRQ6M&4NMvXb80=C=U_JOqk)qH3+E>d2*|u_CnAGezL87fB
zxbH3KhLIWU6d{HOjI&0uX-OV${t?w?+h+RaKKD8BWG0hn!oMSY<VZ7Y-_(MPf4C=8
zO9C@6KRp`&cYX=F)kVpgzfbiSS6%H@u+NnUznFcIl;+S`4^bkOlz5*Mc~ngjDv5i(
z;X7(rgHffq^b*`=*h_e%5VYX~n3C!)s*hX^5nN(tPam|5ORxZ8c5e{x?f9>QQ%R90
z+VGro(~kT|0_LtCHbIDOvKBb1oN#hFj~2ejLBr7MtuEiLW@~MNnEDm8z*`uFXaeOL
zBJq$$L{XYK9mMO77U-&tS6skR{f5a@v5XemUUR&t*TLw3!1*Xm7C?Q?%TPdOoX15N
zjj}q?Z`gv92se&(XDWbutP+<5pjLY1-w@|{rf;7hhNifXPX3*VTps<c8Z+V`o)UHR
zSg0j*ER+$dpQn73=4UDrrI;`bPE~1yq1G61oo-!|&Z>*A9(-(!lB<;;_}CXykM4;a
zqKffeFY~VtYI@8wqJ=Jny0B_ls)Bjb$j)KT*okWBo>#by+#rInuqTUaFopH=@zWZu
zMC!$~&;%ZH*ovqDM(`1{iu(onRv$~Xz#C-hy0^!7S{Gl#1gu*BsLZCs`MXwZ0tclH
zIxDE3gPmB0KJ;S^DC-vTi!pU_p317Vf&0rHI2YM2{mSu!z>?baqaoI^lb0u#0YeMS
zz+@*WZRLnTBT%>(eP0WI`g4VZZ)RTy-2Y3fsMeXyc9r2q{}4HOcg6?spbz6139kGj
zrFyHd9x);=>0P==l_DOaUz-HY;GZm*B%p+$YRtNuo7M(?fCm=8$X;sM!6;lovb#lC
zy*N45Z?9bKbX1C2!^xC2^A10`rX*1Wf1zjUD!5v8+R%8(bef<drKi|PpwaqNIBKlA
z9#dL^ZBgkuq!Clj)Q1=g*wIpquO^LLqWmA0<p?5VOwUf_HS1=)SxdK_MYN^m>COn<
znlD{n`&AGl(o^V+`LRz)(ZMX4T-%{m%i+hVSnwNTnUli4k~;EiS<eKFSxq00Bs{p<
zTdncf#%pS{P=A|L!%E{;z{7G0(fY@6mEu#y7Z5Al!VJx@q-Oom*e%r)P)hLN4qkT6
zLN)kDs&b~0cD(Tqmt11S47gOAYbzy46Wlk%1jD@8*FkB&ATR1aS`lNb%6;aw-EzWM
z4A-rnXC7DiSOu{X4fj9VrDGof0ybvXe`igvpmuCtM{}jhM~U9N`;7$9fFD`MdIF+a
zfPL>Ic<L~81T058$N0+6`Nva)r5U%1j~afVF!6<!HXze9JfgI1iClT>d_Nw>t0Q<S
z5U(fKN)M&_?ZL-LWAnz&J&Ul!q+SDwq;_JpOFa4=bS_;3ucU!FYzs9i!s#vQ?rvc6
zgC?mXETE|6?2veoLWb1~W<M2gmY5+|vFOf|^G@Q%BltEt`wY@MHEfiXc`Y}ir&VH}
zeS$==Z3T)9pFJY<)^{Mtat~gmxl;*5L24MBZnELjLAQR1<8gb;ccPRIQjeCzb*k<y
zIHNc2rFwCANNtt>G&azp>}IFuCHd`$$u<YEHh4(Nit-Fz1E&R+zAy4=b`JlKqb{~x
zv{VWa8SnD=vd=Kfh<VsDjm6b3LN19oFYUtyOJv11o!QIkrlgs}tt)RVP7t3IFVN}~
z6fh%YHp-vMz7o5UdNNIJFH4uF?%D{6H5Zc=wq#U-m)fk2tzTri(LQyIbM}%`nY9+Z
zh#?94LsOtKdy971!49L_?<N#G7s_-5Fr9>Xu$I2*b9IL}sd0(<Q`zlLf;NlQFd!`v
zL`=<9D`{-uPcMGU3v4VR1JId+OGZs7L1NMe7DrUWdQuxbjUw;;fTVL`M*{KKqY|b}
z5_C_hpD0E16xLXqc6ecW6Do4t8-&6?^Z{m3mzI!9_UknOt)|JPoiP}4M*9K016H4Y
z{ii4ph2k*em6;7?Ujq)(F#`mTp-U-IPy>Y^^lyZy%qpJ3YY?u=9BYd7W&KSqZ6v7g
z?}CU6@lj+<Z?>_B>Pu@k;y?!s;#Zl~lIgSDD1U<YA9B*9Uopu&So3BU@V8TdpSX}{
zvZB4v!$IG0P5tA7@k=y=kzx(Cke;~bX7Cd#EJBxvOb15L(q|s<Z;uul*y-D5AD@hf
zMviuCYE#VB@-%4IXq1K3hG?$Gw7_U_Q7833KJ_mZ5Q^N$gpbq_V#YdQv&J`Z?R`bz
z(9t-+SZ)n8yfV<>!CFQLY5tiaz*!F<Y%i6mX|DxaspCc<9ybD5XgL~kt6M{^>@;~+
zXAqtmN38^S@(LhH*ZafV7-<RNCLss!m#6m)G`7E-8EJPU+#|ir1(f%eb!ja;@st^!
zbY)3aMpJNKS6h7$CE~4>th5aeZ4oXvZ*g+%kPb19(@h}1*r<ZZ4P>UaRXnFYX+sV{
zq1nX`f?rLfBSbaU6YfWM%*a0Dd^^jAA=-VE>LdLzaYYg7Y$OndF&sfJMFgY8A6JRY
z41%9J##@{+s{c|i$V{woK@F5VC?bX-^3RT=$&#H^xeLB#n6M7JdZ)o5{-<*0oN~G3
zmJ*jD8l^C9(>wqskpsJl_=qsujcNY^ee$bI=UQXwd=elE?>e1fdWT)vqIqzE!0&Ta
zl3%9VUUJn}YWcP{4rh#wHukXv%(-t9TD|qyiZUUD6&h;88edx02kKI~g$o6)x((XW
z(eVLP@6dArXY&KW%efPT=Qc_9->E@I80WfS#47Kbra>my?Xy*3WFNH*JGB+{GdI){
z|48r_pe-NOt+kWwp3zNhxvcK-zf&;v19<HLsE=SbOY>u!k|Aj0;b!@#U!#mOMAYCK
z@bBtHk_MSH?-IF3ec2Kcfy6<IK&pF+F8Fx$JF~Phe=_G_<vnR|G_`Y=biI|gXBAU{
z(Ztpkxp3eha<y)fc{4cL*U2cfF?%{SuRG|RT6Nc#=`F655?WEk`G53+AOP)kSkILL
zMpo`{H48Gn-54WcvP%E192CD6E3xb9Ju5AJwV}Ie+SwR=9ZgY#{S6r#&zN8H^&4?q
z9W5!1V=#GlF%QM~=0ZZci~21-1Wti74<ys(b89Zt9lbjQstdUP%96i~d+`&Py#w`h
z!+0;N+_k-mzg{hyv3khR0rBS8@Ri=^Fg+g>`LxrR5uOqUz|uDnIyOendskmSe`kUU
z`m9oO#9hs!VP0WN@&P=v5o06qTv=sJz*DN!l3#zF2O?KgU(>parrTRh&iwM%*UtAV
z!}n3{_r3m?fPxG#2pSL?5D*X)kXeDe?u!}lyqg;kkbNx}5a!S7|8B-kriL!2s+OXr
zW|nrAE|&Io^j6OHcK?47wdfq&=`Tp2pns}B$p5QC<xgo_LrXgqQ(Fg{pHlz#I5@<A
QyFh+=(9gHj73ydFKU}sAPXGV_

literal 243596
zcmcHALy#yyvoH9zZQHhO+qP}nw(UM`yZf|l+qT{P&Nnl0V{XLEi@SLdwaQx7BBOr!
zPX%dU5EK9a00;oZbU9se39uDGZ~%Z=Q~&_<e^p~AQ$rV1RZ9_5GfO*57fX9PIxA;;
zyB3XKJK{FPpWguQ@c!0H662Oe+!ERtJ*ZJGlJJkDzo#ck8e)R9=I)rz<Ge}MnjIKt
zO;7V5B*PBrRl1TZoU{+|hKYmk?~W&jem?I&1Rp)J&@`GZV2b-Xrn6>EW~7vvMx1FC
zIs<;Suw<2Vo4nlIa&k$FmZo=ldsc3S37lV_*_>uVkmSu$J1Yy3_!CFuRm-<UYnxOV
z2S~8%Uerp(H8VO+H?FTN%>%C%)pJoH;3FH?QJ88)!p6nSZxYe~ihoqe9;Sf=NUpr^
znVEUGf@3739ow2r)Jl35{Su31V=Hv5-|35{`m>&vized?t4PpmE7Ds;ldX;^gj2Bb
zB_G{C;8KyHj;l>p3Nv*tbT-Xy^9|`6Uf+p=Quk^-S|Wa)M4#&;3Ir0-Yd^n_g=m-N
z=i4^+*XI#^=o2+Tf-$iiuyg_wEGeI*Dsa*=EQ1MBTxF!R3Vo|gWdU;m&p&4Seqh!4
zl7nU2I|jtqGaK6u5$usK7Xi6~F^YUvshXN<d-HSgW*LQt=Y8C~z7D^vRyOX<l9J@d
zC<*Fnp;;hEwFi;*Pvp*1fedZ8U&FQ=N}8EBwcvNO>9--|3xp0c6!`q466+Coq6;^s
z4LY*hL%O}{rni+YyDHV3V5{9i*-BVUqo8MSN_Pa%sX_$yN8gv%PtYNI)VddhIy~CH
z!juW@aDkO^dMB9@iF|%W=?&uGl<_gY0Cy;)GwLC`6)USbwe&l`!w8q93@@4kCkp!E
zTk4BkTZ~eeD{A745{2Ok)9&CFHz3;h(k*ZtPBa?tL1bv>M--MwatFh)Vhcj08d*!n
z*%Vzi)NDV5v@%x*V1W4E7(9T|5AfPvP{D=Cq(b0XlZlYePf8Zx=D1o@2GGWQGvne;
zrWo5H9JM<s$Qf~P6}f~Ezb{Tn{GB7GC@3lqY$~l+Crupuz#V%*!PaE=(ASn13V-kR
z;hJ>HlgqMOrbkyM{a(+XNdv|TmRlt6y^C)_?LT&8^?^QgpSz%9XR~}aTkbW@JM5n;
zgJr<hrYjO!jVL!XQLAS$43DA+90fK7LhA+q_oZ{Am!!><>TH(KySKkQuF7RDz;L+F
zspc7h?q0xR3Hv!eUVdWtLXHYZ!cc|c;6j3@&K7o=DxD3Y##@jpL+Ma~Z$Ief&ydt;
zNW&5zLoN#o^s#l-xqp~1&g<|)O1sc<1DRd*72n#v$tiYVTHvt0&&xC<^+Y*4Cm&yR
zDSYd;Iv<F#8(r$<W@J6}BB5(?=AAsGtUYNdqRz55Y{^Js%`|G+F^kKFaR`P%gx-(z
zS~vmnLFy@d#j(!hS`PA*6JD~nkU^Q#DxB0~z$J0yk)j-s@a65msVbn0Tt5YrEQ-M9
zSL^D+$6}~XpzIl!sZ8y*`f?5>i9C2Nw!=>K3i=wQWVEdwFP`3>JiNY6&+o@AoUpH}
z?0hPss?5>ugwjjZ#<$L_YSpa>XxEWQBX7lpNj0NF)4C09Z+(0No@@IFQ5=e?<&=F$
zOF$%DUz3};w}nH#QxocE7z%T?{T&m2|C+=$V{fNaW3dO|u&)~PVCe<SlXQ^ZV`z0i
zc7G(D5H~<@yL~9t%{6;R?j>UkZ0LQ-k}<}F4lZ0)W;AfvDYAUDTR8Pb%%IIvfFV7W
z8)48Ec_4bqzufZ0ktGv0YTG~u`?QHaF}GSu`WB*Dv=w@5gfEk4i%WZA)6BJOMU!73
zRp@B<*)pd15nWH!U#sET%rqo<;abRHoO3rFNnYurWbF8s;=9SY{O~OTjm9i5c)DEk
zP`cF#7P}74axooP#!)L^KxBTD=>_%cAT(m1kfV%7!BLT~7BunlfMP)l+5@5Evcpb~
z1FzRF2|}YnR~N}15v)7??KNT;drK;H-|6ps$hw(#p`qbqc;i##J<%AQ_X}RYRq0b@
z?*z%G!)_ryK){x=B{Us@IAU4<8YFU{vV!F71cI#&q2Aa4Lpx~7WEzc-EpQUaG2Bx7
zu@`d0XvcTgb*R5;nVWd-92i$4W#hNYXXhKMlQsCXzej7pgP<in^q|eTr2;4QzqZBq
za$|CR+slK`u=a7#m(0D<)4L9Tof)%ON{nS_2RepyAG`@12yD{_`kiC#LE_EyxyV%0
zE|-?4?=dPgsJZN&=og-V{{u3^9DY&>?kBTjN>q0)S;SFbBrPeNW_CaKe%$%GPEZGG
zPE{I?!7>{<Z4UUMz#y^#U_EOKIG7|?s^CuE=PEfq)*H+B*B#HXCOHKyzwrd?hDW<Q
zZ6o5xow-&yJ0<t_X?TeLtFsQZN$ov_MLzh%b~rvfspmG$9@bH}>kl4MF|2CN3!cop
zELn`};cp^7<M8M&xOh~e-YZ+q9SM2H?H1_(Gl6m*LMR592?dr2nqLe!5%z`@lXvxV
zXubi6%fe&Hy+t-;EZO*vu=f&N*>aQ1i+spxP~G?8Bzio({ujE!f9tyROf?;{b-)1A
zUc>;1|GKWNp{1RQsjY*}zux<Q_1mkSORr6iMv9MLpIuLI8nczP3tFk}i-YqgJoy}%
z&zQyWsN9=%?ui*7Nr{6DqID3<(e3l+Yj+NN2RvK;@pq^_RU**~v&mMT-4a_Q0BBW#
z!aoY>yT7-;(1iQ)OF2oHXmSY*u)_IyE?r-e=3%-#gv<wFxL?{R332Ds2ky;P5)TR~
zEQ(28X!p3ca2vXbnYVihE<d8Yuc32h_zb-4BzAAikQLV*ceowI{l5pV%t%Ji;Q;-&
zcL0Qd;`>X`1?SqEFgzEr!X!jk@4e_D{<);H00evxpHnab1#_1R&P8)CIw&Img$?Kh
zHr32bWVNC|PqR(%Ku^EH!3T!`vl0?OS->OrGBClW@d!u*-1&dgEil$@NC1J%jJwc>
zazm8&LB`jOqhlP8LimlzjlTInL%b9XlKQ~)j_}*K#?|>wN45US@Sw2*Z^j!U`8^1s
zC>pgSB8HBU4iTY2@g5mVA;Os%Vdxbn%prWAihd#9J6(vzk^UTo9_&WE5yR0eHbp$=
z<A(SVj=5P%)PoimIY`a<?|AjIJ~v1XflU31v?*`q5M>iZgS@~t%yHbARlg5YN^vt>
z4b0+yp~qQ-gbWjA@4MqAQWsw)pLdYK#mDm{Kxz}=9YABun=F$w7fPTYlGalhK=ywj
z86c9vG48h&yR}-y#V5Ur*Q}g=bfA}Yo0u(E)y${(OZJBA@Em&Y4`df8qjS3#+A6tl
zlLC%k$4eiCwMyd<(32V-smmS56w<BB-w_Tz)=EoSdgLj~jxoAXXu2AGU9P*y^~xi<
z(P~7y1?V}x1pCFnpd>`f4hASj5N)<Zz~gSubqMdY!vKCkkGJDKL3O3s_B-7H-;RXE
z1NlSOV-^K`VXXreLVVsOX^i!QZOW`UuCZ@Y5UerPdrkwy_^>U&LS8jYugaFgEpiOi
z@vM@XjbR-9v49J<(4`q%2^(QB{PB&F!2w}wNC2!eY#7q6h!wII8lZ%ntHG5sRwBta
zPG)zEz_kyGzy@P0JmVl+;<s593bkyV5BCs8!)sF98(+?q*NTpqynn{VSzB|E$g4@l
zY{hM@Ov9trUvSG`P>hRT8!T3vs1BtcpYk7I77L3SG%NJI(NN)*5|`5^ft{iC7=<&y
zs+01=i5|~4T2PTGFL-gG{<%6Je~)-SH?e<kj=ECM<8CECP1DJkUuGfT@WJ;WJPlY!
zKk+)^PxMax4NEPz=myI2x0k&AYNO6l9Y}-`><t?Ny&$=~-Qtp)33I-DqX?~koFUJt
zGC18TeKEmWu$wqOSHwP^jd&VXtXdZ9P^62*1a<RBhf@rI3LBUGWA$)#L^-N}Yn8T7
zf_P2mYcznB{%CGFe6=CIO`6PYwfc-ktIT61Ui)n=@;2|j1q0}bf}%CtB`a4t2PHGi
zbou$WiHKQOiLslomkd<kVY9qO8sJ^=bBrl|jXpwtFG-#Nueg!>QftrICq)eTbhnDg
zp6Q(vq;xkw{|U>vY-Yn*&g5nIoUWPHCYVzUOP+4@OW9J6Looj>2VH);OuHi+=d&5R
zn0g(9#r@1^cjn$zR7s_lD$-BD&c-R*8VYHBLAIm*-buT;A{QcG%3X=d0G-=uJ-pYM
zxw-xne)c)ZHDcPD$M8_4CM+lBn=?BT--8cQh}(ZFeVp}J{3#~}d6GU7&vS4*3d)={
zy|n(CteML16))xLNjQ4qrQFLcK^qMx5R~;T{$MhQhV`}9q>7Xu)CWcV$1Hp-O56x8
zAXJwsI!UWjdXWyhKKejYkLjh8n-h0$!wqw`7sk;d8-G?hOT{+!>ti3mFXp)A!3_fP
zB?u)G{a1?ch@x4zJTQa@-ou20EjOu1v7*S)F28TMzvXzFZu6E+6l12U0hSE~J^TgM
z@h0Iq%mgT^Z&}PwK%~s>4G&h7m|!g@=s*aFzn)T1W~B^dehjYPBuH2RUQnkrqCM?)
z-EK{c%_7UqV^vJX*P;or;g-AMX0&C6($OdCrW-;NM9e_HkI)9-HEeD!Z!cjew|Fia
zu%Y2_D{y__Rp9m+;rXjlc3%`?gn&$7ab^s+165)#VYBvJ1g((V;wZ}Wg^2;TJC3}$
zWZaWykyLgkcC=M8VPmln5&eEXe||RcFbM#=)i~V!%yt4NJ?3fRo(MYkgD>>G=N^dV
z5h!DF4H|&6AXaIBRx@8p#b=V4_zi@;510JQ^S~7f%h28Da_z=-_4dd8t<JVb1w}N8
z<a)Nv(A><gp(Z_2Xyi?yGnr<#MBk|QYuF{1o@{ujSvxmsnH#d6|2sY+K&^XBJUM?s
zcKl;j0%J`^B|y~wICO2_TuVR(D6RA1wy_s36JbVVMmM=ey|bhxkP=Yf7GqUXlleA6
z?51t4{)x{l2msmZ9VymHTk-mwl2csBD+k>_YIN$GaDR!g{{q9HCu$KqFl&0pE&j1d
z9{r)xHCQ)UV_a^mc{_0q4|3hE(%KVBNJO_7Ccx#f0OX?sO!Naq?-+AT!r~h98i_4b
z5BSkWW{BCzI6LI^9c(n{lqfr{c-ODX8*+qs2)nx>_e1QInTHS^uk}K^)7XCe659Tt
zqb2xDL<j*jtF`L=<nu2xWNAxrAZBh@zb<h~572(_I@fy2tIhaOmrV=kBi76VX|nk(
zKbRb8r)KaX!_WyzT;cKcjyDSrah$I(Qp_zTTyn9$C=J>6g__qwoU6^;%@o`kVR!!6
z!4~@GPt=;xx16s(J$Y)b<rR((tazVwQkk=H&w?DPGPQS(CID3Ms8fdTzbCE(;wA}<
zT}`S&+NMXu*)KA}9JV{4PLG0bU|VLp`6HL#CVHik3j3|aSU#?jv6nc8t4j8HEFqER
zN)*L%*|N~a5zXJ@wQF-_LR-g5ABU*nMPe!p8^Ha0_wrNWFK3($((neiWrKKBTArBg
z{|q~C!8RE9jV*|t5r)2VBs`@$C(SabA76Kc`OXb^O;4g`-P?xm@k?YD;RH~e4o&<W
za5uz#qg_+#k%zwjg1f-U>2%xgI=a(4n32r<g1Z!?@hcJF3nN`nuy@5>FG_2@TS%+;
zjE8nK>XmnrGWlKVsW-UoOc8DMk_X&Xad}Js7a#aE)i~SRQHpnETF(f0T|X!t!{`Nn
zjnjJ0FtfHvCVHeC7;d%Suz&2iU7<bbd^#%Ed6lV+^oH>9HEPl(AtP*$D}BnT%RPD7
z1Sp852==!`Ru>*8YJhvi#~a=Jk;1sj2HA&qF?(uM_`JKv7FUS9Y4!TFn)!44gW28)
zcx!fjb{%9@T+sONAnyRMHgProONrKj-#kYdekI?77}uEpRKGsFHa;-SY`JHo-z>T>
zvBvE`weA1Z$o9U61m{V*`H-@*(q56FP4z^vBY|VDS3bkyb80+rVOW@0Z;x|~7aup0
zYgu(~kE^50u3E@<mxy}PIVkSKw9(<KFg9Od(M1nGxhO2GdUxA0(=(=4Gk>JgUVVoJ
zXOQ|J;jl2DUQxjxZ}PDB3h#CMd-siII9*^-SX%CGH>aX&i>+n43pM@3AL&}E>G^al
z*k29s{QK;gqZp?#76@`0na(^n2@52}@`cuTh9ZFr<1261hW8$aOTe#-?HH;2QZpp+
z!D(imERSL+WN6{EwWlzYc$MA-ByFr1{be;Lvt@<S4;eW+sfE=S1=cxIx``0zHFK#!
z|B$8V31~2mN{zSDWlLm1T)&zjr~#;E4ThPwY650(D9Slo%u&<d@%D~g5@=_In%62@
zutx)jaZC%1@&1Z2)+%cR51#x^IiB&XfaI6czl|ofq%~JYtmw<w-gi{HBh@Kxpz5hT
zRp}PL^Dz>)n?yoFaYj2ys<aL;B?0~@jxvHwmh}eTW|`_t!0S#qC_x?wA!T?<T+4!M
zq^^?cHid#IH(o6?1Cl}xHZmq5wkAQEDpF`r15e;V0WNDQrNOIarJG!<(56Dl=H(qV
zaDG;#valsGP?1DqMH-Px8o5FiIb5Yk!?-31IYSoSH9$ogph_B$LKfT{>Aw&C8mHqt
z7b0y{C#;#FL)xyKIxj=o{LwV99mrZnnqiS*ah72CcOKu6rj|(3G+B^q5aD)c0;g_}
zN0&DLvSsV24m}YP%D4(;=q{G9?N1WUPxg{{tv@SONFFt=Lh881W^aJdekNp?u1ZwM
zcQ*<Rr0N21auiBEicpC{pX4}b<F+W~4mI&f9Y%_nFCljsqKpuJ90V5AXDK^*rVRUu
zs#kMWnJS`uqVqOfTv-*9ys&T?9ebvA0^BG+4gO))x|nYXpNFlQsUwRrq%THa$vO0j
zegrH+R?F3wMH$c&!>{HV?W73)j-k^yMX8P@T01-oJbBc`BCS`S2c({<WP&p2>;6^G
zQO!;N)$@9-;}|8=`|`f*+4ZS))%*B7$=&rai|xL9UHJ5S=A?UW+?BrlSU%Ob6zyx<
zd7M7gIwkG1-?^VQS33mlGvB$Lq)CKTW>@EKUoElHOZ#IUx-^x)`qEb?*VB#CoT^M)
zmuBSIvNSQNOl6-Y)!_(rOj?<|S|;b~)>bOAaj7!)nGf`ySi-k+nlc(suzX)E;rIoi
zgv}q7G7?XmdT%Ug_@!{V!B<YQbE`5GPXu~jEXmuwN*RuC<;)j`G7wMXdUq&+`K2&v
zldlZGk0STNQF?oNLYDsVr}q_wr^(asrNr;eOEGd2eq}N=msSm4A5EZD=<fQ0u)(r>
zQd4zxC}KsdWnbt0ZwCG#CiLaU&hNfA7FZtl`#w263Hh%3Vc(p0xPg>{zz9h|(J%r(
z;|tDcSIage(^y9OeJP<Ejt9_fGDdsyZPyPx@vHZ5`0r!iFaJ}ZV%;2oZ~Qz9!C`ta
z3x<tR_~MvBA=*^!&@XE8yX#;;!VSz~0?2j<982`{hr6g${o8HSf4*Yd@FCLxWun~7
z)+ApD{DN2Wuex8tfK$|F2)X;*CJ9JycdR#47VMA@5@temy0<GWl(7)Fko@(12*1d^
z0R}CGo2D2*BpWECb8U%z5r^wUR@{^seIETS`<|;sr(Es|`d$~H42_YxldTRAC{Pnr
zjK7apgOZ-PXKtRh7JB_$>2M!0sa<BS^}jLZKl%!dliX)KwbIiRI*R>Vu;GDT>wxd9
zjg%?PVe%gsbCE<7W=V~6ECS^jH&|c#+?XsB5jaAd7FdFpkRPewa{yNNxCK!UnI*-5
z!2zd`e(Q9C90U<Qri=AlX9K;2&bPYIpm&j&f_-9Z`(EY?i_bzL77_1yElggd+R$%Q
z6Git<T{3pXC5Q!-gbuxtS+MFY6pS{hCZ=&A_;e6(I(in^*m@`@6-fj^v@`Y<>j~#Z
zZ9GjjZ!Y|1*;bkh0j4(1Tp#>^M!kl??Y|?svNN51ZRW@#z|7%k0K0A+(NPqVPT(re
zRT+wbCGziG^y6J{J()2eF4o%nPsb8xmp`kC0c9X=${(-ru!FT#&O#_fv)QhkA@ck+
zcjpJ|@Rdjr)@deENCIR72odnFG5opHzN<0xuUT8ytWzY-rAwmL<!2fq3ezqJO*H$n
zuFOd;TdOFz(Z-7dMRF*zI23<K<G@em8b8|0$37m;9SEO#_f$#7muRIC!@mXPm%JYo
za4e$etU6i#Msd}D@OI1JA-Qrap<2^mwUbA7n#2tUvfM;|@3hCG8pS;Kc7Sz*E>{^5
z$6g17-FE2sg$a*9p-3u<NTQRLjs+o?n){s|wR*g8)LlXvEa!O$uA8-VW43N5WxueL
zfks9@bA<fqNUey}mWmDdBbS?sGD)Hjb*&{M4!U`zRHJyRWh@Do{jN$jz($f*2^T?y
zTwT%gGnar;4NprXZ4ApU$@;h#se6KQLFPeE(p#w#X`VMMOJ9qLfJStSlE(gi0Uk22
zq#t}9DtnE)NQaJ2%gQUKvFR$Q;3^SF9yR!?((sv2u~-XTj_<vYX^1Y5;et!n$dnk<
zSF9_V6z;=%gf^@Cl{nK^aoU@~Z`{Bg870}5QiPV@P^5#6>GB=w_5w3=nlu!${vgN8
zE49#C`c+&{_{UfH;VKreIi?5Ivnio^jmZExwGu^)Z?p`7&hEB^aT8MJ`MrvWl2`G9
zR$fjs`!%r&aKnRV1Z{q}aGqI2cf=U6>JKU0C$B776xsP;QgFM>gmlIzHoeES)~%pB
z-8BY%+ysvgCs80SP}x@MX}TO+bi&jM)f}p^79DOYWPu~~8VSH<G`i^@-<_m@xLs$f
z7O`52C}Q`cJhKb8vqBF};^>eyx3eHCEk3KO#1Ow2)~`9?TRVxrGE)9x<#cX06#Ms`
zVtb;=mJtJ#pQRIMiBe&>0glaQOls+uY;8P353C|YO08+M>}8t{%ALn)>->JMJLKe(
zo)Tuule9P4xx$ms$F!N^hR9e^L8^ln(GPP9qP7*<L}}Fx97~S)aGU!EJbGYrWyn+t
zFfs4=_1uIlyhchEEeXS~aI9khghU5Gf3*dwx75LqzG!Y=#E}{3B_XnlgV1MO3x){E
zG^)mC0X%6F-{r5{qnTB(W$MOJR=>XP4EgEd@m@ZyZUay2Ea9O8%BbL>{}#Od#jqGN
za)Ssgg2&H*;Fa_?z!{5T@!9LCuy_z&B-Dk32M?lyZw3b|+`WCp3RYMx>8`imKg6K3
z(HCWTG8=#l!r{-B!hVTisJdFkf^_i>Yj@e11hgTGk0X^$f660CYS=<%jR_}GYao4T
z3AED`wyc2vcqNPfk-+Jzq@a>^g|+<vq*Dhr8a~?Te2SpG5emv3+Dl#c;Zsd1wd?K_
z*bJ!xHuL>@;>L2^_aezDNWA0U3+ss$3krs9Kat7*p2q_vM*r5c_)cz{<M12;H86?|
zK~8(Vh+p6W1^v55adqQ#v0Ws_BE19@(4aJIqEYGBVG|C`(tTK|?7QiBMy6#`c6Tk5
zzMTaNRPjZt_|xYoe`nut_{;79`8%Q&aWDTR{lNZ7Z-4)C#oB3vrgTysy7ujJ@aOqD
zsmAIkHdA=;eAb{o!WX|cw~G)`2guzovKS~lm<d2G*@J`LN%-zNV)tP-&v3Kj5a0XI
zqixJt5p2AzFBxGTAsi(yU(Zi~qwxv>F|Q^z{;iGs2`yWBll1I15dHn$_z*6)%gw@g
zZNxF7ztVD`E4~-oKL;?#kAwpPHfV787BkLV@3a@i7%f+84Zdej+YkqjkE0bZd=J>r
zt5=q$e#WQ!3!4l23j5*u>9l)u>>o3|OK0ni(h6Yqnc!gqh<x;8L=V%?6z8!DCd6_S
zoo$B74r1gGQ7~t~H6(!Im+aQ^;EyAH2$<<f@PWY%kQqd4jCBzLO4R@l+m~DLeV!xf
ziXAq5qxycj9fO{w8Z&>OWSNJRui9Z4xcG(r;Lo~Yb^@;1I~O-G8aXq0cg>i|<$l&b
zHp$u!x=~$Cbnu;z$m2|2aAX^JG2?@~braiuU~L)Jrm1k)Oh9I1Z-Qx?D_}cU<S;lG
zcCE%%+faVOH8hkUX!zXskt*kuS*MASh^lyjp|N^aL}yeaaV&jw8etgMkXN>lXG`LQ
zXU1ii3;Sf~85aMbv}|8e<H$gCF-V~67yF@)L+0QBwDee*nBZG)O~Q|%qT8vzDG5oP
z6g61itG0wC34vu*AZ;VG<WWTfZzqW=D~1iJ)HB|s?^s?T!g3yJ#|FuMZc)?1462Zr
zG9bXZav-!g%A>~e;YEqyRwNNsg%w(P%SFE}>BeHja&J?!Muft`T4!-EG*DTArHKY>
zh%6lm+E-V8=as^|<X{nq)`~@$@n$U=MzS^buTRe~kPx|EhPO2i4{~=Tnhv;LL-GZx
zCB&rH@n&yV(p)P#=V~(_9}F#Tgl?I<l&-{-iNS<~=qG=X@MN<@v^a`cJ|$ri?2S93
zh3iAK_4gl53I)i1cB#?*DSLwgY$cp`psUvx*hO$2092)cbr7Jzb*!d7juI>|&hDrh
zRDI~0{K{UDuxN3fJ0Y5A1AM9=QP34wt|y;RI5`8rI**x+nCaJopxq^F9?p0st%$=W
zLjIajO7{ecV^gahOgnV{WI%sJg?OfrV_Ihk<dU9fkWFx|<V*VtU84ljHb2$0zyX4H
zyceqMkRM?76c=Wq#usiB^UHS1n9gf3uA_InD(Od7KN0MKA+m)K1MGZvdSKoL>BC3k
z4tbRRGK6ZIe!>8k$g#JLKU;uu?%bi&3i;-Pl}7qEUss1<bTH;SHK@b)>>`j$R(66>
z1|qJ#F_%64(Qs4Sfv<F^@j0877KeTZL(%&HDH^+YPr<M(&m>2lI4~23zFX4DQKX!Z
ztM^XkiUC5Kc%Ruz6C^D@aprJ_{F+DNy6ljRW4`hmI|AKR9X51Bck-$d;sQ^@VE2=^
zrS^LsAZ|-`G5c?JDLV}{=RFCM6jA9uN1y7I>`K9BtSsT)WgE**v)V*7w;a%>*0C9=
z&*VCj)qzLL0xC%|Xs*Rc?{Fcf=^L;MOZz^J(6WW<Q0|t68H4#arX5LO87}cEocbF=
zv>xR%XYF~al?WQ+HKtn{l_<6DWbIt_IPK$x2;CvLHDb?dGjd2lt)LUvvmJjJnT^#x
zNJru!3prmnGoyYy@n~QH48{d7aNkCkGp^Gz`=7pKb4C)lQJe2jpKEdJTNPy3oO?l%
zqJ6k&hR@0@E)tRQIAm*Z4>1ZaO#P{0r4ZA_Ik#yBPpkg(tmdD|u~0;(g(*^GE`h;Z
z<g5c>yftd{wiD6<86Cqm=TTa>$`rp8{Hw6*8A-;*Whwzh1;>-ZO!exCK&_>uw82&)
zi-0w#zeYLqpwy^+t-vaB&H3PeDr8cCS?e%uz$=OxS>RWLlGNa|B1c+q&!Dn?c^n>J
z!kpI7V!^Wm($p1<JOs#2+{!O(=kYqG^-und&8-}-OX{R3GkR$U4WI>n(6>N^&km*0
zU_;~P$7mnQ6F0Fs@}hr^5**hg5kOd5e^3OL)ITW7Q6m8Ffg&9DEOHiIF?#!Aw(Qt1
z1MD61-bwn#r&B>ZK}iiOUxE94{fVH0c!^I?(o<2j&!#qNDoA~JzpaF|0~b}=?E#A>
z1kcW)5I8jhsSjYQ;W$Us7y!CQ0ZCV|vpLXw&j<1K|Ms1~4P?tiJkNYfND64@m&}Ih
znKxh`TY3mG!0HRdEWw298`LP`ca7G%dv75{E8u9ZjJtR-W#=k*Em375oPgP&dz)2P
z_>K(3?yshM&T+3lvITUn5qM7YO==<&l)f2;RCZt&4|NYBV}b9)Gz?Q4z{Dr7R~xH%
zNSGS)fjyr;LM0UNDFwf`^_bcji_!+#gWvFh$JymgP9@Nb3l*Y!l(QXRXWpmuW$&Jn
zLdj-(@9H8bB%Hdrz7)k`5Y)Hp5Ad@LG3R5N9DZ>|YxBJp!P@z*y+>vSM%6snZ`e0r
z$2MS!_4_n^WqaZ!L5O5zaWWv1aC|~HgAy?W+c`}p%n`WHClw2)K9W$|eApArJzS=Q
zkUTCO4$CjXn>8Q8?s~+D2EB6R6!{ku!U;|I5Q+~}B_n>ZSm)ShDZBy)o?SkM80KqV
z|EY9vn;vVkX-)m+|LA6xNvbP^nPcnxx>uR^);T-61VNHj%;vUaIt^pvDyKn2!YS6&
zi&EZozZ&Y*72I=KiuntA;3ph+sw?g%SVnhMh9;3ceCPqV$!T)xCfMr;HVRMQq>8Q#
z0#3LY4&Wz*<`N@x#~y0FPGwueu<q#?Jk5PV1x=+gZkhd00^CT}*k2%at|0sZiXVHg
z?kO`@8fW3uE>#kXjV<Nzx$AKO)FNm-Z`f3mMOD6mD7OGey&fI%RTzYbypG@9XXW^`
zSRRi{b6Bd0>;Td>=9+GFc$%gU=ZXnQx_R_0R;+9bGN<jv)bZ^e(Zh1_nMa+f49}04
z0QEg3*MzLgr`#<ahLjb2(5h*Ax7Ws;_P)Sp`uuZ#J@ElBPxUE8UT+?Hf`t=QwI)5h
zs?AM`>|3T|`D1znGnHPE6n7g2hfotKS;TXTMZ2)QXH&_~P%s%+XWdH-_Y#i$h+b3C
zKI{|r+U~OW(bJz06T2C1K^60bn-_^oNlvaEbZkW5wx(MEJQTZ04GpsAjAL-M(7$rs
zx(JX5kR15}uB!1&PQA@@JG}duJUu$Pv9lfJW(i7CQ_wBev5<}Kn}+Y!%gL?rGDd+J
z;)79M45~{IZhN&c&4%fDl}%s&2H@oYvMzwNVP|!uh9JTMo3Kw}CxRW+F;0Sf(`YoA
z6$m3-5Vz5~bg3&CM%uH^*?1@tY30s?<0j9PESk~VMfU$eYEV)~5OI&DZ0y!XCn_T-
z0>7#tVd1_KxpI5&OArV5;z$S_!A1|4rz^gfr9+;P_RzXT{%fBqugh=(hA0b;0ZH>j
z<F3}nyQsbCfJVVu)qH3Kbk)hf3<RbAtQo9^ow|$g@A5ZkAG&-E>(m%a*(KI_wF}he
zc!2&<f_sJ#IIA1_D)QPdpi>JFk`GJ{+7pn<7KC1V8A4X!@kQoTS=#&fcgnZ2=S()i
z&}4tvTdkDb62UlvlKY%UCUG!;hE6ZO&D*<-JQ}<6FGVP*`hk<yUxqF`fA2E%vZ-z1
z-Mn+A3pYaj1=w9owIgntn`xt6+(D#>P+ociu;K$$wvAZt)g&5Sn!vZ>?qiO2_v=r{
z#Q<CMZZ|nggvU!A=n9gg?r;+O$U%iRY;9d(`XRZTT-l>P%1Bs~2c?HJ05pR*Du1)p
zTQPiWD$*NvmgSH}6@S(aW|3`U&rLByy4D+|nYUQ8PJ3^zXuV};(8;t++eazeZN0U>
zVVyAfR&9roId80lw=cy!YST+VMa{zMAP2?>SWw6jO*AD<aV1g%fzxL8-K?^eQ349U
z2w5$}Xt0T+u?J*u1QGb$pp%exanzNO{Kv|!h!rkUz>g}B8t-sH$$KTMPXr=pAJ4Kk
zP^ju=tAsKw;A5ejG{GAr4W)=9`iE|CANn7WF3Pb?jJm32=r;T70MK%#%b<hrJ4m>M
zL}ER2p&U47CHK}RI#o-NYdh8qz~p>FfJn#GS&)8K%a!l_jqclK`zHMzeg*|K#90q{
zne}flCOGr2XsNABy|4!PN$gBLRh%iEEwC9Ep-8;ig$+(3g^&o=#$l8hsd*+7Y3~({
zT!b$XZh9^sPb!O5A<HnGYET_@0+&My%{h*X%L6@X*u0Jnq@p9@u}kf>9+9PY?>q&q
zbWSL<^X1%rd`d>JDfm4kBR-wbMkSdnv~4{g5r4mQcf^h8MmX@-aw@Z-vr`f41kB(V
zl>wDs4l~VA6hcM?oIQp)fWi2LbdI<YL0Ad19kUL?Xy+xPrHN0QrV&yKs_UWW;6Y1<
zsOfh1K6#8zjES9KtK1Y*1&M_%@B)A^qqH0mtCzPL)Dgk0n&|kE2|KA4_ZCsH;0ndV
z=Zb~T<_VuHxC_O*ICHU1&i%>EQ{38bX}fM?m3{5KHoIIh26b<V)7@T}5+sItZ?{r?
zcxPgLV19@G=r^?!D!?T3Oq4ckM+R|?BqIOdh99Br&a-j(`xocR%I1Hs829xIpH!L(
zPTReq!UWRHx^_`gba5j7k-p$b7T$Y5mZ(_kytL_10w4Uk*qJV(r5|m!wf;cvX7H;8
z`_`p@_b^ebiU#2U)wsum2iv}P%c#O^rN{X^w<{U+n@G}F0i8ybeYcfh;YcTw&u?*S
z5==wy+*B7dFFtbb(!C3J<!`$|2jW;j3ZE>JToiK-Bh1rcNDmrmFn5bEu@v7dHdGxU
zZ<PG&?Q{Uz8i@-G{@SFRcNuo>*0BmW3P%!k;6;jZ%cAL_fbA2!j~I4&nR(ji?%;0O
zH8vCnoL3v7<8Gv1q>tndxdN`iv0r>lFC9w}B73A^5oHfCKtR=wvB8A{bw^JB0#D>1
z9*-OBNyOOOpZUntEa5XxsZ}9{+*MLc4G#(;ESVZWVB>-4VY`MBI+WA-Qim8)h3u5n
z3MV(m0^{qoaDDJ^;O1&>77lps(O=?it-rY~ZI82a5a2>j>RHg+E;Ul9&!?2vR<&t*
z7RlH;;o-}Bj?Y<0E60m(gROtdWN|4b-G8n({$P+G11*0B>E(C~YWoxv`(1q67oNCz
zHcb7hdLpkkm8yG3Ia|HIOU!d0ryAWAsov>My!lP<!h<A4f0j@evYM5L=tTSAI)YCY
z@*yxl;XwIVm}dlqN7BH}BRZuHj#Fs}R2UvH$>a5JDEwn|qwBEFH(4Wba{)SB`5mxj
z5FT)d&Q`t^zEyU%)-Ju>_a;KX2b5UnaWcqm$f#tW=Akk>=Xf-@`c#7Me7=`w3}9cy
z>|Z_f$03qf=gKBY+F3w9NEw-Q7zT!mI~ffj$E&P-RQX4lySsV}^=(@n(RR{2+^;=>
zqANjSLf6iVxWOl9Fm;GHopr)F2Ca!5O?pV(#BmFjTU)KrPyc-rYr*wM2>~^t1$zBs
zeSFr{nybw({U~m`blvei{dSkkzYqEWfur|m%d91lowqq1M#*ZKR$iS-;OP!E^Ibvb
zDJQk6Oo4fUH12JM4LIKG@Gd4M(z>D3vQGE1$6Vbs1ocN`nljT6gKR#5%#9;9=3g+W
z^E^N|O+RzB6lGQyYFN19EgD@%IMaB86=(Krh5=S`?wHuk{xBWaA+z?)Ybt05d<WLi
z&|8I>xPSD7HE&3HB!P<}(>?r~w9KL)51CQG9P-UdzRf5_#kSkzi)0*}#Pp0JcY=rv
z@(Kq}a@1FLzJY^{mgYiaekia=>%hYRj<zb^JF0p$w)yV3@r0Dxbbo#;cp$%ne?h+q
zH0Rg}fP$}76YK1L9`j#nicV7l@;F{A-<Tm;Q0am6G$DbmXoegA>Tt@DPgB??Qvp9a
z#O?cUR|755oLx+!N#?0tHptZ`rwC<IQB)F{R3pR(Rf)-17FpNr|D7IsT$JSZUb4bB
zz3g_DoT8{7>_X`+cGI<=?_?b+b{o0^Pv62nsu&OAuxiojkje@=yoYTK_<V9US~#kh
zn<wHMs_t=)J}(WG2i&KGo~b!3wu!?(C~vlAESlNl;j=0(_PmG!AZ?Iw6;R1E5WRj5
z4=XY7wLsLwvTg?e^GW!Z@^MVE&(R(|7NF6G7PnOiyj8=-r6p7!P<%5BbF_0XXxb1M
z71u|aaj?S$yg(jfmZLT?ZH%s#sBfgI)XCYe5Q40gQ&7I47MK_|v7BY@W(u3icQIQV
zMg|%>fQfgs_=$5vmBf39O(3><KpY9uM|qFmGjK;j#mr-(Ur4Pd`%lvBWMiFqOhw=6
zF!TB+M8%XwPomW?P``v14Z~ay&lCW1QbP}M$%HcvFgr)Hl;MGsEz}|LlQecQIq^p|
zF(r@US!!J!kG)iy2{;B<@PC7=3&a$r$yHMDu23R*68xToft2djutB&<>q%d4sa#S)
z=NHX-(=51w<CNqQ9`{6>6BOI01V4RlwD|RaE3RTSD`Tjljz@7@$|(w{F}e3nVF2Vd
z+$?MbtFc}asvsy;5DW@Q77*W<xt(hr#UPpr?^6)n7EGYoJfEdDXa0G<5<2_c1;7md
z{?jHJbF=9x*IJurEL$mdqT4L2_$-P_O*|?sshAhdcD<0WqWymipG7?_DvH>aXc47X
zG;l83;YUv#81PojJ~j-5K%-dM@<>YNtO%n~i@bsZQPWSopd(U0Cj^4>VN=xroKa7+
zII1vme)xfpU?=TasLT~}3O5YAWT9E>?%($Z{q*p7u3ndSfM@j=@z4NdRq@aQ1aAWw
z=Msjm5P(GS`4|wrl3xCDB%oTp{q<IyKMF4s?nJ_a1JT8^fQJ$4+r4E4E3B3DJtqU?
zj&uKvDpj>TlGdiTHF;I4isqTdIKc1f0zG&*(^znkyp<%voa9v;^q??8)i%<{K1*Xw
z3HvDUw|_W`AF6~cmT2kd{KW1r!yl_lgf$)F=xC$kJz$v@H=3T1%Jcm*m9pvJ8rTXc
zTAkT&yLf9c6ndHH5F|G6OOVp_&7ttX@OlNW#)J4@VwzI2j0;H~K=dTuucr=$fgNfp
z2GW=J&r5G5f4~c^x&3IA7cD$S?Js=(JC+7*$B|9^virGz(7t@UfuT$8YCtpoMEXnq
znEf8pI+e~7=0enE{{&_X^%AbMk&e^%sg5rCYM%i7<?m{i_-reM{OU~|74fxplEn7+
zsWp0Ri<&aq{WBoji#lSdkno^w+n8cM$@?0uucH-utvxvRYA>5x7`;nJxf<N-JLy@E
znr$9Nu4V*`YHd?szk4D!OTJ)k9~wTvp*OnDCe7L#gUrU>3fnqUz;>d*X}CAwR)?**
zuJnRyWNdkqvA1^foF?O#RjY}Wh@yCosj+laNM}?eb)ay08D$vLl2@{lXG7+QW5%UL
zDDKOZ`2V8A>KR8ueP3OAEX?&$tk(x%r{T~|)ZUZ?B!KNgWaRQfD_GJ{7#2m+PC_eQ
zRW$HU(&(}xn8->4<E^@GwOwSak#S<RB7;S~S1IU022@E*7!hGyI1$?|WzpjJa3V$U
zKP6*-3@bMB7Kt3QbtC^LcsPY`MXJPdIiCY3-JA$JW9Jq|D~aRoFza_zTb&3!KpoM-
zhAZCp?H1m+L?t<4=6+QuX81mwQrN+yvBxpt<Y_ki5kf<Gu6Ys%)FB@#qTZ;hmxG&!
z|DS*rP37(XLxGIK1NTB)fwlm=RO3nn1y*awrWDRD0I@8POj*IKEAIyqRkT9d7#^5^
z4#O-3VbMTP5geKujBs0V`ZmKm819%dkWtJVLZ1~*txEpIXL7*bkUR=iqxRUcJkxmN
zw&gcroal3cK0#QD-C0PQ9yomnkh8=3w_i>baXi;`k{&2{oW1P+8wu)rAkS{|-E|nI
z3;J2g>&(YFzd6MmQse~X+wue}mE_Ofh3I&!ZSd_m3)2JtOE>}vCQ#S+DKWIc>+&jS
zo}7{7^5Hm|a^Ipl2(>D;x@8=-?QPvjuiCFPJ9K*(i(E%S1CANQ1PPZWa9uA-7?6!Z
z+b3z^%v(mp(eog4!wjrQyv69D1?Ezd4l~Ui30Se?y0aG&Nnclv{hjJQ;Y);|IN@w6
zE@8L9WOeM;I)_Rc50YbX-W6i=4eJwoW;!XfYNk4nvtwb-XgY#nPZC&+OSBHB_JJVm
zm%h!%@+YlB)EsIyU#pD7)!Nr`3pJCq%UmUM!sOS8KI<vVrNK#Jm4It_z!yelYjFtL
z8gtA-&L7Oos4Mgv!Gwc^dCm*ezuxYE>$t#P-W}(6ajM#HlG*mV;LrqNIHIPlC`pqQ
z-jr?fn^AW%Xkq<tewVkpAV7*Vmjt49r|4HNd{bRiL8M&+gaV3cj+f;*{0FB(l-82d
zhB^o=q6UCw<Xx#=>E4=K;8^6-vmk0hgj3-$tKThvic0#?ftJGZxFFR+XEU(2;C&XD
z-QJ!e+;-lh9@65UriFo<7}>f1*+IKruwg-^cdladZE1H~P%lN1*-bO72PL3iG7}_j
z8_OraZn*3?lZV3$x5UI5Q~N3h5b9hIe@`m<*T;1@uuffY^PFLjHl~&da!)-@)4GfQ
z+)sAnzg>SSPcEqMX0~W6O22u1EQhrMl~+3K0*Rys&n==7I5iG@WSUw_rRaJnOrPg|
zCME^6@=4}H_skfvPb}UA8DRB>U{qql_5IZ<=5veJy?tpXMJwcJtWG|EGGXH`e6rx{
z@pSy_)?iL&zmy4{m|6XxR=A+~(hW;M&nA&KqdrXGhY@9bHA2C7dpATKGsshiXWu#~
zo-X;iejg>ATk&7#dMT1h+NqVLV|{B)^K%)Av-bZ7l2V4PS=i@4)(8ourw9dX#+}<L
zvuKJg&^Mtl-=9wQ`NFkuKQ%O?e4h8&{0-Mg-{1ZiQr6urZBYKpoZ#G}pyY#6N87Wr
zHR5pm20q^6pZeFb0z1`aAGfgX==QohKr~8OW6JAOkm%bwAHq9hF3d}d_>R(%N$_9b
z&~9w6dD~qE$t5B>fBT4Ifx$`MkUQyH7XF4Eb*z4Mw3oz39GQxWJ|J8_Nl-?5a^s+D
zBl5XB(*o$B*h^xpkv(A;hp&M8mv7UJg|x2>j?G*My7juRWOkw3=m68Fy3d|dl4$Yp
z1}CT)U8~ia{*OcmmkKt;CYS_@9d>B9c|%}YAe>-H+)n$<&G{HYu&IzH9KL4eEI3Zm
ze8I8_y=|z#O=9hqCgKKdv6+TI<S76*HN=dZj(PMql!t3>Fc5}ir=5d`1u!1KCwVgD
zk%>C7O~V8wY1f19wZx=fkq*N-IHC+V1_aG3jl1d}w$zBpiD{Og`m>*+s93347FSV%
zTr$Gvt3Xq<f0)2(*}5H%efHerM1$Nqa@Y!!_V$^)4N$g@yl0G{=-#nJBGBwnqx)rw
zZ#cqX&K>C*$lJUEV<r<20H#=mQpK0X?wM9$6+&9=<emFiS=N2!chI*~S!1Mid&L7E
zgh>Wt2+OQXq8moxfSEYndv)WcaK@msy96piLDvo)HwWyaxsSv^1EOvHcNQ9o&J)<5
zVaAO$gd7^kLuUw9yobWR9_g``OsgH$w!7ThX}Kkr0dAEQ#tBI&<;I3AXNh=stp!~o
zmD~|dY8x`F*o>{IEkrjWpP3;WITk;h(?FxgH3u}nJPC@ped}%<-aBj&GVY<KMUaw~
zipbNJp`Rq!noiTr+OM7Gd380nU$<`To=|Ms$1C4!y|#U3A2WT^X+xDiYOjKIt;62$
z&`Ux?!K^rmVPJxQ9hL;qR8!IfS2EoTD0Obn-8ex3C8%f!T46R?$I#qDFf&qn!Ri8)
zjI@udvQ%>3{*MdM<o<uT5X)0gm!~QP@^zu2Al>Di(S61Ogb_o7ceoFZT;gTu7y<I8
z>pG7Ccps3416wv7%*bid83ZEhi7VCLeID{abLvaA%#)y>n!oN-!(hw~2gE28g1tqF
zcYS=hQNPI1eZD`sKf#aqa06U_FmE$QY)BLa{Cqo@O>0!-jo-qDYG~rE=uF{kiOsb3
zMVASAEl`pImYK~nqBQq4<7^`1k&3ak!X0jP^V#KbYor*a6Rc|@4xy^aV0Z^9@p)l~
ztXt-(!IiZ{e6}cj7qjv;KEh_9l@6KY*S}mEA5V!{ch&%5=^-8UXAU?d!ECEw=?M?=
z`zAjnriL+2fwP%ioei6q4p7IY2+gPrCj597V}PRWFf8EeFwFn{6_1GaArC4bGhvof
z-l`|%vUId$C}ja=6V)_CFTjVAh*a0<?SJ(gni>{3##Xy7q6!uZo8tihWkP8=AkwJn
zFs>tlTQbx2BNK8_E$c6*X2B7P|1TbL6N-0p=3<>%{FRxZxaL#7w<{G87z`Q9UWSbL
z9~;plCk_<U1%|lXn>$XDwvYJc+1Gch8yl<di+23?3tD!08Y+U+zB&U)BN5YeS;5tb
zNCjQxqYPZ&X*zMC(PeGZu@o-MW0g01bZa-xVr$L0{N2D?2iB8&&(UF`W(^(E9g4xQ
zIS+=*=%!(<*;=o|Re4t;+$W{9ktRBeI?Hhz;ryOX7LV`B#x$6w-kF^~Xl`uM?zLM#
z{>t}Or#{4<gftFaG?^^+G-jBGRlg1t)@a^3VNxlsZG4z2X8sr%;O%%M`Wl%V49?c9
zoM$a|+2*kxI1cx}v4e9DQj~iZ4NnDZZ~q;{;Pdm8^E!8XSF^5((I}w2x=<~51N}UG
zWEaRKFip<g{6l)F7|H;d6AjBSJBT3yst$}TE*$7vGWsVtVtesuT>lh1doQf{%;X%=
zy=b{bA(re_Qd}($3IYtNDo{}UzUW?yp)v}R^TkG=7(%VwnB)c*hu|W^)460@^dLg^
zYHlVjSji!1@=cAetvh{>qenFGLQl$3;Ku<KX1L$Ggr{zlU3ww;$Qsq*^K*&+QAjJt
zvroOPPtRmQ4K^)kxi{%#upkpHPa*l)a4LH9JT%)&eBLjfm|Zb?-IjVLzbB)*TYouE
zQ<#7JzZ|q0?G2gU`A)3OYv0_x1Vm4Pa4(XcwU^jf%h)QWe+I$@Fl6!H(y4H-C`yln
zp_@AtMtxj|k}${+JR-WsvyMlix9AS{e$!8yHlmIybd>TJV5eYQpg8@t94CCI>>}es
zI@jL=<iIxwk=}z$_}!3Ui5|@ZMPA|2M0owhWWA}<VDC7<?wXme2BfM1(m02PCP}(!
zKwn5X*%TCJhO;XfEdhs%%sf2#e_@)tMk4h+cYV=j+I-xPeW9W&AtFlmj`P@|2S+${
zq<Ebb4T=-Bq@D&1qF$otL%X&0MyTh{iQSciTH^Ge3V~|fv6Wdlzgq3Zj^{21hy1Lo
zYw_Lx(^RyroG)&@kw=}^g%TC6aF0&k&L)6-gB54)VxAF3a`u4O)pkD#*Dj;(!)qpZ
z3w#^aUeEg{GjY%O5ljAn(pUmFWvXlN2T7SlVKx$@pb5mMrCgg)>JOV9lV8#ia1xVC
zikvB8GKd>oe92*N*_j4THX531k;Q?4BCR72LwMTqD6i<srI^;6ljdVmYU7>7jo|+5
z7XG_y_S6qP+vF~(&IrZS;MPCE%pRI1*A>{)_<I-s<M~opJ<4{TW$=_#GX&JFbicF_
z6D4^IVm*$N?5k*Dy}smrw+&=w^<rfguaSre{4xHdgB(8kZ}VrAougj!KKrnk9x`gC
zrdUloUF(|ozQWgJ8%z9(y~63qT7<4+QHn>x)PKd@PtK>Hn5-fyyHV6>$*KiPRT%Vh
zeCo(-J*>jivCGhAdTqT-raH+LRU7nZbqp>7G{f9&beQD~T1US<7JIOOxk>~ufGH7U
zs4A-ZBGh1x=|o$%p{>mII>9+LCA~%Gr$uMJp0oyPW%R?1b(dxdTYI5aqs3;w`J?*?
z<wK{Jub@Kxs^|D#=RLm)9qHdj-Hr%dTT0VNM-%NkEB6sopX!LaQoM?nkBgYkXqWaL
ze9i2ANs{1#Xx5nqCi<-p0S`CKwU$k@CZadc%k>tWB8ezEscedqHfbu_DIj9%enDM!
zR>^)L&&~NC8w1~nmb`@~7TFfB4n~>-;kO6wws!Im`Kf$FzI*^LJ6!PfI`MUxop*=m
z=`U|&$#_U-nEj`U*oO*feVi68+Z62MqzpxaaQAZrNa7<O$dO8;Rmz=5Xwf_1*>K&7
zR_{1n2<F)+T!85SfQ<&_y}w6Q@V!xNHY8UfHdd%D&>&V`IrTItG8G7E0~%j?XL>}k
zkL0<SZucRAqnTXDb?@98swAFc>cV#SBusqC`TA3iD&Sqo6=OT8p1$27oRb8<G|f%s
z|JEo;Z>au73M(|p@_|k5Y&iZGXYUwfYol#xrfuxBZQI^y=T6(UZ5umn+qP}nwq5z1
z)7`gDS5$P@{j=5^@9(uD<{0CdWBSRAxl`X=rgQiP8r_|71Bbe(LDq!z$wLuk8z@4c
zHM`8QD_flCpo*V{Daa-oB3?=0<E-rcRxW4#vA=A=hR$qFOY;byS>*A`fM;VP{Y+tu
zq$;{7VM#Q{!Z%6w4q8F|g;qh%EBV|AKM#UHiZre65HDgUl2O=7ndwRXR!xnrOh}Q?
zliY(q(rM=)Wdd8WL9+fEDMWU{l}eI?La(y&!Ltqz%1fnfEMTo&HX^`m6fr-8iS-nx
z5|#(w&n0{+%%w1|GYl0<`mHZZxN<Vu7Wke-dCN+wl%s0EWiJR-S(PcxH_-R{qV*3~
z(#l^Y8_UMMxnLVVq`QCot4S~Va^(%A{TFQZOdqfotY5U|N)V<|uPl{z-9ta7Rlm2+
zQbPzRzhY7dsP2r1F3gD6p&wfAe-M8cmyj6$t6eq8@^8E9P{{fKM8{{v2yLu9yLqx@
z_Q$U3I-EmhFj7uop?(Uh3QH>--ODk-$YYFs=$acILw~-OcIO2B?k<W?&~&+{^vze+
zWrD>PMRO)KhfGntR#|DY44i-93!@=nBAZaFka!R1*TgnSRZ?BG9SnE^9%3?HeM>C(
zz^HwV33Pti5nB&;05W1to}*Lg)?^j%3wHUC*lflznI%=_%XOSIIva@>4hEMkR_+u$
zuyPMFlyIqBijvW~*pN@p8z_T}K=|4oC?rx-X8l?H-=K1k=xBK2buC$dY}|0IFMy0R
zv97VhaOF01UQc&6ppw7h@2L67D4pXRZ-Z7;F`vlUn>;#6_QP0b-UAroM4&Ca<onYo
zFxTYJr04LEMVP`^E7-FB4%q#Dnu>INDQW_i+JOQ`?t>{j?Xy_82ErQfvo^B|Y}00D
ztc#Hb>UJ9rB)r+g;heKmC_%y~tK&rhA5ukQ5kCt97Qu{2TOd+RhMA9l_mBvOwz;z&
zz1&qWuUL52hSWEoYuP4BW?z6IG@o;&#^l*VSgZ|FE@e}ZT3l1~{{VMguN03>dfU2&
z!}uEjxTI{i!DcA0NKFl=R8A&w#E%K5l(};#?u{FZZ{plTo4!mkHuia)M32-2R<?x~
zUc{;-JgG!%r;EWOe+my)W^}Sb5AGrHS1|;{VkY0L`N(jk3g9n<xReq<Atp9Tx-@9f
zr=yGPLskaxG*XPqlDSLjCS3=l`*EJ+)9Kv#ju=urqM)h)(Mx8M6lbmckqtGyZBkh?
z%wTm|HTBZyL&gv66y&+h;FN}x?G&OO&VH~E+iXDc3!4#+EdvbxQO5*sjM9se+a>wo
zzE()^sDfyRyrLeDSq!u0{s)Qr6M<nJ$p+$w&B~ne9@XU^yHm+&W*gC`bE(GM-atls
zZ|T_2<e|^Rmd&Z%%08A305rkFh9hXkDtP(H-!JO3;lN^M73Cf|O<PcY7D>gk=d9I9
z%(0(lT)g&<R0*%G`|zp^uP$xsf#;fQ;yxv_d=G`Ux{PYIqpPFx;2^D?Kz)$`d)oVp
zHDDL=gz&w-B3maYd~xX>BR3aTJc0X}hu!bmR_&NK2-Exg2M0Ry+nl1A4mxoEjzjQK
zv+rz>*Rtn<$lGwT=INSpTiHyQ8cS0p$86(eb8K9nux2#jz^GU<GnyBlb=B{|>G>@C
zOd@>>HrN18IOkjMce%Pc?*$n{fz$qz#0#2f)}G44#%BEpSKi^AG~DVx^#hW-B$k{|
z&^~^~{qdOA(xy2)fo8NwMz%<uNoy=iR-gS0t7Kqjo=o~eXih<pafwyQu4-62C}O#>
zro#v4j7W?vcq{bWMkQ<-7Q?fUXvHKep4=$EkFLTpN-W1ZLcqFJvdQ0@bG%m`8K;`3
zS)i1Kn!k16apK(#>QC@3YOw`^N0sP)IqGk3)|t}&_WU|~M0;usw{hf+0x@0RwG!()
zR?*8Scaaurb^pTxHoiLgzHZ&JlG>?*AZN<Vb;Oez8=o!51-_IqBACCL^5W4hiIkQ1
zm6*%hN+95@(D|WjvmV|_Lv+-8^ki9pF0Ip_T^xsYD-oB^ge_(1OnUOQ3}!hHBB$sw
z*CEs!Q7b_H=&<Pcd@OZ%bza?(iWfv2>QLR9FwTV;zj}9XXSTd&mfD`8d9L{Q>0--C
zCnnuKTJUs%@8j~?aoq-Ia($QGzsi*o^<@i!7rjG+-CGUR2j_hu=NN#qt{)=W=-iHa
z=q$A9eA(}yT|Y_Dq&&O}C);noP+h#q8<KFFlbHO84L8)^`?BDq7!nAfu$G@<YBN3Z
z&bjdgqy>O6F54PRhUN20H|;#zc&SdOW^d!_s`&x45RXDZSM7xgP@|^B5<zw$NEZiE
z*bM#Hg}87qiW<V1O90o$mvdosMPOIShX5Ov?ZXaPbNSWVu=$~cKE{pq2?@l+#Zl2M
z>;r|L?f!J39b<J<Wc)<~p(zeD{lmF=GEb3#L+Z-XEw6K-RL*58sEwPICRBdiAOom0
z{JLmtMbEyk8*#Y7sfsi?W2>8r8qe4s>3zAMFx=oMwL!Lkz<Old`}LA?(}(NOTbn78
z=g`Zx?MU3Pc5%(N;vBk|LuA8_B$0`$7>C>`>_Or93(z`O>0kntchYc5Ygx|-LRwmA
z2<PoL{N7=5bo&RTPc&<hRyY!e=naG%7Q(p~%8MlB+7*^JQ`h~6@XM}wX4ZTY*Y6uD
zdBe-J9dN!Yd%i2r@C{haR@oozqDcPQoL;dy_N(5QtZ)atps}=GZS{UYU5vV&6`-gp
zT5~cHFa4}Owo9Lg%A;_ygF30Fuh3RTSuYK0jZL`_>LFt;o^|w;dX?!y{r>5}gQ@tQ
z%lhHB!}dk}swZgQWuf7V=RDs9Qu%3>PXko{eP@H*!J<1)vD4><QWhyr5i2A<+WMxs
z7z%bZAi-_vishtT*prQm^fYrKUv`?KslT%J9CrIs(y>k~Rx(}pDCjhg;VjR=fEMi`
z8{%wh2}JEkj4(YNPzLgFJsO7_w}&hIDaq>xtsDDL?=-WrFu>=uYz_Ngh4Q$!iGy$t
zJ_vZ$1$!*>uChfi)`b{92l^~tz5UZU7-jeifjG{f3v$0C9-`<=Bmkd6La29*0h6Z8
zNE>h~gGZ%|)<gBo6szIXm6q0{QQ~9IgQxod_RoUBQ+4s@Fl9vzj#WOa13AS@ImOCe
zMveug^-iP@5F)N;HILOwF&A!cZiZ=*dyERaTJ#r`xmVnR?qZtH%MgY~e0^Nu38B?3
zQ9f`)2h=G$TQwbq$CnI{HZ?GNy1TegFz}GaVz=XX2cuSEW0aNM%~BzM`fQ;iuN}2G
z3{qZPqTPpPa{LqK<f?x)4;UJmho(-GC14cW(Z4eOY}G<5D86$US01Txul|{?B%NZa
zFblh$$ZDHH=`qS;I!&lNGpKS27Wzn*3n$a03z+66JhaGmDiPc7#X&fqWp68b-+67N
z*sTA)H&93QC{V-GG|Nu^Kpcl=BYf_fGTQKfUD8UQQNe9EAP77axYXWd3b8$#rT5d%
zZBnnAkHJ06>-7ZcJP_e!ugTLvj-#;pCMPc9Zs7Q{4?|X(Z+B<P7JPZ18YBG|#q$XN
zH>wYu|H2n`>L{zLxBbFrn+M)Ni5P+CXoz{B18MIHN{ytX?&|(sIR&6$AQj_14tBgl
zgpp`SyF&{5-oL9u`v27m;?JfXyHSzC1o7|Ql3=|ey_5L_YnOl4*iQa#RiwkM@H~1A
zv#w57xn3#6;{6*6sDl1~LjjpS0vIEA)x$?^&wegKnz3T#ZV~^t)I-ouaC2GF(GLeZ
z<3I#<O!lq*X@w9KN6nWS`sPR&Ta2D7<wikT;ouG@PHi)y*sI|?33Hdl4F{H<6_HK>
zQ<Vo-=??i{mELLfD$rC}01!&{TwC_T%Sq%*v`Y$gMc|!S<ut?JQGAM5r1Z)kDnLfl
z1A@_!*dmk$`OF|;rV7uMtw{uEEs7zY`aa`<Tz7klKq3xB`JX-(5kCBiC6guQRj+KR
zX%;)zjBJ^=)qItAa*g9m;TVbCf0ad4Y6$&bZ4tDsO?C^00zVq2a+<>xC&s1*bfY*M
zIe}CxDEilJn8mD%^=vemC)A#x<nhw2JnL}52hyc_WJ#=Q2yWx-EVq-05&Ow`5viFg
zd5lLJC6+3ler53kwX|ZTHXzIkzG9Cr`zYHFN??zlTpg6pTGr!I9u=J&OSMbx$<)vO
zqepw;gK+V@#M%2>oj^)t@u%4<cfhk`f#gtrumFJS>mFky1ed&n{~`mNZ~jlo02^;|
zJ!yL}|L@7hAB6;Nasc!`<?JI^#`uelSfjg#ZVneZlF5ck@Ba`D_}^=z!v6;iNU<_f
zt1Y9^bgET*RO?`s-WxnfL?-TVjk7XJyt=PNE4V!)`hzkU*B&Meu`Kdic&w>9I7CCr
z=qW}g^MSQI%#E=ex$D-8PG=5EexcX3B-G2yG(3$OV^5AGekB2d)xC~(*V_y3680Y{
zwBOzlh@!5=mF|t-Ey{W_7-jEPAR+#_*@SxA|41Vzi0eC_){vV8QLkQ_NcGbtlL~z@
z4dBu*Ib=)#TRvS~ieVgeUEUe;*;Vl$`%kg&W59HR|B>OZtRpjWV?(rY&)}j5dUtPI
zzzAw3xT9J9TMZ>Go2o3fKh=z9xU2Blq}%1=sQfzq{}e+k9VM&_^r(mDR~W~Qc6ugx
z$+jGi)<KoyqH>K{SbRuA;?AvirM><kC$mi62^oPg)-8Ji?|^9R#-48=DZ@9e14n#F
zYpVfxRuMPruM@rsZ-Zwk<D}#>H_<xy?@jxbhECH9aU{!_Ar-UboV#P|j(wAfSL&5m
z|KclHrLC-MAa=i{vC-p|joJ-tG|X7^NxZk-7CiAPYFiYcd7QnQO08C8f~0Ad$u=SQ
zSPqANsscQ*R~Vcu+v2f!_EWJeHNm#5>rkyMNyczO(V9FqM`+_|yAZG>dGtVrovWJ-
zxo5%LedtN+O!X@1%vG60gs{%?#NQ0^Oi5>hABT_=*x}~4QW4>|7o2?|HFtFd|K>7l
zxkkNd=>`;@p=@o&=4_yIE=P!pKGllvuwDO^1L<n-H?@#~QYI8qUJBXkK|jwU73Z<b
z`E4Md;0`h#ucvPBBP$+Py;DQUqH^X@4Z^@;wsDOpiER#s$YRF*D=N!6^lYWCYypd^
z$o!H*;O=xsg=9p+>)Is*W}+A1yo~({tFDCN*Dvt0MPw2Od|2=@8G6>IMErX|gK{LJ
z!>?xvbVv<g<!g8mMJ&oZW6F5;n#in@2XNp;Mn}uP0X!s9^$=O0?#!1<88GXp0LTPk
zVNf9_eZ|?ccDVyyr3vop<=!SiWV7uJcL(`Xl_v+EVOgRQ)u^G<ZFuo+IPq>Qs-z)?
z+UbeU*4Egv^FBQ59Xj_Wn$pHgn^|@Qa71sRG3?u0GEY0Lpp{i!ITremYtve$0VR^t
z4;h(N$Edt@)l_S~XCm*ldD$MpLqXvg@HI7fW^p4t+Dm78Jak&qRL4@<KL4pgYS)7T
zA<PJ-RT9dE7D-@V(h+o!i6yxzZF-hD`0qmtE`+=by();?z;EZ%nOeW<c|6nq7_C<F
zb7VWbQ=CXSu&Cm0v@CK}+<`TQtl*j828QA$zwIadPclPAN$)>oM&fF&4W*(v_1>|Z
z{H~obuor~cqxgdJCN3TiN)U~#cp_(;^$x!h-vj~cUg?(TU>Kw9JbeKhs~z<ik})X<
z*Ze~2eWf~0BHyy&F>+QX6Qrr&3NvJ(IN|h5gbi<p$NS;M<MeU0w$EtsamKgk@%(S!
zCY&v2g2Cg(_M&{v&T`CsR5YTT?#tka%++^Lz#!3jgRKNeidV=+2i?gqYUVUAx5o3g
zT#7SUjI#tRB*XU5KaG4V>rL@?3`9o);cl!7kww+J)AJ({u7xAB7;vPlT*!{!7Qn1~
zLM5eKW?Q*CgDd!nZ>{ES?+!)w&yRn$CSnAU2ErCMAY~^zKRh+p8eP?ou1J>Ol)S!i
zGN#7m=dBq_dALTlwRo@FtNK^lKaOpmrjq7(uzN#@T%pBo%6)4B@VHPmb%&c)a^)*G
ztwmZl<(jqLZ!(rG9m1^^?OOWhYp@^B&6=lo4Y|n+jrc+WZf)s#^Zn&KJVdvacU9C@
zOI^oUxK|}C_%1b0i~D{A!Q7oJM@8{t_MFMHyJY|y%e{@j4hyPlG_cry{%t+yZvYSX
z)~<OZ$x#_MZ<aiB2L|3_qguW}R(LjA(DLb@xnIiYzdQF&DPvD+9~e$u>`v)tITR7>
z!+8~e-`YzKYk4Q}iDAvtiiBYkxq_6yhCcE_c^=>Hu<dhA%LaCDGgil#uj3HEZ2n5f
zOc_q$guc|vyGS!kN-rGEl8kHjqk1+&*LQ#-`F2iV(OA`Ax+p-w4rpL?VlB@|S3M6k
zs&`kIW+5^R`x*SBjsE+CKk%7z*rMYypL)>ltF}7%oq1>0e4Dp5rECJ6Vme4{#HDp3
z5mfZDZ|sYbWz$iM@OyK6kqPElwyZQKb1$VJ(CeAOa@*Ypw0-~GAsb|=8UIqHMeH<f
zQlC9VcUb6@h{%i{UYM>n2s>G{37!3&>(dSHoaEiB)}3u+K(<*~D8O5Gwyqt0p$gGs
z>L}{7Hv+C@$sy~4r*b*0Wywzij4roV-_U#^Mj7r(0HG7qsyq;thbZ<s3BZ?x2+C7)
z=(Hsl#x~sA&{-+F!+0Yn-Fh@rt)0VUg80<y$mKD(-J5vCd}I6-a(PjceVq^MNN&+u
zZjpL`k$p*NlLyHQBxcZm4*#QTKf}N3`6P-9_ivvN$+crEDW1^3KU2RlSyV>^ShS$*
z%GO}Qjwn+Ah|Nl{24LREVS2%~QttiIjTA@d-`4Da@wa5HrDNimNyb=@xENt(cJ>Os
zNv@O(s&NvA{2sV#862d*S8T>>;OX!Q`rBJ{$l`7hK!M^~$Ed0zz+Qs#5#b3>-qZ>9
zsDRNFj4yXhIqS7;1`C$yz0odrYZkjKJ!wf#lcxozA^_U^4DoDBWju#YChWcDKn3ny
zcMQ)XL<*hv3Lzd$_$y!4n4wvgP4MYy>C>#wY`pn0SE*;pknu}0QlEjlzNnGTY6pyG
z?Et4`(uO2(8aD_%ce(aIFB1eA?#xm-swI`l=MVW}t)}$Z{B&+{@Ng9;%ff~d>wHjQ
z6!2D4i|qa4XQmn4Yf*ado<|1Aq@dXx5DJ6Y0r-nIC@mpGOsinive9iiF4qC*kK_a7
zud##rQ^e@$K+a~6)E=7NEF`{>wj#z|0YdiHwG$_{E>}omo)+nTVn5-W=+HppUqHTA
zH98Z7zU&eX5+;~_ss5Q_vdyajxZ=23hE6p$oEnd__h_rSbgkQsLVUh|r9i=&Xbl$Z
zS+kjXnDIH|Vi#LObX?y+8kVoi1`eC=J?#XvBl(LRA~&^eQDnD?3=p-W9b6Z53?jgf
z8KHojl0APs+EDWg!sSW#zcbW8|GVPg-!V|r_>lufK0UkxG7O1TJP6Y%kl<*%@Hh9n
z+>$}MqcpwysER(Ic4>*8mFQrBi+`hG^k^4(L!;#x*NZhE6N?8+vlxHOzOOeU&+@=7
z!$J^mSFayz^sgVWA?csza9*;wRH*X)o7)^ut$7IX9aiL@3OU+V2^4sR)$GU2Y-GHX
z63DW>BFngcNrWJ`Ras+FwsBTrnuv8+1B;<4RwMnSit-i8pPAE{pSq`GU$1;%tE1;J
zXuX92hO_=c<ch+#4>mXe>fR|yQ4Ir+mdc~KVY9BJf+NmKn^%>0F>u9VqFEQXEQs>^
z_}JdPH)(`w+6m(c6LC^X{T?-mk;B?(EK=&7o=Y`qVVKknxz%o95b`Y%iyVhIUpLt~
zilLf07n6sVlc;NdlZHNZ=@@;<Fc!sZw9q)XP(}eg#+in7t)c}E^kTiWvgmg>twb96
z;gbfX{S+{vy6P#F*W5CyP%{|tq7t#wO!Lr?98P+C7G6IguN}?X6ivL~%fN-j%`3=^
z!#VqiH_w<cQVK?(p=Mai2(e(Wt^0zg+d?5-w0b4$SXBHBHxA)$QATSoyD~T5phwo1
z|34*mJ#eaq{e2VlEsJ9;z(A(MK{ybv#6W_2XVn5Mx{Bp9A)x<cKNI}qO20MrsQc+0
z=@3U>6Q*F=UHfwO$$%4P|L5!{90<8jXQI~VpX}#n-Si&p1PP8V0HJYaD(e;3R2&+}
zv#A5wJQ?zpKNTxoOepa|)ew!%;YZm7Zn=RWT-PD#B3BmvSD}Pm8P;q!W&9j+VHWvl
z9v*^9g|}TnnQ}VdP|Kxm#UqUto3L^}k9@PC@<70@s*=%WY^{G|ZB;U^`4v*?!=|fc
zdf+Gq!*$V0<AtkGGTfj2K>1{v+P9;8TH|Kk_Whz!oYXIO|G>C+9tTs=iXZAM&K9~c
zLDo?G?YSF2Am}c%=$L(__<;D8#LZ#Po%VJ7_lw>E;e!`?K|o?hFqq0305-Jn#R~E>
z2+Zps;OvTn5MsqW*;vmv=C_xmFFRTAv8qp)-^a71ZJ<O$T`d~EjCsM6qhm5sIti%M
ziw%qxTSGGN*cDoMY;x~yCr^3~1@P11@0o%)UsK&K>_X4!ENNlB8|v8%c?Jlk)<4Xh
zYT!Ei7)?GzD#Ijt%Net@PnWb=PL~*2v20C3{Jy8&t~A|IN&#LjC`CO!+pqz6qF2va
zqDn6`??Iia0bus<rm+>!tjp!4((-lN@_i5T6ITG8p`L?G+XN$6`K2z<%{;YaJckq*
zWOCBvt9B#KLe*LRnb%P}A@>M+!?)HHZTES5Esv5rFPE$Bzq+-5A~b5&-Khwm15o6P
zwZs%Id&pYycl5Tjc*{IQl0+9{7j?y}VSn^+iab638|v1ZH{5(P{vnPwE)Z~QvO-p_
z<4`J5d^9`L!D^Km=?=pISJ$}gAj0pl-!HivA2(iT-@ewCk$q;kh$*!PutDi92<rmh
z_yZ=BD@v9rpIuNL7a3Qif;=O11|C2^hzL0t$P0YC<L7^MjNYO43loA-$AT#yxL$#L
zog<CN!>@V>!b|`DO9OWu4B{!?D?(lyD+{z<zb5(HRT!D@F0;0VPV@@i^uYUh^PjdN
zgpGkL&u5&sD*kJVB8dDM=vv@&)g|ABhJdNz8Ng%$4_{k;UDUN;p*2h8w3VoFZ>9|}
z5Ob43$)LQ@I-O#Ws6d%wCZyPX0o&Rj+Y#LQoK%K)mH{w(OUyp%RXJZIVXFwou6+me
z);#h)pO=EJ_baO(ECbzNA2*LSt(H%5p`V(<E)-G-=>XL92-I^*GgA83fXjAa+s_BV
z)$4RKR_h@Zc>kC#Q-%Opq^>qxj{k=93>F=Kg#ggl?fUrmGmWtH-d@j>DVAH+?rx8u
zv9OR0Sbu#o%I4ZGiq|tv_hPp%g=}Xi5ccqH;)($7hOLBVpjY+|K49kbG_)!75t{s8
zsnM$4zhSxK12flMl0)Je{(*rwykyxR7e^y3;#gYsl?S=sbKle7Up__@@F}uD(P7e-
z7d`oLp^0bdHL6l|C_?kK3<$NBV|hhCNzsh5q*AbgY(iwMF<hgS#|2#TU%fZHZqCvK
zJ>=>*>dWUL>lSRk|GlNqrLB?T9sr3tvb8eEND!p5JXM6J4=qrS65%iXedP)!QwPK9
zXMidz?RPD|GsM?lsU&1GX<WOjGO+m2OkcJZa6($zWsvZG!O}%%vDOciQ##fUM1R6V
z4|dSS=&A~V;`P!ad?LOEyw9&vpl2gHa$}2sa>wtXi}3d8UCjXDBz<P^6Q5Oe>N9HR
z&&;Y{M{7C?=GPm;S}Q>d?Mc?|EvN5wJ-sg<RMoE3wGTjRI>&pwsbW~D60g}(o4d>Y
zsx>;xBRQ48vmnJSmn2@H8JF>aufgJI+3@CA9_|Gj&!5<w?12*SPtS|<OkGgc(l^p7
zwJ>6UDn1m5UyqpZ{Vwg@3XJ42+3;W!U#;Km0~sg$Te6}xSG+wNYLoQOzJR}FR3Iy+
z-N3z=$%^yUOs!?(3l%N8pp{58<AWI1WYnAv_92>JmEK=o7{xh}q+jnHj~lj7nM$R3
z%QXedKEmt};sBq)cHMoGuUih(0!>R*rwvj>2F@br+dsK2(R7_uvq6=IQ(HAL1><RX
zSqVijsX31uHQW%7Vj{~N(Pvf_T=3G;IF*&9-}G%e^m?at!9x)_7}wlfa`dIPjX0AE
zO`!>FW3DN>E53O^76sgG3mxSUKO6NXwr+kFSNcyHn>XA-!+NGxf2pnWV>a~lg_|y1
z6Y8B;cOx-DU1H5OyhQU85xtvN-aCpSyj0BGOjrlbXl1Xe;=wyrE~9~CqDNNv5x_n8
zQ9Oa)$teTkTGdo5W$LX95V}WXYGB7MnwDJz7e&pqTBKp}IFzUx;*arIkeeULA%*n+
z1Tza?a*H&1&&*!aW^dl+^QY!0$}U2)q9YqDA|b-@?uPggYb$fY(u~1-GYZ7=my&Hp
zk5a8Ml|02KuM=c|kFM6D4<--I%hf6eeQ(wf8_UCt@?ZvWFizCwz-mahstE&GxsR~Q
zY%~>*&N8|d6@S~zP4i}nl1oP0sNo)K2{6x8G0}moOko;$$ZiT_Ov>ez)?o#(cI}rz
za5Tb+A1884;9#{Dlq|!83pDbU{uB}rgzF<3$U?e{+(hQ_<^S0^(sR`WR<o<V3T=q0
zX|tF^A{;f?K`r9F3fL$L0}g@_*6O#HJ-4X)i5W;}UZM<<kU6_D_Ix{@E!ixIWSnnC
zU614Id%6fJ7ejeBU?;J1J&wU^SX4+#m(i39mysI*aYKh<OY#=yL)r*o!IPKP71Mk^
zYys0(YbPz*Fa=y3cUb!lr;H3I@sU`S<#8;4<>vt)CQrhGmx%1QFUI3rtC3I*=e~dU
zQr?+7yivItR`ln2a3Q6n?>HS}t2Zf0V~*)>%Sp=<g_G!uD-ZYyfI;EH1(#J^wK6Ah
zQslX?5kvH3TC==8xeP?5=QtmWLZ?0?W*LVC-14Kba4!t(x>|+>A~c#vU?x|1Dcf#)
zFr!R|8f^0m-(@5Ijbm`g(U9+3i<2)yG<T8KG1E1tTpHR_O+k?xRkAaMp_a#ah8aDf
z2xi>+bMygLB{L&y=-<2L`f*hJt1U7zb+V62Wuq@(GqwfM*+qIUi?b%UjQiJc88=E}
zZbg`=PVIo-B35i}MXHzNx&>1AbIGLmhc__N_?)%r21F-UN^N2;Ax2<mQJF5imfFuR
z2z54=c#<)(Hhj{nk%nxRnmp<;?*!G)L(kFk^-7s43R5+1qn%NKwf8~6{!jNuM=vaH
zySM*%JBbH}Hgy}vK;0sfup(fuyfVy<UXrlYisIte_w-gfZL3v*SwM6ABwTg);sj*|
zeBHRtNZsL*$>`E=`)Sd3>~N4+{8>;SQ-BJjV=S==oQoKnugjRt&WO*>6h^ih4@fK<
z<2_-2V*WY_Cw^(yHl-1VuGClD>}5G8hkWq<uO+U-(4}_5jSwTk4YNLj5)4p6(ntUH
z$?ImLy%4|2C-p$Dl)P#Go9t-FUJnxB>smpoUKQ{Vb&i2ff8_{na*X2XZ)))}b9Cx2
za#R7{3!i6*#&~t1N>@I%di?6XOj@yRYp9xDmYGh<KB(XUAchw@{a6utQFn}9pGw}h
z$)jEtJV8bPc&<Vwi1kh|7auzlwA{MbN!q`nC_QiZ<d8!|eL}9dF_FV3D7mcUCUF}W
zW2-?lc})H&0vn<uN(R<iWZ`%0a0GC~Vg#K<6vCH;gnN*Jbp;dy_Qc|t$Sz<8BcZaz
z&=5}e2+xU!<bYg%5TwaWr=0AO5BN190wZs<SF!gw23RsZpZmve1EYwhOqfN~U>@&t
zLNQ0fJd!ed32{;Bx-kN4-eHj+(GMR3E{z_Kh%>=1avWQDgfl^~bMh#v9S2(Po5h(7
zSD&m<-$5*W>(2Be#*kQH)m&h=?@RV#uI6Iu&sn;jm7P|SyjKRdzTJ=cGX2)u465*&
z!ol@xoA>jwvg=DEqfNoAJ-C}9$r}0LGC=`kpk@ua;GeHqj8eoe?%RVmardfry}ij1
z<6#0lTX%t`5I<<dv~!DcV4y)bA~J#u2P3fMZ76}j%U8^t?*XjOxkK?CgM<>>h>1@j
z=Pm4{5S2m*Gr<x2wI}TvWrwiq5?KUzU91IrnwQdjzo({WV-iD-1*G{RZ3c9A>n38c
z6hf!R5nT^^fs*cNz~s+wNvJ&ij);rR08(>KAgRFH74g(=n}N0(u`%pTy@kvIWyUbV
zoG|n2>&?^jkM<eXDVLbR-Tcr(^hUa(v0dNk#LhEo!6ONxa`*r{`=|nF#U?WM><830
zltj^kXvI!Gus`3Jgb9SuvB%V6>4cYWeFq7*koC`g6XO#8x`)!?>-gHG;nc&3Ff#L0
zfw}p}XcofvjOEJ`2<`w4GKm9aw=dCVPr<M!XKwt>{Z!><`Lr89iwlDOYq~KsveHSR
zLMT_)0~j!AW;I)PlTr&S+mJyh$Ap!W^`gh5Ha()`g_@KJFb(p~1S34(HVmo&6}P+1
z?DsdE=P;k|^-Jmz0xG%Oi;hRa8!tWgdbK=S*<msI9?KxX)$g8;_Mg<(78-Q;v<M0H
zQ$-qT;-Go^`>wR3Xa;nr-tYmrW}mDu>yu{Eq&6jL*`gb2j=K8c7L6R@BLROub~37H
zc!y}h8p;-pb~hD=@zYTxWmRH#yI^}bz3simRyb?7@Wj>#B{E0kk7bg0TKr*gtmwSw
z(#1)$@#6OIi3YLs&IC}E>OGMZKu5Yo{`T6hbYP`7j;d5@nUzJ(F6_nP=3D%VNL{C|
zgdqS<?DV7c$7i(b84h>ZKe$X&qR<aExa}Fkp`sXpnA>v9M9a1m@*tsLYSC3@XQ0+_
zLAnpz%ox$Upj%ybTl|AMn*7zO9n6nSxb5yiz%lq6e{Hcm3A0@8CWyvOkPT(jWsY1c
zBh;;L@CC^Z{rpiou%!nO55DyQ7dwE2hkXcVk<69KCn!6L#W95*xLj|W<=$jbLN#V~
zDb?_EC}9#`vf2cYX2?w<9{cVADoVCAxze~asv!5|u4WcFDef?&%2FeAw&yJokDL_J
zD`2a|J-FBWeGjcEM`B&?@deciF^mrsHr5aX;LbS&)L<Tla)A1%k5te2-7wa{@dZo)
zIG~@yk4#8PJ7M;No(aX-doS|pjZeAot7#Sn<KFa~C>uH6X-sx;&m9#|_aDpKOP%Ao
z$=EFI5gZtKEmX{MI~zYQ=FaHgVka$ZK5r^u;_&cO!K278pLOfUXn}ys%5Gm_e);pA
z(5eCa5=Kz|5ELM?5q}BGT$8nlkY(|1yS$`p32f?D&iTNjuSr(}NQ)JLlE4^p9vo3i
z5t7mF93N^7*d3y<g|EO%3A`da(9~j>{&UUS%hGLUUCDNLc{3$v{vA;})(ybf7C8m%
zSl7ixeJ?=OiQQ(j>YtnR5<#zN{~GFU8poWy00~tj4?`wWf!%)UAK99#+0Ps7*DkDv
zO9pvUVeL@u9o+f$kb803V|D&)sl48Q?J6%88JuLoHqXTxqMhFVw|0F!O=Q8$VM+z<
zZCSmOu6@C$&BS8z&38~ccl#|Nb68MXPFv3{@<VV?K}740t*z<7(m31Pd3ULC`zExx
z5?JVi<4CZFtrlHSP<9S~j6*2h9xl{Mzb$mhddnZyxGX0)uT&a4NJYH_<!j%|dqjK+
zWz`qo%Z}qMca|8zgkr8gee9waZD3U9FXF+$0db6?L|?d>*}C8D3mwg%%JhgUH?NL`
z^(VpRhN@G&)8!4_rfAG^c&&*IH*WS=e4vpyrflMEOR>JZVRxLzQraLJNzR|<oTGJd
z8rK2lfc5)M6OK`jra18T6+TRh4;-dBRD#vcHo801&J9_s&E%*;JE?b?A$9LxtvZ+1
zPig8pH`ds8XB(i0Jrq>$OWQ<TlYXrY@M`a!4wiU{Ht#bV>%-Iin@fA;iTC|R4ieu>
zoP|l8IfB)DpP>fK(&CI<I|?Yl?VF=(D(8cv$ej>cM@`P#Reie>7*&ZxS`<C0IJWup
z+=+hxVLLm+(wlGfIi*v#U3S?JA8kTg)h_u`F&Vi|VC&Sd-Erm=t5_5aVQ%&l?ZxVO
zFjM8@r^WB8_IQgZ3THjqWDOP_y`@qWWlWl5&rJAK0CrBrahZA#*1w2sqPrdpn;v=6
zB`An3e2L*eb8D3^Cl@aJmv9UqyIWggEYORkHax>4$Z@O?+sS&lL(?}?S?mixf40<i
zhGzBt+^lIitqWB}Xn@0ZBDB5f%z%q)DlY_xZR*POeKDTVRNKlF;c=L!&)8?D$UjIM
zkyw{eJsXf{56XY#s>WN!%{;)i5XU@Wv&1Oxg)D?Q0PI|l>^aeGm}rS%Uw`WKre}!w
zKD31`*|$Hr!-SJF59UMF8c9))4yB1`Ng1jQEz}UKNA8kOJ((_j9({rED34!YZ)maP
zQj8QDj=_LV%<~9Q7^$HPA4U2kZ@Ev5$q@_cs-cf~PHhnDcdJYwU!th|9oxK~_t>)U
zhp6v;3^r-4#_DM47hF_lm>Nf<TW?Svg#Jam<fyW_lhiUte_yWFd~l<^6v>`cZMo>b
zY<{wBL#@$nWQ_G<G*8GRDKb8MTcBoPG(fdjR^5?hdN|)6?nx^bfm2ese{WUEggmCp
z>n3%SV1UK9WOluq4vhbD?w1PO709xqd-VY4_>>@25z#r>Jj0)HL^totft7q#-w!XY
z7kgz>hDnVWK$3?Q2Adq(+v0XjgDBP_0bV~aPcP}|z-)D+*eK!Y0skkKq*S&VEa@#r
z!RLbVG0k3@+v8-$#6~Xn`A_b6r+LJ{MVp9bs_9A{3bX}hW381c?UT~7i;)PcrUBR7
z3NG>UJ55fyXJkUQi+>=?yjE%O<r?W=vN4A$laoJ=G*hhvv$6|L!blf)jz2fQ62dF3
zB@HP0!l~K3_XtZdj4nStNT0sKE`@Y1wQ!@gppLo-nz^qxNF4vKGzVZIXJ_|t{80|_
zm2cFC55$8cnel7#?6{2MC2jhZ-9$k`!{88GA%Zy;p_`%5Pz-XI&xtTG#M@p>g<!8p
z>(TfYAo&L5un%;05erih`@7esBQksBbEVumX@=ac0G6_}6~6)0XwvdzlM<!mi(Yk(
zoimsgPT;C3-*Tq^e~&R(e@qYs6n*7V2O|~=(eTu|{Pcy%F8^}bh`UY+X-LFa9$CT@
z(AWf+#^wIGu7mOtb5(4{-^bTvw?_kDNzn3QYQR#8+F6{&C=&pxdRT>vsjp8^zrSXD
zz(sgx3jdM;D75U1sS@&$6m*=rSI&oeBh$3Dbj2Yl`GeQ}73twP4}!V2I{Ryb#PM#?
zmFh|1yz0Yf-Bu!_@E76R_|W0n(t%D>6lk@j6);Qb^I8GQ_ST$b*5{`>bCWU4@A0?z
zu*Vhn=rX*nVdTL4Gb0w%D5?1#t{$G+hqOy09~$o`J3S7#o00JT>IPZh5O8|zP*X=&
zlzzKC^ruk6md~A#ZJXI*7XUjAwOGJ`OGz;+SbXcvWJ>_M_U&9nuYEjlgl512tDYcF
zeug6Xi`ivuj9Etn^S#jXI`hd(@WmkqF5C^6b|4>d0vd6Gghx;?BL$1fu$Ws%%sES)
z8XeUOcun`{UwSJZ^z;zV$7P6W@o*y5>n7MtBLKHewq*<NDj^+?bQ-~ScsJH6o0pS3
z8<$p;t6er0EAf_~7EKoV<FTF<=5+<DN-9?4ozquO9{OL27Rw8LPERX*+-RlLB-zj6
zVq<4Gc7PlhC3S|Q14^~hj<6QNdV1-UV5C{4=0$XhqbEQY^oGP<d$r)_C8Fdc96>w&
zlzQ4Sn`$T_w~mmxK-4Dn5NNK-#Qgg~`;L9o>Z_53EqC&<Ca}Jwzg&6<L9BldDU=tY
zp3RFRzCEJ0m3+Bt+vs`*Yv-uZXWq&STIb;3sebJ@5(~1~r3Lg}a^|qb#@|Nk!ygP|
zc<@_E))Pw)#-F*V65;l;vM5)SBpd!s%Y8GBp|1v{umYvH#EFPk<FlP^&L#uQXtIx0
z*`1g9J<P<!D}=WXl4|>LzTCTf_&Vjf*KcE3$`L&s%l_9rwjLU6!X1i{xtJI#ue2LN
zO>`m6uM@6*2{pnp#xg4^yg6;ep|f~6zQ4Xp*#g-@+W%Lv26T9&xyH=BbHT8stW+aT
zaZJiH|5v1XU2GKz1WHWYGbOPi2rQkMO2YzVQFSm=2yN`Jmaqy{6hUVpdy`0Rj}8^9
z8iou9Zt{k`Q{_393f^Ed+V5oa+$1mWhyt+PaQN%p4{dzwAzJ8ce<@ee+<W(O<bud_
zm7VP@Wu=GOj?t`7@7m;5)X%31Uf!nl)%tBZ%*pSk3iO_zr*It$A5k4;pAftIUV1|+
z)eKRNgV~8gP<wlkcX8bSC-?a}n59#&U;%+qogpPJ5CcVu;%-AQSJFyo(j@RMmn1Xz
z5NEfF<mXPXI+7^4X=+9n)3Iz%K-svxRQ4B;GMy`sC73Qyq?v;gu~l3d`{_k&nY$GB
z(UbCkm^x>j=)0_8*C}S6_ZpCoRe*r^tVX;;SbG~)zu~>W<z=PgddJ~Djc4Aq<3yed
zhq`?Pa}UNRnC-qaV+705q6nI82h{0iC0UP!r`EK$!xW1&|GP{IRK_<Y8mHiEwJt)v
zGX-ReWFv!h7sHG5=t8chQ&Y}U{nB-1LvX|k%=@#U@wur?y5|f6cY;Xo7b&fWs=iWp
z93$!$a}%M?=Z<IV>dX5pObdWhaN3#{JnjfesHB>_7t$q1)R_!!&~+uYP)Vajx#ooa
zCvWEpO*5m7L-*z3231+Cdxs1~vgm4Wkoc2iZetz(7T%*3nUvpr$d*3)7G}<$!IKCK
zW!){<n?0!>w32gwbcjL_v7PtniGR*+pmn3@WC;xgSL5ty-!??bG0J3rtHmoV(sy-X
zGt^(Oaj;E$CwLgq>1GWO!xYUr$ThHG343E7qU+maQ7PQ1eY^+v-FjUO<UX@p9~=KV
zc(7pDss6DBmSoz+?g`(g*p6F=!ELo84>BfGKjFS>C-@J6;|gw_c4lGXAZDi*w0v14
zO6F2@pY?YfY=GIK>Q|=O_O|Ra+auc|m`75mneF2gtcBXau97fjRdb1>2)-bhM}2oC
z?R#nhO66kAMmQXRR8E0}Z4~fNq~(%hUtRt8EYjj*8<nXAiHs9M+ysyBcbH^#2R!z8
zO#vo`Nq-e9B89DFF+Es_%Etni;0mb8D5%he1(2HzJwmvdAq10$+FM)Pld~PUk(0>`
zB?sDoKFT3z%~Qj>D$H5`y2+|Z4O-N=1kEfpt*TBhiYTo>s7Or<v&#Id>TI;0tHi3j
z{(*Ew^<;(fX>44{*j8Z^UMa7z(80oo(k0MF^%_q-s!CWF$s#6Sb6G~29FC`Uc6?%6
z0BSm;?ezLVlf%}T1`#IIZ;W-)W<%uBQXAuc!Si`c2*ARBO)s*vyER4F1JKJY{*q;{
zvnEk_tHHM$bt}59m`yFn4l)t3lWfT7%G6E9;n(?g+5GKC%hATvY+K*rOz)_32YcxA
ziN6)q@s>6lt96;8KRb(u+_0vC;4k1*Sa}_hj?&jtH;(wW|Lkq3)6-Xf6hr&s)X6H5
zDTEZL=ZtmTGsYq4Ik@i~I<~hY-?YIwmg4$rq22A5dpB4iFrp!#Bfqq}-_Z^<3V#KC
zC9wK}7tl&}H~d^5JXi;$wiw(^!nxV^Z_ZC<vTRv=2+r|Q?$n%^$SA;Qp7g{it_^Sl
ze{b<(n-dn;?LoaA+HxPXZJ$X~^><(g-Ip-`kVso&wP&vuY(4hB*QHp*J2cZn-+lKA
zX-19Ap@y7VseBsoYlcu{F)`F(2O@y$3>05qWx8(zWJkCtgB;HYWzrrK?CnPjtz0oL
zSeh&qQVtw5+5Qlj5b)?b=XJWYIeagR_kL~N#27+5wtLel`F2*ezCiM@6|9)dMAF~s
zL@pD4WKB*q-0rHw@)<T*8)#~6@Q|rCe*yBnUufMs*W+rFpNX0yn&K9*OtU%|T#XjH
zs<Qgma=M@mp3M(Yux&x28A*>wn}<VH{**fF5NoeHwO&~@?HNC13A{kG?UG}r<bz?(
zXdr!M5;ykVh137mt{lPs{893>V*8L{&a2u%*}Zu{Gv`ltk$Y~p=0mG}YN>bQ^xCd;
z@dX)XyWm6j!$0Sa(gF@W?EAxkBw2YqWH;F#a}?3%$73=nl}`u>GvXHM&|Z1)y7jB6
z&!BC(jM`vY3d~!BaRx&DqoS%k5$aGsSR|X7!2?wrmsI=rF3Ic9`|1@rx@)JEPuC*q
zas}n{R6=wf(#N{38gw=$(<SP!8}If=H<Yk>{}e{7n+cgcwNh$nVPTC$04Yc9$=Q%k
z3$%>Q9oAAtkZD&ke`}&v<CHx?iTIUCI904!gkCFy$|M@;vFj+GqG?-EaCBOczgi^U
z#ly5(fQFEZqW#Xo4^1`nF3A7@?Iz`(+{ttsWz^S!fXZlS$Xif<_4$(h^2zwvS=4{T
zq)94RUHZE=r&=#RQ_x#ZhWn-7&fjNcWsb9sav@qNB6DPAb%wKkK+Rt%?u@dg&aAFZ
zt%H7rr^DH^q;W7@SSeCpDAM9T#X+0K&i2?8p1-h^wm65$XLdf&7o(~{<y?vCicHl|
z-remQvNiAK*(pf7=lNC0>E=TrE2RNnx4<a3ME}T7Y1$EAzS+=BZevsX6smHWw9Ieu
zb7SsTxk;0`?Rm!ea8c9XwVFiI5pMtC9hx&+L(_t@YPhkkX~pgkSZ~n6T4Gl|1-fZI
z33?&|%06=lAp>EMNuw@-cRRKhsKm8G-ACsG`SGOE)xpJCD!$ubTt<FqZC^t25og3G
zkYYtS-L_qAPqaUfb56+P)`*UWf%l`Lbk&RJV+c4qe*SeXt+qyHz7pSMO5dAvLkajL
z7?%&YWr%z8y8L~k!xNx0`<e4o`kUUBl?PWV-rl@(3EMgz{HNo>b^*BCZ`Z7?F5>!Z
zrZQWhO>i~C@lqw+fzpq>kUBoY&A2@&>q}1;nl(hsyO?!{+>0IYKT47LeLu7oK6C~?
z%$*Uug~BQJ&AkBFT^!alay(d{2E~Z?%dvkT-u~5ux!HrE)ESK`7Bsw;_wU$9-`-0b
z^F(5={8IV&2SENq0#Y00D<FYG`jp{)no?6Dczf?%hr=D--QrKSknabdOm~dMm|6`n
zhNfn$t>@+%Xqr)#dA2pZcTt?k$Kt{uuSVP42}G5fp_-O$$tIEAk4J6jWkpnnb%aYX
zaP#ewD!nVdcV;Ja(|7rt_1EdFTNyEVa%`58>%X~PSO=xg3+q%B7Sl6To#l@}GH9O{
zE{@M)tz|6nAs;|1&yc41qIUC_II-Q`N4Kn|akp0h$HLu2P7o79q3Nwc-UZouvtsc6
z70<cyt{LRNb&0ibGe_Wl4(t*adAeclk7av>ecIw&8jwDFxjdui&Wia;aL7bH$ou_@
zhEKnftEyiF7~)CarGAH)i@Jo=vPBp(s>H#qd&<R!F_zjwlLbtp>OVo(XJ#Jl+whhe
zMQU*NxLm}sQ@V;Qc<rTLJVwh7xaa{lKkx@9{UphrO+4lAp|=$)rzacjwLloUIv<JA
zL*0t~kp8&{M+PTh#SC6a(eU`=Oi;jY8l1dFyk<oOIZ6;+(@f6y@HpyrROZ9NCd!oC
zUcPU^305<w{bNkjJva7T`5H{h0o>PfBvXLH8GsLdY~hF>b!6k~T9kch?*_vvcNfZ!
zGZBNQH<{~C-Z)*5cLj$@G4H*`@2-7WrB(WL8@0p-dt2j;APJU|nSnJ?%+?lZP&!-o
z_Y~!+rkSl5T{}Y#U2+8oG;b?5cb}DUojiB{_4d*DJEgMu9h{SDQuuvSA7YH7>Vl6)
z4eVlofu2~lzHA~_X8nedSQevE>W-jIZDBc69v+1LP^NKeI8zSizUWc@$4gEf$`_U-
zoLFzO&a0wzphwur>tei)`Zc(yHEr{c<g5d=?0VAqM~2_rZ6=DPyC@Ul4GklWGP<3z
zp@oKiJ{?K7-K`_4_x?dD`guJZp?Nueiw4|*w_XX$gNrTdy5Lv<|4NDmo~9sf`$Jvv
z`rr<aeAV#|j~%)^%ocL{uM<eSS1LrUGWR9KE9dfxoJ$(2-%W*X@mIRrikcN_N<+zI
z@2Ux5*Jr}=l`?<t9<v2hT9noNh?X{d#P#6GyYpAtqY11-<KX*-jDc_iqiBac5m>XL
zYY>a6%`Icuz-%rbvwJl>ZkBlelH&Sx>?+9K5^MDr?T)G@aN{9MtJEB{Bn!a&QC2pH
zW$S9N>QiGCh66Ko>n4egfPR1pe!cL9M8bx0j3r`4KEfAs<md{(zI8kZC4udKF^(ky
z<H$QS`R8j-H_a8qKCr^9O@J8wozt$?7y%MloUzt|vg*`4zFY&I5y@h@U=(ZaWX)s1
z)(w-za(u3qjtgo@bFer0ic+<STK{kSVQU)GfUTFCCo40E)uyZ*E2+-Ycvl0dN7Z2P
z<G8b9HDR|i^i;Z{Hcb4zF(D4|F|C+eYzChH!3Nr3`%=%&)t`z1faHc-6NGf|+Sl9A
z$@hldAg;wF?o@Y7R+90dH2v`vI~vIMrb;y>rxJnSnH(-u@~aH-YpUS}2nMl4c~_!l
zy(o)uceYUEba6)nvNr4kfecs9;1)B9WEZR8@qPA*fCGq=^1Q;k+0j^{y0bSkZZSB}
z9GvQf4)z6-h)6*=$`+2@yQ35nPw9E)8}2k%($QYxRnc=`gi8Qn4{~X4pw%&D%RKVn
zAXsEgEUV4F0a8j<OQA;Q(FLn=t`~xD48hW9{~8x+*G^W+$pD5r=6h%O_!(n=OyXSH
zVe8nyrix*F$jkS@q;rm*LMyE-Kw2wbNe!ZKz~8$OcHha;#6c~jP0|?HNYbEOT~~TS
zOeE`zQX1EID-SQ&NR>Q4?}dtrj?7dUtioA@o@<4ek<Swq{y2DvKPUDQ+>Ub*cSY1=
zqah)`y+^p5@MI1z19yCEV*JvB4#!bN3v5Ms&oYjnKc2e^2|Aynriy(#8}y}gB><cQ
z<Z5Fp(BVm?Cxe#bpqo`+572CLs|Igv7!N}~m@6hqfqU^5avpff?j>hIFN7-!6Vpw!
zC+??*86E_4BB@wi7!X!QwM<iDpplhFEp^G*@CEgzd$9*oaG}z4t333>+wK?!=G!{N
z#eBIf?vH^-a20}?8p`$~!Bf2pFxx|{IS9T+_!Eyq-J0gl((h1vhy;!GOPN}$Svl_%
zSn>;B`4HgQnF`x&@unx%W^31v;MyJzEcoM;{s1_6<LA`}2Kt>J0pHJ`1W?GDGfN+7
zu@^2$c_f8GZ=IEy`Zc-qC0U>S6XWiEr%ky6p{C7<ydM`%HLdt}nYm&GRb4d8+3QLZ
z4{&<;A<~~FCE2U1wIwew9_<-I57X*nkL`h6r__UE_F@@qozE9goEra(sa?W%tKYNk
z>@e=yAp){yNX5Q>SJbmW{`v%@rUsC|Xww1Dnq~VU^N6SXxm$`5B*wpyW-0W1ZY2Wi
z9~j*+hM=!S;u~@VJBqC{+|f>m3Cu+KK8Ygo6P^!(lRmNz47qvtMSKG>S@@_k++qP!
ze++n;*(FvLDA_Wf?gKH9wC<68YS{o&_qozS^+~V=U_83e@$ktd2jyVnaaAnDkK|+D
zt)B4am`k9I1^*jW`{%PFIQ{1)A(qfht*TRji>_^b7ish8J=2kWW?!6!PZ-8~e5P&S
z)K(qzsaq1`$z;zwBq`MKfwb$gl{gd}jiOR^)<<licyQz;w2?jLP&$rF5-Wfuc@hO|
z9dF;Kpjq3R4J*<Mfxr{{4{${Nad#NP0pGthj}I`Rkib8Oi{-hs1_JX#5yrj<L2gk+
zZZ$7Fih^0f+ExgEpeE^}I<xlpQ|=KEnL#L2sU6%WR>>u!GE=BzE#<znD#^cc>x0Q>
z<89JLd8a%VR+~`H>e1HFfX*y*0IcbOKG1bNkbU?%&dZZgNb&I;lV)!YdOcDGdUUTE
z{5EY>CnHhEkm3Q6<J$iNzCc00LH5Hx7bN@`cdma;!UgO9V-R*kKkc|e(b~iiMywZf
z-Fb$BT69<PC0SCjL}VFjj-p`ORaGn%KeD8D7<-qIciO<x7TcLv`WazIV0VIv|M}18
zEm*c+<T+uuwoKOg#!0^gX$$^4J^eVN%yO5ZITX!FI;BD~3pmmrx8$LmfdgiUxM`ea
zh=j$T5KJdSCv%QeFhL0fM+MPz!sN*;A@eZ`B9zZ4%4o=QCMPrvV($#Sj3bvuc}n1q
zymLU^jeSIrPj65VdBJtyEl8N5AVUNI1mkFmvS1pK5Xu2SuS1~$<dS(pf@zeUou0xh
z;lI;UkZ|X78hMa#n32-+(^K>=4dOJ&gN(w!vSJbZI7JzC7io|$5rO$cG|Nz)k|1JJ
z%7f`FrzuJ*!c5{Ya06HZs7*hUc@nZ#(T6+@+#Dq-&1gR6>*0nm7)s}H6yz~j3lWC0
zO9Utn%XpEZSumZ^EXQe(U7>`=Nl4Fb<80B-)J4}MK@N!`n)W(VvQITt_8siHwt+Qj
z$=Hz%4XZ>Zs->vZq0W~$Q|fJ<sl#+s8}w4yBK3(2TB+MSh5Q5pZMGc23Cd#hfx5pW
z8FER4lE%4c(qio}o}mxHJP1jO@)!}oKxtew?-<oyj@V^=)|wf;Lw<z~SrqCpr7PMf
z_$RFQZ_l{Ci5JbD{f<fv)ubp>AghQkfnRSJ%}7=uyIhW{YCQB4ZLP-2)GIOX^c|IW
zCiJS#Z_nP4EJq(GjoA1baHr#<l(R&?J%fAw+3y#v*r|Ml@;E`V#7nO%4KI+S@js}W
zmyJ!<3r>n9oA5=LuxU-21MPewvf$skA6O_qi*H^;BwXf!oAr~`MtLx&%o*Zy{wj^<
z?+W&bvo3S`o<vjH?<^NCNyNJ*kxRY5!nQ`!?yM76N&g!Gx`&2(IW~=^Y2baJd2e&m
z$PdE2zpPs+l6v}4_46BZ<8U#L-jdv90+=ATp59({otL^#)xB-ybql!zoN-UlPY9qd
z*(xwGRBSQN=c^~5d&ztKB;W&;W1~eBKsDLyJLv=b&qrCl<j`s!b%Qwx_Yk&^r1a_~
zTK6d2XA=)PZ0t%Oj@oe4HjvA3)Q)!4fNdI1+Hlf_lXlxDts%h-M{YQBPxr`mE!xrS
z^T#pGAx*m*SQYowWcCoE`JVTep+|F)PFVo*NS2b%oh9~!cwQmOLA@icA6LmLp6}VR
zBV)(%RICwG!G!o4CaOea%Q775nUB@X@qH04gz^+T&mbiq0<90ih((ZbUF!e%F(uI=
zB%s~@gWEseQ>LAd@}_IxMEt9aLn{Bm!kn_wAueM|eZmp}ausd;TQ!bCMF|RjP^@|+
zC!m6DjtK=(PSa}=o}S)@#vc@52qRhRrR(=R$MFdDv7>?^S|Jv;6xqe5?|LSsy6SXF
ziTuQM{TqBxw-egr5bE+s5VB;(A<fY=B@w!4Qrp+X$9WKe8WdfiJkDGalJumeuSa!v
z&v_8lw9w<K3G%sf6AeXn)kNkJ-;YBNU7!>cvZyR15^@I7i5TgG&1Ve82liLqdGXgQ
zrwRMDY}z3i{TH?kphwSX8i4MV)`xh!WM%v2ny#BT+LmYGtc-qVTqNok7&&PV8swXK
z<dDW{LjOh**cWtxw&D$a$t^h?c$B4y-Igz)tw054#1?B2i9pzs@`(I9`bQi@=qiZ3
zi;((xya1#0Nk!+~5}2<!a#waTSdHocUa)gkTP}9e#wd<zg(@pjtzgwG32Eli6ZVG*
zlE#x32XQg9G7BF!hwU-%Rr}h>Gqx$u#`kH?!X2J-FW{b#am(6K=Pju1-p_o+)_Rn=
z!$G?D6R#V7k9NZIl;Aj>-p?~G26y-=Z=3rsi~QbRZ^hUSpZNxVi2FBXLGU+0J`)GD
z^Q?j6+4RJ&h9%wGiMPZ$b)0^|AKl-XmFSC%S2@D2?gMR6@KgY9agWz(9Wi6v*H=aw
zd}X*)9tIJ0XC%$Ldpbkuy&PsfzxW(vg`*H7f$qxTQAX2%W^af?!&>LJ=0C%`E1bgH
zIO?7@kPt==Z5`AKix=TZ4k?XB_rdw0ZKc*<s(n}M;Fii2OR4ugNw4nVnr)I@j<II@
zG*n-*?^5v6ei)0kpOahbvhCMYec|rmlC{eW``=>+wbQ)G9?r?!!{elt!uDvVwq#^^
z4_B*IFxz*n4r^wey6!23Z4m<wq_V%ic!#}xmyIV^c^GT9A{6esY*4vs?J%kf;nDmK
z{FWck>TzLe-zkHac3*mV%#IXA)Uy0UeJC8)p+3<p?CZLUHN}=NaeW^vhAq3qw`_}&
z$Ld4z9q}N}(f0!voqRP$ctv#F=}N(j-D%}d;WQeASWQ}EB}63K81W!v2>*<Q<+~B`
zmQ5;^j<>~QqOyjc-LCV5-phGHl}tl+To*es(Xpme1zWB}u%f7z<vWfq8}8sd(ZhM-
zNL01%Jdv$CPaGJzSg9h}^TlecC?(5izvAaR;;okp{F4p(ex}u2(PTExM-!3jJK}x%
z$QSR^JDNi1HJQ>+#X$#qzZWl@ke)EakCWzT&a2NW6B?saBuml+DPz%Li{kXRXK=-c
z?$K8)sB!y%ZcRZ-rqh%`O|#o?h(TP_tKLVZM0=u4i7r`^Y7h&1wqavUa~13;o`PLN
z@oe~!?M{xJyNc{!Sa*$ikBu(3m@yUzqaVPLw}$y4>?u3j>AmH>H+yZHch`W3<?rIu
zE5mIMTwhKN)Sw=v)WM$XQLM?Hge}W8v29Y{G*wMfo$bh?+xywEa-H)?^x;Jh%onk5
zj)*>aA?_Eq{tcTUVpM-|Il6%(_gt2wuf9eOBRK5FVMvmUJ}-VLzB~u$?yoCQFDMzO
z&;Kk*s%jWtUyc|y%r`m5i1{Y>%3gr~#Uu=-(Q~loHXB5K9OW3E;pd8!d=~${p`cQD
z?!=+@HSgzU7UcA6G2pK*N8i4L@i}qI-s1Yv2Y0|l$`BpCInO;lobzH_=WGQ^9GkZR
z;9<l*WO4BU>Lq1(7ry{sL6K_c1zt;rs-hn$nREATw?2poisBr_QMlx+;u&I$Xcmzq
zo5eYTW1Wf00(%2OKCS^VrU2Ox@HV?ZXx>x6$KXsS^#Yfn;GCZFw*MD0PrgQt^*KF-
z2nW_nFi&Wj#gQ2DoB#$*yvWe6@84t-1b7`wl(D7YbMylSO2gqpf{0Jx_HbqRlI{a7
zqk5)A3_`Fjdm1Dga<Hv>GFA-F_btQs4C9N$F+2cw^S@H!0S~uE<mXKiucH^uDS#Al
z<Rc(N*u4eI!NSFt<%COC2~BY+Yi9{bub`(4;A5a#v;6{-h6Q5;fZ3G=aAUz)LDLWr
zGtQ9k-sR*8WXm9sn7|_>eJ{xJAaaXY%z1^gZa(dF#ami*$0fPS3)v-ft6TL(Ullf{
z*Y#sqSX?egHNW^p&_0e|)9`iV$5qLNyE>3x)9_^&xK}F!`PVqT3S;8ch9Uf8YC{Yn
zbaFXj)xQg40Oh$HO`3oBZuyZ$B+B0be%11FRP#0W=kCf_UIih2TU;{2`v%6pVN@jn
zis6k{9GU0sZcQE+i&>@8xf`6?+7P7~O_W6R!G)^^W{G}bp6~JmePr}k3rS$z&dC+U
zT)m7w)ck`y>J#SYjija<P#I59a|rq{7Vb{0$^CuuwoHw;QO>ZMnX+kSyM}SxnZwE1
zb83xaQ$=sp=BT#Jk#~6H?OOx~QzE;&KFpZ9sd!ndnP_dh#d<yNOyK_Ly&dI|M(k$D
zP<2^|;p;8K=Up9l_;BUyNlkD!wOjy3%gA{zw=wb~Ujfy|)aF>t&D=P*ySf8}iZf1g
zP(i||Nai+me_}quWm1fI00`R`AdF$Gc85IMM+e3#<{<}5>znv-6?~zi^5$>=|L#WU
z5lF5_nH(eO{ioI|4d+3yWFlL3SJn6iB(vM`2sj9HY){0o{qe>QMu|8MM#OD^KJ++2
z83puek}i*OjCwr@YsW~rjVoeJZQG+NH$#ocB9BK8(EX#Xx#{uTJUWYuDw{f?RL8pE
zDOhs>R6}-EZ0Zg*ER`C*?>r`p%Zd_~YhDMVON}6GN3s>!$G%H_tl7SXEl*dl<hh>g
ztE!~w+X-SYx)cOB7+t=+(dCCZg^PDuAft6NvV4=2!>T%#jpQ>-;9o&UJdaa~vKXMp
zb79RO9;mko6E{Ic88LeYw?fcj7=B9sxu8)VE?Jo*rPm~6|DK>Af0iK^Ajw@4GQbat
znDr}<(LWb~dlfEG;8Adr;k8pr+?=`nFkFAp+1WSeNja0>woc_6=iC49|M=hkumAV|
z{@-2{cAa-=4EB@f-0P=MZ-*rEGM6Oun{($|X#e+<S)M1^^Yil}hrrpqP=ubj@%)@u
zBn6DMdhW}XK{ZFhisiw@ViRmjGR3Z;nTF*Up5(db;Hm_MqW{Lho3o3YOtY^PUHzT~
z$^_ALeAujBEb<tXy&iHF8EExkZ(yPgD^r<Y0ibCz1W8E3kcNn`J>-er`Tmh*8iyhB
z0%6)f;UcBk{;Q-?M^{zT!j`RgSTk%L6U{cUqI(k2HQACW?X?6S<2bCQ{~@O&e7XPd
zG|y5^S5~m>IU3e%*TR-&7+8^Q*|t1Qa%`v9@P7I5`sa_;_<sHQr7Y|6`H!<W%Wu+v
z<)08cUu{a2J>y5Vcf@6?odcHLk%>ulYGTdNRIHi0g)K|cv2V&6kyTkXWO5+o{Sdk7
zG6BjH#+}vqfJZ5SC1p9u>A4?7Byt0=Kv6f3(*q`F=(1-RHo=;y$bf3)V8^iytV=ev
zHAi=R&mNaopU9c=4MDS%`WKg@qPuCl(vg1?2GP~|e}n%Yco&MQsJ5(Lj>LQ}E=Ql7
zkVIFPqqZf};2IbF?Q>vm5x?0t8thU1if_IS!WAGTUa-iX>wGi#Y`%pwL6ALyxgYY&
zp0IDX={YOinK&WsBTGof7bGOtv}9`OnD{_xGBL32`X+W%$FYfId%7n*CP8AAu^42C
ziWW5AvMj?>v1KU)Yp$$e;+Q@rs_A&Dq)=7ap3iNNAqv_XWQZ>>LsTv%;9m6sUR~i7
zkA5UMy&+5Vj;2go7r7nXxVEwpzcL5?`6A2%$gg!xBM;JTaa6=2Wml5M-U8gbAeT|>
z`^<?1xKQx0Dy+<B=&$h&y#{zi$hQTd0x6x*C<Ct-8hJR6G1%5flB6+lXaDsd|CuEu
zf&^epHUVJ+oUY0iCn(`MlL-o<YntT&_bs2Glx9gBWt0OsGVIVIm)L*($A3cZG8h~p
zXb}Z|0P+$<DEL0KdktguX~cvW0uYP2JEIu@#?j9%r5?{4MZw99xJw9y$bvAYUi)rj
zak${q?;r|UCF}Nvk~CtH-8!#zb91x8{m=+6vXTcocfxpju1Jb;E*a;teqI*FY-Yfo
zunojT4eZd!oy|#l6+}~fMVB~;GN8o_0|q3HBZ`-lq&W65#A%$5(Hf7ogBSg4FrDEH
zwjT(lnN|zXWrXjMJdq?xB;^wBQq)5jy`oOKAnEeI{^NhXNYWrgFg<kA;(@qAn)R8D
zi?zH>cB^CRQSm(4nrlg#Z)3$WBn;9gcBpP+-%(|v`M#oj8TjCP?{)`d$gZ)I*O5m*
zKM%mv4RNc_IdtX({SDG&!r!^DRD}G<09v`hUllC<vaOZjK?;<88_cOovK&5Yrd57a
z;p4kBj{SFW5b@8JT7K5x^IzjMqB*-5f_w=@EV(M8LlI_+VRX!Tmvy=PZov1~X&k+a
zQ`Ww$nAPA+`1&15Q{pZ>!anPkUVgUV^Q$1GKP)MHRAkA7Z>yQd1UO!GVu~B<as;75
zu%r_x)jYr}NB11bKk-w`Yq7QG9kExBr9kV|hHz`RwOFKDa<X2AdT+t?^>0B$vJ8!-
zGVN$|dK#(DzC_Nl4J3R(?g{yBbC_+*L8eJx^~*qZJ8lC9ZBWOP|8$at?BgH8eHoYq
zUh19jZ5xFdeJO0nao1tR7a3*oRD6+lhoY^m@|X5c`MtXjMjGF|3Fh20s5?=Qz>)F0
z<!wF`ptSgjE^qG+f+_qW{8r@00cf&@OY&5KNvN**p6+;9HmQO&$#bz~n;y1^>Ntul
z%Z9&QdHBE-$sd0Bv93NE^vD${$i7NUsyJ98vX3>(A=vhaim9oqvZqUuty+T~`O5?V
z^Bp3NYU-frSA9^WNQ#DS)iki=%f$3Flen_l@gD0JQM{@FvO4xML?T~~zWtDsC3?9?
zQyS$R)zw1d2>)S-+vRQ{WtMVuQfhbp*YDqtPfyW*{l|YIQ29<!&O+~SmQXhUI27Sh
z0uh#B7))v8QsK?A8aSLiN9$(j5VW+dy4X_D`q@i`6&#ml@HVsbx8#bP&9haDd0`-i
ziB`(aLZJk4LsK!q(t^)i74RbAo<CxSfDT1cch)wGZu;cbK{u;4DzuM$Q=s@q>dw&1
zcs>XB@+ESrc?sJBS|lFHg*y}XdI7`0bP;&)RJF}3r|!%xnp~M7xJgapblIjG_hV3W
z!_cs5=zR8Nv7(e8r@V}6=uo0{d787TugDviOOAX>z<|L*!*?!{SdhKQur{9!^TanZ
zl4m%gH?33o*BJqqFmNR6GFF%?DkjT<^lF>tQ|f_h#p!9=wuyr<_u{ffQDNJ`X)E8)
zz2Y%3a<yA^;NohaK2%X$-O#b?DFEZ*tKd;guw<$_@eR|p)g9gdn?G)omPhn6kmfs*
zk~tN+(QOKW&4kj6M1aNc0(ibi_%{Fp2*Mx-S$GRyHA;#>mMEaa*+xSn4*C`dl$0R*
z;hzf<evG%)xdsCP8~<pJH7IDlN<jIGaMs+i7CnU1u0BoO{Ft^(MEJS;it8$-iEZkr
zShEZd6WO=0?Gs%!HKKafrq(yLy>W88dE0J$X@y}~0H9Zfc~n@BOEwMT;#Y?10&prx
z8eaz<d-`}`;KE{IzAfAmPfsiVfzwm4BJE}+cqlH|=u79uILb*70WXJ6Pv>H|oHIH-
zh1@9a4Dh<IgA{yhCn!snP-Fr||CB^oJcoad86-y#p&-xD=_$mYpPoXI(^Hb?#GTCn
zFyi!dGrY?m5Ba1jhn&<xHd2p%KzC`3I%|n`9#c#970dTs>=-u1nr%p!7_y69;>sqG
zWQBUhv5%>G=rQeYZ?8k!{Pga10Z0RmE)6hGKtF1p`wGq`qapX);E+rL%!Z}j#r#hq
zkY0qu1H%TKAtmmN#lTfqHyv?jNLXaFT)}PGm5Q-FiCvj4QY3?fK4A8r89+-|)+<tH
zzKLD#t<Nh%2cK(I=OkQ5qhQU{fdPsldw~P6%H!r>*ZSmBxSd`rn3*IEqPzrLSebBz
z$RIjgN#InxCPl8c7GRlTH3bqx$L<8SNPDW%l|e9cc=VCU8g+0B<w%40z+SFbX*~Zv
zo|7P2?Vo=~{9`*lOSk@u4d1ouf{r<Iub|!*D3yw;x*$;q0E!ZjVrSTK;l;7dmdhfA
zOJ&dQVBxx_2P}BWgBRJQ-b4C=-525>{uq0pN%TUH=!qJ!CsIUrbcpTZZ9f!<y^tUJ
zp*{5X0qAVC?}_BFQ!mgLv7rY_LqBAOz0er;M_|~YaQWi^YV41wuosHL3Ub23A<09Q
zwilK|SNw*JBYHZ@l7mFBf?dB#0!Zi{Bo9~=QzTb1JWs{Cr07_46bIXeM6vHnvf}HW
zqH5~VH73dtWwBm>%l)C2yV+Q~qD~(Zbovp3DHjq;rHy1S12DYY`1Ud+8Ph9)?W!mZ
z7e+@20FHz#+IHh8i^G5$!>(wNr30c;81^f1uXs4i=OiRS)F!2a3acT>ldK5lhhUga
zS~fp+A!vOHA|goj&Gaw~f_73EA6-8G#`J-<vNIk8y92NJwO>x+8eU*f4g^=Qo^BlZ
zK{`hth)>arN(YBd7@#7W#~vL65-yEkK|MAJ5{4qc1jbWE4so4f9w%jQKA8t0h{z5N
z<D0XCnYa~Q*v`xfrR#}gy9RY3{{Y1rAvShAi(*UmWZAV9>Ui26xSrg`E%4_*SL)-H
z<5SCS#3>wbiIb2lA#Q5}#g%z!TB*Jtg#!RN1#D!3SaOasVGZR0V4Nj~9)+4YLw-o6
zQ$b}-EpxUzJ5pcrDVB|k<}*rw-ReeA)Rr7m)_m+yOT(IO%Gf4`1o6>|uR5M&d*1C6
zlzL0K40?qX?aq9}(-_sW9j)0rTGAT*+lI78I~AE^I$gnlt}8X`sgSm)EF0y1NvCh<
zH4Qo7H2M>$dkO>-lm+ue$kY=8%(|`g2kQQkK+fDCWQw6ia-*N<5?ug8>5}~9XPV!{
z=~W5ciy#OIgDR<A?Is3VX{Sg!{WK?^>xq?4S+=F0=yJ8Jm~Mq*+%xMuTXUAYvQ`%2
z9V_)2>_)xIdA*(Sn5VhgRJJ~i@wif-@_GCt4kC0FMBW9kBJl#?MWBswL+QFPtyBBt
zNk}u7o~(VGAZbNmSIwAYZkMzwUE{0z>gSH7r8`RO)VjtF9)ONX@ApY}e@L$SuHMzn
zoStj6(b?U4zx<sY+-iP5R1I_sZZ&%-1NKx2?5`N;t{&*gVib=5(tS(;b>JL@%Y`m^
z5+N#fC0oUsEa{lYx`bUtl4Y5=iY+UTkEcc$y%1Mo9fa=m^yfHda#0Z!19hh{<6#)|
z8zor~E}2{GGzu~hra-!5E`c|*F7hI9D8+SL$c2@|$eiZ07$jyU#4a)lz8E<${TYco
zFk#W?I!NP)i+6bpbparaiWDZ1$FbTO*WOYcd_ki)jHe*Zg>ihv#&;FPHxWvhdKMnZ
z!V!ctW{RL16q~XH9|XE&t|5e{_aUxJGbRgz^a?}a*^Qz+jUfT1pOP$37cO{uinK<(
zB$_sU(-$~<D@&T)nwYUlH~l0IS)r1tXci_O(I9=Ajcwa?v88C#F?84WO?!|yjxBL8
zId{!Dt9}&D1(jxS=D6T03Pw}3h}ikSizxW#0{B_h(h<a%x^z<BP;dDaz%GhsV${#>
zksR|3KRconBRYLY(u{h=)Gq+tF{7X0CO=tS7{R~KuQC0c)HG@QGrDNDbymoNwFPWe
zfK)}#;La?r(jbnWO`iSw{!RT4h19SyjYdUc<v{Y7LvWllK8z>#T_O{E!kkS|T|f&U
zn;H|&(7#vNv6|CvR%b#S{Bg77#_RQw1zW4`>OiCcsY{2#En`(8Y|e*dZhgZBA+cKq
z-$x=OuG|a#MZ}bP-6h1y?M<Y4o%Nqb%x<GW*nI-RuKj3*UFx`w;VU+l6o+EX^Caw;
zwt`*HwiQcv75i}+kTRy=tl3^6){`@bOxpcWc{De|4Kl&}cC~?$tYC_Pfr%FhuL$#H
zb|EpYlNTN@^L>01L9#}GK>RCluK*8wg5H+_2Ebp=<Ghe4QJ%*CAkhSU;Nb}4BN&lZ
zG-2w_i0Cz|rT%D-iEgNt@9Hv^ELFmqVd~g2Jq=rmFR7j{n~vi@;A8SJPPmQyih77U
zIM?LEEyv~iLQ4VCWm-r;XdXiVYn4NQM`j8sk~#91Hc&VaM>_@U?h7@H(R*=15JoTK
zWcg?hil<Q3mQ)98HrS6Pk6@yyCRROzD2}YiRN3Tx_2AzV;B)G)2-DcCyds4kK$l0P
z@p6>71jWe#(yF~mLB!RapnI&mUG5dpKX%$TT*;x1>toweEv%`4GViDatCHs!u5D|I
zbqBoEWAdG7)n5V|RdXIIUnHUVUU9F1gHa3kWGc!{ZWFhqMr?P=C^ea^HU72v#v&;9
ziA2kj%MpJfS<3M0m1O@c9!mC)>aFDeY<Vu(2k~NFj>h-IW231&{E05PqejcBG*wf)
zo=5w5DyUD*Qy~d%RR`t5CedH=8BLkfGDG^iW5a!qcd0ve-GhCKi0jyvu1eUVDuJg+
z#g3-<*z!G7gUpG(vpve=DLq9k4^I#kPgDH~a+c_tq&x?B(|sAPi{g<2H(^o;Q!K$i
zDfP6!Td-QI@6wlhmg>HO(BAeS>5Wg<(|NgAOY9lCsJj@pEXs!NH$8>LAgT^Fj=$$q
zxq|cltX0B)259Z=)A;QfXbj4+u#&AKgQ7fIo0aL9qx;Ev6n4a6-vfbt5A5}>R+Toq
z_3oa7``~o%kI-F@bS&&p9Xs8DldVebtZRnpuG8E%8T%fI*!N4qeozAT!;`Q7ap(BQ
zd!C7paZ+94!_hc&7lxy8w?|`lp)PRnBc3d`Bi{XPN*F-~(w?s%GZDWEXvn0bR+gm`
zY5{BK#dMldo>z>=?M9t)J#Y_#zEJ3eOvPp$bWnD%N)YA9-15ta*p3xvl;m@gysMte
zX-aAIo_1{jM4fCFhhFw$%4E{tI-u2eIsT)-jidgncWcAR$@C-76g28iI<Mj=|4_W0
zJHQRPj%6>^&F2@NgKYCzxPMBVA@~Ae^!Uw)wxb!YZDLz?!7atmFmZ{2Rar5JtJ$u!
zBfG*=(qA29O5p-NLmXH&pcJ;ntu~V&i{hNllYDtnYie9m3_ZCp)XERLS`ipP5(asF
zk)Y?v<%l~bFB2O3C)_)FymNs?iPGWtC%P;kB?>F_4$th>!l1R3^-@i=K|=)PYkDD`
z0dUajJbtat)0AAbL8${uoiCz~xu-(sK}>e-^6w-oEJejmCws(h_fMlEE!+b!>JIV%
z!bp9zf`DTa%~3TU`?}_XAV9I>C=#}0ThTqq*L7_(x<2b?^T&-EfTxSaUStZn2UzUe
z%C4bE?ho9qSh`AV6;l~<w^5B?OY${rs;Z?+ME2B;g64o0SpE!XfwzMe$h?aS9C=g#
z$xrIo4MoKElF7yb9Q<_ySOC4Q<=nV?NI|a{e<;SEO*Vv_uSJ@(vKgOK6D*;g8f3-g
zzb{-NDLsI?VGh2E(_&1o-!X@4#&|Kn{AIjAUW}qRhyQT^1`*s>Kq<o@39|sIxp5SU
z>2vm!fhDGBN@MI0Sc7yC((G#l`DlG`cij}Ek6aMYgiZ%AA5vNX8XgUk&><|wxx#xW
z39=$XPIny<A6$nRnxuM|DvpdbpIVssx`K6+>aIeFMfJxQbGCL0c%;DJgt7p(5~wIc
zCkaiP$O+?m#8?yQqe1!Y{X9qivLGn|pA-s2_KE}mcX^UhQ0-8UYYgL*{cpU;(a$V1
z;w@o?tX*dPz(Q=@p{B1{Sd*xOHCflNEqfMLB;S-&)mMC9AN0bv0T!~had(OJvB44X
znean=yjUPr*^jW9YXEJ9$Kj-Q$oby_|70xz4J=tz?%8-EE`#kgc$sHU061~u8Vhuc
z_U{vEb@@f{>Tj$_xz^${|Mz4-U);}E^3efnv{To95R6|OT%)4>+XvRT#cA*}ddnCm
z9Tc{AtalwyFuR5jJzf}0M{#AF>K0aHMa7yeK^_fN#;)Wjs^#jILN}!}e7I6tn_{J>
zp!T+-pjJc@?N(5<i~hF<8{ev3>LsT6s;d~bOtI#x3P7mZ*wz&dTSS&k*`}JN3}V`?
zh-oENb;Ne;lCXV%b$ocRjsq&=fXX-o+I0{fkIOh4#^A8fg>SYVE!*r%k}JDZ!c^BO
z)-+ebmg7rUBfeoMu1kGufU`b|=kl$wI-6Xb2R!Nr!nkw|dv6nTn0NCEOmeN{UUBSC
z4sYf$cs%c+f_*G*&$7DvIV^sLh~4`b%>G53r;qIWyE_Nw;QNa(QXVZUt=p1iNyNso
z>zi292*r-(QLOle?zpBTIlA}gG|=3W>h-&84gE;thPOpS2@RYu_jdzdG~kU_9OOzD
zwQCI#uC{_ayIB^y0V(}{R`k*(oM`0~H$fzfqbV;Az1CX<m$hk1l3Cy)H;z*;fW%7~
zIsqq(eBsdvg39by9uvrY<(4p7_V5L9bcX&)!=%i@x<s>JI>Tv@U7?gt*}_20EMBB8
zK&ZxP1t=^KwdMiK(+iE=np(WR9X(SV*`8@RkmAVKEvz||V&eD|9Nv6KrVfz@b@*{)
z!s<jY(l5#Mq&imPtuo$rkj`2xX05>|;C)n+!K#TjM)o6(Uq^n7F5pV|1gHBGxcz(z
zl22k2)|X6FeIxFQx<DtIJ1g#y@dUjoE|S)A<t@_`@~S>3Wk0p1z$upnP2C4fvYf*~
ztiKCbxOM-PgL0q~wuYmJD<95Day!x?$o$_ek1ZJnIi3GRSqy$xa;c5y7ZInT+?g{-
z2NLbEPTc@j_FSXBE3|WccFQ$DeLcx4j9s{8U~+Fr4!1|A@J&&T3)xUv+*aKxi`z<c
z%75?HtGL`)&GH{zs=^&tTbdp_$*QgZB7IoQJI=J}V>hZU?QZqylt!RUOar&)sCm^r
z#|<R^axW~WDE26;Swd0uIy218Y`;O*fTSQ+X>^1WcVxL=9}+Nkb3J>sa=+y|nn7I&
z6IUUS5mv^IZxJjxmTu{u>{H(zf;?_hTmspo_RkiXeUPXQaRNF(SYoE9blD~YiESEh
z5#B`Yri>*12zIW5c50Z-{AFsI)LIG__O;@_dm&NXPwD3|SjU?C|Ku!W1KRTd475?C
z9z@VV1RX@sE+VKv8QvR{IHlVSfc$5WVDD#EW%;qA*g6K0R9z=naV#He7SXXqJs0bi
zulc5L$(BS0@T#MMR|%dJmxdGY1I0y5dx3|+j444hWf(b61?EaIY{hkSiY-NVv8KB+
zc083}$u=Bar<P|Ln_$!in5*(<fVsLYn5&PgIn%ff3P6ducIpdZSFM3dk*qhqlpni*
z12qK<ihSohyJ1khND@e^J)`IYSUqx-q%@;BOnm{Ns3_qc1%Raih~9CQ<CcC)L@ItM
zp#(6>Gw^1D#Ry#HUoX^yUOXp3lod^Wq!Ed7^db!7oAd9&*u6q;f-Jv1)F~hlo|>Gi
z#&#+libvSh9n~ZnHf5?|jVL~LB!^%}^*qZ|RaLd+$K^$~PGl{~+8N%rRLj{e=)3e3
zV}~TAE)A|(dg+FrSdqrMj-B?AA&_z6nv*4RC?YxY<)SHK-dxO!YZfm;4?ZSo5T`*N
z6qs+NPnWxNXj)P-fz}y{TAq?13Zm&5`Y3)YT61}L?2J}vvV~(9EWbEo;Nl<rbHRP*
zmK-YWa}q=Mc|2idQp!}^E=3N_;84MdD}2t9G@d7r%|4|`oB~^bNVG)RB1^<cDYJaD
zwVT65h@53YGIl5N>6GCpyg!~5k_Lcp=ft0npRc<Ml*0yxx9Y_8@^*6_%OsLwVB$$C
z@ER_*EE8PbG(*yC$+O82{M|I)temd?>9ECl);FDJbkgn=wk_@G*2JGrz~_zO@vJBJ
zoQRF7z7$51z(3iN@q%@;CI6?G?RUic^f4vCK74vdQ<p|LnbJ>U;hEXTix*BvPgpvq
zll9S@S4CE)Fh-}cBu$VqZul&&H}R(nX*DavTA|fos*c$}TP#d#P4fh!a4-shH<ogu
zIT<MQ9r2J@Ec6vCw0-#oqf~KK4@Rl#*&2*ek17S}7YVq!-Rz;Yt8gz<tJJm9u-#vN
zyBm+%UfZqRwPn4BRejF%q+JP;2Udb>u=I#C`V3cO`7<OP??cV{eWd2$#Xp#wdq$Z&
z76x`8=fSILvscyK>qQ5Affa3Vsny9It<MHEeV_V<f_)3{yJXA47IAFs*%HxR!!TS`
zdcfu)*hN_?@&tV^Y<dlabIp=;B81NIW&_fSb+7^>*o7;w7WEGb&@>`p8R!pIOXR2Y
zp9>m+-DMTKpfXX4)evTy%B)nN1H@5~$1KYZXrPY@7I0j1i!g2WOp2nawq!{rR&+-J
zcmaZKL$k1LQA?3MVo~=FkeZ)Dvh13nr4c&wP7w#72#bMu1Ae&1XXphtuETA`GY3}5
ztC-!h%>)E=>JSfXo=g#tl)7wIhuIAqM{ls?bhhMFm~s<zh%sk%s~?9Qr|~o}o671u
z2Q$tPTQtNL4N1p0Ji&t*r(}2rGtSes+6`u$#_9}aoa0}Sowcr@ozLixkldRqOnee%
zI{`f(;*qQP+9#(yzn7-X!5CEi47SZa<UAOI9w%Qk*fx)|{KM^hztPb9fG`fW%`X#y
zzHWLcOk$7MzDbCto2rHt&sVTUbc!8Scd)G3I+Y}VUh{{T^kc`Qe~gnCA|ekWs_@4+
z*%`(7xFXOsD%p}m9866J!*qQa+bTq5Qp<2$qDZEt96bVk^PoBzBP+`}D&v`|oI$UJ
z5wD0n#u%3&$T@Mqq;eg2G^?zAL6pbBa413r(dlVrc04`p7EsKsJuI$Qv;wmsK?L@7
zbb4Bjm7Bj$Pnn$)LYeanou2Xmhy^%3ouJdxU*EsU;I}wMr>87*bT$VskJHo5@w{7h
zd=I~wQBt6@mFdulvz0UtI@9VQXIj|p746HP-Mx>aPc6kW3?2K#hBUpdf^CP`*rW<2
zj$;!^bB=u+)kBYCf3JYLKfq7#UJIM>axEh>N{Ta6^8#STd59^dA$ML$Xc|C1Fy=Nu
z;GdZP34Kh#=F4-(BcD=c@aMt3K?qUFB)x*1ligD3CNp$_>KO_;g=Chc*6r5pMz|c6
z9k5tq$l*3CD-|#)RfY>z6I%aVtC`IBR2lrFOG1*Kutw(OiefSUqC|l^=~167La?k$
zfPqlPUZO0g315lI0L?0on<HK8l8^s(dR;^!-O5Rl29ZF=T$}G2y5@KSPXqJaDC1v6
zkmKcOf__P1Z1SWWrdY`Fq(@gC@2fr5b!7lNaQmZ(sjr5h9AyY=UM?%WH<{_GceQ8l
z#YXR1Zb7{)l%GXPeXjb{sy-`fTFDUzCCO@nKoMpt`Vp;cXP0*8`|FEkdN_*d-uR_0
zL83uOw~9urL|3VZr@VOC)h(<gL0=c_(T0A1Yc{s+64WT9e!ll$JDDV!Lshz!?qP%I
z9DG$bQaHde9V&PCG$ZsdAM~@O?PWvTKeyj5X#4}HF{8j`lXST^N$$MP)<{y39}Y<#
zvb3v0?~da9(jSpU9&Z`dANvSWJ)DalyVS)vbaa&j00j~x4_NlnJ?i+9V_{9TG^|;=
zgDqnE08m9d-BwK5+5`(Zfbo?-0~p`oV0>R+j=pWtY_XSNg5JD&i^S`K7{{6g*#x~1
z45Sb<Gmf0a|AAhH1i-`Y0IZJ-Shon(2hx2*JV!Y!3(U7z0TEtO4T7y1b_m3t6fr5J
zTsek9#;dq|oz8aQ{Jp2w0li^b2xysA<MSyM7Ws_MY4$au5iBnHKzxec1kn|bAqeJx
z=@&;_rccsX43&?jij`@BSz~yG5d09&1BUe%LRwJ<sCG1zKcPzFoB4qcO-A1_?7yyX
zV^pV_W&7B*R0nI0YhjxjDt08x^BtY~s_Z}DfGxf>D`yi(rZ`2Xr|cZ@<AS^*M2l=9
zV9<T>1G0XE`W+Vr`3E?91i3Sk=7p5b(E};sTtD<z0^=39fzS}|o*#(p_-R{t^IY=(
zYoBl`O|hx3c?vdUVq;D6By4Mvj}=8$JkO<y;%?_YpLRIa8dY&@#$Zm{!>T+IgiEFu
zg+4&R1J@vE{#Y5_BmL}#3$UelT+ssxKLJGA#E#>EQ#?{j+$tpi9m<wjPUmOnJ)Otb
z+=6mBIzPW0L0hDRRArsPdUey*lIav(pgGBD8nEQdCmR6u9u-dB4psANgY3_>$kIwr
z>nv-!*$d<ZQN34K`7u|_rl9Dmm4%E+m8KAOq2A%V-p+W;sAXf>`b@{;N<++N@sBu&
z&{Yt57oY-)7dcH4v@vezm7BW5+7#NRPC}Zw^kn7J1W7A;$!fMFa|iUgjfzQlgxDL@
zVU1Y1zIkQYmGfpLQRPvCpm-OB9KJ#sot>E(mtW{em~-*5JfsfQbq)9oJ9Hp>`Y_e_
zoJZ@l<Vc=uO4P-wD!W)Co`fxz8d%XSQ_@^lS2g{y@%RX@iP}xJ|K~VIBn%4<ngd#s
zEMN%LZaj^Ge*=kdf^KGkJ3~Q+Zf0GC;05q?rHorLa%fKTSq$=T5CJm=Ov`nU<{))s
zB=UgyqS1Ab#u4)!ffv`KIf$MVfrAO-YJ9LD6<Fb`)fq&09L7^%@4`5~Vne%%;+qI1
zObHEdWVUc;Al#E;ni&&(p&AsMQeYhkbjciA2<sCO*QFVg?Sa9Bp$GtcK;wqYmMO{d
zbm8U;j%D6gq*`ZtePAX*vTmviZcWsA;av+l=_~K(nrTo8ONK$PrcjEB@7P%Ph~pZv
zLR8lp<elTnJHXqmRBTZHc?lE0DB$r$!DxyW5jzri!Qkw<Ca9aJG7lo)DC-vXrklw|
z{<&&`eD2&tldT>EraHLJTYj6iNlh&>#0EI+RVi<RzW;cUkTj#8;C(q+?X5^93l<r;
zmK`$vw1^VoUY&gZaV>A`Z<nK2aCM4XoQbBta~Sl%=dueM{<D=*&)C(<zyGPN0Ax^D
z<h<;70{#5@{>|=gnuXSTX?|~Xa-ft6#l_hXh2eE$f91!a`0H^c$4wg`q{r6J6KV5`
zR`u4tP6o+yzhu7P)%U0*&n9W~7d&Hjg1U>IliQoh%IWAomm)xSkfD#@J8<u1=o$n4
zxW#G1F%(rZ33g;d!J17CY}vAlCDX7?;wy^h*^ft@&Jbp%>{WwoQ=0B57r!CVbOAEv
zi`O+H7H}fpf#n$Nr;J5IFXK5Ri~`f@$#*}z1b<{Po<jPa#~uZww-i!g#Z%zuf@>Ns
zQAkP346t0oJ&PA0ATx<Fr6j~RaT?YPz#tgU6Hov!p_YV8CUAgiptQTy496rB5(9d*
zNb?y@=W$9WC;*F#8>dN}G823$wZ0|pEQlz2Q;Z6_`I+R4l!VoCyi4OkzCQW+&AV|U
z-Bt|a_9ie*D8y~g3l{#AGn;-rB85pxH)M$jnl0ue68k0cX-&|Qd4+>mFWm8jq|HSx
zwgx#OC<M=E1QH58L%*@XBbe#$C$l_HvghaLFhbA;fUn{5Y+mgDnH$f~oiLuBmw)mE
zMfh<VGkQ=By;%YmMX(>Im>0sTp=UT0D}+hFzOl8(G@6mf4WcP#bH^e**tw?3lBOBs
zqvKNQy<sUiW!HT`dTAA0Mb!++kujAN9c#YfVn^|Gtoo+qO0G@(y8xxU>pQ0I1_Np6
z7~iqqO_MBANKS{HMG)rb4I}6BxV`0f$H|*FZ^uCIjLzYpiJ&v|;x$g<8|D!&ykVHO
zD-4MP2b@_$MM}Ce^vfbeSsX6dpQHE&F%dFD1?@t^wd2bCN($6gk!TR|*NNNJt8SaD
zQci;AfL|n8LaB%T>p%V{x}p^DXlg*NLa`DrayZq?cp>uQv1X^iHM5i!sr2H6@~LF#
z<ijs7;m#p*P}4>928Ccd<#9eN`i=+R5f4n^5CK%(Pj_)W1k)(UDNd<Jedb)#Joifs
zsw5nS^9<)Ph7}DdCOD!un5G2BJ_hL9b4`^LO_A@{^}uPKk$k@^LiS8Wbrl2alI(*s
zq>gP>m9edx#4!ogCHW56kcZ-E!JubB`AFt-7A8~p@iftu`Mx;IR+gtt+qi_+w1cnD
z{q@kO>mQ$(zr`~)AFc{pQ!R?9V9+nN5yQHZhH%Mfx*%}87Ua=B4hXw(wED(D9V;5@
zz?i5_YM?A9T{J*YtfvBqNxd(o)09rj-hPgw4wEc28T~q}ZpINj-q|b;y^j6|BM@m=
zba9;0DZ@4HSh4Eq$CNz|ofKT1^+GI62$%(~*7>#v;#xVfzZKdCsYmUUvc%jG*FzWC
zvW^P_wBH(hbMY`1p-ZuyzA4=na}>C7)c>%ok?ygElauL3`WYCHQK!SsZi-iNlz%9K
z+*n9bkFMUu8H*rdJ{NJG$Mex0yZ!WFM4QUHx}e%E*zyZ#@4CH;od8#QDf}#hsFLjJ
zSaDnlYpOx8Z7D9c4B4TSnyyVYp*=i7PJ6eBe^Y)4Ap;AAl+eBj-{uaUH$cNBs~%)E
zWnKd`CR>rmp|94SOGle})Jdh5V5-M_MkDTI5Jcc9176Gw2Ez?teY1P)nLY6Rwa}}k
z$_asV@QFmrlgm-5m<AdN!(d7ymtKx0mm|0@iJK!3Ih-)a80ZiC@?+rV$R#NNM*s-O
zbsUH~@5nNZ!;t^}`Zbyo&>;uWl>Ox+$*wL(Yn}vkU+<RD4gyDifg=fS)$F`{@j2*h
zXf7~4J9rUy5?X*l=r2H546+*ZxY9%7L+To_cL9C0c0^CtOvh9u?8~NxHQ%(bW!n~(
z6kpLaT~#HGKJZ*=1!^DScsfF__OTJgiMW%}xT)qZlcl9)(!8~dX1Rdp;k*M6UM=l<
zoC5*RqIi+;GOh18I-zINvk78%_Dhm_6C^I|2@<#UcrDr5f=!3yXckOoG(~BUac|qY
zS&_I`B@4kT%*hftbhRG5LfI@{gdTjXCtza`TE!&Yr9;zFd%qrVdIo8)dFZKV&E>w7
zfWehe7iL^60SiOr5w$f#<BTr38}w%|od6gRw>73Ti2OKpDRO9*ql8%wA;la|7#GhI
z*o~AXamqX_Nwh@SB1?o-qT;(C7Ma;0k+V$Tc$d>D9X5G?4Ek$E17W|o7m4O-7gU^Z
zdhX{a>=4_tse?Vs@~}pA4?9G+Fflbr*KNZzeRGf^gcQ*hpDtvIy7b^I(KSgKm91PV
zAPE-o1*Gp1hBl9##3~6~`;`F4V_QbJC!iWHood+>wj<|lWTWpD7hUDHxY)r^Z&=*c
z1|cA^SmUaPjoZ_Sg%=Hj&0saXT&sngrI~A=$ZyXYiDy~K4c^edJ>&hdGW^#eWO6f>
z8$``?Sf6Pccs+%O22gqzj=uz%I=XM`3g%T;s(56nVXWOO|5Hdl(7D4yFyC$^Ax8(v
z`i=$UKKy5kge(})M=KiZvTobNQLyJ2Hr8ZY$BssAtXPU=DmHaheTT+<^T&-_{d6I@
znT(7u(!V?`+}*(GE4r(hzCp06gL|c_Q*2AFk5%3DCB=6Xf1`<Yz>q6{1`N5wG2{ve
zxw<o~vn=t%Q78b#8Ibb2^BIU<0xh~3gk7dh_!3}p-s<SH$%aVXwE$gKHrqO*b*#F+
zKy`(q-%bFzztNO==|*|LUC#>-{u)kP0%AQ(rBt_Nv|53L<g@H+wxj`!#0g{fiu>WV
z&5^|{q;$%baTza=7o#Z7g|jZK!9)n`BuUaZNduD8Tg8)8`r*kLmT5?aO0hvSA8QsR
z*ivi{Yno-)ieg%-=RIJhcH3E9qxPmI`)@*YWE8RhJ@!dL(`JbIcoPOfgU++MzH9xA
zJxBktASuvlL?`IKFCtJ$hd^X;ie8Z*q#im+DQFU?$4&Eb%KjG|#()0){Sh3aTPdlQ
z9HF1e)X^nPC&a<Bqd8dfR2>svlQA(=S@%?fT81{LOplMPP`*AzI*X&ZF$k-}05Nwz
z5EFJQcUSxU2voKLuT|(%C$$TxL?BqpjKbQl3SN%J{IcSA)sA|#Ta8s@$trf#VP(#1
zmH1t_qZTj3%7356NwTwoD0Mk{0-$^ws6Zejw0&j33JvlQg==q?v`Pu0NcA^Xq}X%u
zmHm@_DEC!-;s0izsx1`X#2*IWh5@*Nb1W4d_6Itcrj$na1G9mV{GK!T;-eRb@}UmD
z_BcIg;171A?gjVpT?!KV0Qm7F06*$t-Q!05pq6S|n&o0oHVv#Px{Mvi(Xi|)RF)-`
zddkCBYSiRJCIXglnx(e!PV^ePwRi2B#M{D!{GR5p0zG51HQVuJN5z)px>%!@f(bZ$
zc^;*bZ#a^B7Z5Q|PjOKY(JCZtJ2+&g$nE<Zz%k%e-j!F~?I>S($@w*=pA!**E*#3X
zVNjll#2+#9QjGl*$mbPJ$Mt@LEQ%Sb(egwzx;BL(S7^-@uFBMT_fU^wk64yhR98;~
zV0&Py3H0xPC7cJ5o0m(~tjLrXUOg{uHE>a*kM?7w(&k1dwbc~r1>ps_3JY0`n`CZ%
znTPBIUlJp-Enr5!hyFl&IH5dV(StK(k6Y|;Bu6$>#l}=72G(TN!j>shY#N?!5<_xq
zbAT4#Bks6}81jPazypl>jacH#f?4dtEB*k11?^BlLR4bm!bR^PFvFzA2QX%L_1zcG
z{>dDCaSP@*3!ISs&S3Q6p5&>-#uJpqh!l}GW!^AniROzi4-!B-s{((7_!dVl1&sdc
zQ;qrMjD;JLMMjUy^ggjz<Oj(UHn|vHt}Q&FO>4m72}(|>R)$9!bV8eW!q7;!8E9}<
zaRYl~VtOpG1FGcChS-6}9Xl}T8`Luh7Y{+Wc+A)Xx?)NWku<E^wvRPildvV}4mK>)
zH#JjtTvK{vZkpUp`t`eO4gE;t(zR`)QG+R5nR_v~>H@>L;;Sn>cv*{tvxVT^mI2l*
zDP1gAEFEiLqZ35JIGXap&}Y3pG^O!0CCMysksHUU7eGF+44nYqn=d>%K~S0fIu;<s
zizrV)y5Wx@Lrh;mF97fX%%BGfPh$o_5HHdqsJ{dq5b@FTAP+cx;%%8(U`u+LSUk^@
zTv_q4>^L&kJkx``TN?Hi%W-|zGhJ-}<vIc=S9Js!t(TN}Qk|#qJvNfuon(pbc?^F|
z0IY4@7ObhNRAXj8()e}c$LInsr%!Otd;-<~ry%(xXk)#7QT2_uwRrk7CZnE+=FW;6
zZ9GA5iYu+PTzTI$h0m(bN!d@Wsfj@19YWeSN}6+$bXc7^NqUNzVeG=rK^JdG4m;8b
zRI?xmQIG%LsbaC`tY-O-E>%IvP@7$W%+<B(3eNC{#k}K8o9U@W6)ktGPp35U-qJh`
z+@7Q6RrefskW-L)_kc)_Vvn+#uL2r+{l;9lob5O08a^{b?R5~%|G0nHX@e!G!8g9$
zeQ`ZlLCw-BF%?C{re~U1Q+*vfl4oNodH+9q@1h(xj-(5}3Pu~VR%r_s?-#o@aeQg_
z_>8+-W2<K)w%y?X0kDcI7Re!5lC``2$9aW6{ul7G^rM_7`6B_|>&7aTY^g*=bX%$d
zabp5Ve3|(rx2fYgwmH~<?oiDI&8hL{lIzu?CcH}LT$g@eopyGBwvgNFlEQ9~-YioQ
zi<h)cw=JG-tB}QqV5E?8(;!5W=TqAbvQTWhEDy?H%6NFDjOH63j2VxU2<g7sAvP+i
z!|iUk-947u-ISBO7os7aDoUTX%)rCt@PWGtmOA1^A0LVbdqwn3OVt$D!>S2xf`-O1
z@l^#|I@fJeaU4zA5Nxvg%YiIyC0UwgmSVO@#e&6+v-JMMO|GBELb0YQzRq>-VNcf;
zY`CV0T~p&&QMvD1uA!KGl~fKCYt_#{v355UYZqNg@PZ9LP6`a@Yw)HeOGwV!#AYPh
zn%m5eDR6C1Ae1HFILeI-Xx~S`v@O#j#aWIk&j49nP$xoOl9HhCNa#|ZB@jxOiHu7X
zsaml`vUmnLH}90uOy7>t%r`8~4B}v}c_ua}Wtec?!Q7{&t$IGSUG<P$Wfp~|laZsO
z)K`@{IY%k4l^cu@`IJ*0TnTUYmJ>|rk6!Wc4Oub{D@(?188Tdpxt?k0Sg{p?4UHMt
z^Eku0Z&KfODY5BSNQm>GqNY0wYdf1qwUEtK3mF|RNBkd#!_UE5PdapLi<vFPVrcc}
zr2!-Gk5@Vgi6+)0z9>felCVz~DFKD!(>YHmB&MD4PX%F|FvqZX?uGnVWH3JN_T;oK
z(CPdLogh_F#z-5r3}4+E{&c3uuM64rZn{OfVJSWHUo04XI@QW_8nEn&(aOXd?NLCX
zmxQ5Wj?kY)q4l#igufhg_{(53>S+iWY)1RF8IA8ys9PK1PL@#R?!&r<$gIaFn61Ni
zC&4tncD&&hv4%4N`u1HqGMet_8Pc|RV%?%K?qfLP<8T1D%Qf>z{aMWWD9w+=pXDya
zc^h|wdm+w)3_hON?jByBahksb@bA|RE?oo5)SbGIT*OI*6=etRM539hqNu8gZHMXD
zPz?inhQYC=>Yicvie@;*15ZY;DrKsy*V4+^gv%QSFp*JU9<kACyI0#<*$5C{AM3pk
zi4B-)8j)1JLy&C^xNVu4CvDrdZ5t<T+qP}nwr$(iN!zw7|66sV-s|j$)!D7pSTW`t
z^Q(jGxh`qD5lx&0C(Z==EiaHpU|%}VyfPYa#RPDJwz>hD-LUw1#;Op$3AQvL*>9BQ
zTsc~~CFu#VI7@5E^}`-WFU!ak3u)we4-GM23RT~xIabGgGCqQUCmv>CM$04X7UBba
z$f@UA#f`+n1;}wsB+!q|-{}U9KR%Mp6$(n|00c|yy^gD|@&Qdlj#NcGh{Gq3>u`(E
z4TXS<RtDhJ&!CX4L8qio1nq^>-zvlZ6;Q~(cXoMQVZ^i2DV~<fF!m^dp_CTg|LTn(
z>cyy9+-34qmI$HmKyfm;vctQRmq=d;g|QASt}5Zc5*k0IZH&CKawo~<ANb&=E2?LZ
zp-;WNJkL04SZ}s@dz|=pB<-_H|BTUon9G>s3+ZJ(Nmb(Bm0^?DkNfuq`ei08>|Gtf
zR8=h_gD(lR-@^s}wN_w-O~~|gkPu3jicXPc;AjYUR<vx;`1T?(rGSt+Z0qgPvX0t~
zNFYPh8G|4_x;9d~O`hM!!IX3s6-keSYM;Yg_(ymlX%ky@;Q0>x8w)07K>-Dmy7&dG
zheOZGo1f^#=sT6`b_-K7wDs$%{^Z%8v+G8vmBmYhFHGOv_hXgE4Q(^uwZFS*6!v(H
zrz-uu;nlCIAy9*l9iuAcyx-Jhan?@imqJ|bGBM$k1kO&yrC&YsG8N1G)Zv&|EkAor
z;9RCp^@UWDuQ{iO!o-p<DLE}FvmFNMd>!?5G-Nmr4+zd#_-044Qw%PPG;z)x6zQ?K
zQEO3^lq2OL!YB$VS*7Jf@W`S}kuxw)GV$1`d7fyfZ<XuFYBYPIzQ@I>6RAIJ47e5^
zuJxg-Dq(Tl^+|f5@Y~rR9U=(3YqganQQXMNT7ab{Ci*O4EGSTy(MD+K5fg{?1w&<L
zh5gEJ6^TfDQh$PQ+(Tq#jShzU<YY%q4-ZpcZWv!_War1j<K`%UB~8i5D%WXNy3TOe
zb6aOV+M$wFW%i9P8LMIp)6({#_VZi&oNljHZ)T(t)M{jr6ZH%>Fj>J_>Mqpyt@+ai
zlx9`5taqdodan{TbE@;k6>nP~T7wG*VIsa@6J<c@TJ{`CKO69aN#KfOjRqF+O$^Tp
zM0e$=`4S{_<Vn?my=H=IQ;B=Q1?@<Q&PWb>E>n?t0;^VJLXLI5rIpJ?O3~nd8JqIg
z4@WF*e<VRUuDkYJU@}H%#L4#ycZU^sDv3kZfJj6_T+wI&tQ}JS@a`lcNj$>=Z+hr%
zabXjq>gsxP=6K!So_u946ivj;j!fnQ_$kUl?7V#fsJuW+7yUnwhGY3;V=M?nP<W#7
zE<drc*>dquo*EDJse(t#^L4~T85&d5(<VA~8Cpohq7JBkIvsVpGV3_rliuw%+B*$T
z`z*FuR=0FBhQuVzR#RnIl}2TW$JmewHZF4m%4IW*y%esFxk<Sjq#s@08ME0)UbJ^>
z5Q06dr?N?>o@|^Gf!s-k7YF#g#A2qo=zXZvy{tqB@19HYV_#k;GtUjgO`R1_RNcX6
zd9Ktpi!HnU4Ne<o$u#*DG+FK~P!w9wB$r6E&5k~^GT|yV1ko5^Ul~PgT#-h-N{=$}
zOG}|d39ae>u321#?Ay=q;@xp;&z5gGwenlSG&vqWQszeK5&<@?0}lapo5=O2mYh*4
zryO?+j`U(XXjz#jq-7d8*i`44V7VKYXZx5s(Q?*d6P~(n25nUnP*4PchbZn?+Kffy
zuH!UZ?9J>9ZMECwVSfvZ+x+axjj!n14;iQ}ggw&kh@}7^ZfvKdIi+EB7{aQ8M|rvc
z%<=gc`q(7=BAN>}wug1z7lm<h0o-ZvSwsx)0F;vcdr3w>ndpT{x*(q#4#)$C0*!Ph
zd&T^p4d&PlmmH8@;YPq1kQ@kBEpN=xC-Bnofo^sJf$SS>{?(`Q{koMlqq>!pHP;t8
z!4zbytX_+KH3jW!t`PdrW-Qu2RKm{|uELdXidl|yF?7BFe+1+lWb~!UYwfZ?yd{qD
zNkruu+I-R(JrrVW_=H-E@U*1_B_+iDX&a~FxBfxw8~8J~;POB2yT`C+j;$>~mSut<
zY_@0431g*KB1EXeF9)R+Vvc0Q&vsXuIar`7XXOya8hzdv=;dyIKAwSGa^&((b*smP
z!<;OJKHyD`sGyp$!UgLF-(_`+Cy3xKVA4If`M~&BjUG{Rduzm$ptL^=N)w4!4iSrh
zoj(uTwgVJu5V$x)yqV#+uS0ix$<>J9=_Y1HiOOxjH51XJsmXjOzcqrL&T6h;DwaCJ
zOMKpmzqvJ08e@5N?FWC2Mn1^l9VgvWKb-85`H!&btR~cU(n*a?x@R4c{Ox>QiExbr
zO@xp;vV4uR!;JguqbRKIqMK}X#ix_i+T%0J<ewV>)L=UNvN1NYKoKC~>ER(j%R#6g
zwhK+uNng`ASZMAQZ9?2p9=mO+riU>H7AAeW>=n!w7Lw%$XqCggb&Ki~-tcszpWpZ8
zhUD83$X0)$c`E@A6fQ)4f-{XYbPOLH>y|M>fsPa$|Dkj)T1q#wQ$U4V&ptgTtg|3l
zaI_F|24<d8>*b0!qx(s&Gn4sn?##m5dBFzU5+_FwF^U(v{h(0z;l>=om&hFA3Z%JV
zcCmV&YY(44iEm))$86$-iq8;m47j=%VdJxG*-HzTJ3mp1wNfyUqLmqiibt7$f330+
z(X3-e9fOLiMwK4?>2DQ~)x|M8_r#p1=meu3v#5tC44lI2q$qj$lq80qgN7ytEHx;d
z61|UYTt9a#5!BEQ_7bP1BY_`V8t0v6$k!u^9LK1x4V!o{8eFfvzy!bu90XlS!a~p}
z*Vl6udgn}2IW3nec~KBl)A|S@VA<7b@w29H`#N&Dd$s!gr&jm9DyyDUZ2I?&8NIb$
zijT|n@%rEt8og~%k2?|&ei#X-wvskz$&A=7Jtp;^fxl}YO!;|bk5!Z%I5=0XR;m;&
z^wm^xIa6oEjFv^Sv<V;0IOn7saDn;RK>afisa@r|F>mHnKnbaWV$8fE`c()9HP>WY
zHPNEd_@y!TY#^g)t3K(lz&8gBX`6XaCu+bI4(S_Ebgu~<bD5x5pLkX`LiWxEt!F(o
zbWjI37~JOjxE~P}o|yD-`o(J1Qnvnvr{J&pNN7Ok+mc2*uaR||bXXs^+-tQs>!SN3
zFL+zi?o2`<r;r1PAxgn$u<ZdhVuPe+{~_^yec3amkQL#56jv&-KFIterP<-^C0YA9
zpq%~n((5-eU$e0@Fk_E~WA*Q!>*eW+e^Dpn$9BkuE0n~V!LtKn`);oOWAKRz6csmZ
zeE*G<QC;hZVos0kf34pbj!ZIcZ?GP9F-_My?wO!wRrH|)?pRarKk*;P7i`Abf11}F
zh19@@)fiXtJS>Gb#EdS{Q|lF-MpPasVDKYsI7%dyt=MTtLuSEUkQawz%Kt7a$ZXuP
zB8)v-Kh*vG0W847fB!#!LUaG;DHL)(k_x~}te@+tsxDlmBoQyrEXSV#oR9~Y)Lw;u
zxpL1bXdaYZ6IONTJMVyH3*L;w<3TY5^BX$b=h1)FlMP&@_63{SIOaQ$c>Le93szzk
z>T*f&t;ttf3MQck+lykBE%q4Zfy9o<zg5Y)dnG`d(^=<5u793$z4_Lh(X#WRnX?&`
zXr!K<$Ery>EKSjo#k)14Z3cDQPt`@(zKy8?-!M-I7lS^|Wgf0DvN!j`61+FZmee|P
zEzdpMQ}LlTHy3Ap>d|IsUX@rA`-$`yT;ZBxC)JV677{ZmBQ4wYo?HXnn!}IPSo<oK
z`X6e&Uw=Ve4$4@CskcTro0%eyVzjnf>jjn&eDDG!kY52w<aI#ao{Swf(P_%I;*%?T
zF^WpP^KNRIyg?tbAJQgsuYyinsGP(W4tU0XW~g>qE%ios*E-?9tA~DURwiu0jHNC_
ztX%R&m_sp2hQmX=hw<0+S|YR)HP&9h^<kIOj%)Xu&70fH$JoZa)O+5B*|wP$Cg!n~
zAF#n3H(KlW>_IxEm+J?u4VXeHmv-UULk-B<<bxOm*R(Ne-5dx5f{Gkq>64^0#Z^Q=
z1*_tsM6|$FHfibaC_4Ox>?z2?WF<0EZ!^Sw*^b0<ap$yx4?YOerP+~CSj@T`c#Oof
zCd^1iI+YWIW|^%6*<o3oh6h25`ALlJFA;|ot*#jhyg~FAZpbZcsX8Ac*qfRqU^@v>
zbnlS+m0jFhghT^wOYr=W)1`%<YqClKwFKR%cB{@zza2RdAg*Q(==0bZXN2R>1Q*rm
z1MxdJ@eS0^;Ih86jDU)s_GQ1jm8F$l1|GT+4dEo0eI885EJYuphrQ4M-3KOX<yC?Z
zl**u{zB0=A5#AdbthhdFk1I7$=@4ffa|p`}mkio13^}6-`Zn1d#s<bD#+W8zp|**N
z2ji9C;*FYoH5zf3aJl?>J_6irAa1Dzx$3GTwYx_L3pQOQR^p2|JjJ+iS#vI(qt7cR
z$4Mn+<64RyS1yA}-6U2QxXitBkxyESx7vl2tBQkO4A<PtyapmJ)}>cbsx)F^U=lIY
z{stS0u_!Idr&V|!_mOq6eP<@ftqtI7wyhx7&B^rg5X`LV!>&kAuXqoR#FPLy))^a&
z%F9$S4m)wUhMipHa;R+($(^Y@!fhb&Jr;VQuQ^`(@sRzYDQ_?c0dYTXv;Q;Aku7SE
zE@v|$;-Q5s>?7I0oxSLlbDuF-TomyQI>lAR6=bzJX08(r*rsx#ZckE;hnFfb#ujZA
zzh|oHfoDf2F=j=SJ>!XJ#OR>vw5!aG^k+7{ttamwwRSt&VgY+z5*ch=hAX?{@TpwQ
zuZzAUK-Lsfy5tqI&xBW0-z$39Czji+BF~wQmjC~Q+7F#Y8}luN8+X{#Y|zt#!eo%F
z(0I=($A;6Up!PDWcB+VceBAKjRr4T#wt<2_<jfujKzyNG_x1ye&qp4>yHf+n-Gc-)
zn4N^?@UyAal#eeQ5)hkAuWEl+2>D<In)Z>q<C`EyDMCH5Oc9B~79%o`OIL5iT>pGA
zujRJ>@e3=qM0K>b(nvBGeB`+#uZV0Hbl$4dnq2p5f(4js0r-0{L~+*f;s@ys^Y=6p
zfS07-ong}0;e!;LB&0sYK7XTXtn6P8NiGWeLR<aVk*U9LS6?k{MJ<#MH|98uz%>|F
zj^!oxzQF163CwI5V`+5gp-<x;g}Qi>Z}!M;d+VNm0dieFHg`^o7C5B1^?0gbF%`DR
z`bc@6(@`F|f-h-Al5N+k$|prn*|x=9^rxnma&O;$=YHTFz{eHnhk#&cV8B<(*rm<d
z4z6`aXLON{{01Dq9nPZ|-HjdcQ^Af8azf;;4z$pv>_#m9(WNou%ZM#6KzsN#bAavk
zi$UT}`9mz?fUQmlEY^&x^^QG?_FzZ9vlV$yERP)w19M3S>7KCt^q&AgOdA3e@)s68
zzv;3Shq9}fPi~zD?2+Crk)353S*>9G(YasfG&PiCX{JWjQd&t{kL-Q>xK>*#rWnL&
zBO^n>5quOsk`JKD)=BUL1lhxLa@Xxg<$(|OF~HIi%3`9L<}0hm@61^RI%wazT3EUe
zOf6b>HS%3=Bx1vW3#N{I;+1m9HY$=`h|A05+)%Ye_wlz2zN3KtQOS$)sO+=J(Vvb~
zhgeN$`ojyrtgUUb@Ta^$rZU}vkKE>?DjlKb+U;(L)lT3fe>ph@tFe6>uJn>^+{`fp
ztTfA~^}(}HZ6ffcE?H7nl|wl#0wu6=?Uos?Gv`8YdIdWbaqBi~Sr#F4!`+HEe|d!p
zx=3IspwiF(#-USha7K#~`0L4kaq&i^M4^oE^#mIhsJ-8D#f%{+Cvl{mC@JllgD5ur
z0Apx3iBksEE&o;94Sld9iFdA$fu1Qb1EkB&?b&9|3int5@xDVbSrS()DX`P!D;a(0
z7shXflN|V*gI+C4rx<o+dOfU?P1=|d!nboWU>P&s$<$Iue%(9a7Fk;CG%;+5Jzv2u
zuA=p8NPo1`U~WMlTwu+#dnQ>k4YUMJx9qB-z7JC|nB*HH-vC-HqHtbG-LJW(b&gP6
z!{@hYTJ2XCAiBzJwOh|!_V~@?26Ej8((j!9-lm<et+~ws`_x<3UOfykSfhPLi8T;<
z^1dvqiJ;lKr5-luD8@^pN`5r(^7Jvz!*kPW&#Mwv5c#Iry9BGT&vS9!1cplGk|&Cv
zKnU%$K~=oXq{7bUe6@(QlRO51I4~oe6il2xp9>mIOd?+NBg7n~fFj(ZaEG4I<ux6M
zq{|4?HAY3tA1unVn-l`{vYOL%PgC;uWm|xvhiQ;Xx(`poiBBWXDMc=L*+)JSfqf=)
zfSV5Bj${6G4Z0eDT8CV1RthXvdSQ5=34ob&sxSQq*}^l}P-e_9`3@QW0(;%EBIwwi
z8S)7wP<wdarXyW=O>>MJbQV5=nc-X5`a&2`Yrk05xpKY^$L)jl#=sd!vx`)9{OhXt
z{JI9iTxuL;uEX1NQv|9?FHM_lqK1z(o9rnml`hH8%B41rTFr}P7Sv+T5cveBHb>JY
zq6xUM)8Y+B&7@HjU0i1SIOBWSj}z#++@#BH2tume2R^fC27jBVd~a6m2w3*V&trLG
z2a4MmxWp9BJ^21fP(A4LUT`e52raHK4U=&j@ZEF6oThZA#9pu2f;YN1OVMT(lACC8
zzme_|Y}Cva|I*ZKo1$I+wp8yroy#{D{cE>&0Oga>Y0bXCZnd<Mb4E=ThQb!8nkQHn
zb|!{;r-F1&7U>>dqQ1QJEm5XF)1|){{Da^3sJc>z2N2MwLB74?2H+XCV&kfr(f=jF
z${T7z<t|30n7caf<guhW3Iz|SjoREfD1dIxxLu}o@4|)xpaG2KDi82<1j^S5yom#U
zZsV}*{on4LsI_$)A&hF#Uc}N(gwi3@m3zI$6z#v+ouB;8I!Wb9wB*CVZc~bu!7>xQ
zYd37Hnta36JBk+RX&0K%N-a|`qdo*Da9b$eke2CV=kXBoYcW8x)ora!C)BMCh*uQj
zFp!>EMcgAPb5sC^Ts!e1+WGrPc7X~7d#a>k{JXNQP#if0AEJhcDAXyM@VOE{cZLLM
zsCxvB7K$4y;3zQ+NrSX%zaa8Jh%iOw*qZQLGs^DhAhrc<j`c_eYvb_zsb{BidueL%
zKV{~~NOHeld0rLj5d{nnRAYOA4MR>w_a2yY<!yRGq~v#?lzaRH;D?HjtY9ZC%6b5w
zIvty?z#80eFoo^AFJl60C3h?t0){B2WD@Sy8OVZgQ+85Ro@qLkTwuGkFtxSyab~z7
zqx9O#R^j>8olA5nHo9wQy}IXKEmmMi_<j2i2m6d}D`+F$O;cf^b|1d<Xg?9o_P0D6
zg*WSg-ETXwnn7zSy4z#FWf5D1h!O>nKcX}S>uYmXA=)*FRvfT*)&uF|A!VVqHQoLx
z1Tau`;ytJ@@NJt-+DmSf8j=gIlzQBi>lZe~*ASufch->xHgiBX(oooRU6yZdw6*!$
zGH1q((pc1Om`9F`7#gLFb!af02YF1qR@wI8s&2xR2i~#FZPhUpY{!Ahj6BQpzvl*i
zNyT7@fb*sMP~VbkxFsg4q88)tzFW4Bwj=S+JJ2kXj_5;FY9n{5<e?#f^(so{ne=>p
zB~lE``RiIEHrz){jiU|I*4_;NKc8HQ4Un_8zMHtXsm53_5V($l&o}q}k{EOB5aRLI
z#$WSxwnOZcq^dAXV4U6inJ%K>BIW7xAl`_DZhhKOr5OmHlvJNSJO^-g1P7rtkRjrb
zBR@3@u-u)pHq?%ToV=?S2+ngwhH~Xdj7*aZQ^-g91Y<K=U-KXP*tGQdC*|(yegyaL
z95zzCQ;qgk(j=umvo?@(-LP>VKp%-OCu|_KSdy@`?4tHU!NtaW0hSUQdn3=KT9jU(
zBMR4$L;a10lA^Q0X@~=V$*#zrnjsu5?X<Z$GUZWY#3~YEj>AMCl>pW}kgKFgXhIKO
z!k%##d_G3I0InD@8iF&o2w{or(1Of?``GRz@&9b@GQRPnsEgTh=a^*8`1eD`TP93=
zrn*Z8kcW}V&5PV=s$(S|YW7LR+d;PbPTq360R{`NRw2D5?SN;6`pO!Z@y3o8NKXVa
z(I1T+VDyR9nM{oJ5=Wa#;BMz7k=a9%b@(+mxTgRs;VYqp5R=+~exTjkASQ%w3B#5a
zJSSX1B*aj_@weaZ&wA2p?+`AuCUeru`XJOcln#INQ|@l6U=K)JRqzgiGQeDx;|}*!
zT4*hE2a=!b73xOb+aR&1UvV8*c!S~4wJP`ys!f1!xgza$p~)u(9H}djad%N}d$`d&
zjTXOn?&8%#!lA%WU+Gz9(LsDT#UsxB<;{Lbx+f<?`YumH*&CnTZ%4Z~%qPcneYe-}
z-8p+Z1ul<Z6#Z9*!Z7dtEoUnE=Y>V2&a6@x?Y&x*SZ}BJKogZ}t_E2$>>9G-*?mYj
zeFgwHNE)5e1nf)w9jhw4*8k!-FB=Bev8<op<>6}X;0|ZP$r5i<q9VC7^<01+FITT+
zW;+{r@wFwuoZoK6Z8Y0663le}df63460xSxR9x{I%Xz)qgf`Pus|Y-qZk0^GWgg&V
zH)WGZ**b)LVvt*)W$*6wxTpV5{2|f()G5NR|MMmV-uU*^>M4lsjzEU8nSkTAnLlhT
z$7UTuv$0&4uYknWA;<6nv8uf982tcdWkqT5rD2mK^V+H(intDSf`Dbs%I6#v$&!Dl
zVKWx|R}g@75j@}zRD)=p6(QfzPu2r?6|45Wg#J2pNkQGs(sP+QHi$d45-||{Hr4pS
zH#GCT40czzsBy(8cc}iVg0>ZVOsMu2v0AHkGQH*t$||Nbv#WlAIRizu<uD=5?`mf6
z*}USTV3!;HKJee}Q=vUWx~R^{4iKqHB53H&{hl19u~(k^svCrJH#`}B7V{r;N!HY5
z8`1oum={+YI6+rK_;WNU`nAB2-9;9@KprzTr-vSbFkQa4{(gT_-FaN*u4~($4lpXI
zTy?A}>OoYFG>H(TAAGq_FhkOH(zCBT=LimTYLcB11qGmvP;1h8>Fkdn1nKYtgTZ3b
zXQdiL8?zwFh_m+h3ig45>}B2W79l61=t9J%Pq8=<9eB{U=@7l?BBO)%a<^o(Ax*3h
zh#@j!7)VFSIPafX4hXvaT8xMD{i{F6xKdVBOytVa8>354R#xOWkvNHGYfE0L^)#8~
zJ?$@RE6s%M>%yv7C&b**+cStcCicXR7@t(>B(w9AH@eE3dBp^<hFZZK$3uyG!PpD8
zkhi))R>mBt`>JaI5q6ZA3Dlmy;YNUpB0e)6fgr*@n~|<xD@nAez{vdF?;k|V$^!q1
z1!HXn4L>#DQAZs08I)z9l>soyk?UV0`_nvscY&wd<;x;k`}6!f%J6RY4eC%kn}GJ<
z1t}4BB7wNA#|h#IqLdlO94l;RxlD&yN|CApi1B^&iyjTrJOu%hVqRH#_7Nf%9XRl{
zjQDbdmBGz`5FDab?<{@b<HLaD%f-1;9rO!>_=XiGB^L@K3cyVP1FxqL5yQtG)Vx-6
zGAFVWx{4DMp=3?e?=o}+%4*O`3ogeYx>ibC*O?)u3_GE4O9Rx%V1h(l9^+b-oR=N0
z>(yVQ*pnEMK88xy=&b|7MVPD7a>~(hRZ(PiUQF_LTpHJM+MCDM-~WqZs?SXPIo*y3
zQK5Rx9gtJ_)%duRRz8DD1*S$8_$B^JVg%6$>)l2c0S4$e&{jk+XfgO-Jp>n|#JOmt
z0|;j4iAfMRg?_$-Bn#Zd@z?HOPL5LX+fB<bcvfNuorD6eS3*91CnLjEOYUO~e-7lA
z2@tNrXM{)3MTs#)(tR4OfFoFOpV*TViSCR4{%$j?sW1_xVxuXlpi-PQp}&lC16$?-
zafutt3#-o{akw{oOLKEuxVq%aa0GRlJHvk9e>!9p@wcjIP;&jz(SyN?#yXqlx&g~3
zyhDxnn-wc&_~;0ktvssSJK3Hry4VxVwEpf;Xj3Z1SoU1NPIWG8=6OC8VBWLXlLj=y
zsl)Be_h|hgAJJdpDlgs|)`A)mFzZ|>x@AUVS;%@smqe_s&`Nk%GeJU!t5wTrBa7Kf
zqkD6e?%{fTs*OmG7UWe;*Frx3vf`Em=1xAkGOBMSk@CV@vqxiRW-WX3#5P5=i@M(4
zD45c6QL$3{hzg)`Qx`>p<IkpOV`VP9HQ?5fJ?~WN7P-YVWLv=18O&^gy`-10eMy~w
z)!GR1|ED#>zW-NR<0qz>=L_aZLunhGm#9Sw=++A|-WnR?(zDxMF`IV$s-{}*53|Ek
zXG#HFiD_Ij4IRkfdt(;YGK#e=XFt=;-h*6kign`-L_pmPHxm#o@bZ#-cIl@!6NF^R
zwKJ<xRBgZa4e4YWe!7KopZ$bq4fcaPwQIMrJ{J1yO&kPr9@;4lf5Z(P2oX!3`ng=~
zk;qI-L72bc90pi3*}VHm*tFN4w!zPzzM!5l5|3BJH1ijIG!>sCwF@$coWBnW7h!A|
znA`GHJMQR%R5fuQg#J!t$U^IdS!R{|mzWNORGz1)m4wg?wxZOS$5`_k88iorgmNt`
z!*k^qI|FGA;jjyhLdb2zEtyFiS0_lq44EgkO*+>X(3z?D$$G1(V+azhI)M!$i92WK
zO5In2F!|8!>srKnb4fuS>QxSDZL-izn((ghOw{F@ak{i07_J^kGw@ireXGK6gC(a`
zVn`64{QP|9{@4~a38p7slpt0d<&#GN@5%7FrAm{YLQjj&ECS5I`+T}3*wKJw<u;Li
zNwi+e27xbW2sN6HK^2%Z(mxS}PnP%@u}la?++acmt<G7QtW=pYBZ~c-Xqe8A5oO`0
z{`mgi03uI)_#vwl{2aYm?}(Ls4PDTZ6SI?38W6%=^vxcSgc4`19+wKkA)vM&Cw#Yo
z_)HWS=9z`Ol|(a@nZAn%7Y<AAI=MxPRbHo2HB8zzlr4X{Rl$vCj#|ExotcIsA8sXk
zT*13Q19h;chJ0-<EI7OdBh7yK&gpmTTNy8$^m1znWL{)Am(KaX7x{N;rU+*eH8Wx$
zVB~U3$vmHRhjg8=m~V~pgyhcd&Rey5=DM(E^2~`#S=B$wIL26CmkrtqUUg9T1>L1g
z*4ct_(K!UW=|yna8q&G5fP{krC?{J*X+dD=pk-AmJ_iJWoLlC@X2aZ|*g;iQfcK@Q
zp!xwPfwNcDx(8ipy>lJqI2Q?B-da~qJmXHT&KA$L5}hYm5c=PX%z)t!`tF<ALPRO8
zrN;T{!omAr&0W`CG5$M2fXLr=*<E>3`TgR|R-T*YK=L1!T1dcM_5BRLZ!sf2IKm87
zA!|NzTEwceXa(0UH-pSf@&82}-=qr9nMO?<(}T@MTg|{)Lx;_W+Z4lgNqB80(&^^v
z8NY>Bq>j+g@LB6Bcqulg8l>5xKT|CNFMU`nu`H18&8AR;Qt<V=lzNUp>kDX$TFH<i
zzTW$fkDhz+>Ln`xwI=rDVNL|bh6H`#MfO$@)@7d3D5Xnx&{=qrSKtX#VLKorP>~qn
z%h0&n41~rb(U1Z!|I0Z{24eSn5CR3juCbR@;h2;!h?HsnjpkFgQqNvAP?hDmmB(y~
zVn{shOukg+zU<oY27TNUcNO#PU75d1Fm55PQvpC5!##$+a6t9J!tdwPAHhlhv>Zoo
zujk&`8MxgP5BT72PPT3OoXFSy9j|8g(qz+GRlu3T5gH81x09A$97^Jd+51gS*((iI
z;b1>f7*K3yYoQ<i#L8ogHUjvn`uoDPEUK8S6Yk3|DU}{vFsA)3hS1c)R&U23{D&;?
zLU@@k#E@_!7rFAnM(ihm><lO77|hz=vhElHLWgUKFxJ316(L(8-46k{EK-wE1SRUn
zzEXc-1t|i~@7P33!#4^-$xD<)b2mtz<`$&4Do$!yP{rD+6%tm8rQxVNx77#l9wl44
zNp%GBCDTy<d=c7vPsCZ1i0%7x*9^ZZ-QoOT7s2&vrV+!Oyqk!LeAa_{!VdF^)Buna
z!mLZ#QCokTda>RgRP{5wpI;O(IU#6JdLC2WM$p2#y#oB*chDM-SID%s$=lES1mSlq
zCvacxw!D?28rwtV!ec%HulnzxpriCCh8?re^(dvSNvm16#kR~j^PnPIRN0WDP7eI3
zH;yv)N|2LCB6ie-c>SIeeFS+Mhxsn%@K)9%7%!Pno}0|~=1K2uWjJve&l@*bbq9S5
zHAs4Y9xYK~;z)ujVQJcwN9^BoA4f%T`_6;c0MRqi?4qB|y5-wx%vVTQu<C9?V>Z8^
zC_EEw4zlJ#%aZB>oLQ^vD&{pp5d5PZ{`(izPQ}!QP6dDAyZwWPPaP@zA}hBP3AAGc
zgH>8Zw03qz8pY;Qn#C)oD;S7fAjBbR1vWWlG+*kb`ih0;uPQMwa30gT+6oMi`&;QN
zjBstydon`@k0?#G`%}c`_uOg=8V%g*KxT`Ds)7opIoSPo+yMixdq9GG5Ttcbmt)+N
zSYXtkBNn%&!4+J>FLivWkO>%Ct8OO-$^|dxXfWEc&7LO(YgH*HhbQ;HvR~sJ?rw1P
zTm|g&z=+INW4c(qJ_qM-MlzgZ*qQbZw-tNQS$UC%Ix>Y=<fG+oDw}tcFh+d|SlI)3
zp9@zKzcI@XM=%}dn4;&LV$F^R4~uiY?xK@dg(lFmrkpB;6#)7p;zmu4QV9HEE0{iV
z99J-Pm>HU2(iMOTTWicgOey5=(bdw%2!>bPd9{?&aQ@VAPHo!S95$9GBvZY)TE{T5
z7)i`C`qBm%UWL|q`-@`i7N@kjW0{n4qJD`vFDtb2Angl<3-zd@%<w$5rI2h~zx=t)
z@>&W0BxFe4A=nApa~)AAB;pqVwmZ0(&+XortK(6d`>(g*Jx-23`+~fAw`|MR`>k;a
zZlEho6lRf}eirMq@qOMXlhXHftgOXSfj^-baNyLi=w={LZ#Nr4tiXE3oP~uOa`$vl
zJa2Kj9O^Bg9A04=BUf)u4$7KFr_NC?>m*{&Z1C5%o9NIE;dB(E&JF^-4G6Tx53KeM
z4jV8q755Wb;C(V?jX>NNZ#<+TG!*~qqk;%d|NSbcnDs$>bh*wD2q9I<`EsoT>gT~~
zPzfjd6wKzSJ$3J`7{N4bs<(UE{9?^3o0GHE8zi%%(qK>#;+cDKFp5gL8D@0vyD!Sq
zG)GZL`rA61Zg|TqY#7hrE>!Jv<eGPAAFlqD3T27_)pu*_tWx+OQxgkqsv851IhrFy
zkl_wF1ZLxKZBZ+RWtAC4rXD-^U!eV-fY`yyV#IZC=?tLg-XxES;iGryT6cIyZ!RuL
zC_L7V*Fh{T>Gt2#CR1TIJ~9|T$z!J2QrjWDR?H)A$X&qYYrYmYzP1l|q@A>E|6r@Y
zS7>S@A?eSru<%sVRn_o_pAa;%REmlU4`eQBd4j~qNNo}OdgHVxO3dYM7%Q-s4ZlbI
z9O69~AC};#=O0OvaYrZF1?&c~Zm|3Pg9r9NCE~94HqiE9Q7?ykN?Ao*$O$8TK8wyG
zlmE&u<g#SMlu51kCM=PSUgiDb$1B+*7-AUdEQo`05;5cwi+KhzGdTrld7~zJx{?vJ
zBNP*QT7Ytqrt++&QDS>C#%q+gp<Oh<*A)D4*&s-#ZDyb$3M*_xY-4|dd$Bo$&=Foe
zQH7QbAj{JP+o;`(mHBl*%~vVyhRtzH<>X|09u|80e96deIFvwLkwS=Xz8Vve9^rC;
zl9|J8C=L7@r2ebYBvKGA@17witc8vp_+&ZAOELRTX}u+ZQAlze$?KFvkM~`VC^ATk
z8%BXkPM~SOxN6mDi>U*wu5+hJJK{<-=6UIdcfmn&TBbD{v<Q@k`iuF*&E(k<kj*cC
zAXYb%k86rr$x9WMSnF>EiVIFIFzjKDhTLdSHo^=SulN-!sYwRxyVDMn(9nG@Cp_Dn
z+a5Wz2Xq3ZTAeMvb_g358T1lQ{I$YI8@8ZziJ9rKmu@(xfS5)mA3PwyG-LW($aH!*
zJ3N%SMdcq^aklEf!bTrY4H5Y1X1+6WdNBX<?#BGC{AG=!v{2r)<*-hauaqSbXSC^E
zB#}$Q$DyfFF0Q&Z-q-HIxGniscFP2jBhd~tM~Ic3{YE_1Hs-Q+CE(h3E2$BP5sl?o
z_j$%D;qrCWmVp|Mlr=qeB3C^zdTK3vpbjr%6z&UmZ(dIrAz?MXBQ?OQT?A}k%a{G|
zyHGer3|gB$>_~SwN}=T4)u7;{foA<;9V8o9L2g(S4N2hlRGUG6?lNw3UJ>xyr&8B5
zihTHOMmEHdrmWPc#_6D1e!Vwsq6_yYANZT<AcjOp2>7B7r^+n?jPU?#RTGhM30O+*
zgn~|;z0~5FEt6nqtKG-K$~J?tKjDjXIx}7oFOR5hjN@{<eK)WEpj!Hp_SN;2CO9qd
zd4x1YpOGBR#=+SVowtKyW82YF5=7`LR#im&v66swamqH7Di&trS+tY6_tT$^WG}Bx
z#^@kdtaoS2*3u{iaF)t?`2EaB+^^D$0vdc&{GR2Ay}vDyJqML2)nw^!c1Y}{w_0li
zrX>dOPU<0nIW1H!1m+(x!_+Or@C%~;y%JI24&jhz*>(jwuZ*o@&x)Gd?@j&ZFeg<_
z93oM?skVap84A252-?^>DzqO(4$v=JBp9H|ODFN$CPzRn#*ps>VLz86`=lRb7NF=U
z5IhUuZwk^5UjBtSb>2#tBdF_gQr}lyQE-H!aE-)-{`WP=lj4W*7+SCV1$9blsY9m4
zP+v_glNJ2rAgnTr6;onokKpgU@}%{<{i60Z6*|&->QTgx3(2pxgd4;k%W-FM;0at|
zm^1A_kecC$75@+b-fBOXQ7QO=`R6y4_rQob{1BIy;b^5)>nDlrmW$g%h9sMw%hln|
zgf&@GK5ilD6kYMiR<(YSEbvYuQ$%D$<*Z+N`CFvjt||bIo+9Zcf2oT^*Eu>VKr2A<
z_to<9Rt%9yZp2%rtEei6Fk>xk8tGv+-utT#>!<t#erpag)Ipj*nLsMs@#5f&tVp}q
z->Um3DX>^|$_j8`yg;FVH=db<Z4{~zE&${w+Q{T>WFFt7a*Ssu=c=2~Oj$DRO7>AK
z4$*|owD$x0946cdw6vW-?JLtLDYlT2>xwUc`Zj=m%+|v^SfbrJB}ol!=wc86Z5A;B
zbU2!3tmo$>D+tX#_bVaDaX!vs`#Iw8`3FL859Ien3MSuO`|)W?WcZEQS{=k_j6Orv
zznW3($wq49Kb?!`bgGCR)wuh#wN4kQ?UR<5Pe7|tm0sqFzgs-uM4iI6x4%GVuT>sY
zmfBM1A8Xh&s@gP=WMd6A_7>eilC{>3<#B$S>A#w4pfeUlY$z<&=K5b+$%?Yt#GRUf
zs_i_hrTjASR>qHIUA<)8^Ov<Yf$#UI_5SNUm|J!xZPI;lY6q%mzo@oEk;T8VRxhch
zb1nu@;-dS@gLxJJ)LA8ww+F{V2!wuSSfK=?PxUvcw`nHv?2k>NN5o?iga2;6e?=CY
zb{O;gxILn^1$w2H4)<1BfF$Wi59lHCK(*(#QvJ`(ccn+uj07**@1Enjx*T`=v7AYl
zno@z8Tr`~Thta}b>NsU&)}Q|fRGqy2h5-oNO8u@hcHye8=f?rMH@hzrsvkxYs%zbi
ztRtzXj|S|Xl61-|&Ua@TD8@uYCRbbiuzp`q;XX;PfI=f}7o;&H4gloq2{CYO>QQ!~
zqAXowMXbP*i`aQ`3)mY&^0;r2tBwq9chfjE83GZ-WKRAv)4fw7-5%ENU%HwpUI;-m
z9VJ)D=In@xnxfu(r?svai&^T0Yx%f*qw8P+)?iY-OZX8{4x!O;^@%+}t^_j!*b+71
zQj<9U)79;K#6k&w?jjeS$AL5*LP<i>oyBTx(A4)I?>I#Lg4A7x_0@}6<un<mt^O$%
ze4dmGy;&FR%eSdpZEblg6K*}>u9N*F3Sd^6>BL010cTrpNPi$7QYjVmFx+TUuP<7F
z0FYKW_vxLkYknuqnLxRDI*gZ-d~){4Lj2hN>FSMQD_L`lAqY#bG&|G>3&3;vy&d8R
zQ{o_KQ2U4kbR7wP!K5TReEx%%KO?lOz|!bb=d|T*&;{_b%IvH%BXxU7P+XYH^#d3z
z))T)Fm)k&93=K*eX7Wl6T&;x^tABBHzfFUg(&PvxtJ?Im%|X~Y&br05EC9ywQHh%^
z!H;L^Y_xD#mic1lxbfiJb{+{1|FgsQ3dZX8&!>sfjc&GWH)3Qb8BwqA<rddySoomu
zwRxz_rgdjc3B7iI!~}GD|EQz(AFh%anc$8o6Cu#t>C&B@?QeE$pRK_gTU+1Fqsxzt
z4Lmj+Z|CX#L#l6V*dEWUgTo6vuV5wakt&o{?iW2au1mw&2b9&9bbpQ$NLJ>Zks&3k
zs^7~>X;RJ?mTlnMe0Zb)IK{$`9M8O2y%@6HGvzOPpVP3R+o2C^STkK6I_&omy&*`p
z?01;qLB)Tqe0ND6m?7})MBtw52YGLxP1Jc+oi97$a>t8!U97}LduG}%(0@l3;v65`
z!FIi~KsatRP(e2vy}?sdVsK;!{_!_FvtKp=m>N73?&)E}j=bwxNsc_17NX7I-L0$5
zZ29BGMObp={Hm0T-g<)sn53j+YXmvh=P4#>ExzKY4ttC{Mb+f8oZ;?+g6XAt{j>uj
zkdv<$_)>xnL`37jTp<e(LxQ6x74&o2mPGpL*NofXnz`I^#+oP$3=@lbjDV&erTnf4
zGwRN$tzSx*)LcnH$k2h@mTLI@1fs&&WGn*UYIjfprQE0pIs~tu%m&>JZaE4*xtIT7
zh=ku_S`IuI)ATuL`!^fWS+#bCVkEFH6$i)}kXKv5;tUfPR++6{cIRxUqfoP-+f^cV
z1k+~4??q6KmSj2VOxPxPe;ti$FssdAC~8Q^(Z3SLEp2*552No-fUypOrB_FvW|vRh
z2S?|Ubb1BDNZDN}kp!B>5G~5|x3Nq)z8MLZNN{gaVsCfH)LDe@HR(z2#3S}KlKLE)
zq)diRHO)QO32e^UC>{vZ&Y;VB%IDHkgw+ZNWNS6MziCdOlLT;1vy_wJ%*^sW0FuAP
z5i~#bYWvE233^x9y+yVS<3QzdSQKd>ic*)Wd<j#5iwwxYLdW{WjctAUpfSE+uWP;b
zMyDD!r1flHfKOTzPc@AlK0epu>K6CZbxM)>3y;+SE3?llwdkMaWt~)MIPz;dMJl=g
zFtEri^^oH-Q2jOI41bu|&NMsa{tk1lO?wP^=^F+;R}sM+M#*wLejDyKSLRwHm(bdj
zRviISE`1Nex%0eTZU(6x-<ejCN8Iy&PTE_hN^EsDn7FJ;(T1@Xw9gPv=xkntJII{h
zWjNJFkFCOlT;mkDte6z8k;y`s_!G5I@+lh$Zde~d6kN7$wSLBxi{1Q_B!io{ZCVQB
zh_?>)OS}M6&jeKE$7q=6Fa|C$RuI3|<1*ls7qmJ~<O?5uMx}2^R}38ZJ|_IM*i%O*
z*@mA*O-={k^5x5eT8d1&1#Yp3A|7HqHnPsn381*a&%Mcx2TNV!SM<*2IdeeHmzLd`
zIo#6MYYJ%;t)54nc=?e+!A4DF`iQg@drdG;cADDJCQ--{RgOLnF4f4!sip=)M>U*E
z6iMX0^`lu8dWW1-b_O)nCed1*GM;D1m0@rNrn2{j%32@7%4`IJFqrAE8b?uo#2ri(
z`q6f`9F-{i5k<c}=X&o~!KIDwhlr;i*FU;{$yE)yO_Eo$KJqG>8(11J*5<usuood;
z2GdpBP#+>hccB$|F>x#}LzD*&&B57~r6>PR5r_fXe^e3_CU9{i8DG8eNWa<CByjOI
zH`w{WsK(FBv8sr_d~hcl+@bzyWXXb3jq`2~@!q>`!14OOz%S435YO@B!J)bkYvrd%
zSX*&q=>?`kJ}YgEP`-G}dL>hiybJ3KZC7XC+i<k;Q&$cl#*&<*6t1;ccj8+O^@kkU
zUy^r(&`kf%YCA`|TaC4|9B#f-a<py(|0Xbgb>P$Uy$R~~*k41ncYJO`eM)3V054Ld
z${0JDsK5~WsVW1%YSh4&VvLuWX2}RegS9F5A#%e#DL0J4GjfLmWrV(l6T?x$192wk
zul=;IK48v2a0@z&FbfZ%D7ywzKrCZhl>Em*T0lO*K^UI+SC&dD%9>e}R>Q4m;xarG
z*rypgA{qsNfLwG#HNwW}{rpyrZ>G#7lW+?>L+%qyI0@1*!9udq4pUOqkt7Tu^4UsD
z2xIw>V8qZ*E)sw)7ydg@3*__FHPr*cF(D$!h?$@V+Wn%ZmWp6>h`1b?BuG3>^lJ`$
z*iYyW21Lya93vH(kxJ-1r}9Zj<KI)<w@9QHr{xr4b%d8sW3XZu7^*sRtl*3;ww-mf
zJjYGn*=hu6nzANd02vi)agdQwt;DG9GkPySB}Ixj1lIHq;G@N=$qnzvTY}=u?n9?Q
z@ZU8of$sy!&kzBPw*)oQM-@WI%`=bPvxB%pHgFEm2_fN52Zn{RffF~MPPM{3R1#NZ
zWt@34hu+B06qihU?J&_l{K`-T4wvV+qZLO;saz!@Ny?G~MB!&pfz-3-%F8-z8`(^g
zD^uvk4@+dotkY(D$dsu=SEwp4)S5o*-Jjpf=Zau1v5SgMch8^cQ47XhGqd94M-b4B
z?3N>DxZ{NsXp6UBrU*1zoN4?Xkm<?x6Z6n<=;&SaW(JrE?jw=Mf;q0aJVKYGgpGc<
zKkxG5B3Z+7=G?y~0BC?Z9SrTbw9oCv=^N%mBd*ECLKD@tz#b2<$!5S0tJDC#ts50`
zlChrow=Q0+Xm3Stvvjin>M%zx$=mckQ^D@<s@<}6%WEnAyYHO6C#I-&X9qhFuN`jo
zbU@j$C|0z5e`88^a)^r)0kYroiNEjWX)ZOO$$)gmSSobG`slyyDhN-<Wvn4L(ax6R
zg)Fa@qLup%AlNd<<dIk1+^`M=rSHSm#)^E8tbtwXcU|wt->2uao8a}=I}E4Rr=u?m
z)ZK4~yJ_oQe!VWT!P*Mj6++xU_Zyu85<tjP$Bk^|UAEn@qyn%wf8l267uJPBi|spG
z>8YbVP1V~+>ye;R=X6Hz1Dm7ilO5y;kS(JC+F1Zot(FIbSFI!0attfp|BRUWRMbU7
zMqLzyQ1NHXC}P=U4wESQxyZON?p9fuM(u(|WU|ebo(=<Pv;m+V*LPh_GsTVk-akIg
zIxq`hml(wIl35UU5RoH9+(rT}&1xAGwc{>n&l!c0##pV}>p(_Irbx3)%7CBEyZ95Z
zC~ViFsiX~V`gJZT;Y6XoG{OmGi%EWtL(Mk-vCxF?mz=uOiwU3kMZ_u+HNNG~awGmG
zlDOwX5uvCyHIw#fgrHzSf38}b;&{0OglMtP=fL?-IlmX*7|rRF^;M36Y5ML3FgOo-
z%2(a>jTW@7jN2Bp&I}-Og^K+PIaM+bwC<F@ufSjuhreKB`n!%8)>L9?VziFZ<^?E3
z*`B@9ppFt6v=z+Cjtjn05W*X$MY-Q(h{fM`oERX=19KEOp;&R_PHEY2=r)^RAL#lC
zI15tmT2(BsDx7sqln`xz$%s4-*ctNXb`&vpk8*PfI#e(EoFDP{Vy#{)qFi4=O11pR
zvvL8sw!-ts%c{lxsnKTHh30Yc!&Qcq&M$kfP*tCwZhj-cp|r_dKWYzePbD1*?zX2A
z;67AollymV@&6V2>ckjtNvh6yIRNQ(ICWBRj}|s`Ni)QTB2U`QvIQ?N^qzLDiQ?UE
z_Y(O%um$p=L7)?sKm0Zmp|i85#L?&QbAByAIadupd!+=JFQPFZI`F_xlR;t9;!)M~
zwa)-IOAt6gU~x?32Rx&lA4l1N$hMt{ZF7BB##}Sdfm7wIP2?Z159f}Dg+--BMyFu?
zTtz6Xm=pbdM6inr<MNne&6>&^&$F{uZI6u)7B-%YAD8bIdV$TnHMB?(jZ8h76l~Q|
zys+8%PW+CkiDIRyivd}c8lmy-)*)Wjl<RTe@1fvvX`@Ur47oo!1i6m-=ZFvy5BP`V
zQsN#Ey!``4AiTYaNq$?$y}sfS%y1CGrJvtjpADz081E!7!zM)Do|QM<^d)+MTvSpi
zDdA`aQF;S@`q;kQh;qG2!@)mx4}qy{XahSMq#WOF%oUjU`slj0X8dhPk>@&N3wW^|
zI7y9!Rf<VL#5}ZI-+X4Gv>dd@mDDQeKJfpEhWsJLeLgA};eS&eglDv@Wf9=$9=-C9
z9E4q08`gZ${#75_sy7CYpM#+Md?yIEUJ78+y6~s<`$!D_#tgMLBXs6%o*xh338tlZ
zg$Kkignylgv)2<;bu}R(&GDl5l2Asm$ChG`<VoQEK`-A&`pD)Fp0}NQDlQNY{;Pmp
zLaZzQBhnbG7T8XgBUj@5pt0qpxVgfn3n94mzJGD!bckkO6nWj}L&#d)f#tCkt?|6#
zT0jI1r45L1`ncx|FmI!DikmkuRu<5KCR&JA{F!{b%RVi@<sVRF2}+|jA5jt^xl&o2
z`L*2oq}1CT`#!UMCM6v$(6$Ys{3|d@C0AM3zP~%t9I7SX7#~cxpON;U)~Wdx@&vGN
zW^+*)nRnJ$d`a5wO>Ad6nD(!JrTpz{AswOloNImH+Zn&{a(%T#nsS0NpJLy1758Xt
z6t~%&K^0a|#ETK%HnHg39SGTXSmYyo;MQ5J+_}MA;<){|;f9$vM)ZTyiR0eYq+@C?
zu|(}3GJ?j+urQo$l&P}QZcVpl)UJPqWjFWidj3W}*^E4x!~@{obbCXAH!SzEL$wm_
z6v+tnhd;c44@d&n2b|bT1$v~q3}mTUi$xILjZg<Pm}8&Vr`IFAxFw-$Y!FlcO!yPc
z){R^S`jZv3+X(SDEC?Hlzer#mOE`OTq$n8IgY9(Guf!hpW6oUnofe4so{1jCu}G8j
z-Vo9V4+)(jkB~;~&ygLf2?%kZ>Z4)Q_c!i*+TDsN$zg^(5CHXbAl2^Ot<7I_MU30-
zc$!1y|Bm|z!R(Ta!N=-({O$u7Y$6DuWlc4lkcZW{rGOzNI6l6-s5w<$O3I|>ko1%E
z@f3i<W^Mt?GfIimhd+;kDexy&^dKZ!T?J*Gg&f&oRo2+(4?beJC{Om+)RaNiQ_H9}
zfnnPb-ed)fj|V>yLDc%En&|sC6Uhw;CR~8jGh%?LleEkUGqLe^CrlitRFz$+%qsr(
zxy0c2pXajb5TB(t5x;bkPn2w&mkwmKaz4siCZZy-?E+-BvH8p`$j~SQgVl1NAM1cd
zm2y&!tH?5or(j+yD<~hKDpa#il{3*7U0hCv4k1|2q7$#wXKIWBgWqN7D#%f~NDg}-
z(buS`7HN(hL8RZf^eosgZWJ)%2M|~a=!f&^2BIp$RtlJr0L?=odRwG^f8ul>qkH$a
zVC7T}Kmh`&G72?)ngn5Nl&Id2j_S*QF&8N<2mf(@7Kbvb_YTVm)PtVn?M{xnH)e5i
z!1tR*$nX)E&%AA`H30fA8)QIHqTI!U6moQqkOP<s>=$&k)H6O_mbU&khd%<UBXMuY
zC&+Y14(bjoS>2ako<5*lc&u1&mv3v@OhMw1;H6nMYUOU?3L3nleE#UKX*1#<6}%Kh
z?34vGvO<1QdRGOwAxlbA)PN($7{FezY^+H@T8KGlBh$m5H2;(L6BP)q4T``8<>v;4
zvRsb{U=7##^$O06w-PjRk>8S&NV6*A-+?jvP{1KS{VvAFLT}T>fOsEue*k2m%vopU
z$xU21jV8+YkB?H=-3pn|PA#(W{d9wAn$tV>2<+nU&|&AWB~&KUkF>I5%~=brGG-QA
zvTdB^q>fqrjNvi)QEh##b;TgF`xTP&(xswmuPx)c43iZ`s6WJZZOtAV#j@qP67<Py
z7DH(r=Kle(Ku^E<)IdACg)Upw@o<${F@!;tU8Bm18Cs#pitn0}+$_9<65DR8Qehh(
zADjZ)9CCm4wei$;%Im^|>nrcCxHiWzsI3oNZ9R1D)pH%)(=8QSRO8sNnTb7(nwT@@
zQbH_Zn(V=Aug3{b+lS@|G`+vSN3UYWR~bIq`fQaLS!~kTsyaJqO^cl$G=su^utcw{
zuE=BH^Zt;K8M+Ec!x~ZR5VPXAL4W08k`<<u(lSB3dB#y9EcQ(uX8&YBX8#4XUc)`~
z<)t&nvrVpIi>nM92KTV1`V`v^)0t=c+_TjOyu3i${Xj|7GJU-(Okc~E$WCiYIzLn3
zn`cscDb?=E$|f}V(lt6m$NcH!=@@x2yBSLY<tb1h*H*l2R4$?79w}JYQ&4G2?@rMw
z;M0OJTGBO#H;B(X&KPI+e^DL!+VV8p^fZTJZWt;yC;%^tX=2T^n8_f7$EA;sIDO+S
zaTY|N;4Zk`%4_1ft3X`^`P{pT_6=eCyXsn!aJ2DO`|;?PG%PP%;%3nDF^(hDwV^bt
z{3Q*m%}liX_xGSMEMDM#Eo?lny;S}9c=TJv<Fq+FcG+FHACAUQV`(4Tsm}7@g<6Gr
zu~U`e$!2}9+27&{3dIX)EDDPhC-A8hu=3N+wX)v@Z{?kC&ATe@b*oB@l}#_Eu3$x(
zvWgXNp?-c@fpPbyIoLzCy;%04RVPWw(cRavxHt-wjV{5Pn-|^OviZ+1J_lK8a}rYC
z%d`3OcFiDk1P)!&k$c-mEBD~i*EE~PY5tnz{9ImFdQ-H3rS6xU!cdQ%A)kcV%J|<c
zi35KB%ESTY_Nat)u*#f8HDcSEftgM<Y-pZ_J%<r&6Y5c>Se8Yt$DIYIVZ$i2llSkQ
zfR=N`kq42X<qfG}8C!8#sxC@Zc9udR>gqL3M7p624TOv<kD4U769{vMy}~@$y~4B%
zg?Y@xhT@pm@HK)R-*YiHR8`Y-oxAP^d*|veSF*=EUh;vGD8$7r|KjYiu!MM~tufp6
zuxb+pau-tU5<>^UQ*_OszU!`X@EC$N?gdo&orqPa!YPUv2u1mG8A*X@9EK#x__Okt
zc8rBb=p`(Jh(XCXefBSkqU)CR{Nqs(tnrP4He~emHxAtpvE%CkI0{tuZX!1TAugl$
zYXX|FuzcXy$Fg^Ilm;Z&jMK|7CT!e*drPtn88JT=Y}v(UV0UT3!ZPq<7N>k;bjO=G
zEqhn=M22OI%OtPuu#b%A0D?quK@}mpfO8q+-;Vq!M^U)3K<>eI@d}l{vtW<y{FE%F
z+m>o`?5Zlq2IUqes=}~g8?ND4w(f9psJ6y}B%(pkB(cu6LFB_UzLx%ILh)Wz*@C!(
zjRRQXC0R`8qmpw;NJ%q#NgV8QB^JvTrl_)>bZwIWNmXVOxf1}f1Mo)iB05^OQ7@KI
z$aU>ZMPR*W)s3Xt>V0#nbGc#LuBl*;Gl~sL73?~ej+w96Ow|lWu^yjw;q(;!z$2cD
z(}Bn>wqR=^;60rMGTv-aK)JLHNZ+F=M^D<^K~E$TVlO|p`)a{xk7z|2i<+URmFS{D
zTr?%wClcK(up^Cnc#S<gG`<*K!D+MExoUvC`{58I1$wW3koPW_vt0G>h{wamlY31O
zDw`<p$1OqWjTQ?nx}=SGP14Jw2g)*QSz7}@#=!zWx@B=kVJ`M9&aj~qAG<0yvCb5O
zGU{8d_Q(@%HNavxZKcyYna#wJ5&O$k#3u_nA`<zUq=Lv13w)oaGNpJ!U99hPuvPau
z1)I5yy2o1cIID{dkn`7uoOONJajG4M=%&R9)v=|4dCI3QCI)k{?kT3H>W<;CRZPJT
z{_0v^S*4aLAQV`XyE^l=uLP9jd=f(>mbi%)7fBfLvr;=8mt==ybYA4?`v*^1K=U#B
zK25=omQ1)rWkgSFTEqo6zck1$Z{)?*<5O}KK$bsvFp(kH6O!!XF1q{i{kR=wiL3e?
z0x5k{v4N5s7?LQ(mddCBNV`X@2ktOi+;zMg^zQ|Nw|pV}@n!8w`s2$l@8A9LMXaSi
zzR1P&$Cm=r`QwXs^T(I6{y)A*Nav3)KhN_pjxWc5d=XSK<3GN<ijyFWbNEicu77-a
zktEqO=o=fO?>|!>j{o>_9$)kHJPx9KBp1{lU&<Br$CvAAK&O9vAxRPjg^Br(FC^uE
zd;!<lKfd@W|L0s};r!#vJcG{paawf00Up6a5&Ppy62sI6B>dwGEY?51@Xtw{&C@&Z
zW8dP88(eOmp(Dx_(<h39Ep9p3po)fx;`vzfxJ8*yxT~)=H9j`QyH=MwXI`N<*N0u{
zu3nyYl@TH-PP?n}wBzEmOJugp3hR}27dY-l<23=Rj}TpJpk)m(t@3y61G|mJ^4UTK
z>G5nuI1bMi3QM7{tbh8KG=yl1x6yeTPk^&URv}az&~P?BU6pL~o3la{s-AwEwZ8!0
zX0VVyPzbT}W=s6A@u~2-?YzWhu~NHKmc6f{VEc1XwE13&Qq@Owlg;^WHd=i?xb@ze
z=H#pS)!u*9Pd(hLfvR~1wH<6T)xic~6gw7IuxaS7$t>c!)>kkeKQtH7(utw;4lS^}
z@@gQB%|bVsk|g0}h}|kEZ@F)1S=)fpJph!>Jah~}*L0gQ)5Iz>DK=E%V&eE3R+(W@
zOC`3l$v^a7V+aebBrPmqZ&9~voJ<;yBXzSv#UD$G+Hv8-HEy_gfjd_LHY^Li4d@gl
zA;}?3q!D*3?*4GUi92p3O}7*2_9C}Df$S0RSc!O+K|p;0?D5EtQ_3L@7-iFV9x~*C
zPhiTUNj`;*@BYJnhrV)EUsGJ-=vZf_f(_4euuE(g6Wub2sSrao9x^Mibk;0yT`$U*
z`8X<kHsxyT0S%T*x3uK_-~aRfHhumCgH_@6MZ%O5cGL8{T;~W@t!KHK7PW(grAtGR
zWBasTy!AqCEaWh_<lzmh<0OqKmrGiL@v@%)!KXo-26>S2#tP2Uf<U8Q%K2P;AQPa)
zS;H0bp&*2ZzL0g@bT#HVSn+)m8_eO@V~&p%O;J5ZC5Gu3gRWla>MOkEYM8J-WF=6z
z%~AUZ0l`)lz%HKGy~c=1te~-Srr|m9jR>2UGrY8r{7RG(Lt0v>$Vmo>kbEmkOBLTe
z*ueU7CJT^DN~hACzT%rgV3o$4mGGGmY^60(l|P`gQw<J*_lpyF2Z%~P*kjL8G()v5
z8!Nu$VuNcOyN&~HBEISy4mbR-k=5eCJEnC5Sirx$pNm=+&r>Q?RvzVx7*>lgX2A^d
zr?ZboN_j%8^;uh>(jTy}hlz!02fG#djBBoESXgsh3mcwKvFBMTR$N23EZ1VT{-9~e
zTj6<iPF}c6uDCPH{U$-0QrtMRET#d0TX%O)5y6frp9ERXQ(;}_BEF7id4nljw*M5p
zjc7OrX2-@BF>Yv~(o$a|?&1o36)@N~MDhR_f*>I$`8?%NwdkvKvh6@y&1kEb(s`QR
z1#q<uW$JM6tyi6<d5l;(!IoxGpi|`lU|E<j%QCs|*pBtc6#$6K@2<rs#flSLCZs`k
z+FhdXm_U=d8bj7xt?S*;8;ew&_={J<HtETD^|CIPw5*^Qk9Q+0_|(2A{rUt3`rDbP
z@z*CsthT81$!}+^CVqV)8xh|=`R#03lTb=J<%&S5Ck2Pwr@;cZI)U}3?32ZVlQdvk
zdJ0sDa`zqt)lDT`zw+KOP|Ym9`gRX(k<52luHKY05p&hE(drm_B?c`HqvAzK4jek|
z6~5JnXl=*j)H@`p-Yr@6>ZH|upY0LE*1K4rfVe)CbAAx!8wpu@Hu^PK;8o?&fqJ4C
zhR+O+ZI4^nAgYR8+o0Gp4Q{A5)rhl!pnCO}1DDcDE+t(RWJ*$Zc`QUqw#iLH_bseA
zRKbSE8Bi*?m{Vq{o~@}&Uu6^;h?J_Ifk<gDL`nc4yqD%@VW<|GRlzh=)1^qg{4R-<
zDm%KgmtRj~c?~KZ`xnTEitAC|yl0yTioTE1I1J%tm6bO8Ac9fM!3?;}4iCLvBrhsV
z^AyNl$b=Whc^*IpV3Ej_-(Ak>od{l3*Klk{RWWf54;!X#W5>2Rwp2oGt~oZ<9&&01
zkZ)C4E8Ojj)EiJURViGnXyJQOUC37eV~YetW#SW3<^El8CJ7=ITm?)l6at264i;bG
zC(`v0$w@llungA7>H`4A4py_Y9j+>trecM=4mJ#GU`Kad?5GM=U0>B5`pBWM1zT9P
z%8J#smZhOgtX{*`n|-z~z}zOj7Z8HPjE+a+Vma2|l(a&D-?V!b?EhubX6dN#LT(7Z
zB<-wkFA4i3>icxgQ_7<p4h3)kVe#Ax`LSSAJYH=0v@X)=?FgNyiZVvps70N$SjC^t
zl%=VJ8$}q;XpP#b=F(CN0A9vZ0mqdC1`w{?M5QP0li$u3su6IXuya;rIwOM;FG&%*
zj{f}Qx3gulHzYhhXlSo3NRJNP)64<g`&Q`Q_zuOox%2HL)XLop^;)?cQ0Ie`%f@-T
zlUN$xSS(??9PhYoZ}H$vTqOFgL2>!`eDn-y8*|}&Z9~oDu+xn1UO^E)x{uQWsSjtt
z;p!;2l<VGV%3yN-_AeZ+*B2=Pl)Q1l{!}EEe28kQaUZv);mp0Qpo&fD@qqz@tIuH`
zw0(UPi>C*1UOhL18gY+3*ES>3V48RdCZS({y9aJ=&Y>G4iA}geY!g#r``B<jjvY!E
zW~yPTME98PT8C}yml>_UfvI0KJQ(^Pi`m~*m`fC@W7k#)HeA=i9=9~Cd%EWso~QV_
zJ(&G>H~Y(Vybq(lsHvyPUzFX4!N1$+*5>|h1q;UhZh>W{{!W=*hJHEml?lI7#bD%L
z*bjtu0YW4WV0J|!%GqBZw~@aoM33$oG?@4g^Hx8Y_!p;WxSoG|xg1RVy=HAN@%Q_A
zJSP5Ht$lPl%3$I@XvrR&S9-m!!I$CTNcP~o^2iS9!Fi?6qz%q1-&{}!=av0T{{Sc4
zi+y)+UfIv|58`~kX_p?V^U9%H)|p{Bw#{6u=)}hcuuOV}VqwoSsHLdP_qli2J}e&+
zGW!-TEYR-Y!E*Quj9L~~GzBZJu3<wrEbMSi!4}aNwH?N7;tsAWySuK4<+~5h6{x7E
z;|dhrhu=!4$*tX1I?pe7t#rO$=Csl-(#vN>%y{Lp(yn0eSXtNx29K4+TTerT9-T30
za9BA^1a)v&S)8K5VddM)<>0W=Yt{ybm3}{uz!ui=!hUob%HXbYm~uThVhxgg(2_kk
zV)c4mgF)@#NcP}}^~jXZ!4a#^qz#T(-&{}!N38u!{{WNSi+y)+#M;mF58^yHV%?!5
z)}gzL*t)^FVRCFR-^T_eD)v;HVMWs&S8*&)wKw=<t^RUIowqu5o`$RB-$2;#NRsDq
zZc*J(b*woa$A(K(OdOYC&o_O_Z9;vr|KxeAJJrj}ulDb2Br3b$WR{^<aTpRWP6fLM
zI#1)mE2#A8!x+OqFEYe|0uwPvZw7uxGm#^G3_eCg2mpel8QC=O;Wa~g^cbC-becOk
z85e#yGoEE+!ZYOEBqS5*+92h+Y-B=mehqGfkZOvOG`$gSPQfgJ1Z<GCZJvpo(*)5t
z3^|$1IigdNKW&arW_ErX<va|736Cg8DNo`w&tzw?M>5V(0;Y>9pIQw0+NzI^ujDTy
z$b1DKWH~1+2%$e|JfBRFrfAk!=E9EsoI|Q?baL|c0!?|CfcwxTf&^@wPNRU55NGoQ
zx&UM0X%<If-cL@DpT;xc36(}9ghwKN9o}Fn5^ph-^N2)wHU=Lrk-0w0IZq3ZuROjc
zDMKlr#W}}>QjvNqj>BRCQ!dha5s_Wa&!4vP<mJRGa)CGB)`~24Cnw<PRAvQ-?>aB|
z8B7dJd+lB(v+Fg7J4V?&ONvx_)tEEUU^eci*%Lz$elN|h{2+uB-ASC~nDH>Ug0t^G
zUYv_rxFTUT77t42(}*F$W{^&A?#+S>az|x|K*uv7Hbo;-5=A`Bs`*)!s_#OKa4zx+
z(g0phHHg+*e|v$-*A2^*&>W<r9{W@Do@aR)&>RJl@mTam%ECOFk%$P#SNJ@RviXds
zwIGl%jIYBWD^^3Z6D*#QAj-yaE;w{0EgLF?r0kcJl59?=(6ztM!E5kEmO-_0o#s=1
zBUW}4!^8ia2PtQAZh7R#X=AnEl*5B0%F&N+UI^(RVOYrM@vAsu0n8u?!2=LPR5&A&
zc|HZ{q;dz!@{~uDd^#FeIp+Qg7G9DDS3$_j`4F!&$nuoral^aV57Mlb?_a-5{_>so
zm)Aj-&J(dKN#V?joOSR?M}EIM_5SkRY4Vrfj;DE^WY11dudlD4&dNehX*@gS5uRtK
zWwyIhFN`OrnxdJfs&cB>r>trY7tP_SIb79*b7<~#RP^x`$Rd_6R|t`iq1LK_RnJIH
z5dREu1ailIh6tL@XC%UL!c(zT1Q7@XJOHlPUL0TEVo=tpVw|eZsaPwrd${Z#Zgmes
z-*B^UxZN>abqtpstA-ER2f;}dcKI-f_%k$(uMt@|t*Ye&f)&c0kjAqljb}l|Z#Pc;
zRJBfFY&ec^KIIrXf~WB{Cf(OoE*}j2z#(Tik8$0PYFGmADR;z>L@c8u;m^?DHF0hr
zkabpUkWmJyQg0)G7D%6_pNccIkUd<rivOu$D1>FBm_+bKWTU5}qaE}iTCeDT1X<t(
zVUXW!P(%`vk{Qo=`ct7zUJ!4s;s&!y(xA{^g6#W$&PjL?uYKl<gmY23YV0zuPTENE
z#)Ttr8VHwzZ?Ea@th}03@fB53umTCj4NudsOLZM9<qzC9_pH3?w^d%Z&-U2N^Y~Xz
z7_8)ly`-VY%s3p5S(z&rWjvIbeG{GrF&oR1D&Z;YVLZJ8Z6zV;CDfZeML(9htV{!m
z*&Os#skg;)PlN2kaDLJ_6}1+9D70X4Vuc*?tda<wq5u9NCDA-2u)KeNUVb^tCK);d
z#ha%AF!J%^qGjo|kD4y~B%OSkk<Z5$!Hj1)nI&U%BE0WK!^LxN*{G`hzeuvY^7A;$
zUl$sdY)C#dkBV!;vFKQ{@m4s%@d#Bu{;zosJo@MieLRvgP|e*33fdR@cr->orwpAT
zbqtDD1i$8SMoCE0vZWch<T&GL0M9krVcaM45L#B?G^xf8+HxW%w|3S4FdB`U-Iw}K
zkVUZwnz(5OF^sk!UNx{*{_1LU+Un75>c}0AekI}P_T!ffi?8b_lWOStrlGIv#aA7C
zm0)#;*I#6jTs8s5_7l+T$yc2M8Mm|j_(izFvca3%55DTd9gZ9_sOL8qL4wYp`@g(@
zS1jOvCn;pG-bn^pTfi^x-=V6qayG0@v(c+x`<)j!3ASJEa1npqyokT(zIl7eSY=!L
z>VG?w3tA;*_*Pk}=<`^Ps_4;r=rH)NO$n?8y!av_;Y}XUtUwsomCu72e+A0V=lo3?
z&(2G&SZKt-jK3$*`aHushe$1<^93Yj?ITd4uU+6M5AslstxxQ6*Q8jyo{hGOrr)r-
zd#v?Q$o+ih&h~P3Zg*AdS9%NI=H6cTP3LD1E=adDzHIAHQe~sEH+OZb)Q^iEPJOr-
zX5@1)o6p{)64!ejOoBYyBuzc+?!Vtc8Z!=eYLedUERq|yvjvgVZnJzA%qkm-%dPZ?
z%=37S`2D^M7_o)jv~k0SE68OMpbeYgy}#Id8Z~T-5^Si3iVfW}u*(dNUB|E$LJVE=
z>CvG=Is3M@X?sL0eu{GrQ0EU|HQk6?2-|9Ts&f`>q}o3Uaz5Kgmj5j&MZObbKw<%%
zeLT8`75Yq7ls`X5p4d4snD9uF@n_{P<u}iwIO5MeLN8%nA_gVn^x3~CimqGM^N&Y@
zdE~oXGLU?iv#J$PtS||KN%Ra(_;!WJkE0yJUi3^;lF!B8*BqeGXI>n#=dzvaX^`{h
zMTh_V|Ficd%5fW6+UTp~aQ+^$G?gUwMK(RH7Hzlg$d;}ocgNq7!krt67@~kOfFe~M
z&yD*I_YMCixp6WRYwaW@aRDQ2kyvs=E@%19cRn0^*S8?ywcb<o>QdyFvAB{AJ1Mzp
z;Yroh6FDd~amrS|o0hl>6qg;t)jA)m_P(W)mdC8}xQ?Y;O}TKS7Y!BXBnMlSc4@Bg
zh@r++Sg8ftiCPuga`=tGgnxkxskxvlrKha&)s1ESr~u1PoK6~#-N}--?ihGx;J+tt
zSvHg2C;`4k(QAbqSMU?$5n<qEE{XJ+z;IUnG0d_QR;c=DwIh0#%nNXyC?8sVxde}#
zbl=5_kY<bua5_kTQ!XN~6sm^`*|MCJ=isM1C(4}>&65OO!YM7lW8G<Pas1@QQds9G
z%k;EE6h2(ORS-~zhZXsz?HLg^J>SMoU_>~uJrlbmVu4MB@O*xs3612?Ec>Nlun=fs
zT@Itasc&@zR@&MST-kj`@D2O>Ks{Gf;eu<=W>qI$psg$X7`>gv7ZO*oKyk{Y{TPan
zu0z2)kOfAjGZIhI<0m(sKR3XesVOJjN$6Y<5CZQO#O&4(W(Hxt3F1^B7{v}ZeH=#I
z#-`!Bj$!zM8AC3uHX%_%>b37$sTbvVS5Hc{^~2#&pHAx5((>KW(GsU%glXHU);n6J
zaoRXpMvXsZN<QsTNZV7>DuhfXTRc9ydo6bK2zB03g*9f}mTeARtnG29h_;7eEXP;(
zBL`bn>sg6zfyebQ>xbb3%d2YKs;jl7Pnq%lD~nTf5vTkV<hpELiX0u0$z;^A4|Yv{
zt!Az44@pG9#8Lm=7#Tf-V$%mwY|y6q>h2DvnLX`?w`E2AOms^m7lfUYd<PnU1Nq#Z
zS;9U&`xF;dC*=p($>O67%r6NQNvpzJ%`&E{s1@SgjM|wMLFylsolde8>=f&<{h^OH
zHEw-&aiW&blwk32({tK>WK-s0%Zyy?L=MA*`WE(s$Ot0aVlKVcGPgR-p&CSUK`wZ9
zm3HOqx3eTJSBVHK5TpvKDZRjBq<x`EU6hodw=M>|drQHp&9hiMa8cNETw;er;J~p7
zc6?58V3;2EjKC6+?fZ^%@8>N*X=hn6&wHBTSw|pUE7=xuV$%i4X4)1YP{-yFr!1Ls
z(E>luNM6P)o&mP^u1x2hwK|>J+ayj9g#-s~Xk&*^7YBjmU^ff{<~g<qob@)`Tbmj7
zZO)ASk!Q>JGif<fp;>YxED&skJ8XJX1{u`5=vr*rernP&dRA*p6|*uFJ<TN8o1`d9
zMW^DpP%^*ZXf6#GAlykKm~4)m?2M#Hd}2ac5e4FLQN}4N>zZT%$2}n1XIEub!_;mC
z>D0X5fSo=Zd=^wuud4d(+sE(pYSNUwJ!PtXMnfoe*MscGrU%Vpq12$eu$$}EJd4GH
zm8lIYq>f+=GakCwu>%(q%QbO8s2Mth^B{WUCy)yC;x~|Ev}CYFf{{+G_V(Uq6yI?N
z?+}D*+3Xa>adh;e_+HmsT|QO21^RGM-O+CV0`0>A!~u3LR>qyR`y#YPK09o2_hXCW
z4|;bq-N1|-$HyVH1$F}0$ALowEc}4FJn~$^+#$^U_QHRvICr%xRu28g66S6Nc4T|h
z!Y*?i?2t&{kOV%qZSMG?N4ZPaxx5D8P5m<fZ*B#6qp1o=q9fY>R)y#PO@`}B?F*vx
zcSGBNi+@d&zw|!#1tLJc0FZ+epi|>Xo?XFPtb_fj+?SDz>^w%#YFdOQN>)Hbcqc-<
zif2_k2X(MCk8{DwWHGKd1tRcs5fvStNZJL^^GR|6Et@K`1#pr{$d3x~hM;H&vIgJ_
zh(5B(H4{K_jQ%1RnHLSl08N2ZfeMtRGG4CC5J`(Gk+;L{p^*h*2}GRdC{EE;mdpH5
z=h-~3a6*N);A<34g%pw<1hnmCTrMOJM5@a>C$pJIl|dJ-z!=OG-+~^XEJrk#A*-E`
z=va2Ai~&jWq=pDdQ7@jVXz3!G=S)0Z)dp$WnCH1j%VdG103n@|Yrq=MlWfk>v)N1+
zQ;I}D<lq7w$y?86GaVmyj9!%JDozq4<L|Xih6{!2;BqEE(~Z#P4~3G;fTTi#iPYb5
zfygC^6ZwZ^eaHpT-@9q$TNs2?B*)DV?95!SayqK7(&H+4o~2QoPZ3FBtbUt=eW`+s
z5p<D)RjY<iY2=vtq^W>qCFf^va;_vE&~e}u6M*FTNNa|K<~y#UPpG$uU5ONqzdC?M
zwRtbVRv4Hr<t)UZFb(X8z`>#EIoJ<uBebZ)7+n{}`=Axw))EIU7rniM6<h9THw^Qw
zwv}o}x!&f0PUP}`-Kfhd=4G@SHbu>rE+(W`L1he70a(hM2ll*`)k@o-R<PfoQ&8gz
z@hiAQj^2<fS>hQfNy|zI#k|l#TqPVUM{kbRwb2;;qVFWxmB^1;Pe59%7kt#hw!q#3
z+P3UaUHZ$6k)&O?v_c&H@`8gB|K|?}qxZ(g(HNa&)6GwrA4l~_s6wX@Bq0E_IT4@G
zpFbQN{YN~K``>@S2KYzCYw<^1qW{oa;U5Kv{Y>abiba9`LxNNP=rEA{QIRqHQ8P9C
zG0Cz?BK{z=8T@}re$UcBW@IrV$sbkW^BE_l_~TOKarB2KG5G`Nkgl?v|1pioA3)?H
zcPa+<;w+c_1|+bYsvi!Hv$Vqv@!_BzU&VDK;Ct*bLEh-MbU}^vy!uYd_7biPCVCER
z3ig%~+~x@Hs+!vkX_RwqL)(8@+wd11juWZk$!>^zOE9;t@^<@Cf789=Gpp~4-Zs=r
zz0a{KF1uCXT@KRR+tF}WT?Si&G3)m4XT#b%F!M&?nfnH5?oO7vU%=+-PVAAPX20Og
zo294OGo8|&;hg*M(O#1(e2)On>x6mUAlUP!A)mLKDtxDTzJDm_4FW><4h!9<BYTC2
z?iVP!Ycp2*mG6e$cQK21RQjk0LdWAFHU$ybF<gdez$46ruq?-7^qwQHR@i5jB6MVi
zaRn{uTj|tru15W%XQ-HSE>fWJ6l0L1)#KT`EMgAfWcidNU1Qc*qFP#^IF&wGMc;t=
zYnEq|Toj)Hvvu7GwO2fj_AF5+WML3t;qnkWuFo(v+yE0ZbVU#f!VK{U%?b5X>rb%S
zI&c*COal9;`rT*SIjVP5+&j+kO}cyM!42wr-y#0~u%)&geq2`dHphT;3>aT5l;W;R
z_CrvF4vJ`|)P0DDxX-f1ZV?okMBlXoYBPdq=yB{=Ccz=&40|CBh=?3&2JStUF8<zk
zHlZUp<iWSV$zqItdG~zO2pOwo3kk>-sP&#=M=nYtO(aK92n4@NHfF<kY8VYoxc$^H
zz&$1qB{@ozXCv-MOX}|?qseutF?d5rsjAh15G#z=$F);*vx^Q<?e>#ku5FG#X=Rk1
z7UVJpk5BCi#9dL1it<W`6qycm8_e&P9DrZmJs+c=K$TfQ!9V1&9B(jo<^XGeiyJxH
zkI^r(wJ=s0g7|0ING-7`TYEgM_}hzF2L7!%Y`!RqBCI-H$k^(;Bc#cXxtEOQQD%g$
z2yr9~j-AMha9~o7Bir^J?z@3yg^y51>#a|@XgVuYFG`pumZO(|T$;zna!tYlk=p6a
zggG#{OLueM*#5=jy8kO{MJ<C{0R*9=H^<fW(RjP)w}im2UsfE|&5bn@BV2wfzrm>t
zjBehi3tfGu(SOb6`7iIDqf_~1vWOE^v@By~>AetST|g_)xGGZmeht_&EL)kP%?%;M
z@a<#_v3`9?WbT9t%L`3>aH}&ix)hy)^O}+J2#~5(gT6(kF|KZWI55EQUVjMv&}g*!
z+J}RuhEYRS)qHJwzidE%fB09u2F|KAAm#VEiQ^T*{f;u(1CYhH(kkf}Cwa{Gw6X*J
z{a&W7+UR!c!N`3};57vAua};^mh^8aKfAXbhx-_kw(VTu&CTVvoIv)mD|2u_?kFoV
z+aqCUgxGa`13QuMaUddwO&U_icU<4J$vxKPS|02QEO^ugQm#&)(o*kQrsj6k3c5Pa
z3K_fz`AHCb1h5nn&cVWqk}SI@P!eBA7^kjq+yLmLS(%_KktA55;Ur=a9VzZHGMyy?
z;`eH0rzu56sK_KJXQH@Jf411)-d2x|WF=SU8RC%6DNdD`BiVDZD{@5^=%0N^$UimI
z?HIkv;|b8J$snLkaIzdmP)Dn99suq&u{}-cswmkCNFKrkT1Y|TDy?g&qi>+|^_x|0
zo9c@JH#$^3%i}4@7qxLckBf_MpuFmZ3bg|-L=tx>(V7G$ViK1z;Gi1VVS{Fr%HVl6
zPdI3{Oko!V@6fZ60-%7r(P`Tt(lrRm*E%UtA-Wyy4EsN;ZjP&(5dffNADU(>a3t{K
z$&t{xyuhL$-{!~YN0H7!*=;3~;+ZI9E+&>GT<PFNNuo&kN^~r7Rs%FUaLc=bb(GMU
z{bI|BV;R(qu!y*Y9Zp<KsAFO?v<%yfJWFu%5o*7!ov_){U>4Cuck|Q0rLz}rU%!0z
zztPXne)_(>wH-YxL4y&Zc>nSEOznR_VuMc5FRy<dX*-bKKID!A6E@2yhlO1FFui8d
z1ST^cX@yyXaz|A@GK5i@>1_hX0LNwLS-y;`+)eMU)oz$gZzQDe^ge?6YP?={m7eK=
zY5}m?16nEQ^4gh<5daXpv?aVygWZ91o~?pnDx~Ba!Qxpg(o&Z7OwEHfcCrCawzU2?
zXWck_fQ0>8i1O&o*%(=d(L#4tIMuu7<r?o|DybI)Iz?}e>%Z2RNp#7b&Oa+9CT|Hf
z*)F++@gwP?S%2Nutudj<dUPGCMbk?xKF#1bQPuVu+!_>-ubLFk%JLXix;7FiPUrUM
z!2_+0VR^7cz7mnEZnY=Yh9MMrw_MoXbVFLL>cV)N)ej(S)xkASv}>-5uHV`UtnD;S
z?}hMz3uO=5p@dFs@=^PKBPWgEu|kx;o|EENi6KwRqh@QUzRy`Um1dz=wcyn)epPrg
zOvTp;VG<JD_2iDx50E+WEm-h-({7AjlI9Niv^*izcd1%7)?>3`xZaTTq8hSl08e)v
z6Qe4)`wrYP$H-cOmDUxKf{i<!hg5FrX;^>AH2StPJ&p8yN6@?4Kvs3OeoF71tq0(y
zs$X7IzgBM)NVTG|xT(M4zWfFVhFadOKMCA}kI>wzKFMIMd#KjB_FTCK=DJ+)TeQ}h
z_F%0WtabO<S|?T9o!kss!{sJ(c;r*eso`UXISf<go0vyD@GP5g-`K)kv;O8<!{{SU
z?%HK{SPCtFEHn=$H*MQ7O&n5}VMlO*1J|&y7f_oTmgQMu-7pU{5B1ML^Kgqa51oiR
z^lxN3`v$#GasCT*Ccx69V-jy8u?lb?_EMQh+jtI$??S!OVsI!BQD*%y+@1**M==8k
zR*|LJ0RTzP!4{^hUdO%uXvmjHAvAcF#c8SO7mGT_dB$RrV3AJZR7l>2r-;;S5;Jg7
zkOIAUH%8)<VDmD*gq$u}o3{dhQu8?Bsx63$2-qEU>J<r<YEe2svKDw<n~Wt$tq@?4
zpOXYU0<y|)>386Ehyg$bCA7u_0;k)zs+1MVz74&N(<moJna^1{&jmVayI3GyOqN|h
zww?=7nF`gbkZolI3DFT1=dmuULf^wcf%8G4^v@vz^2Mv?I`%&!Kr2vUa3(0b`tfee
z2(q!Qo^_l-s_^B;A}SKdR$r(Vl$mUf>cULB3w~GLjurEfBqA@-GUO02e{mX@v1|tg
zk4MAC(70xxcTbMtC3arB5J-uLE~n$oik0hNmS<T6;1Erpv3QE4wNl|5a{+Phs&T4^
znwX=-|Il)J)swI{2P=ogu2d1#EQL>!PHya~=n7@=bhaPEf*(bO6Gb)-Ba35)I3W(~
zz{VDJ9gF)xBtrV=91dXGgpu6Gsw-z<XA4w(_z+><HSM15YTNCUrrAmxGw<2)(tQ;?
zU3cgQav|DI4%B=9t(^NEbLVma>LG3XSzUm1opfG&eojh7Dfoh`E8Q2{_j|9tlbb5A
zC{$OvuWEjU&OkNoRMx{~^XyVj+LqcL0RVjYrLgnUbwTH+z0mpPT+pYc4r*Urur^RG
zwQyxsb*K(J4tzMgiO)Z^cB!Ws-<1`p+kyiaxhdJ+rR3%5xP7oBgKt%fvpQtH6;-dp
z<adtFezc6dLwNlc3OgQR?6(cr5M%%KW9)Adnhtp#w}+;GZEGZ)Ogn9Q_m&n{*nSi`
z+{Gbf3_G?ZFd?3YEjO@D&#;+g1@{>2*p&-f+3_G6Z87U*C{g@9S%m(gY!o1^DD6#4
zfL;2;CfkGzk%u5Dz!VY$+>5|C2*S0Zpq!HYLI<A7_zocDYm!smrG%7n%I_ZpZ-k-Y
zM=r%KvkdGIU*N#wHfBL+x;7Z+!!Iz8290mf_`b5nw^`4li)H<L+=TO=ZsY)fa)(@s
zduc2X?D~asDc%pEX0O<G-!dF(Vi6h!#J2mGSW$#6%W{Ze+Yx8%9*YQXSD1yB{kA|y
z-2=Y^$*(AITaghp602{HuF9)YMiCVWk@RrJPj?AKkaqNwEN@$p+YuEN>~@SK99Owj
z6pr>pfon0aUiYo@ZO-jHD<LkRvN=z|W-Ymf8^Y*rT!zxd1V{gj%L+35ZTj7xkB^W4
zS;3?s3zY;vr{XGEU<Muo!6lhck5m|Z0F|SrwsY70Yeg|=n>UD6wL@T)hz2826w>QK
zz*f&=CLJ|#fzHJ|2kRF@;7wP6LG1&m-rXUr;f;`K<Im#>#QQ_fa1JA=zxx=`Bx90o
zTwVe<Psdf0izzs0S`LWG*4TwCEeVr8m#Ge8X@{K1k^H7|Ow=E6S9ikKk9Cj`kZRrR
zC5pN{a!3?-*a=05orw9EdW2)&<F<(G$mhg+bfW0VNt4#+x?56zM_Rifp%a+5Cu##i
zCuqaAGe$W{FO-X}b|5p7=L_X%RjX-TMkM7lS(nVHi-zvYbt{4W>Z!G;{;ngXc-8Wd
zpLT259ShxpY3mYN&XrprU5-lxE2<xy(L`;mh|_3=SnM8{QT40(DDBb7^17dWV0AlX
zRg0dW$~NA=6GumDavZLJVK+(PmvGq4Etq;sBR@u~rb7D@kGowQ_d2M*?%&TBKj;;v
zq1)Yokx6*<i!jyRtz2z-rJ;YXqce3#609L`bo83CrJN>UvR<vay!P6xLGYdYhOZgS
z^&FyQj>?Q@bDC7i->XkGLQjxs80e(?ZO6#$WkY;_s0Or$6+d0^HR?xe!1(E^5A^=<
z@8=7oNBr>PX*2u{Wkc1T!;h!E_PsyU3_9&cI$di$^QZdeYgYF0=cnt?=cm;)>^h}Z
z)GUGat6IH`z`tc2d#Qrn5ALy}>hUsERP*E>px!0#@&I|4!}90}D#o94Wpww}d$2Ty
zfRN6}46EbwuZ}-mYgss7dRgp4Sie_B07cmYmPW(4YfMK2(a}J3w4cRnuiz<eazEq&
zj@;114j}?l?l{;Z+_H%+46-(g<vtkr|Go-c-*x=g*{ziYHWy69m-6v*p@Iu~j(}3y
zA5>aD2GI!8maPhh_oRP65?8uFNJI$Sg&E{zj3-c&d;($$sF0@Onie1TQ13;>Z371P
z%2tEO70E>k;Mp=KaSE94y8<4NgRrN~*0D{~BHYA+vJg8~L~$r6#|Ec_1VB*ZxR1_e
zI{?NXA7H!>A82sj6@~yzLMs8=hacCYzQ+m^eOgn_ETa(YQQuUxY$knw*g<lG1*{pT
zKTw&?kZHh!O|u6$^;fr2-48^9IyQFYXk-qxqcFfUViY^RW8#odio+-}!cfrA@uGVy
zvb0twNDOLy_ppi(YuC8rTOocOQDux|sJ3#jMX+16P5k3kk!sMnt!M!4#jbt(Xs*KX
zD(qt?a1Nt-!|Gb`MHL{az234a*=lGAQ4V#vr-29+mxV~8Mv|iQ<O0`nlai|x-@UZH
zpVWJq%>B%=nSu(`Z(PMG&#vx@+;lBpcNhk4=!YKmsRweC0Bnv=u<Mw@pd|1ZwH}?^
zbaEo09rACPPeLJYmsg8UP``G)sJ!*NteLKQaFZ1TM3=qlvJJ~87ncI!jA1Rbf_vp^
zf>g{EM<ICGp}H%{>3JS=Q8NGzF^M-2F~6dm*mtC_5*0gzh+?CFs1D#25q&Mc`sq5a
z`U+vO7brSj>i2jV3#;9lE9A(&=U7U<J-_i%jg5m@R;VB8w&DHZa`52c$I}%s-Im<l
zUx&3jy1p`QwOx8~J0Xy@<Xr6UIUXeH`luNEzK~UT-K4w+ey+g<+ziX$<ob+Gu6+y=
zx`bg>tQ(mjbH_c)+;NBW+Z`2K%LpAiBnEb=u(2Z?6B8;z?1irDTE1;?cAw)?&$`4&
zbYApbQa$@li^3`wQi}kVD$!4m@!}l<SZ9+4qd}TBSuiS&sw#<uqPbFh@&!1iWSqhh
zj}}VixwtFV5;bsp*-C`xxUL^i>=PHVAlLy8d0^wnWv*dR8VQp;I$OzL08l@JkE!ot
zT2fe783vYA;*DM?<wDv)b02(3+ZO(y`3^$;9RsNi>G<x5s@vO<2Zi@$pJ7-VTYm<H
zcb$r|D+JTGZ0=hWJHiJVCX-?!e2T-s2>g%*l>6>IR(D@EtiK)SX%Exzwi_D{xJNEw
zk6rgFMpv-c$vfp@mKDFvN!ep0$kR@wvLuQAx18kpH+ecb1{--Rt6^1NDJhX551@>;
ze3m5H)yZFE=>E&NDDR5yTQzq-q(ERe25||dl)Knrp^Itgd)W1Cg9#^~R`B?c0)zIe
zeg^IL`r2=;#uo4_@9Mv87G$OUZgWTvs_(W{Kd8Qg>N}{u_cjy#XI6cC+wq|M-t0pR
z%J0^nLHS*;qwK1jI5doi<6;&BA$C0C<A4SR4lUtwD=-MR={;6|e|hs#CAX10ZCz!y
zBE9Nr!th3|mCA%PvzZ{kuopM4fG#cBW8zie0^sG9f!zd1?21;bVX{Ee_!CORBrfAA
zAd{=AIx2LR>nqEV%H9osjZ{kW@?6AuD;H9h0+2tGiLIp*89c@^<&W|)UuAiDzL1FK
zQYQ?8$Vdo|%oT$kptWV9b4bA>N%P<eBssqnMHx>Nj9Q?18j)$7#3YA?tw<^apln6D
zm!%0Hxq(km<~!1Pc<NSvgHi#!(CTS|u0)bx#frByLRI$m7|7D@jzJ*K*nY+U?nX`!
zcntf@7uaE5ghPiB?0O+1loMBQ@#u^JE5ZhDVHu9qQh~f@f?RNzR#}A3vnv$_091Fe
z;OHlkKt%5ty*`hNb4l9yc1ETZTjkPf?k!-L?#()^n%pKMhovZ2o?dC!Sw*$Q40qT3
zT?!@W#C&cD_pGzc$J3d*2$+8re#t8jO8brW3qKVTczTJE5GGXB*SZmLDtTmeC8OrK
z2D(r3$*&y%{TMxw_JTG+*$dvhTH)Zk_bbjk8S5$At8e|1Coj?{Ta!HgmpoCn2R)Mi
zmBlH#h*N$VL(VVRdg$>80X%-GMeUBfKZGSCIj;{tHujW?d8f9bbP9n7)bv+x#8I2q
z51o?&fK2L%4+kT?Mm9Vv@5?7)4Q+T3Zhtt?mKkVyZI-FWq#u#c>EQsyueaa9D)ST_
z)Kg<nJJ<aTYUg7!%G@K`wILj(8I~a&<#VnHCCv;=V%^VhOgy$@LJIA}g1Fh(59a!Z
zvmih@9oECmhJIKNTYm=k)oP3SuC6OLAk1?a=B@{+?gIl;0;%o^wQUhlQ&?L}>FaN<
z4eVS$`N3w+V-OWc^0&B%X`I9*n721<LI<;ow;%lGk`kEEP2E3$TuCI4wTmk*zW;4b
zl6Tq0cP<Igy@QWqJ(=i+epTN{((@p!xqCXc<Mq|=lb&^t#H>pxSvNhqlrHxggP_UJ
zoX`y{PO)d30d_1q!Za{E9GZ*@>RGNJ>!6(L%3eDjwQtngIOVpxY1$5&pR-cXEW7v-
zzU4MIjr!tMatOiWt+aUuaVe%-vn_m0r|`G34@l0+(+>w%;Qo7R8pfZ#K~zo=%(5gQ
zvqC(reyQ#}O|w*dLkYWpaY-Q&Sd!&W|J5*T+w;Epa3H<N-<Hao{B6nWS|CdY_;)7h
z(?mpNw?GtSX^A0A$WzOhebRqliFk5eKBZa0zftvEoyVp4MmP9R9}d3zsrCf@^5&)T
z7`=?s3-ouA11qg`Ldmr%n{!ff)vlAOfhTe(YS;I>oUjXBR&g#}Z53@+FR9+RallE}
zT$#s{iA+LAT94Lw;lQ)~DvBU4lI^+DvsaKvlnY$OGjyd|s|oPV1<K|n%chXNSMN0N
z0!w0O+z|m_xZvQNE9QmrkO@9QjLgcp_747%C(q$=<s3TRmO<|ORL+REBocD`6y5Jq
z9>EMH@+O3CvvUE}B2ub`>CDE^gBFAE6Uj{_ACN=Sc<!L2`s+aAxAF-hiO5S;cU-&N
z<19T!@09nk>a4C3eD^gSGF;83vpk!|g?Osk2i~Ug9CG`CzY&^p1>RC1Nz2p+Ml2UH
z&K+pXvK-}e@LEQ3qWhAILX@3{lmqLE<T*)8!Ec<au6z8?^8`^yg12*Axh<H(Jr@Vu
zjId)HHl{p?u%IRpu4QuKn2+0;Ud;1|Fi|Yc=U?8u#4rgY5njsWl*D>1qNynJn5oIA
zGAAa|H4MCVamJ73+s(u6+;Q^xeKrA9#<SXsJyqUaaIEJsFt&=Lj;HrJu3P1Ao~Lmp
zx49!(N9Bu!RbMXN#WUp<|K-g~{hr=LKO8Kl6mBx5q1yL-CQ1?~(Do0t)m_04pr>_V
zWArKq-?*u`?2ful;{B_VoAq0@S;uMZ>}@KtcCTo)gLq39AqABpL6-+dQ?b2w#f>j~
zb)9u^W#cVw)#r@5X}#bosgiY7K6_c?xGHsUA+L8K$H^{UBl+B({KzuN+4J3Z#5I&s
zyM4eVr`8U}+g;2X2ZaD_kK~IR_GAy2b+;eZKJV=9o7*#i%aSAS_AGeU436JBH2ykH
zH>KN3RG(n+lqCCP$hnz!;kF2@cAM;d{duRCRNBLXXr3f@KQlXso;z)N``9z~wrZ@g
zZQO8hl&nmB(+(`=V`fA?cA}8ukXt4e1_@{sx`q?oXWsUns#s}}1<C+n4Ek9Y=KXA?
zBDqRTu656u$QwymrtQ8YiO#Iv)j73rDJjooYt8|^nkpd;uByVXviu^+2)}(Wv*+zO
z|Fs&MgV41jp83lzgj-t&wh@?tFgW&@L$MQh0S-csV8Wb$QJaY<@b2+Cc;1=)-8l~u
zbRN^WjDE<X^^;v&M+(Wr4vgxzK0$5!S`%~@iw8bET@nPAX$RP{91}aP<>SDh0S?2!
zW^Q2khHE@-lZIASfP#Ph1YX|$TeicN-Ea;VeYqv~cW}KogE_1e`MB0wtLHf>30iq1
z)YgniPJm(lzkke0I!_2>5Br}Q%RY@$FkC30JR=Fok9tjL>&jj7_Xa{gC7<>wrNb28
zltLzxp4FvWNE^NW_iA98FoG&#przWwyVVifq>pa}At)4h`#Fgkmlq`O#||&*=QNDG
z?ie~nv^`vqSc0UwyE){=ZaphcZ+KjP5B;#@_=Kx!e5<QPDQ5E5K3pHn`q{h$$Ud1&
z6kNZmqicg`HEU^<NFoX*j@sA9$XGQj?I-nhc(Q8)X?jTtcB`4nK_hsUl4McFtk_j4
zxU)ISlQ<RZoa8$w;s^4%Jxv~;o_&gos+01Ad})Q~Ci38e)rfpzMXu|H*c7(Fj%g9d
z*%D!9)5xPD3|zx{<lckx>}sb|mM*l&D8<FKegoK^u64331x_^wLbd0uHJsB$EBI}&
z`L5jsXR+P{?~0`VU^kv12$@HzjU79n*l~Rq2To*RBXF2W-H4mfea`y(E^CO=G?1Y7
zb+3-O2gY^Nkm-J<QxeFZTJgW&+3M{<RXIAw7d9JZC<eW@_DBlC&f9^*cOhyV;u)_+
zBgYvHSl}~k1Q0pSy%1BM`q;3o&<Z^(w7-M_?|vkl(?O%{Nz}~5b#n<$ic4_MY(BuQ
z71-MxPjLQqPpBqHcfA*uF3{Sz*s8>Sp03qVwZNU$avQ5#+A;e6uxiQS$J5<|$126a
zer$@v=S(A8Is3Mv>28R1Z_R~!0C~>^KO_0YP7cP0ja0v@AoKBq%aPnZv3FYWm44}Z
zCgIe;W<){1WCD}Wav)7CW!zydGq>oM>u(PD^lkX`E;{zH0MtG1_{=s!OhqWLLoE}B
zjv;_;2xx|d%h>=>9{}oK2B6+$@<snfrn7I*o4B}GR0$GxL#Drw_~QtYab2BfkdGWR
zMV+^PrA%L8u`>WOE0q8cg?UPnI@>oqQElrwD|Ig0R_g<J4OYDvqX<&PV$gL6D;vV8
zQu5qjiG*#@sjKEB*%i*kY_1ZmS0L~xCq<dh8Nk;O2AsL%N+T&MX28XkW>b>DHdeKp
ziYQay0)Y22CIsJ#aev*Q(qSy5qFoOkV8a#GcLssLaXP`dDB_|7Cib6xc&0MKL(qH*
z>6uwZ*m;B4m*Dj7aI75aUhiw3t3vYg9iuk_oYSmCaY`Y&Lc-#eduE<aNlGTrBe<TW
z#e520J;@cX2Uj}xB!``1odeQ4!JDSkYG8)uX_3L%0Qa+bS;Vr9jHJMQSCk|NuszFC
z&`uQu|8`;SYL@K<bT<ewZSLFH5~htEumTXDIhcor<2l529e&>}M!o5HRIfs9;DLEo
zj8@u>)El{ABEGELvvP-6tLe+I6**mFK;;l!{uqf*Ga}cHoOsfHq+f#a<5>(L6nBMy
zupY9#>_~y-b7n*ywkWl*6Veb976q95)G-Xp4&3ky%%yu}N9s?oo6ajaL03*IZO@bw
z4{ALG^`j(7zarHZy(3CXl?>=n^=o3os`lf?z68&3f%$xv#EihyDKkYEN=i|bP;8b<
zYgbiO4Q8l&u$Fx92Bdn^ORUOA63pMG8?1&$W4>D?eicDsJ%BCF!JHr0*WXUdS(OK`
zPZiiQ+11ZCxClA)V3n&o-|po*xZ5(_wH!`$S+c0=?KQT-7CGLMwNTyLQppA|g6e_9
zBlI5Eqo*o(&0zFoRO69p7{>;B(y#iY+ut!VM}0$N_l>?evabK|<7xf7O!%PaHCv{~
zZb9-Hxd_^ibQ@Eb@~8Us*K8Mm{$RSizoyIH#2L(&gZXmf&m%Qob_MIbESRAanB1h;
zGr{HP@d#7bb#WN^mScpr#kq0M)s9L<&7ze-t;<=`;NdIDX}(qpl)6V2l_Kqg#;-Oe
z+`b~=?mI)ECG|i&Y<RVZe3Sc}W5;no`3Wr?`aZ|pbqzwe<Jva6=QFy6n%F+0+a7W`
zZKGWLHWz7`EFj&z<X7M1GGF3<xZ9I_PvFHpo#bBRn8cw3M}ZBK-0?BtmX8_tXkeHw
z<(@rg_#F+u*llOuKGWAhN7{<Ls%)KVzfq&F*3+%1^jz>cpyh8&v9PQ#tD<+*mesNP
z{glLs*3)HyvW&LQyq&C}uRiM=yH>lKBE9ZCtx@YbSE<zf=Io$T_g?8M)v7IrA5WJX
z1xm4gyRA6)3fxV(uF3)Jy6NAbUO#ALP=E3a`t_h+KY0E6X3EoU%JqH4t=kbXESp5w
z4~2~#!;dgwmVv23h$n1HT=S9BZEZv#D<C@TsJEa|wSe!c{92r>980P?fVl1`Q&vJ8
z{Jrew*^e@-&f~OAP+a1N+5n~AC{OMHoZga`sr#x-9;Jq2v|X&+8MeJmxa>XtHDt>5
zxbZ=p9DwG7IJxd;K${O}^V>C3K5TK)3j)(LOc$GW0H8L)ao}-+ohXPxZim8Q_Zigo
z!$wSG*9`xCb$5w&xN=Vc99M8Sy|2!}uLS7NE09_w^b!?9q!qc8GB~0mY0n3sP^tl%
zqhkd8-%n8i{K`=R!QCYRaa7fgb*kMOwpldI#$Z-FkGV_$$v`&0<(nf&rmFCl4aOA+
z!es-LEDSQ|JXL5^b^ZHKESYnmxjQwp%3T1`MQmU9mxg6Vrfo)%jkyO<Iy3Mwh1|Z3
z*iLA>p+nsPN>{dK(YomkJX4BOM{JzhOGb6YZwxwBd!qM&**7znqZid&*I?8nOD7^n
z=W$VHlJPh$(0M#LPXG~LpovK5aSFM<Q*l){0T%kn33~V9^;7hss203RO^c>vfr>It
zl8Ugo9vO)jtd|^NOh~qGz37h7JH0B)b1{{SyC)}`R~?X@AS#mV3LO#7RoUI8JgW7@
zDcAyGbft!bSwiN8@*kX>fEw2;`xNm-N~SS8djCQ0n^}=T(((@n<KEvN707N0Nq9{Z
zVWq+?4eaTuG$N@MS5MU_!D5!g<<TnB`G<o)e>fPuH$RThzr^YPgO0jAUD62UX8#su
z>S>RwsT18>NBpkF^~KTA8eHH;hee~=HO=6nPky}BSs-6V@b=-y)4HTJQNg<a_XhvK
zgZ2*$@H;&&L-g?1iyq#Iia5*5zbtNhH9)GH{}hXxtORJ-D;@S}-PRD^c|c-I+TI6@
z=m^swe!y`MxB+%Jr8tD>YT;9#`@;8Z?><AfY86n8O{I%Lu-F=15gu#>8KRt|Ko2No
zX*nMinMuo2FpWO}(6JrcCJDO=bYwm?WyBpY9YPqj`kkFalv*;XA{!CS1-anaRa#%k
zNh!ukeCcrS)G?5~z(2`1aa6TAOCfR16k_%;q4Pp;^zP+Z0fCL@pno2JTKqmn$7MDf
zqhrYoHAct9x%~6@7^Eu@Ri)5>k`SN|5+XfD&-9=uS4Uh(NxY*Tk5O?UK>y9INX}8!
z{bCG>a1`$ukwSgDpHNa0kO?*GR5%cja~X@PO2IBOB$UAT5Y=Th1dIK2WfGcJ=yHk!
zGqkW1SOE@g=3>VP9NQBPHN+!#9>V%<>B?#!*hGTWU+L?yXHwCD=a-iL_Lbj?zr^y5
zb$fse!`*Kukc<6>+WF7oY7FZa!-57H)C^Sf$vM_-mJ7G`!D?D|HH9Ifyv(Y#yQhY}
zt5V)w)w+_qtdv6;#k`okOL*_?GMmY_J}rJ%Z^MQxe}iCl`3vmL@|P@yPN{2gseVb~
zOZ7|4=Bj{2rhX|X<nsA&kc*;}zx+0@eq#}r|I#egzs!GE)kpJGy*wjKl{?MSq7=FO
z9T=SDFQxitn#g}9M3<`m`c3}B#ijh0%v9rlkJZ1^OkIz`RV)jQRh3Cb)Gt$^+W>*^
z)tJuHGG8o>=P!Bklge+k?1P4FVJnT8dZ-HAOTb0nGi9{AwI2?S!GeL!k4r(1@G5w>
ztB>4zV3XheOB!qHZYooS>eO<7H=AzO#9OwD9Ca;2o!T}SestrWXX&LRr9MTB6ryds
zkqI_m@Da4<x!Ox1Srv#2i(eCwPRjG6GOO0sQk3fmeTPhV_s4oqhSxtFRJ-+ugKks)
zN{Y8?j-k_4NQTw~Tryr&+wW;@p3;FXryAC<Jj|mpdX<WI*{f8jx8mri8jaJ_PBX_y
z_Tl+CDOWz)?jcZJtHFYXu6(>6%q1(@={6hM7)XJD$D)3+bz2jQ>nCLKuYnF@!?W_f
zd=e6dZ+H-HtLK`pP(R*$xzV^W;GOoZh%ZTXqeJ4}*ah3L5xvg4M#k@uu_E;M4JpM=
z;lH~_{%$ZnHo%g0qZ=D(J@vr8Xg)O$Kb}_e46ewza`^GIo>6d7&xpg1r>(iuwoew5
zRYAr2OY6_9zG3Sv7?)Nwu^uLP;AM7&--wx%Uv$~6@4DHN3SY6hQGL<DOj--ngPF8Z
z5(bjRY9t1d#ruY$zP?RiAB!Mm-18le<G>07?1V0)H1im?BEp%+C~>{;9$N(AP|*~I
zEk`msO0!z+7dZ#Ytc55?I~ob4HovljF`{!&Q6blKE|7?2^62XQuI`TE?5h=gZ83w#
z=II<fUD_aVjNYA#LZBjvXJ`gTpRQKTO<-8N0%cYjE})M!OV@>v#VuRsNQwl>lLaa=
z7Lx>vbP}gRNLY0dPg0UR4jWu5u6Q=x&jc3=J8+!H!Bj*HJJk0u2^hzWxOT)N*W^RG
zY@IH94=bEpG3Vq`pr2o@SXOdX!Gfw*QkU3ljZF;JRCg_HGU8S1Os-p49d*=q?P#eR
z2_$!A9?xbH`_DxwBun7UBT5I;*<d;wOlO1XY%rZYNYmL@HC>&aR<<i`r)`<jze5I`
zmW`R~6uIhI37VF*v>pfBR11^Wn5s&00c@goz-~1dm>xt1k9(zmYkguL^*b<ZkGRyw
z)P-DDByw<QS`nty2rWttlLq%${eHQEuDhiMDB=I;#jEEiC!FLx1$=etp_axlFNBix
zEBp)6_?I>jx70|d%217t;Ewo2rn5w>2FCmz!(ZTn9UY@LH5{m+nkDR9JM@<zGjF65
z9OV3><t{JKEQ8UDNrK{(gFcW+y&dY3tvjA(mrC&{W&%|5WP!K<k9d3uK5YixX*qfT
zk|7)=@dZHp6M<j`7I#6JE|Wbul(`dxmKizNvTcSPVMLgOKE;78Ov;Ghb{IZxFpG+W
z-z@=Gy&ihX@LtPf+`+%K)4?qT*o#FwDO`I&U`18mtcrJ1otJPDxq3j-NX1pMkoVi`
zgpriTGJvJEP9)fFI?J<ZtRWf$xZ-xf71zqfc0CBiM)<@^fBI@xfK{UMk0KQSRN|||
z<>n?#?o9#u?_QpP$1>r42W>~*9UP8dT^=0Yr9h5*MDRqD`3|3_CmB4K-Ielz{$^54
zu(wAtKZel$ohy`q<DcT`eELJKQp=phlemNin0GZB-JRFFK=j;4>9P&(x<MeYVHylO
zzC&=xTpRli^=-~r==t7|R1UUw0$T-qll39kdnc9aXSC{OvwAd1<{}aKwofsmj=&Ca
zO&l`8F^x>qcOBwUdmX>*y0X`fN3G^t>sz&xn$uQrz(Gv2>_VF3wy8O43RE^H@EC7f
zt}--iNHX_@lFZ44`2*M!Ugw$iX6}|(uF*r!M5N5Tpk2O-qL>L}doC&%QC@$sL4U2h
zuS%GN2eYf{9mpysIQWB$c~M((l-Ctv6{NZeS<4i#ze-uD-i`o}xiz=ji}X?yWjq1Z
zQzfkG6r;lmbmp`u&Zj5_jyF)$fgY|@nTjCwj+kbb?G!~aEAZ<qhIoz~oEB#}*mRPN
zDgB%hc2VWq0w=^V`aXpLmK1U5Sy>Wx4oC`>T&^i?T$iN=U}f??um=z*;-ZeY$OWIv
zZlioI)B0tICK<ax;*(%=`E6zLB>-=50l^0F!OHVIn@`RW%aVl9EdLxS-PAzulhMtJ
z43mY1i#hjP>=4t&VdVLk`G#Xy)MBRZK5h$Atxp$A1|vD#vwF2l1$XOO#@#hJ)_+Rl
z&+3KQUBeY}s)kHJi5v37gQbU(0)hizcdGNz%0%XA*`Yi9dzN1$nF@jUa8UO}_V&Yp
zG<3{Uy{{d~LfiI+UOxFIMnp#wASkriCkymebqOL0Ude=8=4jk5dSi;J{i{}$%JI{n
zYq%{3tZ9O^x(T;ezwR``=;ut=4<lMPz^?2#SuRmFaFz6N?6SUbRr+8^S#L;zG2dZ)
z;JG~wDP>$HLa(A-mEXR}W9JXJWbfEP)!oHfa8L-ArJUr88}>xb$m{gO+UK3U%{B*9
zslph$8czB)o}CN;yY=9DHkrLGGS{)k+`t-hQ(Me!nOJt4?0wyHr<da2<<La)BssYA
zh8!uA?6m9MTf)XLa$T3XCN{mmz>Y5>96H>=)Qkcag`5eS-eZS<Euk$bd{TDm`uCMg
zvBjq;S?nsAvLk6~r(<@NioBLJ;ZZo1?t)8PO=qc6?d2JF7`H9o5!hg!i5=gva9~p(
zn-ODCKthMO{^QnblxKXEN>i+!E4!&Tn^ci?`bXQVxmg9-IdyF-CbR<jtqcc+yWpy9
z!o?wMG7;!!B5%O&@M|j~6RJ7<cv|~w+m*K-gSVP^Px)6}_)BfNfC{pNi~Kby&+EId
zU^VKx<?p}D(lL7b*JqaN4WfR%90m;C);)8_&C;}8VF;gN-!u*E7(!rT`#v^_8-^CO
zL=^JDne(}vIX#>4WAWYuf-#d4aNHOkcBsj45V{t2!-zVzLw!cq@u&^nn>!(_eyilN
z%CDlGA%^j%%B6y(t$S98r`0cAXA2naVJ)N_p3L&6|7sYv?RnpPIM803FXg>?ofRcM
zQ?~jA`p2`^=tWv68f68W8tvxF`G?3ed=6orWL{=yHqR#l9sT3k>ydVANau?d@7Lzu
zArYiw(XNBVl3%B`Izl_Es66=4W0Z?xo|MXLtfa7ZKFKEJ59Fs-dSLBx+3MqYu01!u
zuj*!8AR+xO3LLq_v7Kqe;*}t?ERBB`yw&4epxHcucl(`h`<3eMfLNM~nUG<DFbuK>
zFggTStS*4{x<Nd0@EbMbPM9>)D&{=pxyf=Ex-y4gNnpzY>b^WKz^eqMmpRyS8A)|)
zFNFWXs9Xxf$aF^HiKh622xEw7ltIQ-A8;81DVoGxL4u>(_4)ixX8XB(Oxt4-c+9y)
zTp+MCAos9|J?hzkVVEW*#^Y9vHn@Cduu)VWR?dy1Rf}Pyrbk>ZZmu<f0|!3xDKM^y
zJO=x=IMQG_*tn{FOEF@NdTttcb$>67OyLFHdnOluvFxK!<tkN7J)|h8q}rx6#(z9}
zEz@xAS$pU8zGG%ny^=!by0x}mZhSH8>U<+NT2<@YIb%SAevLZytI<4J9%yH$%6}kn
z0{*LOxTEBo%k{cz>(w7udgsfm<+#7rN3M$bzgxvrZSV#s*lk9a4NkDlBQ`j}I>RwI
z!3HPTy>^1Z(e<!>V1^e4hGUx86&}S7Ar2<K<6+x18MmluaU$-q4-6zvrFIr5yA(MB
z6{_p`+Af(_1snlIOf6Z<EMu1>88t*UEqPPwgta7i`yMdQyUtXW>gSIBuP-~JZ*4;R
z5i?oDIJQX`VaKH=4kJ6nc3>G16PC@4bztuMGNI{0Pf2O4>CWb}7_1L;E^lWM+I@CI
zoGEZG-TG9u?Q2ZcSu7s-L=7o3xIt_j_#VMd$bB3du=AR}=eVZHh#fp`^NH3!ik-|S
zOS?QwXlZkk2F*&Ttnl5OlmxBZ&ud%BBqu=8{og<4B%LQDkITjX)CB0$I0av?innDX
zA^CbsN=K*dlF2lT>QnORngw=9Xqp1aWU{NNXDQ%UontV1O(wUEwwa1udh;tS%gCtf
zQa?qsJuZ;Dfuy=KIV7oWJuC72@VNd4`e6y5hpTEJtE)vRX7bk!`O3*;B9oQZb#%S^
zt!DK`h9sh3;;6YgMn-=q^fT2pc%lo;ZF)xbiDljnMU+mqXDLY*Wz33Qk!lC9cqFLe
zQ~5)lO<$9oOoakj9(>KD;gElUos)bAbm)P6ZciNUr)QtyqUxmlAYWQRxxP^MVD%H`
z2gEf(fo;o)utNfdsU>_&nXrYyEyMF3IsQr|ciLOd+vqCT`K0JuXz8M5OCK;sYxlBQ
zthcheA!<L|?IU8L<ApAcs9|A;dJGfGvT@{xkxxU%xBdIf>Gdv~ZFJ37A&^QG?rMr}
zJMXQ<5Ug?WLy=2+%v}Kb!i>IF^7AP0d_Rf=HVmI&$7BQtCKuQw!sXlyx#5w=ebOkT
zFPs?~6<h2vg*MHbo18^!(jj#iO8ckQKgdjbE897&zm(RqJ?(YVzCBZ3w;b(<A5WWN
zWYX)V<&gKfrLw#~tebfF@wDpEaC$%JG%l^Fau0Zta>36?elgG+9o$uBqVa>HkZns6
z`=H=mgM}mrZ0tFXg&l)4Oamvvu1|PGspD-m?5@B0@ft8`h|7&(^^xRnaS_uviOa<n
z)c341`aryiw22V95zh@ENs`A}HjRt#f18u!UH0Ws@EcFAhlPBPT*fTNa<Om${_a`^
z4oT=^OE}D8j^lH-F5F^3zSlnk^8FThi?pyVz2DDClAyP9I*p5>l4bWHG3tZaC2~4R
zfOdJ7<)9_d1<>jMNxdY_t)48P&Qd=>_*AAw0u@6gM(!YKkI~y~p0hShP*FEor-qUI
z*w2$}&Y#U@O83}`aQ{AK**u4#kS$bcnW5P-b*=`GukB%xwX`XKi<k4X%@Cu3`FSkI
z8hY4jbpa1fXJxVg^f^oBkU|)I!KwiT@KjfBu!2l0H2fHn<<1hakUZ8h?KCt7#T@vu
z%Y{l7UuCOO@bxT01eFzuTm@l&ie~X8q~(!np?)87Q^%>!yc17nA}_L3@h(ZSCLo@}
zIy(`3r2-L}U4p8K3YN_TipyIDyccu2AK=|}7>%eEV#~82(#Ughz^IFfV?~ie9aDJr
z<F*iN0K8YE?bRgjOxSuwm+gtaJ^eeZEtRKTt^qy4kI^e2*and#krT6B6{x^cQx_a4
zkL#tb7Sjnhzp{CWk~k7<!4gsL0g@A5rBCCd7WXynd0D#~MTemI%^5mHGm;nLSFqw8
zy&+ffsWVcNE|oKEDmmA=nCl4PH)qGq4VlBFYQ7GFUh%@pXFB}P?Yh8TVTB(K<e;uD
z9;l*a?v*N?iAv-wzcOt39}Y(S&;b~vCe_KxHbcdoGGz<;rWBy5Yznv*TD;n9-?R=9
z$$q&UnXqHCTRs0wjfTQEwz!IExV3?P2J7jTM*400IF<#sT0XE;4FLT$N6f%dHLz4|
z{TW!Q9yLo99C!~KpzoNW;GW}RL79mi9+{Yik%5`-IF4Zx>V)g9XLsL&-Lent3efKf
z{cYiX4MP78!0+WmeFX4(kNBZW4T1wpSlF?Af&;<~OlU-1N?qYN{)3pVXc~XoJWtyb
zvz_Z$@;OTg)={MtYg@}m^HxhaKSxJ$rf0dD=$~O0?+q7%S^V&k`DWxW*Np<~TcH7V
zo(NOJB3Rg_?YLe*!zg;(cAgE${Ec>=dWYW&kpBhEIU6zmgRN(+t!GV0gtA9mEBImQ
z)t$o}iaG5Ae!yI!%qPVLpibXVGa4&%#r8Ls%q90UyrDl%I(DITSp_&O4U2xTeSHXY
z7y=z`UwnSBdY;c2HEd2W7omq8I|y)S5C<E?j%-H4fHUuL3mq!ZK_-@oKdp*wZOa9H
zQM)5puY;TR1q~^Gcl1k03sZ|Wqjg#+JT+>ICf}gziY8Jrc@Qq8_Wh$<^#aMNVd7-@
z#*+7S)a+XBHQXuvPopR1DT;TIF2>bG^((ZyE^=dRPE&~ftVNkKQm*bC6b-Jvaos++
zGWu{Z8lb^<KCnk?>JRp~3>;#Zjw!GUF&d6z*_beDV4FF%V-Y8$k#&#lOh1sM5a?$y
zA(9;O=!c(2QaJC}OX;G0th_Brxy5o?BaN02R6utL1qt5dgDS>|=Glcz3x1XMYAc{N
zbOa}<_(b5qL~jJ7mV#tcKjuVg)#zPL*o8W?XL$w;b)fFUyK|XLTpq9$YU9?;Tkdtd
z394fc+`vUG%A<&5FQf)`Oln}tIl<I&Eb2#u2xdHj#q&<#=l&*g9<y=>r$bxFlc;00
zf?#@IszMMc02&9&Xb$2MsOIqbx+_J7*u?2%jDF6_w=*&wBl!R57`>G;E+ky6muNSP
z3d+;@4bS7rd7`+5n;dQvGP^4)sTz`py_P7ap)ZUOI}W$7V-k)@7)Cg>P2rHh^g_0d
ze*97CZ7UblQ6!gYs+a1hwjTFXxjhe_F&N8AID3|lorj}PZNTU)t0gO#Zi|xSWg#iB
zmvx^`Pn#Q3$XMHYd3P5*q<+2s?x0zGY0csWLefLlFHAdRB5(}sM$Ce}-Na$wTR1eS
z?GxXL3^DMI+;m%)q2x*kyB+yy*xUEs+m#TkW#IPC-Z}%@yFDDSaXL}d;iJ)U=l#*T
zyjm+B+IT>8UKkFAdvPdKOZXul3$7h7;Sd`WGm5Z71CEK~dDt?2TX0G(#{GNFCu17u
zwWVXi5YMJ0PGtbx4?iy{(Os4KU7aVUeyzhBv)<&ioNN+O-4(~^ukqv@tIRZYnbNI7
zQXX@e$wfx*Nn=uzm_;2okRs)7Xu?&~AGRhO(tuNg`PiZn#J&4ICc-kXXPAy>7$%J@
z`~I(uIOXwW%;zL&mdWnxqxE+6>J8V(-I(EfGA`ZI86HJcga)D5v_gg*KO#8fgkjfU
zgt}Hhxa&S{Th9_j)N2bJiS$w=*-VW3$HNLA{$>|NSFb40(UQ+%&;hPt-+65*I;k`H
zU3%u7?#*=){>rBs5x;GD?+E(u4_{lF5eunzfr6@2Sf3rMRo0*xeDy50<GVy^wb#`6
z>ZDc_=x=tcu|B7t%O1<qT7NcWuG)Uc?RwbN6{hnk75NXct9$ivp2qNk>F?gTZ2zIG
z<Ot|L-#62a6e&K%)A{s=T(NeX#gn*%2AFr1V(SY><K0Nr*^MykzM2838JM9JQEYi6
zzzzlLFg1Ma69EBvo*?3pGl47#f?d67NhTbG!Moz@tAwvLV&FCb@LHl@OXeG-y=!G=
z9HhNL+FSWENPB9@4AS0bH2XblY0npg8^kcNMO_a&mgQpVSuS>6hZ>>n8ix4*4BN`c
zHWNAMwpCQFG*0hi*;cP#o!2~v_3P^y9amtE5r&c=kF_FfWZ5K*C45Vy6EYD^6p!Ld
zEM}RUPcpO^t9y6H@l$3qH7*a_E>45cW}IX0aT`0fNiZ?F1)1$!%k@oS8taH?@6iHL
zOrq;nh>XYCyhL;XutpR`={48L-I?6FM-O{;n@+@t7g8)t*TN2QIi}oV*su&{JIu1I
zAu&i#+3z0)!0frpRNukBGe%O06@;DFM8ElAfdr(&Ku7CYd}RbZj|(!T@njCz0o_U{
zu85~`LUKucJ3xf53lWA-u?idv*UuEWF!0G&sA#w>Gnn+=fr?)6b%uueRTX~QE9smR
z=)=LEtJdvghNz2xyeif2kQPN2*}f<*3>J#JY@xUhM)F!LeAs#uF@2NRF2%MBVP+l^
zn1rT>4c8*BV;ZJuJ#tEeB`f)oh<KYv=P|0K(8B^jOs6_D;{v5wiDtPdfG;6VS0AA0
zs08+dt8AWt7WUgb&V_vPMa2*=r}JnG^!0GPITK!-p`(mSwwWJ)d2u#^Dj_T=T{@Gi
z0T>SD-AwsQ+yJ+7D!<_CUfAVa-s9+%&F>$(?RnF__ks^c?{M_qmeTsL&)$GWw$Chz
z4G*$e+K!2d8CuvP#BseaWOlR#sJ{N@kc4Vm5~`hWNDnI+l@NlsHgT{Q@(??gCoqk|
z2%CNoGVa?n5<@bot@yVg8P%;Mqk1D4NV4xFMqX#7*e(6kyGqv1RS`>h)ph8h$~dJ{
zs#bFN7;%C5e3rzF=xjD12PdQyszi{Yf#X!apt4fM>7^*j7zFn$z2zK7Ty}lGG)E5Q
zJT!fVeanon;~ErG$91veGRob^4H<Lqu{HlCDN0badf&79hCLdP4O5}kzLbgutQ<{w
z+Duue)~d1{E3Dxd6(ka%F~zenf=_iK4-l2ttC&kw=~&gHQ9Um>C{1yyXyIUL=_Fej
zdd4qF3MtI~3hbnx!}+y8F~6R8aya(O!yQr<g&s383EcoYuIXZG`X)9F!K}!p#PhxY
zInDjB8kok$&1&Ne?WDm&XChLlFW8Y@MN!NIvORa-9c|;BEiyz>k}RP0kkoGd1a9U1
zUe5Kcc6CsN3vKR|@!-oQUy@IL?a&5~(GwM2+-YN9scfitxhPma12^0~{CL_bb8A*^
zeGJJK!>djE;ck`GT&wtpA5W_*>Vm95?H2Fi8B`+wcn3Sj`$OmoIzd0e?s53>RQ?Ov
zyfj~bDn$-y`ecp#@Z;%=qPnIoX>A+2206jii0BLB-Y^ZZ7LU!geZyUUpPb3I=eyhp
zB5azTi=D{vG4X603&*zLI1n~}I5J0HY`me!p^F<N4mtOxB-u~i@My?A56~(+2(jZ+
z0~6mO*cBr1EZYby{>TZuZYFP3v;E<S8$YQY4Fbm?a6s;cUDp*%A?X&?(@)R7!J>aV
zoBlrH2KR*Taf4uA2!S1DxHu4@g-s(0J<Fmlp<58WgLVA+)^TNzdn|@=Q-mz=LyEaa
z1$MaY;n45`OkKwg2#tKs*D+PED|_vDY!_sAlOr18Rf1oil_g;pf~&N{V|h)fx`nb>
zJ)4)=l$0?;wa%&FSU+U>70F@LD*+c{tn93@bisjUeHn9^9KKLwwlYinlP6FKsVbf?
zRs7@$02ShtX7iM5AVY(PNG0$=<{~B(vMfA#Lh3e(s*UQcsBYtvC+p3x8@@BkQXYdY
zNRq$BMNH!)E*Dz{ct&zE6{W~QS%;B+N9e{030Wyf9_#NC7vKLjC&{~P<2#oGBFsU?
zy-v59o%U0SFtQwk(erG!=>GHdm+`e%W@Hl2FkA;a4mGi3TLM$z1E-76P1A`Ym-)B8
zGOe2~&6aTgb5;tPWf#)wvrWWTn{XwB2p(@eFc0EV3@$6>CMr3S)A{s+To0He@g#i;
zNw&VZ9hcSeJ}Y;z){ci>=pAxbPZofzG%a|&%U*~odmm_Yq-<Ekr3JLR;iCWZ|Neii
zz-`S{6#@23q-6qtuY4ji<<LcME7tT>pa9m&;4T{AG5oF=wc5u4v`rOUg`7!8NtaHD
zK-opVAvuA<$LL%nGcbF{60H_3&`h#^z<Vi2vkaDAOcIpG#YIIccMPT(`0vRR2+E#L
zp+c^mI8UEELC<D07zO~lmANE81Q4CnGAq;`?v1I+M06R8s~Y&%??-`VSy99^5r`%k
zyTG7<H>7vPEjkJ1)^6In?&&=`EXy)N!@{;f1MCnH;gI?vHXRn4HZiHSR<gMdM!V$|
z*)`N@>|6)GnF|)rVz7;<*+-NYK<LE=c9Zy0=C*9j(E>#YnLunCDI}5YxW#ar<w)Bb
zj?rI5GAo)13`-Zw>8fUyOlwuG$U?9=q_0E--c3bO&GRH?3nbDg%bA#pw7dmx;g;#N
z->h<j$aZKL;lOe@b|MyGY7v6D&+Wh<#0b8GDfrIW<Iw8#t4l#Qa-M;`P0cmf@w!v0
zHKX+OgXt{Ab!GfQZR;0$l}}!ZOOd=*6X#!mY@#lzh^O;Jx<NEU#j2;@3ifJNpr1&b
z(Cm|bP}X-A=lXm)J^gU-Lam7&g!QMhSHCvtEjrZvXVvAOM0uX^VuU(x{t)LySwEw5
zYsG~^t9FVVL1L@ti6AneR*ie5Wb*5USQNd7-y0uCtEzfCr(m_5Wcfl@)@y+r4PA{&
z9hc{1@oOT|NqOF_<bC(mk0bOQGR9T9uI^1}{8Q9v`Npzj`{AXZGt@Nhh(W_3yH~es
z|0$q1y5gTjd6nfCjlFe@4)Gx*2-DkM+x1x$w1Y$TKgFW|?7OTai7ZaiL!WBc@K{gX
z=1wauYyXR%wvDx;v7EL$zSww`M`Kt&yT1lc>jbbXho#HDEybi(H;<P3_wT)C|9iJN
z-JBGEA^g{OO5*wTwaCFrPbT75y|g5#n`d*Hh@%`X9QEr*C(RSRFEBz+Ov4x>Yox1`
z+m0(e=Dkw-KJ$7U4nLl*924ouhU(P5Aid<>+FO3~=8;~t@QfZl@MiZ15^l?}1h$#(
zm`XqRj7-71-WgrE@fQLt>2gfbpAJ8sZXV;^-Q>m&Po8I2&%lRK#;n+taPI&zOG<*E
zPvsAJHho>08l;&ao{EQPwf<5JgY8**Es8<o0kiLY72>?{=lt639p@e}O6G!}k^JJ8
zNF{B9oe!Ln4{uiMlX2L-9{TnrrJUh2KlINGBJ1##ANp7Bs3F(-+|CyhJ@38b`K6_{
zJtVfNbd&C?MkwaPgQv(cZgZk<f9T`*b1=ylSzi8Saoai`_&NVmNJH!YnuzpQO7dSj
zqW`bf&I=A&_)6nOtlJvPZI5i9uX~N$PUCiaqqgsuZ5^@gbMHWAP21DRz@Ts9Re3IQ
z>2Zgh&bY&veB~^_$O;~8n7araHxzz=J?hxl5s`&MH}tS=nGlEUGS4*bKl5M(0LUU#
zS#s41+wPFmuI0WrQqrW=IH)R#nvPPGUh<BEa<%JGCuVDk(ai)u<TOj;GLuDpWw+yg
z-bX<lH#CTkU7z{b@vQ)p$g{A`{V*Vr@FMFAP+8tX?_>4xmyjTE1EztRErYLd@HGy;
z#?RnuRA&VEdmgZ#vHN7-&DaaWZH>j?UtGPz5B|l$zc~08H~tL%#lgRLzigLZ-BLaH
z7az%o9{h`s;xiBa#mDfK2mfL-G=qQf0s0qj!HM>`yhgiP&hM@B$gzAYgn%`}x3R-a
zfkSFiOhezK%oY)|A3$C=oz3-32Nz!7hg5|pen#I>Q^#F&A?@c$@(J~9$8@pjGl3mH
zGBNQ?2Mbqtf>Yu6mKZ!qgC}W-S{tI)?o`xT<2_Ml#$$CP=_9k_Pg0i#chc&EZ*V6K
z?xew;wDD(fCk^hTHM{5FPSOK0xRV~I1$uBNJ&MmfxRV~kS03C+&Cm?)q`{rEa>+bK
zchW=mDp5DIISCz1eH&7l2pf~Y;@AvWXqc`iTw_bt>&KRP)4L67anr!djM36@)G%y5
znq-`|a7@Nbf=$m8*fC%>GS9=lusjl)0kuRpFdGlaIKK$9@ebthdr})edGdXaxm_lB
zp#oNYG*8Be&Lv+iB1w?}nXW*jVMLXbseBIpZRzH2xPN(Eup}$yxd1<T46bHqd6phO
zc_JIq@|7!&W~hW^X%tW3rT5>`@4$8O3FY%d6yKiE?>-)#m*uQ@dU8_CXR|CXkEay}
z@-fS%CnCkayghj}FOw|0IDu}R%nO0#`?$<-O<PZrWPx>$am92$0up@vG7x(L_wals
z+wu0NcduI`v}0T5#YrZ~m`}=ip5iQR8c<aprxP5fI8(J^Ke9aEASU*sD8i28yEq^=
z!){<%+_R~{0x^Q2?)0Q;S;N_1W(^vkrqL~q(f`io)hL&FmY^MY{1rrjCD|Nuv`X4h
zQJ{GNw_s>q%}eE8DrRJ=fCX{?YbAo@>B{lpnz<UQfx@=uo@Ba23?<^KL|nBH%NDi<
zP=2=^$gtIH*DS<&fu@qFTYQ=&SzMwLf-)JI5p}4;5W+#6XVbV4Xpzlxl;snWY7Rb_
zAaPj$g=(3Kyf}XHWE;Qri#j)L3#$QNpw$<IQCvdiB?7fivlMYs5-dIe`YKm7&q#TG
zjGkv{5lfgyTo9T_WJj;8%b3VDnJs^!1)8Uc<S|ARz9sz1NFktVp0PPVLIl5UZtU%`
z^IGgP9B#Uyfx|%9*zsHgho)~~+ZMj-dZsYNea>Ll+Qj>NH~3Q*GqDCoB)!fOc2s{-
zO?tg@KTt`(nyFSrtdEft^c0JHYra6g(UCZw9FI|N#~Vu^lHQ6(OE9EXAyk}`%Q&mp
zlc!{%&J38xs56h@=qPSKzplGa-lN+HcE7L674sSOL(|8CL=JWcK=y)=VBd`#>Y0HR
zxaR$b?7c|!^j9)QYpp5BUM)x^i|y#WxGD@ZB1D*8kSh5DxfE;Hp<bpdmm@mL#f0Qs
z?#Edq>+7$|c_H}nvTF%jt5=uQ*)+<pU1oKt-u>10&=;XgT<(&9VP=Mq7M@c~0zbgQ
zBP=um#zJ$QcKHZ7GFtL#UrcQ;tv*A`@-erGI%A1WAALBeq+Crl-|QkU8odVn%jt)M
z9^?L(Wqhv~^y}7vEFp1Un#=yE#rVIn52Mj>_wCWR`5Si7(`%Lm?~eLC(meFghi<L<
z!7MM~o_y?AnL%6*%8)&KEiL#g7Sa%Y@Ocd8i)WwWoms&T)OS0$rTCM(V61odx7FLm
zBRR=T*9aXR2AFVeVTZZ~CI*kN5TO}y+hJZrhm&jtM!yy+E83^4^Gs%)St(4y3ARF-
z>>YW-`F0o1Hwlf_&j_y1{i1@8_YXcOqI>YIdA~jgH4NKW|7;(P-BN#`y2FpB-TDEI
zT^E9?QmPapD~sRnL>>}#+`~j2%QIrg-*5|r$3s?<M;E}np8&mj)7?d&zDIKLgB6H<
zn|q#N2iOwCz>X7g91=k>F)4SbW%%5W9)W%J7wIb084J-H>C63mhSt7gWVOY0zTBqU
zGp^<WBuHsI`V0oveehy~h4m>q2#HVKh}oDE3uvuF7Y9C%u<KaF6?Wv=))%0)zAqNm
z&#afOT6u%6`t@{GW%2GCj88ut{6s&&$EnQOH`i&mX{u7I{mkm>U^srz`6LH5bx1S#
z6(fKKHTABmsn?0M==*OTy4D&6+^2!dap*V%JE0w6VmdbVg&A1BA2=Qh@4wbsqo*s9
ztT%#*_!0ySK<DA+DA8K%QAcDQZP#Fz@wZwQu4<IJY%Z$>nCNEUkObj&l;T3dJMX0m
z`<XC84}E1aPQsA52Bto9u){+a6Xu!Nw`|i03}Qzve?Tj<M#X%|#n~vT!}9z*%k!bH
zQs1J6>H02awk@#Z`V5Bwr&ti*b(vw<G#boJtISRHnye1U%G?BNRLIr8<&Yd~OLqk4
zH?H??#qrjLAQrPEE{|419wD38pFbRo-kTpkt9h!|x*OQ1>XI6MyI$d+%|bN*Db|e7
zV4=GGl*(r$zt|(KvXb|oOY5AJ`t><3!>J8+zN39+08$JVs&!LrKqB9kCF_yM<$+~$
z!K?r~0d=uMg^dH@1=w(G!z7_=5ziXjz?<aqCXjp(&F^^#&S#dZ+d}<qNY`z#x~nh@
z!u3;hK=>s|nc#l~PV#iJ!wx&Rf7iIEcR=d&UK)h!b>lNnW3U37{^OwSeYEc1A<S=A
z;rgM=*rpR0P8b@PMl8gRO?@1&faB0*7K?042-kZAh-YxjO8%7Q)*V4S_geMXG0zWu
zJx0WEsBPNV^<57;QRL%LhyV-bnZl!XU@<o6yk8dj{B~N-niV);pYNa&-1|gJy710O
z=N56rts$GWw6(LJXuCS|NK*|x4#9XpbPp>1(o`A(kMFQbfA=8I4^}>=f(ODkee4M0
zV<+-WObGEY^$lX1k;7RKJV2~-z70;<Qxoq5+WB59u%8$4{Lq(a<a?CCGPPM0V26W6
z$%+WJBg?QH!*in`dZfVTTU@EP2z?&b>SJHBmKhq%4?|3-6Jdw)00+J>aTGF_S(d{X
zaR$rN=S5o#mZrymgx+SX8UWFc-Ox1vqMNZ8FdLia%7EGE{S26m&t{sw<ACS~E1NT$
ziomBf4wwkAV?-7vJhZUkxh56dH%-$YWb;8be;nBezKmc!AfngpNrQB~gC}Yr#M*SM
z4dI6U5g8EC=&=Jo?znXQ(1q-XdeksY8%Hjs*zt&u!_c8Pv;<`~^Mk<LLe{hX=8(C3
zZRT>@LAaG)v!5mGvE(c_EEbvqCSDX;*a;jP6W^xT<AV6aBg~@fX5YH9*N(?_|LAU>
z(Z(mL)1q=w>J)4$hc3!4MV`mJNjriuu6~tl#wDQuvAl$5P^{BngL5)Ngim9cv{$4Y
zONf1)X_})aPnx>wN}fE?x&e4+bY^9AMIclWo(0b+q|YtSVS5H)e`^ZjF*?t##3jJ{
zQ`I2cYJ|?q+iqf^rlV?8##K}L!*cxo+u3*D((hhEl4Uf_askPgzde~<I{|Z1iW#O0
zEdQO%VK7eS5(iz9l;e7YAak`!#tfK?axp>&*O;*^OL+_(A<5t3B39{_w@j5;WrP1&
zum5+1Zd_WB%9-S`o?&tE{cm%UyvsJeb4il9EZo0Nx7Oh~zWx?;?OlZkH*`XXnKx*N
z9fJm#x}0OfwTR_AjzQLD_`3eCV%>CGX_2M>oRxxR*@YCNwo#_5Go|v^2p(_sw;aT!
zm~NF4zb4$|TiFLBC)(+UgDVj4o|=a7r*9CI2M=ahl8{*;o>sq9cb=wMD!!qFUBI}c
z9G=Ybr~hggw(WV}d^nJ}lW$9fKl!%gbuF+0FiGM``ZN(y*)0%7Sz2Pisz0@i*(d$?
zm4L1LDa{i8jjHGBJTApIy1{??aPZwTxuLiA&$D`8d{u2w=;&FJWLMJC^X*B=RntzY
zHlE1Q_^xw=6uJzSrA3y+oRp$K7oy_G*Wj2kC+wo~wik0MLH*S!6BmFu%knzQZk1E}
zT~5+s2D!Z?PvIE76DdhcBpZ41mn35s=w)1#BXkv)=Ws}TIFR=s>!@tjxH_IBiT<|p
zra3C037=Rpm+!q5?A5HOsYC1Se001mgZ&$E8H+2`-sU|uBnc_uP$hXDL*8+DDk`*H
zE~eQfOgfSXINspJWPxa&5sru~OQdBE1BKy)Tc9gJE<_4Pxo-b$C!&{=r=BLVKYtYj
z1h3tsdz%A7)Nn9^EcK4*dYE|J!JL?m9|_a&2))k<>gC#6T1MzyE>gY%S|;^fbTkt=
z`tKielFk#7$K~RGMv%^0uM#CoRf11<jV#tq_(t^EWiHnlveo*OiL`U^+gzj|SVff(
zSoaHlLtucs1;pp}874<>#|cIpAxy&|m>9&wj&He`ct(V|5FBzslgNLJERySUmXPUG
zPQqrwwYOzG>$<Z|Pq0YuL2=5(40b$KioRXKPBgB~{xW|w2;qP(<|Iy}uOks9n&bq~
zJ)QagO?8t@Cg>DRVT+6b!y%4Z$*0?Xh`30zQcP#%;^<XAc_}VM@>;feB)8J;HOM#J
zT>v^gb@kY@Rt9UmuD)V+>YnSQyF$8tle!ReifEj+3x#nWjpWGY0K92EE1{@mRxpx~
z{0PRpUFo!4&S(VlV*Ru2j*LbKG$C2D>dAj)af&YDl%Ik?lg;7egEB@aOPls|L;hM_
zcz@X2U=Kga?vq3mOdPEkoiQ>-z0{y}uSvlM*2uLWDUu8FIWuAx0tA<rgo>o~=B;Kq
zQB_o$Zg1-BoQPA3(K6^I`TyB_7v;8*BwhGbYPH*INx_nFDctN<N4UGkv;L#Itz&!o
zL~Ps9Q8$nnlK=+*B`fxyh<%WAUT&Y{L{{O-D@ainQc#4uB@(DA6tb!^zs&q{CKaFK
zzEYs>8;V{4mX8)R_JY9jWgs!}rNBfOKK3DLpIc@q4a;*JLmseNsW!GUb%EW^shJ46
zZ(3~U=O4=rxeSqp`}vx4e!2Oz+L}@(z7#MR)d7qk2`de8A-(8k6!B5rFa%{!k}NN^
z%zS*Sm5G`W;3?!1Ezw1P)PblSsS_P1<kASRWf%q~!gR6kSSI!vky40|O2arpYlq#|
zvZ<m%K(+d$;a>Q=Foa~TnI9@Us1{8n3tGIEi{=1vn#*AVGG0kxDScWTq0<`ntxRk6
zWhtK&(suL^Aju8>PIyG&YAyT4I1WH0-^4;saaTjha!uRte9VaDVZtmMQ%((RnSmcL
zGay7ffF*uFhLYYy?`$p&cCeQ~zUOw>b^IsyZVRC&VGK3Qp7ta493LyS`e`J!Qvc{t
z4yJpw+9<P3YS>nQ{m`*6akzzjGqkWPLf7G@O<d3Jx7K}PP<z@`3!OnD@aoGDJT{NI
z*FNG_TXd?`3eYhW*hDjV+WcrlGxYi7S316-sr-C0X#cTz<<%(4M*6zy*Tt(oPU%En
zRQ}eu=4>f0rtPE4CC7rE)<OGa3>pp2K}2<H^XyZVUaOmY@#S)^kLESHpT;#s$LNn2
z4Q&`on$#mvUpCCWvfzpStH-MjAvdr2{yM`<J(Ke4x#?+__C~w(^uu4Rqty!y781^+
zi#_fWOaei$Z<rj5z;Qg+VvZXea)sEr@Q9_sB&|@9FyS*$0h4$h_sOP`M`6LzAZB2E
zE5&U^1V*764nSusZklCMsHl!8zLr@Y4K<Y!C|eW~*|R9yfBavWn~sGXN7pjF#d=_M
zwBnjbzb>zM5f9QcQqA>N!5E?ATY~#8CY%_Ua3L_G1_PE`8T!6uQ0qD7Gu{aTg3H#~
z3vE^K@~{koy<#uVt`1+8Zw6=8=|;EprK*72H^X5n^){zNHscNtS^77(>#$zDYP3-Y
zKf1bUk_dHE9Sqs=#*w7?gif#O+IquO%J_rq+5i~!*(e!{?60ZX{QlUe33V%@cM|a=
z-hTG(Z8$j{ev;o{vpnha_Lb<oP2&7xSqlUxl1{eh>MF@p6uNq`NuDQ@lc%p_nn$Z-
z`czn<qy!5t3``s%F(rav=2)J?eK!<A@7GxmJ{H;=xD1!7oyy%<`4abr4jz~?(4&Kg
ziw>Iir+el46hS8kqp0;zVvRrcMcGzKNl)-~cu*oaS}o79xIqN?lmjTr>q>$t#F%;9
z6_#mH)3#`zCBL^^)G|xnbjlE{rCD=WXLvoAWch#vjD}W-L*ay&n9Rk#?Luy=>4d(J
zBowQ-iu<(I>Zea@eZaI<l`FbSTI&jS1kICCkQ`))LGuf7tI@TbOKB|=Se3uyrMe4^
zqbwhwH*pS?SRs6(40s8naS_t0E<9`Hvd)tlfb|+iu^z+5MAwapt3SbfrW3G&v!Z_;
zy`AOJc#L8x)%CGx=KaFeirQXV&nuF3%f!a%G)<-{1l`_mva0HNEB}aVI-cv>40A3$
zOib6ozVC+E5Y)4!<#6e{#}vM;7stIPtD?^*s;9NNs+|&23weC7Y*aPuZL(3_An+}N
z5ljQ{_&S_p%B&E(hR1F0J8rP@gnXVJw!1_EDrtCf8K+Iqt`Pet;lb-uN&8gN2XcJ&
zsiX&=O1g*Qc+Ne8G222h`vGDC89LGn8TN@SF|h-N83}D1FoQ9Z1kxkycr#B`c3;D&
z+H>aVf~L4R@$|{1=&1+TDr?kn142D+U{gv5*un^=(qh<hZDINWCydA=G&}B|HM-pT
z-ecD2Qx>jm^FLi_8-YhGY=fu~DjXcJfMVBniETIm3+V&Y27FfepX&^i`$_S9s>Vm3
zx_QW{o5!2EDJkQ=0Rh~G3^1{Ug()*_OdT2$&ks$LKR{jM1KJcHa67!e<jkkFOZIV9
zhZ|RQ>@n?qs8k;+wehD9l{&ysDeq`?I@5Jc7E%`rKNOhQzK5x86KpbWSRS=QSD1aM
z)ZRm-Y!|N!lu~-ua|x94gkusJP#n5mh>1g8%&5t*O9IO#KIf+2^Z)n!{}03e4<#I*
z0R4X*G}W*eRq>X&P^mvY(hyQ`R2>x+B~^tu0ggP&$4T;a*NkmlA`E9VlsMDhLJz7!
zOMThD&N7J;-Ba`0?Cc&Y4s49c`iqzWjIAcCnAgUbbWB->IE@jzozg68lmmE;QeBB)
z6b(mMQ68!(Zxs{RcNi83+#N~=5J61txCS<)XJcY;2Q$|+ux-o0F%0SZoE)$_L@mdA
zsTj~$P21H8*bsZAnthO30E?2dP4HDfY)gh=h=b6uF%cfYzUQ0Ru$c6jB@8dz5F_7%
zc?~d6zjp<^tz}|+g!n6vlLd6I`tWI`P0mGNwM6`Rarw7*z9m%tt-0x${QK~$;&f;W
zPEX{2L|~0!32F-4#*%m*CSD*g6T-%ULzzj1$32H1Q8-mgl8b1nyYTq8?Wf)8`=3Cd
z%cAbLRS=b7xYUxqhZ&@$5ze8It7~H}C8N}LnN5u2vl{lwyx$V02O`{uKJn9I-Cre)
z+Xh{E+$M|>sA~;DSB67y-~=wVMJNo@V9c-|AfxEWg0AjlnCu>RwYAal<XH3Po}j1A
zKY-Y)Bc{z4rU(qn6j-_}#KdDJ=zbQs?5Jg0!t&gnj<S33)xNjIyTxA})NXn3Ay{)0
zJD8jOJyGA!_p&q!Yrg9~466^rS~viD^83|?V^4nnaOC$L!Z(vN|M9j1V{6Zpf0vjo
z%0*z>9P@xUm{7;Z%pejA!|*wE>@buYDk!b~^2-ikJUoeoBDtmG-=i#I(KyO)H$){(
z%NX4fw*Exf+IS<LOr|uA3X~_x{_>9*9e;XodMgDj_3TzBJg@`9H6(Va&oBwVk?fcZ
zQ=2j&m<U4Fvs?8+TTdux>t4vMT4}Wko^1@H9jY}zf2biy(GJ&I7N(WWrqd+Nmj-I-
zz$;CQg_9J|V*P6obfsdmieRjOg}!MCg54l+pu%o|1H+`)bA>A{H?RX{oSkh9srp-{
z!>RPMq8y@3GO(hn0>-oWhQ<I>7lY7oR}*@RZfKeUzg4biuJ8?5KdPB19^Pvx)%Ju|
zOuF2qw#0@nB_<w(Qu)%uE;S9$7sB*5g+d>cQ)GX9R!c&u_Q7IRi`>J7QEkm(<#FM8
z!XelK5&|NiP_Rn_Oqg&Pr<O}LQH?$`pT!+vxyPfi>W<MpewJh(M%9N=by%xCi&b+<
zGWo2-sCp8sm4yi{lesR(hG7a!m@P0PUWh}R63gJ6($GKhsH?khSS^dXI!x-SMNM(5
zpsP?grtKIec4QzhaYTRvVF=8HLtMkKn9sxGvoH2aT(#Grt0yc`+eS{2kcHIuTueME
zFyS`Cz9}U(IWbt^TU>I{TOs?7oVp*zs;%veK62_%2tuB4<kS%dPT3*oXfE~*U^p-#
zXr9>~rc#8iXSp^pAE2&ukI+1F;M5b?Ec?KzK5*(OA5T4hRnK3w@u%mnn*Ztfs~(e+
z)R7+H(!?QkJxm-)F_4tvz_V=6CYH3l4Vi3xEYvRiRUTdw3H7Y#s|;=m+wv&pR%l|v
zpvHk^8rZS9Z}`ly8CeAn_jUfNpT5rD{vx6Nold5&iy)&KeAN)^cH~v>Vg|-o%|@l-
zdN%Vlou5~TE6pnFj?MB$^>`ZJ-q73gbHpU4vrHL<B_}dQNxBeDb$+gfeturtj;B*d
z6^Y^@&Z5a|tZ)@&0?yT>&r=G6L-HFR&x90b7wG(4J3chdnw_7cNagp=W5p`aNj-L2
z+JWe05$A+NGNDlnAzT3bWpb?VRIDSf(fN5X`9j8xeqemnR}y^(AEl}+AcCMTc!YYE
z#0<bnm>Bi&)uRvQn^Ea1=jRA^YK?JbQ^_NE>Y9xxmDx0jvxto)%)sB;Gu)Wj4Dn<l
z3%V3YM=qcJMTU}_7)^?a{rfEbiZx?dR_y1EfHw59`Yq8@bR!u$g<r}BKA!+PmkNaA
z$r$D@O5)EaXXxK2f@Y)F>aO$iCd*khh3dn~I)~2{J6Z8<p3X9O8Q{;LTz!2C`BPZ}
z`+b%dL~H61C$~_`QC;@=L<xstXY4jN=jSVGI1bQXzVVS_pwV5y3p~wJ8fWmL&rmuW
zgBt@Hd3RO3V0~j!u#QzBbuSB1(@z+Il;;u7rgT#IL(b1HRH$AKu{U{wvT2eRG-ydF
zs%6Yp{VX7QWBuxCi65oOY&fdk0jIGjNb6vs7if4vmIgyzS;g}7)0-cEInzk_#yG>b
z37=)9r09Xet8A^c!h@(pD9MT%p^eAEMKR8DMX_i&lv&<jc|$`w-5-lvQ|&1=B6!zZ
zMIPGBkiH$-IJAiYDujc5hdbD}P0zQbPZ_tKBSe`@>x~CCFD|3&ww%%&-GDqV+b}h|
zesPdAHqJ_bvJps062c!*x}?>l-o8N)DPpOlUj=M{Nr-Mn5g)Z3jzBCp%hcH+Cl_-V
zW)s3xAO9SsvVl+*hb{QTW6=aTn<<VhYJLrRqJOz8lO|zu>XWc&Y1!57^KqM4HORfh
zka)Qq7Tp;YEf<pV5f}NSZ~+L#vQh*UY0HWy+~VN}b5{+@e%EE-4$2AotU`reA^2z>
zj;>nzd~ynk-Pz}pg&De%Y5B}`it5tI9keECX{2AFWx(s3O-_rZ>tU2XwO-P?AqvY|
z+Fj{stDaz0bLv{vl$x18A@uw9bV9$%KQo#C8HK0Clr^shd4hv^P)-DVpn6$51oZjj
zwYsn|lvVTATzHF5{sS_W3gVSaIVgLVD1~Ktx_IX~G7aOxKrdT!KR{;jj`L&+Nker6
zM1Ajk`fxSw7hf({y!)~SL(xK6grVxSN-u6`n^5OrzUx*Z@^|$W<pa0AS8ud&jrzN<
z_^{HUtIVeZhuRm#=zubnyWP7vm9^-hPcQD4UOc#ed6ek8o#c=_v>bLFC4id>*)+De
zfqpxAg)HN#iFx-YNVcEf5;0cM9Fj*9I_|j6J4IGMwIupsN&wtIBfqDkEf0sngtI!l
zhm$;+{?y%)Tec!U<}{D8JmM-?zSFyJElG3p9bH8C1k@Fo-tl36S4rYKJVdu!c3WCo
zds%l`SFoEzliB2BG>ic#q;dXpG>r0Wi_^Pq<!!2woT>@yVV7PfiHQ>---)-89E+U<
z`6NqbDQ`B>S$s}%nhs^Y)2(Vtc%On%P^y|;UXb!~HE#Qq42NS0?<S<<Om>~HkGgzY
zJR6TYbqbyF-|8Dpqss}WQ)e3cUf2Fc(Y4HeE!~7pms_M5%Ab~Wci%ZS%TPl=xd1oV
zsAZS&jGi>zfLho$e2NKUA@*G<vBRX}n%oVH@L3YUCDVDN82)U*g*q7}TMhvx3OZj6
zEG}_VEr5$V!G!2PqG98LRN?F}tSnEHc(^b0y+<Q^G;&8YQaj!tH1TJ(w0a<NBM>=1
zWsizM8l5o6B49v|_r;gX#kbx=kWVjYw}&9x^U*_)yPA*(4$kxtWDh|ezm)e7WDi01
z5aj&Y>><b=f^6^AJp{QW1lh9wx?+)r6x22y8=Hotm<S@VZ*Yn|=}-{_GVuL}Wg>3p
z!JEb!5b@Y)ix(nO|Gj$0Dn#|U<mU({w0-FiOl|IAB0?84#|<!Jlu6%_CS6%oYWMt{
zwNkek7q5wR&|C1-px@+>=Fzo0ef!%P`Z!~gC<Da2=A<n%HZaC565E`zwFI_hY6m($
zU*FUDIhx88tm~SJM+KHEBs|LUl;%mQLen?rhiDv31#uVMrxHTq0TNHph+e~ZigF<X
zq(WPvE2#NVVD#tb3dD!x3qZlni)kI8zkT>c4=c|pA5C;(!0K@CgQhk2@3KD>6hx+t
zF#0K(-ah_*u=5hPnMG{DDfR;{F)^i!8RrZKTrwkYY)UQJr{HZ08|+i?_L73PWE)k<
zM8GXoZl-%?A@972x3}>2&J7uGd)m9#?%d6Nd)=<RF<s~?jgmCVBgpnq*;;CXa~KFb
zZ`)m(&*CT^zJ?@{S(>UmiMF#C$jVv4O^$UwTIF}$TeeVGI*xJmUPs#`3b}+>hUE}!
z2r4llfrFWF92{~INQZG#ibJm3x^n5vi7;-lI%`6D5a@b^6>j!9UUTKr%vO<_cj~=C
zQ#scgIt3vwWPVVt0iCc@Oh|DZB%UadAD}mtyq{HU=n0x6ag--%vD9k9bRCkQgd6f_
z1sVf`HLB&lT+~oXR>%0DxOg7baJ9PkNTc46Y5gKVqC5Dm3Xyg~OUS?qup8PICWaSa
zYS<>`EOh;Vn+~&jdafpQp<+32QWxskZ@=xPa4w4KMJJN<Nfd)06J4S_$v7R;w8@f=
zno$FjD6TWS&d%y4=(o;IG?T;{O)OHi|1?f!;>~orm{q6Kv{d|p%KC+c@cE=(zH@nQ
z^%q6RL!M+goDHX^Q<`S-PuQDIKhPW1)6X=gXJ;4fo6ZLH-$fiMe0;fGON~1h0y5MV
z^k=b~{Q34bUC1yBPv=Ju`B7Gp_12gOowEjw)Hi%AH;m%)<<D>l6&s_m3Ubh+P+Qxk
zF_`x|2H0db4Z*nIA(SuUZy$bn=oj+055FuKh(1LgdMx$XwICuLX2!hNnbE`OHZSIV
z&WkD=T5fCT60zn^39Q#NE;c(w8qv5`@e9D^#XekI49B?oRBx^2r&%ti>Q}vg{5^?c
z^fijbC6rl8W}qgV(&6w7((9`}+7UpFVg2!<5G}2&oW1yR$rC!38JDN?8`8iygB!G}
zzv}XG=O`{#=D@0Jixpm6S`FlHAAVUg4lQx>_cYY2)wfns(teWV{Waygef`?L=Hzi;
zoS{Zp+3KCsjQ7cvD<hl6QC!gFZVro5*KL_ZqYFU%LYW*l?!3nu6DnkHZkySm)WkNq
zkNXXiX+KVL3)tx?eoO(`c=YFJ>`vQ1MxyrdM}LO){(bN=1)K5q4>6sk)A18}7mXug
z`-i!e5Z?ckUdo*wN57jV@i;9NW7ijRFm-;GVUZ1hOJO)2u^W@Qrs+5g2NpFkacmn0
zj%#8I{Hg&Zf*o{aoKAq?!NZP^Sq7ycgX|WoVQz;WGDc|-h5@F5BQOaZiYXx+yNqxu
zecz|nsxrh!DuIyFDwovroU7BcYs+OV+bf-0H$Xonlj&IIQVh^r8jTgV;(S@pX_|1E
zWy<T4(;P_NO4zcw^(fk_vZO3a@_Z~~sj7db2#SZM*%K00c#y57)o=~&87{Vo1*w~s
z#LPD-4lIL(MEKkhJ=VRpOwW#3cN;QB$B7viBP>9aR+pD>MHD_HXgv5lXM?~;YesQD
zu<@WE#_KkQ`@xL|pPLrth9TSwVBCBcpyNL97@B}+b0`fh<bj2woRx-k`M@KXo0CP0
zsu<7bllS>Zrk_vF^iON+TC&pr<+8eC-jmcw=v{Vaci?d|^@IxFd=u00Z65LLc*=C$
z5AMhzEJmug_E*sJ6=lYKn}K^(+NY5`+WKLE2!v-6ifzYZm{4wG#+iq0+civKbK5lh
z=g7CQH>FM48H$WUsnnW}xAFaM8r<B*JYV?>LdsHsF3}ogOJAcnNgF%78ssHfb=$?<
zrHxzPiOUXmy%U24C9}hAbHm)HVyUOOoUuz}1#@Sc8f6p%jjN%KGgJN7TEZ{UIE1QU
z&COT`2(CYgp2+U6m+Ucb|E3#+Mrd+uh9-nuh71R;BeCxoo^6MQ>3hLZAxtmzM^{M}
z>5r~fKtrF>2%>*~m#K(&z6<2kt*Zw1sk<zCETO0>+PDRT{xp^}uCOQy@xU1xB{!{u
zN5xYPQwo8_Vy41^bNy5;EUJpY)U^Yi2neM|im!{=*ba)aMd%ZgNz6@VU?N--`_lHY
zZMxJZl=w`T2Q1c*(WoRT)1sv7TeKx`0jJk8t2n#$98+FE_lgg!4zq;|N6~Nug(Wn<
zBgprhf>YJZIV}Qq>p0#sbRAJWzFN>rQLUuztGrbTO&YP8O080bXjBM&DkoAzb-9~q
z0<#p+F`6oRN|hM)RK+%#;vz_SJCT*93|u!P*bIrl#P&QKc-+O(GCVKj2J=JOE8<%#
z;z?S3GA*{@WvY3($t)=6YWIxd;a-$<y}i$?>X5vuOH!=SUyF+dXi-z|r1ffD9W`!$
zCoVhP2_-RF=hC{{{;Fr|gUn{*{GxrFby1aDcl3(#Q?9JO`lLQ)b=ei6A(&_3Fc1tA
z0*nBTOEIzCAh1kf1_A3g>DDGaEpv8?<UG(+R)Zzo_t{PO^b$N|cQ|C5O&0d*cN?%5
zea+5D2txaZF8+AYuu4>jZ?!-F@j}h>i!U|Sq90(P63kp9NXTtMexDukehl?gc8TqM
zd=|s*q=EW~{7F5uIw*@5q0tjQ>T9w*S*o}$T<Kvn&Ns5KbnNuOEzB;eRuP-yaLx!d
zap3tjCLRwl3oR21DFTaxCbf*CPpt-oZGj3(gCuVu28;5MI?CGBZxuLF%y&fvP+%S<
zp?a940|ZA?k;AGvhBNf*&+qYE!Ci<J3!^bann9{)Rq#_c1gAH&P=J0f725Yw#aC3U
z>u0*8Y6U!Mxp@0qQ;pK~bLVVXpk7C(^YenfLzhdU)m|3%byU<yuIj<+hdaAKZxl$R
zTjexH;g}8)EvM~9G0rRchA2Z}D*rK)aX!AS=a6Q_H0~d|S<8&Ier4&Gk4xT!?JyjZ
z65r&3hbi|ROqgq7>bn9vCbMnkP+z*w(wVARy5}e<mM*OMto{;REEdR_UTSL1sP)=u
zsR2=jdggC=l^dST7}Rp?lx@Ai)YyLn9oo02bAYZaz3=I5uTxX)TUy@IrM>8R(otcn
z?GUSBhZsxjkoknMrXkWEQI$lmh2W}q+m~pUs<cb%jTYaQLm22Lvi}|Bqk?6=O1)iC
z(Dtly;8a&OzD6SoIAL*xO7K-X{+esm_v%VG71mq`Ul$p=^Hle0;$Q)+$);`1smiPU
zH~4l=C}0x*O{KM6EH4SrjM}VU>J_g^|L5O#gY!R6L^5Mzd0M5LHs4B-4BfaDX4_h*
z46x7v7^R!41GFC#@?iC=NAT_&^+&6bEl5T?S+{v<>CtQC*EYY_9=<x0xcQy(0qU<7
z^qUu7F6SS0*>$QY>f-z86LXK+N?#(qJ6Y?-{afp64Q_igl=~d2pmy$X4SRHlGKB|L
z$Dr6)4^gm#Uaot&UM1H`Bj}}C&rQEuAIWYFx@<4hdTM&1J`$l`u*#mFPYn2kdlmio
zs)Q{92|LL)d1%?*Larw&!l<h$plvHC1#awV>2wHGdU)&h!HwJAo&4BduTF?p8Mo}X
z44lZA86m@jc`go&(8iEiLM+22rq7;%XIanY&s9u%yCU|gP<#V%3ZZh^K~Z{y;rBWm
ze+k!hMT9*-@>+tAI++bs$?sczcN9kuFF!7mJ9K`@X7+nF%NsSp#SDg7*8?xe=F3OB
zK<{Eco&jsWP&Icla1&gqi^}pmgW~Ux$t>kkyQQm1Dno-|5JE~I5Gv^ZHT!=xhfI#>
zb(GA~C*vwEho%yQw{;U+fz3^iaBP@?hY1gT%ovy0c0)-l>G06(qe#mr(qd6`TMu&!
zN&P{`sib0VCH(we$vPyZOLRjsM3>9>J;kH;JS#oV%AI*u8r&I*Oylk@{=siDze&=s
zzv|?!ccMch7w;MPP~VBOv%&n%-f0X!>+|Ne>@*IOi?>ls$8S|=UYQLtXdf&)H{EWg
zY_|Pr=V*)79q0q^zJeyymF+Pj;70i^DgRtckh1)YUYvu47dlu*tupU$R~`Mi)XlED
zKxH4`XrCL(A1|s0(o<Mnvt)Saj~BJZRSfaPm&=7wx8l+f+*<m;=N_eY^p_FvfA)^?
zXW$rrb|@V&`pETz_M;y``1^iLuWhi3!1IEDSQd6{X<#C4hJDkpu@!isFu6yF++cX^
zxuEZH*Wgst7EpxK#Bbw8*yQm`az0FnUgA)bn-CBlvJeyL+t{})iOtY5Xh<y23-({4
z*Sc$s-bUc}Z%Hm$l6+P4ZJWZs^;<8K<fMo;F3^)Gmy^DJr>c>e3#4TK^0TU7i|IHT
z#;+jq_VvBh?^NZppIrG)fJsyp<~>yIq!1K+4VlLUea?Lp?1WE;G1Tjn@sJLsDEm*d
z0pbZ{E5Ol(8=ry|H_IxHo+%6tMp>lNYfh9|417I#gsZPLMzznfoiNe6R_)}}V8oX$
z_L=Z834;J=@+l4j?pd7so*|CR0iYJlV-@XO=)5C&zUFrYdH#yBXfhisGcG$rd#cQ-
zE2b}kv-_>ZSqSPbr8r%Ka^E$4?D?L9i31YLeH%-c34_~&h7aMWI^<HE`W0_OPd-4A
zauKOrOG#lv^y>Y&6rbl+xf53MAu_Soa|2Isx3Zb@bI`F;rRw-DwKDJ0uiivIMw143
zSPf#qBUE0zQ;&yQUvX8r#FoIUua?++#bwIV{OMKgAPYAxdq;g)!d*B@`m%%vQ9|y(
z3*oI^+S@<VFqJYshBAxY-%JNI_`bp2CD!EDb=MA+7S0N6$MH=UyPQ!>ESKQG_9bQp
zvpgCK&P?mbP2hc%>FUz({;G5-Nj<D0UB%+su|}6m39~KEG4mwB#A6IIlLa^=rXxa6
zx>mrCUsCUf+j|`{(^Gpl!J9iUdz-}aq)kH1Bq5kMriZEYY|J_FJeQInlwObGtfNU*
zZ{dN<l`I&)eYKK@tX9(3DY>VLSx-q3IA-2u>Y9#ec_x;D<zV6)1XG)v*l=kmrR8zM
zTIE82p4fe-UH>t;@!KatPmSMG;~(MP{G6Ea!_YPZNilP{1EF;`4y41e;X0HG782JH
zM{ZaG7wdekQNg=)s@yUE-z@%$!elIDdbS^Mq>g!MhuWx&re%3g8>47S-q^ajj*f6q
zP4XlTqu~s41M{Rz6l{gusIVXSpz*Bb(V-Rv43j0_F3`JNQ`%+-NNv>xsj3@-7=<tc
z@F0)ijEaVk4AK}-xt!n=s3*|z(H0@01@tEg>$*mop0t?55fwmfTMpp@{glL61by%k
zjfbkT*0M><6ZF4kG==b;Sm#n+Cy|=qtaaGlOOV9hXYp5Dyn^kFY~k9r9~d4cejqU6
zzK@x2h1hb9kQ-qjY~um&%wtoxT6nmUt~J?-unz0*%8XpaM=jNxEf&|735tgob1(p7
zH=0H=&dW@*%Qw1mS^4)uJ*92x!|yXPVL$cQckFp(cAy%>-7@?3l*TsC`m5p$nt?Y-
zjOGWr<o!2CQ)b}(l5p)eR0C<8K5G-<8nn5CC4w^-;jsSVk{uXb78!7T;gf?<(woQR
zF>C1Dw25PJhNbTkOhUuNzH8aoF+*EY(`Jl4fa|9})cZrd)1f}-UPr4x|NHZQ<N05x
zhrj;({?FP>YgJsU(#C(4`6v<DS=&qXHcGR+PB*_qk)r+Aod2z6&j#r8iK@{2`D9Ql
z(TooN{3>s=xr_fWzML)V>f?-Yn#*C5-WHwBjo@D{>u$8Ykf!wZ&#{b$`KaB=AMIPe
zoS`3(F+f?Ka+=Sz3xj`!S|eZEmKs0Y^jp&4KRV^ALN&y&E-kG9Z>VCxP>Rz}u==Y~
z3rdf!KQEQ4#aXz#M9s1Ypaplotx+UlQ)#<(qh88&0PVc^a#@u6Lw~$bLfIzlU)N}}
zIKbR&G)e=spSLF~IBK$jc?o)Uv;}rgTX2-zq7T4uet;CqNB5fVpYpqZ%g=^B<j!Ev
zHq0T+B35V{CgwrtVPb{>rqr{sVf(~q!to`QNABLl1%pQ_uOoR=22r2>O4F~(`uHt@
zpy{*a`OO{unaVAql8tpQ+8<JIJ3=QDntqi+7XYLvR$Ug(whQ!0RnBY;r*y>8ah9km
zl}w_Xew8tzvpkv5JmQKbRW<lVf28~@*D}i^7%JQxLoR<dP2vm+XukU}7hc}va4p8F
zJf(`tKnb2sX3>uT+yS#V0^3fzT9aAM6UfEOW>dIKc@t9_XH%NWnBSH(0V%AqEPo;a
z=<p_R@dCE<E_yy;q3M~}v8lua{EW<E2KGYk7<M2+%QlaEEm6*ADdo55I%}`0!nb{=
zMO0LfQ!e-ctONMv4CD?3O1bW7vrp}I&o0n^M8nZo(|6pAB)E@SK1;POe@ap)ps3od
z|433`2jF9xWl<POCFDRl6c6W}?3$RMD0*8|dqkk{s4r(KKV!uj?!*F8q=x*@fBzrt
ziEDCzz&!lVfB#?g?T0G&e3rvLf+lnv@hF*P|MTDf_w0$Ru}Vy~TVS>@ZO`^?>=N6>
z#4>Fh_!hyQ6%vau*Rz5LDE53HNdH0*NMj$@$3{&{^I}p;rr!8ol%iP#tJKYuECC<X
z68oT6*h0Now8~9iFK4v`;ILQ{H(y_+aPkVlTItYj-f-4x>MBj9GR-3igIsa{#b4C5
zQq&h0jZChw{5FMokz)yLIq0&{V$)q)e18F1k`2n_<}{UnZHc5c2VK<sY+jBot44nZ
z)-sh1-@UAF$AE}kCU~$IP|@MW+V8w93%@N-kPz4CalsE#ZgOw3OTdp8gAmL?jhzmb
zUt+-}uyd}w!q(ugI%bq7LQxXWWq4?9?oF|wso~6xP!qB?A8>%ofw8=y%O?1~aO2rP
z4XC<WjjI0RY>j}m2Q?^f8Y~&y{6npYGbk_ZLjn#WB%rC=9&<>5$CxKf)5T1<CMJ@&
z*f)j1!nFytP3hTg&?^e76a}TpuGFdvP5we1*)L!IWq6@Ab*+$snoA2xB+x)xw?-Ly
z0V-)hP!~eA>leL7(Q6dFMzLO_SU99FFXzs4@R)0(6&&0v?x|EFrRuj^sN)Nufim8+
zX=VPs)|HmFt?ymgbg7LMK@827n~K`frkhIGY6BOn^-MXw2it2=@BuGp@C<$qOg}3V
zXp3=PHaqU1!Ih2mn%qHXautGd%xauZLz4xefrG%|m~h9(LEswLmu|q_z%>HjJ77Td
zldddsW$6HGq)XO7-jJ?V7sZ`m(bYBBuB;+`N|(W_8csqK#SFBsvZB-iW971HRHp?|
zYR#W|)+m*xQ$<?sqHA!I0?V&JoQ^qAU=@iaQ<-uZ=a5>pjIL%{jTZFJQHkHG-*6gb
zUs0xtsN4f<&6e!_WkzH&#Z#*)G`OwfKu`v*HzSZ76IWW8N=a~NIj*!_p9|si=1Q5C
zq-A@fNN*~v)+T0E0c-Dc3+z^}M3r9C$l_?8v+CoYqqK^;`+QQ|z4o-#4Zls3iLOlb
z`i^N%2T*-&usI_7SaWz5gaoaTlJ=|3F4ss+V}Q%#R>7xBZ)rfNjjsN@syAbh8IjD`
zSe~ZPrUEmYr_Iay0-X(XhR%^`7z1RLucEG)HGlK6aMEJTdYBOSIX7~M37tRlity9M
zCvcUT3sg)-Rp)BS{ph>J1{#yl2b&&su<5)oJ-c92lk_#Rjxh?cwg2_uh{qmux^SrN
z^vcQoZ)9utB8zv9k6zdlx43bl(2TC(wz?|b$tz?T9i`#H;&`7&u=Wvz@$Lmj*d~<M
zl`eGxL9k~?6BFS(m`TR4%a~;g%Mq3cjsh)v7mMgR5;HoU1J3pVm_>EtE$oa6k;)7J
zh{Hh7ieVoVdZx#`EqX>>>4$<kSO~+xB#;98p0u#(5@M6Uu><!3Lf8)yJ=1cwPPCsm
ziuOhi{W-vB?UMGLT58|YBXRpg;tI*z3W{sp^MtXuVw^27uK27+<C4i$S*chV-O)sT
zfTAXkK-b)(aXlKhR8snE(Z`2pdNl6Ip$a`3*Q0T*CEKHMJsP(KF0l<7=X-uAOh<7G
zdzc7UU>2AGHW*=&y43U?<M7eAcX6IloTS5jBXLdat-vM9p7syAwOW2gu$y}FBpvPu
zy!jq=Oy4Bf1I|riNgGp1Elf<?<-QvTJ9q$U{KE&{mWuZy0B^+zdg!f(-tIjJZl$dC
z;M+dIw_=+6V7MNBt4_l{7_JY7JAOQ7ZU^kc;g0=<KX5o)4;?*p1oT5h`wjLN)Yyl^
z-3LOk4FqTVQgBKbro^x@F{O`vZZYg}!wDQ2*vz9x2*J&i5w-^mZmzxkf^Y@T<Z_&B
z9+G>qxLG+j+W}{e#SF$BhCS&JOsE4Q>U-Fyp6ybfTXxXbdY=c*)`?+vu&ggB*O!!g
zt|jHRMB<uZZ+h{~hm`4{v*nRw`VK&`^lvM$t8FXFZPw6EvQcvLCZ^-tJmOgq`@i|F
zJeo-LlD_4Dxb-n!`=rO$B5=Pp`2FN3d0Q0bcxoo_^UG`{eHoQLW$W>+fo+UbDJ^aa
zOJZ9PiHTtm>=Vnvf$uQO;>;tSbNEJTU7zgzwM^3pqA!FD%Npm3<ZKTX>nxM4q6OL{
zt*wK?Tv%qKDwQxvH5c7kqhP~s<>rB$t}bsaX1Yjvtobl;`RLPR9PwL}6m!xDO%XCz
zLxmYjhrh^cIo3%mgX-@qb@M=}kc|?)Y9vBRh(?LxOj*{ddVSdoVsb>Uqhyvo6?<Aw
zN;SUijA=uNfZ1H)z%zjqo-rKQ0_ra~p+Q4S7!R?44kQX?8+*BAHrKZl?C~qAx`Vib
z4JFYHg=!!L@2iq?u|&{&Q@pS4`kbq~H}~s*xddi;=)Jwu>(AF%<r@x$PBq{=8S~|t
zUF1=|_;NYlb>kY{d*hn&ociO19ub1xp+;z9d>Sz*U3bL=OKZ{hD8h5i6q}Q<LqrpZ
z-=hh8pYR?{STQj@0n7msz|7e~+dv7XVF>AR3bZc<CPa9cdZvR338?J{GLSw!dME*u
zhG&2zr~y?t!g>G!9=oNjRUaG=grKHlM+Cw349DZ1z}%oACbnl|X4w=I!!Sd}rSN^f
zM-UzwLFgfaMW*Bh=8!q_NTvKl;j&_8%8XSDeIpr8+YoNj*Ibsy@}MjbQd{n8dN%gk
za}OERkip#Ez7aFncoy6zYOv7xGT30@aO!b`o?%A)^teHXpFRqq#|@V8#(F(*>`@cP
zwhf@IU;`F-p(iYCI+nl$umcuSj-~0EAqy!nh<o_3fi_5rlGjkB5{&&xlI2~1f+aXX
zqgg1%r3=|BTfZ)=4c9?XyUcQ=^MyK>x?deK9|;+&0<JYvZKfYY#zQ)k0>F>D7-u%i
zrn)@dpiwDrqWx50Xn}JUCN`pDG*vjcj>M?CMngJ%GNJdt$f956mL-<FAfN^{F!gN*
z6T>$!a{`Jz+hvANg>M8sNo*Bz-@?J#%cgDXH~CNY%E9_U@+5`Y<ZI|n^)<>ZSU2=B
zr+LSU<m%GKt?$HTrvm7MUCW>EofNiR`BBf<C9;CmzHCET&}QY!ZeR(j6#SYY=xgR}
z%ckSD3h36hrgqi7_)<ThZeoF&bgm6$P4;ytkJ_30oTHRYx39m`7nXQ5#i>ihSgkY>
z;@iGw6HIJsU}7644uoKsx`c2~a>oehF<S-;YIzc(H+fF^SCmB)Ach0=xYVWBIuqxO
zgeq}%3NX4-)aw=thl!ZMp^5k{7!H}_voy+Y5xt?QjDa?c)5(-Z!#KM@A7@i&FGKR0
zj%T`+BwT&#G);ynolGQ>VF+sewf-FRhQh#zWTta-Z!5z>r%^r;OMt2ukwuf8>;az!
zt_+M2d#)2=VsHcd#B;H2@W2zq=C;-Q{O0WeJ<+vosW=f=%J1qR-<FQwQN>?XqM_9H
zJL%5);yY=+i^}#oBS-HRAEU_%Yp2(vd*_D!>GkL}M@6qkKQ-#EXN$AXs~z37Y06yU
zb3!rU#KnYrHV)j-z@ATdz_<(p*Ichnum1AOs;^d03aHH@g5!#ge~+?=MdK)k<e@b?
z(aE$deezo|F`p<~_xL9~nM`RK6<T+c{pBAsI{uWby$4iS)%a=+Y|UepuWXnmvnj&J
zG!aH`f78l*1Fl>>1ii$%Atxsjnhq7))QM?KzpZ_)DHTdX?Q$)U82p%|V&mdiGZO_1
z67jjT2*n;}924fcm=e##B9yjoc}xmx6-)D~wpY%_W|OU(u~wUDg}3A?$s+A7xjJiE
zWJP$QGQQv+#<=`dWx(Z>fw6O~!bHo9bugo*7AmYabbh|Rr}OiMW2XvmOQ0~|B#NUf
zPida$$kWX+omyE`c4pB%1igi0Is`Kd;@?oNb7eY*h(ZIvRG!wRCC$)pNfFlx4b6=-
zNehGS<R~`})40p-5yI91!UI@z8Y%d2&5ltxnS5!9(6KNzgoQ~EP#id+#Gc`Yt|yp7
zg}e8qX5DqIHL^{AOLEDQ<m+Ey@7$Dgs(0A3oRt*OMqK(N%H?Duviz8^(D&*YkU9V^
zKcC!yuJFn<jPG6}rgme@lku2NGx@6grTpeqoW$}qqx>t(ODy2ZBz^U-hGE;T`}*_A
z53nhHpQpwDMb!&%&R{x@hViSh4D)t_C`{rU1N+S@%b0#E{=Sj0k-cKcSiIK#+>D}J
zzAgs*-RF}ZmTYG#&3@jm{r$^a=pnr<$M#aqg8Ci)y=m?nt%?V!oTf69agJohDQrKY
za1c(5ev93x88FOlYeXuSbb=-lT;mx^DFgrmJ{BV|&GqhtK8<81QGPp(I316{?|q$&
zuK}V<A+&Ka9m{V;tbQv0F^d#vCcjN(3NYJsByR>NoAD9shbeTdE{L*h2L5jif5k&I
znT_*kIxa%}2Z+tG2rx0s(<q0op|8m-j<^CjGQ=d@#>NT%D#ZY{Q}DIxpyncYc@kwj
ziNk0(OZ80`#XD$DBByD3tK$SxG)<#KV|A+h1bFhZ*%-p_5!HbJ>UbEBlN&savK(p%
zsC`)N=fiQrz>Tka=Od^~r%3jusRTR&-M~3Gg$Qh|&qk9e<@v?;Ed2rgou31+F`2+A
zBZ>}Rou8u*Y8o4}r(QCyUUE^@psZS~#-7AkqzdQ4SdonL6cEKEEk~EnVuc|kD3xNy
zWi{bQL|HmhJMQYEsiVr@*v@rEItJNOAQj++GVMw-U<rrFfMXf>0VZ5XOijzju1{Ut
zH>C)Kcfd&a{KkNOuWO(vFzd%u(yt=9QTu@gy7jW;BMPfKPXQDMg{E0OC7Eam(O`5-
z{lHNi<<YVYqp>v9+DCZ`n}O;Gfm&SbC3>J$#L6iotNhnrQyS046jsnb&kzO0DbuOi
z1N65KzvxUC1<H*kupVGyvjMspMPsdxO{3zOVC#?&S_7X77<R;F>QU$<(b%U-5z6H-
z0m;5VAE(h*rDPVO)?DLBn9CSt(J-cCl-*{zoJ73bgX&!?noOjCSt%Duxqrc$*BmMJ
zK3HzKD2d0nwbMc`>2NlNwN|g#X_~OHoa_U>U$Ut5TYm}Dxg`*98aDH7*TU2^LQEKO
zG4&h|`&M9ZVz~izc%OXJ0OAFW#<z%0Cg4q~*464&q|V#=FL*^&*_dHUV|3YGHm}Ps
zCs7ROtge3yqL!Y{q4`bxdJ@H_aCw%~$@J{3ZiRl^rWN{aX)AO%M3-m+_Duw_5OS`O
z6&O71hw4Q7+z2=*^CO;ewdZ;7fZCw{R2$i!Z?ANaO|(4O#$J(Zqnc>ALP~wCTiVUp
zpcup7KK$~~Blz2gUm63@yZ1wnp*}M{pQzxbN=nfsVoli}s8v<SZVDP$<JvGyChGEH
zaTOPX7NkDai>3TD%jH!4+Tb1e8pYxg%!FhH#{MZC4$mOTv+ARrhSM0<A1{>rs2D9e
zmKm3)ZLt~{XNq6r!!L{1=+|CcQBTI=h1KgB7-z7wlT=|3^%T%;V!NIl-RC%prP4n-
z+^nwKGQca7psf5tnH)Fn+-szl?xMnYpbp2}s_P!|rEJ?~1lGfIY_=aq3%SaD{PXQ^
zJ3YsbDcJ5$<Vhfxa;FDL)YkSyp5j+JhR~K>-^i1bEVbM2@GR3=Ivqc?mr|YxJ3P;=
z1n}U=y`DQfk$yu@=!wd=w5!PJSM)?4rqpB(eHYN$)~=iK6MB$J8@yk^>JW|az`+Hs
zd$J2Q*?^1`?A5i>jpcf-#VIyJi(%r+00)L}aTr>Zy3})I&~u=+qZy$(+}%NxZuw3J
z4nq_pEELA>gd_KZL<~NksBL}&=g7T)5QFOf57=`PdKk?A32=PPnc7MSTlT(yAEdZ?
z4N1tdJNtaBl{Wh{x>u8(L;QwRZ%z5-!4YIU@Ns6_yBufi7AucH_ZT@Q1IyurW5+Xn
zOl;r5zVt2Z1l;jh;5n2ZG8=vupZwfWlR?Nj_-1R*+gyqXoMdY8*2(2t^`L{|Pvyn%
zVt}q>49=SY`bjy~bMS1xrO{Z5x@KGD>zk$tmszHw|8ttpRD#T+^Q)0ma*J4!=VKX5
z{#7}HWtt}UkyGLrI|{6t?=5{;7PBa4u7|nd8JPG?V9G-i8<xWjhf?V?=fLx%iV6+I
zp#^WeEos?W5uGB_DJHp{231FeEays?Q^+dXg6oLtA=P62RAdMe?FwJ*wp9Tw!wrdn
zLn;GITqDGR$9!z@Fkr528-XA8p3ple@oM9P8}%AbLj6ZAK|5*mb7I&N8QeFKL8)Y~
zQD7^JXD;>Ytk+^UYq3x2AnvX@2Ciw_B9Pc3A;ZM<B&IeOScHKu1SQ-x9w1ryK<dDh
z$8vE{E%3W6jmFxN;AM@yyL%ew;4Yb;gDtW>cP4p3XuHj9>0Y*$RYgtgdRi5yr&Zb7
z_1@E}^t3ATLZU5^w~9k%EAp70cJa{CLGNtsbyrmc^%&tkIBAH$BrrY9TrRLdm~BbJ
z5`>z^6iwcS3Q*y4Zd7t;g_ob7e^gQ4prcf{Ry%mSh7DF^o1Bj2Fv=qc7%kaU8rgLd
zJ%BT$GMIEqiVCf*1~ifRC;?D{=GBe)NKO_=7;i=qA0aKbDxE>{QJjpEAtXDfcx)Z|
z4VfTgnq_d$H62HyLBUuJ=#i;aYN;;9gX;;|vZ6vDToOnF`)(*O;f9ZCC<vA=w+w@s
zCimTEsEfbZgiqXzl1!o`jfN2<3S7%nL|o@~7K>)Ei_E@J$Xc<OCX#}88LlesSSqF<
zzl}wta%JmbR1xGFgIO8e4VS?zY;Pmfca~<t8WnuLn@ThOumW#bDEzndj>e_-;&ngk
zqAa&%&A&KIF5bd>d#iSX-}TF@x>EDjd@l7mbeM3bVD=6Z)_JlzxSba!Vz8=);^yfd
z)O-D}TIMddpGjyiO~xOSS;|{Y7T@pE=Gg#USszvQ+RrL^t=&lbySvwuY>Cq1_!k7F
zdQFSd7e(P|l*!37zdfD%_H2MYLn<$VY(!Ye;`7PE8(2s&cze}!5nYyW+5r6=WqB0y
zTu%agCG>Z5vjaQQTqmt(xKghO#$9Y0m&h0(<H8sql`wnS9>F;>4dcQ<FZCWXKxXOQ
zE@R5u*DotUQEM1_JTJbW%lR=vK>ORPrhiOb)oL8BDW?JHhepM8=qB4!1ebpYT1%<v
zyuH%bUGXkX;^!Lsehdb9Taum~wW)3N)TWO`$uzh}v0kzH9byeus~6Fu6j3;E4^bXX
z@&vcc?x#UtWcF}K?A8H1+f<Bk4No#NVAvE=VB-4%2fkp~XO<lXGB5(yJ7WA&S3Z0+
z^s;2!eLC=EIie?nU#bD^j9zjxG^J^USQr$lz*;sAOwYo;>06#>G26Bu0G>Z8^inOE
z$Hp$zAbR9-OXO0`T8~@yxaE4>vLPltYI)eGrPgnD!YnsqS3PFgW0pN;xpH+pv$&xi
zv#ef7k6AuH5$!R{dTM&ivXeL-L8RrLK%FhJid}AaBn&VOLyCz>ZR{Hs#g6R|(+&ug
zo_)l4C2)K_9$cAC>E!7^l`xto15?6ac19^fBebYs0k#PZF%hAG14Fvl@I7j|4wEA6
zV=T8rDPf^JHb@C$=rPJIF-n-U9-{0a%JmRsEhRlddDsZ0(r9{sa*1xx2UXT{(Fawo
z(MJ2k#z#kg`k>0Sv(<~}<BMnyQ0`G4pNC85`2v)4a87r8Qu>}J0v=$S2^$mJ^>Gk*
z5(mTyO+O5I=!6H(A7>hK`n{@Qs*%fixU#kn+N5&7L|NWolr!eb&Lv?9KQ>FCwn58m
zNg>oGepz9KQOuJxl{_Ec&ZC*Ch+P?kxqwraqY0s`myF^5Cg>xc5>K6;KwJ)aI{?!5
zT;DJa6MK>{Oc>`lke<W_=fV<!NqqnCSqxUoCJ55|5=AVE>=tmt3NA!C9(RS-3pv&h
zWR%u$rQQ}R)Usgh1gRV}0)qhqDJsY%*D_5bp>RxSa|NzmlpC(=*&)bVTmf7@85w4`
zxSWaYWY_ls>6=tw!=NrE)HE>T%*BrDdx2@&j0HW{;yhW{x*b<b5y(s}(+it#wfAQC
zL?!klNz@1JJn2p??LYB+6J=t%#|D*{0pF?%|6Ga%wvP1|UoP7XRb|I27PCM54Ctc<
z>-5`xcA3wlPb&qJv-4ykbTXmeqRDLXHr0iue~yMx4sX-!?bb&&1hz>AB$iKz-~lEC
zDEobnVd_wUZBv?|%LpUB_YAY8mh-NH2~cQEo%E#YtX8GwbwI)@TcA+kVM3mhdi4}*
z)S$T{HFb#=_2=Cc!ohDcze&=sWpsq-(8$Gm1}fV-adtMCcaV1)Lsv?rD`k1UFAUF}
zn{GE#HrxKRv+S(ypx~3*8@JOs9lJI5g_kf`CcRr|;<|ZMwhy{^yTg{}zUcJDm&=85
zwCINsjN-+Y%VmS>wfl9aNUz=Z+Wm3)H+${=;0THv5a~8ry)79N#IUg8$`BKWdYBO@
zF?RynXMxWgVyxHdSAV&(7U$|20rg!(Aj5S0dz3{i8b|r<dT~CPmc({dEpp1%J^l$#
zCR3V5g%cpk{_>9*9e+yJ-g8aIGu61cdOp@X*OE7;;*VGNsaIt;^hYJz{+Og<qs*=u
zVwpo>nGSPo%uV0K#0_jrO%f`r&j>=-32lGH1gvU%<-jZ7j<r@GHrsPeOYXNMmn=!X
zsv3Hm?70*55=w4EDWZ*Q=OoJIWFxlrm`<(l)iWR^K9`?QZeU+|Wg5nJuMtxsf_X9?
z(`hDOmA{nVyo!@pzGjqvg?WhuT$!Y={?#yS+jU=mK2h$j?{n?;`aTy`FF-Ph={Oq3
zuf{UW+YO>HiE|98<F71Z`mOl;Mn=O?{)#1I@mlwDGm3Kgx)|_xpHF_6^UA3*cTfbQ
z>7P?0d6^46q?hH`UaDEB+;hrI&q|Mdnp{UhIe#-41N@RF+F&m|!?j1SDzMjd3Ko@A
zbou~Tq_a$>&<^@F;%Sm4VUB*5p~lR?1^zw^BQBBcIwg1UsPaOqq=bg^nU*#_yY0{%
zo9V2EF$I*M=@S1fDIJ#VRuAw(PhYEQUn&t#qdejOHApGo^`i+C35ug^Qe-%c<ai46
zH%p`Z7Uhyo8m>j~J&tb?9S&0{6L{TBrbuUFnGH}X!zh+@3(9L5!8c%HrBckeR6|5z
z8mT)k(0@R##e6Oj&1Hr-jgd?fQQVTJvn*E)jU@%{=DMGd=FxB_2PjL>B#EOu(Md%k
znZfkuX~e-F4xUm*$G~g~(oqinCdx<fx0vxfx{mVO3vl_uzw>jb_%fNm8xcqYo3GB#
z^_cZ@z`$`e@M}Pm!D}`gN(gU&Im3+^s}r6uO67GVZ<K`4Fq9l#r$+8{kwq&04iBt7
zzZZA)&^C@HHE>+56Y#alw4)|rh`<(}l$g4v#KdMEW`YZBdKMF2K!xEL2OK6ax9y-$
zP_}zTA;jWcpH5|p{_C$Pjb~#D()iD_CAAKlYcWidNxhpuzEL(4LdGbYMqeR!=oUq>
zh`@V~D2nCH+(JW~&QzJs8`$2aDXfNuL!T=L)Bv2gV`xA~K8|9w9^h$e;fy9~i;Rbj
z_9^GHl=9mP^lNh+MMVYkViC=45vk0kNi5JmW)c57hJtO47NabiL7<Kd6TKhaLdTTn
zS`J(5?(TsIi(+1mdn?W`JM^g}4mL>OV-ivyvp|^Gc4T0=fo-{V(4*jufC51yI2!8W
zjrHcZO#ybOK`=}y@V2*B)a&xgNfZO8_39D@s0r3hqWBap&vH7Mo}JaL&~MwcLcc9-
zg${@45<#3<8iC(eE~%EVzStz}HiuY3ejZod48YGnX&2ai9(w&r$yP;W4>DA}7IcYN
z^JPQcCyk4jl>!5L<65=<!sUfD6&J&{r9RctQGS}`a;kpS<N13M#pr7ki%ZaelNo4Z
zr*t?xLvUP_eYC;c#<2c)p^lg(sZ>0nW0`Szs-AOzjJZ6ndi*rwebmKDT$ZMi-e&>#
zOhQ22FO<n~<IcUtVCXJNoMVZ=bdJYR7MC*k$1|zoBlZ>b{j`I)OBJ`FbtyfdYd|6K
z4BHAF?6}m&#Pv-axUPc(8JHgTcwjq+TmoE6)Y@3skDUtD*QLE-!f|DlE{lI{y^MBN
zew5A^pRX#|Ps<ASysTh9SGm5SMt}=7949x0v6&^~SqTIv1MIQmTnnMxu`IpEgkf8r
zk3G*On1n3E)G;g^IE+{_Fih8w2cA{{a+#s4x_s@9xdcvu)7*@b8Yw9PHJ0QMY?Cpd
zA)9P5QJ_o^C_5~S_-O*O5z#S-tG2=*-$46zwS_-{yJ9KDQxQ-IA<`4LrG!e01rRZ0
zTaLgabOY=Qm*J3x!gW2D8g^f^d2Px2t*j=siR@P8enA~yQo<SSUc<RVZDn1-x&Hf|
zxa@G(9SS+$t0~kMxqrSz?&nYSEegkmULXvgVOvs;2_#=pJG8J(3AI^B9D_f=iGCol
zmgV8D52kx5ao_KXkGU%rhY!4jcN-2Lea$>R)C_a0@>4WUq*0d_U+M?bO%%f|lty)7
z8<v5<yq+)nsAJ%sbAdn8eS+1ho(Wm@5il#<(YoA%Qh|Gp;Rqkw)H5()LSh>D4rVlT
zsKJTkHaQ}%^Bn9^)}7sk^i|<;cjS64%8IR_dsVEh(LZK#8I5K+?0?K?N<qh$D9UtP
z98Ti#Ei@-&NN3|*1#W0Bvx;g`Ur&?i45D2C$B{9jNK0R{y#hxW%RDO-Llsh?@jrOP
zGU5IvE}y0zeTFcKav0MLj<xYEQuUV~olmw{CuLE$-BRM+z-Ff5S=bRmU=j!eQzLY+
z#TX^r@;xb@V@kYQX&Z}PX}lVut;+1IHV9Zq_Mr2Ei1O8}vh^+75X%-rSYqOAW8pmQ
zD)aMMQSG~`{HFmJ8qqY8abA9gF3}sVX1e@j&j~@w3#@X&3cE6i7lylJT+LCayMK<-
zLUL65?_vf4ne)7-nu0S!BbqJNl%HH<`E3f<f2t&@^&;n+IlCx#<~&iM7fE=kXSHR$
zMOmEWx*~nm@E*#{>%=#xRNg2wUv;oMb!pXva;8^*-2-oF?|VOLd$6zh-kXF+Se)jV
z=t-?!M0?cYk<GDf((g<|QpaHe2ev0Mafrao<s8#Ma2|@#CZ>11@Wu88w)X*Ebf~Mn
z7QHy`(%OYk>mp1$A`C*9gffPqiZ&*eXJS7PKK8jGxL~0O<O9UW9Vx<4RM>tze4(zc
z-J=W73SDSbe%=9F(7Sz)EZi@$&{t+&F+V-B@MN9McF(DJlx1&wWMS=W_3;qTCLUrR
zMp*Zt2*)!>K&ilznI0z6bujfQ!ORhc!wknTxj0@_Ve2xu`v4U-RKI<AK;cOgz%7&Q
zpkT^wSb{^mfLRh?F)P5tlpYRz$HP1@&A?<v!2Ld2VOK0c*TH=}D50u>+an3j3Q1@d
zXx#xwP#b)YBlI}JUQ>qp2!(?WTJLd$9!FR$s(pmQ{Jive70&}lXxU%gVFcn(%d{+s
z4NFnM0;PoE3QP@RxKdb#aL7@XtK7hXa!=JNb(+FnC?_7iHsx-DdFR@cmgkrurv%%S
zJD4~jr2n`M_PKAGhUo{E`z(nimP%q5`5S1?Qy|JJ?t76HY!s0;?Mik_Fxf!rvk?T0
zCn03aG<$e^g-)r43xKp$$t_UZ>Q)PcVjdKTRv=svu=|wsdTKa7-s%;LE?ZV?H`}xs
zsQw9BE52%T$jt|&zdmNDqFs2Veb4@@6fQ5JvLa_-RoTL&gnKRFP}F<>2H(y-0}SEc
zQs92Rn19Qy*?)U=#erEcio(+<i)Z8UX;WU#fU>78K$plEAmhRqAjP14+J2^UWE#eW
zfnK)m8X)WJY`y@@<`jpyij3%TZkD=cIH;kZVk~XO!S*PPvxO$ncSW05JntT)usKXv
zG1|Y0>G(E}cvdJ|oA1h_iBy94Er&OHRaOR2RRN-j{P0M8Bt5v$g9}UKr1t<nevm?I
z_dCR-2h;D99uB%@(S1ty++n?we3OTUgtvf$CsDk`3e>Ou<Q1}vBc@5|SyGM~&AVeA
zU+xCXv|NFM&~h*#)W9ro1$GTn_yKiXJ2a04)l&s|wnFpfsEk!x1xazyq6RK1Xzm8A
z;H{Cp0ukI6*DJ?xIJn-nfF84hz;&s>79$2GCLx$gJH*_h++{(?0*^mmK(8%{+v0ip
zzHWG48_Ao8-U{U5zM(fjkid+8BLuK?A2t5=j44gFfB~1v#bz{6-=@&OH7y(v=2whc
zVQ)*HsK@?#>~DtyuyMfk)F*vl(Nkc<?6JQd`#aux<vsS-V}A|d?6JQ-Bd{y5vJL2G
zcphc0X<)~f0uy1`*!NwI1q%by;xe>^cLbo{Oqrg0Mg7VqA1-(g%1T3RGUa}W)x)$v
zz5+aaQdnO(OWT2c)M0@gND~`Svy4b-V(L;G8)is7*A8g-Jj+7uEPw^tH%e~MgvPf>
zlnf(j3C=XyQJCN<EqkcHV7L12qNF_p?XfgjR!X`QQXQMuLvzm+nyXoTtF9Wvz6;%J
zC{K&s4iK2WQDa~F_pP~n>tVLocIuD&Shk~%Wh><75W{`EEy!}7mI?a&s_66yiN}c>
zE;&aIaVzN~2M-)QeBLoorDe1Y5aOA_;Z|Va&=CeEfz2`VEfX`xCXQgzvrX&pfsl7`
zo>Kfi9qu&_DvH6@qw}FqMJ&^9fl!eeX_5|i$4jbV0dO*l=S<TKaXM4g;}@*gr-GoU
zIY`psjv-T~u>FuYJ{F;nkf!TnDm;Ou^j*uBz9Xggd{LA=32lL_l#x@V&^}D;RMFe=
z=&3xVu+aPPsb?2HRf)yH1W;*NZAMU)(z|5{mA>tX#ZVRRV`&CuIp98pvQMGx;gHQg
zeNo{9f<xvuz#a-Y*zDfJg+ls3sy>jaA)I|6RSzI;g}H14A~M$v0_ug>4?K#AVY-+~
zi(}!NZfMhh1QuJ5xUBy2%c`$d?{EOEhzRyzI{rP%A{LFK{C53Oa562aQGP4t<`ZS>
z9{+?VlPOK30&I-3zx-oH$Dfk5_gvHQOf_yACp$dX;%id`>#Mue2U<6$vtpR}F-gTn
z<a^Bs3l=geY}+&?mVw1Ep(Mae2m^bb6B@q5iQ}(A;8wN0a^RaG<Zeh?4I87k(O8yc
z!)was44r-iIO{5j;(UNUNjk|C*zrD=Kc~^PF8K`qFvjJtpGJ{dN?>hYM?#^w8PF`j
zFL?sB5+fcZvkds{8=T`AqC8Eq4E-9x|C2CBJQ<HEOVR?(9n&0~U>VA0e5A<38-pu{
zG*AOnLshUF{QKkk=?~wtA3oAhqBnU?`Dmh07$Evv-9|kQ)!O$j*$>~poc{3Tbd=}Q
z?A6PcV@cEaVp3jq!IQ~L8RJ>@QpiweXD4A8afxl$d6`jQrmK6$VUpr(n&3o)4Cl}V
zrYxD|XN@8MIE%(Pj$(8jrLzpCv}9<H;?~gX-_c(tObQ{zJwFeP^9YxPFYAG=ek^oy
zl>1t6r)@17%LyHWJBu=fRHczp<M*_|O=vn)^cW|mG5xmofu>X_k3)Iw&RZduA*bB;
zacFxsCLZxIGbF{*a}6VOZ7Iaww?g}_TjBQZhNh#TURpmFD@E-s@6~ESw(CH3j+s;+
z!YfzKxW<xwSuIt-H(|}ZD*O!k>S>yAnPsr1tH90?6^NFVXX|ZLul4FG<=x0Qjbkaa
z{~}K6i=mpsRHk?;(<l+>QwrE^CQ~TZ5K1Wu-yiJL*_5VV$5AXRXT~t4Koa<0e@$sT
z8`Ct(Z~yta{F2cOvYz2w`L*2e3;6t9946Iu3YP|edKN>5cKSI!Rkt>=?4MMri5kPM
zQ0AW~eEhipAE2)cU6oUXPCs6~fBF9BA782oJ^OqzK<`t)`pvUJvm=eKM_HWYax%?t
zPd_O)Bf$9C*>(fbLr~M)K1`*kySJ8izn{K87Oxtk-;(+uuRFKTs;SSlUv<gU?>4>L
z&FVHYx5b2QH7Sj`0Lce2EGFguM-%#0;$kW2by3f~kRhFop$7xpA;2n_<#aMdSuUq~
zU9ejigKA%k_&NuR>RfqNexgM*Y?h=sGy-pp&igNvEDYdDln3(?ZX4)PuHCUZ)Q7w~
zed5l<iA%yv;q9%x1+M5CV0w~A`B*<&7a#OOz?YuwjrL(PxN9vAwjQrK0Rh>0uu4L<
z8>-dq>Ma7$Ix}-MVJik|)g41JwncunKwGy%S$9HLcSlt>#bw<=8Z!x+I8ASN7Rim<
z(}GA^=HZCsU8Z&(gxGMo-o#JnEKk;q>Yuw9TU&%OEiqw!{rP>N=Wf`z3q!#twsd?N
zVAr+?CNwZGbsY<{kQojMq!$Q&a-^o=zM&v%j|R|hNiJEEeElmRZ5z!Xg~yf0y%f<#
z6!j#^<z!=a$76<3ey^SZsm=TH^T`b?h*zdzeD@kLwNSA_rly&ERsK?b^D0ha`I=Gw
z73L)taAlId`d7oSZP$JM`9uX+exK_=%kOhh^#U3frsHTBzk;K`-5?5+ILEN`Us=ZV
zTk-de1YGSEOUB~0?&oF{<??kg;O{=4{IDF@YvX!LpfiO*eg85SdYCWE@xD|u^Fs^k
z%ZfH9NgU-#nl0L-%G}kKY?db}gvHH6ePAQ6fcq}cX7d^b&PuGTVOYP9!DK~%RcQnb
zLatDr3}rr&DO8XH+qf9pY&uS;fSR1iMraZJP5BIR8Utve8o*$mi0bL9;M0+cRV@&*
z=0jdfHJofpITY-SMIF#OO+aWP6|=}^U|ORz%D$?JR1t;(6@q;MLA&tp{QQH2@K=~0
zm|&R1SLXn9K#RZU=xvfhIHH6yjvx%lO$^SCBt==2%WQz6_*!OpG=x~(X_93T$Uf|Q
zX)=j29ofi}IE>N>>I|XQQw7<hG6t~`7k5_d7S5bf_#j?ZrX8I(wr7WuNC$^JfCz9N
z;=pDUbDx=pAww>mLr#TXvF4Qm)(-Jj>sOmyC{HQ>ssW!Or1f+v(>A<w21P#BE$?Do
z)A4w2ZG)i0>dG$A$7%FcBVcvCQ4rT_kn#zIXl?=F*%IY69ZD5N3ljHL39Xz+fHa5I
zFgTq|X*2}?K^Q`F@o;XDHFlB@atO~-?p1KDUY^y;o5eFV9o6zx#Z7^1GXm71S}Xer
z9$$h3E39F=@Ne5NiR1VV_JhF3gxC}_S8{B)mN0FXyO#MJE95HaR(}^V9%Zs*zSQD6
zPC(9tifLWHiM5cahU6#LaEwF~SwVHGUNaQar8z}{M&sLVh$$UH1UF<vq!FMX@^lq=
zIv?vh4-K;01|)TfSQMXDe-G3k&NT9s0+!RbHcS(!s+w^+rs*jRsM*b=+0NOSD!;n&
zTKcVZZ3T?2fx+ky!h#!cS{w9gJi;F@6t4H;%ViZ~TR>vQSsOm9pN(d`gY-Pt;v_T$
zDhQf(Dd4gV=C;hlRrwVgp^Prc<#amQav;T4W$dAQHC@}zgTj-4p-he&ckVUIU3XEM
zw`!eq4#reAM2UE)9O#FPAOax)@?EtFmrLrdkk@@?Z&hb@qi%X9kZTJM?$&<XExoxN
zr%CG>!Vb8k0mGg{eN4C&U=|97EolhmJB|!|dcb;fdAz@+lW2U4)b5@|8N#c~POU^=
zm2ob>kt69>k=(?a^yJbb%WgXux2FqMmymf9tIhkYRJk`Ate?P>t8k66Dp#qvf66h2
z`jHz6ZuO`KHHVNI{Gd>@rO^75j@^j`IObv~0eC|*G^SaOGAZMMQm{cOYL=#qVjAaV
zK4+Ob7o{khrV{+x`k7V%0*{-tSuOiw(g60{PG2X|whiC2ap>6=Cc^eG^_YPLm%{Lw
zVFqk<u-voI*DFmj)7I>gwX}z&qvFx1ihwBIrCK1bc3T3cHM~-yD`)k(0F$6xWzF@W
zjDz)>zIJ$5xr~)X|EtVL2{?}7MX4enpHJ$?n`66wuf}zWqEKbzm0o%1S$*}lX?!+7
z%|8by%TrGC)6XX#qg=j15JgapBAbq*{Pb-y7Ban}`DlPXpS=8ha`p%La#m*K)%HMB
zV=w5U8dOZ>cLiD0$NzX^Ij*|oO*zfKl+#>arpBqR`UNKQqm=QBFPCl0L)idomjR6^
zYa0jEpq8cx>e~?9_u|WCqmhRFvFs^U4SQ~&y)klUcB#D>B3(4o?E(juyFWkBn<x&G
z-vNb&rQJ;_?;cIiJqKpH$b#ihqgLRbyF7!n%{^PQ-89{{8yuwDCJybGPqK9;*DiTn
zWyrwCXc#MQi#V^M2D*}GtqDA^9yZ_PpN|X<blMV<>G5m`TmnPJqiqTO@;kcaw+lG-
z?aj9++jV7}aL~`>dvNQjxCIa_XD=Jc)1|Q74&6HzMn%)!3}}@<J%>O~H@A1NXRA`1
zcF35?1I(oBVPdlY2h_H(7c$Frs87O>A0=ek2*P>u`|dz#H*^yS-i9M()C114EE1>=
z0XlsX1M{5jQ^vz6mS;~19-XH0nvUhx_^6Dpqcn*X%=N?|(vMf~@tfbbjcTw>>f5e~
zUFn;cxTb@dZBrb0k}+G_rem!Ru-yEJ&juykZABa-IJ)?lJxJPvq{j`CJ`GE39|0G=
zCDvPFPm?mM>%Bek_x^Rttw?(q7o3X#ODPy8o=Y(`q=$XSAffMhhV>8{<-HqY4gMB(
zTe%?Dkb7&-#tKtR<@e}Nm24_GxEGpQq)H+Hm97e!t(3k6n(muX1U2Z@9V2=zRp+B<
zIFeaj2AwBi(K+N{6!s4|^{ZI$R8FLbw8;YsWR)N>qN$K^6c6`r{5ZSFDZ9nxRCKm{
z4mC22JFe>sS7MJF5)&?M95_aRISp(fs4YV(j&5bWnNG*ivc>hWw#$|*s0}nnbUIZ@
zIea`*sYM$DyOu68T8}M5@*5C*$e8c8;;I!kku;m7GJ84;tnrvfzs3wtx`fjJ8-!Yz
z5N2U&5CV*29^;-ZLz6vkJVYaR8lPB}s}UBU;^uUZ0ye4k?^8Im;FO!nG=q#|$PXHw
zmFNS&7l3c1G6R6K18h-5W&QC2LaWfr>XcT@;cJ4dUc7vvLaY`8tm?g~U>~oNL6&qf
z9|+aD8KR;3@T8+IepkQm-hH^{r*|LrM(f^ffo>M-p=v2Mm$sy?gDDXqCXNwe-!nP(
z1IHCk;F~^u=3bkHT-0@{O7{%arTM3Y9<#>QsMP1vGDTZga_*XZ+R!upchNvwxzKT8
zTPhXyb4$RSMpEZrK0Ui?8XfO$Wf(RMxi7In3>y<l0~{DW!PMrKB(`Ij?jdKiK>;-7
z8CJOx8TyZ8tT2UQ$I)oTFWPDv$+9*d*#0Bg*l#q&qXO;*+F?tzy)&X2@QDIp!*wKp
zHbHrK&x#6bOQ=p8TNhM-(z*3uLp93$6_`m`Z*5d;G6g=_Adg<>daej3G)PD%(=ixo
zDyIWPz5-6BQ9M;hCUit~88CfQd#|j0*^?y8>yFrMV^qb9T8UUbmADKjo>>sVY!{Tl
zt<V=XbFe{)#DsYq2g0(kFWu0fCbPIrp5yVJOk3<a+pi(TZr@rxjeE;AQ#7L2)%s;K
zzc4nhht8nIW2cf;11wXnYPe(YIc~n9#q2DEF40_?+59b~8l$dOKS0azRsNaD{IvXX
zfb7LPKk8Z4xnf0U<(+><;b|+0Y=IhAeSS7T&SJxjys^fRnu%`p9SYA;6aV7NrTTwa
z9M4k4@s`ZrUcnxfETv0Atv!5B4p&*bPXwr0hk5XnAfq{{IRM;9@pkqx=W1H|;$ZiQ
zrnU~5eq}sIIQ4ML=54-cWkITrZT$022Ff-OKDH|Y>iRYg!a!g`Jp=m$0)Dvdm=3W*
z-`c?J_}t2J?Wugt)2zzn7{2d9z?bi_5EJSX%!F@X;e~_{Vlq2?%2m0pk}StR%W-rK
zxbeT!$@De)Uo)CQ<bEvCyP~evToJCS02c>xLa266b2OsUsRTC5q>Ax4Kc^uO?}?&=
z^Yd5eKV_QWQ8G)>n^~Tqt64gf==49|T%EPzu3AXUL{~5e)=x-I0sc+|#mZUoO(8O|
zK>w%*J)tojN=Q;cSPv~y6uDx6QaP4Dp{ws<5XzEFF3_int#>4E5eSDWZzDC^=d~OI
zU2c}+@;Sf@KTYCH)}jC9BNtqrl#f)b3-Ece<lAam+Jj!%rg@j84O3dp=rNV23T)dm
zUCY2CaD7Yy--Akh0=qn5fpn;0lT`>-PtRWc^z`g|p=XC39#uR1RbAdM2}21i-|QCs
z=bNh?*w|N8U))HU^&*?wO&c`_Ih|6q(Lqt9e3T~tkG(frZW~M21z%+q_sNpz;*u~A
z&Q!*6+370pZKqwbv#Pr+hhqU)ps)=BEC7_O+EFL^4f>+*`szGJU-zS&7wA{$_}74e
z1WACTYz<I`BPC!>_}BE0-@lk%@+;%dZCAz#3>}Vlg8VEhBEJr29#T>)nC}z;t0Y_w
zi*%94Hx-V&7y=Cth5LkSE&<hLMp$Dp9QCvGiq`HR)*Kj9V*t{XUXf9$A?0@#3-`>a
zFvW6+b`F5ehFo4P3C;6Kb)SGfO5AAm+fYJ9Z-rw2b2PnNqAqkN{4i&f)UGP{26j`i
z*ig8pXpTG@rWr*ZWgyo)<`tuiUPbg8;zp}>xgH6M!DuUhN+3((-y95yed(Im369;<
zG)m1-#Y78ya2as1s}UWmf#;JzCl;mm8IB#MxXH;qli5{Q0oIosi7(UZyk-GggUBwn
z2V48hDj-)U4VIQ0948z0E4PU8jQ~7W8Wt=%vs#j+r?A)r=@tCW_{eg#GE+v$0e)9!
z;icvIPcp}RJ9f8w-B;5#2~|RDJ;Z@)YS?fz8+$$g5x6!{T}8E=dmZcoyGrgO@1~yS
z;AT#@@2tNHoj&cby_ThmTKtI^z?^2Fu@?9B+6^{AUY35L31Y|x-c21in2q}VoXp_M
zCg|N|lwa~+rF+oo7Uiz~!iWccLerGxD}>U_NF74n0-6;3rj$oQQ|!A-`_sF@B}p(N
z$wS|z4)t`$_f%|9Ex?9u66~lR#niG?-}M|f3?HREz1>}oxwS#?ADPXhOGy3l<2i9*
zQI*SE>`|WE;Gd;>1K3D3hpoA5c7|V|U%1!hwf@T$1DLJD67U0xok(EjzZd~8FK}5O
zb^eCGgE}fejE2&HKV)+F)|njcMGAw)Qn>@E3~t*Nax2X41J6qkSV|b!aEYo0Hay+I
zB+xXhyP-;Ts)wfe4ZJuX^CdcIxSxABXb$}ABnN&r1z~W>!(BAk>FS+D3EUk#E{<PU
z>@X1b?S?C^YJz<2+(h%{>(2o6zyCj8j3ncKF%k&rQFy#m`AC*I0?hM^Q7Iv8s#6vc
zm1?rYrfRifNBi<4P+Ux*C=8qjd&*};K0Ppxu}oCKUNoOilvZL^W$Q0w;T0lQ#hb4t
zLprM6m>5Xf`JKZdwo0ZC`${!cH8h9;jufVa4Tl7nScZW;TeCHdgpL;6cb)8cO_9Si
zNZ`cPg62?9k_p!5TpaGuhOj=Aws3Ke1`DQouRH#874Xu93c!^K%E75x-oPmeB4+zZ
ziYnybY2EC99OWsf@dIYLA;Bz4gb83g0b3G_IRK6!N5{<46R>CF3HtX%@`W?fC}iH&
z6S$lqSuync3XBZs7#d}n5r74VSOQHy%`y?0HeSwrTQEb)QnFhBuv|a}PoU8}jUyl8
zz>+YUE_gHrx8=};!AZ2lPed$X?wn@v4XQpDt`ioca=^@+ZTq}j2oGNU6!^C1dX|rM
zEA+5ID1<&y2Zy1m2E=ky-~9&L{2p=6y?N%zhQy#UJTr^{QKAeGCSWnmXugP9KRhn!
zk+I7))Xr9(xjGL^CRVm9Q7$+uTNPw1@KNJ{l=+C(*5;*;#M!x}Fcg8J>>%AzmX*1$
zymf>4g88kUaW=Vy(2`AFe#I&X`ie5}7keyeDW0=G2e$fqv(?=$&xg$+`<`d(HVv`r
z+Ykw<Q%pk5!o)Q7kXou?`&;a*kImKipbm+5)8UvJx<!3TvEw)vHdNci#IzmkQiB*8
zwN1~ZgLC0FgTdfjco65pn#}m7^124WtL{0zt6w1;1sT1hNe&`n)61~t?+rp67y0U-
zhQigmlp7~C)$oiXw{t(cCFcfymz|(jg^)B$f5L)AMlVX)l>3&0fWgpI>OM@|eXbfK
zcV-f9hxM_`Q3CgU#X3oAX&O=xNg@(2Ny`ijwH%fZej6TzTm1xIC0B5bPC<eOu*PyA
z83E{2%st@&bphzo)_)e|Uv9V~mZ+QmDE$O$AIL_>JVux|mzWcp&7vG+sQh4Vg0(((
zbQ1Ip$I@Ke#+GF(*sxU#JF4Ph&D4l)sex_S&OKI0)%NPSn1>I*KCM?p1$6{p$kNad
z2RZXq6H{ey1s5D@^Woia9a5AR83DiB6ZD2}1un2g;9Xl}kuP>!wE?8gCrZ`?c)+Tv
zwh36KrS42@3ljY2A}@Gi-Wj<;9z_YIuo;RJWi(j$6fKg3`rzK1-PF1{qzb69I0c<B
zr(ZvC49C<gVp0YB7BR44P#t@ULa<3y-PCO(G@W&~|KrrAtg}O|Tda>n0g^@2Db0k*
z@EL4Q{^DZ9wiN$kS-l~Nc67V$Mc>PuceHv!4vs^I1hsf@jzcXA=JB}?^?`?Ky9Xb*
z5=XZ*Gf+bnhq^(q;d>z_wi9CNY1A|o%OipDu(-;1G=p@%WJ;T?<#Q7I3$U}545cUr
z*K%D}S_wAE7e4T3;erQbiJO~iiZ~|+4RWZ<dP6d13xcthnM{E+4_Ue-Gs#e`YD<&_
zgXKBR`G6Y|R&&gym~(hncVoZZh39_p;BAalC$6bzK6Vvd!G@)&*wYLLo2DOxmK!=M
zp$}`1m1!_n0#llM?q!<sJd?FJ5b9qhX`D`PCS3O79tW_(bHIaxl^qrN<{imnAJ<BJ
z$8wxMptGvfX}!(y33|4wdSGaCV4URRWf*s)kdhmq4Pb^x2ZCcvrx9e^D}Y6g03w0_
z2wchn7n2|gSbKn|&qYB{S}XvPZoyKxuzZ~7)nNiGY()wYG3n9E2;2yOgfPCt?{90*
z{atq(dhi?FwXM*1l@NQOVPQjugq?~>u|Z8m^>o{FtO5GDF8($z*=>rNbWyqk@XNF&
zH?JNCQVy+-r_YiLUJ+}%2&L%k3|-WDYB5e}ns1fwnnE*gZp9wH)bPcKiG;t>0w62j
za3<kZum*R!61b}tg3oVA6o+woy<ULtI+l&y&a)^f;Fono&M1kGTV9SQ&00$%UaD5T
z<@H1>pDR`logw1o$62~ag5%@k4IQ6uYJL1fRh02W8;|cq`VWC4iS98{WL}Ui@^lgP
zJMblW1VU?9?6PIty48i$O+ap7I;vWqI=vws>wu164(ld}cN@}fFmolyTvuhn4hVC*
z=9oMb;#(I2uA0p|RZ6qsc@{CX=*x)4!R`xD9zi3BLm3?)!z}F9p4*T)H|+ZztdVEa
zX-22z$?+?!^)8i}s;b|pE2(G%cG3JYjf0N5vC%9IIP_bZQSiaot{f5-FDWTzWd5$&
z&eM$2<eYYGpc?9*GRAOr(j9iz9<q%JwrZ~U`>6+VY&o*ON>>-NN9~NxGn&J4k#o-o
z({;yBZj%Z>e@7~0H0Z2(?RfHiI?%}%`DxOB%dM>6Lk*{XkM$l_uiLEuUAEgzcBm_=
zAkz=@Yte2FK)W2%FVm!WFF$EUr)1P)9PgNq24CJ@S`_JQ`?YoV6qa3>+Iy?Sunel2
zwokDZS_B)K9%9$0CI(*>$Fo914a`Sq!+*yRV^+14PY<e^WLO-hr`z?DJi!XI+BPVr
zY~<R@J++p{YrVY2CqlIgNOjCM5z=c0Qc4n}Ds5B%8qu%d0tZQTxmkn_5Y)VI@8uHK
z4xr$oWEw7FMv<E8qOO?fs=W|tJKnr_`?;dl8Jd$Ur=LNUeOxN3-*Df%aiikPC<Faa
zRWphp@dwXc(P(uHsXLy>lq8J=A0C;0{z7l^rNSSTPve%J-Y-1i?sp^lS{lIb&Z=Ix
z87Rxh&F7dV)8ew($H!*XPh<2mQp#*3&6hCtrOYH7+hW6qO24KxE&s6(0~=qA#`URM
z`LJ4ii%iBe0v-6Kf-Dw!doc)a-l&y>SFpb~=>Fh!AN?OMU*?=?Q{M3+VxpyH|7A?T
zP3B^BLvz_uC-q-Ve^q64S*|pmR3-#jC<<4KO_qjJj)(cmER(uEt@Tm-d<NSdmSfrH
z&q!%3Z}H+B_WT**+Pbpv6QnB2iGoh+txk|OZu-R3a`iHc($S~0<q<Z$Wh#`Nvqr-o
zk7U<JpU&j3wa4g(>N$*<4}*#OJdI4P+>qVx;in8<T~RwFx=?OE1q^3-pR?gJ##fM(
zF^c+jPEr00=_>AGx{Apyu5oz`-h&h_Qads^$hL5YU2(sYxO{_MfqvL&TNvMZTlClx
zGp29odL{8mA3a5y@_={UH_x2(UG~fNLZ2pm)AfC0Ro+2;lOA%CXO~!krg}EEO+y2a
z6B9e39%4^*4BPNbjcCd}c0iPvV;tD0CZS6=#N`;WdgcQ!qvQ+6qi*=-iZ+GjisO_-
z8OrC>kHW}b4c9!`o>~IY**s2fax`1SMFg2rS8)NE5-<A4f+eny(V{F*Za|Ba0}D*}
zgN)7>+**W)_);D-D*ZM@5`=sivWUZGuY5r(Y<9t8acCeMli|#pfdT?3h2{7gag=3%
z9Gy{E{?qa^3t$y|9{&mcjey61SS*F`ZCn$^mm>nCg$zq^3(d-a+3QQ73v&<yfwPL$
zB?;4WLUqv5WRbU!d7P?dAUqFZK5r?oPL8`@NS*11j-gsACW@+H!|*jssILMJ84X;=
z_k%EegzETC07XlixJ->w+vpWK5e=G{M9a(T{)gVRDbSm0ZxL}<DP&<gch$1bt}y*N
z=QRpO@Xadr6M1e!fW*z5rr|NyIyV%@wJg!1*>Q*XK2db?Jp%oNt`jt_DynOsqXg21
z3#jo@RV<0stjKi00cs5e6gB#U6)sg;-{_=9&CPh^a@-{M>trUme<yq=9~Z9Y&QWgV
z&HSLF+=yuqCm<nKJgQ;CS12Y<U}GZ;6{<M48wT2NiPkRB761CaSLudJ^z`)jFVB#s
zXcks%tQzCm%>hi>%B@sh6vs2r$VeE$Jn~{@vM!m(F&LFuFiai;%gr;dfjJW8Q8ER7
zo3)5wD*$3kK?#G1AjpG!G7OXL-`~Iel^awynV#9>7m+{(<yRtLvn`UKyf$0zRtYS9
zwByYxDRJPNRg_=3S!*|{<Ov#g0DJ$L8NW6d=}NbRqfcj|nMu7wi9+~!xH%rQ1+AL#
zM`vHq760<iX*$1slK4T@`MvnNPC4Z7D}U#iff6X1hW*e`v0+ma6RKF)4>i@cJj1rl
z`;3jn{GNc-Ii!YjE*rgN6=&Jc79D3ao6{^88qQkM-3j{b{B=Y5na|U@-tJrLJj)N-
zqVz1w9YpKdLdN@{_GAO^sq`d1F%?xYu<t>Na^i&8(I~}~IFwS&45>OK1ze-_<n$g?
zp8Zsw(zWzf6`nko&Y<ob)SYY3zd_x3tL!j893Qr_)3jAn)hz`prfp-x^eJ{i-@>Xw
zblX)N%k&2j&W*~>epl#0Rh|5bcmRq{_945fIXM*$dYiJ+n-rX!1K3l&$r>4yn_G^(
zLAlB4Feo?IuaQBy`Dpw&_vGdtvgc+H+Kz7-9=5H}!iMW8*inKI2TEY*8nqpTnD<z*
z$r91-q|_8DF5tRI6w_dB{*3^!9L$25E7NFjzO6;W$%fPtQyrDcO1h$JoS-R9K+RS?
z@D}kG-l=#NCDTdGV-tHU<}ts?d7jEw?<OcnXC&hK&M{YN&Z4g@Ifp>gEQfW%X~Z(>
zvCpexy*4vZhEYOsu}CN{SPrJrUV>8-iQ$8)tQ{<#n`O_KXKApI=|6au43?E(DH^;@
zxmhM?SgYRz-7#lln^fnsv8vdt05IFsnzyCFWP|Icz@)0Kx~dXlMbmX`*apGG^&ISm
zwn7Y7Gc14b+FYZ+tnb%v;IauD@h{Ag^bGaW8S*&ujv~$m=ge{hJE|4gk#$G4ilq-L
z_j+9G{>sL`wrtbSb#S;G94_yz!zDZ29=Zb3(mda{vF8N@8$=JVtNI}hsOp4X5NNjj
z7!ibeC?I=Xfd|z;vb*E~s2|}wcGW&I8XWS@g~FRukBpJnQ}YOI42s8X+j#J*WONu5
zkL%aSpm-b<kDZvfhpczhT-OXu)5EGAy4Wxs4?C8wV5;c05~zl$X=KRleYo7-jn%a+
zvp1h2LsvA{AR+cGC&Y%K+1T++69*<Fgbf@wFtl%;9=!d<Is&ZibGzcX8~0u*o6&oz
z+I(B)V@A(u!onrrzkNO~Q$i!Da>f`p5<nNkt9e!;mP!~Dn5ELR%Jh7Ko~JVpvb2KE
zn7M|cjOOz+$r*2)MZUnyjLJ;Mz|oaT>>@=JmKFfzwI=uS(&7>U>^mruDm^k&8j}Rl
z<3{jpz)x?^W4vK;`e_m{v|bYbHOeC|ilgFY3&H0y(o!ZN{6M@-huDaxNsGihMforP
zSdjQb+HuqA`)s;A^&yos@fe?-MJ&YOKwGB!G2ZzA|JSw?Aq*^2Gjt!Ds^Me9QFZJ>
zF2B%o6-U#oKrz;(AKHC~YWr@{nrQuNT2L=dzx)Xfz-<Edh#iwMHkSs`))0qL1bbv#
zjMMkDiTxzZ9I(*NE=D4iy`uc^Bl6h!i~Tf?$vme|<uCHhQ^*bSqeuKNJShQ`OtYu|
zrYO2@SwCKkcxHQ<;l2pUULZ&slQ^0tPa%Z7*&qtjq`(la{Zv!tU&Y_o6ppE<UK$5K
z@_w!_qk{e@2K>Xt=;!jheI*aTb9n&1;Rhfa$7vDp0iDW`oiZBK41eW;O=36)!DyBE
zH|1G*^5hBn09u9GS<BO-fxRtHWA5^v&nf6l#E}V4SX;!u;ifh}CV38F4+2od_ZJ!Q
zZyG1@`?t@*mc^u}#HU-+*t20VEMo)#>Cl!Rr#VYGp3^JJ=tHIeTU(%;bdjO=ub=T~
zg7R8`po3azra1&{%wm2`vfyC(>G@eG35ew#wNs}0(A9jMY6jM+5@I7XeC$x_Vx9Vy
z;^<mvd+V8{yKl7S_Ue`Oz0q7POrf1p)#Ho;NO({&7IInu-X}-bG>+l_tgS4ar<siD
z;P&RS^qLf;T)<^u<z>kzDFb>AXhr3VihoqqS3gUtulk{7yB4+-Tg678QS619kA0Im
zfks@HsE;vpAH8ITe8zxQq-DC|OL9dKDG-316(~*U@`@!f&5BO8Q6AUDsy~BDV2YH@
zum{Uf+3&cw05E@bMDALA*fZ%n@!>L~q<|VipUHu}*R)Uto<SpWt=6%(rH1r9V};r1
zUIiPhuJSwN{$1A3l5F}}8Xo_|+&c=mK%Ov-t*rDb+e^y|WYKxPMjb3)kJ(Y5q{Z<E
z$Yll)_*s!NvEX9#{Q2h+LR|pEh<Y3uh~u+YO)aCrFt8a(o#WMsEL&~RtKN3w1;?p}
zw$cRsH{cUa$|`5*zh!V0pEPQ8rssrzm^45OD0A8GI%-!9mk01?{=R9%Zgf|(U)P4v
zYQwJTbhBfZ<vZH4>*bdKgtkKZlyz6pd}^Qd@o3#mb@Zu@@3Tz5Rj8jPJr0fVb62r?
zNCqY@Fdc8N%*yqIUC3z`(fl>>Xk4p#Q2Yhng%ritEr-rv42;!h@z(Kzc1}&z#YOcS
zdz{)^6LW3hVY(Ucg)f+<`=K8YtSTx%4h0G(zO7=1IF{-grV`rfW8`3-m%f-42lI59
zSGmg3+v1WR`f!gwi??zj{qD6b48)|)kgzM_Vet){*@lwZd*A--F)smAHzQx@=bRSD
zHR`S<kob&0lbkJ%a&4R;IjTnM+&QlY%ekSIO>Ad5u;;a8Jz;pfJWj}v(_Gb%V&`JS
z*R`ChReq+$BTx1ORl487`u)9w=h3ZrZ)ttc|57nh<{Ro_{S)9MgiuX26|8!Sfeqa=
zuxqP2Hk>ffec#dyJG{s0kZ0hDJ*}24;}+3}6g_9EE`ZQn6qKJJpcaX8p%tn8!<hrH
zXa-i|1oRQ2-lWo+ZPSjR<2lWmlI$4JLgI*Vu~LUN0q>=obb);ESE3YMrq?T)LU43S
zrZnenQZT3!bWTH>QSg%oHC;inDTN#B&yZ)$QYPpP4Wh*ishToDuhVO!8Oj8`O1QHH
z*IycrB0ucldKMTYE>g^i)ze>H(|zB!eC#Qqf(^y?utOCU2aadCzM&A?c#JN4e4@*=
zr479;i(OzVvRsLfE^S<`N6E9ifBo$9Ur82$UK=jIfE0u)`j6j>)}HcvnfvvANY7z4
zUeTvfQjF0@c|To@V5!07VJVa9Azyaz7*<~O{B?Q_4`CHn4;#x7UK<We(e;V(Hr!_r
zy^>fqZ(h7D_gl5it|G#9NXSn!_8P8I@v)7ouM{zAcXb>81kcwoLj2u&W@v@++s5wj
z!Yi=6@>P9|4bHMYkh+#CO3-m<eq*wMsVGOc?Q_~W*d`ZS<HO(u(;X~5tAP-|<96*#
zPKwZ+iS_U&TClv8c~O~IAYUV`0(jb1id+(}S=Bc|T3Zg=SHo70`gy}*GePeQQY`Wb
zl6z``o&))5z_FUybtHagd^3;wUit7AmF7|jHskH<e7szHBbWXoLZ_$b7oHIlC24|}
zHTWb)38ewo^uWJWTGoXHP6F=X%D;DsRc#zE<&DjbBntP(=Kwg^BYs64HHlWEX1mz1
zbkL<qITcGRt|ZdOqi0uB&My>oeqqcMROD)U+&bQId7d#Axqiq9UU`E4$dors<0rEo
zwtxH2O`4Pw2=OoEMkoyHWKbciV)MhwoPbb+;bF`7k49Nm#aY~rvh3@#uMw0Ty&yN8
z5>DTU3Z3+6qc!VrbfD;J?$PxWjpVxM^a(!Oa7;{O9ucFbC|ShuZR^UKTxA{;NR-nw
zKzHOS_0SH~P_?lWXdyO;>S5yA6sxvt>yE1V#QGMJ&w3Y?{n*N0?kc-Ft@LqS;XmE7
z-gguW`%|bzMC8Y3B_TF%Zgl)1TTsMP!(UNQ`MqSp#q!Cx;f5!K$0`(f8QGA@KO*OJ
z3->A=J(wi}Ep<(^e6ig933^qCU}}=*;D1+z+LUf0z_pgnfx<O~hoWDRI12cO@~G!+
zJ{x^dfR_~;x_+W}Q|B*j^CkC}j?&|<Ue4`Kat9=faFKNaPgMZ_N;52MgeJuf07{0I
z>IANDhqmo^=(S6qcW=`*SN6KSCleblZ?A@KW==DoCIzTxR-9Do-X=*HWwVxj#dc5{
zhBT9bVi|Zv<%^6pxX$$o_7o(skGW5*)W}3hZ38Yj#+J&OyST@SIcC}JAI9d=4dNJq
z7h+3s38;)hOhOvsP&HkRdIoVd@4;@aO6GW0`e0w>=nZ$hhWl=jweG7Zju&|W%V4bo
zSL>a{t~BYq=#x0Uk(U*B_l|GaCM&O?tI}bc-$H4-6D4dh7)CUk6Q6~i)*K|6Lwe=C
zF7%@;S`&QT(Es|s|L6br|NNim$^V`%&~+5Y-1DeNQAU|_JT$xj)kb^+9*aEmm18vn
zsL4&eFYdrzVNVxKMVp~Co03Gx87JEmrr%{(!$;t&9P@c#+E+N&9>yjoY8bexZeg3K
z8a4t)!JbZ4Of_49{U6%;W+3KU+T{9eZSq~U#x1(zKQ5v;Km^4RxZ#Csl&KKx3n1S(
z6V?UTDl7WOjhfX#qk1njs%ZjH^OpjCKBIo6R)wnow5oEMOb|`-1%qvhile-~l$uJ`
zZp&h4)#{zpn^t>ik;wg3q(CEdOi!jK6ZGQ!yEml}xkRXT_3058S&zDGdKk+wPc}p1
zF?t=%qM|ff2B+ZyF6)}q*{~07f#6x<*3VEBg{7q;%0V4;+$=K&kA@<PX2%yJ1onpI
z*GxHlF{;^weoYJXo)*kFAr-5QO8n_~N!iJV3!zh;kH^jq3Hv1fJFKSkAo|ih-5c(L
zMxcYg!yV^k{E(QQ?VH$Cd><R0?qSFC2v&)!`=;%Mp|L)k@R9Q}trp?sQyjf|F&Kvj
z<8Z?`+{*NRC&O^*TPU3kZ;OekF()ZlZ(2>eHQt1Wf|s&yLS_u0lLL9SvPSh!Y2}b=
zyyo+CHeWy-IjH0$U?*alC^Acvsnjk2!_=6fU2V-Pc3w~hN?l-s$%(=x?u9p3FMlzr
z%)K8VeoYt?_)p0!HLcvW`k>$xj+t%E{ERB^nAKrEL8_vhDCo3ar!1dQ5+4H##(E$3
z<$}5?svZFs1gAxJ;uWN)?YIsa@G_z?V+NL&NRKp+tf6PqX+}9}12+XGeVSl_6uW#y
z#WgTOM4ef0R&|yJtZEe{-mCg0CB=-)-&Hv>rx~TmIqla><xlsgjB#ckw}yZ8O^pdW
zpPweXQuvz;u#Pje<3ME|&py=ODUoMeD$gFBGUonkG+WGGW;{CnMKp~H7=+fnl}@l!
zJtv_c(+~7(Ay0(LUbf4b@G?z`_mWIszrF?s;Zg6g@FDPH#Y>AKopsF{dxuS4-H-S?
zD?U=6Xu3%V)*V8yVFdvursZPW2m&W`bWaPFL44edd<t;$mE%SX@##cj%Y%Q!WzA5{
z3`GU=_GNfT5<&s&E!-S+)$~fv8^}leoMFbQ)6-`Gz@32plw-~_(^6%9%25=uh=7d7
zY#?Bq;+#8~&tt)xo^l%%Z}BC)rWv|i%t*o=?(0K2W@BfzYiOdh5K7w+Y>BbV84!bo
zE`UC0j;74zD+B50?L4np>KO7v&0ZGeC|~$K&2z3_yd+7$P+DhcM$vVeeL3mw(CytY
zSI)ZSp)n1EIpXm+c*9A($X6^793zJbMJvnQyFu5NQr``mc(!+(WV>X(yHvhj!(V^9
z(dbYeZA(7e4Y`@41u&srCfI1k3bJ1RC}RcJTsfzwXv>i$5#Q=-qe$cQnr6pu(tueS
z{&+KnFvibtnjK$^#PKznT#U#+!99WfR<_9ggcBBA8rdJSav6UOvZW`1O#dujac5P5
zmcS84YLYwrT#QOziJJL=zxgv9q!pUSYIXufwpIfPr{|qCK|DsI0l(qyzqNoEp08R;
zh*ghR*syIEJC+|{8XAV7X`xEBbzpjpKDQP5bUOfEC6eS8Fwv$<m*VKeHv+79L4b|G
zvoSG41uKD}`krMIgKl=|+VHh&zw^-pP_BTkZNq>4MmUs{gCN3g1Fck@Fmzm7!PJBd
zXTGUoS9J&`#Bz0Fn1Sl7ixC(=E6bk&wDKUJm9H9TyuYs?E1xm$zB6RyIi1lUYQjvG
zY1{y?5^ORg103N}I6Qv#>YO8c2r-rfvk1JQxrAEBp)8?<LA%dEf15bM>7ww{8O=*y
z%}pqk=RBd?vsdS6&cP)yf5}7w@DlZIgi9w#h}V}lAQfln6#yF+<O@Y{3Zct<7{CYS
zw9cuD(A|Q`tR!R}qCtxC^uXYiB+7Qft2C+NDVFbG+qMmCP|v`QXNTCdHBYy7EufBZ
zp8*=mCDvTtFkj^Y=c`XF^EM!b%`rF|FfDs@FV;H1KY(~86VOzEm6ghaRS$XU$5Kml
z>`|XAa^^ob&!RL#S+x<zC*LszRJlUM*6NOexpxMEJwKXn5ycEuBcMK}w&i0()qU*f
zM8UdB6f^LtWm5Zbr*x{TDq&x+^YoX>)BY`lrmzrG$UDk)nQIrgIMiW%FW{Ca<62+`
zGBwA$G%sXkqt&cQd>@14iO&8<UGPS=n`tRD{68otCGsNkNpbuuEkK9(hUPh$(pLeR
zpd)-VLFd$u<`GQ_4kZ}`8O=-Z$#&h2NEFERI{!g$I(R)U<rrK>bm3ojPV+@v95lFk
zCt3eNgk(=MGQaE@k}WpncDh2@bpE`b{~FlH7qjFIWFmvF5vt9OT7`OoBlR#oeIxMC
zrrDmK!B+b&AJI`8Q!^^}P^L&jvfWiFwSyH|nt<O&(}el^Bt>Zj?y8O3-;jK$+(uiA
z{Ogu+5X$p$bceIGS8Pu$=Ik3KzdQ)vL#Ren$5gQC*%TXYXk(A~1`Zs@QB0k9hU+~J
z(V+a3@i5Oquu^hVL&=78l^R-M-&&#D9HqFF!N-sY{CMst;|X$C9=i&coLzV2jXUPK
z7dVX0M8+Kl4Tw2rwBQb!f&7{xWh|VqBSUay4*7H#CJ$k$Ah^B`3eM6bDww#zh$O?2
zk4t2*f|41UQ8=9Qnk-#O`>_<N;W704PULwIA{qa_NZN7dDa?07;!;KjRY5tMrPWTF
zg-_6{P}tl>@tm2bQJDH*?Ms#feE92n%}|)kpEIFfaHY&Z#ncs?Z}ou&U>y31pv#Pg
zXGfPsG0&f#o<it%a#EU+PW*IsN)x=uPo+T#r_9cZb;~?u@)Cqs*2K7fV`1jgMMiP?
zz4iA;KeHNyD=2`c{_Xtr1mN-oQ_UBx4`H}8%TLfxr-W&4?u2wGH9MG*^?u2SuH#!)
z;8IM(AjF0e`q*<k1$$IC13L^{o4AiqMywqbPtgmOu3j8^r*qqc^M>4@<LWdTZ$FKs
z|Gan$UNtMZ>nne8c|P;)%RQ{cGqA*-p2~J4Xi8aMNQQ6n=|<rYTploZKD0}Rvb9R&
zdl_Yw^a^Oeja={`0rD;<(!rwU8o{4{n3QubcOXP<|Cgj_myj#6bd-@#PiyCDtsg`i
zZQd%W>gwe6)MC`AmP9*5TZ2+*BC0kN0WV-hzTt~;1sV=~0N@RL!}8d~6G`-j<3*#<
zpU)5joveQ-$AW93ztt->eF@;_<Iy`usnw|N{YFJ#BU&rFohrL)D!ZL3yQ`I%1juH+
z23RKw3EjskVbx%a4yx)P4gYohab#(jW>L^LNkf_yf4n(#UIsw(`VY!3h~>HN?#Pm6
z#am&4Rlivth7N162gSOnQ1+%)Us`Q<+PG!mewWYeiFjC^U>!+V9+zFqJN?R+r~jca
z7eSf(nodF2u-Qf7PU%Ucd<Mtbec}5RMR)X2#g<{{*a%Dod#V{=&7ubJRn^l>^Ks}%
zngzIl0-(@n5_G{>TWdjmb-u>FKS3fNLG(`!y9NOJjAMSm5YlMy<O$$GJbCgwrX+dt
zq=sc!u;i4j$%X5Rgj%;XJJd2Zn}}6q;A{{+ML;+aKGBD^yIS@R`$|&mp2^gK>Ju;Y
zD7F+s!G>p1?E2Kiq2W;1we=wMzky7BYkRA?VWfWP1NlOer+qeF1-*96Jc&1WD_mbv
z9@tS+W+jL)eI`lzbehqBEFut^rN54FiUBU3BwQZ`(4+)3gK37YK@Or{slO<evD}*2
zZ4LNPrnIA1l&P|6UNr*!jYXg|a(%-VoToXsfYv{tCioqCL+bi2eh>}Vw0pKKwa|4;
z)$p*Q+8Q=|gJO?pCU%KQ4OMr1(^ej%s%!mC#k?NK%~PS#k=GNt%1;oxn`+T0?;#zc
z`V_sO!GcF$(TzG7XnV#rENq`<Qnw=2L$Il9+;lw~#YR<8yRztPvqJ^1w$T@&?!dql
zIIC)+R{c=bybJ>BSdr%yVZHyjOlS=Vok7g2xVW!q7DPV4Y2{4o4~F+&;ABdCT4K?O
zzyB)Bmbe`&#p`7JB`KnUN&g~i#v2mFV(=n#ibU~quA8sLOO?7Q`nAXiQwIh&0F&V#
zKMMjDE=yt-+us1;U^b5^2V)08b+!KlftQ##aDx>p=7?k&x%rXD0A5EqMb{abuax7a
zAfQrAF-WPr-pZ&GUJn{>B2knWUhKP0R>r}=yjYu`W138h%k>4%&T2>&2+fKA<uj|f
zqJtbys@;2fig@5o^&K>(GZyd#mBkvUTB~|kGm_==;q;Wzn%VkTizLS|B_Vi((yvio
zZMJb+Dwt&U>IFKhlW?^IQM5=|B;{2Uz>OkLgjX-h4o*+yQWtBStJ+_aybudnYMhxD
zP#)#)*)|p_;`ysrNkQW{nl{(BnCZH*FRq$pE0zamm5OXmzgpkprmm3h#%Hfy1AOF}
zAb0!dR;#^A3WknSueEXDf*_#UldX%j+E{+|L5&%B%Ib&J%Y0Nmom8L4fag{<qO$W3
zuc}9D`+k+kjxR<t0ugrUBIjoZ57GmLeR6}?c8rpiNvnn1Rt;1u<PFKb@bv0X5pyvH
zM4_-;HBqhRX}-wk{8xs&$InnI4nQb6&uHENFp?-WjhpagOdvyboi;wnX(KJs@~Yxz
zXq^fdqiQ%njx=kX*{u~<rU+6$mTi4_#c#nz14}iS@7(gk5P<dT59_D(-<W@X<D6z!
zJG&A<P5vW99g;=N&=pl?bmnK4-0QUqQrcr=UDyz?38SPCJFk4TddrBB@HJSwv)D&B
zZm0?|vF)c!v0NX<1gYZ*d~f4pqOck(TVGKQ-?piBwKnit_Q-sR!#acQaJ;(MU^}+7
z&cFTrVpeX%d@(!bPr0KfJoRqm!CY>8_<Ov<UFc8Izk>;?g==HcwI#E`Lgs~0g8Rtw
z%VwE(Tc09(g(oR<m9E^|Rnk%zb;J4<3Hr&euhL{M5q82?^D-GrWeO)*t$~uVumT!=
zHbl+0oMRSPpK>^GzAdSC_@T#{=hZBt?=nW_C{3h;EzIN6=*G=7M;m-@+lII<`BCfV
zJibIocS-AYpM36A$22wH_i*3@1~yFJz(n^$tk{~S=t1b}n)$e64Y(#N;vQWhR;!~P
zYqQcS5J6|4t*YUT@O%TThphn!-zA!$w~$_Mz7}{OTF9d5bbItzuLR4xg%;eCbjpWN
z0Cvfzy!ZLEon*^F&<8ou6y5VJs{2?m1BwmJ3b3mN4)zR(=$2<tVt<PO!yyma2I72+
ztTAwA;?nO;nmgd!fm3&@iBN=zwYW-`xnr1pBcrSKhdIq4oCFLH+&WNt7D@+aIUJJF
z>TnETbU>ndOy-j(?*Rhl1&wJzpFEkMCr|!NvY_$cO$z8-MT-7?k$gcf(>S2n(wkR_
zmwtt3aPK^M@|Ok42%KybozobCh~XXA(Xqq_b*o4n=}X!@cy={$1vcF$51J0Dd6YGX
z37Hc44f;URzbLMy`ozTnF&%8UzJXn$`q;5`-!v`Pqd_MSlt&1eUSrq9H4IUmEMFn_
z0iMm6TvqMe;*x;FKBPtxY#6L9w6swt<>r*pqmWLVv2TJAyqTA3`e{bMW3+Ktluom=
zC}FW2OosPKOfrt3#kskLQlaT`TKV11$k)zI)ET&16J!c%FJRNM2zV8G+&#XP^J#!_
z1>7ExjK5gr@jhORYG>BP=+l|RpB7%x(8f`%$kBKLm1^hOx=OVoqEdOn{U@A#Av^ol
z)ov@h+)M-q<<<sRDN(g{mS+4cT~~dz<Pqb9%c)vb4Zxxj6PSUJT`SAf=}=s(Em0VT
z$DZ=#BA@1<Ac9}l>vWFEbjpzJ%075mY5%GXt8I#f=4Iv8L|HSvRfXm&Sz-OuRyEg@
zS!tp+tu2-1TUl-0lvY(+OH3508A`LFIkBBIGJW+jj|8&3tCr{Rj729+&K+kf0*w-f
z5+4&i@UUS)kdW^gSSOz6xu!=965IuBwY@z$o1AtZC^qW(L^T2vyQUFfgX$(Gnr33(
zQ$mO6lsM`D#a1G3v)Ngnyk`Rl*(!w4qe5R(h+^ul5#Z2Kb!-@lgBbvz6B>?6sBZYm
zx@9(?ua!Ro`r1Lz*FL0k^hTPLMV#()GMkfV3Yb*F=t?;tau*o3KfzY6+3FcnwE#CF
zE^#qcf?xGOiUNG1ugMjJVRF|Okg&v1c>n0t3&;Z>O%tvislc8k&@;14S8&l2rmu&#
zQee%}Yf#3N-EuQ1O9Lq!Rv4Q;si2!nceZ?ja^69Z&PW76S;F057JX$}l$^}wfL^@t
zfIH4l(4V=h_a$Xfs4N+8UdW`sAhB_ex%`sMc`EKS&4MUlN^?$)9MH<aVYav=36e45
zt9~}jsUXVJSfuKGvJH0bU38T~5==IfBAr(hDUJU{iY`G$mWbtLSB)TZFHZe0FsS^J
zfMr9_C`!VN<VCjdi$z8cj5Sv+ny!wkg7eXdOAX(`s%M7S@SOm|DU03ECaS0TdSE<8
z+ZIcekr(TBYK`1tZSbwf_NCaCuL6V{8?3gO(Xm`Plg4iP?ff<J<H-NAac51Ix7Ao=
z6@co`S#|Ie;J+}aMA-wZ?%&Q|b5{oz89~cWIm)Z$eEeG$vxbD;1SDbbjg82P%OUR@
z6eqmHKi<e==?pbnX^;P1($5ID%qAUwMoJwze$~gcS)R$~%Y~K|Fmi0QnAg=AER{n4
z$i%ZUn)|mbewBo2T?zDC7QasGX~X_<{yYt+RQ}wRFaJv>Ua??m{_QKXx`q}@G5w8E
zzlbsccF8^-wCRf^xEOJukUU8l9^FkNV7>ytXnb?M?YG(VHG~_y1N8bE^gHe<_U<yu
zFWDIz%@+KK=k6yWQ3d!eF?~hTv1Q*__+2sOY7`fXZN(L>?6fv5?E_h<`koyXFZfAO
z)#i^uWx-#yRAlGKa`hScLO<tpwSfsTSKFvf=Q+8qSFgR9AX8b}y*R}hJ@aR+9kN)|
z_mr+e53CdgXI5FVq3*30Tv_QGw0}!y9NTYgmBn&v9x_5RRz92{sS9iEt2%SGb@TD)
zFXsr38W#KyURq^m)n<p@q@U_v&XLbfCgG*pXpK+Xo9HWe>M?&;P}O}VxqqC~;`1Vj
z(&RXw$5C<2H<EDcZY~698UBrHzepGPkDtb4(I@a(n!?!Dn#*LRPyKkb%<CR~I%|?*
zf<7L}%158hs_*@HRPCvwPiNI1@T$5ik3OB%rsU%hU-d}rhoettjs3w&@auQA;OcgQ
z;=)btP4xBX(^*N~NqySRYQNWe5L=^aTRea=Y#$(4-bbI#%1r@pVA;zTatj>T*R9}5
z#YXqnFOJD(w}a6TMlt`uj#}mlSg~`sd{@os656BO9Gw--b;w7(U!}J@Kr+s&RE{2~
z(YnJha@FW__PI<!D&~x9;<{>$yXWfL5!rGFY|CA9B<__VaV@N6CuENv*%1$zByh()
zQQZr}uGnt^hF$S+c16V>-Gg0`(clHiz6{p|r_7_jE)D@KbxZ2mPHd<2cGHONs#L`a
z)hujKg<|3aIsn<|zOCw-V&7M=jh`4D5Mxo!E=I!Wq9{N7C`>olPve-(bNW>N(lqK+
zDZ`;;nmzqDMbUN3`tf4KjW5y&Qv_u%AcJ5MN7Ljf$k_+761@SNIy)+9uxcbKxeN45
zG9^<M%G}vrbWV~lZRVnCIn~v>P4)323yCicMs-6H_v>RQb<Fz~M(m~BUK3>W8qso~
z2%_JzAQmt@8M!WvLRWBI&=d6GlJdN=d4c(}+UUS_cL8!&e1rZ`dIJT>qakF4m5vA#
zlyh8>%FqHs44^-u#)g*Cu%HRbXC#gxV!i+!Jy>DbSDm0|EcxX>X_hiV2*nFe5jvv;
zhEt<eI;Sua!pd$|ho7K7iZm{qj4(hx7BF+gbQ%>A_zPC5_1cuB2~a#m-Xe+vh;0ud
zFN&i=gm4pvvjk&kf*nA}Ws(+%T#+bdTLqM%6Y#bn1q>8M1J(!jk!ex^FvmBw-r0y4
zF|R>M!)6prW(^w}12AT;*i}W|a0jc|ONrOa$5hTBm>d^5vpvRfdW{!zbWE;E#xb2p
z5=?}C7f8ZK4lDfzd4NeXha{R4G$(m}oo0Zbk<)@}i<toqT3<23fw_&Tguj8kZI<Q*
zqY({yTHL5h4b?MjtQfk14UL-E@e~6as;v-Du~g4dAECwV&4xoRBMH!X%~=Oo-FH9Y
zCQE1B()l(R)&|4cU|1UrYlC6!77S~`4&K$MR$AEwYgZbI2lLrYMV6iHXX~wD{Vi*Q
z{cNzGJyiSIpcNgAXoC@LFf0#-<-xGL^|BZY%iDhj!}48px43imv%0#qj|EK)L+XUC
zjY(j;*suc^yQb^lAh2~xO~VhI&4Ha8KI794L2iDUNOa)8M!B#AY>C;MOOLr<1xY>-
zZ(}r`pU&nai-e^u%76LCg2W%vZx^*#X>K1??4sv{8c}@%n}J2KL2M7Z5KyB~HPndi
z8NRu0v9&I<_N+3aD1V*8M%W}DjR5%I1D(ymMDmJ_4j^BngvPjx50l|xFVl<%hv}AC
zCdtSN<k(~gH)}jVq>12NmR`{W+%eZr;0OSlnUg)UYyT6H$cyouu)lCQygZE;FaTU8
z<z&O+LtQtMvi-kSmI(bsJ5kq`7h~t+p}OmuS`cE7SPC{3Kg5m_TG+Nin`qPvP21nr
z(n`;5#apI%<<ZiE#-Fu6%3rHxS)DF0ijU>Fkslwupz}DrkrV#6H2dPE>6fGNCoxRf
zNI8AdPBbc4%gNh0&6xKriC>9@aSHJh`JDJPKNaBRS$--gB9~un`HaXssu4<4G#x7j
zR#ZIacF9^%d8B;w(*&Y5>Yr0~do-RLomNA9FVfqV<2#yctBr$e4<AhyN%W5eeb13&
zkGd>~qw#qBsW#qNg#N71zU&UmB1esi0i6R*)Z3(~yBK}UXr3-IpS}u?kE(Ax7f&HW
zElesHvGSt{I$EAx91zXcY-*dDX9kX=`<kLVb`W~59{P%@HiiKmvH$>>9NEXK;JAGd
zo7ch-SZ-VCJ)WSW4bvr06uz0Eohy<>aNp;Qy;F2%P1vm++qOGSI<{@ww%M`mbZp!1
z*m`2ywv9jU_l<v#vCsBV)mW#iYOSjKp4Xfs;<<-oH`E*;bASZ(kpqjIV&@EWWZiaY
zG2qEh+6=%e6{zvA>YRd4xglhZcK~>gH(czO_Lcq|c0i8lmf_cdi5QAu*ue-9fPZ59
zur#Bf-P>!SM9a+yB!}gDi6>c%QL-fJh_Q?g*GL<I_E99@J7rw7(IbPA+~riEb_$F$
zz!vgbf&eN;xu~k%DQl^E)JC9C7ShnU%qgJ-{z*&5@f_=w-3@>DES(ZIcU<r8yM`(w
z1ikW6p>n>&HD3+X81pYGj+;RS!4kZYA+v(33?BPnyOk&PY&dd8wM6RSu18vjZzi*V
z&)H8`3MN?N8n}0k!cJkK<`B4*yU6uki!ytrm)l03o#lp28tJWkbX-hJPdEU7V<t<D
zo#oV1jWxDq<O4R|4xwxmsr%I>YL-#INfy*}=U_6SC1$_Wf=x6P&*H<#gc6f9$^2_o
z)Z<FDkt)aB(*IL4wz0tIt}b^<ZWNP=)c@{J;>_Mc?qR73L3ZM*B@3xC4As1Td|+12
zcR{!23Bmbu0VU)#{wXy(7h}f-=95tvrvhCX=s)_ERwg3ef7^=0Q~T7~7?Mbz<NK|1
zNI&X@oiA0PE5<W<Xam%6s+}@KZSxzj&N@BxaDQ&qSi3pV#?4FVotMd|R^xyvaVH%A
z>_>840s1;B$$~6#dWs|n&hzNkr)0u*pf&-u^ni*0T#S2qlUC;71tk!AlZ!)nFkLg2
zs!1;y$&{?5#>p$rj2&<XM(?H<>-g;PHhS8Okq`R8PE3auozL;_%b{2K(gSmhY=l?=
z)r4oE5`pP?vV7kJGl~;_%4~JYkp9!!=|8KyKGZ|#2AcgAFeq>=;mqS3H$*tE$IGW^
z$!W%A2Z1XFhE@`>do1bw->7Fnj>*TWxpM_tc(en=+Db@SlAt%3(Q^h3hA?qXoDtsU
zRToiF2j*Z`#n)JrxG&gB4u@WIY4!s9q-7GY{Y+iu5Hha5AU}F(V<Wsq$O-0q7#D2D
z>^jv`P@N*g?E#BSU?U-tl*ox)u;27z6ciMgq=Rin5Z8Tw`S0-l!UYHYp$z@8s7MOJ
z7lIOClgqiWZ<AmczTy8;l+WqZ925<PjTeV?i8Q;IPJFmY=8WlMKp2Iy3^m&c({ikF
z`mcD${(3QnI(V7j-7#z3?F3Z?_Y^`~88x9cD3z6$Y8k2l%$c;$e!bm;TewjQJyyVy
zo5ymi<o~cAU_HY_Lxm@i%i{rY4%Zbb-z|d)#1|DCC5>bHxQmhMU(c7T4DuC=ClcbL
zKVA@;4oj|J>bmSO9zLsTbMlv>A-jRhL4xdPn@qvWFivg;vn5&Sfq&xr(eFdQLWvM_
zN0&kBqEIG~8ON~5c7{;$g>9N4;@F_zjhgL2U?8>}Qo|V?pwKyUqq{$or+C#ZBQbB;
z02g(+$E#Tm*1Fd5U8()!Cv_@!Vzr{CLx@|kXQ*BZ(}E_&Bh89#l&Q^H<K?Yjyv7X)
z4k%}6ISagZPB6{Ol<%V)|3)h%h~UNub9@jAIQBx5+wTe7YA#$BVi(yn==*igK2u>w
zb#qULoPhgT8G7pjX>hXkjPGykV-8c+a^$^@Y*F%_P0^<meJum3s;qM!D>Lwn8(7XY
z>`oA9yRLRjY(q0=mv8AZHQ0O{J+f}3kK$w3WkbyqBj-MeP&&KBC}C|lz11=2YyGW%
zB5U4q_#|W*9I?tIOveIM5{hdy(4_JM<qifIS+OyCqnzP#tbpFjvFdzQyBh5&?l_1M
z0`+MY)vUy#5dWjU+|g0DXM?Hg+<+p6$56$49YOFymFfBYXKr9tIfvJNIs`gHR6&uE
zbY|pR2-CY#CpxDfDuJ5mfU*Bx{I|wgh%qbHy?Pd7u!?7v$%#H{(?Vp|+W0o*C&=W=
zjEpq8u4eT;xoo6#SrLu3)jzsspt-I*>;-4hu2A^Xsay?GS9ia-7(Fl)Yg2+D$L_cV
z?J+l~!e)pI7zWK*6{~YDHkRq$(BjY)Xgb15h~_fe^!9y-uoR!gF4mjo`zzNZ?^Cje
z6fy|jx#2{|ByY}mlPbsz^tR9_-Z+jG2U@}ovZneY&JxVDZsE?$(#D??DYPekr~5eK
zOK*QBE=_@Q*Ycgl_aV(AX1o?^MAO9jd^%lcg}SSkBPa39W!ZlAW<*}Ak2xx{i|jx{
zy|I5kr324JT5O!HxT`DvurY_btC}VUB7}}rc*zxe>DuLlC56-0Q<i7S^%<~hofSAe
zo40yj&AI2wtgSjbsFhZz$H;L~K*m$1;-{Ng6Dp&<mzZt^C5EetO>n%s>aETNL`I;i
zHe*olooXhSySJGB<Pi&CJ~(s9H}2~NaGz6J=fRC?lbJ8YN-?;=3eAS6+DFEMX5$fh
zd0Ik<G|>JCjUY71?mFF@BMNF$RuZYp{7_dK7P-$Edd@kFpS$zy%yiCPID9E%L7}zv
z6dW2*LYZ=HwD~Awb22!RV+65M=Q>oZG7oaLISc(MFh(ohBR<_XIUxNHY|goMYi_}<
z;LKK@t~e5>UvoDzAKp7N06&Ing(chyyCvUKq@z$7)|V80Bsg|kSS!@s5^RUid##UR
z-&RQ9WELI&In(9Y?Why=pZzBYf{?BvE$(@Sso?-I!jn$LelL@*va${ZLlrmIF;dz4
zdn{1sBy?9XY%40AeYQ9oPX&_xh^Ga|3WEVssJY>EU76K;OT~+Oa$%qjPtRc<`YZ3-
zA<Z9?3nvln)<Jsr{PXJE8LK?p$V#L2d7uAyVUbzZi$4pq;pc7b72A$>6)s95_O%u%
z0o=Mhug&(SELTEn+Ui<m3v;w7u#=4Sf;yvfs1RvN724fKNWa=DLF|~PU#=CCv70Eu
zT&1PT<%+s4Usdt8XCjdIW>i>^##}Bu<@_IK?$D;^c<4GS!|tUSvh(y$ll;4HUk+=H
zC3G30oD}Y!Hu|S7WgIEaww}<m+fm!ve<VQax;AYUKL{>t9jXR`tLi{2=)Ro%Z3j!-
z3tG>*air>@+ff^;hkf=BA1QlFIn-T)te^|N0`CIv6=?*PgK;+4Q`v5cJsCKDQ-jA_
zYJe#=a=pz*n5qcMTl(ITl%z}9<=BphyFo|yXW|2FxC7oxlNMv%JpxCA;EB}$&vg=%
zPz@Znrue+2IP*yhF_d`I(w@lrGDSe%bOKfSdKLLCNpu+C!p0KbUQ)P<!n3%|T|qkT
z?gzuGGkER#6L#1IP@?KfLRQ1C?`|Ew_P6E>HUa7s7W+-C^bE7{Ih0OUXsjq8O20x9
zl1GLW2Zgvh7Ux7zNGfa#cEdt6KM+7yz+50>(teOGYt5yoQe+9|NCX~viaz=0OBq=n
z=`U^y?B9uFO{ouQEMYkzE?t2#(15nmP66kHPJ0ml`MkfGM2LGrL?$8!%fa?C=19vf
zA0zrXahw`%;|!JeXlIxS`tmRUe^118EMF=p!*_hQI<#kexj5Cds7bc_ob9P=@&P4P
zb{AJXlse#w_Bi|s>XjCi`PP1-JS~p56yGe}xZCWwiqF`GPlTth5$^BPzep9NPtU$8
z8>pz>_<S5u?IwPW7mGYC(Z@SN1YOZ0FqSx>4qtkXX|F5?=J4FSgPH@MA2T`<Oh|W!
zBd{ytH&v8>QHaKw8$F`}LrjXJKxPf7K_DwvPMN+hX{Cr<z_as7LS&Z6w8w9>ia~8l
zs_{}S&CCz1kI8ZBIy#{d)MCFxJpK?Y!0kV1!C@ds13i@@<*F0ijDvzCZ__|3p5JoP
zz+v@(Pm)OFipObkre(j49xy}CX~)8OG_^tG?d;!0fn^V$92C9D+#c?0iLErhny7PC
zqR1C)_j#IHOp=IKjq-QYL^HtXM$ep5y<Mt@3z<dyhWU{z%)0UzC=PoG$>2*4iVhm-
z?OwjC_jC%5I3_6+QS*>8!QDJ0wF(n?$Lr@P#s-2HVIBj=@*IO+0PsA}GPEW@-D<%v
z&i8TCGYdLvL``g}Q6(YE4QT!%eaHSHrgyddAU(wF_cSXs9*7mf==djbV13Jos==)2
z2u4L<)VqC5(8c5Hx*1RXvYU+7@#x{dw@;{;stRyt9JG#<-EaiHzq<2k4%Sw4$f%}K
ztlqAWOc;6mIXUJ6jA62Y$)x4@LAiZ(&Q`Z)_L$)BZmn!n6q@En?wcAEr<6I^Gt98{
zRwaS2`b9IGk?`YW`2F(PUzK*_#!GM8uYTw}gR>G#H&QMg9B}QK0-7AYki*g#OC~z{
zOne_3wNEmq?Z}1c$<!O*olPCw&*7F8c7bC3`HZo>H2muQD8<kFCA;8aWLm%PB1V6N
z^%4*F&(BqEm&mEpIa6|{shhz?9=CrI$g)mQtlcFiC{FVOeS;2}6(%gA<AGit7ECri
zqgAsT_IZ1$kTcR4zh#4B)@$?(r|F<5$g?1FC6Vw5!4Hls0xu*1Q+Ty5x6!khP_T~E
zBZr|NFnZDCMzD818Un1fK(n{Gl1`wk)YOeI$1XX=NS_FLA9OT6#xPDzzaTxT|Jg;1
zYNwEV2TDF3?kziK{N5|*ULdC#u&&`HuodieVn+wWgEdkLdK6=u0Yr1wkOUDPOrUdX
zh*y;YC9+CMq*3LG$@Zr6fe+|Dem8MYrLNs`=z>ijId>bhR5zNP+ShfmRnfZv^MIbI
zSUEpw_x1CtEla9KFV{|$tO@$c)vS&PPK>=2X%?GaR!^9xs%<wU&DRDlPByZLbO)#q
zuoN`s22E10V_;QP;N(sl5Wj?6{RKA=6p<YIJ<56)I+(j!^Z6mxU2!{a>)vyKvc`s~
zoj$Vf1L5X_9YAi95TF!VuS;d}Pb)<@R=*oC(j2o}itT_%LZf-{+h}TW?ArVFiW%?T
zx~KY4q#J(=Tk6u6fo<OXzy%|Je{t2&Qc!Cd(5;;E8%s;F&40u40;LpKYa&zq3`}&M
z%=C4L<8Vb1^Kb(G5ax(6_5(Kw^VD09T%z*mOg*h~`Wle)l-1(9tj5aw5sm3OXrbZZ
z#?)oJJ!9>J#q8##+$g~%J2l3X?^n6_-d*&yiT|U<4LX#zuGxM|)-4i}RUj}FjT9<3
zDleda#n&a}eQ%g%?Qo#ET-MpMbukF%4<iHXL>)vzdE<#n3}kM?KK5TBGmA1gJV>@-
zPzGm3leOKWY?^D3+9kZc_Ys6C8HF%7Zj74!9Yb#Dm_ow4Q9eQ7E!O#whAkKy7Z=4+
zNLG`U(t?c@_dTOz;}I7<vOk}Er1pF6F-Da_dl}(-#`fV)F;>UZ@cu2Ts$yLQ<$eSk
z!Ltf&;1BmXTUp_nu9xbsw>dxG6xQE8F{g=rvI+ZaRxVqDmJDNF{`ZwxeeA(TDsRk@
z8<`~)v*=`14EfUN+ahe=j8>`kY85Cl4fS8oT032guyN)S>9Ca6!<56<X9H=HPhXc~
zulzARrI&9*i}fddVt;FC7)2Dxr3vAB*pmUX$p=81?FC=FOM;}VVy(+-oAvtL3MKM+
zmL;NpltNPRDF4Km`7C}(=zLpi1Pqf~{Y15Mdk;(YM?kc(uYeZHUHq(=Hbr<Uc*5M;
z+~J0XAU^I;gm)qVJY^Gy8nT<;8Et`g(b?vKJ6)nIkw=F;tUq7mCp<A}^&D4D+!(Y)
z)FZQRP#I+<P1?v}5EE=E_OEaiAx1|@X=3z4cgRPES?aHIyR`A*@duT$9B1~XP(|*h
z2C#oAh3Gig-`w}OPR_TvzpJe7Hq?dAIgBMb7SR=5>Fv5J?ZWXlrHvgD11!dSN5*6Y
zP7EX<-K*?7X07Bp+EzW+*m$p&4co|_PHLM^@#lL>dcvtf>ffNAzauImJ)z17CnYxY
z#kx#kFiqY93R|G*o-MIOw^h{kO4^;+)%Hv?(5`<;-VJ4$)%N}JXxcCHs6yE;($fM0
zGXITS>$S`0g74V*+!Mgg83lCeijr(Mwt<RLsFxZLEi?~Ofvi3>sHkJZu`nW{swzW=
z*)XY*b7UK9wt2Zum|tp@o*mRtIb{jqM3v4Y41Di0tth660g=GDPgvYa(8x3@0!0f8
znm(D9DT1>U30{D28B)IS$(MVdf-9EBTEni;VR^HM0IO>4l!ZyE*J4>Ig-I(>bz0Rv
zOygK?c%<HFHMZMTh2==CzgiKJw>Z<YuEFL8m|(jBaFH-eivj?*MVi)@gVKu?t(`d*
zhxZ*;uUYvR+zQ$wrI}jh<Vk(rckvSxVQjutHC^xa2>v^@US<d{1WW#1|K{!U8m|F3
zHDvFXn*tf=(~aSrxG86ipX?DV63^_a@G0SaD6_T^|BY=P$8^Y$98!>tgZm89A1(~G
zH^$9UAKs8uY5!YNr+ySH{+dxeV?E4hdz$H9-pUiYt`$=ETEvK0l?{8LW~|${Kwy(O
zGg@}?#yjynsm!o?T{0`G$4}WP)fQlXji2({gh5%7aWB@cxn4u#4&65#V1s^w8yMzd
zbeVs)DF{9DhjBtw6kM=3v`#Qkkk4Vc4AXHQ2Z8_-CZZ)r&zVCT7g9OrdMGw^$%i-*
zPl7VZ$7W|ZppefYl5j$RdFlzs;ScDX(|jdBPc7Q{*Nh40#!(m#mA*@?qa5xsiM+u`
zVgvyr%+HLXAR<&3nq){=sNFzDFNkI<O2Q8&Hw&Yc!1e8^y-neSnyFG)A<dYd9|m8s
zz7jNuo|AtjXK<>by3wb_xpM~B#syk4<zLDC|29R$RX0x%Q1(|yFO8ZgH7C^Q2Ief-
zcbmv&C*wQJrz;j`b8ZQXPhnSV7@Y;UdxUh8c9v_$J0hjTZlL6uHB{S&x&>7rcYd&n
zvr6<9^R4eXwzw%-f9b|f0oU`Fo?L?|jH|t$a6Pb-iIwu`vsUE!?PWH@*A{?1p6$2l
zJI2{%2ncI)ulaWb$NFK}59(QEC-d9j$VD_RG=zWErRZd4d<>M-?-ZBY=8->^$co)w
zCYXILZ_^bpW-JoXos*$HtiZ=s5O$A{1{a>0vZBYxG*Ye%@YX+MT$=hN^LMn>;X(W{
z8QWD~Ee`ku#d;E9S>un~WpIS!7Gc`(y%{LgemKP!*hqn5@^ACGE~^F}ti~OKKx*y4
z=UQa{as+b371)5#8TCRl&L{%*K~F-K^~xuYZKJPT+OSiw<!RmDnye$ev4yadERtEm
z#7dH^ZYJj|nzxj>*X{ESSh@c9kVU)K_H1B)^i``$T2XKjrPm7JpeF_$#64B9e5yw9
zIL&E=+o#{zr0rN==Wbi?P;nfXVXZ4{!(r3e9*!*z)?il|awxCpi1ka|ymTM@pt4+E
z=y!cu+2+SAubAk$N{mff<R$`sWtvePQjDlJPECVgqXqQQFVf0@XtQ4^6h|(CuNaO>
zyp0+oswu`Oh{3@0fvfg+2EL_A;*`$gLZKUQW{S4;N~Z(GV9GT@H(DH~(hjMH7m(Nk
zvDCMLVh}sXI;CjQRVw7hnw~5po>X~yYS|n70HgT;3(qle=zjqPWCpKs>WNUgrJBGH
zt(D<=!cxQbXkK}I6Dy!+T%m<nTxt(Qy%5k)Zspa+vhHXAHd@{$uV4>&2}@}S%WI9K
ziL+3zb`O5&ou=ZLCb(QT8Lq4JTj;m=sRa1-9$&l<jjQV{3ce3X)r|cYn1~=tAkGeh
z-l|ecab~GR%Jk5vG*gjk?3Hr{Yu)-$x6z~3vOkp(JnCMal$<>0%FTC%)si!FHpYSp
zingGhTPY7|ml5S``wzEwz@xd6(in5eU;%qfFnYr#k$Jng8Gsb7zK2DJqZw?Nwy063
zV#cCYv~@L%$o^!bzs0*r`-Wq5sg}CAb#Iiue8Ls|7+U}9*`V{EXTvr2p4r8ZXG1)+
zJerG^y=!2T<2=mAZJCxR;rQQ+llfICGxdktGCn@G_1B+&x!65n+yPK5U-p>3b=)lC
zqB9mdA)Igv$R5jhzW)*5Z-w~ZO}Suf8l}q#rgd`c3~&chUwkEJpjeqwoS&S`z08)n
z4COpGU6nE&{7nGi=FV%DczDZTPqT#A(2|ca_Zzf?<-sj(g>PT(I<uQ(34y;s_NMMD
zW4z^@7YEn%e`gWB>`nJ;Y!2~TZ=)?e-3*~$nt>sn@vZqsQ4gl-KoEzZYirBtO-^G&
zTCa4QrY*Twj#Z{f7vNR!H1dPs2S`>FZ3(#zcdP|ZP6BT8E}dB)0qZmw0e9I{=uU4M
zbgpVx9Qh>%XUe#^vHM2s4=Q*WImVtfm)PW|M&;{jCIFHZwxh!c_2g=1{V7i22O+G_
zyX3bM-4NwR>M>1+#idZsX^-nwz4YTtRyClxXR<mDLXa>k9M!s#5H>a${Fy8e_>P69
zaCz0uIriUSlb<&EI+mszN1n?gO&apJ_y0c_oFdYCz}NxO|HwGv#wGHWZt#w)FWq=9
ze*ufE{b-I^XuaYruPXYwD}GQ99`=86!7Dfa!v)ik{$E^hn&wk!V5YerbzlP~gS^rI
z^jRs_GJnFfWMSay+2vVHzf?bbWDVc>9_Kh-5}uuXu+bmH8FvWj#rT)qyaZs=eU3}#
zNp?Uvl1VvDw<mnV{AigKJOn2iAE;q0VkH7k)X#qR;`~xMWjA;>+Htlg;g`N=p<UYB
za@6U_dW)i^w$rdUASv7kbpzj^VJ@f_x~C0!p_m~94gF08G=RVt0wE(jm5y2`C5_Y-
zAu^Mh=PhTp4=q(|A!f9cLMB9N_BYH!=(zEOM&4l1Ymd(YXkvtqcCv&Fxt^Eeq&2Ic
z3`l`D@Gj7#YJ(>xF%Wwh70pBuuaJ_et(q=xBMmbz@DC>`bS?}|9_7CR59HgTqD|Tz
zUPI>MMeS?w>~d^hi?x=x@(N^|mCzX7zbhJ#s>_8c&92K|1Xnaywzi*UX4OpXRrZn9
zvpP$ito&$vf+e-Vkribc#1)b7^7D1)=Ui$BaTO2FE*wa}IM%gX-d{Mg=X$b(gN2Tb
z@Ggt33HTc;;)=d<-}T`F@H5;p39fC8jZh2%H`!!-r5mX&O4i;N6rGG)C*bg7B%!js
zoltg?<U!o`;8ai(iz9L0A@m&W%&iWMZEg%M`Zv&r^4n2fg=JeuEN0^GAw*nn%V2b^
z=tBkyx>n~QJd!^cdJk5<pU+wA#V=YO>#v<3$&zv50_Q{_$CUj(fySD6xH8XWSQ)Jx
zzU@GHp--H(;5XZ{(Dizr3sE4gKS7z~^bDML07*D{iK{?VyF8HB2g!I5A>1F-PAQ%p
z3ibJ~1e-Sxv2FrkBp1E-RqsGP1~v$eCvPRLYX`z;XwOVp{dpRk9_jtjp7O7hYd?Uc
znpZC#)>lwqShRzg=A%y=mf=d;f7<>Xy6NF>S}3NB<7Sp{6E591U$Mls5ebSoMB0dh
z^x(_1(c|C0<|*_TpYzD*+QJkr8%LrWt$n%NkCCT$$_!024g`9lP+Vwv4E$>Wh3WoZ
zJL1z`XFb`+Z~+6-J$li@&3(WyBCK_57Bjyr-?s7Ej1hS1%dK~32e{<sjOKT`VNbWF
z$807c>lP8OMQgX+OsWnyQ`R-tN6+9{+_$hg8?5Y8pABsl{Gye=0dw>##;|xMG83|P
zVaRmK<!*WtK`r}Ei|aOHlNVWnFX65OiY)YE@GN=kWMACr%MbvXej*Rnbk4Wy=`G#p
zVbs`*hJP^IK@A{P%aezzk;g-ozo#&_<|z2%=0$I8_<r}Oyan8T)Ngpz9T|AY)o3aj
zj15y9FUU6nafLAQe$SLEh0v4qV{3jUjvjk|WORrunD^NX95d}CRvhBEA!(!8*ks))
zPEfvR=h#{xU>GfG1%=*SQ8u3UH!E}Y)Gw=^uEjL`xB)3v4j{g{9&WR&rJCQj&t3Rb
zcXB{4qlYc4T6%C*Q%&lr7grh^%X%p0RS>g3X58TgSJLX*RW`ivlqDb4R_-;+F6s$l
zlvSv#S9FE`(O2DxYM_OCucZE@ElWtOZDsxC2VmAqBzC9UMJhglD@O%m{5ye|{9B-}
z7FwRU%{-?udd1ubTuw`C)~foW=lk#XNGjomR+V01v6E#BYe_51k_{S*rNendRL>GU
z?QRQOOsp-8Tj3Ik{*kS12LAd1tw6P83;LQ?la>~(J=PVWK3DIO_Q85_wP;7NC`X_i
zCw;~W`(w+2nw9mWrDe=@)8bHntA;j>T{U_eDos;m55HH~)G2M3mKME{-&g*chaaW8
zj5cD$9FxKl1H1sW#YQ4vv#GVr&aU1qLhUknM8G;~?FggNy2Z+2pMAMi);4llQ!4og
zZ(#Qh(v7XDWuZmWgqeY5$-y{qN5IN<d}9s`u4xtpP6{g0QcWNM4f#})P9r=Hvyf2W
zR97k`S1QhFOXg5+DmDjNDHU&wGZKr2$I`N<F^!gCsQv8@9|QJ+h|<8zQ{y`NqnY_g
zoqzElaa!H)k3TQd+tvAA^DL(nVxuormA!aW`?5{lXX}W|$+jDpRkzy~eJ=uJ_LOgK
zcdpm^l-$+(OVj1~<Wuc?H}{$QT-OE}kG%c%uf|N~3J2j$a7~kenuV*Onva^y27Z&x
zfIS&ITR(TYHDsJS{nlfl)xN)SYBH#n1)tVQ;(BP}L$Zk0N~d@?=Xwx#3ID6AXjMx3
zzKa8o;4j)tUz|G`OIy&cW0OME?Usy>^zXa0w^BiKt}a(poB$R$<RiCV>;?}U_oa^u
zBQ3Wm42SXEaX#Fk-!1*52>X8M$@auvL}b*4WNc~0-EwcOgQXi2n`d7$dKbfwew3Gj
zeRnb}pFmc-8Ln&FmhKkZ{n(caJ}-~_XB++$1lnAyy3FvLtDCWg*z`#>bNOLD@~1S2
z5)A=o!F_b5oAqvi6W$Hxe2uZ`hu-M&pBLrtu-)8Ltg(tgW8?>N>jGI*E95wJLm1uG
zz5j!2op5^vbS&~MafX!kPHT6B@EYI?UJ!RR)Uah5(|;%;2tv9#*@wBRC$8rlVY%%W
z<9Ik-6XoNFe<`eY)iHHNEL4aHl<bs-bs7XhheyD6*o|in0FLHn8~90QE5cnzZa4Uy
z1kmE<F}dv0!J0_xq{#tcQ4gJE9JH`V4Egs-MarJnylz?3jVykspIEh$S^V~PVV!jC
zAsFL*(_3U8C7r>D4}}HMjf`$)(#;OPx8Ro?Or@~PN~KrY5#eoAxFFVuDVtyYADroN
zLLfY?KjCIWTcVr+W^a)o`qd4(Z;NkZk>{cnYQ6pFg5+5|`#*%HJ0HdhwnN!(wBC;k
zTtE`&dwtN}`xd^$QD-KR0Zql1-fk$oYLBr3MI9RAdX1g&0F3N~Wqv?}6dX!$<YC9I
zZALZ!CX<e&Fn=qo33NV-0vv2dQreGA48B*5siF2f-hi7f_d^HR{?limVC%MWYtKam
z_sMflrmvrJ+LYMlcSc@%;hf*gNw+4X8vZCGptrRi4o+%u@&P-k;@lUa_-sI};wl6a
zfP?!`5r`C|=eo~@{ZJ94_c(Q?dYzmCVjvt*Lb>9yfrQIf&oKLm6jo6|oo|ZOz5BGN
z^neH0cRS?bHO+JJCI`>Vnb!gPu}G6f7t=vsT}xRx@fx$&;n5A<=HNpy<~<`SXn_e_
zKNPsa4Am0$gH*4Fm-aw{dUrYxk{%UK)%)>r#OkDw@<iA|eW#1;^D@E>AV5y-L7Oc;
zr@-H}V;_eZo@xl(;}XkDBR~M190?Uxy*M!ohffafmSovH4W`on#x@DjPDbZ2n%qo9
zbMwFB4(~cg+6%>cC9<i~?+vP(HO)lqAKpi1n~N5WfxjExsqT7X{$q`}wdPeD0ZC;4
z!ZHIg#8PJqPR*7?G&rchTJ@*f7#Xnax`}fTb8VY>V~0Zm3EI@Tjxw@}%@t@!ut_Hv
zC>(&`H24<6If|^?a!n-8L%_Kg`Xd_S9Yqepo4sTHZ>WFH_ygn=Y=u=KngkR^ep_#d
z42~*VUvF>SeTf@s&-KiNVm(qcW<7V(&OPV=4$-VL!suA$`NO|V4#b{XYq;VWtwy50
zgt8Ah`1pCVv4Gib$||st>puayn@GHB216eKZZ4%HJuR?P=gN9;iT7`!ToO~dEq6qm
z+mK`ben-0hgi~zFD;WVvYrQjvPX?`gI1C=?uI=<^U*QBufr73_?i&d^t6sdu1`02;
z;#GJpkO*7Mu%lCUbN<~@kF`WLLZB?X5wjb>Sx$MhL!wyvJu8@X(vSe@xOa=SSMr0d
zESa^D$nKM55CZwAHmT@wao&ljZ8Aukj}`(op(bTu#=V&&D31z)Q&8Y-ecZ_WbO%KR
z1@8OEIMc}1m)?LxxPfM`I>-t9Z4RyJXITJ!DeyHhHKzu9DEQhn#oVDrnKkqHAMxLC
z`6`ftE8J+EdYQ#XTUeSI9vzU97N3DQWcl>#cJaY%Gsf}3Ze9I9tH{9;cZ|8W7~a8>
zCdvp%>BVlNXCFnBv^z#u8$3)zdqB?uVui_O=n;OM^&OIpmnTfb95PH~U8&p_3}VS9
z)o6f8_yT!gn7nv_{X>Bf)Yd`b;|n3;dakoq$w<i0?+GD$UelAc7vRS|Kq3>66`(4Z
zCS8BbqCW_p>bCvcJNM|H$XO+3kZK<+bUZ@ZY&P-d*;w#v15olkyq2X`y!7()BT=f`
zDsqs{+n<9u;BEWS*p)A4tYV15g)QqnV60-Ep$1yOeZ8m;I4*rN<E$(EI@_WR#f*#W
zDLw_eLBKY2cUHi{CXBkCwa3oL^7L(QoI7V2gzv}g%|0mD7E(~-lexhdWQzAS>n)Im
z6U{?-Z5e@@x9~tH`pe2~L=at=Rjg$@7vn_0ub$KjCx5SwAAfGEKL(@A(>J~G?yHcX
z!e4)|?trE3eja_n!M*mzUw4rc014Z91(>034iKoij;59yEH}ed1;<v0#F}}0V&8S_
zwEv<4tFpr$uL}ZALAHpj=|IcOurdmQAa>jA?Qc1H8C1vTRp{twas3V?U@w~>SUZ2)
zVs*68C4Xh5D@!fW|9Zg3uPX?g+97)9D6-fjgy<?8$TN4zG4l_&+ROt78xoS4Swo@K
zVS`+_jvwR{y=RGwJc$&dr1MLhp)!;YMA@b7kjNQ1CHcda+nOhorOZDW$n3&Hp()4z
zZJt9ua(s}H>@5hxM38$!QWuQFy8XLTGiiXy=SOB$5MxV=o}=Q&f2<9b!A~>SIa*-i
zxlvxMH3_i*O87e*kO4UPM=Q+Cv?K=BgASg@UblB?%ni!kOv#tD(Zy39w9;j%3~%I~
zYV3*Baow__`#0k+%a79-yaA*wf6xTa=!Cm~+0Vz%`A@{ELvs8HnDS(OJ@OmZ6WZip
ztgUs9H0ZR_LSOJBegg;mp0uEsB(A@!N(5S1Dq)_FAqyU@`#I(lk&w&kR}fTv06`EG
zBN4gH1}~^lzkga?10}(4qkcgVC|h^rz~GD$a6Sak_1;h+p9`ev;g)=*MK_<Jrz=ws
z3Q6KIuqy+5XBFk*jC{kzWptagl0azJ9}YR+s$Jz*=<2}MQndkvlM5->%3>hYip~Eq
z@+#@DvtyyaPM-}l>yZLAOM&qk(<k-ZOfDeh&z_XTIMjKHywm@xC%O%5a{i=2`K|Fy
zSkOlLW+@Kyi-s_i!Kf>*a!Q|4E$Wmezkr(S>wDE}`JgR<R@Z@Mi?*^7%B?Nj9cWxd
zcb+u4SX+r)+h`I0TqS*C*FhvN97q8uQ02iT{So14<kIin*v5_V{1kqI*6^Z@TkjSu
z5E%_Sc%mVa?BjA|bNZeeMp4zKEh7}a;#`C3t2}bc=)zWP%L-Il+s4}H)GU}6v;$S<
z!@WnCu&?2hdK!A9`LJOr&h8B|zGbK9{=SlGKcxe1GS5P84*GARCQ<xX@GrzeJUj;B
z;1b6aViXKNA%<)?cr%c4gJ2Y>SeSybaKK+pAv0k#5z1Vqq<Vz|895D{!7b+p@>t5K
zyQE%1(PRI1-1l&z+|2@_yTHue%)bo6f}v1AP{XrerhQ~2#7Ut3dZ~h-;fb0;fs#qQ
z{QO~>{eH*CM7vXFw0A_i3>3wfKiN-A@OvzyLD7A^4MxZx9HQ8T_bj8B;l17@DW;V2
zl1R5yhkYg)jcC8n4aps`W`I(FtQzf2Qi3~GA2{VfGYZK}u>oO5ycSqN`7RjZf&@X$
zNQRUh0{(Y(;m1@N5PzuvPFWDEtWp|T!56QLQyA~Vl<maOPLgQ#P4nqWK4vEs*G5wK
zu(%Uy^_5x>OA%5o+Vkmvjcdn}2jlGWj?*%>li~)CGgKI@a^oB!N00!vWxPJ*aifRy
zS^d9oiYWO-j`SH#8r;#-v&RM)!DONy(NG3?Ec6-Da?ScvFQ%W~wq_3)ujp(hie&>y
z^p=G?>KfPEInX|TDKmKAX{cFM3JYWcsz`dke7g);erbkW+#Oa`kPGq8E?ITTbfG-U
zZ7WKe2-Ti_JY9f}IX$G;hsX5*yK~V>{V3koncJ3gKOYaZE>!A;JhF&Xk&9DP#Ly(>
zUhJcfOpOZ{0}GAD#Eg)|ytN9C1hjL*X<u5OATh?}_t({tp)oxK8tod^GzliK+(Tbd
zelFsxrhR<SOQyqo2^RhB*@ykVBL1+G6->O7+E}w#PIEygKlC8yd0CYGHJ)E3gYTTC
zy|%IAx({NwraxDUEQ<A2+58x`z?(9k6;D*A_m^}!Ke<$0_Bef4*<4rCYmM*d#db&g
zECPB9tp&jpKE#Of?l!xt{@b}M3({TabYVjPt{{u=p8bITF+JVjO`NyLBNl`W{fyLt
zSoCm4rsYn#VTyX~vhtF=McDjRW=oX%Rfd022E4wI+w@iRNO8GBQBB<UAYQ}oB>z0x
zOt&_7aUUm~A)MjHUPpaZK6XJQ62*H>FPu9m!L<uKYF?4(ZB18CF?bK7h;WAQ@EI(n
zcJDo{sEgjwQfeF&%_<XaZ%{xZ(rgPb-Fi`(#IuibAWkaX@qnOuMY8Zg65|P!IZ^t4
z&Q(U46b4!Q^n-dIp%`wySKM-e#~a%o=P0`S%`-togTKdAvp~UvoTo6m)T6pjsgjg;
z136S7?gT=;a+IckbV%Dpy!-mf$nup3B#c!qMxont{I5nlElw97ZWgD$zPcPO&gU!!
zo7uHhRqBAE=6ri6s6Bf|%srnz4vbjd46gxCRtY6PRo3b~|AhmVL?Ngkl`@W5N+=P*
z>djNd{W%L<Q5KfBDuZZSi+xtXL|xV->BSe%^W>M5AaT^V5EHRE68wRLxHq3L1K&+g
z<Wy9T8K?A1oasFM*h<fhEfBBg)EtmYZ57|(z%QD0_GOpN!FoH7qpP_S_hHe3lz@c7
zN5LQ?W<<O>4cU`z36S?dy@KjL!rRW$R|q`g^MiH(%(@x@aI-;7Yl1O>6+sV?FZ@qB
z1QHi~ku5;{s|OEc;X_`*y&Lp|I^I7TZtN;CS0Md6XEkkl-?>oASgR0f8l`H3MOtW0
zu~q+X!{DS{i<qD`JgxK)`LuzjwC4sN+nZ?n@y1=@j7FC*%njH!3X}c@w;2y<E3X@7
z{f1@&lPiaKf{(%T(Cwh?8=hYraukU7(SW|q&!pPS_uBi9K0W)Pl`Fn`_%9?x`|-pb
z`yg*>M2mAx(2>T|2wene&pK3n)bj<WH*miP2XnQ8-%fgmKppLfO`?6uz->dIdX=h!
z(T3{!*u~Gu$VwhqBGGb^8LiJQp>tlG6W(5rbfYlh#Bv~)$phxt(x53mMD(!M*@TmR
zVlL_&A+`Hu+-m|tSe#9+rD}gV!zG+XHC&#MvIv)|7tW-cudO!!6*~<n9d-RWeFW8M
zlx+YIFWKaVo=HD(f&ac7skeCN{8z2p@|jWbdjnLb;gM<J>v<)6&2q~m?%3pN*Rdg`
z|H-1X#l++mNZq>HpygU?vpQY%%rg(IMHH@$H2L$qQu^Yu!-nMF_`XKtuY8AX)1Yxx
zYxlx-B!bE1oz{<VHF+rIcRB3Nrj9uP6}J+aBH#@5G2fva;BB<B!Y+%Cn^9;W<U?qk
zQmC}I9y>W&{-)4LPB6&%<|{C}^DG>kDl(E?gSN4ft@edxS11_1Xu_%{B-Q|*03{T9
zGp(W3jZ195TBdaRN1KP7+WO^wpG!V1JBz}_)TW%icttfL0{*Y%N(oF~M#*~1b$hqf
z?3Tw*(9K{#nbo2PiMDG_oAH5Bapb`?W^H{@5^dpUq+e}Bs}}tYB<{nfPUXL%F`KM7
za*}21J)bU=sOQJTVkA#l@(XLnnZB*-A!l|I(AXD7i`b)rw@#LPVlMHDg6Md*B>Wo1
ztgk1y8mv{`H(o@m4ZgfWDv2?ZM5i)K-}gtxa2n6Wu+bze`6MbvbnRI>Bjf3MJR2;P
zftn-BG_8!|Uj9YP!<B!PqX?m{%W2OmCr(kE#sLg((0Cr!X@qk*4UO4T+FKrt>Mb7b
z@ZlQ1_@#Q-c3vZo=s!8hM~uTd7m9I)!jEV+>n_pRjQ1nPn+h)O+zlsBzHU`I=R7F7
ze`dLlqE^_&MN&JF5Tmre6Q+?IEBsy$FEC;^U{w`;zd@Zi`wVfyh$Wex3SRPG?m+T7
z{K^En@=UV2U$P5M+D$)i4x^0+KGI;L(+HhwFTh{)W%><Jx`3?h8U+tV6k~U>ee<ct
z*k9l2K$H7n*%7)3Mfh9iiOl&&fxo{1tAty<FB=?(_Ku$?LEJk$hv5kPdIvdJQ=*JD
zu-zcPVkbv{ZWxRR8`@rg9uu89qx1u64J2A8Kx%&ptIpDhnf3c*E<rL1DP|RNz+eWd
zddG5*W{8rFl{m)kXqY!N3~u?y$KeV@Qwgw<bxzVFWyr(bFoMmGb^1G@W!*c^KKYS0
z9zZT=<lZ}nJM46UH3k=J;*AkcLmA8r-ot&q&WG6q1JxP_Fm<CD#rpONT7r2?AVomq
zA*zefp7PBwwX?TGh(fWcPWzh()4RFI4`m#_cH6$@nEIr0go^LjeTj?l?Ch$Ae-udW
zxjqzNgT|8tc!LE)b+8|EY6QPDU_p;j8&c7mUeXeuvOXjMd&8+%x9A(p-55jzF?2Kl
z+0k;)SfGFy4Lg%{xr2LvtU5uF(cef&Zo@Y4gj+C1rI+1wX3KMH-=(B%LQB@%36%uf
zx>jzTRQ8WNbo;`=MgdYAGxR@rH27orOLyN#<0=!K+j-)D=9vt6%hI5)xsIOr!-JLZ
z!fzuBp;#goKW|gr4}TbF{Ql5p;bY)@2t7(7Ngu>_aSxz5xxA4(TU_4>EA&*~W>WMF
zAMH0#CIyl-@RI<|G`-Zp>LEmXlq_{@=U}BBMmcF&Kvpn~R)drF>n+)<yOPvp=(H9i
zv9}{T!8$a=6Wgce71CpZVq+SYN|rs3DJSm;>A{0?GyBiq_xA(a^bCu_EJIdi+xZDM
z`29NOu)mGR3pgVsky{m$iu%mrv%3MU_5>S0sQBii$M~Y`5I}2kP@`45b9rD2>?&?*
zU6H_Y&^{DSH8ljU`=8lMLFE7fVNDiqIrLQtE2e+5*+D_7ar8&8x<E5yGpCv}u6@?J
z&nB?a5OyhN8Ihq1S)uG^ZdRO2dJ^dsaQ_oH)IL__CGqsrY`|@#2W9VEJGrk8guX?2
z=Ra<LKQGb;Y>67kbUcdF&(b9-_~UGYF_V^ymWo?=3A2$~s5aE2m7H+n_x+en>|c8f
zSjZzlJ|_-=Ob{oFWV(0<SgxKZYOx7!(KJS)w(I#748qw79t63(LeFvSM<oN!&Q2JZ
zy7-yFjHsC@rG`NuWua28JZ!pVt6YuV+q}P`0EsAS7J6QV(lJDM>W(anBYdWOY<Szf
zE#_7lw`HYo?KN0OZh<E;^x(ixVyV~mF0YouJA2t^qZXIZwEX0UbrrFyG_Me-FS&W7
zIYU&!ns77w|C-E@5Es^iqcZafqT9NJHHbAB;rLDcavLcTF*{`v8*owXw#6w&b4|lR
z$T)uyLw*>9Yxmq?efkj0oI3=7#0C6~F3V;Ta=v;RaQrkipZ4pN7*GFbai!*O_j~#N
zs{OwI{_^|I{oYqKT>d9xT$kI4q{koP$xW7!s+d?u_<Mt2;N1^j=ALIvPe%uh6D(&M
zM)brPXPRC_RH;|v9JAX>d%^*|YL!5T7NIY;fJuhV*k-lnkcyxSNc|TB+NV44R#w-<
z7}<N5*_pjZ-jAtYsC(vOr3XP!!?N%d4`?;t1-wj?p(*t}4G@cLC=s+IRs#}pcNocR
z#|nRg#6E+F9+50AWmYNex?i%(QARsoOZ}w<0UPbe;Gn~>1~YF+TBucJw5wKNB?m&~
zsoxYf^!5cm&p_iNqbh5aXH5Wn*xCvkEv$7#Ay<nzWzD`D&Q@*i_P3L2%=L6nr=qHI
z*NX>^`Kv9?%?GN}aiwf|gZanAbF4zm+P{H@4r*-XzcKZ@I9zPQB{8<zjP?9#@C9cT
zR^<n=Nzck6^P(V06fxX@d*C=FAn9?Z#70>Da0wC6IswLvkyCtf^YjXHO@zK-4Q1fP
z@u8Y?jTIHVBdnU!w;X2LTE2AVL-D{8s(XE3PMY@2L23NgRzoCR{SWt-?Ow0)(~PUK
zw^U}%+*JLk?snpcnx3p`Z6?qf$Fc2hpd*ZkOrOF&g2mdGqjMr%V5L3q`->1NHsOgQ
z#CUS3262aHVaHX}ugkQY#__HQ)N#HBkq#ZRY%u7MSli@Pa&kU}3@O@+pB9(yrYn8{
zN6sl#DVYQ<Ge#Gj;%wmVdW)?GSBq_oK~Mz*`PIsZ2w_J~jfKo|%dzvhX?Wn1C-&Yu
z04X^Nx=r0DR9&5Gs4!P@%5Drqw;{>;oMde-#+nBA*8D1uKQqh&=(X8S<3O;TE+A5)
z=t634B{L`!^MEPRCzm?`2or`tEhPDs^Uc^BU<ag!d}k|ICNN$?JKlR9B1$l24A;V%
zNM<Q>^3e0O&)*m<5)Tv&ASbf%pI2SogZd?8&Lkx0GSI+-)O|>r)Ib|i7!6G%9*eJa
zfbw4Z{USfA3lSs?Hd)w<D4-Vz1->2TW^XXT7uAL&3}nPus+<CBfcGwjeJ`>_2_a_}
zOizSH0^6VFaqdnUHSjOZ7glkUUb7W3x(GS-Ld~OkeSQ7cRha0XoMfJr5ZvLvu(GpN
zutV(%lTi%}N6es4!S+P-RtBk}E?lIiu1K;stlB$7<Ng@Ta9Hsiu~>QxiF+#}NTrU9
zA~ZZ}2zn1c@ywCTE51Z&W?FOtsR`ZUXA+8N=}FS<(u|0P53&DFvx=g=-{QU>sU?Gu
z`W|KsVj%ZWESJpLXqWENF4O=Eg?AoKa8@*-*9Ma<XmE2BZt156+l#73FWn_RgfBag
z*KUv|qqX&Y@1w@sdSC`;p>2zpAY9JDUm%uDyVpV*)Iz>0K-C*NwJ<5Zi;UwpMDXLj
zaAwhov|(|>EA;$lH@8eN#@|c`B)6+efN2QtFXJpR+G9-N_}_Wq)oP+Ll>N4hS+O41
z73C@0bT40gF@*q*!^_IGHk=Kt?rw5Rsgn)Tk4DSPLvvid9$2NP`M^GLS=HeiTh9A5
zu#rkR8AoFu&L9P1jXC5bD}tTkLa%@Y{s?6ntJ`Kw{9E<7Qi1b@P#0?sEm|cyPE88o
zE_Tefw>Tn_)s#Nv^cEH_-WV10ZBp}92$XK&E9ggG=QLY@pc!S)bxObmhaIT<T3!mp
z_bD0d>IlEc3zGwE=N#wmIvY%5yOKuke$7ziH1qI&`5?(Pf~dCU;q_(i-SQJ3mZkSQ
zaT@e=-jj$AL~L{|=7=|?faNVk3&$2dnDUG2TXk6}uth_l^qoq8WSZqm&Z(ycJ~KRS
zq<H;hG_MWnrYozeDxF`)-Aw{jBLDY;v#!s=c>;}+f=_mI`jJsc86TTXs=){;mzlA$
zI<K-K-saWg=r#qA#s!k&V?A_+?<S;bWC8Zd><EUMcXBkZu}s;IW^trl6z#XQ|3ymI
zL&B*3)YlCs1?+=a&d)B<uBa>?M*bQ=YNgo_8mB$9P_T0UYHiI8{VB!#w_}jYyu~Sx
z^W8b5vEYFaMB9@Df=#g?P%#wAyEIck!x}Ly7UA#%Q{1ZQTU45S@0BdUM~bn%vo+rk
z4>EXiO#vA9{Q_{P)k)bQLeP7m<W7Ob;JF>tJ02uFeg|;C_>n~}?RFTK4`bGln^j9?
zb-o9gAValS*#+#kHV{{bum@`Qi7ntP@;r&s?&Q0VAfW+cJU2V#TI{u1vs82$IvK=m
zlCpa)^>XZ2BY7vG`G%WJLl*!eQ7V2pQS42o{K2(D%c+WP5<&xd&O2;iPzXf$?SB$Z
zf=?s^Yu;=VsM~UqIlJMTHQD3eStt(BpyCZ|#v%U-j2d_(YFjM%j0xJ*vT|$J**uWU
z^mLXescpD9&d1%IYdL<2)woqY>FB^OgjwRS(xEELgJNOoL&g~eCfD1cY~v`4Z|}m_
zz3#JFzDE0i&UKPer8Ab}Zk8ae$WUfWfN8+}_CJma_5)_{CxUZ|4{5zoHJ4-@MFCH0
zTemoo@$Uvl`Sokm_w79^Sp9a1i`{@|XP<xF7#=307DeHUI-9k%N)&Rpsajr{o4<q(
zHNp3)TdbUoz&Pw57n==WK;+T(;$?7Q1Y(xgOZhx=ZHwdIW~VK8cT;~IEzk_j01tK5
z$gj*$$6HcyS7450vKV`iIDVf31_#4>mTe5Xh~wkr@7`BVjRdzw6cRK{n}=d&W4uGM
zaQ{@{<6~w{oj&aBTwyyjF7VE)Od@c?b>#6xa5U_IS^i&&7}Gn;#9;?eBxncNT>N1#
z_xH|}PQG$?Su>|_K%`UC>;oMi`;56Nm-H0P@i7lUgfqH0g-com*&_>TK9f&Ak-7lG
zAMy?yRk}D0r6M+>z-poq!AIt?gJAyZ>4~dpGM9cE)1PJMWDe*a?4j`JU+s<!69&vQ
zJn$G<pUs~$UD_`)&{I<h9tN9UY$l;n9*CO$cFPEE;eL|BLliqejY{<S-<9N35>qCL
z6Hv477|^C*(=HO%qp&m>dmlw?t{1gRF4A3U9B}&*1ULn>RaiWKbpkfXj=9pben-!0
z1G7Yy@H-R-L(6`2lAsF*ssQEN477i1OF#g$N~#1REjNmK(WO#qT^um+FmZLArLrJx
z3rL(n^Dn2apNiW0AF)7-e}1?45pn0Ynrn~xHZL`*sV=nfUcVk|0+h<jD&SE<!15@8
zsoX;GG4=4)ZT|5nwW&N^AYjyZdG-dT^888AJwq+}z2ZZBwHsFtnIS>}77<&9>_sBl
zBp$XxzvU(zumby<kGm%9PUyd+_8u#N!2JlKi;T;a$KoPvwgMYt=m!>x50mP*5rES{
zN_`PhP#2ta^GD*2UV0rGkWc43FpSKLZ#tGOQWvP(BL^aJLO>R$fi{m;p^;N+tUN38
zQ+AHRmo{8^MpwO;m7j<I+`&P;^l#9h=smnr09@Ks*(#PILUZ{98jObwDp``g0)XIZ
z8M?cmC5IoS3_7T#20~_0Km>@00WFqzrjA%p#w)Bp4v7LPFeARd9<+iRy`_avM9zy`
z6bxC(JQC6SK9Jz%r2t1GXn{)<L?nSK+cJm)#1`Tqw+WH2>?Mdz$-J0?b=)@@+wX^D
zc01q@hXM}p=aT!Qh;!I)GTxzjs$3i_JN}Ut7+y9|5^c1B;Eyk45?JFvs95sooMbMc
z9$86UuO=A5L?j)w(e}C9=@Hs<A(s<X3hg<R2+dd_AE0o!!5k}(HlenQ%Bp7;6OYke
z4!oShbT=K_s%QJf`^o@2GD<v$h`;f)M0VDoL&+YNOG-ZMFpxk_5G$i#w+DEp{W#<x
zy<pM^yi%;rp&#)w<cZ@MT1PhSZbdZ*%CwnClcmu>9gDGfX@zaZi#PQnHlVmi8bb*6
zXyI{7-kXnTBlofL3U3Kc*e)<MYuT?7MT`~Z+*<YSRg%^Z_PBF6mntTSV<ym`?KKNk
zr9x{34K_*dtl8cM?6he9^C!6io61CKd9-Ph!ZkVZ221Bser6BL{~rMFKoGwKa^?mh
zR}3|h8~uqb&`V$_Dai-Fu>3YouS@7&1VKm`R7vaAZgQZNc8a8vuQT$ko>=LeXIuIc
zTP&BA)2(ofJ7%5dYtEBb*2+S>W2HWW-KcjttG6>8iZoZ7%GReb99HU6F^|8+L4>Y@
z$a@K_NIVC45olxBP`YkR>$HCIBxD(7gO!gXq%0}ysu`1vwn?kfHomH>e(q3Ox`V_{
zt!nJx0ce@@exG#rcga=X*1Niy({qJ3TDx2Cm%p=xTg_kZss=iOTg@KIfIU?L`zr?8
zs|Px=7=`1%@(@!%-Eof6<-$}vg%BN6#nG{$DkdhXsbH!ps;UyIIjVMgJT=1TmAn$`
zAav*Fzr;D0i;AEas5^-{55u9~7|DWg!QEmfQILT!1=1aN3A~-Qkr#nODX!x}F033z
zW-On^ATe_xcAhct#mIr_&q(Bf35!KHK^jLwyvt*#3jk?MrZ9;-fz{5r_BGYP7c`2)
zcmm>F7{}LqeAiKY8=-`&XW@}796?B9rU<G*u?bJ`L7+?S8bU;RA3`b1xGW6PD-1<s
zH;VE!h6I>?O0qniQ}FbZX^lEbH0$_HU*ha7EopW%F=Lr-x=9?W#+0#U*qC_4fb?k&
zb{tBvtr^U<OzQh%r<XVmEpc!;cf~oYeiSYwm1c0}gy1R*MiVrT`1!!|DERvv_*vf4
z0mPWPbW+|>AH@~GFN$Y!)XyG}9P<o6JD?OJJG~@n#=K(cF9F>#V_)GWA1p77<lkpE
zn0-rXnl$kly==DiypRQJ3)rjxsfwP#ompI^K^#3BJ^S;g5A{D3Qp3hH8Wo9^1Ic3n
z!7*rj7>*vgL?-uyJDZ@ofEGYDH7=Z?f3LD*HK*OI&V@Mm<7UZC)axP(uC2PO1DOV-
zE*(m@jAe<iIUkbI`iAvFV!I5!Cn6*+-3#4C#FTmMCB)J3Cepmly3Zr#w^1+bJ^^9Z
zIay(sxzx3M&B2Q1GHiIBg59yBVd^=KW}8%VPRoFlaRq11_6o6{f;r^U?&r#*xe;!V
zN#?h$4U}XBQw$7DJWoVLm@l^r$#D%{d7{kQ_%?!MjR1l8M?$Xw4|{|@l>r98U(VvZ
zkSI}}#(yKx2z?ge2*U#yk(M-J`p$^x6|1Frvd6@<blaz<iWOT|uwji&Y>zzy+nTTF
zp0AEw*MG#v<SI^tjr^K<NH{px<ijn;<!zy*0O>L<Bp@`4A%L~YAs`|%r4-2>`AZup
z9EgLRf>rm08ph~@I3Wn5H*vB!*@NO~Om`IB#fAg+W5pww82T9No<%fQ)l{Z!^1gcX
z?+NfZ^;d*zY?fY;!VjR$Bhq*|N?d~C<N#^aUZo%s>Q2x-R^BcTis(<B_ARQo%%whd
zY~99&4k+`kPOz?cu0<Wk(CmBQrB2CrVy*rX*r=NGSotDJ&G(Xf4IGSGz$aHxZgQJA
zmKt%rQ%0%D<gJOX%{LZ7xvwNz48EL+Cz7WOuU<+1Yw=L>U#hoK{JQ43<R9dV`Q>c*
zKs+{@%ELdgg>ckZvnoy1l&I&iE}jbdQ}a|vf}`r7C~Ok@HJ`GSJ1ujhzk4>^cX*fD
zW7j>}r-)G3u}xjUHq!|_MLKp3&BwOyjSa}0=)2paJf6~1wC3RnqT*?)KSAyS-H=q|
z0B^c4!*x+SQs5>`3So*T7$~Kl_3sv}*7Cdb{hp<|uOPIyJxF@v)Ae*-F5VJ<hF;cP
z4A(5mhVC~#g~cGM4mOUz<5RhW^ZsnDg#QfC+SgCxw`ZU+D96G}t{oW^717$fOv@bI
zPu8QbB@X)@2<&@cueY_TtixMx?>V>+PWS!@-StSv!VcB4(;Yb3x<aRIGfcOg=Dx|;
z_ejLPUlR5^C1AgM^7Vh*JO1&WXW}YOs!O~-8h71={%G9q(b!$64IKQLNS50Y?|wHW
zoIwWCj;|m$5x)yq$fcyUEK4iY0^ZK6$s}bWub7D2jaub;5FP|wq0kGNiqAS|q3qz5
zAj*-u<(Cn$Eh|nL$!8?Fte(qB%2@P?wQT@IoopJ1UiNd!WzyeTpw+iI{$~M=qwcGB
zwBh7rawReaowX;OcX5<|F5b=^;0A5SvX|=S+pBLuw)rePJS9#ae1R}JeKVrt8WwfN
z*ik9CrC0_glvr3-HH%Qgp~{Zz3QtLYbthAb5b!zTz_J0Quq|%2nFLuB=WLebi$Sfa
zVNEgg<ib!ZKkRBnU;s%N<n={@o=0EKgk$m|VX;3D-qFLI3oJ{N4#$6Divm)jutM+f
z%w8@GT1(X|)kGUKL{Pq_7ZMo&d#%ptYjvKc<ZARv9Z>3g7k$hF6*}+4WY;eLR<goE
zR%~^$&-m^B_3S_k_ehMoy*z+0(oa?pa2;Z}y5VErG<*;Q7<OGv!M5sXrl<I(X>3N<
z=lyK{xKRV}bg|frOd$^di+x+!6%@(+f!j6P)QO{Grb6yEW)N&EzJbTOZkq~GJ$<8~
z*`o!P|9Z5*<Ddm{@8SYS9u+|HqdIm&5wX4CvatjQf8PKWK<{fgH|`%&&@09t%JFBT
z4I$?%k><Q?Cg#)xOQ@#?S#tUB3Rg%<51@9KgYV+B7}NVp?r_Z+FAkW$i08<QQ55I!
ze=fivg8K?6WjG{Z7C<!`N0FSqU{5(%Vu~g##x8+1NarETen60q)(3ajO+osIf`BG<
zI)M3*vI5ZXV3>q1;W5q?-a|={6&VV;Yl-+kU1AxE?qR06DmHv(W8#|{Hpk4Q8X-0_
zPcP<d<rIiWfxk#)0c<5uQHBNyOPk0E!+OM66X~Nt`Rn_6f&OJqQUX3H42bL<2>|YL
zkTOv1Fi&U<<COn@JkQZDJTu~vutHWYvu<D^j_I<oZ`jySn2Qb7G_a$3Hr5n>tmwM0
z`M%lfg^vLiva)gaiS@C;5%HPyLp)t9kgDtzY~~6;Tj6mysvUCix4<8)B%pyMtI9na
zj^t&qy@n|B><IuTZd_xDj<NpxNLgNfS-koiFH)|x{49PS_2`TH`AVJ~u*Q1o+7E*9
zyMt>~w10eHjU!G&oY5m=oU~Bb-m~7dN5O0xLUg(?n65@uhnY6kR87Z*qd*=FUBy&!
zHQlDBt+7oh4Ii(Rwob9qQBeEXQcx=*iFPX}){FkfgN<LSUFsyJ`8w4sM`hUXbqyd?
z9qgEzfo-CyW7T1Xq4i?gQN*;8s#;<@wn^CD!#X}bSjQffu}5X>1MOM}kB4QPEvt7}
zXu~(#C(Abbib7S&6wFMMVZ)#bwq0Mr2JtORqm=n}4`+Q4&*h`BI-6Xbdpzn#!nm{z
zdtWE$aPQ_NnB-c?z2exP9Nx?+cs%c+f;|<tXI0<*92Wojh~0-6%>G@Rrw{D=yE_MF
z@B51|(oU9@HXX&b72;r(`eSSugkjh47}k8tbm>@8T+=%_4Ycs2dVhIipr2XX@V00u
zp@9<?{%+ul2E6f-gIwvNc4HtS)K-vZH_KugkkapGNiSW(iB?W=BSgYDnuy}iYrREq
zS(~IJnFbWmI8MC)5-(+F08SS9++!mImHCe%CQ$gwEnu|#;S1vEIr<|DlQIkI0!@R-
z6sJLUjZ!w@3j;N?c%D*#P>s_HP*@^r%>tgM7aBX7TD-m;9a9`R-q>~_#gT8?*l-!c
z#Pu0Cy!o!mT%z{s@WaT2)rsJwUy|vdI#$E2GTwHO&RQ&Ht-&YYeN>ads);v7_A`s$
zM}CZ6!j<q9PWM-E`}rCqU*#sOE}5+QLEaU0flfB}ytqe(BlMxTNY<7sZ<(f$SM@n6
z`>8brPPsg2>LFl~<pK_3^<BWyt^1DxlmiX;8lF8~`EW*(<4A`f^S@pkS~3iBHv1Ff
zG5BrCr8b^lWt@t3Z_XesNVLN`wF6k$bB(&L(9ZSQE!P0`btJ1Wrf|!^<UWubZjV;s
zo3fe^vZ1oPt=d(Vx0UQv{M@crdAaeL<u7fj!W~yznhrb3t1bZ|eV)%+&a~-ccUE26
z?dr1$i$I&02DIa-Mb$mW4J7|&FD$1h_86~OLQ!=(Gu+K=zd_f4q##!5>;Nb3z;eIY
zCtz;pdUmpMzfE1kVpPF|Y6LREs@U~yf)&>`ZPQbI=F>jN<Cx+S$R@R4*U0R>M0FP@
zpgRal-1L+#*2zF}n}%D2H(9$WBgsF4ovWao8fLS2nVKfGH3bX%TJhh5kf<J}^m7W<
zvF83iISW~j_S^#lZ4{|{5wsUUdl9sa2r5yA_r@en*>(e<_}5FY4>PN>dg>^)u0<5x
zGzr#R+sB4YOl&icV$=2wf9%_;t&kqP>R{kik|)Kb;RO6ZaS_vA;9+oMN)SyrM$S`#
zxza30qpr!Yt(g=XCRMTP=>#i|<(ek5y|J|kMy-drD*yE`SI2_6x?0YeCUj5$N-VTf
z-wC^F1zd_`o$;mom;w&e1TZM_o%3vmLG>z0Ag%V4q0eCT$WfBAjO8%(IfSC3M0gYc
zmIfet$61co^jjiQiAxD3fKi@-Hxn#IK)HXtR1bRbj090uG<n4$66NSs7{<33ufv#L
zqYpur9}jg3NJOM27pk$HN{8YRrlzZpiGjx|Gq6E4AG?Z6u&aBXJ=S$ychuAJB3mW0
zHObmJ-nUZA*)Hk3^c3TVBxRHZH$1&`!%wV8V_nBiyW$9Bg1Ba6fn0`2&V9L9inuoy
z_u`ty^U#BjNgBjykOu|kTj|q97cNUnN+!@cM^VdD5=22Xd5*5+Pep4~gvU-<l_py{
zhQad7GX^gH!Qbb?cWxn|(!M1zbf3o~UM6K+#Z4J<Sq6s+PF&%0mZb44fo%3EOX3vR
z0z{$(%H~-jPfD5Po3GsrE<)rk5|Z&dNld2<M-lyrtdJ}Kd^<P(cKCeVZJ-=BIJ{LS
zu9LSLb?q@xGz$|?(Sg^X*tW;u@@80y;V7O%`rz-T`DW>Kbx(&a&$GGdJfp#Sr?72l
zN4F;ad;&gi9FJ!;x#vi3O!cKOk_7%>OU4V{&6fP1a<;FD_w_0zz&?DvWGQ7)PA2TD
zTzGEw@#47~vH?%$G*}(YMO9>J3PW_RD#{3H!-mh|Y7_tTQd!Olu~KL`n5tzq&@~pO
zm8M04Q8*X{z#C6F(VPqvdQChe7YqHK7uvpjy-}*Ts(YhU^=$P<sgp`U`dtF9j+;HS
zb`|brYE{}+>bLv*Z+GKS+iSax`?joiu&U3vp0q7Nioi;64OUJ#qfdWDmjC*s<6WrP
ze2CQCzxa11=Z;Y(r^3MY<lK8zZT70Vf4yjrFR-KyF10$@$@*-tvF|hA(y(s>ewS+7
z*e0%nJx3uXwJeM3$|E)x!7i#wktgV_wCObz&NWNYKnk71%?6|;>tF>&unSjUCF&m(
zplL+HGSDBamdH=p-{&j>yUQ|mL1m(pt0B!am077k2Z*B}k9n3I&_Ev)Ea0%_7HQh-
zm=s0V9mQ70STkJ>-~|YFEW^f*&1_Beh|TCdAT>XQWZ5-COCxmVQj-Uu2#bMu197;9
z&(SMkT!-6AWDcy7S8==NIuj7ksY^Vtd2&TSQtGmK9d0*l9KGI>)7p|#VakorU5q))
zTYVaKoW|3@Z7R$2?9DiRY*8Ou)F&O^@C5f}oRZ<`%{WijYS)`_8mrTraSne)w${3W
zc0OZ2LvnASF!4#4?F96Ej7P5GYoDC<{6U&Fdt*@bueWV>A?My0beeooZ`(Y~^7ps%
z!$w2z0>aqaHos2<`l{)rFo~V6eUlKw9P0+wJYT~GF&TDs)5WUhm`qUsdd=@+(hnVz
zeibLLWJDfBRN<>Q*%`%nS`p|5QyfJhE@op0!=%279UY=FnQgh0Xv)~u4jzHNc~Gs4
zk(K2fmGMkf&Y<_wh*!iOV~ooX<ea!*Qn?8{mQ~iiAj)HDIFzA+=={7gJD#7n3n&)W
z9v;^#TY=e-AOib3IzKPRD$L*K=iJT-q0D)P&d<dF<N}<ZkI?z~pFe%b;HNl6=jS|h
zbUFhskMr}*@w{7hd=I~wv!p<0E7PG9cPnY$=}hZ)In&Z^uNmL}?CyOWeP(N(WtrF~
z4y5U&8g^Xb;4#w}ab1TfhI{DasNeNCcJ~UX`vd&x^1ZYPFIF-#qog=9H7@{eoQIfV
z77FK;grx!G1LJN31b)ThPv|NIo3F?nk9@|s!CwUT1|dWxlk^&LPPR*>n@rJ5RL@Y*
zDkQTkwQ9HKH^P^*vI8D#3_0AUWu*cprOI%@YeMVaYBiIom@0>#q$DKifHyKD*9^<~
z7bObZNsswt9)e|E0StsP_7Y_|OT<c4254S+*c|Cfmty?K>2)5-bSr}-4I+t-xia4s
zbj{%io(Ar_QO3W@AjdCfBlK$uV^c@vFy%rHM;*HIL|^M;U6%$R0=KVZOno&3?I1%~
z@p4(}y~#{hz3Ux&FE)DDa!cyvq5M2j>RZ*PQT16-(^8H=C`pzR1j;Z|*^g{xJG-<y
z-(OcO)4QXX?u}o%CP*|0*;dhrmuM>$iIf*_+Pa0UNzm5@d$gh7-<pkWy99L>GC$vY
zu&qoI&7o@TN_Vh9v<|+i8!231neHlgcQhk(FduZYrR`-y+dsG8E@=EaP-Dh`%O>e!
zZ<5@3ovo0hram5$yvx!q3%xsvi%b8E%=385sQ$5!Al1RS_|&B?&Y`30BmgLoAbG^H
zm+3LrS6mw#x@};?HeGC!u@3-M#4{ajtlFDkA$u^s@?Q_ecXu$pAHJOZVU1>szYHVv
z;loEHUl+tV)-1?I=#^w3rI?us<Sg+EdJ_@=54#7jJ|SQo5vmWQ`-XUqa#$9aZ?OV0
zyrdcgUo-3yh&?G{Qb@US9ED6&p<<n$@51@}#BKt1%e4^DGOs4)Qz|U-DVwqE2gD*+
zT=bdv41EZqYY{^b%mC9bj)Y8~q_G^T7)=!`vj%33;}t^iLp%#O)?Wx|MLD3_!BGCB
zDot$WXE8Jtz2?||ZQ;h4$qd`^F|~CU8!ol6!z>-UitYKX$$VY)A928zSem7?2_#dT
zqVscpj>K_6UJ;^2HW4uBzQh4pJwn}%3y1sz96f^Ql%#nfr3>^xh6L9S{guFY1#TcT
zB)S&|B0GHAR?)nW{QuY`oXXG~<{O@dEtNRfP&@@YhT>yQQ#H?{Ow;Ig?(=DfQ>{>y
zz-A0)Y<*ajM}ly{^`g)RD0tu+1kE2WBYI@tXgCL3iYF93pzxDGq)qHN5jZ6xwdAc*
z0??ssk>zam9DQQ5_(oVzzMNfLd^v-*NC~ORJA?IVr>!NE33`cUBxh;BlQR!C0P39-
zPTmex^Kygy&$Y<XN>A%9YP#8%$PJ=;udwn%p_olU(N!x88IvkaA?!lE!&$wZ;gD0y
z#<KO94u_S7Sj^&YaS);FAo5;<3MiiEEJe`9u%TCO>JDpDST}VNvW&99(x(wpmh_U<
zY)M9Y^tz3TNqB_#8`NTrc)6~5W%-r!VJT7NL4%+~7lj<YL>aA}nK_qV=t#J8@u57V
z?yBqR@fmjLK=$-us_{7|>$K!5o;p?-#k#IiY!FYuHf0vpOna;tl$yF>o*Ivj@QSG2
zWcz=Kb40?h;GhMdHOT^wP)*}W6#N@Vgd=o24d@gF8M>Xe5rXHy*OfAE$;hD@%cn8O
zzd;1d7%(k2L7Icqk&(y)=8Hu)K^jNgcLZKskL4hGG6W7LoU8G{f>dCIFIVRf-EkOC
zfV~Uj_?i#xI*M;2lyD_9yph?QPC>XQ#WXW6_(C-(HetXz66lgUv=H7WB9yX>%l5!v
z!cZgtKA>?!X3Lahc{->0Tws}Z6{%L)ULTlAkgS{Pf}@E#ue=*cCtc+o(->P!!HQ)O
zY-o&O;=2wuJ>pVJ)rd~*UfwyZyaT-5QpE=KUz9NM^8y}U7K|on9`PfA=N!&nXoA{_
zDzhL0j<RlHZ@QUm<e#f1$hX!_G}-E2V5)=bd=$6oI;m-m46y-Dds)gGp|@8r6Ov}^
zE4(j*<=%=^vS5*cYuP1}uk$D&^m_32Y9(*%Z(q*d!PO~maW0zvRluMJzK~t`@SiP}
zdd9C-@%^9H6@Uy1^IVi2j-a1EfBLYyn`WWaUYg$<o!n8%gyQn-$inct@xO}WQ2h0<
zlH;ZgkkaGY&m(2?idOYjzK(jybH8N1;MI3hl4p}Nx(l8$KSAw9&(ZOwvUEDS&!q^^
z?Pcf#_zpaH8M?+mpSCz{xt69IV}f1P(y-w$3)_xLu`;%tG4VCc^PJNWr!$1PDSO!<
z+mxnT%Ecc@G?{~p`RaYmhy|R;Yp@)H{gkt4=uJF>gi&Bx9lZYO4frF=@f6bUEcO^6
zy`_)}E1m#H7u>LLfkH-7Zh#dU?rA&+0hvpbDI+1ijnlAZ00zN$mVg3)3$-L%aDf9<
z1Et-qW;iC9lo-&vd74jII*U^_LIGG@Xq+Z-%1!X4)cTRoX%I2=p%@i(^9#x6DG96P
zxJ=_hz8?JY;d0nWw-v*<y%9_k3JKfuoQFT<+@@cTNa2#wEm<Ifrt=wz<bKI~S|haJ
zUg03tOLsgeX$z5yuR)Fo3c>RkfrP@Iqu==85zO?jgK3^8*^7${7$N8az}Il`d{*rL
za~jVs+%TS8lz;LhMfh<Vb9&G%vsnTcMX(>ISQNs#Wo9^(D}+hFzwx!lESi#t2GIob
zxnr3g?7}cq#W1Yl!Eq_g&ajk%vg<w|owN#6(+x{;Rm>F4#D;HC>}sBgb$@JAg*wE)
z4^YbczGLccFp!3h^Bw!$G|4=L<aF4b2VssraB?n>+edMC3_g7LI0Sm<bPfki2A!c-
z?{N~}a*ufF4a2ovVMts!;M^K2Q_?+0zs^&X#o?U)If`!)7a=oL&@MDwJFeWXq(E(z
zi3TBmoxEMW>bA)$<s@hh#6^-NjCtt4{^Nh4YsLVNrUv9H6)W*Phf}?X=Q1xIZ*~&g
za7$^CN-s{Bm`a8QpMQM=cMh3>nl56uC<NQ7i1XpmcOv+Xcwh>L2%zeIx{vE2m_$L&
zaLPR9bLX1oxnE#VCE+lfWjK#9tZ2wE!4bQ~EG0PhF+ks57`mbvn)<M=2SM|k<hxxF
zsyEhjs#(}nR3DrnP3-8piXC%I+%aLMqTT}=@>m=#IP@$iAIWUS!(<9So+i4o*cW%P
zmgQNeZCt=>+QQf8;d*G)^^Z@?-{Kjck5GlJs1{{ZFz6T85yPsJhIGkjx*!O=7UZ!m
z4hXw(w7SMY9V!~?jxkZ2)IeEI+Gv2FSVsjAmwI1KCMlbgz5NnLEhbrLGP-qG-Hd1O
zcxTf%^ji8KoPkKgql@E|O*pP`%ZgP`Kd1b0Xr<t4try~9LclBtway<pAg+}o`%9sH
zP&(938Bfd|2|aX?E$gr_K>Mx1k1rp`BD5*C(>JBvVx9#wj=CR~71BM_aB?!aV&8!A
zIBRv-`AzXIj`Gh%kQ)z4>d@6?obd=E?sF06c|1G2XSbgYjA&DNR~J;<1zUax?OnT9
zu@&G-CxxGF5nWNKi8Yrh*w8J49b2Q=wp5ofHl_~Qg!b?RIqlsh{!RHIqzo(-Qd0XS
zeVbc&-T)1kta^~ulz9!%m~2TNhrZVKTsqp+qfRQd1Xn%gQx*v)gCGJ=8SrA}Fc>s|
z_01lzXLir`*FvwFDklWe!B-M324Buf#Wc`J7zPs-QTF9*^yLihOG0x5B8M9W83+C0
zUw#h!98r=2a0GyW+{A&bb4eCy9ERfO_wUh!fDSo`Cj2i~B)k4{w&F=p_w`;g+Fs!3
zE^s8lQO(YaSKorxhUNm(vxOINE1?A_g#8M1#UZOfkE=W;KBTS@yA0UL+7Ug|7`tO#
z!M-{+u;GtwY&(vP70uTS!_;-fV2?akT7lY!1fGu6t6epsIFWEt8aCDZWwNxiOq#cn
z(JYtnJc4%+!K<ZRPjDdMSrpF`QD*Hsjt1=c<oO8kJNpeuy%CZZ_6W(_dbpBoZO*4d
zax@JlQ<kDM$b`3T-K<FHb;&}A3Nx}mE?ce#uTVCP=b;B5>j~I6gjO+0x^P)qYVTJA
zPM<^CYY}=XTcg645-_+DMq$Rq67Voo5m8$+G)~z<xIupd(+Pk930q^zg2<0k%8<*l
z93|Xx2r1@7!nk;rz;2{0iBs-jNumYH=2;@G5*6PCvB=yGiQGj3$Ge<P>98sK<IrDI
z7D)TWgGe-2yP)Dk&~rCOVV5|b!(8mywucR7de|kVjmg+hOw+N(V}IOB5mJg+7oRR=
zin{dRF3=50Ih8G4Dj*3K@&%;tl7=>qpTsH&-1;j4j>oo)a8E!rUOLtCDQrj1+sH;g
zC@#9nZSiskL%m^f*ER?NiNzXMJ#5^bRxG@17;Fa1>E+g1$a$K%^%ME+StIc*FS)@R
z`nPAIUtUK1*oRDR#&UzGnHK9aNdvE=@X!ECZ^QAIAX5kTZC%2=YD*O-mKw(1&GJ8m
z<O8icybI>rQ4(^rkgV@nK<>hSu91)>1A4Nev8kGlLtG7euH|4ubxiCU%)y$i*<;ON
zR5y2M+&6#RxYbV=lAFuO2qW|R!@}JUoW5pKW9(Z5>n6BY>L$aELVc{8V_(sHSMxWT
zSbGe)@?Vc3cXtfA0z$6t4C^jRJaH6CKyePFyy|=gqL)OAZU$kOX%oH&n4Gsf`fRiz
zQg<almzT}9&S({@t}9So;pn#$K<+Or<zBi`9thX-!h^qt6PJKk4^t`CZ5gXpAR+lQ
z`++ZM03&h3m|hD%+;wy0F$*c1@MT=YbL7P+igW3#3u`cv0y{~PG)~fh<m{+;a#}Y$
zIm;efilsAb5yQuZ%?P$N$HRtUTaKoUZQb)8u~K{8SzV#_rY8F@Qgq}LG6y~OAYo}U
z#C*631EE3ZSzX_?dd6O$f0>gMXf<LZ^greisH8(6vN%QWNDwj)4N?Z01m+3Te4O(C
z2Z!-r-hMiOWAs`|swGG0rZRO+#V`qRvFaKwHay+L#5Yt-EL}A{-D0+7^eWTCV=I)e
zPm#{zU~UZ3>d-^XJq*Nz-OAnNey@Pamf*Dted?%o0hI^@E16Mv`&Gd&XG3vWiMwh?
zz1pqDEAnI&JL>Q<7qv>_F5FQ|6yoLIrg4(&tRPE$IeP-2d>g1hA|$N)%7GOc<RJ^!
z-YjLA5@eC;Z@fsc=khE6m47JrRelk_^H0?l%5U-yJ#a%0+#ooXiVnL29ZXWjqKARm
zz)6138GQHA%R~8ChhKY~9yRa>zft#s`*@v#gx&*wJPE*$x>$GGh#$<>9ow)e_SCV3
z4b4=s>$(P3sm4@Q(V3?`ex*iDPUIqB38z_V8}CK0v0Hn$UXyq%T*$X9hZX1;n{7C*
zuev(66-u$eYz-4|`0_l)6yI_cdLIxmPfu}C5YaLu?0Rs>R*~BeH-MwZtGq9-y5lHc
zM9J9=X5SJSfi4}&wqZ~{mx(`O?xh&}1IXtUO@{S;gDi?Us?lN~8(o<~kt?+33Rh+7
zynm=ixko(9E2^s}0<b-B)dc!?z!J`bi00)|H7j!Eg;&o@TMb;+=%W2ts<gS$QEfG)
zdO>;tF2h0=<0cucFLR%r;Co_3t_zqkAD}<b9!@ByD|!f~?6k!WS8-KK*Bs1LVqrto
zZETNKhR2p?j)|qX&bWsb-y`n0h#2yMo4^B%`i)rPi-K9~!Ylp+fd%WKf~2U#!-b39
zLtutUjSt|=?((}YpZ&oMd~plrHw)a5|IA_Z;hq$!#D*i3#fTJ<H)Y;1cY$W}Fb@(y
zJF5bJr1%y`lmSM6^{K}E3dVwlWS+6ZGQCeM7Wq-~giS6+lv@{`uuf~h;|WSmsa8fr
z8ni;2c*4*~#|$*MuegCdGBKS>?0~M&X&*aq+OY$pu0cJ$aPb&~i&MrPFtxGb62-u#
z<M`Nc3<cYY>0-+s`(tBlx^%3Zn46|>lYW1BW1yc|T)MVxG-_~#D|asjS6yH@mwa`l
z2QP1t2(}R1+cLnKC8dkylBHt>Y;=T37)KLP82YTYhbAnZq$HUJ6wx?Ny#VroWoQ6=
zZ$9_f2tj53<4}SW&!apA=|((;95H<fy#T-mFozx}JdHU7K|D{3p#BncK*mSUf;<rT
ziN`Xtz?O6}v3Q=RP*wA>>bfd6ys-y)w+!rSwo85Ljj7RtavcDat2zRl)=SD9ROe~<
zfQ=;gCt0Eg9>ZS~0Bc*f1#7A*)tK4OEPfyPF?tD?(^t4>zJluiYmj`Ew6WU0tolLT
zS|a@!mr)0@x#z`=HXNZ3#g(?UTzTI$h0m(bQQ1$esgXqD?L*o(N}4m0v{;=PNji#|
zVN7A?po<SAhaG7Js#y?(tS5eMRk7G}UbFnAO;u1b)Mi&8bG5CygfskkK5IGCW_qf#
zik92eXA>5AA6cFTwBx8n)jh`@<P4<VJs^^!*kioryMTpWw=owkXZsDhhR+O9do4us
ze>^<wwB8cb;2S^gzPKK(pk|wlj5STiV{bghhVGl#RXhhX#baY?JNDS@Z9qq4bAfZJ
z{klfHTIGZ{@toVz4{YPkPS6%|cV3d)4bsIr7Ex}}Hr`g&ZnBW_k6@$_bW;OF67N&f
z4zg0LTb2i<H)T9NQ$~Hqdt=7a1VVbKc8HyfYA@aO(%n;$?xu|7tuz|EmMneQFa!6(
z;UjkwEO^ALHa--ORz&noOVt#|#i|Kzf`-O0@l^#|I@8CdV%wUsBiLl~#~v(gBUqYd
z7G$;x#e%uSS$O~9I@Zrqfml-&UuQaVv8(F}HXPH$j;S%MsLb~*$52eRi7I=DwenvN
zv34AYwX0=FaEXQ=CsGG=AGm4B8j$lQuo=lZW1IOg1+47}gtFv2XSovr?WYKkwnbW`
zILmSA86cVqszk_ZQW8jygk|Wn1VRZjo^h!JRg+hw7tbK)=1~#N^lpe|zF{%XAU0;2
zYhr^^4-=-_nEBKktFBMSj(SS2GOI+hl#!!=)K`@%IY&XSr5g+<`IJ!>+;DIAh7(NT
zk6z;N^;t4bD@(?H88RHpb6nHVu`*T&HZ;$`uFE{E`zH0r4kcrH4+(J|Rn+v-!Rlu7
zC=ar^=^&%QdX4|%aQHb{>&X%v+iGTu5uaN1_rib?_=Am3LcEJDi7(_#UlZ@^RZ4*2
z_<G4w3W;ea?5hNf<K`GIp1UC%@C?R-<&j)e1(pUsMCV9Vlo8T~4a3)R3;*;|5uYXP
zx{Ku^%V8-k^IxnOeU_RP=``Tj$=Qm;8_iijq1VJia*fdMd7<sA)`!2GbofheGiqrF
z>1{@bwHb|$NYsssa4$=!a{REaJ~Hd+5oY7@-HR}d`;Is45NkN&O5e6eM?}+|y+B%r
z8ru$y@esoqpN0d#G0)5s^=C03A~in|f0kpCa~F4m2SLs~4L+UN?iOC3ahksd<=<~R
zT)KLcsiV4&T*XPLE6PsXi9|D1MNw4~k8MxKhH4ntH4KI=Rd)@;S2V*m9(gi)RVh+s
zy%ko*y1Kk(0OJ`2=8-qtZ1-wfD{BGb+he^~BC$cInnolngRhrU+%HFy&j=)&0*F(&
z5;6ySl{3DG*p8zhkHIaTE3^+9z<od~k=T%qb|N<RsXO)=He5=up_)1-j;mnXW1gy;
zu1fo~K!=Elso94b;W3w*r2HcE1pt%8nHr8z6yKsC0{c(Vp6HOqkq?AV8Oo9{$kE`B
z!DM>z3-D2)055>TL^^&lZ`nTr%_L%0##qFG%ETz1qgVVw1f!M2N33$iaWsQ<rZR4L
zA|CiEa8*H4YUQi!@Qq{M+q?>!moUq;NE;+gMtuL@#F1YQ)~Vr{y(uY!8{H(FSu@;+
z|EYjXYlDWi!%|kkoQ<Gl{g&CscDBBeuR!5#>T_zWEfcII)ZN^&I5zvXEoyIUU99A1
z26La0YxXr``PaY~wmiAaqs?#wHS~b$W_WN$MAXiTIJ?2Z)cm<H2v(~D!GATdz8QLn
zKChziHS#i5BwQ@)U^YZcSO&j6YcML@g1Ee%Z4H(ZHxj66Se4<FS^F$+;aUOlm!p|H
z8%Th~s_=Tki2jwNDOn6kV*7Fi{|$RfX~7EhmePl#zBystdasQ<kojNSz{fR|_PhQ4
zb<fQQwcqbkw>8|OA4Gq=zyEgk-UUbWE_jgk*xnp_fHPAGi;u`E+q3n(lfh=H?tNx<
z{p+RFN5seWJ~O?hr1zQWGqc^@XQr^}pSHuySRK1QWj1zA&%lPGDA;j47aJ~7sHy0t
zqwdHFz4>F0y0RH{#loD>Du11;I4Q!_d9*st<3yqxJQb`J)6|JiiH0d5DmF}4#V(@?
z_9!tl%QanQSO>>i**vILPFj_F7W$l!SuI)fd+EDTU~FKFOQ?;UxL_r{2_U$*bn*zI
zJeDphMasML^UA^H{Jb4>hOiWKs0-N&%!C9HxNxEKb3RVtUv+-YeQ5x&BhS$Jx#(O@
z{QP``&d>k+=|cuT#VI;J=M*}HK<VuKd^5VmmYv=M^SN{0&wZf0DiAMYpJ^>QhVdo7
zA})FlNC)5l{O)}uiRI`-F$pH)v4#yo4eZz!KpPNG@l<!LING6)q<+^U*&VH*j#Kcb
z%lFdJVS!?Q3CSjdjjj2dalb4`VaY<_Bbl%?h`o_;Q6umx7Jm{+UQs4c1boK0ua^M7
z2tsfsBk48dzHFBiJ%g;)b%f?t{!C@5Ri_sq*)L~h`+u89*WksFlvUnJc(5YlkgWGV
z=FxSnUY3Y?au+E|LXr-68{j5_<>ZSJ1(31Fd@>KgOGjyBuCB6c*OOsG<zZu-D?ReT
zAE(cG1n>&!muQfrK_tPJS7y5c);uh;Y$FcB0AwUIFW?dKYswRUkIGTXRTO?rEqn4r
zSL@LkmiiZ{CRY*!sTzWIkRhyiQ!dZG;l5n;u6OKRZu8E?2LIwbMuJj{&Wx(Fl7^Pj
zoI^pfoE=oU3RPL=cjazwlk&4`vd_Dx`P@6f=NgZlAY@yE?s$o|ve8){<e`{b8wdF{
zIXc_K05;U}TQf3lm!r-?=I474wv{EJIaIA(=?<oY*0H#C+ky+s(p{rfI;yHVIP-K1
zDO?RDY!fcEcYe=ZiB|4FjTr;}nxu=pNwQrk`Z`H!>f<5FyDaUpn7gC6xb)A+Jdd}G
z>L2@vP#xk{PF>#O{P=YefV*vwJYqqM63;VrUB#;B+8}7z*rkqx4UKxHri~dhH^DRZ
zIJ4!y9%uF-II~Ndte<=ze!3B;s1PE+Uy1v`mgOTkBDC!4)Iefyh}<ZL$v#K#Ae^dR
ze1vXU1q)jOU#2XHQ&0uC3$%#mDI(qsqAQ_s;4eTmk)av!7)k(&wt(H<iDCQRM<JU8
zc`ze6LwxoDG?W6uDap8QVuVt56R=x>Q3#6%-M*fO*IeV5P2<qZen5dQG#NpLLPj{6
zZ9YxoIRsPWKpu?4AkGdAV9Q4&@oUv?__eCy=)Ue+m@+cPhHo0!Q8Wkp4k4Zgu$qp4
z50Smvkzh4{iF4-0@%7JOAZQ7$$&Cqx2*<pjEyx_C#Apc?*Dg~=OUTjgD|AQr(XAk)
zl!O%EGK(D9jhi5r2c&lOfJQH#=ZJX|5nEa+>SjR%GIw1y(bUXU8j4vERe+eoN{uxm
z-&!|O$JCTfTwEZRWb9w~#J;}!<?AcBbH09_yR#tU7tYtummiDHHWsLN4~5@^@!Wfr
zB&#^2mA=en`7H#p4vJNH{=Aq?BXaE(Uq+x-p_AkTsQTwW<y;xn2(hb5h^kfOWj*xr
z6S?JMd`ogN96oPWYDQqLpqjR8@>dtMKkvQ9oR$U$k;GrllrLwSQntaLH*DCyzPkMS
zc}^+IGJhU^<=WWVcCGomyjh%HF5@gO6t%0nCifr>CKHy5ZTOrp8jw(Ykx`b*Tg7|(
z*H@Q~&!1Sv^{2dm7@7Rug*MhM5ggi!iz{-?5D7yBZ)h=uQI#DYP2*cMBhjLIdT-%?
zWdI+*Gr^bZ6)q4B836;>JbAuj7ycY&+xKCmz{A*ye>%cW?7Is-2|@sIh{d|2d4jw-
zMByWrrf~|!L~i815WLaFtIPN3hDBbSW@sXWv;t_kuwnW^n&lh!?(^lVk9>39U6$Kb
z``fX12y7u=VG#yj&OWh%qx*6;f?ty~hCP9+ZP<BR{uT!jx(*`mC1@HmHVY7+LH&VS
z!iuhcYIR>1kI!&p?V7bn+L9}i(Q2haRla=HHe#(;I*X%~3R@{t(jU+!(8;^Y4Bbux
zIz_iI<Two`K}6u_!!QNK-cDHr<au@VjH5KnMA<0LQ5JJ<o<t~{yC8?;LL`Aao}Bh!
zjs5r*QP7l$=5kmZKbFRJ0nY%MApm69OsNT(eFgMwKa6iHTCM+eEw!#v=yppVC$!qW
zmG{RUcf)r^2XAis&#c<?S+QbujGE7vA4l*tTB49&KE8jOp#ki+7i4)5(Y*E|a~l(1
z?K&g)wSGyUmx#ETjO8B;@;GHA9F$wNk*yjI|9M^6wQtFAIJ{VGxj`OVnp<KKx^?`|
z9VUcVhgjXV!{P8;RTQi$%5bC&+eZ&drD@w(m9AE^!&=Y|Volp_S<7<LKF|aTcg=BF
zX=0ZW75)NA<vRq9?2}+|Dbr!4pJ?APC~ISnSBHBT1mgD5iyJZ~PEy9APhHS#QGM_~
zr(9pr3W&Y<*I~JMZ*js>lE<7@|IlTe&9VNaP{BK9=SEVNq$~q4jDlqNy0s3B?GjjV
z_eJ{g<wIGeIOX@sDKC?9fMsfzwzPA6N~`?BWt;8qzktTkzSrN%&2fwY)@|*34zzP1
z>AuLmcft1UKnWdIFDH{L_6=q)J+~UV!a<=K{Hf3kw&r+>*Y{l<<)4c=XY+)mAHX;3
ztn&~r<BVH-xj{V6^LW-a5V=jUc1yNwpf+1x2rHo&Yu5U6YmTUUM8=+R8GA)%bXreg
z08w<yHdU%(!*&=pe2-vTF&%813RNxD9NX?L0NJ*Eo|e|XSJC$>`d&rftLS?beXpYL
zRrK($SJC$>`p2rG=OO@nqu`zTQrbjI)5*smnrC1Pf=CaplXxjr)tlAn2%{b9Y%yIP
z`-28shQYPv=-n?Fs`)c4jiZfvy>*9R_4>qsQ)cL2Ns?^sZ@)Q-W>IBY2p8MuwAK*O
zy1QTEeCI^A7*E=E(-bSg%2Nioq2E_s?`iKr|BSi}8eO2BHlHm`t}J%9?l+X)G_{?F
zMPgSYTq0QSyDKTf-)&RSKchBeecD@x%Dt;$dKVif@Vx8WC^x99y{|QL<f+^HS~_r+
zGulVLwH(UglQ3($h@GSJwnZ8>D5sOLt#$0)p6cFCF@4*n*y%KMkM%nYWZ-ff)sBdz
zyI808MzP!z%lj@ih$_PGb1;blKcFPa%OJnDNRB(B1+^ntx!RjSTG|KN-b&pwnD3p(
zT>R@sM0Y)*dx9Pxfd2PB0e3kAdj`iIgZMj<|8dUBUr)-G)(Y6{M2%^-XP6cv8uk@~
zV8a`$*fFVveU}i=rkbbun{aI!eeNpq9Wq}QJHNW)EhDXL%~mznwlN#~V{Eug!H%cu
z*k)rg_H3$9gFWILic7(bJd_c_?uvND^K%{~B$#thLy5GBWK(1y#0rU6#Fb#hZh?u<
z(G?_)OBq3QO47VgukrMEQ-;Lj0o|2)d_N?U3G;YEHCV6g0ND}OB3kkJc1m*Sn&#Lb
zwv7#4aj`)uKuK8)J4A7nF>^ek-2*Y{M~d3(WS8C$hqg7z;WA0ZH!MXU%C66L=#d~?
zv;&YLlL^n>m9sPeA(S-&&gy>VzorwO(C#u01G*4#CLFvFy3T?b1kqIi5$j5SX7tx2
z<4RgLUdq3>35n`Kc%Coi*n?7)-~3DD)}#4Ge7$8r9{2LAmE~asrPc-3eoIs!4}IBK
zwi*6c;Z?1R7m4RNOA)j&Y@l2<bvm^vz}nYx$imD?$TG?X68A`1!bqy7NHW?!tyv3b
zkG+&Vhf?$0QNgpS+JS4G-|8(Y^K#votuq00_JO!8tkrBKMz!VTL>C1nNRv`pb9UTQ
zynt(Ioix5piu1d|?i`U7YcS#M5Oy9bp0MJ$V^7x=tXj5?4U-y}P=#SzHB{49JXLqi
z9#8mS_%{Wfu!VuPaK$NL&YOOJK%DzQ4%SR<toz0o+nNH%!Ip__TQ#xjDW=1iO<ecz
z$idnHaY{SEKXeCvXb1Vwqvsp}JtqS$skCB-5<GQOlR$Gur%@cnlf_7;$3;QprzFeM
zInC!Ot1w&&sOay2yyGoTAsf|lnwN6`tkroYMbfJJs7OM-Yi6qmKV9K{z`Z0Pvz>4{
zpGc62$Xz~wH}Q;5JV#u7L4((CJ`5|+9NtS52ic;TPF>*olqf)M7*h_XGYuwFd;`j6
zHbP;1i}`(zT<A)|x=R6wBuN@4X+UyzOt>Ab8{Cd-YrbJ<E+#rruwnRcw|YL-e9s_`
z=@`yN;OEDu1mb6Og}|Fip}$Cuo`=BCK}H@VENu$cLr~7Fi0n%k(!8@9k_Pd7-Kj$V
zGAAhkIfIQjWG(XJ5J)Rd(K`XFFi085ZOjuof;cU)X?}V8X?PsfPYwOKn*xYfx@LLK
z7@HQQ*f4z;+luO7rchlsEXT5UXj*#(P*(*|<Haf9x(}cgx(}t$cTxBh0OxX*i{$oo
zbrhe*R>XznZh1!4rj-0r>XAmZLoWUn_=6REb>4hc@XOgyTnOSm*io-`bMT5V%x^pD
z@G=**O5(oRQA-r!<=>_;c<$|}AWH!n%E{}~))RqLsjc}qQkIEBmaV-C$}%0uBGun`
zkz&W?SN<#iQ0}VyB7WzestuIi<R3=8+HXI#A0%`*DYf4kn%z(LcR-u&elw{~RQCyR
ztb_L2%OlRBI`rLVA+QJ@#5DNr)O`ji^IoSQH-7gCh)Z;@8GQG#%S(Q*!9PhAeq9(k
zZFRmg_H9SeHLM#<$A;qj*ag=RL-SO}B#bDIc|vM{np;Szl)Dc#z;3P9dR5zz{5;;W
z9OmCm(06o`5l8W`ZRiR%9M8nAV`x|>V^>!lVkvs>>2X+3k2(o0xi!_P<N}UI8i!oD
zy4ww@m7?JLV;(;Ubwvx!!J+gT-PIbi8_d2XFrg|PRt@2JdDO$_!i6kGaP7waK%gQw
z5RZc_igPwg^2I>5Ic(uGQzgsVU)YD@lIUb%7%Bg&prhiiO9H%Hc%EPl)#dpBwBcNq
zNB>?%o0coptjMK(ubvUE8n~>{MP0B|X>+5a+G=k1!zsp1GFo5e-YKV@bpBu%OY!iY
zHdE>ADx-?0V#Q!8HeAicj_cT18*8>hiEg;|W~YeV{X8|F(DLf#2GSt%f}6kt-{oe(
znw_~|2-@=l7Z*SAOr_97@b@`91mc2cUaiLvMowz)4rgMP-x=}D3}z66Q}8rd;D-EX
z?qLk)Qusg*M}W*sDim<(@a!(oY#!!860&MgB}*Phl!3c;^@&g7(U~%iV##=zyg~Cd
z6XiU%oP6`QXX_+19*A7Nn6)w)|I#YUV!J$@C+V8nHf>Dz$i6*d`r2x+R?~iV)kfFD
z_}YeZ?jL1akFYJ&W*zXAIe+nn&zW->avz{IU7^#qAdhXQxo@1}9ubQB#U|b<DslhR
zon3=w52YAwF}X882=kqulr1~GcZT;eU?<D&Iwms|W9(pGaVa)b-^aG<sMyjC*HSD`
zxAYTpr4n9@?=No*^fQY~7nF^fRGxo}JNtoa9I#zWZi3R~j<-kzbHqT_&0-3EbJ7uN
zNx#|voDw-e!Z@0Uve0F{IW%GMBqhl-poqqC>ID(^lpFx_m(M-!#TQNZk0Of;=V4M{
zxW%IYJ~rr&EKJJ4zlHDuOoQwirEJ1ihbJbA=P8Bgy*Nd=%)u@r_s}fJ0|CQ-B;77-
zNGH9nr5c_}bsu}aMX+I+4tCYCg2%35S=6#T%esfednYHYHMF_zqDKFm&`Y`;REKG}
zEX6#4Fg@N_jq|UK_CZAO)g+B-XpNEm%;NWvAETFW1$>3m{1p_AUxVbU+=Gpi`XKLy
zdJZ|+-1Fkz7>>|~;^J6auDn&6qE6N4sO+cK)JV+iD?)wH-A2h~Mv@lQW+dq-)`T&I
zy@M`3kR0};RmON(O|bDihOXS>cJ(D0$bQAo?K+lJ!)unmw5bY0acy<Z1l6^!x|CMt
z^L*BFrcH;Y&MU<xEb>0GJPl~aQH!d3jvK;k-t3bL=PZgn#%sO{Sm<>dbK#P)-=J$L
zcp&cO5U3XimM+Xag$rPHKJLB(9<5+unyTZCRTF!3?0{>%jcw+cm{>Z|Or07g+ny1i
z=gjWHnE~fh`*n>x(4Ki)X0M(B0YBTxTs?FJ_8zR;-MKQZ@8#M0R+ufhN1IZfma6A;
z(PYNtA3?b+V0Acy&$Y|qnr^DEmrH>nyJyo*S^-_#@F%B%HhT?pmmF31tvuezt@R>O
zFCz6KQacez<_m2pSgmFkZRhX*SR|~1)oKML`FQ0lWo&y?GcdDVh7HHiv19ubTc$R4
zESsrJ_fE)w!{HF#OFV|A&E{=^hREfk0Jv*+&Ly2y_jUq)MH%t}-)AX{^0hDvpfR5?
zNTe>b<yUcnRHejLD9k~;s*uA5lawuZR*~U~xh3J;6d*4~0%<{1p+%oUW+Pxc%1{!+
zY6T=j87x4YqIq;nxJOgrZN$Bij^$*}=hVp(L%p%9Q<q_4K^j0!qnNn*7#qZ=nx!b3
zXWj!HJ}OJh5>4Jt13KjbHe`b0J5Uk_3V|S>qxU&Dw{21ez|V!t{Sra*`p_|&b9|2+
zh;16*q8W5nVs?_0Ri;T!^neVvwz0?QwYGNv{?_pNN*5B%!*Br0RjwAF+BTtnwRBTp
zU;Vz;`E1<{#+3l8^+!?|eA!lw`(%+3PeJ;BG=hJLy4d@k9nkme(MtXgLyF+n>g$EL
zPfu2gP&Ab)8X#&BYm5zT>|uwg1Y5RE{4rsk>Ge?$-<^8{E<+d=;E{aG<q!~Vnl5TA
z<vk^7d=q#qtI+H2#O`s2F#fdxG1qf}N8<uVD|;=f=Ryp17loJ2I&M&6HHvy78QM}~
zU@z)<#-3+<+&p6+uJD9d#)lqha918vT+AoSWV))Yn@sVs?+_0g2Gz0a5(87;A&zNS
zp5l-me*NI^>zXa_*H>_!@j94iydLGbU?QIiXuGbAJ>64u?C6AHgW5iJE!)Mut?P`9
zJ>6z@58D2aLEAa#IM?4HPMI&ioJkyXMfv>?5=|Y`I1EXWu@}V;O`LU?&}%qHkq0H?
z^u_NKMb|Cshc9OW)x1DA&%Lr2P-0>d29xLo;A|WTxE+j9B+m)GW*&f=r$Rgg;Xp!o
z-vbVNwwzRK86TZ=PBe!6n9ehhjp16_Imz8f>g*<9w_HS?#aWICPde9ZZpuWHFq>rn
zb+E-{fB?V*emV|=EJu_?o>-=1!lLWlV9^b#8_XNK*tR@^4aQV#6U)KAV^K}jiJ=?H
z37LXdiDQdBSPIQ)VH7Ipvy9i{6rM85f*TGS(NOLb$PNX3KP1D;m?WVYSs<4olJkf<
zmLeWg$7AWH@jUe4W0D4O8stHde4vc1qYIa%8KZMRutMaPq$2-io{}I6qRDe~C4VYf
zqXK*ja48Z-A@^?)o(CHsDY`<P$fs<<^*rob5<~ZSJmO_i#+`vFLoUleT?A*Qi2O^^
zc$Vbh0;Md8Q+Uz2S}U7pNkF-Vs?;Izg`2_sh1^9#GJczg>6Fl3qCXDOF=YWT7jFFR
z0H*6ZMEW*T2gb>t`Bt{Hct2VOoQ)NmcqTSg-@^tm4eY8e#lE9zOx0Y2C~9w`->T*9
z5;a-gJLaZ)2MyL+slQ_^<%*rVuHbwSQIj0ynK#Ehyh_}9*p}+gh4*{l4>pB|@($Jx
zurbfq#QS=c65vq2Ub2+3C?^y4Rjvy6<oDva8?pgs6bDP=xTwA_jeK~HR7DvfZP<vI
zSgQX|FO{0!*W|&XjS|bM-*QG=?Ynk<>tY3(jY0seKvKU6K3opfK94+JW@!Rkg-kpo
zR|oxG_#13puO92>q@4|(a;QNMcJuwT$D<?CbmJb}i>j65Q*}?6PmeGgZ|`1&X?$P8
zG$1%@wCBy;q2i3oUTsgI0O2}&fi&fzL6<#f<g$6jc#2T5xjqTAod&o^cjTTZYtu(j
zp5_bE1;^vN`v&(wl26DpqeY}aoaV0~%;vYhJ`ljjt2imuE!m039a?Pc>gL$P*4WXo
zp;8mux=%6l3DZ^LGmWuFY;2OTehoLuy85?fhvL}_=aDzuZGKuZE>?h&Td^TmLJ2`J
znMM#CD8U-RvWfhZ{e8|Nu-YtxPjbtqTncI5sq9g+I12I@ph&pF_@E$<hcnQKoj7?D
zjq0hc=h_~2EY-n=ZM)dfO@j5YqY`hd`-)@rCYocIXc|aLmzq4J1xixoH$8lgUh$0w
zBTfL#^D#&tdv4raH!L_>F7d#y%jNZ?)QmqM&-xajjt|iURDt%7pk)16?PnBP?|6T7
zdk{K~L8x6UKyMG~gHN~o>+M1NX*VC52J!xrADo=h<R0xo{dRx<?e48CZC0(fvh-JE
zZzkzq{F8j~AB~x$OVazE>*Q<DTS~r<rKC{kp0=4pGj-+@k6=n{2OADGv8ys2GeaX(
zQB2p-H^mXkel~yn>mJdKG>!_T<zIp<aDy<&7dwJAlLC$F7rB*J#N8T(3BV^L4Wv0G
z$bS0!oP<~Lea5^xxO>3dQ;BW$3`!Mq>|^S<V{9m{gKg8(v8nlvGPcH^>YE3TZQV+e
zyG?YJaZaeG(fe7#(kzZdE`$F@X2}oe^-pg~Y|z3GhcPb09CPA|@InS@c)9YQhiqjz
z=Hw@B05Y74h9t{gp!4&f(G?KQYlu*U_zf`@z->w6S&%U_c>U9x;rTg7;BmpGRs#`T
zZ6{0O*ss|sMuiE0%=0N2`$V8N8od4Z>eHJMdi$sMA4ll(<vYl|K1*KB^C=`Do+nAT
zz;p`s3TQU@|Ji#J<+za~ZSYlMIMySQn?d3}sAA2iq^fRhtGYBgx@}jIX#x>}Obn4g
zHh?6RJ=JUfE3EAc=vnkA|C6kFMBvN|Nm3HYgv`22N(ACU9PXcg?oP5I5zehuzi66e
zTv`RB`&Srcd4XZ>2?bC(;aB*QCoIj%?SQb#emqVp7tk4a$T42~uZ2-U5(<GzMcTQH
z3mYZ;Q*5=o40=?BD8hNfpgYqUNrdNlDxS6HrZT6fuXKF;hLdToKJ!y>)eX{2ls!I%
z&w6r`Lqk~_+g%7a6@hiKNJwM{_xVWG*KOw>hegPUM=7&$NJ5G&+a;Jd#K4*z*qRk^
zT{FzvJ}k_e9u~VtZf(YF{qxJ`%GR`43LU(56N`=CG&u@OAnYF=OKbj&XHm*V(m+Yz
zpIH8c-iXBFInN?+zvNt47p1#o1n%oIl3hUBabXgSd4a|mNzgg^pFd_Kna2d2E&utr
zd<ZM|95ubi`o%EalAybF;J!bAn8a&Sd8cXk{-ElR@b*OKqGNR<G8jdfezR-@iZ)&i
zIF*wl@}*D`lk8AdGbI-st0^msl;N}(56L_RYo7)uNM%t(dBJCL@@o5-c=@Q^*`+q+
z5WY^Ub2ta#FNd=X!mX8-%Fck7qJ|xf8tKtH-v^x{@fDOS&ijKA`YnUb>Z7XP<=jf6
zY2U_~Y<;y+x6>u*RQpEV6?G?!Tk6D;X};6Gm;%l^ES|a_=C1uHm%+Agp;ou>wibqh
zPj#bK-Dthmj@luAp(N=BbyF^PRW5n);%1R?d(!w_<MrM=Qt!26^saE2i(<Z!i!Dm@
z)fx|qsEFm*`VhueWO?sH4R3)%8*_SZ)-Vqsw#c<RE7sC(T{ZfZ-T}bs?Uu145qNvZ
zjUA1sI~Y%QGn!t@-{Sfi;<tr6yTNMAIf%g|TU>idZavPHmZYKIpCx&dsqHHMTZ+p=
z|A5SkbVINHc^&X*2lVg3szs&N2r|jVECTjhH2eP0(X|ykUk@2Gybzl@wXhZX77iSZ
zVBMh1cbR1|7T!7<WZa^L_m{NbL7H9&-?OcHo<Imo>4URqtJD46k978cqMQj5Ydhc1
zMx?EwaDRhvXEV{euNd#F|7bh-r-%#=+RoN^Xg?=nu|WNx%S1`R<2V}ggmM|bx>fHi
zOUn?E(CymA0N3SOaJq7Bcr4~N5>TcjOVcz7qio6<iqrH0R?Y>l93d14_=YD0axp=i
zHS{9Ni`x#aCYKk$#5)C6<7QwOra`f%*$%dR-NeMP4eVH<t8v5dT>Cx;R$JP1xU;$%
z%T7pX9S0Yo1Lx>)#<Mmgb+jV$RvAhSmeaQ7F89TnzM!cBo%-yu(uGFu=?;b`km@==
zmyE9#P5GVhf2o)3^XW_>2RkL^;=b)TE(@_4P=+ndFtN|Q5c@u7njKIp2*1JNy;q63
znw}(b{{Q#?`v11BRw%P}-&BigwJQoEQM~8}?~?Htouer!coqQ~!VmW+3D-)%`B7`q
zA9d^Qc!)r)H8gvUf+%S=3sZk2aoG%ztVUT#@m)iK@EMxTOq=x_9f>P#ZQ15fkB(}9
zSoZzD(<ng~QNqqavP$O#&k)pc)Pj}U;9z42t?6i->M#W)<~iku3QE*Euwy+|GUNo`
zfIAWq%aUYU5i~g0pxlnpx}<^O1qpcEc=J}ncF876HG9pH=}mYO(tIn0*FDV=bsa*}
ziW~aD(wQ7RB)a1;9GaSjErU3in1+QJ*S)|DS!hvxPbA@BQ5QsSs`&X*HvX$RGWa&>
zShm;{6qY3BU{R%o+OAEq<&gehtDKjCht>10Se@TRS(nqvZlbORIm<l9!J%nc*do4x
zi5W2LQInd~X14DQIcV>MsM}oB?TS|9q=<NaT7{C1k{;S#FF|@5B_QxL?YnK##9HC5
zu7Z5(T}4~wdr0E^txEH1P-X9?mzaN=!H8=6`ix{b{|M*yVYiB-6S;^%`d-X<8Xf{X
zpNw1n)MZU8c`ZHEhuQ*veLVt-s|BbEL!ZU3a!r-Lc60;vwFH#|HC2TO@GPMwpx;II
z^C+Q3HPrTtLXluiHcH)b^~NrmNav;Xm5v&-xmgn_`%QA%oaR9-*`$^LMNFzCcTOmV
ztNejW#+2EPV}w{Y10j0^n1tNL8gWd^<R%GhI>2mOWDmSm^4K7dS7){`yhI6$E+aN4
zkS%>V%~dH-^p_`2Pk$DS%rdnGu$slCAku}Djl}>blE$?qq@nILrEaOiDUcsZ=?Id{
zh`$Sr7dA5zyBQeXDI#UYjS4{z7HB$;i)a?}X2K7pZ=_(*0iC0IbU#zI?x}Fmz7A!%
zRe4@lsh}dnOLgTo%E&<fy|`cf*n`*O5Z)G(@P>TCn}^{iv&oLgo&qqmTL^!6m$Lv|
z144W#k#dJ506WKxzBZrn;rQ_0NrC-kbSM3C``t&qTqSps@LkjLeMk2&_bdZjmc}u$
zZ5vbOd6uvFrsu8qU43xaxAdua{_@g7f8;4D{dkt(@5=G75$&{<Syp*Gikj+leBB79
z8$zU(sza-{BShjf8OxWU56$|~n5W|QjwqsOnz0CIOgTCPDYuw2K0@%a`0J5$Yy_Dp
z1Fb?{IS?JS8<iDYNwLWNm+`TfCgB~XLbSHB{wWXBI~HoSeFVT)-3fiyJ)h`=>Nqr9
z8(WU=V$ah8?1mxXI=7kOtn(D?GsJ;t(hGfG7wNPW-t_s)Is;w3k&o`DhIqSdl4VCn
z!HUe2wBXZOv1rbhgauY2o^4mlQ6u7Jm4XeT$Vz_vFA<MfUKSE3Rd-BELu?(qtqJ@i
zPoF1Yiq7G1`v~XMM*x~XMzfFVQ+In_z4}6(deV#`RN6yT-AQ>O9*xk8@<?1+t~xK<
z8fx9<sA{KC)kqHPBSQTZQf=Q9(kYqscx_5%JF0_mO5xi<6E8>s-=vrOQMn}4d-CtS
zUM#=5c(eLPpI712H%7NZKqm3(lkqs?@}?C@>gLm)BW*Kq4(iq1?|nYz3Hy~7Swwg2
zwS4uO{RWSPr$EWsZ9#xUkTNdb6i3pop|2zl=z5*5CENpWA?QIM`sX*+s_dI8RUlFQ
zx_vL-TN8-wT7jbzhB-ADwrt(SzDaG&H0}pXw?c#ag8;b21abpW4g{6PKUe518>KyT
z>$1^<lpSv_ZwUZCTdWeJ)HhqQdNd3K>g^S=0kQ?4{cX*lk>FRJ<ZZ*k+TvhqxDz5-
zA^oG*kc4uqVmthalVVC{=uk}e!TlBX9zqh}RcmVR3;{zd*zXq$_BM#+gT^&zT>GMN
zP2}y_^DR~SWjh=1160_QRP|sLHg21N%L0lm$1|~IYCaA;*T>WixZ~NruiO5^vS`Vm
zXy4bLxzmRm_%Vx`pvr)Nf5&}sWR??f4OeE51zM;F8n*l(#Fj}6?1z4cb;sg?Z=0H9
z3;@Gz`FAXBmBEGi>$xzC$sSyn#WV~q%U=OjcyKPuoux9kD(@!VHtygDE8hCV)I7?3
z9E6&UEyHthpfMZUmSZ|h^K{}F`yk%ldspRB&b^y*?9Oh=hDUv>+YB?q2(e}92KISK
zvFCV!Z)=|6I9qap3`D7~E5<e#vaDcmOTKr!u>0*fq=M)V?#P2X^1XLQ{yHkh;>o9|
zx00bEp5Kyl$2Zq@-n~;Nf;bnm1iV^hX8MB<yQ@CCWC^_8yo&2a6(vPRaGH&;HJ((2
zSh!<D5-FRmHJk;H<Me8O!)P_+>W8hM>O?mUFQnMEGz(iSlu<dcNlZ=i3}Vq>GZAu7
z1p37cSW*IpSOG(<fO{|T4>1A;mLB{Wob*>+v4fNTZ6q72ULKtE@2ZSExaqeOmbxtT
zJ>S5d4S~3PYGThdefYn?wQSupiTS{-K6lbRzck_up7}SoIqmG5Z&J_XZm40~^mS|n
zI>A9;2bgh<>8|B@JRBn9el_OQ;FEt-<BQUb24DQa7k}`@Z=CLfFaF?*zgEB;eDOEw
zPT#~E-`?4{VBeZ?!7!NTXcUt`W7u+SjswHz*zj#zGc?E3s5=-J?zK05KdI>MGj$%I
z7rs1WwtC-pirpEn`@6{~c?iDo%`d)pKJk`DCp|sF`;jyNDw$6Mp8X;QyVEG=NdzzG
zZvU~RyHDmS+<owgZ_LgRg>1|68KRI4KJj<MCtluN-^45aJ1R~-({x=ADE649Lnap=
z`<mus$FdpK3~B~jq8;3A1JdjHY!)x@(+Om>|2Hz7Jw`7{RzUWsR}j4T@MW4qDiU7(
zT!Y*~B0fHTnr0b~MaX1fKWbA_bF@h38A`J;NtEzbYF5)UFIF0iWNzI_nsbzsX(KWG
zgcOL9EQ_kB$@vL-0&;8)_NAHXVw#~G#uf2Qy^HcWV?2o$m0?T04tZM$=qV5$I*-QC
zanTG6rL1pC7AOFLzZ^M37!mmQG=-|g6jCvTpezNYRX{3(v}+Z(<g`e$ljGwbg6v25
z-|_J)4wZp!!jO!6e|CI~{>n25B~6k=6<DC`QZdQW`FMgzHF!FKB=#{1c$j8f)RK%L
zGgmR;QHC;3c~X>VV{)*&@k|U8(ikIxX61*j`#Vz6u9G|hb+(AclY%GGEGR$NOzMLo
zoHfjvnr#s3Vc<y^WmD)|%t>-`SG={BSMrV?ThuYA?K;>Dz?0B%OiZ}Ju@(A`&Rk3L
zsWV_H6_zqX>AaB3B`X#FYD));`l;M5m!K<f87+O1UX^H!6zo@c8HxksjoQuX<mj9m
zha|7wlF*Do8TKd8Ksy38I)_gFrY64ZUI|=OO+S;nxq*q~vp6aaSN3g$-XHwO`-7u*
z`iD(WNvHC5%Vm#*P;o9nl2P}SX83IR%lXPmMY_UH2F~@9@m#Kt3O|$JnOs)@TI5IP
z=OKx6F0vhVd(a&)e3I5+jz*0+Sp9Z8NOt{nR85P-3C^eF)5lijBlJ9>=`>2lvc%t_
zVxo40n#9)n`-!lRZ!!YDw;x~f4DJQUBnF?ErSl->hZ$6TxVBPsS{H5i?FbzsUDHO$
zI8uuM_P=h!sM{sGsjF1vMmc1GkuA@|yGLamO)RZluLydn_WIRnc`%5AYsUlc{6rX1
zlY;&rim#rg0g$^7xLRkOTnk#$`o1(^PXGM&j#k|uqf1+U@8DEtfKwmj(r(>M*IL!q
zH#^DhJ$U}D_x}!ie=5MRzPFMj=^vaSV{3Xz`De(7w-xnV1`ZyuGb$mP<x;Hcng`L6
zJnWe!$Bs^kX$Q9D+vFa@o^R4wtybpfO__=<Safn}odVP?an2V}UPy?uf-w|^8D{+N
zbDk9OqE6}tNvB&ifm*qZFAN9vbOs6uKp!Qyqyc@jYLo!T2u;!}GzE~5MR^e=v?xIi
zbOqXOlw79qC1)d18R%m<Aosk)LQ0rKqJ33mX{aFB5;ByvF&;;kJOcnW6%_)o@@Yf*
zyLk>hIZVTXCy0OIbY4W4JO_|Aj1nLLpu8Yqc!aJdseoD&&Kc;c83FyU3=5TJh+L73
z!~ETe&`<4;AwT?9sZ(vQK<6$sh=u*oWY{83fIX@k*kv~NLyhQxv6tEL(phtJt=~*y
zTaG05*Io6aYJHdZUu#{*M4;?Z(pbG4u)vL2(I(Ikz^65^;b;Xyc(i-ImHwb2G>D<y
z+lq};mu>Y)YTLDY@(4;dKlU^Att7US%OB4XljWDv;w@M3CY=epBWDs65>=d|DY@Vu
zbKb0?1dZ$!y(rJHHz|C|PpTK96H$1m9xqBasdDy{`a_j9H37}$l-Agnp)Fl1s{yd8
z9sxeBfmk;rbXn1aNcUdu4mIU69en#UKsnfYYGxG(CyUAz^^s&5SsX6SJ}fNw-;vBL
z-?$pYY^mJy?b*In1g%O5v)hfn2Pt8$NA|nRpx%&3W+2TC&g$PKqkNi_*=he8<xvpD
zQL*SH70$|IvkZy#h6H^gz@^g}$s(n(MfuNvpOg4a+UL9^@mw^d+c#AaN_juwSC`R0
zZYc4SkQ<)q_?U#Afi0JC>{$-Oy6Xqba{|ZFwnTSY|8Q+Uuk}N`&L`dZV_xSo_WFPu
z##Mf_ahA?!2qU*dZ}3k)KgG|J97rr1KH4sb%??=25=yhFEL`0`r5W40zc<W-(lcG(
z)gkCL(>w=TE_JaNIu5oq-*y6@+74Z(XRfPz?R-?Ajj?gnZC5Cps^nkNf(L1O@kjWa
z+Z0Oq(Mws2vuLZVBvLhPm0P|iTJ?h%0}`w9{Qbcd02XJurv2eD3d9n@G>v02%lTRP
zm-5LOq|SXD5PAXgk}xQlW@rDZX{PBokKZ5s2s+3QMW+7Cs#ZYg#Uzf#$yv<9qFo^h
z)1<&4qMsSs?34QU6^D&=7NjwIEZe!7L<N7WI{b(C2R|+at57!oC-Y(gu#wWXn2LjS
zC}Jj#(6c{3|8<03zx-t+05d2pbg&;z3nqJhS`Oh<OqTdN{O`>q%2BQ~cc8JQal`~s
z@q#aql&lr2P^QoUpn!jx#lU)5-8nkp^dhhN7$t2wQm?c<C`_qL{v+9Wb#UpGP38qj
z7|B?EhStx>$u=(GFAzgrsmvjXVrX7ecM7$gipnk}-%t`ZuacUXMcO@zax|L<ag<M>
z2^c%Lu~E*@;p{x)pwJ#kG_e3vEP`7z%3<l(>`;l(WDq>0rXB`yN-q#436tOH#+1R8
z{J+<7McC*kU`+O9{rMVmiD`P6`4*(d@;w~5o`-{wS)p%gn#-(vjEMK#oHB*Lwyk-5
z{8~`=Hm49!@H1Jl!(i#rbjmlM0<f?^`;=<__I(FSw?!U2L2q*&&SOz<nkG?^0?n=4
zrF>3l>BI?p2O{At=hXt#qr$&Ql1@ns84S`4%~JRz5sA^PgaZK@zZ)=ixhG)4U{<e_
zipwGz34D!X+hz<~A#t#0P!nsMQQM_l^PPbayWYE4U}{(%$6|ry8?q6c><e*KH7aK1
z7r0x`(P2eIZ3NqFpHM0q=Fy3G???jnFsJVimOIg`JD*PvtAC501OVaJ{c9g!0}t@K
zg?j(y@z$$l@%4j|-@WMF*Y*(;mx(;n9(Lev*Y^#LnHtt~X2}dbf$v+`vrTSm)MqXm
zGWcx2{r>#?*WvQ(UVeXm{_Az_zCS<zb=%cf*DP*6_0QqryTdt7zWv3gR>eMMt+?U6
z2dCM?zV?Dp^TUu?m~*aS%LrXeY|X_w4Q-40)O5ZDMey!%m;iK?E27V}_xj~8!>!l3
z^<KaH<r<gX>zBW5x%29J;mTA08g9Jd#%m-JmWyKd3vV{hX7L^?dT@?C?EB7QjuUd-
z#J&&tnQR(j&-F|knw<Nd6`EuKIk(?;0N$s0RPe54VZc4xmtbk-xW-Lb8%Q=@hn*JS
zPHg@(T#UoTSYM3Im9hKn7{v2Ez8lNAd*BzO<~v^C86Gyw5TfA_0~4DQ?2*9qO~<fo
zH+)DIazUAIhOJOHoy5Fhqs%j~U@LbKWf^}K<+GS9q$in(j-hoNvC!d5T^Q(I8b`u1
z-Hmu7Y<==Rm2FjliBXY7<1vu!PaxbyJZIHi+~%n?qU=x-Q!otjykUU^LX7Y@p49<D
zz>2Q|JQb<%@QQ)+)A04m(|JbuU9xL8j1c8F+AY?T#Vp733Fd*ru;qs~_H5$ekP=3T
zrTL*dfE?R|zNTTjM-1)8#%P7perc4;Z^_N)NXCm&<@8QDux2;Po}ee<^n+;JiUNxw
zMGTdp%$7HdB!6t)AMh$Cbkg3=dt<Nf?JrkX`UWOiywS;Px$Lr4nqXT6qwp~2#m5QB
zKk}GQc~Ts1&%!CZ@0v-OkHk1$>T<E1uUa!B^wMZO?gnq_k`;OdSn3R_5ml)(G0S0<
zl%HU`f`2*J8bOzY<5{~z*XQh|t}Za)s8!AY_;S58T2IvAg_l?Bc9R}ntwy9b8SEhS
z-9?$sh}t!&h)bJhuRq^ndkmK$5c-|-?b@AU@le9{3{lV@X4szA5jX@Od+49Ld6|9P
zAWhdl!?qqnqx&DlXb5$6t6QcA6!&mbD=&iw4;H&~EW^_+!m!T_3tIvAG2yy~P22Uj
z=QE<&!9HMjDj`qlrKBPtH(tDTG_Q>84v$v1UO^_;!t{ir)q{fb#4P>%sn`|KyRUoG
z_sx(|)54~01=!LJjstG`I3zS++zPF5o9p;q6Ro88w?ra4$tmtP8YxeUwL=;p%5Mu%
zmdBF#8n+2kcE0ef0+y{#_W~_f40Ctjaz!O8z{}-Qw*g?bFIgFCeyO3}AZF*vmO$pV
zSslR4eaPylzW;z|uKzRSb-YIq*MMm5)#vWsYy+yfe(DBPv)`Y6**4{_*-MM2IV2)^
zP<VZx7a)oKPm9}@t06kupZVfOw-NO0Hx*0IxTo~v8=5e>fa!xpN*$jP)AfDK3}$1?
z^Bo+R#Kt=30kND=3oK`UtQgOe?`g&8wmw)fR&2`W$=+Bo%#fHSwHelUK(OWNAr34z
z#2VENs)w$tu^~oSKPyI*JUA=H+93^AjPGE@D9`TOv|>a_krA9`<J-4il-=!bzi1Ee
zn)Zu!CF|@Ltx~sVzbLD%?G3GlcC=qqmvzH_v0+y4g#DtC_(RuFXOT6}#46)*b%edt
zPhT2GdyoX=?psO9Rkn91$-w)5nE2mdCD}i?w{d?CR+9BoH&{vf{n?jo^BknLG#d|A
zlH2$aw~@cwz4r;c2d{?yCV>X}_+Vj2!ZqsH)Wwd+3AUK6;Xrp?tn)DBB-E*9ZB7(6
z<lVYf-YpL+#Ii~(u`fBdJk51o*N4SMJZw1u$DU>y*fE@ddDL`Rz=oV#L(Z*ll5^{q
zD9Z~B5Eh{Y`ZqG2Jw|`wSNN|yVPLA034r^h)2fW`O$&kq@k=XV&Uqr?{s~7Rv@KKP
zsBGIgk2!^`yfdCfDLa9#oQh(YsxD?+#yrU<(JV(8@qET<MB;dX(uC)T#2F`Sfhftc
zg|u=&jwvWgGL8s><X35eW*MjREEkrCD(%h)1(0|Pa{0(HK!U<7oklrFhd=%NRAsHo
z=d)S7z;ps&At?$%FY>Jkw%&+TS3yP+h7*3(n39Aw`$=-?VKvL56jF(xj9*6l>T#KU
z3v!f;lw>p}(G+?gz_2b7$jBwC7b%5ERwO(_0T0uR!+`}EorTRO%Ft8>dAYs(Sz-cF
zNKvp$$}G(eJkv65OkK{f<q;G6y3eucd4a)g-*=7sY>xk>wQ%dqW^!M^S}AwV@$s6y
zBeu9qUv)L%Vv{V;6<8SL<`MfzZ63L2(BU-AVVeLHFH0SPUmz-YLLk|euolK?GUgeY
zM0t^Bu%4p4_VCNmm?!fn;qd~&N>!ctzHWZi3M;2(au?0vw<eZS+ht)GSeS(@z!uRt
z_RWA}-3f`$J=-DLIw4_CeEQ-jFY<a<wfD_#_spt2GeY@13kiioGg-QY$}MrTjn%!&
zR$op({rq(OtplgW=_z{i{N<VS(q+8P&qyfcGZ?12Yes0E$g8Ok)9~{r;VoPeOdvgl
z%*r_7XbMOS3|<&CF^$PQ=c>7w7u|Qy5nCi=8qvdd@5QP}^YnzK)At7>2rwID(FK{x
zA3hvC-VpMvhuOL`?TT-p*h65(Rq=20SsWD&wt@;-2A1akcz<y8PXEv{)kb-e7JND@
z7R&F5f~TjIRkzvVzeLIZgAUu%aMZP{i!0zY=gIjrO6u5XM<b--tmWsWp&h*u0zmus
zC_HTRPnG~PVJ=PND+bx@V{LCXguS`y4Prc}U0ZW$PCj2zYxz{c0ac;W82|2(s2f4$
zk3O7N4b|fm24~U#>ZeB^&f8<Y6K3Q6GwANh<^5(B;Qs64yW4&tfblIEesy!Z6tNG;
zZ|??W5TIx}pZ=0bed}2?jtc02{@@HFoilXU8aMk2!`8TSmX$l~JF%pM_PUnut!;$q
zlm{B2*kA;LTN9vU>kcNS={m#>JX<&KF+TH`3fri_xGrkA2Bhh{wME-hN~Qqqn($=A
zS=r7Afd-138t4gnvV;~cfrUjXwY_-`t1-$EfpE@gGDe(a@d96wERnII#|eq=2!c~i
z+rvh10%rI@z%5J}H?ZaV6ce3km>ZPZ;Ll*11A@~;aCX~NT?l9M?#f7VAz{?UK8qI(
z6!j}?H_`jjv><?$pMHKiAU3y;*eD;9uLst=AmxK*g!`2!j<T4YGx^Ihq|}J0UzJ)N
zWB&$_P!s==)6uR9{fM;dphGvof7Hx0$KMAOf-*4wW!>es7{H?Pz8S!x0W8`q;Pew*
zss%NGMGpilQb+Cp65VX}hb{4NwnQy_47=iHA7I!O4`){lR)xXfc8?8i55%faLSGNt
zs^Bu>+Yo=rCIE~E2FC=FrBl}nbUk3i3cbPO0`z(Uqym`x^&Ti2ybX3)kxT9w(iKR8
zI*J{>Fa8<6#%;s$2sWq*LBc{4dyY>rwQTB`I(5QeU7F%`b+4U|?KZA{)~(vEh2Fk;
z(TwB;urvJhG>+&6dagq5lr}AlG5kl+Dhm<--gg;6{*Wp*Pm~lXIzE2;>IDu+4qU>j
z?&D(s<0bL3WRy#`zf3fbNRZA8(K?0JbHM6>Z6lF*;P6QxJx!ocjv@xh>O(;8Nsf+>
zrzDPOl+N?x<CAOcfHWzC4gEFBqacc-VzFf+XC>pSOl<y!1REC~xCoFeQu80>KmUDB
z;x}o(oqes1-N}4nSO}x1>1?6?^ZobfwYQ$3+m2;w42PUL*z$q^6Q6k4)E!6njL`9Y
z^R~C1dDE@8JFmIPX#Vrd=gI`JKxrs8i?lYuUMyo=9lj<ZM=zq}A}_a++SkfXR_;R?
zdvAq(Y$WN)1pbMY$xLLMM>)?To}-X+Vd@eIii;@bD4&t+0yx3KWCfhxaYn#y^FM#g
zNHUKJc&GgHarsd7>m0q!VsY3=Zg2HGh*JtSxbw1PX_<H;#t0@17{=lI1M&7xvbf+6
zH-GqP@ka2iWs>9f2S-%{B#zUoEe!}dv8e8eEdBnV+d(-i!a7AsOtQnW<G-URx!_pM
zS6NIMeh}j!na2<eOM~;QG7_P@;4?XMwK+w+ywvlhmdg=+y_UuKyVPzqf2*2RCaWh@
z{P*oFxnU2oc)0_@4E8pQpC@6uxf^e@`1<Y76G)z&y-yBjS(JdFBg2`k`1G}vP)+;M
z2yR(%&B2=bwY;k2MVq5~{i5G8=&(Mj`rce=GQ!%r4%91PTL)CLYFUH1FP)Dkb@N8u
zd~>;NZoXOwb?eKYztfSo;z}3Yf%8NhT6H(fx*PS{+uVuHVp!@5EP+lRo<-p8MuqGF
zB8>DZsC!{GdQq;w(j1&-1xP1QkaW$UDk_?4N>#F1EZxpm-<7F;bB_A8+371xjZwUr
zgepq()ly~Dwx@mhTuV7t<#*YtIX7wI8v%>W8tno2;a<D5VlC~~Rij_&9jNTRL+&hb
z-ERm5>}q1%frq{u|NL6K^XtQ3+hC>}tj3&!zC*IbwU^}9<7{b38v6ZNk~f*!F1WCz
zxIFX^$h=55^y;5q8`OE=`tLl8(ZwtR3SKn3$67D5xnUX(!Ng_^TZZo9AaHH0anp2}
zYco@GZXIwkZc*+1OIq+CO)vfk;Ne!~S3r!V@WENM73~&j9)^G*-zFePi4ZDK4*w)T
zKV=`Ram9WSK?JUtD-eUGNuI_L6Iq8Zc$t+Ik_wOl!g$jQfokwivluv=0EI}%Q2`>2
zkiAjT$!$zp=wYxxzeY4m^E8A`hmyMp(8zBPshA_vu~C>(2=+0Ckpe2xf;CV9cVVs|
z8N8++BlMrI5KS3x{Z>M*IVAwV(jvNqI3B?Q#VM5z-&>=FJWZ1@%BH9R{6sn82~4ld
zqM*i|F!Y9#Y5o{R$tBN=XiN%@{__<U-733MhfB|A(FMRgq6Q9!-560aosnpq++I8o
z1x@PaR!p*W5^`o*j>lcB`=)~}J7n0`9S{4arfbA;3{x}ivBQbfIn|Pq8|zmRUqM`&
zr482hJP{j7?ia+$WE^DOvV|s^xdG~(R5rI_NA0$IPSBePmk|T#gk(jjmW$*B6ON>O
z4;`s21I-j5(^fxjBecl6mABghbY1QS0il?=wt+3z3vfWWk2NO<^nmF`5Duxd*C(MU
zmsew5rI$RDjvFgePcRb2;%K}inSjsADjGm|$L@p*PA5qkr{jp{r?3~ZG!|FF_Ep;p
z$tL45I)?xlJc|JA;D>8sRdjP2pb5#*BQ=6Y&62-m;}`sr#}c(h{{kSDFtJK+k?C9p
z0(pNRPV7~sUvv7~45lZFgY;7;6vm(V0-b{#Oi6M07hYVY*@fcIKWAu!9^pp~+I`E(
z0Cl|}NH+esIlqKz^d%&BVCB%y(WYb%^2O;T=AULTLN!P7G2}03)^(zuHYc$Cf(XL`
zOo{ggZ(qGwPG`|cVj)hnPK%ZEN$UalTvX`sISQJ7AS1DAjwE!P0mjxS8)oUW0o#tp
zEu^yTPjUo)MC;48TuhE?47)Y?0#Qc4qyJ8$1YJZ4JC7jn7E;x*5&&%vyZ!nRNIt9y
zjn_kMy(e3)n*wn&ofoP(QO)L8w>2<od@&O9obp2jwQ3z$wmlw_)8+>wIqmNiqU~D<
z5xA_yU48KVBh7k!ujPA7a`Jg-b2q@YOF)v<ee8R_k999(9wpr7j`y%6S;-jsMslod
z?0ZYG&0c&18Fn{O*7AJA^mGH;mZf1Uv|Q|Yo{kOI40VeJVc-p-?3R3LAf4SnmaXcz
zzrw5-!XV0S5M{*-tr29!v*si>3tvNsZMRj4u#KM|oB-P#a)0r)@z!p_>(YyxEAKD3
zHpelDt@m7Pedy9_;Cp6ZIy!c!!Lj8s8wUopF=x!DggC^u*}a!u4`)1UUz$fC>HX&`
z^fYCBo#CS`&sK?%#UY)qtFx2VRGs`F87TX~3c0dUkw*~E`}K@W(Pcy$)`(h$n5ydr
z{fWo3T$xfz%LEDLIY%>Lv2V&Sw;v41?!TcnOSlhxdzs7&T$}6I;X1>X#RDAZA;qr8
zOcuBy4_y5oZ!eH`UsIB_OkXdQ>1)*%xz?VN<Yx-;=9!dUO0m1LvI$APq(<lHke`fC
zMkq+xVk847PaqU>ZN<xv$}ObyND*~C1Cgd=cZya4pB53LWw_>ef%r7wjB$4NH`PPm
zTY=%)f#FfiElbB11>i-qZEV;Mvl+PX_;l|Ar*G8~r%?g|?h@@*s)?Iafw~Ivsdp7^
z4Pkd(bz_ilv{kEpfABVoONC2l1}%<pnxL)?rCH_MEUpeS(ei)30)b&!fqSQHJaD{J
z{dj-yp^D?QJw0~WUC<AYMo?pEAG=na<;zR83i0AvRf;#8^}%6(0~HjCtJSCqixemD
zt6X5^uN}3rpMtkmr`zzYlwP;4#7NurVd@IjlqsuN^A+m%R}~m_HO;{uva4d*C#*V|
zl`*>e5{uPUplziDZ*N|7bI0aCJ^2*nrOipK@?Om5PrEgP&;by-B$0d9S1WpO$u-R<
zX;wTV1%D~kmEIv*z*6_NpfJ>fGZd0IU+e$7W8i>)e&fIa_U@>J^I(NJhZ@9n4GS}q
z8rU)d0|y=>*d;WeOmiHEI{Tdkr(wfT(#fkAk3h<~<R}2o&{9KcSjN^UOO>KjWoJ<W
zQCF^MBGL_EXb8x-_NtjhUj@Rv##v!M*t5cRER6-s#+K&U*a{7Ty)f`Gw{+bwOq2Wm
z7JKLVhijw9>~HXaGEj(*Tm0gDU!sHrwreog53ueM4RRM!>=Vm`g{PT@MMK|TNAMV&
zHtqye`GfFPsN5-(4}_-uq4cD{G>v02%lTRPm$r{ZK<EW*gM>lJG&}oOO*2i$dHnuB
zIct0;rw!?S{heJmgzxw!2M&eGejU#ZK!{84{W<{6NLW5_8e-YI+DiixY^K>ooDw!_
zz`bR#4e2pI64A2NZ(w(6!NSt<W141st9QpQX;$`5^+dX5jLIahZMTn{7XX4JsR|V#
zyMPPn<KOoDC`X}aERcJ!UA#i&znZhhZagK2nXaR|9Q(S?u|>IqiLNnhxt4Evj%#|H
zJXBkw3KG!>&?K?Wwn60eB)yV+G$DAet88hxgN*~C#LHkYouA5>OJbEYy_dwrE_b5Z
zwlGDN^`vW?1W2kfo5+&@0y{w5D6YJtWgGQoiN(6E$y5aPdtPZI%~tOksm|w?>-x5a
z1I{S6DAlm<IVNVI<}%%|Jk8lZ>%!?N`Xf(xCT<5Jk60D0g#ddxkEFlZ@&e`3HXyl2
z6OJCWV+TEwkq~?F-0rFcqdlTEX)NjpMXf{^jle|{l7A%0VktV(Q4iMG{X^r`@Kj8j
z?c}Nf^6rO2kPO0m^@F^xgE`Ax|AGWOZoGM`DMDovrGDI6D812QAw`#ABc74$;^3Y}
znRT3<0U+za0zjtYa8F}C4js<0Ws(s4I=8XOG>bACI=->z3AY+xG2FJ2^iHNzab=|8
zY7z0#l8lH%z9uOka>SxA<e5w<-VhgSoeqxbUbkQ~mr?gxYhGt{u>o@a){wJl4ku1^
z;t<nzIH4wX3@}fH)W^hPJ~ji*4s_GAJhm=U@V!@EYn4?>sRBZQO?h21Ut1-hq~PNe
zJh6l(suW2W@mVPyj>=$%BlJ?`>H90sSVW5v`Z>#hM@z<BqB5eVby&nDnqL;>7YnJl
z27E#;BgpaxFV3V3_L$6WLl?dN^}XMOS>o#<2S>`#)?5h54H1$k#g5LX1xR~9oO@1~
zRk}{FKz~yR-s+9?<@3g!^yTy0S1-PN7JKQ-XStcad{&swm(RiC%jdHGFP|l(^X2nz
z^CC{ui_w?QB9zSN%jc)*EQ-?to(b6X%jYMvS$+n6V<YtQC(7f|m(MTLE1tbfqog>J
z8|usFaz}mnd^L&a<jZF=o5hhbF@O0?GXCW=P-nk<4m1AuxyZu#<?}p;&V^~Fy59hg
z;H89p`8-QuY9kVV`3#%&%V+*+mge*9EAZHNxZ?)O?HM|tT(d)>dD!8Ohb^iZm}o(W
zjet9pg@pU&dQ;=R3Es81+`03V++1IFC0)I|?J6V0Ox<>u<!#5sZ8wwIGApcC+Fjtf
zI~r|pSlvT(t$~&`z_g0*+6Q(!8p(H+2-4%-D&RQ0s{|G$uWWw%Z5D$!#q;E4mX0B2
zi>yM3I3VF{eY+~z=r?Cd6sq2Sp0^(Ww;3$t_Y^|xeAyB|Z2T%%x1EpJELKXF+N$rR
z3bub2MVsG6m8yQKn{3X1v(f7Jf!2HDFel%PS9|wSKmFmV2D%Yg)b+5-bPrpEQS3Qf
z!?tDmHgkyYJKw;3eBUUdC5fSAhbk<uR1KuDS;!_6GMn+z#cmyxx0)MT);6GY_W-4{
zA3BC$8m3E`ZDXC;6k9s+G4VnJ>&$YfqZ3!##t*&I7{U^jq=hBin%C_Hl1YO&Qa39^
z{E-Y%J5n63QG?<IbS?!pta84M=mgDTQh=LC!|zt;{-EEa9a>3~b|Psn^2ig&9s$Nm
z!t)#)>J_lZlQ7LF2R~qxPttkJPyn33j3?t_0tesShy5P<&ecOh^ND9-li3=!g22N*
zaeYio$0oK$EZw@#QGq2{v(&ntls@xmqBxs!xAlMq%dJ~l^8WY#`hT08KM}!7vA#&0
zal#f&=H(_LShb(!Zd#TOmbNa9MUL&$dh^yBv9Xck=z_-!*vGRhrCe@l3C7EQ0tBB$
zX%-bx&Ko<p$W#E0dMg)m@q<i&mgWsA<b6R1ANoc%P1`qE;9)HcZEP`*<A8Y~)(lM#
zJe^p!XAQEtlGWF+<!YF)zGNj(xXV?$hk#%!3t$(|>#8wg5-Vt|oN0JZJP~g5a)wtH
zl8;0wF{G7+R8BHLgydIQSxP;-w~qDYOe&B|u1>8ved>u?uv%lzO887HY^^m>6(3OA
zsRlye-HHi(4T#Eou-Bfa8J6xkF4jWF#}+p@_B{`1BB35y9=F18k=5ef6Vtj5EWj`C
zM^Veuc}9iE%9COl!)gVLSu%tC%lZ2Qt-K*Na@LkY=?_@g{lvnI2YVESj2nJnIoR-g
z2U|f%aS%8<)_lu!9N%HCd9TBgx7_pUoV=h*uF;w0c{4+XrZmnxPiaIz>+YT@!r3w7
z<0vn9CamjR_}B5gXhaH^?Vq6M3619v*|Bj%j2cp?wA9y#yHJ5IBL>HYNFD$~5JAXE
zG0!+uE&3`+wjF4z>1~x#I?uAN0bK18GIh{<>s@CU0V9q{uwytB!l`lqupCU7<Jdg(
zT+i8a0Ra5+yL<7G+HoS532B5o?QT(cO`u6#i6L+9*3C5Z#wHav{<2Eg4tg?LzpcwH
zEh|vt2^O+~k8MTi-6I(2hjUTmyGP1bTU7e!!+EQTcaLNv;_0Ig=c}58Qj(M_9Hkzq
z7;Ya23*7ny*4wgAsu#yu#CBu~REctL-3h9jO1l2!y?vmXS$xgiUfLm<@2XtA8E3-h
zs%N9sHS|;rT3klzL&z97bkfUxt52Y{YbK|@Mw065C97Vaw7T!RJ)GEj7wh8?*C*s$
z7{$fbfGj;5{T5N+b?u=8^+dC*kXanN0e7%PbRGMyMR8zT+|pfY5N}I>>h%wYSW0VS
zDVe$mrX*#TeF>!G+T6Cx(7~EVHEbE2K}ZE3bIKe&a1EWA>x@D}Af@Wh5J>4(0x1E2
z@JgDWg`rwVRw~j^9WF)6<zF+9Qe{V%_VTMqD%GHp*uNBfNU2AC^PX)BQ1o+>rEv_J
zRbJZcqXb4V2Q%O*J3RDyIe3vW%~J^WLdIMf=XnGffJGux{`GQBUn{_i?pvPg={hF9
z6=2IYUF^9o$Bs^@%MH(^#(hrB0P9=VHZJaVM(Qo7nXV~n6;<4mN+DkZj4cNsDifcO
zD);XanIuYBbQv+RQ3x2OIaquJPo&EbDM&Wvunjh>)q4PpJy^-o^|-D%hK@Dvd)Tt5
zg+0^vv8QWP_e0(E=$=DiOSZ6Tm#N*gF-k+3SiOd=w{y1NfVoXP7Z8HPj1G@RYCG0X
z%CJIF*tC18=>KKXW=T|dA`gVOvv$_Ep9uRX>ihVTXOt%eTnaz{Vd*@G`JsrWc(~l~
zX<ek#+aq+WYuX4IN3GCF%T@f#xwbNuaH9z0IjvDU-CkL03Bb#FCg8YozyQLPhp1%Y
zKKgLJRE>c9gq^c0(-|3*_=zarb@YcvAI?|J-jMM4K|_1(g|v6*o?#E@-uFWHMqhDR
zH&4E6Eo$xSFY1l!azLFQ<hpF!x7S*h)^}c(a9obAd2H|S;#4RSefOYHK0Y0sA!BPU
zoNsNY*$+F-=<5q8f}^{i7D#ir3m&eFa>I4qTTB^D&fouogL?fYBY=`O6zq>GvE+Re
zQ?0vrG!1v|O&6*-l=cq{7^prE^P=s`QB-da%X$6W3}VC`X0B~VqQNxr6PSeFeYgWO
zH}9bvBZ*76M_e0I;)dAr1CBjP7-qU<>%<J0={pbG*e^3$e+N^)Xm~L6?~B>r*O*T<
zYGU8j2)2CR!vS{;YzAiFSwWzMraPGZuW$C3`}j7D{-UOyCVx@(HVppVMt3&%cPm&j
z_IC@cGWB=L^fL6ziLXrfohk++|I&FNqzhO?;sR!uB%z%BX}^v9%|*0#YS3Wff0$bR
zVB%k%qCq|X{_Aou@%Ngw!NlM1&;FSBYq56kWR$_g|Dad)Kwjzfxdtx7{aM)qd1cQo
z>4Ch`XVM1p%6DI=19|0krhkAF?!>t}kXLSJ`iJFwx5F;oSMth3x2!YE@m!brSTjk8
zEr>E1Sek=_z@m<(voPer!{)HOo{{PIps+x@1B2z^Z!qdOTr)JR`KEy_({ixK4GlZQ
zVAS;(cZokxSFTT85!?4Rm@80GPvQy`y$#+<r^%gZE1mb3SSy|9t4J&DBE2{(V#X`V
zO1pxAv9fdw42+d!t*5bs_RbhI5LO;0f;tdZmZxYStbG4<IS^KQ&Dua%>Gx+3Y+)T1
z_TEV-16}1|uIqt_HLUChy|M=)R<F-B7}W01${vVVdnSAiM65oOHW0DC`$8RvShq9%
z159=&&fS5Cbvx5PEa!oU^%aR&51lUJnil7l&9TM85L=Y!IM7{&HN*6L&2s|X-NMIO
z|8Pj1w?1{Afve=-5U^oSlIL;mP}9;)Y<L03mQQp{JfGnpv_r~WLPK)<$@A8Csu#<z
z=Jz!cmA&C)nxm&_9Fri;M05}IGD{UJsO0ovjNv~|a>OA7CSs7@40uOVkt2Ns93vtY
z0D`0$`6LSAGedgx6dfOTnmaxoDIU(0=Q$bk90iLR$wj(0NVzT>8Iyuv0gVt+O;M6%
z3qf;=rZY&u23gzYxyU(95KZHllkuD*Iw8eLb9^$h^Yf(OaU6|#LOII#EX|5sb_NF|
z=M2rjbW!C~OCeud_0!>{{L2w!zJed}f)f_S(4Q=wk0;2`3}+;BVW(liAyqayK7RfN
zO?W&5`p^Y}1Z<p6l8BNR=kpnK0mj0!JWa&BA0MMIOQ(Vfl_eyGR}y{|FEAB}w-_pT
zLXsjM0mn;ZuFnh3GsXBS(kqfNl<{d=a7-u_skhQJRuh<Uk=Bcd>~djo(#n%pkU-@E
zZ+@*cS?rFFf$3Cc1&3#y4}1m_1Jhp9%Vc)F=5R+SpXW1`O0ODoE*i{7-86e*2!i+0
zd=y48r0AZdd4U;^qf5B^{_iI*#VlNsI3I}@CHXXAh_ET7)0+p=D2LopIU>;UTr3;a
z$b=*bkMnAN)}`uuBSttEc?D?%pQjo`>#IM1gUZhh+mz4(R!2Sd6ZDGbMHbNlMKa>C
z=#5+p^JGdAB8ac>dz$3)DbMPKK;k&PilbcZhGr*NIwet(kK|l%=t@>Lq!vlpFS$zc
zIh{b){&Nnj!6$hR)yjQZO!z|V>?DPk|2~g0&g9(kBuul$ZowIc7fDi}Uw?TbRtJe=
zwMGx0rU{E+21yJIKv<%Jj7a9i1Xd@NCs1BwJQ)|0qfwP(?jNx6W?6I@#k`yk@j0Ws
z$Vibk*u`O#<@Nf0_rvVRAA%pBMR_)#iBm}~&RpfJgI_x9_lMKq#~)5-KYloz6vZq*
zJ3YO+x;mMbg-&QXJ>?0W=ci@1yVD>}$ESv7*r&R7s=24EY7VRBaMc{HYQhCHcY37y
z_!QP6mLFFvBC&>Ay9RbWBLzYH6ZjFx6Z;GiG?`CHg3}q##8D9?upr<CpkfDUdU1n6
zIj5R+s(YtmugLD<vU|AIJq&%r&A#Dw$8gm#Tz0G)K4c#Rk}90?ag^{gG)b=zS-P#N
z?F0)emM0-ir?V`bMmfLPIL%YtIfb#|G{MD$W9SH;q*s`9KU=wdF!Te*oZ%wHbw8?M
z3B0E~5o40DoRS$oL;q=rdjr8*XX=1Va!8eWlLhF&>NCt!afhn4hpSfc-wh0fuxu2Q
z1ipxD^z`W98uAdWcl2MQJPM*XDi&J=kr~Ozlovevi;^bakYJ<W2D3`CNXaiz{`24G
zBz}`_eCLwHb5Xf&U1waKw2|VA3nFk93Ch9umvpZ!yxLR?HC@xN1_{Qkz%Z~+O%rS7
zAJ8{%S$H*XD!lHV?Xj8X@lTvE*vU(0NkfpCa=0AxGFL9jc`P&g&UhB3Y$R{08PDJh
z<Jl!hD>IT^K)v}1`n8m0Wg1A#<{+m^xh<7v8e|`a`;(@bs8#hrNx|aAiaF$2B?&r5
z|MSO;B=eZS_WtMN^5HZe=ja>+Z=OXEk&hp$mL+Q+H7WZf8-JXVPls=!DbEWsosH13
zVBd>|)qBs`QC0gt$ZU1xFVnnurX(!ckbG&LC^g|wbgbEU%N^kG2vr>aXS{$o`sf_J
zKaev}&E0DX(ieMwFhaj&44or=1cFuqe=X9Sl9*&=OH*>ean7>{-fOhOcu3|kw5-8x
zQjHy?<(Zt^nyUZ$=xEgJzLa;OJV}Mq#G>iMaJ2jIs)4ogS68Dm){kymN510d*9IKj
zef%=Q;<MVzq#C-pZRneN@l6L`C0M=2=T})IS51Jm`vf$5@=d2e`t9sKe&MdLYVh{%
zgRlDV6-N#k)QiQNXok+A`)^;pP#gGfB!djr*IEOuBjD|;7pSVNoDFB&Z1n2a?am9_
z1iNo{P{f}#74awCFYm4xt8DAG`rmftf>ufCzEze|eIChCsUB^H4x@i;OJFVF#U}}g
z7ez#Kg)nX^Uqn;>6oj8o#V=VpeOXGyLL!c){1r(y=NZ1Xi`0s6zJR1`d<9DMwF?{+
zQ4!0r_3=IKniSRN*=nn3@`m;6`&u8wJS?u=*<MuVc2|vlrFY;q_h#WY$<F~ONH;XT
z?8+ypvQfF)ySh{A$7P07pI8i2@+q3mr@v$p*LxO?qaxq7ntIsX|9OMem~+snNw&E5
zlH7WnEiFmoCfjGptg@xJJW3D9yht}Jzkgl_jM%|$+R*Sp1-Y0-Xv-mZ=N0?FpqA@U
zf-T+Bv1JAp_L;@8?^&)!h-DffJ$R^4&TU)Uj9Wx3{*o3Ppw2&n)pRRvA#AJVt<G7r
zHPrq=RPgE6VENxOq{t6q3`lIC^Y;f=utU#uP5Z-R6o``pg9(q!a(-6+rF?RhqzQi<
z5PAXgk}xQlW@rDZX{PBokKZ4N$Rj@#G6KmD1*=*C!3vW&8YgFP!?!C$VVV>e&Z09z
zn|)IMzTyCdo&{;l9?N#FCQ-p3s}BF+{lSl21PQOTo}%9_d3G7`E77sjg2^79mR&s+
zlTrmv*=l!F5_gWGq6J*7v#~1cTQY7~%u0*vNSM{62}fAbP(C3UU{%VbxxylbYExmU
z7APZXS#87MHv$O%0_Q?=L03{wS!JsmiS|(r$WN4vYm43KlC|yx;>^JRj$hMsCah5$
zY>m9r3o)-?C&)rV!OC0^VKag0EbU{MrU~p&`Ozvv^emp|U_6mFwCd*qEONqp7s-G$
zBb0;D0Ifh$zd_iWG9Cg_C=2DHXBjCbV5gf9Y0e1eaf~kEmgZowZgn?5Ili$J*1F14
zwd_y;A1>P}2*}IB2wmNDv=Hl#YhugOLhPB2j%^ZB&m^2XF1ybGjl|R}+ofT$5NKlU
z7)F1U-|7%h+6o9Rao;2OhTU_ZS}U@0&Xi@dY%^G(tvmb#y`DuEf>*IXQNjd%3{?oz
zA!jYh0wvQKiN?vv@r~Ed4ftkq$q923ns5R_;N7B_-5SG8Bh=MFobosgu*Gy2`yn&2
zuDQ0QX)dSQkV~r>kf;vowd-D~Hsz?VC8a$2;qs_%C;4b;`}Q=nL<xW}O`K}Ip=BB+
zwUOnhwx>+VryVM3T51}Vknwnn#izg3qNhcu^^UBphH)F%9K2ZJapx##PQysduNp@N
zSXQH~V7EYVHO;Cpd|>gboVW7V3h9$D-hZc2f-a(jor7GL&I_KQLoyy8weZ0<<k#rd
z%JGnx=ae6IpN){#0Tk;okbHwS)m3+UKr=hyhqr|yex-0rB;$lmNY*0^z=0^YW0tT_
zPd-I?IY{wAdLcd%V17XY9yc1i)huJOiAo{vtf<~m5rqCx;&dWPK`&pA?S($v6x{mi
z;zT8%Nx|abrsp)>&<v=94L!866<QRNz%{Vzg_;+d2DO8GEpyA;9GXEv#>oXsuadT$
z{dyKh#VQeD1%p&lHH8&;gp@5*s*55d=&g&v_RdnU?DH(*4_p*>ESs1<;n=fGf-RQ?
z*wb_eJDO+k&~#nPy7%iAsI;>*pJyG-@L5YBT`Sq<Vqpghkj)epz)=fxh!Psl8E=rE
zXCx~k8qI*)dsmioZ>>(H_ST8zg+9Ta?VH#lfsH-Su(0j>9(62}d)9gk_tsX1d7CR^
zcjnnL|4blf(ltvQggJtvu*abn2q%N;6kW?r+f7Y6K~E};sf?@)RZmkv_9h8R6W(e#
z%B9TD8JY{=0)#sOf{E^k#ZF0r_$SH*ipUX*@*+xTQMDv0IO!1CzPc*2nx=LuOsD$w
zn(Xxc;H$8TI!#q?-#&k*(~=6=+fk;fGKxacUk@_(O%IwyT&h8L;WSsfc^2^pD^qKR
zA6T4HOqp+E%k*qa3|q$@33T5gjCtXn-$2sQi`_tuQIf$H2}T&Tn#X%LqIk~}ycHl^
z$!6y$io(O^`Om85^5=7TTA=p_<rDP=Fwou~fFEG%#}eFGdoDt6MA_kpyB|j!d(fww
zZhLxYSuXYilVi)XUF=zbhq>zoHVYk_P<wE5zdiS#($8I<ilsq+U)<ac&kRi`FtAN+
z3tJ@Q*e9NgO_N!!?*z;a)|tEp;!X8uAl}>x@kWIzAhGgj|7+=<|5xFzFSIZ4((lK%
z0TcfkFMnZu><UD{d;uZ{$w8;a<1D>`w`hy|Q<^VB;n{hDo>XBGYA;z19^owy@zS4F
z#yO~*rCF45TEvS{8B-txI~S4O;jsw20D3-&FQ8{r8EgTJWP<V|UA)058l0?w_yVGj
z=yDYaAU{DraZ2WS%`rez2&xcplqSMou1FC{@++P--R_~2IifLmoM$LX&{dj={7{p0
zo|QbITp{?1g;O$x!~lV9dl?lA5eFhs^-aiZ#uEwX!Y?ofa~W?zO;DPlAQLXDEtlv>
z45x^INpoCLgoLOUO{KSVp3XDM&sOz8KpXQc<4F-OkPsk*adHh=<7u4E8G16CscH%y
zbMPEophNNK$!w<l<4(}?0$oLMjD-Ka!ekhitPUnt@)Okw1%F7ETna%d1er+wJIWEc
zBvCB>A)-EHoT%?z_wqGNLc-&ddJ1|+E?Bu7<yYy%DtMYEVU$e~Nno!2J_mfMq>K@C
zkpQYy(Wex1On%aY!?qIZv$Hr?1|Cp;;AJEL5$7YRA|%w`aaH()>WJtYNa5tW6KG_g
zcOq>0o^A(>`q<~XhAr+{*w-BkyPm1}Mqp7ItaIai(28zji$g3Ib-V+LEl#u>y7`vJ
zN_nDO?{Gk;V*9_W)n)1Pa@3ETB3DbB6Vhp*1Ouf5mW1;F&s*87zy_6q{R*9f8lUrz
zU=lfeMXp4R&qzTUC?QnyTsd(SaIGA^I+4E}jnG^5Bu=k*cGxHZX|bNOqXxGH&KA(N
z#ek~XU!;`8&B_G|arpK*110`H-X9#j(>@%H(6e;9xs?9lsG12`=@gtKIFL5S{1f_*
z_Xmgn9vzAE@8977{Jo58@q1LDe^*E0?>UJ5l&d27B1iu&$f>`#B9Q!E24ncWiq!D?
zI8Dbf|DDWc@c&ctk2LvxMiw&?|6W!;pD|MK-!FL<g}<vHCci^Cq^mSzzfVK*I|OnO
zClv*}IL*Ykfe9>@>idI}G-<_#cz;mMuZ(rX;d|_`Kwhc0R7Ev<UVf)#yo5=>M6H2M
z&fY?T+w9?8Hgmf!jbg2B==<BX9e>`6aUxVaF$|t<apqP{-tIW6Z@RO8X8B#w>pJvO
z=X0#`%WgDymz^|sHZ<H-lfhPJ%&PypVOTpmX5Pp>b5|$L{=rgrbJ$!xh#fN2?B=|A
zv-C7Orc>I{opYCXwATz3zJr73b=*8};Ou!*m(SZx72a!|@9qkE1BcL^-9mR6$WAVz
zyE%&X?Z!&G^4-w;E@n|rr7z%~Z#m4zIwu@knoV)wu@F<v4Z|{MaL<`nEAW{m4;_(V
zTvAKAD4m?n)vSN?1m$zacmiQO`3U4_Sv;K=dBnh-ESr+J4Q7o5tEJ(JQ|gnY_YJ^b
zvn(BFJpT%ut?MqRo&0f>Wht<H>U$yPHuJG%yA%hS?O~$(Huro^sK)mYPN<ezcY#&t
zz+u#Z1a?vN+hv<Ms(UK#E#vqm-Mv+CgZkbzh`)Q(P}?4TSXT8m`+&3njBn;jaaSe#
z!6`yHMbt~`KKMi2XW62k2ZaivZ<}6VQi22DVc0Tsf_=&;cKpC2JhTGcv+uEV@wcwA
z2_3>E54HtH79;fb&C{b=$XG2~2tqDLjrU}9<h&pPA~}Rg!1-N7W7f1YO{>F%n`fE^
z<}r=}lA%~yHlnV#r21~cn_Sfzfi;8_vRUN_u>!n4sf?nVO>`(wW<NpZ+Gh9@D5DrO
zCzlaed@55QZi{LGFRnOGkZ!@S0e&~c1iXFobcB8dRb~Md|B^*wz5(pafYty%Zj9M}
zg5HYW!d#^Y{GUZ9mBc2o_GnthZ_j5b*th0z_@Xonu^e<Re5>z{kS0FnPBNMkP|dfw
zk3+68Y=usUJw0GJG)>oHuI(9yzlSnfXMc)K)7qhGQ^GPaEVTv1);u{8dlEK?&`xhA
z%mLso%*|b}{hP^k|7Y6pS_ZQM2ttRiPRiepM%zWdB?f-=vW!t(KUgC%!q2b8H#irL
z(e?YmLN(v&^q<ms_V&$FbS}P38ZsiQ7Imzwz2kzcDrh(wmsJYeuLfs^VM-`k-{3+F
z-%j`ttJjxA=9a6l_@VX>ZVX0vm!fkpUQ<#W0#mi@&<{x0M&*O|2O0qH)rU}pj*eFU
z_Ws~Z(<;iUT(9-$mjU#5kN%|gz_W4>2>HG0;%J3%-%}=g0J8YjuuAI1aTc*1QFaJ_
zzZ29|fo`|%jNC;6uOWDUzx3>tq<>5K*`4h?+<i#e*1N%*!{xV}Kz84iIk+Hu%8Jx<
zi0^AYwry9#R>)oK@sMIY@B_=WY*#nQJ=WzK7VMHNc-SOTu1=rQQ12R0bJJ@DT}{$l
zI4?qe5(FOskYd6ZAiO9}(~BI%(S@LKss=|jflk261YPks#*z&u7>npo#vUWnS<JzI
zuTpmETBL`HNP_Z==NIyyjp%Q$%VI~Ok*i6H7^HKG5-H}0=sD>XxgrbnUtLPbe<`Zl
z3HmLI#t>FbI03bslf^WGI$FB(0CBJO?Wt>*Rf%3e@({++LI@gHN!3c_eFKB9-Yj$5
zlwS;DqeIiPESi#RQGx4OlwUlC`pOqd)(*T73f`e$YZ4Umaa2UWgQ{tVHJec=gOhX~
zGtg|Q<Sug73eQGzpaQa5r)`o**Dxqws-#3YZx6IJ?f+E{b5ypBfB-GVP<LCBBOyMX
zm<g533lIhIHakIo<jEYA-9{oQmhxQWVxnoxqz;}JBn+jkMEMe@6+yE_x4bJ{M?sC*
z&9|Ibh8EZ%<{>k%#fXhbVCh)*4b9X;$KXugL+!V564qxLtfFAiKKvAM>DlwwFJC<Q
zztCTv{Q7hAXghpTfCj^P{_excGkN|&5F2!g-oE_Hk-~x0@gYteSg>g}ew2%?56f#N
zATW{fNGZ&UlzUX>BSRP^sX8Wb1aw?FNwZ~MWk0>UQoCU_y%LnZ^ZQ8ZtN429Rq{+t
zRD*!koX}E17r#9dJ_1037g)k`IoT~b=d)E*Ov#jd#c4E)cv6VEp2&63<WAP)$%fYd
z>RH<lA1GlTb6y<2dNx9arZw1|B~SJ4S-D1ippt4spmX%<r25wym_*gw8vK(&aPpQ|
zlg*k7m_L#%>iyU5-5Ll*w4>UPJ(^x({%Ho+iEOsh;l`x!Y}KN8QWPh!(-lZ0V>&ly
z4+=C6hULlT*-A#PeAHZ68>WzF?Rw#OQyppas!ijqcR!G@<p9@|XtrEcUA?uHSljBF
zIt$?g=MoR<QA5i&`LOxCmXnU4Sk8-&6Ow-v9P*?%tdEBB`#ejh0v7tM61>{guX1mO
zrT8)?R8WH3mfR8g1u`eT1_Zye>_+GXsh^Nf%L`I|m$GLgH8(4!>lH~Z$|)-+@VxJw
zXl2Fici@peLdFuUv}%y#bkrI=q;iv`VgDgr>tbhW8L9P-V00BgRt~l*rOwVq0eC3e
z7eC6smT%-p_M%4I<iFv$_y!23T0E^j2|R<3P(La^$$-{9RJ5+SR_*~@mvMHBXq|2j
zXx)I;-Dk8;sJOk%3`)agI<;8n2ABn!i!EwV98g!sEM%Tzn3TENme@7xAFc&P_c*z0
zJG#S?Yx%x}dC-||nwG9(Kd>pbIOEu}H3K_dU<R6DI0j!g%|n=n>dz47;TFR@v^?(6
zzme(eF?ufj{1@mM2c${)B;H116^Mb@No69i@eCN>xqPJ&!68RP!ulh4JmWM9BMKC(
zJWZ4V0Fs;o7A8@zlg@Y)<%=ia8azv*q)_1(^D4)AN+S|uo{Xb}i?|JEh*Z%eW?-Tq
zIePwPg!m^;=S6f0IbG6b+zKE{&7+vfzMz1I5ZzIwUJ+EOMo0%p)&j39$XJlnat?s}
zoWx)e5KaCN{0L@;2nb|QLt{?Bak}}aOj#lEZ5VBogc-?;Y)*@L#?fKZ!~*GJ()0qd
z^<3~0DwMB6wv{7Dh>ik2iBw%B`yM6=j1PjPKLHQO=f6EwzW*tKumS}JV}iuhPx?hh
z5S?v|tYr+6l`nS|1w4jq^||apk&5ofA<UGy;2+Z3v0^=vm}doArW^w2FG`{!68#9k
z;!#Iqs7*64y5kdgiB2jL0x1wt^|Y*6ku)95vNR2W9HPQ!EY6TXD<!`%<KXu$J10k|
z0&_ItKQxS9)gtVy!O~#SH&jHqO5u|v;~SeQ+Co`0o$VH3!3{&r3PTh7p~0|4EFXKO
zXJR9;ErYpU$o*jN3=RNo!c6Xh>WWp^Is#=peDE-DL%YxVV!N%{RJ76>=6!au^jtbm
zR|EQmT=1rm19jeiE!KVu?p&@w7E<8P>I#JEr1j#{2`OYq!RJi=(tfe|yz}ZCai~HR
zh4Pp7t17-iYoh9YO7w6Uo?RMA6RGV40Dv#Q<aU0(&guNT<2t{b3;JAFPVK8JRsiKv
z4_7u-x#~c1h=;>!|NL{KPdoMeu53U)<_yTlb<Jj<nwOX3_Q?_ve9Km>)h_c5uX^Ps
z-`hKTZzJ*!?)Bfu?RfC9-!@@`kNx-evA>CHI^=cS?wbC+(MY(NdL4TAHY_eT-O#s~
zjs1X9Y?%hfgg6d1Y|qpk&7_9m-D9$2TP|p1#{+M)#jKN|M8@w)L-doxC_q|~+MAL9
z+u;-IY!kvo9-O3rQ%DfRUWAB)AY983lv9#jD91D5-vL4S>g1GnDIuj;^1D01Yre0!
zp&ekG8XC5U%dzJ$6I0LEZ4<zG{~N5MLE{@VzVEE@ZPxRG#j^fAs@?g|H^u;fdWT$!
zJ83N7?D~y!Dc%pEW+&fv*U+p$$K2O6@NIW7F~SfVhG7xSG($$|Jr)sOuYiRmew(Ai
z_J!Y~<d-3E8=esr6RQhHm-Uq?qlol`h&w#vvp$Xp0!KehvnGn%^r$Flw<9FzxYDd5
zd9<gJT#F&<br+p)#@x=*0{j9>%y|l!wTLxb2aIm}Wk_v|GxT3kQBsC~NPhf}larJG
zDrwS?g-Vd06MhvhFa?VNXCjzTC#W#k07^qmg>zTqYj`mz%p1h2${?^xM1vW~b7A!$
zfYq~z3PVklqY0m9fPPT~)^tf2R5pO}-5zcYueeAXKZ(ZR?++ux8O)&i?jsb$DHYMi
z#ZO@7X_;y=J_Q3!!vHbf>bsC81);*`GF5IYO_viflaEWoMD+ptniIaiuY;g~l>25U
zQPgIkMMBTPmd|}`h1A7?Ll|})X7bPsT}GU}6Gcx?>$E=CJ(9X7(%J(Fox-|3l?M<y
zMH`Nt5z0t%Ax(6Z0hy94TS!Bz+)e8;B1xmkx@1OeHgs36TS@GfrPi|g+lG|<w}yrM
zyxl^7E_8#Yt!ii(S8gHba#SGLQC;VZ+G}HlpGL#QqQ7HCIj-`fG-oHxs&RIS)y<Su
zjqn6zw(;(hC_G$~<8TEHyG{zf#KW#1!O~lr`4L*R6q=uS)E?rfGeGrq|2A3tqIQ^~
zZnq~!B;i#r!cu#)a<{3ShW?MrJ5#wN!5#ubN2e=W>Zu(jtKF*VYwpd81mDVU_>#g}
z&%j&eut-@t58^WUd-<u3&@s|A4V|{X?Fi|eY>4k3$qDUn#m`rKjjCux7(ZY2f!;m(
z+hl>%j6eEtUQd4=vZ3tHqYvku{=IvoBIq=Ww1(Cw^M~r;OImdK=jZF#=jY`zY#XIk
zv@D4Bt9rf6z`tc4dm)|P5ALy{YJVeCl<VXku---7<$>}pre*H~RE)mn&S;;l_h4%b
z4k4|X8Ft6l-yMIr*0!*|^|sh0VEs-R0c6M?KpHjeu0=W;0v!#3j&?)Lc5<F#I&*#I
z;n4PVY!Sk7z$^<pgc&9=xklD{vD^oM|8J|<^=-p{mEBq*uo<U3x)jAHTsjwY3;~6}
zA7olT3f>3;%a)bHd&0gS@+(y#BqD^^g(>7@jK<KCC;>hN0T)nl6&4?NSnqim+Xevl
z601Sviex+i@@$cjC;`s*T_F#MN!SsywM<<%2-7hSsE;ip46x4whBX!t;z58K%icT8
zb|8%JA7Q*pAE<fXC5HeYp_PQ~M<3R+zDJT1eO`r}S!N-aM_s6D876)AsKw+41gxH?
z-%*jykgh?&y4wSt`n#i4_k)ojuZ_Mj8mSeSq3_`!qye^EOUFJ50_=yO=KDPGEhoIk
zB1>a;g2W*AcZaJ8zIL@azTx865>-Y>xN1uSTL`B`6XGAO@>GMtZDj)}D|ThuM|0_p
zS8^X)j&m4Q2UZ)!=cR+BvU-cAM6aPEL>kn^nFb<MROCDkYe_1Y#}~Mgo1|PN<J}AN
z{j@sEMDAyr&LmZ!dgCfeSbB9=<fd!cx_#fXeb;xe8#o|0ap2~-1lyL*wSagI4UD~$
zn@&#!wL|<{<dcxh+vVM&64bBVFEVd^pFPu74{ox9Akbx}xpc$!$@nD)KV#Sn4d-65
zn;;c)8KV%a?9kkmi0L_r7_TA#4nB!D5HY`_oY*y_uM!nomGFF{fG98E6&`&JyZZS$
ztNIFIvEwK@S{nCgnG37Tnk(eUuH{%rz8$;qQj4{LSv07MwEOVx(X#X4qYvjRXu1u#
zySoo7b9D8~sL^*}#cjDjR+4kRyXAP0sH>}Du=_$*;dP7h9@x1C6L38(gOTei8o71>
zBvcK<u2?rSL*|Zqmbv2&>9;)<TSN0L(<d6X18!oATRJ8I_p#&Kwr#kk#^`<aOMTW3
zj1<iCu1Ttc?=(VKWn5?x5T%ND(_=h;gMijqr@^S1rgavKGDcOIL_&tSlJVqoFiZ(Q
zg{3%JD4u8huAn7y;&#GHxMSJ2>jl^)He^9CJ?t~j#Gy@XO$&mM>tye+k^umae+C;<
z*T%G@u&x3ImQ>=6Rw!vg>Y=$0wxn$vf6#mfq5h7M)P{6?cSP0goXCU1d$Z3l?2WB|
z28DN>iqe;Y=^7?;jR0HRg)mHdfC+a4?0cH$`qT@UYu{sa_eCA`w`Dx-a2j5>edB@m
z$OP@NZC=Ib3eGz5q*%<-{O@y8bRrUDNy}4N1d0B)jAYs4EIB#>jJ%Q6uxzgoA(0^u
zpzyYQ636M)=}*FS|3#D+cSZLtySp1xz|$;^*aQawv#~{e8wbAYVB0Y@$}KN2y!~Se
z4BD^!Giblp*M2KCHixpTt^YQoAWQ9cn?ZU|eYfrULG>L}-$C`gx0&d_vg+G8jtAxU
zW*=fuez*P^l;8C_N?+x~3jB~*Hm08EW6L2f_5x4CzQJu~cp715aF5mBx36Bv<TfHs
zTU(hegI={YVR)m`N<~7N*^Cp2uou;@fG#bf$3&~#1;ENH9J>hwvCA92hVcSTqfaR2
z<EV(Hz)UWiYN^oeSYK&|WcF_O*O5$VUQBqDHF6=P2@v^Hk=R-ok-=gtQvOIA^HrJ^
zlZ9Y37b;;8ct(PAWF{l%0b5%nI)@ZIB4{4`0!hv<d0s?gNu%ayo`hr?#SzJ%V=Iyh
z0V!Js-Aj`gnA{LgP~<yOd3dT`KSl|MxX`jRL03GEv5bnhG(%<f_6UNd-5o$6O6hK3
z0JB5O^Bjs@>T+yRC&a!*3AP=dl7JDLGro6VzzVm4TiAvpxm6(V87CJEmQ@;}NqQyS
z03g&|#2NaP#Ng38LN6y#J`q7XU(d+2j8?g{n>!mAmV3Pq%Pu#Ak;7ILJ5TMj>+GTm
zF~jXWf0tYdT0Wl}+&!yo^U-uBe+16IbiZV!1*Q2$^MzmYF_d14NC*q69Bb8yC=qdF
zRU=1rxth99vhl|jfqsOJ1zyk$Q1+bFua-Rc_VY4kp78Y){Z)_NX7TeROxGljf1AY;
zdr&j^-)WSfizs2|5#;<5y@wGWA)v=E^{6?JcaLDph?v)pKGb+h8F{BdQCgKi0lEC;
z8&TMd>xU*J2O^U!@&4dQ?U4;-#dA>-_Rxlc@c8|KLS~@n6)aQDN!KHxHNt_4Umd>#
zDszSos--cgo$LM#YUjRzGWRI#+Te~-Ps`wr@-_E_lxBu4vF^`sP3+q>A%yl}L)>ic
z2e|&>YzR<Jhy8G~sUP;k)<1*!YBi$X*K}ojggQ3G%yuBvy{F-TK&pEZm?rlEof})A
z^z{$dI(DvK{D7IW2t)-E|24{^Ac~^`;Oz~E(7~*X+Yfeg5fYdLn}&Y?xspg0DHB(e
z|NQqkiQl9f-?=0Z?j39#>w}4I7+3j?M0g&ARqUP?cD%m%UDC7ekeGETCF`cLOX+g2
zF$pU8ndRG_!2;}<x`!>p3~}IT4)%2#@W3%_PS#O5*VVmtJ}TR&v2n?5H`6o?G=E78
z9;E5TAK_bWGt<Z~UM7d&EZQ12?;tApbZfSS?`ahNL5u;3ReApY;0nxtXS$~S;V}xt
z62UZ$V=~M6S^1ap$yt&n{Bc0&1<XqViNNACJNs8nGfl^N{Qf{#k$)(pHTj2vRjojl
z4zTZxle3tIMY}>2rb&SzOURj_%|5ArU-4)>Db9j4W{+h%SCgpVk5z~N@c!V(Un@({
z+gC57#pp$pT%f;^45HEsBb3;yqC2Mrll?j^J9sLlqB4EI$q2nrb>$ObYAeHLb&~3h
zY6F}w%@tWR9*ZP&q*1iW3kR0%-@*{`BAJdYEPFW#d9lDnG(%Uiw<-YMgrjs`&~ysv
zd(}w;FVHxG&K(jUhI0nSxqO~W3mIoeh>}?`SJuI|S^N}=OXJYVwhVGVCt^jsCLtH|
zC&T?N<q=F#EFOaEHl1*27Lh`BOl3BP5i}wQAB)&jqJWs1+HwaqRbK}ZzZJ)b#5^lx
z+fik5|Nq&07v;8*EL-$fax~LpQHLqxk$AaU9pkpk-Hxd$``E6YI8%01<O>wWAixGd
z$?AzYasT1|;r)^uI}-o_@C8bgEK+bpcTpsenMmx++>f=_j?&~DebUj#>S4<+A$DKW
zA;Y)nbe5&lD3>qv_#oO;TtaO>h&RGet|3|qBx$LB!H8#4<+%fmS(>424pGZ6ipyuo
zWG;)=MLK|WO|y(9g%o$LRo6cL=UI#x6v6AAS8hvAgzI2mm?0*%VPhuz5KCrK=~$+q
z#C+Pp^n9L$l*@cco`3!D69yqrM0kl%B8khjh^Dg0BCdr|S5AyoXc&0yqEwu#yB8NX
zYsabUci99`5zXo-_EblAA+VlBz}PBJTan(|gl=`bd7eb6+U8DGA5|<CR()~vDVpi1
z_^%&+D(@>d(a$H#C50E2(oh}yek}_c#W42Iwbxz458z4b#>VJf2C;EdbJ?A?gT%Xc
zr8eu2db5s_I@r7D$m-wG>HzVUM}!hongm@P9E*<aojYE{!dLfMCs!__#f|>Rs9n|z
zzNJ;Mt}14)dK_1+4k6_AA>=6T6E#xT?Z}U;ik!Xbzay@pl<M~amx5Y7oVR`48z;F0
zYma6(cYKl^Le}l)uy(m;=h)ni1zeT_dHeI=-7-0T=hXPy1l_c4t5AKCM^hT_QX%JV
z(S>~xSoIV3uKnEWCSCUMB%H_b<FCvPs%NiFZx?^Y&R&f*zKuIhj@Ff#XWG8SJ<N^J
z!z2s@4uoZ5X;7bqfn$*Hka^oXrebA9<|qY(G1zBqnD@(-hU6+WxwbuLGFxcEs%-Za
zjmygFZJV=HE*0gu8qFo3R}-zI!MD2c>oofsr&R18%<Q^5%71CbW}tNS#4|taLfG3n
zunphzr6I7(3B$y9ee4G=#gr4DGn>oMcMo_SylP2*TjoK7&LTEf*$-*BUf4_TNUoUJ
zfl+<$0&3g063|&Bk6b(*>id>y``EIGiHT!**f*GugTS}B;~Spg7*E@!Q5q{i!M|RB
zm$(0h@37%FoC8K*ZOPpoyxg0?9ahL}T-&YH^@0`@tvnKHZ^k5}z%c*cf5~Vvk113S
z`=1)iK8+G^Txg&?r!mb=J40yN%5C!Z1%!S|zwOdWiz$B53Y|<kUYB+wP4xPIR1>pE
zBd9V48m2wmTOF~B^6`x%1dRf3UZ+sw>I=pD(c{MQx)MfSKNz||tT|m!Sb`?y<7QA7
zyK${Lz2WlmeUuj~j!*bj&u{f@UdWmH*oEtZTR)u_0NJOLiH7S}eYAZLjbSa#5{+ff
z<!ST#F)~(7OY_R|d$_Xg16e#J&G}v{m4ij_GNJKJ5%IjQQSfMMmd8;d`6bPI7~&`D
zx*c5}-(G%;^6DYg3wdaR=q~!;(ON_vwL-^n0&GfKVq#hpYPN)!+bndM41CA1o_O@&
zGQI9~%CehMWmM|o+PDF1Pq#W*mJ+8H2ST;yt#zEUn?~~6;PYL(3(lf)6MQV1{?Tqc
zz8`RxF&h)xXP7vigMAWO*zgHAnG*^#JmjjspV9?US_vemW8JHB?tyXLG*r1?6_f<>
zr$+uSM7BD6P}NSE;|rUOb`*nMTSp`%<(JLG;m43Q4*86?qLCAv`P}z7Hhjn&7jA%=
z$2@G<R$v9L71$5qz&nhBb7j(KQ-~IlxK5Vfq_~3c%;p2^R*Aif;|b2c_6fB}(p?{g
zWjAPTUToE3w@%mUtXkksYlMyUPi0{Aw`bKzo_)FKpFCC>4)#+s9PYD>Y!&R=il)0G
z*1aJM2LO4`q<BrUue}0{$Bk5ftRVC8(bY(9p4h!sd}Uucu1N(muo*J2FS*1tun3fi
zWn2*MaC3`&x&FripS}&B-bTkh6@a=ch{tUsz)S`b6K0t>Ach3CA)pzSj^G18eE_IG
z3_!ij<ct25PG>)$4^jU0rYexo51IZ};g3To#&vy}LOpV@6wA8xD|Pw`i=6_PS(^la
zD9jQX*VVq^ifUUgt5RobY_&ar*I?E2F$$qnECySL@?t?aRVbbttdOt`I(0pqIK9T1
zoXvHi^$G+YW;8FdIS2SU!hkbZTxm2x`3$(&l5|RA*v6`HGa05DTmbN1&ZQJvG4Agd
zsC1YMWoXya2iS0p^_@W?aFk4NCi5sSfQkL*H!pQXcu1O0pgc2ADZgAG_7yn2Jsm5j
zy7Tlk&sDDY`OeV?3BhSzpeSLGU7=v{Iy^H^rZk}wcp~^dP4f8^qI!xezMNbY+*2HO
znsp9H@1$4^r8WaoG*9vr&Ib5Bofmne#>i;`+;@3FGXUH3Gy&^WL-6+tbJtR~6VTnD
z)U<_XV@sMgCg2629w%4?25|{>93l?gW7HAH(|Q$_4jz!Re6-SUr0>Wim(f)fo>e=<
zT1#K0ttfGg0F^___Qyzmn^CoPl;A1<QF#-zAI&02p?E9=g!Po|<VW%?PjDl2vBj8$
zNx%Y3dFW%|F=7~&?K{B($kIXik-7qQSGiIGx>Br4f2I;V==B+x9|euO9qF-@JEHPb
zse~Tge@Sdu^?ttaFTpiJVlkh^5vL$JMXKpSX(96hnoTq1?W($}!3^~itR>&O1F7Eh
z3hVZf0`oWN2CL~QG2aamzlxx+p1=m@U?$G%?>|n9SyczGOBL8~+11xCa1m<i!7Eok
zeDf(k!LJS1T_fOBx22k@?q1_7Y>?wEc?<P#TRPbQM$k{7@CcpD%h}T%yyq}`Dy#9-
zG>mftoprl@-hSROGDlrUWc!Y;JF@Qo*_Vs@vnu$Y=`|a!$96;N8np<Tm$U~{xAKSj
z_V>I`Jb!Rq9<J-MBRGTma&TX6{P#rNmu<y*Cl6*od{dYVyC#GjT@hmDI1Ua%&mu-(
zTS6EIZgx~AY8tLgYF)091{Yr|PV==|pt3#Eu#ibBHGZ`-VgH7Nv#W%_Na~3=Zg{l}
zJyUo>U_uBOKY@h<&l6ZUjzOs)j&1V;m*@s+V!K2)BjieK!%Y5tE|Vg@fpYhXUwu=^
ze2M?zaSQp5z>5PFayKL<C5+<Gw?W8>hpDhU%!SK*!*rN%?ZLutS@?OsoqfBcuY-;>
z4SU_$I@5lmMPIF_y_obuiaDU=?@Y0<Y%uGlds@r-Sp9KIqqwxwRfDRHrp>&atf6Z@
zmp}CFwx1!r?!MBZF8f?%Qg?^b!=~=s(lx5}Se|{kSRND@#pT^i!@1L7KjXS;2dwMG
z^9|<pQ6q!8!ZX;{gMEGU_VwM2r+&uuq2ku<kQ$avL+l08#>DVKOu1!XW>D%%n^DJn
z;&fXZ5y%>d4m;`|EUE_ZUAJGWlT~0zcLxyHo;qcv#KGUoah}~Mv+6od+Z4qmey9yl
z>W%tj58(8cx=ig`Rq-f26{GEHWpCK_Hs!K&`S;K%*W<<qb#efj59;K)e*@ZlK%4K^
zO?lkvr0e^pX_yW+Z682wRAAo~6qC>o17Qb}@IwZ*z1fI~Y`fuqtbSdh9j?Mt0LPUA
zPVehWh${j5^BS}k1-(SMlu1P{r5%pwRQdA(D3p`{&Cxjm{_htk2Y%%+hUD&of;y^u
z$7QMA8n&4)hK<3kco_**$~Qw$OjYAA7Z_I{2v-Bpx-jUR^F*Uj_4hx1<MCX`lDo5H
zR(T9Sx{&W0{wiUap=q08Xk+05l+N@$%%HX}r#1;}Cm_rjpmaq;iq?rY@Jwk=9l24o
zmz?UF-xzGFrl5C$*>`i7qqmi;mtfR5O(rr!mr-7%it#wg(PcEbi~$j!qlrxBQ3AET
z6M0<^0T%l6=jhYh_b<@fyjt+OG%cFa8<ZDO99M+R^~@-|V7=rh=TfnKmy7NkeJWRF
zaVe*YargQ2&8rT`P7srEdW}x05W4O5QXbXz;uL&=FuTe^!aSz)T*nWdKL<0e)Aj`t
zHwm3a{PefaYTr!r6pEIAJ{foZ{-Qy4OGv_7q6jM!ZfRmKE|e2VkGQ(3MhWJ#I4Vw8
zxz0bI{M+Y~(QoFL5&EYn`M>D2{iI74q1x;}f}~z_xSCqoy>-U#YFu9wp02?KZVXr~
zEW5=pgzS<ZZw(fxn-Sdo?8`;n(weN`KES;pK5*3WfdPJ3&dZQJ{Qa_rdr=XmS@Gwa
zeXj;6b@T7?<}ND%2KKH@`?U5og^wPP*wD6j0V5J=8r1Uz_I=04L@<T}$gY+i^Mofo
z*LDvXx>cKidTuIP43fpx*otsrBgqhDGy!@*rAsS$)MO@&NWnDv20+JVZkr<P%F(I$
z!c-Y|z;p;{)cP~Oge<jqRAn|ImPz_mq}NIPO-2hj*6K@(d#BEU>?HmvzKPRn%xMCJ
zYo?I1hbf!qQlL*iz0M)A@e=IM^KUo*7^CwdosH4CVul){^ZZi%`Hu*+D^OLH(*HcB
zKp!M!a*ke>lcGZ%QLZ%cmU%oz`Bw?{Z+cBLfvU&P$504I^PW+q)Hk0KT3RGzLeFI>
z97xEyisW@=U>7NpT46j!b6HQp&2F|b4NNO=1jD`=SeW>hj{}=Km>52>T}hZBpLp;P
z)^EdB*89LF60Gh@UynUgh7Mf6wDh;H{6_vIR(Gu115_IBZaaZm?02-zf05T?Sicw+
zG|-@?V46=ZaXDtSaO)UsNz1N97&6L>v|776TIhX^^7g7OJ9*4TIkb__^Vz3ZbnY(F
znY!!S%|G<rupz5Ykj$<=z}~DrqzOEf{w^x?hd8>@A0j^24cw&qL(ZU<&*zg&=7sw3
z_j&b+heG|ArAhf={tw-KI8XG=Gs<<l(=^EonW@jf;H*9r`ajcH{bxeUR`p+hSN{?6
zO8uA4^x*#y>Hkhs{e1+XV%2D*yNpw+KTKsg21taj=5(GE+0D{?{+h)<>-tv9F=*Hp
zw$g~{i>k!E7((<NS4JaR`}yP?JQ&#gvXt})w?cHgddZCoHpT59(pghKrgl~6hgyE#
z&90j@`IgNlM{UngtG5k~pK@@o(&S2!QePlWbJ=v>r~;dB#R$gpO7EpmtP0eHo8M!Z
zOp43XBCXceQkLro{Rx?H?_cUY8E*f4Qtj5CPufHIE6qP@8ABJVkPHn0TykDj+wVo~
zo+=YvE=pL#@-&ae=v^W|rSB4{?~20HYBnw|TEiS8^$f2rX|eLs<`V+dwVo^(=*r9M
z$z1ZHU2OBAje!&hcr5BG8$XxC;^h^p`S(DFvEf?vySfqzhHtnKe%9A5-a>u(;?0f5
z3kTjs*NgZQt$t{cxG(&IP1s1e&f8ALKOtj9>hA|y$X@Bc{WE_zI3E|llIEZnKGItB
zz`tm|FrR(7sN@X3QL^&v%SA0w@MS3x&%RtVWT)w$%qOdoipw`$zGnRn8+XCHG_r}y
zX@U!WO0V$;IaB&e*>>Z-ZuX?YTdaPl-ss>atrhCQO}a1=29m{UCI*tlLqk#D-lwpO
zN04#hdc+mjw*nuNz=4uxF2`0#1$Q~4jvE}XM-UE`lESbNNJghgTATec6F`}DBa2Z_
zC!w<DSGF)lYz`(W)SAvDl94JNUESZd-7%bfwSixH%;2(lGKWZ4>5w=_pDtxCQ65J#
zG=rnB>{iPrFsxmJF{>OG@QgJ}*H@{UTlUV;1WB63Hz-eeL}M(INt8&bVAXjvNof2u
zd~k`p7U^_17hE81pOBDXCPR)1^IS}QE-<H#9g5H~#ZWH0ESJ557f!91OL`^IFYi_?
zE48X%K~*cMO>DNtCkAV(y_PmP@v3#E)-9}#I_tX*wA6zHlDi^{W;2ET7qXCwCGhSU
zrGx8iaGedVv%z&XxXzB!b@p9dR~HwR@2d3EHr(ldLI#|c3pdvVa`d$dG_87RTn@ge
z1}1Oesw(JLU=w`=eyhR3bQBdl4$A&6?TKB?Z{M(8>M##82WnZ-kl?_yLd=*ESd1Aa
z^AFkl{%HkWcf$<O%Kz!xcdt-J1<g7J`0CO_4U1u(ORecw_!m^-Uz$YR$|9X=M>RTy
zU*tDBoyBrBFy<c-`~@M{(K-51!+{o5vy@+!0sSS&%m)<&2R%P;gv)a@OJVjR8lxx?
zU=O6qZil|q=+39<l{P%`nFNzOzCl7lL_E5Jm^O##w3<Bt$xwmf=qo_`V~Icl^T%LJ
z7x9i9%7XZTWrhS>w#_k-Mu=(PG3?vYWSmN22f@<@v*=9teg(Md_0TbfcUm6f7XGbS
z4sI#IUfwi|!ZjBJ)>QS2Rq;ug^9oL)Ru5<ziM)<))bGu8!f7HRmB7+iCkkvgon`4X
zDj^yJxMIKHid$7<yB&mLBYa|IJbg7Qz$#VwFEWt;R1&My<;9O6+?x{gKmGI?B9^h}
z254LQ?htVN?)u>PF(q;w5Wy3R=RICeM>BY(9#`oH<vUYqg1tSH`6;CK_wG<7j(>}$
z^XZ#RmzH@QO`-w@U_RDrbdTQd0@ZUDqsumg<M_VBhG}q2JVJ569UFUudA8s@a6NY@
zDhFFTg{=bK$@&!Ror}tKD_XUySv{E|bD<19+hdqBA~B(ki32VLW}#_%4xuiy*YV4)
zYkTc{)Mmc5epJ28oTh;T0b-V>UzIy<o0+3Upz=9E#CY3sRjFY^k+}ydGN%^i8}KK*
z&(boQ*{`nL!VY~cL+$1T>+)R~MqDD>bx_W!j{3_D_G=Y=)ygDXm|j=+Kvgj*ARe60
z^V*Z6qppyvpv+CETBd>hRmn<ycL;#Yt+n0WCRZ{qq6wIux?okSnKG@Qteh4`*%U><
z@dk!E(8CqFQW2Eik<;|5S)xc)1%97Kkk64p(BgFlKAkw_+CFELf350mK@j2`{g}W6
zD~dSuvM4CO1SEwnF1KiHT(_ksU}f<>@CQ(6;%l98kx4OEkBzdqD(jab7N`6xlHVks
zt9Pr4F9CQ%NJut-7gk(m>3njDcpAr)rP+Oybkh^POGP&;G)x{C4i>_7FrlW6gV6Ob
z_Y7iK%;Ki!JZ%qBZBOS*4kI<)vwF2F19$6M#_csZF8@@{pVbSqy@o5~R1KMc7B|$1
z2Tu>9IV1<b?o`*KRfWuxqD6Q3A8GbAPIU^z=ac$b)YE=GQI3vzQtoS~s?nyup;J$O
zkt0%O6Ch}Gu}|jcqkbgFD0rs|ZkeNTv+0c`s&?;McdF*E1YN_=YQh#nuvQOYfBlya
zjWGHpE&GQVtp{LNew;K@C>!{ec5&>gzj4+2;7D2TNP#);F+XtKj*gTfDq>l#qQ1s&
z*X7as1upqJdYHO>yagw@<Y^*kc5}xkQ4)EZ=dgCUXJ@y~$yAvzMqkHC*T>V#0nqOW
zZs(KP*&}lsf6N`cF?aRF?90W{PuRP*XRn*0f2gSm=W%@U=p8vqC+W589V}sE5IT;-
z9TS_bZ(!od5C=pM%*@c|VIa7)*#QUqYYlD5;8VI&JHD@ViY+ls#bQ_Klr2rO3_7OQ
ziOgzU6E1~Q=`n=FwKyx2YNyCJ;lj2&BC)|;6BEy}ux~RDn<3|+PXj_7?`hjLIx@b>
zq{&yyN<Z^vlPR*!{%A%uH=7{6OV>7XLMx!(%5+fp6+)GZba6<Vj3xSosvqDpd~9T7
zLO0L8T-5Q}X6KE|;I2i!r~0dI{HM}&0Ue~VklA}$T-Lw7gVk8}tv>%cOUCHqUtd~|
zJE;2gau_glTldVKo26+x(vY6Oo@pAG7*b+tdmc8a69g8sWEhAcm~&sjoQ}`<sYGvl
z$+^iW1a1r$6J~Pk2abiEAY{ZQ%;RhwkJ=Euc@)a(AGKaq#Z}5+h++Jp3aMb_>z?KE
zMfIT_YyrnTtc66tm1*|kpAEydUH6C2CuP*;p`thM)4ag1wXgmL{pZW~=xvf~8f6We
z8ubh1{HM%Pd<kiubY7%rHqRy!o&M*`_oFhbp@J`^dcU^z4h^9kOBp)2S&Hk_UPl;b
zm6ZoCdW<re&*MV7jkOlmtS7lh`2+o_Q69JqxonN`yecC%|5){yQI4dFyJ&Fa632F0
zA{MVDoux_i4=EZ?oJlmB$8c}=;hS-#`f)%l&E!m~v_O~!^#m|G6j-dj0_*hx@hBi}
zw3v6wm77*G=jq5zn!(f+86-;rTNY6FWl;`MC1}0Kz?aKuQs(wT`Y+7Nl|-CQXEd6W
z6n~Im3>l3o$+&t3Ttq;Mrf^qK;Ap=wpMTKVZXqAjc6kU9b74^j2rLb#J#1o^xwdZ@
zrpc)Bv`wQ8A)gs+6xEAWvT?d<F^sf$M8(bBttJTIz)QXW#x<Em;NO;~C0GtNu4>=X
zj98;im<Dd$JxZfWc){bnREs}fj?w6LwJD}A(iBw6Y%49s|9tsgmEqd4_tx#*z|5w8
z6@|`idu`mjh{dey^Ml%Gb*~@ioC68^E&42P4d?OlM3Y{fzoAhK@vB>eqtu<t{W@#=
zEnlvR&KGGTaDS_pTs8B*8_iT>aEBn+KC{b)AlT*^8-if1=@^1wLlEqsgJ5uU9d``O
za0A~UrimTtGE68Xn0my;wqtT(G1C%M9&ii{G*4}I<|w_A83Gfk9r@a>nO6;*0!2)%
zS*t2zS2P|ih-@1Arm_iZO>qAaFxS0}C@b@`XZ-77C3<fH?S<UrAs5)DL5PXNOdN!E
zfNkG0LM|<v8|%Q_ha%AIrW8r#tZ7U0>j=CLY_5JzL)2foA<q=Jm-a5IwtWjxokjA<
z1vOyY5C*le@3|C{KzKMXVCOYGmpG=$sqH^)_ep7g<h|S{OS?P>wDP$rhh}9|R`_l~
z3yN0m=e4h7l2M@O{_nqJG?~XVi;A27sR_`hQ3A1Eoo~x&OtbZ#l$K4~CX-n(s!!>+
zTQ=Atp;<IYCzHOeo~49eeU8EGEh@Qf^vzW4(wlE-ct%F;kopB;&3S>^4KyhqCW9i?
zjcXO2A1*K7L3y!)&%?KRBCBunLeA934fV?DWTJ|d*L}33`;B3BW`@Qx=kj#%?HC!|
zsVJ|hzJn{;z}&@?(Oq(xw?h$CknLqc<C`Mld0(X32`nB3s`ysC$<pb2n$fA$Aj^~Q
zSu`B#FYrs6^+1Q7sOxsb;eLDhEy}BhR4?SA4V2p}bw_KTaL=cX5lC!XB*cXJ95YLL
zm~m-KLs*9EK5_h&F7C9mp0_bn(EFt5dT7~A!<Rl_jMnaDv#8w49*3%ZyxT{}1L6h_
z4w+$L!d#B2W!X6Ng3x0D@oevqIlVrmvyGwoDg{!j!fi|OW9z=P7=kq+erR%Ok9iD0
zUy$fq6+aJs*Ym<qV#Dw#CMKuYH-*F|m5vZ*APkp2?UP0$ec{X~QL*_BBD6_v?s68b
zDTmZzDD9qF|4C<Mw6a;l`k}0z?PaeQ<J+<1btBOJ?90WX8CCRpF><JT-7r~xdsYwe
z*_VsziH6hrsLQxCMCAZ@k}@e?)9mX&Z*=llnTf_nM<LtPBz8f;I|dJ^@7vfV#KOc7
z95bJU*zu?c86)mi$L{(czuW>Q4SBf{tUen5Ey^Pn#Zhsy1@%3voIa3mqI@EhZNzf}
zNRnnzshdXmkAI)j_*44uDEN&h*Kr}=Lx*#VSPqsBz~3FqzyS?BY)Qf`PKYP?x^#;H
z`Ck7UknelsEh?3D75#oi;~0IMvuTv)l`gvriBT8Ku8`Al47AI$Gy^Mv-2kl)kkl*U
z-0I34`Yg%|sF<qKNMK^<!pJQo?K%3G&NJSm3Cimsm!)A8KlZCQor{;VnYKN)BHVvW
zcskEuD%1#dS!NivDxF&b$k#q$o;Iv0fQuLNq{$Fd0`s#-%{4q>W7IiZIGq*o4WQ3?
zJckm(5DV4=$bqN23WMczTA|^`P%L*A(;LNOt;$ZrU{EB0FT1$W#p0`KRT{pYhKQn~
zB9W^g>@UzPx`MJi$}BAJhuYLpQdZuHrZbu4X`*?T6j>7x&*8E<5xk`wQI=kTsflu)
z&LoP8Jp<nJIol2J?hwvGW(C-CEyy%-9qe=FU`nhoB#fBSwV$?!U<2U2B5kjPyd|*p
ziY}UhzrFlBtSw!qU9Evqz|YY;AlL?#Bvyji><Ua^WvNR6l*jc_*Nf>n1i#XGf#N8X
z{D#M}-UAdTye^+6Mh)(3)`_yVH;NWP^M}{y0?lZa%iqC^clv=|tE*nqg0`ugVN=OO
zS&O;O5dQG`eDQ;-VNwmhOoCo<!^&$~{Ljt4z+YhnpHI}Ju5KQvqE+pcs+@@~<gDH@
zZ26y0M%~l_n50Fila*tJj$3W25p-QCKvTJB;8tkyYP0>&I7Aft<#J|1&tW&7{GJ94
zjc*)rmD8}diGB&|X-_l#v3VS;h8rUvSgHnq{+c6ZV5u5ds<!?cSgM{hOBEb=#|_XY
zW*~)294r|(F%hAOSr8hSdxQ|fri=vZy=RX<g5B^B^abd5l>Vl2zXqZI2;lchP@e$&
z-lbmPFoR;>k`^YGN3l=2fhh}_!<Zup@s2`V(KPzDSx%dR*{pS}_?#64>$Eb8OJB>V
z<gHeEeuhq!q^Fq{^m~xvo#8?t#mA4#H$%c5C-kvr1qS$eLd*<{VriQ;aa^ATVfeKD
zJR6Yt8~r@>4!;v1{{h`O8!`WbuV<~VXH80k_D9?*`C;kS-f0f`oOJ;|;4abblY9eE
zr|YO0jkUXC`<+Yfk^@a|=+0A_yU_SrCpaukOL<}Q`ytU`NOai0`h2u@o+mgnY(cS*
zfs2Xl`#3Nt!3MQMo72D-+<n?ghfZ`*g=L~|t8!bLdO=s!ZYkF5;HF(gL+Rfw`x45+
z)T+&BofQgKjhd>-59qe4iPB7tBBa#({dBKUAk{SpPMU3OdDlQq-*#^iPU*gyQZO%2
z)JMA*S6}LnFz&j^jk!6CM#|Tk7a6C;>W71-A=Edn#|PhxKA(&RXz-&?>?tkvqdhKt
zLJgCc5<8HiL5O8z%9(*}PHbXP60p!ZU_a9v8s`%IA}3UlL!Q3*Wu%nzmcNwUG>?^!
z1ueFCPHUvm5`qfoE}<bQ7WJU=F=AQzRh0$5PCC8i&>K31lT?1AaA2Yj5=u)!v8lgg
zR9V&NQ%3n$eP++H6d3Bj+=qMTs+hPsU@O$d-rZZyZK4VK!H(R)#VjVmP+&J;1|}vm
zFcX4eW)X{dA*GTVPhjzU()hW*$xKAN=n-^iDtQWZtXB|-_myr0(Hx+0u#D!QE`ezd
zudlsQREkZMOvdP!wD>rq(=meoADyF*O2>tQi}ez1r%^$BWqrfTXmS~AZsA1@w+Wp+
zmX%aZ$#JhGCRpG}Bfx|R3lozHOoJfAfo)1cebWv2I{NV^Ww)(dP^Y0<s!6$2N4593
zW6JG#@QlG(R>0Y_eC!;LLA3#+w``WIV7ko<niaXCz+Sd}T2H$8K`9w)N3VYEV~5nY
zckdl6i-)!>?w}+cvwdOO0hc~8uoH3%_I48ozGvaUWVS~=5*l*g9l7hau2RXh61E@x
zY1rF$-rKbjT<XBhoxO1eHg|hCVxwfDsl!L3^Va>Nb#=8?T(t3kXx%Uz3I}m0R7?1n
zj|Io}xg^xa)C@yRm@hCTu8S?xv!!6n;=(&{J{i+M@2xT?42g6~qeLaZz4>Lyh;EzA
zpXxd>^=&QQnDs8F<zkai>MlP=e~l)WSXZX0+f-o{nutiKN-ipUPdSqog<14*10_-(
zhb3GM{kSdRfcb(M+`|?NA@AMuFqM{pUBe`<VVEqm?89FhQ6i$NNX%)xSSJ0~N8|45
z);q3|$06Z6GA<pcgoh!Mfk7EIt$<_Vg%k&Za_ktKGRN|%aGa;@>sg|RdT*gqnOw;@
zoyk%6cvum`-yEW7+Z8!FU5Z%@Hoz_XJMS$`C-ppiQ*b4L8fJ`%ZOz2CZQFKoV%x^V
zwr$(C?POxx$>!d>yDwc`)&0<2&5yrkS4y;J$>#wlobRCu3|h~ryDi0A509s9(qDD)
z9T-&Qs^Rtv^{8fuiQNvhIy^p7#fmK9gN_7EhTNXhH6w4?9!0rI+4H+5fa}teQ1!Ke
znrrH0iL|NhV!_qJ-+ST!9O;_xfu9+bCPiYs_mMhOm*h$NTFhB;JI3iv2hPmlzcBq?
z)hU|s*>SFAi)H!xD}|gv=@-~Qsf<@0%3`2Fuj!e%FBG7m-Kz`l!kPT3DFUoJ01{-l
ziG3r;7Zr&$EEc=0;5Vw}dP2uIja^zQrnrq=0vlSdwzE$U@mP&ro=)$0EzQRgl&}`5
ztA^2$;U*lZZOMUnq4a-h@doH)dh4pPteAeDT`iMC%3~+Gnda`#xB4TFN?W~|lU5MN
zzx0h@&Xp_%f8@v{3U{>_(`Li9jc?7n2fdOh-4)A*)W4tHK=?#B7w#SY`Pd&pvSNV1
zsI8{1k`67RqANE$Qjai|0V@CG^W=i(rwOlAAtuE%xQ8dg^<vMV7PV;qi4kj^Amg+-
zWtA8$!=a~^8R-w=1Yt6;w^D~_fo`F;B!``6c<KlRruTe8dc?oYVo(&VEc~b^eVfWY
z6c?m`b!yKZQZt#2Brj3=sfYB#BNv07I-FyU02G(nLWbQ~6ZPLvs`>}+y|1KeW4`>O
zQfBt5qD*zV@{it*aE=anQ_b?(0G!4jo!pQ0s1%$ZhLmRbwNoyckw@mITltiAV{)U$
ztO?me$=+$waNBf*r)Nu8hZ=17Gc%<~NrNs7h5Q(yQbPcma+&k`V^ZCPzpw63xW$^#
z->Ai67s?Q($i*Zyb2UgEccsGOmmtYGY5YESIkQIegFn6TO%!!rn+?O%_PMb^y?MNP
z*ip8-MN24@teAXXA1}|5oS*>$WAka+GQD=>&yI(5_MjJs%05)fTeHX7+j}P}1K0Q+
zGHrmbCskOnYrBW5iJxIn4J&4Om-dkc1Hl%_tPBh+pfFmA$RltdHlbR6XXn1S5%Shl
zf=e)=PTE7Ig^7!G6n!>?Akx%ohUgGPtUP?X{S6xAp@zy@x3)qI<z1)+Z-gA?^*N}b
z-IbDaH6M#5k}K0rC{oT#6N^GR_T|)Nnx}h4#Kh=7Q&#LXRU3eL*o%V~X#&vUa7zy1
z+9_2MwZ}Tc`0eEqcvjev&*ogI9EDR6{ZH*LG)%+7jp!%C4)pi!NHb@l*<ImRGrm!#
zVCb7TuNyo<@vvjz^5wPk)(1gUqeVQ6GU{ooR8+W@)dv{H0pxv#5vE39HD_&{{7yPG
zUe(e?j$3l!XYN$J<`Kv;Fp&8w=xdU5QuZP!<OWY_`ea=(yDL|NA4R)mr>j-)uDx!U
zt($|)c3#rB3w@Ih(pK2<T6t5Y=e$51QwDBu(nbfSO$vfqCO5N|SQd*I7vk6b^!vzb
z)eYy-%?hUXsB=NXZ1f)F7A?AdIL<vOmfq(&c+z{FPS53DHzp}`Q=~mD=7A$8(q<Sf
z!>cTm7|NZ3N1a;!I6mG_hxv0y%jKJg427bwEwsZ3J*py8QYimX%Fl2<gU|S{(R1>#
zobtb3z_><iXLc249Um}Od49BD`EPJb-L{$@G{!(i?{cx*9~`jJ`6lbDqPcNnE{~!;
zBmO$n$|NIHJ*0GRy<@+!Q)F6y=@Cu;ftXQzu8)k2ptRClN8AiP;@>!QdxERebQ?`6
zwzipTPrjBh@5bgmVB&A5!(Rc#*E?tgQJgJO_owJuvw2TzKODtvOJ=9E@Y8KED(4Xe
z?$=1J9sgxW_xUej@n8|DTdE@4o0Ds^g&mPC#Oeoa1NjRH3WmLqKyNJdRp$QQCh8;k
zX7D*Kw-MWGyp^xkl6_1zlU{E+ef3sp!{1gIkRj(rM~E9G)DJ=GBg$RXmreI|I&qgJ
zV$_Lh;6C0OsENKwf+=|T71xbr8J00i6Yg=c03>_mjZEz5N7AWk07Qc>MJuM!rCF3R
z6g>5Lg?Q=yO&e*0ipu`XbS{dfGq>K^%LT08FNOYj_urC)10V=-<hz08BGOpO8thyJ
zkC-MbqTXuiF}D|1UGL5Vo<~0fbS*gGqlG+19aU^-Dj7O^?ysx~5flBgK{1~~vjSlr
zCHPeSU6=6x#X;@2*;K!<j&cvSkLu95E?YnhjFE!oDx6#vzGj~FhFf&g@+5Qy?4U@4
z(o$EG2c<oFPxql0hz(BcY_F*n+Rx{$$e()(gN*@iD(>FRWiK8m)rp7{`Bjid63U}Q
z#zh0d!Tge$bi5UhegIsVcno>t^U%+r%H(H_rbreS?uX`0qIc1HAY+yJfR&C5H4T+(
z(8y?X7<BtXU~Ajflka!muN~2SmoXJIkS8fp5m>((t9;7C+Kg#c?Rh1CV0D~8Z|Yvh
zmrAUkZV}+WGHlvKnPvPE8M0x58}6=zSi!?1CyK*NcAjFts?fJ{(+ofT-jV%HDX6=`
zhRGxEYS5}SIa*D3ea*~b6M3=(L-S$xJK4E}=**Z>A%Hs2(th)SA!gMxQZ3?NO_o&)
zJE4u8W529;N8?V-bH}JtBSk8Gp#_3>6Lw8JV-hQCbpW2X7Py?$lTE-vf~^BzQ{}Pt
z{oH|Bp%J7r(kC@5)^GzBY}`ef@tjFqs)KhXiDOKWUPK!o6!5@f4-G+kB%F#Yv{;Rq
z#SEm$VmCw`MU1&@=r@b8C_mwjPih#m4`F~qiXxL*Eyfg0s>;#Qq<BN`lEV7C!Y8RX
zV*dC98Y35Dr6{GLdWNCfAeC$tj^7Gp)Dr%f)4@oI5EvTBhx$>PZRIUq5cYogIDN4<
zwtt){&PT;F-LwES0`Y2S6yd@thY$ue%FfqcgVVR^9%wT@h--{LbYZ6XfY*e#l<{Sb
z>wX0$!lG4Ff04g-Xhi!ID@@MY9tM~9tSG2v%VA*T$Zemo%=y=TeY|a5N8X{+SbVK4
zt?*6kGormhHC=h3n7AwGDJ?HYI7F#hvv39UtJWAws0dVHKaZdMd#<@7z1IH7xHV}k
zuZVGk(4CM--%8AK7R@y+xDZW=o?!I2_xzE~?ANaTwLDeniJr)fVyYdsuk-cq>g6tv
zvNabCBd~qO=MU}5a=^ltdo~eV?vQZHtliSpx5_ru!1$hH@(j%6@~gL9vIym<2=Rc_
zf79BwulPv9U{@TW@;rz@<KU;{cf1rSBsaYe)1^<Z&#8x7&){Gv9L`}b%YAR`p49_g
zi~|4-wp1)-x2YvkGtWJo17CWVdySTgA88Rge1NFq=VwMxI-ac2or$6%{;l6x4eHsZ
zH$#9H-v=*ykz=^OvuOZKBjc!X+NI{7h=Y4clFejicBq*it?G1mgt3sThn~E`oy&C;
z``doJY>S-?hd1KXl`Qc`<q`6#>AGY2{w@<|@QH_|%U&p-lD>qRW5n0Z&pY*q<BEWk
z%|qKgO}8fqQ}oCENVm5Qt(>e3Ca@F1_S1x>*M^;#L6kmj^q|RyI-sv4X)D5Dj?3`A
z?MgI_vva&*bHxtXOP(fin{KN2EKCW&`Eb}x<mN4-l^ZsA=X|=90&omi@;<G=Ql8%=
z$9&SXOvY+;+1%-uANN^iBUCkA=GMumq&C)I<)tCW=@L$?mgL&@oJ_p%rvAHUruy<~
zu*E^x&-|uMDtOc*Wqi$=yLe7M`|eos?CXQtNoqy1)N^dRjK92VUzmJMZ~2^BuXb#9
z9&Vo44lhq{E=cenXc%)HDw<Rt#B<?1Kr*^>t_Aut!MD!riiJoPn;oMgY9(!KzSj$_
zZKXx}kBDoNC2GJ7zY+)t5Jo9it!uCW8gF9Wh7+aC3}AsTr_5J1r6?zNr{Ztpd{9R>
z)nZnHN7;{EU=EK^W_ipSi0%*}Ao(M!FOR^5|4e^NO|UTAR7=y@TaxD_bPilfjX?jV
z-t|F34D|tIm|J8L#sXhAOtkEVP$%jw%HMe$cJTL-s>5Jd7Td;%Hsodh49_Qw4*qtC
zsJr!c2T>1qKQi>N<Krs(jHvrXSoZ-@&kMQ6J&cYwxP^NV14D^v5F>`ZyET+>eIWw-
z@iCLY>LyG*8;!p|eQzz*PHEpS4Yr||39H3q^zu*XxvHw8w+<=BHgAY>5!trUh56iw
z5iHRqy2Ks1qqQOD>O<?`AdHN(PJ;faxY{q$aI-O@cxK`Fkjf?^%S#25Dw=$<w@J5h
z|H8XbtD%GkH6eDuV;@^kLWtcwqU`#MEfg8tULi}zF`_IbnIRMzj|{>CqO8Zy0spN3
z9B@zqx)RfW_Z}y?M;(wD!B;Vq)rY}GoaDxlOcTdZ+Cg4@aMw?brouClS~@RLbzj(m
zY-$DUnhcwxv1`&>@unGOHWQN`lMWT1OG?AWie9y^CL~LNE|?|5LYN-pVIBw4<2)0F
z?!>LXTwIL6J9bds^b=RU+2O|^Wl(i%3m<TUGwOt&1R$v>6i09jwy30f_I*<2XN~}P
zXNU*K{y?z|j4u59xR8b`M50>3otlM~OQ28hmFfA6`-B$6*pX+AG5H!fzL3+CrHeF7
z?s5C#&Y3X<sAkGh!T)p2md%*}`+mE9?QlmbIbAuvQJ*<(8$9#TE^IBXDzWzpoFE%U
zTlj<$znRGJUqxvRJ!WEwj^Xq5*h$UHHcC65Q4$&c=u9<(mQ5G}DxWSe4k!RCX;-@l
zPCmz49Mr`ONkyFL<89(_@tQ!co`SuaK$3Pomne^;VSkTw@`oq|INduw_|ChtOo${8
zmqNz$gpl8`X9-2Aif~anGSBRhrKY>y3x=lLVP#q93oLqT)fH;gJNO8XX-7Q@8*Dgd
zmzYFiY7VMIwqg^h{;`tI^|0j`t!-*dp&rzTE{-VE^2rziDCdI2Gje1pc$W^K_6ubG
zC&_R^nq@{lMaoRU@xsra{~Pkx((gD8A0L<IsGT=!os4GxB|o-VH}oI{W&T5wUtMww
zV9=WK)IGp&lnXpF=JxK<x<wNB6scl~O6XL^VkK1-VdX4ov_1Ja%yNc9Mt?CorCvq>
zw0V|scO3kJg{y3APfwe#ikD1b^jW>V{&d#T+9SRGry8rxMaS&b6f*9kXcyQSZm!oM
zZf8@{)qO~1r40diOErzeUAk=qC;56X3KfjYBjOYu=_1`kbT^wP%Gq+$Bc%-oQD}%|
zn-OAC^o62-q;=;j$g5TpN*+XWun0#=Nk;6P{=L`KoL?wDn-h#(g<5Fa$1u^+^H2lC
z>GOcr?m;7X$cQIdyeC{I2SP8pWF&7_I7N-B0HeB9;zMj3bDj!InCik|cMbw)`v?z`
z)jFYvj5=+&a{y8@W)urPS)nC8SCwf;isTd>p*78}_QWaG{Eu{N)zGs8J@1ijD7-VM
z&^KI1CcpZd0E076-elTC|2;?i)bq*-veCG?S+x!e3rB!6mS%EHo6I7Xl+)YEy+qMr
zvhfcl|99D6E%5Dh`&u~A`d$0?8ZFR=hjW$$^{V1uJ)brGSB+Q5+)1bRvw7zWj>~MM
zRx|i>bi17L-RuBUqbCiWbOVTwQp#sFWmts-)=v_m2s}qbk)vPkYQ(_j{!VK#1MNe&
zrzL^sFozq$tgE4;W}7v8RKk=~lwWw)h%zV`+7VV74#|)LlnIq}&t^0v!3tcoN0pLl
zz2tmCStU!OOu8SsSuo=Q*L~pi33HkaJc_m^E}#4P{ul2y&r5FjQ(w!`*Bc?V!Rqjv
zWrz7i$Sdd;&%49i6~XMP^Pf_SB1)qA`qwSle|hpF!02b{$zgdu1Ncxeq2<JKwEpgF
z;2w{~8)A99gk3M@XofTB)t0Ng&BQG9ME<?NNw7)@(EZc{D7r6T9~C|2@&+1ph~Dyb
zo9~W|E}(xZc&hIY87^nq(j{gIlkQLOaVtA^haeEnVVscVV>pOf>T=O%H6h`jc#sT3
z)feMjPS%$}XEg~TLLaj)=T)d|YgKx3s>*q`bwY24juUd$*xWdhxZbZ=FIlBjG@72R
zs^Oy#3aZICQp<$W`mR%fnN!PRwxqjcszum*94}NYPhetxT)MzSKb3^=3@qVMJb<_4
z<JZB%zCEof7LWGdV{e3Qf2;ZDfSmAkaY>5MJl7R9#5QPFO+Kv4VAOahwOEz5K%||R
z?8N=;v_$Qzce5Y?{o5#_C#!0t7|c+mM*2tg0pU=%(ruQ8Gxah9Y^8Xd`(di4Q4#K=
zLv8fRp@;5#6ZflXWo8TmPTY`=8_B8c_#^&wn8}NdxHg!qFp#bbl&(r$q!pm`4s3nc
zNfwW`KZb;z`9FQHQRiJ+j-4z-VXxHD5erGNVx>oqwm-ajPnzD<63-IW7T$-FvlNU^
zhwQ=gQ69D*s^yW{jr?U#;hkl=_f}qI{qnOO#dYTV+k~TbkrK{FeTlCrkRmL8x$|#U
z!no(dF^}IKZMJKI4ih7TX7Hra>#Hf%F>r=Bq;R;A?aPP|+l47~$YYR8AH7O;R~j`o
zl#lPT)fpDf8~T`u=NKnJ5mf1R6koqG|BV%nz;gxpt^}2O5;}9T!Hqw*zowBPx%tan
z17@Fi*KV$3k5<&$cwO)|h`R*>dV8t=0h6-c*UotRgNABxH_}kxJwp>_6VX?^D53N5
zAP+j4Da+yAdtIC}6has@1B^x-wWa%K2mBLxlQ&t4CaiY$y=vVF(BD4nH7C)j?0R|m
z1pl<&M<iSAZHpg6*bi;TP8BsTamhArWxD4Vg=B{qauc>gCiqAsh72BvS<UnDj^59m
zjY$8}^C%7tFT^L!Gc%Md3r#bV-+&F@?e+~)KeocjtT!U%{ndCcfK&S%>BjqHg6%<j
zP%CYX|CS1ML#{zI<YJD6&Y(^9FhKUpYx_WQ>(7I`dWD?#n5L<|9UT<C$&Z)_P4J%0
zY>#Ods)fFn8Q*vB)MFmmxA1@(JG+so0!sK+#?=nN|6oW9F*$6ifkls#<qK+hu&uoi
zgNx|h*v`?C_P}Fmlp{re@~4p=%|94!g&_?!8<4)8n}N{&x=<>5Lm%<z7pB`n2Dk1U
zBfiKV)^w_lGY{9n#7LMwrv&N4?Qr?FnsgD{Hc2mo6AEvX+PXL(z>f(}J=QwKv%}UB
z`&jvHU#i{R?9e8IXtTI-p$hFu$ua>K30Vx*2LlR&lCzrX!8%YKyI4Sbh^|HEeZH>C
zMX+&D@cFwSGSyrIU1c<%y06&sB>zFuRD&4ZM2voTNo>eeTOI;&f~pll#01L<O13yG
z0#F$7G%l<UUROgU1LNe<d{S}s@1n91j*wGHRaJBaRS|7ZGwiS6>*hXkvzh!;OEMvT
z!Nh~6E^sH`9B6-(K%%pIhR|da`x!%#AVLur&2i7C{Zk2FJ>MsoNb(%>6fvsa*TMZ-
z6%74xaHfGv;F2$yW9r{y$KXI(^WSznLh@~z7)B72BKAyzWG%7k*`&V%AoFf_^10^^
zQ(D5tEARTg6|2AH60Nm0<;T-Z6(|f8z7BSdnZFWkI*%iU9hX{NGe$H+k6*sDW~*G$
zD6{;)Vwr4fflz+%Cx@W^Kwaq}lHqI<TDMJ4g}UpODz@?I|3&O&3LE4Lk7<fSmW5%>
z!&<WWg0d|Z;X5cccVdsQ;?V0quQf~gYu(h4+fV{TB}jxL0PcbYt)4PLxt=aD;J2@S
zqHnOf1ekW3Dc#o^z14=Z?~7Ny9homR^Vh$a;8IV2wEuzrI@m~;Kyv8>5Kz_6V3W!2
zBwszL)posFW^}$2pK7`S!7q9E7la(SuLnizlc>*o=PtVL3RZHbH^%4%%fr*xgL}b~
zJf5227wxIx98EEC-R8apVz~qHS;3=|ic0o7DLd&ng|DWF=3~cV{?8=}ltVvusfPA(
z8x^H@CD8=0AM-w{+#aTPJhaTOLWtLo8T;{`{G9ww%)Il`)*zw%`|vlo^5}AdsEPxL
zxD#70TXZpS*gc$><FoFV_@0bI7H9LWteEK*mD+E@n&0kKBOR@BauU)o?8<;-5qVeb
ztO#uDlrew@xS*I3^a#!-<_=+UkuqWVdb~tjpRfV@p3Q7ip`Hndm^;UpH%7i%zfxql
zM|O|ouLw21%WZT&L>8zc`J(L9=*TiEDD*{QU2>U$qKjCV#fqk;#=o;A(xisqjnZo!
zCr+eH5C041{R{_U`(_GoSU#kjYgaCMX<Qkd()8CW<@GjhtB$Q&DWNRP8ta)c0f|si
zr|^Gt>>~q%ALSwBZIMb%@5%-d4Noi<ATNesVYsD+R9b<mi&f;8F~|0hixYA1o<io#
zq9oFW(stCMEvlxmF7gXL#789&oYo&%s7mC+s6~mgZ0RW{fRkj;jRcP}L^}^N@h8Os
zcaoF(@-6i#On`3ZS6co3r`K+DLG<?26!-UdLSyWLhP~t4|Kk&)+zXrMpIqf_+q;0q
z?-rL#=y1>~C!8PgDwJFW$u806qcawxa$yGZ3)jde@68KMSwVMY4m80<e!9#TQcX+f
zkEdiyrd&k-#6~`@uo4(E3+h9cWj`i-s9}?wSSE(S$eYh|WO~gGLlun~a$hF)4FCCf
zs%+@veb2|w`LAbV=;Ci2!&xFkRZjYmm;TQff%yEi!e<R6u9V!?58<@GIIdSs<Kb8N
z^-f&*3mu3hiUlh3QrsyKGxmBE^3RtMx(?I?RST;yAQLJ6gM%p`C<ZU9p@rTyX?e`l
zGxo6Vy%t65tL2N}E(;1wNKQMAtJBlGsyGhdaUt)oA&x#xuT9(Oilp7B^q5P)e+l6%
z;p{28PTm;zQzAov6M1Cr^XC~OUqq=;U_|{!Vx<}dF+Lk0@}CN2oibyk{`4jrV5UMX
z40Ri&t(pl-5(!em9Y9s#xirMe1pfkFI!kbQ?%ydQB8Hjzklzr1nNzOM9kOgPk47p9
z&MYK6XhKz;FBwAO)M@p$T+sYfA0rEH#Nz=IcL?lJ!dGb3obcg@21Oi837=KkT#>KW
zUSQ=WU@~-1rJop1R07p9-G!Wlg+fBm4=0GtD`cDF%8)wHT9qQ)$-;9%`5x=q5Ij-9
z6oP9g`4k5o8PTlrL6@jn^mR=PJjJhK9j8vfZbsARbE1~UwK3R%rMZZhb#4WqtTcpH
zIp^?}@>rJ_P3Q95oQ)v<X5DeF`TWu6*UD6>_($ZYNz*45j?_|^#d73)if>t_{v9XS
zzsDR>?dXZV7IjyDwR$a$U}c>}mdiz1ic)<VuJg95+f$za@LKeSTj%sgL>kSjCU{lO
zo7%^IxE4-t=9;-r=4uKq(H<U4^PeG&#tg`hMgyA_zp_tyAbgjI{vEOG=-IL@^cHsd
z*g&iob<NT8_`Fm&H+tmt3HGNs)s1)uNDx9j!6g_Wu}2?kPTB_wRU>Zri&cUpH0J&`
z7(dPhDVA8dPM9H%>5nfGnCyE|jo82j6D`Az7BHi-O+Qv7R~GxP%s`qx4wXprEBwMe
z@tWXU?XcL0=-@=sluaGM%3pQU@8SGDBIQ%SL-ed|8~QI2XE#afwPAm_KQsmilLftg
zTT<S&7DQ9FA@4z!Hox5(sb^l*FJ0VZfm*eliG+%Q6pW3mhBK#vj$uW#-KRt2c!{nl
zz^Li`0a3-vkqsU#dJVSq;-BbhoAhGAtwtcBr_Ni&c|%FFYmBBx(zL`e$h8(=`m_59
zX7pD*#-`WLW)+k(HPLJ0eL(&D#ny)1FV0uuo<39e`SVMvIrjw8p^<WQD0$+ni`k`j
zW;JrBN5h4D@e;Bay)ot()v<@NT0seDbZyL3c40$Fu)fJU?$CD|@&KahhP7993tL1+
z?J}2gJ0m=)%?#I@-bDXCF1OZgf%`9~8o`|3C;#+OoBEPkZ}{Lv)|Ms4_-~xus)ZdI
zHM5QE1EInwAmtNRlE9RDQ{6Ywk^u?}%_p%WJuTXclv3MHlu*m#l^m5!o!OH0UcDfq
zLR5o!c7oE<M}|8tL@i5Bf_mb}5zg8}LYkJJw&IrFy^X3#R2~_P%PbdA>0|}O9HU5q
zM=5p{b4eG4jjGU<l-sx3TfzI}bi*emiu@$1esaowDfAIi;uY<7i{mDj@z{Qk*rMV1
z1Is_^VR%K2K5qksdY}7RkErdj2<ixVoT5%nnCUj1c2((R(_<&8MvJ6X=2X2?GVsZh
zPlAfd4A+pD_QI|9j%ljnsexfT{F67^U`TE@4Na)j4iD)|vo7v)c4Y)_PH8slQTdak
zIL+a0U%kRot?QVm^G^UAR+Ju&aR1ycnxaAQ0vo@j?YgyZ9pw%nx_T7=raXUh!YG>|
z+o5<tAOdD9PJ*W>K|p@PQ5cW!MR|%Jalr9>@po+rt${#Hnovm0gJ^)aj)c^um;O&)
z6sRe^X*|D25T5N(+4z+uri$k@x6V9j3t2XAJ1Wm35SK|5rwxDU2%MGVDUcRspRy*b
zRyB<@-)<0+dywhKR)eUT){f^Sw)bRzljT<lmGz&SuwZLM7Qx^^P;~i=b=o>OGJPU%
zzjZ%3%5TR6e+NE_?3kq&Ohq;X4(EF}CN>h2O*Wuj>ro&SE%j8!h2h0KqT7#I=2y@~
z7T#Q$Ti}*~cd2PF?T&wb6`b1IOLa!;kfn=2N$YR6ev){E%Hv#`S<_BB2|op8{RrTs
z&DRDN8(<lKagxO@XVH#+_Ty3>cey3aO`LDY{v|(-5-nlOZ-3%JL<;ZBP(V6B3r(Hz
zl9}<<`^|Ur%?JC<muTk&_V5iet2|(+Jfy`bU$(<LkEm#;jE5E+Urr>uE0&F6pYGFT
zJ={!-6yk_2nR%|42dR>0V!y^W;~1{ArF6gU<%EC+*=$(vgX(B!R53<*+{8c{MKOU?
z0&U2~lztrL0K}Iot@gY1?~gS>0l%EW77b;U4HgFM3Z4WsjF8k-8x&{0fq|hlFwGKs
zwb^7BGvvWr7M>k9Kl#U#3Ts|jymba<)u&r#N>GU2TmSC@r2AKx^%y;@Jt8(MY5$+q
zXD<{S^aS39puJ!%`ny1;n!U+|YaNblR>nGS$Pcv9v3S>-uRHr985cx#8YEv$?XSx$
zTks@bOB)E%Z(tvlY<TNFtgw%mQ4J&Yfb{+!y)HX690O`HsMda0-c)hVer8V$ti(dX
zA-uR9CdPNer=7?9`wvh%^|=q1e<|!hQSwiok&q_J4nA002gi{DtEhXz$`ChasaEai
zGnt+TagX;QoPgl`i_>5e&FRoSgI+YZn#HdgHgxwtgm0ugW^rGt0Uy8UT%3RPm2v7O
zzH3v%-0g|_J(nE)>=6Ob(^(kcK9~YzfDt^I7KY(A6}mkKoQTUJExDH4HMigbp?m$g
z*^TXEN#HUW5~1%*`l6NT-7~-Y`l%i{c<Iu^&j60TvItb4ut(3A9sb`lf|$<^Xm^_F
zP>!t!eKWlDt81T?0xihGQ7YtMUl1p+DMXw)X2?vLQE1+#q5$ACM$ZQLU=Q#cb&MwJ
z8~qR|a=)~7EkH6|1#@fM`ZK&f%I#0~k8?Rvl1?u1`{kJ<ijRlAE6ITd?n0G}yB2hS
zh1jKRh8~(Q_97KlDT9$H6-tn`Rtqk-N(^kh9mAnQRkO-rhBag^#3E|W)&fegaZj^C
zU-Q+ARjR>|L|zKChM5LkmWf;LVFcN!s8)jnlS)6&Rx?1K4GOok7H7AYp5jS+PjUk8
z!VjxpPE~xVrY%J2)Jz0CSK6UA{~Toa{$D!jZZR!np1qoqM_@G|8MsF!&%FAEMV+ra
zjXZ6WD$&AKkcw32N>R&jAO#r(Ay>Kkp;k&};69kX%Ub><@K?k|%!~ziq6Go9DomUw
zJLb|ft|~r8HW_XJ4IvRB$S?2?=H4La6nl#{W1OWElt_)uIhyBB^UAmPlWyPSe?SG;
z`pP`ZXT63?nep1Z0L&$R!=`5XJQK#1!&Q1|f9M8q(?J+}b0tHpOeO3$vFP@8n9wE4
z#U%qpH5$tZF8^x5z0_u-)YUlu-a#Z__#h&B40wCE0YhGdn3?WXD*Gi}0ks(Qd>0Yf
zxY*#uXKiV23i>_Pfo=*CRt^UBT`g?~2K67gQg#c$XldGI*e{b4H6T{(ZziYVZX#Yl
z^v_oWC<GLR|9<j`KIyj;&qP!BE0A*$B*K&{ge*_Mlmn0~TyNQk7dPC83aIbWvM;Ew
z%JWXI-Xjl(1l}nUtqiW>%D`Y8DyRenJom(tm7&DOM*JA7exA*M-r*jccqy5Po{62(
zYO)wZiy#UL1PeU%LT~hx_kdaS)F|ikjr?)V7u(|N1_AP!-l@}*5HzDEyIxbIGuvHx
z3pA*aRi9{)9nZ#V`t-C#4Aqq7dGu7I=%ZWuruITc1JfXJ$-OpKFd7-7D4-dvgp*52
zh>uHaHM)dJ94$N^db;40Th#~61jNN+9s?`5kLWdO#F1#|1UD<|v^Vsr;mFL4T=BI_
zN3RZqvutFVk_(ZC&R$l$Pzjp^Xb)sWkJiY$#1QWlI4dhDfzEjT1aesIn|O|3w?aAz
zTo~vrKumoyJ~glbnN*a=>+|HmhKW+=@B+3^w#qy6Rr(Gp+oMl3am*{3)P2wpn(4;U
zGX#ez<L7ZPkw^hK9bIbRn^5q`$^~%LeY41Q8&0Vwr@Xs^&W2>K<S6opti<Ojy~wlN
zyn?N^p&~|?Fih$tlKzlYCwe6TM=5-z9n;h4)Mk&U<#d+kxZP?O#)mZ`tTTHi{M>;K
zkM|V+<PIq=p4}CYtIEVOxA|$roY#&~NN^*v>UK6Wv#QGW*hPPm+9?tKqORa{H;tp_
z@dJ_gc~<yBn4sA1@7-Q~Z^Mnocojs>Gg1l*a+v;!7)aA*PMRY^)6>&v$~8b2GI9A{
z$>=0-nwsGj!E2h_Fk!ltdRv0~bPZ0tZIwH~CE?@}=lXdm+c)vla3Sr@5r?NGDZXET
zLY_k{`w&}2-We*1InYqGHBCzsFokgW^b{6BoS47~!_1`!!#U&M_xXKyA*4>teCRF3
z>q-FOn`&1<{PoG$ZoGB&#&BTDpg`|XuGJQqnU*3std{KjNX9H0R{Yh@*1y&34w5iV
zaCe;+1B(}LhXV7f?3TdebOMs|h+kp#XjR3LmpEW?|BWs8LZpWL7r$Kk{XvA8c64?b
zJ#`-mU2`%huhA1rvvMP!7(h4N4>#xJ$e@U(vGBQk5dL;jAd%_+M=jf5U!<beGBcu6
zYZ2=iPIT+gr1h|@J7+;uhH0NB_Y1>MzLHWzKB2kNy&n(XXS2;h`>}%p)Kyz%)(jlY
z!+*D;nycOB^nQ$j+@)ZKOp572*K~=APElD+_NtXdf-26ZC>glMmY0VnLl?H-tz}k9
zlTFybS*nAI$NHym!ctbJB3+T`o{PW7R<`7!;)5q;=vu)|Q&!{NBbJOkb!17n7o$8S
zN{IglcgSO~hSb|^r^DF3j(rFHO$vC?HN{Qrf=TSF=ho@IhfNEyx5+)OY9sj5;58z`
z8CaMH4q|9;%jVsR|J*=_VY%(C5}0R|N7*m`tXYD=)+keYKYQ7p6!sB1gti3Q;-hBU
zXdm_FS^84Tnp-hh0_xgC7dZ!PLiya`>Pcz2HV~`3N!R7(^?gS^M_@w|`Y-RW_L{t}
zt&BTk7@lp`mW(degqxM&`Wx)@>R!wJFIu|Low?*e_IW2p{aYQ$oE#%($L6gaxeR;7
zh$lP6{946V@@6^OYhCV7T_BR0{;TeFcN6i{rRxLI7K*%@vCBy4Ylb9p&ydhV$Dxaq
z<uUoW^)lK8>6{bqC#DRt9qN3c+fVH9_s-sfZsQ&4LUv|5^tnNbE?u~UBGHfN9QSvq
z3hb3w?ikCKbxzAm_E)-$v3-TsQt}NgXhE(b%X=pw+M&hf6GfJ^A@ntAp*`)p?5dbf
zH%;1zeT{4$)7Qkl=)#F(|LJ1daQ8|}&%}x35uciYV95-PqV&HCw5=`I=qbvdj{LUX
zA3}bj`sQyo^Om3HDw|gXv=Pyh4n^HS;X(Q)+}|4s<i4VY>JrQ^t2P*CM#=7V@Knl`
zSC5hX2>PXX$6Hk!!G{&|`Bp+D9~VqjU1I>_TFSHcjVS!~sFuec=Uuqm@S3H0Y}`04
zytplj_iA48f)s>$FxZn@-gk$(k7Y=Ve+QtK@U){(Ua+*I8|kr-SD9Gav4JpmFGXH<
z0zVu2z}Iv#0%08N1e%}E`oP-?VCqdiA0I`q73DXatbS}<hQGrGyZb1f3WY=vM|+<M
zlEYiGAZ@X6GQ&n>wK{{OKUd!HsKU;a#%7RY&EMyVQr9;Jgo9{JqjB_y$rHN&$h0??
zFJ9g|vPy2b^t=S9Lw5O#!@Y^fnj`6qEwJ_cogLxG5an>2#K>$^8HN~c6*1J3Z;tD2
zmb~OQGt2Pg<P!SvQaX3#?kn^<974z3{Votmr!aqe`arydR3f~pf0qU!#@F7bXfITw
z&#u=V#iTH&asp@JlO*_DOLN#4x&wFXn;r+?73lGO6o#sxChEyL8}@p%J_{_Qzq_sx
zNdEf0Ad1-~X~wqW%h&pd+>$0@^>ezQv<wVIkyyvDklKuY?5redI0|>I1L5E)+&m@v
zwCbYDjeqYZm$NSLG{in{4{m6=c^-$rw(?wV{ZKSV-Ccl{?R44)-pF}s%HN|;3Tv7c
z0Wg?Q+_qfWnv)6SX&*om#P`%n?#P$=46#WK@fo=1UX7er?JZV$wZCu=-nw+J;>rIZ
z8)793)e@Bs27$qw_S@TyN)X}=%TU0#*_^KzEg%_e8agirJrK@DqN#?gadjS17N*tw
zVYy!N3@ol+z~KZZqBHT)t^&@gRgx8V$0N=rk0U5ZY3huzV0}Q9Ss<pIuhh1H>34#Y
zkne|kZ2%eS)sI4V(4(;+C#hiIC8x*{W6`d;;+ZdHGuG^Ziao)vt57V=nnh-;1-S@m
z4i4V~PsMHy=YY}S+btfb^v|x4&?!})&R7igc-pY-pvaua_t=gk_Qobb91+GS6?c?1
zN@vlSS3qH*kBS!wSut-k5AZqP5@wR9oEv0RdH-MdWX(Y}OLjr=1w82y24?Sm%<$Fa
zZWEm^F*fw~6bw6#tehG1#Nl-<Tb57mN_ojjV{XBm`+M=6+pTN3P;d>Mi)ESpF*2c$
zwLniw$Jn*4&s;EU!A&EV$7oFbcxB75@JS|%xv~Agh{XUoo!%!bhI}1E1lp)TjG(pk
z#<2eOHKu;T7Ax3+PpEv?-=90?VV3US3IbmhW*Dysz6W(=gQbM9$K+r48m5BKIa}Sy
z_e=~G*2eYa*`KIZ7P5K`K+(n}f;r#5Y9GUIV#2$%6EoWWv1(iMe^D*5F5myp1(G);
zP7BDe7bT2A&7Yt1u0!Px*ZxG0B9edT{htiyP2ztD!Nv}vs3@e(T$NAf6g4g}_c}(%
zWgV^Ro4a`r!XBR&zyN#Wpz}4LRPEfhs;KajxZ>S%-1Yq}%G>#$z13g&f=a8;X~1;o
zzwxHgVs=T%_RY&$a_6mR3Fda7LAk`SR{LX~<y86Du4z`sNJW&6f4o;1qzgWoN9cAH
zB`=N;*-_VDxKUex=MnKG-mk5kye?mYPU$|=&Uc~7qcv(D;p=>R;fpVNHssyUnA4)o
zQ~QSwchr~#MFyL9L-^w98A?6lfxaRyb{=mwQb(Bu`yV02!f=0;6&`nG5PeVuR1%Eq
zWSqSVHvsb5<s;if9-DF0rWX6iW?N{O9Il_fm)Q=C)L)2!B*-WQNw(<veNj^_<VBnW
zQBm_S!XrD2Q>Mkbt=!~Y_joz##~#QTX+kuF*_EeI*^1U-!egc}ZjxP5DkT6z=w7jz
zJXIw&r>jC@qM?aeCtX<nl}1F4pMDr4uD&PWlB_zw(rVVaN{U`+qlwJ4Q^;Nmi;leK
zC<fbo6=mXKb9!#m@psPt?e7FqvTUMi3Wl8sDsSO}+ee#GV6PgEs6C&}fxX1v6<gTn
z12%kL8_h(m5IZ{fgQE^0yl4NBS*I}8(D_+Ge0BD64S;$I0(Zc4CbgFGp&M^bCl#&9
z)2ngecT;mU8r5eG?HN~lT%oAobvf5N7k-P99Qn)9#E&~xWbpogV!@fuM-09evut}^
zkAFrj5$o9+;z|XOBXVbc9t!>&F<XMX885~_uq_J948PfWg+6%7df_JL_s;NkBCClR
zIU{_Lq9yP4@O8_=E+>v-%N+*)IHN!9EQE=aUIDuV4p%4kKX6Ug4fo^u;VRo9k(iF{
zh}-!1wS(qq`sXtBGeEWJ1&D^gv6WK6U*ueSmPLEh^6wVa8!2Y^JP-9Otn<A99NB!a
z`uB4Z&&iFRQ;0mIbli+Q=-7$ay<TVHC%l1%%UODFI(ABg1;@`H8ZPER?Rup(gx3Tq
z*Y}&03F&s9mA1r3hs7(WeWHG398IMlN-KI+t*%hwGBV!}a(d3hV~f)bHQOOx0SG;^
zEdU(jtxU7K6x+Yd5|SI4ED@igo6^jPO)Zf|Feg>o(1sBdWiNd-r8&lWp@=na(5#<Z
zzb@pjD2YTHI*HCsK8?SWj|WXdM1$50!(q|6?yWzKezV=)PXSR-KXUpG(!Y*^-9;8h
zS*hMDkP$9HHKe5jEhrC?@}@=aBsR&sv7h$CGL>?~sDN2B2TGAfa#toPgXEtAh_w6?
z<#2--6{`g-T7mJ7@JeQr-FBirQ*kiT=HtEI1KQ-|J$E9uRDyW{q#X?;xrVz8jW)O%
z#i<GzQwa{W4zon*r~Jb6%dU!Yp}TTgi8=va8anI(6Pd1*<qBu##n#WN))Qy4#6j~c
zsSKO<$m}Wv#+;EM_jmU50?L*vOw_{>Z4K{F3Gd0XdMZI7`k8(MLQGOHOkms;L&FXM
z{j`2q5LT=CDj5&e!;8c*_uR5d*W`yCvzFHqwHG0qYxp&jgy62XOZ1({?xW>w#Gt3^
z_LobI0ZIkL9S`5H%e3@kGd=Wf^iLqEBz?{(LLyiH4_=O$cZNl!Hn`^J_Xf--GPp&t
ze^igNXSvjRK~LE?6M3W)1w|3(14;Oz_H{|YMP?-kHU>`$O_Em80~~)A2mOyXQr)-*
zsT-xK3!$iy(-#?|d7H4gt)!IY*Cp;C=+zVT$_pxWK2<ry#$T(;fFyIoL`w0C*D(9$
zl#gmHqW5q=Ki=@JP&dIF)iH<sm;;sP+ILHApk!^$^PJvz)V8~if9WYSRL3|;EUn*`
z9_~-k$*@SS%v`S4^LItdcH9Si`O&K8E@h`YIV&%VSD*Kth2mrtq>M`xY8^5Q{Fq<E
zR2N*TFptr^g%S(s6MS<f3d3yC9mVe*u%EBn*GB&~xtpA(#87PqZF#Yil5~%OA}C#P
zrP8nTFS>%eNSkg<=5;&e7}KjXIJuHjsM1#2sQMo2P-BdW)3G#}E_z%xE&7oQ@!YrM
zPs7a|!&-1WjW=%_T3iqagg)V&;ubt7Z$CdYuT+#h(NvkAj_W>f1C&=ixCSj&iH3i1
z6=u*cGYhZ(DNi_QLhPj5c>-^jQCUxV6rIqkAo}Z!^6D!*WHQF6SF&AAVa`<!%Kn%X
zl`}^I&S&5rEP12C^%Y{dbbThtj>f7D#g~HBu2b&GVqXiyYP`^Vq<pya1@p0v^ec7H
zR{>ysTp<O*tdJ3z@|H~}{@roi(f6uX_+LNi@@er@iz2BIn@#Xqb223;wKI_DY4aJ-
z<wy{>`sW!^=ey|VoQJVg{G9BvwXUYf1NLjvRE~3yZJfmBhs+Srqny;+)DIxp64P<c
zqKs(&;0+nvENGrr6ThyibUyg1dW?c->Do$qM=j5Ny0QcHbc$gNhEyHN-Bd?Vs0|dT
zhHTR%Tao;OS*STPRjWlXW&_uLLAdB)0g=axoTpnqo~<hl`w|3+_W4pCM8kz_L$dKN
z&%_h5Et@jv#{kT~p(_7tb9G_<6j<5A?fj`PYJ({AqpLu-i(41XX3ZW8ERKOmFyyBJ
z2NyFhil`w-Jw!@6hsS@kK6`3~g|tft$rBHChd&cUSr(GKJdEB;xA#`fPG?1U)rh!;
zc(8QgRXFLRd(Kr%0?h5TRq|@~m1JY>dacuZ5e&l-^C%zRO@dXAXPv_%<HilX@>6hW
zbBsv(Mps8U=@=`;*H`*y$w{pvrw9%gA^=6<&tF>jy>jvWh|B0MQIqeK&66%~&%&HU
z*lC%%`pe43Bgkj~mRs8G#Avv6uo*|vP$D$+$nSTReBojKNeezFjKrtFfwbbB26W91
zg+^$hQ+PEX`osdOhm8BIw}J7dax=}Ws4pvTl=%vOpWyp<<WE`bTZ8PC2bBl2!&kHb
z>|+&X)bLhT*9xZY`TbGx88h_4J)45y0o$*1HIu-<8;}!K88&Q6EE`|VZ0m;JkZ-*m
zbhAP2^*p9vo8&!(OF1~uimEwt6OOeHf+H2BD(%3oOLNy$0~hTu%8$VQPt)>0KSX@7
z+5K<nXahn$JX+@3hloFgOzPOqFe%Zy%ajn??ujC~J%YX8ykNsQ{Q4hb?x$f4gewS~
z(LP`|&!4Hf9WRt1GcX{A8mo0h{^5;SPcj3;s=LAc|L}<%BKMk(1G-0a0+kfB_>p8$
zdL)v!NOyXOj|UP@NZ?u8p#5%QgHy$KhP$mLtU{6ngbdwvYrm1ZmcM7VJFbVTEZqZZ
z`dyy!I|A~n-iOw<`DLHRH~_?4SHxxr#Vvt;zsnf8D9fS?>kn#rKp$`>zXM<W-2b{~
z`}n&D_x*ORswmfX(Kf+?GE`GQ6`_f@{9Ha{>m(Di{d4o)LVPR`@0D=4u^jAM(V|N_
zW>30IJNqZ@-hO6>f`id9r0_ydTLMB$`Zq(w4AI@wVc@N+<l6<A*bX#(xUs=Dup^m&
z?g`E)H|_W_H<$sL7iWZjO~S|@#{J4p-*h-68A2`KXxhye)XG+X>e5MC@2-BL2xV7!
zIAc_vt{ko1V^e>ri^K*rN*9eK8HuL8`(~eRFSk{2H-gC>G`#m2cA`i1F#IGiA;x6P
z@5{^%_mTbA@@}fpd$z>zTjqFEZB~9R!z1Otr}w)THf`)M0$U*w3v*D9xKjhw$Lp*0
z0)}N~hF4(H1;rx$BX-J{OlTz@Lm7!=1iy)NgdJAm6;~0vJbY<~j@=nt`z5zWBrhH}
zdr>xHSRGy9IT=;Padtwf?s=b8GET@CZ2Ur(2#>f0O%AHAT5CQcCQgvGKpN6%>Ruxz
z5=+(=D%J&#Xtf`rJv95REfOCZgFFR@T8@R?CQ_b`W|$>8Vi5dI>)ta?{UG?5TRVEw
zH&b1$^(OkUx&a&6SNfq4U|JzY20IVz@QuB85~Jq1IFL3V*Ac}PQX?Hkr}6Radc-<I
z`|I%q6GW=|*ophShv?0lguVXwFYJv@8Nsx!usQhMg}l<%*D9mZdg~p~+nWXTEjC!R
zY*mPmoAtFO=d`4oEDS}-=bVFgLRU}Z)8&j~cQo9LI%Ao)8x2X^q*@X)N_YH!HRL3a
z*#EUp49;0^**Q;o4-6-lXr!hpkE9C;PQ#^G3^QW9-49-IUB2<vv--RXpGX}%7u_P*
z+4{&P-44tyddu4BE8z&9OJ6u<7*5qe8wi+luyWZAAY0T;A7P_8x5yT99qE<avZ0b9
z9h~a3?TX{w&%-yxVaY_^WiN})B{~~fy5OPh{q87~z>SzgbpX9Dlt#4*-W;tZc*(u3
zJe(uK0EcA~@6O3@X`=*W5RqF@;S|QRfq{ed!}bPx!I>pu3NVTr@gF(_$oa|T9u!Oo
z2|Aw0Auo4|mU9CbLRW$W02>ZaB`40vW*}DrH4@zMlbVsFG;*^&G7`V`xa!7>IwgWK
zcPpJ&dBtM~eWed<Tiw7ju+}CSWM)>ht=xGB&>y*R-9*FS#9+$M-zFFFfoHgxohyPv
zrA{^DvY^guzp5uklO9Xkyc&Kk8NGo0w;_Cp{zXLiuDz~lx=yF!q{-oqqnBjH&A>Gy
zqXC=Oh1Rw^z$F)V@RRY~C2^Ql>rrhOiy7259&-xbsqfu3x_GkJGe!Q8EfExu$xDT@
zhi&2*3Ik?F+Hc@|P|r!<PR_XNv7gW-Kc6x3kI3>wnT=*67x*aK$bf3m>4GC9+?t1(
zV{VEN3cv4hf#B>jZ~Ii9z~y-EZ07sxL(lUI<81F;kI$=WsuBG_Gl}&p`*;O<0>YYZ
z2`A3fJ<G<&KZyFh#^S4`9S?SHDbCoun-hCk(urSGujjVIs`!>*J*6*S%R3z+@t;>>
zq3h6;spyRy#-nv&S8VaWE6c$H1)r_%F@j5}9@tqrah!Z=If^l}x8S~<g5^=QCz25a
zjL&4|GlDGnF?l$KN|-XVT{smq`ojGOY*k;8Cc?*)w|m91^qk;Gn8iX7Aez>96S(*w
z=S7za(XQHM;0MQ#!~EPgAzxgnJS&U~y(K^buD&TN_9D>b@ns|$u2Wrr2DFEZ3Cv`-
zRiD5zx_8j8V^4L%*InKFfs~J{ox27K0tee#vxIRXe*>(%veVSJyhs|J2L__*aF&IJ
zPQNvLvX9=ajMmcKxI3Ia+X=$6glFPU(yEvpWT<p}>S^1nlbJ*tq%^C_tNafl5o@v5
zvDCsHb|o-Bu%Wx;;D$?7@8rp}s=dT$c4U)q<1$$G@i8|1Ka5ie3}fI)CW<DZHH%{N
zGY$g{+P(67`<M=|4HC#^{JF1B2hwit4I!2cs;3l5MX-gtWya`_Q1V>**f6!1i4`nq
zN6h}(omQOwrt=x8@$4C~i6aly)F`q2loNMk$bRs)AQ*J|OxOA68Um#qoXs-*b>Ke3
zy->^-A&bk>Il&=i1TUJu6J?bIuV-bJbyb3G-*qEP^<xugUx+F}Urc};AVElUo(tXO
z4qaws=k$h7I28}MY-%`KV>EfC+GzF2C=kiVea`vfQOiMR!;I6Qz*7X_MMC%IDid_j
zNXf-*VVcFje#Lw^P~I~oSMJHG@JB4het*?`Yq{^Iv+(QVf4%p7rF=XYC3*5r84w5<
zAwyHf1D<xiAA2C=jH6Tx>(@Y-(rns)#>I^=;#py}hkO4_2e%ALHUN*de2L+I>Le5Y
z)<zUJB2XI<)k!{b)0Qk=e~FfwqYh9xvl*uZCOAZXFI8Q|-J#YzDy~Us&<3$nrw+@g
z(UQpQ6s%3=bjrYh)zr}`9t$dI+oc~RS;_g*Xg;j8(RO0&?)!KLI|>%VEkDeS6pfK_
zwZ8qNFqUAIBxNfp1GADMuHrZexNlg))lts+f>)U^X7zH_+=&K8+K|4n<IT+<2yWVO
zS3vjC$|fYLwjbf(6K@;q8m9%~%SI5K4P|lR)ZQHQBdv9$wKkx<QNw4NM<J3zo-uYK
zx4u%T%NyI9{40-UY|Xoicq(LVFNPs=<9*fNCl6n0K_jN}{iDR`UkboYM25gXu)WJu
z?Zb{2dyDt#27xg<ZwSFd+XeQTv|sJ|ad0-b9_q`P!7`0BhLt(4IDP0Us27uq%ea)O
z>X_e^+>P>bz2BcG1I{Fgz*$mIN#giHt#v3FonR>e3c0jk&F2TY1t%;Kx&`W03X^#A
z7#K{)KOAb(+%Nbmk`-mjIOWF;p2b`6Splr;wMNG8g5@Oir>bh5b?34uGy&MD?2L%@
z{^|_LRR>Uv%13F=?$8WNg&SZRGdmzY&*GdU=*A&-x^%Xy+`go&$Mj8Ia|g5lhf#}6
zF+rXiA-MN$nK}_`g!k?OgBUJeXD_jP9@iM)rI`qgfAjLd%i;>l{M)gH6)5&(>P{Sx
zKSlqAaunE|<p;#Vzv21cDY1%<C{<|<3pgo$6)it1LBf?YCsEFyVQl$jpq76y3QGv*
zfvLu+Gwx9w+QXNrM2;^>m(K-!x$Eq=+_7awT;PlohmV6QSFP20_@*JHN#6{XhC#47
z<I*Ghoy**F3?&c1Nwc@unXkgL;l(hTJ|9V@B^MfdR*BdAQMJS{O#-&GRYB;>(hO(p
zDvleP<2E}S>4|8JXz$>ptk!j3FOS|S98+gd>gqI0U%;>ZDee{%Ca{2?$&AfKQ=Io{
zS{wRR27tAT+mw89+9QF3YO=4WNqIDdWgLhHAl@dRzWpDzzA3npHefThZQFJ-u}^H<
zwr$(CIk9aUGvSGC&CKTeYqxeU_NKe5@B8g~oMvS4_>;F5zsjx%)F;>tfKOKHhskNW
zel-?5EECIGYb?5dIy*^9<@Pd5KdgvfC``|bU6mCVb80j6d{+66gqOMqolE4_bY90I
z*kh#n>w>ohi50H7?cei3R3wobpJ$c*^K^aW-lWEj1k^PFv0w+agVTXl39kN#JtqC{
zC0@3l3Cnj@&b<rdTAv`pUY;T3c4*U=PLbcOTurskgu1h>&V!*K{31qKvrXAUU!lS?
zzsKcwVYn!l5S-fK2jy4uJDS*swWirYNM67N=_C3y&$96zE6#A8JF(eJOvgF!b%iW9
zUAuzaCtBoZIskj#VJI(s;tOec^=Q}B2_=0hVu463I=RdJs*2ZgJ`@g_(t4!c_#)2r
zwgoI$nsKd=<CuldR(fpx4B0W|ON`@R<ViVSK`wKGcpIh8@Ra2XSby&C<P*mQdDV)g
zj(j*8+RS`88l;Z61}V8jjs!N~vmIu(hnd>5Mx6F9h1S97_eV*)Ep0y&$NS<R)AlI{
zukoU7O&lSalz&^l7U|ZWT0-<pQ7bMlWenz?qUpZ6!S{Tx4YPGd!%{=FyR8%#9I>wi
zhAqE+BKI<4+!BNIVv?T~cM$pb-jQ^cx2%Uc_CV~#Sl@&m_`KEgA$}Tl3gO(`-DhPJ
zHX%pyKVko!Ja7_pd)h=@Ohmor-qlw!B}RHhff=Jh$vbzJjK(xFv8HNwyD?701NEr3
z_}=868>EDW83L4}wu2)$R1EwIagxZN8sphwpm;TNZgp|s0-v`dUj(y(-UPOXGn#}(
z`7pgi+47B+Mx4Lu-L?*H(Xn13Wjv?32$t`<mZ$BYMB7I6RgZDwt5k%{V@ah{(}Rqu
z3@{EgaG9s+HWm|_Z%kd+W{G=t6=|b>pX@byab12gd#=K}A2^Nr855dhcTHSxBgfQT
z_$aOdoak@w=IuIy@v?<2&qv=|>v3xHh&Ak?rm5QB`{l;Q3v38iz8*$698QcIzXQqJ
zPN+YfMpo2>pCFHnr<|E$^R5R?@-2ELbc*DcxA|yh!zH+C)L>K9*1iK)F!=4Ixsiu%
zoPC_RbSY0-Ya^q;QpFVMMgBAl*JT)hu|TF+IIf)3?HgjE8rn?L$ES*cKpLG{=&)u&
zm^0E64cUB|IpfylOixjeVJd#I{7R*XVy#T|ct<vCJ?jZH6>!tjod%8=Vv`&9j(M|K
zQZ&>$u{r340?r)Wx2w*sfr++eg4x&|+8G)@rc@Wqjzr>@Che(RaM5dp*TT(5-qx?&
z&*vZd!sgzczP^>3g^f+q8w3dXJp25(kHBpGV`ZYiuB<-y()e!QQh>L@ALlyBu>G4s
z)NPzXQ3Tly{Usw(Z2v?ufera)T-Y5cj-dx14&zhw-=(l}R29r1t&xyM7IwveA_)Bz
z98a3y7G}J5h7*&+3$AvC!mNS?|C{8{NHk$<FDU5{0;O>BIw+L=X5DR_=b-~(7#F^F
zaTEg0R{aY$c}_Hw88-j{4%JXb#ksLC@1sDY6bcc($QfzqyX=%}x|qc*dG-VOu!Nb#
za$GvRzddVSJLxWip{p|9%t#7JS^KW$uJ+D#zVBpF1cJrOOIy~^cI!T=a%fjBa|q%I
zQY8`h8U5^J;rH!sMT+#PbEu@d*};(Kr3ika9kD3hD0I+MEE89&12KYe5Gf={Y1Ul|
zIW$Qt2YB_vt_UF|<N;5MZfKL3TKhL7jaCpkM>ixJlY|+w{hu5S{B02>{sot^hj2dC
zU(Cqa*l`mngKZ6Jxz*4I_fc^?;CH1|N3#`M;!8(}`10PSz)CPN_`Ft@<`8i!GG`ae
zXyspc@sr0>VZX&Bu%79-%d}kl3$4UQM%nG{tP3K*cc?cx^MxN_9ytb>(R9OiJDi$c
zTC8_I=02$T>xVv)S12GI9x#Cbb^LRzI{uHe)LwG(F1zi{C&r#L@gSkyjK6-T62?2T
zi8kX*Ne9fY=C;cr>-2^m;BrZ7ck~fO+q2slfC+od#d<pcutxB&%8#N8lLn4+dE(`q
zD{mU)?d;FI(lqzV)4lU(%7CoH)o@k~T0jOcyTDdwlPx-eQFWzxK`SWQRC^V;y6)#P
znK6{7QxJBhUV#3AXl{ZKejqH!<bIw$KdMb$ESr}P632x3+&wXDJY3;qMdkw?AvS)_
zf%#5I)<FSeO+zd-6CgFgu&g{=aRd8f9<`TbRpTQw49rwmHcLyn&mt#^C_34zS`cxh
zK|mN{PtWz$#KoeEe~8us6Yr0bkLzfG7C7YJ-4MOv^N3=Mx7lpfgZ{4F)VIi9<?t!o
zs}n4u>TYK=2aJ|K^axCLlplGj-DfIuq<sWX|I+5{&phF8v}<H@S#`LViObaD?<4xf
z&%LVHDAmYA=Og%0oqprf&huHfy`-N@6>RFgO14>&5z2Uxv*{^{*i#_!C+K0(^J#7S
z>4ABG;nU{5ENFWcf<TkvL*I-HC3%w6+iFa~jf1vYF@T=xgdJ8x@GmN096cpQ^b%{U
z@ShOn(y1AcvuJpFKGW8So~YK(yp$tb0Y$PqfyL)BSLFoX3HU%-MY)d1%Zr!lMo|kO
zJl{V4oIcG#q2gR+vM-JrDojbM*C(L2D5(lD^G?IZ8e&4EX$PAa8g+4>6?O25z<07>
zs9o-@yDfig{%v+?QMYEHbHLao&sN+^nHicPp%F$cdj$X2IBv$!97<0CjK#yjEX!(3
z3zEHNSv34P!k|~nzY?1nFCm|9kP*~musKR1qmn{V?fCp7OQD=WmcO-A5TY*}6*o8=
z^4^g~vx_ZXOuQJpO08hMf^urnQ3iDbmT)ePLk2$d=8S|JS-)rD26cEHbQoOAjgG>v
z(`14sPo9Wd%L+fsYIZQ=7X506bfV!TJYfbbm&Ni_Zm#oI$JQ+OZ^p5Jbc$nOaG$IG
zeD$`m93TDssE*!;^s!$rmiFJ|rp1K^+#~@IriKIu5lx;A&g;rdnxr1q3K@)Knel}g
z!)eF)BZ?DdaM6LG-cbY{s`K|BwmH^(^E0)jhDNF%yo#~^wB50*ctd3<B=5aPM|yve
z!lm*|DE&FvU8LHJ9dP8eGdmSQYtFn7>ewJVWsU{?=jQ%26LKwIv9<8g7AQ26jkm1L
z+s@7l|KR!dTGQqD69-vENXC2oh~PdBZ8JdYfFuv&mC>WrV$jJ+lU#+D+LYsDA8$cP
zmIMUnt{ErTy1|3`={?7i0O*M>B7+gU_emA)08%1H`qNn;`t6lW;|DOX5Dqry{uaFe
zY}SMP?Ha{g)d%s@7>+vwQ9J`M^sj!u(JO3xg$6sd3g(%(#3%=LaFhigfz%P<8(-O6
zgmyfsG<eWLB74R?AJLQ_(x?x~i9Ix9n!H4TG-j1k6RQyGxtJ#|yZodu23uy867%im
zNeKWGc;Dg(x$_lQBMA~9Dxv8bOP+MuM@jl@+Fg)RMhn6>{FQG2&YaKC!Y#wQk9&qS
zKLjgoMDMQ=M;&%j`2+f#`R;ZM9)xS$l*e4ldE^nBc~OctK7K2e8CR3J%ZQUkI~KT^
z%7dQ5gFPPOl~)-=LuJj|?T06aKr2FPsXAQ?D<yAsu6ENolUR{J7ih|_iF=M?rWm3Y
zg#GZ-HW@T@3+t8kr2o`3mMtOL!E5tA%G8I?Qpoic2e$AR&f+a6bPPo6-!zwpc*+i!
zA4<X<IvGzngBSCvAY&rM)-9D3rj(>`aSqkQTBBsxv0QQE%SpDxKw3Mf2T7RKLlb6Y
z@Om;01rlxGkAEpCUU;ZlBL8qmz+zM@RN5lX9Eta;<*{L>^%IQ+2S+W$+<Y0y$`b+N
z_wr5dPB8Vsins{65UTGqW_dJMsueImzqBB;!V*RFdjMT_copY{7utz{WH!zih3J-k
z#$$64kVx%T$3)-+!J=G`0{Hj4-)Bv_`gO=<MnZ<**O~%+TiJ*;gl)Y+b1DZcnb2=Y
zzX2oV>W%=Yl`c}0Mq7*h?1bRxhVV@|259sRk7mm^yf%ahYOd>4M?7Hxa<XnQGXW?^
zm9~bA@4VIT^}r$e8Y@#t+UO+-->qJT0fJbZMeVUbgp!Pc*`jyAmk+}sx>W(tOaK?*
z!eH_h;6u8H{URz!?iM_5v<DLvzR#Y|Ftl&{BaM1loqWG&HqmR^ZlU!zXqQM}I{wxM
zcP8DWB!fabYbM3cBokgkk_z!<h6g(img(EhglD2)$bi4!22Rj+AF(gObGEZPMQAP^
ztpqlW)%0Jbh8j^1)x|+P`w<S@nUk?YI=oOUiXZB+<zE~#@8W;AtN0%PqgP<FVP<gS
ze_?Usp^}cZf0gD(tl+E@PpAZ##bHHzNxsYI)<tX!uW!7)IrPW-Tua3Iu$|y*G+I_6
z8d+0Uj}l$blH`th2==%XCP#Ix{@~MN*s;giPj^<*_?;Xi6;JPpcV6zGY%DN1!rFS#
z9qA{t(~cYb{Km<(lUN$2cOn$v|G1;Ea9@dG_e%XhktEl(7E0k_>r1A1Um%XM-ExiZ
z?UF+2xx-js&IX`fQuU<;MmLQ;?mB}Y7wlekO`unEKZO-k`N{3X<oQS_9vjO7EcQG>
z%kAxZXnzz#SN|M}#H>SFf=MLM+vkzmF-k?8lpZ$F&vrnVa7U1BBEkc07q~GsG(|!Z
z3q^_S<a+(YtGc$5G>Yu`5w*;?XT4w?WfB%XyxF%uIYNRuQcK=7*I3Q_KteLw^zje%
zb~lVDqBRhVz;Hv}o-&N_yB&qN%&M<Mda{K6)32_a>r-5yYD$4LAatgK>d(VI%renC
z5Br>bLhC+~T%zzRPFK)p1b{KdUh}od+=uI>)6!_CvK{}e0dOXyIdXfLTF7g|2BQtV
zXLs$LE5jO`D$n$rugkBLzpCgBJ%Epoutbh1^wA>9KyJbZso<JhTs&_r&py4;F@-A4
zGCS_?f{ai)EZgIJqom3dAzX?;qSx#>_c_9eb&i0zLUg@7ZIeqs_meShu!z-uXO>Mv
z1S7Li)}qoxj<M<-RhVyZ->J6>q?nkq)eyd;oKCxnIJI;~tc*jY$eJ=~tS#j%jhXsZ
z2)@W_l1*~}9UDZnM|h)$s)n$btEk)v>48u?0pn;tzSm|^F)>d?^}E5Qujp;@=uA8^
zlbWpn>>6<!gnjwaLX@%L<bE+cZkp^19AtZomxamzR3BE4L9D+DwDY$Z<mt9zCNvR&
z3AMSbpAapBYf*g5D#>tRm6%l5OD(_xY}O-CbA8swk~Fo~+BXmH>+#1syA#ST96@Xm
z>|lBbS+vOA8t$_*SI6XSuAQmb^w&<0*T4O~_Sa3<CDF(o$JddzD&J@IUmf<BhyLE#
zzHF#rIfTM`9+WX<wR`W51&?H_(+;+Fnlr*$dc|SRiluTCgRFAm<<26|IRG*n_@yZS
zE-F>))Zq8(jX=yW%gqz_qi_KQEj8y%m-P6hg=iFH29+u+lU&@k7Bns}pa7Ca;_Yr6
zFgM{Uf#cW+*(WLMV9p0#x#5gPNiOY?biYaWgwG~ImSXNShZqfEn`Tr8^%N>syQ-oe
z2fcybLRuQKKrnNP_mY=n9BV^FMcT^ZSygNu+@QMP9nt-r0(%?1c299mD>I=WQQnWJ
zlvhgM(Pqdw;9~ofC9@qf!E*)sZEmHm*Q_Kj5`Z5oeKNg1Qbjh23DwHciJvpXVCO)-
zs+nOi42S9W!j*3E<qZ3qMe3{LE=E$-wf|RROd7D^_$zkg_zAJMgWHAsO~0@ALc`^E
z&H|-jBpmt;#_Vt7VLn9-=#Ix-afD1~nufv~<GzgnO*YTwcX`oBYczk^3R-)2ZNC9P
zVJK-ghtSkjo1yuGPEYEK=j&;zUG(zT+bKl358!cyTHK3_O{n15lbU@GDdG%H#T(U(
zd|1{(Q_9uRh-qwp&U{6}O?lW_?5TFr1$9La0OmKg>dD>;&c8eh&{=SzHAIc;+2mkK
z;u7Dk<`QQ!ekl_S!Is|msfw6iEoc$-wA`mZp4PF$TvAlUiNINK#C&Gr5r?w)_oU^V
zIJI6UUo6)JFUiMBO+NCXMNne#i+WK<7H~ROZsRG_!xLR-d-X|*vu`is<53O()HB<E
zl*+Op5-ZhZ+68=04%s}B`6Q9SLEi{XmpTXzF}8kMFQ(4kD5CbLgDg<Ru_l~62)}~Y
zvClUFy%9c%;G3{<EY4gF9|>QB?&Ze(-bNN@S`Kekf|+Mf1#!PrkgRN<QZ9<;-N{Gg
z$p^u{1>OyPaNlmr&IZ)1ig%d1FOlL*m#HtSD;1;?DJE`lCScujr+K1o!#E?p$#QAN
zXS@#G9}D_f7eS9T(+ok2Ez=A+%?b8c{0r8Zi}0r`;3N7HQEOdg#RLO?^bx4I&JE1!
z7D?@9agJ@c5S6iXQ#m@iZ;nWl{dR`K2i8G@_n;T$>f492lQ|dZQ6;$guvGzqJZ$I|
zUO7VBA_>D?vvo3xF2ib5qcgN^fgHjF5)b?*&di*WtQO4=ys|LXCmdh|4yC*fvhoWG
z&?c%SBZa7V*D*}RhC@)eOPKpCl<u<Y`=V)8>Thy{EEV`sG@ahM7JHV6y+l;BTPz@i
zoH_ppNn^R6ck@Q^s+ak`I$<#=Z<n1A>Awfu?6^{T9Zrhy=sbNsa<i8l$RwzM>&gqK
zxBV>ASG&ode2|pjwa@Tif|Yw~mI>a5Vr+#JuL69v48uvtr*Z%}5^pS)<Yi1Wp^WDb
z(tuW?MbC$<dV3K5o2oUcl~gF1V!siBIP@o0+yE0y9bk5lX(oj|1h#2xq3_*5?@z-q
zqb|D;5`P-y(GataApDF~Q3~Z%OdaN9Es-R$`UBZEMvW?S<u>#(mrWQ1D1<VjBsmAK
z95^ax`7>A827^V!4L=W<2dqqxOhw6vP=3AnQHz$#E}>Vq;id{yXkGCQCt+~torKem
zZfmIEy$zi_Myz(533U|+Hr1J@-4osGzAf-{G~X17)yQjsa|OX`p?g35snHig{PIzb
zHw~_@ZWMSs!prac!#1J%Pg8Zw)<%D*Cy`M13;Q2EvzE1r^pL5ok7i_U98`N_UVH(m
zbS3A8W75ZWT+hE9{tQJ7QcVSA9B5;e3bixPY~6N!cT*T|u67ae1!HOzd?K`#V{Pa|
zq8BY@@tw=8X){)zs0$CX=@uy+7>gF9`aEOs+AJc-002v5|9S^RdA{OLJ7hlU;}VPr
z`FQ`J1WmtWAVQ63Lwi@Ux-nL}(K0R|haYsgZ(KV}JM0vCWaI<6X)a{0>)Kc72zxkR
zx-wbxDEjcN4r_eXUXZ)JJ|h?x{GC_6r|VpgtkQ`kSz^8)W1%)|UuzYT4SH_dK1UuL
zU$+1J#-wo&F3Yugra}g@u!dSEATpVuVnSk=XKnLef%ju>Vzh7582Fkg*UOu+gjn^Y
z5{{60>X{TLAxqw?$2u*Q(cWx0B%>axnfOsM<t3`3%mXU^ayp<W^Tey|{e5;<w7B}e
z`_*|hKsw5g6EhD~>ZJc#B+j<`tfVlvHTM`pnIV7^>j2*wReN=_<L!@*b_id-SovCP
z7F*F}1D*LW;JcgdFs;LgdVbMcN%>@)@=l`Iqlo;?=X)dFAJ)=NYH4!4&5OoM+&H!#
zP^Nlm`HmnRvoN-{#CS!2+FkMI2@O(3oCQ!4CC?UM@K+_km57=(5EtbG@r2T1kxgdd
zpZ1FUinD<Mp^WFoLYIs0pS;!!CM7epROz_G$EZl}9x)6m=LAysum6qTx^VPQ|33gO
zPE%od7Zg@<<p;HtO9ne<S*wekr3)6_YaYi+>#}Jf6?cftsUwtWkl}+k?p3*E=L?Jm
zgfF1dXsE1Y8G4W`-$EcfV9{4(g+gwa;Lo&Jcy=iKmlzJ*bn^M8`Ss!DG(2M}8s5C6
z%J$oke&kI^^|VbCOc4Yi^UYD_yb0lE6-06EsZHxsCBcf$MFiAlKX2$#%9I2)MuLlp
zjiAAsBltbHf^0yHm-;Be7S%6tiIA*R8IB{Ed(JGz4e#DAN`)vUYeP`Fu{_9ea8#Bz
zSA{7uYFKTOUUA8gbi;%TJNj5aENwKZ5|*B6YQ;KZCV@<$$ivmYFzMKY11Oe8X_Yrh
zrl_W}#JOPf@u;SB7a3Z~L4vBr1$j;b9Z3IR`<4r^W^xb@@PuPBe0x2FWa*EaxRb<D
z89aH9#kQHf;5FLs#Ct<5n%d{YkLL;F9?Ux!k6VLP#3}!hywjy6r9j{f->6RFmuQjR
z3>*ZfU${N@7yKDtDuYCzc?scHFK}HYV>Qd2J;O_tFyCwr#e{@ouH_jY)Fot`Q-AH8
zH8|TIDg<u-ibghis9z}W74!FznKrr-71a7`!U%N3*p)HDnytYTeUf{+BJLi?9Q_{A
zCGsXIDjVchkc{S}gB>1GnJt~;TN3C4sAwS~Mhc}PRgv;Ilb;1S<3(#VKzrrr@Qi6W
zB;Qvp{U~<JLG$s9`OUqNOoKBUE5Xq!Q6`W}!7BERygwMhhTA0*$!020szye{uOmI3
zOhsKOzXSH3|AfQ5S(zvLl;>F3zc=aZ>a_bK>yx~A?y?gAxt|e7xe=xxf^ffKXpF=M
zmy}Yu*K?1kAg%^QSY%;W?H%i@GJ%<<sA7OiAO>U=?0UR}AJ|-LUL19($S?T!ei`QD
z&tZc}t1u>%(d=@tuYNyJ-C>&+nN9nbWYGXDO?~9S1tDwfO@AyOe@63KI&)+;wLUDj
z;E<D<h+aiBY-aj!xU=|nmw(|W;T)Lp#ycs6bmufb=3Io52WsxWq{vL3{=-rn`(|+4
zoBv@cn1t8|B72q&*18`FK-5-}^cX6NLtG&B18<~s?$lAugd*Fvls?0lxy<yG7+R+#
z0ocX=!AqgV4$6lF@DLTQ0uetu%Z7*nU2%z<>Z`9SNQX@7yAkV@&p{2K;Tg5rl2)cW
zq(tomiWB`uo13ToH!7JQ6@3dB`?4h(<HG?L;%bJfz9V5r({%b6|F(T_uj~Ah=TjCm
z5nfVLh6*weUf5@!5jny1s*KZivBoVj#8=Q@lAtyd6I>a?T;z0oxQ%kGJBd8>SB5ok
z!m>7Vg8liwzc$<M(tANgdXTQ!MRR~*k2zDY{ys;?hD>}KMlc?{3k=s3j#3hUtB^*C
z3MP%4A?{5Etd&$6;;^QUWs+N|U*G&7@t`Kl^+gQ=Lo{j?!hxoE7sf9NhYc~;nBL9r
zij{hh6gK;)6KQF-pw*ia_(xJBbyvLIw5w2c0$Yiv^qM!1--(_c>h$Bb<Emst{guQe
zKuNWVx+}1s;<dH%18TIn_>z4NzG(_}42!}Lm7SwWhQS1?*xdFBRpCi6x{U$Z)15^S
zX3T$p{_muIGmqasWv{;LTNPL9n-cqM{j{PoPqL_f!oVtWMK?`^E=_!kF@8qyU~j*{
zi^#;Fpk>I9U)~{h>I-FBFQ94~ot5rgA~KK{+c|Rrc4(R-8iPDk{gy{TVO&d9W7XD#
zNgLi!FErkk+_WEb_np4$K8#jl8fm`i>bhflm43>&b1s{K-~3}x!b0+-njV3|;Tcl5
zsQ|@y#a%G|^bA93&hbX78C$p&_Mo#@9E{5H##Q5>GFgFTxCxCI9mZeiL@lb_y>Z~m
zYUu)sBv~XY;6N+(Ch6Gl@4>TKth-7|w|yqs?VClBZ9}mAI8M7?g>gwZ7gtD-*6N+!
ze1WNKub#E7Oe2N?;*y5BhXy_b1BLIVw@8$qxBAvc3IJ{fOH9k?(9YyQz&_)BtFG!r
zUH$J03IZZ4s=)lr!Xl)P1W-P+@QR02+9%jtLCaW^>VDS=JFb=&&ilEMjFCd><sTOk
z35jd_O*P$6cCl^Boa=O=Bg;Rb;Fm&r8JoVzEeEJd;Cvo6+Y=eA;%Z%c9e47WOasn&
zZGxvTdn4LjP<5{ehv6@y&*gG;?B#5OKhGfUa=v??B0Hgir@oG8L?pa(r0LY0KB(8q
zvBY)>_9+3Cwt1T#gH4Xz1iI~GPWwtR(F-()+EzN<zMXetClEV5Ak2JsHjU!UNVz&a
zC^izqKPiU?vmBC11_w*x8AsNdPuY=u)lAbMNgv<IM<)qshLu?C{_*$~TWs7cg<FO*
z{md%t7{pq2*dvEWj%9e7os~POl)@^gYu&oCr6Z!awohcJ%c~b6I@}r+yBdbMB*HN6
z$pNAdvmm=+>+UwQ-baOl=YCs?wsI7<4ocwgSN3nf)U-wdKHq|dQ%MFHQ?G+q%=sCH
z+Vy_0@C=$nBr@jrY`)rIs~T?j3oiOyJTJlRn83zBzfOq2VnRD4QV7sf6w54jLne`M
zzY$5DIfvy}AUvbO`4a#9eFP(z(4?pK2@}5Mef~&S0G+VdGSEE&lL0{Z#lo|Wpbdv5
zD{F-`BHqdo$u4Hv?w;h9Zd+3%fTCM2tGX#O6+LlUv8%vxI|s1tY$sANF-}#&*Y$uo
z|B(<ccyZoc;oE;8Ff)t>PuU#%g{VHKN|UCp=b4AOMia(%J$;d3)DpaExq-q`5SGNc
z(mRqX=O&7w2O^<czAI|2yJj1#G#dhD0y|7u)UBv(pony;=xH-n5}Sd!Gsk5QRTCKT
zJEn1)^VkA>*^r1$ZHcPD+OX9(V|WaMPR<1?V+o6ip>qQbN!#bvaDOM;GKlm`4z8_G
z(Q?nl_GM4cK&6U-<{Ln^c;QJ<1H5sCrwZCZ^hxZaeyZ9>nL%EszOeTRcUR=woYlFn
zq2PuNF@Vl~U_|0dO1iPK%jvTd94jfYW_XMZz0kA`>1Cc(mMqBScp|H45mPbHZx6)C
zxMhCtN=&bR)Vi>qsGtm--bpgcS%6Hzk&J&GA=gMPhr$bXHVG^EAm1e-t5{tJd}cir
z`T8%97`S2ymbonutm{s7JZ~o5K{?%NjpEk{KVKxyCl?bsWvBJaPK%U!zaHP0ClH@S
zj5HDBeT#!72ZNqC9vu1JLd}HitH_XRsbK>6#op}Yapr~+$%iFUka}v1yNp^x_~gEj
zWSz7PnhC~%PJIB-zQHH|2~q_7;BsTR4hH#7T$2m53y1)mHzxo7AOl@A?y<*J_g{Ct
zTq)e}eVCIYVq%U#B*D1<Vpyw|{TJVM*qN+bKoL5XnAS^!FW91?8qSOpSq4mY(R_8^
z#06hAOapZZg5tp&nEjWbu>`|yvi|2?<c#KT)4=aXlzF1hOLnjxF#6n}fSk*e!6i;R
z-#p`3T&fp=NE58Eeg`EYyjekzMMpZoLVihrd1fMZFZ9plK>*b+=4QVvtVzwFNJY3y
zdP{5ero_!)#}B;;Jf{rpyvr<}(a{_tv<+5&G$BQus(Q#K;m?LtT@I>yLKE}w<ew0h
zcz>kj@50hNs|H|hR@WfQ1tG2>ty`jGyT8lRayP_W7cg^bYd<tPY%pH(d-_5i(l+fu
zgR9{&U&;gaIx`#vXEoaLKaPYlu8T~!;JUUZoQOR`O?VY&Ap8Ru`20l=jSnN>=ac<+
zWj`i|1f`G*JrUHbaqYpvI{8|w4{UjUW=Al72Z`<w2%+1pw;1*ts_{RO!+QTSC?KC(
zRXQt?LFp#WMu=iI%kMyn!tyRt5ZWhZs*Ql{o8c{FRp6GG(QO@_)@@XV6ixC<e|r~5
zRr%Qa7Fz^oMaM}28zW&|2(CB05fg&BuCMPUH2i4WVA{0gm9oYDd7IUT4zZ<`4{3v<
zw<DDW`fqBKSib1O<z{WTBI>fY5u|DtE!0?I>b;5KxM{$kPmF1y@Rmri^?y%g!@dxa
zvvxs(7%d%JeV_2*Pr+*bB<f;3pTadn!n-i8TM*(11QV~(_$CXUu<abbhQjbM*cClR
zQ{OTiA!<=GfrbIvFKZ8kNJW@bM#xl4w`AzSQQ`p|A2d8UY30fR^e6wXj0a|i@qcAJ
zZi<}gdG~9p*wdUq`<B6v2i+R*`rH+5jjVUol$N&1*BI3A`aBqRfc|OLr(_VL$vcmc
z{78dsWR9ik%u5ET)Bk{`XA~FivigYlC4AKT6s}&Tt-Rt?MG#AUDzf>=Gj{4D`4B>4
zlfSlf4j4f8uMwQgfq;H27uw)9fATDGS9Y3Kh=F5RCrY?)zZ=x^H9qGAySP=38LkiW
z{y&OY)NeQi@x4CLg*r6^n^9~h+h~4&H@-hjiU<S&Dp6iR{rmgo{V=mI#9Synxl}7a
z{p7=-j6?I((VOT)(9%)35Mmf0l>7AnJmy=V-g@8C9+kl>Oqj8#<iIVw$5Cu$9~Vo{
z&krjuBFIhf&p@q`*W4qFl!<AT2|>q#;)&EXLZevmTf})NtRS0ij#`SBuEdqM)-Ki`
ztuNjfDE*NLK96IG{3Sp!56KkGd>PCb$l&Id^qCXbXb%wglP7bsOco|nuTHZ0O5o~b
zm62)@7*B2h^f&qy!5S|gDYgIdp)V6C3-cjD0&I+C*n0CU@(k^|b1=He&u`9mh(7k~
z9-Q1nRFoDQ=nP=dOWZILAKQpjn1b_9q|G27q{~_AnNAg`%VFLDwAfF>3q{%r%3y)o
zP`2H0SG`mS$tm9Lza`gn8g*oDB_(ADTr0k?omIG@xFTT{@53s|jL%%*Htok%No-+w
zEyHh-U(W4BmmQO%yn(Yg<q$Cte@_in&=kp2V!m#OnP-^6Q$*I;^XPA95C?)5_Qs7>
z+EP0?Kvq|9*nY0mes@=IkG2@f)kNcsG$@^HKnV5I4MKNnMlj7(i&7Ud{mAowdseh`
z5rx*25_=+rtTQA=$mLdf>z+KMI6aaH@O;qj#swW;fXYP_M-)+T{bT{w_4hTuz4Uaw
zRvxOGKIy6uA3x8{iEuu5J=8K~eOy;~wrc+}JK@S|il-`P#U^<ti5M&UQv7C6c$hLm
zbg-Xy*@;rDAv_lc3BlAM|3fD<-%3n<>^{;s$)_e+|MU=<Ba<L~qYNryE~Pb6{-7>-
z>tA?Ucrh=u^P%3LnFyOSde1tfucTMz!cO;tQAp#8yB7@uFvf1EEFvIT;%ck=y~qNj
zU-g!OEiqSUkH(=<?R^b7N>V*EJ*8P|G2Sm7N0gxTE;dc{b~xesZcFL$ipd2it4j--
zOO3OOm#T~I&N^Rd({T}W>hoXgWL+M<Ip{KCd&J4T3#;=XD7HDZfUhX|N3*f2zs>Q@
zZ6Y))VCW}*8j0ZqJ?F;tao`HfU3SQYJmg1)vF<tL33diWaID&at{aw5XTpFHeKC=7
zB*db<lsssehim4bpY@!f6hxXtuX)jJG#AN}?_TyE6Nw0=U)n<8DY>uz(HIO-uKFth
zKG9%ZO3mUGRJcEw18E0%6H~JW5Mcg5J)*H&WtW})tFx{+=V5M4Fbe`Mbiw`n;<a4U
z7d{%MKr4MCNcig!Nh5zqFtYrE`{&f_;jJ!G=eBo}_*HrL!gbr^`;5up4}HQvEjXLD
zM?UaH?9n2B{JtrS*;bccOBag(Yh!=yrBj}0iGs4NUI5*kzWJ1ecZ#UiF2gD`*8^JT
zEk-?eqw&5-bUG)(B{FMP9ZVBlc#+5?=5#9RLZdevf{PJ8wrQ?HNf^uivHZGd?3v@T
zWl}1RF!~lK)MuEwq9J6V!Hm`#7^$t$F=FP(6jd0QvE}SV(7FtmD81P%S$>Fhyh^fv
zDmpDW0xliICq{_J!CovjF>lzw@Yf*32t~nwSMYBN+AwmLB4-F=X$Mm$4+`38@%dI#
zw0pz_7uFE1U6~YfFf-zpJ`UVic?qs%3M2_W$$ZjPpBfV1v<VWftEb;Fzjm`#;fP0P
z9)6ZSj=Rkz>F$n`K9hpwMQn0|hg4&q<&29>U;8VB8@8O3gRLXoXIyG#>(eO0{;2>d
zBrAJ18(!h+Wd}(~RG;b5+MtNBSm%P_t82Kz@Xv{IgafU8mlV-+6rP@dDCxotvvf^M
zbsIIuV3gkFrv2$R3%X38K2r3bg9YMmC`;JQ;nFOb?G**_J4`|OZf#M$PQluA?zk#1
z;o3v`afOndD#(RWeflqmMCQR@%JnAgw~p%b40~U$7r(uc40ALBo;;H|)+`6URo17|
z$t3!6-M{*ios(YL?<&!@X+e3cxGUX0=(eP)h*OFV`#7kk1|se$jkuF;G72c)`tD^!
zRtl=PlbED99SGzB^~~VPme!uO6-%eBunIN}%Dv3<s}hn)QBosDQ=a4w3m{0Hvy_7D
z92TL<JJ-3ja7cK$k;z`Jzhhfta1#zEE{=qu6ST5Tr187w(V4-y@0*BJkFy7jwhra;
z)A)fuWd(ii-Ed4n5w3zlaV@&v0(;UvIhy{CX<Hn}GzBzs={pdPsh8aux(2%0^C6=t
z21tPsaW?E)XY_PSSpS}OU*^S8-A182By}w!W)Fc0gNV7E26XDFyoUD@vH8~Wwc_`l
z=L<I=3UuOsI&(jrc;r!)Te7TF=DmS>*dH3l;t3&%Vi|?nGThnaeiCh&_H_yT-b-qZ
zx=Gso#hy&sJA0)j`(%!L3dZTe^FE%k<CR~a=VKPygEW3UmA5wLRWR!ENR&qRsuTLm
z?&U(+fGX21tNmF?U|L1gmAtQ!=%clPk`hXc6~kpI8>rIE&k8=Fhky~(K_P}Z<&x%1
zgj^niD65>BqcTb{KjSyg=BZFdlUqjcwSAGD0Sfkm%eqzPWvmSJsw=zS!Fgp>U}LoS
zyG6{TA~qV|Doc5ugL%>IhZYgTE5p;XZ0c+pXO9u%wbA*c7Y7+RNsK2g_T;;V+<sYv
zrmUN}QX@PI?6ms29`Q1dR{c4Bq-Xk!miE)FcR+s75spC`1!xyv4Y6az_8(~826zh5
z>|{+J;KBSu?Ev6#2!-<>!T)3<6dMwRqVo#LqsXcxlL2JOg}pLl<12D0hR926OIvG8
z`^c9wMYEH&*TEIz25GT2X(n_7^f40tAD8qa9%iYUK#l?W$}R`030mF0(5bIcZ@=$^
zguS;kzVHoO5vsZUQ4!wiFouXbZpdZAfF1{*^(Jv_fyq{rCDb-P`D+7H8@gCotVOr>
z{-DY0sgw)-A<H|Vl9kr>ue67oC5T_HMqIHBT3;M4kO99=aN__CTb<j075koXk#6h5
z#f*0fd`lPm)Cu(n1V6M=t@ZY(M>?A#+xt4qVCeCqliaT(=uq(d_AoOS9(*vM66sN-
zJ?x(c{!U;ABG1d8HP2-G9<~IUGs`dVPIvQNFqn+K)cE7`jHX?LU;Jq?G2LB6i*$h>
zcwqirUHPGc_{#P<#wcg26QG`YcG<y+{w8>vh~Oj5(U#$)g3^;eQNtcDUay0f9nPpQ
zyzuqqN{O5@B$9>QVHT%qap)GReIL9iOoY5-@6ITI+!TlSN2LP&sMct5S(niwW#51B
zea!(!yfveXQFcN?{@s;k;29T^e5%nNP{hbZwIdz~nsG^dzg1MWQy(P;A$3aJ3N7QC
z^wcD>TxlGAO}1asG3q0CWt}m5;bU+3=KIPAl$7uVo2D@rI?4Oq5+w|Y9@oFx%E9z$
zsKrezRu<}HU9Z|h+f`?p#2o8Ow=|8WrF!&LtCHn9z}STcFse|Y2FYqd&S}W*>1E&S
z*n$!~J;d0$i~#2v$Ifyry>Z<N!p7!EkxQEb2dfRoLMr`cvz4fjX_C}KMmc406D0(;
z`|eF0$t#BlnJP<Kfvt_n#;YC#iM#|oYDb$TyQBT}?^$SjW^q{p6j%Ei>$Ou9Xt7uu
zmD^0ZO-1Wzykx1-^3%mjY86=Zh*vtDlhT6i2=}*2`=JwVJ(!yHO{~;g9Kfv=ZKL=J
zfj7>IuH9yu`(_JNa9s@}qY`Z_H3C=giyVQ~(9`%xnq!3n^jH_pVK6nl!W-p5s<prV
zV3AmPF6adoNzMrGA{(J-{vdB)ckyYKAWj}Zj4@T;L?`J_xP0}>pLGQNWRu_PP+AdM
zbI@9AzN*Upy|Pf+PN`eMRqJCYh-;D5gdFesfBJo24`K>``)}gc^LIdYYuA0&lxL;o
z=J9Y*VZk?>+mgQM<(n*Y5L$c|+$3Axv}Mmo=$F^HEhy<{1?rr!(%Z$$`U}yj{=`gm
z-8f!}D7YWMCj6NWkBQx0tYR$G0WllBPxtTPd`lhOxw9v|BAcR&Xd<UPdy{N*qW|PO
zHMhE-VU6G2x`1mh97H8J!lp?k76>4Vrp4e-5T*Z3TYH|9x$9^2Y4|uEP%0}RyYEm%
z&@R5kzd;e|Q=-&#Ajv|LOCs1C8e(iOQoS<14vC;d*Fj`g1vO_FoSo)pyD>(kx}O?<
zxKyjRpgsf(iI#Ft0VW1GaSNK%9Gns#MUOTcj*lt<RmE<5o!-tARA}k#S9aRKQNJ(A
zAj?psWCEXLj}>Lfg)~<pf6Bt$)FQ{4(AZbGVjmeL@)V6f3l;%f@)F%nm8t7nK5|mj
z?sRA<9&NkKVdPi2xA|<%GQ~Y#7PDL3m#R+HfM(EYa_+MB#^g3y3Gu@h!*irsaQS|F
zrYF}Qpr>8@jttog3eyacl6eDx)SR_+nsuGp-at*%f}bgqC$dM=3(#U_3!b}^__heu
z*=HJtr1u28_uty#@jpu50@A5_tl2$<A);)Ca++cdA|a{I+B!iBu+?K@A|c92D@mId
z5bhLr{?9B|UPeLQO|g>dda(*a-0!lWUxwSg&+!>(D(+WD#II~hT+w%|geT||?9Id<
z2)d(dO_m~q$ei}S+T#}4*VR1y9DeHYmo$3k)akXKcq2jhc{`w(#Cl;NWmOuVL}Zw2
z`xr$iW~X1WO}Tv0CypZSkN?BRRWv9G%uT@{do@k?jn%8ePN9bhiXDC!Ht3<~;s&5X
zM_OY@r5isQgGUoR5Y*V+AB%N;x)lK2xw8S5YOM>3W~})R&yM#D^^tU(H5n-^>TqU@
zFQ_Rhh5sl(m;pr|^vT%1wT(t-K`K^UXK57?EkwX1TGxM~k~2+lZ38Sx8YOOF$%1;@
zZ`*)KVIGP;M9noJM=uDVODjR<0;s{;cb=>l=?^n;R~1m^tS!zx*r!0`!QWeZyU$>&
zJD{)}QB`N|jC4u$z2f{Lq1gC@pQzn$0kT3Ug75-bs3Y1!X9lINU%>ZyCDU?G#@l1_
zK)G$iaQ!Jj2FIo9fpE7tFwnhAg7by)D%Mucg3yw^$2!zCDFrqepD>9GxM9sks9#Hd
z)EJu(r;5X8cMGwkb{xVrlO36NtcuGoF-Q*^Il_@`v81mr)sF*a88zZvk|bAk!A8~6
z3e*1K>@tFHnRJDeSB;9X%vee$5uQ}TE?41e(d#r;gLYj5(oW#w{&Q4dCgRx}%uCI=
zgi~>(MeS)@<th-f^fG%Zd<WAx%TxhR3R56dpxVrVhCo$73=}yvtu$zcY=iC;voviF
zCIH^M)O`R>D#U_iyIYu2UQYhjLnGS%Bx|#Vz}E;TZ>KmRdWa?r;cb&UD%u@OX;}Wy
zseb{ud4So$*`-O@bKw{KoGpBKdCX<&HJG7h#+(tE=6{Y!Q=Zz2>l}J*Hs+&F#M*`;
zJRv)*XJNTcrY!-79ZS*`yjM=7EmP}eu7<adjEGf$y6{hgN{eygCZN&Z-9A-`dX!Ua
z)^BGp!?Kg7NGWR2Gx}Q_Il6Xlfv>A^A%ye<<b?LX8V<AsFthmoHuj#=!H)k*H39i{
zo|@?AZOCD7qCi?d#7{_T2*KRsgogsFegGzM3hbho8YMjH0~klX3w^8Lo|*H!P^dX%
zDGW(}W++^sc)@$+)uy)WqHSC3sp=FC5jIpn%+T^asbAa=K3Nr+#^NLBRsfnRp$S|k
zma2)p0&s-n0zVF&cyZUErUK0bn8ZYLA`1^kA&YB9d$dYpcJ>3+?x3oYt-$15bv+_}
zjQAhuF(*F%*qa1vooj)x2~FWg>wIra5YA-2Xc4mg8xaW26GO@ySq?s6>EdNa71>wB
zVii4&Uc}~QWjGm1(*r#(H%P!}#zauk9bP~9#9|x~4EV9yH8r=`PD~o}$V*%@qVeYK
z6iHPyfW*FNiOvFLNwyn{#822~iaN4Y{BXGHOvxR3*sJe6x~89Wo8Mzq=$A_ml3VyM
zP>(P@=HHsKGO2zTH9IzOrhP*3$@`kJIcZ&Yg^iltY7?b~{<@WipP@fQ4t8Uc6+%wr
zms(%?!wTUgPHU=8754Q)<o57X-453P4gLba<X7*XwWi9_ZG~vi<$2;fq~>)t!7K8$
z_2)%0EC`iNq;`Q}7H0-{=!OG4C|JSJYksQFX3%442-uKLEHziF6tj?5UV1Liv(h^u
zwf?(90&`W^K5p=Tm=FT4MWP4OIOZs7`UQiqCZZn!hrJ5CJdWLe6vZ<@;ugwIBbu6{
z;IRjdVEQStT|w}~A{5FhBc~Ri#GV>g-f~sSlxa%qBb|7_wOMyx8F_FQVcqDmQH3E<
zQiM~ftaZ#P5G}GDUC*VnNqfS<GE|N3!gzBil8cg{u_8@4)VDCEGe=Cd6--3_h9!k{
zp%+McRt4zsD3~QoBV}`A*FValAQ1(atRj957H_%@gXo5dU7)`@;au>MCseBbL(O<6
zvYyAkoE^a&Ei(79peZU5PbZNdG|hRi!<+i7>MgUZVB)UvU|P+-{L`djG7~UEhb^04
zk1vb)*4ZYK;U_NFs8OF7+vf@}wE_bGCA%x??OGeV-EAM>fgOM4tEb?py46xG2U4&x
z9(8{P4;)Vb^{@(Oe)zV1NY$?WLRuJEPqIeote6q2Q^jT@1tiE=@nmhb<GM(7=yi_|
zeC&$Gd*UU%aeyaune*kjBnU3JHkJ1XQMF$h7wV3(b=pD;-G;(%@FINd59dQ*bJ>l*
zy03EL7|c!H+aJLh(@Vc|CbF}j?kGpZdpWWkrcG@y*l30MXnGtqfg&cV13fS;xzTrv
z=37*sxR@E{=n7aevzJz;xzwA1Mn;o1baOaVm_nL~%8=}s#*uT)nWYfdpOU{RtQR>b
zj8b6G=Co#7aBMj1hTrTZFdE{~{qXk&S^2==@nSeNz-3_56vpV#h-#Pydl|X|=~^5;
z=}>ArxqP+9VY!Hu5)>rkCaoF{^Y7dk*qVx4^21@dZo15qNZJG@?)0(w6KaiT)(Ef8
za}p7ENGeL%H(dGzp~~=VpH1(HghD@l62zFy!SxR=FS0?WKdiB+&K$#;^Kkr@a;jvZ
zNCwgdckZY@88AYcH^D_U%&CgRVrnu6p*?=Hq!7qSH9pxvmffTCG3Fwhf%2_-sE-NX
zu2G&C-pH{eY8s%OEN{*@YbDC>+~1rIt#U9`lzC$U#+-q<m=kw)Bcxm#EbdX^jIp^q
ziyR^L4Y}>-I>pzF{C^6mb6RGRyX3VBVL?)2mZB=dXYMc=6rRV{lJ!(B61BZb^L`#h
zA~Js{-}D~66Sg1|Y?~{`hQbr*kgzN;`&p$vD8<eXfkQjXPc&r{UGQ))hA`rVWpx@v
zc^f(Htmg%>TsHljmMZ}J#f*F3Zu6ca?gkgoE?dlyGt|8MGyNn5&_WCOhas;ftnTnw
zLppi+xJXR>qGd}tyA^Uut5w!Q*_ueJTh?4fqs=C&N*-#4t)LpTgQ4yvi=N%`wfJWJ
zj|O(Z;@7@^+%83bJub#)PPOq2s~Z7MMx=di%i_J5BK23(x|T#JZ)VoAfvaPR+Pys2
zgD_8DLMjdJFU0ig^6$XwFnbj=bPD5x-E)juSE3waf2vE~kK)+wHSN}gAzB|!WWh-r
z*Zn-Tqjb(2X#*VxC3}z=A2%Z&Nk57pduC`%ZQ*DbFo}J%>`ol^A+tawWy9<c5FPnq
zieG9fozg<{iO&{bbasN6660orjgVoegBZha9s~XPz74k)n~OutZhP*c7q+BGqBBDo
zuwnT*bIoJ+0AzXYyS)A<*Of1O;+D&x95bD8@T!rY#@q{z(B*_Wj*5nIj9&9~*CuHt
zvG8tdtJSg284d5@FZw%H8o%b=M=bgJ`BJD390ej%(r?pK?lKsw`StO4-I1>@eaT8#
zWF0c`@AM~H9@<mYMtQ$l>{3(}N>U*Wks_{ZEhGh8wg1$2H=F@&>!*w1#Y3(r02QqK
zyu8}ZN3H68$OdOQTsU~4L#ajoXfC8n1RF52fn~9R`LT0cUoJi|aP|7OnRDy)x!7e6
zP%gC<r4Dv3bK{hRxsZfIgzIxCw_Ih{)3fRlC*2{ix@uWF8Ky3pn0wvw`@K88D-tp}
z0}A0`5_>R2&DW64yCDfA$UrM-gw`e<ZoLS$&V&91QhskvymCLaYl4B`I?paGQT5#T
z?|R#WLFOENYShc9c*1z}3fTcl+DM$Z=Y1vT15WDqEP19&pul&R$d88x!d0<9a&(yU
z3Y*53PfAQ`ck1-}x2K476B^{7eF*N&+?{;D)HF*HCSXq{`ilD)GO-I*z<Y3OlFK@-
z_jTu^|JKqxwH2CU|MAJOr{;)tfhj(+ZRv{LW2;?Hs-32knu28E`>S6wKZt!RU_j>Z
zOZ8paRESIpKki6n+=}KNDMdhW{4%k=5?aec+2$2%)QO>ChY7d|Lm0w1g3zqk6;G-$
z2A{XMoc#yE|1Gn{WL7}dyI<8xW&MzcUpG;aE(G(;eW{3Ivubh1w<LpFuCy1b67nZ}
z`bC)|*>OjUG;MTp17i+k7WrR7(fuGb%`S;!5YUrwS7!Q|Z4p`?)Wl(H3d=H3eU9Ml
zhBFC~o%_EV$cC3&-NNW87GLzjThy4+e+<TcBkExHqtfn+J*SI;+(#ZZSUvNBTqJCu
zQai`)larJ-?!D=At-K*$&lnBm3jspOc5fRxH)cWpo|p8;x`3C{c75XAd!-q6+}=xl
zE;EBa!7tNsrMzUayx>}-r29`Dj7SVnBBuQd8y<wxlnOnm&GBuL43Lu<cZ0xrtBGL4
z_V#C&b~K2d9@1>;*E9;ed!~9Tv@vv^X8^lZOFfjxocx;`C7d<8wnVrvUBEXKi1<}w
z;g;QJ#ZspaV@{4b&xt>eP>Giqm!6$}abjzqaF_|N^+J-cCKxE9Bi9?tEHs=mAPiSu
zi#PDUh32ixZ=u;kUOu!|(<kkl-<eHlB4kw6-0HG&|C(_2zWk;KfsOHrON!5@EGC=?
z);IKc*^)g4zi#hnLr*Df=u6<Q4`_|jrayI%4C(sE(qtu;^crb1ehBK1sg~8^2o=R;
z?(7pOb*7z7I#JII-)fEpq;?7n*9iZxZ)2#NFu=lRh;AOm?<SJDC@0P*7vtYoe?6O(
z`C-;q=lEpaNvpp{F6PZ258yLPu`J}7T?EJOX*U;6M#uLp#yu2%W!QkT3&q(cf+oq}
zoKQ0^j0iV~Ae}!+;><=4NlSICA#$hZ>Nsl^ZcxidOD?e+u7-ikSKJWLS7Z!+^FpKa
z#KluA)dNwz@Y5HDJ&Ybuq;!_ZW~B3W!CgRC*D|USl72U<>6M7WP^@v0oau}YfgsIg
z)GnL0SP&c<ZrSRZ9y_Rmk&h5`L;!)9#bBD)n=Y+GJATUweM_vFm=#ekqWgz_h+j+u
zp3;ROVRw|m(T{+drDLQOgEgz2&f@Ef_(%pmI=Elw>Mq0Jtk6lolA{K(k}^?!1GW4}
za{3sIb~)|rn4x0%S!{WpkPuyAyV+6|3|q;!N_sT=N@H&PhH&tv02yO}<t!1utaaw@
zPBy>I8Er9U`%m>23-ru>vuCoi7F1hnUSIj;9`R(4`XWY8;ms!M&(GZsQjtT4;nX|v
z;(5mX&LK2?H~zDvJxvb6zfs}?V3!c1>QVp*ol#+YgEYLxqC=OKZERVDtm5$MpfSwc
zGR%3spS>%_rd*mE<jfNQw(UHNlqG6Z{`cMsABTLPM*b{xK2Xvw)+;Vd3%)a$vBp_m
z;KYO;fwRH8ftaoIhd6%ZnV#RD3aRrLv8Su6<2?gXF?NEwF0Brz_*C$;pIxfed^8H<
zL6d3b5bUVp%jWvD$>2_OGiF%~VClN7jlukA=43>{{fxfiO&CQca`Vv)s3J-rerzrO
ztE+R2&Ln8_er($lO>Enk_>OJc$;7s8`;KjEVmlMtni!jBci#{DcAu{9)2HhCR#n{>
zet(LMUf<W7ET{4sC;o{zKTL5|fGfF(ZHwh3(Ac?uO$#ekVC&9={u>fPX+7tAWn!CM
zULrrs1Ag$NUvh69l2ijH!}aN;=)!8#QVvA%y;O(|ddy$4e_wmSmW|O9<SxFymD=+v
zzn469&*3_FQtgGeDP^8wVnU=R)MjX9-pvfMv^c3j*Ql|+cDAL%eS!c^GoVgOt(}64
zW-s|H8)O^t?OLi4XCu!4C3*d>nWDd8%_5iEysBrOISW|!&sFWr$<Ku^brdvE;J!f=
zRuGA(KFtiV1i?5Qg0DAsh~>WJIu0dt>ZXL$0rLdDT#?L75znwRJqUv;43{hn=J0Q}
zyL_GRPD87PEgk({H7L70Yq9$#@Yt*jr^<0Zikunfl9irY=Nd2cz#L20IX9BIlmW_k
zNRdEJl93zeCo9Yh%gQQjy5V+I@cQ_7<<_K-?P}H@Jsp&%M3L<n(h`U^y*V7SpB9gh
zxSf(hY9tA1`)bg6R`2)`z3||f7t&4fHvh31T{G8FM_9CivBQVMH!+ZsPN&}4Gm&$r
z!<*I=&H+3(z=D;LEQRHp%lo7S!q}1K!bd?GmwrGjoMd%a-e!bL4oVDBAel@XyQNX*
zj<=?X4ka?9!d(+k0i5Z2WSn9PGtJnml-VT{6%_>Z8keoJB3Lk(M_<^EfQIbpc-_JI
z6lne6OI3s{dD;!;vh%@mGOx(Pi6ok^W)1z=0a=*BgG%1$b;czlE#|u2F&+ku4F2sf
z%idHF%1CysAW7$?SLa&c?1OCehguNmf;V+PI`Hbf2c0Z_G`B<a+0?8^!mI^{JlnIx
zKY-bW;sW{ZV=1O1cP6bMv<D)cCOiwvjW7p+g+ytgz2moxwi~g|m*5O<{uAAZZONS*
z1>o_qsDQIQVgm^6A(Pb=%W&M4ZYG0Chrh=f!WQ5lPDNx6WzR)?GDsl4!N;puKFQ8?
z6Rg;HwShz>q>c&)sIMmhqplNealqvJS@5_C(_&~MubuiNH1|JkMZ0fq78{_;e`iNi
zFCkZ*Wf7gHT-ZysTMXlKH@w_8x9Cr`MlY)M5=^Z^?GsRxN537LxD1bA8zYlYA{s|8
zlPp9zMBca96BGug{43xyf1950Y$WoeE$&5!N2B%bHA-c^r<W%{QKSgXX#}SgCf^y2
zjg&T_7!3-f5lqgy^jP_U2N$|;9xlBe0a2WKhC(V^>Ms{&Q+Wn8O{wwh2@MLb0t)n8
zpoj<jSa%?KuLR(c(7zZ@GBuw$B7jJ}uQ5QNJ9G4Rh{HU&S%Vg1gfDgmj2QV{Cp)?T
zH7mUg+Q1CCMsoxqbtao)7iGf7%e69^k30_p&%HntgA5fwDoN;Uts<TpiC2r|Z|m(e
z{<GlnB@BtP%^(YPi))n8#Dd%fc$z-WbEY{C(n6K#gXl&rV82JE$x!R-|CJ*nI^+cS
zkhhMpaHg@=a}4kP>ci7a+kYVQF%rbKLqchasw@f|*ZZF^@Rw1h7;1*ed)Ir(`w>B#
zupU&fuW~WO|4C-2HhW9l75I(;6HDR!CzIXz7m2-l_yGAdbFp<E{`!H}?Gt^N?HS)M
z(nqDg$B$YE@21Q<c{Q=V6^|ROhfvS;n;_ejh=ACAI&&)_^TR*W2Lx;ceoLWpq^r>V
zmY55jR<(RSw_rX{Dh2f`G@fiXt)^1NB3q5H(3{1pEW7Ay*ahz6OA=&>rtyye43+=R
zhhABa5cK(t*h6Q@Kb%}!QlB=M*c^>YUM#B5Ce0$noqLPVa2yt$Z(|#Km1r3$(Ct;y
z01Gq*O+>=0{^<l`G3nwYqtwFc>)DK*iXJ|}YDHW6I?Gu;h6taf17DA+h2fR`wtBEQ
z$F~6U*Py-O;UQ;vT%VtEoA&Qg2yGL(D!)882CR9rkzx-P)pb&VHj(&E?**+Kg_PEj
z3zeVqk|!)=1&f1e{T;9*yfQeK&{Hu5P!R^aZqA@gIb(Ct+3t@$I$Je@8Wpwx$l6{p
z2R#eS<r$v|c#;vmD1la&sTmEg9E6f3l2JLO7Lgw{qREiv9_4r!(bUT5eZnz-shh0D
zyc@KrJeEXafgILqCUhqJcmzi0JbULjB@SXj=2pOYF`gF4^99LEYuYYvF`&*XC}E}+
zc}=MO)}1(}TDhhZkeQ!bnZJF;#@$L71icd>Z8;S09cyNTC&uQSN$u-DTmf%i8kO?B
z!)=?)hw#lbpQmf%@%(tTRu$={LQvKzqXDmYy>L};Trx1J&v0^+Khif@vbOHY^l9w@
zxSkc%l1qGnc@9{*jzPYrVZ`n&EMw*zJC_qxxd>sGOisKpWL<XbTY-N9d+d4ZwOg&9
zYw<-jP6lggPme}x*4-aWIX7l7P_(q?%R1b8G8OjgKe_bWlnDJSm!C3ndS8?TFJD$&
zL-NYBD#MC*_P|zdU!zPr5hoZ-_%Qjr{x_)m0qGhwkD*V2loQ4LOI80!TT*!|BNHeS
zenuvl-C-TkzI?*;m*82PF5PfGo+Z##E-X=0b}+bu=P~^FWU--nb}6q2>b@g#xQadf
zUQ_pwLiER-b@S;U_a}{3WrU4eO|>F%s9cB`5o%ZoXO$X0aINR*lu=NPerG9WjPsLy
z|3&J12apHc;`sf{z=)ORU;uCf)vjr{?7>r<#ThFXr>zWX@lE&*f3xt)8~m}9VFz63
z5K^}@Y%g^QG!m26cA@Lce;{x?Jt5?VLq}|}aQywEH7MT0Kim7DjZ8urK>WL0M`VH3
zGTArKQ<=4TCt{{_hLeha#Y}JqM_Mo0yee&r>LWjE4eKflJ7qb&galR>{s&H_I2Jh#
zv`?IqI6}0KEb=^*-KqtNP?!=uw}pNUR0TdFc+p4(!4_st#(fM!F<gC*K$o)hd)7nn
z43p(nFj3<yQosHY&2<V-f=*|kJPjX=_@}<3>D)x(Ig^ndn_y=l`oPdG9$JDpx1j;4
zP4zy1*L2tK7TefI?3io7u8BWViBD0oSim(af~cK|ZxCnAW2U$Byf`0j%|9B?|F4jC
zeICn>))~84Of3<{#WF~XNG9iSp;KMokFo+p2OmjL!l}^zGf6?*{`gEs&9OT#DULXX
z^Id1?1>{39S3zBp*vjEI*LvM2AcD{vAyM7$lc7BXSs3mdS$hvgUpu$><dxJFAConF
zE4A5X>+7{Z%l;orC#sm?uW*Wrcf8p7Jwt6teN!X0=`-<HbnhNnRHbct_0S`XUe~i&
zD?atq)^{NHNUGTy!7ua@G-jUDDtiQVD$J#mW&UX+#Fpw|jt8b^5hG~UJoZQweVSf3
zt)65sZrX!gM!vMJ6ivNO4gcDN6<EF~@)C>)_q+KgI?M1uPfLwT#a=rPo6r+w`8!Jv
zvBONf!WE{E><X=^J1!dEG|$HI*Icg~$oL~!_?Hpvi5G*%vlOjYnc(T^**r`#ipV6K
z8PaERQRZV=68;-|Uxuuaz)UdAU0|-egsSZ~-!Ou{l^p4KR2>TMqMoNPb|YyyeQMZj
za8e>|XsI$?(Q!iRb^m#3>enf}hq6A-FaOBRXnCwycfh5&lDM56OGpi$m|x;fjM%&M
z^5F2yr;L|85F6%&@t_6-A!{KYywd2cpGID&O=NkHq1TVYKr_eumdRl4Nqrl#iT^ca
z)0H&4hnC?axQviKVX%nMRJ}61#@R(>T)a#&->F}URZ&8WAgAa%w-`AlrMY>Wj#Mal
z!A;10k!EVv)U&*E)mS2&z7RV7nPIf!ytA|nKbb4e@P!Upu{}?#U9oMvMVK}#xTZYM
zuIh<!YGBITA|Rr?WoBK(CU5iPz?tXpm*U{Iga7;1pM$--Bw<>FS|*}%m7TTm(D_el
zt}<+kTGRZn2b25^?R&PY>8($U?x`pft3*>2KlQS86+_beX0`qRaf?W4@m`VygEL{(
z<@=8G7&#!w3>bc?hm~8<y?N@3?6ZvIx#I@a@vyKHZ+0rF*s^gzjqnHUpi>>@I)N7e
zz~bT(_p*qno95PLo#rLbExwX^VQO7V&XKFDM{i>`pgg`$u#?eFoMP7W%>#AmGSD5v
zOb#Ydm=LSSC@gHSq~X=U@`SX8`*lHviLOn`LTX3Xm+_q!Q{@q9O_ygd=H`bJHPIAq
zUQav}dxY*EEg~yIv<GPQ34+GDjoC54R=0KT0vgrXvpnd9=nZ;s%3;^gqKYrjK{IRM
z^)=s2CQ54IcKwpV_?r@z0{0YqbwFAfo1aBvpq(Q!wnr?jVZ?;MoQp!Etbh-i$U@v5
ztH*ewm{AQ|Z+FuBRr_`P_2&1b@UZvwtMo)oEFqF_96i|ymjIbi0dzh5ir7f8qz9-q
z1z0?&@nFR4(_6`%{wbDKNKTm0R>vy80$M6)qB<zLlZ8<EL_DXyx`Je!fX;8yW5=`l
zvm=21$dZexJ+^(<s_s*CMMpRMB>=1a1rX(}z4#l{?Y*ob9EX$&4J8zt0aTe}4Lj0%
zzv+gdPbp*YhdOB`e_=;jxD}dc#mjl&yZ5*yV&#A$NVyd?h3L?}4b22c#5<RDq!PZ#
zB?XqYXr%%gXZ6ZF8^elvZXZFx|8N2H1$BFBqyJ<?Xnmt+X_Nl7O%#UJXHzxcq9M-m
zGGlohHkp|3Vj!J|F0I`mS5x=17FFvLlMIY2ld$*)$*<c&q0GgX8F@Ro2KQ|<y){FG
z)yCop6l^CF`0Ta2$S3z%os<4MHGsNM84OvhnBFix_78rG|GLDY{tK(;Idc<Q<`3f%
z?*4nP0|7CDux)XqMS{8ojI~b>1*HmoySN2ExS*LY=O*Kv1)hJPv6IX5&H9?)Drb=X
z_(r7U37R{!a&>@Z^`;;>J=7`D|H-Vty0svyT;*o`F=k8y>qI4l4;v^kC8=3X!tOG)
zGWMG#gwM(UU_3DA7pbC2_D~U;E=WklzsQz<>@zPOpa^vJeW{6L1Gtyst}8Zvt}2~g
zf})>VyRrbml!nDeC(asZ|3;Weoy94}^4QpnA4l-T*6S6a)0rzOm)|~1bU^>XU+63=
z;lKVs^L)sDyE&gbr-p*-Hchsjn4JU_C^K;r@Jz|Ixym`JL!ecV6XZyi3kf=Pi$|oE
zbv!x=PvzF#yyL(@iEHY!M4G;HV%*q4!_gmtlI+nRFJ^xiZ(aPPO3WTd*B|2KDwu`8
z%SyX05d_CUvRq4B2rS0-+s7{K#ShxU$DM<+qz^wkaTG@Fl~M@5DsdtRpbTBEOO!Q%
zi25S`?Go(TM78o;<M0~DBA*saS$Oz(<Ap&HSpQ9D1!JWR`ya2Mu7`16-9+UZ)|bhY
zq<n<oda%I)8H6^{xB6UcoNg2|<HKYhO!Jnvj_wP__|!@OKI%bPQbP;hkfaVL!P2~9
z@`Q!HCUON`0mvuTVQhz`<WKYJaY?JZglS-7qdLNP4u~(%YFcJR>C$IB9>!EcXq=22
z#X+8WDo2(=u^=m#`bWyyEn@E>bw_TjR2A4&mMC|Eaazx}8u}edY7dD9T2LY@F&Hvo
zkk<`DjL9E$xaFBJspXr+v2kQXzl=Wsj*@S*#Q=7#)TBwuvSZ@iS8w<Em+i)%yI#h+
zFK~q@-m%aT3UMXU1<wFByPB<$jYX+-a5OR;r%;X+jEcl$!l&7{4dm-71a6E9#+DQt
z9a<rfsO(yMGooXkH@<y}iCU!ZkRFoVT#9llA6u%SdF*c<q^-V+WAO<v5+)}Am6h$&
z&T?D3%BvmM&;s<Rl$*@aQ`&f%_4B`0+888uYwepgyFXK4^dKRgDF#KjwBg;pWk!%`
z-cCr!G3<0QBt55IMU#map~pcB(FG;Dog4fx#_uqjHa7*7YwGsT1(JTyPY~~wR;Yep
zVUTGO@66RLx0I=je1<e1jh;WVRex#)3gOI=e*=;V)L*16j-YRkpbd)IGbMR>K@+PN
zgh)?bR5OWl3+IHqcZqtN{dt5fVy411Knc;!S#BdZk#Kht_PL4_O>XB{n7SqM&Lgw^
zh(K!Lq?{1bEfz{99&GS<qSHZ*hYb6J0h}xmV+6DaBj{&0OANZSW}Pm%3Pk=5kR2^Z
zU;p5D0Z6TZFr7$E^LK@R?kOpD8BDm~b)%kBC1Fd9w@YIu=<GG4`;eL%UR%MdH{mP}
zrNCpJdaeG9AOG&$#%Z{VR^X1xVoFlQ;{>UK$U>L`m25*pf}T;BhG+=GFs9BL*+HZy
zS0M~*2t<Rr>;d_(-Gec|XPGSRD)(krFHp&i2)6s~9GwA@M!xqm5@P2k-llY#d_0Oh
zgS{}#bfYy02i++qXCi_~+Az}&k%q%ZDUGPROtPkBFi{~LYoyJ@P72%fb(s386D!kb
zfh0vzgeU<K*AP4fsv~7lU+yZ|2>&rNIGc)gReQH#HxQA*EpPKkR|u}s*g?%eYpcMk
zeFgLrbci;^zZ9yfN|i{1AFbjCE&Uwv4oMF7i6H01J{{-XEAbWKJHE1zDz6Gr^^_vh
zk8I(cfFvx*As4a<Lq2kE7NiK{HIiE!E3}Qm(g_g(x0eIUGM9PP6bFX*JYRjU^)HA5
zY8)dt56KV)=ToROS;EIBf*v$g9r$b^73Z$$NF`GaD|0!tW1Mf{`I9e~{*BolS@?oo
zK_`GThAGj!(~W{&Aku9zHe~k><s=TC&-@QObG~SEW(670pJN)+QE=W3+O1^hkZ|48
zaqn*6wWA>fK~dohMsDU^>6C|RL6z4(&%dZe8W^2;I=hU2weTgMpTe0ou0?ge)CR<O
z3&<&upyN(T0691pX-;5ct1h1({`CoF9V2H$T|K_Z8j0FQo2m2!v54a)QfASVTp5b1
zQS5NuibsA5SZZnpa4wDTZ^n03Z%SB4z29ayqR@P<zC|`RudEQ!A6>xz?A;vi4!c8b
z=361RW7-|MErNx$I6*n`$UR+Wb9mpe42N1$=o;jU>yxGiATF_+C|4AqKUSl6OtDVL
zV0t4&^g*-EY~thjp4Z#MjjcUt+rRTCcnSBNAgFFKTMJDV%!zPWu&`&b4AN#dk%>B(
zg1)$*B!wB#z!cO51uoFV$Y5~B|DqxA0FVTwWXs1;Lm%l_G`P@TQc9PHj?P|NXB-Ph
zni%=kH|$TdXk4dLq(mbD1FhI;D|1-jf8bCiG__CcL1vc4P{H@Fr!l}h-<+F`0RTsg
zfRnUVB{o1ohsdV3Xg(-TSWn4_>2y)ir>W+2q<L5v%4-ghidk_GQx?%(@??~#DS#Ar
zT{D8;4Ovky@J3oL`VBucLx0j)9{6&0{pL4{r$R-wBmZ%Av4pa7cUYojvyL+0;Gsu=
zvrVM5xao~KUod}xLVmuVi0Z>g5SK9n8>b;gzzQd|14#kfcG(~`^bY$kFF(4xKGJ-I
zxwJA(_S%8NF<^UE+Zf<n)ctSs*UQXA>yGNexUT+N6zwNnZ0${5>P#P+*YEOm#e8a2
zA8OoOENt2kQ3ns=otIg9Lg2Dh!nJAk$~<j8D5q0@5Cl~R0Sz?#6uSr?D02mh-jxu{
z<-2<ENou@xgAEng4<ajX)$`Gv7!E<&3K!QqCo2;6Gx|Bix#fJ7)Nvr9cpvk{ALV*n
z?OBH%a1eU~q$uMg1&lfTSnL>yFJBYllVSnI0LT?FzXe)$AK0Dkw@>StMXSZ_4+-%$
z2^Y0TPT&P&#f81fn!UONEQ-1=cvVtJ@l}zWM${#)wyNuF=vT)FTLYWU0duEyVkjMB
zZ|7e(Jt(33*Mxm&Bgbk^cayQZJ4(xd<{k~AP{hX_LaLSwxWoR%4%+HvUR!Uo-A{pq
zF0wtt;eHNs!(j$a`s=^d-oqcQA?+~Zo9gdiE{K)77(F!n5s5SY)%>Ymy_V~_gqkK7
zTpW(+)`@*ixVSOxqM{RU5;bpZF62{S145tx3qI2<gDU#w{M>B%`fFswj5y*?-M$*o
zK7p<DI8>6D#t)yqpw(@^1c%J4Yio_rpA=;mvJ6$UXiawPyo;n9S<$NE4jeFfg~Zvv
z@=k0wbVrlCvT4QZB`K6yX^Vw199TFAleqfR(FG3}A_(H%K8MT{PXzZGm-v{ZdmmEu
zZXeckk@OI|IfNAUFt^}1({v!*EXJ!A^UG(7Pjz{wUhMC2g3S(V$#RT#uoRRFkijjK
z;Jyh$oOVJ;dwIXP7_sX&Ggoa9p8+cCx7M*hx~WQu!d^oNX|fegf__akfB13%P`R6p
z$AG5Gw`XBCg9W0sdIIsDV=Z|hS!)(j`4b1U*#sHyGpEsp?%AAl1;wT2cbO19<cG(M
z#gp=xBu8BWoM+qlLd7j19<lQb$H_GvG5y;V9vllV8aBG$^3EmNif1HTi|e*pGZOVm
zs*BZhJX)6k5@7X1$SffaAYefa-SsT&>_`=5HWX7_5B1_BOI#$*f0lcwYaIEBeMXZ2
zEL$x=%a5tc4>_9}(IZ5h((kKqT&<0;dXERUS7D+}>{Q=uimSwt6q-@A%p$uBrNe_>
z4>&J(t6(axNchJNl!A<a&m3XU)H1OC0}%zO$zuo-hqt_-@*@oDcZ5{vgq8{&Lgw+q
zBR(qlZ*=U<wz1PHRr&Nle`#1s;*v<uYQ?fbBDPJj!g8iA2R-O&N8)tsmKWyTQ*n>>
zuARArP!mHORy;kQp-g(hgRMG&?y#^>n9YjgesqChf5vjUC!xPue+Ls2=<dP>MT^<j
zU+cuRP&5)@_(WdH+RBkP^weq6T|Av^2u{gu+=-)7aV3=WMiF|bBFVA|)CmcQfYl67
zZGh(9LUC%&hIy_cYyc{@{SD3p#_iscl-3=21Y_o#c1=^wh0K|m<7nhgm2?9AN!h>d
zl|{_Rh3EGJ%sxpXDJS>18r@5BdQ?L3+GeMnMB@B)<?4y<^;O^3{6`eN5`O0HNw53&
z{9GcinP&Dv;C(CQzoHVKykg)!ayNAdOs9<=%oa)DgOFj~7T#}y{U+nNCWnoV0MD@O
z`FH7J^{_~>Z_O7t@uixG=FG6+uJi~&R1bw400S;DM$TcE1qcpxa^^_djj0HUXtR7)
zJXTjis)eIEED=z7SG1N0DV}VCSKZBaco|LjY!q1CO1Ve7YGF_S^*T*25DlWC?^o`8
zu0JQ(+h2CO5Ss@9Nb&<$40FjP?kEhAFz;_%)LapWA15k08wl_h#VIS{^H{2URF{Yq
zyAZz23Q4l_F0dLJs_|2eH1)v|9bCsB@WxMyDDtdo>)iu8Y5}^+;J2mnH)ymO681ad
zG;!h+jK(exZ*EVPEeX>dEd>0gA>iM&bg0B}cD>kr(mQuE6lDDbr6`Zp#+O)8OG8A+
zNRxowC8HJKh;nZ|q;Al5Poz<|Jnz({qz_T#tkSP9&dc=4q3{Z*6Rpp}9@C&!h8Syt
zq8T4RvUpfSVfRDhG>iCG5eoipE8I+$p4-OP+8Ew5oiOQ`N&~H}F&Z*=$-Y2Pebau4
zx7TnWnX};G84=$@QN3b(*WSptLKtEwls-zZ*H$1}PAD;y9W7BhMY>JYuE4u2WYJ)>
zJNMJLnPbtoT1|@?*9B^w2GL&Z0KboD8H)H_yAbw@uK0Y)Ism#Mgs-Pf;|IT68N|dB
zJpFI-)8y6ykWKQuyP%f^&qR7CVf&Dx3^$b6c0#lT(`>FHX0o1PJ~S?(=Fxz`(*qd@
zoU6P1YU1g%KX~ALNh-ef<C~z~&}~;*=miMq=ME_~PNVrgWXHB|gVDz*@?fFRhJ@vO
z@F_u!ct}$oQv|rtNWY3lO|GtcL1EI3b8ix_uaRRuK7LqC;~~ql3LVq1?*F)d82_E|
zGx`|bUVfhV4Ps`ev$6N<KKlrR3!iiPH<<9yjr_?8(`|qq=3GKg@?TLC^`yMM(zgS(
z1z~ng&7kynYDI71FY;4;SwEYQMat+7BFFbx5`kusJ-Lfn*HPcTH3?!W1r!$D&YH0q
zCNWo|9+6#ezMMiGwY<%{#K1v;Vu{2Rrd92c0bxS5FlF&L5gx~`p0TK%%POS>{R0d>
z3H-@Ir_7uY>Jg`Wgdg+4M_|G-n@4!kA*B<Rm+rhJc^q~ky?vH)v+w|~es=n}-I@XD
ztkKp;FFXUCep}>U6nah9zpn)!*mD0Bxce60l$EHnHO;L=K0Jj2r1q^RXe`A|N+Jh8
z;D74}ciC%R)-*&-4fRp2aQK&)sK%rn1*S1nZZWKlW;ryg*e-$C(6sw=!>nm(s+5U3
zwzqz-Q$zxo8{+)*Lc$P!3@fJyC&Q4W8>&9x4db6Bh?Uk6B}XOytSlHbw>m`bQ-F2e
zmgku=<4u{fsm(<Vo|Qm)?fDKX^N4~9Hc?GI4s18Fm`UA#ED8_}-pcedkBnIOmQFo)
z){yv)XO4JiR*n8##xQ7b;9;w5Fkst=<)UjV{?(5Lanna~Zwvq%KA4I_rnKjp!SF%b
zwAr~oKMf5eh?=?oRS{xnhjhhMHu8DQz@ap71kWak=(ARwuJ;W7I?&{BBv>GW0XY$m
zHCMFbEoisNx}04B`td$ASLfGuPnnHWuuxBM{l#|SDY}I;P?9R5#rFS`)mQhyNnkpq
z7MBL(ZbOBQfLDbz{0mMma}&{1u!0gwt)nkAkSL1!floOa4=vF1E5xlB%1cdX#v-F;
zw=k@{HmrrEEz^`UKf0m=(+nUBPEDwGlPOSDkVWg>Vq}3)2%aiui6Epo|JMM|PlR4t
zxQtbZF&El_mjNmIM{woS&rvEB*%9qznp4JKHUq{rZN;n!k-QU5SY_pG*o#yk)dU1)
z6Ec~2G!k8x=0Wn1jtM_mRIfjIR@+x@U7@6y9H~q>Dyfxlza}QzAaFHFQq^_Y11E#X
z;cE>5!#^P>LW>o%CAjIwy@^uqv+Z%MYqr?3cxuM8;^cg;f{l$J?ZmQYjUn3TzCYcY
z0~IY;kEz#Nm{cVc8F(x3+7Gu-B#~!I_);k+iDSS^3C)c2-KOgtGq-ZOSq8|FYSnV9
zcK7PnlQbdoU*W5ee8KjRgQZpY`>uT5AEn!P3``(uOXnHSF8O|^QLe@>X8DsN^wcxk
zwi8752s@JUykDu+myi{$NxQ#a2l`5Mm~xyxyALiF>~9E^PTf)EF=A<{^p)3JGS^;W
zRwaw{9^PqUPJJ*a$j?(PqzGN#9jKO;A-=s_h>x@>eR|WgesQPOGNo%xb~giMEb37f
zwsHPBX3NycWb;`p98<r|q6?9TXOa;8wIws?f$FoE)U<yqd*8zh#_xi9c-7t)46a-~
zpJ;0nBf?iW4jhJmLeD4%^G*Zk&$-xmSkS%uFdwo-PE0L3iC6M0rIvURR|D<iRSDqb
z6<4t0giT5GTvfyb8Z>;QYoA90Tk&!5>^c!`xo1vd^mM&g*>s#OpAw_kJ+WqZc!x9=
zIkQ^}ptZ#NGgMP-%Dw&tR_FAHytVf2-*maErfyV^nG~B<d2+EOGgLL!W*%3aANhP8
zvw~|NLVX3LsV!;xtQK${mc8C*ppu#=>H%YxhZ=H5^7@pKKXipvpAxWk^LGwMJ@Cv=
z^V5Gia-%>?b+~eJf;Az0Jv9j?N4>w@ck{1NZZ=9#=xMX3jcMh*_VoT<xy<{)F2&5Y
z^`v_E`J%|b{q*rF`)?-h?8go8Q|)mkuIZ=8Hg@M${BePw?;_U^4H0kO4akjA*hm@9
z_JwEVulMr8D}a6r*`<9qv<KT+%ON;b&~cyt<zGQTAQEI(fNiZ_Ia!^leyb8W<~hG!
zFIV!E0J4NA2BlFTzEy^`!EnsrA?H#yLq0!nu)e-fGt9f`TJ5yVONeFqOeGeye2yc`
z5Cb@e&84dnKhBPx*(TRKl68F6N!f77Uq^qPMRqHUi<UN^Wfy$m7<Lh^EsOShhE>rI
z+pTQR5WbEV(=S(9aXXHvzv2%!Z|Td@l`{#|{ed9%21x3w?AcmOP0sj+t(fih9v1V9
zg)D)clL)^Vczg_@Je`+`JQ3~cNb4_X@LDR#AD;6kMwwqPF>HV1nPkv-XrEdCNiLKt
zmm!2DYJOhWms)P@-*W!&9C$8_X8Kv_35pv$OWyM<FCe@7C+!^d>SBVb(=rE|YAgKy
z+e4t90oDD;V<Bs%o@++b*=2F1d)C>$2hkh=H`+xs@#b7KndhM=1Qj}?Zlx}J8>b7e
z9CXf}TZSA#LEfIGXqMfZ;W^;;F)^yEL0sw^u<x?d!3*6^+s^J=*%gqEdIQriKqDDk
zpa`Rrus#bWYBHOrVk|17sdBeSRmvtsY}5lm$gg4OpawnSEbIHiJHtvItkM;ZQJ^eu
z$c0zkfE$(opzG8k^fmCNTxf$~82}m9=$lNriE4}P*RNBnww6gP5xSj(IdU8zZpj%I
z&K@d3*ewljgfO-UBoz8%nwbLCUFsMp37K3Vdec(y69Gd4d>K01By|~Na_sxxEEXoh
z16&$UN0BLm-NpjOAi8GNRebISO06*su2wU;LQ9y5dm6rppF+w_^oZ41$lij1DaT?w
zRH+x99F;6A$JZLdUy3z|JX6$IB5IFf0#vwYr(_nZ2oy=n9(T8IGn8hR(ZD{-Ogw^Z
z?;;k9^U8S?E*qAaaD!wzymJU%HjHa|s5pST1#HGM5UX_oQ<kBOde#HBHmK_A$=q=e
zlBl(B+by&?$I#YXV*_{j`*FrVBgySXF2*V)MOW{VM)Y>t+f6&^Q17wvaJjBid)e)=
zG3VoA#!7I*QrumlDF^j?<Q8tKd+1^FkEk3&kB{CQ!xw9p*5|Ve^Nx;x3|MTmk!{#7
z=pt)Fl+(d4L+(CtOdR#x?m6)umEgSUvit8u!ghwKG%h>(dm>t3%R?7a$)lTsKc%+j
z4NTee(&fzA;z~;B8G62K<&#?1(xSAg*jp87+?a0)QJY1=+H58xL@7aUN%BVy)YuB$
zc7m@Ork2~MIvU3x_V!evpbb;J7r}ReTD^I|(Z^t8k%;y8lPQZMk(GB185?yV!q$vi
zr4tnaf9fM(IA!>Rk|TCpb9L`AHks2H4Uj>y=EjIF*Ly|LJh*eg-^GEun3^nMpz$=+
zlt?lNu4~f3N52Ys)W`mlJ}oW1Sl#Hbjh^dR4KXktj&DU2)Z0l5S&DrN5lO!AO{un;
z615rKVcyjCe-^vK`(=-!+c8#;f+OkL<xdicfFJi17)quXMW^B9?|J);HFz63>f&>p
zyFc^hM}AM0s-7BFmRr#RE4V*157mWJ*}Eb<(Vl?f8D2Rgmj`toRAFBNlS<*zpelp?
z>{G_ilbAuDlHzUX%iH)OIFLe^k85(XqrK4{cwZdH_7Er4HYS!nRh?YQa{xbdu<^n+
z*H<quuj3exVZY1_omw6WYuxQ)L-#D^_OOPQ5`=0^>0LLl!=&g2q$%xl?b*(Rkb*ht
z^R|Qs5MDUZUmchp{PZBzQDjf42JG~VwENFI@NE0oyivb$o?p=_UlYVR2slh)YpM=$
zG(nlR6qjH3=yU+s*No?>VOz!?dgN=_{CQIcH?6#dPHu6i?DKv$?m}k>+r}#PCPZ!o
zf7caH1!p?rcA4o<qv+&3G|Y6hZXRVtRJE8Q&!Q;6lJ$-=-ot$m8{gO`Y9nzGUnV?g
zda7m{mjO$^x&xc5Lbi*gBWa*Mj0I#GHkMnBuXSQEwb4aSP4AsJBo*KNzMjwZKmT+6
z0LXxXVSr$OfPlb&D5lBlQvQNk7KR1^nZX1B!Tx^xe-C3PQ$rV1RZB5bGfO*57fX9P
z1}kTKyZ_$^BTIF=TrD`rlqVSo>i@Ce_HEkM(9%xD)Yie~+tmLKhlKi1FR<@3`1^j>
I0{-3p7qmSOD*ylh

diff --git a/Solutions/Microsoft Defender XDR/Package/createUiDefinition.json b/Solutions/Microsoft Defender XDR/Package/createUiDefinition.json
index 373809538ea..6c17547c143 100644
--- a/Solutions/Microsoft Defender XDR/Package/createUiDefinition.json	
+++ b/Solutions/Microsoft Defender XDR/Package/createUiDefinition.json	
@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20XDR/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nWorkbook-only authoring candidate for Microsoft Defender XDR: Defender for Endpoint, Defender for Identity, and Office 365 Detections & Insights. Includes the Microsoft Defender XDR connector prerequisite for panels using connected Sentinel SecurityAlert data. Detection rules, hunting queries, playbooks, and Sentinel workbook installation are excluded. Live installation and runtime qualification are not established.\n\n**Data Connectors:** 1, **XDR Workbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20XDR/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Microsoft Defender XDR](https://www.microsoft.com/security/business/threat-protection/microsoft-365-defender) solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.\n\nAdditional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on [GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender). This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\n**Data Connectors:** 1, **Workbooks:** 3, **Analytic Rules:** 40, **Hunting Queries:** 387, **XDR Workbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -55,6 +55,20 @@
         "name": "contentSelection",
         "label": "Content selection",
         "elements": [
+          {
+            "name": "DeployAnalyticsRule",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployAnalyticsRule",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
+          },
+          {
+            "name": "DeployWorkbook",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployWorkbook",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
+          },
           {
             "name": "DeployDefenderWorkbook",
             "type": "Microsoft.Common.CheckBox",
@@ -68,6 +82,13 @@
             "label": "DeployDataConnector",
             "defaultValue": true,
             "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
+          },
+          {
+            "name": "DeployHuntingQuery",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployHuntingQuery",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution."
           }
         ]
       },
@@ -94,14 +115,6117 @@
             }
           }
         ]
+      },
+      {
+        "name": "workbooks",
+        "label": "Workbooks",
+        "subLabel": {
+          "preValidation": "Configure the workbooks",
+          "postValidation": "Done"
+        },
+        "bladeTitle": "Workbooks",
+        "elements": [
+          {
+            "name": "workbooks-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view."
+            }
+          },
+          {
+            "name": "workbooks-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
+              }
+            }
+          },
+          {
+            "name": "workbook1",
+            "type": "Microsoft.Common.Section",
+            "label": "Microsoft Defender for Office 365 Detections and Insights",
+            "elements": [
+              {
+                "name": "workbook1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Gain extensive insight into your organization's Microsoft Defender for Office 365 protection across email and Microsoft Teams by analyzing and correlating events. \nYou can track detections and insights over time including: metrics for phish, spam, and malware, URL and URL click detection details, malicious file detections, Microsoft Teams collaboration protection (impersonation, voice phishing, and malicious URLs and files), post-delivery detections, user and admin submissions, system overrides, and actions taken by security administrators."
+                }
+              }
+            ]
+          },
+          {
+            "name": "workbook2",
+            "type": "Microsoft.Common.Section",
+            "label": "Microsoft Defender For EndPoint",
+            "elements": [
+              {
+                "name": "workbook2-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "A wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through M365 Defender Connector."
+                }
+              }
+            ]
+          },
+          {
+            "name": "workbook3",
+            "type": "Microsoft.Common.Section",
+            "label": "Microsoft Defender For Identity",
+            "elements": [
+              {
+                "name": "workbook3-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Use this workbook to analyse the advance hunting data ingested for Defender For Identity."
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "name": "analytics",
+        "label": "Analytics",
+        "subLabel": {
+          "preValidation": "Configure the analytics",
+          "postValidation": "Done"
+        },
+        "bladeTitle": "Analytics",
+        "elements": [
+          {
+            "name": "analytics-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view."
+            }
+          },
+          {
+            "name": "analytics-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
+              }
+            }
+          },
+          {
+            "name": "analytic1",
+            "type": "Microsoft.Common.Section",
+            "label": "Possible Phishing with CSL and Network Sessions",
+            "elements": [
+              {
+                "name": "analytic1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. \nIf your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic2",
+            "type": "Microsoft.Common.Section",
+            "label": "SUNSPOT malware hashes",
+            "elements": [
+              {
+                "name": "analytic2-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query uses Microsoft Defender for Endpoint data to look for IoCs associated with the SUNSPOT malware shared by Crowdstrike.\nMore details: \n  - https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/\n  - https://techcommunity.microsoft.com/blog/microsoftsentinelblog/monitoring-the-software-supply-chain-with-azure-sentinel/2176463/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic3",
+            "type": "Microsoft.Common.Section",
+            "label": "Potential Build Process Compromise - MDE",
+            "elements": [
+              {
+                "name": "analytic3-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process. This query uses Microsoft Defender for Endpoint telemetry.\nMore details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic4",
+            "type": "Microsoft.Common.Section",
+            "label": "TEARDROP memory-only dropper",
+            "elements": [
+              {
+                "name": "analytic4-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic5",
+            "type": "Microsoft.Common.Section",
+            "label": "SUNBURST network beacons",
+            "elements": [
+              {
+                "name": "analytic5-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies SolarWinds SUNBURST domain beacon IOCs in DeviceNetworkEvents\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic6",
+            "type": "Microsoft.Common.Section",
+            "label": "SUNBURST and SUPERNOVA backdoor hashes",
+            "elements": [
+              {
+                "name": "analytic6-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in DeviceFileEvents\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic7",
+            "type": "Microsoft.Common.Section",
+            "label": "AV detections related to Ukraine threats",
+            "elements": [
+              {
+                "name": "analytic7-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for Microsoft Defender AV detections for malware observed in relation to the war in Ukraine.\n  Ref: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ "
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic8",
+            "type": "Microsoft.Common.Section",
+            "label": "AV detections related to Tarrask malware",
+            "elements": [
+              {
+                "name": "analytic8-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for Microsoft Defender AV detections related to Tarrask malware. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged-on users etc. \n This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.\n Reference: https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic9",
+            "type": "Microsoft.Common.Section",
+            "label": "AV detections related to SpringShell Vulnerability",
+            "elements": [
+              {
+                "name": "analytic9-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for Microsoft Defender AV detections related to the SpringShell vulnerability. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device.\n  This query joins the DeviceInfo table to clearly connect other information such as device group, IP, logged-on users, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.\n  Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic10",
+            "type": "Microsoft.Common.Section",
+            "label": "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863",
+            "elements": [
+              {
+                "name": "analytic10-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks at device, process, and network events from Defender for Endpoint that may be vulnerable to buffer overflow defined in CVE-2023-4863. Results are not an indicator of malicious activity."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic11",
+            "type": "Microsoft.Common.Section",
+            "label": "Deimos Component Execution",
+            "elements": [
+              {
+                "name": "analytic11-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic12",
+            "type": "Microsoft.Common.Section",
+            "label": "Imminent Ransomware",
+            "elements": [
+              {
+                "name": "analytic12-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for a series of commands that are commonly used by attackers to disable security tools and system recovery tools before deploying Macaw ransomware in an organization."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic13",
+            "type": "Microsoft.Common.Section",
+            "label": "Java Executing cmd to run Powershell",
+            "elements": [
+              {
+                "name": "analytic13-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query was originally published in the threat analytics report, Sysrv botnet evolution.\nSysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.\nThe following query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic14",
+            "type": "Microsoft.Common.Section",
+            "label": "C2-NamedPipe",
+            "elements": [
+              {
+                "name": "analytic14-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Detects the creation of a named pipe used by known APT malware.\nReference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic15",
+            "type": "Microsoft.Common.Section",
+            "label": "DopplePaymer Procdump",
+            "elements": [
+              {
+                "name": "analytic15-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.\nDoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they use SysInternal utilities such as ProcDump to dump credentials from LSASS. They often use these stolen credentials to turn off security software, run malicious commands, and spread malware throughout an organization.\nThe following query detects ProcDump being used to dump credentials from LSASS.\nThe See also section below lists links to other queries associated with DoppelPaymer.\nReferences:\nhttps://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/DoppelPaymer.KM!MTB\nhttps://docs.microsoft.com/sysinternals/downloads/procdump\nhttps://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic16",
+            "type": "Microsoft.Common.Section",
+            "label": "LSASS Credential Dumping with Procdump",
+            "elements": [
+              {
+                "name": "analytic16-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query was originally published in the threat analytics report, \"Exchange Server zero-days exploited in the wild\".\nIn early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:\n1. CVE-2021-26855\n2. CVE-2021-26857\n3. CVE-2021-26858\n4. CVE-2021-27065\nThe following query looks for evidence of Procdump being used to dump credentials from LSASS, the Local Security Authentication Server. This might indicate an attacker has compromised user accounts.\nMore queries related to this threat can be found under the See also section of this page.\nReference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic17",
+            "type": "Microsoft.Common.Section",
+            "label": "Doppelpaymer Stop Services",
+            "elements": [
+              {
+                "name": "analytic17-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.\nDoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization.\nThe following query detects attempts to stop security services.\nThe See also section below lists links to other queries associated with DoppelPaymer.\nReferences:\nhttps://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/DoppelPaymer.KM!MTB"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic18",
+            "type": "Microsoft.Common.Section",
+            "label": "Qakbot Campaign Self Deletion",
+            "elements": [
+              {
+                "name": "analytic18-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware\nQakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.\nThe following query detects if an instance of Qakbot has attempted to overwrite its original binary.\nReference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic19",
+            "type": "Microsoft.Common.Section",
+            "label": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
+            "elements": [
+              {
+                "name": "analytic19-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll.\nJoins the data to public network events.\nReferences:\nhttps://threathunt.blog/running-live-malware-for-threat-hunting-purposes/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic20",
+            "type": "Microsoft.Common.Section",
+            "label": "Regsvr32 Rundll32 with Anomalous Parent Process",
+            "elements": [
+              {
+                "name": "analytic20-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This analytical rule looks for rundll32.exe or regsvr32.exe being spawned by abnormal processes: wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe.\nBlog: https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic21",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Suspicious Commands Initiated by Webserver Processes",
+            "elements": [
+              {
+                "name": "analytic21-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query was originally published in the threat analytics report, Operation Soft Cell.\nOperation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.\nOperation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.\nReference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic22",
+            "type": "Microsoft.Common.Section",
+            "label": "Bitsadmin Activity",
+            "elements": [
+              {
+                "name": "analytic22-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. \nThis service is commonly used for legitimate purposes, but can also be used as part of a malware downloader. \nAdditionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This\nquery will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer\ndirectionality."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic23",
+            "type": "Microsoft.Common.Section",
+            "label": "Office Apps Launching Wscipt",
+            "elements": [
+              {
+                "name": "analytic23-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated.\nTrickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command-and-control (C2) operations.\nTrickbot is frequently spread through email. An attacker will send a target a message with an attachment containing a malicious macro. If the target enables the macro, it will write a JScript Encoded (JSE) file to disk (JScript is a Microsoft dialect of ECMAScript). The JSE file will then be launched using wscript.exe to perform a variety of malicious tasks, particularly reconnaissance.\nThe following query detects when Office applications have launched wscript.exe to run a JSE file.\nSee Detect rundll.exe being used for reconnaissance and command-and-control for another query related to Trickbot activity.\nReference - https://attack.mitre.org/software/S0266/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic24",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Potential Kerberoast Activities",
+            "elements": [
+              {
+                "name": "analytic24-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query aim to detect if someone requests service tickets (where count => maxcount)\nThe query requires trimming to set a baseline level for MaxCount  \nMitre Technique: Kerberoasting (T1558.003)\n@MattiasBorg82"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic25",
+            "type": "Microsoft.Common.Section",
+            "label": "Files Copied to USB Drives",
+            "elements": [
+              {
+                "name": "analytic25-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic26",
+            "type": "Microsoft.Common.Section",
+            "label": "MosaicLoader",
+            "elements": [
+              {
+                "name": "analytic26-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic27",
+            "type": "Microsoft.Common.Section",
+            "label": "Unusual Volume of file deletion by users",
+            "elements": [
+              {
+                "name": "analytic27-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here.\nThis applies to SharePoint and OneDrive users.\nAudit event and Cloud application identifier references.\nReference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-activities?view=o365-worldwide\nReference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic28",
+            "type": "Microsoft.Common.Section",
+            "label": "Remote File Creation with PsExec",
+            "elements": [
+              {
+                "name": "analytic28-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog.\nRyuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.\nRyuk operators use PsExec to manually spread the ransomware to other devices.\nThe following query detects remote file creation events that might indicate an active attack.\nThe See also section below lists links to other queries associated with Ryuk ransomware.\nReferences:\nhttps://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk.AA\nhttps://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/\nhttps://docs.microsoft.com/sysinternals/downloads/psexec"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic29",
+            "type": "Microsoft.Common.Section",
+            "label": "Service Accounts Performing Remote PS",
+            "elements": [
+              {
+                "name": "analytic29-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Service Accounts Performing Remote PowerShell.\nThe purpose behind this detection is for finding service accounts that are performing remote powershell sessions.\nThere are two phases to the detection: Identify service accounts, Find remote PS cmdlets being ran by these accounts.\nTo accomplish this, we utilize DeviceLogonEvents and DeviceEvents to find cmdlets ran that meet the criteria.\nOne of the main advantages of this method is that only requires server telemetry, and not the attacking client.\nThe first phase relies on the DeviceLogonEvents to determine whether an account is a service account or not, consider the following accounts with logons:.\nRandom_user has DeviceLogonEvents with type 2, 3, 7, 10, 11 & 13.\nRandom_service_account 'should' only have DeviceLogonEvents with type 3,4 or 5."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic30",
+            "type": "Microsoft.Common.Section",
+            "label": "Account Creation",
+            "elements": [
+              {
+                "name": "analytic30-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "User accounts may be created to achieve persistence on a machine.\nRead more here: https://attack.mitre.org/wiki/Technique/T1136.\nTags: #CreateAccount.\nQuery #1: Query for users being created using \"net user\" command.\n\"net user\" commands are noisy, so needs to be joined with another signal -.\nE.g. in this example we look for use of uncommon & undocumented commandline switches (e.g. /ad instead of /add)."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic31",
+            "type": "Microsoft.Common.Section",
+            "label": "Local Admin Group Changes",
+            "elements": [
+              {
+                "name": "analytic31-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for changes to the local administrators group.\nBlogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic32",
+            "type": "Microsoft.Common.Section",
+            "label": "Rare Process as a Service",
+            "elements": [
+              {
+                "name": "analytic32-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query is looking for rarely seen processes which are launched as a service. Whiltelisted process list need to be updated based on the environment.\nAuthor: Jouni Mikkola\nMore info: https://threathunt.blog/rare-process-launch-as-a-service/"
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic33",
+            "type": "Microsoft.Common.Section",
+            "label": "Disabling Security Services via Registry",
+            "elements": [
+              {
+                "name": "analytic33-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for processes modifying the registry to disable security features. This is a common technique used by threat actors for defence evasion."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic34",
+            "type": "Microsoft.Common.Section",
+            "label": "Deletion of data on multiple drives using cipher exe",
+            "elements": [
+              {
+                "name": "analytic34-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic35",
+            "type": "Microsoft.Common.Section",
+            "label": "LaZagne Credential Theft",
+            "elements": [
+              {
+                "name": "analytic35-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "LaZagne is a popular open-source tool used to recover passwords stored on a local computer. It has been used in ransomware attacks to steal credentials and escalate privileges. This query looks for the execution of LaZagne."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic36",
+            "type": "Microsoft.Common.Section",
+            "label": "Clearing of forensic evidence from event logs using wevtutil",
+            "elements": [
+              {
+                "name": "analytic36-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. Clearing event logs can be a sign of ransomware activity, as ransomware often attempts to cover its tracks by deleting logs."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic37",
+            "type": "Microsoft.Common.Section",
+            "label": "Stopping multiple processes using taskkill",
+            "elements": [
+              {
+                "name": "analytic37-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. This is a common technique used by ransomware to stop security products and other processes."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic38",
+            "type": "Microsoft.Common.Section",
+            "label": "Potential Ransomware activity related to Cobalt Strike",
+            "elements": [
+              {
+                "name": "analytic38-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns. It looks for alerts that indicate potential ransomware activity, such as attempts to clear security event logs, delete backup files, and execute Cobalt Strike malware."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic39",
+            "type": "Microsoft.Common.Section",
+            "label": "Qakbot Discovery Activies",
+            "elements": [
+              {
+                "name": "analytic39-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. It looks for discovery commands such as net.exe, whoami.exe, nslookup.exe, netstat.exe, arp.exe, and ping.exe."
+                }
+              }
+            ]
+          },
+          {
+            "name": "analytic40",
+            "type": "Microsoft.Common.Section",
+            "label": "Shadow Copy Deletions",
+            "elements": [
+              {
+                "name": "analytic40-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors.\nThis query detects know commands that have been used by the ransomware actors.\nSome information from Mitre Attack: \nhttps://attack.mitre.org/techniques/T1490/"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "name": "huntingqueries",
+        "label": "Hunting Queries",
+        "bladeTitle": "Hunting Queries",
+        "elements": [
+          {
+            "name": "huntingqueries-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. "
+            }
+          },
+          {
+            "name": "huntingqueries-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/hunting"
+              }
+            }
+          },
+          {
+            "name": "huntingquery1",
+            "type": "Microsoft.Common.Section",
+            "label": "Appspot Phishing Abuse",
+            "elements": [
+              {
+                "name": "huntingquery1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps surface phishing campaigns associated with Appspot abuse.These emails frequently contain phishing links that utilize the recipients' own email address as a unique identifier in the URI.\nThis campaign was published on Twitter by @MsftSecIntel at this link: https://twitter.com/MsftSecIntel/status/1374148156301004800\nReference - https://twitter.com/MsftSecIntel/status/1374148156301004800 This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery2",
+            "type": "Microsoft.Common.Section",
+            "label": "Dropping Payload via certutil",
+            "elements": [
+              {
+                "name": "huntingquery2-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "BazaCall campaign tricks users into calling a fake customer support center, and download a malicious Excel file which contains a macro to infect users' device with BazaLoader. This query searches for a copy of certutil.exe used by the macro. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery3",
+            "type": "Microsoft.Common.Section",
+            "label": "Judgement Panda Exfil Activity",
+            "elements": [
+              {
+                "name": "huntingquery3-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml.\nQuestions via Twitter: @janvonkirchheim. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery4",
+            "type": "Microsoft.Common.Section",
+            "label": "Deimos Component Execution",
+            "elements": [
+              {
+                "name": "huntingquery4-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising. This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery5",
+            "type": "Microsoft.Common.Section",
+            "label": "LemonDuck Registration Function",
+            "elements": [
+              {
+                "name": "huntingquery5-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "LemonDuck is a malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery6",
+            "type": "Microsoft.Common.Section",
+            "label": "Devices with Log4j vulnerability alerts and additional other alert related context",
+            "elements": [
+              {
+                "name": "huntingquery6-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J. This hunting query depends on MicrosoftThreatProtection data connector (AlertInfo AlertEvidence Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery7",
+            "type": "Microsoft.Common.Section",
+            "label": "Alerts Related to Log4j Vulnerability",
+            "elements": [
+              {
+                "name": "huntingquery7-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Microsoft has observed attackers exploiting vulnerabilities associated with Log4J. This hunting query depends on MicrosoftThreatProtection data connector (AlertInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery8",
+            "type": "Microsoft.Common.Section",
+            "label": "Imminent Ransomware",
+            "elements": [
+              {
+                "name": "huntingquery8-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Before deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery9",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious Use of MSBuild as LOLBin",
+            "elements": [
+              {
+                "name": "huntingquery9-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery10",
+            "type": "Microsoft.Common.Section",
+            "label": "Qakbot Reconnaissance Activities",
+            "elements": [
+              {
+                "name": "huntingquery10-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for reconnaissance and beaconing activities after code injection occurs in Qakbot infections. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery11",
+            "type": "Microsoft.Common.Section",
+            "label": "Robbinhood Driver",
+            "elements": [
+              {
+                "name": "huntingquery11-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query detects the presence of the Robbinhood ransomware driver. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery12",
+            "type": "Microsoft.Common.Section",
+            "label": "Snip3 Malicious Network Connectivity",
+            "elements": [
+              {
+                "name": "huntingquery12-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query looks for potentially hollowed processes that may be used to facilitate command-and-control or exfiltration by Snip3 malware. This hunting query depends on MicrosoftThreatProtection data connector (DeviceNetworkEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery13",
+            "type": "Microsoft.Common.Section",
+            "label": "Java Executing cmd to run Powershell",
+            "elements": [
+              {
+                "name": "huntingquery13-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery14",
+            "type": "Microsoft.Common.Section",
+            "label": "Spoofing attempts from Specific Domains",
+            "elements": [
+              {
+                "name": "huntingquery14-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query identifies potential phishing or spoofing attempts originating from specific domains with authentication failures. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery15",
+            "type": "Microsoft.Common.Section",
+            "label": "C2-NamedPipe",
+            "elements": [
+              {
+                "name": "huntingquery15-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Detects the creation of a named pipe used by known APT malware.\nReference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery16",
+            "type": "Microsoft.Common.Section",
+            "label": "Recon with Rundll",
+            "elements": [
+              {
+                "name": "huntingquery16-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query detects suspicious rundll.exe activity associated with Trickbot campaigns. This hunting query depends on MicrosoftThreatProtection data connector (DeviceNetworkEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery17",
+            "type": "Microsoft.Common.Section",
+            "label": "DopplePaymer Procdump",
+            "elements": [
+              {
+                "name": "huntingquery17-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Detects the use of ProcDump to dump credentials from LSASS memory by DoppelPaymer ransomware operators. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery18",
+            "type": "Microsoft.Common.Section",
+            "label": "Credential Harvesting Using LaZagne",
+            "elements": [
+              {
+                "name": "huntingquery18-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Detects the use of LaZagne to steal credentials from the SAM database by Ryuk ransomware operators. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery19",
+            "type": "Microsoft.Common.Section",
+            "label": "LSASS Credential Dumping with Procdump",
+            "elements": [
+              {
+                "name": "huntingquery19-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Detects the use of Procdump to dump credentials from LSASS memory. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery20",
+            "type": "Microsoft.Common.Section",
+            "label": "Clear System Logs",
+            "elements": [
+              {
+                "name": "huntingquery20-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query searches for attempts to use fsutil.exe to clear system logs and delete forensic artifacts. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery21",
+            "type": "Microsoft.Common.Section",
+            "label": "Doppelpaymer Stop Services",
+            "elements": [
+              {
+                "name": "huntingquery21-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for attempts to stop security services, which is a common tactic used by DoppelPaymer ransomware operators. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery22",
+            "type": "Microsoft.Common.Section",
+            "label": "Qakbot Campaign Self Deletion",
+            "elements": [
+              {
+                "name": "huntingquery22-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query detects if an instance of Qakbot has attempted to overwrite its original binary. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery23",
+            "type": "Microsoft.Common.Section",
+            "label": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
+            "elements": [
+              {
+                "name": "huntingquery23-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceNetworkEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery24",
+            "type": "Microsoft.Common.Section",
+            "label": "Regsvr32 Rundll32 with Anomalous Parent Process",
+            "elements": [
+              {
+                "name": "huntingquery24-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for rundll32.exe or regsvr32.exe being spawned by abnormal processes such as wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceNetworkEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery25",
+            "type": "Microsoft.Common.Section",
+            "label": "Determine Successfully Delivered Phishing Emails by top IP Addresses",
+            "elements": [
+              {
+                "name": "huntingquery25-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query identifies phishing emails sent that were successfully delivered, by top IP addressess. cutoff default value is 5, adjust the value as needed. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery26",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Suspicious Commands Initiated by Webserver Processes",
+            "elements": [
+              {
+                "name": "huntingquery26-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Detect suspicious commands initiated by web server processes used for network discovery and user/owner discovery. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery27",
+            "type": "Microsoft.Common.Section",
+            "label": "Enumeration of Users & Groups for Lateral Movement",
+            "elements": [
+              {
+                "name": "huntingquery27-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query hunts for attempts to list users or groups using Net commands, which are commonly used for lateral movement. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery28",
+            "type": "Microsoft.Common.Section",
+            "label": "ATP policy status check",
+            "elements": [
+              {
+                "name": "huntingquery28-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery29",
+            "type": "Microsoft.Common.Section",
+            "label": "JNLP-File-Attachment",
+            "elements": [
+              {
+                "name": "huntingquery29-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "JNLP file extensions are an uncommon file type often used to deliver malware. This hunting query depends on MicrosoftThreatProtection data connector (EmailAttachmentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery30",
+            "type": "Microsoft.Common.Section",
+            "label": "Safe Attachments detections",
+            "elements": [
+              {
+                "name": "huntingquery30-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query provides insights on the detections done by Safe Attachment detections This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery31",
+            "type": "Microsoft.Common.Section",
+            "label": "Authentication failures by time and authentication type",
+            "elements": [
+              {
+                "name": "huntingquery31-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery32",
+            "type": "Microsoft.Common.Section",
+            "label": "CompAuth Failure Trend",
+            "elements": [
+              {
+                "name": "huntingquery32-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spoof - Composite Authentication fails summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery33",
+            "type": "Microsoft.Common.Section",
+            "label": "DKIM Failure Trend",
+            "elements": [
+              {
+                "name": "huntingquery33-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spoof - DKIM fails summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery34",
+            "type": "Microsoft.Common.Section",
+            "label": "DMARC Failure Trend",
+            "elements": [
+              {
+                "name": "huntingquery34-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spoof - DMARC fails summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery35",
+            "type": "Microsoft.Common.Section",
+            "label": "SPF Failure Trend",
+            "elements": [
+              {
+                "name": "huntingquery35-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spoof - SPF fails summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery36",
+            "type": "Microsoft.Common.Section",
+            "label": "Spoof attempts with auth failure",
+            "elements": [
+              {
+                "name": "huntingquery36-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps in checking for spoofing attempts on the domain with Authentication failures This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery37",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Spoof external domain detections by Sender domain (P1/P2)",
+            "elements": [
+              {
+                "name": "huntingquery37-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery38",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Spoof DMARC detections by Sender domain (P1/P2)",
+            "elements": [
+              {
+                "name": "huntingquery38-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery39",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Spoof intra-org detections by Sender domain (P1/P2)",
+            "elements": [
+              {
+                "name": "huntingquery39-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery40",
+            "type": "Microsoft.Common.Section",
+            "label": "Message from an Accepted Domain with DMARC TempError",
+            "elements": [
+              {
+                "name": "huntingquery40-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery41",
+            "type": "Microsoft.Common.Section",
+            "label": "Message with URL listed on OpenPhish delivered into Inbox",
+            "elements": [
+              {
+                "name": "huntingquery41-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email with a URL from OpenPhish was delivered to Inbox This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery42",
+            "type": "Microsoft.Common.Section",
+            "label": "Potential OAuth phishing email delivered into Inbox",
+            "elements": [
+              {
+                "name": "huntingquery42-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious OAuth app URL has been delivered into an Inbox. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery43",
+            "type": "Microsoft.Common.Section",
+            "label": "Potentially malicious svg file delivered to Inbox",
+            "elements": [
+              {
+                "name": "huntingquery43-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailAttachmentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery44",
+            "type": "Microsoft.Common.Section",
+            "label": "Audit Email Preview-Download action",
+            "elements": [
+              {
+                "name": "huntingquery44-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery45",
+            "type": "Microsoft.Common.Section",
+            "label": "Bad email percentage of Inbound emails",
+            "elements": [
+              {
+                "name": "huntingquery45-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery46",
+            "type": "Microsoft.Common.Section",
+            "label": "Calculate overall MDO efficacy",
+            "elements": [
+              {
+                "name": "huntingquery46-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery47",
+            "type": "Microsoft.Common.Section",
+            "label": "Email sender IP address Geo location information",
+            "elements": [
+              {
+                "name": "huntingquery47-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps getting GeoIP information of emails SenderIPv4 addresses. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery48",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for Admin email access",
+            "elements": [
+              {
+                "name": "huntingquery48-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps report on email access by administrators This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery49",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for TABL changes",
+            "elements": [
+              {
+                "name": "huntingquery49-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery50",
+            "type": "Microsoft.Common.Section",
+            "label": "Local time to UTC time conversion",
+            "elements": [
+              {
+                "name": "huntingquery50-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Advanced Hunting has default timezone as UTC time. Filters in Advanced Hunting also work in UTC by default whereas query results are shown in local time if user has selected local time zone in security center settings. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery51",
+            "type": "Microsoft.Common.Section",
+            "label": "Mail item accessed",
+            "elements": [
+              {
+                "name": "huntingquery51-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing emails accessed by end users using cloud app events data This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery52",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious email senders",
+            "elements": [
+              {
+                "name": "huntingquery52-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for emails from a sender with at least one email in quarantine This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery53",
+            "type": "Microsoft.Common.Section",
+            "label": "MDO daily detection summary report",
+            "elements": [
+              {
+                "name": "huntingquery53-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents AlertEvidence EmailEvents EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery54",
+            "type": "Microsoft.Common.Section",
+            "label": "New TABL Items",
+            "elements": [
+              {
+                "name": "huntingquery54-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps identifying when new items being added to the Tenant/Allow Block List (TABL) in Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery55",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)",
+            "elements": [
+              {
+                "name": "huntingquery55-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies the top 10 sender domains delivering inbound emails classified as malware, phishing, or spam.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery56",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 External Senders (Malware)",
+            "elements": [
+              {
+                "name": "huntingquery56-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies the top 10 external sender addresses delivering inbound emails classified as malware.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the malware filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery57",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 External Senders (Phish)",
+            "elements": [
+              {
+                "name": "huntingquery57-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies the top 10 external sender addresses delivering inbound emails classified as phishing.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the phishing filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery58",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 External Senders (Spam)",
+            "elements": [
+              {
+                "name": "huntingquery58-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies the top 10 external sender addresses delivering inbound emails classified as spam.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery59",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 External Senders (Spam)",
+            "elements": [
+              {
+                "name": "huntingquery59-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies the top 10 external sender addresses delivering inbound emails classified as spam.\nTo exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery60",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Targeted Users (Malware+Phish+Spam)",
+            "elements": [
+              {
+                "name": "huntingquery60-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies the top 10 users receiving inbound emails classified as malware, phishing, or spam.\nBased on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery61",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)",
+            "elements": [
+              {
+                "name": "huntingquery61-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Visualises the top 10 users with click attempts on URLs in emails detected as malware, phishing, or spam, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery62",
+            "type": "Microsoft.Common.Section",
+            "label": "MDO Threat Protection Detections trend over time",
+            "elements": [
+              {
+                "name": "huntingquery62-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Graph of MDO detections trended over time This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery63",
+            "type": "Microsoft.Common.Section",
+            "label": "Total number of detections by MDO",
+            "elements": [
+              {
+                "name": "huntingquery63-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Provides a summary of total number of detections This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery64",
+            "type": "Microsoft.Common.Section",
+            "label": "Automated email notifications and suspicious sign-in activity",
+            "elements": [
+              {
+                "name": "huntingquery64-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for Automated email notifications and suspicious sign-in activity This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents AADSignInEventsBeta Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery65",
+            "type": "Microsoft.Common.Section",
+            "label": "BEC - File sharing tactics - Dropbox",
+            "elements": [
+              {
+                "name": "huntingquery65-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for BEC - File sharing tactics - Dropbox This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery66",
+            "type": "Microsoft.Common.Section",
+            "label": "BEC - File sharing tactics - OneDrive or SharePoint",
+            "elements": [
+              {
+                "name": "huntingquery66-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery67",
+            "type": "Microsoft.Common.Section",
+            "label": "Email bombing attacks",
+            "elements": [
+              {
+                "name": "huntingquery67-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing recipients who are potentially victim of email bombing attacks This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery68",
+            "type": "Microsoft.Common.Section",
+            "label": "Emails containing links to IP addresses",
+            "elements": [
+              {
+                "name": "huntingquery68-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for Emails containing links to IP addresses This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery69",
+            "type": "Microsoft.Common.Section",
+            "label": "Files share contents and suspicious sign-in activity",
+            "elements": [
+              {
+                "name": "huntingquery69-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for Files share contents and suspicious sign-in activity This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents AADSignInEventsBeta Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery70",
+            "type": "Microsoft.Common.Section",
+            "label": "Good emails from senders with bad patterns",
+            "elements": [
+              {
+                "name": "huntingquery70-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for good emails from senders with bad patterns This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery71",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for email bombing attacks",
+            "elements": [
+              {
+                "name": "huntingquery71-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps to hunt for possible email bombing attacks in Microsoft Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery72",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for email conversation take over attempts",
+            "elements": [
+              {
+                "name": "huntingquery72-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for email conversation take over attempts This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery73",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for malicious attachments using external IOC source",
+            "elements": [
+              {
+                "name": "huntingquery73-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source This hunting query depends on MicrosoftThreatProtection data connector (EmailAttachmentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery74",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for malicious URLs using external IOC source",
+            "elements": [
+              {
+                "name": "huntingquery74-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for emails with malicious URLs based on external IOC source This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery75",
+            "type": "Microsoft.Common.Section",
+            "label": "Inbox rule changes which forward-redirect email",
+            "elements": [
+              {
+                "name": "huntingquery75-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for Inbox rule changes which forward-redirect email This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery76",
+            "type": "Microsoft.Common.Section",
+            "label": "MDO_CountOfRecipientsEmailaddressbySubject",
+            "elements": [
+              {
+                "name": "huntingquery76-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Count of recipient's email addresses by subject This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery77",
+            "type": "Microsoft.Common.Section",
+            "label": "MDO_Countofrecipientsemailaddressesbysubject",
+            "elements": [
+              {
+                "name": "huntingquery77-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Count of recipient's email addresses by subject This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery78",
+            "type": "Microsoft.Common.Section",
+            "label": "MDO_CountOfSendersEmailaddressbySubject",
+            "elements": [
+              {
+                "name": "huntingquery78-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Count of sender's email addresses by subject This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery79",
+            "type": "Microsoft.Common.Section",
+            "label": "MDO_SummaryOfSenders",
+            "elements": [
+              {
+                "name": "huntingquery79-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Count of all Senders and where they were delivered This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery80",
+            "type": "Microsoft.Common.Section",
+            "label": "MDO_URLClickedinEmail",
+            "elements": [
+              {
+                "name": "huntingquery80-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "URLs clicked in Email This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery81",
+            "type": "Microsoft.Common.Section",
+            "label": "Top outbound recipient domains sending inbound emails with threats",
+            "elements": [
+              {
+                "name": "huntingquery81-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for top outbound recipient domains which are sending inbound emails with threats This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery82",
+            "type": "Microsoft.Common.Section",
+            "label": "Detections by detection methods",
+            "elements": [
+              {
+                "name": "huntingquery82-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing malicious email detections by detection methods This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery83",
+            "type": "Microsoft.Common.Section",
+            "label": "Mail reply to new domain",
+            "elements": [
+              {
+                "name": "huntingquery83-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery84",
+            "type": "Microsoft.Common.Section",
+            "label": "Mailflow by directionality",
+            "elements": [
+              {
+                "name": "huntingquery84-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing inbound / outbound / intra-org emails by domain per day This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery85",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious emails detected per day",
+            "elements": [
+              {
+                "name": "huntingquery85-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing Malware, Phishing, Spam emails caught per day This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery86",
+            "type": "Microsoft.Common.Section",
+            "label": "Sender recipient contact establishment",
+            "elements": [
+              {
+                "name": "huntingquery86-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps in checking the sender-recipient contact establishment status This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery87",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam Detections (High) by delivery location",
+            "elements": [
+              {
+                "name": "huntingquery87-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails with Spam detections (High confidence) summarizing the data by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery88",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam Detections (Normal) by delivery location",
+            "elements": [
+              {
+                "name": "huntingquery88-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery89",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 100 malicious email senders",
+            "elements": [
+              {
+                "name": "huntingquery89-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing top 100 malicious senders This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery90",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 100 senders",
+            "elements": [
+              {
+                "name": "huntingquery90-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing top 100 senders in your organization in last 30 days This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery91",
+            "type": "Microsoft.Common.Section",
+            "label": "Zero day threats",
+            "elements": [
+              {
+                "name": "huntingquery91-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing zero day threats via URL and file detonations This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery92",
+            "type": "Microsoft.Common.Section",
+            "label": "Email containing malware accessed on a unmanaged device",
+            "elements": [
+              {
+                "name": "huntingquery92-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we are looking for emails containing malware accessed on a unmanaged device This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents CloudAppEvents AADSignInEventsBeta Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery93",
+            "type": "Microsoft.Common.Section",
+            "label": "Email containing malware sent by an internal sender",
+            "elements": [
+              {
+                "name": "huntingquery93-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we are looking for emails containing malware attachment sent by an internal sender This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery94",
+            "type": "Microsoft.Common.Section",
+            "label": "Email malware detection report",
+            "elements": [
+              {
+                "name": "huntingquery94-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing email malware detection cases This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailAttachmentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery95",
+            "type": "Microsoft.Common.Section",
+            "label": "File Malware Detection Trend",
+            "elements": [
+              {
+                "name": "huntingquery95-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery96",
+            "type": "Microsoft.Common.Section",
+            "label": "File Malware by Top Malware Families (Anti Virus)",
+            "elements": [
+              {
+                "name": "huntingquery96-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery97",
+            "type": "Microsoft.Common.Section",
+            "label": "File Malware by Top Malware Families (Safe Attachments)",
+            "elements": [
+              {
+                "name": "huntingquery97-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations) This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery98",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery98-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Malware detections over time summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery99",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware Detections by delivery location",
+            "elements": [
+              {
+                "name": "huntingquery99-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery100",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware Detections by Detection technology Trend",
+            "elements": [
+              {
+                "name": "huntingquery100-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery101",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware Detections by Detection technology",
+            "elements": [
+              {
+                "name": "huntingquery101-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery102",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware detections by Workload Locations",
+            "elements": [
+              {
+                "name": "huntingquery102-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery103",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware detections by Workload Type",
+            "elements": [
+              {
+                "name": "huntingquery103-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery104",
+            "type": "Microsoft.Common.Section",
+            "label": "Email Top Domains sending Malware",
+            "elements": [
+              {
+                "name": "huntingquery104-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery105",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Malware Families",
+            "elements": [
+              {
+                "name": "huntingquery105-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery106",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Users receiving Malware",
+            "elements": [
+              {
+                "name": "huntingquery106-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery107",
+            "type": "Microsoft.Common.Section",
+            "label": "Zero-day Malware Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery107-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery108",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams communication from suspicious external users",
+            "elements": [
+              {
+                "name": "huntingquery108-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for communication from suspicious external users. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery109",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams communication to suspicious external users",
+            "elements": [
+              {
+                "name": "huntingquery109-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for communication with suspicious external users. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery110",
+            "type": "Microsoft.Common.Section",
+            "label": "Expanding recipients into separate rows",
+            "elements": [
+              {
+                "name": "huntingquery110-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for recipients of Teams messages. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery111",
+            "type": "Microsoft.Common.Section",
+            "label": "External malicious Teams messages sent from internal senders",
+            "elements": [
+              {
+                "name": "huntingquery111-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for external malicious Teams messages sent from internal senders This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery112",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for malicious messages using External Threat Intelligence",
+            "elements": [
+              {
+                "name": "huntingquery112-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source This hunting query depends on MicrosoftThreatProtection data connector (MessageUrlInfo MessageEvents UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery113",
+            "type": "Microsoft.Common.Section",
+            "label": "Inbound Teams messages by sender domains",
+            "elements": [
+              {
+                "name": "huntingquery113-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing volume of inbound external Teams message by sender domains This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery114",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious Teams messages by URL detection methods",
+            "elements": [
+              {
+                "name": "huntingquery114-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing malicious Teams message detections by URL detection methods This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery115",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious Teams messages received from external senders",
+            "elements": [
+              {
+                "name": "huntingquery115-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for malicious Teams messages received from external senders. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery116",
+            "type": "Microsoft.Common.Section",
+            "label": "Microsoft Teams chat initiated by a suspicious external user",
+            "elements": [
+              {
+                "name": "huntingquery116-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages. This hunting query depends on MicrosoftThreatProtection data connector (AlertInfo AlertEvidence Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery117",
+            "type": "Microsoft.Common.Section",
+            "label": "Number of unique accounts performing Teams message Admin submissions",
+            "elements": [
+              {
+                "name": "huntingquery117-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises number of unqiue accounts performing Teams message admin submissions as false negatives or false positives This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery118",
+            "type": "Microsoft.Common.Section",
+            "label": "Number of unique accounts performing Teams message User  submissions",
+            "elements": [
+              {
+                "name": "huntingquery118-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises number of unqiue accounts performing Teams message user submissions as false negatives or false positives This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery119",
+            "type": "Microsoft.Common.Section",
+            "label": "Possible partner impersonation in external Team messages",
+            "elements": [
+              {
+                "name": "huntingquery119-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery120",
+            "type": "Microsoft.Common.Section",
+            "label": "Possible Teams phishing activity",
+            "elements": [
+              {
+                "name": "huntingquery120-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for possible Teams phishing activity. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery121",
+            "type": "Microsoft.Common.Section",
+            "label": "Potentially malicious URL click in Teams",
+            "elements": [
+              {
+                "name": "huntingquery121-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query provides insights on a potentially malicious URL click in Teams This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents MessageUrlInfo UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery122",
+            "type": "Microsoft.Common.Section",
+            "label": "Rare Domains in External Teams Messages",
+            "elements": [
+              {
+                "name": "huntingquery122-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Detects rare domains (seen in fewer than 3 Teams messages) appearing in external Microsoft Teams threads within the last 24 hours. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents MessageUrlInfo UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery123",
+            "type": "Microsoft.Common.Section",
+            "label": "Suspicious Teams Display Name",
+            "elements": [
+              {
+                "name": "huntingquery123-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for Teams messages from an external user with a suspicious display name. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery124",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams Admin submission of Malware and Phish daily trend",
+            "elements": [
+              {
+                "name": "huntingquery124-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of admin false negative Teams message submissions by submission type of Phish or Malware This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery125",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams Admin submission of No Threats daily trend",
+            "elements": [
+              {
+                "name": "huntingquery125-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of admin false positive Teams message submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery126",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams Admin-User Submissions Grading Verdicts",
+            "elements": [
+              {
+                "name": "huntingquery126-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualizes Teams messages submitted by users or admins then graded in the submission process. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery127",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams blocked URL clicks daily trend",
+            "elements": [
+              {
+                "name": "huntingquery127-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery128",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams Malware ZAP",
+            "elements": [
+              {
+                "name": "huntingquery128-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for Teams messages with Malware threats that have been ZAPed. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery129",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams Message with URL listed on OpenPhish",
+            "elements": [
+              {
+                "name": "huntingquery129-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish was delivered. This hunting query depends on MicrosoftThreatProtection data connector (MessageUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery130",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams message ZAPed with the same URL in Email",
+            "elements": [
+              {
+                "name": "huntingquery130-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for Teams messages that have been ZAPed with the same URL in Email. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents MessageUrlInfo EmailUrlInfo EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery131",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams messages from a specific sender by ThreadType",
+            "elements": [
+              {
+                "name": "huntingquery131-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for Teams messages from a specific sender by ThreadType. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery132",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams messages with suspicious URL domains",
+            "elements": [
+              {
+                "name": "huntingquery132-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for Teams messages with suspicious URL domains. This hunting query depends on MicrosoftThreatProtection data connector (MessageUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery133",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams Phish ZAP",
+            "elements": [
+              {
+                "name": "huntingquery133-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for Teams messages with Phish threats that have been ZAPed. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery134",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams post delivery events daily trend",
+            "elements": [
+              {
+                "name": "huntingquery134-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualizes the daily amount of post delivery events on Teams messages. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery135",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams Spam ZAP",
+            "elements": [
+              {
+                "name": "huntingquery135-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for Teams messages with Spam threats that have been ZAPed. This hunting query depends on MicrosoftThreatProtection data connector (MessagePostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery136",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams URL clicks actions summarized by URLs clicked on",
+            "elements": [
+              {
+                "name": "huntingquery136-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery137",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs",
+            "elements": [
+              {
+                "name": "huntingquery137-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery138",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams User submissions daily trend",
+            "elements": [
+              {
+                "name": "huntingquery138-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of user false negative and false postive Teams message submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery139",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams users clicking on suspicious URL domains",
+            "elements": [
+              {
+                "name": "huntingquery139-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for Teams users clicking on suspicious URL domains. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents MessageEvents MessageUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery140",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Attacked user by Phish messages",
+            "elements": [
+              {
+                "name": "huntingquery140-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Top 10 attacked users by Phish messages from external senders using Teams This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery141",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 external senders sending Teams messages",
+            "elements": [
+              {
+                "name": "huntingquery141-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visulises all up Top 10 external senders sending Teams messages This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery142",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 External senders sending Teams phishing messsages",
+            "elements": [
+              {
+                "name": "huntingquery142-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looking for top 10 External senders sending Team phishing messsages. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery143",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 sender domains - Admin Teams message submissions FN",
+            "elements": [
+              {
+                "name": "huntingquery143-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery144",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 sender domains - Teams user submissions FN or FP",
+            "elements": [
+              {
+                "name": "huntingquery144-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery145",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 senders - Teams users submissions FN or FP",
+            "elements": [
+              {
+                "name": "huntingquery145-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery146",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 senders of  Admin Teams message submissions FN",
+            "elements": [
+              {
+                "name": "huntingquery146-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery147",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 senders of  Admin Teams message submissions FP",
+            "elements": [
+              {
+                "name": "huntingquery147-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises Teams messages submitted by admins as false positives, summarizing the data by top 10 indidvidual senders of those messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery148",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Users clicking on malicious URLs in Teams",
+            "elements": [
+              {
+                "name": "huntingquery148-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery149",
+            "type": "Microsoft.Common.Section",
+            "label": "Top accounts performing Teams admin submissions FN or FP",
+            "elements": [
+              {
+                "name": "huntingquery149-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top admins performing false negative or false positive admin submissions of Teams messages This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery150",
+            "type": "Microsoft.Common.Section",
+            "label": "Top accounts performing Teams user submissions FN or FP",
+            "elements": [
+              {
+                "name": "huntingquery150-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top users performing false negative or false positive user submissions of Teams messages This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery151",
+            "type": "Microsoft.Common.Section",
+            "label": "Top domains outbound sending Malicious Teams messages inbound",
+            "elements": [
+              {
+                "name": "huntingquery151-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looking for potential partner compromise via comparing outbound Teams message traffic per target domain and looking for malicious Teams messages from the same domains as inbound. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery152",
+            "type": "Microsoft.Common.Section",
+            "label": "Top External malicious Senders",
+            "elements": [
+              {
+                "name": "huntingquery152-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Top external senders sending malicious inbound Teams messages Spam, Phish, Malware This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery153",
+            "type": "Microsoft.Common.Section",
+            "label": "Top External Sender domains - Malware",
+            "elements": [
+              {
+                "name": "huntingquery153-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Top External Sender domains sending Teams message with Malware threats This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery154",
+            "type": "Microsoft.Common.Section",
+            "label": "Top External Sender domains - Phish",
+            "elements": [
+              {
+                "name": "huntingquery154-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Top External Sender domains sending Teams message with Phish threats This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery155",
+            "type": "Microsoft.Common.Section",
+            "label": "Top External Sender domains - Spam",
+            "elements": [
+              {
+                "name": "huntingquery155-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Top External Sender domains sending Teams message with Spam threats This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery156",
+            "type": "Microsoft.Common.Section",
+            "label": "Top malicious URLs clicked by users in Teams",
+            "elements": [
+              {
+                "name": "huntingquery156-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunt for top malicious URLs clicked by users in Teams This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery157",
+            "type": "Microsoft.Common.Section",
+            "label": "Total number of MDO Teams protection detections daily",
+            "elements": [
+              {
+                "name": "huntingquery157-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visulises Total number of MDO Teams protection detections daily This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery158",
+            "type": "Microsoft.Common.Section",
+            "label": "URL click on URLs in ZAP-d Teams messages",
+            "elements": [
+              {
+                "name": "huntingquery158-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents MessagePostDeliveryEvents MessageUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery159",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam and Phish allowed to inbox by Admin Overrides",
+            "elements": [
+              {
+                "name": "huntingquery159-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps in reviewing malicious emails allowed due to admin overrides This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery160",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam and Phish allowed to inbox by User Overrides",
+            "elements": [
+              {
+                "name": "huntingquery160-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps in reviewing malicious emails allowed due to user overrides This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery161",
+            "type": "Microsoft.Common.Section",
+            "label": "Top policies performing admin overrides",
+            "elements": [
+              {
+                "name": "huntingquery161-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps in reviewing top policies for admin overrides (Allow/Block) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery162",
+            "type": "Microsoft.Common.Section",
+            "label": "Top policies performing user overrides",
+            "elements": [
+              {
+                "name": "huntingquery162-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps in reviewing top policies for user overrides (Allow/Block) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery163",
+            "type": "Microsoft.Common.Section",
+            "label": "Total Emails with Admin Overrides (Allow)",
+            "elements": [
+              {
+                "name": "huntingquery163-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery164",
+            "type": "Microsoft.Common.Section",
+            "label": "Total Emails with Admin Overrides (Block)",
+            "elements": [
+              {
+                "name": "huntingquery164-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery165",
+            "type": "Microsoft.Common.Section",
+            "label": "Total Emails with User Overrides (Allow)",
+            "elements": [
+              {
+                "name": "huntingquery165-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery166",
+            "type": "Microsoft.Common.Section",
+            "label": "Total Emails with User Overrides (Block)",
+            "elements": [
+              {
+                "name": "huntingquery166-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery167",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery167-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish detections over time summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery168",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detections (High) by delivery location",
+            "elements": [
+              {
+                "name": "huntingquery168-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery169",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detections (Normal) by delivery location",
+            "elements": [
+              {
+                "name": "huntingquery169-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery170",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detections by delivery location trend",
+            "elements": [
+              {
+                "name": "huntingquery170-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery171",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detections by Detection technology Trend",
+            "elements": [
+              {
+                "name": "huntingquery171-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery172",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detections by Detection technology",
+            "elements": [
+              {
+                "name": "huntingquery172-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish detections summarizing the data by various Phish detection technologies/controls This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery173",
+            "type": "Microsoft.Common.Section",
+            "label": "Possible device code phishing attempts",
+            "elements": [
+              {
+                "name": "huntingquery173-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps hunting for possible device code Phishing attempts This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents AADSignInEventsBeta Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery174",
+            "type": "Microsoft.Common.Section",
+            "label": "Email Top Domains sending Phish",
+            "elements": [
+              {
+                "name": "huntingquery174-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery175",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Users receiving Phish",
+            "elements": [
+              {
+                "name": "huntingquery175-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery176",
+            "type": "Microsoft.Common.Section",
+            "label": "Zero-day Phish Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery176-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery177",
+            "type": "Microsoft.Common.Section",
+            "label": "Campaign with randomly named attachments",
+            "elements": [
+              {
+                "name": "huntingquery177-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery178",
+            "type": "Microsoft.Common.Section",
+            "label": "Campaign with suspicious keywords",
+            "elements": [
+              {
+                "name": "huntingquery178-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this detection, we track emails with suspicious keywords in subjects. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery179",
+            "type": "Microsoft.Common.Section",
+            "label": "Custom detection-Emails with QR from non-prevalent senders",
+            "elements": [
+              {
+                "name": "huntingquery179-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery180",
+            "type": "Microsoft.Common.Section",
+            "label": "Emails delivered having URLs from QR codes",
+            "elements": [
+              {
+                "name": "huntingquery180-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we hunt for inbound emails delivered having URLs from QR codes This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery181",
+            "type": "Microsoft.Common.Section",
+            "label": "Emails with QR codes and suspicious keywords in subject",
+            "elements": [
+              {
+                "name": "huntingquery181-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery182",
+            "type": "Microsoft.Common.Section",
+            "label": "Emails with QR codes from non-prevalent sender",
+            "elements": [
+              {
+                "name": "huntingquery182-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery183",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunting for sender patterns",
+            "elements": [
+              {
+                "name": "huntingquery183-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailAttachmentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery184",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunting for user signals-clusters",
+            "elements": [
+              {
+                "name": "huntingquery184-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery185",
+            "type": "Microsoft.Common.Section",
+            "label": "Inbound emails with QR code URLs",
+            "elements": [
+              {
+                "name": "huntingquery185-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we summarize volume of inbound emails with QR code URLs in last 30 days This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery186",
+            "type": "Microsoft.Common.Section",
+            "label": "Personalized campaigns based on the first few keywords",
+            "elements": [
+              {
+                "name": "huntingquery186-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this detection, we track emails with personalized subjects. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery187",
+            "type": "Microsoft.Common.Section",
+            "label": "Personalized campaigns based on the last few keywords",
+            "elements": [
+              {
+                "name": "huntingquery187-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this detection, we track emails with personalized subjects. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery188",
+            "type": "Microsoft.Common.Section",
+            "label": "Risky sign-in attempt from a non-managed device",
+            "elements": [
+              {
+                "name": "huntingquery188-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery189",
+            "type": "Microsoft.Common.Section",
+            "label": "Suspicious sign-in attempts from QR code phishing campaigns",
+            "elements": [
+              {
+                "name": "huntingquery189-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents AADSignInEventsBeta Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery190",
+            "type": "Microsoft.Common.Section",
+            "label": "Group quarantine release",
+            "elements": [
+              {
+                "name": "huntingquery190-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery191",
+            "type": "Microsoft.Common.Section",
+            "label": "High Confidence Phish Released",
+            "elements": [
+              {
+                "name": "huntingquery191-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query shows information about high confidence phish email that has been released from the Quarantine. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery192",
+            "type": "Microsoft.Common.Section",
+            "label": "Quarantine Phish Reason trend",
+            "elements": [
+              {
+                "name": "huntingquery192-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery193",
+            "type": "Microsoft.Common.Section",
+            "label": "Quarantine Phish Reason",
+            "elements": [
+              {
+                "name": "huntingquery193-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total amount of phish emails that are quarantined, summarized by the detection method This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery194",
+            "type": "Microsoft.Common.Section",
+            "label": "Quarantine Release Email Details",
+            "elements": [
+              {
+                "name": "huntingquery194-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query shows information about email that has been released from the Quarantine in Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery195",
+            "type": "Microsoft.Common.Section",
+            "label": "Quarantine release trend",
+            "elements": [
+              {
+                "name": "huntingquery195-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing quarantine release trend in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery196",
+            "type": "Microsoft.Common.Section",
+            "label": "Quarantine releases by Detection Types",
+            "elements": [
+              {
+                "name": "huntingquery196-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails released from quarantine and summarizing the result by the original filter verdict This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery197",
+            "type": "Microsoft.Common.Section",
+            "label": "Quarantine Spam Reason trend",
+            "elements": [
+              {
+                "name": "huntingquery197-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery198",
+            "type": "Microsoft.Common.Section",
+            "label": "Quarantine Spam Reason",
+            "elements": [
+              {
+                "name": "huntingquery198-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total amount of spam emails that are quarantined, summarized by the detection method This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery199",
+            "type": "Microsoft.Common.Section",
+            "label": "AIR investigation actions insight",
+            "elements": [
+              {
+                "name": "huntingquery199-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query provides insights into AIR investigation actions in Microsoft Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery200",
+            "type": "Microsoft.Common.Section",
+            "label": "Listing Email Remediation Actions via Explorer",
+            "elements": [
+              {
+                "name": "huntingquery200-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Listing Email Remediation Actions performed via Explorer in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery201",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 domains sending Bulk email",
+            "elements": [
+              {
+                "name": "huntingquery201-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total inbound emails which has any Bulk complaint level. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery202",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam detection by delivery location",
+            "elements": [
+              {
+                "name": "huntingquery202-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery203",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam detection by IP and its location",
+            "elements": [
+              {
+                "name": "huntingquery203-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery204",
+            "type": "Microsoft.Common.Section",
+            "label": "Bulk Emails by Sender Bulk Complaint level",
+            "elements": [
+              {
+                "name": "huntingquery204-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total inbound emails which has any Bulk complaint level. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery205",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam detection technologies",
+            "elements": [
+              {
+                "name": "huntingquery205-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery206",
+            "type": "Microsoft.Common.Section",
+            "label": "Email Top 10 Domains sending Spam",
+            "elements": [
+              {
+                "name": "huntingquery206-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total inbound emails with Spam detections. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery207",
+            "type": "Microsoft.Common.Section",
+            "label": "Email Top 10 Targeted Users (Spam)",
+            "elements": [
+              {
+                "name": "huntingquery207-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises top 10 users targeted with Spam. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery208",
+            "type": "Microsoft.Common.Section",
+            "label": "Email Top 15 Domains sending Spam with Additional Details",
+            "elements": [
+              {
+                "name": "huntingquery208-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery209",
+            "type": "Microsoft.Common.Section",
+            "label": "Email Top 15 Targeted Users (Spam) with Additional Details",
+            "elements": [
+              {
+                "name": "huntingquery209-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises top 15 users targeted with Spam with summarized spam detections. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery210",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam detection trend",
+            "elements": [
+              {
+                "name": "huntingquery210-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spam detections over time summarizing the data daily This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery211",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam Detections by Detection technology",
+            "elements": [
+              {
+                "name": "huntingquery211-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery212",
+            "type": "Microsoft.Common.Section",
+            "label": "Display Name - Spoof and Impersonation",
+            "elements": [
+              {
+                "name": "huntingquery212-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery213",
+            "type": "Microsoft.Common.Section",
+            "label": "Impersonation Detections by Detection Technology Trend",
+            "elements": [
+              {
+                "name": "huntingquery213-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery214",
+            "type": "Microsoft.Common.Section",
+            "label": "Impersonation Detections by Detection Technology",
+            "elements": [
+              {
+                "name": "huntingquery214-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery215",
+            "type": "Microsoft.Common.Section",
+            "label": "Impersonation Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery215-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish (BEC) - Impersonation detections over time. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery216",
+            "type": "Microsoft.Common.Section",
+            "label": "referral-phish-emails",
+            "elements": [
+              {
+                "name": "huntingquery216-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Hunting for credential phishing using the \"Referral\" infrastructure using Defender for Office 365 data This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery217",
+            "type": "Microsoft.Common.Section",
+            "label": "Spoof and impersonation detections by sender IP",
+            "elements": [
+              {
+                "name": "huntingquery217-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing count of spoof and impersonation detections done per sender IP This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery218",
+            "type": "Microsoft.Common.Section",
+            "label": "Spoof and impersonation phish detections",
+            "elements": [
+              {
+                "name": "huntingquery218-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing count of phish detections done by spoof detection methods This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery219",
+            "type": "Microsoft.Common.Section",
+            "label": "Spoof Detections by Detection Technology Trend",
+            "elements": [
+              {
+                "name": "huntingquery219-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology over time This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery220",
+            "type": "Microsoft.Common.Section",
+            "label": "Spoof Detections by Detection Technology",
+            "elements": [
+              {
+                "name": "huntingquery220-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery221",
+            "type": "Microsoft.Common.Section",
+            "label": "Spoof Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery221-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery222",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Domains Outbound with Emails with Threats Inbound (Partner BEC)",
+            "elements": [
+              {
+                "name": "huntingquery222-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery223",
+            "type": "Microsoft.Common.Section",
+            "label": "User not covered under display name impersonation",
+            "elements": [
+              {
+                "name": "huntingquery223-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps to find threats using display name impersonation for users not already protected with User Impersonation This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents IdentityInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery224",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submission Trend (FN)",
+            "elements": [
+              {
+                "name": "huntingquery224-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of admin false negative submission by submission type. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery225",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submission Trend (FP)",
+            "elements": [
+              {
+                "name": "huntingquery225-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of admin false positive submission by submission type. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery226",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submissions by DetectionMethod (Phish FP)",
+            "elements": [
+              {
+                "name": "huntingquery226-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the original detection technology of emails submitted as phish false positive by admins This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery227",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submissions by DetectionMethod (Spam FP)",
+            "elements": [
+              {
+                "name": "huntingquery227-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the original detection technology of emails submitted as spam false positive by admins This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery228",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submissions by Detection Type",
+            "elements": [
+              {
+                "name": "huntingquery228-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery229",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submissions by Grading verdict (FN-FP)",
+            "elements": [
+              {
+                "name": "huntingquery229-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery230",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submissions by Submission State (FN)",
+            "elements": [
+              {
+                "name": "huntingquery230-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total amount of admin false negative submissions by the state of the submission. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery231",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submissions by Submission State (FP)",
+            "elements": [
+              {
+                "name": "huntingquery231-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total amount of admin false positive submissions by the state of the submission. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery232",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submissions by Submission Type (FN)",
+            "elements": [
+              {
+                "name": "huntingquery232-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing admin reported email submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery233",
+            "type": "Microsoft.Common.Section",
+            "label": "Admin Submissions by Submission Type (FP)",
+            "elements": [
+              {
+                "name": "huntingquery233-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total amount of admin false positive submission by submission type. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery234",
+            "type": "Microsoft.Common.Section",
+            "label": "Top accounts performing admin submissions (FN)",
+            "elements": [
+              {
+                "name": "huntingquery234-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top admins performing false negative submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery235",
+            "type": "Microsoft.Common.Section",
+            "label": "Top accounts performing admin submissions (FP)",
+            "elements": [
+              {
+                "name": "huntingquery235-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top admins performing false positive submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery236",
+            "type": "Microsoft.Common.Section",
+            "label": "Top accounts performing user submissions",
+            "elements": [
+              {
+                "name": "huntingquery236-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query graphs top accounts performing user submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery237",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Detection Overrides - Admin Email Submissions (FN)",
+            "elements": [
+              {
+                "name": "huntingquery237-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery238",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 sender domains - Admin email submissions (FN)",
+            "elements": [
+              {
+                "name": "huntingquery238-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery239",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 sender domains - Admin email submissions (FP)",
+            "elements": [
+              {
+                "name": "huntingquery239-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery240",
+            "type": "Microsoft.Common.Section",
+            "label": "Total Submissions by Submission Type",
+            "elements": [
+              {
+                "name": "huntingquery240-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Total Submissions by Submission Status This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery241",
+            "type": "Microsoft.Common.Section",
+            "label": "Total Submissions by Submission Type",
+            "elements": [
+              {
+                "name": "huntingquery241-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Total Submissions by Submission Type This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery242",
+            "type": "Microsoft.Common.Section",
+            "label": "User reported submissions",
+            "elements": [
+              {
+                "name": "huntingquery242-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing user reported email submissions This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery243",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions accuracy vs Admin review verdict",
+            "elements": [
+              {
+                "name": "huntingquery243-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises user submissions type compared to admin review verdict This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery244",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FN) - Top Detection Overrides by Admins",
+            "elements": [
+              {
+                "name": "huntingquery244-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery245",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FN) - Top Detection Overrides by Users",
+            "elements": [
+              {
+                "name": "huntingquery245-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery246",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FN) - Top Inbound P2 Senders domains",
+            "elements": [
+              {
+                "name": "huntingquery246-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises top sender domains of inbound emails submitted as false negatives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery247",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FN) - Top Inbound P2 Senders",
+            "elements": [
+              {
+                "name": "huntingquery247-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises top sender email addresses of inbound emails submitted as false negatives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery248",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FN) - Top Intra-Org P2 Senders",
+            "elements": [
+              {
+                "name": "huntingquery248-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises top sender email addresses of intra-org emails submitted as false negatives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery249",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FN) - Top Intra-Org Subjects",
+            "elements": [
+              {
+                "name": "huntingquery249-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises top 10 subjects of intra-org emails submitted as false negatives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery250",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions by Admin review status (Mark and Notify)",
+            "elements": [
+              {
+                "name": "huntingquery250-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises user submissions where admin also performed 'mark and notify' action on the submission This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery251",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FN-FP) by Grading verdict",
+            "elements": [
+              {
+                "name": "huntingquery251-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery252",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FN) by Submission Type",
+            "elements": [
+              {
+                "name": "huntingquery252-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total ammount of user false negative submission by submission type, including the phish simulations reported emails This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery253",
+            "type": "Microsoft.Common.Section",
+            "label": "User email submissions (FN) from Junk Folder",
+            "elements": [
+              {
+                "name": "huntingquery253-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the total ammount of user false negative submissions from the junk folder This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery254",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submission Trend (FN)",
+            "elements": [
+              {
+                "name": "huntingquery254-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery255",
+            "type": "Microsoft.Common.Section",
+            "label": "Attacked more than x times average",
+            "elements": [
+              {
+                "name": "huntingquery255-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing count of users attacked more than x times average. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery256",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious mails by sender IPs",
+            "elements": [
+              {
+                "name": "huntingquery256-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing sender IPs sending malicious email of type Malware or Phish This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery257",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10% of most attacked users",
+            "elements": [
+              {
+                "name": "huntingquery257-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing the list of top 10% of most attacked users This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery258",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 URL domains attacking organization",
+            "elements": [
+              {
+                "name": "huntingquery258-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing list of top 10 URL domains attacking the organization This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery259",
+            "type": "Microsoft.Common.Section",
+            "label": "Top external malicious senders",
+            "elements": [
+              {
+                "name": "huntingquery259-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery260",
+            "type": "Microsoft.Common.Section",
+            "label": "Top targeted users",
+            "elements": [
+              {
+                "name": "huntingquery260-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery261",
+            "type": "Microsoft.Common.Section",
+            "label": "End user malicious clicks",
+            "elements": [
+              {
+                "name": "huntingquery261-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing list of top users click on Phis URLs This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery262",
+            "type": "Microsoft.Common.Section",
+            "label": "URL click count by click action",
+            "elements": [
+              {
+                "name": "huntingquery262-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing URL click count by ClickAction This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery263",
+            "type": "Microsoft.Common.Section",
+            "label": "URL click on ZAP email",
+            "elements": [
+              {
+                "name": "huntingquery263-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Alertinfo AlertEvidence Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery264",
+            "type": "Microsoft.Common.Section",
+            "label": "URL clicks actions by URL",
+            "elements": [
+              {
+                "name": "huntingquery264-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we are looking URL click actions by URL in the last 7 days This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery265",
+            "type": "Microsoft.Common.Section",
+            "label": "URLClick details based on malicious URL click alert",
+            "elements": [
+              {
+                "name": "huntingquery265-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Alertinfo AlertEvidence Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery266",
+            "type": "Microsoft.Common.Section",
+            "label": "User clicked through events",
+            "elements": [
+              {
+                "name": "huntingquery266-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery267",
+            "type": "Microsoft.Common.Section",
+            "label": "User clicks on malicious inbound emails",
+            "elements": [
+              {
+                "name": "huntingquery267-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query provides insights on users who clicked on a suspicious URL This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery268",
+            "type": "Microsoft.Common.Section",
+            "label": "User clicks on phishing URLs in emails",
+            "elements": [
+              {
+                "name": "huntingquery268-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query helps in determining clickthroughs when email delivered because of detection overrides. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery269",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious Clicks allowed (click-through)",
+            "elements": [
+              {
+                "name": "huntingquery269-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery270",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious Emails with QR code Urls",
+            "elements": [
+              {
+                "name": "huntingquery270-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery271",
+            "type": "Microsoft.Common.Section",
+            "label": "PhishingEmailUrlRedirector (1)",
+            "elements": [
+              {
+                "name": "huntingquery271-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data. This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery272",
+            "type": "Microsoft.Common.Section",
+            "label": "SafeLinks URL detections",
+            "elements": [
+              {
+                "name": "huntingquery272-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query provides insights on the detections done by SafeLinks protection in Defender for Office 365 This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery273",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Users clicking on Malicious URLs (Malware)",
+            "elements": [
+              {
+                "name": "huntingquery273-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery274",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Users clicking on Malicious URLs (Phish)",
+            "elements": [
+              {
+                "name": "huntingquery274-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery275",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 10 Users clicking on Malicious URLs (Spam)",
+            "elements": [
+              {
+                "name": "huntingquery275-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Visualises the top 10 users with click attempts on URLs in emails detected as spam, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery276",
+            "type": "Microsoft.Common.Section",
+            "label": "URL Click attempts by threat type",
+            "elements": [
+              {
+                "name": "huntingquery276-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery277",
+            "type": "Microsoft.Common.Section",
+            "label": "URL Clicks by Action",
+            "elements": [
+              {
+                "name": "huntingquery277-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery278",
+            "type": "Microsoft.Common.Section",
+            "label": "URLs by location",
+            "elements": [
+              {
+                "name": "huntingquery278-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303 This hunting query depends on MicrosoftThreatProtection data connector (EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery279",
+            "type": "Microsoft.Common.Section",
+            "label": "Post Delivery Events by Admin",
+            "elements": [
+              {
+                "name": "huntingquery279-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery280",
+            "type": "Microsoft.Common.Section",
+            "label": "Post Delivery Events by Location",
+            "elements": [
+              {
+                "name": "huntingquery280-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery281",
+            "type": "Microsoft.Common.Section",
+            "label": "Post Delivery Events by ZAP type",
+            "elements": [
+              {
+                "name": "huntingquery281-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery282",
+            "type": "Microsoft.Common.Section",
+            "label": "Post Delivery Events over time",
+            "elements": [
+              {
+                "name": "huntingquery282-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge. This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery283",
+            "type": "Microsoft.Common.Section",
+            "label": "Determine Successfully Delivered Phishing Emails to Inbox/Junk folder.",
+            "elements": [
+              {
+                "name": "huntingquery283-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query identifies threats which got successfully delivered to Inbox/Junk folder. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery284",
+            "type": "Microsoft.Common.Section",
+            "label": "Anomalous Payload Delivered from ISO files",
+            "elements": [
+              {
+                "name": "huntingquery284-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for lnk file executions from other locations than C: drive, which can relate to mounted ISO-files. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery285",
+            "type": "Microsoft.Common.Section",
+            "label": "Bitsadmin Activity",
+            "elements": [
+              {
+                "name": "huntingquery285-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for use of bitsadmin.exe for file transfer, which can be used for legitimate purposes or as part of a malware downloader. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery286",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Malicious use of MSIExec",
+            "elements": [
+              {
+                "name": "huntingquery286-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query detects possible download and execution using Msiexec. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery287",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Malicious use of Msiexec Mimikatz",
+            "elements": [
+              {
+                "name": "huntingquery287-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for malicious use of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery288",
+            "type": "Microsoft.Common.Section",
+            "label": "Office Apps Launching Wscipt",
+            "elements": [
+              {
+                "name": "huntingquery288-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "The query searches for Office applications launching wscript.exe to run a JSE file. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery289",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Potential kerberoast Activities",
+            "elements": [
+              {
+                "name": "huntingquery289-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query aim to detect if someone requests service tickets (where count => maxcount). The query requires trimming to set a baseline level for MaxCount. This hunting query depends on MicrosoftThreatProtection data connector (IdentityLogonEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery290",
+            "type": "Microsoft.Common.Section",
+            "label": "PowerShell Downloads",
+            "elements": [
+              {
+                "name": "huntingquery290-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "The query searches for PowerShell execution events that could involve a download. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery291",
+            "type": "Microsoft.Common.Section",
+            "label": "Webserver Executing Suspicious Applications",
+            "elements": [
+              {
+                "name": "huntingquery291-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for common webserver process names and identifies any processes launched using a scripting language (cmd, powershell, wscript, cscript). This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery292",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect Suspicious Mshta Usage",
+            "elements": [
+              {
+                "name": "huntingquery292-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query detects when mshta.exe has been run, which might include illegitimate usage by attackers. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery293",
+            "type": "Microsoft.Common.Section",
+            "label": "Files Copied to USB Drives",
+            "elements": [
+              {
+                "name": "huntingquery293-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents DeviceFileEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery294",
+            "type": "Microsoft.Common.Section",
+            "label": "Suspicious Tomcat Confluence Process Launch",
+            "elements": [
+              {
+                "name": "huntingquery294-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery295",
+            "type": "Microsoft.Common.Section",
+            "label": "MosaicLoader",
+            "elements": [
+              {
+                "name": "huntingquery295-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection. This hunting query depends on MicrosoftThreatProtection data connector (DeviceRegistryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery296",
+            "type": "Microsoft.Common.Section",
+            "label": "Spoolsv Spawning Rundll32",
+            "elements": [
+              {
+                "name": "huntingquery296-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Look for the spoolsv.exe launching rundll32.exe with an empty command line. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery297",
+            "type": "Microsoft.Common.Section",
+            "label": "Suspicious DLLs in spool Folder",
+            "elements": [
+              {
+                "name": "huntingquery297-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Look for the creation of suspicious DLL files spawned in the \\spool\\ folder along with DLLs that were recently loaded afterwards from \\Old. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents DeviceImageLoadEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery298",
+            "type": "Microsoft.Common.Section",
+            "label": "Suspicious Files in spool Folder",
+            "elements": [
+              {
+                "name": "huntingquery298-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery299",
+            "type": "Microsoft.Common.Section",
+            "label": "Suspicious Spoolsv Child Process",
+            "elements": [
+              {
+                "name": "huntingquery299-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675 This hunting query depends on MicrosoftThreatProtection data connector (DeviceImageLoadEvents DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery300",
+            "type": "Microsoft.Common.Section",
+            "label": "PrintNightmare CVE-2021-1675 usage Detection",
+            "elements": [
+              {
+                "name": "huntingquery300-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for any file creations in the print spooler drivers folder. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery301",
+            "type": "Microsoft.Common.Section",
+            "label": "Windows Print Spooler Service Suspicious File Creation",
+            "elements": [
+              {
+                "name": "huntingquery301-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "The query digs in Windows print spooler drivers folder for any file creations. This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery302",
+            "type": "Microsoft.Common.Section",
+            "label": "MITRE - Suspicious Events",
+            "elements": [
+              {
+                "name": "huntingquery302-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query looks for several different MITRE techniques, grouped by risk level. A weighting is applied to each risk level and a total score calculated per machine. Techniques can be added/removed as required. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery303",
+            "type": "Microsoft.Common.Section",
+            "label": "Unusual Volume of file deletion by users",
+            "elements": [
+              {
+                "name": "huntingquery303-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents AADSignInEventsBeta Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery304",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect MaiSniper",
+            "elements": [
+              {
+                "name": "huntingquery304-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for usage of MailSniper Exchange attack tool. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceNetworkEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery305",
+            "type": "Microsoft.Common.Section",
+            "label": "Account Brute Force",
+            "elements": [
+              {
+                "name": "huntingquery305-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query searches for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded. This hunting query depends on MicrosoftThreatProtection data connector (DeviceLogonEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery306",
+            "type": "Microsoft.Common.Section",
+            "label": "Remote File Creation with PsExec",
+            "elements": [
+              {
+                "name": "huntingquery306-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query detects remote file creation events that might indicate an active attack using PsExec. This hunting query depends on MicrosoftThreatProtection data connector (DeviceFileEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery307",
+            "type": "Microsoft.Common.Section",
+            "label": "Service Accounts Performing Remote PS",
+            "elements": [
+              {
+                "name": "huntingquery307-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for any Service Accounts Performing Remote PowerShell. This hunting query depends on MicrosoftThreatProtection data connector (DeviceLogonEvents DeviceEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery308",
+            "type": "Microsoft.Common.Section",
+            "label": "Account Creation",
+            "elements": [
+              {
+                "name": "huntingquery308-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for the creation of user accounts on a machine using the \"net user\" command. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery309",
+            "type": "Microsoft.Common.Section",
+            "label": "Local Admin Group Changes",
+            "elements": [
+              {
+                "name": "huntingquery309-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This hunting query searches for changes to the local administrators group. This hunting query depends on MicrosoftThreatProtection data connector (IdentityInfo DeviceEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery310",
+            "type": "Microsoft.Common.Section",
+            "label": "Rare Process as a Service",
+            "elements": [
+              {
+                "name": "huntingquery310-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query looks for rarely seen processes which are launched as a service. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents DeviceNetworkEvents DeviceFileEvents DeviceImageLoadEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery311",
+            "type": "Microsoft.Common.Section",
+            "label": "Scheduled Task Creation",
+            "elements": [
+              {
+                "name": "huntingquery311-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for any scheduled task creation event. This hunting query depends on MicrosoftThreatProtection data connector (DeviceEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery312",
+            "type": "Microsoft.Common.Section",
+            "label": "SAM Name Change CVE-2021-42278",
+            "elements": [
+              {
+                "name": "huntingquery312-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity. This hunting query depends on MicrosoftThreatProtection data connector (IdentityDirectoryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery313",
+            "type": "Microsoft.Common.Section",
+            "label": "Deletion of data on multiple drives using cipher exe",
+            "elements": [
+              {
+                "name": "huntingquery313-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery314",
+            "type": "Microsoft.Common.Section",
+            "label": "Check for multiple signs of Ransomware Activity",
+            "elements": [
+              {
+                "name": "huntingquery314-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for multiple signs of ransomware activity to identify affected devices. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery315",
+            "type": "Microsoft.Common.Section",
+            "label": "Disabling Services via Registry",
+            "elements": [
+              {
+                "name": "huntingquery315-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Search for processes modifying the registry to disable security features. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery316",
+            "type": "Microsoft.Common.Section",
+            "label": "DLLHost.exe WMIC domain discovery",
+            "elements": [
+              {
+                "name": "huntingquery316-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for dllhost.exe calling WMIC to discover additional hosts and associated domain. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery317",
+            "type": "Microsoft.Common.Section",
+            "label": "PowerShell adding exclusion path for Microsoft Defender of ProgramData",
+            "elements": [
+              {
+                "name": "huntingquery317-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery318",
+            "type": "Microsoft.Common.Section",
+            "label": "Suspicious Image Load related to IcedId",
+            "elements": [
+              {
+                "name": "huntingquery318-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to IcedId ransomware. This hunting query depends on MicrosoftThreatProtection data connector (DeviceImageLoadEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery319",
+            "type": "Microsoft.Common.Section",
+            "label": "LaZagne Credential Theft",
+            "elements": [
+              {
+                "name": "huntingquery319-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query can be used to locate processes executing credential theft activity, often LaZagne in ransomware compromises. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery320",
+            "type": "Microsoft.Common.Section",
+            "label": "Clearing of forensic evidence from event logs using wevtutil",
+            "elements": [
+              {
+                "name": "huntingquery320-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery321",
+            "type": "Microsoft.Common.Section",
+            "label": "Stopping multiple processes using taskkill",
+            "elements": [
+              {
+                "name": "huntingquery321-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery322",
+            "type": "Microsoft.Common.Section",
+            "label": "Potential Ransomware activity related to Cobalt Strike",
+            "elements": [
+              {
+                "name": "huntingquery322-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns. This hunting query depends on MicrosoftThreatProtection data connector (AlertInfo AlertEvidence DeviceLogonEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery323",
+            "type": "Microsoft.Common.Section",
+            "label": "Qakbot Discovery Activies",
+            "elements": [
+              {
+                "name": "huntingquery323-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery324",
+            "type": "Microsoft.Common.Section",
+            "label": "Shadow Copy Deletions",
+            "elements": [
+              {
+                "name": "huntingquery324-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery325",
+            "type": "Microsoft.Common.Section",
+            "label": "Turning off services using sc exe",
+            "elements": [
+              {
+                "name": "huntingquery325-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query checks for attempts to turn off at least 10 existing services using sc.exe. This hunting query depends on MicrosoftThreatProtection data connector (DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery326",
+            "type": "Microsoft.Common.Section",
+            "label": "Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities",
+            "elements": [
+              {
+                "name": "huntingquery326-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a This hunting query depends on MicrosoftThreatProtection data connector (DeviceTvmSoftwareVulnerabilitiesKB Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery327",
+            "type": "Microsoft.Common.Section",
+            "label": "Punycode lookalikes",
+            "elements": [
+              {
+                "name": "huntingquery327-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Punycode lookalike domains in Emails and Teams messages This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo MessageUrlInfo MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery328",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for RMM tool execution following Teams messages",
+            "elements": [
+              {
+                "name": "huntingquery328-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Correlates inbound Microsoft Teams messages with subsequent execution of common Remote Monitoring and Management (RMM) tools (QuickAssist, AnyDesk, TeamViewer) \non the recipient's device within a short time window. This pattern is associated with social engineering / tech-support-scam intrusions (e.g., Storm-1811 / Black \nBasta) where attackers lure victims via Teams chat and then convince them to launch an RMM tool to gain remote access. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents DeviceProcessEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery329",
+            "type": "Microsoft.Common.Section",
+            "label": "Hunt for alerts correlated with Teams messages",
+            "elements": [
+              {
+                "name": "huntingquery329-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Correlates Microsoft Teams message activity with downstream Defender alerts on the\nrecipient (victim) identity, surfacing potential phishing or social-engineering chats\nthat are followed by alert activity within a tunable time window. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents CloudAppEvents AlertEvidence Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery330",
+            "type": "Microsoft.Common.Section",
+            "label": "Identify acting user for reported phish",
+            "elements": [
+              {
+                "name": "huntingquery330-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies the user who acted on a reported phishing message and compares that actor with the original recipient, helping investigate delegate or shared mailbox reporting scenarios. This hunting query depends on MicrosoftThreatProtection data connector (AlertEvidence CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery331",
+            "type": "Microsoft.Common.Section",
+            "label": "Inbound Sender Domains Failing Email Authentication",
+            "elements": [
+              {
+                "name": "huntingquery331-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, and Composite Authentication), using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery332",
+            "type": "Microsoft.Common.Section",
+            "label": "Automatic External Email Forwarding Overview by Type (Mailbox Rule and SMTP)",
+            "elements": [
+              {
+                "name": "huntingquery332-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises automatic external email forwarding across the tenant by forwarding type (mailbox rule versus SMTP forwarding), using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery333",
+            "type": "Microsoft.Common.Section",
+            "label": "First-Contact External Email Senders",
+            "elements": [
+              {
+                "name": "huntingquery333-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists external email senders seen for the first time in the period (most recent first), surfacing new first-contact relationships, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery334",
+            "type": "Microsoft.Common.Section",
+            "label": "New External Sender Domains Carrying Threats",
+            "elements": [
+              {
+                "name": "huntingquery334-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists external sender domains seen for the first time in the period that already carried threats, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery335",
+            "type": "Microsoft.Common.Section",
+            "label": "Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
+            "elements": [
+              {
+                "name": "huntingquery335-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the top external domains receiving automatically forwarded email, by forwarding type, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery336",
+            "type": "Microsoft.Common.Section",
+            "label": "Top External Recipients Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
+            "elements": [
+              {
+                "name": "huntingquery336-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the top external recipients receiving automatically forwarded email, by forwarding type, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery337",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)",
+            "elements": [
+              {
+                "name": "huntingquery337-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the top internal users automatically forwarding email to external addresses, by forwarding type, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery338",
+            "type": "Microsoft.Common.Section",
+            "label": "File Malware Detections Over Time (SharePoint, OneDrive and Teams)",
+            "elements": [
+              {
+                "name": "huntingquery338-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query shows the daily volume of file malware detections in SharePoint, OneDrive and Teams over the last 30 days, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery339",
+            "type": "Microsoft.Common.Section",
+            "label": "File Malware Detections by Location (SharePoint, OneDrive and Teams)",
+            "elements": [
+              {
+                "name": "huntingquery339-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query surfaces malware detections in files stored in SharePoint, OneDrive and Teams, grouped by the site or personal location where each file resides, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery340",
+            "type": "Microsoft.Common.Section",
+            "label": "File Malware Detections by Workload (SharePoint, OneDrive and Teams)",
+            "elements": [
+              {
+                "name": "huntingquery340-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises malware detections in files stored in SharePoint, OneDrive and Teams by the Microsoft 365 collaboration workload, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery341",
+            "type": "Microsoft.Common.Section",
+            "label": "File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)",
+            "elements": [
+              {
+                "name": "huntingquery341-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by Microsoft Defender for Office 365 (Safe Attachments detonation), using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery342",
+            "type": "Microsoft.Common.Section",
+            "label": "File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)",
+            "elements": [
+              {
+                "name": "huntingquery342-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by the built-in SharePoint Online antivirus, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery343",
+            "type": "Microsoft.Common.Section",
+            "label": "File Scanning Coverage (SharePoint, OneDrive and Teams)",
+            "elements": [
+              {
+                "name": "huntingquery343-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises file scanning coverage in SharePoint, OneDrive and Teams: how many files were processed, how many were found malicious, and how many were scanned with no detection, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery344",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware Detection IP and Geo Position",
+            "elements": [
+              {
+                "name": "huntingquery344-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises inbound email malware detections by sender IP address with geographic coordinates for mapping. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery345",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware Detections by Sender Country",
+            "elements": [
+              {
+                "name": "huntingquery345-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises inbound email malware detections by the sender IP address country, derived from the sender IPv4 address. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery346",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware Detections by Threat Classification",
+            "elements": [
+              {
+                "name": "huntingquery346-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises inbound email malware detections grouped by the malware threat classification (for example Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery347",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Attacked Users by Malware Threat Classification",
+            "elements": [
+              {
+                "name": "huntingquery347-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query surfaces, for each malware threat classification, the recipient most frequently targeted by inbound malware email. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery348",
+            "type": "Microsoft.Common.Section",
+            "label": "Top File Owners Holding Malware (SharePoint, OneDrive and Teams)",
+            "elements": [
+              {
+                "name": "huntingquery348-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the file owners (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, using the FileMaliciousContentInfo table. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery349",
+            "type": "Microsoft.Common.Section",
+            "label": "First-Contact External Teams Senders",
+            "elements": [
+              {
+                "name": "huntingquery349-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists external Microsoft Teams senders by the date they were first seen, surfacing recent first-contact senders. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery350",
+            "type": "Microsoft.Common.Section",
+            "label": "Malicious files shared in Microsoft Teams",
+            "elements": [
+              {
+                "name": "huntingquery350-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery351",
+            "type": "Microsoft.Common.Section",
+            "label": "Microsoft Teams External versus Internal Thread Exposure",
+            "elements": [
+              {
+                "name": "huntingquery351-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants. This hunting query depends on MicrosoftThreatProtection data connector (MessageEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery352",
+            "type": "Microsoft.Common.Section",
+            "label": "Teams File Protection Summary",
+            "elements": [
+              {
+                "name": "huntingquery352-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarizes Microsoft Teams file protection: files scanned, files with malware detected, and files with no detection. This hunting query depends on MicrosoftThreatProtection data connector (FileMaliciousContentInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery353",
+            "type": "Microsoft.Common.Section",
+            "label": "SecOps Mailbox Override Count",
+            "elements": [
+              {
+                "name": "huntingquery353-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query counts inbound emails delivered to the SecOps mailbox by an organisation-level allow override. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery354",
+            "type": "Microsoft.Common.Section",
+            "label": "SecOps Mailbox Overrides by Threat Type",
+            "elements": [
+              {
+                "name": "huntingquery354-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query breaks down inbound emails delivered to the SecOps mailbox by an organisation-level allow override, grouped by threat type. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery355",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Recipients Receiving Threats Delivered by Override",
+            "elements": [
+              {
+                "name": "huntingquery355-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the recipients who received the most threats that were delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery356",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Sender Domains Delivering Threats via Override",
+            "elements": [
+              {
+                "name": "huntingquery356-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the sender domains whose threats were most often delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery357",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detection IP and Geo Position",
+            "elements": [
+              {
+                "name": "huntingquery357-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises inbound email phishing detections by sender IP address with geographic coordinates for mapping. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery358",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detections by Sender Country",
+            "elements": [
+              {
+                "name": "huntingquery358-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises inbound email phishing detections by the sender IP address country, derived from the sender IPv4 address. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery359",
+            "type": "Microsoft.Common.Section",
+            "label": "Phish Detections by Threat Classification",
+            "elements": [
+              {
+                "name": "huntingquery359-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises inbound email phishing detections grouped by the message-intent threat classification produced by Microsoft Defender for Office 365 LLM content analysis (for example Invoice, Gift card, Payroll, PII gathering). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery360",
+            "type": "Microsoft.Common.Section",
+            "label": "Phishing Detected by LLM Content Analysis",
+            "elements": [
+              {
+                "name": "huntingquery360-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists inbound phishing messages that Microsoft Defender for Office 365 detected using LLM (Language AI) content analysis, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery361",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Attacked Users by Phish Threat Classification",
+            "elements": [
+              {
+                "name": "huntingquery361-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query surfaces, for each phishing message-intent threat classification, the recipient most frequently targeted by inbound phishing email. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery362",
+            "type": "Microsoft.Common.Section",
+            "label": "Quarantine Release Percentage",
+            "elements": [
+              {
+                "name": "huntingquery362-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query calculates the percentage of quarantined emails that were subsequently released, out of the total quarantined. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery363",
+            "type": "Microsoft.Common.Section",
+            "label": "Automated Investigation Outcomes by Day",
+            "elements": [
+              {
+                "name": "huntingquery363-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarizes daily automated investigation outcomes (threat detected versus clean) by correlating automated remediation events with alert evidence, using the EmailPostDeliveryEvents and AlertEvidence tables. This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents AlertEvidence Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery364",
+            "type": "Microsoft.Common.Section",
+            "label": "Automated Remediation Delivery to Action Latency",
+            "elements": [
+              {
+                "name": "huntingquery364-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query measures how long after delivery Microsoft Defender for Office 365 automated remediation acts on a message, reported as daily average and percentiles, using the EmailEvents and EmailPostDeliveryEvents tables. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery365",
+            "type": "Microsoft.Common.Section",
+            "label": "Automated Remediation Efficiency Over Time",
+            "elements": [
+              {
+                "name": "huntingquery365-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query trends the outcome (success versus failure) of Microsoft Defender for Office 365 automated remediation actions over time, using the EmailPostDeliveryEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery366",
+            "type": "Microsoft.Common.Section",
+            "label": "Automated Remediation Manual versus Automatic Approval",
+            "elements": [
+              {
+                "name": "huntingquery366-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query shows whether Microsoft Defender for Office 365 automated remediation actions were taken automatically or required manual admin approval, using the EmailPostDeliveryEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailPostDeliveryEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery367",
+            "type": "Microsoft.Common.Section",
+            "label": "Spam Detections by Sender Country",
+            "elements": [
+              {
+                "name": "huntingquery367-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarizes inbound spam detections by the geographic country of the sending IP address, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery368",
+            "type": "Microsoft.Common.Section",
+            "label": "Impersonation and Spoof Detections by Sender Country",
+            "elements": [
+              {
+                "name": "huntingquery368-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarizes inbound impersonation and spoof (BEC) detections by the geographic country of the sending IP address, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery369",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Recipients Targeted by Impersonation or BEC",
+            "elements": [
+              {
+                "name": "huntingquery369-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery370",
+            "type": "Microsoft.Common.Section",
+            "label": "Top accounts performing user submissions (FP)",
+            "elements": [
+              {
+                "name": "huntingquery370-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top accounts performing user false positive submissions. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery371",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FP) - Top Inbound Subjects",
+            "elements": [
+              {
+                "name": "huntingquery371-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top 10 subjects of inbound emails submitted as false positives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery372",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FP) - Top Intra-Org P2 Senders",
+            "elements": [
+              {
+                "name": "huntingquery372-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top 10 intra-org senders of emails submitted as false positives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery373",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FP) - Top P2 Sender Domains",
+            "elements": [
+              {
+                "name": "huntingquery373-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top 10 sender domains of emails submitted as false positives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery374",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submissions (FP) - Top Inbound P2 Senders",
+            "elements": [
+              {
+                "name": "huntingquery374-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the top 10 inbound senders of emails submitted as false positives by users. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery375",
+            "type": "Microsoft.Common.Section",
+            "label": "User Email Submission Trend (FP)",
+            "elements": [
+              {
+                "name": "huntingquery375-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises the daily amount of user false positive email submissions over time. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery376",
+            "type": "Microsoft.Common.Section",
+            "label": "User Submissions by Detection Method - Phish (FP)",
+            "elements": [
+              {
+                "name": "huntingquery376-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises user false positive submissions by the original phish filter verdict on the reported message. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery377",
+            "type": "Microsoft.Common.Section",
+            "label": "User Submissions by Detection Method - Spam (FP)",
+            "elements": [
+              {
+                "name": "huntingquery377-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises user false positive submissions by the original spam filter verdict on the reported message. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery378",
+            "type": "Microsoft.Common.Section",
+            "label": "User Submissions by Submission State (FP)",
+            "elements": [
+              {
+                "name": "huntingquery378-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises user false positive submissions by submission state. This hunting query depends on MicrosoftThreatProtection data connector (CloudAppEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery379",
+            "type": "Microsoft.Common.Section",
+            "label": "Largest Malicious Email Campaigns by Cluster",
+            "elements": [
+              {
+                "name": "huntingquery379-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query surfaces the largest malicious inbound email campaigns, clustered by EmailClusterId, with one row per attack wave, using the EmailEvents table. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery380",
+            "type": "Microsoft.Common.Section",
+            "label": "Blocked URL Clicks by Workload",
+            "elements": [
+              {
+                "name": "huntingquery380-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises blocked Safe Links URL clicks over time broken down by the workload the click came from (Email, Teams, Office, Microsoft 365 Copilot). This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery381",
+            "type": "Microsoft.Common.Section",
+            "label": "Top 20 Malicious URLs by Clicks",
+            "elements": [
+              {
+                "name": "huntingquery381-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the top 20 URLs carrying a detection ranked by the number of clicks registered, with the threat type, click action and workload for each. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery382",
+            "type": "Microsoft.Common.Section",
+            "label": "Top Clicks on Malicious URLs",
+            "elements": [
+              {
+                "name": "huntingquery382-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query lists the malicious URLs that registered the most user clicks, with threat type, click action and workload, using the UrlClickEvents table. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery383",
+            "type": "Microsoft.Common.Section",
+            "label": "URL Click-Through by Workload",
+            "elements": [
+              {
+                "name": "huntingquery383-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query shows malicious URL click-throughs (where the user proceeded past the Safe Links warning) broken down by the workload the click came from. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery384",
+            "type": "Microsoft.Common.Section",
+            "label": "URL Threat Protection Summary",
+            "elements": [
+              {
+                "name": "huntingquery384-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query summarises URL threat protection activity (Safe Links click outcomes and distinct URLs seen in email) as a set of headline metrics for the selected period. This hunting query depends on MicrosoftThreatProtection data connector (UrlClickEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery385",
+            "type": "Microsoft.Common.Section",
+            "label": "Malware URL Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery385-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises inbound email malware detections attributed to URL-based detection technologies over time. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery386",
+            "type": "Microsoft.Common.Section",
+            "label": "Phishing URL Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery386-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises inbound email phishing detections attributed to URL-based detection technologies over time. This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents Parser or Table)"
+                }
+              }
+            ]
+          },
+          {
+            "name": "huntingquery387",
+            "type": "Microsoft.Common.Section",
+            "label": "QR Code URL Detections Trend",
+            "elements": [
+              {
+                "name": "huntingquery387-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This query visualises inbound email detections involving URLs embedded in QR codes over time, split by the threat type of the detection (phishing, malware, spam). This hunting query depends on MicrosoftThreatProtection data connector (EmailEvents EmailUrlInfo Parser or Table)"
+                }
+              }
+            ]
+          }
+        ]
       }
     ],
     "outputs": {
       "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
       "location": "[location()]",
       "workspace": "[basics('workspace')]",
+      "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]",
+      "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]",
       "DeployDefenderWorkbook": "[steps('contentSelection').DeployDefenderWorkbook]",
-      "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]"
+      "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]",
+      "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]"
     }
   }
 }
diff --git a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json
index f29c7c4d474..bce6b5e3be7 100644
--- a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json	
+++ b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json	
@@ -28,6 +28,44 @@
         "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
       }
     },
+    "workbook1-name": {
+      "type": "string",
+      "defaultValue": "Microsoft Defender for Office 365 Detections and Insights",
+      "minLength": 1,
+      "metadata": {
+        "description": "Name for the workbook"
+      }
+    },
+    "workbook2-name": {
+      "type": "string",
+      "defaultValue": "Microsoft Defender For EndPoint",
+      "minLength": 1,
+      "metadata": {
+        "description": "Name for the workbook"
+      }
+    },
+    "workbook3-name": {
+      "type": "string",
+      "defaultValue": "Microsoft Defender For Identity",
+      "minLength": 1,
+      "metadata": {
+        "description": "Name for the workbook"
+      }
+    },
+    "DeployAnalyticsRule": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
+      }
+    },
+    "DeployWorkbook": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
+      }
+    },
     "DeployDefenderWorkbook": {
       "type": "bool",
       "defaultValue": false,
@@ -41,6 +79,13 @@
       "metadata": {
         "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
       }
+    },
+    "DeployHuntingQuery": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution."
+      }
     }
   },
   "variables": {
@@ -59,552 +104,43530 @@
     "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]",
     "dataConnectorVersion1": "1.0.0",
     "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]",
-    "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
-  },
-  "resources": [
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[variables('dataConnectorTemplateSpecName1')]",
-      "location": "[parameters('workspace-location')]",
-      "dependsOn": [
-        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
-      ],
-      "properties": {
-        "description": "Microsoft Defender XDR data connector with template version 3.2.1",
-        "mainTemplate": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "[variables('dataConnectorVersion1')]",
-          "parameters": {},
-          "variables": {},
-          "resources": [
-            {
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
-              "apiVersion": "2021-03-01-preview",
-              "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
-              "location": "[parameters('workspace-location')]",
-              "kind": "StaticUI",
-              "properties": {
-                "connectorUiConfig": {
-                  "id": "[variables('_uiConfigId1')]",
-                  "title": "Microsoft Defender XDR",
-                  "publisher": "Microsoft",
-                  "descriptionMarkdown": "Microsoft Defender XDR is a unified, natively integrated, pre- and post-breach enterprise defense suite that protects endpoint, identity, email, and applications and helps you detect, prevent, investigate, and automatically respond to sophisticated threats.\n\nMicrosoft Defender XDR suite includes: \n- Microsoft Defender for Endpoint\n- Microsoft Defender for Identity\n- Microsoft Defender for Office 365\n- Threat & Vulnerability Management\n- Microsoft Defender for Cloud Apps\n\nFor more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220004&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
-                  "graphQueries": [
-                    {
-                      "metricName": "Total data received",
-                      "legend": "Incidents",
-                      "baseQuery": "SecurityIncident \n| where ProviderName == \"Microsoft 365 Defender\""
-                    },
-                    {
-                      "metricName": "Total data received",
-                      "legend": "Alerts",
-                      "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
-                    },
-                    {
-                      "metricName": "Total data received",
-                      "legend": "Endpoint Events",
-                      "baseQuery": "DeviceEvents| union isfuzzy=true DeviceFileEvents| union isfuzzy=true DeviceImageLoadEvents| union isfuzzy=true DeviceInfo| union isfuzzy=true DeviceLogonEvents| union isfuzzy=true DeviceNetworkEvents| union isfuzzy=true DeviceNetworkInfo| union isfuzzy=true DeviceProcessEvents| union isfuzzy=true DeviceRegistryEvents| union isfuzzy=true DeviceFileCertificateInfo"
-                    },
-                    {
-                      "metricName": "Total data received",
-                      "legend": "Office Events",
-                      "baseQuery": "EmailEvents| union isfuzzy=true EmailUrlInfo| union isfuzzy=true EmailAttachmentInfo| union isfuzzy=true EmailPostDeliveryEvents"
-                    },
-                    {
-                      "metricName": "Total data received",
-                      "legend": "Identity Events",
-                      "baseQuery": "IdentityLogonEvents| union isfuzzy=true IdentityQueryEvents| union isfuzzy=true IdentityDirectoryEvents"
-                    },
-                    {
-                      "metricName": "Total data received",
-                      "legend": "Cloud app Events",
-                      "baseQuery": "CloudAppEvents"
-                    },
-                    {
-                      "metricName": "Total data received",
-                      "legend": "Defender Alert Evidence",
-                      "baseQuery": "AlertEvidence"
-                    }
-                  ],
-                  "connectivityCriterias": [
-                    {
-                      "type": "SentinelKinds",
-                      "value": [
-                        "MicrosoftThreatProtection"
-                      ]
-                    },
-                    {
-                      "type": "MtpAlerts",
-                      "value": [
-                        "AzureAdvancedThreatProtection",
-                        "MicrosoftCloudAppSecurity",
-                        "MicrosoftThreatProtection",
-                        "OfficeATP",
-                        "MicrosoftDefenderAdvancedThreatProtection",
-                        "AzureActiveDirectory",
-                        "OfficeIRM"
-                      ]
-                    },
-                    {
-                      "type": "IsConnectedQuery",
-                      "value": [
-                        "DeviceEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceFileEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceImageLoadEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceLogonEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceNetworkEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceNetworkInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceProcessEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceRegistryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "DeviceFileCertificateInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-                      ]
-                    },
-                    {
-                      "type": "IsConnectedQuery",
-                      "value": [
-                        "EmailEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "EmailUrlInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "EmailAttachmentInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "EmailPostDeliveryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "UrlClickEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-                      ]
-                    },
-                    {
-                      "type": "IsConnectedQuery",
-                      "value": [
-                        "IdentityLogonEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "IdentityQueryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                        "IdentityDirectoryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-                      ]
-                    },
-                    {
-                      "type": "IsConnectedQuery",
-                      "value": [
-                        "CloudAppEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-                      ]
-                    },
-                    {
-                      "type": "IsConnectedQuery",
-                      "value": [
-                        "AlertEvidence\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-                      ]
-                    }
-                  ],
-                  "dataTypes": [
-                    {
-                      "name": "SecurityIncident",
-                      "lastDataReceivedQuery": "SecurityIncident \n| where ProviderName == \"Microsoft 365 Defender\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "SecurityAlert",
-                      "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceEvents",
-                      "lastDataReceivedQuery": "DeviceEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceFileEvents",
-                      "lastDataReceivedQuery": "DeviceFileEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceImageLoadEvents",
-                      "lastDataReceivedQuery": "DeviceImageLoadEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceInfo",
-                      "lastDataReceivedQuery": "DeviceInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceLogonEvents",
-                      "lastDataReceivedQuery": "DeviceLogonEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceNetworkEvents",
-                      "lastDataReceivedQuery": "DeviceNetworkEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceNetworkInfo",
-                      "lastDataReceivedQuery": "DeviceNetworkInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceProcessEvents",
-                      "lastDataReceivedQuery": "DeviceProcessEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceRegistryEvents",
-                      "lastDataReceivedQuery": "DeviceRegistryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "DeviceFileCertificateInfo",
-                      "lastDataReceivedQuery": "DeviceFileCertificateInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "EmailEvents",
-                      "lastDataReceivedQuery": "EmailEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "EmailUrlInfo",
-                      "lastDataReceivedQuery": "EmailUrlInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "EmailAttachmentInfo",
-                      "lastDataReceivedQuery": "EmailAttachmentInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "EmailPostDeliveryEvents",
-                      "lastDataReceivedQuery": "EmailPostDeliveryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "UrlClickEvents",
-                      "lastDataReceivedQuery": "UrlClickEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "IdentityLogonEvents",
-                      "lastDataReceivedQuery": "IdentityLogonEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "IdentityQueryEvents",
-                      "lastDataReceivedQuery": "IdentityQueryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "IdentityDirectoryEvents",
-                      "lastDataReceivedQuery": "IdentityDirectoryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "CloudAppEvents",
-                      "lastDataReceivedQuery": "CloudAppEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    },
-                    {
-                      "name": "AlertEvidence",
-                      "lastDataReceivedQuery": "AlertEvidence\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-                    }
-                  ]
-                }
-              }
+    "analyticRuleObject1": {
+      "analyticRuleVersion1": "1.1.2",
+      "_analyticRulecontentId1": "6c3a1258-bcdd-4fcd-b753-1a9bc826ce12",
+      "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6c3a1258-bcdd-4fcd-b753-1a9bc826ce12')]",
+      "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6c3a1258-bcdd-4fcd-b753-1a9bc826ce12')))]",
+      "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6c3a1258-bcdd-4fcd-b753-1a9bc826ce12','-', '1.1.2')))]"
+    },
+    "analyticRuleObject2": {
+      "analyticRuleVersion2": "1.0.4",
+      "_analyticRulecontentId2": "53e936c6-6c30-4d12-8343-b8a0456e8429",
+      "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '53e936c6-6c30-4d12-8343-b8a0456e8429')]",
+      "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('53e936c6-6c30-4d12-8343-b8a0456e8429')))]",
+      "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','53e936c6-6c30-4d12-8343-b8a0456e8429','-', '1.0.4')))]"
+    },
+    "analyticRuleObject3": {
+      "analyticRuleVersion3": "1.1.0",
+      "_analyticRulecontentId3": "1bf6e165-5e32-420e-ab4f-0da8558a8be2",
+      "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1bf6e165-5e32-420e-ab4f-0da8558a8be2')]",
+      "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1bf6e165-5e32-420e-ab4f-0da8558a8be2')))]",
+      "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1bf6e165-5e32-420e-ab4f-0da8558a8be2','-', '1.1.0')))]"
+    },
+    "analyticRuleObject4": {
+      "analyticRuleVersion4": "1.0.6",
+      "_analyticRulecontentId4": "738702fd-0a66-42c7-8586-e30f0583f8fe",
+      "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '738702fd-0a66-42c7-8586-e30f0583f8fe')]",
+      "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('738702fd-0a66-42c7-8586-e30f0583f8fe')))]",
+      "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','738702fd-0a66-42c7-8586-e30f0583f8fe','-', '1.0.6')))]"
+    },
+    "analyticRuleObject5": {
+      "analyticRuleVersion5": "1.0.5",
+      "_analyticRulecontentId5": "ce1e7025-866c-41f3-9b08-ec170e05e73e",
+      "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ce1e7025-866c-41f3-9b08-ec170e05e73e')]",
+      "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ce1e7025-866c-41f3-9b08-ec170e05e73e')))]",
+      "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ce1e7025-866c-41f3-9b08-ec170e05e73e','-', '1.0.5')))]"
+    },
+    "analyticRuleObject6": {
+      "analyticRuleVersion6": "1.0.7",
+      "_analyticRulecontentId6": "a3c144f9-8051-47d4-ac29-ffb0c312c910",
+      "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a3c144f9-8051-47d4-ac29-ffb0c312c910')]",
+      "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a3c144f9-8051-47d4-ac29-ffb0c312c910')))]",
+      "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a3c144f9-8051-47d4-ac29-ffb0c312c910','-', '1.0.7')))]"
+    },
+    "analyticRuleObject7": {
+      "analyticRuleVersion7": "1.1.3",
+      "_analyticRulecontentId7": "b6685757-3ed1-4b05-a5bd-2cacadc86c2a",
+      "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b6685757-3ed1-4b05-a5bd-2cacadc86c2a')]",
+      "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b6685757-3ed1-4b05-a5bd-2cacadc86c2a')))]",
+      "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b6685757-3ed1-4b05-a5bd-2cacadc86c2a','-', '1.1.3')))]"
+    },
+    "analyticRuleObject8": {
+      "analyticRuleVersion8": "1.0.4",
+      "_analyticRulecontentId8": "1785d372-b9fe-4283-96a6-3a1d83cabfd1",
+      "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1785d372-b9fe-4283-96a6-3a1d83cabfd1')]",
+      "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1785d372-b9fe-4283-96a6-3a1d83cabfd1')))]",
+      "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1785d372-b9fe-4283-96a6-3a1d83cabfd1','-', '1.0.4')))]"
+    },
+    "analyticRuleObject9": {
+      "analyticRuleVersion9": "1.0.3",
+      "_analyticRulecontentId9": "3bd33158-3f0b-47e3-a50f-7c20a1b88038",
+      "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3bd33158-3f0b-47e3-a50f-7c20a1b88038')]",
+      "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3bd33158-3f0b-47e3-a50f-7c20a1b88038')))]",
+      "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3bd33158-3f0b-47e3-a50f-7c20a1b88038','-', '1.0.3')))]"
+    },
+    "analyticRuleObject10": {
+      "analyticRuleVersion10": "1.1.3",
+      "_analyticRulecontentId10": "26e81021-2de6-4442-a74a-a77885e96911",
+      "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '26e81021-2de6-4442-a74a-a77885e96911')]",
+      "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('26e81021-2de6-4442-a74a-a77885e96911')))]",
+      "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','26e81021-2de6-4442-a74a-a77885e96911','-', '1.1.3')))]"
+    },
+    "analyticRuleObject11": {
+      "analyticRuleVersion11": "1.0.0",
+      "_analyticRulecontentId11": "c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b",
+      "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b')]",
+      "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b')))]",
+      "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c25a8cd4-5b4a-45a8-9ba0-3b753a652f6b','-', '1.0.0')))]"
+    },
+    "TemplateEmptyArray": "[json('[]')]",
+    "analyticRuleObject12": {
+      "analyticRuleVersion12": "1.0.0",
+      "_analyticRulecontentId12": "bb46dd86-e642-48a4-975c-44f5ac2b5033",
+      "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bb46dd86-e642-48a4-975c-44f5ac2b5033')]",
+      "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bb46dd86-e642-48a4-975c-44f5ac2b5033')))]",
+      "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bb46dd86-e642-48a4-975c-44f5ac2b5033','-', '1.0.0')))]"
+    },
+    "analyticRuleObject13": {
+      "analyticRuleVersion13": "1.0.0",
+      "_analyticRulecontentId13": "2c81c0a0-9823-4a14-b21a-2b4acd3335d2",
+      "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2c81c0a0-9823-4a14-b21a-2b4acd3335d2')]",
+      "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2c81c0a0-9823-4a14-b21a-2b4acd3335d2')))]",
+      "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2c81c0a0-9823-4a14-b21a-2b4acd3335d2','-', '1.0.0')))]"
+    },
+    "analyticRuleObject14": {
+      "analyticRuleVersion14": "1.0.0",
+      "_analyticRulecontentId14": "7ce00cba-f76f-4026-ab7f-7e4f1b67bd18",
+      "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7ce00cba-f76f-4026-ab7f-7e4f1b67bd18')]",
+      "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7ce00cba-f76f-4026-ab7f-7e4f1b67bd18')))]",
+      "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7ce00cba-f76f-4026-ab7f-7e4f1b67bd18','-', '1.0.0')))]"
+    },
+    "analyticRuleObject15": {
+      "analyticRuleVersion15": "1.0.0",
+      "_analyticRulecontentId15": "1be34fb9-f81b-47ae-84fb-465e6686d76c",
+      "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1be34fb9-f81b-47ae-84fb-465e6686d76c')]",
+      "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1be34fb9-f81b-47ae-84fb-465e6686d76c')))]",
+      "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1be34fb9-f81b-47ae-84fb-465e6686d76c','-', '1.0.0')))]"
+    },
+    "analyticRuleObject16": {
+      "analyticRuleVersion16": "1.0.0",
+      "_analyticRulecontentId16": "c332b840-61e4-462e-a201-0e2d69bad45d",
+      "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c332b840-61e4-462e-a201-0e2d69bad45d')]",
+      "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c332b840-61e4-462e-a201-0e2d69bad45d')))]",
+      "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c332b840-61e4-462e-a201-0e2d69bad45d','-', '1.0.0')))]"
+    },
+    "analyticRuleObject17": {
+      "analyticRuleVersion17": "1.0.0",
+      "_analyticRulecontentId17": "5bdc1504-880c-4b30-a39c-7c746535928d",
+      "analyticRuleId17": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5bdc1504-880c-4b30-a39c-7c746535928d')]",
+      "analyticRuleTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5bdc1504-880c-4b30-a39c-7c746535928d')))]",
+      "_analyticRulecontentProductId17": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5bdc1504-880c-4b30-a39c-7c746535928d','-', '1.0.0')))]"
+    },
+    "analyticRuleObject18": {
+      "analyticRuleVersion18": "1.0.0",
+      "_analyticRulecontentId18": "47c02e21-3949-4e05-a28e-576cd75ff6f6",
+      "analyticRuleId18": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '47c02e21-3949-4e05-a28e-576cd75ff6f6')]",
+      "analyticRuleTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('47c02e21-3949-4e05-a28e-576cd75ff6f6')))]",
+      "_analyticRulecontentProductId18": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','47c02e21-3949-4e05-a28e-576cd75ff6f6','-', '1.0.0')))]"
+    },
+    "analyticRuleObject19": {
+      "analyticRuleVersion19": "1.0.0",
+      "_analyticRulecontentId19": "36fbd4e7-5630-4414-aa42-702a7fdded21",
+      "analyticRuleId19": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '36fbd4e7-5630-4414-aa42-702a7fdded21')]",
+      "analyticRuleTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('36fbd4e7-5630-4414-aa42-702a7fdded21')))]",
+      "_analyticRulecontentProductId19": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','36fbd4e7-5630-4414-aa42-702a7fdded21','-', '1.0.0')))]"
+    },
+    "analyticRuleObject20": {
+      "analyticRuleVersion20": "1.0.0",
+      "_analyticRulecontentId20": "2624fc55-0998-4897-bb48-1c6422befce4",
+      "analyticRuleId20": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2624fc55-0998-4897-bb48-1c6422befce4')]",
+      "analyticRuleTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2624fc55-0998-4897-bb48-1c6422befce4')))]",
+      "_analyticRulecontentProductId20": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2624fc55-0998-4897-bb48-1c6422befce4','-', '1.0.0')))]"
+    },
+    "analyticRuleObject21": {
+      "analyticRuleVersion21": "1.0.0",
+      "_analyticRulecontentId21": "fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7",
+      "analyticRuleId21": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7')]",
+      "analyticRuleTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7')))]",
+      "_analyticRulecontentProductId21": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7','-', '1.0.0')))]"
+    },
+    "analyticRuleObject22": {
+      "analyticRuleVersion22": "1.0.0",
+      "_analyticRulecontentId22": "2a1dc4c2-a8d6-4a0e-8539-9b971c851195",
+      "analyticRuleId22": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2a1dc4c2-a8d6-4a0e-8539-9b971c851195')]",
+      "analyticRuleTemplateSpecName22": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2a1dc4c2-a8d6-4a0e-8539-9b971c851195')))]",
+      "_analyticRulecontentProductId22": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2a1dc4c2-a8d6-4a0e-8539-9b971c851195','-', '1.0.0')))]"
+    },
+    "analyticRuleObject23": {
+      "analyticRuleVersion23": "1.0.0",
+      "_analyticRulecontentId23": "174de33b-107b-4cd8-a85d-b4025a35453f",
+      "analyticRuleId23": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '174de33b-107b-4cd8-a85d-b4025a35453f')]",
+      "analyticRuleTemplateSpecName23": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('174de33b-107b-4cd8-a85d-b4025a35453f')))]",
+      "_analyticRulecontentProductId23": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','174de33b-107b-4cd8-a85d-b4025a35453f','-', '1.0.0')))]"
+    },
+    "analyticRuleObject24": {
+      "analyticRuleVersion24": "1.0.0",
+      "_analyticRulecontentId24": "12134de5-361b-427c-a1a0-d43f40a593c4",
+      "analyticRuleId24": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '12134de5-361b-427c-a1a0-d43f40a593c4')]",
+      "analyticRuleTemplateSpecName24": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('12134de5-361b-427c-a1a0-d43f40a593c4')))]",
+      "_analyticRulecontentProductId24": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','12134de5-361b-427c-a1a0-d43f40a593c4','-', '1.0.0')))]"
+    },
+    "analyticRuleObject25": {
+      "analyticRuleVersion25": "1.0.0",
+      "_analyticRulecontentId25": "3ab04acf-e0e7-4f7c-8995-748ab4c848c2",
+      "analyticRuleId25": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3ab04acf-e0e7-4f7c-8995-748ab4c848c2')]",
+      "analyticRuleTemplateSpecName25": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3ab04acf-e0e7-4f7c-8995-748ab4c848c2')))]",
+      "_analyticRulecontentProductId25": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3ab04acf-e0e7-4f7c-8995-748ab4c848c2','-', '1.0.0')))]"
+    },
+    "analyticRuleObject26": {
+      "analyticRuleVersion26": "1.0.0",
+      "_analyticRulecontentId26": "506f4d6b-3864-4bb1-8f75-a13fb066f97a",
+      "analyticRuleId26": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '506f4d6b-3864-4bb1-8f75-a13fb066f97a')]",
+      "analyticRuleTemplateSpecName26": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('506f4d6b-3864-4bb1-8f75-a13fb066f97a')))]",
+      "_analyticRulecontentProductId26": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','506f4d6b-3864-4bb1-8f75-a13fb066f97a','-', '1.0.0')))]"
+    },
+    "analyticRuleObject27": {
+      "analyticRuleVersion27": "1.0.3",
+      "_analyticRulecontentId27": "e5f8e196-3544-4a8b-96a9-17c1b6a49710",
+      "analyticRuleId27": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e5f8e196-3544-4a8b-96a9-17c1b6a49710')]",
+      "analyticRuleTemplateSpecName27": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e5f8e196-3544-4a8b-96a9-17c1b6a49710')))]",
+      "_analyticRulecontentProductId27": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e5f8e196-3544-4a8b-96a9-17c1b6a49710','-', '1.0.3')))]"
+    },
+    "analyticRuleObject28": {
+      "analyticRuleVersion28": "1.0.0",
+      "_analyticRulecontentId28": "35ab0d58-baab-4154-87ed-fa2f69797e9e",
+      "analyticRuleId28": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '35ab0d58-baab-4154-87ed-fa2f69797e9e')]",
+      "analyticRuleTemplateSpecName28": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('35ab0d58-baab-4154-87ed-fa2f69797e9e')))]",
+      "_analyticRulecontentProductId28": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35ab0d58-baab-4154-87ed-fa2f69797e9e','-', '1.0.0')))]"
+    },
+    "analyticRuleObject29": {
+      "analyticRuleVersion29": "1.0.0",
+      "_analyticRulecontentId29": "d29cc957-0ddb-4d00-8d6f-ad1bb345ff9a",
+      "analyticRuleId29": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd29cc957-0ddb-4d00-8d6f-ad1bb345ff9a')]",
+      "analyticRuleTemplateSpecName29": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d29cc957-0ddb-4d00-8d6f-ad1bb345ff9a')))]",
+      "_analyticRulecontentProductId29": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d29cc957-0ddb-4d00-8d6f-ad1bb345ff9a','-', '1.0.0')))]"
+    },
+    "analyticRuleObject30": {
+      "analyticRuleVersion30": "1.0.0",
+      "_analyticRulecontentId30": "450f4e56-5bba-4070-b9d9-9204ba9d777d",
+      "analyticRuleId30": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '450f4e56-5bba-4070-b9d9-9204ba9d777d')]",
+      "analyticRuleTemplateSpecName30": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('450f4e56-5bba-4070-b9d9-9204ba9d777d')))]",
+      "_analyticRulecontentProductId30": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','450f4e56-5bba-4070-b9d9-9204ba9d777d','-', '1.0.0')))]"
+    },
+    "analyticRuleObject31": {
+      "analyticRuleVersion31": "1.0.2",
+      "_analyticRulecontentId31": "63aa43c2-e88e-4102-aea5-0432851c541a",
+      "analyticRuleId31": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '63aa43c2-e88e-4102-aea5-0432851c541a')]",
+      "analyticRuleTemplateSpecName31": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('63aa43c2-e88e-4102-aea5-0432851c541a')))]",
+      "_analyticRulecontentProductId31": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','63aa43c2-e88e-4102-aea5-0432851c541a','-', '1.0.2')))]"
+    },
+    "analyticRuleObject32": {
+      "analyticRuleVersion32": "1.0.0",
+      "_analyticRulecontentId32": "91a451e3-178f-41b2-9e5d-da97d75b9971",
+      "analyticRuleId32": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '91a451e3-178f-41b2-9e5d-da97d75b9971')]",
+      "analyticRuleTemplateSpecName32": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('91a451e3-178f-41b2-9e5d-da97d75b9971')))]",
+      "_analyticRulecontentProductId32": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','91a451e3-178f-41b2-9e5d-da97d75b9971','-', '1.0.0')))]"
+    },
+    "analyticRuleObject33": {
+      "analyticRuleVersion33": "1.0.0",
+      "_analyticRulecontentId33": "32b29155-3fd3-4a9e-a0ca-a67e2593b60b",
+      "analyticRuleId33": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '32b29155-3fd3-4a9e-a0ca-a67e2593b60b')]",
+      "analyticRuleTemplateSpecName33": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('32b29155-3fd3-4a9e-a0ca-a67e2593b60b')))]",
+      "_analyticRulecontentProductId33": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','32b29155-3fd3-4a9e-a0ca-a67e2593b60b','-', '1.0.0')))]"
+    },
+    "analyticRuleObject34": {
+      "analyticRuleVersion34": "1.0.0",
+      "_analyticRulecontentId34": "03caa992-477f-4b19-8e2a-8cd58f8f9652",
+      "analyticRuleId34": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '03caa992-477f-4b19-8e2a-8cd58f8f9652')]",
+      "analyticRuleTemplateSpecName34": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('03caa992-477f-4b19-8e2a-8cd58f8f9652')))]",
+      "_analyticRulecontentProductId34": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','03caa992-477f-4b19-8e2a-8cd58f8f9652','-', '1.0.0')))]"
+    },
+    "analyticRuleObject35": {
+      "analyticRuleVersion35": "1.0.0",
+      "_analyticRulecontentId35": "7d0d3050-8dac-4b83-bfae-902f7dc0c21c",
+      "analyticRuleId35": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7d0d3050-8dac-4b83-bfae-902f7dc0c21c')]",
+      "analyticRuleTemplateSpecName35": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7d0d3050-8dac-4b83-bfae-902f7dc0c21c')))]",
+      "_analyticRulecontentProductId35": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7d0d3050-8dac-4b83-bfae-902f7dc0c21c','-', '1.0.0')))]"
+    },
+    "analyticRuleObject36": {
+      "analyticRuleVersion36": "1.0.0",
+      "_analyticRulecontentId36": "515d0bba-b297-4f83-8280-20ff7f27ecb1",
+      "analyticRuleId36": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '515d0bba-b297-4f83-8280-20ff7f27ecb1')]",
+      "analyticRuleTemplateSpecName36": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('515d0bba-b297-4f83-8280-20ff7f27ecb1')))]",
+      "_analyticRulecontentProductId36": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','515d0bba-b297-4f83-8280-20ff7f27ecb1','-', '1.0.0')))]"
+    },
+    "analyticRuleObject37": {
+      "analyticRuleVersion37": "1.0.0",
+      "_analyticRulecontentId37": "4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77",
+      "analyticRuleId37": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77')]",
+      "analyticRuleTemplateSpecName37": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77')))]",
+      "_analyticRulecontentProductId37": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77','-', '1.0.0')))]"
+    },
+    "analyticRuleObject38": {
+      "analyticRuleVersion38": "1.0.1",
+      "_analyticRulecontentId38": "4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d",
+      "analyticRuleId38": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d')]",
+      "analyticRuleTemplateSpecName38": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d')))]",
+      "_analyticRulecontentProductId38": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4bd9ce9d-8586-4beb-8fdb-bd018cacbe7d','-', '1.0.1')))]"
+    },
+    "analyticRuleObject39": {
+      "analyticRuleVersion39": "1.0.0",
+      "_analyticRulecontentId39": "ba9db6b2-3d05-42ae-8aee-3a15bbe29f27",
+      "analyticRuleId39": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ba9db6b2-3d05-42ae-8aee-3a15bbe29f27')]",
+      "analyticRuleTemplateSpecName39": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ba9db6b2-3d05-42ae-8aee-3a15bbe29f27')))]",
+      "_analyticRulecontentProductId39": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ba9db6b2-3d05-42ae-8aee-3a15bbe29f27','-', '1.0.0')))]"
+    },
+    "analyticRuleObject40": {
+      "analyticRuleVersion40": "1.0.0",
+      "_analyticRulecontentId40": "28c63a44-2d35-48b7-831b-3ed24af17c7e",
+      "analyticRuleId40": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '28c63a44-2d35-48b7-831b-3ed24af17c7e')]",
+      "analyticRuleTemplateSpecName40": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('28c63a44-2d35-48b7-831b-3ed24af17c7e')))]",
+      "_analyticRulecontentProductId40": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','28c63a44-2d35-48b7-831b-3ed24af17c7e','-', '1.0.0')))]"
+    },
+    "huntingQueryObject1": {
+      "huntingQueryVersion1": "1.1.0",
+      "_huntingQuerycontentId1": "cdac93ef-56c0-45bf-9e7f-9cbf0ad06808",
+      "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdac93ef-56c0-45bf-9e7f-9cbf0ad06808')))]"
+    },
+    "huntingQueryObject2": {
+      "huntingQueryVersion2": "1.0.0",
+      "_huntingQuerycontentId2": "4d11f63f-5b64-416e-8d77-266e4c6d382e",
+      "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4d11f63f-5b64-416e-8d77-266e4c6d382e')))]"
+    },
+    "huntingQueryObject3": {
+      "huntingQueryVersion3": "1.0.0",
+      "_huntingQuerycontentId3": "d7b7dcad-d806-4a61-b8fc-0d7c9c45bdec",
+      "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d7b7dcad-d806-4a61-b8fc-0d7c9c45bdec')))]"
+    },
+    "huntingQueryObject4": {
+      "huntingQueryVersion4": "1.0.0",
+      "_huntingQuerycontentId4": "fe9edc77-1b6c-4f1e-a223-64b580b50187",
+      "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fe9edc77-1b6c-4f1e-a223-64b580b50187')))]"
+    },
+    "huntingQueryObject5": {
+      "huntingQueryVersion5": "1.0.0",
+      "_huntingQuerycontentId5": "147c4c0a-7241-4ce9-9b71-0aecb8a2b59f",
+      "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('147c4c0a-7241-4ce9-9b71-0aecb8a2b59f')))]"
+    },
+    "huntingQueryObject6": {
+      "huntingQueryVersion6": "1.0.0",
+      "_huntingQuerycontentId6": "8fe88892-3a55-4220-9141-939a8e7a15c5",
+      "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8fe88892-3a55-4220-9141-939a8e7a15c5')))]"
+    },
+    "huntingQueryObject7": {
+      "huntingQueryVersion7": "1.0.0",
+      "_huntingQuerycontentId7": "e7791695-c103-4d20-a75a-53e90788616b",
+      "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e7791695-c103-4d20-a75a-53e90788616b')))]"
+    },
+    "huntingQueryObject8": {
+      "huntingQueryVersion8": "1.0.0",
+      "_huntingQuerycontentId8": "846bf25e-3d2d-4122-9b60-adfadd2fc616",
+      "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('846bf25e-3d2d-4122-9b60-adfadd2fc616')))]"
+    },
+    "huntingQueryObject9": {
+      "huntingQueryVersion9": "1.0.0",
+      "_huntingQuerycontentId9": "1850a459-b009-43d0-a575-8284b737eef8",
+      "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1850a459-b009-43d0-a575-8284b737eef8')))]"
+    },
+    "huntingQueryObject10": {
+      "huntingQueryVersion10": "1.0.0",
+      "_huntingQuerycontentId10": "d6991ef1-b225-4780-b6a6-cfe9b5278f5e",
+      "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d6991ef1-b225-4780-b6a6-cfe9b5278f5e')))]"
+    },
+    "huntingQueryObject11": {
+      "huntingQueryVersion11": "1.0.0",
+      "_huntingQuerycontentId11": "4713d763-122d-419c-bf6f-bdef111cd8e2",
+      "huntingQueryTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4713d763-122d-419c-bf6f-bdef111cd8e2')))]"
+    },
+    "huntingQueryObject12": {
+      "huntingQueryVersion12": "1.0.0",
+      "_huntingQuerycontentId12": "b3470e40-39ae-4c28-9282-440038f6f964",
+      "huntingQueryTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3470e40-39ae-4c28-9282-440038f6f964')))]"
+    },
+    "huntingQueryObject13": {
+      "huntingQueryVersion13": "1.0.0",
+      "_huntingQuerycontentId13": "a18e8bcf-e05d-4e45-bc6e-2c5004729fbd",
+      "huntingQueryTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a18e8bcf-e05d-4e45-bc6e-2c5004729fbd')))]"
+    },
+    "huntingQueryObject14": {
+      "huntingQueryVersion14": "1.1.1",
+      "_huntingQuerycontentId14": "cdac93ef-56c0-45bf-9e7f-9cbf0ad034234",
+      "huntingQueryTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdac93ef-56c0-45bf-9e7f-9cbf0ad034234')))]"
+    },
+    "huntingQueryObject15": {
+      "huntingQueryVersion15": "1.0.0",
+      "_huntingQuerycontentId15": "f78255b6-8f91-4cf3-a25c-e1144b7b5425",
+      "huntingQueryTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f78255b6-8f91-4cf3-a25c-e1144b7b5425')))]"
+    },
+    "huntingQueryObject16": {
+      "huntingQueryVersion16": "1.0.0",
+      "_huntingQuerycontentId16": "76c14475-9a22-4cc1-922c-437d7f614a36",
+      "huntingQueryTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('76c14475-9a22-4cc1-922c-437d7f614a36')))]"
+    },
+    "huntingQueryObject17": {
+      "huntingQueryVersion17": "1.0.0",
+      "_huntingQuerycontentId17": "89b31213-4350-4730-8d27-26667ce53894",
+      "huntingQueryTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('89b31213-4350-4730-8d27-26667ce53894')))]"
+    },
+    "huntingQueryObject18": {
+      "huntingQueryVersion18": "1.0.0",
+      "_huntingQuerycontentId18": "79f9bb6b-6d31-412e-b3bc-6e5ad1303112",
+      "huntingQueryTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('79f9bb6b-6d31-412e-b3bc-6e5ad1303112')))]"
+    },
+    "huntingQueryObject19": {
+      "huntingQueryVersion19": "1.0.0",
+      "_huntingQuerycontentId19": "0b985ed8-aacd-41ba-9b17-489be9224159",
+      "huntingQueryTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0b985ed8-aacd-41ba-9b17-489be9224159')))]"
+    },
+    "huntingQueryObject20": {
+      "huntingQueryVersion20": "1.0.0",
+      "_huntingQuerycontentId20": "6284b962-ab0d-46d8-a47f-1eb1ac1be463",
+      "huntingQueryTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6284b962-ab0d-46d8-a47f-1eb1ac1be463')))]"
+    },
+    "huntingQueryObject21": {
+      "huntingQueryVersion21": "1.0.0",
+      "_huntingQuerycontentId21": "abf42310-51c7-4d7f-98d2-e5af09859aab",
+      "huntingQueryTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('abf42310-51c7-4d7f-98d2-e5af09859aab')))]"
+    },
+    "huntingQueryObject22": {
+      "huntingQueryVersion22": "1.0.0",
+      "_huntingQuerycontentId22": "63ecff0f-3a86-468b-8c9e-a7a88fe33ebb",
+      "huntingQueryTemplateSpecName22": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('63ecff0f-3a86-468b-8c9e-a7a88fe33ebb')))]"
+    },
+    "huntingQueryObject23": {
+      "huntingQueryVersion23": "1.0.0",
+      "_huntingQuerycontentId23": "b1f8aac2-766d-47ec-8787-84bc7692ff77",
+      "huntingQueryTemplateSpecName23": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b1f8aac2-766d-47ec-8787-84bc7692ff77')))]"
+    },
+    "huntingQueryObject24": {
+      "huntingQueryVersion24": "1.0.0",
+      "_huntingQuerycontentId24": "54ea2379-28e7-48e1-8dfd-aaf8fb1331ba",
+      "huntingQueryTemplateSpecName24": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('54ea2379-28e7-48e1-8dfd-aaf8fb1331ba')))]"
+    },
+    "huntingQueryObject25": {
+      "huntingQueryVersion25": "1.0.2",
+      "_huntingQuerycontentId25": "cdac93ef-56c0-45bf-9e7f-9cbf0ad06567",
+      "huntingQueryTemplateSpecName25": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdac93ef-56c0-45bf-9e7f-9cbf0ad06567')))]"
+    },
+    "huntingQueryObject26": {
+      "huntingQueryVersion26": "1.0.0",
+      "_huntingQuerycontentId26": "fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7",
+      "huntingQueryTemplateSpecName26": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7')))]"
+    },
+    "huntingQueryObject27": {
+      "huntingQueryVersion27": "1.0.0",
+      "_huntingQuerycontentId27": "29683151-e15d-4c0c-845b-892be89bf080",
+      "huntingQueryTemplateSpecName27": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('29683151-e15d-4c0c-845b-892be89bf080')))]"
+    },
+    "huntingQueryObject28": {
+      "huntingQueryVersion28": "1.0.0",
+      "_huntingQuerycontentId28": "518e6938-10ef-4165-af19-82f1287141bc",
+      "huntingQueryTemplateSpecName28": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('518e6938-10ef-4165-af19-82f1287141bc')))]"
+    },
+    "huntingQueryObject29": {
+      "huntingQueryVersion29": "1.0.0",
+      "_huntingQuerycontentId29": "b6392f39-a1f4-4ec8-8689-4cb9d28c295a",
+      "huntingQueryTemplateSpecName29": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b6392f39-a1f4-4ec8-8689-4cb9d28c295a')))]"
+    },
+    "huntingQueryObject30": {
+      "huntingQueryVersion30": "1.0.0",
+      "_huntingQuerycontentId30": "16eda414-1550-4cdc-8512-0769901d3f05",
+      "huntingQueryTemplateSpecName30": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('16eda414-1550-4cdc-8512-0769901d3f05')))]"
+    },
+    "huntingQueryObject31": {
+      "huntingQueryVersion31": "1.0.0",
+      "_huntingQuerycontentId31": "7fbf7687-5ded-4c39-9fe9-f4f6aa6fc422",
+      "huntingQueryTemplateSpecName31": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7fbf7687-5ded-4c39-9fe9-f4f6aa6fc422')))]"
+    },
+    "huntingQueryObject32": {
+      "huntingQueryVersion32": "1.0.0",
+      "_huntingQuerycontentId32": "eb560458-d96f-4c68-acbb-14b3c706ebe7",
+      "huntingQueryTemplateSpecName32": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('eb560458-d96f-4c68-acbb-14b3c706ebe7')))]"
+    },
+    "huntingQueryObject33": {
+      "huntingQueryVersion33": "1.0.0",
+      "_huntingQuerycontentId33": "14d47b2a-62b3-4c7b-819c-699e264c581d",
+      "huntingQueryTemplateSpecName33": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('14d47b2a-62b3-4c7b-819c-699e264c581d')))]"
+    },
+    "huntingQueryObject34": {
+      "huntingQueryVersion34": "1.0.0",
+      "_huntingQuerycontentId34": "62d6a2e6-4583-4538-a476-a5b3c672657b",
+      "huntingQueryTemplateSpecName34": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('62d6a2e6-4583-4538-a476-a5b3c672657b')))]"
+    },
+    "huntingQueryObject35": {
+      "huntingQueryVersion35": "1.0.0",
+      "_huntingQuerycontentId35": "79755078-7be8-4f13-a8e7-1ce87cb7d5c0",
+      "huntingQueryTemplateSpecName35": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('79755078-7be8-4f13-a8e7-1ce87cb7d5c0')))]"
+    },
+    "huntingQueryObject36": {
+      "huntingQueryVersion36": "1.0.0",
+      "_huntingQuerycontentId36": "5971f2e7-1bb2-4170-aa7a-577ed8a45c72",
+      "huntingQueryTemplateSpecName36": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5971f2e7-1bb2-4170-aa7a-577ed8a45c72')))]"
+    },
+    "huntingQueryObject37": {
+      "huntingQueryVersion37": "1.1.0",
+      "_huntingQuerycontentId37": "3dbaa9c1-5e69-40a9-bacb-8cbdb4a0e6cb",
+      "huntingQueryTemplateSpecName37": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3dbaa9c1-5e69-40a9-bacb-8cbdb4a0e6cb')))]"
+    },
+    "huntingQueryObject38": {
+      "huntingQueryVersion38": "1.1.0",
+      "_huntingQuerycontentId38": "23b646e8-b885-4cde-a9ab-1e35fa5e37a7",
+      "huntingQueryTemplateSpecName38": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('23b646e8-b885-4cde-a9ab-1e35fa5e37a7')))]"
+    },
+    "huntingQueryObject39": {
+      "huntingQueryVersion39": "1.1.0",
+      "_huntingQuerycontentId39": "ba97d6b9-f82e-4917-9c07-4c0028bbd32d",
+      "huntingQueryTemplateSpecName39": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ba97d6b9-f82e-4917-9c07-4c0028bbd32d')))]"
+    },
+    "huntingQueryObject40": {
+      "huntingQueryVersion40": "1.0.0",
+      "_huntingQuerycontentId40": "4c021477-38f0-409e-869b-11056fcd47f1",
+      "huntingQueryTemplateSpecName40": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4c021477-38f0-409e-869b-11056fcd47f1')))]"
+    },
+    "huntingQueryObject41": {
+      "huntingQueryVersion41": "1.0.0",
+      "_huntingQuerycontentId41": "a8c66aec-2000-45d8-8481-36aaa17f1033",
+      "huntingQueryTemplateSpecName41": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a8c66aec-2000-45d8-8481-36aaa17f1033')))]"
+    },
+    "huntingQueryObject42": {
+      "huntingQueryVersion42": "1.0.1",
+      "_huntingQuerycontentId42": "08113d6f-3c95-45ba-94df-4fdd7f35d944",
+      "huntingQueryTemplateSpecName42": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('08113d6f-3c95-45ba-94df-4fdd7f35d944')))]"
+    },
+    "huntingQueryObject43": {
+      "huntingQueryVersion43": "1.0.0",
+      "_huntingQuerycontentId43": "1b56831b-3713-4c9c-ac75-a7e330623076",
+      "huntingQueryTemplateSpecName43": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1b56831b-3713-4c9c-ac75-a7e330623076')))]"
+    },
+    "huntingQueryObject44": {
+      "huntingQueryVersion44": "1.0.0",
+      "_huntingQuerycontentId44": "ba1a91ad-1f99-4386-b191-06a76ef213f8",
+      "huntingQueryTemplateSpecName44": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ba1a91ad-1f99-4386-b191-06a76ef213f8')))]"
+    },
+    "huntingQueryObject45": {
+      "huntingQueryVersion45": "1.0.0",
+      "_huntingQuerycontentId45": "242561f3-568a-4864-be15-fbc85b2e77f9",
+      "huntingQueryTemplateSpecName45": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('242561f3-568a-4864-be15-fbc85b2e77f9')))]"
+    },
+    "huntingQueryObject46": {
+      "huntingQueryVersion46": "1.0.0",
+      "_huntingQuerycontentId46": "ff56a21d-fc95-4c11-8f9d-cc59c48cd4e6",
+      "huntingQueryTemplateSpecName46": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ff56a21d-fc95-4c11-8f9d-cc59c48cd4e6')))]"
+    },
+    "huntingQueryObject47": {
+      "huntingQueryVersion47": "1.0.0",
+      "_huntingQuerycontentId47": "0d5ae69d-bdb2-404d-8c8c-50ebe68b6a5b",
+      "huntingQueryTemplateSpecName47": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0d5ae69d-bdb2-404d-8c8c-50ebe68b6a5b')))]"
+    },
+    "huntingQueryObject48": {
+      "huntingQueryVersion48": "1.0.0",
+      "_huntingQuerycontentId48": "e55e178e-48ba-4313-918a-2d3e16a95441",
+      "huntingQueryTemplateSpecName48": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e55e178e-48ba-4313-918a-2d3e16a95441')))]"
+    },
+    "huntingQueryObject49": {
+      "huntingQueryVersion49": "1.0.0",
+      "_huntingQuerycontentId49": "bc2d8214-afb6-4876-b210-25b69325b9b2",
+      "huntingQueryTemplateSpecName49": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bc2d8214-afb6-4876-b210-25b69325b9b2')))]"
+    },
+    "huntingQueryObject50": {
+      "huntingQueryVersion50": "1.0.0",
+      "_huntingQuerycontentId50": "712ffdd8-ddce-4372-85dd-063029b418cf",
+      "huntingQueryTemplateSpecName50": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('712ffdd8-ddce-4372-85dd-063029b418cf')))]"
+    },
+    "huntingQueryObject51": {
+      "huntingQueryVersion51": "1.0.0",
+      "_huntingQuerycontentId51": "81ede5df-2ec3-40a5-9dff-1fe6a841079d",
+      "huntingQueryTemplateSpecName51": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('81ede5df-2ec3-40a5-9dff-1fe6a841079d')))]"
+    },
+    "huntingQueryObject52": {
+      "huntingQueryVersion52": "1.0.0",
+      "_huntingQuerycontentId52": "63c799bc-7567-4e4d-97be-e143fcfaa333",
+      "huntingQueryTemplateSpecName52": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('63c799bc-7567-4e4d-97be-e143fcfaa333')))]"
+    },
+    "huntingQueryObject53": {
+      "huntingQueryVersion53": "1.0.0",
+      "_huntingQuerycontentId53": "deb4b2c6-c10e-4044-8cf4-84243e40db73",
+      "huntingQueryTemplateSpecName53": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('deb4b2c6-c10e-4044-8cf4-84243e40db73')))]"
+    },
+    "huntingQueryObject54": {
+      "huntingQueryVersion54": "1.0.0",
+      "_huntingQuerycontentId54": "92b76a34-502e-4a53-93ec-9fc37c3b358c",
+      "huntingQueryTemplateSpecName54": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('92b76a34-502e-4a53-93ec-9fc37c3b358c')))]"
+    },
+    "huntingQueryObject55": {
+      "huntingQueryVersion55": "1.1.0",
+      "_huntingQuerycontentId55": "af183f01-6d98-4fca-8ca4-63577b78a26e",
+      "huntingQueryTemplateSpecName55": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('af183f01-6d98-4fca-8ca4-63577b78a26e')))]"
+    },
+    "huntingQueryObject56": {
+      "huntingQueryVersion56": "1.1.0",
+      "_huntingQuerycontentId56": "530ef5e4-7ee4-4d70-a8e2-a06459605c02",
+      "huntingQueryTemplateSpecName56": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('530ef5e4-7ee4-4d70-a8e2-a06459605c02')))]"
+    },
+    "huntingQueryObject57": {
+      "huntingQueryVersion57": "1.1.0",
+      "_huntingQuerycontentId57": "db9789ab-0636-4ea6-b779-1b72b4b64aac",
+      "huntingQueryTemplateSpecName57": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('db9789ab-0636-4ea6-b779-1b72b4b64aac')))]"
+    },
+    "huntingQueryObject58": {
+      "huntingQueryVersion58": "1.0.0",
+      "_huntingQuerycontentId58": "86c7d21b-2081-419d-bc2e-7bc909d61eef",
+      "huntingQueryTemplateSpecName58": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('86c7d21b-2081-419d-bc2e-7bc909d61eef')))]"
+    },
+    "huntingQueryObject59": {
+      "huntingQueryVersion59": "1.0.0",
+      "_huntingQuerycontentId59": "6f606826-b995-4a8d-8c2c-ee08e3d1194a",
+      "huntingQueryTemplateSpecName59": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6f606826-b995-4a8d-8c2c-ee08e3d1194a')))]"
+    },
+    "huntingQueryObject60": {
+      "huntingQueryVersion60": "1.1.0",
+      "_huntingQuerycontentId60": "b8330f6e-fc47-40ce-b225-5d3b055c6446",
+      "huntingQueryTemplateSpecName60": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b8330f6e-fc47-40ce-b225-5d3b055c6446')))]"
+    },
+    "huntingQueryObject61": {
+      "huntingQueryVersion61": "1.0.0",
+      "_huntingQuerycontentId61": "7d7a3d3f-22db-4cdf-ba67-c57215777a3c",
+      "huntingQueryTemplateSpecName61": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7d7a3d3f-22db-4cdf-ba67-c57215777a3c')))]"
+    },
+    "huntingQueryObject62": {
+      "huntingQueryVersion62": "1.0.0",
+      "_huntingQuerycontentId62": "eb0e4edb-f423-49f8-a02a-4ededdd30dd5",
+      "huntingQueryTemplateSpecName62": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('eb0e4edb-f423-49f8-a02a-4ededdd30dd5')))]"
+    },
+    "huntingQueryObject63": {
+      "huntingQueryVersion63": "1.0.0",
+      "_huntingQuerycontentId63": "0717b136-a1ef-4af0-a911-e189d0064099",
+      "huntingQueryTemplateSpecName63": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0717b136-a1ef-4af0-a911-e189d0064099')))]"
+    },
+    "huntingQueryObject64": {
+      "huntingQueryVersion64": "1.0.0",
+      "_huntingQuerycontentId64": "0955f477-6471-468a-9b13-fc5fa96d7db2",
+      "huntingQueryTemplateSpecName64": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0955f477-6471-468a-9b13-fc5fa96d7db2')))]"
+    },
+    "huntingQueryObject65": {
+      "huntingQueryVersion65": "1.0.0",
+      "_huntingQuerycontentId65": "85dea577-1c76-44ff-8cad-b47182874ddb",
+      "huntingQueryTemplateSpecName65": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('85dea577-1c76-44ff-8cad-b47182874ddb')))]"
+    },
+    "huntingQueryObject66": {
+      "huntingQueryVersion66": "1.0.0",
+      "_huntingQuerycontentId66": "da745698-da8a-40c5-b527-2e9328c2cefe",
+      "huntingQueryTemplateSpecName66": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('da745698-da8a-40c5-b527-2e9328c2cefe')))]"
+    },
+    "huntingQueryObject67": {
+      "huntingQueryVersion67": "1.0.0",
+      "_huntingQuerycontentId67": "c1cac5ad-7aaa-40de-89aa-954f5a33a578",
+      "huntingQueryTemplateSpecName67": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c1cac5ad-7aaa-40de-89aa-954f5a33a578')))]"
+    },
+    "huntingQueryObject68": {
+      "huntingQueryVersion68": "1.0.0",
+      "_huntingQuerycontentId68": "8e9a96dd-f85d-4f5e-a65f-dcc55d6d9935",
+      "huntingQueryTemplateSpecName68": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8e9a96dd-f85d-4f5e-a65f-dcc55d6d9935')))]"
+    },
+    "huntingQueryObject69": {
+      "huntingQueryVersion69": "1.0.0",
+      "_huntingQuerycontentId69": "11cc0e3f-9718-4ab5-be7b-d9c036ed6b0a",
+      "huntingQueryTemplateSpecName69": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('11cc0e3f-9718-4ab5-be7b-d9c036ed6b0a')))]"
+    },
+    "huntingQueryObject70": {
+      "huntingQueryVersion70": "1.0.0",
+      "_huntingQuerycontentId70": "e6259b03-622e-4e11-9c54-94987dad7c14",
+      "huntingQueryTemplateSpecName70": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e6259b03-622e-4e11-9c54-94987dad7c14')))]"
+    },
+    "huntingQueryObject71": {
+      "huntingQueryVersion71": "1.0.0",
+      "_huntingQuerycontentId71": "dd4a480b-aa24-4b62-b1f3-f538d8abbdfb",
+      "huntingQueryTemplateSpecName71": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dd4a480b-aa24-4b62-b1f3-f538d8abbdfb')))]"
+    },
+    "huntingQueryObject72": {
+      "huntingQueryVersion72": "1.0.0",
+      "_huntingQuerycontentId72": "fb46ca1b-0b46-4d9c-b3b3-2f8f807e9f72",
+      "huntingQueryTemplateSpecName72": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fb46ca1b-0b46-4d9c-b3b3-2f8f807e9f72')))]"
+    },
+    "huntingQueryObject73": {
+      "huntingQueryVersion73": "1.0.0",
+      "_huntingQuerycontentId73": "0da830c3-5d0e-4b98-bfa1-d5131a8d0ebe",
+      "huntingQueryTemplateSpecName73": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0da830c3-5d0e-4b98-bfa1-d5131a8d0ebe')))]"
+    },
+    "huntingQueryObject74": {
+      "huntingQueryVersion74": "1.0.0",
+      "_huntingQuerycontentId74": "57f95ba7-938d-4a76-b411-c01034c0d167",
+      "huntingQueryTemplateSpecName74": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('57f95ba7-938d-4a76-b411-c01034c0d167')))]"
+    },
+    "huntingQueryObject75": {
+      "huntingQueryVersion75": "1.0.0",
+      "_huntingQuerycontentId75": "54569b06-47fc-41ae-9b00-f7d9b61337b6",
+      "huntingQueryTemplateSpecName75": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('54569b06-47fc-41ae-9b00-f7d9b61337b6')))]"
+    },
+    "huntingQueryObject76": {
+      "huntingQueryVersion76": "1.0.0",
+      "_huntingQuerycontentId76": "430a9c0d-f3ce-46a3-a994-92b3ada0d1b2",
+      "huntingQueryTemplateSpecName76": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('430a9c0d-f3ce-46a3-a994-92b3ada0d1b2')))]"
+    },
+    "huntingQueryObject77": {
+      "huntingQueryVersion77": "1.0.0",
+      "_huntingQuerycontentId77": "f840db5b-87c9-43c8-a8c3-5b6b83838cd4",
+      "huntingQueryTemplateSpecName77": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f840db5b-87c9-43c8-a8c3-5b6b83838cd4')))]"
+    },
+    "huntingQueryObject78": {
+      "huntingQueryVersion78": "1.0.0",
+      "_huntingQuerycontentId78": "b95994d1-1008-4c42-a74f-9f2967e39ed6",
+      "huntingQueryTemplateSpecName78": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b95994d1-1008-4c42-a74f-9f2967e39ed6')))]"
+    },
+    "huntingQueryObject79": {
+      "huntingQueryVersion79": "1.0.0",
+      "_huntingQuerycontentId79": "a96c1571-1f7d-48dc-8287-7df5a5f0d987",
+      "huntingQueryTemplateSpecName79": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a96c1571-1f7d-48dc-8287-7df5a5f0d987')))]"
+    },
+    "huntingQueryObject80": {
+      "huntingQueryVersion80": "1.0.0",
+      "_huntingQuerycontentId80": "2c6e7f75-d83c-4344-afdc-83335fe550e6",
+      "huntingQueryTemplateSpecName80": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2c6e7f75-d83c-4344-afdc-83335fe550e6')))]"
+    },
+    "huntingQueryObject81": {
+      "huntingQueryVersion81": "1.0.0",
+      "_huntingQuerycontentId81": "38d6e2fb-a804-4170-8d32-d251ecd6bcd2",
+      "huntingQueryTemplateSpecName81": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('38d6e2fb-a804-4170-8d32-d251ecd6bcd2')))]"
+    },
+    "huntingQueryObject82": {
+      "huntingQueryVersion82": "1.0.0",
+      "_huntingQuerycontentId82": "1c51e10e-7f77-40bc-bd37-6aa55cdf94d6",
+      "huntingQueryTemplateSpecName82": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1c51e10e-7f77-40bc-bd37-6aa55cdf94d6')))]"
+    },
+    "huntingQueryObject83": {
+      "huntingQueryVersion83": "1.0.0",
+      "_huntingQuerycontentId83": "da7b973a-0045-4fd6-9161-269369336d24",
+      "huntingQueryTemplateSpecName83": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('da7b973a-0045-4fd6-9161-269369336d24')))]"
+    },
+    "huntingQueryObject84": {
+      "huntingQueryVersion84": "1.0.0",
+      "_huntingQuerycontentId84": "6b478186-da3b-4d71-beaa-aa5b42908499",
+      "huntingQueryTemplateSpecName84": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6b478186-da3b-4d71-beaa-aa5b42908499')))]"
+    },
+    "huntingQueryObject85": {
+      "huntingQueryVersion85": "1.0.0",
+      "_huntingQuerycontentId85": "da932998-81dd-4be4-963c-f4890cb4192e",
+      "huntingQueryTemplateSpecName85": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('da932998-81dd-4be4-963c-f4890cb4192e')))]"
+    },
+    "huntingQueryObject86": {
+      "huntingQueryVersion86": "1.0.0",
+      "_huntingQuerycontentId86": "b2beec6a-2c1c-4319-a191-e70c2ee42857",
+      "huntingQueryTemplateSpecName86": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b2beec6a-2c1c-4319-a191-e70c2ee42857')))]"
+    },
+    "huntingQueryObject87": {
+      "huntingQueryVersion87": "1.0.0",
+      "_huntingQuerycontentId87": "45c47684-6650-44b6-81c0-951522d0c435",
+      "huntingQueryTemplateSpecName87": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('45c47684-6650-44b6-81c0-951522d0c435')))]"
+    },
+    "huntingQueryObject88": {
+      "huntingQueryVersion88": "1.0.0",
+      "_huntingQuerycontentId88": "99e1246e-c1a9-4794-8e96-eb906c73c529",
+      "huntingQueryTemplateSpecName88": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('99e1246e-c1a9-4794-8e96-eb906c73c529')))]"
+    },
+    "huntingQueryObject89": {
+      "huntingQueryVersion89": "1.0.0",
+      "_huntingQuerycontentId89": "12225f50-9d41-4b78-8269-cc127d98654c",
+      "huntingQueryTemplateSpecName89": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('12225f50-9d41-4b78-8269-cc127d98654c')))]"
+    },
+    "huntingQueryObject90": {
+      "huntingQueryVersion90": "1.0.0",
+      "_huntingQuerycontentId90": "cadf6e78-2a9a-4fb5-b788-30a592d699d3",
+      "huntingQueryTemplateSpecName90": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cadf6e78-2a9a-4fb5-b788-30a592d699d3')))]"
+    },
+    "huntingQueryObject91": {
+      "huntingQueryVersion91": "1.0.0",
+      "_huntingQuerycontentId91": "95b0c7ed-2853-4343-80a9-ab076cf31e51",
+      "huntingQueryTemplateSpecName91": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('95b0c7ed-2853-4343-80a9-ab076cf31e51')))]"
+    },
+    "huntingQueryObject92": {
+      "huntingQueryVersion92": "1.0.0",
+      "_huntingQuerycontentId92": "439f817c-845c-4dda-a8d9-5c1f6831cee9",
+      "huntingQueryTemplateSpecName92": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('439f817c-845c-4dda-a8d9-5c1f6831cee9')))]"
+    },
+    "huntingQueryObject93": {
+      "huntingQueryVersion93": "1.0.0",
+      "_huntingQuerycontentId93": "07c85687-6dee-4266-9345-1e34de85d989",
+      "huntingQueryTemplateSpecName93": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('07c85687-6dee-4266-9345-1e34de85d989')))]"
+    },
+    "huntingQueryObject94": {
+      "huntingQueryVersion94": "1.0.0",
+      "_huntingQuerycontentId94": "23dbd58b-23ce-42ae-b4d1-0dfdd35871ea",
+      "huntingQueryTemplateSpecName94": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('23dbd58b-23ce-42ae-b4d1-0dfdd35871ea')))]"
+    },
+    "huntingQueryObject95": {
+      "huntingQueryVersion95": "1.0.0",
+      "_huntingQuerycontentId95": "817043be-4b30-4e66-a742-8f601a78b08f",
+      "huntingQueryTemplateSpecName95": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('817043be-4b30-4e66-a742-8f601a78b08f')))]"
+    },
+    "huntingQueryObject96": {
+      "huntingQueryVersion96": "1.0.0",
+      "_huntingQuerycontentId96": "a924de5a-89ce-43c7-8adc-b130e5f1924c",
+      "huntingQueryTemplateSpecName96": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a924de5a-89ce-43c7-8adc-b130e5f1924c')))]"
+    },
+    "huntingQueryObject97": {
+      "huntingQueryVersion97": "1.0.0",
+      "_huntingQuerycontentId97": "2de2de5d-87a3-4e13-9b97-5f42e44d0954",
+      "huntingQueryTemplateSpecName97": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2de2de5d-87a3-4e13-9b97-5f42e44d0954')))]"
+    },
+    "huntingQueryObject98": {
+      "huntingQueryVersion98": "1.1.0",
+      "_huntingQuerycontentId98": "e1dbe1d2-785a-4ecd-a1c0-233fc0e990bc",
+      "huntingQueryTemplateSpecName98": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e1dbe1d2-785a-4ecd-a1c0-233fc0e990bc')))]"
+    },
+    "huntingQueryObject99": {
+      "huntingQueryVersion99": "1.1.0",
+      "_huntingQuerycontentId99": "b3a4b803-06f6-46d8-9220-b3a53e85ce4f",
+      "huntingQueryTemplateSpecName99": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3a4b803-06f6-46d8-9220-b3a53e85ce4f')))]"
+    },
+    "huntingQueryObject100": {
+      "huntingQueryVersion100": "1.1.0",
+      "_huntingQuerycontentId100": "db79eb5a-785a-400a-a7ef-7285dde8e116",
+      "huntingQueryTemplateSpecName100": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('db79eb5a-785a-400a-a7ef-7285dde8e116')))]"
+    },
+    "huntingQueryObject101": {
+      "huntingQueryVersion101": "1.1.0",
+      "_huntingQuerycontentId101": "15d255f7-57a6-4b23-bd89-376930d3a305",
+      "huntingQueryTemplateSpecName101": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('15d255f7-57a6-4b23-bd89-376930d3a305')))]"
+    },
+    "huntingQueryObject102": {
+      "huntingQueryVersion102": "1.0.0",
+      "_huntingQuerycontentId102": "ef29d6b6-9192-46aa-b16a-082c2da2f78f",
+      "huntingQueryTemplateSpecName102": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ef29d6b6-9192-46aa-b16a-082c2da2f78f')))]"
+    },
+    "huntingQueryObject103": {
+      "huntingQueryVersion103": "1.0.0",
+      "_huntingQuerycontentId103": "af541ae2-9bb4-4737-a8ea-4fa261bc3866",
+      "huntingQueryTemplateSpecName103": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('af541ae2-9bb4-4737-a8ea-4fa261bc3866')))]"
+    },
+    "huntingQueryObject104": {
+      "huntingQueryVersion104": "1.0.0",
+      "_huntingQuerycontentId104": "a2a7bede-cf55-47ed-9aeb-7b4c97079f4f",
+      "huntingQueryTemplateSpecName104": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a2a7bede-cf55-47ed-9aeb-7b4c97079f4f')))]"
+    },
+    "huntingQueryObject105": {
+      "huntingQueryVersion105": "1.1.0",
+      "_huntingQuerycontentId105": "0d16e85e-82ec-460a-bf48-e90164464f7c",
+      "huntingQueryTemplateSpecName105": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0d16e85e-82ec-460a-bf48-e90164464f7c')))]"
+    },
+    "huntingQueryObject106": {
+      "huntingQueryVersion106": "1.0.0",
+      "_huntingQuerycontentId106": "c6bbcac2-a6b8-4537-a32a-6f1367e6aa44",
+      "huntingQueryTemplateSpecName106": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c6bbcac2-a6b8-4537-a32a-6f1367e6aa44')))]"
+    },
+    "huntingQueryObject107": {
+      "huntingQueryVersion107": "1.1.0",
+      "_huntingQuerycontentId107": "a370ad6f-e7fa-4740-ab9e-cb5560e3599f",
+      "huntingQueryTemplateSpecName107": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a370ad6f-e7fa-4740-ab9e-cb5560e3599f')))]"
+    },
+    "huntingQueryObject108": {
+      "huntingQueryVersion108": "1.0.0",
+      "_huntingQuerycontentId108": "c3a6f568-8200-4f2f-88b8-a4df5eb54ba9",
+      "huntingQueryTemplateSpecName108": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c3a6f568-8200-4f2f-88b8-a4df5eb54ba9')))]"
+    },
+    "huntingQueryObject109": {
+      "huntingQueryVersion109": "1.0.0",
+      "_huntingQuerycontentId109": "12eeae9e-8f0a-4b8c-b437-31c998f15af8",
+      "huntingQueryTemplateSpecName109": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('12eeae9e-8f0a-4b8c-b437-31c998f15af8')))]"
+    },
+    "huntingQueryObject110": {
+      "huntingQueryVersion110": "1.0.0",
+      "_huntingQuerycontentId110": "18fee342-8209-4270-9198-711646867e71",
+      "huntingQueryTemplateSpecName110": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('18fee342-8209-4270-9198-711646867e71')))]"
+    },
+    "huntingQueryObject111": {
+      "huntingQueryVersion111": "1.0.0",
+      "_huntingQuerycontentId111": "9cb4a6eb-c7ae-44ac-b12b-c16ec63da385",
+      "huntingQueryTemplateSpecName111": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9cb4a6eb-c7ae-44ac-b12b-c16ec63da385')))]"
+    },
+    "huntingQueryObject112": {
+      "huntingQueryVersion112": "1.0.0",
+      "_huntingQuerycontentId112": "28c79831-120c-4028-8a2b-4e4ae3082148",
+      "huntingQueryTemplateSpecName112": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('28c79831-120c-4028-8a2b-4e4ae3082148')))]"
+    },
+    "huntingQueryObject113": {
+      "huntingQueryVersion113": "1.0.0",
+      "_huntingQuerycontentId113": "f304b75a-a2a0-45fb-814c-40b6e08211f0",
+      "huntingQueryTemplateSpecName113": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f304b75a-a2a0-45fb-814c-40b6e08211f0')))]"
+    },
+    "huntingQueryObject114": {
+      "huntingQueryVersion114": "1.0.0",
+      "_huntingQuerycontentId114": "b3470167-2608-44a2-bd2f-8ebad88a27d5",
+      "huntingQueryTemplateSpecName114": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3470167-2608-44a2-bd2f-8ebad88a27d5')))]"
+    },
+    "huntingQueryObject115": {
+      "huntingQueryVersion115": "1.0.0",
+      "_huntingQuerycontentId115": "3cb281a9-34e5-4864-8303-6c07e096818b",
+      "huntingQueryTemplateSpecName115": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3cb281a9-34e5-4864-8303-6c07e096818b')))]"
+    },
+    "huntingQueryObject116": {
+      "huntingQueryVersion116": "1.0.0",
+      "_huntingQuerycontentId116": "b8eb3e2e-0f95-458e-b6d1-fe36a0ee8310",
+      "huntingQueryTemplateSpecName116": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b8eb3e2e-0f95-458e-b6d1-fe36a0ee8310')))]"
+    },
+    "huntingQueryObject117": {
+      "huntingQueryVersion117": "1.0.0",
+      "_huntingQuerycontentId117": "dc230eec-acc2-482f-8601-25125c8ff122",
+      "huntingQueryTemplateSpecName117": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dc230eec-acc2-482f-8601-25125c8ff122')))]"
+    },
+    "huntingQueryObject118": {
+      "huntingQueryVersion118": "1.0.0",
+      "_huntingQuerycontentId118": "489ad959-48eb-4c34-bed6-764cfd39214d",
+      "huntingQueryTemplateSpecName118": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('489ad959-48eb-4c34-bed6-764cfd39214d')))]"
+    },
+    "huntingQueryObject119": {
+      "huntingQueryVersion119": "1.0.0",
+      "_huntingQuerycontentId119": "f094e9f1-2d55-450d-af1a-0fdcd290f8c4",
+      "huntingQueryTemplateSpecName119": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f094e9f1-2d55-450d-af1a-0fdcd290f8c4')))]"
+    },
+    "huntingQueryObject120": {
+      "huntingQueryVersion120": "1.0.0",
+      "_huntingQuerycontentId120": "01cf63bd-debd-4d03-847c-d19c31844501",
+      "huntingQueryTemplateSpecName120": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('01cf63bd-debd-4d03-847c-d19c31844501')))]"
+    },
+    "huntingQueryObject121": {
+      "huntingQueryVersion121": "1.0.0",
+      "_huntingQuerycontentId121": "8d25156b-2ac4-4528-b1b1-f8427267f9f2",
+      "huntingQueryTemplateSpecName121": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8d25156b-2ac4-4528-b1b1-f8427267f9f2')))]"
+    },
+    "huntingQueryObject122": {
+      "huntingQueryVersion122": "1.0.0",
+      "_huntingQuerycontentId122": "b2a36ca5-b6a4-4f27-a7d8-7f044885cccf",
+      "huntingQueryTemplateSpecName122": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b2a36ca5-b6a4-4f27-a7d8-7f044885cccf')))]"
+    },
+    "huntingQueryObject123": {
+      "huntingQueryVersion123": "1.0.1",
+      "_huntingQuerycontentId123": "02bdbd93-02b7-40e4-9468-d501463e57af",
+      "huntingQueryTemplateSpecName123": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('02bdbd93-02b7-40e4-9468-d501463e57af')))]"
+    },
+    "huntingQueryObject124": {
+      "huntingQueryVersion124": "1.0.0",
+      "_huntingQuerycontentId124": "fc47e222-c348-43ca-ba11-b4628fe243cd",
+      "huntingQueryTemplateSpecName124": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fc47e222-c348-43ca-ba11-b4628fe243cd')))]"
+    },
+    "huntingQueryObject125": {
+      "huntingQueryVersion125": "1.0.0",
+      "_huntingQuerycontentId125": "b2a6440b-6ebd-4d86-aa33-cfe11f9defcf",
+      "huntingQueryTemplateSpecName125": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b2a6440b-6ebd-4d86-aa33-cfe11f9defcf')))]"
+    },
+    "huntingQueryObject126": {
+      "huntingQueryVersion126": "1.0.0",
+      "_huntingQuerycontentId126": "20c9d89a-ad65-48f4-ba14-605715af640a",
+      "huntingQueryTemplateSpecName126": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('20c9d89a-ad65-48f4-ba14-605715af640a')))]"
+    },
+    "huntingQueryObject127": {
+      "huntingQueryVersion127": "1.0.0",
+      "_huntingQuerycontentId127": "71117505-5a71-431e-8605-8896960affe5",
+      "huntingQueryTemplateSpecName127": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('71117505-5a71-431e-8605-8896960affe5')))]"
+    },
+    "huntingQueryObject128": {
+      "huntingQueryVersion128": "1.0.0",
+      "_huntingQuerycontentId128": "4684afc7-3d05-4ec1-8fb0-342707d0ac5d",
+      "huntingQueryTemplateSpecName128": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4684afc7-3d05-4ec1-8fb0-342707d0ac5d')))]"
+    },
+    "huntingQueryObject129": {
+      "huntingQueryVersion129": "1.0.0",
+      "_huntingQuerycontentId129": "45d955e0-0e34-4ce7-833d-c14b43d69677",
+      "huntingQueryTemplateSpecName129": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('45d955e0-0e34-4ce7-833d-c14b43d69677')))]"
+    },
+    "huntingQueryObject130": {
+      "huntingQueryVersion130": "1.0.0",
+      "_huntingQuerycontentId130": "8b7a84e9-5831-4e90-9b98-bd57493c6cc9",
+      "huntingQueryTemplateSpecName130": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8b7a84e9-5831-4e90-9b98-bd57493c6cc9')))]"
+    },
+    "huntingQueryObject131": {
+      "huntingQueryVersion131": "1.0.0",
+      "_huntingQuerycontentId131": "f6f317c4-8ebe-4f93-9068-720705a75c65",
+      "huntingQueryTemplateSpecName131": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f6f317c4-8ebe-4f93-9068-720705a75c65')))]"
+    },
+    "huntingQueryObject132": {
+      "huntingQueryVersion132": "1.0.0",
+      "_huntingQuerycontentId132": "5515296b-8f4c-42f1-a5ad-0574fbf99f23",
+      "huntingQueryTemplateSpecName132": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5515296b-8f4c-42f1-a5ad-0574fbf99f23')))]"
+    },
+    "huntingQueryObject133": {
+      "huntingQueryVersion133": "1.0.0",
+      "_huntingQuerycontentId133": "abd7e757-7737-4c9f-af7a-92e87172ff4f",
+      "huntingQueryTemplateSpecName133": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('abd7e757-7737-4c9f-af7a-92e87172ff4f')))]"
+    },
+    "huntingQueryObject134": {
+      "huntingQueryVersion134": "1.0.0",
+      "_huntingQuerycontentId134": "fea3f03b-0723-4f3e-9f6a-c8a6a67fbde0",
+      "huntingQueryTemplateSpecName134": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fea3f03b-0723-4f3e-9f6a-c8a6a67fbde0')))]"
+    },
+    "huntingQueryObject135": {
+      "huntingQueryVersion135": "1.0.0",
+      "_huntingQuerycontentId135": "008ff55b-0588-4d39-af03-c08f1bb519d7",
+      "huntingQueryTemplateSpecName135": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('008ff55b-0588-4d39-af03-c08f1bb519d7')))]"
+    },
+    "huntingQueryObject136": {
+      "huntingQueryVersion136": "1.0.0",
+      "_huntingQuerycontentId136": "161b163c-0805-46fd-abda-2fe5f0a5185e",
+      "huntingQueryTemplateSpecName136": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('161b163c-0805-46fd-abda-2fe5f0a5185e')))]"
+    },
+    "huntingQueryObject137": {
+      "huntingQueryVersion137": "1.0.0",
+      "_huntingQuerycontentId137": "68aaf2af-83ac-4f9e-9680-4050700b93f9",
+      "huntingQueryTemplateSpecName137": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('68aaf2af-83ac-4f9e-9680-4050700b93f9')))]"
+    },
+    "huntingQueryObject138": {
+      "huntingQueryVersion138": "1.0.0",
+      "_huntingQuerycontentId138": "ace8e98a-660b-4fa9-a877-60644eb83344",
+      "huntingQueryTemplateSpecName138": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ace8e98a-660b-4fa9-a877-60644eb83344')))]"
+    },
+    "huntingQueryObject139": {
+      "huntingQueryVersion139": "1.0.0",
+      "_huntingQuerycontentId139": "b1fa5bb7-9c4e-4d4f-826a-afc1fbe8c2cf",
+      "huntingQueryTemplateSpecName139": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b1fa5bb7-9c4e-4d4f-826a-afc1fbe8c2cf')))]"
+    },
+    "huntingQueryObject140": {
+      "huntingQueryVersion140": "1.0.0",
+      "_huntingQuerycontentId140": "8b3bd5c3-1f37-4131-8b3a-a0f6d540e56d",
+      "huntingQueryTemplateSpecName140": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8b3bd5c3-1f37-4131-8b3a-a0f6d540e56d')))]"
+    },
+    "huntingQueryObject141": {
+      "huntingQueryVersion141": "1.0.0",
+      "_huntingQuerycontentId141": "511406e2-2bdf-4b4d-a436-17dadbf4829f",
+      "huntingQueryTemplateSpecName141": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('511406e2-2bdf-4b4d-a436-17dadbf4829f')))]"
+    },
+    "huntingQueryObject142": {
+      "huntingQueryVersion142": "1.0.0",
+      "_huntingQuerycontentId142": "0bd46e27-9d5a-4abd-889b-829a8b4d29a4",
+      "huntingQueryTemplateSpecName142": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0bd46e27-9d5a-4abd-889b-829a8b4d29a4')))]"
+    },
+    "huntingQueryObject143": {
+      "huntingQueryVersion143": "1.0.0",
+      "_huntingQuerycontentId143": "132dffdf-3ee0-4748-8509-fbd3a92e5c9f",
+      "huntingQueryTemplateSpecName143": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('132dffdf-3ee0-4748-8509-fbd3a92e5c9f')))]"
+    },
+    "huntingQueryObject144": {
+      "huntingQueryVersion144": "1.0.0",
+      "_huntingQuerycontentId144": "bebb6652-3c52-4358-a946-ecd63cddf082",
+      "huntingQueryTemplateSpecName144": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bebb6652-3c52-4358-a946-ecd63cddf082')))]"
+    },
+    "huntingQueryObject145": {
+      "huntingQueryVersion145": "1.0.0",
+      "_huntingQuerycontentId145": "2d8448f5-c0a2-46d7-a004-e062970ccb7b",
+      "huntingQueryTemplateSpecName145": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2d8448f5-c0a2-46d7-a004-e062970ccb7b')))]"
+    },
+    "huntingQueryObject146": {
+      "huntingQueryVersion146": "1.0.0",
+      "_huntingQuerycontentId146": "49071a21-fbb6-472f-932f-5b6ca1a25883",
+      "huntingQueryTemplateSpecName146": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('49071a21-fbb6-472f-932f-5b6ca1a25883')))]"
+    },
+    "huntingQueryObject147": {
+      "huntingQueryVersion147": "1.0.0",
+      "_huntingQuerycontentId147": "f82f3d63-b7f2-494d-8254-612405702dd4",
+      "huntingQueryTemplateSpecName147": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f82f3d63-b7f2-494d-8254-612405702dd4')))]"
+    },
+    "huntingQueryObject148": {
+      "huntingQueryVersion148": "1.0.0",
+      "_huntingQuerycontentId148": "b3b507e9-9f92-4751-8463-fc77394fed91",
+      "huntingQueryTemplateSpecName148": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3b507e9-9f92-4751-8463-fc77394fed91')))]"
+    },
+    "huntingQueryObject149": {
+      "huntingQueryVersion149": "1.0.0",
+      "_huntingQuerycontentId149": "0a29c9f0-e8d4-4339-a196-52bb3a090a79",
+      "huntingQueryTemplateSpecName149": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0a29c9f0-e8d4-4339-a196-52bb3a090a79')))]"
+    },
+    "huntingQueryObject150": {
+      "huntingQueryVersion150": "1.0.0",
+      "_huntingQuerycontentId150": "9ffbd78f-c87c-4fd2-96ec-fd46e27bbd21",
+      "huntingQueryTemplateSpecName150": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9ffbd78f-c87c-4fd2-96ec-fd46e27bbd21')))]"
+    },
+    "huntingQueryObject151": {
+      "huntingQueryVersion151": "1.0.0",
+      "_huntingQuerycontentId151": "ab2f1fd6-1023-425e-a429-ff74db5709be",
+      "huntingQueryTemplateSpecName151": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ab2f1fd6-1023-425e-a429-ff74db5709be')))]"
+    },
+    "huntingQueryObject152": {
+      "huntingQueryVersion152": "1.0.0",
+      "_huntingQuerycontentId152": "74b581fc-e8cb-4b50-9d82-7b91d3a88a08",
+      "huntingQueryTemplateSpecName152": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('74b581fc-e8cb-4b50-9d82-7b91d3a88a08')))]"
+    },
+    "huntingQueryObject153": {
+      "huntingQueryVersion153": "1.0.0",
+      "_huntingQuerycontentId153": "90cd91d1-7b90-421c-a5c9-0479b6b7e6a2",
+      "huntingQueryTemplateSpecName153": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('90cd91d1-7b90-421c-a5c9-0479b6b7e6a2')))]"
+    },
+    "huntingQueryObject154": {
+      "huntingQueryVersion154": "1.0.0",
+      "_huntingQuerycontentId154": "0c68250b-44b5-46f4-8cac-f3e7149e8c61",
+      "huntingQueryTemplateSpecName154": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0c68250b-44b5-46f4-8cac-f3e7149e8c61')))]"
+    },
+    "huntingQueryObject155": {
+      "huntingQueryVersion155": "1.0.0",
+      "_huntingQuerycontentId155": "0c829a3c-ead1-4ebc-92c9-2e85abb1edeb",
+      "huntingQueryTemplateSpecName155": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0c829a3c-ead1-4ebc-92c9-2e85abb1edeb')))]"
+    },
+    "huntingQueryObject156": {
+      "huntingQueryVersion156": "1.0.0",
+      "_huntingQuerycontentId156": "6610945e-9496-4ef4-9bc4-a511a3f2a477",
+      "huntingQueryTemplateSpecName156": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6610945e-9496-4ef4-9bc4-a511a3f2a477')))]"
+    },
+    "huntingQueryObject157": {
+      "huntingQueryVersion157": "1.0.0",
+      "_huntingQuerycontentId157": "75ade06c-7326-4e0d-9dfb-27e05043525b",
+      "huntingQueryTemplateSpecName157": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('75ade06c-7326-4e0d-9dfb-27e05043525b')))]"
+    },
+    "huntingQueryObject158": {
+      "huntingQueryVersion158": "1.0.0",
+      "_huntingQuerycontentId158": "2ae448b1-b27d-4043-a92f-ef10202cdb7a",
+      "huntingQueryTemplateSpecName158": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2ae448b1-b27d-4043-a92f-ef10202cdb7a')))]"
+    },
+    "huntingQueryObject159": {
+      "huntingQueryVersion159": "1.0.0",
+      "_huntingQuerycontentId159": "02e237ed-f7b5-49dd-92e6-1b340d5e37fb",
+      "huntingQueryTemplateSpecName159": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('02e237ed-f7b5-49dd-92e6-1b340d5e37fb')))]"
+    },
+    "huntingQueryObject160": {
+      "huntingQueryVersion160": "1.0.0",
+      "_huntingQuerycontentId160": "b1f797d1-6ea4-4f8f-b663-6c8a1c1018e9",
+      "huntingQueryTemplateSpecName160": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b1f797d1-6ea4-4f8f-b663-6c8a1c1018e9')))]"
+    },
+    "huntingQueryObject161": {
+      "huntingQueryVersion161": "1.0.0",
+      "_huntingQuerycontentId161": "c73ae295-d120-4f79-aaed-de005f766ad2",
+      "huntingQueryTemplateSpecName161": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c73ae295-d120-4f79-aaed-de005f766ad2')))]"
+    },
+    "huntingQueryObject162": {
+      "huntingQueryVersion162": "1.0.0",
+      "_huntingQuerycontentId162": "fe2cb53e-4eb3-4676-87c1-f80d2813f542",
+      "huntingQueryTemplateSpecName162": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fe2cb53e-4eb3-4676-87c1-f80d2813f542')))]"
+    },
+    "huntingQueryObject163": {
+      "huntingQueryVersion163": "1.1.0",
+      "_huntingQuerycontentId163": "8f8fd7c8-277a-48c3-ad67-c80b3037c5af",
+      "huntingQueryTemplateSpecName163": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8f8fd7c8-277a-48c3-ad67-c80b3037c5af')))]"
+    },
+    "huntingQueryObject164": {
+      "huntingQueryVersion164": "1.1.0",
+      "_huntingQuerycontentId164": "bd6aae91-6233-430b-a5af-15c6406a7770",
+      "huntingQueryTemplateSpecName164": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bd6aae91-6233-430b-a5af-15c6406a7770')))]"
+    },
+    "huntingQueryObject165": {
+      "huntingQueryVersion165": "1.1.0",
+      "_huntingQuerycontentId165": "e6b3edc5-ec6f-44ae-9bb4-60c9ea49154e",
+      "huntingQueryTemplateSpecName165": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e6b3edc5-ec6f-44ae-9bb4-60c9ea49154e')))]"
+    },
+    "huntingQueryObject166": {
+      "huntingQueryVersion166": "1.1.0",
+      "_huntingQuerycontentId166": "74e076da-58e8-436d-b7bc-68888dbb6091",
+      "huntingQueryTemplateSpecName166": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('74e076da-58e8-436d-b7bc-68888dbb6091')))]"
+    },
+    "huntingQueryObject167": {
+      "huntingQueryVersion167": "1.1.0",
+      "_huntingQuerycontentId167": "fbe7a9d2-507e-4974-9e9a-d1cba3907f67",
+      "huntingQueryTemplateSpecName167": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fbe7a9d2-507e-4974-9e9a-d1cba3907f67')))]"
+    },
+    "huntingQueryObject168": {
+      "huntingQueryVersion168": "1.1.0",
+      "_huntingQuerycontentId168": "76c77c8a-bd2a-489a-af52-97291211e4e4",
+      "huntingQueryTemplateSpecName168": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('76c77c8a-bd2a-489a-af52-97291211e4e4')))]"
+    },
+    "huntingQueryObject169": {
+      "huntingQueryVersion169": "1.1.0",
+      "_huntingQuerycontentId169": "4d86021c-cad7-489b-a8c8-dddecb87a2ef",
+      "huntingQueryTemplateSpecName169": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4d86021c-cad7-489b-a8c8-dddecb87a2ef')))]"
+    },
+    "huntingQueryObject170": {
+      "huntingQueryVersion170": "1.1.0",
+      "_huntingQuerycontentId170": "b20e56b8-e335-43d9-b7b3-43c034c43aea",
+      "huntingQueryTemplateSpecName170": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b20e56b8-e335-43d9-b7b3-43c034c43aea')))]"
+    },
+    "huntingQueryObject171": {
+      "huntingQueryVersion171": "1.1.0",
+      "_huntingQuerycontentId171": "dd6efecd-7fe5-41b1-a122-8e0a15de9451",
+      "huntingQueryTemplateSpecName171": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dd6efecd-7fe5-41b1-a122-8e0a15de9451')))]"
+    },
+    "huntingQueryObject172": {
+      "huntingQueryVersion172": "1.1.0",
+      "_huntingQuerycontentId172": "4c30fab1-db4f-4a64-b66b-51478e43a477",
+      "huntingQueryTemplateSpecName172": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4c30fab1-db4f-4a64-b66b-51478e43a477')))]"
+    },
+    "huntingQueryObject173": {
+      "huntingQueryVersion173": "1.0.1",
+      "_huntingQuerycontentId173": "ad76e484-f159-4d23-99ee-e734f0b8b60b",
+      "huntingQueryTemplateSpecName173": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ad76e484-f159-4d23-99ee-e734f0b8b60b')))]"
+    },
+    "huntingQueryObject174": {
+      "huntingQueryVersion174": "1.0.0",
+      "_huntingQuerycontentId174": "0b197e26-7899-47ff-9be9-f7ba6dc949ea",
+      "huntingQueryTemplateSpecName174": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0b197e26-7899-47ff-9be9-f7ba6dc949ea')))]"
+    },
+    "huntingQueryObject175": {
+      "huntingQueryVersion175": "1.0.0",
+      "_huntingQuerycontentId175": "87846aad-624c-4e18-b963-81bedd7123a2",
+      "huntingQueryTemplateSpecName175": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('87846aad-624c-4e18-b963-81bedd7123a2')))]"
+    },
+    "huntingQueryObject176": {
+      "huntingQueryVersion176": "1.1.0",
+      "_huntingQuerycontentId176": "80f357a6-6bb4-4b2b-a88c-265fccafc794",
+      "huntingQueryTemplateSpecName176": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('80f357a6-6bb4-4b2b-a88c-265fccafc794')))]"
+    },
+    "huntingQueryObject177": {
+      "huntingQueryVersion177": "1.0.0",
+      "_huntingQuerycontentId177": "25150085-015a-4673-9b67-bc6ad9475500",
+      "huntingQueryTemplateSpecName177": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('25150085-015a-4673-9b67-bc6ad9475500')))]"
+    },
+    "huntingQueryObject178": {
+      "huntingQueryVersion178": "1.0.0",
+      "_huntingQuerycontentId178": "9b086a51-e396-4718-90d7-f7b3646e6581",
+      "huntingQueryTemplateSpecName178": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9b086a51-e396-4718-90d7-f7b3646e6581')))]"
+    },
+    "huntingQueryObject179": {
+      "huntingQueryVersion179": "1.0.0",
+      "_huntingQuerycontentId179": "516046e8-a460-4f7b-86eb-421d3a9cdff1",
+      "huntingQueryTemplateSpecName179": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('516046e8-a460-4f7b-86eb-421d3a9cdff1')))]"
+    },
+    "huntingQueryObject180": {
+      "huntingQueryVersion180": "1.0.0",
+      "_huntingQuerycontentId180": "594fe5a1-53b6-466b-86df-028366c3994e",
+      "huntingQueryTemplateSpecName180": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('594fe5a1-53b6-466b-86df-028366c3994e')))]"
+    },
+    "huntingQueryObject181": {
+      "huntingQueryVersion181": "1.0.0",
+      "_huntingQuerycontentId181": "706b711a-7622-40f1-9ebb-331d1a0ff697",
+      "huntingQueryTemplateSpecName181": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('706b711a-7622-40f1-9ebb-331d1a0ff697')))]"
+    },
+    "huntingQueryObject182": {
+      "huntingQueryVersion182": "1.0.0",
+      "_huntingQuerycontentId182": "f708c866-073a-4107-a60b-ba6f86e54caa",
+      "huntingQueryTemplateSpecName182": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f708c866-073a-4107-a60b-ba6f86e54caa')))]"
+    },
+    "huntingQueryObject183": {
+      "huntingQueryVersion183": "1.0.0",
+      "_huntingQuerycontentId183": "68aa199c-259b-4bb0-8e7a-8ed6f96c5525",
+      "huntingQueryTemplateSpecName183": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('68aa199c-259b-4bb0-8e7a-8ed6f96c5525')))]"
+    },
+    "huntingQueryObject184": {
+      "huntingQueryVersion184": "1.0.0",
+      "_huntingQuerycontentId184": "8c852f12-499f-499b-afc1-25c50aa9b462",
+      "huntingQueryTemplateSpecName184": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8c852f12-499f-499b-afc1-25c50aa9b462')))]"
+    },
+    "huntingQueryObject185": {
+      "huntingQueryVersion185": "1.0.0",
+      "_huntingQuerycontentId185": "f6354c94-3a95-4235-8530-414f016a7bf6",
+      "huntingQueryTemplateSpecName185": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f6354c94-3a95-4235-8530-414f016a7bf6')))]"
+    },
+    "huntingQueryObject186": {
+      "huntingQueryVersion186": "1.0.0",
+      "_huntingQuerycontentId186": "dc7e1eb5-16f5-4ad5-96a1-794970f4b310",
+      "huntingQueryTemplateSpecName186": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dc7e1eb5-16f5-4ad5-96a1-794970f4b310')))]"
+    },
+    "huntingQueryObject187": {
+      "huntingQueryVersion187": "1.0.0",
+      "_huntingQuerycontentId187": "54d3455d-27e0-4ceb-99f9-375abd620151",
+      "huntingQueryTemplateSpecName187": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('54d3455d-27e0-4ceb-99f9-375abd620151')))]"
+    },
+    "huntingQueryObject188": {
+      "huntingQueryVersion188": "1.0.0",
+      "_huntingQuerycontentId188": "8d298b5c-feca-4add-bd42-e43e0a317a88",
+      "huntingQueryTemplateSpecName188": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8d298b5c-feca-4add-bd42-e43e0a317a88')))]"
+    },
+    "huntingQueryObject189": {
+      "huntingQueryVersion189": "1.0.0",
+      "_huntingQuerycontentId189": "3131d0ba-32c9-483e-a25c-82e26a07e116",
+      "huntingQueryTemplateSpecName189": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3131d0ba-32c9-483e-a25c-82e26a07e116')))]"
+    },
+    "huntingQueryObject190": {
+      "huntingQueryVersion190": "1.0.0",
+      "_huntingQuerycontentId190": "a12cac64-ea6d-46d4-91a6-262b165fb9ad",
+      "huntingQueryTemplateSpecName190": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a12cac64-ea6d-46d4-91a6-262b165fb9ad')))]"
+    },
+    "huntingQueryObject191": {
+      "huntingQueryVersion191": "1.0.0",
+      "_huntingQuerycontentId191": "9e8faa62-7222-48a5-a78f-ef2d22f866dc",
+      "huntingQueryTemplateSpecName191": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9e8faa62-7222-48a5-a78f-ef2d22f866dc')))]"
+    },
+    "huntingQueryObject192": {
+      "huntingQueryVersion192": "1.1.0",
+      "_huntingQuerycontentId192": "79bed402-09bc-453b-ab92-8b1411e683fa",
+      "huntingQueryTemplateSpecName192": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('79bed402-09bc-453b-ab92-8b1411e683fa')))]"
+    },
+    "huntingQueryObject193": {
+      "huntingQueryVersion193": "1.1.0",
+      "_huntingQuerycontentId193": "36cf7ce5-7264-46d9-9f47-57b59049b44f",
+      "huntingQueryTemplateSpecName193": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('36cf7ce5-7264-46d9-9f47-57b59049b44f')))]"
+    },
+    "huntingQueryObject194": {
+      "huntingQueryVersion194": "1.0.0",
+      "_huntingQuerycontentId194": "6f96f6d7-d972-421e-a59f-6b9a8de81324",
+      "huntingQueryTemplateSpecName194": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6f96f6d7-d972-421e-a59f-6b9a8de81324')))]"
+    },
+    "huntingQueryObject195": {
+      "huntingQueryVersion195": "1.0.0",
+      "_huntingQuerycontentId195": "9f135aef-ad25-4df2-bdab-8399978a36a2",
+      "huntingQueryTemplateSpecName195": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9f135aef-ad25-4df2-bdab-8399978a36a2')))]"
+    },
+    "huntingQueryObject196": {
+      "huntingQueryVersion196": "1.1.0",
+      "_huntingQuerycontentId196": "23e6d66b-511a-43fd-9863-6924da60319a",
+      "huntingQueryTemplateSpecName196": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('23e6d66b-511a-43fd-9863-6924da60319a')))]"
+    },
+    "huntingQueryObject197": {
+      "huntingQueryVersion197": "1.1.0",
+      "_huntingQuerycontentId197": "32a981ad-cd5a-4d80-8c6c-d59b9893c019",
+      "huntingQueryTemplateSpecName197": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('32a981ad-cd5a-4d80-8c6c-d59b9893c019')))]"
+    },
+    "huntingQueryObject198": {
+      "huntingQueryVersion198": "1.1.0",
+      "_huntingQuerycontentId198": "bde9d9fc-e166-4628-91f7-fb86ace93af0",
+      "huntingQueryTemplateSpecName198": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bde9d9fc-e166-4628-91f7-fb86ace93af0')))]"
+    },
+    "huntingQueryObject199": {
+      "huntingQueryVersion199": "1.0.0",
+      "_huntingQuerycontentId199": "77104824-b41e-412d-8e50-26971fe97ab0",
+      "huntingQueryTemplateSpecName199": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('77104824-b41e-412d-8e50-26971fe97ab0')))]"
+    },
+    "huntingQueryObject200": {
+      "huntingQueryVersion200": "1.0.0",
+      "_huntingQuerycontentId200": "99713387-9d61-49eb-8edc-f51153d8bb01",
+      "huntingQueryTemplateSpecName200": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('99713387-9d61-49eb-8edc-f51153d8bb01')))]"
+    },
+    "huntingQueryObject201": {
+      "huntingQueryVersion201": "1.1.0",
+      "_huntingQuerycontentId201": "147131b3-8b57-4c50-b981-5a951ed82272",
+      "huntingQueryTemplateSpecName201": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('147131b3-8b57-4c50-b981-5a951ed82272')))]"
+    },
+    "huntingQueryObject202": {
+      "huntingQueryVersion202": "1.1.0",
+      "_huntingQuerycontentId202": "7e93ce37-0cc5-4aa9-b30a-07772affa481",
+      "huntingQueryTemplateSpecName202": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7e93ce37-0cc5-4aa9-b30a-07772affa481')))]"
+    },
+    "huntingQueryObject203": {
+      "huntingQueryVersion203": "1.1.0",
+      "_huntingQuerycontentId203": "316f8777-09fd-480b-a726-21f521fa990f",
+      "huntingQueryTemplateSpecName203": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('316f8777-09fd-480b-a726-21f521fa990f')))]"
+    },
+    "huntingQueryObject204": {
+      "huntingQueryVersion204": "1.1.0",
+      "_huntingQuerycontentId204": "2e903da3-32fe-46b0-8df7-5f39e55db17e",
+      "huntingQueryTemplateSpecName204": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2e903da3-32fe-46b0-8df7-5f39e55db17e')))]"
+    },
+    "huntingQueryObject205": {
+      "huntingQueryVersion205": "1.1.0",
+      "_huntingQuerycontentId205": "f290d544-c499-4b23-8a7e-c4cbb7ab6316",
+      "huntingQueryTemplateSpecName205": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f290d544-c499-4b23-8a7e-c4cbb7ab6316')))]"
+    },
+    "huntingQueryObject206": {
+      "huntingQueryVersion206": "1.1.0",
+      "_huntingQuerycontentId206": "6fe463ca-4cd3-4d97-a099-6b736f28a128",
+      "huntingQueryTemplateSpecName206": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6fe463ca-4cd3-4d97-a099-6b736f28a128')))]"
+    },
+    "huntingQueryObject207": {
+      "huntingQueryVersion207": "1.1.0",
+      "_huntingQuerycontentId207": "9e4b7553-1113-4d40-bb6b-7daca7d7d255",
+      "huntingQueryTemplateSpecName207": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9e4b7553-1113-4d40-bb6b-7daca7d7d255')))]"
+    },
+    "huntingQueryObject208": {
+      "huntingQueryVersion208": "1.1.0",
+      "_huntingQuerycontentId208": "c03e13ee-0e7a-4d05-b3f4-790b01bb30a5",
+      "huntingQueryTemplateSpecName208": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c03e13ee-0e7a-4d05-b3f4-790b01bb30a5')))]"
+    },
+    "huntingQueryObject209": {
+      "huntingQueryVersion209": "1.1.0",
+      "_huntingQuerycontentId209": "86f2b124-8caf-4b53-845a-87de3ffccbdf",
+      "huntingQueryTemplateSpecName209": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('86f2b124-8caf-4b53-845a-87de3ffccbdf')))]"
+    },
+    "huntingQueryObject210": {
+      "huntingQueryVersion210": "1.1.0",
+      "_huntingQuerycontentId210": "ae690d6f-0ea5-4617-95cf-1ed9a5fcb329",
+      "huntingQueryTemplateSpecName210": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ae690d6f-0ea5-4617-95cf-1ed9a5fcb329')))]"
+    },
+    "huntingQueryObject211": {
+      "huntingQueryVersion211": "1.1.0",
+      "_huntingQuerycontentId211": "16cfa413-238f-4355-9f8a-4b97ce7572ac",
+      "huntingQueryTemplateSpecName211": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('16cfa413-238f-4355-9f8a-4b97ce7572ac')))]"
+    },
+    "huntingQueryObject212": {
+      "huntingQueryVersion212": "1.0.0",
+      "_huntingQuerycontentId212": "6a570927-8638-4a6f-ac09-72a7d51ffa3c",
+      "huntingQueryTemplateSpecName212": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6a570927-8638-4a6f-ac09-72a7d51ffa3c')))]"
+    },
+    "huntingQueryObject213": {
+      "huntingQueryVersion213": "1.0.0",
+      "_huntingQuerycontentId213": "418e8859-b22a-4fd4-b273-5433e054cdc7",
+      "huntingQueryTemplateSpecName213": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('418e8859-b22a-4fd4-b273-5433e054cdc7')))]"
+    },
+    "huntingQueryObject214": {
+      "huntingQueryVersion214": "1.1.0",
+      "_huntingQuerycontentId214": "15a17150-811d-4829-a3d6-489139c9ff5e",
+      "huntingQueryTemplateSpecName214": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('15a17150-811d-4829-a3d6-489139c9ff5e')))]"
+    },
+    "huntingQueryObject215": {
+      "huntingQueryVersion215": "1.0.0",
+      "_huntingQuerycontentId215": "416cd270-6327-441a-9304-940c832cf361",
+      "huntingQueryTemplateSpecName215": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('416cd270-6327-441a-9304-940c832cf361')))]"
+    },
+    "huntingQueryObject216": {
+      "huntingQueryVersion216": "1.0.0",
+      "_huntingQuerycontentId216": "cdc4da1c-64a1-4941-be59-1f5cc85481ab",
+      "huntingQueryTemplateSpecName216": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdc4da1c-64a1-4941-be59-1f5cc85481ab')))]"
+    },
+    "huntingQueryObject217": {
+      "huntingQueryVersion217": "1.0.0",
+      "_huntingQuerycontentId217": "b3180ac0-6d94-494a-8b8c-fcc84319ea6e",
+      "huntingQueryTemplateSpecName217": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b3180ac0-6d94-494a-8b8c-fcc84319ea6e')))]"
+    },
+    "huntingQueryObject218": {
+      "huntingQueryVersion218": "1.0.0",
+      "_huntingQuerycontentId218": "011c3d48-f6ca-405f-9763-66c7856ad2ba",
+      "huntingQueryTemplateSpecName218": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('011c3d48-f6ca-405f-9763-66c7856ad2ba')))]"
+    },
+    "huntingQueryObject219": {
+      "huntingQueryVersion219": "1.0.0",
+      "_huntingQuerycontentId219": "1dce39ec-8a64-4e49-9d6e-926ee6f04c39",
+      "huntingQueryTemplateSpecName219": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1dce39ec-8a64-4e49-9d6e-926ee6f04c39')))]"
+    },
+    "huntingQueryObject220": {
+      "huntingQueryVersion220": "1.1.0",
+      "_huntingQuerycontentId220": "53139a92-eb64-46d2-be97-e752a71e7021",
+      "huntingQueryTemplateSpecName220": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('53139a92-eb64-46d2-be97-e752a71e7021')))]"
+    },
+    "huntingQueryObject221": {
+      "huntingQueryVersion221": "1.0.0",
+      "_huntingQuerycontentId221": "09b263e1-9c73-4585-a55c-bc209e148e14",
+      "huntingQueryTemplateSpecName221": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('09b263e1-9c73-4585-a55c-bc209e148e14')))]"
+    },
+    "huntingQueryObject222": {
+      "huntingQueryVersion222": "1.1.0",
+      "_huntingQuerycontentId222": "f9442d20-eff8-4751-9a75-6451aeace687",
+      "huntingQueryTemplateSpecName222": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f9442d20-eff8-4751-9a75-6451aeace687')))]"
+    },
+    "huntingQueryObject223": {
+      "huntingQueryVersion223": "1.0.0",
+      "_huntingQuerycontentId223": "e90345b3-439c-44e1-a85d-8ae84ad9c65b",
+      "huntingQueryTemplateSpecName223": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e90345b3-439c-44e1-a85d-8ae84ad9c65b')))]"
+    },
+    "huntingQueryObject224": {
+      "huntingQueryVersion224": "1.0.0",
+      "_huntingQuerycontentId224": "c51b0367-573a-42c3-a4a2-2d8b1ef6bea9",
+      "huntingQueryTemplateSpecName224": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c51b0367-573a-42c3-a4a2-2d8b1ef6bea9')))]"
+    },
+    "huntingQueryObject225": {
+      "huntingQueryVersion225": "1.0.0",
+      "_huntingQuerycontentId225": "e3a11181-3ff9-4ba0-908d-3e229b476ce3",
+      "huntingQueryTemplateSpecName225": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e3a11181-3ff9-4ba0-908d-3e229b476ce3')))]"
+    },
+    "huntingQueryObject226": {
+      "huntingQueryVersion226": "1.0.0",
+      "_huntingQuerycontentId226": "515a98db-49a5-4592-80b7-8227998da9ed",
+      "huntingQueryTemplateSpecName226": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('515a98db-49a5-4592-80b7-8227998da9ed')))]"
+    },
+    "huntingQueryObject227": {
+      "huntingQueryVersion227": "1.0.0",
+      "_huntingQuerycontentId227": "5cb9399f-e4d7-46c1-bdfa-d66eec278bf2",
+      "huntingQueryTemplateSpecName227": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5cb9399f-e4d7-46c1-bdfa-d66eec278bf2')))]"
+    },
+    "huntingQueryObject228": {
+      "huntingQueryVersion228": "1.0.0",
+      "_huntingQuerycontentId228": "8f82894a-1b18-4d1e-a580-1dcaff739a32",
+      "huntingQueryTemplateSpecName228": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8f82894a-1b18-4d1e-a580-1dcaff739a32')))]"
+    },
+    "huntingQueryObject229": {
+      "huntingQueryVersion229": "1.0.0",
+      "_huntingQuerycontentId229": "8425234b-f09d-490e-be3d-a7ecf081c5d0",
+      "huntingQueryTemplateSpecName229": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8425234b-f09d-490e-be3d-a7ecf081c5d0')))]"
+    },
+    "huntingQueryObject230": {
+      "huntingQueryVersion230": "1.0.0",
+      "_huntingQuerycontentId230": "60cddbbb-2244-4a61-ad73-b20b1c6f5027",
+      "huntingQueryTemplateSpecName230": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('60cddbbb-2244-4a61-ad73-b20b1c6f5027')))]"
+    },
+    "huntingQueryObject231": {
+      "huntingQueryVersion231": "1.0.0",
+      "_huntingQuerycontentId231": "354d78b3-91b7-4219-9079-57e63e281077",
+      "huntingQueryTemplateSpecName231": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('354d78b3-91b7-4219-9079-57e63e281077')))]"
+    },
+    "huntingQueryObject232": {
+      "huntingQueryVersion232": "1.0.0",
+      "_huntingQuerycontentId232": "a7f2dae2-2e33-4744-b013-37dc5628d939",
+      "huntingQueryTemplateSpecName232": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a7f2dae2-2e33-4744-b013-37dc5628d939')))]"
+    },
+    "huntingQueryObject233": {
+      "huntingQueryVersion233": "1.0.0",
+      "_huntingQuerycontentId233": "de074419-2ec5-4c7f-a7f6-0a49178b314c",
+      "huntingQueryTemplateSpecName233": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('de074419-2ec5-4c7f-a7f6-0a49178b314c')))]"
+    },
+    "huntingQueryObject234": {
+      "huntingQueryVersion234": "1.0.0",
+      "_huntingQuerycontentId234": "d236f728-8b0f-4b4f-acf7-e4707993b841",
+      "huntingQueryTemplateSpecName234": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d236f728-8b0f-4b4f-acf7-e4707993b841')))]"
+    },
+    "huntingQueryObject235": {
+      "huntingQueryVersion235": "1.0.0",
+      "_huntingQuerycontentId235": "8b0bae20-687f-47ca-bc2e-8dabbed9cbae",
+      "huntingQueryTemplateSpecName235": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8b0bae20-687f-47ca-bc2e-8dabbed9cbae')))]"
+    },
+    "huntingQueryObject236": {
+      "huntingQueryVersion236": "1.0.0",
+      "_huntingQuerycontentId236": "47506508-dee4-4d4d-93a8-1c78d63cd2eb",
+      "huntingQueryTemplateSpecName236": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('47506508-dee4-4d4d-93a8-1c78d63cd2eb')))]"
+    },
+    "huntingQueryObject237": {
+      "huntingQueryVersion237": "1.0.0",
+      "_huntingQuerycontentId237": "72f939fe-c77b-4c25-91b4-3f784c9c58c3",
+      "huntingQueryTemplateSpecName237": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('72f939fe-c77b-4c25-91b4-3f784c9c58c3')))]"
+    },
+    "huntingQueryObject238": {
+      "huntingQueryVersion238": "1.1.0",
+      "_huntingQuerycontentId238": "da7eecca-ecb8-4b8e-a111-62d2b48e2e69",
+      "huntingQueryTemplateSpecName238": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('da7eecca-ecb8-4b8e-a111-62d2b48e2e69')))]"
+    },
+    "huntingQueryObject239": {
+      "huntingQueryVersion239": "1.0.0",
+      "_huntingQuerycontentId239": "4c786e9a-b570-47bc-877f-7f3da87a4673",
+      "huntingQueryTemplateSpecName239": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4c786e9a-b570-47bc-877f-7f3da87a4673')))]"
+    },
+    "huntingQueryObject240": {
+      "huntingQueryVersion240": "1.0.0",
+      "_huntingQuerycontentId240": "53c58a33-668d-46e1-9714-5892c87650d9",
+      "huntingQueryTemplateSpecName240": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('53c58a33-668d-46e1-9714-5892c87650d9')))]"
+    },
+    "huntingQueryObject241": {
+      "huntingQueryVersion241": "1.0.0",
+      "_huntingQuerycontentId241": "8cde246b-7ed1-429c-933a-f7d0363dbbc0",
+      "huntingQueryTemplateSpecName241": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8cde246b-7ed1-429c-933a-f7d0363dbbc0')))]"
+    },
+    "huntingQueryObject242": {
+      "huntingQueryVersion242": "1.0.0",
+      "_huntingQuerycontentId242": "0bd33643-c517-48b1-8211-25a7fbd15a50",
+      "huntingQueryTemplateSpecName242": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0bd33643-c517-48b1-8211-25a7fbd15a50')))]"
+    },
+    "huntingQueryObject243": {
+      "huntingQueryVersion243": "1.0.0",
+      "_huntingQuerycontentId243": "d78bad8c-3d94-4a73-bdbe-1c567e3d6d62",
+      "huntingQueryTemplateSpecName243": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d78bad8c-3d94-4a73-bdbe-1c567e3d6d62')))]"
+    },
+    "huntingQueryObject244": {
+      "huntingQueryVersion244": "1.0.0",
+      "_huntingQuerycontentId244": "58acf93f-27de-4af4-8a5f-d87ee59326f9",
+      "huntingQueryTemplateSpecName244": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('58acf93f-27de-4af4-8a5f-d87ee59326f9')))]"
+    },
+    "huntingQueryObject245": {
+      "huntingQueryVersion245": "1.0.0",
+      "_huntingQuerycontentId245": "0a9385bc-2ef9-4b0e-8834-12f796b08ca8",
+      "huntingQueryTemplateSpecName245": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0a9385bc-2ef9-4b0e-8834-12f796b08ca8')))]"
+    },
+    "huntingQueryObject246": {
+      "huntingQueryVersion246": "1.0.0",
+      "_huntingQuerycontentId246": "385aca1d-2135-40c6-af8e-030c9e086cf5",
+      "huntingQueryTemplateSpecName246": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('385aca1d-2135-40c6-af8e-030c9e086cf5')))]"
+    },
+    "huntingQueryObject247": {
+      "huntingQueryVersion247": "1.0.0",
+      "_huntingQuerycontentId247": "12798858-1916-4b59-a85e-8a7a4f7b43cf",
+      "huntingQueryTemplateSpecName247": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('12798858-1916-4b59-a85e-8a7a4f7b43cf')))]"
+    },
+    "huntingQueryObject248": {
+      "huntingQueryVersion248": "1.0.0",
+      "_huntingQuerycontentId248": "b78eddd9-ebe5-42ab-95b4-928a782b52b5",
+      "huntingQueryTemplateSpecName248": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b78eddd9-ebe5-42ab-95b4-928a782b52b5')))]"
+    },
+    "huntingQueryObject249": {
+      "huntingQueryVersion249": "1.0.0",
+      "_huntingQuerycontentId249": "cbf3abc0-2b2d-4852-ab7a-9f7a1231997e",
+      "huntingQueryTemplateSpecName249": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cbf3abc0-2b2d-4852-ab7a-9f7a1231997e')))]"
+    },
+    "huntingQueryObject250": {
+      "huntingQueryVersion250": "1.0.0",
+      "_huntingQuerycontentId250": "201cb524-b4b4-479a-9637-da35cfa1e30a",
+      "huntingQueryTemplateSpecName250": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('201cb524-b4b4-479a-9637-da35cfa1e30a')))]"
+    },
+    "huntingQueryObject251": {
+      "huntingQueryVersion251": "1.0.0",
+      "_huntingQuerycontentId251": "abdca3e6-c198-404a-b95c-f09ddfed2027",
+      "huntingQueryTemplateSpecName251": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('abdca3e6-c198-404a-b95c-f09ddfed2027')))]"
+    },
+    "huntingQueryObject252": {
+      "huntingQueryVersion252": "1.0.0",
+      "_huntingQuerycontentId252": "289283e9-9f63-488c-8d62-fe9c598f3cd5",
+      "huntingQueryTemplateSpecName252": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('289283e9-9f63-488c-8d62-fe9c598f3cd5')))]"
+    },
+    "huntingQueryObject253": {
+      "huntingQueryVersion253": "1.0.0",
+      "_huntingQuerycontentId253": "300b0d05-e99e-4349-ab2b-ec12ff5c2da1",
+      "huntingQueryTemplateSpecName253": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('300b0d05-e99e-4349-ab2b-ec12ff5c2da1')))]"
+    },
+    "huntingQueryObject254": {
+      "huntingQueryVersion254": "1.0.0",
+      "_huntingQuerycontentId254": "9c4359a1-0bf9-45b3-9a1a-f333c437a061",
+      "huntingQueryTemplateSpecName254": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9c4359a1-0bf9-45b3-9a1a-f333c437a061')))]"
+    },
+    "huntingQueryObject255": {
+      "huntingQueryVersion255": "1.0.0",
+      "_huntingQuerycontentId255": "de480ca4-4095-4fef-b3e7-2a3f17f24e78",
+      "huntingQueryTemplateSpecName255": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('de480ca4-4095-4fef-b3e7-2a3f17f24e78')))]"
+    },
+    "huntingQueryObject256": {
+      "huntingQueryVersion256": "1.0.0",
+      "_huntingQuerycontentId256": "a8ccbf35-4c6d-4a8f-8c42-04fd9b000a27",
+      "huntingQueryTemplateSpecName256": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a8ccbf35-4c6d-4a8f-8c42-04fd9b000a27')))]"
+    },
+    "huntingQueryObject257": {
+      "huntingQueryVersion257": "1.0.0",
+      "_huntingQuerycontentId257": "e3b7b5c1-0e50-4dfb-b73a-c226636eaf58",
+      "huntingQueryTemplateSpecName257": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e3b7b5c1-0e50-4dfb-b73a-c226636eaf58')))]"
+    },
+    "huntingQueryObject258": {
+      "huntingQueryVersion258": "1.0.0",
+      "_huntingQuerycontentId258": "27ee28e7-423b-48c9-a410-cbc6c8e21d25",
+      "huntingQueryTemplateSpecName258": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('27ee28e7-423b-48c9-a410-cbc6c8e21d25')))]"
+    },
+    "huntingQueryObject259": {
+      "huntingQueryVersion259": "1.0.0",
+      "_huntingQuerycontentId259": "9d6c8c17-06b0-4044-b18e-35eb3dfc5cf2",
+      "huntingQueryTemplateSpecName259": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9d6c8c17-06b0-4044-b18e-35eb3dfc5cf2')))]"
+    },
+    "huntingQueryObject260": {
+      "huntingQueryVersion260": "1.0.0",
+      "_huntingQuerycontentId260": "a1664330-810a-473b-b354-acbaa751a294",
+      "huntingQueryTemplateSpecName260": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a1664330-810a-473b-b354-acbaa751a294')))]"
+    },
+    "huntingQueryObject261": {
+      "huntingQueryVersion261": "1.0.0",
+      "_huntingQuerycontentId261": "d24e9c4a-b72a-4a85-89cd-83760ae61155",
+      "huntingQueryTemplateSpecName261": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d24e9c4a-b72a-4a85-89cd-83760ae61155')))]"
+    },
+    "huntingQueryObject262": {
+      "huntingQueryVersion262": "1.0.0",
+      "_huntingQuerycontentId262": "3f007cdc-86bf-4657-9015-05101a3e54f5",
+      "huntingQueryTemplateSpecName262": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3f007cdc-86bf-4657-9015-05101a3e54f5')))]"
+    },
+    "huntingQueryObject263": {
+      "huntingQueryVersion263": "1.0.0",
+      "_huntingQuerycontentId263": "efe27064-6d35-4720-b7f5-e0326695613d",
+      "huntingQueryTemplateSpecName263": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('efe27064-6d35-4720-b7f5-e0326695613d')))]"
+    },
+    "huntingQueryObject264": {
+      "huntingQueryVersion264": "1.0.0",
+      "_huntingQuerycontentId264": "bc46e331-3cb0-483d-9c90-989d2a59457f",
+      "huntingQueryTemplateSpecName264": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bc46e331-3cb0-483d-9c90-989d2a59457f')))]"
+    },
+    "huntingQueryObject265": {
+      "huntingQueryVersion265": "1.0.0",
+      "_huntingQuerycontentId265": "03e61096-20d0-46eb-b8e0-a507dd00a19f",
+      "huntingQueryTemplateSpecName265": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('03e61096-20d0-46eb-b8e0-a507dd00a19f')))]"
+    },
+    "huntingQueryObject266": {
+      "huntingQueryVersion266": "1.0.0",
+      "_huntingQuerycontentId266": "f075d4c4-cf76-4e5d-9c2d-9ed524286316",
+      "huntingQueryTemplateSpecName266": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f075d4c4-cf76-4e5d-9c2d-9ed524286316')))]"
+    },
+    "huntingQueryObject267": {
+      "huntingQueryVersion267": "1.0.0",
+      "_huntingQuerycontentId267": "891f4865-75e5-4d40-bc24-ebf97da3ca9a",
+      "huntingQueryTemplateSpecName267": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('891f4865-75e5-4d40-bc24-ebf97da3ca9a')))]"
+    },
+    "huntingQueryObject268": {
+      "huntingQueryVersion268": "1.0.0",
+      "_huntingQuerycontentId268": "d823da0e-1334-4a66-8ff4-2c2c40d26295",
+      "huntingQueryTemplateSpecName268": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d823da0e-1334-4a66-8ff4-2c2c40d26295')))]"
+    },
+    "huntingQueryObject269": {
+      "huntingQueryVersion269": "1.0.0",
+      "_huntingQuerycontentId269": "ba4f7e56-a2f8-4a30-b848-200fdc7fc3a2",
+      "huntingQueryTemplateSpecName269": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ba4f7e56-a2f8-4a30-b848-200fdc7fc3a2')))]"
+    },
+    "huntingQueryObject270": {
+      "huntingQueryVersion270": "1.0.0",
+      "_huntingQuerycontentId270": "13260191-fb10-4a36-9ca1-2bbc0aaf77d0",
+      "huntingQueryTemplateSpecName270": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('13260191-fb10-4a36-9ca1-2bbc0aaf77d0')))]"
+    },
+    "huntingQueryObject271": {
+      "huntingQueryVersion271": "1.0.0",
+      "_huntingQuerycontentId271": "08aff8c6-b983-43a3-be95-68a10c3d35e6",
+      "huntingQueryTemplateSpecName271": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('08aff8c6-b983-43a3-be95-68a10c3d35e6')))]"
+    },
+    "huntingQueryObject272": {
+      "huntingQueryVersion272": "1.0.0",
+      "_huntingQuerycontentId272": "492f1ea1-37c3-410a-a2f2-4e4eae2ff7f9",
+      "huntingQueryTemplateSpecName272": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('492f1ea1-37c3-410a-a2f2-4e4eae2ff7f9')))]"
+    },
+    "huntingQueryObject273": {
+      "huntingQueryVersion273": "1.1.0",
+      "_huntingQuerycontentId273": "5a84e13a-bb17-4124-9564-d74cdb84c124",
+      "huntingQueryTemplateSpecName273": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5a84e13a-bb17-4124-9564-d74cdb84c124')))]"
+    },
+    "huntingQueryObject274": {
+      "huntingQueryVersion274": "1.1.0",
+      "_huntingQuerycontentId274": "a937905e-ee5c-406c-ab86-8e2581240112",
+      "huntingQueryTemplateSpecName274": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a937905e-ee5c-406c-ab86-8e2581240112')))]"
+    },
+    "huntingQueryObject275": {
+      "huntingQueryVersion275": "1.1.0",
+      "_huntingQuerycontentId275": "3a2fdf32-ebe7-4f65-a1c3-fc7faf23ae90",
+      "huntingQueryTemplateSpecName275": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3a2fdf32-ebe7-4f65-a1c3-fc7faf23ae90')))]"
+    },
+    "huntingQueryObject276": {
+      "huntingQueryVersion276": "1.0.0",
+      "_huntingQuerycontentId276": "3eef362d-3aee-4950-9208-4afa6f7afbe9",
+      "huntingQueryTemplateSpecName276": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3eef362d-3aee-4950-9208-4afa6f7afbe9')))]"
+    },
+    "huntingQueryObject277": {
+      "huntingQueryVersion277": "1.0.0",
+      "_huntingQuerycontentId277": "4620ece3-dceb-4151-8621-5a56351c97cd",
+      "huntingQueryTemplateSpecName277": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4620ece3-dceb-4151-8621-5a56351c97cd')))]"
+    },
+    "huntingQueryObject278": {
+      "huntingQueryVersion278": "1.0.0",
+      "_huntingQuerycontentId278": "ab006655-d723-4844-9d5d-91cb3b020555",
+      "huntingQueryTemplateSpecName278": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ab006655-d723-4844-9d5d-91cb3b020555')))]"
+    },
+    "huntingQueryObject279": {
+      "huntingQueryVersion279": "1.1.0",
+      "_huntingQuerycontentId279": "21bafecb-ae8f-4667-b7d6-144e047cb602",
+      "huntingQueryTemplateSpecName279": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('21bafecb-ae8f-4667-b7d6-144e047cb602')))]"
+    },
+    "huntingQueryObject280": {
+      "huntingQueryVersion280": "1.0.0",
+      "_huntingQuerycontentId280": "5e8d5202-ffdc-4d16-ad33-d56eb319c175",
+      "huntingQueryTemplateSpecName280": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5e8d5202-ffdc-4d16-ad33-d56eb319c175')))]"
+    },
+    "huntingQueryObject281": {
+      "huntingQueryVersion281": "1.1.0",
+      "_huntingQuerycontentId281": "dbc25434-bbe7-4517-bf4b-48ad9cb4e980",
+      "huntingQueryTemplateSpecName281": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dbc25434-bbe7-4517-bf4b-48ad9cb4e980')))]"
+    },
+    "huntingQueryObject282": {
+      "huntingQueryVersion282": "1.0.0",
+      "_huntingQuerycontentId282": "dd9df55e-79b7-48e0-9d19-965fcadae5e9",
+      "huntingQueryTemplateSpecName282": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('dd9df55e-79b7-48e0-9d19-965fcadae5e9')))]"
+    },
+    "huntingQueryObject283": {
+      "huntingQueryVersion283": "1.0.2",
+      "_huntingQuerycontentId283": "cdac93ef-56c0-45bf-9e7f-9cbf0ad06123",
+      "huntingQueryTemplateSpecName283": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cdac93ef-56c0-45bf-9e7f-9cbf0ad06123')))]"
+    },
+    "huntingQueryObject284": {
+      "huntingQueryVersion284": "1.0.0",
+      "_huntingQuerycontentId284": "14694b88-a6e9-4cd1-9c4a-e382bdd82d8d",
+      "huntingQueryTemplateSpecName284": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('14694b88-a6e9-4cd1-9c4a-e382bdd82d8d')))]"
+    },
+    "huntingQueryObject285": {
+      "huntingQueryVersion285": "1.0.0",
+      "_huntingQuerycontentId285": "bba7bbbe-5aa3-4c08-bd23-dd6cd8ccaf20",
+      "huntingQueryTemplateSpecName285": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('bba7bbbe-5aa3-4c08-bd23-dd6cd8ccaf20')))]"
+    },
+    "huntingQueryObject286": {
+      "huntingQueryVersion286": "1.0.0",
+      "_huntingQuerycontentId286": "7a5597de-7e99-470d-944f-acb163b9cb14",
+      "huntingQueryTemplateSpecName286": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7a5597de-7e99-470d-944f-acb163b9cb14')))]"
+    },
+    "huntingQueryObject287": {
+      "huntingQueryVersion287": "1.0.0",
+      "_huntingQuerycontentId287": "58e6170e-0512-4485-9638-463fdde85b0e",
+      "huntingQueryTemplateSpecName287": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('58e6170e-0512-4485-9638-463fdde85b0e')))]"
+    },
+    "huntingQueryObject288": {
+      "huntingQueryVersion288": "1.0.0",
+      "_huntingQuerycontentId288": "fe912310-32f5-4256-933b-d4b45e7e6e54",
+      "huntingQueryTemplateSpecName288": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fe912310-32f5-4256-933b-d4b45e7e6e54')))]"
+    },
+    "huntingQueryObject289": {
+      "huntingQueryVersion289": "1.0.0",
+      "_huntingQuerycontentId289": "35ca729c-04b4-4f6c-b383-caed1b85226e",
+      "huntingQueryTemplateSpecName289": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('35ca729c-04b4-4f6c-b383-caed1b85226e')))]"
+    },
+    "huntingQueryObject290": {
+      "huntingQueryVersion290": "1.0.0",
+      "_huntingQuerycontentId290": "3842e70d-45be-43b1-8206-4ebc4c305f34",
+      "huntingQueryTemplateSpecName290": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3842e70d-45be-43b1-8206-4ebc4c305f34')))]"
+    },
+    "huntingQueryObject291": {
+      "huntingQueryVersion291": "1.0.0",
+      "_huntingQuerycontentId291": "761230a3-71ad-4522-bfbc-1dca698ffc42",
+      "huntingQueryTemplateSpecName291": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('761230a3-71ad-4522-bfbc-1dca698ffc42')))]"
+    },
+    "huntingQueryObject292": {
+      "huntingQueryVersion292": "1.0.0",
+      "_huntingQuerycontentId292": "81f02314-2ff5-45cb-a35d-0deb546a0104",
+      "huntingQueryTemplateSpecName292": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('81f02314-2ff5-45cb-a35d-0deb546a0104')))]"
+    },
+    "huntingQueryObject293": {
+      "huntingQueryVersion293": "1.0.0",
+      "_huntingQuerycontentId293": "f350f0e7-0e52-434c-a113-197883219f00",
+      "huntingQueryTemplateSpecName293": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f350f0e7-0e52-434c-a113-197883219f00')))]"
+    },
+    "huntingQueryObject294": {
+      "huntingQueryVersion294": "1.0.0",
+      "_huntingQuerycontentId294": "c5b3e559-7c44-442c-9e73-c753abb02c13",
+      "huntingQueryTemplateSpecName294": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c5b3e559-7c44-442c-9e73-c753abb02c13')))]"
+    },
+    "huntingQueryObject295": {
+      "huntingQueryVersion295": "1.0.0",
+      "_huntingQuerycontentId295": "0efbcea0-1dc0-4844-8a9c-3a1d98fc1697",
+      "huntingQueryTemplateSpecName295": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0efbcea0-1dc0-4844-8a9c-3a1d98fc1697')))]"
+    },
+    "huntingQueryObject296": {
+      "huntingQueryVersion296": "1.0.0",
+      "_huntingQuerycontentId296": "3cc2127f-d9ca-46a0-9628-89f702be82b3",
+      "huntingQueryTemplateSpecName296": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3cc2127f-d9ca-46a0-9628-89f702be82b3')))]"
+    },
+    "huntingQueryObject297": {
+      "huntingQueryVersion297": "1.0.0",
+      "_huntingQuerycontentId297": "0b5b076b-9a1c-440c-a11f-8471a75f46fd",
+      "huntingQueryTemplateSpecName297": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0b5b076b-9a1c-440c-a11f-8471a75f46fd')))]"
+    },
+    "huntingQueryObject298": {
+      "huntingQueryVersion298": "1.0.0",
+      "_huntingQuerycontentId298": "2d16b6fc-eb63-491c-a2c2-1160e2e41dcf",
+      "huntingQueryTemplateSpecName298": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2d16b6fc-eb63-491c-a2c2-1160e2e41dcf')))]"
+    },
+    "huntingQueryObject299": {
+      "huntingQueryVersion299": "1.0.0",
+      "_huntingQuerycontentId299": "084a6349-b3d6-4528-91e4-4de5d52424e5",
+      "huntingQueryTemplateSpecName299": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('084a6349-b3d6-4528-91e4-4de5d52424e5')))]"
+    },
+    "huntingQueryObject300": {
+      "huntingQueryVersion300": "1.0.0",
+      "_huntingQuerycontentId300": "8f404352-c4ff-44d1-8d70-c50ee2fad8f8",
+      "huntingQueryTemplateSpecName300": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8f404352-c4ff-44d1-8d70-c50ee2fad8f8')))]"
+    },
+    "huntingQueryObject301": {
+      "huntingQueryVersion301": "1.0.0",
+      "_huntingQuerycontentId301": "daa347a4-8251-43a7-9730-32f22aa741ab",
+      "huntingQueryTemplateSpecName301": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('daa347a4-8251-43a7-9730-32f22aa741ab')))]"
+    },
+    "huntingQueryObject302": {
+      "huntingQueryVersion302": "1.0.0",
+      "_huntingQuerycontentId302": "8722489a-d6f1-4b66-98e9-e3dfda902019",
+      "huntingQueryTemplateSpecName302": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8722489a-d6f1-4b66-98e9-e3dfda902019')))]"
+    },
+    "huntingQueryObject303": {
+      "huntingQueryVersion303": "1.0.2",
+      "_huntingQuerycontentId303": "2bdd260c-c687-4cb2-9992-87e5ce677678",
+      "huntingQueryTemplateSpecName303": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2bdd260c-c687-4cb2-9992-87e5ce677678')))]"
+    },
+    "huntingQueryObject304": {
+      "huntingQueryVersion304": "1.0.0",
+      "_huntingQuerycontentId304": "e17ddfc6-7478-443b-99ff-286f3d09b8aa",
+      "huntingQueryTemplateSpecName304": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e17ddfc6-7478-443b-99ff-286f3d09b8aa')))]"
+    },
+    "huntingQueryObject305": {
+      "huntingQueryVersion305": "1.0.0",
+      "_huntingQuerycontentId305": "4095e430-d3f4-426f-92c5-aa5c5e137ca0",
+      "huntingQueryTemplateSpecName305": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4095e430-d3f4-426f-92c5-aa5c5e137ca0')))]"
+    },
+    "huntingQueryObject306": {
+      "huntingQueryVersion306": "1.0.0",
+      "_huntingQuerycontentId306": "a7214393-9da7-432e-9b41-fb02b4f740bd",
+      "huntingQueryTemplateSpecName306": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a7214393-9da7-432e-9b41-fb02b4f740bd')))]"
+    },
+    "huntingQueryObject307": {
+      "huntingQueryVersion307": "1.0.0",
+      "_huntingQuerycontentId307": "cedc5bfa-01f6-4e54-b87b-1edbe430e27a",
+      "huntingQueryTemplateSpecName307": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cedc5bfa-01f6-4e54-b87b-1edbe430e27a')))]"
+    },
+    "huntingQueryObject308": {
+      "huntingQueryVersion308": "1.0.0",
+      "_huntingQuerycontentId308": "d0585c34-1b03-473c-938d-11fe73f7e053",
+      "huntingQueryTemplateSpecName308": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d0585c34-1b03-473c-938d-11fe73f7e053')))]"
+    },
+    "huntingQueryObject309": {
+      "huntingQueryVersion309": "1.0.0",
+      "_huntingQuerycontentId309": "63142c12-5d8b-48cf-a0f6-b523c855497c",
+      "huntingQueryTemplateSpecName309": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('63142c12-5d8b-48cf-a0f6-b523c855497c')))]"
+    },
+    "huntingQueryObject310": {
+      "huntingQueryVersion310": "1.0.0",
+      "_huntingQuerycontentId310": "96976bb1-1993-45b8-a477-8236ee93976b",
+      "huntingQueryTemplateSpecName310": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('96976bb1-1993-45b8-a477-8236ee93976b')))]"
+    },
+    "huntingQueryObject311": {
+      "huntingQueryVersion311": "1.0.0",
+      "_huntingQuerycontentId311": "1ddee78f-7508-4f4a-9b6b-d2927724217d",
+      "huntingQueryTemplateSpecName311": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1ddee78f-7508-4f4a-9b6b-d2927724217d')))]"
+    },
+    "huntingQueryObject312": {
+      "huntingQueryVersion312": "1.0.0",
+      "_huntingQuerycontentId312": "1299962c-804e-459a-8d3d-41d68bc45ba2",
+      "huntingQueryTemplateSpecName312": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1299962c-804e-459a-8d3d-41d68bc45ba2')))]"
+    },
+    "huntingQueryObject313": {
+      "huntingQueryVersion313": "1.0.0",
+      "_huntingQuerycontentId313": "cb2fb8f9-89bd-485e-8422-da8cb6c7bc23",
+      "huntingQueryTemplateSpecName313": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cb2fb8f9-89bd-485e-8422-da8cb6c7bc23')))]"
+    },
+    "huntingQueryObject314": {
+      "huntingQueryVersion314": "1.0.0",
+      "_huntingQuerycontentId314": "4f669adc-2c00-4bc8-896b-e59f068dcb18",
+      "huntingQueryTemplateSpecName314": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4f669adc-2c00-4bc8-896b-e59f068dcb18')))]"
+    },
+    "huntingQueryObject315": {
+      "huntingQueryVersion315": "1.0.0",
+      "_huntingQuerycontentId315": "06ea5081-cdea-40c8-b829-240ece951243",
+      "huntingQueryTemplateSpecName315": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('06ea5081-cdea-40c8-b829-240ece951243')))]"
+    },
+    "huntingQueryObject316": {
+      "huntingQueryVersion316": "1.0.0",
+      "_huntingQuerycontentId316": "f086d58b-c44b-4fae-903b-f65ad042a4ee",
+      "huntingQueryTemplateSpecName316": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f086d58b-c44b-4fae-903b-f65ad042a4ee')))]"
+    },
+    "huntingQueryObject317": {
+      "huntingQueryVersion317": "1.0.0",
+      "_huntingQuerycontentId317": "88707168-d4a4-4ca7-a516-b2ee0310af1b",
+      "huntingQueryTemplateSpecName317": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('88707168-d4a4-4ca7-a516-b2ee0310af1b')))]"
+    },
+    "huntingQueryObject318": {
+      "huntingQueryVersion318": "1.0.0",
+      "_huntingQuerycontentId318": "853bacff-45cf-42f2-b2a6-6727fcf183ef",
+      "huntingQueryTemplateSpecName318": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('853bacff-45cf-42f2-b2a6-6727fcf183ef')))]"
+    },
+    "huntingQueryObject319": {
+      "huntingQueryVersion319": "1.0.0",
+      "_huntingQuerycontentId319": "829cf5ba-39d5-4986-814e-d46f8437c27b",
+      "huntingQueryTemplateSpecName319": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('829cf5ba-39d5-4986-814e-d46f8437c27b')))]"
+    },
+    "huntingQueryObject320": {
+      "huntingQueryVersion320": "1.0.0",
+      "_huntingQuerycontentId320": "3dd9ab09-0ea3-4f47-ba10-f84045ab52c3",
+      "huntingQueryTemplateSpecName320": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3dd9ab09-0ea3-4f47-ba10-f84045ab52c3')))]"
+    },
+    "huntingQueryObject321": {
+      "huntingQueryVersion321": "1.0.0",
+      "_huntingQuerycontentId321": "4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77",
+      "huntingQueryTemplateSpecName321": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4dd31bd5-11a3-4b9c-a7c5-4927ab4f2a77')))]"
+    },
+    "huntingQueryObject322": {
+      "huntingQueryVersion322": "1.0.0",
+      "_huntingQuerycontentId322": "74cc0176-3900-440e-b179-45d6a957145a",
+      "huntingQueryTemplateSpecName322": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('74cc0176-3900-440e-b179-45d6a957145a')))]"
+    },
+    "huntingQueryObject323": {
+      "huntingQueryVersion323": "1.0.0",
+      "_huntingQuerycontentId323": "e18109aa-f252-48ec-b115-1b7c16e1174f",
+      "huntingQueryTemplateSpecName323": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e18109aa-f252-48ec-b115-1b7c16e1174f')))]"
+    },
+    "huntingQueryObject324": {
+      "huntingQueryVersion324": "1.0.0",
+      "_huntingQuerycontentId324": "aa3a8508-c0ff-404d-8d5c-4e7f548b0d86",
+      "huntingQueryTemplateSpecName324": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('aa3a8508-c0ff-404d-8d5c-4e7f548b0d86')))]"
+    },
+    "huntingQueryObject325": {
+      "huntingQueryVersion325": "1.0.0",
+      "_huntingQuerycontentId325": "9674f529-f0e9-4305-862d-479ccc9e28f1",
+      "huntingQueryTemplateSpecName325": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9674f529-f0e9-4305-862d-479ccc9e28f1')))]"
+    },
+    "huntingQueryObject326": {
+      "huntingQueryVersion326": "1.0.0",
+      "_huntingQuerycontentId326": "180bacfd-18de-450a-8e0c-7d2fa399ca49",
+      "huntingQueryTemplateSpecName326": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('180bacfd-18de-450a-8e0c-7d2fa399ca49')))]"
+    },
+    "huntingQueryObject327": {
+      "huntingQueryVersion327": "1.0.1",
+      "_huntingQuerycontentId327": "9582b09c-a5cd-4da0-8244-52cc952da158",
+      "huntingQueryTemplateSpecName327": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9582b09c-a5cd-4da0-8244-52cc952da158')))]"
+    },
+    "huntingQueryObject328": {
+      "huntingQueryVersion328": "1.0.0",
+      "_huntingQuerycontentId328": "a2ad014d-0a3a-45eb-ad58-b20532b86015",
+      "huntingQueryTemplateSpecName328": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a2ad014d-0a3a-45eb-ad58-b20532b86015')))]"
+    },
+    "huntingQueryObject329": {
+      "huntingQueryVersion329": "1.0.0",
+      "_huntingQuerycontentId329": "d0232a68-41e1-4fdf-aa17-bf67001fe7b2",
+      "huntingQueryTemplateSpecName329": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d0232a68-41e1-4fdf-aa17-bf67001fe7b2')))]"
+    },
+    "huntingQueryObject330": {
+      "huntingQueryVersion330": "1.0.0",
+      "_huntingQuerycontentId330": "a5888069-ad78-4ac5-9241-5ee83eb19d5d",
+      "huntingQueryTemplateSpecName330": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a5888069-ad78-4ac5-9241-5ee83eb19d5d')))]"
+    },
+    "huntingQueryObject331": {
+      "huntingQueryVersion331": "1.0.0",
+      "_huntingQuerycontentId331": "80067390-3954-4276-bbca-8d4be1df0591",
+      "huntingQueryTemplateSpecName331": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('80067390-3954-4276-bbca-8d4be1df0591')))]"
+    },
+    "huntingQueryObject332": {
+      "huntingQueryVersion332": "1.0.0",
+      "_huntingQuerycontentId332": "cb7629af-4872-427a-9042-ce848c2f49e7",
+      "huntingQueryTemplateSpecName332": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cb7629af-4872-427a-9042-ce848c2f49e7')))]"
+    },
+    "huntingQueryObject333": {
+      "huntingQueryVersion333": "1.0.0",
+      "_huntingQuerycontentId333": "6ad2dbb3-40de-4e39-a3b0-5c8be4e37b7b",
+      "huntingQueryTemplateSpecName333": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6ad2dbb3-40de-4e39-a3b0-5c8be4e37b7b')))]"
+    },
+    "huntingQueryObject334": {
+      "huntingQueryVersion334": "1.0.0",
+      "_huntingQuerycontentId334": "41614487-ccca-458e-81eb-dffbeba0b703",
+      "huntingQueryTemplateSpecName334": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('41614487-ccca-458e-81eb-dffbeba0b703')))]"
+    },
+    "huntingQueryObject335": {
+      "huntingQueryVersion335": "1.0.0",
+      "_huntingQuerycontentId335": "370583ef-40d1-4d8e-a2e2-16095704f357",
+      "huntingQueryTemplateSpecName335": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('370583ef-40d1-4d8e-a2e2-16095704f357')))]"
+    },
+    "huntingQueryObject336": {
+      "huntingQueryVersion336": "1.0.0",
+      "_huntingQuerycontentId336": "01d676ef-29fb-4974-9db1-763660d577fa",
+      "huntingQueryTemplateSpecName336": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('01d676ef-29fb-4974-9db1-763660d577fa')))]"
+    },
+    "huntingQueryObject337": {
+      "huntingQueryVersion337": "1.0.0",
+      "_huntingQuerycontentId337": "7d5d4ac0-e3db-4ddc-9fd3-9894c7de2c5c",
+      "huntingQueryTemplateSpecName337": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7d5d4ac0-e3db-4ddc-9fd3-9894c7de2c5c')))]"
+    },
+    "huntingQueryObject338": {
+      "huntingQueryVersion338": "1.0.0",
+      "_huntingQuerycontentId338": "5dcb4965-db9c-4fee-a7b1-c178998ce5e8",
+      "huntingQueryTemplateSpecName338": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5dcb4965-db9c-4fee-a7b1-c178998ce5e8')))]"
+    },
+    "huntingQueryObject339": {
+      "huntingQueryVersion339": "1.0.0",
+      "_huntingQuerycontentId339": "f72e4cc0-1cb9-413a-8f56-f0363c205d1c",
+      "huntingQueryTemplateSpecName339": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f72e4cc0-1cb9-413a-8f56-f0363c205d1c')))]"
+    },
+    "huntingQueryObject340": {
+      "huntingQueryVersion340": "1.0.0",
+      "_huntingQuerycontentId340": "6f0595a9-724e-4b19-8a9c-8a50d0ac2eef",
+      "huntingQueryTemplateSpecName340": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6f0595a9-724e-4b19-8a9c-8a50d0ac2eef')))]"
+    },
+    "huntingQueryObject341": {
+      "huntingQueryVersion341": "1.0.0",
+      "_huntingQuerycontentId341": "2c96d709-274b-45b8-b53a-545124ac8d8a",
+      "huntingQueryTemplateSpecName341": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2c96d709-274b-45b8-b53a-545124ac8d8a')))]"
+    },
+    "huntingQueryObject342": {
+      "huntingQueryVersion342": "1.0.0",
+      "_huntingQuerycontentId342": "57d825ee-1546-48af-b2d3-644731d21ad3",
+      "huntingQueryTemplateSpecName342": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('57d825ee-1546-48af-b2d3-644731d21ad3')))]"
+    },
+    "huntingQueryObject343": {
+      "huntingQueryVersion343": "1.0.0",
+      "_huntingQuerycontentId343": "f9caad74-cd5a-4559-949a-6cd0f3376ff6",
+      "huntingQueryTemplateSpecName343": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f9caad74-cd5a-4559-949a-6cd0f3376ff6')))]"
+    },
+    "huntingQueryObject344": {
+      "huntingQueryVersion344": "1.0.0",
+      "_huntingQuerycontentId344": "b232adb3-059b-4351-9e4b-78a3c15175e5",
+      "huntingQueryTemplateSpecName344": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b232adb3-059b-4351-9e4b-78a3c15175e5')))]"
+    },
+    "huntingQueryObject345": {
+      "huntingQueryVersion345": "1.0.0",
+      "_huntingQuerycontentId345": "eee98563-fd77-4d6a-a1aa-e0e4952b5cf3",
+      "huntingQueryTemplateSpecName345": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('eee98563-fd77-4d6a-a1aa-e0e4952b5cf3')))]"
+    },
+    "huntingQueryObject346": {
+      "huntingQueryVersion346": "1.0.0",
+      "_huntingQuerycontentId346": "f9ec4d6a-4112-4f4a-bbe9-71eb6f65ce3d",
+      "huntingQueryTemplateSpecName346": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f9ec4d6a-4112-4f4a-bbe9-71eb6f65ce3d')))]"
+    },
+    "huntingQueryObject347": {
+      "huntingQueryVersion347": "1.0.0",
+      "_huntingQuerycontentId347": "a52f16af-5632-420d-ae90-b1b8bd742af0",
+      "huntingQueryTemplateSpecName347": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a52f16af-5632-420d-ae90-b1b8bd742af0')))]"
+    },
+    "huntingQueryObject348": {
+      "huntingQueryVersion348": "1.0.0",
+      "_huntingQuerycontentId348": "c8b12c34-4571-4d37-ae85-fafb02f8bc24",
+      "huntingQueryTemplateSpecName348": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c8b12c34-4571-4d37-ae85-fafb02f8bc24')))]"
+    },
+    "huntingQueryObject349": {
+      "huntingQueryVersion349": "1.0.1",
+      "_huntingQuerycontentId349": "3c9780f9-1784-48b3-b82e-d1e334c08ed2",
+      "huntingQueryTemplateSpecName349": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3c9780f9-1784-48b3-b82e-d1e334c08ed2')))]"
+    },
+    "huntingQueryObject350": {
+      "huntingQueryVersion350": "1.0.0",
+      "_huntingQuerycontentId350": "b2ec7e00-f8a5-450a-81d9-ddb884162595",
+      "huntingQueryTemplateSpecName350": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b2ec7e00-f8a5-450a-81d9-ddb884162595')))]"
+    },
+    "huntingQueryObject351": {
+      "huntingQueryVersion351": "1.0.0",
+      "_huntingQuerycontentId351": "9ddbd09d-6119-4e78-bf15-911c4113d608",
+      "huntingQueryTemplateSpecName351": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('9ddbd09d-6119-4e78-bf15-911c4113d608')))]"
+    },
+    "huntingQueryObject352": {
+      "huntingQueryVersion352": "1.0.0",
+      "_huntingQuerycontentId352": "1be71088-f71c-43cc-9adc-9e5fd7a3a8c4",
+      "huntingQueryTemplateSpecName352": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('1be71088-f71c-43cc-9adc-9e5fd7a3a8c4')))]"
+    },
+    "huntingQueryObject353": {
+      "huntingQueryVersion353": "1.0.0",
+      "_huntingQuerycontentId353": "293d6bbe-97b6-458e-8670-929e9f1756d2",
+      "huntingQueryTemplateSpecName353": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('293d6bbe-97b6-458e-8670-929e9f1756d2')))]"
+    },
+    "huntingQueryObject354": {
+      "huntingQueryVersion354": "1.0.0",
+      "_huntingQuerycontentId354": "b5ac7138-d807-450e-9f67-dbdac948f651",
+      "huntingQueryTemplateSpecName354": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b5ac7138-d807-450e-9f67-dbdac948f651')))]"
+    },
+    "huntingQueryObject355": {
+      "huntingQueryVersion355": "1.0.0",
+      "_huntingQuerycontentId355": "95f7ab0b-3025-487e-9523-1b68152f4b91",
+      "huntingQueryTemplateSpecName355": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('95f7ab0b-3025-487e-9523-1b68152f4b91')))]"
+    },
+    "huntingQueryObject356": {
+      "huntingQueryVersion356": "1.0.0",
+      "_huntingQuerycontentId356": "d3427b51-d7b9-4610-a871-5738e59cfa93",
+      "huntingQueryTemplateSpecName356": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d3427b51-d7b9-4610-a871-5738e59cfa93')))]"
+    },
+    "huntingQueryObject357": {
+      "huntingQueryVersion357": "1.0.0",
+      "_huntingQuerycontentId357": "22dd5345-f620-41b2-b319-a1b3cfa9cb8e",
+      "huntingQueryTemplateSpecName357": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('22dd5345-f620-41b2-b319-a1b3cfa9cb8e')))]"
+    },
+    "huntingQueryObject358": {
+      "huntingQueryVersion358": "1.0.0",
+      "_huntingQuerycontentId358": "7d041b6d-973b-48aa-886d-d234047511f2",
+      "huntingQueryTemplateSpecName358": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7d041b6d-973b-48aa-886d-d234047511f2')))]"
+    },
+    "huntingQueryObject359": {
+      "huntingQueryVersion359": "1.0.0",
+      "_huntingQuerycontentId359": "b54359db-ca8c-4a11-98b7-0f320b870cbd",
+      "huntingQueryTemplateSpecName359": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('b54359db-ca8c-4a11-98b7-0f320b870cbd')))]"
+    },
+    "huntingQueryObject360": {
+      "huntingQueryVersion360": "1.0.0",
+      "_huntingQuerycontentId360": "945a8419-d3ec-41ba-a4b3-c37303bd9458",
+      "huntingQueryTemplateSpecName360": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('945a8419-d3ec-41ba-a4b3-c37303bd9458')))]"
+    },
+    "huntingQueryObject361": {
+      "huntingQueryVersion361": "1.0.0",
+      "_huntingQuerycontentId361": "ccaec93a-7231-4483-9d36-78106f0a8a1a",
+      "huntingQueryTemplateSpecName361": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ccaec93a-7231-4483-9d36-78106f0a8a1a')))]"
+    },
+    "huntingQueryObject362": {
+      "huntingQueryVersion362": "1.0.0",
+      "_huntingQuerycontentId362": "60cf8dc6-b3f7-4bd9-b877-3ed9c9443750",
+      "huntingQueryTemplateSpecName362": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('60cf8dc6-b3f7-4bd9-b877-3ed9c9443750')))]"
+    },
+    "huntingQueryObject363": {
+      "huntingQueryVersion363": "1.0.0",
+      "_huntingQuerycontentId363": "8c86aaf1-46c1-4eee-8953-60f163e83253",
+      "huntingQueryTemplateSpecName363": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8c86aaf1-46c1-4eee-8953-60f163e83253')))]"
+    },
+    "huntingQueryObject364": {
+      "huntingQueryVersion364": "1.0.0",
+      "_huntingQuerycontentId364": "3027abf0-a965-42bd-babe-79f34bbd9e7a",
+      "huntingQueryTemplateSpecName364": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3027abf0-a965-42bd-babe-79f34bbd9e7a')))]"
+    },
+    "huntingQueryObject365": {
+      "huntingQueryVersion365": "1.0.0",
+      "_huntingQuerycontentId365": "ca968fd4-2778-4bca-9da3-2dd1f1b38746",
+      "huntingQueryTemplateSpecName365": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('ca968fd4-2778-4bca-9da3-2dd1f1b38746')))]"
+    },
+    "huntingQueryObject366": {
+      "huntingQueryVersion366": "1.0.0",
+      "_huntingQuerycontentId366": "2a3fe5b0-9a99-467a-b5f9-57825530b22b",
+      "huntingQueryTemplateSpecName366": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2a3fe5b0-9a99-467a-b5f9-57825530b22b')))]"
+    },
+    "huntingQueryObject367": {
+      "huntingQueryVersion367": "1.0.0",
+      "_huntingQuerycontentId367": "fd9d2289-a2c3-4634-8a87-abe4a7db896f",
+      "huntingQueryTemplateSpecName367": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fd9d2289-a2c3-4634-8a87-abe4a7db896f')))]"
+    },
+    "huntingQueryObject368": {
+      "huntingQueryVersion368": "1.0.0",
+      "_huntingQuerycontentId368": "04f08949-c44a-4c02-9d3c-ba40186ea6b2",
+      "huntingQueryTemplateSpecName368": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('04f08949-c44a-4c02-9d3c-ba40186ea6b2')))]"
+    },
+    "huntingQueryObject369": {
+      "huntingQueryVersion369": "1.0.0",
+      "_huntingQuerycontentId369": "14d4474b-10d0-4d03-9938-98c8ef92f15a",
+      "huntingQueryTemplateSpecName369": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('14d4474b-10d0-4d03-9938-98c8ef92f15a')))]"
+    },
+    "huntingQueryObject370": {
+      "huntingQueryVersion370": "1.0.0",
+      "_huntingQuerycontentId370": "2bf1fded-7eb8-4cff-9e1d-efd204cac3f6",
+      "huntingQueryTemplateSpecName370": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2bf1fded-7eb8-4cff-9e1d-efd204cac3f6')))]"
+    },
+    "huntingQueryObject371": {
+      "huntingQueryVersion371": "1.0.0",
+      "_huntingQuerycontentId371": "3f252bcb-71a8-4c04-bed9-4dd53419ecb6",
+      "huntingQueryTemplateSpecName371": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3f252bcb-71a8-4c04-bed9-4dd53419ecb6')))]"
+    },
+    "huntingQueryObject372": {
+      "huntingQueryVersion372": "1.0.0",
+      "_huntingQuerycontentId372": "6b26701a-a1c7-4782-a662-f44cdca5bb5f",
+      "huntingQueryTemplateSpecName372": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6b26701a-a1c7-4782-a662-f44cdca5bb5f')))]"
+    },
+    "huntingQueryObject373": {
+      "huntingQueryVersion373": "1.0.0",
+      "_huntingQuerycontentId373": "97f19cad-130a-47b3-a3bb-cbc2e66845f0",
+      "huntingQueryTemplateSpecName373": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('97f19cad-130a-47b3-a3bb-cbc2e66845f0')))]"
+    },
+    "huntingQueryObject374": {
+      "huntingQueryVersion374": "1.0.0",
+      "_huntingQuerycontentId374": "37511ce4-f88e-4e2d-b505-27411af1a226",
+      "huntingQueryTemplateSpecName374": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('37511ce4-f88e-4e2d-b505-27411af1a226')))]"
+    },
+    "huntingQueryObject375": {
+      "huntingQueryVersion375": "1.0.0",
+      "_huntingQuerycontentId375": "97f0d020-be70-4732-b5d7-abcfeecc459c",
+      "huntingQueryTemplateSpecName375": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('97f0d020-be70-4732-b5d7-abcfeecc459c')))]"
+    },
+    "huntingQueryObject376": {
+      "huntingQueryVersion376": "1.0.0",
+      "_huntingQuerycontentId376": "4ae87c11-4030-42cb-b87d-993198ca40e0",
+      "huntingQueryTemplateSpecName376": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4ae87c11-4030-42cb-b87d-993198ca40e0')))]"
+    },
+    "huntingQueryObject377": {
+      "huntingQueryVersion377": "1.0.0",
+      "_huntingQuerycontentId377": "05d933db-f605-48d5-a177-af64be537cf4",
+      "huntingQueryTemplateSpecName377": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('05d933db-f605-48d5-a177-af64be537cf4')))]"
+    },
+    "huntingQueryObject378": {
+      "huntingQueryVersion378": "1.0.0",
+      "_huntingQuerycontentId378": "2f8a0226-b3f3-4a31-b32b-2dd15d644625",
+      "huntingQueryTemplateSpecName378": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2f8a0226-b3f3-4a31-b32b-2dd15d644625')))]"
+    },
+    "huntingQueryObject379": {
+      "huntingQueryVersion379": "1.0.0",
+      "_huntingQuerycontentId379": "a92a3921-1a71-4a4d-8382-873b689ff7d8",
+      "huntingQueryTemplateSpecName379": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a92a3921-1a71-4a4d-8382-873b689ff7d8')))]"
+    },
+    "huntingQueryObject380": {
+      "huntingQueryVersion380": "1.0.0",
+      "_huntingQuerycontentId380": "22811654-25ac-43d6-ba63-699ec29dd6af",
+      "huntingQueryTemplateSpecName380": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('22811654-25ac-43d6-ba63-699ec29dd6af')))]"
+    },
+    "huntingQueryObject381": {
+      "huntingQueryVersion381": "1.0.0",
+      "_huntingQuerycontentId381": "13e20569-a96c-48c4-b0d7-3c2058d24245",
+      "huntingQueryTemplateSpecName381": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('13e20569-a96c-48c4-b0d7-3c2058d24245')))]"
+    },
+    "huntingQueryObject382": {
+      "huntingQueryVersion382": "1.0.0",
+      "_huntingQuerycontentId382": "d31069b5-44a5-4a5d-96fa-68db27074023",
+      "huntingQueryTemplateSpecName382": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('d31069b5-44a5-4a5d-96fa-68db27074023')))]"
+    },
+    "huntingQueryObject383": {
+      "huntingQueryVersion383": "1.0.0",
+      "_huntingQuerycontentId383": "07e1f2f5-3662-4e8b-8f52-5273d220976b",
+      "huntingQueryTemplateSpecName383": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('07e1f2f5-3662-4e8b-8f52-5273d220976b')))]"
+    },
+    "huntingQueryObject384": {
+      "huntingQueryVersion384": "1.0.0",
+      "_huntingQuerycontentId384": "a0d5391b-a44c-433c-8e08-7137f6e4a23c",
+      "huntingQueryTemplateSpecName384": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a0d5391b-a44c-433c-8e08-7137f6e4a23c')))]"
+    },
+    "huntingQueryObject385": {
+      "huntingQueryVersion385": "1.0.0",
+      "_huntingQuerycontentId385": "effba60e-0a4a-4558-bbf6-4e099607d82e",
+      "huntingQueryTemplateSpecName385": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('effba60e-0a4a-4558-bbf6-4e099607d82e')))]"
+    },
+    "huntingQueryObject386": {
+      "huntingQueryVersion386": "1.0.0",
+      "_huntingQuerycontentId386": "4bce2a7c-31fb-46e9-8487-ce611bd98004",
+      "huntingQueryTemplateSpecName386": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4bce2a7c-31fb-46e9-8487-ce611bd98004')))]"
+    },
+    "huntingQueryObject387": {
+      "huntingQueryVersion387": "1.0.0",
+      "_huntingQuerycontentId387": "88035c0e-0e2d-4805-a249-34d54a88c3fe",
+      "huntingQueryTemplateSpecName387": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('88035c0e-0e2d-4805-a249-34d54a88c3fe')))]"
+    },
+    "workbookVersion1": "4.0.0",
+    "workbookContentId1": "MicrosoftDefenderForOffice365detectionsandinsights",
+    "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
+    "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
+    "_workbookContentId1": "[variables('workbookContentId1')]",
+    "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+    "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
+    "workbookVersion2": "1.0.0",
+    "workbookContentId2": "MicrosoftDefenderForEndPoint",
+    "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]",
+    "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]",
+    "_workbookContentId2": "[variables('workbookContentId2')]",
+    "_workbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId2'),'-', variables('workbookVersion2'))))]",
+    "workbookVersion3": "1.0.0",
+    "workbookContentId3": "MicrosoftDefenderForIdentity",
+    "workbookId3": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId3'))]",
+    "workbookTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId3'))))]",
+    "_workbookContentId3": "[variables('workbookContentId3')]",
+    "_workbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId3'),'-', variables('workbookVersion3'))))]",
+    "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
+  },
+  "resources": [
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('dataConnectorTemplateSpecName1')]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Microsoft Defender XDR data connector with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('dataConnectorVersion1')]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
+              "apiVersion": "2021-03-01-preview",
+              "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+              "location": "[parameters('workspace-location')]",
+              "kind": "StaticUI",
+              "properties": {
+                "connectorUiConfig": {
+                  "id": "[variables('_uiConfigId1')]",
+                  "title": "Microsoft Defender XDR",
+                  "publisher": "Microsoft",
+                  "descriptionMarkdown": "Microsoft Defender XDR is a unified, natively integrated, pre- and post-breach enterprise defense suite that protects endpoint, identity, email, and applications and helps you detect, prevent, investigate, and automatically respond to sophisticated threats.\n\nMicrosoft Defender XDR suite includes: \n- Microsoft Defender for Endpoint\n- Microsoft Defender for Identity\n- Microsoft Defender for Office 365\n- Threat & Vulnerability Management\n- Microsoft Defender for Cloud Apps\n\nFor more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220004&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
+                  "graphQueries": [
+                    {
+                      "metricName": "Total data received",
+                      "legend": "Incidents",
+                      "baseQuery": "SecurityIncident \n| where ProviderName == \"Microsoft 365 Defender\""
+                    },
+                    {
+                      "metricName": "Total data received",
+                      "legend": "Alerts",
+                      "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
+                    },
+                    {
+                      "metricName": "Total data received",
+                      "legend": "Endpoint Events",
+                      "baseQuery": "DeviceEvents| union isfuzzy=true DeviceFileEvents| union isfuzzy=true DeviceImageLoadEvents| union isfuzzy=true DeviceInfo| union isfuzzy=true DeviceLogonEvents| union isfuzzy=true DeviceNetworkEvents| union isfuzzy=true DeviceNetworkInfo| union isfuzzy=true DeviceProcessEvents| union isfuzzy=true DeviceRegistryEvents| union isfuzzy=true DeviceFileCertificateInfo"
+                    },
+                    {
+                      "metricName": "Total data received",
+                      "legend": "Office Events",
+                      "baseQuery": "EmailEvents| union isfuzzy=true EmailUrlInfo| union isfuzzy=true EmailAttachmentInfo| union isfuzzy=true EmailPostDeliveryEvents"
+                    },
+                    {
+                      "metricName": "Total data received",
+                      "legend": "Identity Events",
+                      "baseQuery": "IdentityLogonEvents| union isfuzzy=true IdentityQueryEvents| union isfuzzy=true IdentityDirectoryEvents"
+                    },
+                    {
+                      "metricName": "Total data received",
+                      "legend": "Cloud app Events",
+                      "baseQuery": "CloudAppEvents"
+                    },
+                    {
+                      "metricName": "Total data received",
+                      "legend": "Defender Alert Evidence",
+                      "baseQuery": "AlertEvidence"
+                    }
+                  ],
+                  "connectivityCriterias": [
+                    {
+                      "type": "SentinelKinds",
+                      "value": [
+                        "MicrosoftThreatProtection"
+                      ]
+                    },
+                    {
+                      "type": "MtpAlerts",
+                      "value": [
+                        "AzureAdvancedThreatProtection",
+                        "MicrosoftCloudAppSecurity",
+                        "MicrosoftThreatProtection",
+                        "OfficeATP",
+                        "MicrosoftDefenderAdvancedThreatProtection",
+                        "AzureActiveDirectory",
+                        "OfficeIRM"
+                      ]
+                    },
+                    {
+                      "type": "IsConnectedQuery",
+                      "value": [
+                        "DeviceEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceFileEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceImageLoadEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceLogonEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceNetworkEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceNetworkInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceProcessEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceRegistryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "DeviceFileCertificateInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+                      ]
+                    },
+                    {
+                      "type": "IsConnectedQuery",
+                      "value": [
+                        "EmailEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "EmailUrlInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "EmailAttachmentInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "EmailPostDeliveryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "UrlClickEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+                      ]
+                    },
+                    {
+                      "type": "IsConnectedQuery",
+                      "value": [
+                        "IdentityLogonEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "IdentityQueryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                        "IdentityDirectoryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+                      ]
+                    },
+                    {
+                      "type": "IsConnectedQuery",
+                      "value": [
+                        "CloudAppEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+                      ]
+                    },
+                    {
+                      "type": "IsConnectedQuery",
+                      "value": [
+                        "AlertEvidence\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+                      ]
+                    }
+                  ],
+                  "dataTypes": [
+                    {
+                      "name": "SecurityIncident",
+                      "lastDataReceivedQuery": "SecurityIncident \n| where ProviderName == \"Microsoft 365 Defender\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "SecurityAlert",
+                      "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceEvents",
+                      "lastDataReceivedQuery": "DeviceEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceFileEvents",
+                      "lastDataReceivedQuery": "DeviceFileEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceImageLoadEvents",
+                      "lastDataReceivedQuery": "DeviceImageLoadEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceInfo",
+                      "lastDataReceivedQuery": "DeviceInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceLogonEvents",
+                      "lastDataReceivedQuery": "DeviceLogonEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceNetworkEvents",
+                      "lastDataReceivedQuery": "DeviceNetworkEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceNetworkInfo",
+                      "lastDataReceivedQuery": "DeviceNetworkInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceProcessEvents",
+                      "lastDataReceivedQuery": "DeviceProcessEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceRegistryEvents",
+                      "lastDataReceivedQuery": "DeviceRegistryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "DeviceFileCertificateInfo",
+                      "lastDataReceivedQuery": "DeviceFileCertificateInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "EmailEvents",
+                      "lastDataReceivedQuery": "EmailEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "EmailUrlInfo",
+                      "lastDataReceivedQuery": "EmailUrlInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "EmailAttachmentInfo",
+                      "lastDataReceivedQuery": "EmailAttachmentInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "EmailPostDeliveryEvents",
+                      "lastDataReceivedQuery": "EmailPostDeliveryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "UrlClickEvents",
+                      "lastDataReceivedQuery": "UrlClickEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "IdentityLogonEvents",
+                      "lastDataReceivedQuery": "IdentityLogonEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "IdentityQueryEvents",
+                      "lastDataReceivedQuery": "IdentityQueryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "IdentityDirectoryEvents",
+                      "lastDataReceivedQuery": "IdentityDirectoryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "CloudAppEvents",
+                      "lastDataReceivedQuery": "CloudAppEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    },
+                    {
+                      "name": "AlertEvidence",
+                      "lastDataReceivedQuery": "AlertEvidence\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2023-04-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+              "properties": {
+                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+                "contentId": "[variables('_dataConnectorContentId1')]",
+                "kind": "DataConnector",
+                "version": "[variables('dataConnectorVersion1')]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('_dataConnectorContentId1')]",
+        "contentKind": "DataConnector",
+        "displayName": "Microsoft Defender XDR",
+        "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
+        "id": "[variables('_dataConnectorcontentProductId1')]",
+        "version": "[variables('dataConnectorVersion1')]"
+      },
+      "condition": "[parameters('DeployDataConnector')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+      "dependsOn": [
+        "[variables('_dataConnectorId1')]"
+      ],
+      "location": "[parameters('workspace-location')]",
+      "properties": {
+        "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+        "contentId": "[variables('_dataConnectorContentId1')]",
+        "kind": "DataConnector",
+        "version": "[variables('dataConnectorVersion1')]",
+        "source": {
+          "kind": "Solution",
+          "name": "Microsoft Defender XDR",
+          "sourceId": "[variables('_solutionId')]"
+        },
+        "author": {
+          "name": "Microsoft",
+          "email": "[variables('_email')]"
+        },
+        "support": {
+          "name": "Microsoft Corporation",
+          "email": "support@microsoft.com",
+          "tier": "Microsoft",
+          "link": "https://support.microsoft.com"
+        }
+      },
+      "condition": "[parameters('DeployDataConnector')]"
+    },
+    {
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
+      "apiVersion": "2021-03-01-preview",
+      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+      "location": "[parameters('workspace-location')]",
+      "kind": "StaticUI",
+      "properties": {
+        "connectorUiConfig": {
+          "title": "Microsoft Defender XDR",
+          "publisher": "Microsoft",
+          "descriptionMarkdown": "Microsoft Defender XDR is a unified, natively integrated, pre- and post-breach enterprise defense suite that protects endpoint, identity, email, and applications and helps you detect, prevent, investigate, and automatically respond to sophisticated threats.\n\nMicrosoft Defender XDR suite includes: \n- Microsoft Defender for Endpoint\n- Microsoft Defender for Identity\n- Microsoft Defender for Office 365\n- Threat & Vulnerability Management\n- Microsoft Defender for Cloud Apps\n\nFor more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220004&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
+          "graphQueries": [
+            {
+              "metricName": "Total data received",
+              "legend": "Incidents",
+              "baseQuery": "SecurityIncident \n| where ProviderName == \"Microsoft 365 Defender\""
+            },
+            {
+              "metricName": "Total data received",
+              "legend": "Alerts",
+              "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
+            },
+            {
+              "metricName": "Total data received",
+              "legend": "Endpoint Events",
+              "baseQuery": "DeviceEvents| union isfuzzy=true DeviceFileEvents| union isfuzzy=true DeviceImageLoadEvents| union isfuzzy=true DeviceInfo| union isfuzzy=true DeviceLogonEvents| union isfuzzy=true DeviceNetworkEvents| union isfuzzy=true DeviceNetworkInfo| union isfuzzy=true DeviceProcessEvents| union isfuzzy=true DeviceRegistryEvents| union isfuzzy=true DeviceFileCertificateInfo"
+            },
+            {
+              "metricName": "Total data received",
+              "legend": "Office Events",
+              "baseQuery": "EmailEvents| union isfuzzy=true EmailUrlInfo| union isfuzzy=true EmailAttachmentInfo| union isfuzzy=true EmailPostDeliveryEvents"
+            },
+            {
+              "metricName": "Total data received",
+              "legend": "Identity Events",
+              "baseQuery": "IdentityLogonEvents| union isfuzzy=true IdentityQueryEvents| union isfuzzy=true IdentityDirectoryEvents"
+            },
+            {
+              "metricName": "Total data received",
+              "legend": "Cloud app Events",
+              "baseQuery": "CloudAppEvents"
+            },
+            {
+              "metricName": "Total data received",
+              "legend": "Defender Alert Evidence",
+              "baseQuery": "AlertEvidence"
+            }
+          ],
+          "dataTypes": [
+            {
+              "name": "SecurityIncident",
+              "lastDataReceivedQuery": "SecurityIncident \n| where ProviderName == \"Microsoft 365 Defender\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "SecurityAlert",
+              "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceEvents",
+              "lastDataReceivedQuery": "DeviceEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceFileEvents",
+              "lastDataReceivedQuery": "DeviceFileEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceImageLoadEvents",
+              "lastDataReceivedQuery": "DeviceImageLoadEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceInfo",
+              "lastDataReceivedQuery": "DeviceInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceLogonEvents",
+              "lastDataReceivedQuery": "DeviceLogonEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceNetworkEvents",
+              "lastDataReceivedQuery": "DeviceNetworkEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceNetworkInfo",
+              "lastDataReceivedQuery": "DeviceNetworkInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceProcessEvents",
+              "lastDataReceivedQuery": "DeviceProcessEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceRegistryEvents",
+              "lastDataReceivedQuery": "DeviceRegistryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "DeviceFileCertificateInfo",
+              "lastDataReceivedQuery": "DeviceFileCertificateInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "EmailEvents",
+              "lastDataReceivedQuery": "EmailEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "EmailUrlInfo",
+              "lastDataReceivedQuery": "EmailUrlInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "EmailAttachmentInfo",
+              "lastDataReceivedQuery": "EmailAttachmentInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "EmailPostDeliveryEvents",
+              "lastDataReceivedQuery": "EmailPostDeliveryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "UrlClickEvents",
+              "lastDataReceivedQuery": "UrlClickEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "IdentityLogonEvents",
+              "lastDataReceivedQuery": "IdentityLogonEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "IdentityQueryEvents",
+              "lastDataReceivedQuery": "IdentityQueryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "IdentityDirectoryEvents",
+              "lastDataReceivedQuery": "IdentityDirectoryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "CloudAppEvents",
+              "lastDataReceivedQuery": "CloudAppEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            },
+            {
+              "name": "AlertEvidence",
+              "lastDataReceivedQuery": "AlertEvidence\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+            }
+          ],
+          "connectivityCriterias": [
+            {
+              "type": "SentinelKinds",
+              "value": [
+                "MicrosoftThreatProtection"
+              ]
+            },
+            {
+              "type": "MtpAlerts",
+              "value": [
+                "AzureAdvancedThreatProtection",
+                "MicrosoftCloudAppSecurity",
+                "MicrosoftThreatProtection",
+                "OfficeATP",
+                "MicrosoftDefenderAdvancedThreatProtection",
+                "AzureActiveDirectory",
+                "OfficeIRM"
+              ]
+            },
+            {
+              "type": "IsConnectedQuery",
+              "value": [
+                "DeviceEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceFileEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceImageLoadEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceLogonEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceNetworkEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceNetworkInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceProcessEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceRegistryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "DeviceFileCertificateInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+              ]
+            },
+            {
+              "type": "IsConnectedQuery",
+              "value": [
+                "EmailEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "EmailUrlInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "EmailAttachmentInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "EmailPostDeliveryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "UrlClickEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+              ]
+            },
+            {
+              "type": "IsConnectedQuery",
+              "value": [
+                "IdentityLogonEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "IdentityQueryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
+                "IdentityDirectoryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+              ]
+            },
+            {
+              "type": "IsConnectedQuery",
+              "value": [
+                "CloudAppEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+              ]
+            },
+            {
+              "type": "IsConnectedQuery",
+              "value": [
+                "AlertEvidence\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
+              ]
+            }
+          ],
+          "id": "[variables('_uiConfigId1')]"
+        }
+      },
+      "condition": "[parameters('DeployDataConnector')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PossiblePhishingwithCSL&NetworkSession_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. \nIf your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored.",
+                "displayName": "Possible Phishing with CSL and Network Sessions",
+                "enabled": false,
+                "query": "//SuspiciousUrlClicked\nAlertEvidence\n| where ServiceSource =~ \"Microsoft Defender for Office 365\"\n| where EntityType =~ \"Url\"\n| project AlertId, RemoteUrl\n| join kind=inner (\nAlertEvidence\n| where ServiceSource =~ \"Microsoft Defender for Office 365\"\n| where EntityType =~ \"MailMessage\"\n| project AlertId, NetworkMessageId\n)\non AlertId\n| distinct RemoteUrl, NetworkMessageId\n| join EmailEvents on NetworkMessageId\n| distinct RemoteUrl, NetworkMessageId, RecipientEmailAddress, RecipientObjectId\n| join kind = inner IdentityInfo on $left.RecipientObjectId  == $right.AccountObjectId\n| distinct RemoteUrl, NetworkMessageId, RecipientEmailAddress , RecipientObjectId, AccountSID\n| join kind = inner  \n(DeviceEvents\n| where ActionType =~ \"BrowserLaunchedToOpenUrl\"| where isnotempty(RemoteUrl)\n| project  UrlClickedByUserSid = RemoteUrl,\nInitiatingProcessAccountSid, DeviceName, DeviceId, InitiatingProcessFileName,\nInitiatingProcessAccountUpn, InitiatingProcessAccountName, InitiatingProcessAccountDomain\n)\non $left.AccountSID == $right.InitiatingProcessAccountSid and $left.RemoteUrl == $right.UrlClickedByUserSid\n| distinct  RemoteUrl, NetworkMessageId, RecipientEmailAddress, RecipientObjectId,\n AccountSID, UrlClickedByUserSid, DeviceName, DeviceId, InitiatingProcessFileName,\n InitiatingProcessAccountUpn, InitiatingProcessAccountName, InitiatingProcessAccountDomain\n|  join kind=inner\n(\n//Suspicious url clicked found in common security logs\nCommonSecurityLog\n| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceAction, DestinationDnsDomain, DestinationIP, RequestURL, SourceIP, SourceHostName, RequestClientApplication\n) on $left.RemoteUrl== $right.RequestURL\n|  join kind=inner\n(\n//Find the relevant network sessions\n_Im_NetworkSession\n| where isnotempty(DstIpAddr)\n| where not(ipv4_is_private(DstIpAddr))\n| project TimeGenerated, SrcIpAddr, SrcPortNumber, DstIpAddr, DstPortNumber, DstBytes, SrcBytes\n) on  $left.DestinationIP == $right.DstIpAddr //The relevant network session being projected \n| summarize count() by TimeGenerated, RecipientEmailAddress, UrlClickedByUserSid, InitiatingProcessAccountUpn, InitiatingProcessAccountName, InitiatingProcessAccountDomain,\nDeviceName, InitiatingProcessFileName, DeviceProduct, DeviceAction, SourceIP, DestinationIP, RequestClientApplication\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n| extend RecipientEmailName = tostring(split(RecipientEmailAddress,'@',0)[0]), RecipientEmailUPNSuffix = tostring(split(RecipientEmailAddress,'@',1)[0])\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "AlertEvidence",
+                      "EmailEvents",
+                      "IdentityInfo",
+                      "DeviceEvents",
+                      "DeviceNetworkEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  },
+                  {
+                    "dataTypes": [
+                      "CommonSecurityLog"
+                    ],
+                    "connectorId": "Zscaler"
+                  },
+                  {
+                    "dataTypes": [
+                      "CommonSecurityLog"
+                    ],
+                    "connectorId": "Fortinet"
+                  },
+                  {
+                    "dataTypes": [
+                      "CommonSecurityLog"
+                    ],
+                    "connectorId": "CheckPoint"
+                  },
+                  {
+                    "dataTypes": [
+                      "CommonSecurityLog"
+                    ],
+                    "connectorId": "PaloAltoNetworks"
+                  },
+                  {
+                    "datatypes": [
+                      "AWSVPCFlow"
+                    ],
+                    "connectorId": "AWSS3"
+                  },
+                  {
+                    "dataTypes": [
+                      "WindowsEvent"
+                    ],
+                    "connectorId": "WindowsForwardedEvents"
+                  },
+                  {
+                    "dataTypes": [
+                      "SecurityEvent"
+                    ],
+                    "connectorId": "SecurityEvents"
+                  },
+                  {
+                    "dataTypes": [
+                      "SecurityEvent"
+                    ],
+                    "connectorId": "WindowsSecurityEvents"
+                  },
+                  {
+                    "dataTypes": [
+                      "Syslog"
+                    ],
+                    "connectorId": "MicrosoftSysmonForLinux"
+                  },
+                  {
+                    "dataTypes": [
+                      "AzureDiagnostics"
+                    ],
+                    "connectorId": "AzureNSG"
+                  },
+                  {
+                    "dataTypes": [
+                      "VMConnection"
+                    ],
+                    "connectorId": "AzureMonitor(VMInsights)"
+                  },
+                  {
+                    "dataTypes": [
+                      "VectraStream_CL"
+                    ],
+                    "connectorId": "AIVectraStream"
+                  }
+                ],
+                "tactics": [
+                  "InitialAccess",
+                  "CommandAndControl"
+                ],
+                "techniques": [
+                  "T1566",
+                  "T1102"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "InitiatingProcessAccountUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "InitiatingProcessAccountName"
+                      },
+                      {
+                        "identifier": "UPNSuffix",
+                        "columnName": "InitiatingProcessAccountDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "RecipientEmailAddress"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "RecipientEmailName"
+                      },
+                      {
+                        "identifier": "UPNSuffix",
+                        "columnName": "RecipientEmailUPNSuffix"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "SourceIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "DestinationIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 1",
+                "parentId": "[variables('analyticRuleObject1').analyticRuleId1]",
+                "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Possible Phishing with CSL and Network Sessions",
+        "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+        "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+        "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SUNSPOTHashes_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query uses Microsoft Defender for Endpoint data to look for IoCs associated with the SUNSPOT malware shared by Crowdstrike.\nMore details: \n  - https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/\n  - https://techcommunity.microsoft.com/blog/microsoftsentinelblog/monitoring-the-software-supply-chain-with-azure-sentinel/2176463/",
+                "displayName": "SUNSPOT malware hashes",
+                "enabled": false,
+                "query": "let SUNSPOT_Hashes = dynamic([\"c45c9bda8db1d470f1fd0dcc346dc449839eb5ce9a948c70369230af0b3ef168\", \"0819db19be479122c1d48743e644070a8dc9a1c852df9a8c0dc2343e904da389\"]);\nunion isfuzzy=true(\nDeviceEvents\n| where InitiatingProcessSHA256 in (SUNSPOT_Hashes)),\n(DeviceImageLoadEvents\n| where InitiatingProcessSHA256 in (SUNSPOT_Hashes))\n| extend timestamp=TimeGenerated\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceImageLoadEvents",
+                      "DeviceEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Persistence"
+                ],
+                "techniques": [
+                  "T1554"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "InitiatingProcessAccountUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "InitiatingProcessAccountName"
+                      },
+                      {
+                        "identifier": "UPNSuffix",
+                        "columnName": "InitiatingProcessAccountDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 2",
+                "parentId": "[variables('analyticRuleObject2').analyticRuleId2]",
+                "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject2').analyticRuleVersion2]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "SUNSPOT malware hashes",
+        "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
+        "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]",
+        "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PotentialBuildProcessCompromiseMDE_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process. This query uses Microsoft Defender for Endpoint telemetry.\nMore details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463",
+                "displayName": "Potential Build Process Compromise - MDE",
+                "enabled": false,
+                "query": "// How far back to look for events from\nlet timeframe = 1d;\n// How close together build events and file modifications should occur to alert (make this smaller to reduce FPs)\nlet time_window = 5m;\n// Edit this to include build processes used\nlet build_processes = dynamic([\"MSBuild.exe\", \"dotnet.exe\", \"VBCSCompiler.exe\"]);\n// Include any processes that you want to allow to edit files during/around the build process\nlet allow_list = dynamic([]);\nDeviceProcessEvents\n| where TimeGenerated > ago(timeframe)\n// Look for build process starts\n| where FileName has_any (build_processes)\n| summarize by BuildParentProcess=InitiatingProcessFileName, BuildProcess=FileName, BuildAccount = AccountName, DeviceName, BuildCommand=ProcessCommandLine, \ntimekey= bin(TimeGenerated, time_window), BuildProcessTime=TimeGenerated\n| join kind=inner(\nDeviceFileEvents\n| where TimeGenerated > ago(timeframe)\n| where InitiatingProcessFileName !in (allow_list)\n| where ActionType == \"FileCreated\"  or ActionType == \"FileModified\"\n// Look for code files, edit this to include file extensions used in build.\n| where FileName endswith \".cs\" or FileName endswith \".cpp\"\n| summarize by FileEditParentProcess=InitiatingProcessParentFileName, FileEditAccount = InitiatingProcessAccountName, FileEditDomain = InitiatingProcessAccountDomain, FileEditUpn = InitiatingProcessAccountUpn, \nDeviceName, FileEdited=FileName, FileEditProcess=InitiatingProcessFileName, timekey= bin(TimeGenerated, time_window), FileEditTime=TimeGenerated)\n// join where build processes and file modifications seen at same time on same host\non timekey, DeviceName\n// Limit to only where the file edit happens after the build process starts\n| where BuildProcessTime <= FileEditTime\n| summarize make_set(FileEdited), make_set(FileEditProcess) by timekey, DeviceName, BuildParentProcess, BuildProcess, FileEditAccount, FileEditDomain, FileEditUpn\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents",
+                      "DeviceFileEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Persistence"
+                ],
+                "techniques": [
+                  "T1554"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "FileEditUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "FileEditAccount"
+                      },
+                      {
+                        "identifier": "UPNSuffix",
+                        "columnName": "FileEditDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 3",
+                "parentId": "[variables('analyticRuleObject3').analyticRuleId3]",
+                "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject3').analyticRuleVersion3]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Potential Build Process Compromise - MDE",
+        "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
+        "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]",
+        "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SolarWinds_TEARDROP_Process-IOCs_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies SolarWinds TEARDROP memory-only dropper IOCs in Window's defender Exploit Guard activity\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f",
+                "displayName": "TEARDROP memory-only dropper",
+                "enabled": false,
+                "query": "DeviceEvents\n| where ActionType has \"ExploitGuardNonMicrosoftSignedBlocked\"\n| where InitiatingProcessFileName has \"svchost.exe\" and FileName has \"NetSetupSvc.dll\"\n| extend HashAlgorithm = \"SHA1\"\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution",
+                  "Persistence",
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1543",
+                  "T1059",
+                  "T1027"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "InitiatingProcessAccountUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "InitiatingProcessAccountName"
+                      },
+                      {
+                        "identifier": "UPNSuffix",
+                        "columnName": "InitiatingProcessAccountDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Algorithm",
+                        "columnName": "HashAlgorithm"
+                      },
+                      {
+                        "identifier": "Value",
+                        "columnName": "InitiatingProcessSHA1"
+                      }
+                    ],
+                    "entityType": "FileHash"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 4",
+                "parentId": "[variables('analyticRuleObject4').analyticRuleId4]",
+                "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject4').analyticRuleVersion4]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "TEARDROP memory-only dropper",
+        "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
+        "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]",
+        "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SolarWinds_SUNBURST_Network-IOCs_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies SolarWinds SUNBURST domain beacon IOCs in DeviceNetworkEvents\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f",
+                "displayName": "SUNBURST network beacons",
+                "enabled": false,
+                "query": "let SunburstURL=dynamic([\"panhardware.com\",\"databasegalore.com\",\"avsvmcloud.com\",\"freescanonline.com\",\"thedoccloud.com\",\"deftsecurity.com\"]);\nDeviceNetworkEvents\n| where ActionType == \"ConnectionSuccess\"\n| where RemoteUrl in(SunburstURL)\n| extend HashAlgorithm = 'MD5'\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceNetworkEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution",
+                  "Persistence",
+                  "InitialAccess"
+                ],
+                "techniques": [
+                  "T1195",
+                  "T1059",
+                  "T1546"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "InitiatingProcessAccountUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "InitiatingProcessAccountName"
+                      },
+                      {
+                        "identifier": "UPNSuffix",
+                        "columnName": "InitiatingProcessAccountDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "RemoteIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Url",
+                        "columnName": "RemoteUrl"
+                      }
+                    ],
+                    "entityType": "URL"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Algorithm",
+                        "columnName": "HashAlgorithm"
+                      },
+                      {
+                        "identifier": "Value",
+                        "columnName": "InitiatingProcessMD5"
+                      }
+                    ],
+                    "entityType": "FileHash"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 5",
+                "parentId": "[variables('analyticRuleObject5').analyticRuleId5]",
+                "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject5').analyticRuleVersion5]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "SUNBURST network beacons",
+        "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
+        "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]",
+        "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in DeviceFileEvents\nReferences:\n- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f",
+                "displayName": "SUNBURST and SUPERNOVA backdoor hashes",
+                "enabled": false,
+                "query": "let SunburstMD5=dynamic([\"b91ce2fa41029f6955bff20079468448\",\"02af7cec58b9a5da1c542b5a32151ba1\",\"2c4a910a1299cdae2a4e55988a2f102e\",\"846e27a652a5e1bfbd0ddd38a16dc865\",\"4f2eb62fa529c0283b28d05ddd311fae\"]);\nlet SupernovaMD5=\"56ceb6d0011d87b6e4d7023d7ef85676\";\nDeviceFileEvents\n| where MD5 in(SunburstMD5) or MD5 in(SupernovaMD5)\n| extend HashAlgorithm = \"MD5\"\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceFileEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution",
+                  "Persistence",
+                  "InitialAccess"
+                ],
+                "techniques": [
+                  "T1195",
+                  "T1059",
+                  "T1546"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "InitiatingProcessAccountUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "InitiatingProcessAccountName"
+                      },
+                      {
+                        "identifier": "UPNSuffix",
+                        "columnName": "InitiatingProcessAccountDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Algorithm",
+                        "columnName": "HashAlgorithm"
+                      },
+                      {
+                        "identifier": "Value",
+                        "columnName": "MD5"
+                      }
+                    ],
+                    "entityType": "FileHash"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 6",
+                "parentId": "[variables('analyticRuleObject6').analyticRuleId6]",
+                "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject6').analyticRuleVersion6]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "SUNBURST and SUPERNOVA backdoor hashes",
+        "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
+        "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]",
+        "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AVdetectionsrelatedtoUkrainebasedthreats_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query looks for Microsoft Defender AV detections for malware observed in relation to the war in Ukraine.\n  Ref: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/ ",
+                "displayName": "AV detections related to Ukraine threats",
+                "enabled": false,
+                "query": "let UA_threats = dynamic([\"FoxBlade\", \"WhisperGate\", \"Lasainraw\", \"SonicVote\", \"CaddyWiper\", \"AprilAxe\", \"FiberLake\", \"Industroyer\", \"DesertBlade\"]);\nSecurityAlert\n| where ProviderName =~ \"MDATP\"\n| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n| where ThreatFamilyName in~ (UA_threats)\n| extend HostName = tostring(split(CompromisedEntity, \".\")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "SecurityAlert"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Impact"
+                ],
+                "techniques": [
+                  "T1485"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "CompromisedEntity"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 7",
+                "parentId": "[variables('analyticRuleObject7').analyticRuleId7]",
+                "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject7').analyticRuleVersion7]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "AV detections related to Ukraine threats",
+        "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
+        "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]",
+        "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AVTarrask_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query looks for Microsoft Defender AV detections related to Tarrask malware. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged-on users etc. \n This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.\n Reference: https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/",
+                "displayName": "AV detections related to Tarrask malware",
+                "enabled": false,
+                "query": "let Tarrask_threats = dynamic([\"HackTool:Win64/Tarrask!MS\", \"HackTool:Win64/Ligolo!MSR\", \"Behavior:Win32/ScheduledTaskHide.A\", \"Tarrask\"]);\nDeviceInfo\n| extend DeviceName = tolower(DeviceName)\n| join kind=rightouter ( SecurityAlert\n| where ProviderName =~ \"MDATP\"\n| extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)\n| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n| where ThreatName in~ (Tarrask_threats) or ThreatFamilyName in~ (Tarrask_threats)\n| extend CompromisedEntity = tolower(CompromisedEntity)\n) on $left.DeviceName == $right.CompromisedEntity\n| summarize by DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId , bin(TimeGenerated, 1d), CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities\n| extend HostName = tostring(split(CompromisedEntity, \".\")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "SecurityAlert"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Persistence"
+                ],
+                "techniques": [
+                  "T1053"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "CompromisedEntity"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "PublicIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 8",
+                "parentId": "[variables('analyticRuleObject8').analyticRuleId8]",
+                "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject8').analyticRuleVersion8]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "AV detections related to Tarrask malware",
+        "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
+        "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]",
+        "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AVSpringShell_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query looks for Microsoft Defender AV detections related to the SpringShell vulnerability. In Microsoft Sentinel, the SecurityAlerts table includes only the Device Name of the affected device.\n  This query joins the DeviceInfo table to clearly connect other information such as device group, IP, logged-on users, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.\n  Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/",
+                "displayName": "AV detections related to SpringShell Vulnerability",
+                "enabled": false,
+                "query": "let SpringShell_threats = dynamic([\"Trojan:Python/SpringShellExpl\", \"Exploit:Python/SpringShell\", \"Backdoor:PHP/Remoteshell.V\", \"SpringShell\"]);\nDeviceInfo\n| extend DeviceName = tolower(DeviceName)\n| join kind=inner ( SecurityAlert\n| where ProviderName =~ \"MDATP\"\n| extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)\n| extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n| where ThreatName in~ (SpringShell_threats) or ThreatFamilyName in~ (SpringShell_threats)\n| extend CompromisedEntity = tolower(CompromisedEntity)\n) on $left.DeviceName == $right.CompromisedEntity\n| summarize by DisplayName, ThreatName, ThreatFamilyName, PublicIP, AlertSeverity, Description, tostring(LoggedOnUsers), DeviceId, TenantId , bin(TimeGenerated, 1d), CompromisedEntity, tostring(LoggedOnUsers), ProductName, Entities\n| extend HostName = tostring(split(CompromisedEntity, \".\")[0]), DomainIndex = toint(indexof(CompromisedEntity, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(CompromisedEntity, DomainIndex + 1), CompromisedEntity)\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "SecurityAlert"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "InitialAccess"
+                ],
+                "techniques": [
+                  "T1190"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "CompromisedEntity"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "PublicIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 9",
+                "parentId": "[variables('analyticRuleObject9').analyticRuleId9]",
+                "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject9').analyticRuleVersion9]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "AV detections related to SpringShell Vulnerability",
+        "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
+        "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]",
+        "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PossibleWebpBufferOverflow_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query looks at device, process, and network events from Defender for Endpoint that may be vulnerable to buffer overflow defined in CVE-2023-4863. Results are not an indicator of malicious activity.",
+                "displayName": "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863",
+                "enabled": false,
+                "query": "//CVE-2023-4863 Process activity with .webp files on devices where CVE-2023-4863 is unpatched\n//This query shows all process activity with .webp files on vulnerable machines and is not an indicator of malicious activity\nlet VulnDevices = DeviceTvmSoftwareVulnerabilities\n    | where CveId == \"CVE-2023-4863\"\n    | distinct DeviceId;\nunion DeviceProcessEvents, DeviceNetworkEvents, DeviceEvents\n| where DeviceId in (VulnDevices) and (InitiatingProcessCommandLine has(\".webp\") or ProcessCommandLine has(\".webp\"))\n| extend Name = tostring(split(AccountUpn, \"@\")[0]), UPNSuffix = tostring(split(AccountUpn, \"@\")[1])\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Informational",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents",
+                      "DeviceNetworkEvents",
+                      "DeviceEvents",
+                      "DeviceTvmSoftwareVulnerabilities"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution"
+                ],
+                "techniques": [
+                  "T1203"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "HostNameDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "AccountUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "Name"
+                      },
+                      {
+                        "identifier": "UPNSuffix",
+                        "columnName": "UPNSuffix"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "LocalIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "ProcessId"
+                      }
+                    ],
+                    "entityType": "Process"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "InitiatingProcessId"
+                      }
+                    ],
+                    "entityType": "Process"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "CommandLine",
+                        "columnName": "ProcessCommandLine"
+                      }
+                    ],
+                    "entityType": "Process"
+                  }
+                ],
+                "eventGroupingSettings": {
+                  "aggregationKind": "SingleAlert"
+                },
+                "alertDetailsOverride": {
+                  "alertDisplayNameFormat": "Possible exploitation of CVE-2023-4863",
+                  "alertDynamicProperties": []
+                },
+                "incidentConfiguration": {
+                  "groupingConfiguration": {
+                    "groupByEntities": [
+                      "Account"
+                    ],
+                    "lookbackDuration": "PT5H",
+                    "matchingMethod": "Selected",
+                    "reopenClosedIncident": false,
+                    "enabled": false
+                  },
+                  "createIncident": false
+                }
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject10').analyticRuleId10,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 10",
+                "parentId": "[variables('analyticRuleObject10').analyticRuleId10]",
+                "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject10').analyticRuleVersion10]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863",
+        "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
+        "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]",
+        "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject11').analyticRuleTemplateSpecName11]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DeimosComponentExecution_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.",
+                "displayName": "Deimos Component Execution",
+                "enabled": false,
+                "query": "DeviceEvents   \n| where InitiatingProcessFileName =~ \"powershell.exe\"\n| where ActionType == \"AmsiScriptContent\"\n| where AdditionalFields endswith '[mArS.deiMos]::inteRaCt()\"}'\n| project InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, AdditionalFields, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution",
+                  "Collection",
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1059",
+                  "T1005",
+                  "T1020"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject11').analyticRuleId11,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 11",
+                "parentId": "[variables('analyticRuleObject11').analyticRuleId11]",
+                "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject11').analyticRuleVersion11]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Deimos Component Execution",
+        "contentProductId": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
+        "id": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]",
+        "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject12').analyticRuleTemplateSpecName12]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ImminentRansomware_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query checks for a series of commands that are commonly used by attackers to disable security tools and system recovery tools before deploying Macaw ransomware in an organization.",
+                "displayName": "Imminent Ransomware",
+                "enabled": false,
+                "query": "_ASim_ProcessEvent \n// Pivot on specific commands \n| where CommandLine has_any(\"-ExclusionPath\", \"Set-MpPreference\", \"advfirewall\", \"-ExclusionExtension\", \n\"-EnableControlledFolderAccess\", \"windefend\", \"onstart\", \"bcdedit\", \"Startup\") \n// Making list of found commands \n| summarize CommandLine = make_set(CommandLine, 10000) by DvcId, Dvc, bin(TimeGenerated, 6h) \n// Extending columns for later aggregration, based on TTP\n| extend StartUpExclusionPath = iff(CommandLine has_all(\"-ExclusionPath\", \"Startup\"), 1, 0) \n| extend DefenderTamp = iff(CommandLine has \"Set-MpPreference\" \nand CommandLine has_any( \n\"-SevereThreatDefaultAction 6\" \n\"-HighThreatDefaultAction 6\", \n\"-ModerateThreatDefaultAction 6\", \n\"-LowThreatDefaultAction 6\" \n\"-ScanScheduleDay 8\"), 1, 0) \n| extend NetshFirewallTampering = iff(CommandLine has_all( \"netsh\", \"advfirewall\", \"allprofiles state off\"), 1, 0) \n| extend BatExclusion = iff(CommandLine has_all(\"-ExclusionExtension\", \".bat\"), 1, 0) \n| extend ExeExclusion = iff(CommandLine has_all(\"-ExclusionExtension\", \".exe\"), 1, 0) \n| extend DisableControlledFolderAccess = iff(CommandLine has_all(\"-EnableControlledFolderAccess\", \"Disabled\"), 1, 0) \n| extend ScDeleteDefend = iff(CommandLine has_all(\"sc\", \"delete\", \"windefend\"), 1, 0) \n| extend BootTampering = iff(CommandLine has_all(\"bcdedit\", \"default\") and CommandLine has_any (\"recoveryenabled No\", \"bootstatuspolicy ignoreallfailures\"), 1, 0) \n| extend SchTasks = iff(CommandLine has_all(\"/sc\", \"onstart\", \"system\", \"/create\", \"/delay\"), 1, 0) \n// Summarizing found commands \n| summarize by NetshFirewallTampering ,BatExclusion, ExeExclusion, DisableControlledFolderAccess, ScDeleteDefend, SchTasks, BootTampering, DefenderTamp, StartUpExclusionPath, DvcId, Dvc, TimeGenerated \n// Adding up each piece of evidence \n| extend EvidenceCount = NetshFirewallTampering + BatExclusion + ExeExclusion + DisableControlledFolderAccess + ScDeleteDefend + SchTasks + BootTampering + DefenderTamp + StartUpExclusionPath \n| where EvidenceCount > 4\n| extend HostName = iff(Dvc has '.', substring(Dvc, 0, indexof(Dvc, '.')), Dvc)\n| extend DnsDomain = iff(Dvc has '.', substring(Dvc, indexof(Dvc, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": "[variables('TemplateEmptyArray')]",
+                "tactics": [
+                  "DefenseEvasion",
+                  "Persistence"
+                ],
+                "techniques": [
+                  "T1562",
+                  "T1547"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "Dvc"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject12').analyticRuleId12,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 12",
+                "parentId": "[variables('analyticRuleObject12').analyticRuleId12]",
+                "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject12').analyticRuleVersion12]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Imminent Ransomware",
+        "contentProductId": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
+        "id": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]",
+        "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject13').analyticRuleTemplateSpecName13]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MaliciousCMDExecutionByJava_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query was originally published in the threat analytics report, Sysrv botnet evolution.\nSysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.\nThe following query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script.",
+                "displayName": "Java Executing cmd to run Powershell",
+                "enabled": false,
+                "query": "DeviceProcessEvents                         \n| where InitiatingProcessFileName == 'java.exe' and FileName == 'cmd.exe' \nand ProcessCommandLine has_all('powershell iex','DownloadString')\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution"
+                ],
+                "techniques": [
+                  "T1059"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject13').analyticRuleId13,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 13",
+                "parentId": "[variables('analyticRuleObject13').analyticRuleId13]",
+                "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject13').analyticRuleVersion13]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Java Executing cmd to run Powershell",
+        "contentProductId": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
+        "id": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]",
+        "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject14').analyticRuleTemplateSpecName14]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "C2-NamedPipe_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Detects the creation of a named pipe used by known APT malware.\nReference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c",
+                "displayName": "C2-NamedPipe",
+                "enabled": false,
+                "query": "// this is what should be constantly tweaked with default C2 framework names, search uses has_any (wildcard)\nlet badPipeNames = pack_array(\n    '\\\\psexec',                                     // PSexec default pipe\n    '\\\\paexec',                                     // PSexec default pipe\n    '\\\\remcom',                                     // PSexec default pipe\n    '\\\\csexec',                                     // PSexec default pipe\n    '\\\\isapi_http',                                 // Uroburos Malware Named Pipe\n    '\\\\isapi_dg',                                   // Uroburos Malware Named Pipe\n    '\\\\isapi_dg2',                                  // Uroburos Malware Named Pipe\n    '\\\\sdlrpc',                                     // Cobra Trojan Named Pipe http://goo.gl/8rOZUX\n    '\\\\ahexec',                                     // Sofacy group malware\n    '\\\\winsession',                                 // Wild Neutron APT malware https://goo.gl/pivRZJ\n    '\\\\lsassw',                                     // Wild Neutron APT malware https://goo.gl/pivRZJ\n    '\\\\46a676ab7f179e511e30dd2dc41bd388',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\9f81f59bc58452127884ce513865ed20',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\e710f28d59aa529d6792ca6ff0ca1b34',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\rpchlp_3',                                   // Project Sauron https://goo.gl/eFoP4A - Technical Analysis Input\n    '\\\\NamePipe_MoreWindows',                       // US-CERT Alert - RedLeaves https://www.us-cert.gov/ncas/alerts/TA17-117A\n    '\\\\pcheap_reuse',                               // Pipe used by Equation Group malware 77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0\n    '\\\\gruntsvc',                                   // Covenant default named pipe\n    '\\\\583da945-62af-10e8-4902-a8f205c72b2e',       // SolarWinds SUNBURST malware report https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n    '\\\\bizkaz',                                     // Snatch Ransomware https://thedfirreport.com/2020/06/21/snatch-ransomware/\n    '\\\\atctl',                                      // https://www.virustotal.com/#/file/a4ddb2664a6c87a1d3c5da5a5a32a5df9a0b0c8f2e951811bd1ec1d44d42ccf1/detection\n    '\\\\userpipe',                                   // ruag apt case\n    '\\\\iehelper',                                   // ruag apt case\n    '\\\\sdlrpc',                                     // project cobra https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    '\\\\comnap',                                     // https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    '\\\\lsadump',                                    // Cred Dump-Tools Named Pipes\n    '\\\\cachedump',                                  // Cred Dump-Tools Named Pipes\n    '\\\\wceservicepipe',                             // Cred Dump-Tools Named Pipes\n    '\\\\jaccdpqnvbrrxlaf',                           // PoshC2 default named pipe\n    '\\\\svcctl',                                     // CrackMapExec default named pipe\n    '\\\\csexecsvc'                                   // CSEXEC default named pipe\n    '\\\\status_',                                    // CS default named pipes https://github.com/Neo23x0/sigma/issues/253\n    '\\\\MSSE-',                                      // CobaltStrike default named pipe\n    '\\\\status_',                                    // CobaltStrike default named pipe\n    '\\\\msagent_',                                   // (target) CobaltStrike default named pipe\n    '\\\\postex_ssh_',                                // CobaltStrike default named pipe\n    '\\\\postex_',                                    // CobaltStrike default named pipe\n    '\\\\Posh'                                        // PoshC2 default named pipe\n);\nDeviceEvents\n| where ActionType == \"NamedPipeEvent\"\n| extend ParsedFields=parse_json(AdditionalFields)\n| where ParsedFields.FileOperation == \"File created\"\n| where ParsedFields.PipeName has_any (badPipeNames)\n| project TimeGenerated, ActionType, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, ParsedFields.FileOperation, ParsedFields.PipeName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "CommandAndControl"
+                ],
+                "techniques": [
+                  "T1105"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject14').analyticRuleId14,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 14",
+                "parentId": "[variables('analyticRuleObject14').analyticRuleId14]",
+                "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject14').analyticRuleVersion14]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "C2-NamedPipe",
+        "contentProductId": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
+        "id": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]",
+        "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject15').analyticRuleTemplateSpecName15]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DoppelPaymerProcDump_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.\nDoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they use SysInternal utilities such as ProcDump to dump credentials from LSASS. They often use these stolen credentials to turn off security software, run malicious commands, and spread malware throughout an organization.\nThe following query detects ProcDump being used to dump credentials from LSASS.\nThe See also section below lists links to other queries associated with DoppelPaymer.\nReferences:\nhttps://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/DoppelPaymer.KM!MTB\nhttps://docs.microsoft.com/sysinternals/downloads/procdump\nhttps://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection",
+                "displayName": "DopplePaymer Procdump",
+                "enabled": false,
+                "query": "// Dumping of LSASS memory using procdump\nDeviceProcessEvents\n// Command lines that include \"lsass\" and -accepteula or -ma flags used in procdump\n| where (ProcessCommandLine has \"lsass\" and (ProcessCommandLine has \"-accepteula\" or\nProcessCommandLine contains \"-ma\"))\n// Omits possible FPs where the full command is just \"procdump.exe lsass\"\nor (FileName in~ ('procdump.exe','procdump64.exe') and ProcessCommandLine has 'lsass')\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "CredentialAccess"
+                ],
+                "techniques": [
+                  "T1003"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject15').analyticRuleId15,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 15",
+                "parentId": "[variables('analyticRuleObject15').analyticRuleId15]",
+                "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject15').analyticRuleVersion15]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "DopplePaymer Procdump",
+        "contentProductId": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
+        "id": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]",
+        "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject16').analyticRuleTemplateSpecName16]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LSASSCredDumpProcdump_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query was originally published in the threat analytics report, \"Exchange Server zero-days exploited in the wild\".\nIn early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:\n1. CVE-2021-26855\n2. CVE-2021-26857\n3. CVE-2021-26858\n4. CVE-2021-27065\nThe following query looks for evidence of Procdump being used to dump credentials from LSASS, the Local Security Authentication Server. This might indicate an attacker has compromised user accounts.\nMore queries related to this threat can be found under the See also section of this page.\nReference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/",
+                "displayName": "LSASS Credential Dumping with Procdump",
+                "enabled": false,
+                "query": "DeviceProcessEvents \n| where (FileName has_any (\"procdump.exe\", \"procdump64.exe\") and ProcessCommandLine has \"lsass\") or \n// Looking for Accepteula flag or Write a dump file with all process memory\n(ProcessCommandLine has \"lsass.exe\" and (ProcessCommandLine has \"-accepteula\" or ProcessCommandLine contains \"-ma\"))\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "CredentialAccess"
+                ],
+                "techniques": [
+                  "T1003"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject16').analyticRuleId16,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 16",
+                "parentId": "[variables('analyticRuleObject16').analyticRuleId16]",
+                "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject16').analyticRuleVersion16]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "LSASS Credential Dumping with Procdump",
+        "contentProductId": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
+        "id": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]",
+        "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject17').analyticRuleTemplateSpecName17]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DoppelpaymerStopService_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.\nDoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization.\nThe following query detects attempts to stop security services.\nThe See also section below lists links to other queries associated with DoppelPaymer.\nReferences:\nhttps://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/DoppelPaymer.KM!MTB",
+                "displayName": "Doppelpaymer Stop Services",
+                "enabled": false,
+                "query": "// Attempts to stop services and allow ransomware execution\nDeviceProcessEvents\n| where InitiatingProcessFileName startswith \"psexe\" and FileName =~ \"powershell.exe\" and\n  ProcessCommandLine has \"stop-service\" and ProcessCommandLine has \"sql\" and ProcessCommandLine has \"msexchange\"\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution",
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1059",
+                  "T1562"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject17').analyticRuleId17,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 17",
+                "parentId": "[variables('analyticRuleObject17').analyticRuleId17]",
+                "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject17').analyticRuleVersion17]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Doppelpaymer Stop Services",
+        "contentProductId": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]",
+        "id": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]",
+        "version": "[variables('analyticRuleObject17').analyticRuleVersion17]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject18').analyticRuleTemplateSpecName18]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "QakbotCampaignSelfDeletion_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware\nQakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.\nThe following query detects if an instance of Qakbot has attempted to overwrite its original binary.\nReference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/",
+                "displayName": "Qakbot Campaign Self Deletion",
+                "enabled": false,
+                "query": "DeviceProcessEvents \n| where FileName =~ \"ping.exe\"\n| where InitiatingProcessFileName =~ \"cmd.exe\"\n| where (InitiatingProcessCommandLine has \"calc.exe\") and (InitiatingProcessCommandLine has \"-n 6\") and (InitiatingProcessCommandLine has \"127.0.0.1\")\n| project TimeGenerated, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DeviceId, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1070"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject18').analyticRuleId18,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 18",
+                "parentId": "[variables('analyticRuleObject18').analyticRuleId18]",
+                "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject18').analyticRuleVersion18]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Qakbot Campaign Self Deletion",
+        "contentProductId": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]",
+        "id": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]",
+        "version": "[variables('analyticRuleObject18').analyticRuleVersion18]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject19').analyticRuleTemplateSpecName19]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Regsvr32Rundll32ImageLoadsAbnormalExtension_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll.\nJoins the data to public network events.\nReferences:\nhttps://threathunt.blog/running-live-malware-for-threat-hunting-purposes/",
+                "displayName": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
+                "enabled": false,
+                "query": "DeviceImageLoadEvents \n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where FileName !endswith \".dll\"\n| join (\nDeviceNetworkEvents\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where RemoteIPType == \"Public\"\n) on InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessCommandLine\n| project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalIP, LocalPort, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessParentFileName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents",
+                      "DeviceNetworkEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion"
+                ],
+                "subTechniques": [
+                  "T1218.010",
+                  "T1218.011"
+                ],
+                "techniques": [
+                  "T1218",
+                  "T1218"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "LocalIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "RemoteIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Url",
+                        "columnName": "RemoteUrl"
+                      }
+                    ],
+                    "entityType": "URL"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject19').analyticRuleId19,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 19",
+                "parentId": "[variables('analyticRuleObject19').analyticRuleId19]",
+                "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject19').analyticRuleVersion19]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
+        "contentProductId": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]",
+        "id": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]",
+        "version": "[variables('analyticRuleObject19').analyticRuleVersion19]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject20').analyticRuleTemplateSpecName20]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Regsvr32Rundll32WithAnomalousParentProcess_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject20')._analyticRulecontentId20]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This analytical rule looks for rundll32.exe or regsvr32.exe being spawned by abnormal processes: wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe.\nBlog: https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/",
+                "displayName": "Regsvr32 Rundll32 with Anomalous Parent Process",
+                "enabled": false,
+                "query": "DeviceProcessEvents\n| where FileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where InitiatingProcessFileName has_any (\"wscript.exe\",\"powershell.exe\",\"cmd.exe\",\"pwsh.exe\",\"cscript.exe\")\n| project TimeGenerated, DeviceName, InvestigatedProcessName=FileName, InvestigatedProcessCommandLine = ProcessCommandLine,InvestigatedProcessStartTime = ProcessCreationTime, InvestigatedProcessId = ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName\n| join (\nDeviceNetworkEvents\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where RemoteIPType == \"Public\"\n| project DeviceName, InvestigatedProcessName=InitiatingProcessFileName, InvestigatedProcessCommandLine = InitiatingProcessCommandLine,InvestigatedProcessStartTime = InitiatingProcessCreationTime, InvestigatedProcessId = InitiatingProcessId, LocalIP, RemoteIP, RemoteUrl\n) on DeviceName, InvestigatedProcessCommandLine, InvestigatedProcessId, InvestigatedProcessName, InvestigatedProcessStartTime\n| project-away DeviceName1, InvestigatedProcessCommandLine1, InvestigatedProcessId1, InvestigatedProcessName1, InvestigatedProcessStartTime1\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents",
+                      "DeviceNetworkEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion"
+                ],
+                "subTechniques": [
+                  "T1218.010",
+                  "T1218.011"
+                ],
+                "techniques": [
+                  "T1218",
+                  "T1218"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "LocalIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "RemoteIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Url",
+                        "columnName": "RemoteUrl"
+                      }
+                    ],
+                    "entityType": "URL"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject20').analyticRuleId20,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 20",
+                "parentId": "[variables('analyticRuleObject20').analyticRuleId20]",
+                "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject20').analyticRuleVersion20]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Regsvr32 Rundll32 with Anomalous Parent Process",
+        "contentProductId": "[variables('analyticRuleObject20')._analyticRulecontentProductId20]",
+        "id": "[variables('analyticRuleObject20')._analyticRulecontentProductId20]",
+        "version": "[variables('analyticRuleObject20').analyticRuleVersion20]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject21').analyticRuleTemplateSpecName21]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SuspiciousCommandInitiatedByWebServerProcess_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject21')._analyticRulecontentId21]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query was originally published in the threat analytics report, Operation Soft Cell.\nOperation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.\nOperation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.\nReference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers",
+                "displayName": "Detect Suspicious Commands Initiated by Webserver Processes",
+                "enabled": false,
+                "query": "// Suspicious commands launched by web server processes\nDeviceProcessEvents \n| where (((InitiatingProcessParentFileName in(\"w3wp.exe\", \"beasvc.exe\",\n    \"httpd.exe\") or InitiatingProcessParentFileName startswith \"tomcat\")\n    or InitiatingProcessFileName in(\"w3wp.exe\", \"beasvc.exe\", \"httpd.exe\") or\n    InitiatingProcessFileName startswith \"tomcat\"))\n    and FileName in~('cmd.exe', 'powershell.exe')\n| where ProcessCommandLine contains '%temp%'\n    or ProcessCommandLine has 'wget'\n    or ProcessCommandLine has 'whoami'\n    or ProcessCommandLine has 'certutil'\n    or ProcessCommandLine has 'systeminfo'\n    or ProcessCommandLine has 'ping'\n    or ProcessCommandLine has 'ipconfig'\n    or ProcessCommandLine has 'timeout'\n| summarize\n    take_any(FileName),\n    make_set(ProcessCommandLine, 100000),\n    take_any(InitiatingProcessFileName),\n    take_any(InitiatingProcessParentFileName)\n    by DeviceId, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution",
+                  "DefenseEvasion",
+                  "Discovery"
+                ],
+                "techniques": [
+                  "T1059",
+                  "T1574",
+                  "T1087",
+                  "T1082"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject21').analyticRuleId21,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 21",
+                "parentId": "[variables('analyticRuleObject21').analyticRuleId21]",
+                "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject21').analyticRuleVersion21]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Detect Suspicious Commands Initiated by Webserver Processes",
+        "contentProductId": "[variables('analyticRuleObject21')._analyticRulecontentProductId21]",
+        "id": "[variables('analyticRuleObject21')._analyticRulecontentProductId21]",
+        "version": "[variables('analyticRuleObject21').analyticRuleVersion21]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject22').analyticRuleTemplateSpecName22]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "BITSAdminActivity_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject22')._analyticRulecontentId22]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. \nThis service is commonly used for legitimate purposes, but can also be used as part of a malware downloader. \nAdditionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This\nquery will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer\ndirectionality.",
+                "displayName": "Bitsadmin Activity",
+                "enabled": false,
+                "query": "DeviceProcessEvents\n| where \n    (FileName =~ \"bitsadmin.exe\" or column_ifexists('ProcessVersionInfoOriginalFileName','ColumnNotAvailable') =~ 'bitsadmin.exe')\n    and ProcessCommandLine has_any ('/Transfer','/AddFile', '/AddFileSet','/AddFileWithRanges')\n| extend \n    ParsedCommandLine = parse_command_line(ProcessCommandLine,'windows')\n| extend     \n    RemoteUrl = tostring(ParsedCommandLine[-2]),\n    LocalFile= tostring(ParsedCommandLine[-1]),\n    Direction = iff(ProcessCommandLine has \"/Upload\", 'Upload', 'Download')\n| project-reorder \n    TimeGenerated,\n    DeviceId,\n    DeviceName,\n    Direction,\n    RemoteUrl,\n    LocalFile,\n    InitiatingProcessFolderPath,\n    InitiatingProcessAccountDomain,\n    InitiatingProcessAccountName,\n    InitiatingProcessSHA256,\n    ProcessId,\n    ProcessCommandLine\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Persistence",
+                  "CommandAndControl",
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1197",
+                  "T1105",
+                  "T1048"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "ProcessId"
+                      },
+                      {
+                        "identifier": "CommandLine",
+                        "columnName": "ProcessCommandLine"
+                      }
+                    ],
+                    "entityType": "Process"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject22').analyticRuleId22,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 22",
+                "parentId": "[variables('analyticRuleObject22').analyticRuleId22]",
+                "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject22').analyticRuleVersion22]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Bitsadmin Activity",
+        "contentProductId": "[variables('analyticRuleObject22')._analyticRulecontentProductId22]",
+        "id": "[variables('analyticRuleObject22')._analyticRulecontentProductId22]",
+        "version": "[variables('analyticRuleObject22').analyticRuleVersion22]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject23').analyticRuleTemplateSpecName23]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "OfficeAppsLaunchingWscript_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject23')._analyticRulecontentId23]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated.\nTrickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command-and-control (C2) operations.\nTrickbot is frequently spread through email. An attacker will send a target a message with an attachment containing a malicious macro. If the target enables the macro, it will write a JScript Encoded (JSE) file to disk (JScript is a Microsoft dialect of ECMAScript). The JSE file will then be launched using wscript.exe to perform a variety of malicious tasks, particularly reconnaissance.\nThe following query detects when Office applications have launched wscript.exe to run a JSE file.\nSee Detect rundll.exe being used for reconnaissance and command-and-control for another query related to Trickbot activity.\nReference - https://attack.mitre.org/software/S0266/",
+                "displayName": "Office Apps Launching Wscipt",
+                "enabled": false,
+                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName in~ ('winword.exe', 'excel.exe', 'outlook.exe') \n| where FileName =~ \"wscript.exe\" and ProcessCommandLine has \".jse\"\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution",
+                  "Collection",
+                  "CommandAndControl"
+                ],
+                "techniques": [
+                  "T1059",
+                  "T1105",
+                  "T1203"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "ProcessId"
+                      },
+                      {
+                        "identifier": "CommandLine",
+                        "columnName": "ProcessCommandLine"
+                      }
+                    ],
+                    "entityType": "Process"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject23').analyticRuleId23,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 23",
+                "parentId": "[variables('analyticRuleObject23').analyticRuleId23]",
+                "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject23').analyticRuleVersion23]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Office Apps Launching Wscipt",
+        "contentProductId": "[variables('analyticRuleObject23')._analyticRulecontentProductId23]",
+        "id": "[variables('analyticRuleObject23')._analyticRulecontentProductId23]",
+        "version": "[variables('analyticRuleObject23').analyticRuleVersion23]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject24').analyticRuleTemplateSpecName24]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PotentialKerberoastActivities_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject24')._analyticRulecontentId24]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query aim to detect if someone requests service tickets (where count => maxcount)\nThe query requires trimming to set a baseline level for MaxCount  \nMitre Technique: Kerberoasting (T1558.003)\n@MattiasBorg82",
+                "displayName": "Detect Potential Kerberoast Activities",
+                "enabled": false,
+                "query": "let MaxCount = 70; //Number of requests per 2 minute timeframe, depending on org size.\nIdentityLogonEvents\n| where ActionType == \"LogonSuccess\"\n| where Protocol == \"Kerberos\"\n| extend json = todynamic(parse_json(tostring(AdditionalFields)))\n| extend SPN = json.Spns,\n       AttackTechniques = json.AttackTechniques\n      | project-away json\n| where isnotempty(SPN)\n| where AttackTechniques has \"T1558.003\"\n| mv-expand SPN\n        | extend SPNType = tostring(extract(@\"^\\w+\",0,tostring(SPN)))\n| distinct tostring(SPN), DeviceName, AccountUpn, AccountSid, bin(TimeGenerated, 2m), ReportId, tostring(AttackTechniques)\n| summarize count(), SPNS=(make_list(SPN, 100000)),ReportId=tostring((make_list(ReportId, 100000))[0]) by AccountUpn,AccountSid,DeviceName, bin(TimeGenerated, 2m), tostring(AttackTechniques)\n| extend SPNS = (replace_regex(tostring(SPNS), @'[^\\w+-\\/]+', '')) \n| where count_ >= MaxCount\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n| extend AccountDomain = tostring(split(AccountUpn, '@')[1]), AccountName = tostring(split(AccountUpn, '@')[0])\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "IdentityLogonEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "CredentialAccess"
+                ],
+                "subTechniques": [
+                  "T1558.003"
+                ],
+                "techniques": [
+                  "T1558"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "AccountUpn"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "AccountDomain"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "AccountName"
+                      }
+                    ],
+                    "entityType": "Account"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject24').analyticRuleId24,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 24",
+                "parentId": "[variables('analyticRuleObject24').analyticRuleId24]",
+                "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject24').analyticRuleVersion24]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Detect Potential Kerberoast Activities",
+        "contentProductId": "[variables('analyticRuleObject24')._analyticRulecontentProductId24]",
+        "id": "[variables('analyticRuleObject24')._analyticRulecontentProductId24]",
+        "version": "[variables('analyticRuleObject24').analyticRuleVersion24]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject25').analyticRuleTemplateSpecName25]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "FilesCopiedToUSBDrives_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject25')._analyticRulecontentId25]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types.",
+                "displayName": "Files Copied to USB Drives",
+                "enabled": false,
+                "query": "let UsbDriveMount = DeviceEvents\n| where ActionType==\"UsbDriveMounted\"\n| extend ParsedFields=parse_json(AdditionalFields)\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=TimeGenerated,\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\n| order by DeviceId asc, MountTime desc;\nlet FileCreation = DeviceFileEvents\n| where InitiatingProcessAccountName != \"system\"\n| where ActionType == \"FileCreated\"\n| where FolderPath !startswith \"C:\\\\\"\n| where FolderPath !startswith \"\\\\\"\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\nFileName, FolderPath, SHA256, TimeGenerated, SensitivityLabel, IsAzureInfoProtectionApplied\n| order by DeviceId asc, TimeGenerated desc;\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\n| where FolderPath startswith DriveLetter\n| where TimeGenerated >= MountTime\n| partition hint.strategy=native by ReportId ( top 1 by MountTime )\n| order by DeviceId asc, TimeGenerated desc\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n| extend FileHashAlgorithm = 'SHA256'\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceEvents",
+                      "DeviceFileEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Exfiltration"
+                ],
+                "techniques": [
+                  "T1041"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Name",
+                        "columnName": "FileName"
+                      },
+                      {
+                        "identifier": "Directory",
+                        "columnName": "FolderPath"
+                      }
+                    ],
+                    "entityType": "File"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Algorithm",
+                        "columnName": "FileHashAlgorithm"
+                      },
+                      {
+                        "identifier": "Value",
+                        "columnName": "SHA256"
+                      }
+                    ],
+                    "entityType": "FileHash"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject25').analyticRuleId25,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 25",
+                "parentId": "[variables('analyticRuleObject25').analyticRuleId25]",
+                "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject25').analyticRuleVersion25]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Files Copied to USB Drives",
+        "contentProductId": "[variables('analyticRuleObject25')._analyticRulecontentProductId25]",
+        "id": "[variables('analyticRuleObject25')._analyticRulecontentProductId25]",
+        "version": "[variables('analyticRuleObject25').analyticRuleVersion25]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject26').analyticRuleTemplateSpecName26]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MosaicLoader_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject26')._analyticRulecontentId26]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection.",
+                "displayName": "MosaicLoader",
+                "enabled": false,
+                "query": "DeviceRegistryEvents \n| where ((ActionType == \"RegistryValueSet\") and (RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows Defender\\\\Exclusions\\\\Paths\" \nor RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Extensions\"\nor RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\"))\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceRegistryEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1562"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Name",
+                        "columnName": "RegistryValueName"
+                      },
+                      {
+                        "identifier": "Value",
+                        "columnName": "RegistryValueData"
+                      }
+                    ],
+                    "entityType": "RegistryValue"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject26').analyticRuleId26,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 26",
+                "parentId": "[variables('analyticRuleObject26').analyticRuleId26]",
+                "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject26').analyticRuleVersion26]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "MosaicLoader",
+        "contentProductId": "[variables('analyticRuleObject26')._analyticRulecontentProductId26]",
+        "id": "[variables('analyticRuleObject26')._analyticRulecontentProductId26]",
+        "version": "[variables('analyticRuleObject26').analyticRuleVersion26]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject27').analyticRuleTemplateSpecName27]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AnomalousVoulmeOfFileDeletion_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject27')._analyticRulecontentId27]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here.\nThis applies to SharePoint and OneDrive users.\nAudit event and Cloud application identifier references.\nReference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-activities?view=o365-worldwide\nReference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers",
+                "displayName": "Unusual Volume of file deletion by users",
+                "enabled": false,
+                "query": "let relevantOperations = pack_array(\"FileDeleted\", \"FileRecycled\", \"FileDeletedFirstStageRecycleBin\", \"FileDeletedSecondStageRecycleBin\", \"FileVersionsAllMinorsRecycled\", \"FileVersionRecycled\", \"FileVersionsAllRecycled\");\nlet relevantAppIds = pack_array(int(20892), int(15600)); // App Ids for SharePoint and OneDrive\nlet timeWindow = 7d;\nlet timeNow = now();\n//\nlet riskyUsers= // Look for users with risky sign-ins\n  SigninLogs    \n  | where CreatedDateTime between ((timeNow - timeWindow) .. (timeNow))\n  | where isnotempty(UserId) and isnotempty(OriginalRequestId)\n  | where ResultType == '0'\n  | where RiskLevelDuringSignIn == 'high'\n  | project UserId, RiskLevelDuringSignIn, CreatedDateTime, SessionId=OriginalRequestId\n  ;\nlet hasUsers = isnotempty(toscalar(riskyUsers));\n//\nlet deleteEvents = // look for file deletion activity and scope it to risky users\n  CloudAppEvents\n  | where hasUsers\n  | where TimeGenerated between ((timeNow - timeWindow) .. (timeNow))\n  | where ApplicationId in (relevantAppIds)\n  | where isnotempty(AccountObjectId)\n  | where AccountObjectId in (riskyUsers)\n  | where ActionType in (relevantOperations)\n  | extend SessionId= tostring(RawEventData.AppAccessContext.AADSessionId)\n  | where isnotempty(SessionId)\n  | project UserId=AccountObjectId, AccountDisplayName, ApplicationId, SessionId, ActionType, TimeGenerated, ReportId\n  ;   \n //\ndeleteEvents  \n| join kind=leftsemi riskyUsers on UserId, SessionId\n| summarize Count=count() , (Timestamp, ReportId)=arg_min(TimeGenerated, ReportId) by UserId, AccountDisplayName, ApplicationId, ActionType, Time=bin(TimeGenerated, 5m)\n// look for only those scoped users who have generated an increase in file deletion activity.\n| summarize TotalCount= countif(Count > 50), (Timestamp, ReportId)=arg_min(Timestamp, ReportId) by UserId, AccountDisplayName, ApplicationId \n| where TotalCount >= 3\n| project UserId, AccountDisplayName, ApplicationId, TotalCount, ReportId, Timestamp\n| extend NTDomain = tostring(split(AccountDisplayName,'\\\\',0)[0]), Name = tostring(split(AccountDisplayName,'\\\\',1)[0])\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "CloudAppEvents",
+                      "AADSignInEventsBeta"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  },
+                  {
+                    "dataTypes": [
+                      "SigninLogs"
+                    ],
+                    "connectorId": "AzureActiveDirectory"
+                  }
+                ],
+                "tactics": [
+                  "Impact"
+                ],
+                "techniques": [
+                  "T1485"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "AadUserId",
+                        "columnName": "UserId"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Name",
+                        "columnName": "Name"
+                      },
+                      {
+                        "identifier": "NTDomain",
+                        "columnName": "NTDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "AppId",
+                        "columnName": "ApplicationId"
+                      }
+                    ],
+                    "entityType": "CloudApplication"
+                  }
+                ],
+                "customDetails": {
+                  "Count": "TotalCount"
+                }
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject27').analyticRuleId27,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 27",
+                "parentId": "[variables('analyticRuleObject27').analyticRuleId27]",
+                "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject27').analyticRuleVersion27]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Unusual Volume of file deletion by users",
+        "contentProductId": "[variables('analyticRuleObject27')._analyticRulecontentProductId27]",
+        "id": "[variables('analyticRuleObject27')._analyticRulecontentProductId27]",
+        "version": "[variables('analyticRuleObject27').analyticRuleVersion27]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject28').analyticRuleTemplateSpecName28]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "RemoteFileCreationWithPsExec_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject28')._analyticRulecontentId28]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog.\nRyuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.\nRyuk operators use PsExec to manually spread the ransomware to other devices.\nThe following query detects remote file creation events that might indicate an active attack.\nThe See also section below lists links to other queries associated with Ryuk ransomware.\nReferences:\nhttps://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk.AA\nhttps://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/\nhttps://docs.microsoft.com/sysinternals/downloads/psexec",
+                "displayName": "Remote File Creation with PsExec",
+                "enabled": false,
+                "query": "// Find PsExec creating multiple files on remote machines in a 10-minute window\nDeviceFileEvents\n// Looking for PsExec by accepteula command flag\n| where InitiatingProcessCommandLine has \"accepteula\"\n// Remote machines and file is exe\n| where FolderPath has \"\\\\\\\\\" and FileName endswith \".exe\"\n| extend Exe = countof(InitiatingProcessCommandLine, \".exe\")\n// Checking to see if command line has 2 .exe or .bat\n| where InitiatingProcessCommandLine !has \".ps1\" and Exe > 1 or\nInitiatingProcessCommandLine has \".bat\"\n// Exclusions: Remove the following line to widen scope of AHQ\n| where not(InitiatingProcessCommandLine has_any(\"batch\", \"auditpol\",\n\"script\", \"scripts\", \"illusive\", \"rebootrequired\"))\n| summarize FileCount = dcount(FolderPath), make_set(SHA1, 100000), make_set(FolderPath, 100000),\nmake_set(FileName, 100000), make_set(InitiatingProcessCommandLine, 100000) by DeviceId, DeviceName,\nTimeWindow=bin(TimeGenerated, 10m), InitiatingProcessFileName\n| where FileCount > 4\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceFileEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "LateralMovement"
+                ],
+                "techniques": [
+                  "T1570"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject28').analyticRuleId28,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 28",
+                "parentId": "[variables('analyticRuleObject28').analyticRuleId28]",
+                "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject28').analyticRuleVersion28]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Remote File Creation with PsExec",
+        "contentProductId": "[variables('analyticRuleObject28')._analyticRulecontentProductId28]",
+        "id": "[variables('analyticRuleObject28')._analyticRulecontentProductId28]",
+        "version": "[variables('analyticRuleObject28').analyticRuleVersion28]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject29').analyticRuleTemplateSpecName29]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ServiceAccountsPerformingRemotePS_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject29')._analyticRulecontentId29]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "Service Accounts Performing Remote PowerShell.\nThe purpose behind this detection is for finding service accounts that are performing remote powershell sessions.\nThere are two phases to the detection: Identify service accounts, Find remote PS cmdlets being ran by these accounts.\nTo accomplish this, we utilize DeviceLogonEvents and DeviceEvents to find cmdlets ran that meet the criteria.\nOne of the main advantages of this method is that only requires server telemetry, and not the attacking client.\nThe first phase relies on the DeviceLogonEvents to determine whether an account is a service account or not, consider the following accounts with logons:.\nRandom_user has DeviceLogonEvents with type 2, 3, 7, 10, 11 & 13.\nRandom_service_account 'should' only have DeviceLogonEvents with type 3,4 or 5.",
+                "displayName": "Service Accounts Performing Remote PS",
+                "enabled": false,
+                "query": "let InteractiveTypes = pack_array(                                  // Declare Interactive logon type names\n    'Interactive',\n    'CachedInteractive',\n    'Unlock',\n    'RemoteInteractive',\n    'CachedRemoteInteractive',\n    'CachedUnlock'\n);\nlet WhitelistedCmdlets = pack_array(                                // List of whitelisted commands that don't provide a lot of value\n    'prompt',\n    'Out-Default',\n    'out-lineoutput',\n    'format-default',\n    'Set-StrictMode',\n    'TabExpansion2'\n);\nlet WhitelistedAccounts = pack_array('FakeWhitelistedAccount');     // List of accounts that are known to perform this activity in the environment and can be ignored\nDeviceLogonEvents                                                         // Get all logon events...\n| where AccountName !in~ (WhitelistedAccounts)                      // ...where it is not a whitelisted account...\n| where ActionType == \"LogonSuccess\"                                // ...and the logon was successful...\n| where AccountName !contains \"$\"                                   // ...and not a machine logon.\n| where AccountName !has \"winrm va_\"                                // WinRM will have pseudo account names that match this if there is an explicit permission for an admin to run the cmdlet, so assume it is good.\n| extend IsInteractive=(LogonType in (InteractiveTypes))            // Determine if the logon is interactive (True=1,False=0)...\n| summarize HasInteractiveLogon=max(IsInteractive)                  // ...then bucket and get the maximum interactive value (0 or 1)...\n            by AccountName                                          // ... by the AccountNames\n| where HasInteractiveLogon == 0                                    // ...and filter out all accounts that had an interactive logon.\n// At this point, we have a list of accounts that we believe to be service accounts\n// Now we need to find RemotePS sessions that were spawned by those accounts\n// Note that we look at all powershell cmdlets executed to form a 29-day baseline to evaluate the data on today\n| join kind=rightsemi (                                             // Start by dropping the account name and only tracking the...\n\tDeviceEvents                                                      // ...\n\t| where ActionType == 'PowerShellCommand'                         // ...PowerShell commands seen...\n\t| where InitiatingProcessFileName =~ 'wsmprovhost.exe'            // ...whose parent was wsmprovhost.exe (RemotePS Server)...\n    | extend AccountName = InitiatingProcessAccountName             // ...and add an AccountName field so the join is easier\n) on AccountName\n// At this point, we have all of the commands that were ran by service accounts\n| extend Command = tostring(extractjson('$.Command', tostring(AdditionalFields))) // Extract the actual PowerShell command that was executed\n| where Command !in (WhitelistedCmdlets)                                          // Remove any values that match the whitelisted cmdlets\n| summarize (Timestamp, ReportId)=arg_max(TimeGenerated, ReportId),               // Then group all of the cmdlets and calculate the min/max times of execution...\n    make_set(Command, 100000), count(), min(TimeGenerated) by                     // ...as well as creating a list of cmdlets ran and the count..\n    AccountName, AccountDomain, DeviceName, DeviceId                                             // ...and have the commonality be the account, DeviceName and DeviceId\n// At this point, we have machine-account pairs along with the list of commands run as well as the first/last time the commands were ran\n| order by AccountName asc                                        // Order the final list by AccountName just to make it easier to go through\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")                                           \n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceLogonEvents",
+                      "DeviceEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "LateralMovement"
+                ],
+                "techniques": [
+                  "T1210"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "AccountName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "AccountDomain"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "AccountName"
+                      }
+                    ],
+                    "entityType": "Account"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject29').analyticRuleId29,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 29",
+                "parentId": "[variables('analyticRuleObject29').analyticRuleId29]",
+                "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject29').analyticRuleVersion29]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Service Accounts Performing Remote PS",
+        "contentProductId": "[variables('analyticRuleObject29')._analyticRulecontentProductId29]",
+        "id": "[variables('analyticRuleObject29')._analyticRulecontentProductId29]",
+        "version": "[variables('analyticRuleObject29').analyticRuleVersion29]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject30').analyticRuleTemplateSpecName30]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AccountCreation_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject30')._analyticRulecontentId30]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "User accounts may be created to achieve persistence on a machine.\nRead more here: https://attack.mitre.org/wiki/Technique/T1136.\nTags: #CreateAccount.\nQuery #1: Query for users being created using \"net user\" command.\n\"net user\" commands are noisy, so needs to be joined with another signal -.\nE.g. in this example we look for use of uncommon & undocumented commandline switches (e.g. /ad instead of /add).",
+                "displayName": "Account Creation",
+                "enabled": false,
+                "query": "DeviceProcessEvents\n// Pro-tip: \n// There are many different ways to run a process from a file - e.g. by using full path, env. variables, ~1 annotation, more...\n// So, to find executions of a known filename, better filter on the filename (and possibly on folder path) than on the commandline.\n| where FileName in~ (\"net.exe\", \"net1.exe\")\n// Parse the user name from the commandline.\n// To have case-insensitive parsing use the i flag, to have non-greedy match (e.g. CreatedUser as short as possible), specify U flag:\n// \"kind=regex flags=i\"\n| parse kind=regex flags=iU ProcessCommandLine with * \"user \" CreatedUser \" \" * \"/ad\"\n// Filter rows where user could not be parsed - e.g. because it was not a user command, or the /add commandline switch was not specified.\n| where isnotempty(CreatedUser)\n// Every net.exe executed will run net1.exe with the same commandline.\n// in this where clause we remove such rows, as they duplicate the number of results we have without adding any value.\n| where not (FileName =~ \"net1.exe\" and InitiatingProcessFileName =~ \"net.exe\" and replace(\"net\", \"net1\", InitiatingProcessCommandLine) =~ ProcessCommandLine)\n// If /domain is specified, so the user is created on the domain controller.\n// Also, any prefix that's longer than 1 char will also do the same, e.g. /do, /dom, /doma, ....\n| extend CreatedOnLocalMachine=(ProcessCommandLine !contains \"/do\")\n| where ProcessCommandLine !contains \"/add\" or (CreatedOnLocalMachine == 0 and ProcessCommandLine !contains \"/domain\")\n| summarize MachineCount=dcount(DeviceName) by CreatedUser, CreatedOnLocalMachine, InitiatingProcessFileName, FileName, ProcessId, ProcessCommandLine, InitiatingProcessCommandLine, DeviceId, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Persistence"
+                ],
+                "techniques": [
+                  "T1136"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "ProcessId"
+                      },
+                      {
+                        "identifier": "CommandLine",
+                        "columnName": "ProcessCommandLine"
+                      }
+                    ],
+                    "entityType": "Process"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject30').analyticRuleId30,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 30",
+                "parentId": "[variables('analyticRuleObject30').analyticRuleId30]",
+                "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject30').analyticRuleVersion30]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Account Creation",
+        "contentProductId": "[variables('analyticRuleObject30')._analyticRulecontentProductId30]",
+        "id": "[variables('analyticRuleObject30')._analyticRulecontentProductId30]",
+        "version": "[variables('analyticRuleObject30').analyticRuleVersion30]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject31').analyticRuleTemplateSpecName31]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LocalAdminGroupChanges_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject31')._analyticRulecontentId31]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query searches for changes to the local administrators group.\nBlogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.",
+                "displayName": "Local Admin Group Changes",
+                "enabled": false,
+                "query": "let machineAccountSIDs = dynamic([\n  \"S-1-5-18\",\n  \"S-1-5-20\",\n  \"S-1-5-19\"]);\nlet ADAZUsers =  IdentityInfo \n| extend DirectoryDomain = AccountDomain \n| extend DirectoryAccount = AccountName \n| extend OnPremSid = AccountSID\n| distinct DirectoryDomain , DirectoryAccount , OnPremSid , AccountCloudSID, AccountUPN, GivenName, Surname;\n // check for any new created or modified local accounts \nlet NewUsers =  DeviceEvents\n| where ActionType contains \"UserAccountCreated\" or ActionType contains \"UserAccountModified\"\n| extend lUserAdded = AccountName\n| extend NewUserSID = AccountSid\n| extend laccountdomain = AccountDomain\n| distinct NewUserSID, lUserAdded,laccountdomain;\n// Check for any local group changes and enrich the data with the account name obtained from the previous query\nDeviceEvents \n| where ActionType == 'UserAccountAddedToLocalGroup'\n// Exclude machine and wellknown SIDs \n| where (AccountSid !in (machineAccountSIDs)) and (AccountSid matches regex @\"S-\\d-\\d+-\\d+-(\\d+-){1,5}\\d+\")\n| extend LocalGroupSID = tostring(parse_json(AdditionalFields).GroupSid)\n| extend LocalGroup = tostring(parse_json(AdditionalFields).GroupName)\n| extend AddedAccountSID = AccountSid\n| extend Actor = trim(@\"[^\\w]+\",InitiatingProcessAccountName)\n// limit to local administrators group\n// | where LocalGroupSID contains \"S-1-5-32-544\"\n| join kind=leftouter    (NewUsers)\non $left.AddedAccountSID == $right.NewUserSID\n| project TimeGenerated, DeviceName, LocalGroup,LocalGroupSID, AddedAccountSID, lUserAdded , Actor, ActionType , laccountdomain \n| join kind=innerunique  (ADAZUsers)\non $left.AddedAccountSID == $right.OnPremSid\n| extend UserAdded = iff(isnotempty(lUserAdded),strcat(laccountdomain,\"\\\\\", lUserAdded), strcat(DirectoryDomain,\"\\\\\", DirectoryAccount))\n| extend AccountName = iff(isnotempty(lUserAdded), lUserAdded, DirectoryAccount)\n| project TimeGenerated, DeviceName, LocalGroup, LocalGroupSID, AddedAccountSID, UserAdded ,Actor, ActionType, AccountName, laccountdomain  \n| where DeviceName !contains Actor\n// Provide details on actors that added users\n// | summarize count()  by Actor \n// | join ADAZUsers\n// on $left.Actor == $right.DirectoryAccount \n// | render piechart\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "IdentityInfo",
+                      "DeviceEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Persistence"
+                ],
+                "techniques": [
+                  "T1098"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "UserAdded"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "AccountName"
+                      },
+                      {
+                        "identifier": "NTDomain",
+                        "columnName": "laccountdomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject31').analyticRuleId31,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 31",
+                "parentId": "[variables('analyticRuleObject31').analyticRuleId31]",
+                "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject31').analyticRuleVersion31]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Local Admin Group Changes",
+        "contentProductId": "[variables('analyticRuleObject31')._analyticRulecontentProductId31]",
+        "id": "[variables('analyticRuleObject31')._analyticRulecontentProductId31]",
+        "version": "[variables('analyticRuleObject31').analyticRuleVersion31]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject32').analyticRuleTemplateSpecName32]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "RareProcessAsService_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject32')._analyticRulecontentId32]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query is looking for rarely seen processes which are launched as a service. Whiltelisted process list need to be updated based on the environment.\nAuthor: Jouni Mikkola\nMore info: https://threathunt.blog/rare-process-launch-as-a-service/",
+                "displayName": "Rare Process as a Service",
+                "enabled": false,
+                "query": "let LookupTime = 14d;\nlet WhiteList = pack_array(\n\"svchost.exe\",\n\"mssense.exe\",\n\"msmpeng.exe\",\n\"searchindexer.exe\",\n\"microsoftedgeupdate.exe\"\n);\nlet GetServices = materialize (\nDeviceProcessEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, StartedChildProcess = FileName, StartedChildProcessSHA1 = SHA1, StartedChildProcessCmdline = ProcessCommandLine, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName\n);\nGetServices\n| summarize count() by ServiceProcess, DeviceName\n| where count_ < 6 \n| join kind = inner GetServices on ServiceProcess, DeviceName \n| join kind = leftouter ( \nDeviceNetworkEvents \n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, NetworkAction = ActionType, RemoteIP, RemoteUrl\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| join kind = leftouter (\nDeviceFileEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, FileAction = ActionType, ModifiedFile = FileName, ModifiedFileSHA1 = SHA1, ModifiedFilePath = FolderPath\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| join kind = leftouter (\nDeviceImageLoadEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, LoadedDLL = FileName, LoadedDLLSHA1 = SHA1, LoadedDLLPath = FolderPath\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| summarize ConnectedAddresses = make_set(RemoteIP, 100000), ConnectedUrls = make_set(RemoteUrl, 100000), FilesModified = make_set(ModifiedFile, 100000),FileModFolderPath = make_set(ModifiedFilePath, 100000),FileModHA1s = make_set(ModifiedFileSHA1, 100000), ChildProcesses = make_set(StartedChildProcess, 100000), ChildCommandlines = make_set(StartedChildProcessCmdline, 100000), DLLsLoaded = make_set(LoadedDLL, 100000), DLLSHA1 = make_set(LoadedDLLSHA1, 100000) by DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P14D",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents",
+                      "DeviceNetworkEvents",
+                      "DeviceFileEvents",
+                      "DeviceImageLoadEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Persistence"
+                ],
+                "subTechniques": [
+                  "T1543.003"
+                ],
+                "techniques": [
+                  "T1543",
+                  "T1543"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "ServiceProcessID"
+                      },
+                      {
+                        "identifier": "CommandLine",
+                        "columnName": "ServiceProcessCmdline"
+                      }
+                    ],
+                    "entityType": "Process"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject32').analyticRuleId32,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 32",
+                "parentId": "[variables('analyticRuleObject32').analyticRuleId32]",
+                "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject32').analyticRuleVersion32]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Rare Process as a Service",
+        "contentProductId": "[variables('analyticRuleObject32')._analyticRulecontentProductId32]",
+        "id": "[variables('analyticRuleObject32')._analyticRulecontentProductId32]",
+        "version": "[variables('analyticRuleObject32').analyticRuleVersion32]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject33').analyticRuleTemplateSpecName33]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DisableSecurityServiceViaRegistry_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject33')._analyticRulecontentId33]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query checks for processes modifying the registry to disable security features. This is a common technique used by threat actors for defence evasion.",
+                "displayName": "Disabling Security Services via Registry",
+                "enabled": false,
+                "query": "DeviceProcessEvents\n| where InitiatingProcessCommandLine has_all(@'\"reg\"', 'add', @'\"HKLM\\SOFTWARE\\Policies\\', '/v','/t', 'REG_DWORD', '/d', '/f')\n  and InitiatingProcessCommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', \n  'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource')\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1562"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "AccountUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "AccountName"
+                      },
+                      {
+                        "identifier": "NTDomain",
+                        "columnName": "AccountDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "ProcessId"
+                      },
+                      {
+                        "identifier": "CommandLine",
+                        "columnName": "ProcessCommandLine"
+                      }
+                    ],
+                    "entityType": "Process"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject33').analyticRuleId33,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 33",
+                "parentId": "[variables('analyticRuleObject33').analyticRuleId33]",
+                "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject33').analyticRuleVersion33]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Disabling Security Services via Registry",
+        "contentProductId": "[variables('analyticRuleObject33')._analyticRulecontentProductId33]",
+        "id": "[variables('analyticRuleObject33')._analyticRulecontentProductId33]",
+        "version": "[variables('analyticRuleObject33').analyticRuleVersion33]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject34').analyticRuleTemplateSpecName34]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DataDeletionOnMulipleDrivesUsingCipherExe_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject34')._analyticRulecontentId34]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption.",
+                "displayName": "Deletion of data on multiple drives using cipher exe",
+                "enabled": false,
+                "query": "// Look for cipher.exe deleting data from multiple drives\nDeviceProcessEvents\n| where FileName =~ \"cipher.exe\" \n// cipher.exe /w flag used for deleting data \n| where ProcessCommandLine has \"/w\" \n| summarize CipherCount = dcount(ProcessCommandLine), CipherList = make_set(ProcessCommandLine, 1000) by DeviceId, DeviceName, bin(TimeGenerated, 1m) \n// cipher.exe accessing multiple drives in a short timeframe  \n| where CipherCount > 1\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Impact"
+                ],
+                "techniques": [
+                  "T1485"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject34').analyticRuleId34,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 34",
+                "parentId": "[variables('analyticRuleObject34').analyticRuleId34]",
+                "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject34').analyticRuleVersion34]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Deletion of data on multiple drives using cipher exe",
+        "contentProductId": "[variables('analyticRuleObject34')._analyticRulecontentProductId34]",
+        "id": "[variables('analyticRuleObject34')._analyticRulecontentProductId34]",
+        "version": "[variables('analyticRuleObject34').analyticRuleVersion34]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject35').analyticRuleTemplateSpecName35]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LaZagneCredTheft_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject35')._analyticRulecontentId35]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "LaZagne is a popular open-source tool used to recover passwords stored on a local computer. It has been used in ransomware attacks to steal credentials and escalate privileges. This query looks for the execution of LaZagne.",
+                "displayName": "LaZagne Credential Theft",
+                "enabled": false,
+                "query": "DeviceProcessEvents \n| where FileName =~ 'reg.exe'\n| where ProcessCommandLine has_all('save','hklm','sam')\n| project DeviceId, DeviceName, TimeGenerated, InitiatingProcessId, InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "CredentialAccess"
+                ],
+                "techniques": [
+                  "T1003"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "ProcessId"
+                      },
+                      {
+                        "identifier": "CommandLine",
+                        "columnName": "ProcessCommandLine"
+                      }
+                    ],
+                    "entityType": "Process"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject35').analyticRuleId35,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 35",
+                "parentId": "[variables('analyticRuleObject35').analyticRuleId35]",
+                "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject35').analyticRuleVersion35]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "LaZagne Credential Theft",
+        "contentProductId": "[variables('analyticRuleObject35')._analyticRulecontentProductId35]",
+        "id": "[variables('analyticRuleObject35')._analyticRulecontentProductId35]",
+        "version": "[variables('analyticRuleObject35').analyticRuleVersion35]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject36').analyticRuleTemplateSpecName36]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LogDeletionUsingWevtutil_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject36')._analyticRulecontentId36]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query checks for attempts to clear at least 10 log entries from event logs using wevtutil. Clearing event logs can be a sign of ransomware activity, as ransomware often attempts to cover its tracks by deleting logs.",
+                "displayName": "Clearing of forensic evidence from event logs using wevtutil",
+                "enabled": false,
+                "query": "// Look for use of wevtutil to clear multiple logs\nDeviceProcessEvents\n| where ProcessCommandLine has \"WEVTUTIL\" and ProcessCommandLine has \"CL\"\n| summarize LogClearCount = dcount(tostring(ProcessCommandLine)), ClearedLogList = make_set(ProcessCommandLine, 100000) by DeviceId, DeviceName, bin(TimeGenerated, 5m)\n| where LogClearCount > 10\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1070"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject36').analyticRuleId36,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 36",
+                "parentId": "[variables('analyticRuleObject36').analyticRuleId36]",
+                "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject36').analyticRuleVersion36]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Clearing of forensic evidence from event logs using wevtutil",
+        "contentProductId": "[variables('analyticRuleObject36')._analyticRulecontentProductId36]",
+        "id": "[variables('analyticRuleObject36')._analyticRulecontentProductId36]",
+        "version": "[variables('analyticRuleObject36').analyticRuleVersion36]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject37').analyticRuleTemplateSpecName37]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MultiProcessKillWithTaskKill_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject37')._analyticRulecontentId37]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. This is a common technique used by ransomware to stop security products and other processes.",
+                "displayName": "Stopping multiple processes using taskkill",
+                "enabled": false,
+                "query": "// Find attempts to stop processes using taskkill.exe\nDeviceProcessEvents\n| where FileName =~ \"taskkill.exe\" \n| summarize taskKillCount = dcount(ProcessCommandLine), TaskKillList = make_set(ProcessCommandLine, 10000) by DeviceId, DeviceName, bin(TimeGenerated, 2m)\n| where taskKillCount > 10\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion"
+                ],
+                "techniques": [
+                  "T1562"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject37').analyticRuleId37,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 37",
+                "parentId": "[variables('analyticRuleObject37').analyticRuleId37]",
+                "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject37').analyticRuleVersion37]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Stopping multiple processes using taskkill",
+        "contentProductId": "[variables('analyticRuleObject37')._analyticRulecontentProductId37]",
+        "id": "[variables('analyticRuleObject37')._analyticRulecontentProductId37]",
+        "version": "[variables('analyticRuleObject37').analyticRuleVersion37]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject38').analyticRuleTemplateSpecName38]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PotentialCobaltStrikeRansomwareActivity_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject38')._analyticRulecontentId38]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns. It looks for alerts that indicate potential ransomware activity, such as attempts to clear security event logs, delete backup files, and execute Cobalt Strike malware.",
+                "displayName": "Potential Ransomware activity related to Cobalt Strike",
+                "enabled": false,
+                "query": "// Look for sc.exe disabling services\nAlertInfo \n// Attempts to clear security event logs. \n| where Title in(\"Event log was cleared\", \n// List alerts flagging attempts to delete backup files. \n\"File backups were deleted\", \n// Potential Cobalt Strike activity - Note that other threat activity can also \n// trigger alerts for suspicious decoded content \n\"Suspicious decoded content\", \n// Cobalt Strike activity \n\"\\'Atosev\\' malware was detected\", \n\"\\'Ploty\\' malware was detected\", \n\"\\'Bynoco\\' malware was detected\",\n\"\\'Cobaltstrike\\' malware was detected\",\n\"Echo command over pipe on localhost\",\n\"Known attack framework activity was observed\",\n\"An active \\'Cobaltstrike\\' malware was detected\",\n\"Suspicious \\'CobaltStrike\\' behavior was prevented\",\n\"Suspicious process launch by Rundll32.exe\") \n| extend AlertTime = TimeGenerated | distinct AlertTime, AlertId, Title \n| join AlertEvidence on $left.AlertId == $right.AlertId\n| summarize by DeviceId, AlertTime, Title, AlertId\n// Get device IDs\n| join DeviceLogonEvents on $left.DeviceId == $right.DeviceId \n// Creating 10 day Window surrounding alert activity \n| where TimeGenerated < AlertTime + 12h and TimeGenerated > AlertTime - 12h // Projecting specific columns \n| project Title, DeviceName, DeviceId, TimeGenerated, LogonType, AccountDomain, AccountName, AccountSid, AlertTime, AlertId, RemoteIP, RemoteDeviceName\n| extend AccountFullName = tostring(strcat(AccountDomain, \"\\\\\", AccountName))\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "P1D",
+                "queryPeriod": "P1D",
+                "severity": "High",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "AlertInfo",
+                      "AlertEvidence",
+                      "DeviceLogonEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Execution",
+                  "Persistence",
+                  "DefenseEvasion",
+                  "Impact"
+                ],
+                "techniques": [
+                  "T1059",
+                  "T1078",
+                  "T1070",
+                  "T1490"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "AccountFullName"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "AccountName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "AccountDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "Address",
+                        "columnName": "RemoteIP"
+                      }
+                    ],
+                    "entityType": "IP"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject38').analyticRuleId38,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 38",
+                "parentId": "[variables('analyticRuleObject38').analyticRuleId38]",
+                "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject38').analyticRuleVersion38]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Potential Ransomware activity related to Cobalt Strike",
+        "contentProductId": "[variables('analyticRuleObject38')._analyticRulecontentProductId38]",
+        "id": "[variables('analyticRuleObject38')._analyticRulecontentProductId38]",
+        "version": "[variables('analyticRuleObject38').analyticRuleVersion38]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject39').analyticRuleTemplateSpecName39]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "QakbotDiscoveryActivities_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject39')._analyticRulecontentId39]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances. It looks for discovery commands such as net.exe, whoami.exe, nslookup.exe, netstat.exe, arp.exe, and ping.exe.",
+                "displayName": "Qakbot Discovery Activies",
+                "enabled": false,
+                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName in~('mobsync.exe','explorer.exe')\n| where (FileName =~ 'net.exe' and InitiatingProcessCommandLine has_all('view','/all'))\n     or (FileName =~ 'whoami.exe' and InitiatingProcessCommandLine has '/all')\n     or (FileName =~ 'nslookup.exe' and InitiatingProcessCommandLine has_all('querytype=ALL','timeout=10'))\n     or (FileName =~ 'netstat.exe' and InitiatingProcessCommandLine has '-nao')\n     or (FileName =~ 'arp.exe' and InitiatingProcessCommandLine has '-a')\n     or (FileName =~ 'ping.exe' and InitiatingProcessCommandLine has '-t' and InitiatingProcessCommandLine endswith '127.0.0.1')\n| summarize DiscoveryCommands = dcount(InitiatingProcessCommandLine), make_set(InitiatingProcessFileName), make_set(FileName), make_set(InitiatingProcessCommandLine) by DeviceId, DeviceName, bin(TimeGenerated, 5m)   \n| where DiscoveryCommands >= 3\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "DefenseEvasion",
+                  "Discovery",
+                  "Execution"
+                ],
+                "techniques": [
+                  "T1140",
+                  "T1010",
+                  "T1059"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject39').analyticRuleId39,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 39",
+                "parentId": "[variables('analyticRuleObject39').analyticRuleId39]",
+                "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject39').analyticRuleVersion39]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Qakbot Discovery Activies",
+        "contentProductId": "[variables('analyticRuleObject39')._analyticRulecontentProductId39]",
+        "id": "[variables('analyticRuleObject39')._analyticRulecontentProductId39]",
+        "version": "[variables('analyticRuleObject39').analyticRuleVersion39]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('analyticRuleObject40').analyticRuleTemplateSpecName40]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ShadowCopyDeletion_AnalyticalRules Analytics Rule with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+              "name": "[variables('analyticRuleObject40')._analyticRulecontentId40]",
+              "apiVersion": "2023-02-01-preview",
+              "kind": "Scheduled",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "description": "This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors.\nThis query detects know commands that have been used by the ransomware actors.\nSome information from Mitre Attack: \nhttps://attack.mitre.org/techniques/T1490/",
+                "displayName": "Shadow Copy Deletions",
+                "enabled": false,
+                "query": "let CommonRansomwareExecutionCommands = dynamic([@'vssadmin.exe delete shadows /all /quiet', \n@'wmic.exe shadowcopy delete', @'wbadmin delete catalog -quiet', \n@'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}',\n@'del /s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk', \n@'wbadmin delete systemstatebackup -keepVersions:0', \n@'schtasks.exe /Change /TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" /disable', \n@'schtasks.exe /Change /TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" /enable >nul 2>&1', \n@'reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /f >nul 2>&1']);\nDeviceProcessEvents\n| where ProcessCommandLine has_any (CommonRansomwareExecutionCommands)\n| project-reorder TimeGenerated, ProcessCommandLine, DeviceName, AccountName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")\n",
+                "queryFrequency": "PT1H",
+                "queryPeriod": "PT1H",
+                "severity": "Medium",
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "status": "Available",
+                "requiredDataConnectors": [
+                  {
+                    "dataTypes": [
+                      "DeviceProcessEvents"
+                    ],
+                    "connectorId": "MicrosoftThreatProtection"
+                  }
+                ],
+                "tactics": [
+                  "Impact"
+                ],
+                "techniques": [
+                  "T1490"
+                ],
+                "entityMappings": [
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "DeviceName"
+                      },
+                      {
+                        "identifier": "HostName",
+                        "columnName": "HostName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "DnsDomain"
+                      }
+                    ],
+                    "entityType": "Host"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "FullName",
+                        "columnName": "AccountUpn"
+                      },
+                      {
+                        "identifier": "Name",
+                        "columnName": "AccountName"
+                      },
+                      {
+                        "identifier": "DnsDomain",
+                        "columnName": "AccountDomain"
+                      }
+                    ],
+                    "entityType": "Account"
+                  },
+                  {
+                    "fieldMappings": [
+                      {
+                        "identifier": "ProcessId",
+                        "columnName": "ProcessId"
+                      },
+                      {
+                        "identifier": "CommandLine",
+                        "columnName": "ProcessCommandLine"
+                      }
+                    ],
+                    "entityType": "Process"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject40').analyticRuleId40,'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Analytics Rule 40",
+                "parentId": "[variables('analyticRuleObject40').analyticRuleId40]",
+                "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]",
+                "kind": "AnalyticsRule",
+                "version": "[variables('analyticRuleObject40').analyticRuleVersion40]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]",
+        "contentKind": "AnalyticsRule",
+        "displayName": "Shadow Copy Deletions",
+        "contentProductId": "[variables('analyticRuleObject40')._analyticRulecontentProductId40]",
+        "id": "[variables('analyticRuleObject40')._analyticRulecontentProductId40]",
+        "version": "[variables('analyticRuleObject40').analyticRuleVersion40]"
+      },
+      "condition": "[parameters('DeployAnalyticsRule')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Appspot Phishing Abuse_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_1",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Appspot Phishing Abuse",
+                "category": "Hunting Queries",
+                "query": "EmailUrlInfo\n// Detect URLs with a subdomain on appspot.com\n| where UrlDomain matches regex @'\\b[\\w\\-]+-dot-[\\w\\-\\.]+\\.appspot\\.com\\b'\n// Enrich results with sender and recipient data\n| join kind=inner EmailEvents on $left.NetworkMessageId==$right.NetworkMessageId\n// Phishing attempts from Appspot related campaigns typically contain the recipient's email address in the URI\n// Example 1: https://example-dot-example.appspot.com/#recipient@domain.com\n// Example 2: https://example-dot-example.appspot.com/index.html?user=recipient@domain.com\n| where Url has RecipientEmailAddress\n    // Some phishing campaigns pass recipient email as a Base64 encoded string in the URI\n    or Url has base64_encode_tostring(RecipientEmailAddress)\n| project-away NetworkMessageId1, ReportId1, Type1, TimeGenerated1, Timestamp1\n| extend Name = tostring(split(SenderFromAddress, '@', 0)[0]), UPNSuffix = tostring(split(SenderFromAddress, '@', 1)[0])\n| extend Account_0_Name = Name\n| extend Account_0_UPNSuffix = UPNSuffix\n| extend IP_0_Address = SenderIPv4\n| extend URL_0_Url = Url\n| extend MailBox_0_MailboxPrimaryAddress = RecipientEmailAddress\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps surface phishing campaigns associated with Appspot abuse.These emails frequently contain phishing links that utilize the recipients' own email address as a unique identifier in the URI.\nThis campaign was published on Twitter by @MsftSecIntel at this link: https://twitter.com/MsftSecIntel/status/1374148156301004800\nReference - https://twitter.com/MsftSecIntel/status/1374148156301004800"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 1",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]",
+                "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject1').huntingQueryVersion1]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Appspot Phishing Abuse",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PayloadDropUsingCertUtil_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_2",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Dropping Payload via certutil",
+                "category": "Hunting Queries",
+                "query": "DeviceFileEvents\n| where InitiatingProcessFileName !~ \"certutil.exe\"\n| where InitiatingProcessFileName !~ \"cmd.exe\"\n| where InitiatingProcessCommandLine has_all(\"-urlcache\", \"split\", \"http\")\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "BazaCall campaign tricks users into calling a fake customer support center, and download a malicious Excel file which contains a macro to infect users' device with BazaLoader. This query searches for a copy of certutil.exe used by the macro."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 2",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]",
+                "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject2').huntingQueryVersion2]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Dropping Payload via certutil",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "JudgementPandaExfilActivity_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_3",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Judgement Panda Exfil Activity",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where ProcessCommandLine has @\"\\ldifde.exe -f -n \"\n     or ProcessCommandLine has @\"\\7za.exe a 1.7z \" \n     or ProcessCommandLine endswith @\" eprod.ldf\" \n     or ProcessCommandLine has @\"\\aaaa\\procdump64.exe\" \n     or ProcessCommandLine has @\"\\aaaa\\netsess.exe\" \n     or ProcessCommandLine has @\"\\aaaa\\7za.exe\" \n     or ProcessCommandLine has @\"copy .\\1.7z \\\" \n     or ProcessCommandLine has @\"copy \\client\\c$\\aaaa\\\" \n     or FolderPath == @\"C:\\Users\\Public\\7za.exe\"\n| top 100 by TimeGenerated desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml.\nQuestions via Twitter: @janvonkirchheim."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1560"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 3",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]",
+                "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject3').huntingQueryVersion3]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Judgement Panda Exfil Activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DeimosComponentExecution_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_4",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Deimos Component Execution",
+                "category": "Hunting Queries",
+                "query": "DeviceEvents   \n| where InitiatingProcessFileName =~ \"powershell.exe\"\n| where ActionType == \"AmsiScriptContent\"\n| where AdditionalFields endswith '[mArS.deiMos]::inteRaCt()\"}'\n| project InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, AdditionalFields\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,Collection,Exfiltration,Impact"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 4",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]",
+                "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject4').huntingQueryVersion4]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Deimos Component Execution",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LemonDuckRegistrationFunction_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_5",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "LemonDuck Registration Function",
+                "category": "Hunting Queries",
+                "query": "DeviceEvents\n| where ActionType == \"PowerShellCommand\"\n| where AdditionalFields =~ \"{\\\"Command\\\":\\\"SIEX\\\"}\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "LemonDuck is a malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,Persistence,LateralMovement,CommandAndControl"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 5",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]",
+                "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject5').huntingQueryVersion5]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+        "contentKind": "HuntingQuery",
+        "displayName": "LemonDuck Registration Function",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject6').huntingQueryTemplateSpecName6]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DeviceWithLog4jAlerts_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_6",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Devices with Log4j vulnerability alerts and additional other alert related context",
+                "category": "Hunting Queries",
+                "query": "// Get any devices with Log4J related Alert Activity\nlet DevicesLog4JAlerts = AlertInfo\n| where Title in~('Suspicious script launched',\n'Exploitation attempt against Log4j (CVE-2021-44228)',\n'Suspicious process executed by a network service',\n'Possible target of Log4j exploitation (CVE-2021-44228)',\n'Possible target of Log4j exploitation',\n'Possible Log4j exploitation',\n'Network connection seen in CVE-2021-44228 exploitation',\n'Log4j exploitation detected',\n'Possible exploitation of CVE-2021-44228',\n'Possible target of Log4j vulnerability (CVE-2021-44228) scanning',\n'Possible source of Log4j exploitation'\n'Log4j exploitation attempt via cloud application', // Previously titled Exploitation attempt against Log4j\n'Log4j exploitation attempt via email' // Previously titled Log4j Exploitation Attempt\n)\n// Join in evidence information\n| join kind=innerunique AlertEvidence on AlertId\n| where DeviceId != \"\"\n| summarize by DeviceId, Title;\n// Get additional alert activity for each device\nAlertEvidence\n| where DeviceId in(DevicesLog4JAlerts)\n// Add additional info\n| join kind=leftouter AlertInfo on AlertId\n| summarize DeviceAlerts = make_set(Title, 100000), AlertIDs = make_set(AlertId, 100000) by DeviceId, bin(TimeGenerated, 1d)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 6",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6)]",
+                "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject6').huntingQueryVersion6]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Devices with Log4j vulnerability alerts and additional other alert related context",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject7').huntingQueryTemplateSpecName7]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Log4jVulnRelatedAlerts_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_7",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Alerts Related to Log4j Vulnerability",
+                "category": "Hunting Queries",
+                "query": "AlertInfo\n| where Title in~('Suspicious script launched',\n'Exploitation attempt against Log4j (CVE-2021-44228)',\n'Suspicious process executed by a network service',\n'Possible target of Log4j exploitation (CVE-2021-44228)',\n'Possible target of Log4j exploitation',\n'Possible Log4j exploitation',\n'Network connection seen in CVE-2021-44228 exploitation',\n'Log4j exploitation detected',\n'Possible exploitation of CVE-2021-44228',\n'Possible target of Log4j vulnerability (CVE-2021-44228) scanning',\n'Possible source of Log4j exploitation',\n'Log4j exploitation attempt via cloud application', // Previously titled Exploitation attempt against Log4j\n'Log4j exploitation attempt via email' // Previously titled Log4j Exploitation Attempt\n)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Microsoft has observed attackers exploiting vulnerabilities associated with Log4J."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 7",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7)]",
+                "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject7').huntingQueryVersion7]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Alerts Related to Log4j Vulnerability",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject8').huntingQueryTemplateSpecName8]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ImminentRansomware_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_8",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Imminent Ransomware",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n// Pivot on specific commands \n| where ProcessCommandLine has_any(\"-ExclusionPath\", \"Set-MpPreference\", \"advfirewall\", \"-ExclusionExtension\", \n\"-EnableControlledFolderAccess\", \"windefend\", \"onstart\", \"bcdedit\", \"Startup\") \n// Making list of found commands \n| summarize ProcessCommandLine = make_set(ProcessCommandLine, 10000) by DeviceId, bin(TimeGenerated, 6h) \n// Extending columns for later aggregration, based on TTP \n| extend StartUpExclusionPath = iff(ProcessCommandLine has_all(\"-ExclusionPath\", \"Startup\"), 1, 0) \n| extend DefenderTamp = iff(ProcessCommandLine has \"Set-MpPreference\" \nand ProcessCommandLine has_any( \n\"-SevereThreatDefaultAction 6\" \n\"-HighThreatDefaultAction 6\", \n\"-ModerateThreatDefaultAction 6\", \n\"-LowThreatDefaultAction 6\" \n\"-ScanScheduleDay 8\"), 1, 0) \n| extend NetshFirewallTampering = iff(ProcessCommandLine has_all( \"netsh\", \"advfirewall\", \"allprofiles state off\"), 1, 0) \n| extend BatExclusion = iff(ProcessCommandLine has_all(\"-ExclusionExtension\", \".bat\"), 1, 0) \n| extend ExeExclusion = iff(ProcessCommandLine has_all(\"-ExclusionExtension\", \".exe\"), 1, 0) \n| extend DisableControlledFolderAccess = iff(ProcessCommandLine has_all(\"-EnableControlledFolderAccess\", \"Disabled\"), 1, 0) \n| extend ScDeleteDefend = iff(ProcessCommandLine has_all(\"sc\", \"delete\", \"windefend\"), 1, 0) \n| extend BootTampering = iff(ProcessCommandLine has_all(\"bcdedit\", \"default\") and ProcessCommandLine has_any (\"recoveryenabled No\", \"bootstatuspolicy ignoreallfailures\"), 1, 0) \n| extend SchTasks = iff(ProcessCommandLine has_all(\"/sc\", \"onstart\", \"system\", \"/create\", \"/delay\"), 1, 0) \n// Summarizing found commands \n| summarize by NetshFirewallTampering ,BatExclusion, ExeExclusion, DisableControlledFolderAccess, ScDeleteDefend, SchTasks, BootTampering, DefenderTamp, StartUpExclusionPath, DeviceId, TimeGenerated \n// Adding up each piece of evidence \n| extend EvidenceCount = NetshFirewallTampering + BatExclusion + ExeExclusion + DisableControlledFolderAccess + ScDeleteDefend + SchTasks + BootTampering + DefenderTamp + StartUpExclusionPath \n| where EvidenceCount > 4\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Before deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 8",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8)]",
+                "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject8').huntingQueryVersion8]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Imminent Ransomware",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject9').huntingQueryTemplateSpecName9]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MaliciousUseOfMSBuildAsLoLBin_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_9",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious Use of MSBuild as LOLBin",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName =~ \"wmiprvse.exe\" \n| where FileName =~ \"msbuild.exe\" and ProcessCommandLine has \"programdata\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CommandAndControl"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 9",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9)]",
+                "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject9').huntingQueryVersion9]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious Use of MSBuild as LOLBin",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject10').huntingQueryTemplateSpecName10]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "QakbotReconActivities_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_10",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Qakbot Reconnaissance Activities",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where InitiatingProcessFileName == InitiatingProcessCommandLine\n| where ProcessCommandLine has_any (\n\"whoami /all\",\"cmd /c set\",\"arp -a\",\"ipconfig /all\",\"net view /all\",\"nslookup -querytype=ALL -timeout=10\",\n\"net share\",\"route print\",\"netstat -nao\",\"net localgroup\")\n| summarize dcount(FileName), make_set(ProcessCommandLine, 10000) by DeviceId,bin(TimeGenerated, 1d), InitiatingProcessFileName, InitiatingProcessCommandLine\n| where dcount_FileName >= 8\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for reconnaissance and beaconing activities after code injection occurs in Qakbot infections."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Discovery"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 10",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10)]",
+                "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject10').huntingQueryVersion10]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Qakbot Reconnaissance Activities",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject11').huntingQueryTemplateSpecName11]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "RobbinhoodDriver_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject11').huntingQueryVersion11]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_11",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Robbinhood Driver",
+                "category": "Hunting Queries",
+                "query": "DeviceFileEvents\n| where TimeGenerated > ago(7d)\n| where SHA1 in('0b15b5cc64caf0c6ad9bd759eb35383b1f718edf3d7ab4cd912d0d8c1826edf8',\n'31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427')\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query detects the presence of the Robbinhood ransomware driver."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 11",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11)]",
+                "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject11').huntingQueryVersion11]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Robbinhood Driver",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject12').huntingQueryTemplateSpecName12]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Snip3MaliciousNetworkConnectivity_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject12').huntingQueryVersion12]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_12",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Snip3 Malicious Network Connectivity",
+                "category": "Hunting Queries",
+                "query": "DeviceNetworkEvents \n| where InitiatingProcessFileName in~ (\"RegSvcs.exe\",\"RegAsm.exe\", \"InstallUtil.exe\") \n| where InitiatingProcessCommandLine in~ (\"\\\"RegAsm.exe\\\"\",\"\\\"RegSvcs.exe\\\"\",\"\\\"InstallUtil.exe\\\"\") \n| where InitiatingProcessParentFileName endswith \"powershell.exe\" \n  or InitiatingProcessParentFileName endswith \"powershell_ise.exe\" \n  or InitiatingProcessParentFileName endswith \"pwsh.exe\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query looks for potentially hollowed processes that may be used to facilitate command-and-control or exfiltration by Snip3 malware."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CommandAndControl,Exfiltration"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 12",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12)]",
+                "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject12').huntingQueryVersion12]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Snip3 Malicious Network Connectivity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject13').huntingQueryTemplateSpecName13]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MaliciousCMDExecutionByJava_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject13').huntingQueryVersion13]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_13",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Java Executing cmd to run Powershell",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents                         \n| where InitiatingProcessFileName == 'java.exe' and FileName == 'cmd.exe' \nand ProcessCommandLine has_all('powershell iex','DownloadString')\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query finds instances of the Java process being used to execute cmd.exe, and download and execute a PowerShell script."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 13",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13)]",
+                "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject13').huntingQueryVersion13]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Java Executing cmd to run Powershell",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject14').huntingQueryTemplateSpecName14]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Check for spoofing attempts on the domain with Authentication failures_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject14').huntingQueryVersion14]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_14",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spoofing attempts from Specific Domains",
+                "category": "Hunting Queries",
+                "query": "// Add the list of domains to search for.\nlet DomainList = dynamic([\"contoso.com\"]); \nEmailEvents \n| where TimeGenerated > ago (1d) and DetectionMethods has \"spoof\" and SenderFromDomain in~ (DomainList)\n| project TimeGenerated, AR=parse_json(AuthenticationDetails) , NetworkMessageId, EmailDirection, Subject, SenderFromAddress, SenderIPv4, ThreatTypes, DetectionMethods, ThreatNames  \n| evaluate bag_unpack(AR)  \n| where column_ifexists('SPF','') =~ \"fail\" or  column_ifexists('DMARC','') =~ \"fail\" or column_ifexists('DKIM','') =~ \"fail\" or column_ifexists('CompAuth','') =~ \"fail\"\n| extend Name = tostring(split(SenderFromAddress, '@', 0)[0]), UPNSuffix = tostring(split(SenderFromAddress, '@', 1)[0])\n| extend Account_0_Name = Name\n| extend Account_0_UPNSuffix = UPNSuffix\n| extend IP_0_Address = SenderIPv4\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query identifies potential phishing or spoofing attempts originating from specific domains with authentication failures."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 14",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14)]",
+                "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject14').huntingQueryVersion14]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spoofing attempts from Specific Domains",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '1.1.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '1.1.1')))]",
+        "version": "1.1.1"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject15').huntingQueryTemplateSpecName15]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "C2-NamedPipe_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject15').huntingQueryVersion15]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_15",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "C2-NamedPipe",
+                "category": "Hunting Queries",
+                "query": "// maximum lookback time\nlet minTimeRange = ago(7d);\n// this is what should be constantly tweaked with default C2 framework names, search uses has_any (wildcard)\nlet badPipeNames = pack_array(\n    '\\\\psexec',                                     // PSexec default pipe\n    '\\\\paexec',                                     // PSexec default pipe\n    '\\\\remcom',                                     // PSexec default pipe\n    '\\\\csexec',                                     // PSexec default pipe\n    '\\\\isapi_http',                                 // Uroburos Malware Named Pipe\n    '\\\\isapi_dg',                                   // Uroburos Malware Named Pipe\n    '\\\\isapi_dg2',                                  // Uroburos Malware Named Pipe\n    '\\\\sdlrpc',                                     // Cobra Trojan Named Pipe http://goo.gl/8rOZUX\n    '\\\\ahexec',                                     // Sofacy group malware\n    '\\\\winsession',                                 // Wild Neutron APT malware https://goo.gl/pivRZJ\n    '\\\\lsassw',                                     // Wild Neutron APT malware https://goo.gl/pivRZJ\n    '\\\\46a676ab7f179e511e30dd2dc41bd388',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\9f81f59bc58452127884ce513865ed20',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\e710f28d59aa529d6792ca6ff0ca1b34',           // Project Sauron https://goo.gl/eFoP4A\n    '\\\\rpchlp_3',                                   // Project Sauron https://goo.gl/eFoP4A - Technical Analysis Input\n    '\\\\NamePipe_MoreWindows',                       // Cloud Hopper Annex B https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, US-CERT Alert - RedLeaves https://www.us-cert.gov/ncas/alerts/TA17-117A\n    '\\\\pcheap_reuse',                               // Pipe used by Equation Group malware 77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0\n    '\\\\gruntsvc',                                   // Covenant default named pipe\n    '\\\\583da945-62af-10e8-4902-a8f205c72b2e',       // SolarWinds SUNBURST malware report https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\n    '\\\\bizkaz',                                     // Snatch Ransomware https://thedfirreport.com/2020/06/21/snatch-ransomware/\n    '\\\\atctl',                                      // https://www.virustotal.com/#/file/a4ddb2664a6c87a1d3c5da5a5a32a5df9a0b0c8f2e951811bd1ec1d44d42ccf1/detection\n    '\\\\userpipe',                                   // ruag apt case\n    '\\\\iehelper',                                   // ruag apt case\n    '\\\\sdlrpc',                                     // project cobra https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    '\\\\comnap',                                     // https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    '\\\\lsadump',                                    // Cred Dump-Tools Named Pipes\n    '\\\\cachedump',                                  // Cred Dump-Tools Named Pipes\n    '\\\\wceservicepipe',                             // Cred Dump-Tools Named Pipes\n    '\\\\jaccdpqnvbrrxlaf',                           // PoshC2 default named pipe\n    '\\\\svcctl',                                     // CrackMapExec default named pipe\n    '\\\\csexecsvc'                                   // CSEXEC default named pipe\n    '\\\\status_',                                    // CS default named pipes https://github.com/Neo23x0/sigma/issues/253\n    '\\\\MSSE-',                                      // CobaltStrike default named pipe\n    '\\\\status_',                                    // CobaltStrike default named pipe\n    '\\\\msagent_',                                   // (target) CobaltStrike default named pipe\n    '\\\\postex_ssh_',                                // CobaltStrike default named pipe\n    '\\\\postex_',                                    // CobaltStrike default named pipe\n    '\\\\Posh'                                        // PoshC2 default named pipe\n);\nDeviceEvents\n| where ActionType == \"NamedPipeEvent\" and Timestamp > minTimeRange\n| extend ParsedFields=parse_json(AdditionalFields)\n| where ParsedFields.FileOperation == \"File created\"\n| where ParsedFields.PipeName has_any (badPipeNames)\n| project TimeGenerated, ActionType, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, ParsedFields.FileOperation, ParsedFields.PipeName\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Detects the creation of a named pipe used by known APT malware.\nReference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CommandAndControl"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 15",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15)]",
+                "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject15').huntingQueryVersion15]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
+        "contentKind": "HuntingQuery",
+        "displayName": "C2-NamedPipe",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject16').huntingQueryTemplateSpecName16]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ReconWithRundll_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject16').huntingQueryVersion16]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_16",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Recon with Rundll",
+                "category": "Hunting Queries",
+                "query": "DeviceNetworkEvents\n| where InitiatingProcessFileName =~ \"rundll32.exe\"\n// Empty command line\n| where InitiatingProcessCommandLine has \"rundll32.exe\" and InitiatingProcessCommandLine !contains \" \" \nand InitiatingProcessCommandLine != \"\" \n| summarize DestinationIPCount = dcount(RemoteIP), make_set(RemoteIP, 100000), make_set(RemoteUrl, 100000), \nmake_set(RemotePort, 100000) by InitiatingProcessCommandLine, DeviceId, bin(TimeGenerated, 5m)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query detects suspicious rundll.exe activity associated with Trickbot campaigns."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Discovery,Collection,CommandAndControl"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 16",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16)]",
+                "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject16').huntingQueryVersion16]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Recon with Rundll",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject17').huntingQueryTemplateSpecName17]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DoppelPaymerProcdump_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject17').huntingQueryVersion17]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_17",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "DopplePaymer Procdump",
+                "category": "Hunting Queries",
+                "query": "// Dumping of LSASS memory using procdump\nDeviceProcessEvents\n| where TimeGenerated > ago(7d)\n// Command lines that include \"lsass\" and -accepteula or -ma flags used in procdump\n| where (ProcessCommandLine has \"lsass\" and (ProcessCommandLine has \"-accepteula\" or\nProcessCommandLine contains \"-ma\"))\n// Omits possible FPs where the full command is just \"procdump.exe lsass\"\nor (FileName in~ ('procdump.exe','procdump64.exe') and ProcessCommandLine has 'lsass')\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Detects the use of ProcDump to dump credentials from LSASS memory by DoppelPaymer ransomware operators."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CredentialAccess"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 17",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17)]",
+                "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject17').huntingQueryVersion17]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
+        "contentKind": "HuntingQuery",
+        "displayName": "DopplePaymer Procdump",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject18').huntingQueryTemplateSpecName18]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LaZagne_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject18').huntingQueryVersion18]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_18",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Credential Harvesting Using LaZagne",
+                "category": "Hunting Queries",
+                "query": "// Find credential theft via SAM database export by LaZagne\nDeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where FileName =~ 'reg.exe'\n    and ProcessCommandLine has 'save'\n    and ProcessCommandLine has 'hklm'\n    and ProcessCommandLine has 'sam'\n| project DeviceId, TimeGenerated, InitiatingProcessId,\nInitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Detects the use of LaZagne to steal credentials from the SAM database by Ryuk ransomware operators."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CredentialAccess"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject18')._huntingQuerycontentId18),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 18",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject18')._huntingQuerycontentId18)]",
+                "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject18').huntingQueryVersion18]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Credential Harvesting Using LaZagne",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject18')._huntingQuerycontentId18,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject19').huntingQueryTemplateSpecName19]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LSASSCredDumpProcdump_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject19').huntingQueryVersion19]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_19",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "LSASS Credential Dumping with Procdump",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where (FileName has_any (\"procdump.exe\", \"procdump64.exe\") and ProcessCommandLine has \"lsass\") or \n// Looking for Accepteula flag or Write a dump file with all process memory\n(ProcessCommandLine has \"lsass.exe\" and (ProcessCommandLine has \"-accepteula\" or ProcessCommandLine contains \"-ma\"))\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Detects the use of Procdump to dump credentials from LSASS memory."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CredentialAccess"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject19')._huntingQuerycontentId19),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 19",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject19')._huntingQuerycontentId19)]",
+                "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject19').huntingQueryVersion19]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
+        "contentKind": "HuntingQuery",
+        "displayName": "LSASS Credential Dumping with Procdump",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject19')._huntingQuerycontentId19,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject20').huntingQueryTemplateSpecName20]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ClearSystemLogs_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject20').huntingQueryVersion20]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_20",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Clear System Logs",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where FileName =~ \"fsutil.exe\"\nand ProcessCommandLine has \"usn\" and ProcessCommandLine has \"deletejournal\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query searches for attempts to use fsutil.exe to clear system logs and delete forensic artifacts."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject20')._huntingQuerycontentId20),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 20",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject20')._huntingQuerycontentId20)]",
+                "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject20').huntingQueryVersion20]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Clear System Logs",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject20')._huntingQuerycontentId20,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject21').huntingQueryTemplateSpecName21]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DoppelpaymerStopServices_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject21').huntingQueryVersion21]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_21",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Doppelpaymer Stop Services",
+                "category": "Hunting Queries",
+                "query": "// Attempts to stop services and allow ransomware execution\nDeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where InitiatingProcessFileName startswith \"psexe\" and FileName =~ \"powershell.exe\" and\nProcessCommandLine has \"stop-service\"\nand ProcessCommandLine has \"sql\" and ProcessCommandLine has \"msexchange\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for attempts to stop security services, which is a common tactic used by DoppelPaymer ransomware operators."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject21')._huntingQuerycontentId21),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 21",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject21')._huntingQuerycontentId21)]",
+                "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject21').huntingQueryVersion21]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Doppelpaymer Stop Services",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject21')._huntingQuerycontentId21,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject22').huntingQueryTemplateSpecName22]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "QakbotCampaignSelfDeletion_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject22').huntingQueryVersion22]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_22",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Qakbot Campaign Self Deletion",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where FileName =~ \"ping.exe\"\n| where InitiatingProcessFileName =~ \"cmd.exe\"\n| where (InitiatingProcessCommandLine has \"calc.exe\") and (InitiatingProcessCommandLine has \"-n 6\") and (InitiatingProcessCommandLine has \"127.0.0.1\")\n| project TimeGenerated, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DeviceId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query detects if an instance of Qakbot has attempted to overwrite its original binary."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject22')._huntingQuerycontentId22),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 22",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject22')._huntingQuerycontentId22)]",
+                "contentId": "[variables('huntingQueryObject22')._huntingQuerycontentId22]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject22').huntingQueryVersion22]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject22')._huntingQuerycontentId22]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Qakbot Campaign Self Deletion",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject22')._huntingQuerycontentId22,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject22')._huntingQuerycontentId22,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject23').huntingQueryTemplateSpecName23]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Regsvr32Rundll32ImageLoadsAbnormalExtension_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject23').huntingQueryVersion23]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_23",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
+                "category": "Hunting Queries",
+                "query": "DeviceImageLoadEvents \n| where TimeGenerated > ago(1d)\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where FileName !endswith \".dll\"\n| join (\nDeviceNetworkEvents\n| where TimeGenerated > ago(30d)\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where RemoteIPType == \"Public\"\n) on InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessCommandLine\n| project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessParentFileName\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1218.010,T1218.011"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject23')._huntingQuerycontentId23),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 23",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject23')._huntingQuerycontentId23)]",
+                "contentId": "[variables('huntingQueryObject23')._huntingQuerycontentId23]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject23').huntingQueryVersion23]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject23')._huntingQuerycontentId23]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Regsvr32 Rundll32 Image Loads Abnormal Extension",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject23')._huntingQuerycontentId23,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject23')._huntingQuerycontentId23,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject24').huntingQueryTemplateSpecName24]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Regsvr32Rundll32WithAnomalousParentProcess_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject24').huntingQueryVersion24]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_24",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Regsvr32 Rundll32 with Anomalous Parent Process",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(30d)\n| where FileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where InitiatingProcessFileName has_any (\"wscript.exe\",\"powershell.exe\",\"cmd.exe\",\"pwsh.exe\",\"cscript.exe\")\n| project TimeGenerated,DeviceName, InvestigatedProcessName=FileName, InvestigatedProcessCommandLine = ProcessCommandLine,InvestigatedProcessStartTime = ProcessCreationTime, InvestigatedProcessId = ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName\n| join (\nDeviceNetworkEvents\n| where TimeGenerated > ago(30d)\n| where InitiatingProcessFileName has_any (\"rundll32.exe\",\"regsvr32.exe\")\n| where RemoteIPType == \"Public\"\n| project DeviceName, InvestigatedProcessName=InitiatingProcessFileName, InvestigatedProcessCommandLine = InitiatingProcessCommandLine,InvestigatedProcessStartTime = InitiatingProcessCreationTime, InvestigatedProcessId = InitiatingProcessId, RemoteIP, RemoteUrl\n) on DeviceName, InvestigatedProcessCommandLine, InvestigatedProcessId, InvestigatedProcessName, InvestigatedProcessStartTime\n| project-away DeviceName1, InvestigatedProcessCommandLine1, InvestigatedProcessId1, InvestigatedProcessName1, InvestigatedProcessStartTime1\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for rundll32.exe or regsvr32.exe being spawned by abnormal processes such as wscript.exe, powershell.exe, cmd.exe, pwsh.exe, cscript.exe."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1218.010,T1218.011"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject24')._huntingQuerycontentId24),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 24",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject24')._huntingQuerycontentId24)]",
+                "contentId": "[variables('huntingQueryObject24')._huntingQuerycontentId24]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject24').huntingQueryVersion24]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject24')._huntingQuerycontentId24]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Regsvr32 Rundll32 with Anomalous Parent Process",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject24')._huntingQuerycontentId24,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject24')._huntingQuerycontentId24,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject25').huntingQueryTemplateSpecName25]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Delivered Bad Emails from Top bad IPv4 addresses_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject25').huntingQueryVersion25]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_25",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Determine Successfully Delivered Phishing Emails by top IP Addresses",
+                "category": "Hunting Queries",
+                "query": "// Adjust the cutoff as needed \nlet cutoff = 5;\nEmailEvents\n| where ThreatTypes has \"Malware\" or ThreatTypes has \"Phish\" \n| summarize count() by SenderIPv4 \n| where count_ > cutoff\n| join kind=inner EmailEvents on SenderIPv4  \n| where DeliveryAction =~ \"Delivered\"\n| extend Name = tostring(split(SenderFromAddress, '@', 0)[0]), UPNSuffix = tostring(split(SenderFromAddress, '@', 1)[0])\n| extend Account_0_Name = Name\n| extend Account_0_UPNSuffix = UPNSuffix\n| extend IP_0_Address = SenderIPv4\n| extend MailBox_0_MailboxPrimaryAddress = RecipientEmailAddress\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query identifies phishing emails sent that were successfully delivered, by top IP addressess. cutoff default value is 5, adjust the value as needed."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject25')._huntingQuerycontentId25),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 25",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject25')._huntingQuerycontentId25)]",
+                "contentId": "[variables('huntingQueryObject25')._huntingQuerycontentId25]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject25').huntingQueryVersion25]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject25')._huntingQuerycontentId25]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Determine Successfully Delivered Phishing Emails by top IP Addresses",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject25')._huntingQuerycontentId25,'-', '1.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject25')._huntingQuerycontentId25,'-', '1.0.2')))]",
+        "version": "1.0.2"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject26').huntingQueryTemplateSpecName26]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SuspiciousCommandInitiatedByWebServerProcess_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject26').huntingQueryVersion26]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_26",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Detect Suspicious Commands Initiated by Webserver Processes",
+                "category": "Hunting Queries",
+                "query": "// Suspicious commands launched by web server processes\nDeviceProcessEvents \n| where TimeGenerated > ago(7d)\n// Pivoting on parents or grand parents\nand (((InitiatingProcessParentFileName in(\"w3wp.exe\", \"beasvc.exe\",\n\"httpd.exe\") or InitiatingProcessParentFileName startswith \"tomcat\")\nor InitiatingProcessFileName in(\"w3wp.exe\", \"beasvc.exe\", \"httpd.exe\") or\nInitiatingProcessFileName startswith \"tomcat\"))\n    and FileName in~('cmd.exe','powershell.exe')\n| where ProcessCommandLine contains '%temp%'\n    or ProcessCommandLine has 'wget'\n    or ProcessCommandLine has 'whoami'\n    or ProcessCommandLine has 'certutil'\n    or ProcessCommandLine has 'systeminfo'\n    or ProcessCommandLine has 'ping'\n    or ProcessCommandLine has 'ipconfig'\n    or ProcessCommandLine has 'timeout'\n| summarize take_any(TimeGenerated), take_any(TimeGenerated), take_any(FileName),\nmake_set(ProcessCommandLine, 100000), take_any(InitiatingProcessFileName),\ntake_any(InitiatingProcessParentFileName) by DeviceId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Detect suspicious commands initiated by web server processes used for network discovery and user/owner discovery."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,DefenseEvasion,Discovery"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject26')._huntingQuerycontentId26),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 26",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject26')._huntingQuerycontentId26)]",
+                "contentId": "[variables('huntingQueryObject26')._huntingQuerycontentId26]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject26').huntingQueryVersion26]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject26')._huntingQuerycontentId26]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Detect Suspicious Commands Initiated by Webserver Processes",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject26')._huntingQuerycontentId26,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject26')._huntingQuerycontentId26,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject27').huntingQueryTemplateSpecName27]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User&GroupEnumWithNetCommand_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject27').huntingQueryVersion27]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_27",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Enumeration of Users & Groups for Lateral Movement",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where TimeGenerated > ago(7d) \n| where FileName == 'net.exe' and AccountName != \"\" and ProcessCommandLine !contains '\\\\'  and ProcessCommandLine !contains '/add' \n| where (ProcessCommandLine contains ' user ' or ProcessCommandLine contains ' group ') and (ProcessCommandLine contains ' /do' or ProcessCommandLine contains ' /domain') \n| extend Target = extract(\"(?i)[user|group] (\\\"*[a-zA-Z0-9-_ ]+\\\"*)\", 1, ProcessCommandLine) | filter Target  != '' \n| project AccountName, Target, ProcessCommandLine, DeviceName, TimeGenerated  \n| sort by AccountName, Target\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query hunts for attempts to list users or groups using Net commands, which are commonly used for lateral movement."
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject27')._huntingQuerycontentId27),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 27",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject27')._huntingQuerycontentId27)]",
+                "contentId": "[variables('huntingQueryObject27')._huntingQuerycontentId27]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject27').huntingQueryVersion27]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject27')._huntingQuerycontentId27]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Enumeration of Users & Groups for Lateral Movement",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject27')._huntingQuerycontentId27,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject27')._huntingQuerycontentId27,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject28').huntingQueryTemplateSpecName28]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ATP policy status check_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject28').huntingQueryVersion28]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_28",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "ATP policy status check",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where Application == \"Microsoft Exchange Online\"\n| where ActionType == \"Set-AtpPolicyForO365\"\n| mv-expand ActivityObjects\n| extend Name = tostring(ActivityObjects.Name)\n| extend Value = tostring(ActivityObjects.Value)\n| where Name in (\"EnableATPForSPOTeamsODB\", \"EnableSafeDocs\", \"AllowSafeDocsOpen\")\n| extend packed = pack(Name, Value)\n| summarize PackedInfo = make_bag(packed), ActionType = any(ActionType) by Timestamp, AccountDisplayName\n| evaluate bag_unpack(PackedInfo)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject28')._huntingQuerycontentId28),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 28",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject28')._huntingQuerycontentId28)]",
+                "contentId": "[variables('huntingQueryObject28')._huntingQuerycontentId28]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject28').huntingQueryVersion28]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject28')._huntingQuerycontentId28]",
+        "contentKind": "HuntingQuery",
+        "displayName": "ATP policy status check",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject28')._huntingQuerycontentId28,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject28')._huntingQuerycontentId28,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject29').huntingQueryTemplateSpecName29]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "JNLP attachment_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject29').huntingQueryVersion29]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_29",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "JNLP-File-Attachment",
+                "category": "Hunting Queries",
+                "query": "EmailAttachmentInfo\n| where FileName endswith \".jnlp\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "JNLP file extensions are an uncommon file type often used to deliver malware."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject29')._huntingQuerycontentId29),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 29",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject29')._huntingQuerycontentId29)]",
+                "contentId": "[variables('huntingQueryObject29')._huntingQuerycontentId29]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject29').huntingQueryVersion29]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject29')._huntingQuerycontentId29]",
+        "contentKind": "HuntingQuery",
+        "displayName": "JNLP-File-Attachment",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject29')._huntingQuerycontentId29,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject29')._huntingQuerycontentId29,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject30').huntingQueryTemplateSpecName30]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Safe attachment detection_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject30').huntingQueryVersion30]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_30",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Safe Attachments detections",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where DetectionMethods != \"\" \n| extend detection= tostring(parse_json(DetectionMethods).Phish) \n| where detection has \"File detonation reputation\" or detection has \"File detonation\"\n| summarize total=count() by bin(Timestamp, 1d) \n| order by Timestamp asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query provides insights on the detections done by Safe Attachment detections"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject30')._huntingQuerycontentId30),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 30",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject30')._huntingQuerycontentId30)]",
+                "contentId": "[variables('huntingQueryObject30')._huntingQuerycontentId30]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject30').huntingQueryVersion30]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject30')._huntingQuerycontentId30]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Safe Attachments detections",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject30')._huntingQuerycontentId30,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject30')._huntingQuerycontentId30,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject31').huntingQueryTemplateSpecName31]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Authentication failures_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject31').huntingQueryVersion31]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_31",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Authentication failures by time and authentication type",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago (30d)\n| project Timestamp, AR=parse_json(AuthenticationDetails), NetworkMessageId, EmailDirection, SenderFromAddress, ThreatTypes, DetectionMethods\n| evaluate bag_unpack(AR)\n| where DMARC == \"fail\"\n| summarize count() by bin(Timestamp, 1d)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing authentication failure count by authentication type. Update the authentication type below as DMARC, DKIM, SPM, CompAuth"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject31')._huntingQuerycontentId31),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 31",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject31')._huntingQuerycontentId31)]",
+                "contentId": "[variables('huntingQueryObject31')._huntingQuerycontentId31]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject31').huntingQueryVersion31]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject31')._huntingQuerycontentId31]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Authentication failures by time and authentication type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject31')._huntingQuerycontentId31,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject31')._huntingQuerycontentId31,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject32').huntingQueryTemplateSpecName32]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "CompAuth Failure Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject32').huntingQueryVersion32]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_32",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "CompAuth Failure Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| extend CompAuthFail = AuthenticationDetails has_any ('CompAuth\":\"fail') \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spoof - Composite Authentication fails summarizing the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject32')._huntingQuerycontentId32),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 32",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject32')._huntingQuerycontentId32)]",
+                "contentId": "[variables('huntingQueryObject32')._huntingQuerycontentId32]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject32').huntingQueryVersion32]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject32')._huntingQuerycontentId32]",
+        "contentKind": "HuntingQuery",
+        "displayName": "CompAuth Failure Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject32')._huntingQuerycontentId32,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject32')._huntingQuerycontentId32,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject33').huntingQueryTemplateSpecName33]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DKIM Failure Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject33').huntingQueryVersion33]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_33",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "DKIM Failure Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| extend DMARCFail = AuthenticationDetails has_any ('DKIM\":\"fail') \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spoof - DKIM fails summarizing the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject33')._huntingQuerycontentId33),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 33",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject33')._huntingQuerycontentId33)]",
+                "contentId": "[variables('huntingQueryObject33')._huntingQuerycontentId33]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject33').huntingQueryVersion33]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject33')._huntingQuerycontentId33]",
+        "contentKind": "HuntingQuery",
+        "displayName": "DKIM Failure Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject33')._huntingQuerycontentId33,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject33')._huntingQuerycontentId33,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject34').huntingQueryTemplateSpecName34]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DMARC Failure Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject34').huntingQueryVersion34]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_34",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "DMARC Failure Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| extend DMARCFail = AuthenticationDetails has_any ('DMARC\":\"fail') \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spoof - DMARC fails summarizing the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject34')._huntingQuerycontentId34),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 34",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject34')._huntingQuerycontentId34)]",
+                "contentId": "[variables('huntingQueryObject34')._huntingQuerycontentId34]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject34').huntingQueryVersion34]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject34')._huntingQuerycontentId34]",
+        "contentKind": "HuntingQuery",
+        "displayName": "DMARC Failure Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject34')._huntingQuerycontentId34,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject34')._huntingQuerycontentId34,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject35').huntingQueryTemplateSpecName35]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SPF Failure Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject35').huntingQueryVersion35]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_35",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "SPF Failure Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| extend DMARCFail = AuthenticationDetails has_any ('SPF\":\"fail') \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spoof - SPF fails summarizing the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject35')._huntingQuerycontentId35),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 35",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject35')._huntingQuerycontentId35)]",
+                "contentId": "[variables('huntingQueryObject35')._huntingQuerycontentId35]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject35').huntingQueryVersion35]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject35')._huntingQuerycontentId35]",
+        "contentKind": "HuntingQuery",
+        "displayName": "SPF Failure Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject35')._huntingQuerycontentId35,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject35')._huntingQuerycontentId35,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject36').huntingQueryTemplateSpecName36]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spoof attempts with auth failure_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject36').huntingQueryVersion36]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_36",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spoof attempts with auth failure",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where Timestamp > ago (1d) and DetectionMethods contains \"spoof\"  \n| project Timestamp, AR=parse_json(AuthenticationDetails) , NetworkMessageId, EmailDirection, Subject, SenderFromAddress, SenderIPv4,ThreatTypes, DetectionMethods, ThreatNames  \n| evaluate bag_unpack(AR)  \n| where SPF == \"fail\" or DMARC == \"fail\" or DKIM == \"fail\" or CompAuth == \"fail\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps in checking for spoofing attempts on the domain with Authentication failures"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject36')._huntingQuerycontentId36),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 36",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject36')._huntingQuerycontentId36)]",
+                "contentId": "[variables('huntingQueryObject36')._huntingQuerycontentId36]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject36').huntingQueryVersion36]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject36')._huntingQuerycontentId36]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spoof attempts with auth failure",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject36')._huntingQuerycontentId36,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject36')._huntingQuerycontentId36,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject37').huntingQueryTemplateSpecName37]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Spoof detections by Sender Domain_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject37').huntingQueryVersion37]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_37",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Spoof external domain detections by Sender domain (P1/P2)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\"\n| summarize TotalEmailCount = count(),\n            SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof external domain\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\n| where SpoofExternalCount != 0\n| top 10 by SpoofExternalCount\n| project P1Sender, P2Sender, SpoofExternalCount, TotalEmailCount, SpoofExternal_Traffic_Percentage\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject37')._huntingQuerycontentId37),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 37",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject37')._huntingQuerycontentId37)]",
+                "contentId": "[variables('huntingQueryObject37')._huntingQuerycontentId37]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject37').huntingQueryVersion37]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject37')._huntingQuerycontentId37]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Spoof external domain detections by Sender domain (P1/P2)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject37')._huntingQuerycontentId37,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject37')._huntingQuerycontentId37,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject38').huntingQueryTemplateSpecName38]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Spoof DMARC detections by Sender Domain_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject38').huntingQueryVersion38]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_38",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Spoof DMARC detections by Sender domain (P1/P2)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\"\n| summarize TotalEmailCount = count(),\n            DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof DMARC\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\n| where DMARCFailCount != 0\n| top 10 by DMARCFailCount\n| project P1Sender, P2Sender, DMARCFailCount, TotalEmailCount, DMARCFail_Traffic_Percentage\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject38')._huntingQuerycontentId38),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 38",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject38')._huntingQuerycontentId38)]",
+                "contentId": "[variables('huntingQueryObject38')._huntingQuerycontentId38]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject38').huntingQueryVersion38]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject38')._huntingQuerycontentId38]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Spoof DMARC detections by Sender domain (P1/P2)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject38')._huntingQuerycontentId38,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject38')._huntingQuerycontentId38,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject39').huntingQueryTemplateSpecName39]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Spoof Intra-Org detections by SenderDomain_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject39').huntingQueryVersion39]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_39",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Spoof intra-org detections by Sender domain (P1/P2)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\"\n| summarize TotalEmailCount = count(),\n            SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof intra-org\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\n| where SpoofInternalCount != 0\n| top 10 by SpoofInternalCount\n| project P1Sender, P2Sender, SpoofInternalCount, TotalEmailCount, SpoofInternal_Traffic_Percentage\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject39')._huntingQuerycontentId39),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 39",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject39')._huntingQuerycontentId39)]",
+                "contentId": "[variables('huntingQueryObject39')._huntingQuerycontentId39]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject39').huntingQueryVersion39]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject39')._huntingQuerycontentId39]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Spoof intra-org detections by Sender domain (P1/P2)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject39')._huntingQuerycontentId39,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject39')._huntingQuerycontentId39,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject40').huntingQueryTemplateSpecName40]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Message from Accepted Domain with DMARC TempError_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject40').huntingQueryVersion40]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_40",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Message from an Accepted Domain with DMARC TempError",
+                "category": "Hunting Queries",
+                "query": "let SenderDomains = pack_array ('contoso.com','fabrikam.fr');\nEmailEvents\n| where EmailDirection == 'Inbound' and SenderMailFromDomain in (SenderDomains)\n| extend SPF= tostring(parse_json(AuthenticationDetails).SPF)\n| extend DMARC= tostring(parse_json(AuthenticationDetails).DMARC)\n| where DMARC == \"temperror\" or SPF == \"temperror\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email appearing to come from an Accepted Domain but DMARC had a (transient) TempError result."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject40')._huntingQuerycontentId40),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 40",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject40')._huntingQuerycontentId40)]",
+                "contentId": "[variables('huntingQueryObject40')._huntingQuerycontentId40]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject40').huntingQueryVersion40]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject40')._huntingQuerycontentId40]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Message from an Accepted Domain with DMARC TempError",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject40')._huntingQuerycontentId40,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject40')._huntingQuerycontentId40,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject41').huntingQueryTemplateSpecName41]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Message with URL listed on OpenPhish delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject41').huntingQueryVersion41]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_41",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Message with URL listed on OpenPhish delivered into Inbox",
+                "category": "Hunting Queries",
+                "query": "let PhishingURLs = externaldata(url: string)\n[\n    \"https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt\"\n]\nwith (format=\"txt\"); // CSV and JSON formats are also valid formats if using the premium feeds\nEmailUrlInfo\n| where Url in (PhishingURLs)\n| join EmailEvents on NetworkMessageId\n| where LatestDeliveryAction == \"Delivered\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious email with a URL from OpenPhish was delivered to Inbox"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject41')._huntingQuerycontentId41),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 41",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject41')._huntingQuerycontentId41)]",
+                "contentId": "[variables('huntingQueryObject41')._huntingQuerycontentId41]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject41').huntingQueryVersion41]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject41')._huntingQuerycontentId41]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Message with URL listed on OpenPhish delivered into Inbox",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject41')._huntingQuerycontentId41,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject41')._huntingQuerycontentId41,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject42').huntingQueryTemplateSpecName42]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Potential OAuth phishing email delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject42').huntingQueryVersion42]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_42",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Potential OAuth phishing email delivered into Inbox",
+                "category": "Hunting Queries",
+                "query": "let LoginCom = strcat(\"login.\", \"microsoftonline.com\");\nlet LoginUs  = strcat(\"login.\", \"microsoftonline.us\");\nlet ConsentUrls = pack_array(strcat(\"://\", LoginCom, \"/common/oauth2\"), strcat(\"://\", LoginCom, \"/consumers/oauth2\"), strcat(\"://\", LoginCom, \"/organizations/oauth2\"), strcat(\"://\", LoginUs, \"/common/oauth2\"), strcat(\"://\", LoginUs, \"/consumers/oauth2\"), strcat(\"://\", LoginUs, \"/organizations/oauth2\"));\nEmailUrlInfo\n| where Url has_any (ConsentUrls)\n| join EmailEvents on NetworkMessageId\n| where EmailDirection == \"Inbound\" and LatestDeliveryAction == \"Delivered\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious OAuth app URL has been delivered into an Inbox."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject42')._huntingQuerycontentId42),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 42",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject42')._huntingQuerycontentId42)]",
+                "contentId": "[variables('huntingQueryObject42')._huntingQuerycontentId42]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject42').huntingQueryVersion42]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject42')._huntingQuerycontentId42]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Potential OAuth phishing email delivered into Inbox",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject42')._huntingQuerycontentId42,'-', '1.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject42')._huntingQuerycontentId42,'-', '1.0.1')))]",
+        "version": "1.0.1"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject43').huntingQueryTemplateSpecName43]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Potentially malicious SVG file delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject43').huntingQueryVersion43]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_43",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Potentially malicious svg file delivered to Inbox",
+                "category": "Hunting Queries",
+                "query": "let SuspiciousDisplayNames = pack_array(\"Help Desk\", \"Help Desk Team\", \"Help Desk IT\", \"Microsoft Security\", \"IT Support\", \"Helpdesk\");\nEmailAttachmentInfo\n| where FileName contains \".svg\" and FileType == \"html\" // SVG files which render as only an image will display FileType as Text, unless containing Javascript which displays FileType as Html\n| join EmailEvents on NetworkMessageId\n// | where SenderDisplayName has_any (SuspiciousDisplayNames) // Optionally remove comment to also evaluate and filter based on email display name\n| where LatestDeliveryLocation == \"Inbox/folder\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject43')._huntingQuerycontentId43),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 43",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject43')._huntingQuerycontentId43)]",
+                "contentId": "[variables('huntingQueryObject43')._huntingQuerycontentId43]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject43').huntingQueryVersion43]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject43')._huntingQuerycontentId43]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Potentially malicious svg file delivered to Inbox",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject43')._huntingQuerycontentId43,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject43')._huntingQuerycontentId43,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject44').huntingQueryTemplateSpecName44]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Audit Email Preview-Download action_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject44').huntingQueryVersion44]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_44",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Audit Email Preview-Download action",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| project Timestamp, ActionType, AccountDisplayName, AR=parse_json(RawEventData) \n| evaluate bag_unpack(AR)\n| where RecordType == \"38\" and ExtendedProperties contains \"DownloadEMail\" or ExtendedProperties contains \"GetMailPreviewUrl\"\n| serialize \n| extend RowNumber = row_number()\n| mv-expand ExtendedProperties\n| evaluate bag_unpack(ExtendedProperties, 'xp_')\n| extend DownloadEMail = iff(tostring(xp_Name) == 'DownloadEMail', xp_Value, ''), GetMailPreviewUrl = iff(tostring(xp_Name) == 'GetMailPreviewUrl', xp_Value, ''), MailboxId = iff(tostring(xp_Name) == 'MailboxId', xp_Value, ''), InternetMessageId = iff(tostring(xp_Name) == 'InternetMessageId', xp_Value, '')\n| summarize Timestamp = any(Timestamp), ActionType = any(ActionType), AccountDisplayName = any(AccountDisplayName),  DownloadEmail = make_set_if(DownloadEMail, isnotempty( DownloadEMail)), GetMailPreviewUrl = make_set_if(GetMailPreviewUrl, isnotempty( GetMailPreviewUrl)), MailboxId = make_set_if(MailboxId, isnotempty( MailboxId)), InternetMessageId = make_set_if(InternetMessageId, isnotempty( InternetMessageId)) by RowNumber\n| extend DownloadEmail = tobool(DownloadEmail[0]), GetMailPreviewUrl = tobool(GetMailPreviewUrl[0]), MailboxId = tostring(MailboxId[0]), InternetMessageId = tostring(InternetMessageId[0])\n| project-away RowNumber\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1078"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject44')._huntingQuerycontentId44),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 44",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject44')._huntingQuerycontentId44)]",
+                "contentId": "[variables('huntingQueryObject44')._huntingQuerycontentId44]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject44').huntingQueryVersion44]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject44')._huntingQuerycontentId44]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Audit Email Preview-Download action",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject44')._huntingQuerycontentId44,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject44')._huntingQuerycontentId44,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject45').huntingQueryTemplateSpecName45]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Bad email percentage - Inbound emails_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject45').huntingQueryVersion45]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_45",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Bad email percentage of Inbound emails",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n| summarize TotalEmailCount = count(),\nBadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, 1d)\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\n| project Timestamp,Bad_Traffic_Percentage_Inbound\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject45')._huntingQuerycontentId45),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 45",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject45')._huntingQuerycontentId45)]",
+                "contentId": "[variables('huntingQueryObject45')._huntingQuerycontentId45]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject45').huntingQueryVersion45]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject45')._huntingQuerycontentId45]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Bad email percentage of Inbound emails",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject45')._huntingQuerycontentId45,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject45')._huntingQuerycontentId45,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject46').huntingQueryTemplateSpecName46]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Calculate MDO Efficacy_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject46').huntingQueryVersion46]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_46",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Calculate overall MDO efficacy",
+                "category": "Hunting Queries",
+                "query": "let _startTime = ago(30d); \nlet _endTime = now(); \n// Get all mailflow detected as clean at time of delivery \nlet EmailEventsClean = materialize( \n    EmailEvents \n    | where Timestamp between (_startTime .. _endTime) and EmailDirection == \"Inbound\" \n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" \n    | project NetworkMessageId,ThreatTypes \n); \n// Get all mailflow detected as phish or malware at time of delivery \nlet EmailEventsThreats = materialize( \n    EmailEvents \n    | where Timestamp between (_startTime .. _endTime) and EmailDirection == \"Inbound\" \n    | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \n    | extend MDO_detection = parse_json(DetectionMethods) \n    | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \n    | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \n); \n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each\nlet EmailPostDeliveryFiltered = materialize( \n    EmailPostDeliveryEvents \n    | where Timestamp between (_startTime .. datetime_add('day', 7, _endTime)) \n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\",\"Redelivery\") \n    | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \n    | summarize arg_max(Timestamp, *) by Key \n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \n); \n// Optional - Get all admin submissions for malware or phish, so we can also count these in the miss bucket. \nlet CloudAppEventsFiltered = materialize( \n    CloudAppEvents \n    | where Timestamp between (_startTime .. datetime_add('day', 7, _endTime)) \n    | where ActionType == \"AdminSubmissionSubmitted\" \n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \n    | where SubmissionType in (\"1\", \"2\") \n    | project SubmissionType,NetworkMessageId \n); \n// Get the number of threats caught in mailflow \nlet Mal_Phish_Mailflow = toscalar( \n    EmailEventsThreats \n    | summarize count() \n); \n// Get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \nlet FP_ZAP = toscalar( \n    EmailPostDeliveryFiltered \n    | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and ActionType == \"Redelivery\" \n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \n    | summarize count() \n); \n// Get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \nlet FN_ZAP_Successful = toscalar( \n    EmailPostDeliveryFiltered \n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \n    | summarize count() \n); \n// Get the number of threats unsuccessfully cleaned up post delivery. \nlet FN_ZAP_Unsuccessful = toscalar( \n    EmailPostDeliveryFiltered \n    | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \n    | summarize count() \n); \n// Join the admin submissions to clean mailflow to find the additional miss \nlet FN_Admin_Submissions = toscalar( \n    CloudAppEventsFiltered \n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \n    | summarize count() \n    ); \n// Print each result, and run the formula to calculate effectiveness at time of delivery and post delivery. \nunion withsource=Table \n    (print StatisticName=\"Mal/Phish Mailflow totals - Minus FPs\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \n    (print StatisticName=\"Admin Mal/Phish FNs Submitted\", Value=toreal(FN_Admin_Submissions)), \n    (print StatisticName=\"Mal/Phish FPs Reverse Zapped\", Value=toreal(FP_ZAP)), \n    (print StatisticName=\"Mal/Phish Successfully Zapped\", Value=toreal(FN_ZAP_Successful)), \n    (print StatisticName=\"Mal/Phish UN-Successfully Zapped\", Value=toreal(FN_ZAP_Unsuccessful)), \n    (print StatisticName=\"Effectiveness Post Delivery\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \n    (print StatisticName=\"Effectiveness Pre-Delivery\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2)))\n| project StatisticName, Value\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps calculate overall efficacy of MDO based on threats blocked pre-delivery, post-delivery cleanups, or were uncaught."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject46')._huntingQuerycontentId46),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 46",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject46')._huntingQuerycontentId46)]",
+                "contentId": "[variables('huntingQueryObject46')._huntingQuerycontentId46]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject46').huntingQueryVersion46]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject46')._huntingQuerycontentId46]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Calculate overall MDO efficacy",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject46')._huntingQuerycontentId46,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject46')._huntingQuerycontentId46,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject47').huntingQueryTemplateSpecName47]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Email sender IP address Geo location information_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject47').huntingQueryVersion47]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_47",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email sender IP address Geo location information",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where geo_info_from_ip_address(SenderIPv4) != \"\"\n| extend GeoIPInfo = geo_info_from_ip_address(SenderIPv4)\n| extend country = tostring(parse_json(GeoIPInfo).country)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps getting GeoIP information of emails SenderIPv4 addresses."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject47')._huntingQuerycontentId47),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 47",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject47')._huntingQuerycontentId47)]",
+                "contentId": "[variables('huntingQueryObject47')._huntingQuerycontentId47]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject47').huntingQueryVersion47]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject47')._huntingQuerycontentId47]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email sender IP address Geo location information",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject47')._huntingQuerycontentId47,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject47')._huntingQuerycontentId47,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject48').huntingQueryTemplateSpecName48]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for Admin email access_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject48').huntingQueryVersion48]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_48",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for Admin email access",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminMailAccess\"\n| extend data = RawEventData[\"ExtendedProperties\"]\n| extend OpenedMailbox = data[1].[\"Value\"]\n| extend OpenedEmail = url_decode(tostring(data[2].[\"Value\"]))\n| project AccountDisplayName, ActionType, OpenedMailbox, OpenedEmail\n| join EmailEvents on $left.OpenedEmail == $right.InternetMessageId\n| project Timestamp , Actor = AccountDisplayName, ActionType, OpenedMailbox, SenderFromAddress, RecipientEmailAddress, Subject\n| order by Timestamp desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps report on email access by administrators"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1078"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject48')._huntingQuerycontentId48),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 48",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject48')._huntingQuerycontentId48)]",
+                "contentId": "[variables('huntingQueryObject48')._huntingQuerycontentId48]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject48').huntingQueryVersion48]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject48')._huntingQuerycontentId48]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for Admin email access",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject48')._huntingQuerycontentId48,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject48')._huntingQuerycontentId48,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject49').huntingQueryTemplateSpecName49]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for TABL changes_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject49').huntingQueryVersion49]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_49",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for TABL changes",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType contains \"TenantAllowBlockListItems\"\n| order by Timestamp desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject49')._huntingQuerycontentId49),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 49",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject49')._huntingQuerycontentId49)]",
+                "contentId": "[variables('huntingQueryObject49')._huntingQuerycontentId49]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject49').huntingQueryVersion49]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject49')._huntingQuerycontentId49]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for TABL changes",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject49')._huntingQuerycontentId49,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject49')._huntingQuerycontentId49,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject50').huntingQueryTemplateSpecName50]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Local time to UTC time conversion_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject50').huntingQueryVersion50]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_50",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Local time to UTC time conversion",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp between (datetime_local_to_utc(datetime(2023-08-10T00:00:00Z),\"Europe/Madrid\") .. datetime_local_to_utc(datetime(2023-08-31T23:59:59Z),\"Europe/Madrid\"))\n| where DeliveryAction == \"Delivered\"\n| where LatestDeliveryLocation == \"Quarantine\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Advanced Hunting has default timezone as UTC time. Filters in Advanced Hunting also work in UTC by default whereas query results are shown in local time if user has selected local time zone in security center settings."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject50')._huntingQuerycontentId50),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 50",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject50')._huntingQuerycontentId50)]",
+                "contentId": "[variables('huntingQueryObject50')._huntingQuerycontentId50]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject50').huntingQueryVersion50]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject50')._huntingQuerycontentId50]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Local time to UTC time conversion",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject50')._huntingQuerycontentId50,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject50')._huntingQuerycontentId50,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject51').huntingQueryTemplateSpecName51]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Mail item accessed_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject51').huntingQueryVersion51]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_51",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Mail item accessed",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where Timestamp > ago(30d)\n| extend Record= (parse_json(RawEventData)).RecordType\n| where Record == 50\n| take 10\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing emails accessed by end users using cloud app events data"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject51')._huntingQuerycontentId51),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 51",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject51')._huntingQuerycontentId51)]",
+                "contentId": "[variables('huntingQueryObject51')._huntingQuerycontentId51]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject51').huntingQueryVersion51]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject51')._huntingQuerycontentId51]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Mail item accessed",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject51')._huntingQuerycontentId51,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject51')._huntingQuerycontentId51,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject52').huntingQueryTemplateSpecName52]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malicious email senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject52').huntingQueryVersion52]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_52",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious email senders",
+                "category": "Hunting Queries",
+                "query": "let SenderWithQuarantine = EmailEvents\n| where LatestDeliveryLocation == \"Quarantine\"\n| project SenderFromAddress;\nEmailEvents\n| where LatestDeliveryLocation == \"Inbox/folder\"\n| where SenderFromAddress in (SenderWithQuarantine)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for emails from a sender with at least one email in quarantine"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject52')._huntingQuerycontentId52),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 52",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject52')._huntingQuerycontentId52)]",
+                "contentId": "[variables('huntingQueryObject52')._huntingQuerycontentId52]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject52').huntingQueryVersion52]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject52')._huntingQuerycontentId52]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious email senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject52')._huntingQuerycontentId52,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject52')._huntingQuerycontentId52,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject53').huntingQueryTemplateSpecName53]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MDO daily detection summary report_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject53').huntingQueryVersion53]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_53",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MDO daily detection summary report",
+                "category": "Hunting Queries",
+                "query": "let QueryTime = 30d;\nlet Reports = CloudAppEvents \n| where Timestamp > ago(QueryTime)\n| where ActionType == \"UserSubmission\" or ActionType == \"AdminSubmission\"\n| extend MessageDate = todatetime((parse_json(RawEventData)).MessageDate)\n| extend NetworkMessageID = tostring((parse_json(RawEventData)).ObjectId)\n| extend Date_value = tostring(format_datetime( MessageDate, \"yyyy-MM-dd\"))\n| distinct Date_value,NetworkMessageID\n| summarize count() by Date_value\n| project Date_value, MessagesGotReported=count_;\nlet ThreatByAutomation = (AlertEvidence | where Title == \"Email reported by user as malware or phish\")\n| extend LastVerdictfromAutomation = tostring((parse_json(AdditionalFields)).LastVerdict)\n| extend Date_value = tostring(format_datetime( Timestamp, \"yyyy-MM-dd\"))\n| extend DetectionFromAIR = iif(isempty(LastVerdictfromAutomation), \"NoThreatsFound\", tostring(LastVerdictfromAutomation))\n| summarize PostDeliveryTotalAIRInvestigations = count(),\n         PostDeliveryAirNoThreatsFound = countif(DetectionFromAIR contains \"NoThreatsFound\"),\n         PostDeliveryAirSuspicious = countif(DetectionFromAIR contains \"Suspicious\"),\n         PostDeliveryAirMalicious = countif(DetectionFromAIR contains \"Malicious\")\n         by Date_value          //Date Reported from Message Submissions from CloudAppEvents does not match to the AIR Investigations from Alert playbooks\n| project Date_value, PostDeliveryTotalAIRInvestigations, PostDeliveryAirNoThreatsFound, PostDeliveryAirSuspicious, PostDeliveryAirMalicious;\nlet DeliveryInboundEvents = (EmailEvents | where EmailDirection == \"Inbound\" and Timestamp > ago(QueryTime)\n| extend Date_value = tostring(format_datetime( Timestamp, \"yyyy-MM-dd\"))\n| project Date_value, Timestamp, NetworkMessageId, DetectionMethods ,RecipientEmailAddress);\nlet PostDeliveryEvents = (EmailPostDeliveryEvents | where ActionType contains \"ZAP\" and ActionResult == \"Success\"| join DeliveryInboundEvents on RecipientEmailAddress, NetworkMessageId //Only successful ZAP Events, there could still be more, join on Recipient and NetID\n| extend Date_value = tostring(format_datetime( Timestamp, \"yyyy-MM-dd\")) //Zap Timestamp is used and not MessageDate received\n| summarize PostDeliveryZAP=count() by Date_value);\nlet DeliveryByThreat = (DeliveryInboundEvents\n| where Timestamp > ago(QueryTime)\n| extend Date_value = tostring(format_datetime( Timestamp, \"yyyy-MM-dd\"))\n| extend MDO_detection = parse_json(DetectionMethods)\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\"))\n| summarize TotalEmails = count(),\n         Clean = countif(FirstSubcategory contains \"Clean\"),\n         Malware = countif(FirstSubcategory contains \"Malware\"),\n         Phish = countif(FirstSubcategory contains \"Phish\"),\n         Spam = countif(FirstSubcategory contains \"Spam\" and FirstSubcategory !contains \"Bulk\"),\n         Bulk = countif(FirstSubcategory contains \"Bulk\")                  \n         by Date_value;\nDeliveryByThreat\n| join kind=fullouter Reports on Date_value\n| join kind=fullouter PostDeliveryEvents on Date_value\n| join kind=fullouter ThreatByAutomation on Date_value\n| sort by Date_value asc\n| project Date_value, Clean, Malware, Phish, Spam, Bulk, MessagesGotReported, PostDeliveryZAP, PostDeliveryTotalAIRInvestigations, PostDeliveryAirNoThreatsFound, PostDeliveryAirMalicious, PostDeliveryAirSuspicious\n| where isnotempty(Date_value) // As Reports from CloudAppEvents Submissions could contain messages submitted before 30 days it is good to remove all > 30 days, otherwise EMailEvents wouldn't have a date\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps report daily on total number of emails, total number of emails detected aby Defender for Office 365"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject53')._huntingQuerycontentId53),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 53",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject53')._huntingQuerycontentId53)]",
+                "contentId": "[variables('huntingQueryObject53')._huntingQuerycontentId53]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject53').huntingQueryVersion53]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject53')._huntingQuerycontentId53]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MDO daily detection summary report",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject53')._huntingQuerycontentId53,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject53')._huntingQuerycontentId53,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject54').huntingQueryTemplateSpecName54]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "New TABL Items_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject54').huntingQueryVersion54]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_54",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "New TABL Items",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"New-TenantAllowBlockListItems\"\n| extend Parameters = RawEventData.Parameters\n| mv-apply Parameters on ( \n  extend Out=bag_pack(tostring(Parameters.Name), Parameters.Value)\n  | summarize Parameters=make_bag(Out)\n  )\n| extend Allow=Parameters.Allow, Block=Parameters.Block, Entry=Parameters.Entries, ExpirationDate=Parameters.ExpirationDate, ListType=Parameters.ListType,ListSubType=Parameters.ListSubType, ModifiedBy=Parameters.ModifiedBy, NoExpiration=Parameters.NoExpiration, SubmissionID=Parameters.SubmissionID, SubmissionUserId=Parameters.SubmissionUserId, Notes=Parameters.Notes\n| extend Action=iff(Allow == \"True\", \"Allow\", iff(Block == \"True\", \"Block\", \"Unknown\")), AccountUpn=tostring(coalesce(SubmissionUserId, ModifiedBy))\n| project Timestamp, Action, ListType, ListSubType, Entry, ExpirationDate, NoExpiration, AccountUpn, Notes, SubmissionID, ReportId\n| order by Timestamp desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps identifying when new items being added to the Tenant/Allow Block List (TABL) in Defender for Office 365."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject54')._huntingQuerycontentId54),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 54",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject54')._huntingQuerycontentId54)]",
+                "contentId": "[variables('huntingQueryObject54')._huntingQuerycontentId54]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject54').huntingQueryVersion54]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject54')._huntingQuerycontentId54]",
+        "contentKind": "HuntingQuery",
+        "displayName": "New TABL Items",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject54')._huntingQuerycontentId54,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject54')._huntingQuerycontentId54,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject55').huntingQueryTemplateSpecName55]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject55').huntingQueryVersion55]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_55",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n// Exclude phishing-simulation and SecOps mailbox traffic so they do not skew the ranking\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has_any (\"Malware\", \"Phish\", \"Spam\")\n// Uncomment the line below to exclude your own organization's domains (including subdomains)\n// | where SenderFromDomain !contains \".yourdomain.com\"\n// De-duplicate each delivery (NetworkMessageId + recipient) before counting so re-scanned messages are counted once\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderFromDomain\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies the top 10 sender domains delivering inbound emails classified as malware, phishing, or spam.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject55')._huntingQuerycontentId55),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 55",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject55')._huntingQuerycontentId55)]",
+                "contentId": "[variables('huntingQueryObject55')._huntingQuerycontentId55]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject55').huntingQueryVersion55]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject55')._huntingQuerycontentId55]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject55')._huntingQuerycontentId55,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject55')._huntingQuerycontentId55,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject56').huntingQueryTemplateSpecName56]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 External Senders (Malware)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject56').huntingQueryVersion56]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_56",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 External Senders (Malware)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n// Exclude phishing-simulation and SecOps mailbox traffic so they do not skew the ranking\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Malware\"\n//| where SenderFromAddress !contains \".yourdomain.com\"\n// De-duplicate each delivery (NetworkMessageId + recipient) before counting so re-scanned messages are counted once\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderFromAddress\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies the top 10 external sender addresses delivering inbound emails classified as malware.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the malware filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject56')._huntingQuerycontentId56),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 56",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject56')._huntingQuerycontentId56)]",
+                "contentId": "[variables('huntingQueryObject56')._huntingQuerycontentId56]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject56').huntingQueryVersion56]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject56')._huntingQuerycontentId56]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 External Senders (Malware)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject56')._huntingQuerycontentId56,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject56')._huntingQuerycontentId56,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject57').huntingQueryTemplateSpecName57]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 External Senders (Phish)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject57').huntingQueryVersion57]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_57",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 External Senders (Phish)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n// Exclude phishing-simulation and SecOps mailbox traffic so they do not skew the ranking\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Phish\"\n//| where SenderFromAddress !contains \".yourdomain.com\"\n// De-duplicate each delivery (NetworkMessageId + recipient) before counting so re-scanned messages are counted once\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderFromAddress\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies the top 10 external sender addresses delivering inbound emails classified as phishing.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the phishing filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject57')._huntingQuerycontentId57),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 57",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject57')._huntingQuerycontentId57)]",
+                "contentId": "[variables('huntingQueryObject57')._huntingQuerycontentId57]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject57').huntingQueryVersion57]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject57')._huntingQuerycontentId57]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 External Senders (Phish)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject57')._huntingQuerycontentId57,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject57')._huntingQuerycontentId57,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject58').huntingQueryTemplateSpecName58]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 External Senders (Spam)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject58').huntingQueryVersion58]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_58",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 External Senders (Spam)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n| where ThreatTypes has \"Spam\"\n//| where SenderFromAddress !contains \".yourdomain.com\"\n| summarize count() by SenderFromAddress\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies the top 10 external sender addresses delivering inbound emails classified as spam.\nIf you want to exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject58')._huntingQuerycontentId58),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 58",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject58')._huntingQuerycontentId58)]",
+                "contentId": "[variables('huntingQueryObject58')._huntingQuerycontentId58]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject58').huntingQueryVersion58]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject58')._huntingQuerycontentId58]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 External Senders (Spam)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject58')._huntingQuerycontentId58,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject58')._huntingQuerycontentId58,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject59').huntingQueryTemplateSpecName59]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 External Senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject59').huntingQueryVersion59]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_59",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 External Senders (Spam)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n| where ThreatTypes has \"Spam\"\n//| where SenderFromAddress !contains \".yourdomain.com\"\n| summarize count() by SenderFromAddress\n| sort by count_ desc\n| top 10 by count_\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies the top 10 external sender addresses delivering inbound emails classified as spam.\nTo exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:\n  | where SenderFromAddress !contains \".yourdomain.com\"\n(Replace \"yourdomain.com\" with your actual domain.)\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject59')._huntingQuerycontentId59),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 59",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject59')._huntingQuerycontentId59)]",
+                "contentId": "[variables('huntingQueryObject59')._huntingQuerycontentId59]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject59').huntingQueryVersion59]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject59')._huntingQuerycontentId59]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 External Senders (Spam)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject59')._huntingQuerycontentId59,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject59')._huntingQuerycontentId59,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject60').huntingQueryTemplateSpecName60]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 Targeted Users (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject60').huntingQueryVersion60]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_60",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Targeted Users (Malware+Phish+Spam)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n// Exclude phishing-simulation and SecOps mailbox traffic so they do not skew the ranking\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has_any (\"Malware\", \"Phish\", \"Spam\")\n// De-duplicate each delivery (NetworkMessageId + recipient) before counting so re-scanned messages are counted once\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by RecipientEmailAddress\n| top 10 by count_\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies the top 10 users receiving inbound emails classified as malware, phishing, or spam.\nBased on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject60')._huntingQuerycontentId60),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 60",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject60')._huntingQuerycontentId60)]",
+                "contentId": "[variables('huntingQueryObject60')._huntingQuerycontentId60]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject60').huntingQueryVersion60]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject60')._huntingQuerycontentId60]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Targeted Users (Malware+Phish+Spam)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject60')._huntingQuerycontentId60,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject60')._huntingQuerycontentId60,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject61').huntingQueryTemplateSpecName61]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject61').huntingQueryVersion61]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_61",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| where ThreatTypes has_any (\"Malware\", \"Phish\", \"Spam\")\n| summarize count() by AccountUpn\n| top 10 by count_\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Visualises the top 10 users with click attempts on URLs in emails detected as malware, phishing, or spam, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject61')._huntingQuerycontentId61),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 61",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject61')._huntingQuerycontentId61)]",
+                "contentId": "[variables('huntingQueryObject61')._huntingQuerycontentId61]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject61').huntingQueryVersion61]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject61')._huntingQuerycontentId61]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject61')._huntingQuerycontentId61,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject61')._huntingQuerycontentId61,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject62').huntingQueryTemplateSpecName62]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total number of detections by MDO over time_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject62').huntingQueryVersion62]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_62",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MDO Threat Protection Detections trend over time",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet totalinbound = EmailEvents\n| where TimeGenerated >= TimeStart\n| where EmailDirection == \"Inbound\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Inbound Emails\";\nlet totalintraorg = EmailEvents\n| where TimeGenerated >= TimeStart\n| where EmailDirection == \"Intra-org\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Intra-org Emails\";\nlet totaloutbound = EmailEvents\n| where TimeGenerated >= TimeStart\n| where EmailDirection == \"Outbound\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Outbound Emails\";\nlet totalwiththreat = EmailEvents\n| where TimeGenerated >= TimeStart\n| where isnotempty(ThreatTypes)\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Emails with Threat\";\nlet phishingcount = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ThreatTypes has ('Phish')\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Emails Detected as Phish\";\nlet malwarecount = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ThreatTypes has ('Malware')\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Emails Detected as Malware\";\nlet spamcount = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ThreatTypes has ('Spam')\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Emails Detected as Spam\";\nlet zapcount = EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where ActionResult == \"Success\"\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Emails Removed by ZAP\";\nlet usersubmissioncount = CloudAppEvents\n| where TimeGenerated >= TimeStart\n| extend Record= (parse_json(RawEventData)).RecordType\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\n| where Record == 29 | where ActionType == \"UserSubmission\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Emails Reported by Users\";\nlet adminsubmissioncount = CloudAppEvents\n| where TimeGenerated >= TimeStart\n| extend Record= (parse_json(RawEventData)).RecordType\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\n| where Record == 29\n| where ActionType == \"AdminSubmission\"\n| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Total Emails Reported by Admins\";\nunion totalinbound, totalintraorg, totaloutbound, totalwiththreat, phishingcount, malwarecount, spamcount, zapcount,  usersubmissioncount, adminsubmissioncount\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Graph of MDO detections trended over time"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject62')._huntingQuerycontentId62),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 62",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject62')._huntingQuerycontentId62)]",
+                "contentId": "[variables('huntingQueryObject62')._huntingQuerycontentId62]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject62').huntingQueryVersion62]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject62')._huntingQuerycontentId62]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MDO Threat Protection Detections trend over time",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject62')._huntingQuerycontentId62,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject62')._huntingQuerycontentId62,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject63').huntingQueryTemplateSpecName63]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total number of detections by MDO_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject63').huntingQueryVersion63]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_63",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Total number of detections by MDO",
+                "category": "Hunting Queries",
+                "query": "let totalinbound = EmailEvents\n| where EmailDirection == \"Inbound\"\n| summarize Count = count()\n| extend Details = \"Total Inbound Emails\";\nlet totalintraorg = EmailEvents\n| where EmailDirection == \"Intra-org\"\n| summarize Count = count()\n| extend Details = \"Total Intra-org Emails\";\nlet totaloutbound = EmailEvents\n| where EmailDirection == \"Outbound\"\n| summarize Count = count()\n| extend Details = \"Total Outbound Emails\";\nlet totalwiththreat = EmailEvents\n| where isnotempty(ThreatTypes)\n| summarize Count = count()\n| extend Details = \"Total Emails with Threats\";\nlet phishingcount = EmailEvents\n| where ThreatTypes has ('Phish')\n| summarize Count= count()\n| extend Details = \"Emails Detected as Phish\";\nlet malwarecount = EmailEvents\n| where ThreatTypes has ('Malware')\n| summarize Count= count()\n| extend Details = \"Emails Detected as Malware\";\nlet spamcount = EmailEvents\n| where ThreatTypes has ('Spam')\n| summarize Count= count()\n| extend Details = \"Emails Detected as Spam\";\nlet usersubmissioncount = CloudAppEvents\n| extend Record= (parse_json(RawEventData)).RecordType\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\n| where Record == 29 | where ActionType == \"UserSubmission\"\n| summarize Count= count()\n| extend Details = \"Total Emails Reported by Users\";\nlet adminsubmissioncount = CloudAppEvents\n| extend Record= (parse_json(RawEventData)).RecordType\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\n| where Record == 29 | where ActionType == \"AdminSubmission\"\n| summarize Count= count()\n| extend Details = \"Total Emails Reported by Admins\";\nlet zapcount = EmailPostDeliveryEvents\n| where ActionResult == \"Success\"\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\"\n| summarize Count= count()\n| extend Details = \"Total Emails Removed by ZAP\";\nunion totalinbound, phishingcount, malwarecount, spamcount, totalintraorg, totaloutbound, totalwiththreat, usersubmissioncount, zapcount, adminsubmissioncount\n| project Count, Details\n| order by Count desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Provides a summary of total number of detections"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject63')._huntingQuerycontentId63),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 63",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject63')._huntingQuerycontentId63)]",
+                "contentId": "[variables('huntingQueryObject63')._huntingQuerycontentId63]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject63').huntingQueryVersion63]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject63')._huntingQuerycontentId63]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Total number of detections by MDO",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject63')._huntingQuerycontentId63,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject63')._huntingQuerycontentId63,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject64').huntingQueryTemplateSpecName64]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Automated email notifications and suspicious sign-in activity_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject64').huntingQueryVersion64]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_64",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Automated email notifications and suspicious sign-in activity",
+                "category": "Hunting Queries",
+                "query": "let usersWithSuspiciousEmails = EmailEvents\n| where SenderFromAddress in (\"no-reply@notify.microsoft.com\", \"no-reply@dropbox.com\") or InternetMessageId startswith \"<OneTimePasscode\"\n| where isnotempty(RecipientObjectId)\n| distinct RecipientObjectId;\nAADSignInEventsBeta\n| where AccountObjectId in (usersWithSuspiciousEmails)\n| where RiskLevelDuringSignIn == 100\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for Automated email notifications and suspicious sign-in activity"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject64')._huntingQuerycontentId64),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 64",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject64')._huntingQuerycontentId64)]",
+                "contentId": "[variables('huntingQueryObject64')._huntingQuerycontentId64]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject64').huntingQueryVersion64]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject64')._huntingQuerycontentId64]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Automated email notifications and suspicious sign-in activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject64')._huntingQuerycontentId64,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject64')._huntingQuerycontentId64,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject65').huntingQueryTemplateSpecName65]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "BEC - File sharing tactics - Dropbox_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject65').huntingQueryVersion65]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_65",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "BEC - File sharing tactics - Dropbox",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType in (\"Added users and/or groups to shared file/folder\", \"Invited user to Dropbox and added them to shared file/folder\")\n| where Application == \"Dropbox\"\n| where ObjectType == \"File\"\n| extend FileShared = tostring(ObjectName)\n| where isnotempty(FileShared)\n| mv-expand ActivityObjects\n| where ActivityObjects.Type == \"Account\" and ActivityObjects.Role == \"To\"\n| extend SharedBy = AccountId\n| extend UserSharedWith = tostring(ActivityObjects.Name)\n| summarize dcount(UserSharedWith) by FileShared, AccountObjectId\n| where dcount_UserSharedWith >= 20\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for BEC - File sharing tactics - Dropbox"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1021"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject65')._huntingQuerycontentId65),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 65",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject65')._huntingQuerycontentId65)]",
+                "contentId": "[variables('huntingQueryObject65')._huntingQuerycontentId65]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject65').huntingQueryVersion65]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject65')._huntingQuerycontentId65]",
+        "contentKind": "HuntingQuery",
+        "displayName": "BEC - File sharing tactics - Dropbox",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject65')._huntingQuerycontentId65,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject65')._huntingQuerycontentId65,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject66').huntingQueryTemplateSpecName66]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "BEC - File sharing tactics - OneDrive or SharePoint_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject66').huntingQueryVersion66]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_66",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "BEC - File sharing tactics - OneDrive or SharePoint",
+                "category": "Hunting Queries",
+                "query": "let securelinkCreated = CloudAppEvents\n| where ActionType == \"SecureLinkCreated\"\n| project FileCreatedTime = Timestamp, AccountObjectId, ObjectName;\nlet filesCreated = securelinkCreated\n| where isnotempty(ObjectName)\n| distinct tostring(ObjectName);\nCloudAppEvents\n| where ActionType == \"AddedToSecureLink\"\n| where Application in (\"Microsoft SharePoint Online\", \"Microsoft OneDrive for Business\")\n| extend FileShared = tostring(RawEventData.ObjectId)\n| where FileShared in (filesCreated)\n| extend UserSharedWith = tostring(RawEventData.TargetUserOrGroupName)\n| extend TypeofUserSharedWith = RawEventData.TargetUserOrGroupType\n| where TypeofUserSharedWith == \"Guest\"\n| where isnotempty(FileShared) and isnotempty(UserSharedWith)\n| join kind=inner securelinkCreated on $left.FileShared==$right.ObjectName\n// Secure file created recently (in the last 1day)\n| where (Timestamp - FileCreatedTime) between (1d .. 0h)\n| summarize NumofUsersSharedWith = dcount(UserSharedWith) by FileShared\n| where NumofUsersSharedWith >= 20\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1021"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject66')._huntingQuerycontentId66),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 66",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject66')._huntingQuerycontentId66)]",
+                "contentId": "[variables('huntingQueryObject66')._huntingQuerycontentId66]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject66').huntingQueryVersion66]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject66')._huntingQuerycontentId66]",
+        "contentKind": "HuntingQuery",
+        "displayName": "BEC - File sharing tactics - OneDrive or SharePoint",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject66')._huntingQuerycontentId66,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject66')._huntingQuerycontentId66,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject67').huntingQueryTemplateSpecName67]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Email bombing_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject67').huntingQueryVersion67]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_67",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email bombing attacks",
+                "category": "Hunting Queries",
+                "query": "// Find mail that is older than 4 hrs and establish if it is a reply/forward or not. Join that to recent mail where the User hadn't communicated previously. These are new first contact messages.\nlet Contact_Established = EmailEvents \n| where Timestamp <= ago(4hr)\n| where DeliveryLocation != \"Quarantine\"\nand EmailDirection == \"Inbound\"\nand OrgLevelAction != \"Block\"\nand UserLevelAction != \"Block\"\n| extend NewMsg = case(Subject startswith \"RE:\", false, Subject startswith \"FW:\", false, true )\n| where NewMsg == false\n| project Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress);\n// Find new mail in the last 4hrs.\nEmailEvents\n| where Timestamp > ago(4hr)\nand DeliveryAction == \"Delivered\"\n| extend Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress)\n| where Pair !in (Contact_Established)\n| summarize 5_Min_Count = dcount(NetworkMessageId) by RecipientEmailAddress, bin(Timestamp, 5m)\n| where 5_Min_Count > 5 // check if recipient has received more than 5 first contact emails in 5 mins\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing recipients who are potentially victim of email bombing attacks"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Initialaccess"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject67')._huntingQuerycontentId67),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 67",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject67')._huntingQuerycontentId67)]",
+                "contentId": "[variables('huntingQueryObject67')._huntingQuerycontentId67]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject67').huntingQueryVersion67]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject67')._huntingQuerycontentId67]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email bombing attacks",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject67')._huntingQuerycontentId67,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject67')._huntingQuerycontentId67,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject68').huntingQueryTemplateSpecName68]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Emails containing links to IP addresses_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject68').huntingQueryVersion68]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_68",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Emails containing links to IP addresses",
+                "category": "Hunting Queries",
+                "query": "EmailUrlInfo\n| where Url matches regex @\"file://(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for Emails containing links to IP addresses"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject68')._huntingQuerycontentId68),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 68",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject68')._huntingQuerycontentId68)]",
+                "contentId": "[variables('huntingQueryObject68')._huntingQuerycontentId68]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject68').huntingQueryVersion68]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject68')._huntingQuerycontentId68]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Emails containing links to IP addresses",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject68')._huntingQuerycontentId68,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject68')._huntingQuerycontentId68,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject69').huntingQueryTemplateSpecName69]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Files share contents and suspicious sign-in activity_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject69').huntingQueryVersion69]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_69",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Files share contents and suspicious sign-in activity",
+                "category": "Hunting Queries",
+                "query": "let usersWithSuspiciousEmails = EmailEvents\n| where Subject has_all (\"shared\", \"with you\")\n| where Subject has_any (\"payment\", \"invoice\", \"urgent\", \"mandatory\", \"Payoff\", \"Wire\", \"Confirmation\", \"password\")\n| where isnotempty(RecipientObjectId)\n| summarize RecipientCount = dcount(RecipientObjectId), RecipientList = make_set(RecipientObjectId) by Subject\n| where RecipientCount >= 10\n| mv-expand RecipientList to typeof(string)\n| distinct RecipientList;\nAADSignInEventsBeta\n| where AccountObjectId in (usersWithSuspiciousEmails)\n| where RiskLevelDuringSignIn == 100\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for Files share contents and suspicious sign-in activity"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject69')._huntingQuerycontentId69),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 69",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject69')._huntingQuerycontentId69)]",
+                "contentId": "[variables('huntingQueryObject69')._huntingQuerycontentId69]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject69').huntingQueryVersion69]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject69')._huntingQuerycontentId69]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Files share contents and suspicious sign-in activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject69')._huntingQuerycontentId69,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject69')._huntingQuerycontentId69,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject70').huntingQueryTemplateSpecName70]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Good emails from senders with bad patterns_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject70').huntingQueryVersion70]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_70",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Good emails from senders with bad patterns",
+                "category": "Hunting Queries",
+                "query": "//Good emails from senders with bad patterns\nlet PctPhishThreshold = 50;\nlet LookbackWindow = 1d;\n EmailEvents\n| where Timestamp > ago (LookbackWindow) and EmailDirection == \"Inbound\"\n| extend PhishMethods=tostring(parse_json(DetectionMethods).Phish)\n| where PhishMethods contains (\"File\") or PhishMethods contains (\"URL\") or PhishMethods contains (\"Filter\")\n| summarize PhishCount=count() by SenderMailFromAddress,AuthenticationDetails,PhishMethods\n| join kind=inner (EmailEvents | where Timestamp > ago (LookbackWindow) and EmailDirection == \"Inbound\"\n| summarize TotalCount=count() by SenderMailFromAddress,AuthenticationDetails) on SenderMailFromAddress,AuthenticationDetails\n| project-away SenderMailFromAddress1,AuthenticationDetails1\n| extend PctPhish = (PhishCount*100 / TotalCount)\n| where PctPhish < 100 and PctPhish>= PctPhishThreshold\n| join kind=inner (EmailEvents | where Timestamp > ago (LookbackWindow) and EmailDirection == \"Inbound\" and DeliveryLocation<> \"Quarantine\") on SenderMailFromAddress,AuthenticationDetails\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for good emails from senders with bad patterns"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject70')._huntingQuerycontentId70),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 70",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject70')._huntingQuerycontentId70)]",
+                "contentId": "[variables('huntingQueryObject70')._huntingQuerycontentId70]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject70').huntingQueryVersion70]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject70')._huntingQuerycontentId70]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Good emails from senders with bad patterns",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject70')._huntingQuerycontentId70,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject70')._huntingQuerycontentId70,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject71').huntingQueryTemplateSpecName71]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for email bombing attacks_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject71').huntingQueryVersion71]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_71",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for email bombing attacks",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Inbound\"\n| make-series Emailcount = count()\n              on Timestamp step 1h by RecipientObjectId\n| extend (Anomalies, AnomalyScore, ExpectedEmails) = series_decompose_anomalies(Emailcount)\n| mv-expand Emailcount, Anomalies, AnomalyScore, ExpectedEmails to typeof(double), Timestamp\n| where Anomalies != 0\n| where AnomalyScore >= 10\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps to hunt for possible email bombing attacks in Microsoft Defender for Office 365."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject71')._huntingQuerycontentId71),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 71",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject71')._huntingQuerycontentId71)]",
+                "contentId": "[variables('huntingQueryObject71')._huntingQuerycontentId71]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject71').huntingQueryVersion71]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject71')._huntingQuerycontentId71]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for email bombing attacks",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject71')._huntingQuerycontentId71,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject71')._huntingQuerycontentId71,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject72').huntingQueryTemplateSpecName72]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for email conversation take over attempts_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject72').huntingQueryVersion72]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_72",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for email conversation take over attempts",
+                "category": "Hunting Queries",
+                "query": "let emailDelivered = EmailEvents\n| where Timestamp < ago(4hrs)\nand DeliveryAction == \"Delivered\"\n| extend Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress)\n| distinct Pair;\nlet EmailDomains = EmailEvents\n| where Timestamp < ago(4hrs)\nand DeliveryAction == \"Delivered\"\n| distinct SenderFromDomain;\nEmailEvents\n| where Timestamp >= ago(4hrs)\n| where DeliveryLocation != \"Quarantine\"\nand EmailDirection == \"Inbound\"\nand OrgLevelAction != \"Block\"\nand UserLevelAction != \"Block\"\n| extend NewMsg = case(Subject contains \"RE:\", false, Subject contains \"FW:\", false, true )\n| project Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress), NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject\n| join kind=leftouter ( emailDelivered ) on Pair\n| order by SenderMailFromAddress\n| where NewMsg == false\nand Pair1 == \"\"\n| join kind=leftouter (EmailDomains) on SenderFromDomain\n| where SenderFromDomain1 == \"\"\n| distinct Pair, NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for email conversation take over attempts"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject72')._huntingQuerycontentId72),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 72",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject72')._huntingQuerycontentId72)]",
+                "contentId": "[variables('huntingQueryObject72')._huntingQuerycontentId72]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject72').huntingQueryVersion72]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject72')._huntingQuerycontentId72]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for email conversation take over attempts",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject72')._huntingQuerycontentId72,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject72')._huntingQuerycontentId72,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject73').huntingQueryTemplateSpecName73]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for malicious attachments using external IOC source_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject73').huntingQueryVersion73]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_73",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for malicious attachments using external IOC source",
+                "category": "Hunting Queries",
+                "query": "let abuse_sha256 = (externaldata(sha256_hash: string)\n[@\"https://bazaar.abuse.ch/export/txt/sha256/recent/\"]\nwith (format=\"txt\"))\n| where sha256_hash !startswith \"#\"\n| project sha256_hash;\nabuse_sha256\n| join (EmailAttachmentInfo\n| where Timestamp > ago(1d)\n) on $left.sha256_hash == $right.SHA256\n| project Timestamp,SenderFromAddress,RecipientEmailAddress,FileName,FileType,SHA256,ThreatTypes,DetectionMethods,NetworkMessageId,ReportId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for emails with malicious attachments based on SH256 hash from external IOC source"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject73')._huntingQuerycontentId73),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 73",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject73')._huntingQuerycontentId73)]",
+                "contentId": "[variables('huntingQueryObject73')._huntingQuerycontentId73]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject73').huntingQueryVersion73]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject73')._huntingQuerycontentId73]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for malicious attachments using external IOC source",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject73')._huntingQuerycontentId73,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject73')._huntingQuerycontentId73,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject74').huntingQueryTemplateSpecName74]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for malicious URLs using external IOC source_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject74').huntingQueryVersion74]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_74",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for malicious URLs using external IOC source",
+                "category": "Hunting Queries",
+                "query": "let url = (externaldata(url: string )\n[@\"https://urlhaus.abuse.ch/downloads/text_online/\"]\nwith (format=\"txt\"))\n| project url;\nurl\n| join (EmailUrlInfo\n| where Timestamp > ago(2h) \n) on $left.url == $right.Url\n|join EmailEvents on NetworkMessageId\n|project Timestamp, NetworkMessageId, Url, UrlLocation, UrlDomain, SenderFromAddress, SenderDisplayName, SenderIPv4, Subject,RecipientEmailAddress, RecipientObjectId, LatestDeliveryAction, ThreatNames, ThreatTypes, DetectionMethods, DeliveryAction,ReportId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for emails with malicious URLs based on external IOC source"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject74')._huntingQuerycontentId74),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 74",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject74')._huntingQuerycontentId74)]",
+                "contentId": "[variables('huntingQueryObject74')._huntingQuerycontentId74]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject74').huntingQueryVersion74]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject74')._huntingQuerycontentId74]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for malicious URLs using external IOC source",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject74')._huntingQuerycontentId74,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject74')._huntingQuerycontentId74,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject75').huntingQueryTemplateSpecName75]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Inbox rule change which forward-redirect email_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject75').huntingQueryVersion75]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_75",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Inbox rule changes which forward-redirect email",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType contains \"Set-InboxRule\"\n|extend Parameters = tostring((parse_json(RawEventData)).Parameters)\n|where Parameters contains \"ForwardTo\" or Parameters contains \"RedirectTo\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for Inbox rule changes which forward-redirect email"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1098"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject75')._huntingQuerycontentId75),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 75",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject75')._huntingQuerycontentId75)]",
+                "contentId": "[variables('huntingQueryObject75')._huntingQuerycontentId75]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject75').huntingQueryVersion75]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject75')._huntingQuerycontentId75]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Inbox rule changes which forward-redirect email",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject75')._huntingQuerycontentId75,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject75')._huntingQuerycontentId75,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject76').huntingQueryTemplateSpecName76]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MDO_CountOfRecipientsEmailaddressbySubject_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject76').huntingQueryVersion76]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_76",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MDO_CountOfRecipientsEmailaddressbySubject",
+                "category": "Hunting Queries",
+                "query": "//Count of recipient's email addresses by subject\nEmailEvents\n//Change the date for as far back as you want to go\n| where Timestamp > ago(10d)\n| summarize CountRecipientEmailAddress=count() by RecipientEmailAddress, Subject\n//Change the Count of how many times the email with the same subject has come in\n| where CountRecipientEmailAddress >= 15\n| project RecipientEmailAddress, CountRecipientEmailAddress, Subject\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Count of recipient's email addresses by subject"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject76')._huntingQuerycontentId76),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 76",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject76')._huntingQuerycontentId76)]",
+                "contentId": "[variables('huntingQueryObject76')._huntingQuerycontentId76]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject76').huntingQueryVersion76]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject76')._huntingQuerycontentId76]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MDO_CountOfRecipientsEmailaddressbySubject",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject76')._huntingQuerycontentId76,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject76')._huntingQuerycontentId76,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject77').huntingQueryTemplateSpecName77]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MDO_Countofrecipientsemailaddressesbysubject_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject77').huntingQueryVersion77]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_77",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MDO_Countofrecipientsemailaddressesbysubject",
+                "category": "Hunting Queries",
+                "query": "//Count of recipient's email addresses by subject\nEmailEvents\n//Change the date for as far back as you want to go\n| where Timestamp > ago(10d)\n| summarize CountRecipientEmailAddress=count() by RecipientEmailAddress, Subject\n//Change the Count of how many times the email with the same subject has come in\n| where CountRecipientEmailAddress >= 15\n| project RecipientEmailAddress, CountRecipientEmailAddress, Subject\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Count of recipient's email addresses by subject"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject77')._huntingQuerycontentId77),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 77",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject77')._huntingQuerycontentId77)]",
+                "contentId": "[variables('huntingQueryObject77')._huntingQuerycontentId77]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject77').huntingQueryVersion77]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject77')._huntingQuerycontentId77]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MDO_Countofrecipientsemailaddressesbysubject",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject77')._huntingQuerycontentId77,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject77')._huntingQuerycontentId77,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject78').huntingQueryTemplateSpecName78]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MDO_CountOfSendersEmailaddressbySubject_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject78').huntingQueryVersion78]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_78",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MDO_CountOfSendersEmailaddressbySubject",
+                "category": "Hunting Queries",
+                "query": "//Count of sender's email addresses by subject\nEmailEvents\n//Change the date for as far back as you want to go\n| where Timestamp > ago(10d)\n| summarize CountSenderFromAddress=count() by SenderFromAddress, Subject\n//Change the Count of how many times the email with the same subject has come in\n| where CountSenderFromAddress >= 10\n| project SenderFromAddress, CountSenderFromAddress, Subject\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Count of sender's email addresses by subject"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject78')._huntingQuerycontentId78),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 78",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject78')._huntingQuerycontentId78)]",
+                "contentId": "[variables('huntingQueryObject78')._huntingQuerycontentId78]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject78').huntingQueryVersion78]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject78')._huntingQuerycontentId78]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MDO_CountOfSendersEmailaddressbySubject",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject78')._huntingQuerycontentId78,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject78')._huntingQuerycontentId78,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject79').huntingQueryTemplateSpecName79]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MDO_SummaryOfSenders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject79').huntingQueryVersion79]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_79",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MDO_SummaryOfSenders",
+                "category": "Hunting Queries",
+                "query": "//Distinct Count\nEmailEvents\n| summarize QuaratineEmails = count_distinct(DeliveryLocation == \"Quarantine\"),\n  Emails = count_distinct(DeliveryLocation == \"Inbox/folder\"),\n  JunkEmails = count_distinct(DeliveryLocation == \"Junk folder\")by SenderFromAddress\n\n//Count of all Senders and where they were delivered\nEmailEvents\n| summarize QuaratineEmails = count(DeliveryLocation == \"Quarantine\"),\n  Emails = count(DeliveryLocation == \"Inbox/folder\"),\n  JunkEmails = count(DeliveryLocation == \"Junk folder\")by SenderFromAddress\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Count of all Senders and where they were delivered"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject79')._huntingQuerycontentId79),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 79",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject79')._huntingQuerycontentId79)]",
+                "contentId": "[variables('huntingQueryObject79')._huntingQuerycontentId79]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject79').huntingQueryVersion79]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject79')._huntingQuerycontentId79]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MDO_SummaryOfSenders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject79')._huntingQuerycontentId79,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject79')._huntingQuerycontentId79,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject80').huntingQueryTemplateSpecName80]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MDO_URLClickedinEmail_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject80').huntingQueryVersion80]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_80",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MDO_URLClickedinEmail",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| where ActionType == \"ClickAllowed\"\n//| where ActionType <> \"ClickAllowed\"\n| project AccountUpn, ActionType, Url\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "URLs clicked in Email"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject80')._huntingQuerycontentId80),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 80",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject80')._huntingQuerycontentId80)]",
+                "contentId": "[variables('huntingQueryObject80')._huntingQuerycontentId80]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject80').huntingQueryVersion80]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject80')._huntingQuerycontentId80]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MDO_URLClickedinEmail",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject80')._huntingQuerycontentId80,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject80')._huntingQuerycontentId80,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject81').huntingQueryTemplateSpecName81]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top outbound recipient domains sending inbound emails with threats_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject81').huntingQueryVersion81]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_81",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top outbound recipient domains sending inbound emails with threats",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Outbound\"\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\n| summarize count() by RecipientDomain\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\n| join (EmailEvents | where EmailDirection == \"Inbound\" and isempty(ThreatTypes)==false) on SenderFromDomain\n| summarize max(OutboundCount),count() by SenderFromDomain\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\n| sort by OutboundEmails\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for top outbound recipient domains which are sending inbound emails with threats"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject81')._huntingQuerycontentId81),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 81",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject81')._huntingQuerycontentId81)]",
+                "contentId": "[variables('huntingQueryObject81')._huntingQuerycontentId81]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject81').huntingQueryVersion81]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject81')._huntingQuerycontentId81]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top outbound recipient domains sending inbound emails with threats",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject81')._huntingQuerycontentId81,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject81')._huntingQuerycontentId81,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject82').huntingQueryTemplateSpecName82]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Detections by detection methods_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject82').huntingQueryVersion82]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_82",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Detections by detection methods",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(7d)\n| where isnotempty(DetectionMethods)\n| extend MDO_detection = parse_json(DetectionMethods)\n| summarize TotalEmailCount = count(),\n            Phish_detection = countif(isnotempty(MDO_detection.Phish)),\n            Malware_detection = countif(isnotempty(MDO_detection.Malware)),\n            Spam_detection = countif(isnotempty( MDO_detection.Spam)),\n            URL_malicious_reputation = countif(MDO_detection.Phish == @'[\"URL malicious reputation\"]' or MDO_detection.Malware == @'[\"URL malicious reputation\"]'),\n            URL_detonation_reputation = countif(MDO_detection.Phish == @'[\"URL detonation reputation\"]' or MDO_detection.Malware == @'[\"URL detonation reputation\"]'),\n            URL_detonation = countif(MDO_detection.Phish == @'[\"URL detonation\"]' or MDO_detection.Malware == @'[\"URL detonation\"]'),\n            Advanced_filter = countif(MDO_detection.Phish == @'[\"Advanced filter\"]'),\n            General_filter = countif(MDO_detection.Phish == @'[\"General filter\"]'),\n            Spoof_intra_org = countif(MDO_detection.Phish == @'[\"Spoof intra-org\"]'),\n            Spoof_external_domain = countif(MDO_detection.Phish ==  @'[\"Spoof external domain\"]'),\n            Spoof_DMARC = countif(MDO_detection.Phish == @'[\"Spoof DMARC\"]'),\n            Impersonation_brand = countif(MDO_detection.Phish == @'[\"Impersonation brand\"]'),\n            Impersonation_user = countif(MDO_detection.Phish == @'[\"Impersonation user\"]'),\n            Impersonation_domain = countif(MDO_detection.Phish == @'[\"Impersonation domain\"]'),\n            Mixed_analysis_detection= countif(MDO_detection.Phish == @'[\"Mixed analysis detection\"]'),\n            File_reputation = countif(MDO_detection.Phish == @'[\"File reputation\"]' or MDO_detection.Malware == @'[\"File reputation\"]'),\n            File_detonation = countif(MDO_detection.Phish == @'[\"File detonation\"]' or MDO_detection.Malware == @'[\"File detonation\"]'),\n            File_detonation_reputation = countif(MDO_detection.Phish == @'[\"File detonation reputation\"]' or MDO_detection.Malware == @'[\"File detonation reputation\"]'),\n            Antimalware_engine = countif(MDO_detection.Malware == @'[\"Antimalware engine\"]'),\n            Fingerprint_matching = countif(MDO_detection.Phish == @'[\"Fingerprint matching\"]'), \n            Mailbox_intelligence_impersonation = countif(MDO_detection.Phish == @'[\"Mailbox intelligence impersonation\"]'),\n            Campaign = countif(MDO_detection.Phish == @'[\"Campaign\"]' or MDO_detection.Malware == @'[\"Campaign\"]') by bin(Timestamp, 1d)\n| project Timestamp, TotalEmailCount, Phish_detection, Malware_detection, Spam_detection,URL_malicious_reputation,URL_detonation_reputation ,URL_detonation,Advanced_filter, General_filter,Spoof_intra_org,Spoof_external_domain,Spoof_DMARC,Impersonation_brand,Impersonation_user,Impersonation_domain,\nMixed_analysis_detection,File_reputation,File_detonation,File_detonation_reputation,Antimalware_engine,Fingerprint_matching,Mailbox_intelligence_impersonation,Campaign\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing malicious email detections by detection methods"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject82')._huntingQuerycontentId82),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 82",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject82')._huntingQuerycontentId82)]",
+                "contentId": "[variables('huntingQueryObject82')._huntingQuerycontentId82]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject82').huntingQueryVersion82]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject82')._huntingQuerycontentId82]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Detections by detection methods",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject82')._huntingQuerycontentId82,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject82')._huntingQuerycontentId82,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject83').huntingQueryTemplateSpecName83]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Mail reply to new domain_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject83').huntingQueryVersion83]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_83",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Mail reply to new domain",
+                "category": "Hunting Queries",
+                "query": "let emailDelivered = EmailEvents\n| where Timestamp < ago(4hrs)\nand DeliveryAction == \"Delivered\"\n| extend Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress)\n| distinct Pair;\nlet EmailDomains = EmailEvents\n| where Timestamp < ago(4hrs)\nand DeliveryAction == \"Delivered\"\n| distinct SenderFromDomain;\nEmailEvents \n| where Timestamp >= ago(4hrs)\n| where DeliveryLocation != \"Quarantine\"\n and EmailDirection == \"Inbound\" \n and OrgLevelAction != \"Block\"\n and UserLevelAction != \"Block\"\n| extend NewMsg = case(Subject contains \"RE:\", false, Subject contains \"FW:\", false, true )\n| project Pair = strcat(SenderMailFromAddress,\"|\",RecipientEmailAddress), NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject \n| join kind=leftouter ( emailDelivered ) on Pair\n| order by SenderMailFromAddress\n| where NewMsg == false\nand Pair1 == \"\"\n| join kind=leftouter (EmailDomains) on SenderFromDomain\n| where SenderFromDomain1 == \"\"\n| distinct Pair, NetworkMessageId, SenderFromDomain, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, ThreatTypes, DetectionMethods, NewMsg, Subject\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing mail that is likely a reply but there is no history of the people chatting and the domain is new"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject83')._huntingQuerycontentId83),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 83",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject83')._huntingQuerycontentId83)]",
+                "contentId": "[variables('huntingQueryObject83')._huntingQuerycontentId83]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject83').huntingQueryVersion83]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject83')._huntingQuerycontentId83]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Mail reply to new domain",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject83')._huntingQuerycontentId83,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject83')._huntingQuerycontentId83,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject84').huntingQueryTemplateSpecName84]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Mailflow by directionality_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject84').huntingQueryVersion84]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_84",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Mailflow by directionality",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where Timestamp > ago(30d)\n| extend domain = substring(RecipientEmailAddress, indexof(RecipientEmailAddress, \"@\")+1) \n| summarize total=count() by EmailDirection, domain, bin(Timestamp, 1d) \n| order by Timestamp asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing inbound / outbound / intra-org emails by domain per day"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject84')._huntingQuerycontentId84),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 84",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject84')._huntingQuerycontentId84)]",
+                "contentId": "[variables('huntingQueryObject84')._huntingQuerycontentId84]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject84').huntingQueryVersion84]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject84')._huntingQuerycontentId84]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Mailflow by directionality",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject84')._huntingQuerycontentId84,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject84')._huntingQuerycontentId84,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject85').huntingQueryTemplateSpecName85]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malicious emails detected per day_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject85').huntingQueryVersion85]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_85",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious emails detected per day",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where DetectionMethods != \"\" \n| extend detection= parse_json(DetectionMethods) \n| extend Spam = tostring(detection.Spam) \n| extend Phish = tostring(detection.Phish) \n| extend Malware = tostring(detection.Malware) \n| where Spam != '' or Phish != '' or Malware != '' \n| extend detection = case( \n    Malware != \"\", 'Malware', \n    Phish != \"\", 'Phish', \n    'Spam') \n| summarize total=count() by detection, bin(Timestamp, 1d) \n| order by Timestamp asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing Malware, Phishing, Spam emails caught per day"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject85')._huntingQuerycontentId85),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 85",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject85')._huntingQuerycontentId85)]",
+                "contentId": "[variables('huntingQueryObject85')._huntingQuerycontentId85]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject85').huntingQueryVersion85]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject85')._huntingQuerycontentId85]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious emails detected per day",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject85')._huntingQuerycontentId85,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject85')._huntingQuerycontentId85,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject86').huntingQueryTemplateSpecName86]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Sender recipient contact establishment_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject86').huntingQueryVersion86]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_86",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Sender recipient contact establishment",
+                "category": "Hunting Queries",
+                "query": "let emailDelivered = EmailEvents\n| where Timestamp < ago(30d)\nand DeliveryAction == \"Delivered\"\nand SenderDisplayName contains \"Microsoft\"\n| summarize count() by SenderFromAddress\n| where count_ > 3 // ensuring that some level of communications has occured.\n| project SenderFromAddress;\nEmailEvents \n| where Timestamp > ago(24hrs)\n| where DeliveryAction == \"Delivered\"\n and EmailDirection == \"Inbound\" \n and OrgLevelAction != \"Block\"\n and UserLevelAction != \"Block\"\n and SenderDisplayName contains \"Microsoft\" //Change the name here\n| extend NewMsg = case(Subject contains \"RE:\", false, Subject contains \"FW:\", false, true )\n| project SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject \n| join kind=leftanti  ( emailDelivered ) on SenderFromAddress\n| order by SenderMailFromAddress\n| summarize count() by SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps in checking the sender-recipient contact establishment status"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject86')._huntingQuerycontentId86),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 86",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject86')._huntingQuerycontentId86)]",
+                "contentId": "[variables('huntingQueryObject86')._huntingQuerycontentId86]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject86').huntingQueryVersion86]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject86')._huntingQuerycontentId86]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Sender recipient contact establishment",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject86')._huntingQuerycontentId86,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject86')._huntingQuerycontentId86,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject87').huntingQueryTemplateSpecName87]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detections by Delivery Location - High_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject87').huntingQueryVersion87]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_87",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam Detections (High) by delivery location",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ConfidenceLevel has_any ('Spam\":\"High')\n| summarize count() by LatestDeliveryLocation\n| sort by count_ desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails with Spam detections (High confidence) summarizing the data by Delivery Location."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject87')._huntingQuerycontentId87),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 87",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject87')._huntingQuerycontentId87)]",
+                "contentId": "[variables('huntingQueryObject87')._huntingQuerycontentId87]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject87').huntingQueryVersion87]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject87')._huntingQuerycontentId87]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam Detections (High) by delivery location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject87')._huntingQuerycontentId87,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject87')._huntingQuerycontentId87,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject88').huntingQueryTemplateSpecName88]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detections by Delivery Location - Medium_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject88').huntingQueryVersion88]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_88",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam Detections (Normal) by delivery location",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ConfidenceLevel has_any ('Spam\":\"Normal')\n| summarize count() by LatestDeliveryLocation\n| sort by count_ desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails with Spam detections (Normal confidence) summarizing the data by Delivery Location."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject88')._huntingQuerycontentId88),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 88",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject88')._huntingQuerycontentId88)]",
+                "contentId": "[variables('huntingQueryObject88')._huntingQuerycontentId88]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject88').huntingQueryVersion88]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject88')._huntingQuerycontentId88]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam Detections (Normal) by delivery location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject88')._huntingQuerycontentId88,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject88')._huntingQuerycontentId88,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject89').huntingQueryTemplateSpecName89]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 100 malicious email senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject89').huntingQueryVersion89]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_89",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 100 malicious email senders",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where ThreatTypes has \"Phish\" or ThreatTypes has \"Malware\" \n| summarize total=count() by SenderMailFromAddress \n| top 100 by total\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing top 100 malicious senders"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject89')._huntingQuerycontentId89),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 89",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject89')._huntingQuerycontentId89)]",
+                "contentId": "[variables('huntingQueryObject89')._huntingQuerycontentId89]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject89').huntingQueryVersion89]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject89')._huntingQuerycontentId89]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 100 malicious email senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject89')._huntingQuerycontentId89,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject89')._huntingQuerycontentId89,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject90').huntingQueryTemplateSpecName90]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 100 senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject90').huntingQueryVersion90]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_90",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 100 senders",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where Timestamp > ago(30d)\n| summarize mailCountBySender = count() by SenderMailFromAddress \n| top 100 by mailCountBySender\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing top 100 senders in your organization in last 30 days"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject90')._huntingQuerycontentId90),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 90",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject90')._huntingQuerycontentId90)]",
+                "contentId": "[variables('huntingQueryObject90')._huntingQuerycontentId90]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject90').huntingQueryVersion90]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject90')._huntingQuerycontentId90]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 100 senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject90')._huntingQuerycontentId90,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject90')._huntingQuerycontentId90,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject91').huntingQueryTemplateSpecName91]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Zero day threats_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject91').huntingQueryVersion91]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_91",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Zero day threats",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where Timestamp > ago(30d) \n| where DetectionMethods has \"URL Detonation\" or DetectionMethods has \"File Detonation\" \n| count\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing zero day threats via URL and file detonations"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject91')._huntingQuerycontentId91),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 91",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject91')._huntingQuerycontentId91)]",
+                "contentId": "[variables('huntingQueryObject91')._huntingQuerycontentId91]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject91').huntingQueryVersion91]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject91')._huntingQuerycontentId91]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Zero day threats",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject91')._huntingQuerycontentId91,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject91')._huntingQuerycontentId91,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject92').huntingQueryTemplateSpecName92]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Email containing malware accessed on a unmanaged device_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject92').huntingQueryVersion92]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_92",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email containing malware accessed on a unmanaged device",
+                "category": "Hunting Queries",
+                "query": "EmailPostDeliveryEvents\n| where ActionType == \"Malware ZAP\"\n| project NetworkMessageId,InternetMessageId,ActionType,ThreatTypes,DetectionMethods,ZAPReportId=ReportId,ZAPTimestamp=Timestamp\n| join (CloudAppEvents | where ActionType == \"MailItemsAccessed\"\n| extend RawEvent=parse_json(RawEventData)\n| mv-expand RawEvent.Folders\n| mv-expand RawEvent_Folders.FolderItems\n| project SessionId=tostring(RawEvent.SessionId),InternetMessageId=tostring(parse_json(RawEvent_Folders_FolderItems).InternetMessageId),ActionTimestamp=Timestamp,ActionReportId=ReportId\n) on InternetMessageId\n| where isnotempty(SessionId)\n| join (AADSignInEventsBeta | where isempty(DeviceName) | distinct AccountUpn,SessionId) on SessionId\n| project AccountUpn,NetworkMessageId,InternetMessageId,ActionType,ThreatTypes,DetectionMethods,SessionId,ReportId=ActionReportId,Timestamp=ActionTimestamp\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we are looking for emails containing malware accessed on a unmanaged device"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1204"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject92')._huntingQuerycontentId92),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 92",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject92')._huntingQuerycontentId92)]",
+                "contentId": "[variables('huntingQueryObject92')._huntingQuerycontentId92]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject92').huntingQueryVersion92]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject92')._huntingQuerycontentId92]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email containing malware accessed on a unmanaged device",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject92')._huntingQuerycontentId92,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject92')._huntingQuerycontentId92,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject93').huntingQueryTemplateSpecName93]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Email containing malware sent by an internal sender_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject93').huntingQueryVersion93]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_93",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email containing malware sent by an internal sender",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where EmailDirection == \"Intra-org\" or EmailDirection == \"Outbound\"\n| where ThreatTypes == \"Malware\" and SenderFromAddress !startswith \"postmaster@\" and SenderFromAddress !startswith \"microsoftexchange\"\n| join (EmailAttachmentInfo | where isnotempty(ThreatTypes)) on NetworkMessageId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we are looking for emails containing malware attachment sent by an internal sender"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1534"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject93')._huntingQuerycontentId93),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 93",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject93')._huntingQuerycontentId93)]",
+                "contentId": "[variables('huntingQueryObject93')._huntingQuerycontentId93]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject93').huntingQueryVersion93]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject93')._huntingQuerycontentId93]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email containing malware sent by an internal sender",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject93')._huntingQuerycontentId93,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject93')._huntingQuerycontentId93,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject94').huntingQueryTemplateSpecName94]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Email malware detection report_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject94').huntingQueryVersion94]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_94",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email malware detection report",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatNames)\n| join kind=inner EmailAttachmentInfo on NetworkMessageId \n| extend ThreatFamilyAttachment = strcat(format_datetime(Timestamp,'yyyy-M-dd H:mm:ss'), \" /\", ThreatNames, \" /\", FileName, \" /\", NetworkMessageId)\n| summarize ThreatFamily_wih_Attachment= make_list(ThreatFamilyAttachment) by RecipientEmailAddress\n| extend Case = array_length(ThreatFamily_wih_Attachment)\n| project RecipientEmailAddress, Case, ThreatFamily_wih_Attachment \n| sort by Case desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing email malware detection cases"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject94')._huntingQuerycontentId94),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 94",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject94')._huntingQuerycontentId94)]",
+                "contentId": "[variables('huntingQueryObject94')._huntingQuerycontentId94]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject94').huntingQueryVersion94]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject94')._huntingQuerycontentId94]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email malware detection report",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject94')._huntingQuerycontentId94,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject94')._huntingQuerycontentId94,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject95').huntingQueryTemplateSpecName95]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Malware Detection Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject95').huntingQueryVersion95]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_95",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Malware Detection Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nCloudAppEvents\n| where TimeGenerated >= TimeStart\n| where ActionType == 'FileMalwareDetected'\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject95')._huntingQuerycontentId95),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 95",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject95')._huntingQuerycontentId95)]",
+                "contentId": "[variables('huntingQueryObject95')._huntingQuerycontentId95]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject95').huntingQueryVersion95]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject95')._huntingQuerycontentId95]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Malware Detection Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject95')._huntingQuerycontentId95,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject95')._huntingQuerycontentId95,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject96').huntingQueryTemplateSpecName96]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Malware Top Families by AV_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject96').huntingQueryVersion96]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_96",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Malware by Top Malware Families (Anti Virus)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == 'FileMalwareDetected' and isempty(UserAgent)\n| project ObjectName, UserAgent, RawinfoVirusInfo = RawEventData.VirusInfo\n| summarize count() by tostring(RawinfoVirusInfo) | sort by count_\n| render piechart\n// | render columnchart // Uncomment to change the graph type\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on built-in SharePoint AV detections"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject96')._huntingQuerycontentId96),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 96",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject96')._huntingQuerycontentId96)]",
+                "contentId": "[variables('huntingQueryObject96')._huntingQuerycontentId96]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject96').huntingQueryVersion96]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject96')._huntingQuerycontentId96]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Malware by Top Malware Families (Anti Virus)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject96')._huntingQuerycontentId96,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject96')._huntingQuerycontentId96,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject97').huntingQueryTemplateSpecName97]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Malware Top Families by Safe Attachments_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject97').huntingQueryVersion97]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_97",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Malware by Top Malware Families (Safe Attachments)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == 'FileMalwareDetected' and UserAgent =~ 'MS Scanner ATP'\n| project ObjectName, UserAgent, RawinfoVirusInfo = RawEventData.VirusInfo\n| summarize count() by tostring(RawinfoVirusInfo) | sort by count_\n| render piechart\n// | render columnchart // Uncomment to change the graph type\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject97')._huntingQuerycontentId97),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 97",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject97')._huntingQuerycontentId97)]",
+                "contentId": "[variables('huntingQueryObject97')._huntingQuerycontentId97]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject97').huntingQueryVersion97]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject97')._huntingQuerycontentId97]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Malware by Top Malware Families (Safe Attachments)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject97')._huntingQuerycontentId97,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject97')._huntingQuerycontentId97,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject98').huntingQueryTemplateSpecName98]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware Detection Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject98').huntingQueryVersion98]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_98",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\"\n| make-series MalwareDetections = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Malware detections over time summarizing the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject98')._huntingQuerycontentId98),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 98",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject98')._huntingQuerycontentId98)]",
+                "contentId": "[variables('huntingQueryObject98')._huntingQuerycontentId98]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject98').huntingQueryVersion98]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject98')._huntingQuerycontentId98]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject98')._huntingQuerycontentId98,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject98')._huntingQuerycontentId98,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject99').huntingQueryTemplateSpecName99]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware Detections by Delivery Location_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject99').huntingQueryVersion99]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_99",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware Detections by delivery location",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\" and EmailDirection == \"Inbound\"\n| make-series TotalMalwareDetections = count(), Quarantine = countif(DeliveryLocation == \"Quarantine\"), Failed = countif(DeliveryLocation == \"Failed\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject99')._huntingQuerycontentId99),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 99",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject99')._huntingQuerycontentId99)]",
+                "contentId": "[variables('huntingQueryObject99')._huntingQuerycontentId99]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject99').huntingQueryVersion99]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject99')._huntingQuerycontentId99]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware Detections by delivery location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject99')._huntingQuerycontentId99,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject99')._huntingQuerycontentId99,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject100').huntingQueryTemplateSpecName100]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware Detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject100').huntingQueryVersion100]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_100",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware Detections by Detection technology Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\"\n| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)\n| where isnotempty(MalwareMethod)\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by MalwareMethod\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject100')._huntingQuerycontentId100),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 100",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject100')._huntingQuerycontentId100)]",
+                "contentId": "[variables('huntingQueryObject100')._huntingQuerycontentId100]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject100').huntingQueryVersion100]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject100')._huntingQuerycontentId100]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware Detections by Detection technology Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject100')._huntingQuerycontentId100,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject100')._huntingQuerycontentId100,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject101').huntingQueryTemplateSpecName101]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware Detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject101').huntingQueryVersion101]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_101",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware Detections by Detection technology",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\"\n| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)\n| where isnotempty(MalwareMethod)\n| summarize Count = count() by MalwareMethod\n| sort by Count desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject101')._huntingQuerycontentId101),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 101",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject101')._huntingQuerycontentId101)]",
+                "contentId": "[variables('huntingQueryObject101')._huntingQuerycontentId101]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject101').huntingQueryVersion101]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject101')._huntingQuerycontentId101]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware Detections by Detection technology",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject101')._huntingQuerycontentId101,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject101')._huntingQuerycontentId101,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject102').huntingQueryTemplateSpecName102]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware detections by Workload Locations_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject102').huntingQueryVersion102]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_102",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware detections by Workload Locations",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == 'FileMalwareDetected'\n| project location=(split(RawEventData.SiteUrl, '/')[4])\n| summarize count() by tostring(location)\n| sort by count_ desc\n| render columnchart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject102')._huntingQuerycontentId102),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 102",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject102')._huntingQuerycontentId102)]",
+                "contentId": "[variables('huntingQueryObject102')._huntingQuerycontentId102]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject102').huntingQueryVersion102]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject102')._huntingQuerycontentId102]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware detections by Workload Locations",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject102')._huntingQuerycontentId102,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject102')._huntingQuerycontentId102,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject103').huntingQueryTemplateSpecName103]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware detections by Workload Type_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject103').huntingQueryVersion103]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_103",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware detections by Workload Type",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == 'FileMalwareDetected'\n| extend Appwithteams = iff(Application =~ 'Microsoft SharePoint Online',strcat(Application,' / Teams Files'),Application)\n| extend Appwithteams = trim_start('Microsoft',Appwithteams) | summarize count() by Appwithteams\n| sort by count_ desc\n| render piechart\n// | render columnchart // Uncomment to change the graph type\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject103')._huntingQuerycontentId103),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 103",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject103')._huntingQuerycontentId103)]",
+                "contentId": "[variables('huntingQueryObject103')._huntingQuerycontentId103]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject103').huntingQueryVersion103]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject103')._huntingQuerycontentId103]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware detections by Workload Type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject103')._huntingQuerycontentId103,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject103')._huntingQuerycontentId103,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject104').huntingQueryTemplateSpecName104]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Domains sending Malware_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject104').huntingQueryVersion104]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_104",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email Top Domains sending Malware",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by SenderFromDomain\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where MalwareEmailCount != 0\n| top 15 by MalwareEmailCount\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain)"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject104')._huntingQuerycontentId104),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 104",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject104')._huntingQuerycontentId104)]",
+                "contentId": "[variables('huntingQueryObject104')._huntingQuerycontentId104]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject104').huntingQueryVersion104]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject104')._huntingQuerycontentId104]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email Top Domains sending Malware",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject104')._huntingQuerycontentId104,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject104')._huntingQuerycontentId104,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject105').huntingQueryTemplateSpecName105]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Email Malware Families_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject105').huntingQueryVersion105]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_105",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Malware Families",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where isnotempty(ThreatNames) and ThreatTypes has \"Malware\"\n| mv-expand ThreatName = split(ThreatNames, \",\") to typeof(string)\n| where isnotempty(ThreatName)\n| distinct Key, ThreatName\n| summarize Count = count() by ThreatName\n| top 15 by Count\n| project ['Threat Name'] = ThreatName, Count\n| render columnchart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject105')._huntingQuerycontentId105),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 105",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject105')._huntingQuerycontentId105)]",
+                "contentId": "[variables('huntingQueryObject105')._huntingQuerycontentId105]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject105').huntingQueryVersion105]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject105')._huntingQuerycontentId105]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Malware Families",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject105')._huntingQuerycontentId105,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject105')._huntingQuerycontentId105,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject106').huntingQueryTemplateSpecName106]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Users receiving Malware_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject106').huntingQueryVersion106]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_106",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Users receiving Malware",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by RecipientEmailAddress\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where MalwareEmailCount != 0\n| top 15 by MalwareEmailCount\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total inbound emails with Malware detections summarizing the data by the top recipient email address (RecipientEmailAddress)"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject106')._huntingQuerycontentId106),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 106",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject106')._huntingQuerycontentId106)]",
+                "contentId": "[variables('huntingQueryObject106')._huntingQuerycontentId106]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject106').huntingQueryVersion106]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject106')._huntingQuerycontentId106]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Users receiving Malware",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject106')._huntingQuerycontentId106,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject106')._huntingQuerycontentId106,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject107').huntingQueryTemplateSpecName107]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Zero-day Malware Detections Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject107').huntingQueryVersion107]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_107",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Zero-day Malware Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\"\n| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)\n| where MalwareMethod in ('File detonation', 'URL detonation')\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by MalwareMethod\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject107')._huntingQuerycontentId107),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 107",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject107')._huntingQuerycontentId107)]",
+                "contentId": "[variables('huntingQueryObject107')._huntingQuerycontentId107]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject107').huntingQueryVersion107]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject107')._huntingQuerycontentId107]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Zero-day Malware Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject107')._huntingQuerycontentId107,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject107')._huntingQuerycontentId107,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject108').huntingQueryTemplateSpecName108]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Communication from suspicious external users_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject108').huntingQueryVersion108]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_108",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams communication from suspicious external users",
+                "category": "Hunting Queries",
+                "query": "//This query uses MessageEvents to detect communication from suspicious external Help Desk\\Support representatives\nMessageEvents \n| where Timestamp > ago(30d) \n| where (SenderDisplayName contains \"help\" and SenderDisplayName contains \"desk\") \n  or (SenderDisplayName contains \"it\" and SenderDisplayName contains \"support\") \n  or (SenderDisplayName contains \"working\" and SenderDisplayName contains \"home\") \n| where IsExternalThread == true \n| project Timestamp, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for communication from suspicious external users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject108')._huntingQuerycontentId108),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 108",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject108')._huntingQuerycontentId108)]",
+                "contentId": "[variables('huntingQueryObject108')._huntingQuerycontentId108]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject108').huntingQueryVersion108]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject108')._huntingQuerycontentId108]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams communication from suspicious external users",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject108')._huntingQuerycontentId108,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject108')._huntingQuerycontentId108,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject109').huntingQueryTemplateSpecName109]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Communication to suspicious external users_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject109').huntingQueryVersion109]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_109",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams communication to suspicious external users",
+                "category": "Hunting Queries",
+                "query": "//This query uses MessageEvents to detect bi-directional outbound communication to suspicious external Help Desk\\Support representatives\nMessageEvents \n| where Timestamp > ago(30d) \n| where (RecipientDetails contains \"help\" and RecipientDetails contains \"desk\") \n  or (RecipientDetails contains \"it\" and RecipientDetails contains \"support\") \n  or (RecipientDetails contains \"working\" and RecipientDetails contains \"home\") \n| where IsExternalThread == true \n| project Timestamp, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for communication with suspicious external users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject109')._huntingQuerycontentId109),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 109",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject109')._huntingQuerycontentId109)]",
+                "contentId": "[variables('huntingQueryObject109')._huntingQuerycontentId109]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject109').huntingQueryVersion109]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject109')._huntingQuerycontentId109]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams communication to suspicious external users",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject109')._huntingQuerycontentId109,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject109')._huntingQuerycontentId109,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject110').huntingQueryTemplateSpecName110]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Expanding recipients into separate rows_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject110').huntingQueryVersion110]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_110",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Expanding recipients into separate rows",
+                "category": "Hunting Queries",
+                "query": "//Analyzing recipient details with a separate row for each recipient\nMessageEvents\n| mv-expand Recipients = RecipientDetails\n| extend RecipientSmtpAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for recipients of Teams messages."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject110')._huntingQuerycontentId110),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 110",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject110')._huntingQuerycontentId110)]",
+                "contentId": "[variables('huntingQueryObject110')._huntingQuerycontentId110]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject110').huntingQueryVersion110]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject110')._huntingQuerycontentId110]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Expanding recipients into separate rows",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject110')._huntingQuerycontentId110,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject110')._huntingQuerycontentId110,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject111').huntingQueryTemplateSpecName111]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "External malicious Teams messages sent from internal senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject111').huntingQueryVersion111]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_111",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "External malicious Teams messages sent from internal senders",
+                "category": "Hunting Queries",
+                "query": "//This query helps hunt for Teams messages from internal senders with Threats in them (Spam, Phish, Malware)\nMessageEvents \n| where Timestamp > ago(30d)\n| where IsExternalThread==1 and IsOwnedThread==1\n| where ThreatTypes has_any (\"Phish\",\"Malware\",\"Spam\")                    \n| project Timestamp,TeamsMessageId, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId, ThreatTypes, DetectionMethods\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for external malicious Teams messages sent from internal senders"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject111')._huntingQuerycontentId111),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 111",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject111')._huntingQuerycontentId111)]",
+                "contentId": "[variables('huntingQueryObject111')._huntingQuerycontentId111]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject111').huntingQueryVersion111]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject111')._huntingQuerycontentId111]",
+        "contentKind": "HuntingQuery",
+        "displayName": "External malicious Teams messages sent from internal senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject111')._huntingQuerycontentId111,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject111')._huntingQuerycontentId111,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject112').huntingQueryTemplateSpecName112]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for malicious messages using External Threat Intelligence_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject112').huntingQueryVersion112]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_112",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for malicious messages using External Threat Intelligence",
+                "category": "Hunting Queries",
+                "query": "// This query helps hunt for Teams messages with malicious URLs based on external IOC source\nlet url = (externaldata(url: string )\n[@\"https://urlhaus.abuse.ch/downloads/text_online/\"]\nwith (format=\"txt\"))\n| project url;\nurl\n| join (MessageUrlInfo\n| where Timestamp > ago(14d) \n) on $left.url == $right.Url\n|join MessageEvents on TeamsMessageId\n//|join UrlClickEvents on Url\n|project Timestamp, TeamsMessageId, Url, UrlDomain, SenderEmailAddress, SenderDisplayName, RecipientDetails,ThreatTypes, DetectionMethods, DeliveryAction,IsExternalThread, IsOwnedThread//, AccountUpn, ActionType, AppName, AppVersion, Workload\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject112')._huntingQuerycontentId112),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 112",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject112')._huntingQuerycontentId112)]",
+                "contentId": "[variables('huntingQueryObject112')._huntingQuerycontentId112]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject112').huntingQueryVersion112]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject112')._huntingQuerycontentId112]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for malicious messages using External Threat Intelligence",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject112')._huntingQuerycontentId112,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject112')._huntingQuerycontentId112,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject113').huntingQueryTemplateSpecName113]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Inbound Teams messages by sender domains_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject113').huntingQueryVersion113]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_113",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Inbound Teams messages by sender domains",
+                "category": "Hunting Queries",
+                "query": "//This query helps reviewing volume of inbound external Teams message by sender domains\n MessageEvents \n | where IsExternalThread==1 and IsOwnedThread==1\n | mv-expand Recipients = RecipientDetails\n | extend RecipientEmailAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType\n | extend Domain = substring(RecipientEmailAddress, indexof(RecipientEmailAddress, \"@\")+1)\n | summarize total=count() by Domain, bin(Timestamp, 1d) \n | order by Timestamp asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing volume of inbound external Teams message by sender domains"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject113')._huntingQuerycontentId113),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 113",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject113')._huntingQuerycontentId113)]",
+                "contentId": "[variables('huntingQueryObject113')._huntingQuerycontentId113]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject113').huntingQueryVersion113]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject113')._huntingQuerycontentId113]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Inbound Teams messages by sender domains",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject113')._huntingQuerycontentId113,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject113')._huntingQuerycontentId113,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject114').huntingQueryTemplateSpecName114]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malicious Teams messages by URL detection methods_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject114').huntingQueryVersion114]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_114",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious Teams messages by URL detection methods",
+                "category": "Hunting Queries",
+                "query": "//This query helps reviewing malicious Teams message detections by URL detection methods\nMessageEvents\n| where isnotempty(DetectionMethods)\n| extend MDO_detection = parse_json(DetectionMethods)\n| summarize TotalMessageCount = count(),\n           Phish_detection = countif(isnotempty(MDO_detection.Phish)),\n           Malware_detection = countif(isnotempty(MDO_detection.Malware)),\n           URL_malicious_reputation = countif(MDO_detection.Phish == @'[\"URL malicious reputation\"]' or MDO_detection.Malware == @'[\"URL malicious reputation\"]'),\n           URL_detonation_reputation = countif(MDO_detection.Phish == @'[\"URL detonation reputation\"]' or MDO_detection.Malware == @'[\"URL detonation reputation\"]')\n           by bin(Timestamp, 1d)\n| project Timestamp, Phish_detection, Malware_detection,URL_malicious_reputation,URL_detonation_reputation\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing malicious Teams message detections by URL detection methods"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject114')._huntingQuerycontentId114),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 114",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject114')._huntingQuerycontentId114)]",
+                "contentId": "[variables('huntingQueryObject114')._huntingQuerycontentId114]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject114').huntingQueryVersion114]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject114')._huntingQuerycontentId114]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious Teams messages by URL detection methods",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject114')._huntingQuerycontentId114,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject114')._huntingQuerycontentId114,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject115').huntingQueryTemplateSpecName115]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malicious Teams messages received from external senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject115').huntingQueryVersion115]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_115",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious Teams messages received from external senders",
+                "category": "Hunting Queries",
+                "query": "//This query helps hunt for Teams messages from external senders with Threats (Spam, Phish, Malware)\nMessageEvents \n| where Timestamp > ago(30d)\n| where IsExternalThread==1 and IsOwnedThread==0\n| where ThreatTypes has_any (\"Phish\",\"Malware\",\"Spam\")                    \n| project Timestamp,TeamsMessageId, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId, ThreatTypes, DetectionMethods\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for malicious Teams messages received from external senders."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject115')._huntingQuerycontentId115),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 115",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject115')._huntingQuerycontentId115)]",
+                "contentId": "[variables('huntingQueryObject115')._huntingQuerycontentId115]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject115').huntingQueryVersion115]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject115')._huntingQuerycontentId115]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious Teams messages received from external senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject115')._huntingQuerycontentId115,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject115')._huntingQuerycontentId115,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject116').huntingQueryTemplateSpecName116]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Microsoft Teams chat initiated by a suspicious external user_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject116').huntingQueryVersion116]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_116",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Microsoft Teams chat initiated by a suspicious external user",
+                "category": "Hunting Queries",
+                "query": "//Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external  Teams messages\nAlertInfo \n| where Timestamp >= ago(30d) \n| where Title == \"Microsoft Teams chat initiated by a suspicious external user\" \n| join AlertEvidence on AlertId\n| top 100 by Timestamp\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject116')._huntingQuerycontentId116),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 116",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject116')._huntingQuerycontentId116)]",
+                "contentId": "[variables('huntingQueryObject116')._huntingQuerycontentId116]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject116').huntingQueryVersion116]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject116')._huntingQuerycontentId116]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Microsoft Teams chat initiated by a suspicious external user",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject116')._huntingQuerycontentId116,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject116')._huntingQuerycontentId116,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject117').huntingQueryTemplateSpecName117]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Number of unique accounts performing Teams message Admin submissions_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject117').huntingQueryVersion117]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_117",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Number of unique accounts performing Teams message Admin submissions",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"1\",\"2\",\"3\")\n| summarize dcount(SubmittedBy) \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises number of unqiue accounts performing Teams message admin submissions as false negatives or false positives"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject117')._huntingQuerycontentId117),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 117",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject117')._huntingQuerycontentId117)]",
+                "contentId": "[variables('huntingQueryObject117')._huntingQuerycontentId117]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject117').huntingQueryVersion117]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject117')._huntingQuerycontentId117]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Number of unique accounts performing Teams message Admin submissions",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject117')._huntingQuerycontentId117,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject117')._huntingQuerycontentId117,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject118').huntingQueryTemplateSpecName118]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Number of unique accounts performing Teams message User  submissions_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject118').huntingQueryVersion118]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_118",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Number of unique accounts performing Teams message User  submissions",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)\n| where SubmissionContentType == \"ChatMessage\"\n| summarize dcount(SubmittedBy) \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises number of unqiue accounts performing Teams message user submissions as false negatives or false positives"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject118')._huntingQuerycontentId118),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 118",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject118')._huntingQuerycontentId118)]",
+                "contentId": "[variables('huntingQueryObject118')._huntingQuerycontentId118]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject118').huntingQueryVersion118]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject118')._huntingQuerycontentId118]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Number of unique accounts performing Teams message User  submissions",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject118')._huntingQuerycontentId118,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject118')._huntingQuerycontentId118,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject119').huntingQueryTemplateSpecName119]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Possible partner impersonation in external Team messages_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject119').huntingQueryVersion119]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_119",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Possible partner impersonation in external Team messages",
+                "category": "Hunting Queries",
+                "query": "//This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message\n MessageEvents \n | where IsOwnedThread==0 and IsExternalThread==1 and SenderDisplayName contains \"@contoso.com\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject119')._huntingQuerycontentId119),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 119",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject119')._huntingQuerycontentId119)]",
+                "contentId": "[variables('huntingQueryObject119')._huntingQuerycontentId119]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject119').huntingQueryVersion119]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject119')._huntingQuerycontentId119]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Possible partner impersonation in external Team messages",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject119')._huntingQuerycontentId119,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject119')._huntingQuerycontentId119,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject120').huntingQueryTemplateSpecName120]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Possible Teams phishing activity_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject120').huntingQueryVersion120]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_120",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Possible Teams phishing activity",
+                "category": "Hunting Queries",
+                "query": "let suspiciousUpns = DeviceProcessEvents\n| where DeviceId == \"alertedMachine\"\n| where isnotempty(InitiatingProcessAccountUpn)\n| project InitiatingProcessAccountUpn;\nCloudAppEvents\n| where Application == \"Microsoft Teams\"\n| where ActionType == \"ChatCreated\"\n| where isempty(AccountObjectId)\n| where RawEventData.ParticipantInfo.HasForeignTenantUsers == true\n| where RawEventData.CommunicationType == \"OneonOne\"\n| where RawEventData.ParticipantInfo.HasGuestUsers == false\n| where RawEventData.ParticipantInfo.HasOtherGuestUsers == false\n| where RawEventData.Members[0].DisplayName in (\"Microsoft  Security\", \"Help Desk\", \"Help Desk Team\", \"Help Desk IT\", \"Microsoft Security\", \"office\")\n| where AccountId has \"@\"\n| extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))\n| where TargetUPN in (suspiciousUpns)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looks for possible Teams phishing activity."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject120')._huntingQuerycontentId120),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 120",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject120')._huntingQuerycontentId120)]",
+                "contentId": "[variables('huntingQueryObject120')._huntingQuerycontentId120]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject120').huntingQueryVersion120]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject120')._huntingQuerycontentId120]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Possible Teams phishing activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject120')._huntingQuerycontentId120,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject120')._huntingQuerycontentId120,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject121').huntingQueryTemplateSpecName121]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Potentially malicious URL click in Teams_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject121').huntingQueryVersion121]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_121",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Potentially malicious URL click in Teams",
+                "category": "Hunting Queries",
+                "query": "//This query provides insights on a potentially malicious URL click in Teams\nMessagePostDeliveryEvents\n| join MessageUrlInfo on TeamsMessageId\n| join UrlClickEvents on Url\n| where Workload == \"Teams\" and ActionType1==\"ClickAllowed\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query provides insights on a potentially malicious URL click in Teams"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject121')._huntingQuerycontentId121),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 121",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject121')._huntingQuerycontentId121)]",
+                "contentId": "[variables('huntingQueryObject121')._huntingQuerycontentId121]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject121').huntingQueryVersion121]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject121')._huntingQuerycontentId121]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Potentially malicious URL click in Teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject121')._huntingQuerycontentId121,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject121')._huntingQuerycontentId121,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject122').huntingQueryTemplateSpecName122]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Rare Domains in External Teams Messages_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject122').huntingQueryVersion122]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_122",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Rare Domains in External Teams Messages",
+                "category": "Hunting Queries",
+                "query": "let lookback = 1d;\n// External Teams messages \nlet externalMsgs =\n  MessageEvents\n  | where Timestamp > ago(lookback) and IsExternalThread == true\n  | project MsgTime = Timestamp, TeamsMessageId, SenderEmailAddress, ME_ReportId = ReportId;\n// URLs found in Teams messages \nlet urlsInMsgs =\n  MessageUrlInfo\n  | where Timestamp > ago(lookback)\n  | project MUI_Time = Timestamp, TeamsMessageId, Url, UrlDomain, MUI_ReportId = ReportId;\n// Clicks coming from Teams \nlet clicks =\n  UrlClickEvents\n  | where Timestamp > ago(lookback) and Workload == \"Teams\"\n  | project ClickTime = Timestamp, Url, Clicker = AccountUpn, ClickAction = ActionType, UCE_ReportId = ReportId;\n// Define \"rare\" domains in the period \nlet rareDomains =\n  urlsInMsgs\n  | summarize msgCount = dcount(TeamsMessageId) by UrlDomain\n  | where msgCount < 3;\nrareDomains\n  | join kind=inner (urlsInMsgs) on UrlDomain\n  | join kind=leftouter (externalMsgs) on TeamsMessageId\n  | join kind=leftouter (clicks) on Url\n  | project\n      Timestamp = coalesce(ClickTime, MUI_Time, MsgTime),\n      UrlDomain,\n      Url,\n      SenderEmailAddress,\n      Clicker,\n      ClickTime,\n      ClickAction,\n      TeamsMessageId,\n      ReportId = coalesce(UCE_ReportId, MUI_ReportId, ME_ReportId)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Detects rare domains (seen in fewer than 3 Teams messages) appearing in external Microsoft Teams threads within the last 24 hours."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,Execution"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1204"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject122')._huntingQuerycontentId122),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 122",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject122')._huntingQuerycontentId122)]",
+                "contentId": "[variables('huntingQueryObject122')._huntingQuerycontentId122]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject122').huntingQueryVersion122]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject122')._huntingQuerycontentId122]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Rare Domains in External Teams Messages",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject122')._huntingQuerycontentId122,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject122')._huntingQuerycontentId122,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject123').huntingQueryTemplateSpecName123]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Suspicious Teams Display Name_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject123').huntingQueryVersion123]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_123",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Suspicious Teams Display Name",
+                "category": "Hunting Queries",
+                "query": "//This query surfaces external Microsoft Teams senders whose display name impersonates IT support or helpdesk, and\n//senders operating from throwaway .onmicrosoft.com tenants, ranked by how many of their messages carried a threat.\n//Messages are de-duplicated to the latest record per message.\nlet SuspiciousDisplayNamePattern = @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\";\nMessageEvents\n| where Timestamp > ago(30d)\n| where isnotempty(TeamsMessageId)\n| summarize arg_max(Timestamp, *) by TeamsMessageId\n| where IsExternalThread == 1 and IsOwnedThread == 0\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \"@\")[1]))\n| extend IsOnMicrosoft = SenderDomain endswith \".onmicrosoft.com\"\n| extend SuspName = SenderDisplayName matches regex SuspiciousDisplayNamePattern\n| where IsOnMicrosoft or SuspName\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)),\n            FirstSeen = min(Timestamp), LastSeen = max(Timestamp)\n    by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \"Throwaway .onmicrosoft tenant and helpdesk-style display name\",\n                           IsOnMicrosoft, \"Throwaway .onmicrosoft tenant\",\n                           \"Helpdesk or IT-style display name\")\n| extend ThreatPct = round(100.0 * ThreatMessages / TeamsMessages, 1)\n| sort by ThreatMessages desc, TeamsMessages desc\n| take 20\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress,\n          ['Sender Domain']=SenderDomain, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages,\n          ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct,\n          ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looks for Teams messages from an external user with a suspicious display name."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject123')._huntingQuerycontentId123),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 123",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject123')._huntingQuerycontentId123)]",
+                "contentId": "[variables('huntingQueryObject123')._huntingQuerycontentId123]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject123').huntingQueryVersion123]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject123')._huntingQuerycontentId123]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Suspicious Teams Display Name",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject123')._huntingQuerycontentId123,'-', '1.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject123')._huntingQuerycontentId123,'-', '1.0.1')))]",
+        "version": "1.0.1"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject124').huntingQueryTemplateSpecName124]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams Admin submission of Malware and Phish daily trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject124').huntingQueryVersion124]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_124",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams Admin submission of Malware and Phish daily trend",
+                "category": "Hunting Queries",
+                "query": "//Admin submission of false negative Teams message detections with Malware and Phish threat daily trend\nlet TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery=CloudAppEvents\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"ChatMessage\";\nlet Admin_Malware_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"2\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Malware_FN\";\nlet Admin_Phish_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Phish_FN\";\nunion Admin_Malware_FN,Admin_Phish_FN\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of admin false negative Teams message submissions by submission type of Phish or Malware"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject124')._huntingQuerycontentId124),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 124",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject124')._huntingQuerycontentId124)]",
+                "contentId": "[variables('huntingQueryObject124')._huntingQuerycontentId124]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject124').huntingQueryVersion124]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject124')._huntingQuerycontentId124]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams Admin submission of Malware and Phish daily trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject124')._huntingQuerycontentId124,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject124')._huntingQuerycontentId124,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject125').huntingQueryTemplateSpecName125]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams Admin submission of No Threats daily trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject125').huntingQueryVersion125]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_125",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams Admin submission of No Threats daily trend",
+                "category": "Hunting Queries",
+                "query": "//Admin submission of false positive Teams message detections daily trend\nlet TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery=CloudAppEvents\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"ChatMessage\";\nlet Admin_Teams_FP=baseQuery\n| make-series Count= countif(SubmissionType == \"3\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Teams_FP\";\nunion Admin_Teams_FP\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of admin false positive Teams message submissions"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject125')._huntingQuerycontentId125),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 125",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject125')._huntingQuerycontentId125)]",
+                "contentId": "[variables('huntingQueryObject125')._huntingQuerycontentId125]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject125').huntingQueryVersion125]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject125')._huntingQuerycontentId125]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams Admin submission of No Threats daily trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject125')._huntingQuerycontentId125,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject125')._huntingQuerycontentId125,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject126').huntingQueryTemplateSpecName126]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams Admin-User Submissions Grading Verdicts_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject126').huntingQueryVersion126]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_126",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams Admin-User Submissions Grading Verdicts",
+                "category": "Hunting Queries",
+                "query": "//This query visualizes Teams messages submitted by users or admins then graded in the submission process, summarizing the data by the various submission garde results\nCloudAppEvents\n| where ActionType == \"AdminSubmissionTriage\" or ActionType == \"UserSubmissionTriage\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmissionState=tostring((parse_json(RawEventData)).SubmissionState),TriageVerdict=tostring((parse_json(RawEventData)).GradingResult.TriageVerdict)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionState == \"Graded\"\n| summarize count() by TriageVerdict\n| project TriageVerdict, TeamsMessages = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualizes Teams messages submitted by users or admins then graded in the submission process."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject126')._huntingQuerycontentId126),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 126",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject126')._huntingQuerycontentId126)]",
+                "contentId": "[variables('huntingQueryObject126')._huntingQuerycontentId126]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject126').huntingQueryVersion126]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject126')._huntingQuerycontentId126]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams Admin-User Submissions Grading Verdicts",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject126')._huntingQuerycontentId126,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject126')._huntingQuerycontentId126,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject127').huntingQueryTemplateSpecName127]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams blocked URL clicks daily trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject127').huntingQueryVersion127]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_127",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams blocked URL clicks daily trend",
+                "category": "Hunting Queries",
+                "query": "//This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages summarizing the data by various Teams app names.\nlet TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nUrlClickEvents\n| where Timestamp >= TimeStart\n| where ActionType == \"ClickBlocked\" and Workload ==\"Teams\"\n| make-series TeamsBlockedClicks = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by AppName\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject127')._huntingQuerycontentId127),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 127",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject127')._huntingQuerycontentId127)]",
+                "contentId": "[variables('huntingQueryObject127')._huntingQuerycontentId127]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject127').huntingQueryVersion127]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject127')._huntingQuerycontentId127]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams blocked URL clicks daily trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject127')._huntingQuerycontentId127,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject127')._huntingQuerycontentId127,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject128').huntingQueryTemplateSpecName128]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams Malware ZAP _HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject128').huntingQueryVersion128]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_128",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams Malware ZAP",
+                "category": "Hunting Queries",
+                "query": "//Zero-hour auto purge (ZAP) took action on Teams messages containing Malware after delivery.\nMessagePostDeliveryEvents\n| where ActionType == 'Malware ZAP' \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for Teams messages with Malware threats that have been ZAPed."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject128')._huntingQuerycontentId128),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 128",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject128')._huntingQuerycontentId128)]",
+                "contentId": "[variables('huntingQueryObject128')._huntingQuerycontentId128]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject128').huntingQueryVersion128]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject128')._huntingQuerycontentId128]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams Malware ZAP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject128')._huntingQuerycontentId128,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject128')._huntingQuerycontentId128,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject129').huntingQueryTemplateSpecName129]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams Message with URL listed on OpenPhish_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject129').huntingQueryVersion129]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_129",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams Message with URL listed on OpenPhish",
+                "category": "Hunting Queries",
+                "query": "//This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish.\nlet PhishingURLs = externaldata(url: string)\n[\n\"https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt\"\n]\nwith (format=\"txt\"); // CSV and JSON formats are also valid formats if using the premium feeds\nMessageUrlInfo\n| where Url in (PhishingURLs)\n| join MessageEvents on TeamsMessageId\n//| where IsOwnedThread==0 and IsExternalThread==1\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish was delivered."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject129')._huntingQuerycontentId129),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 129",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject129')._huntingQuerycontentId129)]",
+                "contentId": "[variables('huntingQueryObject129')._huntingQuerycontentId129]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject129').huntingQueryVersion129]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject129')._huntingQuerycontentId129]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams Message with URL listed on OpenPhish",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject129')._huntingQuerycontentId129,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject129')._huntingQuerycontentId129,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject130').huntingQueryTemplateSpecName130]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams message ZAPed with the same URL in Email_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject130').huntingQueryVersion130]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_130",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams message ZAPed with the same URL in Email",
+                "category": "Hunting Queries",
+                "query": "//This query provides insights on Teams messages ZAPed with the same malicious URLs in Email messages\nMessagePostDeliveryEvents\n| join MessageUrlInfo on TeamsMessageId\n| join EmailUrlInfo on Url\n| join EmailEvents on NetworkMessageId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for Teams messages that have been ZAPed with the same URL in Email."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject130')._huntingQuerycontentId130),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 130",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject130')._huntingQuerycontentId130)]",
+                "contentId": "[variables('huntingQueryObject130')._huntingQuerycontentId130]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject130').huntingQueryVersion130]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject130')._huntingQuerycontentId130]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams message ZAPed with the same URL in Email",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject130')._huntingQuerycontentId130,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject130')._huntingQuerycontentId130,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject131').huntingQueryTemplateSpecName131]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams messages from a specific sender by ThreadType_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject131').huntingQueryVersion131]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_131",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams messages from a specific sender by ThreadType",
+                "category": "Hunting Queries",
+                "query": "//This query gets the count of messages from a sender across all types of conversations\nlet Sender = \"norpely@contoso.com\";\nMessageEvents\n| where SenderEmailAddress == Sender\n| summarize Count = count() by ThreadType\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for Teams messages from a specific sender by ThreadType."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject131')._huntingQuerycontentId131),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 131",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject131')._huntingQuerycontentId131)]",
+                "contentId": "[variables('huntingQueryObject131')._huntingQuerycontentId131]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject131').huntingQueryVersion131]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject131')._huntingQuerycontentId131]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams messages from a specific sender by ThreadType",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject131')._huntingQuerycontentId131,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject131')._huntingQuerycontentId131,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject132').huntingQueryTemplateSpecName132]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams messages with suspicious URL domains_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject132').huntingQueryVersion132]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_132",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams messages with suspicious URL domains",
+                "category": "Hunting Queries",
+                "query": "//This Query uses MessageUrlInfo to find external Teams messages with suspicious low reputation URL doamins (e.g .xyz etc)\nMessageUrlInfo\n| extend Domain = extract(@\"^(?:https?://)?([^/]+)\", 1, Url)\n| extend TLD = tostring(split(Domain, \".\")[-1])\n| where TLD has_any (\"dev\",\"app\",\"zip\",\"solutions\",\"io\",\"top\",\"xyz\")\n| project Timestamp,Url,UrlDomain,TLD,TeamsMessageId, ReportId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for Teams messages with suspicious URL domains."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject132')._huntingQuerycontentId132),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 132",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject132')._huntingQuerycontentId132)]",
+                "contentId": "[variables('huntingQueryObject132')._huntingQuerycontentId132]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject132').huntingQueryVersion132]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject132')._huntingQuerycontentId132]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams messages with suspicious URL domains",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject132')._huntingQuerycontentId132,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject132')._huntingQuerycontentId132,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject133').huntingQueryTemplateSpecName133]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams Phish ZAP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject133').huntingQueryVersion133]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_133",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams Phish ZAP",
+                "category": "Hunting Queries",
+                "query": "//Zero-hour auto purge (ZAP) took action on Teams messages containing Phish after delivery\nMessagePostDeliveryEvents\n| where ActionType == 'Phish ZAP' \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for Teams messages with Phish threats that have been ZAPed."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject133')._huntingQuerycontentId133),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 133",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject133')._huntingQuerycontentId133)]",
+                "contentId": "[variables('huntingQueryObject133')._huntingQuerycontentId133]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject133').huntingQueryVersion133]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject133')._huntingQuerycontentId133]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams Phish ZAP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject133')._huntingQuerycontentId133,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject133')._huntingQuerycontentId133,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject134').huntingQueryTemplateSpecName134]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams post delivery events daily trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject134').huntingQueryVersion134]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_134",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams post delivery events daily trend",
+                "category": "Hunting Queries",
+                "query": "//Teams post delivery ZAP events daily trend\nlet TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nMessagePostDeliveryEvents\n| where Timestamp >= TimeStart\n| where ActionType has \"ZAP\"\n| make-series ZappedTeamsMessages = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualizes the daily amount of post delivery events on Teams messages."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject134')._huntingQuerycontentId134),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 134",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject134')._huntingQuerycontentId134)]",
+                "contentId": "[variables('huntingQueryObject134')._huntingQuerycontentId134]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject134').huntingQueryVersion134]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject134')._huntingQuerycontentId134]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams post delivery events daily trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject134')._huntingQuerycontentId134,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject134')._huntingQuerycontentId134,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject135').huntingQueryTemplateSpecName135]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams Spam ZAP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject135').huntingQueryVersion135]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_135",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams Spam ZAP",
+                "category": "Hunting Queries",
+                "query": "//Zero-hour auto purge (ZAP) took action on Teams messages containing Spam after delivery\nMessagePostDeliveryEvents\n| where ActionType == 'Spam ZAP' \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for Teams messages with Spam threats that have been ZAPed."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject135')._huntingQuerycontentId135),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 135",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject135')._huntingQuerycontentId135)]",
+                "contentId": "[variables('huntingQueryObject135')._huntingQuerycontentId135]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject135').huntingQueryVersion135]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject135')._huntingQuerycontentId135]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams Spam ZAP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject135')._huntingQuerycontentId135,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject135')._huntingQuerycontentId135,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject136').huntingQueryTemplateSpecName136]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams URL clicks actions summarized by URLs clicked on_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject136').huntingQueryVersion136]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_136",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams URL clicks actions summarized by URLs clicked on",
+                "category": "Hunting Queries",
+                "query": "//Teams URL clicks actions summarized by URLs clicked on\nUrlClickEvents\n| extend UrlBlocked = ActionType has_any(\"ClickBlocked\")\n| extend UrlAllowed = ActionType has_any('ClickAllowed')\n| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')\n| extend ErrorPage = ActionType has_any('UrlErrorPage')\n| where Workload == \"Teams\"\n| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough) by Url\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject136')._huntingQuerycontentId136),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 136",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject136')._huntingQuerycontentId136)]",
+                "contentId": "[variables('huntingQueryObject136')._huntingQuerycontentId136]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject136').huntingQueryVersion136]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject136')._huntingQuerycontentId136]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams URL clicks actions summarized by URLs clicked on",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject136')._huntingQuerycontentId136,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject136')._huntingQuerycontentId136,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject137').huntingQueryTemplateSpecName137]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject137').huntingQueryVersion137]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_137",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs",
+                "category": "Hunting Queries",
+                "query": "//Teams URL clicks through actions on Phish or Malware URLs summarized by URLs\nUrlClickEvents \n| where IsClickedThrough !=\"0\" and Workload ==\"Teams\"\n| where ThreatTypes in (\"Phish\",\"Malware\") \n| summarize by Url,ThreatTypes, IsClickedThrough, ActionType\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject137')._huntingQuerycontentId137),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 137",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject137')._huntingQuerycontentId137)]",
+                "contentId": "[variables('huntingQueryObject137')._huntingQuerycontentId137]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject137').huntingQueryVersion137]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject137')._huntingQuerycontentId137]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject137')._huntingQuerycontentId137,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject137')._huntingQuerycontentId137,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject138').huntingQueryTemplateSpecName138]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams User submissions daily trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject138').huntingQueryVersion138]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_138",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams User submissions daily trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery=CloudAppEvents\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where ActionType == \"UserSubmission\" and SubmissionContentType == \"ChatMessage\";\nlet User_TeamsSubmission_FN_FP=baseQuery\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"User_TeamsSubmission_FN_FP\";\nunion User_TeamsSubmission_FN_FP\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of user false negative and false postive Teams message submissions"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject138')._huntingQuerycontentId138),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 138",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject138')._huntingQuerycontentId138)]",
+                "contentId": "[variables('huntingQueryObject138')._huntingQuerycontentId138]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject138').huntingQueryVersion138]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject138')._huntingQuerycontentId138]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams User submissions daily trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject138')._huntingQuerycontentId138,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject138')._huntingQuerycontentId138,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject139').huntingQueryTemplateSpecName139]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams users clicking on suspicious URL domains_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject139').huntingQueryVersion139]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_139",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams users clicking on suspicious URL domains",
+                "category": "Hunting Queries",
+                "query": "//This Query uses MessageUrlInfo, MessageEvents and UrlClickEvents to find external Teams messages with low reputation URL doamins (.xyz) and identify the top 10 users clicking on them. \nMessageUrlInfo\n| extend Domain = extract(@\"^(?:https?://)?([^/]+)\", 1, Url)\n| extend TLD = tostring(split(Domain, \".\")[-1])\n| where TLD has_any (\"dev\",\"app\",\"zip\",\"solutions\",\"io\",\"top\")\n| join MessageEvents on TeamsMessageId\n| join UrlClickEvents on Url\n| project Timestamp,Url,UrlDomain,TLD,TeamsMessageId, ReportId, Timestamp2,ActionType,AccountUpn,Workload, SenderDisplayName, SenderEmailAddress, ThreatTypes, DetectionMethods, RecipientDetails\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for Teams users clicking on suspicious URL domains."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject139')._huntingQuerycontentId139),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 139",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject139')._huntingQuerycontentId139)]",
+                "contentId": "[variables('huntingQueryObject139')._huntingQuerycontentId139]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject139').huntingQueryVersion139]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject139')._huntingQuerycontentId139]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams users clicking on suspicious URL domains",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject139')._huntingQuerycontentId139,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject139')._huntingQuerycontentId139,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject140').huntingQueryTemplateSpecName140]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 Attacked user by Phish messages_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject140').huntingQueryVersion140]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_140",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Attacked user by Phish messages",
+                "category": "Hunting Queries",
+                "query": "//Top 10 attacked users by Phish messages from external senders using Teams. Replace contoso.com with your own recipient domain.\nMessageEvents\n| where ThreatTypes has 'Phish' and IsOwnedThread==0 and IsExternalThread==1\n| mv-expand Recipients = RecipientDetails\n| extend RecipientEmailAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType\n| where RecipientEmailAddress contains ('contoso.com')\n| summarize count() by tostring(RecipientEmailAddress)\n| sort by count_\n| top 10 by count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Top 10 attacked users by Phish messages from external senders using Teams"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject140')._huntingQuerycontentId140),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 140",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject140')._huntingQuerycontentId140)]",
+                "contentId": "[variables('huntingQueryObject140')._huntingQuerycontentId140]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject140').huntingQueryVersion140]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject140')._huntingQuerycontentId140]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Attacked user by Phish messages",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject140')._huntingQuerycontentId140,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject140')._huntingQuerycontentId140,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject141').huntingQueryTemplateSpecName141]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 external senders sending Teams messages_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject141').huntingQueryVersion141]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_141",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 external senders sending Teams messages",
+                "category": "Hunting Queries",
+                "query": "//Top 10 external senders sending Teams messages\nMessageEvents \n| where IsOwnedThread==0 and IsExternalThread==1\n| summarize count() by SenderEmailAddress\n| sort by count_ desc\n| top 10 by count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visulises all up Top 10 external senders sending Teams messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject141')._huntingQuerycontentId141),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 141",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject141')._huntingQuerycontentId141)]",
+                "contentId": "[variables('huntingQueryObject141')._huntingQuerycontentId141]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject141').huntingQueryVersion141]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject141')._huntingQuerycontentId141]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 external senders sending Teams messages",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject141')._huntingQuerycontentId141,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject141')._huntingQuerycontentId141,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject142').huntingQueryTemplateSpecName142]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 External senders sending Teams phishing messsages_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject142').huntingQueryVersion142]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_142",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 External senders sending Teams phishing messsages",
+                "category": "Hunting Queries",
+                "query": "//This query looking for top 10 External senders sending Team phishing messsages\nMessageEvents\n| where IsOwnedThread==0 and IsExternalThread==1\n| where ThreatTypes has \"Phish\"\n| summarize Count = count() by SenderEmailAddress\n| top 10 by Count\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looking for top 10 External senders sending Team phishing messsages."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject142')._huntingQuerycontentId142),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 142",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject142')._huntingQuerycontentId142)]",
+                "contentId": "[variables('huntingQueryObject142')._huntingQuerycontentId142]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject142').huntingQueryVersion142]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject142')._huntingQuerycontentId142]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 External senders sending Teams phishing messsages",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject142')._huntingQuerycontentId142,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject142')._huntingQuerycontentId142,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject143').huntingQueryTemplateSpecName143]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 sender domains - Admin Teams message submissions FN_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject143').huntingQueryVersion143]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_143",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 sender domains - Admin Teams message submissions FN",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"2\",\"1\")\n| summarize count() by P2SenderDomain\n| project P2SenderDomain, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject143')._huntingQuerycontentId143),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 143",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject143')._huntingQuerycontentId143)]",
+                "contentId": "[variables('huntingQueryObject143')._huntingQuerycontentId143]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject143').huntingQueryVersion143]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject143')._huntingQuerycontentId143]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 sender domains - Admin Teams message submissions FN",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject143')._huntingQuerycontentId143,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject143')._huntingQuerycontentId143,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject144').huntingQueryTemplateSpecName144]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 sender domains - Teams user submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject144').huntingQueryVersion144]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_144",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 sender domains - Teams user submissions FN or FP",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"ChatMessage\"\n| summarize count() by P2SenderDomain\n| project P2SenderDomain, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject144')._huntingQuerycontentId144),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 144",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject144')._huntingQuerycontentId144)]",
+                "contentId": "[variables('huntingQueryObject144')._huntingQuerycontentId144]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject144').huntingQueryVersion144]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject144')._huntingQuerycontentId144]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 sender domains - Teams user submissions FN or FP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject144')._huntingQuerycontentId144,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject144')._huntingQuerycontentId144,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject145').huntingQueryTemplateSpecName145]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 senders - Teams users submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject145').huntingQueryVersion145]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_145",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 senders - Teams users submissions FN or FP",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)\n| where SubmissionContentType == \"ChatMessage\"\n| summarize count() by P2Sender\n| project P2Sender, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject145')._huntingQuerycontentId145),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 145",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject145')._huntingQuerycontentId145)]",
+                "contentId": "[variables('huntingQueryObject145')._huntingQuerycontentId145]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject145').huntingQueryVersion145]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject145')._huntingQuerycontentId145]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 senders - Teams users submissions FN or FP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject145')._huntingQuerycontentId145,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject145')._huntingQuerycontentId145,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject146').huntingQueryTemplateSpecName146]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 senders of  Admin Teams message submissions FN_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject146').huntingQueryVersion146]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_146",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 senders of  Admin Teams message submissions FN",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"2\",\"1\")\n| summarize count() by P2Sender\n| project P2Sender, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject146')._huntingQuerycontentId146),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 146",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject146')._huntingQuerycontentId146)]",
+                "contentId": "[variables('huntingQueryObject146')._huntingQuerycontentId146]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject146').huntingQueryVersion146]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject146')._huntingQuerycontentId146]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 senders of  Admin Teams message submissions FN",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject146')._huntingQuerycontentId146,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject146')._huntingQuerycontentId146,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject147').huntingQueryTemplateSpecName147]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 senders of  Admin Teams message submissions FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject147').huntingQueryVersion147]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_147",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 senders of  Admin Teams message submissions FP",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"3\")\n| summarize count() by P2Sender\n| project P2Sender, TeamsMessages = count_\n| top 10 by TeamsMessages desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises Teams messages submitted by admins as false positives, summarizing the data by top 10 indidvidual senders of those messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject147')._huntingQuerycontentId147),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 147",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject147')._huntingQuerycontentId147)]",
+                "contentId": "[variables('huntingQueryObject147')._huntingQuerycontentId147]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject147').huntingQueryVersion147]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject147')._huntingQuerycontentId147]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 senders of  Admin Teams message submissions FP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject147')._huntingQuerycontentId147,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject147')._huntingQuerycontentId147,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject148').huntingQueryTemplateSpecName148]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 Users clicking on malicious URLs in Teams_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject148').huntingQueryVersion148]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_148",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Users clicking on malicious URLs in Teams",
+                "category": "Hunting Queries",
+                "query": "//Top 10 Users clicking on malicious URLs in Teams\nUrlClickEvents \n| where Workload ==\"Teams\" and ThreatTypes in (\"Phish\",\"Malware\") \n| summarize Blocked = countif(ActionType ==\"ClickBlocked\"), Allowed = countif(ActionType ==\"ClickAllowed\"), PendingVerdict = countif(ActionType ==\"UrlScanInProgress\"), Error = countif(ActionType ==\"UrlErrorPage\"), ClickedThrough = countif(IsClickedThrough)by AccountUpn\n| top 10 by Blocked desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualizes Top 10 Users clicking on malicious Phish or Malware URLs in Teams."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject148')._huntingQuerycontentId148),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 148",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject148')._huntingQuerycontentId148)]",
+                "contentId": "[variables('huntingQueryObject148')._huntingQuerycontentId148]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject148').huntingQueryVersion148]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject148')._huntingQuerycontentId148]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Users clicking on malicious URLs in Teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject148')._huntingQuerycontentId148,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject148')._huntingQuerycontentId148,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject149').huntingQueryTemplateSpecName149]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top accounts performing Teams admin submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject149').huntingQueryVersion149]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_149",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top accounts performing Teams admin submissions FN or FP",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)\n| where SubmissionContentType == \"ChatMessage\" and SubmissionType in (\"1\",\"2\",\"3\")\n| summarize count() by SubmittedBy\n| project SubmittedBy, TeamsMessages = count_\n|top 10 by TeamsMessages desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top admins performing false negative or false positive admin submissions of Teams messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject149')._huntingQuerycontentId149),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 149",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject149')._huntingQuerycontentId149)]",
+                "contentId": "[variables('huntingQueryObject149')._huntingQuerycontentId149]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject149').huntingQueryVersion149]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject149')._huntingQuerycontentId149]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top accounts performing Teams admin submissions FN or FP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject149')._huntingQuerycontentId149,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject149')._huntingQuerycontentId149,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject150').huntingQueryTemplateSpecName150]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top accounts performing Teams user submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject150').huntingQueryVersion150]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_150",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top accounts performing Teams user submissions FN or FP",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)\n| where SubmissionContentType == \"ChatMessage\"\n| summarize count() by SubmittedBy\n| project SubmittedBy, TeamsMessages = count_\n|top 10 by TeamsMessages desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top users performing false negative or false positive user submissions of Teams messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject150')._huntingQuerycontentId150),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 150",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject150')._huntingQuerycontentId150)]",
+                "contentId": "[variables('huntingQueryObject150')._huntingQuerycontentId150]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject150').huntingQueryVersion150]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject150')._huntingQuerycontentId150]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top accounts performing Teams user submissions FN or FP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject150')._huntingQuerycontentId150,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject150')._huntingQuerycontentId150,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject151').huntingQueryTemplateSpecName151]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top domains outbound sending Malicious Teams messages inbound_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject151').huntingQueryVersion151]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_151",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top domains outbound sending Malicious Teams messages inbound",
+                "category": "Hunting Queries",
+                "query": "// This query provides insights of top outbound recipient domains of outbound Teams messages by volume and shows total number of inbound Teams messages with Threats from the same domains (as inbound senders) indicating potential partner user or organization compromise.\nMessageEvents\n| where IsExternalThread==1 and IsOwnedThread==1\n| mv-expand Recipients = RecipientDetails\n| extend RecipientEmailAddress = Recipients.RecipientSmtpAddress\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\n//| where RecipientDomain !=\"contoso.com\"\n| summarize count() by RecipientDomain\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\n| join (MessageEvents |mv-expand Recipients = RecipientDetails|extend RecipientEmailAddress = Recipients.RecipientSmtpAddress|extend SenderFromDomain = tostring(split(RecipientEmailAddress, \"@\")[1])| where IsExternalThread==1 and IsOwnedThread==0 and isempty(ThreatTypes)==false) on SenderFromDomain\n| summarize max(OutboundCount),count() by SenderFromDomain\n//| extend Bad_Traffic_Percentage = todouble(round(IncomingTeamsMessagesWithThreats=count_ / todouble(OutboundTeamsMessages=max_OutboundCount), 2))\n| project SenderFromDomain, OutboundTeamsMessages=max_OutboundCount, IncomingTeamsMessagesWithThreats=count_//, Bad_Traffic_Percentage\n| sort by OutboundTeamsMessages\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looking for potential partner compromise via comparing outbound Teams message traffic per target domain and looking for malicious Teams messages from the same domains as inbound."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject151')._huntingQuerycontentId151),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 151",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject151')._huntingQuerycontentId151)]",
+                "contentId": "[variables('huntingQueryObject151')._huntingQuerycontentId151]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject151').huntingQueryVersion151]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject151')._huntingQuerycontentId151]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top domains outbound sending Malicious Teams messages inbound",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject151')._huntingQuerycontentId151,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject151')._huntingQuerycontentId151,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject152').huntingQueryTemplateSpecName152]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top external malicious senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject152').huntingQueryVersion152]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_152",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top External malicious Senders",
+                "category": "Hunting Queries",
+                "query": "//Top external senders sending malicious inbound Teams messages Spam, Phish, Malware\nMessageEvents \n| where IsOwnedThread==0 and IsExternalThread==1 and ThreatTypes !='' and Timestamp > ago(30d)\n| summarize count() by SenderEmailAddress, ThreatTypes \n| sort by count_ desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Top external senders sending malicious inbound Teams messages Spam, Phish, Malware"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject152')._huntingQuerycontentId152),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 152",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject152')._huntingQuerycontentId152)]",
+                "contentId": "[variables('huntingQueryObject152')._huntingQuerycontentId152]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject152').huntingQueryVersion152]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject152')._huntingQuerycontentId152]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top External malicious Senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject152')._huntingQuerycontentId152,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject152')._huntingQuerycontentId152,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject153').huntingQueryTemplateSpecName153]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top External Sender domains - Malware_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject153').huntingQueryVersion153]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_153",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top External Sender domains - Malware",
+                "category": "Hunting Queries",
+                "query": "//Top External Sender domains sending Teams message with Malware threats\nMessageEvents\n| where IsExternalThread==1 and IsOwnedThread==0\n| where ThreatTypes contains \"Malware\"\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\n| summarize count() by SenderDomain\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Top External Sender domains sending Teams message with Malware threats"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject153')._huntingQuerycontentId153),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 153",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject153')._huntingQuerycontentId153)]",
+                "contentId": "[variables('huntingQueryObject153')._huntingQuerycontentId153]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject153').huntingQueryVersion153]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject153')._huntingQuerycontentId153]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top External Sender domains - Malware",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject153')._huntingQuerycontentId153,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject153')._huntingQuerycontentId153,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject154').huntingQueryTemplateSpecName154]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top External Sender domains - Phish_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject154').huntingQueryVersion154]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_154",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top External Sender domains - Phish",
+                "category": "Hunting Queries",
+                "query": "//Top External Sender domains sending Teams message with Phish threats\nMessageEvents\n| where IsExternalThread==1 and IsOwnedThread==0\n| where ThreatTypes contains \"Phish\"\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\n| summarize count() by SenderDomain\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Top External Sender domains sending Teams message with Phish threats"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject154')._huntingQuerycontentId154),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 154",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject154')._huntingQuerycontentId154)]",
+                "contentId": "[variables('huntingQueryObject154')._huntingQuerycontentId154]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject154').huntingQueryVersion154]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject154')._huntingQuerycontentId154]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top External Sender domains - Phish",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject154')._huntingQuerycontentId154,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject154')._huntingQuerycontentId154,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject155').huntingQueryTemplateSpecName155]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top External Sender domains - Spam_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject155').huntingQueryVersion155]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_155",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top External Sender domains - Spam",
+                "category": "Hunting Queries",
+                "query": "//Top External Sender domains sending Teams message with Spam threats\nMessageEvents\n| where IsExternalThread==1 and IsOwnedThread==0\n| where ThreatTypes contains \"Spam\"\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\n| summarize count() by SenderDomain\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Top External Sender domains sending Teams message with Spam threats"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject155')._huntingQuerycontentId155),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 155",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject155')._huntingQuerycontentId155)]",
+                "contentId": "[variables('huntingQueryObject155')._huntingQuerycontentId155]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject155').huntingQueryVersion155]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject155')._huntingQuerycontentId155]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top External Sender domains - Spam",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject155')._huntingQuerycontentId155,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject155')._huntingQuerycontentId155,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject156').huntingQueryTemplateSpecName156]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top malicious URLs clicked by users in Teams_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject156').huntingQueryVersion156]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_156",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top malicious URLs clicked by users in Teams",
+                "category": "Hunting Queries",
+                "query": "//This query shows the top 20 URL's that have a detection associated with it and the most ammount of clicks registered from Microsoft Teams \nUrlClickEvents\n| where ThreatTypes !=\"\" and Workload ==\"Teams\"\n| summarize count() by Url, ThreatTypes, ActionType, Workload\n| project Url, ThreatTypes, ActionType, Workload, ClickCount=count_\n| top 20 by ClickCount\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunt for top malicious URLs clicked by users in Teams"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject156')._huntingQuerycontentId156),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 156",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject156')._huntingQuerycontentId156)]",
+                "contentId": "[variables('huntingQueryObject156')._huntingQuerycontentId156]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject156').huntingQueryVersion156]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject156')._huntingQuerycontentId156]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top malicious URLs clicked by users in Teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject156')._huntingQuerycontentId156,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject156')._huntingQuerycontentId156,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject157').huntingQueryTemplateSpecName157]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total number of MDO Teams protection detections daily_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject157').huntingQueryVersion157]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_157",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Total number of MDO Teams protection detections daily",
+                "category": "Hunting Queries",
+                "query": "//Total number of MDO Teams protection detections daily \nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\nlet baseQuery = MessageEvents\n//| where IsOwnedThread==0 and IsExternalThread==1 \n| where isnotempty(Timestamp);\nlet totalwiththreat = baseQuery\n| where isnotempty(ThreatTypes) \n| make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d \n| extend Details = \"Total Teams messages with Threat\";\nlet totalwithphishthreat = baseQuery\n| where ThreatTypes has ('Phish')\n| make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d \n| extend Details = \"Total Teams messages with Phish Threat\";\nlet totalwithmalwarethreat = baseQuery\n| where ThreatTypes has ('Malware')\n| make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d \n| extend Details = \"Total Teams messages with Malware Threat\";\nunion totalwiththreat, totalwithphishthreat, totalwithmalwarethreat\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visulises Total number of MDO Teams protection detections daily"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1562"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject157')._huntingQuerycontentId157),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 157",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject157')._huntingQuerycontentId157)]",
+                "contentId": "[variables('huntingQueryObject157')._huntingQuerycontentId157]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject157').huntingQueryVersion157]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject157')._huntingQuerycontentId157]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Total number of MDO Teams protection detections daily",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject157')._huntingQuerycontentId157,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject157')._huntingQuerycontentId157,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject158').huntingQueryTemplateSpecName158]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URL click on URLs in ZAP-d Teams messages_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject158').huntingQueryVersion158]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_158",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URL click on URLs in ZAP-d Teams messages",
+                "category": "Hunting Queries",
+                "query": "//URL click on URLs in ZAP-d Teams messages\nMessagePostDeliveryEvents\n| join MessageUrlInfo on TeamsMessageId\n| join UrlClickEvents on Url\n| where ActionType !=\"\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject158')._huntingQuerycontentId158),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 158",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject158')._huntingQuerycontentId158)]",
+                "contentId": "[variables('huntingQueryObject158')._huntingQuerycontentId158]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject158').huntingQueryVersion158]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject158')._huntingQuerycontentId158]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URL click on URLs in ZAP-d Teams messages",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject158')._huntingQuerycontentId158,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject158')._huntingQuerycontentId158,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject159').huntingQueryTemplateSpecName159]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam and Phish delivered to Inbox due to Admin Overrides_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject159').huntingQueryVersion159]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_159",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam and Phish allowed to inbox by Admin Overrides",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ConfidenceLevel != \"\" and OrgLevelPolicy!=\"\" and OrgLevelAction == \"Allow\" and DeliveryAction == \"Delivered\";\nlet spam=baseQuery\n| where ThreatTypes has 'Spam'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Allowed Spam\";\nlet phish=baseQuery\n| where ThreatTypes has 'Phish'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Allowed Phish\";\nunion spam,phish\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps in reviewing malicious emails allowed due to admin overrides"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject159')._huntingQuerycontentId159),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 159",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject159')._huntingQuerycontentId159)]",
+                "contentId": "[variables('huntingQueryObject159')._huntingQuerycontentId159]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject159').huntingQueryVersion159]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject159')._huntingQuerycontentId159]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam and Phish allowed to inbox by Admin Overrides",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject159')._huntingQuerycontentId159,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject159')._huntingQuerycontentId159,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject160').huntingQueryTemplateSpecName160]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam and Phish delivered to Inbox due to User Overrides_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject160').huntingQueryVersion160]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_160",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam and Phish allowed to inbox by User Overrides",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = EmailEvents\n| where TimeGenerated >= TimeStart\n| where ConfidenceLevel != \"\" and UserLevelPolicy!=\"\" and UserLevelAction == \"Allow\" and DeliveryAction == \"Delivered\";\nlet spam=baseQuery\n| where ThreatTypes has 'Spam'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Allowed Spam\";\nlet phish=baseQuery\n| where ThreatTypes has 'Phish'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Allowed Phish\";\nunion spam,phish\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps in reviewing malicious emails allowed due to user overrides"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject160')._huntingQuerycontentId160),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 160",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject160')._huntingQuerycontentId160)]",
+                "contentId": "[variables('huntingQueryObject160')._huntingQuerycontentId160]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject160').huntingQueryVersion160]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject160')._huntingQuerycontentId160]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam and Phish allowed to inbox by User Overrides",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject160')._huntingQuerycontentId160,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject160')._huntingQuerycontentId160,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject161').huntingQueryTemplateSpecName161]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top policies performing admin overrides_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject161').huntingQueryVersion161]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_161",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top policies performing admin overrides",
+                "category": "Hunting Queries",
+                "query": "EmailEvents  \n| where OrgLevelPolicy!=\"\" and OrgLevelAction == \"Allow\"  //\"Block\"\n| extend OrgPolicy = split(OrgLevelPolicy, \"(\", 0)\n| summarize count() by tostring(OrgPolicy)\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps in reviewing top policies for admin overrides (Allow/Block)"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject161')._huntingQuerycontentId161),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 161",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject161')._huntingQuerycontentId161)]",
+                "contentId": "[variables('huntingQueryObject161')._huntingQuerycontentId161]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject161').huntingQueryVersion161]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject161')._huntingQuerycontentId161]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top policies performing admin overrides",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject161')._huntingQuerycontentId161,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject161')._huntingQuerycontentId161,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject162').huntingQueryTemplateSpecName162]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top policies performing user overrides_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject162').huntingQueryVersion162]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_162",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top policies performing user overrides",
+                "category": "Hunting Queries",
+                "query": "EmailEvents  \n| where UserLevelPolicy!=\"\" and UserLevelAction == \"Allow\" //\"Block\"\n| extend UserPolicy = split(UserLevelPolicy, \"(\", 0)\n| summarize count() by tostring(UserPolicy)\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps in reviewing top policies for user overrides (Allow/Block)"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject162')._huntingQuerycontentId162),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 162",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject162')._huntingQuerycontentId162)]",
+                "contentId": "[variables('huntingQueryObject162')._huntingQuerycontentId162]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject162').huntingQueryVersion162]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject162')._huntingQuerycontentId162]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top policies performing user overrides",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject162')._huntingQuerycontentId162,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject162')._huntingQuerycontentId162,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject163').huntingQueryTemplateSpecName163]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total Emails with Admin Overrides - Allow_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject163').huntingQueryVersion163]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_163",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Total Emails with Admin Overrides (Allow)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where OrgLevelPolicy != \"\" and OrgLevelAction == \"Allow\"\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by OrgLevelPolicy\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject163')._huntingQuerycontentId163),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 163",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject163')._huntingQuerycontentId163)]",
+                "contentId": "[variables('huntingQueryObject163')._huntingQuerycontentId163]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject163').huntingQueryVersion163]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject163')._huntingQuerycontentId163]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Total Emails with Admin Overrides (Allow)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject163')._huntingQuerycontentId163,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject163')._huntingQuerycontentId163,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject164').huntingQueryTemplateSpecName164]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total Emails with Admin Overrides - Block_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject164').huntingQueryVersion164]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_164",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Total Emails with Admin Overrides (Block)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where OrgLevelPolicy != \"\" and OrgLevelAction == \"Block\"\n| make-series TotalAdminOverrides = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject164')._huntingQuerycontentId164),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 164",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject164')._huntingQuerycontentId164)]",
+                "contentId": "[variables('huntingQueryObject164')._huntingQuerycontentId164]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject164').huntingQueryVersion164]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject164')._huntingQuerycontentId164]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Total Emails with Admin Overrides (Block)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject164')._huntingQuerycontentId164,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject164')._huntingQuerycontentId164,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject165').huntingQueryTemplateSpecName165]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total Emails with User Overrides - Allow_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject165').huntingQueryVersion165]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_165",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Total Emails with User Overrides (Allow)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where UserLevelPolicy != \"\" and UserLevelAction == \"Allow\"\n| summarize Emails = count() by UserLevelAction, UserLevelPolicy, ThreatTypes\n| sort by Emails desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject165')._huntingQuerycontentId165),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 165",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject165')._huntingQuerycontentId165)]",
+                "contentId": "[variables('huntingQueryObject165')._huntingQuerycontentId165]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject165').huntingQueryVersion165]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject165')._huntingQuerycontentId165]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Total Emails with User Overrides (Allow)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject165')._huntingQuerycontentId165,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject165')._huntingQuerycontentId165,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject166').huntingQueryTemplateSpecName166]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total Emails with User Overrides - Block_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject166').huntingQueryVersion166]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_166",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Total Emails with User Overrides (Block)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where UserLevelPolicy != \"\" and UserLevelAction == \"Block\"\n| make-series TotalUserOverrides = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject166')._huntingQuerycontentId166),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 166",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject166')._huntingQuerycontentId166)]",
+                "contentId": "[variables('huntingQueryObject166')._huntingQuerycontentId166]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject166').huntingQueryVersion166]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject166')._huntingQuerycontentId166]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Total Emails with User Overrides (Block)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject166')._huntingQuerycontentId166,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject166')._huntingQuerycontentId166,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject167').huntingQueryTemplateSpecName167]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detection Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject167').huntingQueryVersion167]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_167",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\"\n| make-series PhishDetections = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish detections over time summarizing the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject167')._huntingQuerycontentId167),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 167",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject167')._huntingQuerycontentId167)]",
+                "contentId": "[variables('huntingQueryObject167')._huntingQuerycontentId167]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject167').huntingQueryVersion167]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject167')._huntingQuerycontentId167]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject167')._huntingQuerycontentId167,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject167')._huntingQuerycontentId167,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject168').huntingQueryTemplateSpecName168]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detections by Delivery Location - High_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject168').huntingQueryVersion168]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_168",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detections (High) by delivery location",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where tostring(parse_json(ConfidenceLevel).Phish) == \"High\"\n| summarize count() by LatestDeliveryLocation\n| sort by count_ desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails with Phish detections (High confidence) summarizing the data by Delivery Location."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject168')._huntingQuerycontentId168),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 168",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject168')._huntingQuerycontentId168)]",
+                "contentId": "[variables('huntingQueryObject168')._huntingQuerycontentId168]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject168').huntingQueryVersion168]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject168')._huntingQuerycontentId168]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detections (High) by delivery location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject168')._huntingQuerycontentId168,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject168')._huntingQuerycontentId168,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject169').huntingQueryTemplateSpecName169]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detections by Delivery Location - Medium_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject169').huntingQueryVersion169]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_169",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detections (Normal) by delivery location",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where tostring(parse_json(ConfidenceLevel).Phish) == \"Normal\"\n| summarize count() by LatestDeliveryLocation\n| sort by count_ desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails with Phish detections (Normal confidence) summarizing the data by Delivery Location."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject169')._huntingQuerycontentId169),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 169",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject169')._huntingQuerycontentId169)]",
+                "contentId": "[variables('huntingQueryObject169')._huntingQuerycontentId169]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject169').huntingQueryVersion169]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject169')._huntingQuerycontentId169]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detections (Normal) by delivery location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject169')._huntingQuerycontentId169,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject169')._huntingQuerycontentId169,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject170').huntingQueryTemplateSpecName170]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detections by Delivery Location Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject170').huntingQueryVersion170]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_170",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detections by delivery location trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\" and EmailDirection == \"Inbound\"\n| make-series TotalPhishDetections = count(), Quarantine = countif(DeliveryLocation == \"Quarantine\"), Junkfolder = countif(DeliveryLocation == \"Junk folder\"), Inbox = countif(DeliveryLocation == \"Inbox/folder\"), Failed = countif(DeliveryLocation == \"Failed\"), Dropped = countif(DeliveryLocation == \"Dropped\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject170')._huntingQuerycontentId170),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 170",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject170')._huntingQuerycontentId170)]",
+                "contentId": "[variables('huntingQueryObject170')._huntingQuerycontentId170]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject170').huntingQueryVersion170]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject170')._huntingQuerycontentId170]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detections by delivery location trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject170')._huntingQuerycontentId170,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject170')._huntingQuerycontentId170,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject171').huntingQueryTemplateSpecName171]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject171').huntingQueryVersion171]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_171",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detections by Detection technology Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\"\n| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(PhishMethod)\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by PhishMethod\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject171')._huntingQuerycontentId171),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 171",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject171')._huntingQuerycontentId171)]",
+                "contentId": "[variables('huntingQueryObject171')._huntingQuerycontentId171]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject171').huntingQueryVersion171]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject171')._huntingQuerycontentId171]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detections by Detection technology Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject171')._huntingQuerycontentId171,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject171')._huntingQuerycontentId171,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject172').huntingQueryTemplateSpecName172]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject172').huntingQueryVersion172]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_172",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detections by Detection technology",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\"\n| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(PhishMethod)\n| summarize Count = count() by PhishMethod\n| sort by Count desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish detections summarizing the data by various Phish detection technologies/controls"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject172')._huntingQuerycontentId172),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 172",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject172')._huntingQuerycontentId172)]",
+                "contentId": "[variables('huntingQueryObject172')._huntingQuerycontentId172]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject172').huntingQueryVersion172]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject172')._huntingQuerycontentId172]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detections by Detection technology",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject172')._huntingQuerycontentId172,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject172')._huntingQuerycontentId172,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject173').huntingQueryTemplateSpecName173]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Possible device code phishing attempts_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject173').huntingQueryVersion173]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_173",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Possible device code phishing attempts",
+                "category": "Hunting Queries",
+                "query": "let DeviceLoginUrls = pack_array(strcat(\"microsoft.\", \"com/devicelogin\"), strcat(\"login.\", \"microsoftonline.com/common/oauth2/deviceauth\"));\nlet suspiciousUserClicks = materialize(UrlClickEvents\n  | where ActionType in (\"ClickAllowed\", \"UrlScanInProgress\", \"UrlErrorPage\") or IsClickedThrough != \"0\"\n  | where UrlChain has_any (DeviceLoginUrls)\n  | extend AccountUpn = tolower(AccountUpn)\n  | project ClickTime = Timestamp, ActionType, UrlChain, NetworkMessageId, Url, AccountUpn);\n//Check for Risky Sign-In in the short time window\nlet interestedUsersUpn = suspiciousUserClicks\n  | where isnotempty(AccountUpn)\n  | distinct AccountUpn;\nlet suspiciousSignIns = materialize(AADSignInEventsBeta\n  | where ErrorCode == 0\n  | where AccountUpn in~ (interestedUsersUpn)\n  | where RiskLevelDuringSignIn in (10, 50, 100)\n  | extend AccountUpn = tolower(AccountUpn)\n  | join kind=inner suspiciousUserClicks on AccountUpn\n  | where (Timestamp - ClickTime) between (-2min .. 7min)\n  | project Timestamp, ReportId, ClickTime, AccountUpn, RiskLevelDuringSignIn, SessionId, IPAddress, Url\n);\n//Validate errorCode 50199 followed by success in 5 minute time interval for the interested user, which suggests a pause to input the code from the phishing email\nlet interestedSessionUsers = suspiciousSignIns\n  | where isnotempty(AccountUpn)\n  | distinct AccountUpn;\nlet shortIntervalSignInAttemptUsers = materialize(AADSignInEventsBeta\n  | where AccountUpn in~ (interestedSessionUsers)\n  | where ErrorCode in (0, 50199)\n  | summarize ErrorCodes = make_set(ErrorCode) by AccountUpn, CorrelationId, SessionId\n  | where ErrorCodes has_all (0, 50199)\n  | distinct AccountUpn);\nsuspiciousSignIns\n| where AccountUpn in (shortIntervalSignInAttemptUsers)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps hunting for possible device code Phishing attempts"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject173')._huntingQuerycontentId173),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 173",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject173')._huntingQuerycontentId173)]",
+                "contentId": "[variables('huntingQueryObject173')._huntingQuerycontentId173]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject173').huntingQueryVersion173]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject173')._huntingQuerycontentId173]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Possible device code phishing attempts",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject173')._huntingQuerycontentId173,'-', '1.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject173')._huntingQuerycontentId173,'-', '1.0.1')))]",
+        "version": "1.0.1"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject174').huntingQueryTemplateSpecName174]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Domains sending Phish_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject174').huntingQueryVersion174]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_174",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email Top Domains sending Phish",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\n| summarize TotalEmailCount = count(), PhishEmailCount = countif(ThreatTypes has \"Phish\"), Phish_High = countif(ThreatTypes has \"Phish\" and PhishConf == \"High\"), Phish_Normal = countif(ThreatTypes has \"Phish\" and PhishConf == \"Normal\") by SenderFromDomain\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where PhishEmailCount != 0\n| top 15 by PhishEmailCount\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject174')._huntingQuerycontentId174),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 174",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject174')._huntingQuerycontentId174)]",
+                "contentId": "[variables('huntingQueryObject174')._huntingQuerycontentId174]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject174').huntingQueryVersion174]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject174')._huntingQuerycontentId174]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email Top Domains sending Phish",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject174')._huntingQuerycontentId174,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject174')._huntingQuerycontentId174,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject175').huntingQueryTemplateSpecName175]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Users receiving Phish_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject175').huntingQueryVersion175]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_175",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Users receiving Phish",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), PhishEmailCount = countif(ThreatTypes has \"Phish\") by RecipientEmailAddress\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where PhishEmailCount != 0\n| top 15 by PhishEmailCount\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total inbound emails with Phish detections summarizing the data by the top recipient email address (RecipientEmailAddress)"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject175')._huntingQuerycontentId175),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 175",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject175')._huntingQuerycontentId175)]",
+                "contentId": "[variables('huntingQueryObject175')._huntingQuerycontentId175]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject175').huntingQueryVersion175]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject175')._huntingQuerycontentId175]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Users receiving Phish",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject175')._huntingQuerycontentId175,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject175')._huntingQuerycontentId175,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject176').huntingQueryTemplateSpecName176]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Zero-day Phish Detections Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject176').huntingQueryVersion176]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_176",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Zero-day Phish Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\"\n| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)\n| where PhishMethod in ('File detonation', 'URL detonation')\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by PhishMethod\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject176')._huntingQuerycontentId176),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 176",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject176')._huntingQuerycontentId176)]",
+                "contentId": "[variables('huntingQueryObject176')._huntingQuerycontentId176]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject176').huntingQueryVersion176]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject176')._huntingQuerycontentId176]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Zero-day Phish Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject176')._huntingQuerycontentId176,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject176')._huntingQuerycontentId176,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject177').huntingQueryTemplateSpecName177]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Campaign with randomly named attachments_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject177').huntingQueryVersion177]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_177",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Campaign with randomly named attachments",
+                "category": "Hunting Queries",
+                "query": "EmailAttachmentInfo\n| where Timestamp > ago(7d)\n| where FileType in (\"png\", \"jpg\", \"jpeg\", \"gif\", \"svg\")\n| where isnotempty(FileName)\n| extend firstFourFileName = substring(FileName, 0, 4)\n| summarize RecipientsCount = dcount(RecipientEmailAddress), FirstFourFilesCount = dcount(firstFourFileName), suspiciousEmails = make_set(NetworkMessageId, 10) by SenderFromAddress\n| where FirstFourFilesCount >= 10\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this detection,we hunt for emails with randomly named attachment names from the same sender to multiple recipients"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject177')._huntingQuerycontentId177),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 177",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject177')._huntingQuerycontentId177)]",
+                "contentId": "[variables('huntingQueryObject177')._huntingQuerycontentId177]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject177').huntingQueryVersion177]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject177')._huntingQuerycontentId177]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Campaign with randomly named attachments",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject177')._huntingQuerycontentId177,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject177')._huntingQuerycontentId177,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject178').huntingQueryTemplateSpecName178]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Campaign with suspicious keywords_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject178').huntingQueryVersion178]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_178",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Campaign with suspicious keywords",
+                "category": "Hunting Queries",
+                "query": "let PhishingKeywords = ()\n{pack_array(\"account\", \"alert\", \"bank\", \"billing\", \"card\", \"change\", \"confirmation\",\"login\", \"password\", \"mfa\", \"authorize\", \"authenticate\", \"payment\", \"urgent\", \"verify\", \"blocked\");};\nEmailEvents\n| where Timestamp > ago(1d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| where isempty(SenderObjectId)\n| where Subject has_any (PhishingKeywords())\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this detection, we track emails with suspicious keywords in subjects."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject178')._huntingQuerycontentId178),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 178",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject178')._huntingQuerycontentId178)]",
+                "contentId": "[variables('huntingQueryObject178')._huntingQuerycontentId178]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject178').huntingQueryVersion178]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject178')._huntingQuerycontentId178]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Campaign with suspicious keywords",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject178')._huntingQuerycontentId178,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject178')._huntingQuerycontentId178,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject179').huntingQueryTemplateSpecName179]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Custom detection-Emails with QR from non-prevalent senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject179').huntingQueryVersion179]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_179",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Custom detection-Emails with QR from non-prevalent senders",
+                "category": "Hunting Queries",
+                "query": "let QRCode_emails = EmailUrlInfo\n| where Timestamp > ago (2d)\n| where UrlLocation == \"QRCode\"\n| distinct Url,NetworkMessageId;\nlet nMIDs = QRCode_emails | distinct NetworkMessageId;\n// Extracting sender of the email with QRCode:\nlet senders_NMIDs = EmailEvents\n| where Timestamp > ago (2d)\n| where DeliveryAction != \"Blocked\" // Only delivered or Junked emails are interesting\n| where isnotempty(NetworkMessageId)\n| where NetworkMessageId in (nMIDs)\n| distinct  Timestamp, NetworkMessageId, RecipientEmailAddress, SenderFromAddress, InternetMessageId, RecipientObjectId, ReportId;\nlet senders = senders_NMIDs\n| distinct SenderFromAddress;\n// Checking sender prevalence in the organization\nlet senderprevalence = EmailEvents\n| where Timestamp between (ago(14d)..(now()-24h))\n| where isnotempty(SenderFromAddress)\n| where SenderFromAddress in (senders)\n| summarize TotalEmailCount = count()  by SenderFromAddress\n| where TotalEmailCount > 1;\nlet prevalent_Sender = senderprevalence\n| where isnotempty (SenderFromAddress)\n| distinct SenderFromAddress;\n// Checking where email sender was not prevalent.\nlet nMIDs_from_non_prevalent_Senders = senders_NMIDs\n| where SenderFromAddress !in (prevalent_Sender)\n| distinct NetworkMessageId;\nlet QRCode_emails_from_non_prevalent_senders = QRCode_emails\n| where NetworkMessageId in (nMIDs_from_non_prevalent_Senders)\n| join kind=inner senders_NMIDs on NetworkMessageId\n| project Timestamp,Url,NetworkMessageId, InternetMessageId, RecipientObjectId,RecipientEmailAddress, ReportId;\nQRCode_emails_from_non_prevalent_senders\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this detection, we check the sender prevalence over the last 14 days and use the same to detect malicious activity via email containing QR code"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject179')._huntingQuerycontentId179),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 179",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject179')._huntingQuerycontentId179)]",
+                "contentId": "[variables('huntingQueryObject179')._huntingQuerycontentId179]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject179').huntingQueryVersion179]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject179')._huntingQuerycontentId179]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Custom detection-Emails with QR from non-prevalent senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject179')._huntingQuerycontentId179,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject179')._huntingQuerycontentId179,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject180').huntingQueryTemplateSpecName180]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Emails delivered having URLs from QR codes_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject180').huntingQueryVersion180]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_180",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Emails delivered having URLs from QR codes",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| join EmailUrlInfo on NetworkMessageId\n| where UrlLocation == \"QRCode\"\n| project Timestamp, NetworkMessageId, SenderFromAddress, Subject, Url, UrlDomain, UrlLocation,RecipientEmailAddress\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we hunt for inbound emails delivered having URLs from QR codes"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject180')._huntingQuerycontentId180),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 180",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject180')._huntingQuerycontentId180)]",
+                "contentId": "[variables('huntingQueryObject180')._huntingQuerycontentId180]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject180').huntingQueryVersion180]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject180')._huntingQuerycontentId180]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Emails delivered having URLs from QR codes",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject180')._huntingQuerycontentId180,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject180')._huntingQuerycontentId180,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject181').huntingQueryTemplateSpecName181]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Emails with QR codes and suspicious keywords in subject_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject181').huntingQueryVersion181]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_181",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Emails with QR codes and suspicious keywords in subject",
+                "category": "Hunting Queries",
+                "query": "let SubjectKeywords = ()\n{pack_array(\"authorize\", \"authenticate\", \"account\", \"confirmation\", \"QR\", \"login\", \"password\",  \"payment\", \"urgent\", \"verify\");};\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| where Subject has_any (SubjectKeywords)\n| join EmailUrlInfo on NetworkMessageId\n| where UrlLocation == \"QRCode\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject181')._huntingQuerycontentId181),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 181",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject181')._huntingQuerycontentId181)]",
+                "contentId": "[variables('huntingQueryObject181')._huntingQuerycontentId181]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject181').huntingQueryVersion181]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject181')._huntingQuerycontentId181]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Emails with QR codes and suspicious keywords in subject",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject181')._huntingQuerycontentId181,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject181')._huntingQuerycontentId181,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject182').huntingQueryTemplateSpecName182]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Emails with QR codes from non-prevalent sender_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject182').huntingQueryVersion182]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_182",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Emails with QR codes from non-prevalent sender",
+                "category": "Hunting Queries",
+                "query": "let senderprevalence =\nEmailEvents\n| where Timestamp between (ago(7d)..(now()-24h))\n| where isnotempty(SenderFromAddress)\n| summarize TotalEmailCount = dcount(NetworkMessageId) by SenderFromAddress\n| where TotalEmailCount > 1;\nlet prevalent_Sender = senderprevalence\n| where isnotempty (SenderFromAddress)\n| distinct SenderFromAddress;\nlet QR_from_non_prevalent =\nEmailEvents\n| where EmailDirection == \"Inbound\"\n| where Timestamp > ago(1d)\n| where SenderFromAddress !in (prevalent_Sender)\n| join EmailUrlInfo on NetworkMessageId\n| where UrlLocation == \"QRCode\"\n| distinct SenderFromAddress,Url,NetworkMessageId;\nQR_from_non_prevalent\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we hunt for inbound emails having URLs from QR codes and send by non-prevalent senders"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject182')._huntingQuerycontentId182),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 182",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject182')._huntingQuerycontentId182)]",
+                "contentId": "[variables('huntingQueryObject182')._huntingQuerycontentId182]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject182').huntingQueryVersion182]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject182')._huntingQuerycontentId182]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Emails with QR codes from non-prevalent sender",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject182')._huntingQuerycontentId182,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject182')._huntingQuerycontentId182,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject183').huntingQueryTemplateSpecName183]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunting for sender patterns_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject183').huntingQueryVersion183]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_183",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunting for sender patterns",
+                "category": "Hunting Queries",
+                "query": "let PhishingSenderDisplayNames = ()\n{\npack_array(\"IT\", \"support\", \"Payroll\", \"HR\", \"admin\", \"2FA\", \"notification\", \"sign\", \"reminder\", \"consent\", \"workplace\",\n\"administrator\", \"administration\", \"benefits\", \"employee\", \"update\", \"on behalf\");\n};\nlet suspiciousEmails = EmailEvents\n| where Timestamp > ago(1d)\n| where isnotempty(RecipientObjectId)\n| where isnotempty(SenderFromAddress)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| join kind=inner (EmailAttachmentInfo\n| where Timestamp > ago(1d)\n| where isempty(SenderObjectId)\n| where FileType has_any (\"png\", \"jpg\", \"jpeg\", \"bmp\", \"gif\")\n ) on NetworkMessageId\n| where SenderDisplayName has_any (PhishingSenderDisplayNames())\n| project Timestamp, Subject, FileName, SenderFromDomain, RecipientObjectId, NetworkMessageId;\nlet suspiciousSenders = suspiciousEmails | distinct SenderFromDomain;\nlet prevalentSenders = materialize(EmailEvents\n| where Timestamp between (ago(7d) .. ago(1d))\n| where isnotempty(RecipientObjectId)\n| where isnotempty(SenderFromAddress)\n| where SenderFromDomain in (suspiciousSenders)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| distinct SenderFromDomain);\nsuspiciousEmails\n| where SenderFromDomain !in (prevalentSenders)\n| project Timestamp, Subject, FileName, SenderFromDomain, RecipientObjectId, NetworkMessageId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this detection approach, we correlate email from non-prevalent senders in the organization with impersonation intents"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject183')._huntingQuerycontentId183),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 183",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject183')._huntingQuerycontentId183)]",
+                "contentId": "[variables('huntingQueryObject183')._huntingQuerycontentId183]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject183').huntingQueryVersion183]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject183')._huntingQuerycontentId183]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunting for sender patterns",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject183')._huntingQuerycontentId183,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject183')._huntingQuerycontentId183,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject184').huntingQueryTemplateSpecName184]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunting for user signals-clusters_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject184').huntingQueryVersion184]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_184",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunting for user signals-clusters",
+                "category": "Hunting Queries",
+                "query": "let suspiciousClusters = EmailEvents\n| where Timestamp > ago(7d)\n| where EmailDirection == \"Inbound\"\n| where NetworkMessageId in (\"5ff15b1f-d731-4625-4c1c-08dc8615943f\",\"00ff0916-1263-428c-a558-08dc86a6d3cd\") //<List of suspicious Network Message Ids from Alerts>\n| distinct EmailClusterId;\nEmailEvents\n| where Timestamp > ago(7d)\n| where EmailDirection == \"Inbound\"\n| where EmailClusterId in (suspiciousClusters)\n| summarize make_set(Subject), make_set(SenderFromDomain), dcount(RecipientObjectId),dcount(SenderDisplayName) by EmailClusterId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject184')._huntingQuerycontentId184),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 184",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject184')._huntingQuerycontentId184)]",
+                "contentId": "[variables('huntingQueryObject184')._huntingQuerycontentId184]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject184').huntingQueryVersion184]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject184')._huntingQuerycontentId184]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunting for user signals-clusters",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject184')._huntingQuerycontentId184,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject184')._huntingQuerycontentId184,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject185').huntingQueryTemplateSpecName185]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Inbound emails with QR code URLs_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject185').huntingQueryVersion185]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_185",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Inbound emails with QR code URLs",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| join EmailUrlInfo on NetworkMessageId\n| where UrlLocation == \"QRCode\"\n| summarize dcount(NetworkMessageId) by bin(Timestamp, 1d)\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we summarize volume of inbound emails with QR code URLs in last 30 days"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject185')._huntingQuerycontentId185),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 185",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject185')._huntingQuerycontentId185)]",
+                "contentId": "[variables('huntingQueryObject185')._huntingQuerycontentId185]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject185').huntingQueryVersion185]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject185')._huntingQuerycontentId185]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Inbound emails with QR code URLs",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject185')._huntingQuerycontentId185,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject185')._huntingQuerycontentId185,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject186').huntingQueryTemplateSpecName186]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Personalized campaigns based on the first few keywords_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject186').huntingQueryVersion186]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_186",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Personalized campaigns based on the first few keywords",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(1d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| where isempty(SenderObjectId)\n| extend words = split(Subject,\" \")\n| project firstWord = tostring(words[0]), secondWord = tostring(words[1]), thirdWord = tostring(words[2]), Subject, SenderFromAddress, RecipientEmailAddress, NetworkMessageId\n| summarize SubjectsCount = dcount(Subject), RecipientsCount = dcount(RecipientEmailAddress), suspiciousEmails = make_set(NetworkMessageId, 10) by firstWord, secondWord, thirdWord, SenderFromAddress\n| where SubjectsCount >= 10\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this detection, we track emails with personalized subjects."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject186')._huntingQuerycontentId186),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 186",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject186')._huntingQuerycontentId186)]",
+                "contentId": "[variables('huntingQueryObject186')._huntingQuerycontentId186]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject186').huntingQueryVersion186]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject186')._huntingQuerycontentId186]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Personalized campaigns based on the first few keywords",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject186')._huntingQuerycontentId186,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject186')._huntingQuerycontentId186,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject187').huntingQueryTemplateSpecName187]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Personalized campaigns based on the last few keywords_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject187').huntingQueryVersion187]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_187",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Personalized campaigns based on the last few keywords",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(1d)\n| where EmailDirection == \"Inbound\"\n| where DeliveryAction == \"Delivered\"\n| where isempty(SenderObjectId)\n| extend words = split(Subject,\" \")\n| project firstLastWord = tostring(words[-1]), secondLastWord = tostring(words[-2]), thirdLastWord = tostring(words[-3]), Subject, SenderFromAddress, RecipientEmailAddress, NetworkMessageId\n| summarize SubjectsCount = dcount(Subject), RecipientsCount = dcount(RecipientEmailAddress), suspiciousEmails = make_set(NetworkMessageId, 10) by firstLastWord, secondLastWord, thirdLastWord, SenderFromAddress\n| where SubjectsCount >= 10\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this detection, we track emails with personalized subjects."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject187')._huntingQuerycontentId187),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 187",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject187')._huntingQuerycontentId187)]",
+                "contentId": "[variables('huntingQueryObject187')._huntingQuerycontentId187]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject187').huntingQueryVersion187]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject187')._huntingQuerycontentId187]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Personalized campaigns based on the last few keywords",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject187')._huntingQuerycontentId187,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject187')._huntingQuerycontentId187,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject188').huntingQueryTemplateSpecName188]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Risky sign-in attempt from a non-managed device_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject188').huntingQueryVersion188]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_188",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Risky sign-in attempt from a non-managed device",
+                "category": "Hunting Queries",
+                "query": "AADSignInEventsBeta\n| where Timestamp > ago(7d)\n| where IsManaged != 1\n| where IsCompliant != 1\n//Filtering only for medium and high risk sign-in\n| where RiskLevelDuringSignIn in (50, 100)\n| where ClientAppUsed == \"Browser\"\n| where isempty(DeviceTrustType)\n| where isnotempty(State) or isnotempty(Country) or isnotempty(City)\n| where isnotempty(IPAddress)\n| where isnotempty(AccountObjectId)\n| where isempty(DeviceName)\n| where isempty(AadDeviceId)\n| project Timestamp,IPAddress, AccountObjectId, ApplicationId, SessionId, RiskLevelDuringSignIn\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject188')._huntingQuerycontentId188),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 188",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject188')._huntingQuerycontentId188)]",
+                "contentId": "[variables('huntingQueryObject188')._huntingQuerycontentId188]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject188').huntingQueryVersion188]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject188')._huntingQuerycontentId188]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Risky sign-in attempt from a non-managed device",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject188')._huntingQuerycontentId188,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject188')._huntingQuerycontentId188,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject189').huntingQueryTemplateSpecName189]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Suspicious sign-in attempts from QR code phishing campaigns_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject189').huntingQueryVersion189]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_189",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Suspicious sign-in attempts from QR code phishing campaigns",
+                "category": "Hunting Queries",
+                "query": "let successfulRiskySignIn = materialize(AADSignInEventsBeta\n| where Timestamp > ago(1d)\n| where isempty(DeviceTrustType)\n| where IsManaged != 1\n| where IsCompliant != 1\n| where RiskLevelDuringSignIn in (50, 100)\n| project Timestamp, ReportId, IPAddress, AccountUpn, AccountObjectId, SessionId, Country, State, City\n);\nlet suspiciousSignInUsers = successfulRiskySignIn\n| distinct AccountObjectId;\nlet suspiciousSignInIPs = successfulRiskySignIn\n| distinct IPAddress;\nlet suspiciousSignInCities = successfulRiskySignIn\n| distinct City;\nCloudAppEvents\n| where Timestamp > ago(1d)\n| where ActionType == \"MailItemsAccessed\"\n| where AccountObjectId in (suspiciousSignInUsers)\n| where IPAddress !in (suspiciousSignInIPs)\n| where City !in (suspiciousSignInCities)\n| join kind=inner successfulRiskySignIn on AccountObjectId\n| where AccountObjectId in (suspiciousSignInUsers)\n| where (Timestamp - Timestamp1) between (-5min .. 5min)\n| extend folders = RawEventData.Folders\n| mv-expand folders\n| extend items = folders.FolderItems\n| mv-expand items\n| extend InternetMessageId = tostring(items.InternetMessageId)\n| project Timestamp, ReportId, IPAddress, InternetMessageId, AccountObjectId, SessionId, Country, State, City\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject189')._huntingQuerycontentId189),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 189",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject189')._huntingQuerycontentId189)]",
+                "contentId": "[variables('huntingQueryObject189')._huntingQuerycontentId189]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject189').huntingQueryVersion189]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject189')._huntingQuerycontentId189]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Suspicious sign-in attempts from QR code phishing campaigns",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject189')._huntingQuerycontentId189,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject189')._huntingQuerycontentId189,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject190').huntingQueryTemplateSpecName190]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Group quarantine release_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject190').huntingQueryVersion190]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_190",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Group quarantine release",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"QuarantineReleaseMessage\"\n| extend parsed=parse_json(RawEventData)\n| extend NetworkMessageId = tostring(parsed.NetworkMessageId)\n| join EmailEvents on NetworkMessageId\n| summarize count() by DetectionMethods\n| order by count_ desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject190')._huntingQuerycontentId190),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 190",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject190')._huntingQuerycontentId190)]",
+                "contentId": "[variables('huntingQueryObject190')._huntingQuerycontentId190]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject190').huntingQueryVersion190]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject190')._huntingQuerycontentId190]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Group quarantine release",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject190')._huntingQuerycontentId190,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject190')._huntingQuerycontentId190,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject191').huntingQueryTemplateSpecName191]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "High Confidence Phish Released_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject191').huntingQueryVersion191]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_191",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "High Confidence Phish Released",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"QuarantineReleaseMessage\"\n| project ReleaseTime = Timestamp, ResultStatus = RawEventData.ResultStatus, ActionType, ReleasedBy = tostring(RawEventData.UserId), NetworkMessageId = tostring(RawEventData.NetworkMessageId), ReleaseTo = RawEventData.ReleaseTo\n| join kind=inner (\n  EmailEvents\n  | where todynamic(ConfidenceLevel).Phish == \"High\"\n  | project-rename EmailTime = Timestamp\n  ) on NetworkMessageId\n| project-away NetworkMessageId1\n| order by ReleaseTime asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query shows information about high confidence phish email that has been released from the Quarantine."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject191')._huntingQuerycontentId191),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 191",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject191')._huntingQuerycontentId191)]",
+                "contentId": "[variables('huntingQueryObject191')._huntingQuerycontentId191]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject191').huntingQueryVersion191]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject191')._huntingQuerycontentId191]",
+        "contentKind": "HuntingQuery",
+        "displayName": "High Confidence Phish Released",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject191')._huntingQuerycontentId191,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject191')._huntingQuerycontentId191,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject192').huntingQueryTemplateSpecName192]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Quarantine Phish reason trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject192').huntingQueryVersion192]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_192",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Quarantine Phish Reason trend",
+                "category": "Hunting Queries",
+                "query": "let minTime = startofday(ago(30d));\nlet maxTime = startofday(now());\nEmailEvents\n| where Timestamp >= minTime\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Phish\" and DeliveryLocation == \"Quarantine\"\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(Details)\n| where Timestamp < maxTime\n| make-series Count = count() default = 0 on Timestamp from minTime to maxTime step 1d by Details\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the amount of phish emails that are quarantined, summarized daily by the detection method"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject192')._huntingQuerycontentId192),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 192",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject192')._huntingQuerycontentId192)]",
+                "contentId": "[variables('huntingQueryObject192')._huntingQuerycontentId192]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject192').huntingQueryVersion192]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject192')._huntingQuerycontentId192]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Quarantine Phish Reason trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject192')._huntingQuerycontentId192,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject192')._huntingQuerycontentId192,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject193').huntingQueryTemplateSpecName193]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Quarantine Phish reason_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject193').huntingQueryVersion193]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_193",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Quarantine Phish Reason",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish' and DeliveryLocation == \"Quarantine\"\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(Phish)\n| summarize count() by Phish\n| sort by count_ desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total amount of phish emails that are quarantined, summarized by the detection method"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject193')._huntingQuerycontentId193),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 193",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject193')._huntingQuerycontentId193)]",
+                "contentId": "[variables('huntingQueryObject193')._huntingQuerycontentId193]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject193').huntingQueryVersion193]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject193')._huntingQuerycontentId193]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Quarantine Phish Reason",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject193')._huntingQuerycontentId193,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject193')._huntingQuerycontentId193,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject194').huntingQueryTemplateSpecName194]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Quarantine Release Email Details_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject194').huntingQueryVersion194]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_194",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Quarantine Release Email Details",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"QuarantineReleaseMessage\"\n| project ReleaseTime = Timestamp, ResultStatus = RawEventData.ResultStatus, ActionType, ReleasedBy = tostring(RawEventData.UserId), NetworkMessageId = tostring(RawEventData.NetworkMessageId), ReleaseTo = RawEventData.ReleaseTo\n| join kind=inner (\n  EmailEvents\n  | project-rename EmailTime = Timestamp\n  ) on NetworkMessageId\n| project-away NetworkMessageId1\n| order by ReleaseTime asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query shows information about email that has been released from the Quarantine in Defender for Office 365."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject194')._huntingQuerycontentId194),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 194",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject194')._huntingQuerycontentId194)]",
+                "contentId": "[variables('huntingQueryObject194')._huntingQuerycontentId194]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject194').huntingQueryVersion194]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject194')._huntingQuerycontentId194]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Quarantine Release Email Details",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject194')._huntingQuerycontentId194,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject194')._huntingQuerycontentId194,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject195').huntingQueryTemplateSpecName195]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Quarantine release trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject195').huntingQueryVersion195]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_195",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Quarantine release trend",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"QuarantineReleaseMessage\"\n| summarize count() by bin(Timestamp, 1d)\n| project-rename Releases = count_\n| render timechart with (title=\"Quarantine Releases by Day\")\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing quarantine release trend in Defender for Office 365"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject195')._huntingQuerycontentId195),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 195",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject195')._huntingQuerycontentId195)]",
+                "contentId": "[variables('huntingQueryObject195')._huntingQuerycontentId195]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject195').huntingQueryVersion195]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject195')._huntingQuerycontentId195]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Quarantine release trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject195')._huntingQuerycontentId195,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject195')._huntingQuerycontentId195,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject196').huntingQueryTemplateSpecName196]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Quarantine releases by Detection types_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject196').huntingQueryVersion196]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_196",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Quarantine releases by Detection Types",
+                "category": "Hunting Queries",
+                "query": "//Per detection technology: the share of its quarantined emails that were later released from quarantine.\n//Release % = released / quarantined for that detection technology. A high rate flags a detector that may be\n//over-flagging legitimate mail. Detectors with fewer than 10 quarantined emails are excluded so the rate is\n//statistically meaningful rather than driven by one or two messages.\nEmailEvents\n| where Timestamp > ago(30d)\n| where DeliveryLocation == \"Quarantine\"\n| extend MDO_detection = parse_json(DetectionMethods)\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\n| join kind=leftouter (\n    EmailPostDeliveryEvents\n    | where Timestamp > ago(30d)\n    | where Action == \"Quarantine release\"\n    | distinct NetworkMessageId\n    | extend ReleasedFlag = \"yes\"\n  ) on NetworkMessageId\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\n| where Quarantined >= 10\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\n| order by ['Release %'] desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails released from quarantine and summarizing the result by the original filter verdict"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject196')._huntingQuerycontentId196),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 196",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject196')._huntingQuerycontentId196)]",
+                "contentId": "[variables('huntingQueryObject196')._huntingQuerycontentId196]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject196').huntingQueryVersion196]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject196')._huntingQuerycontentId196]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Quarantine releases by Detection Types",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject196')._huntingQuerycontentId196,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject196')._huntingQuerycontentId196,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject197').huntingQueryTemplateSpecName197]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Quarantine Spam reason trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject197').huntingQueryVersion197]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_197",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Quarantine Spam Reason trend",
+                "category": "Hunting Queries",
+                "query": "let minTime = startofday(ago(30d));\nlet maxTime = startofday(now());\nEmailEvents\n| where Timestamp >= minTime\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Spam\" and DeliveryLocation == \"Quarantine\"\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\n| where isnotempty(Details)\n| where Timestamp < maxTime\n| make-series Count = count() default = 0 on Timestamp from minTime to maxTime step 1d by Details\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the amount of spam emails that are quarantined, summarized daily by the detection method"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject197')._huntingQuerycontentId197),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 197",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject197')._huntingQuerycontentId197)]",
+                "contentId": "[variables('huntingQueryObject197')._huntingQuerycontentId197]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject197').huntingQueryVersion197]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject197')._huntingQuerycontentId197]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Quarantine Spam Reason trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject197')._huntingQuerycontentId197,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject197')._huntingQuerycontentId197,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject198').huntingQueryTemplateSpecName198]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Quarantine Spam reason_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject198').huntingQueryVersion198]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_198",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Quarantine Spam Reason",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam' and DeliveryLocation == \"Quarantine\"\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\n| where isnotempty(Spam)\n| summarize count() by Spam\n| sort by count_ desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total amount of spam emails that are quarantined, summarized by the detection method"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject198')._huntingQuerycontentId198),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 198",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject198')._huntingQuerycontentId198)]",
+                "contentId": "[variables('huntingQueryObject198')._huntingQuerycontentId198]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject198').huntingQueryVersion198]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject198')._huntingQuerycontentId198]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Quarantine Spam Reason",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject198')._huntingQuerycontentId198,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject198')._huntingQuerycontentId198,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject199').huntingQueryTemplateSpecName199]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AIR investigation actions insight_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject199').huntingQueryVersion199]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_199",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "AIR investigation actions insight",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AirInvestigationData\"\n| project Timestamp, RawEventData\n| extend EventData = parse_json(RawEventData)\n| extend Data = parse_json(tostring(EventData.Data))\n| extend InvestigationType = EventData.InvestigationType\n| extend InvestigationId = RawEventData.InvestigationId\n| extend Status = tostring(Data.Status)\n| where Status == \"Resolved\"\n| extend ActionRaw = parse_json(tostring(EventData.Actions))\n| mv-expand ActionRaw\n| extend Action = parse_json(tostring(ActionRaw))\n| extend ActionType=Action.ActionType, ActionApproval=Action.ActionApproval, ApprovedBy=Action.ApprovedBy, ApproverComment=Action.ApproverComment, ActionStatus=Action.ActionStatus\n| mv-expand Action.Entities\n| extend EntityQuery = Action_Entities.Query\n| mv-expand Action_Entities.Urls, Action_Entities.NetworkMessageIds\n| sort by Timestamp\n| project Timestamp, InvestigationType, InvestigationId, ActionType, ActionApproval, ApprovedBy, ApproverComment, ActionStatus, EntityQuery, Action_Entities_Urls, Action_Entities_NetworkMessageIds\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query provides insights into AIR investigation actions in Microsoft Defender for Office 365."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject199')._huntingQuerycontentId199),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 199",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject199')._huntingQuerycontentId199)]",
+                "contentId": "[variables('huntingQueryObject199')._huntingQuerycontentId199]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject199').huntingQueryVersion199]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject199')._huntingQuerycontentId199]",
+        "contentKind": "HuntingQuery",
+        "displayName": "AIR investigation actions insight",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject199')._huntingQuerycontentId199,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject199')._huntingQuerycontentId199,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject200').huntingQueryTemplateSpecName200]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Email remediation action list_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject200').huntingQueryVersion200]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_200",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Listing Email Remediation Actions via Explorer",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where LatestDeliveryAction in (\"Hard delete\", \"Soft delete\", \"Moved to junk folder\", \"Moved to deleted items\")\n| summarize HardDelete_NetworkID = make_list_if(strcat(NetworkMessageId, @\"\\\", Timestamp,@\"\\\", Subject), LatestDeliveryAction == \"Hard delete\"),  \n            SoftDelete_NetworkID = make_list_if(strcat(NetworkMessageId, @\"\\\", Timestamp,@\"\\\", Subject), LatestDeliveryAction == \"Soft delete\"),\n            MoveToJunk_NetworkID = make_list_if(strcat(NetworkMessageId, @\"\\\", Timestamp,@\"\\\", Subject), LatestDeliveryAction == \"Moved to junk folder\"),\n            MoveToDelete_NetworkID = make_list_if(strcat(NetworkMessageId, @\"\\\", Timestamp,@\"\\\", Subject), LatestDeliveryAction == \"Moved to deleted items\") by RecipientEmailAddress\n| extend HardDelete_case = array_length(HardDelete_NetworkID)\n| extend SoftDelete_case = array_length(SoftDelete_NetworkID)\n| extend MoveToJunk_case = array_length(MoveToJunk_NetworkID)\n| extend MoveToDelete_case = array_length(MoveToDelete_NetworkID)\n| extend Sum_case = HardDelete_case + SoftDelete_case + MoveToJunk_case + MoveToDelete_case\n| project RecipientEmailAddress, Sum_case, HardDelete_case, SoftDelete_case, MoveToJunk_case, MoveToDelete_case, HardDelete_NetworkID, SoftDelete_NetworkID, MoveToJunk_NetworkID, MoveToDelete_NetworkID\n| order by Sum_case desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Listing Email Remediation Actions performed via Explorer in Defender for Office 365"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject200')._huntingQuerycontentId200),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 200",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject200')._huntingQuerycontentId200)]",
+                "contentId": "[variables('huntingQueryObject200')._huntingQuerycontentId200]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject200').huntingQueryVersion200]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject200')._huntingQuerycontentId200]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Listing Email Remediation Actions via Explorer",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject200')._huntingQuerycontentId200,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject200')._huntingQuerycontentId200,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject201').huntingQueryTemplateSpecName201]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Bulk Detection Top10 Domains_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject201').huntingQueryVersion201]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_201",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 domains sending Bulk email",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\" and isnotempty(BulkComplaintLevel)\n| summarize count() by BulkComplaintLevel, SenderFromDomain\n| top 10 by count_\n| project SenderFromDomain, BulkComplaintLevel, Emails = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total inbound emails which has any Bulk complaint level."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject201')._huntingQuerycontentId201),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 201",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject201')._huntingQuerycontentId201)]",
+                "contentId": "[variables('huntingQueryObject201')._huntingQuerycontentId201]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject201').huntingQueryVersion201]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject201')._huntingQuerycontentId201]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 domains sending Bulk email",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject201')._huntingQuerycontentId201,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject201')._huntingQuerycontentId201,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject202').huntingQueryTemplateSpecName202]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection Delivery Location_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject202').huntingQueryVersion202]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_202",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam detection by delivery location",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where DetectionMethods has \"Spam\" and EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| make-series TotalSpamDetections=count(),Quarantine = countif(DeliveryLocation == \"Quarantine\"),Junkfolder=countif(DeliveryLocation == \"Junk folder\"),Inbox=countif(DeliveryLocation == \"Inbox/folder\"),Failed=countif(DeliveryLocation == \"Failed\"),Dropped=countif(DeliveryLocation == \"Dropped\") default = 0 on Timestamp step 1d\n// | render timechart // Uncomment this line to render as a graph\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject202')._huntingQuerycontentId202),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 202",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject202')._huntingQuerycontentId202)]",
+                "contentId": "[variables('huntingQueryObject202')._huntingQuerycontentId202]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject202').huntingQueryVersion202]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject202')._huntingQuerycontentId202]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam detection by delivery location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject202')._huntingQuerycontentId202,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject202')._huntingQuerycontentId202,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject203').huntingQueryTemplateSpecName203]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject203').huntingQueryVersion203]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_203",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam detection by IP and its location",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6).\nlet ipv4position = EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\" and SenderIPv4 != \"\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderIPv4\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude), Country = tostring(GeoInfo.country)\n| project SenderIPv4, Country, Latitude, Longitude, count_;\nlet ipv6position = EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\" and SenderIPv6 != \"\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by SenderIPv6\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv6)\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude), Country = tostring(GeoInfo.country)\n| project SenderIPv6, Country, Latitude, Longitude, count_;\nipv4position\n| union ipv6position\n| project SenderIPv6, SenderIPv4, Country, Latitude, Longitude, count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4, SenderIPv6)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject203')._huntingQuerycontentId203),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 203",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject203')._huntingQuerycontentId203)]",
+                "contentId": "[variables('huntingQueryObject203')._huntingQuerycontentId203]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject203').huntingQueryVersion203]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject203')._huntingQuerycontentId203]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam detection by IP and its location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject203')._huntingQuerycontentId203,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject203')._huntingQuerycontentId203,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject204').huntingQueryTemplateSpecName204]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection Mails with BCL_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject204').huntingQueryVersion204]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_204",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Bulk Emails by Sender Bulk Complaint level",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where EmailDirection == \"Inbound\" and isnotempty(BulkComplaintLevel)\n| summarize count() by BulkComplaintLevel\n| sort by BulkComplaintLevel desc\n| project BulkComplaintLevel, Emails = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total inbound emails which has any Bulk complaint level."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject204')._huntingQuerycontentId204),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 204",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject204')._huntingQuerycontentId204)]",
+                "contentId": "[variables('huntingQueryObject204')._huntingQuerycontentId204]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject204').huntingQueryVersion204]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject204')._huntingQuerycontentId204]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Bulk Emails by Sender Bulk Complaint level",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject204')._huntingQuerycontentId204,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject204')._huntingQuerycontentId204,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject205').huntingQueryTemplateSpecName205]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection Tech_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject205').huntingQueryVersion205]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_205",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam detection technologies",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls in Microsoft Defender for Office 365.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where DetectionMethods has 'Spam'\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| project Timestamp, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) | summarize count() by Spam=tostring(column_ifexists('Spam', ''))\n| sort by count_\n// | render piechart  // Uncomment this line to render as a graph\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject205')._huntingQuerycontentId205),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 205",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject205')._huntingQuerycontentId205)]",
+                "contentId": "[variables('huntingQueryObject205')._huntingQuerycontentId205]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject205').huntingQueryVersion205]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject205')._huntingQuerycontentId205]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam detection technologies",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject205')._huntingQuerycontentId205,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject205')._huntingQuerycontentId205,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject206').huntingQueryTemplateSpecName206]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection Top10 Domains_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject206').huntingQueryVersion206]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_206",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email Top 10 Domains sending Spam",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain).\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\n| extend Bad_Traffic_Percentage_Inbound = round(100.0 * SpamEmailCount / TotalEmailCount, 2)\n| where SpamEmailCount != 0\n| top 10 by SpamEmailCount\n| project SenderFromDomain, SpamEmailCount, TotalEmailCount, Bad_Traffic_Percentage_Inbound\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total inbound emails with Spam detections."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject206')._huntingQuerycontentId206),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 206",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject206')._huntingQuerycontentId206)]",
+                "contentId": "[variables('huntingQueryObject206')._huntingQuerycontentId206]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject206').huntingQueryVersion206]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject206')._huntingQuerycontentId206]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email Top 10 Domains sending Spam",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject206')._huntingQuerycontentId206,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject206')._huntingQuerycontentId206,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject207').huntingQueryTemplateSpecName207]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection Top10 Users_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject207').huntingQueryVersion207]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_207",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email Top 10 Targeted Users (Spam)",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 10 recipient email address (RecipientEmailAddress).\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\" and EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize count() by RecipientEmailAddress\n| top 10 by count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises top 10 users targeted with Spam."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject207')._huntingQuerycontentId207),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 207",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject207')._huntingQuerycontentId207)]",
+                "contentId": "[variables('huntingQueryObject207')._huntingQuerycontentId207]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject207').huntingQueryVersion207]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject207')._huntingQuerycontentId207]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email Top 10 Targeted Users (Spam)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject207')._huntingQuerycontentId207,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject207')._huntingQuerycontentId207,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject208').huntingQueryTemplateSpecName208]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection Top15 Domains Details_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject208').huntingQueryVersion208]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_208",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email Top 15 Domains sending Spam with Additional Details",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(),\n            SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\n| where SpamEmailCount != 0\n| top 15 by SpamEmailCount\n| project SenderFromDomain, SpamEmailCount, TotalEmailCount, Bad_Traffic_Percentage_Inbound\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject208')._huntingQuerycontentId208),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 208",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject208')._huntingQuerycontentId208)]",
+                "contentId": "[variables('huntingQueryObject208')._huntingQuerycontentId208]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject208').huntingQueryVersion208]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject208')._huntingQuerycontentId208]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email Top 15 Domains sending Spam with Additional Details",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject208')._huntingQuerycontentId208,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject208')._huntingQuerycontentId208,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject209').huntingQueryTemplateSpecName209]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection Top15 Users Details_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject209').huntingQueryVersion209]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_209",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Email Top 15 Targeted Users (Spam) with Additional Details",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize TotalEmailCount = count(), SpamEmailCount = countif(ThreatTypes has \"Spam\") by RecipientEmailAddress\n| extend Bad_Traffic_Percentage_Inbound = round(100.0 * SpamEmailCount / TotalEmailCount, 2)\n| where SpamEmailCount != 0\n| top 15 by SpamEmailCount\n| project RecipientEmailAddress, SpamEmailCount, TotalEmailCount, Bad_Traffic_Percentage_Inbound\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises top 15 users targeted with Spam with summarized spam detections."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject209')._huntingQuerycontentId209),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 209",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject209')._huntingQuerycontentId209)]",
+                "contentId": "[variables('huntingQueryObject209')._huntingQuerycontentId209]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject209').huntingQueryVersion209]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject209')._huntingQuerycontentId209]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Email Top 15 Targeted Users (Spam) with Additional Details",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject209')._huntingQuerycontentId209,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject209')._huntingQuerycontentId209,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject210').huntingQueryTemplateSpecName210]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detection Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject210').huntingQueryVersion210]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_210",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam detection trend",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total emails with Spam detections over time summarizing the data daily.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| make-series Count = count() default = 0 on Timestamp step 1d\n// | render timechart // Uncomment this line to render as a graph\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spam detections over time summarizing the data daily"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject210')._huntingQuerycontentId210),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 210",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject210')._huntingQuerycontentId210)]",
+                "contentId": "[variables('huntingQueryObject210')._huntingQuerycontentId210]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject210').huntingQueryVersion210]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject210')._huntingQuerycontentId210]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam detection trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject210')._huntingQuerycontentId210,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject210')._huntingQuerycontentId210,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject211').huntingQueryTemplateSpecName211]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detections by Detection technology_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject211').huntingQueryVersion211]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_211",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam Detections by Detection technology",
+                "category": "Hunting Queries",
+                "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\n//(v4) Single mv-expand over DetectionMethods.Spam replaces the previous 8-way union: less scan, and new spam techniques appear automatically.\nlet minTime = startofday(ago(30d));\nlet maxTime = startofday(now());\nEmailEvents\n| where Timestamp >= minTime\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where DetectionMethods has \"Spam\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\n| where Timestamp < maxTime\n| make-series Count = count() default = 0 on Timestamp from minTime to maxTime step 1d by Details\n// | render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Spam detections over time by various Spam Detection technologies/controls."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject211')._huntingQuerycontentId211),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 211",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject211')._huntingQuerycontentId211)]",
+                "contentId": "[variables('huntingQueryObject211')._huntingQuerycontentId211]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject211').huntingQueryVersion211]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject211')._huntingQuerycontentId211]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam Detections by Detection technology",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject211')._huntingQuerycontentId211,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject211')._huntingQuerycontentId211,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject212').huntingQueryTemplateSpecName212]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Display Name - Spoof and Impersonation_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject212').huntingQueryVersion212]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_212",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Display Name - Spoof and Impersonation",
+                "category": "Hunting Queries",
+                "query": "let emailDelivered = EmailEvents\n| where Timestamp < ago(24hrs)\nand DeliveryAction == \"Delivered\"\nand SenderDisplayName contains \"Microsoft\"\n| summarize count() by SenderFromAddress\n| where count_ > 3 // ensuring that some level of communications has occurred.\n| project SenderFromAddress;\nEmailEvents\n| where Timestamp > ago(24hrs)\n| where DeliveryAction == \"Delivered\"\nand EmailDirection == \"Inbound\"\nand OrgLevelAction != \"Block\"\nand UserLevelAction != \"Block\"\nand SenderDisplayName contains \"Microsoft\"\n| extend NewMsg = case(Subject contains \"RE:\", false, Subject contains \"FW:\", false, true )\n| project SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject\n| join kind=leftanti  ( emailDelivered ) on SenderFromAddress\n| order by SenderMailFromAddress\n| summarize count() by SenderDisplayName, SenderFromAddress, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, DeliveryAction, DeliveryLocation, ThreatTypes, DetectionMethods, NewMsg, Subject\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing incoming email messages where the Display Name of the sender contains own or other partner company/brand name"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject212')._huntingQuerycontentId212),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 212",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject212')._huntingQuerycontentId212)]",
+                "contentId": "[variables('huntingQueryObject212')._huntingQuerycontentId212]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject212').huntingQueryVersion212]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject212')._huntingQuerycontentId212]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Display Name - Spoof and Impersonation",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject212')._huntingQuerycontentId212,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject212')._huntingQuerycontentId212,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject213').huntingQueryTemplateSpecName213]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Impersonation Phishing detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject213').huntingQueryVersion213]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_213",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Impersonation Detections by Detection Technology Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = EmailEvents\n| where DetectionMethods has \"Phish\";\nlet bimp=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Impersonation brand' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Impersonation brand\";\nlet dimp=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Impersonation domain' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Impersonation domain\";\nlet uimp=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Impersonation user' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Impersonation user\";\nlet mimp=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Mailbox intelligence impersonation' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Mailbox intelligence impersonation\";\nunion bimp,dimp,uimp,mimp\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology over time"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject213')._huntingQuerycontentId213),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 213",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject213')._huntingQuerycontentId213)]",
+                "contentId": "[variables('huntingQueryObject213')._huntingQuerycontentId213]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject213').huntingQueryVersion213]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject213')._huntingQuerycontentId213]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Impersonation Detections by Detection Technology Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject213')._huntingQuerycontentId213,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject213')._huntingQuerycontentId213,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject214').huntingQueryTemplateSpecName214]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Impersonation Phishing detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject214').huntingQueryVersion214]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_214",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Impersonation Detections by Detection Technology",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has 'Impersonation'\n| project Timestamp, DT=parse_json(DetectionMethods)\n| evaluate bag_unpack(DT)\n| summarize count() by Phish=tostring(column_ifexists('Phish', ''))\n| sort by count_ desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish (BEC) Impersonation detections by Detection Technology"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject214')._huntingQuerycontentId214),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 214",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject214')._huntingQuerycontentId214)]",
+                "contentId": "[variables('huntingQueryObject214')._huntingQuerycontentId214]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject214').huntingQueryVersion214]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject214')._huntingQuerycontentId214]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Impersonation Detections by Detection Technology",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject214')._huntingQuerycontentId214,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject214')._huntingQuerycontentId214,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject215').huntingQueryTemplateSpecName215]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Impersonation Phishing detections trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject215').huntingQueryVersion215]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_215",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Impersonation Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents \n| where DetectionMethods has 'Impersonation' \n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"ImpersonatedEmails\"\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish (BEC) - Impersonation detections over time."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject215')._huntingQuerycontentId215),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 215",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject215')._huntingQuerycontentId215)]",
+                "contentId": "[variables('huntingQueryObject215')._huntingQuerycontentId215]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject215').huntingQueryVersion215]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject215')._huntingQuerycontentId215]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Impersonation Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject215')._huntingQuerycontentId215,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject215')._huntingQuerycontentId215,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject216').huntingQueryTemplateSpecName216]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Referral phish emails_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject216').huntingQueryVersion216]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_216",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "referral-phish-emails",
+                "category": "Hunting Queries",
+                "query": "let EmailAddresses = pack_array\n('zreffertalt.com.com','zreffesral.com.com','kzreffertal.com.com',\n'wzreffertal.com.com','refferal.comq','refferal.net','zreffertal.com.com',\n'zrefferal.com.com','refferasl.com.com','zreffesral.com','zrefsfertal.com.com',\n'irefferal.com','refferasl.co','zrefferal.com');\nEmailEvents\n| where SenderMailFromDomain in (EmailAddresses)\n| extend RecipientDomain = extract(\"[^@]+$\", 0, RecipientEmailAddress)\n| where SenderFromDomain == RecipientDomain\n| join EmailUrlInfo on $left.NetworkMessageId == $right.NetworkMessageId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Hunting for credential phishing using the \"Referral\" infrastructure using Defender for Office 365 data"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject216')._huntingQuerycontentId216),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 216",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject216')._huntingQuerycontentId216)]",
+                "contentId": "[variables('huntingQueryObject216')._huntingQuerycontentId216]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject216').huntingQueryVersion216]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject216')._huntingQuerycontentId216]",
+        "contentKind": "HuntingQuery",
+        "displayName": "referral-phish-emails",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject216')._huntingQuerycontentId216,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject216')._huntingQuerycontentId216,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject217').huntingQueryTemplateSpecName217]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spoof and impersonation detections by sender IP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject217').huntingQueryVersion217]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_217",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spoof and impersonation detections by sender IP",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n|where Timestamp > ago (30d) and (DetectionMethods contains 'spoof' or DetectionMethods contains \"impersonation\")  \n| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \n| summarize count() by SenderIPv4\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing count of spoof and impersonation detections done per sender IP"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject217')._huntingQuerycontentId217),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 217",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject217')._huntingQuerycontentId217)]",
+                "contentId": "[variables('huntingQueryObject217')._huntingQuerycontentId217]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject217').huntingQueryVersion217]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject217')._huntingQuerycontentId217]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spoof and impersonation detections by sender IP",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject217')._huntingQuerycontentId217,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject217')._huntingQuerycontentId217,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject218').huntingQueryTemplateSpecName218]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spoof and impersonation phish detections_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject218').huntingQueryVersion218]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_218",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spoof and impersonation phish detections",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n|where Timestamp > ago (30d) and (DetectionMethods contains 'spoof' or DetectionMethods contains \"impersonation\")\n| project Timestamp, AR=parse_json(ThreatTypes) , DT=parse_json(DetectionMethods), EmailDirection, SenderFromAddress\n| evaluate bag_unpack(DT)\n| summarize count() by tostring(Phish)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing count of phish detections done by spoof detection methods"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject218')._huntingQuerycontentId218),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 218",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject218')._huntingQuerycontentId218)]",
+                "contentId": "[variables('huntingQueryObject218')._huntingQuerycontentId218]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject218').huntingQueryVersion218]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject218')._huntingQuerycontentId218]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spoof and impersonation phish detections",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject218')._huntingQuerycontentId218,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject218')._huntingQuerycontentId218,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject219').huntingQueryTemplateSpecName219]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spoof detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject219').huntingQueryVersion219]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_219",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spoof Detections by Detection Technology Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = EmailEvents\n| where DetectionMethods has \"Phish\";\nlet sdmarc=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Spoof DMARC' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Spoof DMARC\";\nlet spoofe=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Spoof external domain' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Spoof external domain\";\nlet spoofi=baseQuery\n| project Timestamp,RecipientEmailAddress,NetworkMessageId, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) \n| where Phish has 'Spoof intra-org' \n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"Spoof intra-org\";\nunion sdmarc, spoofe, spoofi\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology over time"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject219')._huntingQuerycontentId219),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 219",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject219')._huntingQuerycontentId219)]",
+                "contentId": "[variables('huntingQueryObject219')._huntingQuerycontentId219]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject219').huntingQueryVersion219]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject219')._huntingQuerycontentId219]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spoof Detections by Detection Technology Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject219')._huntingQuerycontentId219,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject219')._huntingQuerycontentId219,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject220').huntingQueryTemplateSpecName220]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spoof detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject220').huntingQueryVersion220]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_220",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spoof Detections by Detection Technology",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has 'Spoof'\n| project Timestamp, DT=parse_json(DetectionMethods)\n| evaluate bag_unpack(DT)\n| summarize count() by Phish=tostring(column_ifexists('Phish', ''))\n| sort by count_ desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails with Phish (BEC) Spoof detections by Detection Technology"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject220')._huntingQuerycontentId220),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 220",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject220')._huntingQuerycontentId220)]",
+                "contentId": "[variables('huntingQueryObject220')._huntingQuerycontentId220]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject220').huntingQueryVersion220]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject220')._huntingQuerycontentId220]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spoof Detections by Detection Technology",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject220')._huntingQuerycontentId220,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject220')._huntingQuerycontentId220,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject221').huntingQueryTemplateSpecName221]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spoof detections trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject221').huntingQueryVersion221]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_221",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spoof Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents \n| where DetectionMethods has 'Spoof' \n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"SpoofEmails\"\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject221')._huntingQuerycontentId221),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 221",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject221')._huntingQuerycontentId221)]",
+                "contentId": "[variables('huntingQueryObject221')._huntingQuerycontentId221]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject221').huntingQueryVersion221]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject221')._huntingQuerycontentId221]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spoof Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject221')._huntingQuerycontentId221,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject221')._huntingQuerycontentId221,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject222').huntingQueryTemplateSpecName222]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Domains with BEC Threats inbound_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject222').huntingQueryVersion222]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_222",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Domains Outbound with Emails with Threats Inbound (Partner BEC)",
+                "category": "Hunting Queries",
+                "query": "// Partner BEC: domains we email heavily (outbound volume) that also send us threats (inbound).\n// The ratio is inbound threat emails per 100 outbound emails to the domain, so it can exceed 100.\nlet EmailDeduped = EmailEvents\n    | where Timestamp > ago(30d)\n    | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n    | summarize arg_max(Timestamp, *) by Key;\nEmailDeduped\n| where EmailDirection == \"Outbound\"\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\n| summarize count() by RecipientDomain\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\n| join (\n    EmailDeduped\n    | where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes)\n  ) on SenderFromDomain\n| summarize max(OutboundCount), count() by SenderFromDomain\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\n| extend InboundThreatsPer100Outbound = round(100.0 * IncomingEmailsWithThreats / OutboundEmails, 2)\n| top 15 by OutboundEmails\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders)"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject222')._huntingQuerycontentId222),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 222",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject222')._huntingQuerycontentId222)]",
+                "contentId": "[variables('huntingQueryObject222')._huntingQuerycontentId222]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject222').huntingQueryVersion222]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject222')._huntingQuerycontentId222]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Domains Outbound with Emails with Threats Inbound (Partner BEC)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject222')._huntingQuerycontentId222,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject222')._huntingQuerycontentId222,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject223').huntingQueryTemplateSpecName223]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User not covered under display name impersonation_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject223').huntingQueryVersion223]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_223",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User not covered under display name impersonation",
+                "category": "Hunting Queries",
+                "query": "let display_names = \nIdentityInfo \n  | summarize by AccountDisplayName \n  | project-rename  SenderDisplayName = AccountDisplayName; \nEmailEvents \n  | where EmailDirection == \"Inbound\" \n  | where ThreatNames != \"\" \n  | where ThreatNames !contains \"Impersonation User\" \n  | lookup kind=inner (display_names) on SenderDisplayName, $left.SenderDisplayName == $right.SenderDisplayName \n  | where SenderDisplayName != \"\" \n  | summarize by SenderDisplayName\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps to find threats using display name impersonation for users not already protected with User Impersonation"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject223')._huntingQuerycontentId223),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 223",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject223')._huntingQuerycontentId223)]",
+                "contentId": "[variables('huntingQueryObject223')._huntingQuerycontentId223]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject223').huntingQueryVersion223]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject223')._huntingQuerycontentId223]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User not covered under display name impersonation",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject223')._huntingQuerycontentId223,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject223')._huntingQuerycontentId223,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject224').huntingQueryTemplateSpecName224]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submission Trend - FN_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject224').huntingQueryVersion224]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_224",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submission Trend (FN)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = CloudAppEvents\n| where TimeGenerated >= TimeStart\n| where ActionType contains \"Submission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType);\nlet Admin_Malware_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Malware_FN\";\nlet Admin_Phish_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Phish_FN\";\nlet Admin_Spam_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Spam_FN\";\nlet Admin_Malware_URL_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Malware_URL_FN\";\nlet Admin_Malware_Attach_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Malware_Attach_FN\";\nlet Admin_Phish_URL_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Phish_URL_FN\";\nlet Admin_Phish_Attach_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Phish_Attach_FN\";\nunion Admin_Malware_FN,Admin_Phish_FN,Admin_Spam_FN,Admin_Malware_URL_FN,Admin_Malware_Attach_FN,Admin_Phish_URL_FN,Admin_Phish_Attach_FN\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of admin false negative submission by submission type."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject224')._huntingQuerycontentId224),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 224",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject224')._huntingQuerycontentId224)]",
+                "contentId": "[variables('huntingQueryObject224')._huntingQuerycontentId224]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject224').huntingQueryVersion224]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject224')._huntingQuerycontentId224]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submission Trend (FN)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject224')._huntingQuerycontentId224,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject224')._huntingQuerycontentId224,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject225').huntingQueryTemplateSpecName225]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submission Trend - FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject225').huntingQueryVersion225]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_225",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submission Trend (FP)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = CloudAppEvents\n| where TimeGenerated >= TimeStart\n| where ActionType contains \"Submission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType);\nlet Admin_Email_FP=baseQuery\n| make-series Count= countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Email_FP\";\nlet Admin_URL_FP=baseQuery\n| make-series Count= countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_URL_FP\";\nlet Admin_Attach_FP=baseQuery\n| make-series Count= countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Admin_Attach_FP\";\nunion Admin_Email_FP,Admin_URL_FP,Admin_Attach_FP\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of admin false positive submission by submission type."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject225')._huntingQuerycontentId225),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 225",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject225')._huntingQuerycontentId225)]",
+                "contentId": "[variables('huntingQueryObject225')._huntingQuerycontentId225]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject225').huntingQueryVersion225]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject225')._huntingQuerycontentId225]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submission Trend (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject225')._huntingQuerycontentId225,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject225')._huntingQuerycontentId225,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject226').huntingQueryTemplateSpecName226]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submissions by Detection Method - Phish FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject226').huntingQueryVersion226]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_226",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submissions by DetectionMethod (Phish FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Admin_Email_FP\",\n\"Other\"),DetectionMethod=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdictControlSource),\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict ==\"Phish\"\n| summarize count() by DetectionMethod\n| project DetectionMethod,Emails = count_\n// | render piechart // Uncomment this line to render as a graph\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the original detection technology of emails submitted as phish false positive by admins"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject226')._huntingQuerycontentId226),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 226",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject226')._huntingQuerycontentId226)]",
+                "contentId": "[variables('huntingQueryObject226')._huntingQuerycontentId226]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject226').huntingQueryVersion226]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject226')._huntingQuerycontentId226]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submissions by DetectionMethod (Phish FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject226')._huntingQuerycontentId226,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject226')._huntingQuerycontentId226,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject227').huntingQueryTemplateSpecName227]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submissions by Detection Method - Spam FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject227').huntingQueryVersion227]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_227",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submissions by DetectionMethod (Spam FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Admin_Email_FP\",\n\"Other\"),DetectionMethod=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdictControlSource),\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict ==\"Spam\" \n| summarize count() by DetectionMethod\n| project DetectionMethod,Emails = count_\n// | render piechart // Uncomment this line to render as a graph\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the original detection technology of emails submitted as spam false positive by admins"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject227')._huntingQuerycontentId227),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 227",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject227')._huntingQuerycontentId227)]",
+                "contentId": "[variables('huntingQueryObject227')._huntingQuerycontentId227]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject227').huntingQueryVersion227]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject227')._huntingQuerycontentId227]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submissions by DetectionMethod (Spam FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject227')._huntingQuerycontentId227,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject227')._huntingQuerycontentId227,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject228').huntingQueryTemplateSpecName228]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submissions by Detection Type_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject228').huntingQueryVersion228]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_228",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submissions by Detection Type",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Admin_Email_FP\",\n\"Other\"),\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\n| project PolicyOverride, DetectionVerdict,Admin_SubmissionType, Emails = count_\n| top 10 by Emails desc\n// | render piechart // Uncomment this line to render as a graph\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject228')._huntingQuerycontentId228),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 228",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject228')._huntingQuerycontentId228)]",
+                "contentId": "[variables('huntingQueryObject228')._huntingQuerycontentId228]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject228').huntingQueryVersion228]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject228')._huntingQuerycontentId228]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submissions by Detection Type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject228')._huntingQuerycontentId228,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject228')._huntingQuerycontentId228,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject229').huntingQueryTemplateSpecName229]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submissions by Grading Verdict - FN-FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject229').huntingQueryVersion229]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_229",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submissions by Grading verdict (FN-FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType contains \"AdminSubmissionTriage\"\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict\n| summarize count() by tostring(TriageVerdict)\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total amount of admin false negative or false positive submissions by the verdict of the submission grading."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject229')._huntingQuerycontentId229),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 229",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject229')._huntingQuerycontentId229)]",
+                "contentId": "[variables('huntingQueryObject229')._huntingQuerycontentId229]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject229').huntingQueryVersion229]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject229')._huntingQuerycontentId229]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submissions by Grading verdict (FN-FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject229')._huntingQuerycontentId229,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject229')._huntingQuerycontentId229,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject230').huntingQueryTemplateSpecName230]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submissions by Submission State - FN_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject230').huntingQueryVersion230]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_230",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submissions by Submission State (FN)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType contains \"AdminSubmission\"\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\n| summarize count() by tostring(SubmissionState)\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total amount of admin false negative submissions by the state of the submission."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject230')._huntingQuerycontentId230),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 230",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject230')._huntingQuerycontentId230)]",
+                "contentId": "[variables('huntingQueryObject230')._huntingQuerycontentId230]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject230').huntingQueryVersion230]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject230')._huntingQuerycontentId230]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submissions by Submission State (FN)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject230')._huntingQuerycontentId230,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject230')._huntingQuerycontentId230,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject231').huntingQueryTemplateSpecName231]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submissions by Submission State - FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject231').huntingQueryVersion231]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_231",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submissions by Submission State (FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType contains \"AdminSubmission\"\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| where Record == 29 and SubmissionType == \"3\"\n| summarize count() by tostring(SubmissionState)\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total amount of admin false positive submissions by the state of the submission."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject231')._huntingQuerycontentId231),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 231",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject231')._huntingQuerycontentId231)]",
+                "contentId": "[variables('huntingQueryObject231')._huntingQuerycontentId231]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject231').huntingQueryVersion231]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject231')._huntingQuerycontentId231]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submissions by Submission State (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject231')._huntingQuerycontentId231,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject231')._huntingQuerycontentId231,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject232').huntingQueryTemplateSpecName232]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submissions by Submission Type - FN_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject232').huntingQueryVersion232]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_232",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submissions by Submission Type (FN)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType contains \"Submission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Malware_FN\",\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Spam_FN\",\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Admin_Malware_URL_FN\",\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Admin_Malware_Attach_FN\",\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Admin_Phish_URL_FN\",\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Admin_Phish_Attach_FN\",\n\"Other\")))))))\n| where Admin_SubmissionType!=\"Other\"\n| summarize count() by Admin_SubmissionType\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing admin reported email submissions"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject232')._huntingQuerycontentId232),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 232",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject232')._huntingQuerycontentId232)]",
+                "contentId": "[variables('huntingQueryObject232')._huntingQuerycontentId232]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject232').huntingQueryVersion232]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject232')._huntingQuerycontentId232]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submissions by Submission Type (FN)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject232')._huntingQuerycontentId232,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject232')._huntingQuerycontentId232,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject233').huntingQueryTemplateSpecName233]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Admin Submissions by Submission Type - FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject233').huntingQueryVersion233]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_233",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Admin Submissions by Submission Type (FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType contains \"Submission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Email_FP\",\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Admin_URL_FP\",\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Admin_Attach_FP\",\n\"Other\")))\n| where Admin_SubmissionType!=\"Other\"\n| summarize count() by Admin_SubmissionType\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total amount of admin false positive submission by submission type."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject233')._huntingQuerycontentId233),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 233",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject233')._huntingQuerycontentId233)]",
+                "contentId": "[variables('huntingQueryObject233')._huntingQuerycontentId233]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject233').huntingQueryVersion233]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject233')._huntingQuerycontentId233]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Admin Submissions by Submission Type (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject233')._huntingQuerycontentId233,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject233')._huntingQuerycontentId233,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject234').huntingQueryTemplateSpecName234]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top accounts performing admin submissions - FN_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject234').huntingQueryVersion234]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_234",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top accounts performing admin submissions (FN)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\n| summarize count() by tostring(UserId) | sort by count_\n| top 15 by count_\n| render columnchart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top admins performing false negative submissions"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject234')._huntingQuerycontentId234),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 234",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject234')._huntingQuerycontentId234)]",
+                "contentId": "[variables('huntingQueryObject234')._huntingQuerycontentId234]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject234').huntingQueryVersion234]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject234')._huntingQuerycontentId234]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top accounts performing admin submissions (FN)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject234')._huntingQuerycontentId234,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject234')._huntingQuerycontentId234,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject235').huntingQueryTemplateSpecName235]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top accounts performing admin submissions - FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject235').huntingQueryVersion235]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_235",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top accounts performing admin submissions (FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType\n| where Record == 29 and SubmissionType ==\"3\"\n| summarize count() by tostring(UserId) | sort by count_\n| top 15 by count_\n| render columnchart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top admins performing false positive submissions"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject235')._huntingQuerycontentId235),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 235",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject235')._huntingQuerycontentId235)]",
+                "contentId": "[variables('huntingQueryObject235')._huntingQuerycontentId235]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject235').huntingQueryVersion235]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject235')._huntingQuerycontentId235]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top accounts performing admin submissions (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject235')._huntingQuerycontentId235,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject235')._huntingQuerycontentId235,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject236').huntingQueryTemplateSpecName236]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top accounts performing user submissions_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject236').huntingQueryVersion236]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_236",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top accounts performing user submissions",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where Timestamp > ago(30d) \n| extend Record= (parse_json(RawEventData)).RecordType \n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState  \n| extend UserId = (parse_json(RawEventData)).UserId\n| where Record == 29 \n| where ActionType == \"UserSubmission\" \n| summarize count() by tostring(UserId) | sort by count_ //| top 50 by count_\n| render columnchart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query graphs top accounts performing user submissions"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject236')._huntingQuerycontentId236),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 236",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject236')._huntingQuerycontentId236)]",
+                "contentId": "[variables('huntingQueryObject236')._huntingQuerycontentId236]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject236').huntingQueryVersion236]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject236')._huntingQuerycontentId236]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top accounts performing user submissions",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject236')._huntingQuerycontentId236,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject236')._huntingQuerycontentId236,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject237').huntingQueryTemplateSpecName237]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Detection Overrides - Admin Submissions_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject237').huntingQueryVersion237]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_237",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Detection Overrides - Admin Email Submissions (FN)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend Admin_SubmissionType=\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Malware_FN\",\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Admin_Spam_FN\",\"Other\"))),\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\") and PolicyOverride !=\"NoOverride\"\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\n| project PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType, Emails = count_\n| top 10 by Emails desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject237')._huntingQuerycontentId237),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 237",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject237')._huntingQuerycontentId237)]",
+                "contentId": "[variables('huntingQueryObject237')._huntingQuerycontentId237]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject237').huntingQueryVersion237]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject237')._huntingQuerycontentId237]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Detection Overrides - Admin Email Submissions (FN)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject237')._huntingQuerycontentId237,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject237')._huntingQuerycontentId237,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject238').huntingQueryTemplateSpecName238]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Sender Domains - Admin Submissions FN_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject238').huntingQueryVersion238]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_238",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 sender domains - Admin email submissions (FN)",
+                "category": "Hunting Queries",
+                "query": "//Top sender domains that admins reported as false negatives (missed threats), with each domain's Microsoft Defender\n//for Office 365 detection profile for context: total inbound volume, how many of those already carried a threat\n//verdict, and the threat-type split.\n//The submission percentage is the point - 40 reports out of 12,000 inbound messages reads very differently from\n//40 out of 60, and only the second is a filtering problem worth escalating.\nlet AdminSubmissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"AdminSubmissionSubmitted\"\n    | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),\n             SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType),\n             P2SenderDomain = tostring((parse_json(RawEventData)).P2SenderDomain)\n    | where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\")\n    | where isnotempty(P2SenderDomain)\n    | summarize AdminSubmissions = count() by P2SenderDomain;\nlet DomainProfile = EmailEvents\n    | where Timestamp > ago(30d)\n    | where EmailDirection == \"Inbound\"\n    | summarize TotalInbound = count(),\n                EmailsWithThreats = countif(isnotempty(ThreatTypes)),\n                Malware = countif(ThreatTypes has \"Malware\"),\n                Phish = countif(ThreatTypes has \"Phish\"),\n                Spam = countif(ThreatTypes has \"Spam\")\n        by SenderFromDomain;\nAdminSubmissions\n| join kind=leftouter (DomainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\n//Null rather than a misleading 100% when the domain has no matching inbound mail in the window.\n| extend AdminSubmissionPct = iif(isnull(TotalInbound) or TotalInbound == 0, real(null), round(AdminSubmissions * 100.0 / todouble(TotalInbound), 2))\n| top 10 by AdminSubmissions desc\n| project ['Sender Domain']=P2SenderDomain, ['Admin Submissions']=AdminSubmissions,\n          ['Total Inbound']=coalesce(TotalInbound, 0), ['Admin Submission %']=AdminSubmissionPct,\n          ['Emails With Threats']=coalesce(EmailsWithThreats, 0), ['Malware']=coalesce(Malware, 0),\n          ['Phish']=coalesce(Phish, 0), ['Spam']=coalesce(Spam, 0)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject238')._huntingQuerycontentId238),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 238",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject238')._huntingQuerycontentId238)]",
+                "contentId": "[variables('huntingQueryObject238')._huntingQuerycontentId238]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject238').huntingQueryVersion238]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject238')._huntingQuerycontentId238]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 sender domains - Admin email submissions (FN)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject238')._huntingQuerycontentId238,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject238')._huntingQuerycontentId238,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject239').huntingQueryTemplateSpecName239]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Sender Domains - Admin Submissions FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject239').huntingQueryVersion239]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_239",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 sender domains - Admin email submissions (FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"AdminSubmissionSubmitted\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"Mail\" and SubmissionType ==\"3\"\n| summarize count() by P2SenderDomain\n| project P2SenderDomain, Emails = count_\n| top 10 by Emails desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject239')._huntingQuerycontentId239),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 239",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject239')._huntingQuerycontentId239)]",
+                "contentId": "[variables('huntingQueryObject239')._huntingQuerycontentId239]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject239').huntingQueryVersion239]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject239')._huntingQuerycontentId239]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 sender domains - Admin email submissions (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject239')._huntingQuerycontentId239,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject239')._huntingQuerycontentId239,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject240').huntingQueryTemplateSpecName240]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total Submissions by Submission Status_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject240').huntingQueryVersion240]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_240",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Total Submissions by Submission Type",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where Timestamp > ago(30d) \n| extend Record= (parse_json(RawEventData)).RecordType \n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState  \n| extend UserKey = (parse_json(RawEventData)).UserKey \n| where Record == 29 \n| where ActionType == \"UserSubmission\" or ActionType == \"AdminSubmission\" \n| summarize count() by tostring(SubmissionState) | sort by count_\n// | render piechart // Uncomment this line to render as a graph\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Total Submissions by Submission Status"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject240')._huntingQuerycontentId240),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 240",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject240')._huntingQuerycontentId240)]",
+                "contentId": "[variables('huntingQueryObject240')._huntingQuerycontentId240]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject240').huntingQueryVersion240]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject240')._huntingQuerycontentId240]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Total Submissions by Submission Type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject240')._huntingQuerycontentId240,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject240')._huntingQuerycontentId240,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject241').huntingQueryTemplateSpecName241]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Total Submissions by Submission Type_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject241').huntingQueryVersion241]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_241",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Total Submissions by Submission Type",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\" or ActionType == \"AdminSubmission\"\n| summarize count() by ActionType\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Total Submissions by Submission Type"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject241')._huntingQuerycontentId241),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 241",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject241')._huntingQuerycontentId241)]",
+                "contentId": "[variables('huntingQueryObject241')._huntingQuerycontentId241]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject241').huntingQueryVersion241]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject241')._huntingQuerycontentId241]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Total Submissions by Submission Type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject241')._huntingQuerycontentId241,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject241')._huntingQuerycontentId241,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject242').huntingQueryTemplateSpecName242]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User reported submissions_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject242').huntingQueryVersion242]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_242",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User reported submissions",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where Timestamp > ago(30d) \n| extend Record= (parse_json(RawEventData)).RecordType \n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState  \n| where Record == 29 \n| where ActionType == \"UserSubmission\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing user reported email submissions"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject242')._huntingQuerycontentId242),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 242",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject242')._huntingQuerycontentId242)]",
+                "contentId": "[variables('huntingQueryObject242')._huntingQuerycontentId242]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject242').huntingQueryVersion242]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject242')._huntingQuerycontentId242]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User reported submissions",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject242')._huntingQuerycontentId242,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject242')._huntingQuerycontentId242,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject243').huntingQueryTemplateSpecName243]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submission Accuracy versus Admin Verdicts_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject243').huntingQueryVersion243]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_243",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions accuracy vs Admin review verdict",
+                "category": "Hunting Queries",
+                "query": "let ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\n| mv-expand element = Properties\n| where element.Name == \"AdminReviewResult\"\n| project SubmissionId, AdminReviewResult = element.Value;\nCloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\n| join kind=leftouter ReviewResults on SubmissionId\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \"Correct\", iif(AdminReviewResult==\"Phish\" and UserReportedAs == \"Junk\", \"Phish reported as junk\",iif(AdminReviewResult==\"Junk\" and UserReportedAs == \"Phish\",\"Junk reported as Phish\",iif(AdminReviewResult==\"NotJunk\",\"Reported but not malicious or spam\",iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Not correct\")))))\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\n| where Reviewed==\"Reviewed\"\n| summarize count() by ReviewedAccuracy\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises user submissions type compared to admin review verdict"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject243')._huntingQuerycontentId243),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 243",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject243')._huntingQuerycontentId243)]",
+                "contentId": "[variables('huntingQueryObject243')._huntingQuerycontentId243]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject243').huntingQueryVersion243]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject243')._huntingQuerycontentId243]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions accuracy vs Admin review verdict",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject243')._huntingQuerycontentId243,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject243')._huntingQuerycontentId243,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject244').huntingQueryTemplateSpecName244]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top detection overrides by Admins_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject244').huntingQueryVersion244]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_244",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FN) - Top Detection Overrides by Admins",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where ThreatTypes !=\"\"and OrgLevelAction!=\"\"\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\n| project OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType, UserSubmissions = count_\n| top 10 by UserSubmissions desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject244')._huntingQuerycontentId244),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 244",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject244')._huntingQuerycontentId244)]",
+                "contentId": "[variables('huntingQueryObject244')._huntingQuerycontentId244]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject244').huntingQueryVersion244]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject244')._huntingQuerycontentId244]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FN) - Top Detection Overrides by Admins",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject244')._huntingQuerycontentId244,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject244')._huntingQuerycontentId244,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject245').huntingQueryTemplateSpecName245]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top detection overrides by Users_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject245').huntingQueryVersion245]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_245",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FN) - Top Detection Overrides by Users",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where ThreatTypes !=\"\"and UserLevelAction!=\"\"\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\n| project UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType, UserSubmissions = count_\n| top 10 by UserSubmissions desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject245')._huntingQuerycontentId245),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 245",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject245')._huntingQuerycontentId245)]",
+                "contentId": "[variables('huntingQueryObject245')._huntingQuerycontentId245]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject245').huntingQueryVersion245]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject245')._huntingQuerycontentId245]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FN) - Top Detection Overrides by Users",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject245')._huntingQuerycontentId245,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject245')._huntingQuerycontentId245,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject246').huntingQueryTemplateSpecName246]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top email (P2) senders domains_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject246').huntingQueryVersion246]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_246",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FN) - Top Inbound P2 Senders domains",
+                "category": "Hunting Queries",
+                "query": "let TotalInboundbySender = EmailEvents\n| where EmailDirection ==\"Inbound\"\n| summarize count() by SenderFromDomain;\nCloudAppEvents \n| where ActionType == \"UserSubmission\" \n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\"\n| summarize UserSubmissions=count() by SenderFromDomain\n| join TotalInboundbySender on SenderFromDomain\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\n| project SenderFromDomain, UserSubmissions, TotalInboundEmail=count_,UserSubmissions_Percentage\n| top 10 by UserSubmissions desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises top sender domains of inbound emails submitted as false negatives by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject246')._huntingQuerycontentId246),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 246",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject246')._huntingQuerycontentId246)]",
+                "contentId": "[variables('huntingQueryObject246')._huntingQuerycontentId246]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject246').huntingQueryVersion246]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject246')._huntingQuerycontentId246]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FN) - Top Inbound P2 Senders domains",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject246')._huntingQuerycontentId246,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject246')._huntingQuerycontentId246,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject247').huntingQueryTemplateSpecName247]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top email (P2) senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject247').huntingQueryVersion247]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_247",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FN) - Top Inbound P2 Senders",
+                "category": "Hunting Queries",
+                "query": "let TotalInboundbySender = EmailEvents\n| where EmailDirection ==\"Inbound\"\n| summarize count() by SenderFromAddress;\nCloudAppEvents \n| where ActionType == \"UserSubmission\" \n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\"\n| summarize UserSubmissions=count() by SenderFromAddress\n| join TotalInboundbySender on SenderFromAddress\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\n| project SenderFromAddress, UserSubmissions, TotalInboundEmail=count_,UserSubmissions_Percentage\n| top 10 by UserSubmissions desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises top sender email addresses of inbound emails submitted as false negatives by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject247')._huntingQuerycontentId247),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 247",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject247')._huntingQuerycontentId247)]",
+                "contentId": "[variables('huntingQueryObject247')._huntingQuerycontentId247]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject247').huntingQueryVersion247]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject247')._huntingQuerycontentId247]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FN) - Top Inbound P2 Senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject247')._huntingQuerycontentId247,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject247')._huntingQuerycontentId247,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject248').huntingQueryTemplateSpecName248]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top Intra-Org P2 senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject248').huntingQueryVersion248]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_248",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FN) - Top Intra-Org P2 Senders",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Intra-org\"\n| summarize count() by SenderMailFromAddress\n| project SenderMailFromAddress,UserSubmissions = count_\n| top 10 by UserSubmissions desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises top sender email addresses of intra-org emails submitted as false negatives by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject248')._huntingQuerycontentId248),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 248",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject248')._huntingQuerycontentId248)]",
+                "contentId": "[variables('huntingQueryObject248')._huntingQuerycontentId248]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject248').huntingQueryVersion248]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject248')._huntingQuerycontentId248]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FN) - Top Intra-Org P2 Senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject248')._huntingQuerycontentId248,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject248')._huntingQuerycontentId248,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject249').huntingQueryTemplateSpecName249]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top Intra-Org Subjects_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject249').huntingQueryVersion249]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_249",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FN) - Top Intra-Org Subjects",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Intra-org\"\n| summarize count() by Subject\n| project Subject,UserSubmissions = count_\n| top 10 by UserSubmissions desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises top 10 subjects of intra-org emails submitted as false negatives by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject249')._huntingQuerycontentId249),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 249",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject249')._huntingQuerycontentId249)]",
+                "contentId": "[variables('huntingQueryObject249')._huntingQuerycontentId249]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject249').huntingQueryVersion249]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject249')._huntingQuerycontentId249]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FN) - Top Intra-Org Subjects",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject249')._huntingQuerycontentId249,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject249')._huntingQuerycontentId249,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject250').huntingQueryTemplateSpecName250]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions by Admin review status_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject250').huntingQueryVersion250]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_250",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions by Admin review status (Mark and Notify)",
+                "category": "Hunting Queries",
+                "query": "let ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\n| mv-expand element = Properties\n| where element.Name == \"AdminReviewResult\"\n| project SubmissionId, AdminReviewResult = element.Value;\nCloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\n| join kind=leftouter ReviewResults on SubmissionId\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\n| summarize count() by Reviewed\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises user submissions where admin also performed 'mark and notify' action on the submission"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject250')._huntingQuerycontentId250),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 250",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject250')._huntingQuerycontentId250)]",
+                "contentId": "[variables('huntingQueryObject250')._huntingQuerycontentId250]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject250').huntingQueryVersion250]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject250')._huntingQuerycontentId250]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions by Admin review status (Mark and Notify)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject250')._huntingQuerycontentId250,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject250')._huntingQuerycontentId250,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject251').huntingQueryTemplateSpecName251]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions by Grading Verdict - FN-FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject251').huntingQueryVersion251]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_251",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FN-FP) by Grading verdict",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType contains \"UserSubmissionTriage\" \n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \n| summarize count() by tostring(TriageVerdict)\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject251')._huntingQuerycontentId251),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 251",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject251')._huntingQuerycontentId251)]",
+                "contentId": "[variables('huntingQueryObject251')._huntingQuerycontentId251]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject251').huntingQueryVersion251]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject251')._huntingQuerycontentId251]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FN-FP) by Grading verdict",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject251')._huntingQuerycontentId251,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject251')._huntingQuerycontentId251,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject252').huntingQueryTemplateSpecName252]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions by Submission Type_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject252').huntingQueryVersion252]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_252",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FN) by Submission Type",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType contains \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\niff(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\",\"User_AttackSim_Submission\",\n\"Other\")))\n| where User_SubmissionType!=\"Other\"\n| summarize count() by User_SubmissionType\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total ammount of user false negative submission by submission type, including the phish simulations reported emails"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject252')._huntingQuerycontentId252),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 252",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject252')._huntingQuerycontentId252)]",
+                "contentId": "[variables('huntingQueryObject252')._huntingQuerycontentId252]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject252').huntingQueryVersion252]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject252')._huntingQuerycontentId252]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FN) by Submission Type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject252')._huntingQuerycontentId252,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject252')._huntingQuerycontentId252,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject253').huntingQueryTemplateSpecName253]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions from Junk Folder_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject253').huntingQueryVersion253]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_253",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User email submissions (FN) from Junk Folder",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents \n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\n| extend User_SubmissionType=\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Phish_FN\",\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"User_Spam_FN\",\"Other\")),\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\n| join EmailEvents on NetworkMessageId, RecipientObjectId\n| where DeliveryLocation == \"Junk folder\"\n| summarize count() by ThreatTypes,User_SubmissionType\n| project ThreatTypes,User_SubmissionType, Emails = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the total ammount of user false negative submissions from the junk folder"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject253')._huntingQuerycontentId253),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 253",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject253')._huntingQuerycontentId253)]",
+                "contentId": "[variables('huntingQueryObject253')._huntingQuerycontentId253]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject253').huntingQueryVersion253]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject253')._huntingQuerycontentId253]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User email submissions (FN) from Junk Folder",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject253')._huntingQuerycontentId253,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject253')._huntingQuerycontentId253,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject254').huntingQueryTemplateSpecName254]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions Trend - FN_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject254').huntingQueryVersion254]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_254",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submission Trend (FN)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet baseQuery = CloudAppEvents\n| where ActionType contains \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType);\nlet User_Phish_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"User_Phish_FN\";\nlet User_Spam_FN=baseQuery\n| make-series Count= countif(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"User_Spam_FN\";\nlet User_AttackSim_Submission=baseQuery\n| make-series Count= countif(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d \n| extend Details = \"User_AttackSim_Submission\";\nunion User_Phish_FN,User_Spam_FN,User_AttackSim_Submission\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject254')._huntingQuerycontentId254),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 254",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject254')._huntingQuerycontentId254)]",
+                "contentId": "[variables('huntingQueryObject254')._huntingQuerycontentId254]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject254').huntingQueryVersion254]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject254')._huntingQuerycontentId254]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submission Trend (FN)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject254')._huntingQuerycontentId254,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject254')._huntingQuerycontentId254,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject255').huntingQueryTemplateSpecName255]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Attacked more than x times average_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject255').huntingQueryVersion255]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_255",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Attacked more than x times average",
+                "category": "Hunting Queries",
+                "query": "let AverageThreatPerRecipient = toscalar(EmailEvents \n| where DetectionMethods != \"\" \n| summarize total=count() by RecipientEmailAddress \n| summarize avg(total)); \nEmailEvents \n| where DetectionMethods != \"\" \n| summarize total=count() by RecipientEmailAddress \n| where tolong(total) >= 1*AverageThreatPerRecipient // update \"1\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing count of users attacked more than x times average."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject255')._huntingQuerycontentId255),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 255",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject255')._huntingQuerycontentId255)]",
+                "contentId": "[variables('huntingQueryObject255')._huntingQuerycontentId255]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject255').huntingQueryVersion255]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject255')._huntingQuerycontentId255]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Attacked more than x times average",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject255')._huntingQuerycontentId255,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject255')._huntingQuerycontentId255,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject256').huntingQueryTemplateSpecName256]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malicious mails by sender IPs_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject256').huntingQueryVersion256]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_256",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious mails by sender IPs",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where Timestamp > ago(30d) \n| where ThreatTypes has \"Phish\" or ThreatTypes has \"Malware\"\n| summarize count() by SenderIPv4 //SenderIPv6\n| sort by count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing sender IPs sending malicious email of type Malware or Phish"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject256')._huntingQuerycontentId256),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 256",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject256')._huntingQuerycontentId256)]",
+                "contentId": "[variables('huntingQueryObject256')._huntingQuerycontentId256]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject256').huntingQueryVersion256]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject256')._huntingQuerycontentId256]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious mails by sender IPs",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject256')._huntingQuerycontentId256,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject256')._huntingQuerycontentId256,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject257').huntingQueryTemplateSpecName257]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 percent of most attacked users_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject257').huntingQueryVersion257]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_257",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10% of most attacked users",
+                "category": "Hunting Queries",
+                "query": "let topTargeted = toscalar( EmailEvents \n| where DetectionMethods != \"\" \n| summarize total=count() by RecipientEmailAddress \n| summarize percentiles(total,90)); \nEmailEvents \n| where DetectionMethods != \"\" \n| summarize total=count() by RecipientEmailAddress \n| where total >= topTargeted \n| order by total desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing the list of top 10% of most attacked users"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject257')._huntingQuerycontentId257),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 257",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject257')._huntingQuerycontentId257)]",
+                "contentId": "[variables('huntingQueryObject257')._huntingQuerycontentId257]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject257').huntingQueryVersion257]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject257')._huntingQuerycontentId257]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10% of most attacked users",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject257')._huntingQuerycontentId257,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject257')._huntingQuerycontentId257,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject258').huntingQueryTemplateSpecName258]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 URL domains attacking organization_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject258').huntingQueryVersion258]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_258",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 URL domains attacking organization",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where ThreatTypes != \"\" \n| extend detection= parse_json(DetectionMethods) \n| extend Spam = tostring(detection.Spam) \n| extend Phish = tostring(detection.Phish) \n| where (Spam == '[\"URL malicious reputation\"]') or (Phish == '[\"URL malicious reputation\"]') or (Phish == '[\"URL detonation reputation\"]') or (Phish == '[\"URL detonation\"]') \n| join EmailUrlInfo on NetworkMessageId\n| summarize total=count() by UrlDomain \n| top 10 by total \n| render columnchart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing list of top 10 URL domains attacking the organization"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject258')._huntingQuerycontentId258),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 258",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject258')._huntingQuerycontentId258)]",
+                "contentId": "[variables('huntingQueryObject258')._huntingQuerycontentId258]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject258').huntingQueryVersion258]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject258')._huntingQuerycontentId258]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 URL domains attacking organization",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject258')._huntingQuerycontentId258,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject258')._huntingQuerycontentId258,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject259').huntingQueryTemplateSpecName259]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top external malicious senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject259').huntingQueryVersion259]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_259",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top external malicious senders",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where Timestamp > ago(30d) \n| where EmailDirection == \"Inbound\" \n| summarize count() by SenderFromAddress \n| sort by count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject259')._huntingQuerycontentId259),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 259",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject259')._huntingQuerycontentId259)]",
+                "contentId": "[variables('huntingQueryObject259')._huntingQuerycontentId259]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject259').huntingQueryVersion259]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject259')._huntingQuerycontentId259]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top external malicious senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject259')._huntingQuerycontentId259,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject259')._huntingQuerycontentId259,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject260').huntingQueryTemplateSpecName260]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top targeted users_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject260').huntingQueryVersion260]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_260",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top targeted users",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where Timestamp > ago(30d) \n| where ThreatTypes has \"Malware\" or ThreatTypes has \"Phish\" \n| summarize count() by RecipientEmailAddress \n| sort by count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing top targeted users with malware or phishing emails in an organization in last 30 days"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject260')._huntingQuerycontentId260),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 260",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject260')._huntingQuerycontentId260)]",
+                "contentId": "[variables('huntingQueryObject260')._huntingQuerycontentId260]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject260').huntingQueryVersion260]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject260')._huntingQuerycontentId260]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top targeted users",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject260')._huntingQuerycontentId260,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject260')._huntingQuerycontentId260,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject261').huntingQueryTemplateSpecName261]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "End user malicious clicks_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject261').huntingQueryVersion261]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_261",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "End user malicious clicks",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| where ThreatTypes contains \"Phish\"\n| extend UrlBlocked = ActionType has_any(\"ClickBlocked\")\n| extend UrlAllowed = ActionType has_any('ClickAllowed')\n| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')\n| extend ErrorPage = ActionType has_any('UrlErrorPage')\n| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough)  by AccountUpn\n| sort by Blocked desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing list of top users click on Phis URLs"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject261')._huntingQuerycontentId261),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 261",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject261')._huntingQuerycontentId261)]",
+                "contentId": "[variables('huntingQueryObject261')._huntingQuerycontentId261]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject261').huntingQueryVersion261]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject261')._huntingQuerycontentId261]",
+        "contentKind": "HuntingQuery",
+        "displayName": "End user malicious clicks",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject261')._huntingQuerycontentId261,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject261')._huntingQuerycontentId261,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject262').huntingQueryTemplateSpecName262]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URL click count by click action_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject262').huntingQueryVersion262]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_262",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URL click count by click action",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents \n| extend UrlBlocked = ActionType has_any(\"ClickBlocked\") \n| extend UrlAllowed = ActionType has_any('ClickAllowed') \n| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress') \n| extend ErrorPage = ActionType has_any('UrlErrorPage') \n| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough)\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing URL click count by ClickAction"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject262')._huntingQuerycontentId262),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 262",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject262')._huntingQuerycontentId262)]",
+                "contentId": "[variables('huntingQueryObject262')._huntingQuerycontentId262]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject262').huntingQueryVersion262]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject262')._huntingQuerycontentId262]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URL click count by click action",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject262')._huntingQuerycontentId262,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject262')._huntingQuerycontentId262,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject263').huntingQueryTemplateSpecName263]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URL click on ZAP Email_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject263').huntingQueryVersion263]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_263",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URL click on ZAP email",
+                "category": "Hunting Queries",
+                "query": "AlertInfo\n| where Title contains \"Email messages containing malicious URL removed after delivery\" and Timestamp > ago (7d)\n| join kind=inner (AlertEvidence| where EntityType == \"MailMessage\") on AlertId \n| join UrlClickEvents on NetworkMessageId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we are looking for Url clicks on emails which get actioned by Zerohour auto purge"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject263')._huntingQuerycontentId263),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 263",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject263')._huntingQuerycontentId263)]",
+                "contentId": "[variables('huntingQueryObject263')._huntingQuerycontentId263]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject263').huntingQueryVersion263]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject263')._huntingQuerycontentId263]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URL click on ZAP email",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject263')._huntingQuerycontentId263,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject263')._huntingQuerycontentId263,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject264').huntingQueryTemplateSpecName264]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URL clicks actions by URL_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject264').huntingQueryVersion264]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_264",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URL clicks actions by URL",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| extend UrlBlocked = ActionType has_any(\"ClickBlocked\")\n| extend UrlAllowed = ActionType has_any('ClickAllowed')\n| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')\n| extend ErrorPage = ActionType has_any('UrlErrorPage')\n| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough) by Url\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we are looking URL click actions by URL in the last 7 days"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject264')._huntingQuerycontentId264),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 264",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject264')._huntingQuerycontentId264)]",
+                "contentId": "[variables('huntingQueryObject264')._huntingQuerycontentId264]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject264').huntingQueryVersion264]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject264')._huntingQuerycontentId264]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URL clicks actions by URL",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject264')._huntingQuerycontentId264,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject264')._huntingQuerycontentId264,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject265').huntingQueryTemplateSpecName265]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URLClick details based on malicious URL click alert_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject265').huntingQueryVersion265]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_265",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URLClick details based on malicious URL click alert",
+                "category": "Hunting Queries",
+                "query": "AlertInfo\n| where Title contains \"Potentially malicious\" and Timestamp > ago (30d)\n| join kind=inner (AlertEvidence| where EntityType == \"MailMessage\") on AlertId \n| join UrlClickEvents on NetworkMessageId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject265')._huntingQuerycontentId265),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 265",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject265')._huntingQuerycontentId265)]",
+                "contentId": "[variables('huntingQueryObject265')._huntingQuerycontentId265]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject265').huntingQueryVersion265]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject265')._huntingQuerycontentId265]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URLClick details based on malicious URL click alert",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject265')._huntingQuerycontentId265,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject265')._huntingQuerycontentId265,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject266').huntingQueryTemplateSpecName266]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User clicked through events_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject266').huntingQueryVersion266]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_266",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User clicked through events",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents \n| where ActionType == \"ClickAllowed\" or IsClickedThrough !=\"0\" \n| where ThreatTypes has \"Phish\" \n| summarize by ReportId, IsClickedThrough, AccountUpn, NetworkMessageId, ThreatTypes\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject266')._huntingQuerycontentId266),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 266",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject266')._huntingQuerycontentId266)]",
+                "contentId": "[variables('huntingQueryObject266')._huntingQuerycontentId266]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject266').huntingQueryVersion266]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject266')._huntingQuerycontentId266]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User clicked through events",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject266')._huntingQuerycontentId266,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject266')._huntingQuerycontentId266,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject267').huntingQueryTemplateSpecName267]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User clicks on malicious inbound emails_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject267').huntingQueryVersion267]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_267",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User clicks on malicious inbound emails",
+                "category": "Hunting Queries",
+                "query": "let UrlClicked = (UrlClickEvents\n| where ActionType == \"ClickAllowed\" or IsClickedThrough !=\"0\"\n| extend Device_IPv4 = IPAddress\n| project ActionType, Device_IPv4, Url, UrlChain, IPAddress, NetworkMessageId);\nEmailEvents\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes) and EmailDirection == \"Inbound\"\n| where ThreatTypes has_any (\"Malware\", \"Phish\")\n| extend SenderFromAddress_IPv4 = strcat(SenderFromAddress, \", \", SenderIPv4)\n| join kind = inner UrlClicked on NetworkMessageId\n| project Timestamp,NetworkMessageId, Subject, SenderFromAddress_IPv4, RecipientEmailAddress, ThreatTypes, ActionType, Url, UrlChain, Device_IPv4, LatestDeliveryLocation, LatestDeliveryAction, EmailAction, EmailActionPolicy\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query provides insights on users who clicked on a suspicious URL"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject267')._huntingQuerycontentId267),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 267",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject267')._huntingQuerycontentId267)]",
+                "contentId": "[variables('huntingQueryObject267')._huntingQuerycontentId267]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject267').huntingQueryVersion267]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject267')._huntingQuerycontentId267]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User clicks on malicious inbound emails",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject267')._huntingQuerycontentId267,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject267')._huntingQuerycontentId267,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject268').huntingQueryTemplateSpecName268]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User clicks on phishing URLs in emails_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject268').huntingQueryVersion268]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_268",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User clicks on phishing URLs in emails",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents \n| where ThreatTypes has \"Phish\" \n| join EmailEvents on NetworkMessageId,  $left.AccountUpn == $right.RecipientEmailAddress \n| project Timestamp, Url, ActionType, AccountUpn, ReportId, NetworkMessageId, ThreatTypes, IsClickedThrough, DeliveryLocation, OrgLevelAction, UserLevelAction\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query helps in determining clickthroughs when email delivered because of detection overrides."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject268')._huntingQuerycontentId268),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 268",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject268')._huntingQuerycontentId268)]",
+                "contentId": "[variables('huntingQueryObject268')._huntingQuerycontentId268]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject268').huntingQueryVersion268]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject268')._huntingQuerycontentId268]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User clicks on phishing URLs in emails",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject268')._huntingQuerycontentId268,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject268')._huntingQuerycontentId268,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject269').huntingQueryTemplateSpecName269]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malicious Clicks allowed (click-through)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject269').huntingQueryVersion269]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_269",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious Clicks allowed (click-through)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nUrlClickEvents\n| where TimeGenerated >= TimeStart\n| where IsClickedThrough == 1\n| where isnotempty(ThreatTypes)\n| make-series Count = count() default = 0 on TimeGenerated from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject269')._huntingQuerycontentId269),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 269",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject269')._huntingQuerycontentId269)]",
+                "contentId": "[variables('huntingQueryObject269')._huntingQuerycontentId269]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject269').huntingQueryVersion269]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject269')._huntingQuerycontentId269]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious Clicks allowed (click-through)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject269')._huntingQuerycontentId269,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject269')._huntingQuerycontentId269,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject270').huntingQueryTemplateSpecName270]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malicious Emails with QR code Urls_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject270').huntingQueryVersion270]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_270",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious Emails with QR code Urls",
+                "category": "Hunting Queries",
+                "query": "EmailUrlInfo\n| where UrlLocation == \"QRCode\"\n| join kind=inner (\n    EmailEvents\n    | where isnotempty(ThreatTypes)\n    | project NetworkMessageId, ThreatTypes\n) on NetworkMessageId\n| summarize count() by ThreatTypes\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Visualises emails containing QR code URLs that have been detected as malicious, helping analysts identify QR code-based attack campaigns.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject270')._huntingQuerycontentId270),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 270",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject270')._huntingQuerycontentId270)]",
+                "contentId": "[variables('huntingQueryObject270')._huntingQuerycontentId270]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject270').huntingQueryVersion270]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject270')._huntingQuerycontentId270]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious Emails with QR code Urls",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject270')._huntingQuerycontentId270,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject270')._huntingQuerycontentId270,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject271').huntingQueryTemplateSpecName271]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phishing Email Url Redirector_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject271').huntingQueryVersion271]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_271",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "PhishingEmailUrlRedirector (1)",
+                "category": "Hunting Queries",
+                "query": "EmailUrlInfo\n//This regex identifies emails containing the \"T-Dot\" redirector pattern in the URL\n| where Url matches regex @\"s?\\:\\/\\/(?:www\\.)?t\\.(?:[\\w\\-\\.]+\\/+)+(?:r|redirect)\\/?\\?\" \n    //This regex narrows in on emails that contain the known malicious domain pattern in the URL from the most recent campaigns\n    and Url matches regex @\"[a-zA-Z]\\-[a-zA-Z]{2}\\.(xyz|club|shop)\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject271')._huntingQuerycontentId271),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 271",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject271')._huntingQuerycontentId271)]",
+                "contentId": "[variables('huntingQueryObject271')._huntingQuerycontentId271]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject271').huntingQueryVersion271]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject271')._huntingQuerycontentId271]",
+        "contentKind": "HuntingQuery",
+        "displayName": "PhishingEmailUrlRedirector (1)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject271')._huntingQuerycontentId271,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject271')._huntingQuerycontentId271,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject272').huntingQueryTemplateSpecName272]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SafeLinks URL detections_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject272').huntingQueryVersion272]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_272",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "SafeLinks URL detections",
+                "category": "Hunting Queries",
+                "query": "EmailEvents \n| where DetectionMethods != \"\" \n| extend detection= tostring(parse_json(DetectionMethods).Phish) \n| where detection == '[\"URL detonation reputation\"]' or detection == '[\"URL detonation\"]' \n| summarize total=count() by bin(Timestamp, 1d) \n| order by Timestamp asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query provides insights on the detections done by SafeLinks protection in Defender for Office 365"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject272')._huntingQuerycontentId272),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 272",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject272')._huntingQuerycontentId272)]",
+                "contentId": "[variables('huntingQueryObject272')._huntingQuerycontentId272]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject272').huntingQueryVersion272]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject272')._huntingQuerycontentId272]",
+        "contentKind": "HuntingQuery",
+        "displayName": "SafeLinks URL detections",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject272')._huntingQuerycontentId272,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject272')._huntingQuerycontentId272,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject273').huntingQueryTemplateSpecName273]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 Users clicking on Malicious URLs (Malware)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject273').huntingQueryVersion273]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_273",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Users clicking on Malicious URLs (Malware)",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| summarize TotalClickCount = count(), MalwareClickCount = countif(ThreatTypes has \"Malware\") by AccountUpn\n| extend Bad_Click_Percentage = round(100.0 * MalwareClickCount / TotalClickCount, 2)\n| where MalwareClickCount != 0\n| top 10 by MalwareClickCount\n| project User = AccountUpn, MalwareClicks = MalwareClickCount, TotalClicks = TotalClickCount, Bad_Click_Percentage\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Visualises the top 10 users with click attempts on URLs in emails detected as malware, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject273')._huntingQuerycontentId273),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 273",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject273')._huntingQuerycontentId273)]",
+                "contentId": "[variables('huntingQueryObject273')._huntingQuerycontentId273]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject273').huntingQueryVersion273]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject273')._huntingQuerycontentId273]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Users clicking on Malicious URLs (Malware)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject273')._huntingQuerycontentId273,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject273')._huntingQuerycontentId273,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject274').huntingQueryTemplateSpecName274]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 Users clicking on Malicious URLs (Phish)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject274').huntingQueryVersion274]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_274",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Users clicking on Malicious URLs (Phish)",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| summarize TotalClickCount = count(), PhishClickCount = countif(ThreatTypes has \"Phish\") by AccountUpn\n| extend Bad_Click_Percentage = round(100.0 * PhishClickCount / TotalClickCount, 2)\n| where PhishClickCount != 0\n| top 10 by PhishClickCount\n| project User = AccountUpn, PhishClicks = PhishClickCount, TotalClicks = TotalClickCount, Bad_Click_Percentage\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Visualises the top 10 users with click attempts on URLs in emails detected as phishing, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject274')._huntingQuerycontentId274),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 274",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject274')._huntingQuerycontentId274)]",
+                "contentId": "[variables('huntingQueryObject274')._huntingQuerycontentId274]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject274').huntingQueryVersion274]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject274')._huntingQuerycontentId274]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Users clicking on Malicious URLs (Phish)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject274')._huntingQuerycontentId274,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject274')._huntingQuerycontentId274,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject275').huntingQueryTemplateSpecName275]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 10 Users clicking on Malicious URLs (Spam)_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject275').huntingQueryVersion275]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_275",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 10 Users clicking on Malicious URLs (Spam)",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| summarize TotalClickCount = count(), SpamClickCount = countif(ThreatTypes has \"Spam\") by AccountUpn\n| extend Bad_Click_Percentage = round(100.0 * SpamClickCount / TotalClickCount, 2)\n| where SpamClickCount != 0\n| top 10 by SpamClickCount\n| project User = AccountUpn, SpamClicks = SpamClickCount, TotalClicks = TotalClickCount, Bad_Click_Percentage\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Visualises the top 10 users with click attempts on URLs in emails detected as spam, helping analysts identify risky user behaviour and potential targets.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject275')._huntingQuerycontentId275),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 275",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject275')._huntingQuerycontentId275)]",
+                "contentId": "[variables('huntingQueryObject275')._huntingQuerycontentId275]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject275').huntingQueryVersion275]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject275')._huntingQuerycontentId275]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 10 Users clicking on Malicious URLs (Spam)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject275')._huntingQuerycontentId275,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject275')._huntingQuerycontentId275,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject276').huntingQueryTemplateSpecName276]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URL Click attempts by threat type_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject276').huntingQueryVersion276]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_276",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URL Click attempts by threat type",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nUrlClickEvents\n| where TimeGenerated >= TimeStart\n| where isnotempty(ThreatTypes)\n| summarize Count = count() by ThreatTypes, bin(TimeGenerated, 1d)\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject276')._huntingQuerycontentId276),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 276",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject276')._huntingQuerycontentId276)]",
+                "contentId": "[variables('huntingQueryObject276')._huntingQuerycontentId276]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject276').huntingQueryVersion276]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject276')._huntingQuerycontentId276]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URL Click attempts by threat type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject276')._huntingQuerycontentId276,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject276')._huntingQuerycontentId276,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject277').huntingQueryTemplateSpecName277]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URL Clicks by Action_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject277').huntingQueryVersion277]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_277",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URL Clicks by Action",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| summarize Count = count() by ActionType\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject277')._huntingQuerycontentId277),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 277",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject277')._huntingQuerycontentId277)]",
+                "contentId": "[variables('huntingQueryObject277')._huntingQuerycontentId277]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject277').huntingQueryVersion277]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject277')._huntingQuerycontentId277]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URL Clicks by Action",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject277')._huntingQuerycontentId277,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject277')._huntingQuerycontentId277,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject278').huntingQueryTemplateSpecName278]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URLs by location_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject278').huntingQueryVersion278]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_278",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URLs by location",
+                "category": "Hunting Queries",
+                "query": "EmailUrlInfo\n| summarize Count = count() by UrlLocation\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Visualises where URLs have been identified in emails, summarizing by location (for example: Attachment, header, body) to help analysts understand distribution and risk.\nBased on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject278')._huntingQuerycontentId278),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 278",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject278')._huntingQuerycontentId278)]",
+                "contentId": "[variables('huntingQueryObject278')._huntingQuerycontentId278]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject278').huntingQueryVersion278]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject278')._huntingQuerycontentId278]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URLs by location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject278')._huntingQuerycontentId278,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject278')._huntingQuerycontentId278,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject279').huntingQueryTemplateSpecName279]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Post Delivery Events by Admin_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject279').huntingQueryVersion279]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_279",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Post Delivery Events by Admin",
+                "category": "Hunting Queries",
+                "query": "let gran = 1d;\nlet minTime = startofday(ago(30d));\nlet maxTime = startofday(now());\nlet agg = materialize(EmailPostDeliveryEvents\n    | where Timestamp >= minTime and Timestamp < maxTime\n    | where ActionTrigger has \"AdminAction\"\n    | summarize [\"Soft Delete\"] = countif(Action has 'Soft Delete'), [\"Hard Delete\"] = countif(Action has 'Hard Delete'), [\"Moved to junk folder\"] = countif(Action has 'Moved to junk folder'), [\"Moved to inbox\"] = countif(Action has 'Moved to inbox'), [\"Quarantine release\"] = countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\nrange Timestamp from minTime to maxTime - 1d step gran\n| join kind=leftouter (agg) on Timestamp\n| project Timestamp, [\"Soft Delete\"] = coalesce([\"Soft Delete\"], 0), [\"Hard Delete\"] = coalesce([\"Hard Delete\"], 0), [\"Moved to junk folder\"] = coalesce([\"Moved to junk folder\"], 0), [\"Moved to inbox\"] = coalesce([\"Moved to inbox\"], 0), [\"Quarantine release\"] = coalesce([\"Quarantine release\"], 0)\n| sort by Timestamp asc\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject279')._huntingQuerycontentId279),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 279",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject279')._huntingQuerycontentId279)]",
+                "contentId": "[variables('huntingQueryObject279')._huntingQuerycontentId279]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject279').huntingQueryVersion279]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject279')._huntingQuerycontentId279]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Post Delivery Events by Admin",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject279')._huntingQuerycontentId279,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject279')._huntingQuerycontentId279,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject280').huntingQueryTemplateSpecName280]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Post Delivery Events by Location_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject280').huntingQueryVersion280]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_280",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Post Delivery Events by Location",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet quarantine=EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where DeliveryLocation has 'Quarantine'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Quarantine\";\nlet delete=EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where DeliveryLocation has 'Delete'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Delete\";\nlet junk=EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where DeliveryLocation has 'Junk'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Junk\";\nlet inbox=EmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where DeliveryLocation has 'Inbox'\n| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"Inbox\";\nunion quarantine,delete,junk,inbox\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the amount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject280')._huntingQuerycontentId280),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 280",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject280')._huntingQuerycontentId280)]",
+                "contentId": "[variables('huntingQueryObject280')._huntingQuerycontentId280]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject280').huntingQueryVersion280]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject280')._huntingQuerycontentId280]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Post Delivery Events by Location",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject280')._huntingQuerycontentId280,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject280')._huntingQuerycontentId280,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject281').huntingQueryTemplateSpecName281]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Post Delivery Events by ZAP type_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject281').huntingQueryVersion281]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_281",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Post Delivery Events by ZAP type",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailPostDeliveryEvents\n| where Timestamp >= TimeStart\n| where ActionType has \"ZAP\"\n| where Timestamp < TimeEnd\n| make-series ['Spam ZAP'] = countif(ActionType has 'Spam ZAP'), ['Phish ZAP'] = countif(ActionType has 'Phish ZAP'), ['Malware ZAP'] = countif(ActionType has 'Malware ZAP') default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject281')._huntingQuerycontentId281),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 281",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject281')._huntingQuerycontentId281)]",
+                "contentId": "[variables('huntingQueryObject281')._huntingQuerycontentId281]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject281').huntingQueryVersion281]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject281')._huntingQuerycontentId281]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Post Delivery Events by ZAP type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject281')._huntingQuerycontentId281,'-', '1.1.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject281')._huntingQuerycontentId281,'-', '1.1.0')))]",
+        "version": "1.1.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject282').huntingQueryTemplateSpecName282]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Post Delivery Events over time_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject282').huntingQueryVersion282]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_282",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Post Delivery Events over time",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailPostDeliveryEvents\n| where TimeGenerated >= TimeStart\n| where ActionType has \"ZAP\"\n| make-series ZappedEmails = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject282')._huntingQuerycontentId282),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 282",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject282')._huntingQuerycontentId282)]",
+                "contentId": "[variables('huntingQueryObject282')._huntingQuerycontentId282]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject282').huntingQueryVersion282]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject282')._huntingQuerycontentId282]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Post Delivery Events over time",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject282')._huntingQuerycontentId282,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject282')._huntingQuerycontentId282,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject283').huntingQueryTemplateSpecName283]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "EmailDelivered-ToInbox_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject283').huntingQueryVersion283]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_283",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Determine Successfully Delivered Phishing Emails to Inbox/Junk folder.",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where isnotempty(ThreatTypes) and DeliveryLocation in~ (\"Inbox/folder\",\"Junk folder\")\n| extend Name = tostring(split(SenderFromAddress, '@', 0)[0]), UPNSuffix = tostring(split(SenderFromAddress, '@', 1)[0])\n| extend Account_0_Name = Name\n| extend Account_0_UPNSuffix = UPNSuffix\n| extend IP_0_Address = SenderIPv4\n| extend MailBox_0_MailboxPrimaryAddress = RecipientEmailAddress\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query identifies threats which got successfully delivered to Inbox/Junk folder."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject283')._huntingQuerycontentId283),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 283",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject283')._huntingQuerycontentId283)]",
+                "contentId": "[variables('huntingQueryObject283')._huntingQuerycontentId283]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject283').huntingQueryVersion283]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject283')._huntingQuerycontentId283]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Determine Successfully Delivered Phishing Emails to Inbox/Junk folder.",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject283')._huntingQuerycontentId283,'-', '1.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject283')._huntingQuerycontentId283,'-', '1.0.2')))]",
+        "version": "1.0.2"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject284').huntingQueryTemplateSpecName284]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AnomalousPayloadDeliveredWithISOFile_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject284').huntingQueryVersion284]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_284",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Anomalous Payload Delivered from ISO files",
+                "category": "Hunting Queries",
+                "query": "DeviceEvents\n| where TimeGenerated > ago(30d) \n| where ActionType == 'BrowserLaunchedToOpenUrl' \n| where RemoteUrl endswith \".lnk\"\n| where RemoteUrl !startswith \"C:\"\n| project LNKLaunchTimestamp = TimeGenerated, DeviceName, RemoteUrl\n| parse RemoteUrl with Drive '\\\\' *\n| extend Drive= tostring(Drive)\n| where isnotempty(Drive)\n| join kind=innerunique (\nDeviceProcessEvents\n| where TimeGenerated > ago(30d)\n| where FolderPath !startswith \"C:\"\n| parse FolderPath with Drive '\\\\' *\n| project Drive= tostring(Drive), StartedProcessTimestamp = TimeGenerated, StartedProcessName = FileName, StartedProcessSHA1 = SHA1, StartedProcessCommandline = ProcessCommandLine, StartedProcessPath = FolderPath, DeviceName, StartedProcessParentName = InitiatingProcessFileName, StartedProcessParentCmdline = InitiatingProcessCommandLine, StartedParentProcessFolderPath = InitiatingProcessFolderPath, StartedProcessGrandParent = InitiatingProcessParentFileName, TimeGenerated\n) on DeviceName, Drive\n| where StartedProcessTimestamp between (LNKLaunchTimestamp ..(LNKLaunchTimestamp+1m))\n| project-away Drive1, DeviceName1\n| project-reorder LNKLaunchTimestamp, StartedProcessTimestamp, DeviceName, RemoteUrl, Drive, StartedProcessName, StartedProcessSHA1, StartedProcessPath,StartedProcessCommandline, StartedProcessParentName, StartedProcessParentCmdline, StartedParentProcessFolderPath, StartedProcessGrandParent, TimeGenerated\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for lnk file executions from other locations than C: drive, which can relate to mounted ISO-files."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1204"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject284')._huntingQuerycontentId284),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 284",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject284')._huntingQuerycontentId284)]",
+                "contentId": "[variables('huntingQueryObject284')._huntingQuerycontentId284]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject284').huntingQueryVersion284]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject284')._huntingQuerycontentId284]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Anomalous Payload Delivered from ISO files",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject284')._huntingQuerycontentId284,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject284')._huntingQuerycontentId284,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject285').huntingQueryTemplateSpecName285]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "BitsadminActivity_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject285').huntingQueryVersion285]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_285",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Bitsadmin Activity",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where \n    (FileName =~ \"bitsadmin.exe\" or column_ifexists('ProcessVersionInfoOriginalFileName','ColumnNotAvailable') =~ 'bitsadmin.exe')\n    and ProcessCommandLine has_any ('/Transfer','/AddFile', '/AddFileSet','/AddFileWithRanges')\n| extend \n    ParsedCommandLine = parse_command_line(ProcessCommandLine,'windows')\n| extend     \n    RemoteUrl = tostring(ParsedCommandLine[-2]),\n    LocalFile= tostring(ParsedCommandLine[-1]),\n    Direction = iff(ProcessCommandLine has \"/Upload\", 'Upload', 'Download')\n| project-reorder \n    TimeGenerated,\n    DeviceId,\n    DeviceName,\n    Direction,\n    RemoteUrl,\n    LocalFile,\n    InitiatingProcessFolderPath,\n    InitiatingProcessAccountDomain,\n    InitiatingProcessAccountName,\n    InitiatingProcessSHA256,\n    ProcessCommandLine\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for use of bitsadmin.exe for file transfer, which can be used for legitimate purposes or as part of a malware downloader."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence,CommandAndControl,Exfiltration"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject285')._huntingQuerycontentId285),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 285",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject285')._huntingQuerycontentId285)]",
+                "contentId": "[variables('huntingQueryObject285')._huntingQuerycontentId285]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject285').huntingQueryVersion285]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject285')._huntingQuerycontentId285]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Bitsadmin Activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject285')._huntingQuerycontentId285,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject285')._huntingQuerycontentId285,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject286').huntingQueryTemplateSpecName286]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MaliciousUseOfMSIExec_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject286').huntingQueryVersion286]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_286",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Detect Malicious use of MSIExec",
+                "category": "Hunting Queries",
+                "query": "//Find possible download and execution using Msiexec\nDeviceProcessEvents\n| where TimeGenerated > ago(7d)\n//MSIExec\n| where FileName =~ \"msiexec.exe\" and \n//With domain in command line\n(ProcessCommandLine has \"http\" and ProcessCommandLine has \"return\")//Find PowerShell running files from the temp folder\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query detects possible download and execution using Msiexec."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,PrivilegeEscalation,CredentialAccess"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject286')._huntingQuerycontentId286),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 286",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject286')._huntingQuerycontentId286)]",
+                "contentId": "[variables('huntingQueryObject286')._huntingQuerycontentId286]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject286').huntingQueryVersion286]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject286')._huntingQuerycontentId286]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Detect Malicious use of MSIExec",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject286')._huntingQuerycontentId286,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject286')._huntingQuerycontentId286,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject287').huntingQueryTemplateSpecName287]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MaliciousUseOfMsiExecMimikatz_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject287').huntingQueryVersion287]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_287",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Detect Malicious use of Msiexec Mimikatz",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where Timestamp > ago(7d)\n| where InitiatingProcessFileName =~ \"msiexec.exe\"\n//Mimikatz commands\nand (ProcessCommandLine contains \"privilege::\" \nor ProcessCommandLine has \"sekurlsa\" \nor ProcessCommandLine contains \"token::\")\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for malicious use of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,CredentialAccess,PrivilegeEscalation"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject287')._huntingQuerycontentId287),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 287",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject287')._huntingQuerycontentId287)]",
+                "contentId": "[variables('huntingQueryObject287')._huntingQuerycontentId287]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject287').huntingQueryVersion287]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject287')._huntingQuerycontentId287]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Detect Malicious use of Msiexec Mimikatz",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject287')._huntingQuerycontentId287,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject287')._huntingQuerycontentId287,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject288').huntingQueryTemplateSpecName288]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "OfficeAppsLaunchingWscript_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject288').huntingQueryVersion288]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_288",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Office Apps Launching Wscipt",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName in~('winword.exe', 'excel.exe', 'outlook.exe') \n| where FileName =~ \"wscript.exe\" and ProcessCommandLine has \".jse\" \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "The query searches for Office applications launching wscript.exe to run a JSE file."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "LateralMovement,Collection,CommandAndControl"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject288')._huntingQuerycontentId288),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 288",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject288')._huntingQuerycontentId288)]",
+                "contentId": "[variables('huntingQueryObject288')._huntingQuerycontentId288]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject288').huntingQueryVersion288]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject288')._huntingQuerycontentId288]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Office Apps Launching Wscipt",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject288')._huntingQuerycontentId288,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject288')._huntingQuerycontentId288,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject289').huntingQueryTemplateSpecName289]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PotentialKerberoastActivities_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject289').huntingQueryVersion289]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_289",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Detect Potential kerberoast Activities",
+                "category": "Hunting Queries",
+                "query": "let MaxCount = 70; //Number of requests per 2 minute timeframe, depending on org size.\nIdentityLogonEvents\n| where TimeGenerated > ago(1d)\n| where ActionType == \"LogonSuccess\"\n| where Protocol == \"Kerberos\"\n| extend json = todynamic(parse_json(tostring(AdditionalFields)))\n| extend SPN = json.Spns,\n       AttackTechniques = json.AttackTechniques\n      | project-away json\n| where isnotempty(SPN)\n| where AttackTechniques has \"T1558.003\"\n| mv-expand SPN\n        | extend SPNType = tostring(extract(@\"^\\w+\",0,tostring(SPN)))\n| distinct tostring(SPN),DeviceName,AccountUpn, AccountSid,bin(TimeGenerated,2m),ReportId, tostring(AttackTechniques)\n| summarize count(), SPNS=(make_list(SPN, 100000)),ReportId=tostring((make_list(ReportId, 100000))[0]) by AccountUpn,AccountSid,DeviceName, bin(TimeGenerated, 2m), tostring(AttackTechniques)\n| extend SPNS = (replace_regex(tostring(SPNS), @'[^\\w+-\\/]+', ''))\n| where count_ >= MaxCount\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query aim to detect if someone requests service tickets (where count => maxcount). The query requires trimming to set a baseline level for MaxCount."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1558.003"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject289')._huntingQuerycontentId289),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 289",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject289')._huntingQuerycontentId289)]",
+                "contentId": "[variables('huntingQueryObject289')._huntingQuerycontentId289]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject289').huntingQueryVersion289]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject289')._huntingQuerycontentId289]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Detect Potential kerberoast Activities",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject289')._huntingQuerycontentId289,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject289')._huntingQuerycontentId289,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject290').huntingQueryTemplateSpecName290]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PowerShellDownloads_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject290').huntingQueryVersion290]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_290",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "PowerShell Downloads",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where FileName in~ (\"powershell.exe\", \"powershell_ise.exe\")\n| where ProcessCommandLine has \"Net.WebClient\"\n   or ProcessCommandLine has \"DownloadFile\"\n   or ProcessCommandLine has \"Invoke-WebRequest\"\n   or ProcessCommandLine has \"Invoke-Shellcode\"\n   or ProcessCommandLine has \"http\"\n   or ProcessCommandLine has \"IEX\"\n   or ProcessCommandLine has \"Start-BitsTransfer\"\n   or ProcessCommandLine has \"mpcmdrun.exe\"\n| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine\n| top 100 by TimeGenerated\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "The query searches for PowerShell execution events that could involve a download."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject290')._huntingQuerycontentId290),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 290",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject290')._huntingQuerycontentId290)]",
+                "contentId": "[variables('huntingQueryObject290')._huntingQuerycontentId290]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject290').huntingQueryVersion290]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject290')._huntingQuerycontentId290]",
+        "contentKind": "HuntingQuery",
+        "displayName": "PowerShell Downloads",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject290')._huntingQuerycontentId290,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject290')._huntingQuerycontentId290,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject291').huntingQueryTemplateSpecName291]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SuspiciousAppExeutedByWebserver_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject291').huntingQueryVersion291]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_291",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Webserver Executing Suspicious Applications",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where TimeGenerated > ago(7d)\n| where InitiatingProcessFileName in~ ('w3wp.exe', 'httpd.exe') // 'sqlservr.exe')\n| where FileName in~ ('cmd.exe', 'powershell.exe', 'cscript.exe', 'wscript.exe', 'net.exe', 'net1.exe', 'ping.exe', 'whoami.exe')\n| summarize instances = count() by ProcessCommandLine, FolderPath, DeviceName, DeviceId \n| order by instances asc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looks for common webserver process names and identifies any processes launched using a scripting language (cmd, powershell, wscript, cscript)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject291')._huntingQuerycontentId291),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 291",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject291')._huntingQuerycontentId291)]",
+                "contentId": "[variables('huntingQueryObject291')._huntingQuerycontentId291]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject291').huntingQueryVersion291]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject291')._huntingQuerycontentId291]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Webserver Executing Suspicious Applications",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject291')._huntingQuerycontentId291,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject291')._huntingQuerycontentId291,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject292').huntingQueryTemplateSpecName292]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SuspiciousMshtaUsage_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject292').huntingQueryVersion292]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_292",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Detect Suspicious Mshta Usage",
+                "category": "Hunting Queries",
+                "query": "// mshta.exe script launching processes\nDeviceProcessEvents \n| where Timestamp > ago(7d)\nand InitiatingProcessFileName =~ 'mshta.exe'\nand InitiatingProcessCommandLine contains '<script>'\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query detects when mshta.exe has been run, which might include illegitimate usage by attackers."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject292')._huntingQuerycontentId292),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 292",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject292')._huntingQuerycontentId292)]",
+                "contentId": "[variables('huntingQueryObject292')._huntingQuerycontentId292]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject292').huntingQueryVersion292]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject292')._huntingQuerycontentId292]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Detect Suspicious Mshta Usage",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject292')._huntingQuerycontentId292,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject292')._huntingQuerycontentId292,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject293').huntingQueryTemplateSpecName293]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "FilesCopiedToUSBDrives_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject293').huntingQueryVersion293]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_293",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Files Copied to USB Drives",
+                "category": "Hunting Queries",
+                "query": "let UsbDriveMount = DeviceEvents\n| where ActionType==\"UsbDriveMounted\"\n| extend ParsedFields=parse_json(AdditionalFields)\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=TimeGenerated,\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\n| order by DeviceId asc, MountTime desc;\nlet FileCreation = DeviceFileEvents\n| where InitiatingProcessAccountName != \"system\"\n| where ActionType == \"FileCreated\"\n| where FolderPath !startswith \"C:\\\\\"\n| where FolderPath !startswith \"\\\\\"\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\nFileName, FolderPath, SHA256, TimeGenerated, SensitivityLabel, IsAzureInfoProtectionApplied\n| order by DeviceId asc, TimeGenerated desc;\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\n| where FolderPath startswith DriveLetter\n| where TimeGenerated >= MountTime\n| partition hint.strategy=native by ReportId ( top 1 by MountTime )\n| order by DeviceId asc, TimeGenerated desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Exfiltration"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject293')._huntingQuerycontentId293),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 293",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject293')._huntingQuerycontentId293)]",
+                "contentId": "[variables('huntingQueryObject293')._huntingQuerycontentId293]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject293').huntingQueryVersion293]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject293')._huntingQuerycontentId293]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Files Copied to USB Drives",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject293')._huntingQuerycontentId293,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject293')._huntingQuerycontentId293,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject294').huntingQueryTemplateSpecName294]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "CVE-2022-26134-Confluence_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject294').huntingQueryVersion294]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_294",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Suspicious Tomcat Confluence Process Launch",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where InitiatingProcessFileName hasprefix \"tomcat\" and InitiatingProcessCommandLine has \"confluence\"\n| where (ProcessCommandLine has_any(\"certutil\", \"whoami\", \"nltest\", \" dir \", \"curl\", \"ifconfig\", \"cat \", \"net user\",\n\"net time /domain\",\"tasklist\",\"-c ls\",\"ipconfig\",\"arp\",\"ping\",\"net view\",\"net group\",\"netstat\", \"wmic datafile\"))\nor (FileName =~ \"powershell.exe\" and ProcessCommandLine hasprefix \"-e\") \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,PrivilegeEscalation"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1203"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject294')._huntingQuerycontentId294),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 294",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject294')._huntingQuerycontentId294)]",
+                "contentId": "[variables('huntingQueryObject294')._huntingQuerycontentId294]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject294').huntingQueryVersion294]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject294')._huntingQuerycontentId294]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Suspicious Tomcat Confluence Process Launch",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject294')._huntingQuerycontentId294,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject294')._huntingQuerycontentId294,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject295').huntingQueryTemplateSpecName295]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MosaicLoader_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject295').huntingQueryVersion295]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_295",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MosaicLoader",
+                "category": "Hunting Queries",
+                "query": "DeviceRegistryEvents \n| where ((ActionType == \"RegistryValueSet\") and (RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows Defender\\\\Exclusions\\\\Paths\" \nor RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Extensions\"\nor RegistryKey startswith @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\"))\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CommandAndControl"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject295')._huntingQuerycontentId295),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 295",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject295')._huntingQuerycontentId295)]",
+                "contentId": "[variables('huntingQueryObject295')._huntingQuerycontentId295]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject295').huntingQueryVersion295]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject295')._huntingQuerycontentId295]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MosaicLoader",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject295')._huntingQuerycontentId295,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject295')._huntingQuerycontentId295,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject296').huntingQueryTemplateSpecName296]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SpoolsvSpawningRundll32_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject296').huntingQueryVersion296]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_296",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spoolsv Spawning Rundll32",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where InitiatingProcessParentFileName has \"spoolsv.exe\"\n| where InitiatingProcessFileName =~ \"rundll32.exe\"\n| where isempty(InitiatingProcessCommandLine) or InitiatingProcessCommandLine endswith \"rundll32.exe\" //either commandline is empty or just \"rundll32.exe\"\n| where FileName !in~ (\"WerFault.exe\")\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Look for the spoolsv.exe launching rundll32.exe with an empty command line."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation,Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject296')._huntingQuerycontentId296),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 296",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject296')._huntingQuerycontentId296)]",
+                "contentId": "[variables('huntingQueryObject296')._huntingQuerycontentId296]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject296').huntingQueryVersion296]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject296')._huntingQuerycontentId296]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spoolsv Spawning Rundll32",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject296')._huntingQuerycontentId296,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject296')._huntingQuerycontentId296,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject297').huntingQueryTemplateSpecName297]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SuspiciousDLLInSpoolFolder_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject297').huntingQueryVersion297]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_297",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Suspicious DLLs in spool Folder",
+                "category": "Hunting Queries",
+                "query": "DeviceFileEvents\n| where FolderPath contains @\"\\system32\\spool\\drivers\\x64\\3\\\"\n| where FileName endswith \".dll\"\n| where ActionType in (\"FileCreated\", \"FileRenamed\")\n| join kind=inner DeviceImageLoadEvents on DeviceId,DeviceName,FileName,InitiatingProcessFileName\n| where TimeGenerated1 >= TimeGenerated and FolderPath1 contains @\"\\system32\\spool\\drivers\\x64\\3\\Old\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Look for the creation of suspicious DLL files spawned in the \\spool\\ folder along with DLLs that were recently loaded afterwards from \\Old."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation,Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject297')._huntingQuerycontentId297),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 297",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject297')._huntingQuerycontentId297)]",
+                "contentId": "[variables('huntingQueryObject297')._huntingQuerycontentId297]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject297').huntingQueryVersion297]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject297')._huntingQuerycontentId297]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Suspicious DLLs in spool Folder",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject297')._huntingQuerycontentId297,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject297')._huntingQuerycontentId297,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject298').huntingQueryTemplateSpecName298]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SuspiciousFilesInSpoolFolder_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject298').huntingQueryVersion298]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_298",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Suspicious Files in spool Folder",
+                "category": "Hunting Queries",
+                "query": "DeviceFileEvents\n| where FolderPath has @\"System32\\spool\\drivers\"\n| project DeviceName, TimeGenerated, ActionType, FolderPath, FileName, SHA1\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation,Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject298')._huntingQuerycontentId298),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 298",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject298')._huntingQuerycontentId298)]",
+                "contentId": "[variables('huntingQueryObject298')._huntingQuerycontentId298]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject298').huntingQueryVersion298]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject298')._huntingQuerycontentId298]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Suspicious Files in spool Folder",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject298')._huntingQuerycontentId298,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject298')._huntingQuerycontentId298,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject299').huntingQueryTemplateSpecName299]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SuspiciousSpoolsvChildProcess_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject299').huntingQueryVersion299]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_299",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Suspicious Spoolsv Child Process",
+                "category": "Hunting Queries",
+                "query": "// Look for file load events for spoolsv\nDeviceImageLoadEvents\n| where TimeGenerated > ago(7d)\n| where InitiatingProcessFileName =~ \"spoolsv.exe\"\n| where FolderPath has @\"spool\\drivers\"\n| extend LoadFileTime = TimeGenerated\n| distinct DeviceId, LoadFileTime, FileName, SHA256\n// Join process data associated with spoolsv launching suspicious processes after image load\n| join DeviceProcessEvents on $left.DeviceId == $right.DeviceId\n| where TimeGenerated > ago(7d)\n| where TimeGenerated < LoadFileTime +5m\n| where InitiatingProcessFileName =~ \"spoolsv.exe\"\n| where ProcessIntegrityLevel =~ 'SYSTEM'\n| where (FileName1 in~(\"gpupdate.exe\", \"whoami.exe\", \"nltest.exe\", \"taskkill.exe\",\n            \"wmic.exe\", \"taskmgr.exe\", \"sc.exe\", \"findstr.exe\", \"curl.exe\", \"wget.exe\", \"certutil.exe\", \"bitsadmin.exe\", \"accesschk.exe\",\n            \"wevtutil.exe\", \"bcdedit.exe\", \"fsutil.exe\", \"cipher.exe\", \"schtasks.exe\", \"write.exe\", \"wuauclt.exe\") or \n// Processes with specific FPs removed          \n(FileName1 =~ \"net.exe\" and ProcessCommandLine !has \"start\") or \n(FileName1 =~ \"cmd.exe\" and not(ProcessCommandLine has_any(\".spl\", \"route add\", \"program files\"))) or \n(FileName1 =~ \"netsh.exe\" and not(ProcessCommandLine has_any(\"add portopening\", \"rule name\")))) or\n(FileName1 =~ \"powershell.exe\" and ProcessCommandLine!has \".spl\") or\n(FileName1 =~ \"rundll32.exe\" and ProcessCommandLine != \"\" and ProcessCommandLine !contains \" \")\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation,Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject299')._huntingQuerycontentId299),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 299",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject299')._huntingQuerycontentId299)]",
+                "contentId": "[variables('huntingQueryObject299')._huntingQuerycontentId299]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject299').huntingQueryVersion299]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject299')._huntingQuerycontentId299]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Suspicious Spoolsv Child Process",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject299')._huntingQuerycontentId299,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject299')._huntingQuerycontentId299,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject300').huntingQueryTemplateSpecName300]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PrintNightmareUsageDetection-CVE-2021-1675_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject300').huntingQueryVersion300]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_300",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "PrintNightmare CVE-2021-1675 usage Detection",
+                "category": "Hunting Queries",
+                "query": "DeviceFileEvents\n| where Timestamp > ago(7d)\n| where ActionType == \"FileCreated\"\n| where FolderPath startswith \"C:\\\\WINDOWS\\\\SYSTEM32\\\\SPOOL\\\\drivers\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looks for any file creations in the print spooler drivers folder."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation,LateralMovement,Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject300')._huntingQuerycontentId300),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 300",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject300')._huntingQuerycontentId300)]",
+                "contentId": "[variables('huntingQueryObject300')._huntingQuerycontentId300]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject300').huntingQueryVersion300]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject300')._huntingQuerycontentId300]",
+        "contentKind": "HuntingQuery",
+        "displayName": "PrintNightmare CVE-2021-1675 usage Detection",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject300')._huntingQuerycontentId300,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject300')._huntingQuerycontentId300,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject301').huntingQueryTemplateSpecName301]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SuspiciousFileCreationByPrintSpoolerService_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject301').huntingQueryVersion301]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_301",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Windows Print Spooler Service Suspicious File Creation",
+                "category": "Hunting Queries",
+                "query": "DeviceFileEvents\n| where TimeGenerated > ago(7d)\n| where ActionType == \"FileCreated\"\n| where FileName endswith \".dll\"\n| where FolderPath startswith \"C:\\\\WINDOWS\\\\SYSTEM32\\\\SPOOL\\\\drivers\\\\x64\\\\\\3\\\\\"\n   or FolderPath startswith \"C:\\\\WINDOWS\\\\SYSTEM32\\\\SPOOL\\\\drivers\\\\x64\\\\\\4\\\\\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "The query digs in Windows print spooler drivers folder for any file creations. This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation,LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1574"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject301')._huntingQuerycontentId301),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 301",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject301')._huntingQuerycontentId301)]",
+                "contentId": "[variables('huntingQueryObject301')._huntingQuerycontentId301]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject301').huntingQueryVersion301]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject301')._huntingQuerycontentId301]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Windows Print Spooler Service Suspicious File Creation",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject301')._huntingQuerycontentId301,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject301')._huntingQuerycontentId301,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject302').huntingQueryTemplateSpecName302]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MITRESuspiciousEvents_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject302').huntingQueryVersion302]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_302",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "MITRE - Suspicious Events",
+                "category": "Hunting Queries",
+                "query": "let weights = dynamic({\"Low\":1, \"Medium\":3, \"High\":5}); //Assign weights to the risk levels\n//Low risk events\nlet lowRiskEvents =\n    DeviceProcessEvents \n    | where\n        (FileName =~ \"powershell.exe\" and ProcessCommandLine has \"-command\") //T1086 PowerShell\n        or\n        (FileName =~ \"powershell.exe\" and ProcessCommandLine contains \"-nop\") //T1086 PowerShell\n        or\n        (FileName =~ \"schtasks.exe\" and ProcessCommandLine has \"create\") //T1053 Scheduled Task\n        or\n        (FileName =~ \"installutil.exe\") //T1118 InstallUtil\n        or\n        (FileName =~ \"msbuild.exe\") //T1127 Trusted Developer Utilities\n        or\n        (FileName =~ \"nbtstat.exe\") //T1016 System Network Configuration Discovery\n        or\n        (FileName == \"mshta.exe\") //T1170 Mshta\n        or\n        (FileName =~ \"netsh.exe\") //T1089 Disabling Security Tools, T1063 Security Software Discovery\n        or\n        (FileName == \"net.exe\" and ProcessCommandLine has \" start \") //T1007 System Service Discovery\n    | extend Weight = toint((weights[\"Low\"]));\n//Medium risk events\nlet mediumRiskEvents =\n    DeviceProcessEvents \n    | where\n        (FileName =~ \"regsvcs.exe\") //T1121 Regsvcs/Regasm\n        or\n        (FileName =~ \"arp.exe\" and ProcessCommandLine has \"-a\") //T1016 System Network Configuration Discovery\n        or\n        (FileName =~ \"ipconfig.exe\" and ProcessCommandLine has \"all\") //T1016 System Network Configuration Discovery\n        or\n        (FileName startswith \"psexe\") //T1035 Service Execution\n        or\n        (FileName == \"net.exe\" and ProcessCommandLine has \" share \") //T1135 Network Share Discovery\n        or\n        (FileName =~ \"netsh.exe\" and ProcessCommandLine has \"interface show\") //T1016 System Network Configuration Discovery\n    | extend Weight = toint((weights[\"Medium\"]));\n//Higher risk events\nlet highRiskEvents =\n    DeviceProcessEvents \n    | where\n        (FileName =~ \"net.exe\" and ProcessCommandLine has \"config\") //T1016 System Network Configuration Discovery\n        or\n        (FileName =~ \"net.exe\" and ProcessCommandLine has \"time\") //T1124 System Time Discovery\n        or \n        (FileName =~ \"w32tm.exe\" and ProcessCommandLine has \"/tz\") //T1124 System Time Discovery\n        or\n        (FileName == \"cmstp.exe\") //T1191 CMSTP\n        or\n        (FileName =~ \"netsh.exe\" and (ProcessCommandLine has \"portproxy\" or ProcessCommandLine has \"p\")) //T1090 Connection Proxy\n    | extend Weight = toint((weights[\"High\"]));\nunion kind=outer lowRiskEvents, mediumRiskEvents, highRiskEvents\n| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, Weight\n| summarize Start_Time=min(TimeGenerated), End_Time=max(TimeGenerated), Weight_Sum=sum(Weight), Processes=make_set(FileName, 100000), Commands=make_set(ProcessCommandLine, 100000) by DeviceName\n| where Weight_Sum > 30\n| sort by Weight_Sum desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query looks for several different MITRE techniques, grouped by risk level. A weighting is applied to each risk level and a total score calculated per machine. Techniques can be added/removed as required."
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject302')._huntingQuerycontentId302),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 302",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject302')._huntingQuerycontentId302)]",
+                "contentId": "[variables('huntingQueryObject302')._huntingQuerycontentId302]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject302').huntingQueryVersion302]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject302')._huntingQuerycontentId302]",
+        "contentKind": "HuntingQuery",
+        "displayName": "MITRE - Suspicious Events",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject302')._huntingQuerycontentId302,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject302')._huntingQuerycontentId302,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject303').huntingQueryTemplateSpecName303]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AnomalousVoulmeOfFileDeletion_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject303').huntingQueryVersion303]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_303",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Unusual Volume of file deletion by users",
+                "category": "Hunting Queries",
+                "query": "let relevantOperations = pack_array(\"FileDeleted\", \"FileRecycled\", \"FileDeletedFirstStageRecycleBin\", \"FileDeletedSecondStageRecycleBin\", \"FileVersionsAllMinorsRecycled\", \"FileVersionRecycled\", \"FileVersionsAllRecycled\");\nlet relevantAppIds = pack_array(int(20892), int(15600)); // App Ids for SharePoint and OneDrive\nlet timeWindow = 7d;\nlet timeNow = now();\n//\nlet riskyUsers= // Look for users with risky sign-ins\n  SigninLogs    \n  | where CreatedDateTime between ((timeNow - timeWindow) .. (timeNow))\n  | where isnotempty(UserId) and isnotempty(OriginalRequestId)\n  | where ResultType == '0'\n  | where RiskLevelDuringSignIn == 'high'\n  | project UserId, RiskLevelDuringSignIn, CreatedDateTime, SessionId=OriginalRequestId\n  ;\nlet hasUsers = isnotempty(toscalar(riskyUsers));\n //\nlet deleteEvents = // look for file deletion activity and scope it to risky users\n  CloudAppEvents\n  | where hasUsers\n  | where TimeGenerated between ((timeNow - timeWindow) .. (timeNow))\n  | where ApplicationId in (relevantAppIds)\n  | where isnotempty(AccountObjectId)\n  | where AccountObjectId in (riskyUsers)\n  | where ActionType in (relevantOperations)\n  | extend SessionId= tostring(RawEventData.AppAccessContext.AADSessionId)\n  | where isnotempty(SessionId)\n  | project UserId=AccountObjectId, AccountDisplayName, ApplicationId, SessionId, ActionType, TimeGenerated, ReportId\n  ;   \n //\ndeleteEvents  \n| join kind=leftsemi riskyUsers on UserId, SessionId\n| summarize Count=count() , (Timestamp, ReportId)=arg_min(TimeGenerated, ReportId) by UserId, AccountDisplayName, ApplicationId, ActionType, Time=bin(TimeGenerated, 5m)\n// look for only those scoped users who have generated an increase in file deletion activity.\n| summarize TotalCount= countif(Count > 50), (Timestamp, ReportId)=arg_min(Timestamp, ReportId) by UserId, AccountDisplayName, ApplicationId \n| where TotalCount >= 3\n| project UserId, AccountDisplayName, ApplicationId, TotalCount, ReportId, Timestamp\n| extend NTDomain = tostring(split(AccountDisplayName,'\\\\',0)[0]), Name = tostring(split(AccountDisplayName,'\\\\',1)[0])\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Impact"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject303')._huntingQuerycontentId303),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 303",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject303')._huntingQuerycontentId303)]",
+                "contentId": "[variables('huntingQueryObject303')._huntingQuerycontentId303]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject303').huntingQueryVersion303]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject303')._huntingQuerycontentId303]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Unusual Volume of file deletion by users",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject303')._huntingQuerycontentId303,'-', '1.0.2')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject303')._huntingQuerycontentId303,'-', '1.0.2')))]",
+        "version": "1.0.2"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject304').huntingQueryTemplateSpecName304]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DetectMailSniper_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject304').huntingQueryVersion304]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_304",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Detect MaiSniper",
+                "category": "Hunting Queries",
+                "query": "let dateRange = ago(10d);\n//\nlet whoamiProcess = DeviceProcessEvents\n| where ProcessCreationTime >= dateRange\n| where FileName =~ 'whoami.exe' and InitiatingProcessParentFileName =~ 'powershell.exe'\n| project DeviceId, whoamiTime = ProcessCreationTime, whoamiProcessName = FileName, \nwhoamiParentName = InitiatingProcessParentFileName, whoamiParentPID = InitiatingProcessParentId;\n//\nlet netProcess = DeviceProcessEvents \n| where ProcessCreationTime >= dateRange\n| where FileName =~ 'net.exe' and InitiatingProcessParentFileName =~ 'powershell.exe'\n| project DeviceId, netTime = ProcessCreationTime, ProcessCreationTime = FileName, \nnetParentName = InitiatingProcessParentFileName, netParentPID = InitiatingProcessParentId;\n//\nlet mailServerEvents = DeviceNetworkEvents\n| where TimeGenerated >= dateRange\n| where InitiatingProcessFileName =~ 'powershell.exe'\n| where RemoteUrl contains 'onmicrosoft.com'\nor RemoteUrl contains 'outlook.com'\n| project DeviceId, mailTime = TimeGenerated, mailProcessName = InitiatingProcessFileName, \nmailPID = InitiatingProcessId;\n//\nmailServerEvents\n| join netProcess on DeviceId \n| where netParentPID == mailPID and netParentName == mailProcessName \n| join whoamiProcess on DeviceId \n| where whoamiParentPID == mailPID and whoamiParentName == mailProcessName \n| where netTime < mailTime + 4h and netTime > mailTime - 4h\n| where whoamiTime < mailTime + 4h and whoamiTime > mailTime - 4h\n| project DeviceId, EstimatedIncidentTime = mailTime, ProcessName = mailProcessName, \nProcessID = mailPID\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for usage of MailSniper Exchange attack tool."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,CredentialAccess,Collection,Exfiltration"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject304')._huntingQuerycontentId304),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 304",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject304')._huntingQuerycontentId304)]",
+                "contentId": "[variables('huntingQueryObject304')._huntingQuerycontentId304]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject304').huntingQueryVersion304]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject304')._huntingQuerycontentId304]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Detect MaiSniper",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject304')._huntingQuerycontentId304,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject304')._huntingQuerycontentId304,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject305').huntingQueryTemplateSpecName305]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AccountBruteForce_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject305').huntingQueryVersion305]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_305",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Account Brute Force",
+                "category": "Hunting Queries",
+                "query": "DeviceLogonEvents\n| where isnotempty(RemoteIP) \n    and AccountName !endswith \"$\"\n    and RemoteIPType == \"Public\"\n| extend Account=strcat(AccountDomain, \"\\\\\", AccountName)\n| summarize \n    Successful=countif(ActionType == \"LogonSuccess\"),\n    Failed = countif(ActionType == \"LogonFailed\"),\n    FailedAccountsCount = dcountif(Account, ActionType == \"LogonFailed\"),\n    SuccessfulAccountsCount = dcountif(Account, ActionType == \"LogonSuccess\"),\n    FailedAccounts = make_set(iff(ActionType == \"LogonFailed\", Account, \"\"), 5),\n    SuccessfulAccounts = make_set(iff(ActionType == \"LogonSuccess\", Account, \"\"), 5)\n    by DeviceName, RemoteIP, RemoteIPType\n| where Failed > 10 and Successful > 0 and FailedAccountsCount > 2 and SuccessfulAccountsCount == 1\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query searches for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded."
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject305')._huntingQuerycontentId305),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 305",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject305')._huntingQuerycontentId305)]",
+                "contentId": "[variables('huntingQueryObject305')._huntingQuerycontentId305]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject305').huntingQueryVersion305]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject305')._huntingQuerycontentId305]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Account Brute Force",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject305')._huntingQuerycontentId305,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject305')._huntingQuerycontentId305,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject306').huntingQueryTemplateSpecName306]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "RemoteFileCreationWithPsExec_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject306').huntingQueryVersion306]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_306",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Remote File Creation with PsExec",
+                "category": "Hunting Queries",
+                "query": "// Find PsExec creating multiple files on remote machines in a 10-minute window\nDeviceFileEvents\n| where TimeGenerated > ago(7d)\n// Looking for PsExec by accepteula command flag\n| where InitiatingProcessCommandLine has \"accepteula\"\n// Remote machines and file is exe\n| where FolderPath has \"\\\\\\\\\" and FileName endswith \".exe\"\n| extend Exe = countof(InitiatingProcessCommandLine, \".exe\")\n// Checking to see if command line has 2 .exe or .bat\n| where InitiatingProcessCommandLine !has \".ps1\" and Exe > 1 or\nInitiatingProcessCommandLine has \".bat\"\n// Exclusions: Remove the following line to widen scope of AHQ\n| where not(InitiatingProcessCommandLine has_any(\"batch\", \"auditpol\",\n\"script\", \"scripts\", \"illusive\", \"rebootrequired\"))\n| summarize FileCount = dcount(FolderPath), make_set(SHA1, 100000), make_set(FolderPath, 100000),\nmake_set(FileName, 100000), make_set(InitiatingProcessCommandLine, 100000) by DeviceId,\nTimeWindow=bin(TimeGenerated, 10m), InitiatingProcessFileName\n| where FileCount > 4\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query detects remote file creation events that might indicate an active attack using PsExec."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "LateralMovement"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject306')._huntingQuerycontentId306),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 306",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject306')._huntingQuerycontentId306)]",
+                "contentId": "[variables('huntingQueryObject306')._huntingQuerycontentId306]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject306').huntingQueryVersion306]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject306')._huntingQuerycontentId306]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Remote File Creation with PsExec",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject306')._huntingQuerycontentId306,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject306')._huntingQuerycontentId306,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject307').huntingQueryTemplateSpecName307]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ServiceAccountsPerformingRemotePS_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject307').huntingQueryVersion307]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_307",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Service Accounts Performing Remote PS",
+                "category": "Hunting Queries",
+                "query": "let InteractiveTypes = pack_array(                                  // Declare Interactive logon type names\n    'Interactive',\n    'CachedInteractive',\n    'Unlock',\n    'RemoteInteractive',\n    'CachedRemoteInteractive',\n    'CachedUnlock'\n);\nlet WhitelistedCmdlets = pack_array(                                // List of whitelisted commands that don't provide a lot of value\n    'prompt',\n    'Out-Default',\n    'out-lineoutput',\n    'format-default',\n    'Set-StrictMode',\n    'TabExpansion2'\n);\nlet WhitelistedAccounts = pack_array('FakeWhitelistedAccount');     // List of accounts that are known to perform this activity in the environment and can be ignored\nDeviceLogonEvents                                                         // Get all logon events...\n| where AccountName !in~ (WhitelistedAccounts)                      // ...where it is not a whitelisted account...\n| where ActionType == \"LogonSuccess\"                                // ...and the logon was successful...\n| where AccountName !contains \"$\"                                   // ...and not a machine logon.\n| where AccountName !has \"winrm va_\"                                // WinRM will have pseudo account names that match this if there is an explicit permission for an admin to run the cmdlet, so assume it is good.\n| extend IsInteractive=(LogonType in (InteractiveTypes))            // Determine if the logon is interactive (True=1,False=0)...\n| summarize HasInteractiveLogon=max(IsInteractive)                  // ...then bucket and get the maximum interactive value (0 or 1)...\n            by AccountName                                          // ... by the AccountNames\n| where HasInteractiveLogon == 0                                    // ...and filter out all accounts that had an interactive logon.\n// At this point, we have a list of accounts that we believe to be service accounts\n// Now we need to find RemotePS sessions that were spawned by those accounts\n// Note that we look at all powershell cmdlets executed to form a 29-day baseline to evaluate the data on today\n| join kind=rightsemi (                                             // Start by dropping the account name and only tracking the...\n\tDeviceEvents                                                      // ...\n\t| where ActionType == 'PowerShellCommand'                       // ...PowerShell commands seen...\n\t| where InitiatingProcessFileName =~ 'wsmprovhost.exe'          // ...whose parent was wsmprovhost.exe (RemotePS Server)...\n    | extend AccountName = InitiatingProcessAccountName             // ...and add an AccountName field so the join is easier\n) on AccountName\n// At this point, we have all of the commands that were ran by service accounts\n| extend Command = tostring(extractjson('$.Command', tostring(AdditionalFields)))   // Extract the actual PowerShell command that was executed\n| where Command !in (WhitelistedCmdlets)                            // Remove any values that match the whitelisted cmdlets\n| summarize (Timestamp, ReportId)=argmax(TimeGenerated, ReportId),      // Then group all of the cmdlets and calculate the min/max times of execution...\n    makeset(Command), count(), min(TimeGenerated) by                    // ...as well as creating a list of cmdlets ran and the count..\n    AccountName, DeviceName, DeviceId                            // ...and have the commonality be the account, DeviceName and DeviceId\n// At this point, we have machine-account pairs along with the list of commands run as well as the first/last time the commands were ran\n| order by AccountName asc                                          // Order the final list by AccountName just to make it easier to go through\n| where Timestamp > ago(1d)                                     // Included to restrict the scope for the custom detection page\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for any Service Accounts Performing Remote PowerShell."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "LateralMovement"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject307')._huntingQuerycontentId307),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 307",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject307')._huntingQuerycontentId307)]",
+                "contentId": "[variables('huntingQueryObject307')._huntingQuerycontentId307]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject307').huntingQueryVersion307]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject307')._huntingQuerycontentId307]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Service Accounts Performing Remote PS",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject307')._huntingQuerycontentId307,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject307')._huntingQuerycontentId307,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject308').huntingQueryTemplateSpecName308]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "AccountCreation_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject308').huntingQueryVersion308]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_308",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Account Creation",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n// Pro-tip: \n// There are many different ways to run a process from a file - e.g. by using full path, env. variables, ~1 annotation, more...\n// So, to find executions of a known filename, better filter on the filename (and possibly on folder path) than on the commandline.\n| where FileName in~ (\"net.exe\", \"net1.exe\") and TimeGenerated > ago(3d)\n// Parse the user name from the commandline.\n// To have case-insensitive parsing use the i flag, to have non-greedy match (e.g. CreatedUser as short as possible), specify U flag:\n// \"kind=regex flags=i\"\n| parse kind=regex flags=iU ProcessCommandLine with * \"user \" CreatedUser \" \" * \"/ad\"\n// Filter rows where user could not be parsed - e.g. because it was not a user command, or the /add commandline switch was not specified.\n| where isnotempty(CreatedUser)\n// Every net.exe executed will run net1.exe with the same commandline.\n// in this where clause we remove such rows, as they duplicate the number of results we have without adding any value.\n| where not (FileName =~ \"net1.exe\" and InitiatingProcessFileName =~ \"net.exe\" and replace(\"net\", \"net1\", InitiatingProcessCommandLine) =~ ProcessCommandLine)\n// If /domain is specified, so the user is created on the domain controller.\n// Also, any prefix that's longer than 1 char will also do the same, e.g. /do, /dom, /doma, ....\n| extend CreatedOnLocalMachine=(ProcessCommandLine !contains \"/do\")\n| where ProcessCommandLine !contains \"/add\" or (CreatedOnLocalMachine == 0 and ProcessCommandLine !contains \"/domain\")\n| summarize MachineCount=dcount(DeviceName) by CreatedUser, CreatedOnLocalMachine, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looks for the creation of user accounts on a machine using the \"net user\" command."
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject308')._huntingQuerycontentId308),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 308",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject308')._huntingQuerycontentId308)]",
+                "contentId": "[variables('huntingQueryObject308')._huntingQuerycontentId308]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject308').huntingQueryVersion308]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject308')._huntingQuerycontentId308]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Account Creation",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject308')._huntingQuerycontentId308,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject308')._huntingQuerycontentId308,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject309').huntingQueryTemplateSpecName309]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LocalAdminGroupChanges_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject309').huntingQueryVersion309]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_309",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Local Admin Group Changes",
+                "category": "Hunting Queries",
+                "query": "let ADAZUsers =  IdentityInfo \n| extend DirectoryDomain = AccountDomain \n| extend DirectoryAccount = AccountName \n| extend OnPremSid = AccountSID\n| distinct DirectoryDomain , DirectoryAccount , OnPremSid , AccountCloudSID, AccountUPN, GivenName, Surname;\n // check for any new created or modified local accounts \nlet NewUsers =  DeviceEvents\n| where ActionType contains \"UserAccountCreated\"  // or ActionType contains \"UserAccountModified\"\n| extend lUserAdded = AccountName\n| extend NewUserSID = AccountSid\n| extend laccountdomain = AccountDomain\n| distinct NewUserSID, lUserAdded,laccountdomain;\n// Check for any local group changes and enrich the data with the account name obtained from the previous query\nDeviceEvents \n| where ActionType == 'UserAccountAddedToLocalGroup' \n| extend AddedAccountSID = tostring(parse_json(AdditionalFields).MemberSid)\n| extend LocalGroup = AccountName\n| extend LocalGroupSID = AccountSid\n| extend Actor = trim(@\"[^\\w]+\",InitiatingProcessAccountName)\n// limit to local administrators group\n//  | where LocalGroupSID contains \"S-1-5-32-544\"\n| join kind= leftouter    (NewUsers)\non $left.AddedAccountSID == $right.NewUserSID\n| project TimeGenerated, DeviceName, LocalGroup,LocalGroupSID, AddedAccountSID, lUserAdded , Actor, ActionType , laccountdomain \n| join kind= leftouter        (ADAZUsers)\non $left.AddedAccountSID == $right.OnPremSid\n| extend UserAdded = iff(isnotempty(lUserAdded),strcat(laccountdomain,\"\\\\\", lUserAdded), strcat(DirectoryDomain,\"\\\\\", DirectoryAccount))\n| project TimeGenerated, DeviceName, LocalGroup,LocalGroupSID, AddedAccountSID, UserAdded , Actor, ActionType  \n| where DeviceName !contains Actor \n// Provide details on actors that added users\n// | summarize count()  by Actor \n// | join ADAZUsers\n// on $left.Actor == $right.DirectoryAccount \n// | render piechart \n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This hunting query searches for changes to the local administrators group."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject309')._huntingQuerycontentId309),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 309",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject309')._huntingQuerycontentId309)]",
+                "contentId": "[variables('huntingQueryObject309')._huntingQuerycontentId309]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject309').huntingQueryVersion309]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject309')._huntingQuerycontentId309]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Local Admin Group Changes",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject309')._huntingQuerycontentId309,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject309')._huntingQuerycontentId309,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject310').huntingQueryTemplateSpecName310]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "RareProcessAsService_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject310').huntingQueryVersion310]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_310",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Rare Process as a Service",
+                "category": "Hunting Queries",
+                "query": "let LookupTime = 30d;\nlet WhiteList = pack_array(\n\"svchost.exe\",\n\"mssense.exe\",\n\"msmpeng.exe\",\n\"searchindexer.exe\",\n\"microsoftedgeupdate.exe\"\n);\nlet GetServices = materialize (\nDeviceProcessEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, StartedChildProcess = FileName, StartedChildProcessSHA1 = SHA1, StartedChildProcessCmdline = ProcessCommandLine, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName\n);\nGetServices\n| summarize count() by ServiceProcess, DeviceName\n| where count_ < 6 \n| join kind = inner GetServices on ServiceProcess, DeviceName \n| join kind = leftouter ( \nDeviceNetworkEvents \n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, NetworkAction = ActionType, RemoteIP, RemoteUrl\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| join kind = leftouter (\nDeviceFileEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, FileAction = ActionType, ModifiedFile = FileName, ModifiedFileSHA1 = SHA1, ModifiedFilePath = FolderPath\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| join kind = leftouter (\nDeviceImageLoadEvents\n| where TimeGenerated > ago(LookupTime)\n| where InitiatingProcessParentFileName contains \"services.exe\"\n| where InitiatingProcessFileName !in~(WhiteList)\n| project TimeGenerated, DeviceName, ServiceProcessSHA1 = InitiatingProcessSHA1, ServiceProcess = InitiatingProcessFileName, ServiceProcessCmdline = InitiatingProcessCommandLine, ServiceProcessID = InitiatingProcessId, ServiceProcessCreationTime = InitiatingProcessCreationTime, ServiceProcessUser = InitiatingProcessAccountName, LoadedDLL = FileName, LoadedDLLSHA1 = SHA1, LoadedDLLPath = FolderPath\n) on DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n| summarize ConnectedAddresses = make_set(RemoteIP, 100000), ConnectedUrls = make_set(RemoteUrl, 100000), FilesModified = make_set(ModifiedFile, 100000),FileModFolderPath = make_set(ModifiedFilePath, 100000),FileModHA1s = make_set(ModifiedFileSHA1, 100000), ChildProcesses = make_set(StartedChildProcess, 100000), ChildCommandlines = make_set(StartedChildProcessCmdline, 100000), DLLsLoaded = make_set(LoadedDLL, 100000), DLLSHA1 = make_set(LoadedDLLSHA1, 100000) by DeviceName, ServiceProcess, ServiceProcessCmdline, ServiceProcessCreationTime, ServiceProcessID, ServiceProcessUser, ServiceProcessSHA1\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query looks for rarely seen processes which are launched as a service."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1543,T1543.003"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject310')._huntingQuerycontentId310),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 310",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject310')._huntingQuerycontentId310)]",
+                "contentId": "[variables('huntingQueryObject310')._huntingQuerycontentId310]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject310').huntingQueryVersion310]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject310')._huntingQuerycontentId310]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Rare Process as a Service",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject310')._huntingQuerycontentId310,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject310')._huntingQuerycontentId310,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject311').huntingQueryTemplateSpecName311]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ScheduledTaskCreation_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject311').huntingQueryVersion311]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_311",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Scheduled Task Creation",
+                "category": "Hunting Queries",
+                "query": "DeviceEvents \n| where ActionType == \"ScheduledTaskCreated\"\n  and InitiatingProcessAccountSid != \"S-1-5-18\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for any scheduled task creation event."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Persistence"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject311')._huntingQuerycontentId311),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 311",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject311')._huntingQuerycontentId311)]",
+                "contentId": "[variables('huntingQueryObject311')._huntingQuerycontentId311]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject311').huntingQueryVersion311]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject311')._huntingQuerycontentId311]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Scheduled Task Creation",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject311')._huntingQuerycontentId311,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject311')._huntingQuerycontentId311,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject312').huntingQueryTemplateSpecName312]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SAMNameChange_CVE-2021-42278_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject312').huntingQueryVersion312]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_312",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "SAM Name Change CVE-2021-42278",
+                "category": "Hunting Queries",
+                "query": "IdentityDirectoryEvents\n| where TimeGenerated > ago(1d)\n| where ActionType == \"SAM Account Name changed\"\n| extend FROMSAM = parse_json(AdditionalFields)['FROM SAM Account Name']\n| extend TOSAM = parse_json(AdditionalFields)['TO SAM Account Name']\n| where (FROMSAM has \"$\" and TOSAM !has \"$\") \n        or TOSAM in (\"DC1\", \"DC2\", \"DC3\", \"DC4\") // DC Names in the org\n| project TimeGenerated, Application, ActionType, TargetDeviceName, FROMSAM, TOSAM, ReportId, AdditionalFields\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "PrivilegeEscalation,Vulnerability"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject312')._huntingQuerycontentId312),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 312",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject312')._huntingQuerycontentId312)]",
+                "contentId": "[variables('huntingQueryObject312')._huntingQuerycontentId312]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject312').huntingQueryVersion312]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject312')._huntingQuerycontentId312]",
+        "contentKind": "HuntingQuery",
+        "displayName": "SAM Name Change CVE-2021-42278",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject312')._huntingQuerycontentId312,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject312')._huntingQuerycontentId312,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject313').huntingQueryTemplateSpecName313]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DataDeletionOnMulipleDrivesUsingCipherExe_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject313').huntingQueryVersion313]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_313",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Deletion of data on multiple drives using cipher exe",
+                "category": "Hunting Queries",
+                "query": "// Look for cipher.exe deleting data from multiple drives\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"cipher.exe\" \n// cipher.exe /w flag used for deleting data \n| where ProcessCommandLine has \"/w\" \n| summarize CipherCount = dcount(ProcessCommandLine),\nCipherList = make_set(ProcessCommandLine, 1000) by DeviceId, bin(TimeGenerated, 1m) \n// cipher.exe accessing multiple drives in a short timeframe  \n| where CipherCount > 1\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query checks for attempts to delete data on multiple drives using cipher.exe. This activity is typically done by ransomware to prevent recovery of data after encryption."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Impact"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject313')._huntingQuerycontentId313),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 313",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject313')._huntingQuerycontentId313)]",
+                "contentId": "[variables('huntingQueryObject313')._huntingQuerycontentId313]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject313').huntingQueryVersion313]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject313')._huntingQuerycontentId313]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Deletion of data on multiple drives using cipher exe",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject313')._huntingQuerycontentId313,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject313')._huntingQuerycontentId313,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject314').huntingQueryTemplateSpecName314]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DetectMultipleSignsOfRamsomwareActivity_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject314').huntingQueryVersion314]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_314",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Check for multiple signs of Ransomware Activity",
+                "category": "Hunting Queries",
+                "query": "// Find attempts to stop processes using taskkill.exe\nlet taskKill = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"taskkill.exe\" \n| summarize taskKillCount = dcount(tostring(ProcessCommandLine)), TaskKillList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 2m)\n| where taskKillCount > 10;\n// Find attempts to stop processes using net stop\nlet netStop = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"net.exe\" and ProcessCommandLine has \"stop\"\n| summarize netStopCount = dcount(tostring(ProcessCommandLine)), NetStopList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 2m)\n| where netStopCount > 10;\n// Look for cipher.exe deleting data from multiple drives\nlet cipher = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"cipher.exe\" \n// cipher.exe /w flag used for deleting data \n| where ProcessCommandLine has \"/w\" \n| summarize CipherCount = dcount(tostring(ProcessCommandLine)), \nCipherList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 1m) \n// cipher.exe accessing multiple drives in a short timeframe \n| where CipherCount > 1;\n// Look for use of wevtutil to clear multiple logs\nlet wevtutilClear = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where ProcessCommandLine has \"WEVTUTIL\" and ProcessCommandLine has \"CL\"\n| summarize LogClearCount = dcount(tostring(ProcessCommandLine)), ClearedLogList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 5m)\n| where LogClearCount > 10;\n// Look for sc.exe disabling services\nlet scDisable = DeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where ProcessCommandLine has \"sc\" and ProcessCommandLine has \"config\" and ProcessCommandLine has \"disabled\"\n| summarize ScDisableCount = dcount(tostring(ProcessCommandLine)), ScDisableList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 5m)\n| where ScDisableCount > 10;\n// Main query for counting and aggregating evidence\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"vssadmin.exe\" and ProcessCommandLine has_any(\"list shadows\", \"delete shadows\")\nor FileName =~ \"fsutil.exe\" and ProcessCommandLine has \"usn\" and ProcessCommandLine has \"deletejournal\"\nor ProcessCommandLine has(\"bcdedit\") and ProcessCommandLine has_any(\"recoveryenabled no\", \"bootstatuspolicy ignoreallfailures\")\nor ProcessCommandLine has \"wbadmin\" and ProcessCommandLine has \"delete\" and ProcessCommandLine has_any(\"backup\", \"catalog\", \"systemstatebackup\")\nor (ProcessCommandLine has \"wevtutil\" and ProcessCommandLine has \"cl\") \nor (ProcessCommandLine has \"wmic\" and ProcessCommandLine has \"shadowcopy delete\")\nor (ProcessCommandLine has \"sc\" and ProcessCommandLine has \"config\" and ProcessCommandLine has \"disabled\")\n| extend Bcdedit = iff(ProcessCommandLine has \"bcdedit\" and ProcessCommandLine has_any(\"recoveryenabled no\", \"bootstatuspolicy ignoreallfailures\"), 1, 0)\n| extend ShadowCopyDelete = iff (ProcessCommandLine has \"shadowcopy delete\", 1, 0)\n| extend VssAdminShadows = iff(ProcessCommandLine has \"vssadmin\" and ProcessCommandLine has_any(\"list shadows\", \"delete shadows\"), 1, 0)\n| extend Wbadmin = iff(ProcessCommandLine has \"wbadmin\" and ProcessCommandLine has \"delete\" and ProcessCommandLine has_any(\"backup\", \"catalog\", \"systemstatebackup\"), 1,0)\n| extend Fsutil = iff(ProcessCommandLine has \"fsutil\" and ProcessCommandLine has \"usn\" and ProcessCommandLine has \"deletejournal\", 1, 0)\n| summarize FirstActivity = min(TimeGenerated), ReportId = any(ReportId), Commands = make_set(ProcessCommandLine) by DeviceId, Fsutil, Wbadmin, ShadowCopyDelete, Bcdedit, VssAdminShadows, bin(TimeGenerated, 6h)\n// Joining extra evidence\n| join kind=leftouter (wevtutilClear) on $left.DeviceId == $right.DeviceId\n| join kind=leftouter (cipher) on $left.DeviceId == $right.DeviceId\n| join kind=leftouter (netStop) on $left.DeviceId == $right.DeviceId\n| join kind=leftouter (taskKill) on $left.DeviceId == $right.DeviceId\n| join kind=leftouter (scDisable) on $left.DeviceId == $right.DeviceId\n| extend WevtutilUse = iff(LogClearCount > 10, 1, 0)\n| extend CipherUse = iff(CipherCount > 1, 1, 0)\n| extend NetStopUse = iff(netStopCount > 10, 1, 0)\n| extend TaskkillUse = iff(taskKillCount > 10, 1, 0)\n| extend ScDisableUse = iff(ScDisableCount > 10, 1, 0)\n// Adding up all evidence\n| mv-expand CommandList = NetStopList, TaskKillList, ClearedLogList, CipherList, Commands, ScDisableList\n// Format results\n| summarize BcdEdit = iff(make_set(Bcdedit) contains \"1\" , 1, 0), NetStop10PlusCommands = iff(make_set(NetStopUse) contains \"1\", 1, 0), Wevtutil10PlusLogsCleared = iff(make_set(WevtutilUse) contains \"1\", 1, 0),\nCipherMultipleDrives = iff(make_set(CipherUse) contains \"1\", 1, 0), Fsutil = iff(make_set(Fsutil) contains \"1\", 1, 0), ShadowCopyDelete = iff(make_set(ShadowCopyDelete) contains \"1\", 1, 0),\nWbadmin = iff(make_set(Wbadmin) contains \"1\", 1, 0), TaskKill10PlusCommand = iff(make_set(TaskkillUse) contains \"1\", 1, 0), VssAdminShadow = iff(make_set(VssAdminShadows) contains \"1\", 1, 0), \nScDisable = iff(make_set(ScDisableUse) contains \"1\", 1, 0), TotalEvidenceCount = dcount(tostring(CommandList)), EvidenceList = make_set(Commands), StartofBehavior = min(FirstActivity) by DeviceId, bin(TimeGenerated, 1d)\n| extend UniqueEvidenceCount = BcdEdit + NetStop10PlusCommands + Wevtutil10PlusLogsCleared + CipherMultipleDrives + Wbadmin + Fsutil + TaskKill10PlusCommand + VssAdminShadow + ScDisable + ShadowCopyDelete\n| where UniqueEvidenceCount > 2\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query checks for multiple signs of ransomware activity to identify affected devices."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,Impact,Exfiltration"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject314')._huntingQuerycontentId314),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 314",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject314')._huntingQuerycontentId314)]",
+                "contentId": "[variables('huntingQueryObject314')._huntingQuerycontentId314]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject314').huntingQueryVersion314]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject314')._huntingQuerycontentId314]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Check for multiple signs of Ransomware Activity",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject314')._huntingQuerycontentId314,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject314')._huntingQuerycontentId314,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject315').huntingQueryTemplateSpecName315]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DisableSecurityServiceViaRegistry_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject315').huntingQueryVersion315]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_315",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Disabling Services via Registry",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents\n| where InitiatingProcessCommandLine has_all(@'\"reg\"', 'add', @'\"HKLM\\SOFTWARE\\Policies\\', '/v','/t', 'REG_DWORD', '/d', '/f')\n  and InitiatingProcessCommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', \n  'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource')\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Search for processes modifying the registry to disable security features."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject315')._huntingQuerycontentId315),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 315",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject315')._huntingQuerycontentId315)]",
+                "contentId": "[variables('huntingQueryObject315')._huntingQuerycontentId315]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject315').huntingQueryVersion315]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject315')._huntingQuerycontentId315]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Disabling Services via Registry",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject315')._huntingQuerycontentId315,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject315')._huntingQuerycontentId315,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject316').huntingQueryTemplateSpecName316]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "DomainDiscoveryWMICwithDLLHostExe_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject316').huntingQueryVersion316]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_316",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "DLLHost.exe WMIC domain discovery",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName =~ \"dllhost.exe\" and InitiatingProcessCommandLine == \"dllhost.exe\" \n| where ProcessCommandLine has \"wmic computersystem get domain\"\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query checks for dllhost.exe calling WMIC to discover additional hosts and associated domain."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Reconnaissance"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject316')._huntingQuerycontentId316),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 316",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject316')._huntingQuerycontentId316)]",
+                "contentId": "[variables('huntingQueryObject316')._huntingQuerycontentId316]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject316').huntingQueryVersion316]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject316')._huntingQuerycontentId316]",
+        "contentKind": "HuntingQuery",
+        "displayName": "DLLHost.exe WMIC domain discovery",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject316')._huntingQuerycontentId316,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject316')._huntingQuerycontentId316,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject317').huntingQueryTemplateSpecName317]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MDEExclusionUsingPowerShell_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject317').huntingQueryVersion317]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_317",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "PowerShell adding exclusion path for Microsoft Defender of ProgramData",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where FileName =~ \"powershell.exe\" and ProcessCommandLine has_all(\"try\", \"Add-MpPreference\", \"-ExclusionPath\", \"ProgramData\", \"catch\")\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject317')._huntingQuerycontentId317),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 317",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject317')._huntingQuerycontentId317)]",
+                "contentId": "[variables('huntingQueryObject317')._huntingQuerycontentId317]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject317').huntingQueryVersion317]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject317')._huntingQuerycontentId317]",
+        "contentKind": "HuntingQuery",
+        "displayName": "PowerShell adding exclusion path for Microsoft Defender of ProgramData",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject317')._huntingQuerycontentId317,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject317')._huntingQuerycontentId317,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject318').huntingQueryTemplateSpecName318]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "IcedIdSuspiciousImageLoad_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject318').huntingQueryVersion318]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_318",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Suspicious Image Load related to IcedId",
+                "category": "Hunting Queries",
+                "query": "DeviceImageLoadEvents \n| where InitiatingProcessFileName in~ ('rundll32.exe','regsvr32.exe') \n| where FileName endswith '.txt' or FileName endswith '.pdf'\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to IcedId ransomware."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject318')._huntingQuerycontentId318),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 318",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject318')._huntingQuerycontentId318)]",
+                "contentId": "[variables('huntingQueryObject318')._huntingQuerycontentId318]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject318').huntingQueryVersion318]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject318')._huntingQuerycontentId318]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Suspicious Image Load related to IcedId",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject318')._huntingQuerycontentId318,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject318')._huntingQuerycontentId318,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject319').huntingQueryTemplateSpecName319]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LaZagneCredTheft_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject319').huntingQueryVersion319]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_319",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "LaZagne Credential Theft",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where FileName =~ 'reg.exe'\n| where ProcessCommandLine has_all('save','hklm','sam')\n| project DeviceId, TimeGenerated, InitiatingProcessId, InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query can be used to locate processes executing credential theft activity, often LaZagne in ransomware compromises."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "CredentialAccess"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject319')._huntingQuerycontentId319),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 319",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject319')._huntingQuerycontentId319)]",
+                "contentId": "[variables('huntingQueryObject319')._huntingQuerycontentId319]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject319').huntingQueryVersion319]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject319')._huntingQuerycontentId319]",
+        "contentKind": "HuntingQuery",
+        "displayName": "LaZagne Credential Theft",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject319')._huntingQuerycontentId319,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject319')._huntingQuerycontentId319,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject320').huntingQueryTemplateSpecName320]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "LogDeletionUsingWevtutil_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject320').huntingQueryVersion320]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_320",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Clearing of forensic evidence from event logs using wevtutil",
+                "category": "Hunting Queries",
+                "query": "// Look for use of wevtutil to clear multiple logs\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where ProcessCommandLine has \"WEVTUTIL\" and ProcessCommandLine has \"CL\"\n| summarize LogClearCount = dcount(tostring(ProcessCommandLine)), ClearedLogList = make_set(ProcessCommandLine, 100000) by DeviceId, bin(TimeGenerated, 5m)\n| where LogClearCount > 10\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query checks for attempts to clear at least 10 log entries from event logs using wevtutil."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject320')._huntingQuerycontentId320),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 320",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject320')._huntingQuerycontentId320)]",
+                "contentId": "[variables('huntingQueryObject320')._huntingQuerycontentId320]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject320').huntingQueryVersion320]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject320')._huntingQuerycontentId320]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Clearing of forensic evidence from event logs using wevtutil",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject320')._huntingQuerycontentId320,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject320')._huntingQuerycontentId320,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject321').huntingQueryTemplateSpecName321]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MultiProcessKillWithTaskKill_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject321').huntingQueryVersion321]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_321",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Stopping multiple processes using taskkill",
+                "category": "Hunting Queries",
+                "query": "// Find attempts to stop processes using taskkill.exe\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where FileName =~ \"taskkill.exe\" \n| summarize taskKillCount = dcount(ProcessCommandLine), TaskKillList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 2m)\n| where taskKillCount > 10\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject321')._huntingQuerycontentId321),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 321",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject321')._huntingQuerycontentId321)]",
+                "contentId": "[variables('huntingQueryObject321')._huntingQuerycontentId321]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject321').huntingQueryVersion321]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject321')._huntingQuerycontentId321]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Stopping multiple processes using taskkill",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject321')._huntingQuerycontentId321,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject321')._huntingQuerycontentId321,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject322').huntingQueryTemplateSpecName322]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "PotentialCobaltStrikeRansomwareActivity_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject322').huntingQueryVersion322]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_322",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Potential Ransomware activity related to Cobalt Strike",
+                "category": "Hunting Queries",
+                "query": "// Look for sc.exe disabling services\nAlertInfo \n// Attempts to clear security event logs. \n| where Title in(\"Event log was cleared\", \n// List alerts flagging attempts to delete backup files. \n\"File backups were deleted\", \n// Potential Cobalt Strike activity - Note that other threat activity can also \n// trigger alerts for suspicious decoded content \n\"Suspicious decoded content\", \n// Cobalt Strike activity \n\"\\'Atosev\\' malware was detected\", \n\"\\'Ploty\\' malware was detected\", \n\"\\'Bynoco\\' malware was detected\",\n\"\\'Cobaltstrike\\' malware was detected\",\n\"Echo command over pipe on localhost\",\n\"Known attack framework activity was observed\",\n\"An active \\'Cobaltstrike\\' malware was detected\",\n\"Suspicious \\'CobaltStrike\\' behavior was prevented\",\n\"Suspicious process launch by Rundll32.exe\") \n| extend AlertTime = TimeGenerated | distinct AlertTime, AlertId, Title \n| join AlertEvidence on $left.AlertId == $right.AlertId\n| summarize by DeviceId, AlertTime, Title, AlertId\n// Get device IDs\n| join DeviceLogonEvents on $left.DeviceId == $right.DeviceId \n// Creating 10 day Window surrounding alert activity \n| where TimeGenerated < AlertTime +5d and TimeGenerated > AlertTime - 5d // Projecting specific columns \n| project Title, DeviceName, DeviceId, TimeGenerated, LogonType, AccountDomain, AccountName, AccountSid, AlertTime, AlertId, RemoteIP, RemoteDeviceName\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for alerts related to suspected ransomware and Cobalt Strike activity, a tool used in numerous ransomware campaigns."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution,Persistence"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject322')._huntingQuerycontentId322),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 322",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject322')._huntingQuerycontentId322)]",
+                "contentId": "[variables('huntingQueryObject322')._huntingQuerycontentId322]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject322').huntingQueryVersion322]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject322')._huntingQuerycontentId322]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Potential Ransomware activity related to Cobalt Strike",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject322')._huntingQuerycontentId322,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject322')._huntingQuerycontentId322,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject323').huntingQueryTemplateSpecName323]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "QakbotDiscoveryActivities_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject323').huntingQueryVersion323]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_323",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Qakbot Discovery Activies",
+                "category": "Hunting Queries",
+                "query": "DeviceProcessEvents \n| where InitiatingProcessFileName in~('mobsync.exe','explorer.exe')\n| where (FileName =~ 'net.exe' and InitiatingProcessCommandLine has_all('view','/all'))\n     or (FileName =~ 'whoami.exe' and InitiatingProcessCommandLine has '/all')\n     or (FileName =~ 'nslookup.exe' and InitiatingProcessCommandLine has_all('querytype=ALL','timeout=10'))\n     or (FileName =~ 'netstat.exe' and InitiatingProcessCommandLine has '-nao')\n     or (FileName =~ 'arp.exe' and InitiatingProcessCommandLine has '-a')\n     or (FileName =~ 'ping.exe' and InitiatingProcessCommandLine has '-t' and InitiatingProcessCommandLine endswith '127.0.0.1')\n| summarize DiscoveryCommands = dcount(InitiatingProcessCommandLine), make_set(InitiatingProcessFileName), make_set(FileName), make_set(InitiatingProcessCommandLine) by DeviceId, bin(TimeGenerated, 5m)   \n| where DiscoveryCommands >= 3\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query searches for injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion,Discovery,Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject323')._huntingQuerycontentId323),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 323",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject323')._huntingQuerycontentId323)]",
+                "contentId": "[variables('huntingQueryObject323')._huntingQuerycontentId323]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject323').huntingQueryVersion323]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject323')._huntingQuerycontentId323]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Qakbot Discovery Activies",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject323')._huntingQuerycontentId323,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject323')._huntingQuerycontentId323,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject324').huntingQueryTemplateSpecName324]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "ShadowCopyDeletion_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject324').huntingQueryVersion324]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_324",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Shadow Copy Deletions",
+                "category": "Hunting Queries",
+                "query": "let CommonRansomwareExecutionCommands = dynamic([@'vssadmin.exe delete shadows /all /quiet', \n@'wmic.exe shadowcopy delete', @'wbadmin delete catalog -quiet', \n@'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}',\n@'del /s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk', \n@'wbadmin delete systemstatebackup -keepVersions:0', \n@'schtasks.exe /Change /TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" /disable', \n@'schtasks.exe /Change /TN \"\\Microsoft\\Windows\\SystemRestore\\SR\" /enable >nul 2>&1', \n@'reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /t \"REG_DWORD\" /d \"1\" /f', \n@'reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableConfig\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\" /v \"DisableSR\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableConfig\" /f >nul 2>&1', \n@'reg delete \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\" /v \"DisableSR\" /f >nul 2>&1']);\nDeviceProcessEvents\n| where ProcessCommandLine has_any (CommonRansomwareExecutionCommands)\n| project-reorder TimeGenerated, ProcessCommandLine, DeviceName, AccountName\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by threat actors."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Impact"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1490"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject324')._huntingQuerycontentId324),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 324",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject324')._huntingQuerycontentId324)]",
+                "contentId": "[variables('huntingQueryObject324')._huntingQuerycontentId324]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject324').huntingQueryVersion324]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject324')._huntingQuerycontentId324]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Shadow Copy Deletions",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject324')._huntingQuerycontentId324,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject324')._huntingQuerycontentId324,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject325').huntingQueryTemplateSpecName325]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "TurningOffServicesWithSCCommad_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject325').huntingQueryVersion325]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_325",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Turning off services using sc exe",
+                "category": "Hunting Queries",
+                "query": "// Look for sc.exe disabling services\nDeviceProcessEvents\n| where TimeGenerated > ago(1d)\n| where ProcessCommandLine has \"sc\" and ProcessCommandLine has \"config\" and ProcessCommandLine has \"disabled\"\n| summarize ScDisableCount = dcount(ProcessCommandLine), ScDisableList = make_set(ProcessCommandLine) by DeviceId, bin(TimeGenerated, 5m)\n| where ScDisableCount > 10\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query checks for attempts to turn off at least 10 existing services using sc.exe."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "DefenseEvasion"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject325')._huntingQuerycontentId325),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 325",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject325')._huntingQuerycontentId325)]",
+                "contentId": "[variables('huntingQueryObject325')._huntingQuerycontentId325]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject325').huntingQueryVersion325]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject325')._huntingQuerycontentId325]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Turning off services using sc exe",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject325')._huntingQuerycontentId325,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject325')._huntingQuerycontentId325,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject326').huntingQueryTemplateSpecName326]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Detect_CISA_Alert_AA22-117A2021_Top_Routinely_Exploited_Vulnerabilities_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject326').huntingQueryVersion326]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_326",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities",
+                "category": "Hunting Queries",
+                "query": "// CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a\nlet CISAAlertAA22117A= dynamic(\n[\n\"CVE-2021-44228\", // Log4Shell - Apache Log4j - Remote code execution (RCE)\n\"CVE-2021-40539\", // Zoho ManageEngine AD SelfService Plus - RCE\n\"CVE-2021-34523\", // ProxyShell - Microsoft Exchange Server - Elevation of privilege\n\"CVE-2021-34473\", // ProxyShell - Microsoft Exchange Server - RCE\n\"CVE-2021-31207\", // ProxyShell - Microsoft Exchange Server - Security feature bypass\n\"CVE-2021-27065\", // ProxyLogon - Microsoft Exchange Server - RCE\n\"CVE-2021-26858\", // ProxyLogon - Microsoft Exchange Server - RCE\n\"CVE-2021-26857\", // ProxyLogon - Microsoft Exchange Server - RCE\n\"CVE-2021-26855\", // ProxyLogon - Microsoft Exchange Server - RCE\n\"CVE-2021-26084\", // Atlassian Confluence Server and Data Center - Arbitrary code execution\n\"CVE-2021-21972\", // VMware vSphere Client - RCE \n\"CVE-2020-1472\", // ZeroLogon - Microsoft Netlogon Remote Protocol (MS-NRPC) - Elevation of privilege\n\"CVE-2020-0688\", // Microsoft Exchange Server - RCE\n\"CVE-2019-11510\", // Pulse Secure Pulse Connect Secure - Arbitrary file reading\n\"CVE-2018-13379\", // Fortinet FortiOS and FortiProxy - Path traversal\n\"CVE-2021-42237\", // Sitecore XP - RCE\n\"CVE-2021-35464\", // ForgeRock OpenAM server - RCE\n\"CVE-2021-27104\", // Accellion FTA - OS command execution\n\"CVE-2021-27103\", // Accellion FTA - Server-side request forgery\n\"CVE-2021-27102\", // Accellion FTA - OS command execution\n\"CVE-2021-27101\", // Accellion FTA - SQL injection\n\"CVE-2021-21985\", // SQL injection - RCE\n\"CVE-2021-20038\", // SonicWall Secure Mobile Access (SMA) - RCE\n\"CVE-2021-40444\", // Microsoft MSHTML - RCE\n\"CVE-2021-34527\", // Microsoft Windows Print Spooler - RCE\n\"CVE-2021-3156\", // Suco - Microsoft Windows Print Spooler\n\"CVE-2021-27852\", // Checkbox Survey - Remote arbitrary code execution\n\"CVE-2021-22893\", // Pulse Secure Pulse Connect Secure - Remote arbitrary code execution\n\"CVE-2021-20016\", // SonicWall SSLVPN SMA100 - Improper SQL command neutralization, allowing for credential access\n\"CVE-2021-1675\", // Windows Print Spooler - RCE\n\"CVE-2020-2509\", // QNAP QTS and QuTS hero - Remote arbitrary code execution\n\"CVE-2019-19781\", // Citrix Application Delivery Controller (ADC) and Gateway - Arbitrary code execution\n\"CVE-2019-18935\", // Progress Telerik UI for ASP.NET AJAX - Code execution\n\"CVE-2018-0171\", // Cisco IOS Software and IOS XE Software - Remote arbitrary code execution\n\"CVE-2017-11882\", // Microsoft Office - RCE\n\"CVE-2017-0199\" // Microsoft Office - RCE\n ]\n);\nDeviceTvmSoftwareVulnerabilitiesKB\n| where CveId in(CISAAlertAA22117A)\n| join DeviceTvmSoftwareVulnerabilities on CveId\n| project-away CveId1, VulnerabilitySeverityLevel1, AffectedSoftware\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Execution"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject326')._huntingQuerycontentId326),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 326",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject326')._huntingQuerycontentId326)]",
+                "contentId": "[variables('huntingQueryObject326')._huntingQuerycontentId326]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject326').huntingQueryVersion326]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject326')._huntingQuerycontentId326]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Detect CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject326')._huntingQuerycontentId326,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject326')._huntingQuerycontentId326,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject327').huntingQueryTemplateSpecName327]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Punycode chars lookalike domains_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject327').huntingQueryVersion327]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_327",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Punycode lookalikes",
+                "category": "Hunting Queries",
+                "query": "let AsciiLookalikeChars = @\"([\\u0430\\u0435\\u043E\\u0440\\u0441\\u0445\\u0456\\u0443\\u043C\\u043D\\u0455\\u0442\\u04BB\\u0501\\u03B1\\u03B5\\u03BF\\u03C1\\u03C7\\u03BA\\u03BD\\u03F2\\uFF41-\\uFF5A\\uFF21-\\uFF3A])\";\n// Function \nlet NormalizeLookalikes = (s:string) {\n  replace(@\"\\u0501\",\"d\",\n  replace(@\"\\u04BB\",\"h\",\n  replace(@\"\\u0442\",\"t\",\n  replace(@\"\\u0455\",\"s\",\n  replace(@\"\\u043D\",\"n\",\n  replace(@\"\\u043C\",\"m\",\n  replace(@\"\\u0443\",\"y\",\n  replace(@\"\\u0456\",\"i\",\n  replace(@\"\\u03C7\",\"x\",\n  replace(@\"\\u0445\",\"x\",\n  replace(@\"\\u03F2\",\"c\",\n  replace(@\"\\u0441\",\"c\",\n  replace(@\"\\u03C1\",\"p\",\n  replace(@\"\\u0440\",\"p\",\n  replace(@\"\\u03BF\",\"o\",\n  replace(@\"\\u043E\",\"o\",\n  replace(@\"\\u03B5\",\"e\",\n  replace(@\"\\u0435\",\"e\",\n  replace(@\"\\u03B1\",\"a\",\n  replace(@\"\\u0430\",\"a\",s)\n)))))))))))))))))))};\n// End Function\n// Function\nlet SuspiciousPunycodeDomains = (T:(TimeGenerated:datetime, Url:string, UrlDomain:string, ReportId:string, NetworkMessageId:string, TeamsMessageId:string, Source:string)) {\n  T\n  | where UrlDomain has \"xn--\"\n  | extend DomainUnicode = punycode_domain_from_string(UrlDomain)\n  | extend Lookalikes = extract_all(AsciiLookalikeChars, DomainUnicode)\n  | where array_length(Lookalikes) > 0\n  | extend Normalized = NormalizeLookalikes(DomainUnicode)\n  | where Normalized matches regex @\"^[A-Za-z0-9\\.\\-]+$\"\n  | project TimeGenerated, Url, UrlDomain, DomainUnicode, Lookalikes, Normalized, ReportId, NetworkMessageId, TeamsMessageId, Source;\n};\n// End Function\nlet EmailFindings =\n  EmailUrlInfo\n  | project TimeGenerated, Url, UrlDomain, ReportId, NetworkMessageId, TeamsMessageId = \"\", Source = \"Email\"\n  | invoke SuspiciousPunycodeDomains()\n  | join kind=innerunique (\n    EmailEvents\n    | project NetworkMessageId, EmailTimeGenerated = TimeGenerated, ReportId, RecipientEmailAddress, SenderFromAddress, SenderMailFromAddress, SenderDisplayName, Subject, DeliveryAction, DeliveryLocation, ThreatTypes\n  ) on NetworkMessageId\n  | project\n      Timestamp = TimeGenerated,\n      Source,\n      TimeGenerated,\n      ReportId,\n      NetworkMessageId,\n      TeamsMessageId,\n      Url,\n      UrlDomain,\n      DomainUnicode,\n      Lookalikes,\n      Normalized,\n      Subject,\n      ThreatTypes,\n      DeliveryAction,\n      DeliveryLocation,\n      SenderDisplayName,\n      SenderFromAddress,\n      SenderMailFromAddress,\n      RecipientEmailAddress;\nlet TeamsFindings =\n  MessageUrlInfo\n  | project TimeGenerated, Url, UrlDomain, ReportId, NetworkMessageId = \"\", TeamsMessageId, Source = \"Teams\"\n  | invoke SuspiciousPunycodeDomains()\n  | join kind=innerunique (\n    MessageEvents\n    | extend ThreadName = column_ifexists(\"ThreadName\", \"\"), ThreadType = column_ifexists(\"ThreadType\", \"\"), MessageType = column_ifexists(\"MessageType\", \"\"), MessageSubtype = column_ifexists(\"MessageSubtype\", \"\"), Subject = column_ifexists(\"Subject\", \"\")\n    | project TeamsMessageId, MessageTimeGenerated = TimeGenerated, Timestamp, SenderEmailAddress, SenderDisplayName, SenderObjectId, SenderType, RecipientDetails, GroupId, GroupName, ThreadId, ThreadName, ThreadType, IsExternalThread, MessageType, MessageSubtype, Subject, ThreatTypes, DeliveryAction, DeliveryLocation, ReportId\n  ) on TeamsMessageId\n  | project\n      Timestamp = TimeGenerated,\n      Source,\n      TimeGenerated,\n      ReportId,\n      NetworkMessageId,\n      TeamsMessageId,\n      Url,\n      UrlDomain,\n      DomainUnicode,\n      Lookalikes,\n      Normalized,\n      Subject,\n      ThreatTypes,\n      DeliveryAction,\n      DeliveryLocation,\n      SenderDisplayName,\n      SenderEmailAddress,\n      SenderObjectId,\n      SenderType,\n      RecipientDetails,\n      GroupId,\n      GroupName,\n      ThreadId,\n      ThreadName,\n      ThreadType,\n      IsExternalThread,\n      MessageType,\n      MessageSubtype\n      //| where IsExternalThread == true // Use filter if only external threats are in scope\n      ;\nunion isfuzzy=true EmailFindings, TeamsFindings\n| order by TimeGenerated desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Punycode lookalike domains in Emails and Teams messages"
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject327')._huntingQuerycontentId327),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 327",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject327')._huntingQuerycontentId327)]",
+                "contentId": "[variables('huntingQueryObject327')._huntingQuerycontentId327]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject327').huntingQueryVersion327]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject327')._huntingQuerycontentId327]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Punycode lookalikes",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject327')._huntingQuerycontentId327,'-', '1.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject327')._huntingQuerycontentId327,'-', '1.0.1')))]",
+        "version": "1.0.1"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject328').huntingQueryTemplateSpecName328]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for RMM tool execution following Teams messages_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject328').huntingQueryVersion328]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_328",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for RMM tool execution following Teams messages",
+                "category": "Hunting Queries",
+                "query": "let _timeFrame = 30m;\n// Teams message signal\nlet _teams =\n    MessageEvents\n    | where Timestamp > ago(14d)\n    //| where SenderDisplayName contains \"add keyword\"\n    //          or SenderDisplayName contains \"add keyword\"\n    | extend Recipient = parse_json(RecipientDetails)\n    | mv-expand Recipient\n    | extend VictimAccountObjectId = tostring(Recipient.RecipientObjectId),\n             VictimRecipientDisplayName = tostring(Recipient.RecipientDisplayName)\n    | project\n        TTime = Timestamp,\n        SenderEmailAddress,\n        SenderDisplayName,\n        VictimRecipientDisplayName,\n        VictimAccountObjectId;\n// RMM launches on endpoint side\nlet _rmm =\n    DeviceProcessEvents\n    | where Timestamp > ago(14d)\n    | where FileName in~ (\"QuickAssist.exe\", \"AnyDesk.exe\", \"TeamViewer.exe\")\n    | extend VictimAccountObjectId = tostring(InitiatingProcessAccountObjectId)\n    | project\n        DeviceName,\n        QTime = Timestamp,\n        RmmTool = FileName,\n        VictimAccountObjectId;\n_teams\n| where isnotempty(VictimAccountObjectId)\n| join kind=inner _rmm on VictimAccountObjectId\n| where isnotempty(DeviceName)\n| where QTime between ((TTime) .. (TTime + (_timeFrame)))\n| project DeviceName, SenderEmailAddress, SenderDisplayName, VictimRecipientDisplayName, VictimAccountObjectId, TTime, QTime, RmmTool\n| order by QTime desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Correlates inbound Microsoft Teams messages with subsequent execution of common Remote Monitoring and Management (RMM) tools (QuickAssist, AnyDesk, TeamViewer) \non the recipient's device within a short time window. This pattern is associated with social engineering / tech-support-scam intrusions (e.g., Storm-1811 / Black \nBasta) where attackers lure victims via Teams chat and then convince them to launch an RMM tool to gain remote access."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,Execution"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1219"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject328')._huntingQuerycontentId328),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 328",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject328')._huntingQuerycontentId328)]",
+                "contentId": "[variables('huntingQueryObject328')._huntingQuerycontentId328]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject328').huntingQueryVersion328]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject328')._huntingQuerycontentId328]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for RMM tool execution following Teams messages",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject328')._huntingQuerycontentId328,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject328')._huntingQuerycontentId328,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject329').huntingQueryTemplateSpecName329]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Hunt for alerts correlated with Teams messages_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject329').huntingQueryVersion329]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_329",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Hunt for alerts correlated with Teams messages",
+                "category": "Hunting Queries",
+                "query": "let _timeFrame = 30m;      // Tune: how long after the Teams event to look for matching alerts\nlet _huntingWindow = 4d;   // Tune: broader lookback increases coverage but also cost\n// Seed Teams message activity and normalize the victim/join fields you want to carry forward\nlet _teams = materialize (\n    MessageEvents\n    | where Timestamp > ago(_huntingWindow)\n    | extend Recipient = parse_json(RecipientDetails)\n    // Optional tuning: add sender/name/content filters here first to reduce volume early\n    //| where SenderDisplayName contains \"add keyword\"\n    //          or SenderDisplayName contains \"add keyword\"\n    // add other hunting terms\n    | mv-expand Recipient\n    | extend VictimAccountObjectId = tostring(Recipient.RecipientObjectId),\n             VictimUPN = tostring(Recipient.RecipientSmtpAddress)\n    | project\n        TTime = Timestamp,\n        SenderUPN = SenderEmailAddress,\n        SenderDisplayName,\n        VictimUPN,\n        VictimAccountObjectId,\n        ChatThreadId = ThreadId\n);\n// Distinct key sets used to prefilter downstream tables before joining\nlet _VictimAccountObjectId = materialize(\n    _teams\n    | where isnotempty(VictimAccountObjectId)\n    | distinct VictimAccountObjectId\n);\nlet _VictimUPN = materialize(\n    _teams\n    | where isnotempty(VictimUPN)\n    | distinct VictimUPN\n);\nlet _ChatThreadId = materialize(\n    _teams\n    | where isnotempty(ChatThreadId)\n    | distinct ChatThreadId\n);\n// Find first-seen chat creation events for the chat threads already present in _teams\n// Tune: add more CloudAppEvents filters here if you want to narrow to external / one-on-one / specific chat types\nlet _firstContact = materialize(\n    CloudAppEvents\n    | where Timestamp > ago(_huntingWindow)\n    | where Application has \"Teams\"\n    | where ActionType == \"ChatCreated\"\n    | extend Raw = todynamic(RawEventData)\n    | extend ChatThreadId = tostring(Raw.ChatThreadId)\n    | where isnotempty(ChatThreadId)\n    | join kind=innerunique (_ChatThreadId) on ChatThreadId\n    | summarize FCTime = min(Timestamp) by ChatThreadId\n);\n// Alert branch 1: match by victim object ID\n// Usually the cleanest identity join if the field is populated consistently\nlet _alerts_by_oid = materialize(\n    AlertEvidence\n    | where Timestamp > ago(_huntingWindow)\n    | where AccountObjectId in (_VictimAccountObjectId)\n    | project\n        ATime = Timestamp,\n        AlertId,\n        Title,\n        AccountName,\n        AccountObjectId,\n        AccountUpn = \"\",\n        SourceId = \"\",\n        ChatThreadId = \"\"\n);\n// Alert branch 2: match by victim UPN\n// Useful when ObjectId is missing or alert evidence is only populated with UPN\nlet _alerts_by_upn = materialize(\n    AlertEvidence\n    | where Timestamp > ago(_huntingWindow)\n    | where AccountUpn in (_VictimUPN)\n    | project\n        ATime = Timestamp,\n        AlertId,\n        Title,\n        AccountName,\n        AccountObjectId,\n        AccountUpn,\n        SourceId = \"\",\n        ChatThreadId = \"\"\n);\n// Alert branch 3: match by chat thread ID\n// Tune: this is typically the most expensive branch because it inspects AdditionalFields\nlet _alerts_by_thread = materialize(\n    AlertEvidence\n    | where Timestamp > ago(_huntingWindow)\n    | where AdditionalFields has_any (_ChatThreadId)\n    | extend AdditionalFields = todynamic(AdditionalFields)\n    | extend\n        SourceId = tostring(AdditionalFields.SourceId),\n        ChatThreadIdRaw = tostring(AdditionalFields.ChatThreadId)\n    | extend ChatThreadId = coalesce(\n        ChatThreadIdRaw,\n        extract(@\"/(?:chats|channels|conversations|spaces)/([^/]+)/\", 1, SourceId)\n    )\n    | where isnotempty(ChatThreadId)\n    | join kind=innerunique (_ChatThreadId) on ChatThreadId\n    | project\n        ATime = Timestamp,\n        AlertId,\n        Title,\n        AccountName,\n        AccountObjectId,\n        AccountUpn = \"\",\n        SourceId,\n        ChatThreadId\n);\n//\n// add branch 4 to corrilate with host events\n//\n// Add first-contact context back onto the Teams seed set\nlet _teams_fc = materialize(\n    _teams\n    | join kind=leftouter _firstContact on ChatThreadId\n    | extend FirstContact = isnotnull(FCTime)\n);\n// Join path 1: Teams victim object ID -> alert AccountObjectId\nlet _matches_oid =\n    _teams_fc\n    | where isnotempty(VictimAccountObjectId)\n    | join hint.strategy=broadcast kind=leftouter (\n        _alerts_by_oid\n    ) on $left.VictimAccountObjectId == $right.AccountObjectId\n    // Time bound keeps only alerts near the Teams activity; widen/narrow _timeFrame to tune sensitivity\n    | where isnull(ATime) or ATime between (TTime .. TTime + _timeFrame)\n    | extend MatchType = \"ObjectId\";\n// Join path 2: Teams victim UPN -> alert AccountUpn\nlet _matches_upn =\n    _teams_fc\n    | where isnotempty(VictimUPN)\n    | join hint.strategy=broadcast kind=leftouter (\n        _alerts_by_upn\n    ) on $left.VictimUPN == $right.AccountUpn\n    | where isnull(ATime) or ATime between (TTime .. TTime + _timeFrame)\n    | extend MatchType = \"VictimUPN\";\n// Join path 3: Teams chat thread -> alert chat thread\nlet _matches_thread =\n    _teams_fc\n    | where isnotempty(ChatThreadId)\n    | join hint.strategy=broadcast kind=leftouter (\n        _alerts_by_thread\n    ) on ChatThreadId\n    | where isnull(ATime) or ATime between (TTime .. TTime + _timeFrame)\n    | extend MatchType = \"ChatThreadId\";\n//\n// add branch 4 for host events\n//\n// Merge all match paths and collapse multiple alert hits per Teams event into one row\nunion _matches_oid, _matches_upn, _matches_thread\n| summarize\n    AlertTitles = make_set(Title, 50),\n    AlertIds = make_set(AlertId, 50),\n    MatchTypes = make_set(MatchType, 10),\n    FirstAlertTime = min(ATime)\n    by\n        TTime,\n        SenderUPN,\n        SenderDisplayName,\n        VictimUPN,\n        VictimAccountObjectId,\n        ChatThreadId\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Correlates Microsoft Teams message activity with downstream Defender alerts on the\nrecipient (victim) identity, surfacing potential phishing or social-engineering chats\nthat are followed by alert activity within a tunable time window."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,Discovery"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1078"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject329')._huntingQuerycontentId329),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 329",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject329')._huntingQuerycontentId329)]",
+                "contentId": "[variables('huntingQueryObject329')._huntingQuerycontentId329]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject329').huntingQueryVersion329]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject329')._huntingQuerycontentId329]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Hunt for alerts correlated with Teams messages",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject329')._huntingQuerycontentId329,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject329')._huntingQuerycontentId329,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject330').huntingQueryTemplateSpecName330]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Identify acting user for reported phish_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject330').huntingQueryVersion330]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_330",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Identify acting user for reported phish",
+                "category": "Hunting Queries",
+                "query": "let ExtractInternetMessageId = (af: string) {\n    coalesce(\n        tostring(parse_json(af).InternetMessageId),\n        extract('\\\"InternetMessageId\\\":\\\"(<[^>]+@[^>]+>)\\\"', 1, af)\n    )\n};\nlet ReportedMail = materialize(\n    AlertEvidence\n    | where Timestamp >= ago(7d)\n    | where EntityType == \"MailMessage\"\n    | where Title == \"Email reported by user as malware or phish\"\n    | extend AF = tostring(AdditionalFields)\n    | extend InternetMessageId = ExtractInternetMessageId(AF)\n    | where isnotempty(InternetMessageId)\n    | extend Recipient = tostring(parse_json(AF).Recipient)\n    | extend Subject = tostring(parse_json(AF).Subject)\n    | extend NetworkMessageId = coalesce(tostring(parse_json(AF).NetworkMessageId), NetworkMessageId)\n    | summarize arg_max(Timestamp, *) by AlertId, InternetMessageId\n    | project AlertTimestamp = Timestamp,\n        AlertId,\n        InternetMessageId,\n        NetworkMessageId,\n        Recipient,\n        Subject\n);\nlet DeletedItemsActivity = materialize(\n    CloudAppEvents\n    | where Timestamp >= ago(7d)\n    | where ActionType in (\"MovedToDeletedItems\", \"MoveToDeletedItems\")\n    | where RawEventData has \"AffectedItems\"\n    | extend Raw = parse_json(RawEventData)\n    | mv-expand with_itemindex = AffectedItemIndex AffectedItem = Raw.AffectedItems to typeof(dynamic)\n    | extend InternetMessageId = tostring(AffectedItem.InternetMessageId)\n    | where isnotempty(InternetMessageId)\n    | extend ActorUser = coalesce(\n        tostring(Raw.UserId),\n        tostring(Raw.ActorUserId),\n        tostring(AccountId)\n    )\n    | extend ActorIp = coalesce(\n        tostring(Raw.ClientIP),\n        tostring(IPAddress)\n    )\n    | project AppTimestamp = Timestamp,\n        ActionType,\n        InternetMessageId,\n        AffectedItemIndex,\n        ActorUser,\n        ActorIp,\n        AccountDisplayName,\n        AccountObjectId,\n        ReportId\n);\nReportedMail\n| join kind=inner DeletedItemsActivity on InternetMessageId\n| extend RecipientNorm = tolower(extract(@'([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,})', 1, tostring(Recipient)))\n| extend ActorUserNorm = tolower(extract(@'([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,})', 1, tostring(ActorUser)))\n| extend RecipientActorMatch = case(\n    isnotempty(RecipientNorm) and isnotempty(ActorUserNorm) and RecipientNorm == ActorUserNorm, \"Match\",\n    isnotempty(RecipientNorm) and isnotempty(ActorUserNorm) and RecipientNorm != ActorUserNorm, \"Different\",\n    \"Unknown\"\n)\n| project\n    AppTimestamp,\n    AlertTimestamp,\n    AlertId,\n    InternetMessageId,\n    NetworkMessageId,\n    Recipient,\n    ActorUser,\n    RecipientActorMatch,\n    Subject,\n    ActionType,\n    AffectedItemIndex,\n    AccountDisplayName,\n    AccountObjectId,\n    ActorIp,\n    ReportId\n| order by AppTimestamp desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "Identifies the user who acted on a reported phishing message and compares that actor with the original recipient, helping investigate delegate or shared mailbox reporting scenarios."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject330')._huntingQuerycontentId330),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 330",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject330')._huntingQuerycontentId330)]",
+                "contentId": "[variables('huntingQueryObject330')._huntingQuerycontentId330]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject330').huntingQueryVersion330]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject330')._huntingQuerycontentId330]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Identify acting user for reported phish",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject330')._huntingQuerycontentId330,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject330')._huntingQuerycontentId330,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject331').huntingQueryTemplateSpecName331]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Inbound Sender Domains Failing Email Authentication_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject331').huntingQueryVersion331]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_331",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Inbound Sender Domains Failing Email Authentication",
+                "category": "Hunting Queries",
+                "query": "// Inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, Composite Authentication).\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\n| where EmailDirection == \"Inbound\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend Auth = parse_json(AuthenticationDetails)\n| summarize TotalInbound = count(), MessagesFailingAnyAuth = countif(tostring(Auth.DMARC) == \"fail\" or tostring(Auth.DKIM) == \"fail\" or tostring(Auth.SPF) == \"fail\" or tostring(Auth.CompAuth) == \"fail\"), DMARCFail = countif(tostring(Auth.DMARC) == \"fail\"), DKIMFail = countif(tostring(Auth.DKIM) == \"fail\"), SPFFail = countif(tostring(Auth.SPF) == \"fail\"), CompAuthFail = countif(tostring(Auth.CompAuth) == \"fail\") by SenderDomain = SenderFromDomain\n| where MessagesFailingAnyAuth > 0\n| top 20 by MessagesFailingAnyAuth\n| project SenderDomain, MessagesFailingAnyAuth, DMARCFail, DKIMFail, SPFFail, CompAuthFail, TotalInbound\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists inbound sender domains with the most email authentication failures (DMARC, DKIM, SPF, and Composite Authentication), using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject331')._huntingQuerycontentId331),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 331",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject331')._huntingQuerycontentId331)]",
+                "contentId": "[variables('huntingQueryObject331')._huntingQuerycontentId331]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject331').huntingQueryVersion331]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject331')._huntingQuerycontentId331]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Inbound Sender Domains Failing Email Authentication",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject331')._huntingQuerycontentId331,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject331')._huntingQuerycontentId331,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject332').huntingQueryTemplateSpecName332]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Automatic External Email Forwarding by Type_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject332').huntingQueryVersion332]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_332",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Automatic External Email Forwarding Overview by Type (Mailbox Rule and SMTP)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Outbound\" and isnotempty(ForwardingInformation)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend FwdInfo = parse_json(ForwardingInformation)\n| extend ForwardingType = tostring(FwdInfo.ForwardingType),\n         ForwardingUser = tostring(FwdInfo.ForwardingUser),\n         RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])\n| summarize ForwardedMessages = count(),\n            ForwardingUsers = dcount(ForwardingUser),\n            ExternalRecipients = dcount(RecipientEmailAddress),\n            ExternalDomains = dcount(RecipientDomain)\n    by ForwardingType\n| sort by ForwardedMessages desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises automatic external email forwarding across the tenant by forwarding type (mailbox rule versus SMTP forwarding), using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114,T1020"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject332')._huntingQuerycontentId332),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 332",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject332')._huntingQuerycontentId332)]",
+                "contentId": "[variables('huntingQueryObject332')._huntingQuerycontentId332]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject332').huntingQueryVersion332]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject332')._huntingQuerycontentId332]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Automatic External Email Forwarding Overview by Type (Mailbox Rule and SMTP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject332')._huntingQuerycontentId332,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject332')._huntingQuerycontentId332,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject333').huntingQueryTemplateSpecName333]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "First-Contact External Email Senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject333').huntingQueryVersion333]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_333",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "First-Contact External Email Senders",
+                "category": "Hunting Queries",
+                "query": "// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\n// let ExcludeDomains = dynamic([\"contoso.com\", \"fabrikam.com\"]);\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(SenderFromAddress)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend SenderDomain = tostring(split(SenderFromAddress, '@')[1])\n// | where SenderDomain !in~ (ExcludeDomains)\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\n| top 20 by FirstSeen desc\n| project Sender = SenderFromAddress, SenderDomain, FirstSeen, Messages, ThreatMessages\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists external email senders seen for the first time in the period (most recent first), surfacing new first-contact relationships, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject333')._huntingQuerycontentId333),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 333",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject333')._huntingQuerycontentId333)]",
+                "contentId": "[variables('huntingQueryObject333')._huntingQuerycontentId333]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject333').huntingQueryVersion333]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject333')._huntingQuerycontentId333]",
+        "contentKind": "HuntingQuery",
+        "displayName": "First-Contact External Email Senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject333')._huntingQuerycontentId333,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject333')._huntingQuerycontentId333,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject334').huntingQueryTemplateSpecName334]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "New External Sender Domains Carrying Threats_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject334').huntingQueryVersion334]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_334",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "New External Sender Domains Carrying Threats",
+                "category": "Hunting Queries",
+                "query": "// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\n// let ExcludeDomains = dynamic([\"contoso.com\", \"fabrikam.com\"]);\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(SenderFromAddress)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend SenderDomain = tostring(split(SenderFromAddress, '@')[1])\n// | where SenderDomain !in~ (ExcludeDomains)\n| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Messages = count(), Senders = dcount(SenderFromAddress), Recipients = dcount(RecipientEmailAddress), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderDomain\n| where ThreatMessages > 0\n| top 20 by FirstSeen desc\n| project SenderDomain, FirstSeen, Messages, Senders, Recipients, ThreatMessages, LastSeen\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists external sender domains seen for the first time in the period that already carried threats, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject334')._huntingQuerycontentId334),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 334",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject334')._huntingQuerycontentId334)]",
+                "contentId": "[variables('huntingQueryObject334')._huntingQuerycontentId334]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject334').huntingQueryVersion334]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject334')._huntingQuerycontentId334]",
+        "contentKind": "HuntingQuery",
+        "displayName": "New External Sender Domains Carrying Threats",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject334')._huntingQuerycontentId334,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject334')._huntingQuerycontentId334,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject335').huntingQueryTemplateSpecName335]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top External Domains Receiving Auto-forwarded Email_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject335').huntingQueryVersion335]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_335",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Outbound\" and isnotempty(ForwardingInformation)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend FwdInfo = parse_json(ForwardingInformation)\n| extend ForwardingType = tostring(FwdInfo.ForwardingType),\n         ForwardingUser = tostring(FwdInfo.ForwardingUser),\n         RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])\n| summarize ForwardedMessages = count(),\n            ForwardingUsers = dcount(ForwardingUser)\n    by RecipientDomain, ForwardingType\n| top 20 by ForwardedMessages\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the top external domains receiving automatically forwarded email, by forwarding type, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114,T1020"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject335')._huntingQuerycontentId335),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 335",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject335')._huntingQuerycontentId335)]",
+                "contentId": "[variables('huntingQueryObject335')._huntingQuerycontentId335]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject335').huntingQueryVersion335]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject335')._huntingQuerycontentId335]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject335')._huntingQuerycontentId335,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject335')._huntingQuerycontentId335,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject336').huntingQueryTemplateSpecName336]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top External Recipients Receiving Auto-forwarded Email_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject336').huntingQueryVersion336]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_336",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top External Recipients Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Outbound\" and isnotempty(ForwardingInformation)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend FwdInfo = parse_json(ForwardingInformation)\n| extend ForwardingType = tostring(FwdInfo.ForwardingType),\n         ForwardingUser = tostring(FwdInfo.ForwardingUser)\n| summarize ForwardedMessages = count(),\n            ForwardingUsers = dcount(ForwardingUser)\n    by RecipientEmailAddress, ForwardingType\n| top 20 by ForwardedMessages\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the top external recipients receiving automatically forwarded email, by forwarding type, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114,T1020"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject336')._huntingQuerycontentId336),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 336",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject336')._huntingQuerycontentId336)]",
+                "contentId": "[variables('huntingQueryObject336')._huntingQuerycontentId336]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject336').huntingQueryVersion336]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject336')._huntingQuerycontentId336]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top External Recipients Receiving Auto-forwarded Email (Mailbox Rule and SMTP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject336')._huntingQuerycontentId336,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject336')._huntingQuerycontentId336,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject337').huntingQueryTemplateSpecName337]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Users Auto-forwarding Email Externally_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject337').huntingQueryVersion337]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_337",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Outbound\" and isnotempty(ForwardingInformation)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend FwdInfo = parse_json(ForwardingInformation)\n| extend ForwardingType = tostring(FwdInfo.ForwardingType),\n         ForwardingUser = tostring(FwdInfo.ForwardingUser),\n         RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])\n| where isnotempty(ForwardingUser)\n| summarize ForwardedMessages = count(),\n            ExternalRecipients = dcount(RecipientEmailAddress),\n            ExternalDomains = dcount(RecipientDomain)\n    by ForwardingUser, ForwardingType\n| top 20 by ForwardedMessages\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the top internal users automatically forwarding email to external addresses, by forwarding type, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "Collection,Exfiltration"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1114,T1020"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject337')._huntingQuerycontentId337),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 337",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject337')._huntingQuerycontentId337)]",
+                "contentId": "[variables('huntingQueryObject337')._huntingQuerycontentId337]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject337').huntingQueryVersion337]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject337')._huntingQuerycontentId337]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject337')._huntingQuerycontentId337,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject337')._huntingQuerycontentId337,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject338').huntingQueryTemplateSpecName338]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Malware Detections Over Time_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject338').huntingQueryVersion338]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_338",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Malware Detections Over Time (SharePoint, OneDrive and Teams)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nFileMaliciousContentInfo\n| where Timestamp >= TimeStart\n| where isnotempty(ThreatTypes)\n| make-series FileMalwareDetections = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query shows the daily volume of file malware detections in SharePoint, OneDrive and Teams over the last 30 days, using the FileMaliciousContentInfo table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1080"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject338')._huntingQuerycontentId338),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 338",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject338')._huntingQuerycontentId338)]",
+                "contentId": "[variables('huntingQueryObject338')._huntingQuerycontentId338]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject338').huntingQueryVersion338]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject338')._huntingQuerycontentId338]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Malware Detections Over Time (SharePoint, OneDrive and Teams)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject338')._huntingQuerycontentId338,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject338')._huntingQuerycontentId338,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject339').huntingQueryTemplateSpecName339]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Malware Detections by Location_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject339').huntingQueryVersion339]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_339",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Malware Detections by Location (SharePoint, OneDrive and Teams)",
+                "category": "Hunting Queries",
+                "query": "// FileMaliciousContentInfo records malicious-content findings for files in SharePoint, OneDrive and Teams.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n// FolderPath segment [4] is the SharePoint site or the OneDrive personal location where the file resides.\n| extend Location = tostring(split(FolderPath, '/')[4])\n| summarize FileMalwareDetections = count(), DistinctFiles = dcount(SHA256) by Location\n| top 100 by FileMalwareDetections desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query surfaces malware detections in files stored in SharePoint, OneDrive and Teams, grouped by the site or personal location where each file resides, using the FileMaliciousContentInfo table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1080"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject339')._huntingQuerycontentId339),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 339",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject339')._huntingQuerycontentId339)]",
+                "contentId": "[variables('huntingQueryObject339')._huntingQuerycontentId339]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject339').huntingQueryVersion339]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject339')._huntingQuerycontentId339]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Malware Detections by Location (SharePoint, OneDrive and Teams)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject339')._huntingQuerycontentId339,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject339')._huntingQuerycontentId339,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject340').huntingQueryTemplateSpecName340]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Malware Detections by Workload_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject340').huntingQueryVersion340]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_340",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Malware Detections by Workload (SharePoint, OneDrive and Teams)",
+                "category": "Hunting Queries",
+                "query": "// FileMaliciousContentInfo records malicious-content findings for files in SharePoint, OneDrive and Teams.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| summarize FileMalwareDetections = count(), DistinctFiles = dcount(SHA256) by Workload\n| sort by FileMalwareDetections desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises malware detections in files stored in SharePoint, OneDrive and Teams by the Microsoft 365 collaboration workload, using the FileMaliciousContentInfo table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1080"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject340')._huntingQuerycontentId340),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 340",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject340')._huntingQuerycontentId340)]",
+                "contentId": "[variables('huntingQueryObject340')._huntingQuerycontentId340]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject340').huntingQueryVersion340]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject340')._huntingQuerycontentId340]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Malware Detections by Workload (SharePoint, OneDrive and Teams)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject340')._huntingQuerycontentId340,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject340')._huntingQuerycontentId340,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject341').huntingQueryTemplateSpecName341]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Malware Top Families by MDO Detonation_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject341').huntingQueryVersion341]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_341",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)",
+                "category": "Hunting Queries",
+                "query": "// DetectionMethods \"detonation\" indicates a Microsoft Defender for Office 365 Safe Attachments detonation verdict.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| where tostring(DetectionMethods) has \"detonation\"\n| summarize Files = count() by ThreatName = ThreatNames\n| top 50 by Files desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by Microsoft Defender for Office 365 (Safe Attachments detonation), using the FileMaliciousContentInfo table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1080"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject341')._huntingQuerycontentId341),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 341",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject341')._huntingQuerycontentId341)]",
+                "contentId": "[variables('huntingQueryObject341')._huntingQuerycontentId341]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject341').huntingQueryVersion341]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject341')._huntingQuerycontentId341]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject341')._huntingQuerycontentId341,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject341')._huntingQuerycontentId341,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject342').huntingQueryTemplateSpecName342]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Malware Top Families by SharePoint Antivirus_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject342').huntingQueryVersion342]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_342",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)",
+                "category": "Hunting Queries",
+                "query": "// DetectionMethods \"Antimalware engine\" indicates the built-in SharePoint Online antivirus.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| where tostring(DetectionMethods) has \"Antimalware engine\"\n| summarize Files = count() by ThreatName = ThreatNames\n| top 50 by Files desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by the built-in SharePoint Online antivirus, using the FileMaliciousContentInfo table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1080"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject342')._huntingQuerycontentId342),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 342",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject342')._huntingQuerycontentId342)]",
+                "contentId": "[variables('huntingQueryObject342')._huntingQuerycontentId342]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject342').huntingQueryVersion342]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject342')._huntingQuerycontentId342]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject342')._huntingQuerycontentId342,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject342')._huntingQuerycontentId342,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject343').huntingQueryTemplateSpecName343]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "File Scanning Coverage_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject343').huntingQueryVersion343]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_343",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "File Scanning Coverage (SharePoint, OneDrive and Teams)",
+                "category": "Hunting Queries",
+                "query": "FileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| summarize FilesProcessed = count(),\n            FilesWithMalware = countif(isnotempty(ThreatTypes)),\n            FilesNoDetection = countif(isempty(ThreatTypes))\n| extend DetectionRatePct = iif(FilesProcessed == 0, 0.0, round(100.0 * FilesWithMalware / FilesProcessed, 2))\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises file scanning coverage in SharePoint, OneDrive and Teams: how many files were processed, how many were found malicious, and how many were scanned with no detection, using the FileMaliciousContentInfo table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1080"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject343')._huntingQuerycontentId343),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 343",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject343')._huntingQuerycontentId343)]",
+                "contentId": "[variables('huntingQueryObject343')._huntingQuerycontentId343]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject343').huntingQueryVersion343]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject343')._huntingQuerycontentId343]",
+        "contentKind": "HuntingQuery",
+        "displayName": "File Scanning Coverage (SharePoint, OneDrive and Teams)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject343')._huntingQuerycontentId343,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject343')._huntingQuerycontentId343,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject344').huntingQueryTemplateSpecName344]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject344').huntingQueryVersion344]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_344",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware Detection IP and Geo Position",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\" and isnotempty(SenderIPv4)\n| summarize count() by SenderIPv4\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| project SenderIPv4, Latitude, Longitude, ['Malware Emails'] = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises inbound email malware detections by sender IP address with geographic coordinates for mapping."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject344')._huntingQuerycontentId344),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 344",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject344')._huntingQuerycontentId344)]",
+                "contentId": "[variables('huntingQueryObject344')._huntingQuerycontentId344]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject344').huntingQueryVersion344]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject344')._huntingQuerycontentId344]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware Detection IP and Geo Position",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject344')._huntingQuerycontentId344,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject344')._huntingQuerycontentId344,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject345').huntingQueryTemplateSpecName345]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject345').huntingQueryVersion345]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_345",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware Detections by Sender Country",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\" and isnotempty(SenderIPv4)\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Country = tostring(GeoInfo.country)\n| summarize count() by Country\n| project Country, ['Malware Emails'] = count_\n| sort by ['Malware Emails'] desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises inbound email malware detections by the sender IP address country, derived from the sender IPv4 address."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject345')._huntingQuerycontentId345),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 345",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject345')._huntingQuerycontentId345)]",
+                "contentId": "[variables('huntingQueryObject345')._huntingQuerycontentId345]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject345').huntingQueryVersion345]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject345')._huntingQuerycontentId345]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware Detections by Sender Country",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject345')._huntingQuerycontentId345,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject345')._huntingQuerycontentId345,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject346').huntingQueryTemplateSpecName346]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware Detections by Threat Classification_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject346').huntingQueryVersion346]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_346",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware Detections by Threat Classification",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\n| summarize Count = count() by ThreatClassification\n| sort by Count desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises inbound email malware detections grouped by the malware threat classification (for example Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject346')._huntingQuerycontentId346),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 346",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject346')._huntingQuerycontentId346)]",
+                "contentId": "[variables('huntingQueryObject346')._huntingQuerycontentId346]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject346').huntingQueryVersion346]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject346')._huntingQuerycontentId346]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware Detections by Threat Classification",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject346')._huntingQuerycontentId346,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject346')._huntingQuerycontentId346,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject347').huntingQueryTemplateSpecName347]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Attacked Users by Malware Threat Classification_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject347').huntingQueryVersion347]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_347",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Attacked Users by Malware Threat Classification",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Malware\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\n| summarize EmailCount = count() by ThreatClassification, RecipientEmailAddress\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\n| sort by Count desc\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query surfaces, for each malware threat classification, the recipient most frequently targeted by inbound malware email."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject347')._huntingQuerycontentId347),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 347",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject347')._huntingQuerycontentId347)]",
+                "contentId": "[variables('huntingQueryObject347')._huntingQuerycontentId347]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject347').huntingQueryVersion347]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject347')._huntingQuerycontentId347]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Attacked Users by Malware Threat Classification",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject347')._huntingQuerycontentId347,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject347')._huntingQuerycontentId347,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject348').huntingQueryTemplateSpecName348]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top File Owners Holding Malware_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject348').huntingQueryVersion348]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_348",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top File Owners Holding Malware (SharePoint, OneDrive and Teams)",
+                "category": "Hunting Queries",
+                "query": "// Groups by the file owner, or by the SharePoint/Teams site when a file has no individual owner.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat('Site: ', tostring(split(FolderPath, '/')[4])))\n| summarize MaliciousFiles = count(),\n            DistinctFiles = dcount(SHA256),\n            Workloads = make_set(Workload, 3),\n            SampleThreats = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\n            LastSeen = max(Timestamp)\n    by Owner\n| top 20 by MaliciousFiles\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the file owners (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, using the FileMaliciousContentInfo table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess,LateralMovement"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566,T1080"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject348')._huntingQuerycontentId348),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 348",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject348')._huntingQuerycontentId348)]",
+                "contentId": "[variables('huntingQueryObject348')._huntingQuerycontentId348]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject348').huntingQueryVersion348]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject348')._huntingQuerycontentId348]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top File Owners Holding Malware (SharePoint, OneDrive and Teams)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject348')._huntingQuerycontentId348,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject348')._huntingQuerycontentId348,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject349').huntingQueryTemplateSpecName349]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "First-Contact External Teams Senders_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject349').huntingQueryVersion349]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_349",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "First-Contact External Teams Senders",
+                "category": "Hunting Queries",
+                "query": "//This query lists external Microsoft Teams senders by the date they were first seen over the last 30 days, surfacing recent first-contact senders.\nMessageEvents\n| where Timestamp > ago(30d)\n| summarize FirstTimestamp = min(Timestamp), arg_max(Timestamp, *) by TeamsMessageId\n| where IsOwnedThread == 0 and IsExternalThread == 1\n| summarize FirstSeen = min(FirstTimestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\n| top 20 by FirstSeen desc\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists external Microsoft Teams senders by the date they were first seen, surfacing recent first-contact senders."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject349')._huntingQuerycontentId349),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 349",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject349')._huntingQuerycontentId349)]",
+                "contentId": "[variables('huntingQueryObject349')._huntingQuerycontentId349]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject349').huntingQueryVersion349]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject349')._huntingQuerycontentId349]",
+        "contentKind": "HuntingQuery",
+        "displayName": "First-Contact External Teams Senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject349')._huntingQuerycontentId349,'-', '1.0.1')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject349')._huntingQuerycontentId349,'-', '1.0.1')))]",
+        "version": "1.0.1"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject350').huntingQueryTemplateSpecName350]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malicious files shared in Microsoft Teams_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject350').huntingQueryVersion350]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_350",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malicious files shared in Microsoft Teams",
+                "category": "Hunting Queries",
+                "query": "//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365.\nFileMaliciousContentInfo\n| where Timestamp > ago(30d)\n| where Workload == \"MicrosoftTeams\"\n| where isnotempty(ThreatTypes)\n| top 20 by Timestamp desc\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject350')._huntingQuerycontentId350),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 350",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject350')._huntingQuerycontentId350)]",
+                "contentId": "[variables('huntingQueryObject350')._huntingQuerycontentId350]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject350').huntingQueryVersion350]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject350')._huntingQuerycontentId350]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malicious files shared in Microsoft Teams",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject350')._huntingQuerycontentId350,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject350')._huntingQuerycontentId350,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject351').huntingQueryTemplateSpecName351]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Microsoft Teams External versus Internal Thread Exposure_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject351').huntingQueryVersion351]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_351",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Microsoft Teams External versus Internal Thread Exposure",
+                "category": "Hunting Queries",
+                "query": "//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\nMessageEvents\n| where Timestamp > ago(30d)\n| summarize arg_max(Timestamp, *) by TeamsMessageId\n| extend Thread = iif(IsExternalThread == true, \"External Thread\", \"Internal Thread\")\n| summarize Count = count() by Thread\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject351')._huntingQuerycontentId351),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 351",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject351')._huntingQuerycontentId351)]",
+                "contentId": "[variables('huntingQueryObject351')._huntingQuerycontentId351]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject351').huntingQueryVersion351]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject351')._huntingQuerycontentId351]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Microsoft Teams External versus Internal Thread Exposure",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject351')._huntingQuerycontentId351,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject351')._huntingQuerycontentId351,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject352').huntingQueryTemplateSpecName352]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Teams File Protection Summary_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject352').huntingQueryVersion352]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_352",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Teams File Protection Summary",
+                "category": "Hunting Queries",
+                "query": "//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365: files scanned, files with malware detected, and files scanned with no detection.\nlet base = FileMaliciousContentInfo\n    | where Timestamp > ago(30d)\n    | where Workload == \"MicrosoftTeams\";\nunion\n(base | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 1),\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files with Malware Detected\", Ord = 2),\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files Scanned - No Detection\", Ord = 3)\n| sort by Ord asc\n| project Count, Details\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarizes Microsoft Teams file protection: files scanned, files with malware detected, and files with no detection."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject352')._huntingQuerycontentId352),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 352",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject352')._huntingQuerycontentId352)]",
+                "contentId": "[variables('huntingQueryObject352')._huntingQuerycontentId352]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject352').huntingQueryVersion352]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject352')._huntingQuerycontentId352]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Teams File Protection Summary",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject352')._huntingQuerycontentId352,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject352')._huntingQuerycontentId352,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject353').huntingQueryTemplateSpecName353]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SecOps Mailbox Override Count_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject353').huntingQueryVersion353]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_353",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "SecOps Mailbox Override Count",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where OrgLevelPolicy == \"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\n| summarize ['SecOps Mailbox Deliveries'] = count()\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query counts inbound emails delivered to the SecOps mailbox by an organisation-level allow override."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject353')._huntingQuerycontentId353),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 353",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject353')._huntingQuerycontentId353)]",
+                "contentId": "[variables('huntingQueryObject353')._huntingQuerycontentId353]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject353').huntingQueryVersion353]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject353')._huntingQuerycontentId353]",
+        "contentKind": "HuntingQuery",
+        "displayName": "SecOps Mailbox Override Count",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject353')._huntingQuerycontentId353,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject353')._huntingQuerycontentId353,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject354').huntingQueryTemplateSpecName354]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "SecOps Mailbox Overrides by Threat Type_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject354').huntingQueryVersion354]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_354",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "SecOps Mailbox Overrides by Threat Type",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where OrgLevelPolicy == \"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\n| extend ThreatType = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\n| summarize TotalEmails = count() by OrgLevelAction, OrgLevelPolicy, ThreatType\n| sort by TotalEmails desc\n| project ['Override Action'] = OrgLevelAction, ['Override Policy'] = OrgLevelPolicy, ['Threat Type'] = ThreatType, ['Total Emails'] = TotalEmails\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query breaks down inbound emails delivered to the SecOps mailbox by an organisation-level allow override, grouped by threat type."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject354')._huntingQuerycontentId354),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 354",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject354')._huntingQuerycontentId354)]",
+                "contentId": "[variables('huntingQueryObject354')._huntingQuerycontentId354]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject354').huntingQueryVersion354]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject354')._huntingQuerycontentId354]",
+        "contentKind": "HuntingQuery",
+        "displayName": "SecOps Mailbox Overrides by Threat Type",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject354')._huntingQuerycontentId354,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject354')._huntingQuerycontentId354,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject355').huntingQueryTemplateSpecName355]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Recipients Receiving Threats Delivered by Override_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject355').huntingQueryVersion355]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_355",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Recipients Receiving Threats Delivered by Override",
+                "category": "Hunting Queries",
+                "query": "// Recipients with the most threats delivered via an admin or user override, with the override share and type breakdown.\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend OverrideType = case(\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\n    \"(none)\")\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\n| summarize TotalThreats = sum(PerType),\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\n        by RecipientEmailAddress\n| where OverriddenThreats > 0\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\n| top 15 by OverriddenThreats\n| project Recipient = RecipientEmailAddress, TotalThreats, OverriddenThreats, OverridePercent, OverrideTypes\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the recipients who received the most threats that were delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject355')._huntingQuerycontentId355),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 355",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject355')._huntingQuerycontentId355)]",
+                "contentId": "[variables('huntingQueryObject355')._huntingQuerycontentId355]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject355').huntingQueryVersion355]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject355')._huntingQuerycontentId355]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Recipients Receiving Threats Delivered by Override",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject355')._huntingQuerycontentId355,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject355')._huntingQuerycontentId355,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject356').huntingQueryTemplateSpecName356]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Sender Domains Delivering Threats via Override_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject356').huntingQueryVersion356]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_356",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Sender Domains Delivering Threats via Override",
+                "category": "Hunting Queries",
+                "query": "// Sender domains with the most threats delivered via an admin or user override, with the override share and type breakdown.\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend OverrideType = case(\n    OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\n    UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\n    \"(none)\")\n| summarize PerType = count() by SenderFromDomain, OverrideType\n| summarize TotalThreats = sum(PerType),\n            OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\n        by SenderFromDomain\n| where OverriddenThreats > 0\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\n| top 10 by OverriddenThreats\n| project SenderDomain = SenderFromDomain, TotalThreats, OverriddenThreats, OverridePercent, OverrideTypes\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the sender domains whose threats were most often delivered because of an admin or user override, with the share overridden and a breakdown of override types, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject356')._huntingQuerycontentId356),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 356",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject356')._huntingQuerycontentId356)]",
+                "contentId": "[variables('huntingQueryObject356')._huntingQuerycontentId356]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject356').huntingQueryVersion356]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject356')._huntingQuerycontentId356]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Sender Domains Delivering Threats via Override",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject356')._huntingQuerycontentId356,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject356')._huntingQuerycontentId356,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject357').huntingQueryTemplateSpecName357]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject357').huntingQueryVersion357]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_357",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detection IP and Geo Position",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\n| summarize count() by SenderIPv4\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| project SenderIPv4, Latitude, Longitude, ['Phish Emails'] = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises inbound email phishing detections by sender IP address with geographic coordinates for mapping."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject357')._huntingQuerycontentId357),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 357",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject357')._huntingQuerycontentId357)]",
+                "contentId": "[variables('huntingQueryObject357')._huntingQuerycontentId357]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject357').huntingQueryVersion357]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject357')._huntingQuerycontentId357]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detection IP and Geo Position",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject357')._huntingQuerycontentId357,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject357')._huntingQuerycontentId357,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject358').huntingQueryTemplateSpecName358]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject358').huntingQueryVersion358]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_358",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detections by Sender Country",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\n| extend Country = tostring(GeoInfo.country)\n| summarize count() by Country\n| project Country, ['Phish Emails'] = count_\n| sort by ['Phish Emails'] desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises inbound email phishing detections by the sender IP address country, derived from the sender IPv4 address."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject358')._huntingQuerycontentId358),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 358",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject358')._huntingQuerycontentId358)]",
+                "contentId": "[variables('huntingQueryObject358')._huntingQuerycontentId358]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject358').huntingQueryVersion358]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject358')._huntingQuerycontentId358]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detections by Sender Country",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject358')._huntingQuerycontentId358,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject358')._huntingQuerycontentId358,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject359').huntingQueryTemplateSpecName359]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phish Detections by Threat Classification_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject359').huntingQueryVersion359]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_359",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phish Detections by Threat Classification",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\n| summarize Count = count() by ThreatClassification\n| sort by Count desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises inbound email phishing detections grouped by the message-intent threat classification produced by Microsoft Defender for Office 365 LLM content analysis (for example Invoice, Gift card, Payroll, PII gathering)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject359')._huntingQuerycontentId359),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 359",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject359')._huntingQuerycontentId359)]",
+                "contentId": "[variables('huntingQueryObject359')._huntingQuerycontentId359]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject359').huntingQueryVersion359]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject359')._huntingQuerycontentId359]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phish Detections by Threat Classification",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject359')._huntingQuerycontentId359,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject359')._huntingQuerycontentId359,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject360').huntingQueryTemplateSpecName360]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phishing Detected by LLM Content Analysis_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject360').huntingQueryVersion360]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_360",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phishing Detected by LLM Content Analysis",
+                "category": "Hunting Queries",
+                "query": "// OrgLevelPolicy exclusions drop phishing-simulation and SecOps-mailbox deliveries; remove them to include those.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and tostring(DetectionMethods) has \"LLM content analysis\"\n| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, ThreatTypes, DetectionMethods, NetworkMessageId\n| top 100 by Timestamp desc\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists inbound phishing messages that Microsoft Defender for Office 365 detected using LLM (Language AI) content analysis, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject360')._huntingQuerycontentId360),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 360",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject360')._huntingQuerycontentId360)]",
+                "contentId": "[variables('huntingQueryObject360')._huntingQuerycontentId360]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject360').huntingQueryVersion360]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject360')._huntingQuerycontentId360]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phishing Detected by LLM Content Analysis",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject360')._huntingQuerycontentId360,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject360')._huntingQuerycontentId360,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject361').huntingQueryTemplateSpecName361]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Attacked Users by Phish Threat Classification_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject361').huntingQueryVersion361]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_361",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Attacked Users by Phish Threat Classification",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ThreatTypes has \"Phish\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\n| summarize EmailCount = count() by ThreatClassification, RecipientEmailAddress\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\n| sort by Emails desc\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query surfaces, for each phishing message-intent threat classification, the recipient most frequently targeted by inbound phishing email."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject361')._huntingQuerycontentId361),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 361",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject361')._huntingQuerycontentId361)]",
+                "contentId": "[variables('huntingQueryObject361')._huntingQuerycontentId361]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject361').huntingQueryVersion361]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject361')._huntingQuerycontentId361]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Attacked Users by Phish Threat Classification",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject361')._huntingQuerycontentId361,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject361')._huntingQuerycontentId361,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject362').huntingQueryTemplateSpecName362]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Quarantine Release Percentage_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject362').huntingQueryVersion362]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_362",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Quarantine Release Percentage",
+                "category": "Hunting Queries",
+                "query": "let Quarantine_Releases = toscalar(EmailPostDeliveryEvents\n| where Timestamp > ago(30d)\n| where Action == \"Quarantine release\"\n| distinct NetworkMessageId, RecipientEmailAddress\n| count);\nlet Quarantined_Mailflow = toscalar(EmailEvents\n| where Timestamp > ago(30d)\n| where DeliveryLocation == \"Quarantine\"\n| distinct NetworkMessageId, RecipientEmailAddress\n| count);\nprint\nQuarantine_Releases = toreal(Quarantine_Releases),\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\nRelease_Percentage = iff(Quarantined_Mailflow == 0, 0.0, round((toreal(Quarantine_Releases) / toreal(Quarantined_Mailflow)) * 100, 2))\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query calculates the percentage of quarantined emails that were subsequently released, out of the total quarantined."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject362')._huntingQuerycontentId362),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 362",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject362')._huntingQuerycontentId362)]",
+                "contentId": "[variables('huntingQueryObject362')._huntingQuerycontentId362]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject362').huntingQueryVersion362]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject362')._huntingQuerycontentId362]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Quarantine Release Percentage",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject362')._huntingQuerycontentId362,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject362')._huntingQuerycontentId362,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject363').huntingQueryTemplateSpecName363]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Automated Investigation Outcomes by Day_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject363').huntingQueryVersion363]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_363",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Automated Investigation Outcomes by Day",
+                "category": "Hunting Queries",
+                "query": "let AutoRemediations =\n    EmailPostDeliveryEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"Automated Remediation\"\n    | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\n    | project NetworkMessageId, RecipientEmailAddress, Timestamp;\nlet EvidenceVerdicts =\n    AlertEvidence\n    | where Timestamp > ago(30d)\n    | where EntityType in (\"MailMessage\", \"MailCluster\")\n    | extend extra = todynamic(AdditionalFields)\n    | extend networkIds = iff(\n        isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\n        pack_array(NetworkMessageId),\n        extra.NetworkMessageIds)\n    | mv-expand nmID = networkIds\n    | extend lastVerdict = tolower(tostring(extra.LastVerdict)),\n             threatAIList = extra.ThreatAnalysisSummary,\n             threatInt = extra.ThreatIntelligence\n    | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \"\"),\n             verdictTI = iff(array_length(threatInt) > 0, \"malicious\", \"\")\n    | extend ThreatDetectedFlag = case(\n        lastVerdict in (\"malicious\", \"suspicious\") or verdictFromAnalysis in (\"malicious\", \"suspicious\") or verdictTI == \"malicious\",\n        true, false)\n    | extend MailCountInt = toint(extra.MailCount)\n    | extend Weight = iff(EntityType == \"MailCluster\", coalesce(MailCountInt, 1), 1)\n    | summarize IsThreatDetected = any(ThreatDetectedFlag), WeightSum = max(Weight) by nmID = tostring(nmID);\nAutoRemediations\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\n| extend isThreat = coalesce(IsThreatDetected, false), effectiveWeight = coalesce(WeightSum, 1)\n| extend InvestigationOutcome = iif(isThreat, \"Threat Detected\", \"Clean\")\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, 1d), InvestigationOutcome\n| order by Day asc, InvestigationOutcome asc\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarizes daily automated investigation outcomes (threat detected versus clean) by correlating automated remediation events with alert evidence, using the EmailPostDeliveryEvents and AlertEvidence tables."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject363')._huntingQuerycontentId363),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 363",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject363')._huntingQuerycontentId363)]",
+                "contentId": "[variables('huntingQueryObject363')._huntingQuerycontentId363]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject363').huntingQueryVersion363]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject363')._huntingQuerycontentId363]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Automated Investigation Outcomes by Day",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject363')._huntingQuerycontentId363,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject363')._huntingQuerycontentId363,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject364').huntingQueryTemplateSpecName364]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Automated Remediation Delivery to Action Latency_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject364').huntingQueryVersion364]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_364",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Automated Remediation Delivery to Action Latency",
+                "category": "Hunting Queries",
+                "query": "let deliveries = EmailEvents\n  | where Timestamp > ago(30d)\n  | where DeliveryAction == \"Delivered\"\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n  | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\nlet remediations = EmailPostDeliveryEvents\n  | where Timestamp > ago(30d)\n  | where ActionType == \"Automated Remediation\"\n  | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n  | summarize FirstRemediation = min(Timestamp) by MsgKey;\ndeliveries\n| join kind=inner remediations on MsgKey\n| extend DelayMinutes = datetime_diff(\"minute\", FirstRemediation, FirstDelivery)\n| where DelayMinutes >= 0\n| summarize ['Avg (min)'] = avg(DelayMinutes), ['P80 (min)'] = percentile(DelayMinutes, 80), ['P90 (min)'] = percentile(DelayMinutes, 90), ['P99 (min)'] = percentile(DelayMinutes, 99), CountEmails = count() by bin(FirstRemediation, 1d)\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query measures how long after delivery Microsoft Defender for Office 365 automated remediation acts on a message, reported as daily average and percentiles, using the EmailEvents and EmailPostDeliveryEvents tables."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject364')._huntingQuerycontentId364),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 364",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject364')._huntingQuerycontentId364)]",
+                "contentId": "[variables('huntingQueryObject364')._huntingQuerycontentId364]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject364').huntingQueryVersion364]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject364')._huntingQuerycontentId364]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Automated Remediation Delivery to Action Latency",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject364')._huntingQuerycontentId364,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject364')._huntingQuerycontentId364,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject365').huntingQueryTemplateSpecName365]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Automated Remediation Efficiency Over Time_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject365').huntingQueryVersion365]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_365",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Automated Remediation Efficiency Over Time",
+                "category": "Hunting Queries",
+                "query": "EmailPostDeliveryEvents\n| where Timestamp > ago(30d)\n| where ActionType == \"Automated Remediation\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize Count = count() by bin(Timestamp, 1d), ActionResult\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query trends the outcome (success versus failure) of Microsoft Defender for Office 365 automated remediation actions over time, using the EmailPostDeliveryEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject365')._huntingQuerycontentId365),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 365",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject365')._huntingQuerycontentId365)]",
+                "contentId": "[variables('huntingQueryObject365')._huntingQuerycontentId365]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject365').huntingQueryVersion365]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject365')._huntingQuerycontentId365]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Automated Remediation Efficiency Over Time",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject365')._huntingQuerycontentId365,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject365')._huntingQuerycontentId365,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject366').huntingQueryTemplateSpecName366]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Automated Remediation Manual versus Automatic Approval_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject366').huntingQueryVersion366]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_366",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Automated Remediation Manual versus Automatic Approval",
+                "category": "Hunting Queries",
+                "query": "EmailPostDeliveryEvents\n| where Timestamp > ago(30d)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where ActionType == \"Automated Remediation\"\n| summarize count() by ActionTrigger\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query shows whether Microsoft Defender for Office 365 automated remediation actions were taken automatically or required manual admin approval, using the EmailPostDeliveryEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject366')._huntingQuerycontentId366),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 366",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject366')._huntingQuerycontentId366)]",
+                "contentId": "[variables('huntingQueryObject366')._huntingQuerycontentId366]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject366').huntingQueryVersion366]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject366')._huntingQuerycontentId366]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Automated Remediation Manual versus Automatic Approval",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject366')._huntingQuerycontentId366,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject366')._huntingQuerycontentId366,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject367').huntingQueryTemplateSpecName367]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Spam Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject367').huntingQueryVersion367]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_367",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Spam Detections by Sender Country",
+                "category": "Hunting Queries",
+                "query": "// Inbound spam detections by sender-IP country. Country is from IP geolocation and is approximate.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where ThreatTypes has \"Spam\" and isnotempty(SenderIPv4)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend Country = tostring(geo_info_from_ip_address(SenderIPv4).country)\n| where isnotempty(Country)\n| summarize SpamEmails = count(), SenderIPs = dcount(SenderIPv4) by Country\n| top 20 by SpamEmails\n| project Country, SpamEmails, SenderIPs\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarizes inbound spam detections by the geographic country of the sending IP address, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject367')._huntingQuerycontentId367),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 367",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject367')._huntingQuerycontentId367)]",
+                "contentId": "[variables('huntingQueryObject367')._huntingQuerycontentId367]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject367').huntingQueryVersion367]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject367')._huntingQuerycontentId367]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Spam Detections by Sender Country",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject367')._huntingQuerycontentId367,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject367')._huntingQuerycontentId367,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject368').huntingQueryTemplateSpecName368]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Impersonation and Spoof Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject368').huntingQueryVersion368]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_368",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Impersonation and Spoof Detections by Sender Country",
+                "category": "Hunting Queries",
+                "query": "// Inbound impersonation and spoof (BEC) detections by sender-IP country. Country is from IP geolocation and is approximate.\nEmailEvents\n| where Timestamp > ago(30d)\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\n| where (DetectionMethods has \"Impersonation\" or DetectionMethods has \"Spoof\") and isnotempty(SenderIPv4)\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| extend Country = tostring(geo_info_from_ip_address(SenderIPv4).country)\n| where isnotempty(Country)\n| summarize ImpersonationEmails = countif(DetectionMethods has \"Impersonation\"), SpoofEmails = countif(DetectionMethods has \"Spoof\"), SenderIPs = dcount(SenderIPv4) by Country\n| extend TotalBEC = ImpersonationEmails + SpoofEmails\n| top 20 by TotalBEC\n| project Country, ImpersonationEmails, SpoofEmails, SenderIPs, TotalBEC\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarizes inbound impersonation and spoof (BEC) detections by the geographic country of the sending IP address, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject368')._huntingQuerycontentId368),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 368",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject368')._huntingQuerycontentId368)]",
+                "contentId": "[variables('huntingQueryObject368')._huntingQuerycontentId368]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject368').huntingQueryVersion368]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject368')._huntingQuerycontentId368]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Impersonation and Spoof Detections by Sender Country",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject368')._huntingQuerycontentId368,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject368')._huntingQuerycontentId368,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject369').huntingQueryTemplateSpecName369]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Recipients Targeted by Impersonation or BEC_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject369').huntingQueryVersion369]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_369",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Recipients Targeted by Impersonation or BEC",
+                "category": "Hunting Queries",
+                "query": "// Recipients most targeted by impersonation / BEC, with distinct senders, a sample of sender domains and inbox delivery.\nEmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\"\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\n| where DetectionMethods has \"Impersonation\"\n| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize ImpersonationEmails = count(), DistinctSenders = dcount(SenderFromAddress), SampleSenderDomains = make_set(SenderFromDomain, 5), DeliveredToInbox = countif(DeliveryLocation has \"Inbox\") by RecipientEmailAddress\n| top 20 by ImpersonationEmails\n| project Recipient = RecipientEmailAddress, ImpersonationEmails, DistinctSenders, SampleSenderDomains = strcat_array(SampleSenderDomains, \", \"), DeliveredToInbox\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject369')._huntingQuerycontentId369),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 369",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject369')._huntingQuerycontentId369)]",
+                "contentId": "[variables('huntingQueryObject369')._huntingQuerycontentId369]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject369').huntingQueryVersion369]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject369')._huntingQuerycontentId369]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Recipients Targeted by Impersonation or BEC",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject369')._huntingQuerycontentId369,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject369')._huntingQuerycontentId369,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject370').huntingQueryTemplateSpecName370]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top accounts performing user submissions - FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject370').huntingQueryVersion370]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_370",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top accounts performing user submissions (FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend RawData = parse_json(RawEventData)\n| extend RecordType = toint(RawData.RecordType), SubmissionType = tostring(RawData.SubmissionType), UserId = tostring(RawData.UserId)\n| where RecordType == 29 and SubmissionType == \"3\"\n| summarize count() by UserId\n| top 15 by count_\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top accounts performing user false positive submissions."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject370')._huntingQuerycontentId370),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 370",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject370')._huntingQuerycontentId370)]",
+                "contentId": "[variables('huntingQueryObject370')._huntingQuerycontentId370]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject370').huntingQueryVersion370]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject370')._huntingQuerycontentId370]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top accounts performing user submissions (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject370')._huntingQuerycontentId370,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject370')._huntingQuerycontentId370,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject371').huntingQueryTemplateSpecName371]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top Inbound Subjects FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject371').huntingQueryVersion371]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_371",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FP) - Top Inbound Subjects",
+                "category": "Hunting Queries",
+                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient before counting\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\"\n| summarize count() by Subject\n| top 10 by count_\n| project ['Subject'] = Subject, ['Emails'] = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top 10 subjects of inbound emails submitted as false positives by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject371')._huntingQuerycontentId371),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 371",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject371')._huntingQuerycontentId371)]",
+                "contentId": "[variables('huntingQueryObject371')._huntingQuerycontentId371]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject371').huntingQueryVersion371]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject371')._huntingQuerycontentId371]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FP) - Top Inbound Subjects",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject371')._huntingQuerycontentId371,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject371')._huntingQuerycontentId371,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject372').huntingQueryTemplateSpecName372]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top Intra-Org P2 senders FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject372').huntingQueryVersion372]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_372",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FP) - Top Intra-Org P2 Senders",
+                "category": "Hunting Queries",
+                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient before counting\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Intra-org\"\n| summarize count() by SenderMailFromAddress\n| top 10 by count_\n| project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top 10 intra-org senders of emails submitted as false positives by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject372')._huntingQuerycontentId372),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 372",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject372')._huntingQuerycontentId372)]",
+                "contentId": "[variables('huntingQueryObject372')._huntingQuerycontentId372]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject372').huntingQueryVersion372]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject372')._huntingQuerycontentId372]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FP) - Top Intra-Org P2 Senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject372')._huntingQuerycontentId372,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject372')._huntingQuerycontentId372,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject373').huntingQueryTemplateSpecName373]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top email (P2) sender domains FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject373').huntingQueryVersion373]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_373",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FP) - Top P2 Sender Domains",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain = tostring((parse_json(RawEventData)).P2SenderDomain)\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\n| summarize count() by P2SenderDomain\n| top 10 by count_\n| project ['Sender Domain'] = P2SenderDomain, ['Emails'] = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top 10 sender domains of emails submitted as false positives by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject373')._huntingQuerycontentId373),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 373",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject373')._huntingQuerycontentId373)]",
+                "contentId": "[variables('huntingQueryObject373')._huntingQuerycontentId373]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject373').huntingQueryVersion373]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject373')._huntingQuerycontentId373]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FP) - Top P2 Sender Domains",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject373')._huntingQuerycontentId373,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject373')._huntingQuerycontentId373,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject374').huntingQueryTemplateSpecName374]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions - Top email (P2) senders FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject374').huntingQueryVersion374]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_374",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submissions (FP) - Top Inbound P2 Senders",
+                "category": "Hunting Queries",
+                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient before counting\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\"\n| summarize count() by SenderMailFromAddress\n| top 10 by count_\n| project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the top 10 inbound senders of emails submitted as false positives by users."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject374')._huntingQuerycontentId374),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 374",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject374')._huntingQuerycontentId374)]",
+                "contentId": "[variables('huntingQueryObject374')._huntingQuerycontentId374]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject374').huntingQueryVersion374]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject374')._huntingQuerycontentId374]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submissions (FP) - Top Inbound P2 Senders",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject374')._huntingQuerycontentId374,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject374')._huntingQuerycontentId374,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject375').huntingQueryTemplateSpecName375]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions Trend - FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject375').huntingQueryVersion375]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_375",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Email Submission Trend (FP)",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nCloudAppEvents\n| where Timestamp >= TimeStart and Timestamp < TimeEnd\n| where ActionType == \"UserSubmission\"\n| extend RawData = parse_json(RawEventData)\n| where tostring(RawData.SubmissionType) == \"3\" and tostring(RawData.SubmissionContentType) == \"Mail\"\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| extend Details = \"User_Email_FP\"\n| project Count, Details, Timestamp\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises the daily amount of user false positive email submissions over time."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject375')._huntingQuerycontentId375),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 375",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject375')._huntingQuerycontentId375)]",
+                "contentId": "[variables('huntingQueryObject375')._huntingQuerycontentId375]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject375').huntingQueryVersion375]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject375')._huntingQuerycontentId375]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Email Submission Trend (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject375')._huntingQuerycontentId375,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject375')._huntingQuerycontentId375,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject376').huntingQueryTemplateSpecName376]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions by Detection Method - Phish FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject376').huntingQueryVersion376]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_376",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Submissions by Detection Method - Phish (FP)",
+                "category": "Hunting Queries",
+                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient so the verdict is read once\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish'\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\n| where isnotempty(Phish)\n| summarize count() by Phish\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises user false positive submissions by the original phish filter verdict on the reported message."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject376')._huntingQuerycontentId376),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 376",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject376')._huntingQuerycontentId376)]",
+                "contentId": "[variables('huntingQueryObject376')._huntingQuerycontentId376]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject376').huntingQueryVersion376]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject376')._huntingQuerycontentId376]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Submissions by Detection Method - Phish (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject376')._huntingQuerycontentId376,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject376')._huntingQuerycontentId376,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject377').huntingQueryTemplateSpecName377]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions by Detection Method - Spam FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject377').huntingQueryVersion377]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_377",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Submissions by Detection Method - Spam (FP)",
+                "category": "Hunting Queries",
+                "query": "let Submissions = CloudAppEvents\n    | where Timestamp > ago(30d)\n    | where ActionType == \"UserSubmission\"\n    | extend RawData = parse_json(RawEventData)\n    | where tostring(RawData.SubmissionContentType) == \"Mail\" and tostring(RawData.SubmissionType) == \"3\"\n    | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId\n    | distinct NetworkMessageId, RecipientObjectId;\nEmailEvents\n| where Timestamp > ago(30d)\n| join kind=inner Submissions on NetworkMessageId, RecipientObjectId\n// De-duplicate to the latest EmailEvents record per message and recipient so the verdict is read once\n| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam'\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\n| where isnotempty(Spam)\n| summarize count() by Spam\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises user false positive submissions by the original spam filter verdict on the reported message."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject377')._huntingQuerycontentId377),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 377",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject377')._huntingQuerycontentId377)]",
+                "contentId": "[variables('huntingQueryObject377')._huntingQuerycontentId377]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject377').huntingQueryVersion377]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject377')._huntingQuerycontentId377]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Submissions by Detection Method - Spam (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject377')._huntingQuerycontentId377,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject377')._huntingQuerycontentId377,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject378').huntingQueryTemplateSpecName378]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "User Submissions by Submission State - FP_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject378').huntingQueryVersion378]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_378",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "User Submissions by Submission State (FP)",
+                "category": "Hunting Queries",
+                "query": "CloudAppEvents\n| where ActionType == \"UserSubmission\"\n| extend RawData = parse_json(RawEventData)\n| extend RecordType = toint(RawData.RecordType), SubmissionType = tostring(RawData.SubmissionType), SubmissionState = tostring(RawData.SubmissionState)\n| where RecordType == 29 and SubmissionType == \"3\"\n| summarize count() by SubmissionState\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises user false positive submissions by submission state."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject378')._huntingQuerycontentId378),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 378",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject378')._huntingQuerycontentId378)]",
+                "contentId": "[variables('huntingQueryObject378')._huntingQuerycontentId378]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject378').huntingQueryVersion378]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject378')._huntingQuerycontentId378]",
+        "contentKind": "HuntingQuery",
+        "displayName": "User Submissions by Submission State (FP)",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject378')._huntingQuerycontentId378,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject378')._huntingQuerycontentId378,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject379').huntingQueryTemplateSpecName379]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Largest Malicious Email Campaigns by Cluster_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject379').huntingQueryVersion379]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_379",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Largest Malicious Email Campaigns by Cluster",
+                "category": "Hunting Queries",
+                "query": "EmailEvents\n| where Timestamp > ago(30d)\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| summarize Messages = count(),\n            Recipients = dcount(RecipientEmailAddress),\n            SenderDomains = dcount(SenderFromDomain),\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\n            SampleSubjects = make_set(Subject, 5),\n            FirstSeen = min(Timestamp),\n            LastSeen = max(Timestamp)\n        by EmailClusterId\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\n| top 20 by Messages\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Threat Mix']=ThreatMix, ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query surfaces the largest malicious inbound email campaigns, clustered by EmailClusterId, with one row per attack wave, using the EmailEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject379')._huntingQuerycontentId379),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 379",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject379')._huntingQuerycontentId379)]",
+                "contentId": "[variables('huntingQueryObject379')._huntingQuerycontentId379]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject379').huntingQueryVersion379]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject379')._huntingQuerycontentId379]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Largest Malicious Email Campaigns by Cluster",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject379')._huntingQuerycontentId379,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject379')._huntingQuerycontentId379,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject380').huntingQueryTemplateSpecName380]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Blocked URL Clicks by Workload_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject380').huntingQueryVersion380]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_380",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Blocked URL Clicks by Workload",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nUrlClickEvents\n| where Timestamp >= TimeStart\n| where ActionType == \"ClickBlocked\"\n| make-series Teams = countif(Workload == \"Teams\"), Office = countif(Workload == \"Office\"), Email = countif(Workload == \"Email\"), Copilot = countif(Workload == \"Copilot\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises blocked Safe Links URL clicks over time broken down by the workload the click came from (Email, Teams, Office, Microsoft 365 Copilot)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject380')._huntingQuerycontentId380),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 380",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject380')._huntingQuerycontentId380)]",
+                "contentId": "[variables('huntingQueryObject380')._huntingQuerycontentId380]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject380').huntingQueryVersion380]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject380')._huntingQuerycontentId380]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Blocked URL Clicks by Workload",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject380')._huntingQuerycontentId380,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject380')._huntingQuerycontentId380,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject381').huntingQueryTemplateSpecName381]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top 20 Malicious URLs by Clicks_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject381').huntingQueryVersion381]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_381",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top 20 Malicious URLs by Clicks",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| where ThreatTypes != \"\"\n| summarize ['Click Count'] = count() by Url, ThreatTypes, ActionType, Workload\n| top 20 by ['Click Count']\n| project ['URL'] = Url, ['Threat Types'] = ThreatTypes, ['Action Type'] = ActionType, Workload, ['Click Count']\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the top 20 URLs carrying a detection ranked by the number of clicks registered, with the threat type, click action and workload for each."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject381')._huntingQuerycontentId381),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 381",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject381')._huntingQuerycontentId381)]",
+                "contentId": "[variables('huntingQueryObject381')._huntingQuerycontentId381]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject381').huntingQueryVersion381]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject381')._huntingQuerycontentId381]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top 20 Malicious URLs by Clicks",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject381')._huntingQuerycontentId381,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject381')._huntingQuerycontentId381,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject382').huntingQueryTemplateSpecName382]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Top Clicks on Malicious URLs_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject382').huntingQueryVersion382]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_382",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Top Clicks on Malicious URLs",
+                "category": "Hunting Queries",
+                "query": "// Top 20 malicious URLs by click count, with threat type, click action and workload for context.\nUrlClickEvents\n| where Timestamp > ago(30d)\n| where isnotempty(ThreatTypes)\n| summarize ClickCount = count() by Url, ThreatTypes, ActionType, Workload\n| top 20 by ClickCount\n| project Url, ThreatTypes, ActionType, Workload, ClickCount\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query lists the malicious URLs that registered the most user clicks, with threat type, click action and workload, using the UrlClickEvents table."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject382')._huntingQuerycontentId382),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 382",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject382')._huntingQuerycontentId382)]",
+                "contentId": "[variables('huntingQueryObject382')._huntingQuerycontentId382]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject382').huntingQueryVersion382]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject382')._huntingQuerycontentId382]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Top Clicks on Malicious URLs",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject382')._huntingQuerycontentId382,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject382')._huntingQuerycontentId382,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject383').huntingQueryTemplateSpecName383]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URL Click-Through by Workload_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject383').huntingQueryVersion383]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_383",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URL Click-Through by Workload",
+                "category": "Hunting Queries",
+                "query": "UrlClickEvents\n| where Timestamp > ago(30d)\n| where IsClickedThrough != \"0\"\n| where isnotempty(ThreatTypes)\n| summarize ['Click-Through Count'] = count() by Workload\n| sort by ['Click-Through Count'] desc\n| render piechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query shows malicious URL click-throughs (where the user proceeded past the Safe Links warning) broken down by the workload the click came from."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject383')._huntingQuerycontentId383),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 383",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject383')._huntingQuerycontentId383)]",
+                "contentId": "[variables('huntingQueryObject383')._huntingQuerycontentId383]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject383').huntingQueryVersion383]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject383')._huntingQuerycontentId383]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URL Click-Through by Workload",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject383')._huntingQuerycontentId383,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject383')._huntingQuerycontentId383,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject384').huntingQueryTemplateSpecName384]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "URL Threat Protection Summary_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject384').huntingQueryVersion384]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_384",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "URL Threat Protection Summary",
+                "category": "Hunting Queries",
+                "query": "let clicks = UrlClickEvents | where Timestamp > ago(30d);\nunion\n(clicks | where ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\") | summarize Count = count() | extend Details = \"Malicious Clicks Blocked\", Ord = 1),\n(clicks | where ActionType == \"ClickAllowed\" | summarize Count = count() | extend Details = \"Clicks Allowed Through\", Ord = 2),\n(clicks | summarize Count = dcount(AccountUpn) | extend Details = \"Users Clicking Links\", Ord = 3),\n(EmailUrlInfo | where Timestamp > ago(30d) | summarize Count = dcount(Url) | extend Details = \"Distinct URLs in Email\", Ord = 4)\n| sort by Ord asc\n| project Count, Details\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query summarises URL threat protection activity (Safe Links click outcomes and distinct URLs seen in email) as a set of headline metrics for the selected period."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject384')._huntingQuerycontentId384),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 384",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject384')._huntingQuerycontentId384)]",
+                "contentId": "[variables('huntingQueryObject384')._huntingQuerycontentId384]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject384').huntingQueryVersion384]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject384')._huntingQuerycontentId384]",
+        "contentKind": "HuntingQuery",
+        "displayName": "URL Threat Protection Summary",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject384')._huntingQuerycontentId384,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject384')._huntingQuerycontentId384,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject385').huntingQueryTemplateSpecName385]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Malware URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject385').huntingQueryVersion385]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_385",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Malware URL Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Malware\"\n| mv-expand MalwareMethod = parse_json(DetectionMethods).Malware to typeof(string)\n| where MalwareMethod contains \"URL\"\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by MalwareMethod\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises inbound email malware detections attributed to URL-based detection technologies over time."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject385')._huntingQuerycontentId385),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 385",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject385')._huntingQuerycontentId385)]",
+                "contentId": "[variables('huntingQueryObject385')._huntingQuerycontentId385]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject385').huntingQueryVersion385]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject385')._huntingQuerycontentId385]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Malware URL Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject385')._huntingQuerycontentId385,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject385')._huntingQuerycontentId385,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject386').huntingQueryTemplateSpecName386]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "Phishing URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject386').huntingQueryVersion386]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_386",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "Phishing URL Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where DetectionMethods has \"Phish\"\n| mv-expand PhishMethod = parse_json(DetectionMethods).Phish to typeof(string)\n| where PhishMethod contains \"URL\"\n| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by PhishMethod\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises inbound email phishing detections attributed to URL-based detection technologies over time."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject386')._huntingQuerycontentId386),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 386",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject386')._huntingQuerycontentId386)]",
+                "contentId": "[variables('huntingQueryObject386')._huntingQuerycontentId386]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject386').huntingQueryVersion386]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject386')._huntingQuerycontentId386]",
+        "contentKind": "HuntingQuery",
+        "displayName": "Phishing URL Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject386')._huntingQuerycontentId386,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject386')._huntingQuerycontentId386,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('huntingQueryObject387').huntingQueryTemplateSpecName387]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "QR Code URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('huntingQueryObject387').huntingQueryVersion387]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/savedSearches",
+              "apiVersion": "2025-07-01",
+              "name": "Microsoft_Defender_XDR_Hunting_Query_387",
+              "location": "[parameters('workspace-location')]",
+              "properties": {
+                "eTag": "*",
+                "displayName": "QR Code URL Detections Trend",
+                "category": "Hunting Queries",
+                "query": "let TimeStart = startofday(ago(30d));\nlet TimeEnd = startofday(now());\nlet qrMessages = EmailUrlInfo\n| where Timestamp >= TimeStart\n| where UrlLocation == \"QRCode\"\n| distinct NetworkMessageId;\nEmailEvents\n| where Timestamp >= TimeStart\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Url\"\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\n| summarize arg_max(Timestamp, *) by Key\n| where NetworkMessageId in (qrMessages)\n| make-series ['Phish QR Detection'] = countif(parse_json(DetectionMethods).Phish has \"URL\"), ['Malware QR Detection'] = countif(parse_json(DetectionMethods).Malware has \"URL\"), ['Spam QR Detection'] = countif(parse_json(DetectionMethods).Spam has \"URL\") default = 0 on Timestamp from TimeStart to TimeEnd step 1d\n| render timechart\n",
+                "version": 2,
+                "tags": [
+                  {
+                    "name": "description",
+                    "value": "This query visualises inbound email detections involving URLs embedded in QR codes over time, split by the threat type of the detection (phishing, malware, spam)."
+                  },
+                  {
+                    "name": "tactics",
+                    "value": "InitialAccess"
+                  },
+                  {
+                    "name": "techniques",
+                    "value": "T1566"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject387')._huntingQuerycontentId387),'/'))))]",
+              "properties": {
+                "description": "Microsoft Defender XDR Hunting Query 387",
+                "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject387')._huntingQuerycontentId387)]",
+                "contentId": "[variables('huntingQueryObject387')._huntingQuerycontentId387]",
+                "kind": "HuntingQuery",
+                "version": "[variables('huntingQueryObject387').huntingQueryVersion387]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('huntingQueryObject387')._huntingQuerycontentId387]",
+        "contentKind": "HuntingQuery",
+        "displayName": "QR Code URL Detections Trend",
+        "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject387')._huntingQuerycontentId387,'-', '1.0.0')))]",
+        "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject387')._huntingQuerycontentId387,'-', '1.0.0')))]",
+        "version": "1.0.0"
+      },
+      "condition": "[parameters('DeployHuntingQuery')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('workbookTemplateSpecName1')]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MicrosoftDefenderForOffice365detectionsandinsights Workbook with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('workbookVersion1')]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.Insights/workbooks",
+              "name": "[variables('workbookContentId1')]",
+              "location": "[parameters('workspace-location')]",
+              "kind": "shared",
+              "apiVersion": "2021-08-01",
+              "metadata": {
+                "description": "Gain extensive insight into your organization's Microsoft Defender for Office 365 protection across email and Microsoft Teams by analyzing and correlating events. \nYou can track detections and insights over time including: metrics for phish, spam, and malware, URL and URL click detection details, malicious file detections, Microsoft Teams collaboration protection (impersonation, voice phishing, and malicious URLs and files), post-delivery detections, user and admin submissions, system overrides, and actions taken by security administrators."
+              },
+              "properties": {
+                "displayName": "[parameters('workbook1-name')]",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"\\n<table style=\\\"width:100%; border-collapse:collapse; border:none;\\\">\\n  <tr style=\\\"border:none;\\\">\\n    <td style=\\\"text-align:left; border:none; font-size:28px; font-weight:bold;width:1%;\\\">\\n      Microsoft Defender for Office 365 Detections and Insights\\n    </td>\\n    <td style=\\\"text-align:right; border:none;width:1%;\\\">\\n      <img height=\\\"40\\\" src=\\\"https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b\\\">\\n\\t</td>\\n  </tr>\\n</table>\\n<table>\\n<tr>\\n<td style=\\\"text-align:left; border:none; font-size:16px; width:10%;\\\">This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.<br>It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.<br> The workbook uses data from hunting tables streamed from <a href=\\\"https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables\\\">Microsoft Defender XDR</a> via the Microsoft Sentinel Connector. Keep the data in the <a href=\\\"https://learn.microsoft.com/en-us/azure/sentinel/configure-data-retention\\\">Log Analytics workspace</a> for as long as necessary to get insights over an extended period, based on your organisation's needs.</td>\\n</tr>\\n</table>\\n\\n> \\n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \\\"...\\\" located at the end of the tab list on the right side.*\\n> \\n\\n---\\n\\n\\n\\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view.\"},\"name\":\"text - 2\",\"id\":\"d2b45ab8-a1c1-43d2-853d-290640bf4c94\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b52e081b-490e-4f30-a6e8-d047ec40df7c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::all\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"fdc46b38-9d1e-42ac-9277-c6ff62e9ccc6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultWorkspace_Internal\",\"type\":1,\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationsmanagement/solutions'\\r\\n| where name contains 'SecurityInsights'\\r\\n| project workspaceId = tostring(properties.workspaceResourceId)\\r\\n| take 1\",\"crossComponentResources\":[\"value::all\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"6e647d99-1a32-4bca-8147-403b5d37d773\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| distinct subscriptionId, location\\r\\n| summarize by value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\\r\\n| order by value asc\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"d57bcdf5-aec7-4f86-904c-67171864919b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resources | where type =~ 'Microsoft.operationsmanagement/solutions' | where name contains 'SecurityInsights' \\r\\n| parse name with \\\"SecurityInsights(\\\" label \\\")\\\" \\r\\n| project id = tostring(properties.workspaceResourceId), label, selected = iff(id =~ '{DefaultWorkspace_Internal}', true, false)\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"\"},{\"id\":\"2e238f92-709c-410b-93e0-60eab6150a75\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":7776000000},\"key\":\"2e238f92-709c-410b-93e0-60eab6150a75\"},{\"id\":\"165f2f4a-e49f-4561-adc5-d0527a4caf32\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Granularity\",\"label\":\"Trend interval\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{ \\\"value\\\": \\\"1d\\\", \\\"label\\\": \\\"Daily (1d)\\\", \\\"selected\\\": true }, { \\\"value\\\": \\\"7d\\\", \\\"label\\\": \\\"Weekly (7d)\\\" }, { \\\"value\\\": \\\"30d\\\", \\\"label\\\": \\\"Monthly (30d)\\\" }, { \\\"value\\\": \\\"90d\\\", \\\"label\\\": \\\"Quarterly (90d)\\\" }]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"1d\"}],\"style\":\"pills\"},\"name\":\"parameters - 1\",\"id\":\"0021e733-42b4-461f-8f6c-14e6e765389d\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"3d26d949-bba8-486c-9af7-2b85bd5c8ab0\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Executive Summary\",\"subTarget\":\"1\",\"style\":\"link\",\"key\":\"3d26d949-bba8-486c-9af7-2b85bd5c8ab0\"},{\"id\":\"a5f95467-84c1-4d8b-858c-7819339af748\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Malware\",\"subTarget\":\"2\",\"style\":\"link\",\"key\":\"a5f95467-84c1-4d8b-858c-7819339af748\"},{\"id\":\"b6c93de8-16d9-4c90-999b-837935de5645\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Phish\",\"subTarget\":\"3\",\"style\":\"link\",\"key\":\"b6c93de8-16d9-4c90-999b-837935de5645\"},{\"id\":\"9e006e81-4fd4-40b9-9d20-3705dd6c17ad\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Impersonation & BEC\",\"subTarget\":\"15\",\"style\":\"link\",\"key\":\"75f1e28f-e95a-4810-af40-6b47b35cda46\"},{\"id\":\"df2c53b4-b6ed-4151-95fb-b3f08b849b84\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Spam\",\"subTarget\":\"4\",\"style\":\"link\",\"key\":\"df2c53b4-b6ed-4151-95fb-b3f08b849b84\"},{\"id\":\"fd2006c9-39b5-43ac-b05d-47309ee22deb\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Teams & Collaboration\",\"subTarget\":\"14\",\"style\":\"link\",\"key\":\"fd2006c9-39b5-43ac-b05d-47309ee22deb\"},{\"id\":\"ee01f95a-c5f7-4864-82e8-54a164741ba2\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"File - Malware (SharePoint, Teams and OneDrive)\",\"subTarget\":\"9\",\"style\":\"link\",\"key\":\"ee01f95a-c5f7-4864-82e8-54a164741ba2\"},{\"id\":\"9df30067-3266-48a8-b9e3-d65952098d46\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"URL & Clicks\",\"subTarget\":\"5\",\"style\":\"link\",\"key\":\"9df30067-3266-48a8-b9e3-d65952098d46\"},{\"id\":\"b4be0ac3-3f48-44a8-b4b6-b46e17c710cd\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Top Users & Exfiltration\",\"subTarget\":\"6\",\"style\":\"link\",\"key\":\"b4be0ac3-3f48-44a8-b4b6-b46e17c710cd\"},{\"id\":\"e1d34091-7b3c-4e2d-a032-8be82a989313\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Email - Detection Overrides\",\"subTarget\":\"7\",\"style\":\"link\",\"key\":\"e1d34091-7b3c-4e2d-a032-8be82a989313\"},{\"id\":\"a1e6264d-8f85-4a94-9ffd-eee36c04a0d5\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Post-Delivery & Quarantine\",\"subTarget\":\"11\",\"style\":\"link\",\"key\":\"a1e6264d-8f85-4a94-9ffd-eee36c04a0d5\"},{\"id\":\"08c43a4f-f502-4813-9b8d-3f6b0b62b2fd\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"False Negative(FN) Submissions\",\"subTarget\":\"8\",\"style\":\"link\",\"key\":\"08c43a4f-f502-4813-9b8d-3f6b0b62b2fd\"},{\"id\":\"638d931f-f319-4914-b72d-8d68e914c7d4\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"False Positive(FP) Submissions\",\"subTarget\":\"10\",\"style\":\"link\",\"key\":\"638d931f-f319-4914-b72d-8d68e914c7d4\"},{\"id\":\"b2920bee-c32a-4fdd-9d32-b004db2f3ac8\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Operations Center (SOC) Insights\",\"subTarget\":\"13\",\"style\":\"link\",\"key\":\"b2920bee-c32a-4fdd-9d32-b004db2f3ac8\"}]},\"name\":\"links - 14\",\"id\":\"5c9a1d6b-c248-432b-a1c0-496337635775\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Defender for Office 365 - Protection Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Microsoft Defender for Office 365** is a comprehensive security solution designed to protect organizations from advanced threats targeting their email and collaboration tools. It leverages a multi-layered approach to safeguard against phishing, malware, business email compromise (BEC), and other sophisticated attacks.\\r\\n\"},\"name\":\"text - 13\",\"styleSettings\":{\"margin\":\"0\",\"padding\":\"0\"},\"id\":\"46119f93-fad9-413c-8e10-7615c6fdde2f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\n\\r\\n// Get all mailflow detected as clean at time of delivery \\r\\nlet EmailEventsClean = materialize( \\r\\n    EmailEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \\\"Inbound\\\" \\r\\n    | where ThreatTypes !contains \\\"Phish\\\" and ThreatTypes !contains \\\"Malware\\\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\\r\\n    // this alteration is due to the threat types being updated directly within advanced hunting.\\r\\n    //| where DeliveryLocation != \\\"Quarantine\\\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\\r\\n    | project NetworkMessageId,ThreatTypes \\r\\n); \\r\\n// Get all mailflow detected as phish or malware at time of delivery \\r\\nlet EmailEventsThreats = materialize( \\r\\n    EmailEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \\\"Inbound\\\" \\r\\n    | where ThreatTypes contains \\\"Phish\\\" or ThreatTypes contains \\\"Malware\\\" \\r\\n    | extend MDO_detection = parse_json(DetectionMethods) \\r\\n    | extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n    | extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \\r\\n); \\r\\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \\r\\nlet EmailPostDeliveryFiltered = materialize( \\r\\n    EmailPostDeliveryEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") or Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") \\r\\n    | extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n    | summarize arg_max(Timestamp, *) by Key \\r\\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \\r\\n); \\r\\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \\r\\nlet CloudAppEventsFiltered = materialize( \\r\\n    CloudAppEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \\r\\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \\r\\n    | where SubmissionType in (\\\"1\\\", \\\"2\\\") \\r\\n    | project SubmissionType,NetworkMessageId \\r\\n); \\r\\n// get the number of threats caught in mailflow \\r\\nlet Mal_Phish_Mailflow = toscalar( \\r\\n    EmailEventsThreats \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \\r\\nlet FP_ZAP = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ThreatTypes !contains \\\"Phish\\\" and ThreatTypes !contains \\\"Malware\\\" and Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") \\r\\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \\r\\nlet FN_ZAP_Successful = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") and ActionResult in (\\\"Success\\\",\\\"AdminPolicy\\\") \\r\\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats unsuccessfully cleaned up post delivery. \\r\\nlet FN_ZAP_Unsuccessful = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") and ActionResult !in (\\\"Success\\\",\\\"AdminPolicy\\\") \\r\\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// join the administrative submissions to clean mailflow to find the additional miss \\r\\nlet FN_Admin_Submissions = toscalar( \\r\\n    CloudAppEventsFiltered \\r\\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n    ); \\r\\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \\r\\n\\r\\nprint StatisticName=\\\"Effectiveness Post Delivery\\\", Value=abs(round(((toreal(toscalar(FN_Admin_Submissions))+toreal(toscalar(FN_ZAP_Unsuccessful)))/(toreal(toscalar(Mal_Phish_Mailflow))+toreal(toscalar(FN_ZAP_Successful))+toreal(toscalar(FN_ZAP_Unsuccessful))+toreal(toscalar(FN_Admin_Submissions))-toreal(toscalar(FP_ZAP)))*100-100),2))\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"statSettings\":{\"valueField\":\"Value\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"heatmapPalette\":\"greenRed\",\"thresholdsGrid\":[{\"operator\":\">\",\"thresholdValue\":\"95\",\"representation\":\"green\"},{\"operator\":\"<=\",\"thresholdValue\":\"95\",\"representation\":\"orange\"},{\"operator\":\"<=\",\"thresholdValue\":\"90\",\"representation\":\"red\"}]},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"tagText\":\"Phish / Malware Effectiveness - Post Delivery\",\"valueFontStyle\":\"superLarge\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"id\":\"62de2a91-a809-48ec-a111-e697d556b2b3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\\r\\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\\r\\n| where Action == \\\"Quarantine release\\\"\\r\\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \\\"Quarantine\\\") on NetworkMessageId\\r\\n| summarize count());\\r\\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \\\"Quarantine\\\"\\r\\n| summarize count());\\r\\nprint\\r\\nQuarantine_Releases = toreal(Quarantine_Releases),\\r\\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\\r\\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Release_Percentage\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},\"showBorder\":true,\"sortCriteriaField\":\"Release_Percentage\",\"size\":\"auto\"},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"statSettings\":{\"valueField\":\"Release_Percentage\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"heatmapPalette\":\"greenRed\",\"thresholdsGrid\":[{\"operator\":\"<\",\"thresholdValue\":\"5\",\"representation\":\"green\"},{\"operator\":\">\",\"thresholdValue\":\"5\",\"representation\":\"redDark\"}]},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"tagText\":\"Quarantine Release Percentage\",\"valueFontStyle\":\"superLarge\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - 1\",\"id\":\"858ac1a4-8828-45e9-968c-d3cfc1216c64\"}]},\"name\":\"TopNr\",\"id\":\"1369c97e-848b-475a-b447-3a435cb7a1f1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**Effectiveness visually represents the protection given by Defender for Office 365 against phishing and malware in email messages.** <br>\\r\\nWe consider messages that your users report, as well as decisions that are made after delivery.\"},\"name\":\"text - 9\",\"styleSettings\":{\"margin\":\"1px\"},\"id\":\"25e2e19e-aefb-4e37-b28f-b4138d63e109\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\n\\r\\n// Get all mailflow detected as clean at time of delivery \\r\\nlet EmailEventsClean = materialize( \\r\\n    EmailEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \\\"Inbound\\\" \\r\\n    | where ThreatTypes !contains \\\"Phish\\\" and ThreatTypes !contains \\\"Malware\\\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\\r\\n    // this alteration is due to the threat types being updated directly within advanced hunting.\\r\\n    //| where DeliveryLocation != \\\"Quarantine\\\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\\r\\n    | project NetworkMessageId,ThreatTypes \\r\\n); \\r\\n// Get all mailflow detected as phish or malware at time of delivery \\r\\nlet EmailEventsThreats = materialize( \\r\\n    EmailEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \\\"Inbound\\\" \\r\\n    | where ThreatTypes contains \\\"Phish\\\" or ThreatTypes contains \\\"Malware\\\" \\r\\n    | extend MDO_detection = parse_json(DetectionMethods) \\r\\n    | extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n    | extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n    | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \\r\\n); \\r\\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \\r\\nlet EmailPostDeliveryFiltered = materialize( \\r\\n    EmailPostDeliveryEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") or Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") \\r\\n    | extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n    | summarize arg_max(Timestamp, *) by Key \\r\\n    | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \\r\\n); \\r\\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \\r\\nlet CloudAppEventsFiltered = materialize( \\r\\n    CloudAppEvents \\r\\n    | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n    | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \\r\\n    | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \\r\\n    | where SubmissionType in (\\\"1\\\", \\\"2\\\") \\r\\n    | project SubmissionType,NetworkMessageId \\r\\n); \\r\\n// get the number of threats caught in mailflow \\r\\nlet Mal_Phish_Mailflow = toscalar( \\r\\n    EmailEventsThreats \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \\r\\nlet FP_ZAP = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ThreatTypes !contains \\\"Phish\\\" and ThreatTypes !contains \\\"Malware\\\" and Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") \\r\\n    | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \\r\\nlet FN_ZAP_Successful = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") and ActionResult in (\\\"Success\\\",\\\"AdminPolicy\\\") \\r\\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// get the number of threats unsuccessfully cleaned up post delivery. \\r\\nlet FN_ZAP_Unsuccessful = toscalar( \\r\\n    EmailPostDeliveryFiltered \\r\\n    | where ActionType in (\\\"Malware ZAP\\\",\\\"Phish ZAP\\\") and ActionResult !in (\\\"Success\\\",\\\"AdminPolicy\\\") \\r\\n    | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n); \\r\\n// join the administrative submissions to clean mailflow to find the additional miss \\r\\nlet FN_Admin_Submissions = toscalar( \\r\\n    CloudAppEventsFiltered \\r\\n    | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \\r\\n    | summarize count() \\r\\n    ); \\r\\n    // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \\r\\nunion withsource=Table \\r\\n    (print StatisticName=\\\"Mal/Phish Mailflow totals - Minus FPs\\\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \\r\\n    (print StatisticName=\\\"Admin Mal/Phish FNs Submitted\\\", Value=toreal(FN_Admin_Submissions)), \\r\\n    (print StatisticName=\\\"Mal/Phish FPs Reverse Zapped\\\", Value=toreal(FP_ZAP)), \\r\\n    (print StatisticName=\\\"Mal / Phish Successfully Zapped\\\", Value=toreal(FN_ZAP_Successful)), \\r\\n    (print StatisticName=\\\"Mal / Phish UN-Successfully Zapped\\\", Value=toreal(FN_ZAP_Unsuccessful)), \\r\\n    (print StatisticName=\\\"Effectiveness Post Delivery (%)\\\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \\r\\n    (print StatisticName=\\\"Effectiveness Pre-Delivery (%)\\\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))) \\r\\n| project StatisticName, Value\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Value\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"StatisticName\",\"sourceIdField\":\"Value\",\"targetIdField\":\"Value\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"hivesMargin\":5}},\"name\":\"query - 7\",\"id\":\"9e09ff94-8092-49c7-860f-341049e1398c\"}]},\"customWidth\":\"50\",\"name\":\"Effectiveness Nr\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"31081a73-9a54-4668-9e26-ad7347f1e06e\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**Quarantine release rate by detection technology.** \\r\\n<br>\\r\\nFor each detector, the share of its quarantined mail that was later released (Release % = released / quarantined). A high rate can indicate false positives worth reviewing.\"},\"name\":\"text - 1\",\"styleSettings\":{\"margin\":\"1px\"},\"id\":\"e9848043-03dd-4ada-9e73-238067463f74\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Per detection technology: the share of its quarantined emails later released from quarantine (a high rate can indicate false positives). Top 7 by release rate; detectors with <10 quarantined excluded so the rate is meaningful.\\r\\nEmailEvents\\r\\n| where DeliveryLocation == \\\"Quarantine\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods)\\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0]))\\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\")\\r\\n| where FirstSubcategory contains \\\"Malware\\\" or FirstSubcategory contains \\\"Phish\\\"\\r\\n| join kind=leftouter (\\r\\n    EmailPostDeliveryEvents\\r\\n    | where Action == \\\"Quarantine release\\\"\\r\\n    | distinct NetworkMessageId\\r\\n    | extend ReleasedFlag = \\\"yes\\\"\\r\\n  ) on NetworkMessageId\\r\\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \\\"yes\\\") by FirstSubcategory\\r\\n| where Quarantined >= 10 and Released > 0\\r\\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\\r\\n| project ['Detection Technology']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\\r\\n| order by ['Release %'] desc\\r\\n| take 7\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Quarantined Emails\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Released\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Release %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"name\":\"query - 2\",\"id\":\"1bbae9d1-d6f8-446a-817c-8fdc2df83d4c\"}]},\"customWidth\":\"50\",\"name\":\"Quarantine Overview Relese\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"36fd8f20-ece7-4889-9fb1-f5b85b97b45a\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec Protection Insights\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"1d8e22e0-22f7-453e-aed2-9e56ace1363a\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Protection details\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis Overview provides an executive summary of your Microsoft Defender for Office 365 email security posture: the volume of mail processed, threats detected and filtered (phishing, malware, spam), overall protection effectiveness, and the mix of threats targeting your organization. Use it as a starting point, then drill into the dedicated tabs for detailed investigation.\"},\"name\":\"text - 13\",\"id\":\"24cf577c-e12a-4747-95a7-1c19bee17397\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5c0f0101-0a11-4b22-9c33-000000000101\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ProtectionView\",\"label\":\"Protection view\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{ \\\"value\\\": \\\"Table\\\", \\\"label\\\": \\\"Summary table\\\", \\\"selected\\\": true }, { \\\"value\\\": \\\"Tiles\\\", \\\"label\\\": \\\"Detailed tiles\\\" }]\",\"value\":\"Tiles\"}],\"style\":\"pills\"},\"name\":\"Protection view selector\",\"id\":\"5c0f0102-0a11-4b22-9c33-000000000102\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let base = materialize(EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize arg_max(Timestamp, ThreatTypes, DeliveryAction, OrgLevelPolicy, OrgLevelAction, UserLevelAction) by Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress));\\r\\nlet agg = materialize(base | summarize\\r\\n    Total = count(),\\r\\n    Filtered = countif(isnotempty(ThreatTypes) and DeliveryAction != \\\"Delivered\\\" and OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")),\\r\\n    FMal = countif(ThreatTypes has \\\"Malware\\\" and OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")),\\r\\n    FPhish = countif(ThreatTypes has \\\"Phish\\\" and not(ThreatTypes has \\\"Malware\\\") and DeliveryAction != \\\"Delivered\\\" and OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")),\\r\\n    FSpam = countif(ThreatTypes == \\\"Spam\\\" and DeliveryAction != \\\"Delivered\\\" and OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")),\\r\\n    Deliv = countif(isnotempty(ThreatTypes) and DeliveryAction == \\\"Delivered\\\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\\r\\n    Blocked = countif(isempty(ThreatTypes) and DeliveryAction != \\\"Delivered\\\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\\r\\n    Clean = countif(isempty(ThreatTypes) and DeliveryAction == \\\"Delivered\\\"));\\r\\nlet pd = materialize(EmailPostDeliveryEvents | where ActionResult == \\\"Success\\\" | summarize MalZap = countif(ActionType == \\\"Malware ZAP\\\"), PhishZap = countif(ActionType == \\\"Phish ZAP\\\"), SpamZap = countif(ActionType == \\\"Spam ZAP\\\"));\\r\\nlet sub = materialize(CloudAppEvents | extend R = tostring(parse_json(RawEventData).RecordType), SCT = tostring(parse_json(RawEventData).SubmissionContentType) | where R == \\\"29\\\" | summarize Adm = countif(ActionType == \\\"AdminSubmissionSubmitted\\\" and SCT == \\\"Mail\\\"), Usr = countif(ActionType == \\\"UserSubmission\\\"));\\r\\nlet Total = toscalar(agg | project Total);\\r\\nlet Filtered = toscalar(agg | project Filtered);\\r\\nlet FMal = toscalar(agg | project FMal);\\r\\nlet FPhish = toscalar(agg | project FPhish);\\r\\nlet FSpam = toscalar(agg | project FSpam);\\r\\nlet Deliv = toscalar(agg | project Deliv);\\r\\nlet Blocked = toscalar(agg | project Blocked);\\r\\nlet Clean = toscalar(agg | project Clean);\\r\\nlet MalZap = toscalar(pd | project MalZap);\\r\\nlet PhishZap = toscalar(pd | project PhishZap);\\r\\nlet SpamZap = toscalar(pd | project SpamZap);\\r\\nlet Adm = toscalar(sub | project Adm);\\r\\nlet Usr = toscalar(sub | project Usr);\\r\\nunion\\r\\n    (print o = 1, Name = \\\"Total Inbound Emails\\\", Count = Total),\\r\\n    (print o = 2, Name = \\\"    Filtering Totals\\\", Count = Filtered),\\r\\n    (print o = 3, Name = \\\"        Filtered as Malware\\\", Count = FMal),\\r\\n    (print o = 4, Name = \\\"        Filtered as Phish\\\", Count = FPhish),\\r\\n    (print o = 5, Name = \\\"        Filtered as Spam\\\", Count = FSpam),\\r\\n    (print o = 6, Name = \\\"    Delivered with Detection\\\", Count = Deliv),\\r\\n    (print o = 7, Name = \\\"    User/Admin Blocked\\\", Count = Blocked),\\r\\n    (print o = 8, Name = \\\"    Clean Emails\\\", Count = Clean),\\r\\n    (print o = 9, Name = \\\"Post-Delivery ZAP Removals\\\", Count = MalZap + PhishZap + SpamZap),\\r\\n    (print o = 10, Name = \\\"    Removed by Malware ZAP\\\", Count = MalZap),\\r\\n    (print o = 11, Name = \\\"    Removed by Phish ZAP\\\", Count = PhishZap),\\r\\n    (print o = 12, Name = \\\"    Removed by Spam ZAP\\\", Count = SpamZap),\\r\\n    (print o = 13, Name = \\\"User/Admin Reported\\\", Count = Adm + Usr),\\r\\n    (print o = 14, Name = \\\"    Reported by Admins\\\", Count = Adm),\\r\\n    (print o = 15, Name = \\\"    Reported by Users\\\", Count = Usr)\\r\\n| sort by o asc\\r\\n| extend [\\\"% of Inbound\\\"] = round(Count * 100.0 / Total, 1)\\r\\n| project Name, Count, [\\\"% of Inbound\\\"]\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Name\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"3fr\"}},{\"columnMatch\":\"Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"3fr\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"% of Inbound\",\"formatter\":3,\"formatOptions\":{\"palette\":\"green\",\"min\":0,\"max\":100,\"customColumnWidthSetting\":\"2fr\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"ProtectionView\",\"comparison\":\"isEqualTo\",\"value\":\"Table\"},\"name\":\"query - option 1 grid\",\"id\":\"5c0f0005-0a11-4b22-9c33-000000000005\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Emails\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| summarize Count = count()\\r\\n| extend Details = \\\"Total Inbound Emails\\\";\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"greenRed\"}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\"}}},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"blue\",\"compositeBarSettings\":{\"labelText\":\"\"}},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}},\"chartSettings\":{\"xAxis\":\"Count\",\"createOtherGroup\":0},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"Count\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"Count\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"Count\",\"heatmapPalette\":\"greenRed\"}}},\"name\":\"query - 1\",\"id\":\"84e8d60b-7937-46f5-b2f4-a1a4adf06c9f\"}]},\"name\":\"Total Inbound\",\"id\":\"1aeed046-9ea5-4583-b966-722847997fc7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Filtering Totals\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| where isnotempty(ThreatTypes) and EmailDirection == \\\"Inbound\\\" and DeliveryAction != 'Delivered'\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| summarize Count = count()\\r\\n| extend Details = \\\"Filtering Totals\\\";\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\"}}},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"redDark\",\"compositeBarSettings\":{\"labelText\":\"\"}},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"name\":\"query - 1\",\"id\":\"bae9a200-589f-4ca6-a3cf-f1110f644c49\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Total emails detected as Malware\\r\\nEmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| where ThreatTypes has ('Malware') and EmailDirection == \\\"Inbound\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Emails Filtered as Malware\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"red\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 4\",\"id\":\"0984d05b-fd2c-48e1-835f-41afc5a2385a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Total emails detected as Phish\\r\\nEmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| where ThreatTypes has \\\"Phish\\\" and not(ThreatTypes has \\\"Malware\\\") and EmailDirection == \\\"Inbound\\\" and DeliveryAction != 'Delivered'\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Emails Filtered as Phish\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"orange\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 4\",\"id\":\"ced2d054-76d1-40df-a412-0bc86a6c3336\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Total emails by detected as Spam\\r\\nEmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| where ThreatTypes == 'Spam' and EmailDirection == \\\"Inbound\\\" and DeliveryAction != 'Delivered'\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Emails Filtered as Spam\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"yellow\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 4\",\"id\":\"14456a0d-f5ac-46a0-a007-c72c7c40c58f\"}]},\"customWidth\":\"50\",\"name\":\"group - 9\",\"id\":\"d4e69885-f1b2-4c2b-85c2-188a6708dc4b\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\" \",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and DeliveryAction == 'Delivered'\\r\\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Delivered with Detection\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"red\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"394d1ed4-7089-4291-bc80-f9948e3be6a9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\" and isempty(ThreatTypes) \\r\\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\\r\\n| where DeliveryAction != 'Delivered'\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"User/Admin Blocked\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"gray\"},\"tooltipFormat\":{\"tooltip\":\"Emails blocked from being delivered because of User or Admin overriddes\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"c29a2268-67d1-4958-a9a3-696384075987\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailEvents\\r\\n| where isempty(ThreatTypes) and EmailDirection == \\\"Inbound\\\" and DeliveryAction == 'Delivered'\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key \\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Clean Emails\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"gray\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"89a02ac7-971c-4672-bf5d-64709c479536\"}]},\"customWidth\":\"50\",\"name\":\"group - 8\",\"id\":\"761e74d4-279e-465f-ba47-5eeec4cf05d2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Post-Delivery ZAP Removals\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailPostDeliveryEvents\\r\\n| where ActionResult == \\\"Success\\\"\\r\\n| where ActionType == \\\"Malware ZAP\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Removed by Malware ZAP\\\"\\r\\n\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"red\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"b06666bc-6ec0-49e7-a332-77e278d2320f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailPostDeliveryEvents\\r\\n| where ActionResult == \\\"Success\\\"\\r\\n| where ActionType == \\\"Phish ZAP\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Removed by Phish ZAP\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"orange\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"6fbac01b-0c42-46dc-8ca8-68e285593a45\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"EmailPostDeliveryEvents\\r\\n| where ActionResult == \\\"Success\\\"\\r\\n| where ActionType == \\\"Spam ZAP\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Removed by Spam ZAP\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":1,\"palette\":\"yellow\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"33.3\",\"name\":\"query - 3\",\"id\":\"7bd27a3b-be13-4ca0-9964-0f872f826b45\"}]},\"name\":\"Post Delivery\",\"id\":\"4d20339e-5215-4edf-99d6-728cac183d16\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\\r\\nCloudAppEvents\\r\\n| extend Record= (parse_json(RawEventData)).RecordType\\r\\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Reported by Admins\\\"\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"50\",\"name\":\"query - 3\",\"id\":\"7490fa3a-e287-4fc3-b025-8772b9edb601\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\\r\\nCloudAppEvents\\r\\n| extend Record= (parse_json(RawEventData)).RecordType\\r\\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\\r\\n| where Record == 29 and ActionType == \\\"UserSubmission\\\"\\r\\n| summarize Count= count()\\r\\n| extend Details = \\\"Total Emails Reported by Users\\\"\\r\\n\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\",\"styleSettings\":{\"borderStyle\":\"rounded\",\"backgroundColor\":\"colorGray100\"}}},\"customWidth\":\"50\",\"name\":\"query - 2\",\"id\":\"7af222dc-fd74-40ec-8ab7-741e179c07bf\"}]},\"name\":\"Reported\",\"id\":\"8151e242-1c30-4550-ae9c-83f159e1a456\"}]},\"conditionalVisibility\":{\"parameterName\":\"ProtectionView\",\"comparison\":\"isEqualTo\",\"value\":\"Tiles\"},\"name\":\"Protection - Tiles view\",\"id\":\"5c0f0103-0a11-4b22-9c33-000000000103\"},{\"type\":1,\"content\":{\"json\":\"## Most Attacked Users<br>\\r\\n\\r\\n**The users most targeted by inbound email threats across all threat types (malware, phishing, and spam) in the selected period. Concentrated targeting of a few individuals is a strong signal of deliberate campaigns.**<br><br>**Recommended action:** Prioritise these users for security awareness training, tighter protection policies (for example the Strict preset), and closer monitoring - they are your highest-risk people.\"},\"name\":\"exec vap banner\",\"id\":\"1fe431fb-cc96-4e81-b164-3a1a3823ebeb\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query surfaces the users most targeted by inbound email threats across all threat types (malware, phishing, spam) for the selected period, so SecOps can prioritise the highest-risk individuals. Similar to a \\\"Most Attacked People\\\" view.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| where isnotempty(ThreatTypes)\\r\\n| summarize\\r\\n    ['Total Threats'] = count(),\\r\\n    Malware = countif(ThreatTypes has \\\"Malware\\\"),\\r\\n    Phish   = countif(ThreatTypes has \\\"Phish\\\"),\\r\\n    Spam    = countif(ThreatTypes has \\\"Spam\\\"),\\r\\n    ['Last Seen'] = max(Timestamp)\\r\\n    by ['User']=RecipientEmailAddress\\r\\n| top 10 by ['Total Threats']\\r\\n| project ['User'], ['Total Threats'], Malware, Phish, Spam, ['Last Seen']\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Malware\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"145px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Phish\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"145px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Spam\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"145px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Total Threats\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"145px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"exec vap table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"2dfd91b1-b8d3-4a72-aaf4-a30a1886bed7\"},{\"type\":1,\"content\":{\"json\":\"## Detection trend over time - grouped by {Granularity}\\r\\n**Represents total emails, total detections, total user submissions and admin email submissions over time summarizing the data per {Granularity} interval**\"},\"name\":\"text - 14\",\"id\":\"ddbbdaef-b374-42a8-821c-7fcd7ee53ba9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails, total detections, total user, and admin email submissions over time summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet scaffold = range Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran;\\r\\nlet baseQuery = materialize(EmailEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where isnotempty(Timestamp));\\r\\nlet sub = materialize(CloudAppEvents\\r\\n| extend Record = (parse_json(RawEventData)).RecordType, SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29);\\r\\nlet zapbase = EmailPostDeliveryEvents\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ActionResult == \\\"Success\\\"\\r\\n| where ActionType == \\\"Phish ZAP\\\" or ActionType == \\\"Malware ZAP\\\" or ActionType == \\\"Spam ZAP\\\";\\r\\nunion\\r\\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \\\"Inbound\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Inbound Emails\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Phish') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Emails Detected as Phish\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Malware') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Emails Detected as Malware\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Spam') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Emails Detected as Spam\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \\\"Intra-org\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Intra-org Emails\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \\\"Outbound\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Outbound Emails\\\"),\\r\\n(scaffold | join kind=leftouter (baseQuery | where isnotempty(ThreatTypes) | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Emails with Threat\\\"),\\r\\n(scaffold | join kind=leftouter (sub | where ActionType == \\\"UserSubmission\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Emails Reported by Users\\\"),\\r\\n(scaffold | join kind=leftouter (zapbase | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Emails Removed by ZAP\\\"),\\r\\n(scaffold | join kind=leftouter (sub | where ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType == \\\"Mail\\\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \\\"Total Emails Reported by Admins\\\")\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\",\"seriesLabelSettings\":[{\"seriesName\":\"Total Inbound Emails\",\"label\":\"Inbound Emails\",\"color\":\"green\"},{\"seriesName\":\"Total Emails with Threat\",\"label\":\"Emails with Threat\",\"color\":\"redDark\"},{\"seriesName\":\"Emails Detected as Phish\",\"label\":\"Emails with Phish\",\"color\":\"redBright\"},{\"seriesName\":\"Emails Detected as Malware\",\"label\":\"Emails with Malware\",\"color\":\"red\"},{\"seriesName\":\"Total Intra-org Emails\",\"label\":\"Intra-org Emails\",\"color\":\"greenDark\"},{\"seriesName\":\"Emails Detected as Spam\",\"label\":\"Emails with Spam\",\"color\":\"gray\"},{\"seriesName\":\"Total Outbound Emails\",\"label\":\"Outbound Emails\",\"color\":\"greenDarkDark\"},{\"seriesName\":\"Total Emails Removed by ZAP\",\"label\":\"Emails ZAP-d\",\"color\":\"orangeDark\"},{\"seriesName\":\"Total Emails Reported by Users\",\"label\":\"User Reported Emails\",\"color\":\"lightBlue\"},{\"seriesName\":\"Total Emails Reported by Admins\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"bcbefa48-f553-4290-acff-2691caf898ea\"},{\"type\":1,\"content\":{\"json\":\"## Bad traffic (%) - Inbound Emails - grouped by {Granularity}\\r\\n**This represents bad traffic (% of emails with threats) compared to total inbound emails, summarized per {Granularity} interval over time.**\"},\"name\":\"text - 15\",\"id\":\"30761bcc-b1a5-45e2-8c0a-22388fbbf16c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalEmailCount = count(),\\r\\n            BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, {Granularity})\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| project Timestamp, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":0,\"aggregation\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"508036a8-d969-44c2-b2d2-c62d99999197\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec Protection Details\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"e6edeeeb-dcde-41d0-88c7-97ef773403b1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Collaboration Protection Posture\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Defender for Office 365 protects Microsoft Teams and collaboration, not only email. This snapshot shows Teams threat activity for the period.<br><br>**Recommended action:** Review the dedicated **Teams &amp; Collaboration** tab for impersonation, malicious URLs, risky senders and file threats in Teams.\"},\"name\":\"exec collab banner\",\"id\":\"3d78a6aa-51d4-4cab-93d1-26dff86fd667\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Headline Microsoft Teams / collaboration protection metrics for the executive summary, with per-interval sparklines so the collaboration threat trend is visible at a glance. Messages and URLs are counted per distinct Teams message.\\r\\nlet gran = {Granularity};\\r\\nlet me = materialize(MessageEvents);\\r\\nlet cae = materialize(CloudAppEvents | where ActionType == \\\"TeamsImpersonationDetected\\\");\\r\\nlet mui = materialize(MessageUrlInfo);\\r\\nlet uce = materialize(UrlClickEvents | where Workload == \\\"Teams\\\" and ActionType in (\\\"ClickBlocked\\\",\\\"ClickBlockedByTenantPolicy\\\"));\\r\\nlet fmc = materialize(FileMaliciousContentInfo | where Workload == \\\"MicrosoftTeams\\\");\\r\\nunion\\r\\n(me | summarize Count = dcount(TeamsMessageId) | extend Details = \\\"Teams Messages Scanned\\\", Ord = 1, Trend = toscalar(me | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(me | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Teams Threat Messages\\\", Ord = 2, Trend = toscalar(me | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(cae | summarize Count = count() | extend Details = \\\"Teams Impersonation Detections\\\", Ord = 3, Trend = toscalar(cae | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(mui | summarize Count = dcount(TeamsMessageId) | extend Details = \\\"URLs Shared in Teams\\\", Ord = 4, Trend = toscalar(mui | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(uce | summarize Count = count() | extend Details = \\\"Malicious Clicks Blocked\\\", Ord = 5, Trend = toscalar(uce | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(fmc | summarize Count = count() | extend Details = \\\"Teams Files Scanned\\\", Ord = 6, Trend = toscalar(fmc | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(fmc | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Malicious Teams Files\\\", Ord = 7, Trend = toscalar(fmc | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S))\\r\\n| sort by Ord asc\\r\\n| project Details, Count, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"name\":\"exec collab tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3175aee5-56d2-4cb1-b1c3-75be683e6ffb\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec Collaboration Posture\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"39b0921f-fcef-49f4-8d52-0dcd1f33045b\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Emerging Threats\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n<p style=\\\"font-size:16px;\\\">With more sophisticated adversaries and new threats emerging frequently and prevalently, it's critical to be able to quickly identify and react to these threats.</p>\\r\\n\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️Activity Profile: Email threat landscape</b></p>](https://security.microsoft.com/threatanalytics3/f186e4b0-28df-499a-901e-c64768b6d0dc/overview?filters=tags%253DPhishing)\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️Activity Profile: Automated business email impersonation campaign uses parallel aging report and payroll diversion lures</b></p>](https://security.microsoft.com/threatanalytics3/3eb53378-892d-4695-a497-25d0a54181ee)\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️Tool Profile: StealC</b></p>](https://security.microsoft.com/threatanalytics3/4d837c12-1db4-49c8-8466-219198d40b9b)\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️OSINT Profile: UNC1151/Ghostwriter phishing campaign targeting Gmail accounts</b></p>](https://security.microsoft.com/threatanalytics3/b1a7e5e7-4b43-4758-8805-f714a131161a)\\r\\n[<p style=\\\"font-size:16px;\\\"><b>🛡️Activity Profile: Encrypted message campaign targets real estate/financial sectors</b></p>](https://security.microsoft.com/threatanalytics3/651d669a-4721-42ab-bb96-509e94b5bfd9)\\r\\n\\r\\n<br>\\r\\n<a href=\\\"https://go.microsoft.com/fwlink/?linkid=2323913\\\" target=\\\"_blank\\\" style=\\\"font-size:14px; padding:10px 20px; background-color:#003366; color:white; border:none; border-radius:5px;\\\">\\r\\n<b>View all\\r\\n \\r\\n</a>\\r\\n\"},\"name\":\"text - 10\",\"styleSettings\":{\"margin\":\"0\",\"padding\":\"0\"},\"id\":\"0c781e85-af9a-41a6-9cf7-b3bb9a09d5d0\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec Emerging Threats\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"4f8886d3-882a-4c14-ab7f-a37bd302e32f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Microsoft 365 Secure Email Gateway Performance\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n<p style=\\\"font-size:16px;\\\">Using multiple vendor email security products can offer diverse detections. However, our comprehensive end-to-end approach—spanning prevention, detection, posture, investigation, response, and user training—delivers a unified and effective defense that matches or exceeds the efficacy of siloed Secure Email Gateway solutions.</p>\\r\\n\\r\\n[<p style=\\\"font-size:18px;\\\"><b>Learn more</b></p>](https://www.microsoft.com/en-us/security/blog/2026/06/15/microsoft-defender-email-security-benchmarking-key-insights-from-one-year-of-data/) \\r\\n\\r\\n<br>\\r\\n<p style=\\\"font-size:16px;\\\"><b>High-severity email threats missed per 1,000 users protected - February–April 2026 (Microsoft Defender email security benchmarking)</b></p>\"},\"name\":\"text - 12\",\"id\":\"94c804f9-2860-4768-be59-fb31a4ff22d7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"datatable(Index:int, Name:string, Value:int)\\r\\n[\\r\\n    1, \\\"Defender for Office 365\\\", 194,\\r\\n    2, \\\"Mimecast\\\", 478,\\r\\n    3, \\\"ProofPoint\\\", 483,\\r\\n    4, \\\"HornetSecurity\\\", 813,\\r\\n    5, \\\"TrendMicro\\\", 1151,\\r\\n    6, \\\"IronPort\\\", 1274,\\r\\n    7, \\\"Barracuda\\\", 1585,\\r\\n    8, \\\"FireEye\\\", 2107\\r\\n]\\r\\n| project [\\\"Email security solution\\\"] = Name, [\\\"High-severity threats missed / 1K users\\\"] = Value\\r\\n| order by [\\\"High-severity threats missed / 1K users\\\"] asc\\r\\n\",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Email security solution\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"High-severity threats missed / 1K users\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"min\":0,\"max\":2107,\"customColumnWidthSetting\":\"60%\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}],\"rowLimit\":10,\"sortBy\":[{\"itemKey\":\"High-severity threats missed / 1K users\",\"sortOrder\":1}]}},\"name\":\"query - 11\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e54fd5bd-17e2-40dc-897d-8a3bb21116ff\"}]},\"customWidth\":\"100\",\"name\":\"group - Exec SEG Performance\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"1f3a7e2b-0a1f-48ba-9da3-e7531d500938\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"id\":\"ab3756d3-3f60-4024-9376-0f1a7d47ac13\",\"type\":1,\"name\":\"text - 18\",\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Stay Current\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n<br>\\r\\n\\r\\n- **Threat Analytics (Defender XDR)** — live, tenant-specific threat intelligence and recommended actions: <a href=\\\"https://learn.microsoft.com/en-us/defender-xdr/threat-analytics\\\" target=\\\"_blank\\\">aka.ms/threatanalytics</a>\\r\\n- **Microsoft Security Blog** — campaign write-ups and threat research: <a href=\\\"https://www.microsoft.com/en-us/security/blog/\\\" target=\\\"_blank\\\">microsoft.com/security/blog</a>\\r\\n- **Microsoft Defender for Office 365 Tech Community blog** — product updates and reporting guidance: <a href=\\\"https://techcommunity.microsoft.com/category/microsoft-defender-for-office-365/blog/microsoftdefenderforoffice365blog\\\" target=\\\"_blank\\\">Tech Community</a>\\r\\n- **Latest features in Microsoft Defender for Office 365** — <a href=\\\"https://learn.microsoft.com/en-us/defender-office-365/defender-for-office-365-whats-new\\\" target=\\\"_blank\\\">What's new in Microsoft Defender for Office 365</a> \\r\\n- **Share reporting feedback**: <a href=\\\"https://aka.ms/mdoreportingfeedback\\\" target=\\\"_blank\\\">aka.ms/mdoreportingfeedback</a>\\r\\n\"}}]},\"customWidth\":\"100\",\"name\":\"group - Exec Stay Current\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"5e22c565-cd2e-41f3-8d5a-0735af67c93f\"}],\"exportParameters\":true},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Detection Overview\",\"styleSettings\":{\"margin\":\"0\",\"padding\":\"0\"},\"id\":\"3f2cc277-9eb3-486d-a1f8-9fa5374a3d80\"},{\"type\":1,\"content\":{\"json\":\"# Malware detection insights\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **malware threat** (such as viruses, spyware, or ransomware) within its **URLs** or **attachments**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"text - 13\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"81f28ffc-b69e-4960-a61c-cac17a012ed6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of inbound email malware detections for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet mal = EmailEvents | where EmailDirection == \\\"Inbound\\\" | where ThreatTypes has \\\"Malware\\\";\\r\\nlet inbox = mal | where DeliveryLocation has \\\"Inbox\\\";\\r\\nlet malTrend = toscalar(mal | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(mal | summarize count()), Details = \\\"Malware Emails\\\", Ord = 1, Trend = malTrend),\\r\\n(print Count = toscalar(mal | summarize dcount(RecipientEmailAddress)), Details = \\\"Users Targeted\\\", Ord = 2, Trend = malTrend),\\r\\n(print Count = toscalar(mal | summarize dcount(SenderFromDomain)), Details = \\\"Sender Domains\\\", Ord = 3, Trend = malTrend),\\r\\n(print Count = toscalar(inbox | summarize count()), Details = \\\"Delivered to Inbox\\\", Ord = 4, Trend = inboxTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"malware kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"20c06dd3-5025-4b2b-960e-ff012f5d2343\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Malware Detection Trends, Threat Classes, and Malware Names\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend, threat classes and Malware types. \\r\\n<br><br>**Recommended action:** If malware volume spikes, confirm Safe Attachments (Block mode) is enabled for all users and investigate the top malware families below.\"},\"name\":\"text - 14\",\"id\":\"1f09c6ec-b2de-4aa9-bd8e-81d11c92ebd4\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detection Trend\\r\\n**This visual displays a per-{Granularity} trend of email malware detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for malware threats.**\"},\"name\":\"text - Malware Trend header\",\"id\":\"e90b714f-de84-4571-9a60-b3b2f3bd09dd\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents \\r\\n| where ThreatTypes has \\\"Malware\\\" \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize MalwareDetections = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, MalwareDetections = coalesce(MalwareDetections, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"MalwareDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 0\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"350d0aa3-c093-4105-a150-c20111ac2912\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detection Trend - Advanced Threats\\r\\n**Not all threats are going to be easily recognisable, that's why Microsoft Defender for Office 365 has advanced threat detection methods, that use virtual sandbox environments to detonate URLs and Files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Malware detections of these advanced threats**\"},\"name\":\"text - Malware Advanced Threats header\",\"id\":\"12e07248-ada4-41d9-99cc-824eb65cff79\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Malware'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand MalwareMethod = ParsedMethods.Malware\\r\\n| where MalwareMethod in ('File detonation','URL detonation')\\r\\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\\r\\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\\r\\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\\r\\n| sort by MalwareMethod asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"File detonation\",\"color\":\"redDark\"},{\"seriesName\":\"URL detonation\",\"color\":\"orangeDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 9\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"ebcb6f29-02be-4dd0-b792-cd99285c29d4\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Threat Classification\\r\\n**Summary of email messages detected by Microsoft Defender for Office 365 as malware, grouped by type of malware (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware).**\"},\"customWidth\":\"33\",\"name\":\"text - 15\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5638fc51-0830-4675-87d4-82f03df17bbf\"},{\"type\":1,\"content\":{\"json\":\"### Top Attacked Users by Malware Threat Classification\\r\\n**Displays the recipient most frequently targeted for each malware type (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware) in inbound email detections.**\"},\"customWidth\":\"33\",\"name\":\"text - 15 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d2e3903b-4984-40da-a437-3d6a2b121e23\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Threat Name\\r\\n**Summarises email messages flagged by Microsoft Defender for Office 365, grouped by specific malware names detected in URLs or attachments.**\"},\"customWidth\":\"33\",\"name\":\"text - 15 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6c0bebcf-9838-4385-ab3a-30db6c994284\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by threat classification of the malware threat in the message.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where ThreatTypes has 'Malware' and ThreatClassification  has_any(\\\"Adware\\\",\\\"Downloader\\\",\\\"HackTool\\\",\\\"Ransomware\\\",\\\"Remote access trojan\\\",\\\"Spyware\\\")\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Count = count(Key) by ThreatClassification\\r\\n| sort by Count desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"33\",\"name\":\"query - 11\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"acb98530-8e3a-4383-b42f-8fd74b1c3fbe\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Malware detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where ThreatTypes has \\\"Malware\\\" and EmailDirection == \\\"Inbound\\\" and ThreatClassification has_any(\\\"Adware\\\",\\\"Downloader\\\",\\\"HackTool\\\",\\\"Ransomware\\\",\\\"Remote access trojan\\\",\\\"Spyware\\\")\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\\r\\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\\r\\n| sort by Count desc\\r\\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"TopEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true},\"statSettings\":{\"valueField\":\"RecipientEmailAddress\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"auto\"},\"chartSettings\":{\"xAxis\":\"RecipientEmailAddress\"}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 5 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d9b46c97-91ce-4d64-aca6-3126ac49c0ff\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.\\r\\nEmailEvents \\r\\n| where isnotempty(ThreatNames) and ThreatTypes has \\\"Malware\\\" \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , \\\"-\\\", RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| mv-expand ThreatName = split(ThreatNames, \\\",\\\") to typeof(string)\\r\\n| where isnotempty(ThreatName)\\r\\n| distinct Key, ThreatName\\r\\n| summarize Count = count() by ThreatName\\r\\n| top 15 by Count\\r\\n| project ['Threat Name'] = ThreatName, Count\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"xAxis\":\"ThreatNames\",\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b9a4b34f-f54f-4d6e-bb20-81925d0f5540\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"group - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"82853a93-e11f-4e4a-80f4-733850a1d3ff\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Malware Detections by Delivery Location, Detection Technology and Sender Infrastructure Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain malware detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Malware. \\r\\n<br><br>**Recommended action:** For sender IPs or countries you do not do business with, consider connection filtering or geo-based rules; verify the detection technologies catching these are enabled.\"},\"name\":\"banner - Malware Delivery Detection Sender\",\"id\":\"cba6403d-e2b1-4fe8-af52-57e5c2aa8e54\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by delivery location\\r\\n**Visualizes counts (per {Granularity}) of malware detections of inbound emails by delivery location: Quarantine or Failed (rejected with or without NDR)**\"},\"name\":\"text - Malware Delivery Location header\",\"id\":\"95be7f48-40eb-4154-91d8-20f7033f2ff5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Malware' and EmailDirection == 'Inbound'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalMalwareDetections=count(), Quarantine=countif(DeliveryLocation == 'Quarantine'), Failed=countif(DeliveryLocation == 'Failed') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, TotalMalwareDetections=coalesce(TotalMalwareDetections,0), Quarantine=coalesce(Quarantine,0), Failed=coalesce(Failed,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalMalwareDetections\",\"color\":\"blue\"},{\"seriesName\":\"Quarantine\",\"color\":\"orangeDark\"},{\"seriesName\":\"Failed\",\"color\":\"redDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 10\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b2c19e58-2123-490b-9631-c0b238c582e6\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Detection Technology\\r\\n**Visualizes counts (per {Granularity}) of Malware detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**\"},\"name\":\"text - Malware Detection Technology header\",\"id\":\"f3c2691e-4f32-4109-9524-8a11719e4425\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Malware'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand MalwareMethod = ParsedMethods.Malware\\r\\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\\r\\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\\r\\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\\r\\n| sort by MalwareMethod asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"66\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 8\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f00c1ce0-e55e-44c0-8bf0-4af662ccef89\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.\\r\\nEmailEvents \\r\\n| where DetectionMethods has 'Malware'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand MalwareMethod = ParsedMethods.Malware\\r\\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod)\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = MalwareMethod, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"34\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"590880a9-1cf7-44ae-b4de-2f65bc700b5d\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by SenderIPv4 Geo Location\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Malware, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"name\":\"text - Malware Geo Location header\",\"id\":\"19d78b48-af58-4bee-abfe-57efb1eba125\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by email sender IP address (SenderIPv4).\\r\\nEmailEvents \\r\\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_\",\"size\":0,\"showAnalytics\":true,\"title\":\"Malware Detections-Sender Heatmap (IPv4)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"count_\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"count_\",\"sortOrder\":2}],\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"GeoInfo\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8cb46ec0-ac2a-41d1-bf8a-0b8585d1fefc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Malware Emails'] = count_\\r\\n| sort by ['Malware Emails'] desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Malware Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"GeoInfo\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - 1 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b6a0355a-2b8f-48a5-8edc-58f4f7f8180a\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"Malware-Detectiontech-Deliverylocation-SendingInfra\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"2692cb5e-825c-45c1-bd3a-096b55e8d760\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Malware Detections Top attacked users and top senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders. \\r\\n<br><br>**Recommended action:** Apply the Strict preset security policy to the most-attacked users and consider adding persistent malicious sender domains to the Tenant Allow/Block List.\"},\"name\":\"banner - Malware Top Users Senders\",\"id\":\"bc5b37a4-71e4-4a2f-b0ba-b3dd87333391\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections top attacked users\\r\\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Malware. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**\"},\"customWidth\":\"100\",\"name\":\"text - Malware Top Users header\",\"id\":\"cb87a026-ad03-45cc-887e-ab460490d9a5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails with Malware detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(ThreatTypes has \\\"Malware\\\") by RecipientEmailAddress\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| where MalwareEmailCount !=0\\r\\n| top 15 by MalwareEmailCount\\r\\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Malware Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - Malware Top Recipients\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e7ffef62-f85e-4188-8ab9-d90a5c666c30\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains with Malware Detections (Inbound)\\r\\n**Displays the top 10 sender domains sending inbound emails detected as Malware. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Malware Top Senders header\",\"id\":\"93390807-25b2-4bea-9648-98e821da8ec6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \\\"Malware\\\") by SenderFromDomain\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| where MalwareEmailCount !=0\\r\\n| top 15 by MalwareEmailCount\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Malware Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"BadEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"query - Malware Top Sender Domains\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"eaa45734-2df2-4a5e-b35b-1295e00cb46f\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"MalwareTopAttackedUser-TopSenders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"4e0900ab-e7e4-4cf1-93a4-7e86bca20782\"},{\"type\":1,\"content\":{\"json\":\"# Phishing Detection Insights\\r\\n\\r\\n---\\r\\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Phishing threat** within its **email content**, **URLs**, or **attachments**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"text - 24\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fe82d665-fa9e-4fc2-9ba9-7e2eabb9a04b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of inbound email phishing detections for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet ph = EmailEvents | where EmailDirection == \\\"Inbound\\\" | where ThreatTypes has \\\"Phish\\\";\\r\\nlet inbox = ph | where DeliveryLocation has \\\"Inbox\\\";\\r\\nlet phTrend = toscalar(ph | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(ph | summarize count()), Details = \\\"Phish Emails\\\", Ord = 1, Trend = phTrend),\\r\\n(print Count = toscalar(ph | summarize dcount(RecipientEmailAddress)), Details = \\\"Users Targeted\\\", Ord = 2, Trend = phTrend),\\r\\n(print Count = toscalar(ph | summarize dcount(SenderFromDomain)), Details = \\\"Sender Domains\\\", Ord = 3, Trend = phTrend),\\r\\n(print Count = toscalar(inbox | summarize count()), Details = \\\"Delivered to Inbox\\\", Ord = 4, Trend = inboxTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"phish kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5debf0b8-4384-485b-8a7f-71ead592718a\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%;\\\">Phishing Detection Trend, LLM Content Analysis, Advanced Threats, and Threat Classes\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends, advanced threat detections, LLM-based content analysis, and threat classes.<br><br>**Recommended action:** Review the LLM-classified phishing themes; enable Safe Links and impersonation protection, and prioritise awareness training on the dominant lure types.\"},\"name\":\"text - Phish Section1 Banner\",\"id\":\"ce5e489f-c83b-4bc8-9e63-b08dfb5ef31f\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detection Trend<br>\\r\\n\\r\\n**This visual displays a per-{Granularity} trend of email Phish detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Phish threats.**\"},\"name\":\"text - Phish Trend Header\",\"id\":\"429ef4d2-61a9-40d0-940f-2212ddce22ce\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections over time summarizing the data daily.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has \\\"Phish\\\"\\r\\n| summarize PhishDetections = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, PhishDetections = coalesce(PhishDetections, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"PhishDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b0d170ec-331c-4ad0-8ce6-258704cc5345\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detection Trend - Advanced Threats<br>\\r\\n\\r\\n**Not all threats are easily recognizable, which is why Microsoft Defender for Office 365 uses advanced detection methods, including virtual sandbox environments to detonate URLs and files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Phish detections of these advanced threats.**\"},\"name\":\"text - Phish AdvThreats Header\",\"id\":\"425476e0-066a-42ee-afb9-5dabc612a3c8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| project Timestamp, RecipientEmailAddress, NetworkMessageId, DT=parse_json(DetectionMethods)\\r\\n| evaluate bag_unpack(DT)\\r\\n| summarize [\\\"File detonation\\\"]=countif(Phish has 'File detonation' and Phish !has 'File detonation reputation'), [\\\"URL detonation\\\"]=countif(Phish has 'URL detonation' and Phish !has 'URL detonation reputation') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, [\\\"File detonation\\\"]=coalesce([\\\"File detonation\\\"],0), [\\\"URL detonation\\\"]=coalesce([\\\"URL detonation\\\"],0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"URL detonation\",\"color\":\"orangeDark\"},{\"seriesName\":\"File detonation\",\"color\":\"redDark\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish AdvThreats Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6b62347a-b162-49e6-891c-07697af22dd9\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - LLM content analysis<br>\\r\\n\\r\\n**Microsoft Defender for Office 365 uses Language AI for Phish and Business Email Compromise (BEC) detection. These models are progressively learning from thousands of real-world phishing attempts and analyzing all messages classified as phish. Furthermore, it incorporates advanced Machine Learning and Natural Language Processing (NLP) techniques to read, process, and understand email content the way a human analyst might, yet in a fraction of the time and at a large scale. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-defender-for-office-365s-language-ai-for-phish-enhancing-email-securit/4410446)**\"},\"customWidth\":\"50\",\"name\":\"text - Phish LLM Content Header\",\"id\":\"c23460b1-e025-4f6c-b2d5-3f78c0c9afc6\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - LLM Threat Classifications<br>\\r\\n\\r\\n**Microsoft Defender for Office 365 uses purpose-built Large Language Models (LLM) at scale to provide AI-powered email and collaboration security. Our solution now parses language to understand and identify attacker intent and classifies threats at machine speed – keeping malicious emails out of your inbox and giving security operations (SOC) teams a new level of insight into adversary techniques. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-ignite-redefining-email-security-with-llms-to-tackle-a-new-era-of-soci/4302421)**\"},\"customWidth\":\"50\",\"name\":\"text - Phish LLM ThreatClass Header\",\"id\":\"1d723c26-501f-4385-9331-957ab7ae5019\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails detected as Phish by LLM content analysis detection technology in Microsoft Defender for Office 365. \\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has 'Phish' and DetectionMethods contains \\\"LLM content analysis\\\"\\r\\n| summarize count()\\r\\n| sort by count_ desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"thresholdsGrid\":[{\"operator\":\">\",\"thresholdValue\":\"0\",\"representation\":\"red\"},{\"operator\":\"<=\",\"thresholdValue\":\"0\",\"representation\":\"red\"}]},\"tagText\":\"\",\"valueFontStyle\":\"auto\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - Phish LLM Content Count\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"86a301c5-2bc0-436a-982c-861beee7c9ab\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by intent of the message.\\r\\n// Microsoft Defender for Office 365 LLM analysis is analyzing email messages to understand the intent of the messages. These threat classifications are then used in filtering decisions.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has 'Phish' and ThreatClassification  has_any(\\\"Business intelligence\\\",\\\"Contact establishment\\\",\\\"Gift card\\\",\\\"Invoice\\\",\\\"Payroll\\\",\\\"PII gathering\\\",\\\"Task\\\")\\r\\n| summarize count() by ThreatClassification\\r\\n| sort by count_ desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - Phish LLM ThreatClass Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d547b730-f174-4f78-8998-02f24453304e\"},{\"type\":1,\"content\":{\"json\":\"### Top Attacked Users by LLM Threat classes (Phish)<br>\\r\\n\\r\\n**Displays recipients most frequently targeted by inbound phishing emails, grouped by threat classification (e.g., Gift Card, Invoice, Payroll). Helps identify users at higher risk for phishing attacks. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish LLM TopUsers Header\",\"id\":\"4ba9d9eb-d88d-4e5d-ba58-a740559677f7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Phish detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has \\\"Phish\\\" and EmailDirection == \\\"Inbound\\\" and ThreatClassification has_any(\\\"Business intelligence\\\",\\\"Contact establishment\\\",\\\"Gift card\\\",\\\"Invoice\\\",\\\"Payroll\\\",\\\"PII gathering\\\",\\\"Task\\\")\\r\\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\\r\\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\\r\\n| sort by Emails desc\\r\\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"80px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"query - Phish LLM TopUsers\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"51599ab2-db69-4195-b4e9-2828729ec35b\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"group - 5\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"25c47f6a-3525-435e-90cf-357f02fb2fed\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Phish Detections by Delivery location, Detection technology and Sender infrastructure insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Phish detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Phish.<br><br>**Recommended action:** Verify anti-phishing and Safe Links policies cover these delivery paths; consider blocking sender infrastructure from regions you do not operate in, where appropriate.\"},\"name\":\"text - Phish Section2 Banner\",\"id\":\"6876063e-6a4f-48ea-829d-4486922783dd\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections by delivery location<br>\\r\\n\\r\\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various delivery locations: Quarantine, Junk folder or Failed (rejected with or without NDR)**\"},\"name\":\"text - Phish DeliveryLoc Header\",\"id\":\"b5045aab-1b4b-4d35-af41-a6315d36e864\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\" and EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalPhishDetections=count(), Quarantine=countif(DeliveryLocation == \\\"Quarantine\\\"), Junkfolder=countif(DeliveryLocation == \\\"Junk folder\\\"), Inbox=countif(DeliveryLocation == \\\"Inbox/folder\\\"), Failed=countif(DeliveryLocation == \\\"Failed\\\"), Dropped=countif(DeliveryLocation == \\\"Dropped\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, TotalPhishDetections=coalesce(TotalPhishDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Quarantine\",\"color\":\"greenDark\"},{\"seriesName\":\"Failed\",\"color\":\"green\"},{\"seriesName\":\"Dropped\",\"color\":\"green\"},{\"seriesName\":\"Junk folder\",\"color\":\"orangeDark\"},{\"seriesName\":\"Inbox\",\"color\":\"redBright\"}]}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish DeliveryLoc Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e839848c-d176-4251-bbb4-1c2e1103ed2d\"},{\"type\":1,\"content\":{\"json\":\"### Phish detections by Detection Technology<br>\\r\\n\\r\\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**\"},\"name\":\"text - Phish DetTech Header\",\"id\":\"149bf1b3-80cc-4e82-ae5d-ddee0f6b0cd9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls in Microsoft Defender for Office 365.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"createOtherGroup\":15}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish DetTech Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b0b16329-e1a6-4138-871e-76d57a60b978\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarized by individual Phish detection technology/control in Microsoft Defender for Office 365.\\r\\n//Each detection technology is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\\r\\n//The where clause excludes deliveries to the SecOps Mailbox and by the Phish Simulation system.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = Details, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish DetTech Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5270ba04-599f-4940-805b-687f7475bc70\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections by SenderIPv4 Geo Location<br>\\r\\n\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"name\":\"text - Phish Geo Header\",\"id\":\"ddd0c12f-1bb1-4d7d-afb4-f28bcfcd7c4b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by email sender IP address (SenderIPv4).\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ThreatTypes has \\\"Phish\\\" and isnotempty(SenderIPv4)\\r\\n| summarize count() by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish Geo Map\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"85ea7223-7d77-43f5-b0d9-e0de7c898758\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where ThreatTypes has 'Phish' and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Phish Emails'] = count_\\r\\n| sort by ['Phish Emails'] desc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Phish Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish Country Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f561209b-15a6-442e-af10-63e375088209\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"group - 25- Phish delivery locations-detecion tech-sender infra\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"10f3e3eb-b330-4955-952e-01eff69405e9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Phish Detections Top attacked users and top senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Enroll the most-targeted users in security awareness training and consider blocking persistent phishing sender domains.\"},\"name\":\"text - Phish Section3 Banner\",\"id\":\"f46ed4a8-e2b5-4ccd-ae38-efc571bfc791\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections top attacked users\\r\\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Phish. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish TopUsers Header\",\"id\":\"96d9b543-070a-42d4-bbed-3f5cf79ca7ce\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails with Phish detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),PhishEmailCount = countif(ThreatTypes has \\\"Phish\\\") by RecipientEmailAddress\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where PhishEmailCount !=0\\r\\n| top 15 by PhishEmailCount\\r\\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Phish Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish TopRecipients Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"25100115-78d3-4144-b44e-613b44f02484\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains with Phish Detections (Inbound)\\r\\n**Displays the top 10 sender domains sending inbound emails detected as Phish. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish TopSenders Header\",\"id\":\"e7fcb7fe-4bca-4153-a9b0-8ded135b1c64\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain), now including the Phish confidence split (High/Normal) and the aggregated phish detection methods seen per domain. Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\\r\\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \\\"//\\\" to apply the exclusion.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\\r\\n| extend PhishMethods = parse_json(DetectionMethods).Phish\\r\\n| summarize TotalEmailCount = count(),\\r\\n            PhishEmailCount = countif(ThreatTypes has \\\"Phish\\\"),\\r\\n            Phish_High = countif(ThreatTypes has \\\"Phish\\\" and PhishConf == \\\"High\\\"),\\r\\n            Phish_Normal = countif(ThreatTypes has \\\"Phish\\\" and PhishConf == \\\"Normal\\\"),\\r\\n            PhishMethodSet = make_set_if(PhishMethods, ThreatTypes has \\\"Phish\\\") by SenderFromDomain\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where PhishEmailCount != 0\\r\\n| top 15 by PhishEmailCount\\r\\n| mv-apply S = PhishMethodSet on ( mv-expand m = S to typeof(string) | summarize Methods = make_set(m) )\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound, ['Detection Methods'] = strcat_array(Methods, \\\", \\\")\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Phish Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish (High)\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish (Normal)\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"BadEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"query - Phish TopSenders Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"717bfce8-b5d4-4900-99db-4ba0c503591d\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"group - 26-PhishDetectionsTopattackedusers-topsenders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"553afca2-caa1-45b1-bec0-dca426b5be46\"},{\"type\":1,\"content\":{\"json\":\"# Spam Detection Insights\\r\\n\\r\\n---\\r\\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Spam threat** within its **email content**, **URLs**, or **attachments**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"text - Spam Tab Intro\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a693a05a-a772-4ac4-9863-07ad0d1b7092\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of inbound email spam detections for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet sp = EmailEvents | where EmailDirection == \\\"Inbound\\\" | where ThreatTypes has \\\"Spam\\\";\\r\\nlet junk = sp | where DeliveryLocation has \\\"Junk\\\";\\r\\nlet spTrend = toscalar(sp | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet junkTrend = toscalar(junk | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(sp | summarize count()), Details = \\\"Spam Emails\\\", Ord = 1, Trend = spTrend),\\r\\n(print Count = toscalar(sp | summarize dcount(RecipientEmailAddress)), Details = \\\"Users Targeted\\\", Ord = 2, Trend = spTrend),\\r\\n(print Count = toscalar(sp | summarize dcount(SenderFromDomain)), Details = \\\"Sender Domains\\\", Ord = 3, Trend = spTrend),\\r\\n(print Count = toscalar(junk | summarize count()), Details = \\\"Sent to Junk\\\", Ord = 4, Trend = junkTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"spam kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cadd5331-1db8-4ac8-bc99-42cd5227ee51\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Spam Detection Effectiveness and Trends\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Effectiveness and per-{Granularity} trend. For effectiveness, we consider messages reported by your admins and decisions made post-delivery.<br><br>**Recommended action:** If legitimate mail is marked as spam, review the Spam and Bulk thresholds; if spam is leaking through, tighten them.\"},\"name\":\"text - Spam Section1 Banner\",\"id\":\"1093f3b6-cea7-4f54-9029-f9aadd79ca9f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query calculates the effectiveness of spam detections without edge data.\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\n// baseQuery _FN_Admin_Submissions_SPM\\r\\nlet _FN_Admin_Submissions_SPM = toscalar(\\r\\nCloudAppEvents\\r\\n| where Timestamp between (minTime .. maxTime)\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\\r\\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\\r\\n| where SubmissionType in (\\\"0\\\")\\r\\n| summarize count()\\r\\n);\\r\\n// baseQuery _FN_ZAP_Successful_Spam\\r\\nlet _FN_ZAP_Successful_Spam = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and ActionType == \\\"Spam ZAP\\\" and ActionResult == \\\"Success\\\" and Timestamp between (minTime .. maxTime)\\r\\n| summarize count()\\r\\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\\r\\n);\\r\\n// baseQuery _FN_ZAP_Unsuccessful_Spam\\r\\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and ActionType == \\\"Spam ZAP\\\" and ActionResult != \\\"Success\\\" and Timestamp between (minTime .. maxTime)\\r\\n| summarize count()\\r\\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\\r\\n);\\r\\n// baseQuery _SPAM_ZAP_FP\\r\\nlet _SPAM_ZAP_FP = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") and Timestamp between (minTime .. maxTime)\\r\\n| join kind=leftsemi (\\r\\n            EmailEvents\\r\\n            | where Timestamp between (minTime ..maxTime )\\r\\n            | where ThreatTypes contains \\\"Spam\\\"\\r\\n            | project NetworkMessageId, ThreatTypes)\\r\\n            on NetworkMessageId\\r\\n| summarize count()\\r\\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\\r\\n);\\r\\n// baseQuery _Spam_Mailflow\\r\\nlet _Spam_Mailflow = toscalar(\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and ThreatTypes == \\\"Spam\\\" and Timestamp between (minTime .. maxTime)\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count()\\r\\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\\r\\n);\\r\\nprint\\r\\nEffectiveness_PostDelivery = abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))/(toreal(toscalar(_Spam_Mailflow))+toreal(toscalar(_FN_ZAP_Successful_Spam))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))+toreal(toscalar(_FN_Admin_Submissions_SPM))-toreal(toscalar(_SPAM_ZAP_FP)))*100-100),2))\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"heatmapPalette\":\"greenRed\",\"thresholdsGrid\":[{\"operator\":\">\",\"thresholdValue\":\"95\",\"representation\":\"green\"},{\"operator\":\"<=\",\"thresholdValue\":\"95\",\"representation\":\"orange\"},{\"operator\":\"<=\",\"thresholdValue\":\"90\",\"representation\":\"red\"}]},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"tagText\":\"Spam Effectiveness (without Edge data)\",\"valueFontStyle\":\"superLarge\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - Spam Effectiveness Stat\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"036851c1-489e-4fda-8059-850c161578b3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\n// baseQuery _FN_Admin_Submissions_SPM\\r\\nlet _FN_Admin_Submissions_SPM = toscalar(\\r\\nCloudAppEvents\\r\\n| where Timestamp between (minTime .. maxTime)\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\\r\\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\\r\\n| where SubmissionType in (\\\"0\\\")\\r\\n| summarize count()\\r\\n);\\r\\n// baseQuery _FN_ZAP_Successful_Spam\\r\\nlet _FN_ZAP_Successful_Spam = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and ActionType == \\\"Spam ZAP\\\" and ActionResult == \\\"Success\\\" and Timestamp between (minTime .. maxTime)\\r\\n| summarize count()\\r\\n    //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\\r\\n);\\r\\n// baseQuery _FN_ZAP_Unsuccessful_Spam\\r\\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and ActionType == \\\"Spam ZAP\\\" and ActionResult != \\\"Success\\\" and Timestamp between (minTime .. maxTime)\\r\\n| summarize count()\\r\\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\\r\\n);\\r\\n// baseQuery _SPAM_ZAP_FP\\r\\nlet _SPAM_ZAP_FP = toscalar(\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionTrigger == \\\"SpecialAction\\\" and Action has_any (\\\"Redelivery\\\",\\\"Reprocessed\\\") and Timestamp between (minTime .. maxTime)\\r\\n| join kind=leftsemi (\\r\\n            EmailEvents\\r\\n            | where Timestamp between (minTime ..maxTime )\\r\\n            | where ThreatTypes contains \\\"Spam\\\"\\r\\n            | project NetworkMessageId, ThreatTypes)\\r\\n            on NetworkMessageId\\r\\n| summarize count()\\r\\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\\r\\n);\\r\\n// baseQuery _Spam_Mailflow\\r\\nlet _Spam_Mailflow = toscalar(\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and ThreatTypes == \\\"Spam\\\" and Timestamp between (minTime .. maxTime)\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count()\\r\\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\\r\\n);\\r\\nprint StatisticName=\\\"Spam Mailflow Minus FPs\\\", Value=toreal((toscalar(_Spam_Mailflow)) - toreal(toscalar(_SPAM_ZAP_FP)))\\r\\n| union (print StatisticName=\\\"Spam Admin FNs Submitted\\\", Value=toreal(toscalar(_FN_Admin_Submissions_SPM)))\\r\\n| union (print StatisticName=\\\"Spam FPs Reverse Zapped\\\", Value=toreal(toscalar(_SPAM_ZAP_FP)))\\r\\n| union (print StatisticName=\\\"Spam Zapped Successfully\\\", Value=toreal(toscalar(_FN_ZAP_Successful_Spam)))\\r\\n| union (print StatisticName=\\\"Spam NotZapped\\\", Value=toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))\\r\\n| union (print StatisticName=\\\"Spam Effectiveness Post Delivery %\\\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2)))\\r\\n| union (print StatisticName=\\\"Spam Effectiveness Pre-Delivery %\\\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + (toscalar(_FN_ZAP_Successful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2 )))\\r\\n| project ['Statistic'] = StatisticName, Value\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Value\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]}},\"customWidth\":\"50\",\"name\":\"query - Spam Effectiveness Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8d456ea2-f04a-4d71-95c6-fbaad8c2d2f2\"}]},\"customWidth\":\"100\",\"name\":\"Spam Effectiveness\",\"id\":\"82812b88-e7f7-4be0-9d13-8e7a7d8c0c4e\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detection Trend<br>\\r\\n\\r\\n**This visual displays a per-{Granularity} trend of email Spam detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Spam threats.**\"},\"name\":\"text - Spam Trend Header\",\"id\":\"b5574a88-430b-4cca-a76e-9a0b07e9da2e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where ThreatTypes has \\\"Spam\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, SpamDetections = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SpamDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Spam Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"09b7d330-1683-45c4-ac0e-8141580d13b5\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"group - 6-Spam-detections-trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"25273f47-8201-4565-8815-1d059ee8abb6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Spam Detections by Delivery location, Detection technology, Sender infrastructure and Bulk insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Spam detections delivery locations, detection technologies used for detections, sender infrastructure and Bulk insights in inbound email identified by Microsoft Defender for Office 365 as Spam.<br><br>**Recommended action:** Raise the Bulk Complaint Level (BCL) threshold for noisy sender domains and consider blocking high-volume, low-value bulk senders where appropriate.\"},\"name\":\"text - Spam Section2 Banner\",\"id\":\"b82f442b-a3a0-44f7-82df-2fd4a9594992\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections by delivery location<br>\\r\\n\\r\\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various delivery locations Quarantine, Junk folder or Failed (rejected with or without NDR)**\"},\"name\":\"text - Spam DeliveryLoc Header\",\"id\":\"a6326d97-56cc-45fb-8019-e0c3346968f2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Spam\\\" and EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalSpamDetections=count(), Quarantine=countif(DeliveryLocation == \\\"Quarantine\\\"), Junkfolder=countif(DeliveryLocation == \\\"Junk folder\\\"), Inbox=countif(DeliveryLocation == \\\"Inbox/folder\\\"), Failed=countif(DeliveryLocation == \\\"Failed\\\"), Dropped=countif(DeliveryLocation == \\\"Dropped\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, TotalSpamDetections=coalesce(TotalSpamDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalSpamDetections\",\"color\":\"blue\"},{\"seriesName\":\"Quarantine\",\"color\":\"greenDark\"},{\"seriesName\":\"Junkfolder\",\"color\":\"orangeDark\"},{\"seriesName\":\"Inbox\",\"color\":\"redBright\"},{\"seriesName\":\"Failed\",\"color\":\"red\"},{\"seriesName\":\"Dropped\",\"color\":\"redDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Spam DeliveryLoc Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"97f89032-34e3-40ff-bb88-42d195aea095\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections Detection Technology<br>\\r\\n\\r\\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**\"},\"name\":\"text - Spam DetTech Header\",\"id\":\"935ea90d-8430-49d5-b942-3a7b319a603e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where DetectionMethods has \\\"Spam\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - Spam DetTech Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f31ec0d1-04e1-4b2b-9b98-27289ca34b84\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections summarized by individual Spam detection technology/control in Microsoft Defender for Office 365.\\r\\n//Each technique is counted individually via mv-expand over DetectionMethods.Spam (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Spam\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = Details, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Spam DetTech Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"95e40479-f0bc-41ff-8191-634b606d3632\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections by SenderIPv4 Geo Location<br>\\r\\n\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Spam, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"name\":\"text - Spam Geo Header\",\"id\":\"614d1c3f-df6a-4659-b170-7b466c66d66f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4).\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where ThreatTypes has \\\"Spam\\\" and isnotempty(SenderIPv4)\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_  \",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"SenderIPv4\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"name\":\"query - Spam Geo Map\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5519d715-dc79-45f8-8ed5-a63a253c45e3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spam detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where ThreatTypes has 'Spam' and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Spam Emails'] = count_\\r\\n| sort by ['Spam Emails'] desc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spam Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"SenderIPv4\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"name\":\"query - Spam Country Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5078dc24-e8be-4943-98fc-6527968e1e3d\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections Bulk Insights<br>\\r\\n\\r\\n**Displays the distribution of inbound emails across different Bulk Complaint Levels together with Top 10 domains sending Bulk email (grey mail). Helps identify patterns in bulk email complaints and assess potential spam or unwanted message trends.**\"},\"name\":\"text - Spam Bulk Header\",\"id\":\"cd7b3cbe-a6c1-422c-ab37-4afc26002d5d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotnull(BulkComplaintLevel)\\r\\n| summarize count() by BulkComplaintLevel\\r\\n| sort by BulkComplaintLevel desc\\r\\n| project ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blueDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - Spam Bulk By Level\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"021c022b-aa67-427d-9e1a-688af7aed5d4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotnull(BulkComplaintLevel)\\r\\n| summarize count() by BulkComplaintLevel, SenderFromDomain\\r\\n| top 10 by count_ desc\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - Spam Bulk By Domain\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b1835e0f-f9ad-44c3-bba4-cf9a9546d09a\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"group - 28-Spam-Delivery location-Detection technology-Sender infrastructure insights\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"307d3d03-93ae-4c8f-b68b-f833ee7d38e8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"\\r\\n<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Spam Detections Top attacked users and top senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.<br><br>**Recommended action:** Review the most-affected users and the top spam sender domains as possible block-list candidates.\"},\"name\":\"text - Spam Section3 Banner\",\"id\":\"4c34ed7b-86da-4ee1-8a69-f96c213a4340\"},{\"type\":1,\"content\":{\"json\":\"### Spam Detections top attacked users<br>\\r\\n\\r\\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**\"},\"customWidth\":\"100\",\"name\":\"text - Spam TopUsers Header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"be708ad5-51fd-4a54-b1bc-f912e12b4a01\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\\r\\nEmailEvents \\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where EmailDirection ==\\\"Inbound\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),SpamEmailCount = countif(ThreatTypes has \\\"Spam\\\") by RecipientEmailAddress\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount)* 100, 2))\\r\\n| where SpamEmailCount !=0\\r\\n| top 15 by SpamEmailCount\\r\\n| project ['Recipient'] = RecipientEmailAddress, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spam Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Spam TopRecipients Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6e7b357d-6792-41c5-83fc-efae31afe2ee\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains with Spam Detections (Inbound)<br>\\r\\n\\r\\n**Displays the top 10 sender domains sending inbound emails detected as Spam. Helps identify external sources most frequently associated with spam content for prioritised monitoring and mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Spam TopSenders Header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1d1bdb8d-9619-488b-935a-3791ad73f096\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount = count(),\\r\\n            SpamEmailCount = countif(ThreatTypes has \\\"Spam\\\") by SenderFromDomain\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where SpamEmailCount !=0\\r\\n| top 15 by SpamEmailCount\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spam Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Spam TopSenders Table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"253efada-ca89-49c5-b1e3-e42ac005b938\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"group - 29-Spam Detections Top attacked users and top senders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"d4cc057f-c9b7-40b9-85d3-52f90767d1f5\"},{\"type\":1,\"content\":{\"json\":\"# Email Impersonation &amp; BEC Insights\\r\\n\\r\\n---\\r\\nThis tab focuses on the highest-value email threat class: **impersonation and Business Email Compromise (BEC)**. It brings together impersonation and spoof detections, sender authentication (DMARC, DKIM, SPF, CompAuth), supply-chain and partner-compromise correlation, and first-contact / new-vendor senders - the signals that precede targeted financial and credential attacks. It is the email-side companion to the impersonation insights on the **Teams &amp; Collaboration** tab.\"},\"name\":\"text - impersonation bec description\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"id\":\"fda8ccd5-fafc-457a-a6a2-05b504be1023\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of inbound email impersonation and spoof (BEC) detections for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet bec = EmailEvents | where EmailDirection == \\\"Inbound\\\" | where DetectionMethods has \\\"Impersonation\\\" or DetectionMethods has \\\"Spoof\\\";\\r\\nlet inbox = bec | where DeliveryLocation has \\\"Inbox\\\";\\r\\nlet becTrend = toscalar(bec | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(bec | summarize count()), Details = \\\"Impersonation / Spoof Emails\\\", Ord = 1, Trend = becTrend),\\r\\n(print Count = toscalar(bec | summarize dcount(RecipientEmailAddress)), Details = \\\"Users Targeted\\\", Ord = 2, Trend = becTrend),\\r\\n(print Count = toscalar(bec | summarize dcount(SenderFromDomain)), Details = \\\"Spoofed Sender Domains\\\", Ord = 3, Trend = becTrend),\\r\\n(print Count = toscalar(inbox | summarize count()), Details = \\\"Delivered to Inbox\\\", Ord = 4, Trend = inboxTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"name\":\"bec kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"91fdd28f-31c4-4f94-b60a-12cd97d44ddf\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Phish Detections Business Email Compromise (BEC) detections\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Business Email Compromise (BEC) detections Impersonation and Spoof.<br><br>**Recommended action:** Enable mailbox intelligence and impersonation protection for frequently-impersonated users and domains; consider adding confirmed look-alike domains to the Tenant Block List.\"},\"name\":\"text - Phish BEC Banner\",\"id\":\"e3b2232c-8056-4913-a652-64f70e228750\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Impersonation detections Trend\\r\\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Impersonation detection methods by Microsoft Defender for Office 365. Helps track impersonation attack patterns over time.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Imp Trend Header\",\"id\":\"e95667df-3bcd-4023-9e8f-99ed05bc4bf0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has 'Impersonation'\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ImpersonationDetections = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"ImpersonationDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Imp Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"61fa166d-f300-42a6-a324-de18b3fdf4c1\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Impersonation detections by Detection Technology\\r\\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Impersonations.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Imp Tech Header\",\"id\":\"09e1a866-f344-4a92-a3bd-8c3c3c5d598d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where Details has \\\"Impersonation\\\"\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Imp Tech Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6cd5662f-13b4-4a9b-afe7-0a6343e3ab5c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish - Business Email Compromise (BEC) - Impersonation detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\\r\\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where Details has \\\"Impersonation\\\"\\r\\n| summarize Count = count() by Details\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = Details, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"graphSettings\":{\"type\":0},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Imp Tech Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"73499618-e842-440e-a555-cd8849093884\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Impersonation detections by SenderIPv4 Geo Location\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Impersonation, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Imp Geo Header\",\"id\":\"189a1ac1-f275-4697-880b-7ffae1e5d263\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections summarizing the data by email sender IP address (SenderIPv4).\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Impersonation\\\" and isnotempty(SenderIPv4)\\r\\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \\r\\n| summarize count()by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_  \",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"name\":\"query - Phish BEC Imp Geo Map\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"574b61ad-ec2d-4517-93c5-d0e9bd14f2e9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where DetectionMethods has \\\"Impersonation\\\" and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Impersonation Emails'] = count_\\r\\n| sort by ['Impersonation Emails'] desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Impersonation Detections-Sender Heatmap (IPv4)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Impersonation Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"name\":\"query - Phish BEC Imp Country\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e53b7dbc-4683-4309-b879-c7be68599159\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Spoof detections Trend\\r\\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Spoof detection methods by Microsoft Defender for Office 365. Helps track Spoofing based attack patterns over time.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Spoof Trend Header\",\"id\":\"8db0f1b0-49bf-43a2-9f9f-164eb9530629\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has 'Spoof'\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, SpoofDetections = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SpoofDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Spoof Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9a308cd9-bf05-4287-b0d5-54636d081a82\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Spoof detections Trend by Detection Technology\\r\\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Spoofing.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Spoof Tech Header\",\"id\":\"28c9c15d-d22f-4412-9efc-868b95082668\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily by various Spoof Detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where Details has \\\"Spoof\\\"\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"yAxis\":[\"Count\"],\"seriesLabelSettings\":[{\"seriesName\":\"[\\\"Spoof external domain\\\"]\",\"color\":\"redDark\"},{\"seriesName\":\"[\\\"Spoof intra-org\\\"]\",\"color\":\"orangeDark\"},{\"seriesName\":\"[\\\"Spoof DMARC\\\"]\",\"color\":\"yellowDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Spoof Tech Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1a1328fc-5404-4dff-99ed-3a30082a4cbe\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish - Business Email Compromise (BEC) - Spoof detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\\r\\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where Details has \\\"Spoof\\\"\\r\\n| summarize Count = count() by Details\\r\\n| sort by Count desc\\r\\n| project ['Detection Technology'] = Details, ['Detections'] = Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish BEC Spoof Tech Pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"f7df9892-85b4-49c3-8739-873b745183a3\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections - Spoof detections by SenderIPv4 Geo Location\\r\\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Spoofing, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish BEC Spoof Geo Header\",\"id\":\"3c83e7f0-5391-4b1a-bb5b-de0d17488efd\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections summarizing the data by email sender IP address (SenderIPv4).\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where DetectionMethods has \\\"Spoof\\\" and isnotempty(SenderIPv4)\\r\\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \\r\\n| summarize count()by SenderIPv4\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\\r\\n| project SenderIPv4, Latitude, Longitude, count_  \",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"map\",\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"none\"}}},\"customWidth\":\"50\",\"name\":\"query - Phish BEC Spoof Geo Map\",\"styleSettings\":{\"margin\":\"15px\",\"padding\":\"15px\"},\"id\":\"122d860c-ab0d-475e-b29e-2955020680c7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\\r\\nEmailEvents \\r\\n| where DetectionMethods has \\\"Spoof\\\" and isnotempty(SenderIPv4)\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\\r\\n| extend Country = tostring(GeoInfo.country)\\r\\n| summarize count() by Country\\r\\n| project Country, ['Spoof Emails'] = count_\\r\\n| sort by ['Spoof Emails'] desc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spoof Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"Latitude\",\"longitude\":\"Longitude\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"SenderIPv4\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"red\"}}},\"customWidth\":\"50\",\"name\":\"query - Phish BEC Spoof Country\",\"styleSettings\":{\"margin\":\"15px\",\"padding\":\"15px\"},\"id\":\"9d0111bc-8d01-4a99-9009-645dc02c3bed\"},{\"type\":1,\"content\":{\"json\":\"### Supply-Chain &amp; Partner Risk (Possible Partner Compromise)\\r\\n**Correlates the external domains your organization emails most with inbound emails from those same domains that carried threats. A trusted partner or supplier domain suddenly sending threats is a strong signal that the partner may be compromised - a common supply-chain and business email compromise (BEC) vector.**<br><br>**Recommended action:** Verify any flagged partner through a trusted channel before acting on their recent messages, alert them to a possible compromise, and consider tightening inbound policy for that domain until confirmed clean.\"},\"customWidth\":\"100\",\"name\":\"text - Phish Partner Compromise Header\",\"id\":\"2c62c576-3b05-4663-ae2e-4f961d7409c6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) \\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Outbound\\\"\\r\\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \\\"@\\\")[1])\\r\\n| summarize count() by RecipientDomain\\r\\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\\r\\n| join (EmailEvents | where EmailDirection == \\\"Inbound\\\" and isempty(ThreatTypes)==false) on SenderFromDomain\\r\\n| summarize max(OutboundCount),count() by SenderFromDomain\\r\\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\\r\\n| extend Bad_Traffic_Percentage = todouble(round(IncomingEmailsWithThreats / todouble(OutboundEmails) * 100, 2))\\r\\n| top 15 by OutboundEmails\\r\\n| project ['Sender Domain'] = SenderFromDomain, ['Outbound Emails'] = OutboundEmails, ['Inbound w/ Threats'] = IncomingEmailsWithThreats, ['Bad Traffic %'] = Bad_Traffic_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Outbound Emails\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Inbound w/ Threats\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"60ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish Partner Compromise\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1aaa047c-1108-4288-833e-61ca35b5495a\"},{\"type\":1,\"content\":{\"json\":\"### Top Recipients Targeted by Impersonation / BEC\\r\\n**Lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, showing the number of impersonation emails, how many distinct senders were involved, the top spoofed sender domains, and how many of those messages were delivered to the inbox. Helps identify high-risk users (often executives or finance staff) who may need extra protection or awareness.**\"},\"customWidth\":\"100\",\"name\":\"text - impersonation targets\",\"id\":\"b1e7c2a4-9f3d-4a6b-8c12-7d5e9f0a1b23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top recipients targeted by impersonation / BEC, with distinct senders, spoofed domains and how many landed in the inbox.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| where OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")\\r\\n| where DetectionMethods has \\\"Impersonation\\\"\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize ImpersonationEmails = count(),\\r\\n            DistinctSenders      = dcount(SenderFromAddress),\\r\\n            TopSpoofedDomains    = make_set(SenderFromDomain, 5),\\r\\n            DeliveredToInbox     = countif(DeliveryLocation has \\\"Inbox\\\")\\r\\n        by RecipientEmailAddress\\r\\n| top 20 by ImpersonationEmails\\r\\n| project ['Recipient'] = RecipientEmailAddress, ['Impersonation Emails'] = ImpersonationEmails, ['Distinct Senders'] = DistinctSenders, ['Top Spoofed Domains'] = strcat_array(TopSpoofedDomains, \\\", \\\"), ['Delivered to Inbox'] = DeliveredToInbox\",\"size\":0,\"title\":\"Top Recipients Targeted by Impersonation / BEC\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"showAnalytics\":true,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Impersonation Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"name\":\"newviz - impersonation targets\",\"id\":\"afe28369-af82-47ae-846d-179bd86b660e\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"name\":\"group - 7 - Phish-BEC-Insights\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"b7971cd9-d086-47c7-8f66-50956b9c56c3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Phish Detections Sender Authentication details (DMARC, DKIM, SPF, CompAuth)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain Sender Authentication checks details in inbound email by Microsoft Defender for Office 365 focusing on the various Sender Authentication standards: DMARC, DKIM, SPF, CompAuth.<br><br>**Recommended action:** For domains failing DMARC/DKIM/SPF, verify your own outbound authentication is published and enforced (p=reject), and treat persistent external spoofers as possible block candidates.\"},\"name\":\"text - Phish Section5 Banner\",\"id\":\"90d7a338-d943-4398-b788-bfd4f93007d4\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections Sender Authentication Trend (DMARC, DKIM, SPF, CompAuth)\\r\\n**Shows counts (per {Granularity}) of sender authentication check outcomes (DMARC, DKIM, SPF, CompAuth) performed by Microsoft Defender for Office 365 on inbound emails. Useful for monitoring authentication success and failure patterns over time to identify anomalies or potential phishing risks.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish SenderAuth Trend Header\",\"id\":\"4a0ab90e-55dd-4fa6-82c3-0edc57ce0966\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof- DMARC fails summarizing the data daily.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend DMARCFail = (tostring(parse_json(AuthenticationDetails).DMARC) == \\\"fail\\\") \\r\\n| summarize DMARCFail = sum(DMARCFail) by bin (Timestamp,{Granularity})\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"DMARCFail\",\"color\":\"orangeDark\"}]}},\"customWidth\":\"50\",\"name\":\"query - Phish Auth DMARC Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"79920d30-01d4-4412-b994-853e50c9d7d8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof- DKIM fails summarizing the data daily.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend DKIMFail = (tostring(parse_json(AuthenticationDetails).DKIM) == \\\"fail\\\") \\r\\n| summarize DKIMFail = sum(DKIMFail) by bin (Timestamp,{Granularity})\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"DKIMFail\",\"color\":\"yellowDark\"}]}},\"customWidth\":\"50\",\"name\":\"query - Phish Auth DKIM Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"bf09ffd4-eee0-42f7-a507-1cf54d9c365a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof- SPF fails summarizing the data daily.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend SPFFail = (tostring(parse_json(AuthenticationDetails).SPF) == \\\"fail\\\") \\r\\n| summarize SPFFail = sum(SPFFail) by bin (Timestamp,{Granularity})\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SPFFail\",\"color\":\"purpleDark\"}]}},\"customWidth\":\"50\",\"name\":\"query - Phish Auth SPF Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"4d66fe13-9904-45cf-8783-f3ee984f3a66\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof- Composite Authentication fails summarizing the data daily.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend CompAuthFail = (tostring(parse_json(AuthenticationDetails).CompAuth) == \\\"fail\\\") \\r\\n| summarize CompAuthFail = sum(CompAuthFail) by bin (Timestamp,{Granularity})\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"CompAuthFail\",\"color\":\"blueDark\"}]}},\"customWidth\":\"50\",\"name\":\"query - Phish Auth CompAuth Trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"0968b828-23fe-4fa2-a5ea-8ab39362457f\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections Top Sender Domains with DMARC Failures (Inbound)\\r\\n**Displays the top 10 sender domains (P1 and P2) for inbound emails where Spoof-DMARC detection triggered. Includes total inbound email volume and calculates DMARC fail traffic percentage per domain to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish Auth DMARC Domains Header\",\"id\":\"24d4689a-eb6d-49f5-85a8-fcadca409f7a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and DMARC fail traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalEmailCount = count(),\\r\\n            DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \\\"Spoof DMARC\\\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\\r\\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where DMARCFailCount !=0\\r\\n| top 10 by DMARCFailCount\\r\\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['DMARC Failures'] = DMARCFailCount, ['Total Inbound'] = TotalEmailCount, ['DMARC Fail %'] = DMARCFail_Traffic_Percentage\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DMARCFail\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"DMARC Fail %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish Auth DMARC Domains\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"642814ad-9d24-4be9-ae10-3578e89da05b\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections Top Sender Domains with Spoof External Domain Detections (Inbound)\\r\\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof External Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish Auth SpoofExt Domains Header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"993fdc34-354b-412e-be39-facbde4f4f0e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof external domain detection traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalEmailCount = count(),\\r\\n            SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \\\"Spoof external domain\\\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\\r\\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where SpoofExternalCount !=0\\r\\n| top 10 by SpoofExternalCount\\r\\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof External'] = SpoofExternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof External %'] = SpoofExternal_Traffic_Percentage\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spoof External\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spoof External %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"SpoofExternalFail\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"Spoof External %\",\"sortOrder\":2}]}},\"customWidth\":\"100\",\"name\":\"query - Phish Auth SpoofExt Domains\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"69ca3799-d2d5-4896-b3a5-1eeba46f0b46\"},{\"type\":1,\"content\":{\"json\":\"### Phish Detections Top Sender Domains with Spoof Internal Domain Detections (Inbound)\\r\\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof Internal Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"text - Phish Auth SpoofInt Domains Header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3fa33c5d-0eba-471f-b47f-0c12c1f770d6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.\\r\\nEmailEvents\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalEmailCount = count(),\\r\\n            SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \\\"Spoof intra-org\\\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\\r\\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\\r\\n| where SpoofInternalCount !=0\\r\\n| top 10 by SpoofInternalCount\\r\\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof Internal'] = SpoofInternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof Internal %'] = SpoofInternal_Traffic_Percentage\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Spoof intra-org detections by Sender domain (P1/P2)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spoof Internal\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spoof Internal %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"SpoofIntraorgFail\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - Phish Auth SpoofInt Domains\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"ae0c65c7-68ea-4d50-b177-1effeaf1c045\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"name\":\"group - 8-Phish-SenderAuth\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"8077779a-4da8-46be-8032-626bd8c36dbd\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">First-Contact &amp; New-Vendor Senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nExternal email senders and domains seen for the first time in the selected period. New/first-contact relationships - especially ones already carrying threats - are a common precursor to phishing, business email compromise (BEC), and supply-chain attacks.<br><br>**Recommended action:** Treat brand-new domains sending threats as high-priority review; verify any that claim to be a known brand or partner before trusting their messages.\"},\"name\":\"phish fc banner\",\"id\":\"05b83435-c7ed-48a3-919e-388b2e599726\"},{\"type\":1,\"content\":{\"json\":\"### First-contact external senders<br>\\r\\n\\r\\n**External email senders ordered by when they were first seen in the period (most recent first). In tenants with longer history this highlights genuinely new senders.**\"},\"customWidth\":\"100\",\"name\":\"phish fc senders header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"c57dffb4-dfdb-4a1e-93be-16fa9e856a0d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists external email senders seen for the first time in the selected period (most recent first), surfacing new/first-contact senders. In tenants with longer history this highlights genuinely new relationships - a common precursor to BEC and supply-chain attacks.\\r\\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"fabrikam.com\\\"]);\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend SenderDomain = tostring(split(SenderFromAddress, \\\"@\\\")[1])\\r\\n| where isnotempty(SenderFromAddress)\\r\\n//| where SenderDomain !in~ (ExcludeDomains)\\r\\n| summarize FirstSeen=min(Timestamp), Messages=count(), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\\r\\n| top 20 by FirstSeen desc\\r\\n| project ['Sender']=SenderFromAddress, ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, ['Threat Messages']=ThreatMessages\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"phish fc senders table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d1ceb0ac-2dad-49af-b416-a3376a7b8513\"},{\"type\":1,\"content\":{\"json\":\"### New sender domains carrying threats<br>\\r\\n\\r\\n**External sender domains seen for the first time in the period that already carried threats, most-recent first. A brand-new domain sending threats to your users is a strong early-warning signal.**\"},\"customWidth\":\"100\",\"name\":\"phish fc domains header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"bd29bbe4-cde2-499c-a1d0-e2cc51f7733d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists external sender domains seen for the first time in the selected period that already carried threats, ranked by most-recently first seen. A brand-new domain sending threats to your users is a strong early-warning signal for phishing and BEC.\\r\\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"fabrikam.com\\\"]);\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| extend SenderDomain = tostring(split(SenderFromAddress, \\\"@\\\")[1])\\r\\n| where isnotempty(SenderDomain)\\r\\n//| where SenderDomain !in~ (ExcludeDomains)\\r\\n| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Messages=count(), Senders=dcount(SenderFromAddress), Recipients=dcount(RecipientEmailAddress), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderDomain\\r\\n| where ThreatMessages > 0\\r\\n| top 20 by FirstSeen desc\\r\\n| project ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, Senders, Recipients, ['Threat Messages']=ThreatMessages, ['Last Seen']=LastSeen\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Senders\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Recipients\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"phish fc domains table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7da952d5-5ae2-4b2e-a5cf-c78b11bda4f8\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"15\"},\"customWidth\":\"100\",\"name\":\"group - Phish First Contact\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"90e5248a-2c35-48f3-869c-c45c631c6fbf\"},{\"type\":1,\"content\":{\"json\":\"# URL Detections and URL Click Insights\\r\\n\\r\\n---\\r\\nThis tab provides insights into **URL-based detections** in email messages and details about URL clicks performed by end users on URLs identified as **malicious**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"text - 24 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"2156430d-fec6-48bb-a9a8-3166182f6993\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//KPI summary of URL threat protection (Safe Links clicks and URLs seen in email) for the selected period, with a per-period Trend series feeding each tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet clicks = UrlClickEvents;\\r\\nlet blocked = clicks | where ActionType in (\\\"ClickBlocked\\\",\\\"ClickBlockedByTenantPolicy\\\");\\r\\nlet allowed = clicks | where ActionType == \\\"ClickAllowed\\\";\\r\\nlet blockedTrend = toscalar(blocked | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet allowedTrend = toscalar(allowed | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\\r\\nlet usersTrend = toscalar(clicks | make-series Trend = dcount(AccountUpn) default = 0 on Timestamp step gran | project Trend);\\r\\nlet urlsTrend = toscalar(EmailUrlInfo | make-series Trend = dcount(Url) default = 0 on Timestamp step gran | project Trend);\\r\\nunion\\r\\n(print Count = toscalar(blocked | summarize count()), Details = \\\"Malicious Clicks Blocked\\\", Ord = 1, Trend = blockedTrend),\\r\\n(print Count = toscalar(allowed | summarize count()), Details = \\\"Clicks Allowed Through\\\", Ord = 2, Trend = allowedTrend),\\r\\n(print Count = toscalar(clicks | summarize dcount(AccountUpn)), Details = \\\"Users Clicking Links\\\", Ord = 3, Trend = usersTrend),\\r\\n(print Count = toscalar(EmailUrlInfo | summarize dcount(Url)), Details = \\\"Distinct URLs in Email\\\", Ord = 4, Trend = urlsTrend)\\r\\n| sort by Ord asc\\r\\n| project Count, Details, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"url kpi strip\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d5e2326a-a5dd-4217-bb75-0e337d75d306\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Insights on URL-Based Threat Detections\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain URL based threat detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends of URL-based threat detections, QR code detections, and URL scans activity by locations.<br><br>**Recommended action:** Confirm Safe Links is enabled for email and Teams; investigate QR-code and URL detection spikes for emerging campaigns.\"},\"name\":\"text - 13 - Copy\",\"id\":\"ed3468e7-1936-45fd-9168-93010a662302\"},{\"type\":1,\"content\":{\"json\":\"### Trend of URL-Based Malware Threat Detections<br>\\r\\n\\r\\n**This visual displays a per-{Granularity} trend of emails with URL based Malware threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for malware threats.**\"},\"name\":\"text - 13 - Copy - Copy\",\"id\":\"77e7bbac-d752-478b-bce9-06bb1bd12bfe\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware URL threat based detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Malware'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand MalwareMethod = ParsedMethods.Malware\\r\\n| where MalwareMethod contains \\\"URL\\\"\\r\\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\\r\\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\\r\\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\\r\\n| sort by MalwareMethod asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"79ef5e7b-57a6-4519-9899-18fd8cae5e68\"},{\"type\":1,\"content\":{\"json\":\"### Trend of URL-Based Phish Threat Detections<br>\\r\\n\\r\\n**This visual displays a per-{Granularity} trend of emails with URL based Phish threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for Phish threats.**\"},\"name\":\"text - 13 - Copy - Copy - Copy\",\"id\":\"48923812-5440-4f47-8881-273f14cbfb8e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total emails with Phishing detections over time summarizing the data daily by various Phishing URL threat based detection technologies/controls in Microsoft Defender for Office 365.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has 'Phish'\\r\\n| where OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ParsedMethods = parse_json(DetectionMethods)\\r\\n| mv-expand PhishMethod = ParsedMethods.Phish\\r\\n| where PhishMethod contains \\\"URL\\\"\\r\\n| summarize Count = count() by PhishMethod = tostring(PhishMethod), Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct PhishMethod | extend d = 1) on d | project Timestamp, PhishMethod\\r\\n| join kind=leftouter (agg) on Timestamp, PhishMethod\\r\\n| project Timestamp, PhishMethod, Count = coalesce(Count, 0)\\r\\n| sort by PhishMethod asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"query - 8 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b983b361-6c2e-47d5-b2c5-edd9caa6a55d\"},{\"type\":1,\"content\":{\"json\":\"### Trend (per {Granularity}) of QR Code-Based Threat Detections<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of inbound emails containing QR codes flagged for Phish, Malware, or Spam via URL-based detection methods. Helps track QR code abuse patterns over time.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3d8b75e1-6e1d-44eb-b1fc-78d3db7feb71\"},{\"type\":1,\"content\":{\"json\":\"### URL Scan activity by Location (per {Granularity})<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of URLs scanned from various locations within emails (e.g., body, attachments, QR codes). Helps identify where malicious URLs are most commonly embedded.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b275b28c-e441-4c19-9055-256d5d45c69c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" \\r\\n| where DetectionMethods has \\\"Url\\\"\\r\\n| join EmailUrlInfo on NetworkMessageId\\r\\n| where UrlLocation == \\\"QRCode\\\"\\r\\n| summarize [\\\"Phish QR Detection\\\"]=countif(parse_json(DetectionMethods).Phish has \\\"URL\\\"), [\\\"Malware QR Detection\\\"]=countif(parse_json(DetectionMethods).Malware has \\\"URL\\\"), [\\\"Spam QR Detection\\\"]=countif(parse_json(DetectionMethods).Spam has \\\"URL\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, [\\\"Phish QR Detection\\\"]=coalesce([\\\"Phish QR Detection\\\"],0), [\\\"Malware QR Detection\\\"]=coalesce([\\\"Malware QR Detection\\\"],0), [\\\"Spam QR Detection\\\"]=coalesce([\\\"Spam QR Detection\\\"],0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"graphSettings\":{\"type\":0},\"chartSettings\":{\"xAxis\":\"Timestamp\",\"xSettings\":{\"dateFormatSettings\":{\"formatName\":\"shortDatePattern\",\"showUtcTime\":false}}}},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6c2a7724-d3c2-42b2-b8da-7acbcd0666c6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises where URL's have been scanned identified from various locations in emails\\r\\nEmailUrlInfo\\r\\n| summarize  count() by UrlLocation\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5640dbd5-4085-4f2a-8fb9-e4112233e99e\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"group - 9-URL detections\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"b572d79b-17a0-48ac-9a43-4f20324cf998\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Insights on URL Click-Based Threat Detections\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and explain URL click based threat detections in emails as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend of blocked URL clicks, time-of-click URL scans by workload, malicious clicks allowed, top clicks on malicious URLs, and more.<br><br>**Recommended action:** For blocked-click spikes, verify Safe Links is set to not allow click-through; investigate workloads with high click-through activity.\"},\"name\":\"text - 13 - Copy - Copy\",\"id\":\"6d37617e-911e-4ce6-a10d-4749486738ea\"},{\"type\":1,\"content\":{\"json\":\"### Trend (per {Granularity}) of Blocked URL Click Events<br>\\r\\n\\r\\n**Shows the count (per {Granularity}) of blocked URL click attempts and click attempts on URLs with detections, grouped by threat types (e.g., Phish, Malware, Spam). Helps track user interaction with malicious links over time across various threat types.**\"},\"name\":\"text - 13 - Copy - Copy - Copy\",\"id\":\"9e477950-bedc-4cc0-9863-df07d124806c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Generates a time-series analysis for blocked URL click events from the 'UrlClickEvents' table\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(UrlClickEvents\\r\\n| where isnotempty(ActionType)\\r\\n| where ActionType has_any(\\\"ClickBlocked\\\")\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, BlockedClicks = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"BlockedClicks\",\"color\":\"blueDark\"}]}},\"customWidth\":\"66\",\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"366e80d9-f6ed-43af-91e5-3d04cdcf692d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of click attempts on URL's with detections split by the different threat types identified\\r\\nUrlClickEvents\\r\\n| where isnotempty(ThreatTypes)\\r\\n| summarize count() by ThreatTypes\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a356eac3-62c2-4fc9-a4d9-3b05b13848df\"},{\"type\":1,\"content\":{\"json\":\"### Trend (per {Granularity}) of URL Click Actions by Type<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of URL click events categorised by action type: Blocked, Allowed, Pending Verdict, Error Page, and Clicked Through. Helps identify risky user behaviour and policy gaps.**\"},\"customWidth\":\"66\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a91fe7a6-f507-48f7-bbcc-61dc4f998ba6\"},{\"type\":1,\"content\":{\"json\":\"### URL Clicks by Workload<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of URL click events grouped by Workload (e.g., Outlook, Teams, Copilot, Office Apps: Word, Excel, PowerPoint) Helps identify which applications are most frequently used for URL interactions and potential risk exposure.**\"},\"customWidth\":\"33\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"ce05fa08-6e68-4c02-a0bf-2be6cdfae935\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises different URL click event types by action (e.g., blocked, allowed, pending verdict, error pages, and clicked through), summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(UrlClickEvents\\r\\n| where isnotempty(ActionType)\\r\\n| summarize ClickBlocked=countif(ActionType has_any(\\\"ClickBlocked\\\")), ClickAllowed=countif(ActionType has_any(\\\"ClickAllowed\\\")), PendingVerdict=countif(ActionType has_any(\\\"UrlScanInProgress\\\")), ErrorPage=countif(ActionType has_any(\\\"UrlErrorPage\\\")), ClickedThrough=countif(IsClickedThrough == true) by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ClickBlocked=coalesce(ClickBlocked,0), ClickAllowed=coalesce(ClickAllowed,0), PendingVerdict=coalesce(PendingVerdict,0), ErrorPage=coalesce(ErrorPage,0), ClickedThrough=coalesce(ClickedThrough,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"66\",\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a12b4c78-7d18-4adc-86e0-54395d6a996a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises where URL clicks scanned by the Workload the click happened from\\r\\nUrlClickEvents\\r\\n| summarize  count() by Workload\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 5 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3237cd55-1d5c-41a9-a8f2-1d46c61a709e\"},{\"type\":1,\"content\":{\"json\":\"### Blocked URL Clicks by Workload (per {Granularity})<br>\\r\\n\\r\\n**Displays counts (per {Granularity}) of blocked URL click attempts grouped by Workload (Email, Teams, Office, Microsoft 365 Copilot). Helps identify which platforms are most exposed to malicious link interactions and where user awareness or policy enforcement should be strengthened.**\"},\"customWidth\":\"66\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1f209a83-3d50-4bb8-9a79-a365a50a4142\"},{\"type\":1,\"content\":{\"json\":\"### Click-Through Activity on Detected URLs by Workload<br>\\r\\n\\r\\n**Displays counts of click‑through actions on URLs already identified with detections, grouped by Workload where the click happened. Helps identify clients/platforms where users are most likely to proceed to risky URLs and prioritise awareness training or policy tuning for those workloads**\"},\"customWidth\":\"33\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"33592db8-0ff5-4d8e-bd8f-0201b81a4584\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises blocked URL click event types by Workload (e.g., Email, Teams, Office, Microsoft 365 Copilot), summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(UrlClickEvents\\r\\n| where ActionType ==\\\"ClickBlocked\\\"\\r\\n| summarize Teams=countif(Workload==\\\"Teams\\\"), Office=countif(Workload==\\\"Office\\\"), Email=countif(Workload==\\\"Email\\\"), Copilot=countif(Workload==\\\"Copilot\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, Teams=coalesce(Teams,0), Office=coalesce(Office,0), Email=coalesce(Email,0), Copilot=coalesce(Copilot,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"66\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"80241767-0f69-4e2e-9889-3bf1f48e4f02\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of click-through activities on URL's with detections split by the source client\\r\\nUrlClickEvents \\r\\n| where IsClickedThrough !=\\\"0\\\"\\r\\n| where isnotempty(ThreatTypes) \\r\\n| summarize count() by Workload\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fde29b46-2896-4bfc-bb61-09436696d738\"},{\"type\":1,\"content\":{\"json\":\"### Top clicks on Malicious URLs<br>\\r\\n\\r\\n**Displays the top 20 URLs associated with detections that registered the highest number of clicks. Includes ThreatTypes, ActionType, and Workload to provide context on the nature of the threat and where user interaction occurred.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"22bda63a-626c-47de-9a76-ad665ef87862\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the top 20 URL's that have a detection associated with the most ammount of clicks registered \\r\\nUrlClickEvents\\r\\n| where ThreatTypes !=\\\"\\\"\\r\\n| summarize count() by Url, ThreatTypes, ActionType, Workload\\r\\n| top 20 by count_\\r\\n| project ['URL']=Url, ['Threat Types']=ThreatTypes, ['Action Type']=ActionType, Workload, ['Click Count']=count_\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Click Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 10 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a044fd4e-7be6-4a11-974c-b54e417c2a81\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"group - 31-URL clicks\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"75e543f6-08c0-42ed-9869-ecd61b721d34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Top Risky Users Clicking on URLs with Threats\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track and identify users who have clicked on malicious URLs detected by Microsoft Defender for Office 365.<br><br>**Recommended action:** Enroll these users in security awareness training and verify Safe Links policy coverage for their mailboxes.\"},\"name\":\"text - 13 - Copy - Copy - Copy\",\"id\":\"19487811-a94b-4537-877e-61ac7e287c21\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Users Clicking on URLs with Malware Threat<br>\\r\\n\\r\\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Malware. Helps identify individuals at greater risk and prioritise targeted security awareness training.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"78e10621-0e98-44c4-8399-810c19f138c2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 users with click attempts on URL's with malware detections\\r\\nUrlClickEvents\\r\\n| summarize TotalClickCount=count(),MalwareClickCount = countif(ThreatTypes has \\\"Malware\\\") by AccountUpn\\r\\n| extend Bad_Click_Percentage = todouble(round(MalwareClickCount / todouble(TotalClickCount) *100, 2))\\r\\n| where MalwareClickCount !=0\\r\\n| sort by MalwareClickCount desc\\r\\n| top 15 by MalwareClickCount\\r\\n| project ['User']=AccountUpn, ['Malware Clicks']=MalwareClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Malware Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"25ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Clicks\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Click %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalEmailCount\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad_Traffic_Percentage_Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 18 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a7ae8a75-ca7f-49be-8cad-d1451a3bd396\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Users Clicking on URLs with Phish Threat<br>\\r\\n\\r\\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Phish. Helps identify individuals at greater risk and prioritise targeted security awareness training.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"90d9a0c3-970a-4998-be62-3b3b84bb0f37\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 users with click attempts on URL's with Phish detections\\r\\nUrlClickEvents\\r\\n| summarize TotalClickCount=count(),PhishClickCount = countif(ThreatTypes has \\\"Phish\\\") by AccountUpn\\r\\n| extend Bad_Click_Percentage = todouble(round(PhishClickCount / todouble(TotalClickCount) *100, 2))\\r\\n| where PhishClickCount !=0\\r\\n| sort by PhishClickCount desc\\r\\n| top 15 by PhishClickCount\\r\\n| project ['User']=AccountUpn, ['Phish Clicks']=PhishClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Phish Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"25ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Clicks\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Click %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareClickCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalEmailCount\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad_Traffic_Percentage_Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 18 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d46877d9-03af-463a-b406-bb4c601dffeb\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Users Clicking on URLs with Spam Threat<br>\\r\\n\\r\\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Spam. Helps identify individuals at greater risk and prioritise targeted security awareness training.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"dc66e020-0932-4346-8e20-6a2dc78de7a9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 users with click attempts on URL's with Spam detections\\r\\nUrlClickEvents\\r\\n| summarize TotalClickCount=count(),SpamClickCount = countif(ThreatTypes has \\\"Spam\\\") by AccountUpn\\r\\n| extend Bad_Click_Percentage = todouble(round(SpamClickCount / todouble(TotalClickCount) *100, 2))\\r\\n| where SpamClickCount !=0\\r\\n| sort by SpamClickCount desc\\r\\n| top 15 by SpamClickCount\\r\\n| project ['User']=AccountUpn, ['Spam Clicks']=SpamClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Spam Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"25ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Clicks\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Click %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"PhishClickCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareClickCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MalwareEmailCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalEmailCount\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad_Traffic_Percentage_Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"50ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 18 - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"734ee45e-4dff-4ca1-b17d-02389086b17b\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"group - 32-Top clickers\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"ee6c3413-28be-49a1-a89d-bf5fce7acfa4\"},{\"type\":1,\"content\":{\"json\":\"# Microsoft Teams Collaboration Protection\\r\\n\\r\\n---\\r\\nAs email defenses mature, attackers are shifting into **Microsoft Teams**, where messages bypass secure email gateways and carry the implicit trust of a colleague chat. Microsoft Threat Intelligence reports Teams-based phishing and voice phishing (vishing) rising steadily through 2026, most often as **IT help desk or technical-support impersonation** from external or newly-created tenants, used to steer users toward remote-access tools and credential theft.\\r\\n\\r\\nThis tab shows **Microsoft Defender for Office 365** protection for Microsoft Teams: threat detections and impersonation, suspicious external senders, malicious URLs and clicks, malicious files, post-delivery ZAP removals, and user and admin submissions across chats and channels.\\r\\n\\r\\n**Recommended action:** Treat unsolicited external help desk or IT support contact as suspicious. Restrict inbound chat from unmanaged and consumer tenants, allowlist trusted external domains, remove or restrict remote-support tools such as Quick Assist where they are not required, and enforce phishing-resistant MFA for all users (Conditional Access with authentication strength), prioritizing privileged and administrator accounts first.\\r\\n\\r\\n[<p><b>Disrupting threats targeting Microsoft Teams</b></p>](https://www.microsoft.com/en-us/security/blog/2025/10/07/disrupting-threats-targeting-microsoft-teams/)[<p><b>Cross-tenant helpdesk impersonation to data exfiltration: a human-operated intrusion playbook</b></p>](https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/)[<p><b>Help on the line: how a Microsoft Teams support call led to compromise</b></p>](https://www.microsoft.com/en-us/security/blog/2026/03/16/help-on-the-line-how-a-microsoft-teams-support-call-led-to-compromise/)[<p><b>Email threat landscape: Q2 2026 trends and insights</b></p>](https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/)\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"text - teams description\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5c0f0100-0a11-4b22-9c33-000000000100\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Headline Microsoft Teams protection metrics for the selected period, with per-interval sparklines. Messages are de-duplicated to the latest record per Teams message.\\r\\nlet gran = {Granularity};\\r\\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\\r\\nlet zap = materialize(MessagePostDeliveryEvents);\\r\\nunion\\r\\n(msgs | summarize Count = count() | extend Details = \\\"Teams Messages Scanned\\\", Ord = 1, Trend = toscalar(msgs | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Messages with Threats\\\", Ord = 2, Trend = toscalar(msgs | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where ThreatTypes has \\\"Phish\\\" | summarize Count = count() | extend Details = \\\"Phish Detections\\\", Ord = 3, Trend = toscalar(msgs | where ThreatTypes has \\\"Phish\\\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where ThreatTypes has \\\"Malware\\\" | summarize Count = count() | extend Details = \\\"Malware Detections\\\", Ord = 4, Trend = toscalar(msgs | where ThreatTypes has \\\"Malware\\\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where ThreatTypes has \\\"Spam\\\" | summarize Count = count() | extend Details = \\\"Spam Detections\\\", Ord = 5, Trend = toscalar(msgs | where ThreatTypes has \\\"Spam\\\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(msgs | where SafetyTip == \\\"URLMessageWarning\\\" | summarize Count = count() | extend Details = \\\"Messages with URL Warning\\\", Ord = 6, Trend = toscalar(msgs | where SafetyTip == \\\"URLMessageWarning\\\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(zap | summarize Count = count() | extend Details = \\\"Post-Delivery ZAP Actions\\\", Ord = 7, Trend = toscalar(zap | make-series S = count() default = 0 on Timestamp step gran | project S))\\r\\n| sort by Ord asc\\r\\n| project Details, Count, Trend\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"name\":\"teams kpi tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b2c476ca-4141-43b4-9d4e-98470aa432fc\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Microsoft Teams - Collaboration Protection Overview\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Defender for Office 365 extends its protection to **Microsoft Teams**, detecting malicious messages, URLs, and files shared through chats and channels. This tab summarizes Teams message detections, link-safety warnings, post-delivery ZAP, file scanning, and user/admin submissions.<br><br>*Scope note: the Teams message tables surface metadata for external-conversation messages plus internal messages that contain URLs, so counts reflect that scope rather than the full volume of Teams messages.*\"},\"name\":\"teams overview banner\",\"id\":\"2f71360f-1673-480f-8361-5afc83aee67d\"},{\"type\":1,\"content\":{\"json\":\"### Teams threat detections over time<br>\\r\\n\\r\\n**Volume (per selected interval) of Microsoft Teams messages detected with a threat by Microsoft Defender for Office 365. Spikes may indicate a targeted Teams-based campaign.**\"},\"customWidth\":\"100\",\"name\":\"teams trend header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"0ac71d4e-8ecb-4d17-9fd3-10754007ec07\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the number of Microsoft Teams messages detected with a threat over time, de-duplicated to the latest record per message and summarized per selected interval.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId | summarize ThreatDetections = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ThreatDetections = coalesce(ThreatDetections, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"xAxis\":\"Timestamp\",\"seriesLabelSettings\":[{\"seriesName\":\"ThreatDetections\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"teams detection trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"937f3bc6-21f5-4f4c-ab72-78f08f32c5bd\"},{\"type\":1,\"content\":{\"json\":\"### Threat type breakdown<br>\\r\\n\\r\\n**Split of Microsoft Teams threat detections across Phish, Malware, and Spam.**\"},\"customWidth\":\"50\",\"name\":\"teams threat pie header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"645a39ae-843a-47db-8016-6082ef37744d\"},{\"type\":1,\"content\":{\"json\":\"### Thread exposure<br>\\r\\n\\r\\n**De-duplicated Microsoft Teams messages split by whether the conversation includes external participants.**\"},\"customWidth\":\"50\",\"name\":\"teams thread header\",\"id\":\"a1a48f9a-8593-4ab5-8824-5998c643e844\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query breaks down Microsoft Teams threat detections by threat type for the selected period, de-duplicated to the latest record per message. A message flagged for more than one threat type is counted under each, so the split can exceed the distinct message count.\\r\\nlet msgs = MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId;\\r\\nunion\\r\\n(msgs | where ThreatTypes has \\\"Phish\\\" | summarize Count = count() | extend ThreatType = \\\"Phish\\\"),\\r\\n(msgs | where ThreatTypes has \\\"Malware\\\" | summarize Count = count() | extend ThreatType = \\\"Malware\\\"),\\r\\n(msgs | where ThreatTypes has \\\"Spam\\\" | summarize Count = count() | extend ThreatType = \\\"Spam\\\")\\r\\n| project ThreatType, Count\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"teams threat type pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"029b4ecc-cd95-4385-a251-8ab194add8f4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\\r\\nMessageEvents\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| extend Thread = iif(IsExternalThread == true, \\\"External Thread\\\", \\\"Internal Thread\\\")\\r\\n| summarize Count = count() by Thread\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"teams thread pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1581f447-9b3e-4857-84b8-e78b5df65ac5\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Overview\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"283f36b2-5c54-4afe-9a87-33d4796bd5b7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Teams Calls and Vishing (Voice Phishing)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Voice phishing (vishing) over Microsoft Teams is the fastest-growing collaboration threat of 2026. Attackers impersonate IT help desk or support and call users directly, often after a chat lure, to talk them into granting remote access or entering credentials. Because a target must be online to answer, malicious calls cluster in working hours. This section surfaces Teams call activity, when calls happen, and callers using support or brand-impersonation identities.**<br><br>*Interim data source: Teams call activity is currently read from Microsoft Defender for Cloud Apps call telemetry (CloudAppEvents). It will move to the dedicated CallActivityEvents table once that table is available to stream into Microsoft Sentinel.*<br><br>**Recommended action:** Treat unsolicited help desk or support calls as suspicious. Confirm any request through a known internal channel, and never grant remote access such as Quick Assist on the strength of an inbound Teams call. Restrict inbound calls and chat from unmanaged and consumer tenants.\"},\"customWidth\":\"100\",\"name\":\"teams calls banner\",\"id\":\"9815bdc9-9e10-4e84-9164-783092b4ccb0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Teams call and vishing headline metrics for the selected period, with per-interval sparklines. Interim source: Defender for Cloud Apps call telemetry (CloudAppEvents / CallParticipantDetail).\\r\\nlet gran = {Granularity};\\r\\nlet calls = materialize(CloudAppEvents | where ActionType == \\\"CallParticipantDetail\\\" | extend R = parse_json(RawEventData) | extend CallId = tostring(R.CallId), UId = tolower(tostring(R.UserId)));\\r\\nlet susp = calls | extend Local = tostring(split(UId, \\\"@\\\")[0]), Dom = tostring(split(UId, \\\"@\\\")[1]) | where Local matches regex @\\\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\\\" or Dom endswith \\\".onmicrosoft.com\\\";\\r\\nlet reported = CloudAppEvents | where ActionType == \\\"CallReported\\\";\\r\\nunion\\r\\n(calls | summarize Count = dcount(CallId) | extend Details = \\\"Teams Calls\\\", Ord = 1, Trend = toscalar(calls | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(susp | summarize Count = dcount(UId) | extend Details = \\\"Impersonation-style Callers\\\", Ord = 2, Trend = toscalar(susp | make-series S = count() default = 0 on Timestamp step gran | project S)),\\r\\n(reported | summarize Count = count() | extend Details = \\\"Reported Suspicious Calls\\\", Ord = 3, Trend = toscalar(reported | make-series S = count() default = 0 on Timestamp step gran | project S))\\r\\n| sort by Ord asc\\r\\n| project Details, Count, Trend\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21},\"showBorder\":true,\"size\":\"auto\"},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams calls kpi\",\"id\":\"be8946d9-1eae-405c-b8df-cee2242cb44d\"},{\"type\":1,\"content\":{\"json\":\"### Teams call activity over time<br>\\r\\n**Distinct Microsoft Teams calls per selected interval. A sudden rise, or calls outside normal working hours, can indicate a vishing campaign in progress.**\"},\"customWidth\":\"100\",\"name\":\"teams calls trend header\",\"id\":\"1b49c98f-e5d9-457c-b058-a195e89eac0e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Distinct Teams calls per interval (interim source: CloudAppEvents / CallParticipantDetail).\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"CallParticipantDetail\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend CallId = tostring(R.CallId)\\r\\n| summarize ['Teams Calls'] = dcount(CallId) by Timestamp = bin(Timestamp, {Granularity})\\r\\n| sort by Timestamp asc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"xAxis\":\"Timestamp\",\"seriesLabelSettings\":[{\"seriesName\":\"Teams Calls\",\"color\":\"blueDark\"}]},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams calls trend\",\"id\":\"7538b3ca-b96d-421a-9cdc-69b8aef4b185\"},{\"type\":1,\"content\":{\"json\":\"### When calls happen (hour of day, UTC)<br>\\r\\n**Microsoft Teams calls by the hour of day they started (UTC), listed 00:00 through 23:00. The bar length is the number of calls that started in that hour across the selected period. Vishing calls cluster in working hours because the target must be online to answer, with the heaviest malicious-call activity between 14:00 and 20:00 UTC, Monday to Friday, according to Microsoft Threat Intelligence. Use this to baseline normal call timing and spot unusual off-hours spikes.**\"},\"customWidth\":\"100\",\"name\":\"teams calls hour header\",\"id\":\"6bc095e9-fe0d-4f6f-81bd-f3374d758229\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Teams calls by start hour of day (UTC), all 24 hours 00:00..23:00 in order (interim source: CloudAppEvents / CallParticipantDetail).\\r\\nlet data = CloudAppEvents\\r\\n| where ActionType == \\\"CallParticipantDetail\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend JoinTime = todatetime(R.JoinTime), CallId = tostring(R.CallId)\\r\\n| where isnotempty(JoinTime) and isnotempty(CallId)\\r\\n| summarize CallStart = min(JoinTime) by CallId\\r\\n| extend HourUTC = hourofday(CallStart)\\r\\n| summarize Calls = count() by HourUTC;\\r\\nrange HourUTC from 0 to 23 step 1\\r\\n| join kind=leftouter (data) on HourUTC\\r\\n| extend Calls = coalesce(Calls, 0)\\r\\n| extend HourLabel = strcat(iif(HourUTC < 10, strcat(\\\"0\\\", tostring(HourUTC)), tostring(HourUTC)), \\\":00\\\")\\r\\n| order by HourUTC asc\\r\\n| project ['Hour of Day (UTC)'] = HourLabel, ['Teams Calls'] = Calls\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Teams Calls\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blueDark\",\"customColumnWidthSetting\":\"360px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams calls hour\",\"id\":\"c36a9909-5570-4fe7-8efc-1b9b4745713a\"},{\"type\":1,\"content\":{\"json\":\"### Suspicious callers (support and helpdesk impersonation)<br>\\r\\n**Teams call participants whose display name or address looks like IT support, help desk, or a well-known brand (for example \\\"Microsoft IT support\\\", \\\"Help Desk\\\", \\\"Office 365 Support\\\"), or who dial in from a throwaway `.onmicrosoft.com` tenant. Origin shows whether the caller is external, an external throwaway tenant, or inside your own tenant. External and throwaway-tenant callers are the primary vishing risk; own-tenant matches are frequently a legitimate internal help desk and should be confirmed rather than assumed malicious.**<br><br>**Recommended action:** Prioritise External and `.onmicrosoft` callers, confirm none are legitimate, and warn the users they called. Genuine IT support does not cold-call staff over Teams to request remote access.\"},\"customWidth\":\"100\",\"name\":\"teams calls susp header\",\"id\":\"aa420b5f-efd2-4da5-ab41-192031f62ed1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Suspicious Teams callers by impersonation-style DISPLAY NAME or address (Attendees[].DisplayName / UPN), with Origin from the org's own accepted (EmailEvents inbound) domains - no tenant-id anchor. Interim source: CloudAppEvents / CallParticipantDetail.\\r\\nlet suspRegex = @\\\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\\\";\\r\\nlet ownDomains = toscalar(EmailEvents | where EmailDirection == \\\"Inbound\\\" | extend RD = tolower(tostring(split(RecipientEmailAddress, \\\"@\\\")[1])) | where isnotempty(RD) | summarize make_set(RD, 200));\\r\\nlet calls = CloudAppEvents\\r\\n| where ActionType == \\\"CallParticipantDetail\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend CallId = tostring(R.CallId), JoinTime = todatetime(R.JoinTime), Attendees = R.Attendees\\r\\n| where isnotempty(CallId);\\r\\nlet callAtt = calls | summarize Attendees = take_any(Attendees), JoinTime = min(JoinTime) by CallId;\\r\\ncallAtt\\r\\n| mv-expand Att = Attendees\\r\\n| extend Caller = tolower(tostring(Att.UPN)), CallerName = tostring(Att.DisplayName)\\r\\n| extend CallerDom = tostring(split(Caller, \\\"@\\\")[1])\\r\\n| where isnotempty(Caller)\\r\\n| extend SuspName = CallerName matches regex suspRegex or Caller matches regex suspRegex\\r\\n| where SuspName or CallerDom endswith \\\".onmicrosoft.com\\\"\\r\\n| extend Origin = case(CallerDom endswith \\\".onmicrosoft.com\\\", \\\"External (.onmicrosoft throwaway)\\\", set_has_element(ownDomains, CallerDom), \\\"Own tenant\\\", \\\"External\\\")\\r\\n| summarize CallsPlaced = dcount(CallId), FirstSeen = min(JoinTime), LastSeen = max(JoinTime) by CallerName, Caller, Origin\\r\\n| extend OriginRank = case(Origin == \\\"External (.onmicrosoft throwaway)\\\", 0, Origin == \\\"External\\\", 1, 2)\\r\\n| sort by OriginRank asc, CallsPlaced desc\\r\\n| take 10\\r\\n| project ['Caller Display Name'] = CallerName, ['Caller Address'] = Caller, ['Origin'] = Origin, ['Calls Placed'] = CallsPlaced, ['First Seen'] = FirstSeen, ['Last Seen'] = LastSeen\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Calls Placed\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams calls susp table\",\"id\":\"d1c4df7b-db07-4c4c-bc71-dfd8623cd704\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Calls and Vishing\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"1d133411-9b5c-4ede-8502-68b3b02262e4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Teams Impersonation &amp; Identity Deception\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Defender for Office 365 flags Teams messages where a sender impersonates a brand, a specific person, or a trusted domain. Impersonation is the entry point for most Teams social-engineering: attackers pose as IT, executives, or Microsoft to build trust before delivering a malicious link or request. These visuals expose <b>who is being impersonated, who is being targeted, and the infrastructure (display names, look-alike domains, and URLs)</b> behind the campaigns so you can hunt IOCs and coach at-risk users.<br><br>**Recommended action:** Treat the impersonated display names and look-alike domains below as IOCs to hunt, and prioritize the Microsoft Defender alert *Microsoft Teams chat initiated by a suspicious external user*. Teach users that a Teams display name is not proof of identity: verify the real sender domain, and confirm any help desk, executive, or Microsoft support request through a known internal channel before acting.\"},\"name\":\"teams imp banner\",\"id\":\"7ff04ff3-9f2d-4a49-8383-2b542d78fe9b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nunion\\r\\n(imp | summarize Count=count() | extend Details=\\\"Impersonation Detections\\\", Ord=1),\\r\\n(imp | summarize Count=dcount(FakeSenderAddress) | extend Details=\\\"Distinct Fake Senders\\\", Ord=2),\\r\\n(imp | summarize Count=dcount(TargetUser) | extend Details=\\\"Targeted Users\\\", Ord=3),\\r\\n(imp | summarize Count=dcount(ImpersonationType) | extend Details=\\\"Impersonation Types\\\", Ord=4)\\r\\n| sort by Ord asc | project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams imp tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e37f94d5-9bcc-432e-aa66-25831603c228\"},{\"type\":1,\"content\":{\"json\":\"### Impersonation over time, by type<br>\\r\\n\\r\\n**Trend of Brand, User, and Domain impersonation detections. A spike in a single type often marks the start of a targeted campaign.**\"},\"customWidth\":\"100\",\"name\":\"teams imp trend header\",\"id\":\"09907f5b-5c20-4a7e-86d3-c89153c4df98\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp | summarize Count=count() by ImpersonationType, Timestamp=bin(Timestamp, {Granularity}) | sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"100\",\"name\":\"teams imp trend\",\"id\":\"757204b1-e900-4217-a2ff-2224a033fdcc\"},{\"type\":1,\"content\":{\"json\":\"### Suspicious external senders (impersonation and throwaway tenants)<br>\\r\\n**External Microsoft Teams senders flagged as likely impersonation: throwaway `.onmicrosoft.com` tenants and/or help desk, IT support, security, admin, or account/update-themed display names. Attackers rotate through many such identities (for example numbered `ithelpdesk<n>@...` addresses) from newly-created or consumer tenants to pose as internal support, frequently before the Defender impersonation detector assigns a verdict. This heuristic complements that detector.**<br><br>**Recommended action:** Review high threat-rate senders, block the sending domains, and remind users that genuine IT support does not cold-contact them from an external tenant; verify any such request through a known internal channel.\"},\"customWidth\":\"100\",\"name\":\"teams susp senders header\",\"id\":\"5df4af86-49e9-4fc7-b6ad-76d3ef3f7da6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//External Teams senders flagged as likely impersonation: throwaway .onmicrosoft.com tenants and/or help desk / IT / admin / update-themed display names, ranked by messages carrying a threat.\\r\\nMessageEvents\\r\\n| where IsExternalThread == true\\r\\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \\\"@\\\")[1]))\\r\\n| extend IsOnMicrosoft = SenderDomain endswith \\\".onmicrosoft.com\\\"\\r\\n| extend SuspName = SenderDisplayName matches regex @\\\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\\\"\\r\\n| where IsOnMicrosoft or SuspName\\r\\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\\r\\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \\\"Throwaway .onmicrosoft tenant + helpdesk-style name\\\", IsOnMicrosoft, \\\"Throwaway .onmicrosoft tenant\\\", \\\"Helpdesk / IT-style display name\\\")\\r\\n| extend ThreatPct = round(todouble(ThreatMessages) * 100 / TeamsMessages, 1)\\r\\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages, ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\\r\\n| sort by ['Threat Messages'] desc, ['Teams Messages'] desc\\r\\n| take 10\",\"size\":0,\"title\":\"\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Teams Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Threat %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":100},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]},\"showAnalytics\":true},\"customWidth\":\"100\",\"name\":\"teams susp senders table\",\"id\":\"dd1d79d8-f591-4aae-bd44-6ad23a3e0ae4\"},{\"type\":1,\"content\":{\"json\":\"### Who is being targeted<br>\\r\\n\\r\\n**Internal users receiving the most impersonation attempts. Concentrated targeting of a few users is a strong signal of a deliberate campaign - prioritize these users for security awareness training.**\"},\"customWidth\":\"100\",\"name\":\"teams imp targets header\",\"id\":\"43112ad1-ebc9-42fb-9ebd-0dbaa862ed45\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp | summarize Detections=count(), ['Distinct Fake Senders']=dcount(FakeSenderAddress), Types=make_set(ImpersonationType,3), ['Last Seen']=max(Timestamp) by ['Targeted User']=TargetUser | top 10 by Detections\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams imp targets\",\"id\":\"cc4b3f98-bfcb-4741-9abb-9ff099eb946f\"},{\"type\":1,\"content\":{\"json\":\"### Impersonating senders<br>\\r\\n\\r\\n**The identities behind the impersonation, grouped by fake display name, sender domain, and type. Attackers rotate through many sending addresses under a single display name - Distinct Sender Addresses exposes that rotation, and a high count is itself a strong bulk-campaign signal. Use First/Last Seen to scope the campaign window.**\"},\"customWidth\":\"100\",\"name\":\"teams imp senders header\",\"id\":\"99859796-7b69-42e7-a27a-541e0ba86cb2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the identities behind Teams impersonation, grouped by the fake display name, sender domain, and impersonation type. Attackers rotate through many sending addresses under one display name, so Distinct Sender Addresses reveals bulk campaigns that per-address ranking would hide.\\r\\nlet imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp\\r\\n| summarize Detections=count(), SenderAddresses=dcount(FakeSenderAddress), Targets=dcount(TargetUser), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by FakeDisplayName, FakeSenderDomain, ImpersonationType\\r\\n| top 10 by Detections\\r\\n| project ['Fake Display Name']=FakeDisplayName, ['Sender Domain']=FakeSenderDomain, ['Impersonation Type']=ImpersonationType, ['Distinct Sender Addresses']=SenderAddresses, Detections, ['Targeted Users']=Targets, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Distinct Sender Addresses\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams imp senders\",\"id\":\"209439a0-5be3-4e41-abe9-695552730dc8\"},{\"type\":1,\"content\":{\"json\":\"### Display names abused<br>\\r\\n\\r\\n**The identities attackers pretend to be (for example \\\"IT HelpDesk\\\", \\\"Microsoft Support\\\"). These are the trust anchors of the social-engineering lure.**\"},\"customWidth\":\"100\",\"name\":\"teams imp names header\",\"id\":\"e645578b-7a52-4d38-9d83-f5c500bbfe1a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Distinct Senders']=dcount(FakeSenderAddress) by ['Fake Display Name']=FakeDisplayName | top 10 by Detections\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Distinct Senders\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams imp names\",\"id\":\"d723d72b-4e7c-431b-ae7b-980879c8bd75\"},{\"type\":1,\"content\":{\"json\":\"### Look-alike sender domains<br>\\r\\n\\r\\n**Sending domains used for impersonation - watch for typosquats (for example rnicrosoft.com for m&rarr;rn). Add confirmed domains to your Tenant Allow/Block List.**\"},\"customWidth\":\"100\",\"name\":\"teams imp domains header\",\"id\":\"98040a5a-bbd5-4c95-b976-5630ce48b282\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ImpersonationType = tostring(RD.ImpersonationType),\\r\\n         FakeDisplayName   = tostring(RD.Sender.DisplayName),\\r\\n         FakeSenderAddress = tostring(RD.Sender.UPN),\\r\\n         ChatThreadId      = tostring(RD.ChatThreadId),\\r\\n         TargetUser        = tostring(RD.UserId)\\r\\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \\\"@\\\")[1]);\\r\\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Display Names Used']=dcount(FakeDisplayName) by ['Sender Domain']=FakeSenderDomain | top 10 by Detections\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Display Names Used\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams imp domains\",\"id\":\"94b9fa45-c889-46a7-8b80-92e5d280ad3b\"},{\"type\":1,\"content\":{\"json\":\"### URL IOCs from impersonation messages<br>\\r\\n\\r\\n**URL domains that appeared in messages sent by impersonating senders. Threat actors deliberately mix legitimate domains (for example microsoft.com or google.com) with their malicious ones to make the lure look trustworthy, so treat this as a review list - not a blocklist. Investigate the unfamiliar or look-alike domains and block only those you confirm malicious; never block a well-known legitimate domain from this list.**\"},\"customWidth\":\"100\",\"name\":\"teams imp ioc header\",\"id\":\"d5f4886c-7c7e-4c6f-94ca-569cabda5ede\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists URL domains that appeared in messages sent by impersonating senders, with a breakdown of how many carried Malware, Phish, or Spam verdicts. Threat actors mix legitimate and malicious domains in a single lure, so review the unfamiliar or look-alike domains and block only confirmed-malicious ones.\\r\\nlet imp = CloudAppEvents\\r\\n| where ActionType == \\\"TeamsImpersonationDetected\\\"\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend ChatThreadId = tostring(RD.ChatThreadId);\\r\\nlet impThreads = imp | distinct ChatThreadId;\\r\\nlet impMsgs = MessageEvents\\r\\n    | where ThreadId in (impThreads)\\r\\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n    | project TeamsMessageId, ThreatTypes;\\r\\nMessageUrlInfo\\r\\n| where isnotempty(UrlDomain)\\r\\n| join kind=inner (impMsgs) on TeamsMessageId\\r\\n| summarize ['URL Count']=count(), Messages=dcount(TeamsMessageId), Malware=countif(ThreatTypes has \\\"Malware\\\"), Phish=countif(ThreatTypes has \\\"Phish\\\"), Spam=countif(ThreatTypes has \\\"Spam\\\") by ['URL Domain']=UrlDomain\\r\\n| top 10 by ['URL Count']\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"URL Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Malware\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Phish\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Spam\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams imp ioc\",\"id\":\"958ac65c-d56d-4a80-ba83-2ab33e8b1e2e\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Impersonation\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"c49582db-6318-423f-b806-91cbeb625ea2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Malicious URLs and Link Warnings in Teams\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nTracks URLs shared through Microsoft Teams, messages that triggered a Microsoft Defender for Office 365 URL safety-tip warning, and the outcome of Teams URL clicks (allowed versus blocked) captured in UrlClickEvents.<br><br>**Recommended action:** Enable Safe Links for Microsoft Teams so links are checked at click time, and prioritize *User clicked a malicious link in Teams chat* alerts for investigation. Treat a blocked click as an attempted compromise: check whether the user went on to share credentials or run a file, and reset credentials where warranted.\"},\"name\":\"teams url banner\",\"id\":\"e3ec4d65-8d1f-4303-bd8f-eb1ae521da41\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query surfaces Microsoft Teams URL-sharing and link-warning metrics for the selected period. URL-warning messages carry the Microsoft Defender for Office 365 URL safety tip.\\r\\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\\r\\nunion\\r\\n(msgs | where SafetyTip == \\\"URLMessageWarning\\\" | summarize Count = count() | extend Details = \\\"Messages with URL Warning\\\", Ord = 1),\\r\\n(MessageUrlInfo | summarize Count = count() | extend Details = \\\"URLs Shared in Messages\\\", Ord = 2),\\r\\n(MessageUrlInfo | summarize Count = dcount(TeamsMessageId) | extend Details = \\\"Messages Containing URLs\\\", Ord = 3),\\r\\n(MessageUrlInfo | summarize Count = dcount(UrlDomain) | extend Details = \\\"Distinct URL Domains\\\", Ord = 4)\\r\\n| sort by Ord asc\\r\\n| project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams url tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b71382c7-c0f7-4f9d-9d21-e0a8bf9504ff\"},{\"type\":1,\"content\":{\"json\":\"### Teams URL click outcomes over time<br>\\r\\n\\r\\n**Allowed versus blocked Microsoft Teams URL clicks (per selected interval) from UrlClickEvents where the click happened in the Teams workload.**\"},\"customWidth\":\"66\",\"name\":\"teams click trend header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"30818e0d-6c4b-4868-896a-ac48cb3cef86\"},{\"type\":1,\"content\":{\"json\":\"### Click outcomes<br>\\r\\n\\r\\n**Distribution of Microsoft Teams URL click actions by type.**\"},\"customWidth\":\"33\",\"name\":\"teams click pie header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"5a882138-2241-4527-80b8-9983c5807050\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Microsoft Teams URL click outcomes over time (allowed vs blocked) using the UrlClickEvents workload filter, summarizing the data per selected interval.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(UrlClickEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(UrlClickEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(UrlClickEvents\\r\\n| where Workload == \\\"Teams\\\"\\r\\n| summarize ClickAllowed = countif(ActionType has \\\"ClickAllowed\\\"), ClickBlocked = countif(ActionType has \\\"ClickBlocked\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ClickAllowed = coalesce(ClickAllowed, 0), ClickBlocked = coalesce(ClickBlocked, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"66\",\"name\":\"teams click trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7a2f5559-1e3e-412a-addf-c3bf6be98502\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows Microsoft Teams URL click outcomes by action type for the selected period.\\r\\nUrlClickEvents\\r\\n| where Workload == \\\"Teams\\\"\\r\\n| where isnotempty(ActionType)\\r\\n| summarize Count = count() by ActionType\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"teams click pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"889c6bb3-438b-4575-84f2-084c1b5fd1f4\"},{\"type\":1,\"content\":{\"json\":\"### Top domains shared in Teams messages<br>\\r\\n\\r\\n**The 10 most-shared URL domains in Microsoft Teams messages, with the number of messages each appeared in.**\"},\"customWidth\":\"100\",\"name\":\"teams top domains header\",\"id\":\"dcb8c87c-087e-4d69-b7b7-0329296293ff\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 URL domains shared in Microsoft Teams messages by volume for the selected period.\\r\\nMessageUrlInfo\\r\\n| where isnotempty(UrlDomain)\\r\\n| summarize UrlCount = count(), Messages = dcount(TeamsMessageId) by UrlDomain\\r\\n| top 10 by UrlCount\\r\\n| project ['URL Domain']=UrlDomain, ['URLs Shared']=UrlCount, ['Messages']=Messages\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"URLs Shared\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams top domains table\",\"id\":\"7561adb0-1fbe-41ce-a924-a27bcd4c5c12\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Malicious URLs\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"6d47c309-be9e-4b21-940e-7c7b282e5dc2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Targeted Users &amp; Risky Senders\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nIdentifies who is most targeted in Microsoft Teams, and profiles the external senders and domains behind risky messages - URL safety-tip warnings, first-contact senders, threat-carrying domains, and low-reputation link infrastructure - so you can spot anomalous senders before they succeed.<br><br>**Recommended action:** Prioritize the most-targeted users for phishing-resistant MFA and awareness coaching, and treat first-contact external senders and low-reputation domains as IOCs. Restrict inbound chat from unmanaged and consumer tenants, and allowlist only trusted external domains so unsolicited outsiders cannot start a conversation.\"},\"name\":\"teams risky banner\",\"id\":\"0aa13d73-2e13-487c-a7c4-d90464a554d4\"},{\"type\":1,\"content\":{\"json\":\"### Top targeted users (messages with threats)<br>\\r\\n\\r\\n**The 10 users receiving the most Microsoft Teams messages that contained a threat, expanded from each message recipient list.**\"},\"customWidth\":\"100\",\"name\":\"teams targeted header\",\"id\":\"827dc0f6-2bb2-49b9-acf8-d7b400238594\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 users receiving Microsoft Teams messages that contained a threat, expanded from the message recipient list, with each user's total Teams messages received and the share that carried a threat. Messages are de-duplicated to the latest record per message.\\r\\nlet expanded = MessageEvents\\r\\n    | summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n    | mv-expand rd = parse_json(RecipientDetails)\\r\\n    | extend Recipient = tostring(rd.RecipientSmtpAddress)\\r\\n    | where isnotempty(Recipient);\\r\\nlet totals = expanded | summarize TotalMessages = count() by Recipient;\\r\\nexpanded\\r\\n| where isnotempty(ThreatTypes)\\r\\n| summarize ThreatMessages = count() by Recipient\\r\\n| join kind=leftouter (totals) on Recipient\\r\\n| extend ThreatPct = round(100.0 * ThreatMessages / TotalMessages, 1)\\r\\n| top 10 by ThreatMessages\\r\\n| project ['Recipient']=Recipient, ['Threat Messages']=ThreatMessages, ['Total Messages']=TotalMessages, ['Threat %']=ThreatPct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams targeted users table\",\"id\":\"79481d1b-617e-46df-b555-9f7240932dd0\"},{\"type\":1,\"content\":{\"json\":\"### Top senders of URL-warning messages<br>\\r\\n\\r\\n**Senders whose Microsoft Teams messages most often triggered a URL safety-tip warning.**\"},\"customWidth\":\"50\",\"name\":\"teams warn senders header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"ef71d7dd-4442-4992-977d-d550aad4533c\"},{\"type\":1,\"content\":{\"json\":\"### Top domains in URL-warning messages<br>\\r\\n\\r\\n**URL domains most frequently present in Microsoft Teams messages that triggered a URL safety-tip warning.**\"},\"customWidth\":\"50\",\"name\":\"teams warn domains header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"6f41a4ba-f832-4947-ad27-cd6b8015bd63\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 senders whose Microsoft Teams messages triggered a URL safety-tip warning for the selected period, with each sender's total Teams messages and the share that carried a warning. Messages are de-duplicated to the latest record per message.\\r\\nlet dedup = MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId;\\r\\nlet totals = dedup | summarize TotalMessages = count() by SenderEmailAddress;\\r\\ndedup\\r\\n| where SafetyTip == \\\"URLMessageWarning\\\"\\r\\n| summarize WarningMessages = count() by SenderEmailAddress\\r\\n| join kind=leftouter (totals) on SenderEmailAddress\\r\\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\\r\\n| top 10 by WarningMessages\\r\\n| project ['Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Warning Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"teams warn senders table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3fa023af-79e3-407f-ac20-b0aa6e3ba511\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 URL domains appearing in Microsoft Teams messages that triggered a URL safety-tip warning, with the domain's total message appearances and the share that carried a warning.\\r\\nlet warned = MessageEvents | where SafetyTip == \\\"URLMessageWarning\\\" | distinct TeamsMessageId;\\r\\nlet totals = MessageUrlInfo | where isnotempty(UrlDomain) | summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;\\r\\nMessageUrlInfo\\r\\n| where TeamsMessageId in (warned)\\r\\n| summarize WarningMessages = dcount(TeamsMessageId) by UrlDomain\\r\\n| join kind=leftouter (totals) on UrlDomain\\r\\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\\r\\n| top 10 by WarningMessages\\r\\n| project ['URL Domain']=UrlDomain, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Warning Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"teams warn domains table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"68811015-1383-48ad-86da-4f8f9d39e4c4\"},{\"type\":1,\"content\":{\"json\":\"### First-contact external senders<br>\\r\\n\\r\\n**External Microsoft Teams senders ordered by when they were first seen in the period (most recent first). Note: some flows tag internal-domain senders as external - to hide your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**\"},\"customWidth\":\"100\",\"name\":\"teams fc senders header\",\"id\":\"0f131ff3-d6b2-4187-b86c-ca3493594b54\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists external Microsoft Teams senders by the date they were first seen in the selected period, surfacing recent first-contact senders. Messages are de-duplicated to the latest record per message. In tenants with longer history this highlights genuinely new senders.\\r\\n// TIP: IsExternalThread may still surface senders from your own accepted domains. To hide them,\\r\\n// uncomment the ExcludeDomains line below (add your tenant domains) and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"contoso.com\\\"]);\\r\\nMessageEvents\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| where IsExternalThread == true\\r\\n//| where tostring(split(SenderEmailAddress, \\\"@\\\")[1]) !in~ (ExcludeDomains)\\r\\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\\r\\n| top 10 by FirstSeen desc\\r\\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"Threat Messages\",\"sortOrder\":2}]}},\"customWidth\":\"100\",\"name\":\"teams fc senders table\",\"id\":\"4e10a78d-8858-4dbb-9db0-e7b7d7e7636c\"},{\"type\":1,\"content\":{\"json\":\"### External sender-domain risk<br>\\r\\n\\r\\n**External sending domains ranked by threat volume, with the mix of conversation types (1:1 chat, group chat, channel), threat breakdown, threat rate, count of messages carrying low-reputation URLs (domains on commonly-abused TLDs such as .xyz, .top, .click, .shop, .zip), and first/last-seen. A domain that is new in the period, skews toward 1:1 chats, or shows a high threat rate is anomalous and warrants review. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**\"},\"customWidth\":\"100\",\"name\":\"teams anomaly header\",\"id\":\"a91295db-8192-4828-93c5-408436e4b0e1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query ranks external sender domains in Microsoft Teams by threat volume for the selected period, split by conversation type (1:1 chat, group chat, channel), with threat-type breakdown, threat rate, and a count of messages carrying low-reputation URL TLDs. Messages are de-duplicated to the latest record per message. New, 1:1-skewed, or high-threat-rate domains are the anomalies to review.\\r\\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\\r\\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"contoso.com\\\"]);\\r\\nlet suspTlds = dynamic([\\\"top\\\",\\\"xyz\\\",\\\"click\\\",\\\"link\\\",\\\"shop\\\",\\\"online\\\",\\\"site\\\",\\\"live\\\",\\\"icu\\\",\\\"cyou\\\",\\\"sbs\\\",\\\"rest\\\",\\\"quest\\\",\\\"cfd\\\",\\\"bond\\\",\\\"buzz\\\",\\\"fun\\\",\\\"space\\\",\\\"monster\\\",\\\"work\\\",\\\"tk\\\",\\\"ml\\\",\\\"ga\\\",\\\"cf\\\",\\\"gq\\\",\\\"dev\\\",\\\"app\\\",\\\"zip\\\",\\\"mov\\\",\\\"info\\\",\\\"win\\\",\\\"loan\\\",\\\"men\\\",\\\"stream\\\",\\\"country\\\"]);\\r\\nlet suspUrlMsgs = MessageUrlInfo\\r\\n    | where isnotempty(UrlDomain)\\r\\n    | extend Tld = tostring(split(UrlDomain, \\\".\\\")[-1])\\r\\n    | where Tld in (suspTlds)\\r\\n    | distinct TeamsMessageId;\\r\\nMessageEvents\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| where IsExternalThread == true\\r\\n| extend SenderDomain = tostring(split(SenderEmailAddress, \\\"@\\\")[1])\\r\\n| where isnotempty(SenderDomain)\\r\\n//| where SenderDomain !in~ (ExcludeDomains)\\r\\n| extend ConvType = case(isnotempty(GroupId), \\\"Channel\\\", array_length(todynamic(RecipientDetails)) > 1, \\\"Group chat\\\", \\\"1:1 chat\\\")\\r\\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\\r\\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\\\"1:1 chat\\\"), GroupChat=countif(ConvType==\\\"Group chat\\\"), ChannelMsgs=countif(ConvType==\\\"Channel\\\"), ThreatMessages=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \\\"Malware\\\"), Phish=countif(ThreatTypes has \\\"Phish\\\"), Spam=countif(ThreatTypes has \\\"Spam\\\"), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\\r\\n| where ThreatMessages > 0\\r\\n| extend ThreatRatePct = round(100.0 * ThreatMessages / Messages, 1)\\r\\n| top 10 by ThreatMessages desc\\r\\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Threat Msgs']=ThreatMessages, Malware, Phish, Spam, ['Threat Rate %']=ThreatRatePct, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Threat Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams anomaly table\",\"id\":\"bcd6746d-8298-495d-9d6c-2fadc6cba569\"},{\"type\":1,\"content\":{\"json\":\"### Suspicious new senders (no threat verdict yet)<br>\\r\\n\\r\\n**External sending domains with no threat verdict yet, but that are either sending low-reputation-URL messages or showing unusual volume. These slip past threat filters - watch for new domains skewing toward 1:1 chats, an early social-engineering signal. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**\"},\"customWidth\":\"100\",\"name\":\"teams newdom header\",\"id\":\"9e3844f4-befc-4b76-a8cd-ca53fdf51d41\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query surfaces external sender domains in Microsoft Teams that have NO threat verdict yet but are sending messages with low-reputation URL TLDs or unusual volume, split by conversation type. These are early-warning senders that have not tripped a detection. Messages are de-duplicated to the latest record per message.\\r\\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\\r\\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\\r\\n//let ExcludeDomains = dynamic([\\\"contoso.com\\\",\\\"contoso.com\\\"]);\\r\\nlet suspTlds = dynamic([\\\"top\\\",\\\"xyz\\\",\\\"click\\\",\\\"link\\\",\\\"shop\\\",\\\"online\\\",\\\"site\\\",\\\"live\\\",\\\"icu\\\",\\\"cyou\\\",\\\"sbs\\\",\\\"rest\\\",\\\"quest\\\",\\\"cfd\\\",\\\"bond\\\",\\\"buzz\\\",\\\"fun\\\",\\\"space\\\",\\\"monster\\\",\\\"work\\\",\\\"tk\\\",\\\"ml\\\",\\\"ga\\\",\\\"cf\\\",\\\"gq\\\",\\\"dev\\\",\\\"app\\\",\\\"zip\\\",\\\"mov\\\",\\\"info\\\",\\\"win\\\",\\\"loan\\\",\\\"men\\\",\\\"stream\\\",\\\"country\\\"]);\\r\\nlet suspUrlMsgs = MessageUrlInfo\\r\\n    | where isnotempty(UrlDomain)\\r\\n    | extend Tld = tostring(split(UrlDomain, \\\".\\\")[-1])\\r\\n    | where Tld in (suspTlds)\\r\\n    | distinct TeamsMessageId;\\r\\nMessageEvents\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| where IsExternalThread == true\\r\\n| extend SenderDomain = tostring(split(SenderEmailAddress, \\\"@\\\")[1])\\r\\n| where isnotempty(SenderDomain)\\r\\n//| where SenderDomain !in~ (ExcludeDomains)\\r\\n| extend ConvType = case(isnotempty(GroupId), \\\"Channel\\\", array_length(todynamic(RecipientDetails)) > 1, \\\"Group chat\\\", \\\"1:1 chat\\\")\\r\\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\\r\\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\\\"1:1 chat\\\"), GroupChat=countif(ConvType==\\\"Group chat\\\"), ChannelMsgs=countif(ConvType==\\\"Channel\\\"), ThreatMessages=countif(isnotempty(ThreatTypes)), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\\r\\n| where ThreatMessages == 0\\r\\n| where SuspUrlMsgs > 0 or Messages >= 5\\r\\n| order by SuspUrlMsgs desc, Messages desc\\r\\n| take 10\\r\\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams newdom table\",\"id\":\"8036a5b7-b5b3-4af4-912f-bb092bb01b89\"},{\"type\":1,\"content\":{\"json\":\"### Low-reputation link domains in Teams (IOC radar)<br>\\r\\n\\r\\n**URL domains shared in Teams that use TLDs commonly abused for phishing and malware (for example .xyz, .top, .click, .zip, .shop). Ranked by message reach, with first/last-seen. Review these domains as potential indicators - .zip and .mov are especially deceptive because links read like file names.**\"},\"customWidth\":\"100\",\"name\":\"teams tld header\",\"id\":\"d48921f4-233c-4e0f-a97b-83e1bcaed399\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists URL domains shared in Microsoft Teams that use low-reputation TLDs commonly abused for phishing and malware, ranked by the number of Teams messages they appeared in, with first- and last-seen. Treat high-reach or newly-seen domains as candidate indicators of compromise.\\r\\nlet suspTlds = dynamic([\\\"top\\\",\\\"xyz\\\",\\\"click\\\",\\\"link\\\",\\\"shop\\\",\\\"online\\\",\\\"site\\\",\\\"live\\\",\\\"icu\\\",\\\"cyou\\\",\\\"sbs\\\",\\\"rest\\\",\\\"quest\\\",\\\"cfd\\\",\\\"bond\\\",\\\"buzz\\\",\\\"fun\\\",\\\"space\\\",\\\"monster\\\",\\\"work\\\",\\\"tk\\\",\\\"ml\\\",\\\"ga\\\",\\\"cf\\\",\\\"gq\\\",\\\"dev\\\",\\\"app\\\",\\\"zip\\\",\\\"mov\\\",\\\"info\\\",\\\"win\\\",\\\"loan\\\",\\\"men\\\",\\\"stream\\\",\\\"country\\\"]);\\r\\nMessageUrlInfo\\r\\n| where isnotempty(UrlDomain)\\r\\n| extend Tld = tostring(split(UrlDomain, \\\".\\\")[-1])\\r\\n| where Tld in (suspTlds)\\r\\n| summarize Messages=dcount(TeamsMessageId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ['URL Domain']=UrlDomain, ['TLD']=Tld\\r\\n| top 10 by Messages desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"100\",\"name\":\"teams tld table\",\"id\":\"30d5588e-010c-474a-9c53-74b73dcc9676\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Targeted Users & Risky Senders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"6fef737b-cb4e-4a51-9ced-bf11754a6b33\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Teams File Protection\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Defender for Office 365 scans files shared in Microsoft Teams. These visuals show files scanned versus malware detected, and list the malicious files found.<br><br>**Recommended action:** Investigate each malicious file below and confirm it was quarantined and removed from the SharePoint or OneDrive location backing the chat. Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, and use attack surface reduction rules to block executable content delivered through collaboration.\"},\"name\":\"teams file banner\",\"id\":\"2f01c905-dd65-4a13-9f67-c70402b2c175\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection - for the selected period.\\r\\nlet base = FileMaliciousContentInfo | where Workload == \\\"MicrosoftTeams\\\";\\r\\nunion\\r\\n(base | summarize Count = count() | extend Details = \\\"Teams Files Scanned\\\", Ord = 1),\\r\\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Files with Malware Detected\\\", Ord = 2),\\r\\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \\\"Files Scanned - No Detection\\\", Ord = 3)\\r\\n| sort by Ord asc\\r\\n| project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams file tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9f555c51-1680-47ef-94d4-b1f8cf9dce3b\"},{\"type\":1,\"content\":{\"json\":\"### Malicious files shared in Teams<br>\\r\\n\\r\\n**Files shared in Microsoft Teams that were detected with malware, with owner and file details.**\"},\"customWidth\":\"100\",\"name\":\"teams file table header\",\"id\":\"4cd3274e-0c61-4722-83b7-1fccf8a94a57\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365 for the selected period.\\r\\nFileMaliciousContentInfo\\r\\n| where Workload == \\\"MicrosoftTeams\\\"\\r\\n| where isnotempty(ThreatTypes)\\r\\n| top 10 by Timestamp desc\\r\\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams file table\",\"id\":\"135e0e7d-7110-40ee-a377-1a5992b2ef9d\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams File Protection\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"8ecc1bae-4a06-4b1c-8952-59fb434b7cbc\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Post-Delivery ZAP Insights (Teams)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nZero-hour auto purge (ZAP) removes malicious Microsoft Teams messages after delivery. These visuals summarize ZAP volume, type, result, and the senders whose messages were most often removed.<br><br>**Recommended action:** Confirm zero-hour auto purge is enabled for Microsoft Teams so newly-weaponized messages are pulled after delivery. Investigate senders with repeated ZAP removals as likely compromised or malicious accounts and block or restrict them. A rising ZAP trend can signal an active campaign that slipped past delivery-time filtering.\"},\"name\":\"teams zap banner\",\"id\":\"136cfb4e-d2a5-4db0-9771-6b6380011ba0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes Microsoft Teams post-delivery ZAP (zero-hour auto purge) activity by Microsoft Defender for Office 365 for the selected period.\\r\\nlet zap = materialize(MessagePostDeliveryEvents);\\r\\nunion\\r\\n(zap | summarize Count = count() | extend Details = \\\"Total ZAP Actions\\\", Ord = 1),\\r\\n(zap | where ActionType == \\\"Malware ZAP\\\" | summarize Count = count() | extend Details = \\\"Malware ZAP\\\", Ord = 2),\\r\\n(zap | where ActionType == \\\"Phish ZAP\\\" | summarize Count = count() | extend Details = \\\"Phish ZAP\\\", Ord = 3),\\r\\n(zap | where ActionResult == \\\"Success\\\" | summarize Count = count() | extend Details = \\\"Successful Actions\\\", Ord = 4),\\r\\n(zap | where ActionResult == \\\"Failed\\\" | summarize Count = count() | extend Details = \\\"Failed Actions\\\", Ord = 5),\\r\\n(zap | where Action == \\\"Moved to quarantine\\\" | summarize Count = count() | extend Details = \\\"Moved to Quarantine\\\", Ord = 6)\\r\\n| sort by Ord asc\\r\\n| project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams zap tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"06980411-5e6b-4aa4-a746-351cd2b12dae\"},{\"type\":1,\"content\":{\"json\":\"### ZAP actions over time<br>\\r\\n\\r\\n**Microsoft Teams post-delivery ZAP actions (per selected interval) split by Malware ZAP and Phish ZAP.**\"},\"customWidth\":\"66\",\"name\":\"teams zap trend header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"7fc1cfcd-3a9f-45b1-9f39-3820fce23c03\"},{\"type\":1,\"content\":{\"json\":\"### ZAP by action type<br>\\r\\n\\r\\n**Distribution of Microsoft Teams post-delivery ZAP actions by type.**\"},\"customWidth\":\"33\",\"name\":\"teams zap pie header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"9bc0d0a3-876a-49d7-9046-31764511ca38\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Microsoft Teams post-delivery ZAP actions over time by ZAP type, summarizing the data per selected interval.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(MessagePostDeliveryEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(MessagePostDeliveryEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(MessagePostDeliveryEvents\\r\\n| summarize MalwareZAP = countif(ActionType == \\\"Malware ZAP\\\"), PhishZAP = countif(ActionType == \\\"Phish ZAP\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, MalwareZAP = coalesce(MalwareZAP, 0), PhishZAP = coalesce(PhishZAP, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"66\",\"name\":\"teams zap trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c78a509e-324f-4a8c-b2e7-bce3e0d20667\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows Microsoft Teams post-delivery ZAP actions by type for the selected period.\\r\\nMessagePostDeliveryEvents\\r\\n| summarize Count = count() by ActionType\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"teams zap pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cfc94695-fb02-4b6c-a223-f79f7b947379\"},{\"type\":1,\"content\":{\"json\":\"### Top senders whose messages were removed by ZAP<br>\\r\\n\\r\\n**Senders whose Microsoft Teams messages were most often removed by post-delivery ZAP.**\"},\"customWidth\":\"100\",\"name\":\"teams zap senders header\",\"id\":\"f8677ffe-007a-41ca-81de-1ae5dd19d06a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 senders whose Microsoft Teams messages were removed by post-delivery ZAP for the selected period.\\r\\nMessagePostDeliveryEvents\\r\\n| where isnotempty(SenderEmailAddress)\\r\\n| summarize ZapActions = count(), MalwareZAP = countif(ActionType == \\\"Malware ZAP\\\"), PhishZAP = countif(ActionType == \\\"Phish ZAP\\\") by SenderEmailAddress\\r\\n| top 10 by ZapActions\\r\\n| project ['Sender']=SenderEmailAddress, ['ZAP Actions']=ZapActions, ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ZAP Actions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams zap senders table\",\"id\":\"50c9a883-6442-40dc-b84f-57adfbb46a38\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams ZAP\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"f5cc2425-e5ae-4520-9a97-2e4c2c447dcd\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Teams Message and Call Submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nMicrosoft Teams messages and calls reported by users, and messages submitted by admins, for review by Microsoft. Sourced from the submission records in CloudAppEvents.<br><br>**Recommended action:** Encourage users to report suspicious Teams messages and calls so Microsoft can tune protection, and triage admin submissions promptly. A cluster of reports naming the same sender, display name, or call identity is an early signal of a targeted campaign: pivot those identities into the impersonation and risky-sender views above to scope it.\"},\"name\":\"teams sub banner\",\"id\":\"54cbfb29-2626-4b65-8cb5-a42ff4b41e63\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes Microsoft Teams message and call submissions reported to Microsoft for the selected period, split by user and admin reports. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\\r\\nlet sub = materialize(CloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType in (\\\"ChatMessage\\\", \\\"TeamsCall\\\"));\\r\\nunion\\r\\n(sub | where SubmissionContentType == \\\"ChatMessage\\\" and ActionType == \\\"UserSubmission\\\" | summarize Count = count() | extend Details = \\\"Messages Reported by Users\\\", Ord = 1),\\r\\n(sub | where SubmissionContentType == \\\"TeamsCall\\\" and ActionType == \\\"UserSubmission\\\" | summarize Count = count() | extend Details = \\\"Calls Reported by Users\\\", Ord = 2),\\r\\n(sub | where SubmissionContentType == \\\"ChatMessage\\\" and ActionType == \\\"AdminSubmission\\\" | summarize Count = count() | extend Details = \\\"Messages Submitted by Admins\\\", Ord = 3)\\r\\n| sort by Ord asc\\r\\n| project Count, Details\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"secondaryContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"100\",\"name\":\"teams sub tiles\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"419ed645-ebc1-4df1-b9f0-c744403ab494\"},{\"type\":1,\"content\":{\"json\":\"### Submissions over time<br>\\r\\n\\r\\n**Microsoft Teams user and admin submissions (per selected interval).**\"},\"customWidth\":\"66\",\"name\":\"teams sub trend header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"6a795b0a-82e2-427a-8ac0-abfb5bb5e447\"},{\"type\":1,\"content\":{\"json\":\"### Submission mix<br>\\r\\n\\r\\n**Microsoft Teams submissions split by content type (message or call) and reporter (user or admin).**\"},\"customWidth\":\"33\",\"name\":\"teams sub pie header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"1f4c55f8-7290-4b6f-b02a-e3134568b9ff\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises Microsoft Teams message and call submissions over time, summarizing the data per selected interval. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\\r\\nlet gran = {Granularity};\\r\\nlet sub = materialize(CloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType in (\\\"ChatMessage\\\", \\\"TeamsCall\\\"));\\r\\nlet minTime = toscalar(sub | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(sub | summarize max(Timestamp));\\r\\nlet agg = materialize(sub\\r\\n| summarize UserReports = countif(ActionType == \\\"UserSubmission\\\"), AdminReports = countif(ActionType == \\\"AdminSubmission\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, UserReports = coalesce(UserReports, 0), AdminReports = coalesce(AdminReports, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"66\",\"name\":\"teams sub trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7dcb03da-de96-4388-90a4-0a3f3ca98dc6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the mix of Microsoft Teams submissions by content type and reporter for the selected period. Only completed user submissions (chat and call) and admin submissions (chat) are counted; submission triage/timeout lifecycle records are excluded.\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\"\\r\\n| where (SubmissionContentType == \\\"ChatMessage\\\" and ActionType == \\\"UserSubmission\\\")\\r\\n    or (SubmissionContentType == \\\"TeamsCall\\\" and ActionType == \\\"UserSubmission\\\")\\r\\n    or (SubmissionContentType == \\\"ChatMessage\\\" and ActionType == \\\"AdminSubmission\\\")\\r\\n| extend Reporter = iif(ActionType == \\\"AdminSubmission\\\", \\\"Admin\\\", \\\"User\\\")\\r\\n| summarize Count = count() by SubmissionType = strcat(SubmissionContentType, \\\" (\\\", Reporter, \\\")\\\")\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"teams sub pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"84a0141e-51de-4423-acb0-3c4342a49bf2\"},{\"type\":1,\"content\":{\"json\":\"### False Negative (FN) User Submissions by submission State<br>\\r\\n\\r\\n**Microsoft Teams messages reported by users as missed detections, broken down by submission state (for example Rescaned, Graded). Tracks the processing status of user reports.**\"},\"customWidth\":\"50\",\"name\":\"teams sub state header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"1b2bdffd-69b0-41b0-bdda-b242b7faaec0\"},{\"type\":1,\"content\":{\"json\":\"### False Negative (FN) User Submissions by Triage Verdict<br>\\r\\n\\r\\n**Microsoft Teams user submissions grouped by the verdict assigned during grading (for example Phishing, NotSpam, Spam). Shows how reported messages were graded and highlights detection gaps.**\"},\"customWidth\":\"50\",\"name\":\"teams sub verdict header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"bdb97e09-44d2-41ad-a99f-931e4a8169cc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows Microsoft Teams user (false negative) message submissions by submission state (for example Rescaned, Graded), to track processing status.\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend SubmissionState = tostring(RD.SubmissionState)\\r\\n| summarize Count = count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"teams sub state pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"139ce840-5fc2-44d1-9872-91b37a74f0e7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows Microsoft Teams user (false negative) message submissions by the triage verdict assigned during grading (for example Phishing, NotSpam, Spam).\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend TriageVerdict = tostring(parse_json(tostring(RD.GradingResult)).TriageVerdict)\\r\\n| where isnotempty(TriageVerdict)\\r\\n| summarize Count = count() by TriageVerdict\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"teams sub verdict pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"538ce4a3-a1ff-4b8d-a466-2173edbb2cd7\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 P2 sender domains in FN User Submissions<br>\\r\\n\\r\\n**The sender domains most often reported by users as missed Microsoft Teams threats. High-volume domains are candidate sources of malicious messaging.**\"},\"customWidth\":\"50\",\"name\":\"teams sub domains header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"9b8db0c7-2bf2-4077-ae20-60146001bf23\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 individual P2 senders in FN User Submissions<br>\\r\\n\\r\\n**The individual senders most often reported by users as missed Microsoft Teams threats.**\"},\"customWidth\":\"50\",\"name\":\"teams sub senders header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"ffbe90ab-129c-47fa-9dac-50cab528ad55\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 P2 (envelope) sender domains of Microsoft Teams messages reported by users as false negatives (missed detections).\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend P2SenderDomain = tostring(RD.P2SenderDomain)\\r\\n| where isnotempty(P2SenderDomain)\\r\\n| summarize Submissions = count() by ['P2 Sender Domain']=P2SenderDomain\\r\\n| top 10 by Submissions\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"50\",\"name\":\"teams sub domains table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b18192fb-26a8-4bd1-9b07-7aeab496eae3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 individual P2 (envelope) senders of Microsoft Teams messages reported by users as false negatives (missed detections).\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend P2Sender = tostring(RD.P2Sender)\\r\\n| where isnotempty(P2Sender)\\r\\n| summarize Submissions = count() by ['P2 Sender']=P2Sender\\r\\n| top 10 by Submissions\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"customWidth\":\"50\",\"name\":\"teams sub senders table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7ead0a01-2b56-4225-b625-554b09350013\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 users performing the most FN User Submissions<br>\\r\\n\\r\\n**The users who report the most Microsoft Teams messages as missed detections - useful for recognising engaged reporters and spotting over-reporting.**\"},\"customWidth\":\"50\",\"name\":\"teams sub topusers header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"fb893cdd-d6d3-431a-a1d2-87652571a10d\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 admins performing the most FN Admin Submissions<br>\\r\\n\\r\\n**The admins who submit the most Microsoft Teams messages as missed detections.**\"},\"customWidth\":\"50\",\"name\":\"teams sub topadmins header\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"0px\"},\"id\":\"14fca69b-e152-4a5d-bd2c-020c34c2226a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 users who reported the most Microsoft Teams messages as false negatives (missed detections), with each submitter's email (from the submission record) to disambiguate users with similar names.\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"UserSubmission\\\"\\r\\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterEmail = tostring(RD.UserId)\\r\\n| where isnotempty(Submitter) and SubmitterEmail has \\\"@\\\"\\r\\n| summarize Submissions = count() by ['Submitter']=Submitter, ['Email']=SubmitterEmail\\r\\n| top 10 by Submissions\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"name\":\"teams sub topusers table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a171a35b-35b0-46ce-a916-052a54101126\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the top 10 admins who submitted the most Microsoft Teams messages as false negatives (missed detections). The admin's own email is not present in the submission record (that would require the Identity table), so the Submitter ID (object GUID) is shown to disambiguate admins with similar names.\\r\\nCloudAppEvents\\r\\n| extend RD = parse_json(RawEventData)\\r\\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\\r\\n| where RecordType == \\\"29\\\" and SubmissionContentType == \\\"ChatMessage\\\"| where ActionType startswith \\\"AdminSubmission\\\"\\r\\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterId = tostring(RD.SubmitterId)\\r\\n| where isnotempty(Submitter)\\r\\n| summarize Submissions = count() by ['Admin']=Submitter, ['Submitter ID']=SubmitterId\\r\\n| top 10 by Submissions\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"name\":\"teams sub topadmins table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8bf37c2b-067a-4341-a192-2aa45699c3f7\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Submissions\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"eeea53a4-69d9-426e-bf9f-1789cd73bfed\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Recent Threat Detail\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThe most recent Microsoft Teams phishing and malware messages, de-duplicated to the latest record per message, for investigation.\"},\"name\":\"teams detail banner\",\"id\":\"4bdd917c-721f-450b-b455-45cbd5f59cc5\"},{\"type\":1,\"content\":{\"json\":\"### Last 10 Teams phishing messages<br>\\r\\n\\r\\n**Most recent Microsoft Teams messages detected as phishing, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**\"},\"customWidth\":\"100\",\"name\":\"teams detail phish header\",\"id\":\"9bcf96c1-a958-4515-b171-10ec2f3ba660\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\\r\\nMessageEvents\\r\\n| where ThreatTypes has \\\"Phish\\\"\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| top 10 by Timestamp desc\\r\\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams detail phish table\",\"id\":\"3675d08f-1165-4f47-a633-e432cf96e3d5\"},{\"type\":1,\"content\":{\"json\":\"### Last 10 Teams malware messages<br>\\r\\n\\r\\n**Most recent Microsoft Teams messages detected as malware, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**\"},\"customWidth\":\"100\",\"name\":\"teams detail mal header\",\"id\":\"6b9d66d2-8d89-47b0-a72a-5ee8623082dc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\\r\\nMessageEvents\\r\\n| where ThreatTypes has \\\"Malware\\\"\\r\\n| summarize arg_max(Timestamp, *) by TeamsMessageId\\r\\n| top 10 by Timestamp desc\\r\\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"100\",\"name\":\"teams detail mal table\",\"id\":\"d6e76d0a-7eee-4c05-8e92-10f9622b5ab3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"14\"},\"name\":\"group - Teams Detail\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"1e9c879b-d6be-4d36-9068-b5438abf7dd2\"},{\"type\":1,\"content\":{\"json\":\"# Top Attacked Users, Top Senders, and Automatic External Email Forwarding\\r\\n\\r\\n---\\r\\nThis tab provides insights into **Top attacked users, Top Senders** in inbound email messages and details about **automatic external email forwarding**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"6\"},\"name\":\"text - 24 - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f1a60054-44b1-432e-be7a-9d7d114ff5c7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Top Attacked Users and Top Senders Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides key visuals that highlight top attacked users – individuals most frequently targeted by inbound email threats as detected by Microsoft Defender for Office 365. Offers insights into top email senders and sender domains across inbound email traffic, helping identify patterns and potential risk sources.<br><br>**Recommended action:** Apply the Strict preset to the most-attacked users and review the top sender domains as possible block-list candidates.\"},\"name\":\"text - 13 - Copy - Copy\",\"id\":\"ff220902-30b8-4aef-9b79-14c913a1b2d2\"},{\"type\":1,\"content\":{\"json\":\"### Top Attacked Users<br>\\r\\n\\r\\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam, Phishing, or Malware. Helps identify high-risk users for targeted security awareness and policy enforcement.**\"},\"name\":\"text - 13 - Copy - Copy - Copy\",\"id\":\"58f34b9f-824d-4fcf-b2aa-d7d380aa08d5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 users that are receiving Spam, Phishing or Malware emails\\r\\nEmailEvents \\r\\n| where  OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\" and EmailDirection ==\\\"Inbound\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods) \\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \\\"Malware\\\"),PhishEmailCount = countif(FirstDetection ==  \\\"Phish\\\"),SpamEmailCount = countif(FirstDetection ==  \\\"Spam\\\") by RecipientEmailAddress\\r\\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| top 15 by ThreatEmailCount\\r\\n| project ['Recipient']=RecipientEmailAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Threat Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Malware\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Threat Emails_2\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Threat Emails_2\",\"sortOrder\":2}],\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"100\",\"name\":\"query - 28\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e9459e78-6b43-4ef2-9596-32169d95c610\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Senders of Inbound Emails<br>\\r\\n\\r\\n**Displays the top 10 sender email addresses from external sources delivering inbound emails. Helps identify high-volume external senders for monitoring and policy enforcement.**\"},\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"id\":\"eb4590a7-57c7-4728-af62-3d798afe6f2d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 senders by inbound email sending volume\\r\\nEmailEvents \\r\\n| where  OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\" and EmailDirection ==\\\"Inbound\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods) \\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \\\"Malware\\\"),PhishEmailCount = countif(FirstDetection ==  \\\"Phish\\\"),SpamEmailCount = countif(FirstDetection ==  \\\"Spam\\\") by SenderFromAddress\\r\\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| top 15 by TotalEmailCount\\r\\n| project ['Sender']=SenderFromAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Threat Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Malware\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20}}],\"filter\":true},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"100\",\"name\":\"query - 28 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e4272979-1073-4c1e-9b1b-b971bc3efc33\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains of Inbound Emails<br>\\r\\n\\r\\n**Displays the top 10 sender domains from external sources delivering inbound emails. Helps identify high-volume external sender domains for monitoring and policy enforcement.**\"},\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"id\":\"7ab63415-17ce-47f1-a614-e5e6edbe472e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 senders by inbound email sending volume\\r\\nEmailEvents \\r\\n| where  OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\" and EmailDirection ==\\\"Inbound\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods) \\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \\\"Malware\\\"),PhishEmailCount = countif(FirstDetection ==  \\\"Phish\\\"),SpamEmailCount = countif(FirstDetection ==  \\\"Spam\\\") by SenderFromDomain\\r\\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\\r\\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\\r\\n| top 15 by TotalEmailCount\\r\\n| project ['Sender Domain']=SenderFromDomain, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Threat Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Malware\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Bad Traffic %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20}}],\"filter\":true},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"100\",\"name\":\"query - 28 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b593da94-b735-4fe3-a82d-18c90156e506\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"6\"},\"name\":\"group - 10-Top attacked users and top senders\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"3e41cc1a-166e-4094-bc66-7e26a918b2e9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Automatic External Email Forwarding Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Email forwarding can be useful, but can also pose a security risk due to the potential disclosure of information.**\\r\\n<br>\\r\\n\\r\\nUsers can configure [<b>Inbox rules</b>](https://support.microsoft.com/en-US/Outlook/mail/use-rules-to-automatically-forward-messages) in Outlook or set up [<b>SMTP forwarding</b>](https://support.microsoft.com/en-us/office/turn-on-automatic-forwarding-in-outlook-7f2670a1-7fff-4475-8a3c-5822d63b0c8e) to automatically forward messages to external recipients. You can control automatic external email forwarding from cloud mailboxes using [<b>Outbound spam policies</b>](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding) in Microsoft Defender for Office 365. \\r\\n**Attackers might exploit this capability to compromise your organization or its partners.**<br><br>**Recommended action:** Investigate external auto-forwarding - it is a common data-exfiltration path. Consider disabling auto-forwarding via the outbound spam policy unless a business case is documented.\"},\"name\":\"text - 8\",\"id\":\"b04d1590-98e3-4650-9172-33e75561e1e5\"},{\"type\":1,\"content\":{\"json\":\"### Automatic Email Forwarding by Type<br>\\r\\n\\r\\n**Displays counts of outbound emails automatically forwarded to external addresses, grouped by forwarding type (e.g., SMTP forwarding, inbox rules). Helps identify forwarding behaviors that may pose data exfiltration risks.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c7cb7917-eaf4-4a1e-989a-75f4b6182851\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Internal Users Forwarding Emails Externally<br>\\r\\n\\r\\n**Displays the top 10 internal user accounts that have automatically forwarded emails to external addresses (regardless of the forwarding type used). Helps identify potential data exfiltration risks and enforce forwarding policies.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5a5d5a8c-c195-45db-a878-e6ac908cc919\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises automatic email forwarding to external email addresses by forwarding type\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| summarize count() by ForwardingType\\r\\n| sort by count_ desc \\r\\n\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"15094d98-add2-4b50-a0df-ee91fd34c6fb\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| summarize TotalForwardedMessages = count() by ForwardingUser\\r\\n| sort by TotalForwardedMessages desc \\r\\n| top 10 by TotalForwardedMessages\\r\\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"TotalForwardedMessages\"]}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"73d66038-2ea0-449d-9aeb-a1bd4b207d7f\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Internal Users Forwarding Emails Using Mailbox Rules<br>\\r\\n\\r\\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9a7b5fc3-da23-4e95-87df-542a5e3f6320\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using Mailbox Rules\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| where ForwardingType ==\\\"MbxRule\\\"\\r\\n| summarize TotalForwardedMessages = count() by ForwardingUser\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"TotalForwardedMessages\"]}},\"customWidth\":\"100\",\"name\":\"query - 30 - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f8d7b85d-944a-493f-a143-7e18277846c9\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 External domains Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\\r\\n\\r\\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cda99a50-b7c4-4d95-ac61-7231080a3f5d\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 External Recipients Receiving Auto-Forwarded Emails (Mailbox Rules)<br>\\r\\n\\r\\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"72b01575-c33e-457c-98db-ea755c003bf0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 external domains who are recieving automatically forwarded emails using Mailbox Rules\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \\\"@\\\")[1])\\r\\n| where ForwardingType ==\\\"MbxRule\\\"\\r\\n| summarize TotalForwardedMessages = count() by RecipientDomain\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"823dec28-48b5-4be3-8e68-04301a952a62\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using Mailbox Rules\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| where ForwardingType ==\\\"MbxRule\\\"\\r\\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"14804990-bfc9-43b7-8c8d-95c2cf32ee56\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Internal Users Forwarding Emails via SMTP Forwarding<br>\\r\\n\\r\\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"100\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fa04b313-5756-4ff7-9ee8-ec61e6b382cc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using SmtpForwarding\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| where ForwardingType ==\\\"SmtpForwarding\\\"\\r\\n| summarize count() by ForwardingUser\\r\\n| top 10 by count_ desc\\r\\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=count_\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"query - 30 - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"bed8e717-4ea7-4f71-aaa7-b70a31f4dc88\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 External domains receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\\r\\n\\r\\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"f76bc717-3cf8-4d8d-92fa-3f2024065f8f\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 External Recipients Receiving Auto-Forwarded Emails (SMTP Forwarding)<br>\\r\\n\\r\\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**\"},\"customWidth\":\"50\",\"name\":\"text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"2190c799-ab4f-4bd8-87e1-f9c5c224cca4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \\\"@\\\")[1])\\r\\n| where ForwardingType ==\\\"SmtpForwarding\\\"\\r\\n| summarize TotalForwardedMessages = count() by RecipientDomain\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c3be87b3-8ce8-40f2-ad92-0651bed71117\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\\r\\nEmailEvents \\r\\n| where EmailDirection == \\\"Outbound\\\" and ForwardingInformation !=\\\"\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\\r\\n| where ForwardingType ==\\\"SmtpForwarding\\\"\\r\\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\\r\\n| top 10 by TotalForwardedMessages desc\\r\\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Forwarded Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true},\"chartSettings\":{\"yAxis\":[\"count_\"],\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 30 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fb6b0113-f5bb-46a7-994b-92ebc3c7881d\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"6\"},\"name\":\"group - 34 - Automatic email forwarding\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"02c91ebb-4f92-4843-a73b-6dea7a6ac2bd\"},{\"type\":1,\"content\":{\"json\":\"# Email detection action overrides\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into admin or end-user configured **detection overrides** where the message was detected as a threat by Microsoft Defender for Office 365, however an admin-configured policy or end-user setting overrode the detection action.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/understand-overrides-in-email-entity) \"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"text - 13 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"ae594968-00b9-40b8-b5dd-052a27440afb\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Admin configured Detection Overrides (Allow)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track emails subject to administrator policies (e.g., Transport Rules, Tenant Allow/Block List) with an \\\"Allow\\\" action, overriding Microsoft Defender for Office 365 detections (excluding SecOps Mailbox overrides).<br><br>**Recommended action:** Review Allow overrides that later carried threats and remove stale or overly broad allow entries - they weaken protection.\"},\"name\":\"text - AdminOverridesAllowHeader\",\"id\":\"3d70a304-c590-4156-a6d4-da147fe106ab\"},{\"type\":1,\"content\":{\"json\":\"### Admin Overrides (Allow) Trend\\r\\n**Displays the count (per {Granularity}) of emails where an administrator policy with an \\\"Allow\\\" action overrode detections (excluding SecOps Mailbox). Helps track the frequency of admin overrides over time.**\"},\"name\":\"text - AdminOverridesAllowTrend\",\"id\":\"a4ee104a-a0a1-4725-a60f-deedcc91af70\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to an admin policy with action of allow independent of action taken, summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Admin Overrides\",\"color\":\"blueDark\"}]}},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"79928e9e-48ed-4d08-8ff7-c21fe027550e\"},{\"type\":1,\"content\":{\"json\":\"### Total Emails by Admin Override type (Allow)\\r\\n**Summarizes the total count of emails subject to administrator policies with an \\\"Allow\\\" action, grouped by the type of override. Helps identify which policies are most frequently allowing emails.**\"},\"customWidth\":\"50\",\"name\":\"text - AdminOverridesAllowByType\",\"id\":\"855fce09-2000-4d16-8521-8b4eeddfae00\"},{\"type\":1,\"content\":{\"json\":\"### Admin Overrides (Allow) by Override Type and Threat Type\\r\\n**Details the count of emails allowed by administrator policies, categorized by the override type and the detected threat type. Helps assess the risk associated with allowed emails.**\"},\"customWidth\":\"50\",\"name\":\"text - AdminOverridesAllowByTypeAndThreat\",\"id\":\"a2613078-b427-4b23-aca0-21989b1944db\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by OrgLevelPolicy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 16\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b21a0329-8f52-45c2-81f2-6df65c134673\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override and threats type found\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"0bf4cbe6-7c84-49d4-801c-d955762b5699\"},{\"type\":1,\"content\":{\"json\":\"### SecOps Mailbox Overrides (Allow)\\r\\nThis section focuses on emails allowed specifically due to the SecOps Mailbox override policy, typically used for investigation and analysis.[<p><b>Learn more</b></p>](https://learn.microsoft.com/en-us/defender-office-365/advanced-delivery-policy-configure) \"},\"name\":\"text - SecOpsOverridesHeader\",\"id\":\"f582dc86-4c40-4cdd-ba0b-ec6ef8820a27\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to the \\r\\nEmailEvents \\r\\n| where OrgLevelPolicy==\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by OrgLevelPolicy\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"auto\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"50\",\"name\":\"query - 1\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8ad2fea4-dcd0-454e-a4d4-b5275c86fd9b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails delivered to the SecOps Mailbox by threat type\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy==\\\"SecOps Mailbox\\\" and OrgLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":1,\"showAnalytics\":true,\"title\":\" \",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"52c04df2-69b5-46e4-a000-7c6d212a132a\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 15 - Admin Detection Overrides - Allow\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"9b9baf2f-fd5f-41b6-8368-b515f8de4fd4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Admin configured Detection Overrides (Block)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into email messages blocked by administrative policies (e.g. Tenant allow/block list, Antimalware policy file type block), overriding detection actions defined by Microsoft Defender for Office 365.<br><br>**Recommended action:** Confirm these blocks are still needed and consolidate them into the Tenant Allow/Block List where appropriate.\"},\"name\":\"text - AdminOverridesBlockHeader\",\"id\":\"6157683b-cce7-4165-886f-0da73e25ce86\"},{\"type\":1,\"content\":{\"json\":\"### Admin Overrides (Block) Trend\\r\\n**Displays the count (per {Granularity}) of emails where an administrator policy with a \\\"Block\\\" action overrode detections. Helps track the frequency of admin blocks over time.**\"},\"name\":\"text - AdminOverridesBlockTrend\",\"id\":\"699820b4-a984-45cc-ab2f-607c3c8569d4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \\\"Block\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Admin Overrides\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - 5\",\"styleSettings\":{\"margin\":\"10\",\"padding\":\"10\"},\"id\":\"9ef5e7fb-843e-439b-b4f3-9b0bb149e74b\"},{\"type\":1,\"content\":{\"json\":\"### Total Emails by Admin Override Type (Block)\\r\\n**Summarizes the total count of emails subject to administrator policies with a \\\"Block\\\" action, grouped by the type of override.**\"},\"customWidth\":\"50\",\"name\":\"text - AdminOverridesBlockByType\",\"id\":\"5694a7c0-1ee5-40b4-ae2b-263d189c4b4e\"},{\"type\":1,\"content\":{\"json\":\"### Admin Overrides (Block) by Override Type and Threat Type\\r\\n**Details the count of emails blocked by administrator policies, categorized by the override type and the detected threat type.**\"},\"customWidth\":\"50\",\"name\":\"text - AdminOverridesBlockByTypeAndThreat\",\"id\":\"6e309742-37c0-4ad5-9b9a-63643059bfaf\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to an admin policy with action of block, summarizing the data by type of override\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \\\"Block\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by OrgLevelPolicy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"eabc80ed-d0e9-43d2-ab13-a5af478f11c8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data by type of override and threats type found\\r\\nEmailEvents \\r\\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \\\"Block\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 7\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1661bfa6-d8fd-4387-a334-1bc027a3f6d1\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 36-Admin Detection Overrides - Block\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"7d514e9a-f67f-45a6-ba1b-6492348cc18b\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">User configured Detection Overrides (Allow)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section consolidates key visuals that track email messages subject to user policies (e.g. [Safe Senders list defined in Outlook](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365#use-outlook-safe-senders)) with an \\\"Allow\\\" action, overriding Microsoft Defender for Office 365 detections.<br><br>**Recommended action:** Educate users that safe-sender allows can bypass protection; review high-risk user allow entries.\"},\"name\":\"text - UserOverridesAllowHeader\",\"id\":\"4d41c560-0e73-40c5-b610-33e9500e88c4\"},{\"type\":1,\"content\":{\"json\":\"### User Overrides (Allow) Trend\\r\\n**Displays the count (per {Granularity}) of emails where a user policy with an \\\"Allow\\\" action overrode detections. Helps track the frequency of user overrides over time.**\"},\"name\":\"text - UserOverridesAllowTrend\",\"id\":\"9432efff-9f03-4d74-8781-02be8b2d07fa\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Allow\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"User Overrides\",\"color\":\"blueDark\"}]}},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"02da1d33-e477-479d-bdd3-95ab1ad7c75c\"},{\"type\":1,\"content\":{\"json\":\"### Total Emails by User Override Type (Allow)\\r\\n**Summarizes the total count of emails subject to user policies with an \\\"Allow\\\" action, grouped by the type of override.**\"},\"customWidth\":\"50\",\"name\":\"text - UserOverridesAllowByType\",\"id\":\"006a2e87-b1b6-4cc3-a763-ceebaa86b340\"},{\"type\":1,\"content\":{\"json\":\"### User Overrides (Allow) by Override Type and Threat Type\\r\\n**Details the count of emails allowed by user policies, categorized by the override type and the detected threat type. Helps assess the risk associated with user-allowed emails.**\"},\"customWidth\":\"50\",\"name\":\"text - UserOverridesAllowByTypeAndThreat\",\"id\":\"7c34bb4b-46c0-4054-9596-3dfd010bb036\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override\\r\\nEmailEvents \\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Allow\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by UserLevelPolicy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 16\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d1d9021d-e6bf-47b1-bdd2-438a212d2767\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found\\r\\nEmailEvents \\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Allow\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"1acd913c-c945-4a58-b04e-d008ca53ffe3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 15 - User Detection Overrides - Allow\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"c939060e-6a8b-49ff-951b-a3abddbd9fb4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">User configured Detection Overrides (Block)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into emails blocked by user-configured policies (e.g., [Blocked Senders list in Outlook](https://support.microsoft.com/en-us/office/block-or-unblock-senders-in-outlook-9bf812d4-6995-4d19-901a-76d6e26939b0)).<br><br>**Recommended action:** Use user block trends to identify unwanted senders that may warrant tenant-wide blocking.\"},\"name\":\"text - UserOverridesBlockHeader\",\"id\":\"be6c6a3e-08ee-47c5-b8e7-6a1078dd17d1\"},{\"type\":1,\"content\":{\"json\":\"### User Overrides (Block) Trend\\r\\n**Displays the count (per {Granularity}) of emails where a user policy with a \\\"Block\\\" action overrode detections. Helps track the frequency of user blocks over time.**\"},\"name\":\"text - UserOverridesBlockTrend\",\"id\":\"7cd77d54-2e2b-4d23-a6a9-4bd6bca2642a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data daily\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailEvents\\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Block\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"User Overrides\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"query - 5\",\"styleSettings\":{\"margin\":\"10\",\"padding\":\"10\"},\"id\":\"0b21b66c-001d-4b3d-b47f-f3a420ccaaf8\"},{\"type\":1,\"content\":{\"json\":\"### Total Emails by User Override Type (Block)\\r\\n**Summarizes the total count of emails subject to user policies with a \\\"Block\\\" action, grouped by the type of override.**\"},\"customWidth\":\"50\",\"name\":\"text - UserOverridesBlockByType\",\"id\":\"fd513501-5e9d-45d9-9d0d-cd546002b8cf\"},{\"type\":1,\"content\":{\"json\":\"### User Overrides (Block) by Override Type and Threat Type\\r\\n**Details the count of emails blocked by user policies, categorized by the override type and the detected threat type.**\"},\"customWidth\":\"50\",\"name\":\"text - UserOverridesBlockByTypeAndThreat\",\"id\":\"4fbfa876-47ed-4c3b-81ee-1c40b982cecd\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of emails subject to a user type policy with action of block, summarizing the data by type of override\\r\\nEmailEvents \\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Block\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize count() by UserLevelPolicy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d3fccaa6-80fd-419d-bb37-aedf67263419\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data by type of override and threats type found\\r\\nEmailEvents \\r\\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \\\"Block\\\" \\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend ThreatTypes = case(ThreatTypes has \\\"Malware\\\", \\\"Malware\\\", ThreatTypes has \\\"Phish\\\", \\\"Phish\\\", ThreatTypes has \\\"Spam\\\", \\\"Spam\\\", ThreatTypes)\\r\\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\\r\\n| sort by TotalEmails\\r\\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}]}},\"customWidth\":\"50\",\"name\":\"query - 7\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e5e74ce1-fa67-45ea-bc80-97237342e370\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 37-User Detection Overrides - Block\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"0c1d327a-c2f1-4b9b-b210-53c808b53b48\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">User &amp; Sender Override Detail (Allow)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nInbound messages that Microsoft Defender for Office 365 **detected as threats but delivered anyway** because of an admin- or user-configured **Allow** override (phishing-simulation and SecOps Mailbox traffic excluded). **Total Threats** is all detected threats to that recipient / sender domain in the selected range; **Overridden Threats** and **Override %** are the portion delivered due to an Allow override, and **Override Types** names the specific overrides responsible. **User-configured** overrides come from the recipient's own mailbox junk-email settings in Outlook / Outlook on the web (the mailbox \\\"safelist collection\\\") &mdash; the **Safe Senders** and **Safe Recipients** lists and **trusted contacts** (\\\"Also trust email from my Contacts\\\"). **Admin-configured** overrides come from the **Tenant Allow/Block List, Exchange mail flow (transport) rules, the IP Allow List, or allowed sender/domain lists in anti-spam policies**. Use this to spot users or domains where overrides are letting threats through &mdash; candidates for policy review or a Tenant Allow/Block List (TABL) block.<br><br>**Recommended action:** Focus on the users and sender domains with the most allow overrides - these are the biggest protection gaps.\"},\"name\":\"Overrides - User Detail Header\",\"id\":\"3b0e83f3-f340-4b95-85c5-831783e8abc2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top recipients receiving threats that were delivered due to an admin or user override, with the share of their threats that were overridden and a breakdown of which override types caused them.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend OverrideType = case(\\r\\n    OrgLevelAction == \\\"Allow\\\" and OrgLevelPolicy != \\\"\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\", OrgLevelPolicy,\\r\\n    UserLevelAction == \\\"Allow\\\", strcat(\\\"User: \\\", UserLevelPolicy),\\r\\n    \\\"(none)\\\")\\r\\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\\r\\n| summarize TotalThreats = sum(PerType),\\r\\n            OverriddenThreats = sumif(PerType, OverrideType != \\\"(none)\\\"),\\r\\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \\\" (\\\", PerType, \\\")\\\"), OverrideType != \\\"(none)\\\"), \\\"; \\\")\\r\\n        by RecipientEmailAddress\\r\\n| where OverriddenThreats > 0\\r\\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\\r\\n| top 15 by OverriddenThreats\\r\\n| project ['Recipient']=RecipientEmailAddress, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Overridden Threats\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Override %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}]},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"StatisticName\",\"sourceIdField\":\"Value\",\"targetIdField\":\"Value\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"hivesMargin\":5}},\"name\":\"Overrides - Top Users\",\"id\":\"d7e169a2-808a-4bbf-86ee-5be561c690f7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top sender domains sending threats to users, with the share of those threats that were delivered because of an admin or user override and a breakdown of which override types caused them. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \\\"Phishing simulation\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\"\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| extend OverrideType = case(\\r\\n    OrgLevelAction == \\\"Allow\\\" and OrgLevelPolicy != \\\"\\\" and OrgLevelPolicy != \\\"SecOps Mailbox\\\", OrgLevelPolicy,\\r\\n    UserLevelAction == \\\"Allow\\\", strcat(\\\"User: \\\", UserLevelPolicy),\\r\\n    \\\"(none)\\\")\\r\\n| summarize PerType = count() by SenderFromDomain, OverrideType\\r\\n| summarize TotalThreats = sum(PerType),\\r\\n            OverriddenThreats = sumif(PerType, OverrideType != \\\"(none)\\\"),\\r\\n            OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \\\" (\\\", PerType, \\\")\\\"), OverrideType != \\\"(none)\\\"), \\\"; \\\")\\r\\n        by SenderFromDomain\\r\\n| where OverriddenThreats > 0\\r\\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\\r\\n| top 10 by OverriddenThreats\\r\\n| project ['Sender Domain']=SenderFromDomain, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Overridden Threats\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Override %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}]},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"StatisticName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Value\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"nodeIdField\":\"StatisticName\",\"sourceIdField\":\"Value\",\"targetIdField\":\"Value\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"hivesMargin\":5}},\"name\":\"Overrides - Top Sender Domains\",\"id\":\"0eda3153-10ea-4d4e-80ca-7e5ad99e9883\"}]},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"Overrides - User & Sender Detail\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"d5f38e54-a3c7-4df6-b569-bbabe85e1a36\"},{\"type\":1,\"content\":{\"json\":\"# False Negative(FN) Submissions insights\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into email message **False Negative(FN) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message reported to have **Malware, Phish or Spam threat** within its **content, URLs or attachments**.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"8\"},\"name\":\"text - 13 - Copy\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3b243dca-89ce-41e6-bccb-9ceb0953aa2e\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">False Negative(FN) Admin submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into email message **False Negative(FN) Submissions performed by administrators** in Microsoft Defender for Office 365 where the message reported to have Malware, Phish or Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Prioritise admin-submitted misses for policy tuning; recurring sender domains may be block-list candidates.\"},\"name\":\"fn admin - section header\",\"id\":\"64420254-0dae-4495-bd55-fc49e5bc1ed0\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions per-{Granularity} trend by submission types \\r\\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment). Helps to monitor where detections were missed and later submitted by admins as false negatives to Microsoft.**\"},\"name\":\"fn admin - trend heading\",\"id\":\"5f2de929-6f32-4079-a031-cbf689c15b29\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of admin false negative submission by submission type.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(CloudAppEvents\\r\\n| where ActionType contains \\\"Submission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| summarize Admin_Malware_FN=countif(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"), Admin_Phish_FN=countif(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"), Admin_Spam_FN=countif(SubmissionType == \\\"0\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"), Admin_Malware_URL_FN=countif(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\"), Admin_Malware_Attach_FN=countif(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\"), Admin_Phish_URL_FN=countif(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\"), Admin_Phish_Attach_FN=countif(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Malware (Mail)']=coalesce(Admin_Malware_FN,0), ['Phish (Mail)']=coalesce(Admin_Phish_FN,0), ['Spam (Mail)']=coalesce(Admin_Spam_FN,0), ['Malware (URL)']=coalesce(Admin_Malware_URL_FN,0), ['Malware (Attachment)']=coalesce(Admin_Malware_Attach_FN,0), ['Phish (URL)']=coalesce(Admin_Phish_URL_FN,0), ['Phish (Attachment)']=coalesce(Admin_Phish_Attach_FN,0) | sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalAdminSubmissions\",\"color\":\"redDark\"},{\"seriesName\":\"Phish (Mail)\",\"color\":\"redBright\"},{\"seriesName\":\"Spam (Mail)\",\"color\":\"orange\"},{\"seriesName\":\"Malware (Mail)\",\"color\":\"redDark\"},{\"seriesName\":\"Phish (URL)\",\"color\":\"purple\"},{\"seriesName\":\"Malware (Attachment)\",\"color\":\"yellowDark\"},{\"seriesName\":\"Phish (Attachment)\",\"color\":\"purpleDark\"},{\"seriesName\":\"Malware (URL)\",\"color\":\"yellow\"}]}},\"name\":\"fn admin - submissions trend\",\"id\":\"1b61155b-92a1-4533-9561-2e85e9a4dbf8\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions by submission types \\r\\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment).**\"},\"customWidth\":\"50\",\"name\":\"fn admin - by-type heading\",\"id\":\"bbaa9ff9-a95d-495a-a44c-6b4cae888a24\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions by submission State\\r\\n**Displays the total count of False Negative(FN) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**\"},\"customWidth\":\"50\",\"name\":\"fn admin - by-state heading\",\"id\":\"b060c706-342a-4b2e-b81a-920bf4d8c5d9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false negative submission by submission type.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"Submission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| extend Admin_SubmissionType=\\r\\niff(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Malware (Mail)\\\",\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\r\\niff(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\",\\\"Malware (URL)\\\",\\r\\niff(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\",\\\"Malware (Attachment)\\\",\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\",\\\"Phish (URL)\\\",\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\",\\\"Phish (Attachment)\\\",\\r\\n\\\"Other\\\")))))))\\r\\n| where Admin_SubmissionType!=\\\"Other\\\"\\r\\n| summarize count() by Admin_SubmissionType\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"fn admin - by-type pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9d9d714a-357b-4ac3-bcb7-33601d3c3108\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false negative submissions by the state of the submission.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"AdminSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType in (\\\"0\\\",\\\"1\\\",\\\"2\\\")\\r\\n| summarize count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn admin - by-state pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"169f0f1c-1f1e-44fb-965e-850733f01879\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN)/False Positive(FP) Admin Submissions by Triage Verdict\\r\\n**Displays the total count of False Negative(FN)/False Positive(FP) Admin Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**\"},\"customWidth\":\"50\",\"name\":\"fn admin - triage-verdict heading\",\"id\":\"3df841be-c1b0-4d61-8e38-316a34a48bd1\"},{\"type\":1,\"content\":{\"json\":\"### Top Admins Submitting False Negatives \\r\\n**Displays the top 15 admin accounts that submitted the highest number of false negative messages (missed detections) via AdminSubmission. Helps identify key contributors to threat remediation and potential patterns in detection gaps.**\"},\"customWidth\":\"50\",\"name\":\"fn admin - top-admins heading\",\"id\":\"e1e966f4-1f4d-4377-97c6-e2077fc0b8fa\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false negative or false positive submissions by the verdict of the submission grading.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"AdminSubmissionTriage\\\" \\r\\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \\r\\n| summarize count() by tostring(TriageVerdict)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn admin - triage-verdict pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6df0db72-f9db-444e-856a-4369921d199b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top admins performing false negative submissions\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \\r\\n| where Record == 29 and SubmissionType in (\\\"0\\\",\\\"1\\\",\\\"2\\\")\\r\\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\\r\\n| top 15 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fn admin - top-admins pie\",\"id\":\"b5ccb4a1-9783-47cf-bf21-ded924f1a200\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions by Top Sender Domains\\r\\n**For each top sender domain that admins reported missed threats for, shows the domain's MDO-detected threat profile (emails with threats and the Malware/Phish/Spam breakdown), the count of admin FN submissions, and the submission rate (Admin Submission % = admin submissions / total inbound from the domain). A high rate can flag a domain whose mail is frequently reported as missed.**\"},\"customWidth\":\"100\",\"name\":\"fn admin - top-sender-domains heading\",\"id\":\"1a481c97-ac85-4b62-a86d-51b33b5a8e68\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 sender domains that admins reported false negatives (missed threats) for, with each domain's MDO-detected threat profile for context.\\r\\nlet subs = CloudAppEvents\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"2\\\",\\\"1\\\",\\\"0\\\")\\r\\n| summarize AdminSubmissions=count() by P2SenderDomain;\\r\\nlet domainProfile = EmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize TotalInbound=count(), EmailsWithThreats=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \\\"Malware\\\"), Phish=countif(ThreatTypes has \\\"Phish\\\"), Spam=countif(ThreatTypes has \\\"Spam\\\") by SenderFromDomain;\\r\\nsubs\\r\\n| join kind=leftouter (domainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\\r\\n| extend AdminSubmissionPct = round(AdminSubmissions * 100.0 / todouble(coalesce(TotalInbound, AdminSubmissions)), 2)\\r\\n| top 10 by AdminSubmissions desc\\r\\n| project ['Sender Domain']=P2SenderDomain, ['Emails With Threats']=coalesce(EmailsWithThreats,0), ['Malware']=coalesce(Malware,0), ['Phish']=coalesce(Phish,0), ['Spam']=coalesce(Spam,0), ['Admin Submissions']=AdminSubmissions, ['Admin Submission %']=AdminSubmissionPct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails With Threats\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Malware\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Admin Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"120px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Admin Submission %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"110px\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn admin - top-sender-domains table\",\"id\":\"e56bed92-b0fb-4b76-90f3-169f4206418b\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) Admin Submissions by admin Detection override types\\r\\n**Displays the top 10 cases where emails were submitted as false negatives by admins, even though they were initially detected by Microsoft Defender for Office 365 but delivered due to an admin policy override. Includes details on PolicyOverride, PolicySource, and DetectionVerdict for deeper insight into override behaviour.**\"},\"customWidth\":\"100\",\"name\":\"fn admin - override-types heading\",\"id\":\"293c174c-0197-4cf8-bbce-36fe42e5cf1b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was a admin policy override\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| extend Admin_SubmissionType=\\r\\niff(SubmissionType == \\\"2\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Malware (Mail)\\\",\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\"))),\\r\\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"2\\\",\\\"1\\\",\\\"0\\\") and PolicyOverride !=\\\"NoOverride\\\"\\r\\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\\r\\n| top 10 by count_ desc\\r\\n| project ['Policy Override']=PolicyOverride, ['Override Source']=PolicyPolicyOverrideType, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn admin - override-types table\",\"id\":\"97799422-53e0-4e3b-8103-297fd1c744eb\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"8\"},\"name\":\"group - 11-Fn Admin Submissions\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"45a1c185-4fbf-4e83-832e-1f20af427796\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">False Negative(FN) User submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into email message **False Negative(FN) Submissions performed by end users** in Microsoft Defender for Office 365 where the message reported as having Phish, Spam threat within its content, URLs or attachments.<br><br>**Recommended action:** Recognise engaged reporters, coach over-reporters, and use graded phishing verdicts to tune anti-phishing policy.\"},\"name\":\"fn user - section header\",\"id\":\"ca0b48e6-8bd8-4f99-956a-f9c72cc870db\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions per-{Granularity} trend by submission types \\r\\n**Displays counts (per {Granularity}) of False Negative(FN) User Submissions grouped by submission type (Spam, Phish and Attack simulations) . Helps to monitor where detections were missed and later submitted by users as false negatives.**\"},\"name\":\"fn user - trend heading\",\"id\":\"60ac8608-7875-45e6-8c83-e6bd0c34af8b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(CloudAppEvents\\r\\n| where ActionType contains \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| summarize User_Phish_FN=countif(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\"), User_Spam_FN=countif(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\"), User_AttackSim_Submission=countif(ActionType == \\\"AttackSimUserSubmission\\\" and SubmissionContentType==\\\"Mail\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Phish (Mail)']=coalesce(User_Phish_FN,0), ['Spam (Mail)']=coalesce(User_Spam_FN,0), ['Attack simulation reported']=coalesce(User_AttackSim_Submission,0) | sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalAdminSubmissions\",\"color\":\"redDark\"},{\"seriesName\":\"Phish (Mail)\",\"color\":\"redDark\"},{\"seriesName\":\"Attack simulation reported\",\"color\":\"green\"},{\"seriesName\":\"Spam (Mail)\",\"color\":\"orangeDark\"}]}},\"name\":\"fn user - submissions trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"29355816-6cba-4264-938e-b0b27afdcb12\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions by submission State\\r\\n**Displays the total count of False Negative(FN) User Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of user submissions and identify bottlenecks or errors.**\"},\"customWidth\":\"50\",\"name\":\"fn user - by-state heading\",\"id\":\"6a4b32cc-b7e4-47bb-b1b9-f415df7e629c\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions by Triage Verdict\\r\\n**Displays the total count of False Negative(FN)/False Positive(FP) User Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**\"},\"customWidth\":\"50\",\"name\":\"fn user - triage-verdict heading\",\"id\":\"1427e34f-be44-4517-ae73-cc4776a49fe7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false negative submissions by the state of the submission.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"UserSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType in (\\\"0\\\",\\\"1\\\")\\r\\n| summarize count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - by-state pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a6151271-e925-4804-a3c1-06afee27c026\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"UserSubmissionTriage\\\" \\r\\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \\r\\n| summarize count() by tostring(TriageVerdict)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - triage-verdict pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"6ff319ea-b5c5-4e33-9e5c-065aadbf465d\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions of already detected Emails (from Junk folder)\\r\\n**Displays the total count of False Negative(FN) User Submissions where the email message was already detected by Microsoft Defender for Office 365 and the detection action was configured to deliver the message into the Junk folder of the user mailbox. It breaks down the result based on the original detection verdict determined by Microsoft Defender for Office 365. Helps track the user submissions of messages that already had a detection. Consider changing the detection action to Quarantine to avoid these submissions.**\"},\"name\":\"fn user - junk-folder heading\",\"id\":\"d6338907-489d-4c88-b82f-260fc0f9d302\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where DeliveryLocation == \\\"Junk folder\\\"\\r\\n| summarize count() by ThreatTypes,User_SubmissionType\\r\\n| project ThreatTypes,User_SubmissionType, Emails = count_\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - junk-folder pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c13452cb-e864-4f01-8623-51f3ea13bbbc\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId,UserId = (parse_json(RawEventData)).UserId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where DeliveryLocation == \\\"Junk folder\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods) \\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0])) \\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\") \\r\\n| summarize TotalJunkSubmittedEmailCount=count(),PhishEmailCount = countif(FirstDetection ==  \\\"Phish\\\"),SpamEmailCount = countif(FirstDetection ==  \\\"Spam\\\") by tostring(UserId)\\r\\n| top 15 by TotalJunkSubmittedEmailCount desc\\r\\n| project ['User']=UserId, ['Junk Submissions']=TotalJunkSubmittedEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Junk Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Phish\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Spam\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fn user - junk-folder table\",\"id\":\"b242f301-c9f7-41f9-aa73-03848bd58eae\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions - Admin review status (Mark and Notify)\\r\\n**Displays counts of False Negative(FN) User Submissions that were reviewed by admins and marked with a notify action. The Mark and Notify action also can be taken automatically with Automated investigation and response (AIR). Helps track cases where admins confirmed user reports and communicated the outcome, supporting transparency and user trust.**\"},\"customWidth\":\"50\",\"name\":\"fn user - mark-notify heading\",\"id\":\"784bf171-53ae-4907-b2b0-7fc5039df231\"},{\"type\":1,\"content\":{\"json\":\"### False Negative(FN) User Submissions accuracy vs Admin review verdict\\r\\n**Displays counts of False Negative(FN) User Submissions (Phish, Junk, NotJunk) compared to admin review results. Highlights whether submissions were Correct, Not Correct, or misclassified comparing user submission type with the Admin decision using Mark and Notify action in Microsoft Defender for Office 365 (e.g., “Phish reported as Junk”, “Reported but not malicious”).**\"},\"customWidth\":\"50\",\"name\":\"fn user - accuracy heading\",\"id\":\"3d137383-6436-4213-9824-72f424b67290\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises user submissions where admin also performed 'mark and notify' action on the submission\\r\\nlet ReviewResults = CloudAppEvents | where ActionType == \\\"SubmissionNotification\\\" \\r\\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\\r\\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\\r\\n| mv-expand element = Properties\\r\\n| where element.Name == \\\"AdminReviewResult\\\"\\r\\n| project SubmissionId, AdminReviewResult = element.Value;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\\r\\n| join kind=leftouter ReviewResults on SubmissionId\\r\\n| extend UserReportedAs=iif(SubmissionType == 1, \\\"Phish\\\",iif(SubmissionType == 2, \\\"Junk\\\",iif(SubmissionType == 3, \\\"NotJunk\\\",\\\"\\\")))\\r\\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\\r\\n| extend Reviewed=iif(isempty(AdminReviewResult),\\\"Not Reviewed\\\",\\\"Reviewed\\\")\\r\\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\\r\\n| summarize count() by Reviewed\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - mark-notify pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"7bb7d116-bd61-4e46-81dd-d634a31e7369\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises user submissions type compared to admin review verdict. \\r\\n//Eg. User reporting a phish but admin review is 'not threat found'\\r\\nlet ReviewResults = CloudAppEvents | where ActionType == \\\"SubmissionNotification\\\" \\r\\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\\r\\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\\r\\n| mv-expand element = Properties\\r\\n| where element.Name == \\\"AdminReviewResult\\\"\\r\\n| project SubmissionId, AdminReviewResult = element.Value;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\\r\\n| join kind=leftouter ReviewResults on SubmissionId\\r\\n| extend UserReportedAs=iif(SubmissionType == 1, \\\"Phish\\\",iif(SubmissionType == 2, \\\"Junk\\\",iif(SubmissionType == 3, \\\"NotJunk\\\",\\\"\\\")))\\r\\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \\\"Correct\\\", iif(AdminReviewResult==\\\"Phish\\\" and UserReportedAs == \\\"Junk\\\", \\\"Phish reported as junk\\\",iif(AdminReviewResult==\\\"Junk\\\" and UserReportedAs == \\\"Phish\\\",\\\"Junk reported as Phish\\\",iif(AdminReviewResult==\\\"NotJunk\\\",\\\"Reported but not malicious or spam\\\",iif(isempty(AdminReviewResult),\\\"Not Reviewed\\\",\\\"Not correct\\\")))))\\r\\n| extend Reviewed=iif(isempty(AdminReviewResult),\\\"Not Reviewed\\\",\\\"Reviewed\\\")\\r\\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\\r\\n| where Reviewed==\\\"Reviewed\\\"\\r\\n| summarize count() by ReviewedAccuracy\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fn user - accuracy pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8af1b9f0-995c-4c58-9960-8e69c6960987\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 P2 Email Senders domains in False Negative(FN) User Submissions \\r\\n**Displays the top 10 P2 email sender domains of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per domain to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"fn user - top-p2-domains heading\",\"id\":\"78dab1f9-09ec-46e2-aee4-f256e368cdd5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top 10 sender domains of inbound emails submitted as false negatives by users.\\r\\nlet TotalInboundbySender=\\r\\nEmailEvents\\r\\n| where EmailDirection ==\\\"Inbound\\\"\\r\\n| summarize count() by SenderFromDomain;\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize UserSubmissions=count() by SenderFromDomain\\r\\n| join TotalInboundbySender on SenderFromDomain\\r\\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\\r\\n| top 10 by UserSubmissions desc\\r\\n| project ['Sender Domain']=SenderFromDomain, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"User Submission %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"12ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - top-p2-domains table\",\"id\":\"6e6a59d4-70e1-4d85-bebb-6bb23d25d2d9\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 P2 Individual Email Senders in False Negative(FN) User Submissions \\r\\n**Displays the top 10 P2 individual email sender addresses of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"fn user - top-p2-senders heading\",\"id\":\"a6e8fda5-dd05-49ed-87e2-16443495396e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top 10 sender email addresses of inbound emails submitted as false negatives by users.\\r\\nlet TotalInboundbySender=\\r\\nEmailEvents\\r\\n| where EmailDirection ==\\\"Inbound\\\"\\r\\n| summarize count() by SenderFromAddress;\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize UserSubmissions=count() by SenderFromAddress\\r\\n| join TotalInboundbySender on SenderFromAddress\\r\\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\\r\\n| top 10 by UserSubmissions desc\\r\\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"User Submission %\",\"formatter\":4,\"formatOptions\":{\"customColumnWidthSetting\":\"12ch\",\"palette\":\"red\",\"min\":0,\"max\":20},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - top-p2-senders table\",\"id\":\"878fd15f-2607-4d6d-b919-0b4bea6a1850\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Intra-org Email Senders in False Negative(FN) User Submissions \\r\\n**Displays the top 10 email senders of intra-org emails reported by users as false negatives (missed detections). Includes total intra-org email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**\"},\"customWidth\":\"100\",\"name\":\"fn user - intraorg-senders heading\",\"id\":\"87a51814-7f01-42e3-aea2-4136c869d39d\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top 10 sender email address of intra-org emails submitted as false negatives by users.\\r\\nlet TotalInboundbySender=\\r\\nEmailEvents\\r\\n| where EmailDirection ==\\\"Intra-org\\\"\\r\\n| summarize count() by SenderFromAddress;\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Intra-org\\\"\\r\\n| summarize UserSubmissions=count() by SenderFromAddress\\r\\n| join TotalInboundbySender on SenderFromAddress\\r\\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\\r\\n| top 10 by UserSubmissions desc\\r\\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Intra-org']=count_, ['User Submission %']=UserSubmissions_Percentage\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Intra-org\",\"formatter\":0,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"User Submission %\",\"formatter\":4,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"12ch\"}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - intraorg-senders table\",\"id\":\"38edca4b-a403-41e8-8c2b-7c0595e93b7a\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Intra-org Email Subjects in False Negative(FN) User Submissions \\r\\n**Displays the top 10 Email Subjects of intra-org emails reported by users as false negatives (missed detections). Helps to highlight high-risk intra-org email sources.**\"},\"customWidth\":\"100\",\"name\":\"fn user - intraorg-subjects heading\",\"id\":\"52b0bc5b-7e54-4a5b-a487-8a736a8c2397\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Intra-org\\\"\\r\\n| summarize count() by Subject\\r\\n| top 10 by count_ desc\\r\\n| project ['Subject']=Subject, ['User Submissions']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Subject\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"70ch\"}},{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - intraorg-subjects table\",\"id\":\"ee2c1d2e-3d4e-4024-8422-985b22cb7475\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Detection Overrides defined by Admins in False Negative(FN) User Submissions \\r\\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to an admin-defined policy override. Includes details on OrgLevelAction, OrgLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**\"},\"customWidth\":\"100\",\"name\":\"fn user - admin-override heading\",\"id\":\"0dd9b3ce-9716-42bb-93de-495f0af2d075\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an admin definded policy override.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where ThreatTypes !=\\\"\\\"and OrgLevelAction!=\\\"\\\"\\r\\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\\r\\n| top 10 by count_ desc\\r\\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Override Policy\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"48ch\"}},{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - admin-override table\",\"id\":\"100de6ca-beb0-44d7-a715-449a389e9e8a\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Detection Overrides defined by Users in False Negative(FN) User Submissions \\r\\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to a user-defined override. Includes details on UserLevelAction, UserLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**\"},\"customWidth\":\"100\",\"name\":\"fn user - user-override heading\",\"id\":\"67057c7d-c0af-4373-b23a-4001fbced888\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an policy override.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\\r\\n| extend User_SubmissionType=\\r\\niff(SubmissionType == \\\"1\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Phish (Mail)\\\",\\r\\niff(SubmissionType == \\\"0\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Spam (Mail)\\\",\\\"Other\\\")),\\r\\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType in (\\\"1\\\",\\\"0\\\")\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where ThreatTypes !=\\\"\\\"and UserLevelAction!=\\\"\\\"\\r\\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\\r\\n| top 10 by count_ desc\\r\\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Override Policy\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"48ch\"}},{\"columnMatch\":\"User Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - user-override table\",\"id\":\"1b97f7d2-152d-4eb0-bfac-e161fbfa4046\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 users performing the most False Negative(FN) User Submissions\\r\\n**Displays the Top 10 user accounts that performed the highest number of False Negative(FN) User Submissions (missed detections). Helps identify individuals most engaged in reporting suspicious, malicious messages and potential patterns in detection gaps.**\"},\"customWidth\":\"100\",\"name\":\"fn user - top-users heading\",\"id\":\"7799a0a0-a835-4080-b59a-736b08ad809e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 users performing false negative submissions\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType in (\\\"0\\\",\\\"1\\\")\\r\\n| extend UserId = (parse_json(RawEventData)).UserId\\r\\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\\r\\n| top 10 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - top-users pie\",\"id\":\"44838734-43a0-4301-9ddb-a644c7ec509a\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 users performing the most User Submissions of Attack simulation messages\\r\\n**Displays the top 10 user accounts that reported phishing simulation emails during cyber security awareness campaigns. Supports evaluation of cyber security awareness programme effectiveness and identifies highly engaged users.**\"},\"customWidth\":\"100\",\"name\":\"fn user - attacksim-users heading\",\"id\":\"8a96e90f-765f-40c0-8476-30c97d43c328\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top users reporting the phishing simulation emails.\\r\\nCloudAppEvents \\r\\n| extend Record= (parse_json(RawEventData)).RecordType \\r\\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState \\r\\n| extend UserId = (parse_json(RawEventData)).UserId\\r\\n| where Record == 29\\r\\n| where ActionType == \\\"AttackSimUserSubmission\\\" \\r\\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\\r\\n| top 10 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fn user - attacksim-users pie\",\"id\":\"ab648c4a-4c46-4c73-96f0-784c9bcef961\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"8\"},\"name\":\"group - 11 - FN User submissions\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"348ce24a-7cbc-4b66-a471-dfe3827bed2d\"},{\"type\":1,\"content\":{\"json\":\"# False Positive(FP) Submissions insights\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into email message **False Positive(FP) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by administrators or users.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"10\"},\"name\":\"fp - tab description\",\"id\":\"78e2df52-a0d2-499a-95fe-708f67db5ad6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">False Positive(FP) Admin Submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nAdministrator submissions represent escalated false positive reports submitted by security team members rather than end users. These typically involve more complex cases requiring expert review, such as recurring issues affecting multiple users, business-critical communications being blocked, or suspected policy misconfigurations. Admin submissions carry higher priority and can result in actions as allow-list additions or global policy changes to prevent widespread user impact.<br><br>**Recommended action:** Review recurring false-positive sender domains and consider allow entries or policy tuning to reduce business disruption.\"},\"name\":\"fp admin - section header\",\"id\":\"02d54e9c-e989-4cde-a128-68a6381ed9d7\"},{\"type\":1,\"content\":{\"json\":\"### Admin Submission Volume and Type Breakdown\\r\\n\\r\\n**These charts track the volume and composition of administrator-initiated false positive submissions. The trend chart shows submission patterns (per {Granularity}) across Email, URL, and Attachment types, while the pie chart reveals the distribution among these categories. Spikes in admin submissions often signal systemic issues requiring immediate policy review, as admins typically escalate only the most impactful or recurring problems.**\"},\"name\":\"fp admin - volume/type heading\",\"id\":\"103b8362-a10f-4b46-a757-8290c4269a5c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of admin false positive submission by submission type.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(CloudAppEvents\\r\\n| where ActionType contains \\\"Submission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| summarize Admin_Email_FP=countif(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\"), Admin_URL_FP=countif(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\"), Admin_Attach_FP=countif(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\") by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Email']=coalesce(Admin_Email_FP,0), ['URL']=coalesce(Admin_URL_FP,0), ['Attachment']=coalesce(Admin_Attach_FP,0) | sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"TotalAdminSubmissions\",\"color\":\"redDark\"},{\"seriesName\":\"Admin_Phish_FN\",\"color\":\"redBright\"},{\"seriesName\":\"Admin_Spam_FN\",\"color\":\"orange\"},{\"seriesName\":\"Admin_Malware_FN\",\"color\":\"redDark\"},{\"seriesName\":\"Admin_Phish_URL_FN\",\"color\":\"purple\"},{\"seriesName\":\"Admin_Malware_Attach_FN\",\"color\":\"yellowDark\"},{\"seriesName\":\"Admin_Phish_Attach_FN\",\"color\":\"purpleDark\"},{\"seriesName\":\"Admin_Malware_URL_FN\",\"color\":\"yellow\"},{\"seriesName\":\"Admin_Email_FP\",\"color\":\"redDark\"},{\"seriesName\":\"Admin_URL_FP\",\"color\":\"orangeDark\"},{\"seriesName\":\"Admin_Attach_FP\",\"color\":\"yellow\"}]}},\"customWidth\":\"66\",\"name\":\"fp admin - submissions trend\",\"id\":\"326762ca-1f2b-48e9-90d6-ff2aa6a75e95\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false positive submission by submission type.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"Submission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| extend Admin_SubmissionType=\\r\\niff(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\",\\\"Email\\\",\\r\\niff(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"URL\\\",\\\"URL\\\",\\r\\niff(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Attachment\\\",\\\"Attachment\\\",\\r\\n\\\"Other\\\")))\\r\\n| where Admin_SubmissionType!=\\\"Other\\\"\\r\\n| summarize count() by Admin_SubmissionType\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"33\",\"name\":\"fp admin - by-type pie\",\"id\":\"be925c4c-5718-4385-8e82-59c57b975ac5\"},{\"type\":1,\"content\":{\"json\":\"### False Positive(FP) Admin Submissions by submission state<br>\\r\\n\\r\\n**Displays the total count of False Positive(FP) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**\"},\"customWidth\":\"50\",\"name\":\"fp admin - by-state heading\",\"id\":\"2b2acb67-c070-48bd-acf1-025c05aae8b5\"},{\"type\":1,\"content\":{\"json\":\"### Top Admins Submitting False Positives<br>\\r\\n\\r\\n**Displays the top 15 admin accounts that submitted the highest number of false positive messages via AdminSubmission.**\"},\"customWidth\":\"50\",\"name\":\"fp admin - top-admins heading\",\"id\":\"52206f40-fae9-460f-97b8-2cf9b633098f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of admin false positive submissions by the state of the submission.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"AdminSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType == \\\"3\\\"\\r\\n| summarize count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fp admin - by-state pie\",\"id\":\"96133d9e-24fb-417e-a3cd-df98dda4c60a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top admins performing false positive submissions.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType  \\r\\n| where Record == 29 and SubmissionType ==\\\"3\\\"\\r\\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\\r\\n| top 15 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fp admin - top-admins pie\",\"id\":\"da7b4c89-904d-4917-b6cd-04b32e02d4a1\"},{\"type\":1,\"content\":{\"json\":\"### Admin Submission False Positive Malware Detection Breakdown\\r\\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as malware.**\"},\"customWidth\":\"100\",\"name\":\"fp admin - malware-detection heading\",\"id\":\"69d649e0-86fd-4c08-afd4-e6c200b11c86\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Admin false positive submissions whose original verdict was Malware, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Malware.\\r\\nlet total = toscalar(CloudAppEvents\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n    | extend R = parse_json(RawEventData)\\r\\n    | where tostring(R.SubmissionContentType) == \\\"Mail\\\" and tostring(R.SubmissionType) == \\\"3\\\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \\\"Malware\\\"\\r\\n    | count);\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\" and DetectionVerdict == \\\"Malware\\\"\\r\\n| extend DetectionMethod = iif(isempty(DetectionMethod), \\\"Not specified\\\", DetectionMethod)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\\r\\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Malware FPs'] = Pct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"% of\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp admin - malware-detection table\",\"id\":\"607eb19b-1ded-488d-98db-8b23f9e90967\"},{\"type\":1,\"content\":{\"json\":\"### Admin Submission False Positive Phish Detection Breakdown\\r\\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**\"},\"customWidth\":\"100\",\"name\":\"fp admin - phish-detection heading\",\"id\":\"c1f1e12f-d0aa-4023-9172-8182772b3331\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Admin false positive submissions whose original verdict was Phish, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Phish.\\r\\nlet total = toscalar(CloudAppEvents\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n    | extend R = parse_json(RawEventData)\\r\\n    | where tostring(R.SubmissionContentType) == \\\"Mail\\\" and tostring(R.SubmissionType) == \\\"3\\\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \\\"Phish\\\"\\r\\n    | count);\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\" and DetectionVerdict == \\\"Phish\\\"\\r\\n| extend DetectionMethod = iif(isempty(DetectionMethod), \\\"Not specified\\\", DetectionMethod)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\\r\\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Phish FPs'] = Pct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"% of\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp admin - phish-detection pie\",\"id\":\"b6c074f9-affa-41a3-802a-53541394ae73\"},{\"type\":1,\"content\":{\"json\":\"### Admin Submission False Positive Spam Detection Breakdown\\r\\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**\"},\"customWidth\":\"100\",\"name\":\"fp admin - spam-detection heading\",\"id\":\"f0f2adb9-34af-4df0-90e6-087a265bedf6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Admin false positive submissions whose original verdict was Spam, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Spam.\\r\\nlet total = toscalar(CloudAppEvents\\r\\n    | where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n    | extend R = parse_json(RawEventData)\\r\\n    | where tostring(R.SubmissionContentType) == \\\"Mail\\\" and tostring(R.SubmissionType) == \\\"3\\\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \\\"Spam\\\"\\r\\n    | count);\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\" and DetectionVerdict == \\\"Spam\\\"\\r\\n| extend DetectionMethod = iif(isempty(DetectionMethod), \\\"Not specified\\\", DetectionMethod)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\\r\\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Spam FPs'] = Pct\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"% of\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"14ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp admin - spam-detection pie\",\"id\":\"e877d9c9-3bd3-4368-997e-945f18ffcf5f\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains for Admin False Positive Submissions<br>\\r\\n\\r\\n**Lists the top 10 sender domains of emails reported as false positives by administrators (legitimate messages incorrectly flagged as spam or phishing). Helps identify domains frequently misclassified.**\"},\"customWidth\":\"50\",\"name\":\"fp admin - top-sender-domains heading\",\"id\":\"37680101-7e4b-4bcc-9e7e-0ccd2d914881\"},{\"type\":1,\"content\":{\"json\":\"### Admin False Positive Submissions by Original Threat Verdict<br>\\r\\n\\r\\n**Displays all administrator-submitted false positive emails by their original filter verdict (e.g., spam, phishing) and policy override details. Helps identify which threat categories are most often misclassified.**\"},\"customWidth\":\"50\",\"name\":\"fp admin - by-verdict heading\",\"id\":\"879e81ad-00a6-4a10-bcb6-56879133bb9f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top 10 sender domains of emails which are submitted as false positive by admins\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType ==\\\"3\\\"\\r\\n| summarize count() by P2SenderDomain\\r\\n| top 10 by count_ desc\\r\\n| project ['Sender Domain']=P2SenderDomain, ['Emails']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fp admin - top-sender-domains table\",\"id\":\"42844dc9-4418-487b-a5ad-31e1f6b4b487\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"AdminSubmissionSubmitted\\\" \\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| extend Admin_SubmissionType=\\r\\niff(SubmissionType == \\\"3\\\" and ActionType == \\\"AdminSubmissionSubmitted\\\" and SubmissionContentType==\\\"Mail\\\" ,\\\"Email\\\",\\r\\n\\\"Other\\\"),\\r\\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\\r\\n| top 10 by count_ desc\\r\\n| project ['Policy Override']=PolicyOverride, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Emails\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"40ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fp admin - by-verdict table\",\"id\":\"3ebbd402-06ef-45a7-b4ee-c5938b98b540\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"10\"},\"name\":\"fp admin - group\",\"styleSettings\":{\"showBorder\":true},\"id\":\"b6215b53-c181-4693-a14f-441809f65f38\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">False Positive (FP) User Submissions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into email message False Postive(FP) Submissions performed by end users in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by users. User submissions are critical feedback mechanisms that help security teams identify overly aggressive detection rules, refine security policies, and reduce user friction. High false positive rates can erode user trust and lead to security fatigue, so monitoring these metrics helps balance protection with productivity.<br><br>**Recommended action:** High user false-positive volume suggests over-aggressive filtering - review the affected senders and adjust policy.\"},\"name\":\"fp user - section header\",\"id\":\"0d93d7ee-a61e-43b7-bdcd-172bd79ad050\"},{\"type\":1,\"content\":{\"json\":\"### User Submission Trend\\r\\n\\r\\n**Displays the volume (per {Granularity}) of false positive submissions from end users. A sudden spike may indicate a new detection rule causing widespread misclassification, while a declining trend suggests improving detection accuracy. Monitoring this trend helps security teams respond quickly to detection issues before they impact user productivity.**\"},\"name\":\"fp user - trend heading\",\"id\":\"c3f8ae45-0498-4fa8-b9d1-35e926932639\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of user false positive submission by submission type.\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(CloudAppEvents\\r\\n| where ActionType contains \\\"UserSubmission\\\"\\r\\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where SubmissionType == \\\"3\\\" and ActionType == \\\"UserSubmission\\\" and SubmissionContentType==\\\"Mail\\\"\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['User FP Submissions'] = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"User FP Submissions\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"fp user - submissions trend\",\"id\":\"847032f5-56a8-4681-9665-9e917c7c9355\"},{\"type\":1,\"content\":{\"json\":\"### User False Positive Submissions by State<br>\\r\\n\\r\\n**Displays the total number of user-reported false positive email submissions grouped by their processing state (e.g., pending, completed). Helps track submission workflow and resolution progress.**\"},\"customWidth\":\"50\",\"name\":\"fp user - by-state heading\",\"id\":\"7bd03278-7734-4fbf-a502-95b42e90160e\"},{\"type\":1,\"content\":{\"json\":\"### Top Users Performing False Positive Submissions<br>\\r\\n\\r\\n**Lists the top 15 users who reported emails as false positives (legitimate messages incorrectly flagged as threats). Helps identify frequent reporters and potential training or policy adjustment needs.**\"},\"customWidth\":\"50\",\"name\":\"fp user - top-users heading\",\"id\":\"7e2b987b-325d-4f69-8d6b-fafd6676a03a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of user false positive submission by submission state.\\r\\nCloudAppEvents \\r\\n| where ActionType contains \\\"UserSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType == \\\"3\\\"\\r\\n| summarize count() by tostring(SubmissionState)\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"fp user - by-state pie\",\"id\":\"df79d08b-3eac-4101-a3f2-3a4a3bf450ce\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the top users performing false positive submissions.\\r\\nCloudAppEvents \\r\\n| where ActionType == \\\"UserSubmission\\\" \\r\\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\\r\\n| where Record == 29 and SubmissionType == \\\"3\\\"\\r\\n| extend UserId = (parse_json(RawEventData)).UserId\\r\\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\\r\\n| top 15 by ['Submissions'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"fp user - top-users pie\",\"id\":\"ec7505d8-3a70-4bde-a985-baf5a0c4ec34\"},{\"type\":1,\"content\":{\"json\":\"### User Submission False Positive Malware Detection Breakdown\\r\\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection technique that flagged them. Malware quarantine is admin-only by default, so this table only populates when a custom quarantine policy lets users view and report their own malware detections - it is usually empty.**\"},\"customWidth\":\"100\",\"name\":\"fp user - malware-verdict heading\",\"id\":\"693b1072-5ddd-49d0-a0f5-2bba4c287edf\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//User false positive submissions whose email was originally flagged as Malware, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Malware.\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has \\\"Malware\\\"\\r\\n| mv-expand Technique = parse_json(DetectionMethods).Malware to typeof(string)\\r\\n| where isnotempty(Technique)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"22ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - malware-verdict table\",\"id\":\"10ea55bd-937e-454d-b6cc-a9dccfdf3417\"},{\"type\":1,\"content\":{\"json\":\"### User Submission False Positive Phish Detection Breakdown\\r\\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**\"},\"customWidth\":\"100\",\"name\":\"fp user - phish-verdict heading\",\"id\":\"6dd14abb-2772-4271-89d8-8c0dcdbfd9e5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//User false positive submissions whose email was originally flagged as Phish, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Phish.\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has \\\"Phish\\\"\\r\\n| mv-expand Technique = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Technique)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"22ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - phish-verdict pie\",\"id\":\"57049aad-eb17-4e65-a8a4-b5d05b0501cd\"},{\"type\":1,\"content\":{\"json\":\"### User Submission False Positive Spam Detection Breakdown\\r\\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**\"},\"customWidth\":\"100\",\"name\":\"fp user - spam-verdict heading\",\"id\":\"5479b2ed-b629-41e7-9857-c91191b09c8f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//User false positive submissions whose email was originally flagged as Spam, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Spam.\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has \\\"Spam\\\"\\r\\n| mv-expand Technique = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Technique)\\r\\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\\r\\n| sort by FPSubmissions desc\\r\\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Sender Domains\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"22ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - spam-verdict pie\",\"id\":\"45a2122e-0281-4602-906d-a0406ed20d54\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Sender Domains for User False Positive Submissions<br>\\r\\n\\r\\n**Lists the top 10 sender domains of emails reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify domains frequently misclassified.**\"},\"customWidth\":\"100\",\"name\":\"fp user - top-sender-domains heading\",\"id\":\"2751fca4-3ac5-45fe-a965-8c811018926a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 sender domains reported as false positives by users, with each domain's total inbound volume and the share of it reported as FP (a high rate flags a domain whose legitimate mail is most often misclassified).\\r\\nlet totalByDomain = EmailEvents | where EmailDirection == \\\"Inbound\\\" | summarize TotalInbound = count() by SenderFromDomain;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), P2SenderDomain = tostring(R.P2SenderDomain)\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| summarize FPSubmissions = count() by P2SenderDomain\\r\\n| join kind=leftouter (totalByDomain) on $left.P2SenderDomain == $right.SenderFromDomain\\r\\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\\r\\n| top 10 by FPSubmissions desc\\r\\n| project ['Sender Domain'] = P2SenderDomain, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"18ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"FP Submission %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - top-sender-domains table\",\"id\":\"c69b126d-9f25-44a0-b96d-601d89a563f1\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Senders in User False Positive Submissions<br>\\r\\n\\r\\n**Displays the top 10 email senders whose messages were reported as false positives by users (legitimate emails incorrectly flagged as threats). Helps identify senders frequently misclassified.**\"},\"customWidth\":\"100\",\"name\":\"fp user - top-senders heading\",\"id\":\"b39966ad-2b40-4144-ae3f-c7ac6b9fb97c\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 email senders reported as false positives by users, with each sender's total inbound volume and the share reported as FP.\\r\\nlet totalBySender = EmailEvents | where EmailDirection == \\\"Inbound\\\" | summarize TotalInbound = count() by SenderMailFromAddress;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize FPSubmissions = count() by SenderMailFromAddress\\r\\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\\r\\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\\r\\n| top 10 by FPSubmissions desc\\r\\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Inbound\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"18ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"FP Submission %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - top-senders table\",\"id\":\"077ab610-58ed-4d23-886c-dbf912cef2d7\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Subjects in User False Positive Submissions<br>\\r\\n\\r\\n**Displays the top 10 email subjects reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify common patterns in misclassified emails.**\"},\"customWidth\":\"100\",\"name\":\"fp user - top-subjects heading\",\"id\":\"a5b939e1-0fbf-4ee1-a6a3-01fa7639af3a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 email subjects reported as false positives by users, with how many distinct recipients reported each (a subject reported by many users is a broad misclassification pattern).\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Inbound\\\"\\r\\n| summarize FPSubmissions = count(), DistinctRecipients = dcount(RecipientObjectId) by Subject\\r\\n| top 10 by FPSubmissions desc\\r\\n| project ['Subject'] = Subject, ['FP Submissions'] = FPSubmissions, ['Distinct Recipients'] = DistinctRecipients\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Subject\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"70ch\"}},{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Distinct Recipients\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"18ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - top-subjects table\",\"id\":\"71d5c290-f5d0-493c-b821-b5345dbe7312\"},{\"type\":1,\"content\":{\"json\":\"### Top 10 Intra-Org Senders in User False Positive Submissions<br>\\r\\n\\r\\n**Displays the top 10 internal senders whose emails were reported as false positives by users (legitimate intra-org messages incorrectly flagged as threats). Helps identify internal communication patterns causing misclassification.**\"},\"customWidth\":\"100\",\"name\":\"fp user - intraorg-senders heading\",\"id\":\"1d38f458-dfde-4608-ad7d-ee8628e85ee7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 10 internal senders whose emails were reported as false positives by users, with total intra-org volume and the share reported as FP.\\r\\nlet totalBySender = EmailEvents | where EmailDirection == \\\"Intra-org\\\" | summarize TotalIntraOrg = count() by SenderMailFromAddress;\\r\\nCloudAppEvents\\r\\n| where ActionType == \\\"UserSubmission\\\"\\r\\n| extend R = parse_json(RawEventData)\\r\\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\\r\\n| where SubmissionContentType == \\\"Mail\\\" and SubmissionType == \\\"3\\\"\\r\\n| join EmailEvents on NetworkMessageId, RecipientObjectId\\r\\n| where EmailDirection == \\\"Intra-org\\\"\\r\\n| summarize FPSubmissions = count() by SenderMailFromAddress\\r\\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\\r\\n| extend FPPct = iif(isnull(TotalIntraOrg) or TotalIntraOrg == 0, 0.0, round(FPSubmissions * 100.0 / TotalIntraOrg, 2))\\r\\n| top 10 by FPSubmissions desc\\r\\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Intra-org'] = coalesce(TotalIntraOrg, 0), ['FP Submission %'] = FPPct\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FP Submissions\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Total Intra-org\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"18ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"FP Submission %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"16ch\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"fp user - intraorg-senders table\",\"id\":\"b6699a7f-897a-4016-ae2c-d816f3a9492b\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"10\"},\"name\":\"fp user - group\",\"styleSettings\":{\"showBorder\":true},\"id\":\"2ad3311e-e92b-4a49-bdd0-775f085c4587\"},{\"type\":1,\"content\":{\"json\":\"# File Malware Detections (SharePoint, Teams and OneDrive)\\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides insights into malicious file detections across Microsoft collaboration platforms such as SharePoint, OneDrive, and Teams.\\r\\n\\r\\n[<p><b>Safe Attachments for SharePoint, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-about)\\r\\n[<p><b>Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams</b></p>](https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-for-spo-odfb-teams-about) \"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"9\"},\"name\":\"filemal - tab description\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cefcac88-f373-4748-b0ea-e7600f63edd7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Microsoft Defender for Office 365 value for files in SharePoint / OneDrive / Teams: total files processed, how many had a malware detection, and how many were scanned with no detection. A per-period Trend series feeds the tile sparkline.\\r\\nlet gran = {Granularity};\\r\\nlet base = FileMaliciousContentInfo;\\r\\nlet counts = union\\r\\n(base | summarize Count = count() | extend Cat = \\\"Total Files Processed (SPO/ODB/Teams)\\\", Ord = 1),\\r\\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Cat = \\\"Files with Malware Detected\\\", Ord = 2),\\r\\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Cat = \\\"Files Scanned - No Detection\\\", Ord = 3);\\r\\nlet tagged = union\\r\\n(base | extend Cat = \\\"Total Files Processed (SPO/ODB/Teams)\\\"),\\r\\n(base | where isnotempty(ThreatTypes) | extend Cat = \\\"Files with Malware Detected\\\"),\\r\\n(base | where isempty(ThreatTypes) | extend Cat = \\\"Files Scanned - No Detection\\\");\\r\\nlet trends = tagged | make-series Trend = count() default = 0 on Timestamp step gran by Cat;\\r\\ncounts\\r\\n| join kind=leftouter (trends) on Cat\\r\\n| sort by Ord asc\\r\\n| project Count, Details = Cat, Trend\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Details\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"name\":\"filemal - MDO value tiles\",\"id\":\"843e58a9-6324-4a90-a652-bfb0549e79dc\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"9\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">File Malware Detection (SharePoint, OneDrive, and Teams)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section monitors malware detections in files stored across Microsoft 365 collaboration platforms. Microsoft Defender for Office 365 and built-in SharePoint Online antivirus work together to scan files uploaded to SharePoint, OneDrive, and Teams. Understanding file-based malware patterns helps protect collaborative workspaces and identify potential security risks in shared content.<br><br>**Recommended action:** For repeat file owners or sites, investigate possible compromise and confirm Safe Attachments for SharePoint, OneDrive and Teams is enabled.\"},\"name\":\"filemal - section header\",\"id\":\"373fe4e5-fc90-49cf-93ba-c8b100efce57\"},{\"type\":1,\"content\":{\"json\":\"### File Malware Detection Trend<br>\\r\\n\\r\\n**This visual tracks the volume (per {Granularity}) of malware detections in files across all Microsoft 365 workloads. Spikes in detection activity may indicate targeted attacks or emerging malware campaigns affecting collaborative platforms. Regular monitoring helps identify unusual patterns that require investigation.**\"},\"name\":\"filemal - trend heading\",\"id\":\"30145585-8998-443a-b6ec-062d136c621f\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(FileMaliciousContentInfo\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Files']=coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"tileSettings\":{\"showBorder\":false},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Files\",\"color\":\"blueDark\"}],\"showDataPoints\":true}},\"customWidth\":\"100\",\"name\":\"filemal - detection trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"d39cea9b-75a8-4c29-bfdb-2e0db855e98a\"},{\"type\":1,\"content\":{\"json\":\"### Malware Family Analysis - Defender for Office 365\\r\\n**Provides a breakdown of malware detections in files scanned by Microsoft Defender for Office 365 (Safe Attachments detonation) across SharePoint, OneDrive, and Teams. The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify dominant threats and their spread across collaboration platforms.**\"},\"customWidth\":\"100\",\"name\":\"filemal - family MDO heading\",\"id\":\"4e330873-f732-4d37-a7b0-dced08b019b0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes File malware detections by Microsoft Defender for Office 365 (Safe Attachments detonation) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\\r\\nFileMaliciousContentInfo\\r\\n| where tostring(DetectionMethods) contains \\\"detonation\\\"\\r\\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\\\"Site: \\\", tostring(split(FolderPath, \\\"/\\\")[4])))\\r\\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\\r\\n| sort by ['Files'] desc\\r\\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"RawinfoVirusInfo\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"RawinfoVirusInfo\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"RawinfoVirusInfo\",\"createOtherGroup\":15},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Files\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"filemal - family MDO table\",\"id\":\"c3fbb1c9-be67-43b9-9a32-7fb265a84ffc\"},{\"type\":1,\"content\":{\"json\":\"### Malware Family Analysis - SharePoint AV\\r\\n**Provides a breakdown of malware detections in files across SharePoint, OneDrive, and Teams caught by the built-in SharePoint antivirus (Antimalware engine). The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify prevalent threats and their spread across collaboration environments.**\"},\"customWidth\":\"100\",\"name\":\"filemal - family SPO-AV heading\",\"id\":\"331a8361-6e81-4615-b33a-97ebb3e31529\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query summarizes File malware detections by the built-in SharePoint antivirus (Antimalware engine) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\\r\\nFileMaliciousContentInfo\\r\\n| where tostring(DetectionMethods) contains \\\"Antimalware engine\\\"\\r\\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\\\"Site: \\\", tostring(split(FolderPath, \\\"/\\\")[4])))\\r\\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\\r\\n| sort by ['Files'] desc\\r\\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"chartSettings\":{\"xAxis\":\"RawinfoVirusInfo\",\"createOtherGroup\":10},\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Files\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"filemal - family SPO-AV table\",\"id\":\"bbcdccd9-eedb-476a-a0e7-8504f8770229\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Location<br>\\r\\n\\r\\n**Displays the number of malware detections grouped by specific SharePoint sites or OneDrive locations. Helps identify which sites have the highest volume of detected threats for targeted remediation and security hardening.**\"},\"customWidth\":\"50\",\"name\":\"filemal - by-location heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"c5668d6e-7c0e-4ce3-9509-ca93dda3efad\"},{\"type\":1,\"content\":{\"json\":\"### Malware Detections by Application<br>\\r\\n\\r\\n**Summarizes malware detections across Microsoft collaboration apps, including SharePoint, OneDrive, and Teams. Helps identify which applications experience the highest volume of detected threats for targeted security measures.**\"},\"customWidth\":\"50\",\"name\":\"filemal - by-application heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"07e64ca9-04a2-44b2-a044-e927bc73ef1b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query lists total Malware detections of files on SharePoint, OneDrive and Teams by the location (site or personal path) where the file resides.\\r\\nFileMaliciousContentInfo\\r\\n| extend ['Site / Location'] = tostring(split(FolderPath, '/')[4])\\r\\n| summarize ['Detections'] = count() by ['Site / Location']\\r\\n| sort by ['Detections'] desc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"filemal - by-location table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3ce3ea65-a4df-450f-871c-8956d59818a9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams summarizing the data by the Microsoft collaboration application (workload).\\r\\nFileMaliciousContentInfo\\r\\n| summarize count() by Workload\\r\\n| sort by count_ desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"filemal - by-application pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"003afc8e-0403-4aa9-9084-a3c2e435216a\"},{\"type\":1,\"content\":{\"json\":\"### Top File Owners Holding Malware\\r\\n**Lists the users (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, with the count of malicious files, distinct files, affected workloads and sample threat names. Helps pinpoint the accounts and collaboration locations most affected by malicious content for targeted remediation.**\"},\"customWidth\":\"100\",\"name\":\"filemal - top-owners heading\",\"id\":\"c2f8d3b5-0a4e-4b7c-9d23-8e6f0a1b2c34\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top file owners (or the SharePoint/Teams site, when a file has no user owner) whose SharePoint/OneDrive/Teams files were flagged as malware, with distinct files, workloads and sample threat names.\\r\\nFileMaliciousContentInfo\\r\\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\\\"Site: \\\", tostring(split(FolderPath, \\\"/\\\")[4])))\\r\\n| summarize ['Malicious Files'] = count(),\\n            ['Distinct Files']  = dcount(SHA256),\\n            ['Workloads']       = make_set(Workload, 3),\\n            ['Sample Threats']  = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\\n            ['Last Seen']       = max(Timestamp)\\n        by ['Owner']=Owner\\n| top 20 by ['Malicious Files']\",\"size\":0,\"title\":\"Top File Owners Holding Malware\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Malicious Files\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Distinct Files\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"name\":\"filemal - top-owners table\",\"id\":\"36d9a683-9f9d-4a70-84d9-ec351542f827\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"9\"},\"name\":\"filemal - group\",\"styleSettings\":{\"showBorder\":true},\"id\":\"50886cd9-87bf-4a84-bd80-d7f44441b3f7\"},{\"type\":1,\"content\":{\"json\":\"# Post-Delivery &amp; Quarantine Insights\\r\\n\\r\\n---\\r\\nThis tab covers what happens to threats **after delivery**: Zero-hour Auto Purge (ZAP) remediation of malicious messages already in mailboxes, and quarantine management - what is held, released, and by whom. Together they show how effectively post-delivery response contains threats that reached the inbox.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"11\"},\"name\":\"postdelivery - tab description\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"93371620-d968-4987-bddd-6c9b9e5a0344\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Post Delivery Protection offered by ZAP\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides insights into Microsoft Defender for Office 365's post-delivery protection capabilities through Zero-Hour Auto Purge (ZAP). ZAP is a critical security feature that continuously monitors delivered emails and automatically removes messages that are later identified as malicious. These visuals help track ZAP effectiveness, response times, and remediation patterns.<br><br>**Recommended action:** High post-delivery ZAP volume means threats are reaching inboxes before being caught - review pre-delivery filtering and detection latency.\"},\"name\":\"postdelivery - section header\",\"id\":\"b22ee5f1-a2dc-4509-92a3-1dbcad3a6ee7\"},{\"type\":1,\"content\":{\"json\":\"### ZAP Post-Delivery Actions (per {Granularity})<br>\\r\\n\\r\\n**Shows the count (per {Granularity}) of emails that were remediated post-delivery by Zero-Hour Auto Purge (ZAP). Helps track how often threats are detected and removed after reaching user mailboxes.**\"},\"customWidth\":\"50\",\"name\":\"postdelivery - zap-actions heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"af1aa73f-d952-4827-bcc9-b97a19016829\"},{\"type\":1,\"content\":{\"json\":\"### ZAP Actions by Detection Type (per {Granularity})<br>\\r\\n\\r\\n**Visualizes the count (per {Granularity}) of post-delivery remediation actions performed by Zero-Hour Auto Purge (ZAP), broken down by detection type (Spam ZAP, Phish ZAP, Malware ZAP). Helps track which threat categories are most frequently remediated after delivery.**\"},\"customWidth\":\"50\",\"name\":\"postdelivery - by-detection-type heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"8eb38cb1-4e2d-435a-81be-e661c9b89ff4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge.\\r\\nlet gran = {Granularity};\\r\\nlet agg = materialize(EmailPostDeliveryEvents \\r\\n| where ActionType has \\\"ZAP\\\"\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Zapped Emails'] = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Zapped Emails\",\"color\":\"blueDark\"}]}},\"customWidth\":\"50\",\"name\":\"postdelivery - zap-actions trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"dd60fd71-4e14-4b38-ad22-39f1e3e3f55a\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailPostDeliveryEvents\\r\\n| where ActionType has \\\"ZAP\\\"\\r\\n| summarize [\\\"Spam ZAP\\\"]=countif(ActionType has 'Spam ZAP'), [\\\"Phish ZAP\\\"]=countif(ActionType has 'Phish ZAP'), [\\\"Malware ZAP\\\"]=countif(ActionType has 'Malware ZAP') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, [\\\"Spam ZAP\\\"]=coalesce([\\\"Spam ZAP\\\"],0), [\\\"Phish ZAP\\\"]=coalesce([\\\"Phish ZAP\\\"],0), [\\\"Malware ZAP\\\"]=coalesce([\\\"Malware ZAP\\\"],0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"50\",\"name\":\"postdelivery - by-detection-type trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"511f4a43-9f56-48ad-a644-b72722af82d7\"},{\"type\":1,\"content\":{\"json\":\"### ZAP Remediation by Destination<br>\\r\\n\\r\\n**This visual shows where ZAP moves malicious emails during remediation. Post-delivery actions can send emails to different locations: Quarantine (isolated for admin review), Deleted Items (soft delete), Junk Email folder, or back to Inbox (for false positive corrections). Understanding these patterns helps evaluate ZAP policy configurations and ensures malicious content is properly isolated from users.**\"},\"name\":\"postdelivery - by-destination heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"dc7b9b6c-36fb-4ae4-a3e8-ff11da681c97\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailPostDeliveryEvents\\r\\n| where ActionType contains \\\"ZAP\\\"\\r\\n| summarize Quarantine=countif(DeliveryLocation has 'Quarantine'), ['Deleted Items']=countif(DeliveryLocation has 'Delete'), Junk=countif(DeliveryLocation has 'Junk'), Inbox=countif(DeliveryLocation has 'Inbox') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, Quarantine=coalesce(Quarantine,0), ['Deleted Items']=coalesce(['Deleted Items'],0), Junk=coalesce(Junk,0), Inbox=coalesce(Inbox,0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"name\":\"postdelivery - by-destination trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"cbb737ef-1c7e-4b3e-af26-a553fe6147c9\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"11\"},\"name\":\"postdelivery - group\",\"styleSettings\":{\"showBorder\":true},\"id\":\"e436ecee-8886-4179-a578-9e4a42e75b9e\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Quarantine Management and Insights\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\nThis section provides comprehensive insights into quarantine operations, including release patterns, detection methods, and threat categorization. It helps security teams understand what types of threats are being quarantined and monitor quarantine release activity to identify potential false positives or security policy effectiveness.<br><br>**Recommended action:** Investigate high release rates - they indicate false positives or risky user releases; review quarantine policies and release permissions.\"},\"name\":\"quarantine - section header\",\"id\":\"c4862977-6670-4716-8109-252a361d7478\"},{\"type\":1,\"content\":{\"json\":\"### Quarantine Release Trend<br>\\r\\n\\r\\n**This visual displays the per-{Granularity} trend of emails released from quarantine by administrators. Monitoring this metric helps identify patterns in quarantine management and potential areas where policy adjustments may be needed to reduce unnecessary quarantines.**\"},\"name\":\"quarantine - release-trend heading\",\"id\":\"8526a5e0-c6a4-44e3-b00a-5e135374f58e\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of emails released from quarantine\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailPostDeliveryEvents\\r\\n| where ActionTrigger has \\\"AdminAction\\\" and Action has 'Quarantine release'\\r\\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, ['Quarantine Releases'] = coalesce(Count, 0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Quarantine Releases\",\"color\":\"blueDark\"}]}},\"customWidth\":\"100\",\"name\":\"quarantine - release trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"3625d1f1-f34a-4cbf-a78f-eb2e5506bad4\"},{\"type\":1,\"content\":{\"json\":\"### Quarantine Release Percentage<br>\\r\\n\\r\\n**Calculates the percentage of quarantined emails that were successfully released compared to the total quarantined messages. This metric helps measure engagement with quarantine and assess the effectiveness of quarantine policies.**\"},\"customWidth\":\"40\",\"name\":\"quarantine - release-pct heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"e3a9502c-9030-4621-b248-55cdf69f81ae\"},{\"type\":1,\"content\":{\"json\":\"### Quarantine Release Analysis by Detection Type<br>\\r\\n\\r\\n**For each detection technology, this shows the share of its quarantined emails that were later released from quarantine (Release % = released / quarantined). A high release rate flags a detector that may be over-flagging legitimate mail - a strong candidate for policy or rule tuning. The Released count shows the volume behind each rate.**\"},\"customWidth\":\"60\",\"name\":\"quarantine - release-by-detection heading\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"976fc90f-bf46-4315-b05e-4e501b37b869\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\\r\\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\\r\\n| where Action == \\\"Quarantine release\\\"\\r\\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \\\"Quarantine\\\") on NetworkMessageId\\r\\n| summarize count());\\r\\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \\\"Quarantine\\\"\\r\\n| summarize count());\\r\\nprint\\r\\nQuarantine_Releases = toreal(Quarantine_Releases),\\r\\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\\r\\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))\",\"size\":0,\"showAnalytics\":true,\"title\":\" \",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Release_Percentage\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}},\"showBorder\":true,\"sortCriteriaField\":\"Release_Percentage\",\"size\":\"auto\"},\"statSettings\":{\"valueField\":\"Release_Percentage\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"thresholds\",\"mode\":\"foreground\",\"heatmapPalette\":\"greenRed\",\"thresholdsGrid\":[{\"operator\":\"<\",\"thresholdValue\":\"5\",\"representation\":\"green\"},{\"operator\":\">\",\"thresholdValue\":\"5\",\"representation\":\"redDark\"}]},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}},\"tagText\":\"Quarantine Release Percentage\",\"valueFontStyle\":\"mega\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"40\",\"name\":\"quarantine - release-pct stat\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"64e157ce-2f6a-423f-9ce5-eade8b6f41d5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Per detection technology: the share of its quarantined emails that were later released from quarantine.\\r\\n//Release % = released / quarantined for that detection technology - a high rate flags a detector that may be over-flagging legitimate mail (potential false positives). Detectors with fewer than 10 quarantined emails are excluded so the rate is statistically meaningful.\\r\\nEmailEvents\\r\\n| where DeliveryLocation == \\\"Quarantine\\\"\\r\\n| extend MDO_detection = parse_json(DetectionMethods)\\r\\n| extend FirstDetection = iif(isempty(MDO_detection), \\\"Clean\\\", tostring(bag_keys(MDO_detection)[0]))\\r\\n| extend FirstSubcategory = iif(FirstDetection != \\\"Clean\\\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \\\": \\\", tostring(MDO_detection[FirstDetection][0])), \\\"No Detection (clean)\\\")\\r\\n| where FirstSubcategory contains \\\"Malware\\\" or FirstSubcategory contains \\\"Phish\\\" or FirstSubcategory contains \\\"Spam\\\"\\r\\n| join kind=leftouter (\\r\\n    EmailPostDeliveryEvents\\r\\n    | where Action == \\\"Quarantine release\\\"\\r\\n    | distinct NetworkMessageId\\r\\n    | extend ReleasedFlag = \\\"yes\\\"\\r\\n  ) on NetworkMessageId\\r\\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \\\"yes\\\") by FirstSubcategory\\r\\n| where Quarantined >= 10 and Released > 0\\r\\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\\r\\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\\r\\n| order by ['Release %'] desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Quarantined Emails\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Released\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Release %\",\"formatter\":4,\"formatOptions\":{\"palette\":\"red\",\"min\":0,\"max\":20,\"customColumnWidthSetting\":\"90px\"},\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"60\",\"name\":\"quarantine - release-by-detection pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"9a6d21b7-7542-4ae5-8f3f-b18474b52a20\"},{\"type\":1,\"content\":{\"json\":\"### Malware Email Quarantine Analysis<br>\\r\\n\\r\\n**These visuals break down quarantined malware emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple malware detection techniques including file detonation, file reputation analysis, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-malware policies and identify emerging malware tactics.<br>The line chart shows per-{Granularity} trends across all malware detection methods, while the table provides an overall distribution of detection reasons.**\"},\"name\":\"quarantine - malware heading\",\"id\":\"59f84161-a010-44c2-aec1-b72ed98ccdff\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of malware emails that are quarantined, summarized daily by the detection method\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has \\\"Malware\\\" and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Malware to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"quarantine - malware trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"a54a8daf-0be2-4c0e-a8d7-4ff0e0879fd2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of malware emails that are quarantined, summarized by the detection method\\r\\n//(QA 2026-07-14) mv-expand over DetectionMethods.Malware (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has 'Malware' and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)\\r\\n| where isnotempty(Malware)\\r\\n| summarize count() by Malware\\r\\n| sort by count_ desc\\r\\n| project ['Detection Technology']=Malware, ['Detections']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"quarantine - malware table\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"b5d0d022-cf41-47e5-ae06-cf2176b47758\"},{\"type\":1,\"content\":{\"json\":\"### Phishing Email Quarantine Analysis<br>\\r\\n\\r\\n**These visuals break down quarantined phishing emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple phishing detection techniques including impersonation protection, URL detonation, spoof detection, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-phishing policies and identify emerging phishing tactics.<br>The line chart shows per-{Granularity} trends across all phishing detection methods, while the table provides an overall distribution of detection reasons.**\"},\"name\":\"quarantine - phish heading\",\"id\":\"aca50104-cb68-4a8f-82ee-ea8eee25fe14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of phish emails that are quarantined, summarized daily by the detection method\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailEvents\\r\\n| where DetectionMethods has \\\"Phish\\\" and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"quarantine - phish trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"57151360-0577-45ce-8fc6-10a3790865ce\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of phish emails that are quarantined, summarized by the detection method\\r\\n//(QA 2026-07-14) mv-expand over DetectionMethods.Phish (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has 'Phish' and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\\r\\n| where isnotempty(Phish)\\r\\n| summarize count() by Phish\\r\\n| sort by count_ desc\\r\\n| project ['Detection Technology']=Phish, ['Detections']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"quarantine - phish pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"df78c64b-76f6-4980-80df-d0d432e780a5\"},{\"type\":1,\"content\":{\"json\":\"### Spam Email Quarantine Analysis<br>\\r\\n\\r\\n**These visuals provide detailed insights into quarantined spam emails categorized by detection methods. Spam detection technologies include advanced filters, general filters, bulk email filtering, reputation-based systems (IP, domain, URL), and mixed analysis detection. Analyzing spam quarantine patterns helps fine-tune spam filtering policies to balance security with user productivity and reduce false positives.<br>The line chart displays per-{Granularity} trends for each spam detection method, while the table shows the overall distribution.**\"},\"name\":\"quarantine - spam heading\",\"id\":\"e131910f-0233-474a-a9b8-9f70a49246cf\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the ammount of spam emails that are quarantined, summarized daily by the detection method\\r\\nlet gran = {Granularity};\\r\\nlet baseQuery = EmailEvents\\r\\n| where DetectionMethods has \\\"Spam\\\" and DeliveryLocation == \\\"Quarantine\\\";\\r\\nlet agg = materialize(baseQuery\\r\\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Details)\\r\\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\\r\\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\\r\\n| join kind=leftouter (agg) on Timestamp, Details\\r\\n| project Timestamp, Details, Count = coalesce(Count, 0)\\r\\n| sort by Details asc, Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"100\",\"name\":\"quarantine - spam trend\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"5762bcc7-bbda-4a3d-91cf-de18fbdd2775\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the total ammount of spam emails that are quarantined, summarized by the detection method\\r\\n//(QA 2026-07-14) mv-expand over DetectionMethods.Spam (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and DetectionMethods has 'Spam' and DeliveryLocation == \\\"Quarantine\\\"\\r\\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\\r\\n| where isnotempty(Spam)\\r\\n| summarize count() by Spam\\r\\n| sort by count_ desc\\r\\n| project ['Detection Technology']=Spam, ['Detections']=count_\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Detections\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"30ch\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"filter\":true}},\"customWidth\":\"100\",\"name\":\"quarantine - spam pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"2995f55b-17f9-458b-8630-e0370d14522a\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"11\"},\"name\":\"quarantine - group\",\"id\":\"430294af-c68f-4427-8b55-d552a3d89d42\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"# Security Operations Center (SOC) Insights \\r\\n\\r\\n---\\r\\n\\r\\nThis tab provides a view for security operations. Combines incident response metrics with investigation insights to evaluate the effectiveness of both automated systems and manual interventions.\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"13\"},\"name\":\"soc - tab description\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"fd65243c-514c-4813-978f-fb908226d049\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Security Incident Response Metrics\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Operational efficiency insights.** Tracks incident volume, resolution speed, automation efficacy, and classification accuracy to evaluate SOC performance.<br><br>**Recommended action:** Track mean time to close by severity against your SLA and investigate any severity trending upward.\"},\"name\":\"soc - incident-metrics section header\",\"id\":\"f92c3e24-3e0f-4f4c-8ee9-3ec60832f7b1\"},{\"type\":1,\"content\":{\"json\":\"### Email Security Incidents<br>\\r\\n\\r\\n**These visuals display the per-{Granularity} trend of email-related security incidents, as well as the proportion of email incidents compared to the total number of incidents in Defender.**\"},\"name\":\"soc - email-incidents heading\",\"id\":\"c1cf6796-6071-4d2e-bf2c-c5e8d2a99a12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Filter for incidents that have at least one Email Security alert\\r\\nlet gran = {Granularity};\\r\\nlet OfficeEmailAlerts = SecurityAlert\\r\\n    | where ProductName contains \\\"Office 365 Advanced Threat Protection\\\" or ProductName contains \\\"Microsoft 365 Defender\\\"\\r\\n    | project SystemAlertId;\\r\\nlet agg = materialize(SecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| mv-expand AlertIds\\r\\n| where isnotempty(AlertIds) and not(Title startswith \\\"CC_\\\")\\r\\n| extend AlertId = tostring(AlertIds) \\r\\n| join kind=inner\\r\\n    (OfficeEmailAlerts | extend SystemAlertId = tostring(SystemAlertId))\\r\\n    on $left.AlertId == $right.SystemAlertId\\r\\n| summarize arg_max(TimeGenerated, *), AlertCount = dcount(AlertId) by IncidentNumber\\r\\n| summarize Incidents_Number = count() by TimeGenerated = bin(TimeGenerated, gran));\\r\\nrange TimeGenerated from toscalar(agg | summarize min(TimeGenerated)) to toscalar(agg | summarize max(TimeGenerated)) step gran\\r\\n| join kind=leftouter (agg) on TimeGenerated\\r\\n| project TimeGenerated, ['Email Security Incidents'] = coalesce(Incidents_Number, 0)\\r\\n| sort by TimeGenerated asc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Email Security Incidents\",\"color\":\"blueDark\"}]}},\"customWidth\":\"75\",\"name\":\"soc - email-incidents trend\",\"id\":\"e23cfcda-1017-4fd0-ac71-8a861c450f71\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Categorize incidents: Email Security vs Other\\r\\nlet AllAlerts = SecurityAlert\\r\\n    | extend SystemAlertId = tostring(SystemAlertId)\\r\\n    | project SystemAlertId, ProductName;\\r\\nSecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| mv-expand AlertIds\\r\\n| where isnotempty(AlertIds) and not(Title startswith \\\"CC_\\\")\\r\\n| extend AlertId = tostring(AlertIds)\\r\\n| join kind=inner\\r\\n    (AllAlerts)\\r\\n    on $left.AlertId == $right.SystemAlertId\\r\\n| summarize AlertSystems = make_set(ProductName) by IncidentNumber\\r\\n| extend HasEmailSecurity = \\r\\n    AlertSystems has \\\"Office 365 Advanced Threat Protection\\\" or \\r\\n    AlertSystems has \\\"Microsoft 365 Defender\\\"\\r\\n| extend Category = iff(HasEmailSecurity, \\\"Email Security\\\", \\\"Other\\\")\\r\\n| summarize IncidentCount = count() by Category\\r\\n\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"soc - incident-category pie\",\"id\":\"baae2150-1b04-43b4-9713-48fd3cc6247f\"},{\"type\":1,\"content\":{\"json\":\"### Average Incident Time To Close (minutes)\\r\\n**This visual displays the average time, in minutes, to close email-related security incidents (per {Granularity}), split by severity, so you can see how resolution speed changes over time. Reference SLA targets: High 60, Medium 120, Low 240, Informational 480 minutes.**\"},\"name\":\"soc - time-to-close heading\",\"id\":\"e23ccc6c-b0f0-407b-8e01-d8b69c40a745\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// SLA thresholds by severity for email-security (MDO) incidents\\r\\nlet SLA_Variables = datatable (Severity:string, TimeToResolve:int) [\\r\\n    \\\"High\\\", 60,\\r\\n    \\\"Medium\\\", 120,\\r\\n    \\\"Low\\\", 240,\\r\\n    \\\"Informational\\\", 480\\r\\n];\\r\\n\\r\\n// Identify MDO-related incidents via alert correlation\\r\\nlet EmailSecurityIncidents = \\r\\n    SecurityIncident\\r\\n    | mv-expand AlertIds\\r\\n    | where isnotempty(AlertIds)\\r\\n    | extend AlertId = tostring(AlertIds)\\r\\n    | join kind=inner (\\r\\n        SecurityAlert\\r\\n        | where ProductName in (\\\"Office 365 Advanced Threat Protection\\\", \\\"Microsoft 365 Defender\\\")\\r\\n        | extend AlertId = tostring(SystemAlertId)\\r\\n        | project AlertId\\r\\n    ) on AlertId\\r\\n    | distinct ProviderIncidentId;\\r\\n\\r\\n// Get latest incident state for each MDO-related incident\\r\\nlet LatestMdoIncidents =\\r\\n    SecurityIncident\\r\\n    | summarize arg_max(TimeGenerated, Classification, Status, Severity, CreatedTime, ClosedTime, Title) by ProviderIncidentId\\r\\n    | where ProviderIncidentId in (EmailSecurityIncidents)\\r\\n    | where not(Title startswith \\\"CC_\\\");  // Exclude non-email incidents as needed\\r\\n\\r\\nLatestMdoIncidents\\r\\n| where Status == \\\"Closed\\\"\\r\\n| extend TimeToResolveIncident = datetime_diff('minute', ClosedTime, CreatedTime)\\r\\n| join kind=inner SLA_Variables on Severity\\r\\n| summarize\\r\\n    ['Avg Time to Close (min)'] = avg(TimeToResolveIncident),\\r\\n    CountIncidents = count(), Breached = countif(TimeToResolveIncident > TimeToResolve)\\r\\n    by Day = bin(ClosedTime, 1d), Severity\\r\\n| order by Day asc, Severity asc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"chartSettings\":{\"xAxis\":\"Day\",\"yAxis\":[\"Avg Time to Close (min)\"],\"group\":\"Severity\"}},\"name\":\"soc - sla-by-severity trend\",\"id\":\"3f7d1f17-8d2f-4a1b-a97e-17973812ca6f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Closed Incident Classification (True Positive vs False Positive)\\r\\n\\r\\nThis visual shows the distribution of closed email-related incidents classified as True Positive versus False Positive. It helps assess detection accuracy and provides insight into validation trends.\"},\"customWidth\":\"33.3\",\"name\":\"soc - classification heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"48db10ce-8246-4f5e-8b68-f618d9c7f77c\"},{\"type\":1,\"content\":{\"json\":\"### True Positive Incident Classification Rate\\r\\n\\r\\nThis visual displays the percentage of email-related incidents confirmed as True Positive. It offers a clear measure of classification accuracy and highlights changes in detection effectiveness over time.\"},\"customWidth\":\"33.3\",\"name\":\"soc - tp-rate heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"34a84dbf-609a-407f-afef-f1592eb4a92b\"},{\"type\":1,\"content\":{\"json\":\"### Incidents Automated vs Manual Closure\\r\\n\\r\\nThis visual illustrates the proportion of email-related incidents closed automatically versus manually. It provides visibility into operational efficiency and the impact of automation on incident resolution.\\r\\n<br> ⚠️ *You will have to review the underlying query and add any automation system specific to your organization.*\"},\"customWidth\":\"33.3\",\"name\":\"soc - auto-vs-manual-closure heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"a1fd9136-7a12-4d80-b3e1-e2704a84f734\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Build a list of MDO-related incidents by cross-referencing SecurityAlert\\r\\nlet EmailSecurityIncidents = SecurityIncident\\r\\n    | mv-expand AlertIds\\r\\n    | where isnotempty(AlertIds)\\r\\n    | extend AlertId = tostring(AlertIds)\\r\\n    | join kind=inner (\\r\\n        SecurityAlert\\r\\n        | where ProductName in (\\\"Office 365 Advanced Threat Protection\\\", \\\"Microsoft 365 Defender\\\")\\r\\n        | extend AlertId = tostring(SystemAlertId)\\r\\n        | project AlertId\\r\\n    ) on AlertId\\r\\n    | distinct ProviderIncidentId;\\r\\n\\r\\n// Get only the most recent state of each incident, ensuring it's MDO-related\\r\\nlet LatestIncidents = SecurityIncident\\r\\n    | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\\r\\n    | where ProviderIncidentId in (EmailSecurityIncidents)\\r\\n    | where not(Title startswith \\\"CC_\\\");  // Exclude incidents unrelated to MDO (e.g., DSPM)\\r\\n\\r\\nLatestIncidents\\r\\n| where Status == 'Closed'                                     // (Optional) Limit to closed/fully classified incidents\\r\\n| summarize Count = count() by Classification = iif(\\r\\n    isnull(Classification) or trim(\\\" \\\", Classification) == \\\"\\\",\\r\\n    \\\"Not Set\\\", \\r\\n    Classification\\r\\n  )\\r\\n| order by Count desc\",\"size\":3,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33.3\",\"name\":\"soc - classification pie\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"cfa5b7c5-50cc-4b3b-8bba-1a93c57bff43\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Identify MDO-related SecurityIncident IDs via alert correlation\\r\\nlet EmailSecurityIncidents = \\r\\n    SecurityIncident\\r\\n    | mv-expand AlertIds\\r\\n    | where isnotempty(AlertIds)\\r\\n    | extend AlertId = tostring(AlertIds)\\r\\n    | join kind=inner (\\r\\n        SecurityAlert\\r\\n        | where ProductName in (\\\"Office 365 Advanced Threat Protection\\\", \\\"Microsoft 365 Defender\\\")\\r\\n        | extend AlertId = tostring(SystemAlertId)\\r\\n        | project AlertId\\r\\n    ) on AlertId\\r\\n    | distinct ProviderIncidentId;\\r\\n\\r\\n// Get latest incident state for MDO-related incidents\\r\\nlet LatestMdoIncidents =\\r\\n    SecurityIncident\\r\\n    | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\\r\\n    | where ProviderIncidentId in (EmailSecurityIncidents)\\r\\n    // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\\r\\n    | where not(IncidentName startswith \\\"CC_\\\");\\r\\n\\r\\n// Compute true positive rate among closed MDO incidents\\r\\nLatestMdoIncidents\\r\\n| where Status == \\\"Closed\\\"\\r\\n| summarize\\r\\n    TruePositiveCount = countif(Classification == \\\"TruePositive\\\"),\\r\\n    TotalClosed       = count()\\r\\n| extend TruePositiveRate = iff(\\r\\n    TotalClosed > 0,\\r\\n    TruePositiveCount * 100.0 / TotalClosed,\\r\\n    real(null)\\r\\n)\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"stat\",\"statSettings\":{\"valueField\":\"TruePositiveRate\",\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"numberFormatSettings\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}},\"tagText\":\"True Positive Rate\",\"valueFontStyle\":\"xxLarge\",\"tagTextPosition\":\"bottom\"}},\"customWidth\":\"33.3\",\"name\":\"soc - tp-rate stat\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"eca235aa-38aa-46dd-a569-74dd8f83b2f0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\\r\\n//Add strings for your automations if you rely on any other application/system\\r\\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\\r\\n\\r\\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\\r\\nlet EmailSecurityIncidents = SecurityIncident\\r\\n    | mv-expand AlertIds\\r\\n    | where isnotempty(AlertIds)\\r\\n    | extend AlertId = tostring(AlertIds)\\r\\n    | join kind=inner (\\r\\n        SecurityAlert\\r\\n        | where ProductName in (\\\"Office 365 Advanced Threat Protection\\\", \\\"Microsoft 365 Defender\\\")\\r\\n        | extend AlertId = tostring(SystemAlertId)\\r\\n        | project AlertId\\r\\n    ) on AlertId\\r\\n    | distinct ProviderIncidentId;\\r\\n\\r\\n// Get latest status of each incident and count closed incidents by who closed them\\r\\nSecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\\r\\n| where ProviderIncidentId in (EmailSecurityIncidents)\\r\\n| where Status == 'Closed'\\r\\n| where not(Title startswith \\\"CC_\\\")          // Exclude non-MDO incidents from DSPM policies\\r\\n| extend ClosedBy = iff(                       // Add strings for your automation systems\\r\\n        tolower(ModifiedBy) has_any (\\\"system\\\",\\\"azure\\\",\\\"automation\\\",\\\"playbook\\\",\\\"microsoft xdr\\\",\\\"microsoft defender xdr\\\",\\\"created from alert\\\"),\\r\\n        \\\"Automated\\\",\\r\\n        \\\"Human\\\"\\r\\n    )\\r\\n| summarize ClosedCount = count() by ClosedBy\",\"size\":3,\"showAnalytics\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33.3\",\"name\":\"soc - closure pie\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"a4bc160f-1ba6-4779-86cd-ef44422f1e29\"}]},\"name\":\"soc - incident-insights group\",\"id\":\"3083ac4d-0bdd-4db7-a5f0-0d41cb67a4eb\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"13\"},\"name\":\"soc - incident-metrics group\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"18ff8970-e5f6-4c51-918a-aa693a45d18f\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Investigation & Response Actions\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Remediation efficacy analysis.** Compares automated (AIR) and manual admin actions to evaluate response times and investigation outcomes.\\r\\n<br><br>**Recommended action:** Reduce AIR pending-action latency by reviewing why approvals take long, and increase automation where it is safe to do so.\"},\"name\":\"soc - air section header\",\"id\":\"5e0b06c8-7774-4eb4-8b7f-572b3732de84\"},{\"type\":1,\"content\":{\"json\":\"### Automated Investigation and Response (AIR) Actions (per {Granularity})\\r\\n\\r\\nThis visual shows the per-{Granularity} trend of Automated Investigation and Response (AIR) actions, including the number of successful and failed attempts (because of prior remediation).\"},\"customWidth\":\"100\",\"name\":\"soc - air-actions heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"05f14dec-e76c-413c-83a0-31a05dce65e7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query attempts to show AIR Efficiency Over Time by displaying the number of successes and failures over time\\r\\nEmailPostDeliveryEvents\\r\\n| where ActionType =~ \\\"Automated Remediation\\\"\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Count = count() by bin(Timestamp, {Granularity}), ActionResult\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"AlertId\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"Timestamp\"}},\"customWidth\":\"100\",\"name\":\"soc - air-efficiency trend\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"ae2a1850-5b7e-49f7-bac4-d888053ab49b\"},{\"type\":1,\"content\":{\"json\":\"### Automated Investigation and Response (AIR) Response Time After Email Delivery (per {Granularity})\\r\\n\\r\\nThis visual displays the average (per {Granularity}), 80th percentile (p80), 90th percentile (p90) and 99th percentile (p99) time needed, measured in minutes, from email delivery to AIR action. It serves as a SOC metric to monitor responsiveness (security team members reviewing and manually approving AIR Pending Actions) and identify potential latency in automated incident handling. If the latency is high focus on reviewing why reviwing AIR Pending Actions takes longer time for admins and consider <a href='https://learn.microsoft.com/en-us/defender-office-365/air-auto-remediation#configure-automated-remediation'>auto-aproval of URL, Files and Email clusters. </a>\\r\\n\"},\"customWidth\":\"100\",\"name\":\"soc - air-response-time heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"98c66d9e-efdf-40fc-b8b0-be35d7fd97a9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// SOC metric: Daily average/p75 delay (in minutes) from email delivery to AIR action\\r\\nlet deliveries = EmailEvents\\r\\n  | where DeliveryAction == \\\"Delivered\\\"// delivered emails\\r\\n  | extend MsgKey = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n  | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\\r\\nlet remediations = EmailPostDeliveryEvents\\r\\n  | where ActionType =~ \\\"Automated Remediation\\\"// automated remediation events\\r\\n  | extend MsgKey = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n  | summarize FirstRemediation = min(Timestamp) by MsgKey;\\r\\ndeliveries\\r\\n| join kind=inner remediations on MsgKey\\r\\n| extend DelayMinutes = datetime_diff(\\\"minute\\\", FirstRemediation, FirstDelivery)\\r\\n| where DelayMinutes >= 0\\r\\n| summarize ['Avg (min)'] = avg(DelayMinutes),\\r\\n            ['P80 (min)'] = percentile(DelayMinutes, 80),\\r\\n            ['P90 (min)'] = percentile(DelayMinutes, 90),\\r\\n            ['P99 (min)'] = percentile(DelayMinutes, 99),\\r\\n            CountEmails = count()\\r\\n   by bin(FirstRemediation, 1d) \",\"size\":0,\"aggregation\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"FirstRemediation\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"FirstRemediation\",\"sortOrder\":1}],\"chartSettings\":{\"xAxis\":\"FirstRemediation\",\"yAxis\":[\"P99 (min)\",\"P90 (min)\",\"P80 (min)\",\"Avg (min)\"],\"showLegend\":true}},\"customWidth\":\"100\",\"name\":\"soc - air-latency area\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"900383f1-6443-4d50-b15d-26e4ac11b255\"},{\"type\":1,\"content\":{\"json\":\"### Automated Investigation and Response (AIR) Investigation Results Trend\\r\\n\\r\\nThis visual displays the per-{Granularity} trend of AIR investigation outcomes, categorized as **Threat Detected** or **Clean**. It helps track the effectiveness of automated investigations over time and highlights patterns in threat detection.\"},\"customWidth\":\"67\",\"name\":\"soc - air-outcomes heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"d1cabfbe-6040-4b6e-9ce5-f48e9973dfc9\"},{\"type\":1,\"content\":{\"json\":\"### Investigation Actions Taken: Automated Investigation and Response (AIR) vs Manual (Human)\\r\\n\\r\\nThis visual shows whether actions taken after an Automated Investigation and Response (AIR) required manual approval by an administrator or were executed automatically. It provides insight into the level of automation versus human intervention in post-investigation remediation.\"},\"customWidth\":\"33\",\"name\":\"soc - air-auto-vs-manual heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"2f98514b-0172-4c4e-ba25-9a5e4138c570\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// AIR investigation outcomes by day: ThreatDetected vs. Clean\\r\\n\\r\\n// Step 1: Deduplicate automated remediation events by message and recipient\\r\\nlet AutoRemediations = \\r\\n    EmailPostDeliveryEvents\\r\\n    | where ActionType == \\\"Automated Remediation\\\"\\r\\n    | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\\r\\n    | project NetworkMessageId, RecipientEmailAddress, Timestamp;\\r\\n\\r\\n// Step 2: Derive threat verdicts using AlertEvidence\\r\\nlet EvidenceVerdicts =\\r\\n    AlertEvidence\\r\\n    | where EntityType in (\\\"MailMessage\\\", \\\"MailCluster\\\")\\r\\n    | extend extra = todynamic(AdditionalFields)\\r\\n    // If this is a mail cluster, use provided NetworkMessageIds array; otherwise wrap NetworkMessageId as a single-item array\\r\\n    | extend networkIds = iff(\\r\\n      isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\\r\\n      pack_array(NetworkMessageId),          // create a single-element array using pack_array\\r\\n      extra.NetworkMessageIds                // use the array as-is if it exists\\r\\n    )\\r\\n    | mv-expand nmID = networkIds                // expand to individual message IDs\\r\\n    // Derive verdict from LastVerdict, ThreatAnalysisSummary, and ThreatIntelligence\\r\\n    | extend \\r\\n        lastVerdict = tolower(tostring(extra.LastVerdict)),\\r\\n        threatAIList = extra.ThreatAnalysisSummary,\\r\\n        threatInt   = extra.ThreatIntelligence\\r\\n    | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \\\"\\\"),\\r\\n             verdictTI          = iff(array_length(threatInt) > 0, \\\"malicious\\\", \\\"\\\")   // any item in ThreatIntelligence indicates malicious\\r\\n    // Mark as threat-detected if verdict is malicious/suspicious or threat evidence is present\\r\\n    | extend ThreatDetectedFlag = \\r\\n        case(\\r\\n            lastVerdict in (\\\"malicious\\\",\\\"suspicious\\\") or verdictFromAnalysis in (\\\"malicious\\\",\\\"suspicious\\\")\\r\\n                or verdictTI == \\\"malicious\\\",\\r\\n            true,\\r\\n            false\\r\\n        )\\r\\n    // Weight mail clusters by MailCount; default to 1 for single messages\\r\\n    | extend MailCountInt = toint(extra.MailCount)\\r\\n    | extend Weight = iff(EntityType == \\\"MailCluster\\\", \\r\\n                        coalesce(MailCountInt, 1), // default to 1 if MailCount is missing\\r\\n                        1)\\r\\n    | summarize IsThreatDetected = any(ThreatDetectedFlag), \\r\\n                WeightSum       = sum(Weight) \\r\\n    by nmID = tostring(nmID);\\r\\n\\r\\n// Step 3: Join remediation events with verdicts and aggregate by day\\r\\nAutoRemediations\\r\\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\\r\\n| extend isThreat      = coalesce(IsThreatDetected, false), \\r\\n         effectiveWeight= coalesce(WeightSum, 1)\\r\\n| extend InvestigationOutcome = iif(isThreat, \\\"Threat Detected\\\", \\\"Clean\\\")\\r\\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, {Granularity}), InvestigationOutcome\\r\\n| order by Day asc, InvestigationOutcome asc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"customWidth\":\"67\",\"name\":\"soc - air-outcomes trend\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"18552ccb-d8d4-45c4-a3cf-072203df9325\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\\r\\nEmailPostDeliveryEvents\\r\\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| where ActionType == \\\"Automated Remediation\\\"\\r\\n| summarize count() by ActionTrigger\",\"size\":3,\"showAnalytics\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"soc - air-auto-vs-manual pie\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\"},\"id\":\"03bc6e3c-05de-426d-91d8-b48a36b4ea74\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Post-Delivery Actions by Admin\\r\\n\\r\\nThis visual displays the number (per {Granularity}) of emails where an administrator performed a post-delivery action. Actions are summarized by type, including **Soft Delete**, **Hard Delete**, **Moved to Junk Folder**, **Moved to Inbox**, and **Quarantine Release**, providing insight into manual intervention trends after email delivery.\"},\"name\":\"soc - post-delivery-by-admin heading\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"a0961ca9-da58-49c4-9a1c-873c5569bed9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query visualises the daily ammount of emails that had an admin post delivery action, summarizing the data by action type\\r\\nlet gran = {Granularity};\\r\\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\\r\\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\\r\\nlet agg = materialize(EmailPostDeliveryEvents\\r\\n| where ActionTrigger has \\\"AdminAction\\\"\\r\\n| summarize [\\\"Soft Delete\\\"]=countif(Action has 'Soft Delete'), [\\\"Hard Delete\\\"]=countif(Action has 'Hard Delete'), [\\\"Moved to junk folder\\\"]=countif(Action has 'Moved to junk folder'), [\\\"Moved to inbox\\\"]=countif(Action has 'Moved to inbox'), [\\\"Quarantine release\\\"]=countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\\r\\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\\r\\n| join kind=leftouter (agg) on Timestamp\\r\\n| project Timestamp, [\\\"Soft Delete\\\"]=coalesce([\\\"Soft Delete\\\"],0), [\\\"Hard Delete\\\"]=coalesce([\\\"Hard Delete\\\"],0), [\\\"Moved to junk folder\\\"]=coalesce([\\\"Moved to junk folder\\\"],0), [\\\"Moved to inbox\\\"]=coalesce([\\\"Moved to inbox\\\"],0), [\\\"Quarantine release\\\"]=coalesce([\\\"Quarantine release\\\"],0)\\r\\n| sort by Timestamp asc\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\"},\"name\":\"soc - post-delivery-by-admin trend\",\"styleSettings\":{\"margin\":\"10px\"},\"id\":\"d2ea8eac-a3db-46b0-bcb4-3abbb95ba4ad\"}]},\"customWidth\":\"100\",\"name\":\"soc - post-delivery group\",\"id\":\"ebca14d5-954d-4e35-a225-cb0f8a3ea81b\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"13\"},\"name\":\"soc - air group\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"0a05394d-f813-4408-ac4d-8f481ae34c0b\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Top Malicious Email Campaigns (Clustered)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Groups malicious inbound emails into campaigns (attack waves) using the Email Cluster ID assigned by Microsoft Defender for Office 365, showing one row per campaign with the message count, distinct recipients, sender domains, threat mix and sample subjects. Helps the SOC understand the scale and shape of coordinated attacks rather than viewing individual messages in isolation.**<br><br>**Recommended action:** Pivot on the top campaign clusters to hunt related messages and consider blocking shared sender infrastructure.\"},\"name\":\"soc - campaigns heading\",\"id\":\"d3a9e4c6-1b5f-4c8d-ae34-9f7a1b2c3d45\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Largest malicious inbound email campaigns clustered by EmailClusterId - one row per attack wave (messages, recipients, URL clicks, sender domains, threat mix, sample subjects).\\r\\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\\r\\nlet clicksByCluster = UrlClickEvents\\r\\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\\r\\n| summarize UrlClicks = count() by EmailClusterId;\\r\\nlet qrClusters = EmailUrlInfo\\r\\n| where UrlLocation == \\\"QRCode\\\"\\r\\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\\r\\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and EmailClusterId > 0\\r\\n| where OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Messages = count(),\\r\\n            Recipients = dcount(RecipientEmailAddress),\\r\\n            SenderDomains = dcount(SenderFromDomain),\\r\\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\\r\\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\\r\\n            SampleSubjects = make_set(Subject, 5),\\r\\n            FirstSeen = min(Timestamp),\\r\\n            LastSeen = max(Timestamp)\\r\\n        by EmailClusterId\\r\\n| join kind=leftouter (clicksByCluster) on EmailClusterId\\r\\n| extend UrlClicks = coalesce(UrlClicks, 0)\\r\\n| join kind=leftouter (qrClusters) on EmailClusterId\\r\\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \\\"QR code\\\", \\\"\\\")\\r\\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \\\", \\\"), \\\", \\\"), dynamic([])))\\r\\n| top 20 by Messages\\r\\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['URL Clicks']=UrlClicks, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":0,\"title\":\"\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Recipients\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"URL Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"name\":\"soc - campaigns table\",\"id\":\"a2a391e1-0e26-4e0e-a8d3-26e3c7132079\"},{\"type\":1,\"content\":{\"json\":\"<table style=\\\"width:100%; border-collapse:collapse; border:none;background-color:#003366;\\\">\\r\\n<tr>\\r\\n<td style=\\\"text-align:left; border:none; font-size:20px; font-weight:bold;color:white;width:1%\\\">Most-Clicked Email Campaigns (Recipient Engagement)\\r\\n</td>\\r\\n</tr>\\r\\n</table>\\r\\n\\r\\n**Ranks malicious inbound campaigns by recipient URL clicks, surfacing the attack waves that reached a mailbox and drew engagement regardless of raw message volume. The highest-volume campaigns are usually quarantined before delivery, so the clusters that draw clicks are often smaller, targeted waves. A non-zero URL Clicks count means a recipient opened a URL within the campaign's messages. Because attackers often mix legitimate URLs with malicious ones to build credibility, and a per-URL threat verdict is not available here, treat these as clicks on potentially malicious URLs that warrant review rather than confirmed malicious clicks.**<br><br>**Recommended action:** Focus on these clusters for user follow-up (awareness and, where credentials may be exposed, password reset) and hunt for related messages sharing sender infrastructure.\"},\"name\":\"soc - mostclicked heading\",\"id\":\"e9e41b47-0434-42e5-8b04-4170ab061b81\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Malicious inbound campaigns ranked by recipient URL clicks - the attack waves that reached a mailbox and drew engagement, regardless of message volume.\\r\\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\\r\\nlet clicksByCluster = UrlClickEvents\\r\\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\\r\\n| summarize UrlClicks = count() by EmailClusterId;\\r\\nlet qrClusters = EmailUrlInfo\\r\\n| where UrlLocation == \\\"QRCode\\\"\\r\\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\\r\\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\\r\\nEmailEvents\\r\\n| where EmailDirection == \\\"Inbound\\\" and isnotempty(ThreatTypes) and EmailClusterId > 0\\r\\n| where OrgLevelPolicy !in (\\\"Phishing simulation\\\", \\\"SecOps Mailbox\\\")\\r\\n| extend Key = strcat(NetworkMessageId, \\\"-\\\", RecipientEmailAddress)\\r\\n| summarize arg_max(Timestamp, *) by Key\\r\\n| summarize Messages = count(),\\r\\n            Recipients = dcount(RecipientEmailAddress),\\r\\n            SenderDomains = dcount(SenderFromDomain),\\r\\n            SampleSenderDomains = make_set(SenderFromDomain, 5),\\r\\n            ThreatTypesRaw = make_set(ThreatTypes, 50),\\r\\n            SampleSubjects = make_set(Subject, 5),\\r\\n            FirstSeen = min(Timestamp),\\r\\n            LastSeen = max(Timestamp)\\r\\n        by EmailClusterId\\r\\n| join kind=inner (clicksByCluster) on EmailClusterId\\r\\n| where UrlClicks > 0\\r\\n| join kind=leftouter (qrClusters) on EmailClusterId\\r\\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \\\"QR code\\\", \\\"\\\")\\r\\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \\\", \\\"), \\\", \\\"), dynamic([])))\\r\\n| top 20 by UrlClicks\\r\\n| project ['Email Cluster ID']=EmailClusterId, ['URL Clicks']=UrlClicks, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\",\"size\":0,\"title\":\"\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"URL Clicks\",\"formatter\":3,\"formatOptions\":{\"palette\":\"redDark\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Messages\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}},{\"columnMatch\":\"Recipients\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"130px\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":1}}}]}},\"name\":\"soc - mostclicked table\",\"id\":\"1ffe8f97-ad79-47d9-9598-dd73ee54cd8d\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"13\"},\"name\":\"soc - campaigns group\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"10px\",\"showBorder\":true},\"id\":\"b8f2a1c4-5d6e-4a7b-9c8d-0e1f2a3b4c5d\"}],\"isLocked\":true,\"fromTemplateId\":\"sentinel-MicrosoftDefenderForOffice365detectionsandinsights\"}\r\n",
+                "version": "1.0",
+                "sourceId": "[variables('workspaceResourceId')]",
+                "category": "sentinel"
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
+              "properties": {
+                "description": "@{workbookKey=MicrosoftDefenderForOffice365detectionsandinsights; logoFileName=Azure_Sentinel.svg; description=Gain extensive insight into your organization's Microsoft Defender for Office 365 protection across email and Microsoft Teams by analyzing and correlating events. \nYou can track detections and insights over time including: metrics for phish, spam, and malware, URL and URL click detection details, malicious file detections, Microsoft Teams collaboration protection (impersonation, voice phishing, and malicious URLs and files), post-delivery detections, user and admin submissions, system overrides, and actions taken by security administrators.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=4.0.0; title=Microsoft Defender for Office 365 Detections and Insights; templateRelativePath=MicrosoftDefenderForOffice365detectionsandinsights.json; subtitle=; provider=Microsoft}.description",
+                "parentId": "[variables('workbookId1')]",
+                "contentId": "[variables('_workbookContentId1')]",
+                "kind": "Workbook",
+                "version": "[variables('workbookVersion1')]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                },
+                "dependencies": {
+                  "operator": "AND",
+                  "criteria": [
+                    {
+                      "contentId": "EmailEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "EmailPostDeliveryEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "EmailUrlInfo",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "UrlClickEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "CloudAppEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "MessageEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "MessageUrlInfo",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "MessagePostDeliveryEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "FileMaliciousContentInfo",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "AlertEvidence",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "MicrosoftThreatProtection",
+                      "kind": "DataConnector"
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('_workbookContentId1')]",
+        "contentKind": "Workbook",
+        "displayName": "[parameters('workbook1-name')]",
+        "contentProductId": "[variables('_workbookcontentProductId1')]",
+        "id": "[variables('_workbookcontentProductId1')]",
+        "version": "[variables('workbookVersion1')]"
+      },
+      "condition": "[parameters('DeployWorkbook')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('workbookTemplateSpecName2')]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MicrosoftDefenderForEndPoint Workbook with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('workbookVersion2')]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.Insights/workbooks",
+              "name": "[variables('workbookContentId2')]",
+              "location": "[parameters('workspace-location')]",
+              "kind": "shared",
+              "apiVersion": "2021-08-01",
+              "metadata": {
+                "description": "A wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through M365 Defender Connector."
+              },
+              "properties": {
+                "displayName": "[parameters('workbook2-name')]",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Microsoft Defender for Endpoint (Preview)\\n---\\n\\nA workbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through Microsoft Defender XDR Connector.\\n\\n\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b22a3bd7-19b3-495d-a0df-95a7a59d98ff\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"value\":{\"durationMs\":172800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"f0450560-ef16-4aa9-a3ad-7485dd909587\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"type\":10,\"isRequired\":true,\"jsonData\":\"[{ \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }]\",\"label\":\"Show Help\",\"value\":\"Yes\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":1,\"content\":{\"json\":\"\\r\\n|Overview|Device|Network|File|\\r\\n|--------|------|-------|----|\\r\\n|MDE Tables Last Data Received|Source of the AV detections|Internet Connected Devices|FileActivityCount per Device|\\r\\n|Daily Data Flow on MDE Tables|Get stats on ASR audit events|Count By Machine Group|Count by InitiatingProcessAccountUpn|\\r\\n|Device Heartbeat|Get stats on ASR blocks|Count By Network Adaptor||\\r\\n|Device where files are copied to USB Drive|AV Detections with USB Disk Drive|TimeSeries on Network Activity||\\r\\n|Device Internet Connectivity Status |List files copied to USB mounted drives|Top 10 RemoteUrl accessed over TimeRange||\\r\\n|Device Count by DNS Suffix ||Tor Clients||\\r\\n|Device Microsoft Entra ID Join status ||||\\r\\n|Device ClientVersion ||||\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 8\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"454d4e02-26ba-4195-ae30-94752bbf4603\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"preText\":\"Overview\",\"style\":\"link\"},{\"id\":\"3d902e84-3e5b-4631-85d1-c229ec2abf75\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Device\",\"subTarget\":\"Device\",\"style\":\"link\"},{\"id\":\"bbc20288-b398-4f63-b7a9-e3830213bb34\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Network\",\"subTarget\":\"Network\",\"style\":\"link\"},{\"id\":\"edab4a44-8ca3-4ba1-bede-4186f4376d28\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"File\",\"subTarget\":\"File\",\"style\":\"link\"}]},\"name\":\"links - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union \\r\\nisfuzzy = true\\r\\n(DeviceInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type= \\\"DeviceInfo\\\" | extend Description = \\\"Machine information (including OS information)\\\"),\\r\\n(DeviceNetworkInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceNetworkInfo\\\"  | extend Description = \\\"Network properties of machines\\\"),\\r\\n(DeviceProcessEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceProcessEvents\\\" | extend Description = \\\"Process creation and related events\\\"),\\r\\n(DeviceNetworkEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceNetworkEvents\\\" | extend Description = \\\"Network connection and related events\\\"),\\r\\n(DeviceFileEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceFileEvents\\\" | extend Description = \\\"File creation, modification, and other file system events\\\"),\\r\\n(DeviceRegistryEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceRegistryEvents\\\" | extend Description = \\\"Creation and modification of registry entries\\\"),\\r\\n(DeviceLogonEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceLogonEvents\\\" | extend Description = \\\"Sign-ins and other authentication events\\\"),\\r\\n(DeviceImageLoadEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceImageLoadEvents\\\" | extend Description = \\\"DLL loading events\\\"),\\r\\n(DeviceEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceEvents\\\" | extend Description = \\\"Additional events types\\\"),\\r\\n(DeviceFileCertificateInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\\\"DeviceFileCertificateInfo\\\" | extend Description = \\\"Certificate information of signed files)\\\")\\r\\n| extend [\\\"Last Log Received At (Local Time)\\\"] = TimeGenerated\\r\\n| project Type, Description, [\\\"Last Log Received At (Local Time)\\\"]\",\"size\":0,\"title\":\"MDE Tables Last Data Received based on {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Type\",\"formatter\":0,\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Last Log Received At\",\"formatter\":6,\"dateFormat\":{\"formatName\":\"fullDateTimePattern\"}}],\"filter\":true}},\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\\nlet DeviceEventSummary = DeviceEvents | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceLogonEventsSummary = DeviceLogonEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\nlet DeviceProcessEventsSummary = DeviceProcessEvents | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\\n(DeviceEventSummary\\n| union DeviceNetworkEventsSummary,\\nDeviceNetworkEventsSummary,\\nDeviceNetworkInfoSummary,\\nDeviceLogonEventsSummary,\\nDeviceRegistryEventsSummary,\\nDeviceProcessEventsSummary)\\n| join kind=inner ( \\nAllDeviceNames\\n)\\non $left.DeviceId == $right.DeviceId\\n| project-reorder Type, TimeGenerated, count_\\n//| project-away DeviceId, DeviceId1\",\"size\":1,\"title\":\"Daily Data Flow on MDE Tables over {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"xAxis\":\"count_\"}},\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo \\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| extend ParsedFields=parse_json(LoggedOnUsers)[0]\\r\\n| extend DurationAtLeast= format_timespan(now()-TimeGenerated,'dd:hh:mm:ss')\\r\\n| project DurationAtLeast,TimeGenerated,DeviceName,DomainName=ParsedFields.DomainName,UserName=ParsedFields.UserName\\r\\n| order by DurationAtLeast asc\",\"size\":0,\"title\":\"Device Heartbeat from TimeTange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let UsbDriveMount = DeviceEvents\\r\\n| where ActionType==\\\"UsbDriveMounted\\\"\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\\r\\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\\r\\n| order by DeviceId asc, MountTime desc;\\r\\nlet FileCreation = DeviceFileEvents\\r\\n| where InitiatingProcessAccountName != \\\"system\\\"\\r\\n| where ActionType == \\\"FileCreated\\\"\\r\\n| where FolderPath !startswith \\\"C:\\\\\\\\\\\"\\r\\n| where FolderPath !startswith \\\"\\\\\\\\\\\"\\r\\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\\r\\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\\r\\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\\r\\n| order by DeviceId asc, Timestamp desc;\\r\\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\\r\\n| where FolderPath startswith DriveLetter\\r\\n| where Timestamp >= MountTime\\r\\n| partition by ReportId ( top 1 by MountTime )\\r\\n| order by DeviceId asc, Timestamp desc\\r\\n| summarize FileCount = count() by DeviceName\\r\\n| order by FileCount desc\",\"size\":1,\"title\":\"Device where files are copied to USB Drive from TimeTange {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| mvexpand ConnectedNetworks\\r\\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)\",\"size\":1,\"title\":\"Device Internet Connectivity Status from TimeTange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"FileCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\\r\\n| extend DeviceMachineName = split(DeviceName, '.')[0]\\r\\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\\r\\n| summarize count() by DeviceDomain\",\"size\":1,\"title\":\"Device Count by DNS Suffix\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(TimeGenerated, *) by DeviceId\\r\\n| summarize count() by tostring(IsAzureADJoined)\",\"size\":1,\"title\":\"Device EntraID Join status\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceInfo\\r\\n| where isnotempty(OSPlatform)\\r\\n| summarize arg_max(TimeGenerated, *) by DeviceId\\r\\n| summarize count() by ClientVersion\",\"size\":1,\"title\":\"Device ClientVersion\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"30\",\"name\":\"query - 0 - Copy - Copy - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},\"name\":\"groupOverview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\\r\\n//\\r\\n//Get the list of AV detections\\r\\nlet avDetections =\\r\\nDeviceEvents\\r\\n| where ActionType == \\\"AntivirusDetection\\\" and isnotempty(MD5)\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\\r\\n//Get a list of file creations\\r\\nlet fileCreations =\\r\\nDeviceFileEvents \\r\\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\\r\\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\\r\\n//Join the file creations and AV detections on the MD5 of the file\\r\\navDetections | join kind=inner (fileCreations) on MD5\\r\\n| project-away MD51 //Remove the duplicated MD5 field\\r\\n| sort by Timestamp desc \",\"size\":0,\"title\":\"Source of the AV detections for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceEvents\\r\\n| where ActionType startswith \\\"Asr\\\" and ActionType endswith \\\"Audited\\\"\\r\\n// Count total stats - count events and machines per rule\\r\\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType\",\"size\":0,\"title\":\"Get stats on ASR audit events - count events and machines per rule for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceEvents\\r\\n| where ActionType startswith \\\"Asr\\\" and ActionType endswith \\\"Blocked\\\"\\r\\n// Count total stats - count events and machines per rule\\r\\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType\",\"size\":0,\"title\":\"Get stats on ASR blocks - count events and machines per rule for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//This query make a best-guess detection regarding which removable media device caused an AV detection\\r\\n//The query is best run over 30 days to get the full USB history\\r\\n//\\r\\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\\r\\nlet usbDetections =\\r\\n    DeviceEvents\\r\\n    | where ActionType == \\\"AntivirusDetection\\\" and FolderPath !startswith \\\"c\\\" and FolderPath matches regex \\\"^[A-Za-z]{1}\\\"\\r\\n    | extend ParsedFields=parse_json(AdditionalFields)\\r\\n    | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\\r\\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\\r\\nlet usbConnections = \\r\\n    DeviceEvents\\r\\n    | where ActionType == \\\"PnpDeviceConnected\\\"\\r\\n    | extend parsed=parse_json(AdditionalFields)\\r\\n    | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\\r\\n    | where ClassName == \\\"DiskDrive\\\"\\r\\n    | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\\r\\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\\r\\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\\r\\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\\r\\n| sort by DetectionTime desc\",\"size\":0,\"title\":\"AV Detections with USB Disk Drive for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let UsbDriveMount = DeviceEvents\\r\\n| where ActionType==\\\"UsbDriveMounted\\\"\\r\\n| extend ParsedFields=parse_json(AdditionalFields)\\r\\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\\r\\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\\r\\n| order by DeviceId asc, MountTime desc;\\r\\nlet FileCreation = DeviceFileEvents\\r\\n| where InitiatingProcessAccountName != \\\"system\\\"\\r\\n| where ActionType == \\\"FileCreated\\\"\\r\\n| where FolderPath !startswith \\\"C:\\\\\\\\\\\"\\r\\n| where FolderPath !startswith \\\"\\\\\\\\\\\"\\r\\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\\r\\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\\r\\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\\r\\n| order by DeviceId asc, Timestamp desc;\\r\\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\\r\\n| where FolderPath startswith DriveLetter\\r\\n| where Timestamp >= MountTime\\r\\n| partition by ReportId ( top 1 by MountTime )\\r\\n| order by DeviceId asc, Timestamp desc\",\"size\":0,\"title\":\"List files copied to USB mounted drives for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Device\"},\"name\":\"groupDevice\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| mv-apply ConnectedNetworks on \\r\\n(\\r\\nwhere ConnectedNetworks.IsConnectedToInternet == true\\r\\n)\\r\\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet\",\"size\":0,\"title\":\"Internet Connected Devices for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| summarize count() by MachineGroup\",\"size\":0,\"title\":\"Count By Machine Group for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkInfo\\r\\n| summarize arg_max(TimeGenerated,*) by DeviceId\\r\\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus\",\"size\":0,\"title\":\"Count By Network Adaptor\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"name\":\"query - 0 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkEvents\\r\\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)\",\"size\":0,\"title\":\"TimeSeries on Network Activity for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 0 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceNetworkEvents\\r\\n| where isnotempty(RemoteUrl)\\r\\n| summarize count() by RemoteUrl\\r\\n| order by count_ desc\\r\\n| limit 10\",\"size\":0,\"title\":\"Top 10 RemoteUrl accessed over TimeRange {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 0 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// This query looks for Tor client, or for a common Tor plugin called Meek.\\r\\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\\r\\n// To read more about this technique, see:\\r\\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\\r\\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\\r\\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\\r\\n// Tags: #Tor, #MultiHopProxy, #CnC\\r\\nDeviceNetworkEvents  \\r\\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\\\"tor.exe\\\", \\\"meek-client.exe\\\")\\r\\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\\r\\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\\r\\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\\r\\n| order by MachineCount desc\",\"size\":0,\"title\":\"Tor Clients for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Network\"},\"name\":\"groupNetwork\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceFileEvents\\r\\n| summarize FileActivityCount = count() by DeviceName\",\"size\":0,\"title\":\"FileActivityCount per Device for {TimeRange}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"DeviceFileEvents\\r\\n| summarize count() by InitiatingProcessAccountUpn\",\"size\":0,\"title\":\"Count by InitiatingProcessAccountUpn for {TimeRange}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"query - 0 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"File\"},\"name\":\"groupFile\"}],\"fromTemplateId\":\"sentinel-MicrosoftDefenderForEndPoint\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+                "version": "1.0",
+                "sourceId": "[variables('workspaceResourceId')]",
+                "category": "sentinel"
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]",
+              "properties": {
+                "description": "@{workbookKey=MicrosoftDefenderForEndPoint; logoFileName=Azure_Sentinel.svg; description=A wokbook to provide details about Microsoft Defender for Endpoint Advance Hunting to Overview & Analyse data brought through M365 Defender Connector.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Defender For EndPoint; templateRelativePath=MicrosoftDefenderForEndPoint.json; subtitle=; provider=Microsoft Sentinel Community}.description",
+                "parentId": "[variables('workbookId2')]",
+                "contentId": "[variables('_workbookContentId2')]",
+                "kind": "Workbook",
+                "version": "[variables('workbookVersion2')]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('_workbookContentId2')]",
+        "contentKind": "Workbook",
+        "displayName": "[parameters('workbook2-name')]",
+        "contentProductId": "[variables('_workbookcontentProductId2')]",
+        "id": "[variables('_workbookcontentProductId2')]",
+        "version": "[variables('workbookVersion2')]"
+      },
+      "condition": "[parameters('DeployWorkbook')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('workbookTemplateSpecName3')]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "MicrosoftDefenderForIdentity Workbook with template version 3.2.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('workbookVersion3')]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.Insights/workbooks",
+              "name": "[variables('workbookContentId3')]",
+              "location": "[parameters('workspace-location')]",
+              "kind": "shared",
+              "apiVersion": "2021-08-01",
+              "metadata": {
+                "description": "Use this workbook to analyse the advance hunting data ingested for Defender For Identity."
+              },
+              "properties": {
+                "displayName": "[parameters('workbook3-name')]",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Microsoft Defender for Identity\\n---\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"6e647d99-1a32-4bca-8147-403b5d37d773\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"value\":\"\",\"typeSettings\":{\"includeAll\":false,\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"},{\"id\":\"d57bcdf5-aec7-4f86-904c-67171864919b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"query\":\"resources\\r\\n| where type =~ \\\"microsoft.operationalinsights/workspaces\\\"\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"2e238f92-709c-410b-93e0-60eab6150a75\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"ec13514a-7e54-4d41-86db-2805727a2fa7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"About\",\"type\":10,\"description\":\"\",\"isRequired\":true,\"value\":\"Show\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n    \\\"Show\\\",\\r\\n    \\\"Hide\\\"\\r\\n]\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Microsoft Defender for Identity Analysis Workbook\\r\\n\\r\\n\",\"style\":\"info\"},\"name\":\"text - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"About\",\"comparison\":\"isEqualTo\",\"value\":\"Show\"},\"name\":\"AboutGroup\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"48578fe1-da47-4a4c-b495-ce7fe24ce495\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"grpOverview\",\"style\":\"link\"},{\"id\":\"30e93159-8bf5-4006-820f-406ea10bcd17\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"LogOnEvents\",\"subTarget\":\"grpLogOnEvents\",\"style\":\"link\"},{\"id\":\"c40f76ed-94be-40ff-b65b-3fda306f2c3d\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"QueryEvents\",\"subTarget\":\"grpQueryEvents\",\"style\":\"link\"},{\"id\":\"38c88a53-f7b1-42da-83d6-0c809835eaab\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DirectoryEvents\",\"subTarget\":\"grpDirectoryEvents\",\"style\":\"link\"},{\"id\":\"0ad83579-c492-4c20-8db6-27883db5abc8\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Alerts\",\"subTarget\":\"grpAlerts\",\"style\":\"link\"}]},\"name\":\"links - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| summarize count() by LogonType\",\"size\":0,\"title\":\"Log On Summary\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"LogonType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"40\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n|summarize count() by ActionType\",\"size\":0,\"title\":\"Log On Status\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| summarize count() by Protocol\",\"size\":0,\"title\":\"Log On Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\"},\"customWidth\":\"30\",\"name\":\"query - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityQueryEvents\\r\\n| summarize count() by Protocol\",\"size\":0,\"title\":\"Query Summary\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\"},\"customWidth\":\"30\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityQueryEvents\\r\\n| summarize count() by DestinationPort\",\"size\":0,\"title\":\"Query Destination Port\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 3 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityQueryEvents\\r\\n| where isnotempty(QueryType)\\r\\n| summarize count() by QueryType\\r\\n| order by count_ desc\\r\\n| take 10\",\"size\":0,\"title\":\"Top 10 Query Types\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"30\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| summarize count() by Protocol\",\"size\":0,\"title\":\"Directory Events Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"categoricalbar\"},\"customWidth\":\"40\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| summarize count() by AccountDomain\",\"size\":0,\"title\":\"Directory Events Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 6 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| where isnotempty(AccountUpn)\\r\\n| summarize count() by AccountUpn\\r\\n| order by count_ desc \\r\\n| take 10\",\"size\":0,\"title\":\"Top 10 Accounts Activity\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"30\",\"name\":\"query - 6 - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpOverview\"},\"name\":\"grpOverview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| where LogonType == \\\"Resource access\\\"\\r\\n| extend FROM_DEVICE_ = tostring(AdditionalFields.[\\\"FROM.DEVICE\\\"])\\r\\n| extend TO_DEVICE_ = tostring(AdditionalFields.[\\\"TO.DEVICE\\\"])\\r\\n| extend Count_ = toint(AdditionalFields.Count)\\r\\n| summarize sum(Count_) by FROM_DEVICE_, TO_DEVICE_\\r\\n| order by sum_Count_ desc\",\"size\":0,\"title\":\"Resource Access Summary in Devices\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sum_Count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"45\",\"name\":\"query - 0\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| where LogonType == \\\"Resource access\\\"\\r\\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\\r\\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\\r\\n| extend Count_ = toint(AdditionalFields.Count)\\r\\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\\r\\n| order by sum_Count_ desc\",\"size\":0,\"title\":\"Resource Access Summary in OS\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sum_Count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"45\",\"name\":\"query - 0 - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityLogonEvents\\r\\n| where LogonType == \\\"Credentials validation\\\"\\r\\n| extend FROM_DEVICE = tostring(AdditionalFields.[\\\"FROM.DEVICE\\\"])\\r\\n| extend TO_DEVICE = tostring(AdditionalFields.[\\\"TO.DEVICE\\\"])\\r\\n| extend Count = toint(AdditionalFields.Count)\\r\\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\\r\\n| order by sum_Count desc\",\"size\":0,\"title\":\"Credentials validation Summary in Devices\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sum_Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"45\",\"name\":\"query - 0 - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = IdentityLogonEvents\\r\\n| where LogonType == \\\"Credentials validation\\\"\\r\\n| extend TO_DEVICE = tostring(AdditionalFields.[\\\"TO.DEVICE\\\"])\\r\\n| extend Count = toint(AdditionalFields.Count);\\r\\ndata\\r\\n| summarize sum(Count) by  TO_DEVICE\\r\\n| order by sum_Count desc\\r\\n| join kind=inner\\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by TO_DEVICE\\r\\n)\\r\\non $left.TO_DEVICE == $right.TO_DEVICE\",\"size\":0,\"title\":\"Credentials validation by Domain Controllers\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"sum_Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TO_DEVICE1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":10,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"45\",\"name\":\"query - 0 - Copy - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = IdentityLogonEvents;\\r\\ndata\\r\\n| extend Count = toint(AdditionalFields.Count)\\r\\n| summarize LogonSuccess = sumif(Count,ActionType == \\\"LogonSuccess\\\"),LogonFailed= sumif(Count,ActionType == \\\"LogonFailed\\\") by AccountUpn\\r\\n| join kind = inner\\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\\r\\n) on $left.AccountUpn == $right.AccountUpn\",\"size\":0,\"title\":\"Logon Summary by Users\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogonSuccess\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"LogonFailed\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redPurple\"}},{\"columnMatch\":\"AccountUpn1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 0 - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpLogOnEvents\"},\"name\":\"AttachmentGroup\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = IdentityQueryEvents\\r\\n| extend TO_DEVICE = tostring(AdditionalFields.[\\\"TO.DEVICE\\\"]);\\r\\ndata\\r\\n| summarize count() by QueryType, TO_DEVICE\\r\\n| join kind =inner \\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by QueryType, TO_DEVICE\\r\\n) on $left.QueryType == $right.QueryType and $left.TO_DEVICE== $right.TO_DEVICE\",\"size\":0,\"title\":\"Device Query Summary\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TO_DEVICE\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"QueryType1\",\"formatter\":5},{\"columnMatch\":\"TO_DEVICE1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"TO_DEVICE\"],\"expandTopLevel\":true}}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = IdentityQueryEvents;\\r\\ndata\\r\\n| summarize count() by DeviceName\\r\\n| join kind =inner \\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\\r\\n) on $left.DeviceName == $right.DeviceName\",\"size\":0,\"title\":\"Query Summary from Source Devices\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DeviceName1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 0 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpQueryEvents\"},\"name\":\"UrlGroup\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActionType \",\"size\":0,\"title\":\"Timeline on ActionType\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\"},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| summarize count() by ActionType \\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Top 10 Actions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"categoricalbar\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationPort\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 0 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"IdentityDirectoryEvents\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\",\"size\":0,\"title\":\"Account Trend on Directory Events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationPort\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 0 - Copy - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpDirectoryEvents\"},\"name\":\"group - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = SecurityAlert\\r\\n| where ProductName == \\\"Azure Advanced Threat Protection\\\"\\r\\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\\r\\ndata\\r\\n| summarize count() by AlertName\\r\\n| join kind=inner \\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\\r\\n) on AlertName\",\"size\":0,\"noDataMessage\":\"Alerts\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"AlertName1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = SecurityAlert\\r\\n| where ProductName == \\\"Azure Advanced Threat Protection\\\"\\r\\n| summarize arg_max(TimeGenerated,*) by SystemAlertId\\r\\n| mv-expand todynamic(Entities)\\r\\n| where Entities[\\\"Type\\\"] == \\\"host\\\"\\r\\n| where isnotempty(Entities[\\\"HostName\\\"])\\r\\n| extend HostName = tostring(Entities[\\\"HostName\\\"]);\\r\\ndata\\r\\n| summarize count() by HostName\\r\\n| join kind=inner \\r\\n(\\r\\ndata\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by HostName\\r\\n) on $left.HostName == $right.HostName\",\"size\":0,\"title\":\"Impacted Hosts\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"HostName1\",\"formatter\":5},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5}]}},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"grpAlerts\"},\"name\":\"group - 8\"}],\"fromTemplateId\":\"sentinel-MicrosoftDefenderForIdentity\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+                "version": "1.0",
+                "sourceId": "[variables('workspaceResourceId')]",
+                "category": "sentinel"
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId3'),'/'))))]",
+              "properties": {
+                "description": "@{workbookKey=MicrosoftDefenderForIdentity; logoFileName=Azure_Sentinel.svg; description=Use this workbook to analyse the advance hunting data ingested for Defender For Identity.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Defender For Identity; templateRelativePath=MicrosoftDefenderForIdentity.json; subtitle=; provider=Microsoft Sentinel Community}.description",
+                "parentId": "[variables('workbookId3')]",
+                "contentId": "[variables('_workbookContentId3')]",
+                "kind": "Workbook",
+                "version": "[variables('workbookVersion3')]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Microsoft Defender XDR",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Microsoft",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Microsoft Corporation",
+                  "email": "support@microsoft.com",
+                  "tier": "Microsoft",
+                  "link": "https://support.microsoft.com"
+                },
+                "dependencies": {
+                  "operator": "AND",
+                  "criteria": [
+                    {
+                      "contentId": "IdentityLogonEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "IdentityQueryEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "IdentityDirectoryEvents",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "SecurityAlert",
+                      "kind": "DataType"
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('_workbookContentId3')]",
+        "contentKind": "Workbook",
+        "displayName": "[parameters('workbook3-name')]",
+        "contentProductId": "[variables('_workbookcontentProductId3')]",
+        "id": "[variables('_workbookcontentProductId3')]",
+        "version": "[variables('workbookVersion3')]"
+      },
+      "condition": "[parameters('DeployWorkbook')]"
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+      "apiVersion": "2023-04-01-preview",
+      "location": "[parameters('workspace-location')]",
+      "properties": {
+        "version": "3.2.1",
+        "kind": "Solution",
+        "contentSchemaVersion": "3.0.0",
+        "displayName": "Microsoft Defender XDR",
+        "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
+        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20XDR/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The <a href=\"https://www.microsoft.com/security/business/threat-protection/microsoft-365-defender\">Microsoft Defender XDR</a> solution for Microsoft Sentinel enables you to ingest Security Alerts/Incidents and raw logs from the products within Microsoft Defender XDR suite into Microsoft Sentinel.</p>\n<p>Additional Hunting Queries to support proactive and reactive hunting for the Microsoft Defender XDR solution can be found on <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender\">GitHub</a>. This repository has a collection of queries developed by Microsoft Security Research and Microsoft Sentinel community contributions.</p>\n<p><strong>Underlying Microsoft Technologies used:</strong></p>\n<p>This solution takes a dependency on the following technologies, and some of these dependencies either may be in <a href=\"https://azure.microsoft.com/support/legal/preview-supplemental-terms/\">Preview</a> state or might result in additional ingestion or operational costs:</p>\n<ol type=\"a\">\n<li><a href=\"https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api\">Azure Monitor HTTP Data Collector API</a></li>\n</ol>\n<p><strong>Data Connectors:</strong> 1, <strong>Workbooks:</strong> 3, <strong>Analytic Rules:</strong> 40, <strong>Hunting Queries:</strong> 387, <strong>XDR Workbooks:</strong> 3</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
+        "contentKind": "Solution",
+        "contentProductId": "[variables('_solutioncontentProductId')]",
+        "id": "[variables('_solutioncontentProductId')]",
+        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
+        "contentId": "[variables('_solutionId')]",
+        "parentId": "[variables('_solutionId')]",
+        "source": {
+          "kind": "Solution",
+          "name": "Microsoft Defender XDR",
+          "sourceId": "[variables('_solutionId')]"
+        },
+        "author": {
+          "name": "Microsoft",
+          "email": "[variables('_email')]"
+        },
+        "support": {
+          "name": "Microsoft Corporation",
+          "email": "support@microsoft.com",
+          "tier": "Microsoft",
+          "link": "https://support.microsoft.com"
+        },
+        "dependencies": {
+          "operator": "AND",
+          "criteria": [
+            {
+              "kind": "DataConnector",
+              "contentId": "[variables('_dataConnectorContentId1')]",
+              "version": "[variables('dataConnectorVersion1')]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+              "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]",
+              "version": "[variables('analyticRuleObject2').analyticRuleVersion2]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]",
+              "version": "[variables('analyticRuleObject3').analyticRuleVersion3]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]",
+              "version": "[variables('analyticRuleObject4').analyticRuleVersion4]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]",
+              "version": "[variables('analyticRuleObject5').analyticRuleVersion5]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]",
+              "version": "[variables('analyticRuleObject6').analyticRuleVersion6]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]",
+              "version": "[variables('analyticRuleObject7').analyticRuleVersion7]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]",
+              "version": "[variables('analyticRuleObject8').analyticRuleVersion8]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]",
+              "version": "[variables('analyticRuleObject9').analyticRuleVersion9]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]",
+              "version": "[variables('analyticRuleObject10').analyticRuleVersion10]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]",
+              "version": "[variables('analyticRuleObject11').analyticRuleVersion11]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]",
+              "version": "[variables('analyticRuleObject12').analyticRuleVersion12]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]",
+              "version": "[variables('analyticRuleObject13').analyticRuleVersion13]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]",
+              "version": "[variables('analyticRuleObject14').analyticRuleVersion14]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]",
+              "version": "[variables('analyticRuleObject15').analyticRuleVersion15]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]",
+              "version": "[variables('analyticRuleObject16').analyticRuleVersion16]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]",
+              "version": "[variables('analyticRuleObject17').analyticRuleVersion17]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]",
+              "version": "[variables('analyticRuleObject18').analyticRuleVersion18]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]",
+              "version": "[variables('analyticRuleObject19').analyticRuleVersion19]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]",
+              "version": "[variables('analyticRuleObject20').analyticRuleVersion20]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]",
+              "version": "[variables('analyticRuleObject21').analyticRuleVersion21]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]",
+              "version": "[variables('analyticRuleObject22').analyticRuleVersion22]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]",
+              "version": "[variables('analyticRuleObject23').analyticRuleVersion23]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]",
+              "version": "[variables('analyticRuleObject24').analyticRuleVersion24]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]",
+              "version": "[variables('analyticRuleObject25').analyticRuleVersion25]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]",
+              "version": "[variables('analyticRuleObject26').analyticRuleVersion26]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]",
+              "version": "[variables('analyticRuleObject27').analyticRuleVersion27]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]",
+              "version": "[variables('analyticRuleObject28').analyticRuleVersion28]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]",
+              "version": "[variables('analyticRuleObject29').analyticRuleVersion29]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]",
+              "version": "[variables('analyticRuleObject30').analyticRuleVersion30]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]",
+              "version": "[variables('analyticRuleObject31').analyticRuleVersion31]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]",
+              "version": "[variables('analyticRuleObject32').analyticRuleVersion32]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]",
+              "version": "[variables('analyticRuleObject33').analyticRuleVersion33]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]",
+              "version": "[variables('analyticRuleObject34').analyticRuleVersion34]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]",
+              "version": "[variables('analyticRuleObject35').analyticRuleVersion35]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]",
+              "version": "[variables('analyticRuleObject36').analyticRuleVersion36]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]",
+              "version": "[variables('analyticRuleObject37').analyticRuleVersion37]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]",
+              "version": "[variables('analyticRuleObject38').analyticRuleVersion38]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]",
+              "version": "[variables('analyticRuleObject39').analyticRuleVersion39]"
+            },
+            {
+              "kind": "AnalyticsRule",
+              "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]",
+              "version": "[variables('analyticRuleObject40').analyticRuleVersion40]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+              "version": "[variables('huntingQueryObject1').huntingQueryVersion1]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+              "version": "[variables('huntingQueryObject2').huntingQueryVersion2]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+              "version": "[variables('huntingQueryObject3').huntingQueryVersion3]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+              "version": "[variables('huntingQueryObject4').huntingQueryVersion4]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+              "version": "[variables('huntingQueryObject5').huntingQueryVersion5]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
+              "version": "[variables('huntingQueryObject6').huntingQueryVersion6]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
+              "version": "[variables('huntingQueryObject7').huntingQueryVersion7]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
+              "version": "[variables('huntingQueryObject8').huntingQueryVersion8]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
+              "version": "[variables('huntingQueryObject9').huntingQueryVersion9]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
+              "version": "[variables('huntingQueryObject10').huntingQueryVersion10]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
+              "version": "[variables('huntingQueryObject11').huntingQueryVersion11]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
+              "version": "[variables('huntingQueryObject12').huntingQueryVersion12]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
+              "version": "[variables('huntingQueryObject13').huntingQueryVersion13]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
+              "version": "[variables('huntingQueryObject14').huntingQueryVersion14]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
+              "version": "[variables('huntingQueryObject15').huntingQueryVersion15]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
+              "version": "[variables('huntingQueryObject16').huntingQueryVersion16]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
+              "version": "[variables('huntingQueryObject17').huntingQueryVersion17]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
+              "version": "[variables('huntingQueryObject18').huntingQueryVersion18]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
+              "version": "[variables('huntingQueryObject19').huntingQueryVersion19]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
+              "version": "[variables('huntingQueryObject20').huntingQueryVersion20]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
+              "version": "[variables('huntingQueryObject21').huntingQueryVersion21]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject22')._huntingQuerycontentId22]",
+              "version": "[variables('huntingQueryObject22').huntingQueryVersion22]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject23')._huntingQuerycontentId23]",
+              "version": "[variables('huntingQueryObject23').huntingQueryVersion23]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject24')._huntingQuerycontentId24]",
+              "version": "[variables('huntingQueryObject24').huntingQueryVersion24]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject25')._huntingQuerycontentId25]",
+              "version": "[variables('huntingQueryObject25').huntingQueryVersion25]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject26')._huntingQuerycontentId26]",
+              "version": "[variables('huntingQueryObject26').huntingQueryVersion26]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject27')._huntingQuerycontentId27]",
+              "version": "[variables('huntingQueryObject27').huntingQueryVersion27]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject28')._huntingQuerycontentId28]",
+              "version": "[variables('huntingQueryObject28').huntingQueryVersion28]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject29')._huntingQuerycontentId29]",
+              "version": "[variables('huntingQueryObject29').huntingQueryVersion29]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject30')._huntingQuerycontentId30]",
+              "version": "[variables('huntingQueryObject30').huntingQueryVersion30]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject31')._huntingQuerycontentId31]",
+              "version": "[variables('huntingQueryObject31').huntingQueryVersion31]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject32')._huntingQuerycontentId32]",
+              "version": "[variables('huntingQueryObject32').huntingQueryVersion32]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject33')._huntingQuerycontentId33]",
+              "version": "[variables('huntingQueryObject33').huntingQueryVersion33]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject34')._huntingQuerycontentId34]",
+              "version": "[variables('huntingQueryObject34').huntingQueryVersion34]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject35')._huntingQuerycontentId35]",
+              "version": "[variables('huntingQueryObject35').huntingQueryVersion35]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject36')._huntingQuerycontentId36]",
+              "version": "[variables('huntingQueryObject36').huntingQueryVersion36]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject37')._huntingQuerycontentId37]",
+              "version": "[variables('huntingQueryObject37').huntingQueryVersion37]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject38')._huntingQuerycontentId38]",
+              "version": "[variables('huntingQueryObject38').huntingQueryVersion38]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject39')._huntingQuerycontentId39]",
+              "version": "[variables('huntingQueryObject39').huntingQueryVersion39]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject40')._huntingQuerycontentId40]",
+              "version": "[variables('huntingQueryObject40').huntingQueryVersion40]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject41')._huntingQuerycontentId41]",
+              "version": "[variables('huntingQueryObject41').huntingQueryVersion41]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject42')._huntingQuerycontentId42]",
+              "version": "[variables('huntingQueryObject42').huntingQueryVersion42]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject43')._huntingQuerycontentId43]",
+              "version": "[variables('huntingQueryObject43').huntingQueryVersion43]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject44')._huntingQuerycontentId44]",
+              "version": "[variables('huntingQueryObject44').huntingQueryVersion44]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject45')._huntingQuerycontentId45]",
+              "version": "[variables('huntingQueryObject45').huntingQueryVersion45]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject46')._huntingQuerycontentId46]",
+              "version": "[variables('huntingQueryObject46').huntingQueryVersion46]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject47')._huntingQuerycontentId47]",
+              "version": "[variables('huntingQueryObject47').huntingQueryVersion47]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject48')._huntingQuerycontentId48]",
+              "version": "[variables('huntingQueryObject48').huntingQueryVersion48]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject49')._huntingQuerycontentId49]",
+              "version": "[variables('huntingQueryObject49').huntingQueryVersion49]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject50')._huntingQuerycontentId50]",
+              "version": "[variables('huntingQueryObject50').huntingQueryVersion50]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject51')._huntingQuerycontentId51]",
+              "version": "[variables('huntingQueryObject51').huntingQueryVersion51]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject52')._huntingQuerycontentId52]",
+              "version": "[variables('huntingQueryObject52').huntingQueryVersion52]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject53')._huntingQuerycontentId53]",
+              "version": "[variables('huntingQueryObject53').huntingQueryVersion53]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject54')._huntingQuerycontentId54]",
+              "version": "[variables('huntingQueryObject54').huntingQueryVersion54]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject55')._huntingQuerycontentId55]",
+              "version": "[variables('huntingQueryObject55').huntingQueryVersion55]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject56')._huntingQuerycontentId56]",
+              "version": "[variables('huntingQueryObject56').huntingQueryVersion56]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject57')._huntingQuerycontentId57]",
+              "version": "[variables('huntingQueryObject57').huntingQueryVersion57]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject58')._huntingQuerycontentId58]",
+              "version": "[variables('huntingQueryObject58').huntingQueryVersion58]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject59')._huntingQuerycontentId59]",
+              "version": "[variables('huntingQueryObject59').huntingQueryVersion59]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject60')._huntingQuerycontentId60]",
+              "version": "[variables('huntingQueryObject60').huntingQueryVersion60]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject61')._huntingQuerycontentId61]",
+              "version": "[variables('huntingQueryObject61').huntingQueryVersion61]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject62')._huntingQuerycontentId62]",
+              "version": "[variables('huntingQueryObject62').huntingQueryVersion62]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject63')._huntingQuerycontentId63]",
+              "version": "[variables('huntingQueryObject63').huntingQueryVersion63]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject64')._huntingQuerycontentId64]",
+              "version": "[variables('huntingQueryObject64').huntingQueryVersion64]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject65')._huntingQuerycontentId65]",
+              "version": "[variables('huntingQueryObject65').huntingQueryVersion65]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject66')._huntingQuerycontentId66]",
+              "version": "[variables('huntingQueryObject66').huntingQueryVersion66]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject67')._huntingQuerycontentId67]",
+              "version": "[variables('huntingQueryObject67').huntingQueryVersion67]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject68')._huntingQuerycontentId68]",
+              "version": "[variables('huntingQueryObject68').huntingQueryVersion68]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject69')._huntingQuerycontentId69]",
+              "version": "[variables('huntingQueryObject69').huntingQueryVersion69]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject70')._huntingQuerycontentId70]",
+              "version": "[variables('huntingQueryObject70').huntingQueryVersion70]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject71')._huntingQuerycontentId71]",
+              "version": "[variables('huntingQueryObject71').huntingQueryVersion71]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject72')._huntingQuerycontentId72]",
+              "version": "[variables('huntingQueryObject72').huntingQueryVersion72]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject73')._huntingQuerycontentId73]",
+              "version": "[variables('huntingQueryObject73').huntingQueryVersion73]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject74')._huntingQuerycontentId74]",
+              "version": "[variables('huntingQueryObject74').huntingQueryVersion74]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject75')._huntingQuerycontentId75]",
+              "version": "[variables('huntingQueryObject75').huntingQueryVersion75]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject76')._huntingQuerycontentId76]",
+              "version": "[variables('huntingQueryObject76').huntingQueryVersion76]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject77')._huntingQuerycontentId77]",
+              "version": "[variables('huntingQueryObject77').huntingQueryVersion77]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject78')._huntingQuerycontentId78]",
+              "version": "[variables('huntingQueryObject78').huntingQueryVersion78]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject79')._huntingQuerycontentId79]",
+              "version": "[variables('huntingQueryObject79').huntingQueryVersion79]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject80')._huntingQuerycontentId80]",
+              "version": "[variables('huntingQueryObject80').huntingQueryVersion80]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject81')._huntingQuerycontentId81]",
+              "version": "[variables('huntingQueryObject81').huntingQueryVersion81]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject82')._huntingQuerycontentId82]",
+              "version": "[variables('huntingQueryObject82').huntingQueryVersion82]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject83')._huntingQuerycontentId83]",
+              "version": "[variables('huntingQueryObject83').huntingQueryVersion83]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject84')._huntingQuerycontentId84]",
+              "version": "[variables('huntingQueryObject84').huntingQueryVersion84]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject85')._huntingQuerycontentId85]",
+              "version": "[variables('huntingQueryObject85').huntingQueryVersion85]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject86')._huntingQuerycontentId86]",
+              "version": "[variables('huntingQueryObject86').huntingQueryVersion86]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject87')._huntingQuerycontentId87]",
+              "version": "[variables('huntingQueryObject87').huntingQueryVersion87]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject88')._huntingQuerycontentId88]",
+              "version": "[variables('huntingQueryObject88').huntingQueryVersion88]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject89')._huntingQuerycontentId89]",
+              "version": "[variables('huntingQueryObject89').huntingQueryVersion89]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject90')._huntingQuerycontentId90]",
+              "version": "[variables('huntingQueryObject90').huntingQueryVersion90]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject91')._huntingQuerycontentId91]",
+              "version": "[variables('huntingQueryObject91').huntingQueryVersion91]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject92')._huntingQuerycontentId92]",
+              "version": "[variables('huntingQueryObject92').huntingQueryVersion92]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject93')._huntingQuerycontentId93]",
+              "version": "[variables('huntingQueryObject93').huntingQueryVersion93]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject94')._huntingQuerycontentId94]",
+              "version": "[variables('huntingQueryObject94').huntingQueryVersion94]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject95')._huntingQuerycontentId95]",
+              "version": "[variables('huntingQueryObject95').huntingQueryVersion95]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject96')._huntingQuerycontentId96]",
+              "version": "[variables('huntingQueryObject96').huntingQueryVersion96]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject97')._huntingQuerycontentId97]",
+              "version": "[variables('huntingQueryObject97').huntingQueryVersion97]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject98')._huntingQuerycontentId98]",
+              "version": "[variables('huntingQueryObject98').huntingQueryVersion98]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject99')._huntingQuerycontentId99]",
+              "version": "[variables('huntingQueryObject99').huntingQueryVersion99]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject100')._huntingQuerycontentId100]",
+              "version": "[variables('huntingQueryObject100').huntingQueryVersion100]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject101')._huntingQuerycontentId101]",
+              "version": "[variables('huntingQueryObject101').huntingQueryVersion101]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject102')._huntingQuerycontentId102]",
+              "version": "[variables('huntingQueryObject102').huntingQueryVersion102]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject103')._huntingQuerycontentId103]",
+              "version": "[variables('huntingQueryObject103').huntingQueryVersion103]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject104')._huntingQuerycontentId104]",
+              "version": "[variables('huntingQueryObject104').huntingQueryVersion104]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject105')._huntingQuerycontentId105]",
+              "version": "[variables('huntingQueryObject105').huntingQueryVersion105]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject106')._huntingQuerycontentId106]",
+              "version": "[variables('huntingQueryObject106').huntingQueryVersion106]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject107')._huntingQuerycontentId107]",
+              "version": "[variables('huntingQueryObject107').huntingQueryVersion107]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject108')._huntingQuerycontentId108]",
+              "version": "[variables('huntingQueryObject108').huntingQueryVersion108]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject109')._huntingQuerycontentId109]",
+              "version": "[variables('huntingQueryObject109').huntingQueryVersion109]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject110')._huntingQuerycontentId110]",
+              "version": "[variables('huntingQueryObject110').huntingQueryVersion110]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject111')._huntingQuerycontentId111]",
+              "version": "[variables('huntingQueryObject111').huntingQueryVersion111]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject112')._huntingQuerycontentId112]",
+              "version": "[variables('huntingQueryObject112').huntingQueryVersion112]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject113')._huntingQuerycontentId113]",
+              "version": "[variables('huntingQueryObject113').huntingQueryVersion113]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject114')._huntingQuerycontentId114]",
+              "version": "[variables('huntingQueryObject114').huntingQueryVersion114]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject115')._huntingQuerycontentId115]",
+              "version": "[variables('huntingQueryObject115').huntingQueryVersion115]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject116')._huntingQuerycontentId116]",
+              "version": "[variables('huntingQueryObject116').huntingQueryVersion116]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject117')._huntingQuerycontentId117]",
+              "version": "[variables('huntingQueryObject117').huntingQueryVersion117]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject118')._huntingQuerycontentId118]",
+              "version": "[variables('huntingQueryObject118').huntingQueryVersion118]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject119')._huntingQuerycontentId119]",
+              "version": "[variables('huntingQueryObject119').huntingQueryVersion119]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject120')._huntingQuerycontentId120]",
+              "version": "[variables('huntingQueryObject120').huntingQueryVersion120]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject121')._huntingQuerycontentId121]",
+              "version": "[variables('huntingQueryObject121').huntingQueryVersion121]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject122')._huntingQuerycontentId122]",
+              "version": "[variables('huntingQueryObject122').huntingQueryVersion122]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject123')._huntingQuerycontentId123]",
+              "version": "[variables('huntingQueryObject123').huntingQueryVersion123]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject124')._huntingQuerycontentId124]",
+              "version": "[variables('huntingQueryObject124').huntingQueryVersion124]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject125')._huntingQuerycontentId125]",
+              "version": "[variables('huntingQueryObject125').huntingQueryVersion125]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject126')._huntingQuerycontentId126]",
+              "version": "[variables('huntingQueryObject126').huntingQueryVersion126]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject127')._huntingQuerycontentId127]",
+              "version": "[variables('huntingQueryObject127').huntingQueryVersion127]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject128')._huntingQuerycontentId128]",
+              "version": "[variables('huntingQueryObject128').huntingQueryVersion128]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject129')._huntingQuerycontentId129]",
+              "version": "[variables('huntingQueryObject129').huntingQueryVersion129]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject130')._huntingQuerycontentId130]",
+              "version": "[variables('huntingQueryObject130').huntingQueryVersion130]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject131')._huntingQuerycontentId131]",
+              "version": "[variables('huntingQueryObject131').huntingQueryVersion131]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject132')._huntingQuerycontentId132]",
+              "version": "[variables('huntingQueryObject132').huntingQueryVersion132]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject133')._huntingQuerycontentId133]",
+              "version": "[variables('huntingQueryObject133').huntingQueryVersion133]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject134')._huntingQuerycontentId134]",
+              "version": "[variables('huntingQueryObject134').huntingQueryVersion134]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject135')._huntingQuerycontentId135]",
+              "version": "[variables('huntingQueryObject135').huntingQueryVersion135]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject136')._huntingQuerycontentId136]",
+              "version": "[variables('huntingQueryObject136').huntingQueryVersion136]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject137')._huntingQuerycontentId137]",
+              "version": "[variables('huntingQueryObject137').huntingQueryVersion137]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject138')._huntingQuerycontentId138]",
+              "version": "[variables('huntingQueryObject138').huntingQueryVersion138]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject139')._huntingQuerycontentId139]",
+              "version": "[variables('huntingQueryObject139').huntingQueryVersion139]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject140')._huntingQuerycontentId140]",
+              "version": "[variables('huntingQueryObject140').huntingQueryVersion140]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject141')._huntingQuerycontentId141]",
+              "version": "[variables('huntingQueryObject141').huntingQueryVersion141]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject142')._huntingQuerycontentId142]",
+              "version": "[variables('huntingQueryObject142').huntingQueryVersion142]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject143')._huntingQuerycontentId143]",
+              "version": "[variables('huntingQueryObject143').huntingQueryVersion143]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject144')._huntingQuerycontentId144]",
+              "version": "[variables('huntingQueryObject144').huntingQueryVersion144]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject145')._huntingQuerycontentId145]",
+              "version": "[variables('huntingQueryObject145').huntingQueryVersion145]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject146')._huntingQuerycontentId146]",
+              "version": "[variables('huntingQueryObject146').huntingQueryVersion146]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject147')._huntingQuerycontentId147]",
+              "version": "[variables('huntingQueryObject147').huntingQueryVersion147]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject148')._huntingQuerycontentId148]",
+              "version": "[variables('huntingQueryObject148').huntingQueryVersion148]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject149')._huntingQuerycontentId149]",
+              "version": "[variables('huntingQueryObject149').huntingQueryVersion149]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject150')._huntingQuerycontentId150]",
+              "version": "[variables('huntingQueryObject150').huntingQueryVersion150]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject151')._huntingQuerycontentId151]",
+              "version": "[variables('huntingQueryObject151').huntingQueryVersion151]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject152')._huntingQuerycontentId152]",
+              "version": "[variables('huntingQueryObject152').huntingQueryVersion152]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject153')._huntingQuerycontentId153]",
+              "version": "[variables('huntingQueryObject153').huntingQueryVersion153]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject154')._huntingQuerycontentId154]",
+              "version": "[variables('huntingQueryObject154').huntingQueryVersion154]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject155')._huntingQuerycontentId155]",
+              "version": "[variables('huntingQueryObject155').huntingQueryVersion155]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject156')._huntingQuerycontentId156]",
+              "version": "[variables('huntingQueryObject156').huntingQueryVersion156]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject157')._huntingQuerycontentId157]",
+              "version": "[variables('huntingQueryObject157').huntingQueryVersion157]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject158')._huntingQuerycontentId158]",
+              "version": "[variables('huntingQueryObject158').huntingQueryVersion158]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject159')._huntingQuerycontentId159]",
+              "version": "[variables('huntingQueryObject159').huntingQueryVersion159]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject160')._huntingQuerycontentId160]",
+              "version": "[variables('huntingQueryObject160').huntingQueryVersion160]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject161')._huntingQuerycontentId161]",
+              "version": "[variables('huntingQueryObject161').huntingQueryVersion161]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject162')._huntingQuerycontentId162]",
+              "version": "[variables('huntingQueryObject162').huntingQueryVersion162]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject163')._huntingQuerycontentId163]",
+              "version": "[variables('huntingQueryObject163').huntingQueryVersion163]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject164')._huntingQuerycontentId164]",
+              "version": "[variables('huntingQueryObject164').huntingQueryVersion164]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject165')._huntingQuerycontentId165]",
+              "version": "[variables('huntingQueryObject165').huntingQueryVersion165]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject166')._huntingQuerycontentId166]",
+              "version": "[variables('huntingQueryObject166').huntingQueryVersion166]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject167')._huntingQuerycontentId167]",
+              "version": "[variables('huntingQueryObject167').huntingQueryVersion167]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject168')._huntingQuerycontentId168]",
+              "version": "[variables('huntingQueryObject168').huntingQueryVersion168]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject169')._huntingQuerycontentId169]",
+              "version": "[variables('huntingQueryObject169').huntingQueryVersion169]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject170')._huntingQuerycontentId170]",
+              "version": "[variables('huntingQueryObject170').huntingQueryVersion170]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject171')._huntingQuerycontentId171]",
+              "version": "[variables('huntingQueryObject171').huntingQueryVersion171]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject172')._huntingQuerycontentId172]",
+              "version": "[variables('huntingQueryObject172').huntingQueryVersion172]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject173')._huntingQuerycontentId173]",
+              "version": "[variables('huntingQueryObject173').huntingQueryVersion173]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject174')._huntingQuerycontentId174]",
+              "version": "[variables('huntingQueryObject174').huntingQueryVersion174]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject175')._huntingQuerycontentId175]",
+              "version": "[variables('huntingQueryObject175').huntingQueryVersion175]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject176')._huntingQuerycontentId176]",
+              "version": "[variables('huntingQueryObject176').huntingQueryVersion176]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject177')._huntingQuerycontentId177]",
+              "version": "[variables('huntingQueryObject177').huntingQueryVersion177]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject178')._huntingQuerycontentId178]",
+              "version": "[variables('huntingQueryObject178').huntingQueryVersion178]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject179')._huntingQuerycontentId179]",
+              "version": "[variables('huntingQueryObject179').huntingQueryVersion179]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject180')._huntingQuerycontentId180]",
+              "version": "[variables('huntingQueryObject180').huntingQueryVersion180]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject181')._huntingQuerycontentId181]",
+              "version": "[variables('huntingQueryObject181').huntingQueryVersion181]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject182')._huntingQuerycontentId182]",
+              "version": "[variables('huntingQueryObject182').huntingQueryVersion182]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject183')._huntingQuerycontentId183]",
+              "version": "[variables('huntingQueryObject183').huntingQueryVersion183]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject184')._huntingQuerycontentId184]",
+              "version": "[variables('huntingQueryObject184').huntingQueryVersion184]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject185')._huntingQuerycontentId185]",
+              "version": "[variables('huntingQueryObject185').huntingQueryVersion185]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject186')._huntingQuerycontentId186]",
+              "version": "[variables('huntingQueryObject186').huntingQueryVersion186]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject187')._huntingQuerycontentId187]",
+              "version": "[variables('huntingQueryObject187').huntingQueryVersion187]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject188')._huntingQuerycontentId188]",
+              "version": "[variables('huntingQueryObject188').huntingQueryVersion188]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject189')._huntingQuerycontentId189]",
+              "version": "[variables('huntingQueryObject189').huntingQueryVersion189]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject190')._huntingQuerycontentId190]",
+              "version": "[variables('huntingQueryObject190').huntingQueryVersion190]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject191')._huntingQuerycontentId191]",
+              "version": "[variables('huntingQueryObject191').huntingQueryVersion191]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject192')._huntingQuerycontentId192]",
+              "version": "[variables('huntingQueryObject192').huntingQueryVersion192]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject193')._huntingQuerycontentId193]",
+              "version": "[variables('huntingQueryObject193').huntingQueryVersion193]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject194')._huntingQuerycontentId194]",
+              "version": "[variables('huntingQueryObject194').huntingQueryVersion194]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject195')._huntingQuerycontentId195]",
+              "version": "[variables('huntingQueryObject195').huntingQueryVersion195]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject196')._huntingQuerycontentId196]",
+              "version": "[variables('huntingQueryObject196').huntingQueryVersion196]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject197')._huntingQuerycontentId197]",
+              "version": "[variables('huntingQueryObject197').huntingQueryVersion197]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject198')._huntingQuerycontentId198]",
+              "version": "[variables('huntingQueryObject198').huntingQueryVersion198]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject199')._huntingQuerycontentId199]",
+              "version": "[variables('huntingQueryObject199').huntingQueryVersion199]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject200')._huntingQuerycontentId200]",
+              "version": "[variables('huntingQueryObject200').huntingQueryVersion200]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject201')._huntingQuerycontentId201]",
+              "version": "[variables('huntingQueryObject201').huntingQueryVersion201]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject202')._huntingQuerycontentId202]",
+              "version": "[variables('huntingQueryObject202').huntingQueryVersion202]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject203')._huntingQuerycontentId203]",
+              "version": "[variables('huntingQueryObject203').huntingQueryVersion203]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject204')._huntingQuerycontentId204]",
+              "version": "[variables('huntingQueryObject204').huntingQueryVersion204]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject205')._huntingQuerycontentId205]",
+              "version": "[variables('huntingQueryObject205').huntingQueryVersion205]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject206')._huntingQuerycontentId206]",
+              "version": "[variables('huntingQueryObject206').huntingQueryVersion206]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject207')._huntingQuerycontentId207]",
+              "version": "[variables('huntingQueryObject207').huntingQueryVersion207]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject208')._huntingQuerycontentId208]",
+              "version": "[variables('huntingQueryObject208').huntingQueryVersion208]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject209')._huntingQuerycontentId209]",
+              "version": "[variables('huntingQueryObject209').huntingQueryVersion209]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject210')._huntingQuerycontentId210]",
+              "version": "[variables('huntingQueryObject210').huntingQueryVersion210]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject211')._huntingQuerycontentId211]",
+              "version": "[variables('huntingQueryObject211').huntingQueryVersion211]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject212')._huntingQuerycontentId212]",
+              "version": "[variables('huntingQueryObject212').huntingQueryVersion212]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject213')._huntingQuerycontentId213]",
+              "version": "[variables('huntingQueryObject213').huntingQueryVersion213]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject214')._huntingQuerycontentId214]",
+              "version": "[variables('huntingQueryObject214').huntingQueryVersion214]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject215')._huntingQuerycontentId215]",
+              "version": "[variables('huntingQueryObject215').huntingQueryVersion215]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject216')._huntingQuerycontentId216]",
+              "version": "[variables('huntingQueryObject216').huntingQueryVersion216]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject217')._huntingQuerycontentId217]",
+              "version": "[variables('huntingQueryObject217').huntingQueryVersion217]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject218')._huntingQuerycontentId218]",
+              "version": "[variables('huntingQueryObject218').huntingQueryVersion218]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject219')._huntingQuerycontentId219]",
+              "version": "[variables('huntingQueryObject219').huntingQueryVersion219]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject220')._huntingQuerycontentId220]",
+              "version": "[variables('huntingQueryObject220').huntingQueryVersion220]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject221')._huntingQuerycontentId221]",
+              "version": "[variables('huntingQueryObject221').huntingQueryVersion221]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject222')._huntingQuerycontentId222]",
+              "version": "[variables('huntingQueryObject222').huntingQueryVersion222]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject223')._huntingQuerycontentId223]",
+              "version": "[variables('huntingQueryObject223').huntingQueryVersion223]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject224')._huntingQuerycontentId224]",
+              "version": "[variables('huntingQueryObject224').huntingQueryVersion224]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject225')._huntingQuerycontentId225]",
+              "version": "[variables('huntingQueryObject225').huntingQueryVersion225]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject226')._huntingQuerycontentId226]",
+              "version": "[variables('huntingQueryObject226').huntingQueryVersion226]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject227')._huntingQuerycontentId227]",
+              "version": "[variables('huntingQueryObject227').huntingQueryVersion227]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject228')._huntingQuerycontentId228]",
+              "version": "[variables('huntingQueryObject228').huntingQueryVersion228]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject229')._huntingQuerycontentId229]",
+              "version": "[variables('huntingQueryObject229').huntingQueryVersion229]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject230')._huntingQuerycontentId230]",
+              "version": "[variables('huntingQueryObject230').huntingQueryVersion230]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject231')._huntingQuerycontentId231]",
+              "version": "[variables('huntingQueryObject231').huntingQueryVersion231]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject232')._huntingQuerycontentId232]",
+              "version": "[variables('huntingQueryObject232').huntingQueryVersion232]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject233')._huntingQuerycontentId233]",
+              "version": "[variables('huntingQueryObject233').huntingQueryVersion233]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject234')._huntingQuerycontentId234]",
+              "version": "[variables('huntingQueryObject234').huntingQueryVersion234]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject235')._huntingQuerycontentId235]",
+              "version": "[variables('huntingQueryObject235').huntingQueryVersion235]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject236')._huntingQuerycontentId236]",
+              "version": "[variables('huntingQueryObject236').huntingQueryVersion236]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject237')._huntingQuerycontentId237]",
+              "version": "[variables('huntingQueryObject237').huntingQueryVersion237]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject238')._huntingQuerycontentId238]",
+              "version": "[variables('huntingQueryObject238').huntingQueryVersion238]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject239')._huntingQuerycontentId239]",
+              "version": "[variables('huntingQueryObject239').huntingQueryVersion239]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject240')._huntingQuerycontentId240]",
+              "version": "[variables('huntingQueryObject240').huntingQueryVersion240]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject241')._huntingQuerycontentId241]",
+              "version": "[variables('huntingQueryObject241').huntingQueryVersion241]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject242')._huntingQuerycontentId242]",
+              "version": "[variables('huntingQueryObject242').huntingQueryVersion242]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject243')._huntingQuerycontentId243]",
+              "version": "[variables('huntingQueryObject243').huntingQueryVersion243]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject244')._huntingQuerycontentId244]",
+              "version": "[variables('huntingQueryObject244').huntingQueryVersion244]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject245')._huntingQuerycontentId245]",
+              "version": "[variables('huntingQueryObject245').huntingQueryVersion245]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject246')._huntingQuerycontentId246]",
+              "version": "[variables('huntingQueryObject246').huntingQueryVersion246]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject247')._huntingQuerycontentId247]",
+              "version": "[variables('huntingQueryObject247').huntingQueryVersion247]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject248')._huntingQuerycontentId248]",
+              "version": "[variables('huntingQueryObject248').huntingQueryVersion248]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject249')._huntingQuerycontentId249]",
+              "version": "[variables('huntingQueryObject249').huntingQueryVersion249]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject250')._huntingQuerycontentId250]",
+              "version": "[variables('huntingQueryObject250').huntingQueryVersion250]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject251')._huntingQuerycontentId251]",
+              "version": "[variables('huntingQueryObject251').huntingQueryVersion251]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject252')._huntingQuerycontentId252]",
+              "version": "[variables('huntingQueryObject252').huntingQueryVersion252]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject253')._huntingQuerycontentId253]",
+              "version": "[variables('huntingQueryObject253').huntingQueryVersion253]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject254')._huntingQuerycontentId254]",
+              "version": "[variables('huntingQueryObject254').huntingQueryVersion254]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject255')._huntingQuerycontentId255]",
+              "version": "[variables('huntingQueryObject255').huntingQueryVersion255]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject256')._huntingQuerycontentId256]",
+              "version": "[variables('huntingQueryObject256').huntingQueryVersion256]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject257')._huntingQuerycontentId257]",
+              "version": "[variables('huntingQueryObject257').huntingQueryVersion257]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject258')._huntingQuerycontentId258]",
+              "version": "[variables('huntingQueryObject258').huntingQueryVersion258]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject259')._huntingQuerycontentId259]",
+              "version": "[variables('huntingQueryObject259').huntingQueryVersion259]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject260')._huntingQuerycontentId260]",
+              "version": "[variables('huntingQueryObject260').huntingQueryVersion260]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject261')._huntingQuerycontentId261]",
+              "version": "[variables('huntingQueryObject261').huntingQueryVersion261]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject262')._huntingQuerycontentId262]",
+              "version": "[variables('huntingQueryObject262').huntingQueryVersion262]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject263')._huntingQuerycontentId263]",
+              "version": "[variables('huntingQueryObject263').huntingQueryVersion263]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject264')._huntingQuerycontentId264]",
+              "version": "[variables('huntingQueryObject264').huntingQueryVersion264]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject265')._huntingQuerycontentId265]",
+              "version": "[variables('huntingQueryObject265').huntingQueryVersion265]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject266')._huntingQuerycontentId266]",
+              "version": "[variables('huntingQueryObject266').huntingQueryVersion266]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject267')._huntingQuerycontentId267]",
+              "version": "[variables('huntingQueryObject267').huntingQueryVersion267]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject268')._huntingQuerycontentId268]",
+              "version": "[variables('huntingQueryObject268').huntingQueryVersion268]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject269')._huntingQuerycontentId269]",
+              "version": "[variables('huntingQueryObject269').huntingQueryVersion269]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject270')._huntingQuerycontentId270]",
+              "version": "[variables('huntingQueryObject270').huntingQueryVersion270]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject271')._huntingQuerycontentId271]",
+              "version": "[variables('huntingQueryObject271').huntingQueryVersion271]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject272')._huntingQuerycontentId272]",
+              "version": "[variables('huntingQueryObject272').huntingQueryVersion272]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject273')._huntingQuerycontentId273]",
+              "version": "[variables('huntingQueryObject273').huntingQueryVersion273]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject274')._huntingQuerycontentId274]",
+              "version": "[variables('huntingQueryObject274').huntingQueryVersion274]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject275')._huntingQuerycontentId275]",
+              "version": "[variables('huntingQueryObject275').huntingQueryVersion275]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject276')._huntingQuerycontentId276]",
+              "version": "[variables('huntingQueryObject276').huntingQueryVersion276]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject277')._huntingQuerycontentId277]",
+              "version": "[variables('huntingQueryObject277').huntingQueryVersion277]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject278')._huntingQuerycontentId278]",
+              "version": "[variables('huntingQueryObject278').huntingQueryVersion278]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject279')._huntingQuerycontentId279]",
+              "version": "[variables('huntingQueryObject279').huntingQueryVersion279]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject280')._huntingQuerycontentId280]",
+              "version": "[variables('huntingQueryObject280').huntingQueryVersion280]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject281')._huntingQuerycontentId281]",
+              "version": "[variables('huntingQueryObject281').huntingQueryVersion281]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject282')._huntingQuerycontentId282]",
+              "version": "[variables('huntingQueryObject282').huntingQueryVersion282]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject283')._huntingQuerycontentId283]",
+              "version": "[variables('huntingQueryObject283').huntingQueryVersion283]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject284')._huntingQuerycontentId284]",
+              "version": "[variables('huntingQueryObject284').huntingQueryVersion284]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject285')._huntingQuerycontentId285]",
+              "version": "[variables('huntingQueryObject285').huntingQueryVersion285]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject286')._huntingQuerycontentId286]",
+              "version": "[variables('huntingQueryObject286').huntingQueryVersion286]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject287')._huntingQuerycontentId287]",
+              "version": "[variables('huntingQueryObject287').huntingQueryVersion287]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject288')._huntingQuerycontentId288]",
+              "version": "[variables('huntingQueryObject288').huntingQueryVersion288]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject289')._huntingQuerycontentId289]",
+              "version": "[variables('huntingQueryObject289').huntingQueryVersion289]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject290')._huntingQuerycontentId290]",
+              "version": "[variables('huntingQueryObject290').huntingQueryVersion290]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject291')._huntingQuerycontentId291]",
+              "version": "[variables('huntingQueryObject291').huntingQueryVersion291]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject292')._huntingQuerycontentId292]",
+              "version": "[variables('huntingQueryObject292').huntingQueryVersion292]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject293')._huntingQuerycontentId293]",
+              "version": "[variables('huntingQueryObject293').huntingQueryVersion293]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject294')._huntingQuerycontentId294]",
+              "version": "[variables('huntingQueryObject294').huntingQueryVersion294]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject295')._huntingQuerycontentId295]",
+              "version": "[variables('huntingQueryObject295').huntingQueryVersion295]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject296')._huntingQuerycontentId296]",
+              "version": "[variables('huntingQueryObject296').huntingQueryVersion296]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject297')._huntingQuerycontentId297]",
+              "version": "[variables('huntingQueryObject297').huntingQueryVersion297]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject298')._huntingQuerycontentId298]",
+              "version": "[variables('huntingQueryObject298').huntingQueryVersion298]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject299')._huntingQuerycontentId299]",
+              "version": "[variables('huntingQueryObject299').huntingQueryVersion299]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject300')._huntingQuerycontentId300]",
+              "version": "[variables('huntingQueryObject300').huntingQueryVersion300]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject301')._huntingQuerycontentId301]",
+              "version": "[variables('huntingQueryObject301').huntingQueryVersion301]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject302')._huntingQuerycontentId302]",
+              "version": "[variables('huntingQueryObject302').huntingQueryVersion302]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject303')._huntingQuerycontentId303]",
+              "version": "[variables('huntingQueryObject303').huntingQueryVersion303]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject304')._huntingQuerycontentId304]",
+              "version": "[variables('huntingQueryObject304').huntingQueryVersion304]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject305')._huntingQuerycontentId305]",
+              "version": "[variables('huntingQueryObject305').huntingQueryVersion305]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject306')._huntingQuerycontentId306]",
+              "version": "[variables('huntingQueryObject306').huntingQueryVersion306]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject307')._huntingQuerycontentId307]",
+              "version": "[variables('huntingQueryObject307').huntingQueryVersion307]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject308')._huntingQuerycontentId308]",
+              "version": "[variables('huntingQueryObject308').huntingQueryVersion308]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject309')._huntingQuerycontentId309]",
+              "version": "[variables('huntingQueryObject309').huntingQueryVersion309]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject310')._huntingQuerycontentId310]",
+              "version": "[variables('huntingQueryObject310').huntingQueryVersion310]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject311')._huntingQuerycontentId311]",
+              "version": "[variables('huntingQueryObject311').huntingQueryVersion311]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject312')._huntingQuerycontentId312]",
+              "version": "[variables('huntingQueryObject312').huntingQueryVersion312]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject313')._huntingQuerycontentId313]",
+              "version": "[variables('huntingQueryObject313').huntingQueryVersion313]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject314')._huntingQuerycontentId314]",
+              "version": "[variables('huntingQueryObject314').huntingQueryVersion314]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject315')._huntingQuerycontentId315]",
+              "version": "[variables('huntingQueryObject315').huntingQueryVersion315]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject316')._huntingQuerycontentId316]",
+              "version": "[variables('huntingQueryObject316').huntingQueryVersion316]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject317')._huntingQuerycontentId317]",
+              "version": "[variables('huntingQueryObject317').huntingQueryVersion317]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject318')._huntingQuerycontentId318]",
+              "version": "[variables('huntingQueryObject318').huntingQueryVersion318]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject319')._huntingQuerycontentId319]",
+              "version": "[variables('huntingQueryObject319').huntingQueryVersion319]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject320')._huntingQuerycontentId320]",
+              "version": "[variables('huntingQueryObject320').huntingQueryVersion320]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject321')._huntingQuerycontentId321]",
+              "version": "[variables('huntingQueryObject321').huntingQueryVersion321]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject322')._huntingQuerycontentId322]",
+              "version": "[variables('huntingQueryObject322').huntingQueryVersion322]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject323')._huntingQuerycontentId323]",
+              "version": "[variables('huntingQueryObject323').huntingQueryVersion323]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject324')._huntingQuerycontentId324]",
+              "version": "[variables('huntingQueryObject324').huntingQueryVersion324]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject325')._huntingQuerycontentId325]",
+              "version": "[variables('huntingQueryObject325').huntingQueryVersion325]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject326')._huntingQuerycontentId326]",
+              "version": "[variables('huntingQueryObject326').huntingQueryVersion326]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject327')._huntingQuerycontentId327]",
+              "version": "[variables('huntingQueryObject327').huntingQueryVersion327]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject328')._huntingQuerycontentId328]",
+              "version": "[variables('huntingQueryObject328').huntingQueryVersion328]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject329')._huntingQuerycontentId329]",
+              "version": "[variables('huntingQueryObject329').huntingQueryVersion329]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject330')._huntingQuerycontentId330]",
+              "version": "[variables('huntingQueryObject330').huntingQueryVersion330]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject331')._huntingQuerycontentId331]",
+              "version": "[variables('huntingQueryObject331').huntingQueryVersion331]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject332')._huntingQuerycontentId332]",
+              "version": "[variables('huntingQueryObject332').huntingQueryVersion332]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject333')._huntingQuerycontentId333]",
+              "version": "[variables('huntingQueryObject333').huntingQueryVersion333]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject334')._huntingQuerycontentId334]",
+              "version": "[variables('huntingQueryObject334').huntingQueryVersion334]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject335')._huntingQuerycontentId335]",
+              "version": "[variables('huntingQueryObject335').huntingQueryVersion335]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject336')._huntingQuerycontentId336]",
+              "version": "[variables('huntingQueryObject336').huntingQueryVersion336]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject337')._huntingQuerycontentId337]",
+              "version": "[variables('huntingQueryObject337').huntingQueryVersion337]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject338')._huntingQuerycontentId338]",
+              "version": "[variables('huntingQueryObject338').huntingQueryVersion338]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject339')._huntingQuerycontentId339]",
+              "version": "[variables('huntingQueryObject339').huntingQueryVersion339]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject340')._huntingQuerycontentId340]",
+              "version": "[variables('huntingQueryObject340').huntingQueryVersion340]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject341')._huntingQuerycontentId341]",
+              "version": "[variables('huntingQueryObject341').huntingQueryVersion341]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject342')._huntingQuerycontentId342]",
+              "version": "[variables('huntingQueryObject342').huntingQueryVersion342]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject343')._huntingQuerycontentId343]",
+              "version": "[variables('huntingQueryObject343').huntingQueryVersion343]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject344')._huntingQuerycontentId344]",
+              "version": "[variables('huntingQueryObject344').huntingQueryVersion344]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject345')._huntingQuerycontentId345]",
+              "version": "[variables('huntingQueryObject345').huntingQueryVersion345]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject346')._huntingQuerycontentId346]",
+              "version": "[variables('huntingQueryObject346').huntingQueryVersion346]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject347')._huntingQuerycontentId347]",
+              "version": "[variables('huntingQueryObject347').huntingQueryVersion347]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject348')._huntingQuerycontentId348]",
+              "version": "[variables('huntingQueryObject348').huntingQueryVersion348]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject349')._huntingQuerycontentId349]",
+              "version": "[variables('huntingQueryObject349').huntingQueryVersion349]"
+            },
+            {
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject350')._huntingQuerycontentId350]",
+              "version": "[variables('huntingQueryObject350').huntingQueryVersion350]"
             },
             {
-              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-              "apiVersion": "2023-04-01-preview",
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
-              "properties": {
-                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
-                "contentId": "[variables('_dataConnectorContentId1')]",
-                "kind": "DataConnector",
-                "version": "[variables('dataConnectorVersion1')]",
-                "source": {
-                  "kind": "Solution",
-                  "name": "Microsoft Defender XDR",
-                  "sourceId": "[variables('_solutionId')]"
-                },
-                "author": {
-                  "name": "Microsoft",
-                  "email": "[variables('_email')]"
-                },
-                "support": {
-                  "name": "Microsoft Corporation",
-                  "email": "support@microsoft.com",
-                  "tier": "Microsoft",
-                  "link": "https://support.microsoft.com"
-                }
-              }
-            }
-          ]
-        },
-        "packageKind": "Solution",
-        "packageVersion": "[variables('_solutionVersion')]",
-        "packageName": "[variables('_solutionName')]",
-        "packageId": "[variables('_solutionId')]",
-        "contentSchemaVersion": "3.0.0",
-        "contentId": "[variables('_dataConnectorContentId1')]",
-        "contentKind": "DataConnector",
-        "displayName": "Microsoft Defender XDR",
-        "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
-        "id": "[variables('_dataConnectorcontentProductId1')]",
-        "version": "[variables('dataConnectorVersion1')]"
-      },
-      "condition": "[parameters('DeployDataConnector')]"
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
-      "apiVersion": "2023-04-01-preview",
-      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
-      "dependsOn": [
-        "[variables('_dataConnectorId1')]"
-      ],
-      "location": "[parameters('workspace-location')]",
-      "properties": {
-        "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
-        "contentId": "[variables('_dataConnectorContentId1')]",
-        "kind": "DataConnector",
-        "version": "[variables('dataConnectorVersion1')]",
-        "source": {
-          "kind": "Solution",
-          "name": "Microsoft Defender XDR",
-          "sourceId": "[variables('_solutionId')]"
-        },
-        "author": {
-          "name": "Microsoft",
-          "email": "[variables('_email')]"
-        },
-        "support": {
-          "name": "Microsoft Corporation",
-          "email": "support@microsoft.com",
-          "tier": "Microsoft",
-          "link": "https://support.microsoft.com"
-        }
-      },
-      "condition": "[parameters('DeployDataConnector')]"
-    },
-    {
-      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
-      "apiVersion": "2021-03-01-preview",
-      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
-      "location": "[parameters('workspace-location')]",
-      "kind": "StaticUI",
-      "properties": {
-        "connectorUiConfig": {
-          "title": "Microsoft Defender XDR",
-          "publisher": "Microsoft",
-          "descriptionMarkdown": "Microsoft Defender XDR is a unified, natively integrated, pre- and post-breach enterprise defense suite that protects endpoint, identity, email, and applications and helps you detect, prevent, investigate, and automatically respond to sophisticated threats.\n\nMicrosoft Defender XDR suite includes: \n- Microsoft Defender for Endpoint\n- Microsoft Defender for Identity\n- Microsoft Defender for Office 365\n- Threat & Vulnerability Management\n- Microsoft Defender for Cloud Apps\n\nFor more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2220004&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
-          "graphQueries": [
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject351')._huntingQuerycontentId351]",
+              "version": "[variables('huntingQueryObject351').huntingQueryVersion351]"
+            },
             {
-              "metricName": "Total data received",
-              "legend": "Incidents",
-              "baseQuery": "SecurityIncident \n| where ProviderName == \"Microsoft 365 Defender\""
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject352')._huntingQuerycontentId352]",
+              "version": "[variables('huntingQueryObject352').huntingQueryVersion352]"
             },
             {
-              "metricName": "Total data received",
-              "legend": "Alerts",
-              "baseQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject353')._huntingQuerycontentId353]",
+              "version": "[variables('huntingQueryObject353').huntingQueryVersion353]"
             },
             {
-              "metricName": "Total data received",
-              "legend": "Endpoint Events",
-              "baseQuery": "DeviceEvents| union isfuzzy=true DeviceFileEvents| union isfuzzy=true DeviceImageLoadEvents| union isfuzzy=true DeviceInfo| union isfuzzy=true DeviceLogonEvents| union isfuzzy=true DeviceNetworkEvents| union isfuzzy=true DeviceNetworkInfo| union isfuzzy=true DeviceProcessEvents| union isfuzzy=true DeviceRegistryEvents| union isfuzzy=true DeviceFileCertificateInfo"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject354')._huntingQuerycontentId354]",
+              "version": "[variables('huntingQueryObject354').huntingQueryVersion354]"
             },
             {
-              "metricName": "Total data received",
-              "legend": "Office Events",
-              "baseQuery": "EmailEvents| union isfuzzy=true EmailUrlInfo| union isfuzzy=true EmailAttachmentInfo| union isfuzzy=true EmailPostDeliveryEvents"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject355')._huntingQuerycontentId355]",
+              "version": "[variables('huntingQueryObject355').huntingQueryVersion355]"
             },
             {
-              "metricName": "Total data received",
-              "legend": "Identity Events",
-              "baseQuery": "IdentityLogonEvents| union isfuzzy=true IdentityQueryEvents| union isfuzzy=true IdentityDirectoryEvents"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject356')._huntingQuerycontentId356]",
+              "version": "[variables('huntingQueryObject356').huntingQueryVersion356]"
             },
             {
-              "metricName": "Total data received",
-              "legend": "Cloud app Events",
-              "baseQuery": "CloudAppEvents"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject357')._huntingQuerycontentId357]",
+              "version": "[variables('huntingQueryObject357').huntingQueryVersion357]"
             },
             {
-              "metricName": "Total data received",
-              "legend": "Defender Alert Evidence",
-              "baseQuery": "AlertEvidence"
-            }
-          ],
-          "dataTypes": [
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject358')._huntingQuerycontentId358]",
+              "version": "[variables('huntingQueryObject358').huntingQueryVersion358]"
+            },
             {
-              "name": "SecurityIncident",
-              "lastDataReceivedQuery": "SecurityIncident \n| where ProviderName == \"Microsoft 365 Defender\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject359')._huntingQuerycontentId359]",
+              "version": "[variables('huntingQueryObject359').huntingQueryVersion359]"
             },
             {
-              "name": "SecurityAlert",
-              "lastDataReceivedQuery": "SecurityAlert \n| where ProductName in(\"Microsoft Defender Advanced Threat Protection\",\"Office 365 Advanced Threat Protection\",\"Azure Advanced Threat Protection\",\"Microsoft Cloud App Security\",\"Microsoft 365 Defender\",\"Microsoft Defender XDR\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject360')._huntingQuerycontentId360]",
+              "version": "[variables('huntingQueryObject360').huntingQueryVersion360]"
             },
             {
-              "name": "DeviceEvents",
-              "lastDataReceivedQuery": "DeviceEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject361')._huntingQuerycontentId361]",
+              "version": "[variables('huntingQueryObject361').huntingQueryVersion361]"
             },
             {
-              "name": "DeviceFileEvents",
-              "lastDataReceivedQuery": "DeviceFileEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject362')._huntingQuerycontentId362]",
+              "version": "[variables('huntingQueryObject362').huntingQueryVersion362]"
             },
             {
-              "name": "DeviceImageLoadEvents",
-              "lastDataReceivedQuery": "DeviceImageLoadEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject363')._huntingQuerycontentId363]",
+              "version": "[variables('huntingQueryObject363').huntingQueryVersion363]"
             },
             {
-              "name": "DeviceInfo",
-              "lastDataReceivedQuery": "DeviceInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject364')._huntingQuerycontentId364]",
+              "version": "[variables('huntingQueryObject364').huntingQueryVersion364]"
             },
             {
-              "name": "DeviceLogonEvents",
-              "lastDataReceivedQuery": "DeviceLogonEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject365')._huntingQuerycontentId365]",
+              "version": "[variables('huntingQueryObject365').huntingQueryVersion365]"
             },
             {
-              "name": "DeviceNetworkEvents",
-              "lastDataReceivedQuery": "DeviceNetworkEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject366')._huntingQuerycontentId366]",
+              "version": "[variables('huntingQueryObject366').huntingQueryVersion366]"
             },
             {
-              "name": "DeviceNetworkInfo",
-              "lastDataReceivedQuery": "DeviceNetworkInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject367')._huntingQuerycontentId367]",
+              "version": "[variables('huntingQueryObject367').huntingQueryVersion367]"
             },
             {
-              "name": "DeviceProcessEvents",
-              "lastDataReceivedQuery": "DeviceProcessEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject368')._huntingQuerycontentId368]",
+              "version": "[variables('huntingQueryObject368').huntingQueryVersion368]"
             },
             {
-              "name": "DeviceRegistryEvents",
-              "lastDataReceivedQuery": "DeviceRegistryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject369')._huntingQuerycontentId369]",
+              "version": "[variables('huntingQueryObject369').huntingQueryVersion369]"
             },
             {
-              "name": "DeviceFileCertificateInfo",
-              "lastDataReceivedQuery": "DeviceFileCertificateInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject370')._huntingQuerycontentId370]",
+              "version": "[variables('huntingQueryObject370').huntingQueryVersion370]"
             },
             {
-              "name": "EmailEvents",
-              "lastDataReceivedQuery": "EmailEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject371')._huntingQuerycontentId371]",
+              "version": "[variables('huntingQueryObject371').huntingQueryVersion371]"
             },
             {
-              "name": "EmailUrlInfo",
-              "lastDataReceivedQuery": "EmailUrlInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject372')._huntingQuerycontentId372]",
+              "version": "[variables('huntingQueryObject372').huntingQueryVersion372]"
             },
             {
-              "name": "EmailAttachmentInfo",
-              "lastDataReceivedQuery": "EmailAttachmentInfo\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject373')._huntingQuerycontentId373]",
+              "version": "[variables('huntingQueryObject373').huntingQueryVersion373]"
             },
             {
-              "name": "EmailPostDeliveryEvents",
-              "lastDataReceivedQuery": "EmailPostDeliveryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject374')._huntingQuerycontentId374]",
+              "version": "[variables('huntingQueryObject374').huntingQueryVersion374]"
             },
             {
-              "name": "UrlClickEvents",
-              "lastDataReceivedQuery": "UrlClickEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject375')._huntingQuerycontentId375]",
+              "version": "[variables('huntingQueryObject375').huntingQueryVersion375]"
             },
             {
-              "name": "IdentityLogonEvents",
-              "lastDataReceivedQuery": "IdentityLogonEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject376')._huntingQuerycontentId376]",
+              "version": "[variables('huntingQueryObject376').huntingQueryVersion376]"
             },
             {
-              "name": "IdentityQueryEvents",
-              "lastDataReceivedQuery": "IdentityQueryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject377')._huntingQuerycontentId377]",
+              "version": "[variables('huntingQueryObject377').huntingQueryVersion377]"
             },
             {
-              "name": "IdentityDirectoryEvents",
-              "lastDataReceivedQuery": "IdentityDirectoryEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject378')._huntingQuerycontentId378]",
+              "version": "[variables('huntingQueryObject378').huntingQueryVersion378]"
             },
             {
-              "name": "CloudAppEvents",
-              "lastDataReceivedQuery": "CloudAppEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject379')._huntingQuerycontentId379]",
+              "version": "[variables('huntingQueryObject379').huntingQueryVersion379]"
             },
             {
-              "name": "AlertEvidence",
-              "lastDataReceivedQuery": "AlertEvidence\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
-            }
-          ],
-          "connectivityCriterias": [
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject380')._huntingQuerycontentId380]",
+              "version": "[variables('huntingQueryObject380').huntingQueryVersion380]"
+            },
             {
-              "type": "SentinelKinds",
-              "value": [
-                "MicrosoftThreatProtection"
-              ]
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject381')._huntingQuerycontentId381]",
+              "version": "[variables('huntingQueryObject381').huntingQueryVersion381]"
             },
             {
-              "type": "MtpAlerts",
-              "value": [
-                "AzureAdvancedThreatProtection",
-                "MicrosoftCloudAppSecurity",
-                "MicrosoftThreatProtection",
-                "OfficeATP",
-                "MicrosoftDefenderAdvancedThreatProtection",
-                "AzureActiveDirectory",
-                "OfficeIRM"
-              ]
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject382')._huntingQuerycontentId382]",
+              "version": "[variables('huntingQueryObject382').huntingQueryVersion382]"
             },
             {
-              "type": "IsConnectedQuery",
-              "value": [
-                "DeviceEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceFileEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceImageLoadEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceLogonEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceNetworkEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceNetworkInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceProcessEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceRegistryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "DeviceFileCertificateInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-              ]
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject383')._huntingQuerycontentId383]",
+              "version": "[variables('huntingQueryObject383').huntingQueryVersion383]"
             },
             {
-              "type": "IsConnectedQuery",
-              "value": [
-                "EmailEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "EmailUrlInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "EmailAttachmentInfo\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "EmailPostDeliveryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "UrlClickEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-              ]
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject384')._huntingQuerycontentId384]",
+              "version": "[variables('huntingQueryObject384').huntingQueryVersion384]"
             },
             {
-              "type": "IsConnectedQuery",
-              "value": [
-                "IdentityLogonEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "IdentityQueryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
-                "IdentityDirectoryEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-              ]
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject385')._huntingQuerycontentId385]",
+              "version": "[variables('huntingQueryObject385').huntingQueryVersion385]"
             },
             {
-              "type": "IsConnectedQuery",
-              "value": [
-                "CloudAppEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-              ]
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject386')._huntingQuerycontentId386]",
+              "version": "[variables('huntingQueryObject386').huntingQueryVersion386]"
             },
             {
-              "type": "IsConnectedQuery",
-              "value": [
-                "AlertEvidence\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
-              ]
-            }
-          ],
-          "id": "[variables('_uiConfigId1')]"
-        }
-      },
-      "condition": "[parameters('DeployDataConnector')]"
-    },
-    {
-      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
-      "apiVersion": "2023-04-01-preview",
-      "location": "[parameters('workspace-location')]",
-      "properties": {
-        "version": "3.2.1",
-        "kind": "Solution",
-        "contentSchemaVersion": "3.0.0",
-        "displayName": "Microsoft Defender XDR",
-        "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
-        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Defender%20XDR/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>Workbook-only authoring candidate for Microsoft Defender XDR: Defender for Endpoint, Defender for Identity, and Office 365 Detections &amp; Insights. Includes the Microsoft Defender XDR connector prerequisite for panels using connected Sentinel SecurityAlert data. Detection rules, hunting queries, playbooks, and Sentinel workbook installation are excluded. Live installation and runtime qualification are not established.</p>\n<p><strong>Data Connectors:</strong> 1, <strong>XDR Workbooks:</strong> 3</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
-        "contentKind": "Solution",
-        "contentProductId": "[variables('_solutioncontentProductId')]",
-        "id": "[variables('_solutioncontentProductId')]",
-        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
-        "contentId": "[variables('_solutionId')]",
-        "parentId": "[variables('_solutionId')]",
-        "source": {
-          "kind": "Solution",
-          "name": "Microsoft Defender XDR",
-          "sourceId": "[variables('_solutionId')]"
-        },
-        "author": {
-          "name": "Microsoft",
-          "email": "[variables('_email')]"
-        },
-        "support": {
-          "name": "Microsoft Corporation",
-          "email": "support@microsoft.com",
-          "tier": "Microsoft",
-          "link": "https://support.microsoft.com"
-        },
-        "dependencies": {
-          "operator": "AND",
-          "criteria": [
+              "kind": "HuntingQuery",
+              "contentId": "[variables('huntingQueryObject387')._huntingQuerycontentId387]",
+              "version": "[variables('huntingQueryObject387').huntingQueryVersion387]"
+            },
             {
-              "kind": "DataConnector",
-              "contentId": "[variables('_dataConnectorContentId1')]",
-              "version": "[variables('dataConnectorVersion1')]"
+              "kind": "Workbook",
+              "contentId": "[variables('_workbookContentId1')]",
+              "version": "[variables('workbookVersion1')]"
+            },
+            {
+              "kind": "Workbook",
+              "contentId": "[variables('_workbookContentId2')]",
+              "version": "[variables('workbookVersion2')]"
+            },
+            {
+              "kind": "Workbook",
+              "contentId": "[variables('_workbookContentId3')]",
+              "version": "[variables('workbookVersion3')]"
             },
             {
               "kind": "DefenderWorkbook",
diff --git a/Solutions/Microsoft Defender XDR/Package/testParameters.json b/Solutions/Microsoft Defender XDR/Package/testParameters.json
index 5914695ae20..15c9fa70626 100644
--- a/Solutions/Microsoft Defender XDR/Package/testParameters.json	
+++ b/Solutions/Microsoft Defender XDR/Package/testParameters.json	
@@ -21,6 +21,44 @@
       "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
     }
   },
+  "workbook1-name": {
+    "type": "string",
+    "defaultValue": "Microsoft Defender for Office 365 Detections and Insights",
+    "minLength": 1,
+    "metadata": {
+      "description": "Name for the workbook"
+    }
+  },
+  "workbook2-name": {
+    "type": "string",
+    "defaultValue": "Microsoft Defender For EndPoint",
+    "minLength": 1,
+    "metadata": {
+      "description": "Name for the workbook"
+    }
+  },
+  "workbook3-name": {
+    "type": "string",
+    "defaultValue": "Microsoft Defender For Identity",
+    "minLength": 1,
+    "metadata": {
+      "description": "Name for the workbook"
+    }
+  },
+  "DeployAnalyticsRule": {
+    "type": "bool",
+    "defaultValue": true,
+    "metadata": {
+      "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
+    }
+  },
+  "DeployWorkbook": {
+    "type": "bool",
+    "defaultValue": true,
+    "metadata": {
+      "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
+    }
+  },
   "DeployDefenderWorkbook": {
     "type": "bool",
     "defaultValue": false,
@@ -34,5 +72,12 @@
     "metadata": {
       "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
     }
+  },
+  "DeployHuntingQuery": {
+    "type": "bool",
+    "defaultValue": true,
+    "metadata": {
+      "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution."
+    }
   }
 }

From 096dbda44483dc66863de68d416869e9bcb1f23e Mon Sep 17 00:00:00 2001
From: v-skharode <v-skharode@microsoft.com>
Date: Thu, 15 Oct 2026 11:52:58 +0530
Subject: [PATCH 3/7] Updated ReleaseNotes

added latest version row.
---
 Solutions/Microsoft Defender XDR/ReleaseNotes.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Solutions/Microsoft Defender XDR/ReleaseNotes.md b/Solutions/Microsoft Defender XDR/ReleaseNotes.md
index d0d51208f2e..06da13b7b79 100644
--- a/Solutions/Microsoft Defender XDR/ReleaseNotes.md	
+++ b/Solutions/Microsoft Defender XDR/ReleaseNotes.md	
@@ -1,5 +1,6 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                                    |
 |-------------|--------------------------------|---------------------------------------------------------------------------------------|
+| 3.2.1       | 15-10-2026                     | Added **XDR Workbooks** for Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Defender for Office 365 Detections and Insights, extending the solution's visualization coverage across endpoint, identity, and email security. |
 | 3.0.18       | 03-09-2026                     | Added 57 new **Hunting Queries** for Microsoft Defender for Office 365 email and collaboration protection. Updated the **Workbook** Microsoft Defender for Office 365 Detections and Insights to version 4.0.0, adding Microsoft Teams collaboration and file malware coverage, and additional Advanced Hunting data types. |
 | 3.0.17       | 12-08-2026                     | Updated **Analytic Rule** AnomalousVoulmeOfFileDeletion.yaml to add `AzureActiveDirectory` connector with `SigninLogs` data type. Fixed deploy button URLs in **Playbook** AttackSimulatorTrainingNonReporters readme to include the correct 'master' branch path. |
 | 3.0.16       | 12-08-2026                     | Updated KQL projection ordering in the **Unusual Volume of file deletion by users** analytic rules and hunting queries |

From 2dc6f2879e14cf6c3d92a3fa8b6eb8cf33e94f2d Mon Sep 17 00:00:00 2001
From: v-skharode <v-skharode@microsoft.com>
Date: Thu, 15 Oct 2026 12:14:42 +0530
Subject: [PATCH 4/7] Updated ReleaseNotes

description updated.
---
 Solutions/Microsoft Defender XDR/ReleaseNotes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Solutions/Microsoft Defender XDR/ReleaseNotes.md b/Solutions/Microsoft Defender XDR/ReleaseNotes.md
index 06da13b7b79..3e555c699e2 100644
--- a/Solutions/Microsoft Defender XDR/ReleaseNotes.md	
+++ b/Solutions/Microsoft Defender XDR/ReleaseNotes.md	
@@ -1,6 +1,6 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                                    |
 |-------------|--------------------------------|---------------------------------------------------------------------------------------|
-| 3.2.1       | 15-10-2026                     | Added **XDR Workbooks** for Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Defender for Office 365 Detections and Insights, extending the solution's visualization coverage across endpoint, identity, and email security. |
+| 3.2.1       | 15-10-2026                     | Added 3 **XDR Workbooks** alongside the existing Sentinel workbooks. |
 | 3.0.18       | 03-09-2026                     | Added 57 new **Hunting Queries** for Microsoft Defender for Office 365 email and collaboration protection. Updated the **Workbook** Microsoft Defender for Office 365 Detections and Insights to version 4.0.0, adding Microsoft Teams collaboration and file malware coverage, and additional Advanced Hunting data types. |
 | 3.0.17       | 12-08-2026                     | Updated **Analytic Rule** AnomalousVoulmeOfFileDeletion.yaml to add `AzureActiveDirectory` connector with `SigninLogs` data type. Fixed deploy button URLs in **Playbook** AttackSimulatorTrainingNonReporters readme to include the correct 'master' branch path. |
 | 3.0.16       | 12-08-2026                     | Updated KQL projection ordering in the **Unusual Volume of file deletion by users** analytic rules and hunting queries |

From d71e5299865635935168ce5fbb5855f7d6e9b109 Mon Sep 17 00:00:00 2001
From: v-skharode <v-skharode@microsoft.com>
Date: Thu, 15 Oct 2026 14:09:08 +0530
Subject: [PATCH 5/7] updated releasenotes

updated releasenotes
---
 Solutions/Microsoft Defender XDR/ReleaseNotes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Solutions/Microsoft Defender XDR/ReleaseNotes.md b/Solutions/Microsoft Defender XDR/ReleaseNotes.md
index 3e555c699e2..d043207945a 100644
--- a/Solutions/Microsoft Defender XDR/ReleaseNotes.md	
+++ b/Solutions/Microsoft Defender XDR/ReleaseNotes.md	
@@ -1,6 +1,6 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                                    |
 |-------------|--------------------------------|---------------------------------------------------------------------------------------|
-| 3.2.1       | 15-10-2026                     | Added 3 **XDR Workbooks** alongside the existing Sentinel workbooks. |
+| 3.2.1       | 15-10-2026                      | Added 3 **XDR Workbooks** alongside the existing Sentinel workbooks. |
 | 3.0.18       | 03-09-2026                     | Added 57 new **Hunting Queries** for Microsoft Defender for Office 365 email and collaboration protection. Updated the **Workbook** Microsoft Defender for Office 365 Detections and Insights to version 4.0.0, adding Microsoft Teams collaboration and file malware coverage, and additional Advanced Hunting data types. |
 | 3.0.17       | 12-08-2026                     | Updated **Analytic Rule** AnomalousVoulmeOfFileDeletion.yaml to add `AzureActiveDirectory` connector with `SigninLogs` data type. Fixed deploy button URLs in **Playbook** AttackSimulatorTrainingNonReporters readme to include the correct 'master' branch path. |
 | 3.0.16       | 12-08-2026                     | Updated KQL projection ordering in the **Unusual Volume of file deletion by users** analytic rules and hunting queries |

From 1e2cba9920f18c875beb40cbdd644d6824ef2f78 Mon Sep 17 00:00:00 2001
From: v-skharode <v-skharode@microsoft.com>
Date: Thu, 15 Oct 2026 14:12:32 +0530
Subject: [PATCH 6/7] updated releasenotes

updated releasenotes
---
 Solutions/Microsoft Defender XDR/ReleaseNotes.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Solutions/Microsoft Defender XDR/ReleaseNotes.md b/Solutions/Microsoft Defender XDR/ReleaseNotes.md
index d043207945a..cb5ecda615b 100644
--- a/Solutions/Microsoft Defender XDR/ReleaseNotes.md	
+++ b/Solutions/Microsoft Defender XDR/ReleaseNotes.md	
@@ -1,6 +1,6 @@
-| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                                    |
-|-------------|--------------------------------|---------------------------------------------------------------------------------------|
-| 3.2.1       | 15-10-2026                      | Added 3 **XDR Workbooks** alongside the existing Sentinel workbooks. |
+| **Version**  | **Date Modified (DD-MM-YYYY)**   | **Change History**                                                                    |
+|--------------|--------------------------------|---------------------------------------------------------------------------------------|
+| 3.2.1        | 15-10-2026                      | Added 3 **XDR Workbooks** alongside the existing Sentinel workbooks. |
 | 3.0.18       | 03-09-2026                     | Added 57 new **Hunting Queries** for Microsoft Defender for Office 365 email and collaboration protection. Updated the **Workbook** Microsoft Defender for Office 365 Detections and Insights to version 4.0.0, adding Microsoft Teams collaboration and file malware coverage, and additional Advanced Hunting data types. |
 | 3.0.17       | 12-08-2026                     | Updated **Analytic Rule** AnomalousVoulmeOfFileDeletion.yaml to add `AzureActiveDirectory` connector with `SigninLogs` data type. Fixed deploy button URLs in **Playbook** AttackSimulatorTrainingNonReporters readme to include the correct 'master' branch path. |
 | 3.0.16       | 12-08-2026                     | Updated KQL projection ordering in the **Unusual Volume of file deletion by users** analytic rules and hunting queries |

From 78c8f085997c15fdc63801b8ef28913a041d221e Mon Sep 17 00:00:00 2001
From: kingwil <5839248+kingwil@users.noreply.github.com>
Date: Thu, 15 Oct 2026 09:59:58 +0100
Subject: [PATCH 7/7] Add Defender XDR Partner Center usage attribution marker

Use the exact offer tracking ID supplied by the owner in SolutionMetadata.json. Regenerate the additive 3.2.1 candidate with V3.1. The sole semantic ARM change is the empty unconditional root attribution deployment; existing content remains unchanged.

Automatic ARM-TTK still fails inner-template extraction. This is not full validation or Partner Center acceptance.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../Microsoft Defender XDR/Package/3.2.1.zip  | Bin 554561 -> 554686 bytes
 .../Package/mainTemplate.json                 | 845 +++++++++---------
 .../SolutionMetadata.json                     |   1 +
 3 files changed, 430 insertions(+), 416 deletions(-)

diff --git a/Solutions/Microsoft Defender XDR/Package/3.2.1.zip b/Solutions/Microsoft Defender XDR/Package/3.2.1.zip
index 4b523235a4d68ba01efb3c61d87a86098cb5b95c..4d490cd5ccc29dddc7f49bab8a347497eda0e5bb 100644
GIT binary patch
delta 478630
zcmY(qWmqJ^vMq}1;O=gXySuyV;6Atw4vo7v?#|#aFzDbmxVyW%`(xkpzI*rSAKmp;
zXH{j!S{W6wBD3d=tn-`<NktwK3KI+r3=WJ?S-BqRmpk&;uL0(=@0i>tEST^^L!Ude
zG;l0-SLS0&yT|iUxT#1|zHmeEaNT*i=Er1myC0SI<3`*IKm<K`suT<ve7U4E<M|8+
zJ^_<1k^J6C*L@m|$bh_uk}VM|;%z?|7qWSkoe(ifzwy<fS$!o?MBO*?Pb(Bg$$-8u
zf`+18w60Hx`x<c*e(JPMIuY1bB<oQ+Be3Yl&)4y|<EH8xfBejy=%*<xc2&KxfijW#
z;>L7Mv%0zaDy3N`Z)3DeE&`Z~$4sfR#S_p(xBGSeoym7~U--isbcJMW*K0ZzPC7=*
z`6UjbvRNCCZ_Tz`G48W$NVKUITcz_s7t2~*ZcinpPw2L;@YHhAtxuT0GLx|zY=CR7
z_~)hbKS_miD^fyZ{ku+a<Cbl>S2~m$j#D=wj7~6h!Xjr(nS`J#s7nT_DhEAQswcYZ
zzY#pz7sX~NnoTu(OZC}jAXRSKF72z!{fJ`z4UNsNsx`L0qn>Z0rZv`fosTpR%7X0s
zfktpZz~!`RgXdnkXw%4GHN|u(RRg5!?8nv#`maaeuX0g8<cG%QF58HK6aHgcIKl7m
zZ<zi`&=Q|jQZJ%-O{E}Bl}^ie@P8hlH&)@?Y|`!rd$Q8JmOI^)4ZeqcipRL~?M$?N
z{p6<{ff(mNnn;s8%YPYlw{!i{^c%cFyZfv)5JN2HBY&2y4XJtAKGA=aA&*q?%c`FT
z|I4Z^^8udUn@x<bR(@oqn&~VB@g+G_+UrgPBr89b(RGH9HU2luoK4sHs~$N`CJ&^!
zV7_ax$PRd=yBzDK^CyohC5iT5BUt#qw+H?YYW<99ZdGBd-6}S<t9@bf&ahuFbMxnD
z^|6i5IP7Ka$P+5d{r3>e7V&sWmq|n>KCv;Ef|JPJa|0P?1_g&sP})jz+BpW&0`&j)
zkfm1b?_kfti{X1!@@7LE$yV!}+NaMv;DHyZC_1y4M!jACi>cfW{O4Srxts(_eb)T3
zsjRq-FN67xkCFT=>z2<FC|^WP9%HmDtV;L!KTNGk|7kYsl2s#4SR`H5IUN=v3OVEU
zZHLdY$lk17bE8#W-8ZrLa^Sy-+5$~S%di>*RP&kYlUl8dU<XTkRH|GjL|p|iAEfa?
zr<xQtrbjCWR>=NfJyp-QaQBI&_7q<hELuO!g1K;4?6YsS9~vYYJxShx@L_gGVCa$f
z!HSayp$VEX)ry4`Z04=2H{<w@WY_4Ug(!By(AQ)Ka%+EgFZ;Wg_%#hmi~a{-;Q!1U
zKLjY-D#ews)l2cc!ed;mvT5+}GfRwiMZ3&>oLC%w=v3qX*Bx7ix<jt)uw@p88C#J~
zx7j*AWM7vRCbFjWi*Is6xz<t4MdP9WYpk)dT~^##Qti_=xc0M6-7Wjwu&S<8&Cczj
zz!7GA=AQ@*egCib3-=KG6Zz27ZVt`h`E|3bP7RCfb*uK@i)T-k9e#M=e(@)c=D%k^
zn_>Ry5Ynth=}PMKV0Ed<9|d_`13snZ^^43BzoRcQJUKA^FY8=)_g4olb7bQBY5`gI
zux;-PveidV9$;%$UFCu`zS#D}oo4(6?(6>p_l!GhU1^ntA9rmsyT)YOVe|+Yrk@Ko
zZg!xgD~odg$C;GY^8Z=rbdb@Mi!Y(ea_Uckxy))EzS5*hPk|pSKswcs<Euk;Ka&4{
zdjkK1Z{?uMXEA>rpHw?iO;5`%Zg5R>tixvgm|@YPLo%~TK3!+TqAKfuIZ{rCJDFL|
z^|<Mv*&kVVjBp-Yv2n|`yrs)a#eZYI&^5yUZ~O2`TlXC|!YGb*pK~$TG7_MpKg1d~
z%)7Q1$BqNFj&~!!uJ~^J-)=Du(aiwSgP`BqxGutjR5rI{B$*Q?*a5Q8P5yQ2-iU#z
z?!V`I9t2}ndW#i7H8rKyaZ=#4wr;RY^KxUhXxB8YpTKd~65W3{=dHq=w*G0S0>#qO
z_!>(b7dZaVZT%-liQw_oeU!0woLQT$Fg;R%71AR5HXNke&jfr7fD=NrbJ@)%WQM{(
zq_km*vpqtC#r#eTFPU_)z*^V*mb6dy0>}$eUbq3H;``ujI2`V@YE<c9+7cT7don(x
z(@39`J4pDk2LkJ}Het5BNsEAx5e%QMA`S<gGHp$a#qkp(DD1!{C53Eld^7ajCCppk
zLqc75K7ShK(*k~q=mm*0_9RGM?4C>;^*UHXNQx~w4ky@f;H3^)96y{aKAh;Y-X4r_
zx?b>Du$gJ4zh+}umg|}jZ&k4%T7_Qx1b?JTo)gfa;*3sl(^Zgf{!W$Lm{L~Ejck%M
z;uV(E^iW=0ttPj^CqiY91t|ZY_KiR5<W>M$Ggv@YNoM^67ewmNW=>Gw)d&DYZ?C$r
zp3t7ayQK)!CX&1rBlL^^sPQuNZ60Y=R%2&!g^in6n|lusRttwJB#xrb#JlFk5|dsk
zGx11H`EAk^BeiPHfh0^CpDaL?$tFNGs&{N0$;@lkpDLj9Y%OO^D<)0ctm%jqJ63Kk
zp$MEo;p?XvLldqK)tS5R0x>7C9KG%Y?^F8N>oQkxlF)Oy{k61+xI<k<@vJ)9`yu`Y
zA3IfxIPn(nN|~S$>nSi7Wnlt47vGQN0WLYp@RC;<4_6$2Ci8X_IRc-wO`0z)SoQ0t
zCH1X1sT;>YvZPsxKeL$hC*2u*hN<VNgdEVw*QoZC-b#J!DqR5{WcBo@D>7jxgmf9%
zwrq{ucrZt_<Kv5bUYM5sPR;WgZ%%^BhhUL5)u}(A=c_|CCx*yE%w@c1bezT78smef
z&iEofOi}&ZeoijCE_0pchb!x5Y>~<pD@E^`Iv9Uer(gU+&1UV$4>E&5NiOH~p#?z<
z2?B`;KN=l6)dN}1w3(=skXRXxDXtG9*klL6Q=O(!A_7@l6DC7BssfCCg5W@uSC9ZW
zmw;SSnXzA#GD>w4{@vSajHo7YDB;ogh1)p#NQrc%hKj2FotLVD6=DYIsFOI>6IL>L
zYxAolk>uUPkqK@wRPZFZvO=LfgSp(&;6OAXE94|X_zUG<0R%}rGD;9ZB|HT6XrpLB
z7rYit+^!K%#IfmtY?*BWB8z0=wwV%}6}FkyuTVBW`KOKy?@`~;-UV)P;p-#?0f$Fi
zhJ=eMZFf&&qBxz*0bP#*BI?9o%uFaEJlXRJq$~_j?|!0Ya0cf6;>gWbR|xZWiwYoX
zKjPblfqFu0i^t)jvx1AoPl6BS9M@S6f>^27c;y>A8(`@~E1Yb_Pug5r<mQ1xCxZ_=
z_R9vwy1L_I-MEK1$TQ{cV#$Vu=_63&KTRNW$GEQ`nZ76Gl0L*qImhdjXmv~38Rf8F
z)jymG3QI2M!VIUfG?bC$qhDNndSj`DsW?|?s&m%Ufu1+{zaHh0W_CesDf%K((q*t*
z?$d0cH73^#f)Uz#i7OJqx5`V{JmMNH4V%EcyisGR1c$3!?}1o{QcndTr!&lEb0(mX
z>nkLQtCq~3H2JoAfn9r$#|HEowHT(_tIVLrKVw5V^R%n$?FxH%L!dDLW8(KX<^lf0
z4d+<pYaRr%_F6?xX!25SH&<ilIuXuIl;>Td1iCN_p49ixFtr$B`kA|5Io@>=?ezG+
z6rWf^OSFy7UJ2yn1wFQ3VTb2TmDPc-Tby?9W7HO2>dFHs`*o>5y-dJm&``Sijwn)Y
zM+4;0RsPO<Xu3T_3lV-wWi&YS6W4Q7JTt4=?~H3)&PLnwg*%7%uP+)8N$Vct_#Y&j
zNcwq7Y!cC*&5gj3shu9F7q6)kbjUMb<2-uoTT8e7#WK<(&-bP@43l%aIM@ZAFA}^H
zpsi3w6j^OK$R)ga<Ja$11Ibyll$=F?G)IuwH;^R2Z`xRHaiveA!-6?UU8p?ovOC#K
z!soDrZ^$ZzeMi2bGe9zd0~*0Yx9aRP;ceuOGWpF!*iD0j8}UoC9sb>^_RN<mAXSbZ
z5+H$Zi_qI@wyaA0(tc3&(gN82ruR78zkTC0B;eI6cx6}`zYM#vJm2uK?f#^`W#Bz0
z6k%}kN9o}k!M|-}&oHusEB<zKq>4E=0!~GOJOG{pMPG8_>CZ?f$XS9V<jcbkcNWV%
z;@>g!H4UPsWVLnuXlbtl)VJaAFvW9AN7`yVJUp1gtu~#)TXwqUa-%@^#6|8X^UmBv
zrIpntyd#%~w!S@Yldjd=TQ;ulzCHh8>Xr^TIRYFM4P-D1$H})9^(_;ZY#w5}NzZcj
zL6e)j-{B6-fk~G0!KpnCBSs@yKIv~|cFn8u`Ni;0EEWk|@Q%zOzf1S~lEqTBr<L*`
zOU@U<spCVcJqh5G**JkDl#>O=Ubdx(ii@zrKUb1FIBzW&cVOv)zd5$p@7G1vzfYMb
za&<aV1pPjE72g%;Gw(!tCD7eK(S(7Qe`8{!wU`ptz+-6lxgZUn(dj7|HXY`5Lqtpd
zb47xG_+xRJ5tsQ#Dv-L9o$<61M|*|QKqqzcvw4zskS-B-?8O4uOXnJ#`$z<VFXZQ&
z@~u9E#~JqsW7~&=$Tt^Z;9Eod+^p(#R=>gvkBW0?6bL6iS7|7N30m0^le8U<2HA^V
zk}gXHGb<Cna4a>xJ%lNoqp`(RTzgk!nI&0(29<ecA{IhZo!9?nX936L^fax5LI8w8
zyvO!?rY~Em+;bL~LR?-+;3hTZn+N;b*Kvvp#kVHq?=LH|YvD3eCRg!@(E)JrY)inN
zVHX9_qF3VpLe^V`P60@b|K{gQP*?TzpI?efjUP5P(MAoqaXXxBB%xWnlUOI#HyKW3
zxE1|SksnPn%j*wy<`PgJT8*ZJyc$o$xt}`TnZy>BJj3U}9l4LH{oEM?c)PX*$#^DA
zBpnxP%as876jpMoPUzT(UPHEmDt}D76!3j8VThZC;wqYyj5PC84aQb@#f^=$p^H)J
z?X*EABV1l1Y-l4)0zX;159q`d_upN(QJt70K(b=P)LY5A;k0fkBQQz+&q4l=u3T41
zzj7#U0?H<0uecDd)mqnQc)Odl?%oj2EUIj}6zfts7Imt0FF(-jxEXjNNPA)d{3nQM
zk_9NIMnd8;va6kN@}ybJ;}2aPYa}VRyO=og^rx7`zufOUK^>jM9k8RF81yt>Oe}Pi
z+{etxYb1`at)0mC^t1SzKOHCk9%eT)6$n!4_|?`6B=4-bS&J#)nh?6o+P9&v_PRSp
zA*{<nJ-$2Jus5G#bFNwa&@pGzwJWAFN&)o108l5#764xNulh*(#FrD`aOWm*wpEN#
zV8ru}nnkW&73W=;7Y1m<t}RB|Yn8TAmbm_yQ(Gyfk~O{wyk-9-97<$r$ZJPVKXpy%
z@A>f%!o$wIYUQzrei7O#m0CLR9)fU(vQ(Wg^c<`LU0=3T#I?^JDCGARVD}`29RXz9
z3wM=HBZ1vC6SBPX*deuzbEx$X;^IPq*eNGIS#}vNQ=cd-c<mnA*>ic?#(YOBDI-?n
z92vmFuP4A6NrR=e#OKY1qn?HmM(@WHUDNDQQy)86LE)RD$4mf@S&I-33=LczV5>%!
zdd3ajv0^!g3Q7b8z#jb&JBR<xDh|XJg=nvEdriL%;K_h)N^5|TKtznvN=-Q5hSf9?
zG)E8Bw=7lXBmZ`X-q<&gORB3lhuiada=)$c<n3FC@y%Jv?)a8WOgW4a%(h=;7&hmV
ze;+(YTjkyQ`t8q41hj|4`&C)@Y;%z#!u<w8S(s1~T^iIy1F&$D#{!PyBOAyj1>trx
z&*vFk?jax2ZI(1U?IhDH#XS*`6NhW13h6mmAf{$H3azdiA8JSa4L_n`%-!NB5X$~U
zy|-BCkY7n8L`HvsUUO%h)YvVqF`@_(RtGwt<ntI!JGWXOrW@%)7*a=MlF2S>a>mW$
zh;HP_1}XFscSGO8gCKTE79V&LA%$&BFo8|+%Cw~%1VwTc(}V6k3A}+<e@O?&8eA7v
zJOR@iOZT|_`coW1Q1^<@lsiT)ippYl3KySMBu7u<6JJ^O&e7O;AFb}aT<UpG=$T=+
z=c?3SbYq<!IS(gs;l#vHhL`oPt&Xa#dNCQ<Z6pnQf3jNK`;oJKKM?&ybre6_ULr16
z_25%tRDLxgCq~CbRjQ$THmh_c%yMk{mE0~^Cghd$=1C`JY2+YXV_`0X$@IgjmylSZ
zt9OiLT3OI+3nvD&a#)i-<)>`W(Hgw{G!z5(e7qZuKU2x9KmYj>7_CBTQYnuDbJ6=K
zSZ67I{mng7-(1XI2WUMN^nzc|5grQ0brayZhsGYM(_#?i)J|AG$vr!H%p5v^keGg{
zEw=HLZ&Mb%8Z(M<BHSdbe!YxxM3G84ec={c6&_gqy&Sl4E%L#Wr3bY~ELi)|>UOxU
zk6u8m`iWqHi9kp7(XSs(SLprjAIp#+xphi@#_Ft*Jlo5Z51hN(!xS1wO&`vP%V;=X
zE>*JcPh#f<e$*_Ug%(=cx`yR`V3hZBAx9<S=THoXexoG_|KXP;NI;Ym8>jTS@pRu9
z=C<gVF5dYooEAib>F>;aKX$!buT@sUeSBzA>ADW0tQXFvDAE--wG4fisdkAB+bp2I
zqv*`?mG{<f0P>C!zwQc?EaH>JA7kfT_!Ca(r};03Xs9RRTlg6NLRoygGEhpd?liv4
z)P82Xlo4rdsL3FWm+;E%UQXa~OU>9<v<MC)?#1Up#25mbe?35vJg<!w9<mS_GDEip
zCCR0^-r+b&ll8nqSs{}9Lak}_hxmweCN85z?thDO1WMz?r+ZJOD0ok+(paF4Rwt)`
z-WnAmt1VW|-G2+r*XScW@1>n&T2k3!ScLYOb5GQ;rH+9Yfv8g+*G81N+q3>^cOts)
z9RWjQ1=0Vmd~_XxKWz_dk9O~eETMSR1^(5;zNi~w78vf!pnm9&U@-Lc$NTX0c;47m
z=67+rrWtiwda=3r3}p)!{$Z3!#7~^$JsC_x$U})B^{$sK!PkhQrPgRj1A3if1Rn*_
z%~Jwz_rndATV-cPEluxDvF|A&?Mn!FbA)HCWG;KdZq1Zntd^iyU76A$hmj#Kh*JD`
z>uF+oGuR&AAIFuNvu-zDEgMWy{n9@0I|n+ImpylxJ=4%9>AXFWz$N<+HtZ^r1W)H|
zTeSk-P@JJZAn6^_&2Hbv)XQep5PG~q@gIQGnm@aIjf|@DUh29;m3J|`{XMv|d-UFo
z3sf+49&J%ZC)sH&OObY_G+gGHTxFut%`VG1>aw4(OIyU%+y5Q4h<5ErcS?0}86KM+
z?PO^29W9wKxhAIgK$=L}Zr?_n99*zKr$B%s8|vZZ1=p5ff^O_zGE34;hxo4sMrwh*
zDrf!fyBr>XiN-yalpILkWo4Fqq;vy&6Lo5?s@lfN@bA4QjGUMmj3kd|Cb&t}6)YwD
zs+uMh6)YW|Sf%GUsr$VOt*0Zz1`LSwTq#yos-fk-B4#f*9_#WQ(7q?)Cvc;FH^J`L
zO4qa-Ff^qP%kwAPcz64R#Ks`+JVymaS)?G6DA=rIAr-K=J_cGmY}&vLD4+(q{9W8V
zK?fL$x?njLT&!Km2iBpkm2TDHOeDaIZvPGPjG-Y!rKH9cBdFqS`}PEa+|WhYv+H;8
z5=juJEX{o)7QM;~Ec|hOcjsnFqu1wFCm>W4jfWwWCMB~r6%ZaPD2`N+Uzn?13Wd}i
z{d4eFHnV1~D(0@dY6_m8rug^dSR`IDm^JN7NFcqV!xDx<1~>zOO(*_z-_M5S)28-n
z?+nry3t7cEwMN&fP-$}xxV-z5u!%%=D^Iy|P**%Cf6)m|@O?I-dO?mS(w8Ys@Kn1y
z0z|e%2`d;sKEixc4N_Pl0L~ZgV^KDi_XA|C%@Q@4@XEVJs3_1SpaFi+DnFiefV=5N
zBpPfUP$_KbOL!V9XJelN`D(IR@-j^jDKj^}L`o1e_(W97&w77z{?f2xTY=yoIsK{7
zyGF>rl6*kCFpj{VR1I<VOVdQ!XJiz*O`-nLK}wLOk;L$(oaBlQ3%K`i^0Eq(oO;jV
z%Tn&|h^=C?e*r#v*2O9kSyj9@V-{j}fx4%b4$Vi<pUl5CcSOpUgARK|;TTs(FB`z}
z+gMJt7cN~r0)dhenbLUz^>1$;v=EL76Jx~%jcU0hI?KJ<h_QsRB`<p&kUju#50T%7
zhfW<So&WpV7rGA+4CEbF@`Gnx!MFKcw=M0d-kNQ+T^Kr70j(L95`lAy%{FyDe@~p`
zS3vTF;o=;?U?*G*BXcM(?$BLE0V9L8MaT4uhEH1YP&vU^QqbOqWh^N^GCP5ku<`20
zRUWt>0+wuLy@+YARc>&L{Un4Z9aOx$8`}Vi1buY6=_JL8Aqam35qL<0MHxAvYE|Lm
za;{RImqMs&>BDX%8yErh$C(4|=i%*+5`srN5ui0Mky%3A8aXZI-@s+wrU9}E%P(mN
zKTT2dd%iaK&2JgI*mL_(^8a|lb4jnGOqX_*uTUV?7uc2P{fS@!Ws^}Kr~Z|&!af@R
z%+uyq+11aaarF=&5P|CTgOJ`8Z69R#&v$>dKzyQfBgGI#jd_9NAS&J5Qj8%T*XjX}
zkpxutOJBvH)IBA?PB-2dVzEP2(=v0VG>LW=rc2-Y?Y>ErWboXffNNMbVQFlO<GH3k
z#qK$!uMkMu1^p#s;;ht}3<hfMs4n1>ItM_oG1mgfvgPHmd?0db1xmhJ7*7#J2&sXI
zRP?HoU$}<5ES8QP6lZneD7(C(4YUIwkB74XEJ3r)DYbwxgjdW@E;eq$j+HNn*kbd}
zFGq*DL`*IlIR#p;*pWGz+S{&x`xNv|^4u)DiS$(Et(yjDV4Jc*n^QpRoxlT66yM5_
zOSS)#hrF$#3+TN;kF-$q=da-b<7Nm;2o*Yu`xTpvc!|G4O9H@Nf2m_{ZVq3nEMGA}
zbSf*{F|<VK6vKK2>Q%^u{B1->7e;%bXrC_XqxKea^oM2;<3R)IjXBxp?8?b}Lav-g
zN{?J43uOvxhfdY6jo%I>8f7=K|6at(T{wwql*L4U90N-hqQ~oQ<UA=1;Wc@V+OEAd
zxAP-okEVj+(zvF@5!{p=4{ND9JA!VzAhNscG&-F1j7TON&*2WOSnAocyD|puy|&(x
zurCwrpbwcDITPm1p#N%W&klI(V9}^oux}m)j%huHy!#g%rwLqnrCa{V|3B%|SSv5e
zu#;jO&?tF!qUekadgI8WSaDEy4F`IQ21s3a|Cs`wDUEu^A~6!rwz9V+#M(x@VHCF1
zS5{Qbc&pmtRp;ct9BL7cJ3X#=^BwHX%eS9WFAMT5Yi6xaP7nO;w*lByGkpM1xTj#P
z54?B`Gw-sNS;)}u?fAl#hc`AWkE!e0bJ~It_>DvXu$dM5xZ3K|%l7Jsu(7y2X&?us
zH->~cj>JKwPCSNW;qL))@v5?NSSGI-Aa9i`i2W~e0&CI8H(ovRgRL(xnAGzyapXC|
zkCF+VR8HDg*!0+1B@HHI3?ngL4H^{>91RNgq1b_IOseC@!Y~E)T_P?n0<v&I_Z8_a
zP>2}A1n!6j43`|KX7$>Eo@0v1ax4>C3?IyhKO5ExgZDnkAV_b+$_zlmF8?#qXDMe(
z#D%NoF|+2B$DZK3ePy(Lnc4TI+5Xsz{NpyiS;pY`T8y)aCts88LU?RzH_W&s{9+Q`
z@8+8&W>VQ6#M)GU<3_+@GV?tf!H1`(fK6h7srYX)dkOzCgnb()37Hv|u?F}|SzE6L
z1@c|kBm+2*fi2dhSsH<9tAT{VQ`f}+>Fb}QaoXQ>^nqj#BY3PdV{GlAzZu|NkZj#7
ztvn(I?5r|N=Q^aU5`dFu9eRz$QQK=8rkdXl2gxf<dDMYlM|z^Zid8(%k}a|_`14O0
zhfp`aXQDZ{kM<{*vJ$O&Z?+l;inRm1m{YHQE{C}6Hg*Z6FK(cXjT)O;u{g57j@$-#
zQJsG$TSgfBu4fBisfD;j26=4=19ib_LG36E4WCG0p3`e0amb3l;hK1(3)*7<16Xot
zBZCDcI9MHvJFDsli>M)Qch`Mh<WX}&c0rJ^Vj<vOghcaF2*A2JQnRz`ev3C+;<Bb8
zD<$7yBserK%WSV?M!gYu=aw9Y6V!i^m4^kL=@GC7YLS1PdL%oBw-vAifC{~#B*V$_
zH*{C17Buh<%8U8_L(SSby9hU<Gg*L|W2fCr!@7yr9%JBfZ`o_eM`rMZ)|64%dUbx+
zoRQ|Va=Db|bZyWF+Xvw2(g|?VTeeG2o9l@i^n&S`C4mm3dq4O{R-#NIOjw$3h?nf^
zGryb<!b*B8l@DiHy>Z9}Rc|T+<MYDvE^357o@OU;@_G_~2Z6NbShFi-8GRd^T(~{h
zbu2%>2Z6|1m~*LV5sK!XaSJSa(0j8LZ1tc6YkXn$WL)#^#l)ZPA1XjlS=FMm)TPm@
z<6*o`?ZHYzE(Q(LM@TE{{_RL5BGS@G80~^tOF5mK-9)h5=Sr)Md@UA0E`CKsZcU0=
zhh5Qzz^nsfWB&B?7Dc`s(XM#K=4BQ#$eW{In-}N};q62i9x}5ojAh$AN|o_h216Gf
z{1vLJoRRaK25YRa?tN#?3=NkYd{cGHZqCV^x~}`6fNSY*cCm4M23a}=Wz*JNIsTI;
zNlml1>5OI4YyM@cr*Uz>k4C1+i*rqyNR3UypGsuwcD`QMH9z4Vj*cEG)I+N+E6uQ)
zynn$x&`<u+?OD{^vzahT3B0SeB&{abmX8_omw0KLN$G4fCFWYwDTtO`?NJue;LOi9
zVdf&~54TZ$3~r8PV#;!N$i7&V#%bp-jK)(qi(zuGeDorAt1n&$GE#moi2mWFabz0G
zL`>SI<8HD{WWZprwFY53wo6Vuy-sMm_Mhlv8o@TX1EQ*4+a%Vf2cOyBUB(&#0~{Ql
zKMCj!$6^5$)J~XleM6uu*j^R89V|=b+n{2`>|yl<pQ31NBt&)e%x^r{@aVj0Qy9s4
zW6cyd2Y7UW6E$FvjZIHXf__S%PcOJWGR?|z1le6;OSEZ?I@%J9dA0#y5238ZyRRzi
zy$v5-G!*SL&Sa7i9oHmog|?@fb(Xojh>gy8_AG=R;*ReOfUp?cu?5Uy5(?j&;gsLJ
zWxf<R3xSpcW~gj~wwQIoaD<El=@73#AG~`pE5f%&7eFfa>}TdVn!pdgZP>Z?h>D!f
zGHiIEt?;WuBv(r@7+>N)o#a7KY`*P5cZIDbrE?Hz?TGPPfW))sF05X6XJA_I635aN
zv2uACRLn%;o|xDV4IVwj8$9eXknMb?NNb0Rr1E4ciK51keu3O_*YvPhYFSCrEK|}u
z|Kdm(G;l5N|0a`-KhDE=_oBU1*}TNIaXcD`1%>#9#=RZ&eUjQPWRng^CK9Ks$XFYC
z4J}X=n?8{_m2Is{rjKc7-^%9C1i`dImT!OJ{h)`s5<%;p`|Fc(wK+aF)U;+h^`m{$
z>rYP+J?L=?p;6NU>=CBd;>cR{K7Zu^nAfq{lH&WU;j(+z*_raUxhO>-I5MYtFN;Vw
zcSz3g=HFKqQMLC)5UraLIsX8yo8O3|3tBh!ahu<lhHsxDWbe3|L5^~+DD*!pXwu#x
z_`SM*gD!`a{NsbcqQf0mQ9G*~zWBiC(-3y$f3edw)=B<iPtc3;U7N?5y!{D?*JcuV
z817VT-d{=A?m2Qqkr2`&lDxbzMg~#7HaMl=6HZ~VyjRl}Vvx3UB_+KM>Ehf4+)a+`
z59S`*C$k?;JVzt+bj4hWK~2MeSnx`NRkv@%VfP8Di!kIzej2MKJ6TK^8Zz6#%`V6w
z4HS`Bv9j(@KwrVg^Fr>;9m)gFjcR8|twb;v5MaE?OeMoY@sSVXWF!~tpqi_R&q?yI
z&44?hN;CQ80SwXxkqVQe+M;r#&{kAhlumkBdwW<dRpOK+UaVvoh(oq-x>YRhpjb6Z
z_$N;I1L5TX^*AhKdU@<<p(J(hPLr*V@65?RSMTf2NgTpgPP*J)A&Hn><3GRDdDTsS
zY3irM8!(6FF>e9E%X-hJK)$^*v1Y{KQWveD8me!*(L1suRTm)AeRhf-R<aug%56;N
zu#Z`a8UcCaS>6|APGl?k$?o=kJH7$%_Z*P>z8E+nsC8ci*oB~_hObsaJx|g&UFvs*
zM@s*8PQT?iI+#FE_IZEZ{1Nx`9R`Dc*D*_1E*BO^|DzmXSnFwZ2B5B~URhC2MEs%k
z<rIWJng&h(K!2nTNh=g~@qRSXjSE&4V|`G=LO-qM_ijFfbRqfGX(Q3}-*(!6bI{%I
zg#~3kShBVNMK56LzEIaQae{xNWeuF#9fQQEmlXWfaIcBVi?!#{1yq@k4RkS9F@o5)
z!B2UON?2n`*Do@_vB`(}mW;O4FN2iInyU)So<*xMfg-rPywq)`kdXjm8HeWIS66Q$
zj4samC-WeGbs6c8JYZ^aSm>Mv&)C#&vj6G=@`C_qxw$#MAJX7m_<WDEISWSk7OkE!
zO$~L^YrT7U>EBX$3c!*Zvl0$3kQj!2fZkCZ?Bso8GGkdZ_SCJWC#>zguK33?vi$R!
z4?oC-k1&Y7;nv6)8(b;80dfyOcqvKIms<}oDH6N+{Q;m<{vi{(rzvBIC97?&*6Ivn
zL^2E{IE&b`_=-N0nln1~y%PQ=J=7%Fh3<VN=44)2Nge?*hF_84r;H&T{Q`EnA+a=T
zWY0nRM(I~hUaFOzYsZBk(qUO7cK;A`vhGawYd_H_V!tb^l?mS8n=<h9y3CPa=lgW`
z)o}7ohi-zhb6y8;72KA6pRdl~wq56huMz0(Z~)kKK~mPIax#2Ligf{b6IqutD($i>
zf;)FaJ3vLM(Uv0~T0EBOtTB@(WjAPSejlom+m@t^*?w2FuzfeMf1-^hIyC}<!YGr2
zqoEHaV|sRr%D4qrqf)5j!6Tycii^X1(O9C5<g+LnN2C|<y}{cG1;*X(52R4Z3C_Iz
z(FZ1VLYL|Y@f+P_tk2$1l~*6^${Xie%wDZ?18GyjnQL?4Aotx25|)U-e3q-NI#Dhj
zlN%~CCb0hGz7+a}wlg5on6VwgiV<3j-SjR{W$oAM*Zx&l5=ta(xb`+{!#<Tup{UF5
zpP_$+QEN9P_dWPdKlf)T4MlO7OXJPzauQf*r}eDlH(Syq<V4_8OR8{HvXAL6zh<7@
z=}Ps-^T5j-YerZhu$s^lFm3<KHnMLMMlQ|w1bVLK%!ANZ=o6Z-0DPMi{f=_z4oa)x
znupZvCw0_R3Ympj{GP?y#LNf9K7^m-my!XtYcG<6C4Q>58;W<-!PiN}*b`xmV+cIo
zH5i=10L|z2B8F?GJ9nk-1+jfcdZMyoB4SpGTDDsnX}zHKwTz8~FQC{@Q(A7pw6Jj7
zLs7w`^V2^!C)S>aRA*sV<?5tzDV&@T-=Q0NU6YQoH;b<6%955fUa+(^Y9^}9fCS$b
zGD#!G>DNuQ8qTP5DVJmDur+=~cmslkJ=R{L&MFj)e)sG*zo~Cf9xJ`-zx5nQ4vP@$
zO)*l?BmVl@$8intXWhq1s}?lNh4xtOHK9(MPak9(y3_r2VKE$g#MsFsN{&3<A77ii
zC}Pts(s~C%3-u&eA28tF6NCg!LXEFx<a_BZb?WYM%~q{hKJ0M0N`941cx4w3V_5K%
zj~v&2lxDCCf@~h$b1XBT35I@yZ6wc*8CiYkC*_xl_vig0Jqo<0fvMjXzu4ZwhD8C{
zovMMigSt*5z*RvqXY>?Hfzae*Xg1J7AFp@hxVgL`8!p$UkDKb$!_vNV%1YAGpM0Ry
zGkzc%L+kbGjUiTBRZN_eG=WC!T3P!Dikm?BUya;$2lElo-p}@6^Y6*bt*{U4Z!n8S
z`X|FvzJE74dNNpTUJQ#sz)9Z@(cu*OkwNrmK{>-<9Jw$<t$^N6_Wc^d@hz1bhybyZ
z^me5Dgn^-pfZj0aW-AEH5#l`YUab7O#w`^MI@ikNR#-UNWJCQX7|fBJ?PgK9%+RK{
z18lgSL5;`XVOns3cA1iJfx2W+KB90ArRoUk*A$jP%00!8v1X8#6a5N+wbcQbu{S|u
zT`)&b@i{F}++4Lx%w$jXMvId7v60bWER<3m6O{n<_9#wLUxu{u9{=pId1+9YHiCv4
z_l|YxZYVueMTBnDi(_EgH15)l?bDaFcy@9aju~pZ@+eNo1%CTiFAdkv@{WYn-mMNy
zt!KQ3=i#G&EgukIi2G;Aqq6CiDKfhYU5JGYtuFweJFx+N0u7;st${$r@5El=IV6~7
zOl@O#ly1U<zlXWv5IHK!!tYRF#yp58dD-xhkmW#~CUHXi58U4Sj3_kCv5g&AT$*?U
zc>J9kJTPKee;m%wB!RplI)BnU=tLSib)SZ5YYrt%uWo4qz=MI{O2(g;Hc%Zb-!s5X
z?7J4Qaitd@mGt~iWvmaUxrvI}#MJw{L9cg>&dXkz1PT6(w$$+LjTBv~JQAnvFYp}s
z;_msOGarHb20E)ac6`=!fNn+MkmkH7<;sS)q`tsyaTq{FTTqaXtve=nmQ*9|`vq-A
zjpKcwaJAp$)F6Z2c+C~zeFN1sMWX4AkcK`G6&75^G`4a2D58g*S1(?05~T$hEF9pS
zpu9Tnf6vdb>rBu4_c+7N&C(=8@%069Ii*Q#k}XA=xp29mdCMa7R*3S#yvy6#2rXWw
z@ZRIRJ)|0*?<6oqlFC(tC(S~`_y@F0BSbGkGCTj&@Dc5bPA@dk`@g<{7}xSq#+Nl<
z(F5T$>n?at?xE?)I0X5P1ZyBf(<!uJd~t%F@V!>qr@`XJ)iz4Fr)RFWQAb?Zwl}<(
zZhN-g?cZY!`4ex(lAJ&HFB;$RZ}rAJ83hgh%oS>l>Py&`a|-<Nx77ldw=m<lMeBKh
zdQM&fkO_f@GXzY5)EWM|!{^=}3B=z6FK2Gw+VAGxYK*!3nyYR$8DT!!sY2hGI;wza
z9q|nAZyb=Hp)0miJJS3ZEzqpg*CtOy;C=BAdJ>*U16VFtPd)+V1?pv~N6D^&_xo?;
za90Aia4HbOntTlZ{xE6eLdpqgQ_U+aj)jWypKqLoijtg*M<>N;r6avy3EyM`-z%;r
zi3n56BuuYvY0Z*Vup|FSMJ@@TlczIl(zy-1L4~E^bPJCgTu(9xxep0*b0`a9eCRGn
z;G)-DO*RSu-Wqy^QP4gaI$G>vf!I2x&EP`gVi7ZI5Kn9ACx+OQ2v5o5T4-0x6#<hS
zV0q1|`F;E6nrC5G4j<ZY5nawesKyj_aZu)?JKB`i2U8tGKyy@pkf^ni$WXEg9L|kZ
zs`P+_)mx}(YTHe24Y1r&Qp6W|pE2AOO@KUFUW$@De*43Z%k(8Is`3Sqn*$q*OWmoW
zzb9P=e3AMHXM`~2C6)IG(xQPmptqM{mM&J)3F|NW92wYmlkbx5ERR&cMR4hdH@p4|
z8mLx6InSVRwc7(V7HaW#dD__W1OsFEQon4gMe-3g#GGV8v_Cwk=E_8105_T)Pr4_x
zKix;j<Uwu&V2o>OVAbAUEimB8+?tn2mI|}#Xi`21E^_;O5?;U(^8AVEYsV+FV1>98
zT(xGgA4K6ihVEhp&_skl=H6eZR7P>OL)ryS;Ug+O*&y&{1jY)nXhU^~wM8P6#>=C8
zZQG3+^a%$*Jz%8lw+jv->(=fIbk$n5LG_xh@0r8?#ueO+g4V_Fq3#4Hi+!chqTeps
zS{LGtE@@wmvdP8KJ9~ZbY#qR%(%i)2<EZeHx$=j_L+ZGD;&MCCAfw~a^r4djDWS|&
z`rT1*rYwh@3RLmne!h18=Jy{rIWpl_V$&gpi=q=Fn=M30ftnrcdjjGqls<fDYiW<a
zG02Hs8lsf}$D^IG4qx4|!$%>cWh<@>BgIvP)pq)z6nX_uTRX`8r5t*_ck8`M)`85L
zB~^L)wTyJVTMF34UKe8syV|sF+x*(0VAQsc#LZjg(S)&hDg%KjQeaG!suJdKz^j5a
zrIou5NK5l2e+uOB4u#8^nJ$Uc#}(FeLJgs_QN?b^AT`}C_>d4B8Vq!;ke|@ixhK>C
z!*PAmc!}w$y_HCd<tL7nqA&_bd2b0Dc@rg_L0uX03kIqxs`b4VV<(i4m%SERUZ$u6
z>Xe0pb5rwmYKxS?n=Qd{j<^)AN;weMEmVIFmUy?aYBqdZp3w;1h5mrK`MakTFzwe3
z>|+pB9lyUky=OhNGOOJ{@qgJ={seg<eZ`t~;uoeqaT+IY)<0zvd<qqgZd~>U&v8yf
zL#7pA1b}~x2jn%D9P@<y-!{9b4fo&~`qiKP9p4MxaXfqs?C#er9Yy%Ysef=14!NDV
z&${Tn`&S_5FPhl2ljZhQrv3vxzSa08k_tP$DmJs%ohfy#vu0V=ZaS_O&)VI$6YZqO
z5)Fe48@4n3%GkSG%#gDk9F136PTP<OxU02%q=7eqj>-a`u9asY0C8fxBg2ec`?F(Z
zeo^Q)lMe;zjc@ohLNJbAB4S6J%{VN_VT1ekLq5fwk_mxA=!cL!@pYZyIiB9$d|B{)
z)PVv7w?ljl^}i}d2nzjy(`R_&mdwNLj>>Qk!m#GlGGw2CL5_NHqffKaW+%;YO07Y|
zTHyMnp4R3WKla5vez0imrgLPlNlSLqs*Oq6b|Z{dvlSO?tdyg%2fknBKKiI#n-;}%
zhck<rnm}sSip{$x<u`V`+JDiPQBd<rUHe<2?PhL@XZYhV#{}o1eH>1koCHMeR(c0w
zxHhd<PGEf$Q&+R`mqLDoOqRJ}o9Z{=GC)zb#k{%Hp`o9#%LL%l{4PZ3ZVOqKIU-km
z6s(0y7Jb1jast%7s8@1No@g){?RN)Zf<4K239lSm>VOEAEy!+EcFS=HvRK;r<7Ek@
z4yXp~_jmBm&YqQj`5Lml@=OPcN)fv=BCb^}>M<N`KO1y$PFT&*SPhhGCTCI&hk;BY
zBuO*A#XSl#O!Z}k&m=$L+NyS&c6BV9R|gH+H~SRJEIbI;dWhE8oQIrYTTD35I&G6g
z%a$Fv7|UeON@pGTzm}>S@GOPk8Wv_HBw}flR5d}f3rH=c{Tn3zla>U3?TdaUXEnRd
zE+=DCX~03(&ni-;iv1jFni*?ZwgI$W7+>f<!#@!r|HaZ`8&dpD67U?@U-s>Fzx|FO
z=L*W*ayF?WK$DCVxh+%CZ`V-rm05^EB8jsqPHz7wwe-at<0`*^i>^Sor2Heye)amZ
zhq#*bX~)FlYbjS#Yr1~sskY>`by{9YMcI;n%Ycv$!J_(t(R^J@TCu?2k38V%XwU{=
zGI(<Tr*XQdW4&WsdG;7XNwP4yLsKWmNl;u_i&AJhnkqMcb^oYic%N+q105s4!9+Po
zejIX{{d)<WGBhy;^=M+v;&kK#BLDgpmJm*o?=wSxasPL&6JMEUynYDwq8Po@blEZ>
ze*GE5@hDxnS#+SyuUpk{B`r|RBO(y*n*+`0ah@{H94J0JkV1!WsALl+t+5q)=iD_n
zx(W<YUUY^de*@c|SstD>NwxxXoUOgK*n48eC&csVZ#ZFx#a!LjzGyW*kv25b5z*ne
zK2+_c3Gi`OY5;gWjC!_om@YOswHdO|jD^=}<1||qskgS23{@lS)u8JF#esoqqetXh
zHq2W)3mfwTjM4Gy25VdrBzeOF)eI1X=r#IlU$svCH2_YtxSKQm*PHfyCpEmqad%{a
z$&Js}aeJhRb-tr2Glf3O&OJ(hnJ<NY)j#UH%O=eRQLeHq7#D8cS0$CnJ}0|8L!-6%
zbY@}L=rIlYs#JgF0j;f?1_-L9o_&P#1)nnK8W;<x`BjyIsDmXZ5_FBd(<<15CIuc?
z;EEdX!-^s`J7Wrv*ryljBTgqHOj@x<nN^;v=lU*Gyg3A^X`KZ3yCvXDb0NL45MxAO
zR>xKVt4+zumCml0%g3`^9GpmI1N5F)wqcjZEydy{jz}_2j0u+X0uRPYb~79pCZ>Fd
zNpGN){o?0DoB+ez{mq*!vJhc{93WLXW!457m2oz`V2uaIr!FGYpL^j>Ke@Nm?@T;d
z2?3o45$#DVl9~Xn&^=<4aw|${7wiC!!uBIOD8q$h>Gwi?t7KZvZ%Og}m4Z;cg@wM<
z+H4V4;lsApd_C%XKx%&?pUkZU)M`Sp)tdy#d^VoF5$u0OXQK6GfcgsUAkzA;(z{&Z
z9AAz`QSolclYf6<s0RRIRmCRFy(?s(X~S+|TxuQW%wG<|OrQu^;+=pA<r^<qSfAe}
zh2HV31ElO2k77ED8TE;BTz-La=&x`!uI_YupEVlf0V&fj!J6Cd^>8I?`_+inHsc=C
z7TEsYcmCc!AkY3+c0hkh<yJyaPAI>MmMdmp#Y+5BUEE6bmvp9vatulLTEX;u_ZTbo
ztBznM-dE9{5K<(J#%ZTO4O%~?u1|8C>Fh~pO;c1@l()5#6IF3I8J5Lt`$S9vPjnf8
z;b;vHQyqf<yjA<E_=e|CC%VKF5S7bX7_U-yQnI5^5R;lkC7y2APt6AX?r$geJ*DKo
z?m^#v(~8uNi$g_`Vkn}sb4_QP_m7g6E-Q<w%_~(&SUMC_p_RD$PzuQjiUk9JOWVR!
z4Rwu&gd{bQ!6vkWhZ+#F66b?>+954IrD%qR!-oC<pRAgznU3z}c=d_s+cfpUD@@NC
zsF7-B`1Z_<u19KJftTFv;zgRGM&(@yFBSQ<j_@yfO=8{8uh99m6E#!X*d*=ZMg)3v
zx$rLlTRH@I?I~?NVywHb3&P?2QodrK+HF0zm`xbSQ_Mom97dM9*zyaD=PDMK<uhy(
z<8>ec<SHUe={G~CY)A?n4uURc)T%6YZV=z2yJ(%m2XY+)m}C<~4>sx2(a}q^V2|Cm
zCurQ!=}XG3u;4?8MCQ&RtP4!B9|;4-Zf;zr+~5AAp1M`K5TzqE=!!?P%ZUgSq7%QO
z=E%53Dy2<A?5Svz;j{T8d1rf}&KXNCp#$9w>gvQfm(sV?NU(AnZ?-USy)p8U=Heu|
z4g<wA#B|)c%cR;$!5&o)ZjA8{`lc9|(5efh0kp+-N)S>AW6%EmnN~+PhqjPQ++z-1
zvv{no$7+uKdh%&66bnj*C!B3Lb}}Qo0t}-BY5#T|-k{Zp^VK|wU%JTve3_9)ra)?%
zDUH70@WX0>r7W^!Yv32?U{i(0x)u|LA$@#TFJLA_;^Y%j3fsTX{$d3dgPnq}qelN>
z4KOol?aSaBA7KDfw5TYBc=pUr3!^0Y#-4RARk^`(I-5aLeu+jA6d03n*&Ssj;axGs
zihiO4g`WcM$?^2Nj&ZO%X2tO#><MU2^;-#yiB&0)HX;Lx-tBpq!w_wLmI1<63H(8I
zX#{pc^V~>fC>k07<%HV!OqCBHX;Bl0!(L$P&c&g@TO^&2z#^4s^C2jd_}a&CXCF?e
z`6M6O^;hLgHMC2j@Yio!t9Q-iKf83=t8c#d)r$%GLSTK<m(W*f7d21v*d(C#cLkuM
z;JiDtl{@vHi*qryjyFXUU9c!S=wS_KSzc#Z`2uk~QE`N$t$0e7w*Vov_?XBd1Z%ad
z{;7Vl5Ns3p)0~Uwgf-<m@kea1WI(cYmP+C8ZJueVP~$SSe4GeB5>{TE%HYaKdaT}j
zwBcVO2BMl4V&gG0bWG9!O5|dd)g$1M3{^CWDo9du2H2O=0x=Gu6R6<ZI)&h77-&2f
zM|;rx9<DuS4j?yYOmVL5HCov79qs#3QS7MsHd<q$$PP*(qH8E6T}&W&#k0w??7Hh*
zKF-wKQ#h%O$}T6j>ZIDUe9rzx(~l$K;N4En{gpPvt=W0T`BU$eRxwggeid@LzX}rn
z6hqet$z9aFotNocN}u{Wko0Eh`!&74=W`OMuaDyE6>$DuW)`!3!P0BMX*~EGM8Qr=
z^Za@bT8i(qYWGt(Jrcm$z3^gilzTej)EysQLXSeInA3M#f-fD>g)%5hDtacz%H|^k
zqSIu+IrR62p&Fx!!>c%IpsNJ13J8_rb%%v!+_b||RLbL7a<z!`2Y|OFj!fC0^(N#J
zpq{Y740%NMV-j95{zH_6(x4nbrP=km`lS1ah5dIBIB8aA@vjW(I-?OHh@`h+?voH4
zcne1RDXAHba6!Z4Qxg_1k}rkTaw8T<KM5amhmZA?NZeRqs-($!NB|+6I+^XX;thUP
z)J6Z4_$5GX4TV|FSV0JntU!zPel<;%hW6Lk8X^lKDfv?Kdg5oSZtbt){mIm(Hz7Wk
zzH;5vX@t*&aZ$7n)?Zig9a|(M!#Y3#7{=S(7~b4PHpl;L>Ja%6h!`!(MS7`+v;1@b
zo+vsIqiD0U3M~Qi{Mz@W+W|<$z(G2c@9@1DMF>>gmrgLpz3_zmQ&%T_uo5P6@Ub{2
zE;J_V_%$XFVH1Rt`~>w~F8?MV%k#GEV7a_CJBH#;=TR+OC+I^88)OwN6@a;PX1*+D
z-@cs@`%y}16iDC*1%|;ihP-|-T(y$!Gn`F(2Nps@mSaJdQ$b4F!bIW33gWHrTKpI|
z%XQRHE(XfQjsIt3iyX3{^{nCVozFlPnkedk>uJm9uNA*Xlu@crs`2vAxS`c;cd9+)
z+#V`P1UY#{)6+R>h)2_Olt7zNKcg@|B8KBiYOg8S5xn%<#qVc}xSt@p3~VCLNx^U^
z4;>{N>!&`+h9*@<b)7)DC3jbxk6k5`*hITRpdZ5Dqr5gz@NN}R_}5@`|NLE9Xv)75
z&`Eltr*nKM@F?c1=UDLkrbqWZ$flO-X`;kqmY-GA3Pic=7u=6g?!feA%fTnZVUIw^
zknBxU60pNq&54qJ*C=8`aS^m~bkB3zdRhY04*@M0L|mJ+B+_?<4GKJV$8(OwD5%qT
zz0uZ$WsJ6m-WM!?XgktM#368<mki3Et{&+wQJpaW(G>K#vhGz8wW$}cx#QU(loIZl
zeR+BNihi#wiiA-qVjzp-UoZ&XC9J@)9WxIo7jcRycCrKuBxka1gg}MSA~8~Ws2fzY
ze>2ge3vhc(O{4ZA!=hxqJWCMC|4~o077&t?EsMaCIS8<5pBeJ^m^GA`aPv&#C&eHg
ztifKJf*Z9s*nHVaA{?<n8f#XUxbzU7KI!KD+z%>XnVqz8Y2r}eXAlkPX{^xT_&{xw
zRjeih2zqbfTY>wWOhjBwRsXLO|2g}vuLSmWh!r}@f*q7`c51e2X(nyQ4~oyJKUa*6
zoD8;4<2nipp||5_j7M0lsXK@4ZyIH0^677q|K8mk(Bz62^@HJ7GB5N?@>xJwNwsW%
zTXE2udN9mC|5{t#_DjwB6-mT?t>26LGgK!5B^?T@C8q>5ovc{##s223=kJ4G?6>JY
z$1vP0xjW#))l!HErd3z{jn6vqPXs^hQ%amCPCpG62Aq{_Phr^GdTNx0*fXwT6=qnZ
zr2io}0L-ZHHp4U!4*4(dTeB_<_}3>d?K>>EFc2EU+?oF5bSHU$(WGOC-S{<6W~@}5
zaB4HsUv38$f(eag+A}+Bg*%iW=pTq-u5&q{>(>tj3T>jO@1>l)a~SkNSCvqWdnD|=
zXU{9vR{)zgPO{TYk@e1Osp-eD#mdt~+rtgpJ0IH%&3mv}AeN3lt+5wY!V8w#P7SW;
z7Vzm4BHsX@XG$=|^cB~Owj;$-PC~7uaB75x&`&x1=*ciWsTScl0i-8uQ9afEJ%JQR
zSk}v9X=lXza8W%e`Jb&OHhFsjlzl0@{;Ep+@xQ}0WD@<Q+dAd2A0<sbhw~x{!9Pa=
z2FcTZ;O>}6<Jr3uCYpX@{M+@dI8+%Z?VdU&y?wA9<o@Nh&QHNFhMpRc0u~uURx-bX
zdH%<%lYa;IoZ*ND6KH_AdVtvKXm2Gk<WV1C5_5gzCJwSW7#l6_{Qqe9rtq-3=j+(E
zt;TF)v$2!LM$@1%Pi)(^ZQC{)+jjEh{r#WsX78JGwVye&X02H>9Xj!o<D2A(U!*~y
z)p^+q2ijwhz@d-gnwJ~uGS;0Y;IP!vv6P6I+voUislj)c;Ms%=!EF1zD}Wlx^>2){
z!72^=*|*hWkY|y;HD}Tn(n*y0jy$r`J7@|}mhJI0aJ79J8akgqvFkhz;|Ypd7UhN8
zXfcQ1^wCk^s!_;8`_OqrF(A6m+ng9rklE#d^t6zHu2tq@#uO540zD8Q@X<R-&DyHq
z+V%byCH0+qVbXjhT|A%)d4OTRaC;mWSxMAm=(i)CH(kt5coi5`DSr{D1-dzTZuaRy
z&NEN~Xg(2Ef)rHgO+GsC*p4vQD6Eddi0p;I$2bSq_IMI;iEQH4m1j1`5p3FgPA;V5
z0Ohm5mbW4lfk<=0rAVfRF!rPx*M}zzUAuHQ@GbsncoduO<vHM7QNU@;Eb&t0DRv~d
z4H(Y1m&fSgenLr;E7Up`R6Gr(lI)D=T^<6Mo%}vV&*ld%h%bL+d<?zd-c!hzg}Wf6
zH;ank)hExMq9q#CWH&CM>3xG4i10?kG=U}5{S;*L+M-pWbBHWH&D>i=D+iR&p#(dO
z-sPhgRXOk3!4*+V06`ZJD%kf>2amr`t1y{TA1X1a(i?C9(<}tjHSUM5STq)Fxcx8f
z<?mT6B@?!g5oml`7OZdEy=M-6ZD9)Y^OprG<J*FMF>>-4lrI4&>@QAE+W(pF^O6xF
z|IDM9AU*fSAunu&%*`2txG0qwhV2g8jJadJd|4?#cT_b1JO0|cj}^h<QaD3Mkw0J}
z8$D3u6r2rv8qU2TZawMJlg8clwbDd7)SXZda1tEQ&(%tGGb2IitEv~<cY2Uqgm8Oz
zvs{k5vaWtAHDP9%Y#+||xB7mJR9SABq!GDDv?SLBmcJ{PExLuT!31+#=%SOqz*}%9
z&?(&v3~dZpo&7@Z=;rzZ6+uHt3L=tdjj!ScPg2_^dku=19X^KF9^S*&sMKAPht5MG
zwSvr}T6Npcy$2fjt791lzllw(LI7>DtLNZnLqKD-FEgFL)1i}HozMkM55FY~8t@8p
z*oIt;*pSyH;Y<NCbs^#V5o~HZ=zSIh@+g$9IS<I>MbJhg`Umg{QhENg3MdlO$V&a=
z4F?6PM*3U%Oe{uYc?j#C#@02E3<4HKn(PSY=HO?fKgF^LmT4(T@fXp}AIvN!rA?sJ
zRtR<_k6L$Ek@<<FK<;cxgcObNWP|fGh?hQJ$5@Vx_fP{B<D9J|>0cTmsCduNUEqP%
z%nKxo=NLh~LAznvB4=o)78%Twhz>A}3@sEo98bhtf%|6ASfZ9h9kDs|^lFHqnL8+Y
zpA!e!#dO1<g2f&V{q<i&*Z7{BOcM<+7wi~%?wyr`AB;qSN*aNCQd(5%gO=sCt1L(<
zg!ArLi~*;^md4XBL=6z?W(5{gL8J0@Qvw^}i0?ZzCkkgiL72`n_xtAo)()k8IG^0@
zi=y*md;T=#-;p}gV2=Q@naa{3JU9aK<a5y>Zbr^{4c_2Xu*4F?zOxBM5Vi~hS_sqc
z`4YO=!p{&L(>yS}otFbM1?X?dM{7z|zPQSUvv27U%h4zpFNw$Wbs_UpEI1h#$-rz8
zJ)du3vPH*y1|m#(fF)W#E#`pNfxo+@DtDR^ZZsQF_-PE$QV?R@8biV^7Y6)UInBRc
zGfcgOogPS>ttt_kqaP7+AReAOLIi@6oy(#_NQ=`fSyGY{6{PzR6YR|yKabj>>;nz!
zyI^zKKGlx&0zNt(?ka6qV9sORtAW$<-_;06UKN7%j>B0i=Bla^$^hn#I_du%xI=c1
zSbFXRQHbD75pN9my4`zMV8eR9)%Tdb&?2S_5s_`m|1E(d@(V5Yn7*+0xh%R%MD*h)
z6QdS6U{XQ0rte)LTwmD$3Dx|c29%2lMKj@q3bkCx+})w??My(9k!pBpLs2c+T@y{p
zC_mDqTU(pKCK1>A=w#6C^bz=9!zD=`2^0ra0Oi|sNMmvt2%f`-o_T0jagqxXs4(bl
zQX3K|IVgJ4CK4z$C}9#bGAJit*6e`>oy|bTy6I=%#2Mfb$r7@?5p|@E%8mab<L{#k
zlLH^XKLAeu)eBq7gH8;65?X^~Qej3at4q&9xb%{t2-0>93;b<(K655VjCeBu?QQ1r
zXtXX8Z!A1!kLo1RISjIPvp1EO_vy^;_G0az@_T-#Z5oyVD#*8Y6|DfcC^&TqG%(Nd
z!1{ETBn-ATp_bkkm^l8Xq6Ps&R7=bVWe_qor=ldmCoM1cyL;s7P1MBht~h!+h0|u&
zf`QC~Xik=0r=7#{^Kr1MC>oZ0=2P@Bj^Mzqw(}GI7<q<^8#egTAk715IN3w<h<Kg9
zB1eGuQwPzX1#ba(M-l`&cjqYTi(c+=-<Mo@$v0_#VRzABf~TnH{>lDXx^bNqCI5+J
zmp3Dl!yZax@%9T6n&=%;pAl_c-qtBSAK}Oa;SrpSs;d0OXi)8zcDrY68T&~1+}}iq
zgQf0bY|DMyt5$uydafk*V-~=CP&WWx;Js?l34bk2%~!T<!b~E+-^;zzZ#LZvufc{P
z@Tep$pn#eIZwK4Ma+7;9v>R&y<UG&rz5fvk0$6W9m^$ZG%fBGDPZm#dDUINPe0#+q
zxjwGVIbP(&`Is_}8T^7cgo2a$kvg>a6@I};<h{bST17W%7=_xBFrB`VE#_GNXqOp1
zx_$R@xY;M5lxRJWJJO_r<@;z|6ax@-IipZo_Ok(EQyJ0(6_P>9)W71C(8}DtsR1aO
zMSlC;U|O`BMZdmHoBYIcYgmStdzR9Gt(+1$BO})46(A-o$Rw46<C%B;#zEnd*^Q{a
z)hlW_GTy4oF|iL#MhQC^XFP@W!&1@_OtA2FKR$l@5DZ0HAgfssKi1n&-mmUhZG@*m
zYur?lv2mYX!#c4YocEX_CB)DK2A*d|7Dl__liiTyO+&=7RPG%@TRZWy6(jKo8D#Gy
z^siL5GcJmpOptM%n4IigkV;19*rmi(k}n!)5~ynu9y%xoK$z6!%E{hBcd#}U^)=eB
z4x7TSg*7kUra8cVLAVlvwTh^p@f33?nvT`Hs9RJ0BXxrP#digtvndEw+r!_A)t`2V
zXR7?LC5jY6i0}fXuoLln^y*H^A%VhsPOVUr*Wkai7LYATZA`GYzc5#|J%}>0Ox_^Q
zPGa75Ps@a$z`tpdM;RDf%{+6-W?}CntPD8NN|Y^dQE%!0GC=n}!q8fFXNIsxV;$s4
z+kY7#2lIq(!W#8ttwLe5BfGOnTi+5;P(AOwo}ROwjF%~0T^n#~doKI@3J&_kv1dQQ
zCIhHt;$jhq))-$G#@6J&!)e)NM+}ijOL|r|Pyj1Rb%u_BA@yiE>;nFne#yvlQxSUt
z@klZp?zsAmN@hAexUHh{SLuhw#m%j{LMfk%50Kwdtlu8a%pe189{@k_bbPbZceoZd
zMr`fX4we7sY3}t^kCDF=7=nWrNECxw!cy|n)1N@iBWE|{6-?`JzFzF-QQu7V*yP9t
zs9rWD^bRBJWG`kEX^HM-dlWGz?;7n2?^17Qg(x_9AX@?vw%r3`xOM7$V`lx-dL%K!
z^Z9L+vT%X|sSCKF%Z`0WP)od2ZTrW1P{+)KIT1TR2xc}gBZt2T8K+?%+b&xVs>#&(
z7a@z(_~lB=nd?iAgc3>fC9)$*?5zO0ji4m00SZFS@F0f&RS6t)Ai}8~WFWcfpeXL3
zB>%_8`lmb&WJlx~z5Ty5km)Ua2?{qZd-f7{8|;{)eH)N5FqgGph<^782v`+2@nBlN
zWd_W;eg9hu+Uf$@SwznlL5TPX>85Qg<4OM;UC^vt@6aGFUtdQk6G_1Qhr18Rvn?Ml
z5jr%ec{XjV&<Z=Id#--uHU#uuq%zdN6TuxiIb7e84ljO9Sc*uWImg1*>@FL%W)%Vh
z(kxBzs82}xsy<N<C{NlTEwnQ8he>^FM(adTrv&L@MdbEE;Ly;ZFv%yP5iqH>5qaGY
zKINK=^zD<D<MI^jWef;bS08ft>5uyODqy8QC0T7ozdVK%to4HM+;3_a$alw<Or?U_
zd)KUK&#>A7u>{#q9+fObNR<=#M$jX%X{LI7B?@g)a*yp>+ue<f&5!18?LI<h5ckNA
z@|WhC)AA;=HbGn@xmC`(%yuypeyXh?9NO^yk3rlz{?*yefdzmwj>Y1>{rY1PEiZlq
zy>5m$xyajYIL@>PK81pmi8fza;tE8jo#4+BlQ%*M-n&nJ>0}m`I-rt-191CH&Yv0t
z>Cbxl_V5NhdThOsva~H&C#EKS?G}lS#5Ey)(&)DBO@Nt(H#)4Wrl4gXCA$eh36zt|
zWyA?#%*?H0!vHowX)J|kVj3{qoOjJ}nC-Y|?VlCRLObk~rT_}VgAo{YUTcCPYo+Te
zP^DAd2@oAHC+lR(A33{H%j}`Eb5&I)0xDVuIKqeXy^g!-Rd*;bLFBAG!cv6ORgm(r
z@c8bWoSFz@7JuvK5fFAwqw$!T@T$iboGbmQtS-=tl>pcR>;?VOnSg)A30J+3c^abu
z;kiguRRw-4jYMl<1EUUkp(UC5MPiv`{@dYhY`S=t1@5UQ!okOdEPLr5kB0BCS`y#X
zcCWRK-`;|=;`_S=-JP~yxoybizk1<&D+2?nZwf?AV~De>PM!U7>27zHH400!e`RQN
z8G3ep8Utn+qs0!2Q@YcY@uuJWKYqxiM2_4A(?O=p_8Wqtrp)vQZ>CL_mE8<y2CX<M
zB9>4z3GbA29rYh`Aq{2~mEqd%LRBw`GSQOynG8;`)t)*P7BS~xDF?CHMDF>+=N5&c
zS9qaUo+d{cWeg!GLJ3_6f0KX6=aGir$&@~`umFx^+UEIYEUG@?9r21xDC#`y$xA5S
z7_fAFNS4)Daa_SknTjcH8HV0vyx#==VN)#2b{^n(Fh%}GOyFt?Tr^#oaH)Lu#dR(N
znX3YQEBaB!L0VW1Qg*J{<RL-v(TW7t@Xprtbg&wOi8)wRs}*x^Xa4%vzB%P(InmwG
z#vFL$saot1VyaK;?=YbDIDo7T?{w(i%Gti1iENb0%9ZHs*_QU?vdX=+MRB3>5nGd-
zugSm?aHpck(nSp^NivdEzK=8T?~cU+xJ}v}_cNri6D8`x`Plgv^qIbg44MinK7xNp
z5~2ma#7iRZ%;1+%wpvv~DWAhPOW!#;CISDYDd!MG#MP-iMnx<Y7+CcSv@fCd0xhAf
zpR`r_KPQ}1(lS)h@?b))`qAC=T5rPt@{}T-I-JErnD)1q1iArT?Qj20>Qkg#Tw>Ew
zJMX-}*L2y*hk8w7$d>+FyU#y5yhQv;Qe~MK@){&WWd8pMp4rCo423Zq0LX8)1-0zC
zl9FJMqw~5V#D{gz82VIC7`?(%)1EMlq-U^^%--X8*|$$P9yr;2nC7f$hNgnR!Ujda
zS_+>KktfMf=qvyA#gzwKC5m0#RfP)4HZ%l}dFTqli;l>8f<Guxf3S+-+=y4tA8_|+
zC#0015W++BPUPZueLGx7K=v^h8tnV;d~9fM+B|j9Du^6<HwcF2^k@*SPXTwEzK!NT
z43?jm^F@!t))c36dU2=eoQ>3WJd?$VMaP!$OYmf*uq<NL5EhypeDCL%t00oTXks(5
zR#HYT4Y*olLi+aL5LxeHBt!`99NEp5SzJi?egdHwb@Xd+vwj6MKt=)QPknlBUNDBB
zE#Yo32ztKWOc4~Udu-KPLa@Fag%Z^(y?JsZ{IdLUBu9fM#i4BQtsK@21=klS%TD4q
zk);T%(rXvq{g<AF`10P2itm;YzZw?H7b8oLwX~#GD~Bg<;jq{OnnA}$LS?xQK(EVO
z)yb_X_ZDg<EL2a(fT~DiiocNIG>PDatX~_lLO-L1$vvnUKew?@zT>OnoNW&b6b72G
zg~{t#_m<GHncS963|974Pm~c+PxaI85RqqDl1-JcfBF#x^Ux(Yn=~a`VtVFBQ~#QT
zEUCNzi4dmF&LnTpSk_Nai>l_xuXL#CE!Hh7c55**2)%5r1Ek^-s)DZ8480r*{y`Xw
zk?9HwLz9O^h;Ipi{8Q($NMzbK$ja8Qp(jnN2PK_YplwY%DKy9Im*66sqF^hkvifN(
zi<J^LAf*T=D5}l#v)luQ;pn)bDyzqqrkLjR^6<WiAd6A9H%Y{hZ?GU47Q;Q#pX7u^
zBnuB_QgB=%2;d{Yh#w=~Ge_dnRVVk6^9ni%e#X_zFcYJ#qzp*${|lh_dit6LbY6v2
zLLvC*rIfV`Xb|hX-7V!eF~UD!>pXzAZFw#9`EbO4$o8g97|A(Ttvj~4|NS>swRfrg
zAw+nzjUEF$=MQP11i(lL9ftU5pCPMSI%;tvP`KGD0OGlmjMP0|hecs-+J@?{+VbXv
zo@<VARlDO$bwvligSd6&Pt$*P{d2rD3QD3^_j5y}eV)`NKZ!1UtbyqiVL*?yp}%dz
ziS63`8mbo>gg9HTrM~{v{LkerZgmo`Jnr6lZ8Rjce)3fEG(9J25T(UQWRLw4bhZXm
zWbe2%5Ew4EE4L2zAVqeg{Bo*N72$mk94>(z>i?70e9piwilwWa_+7NqABMrmn^(u2
zmRF}2<atMJsWui5+<2N(%h;Qj4QjXnhlHm;C<%L?d}Ph8zBIk&e3GY0ICCPUsP)6M
zLv6V389C4b)I(KGl7lW+gE%tQ6*cGOJ3e|B8$c16hoGl><c>nRKrX^83!y(8-^hU~
zz#yXhs?To^9b5*#bp%!;r4WX#-UyFe*}whMZoH|T0tcmM@`vd#z9FMXhmXTh(z~}c
zg+ubVb`3oP%?aK)QmuHSh-i(H-5>gPKVQ=A5iVOzst@0*Kl~Ve^m!~o27-hn3uplz
zh5&e>ur$Qz5`2~ru@Kz#{npRfPDv6JXP89^Ji(RmzRK4XOk*N`Oamnx+I(RJ)+A!(
zNO1}rRv3?jieL?nfQM!rj%!6h0#-5~fp1|Sg0iaSN_Zps&50rgA&OW^Fwu!*kjg9?
zG%4&{Q%Fqu!mGA@Fxi#{OBjWUq^t%GnLr|6vbZ)@e9VA0(&T{hL5Rk;{?(K2g(qlc
zU&AHSJm{-sH1VjFf5QVfU_bCp=IQg$NzP1Es`5U??@ed@Po_oYbI^!ur)#8@+{p5o
zs;*62AdNU_;~86qwNJ_^6+WQC6KAOyf~~mS2pHZ<)MhYi2$Ge5Dc?X1`}Ea*0|UHJ
zX)S`{M^Eac5y~_cf9PokX+~XV{oT4v)41!ftUMLByX``-5bPe7JCo+9(PejIc2*+l
zF2|#m6&vK^XtFv;1k2anK@~?rr{)zJ6<Oe$G9zaSc7NqUpjFS05}|$$4-kT+x1~pD
zXMWaL)U8}rmT;C-IELVF@YOP<HUyf7I!?`y!`i1KthoB&lF&qt$-OA*BodH1GZOpG
zR^N_lYv7f28D{^2hKh_N=)u`#6;Ej|hXpST`WD2KaNFW)Jg%>#G@QvdgnCi<6vHwk
zsI>kjAPNOpQ(12+zn0$k%zj5eB^>|rd3B`_U>eqdpeC0-i$YmY^1IMJF$}125=I68
zTD`(t+Sex%O(3a^gy7-RY?V#SeG3iqiY}wW4D)GsouGsrC!&ny;=1Ch9)oqr;`om0
z){7hvcn9xzX+4w79jUFyCnv1MFJl0SMHl9V<jbX5iiH`)zu&e;c7wpe#SZe0uULbL
z(gx@9Z<$;{An;AWGRLDm5f$L%wL|*Xb%TV2Q-{o<=Z#-k!Fu?*qc)K9IY)QW(=+ad
z%lB%mzHsha`J3+Oqk}m1*6o>`e)q5e-0>3){83)xGT^B18Ajl;h})U@@&Zz1Cs)^;
zuUFgl54*x^FsfH!o^AX|s7Bee7h<NK;|gj=&p!&sBKXhY$YR2{fBt})7mraiGoR(a
znz}A2=rt<*e!D!Al1Mq(RZ*sHP%qOCSidmW4GBl+awDv4e=pZ>rvdyv-NhV;b!wb)
z{W&ek8JheC9P~XjO=3x_^IYd43W*rYY3g8imowi>op?q4(gyE-b?j$o{bNT0PjrGm
z1U>lQ5avw`I0lRD)M|ihh<j%0m?&r;9;B*5L!)qT`iH;cgK-W>(0c8BLTEu?JOOtZ
z$AXApIML^92I}!?(tk|h8{#!FJQ{Wp0!7XBen_52CcVV0g8nh7>Mqzb5p%VP$Er_A
zkG2BkB)yn7IpDU=zWvOeO^(v9Vm9UliON=5%!6bX#8dCb6L19JR2mdYA=V^!sM)^j
zcHcd_W$NvEHG<pfRWndUcx5xA_07WmP&$HnGBA+KF>NhwtR&3fX(FI@1Eg#U`n469
zH0y3@iPBqj+)|-$5V$cwHkO&*ubEqO_V<F}*RU2=Yi>~odytWk^qZG%L<`bE`vb=R
znJ)08%TyVIhH(S8&@Sxb)|`h{WCt`Uf5&?-L@P&>kp*J^1&-3?6XS7d3SHf<dwknp
zsa)^7HQK71mfm1$7$0UxHwpl=4LO8!EF*uT|N9*LsPK)pm>Au{?2Ny_xX@Lt#GlE;
zoN7aQTbu)s>%H^l32@!HN-p1cId!OaR^nk>p_Da>qo4xFF1Yt=FkkI3yV6QlDCYTR
zou`GCaUb_2e)im-T6lom?2cziSsJN@B&s4S6BD%N3`cpe1#C!Agqv6PSWCufp>%Ah
z_s}y~>$_Qt&!MqLJYQMzH;{L)yZOlQhf(dR>YNRK$TmE=!|;LHTu9VN#El_%uzKGQ
znQiMoIdTK-9fDmli>Xx|+7S=@>2b~Cn{>Fut?}j;rxC5!Intjv#N5hr;`^FXnayhl
z`6;Vm9ohERea{STO^fUzRY{XW&6b^FlgSo&oXLJawn|+aOUq0bIn|sOJaT5<60|wO
zxEYHBBgziuQ;oDazHY2m%l|OVX~CnW!wVMxCh7t*6U?Naes?x6G|(3f>am$GVm<x-
z{(Df*p0B}quRPqNc(cj*AbhoiO?mZU!Objm#!LX-6yi$N)l9f{vtNx5%&+RFCRs#}
z{x^`a257&19~xZnl|%Bcejhd1w_iB%b|n1IC`)mQB{JgdS0kji&<iY{`3tW!z71}A
zK-G_^9$6IRC+Iu9+Qxv?xFDU!Dzdy$U_pT7SxbpV)J;`91A*&pVZ&aEr1SDZj0%Ri
z%G86t?5#QcCdBp_#J<gz|4i!DIGzi#jkOLAgS-c+l)!1@w67<}K^Cor;>)>hB)aIh
zAXJ^=Us=DL{VAUFn~l!@IJMau)}7lJh_4Rx&+`PUP-CIk-3En;yWf_7&5oAOj@2N5
ztF3*_+Up(ND=WA%e=SE-xCBQ7DEaHit9e%InQBM9JM78wzm1D+Z9z>8=SpiFY!{QT
z7{)Nm??J%!d=sKjA-R|%4K=gGeJ_fvKCKlDFQ>1US%&OU_D(RO4p}y*kqOoSxRQDX
z^k0&4++aA}L_dgT%cx)Q&iyvVjnd~b*?eqX$p-w6W<isc#0E(x8X+I$Z_Ppx?|Ug_
ziqpq$K^t+CARPHlCGcOh@kaeGOOCuzCaqpcOjI#?d(#Dl2zLI`YAf=d!LRuA_N1s#
z$f2U4Qa6uRAb1F$g|LE4Gblp>#(U+5!N@7Z-AtBud)eX567;rzKgfQ)k+jZWhAp+o
zL+xpLj8Bz}`+~ibm_MvB(U4CBC946#8+<Hx7rLc98+=d19$Ev9qx?6D|CqBPT4EbG
z=fI$~wv89#Vo99JRr-5L&}k7bXHjJ{^2>*0exVu!n#c@4v44a9nIE(S$jD+=oZbxT
z3iQwxTzKv%khjn4Gm3^rYiMw-zouvrF)-bPCXxrTL0wuH>>Wn)!9ysii7&&}ilpfN
zvh>A|bj#lJ+zYD})elbK2F1qelxw_7i`sy!2kq^CbR0t0@d@zcT9Or;^R%m$=Y`f1
zoeVMN@3wJmQ9#PB2#*Q?Jgi@eEu}?DhfxYIVl_s0EyNOZvb@Wp9n@osx{Wr>B1Js*
zhxTouBG1tGp7Z6i0uDt($g2b3?b)0Z2{lE|#(2KX+O5!c0wyI+s%Z&gO?!YH?pH_t
zceYZ})CIMv!J!&I@6=;m?W4I@l4@FrBY7)d7}8MV#s)a#=2Sb7=@8?GU-#5X!r*w`
zFDu$WemYis#+BNDpXl&MxBtF$wqtli5!?r3#^!`h(l;)Ffm$F*P7N%hYVN8F_xA@w
zjRof@Km8rA-V3d604t$~SKY|<Qke6%QBEed2{r@b=j*bj!=eX69*a^N>MG>lvX06&
zL}@BNj(JR#HrnTb+Si{Y*57rID80NpyBE{bZ&RJFR;VA~TZ^;qxtmlRr!)qBs7aYX
ziGu~YyO+7JnP~m$rOo7uOsLpl3P`9j!el}SSM3|5<!?B^DQm6?waHR#f7+?7SLKb;
zU@`#7TH9@oIF6iCw{T>jD`N46o_HYxciF({UNQv1R=EHJax(z`;EFL)CusjJdmb0h
z$-Vi6i_-?brNgR^Ik2Z+zYA=AJq?l}{VFLBMdJ}+7*B>FK;xlHV}oIwdCyt}IIXr=
zh$yIRX#}oC--wJZNF85g7ScG&kaAetc#7{*n4or4M9C9SL3a^}m8x<pwTGeTsaVn2
za6?MM=e2bKX+|8A6ZNR`$qCGS&>Ct+BE{dI>cPQh7ml>|qlyJyw6XWp#O#*J#Pd_F
z?p<QA;*6DyAE1F?=JF=$U=0^+`MbBp)(!|W%5onmLE=2&PZ~mN4deoCf3m{4F>-z4
z?0P`I?}Iv4=pVH1uN;j1;;|zrE`C~VX$cj0n*C@2!oBk4MX#b*PyG3125s6H{W*Rq
zKnj~=g4}L%vS>e>_gfjPhu$&X%ti0Kri2?EANOddjEJzGBBkfQ@(ZOvG_UsN*{C`z
zK{6BAdH+F|O;kR>T9}!fNT9N|JdG&MSxI^1bkvI-99?Y~JI3mirM2p>O<;|$8JVev
z(!#L=JWF@-#pL{!`O`+ZyWL1o45<g*YI<uF81NMt@e<tib-|KispMv^-KnUmk{b&0
z_W}tejzjr{rz;#RQRbK|JOxmT!YQ*d%AuiiVc#XU(FC*QP?OKPf<{)(SFb*8_JD^0
z0Qp0&!{e^&s;m~Gv@PLI<KHajFWu!GVo^@uU1sYohu3Fyg`uN7#R5MK#f0_1)zS%c
z4!d%1Zsy~0qeJhr%i8&E?Z-yPU)@S@3umXJ;Lxp|=P3|7Z3nYi;aRG9ZJ4x(QN=P!
zGo@IrKGJvZfUR3^l+`GzC!r-1#usuAS5CHB`#Xskn_cD<oL-hbvnxRf<(k*lZ!E`v
z0oTIHO+Dv*2o+YV_p^yk&Db0|Cm-!eYd>-T3v|xA%L3E)a+i>Wi@eS~Zz<K=F-bQ!
zg##aC0@jVD+S1#)qA0jG-Mt>=u}-JEyBj9DF=Nxo;p4bY(~0lTH#|XD8{A)^wch-M
zOPQ9@8nViow^EKS06L?+hetJ=yiyCWw_KrMs3|5~N^9$KUY2}|ZN@0ZK%&(_k&$-{
zR>;y&?+*%T9Cjr*9UhO<Y}l5rKUD-HBFOcMy#~>Ug6@`gU}k^#Tx$G0P1~vBivMhQ
z1Gh9Q8WbS$90~`#uaTo6C-NeC5}~fEIApvKH-275>dw}^s^1H;2)%V#uj&8>skq<_
z8{Tcgp<PV7mC+oL3mcfa!|{3}Iyp2;>WKKx0VNzm&2%`<0Spf6H0{mw=amY>&9&j1
z!k#%nLY}Z)0oYBgiInqC3=k88WL*J)*IF83o4te&dC9@>m4B_;?W+O?(@RRq)|XBj
zrjtKWlCip%P8tMBO=ChFj`V@6yBc|dD-#lH3_n?tLJay0l=}0n>3|qP6bo&YLzJIh
zoOXprG)`K^s}ZrYk1%k2S~$g|93BLEC8{T!XRX)<%*G$kcV<|v7#p)g5(itA?(mvm
z-Kb=CF)$FO5I}HWW*?O5k&Bp43z@rSPrEN&Y19JQ2THY|sG{Fre@h@iBTS&5dXPv2
zd7SNtU_q-<mr)FZR|-?ghXUelBy_eK9tghp7c4^mL&}r&CYWcMKPHlf3?};NC1xg{
z?7@3DjkHVlXVaS`7>D5%5{{4u!9Z^5yq9rtCfrpNJ>R!7^cSRU&^39e@`2n*4Vkqa
zJ~kxiMf%K>#p~jvFlFGMh-1RLMz+|5VXg~E4O7s3O<o&N84z#kvH5(Q8##&k7Wd4z
zXM`P7mm*aBbMUy)RJ;IBo-oZZeQ{>KMvC~xPj}7?mhNdB76pxGq4lO$^@Z0R_WbqO
zUTn+DD+i<`E|tHKJe2%a&xUp3&S9?-E-0vvc=}Up$O4^hSsUmXPFM0cIH>2c_cC<b
zl$arSPJyU)n0j(JyQ5&?Zj&?{liYBz_=f$DB4k8+0sXf`m*+L1>abyF@}bOedkZH|
zR-LKd;`{i_nPiPnP-khvCe6KJ0Tiy8rNiD5_0OND$TII?^KnX_xe<P(>6Ebt-NZaU
z@U6vN1o>I4(!K%Ll@C-~ya9g<^*mqVm0q9b;wOi)zJ`;j@#*(-gwNpD0@?9T0t6H0
zr7}(IWHX-pnL6X_&agLUkf2ho%~__A7qNr)T%Jx7S3>p<GQc(`(jVr;_!e@G7o>>&
z8w2E{IE|tNJTsNFn?=IpB5aJ;dl!o2wJk%vEX#S0$rAvt38F+iB&*0K$)<mG&^qs>
z3UC>2bg!Io!e%^5NAx%O(jAWsyxc1?OuP=3Mc29>_b$tAOgoj%^Oi)5mJ<!FAVdwR
zD@|ga>Q}#J4^0&V6Mx8D#?qUw9du#x;p$FTJ;g7bsmH<<yA1uadC5Lz=v_2H9bJD&
z78SOrOOpZOslkd3$F!^>c2re?e}@aGu*|#)VH#upCG<<b8aXmu=bRL)VXV8^s%lEj
zbiXS5$8q<Zjk^Ti+tAg@FW_ZkVnE(aG2^{$oMEfF`T|}vT~fAB)=bxk0DgxEO5R)D
z^^;$T3cD%T>}g@Vx2c0{HVm1r>hXTD;#yoBgutixH6gBG_1j)X+cC%CxU$Y?r|yrA
zgE#8ldXP@FAAB(vVue^g*Kb5qlVF=Ke5f<33gKMVR{rvnR$9ZKpcDA>ZwE=T|J=?g
zvYhB=M<6@@!;B}n*-C>!TxroK9V&+6+Do!1JQA>%9{5je6qV1E%Pkj2O!?IjZfg7<
zXBzm8jlcqQN7j9Mmb4wl2{~7(h*Mgv6|nk7dA*DktywqSKJUIWVLLBvSf_E#=lVOh
z*=paHs4%L6Kiyxv3<Z_x@o(ycOl{vOHRy4BLx`s|Fqyt=$vsG0BDRw+!yW~%vnD|y
zoS{vxW6NEvH36h?^Tg+ASqq!k59m$|h5)>l@=?Ml45Myr$~Dm3`Vj!tm$l;gs^*ZS
zflwOx79e8{d*~v_ZFnIPwb_(0IM2=8fb`vj7?mVA?srRn<x-;EI`c#5oh;h}oKe+u
z-&U6k6U$}$p$Ak6hC5H}r2d>Zi?XuONSmdlrPVsd_X(n{3U~0r>Vwk4>i?8SZa8<+
zG#5%`4MqNZyzhn8U&)rDgjtHVaT-I-#ZGe-qY)urYmjwO+q}<`(E!)ouI#s_VuT63
zc_UVmEGsB3Any<O{QQ?RkB|2G^4vjPYd(=u)k@^mfmOTs20c&@^3Nv#0h-LGvAENq
zZ(R}hB_&Ke2fZ6XxG`Cn#-Gcdo+X52S!LyG6)S&FU-VxL8Qx@-Nr;tkN`2znnz0pg
z1YHVH^yjw_d=foP)olOPW`eJ=R}wo0fQ(yv+_LZha9bbsl@l3wN?<TwD3z2WrAz9s
zjjr{R4v7o~gHqPfjK(0-+2ylnX`^QQ^Lwc@QgO2f+`=!OO5%N|rD42Bbbg~OQmn3o
z<oiq~4G&U*gz>C*IM}s`WBzC_>X5357{%gTj_UERZIk)Diw~7<J5L8@Hf<}RKIZo0
zG-(}4pq$m%%exz4IY=tMNM&j0j?nEfMs?88jNU1&c6lS5*9!7?!+e8WRCocSXI*%K
zwKTmWt{eaR%sk87W92aabB9ExOxJKXmKS()M+2?(6yDHD^Lqdjca{HISf^EKAfmPW
zSl^bD-&zxD6ZRKz9y+J%++gzirv*>y`WyBR`1nr@ZpFJJVvoYgc_jDyx1@Z4_X&=y
z{r4FC)l2fFhll!1!oIMe(prznKp^$g>I?tW#g-Q+qEX3-ZiS&=gI)V8hTQ|e1_`A8
zfMc=P?ioxDjW==afZm!knw8UL|FYT>BI*!vK!<Ty^D~~yg*-X2B7_Eo$|q*-2L}Vp
zUPRmBj3iXI_OY<+CvK0?9bw`-#8ag}(6pq(yocG}Wy+b|o=Occ%VH};ZE^L8LhiRX
zz|<AK^D;e)8oMwu>}-*x7xZ7Fe@l?=lQ2`EP2wa<P=aNt8@b15n3SnYirbXuu{;o|
zh@<K?_H1Cc36brKDJg6TQPFQp_MrnbyBYnTEjlRK!VWiCxoY5eBGb|}^hD(7cRvK)
zjn+S%2Z&hSSD~4B@v9{WDlDUhzaID@7`qdzGnOy+sI0|ud6|6nhWP=;C~8^UU37cE
z<QXpka(a;Udr)4$qE8;B6%v#67k4PG;ewdh75g4!WMr=qHQ|FuhM!}5`3VH@LK+BW
zI9t1OX0q`)HoUt1K_0rz0-pnOG5hzPD8lUFOW^D3eZsL<4N7LcrQBOE)ao$lyi8JC
z9<>n9Et+Ke-6NmS$N<|?)v*6qPy^1v&p#B7Mr2m<+@7Z7sPL7toCM?JDgZI>hZMo;
zHg^C5vfZZ!vACSJ9D`{0J0kGcZa>Ppf(4W`NNDg6b!?O;b~ZG;FX#dH#pmDmrdOuN
zA6c#Ly`^lA&13Sl7#cg9pCO3;;f1_!;Du;nCe1H?RRZb4XYy7G^P8UqM4uAm6=#~Q
zaho}A=N)T;p=u(U+6ep9+&FlzK{bFCZ=c$EzG*pe3Gr@|&D+Cf+$QjGM+av$`J;Oz
zN_~G%b5|oHuImc(Ac50$W=V3Pdi!e&7LJ@X=kxc!H@#tFv*{i>Halb0ce?@euP(5O
z{|nwxyhI{)d90c{^uF1p-dP(^xo`Qm*e9IP;O|7Y5>M|Lw|8+|$|~v|RY^rz<AAOV
z{8q-b0}(S*z#Nwk5DAO@T72T~(dr}N>HWM*?nn?b13~1-o{T}u93z)a&WNX8dbI~G
z>Go6y;=8r;8$0(P!y9(9143@<PUqg8F#L_&@mv#ivMpEA>ozu>s|3AhZVkecg)VlB
z>emw-`DGI7WuRR9+&gRk+I#{|Dm_PGrGJSZ-{H{H+tf!gV8y{B)KR2Ip%32ydg572
zdq4RVVDqm5On6nI9buhkC4q?da$|i8HX<EOF>e3;!G-_EI;5ETn&q)(kK!nC9>cVB
z#!@YDoTqtp`kUnucXi=+t=SaJLo=io`{br!JzgX)4BMS@c-1z!F8DLpv>X}U-0U8Y
z|Ce1m0k!oB*oO*I#cq7#u^4&5O0qwQ$So4|Pa=;GPJbxOFk|O_K7KCF{!_qi*$#f9
zm*EP~a@jNBwrv@<kIT<hR7Vcv1ZnzZ3EN5}yKCiaPxMRViYv>}Gpfeb(2G%m>(YJM
z4S{dI2x;3Sg;^rMn^d_E&j7ko9j0>V6!9lk3P7RNNi{o9xp)#j$&ixHU#Z=v+LKyI
zXF3tFX2!btB8F;5X!*_g!eR?WbmRRZv-^fDRX@CiH*I-?ueb~$12nYqf+D|ySWtj<
z6zQl5gmHcYyuFJ5z#IWPA&BY^HQD4MzlxARowp=nEL3d1eiJX4FHUt|0uERf5){QE
zFF@KC?LMEIUHiQzS=K5a3vy;;a=mI-ck&oNed9cl5o~Zoxk)QDURrX7Dtey+uavX;
zyjovrtC^UJu})*s=Y(^G;YuH%fRF5K3`8j=JtLAdt;i+vkx?a+Ux>aIBz(qBiV*XF
zZX}A497dK_V>LHVzZXQ@9c0pe<`7~!1>&impZeuI45JXP(M>uzl@~IGxmEwn#rTOV
z;rWstGCKSjviP1)2z!FsuLx>5>&*q7QDiTe1N2eA7ypJF5i)tEOZMNh@=5eEn@`Bn
zli+6=7Xut51vpiL@@~IKBQcTn47G)p+URn=j;uCCXR$&Dv6Q!!9er!d&h`C1aGbU5
z-9nqBwjNY$Qh|Ogp_FFu(M?df6dgf*gnhDV74CBMO7HN8r7Z`#HJ3Upkg@KwY~&VS
z#Rg%ZH;w;*=R7%-6RNO7W|9(%JxZfqo`Iq+csO5Q@rIESWrHXQ#(I>N+8^{-ag;{2
zf#X9tv+Cn$y8dVv-%~=Ip5(_laMZN7+KM+Ko;%unL@;2$$$JILCg%ux@Vg1#Ui);s
zr;SO-#@C2o8GW90#@O2r#R+i7mQUuc28P#v3D%?DhrDC;uv}-7f9Z}aGqcI|>*HvR
zaTbG>d7@z}<Qu>H#vqXo#tgX?ir&-~eppJF*)u|+@)vP!E*y9*akIq$LdV4Dxb+M%
zLTQs>-y6(agjk-R;#<h*sw&)>&Q`S?rH{uSj#5sRoJxPy2YLFmGg_@pO~$q$S!~qH
zCS*)JGsvJD=;z>HX>sZ-*pU7vD0^jSkH+bW-4s@|tit>51+P37@y*gEbk!zjQ}_!V
zEV=>~A~43Dn9~{WzH{mTy+PXp6_qBQ9Q+7Ew^lL8eJR%l8ezzNde=r#km~VcFDs*F
zK4>449axhG<MKL}ow`*4b<a^D7NG6$RgfpX8o?FMTT-`~#W6&(nNKXv!F%;TY0pHl
ze!^U!V=)vj#qkn5{(w5U0cpcZdC-w$%sVUOb&|D}0%;sz#Y4sgh!mgO#<tg|m4O%#
zkj^*o*Ar#ts2+FzH`QTCp$Ix%rf6;ET8BRs_bvyEokH{PQ(hMRZXP>uoBm2IqM3X_
z&$Y{K^qu7REAp!Mio$fTq~rBjnyb(%Eng*W&2D_R23279TS;JCnnL-Xe7y9fOfPc1
zSuN6E8l00%{GPNxg0#X+W<ZZ?N8+5TtbFK0=Z@j`uE(ECa6bYMe_&czZa4aZNuVtq
z>}aZ${*cqR@zhA-j!Pag`lEh$O|i~ab?o;S?U+j)xc95&AM5Crz9l2emn~UQ^mL9)
zz2xKDX`huZ6rF$g<<pgjrWin9bzPrv>uCt0TV&VxFV)5vs93P?<l$y3!BrL*1ZiV{
zS`L3^`Ty0G`>Gi-QFnaHvTITaZjoO8Hs)XO!OS|<2)-|%+E~8r#XeVOeZUAHEHyAX
zlN#&8aSyLC!;jz#z)mXoI&G&}AJXdr5|ipE&$#|80;G#;4k0R5!QAD_OwYJ}*Bm+o
z0?Vem(g(7+O5&Gm(QJ9HC*$$Go(+KnEH7sg-Qgge{34OaCk#gIoPzS$BP%|PDbSRm
z-8Zx3z5e8VAop(}QH=QTen|Ft-indDJC7*>u^||7-2w-<eU)XnQMqBE;)eDS<|e^e
zTc!OG=&ZuuhaC1wtg8C_UBMY?D9Duwfz8=&Y80K2iXr6UQ}H=j@nOQqty7T$<WktB
z5;%z`%bd4}8gFm<F-T*_wMY>#i1?J25P8Y*5{F`byX)XzuU%exZaV~P<R_!H%DB@b
zVuzey_OPWNZ21&4LeV>q1=qo&-72oZkQ+(V38P1^v(412p{q5v-lWa-xj(MS0a)6u
z@Z$6zD1M7pybiI89})blpLkk*q1-#4@7LQ3lEG)h9<N;mtn~)y(5hUe4~q9$!!Oh4
zAIDcV0y-s|Zp)#7yGmDtI~G!|Jn`#J6S1hrNfy#4#m7m($IBck^~|-=N$IB52hIp7
zp923jC@yF%B`r?ljbw0<Dd(pGpj>448)ihb8O7lKZ}0}F(86n$Sh7aDl4BbyYt+|P
z^O-BcZO~h(rnQ#Si=0vfII7=&lr3>zCJ_nepDwyiOYO1{P#XWtZ@eBeWm&gvOddu(
zc4@EcIJf;dPzXcIbVR(neZMn#P`HP61TF1#WK3Br0)Ju_+~{aKB_^))0-imbDWQT|
z-5s9_K3jF7`*inj>>1r~U%I*HI{<jD@*Hxen84X*b>$GRLafe7)%|8Ymw|?VPfcA9
zXUPE1lT%5p6Y_FK_Im(wIyggZ(+>IpI8Qojs;SA*0%F9k_|Tekys=~3p&hd>tg&M{
z|Gd=cnI)L4Fpr<QD6m*rz)kA=&+_Os^x3BSoIJhuq~I~ph}7a4Y>N~(`ma`~LhWAq
zk~V{>a{$v(uGiuzJwd7a;HiO;E;8FZuFL6~JD)MnpN{TRQhNeAcfR)cpIwnlA_imL
zmdh@DG8J4@{R{rh)>%s;*I#w<{CZe8g|rLr__@>ipu^>HS$%6Fuz$PZ%8MX^EzJG_
z2gUR))9rXm;nQJtJIDHsaB=6-cH4E`2-Fh!8}^I~c1LtvP!`&ZUxE62NPopsDK8P$
z?@Vq*_2!5d9%EVc$gJQEMbsp*b+ky@hPa;$j%|g7W*$93=0R^)k7aF=EJXh1L?`&y
zsw9stAQhh_!D9ScK+o5bFisM1D%p$H!72Eu@blZH>V(%Fo@gn>eB%zZ5BQ_84QfU+
z_`oeXEhuvqY=f0=(`WrSw*$^9FiSAdWDbke;5Xr&Opa|GdTkqaO<K?AX`vIop)X}?
zd~fGz){hDtOXs0bZ5^>k{SBwezk@w`MW_|tw{CQxb6>vvD~eIVi^lpJc2vJylsStk
zr9CJDIWi(2%+R_c+9}h+-bbHXe*WZn4;Y6gl;WFYVn}DsO+zcF3%-rW)8FwaN&r`E
zwFc=$xgb>3lO_o9WJ{JI?ZQ-o_GoE~G4dKDFTPj&^v+cc7>@E^pTCUh?jOC;v)kPq
z!>70mUDU{P0gT9!FKltb(?4OkuBYnO7B8BEC)>gz(a_XO+Ke&G8bbYv!?0mlQ4@l=
zmM(H*;h+A!d2?}DlkSY(EwLUkQPP^HKHEXN?f65x_KKvxey`K}R!2;<3!B<`>p0wS
z$}-%g#YCP>dlhAkqw+Ov9o61y`jjTsNv9wrL31vV1w^P|j~3r~mV{eEcP)DH(Bv_l
zXYm+x$!CRS{lYGqGzIZ0<}2nmHiP-PkJQ6}rO0**fqA0&g=wx>zGe%7hI*sUbx+?!
z59rk^!t*pOnGE9PTaj~6uhW{tMtO<lEDFR)#Y9M^+X$<=X^&h!<RFPD=&yNu<T5@3
zY7A)LccqTVjth$G<zr1k$zrm-sbUR%FeTkDI_C1VphuD3ka<T9Y0)E#><TP9KO{%u
zgt6q}3wTPi`vm_a6bf<qDk{SV|Jr{x!h{Ve=q)8;8wn%heVHQ9(aY68|3z7#pb!(x
zb$0E)XN#2M{~$q9p+eeHInt=jhPbh<aXAVC)C*ebe%WN!pH$4f%-GebRW1A~YWTI(
zLGHN|CbOTQiucRUj$$@&xVu>a-I%x0-e7{de9V!gMv8H9@MY$@Ca0}zR_C11fECg?
zkKrPsL(i>evOz^0zUct@Wr!uUn7AF3P_7Gd0lRJ+F?c(`_E{|AFwaDXP**rH$qQT=
zn82${PYl`~4WzS4r(^1>lu_Py9UC3nysay#bxVbOiaDD?mwzsHQeag5xj%cAMR^^z
zN+EnB=3HI1n(W@nsY)DdWvuBsLKJ@zbT1+)<`6y7(A8>Z5ru5m&l=CWu(T1h7XcaF
zZb0(v2B*3c(pT-d&vpqPAK5|Sbw!yCOu7&5&9xTE&8y1sc_UESSP4);Z(!}mCRFB8
zhsKD#fozSqS+qE$1{(jF+lINV!}!=1C~m`clvwnk^I9F&brDws>%P#Xyd#9y5+MtH
zJ`Zu$dZrs6cy^s>glv2F{tRFuU1l0o^^vcTpz)UV&_7hrLgUFrp%nLglZ?g$ZoDI4
zR5b5Ew#nc}@19u~3cl=-3P=bhAgUdmr)FWCxj!lJkbAbW6$rBHQ5!v=TDVKrp#6fI
zt-sNFQ)5XU?NSH+*(p1kDbFpE>_@5fDvu$fl|u%>ROepjoS~K9CmB1F4@`T%lc2Jj
z9VAgUx`1l9euyrqVHu964on~gl;w79AXDHj^i=AgSPS+INaB2Cv|v&~E9u6B3wzu4
zHVkFC48u}n{y=Na&F=oJp_-QHOHGB>P@bzUY^W|22x`pd{&Tka^wJ_vsH$RolW8|s
z|04FhjbNR6KWb$yU>({(0LvjEJf-^3r+<UjZXpL1e!TPG()}QBRdF-`r0>9Nir^6q
z6?&$@U@0Ewg~GSE?ySPQQfI!wht)Bc5`W!}j|vyAb`b%WZSKJ?{B_8LZCyv@PnI}F
z>*vD9m^=ioLkv=Vx(=-I4J7GIc7=GBJ#`R=TxU)N8m&xRWor!twr3|!6$0Ye@)@5o
zT;H$PIB{}s?K#hHM4EtC$Y7PGH7IOG=~D(8!ERoass#|1f(3}gGX@DD%ac2s(Mcf)
zNnFF9jY`f891o!{Q=?~KN#MO<bbHfs%An%}=GOa3b@*eD&RFyf)Dappr9zhRe&IFj
zMC`Rw6S^(wUccu@^fx=14d^q-t54JS?ML%S0T<>WWNPxm>Qmr@gF>4sz^|k3Ch^s~
z^OLYme%v#^lY;<_dlhE1%{VeH>Cdh#@7zK2KCXH5M5e_=iw)jHQ&8YUgis$ZOF06f
zJsv=3u3?K^n#wWF%zzAzh{(P!Y_8#;qltxw1uU&FSSFJ<WfTTVM~x};;c7NwDfA`g
z1pdwmRQHd>X$SD!#{;ITY19wh#RKPBu_-l}hi$QN8yksne_~41MCRoyZPINCV?LB)
zzolQAIw4t`65*p~A&0Q-W<f={9S9T9dly~&8wj3@OzuchDo}=AoAtxxAtt>hS%NG7
z;BLL*3HqMX6#n_J4ekj3H;Bpa-S6VxXJUQv`buWwKpUVpzj^bPW9*SIx{-!Zz&kg`
z@MY>l>Ik_qHtLCfG8zq`VcHU&HVfif?i%<Y_h1^u4zDIJg}u8D=0@LsH{~MrX4wwJ
z`j$hlxHU?)1ll}*uNeRhA)Up&Bp%KA&vaY@>%lgPJD0OPTspvHA*EZ#-drzR?5Wpm
z8wBirI|9H*bp}a~a|I=w0Y+G%$j_9R9QKH9L;A6i*W{VEyCq!7K^QV)_aO=r2E2Ym
z>*w(Pm@603)*|v)No`}W?%><8{DWY(A7WtApD_2NMOx|GMz!$u!Ix~*Z-TOfMOK-6
zIy&oR7w~Y<7SQz9xN*+q_pu#rI|un#9;D0ZFtAn8uvH;%+`nEn?bc2XKDyA>KQ!I&
zk7qYkP0%s7()mQnIF~u9G0SeiEz&_uBBrp5=qMGrY}LDg+q(e+W;8(6*Z*C>wmmfR
z!s(H}8{q!21Ox$}*pr)<3i0dy7_c{@WZ%7oEcWJ%e5Apog5N^0nWZt#YpKjdb((Qy
zfN_-<(I?UuNlzjYtp#_g@A+7Ms=48@WxmSzMbR7ZYvbTR9qKLY4#M9wA;Moz#S(!}
zA;MPqzsY+U=+VCk2MLk}{0lw{j`)?=X@E5!h(87{siF4a558k`n8+6*R#!g1*W2I|
z@G{O~ZvJ@lmvCZ3iKv4Qk9!pdZxp?66fmbLx^5B{f&77As_7T_rDU29XXh}8iij;G
zn9NMWH`cce1pS3*n)5LKdNzJ`^08e=kE7+Q9F7)&p0YD0b{sE5zr{;zq-*ex%$Di;
zof33MPvt1mzJSQ4EO@DRH4Xy*(7d8)A6xcqMOGmV^LB4gPE*#|IWe!K_+KEhfE&_c
zSZt~4U7kJ(dcvC2=}FeEbeIJ$55KccP<L25r#1mi5d(J;^r#`8RJ!SZD$wUy5;y5%
zd{>w@MD%|u30j-VMQg#S*^~jh!Uaq18ALDmup}nU%DLXhc`KNH{;VYjUJ>*TZ-r*C
zrJuu<C<#J}F&w#iB9~zL(==dar<7(V=Z+)<`T$J<vPt3!oBK$1>lPp<`~Rr=#(+xS
zFWQ<sX{yPdYO-x}e%ZEd_h#F6lWp6^<R)8_UHA0A_sjj%`O-OOpLg&5thF{CLe4`^
zWdOWXVa`reCKUdb+<SXPk(tXfVwFrP^{PlQq~=|z{|Q2>{G@^5TXPM3F3m=$mv<&f
z(pk1RyC&(rotl|&7CMY?8W!EcoSE=%X$%Kb|1UEXxU?!MgP3U5E=6be`v9o2tTm$8
ze&I*Kd~Hh6E~G6&6hNWJZ};Oyd}lebj;4&qFO_6zmU5;nmBoe0cyFPtc9zh0SITO<
zA4OmSK#@B>0;3p0;n>rh#bu01AQPb@P@7Z-=Y?wuwn%r~P-17QlHPb*p`;u3)-T4O
z#&Y&(k+TgB+H%08hgF1-27*cGQLBkaUL^=P;O+-U#=Z?{mj6K-JJ~B=U@Yr>ENQUv
zSlEya`bd_?|1!{=u1{WwV8(RXn=WegkB(GrUFM+w`e!1lio17spN@GOY)Ff{W~>hV
z6*U7vAa_Vu%wd;0K{xMDzQ0&Mr$FwO$^r7Wz5%FBUeIxeR=lqdFx2)AXoiMGfX+M5
zZ(Rqt7dCPGc<Prd>N*};!8Fq&*GAy#e2hl!yxAc&-`{AR*122Tuo`$O-A~{OsI?lB
zd>-!NWSa<Ssg3d%a2@W(i!V2Ci!VLQYkS+FFAsJ$u9x~<UE@%9h<X-DRwRYYTDC6i
zdlOnOp~!8gp=8;BA*h>y8YavM^ViB2z22w-i$%NM1|9@V7A-sYR=rtg<Kwz2dT-tp
z+JzL7t}HQcP#Vwe!dB0w6YwsEzN>_~+lUnV9*?=MpHh!9@Y-pLJZE01NPaT*J6i<$
zCd-EZAR-Z$Z1wF#nJw1t#$uiv!*>(oAyo8b!T-$s+YKDBd8oSL)^h<lR-?l&e8D=V
zMe&yizQ#pDuJvw}?-&iXNf}+E_HCh<58H4!j*zrihaYAjNOu5}&THTQy1Yg)WVwzn
zZ~*rDjM3Tp>NmxQ5gl?(HC4|&O~$f3=Q5HPfsm*g=Yi%ctiK}#rcJCjhLBSY-`Rj8
zt>IC+t%eGK+U3DW-?*E15{1=<h+mhA7OkbOgs$?HaJ#pM93m+b@s1%;$(XLK+cv@m
z)t(A<_hqN(0)k7tVRLhuJ~zYp&_F#&z7vGrpM&x-Z#;Rf9q40Azm%N%dvl1V?PXnl
zgYD|VoU;30FL|u~<&hf8+(!AU2uwdG48>imG0+t2^e&&X%<;g558qxx(kvXJwGGEL
znLIvCy44>e)hNgT*<=%83x0ATc$~bQdF+Qje1pAku^$Ta56ke)#|7D^N6?E|*X4Ac
z+4iy~B;f3q7JmY(wh-yo!~*@;q3pB4l2(gFiRJPN?-8gOg%~_8U1u+TJ^p-krz0(i
z61Xv8#OM(C^;?Bmvy7_3<Y^x6-1WihhXVG0p|KHBJ|-64Ml@haUt5RqETq5Tw@i>P
z+drpr<;gzsJRw{%0yIv{WpQQ-)XX{md?WWRmE|+U;3_T9U}P0iDplmgD+h>5*Mr*F
z)7TNmpZ6$=Z(A~}9rh``DTa6Hi){@!8v&MNX4O51u>wtcweL@w!luHq9(JCI5)l8L
zxmL-F-mQ?qZ-8Y@<36$<8*gXaet$RVb$T)JVDd^>f3yAV^q6s5u$^%xu27dJfxN}N
zu<D>Vfn10z$+u@h0PPh)%OmE~p&0-Re)i)4xu%?{H(7N5W<(=kXu&>~Q0U(<+8(eh
zal8C86G<yf*2?|YH&qO<?+gbL-Bg_Rax4Y=?6{1_sZ=LY2HckOoLTU`GMj&YJGO!D
z*3QOKX*%9xc~@b}@=p|CwY1^_9k?0MwZ~R@(#1z@brsU4;1R2|@G{XgF020aw=I!S
zreeva@H8BzL;m#`@Ke@Gu)FZ&IWItS7NO9|GUhAV%PoZWlDR=Kx?EPtX_f~hw&B#u
zJ+7kxueffD0Eg6{yu``k>D)70{WVH8Omm+6?2iG_G$+B%f}6RJC^zKb-01Xa{JgpN
zX=pxz6^<Uwod256h2vGW=zhiGmmKuh@(X(ByfTy8Z2c!U0vB`9TtSR1X|WGzhn#}l
z!fD5msnA*o`_tj#mK9saw_os#a%Qxn@OXO0J2o-KCxD>3qznkDi#mL@K~bs?-YeYK
zmxw0j)Rb`eMC$RGDb^yc@Mn7?HpRVDbGuA>AZzbdztkyKV>i@eG~B4ZE*tjZ*QS=E
zN+?`cF?URrWOFeW*`JsLM!7P)cd#2WWhBaYaQLo_`*;D0GWqA#Q%+xrvu@VE&WiGQ
z%<{SMMTa27P?SmO4qRlj*2(`7%Jjulbwz$5DAT*5zN0y~KPKYDI63E$XIkXjMly`a
z3!yUb?HwRF#LVH#lM)aQ{FGRshg+|;_y+hM1DzkdM(E*+ymJBAW-IK>MY+Mjt>K@@
zFl2Vnd}uP|<~a;&Uq15RBzR!<F+DF#ic_@OL|h#pjFt#?xF0q+xi%csT=)y|!f;DY
zbkUB>&WeizDaxg521VS-k}{MA3LkolRt(q}SmmAI;{Rx<97QNdSoq5~(|51N+9puF
zvoPkJw8QidD6#{d4_eioyh!676`d%^<0%7UA~elU%?1WR4{Bxl!h;|{qBJ2_OIv6#
zxRh+%y8Nr@x?Ob8!MJ%|%PJ@in~9AY)R4)f!fs?mYjhTU=dpm#WTN|Y8}@jK6aMGW
zYT3zH5t#&H@T63;D@%@M)`s-Y3o8W{L%ca;GE(jf(l!9T#_!igI18SYLw6$gw@~Ty
zPmG6nvh#YKUAGCo;Y)>S4qjHA&P|E?>e-(c@;gO?hm3o;i$<E4ioZ3M_od4G)_7>`
z^bv<Fr*FxBE*mQn+M+ZoJqlbL7C6ioP8)w#5fc8vtyCE=W3Pm6!nr@5h2tY0e)E_=
z!OzLO(})sEnCrc$!B^K0g`Xy!Cf8D_IgaRVe5rJoSlL;$ZHa7zlUj3D{dwh<T0dBB
z>-%?sUEJ1ztd^^D)bf4uNP2eC*CJ(95u5~2H)q4xP7m&7wd`fZPw|*swpB>7=~PP6
z%o{prKVXmI)MV3sS=b%<m*HXf@)RZKn)nDO-Wcv21t1m{RNeUNv7WrcT&r)y2_BB_
zFd<daymxJp+>xJLYzUN54nLvFi5FpyTWY%k3YbSOicv0kEVi8Q99>QCPq(atuC2h5
zb%g7Po7F&Ls~TsU=l|s>1#K~HbV3ulRben?gLj=RX^ezp39jJUrOJ}TH2>HVx+Dn#
z(4!58({e%bA=^(EC4o$^-9B)fZBVrfb_0zv^?BL9;ZKck`FCmbM}C@QK1YG@y;j*Q
zfv%l^=G074k~1*GwP?An>&8Vue0QuNfT4mBfY?|DL$I_$3f`A8aK=hrdd=vq$>*m2
zQ{$%(%28M*ddqBmHGP)jbqr@kxR3a|hVIvE)_hH`BM5{UNhXdcgqApbO@HxZQkqq3
z&)-5ubFR>QmW(PmO+S8v(h?gslZvekKQ=^^m{flrOTR=7_{ipZ^b;_4T5O;GpvZtx
zbIa}12WBtzgNphti4_$tTnfI7iDSx#l2|G<{!pRSY4CIYl9n*GeQ$lCIMyDwY}|jE
zJ?1riU_(U>_AXRnpvvwW3YS1^ysEmyoXVGPfQYzWDGoj{#Y*Sovk3M@eZYD#Ct$d|
z4)$Pf6aBIWGV>w<0NH7ulm7w@s+seF?7T2+nPzjy`LuKWuxM=_f0ysm&Wn1GoeybA
zCYC4<=AgI2xNzhoT`Z_6ag3?$8aYD&n}Xx`P8#S+kpbQwmwWgFAz05f<?@uGjPkw;
zMc#5sMOIb*4vRUo<nOAF$U<5goOe!?9642?2SE07ARSG3RLb6<PxS8B{=jYxc&xj-
zUN(V?b_iq{a?aL>qmir@PyXV2wRT=-By%dnM&~9{m#FrGM_?)QZd?+IS;+lqQw6UZ
znb07Gqpc)^5t}M@&md~vT%hYf#=dw?l#yy-j`AEWO5NcT!f%OZ17jz9*9-le1ejFd
z1vqBi4~I<UdId`&$ylP@);fD1lR(%Hf39;hUVt0?PGi~GT4SxN@`y&b(U7BIOls-(
zSC*%5oH-z(D|l_1%%7x3ORx51yI1(A@7?iZ=R)AnvF`UN#Cd}07(|!uNdtfKSkau{
zL^%?*p(}D`xCuze>}+YD;BmR1>0V#Q0JyK?qj+NXCT2Z26?<Xjds^0ECAZ>;+vgt0
zN){e1&zl37o<aT6X!kF-t&gS7_GK>n@V|Z!mVw009{#k=)BjJ}Y;{R-4N(>f8}Pl~
z7Q}9^CAO7#`lb?bCSEHGvw+T_Mki*kd}tQ;4Ou<&&FwF2Wg-}`7AH!+v;uB`IB3%)
zKzMN~K0F+pd_hEOJqcu4So<b7v5Eh31SJmINl@Z2GoPhxuvng%10h{n)&?hBbMx&+
zV{`h}l<v}VEQU!m{YdoFkh=|t-{UbfQ2&8mx&@?IQEbz#u_RDx!677`SVzv}L+^O^
z6BM$@SferJ07qBZ;i|kjf{0Ezs(;*mEEk$@6Wo`ujp8(lDKeFXAEJ%aRN&*7evG6X
z%>K~xF!DY2@HH>^a^0}DKyr!WNiexme;ochTO8VRF{X*o^CZ2~rHQj|8gx0O2&68u
zW(+LTz^_Eke7b+V+-FFjRSuE5n=Ts`=uiUE6yk=Vhrq5d23KqVp89_r9)kK^djI_+
zsol4#mn004@ukBpLEiaJcT?kk?GPv@O5Dvs_MXbs6yz<z0Ihwj&*&lfWg6wIkf7#r
zca(2H{fE+tOS^VVfT3DxWcaI6dC7*~?rxX+0*QyETUO<hkx}hzn@0U2m%>=BIH4Xo
z^^8Gdco*<kf%zOM{5?=Y{AUANW4%TrOppg?&=yxTopzn78GqB$kB44;didzCX}6)O
zC5j&czfw8G5E6{c-NMIf3_Y+!7Z5_<ZjHY<ya*Yl059KAzPO&+mT9N97O~N+n~VBq
zniRq7AV1>Xdx12ZK(B0*z`N~bIHwVw6VH*4?k{jzM8Ci_G)z9+;yPEIlNndwk;P)!
zv{6&3(rL;rE32pt)~R9=iG;MRpg5TjQ?b!Dlg@vdv-l!z%6od$;Ji@6E+ZqWiNRUM
zE*ldQx=~WO%)?o_^c<!5a)hv3FqG!)<*-=u&%Rr?-mY`Ws&cvGQeAl1(+nd^PBdK{
z-3g$tsSLt*+BPulqZDVa!h~K;66_yrI!S)o`|Kh>aI?BdqQ}QrJt9AF9}vf^`jtJ4
ze04XxdzHuDghcCt#ivp!8S{u<_09B8{fjdER29PD3Oa(Rsz(x^bFJgi${Q$pO0{%0
zHwxfG9>L3Uxeb6Hk8s%pt7JktwV{M~0MfGJpGJmi1CC79OZpS?B#$?dlnPTsxO)OG
zREIjbHX`-Z(?0E1cEP0&1hRz>`JCTJdxg#(>!(?4GUo(*oTXV=S(yZPVNrtEXDZz*
z11^&`*>};hICu3L=X(=eWm)&>-gA}<FP-U&oqmLE-~d&VUFe_Vu$E=SojU>opyB?u
z3~*X)xKckYaaiwplj;<cp{}ggDDankiCT?wo;zYi)ejvU>E&DZissVwdEXw_CQn=9
zyGkW2+}kYXBSvd|I_I>KLky&?{_;e-?XGLRfYWHvDNiPwI!~_9E9hG(zN3nFE#k#P
z)X}#cZ`fiK6q0@TAJyVF#b$$AAnvdpWj|0=&r^OoZw=m?KuHhAkokZRDIl%@u}S>n
zF7)HhKWS;uk5$A~a%|GfsyBAo`(zv?Vm8cgA-X)uBPn8@O7izqS=Td+%GUR@FSmjz
z2WWS~1T|pXJMkaN=ZYap_Tx>SQM<bsd`&X4b{jSt;%t0<;w>vZ;w~Quz>){+X~QOw
zsrcQzN2lphm~yiwZTp{^3ce11iiq;X$yhW(rJ|CiCt?DkGpLb1p1Z=Ipt{R|Zevyo
zUk1s16Iu3b+cy|FVq7`D5gZh1lL8g~vc;1>VmB4`TD=x16*WGhtjZ|T$7}R#4z;Qs
zzpCfpLJYa_(9fVMzVg-10?HiMR1cAyT5C;q-e$`<@%iT%HqKTkGG3ugl)36bns4};
z$>(qL-X~A*^#L!f=Y4gPkN@i8x~Z<o%O7dbc?TDFY43ZOS-Oo|O+$=3^v1JJyLENx
zj;wtHV)?%>`N@cRjygID1n4iLNj)*^M;$m;jvea-mM7lC{<GLE0ZO%Bo90`gan#h5
zDnhcrM)pb6Z)(1R+Kocc*(nyC8pH1)&X6VS{`voMi-g&G^1IRZEAJ?|Dce{520sz`
z!$Mu}CpclOpYuHSK;AlxWA747-*%fP<NP-ms!K93B%U4;Wbc$6<n#hbT%N?Um_!aX
z*;eWmR2oBZpW^+WOMonAU~We$`gm23_=x`-Ty2q|%#b^ZuLMz$44K15*-l(QLW0C_
zl6H%X`<le*$m``{=G*_%;t!Svs1HXBPuk7gG%xxci;U$ko8`Z^osv|Pnsn#`PAeRD
z8Xn8eml8RTKQ2AUbP%mguKMMzbbOWL+y|gw2z7$ADFNIYm}yh+`qch%5*=*Miq*Q&
zQ55q9>dD<MZSzKp76%Wf#qvx%{qZ^(jmmj6OKMaV?8^-N+b+&@+YIhi--pTBgN{#R
z+x8%>b7Onpt+)_hfW!6|v~(Kl5_i|TKI$)f5QqVE+8$sdxK0fIl$B}6PiT1^`R~7-
z3YHj5pmiA!7c=87aWUXIt9wSz4YRFjx5JV?W0%vDS$k>0aoBBTA*OkAT#TZ5L8J6<
zb#`#4oD5|s=8Y(j9!0_J))-zTuEP*EXG{{(R;ah=jLnd0BOlwmUjGhuBOJ&qXyG_w
z)Ajfr%yMT2AR&krTQ2_iaTNYfVBi<y!*6dmfC0Xb6zb1vHwg(wY{tDHcGN!-_bt+=
zipUez$F#SLh)XkFmyOcuwF%^%OYo1q1V;A^qQYA7jW^0@SC-Y@GJl@E>@j7kORjat
zK;<%pKu%K(^xEG-50~B+VFr^J1n#Lw>ywbB+VVEF<U6usDHHZeYNh(1PSx4o-KUIA
zU>A|0B2s)_ld(cevSO;{IvrpRR(8q(HDx1E(<1lRAoQ<_1uMH*tG6BL{dMsg7EsBq
zaltjB<!6GZGbwVfgEh*+ifzP*b%vT6l);r18whC@uygZVVmURMqLWtTxPxS3Dfg*+
zV}WN`Csyc}FWj+2CV;?{j>9RA;d7<~xbRtikQ~U$jchB*YO^`O{xa5>mUe@(H~HeI
zZQ=V1J*J>)KafpugBK+^|41216XWU&Di;>&ost;V9X`+2+-XRghH3uk#dMLONB>RC
z937<szw<_<FsqFU_V&eJKfI+w6hxxYZ-)(s-)?Ism5X}<N(s4SBJU~0yF++<foER}
zNdL_eIv4GOf;Xqhp?Dv?QoIlMbyUI;5d%jtWz=&UZy)!KP3k?!TV!a+6IjU=y@oBA
zpL3l0;$(yp=4Q73w;^CsTK6db3F9#U%v+~S7cM&fzgLifjCZq>)MJ}zC%2@~XV84Z
zW1}gJB{Rw$A}r|6`jU_EZ%d=Efc4cVH0Z^_H`OXq6>%;1$!_c&sy258MBIU-<PbqE
zXnSjt9jcBdnur#Ri&<9$$9*`fX2zv!66RD(mGt5WhNaS8Ez4f5oPYfPdb~GRVr34k
zrkwB<kqLyGPKwuLo8mEzZqe>@0{Lgbyio=uDPLDPm&8w2apb@*W{_t9w80Wb`-m-2
zX^K;DPrXp^NIE~7=2urfgcEyBye#yWt&x^Vo=}KtGbkinKCS|x%3gU%JHwqHtosD4
zyXww{DeV_pn@tW*qGq4X(zxv~1q<hxP+z|IXQ^XB!4x|cvkST={G0WqfXH7A)s;E4
z)skfg%a>t?$^WFIp}-gjRthN1c1Bw)`<8%UWhfJo1+JhH2v#1u^`=;tx+47A53_Bq
zT>x3EW}%X98d0;5)~j&ZtDqMe!U}VCH}pm&e3u`UQDr}?qP~s!&3^TFHzqv>_NM6C
zNu=tIF)z5n%jJ*cj{>RlLWOcuJe*F~VN9>kzds1xeVj3Yt8p0OjF9J*dts_$%Y0r{
z5?M+?P2FKaY6w<y<11A1JPvQ=)uNJi)y2%n!g@JZ`Xx<@`$R6V9O~`m+pt=3dHAR&
zIc_?K(J#6*90!;=(2)Aap#8iw%I++~C`cM|TryloP8(1c>Kc0n_L#IvGs2cjZi<C+
zgPA#zx(Qc+r3O-d=H#Ybwlx@emNgRjC;QAy1hKO1!u)pBKQ+CQpiGu&WH-mQQ~1fs
zIF9!-Ht|WM+)>x9^BX{{Og=r%q@c-{g4H6JqO$ltL%3!$4WudZ)q(@lNV3dQ#Z&(s
zr+fUsPF|4U6>Cl)gWDHVXh$h|C^sx1<4rVZ^YkWwRwBjnpJ~u?`0k*(ozWVy43aya
zvVyuI@XhRA6zNODiWL|}rPu@EaWGW-5L0{D!Ya1VKsR#I+1B+#YlVtQfyt256=U@I
z2)rzRWlKze(;4J!4ff}qVD&R^$4sF!0>^?o*!;Tn{qNV3;1pRSknB*wavGr~y-}0S
zdZ2SHvS3NBrz4I5?X@}co6ofPH+7cBS8TKS5?lU;*+x9S^a6?LC4x+sJU=KTRfQrp
zGNGR6{vi(~6s5fHvf0W3^9SU#hv4@Rbib`!rvutjzTOp@#|;k+918zXR2Ua#N}!O$
zgETBJsihtG^_nyFqk{$5*;~O0-|^?}O~zm#b3P@r4t36r91^xbB#!!y!C90VLHaN3
zblcjLpzu^edK{Yj+=Gww$}OW_xzZMl`wx3a)~ENnd^&H9;_PIk#j;*8$a!6umd$Z%
z6+zCM<RuaDFu^^Pb6wc9_G<nVhyBh%4H^`DUtoAOr+o#EtFgv#waZS#@ON&jd&Xqa
zUaH`f45xlet8(87FhQ2hF8h2TyTcO=j~1AhFFdiuc4vd~E}@>o0(YcTd!NEtnKwPd
zEU`D$AD#<X4$oAypS}7OUCl1Dh2pAqd4Ye#8ULG!#8^3fyjqz3##*x@>!*2qKFxpa
zs<F}cC@v^~v%9bMufS?bWvDo+d{HX_4LL9ynjg@_np`)>zHQ5XV_t5;@>ap3=R6S>
z6PrzJY(4on8HVz$@oHJ3`>Y=(G-XFkVysqbN*V;gqSzRXQ8Z=$R_kaYs5(6VGU6qX
zw`>f_kH<`Gm4Ngm%<Yojz4Dg5@~%cbIj<(d7_C+S+y9${yNSpie?@Vr%7F-dcRTbd
z<1{5HKF#xxz~=j7X2YKo{#`f8)tW6<&YRSUP;@ND;2c0SLYHmAHcQ%nQ=&h3E8JJT
z{xhTGQ*@DC4PDuy1Woz^VShg2d@|!AvcA?mdl}hg#(%y1oCaw(9qwkuYFWK}%*|u~
zfVY}&%JTS6P0PDh<KN?12<9Mvb3D|g=T>)vM!N}<lfcs8V;ax1l``9@lZ4@88vf~n
z3)9bZ^6Df{-(AuSl9ES>pU)#MMY@~P2x$u4+x!1fh({-H|5`$js4gl;a=>cZ?kShe
z`4$v5w9gz4TF*j)I%z4tI4hcasu^($B%gxU1{*AC=Au2^iM`#{s8lBvY@Yn=a)8-3
zaD4wI;Rs<@+sfIJN*(rR+W-V?pfMvZB$fN2>3;9)Z{_<%tifW!SJRI74Jzw+yF{`d
zj5;*C?}AcfhrLRArD#X3vD<F>zad>Sh7P+GSZ*4n>Y@|;JMG<}#mvgAs^Al#*4WOl
zpfRFF-psDzS>nWJudHz!Pt)A08K;OE@@>c=E>trkdXmP{#_iu-Dslq-t)t`mmJ^ce
zZa5P&#G{Zid>6-3+}Z?6+sB4`vZD47Cw{1CkdK+^e}aQ)jy7j|TmR9he@CF(^J$lG
zDW(=Y*qqT?p>64J?bEia#?0RX&f2rXikKg(zO2KOG87?Tr({yMOwjLuTe#-=54+_%
z7j~79ufVJ?ujEYIGF|-VEnZNp*x-?F@&H?LvEFZ}8Z5bc)c7BI84=#q49<^<xF)w`
zd5?V>l18g!`395ZxF$WEJ?q#9o0s{fgKn5+Hs21-4B@{Z_r-TV1i3FT(thL_XR%Cl
z35wclwh>R<I9E{AdXKdKJAH^ox#W?*V7t=sF$#8@mbx)Rx#D9Q@Z^Pq2@}o<m9@Hs
zXqvr)oiCyI%X=e-yms{aZ9!<c$@@y<p{n&^HuEj3D)MB-xCOM=@uihrDdJYVXPzq$
zDrV8=h@&SWUvic}fe(OuQ(-P(7mW4T{~bk_k6rto7<7M0j4T56iyA?#8~OVn*}zY>
zlQtx{{Fv$4*=B9kTdUwOB=95f+&wC+7Yy#$78#Z2%r^~$hIaBy(4aSte$G4m7!Yhz
z1Az5kgr-Q<Vv(kxZ1U$`D#aKW!C$HzE;xtLLlyIcrj@f7Gy(;Xe62NGQ{z4Nk3S_U
zsI-1qlR|8Q)F-dx@g>)l6Od}QU`<&t_fW)ChX1PZa-JL6)c{-szVUg}`B-RYmT5or
z#TQh9L@1G1j|0y)i>u4kIQH|9)qpk}t|gIte8-5=8wgKO?_G~A@BRAyG3-miUIVv*
zd<-i4H&m4z;1bEIF#lbhFq>G1Wpn_ZNF49Jt@j&@8NyiaU8%XahWz4z!K>3w$n1K}
z|FoEaqF&~Ql1MwI+P&ecj#XH*M3xOdp`J|JiN^b*$7PQB3nF!%^p7t42Jkw!2F|+A
zz#07v95IZD3m)bEU>Z>1jN}tXtVv*i0tfhI8l`muKNY<_#Peh!S5@oTV*eB;y*(t>
z@$$<h!!E@-{VCgrY(}cAnb9{KCzKuCvv&Z^BK4yshFz=U<moJIb>L8$H5+!zOrs@)
zw`{UUta3JSy?EzoFD$;+#Vj+9Qa61#!fv;=H_Ea%D(iDrgeKC<Ch-?aEs**u1bD>G
zB|i=gx~Py8Am&tsp6Hv%8Sc8V%N3yK8hs&Rg>c(bA?GdiA?Br!6?`38efSzEe;SDH
z+}E3DiD*nXR7h@N^o{@OaEvC@|ErQnsfv6CALFdx!H*{?SUC9Eo{<0IPaxFmi~s=e
z)1=6!bK7GZ&URQ3+2|zbeU&V#2WVV3s%mg4fOUwLxqLQ7R`oAzb#_ENeDyN4>nJSq
zF;$v1H2<v!1ysSi(kl}Lw|%V8Qx3N(v?jWgQk(mfVcQh^QyN^@FS!MJ{<{IB>bx;5
z*PJk>=iCH9ZTE=S1ha#~>I2BRb(cFN#*Mls_bWSw#MUP}1tq48&9d-#0QL-uJ~4u3
z$aW1Jr0MosVi{o~ycfzwdw|0des4%7<cqpZ%^l9`QSsCtEHle@d2=XCNI*P3zbq);
zv_f7<m!cknQoRXgT~+&-I@)TCb|jGt#gSrfpt_E6nQVu?smxdQiRvWTuZ|nmIOecB
z3EviMjKCIY>;MF>C^D9S*9^gxd`~Bkx?cyvR}_}HXKX?%Abdq7=Ym-6&pl*tGtjnH
zl><7$T70IYZj4YOco}J2Xld@@$=`vGqxzY4mwuE&uE#V;3o?%-n{0B&d*`;DQqyGp
z>ZpWs)9T#KlOSlSGT$A?+f9k1u1J@+&(<24jXLr?H(T{DfEg0!Bn_%lv=kjmZ7mr%
zOX7Uqf6-s#j&4r5K8W>!4Vz|7At<B@gEcyH{FQ0Z@GsT5b9i;X@!7$83*yU269KC~
zCQup`s|Xkw@rmizc^$*=zK}<F@AtLnXRZ(TA0Y&<UpHQxkNR!Ry4TJx-i}qZo|Z)S
z2^+`M_rc%pfvCqbux~cJ<vg?C&+I3P<U~GBaIxN!U#Y%+EM5Gkj-RZ3A`ufWTkh{P
zWb6Z$(HnX1GQ5JOGQX0)j<oMLgKdoXt)6j@q0$GM-n5Z2y39#<#ag{^EsZpHTAtap
z(BuLyll^7ecAiigpII8r)Tln(*;C|;)h?JRjW_e+IRKs7R9~^CE1!8g`bv8{3f;3Z
zdeEZ|qChaFpA?9Lx~&&Pf$Wl#L%>a;Gp$KDs6iA6eoAF+_!5hLJmJ9Rrfy%{#BHU5
zMHcg_PO*P{v2UF2Vr|3_sqyDl1)8s6U#wcpB~DV-)XL~FS8=uibP}sfGhx!C{Po>+
z%`YG%=sxIBTAWtbEn9eB%~)q}&-(m%1;@ZuV8(RG&!0`B)e@T}lhp7mHrD~g&6+Vh
zX5wR=hcA9OCYx$+C1IT=SC&Q2V#4uDWN|dl_Y0-fD*!F7kdr(Vf~A^gzaNH@yjnX|
z9rNKlX5zAee-n*oC#TvcwkzOz9O)u~+61tFS_#^%vA>-)jcK8xFFJv@f`TKp2-LkN
zqmrV_ajR<_v}d=;$#W!qo%L|5p`YfXD25F0X{UJ-;D`q=+5snU-w&12CX*s<gFt{?
zY$qV#39LGjc9;y<*jBM{5I`sJ!+ml3R`y1YL@Xqf^i0{yD~Jh_0*Ptr9GF+J4S<{m
zY-dnq;VhmyhcB*9FFQ;p!jn$D%4#oMJ<lv3QYzk$I(L8ijjs{bf`G8|@Ozl}aMYP4
z?sD^=noFnm_YWrs&|k+IdR5f&{;rOLO@w>&jUS+?;j>@k{XKjTFHI=-=sKFoLEcb*
zMO-3}_QR~2!~TNsiHPkdg$o7#rV)Es5_<sePl~uas0*5F?LXa39h=PCs!GLUiQS{>
z&&l0$*U|ssm6K{2bYjW=%#Of?X-e3x|DAI7zTwOxV6Qm|43y0jBh8L81l*vw$R9}|
zlRoisfDtbuhf=@AeZkl-7A8rvnI%omcw%%iX+NG=dF@<Zfj*j8IXD9T1G!o;^QWt2
zQ9dt&_I-eEq7TVq4xX|i$)W_g+AmX#b2?Xq$-Pm_=Gh6*7dJBzOP^f*!ZKfh%~GE&
zVy_1;JA+UsI>BOm;Tg=rd;+3b=2;%7*b?*q@$xmJ%}qQ;4R~}NRM@5||1kRTWo%s&
z6(MbM_nXjUF~vnJaImxYS%I24dOQA!gd{4a&g;QwBbb!#s}12bqIE2}i$;$CN@g5`
z{<}rgDapwZP|KW4RLZv{?bWRmf0QZ6ZnhB>U3G<0HQRS13jK$P;FG;Ff~-8YQW8rL
z>e7CR)J8XG9BVX!yAmrN^#nrGN$U?V(|ba!Rdn*kjClYh9VjtlpsG0!6{u>yBOm0-
zQKsKt0IHhvjQuO2-IM>Un!79YM%~)zmul6Xvm|Ti8$th?l&bH7{q+YiSwj{<4+|mB
zChM!hiQ!4$`%6_gSAo}Tvh)(?9S4(KSz6ov8eGu<MQaJ7i1-$aAxS2mSYe;Lw_Z{%
zZro4!bAa7a&VXpNtuW;GMwVqJ74L6qRDs5V047qLFT|UuAStPo2A)`3UiX4vjG{oG
zM1>Fin!N~axdW^vf}0lh-^u;Xg+eg3zguyd3f<%?z7Z>F^l;pNnvm=Src}vzw2`dB
zrAV`w)6kM%j>jGe?n3*A<VF=k8zQUT9UL{qvVePQ?7A`!yG_KK^mj%+HO=z?GJ;Y^
zm*G1^hU({o)K4+SROiz@Zm8P)K$++OB*y6L1iM?4+<b~L_{7c6eBQ%uYS|L586hAs
ztiRu+Xhm(HA164ZGAKl}TJ5O7Bc=Ue^ks^Gzrb_WMn;wMu8@hNVrAI}FS&9TI4#mf
ziaRTVP$rsft$-eVX3IVk=5p)Nf&o>hj%qBIWC-`_uDUo3zGhI8SDC>wd~u3q(#LYs
z6r>ew&<#hryzq|olG;}eQIbceJG><m$hb*WS^@3dglW@(=q`j@xbtS43&yB%1LGkg
zC|jFhfK7ZfSTaDY?G{d(%%MOAYK8OebL~WgcdP@)MXPoh7sb(ueTK{h<c5-?hS!lB
zL^+(c!ANiwO_>|vqS}+~mox~LSq^NCaB&4xqbBppL1JNa)u&kKr0i4=5?qg{XpsY|
z5ZYG7oIb@u3~k!KikDbvV+qSP38kP+J+e>%+QTuTG#^{q7)$vNfM8IvsQN34%c{MR
zUs=0DOSE}gexTE#VC02qUBIl<n?jqFv}%h<ndGcgnx$l+PNy=fX$P9gIjY>=zEpKZ
zsqy+&=WfQ<oFg@P@*smkxm~IFO}tkQF<b*V9M!_GW}e4<F(x`jTIOnlnusFX*3qSO
z5>c=C;Gjkk^k|0xna^kI0@^ApkBEDgm>kk81I=ws;_^SCE$f<nk~=u_y0CF=<deDY
zftdT^kG%z^5p&)VNys}a*%J3~%=0-X?}+=sV9rJtU(QLY$0hizEj8h+MUkw)9jr4J
z*-VgVK;dFBxmnu8=9{IF(J%AKKDa;0^KvP06bxd|HHsPp(A?N(4N=RbAok4SGPcQn
ziRC(mwq)a24EoVp=0OrQhJ7(ff7W6Gb?4ixTyd)fruCeYbwtx(Fc-cxzjM0$Wpy&A
z^C}^ty#})Vmm<av^K1r0+g16$PAou(M+5j@rv}cyi6AuWt_VWILmA;V#!CIc06S=8
zz%5~0dTk`*Yc=gJa^dMU#!D>gF|<XS`QM<AHv9Z&%-P?D!WoOg83VW&NJIgOxqsV;
z#<dcG3vF_ME4$usK1r503c<^Q;1bMBBlo;I`4(^Ah&LqOC3fBZw-4bF^=~?*$=#W&
z3j!hPLUHk+>w*xWJ7%<^@fg5nRkqT>X6lxrh)W`CoNih&FPf#b2UKg$Lu!ODy)KJD
z?mhK9spkL}q=I>|AyX-)s|z0RfV?|lCJfW0yRHyF!BK`as>zhv&q`ofAWa8FG3Q(}
zZV>+TCLf_KSP;G~QqZTA_WiSwBd;bO7u3ih_}R$u-9&DgEg$&o<d~y4gL-+uCoy!d
zTeD{R?Bu}CNIDq(!Q^5vvaB((%zKmg;inRhUsgLVy_@6)@44i51`@SpmIUqsncOPe
z>)zaG<lXIDueHxaYKR@bmR#Pi-C4BT|Fbx=qT`A<g`zsF=#CAuJGkD)W{YSWC^(2#
zTPPSn9Dw=`ta3>#o%X+P=?CWA33&ske_q~&eoC6o?fn;DjN3dcw3JN;=7t<Cz2g>V
zia!{(IIgWq*cJQMi0XYJx4L;q>IQbmv=d6%U47MM4(4jN4C0hD1s6I8=VurAp;ry3
z*D~4TfDNNF*yCtXW#nqq!qTW}I%vy{Ps@XSw`?U4!gfWw1MMa-!}&FJ60~{z-aB^E
zXNahLlu<FCO8^kM)2NKZfzjw3jQsg-7j0qpzX=OCvMf#s)8g5g1o>p<DGJ$5(Ap(%
zfGpcp$dAgPCMk1}h<Sxqi3TVBNF`JSCFPe`J4!Xqyc8L+o0FFJNlSwbL8{U-Gk>t1
z4Zyz5llFn*R0rPYUdP#&2J%lh(@(a>5pfX(VrzCFwgy{FoVg~!@hNklPBnJ=pJTmG
zpjjcnowkSarx2=t1s0Jl87HM2ocpz#%zp~Cpe~UAS;GnyMI2}k^QY`Er0Ffsp3W|j
z_R>+_4O@=CH{j2hYp0A;8cZ<W0~&=3n$w`r{yCw%^RPZTPChDnY-7P{{6}06m0cBb
zLTo~0cH@*nWEQ=Hd)sPqiw(0_h2~jSVQU$XWls+8H&sg9`Q1S#iw~Y-9)`w0<G6si
z$K>x;7itNm{qO9q3n+?tyNMuH$uQRMYsX)VC8cMstDtFfrhpvI4X|OJ4FGR=B5B|R
zkGcAZeK%FKxfyi&GR|K!;DP?ldM_1JvHHV#pkOP{Ek=Jc(7JZ(07^q1oYa%`qPN!*
zGvloD<GAeq?Dy;WN3{GSF%KhU#JG91(F=GRM{8W0et{)?-7s}@+7y^jz1r-sU%KqZ
z-W+lEv=Pgqy=YA%_^Xf&WE}rIaI^W1M77tN#$}j&Xfoy7Ei^4%CT7XQZZ1&ksIMMa
z&C2ojn{3U2DfX?YQDghSjnzB%%nEeq;mSd%DJY4OXMg6<E1EV!6-3;fwB!)t>|i$=
zk}H~yrV1IJ6rb}|#*;MixsBi1AQmMzjcwj!0bgQTZc=inQ34cybrA*i0DbE?a|5qc
zE^PDSOdP^$0blBxetp2};wwl74K%Zrg`|S#R4ydAa`&1_z13=(L05D?huWxZ9pUw2
z9D%>^1*a3`7Dh75-6^y#4D;sj?ab<L(i<<}rD2-tD5Tbr{s3JUNhI~fR9XC%<4NX)
zq=uJ{Fc<y?bbqGHD&gIH5Tx#cFNfi3qdcmrnhxwbY}yE;%$HK{E^e)<KDrZ>?+yke
z6DVRS#K_AOlCfbILLs?t<K^uT-x<C?Ix!IONeqf&xg%gOgyWm~i!JA27!#}dge>2{
zLfiMdW8h9MUF%>`fFsvNF{~ncojFLj+r^gfUc(`0^#lU))32!vCzZkWJEd8jthRst
z5)2vhVr;?=?f)_`#!6Xx)$DEQ^JD?>Q+rU-!ZOuc$LMR>`RqQk`J?K$@x#9Ldi{7W
zjyiIJG$u32#2Y2792d1&1(kd;jovjUR+y89e?l~ecjqf1q7hmMA4<-$9-|)Y-;<n8
z*0}QN72y0>qcqznc%)IG*{eNlJ)*exxi+%}!x={Rf)6|?qOM#Z@zCdpn~=zs)ENdw
z`$6@1VJXTqBxX3|bCybHB&@nYV*>F2Who%ITxZ#_<Zgz1pz67Bx?I@bS|=z>EeIJo
z;1Eo1(N<d(*06i}6$NRk-E$`*z*fF7oQ@j+&?GLWv!?ll5o1x1IQsYmm$wmk^+Q&#
zh8tpp2nNeM_^@Z~0=J~J><8$(9Cz>4g*Lh#qqqFqNFftnvg9$32Q5;$6)At3AE50$
z!dC4`XK0!IO*mox@k)+ZuXsEf^f$uWEdSbYg0(Rw$tNn>eEDmMG7-|lklRov(Vxjs
z01`_jGBW6f*JCIQ=00=7-5Y|Ts*4jV1(b;NwLbOM-Ef;}rGDrk&^f7>>1V$Ny9+ue
z%llfA{(f<Z9NC9+ZVp@j<TExZ=~1F0Rr;ap8lhU;4pjm<qD697tM4E64|EezYifP>
zx`MA$D!-WPoNM=gF^vtGyP9^a0a^FYOe<0gMgF2AJ8YsyWJK+(wwDiU-CUr1BvfbP
zY2q1`N)t06?K#1E17HrfmM;S8su^f(277Lkc)fX^PwvWH;rULKa|SD~zF6h-dFLWG
zy(CZdanSbj!c^fSJoIchAJC7MoGw>^&43LD+x+{7FDy!^Q}b`7dBJ#KA8^e^YaF$N
z<n-RO5oYs2B<{aYoibUlRt#la!o6VCG!u15p)~>f8qO!!33Imkff}H9r|5dd+4xlf
zvog_xs6fWg&wxq|a@ypKPF@)87RQc}y(C(%0Ghvw4LgyZBYQfiiFXiT18rwW*Zyp*
zc^wP<r_T^<&FXq>N+<Mj63~P1xo<zLC22K<e^a-K?MhP?UKWYy8adW)C*F@=K7tQF
zO?&DvjHt@PN)qk9v(Tc|>@#5hmOL10xFjOCEgn)Hx|>HFy+#%t*SIpt4+x^I5eIWr
z;iPt@7srU}*0K#;)rbu+UVo_>4ta$C=g@Iw(tA+19#Lb%_=RKr1%R<XIP$Ndk0*it
z5NU>--dUov-A}SJKdO$}zZ=(ds!yFR9quQmjRWZcQ=G%Ql*`j%f~%fu#Bzd=gdE#^
zJnP(gG00!Nd(YSQGbL!)_L)svU`ztu6Z>Z77YJnI$T7>X)H3QJrwpg}-phB1{)p?F
zq~>W}C-sM{6GuK70|BWY5c~$5MWva4`f09j`E!2+N$R#o`S*hr1vo4-5{v$K+5EHN
zJ|R_aF!y>SlFz@vgy<KRSf5<HuQM)|M8M3?rv9*y3r3E8g{7sp#P2<j)Z-0T0UpXi
zU!NLz^P)u~Wv>PQp)=bta=oO2kvFni@J#5~;3b1$B98||v;y(VcytHG-OMd&N~cQL
zxGh*oA$}3ibSfxx7}=U^!4ao4HWtAcH-YN5hC_FnCXv_)b37VB7%>PM>t8i^bk*2W
zEUlf$-XiYlj}lJhIIbm^r#dXecM1@SWC($i0AsnGS@}D813&O?ZMVn8Jor;DK4jV5
zn_b!URpvg9Y+zDTf~)%rOhC72E;6EO<IK~Y05{$x4u9A>9mB9RDbm7?;2&NeELyFZ
zY@EZTRYCV9qyKoRjeJ6ize07PiC>|dQpMIyA$X5=1So><_j)`bzY1}XD#v%;;Gu&D
zxv{wreF=AY-DLHCc4llRC%_?!;fvC`iU}^cJG0O6$^wd28OnP{6KQV`PQ7k_IvnKw
z{lOw|Z!`ysMD)r<=+}|4V>KW##!h?d%=b*r(cUzZ!9Iy0)xg4DFLGiOZ1<7v)7jv_
z{8fRBITl3{78%RjMl5XM3c)bW^0hY{8n%60?BC^YK94_>|Ad&Wd0<L+*wbmhyTrPQ
z!k7hj$D#m%9kt|95-AO_lUiSM2)e99UK-P8`8{;PUS?lWn=@+Z=5D@LiQmA|u`_#!
zPm|d5r>pKXA#9>`2%8IQNyg55N@a=dT@z+aV>2m~qBZZKwL$vZqiZFa&uQQkO0Nf+
zHmKVZ@^4GjpX|KzlTBq3$MpChS|RgDmwxyWtE>T-e6<T*z5g}kn48j%y!$s2>E?5u
z)i2w?-u_$=&LNulCKxjO#>Del&GRzrG6LZ~JhU7~cvtsh%SlFNeq2W96|ejIFSKf#
z{CrO@&XkLgR*{9rCrq$j@s;tt0@T<?d3OmORn!cUtBy0*;DLy$Y^5RSF!6o;*cQPZ
zWsw~q=rGwi?vWYum^EO_eW#oqQn%X}+Mm2=MHi~~1=`;h%KszsO?ia}L8G0XZ4INU
zZBU05`qGrb;TcwmkTRe*=K0U?R;jQKWb4xKtBa&tZ!U`^)bzW$eWhE46=L3o46i?@
zfaK4WmCo~Etoop~<f$-VNJYx%FpfS)MB)@Mg9;a~m$8A~OF@{XsMoTY9&roj)fso2
ze^?gMVnbtnM;yu~@Jx@GGLU8%4cc$1@rflaJ0JNbdMh8+M@R`S8*qaj7i4W}jyI3S
z4>49|&AmFUQuIRRTj%4RO9Qezpblg?^jP?bDwQF`SpGFb?u2h0m498I<9J){8SrG`
zHL0ea4S6~_wrHECZ!Bp}P;Fp59Gqkwl+-ym<wi`jG#nv&gio{i&+Vyfd)Yqt`ZqG?
zoj#M@*-^{09Sz<t7-r3GXsyhG+GdySQ>gu!J&}MO_JaU!2!8n!MEs$2bf{&iCY`rM
z=;=9Ists`ow$~OplDAMYEF#S=6cB^&uN~OB_rqz2JB~&<8z;<@I^LfW=fRo<S7NAg
zmbYdfop3d1$oC<Tzc<Vmu@VsmMzAPjZiwZ9W=L(3xJY=@Jh*7b%GS6(J?VhNCA&tv
zfycWI<AK2TSRG+QNC-XT-52WYKMckHy6T8j<l%~8Q$5rv<9C!RZg&TZ<AB6O3Ow`Q
zV}d;=F@dtBgXveMn`;CdV<E_E{;N_(xT7s_rbMCJUx$eyp@a0mUV~`VX&6({e`C7T
zw>)gBC~H+9Z6fyh2RaQNBawu(Aba7^9>g3K<YXL)FTf#*M*R&u0b+hQPfz}803&!#
zvas*Q-Py1~dPpyaaj$rFI|Vf3c2ql19mm`_CIJ3!A!{dTe|Qmuon+Ldeo%mZ3CIF(
zBBRrEgXHy#`5-|t!}zH>B#2&fR?A@vZb63*#o$Eh#`8y~h#H6B_dgxHeu0Wib}8Ae
zziY<&GFux2`r{TIwg0ZA;j<e0QmU}W<?4Ndd(?W{zxd-^G%l>6zXH_XGyld|#J-dJ
z*_Q^(b;zP1gnDC%EE!o%6JxdWzz)>$^ffF|ud~T-<k>pEDxU!Yf>(^BxN~!_D0?|e
zKgQbm#5BUnf&zy4)gjJdc40J`*F>%C`RlRG#Q(dk=TB0Qm8qs3pg>4u^y=DzM5>K}
z5DtbL?OXOkn0YgJ4Fdi_ux^TZ(_D*7u$&{o1g9oW3nH-leIL-x6wa-GWPnAZ?0?o<
z9Jz+%4CRZ*QVT<(jxS!Yr>}JDH~5oK&_#`0<|mwuMne58@b}1%7y_U6O>pa`%q3t3
zi=N;&-dFgp83!=0fhma&gMyfM#959S#d`(N(1$ALQ&S1;pfgZTBHO$TKOH1&fMH<K
zPHyIpFQ$jo*!m`cWzo@XAZ=X{Qwp<bBR{3~IZ`yf*x8NK8<;Vhzc6}5mPjRmPB{Ji
zAI5j8sY`GvKD&`XW~O?163SPT)mlE>dsxlL;lSF_FPWu-De-D%j4?i)8Y4b-ln9<=
z1dQw}k^N$WB!E+bVN6P>Jy%Y^3HxIEj_OhPthC$|bmw(uOt8|;ZL1n@fyIxxh|zti
z1swoF)hT4gNhhBf!zS;7BQ*S8#<PrP+ea1U_#I{sX-C?JpHum?L+^U~yR_Ak!ZEF;
zci<olb8M~I5JhH`dUz~zSMlgiPXl4wU)I6gKJC>!Yrwt`qDZz9uLz+#JSAeNcAH&I
ztYD2Ac>-KXUCcnx{P3KLX{@Nh8LgIEr{G=Unni%70B;#zRBOoy;_$l3ItGnB5wxNv
zQtp-~NhBK9syLywYwyepH5RKx%RC~-9jpt^XtfgBIf=8P%(c+&G_|@D;n#8CgIYKp
z1BIHg66jXN$TRjCoM8pm6Q8-nGU+#h8!W>=z?R9HVq%_uq<M*az4X}t#895C>g!@%
z<G`U4zFnK<F#ulEiIQ>!aZB*Pc)3J-9Iw%PGG$>0%}26o%A1<$d*j;inJageN%@jj
zl@d?g2b0jKjcemTk*2e#QBj~gd&-c#fABLY@clrAsGv74^gZR{Z{9BbfWO(?OWq<B
zv+Y0Gr*n-7b$ARw_TQ*Zi$WgTqDELw?P6I|<D&h&$%Q@KqQ>yPx+O^5akQ)i<yezS
zWv6~wW2=frP?BBL7}6*YU)1<KUMd^IFR7O%q^M;b?waN_x{ZgVs3|8ClvOmyhX5%{
zY88z+=X6P^tLv|3L{`Z8y0D^MWQcXzJ!U(Xs@C1k@p)6n0rK8uk#CE$l6U9L+1$^r
zTL+H<N3c?O(mY(aD>rdvio(HFEgc>_7E=9a$9E-7Rsiws^;aR!T){k=25~4=%%61T
z86AQ{lMqQY>g;rP0xd`1XTNuHvjVz(axCveL=#&@1JheY7Q00WR<yT;kR4761Uh3$
z0|#!D^e<W4MfuO6W6N7bB|Hc^Om3y&Zl(X$>*#b=Mb0a+?Zy&}JN@RLX_<Q{DJSQZ
zdyW^tiYvj$u@3t3HCM?cbBt&vD0Nshxh7}!Z|#e_6oYB;vs7|u_YrPWq5<5vU3suY
znZq$9WkZ1-$U^Wr+UF0fiy{%F<(CTHJ98N=gHqv*S%JN4@rRpU!hT-!p2YZ7eoLQi
zPLhboQqjH|h@B^$y{D2SC5r)g+8<(tLbRO&6=t;nxaN9*#2@G*`aX?2BKt4iCyZJW
zN`69C;if9GOvMibS(L?@2!L)D#<I0go*dtufO)&F1-dVGlg)p0JnuRHW3G036z^Rs
zXV+gmUESf(s^XQ^Cv!NWiw2%=AbK__sHJny4Ph^u#GX_OZZGeS_03d33tdoayVY3x
zo2p%u9P>dkd6NfoGYGb(YAU3gmZz?z>D#Os+cY2Y0|L90E`%eez;A0)?5`PoI}5`j
zGff5cIJ0ctp_iHU=EcP8sF>}q>-I<U(_4G@y(X{m328ev0BU5xUt&u4Sp$y#Ail;R
zLqZ3uA$f?l!s7?YK_T?;GKT956nO9y^r9MIomu{?WvKg99eQ6qD#Nt8dn!2y4;W^D
zA|dy13q&fz0Cxc7tEt0!*;EGEAV4sbO8$$p5_@YDO|27r8uUbc$%!X@Orf@pT@kic
zzHU7U3@^tOtJ#NN*ldn<4=*V9U$gdS4=^aniizbslVUH=$9RdC!+EM8J>Wkc7vX{7
z;yrz>vlGjV#_+<^vcBc&?0=g&_GxxpJNBY~f9YJo0WLZ<eeG5WYxh?$@UTj92tb>m
z^&gsCAH6@$Uf$I$R3>Y>-sLspRU{)AoDq?D;n94)k<-153NCCzd^GkDK#!uh<<FIz
zta}Vxq^k8Qu@54s8~Ja~h<)4XF8Q_9-~v425xINi5h;Zg4`TQ49GS17$E?!_tOu^w
zAP?<P0)Ys<DDhTOIX&?@YJbX6EM;f>QDhfFP{gxwsy8t2{L%2xj|9F|hPZ`F(u?gT
zrJgzOCaIZA{p9Nb6}4urT>l%L>$2m{H+qU+PL1C;>86%aQQJ_!#+AZI3du7Hj#rM2
zN6*n*EHav&J2@4da0pVhG-whWM_~LVRo@<-3OFM&u6<>MAjdOuWKujx9`N`RT9J`g
zf7~za9fR=WRJ^StJ(PyC%heD8-Jq5*04yjSd5aZWaT+Igf<b5!A`Nn)v`=fFRZs2>
zNh@fY=)~pZ@b=y;fjqXB%X#b)H&>E~0PO!z^_4+&b-}W@OMn2uJ-B;t3+`^g-8J~Z
zJ-7we;O_3h-66QUyS>eK>)opRpQ6s5J$p@0PxmYlB>FGpI01oZnG>pmY@528!C|un
zR!(@dl~W*e`uwP0K`O6w`F+V0A_6B#T|O<l)ma}6vCkFI5I<9wh!;g7KZgzXRuT33
zlnnYH01a_XmX}MtX%(fs)@?A~apP!LW<Hx|slNO~S0;To;Q--^b9X{WIq&0{s%IAk
zOjc#_p^=<-5Ypx0{gI%T66~XEHEJMC;sDkw$n@I693>Fusaxv!3x-9`#nu4nE0c3p
z#$$n}d}jmYY;|a%HYWuOwvgUT>TFppW9F8$Js5A#n`D;Z_g;K%C{`|yu%cMQ)`NGL
zF^)j$H`aNvxvw(q)&+Iy5C%ty;wgYWlG|W-#K$bKxM(ex1^62pRFM=UgA!5$8s0`w
znS6>`$pCw=j5}#5rzvna!?02mxHloN65x*35sW%t!fP(NcCiME<a-{GHl&PIT_E^f
z+v>49d>ftoce7d8Ar;JZi)tm9t`>EF+DpkD;HP^5M&MdT6wIL0j#a?SCaBm-o?w&m
z*?4x8pZOJ#beVpjBc$0)LjQQ&8IYXn0*1xB+|kAbqFV+@%a4uDWTUryzC1j+S1B&%
z8qnv*Ai{D+O3ue4-S5^_#K*B+5*}Y!7DuRxa(_Hx;hxbakL<n;L_e!-sGBcEuAHS<
z;WTW`1v)!QEWSf1p9PKJ$yT`{WKB(FCB^IUKL<H3wfEtMB7HBJu`2{5IH3LAM}K9^
z2|HiheU!_GR`C_mvy|+r`{ulFGMQHl1BG>M=x1&zIXJGFT~^T^=KS?b&P|08r;w&h
zOPY5nkZKVLsmqxANhTw^FP>>!SXLaUb-eQjvHEa@_aRxo-x&}F-Q9n|3^q_Ar^PO%
zGvfUoGZ(JtRH9bB%Vf~8Y62}Fl*Yg6vo4RQvjx^PCK&C%Ts=*DlSi(gZh^bW&ncKA
zuWpDfWbrh%o2$NvpGcBT37*c@yS-i`G-*~fYoUK0;q@XG*tRcLq+2I$|6(sx5!*<f
zj=EyQob_-XXxw&WBD5)*zhP(1Uq@vySb#sqL?qum;V%#G|J3Ip!3&~WqkvL=<15h9
zm``hI>D7MBNNXaH`sP6UDJd2DMH}n|yP{y3TM(IVGC%-1)C#+ykYBA^&hHB?T<d)J
zM4#IF0-K^`bl)GPQp}DeBKRz&h#WP`rqDlekqk{K8cMdiS*8!qkBR6pZ6Nye^a3zD
zESk*F@T%A~ve_}fiVw1*vTPJ+9!F>XeQvy&y*^PHGg=4@IggQrJ|G;q5*2U;pQ;#L
zXME`)l>4_6ok2iU`<QRm_C0EUS);n!JXs@`%dPbWwNw0WpAWg(9r@$);~eqr%)xzr
z*2R8-msK{Aa)FM@s(aY^IMBxBDWKvLpGtorYI-s{w?QRG;|CRj%1GVAQD?P7^f|9|
zTLw_`7>$Pv!`=^y7MVS`IU_vvo>eIN!?FDmRdI4TtM@l|2T9H#v%X6|kUbsje|<u8
z(F%1y^_2kH^%u|2#jdtLa<8sD@jGsdn1jRFy_-V<BxPE*3Wgu*!m%v$@&cLa)OG9m
zuU-H*Hs**>0VoPYE>u915+H%+`DPkr22B)_U-FJV)G;&t+GgL;C*>y%Ev+a&us{oE
z;@u1S(sIek4JQr7LlH34<8T0h;(3A1Hv7wB*dk2X^jdhLfNC;q|BL8hm?i0#sAAc7
zudwQws}O1FJ9lYkUFlE`)$(YcZJ^KcfKMcy#B)se1+sst`z`I)cVQxu7NywwYg}`Z
z+X5k}!gt6n0hihQ4{p>K@=e22p|7)K2UP)dZN`Ip7bNc4vk?8GWUNmT8(g|Kd0F{E
zR9<hH*54<2s(z~!@C!+v;YI!VLWnjnFv~`o0EI9shTlTa9I?cA*&}#b9(jx))W!Mb
zyOj&d7Y@)GD~|RGc&*`Sv$#R`S@m6{J>5%s+zG;j%`f)5Z|!S7z*UK31=^~^WIkqd
z3!ZySo|HRPP%FW`SJrsI(bjAu0-%su8!D+m)xUomNN7-vR`jj$O3YUj+-x;h8a6fY
znAusK2IGIUkKqFiKC_bqpd(HE-5bm7v>5)o7gV_;NodT_v(#o8ADo92Buiv@WMnLZ
z`y@WcX%QNAnlTWK{!HB&SNMuKmG^n317Qa<V%6u<n%_?CfH!XzkMt|}#*n|t)6^2S
z7Z?@6>>nml&xbDX(4wX38m>>w%l%O%#%5#^Oevd;#?H}1xLH_L>%U@9cEq+}v|P7@
z5kX;hM+^NySRVV1cEx%jh#Us=H)qHHl1ioZU1G^&dFY`Gp@fbtUaaUJwoM(fT=jHq
zbE0Q!C^@QqqGrk4mW4Z~s}%Tt`Lq`p^o$_#CHm;fLnl!st9eMdqe|@sibd=M9-?DI
z+UU!FMJBQ0{%6|`?Uxa@nb`yf5=J1obps(dD89Mx`#2n8Sbt_C8EgmJ`|0%a6H*3q
zKZ=3Tw8T7Hg1R%M%8GfM3$mxo8|F>G7o^L~Xav2=M07coGkR!8#&Q8gL5?cV%{ycG
z+Uc2ura=n%p6bjTPg0bc20Ft>ym!Y`i;*c}&zAtK8hRd;6~C~#qz4><YRlT$yc5vw
zydpf^Z4qx$DgY@pErFM5R4k_Ilvr(03_!{xOASj*P0J5RnUvZNQHH}g7O&FYd<a0Z
ze{9raZ#1^cod29@|J@{wD>eo&P<6?LzHVz}qXf@y4f|K-j26CqEh~J3`KvspF01*B
zQ<BclG-o!fFz?g(l;9H2X#fk#S#@lO3bt+iwdPI0gBT&fNwVU-Xm)44DS;tX^{t&`
zTi(f@swTtp3DW@;l3PedA(^74s0!UoZ!o@#iO{uk@k~S`Kz^+k_DUk1_GodtpiT;l
z#Wy&}gc@(5ZngwQpUh3Z^N5mIl2)?I9LX@|S5>Ph@|bxe=JI+2g!VG%kNI5&&mUH|
zPO)+VuKUAGuy0$R(J105blu=`GZoLlTkkq|vLPlgmX?rLf&u~Etfz~rX%=suWK>M(
z*ctd|Vxj<d370|WrA92LfnYyhIDqsnK;l&-+tj<@tQty2fskE?QO11{F6g>)%=%S*
zj84n8+~<R9NOBYv7OV<-kN0J6u6dU8uz?FAUsWWt?ElpsGKB=PG5>s1*+a4+FvKzw
z&A>prYO3xrLLK>t?C>}b&AE|EdD-{x>o)bBTffDAL15Yicp!KYZoXXO6>Q3p+kv!p
zM_otQ!D4qL{6(4jbG?6Z6Lb{FI?4=I<lYSF44*9?6t3XA@%a|ScO{TypU&Mzh`6vf
z5}@g8wPECbJ{jU_KcwU?S0pYL6*Ax*YZ%4XvA)u&w-{9~@PkRt>^b-B*@vmi+hV-?
zuG;EUJ4N=K`i`yv6}PKHkFvq8^;tpd`JiZp?*t#Wb>U&6YT2@O+2;<uQV*i^G<m=h
zu+ejujscLUtN~QyU&+Ez#zBMHYl&Q1PFhOO+gLVY*;pS{hO;ylZ`CEx>O$Un+(;+v
z+6tQ?xQo2nnw`8Gh7XVANHVCJ-vEAm%?g(g#@CT9U3<L$%vpT*;3boXA^HACBy2A3
zO*ThQxq~fQJ$BVd#I;e<b=`Zn&#5{OYj?Bly5;iJAsFNexbJRvSsofdI(S}beE*R1
zRvGf<CRD)w{q|02Cn<oIC`O;B6)orknP9T^E1~Z!&EDuA{E+j#&7(wG0Z+Sn$5Med
zV5=tJ`VAq!@vh+TF2muT7c|)2+kHR1<2Cj(+d*~@g%E>l<g2T)Pna0uMG9k8o~8FB
zn<$r)Mk*-&6N}!4tQx`|d0;-)?`k$)20u8WWbwd{7@>^=F%oS$NEI@%4z*Vy42Hua
z)e$4rakE{Dfy35Lokx1!gRfj${P~)MbCQ;@H$-#dX;^hWVyIU=cGHq`E*T6_7|nO<
zz%tngQZhQAg>4n;&=&6)hFbtz|0QdLe4$GOdU%?z<{|6w@q>B9CEJkMlliM$O+#%D
zc5c%M@=CV_&uDw#_MuMt>Z4I5)WK*D<rUXX$4d?Vn3)jb_3<08KHlSC<3Tv^8)NKL
z2!VgIqb;_h4gAJ$SF#K;Rxn=IqUv@Vtv(}27qU{<&X^Z`>|OUJewEyLn`|N=&zX?S
zN=Di^_?oDS!aILWvfa!|?ZU;0@>YZhs!cKBsGEBp%I6GQDJ75z?q{y6Wc0lEj;6at
zi0{H2d2bfK-0j5V3<mf9T=n_?swyT4XEYZs(K-1kf|0`{f{rX1Il&i9-tmV?t8nS~
z*9^MEmW4YxGth;`_W@n#ck~F*Q7(;<2zuTX6Zuq3A5B~z(1p%R8m^)u4aV!VNBiq`
zn(R?6=Ce(x`Sr0vqU)iPcUVSD)gqP45;+}37{eL9kA4yr`J~4!)W$wLi7%Wg0H&L^
zvdB#o4R5r<3q7|;)B$1Xmek(FMeB!~nJA9@5i|BtAZD{wMQ_C{AdXokpdUa+W-lXU
zr{it>V)=kHG?#{3vCblbj4{o7R+b$+Kp=wLD2Z%WeJ@Ci0w1W%v6-tDC4NgCh9sir
z;&b~abRd?|sz4SEG4lCp3|-I8zDOO<pPGGJ;F>xY@$${xSmtDaK1dUSJ$jT|1S5J}
zR8!M0+3OV5e`Z|}bgHwJLM)^CYW7gb?dYU?MESY+#$?*T?EZySR(T2SeKfi6?+YvE
zv+m_Yk7e!f;>85O!MwA*)cU{FKK!d8dH32oD*J(z(5zHePkRSL&swo4Y2m6~Jy~Ip
zvtpd%ScAiJ_vH(G8F}x9-OmLgBm!M-VQ+SMqLdCpn*;Mk5QnpKIj2Eu+s(Msn((88
zaSMaW=!VU{(PeaN^Ygy1^?ThC1P_OFfOXHFwlhr+zI7*eKm{g&Wh=i!EgYp$M|flX
zWCEAdf$WK)*$|gV!;Yu)&eF+<QbO3-&}V^VQkW>K9BycnuD>W-!rew+xjbAO(-gRV
zGls$k)$-xafyUI9S}E+CZQXSkfV6OG2GZj1Za9rKjZyC|z)k3k+c(oVHUn7^tYf?F
zA~YtUo2g@EQ{N;s5;<q6l-jPEUtuP(nj}FmfZ~W<>$yepO))|>tpy3|l!%d^<Owds
zWr-D75uSwsIlXXw;{e>k1T#u-UxK=)Z!UckQ~}~Gf#CzT{t3X!VMe{3_Hc#RLz!B0
z;(O|R88C>R2@6U_e)(^dvGiha@HDj6ti~2AorNoefO1}Cx5pmC5d%MLHZjQ97eql&
zJsBNPbz_!($knSi$RBU_uD#(N;QOM84Q=W^EkkEbSSUpHh0<xZo^87eu?LzWpl8Pz
zlpmfjXVBYjPTL$(d|&ly>WF%-d~VQ)tQz!(Baz`D;^u%d@ti^XDEarY!h@sz<5$~B
zm9%CR;zbh?vgNVWdPNRdA6OG)f77Qb^@J8lvh9Ilj<rye?z9XxW%di<-X%*tL3ZWt
zQ*84BEvUr#aeY?N`p>?vh-?^YKMU#=LAEDFFmH$xWT&mUk$O}CmoCd53}3UYdazKE
zXC}vln_iFiPFc|4M8BftA-?+fu>T9tjeD?}qh{$IU%$3u$&2oTpx0CpgqO2MqCYd^
zfV`bd-qa3ZD7$`qanDs&ZTf0-qzMVd{}dT1m|>%{O&PlYz1OtF8zU*mw(P_y1Y)=4
zI@oFE?n4hzP0$SJ^E9I>Ed(<P<W88zb2{=vI!}%(h9dAU|9$#q;Yt3y%N^pX{zqQa
z#<-A9M?uUvqaJhaR7>%-5OV>&XG~e~UTvp!24R0sjVYpDVcBy@iU4o220+$Rlwz}2
z+KUL#`8Gzq%h@Q;i=A$6{6U!fAUdzIMV62Q#0+}EKL3G#gxH}FX1pYklzmUnk?qzu
z%d`dq_3CR;Ru$wN>kc1hEl-7*Wcu*pNz?aT16Q4~C@ajLIv*N=vnE>zFRO-;RLT*L
z^BUm%s2xd7*xM}8ofoMcX-U(aS8s3hNXeNx%#-&nA6+}TG`PK2QwO2kpW6MwT7uMV
z?!@`V26q(z@$Js=IT8AfbfJ9qt7k;%J@P{7T=26mx2M<f9A&fFKxVT=aw7?L=}ZZY
zjTwj@bZ&i3!v~_JGfT6&J`!~;54Y`@^)%Z3ExdBaFX<ha+yY%ge`vvjJF&{NI%Ila
zdMa~b^XGK=^J=jB-Wf>lNKLjW@w!bGuStZDxc*-H)&gv`Z7YpkozT0Eo=a8sb{l<`
zDzjMaH(%PrIVhg=?Z1KR`ZmiCN5-EXof_9BzUjT_ch)E)E44!aVeHA_zI1Lq@#g?R
z&&2x98u*4iIZP-1gnM!TT=;GKP9}JqWrJiqWt)fHblEzHrB*UNVQ;ELHkGVavNlmR
z^%}a6)!>f0qtSl6k<SmZw%-eKpu7q?jdowhRG{g(A)>42bZT!zz1`0#A!qH7Oxe3-
z6lVNV@s`t`!vnLSvzaV((vBl*4XS`fDX}}<q;CzNdW#{~H@W`&wVx<>Cj8Aak|i3D
z1Y4_5!1)Kn>fWIm(|2|7lIfH9Gqvj<gD%`JNjEozj*CH~ty99Y*VlOIF5w3RR*pYd
zQx=&GPH6ZNjCz^U(!|^&rvF?A@F{HHnVcsk7;R5r@23+_Uw+${1ql0fz3k)`{D!cy
zgqt(f6Fu>ZfG&cl0rL%8l`GtGJ8`vSCI24E#TG#VVt)*sIpD-={rkXu$4Xp2ZNSvu
z$SJbKPXnG$kO({d!Cpy>0BJ{DUi7Dcg@c%$1{HD|Nurcgf)+q(h|>*!CKr%ucHtY=
zVr&2yGMJQL3c@r##v5$F9K5@3Z8RrpZzS+v{M>u&myk@gERO9s^je~+B_Pr}1DpNi
z0m4ag{a48^P0O;?7%^Hi&M|5ImmGzsvFlnp(<Dl_RF>~%W2!&hZ$LmLNyFTbC;vmz
z!3#gguquxC8QuY(yU+(C5ZzBK*h|V(liM8Z$ctfH5eDlo4P{2!P%<f-6D0HS^KdXS
z!@ogCm{8@folRHF2Y#kB0f<>~h2^|wp!iBB^R8wkcViglB@0dzHd>LPbrr!0w-&3T
zBIianB?rxyiBCAnyY|IdCB#SqV(49N9xGcEP~}MUZ*&&N*kdB;<3t>7n6M!R+Pm9%
z8kj!#*+0s=^>eVRq2BJnowf}2$-F;jW!R|sMHUL9(JMr(*cL9xGOnadtEPh8fojzu
zUeV$7J9!}hr`{O6KG1-X`HJ0&BvzC70u301Ih;Nwy#7Z62J!IEL}E-(FZ1OH`3Y#H
z!M#6b<q+NjFgNYI2hTfkh!Z~K`l@6}DeAMXkEMG)12`TT{DgCyBlex!+o?{SH`w~m
zNlr*=C4JSajCS44N(wa)AUB0?1>t4_ffG_byU&`!BeTd=9wGr3Zlh4zmeet@HHs*;
zg3y{8#iC-$&AO4t(BGXbHqJwGwCf7|1J<Uiy3xdSkd>vZaVr9PD@3w%23%E}Mwx^r
zCm;mrQ%(^$*Y~9Si+O~JMCqVS%IgZVm0H-+f|v~R!Egxi(Lq-}AaDr$P>o&4n%sC%
z+sEGznd?XRzO!_KFP(I7+c@)axW$-Ws;!v4X%`Rg3M*n&2ZW0i(rpQw^13(JAu<m_
zDVO>e*r?_K=&Wqs2MsF{D6q^5QyP3{vCIz5wW7!?n3sZn=h+oO$y)1dJps=5+m(_S
zs~B&hp%J*chy?h+`g}GRJCN>Zeu{?ZtXPVzM$oLx+dn8yBPn)4&P!Io#$~~KF3<j-
zIuMh545$ZyYtAV<E%|la*H*C~IA45i0mOTNo2@OD4Io~3wCq+7Z%x*YG|F+0>s4Ux
z@?fi!3arOD3)^hf-fZp3`m{O&2r>BEEFC@La=H%5WI^8PNX>lw#r(~`kZb}0ffb{5
zt98Tb_j8*C;aqb5e*7gQcnryh<cO$Am1Sd6Fv)wA^j9<a82V`ga^8d$j3YjS34gmb
z=|}J<)NDOcRyoY#IB1ElP)!IipHdA+ynCkrIU6GO<k#xSe`L`cFPn6zlcxzx{u^vU
z$-FsXryypD6Mt7f)9L%)1QOxTYCj0uudS%5{_Ms7%FU@K$9#SU6H1uLD=t)IeXr|7
zEh(J(*#+}%<;REQk7=4k9D`Z-ARH&Z7I0yml&)@iQ!6r{_X0&6eDWFm_9c<m+t}Xq
z{0r-JlV<2W-_ect>zSv12gV80v~aQH+WQ~M%{7oearu%D4&-k^$`kd)JJCgT)H;;I
znK!hRsJ(?X+%s>yvwDa^2NHZ2RJbOA@ochwg~{sOso4OZQ6zmTo@4RyN<mj20qQBq
z5ncDOby9_`mAW?r8&SD+@B=v<duE?yBJaA@SP(*0&!0|o6er1zX2vcH%VK(GyH=8J
zn;g)aOlfH5V{}pUvJG2i+$FXfH=h8H!zg_lhyy>DJ8x^Xm*Hq&jiTBaQyk+amP@A2
z)Ew&%(iN1`k4fj?%s(nJ1WpKgig-NZ=zPmYwi6p*lyTqcllGmX`<qMup42M}NO{Dy
z+kT_=i_1(9m;6Bg6dzSQp{^*doP{F+#0H>$No0z0Qi_kxS6WiNV%PGo&^45r9ZCz(
zGQs}WGQsk(<2!reCk(M?oc54I?tSkGxVu8YH#AU`TrB;XUx+iD#t$<WGW2PBdnWbM
z^jv^X>!`|Sk9|Op6c{YJH|{iv<fK7G63rV^c~H1XxOf7n9Xa1#p9Q{wp3Sn}^%`9s
zI(s*TuHOmXDqRgK#~bX$TC;f@95Z{>TsOx53Gj316b9?;vuUI9()%5!Ck?oK)P;p1
z;6Zc>i!8HQICLn14&DW6p_p`mnzzxq&n2_aZ$9#7C#-5M-wdb=(?F43qM3Fwm6%YI
zKuuX@aWDFv^0Uts)CiBL<YoNSlEF{xZKFl6lnt93(c7-iAlbZcwMKn>>5|9!UF9Z0
z6()0KS-ocA@b-V(!PSp;5F7Wub}(#1V$jstOU?VFb{tP3$eehX#wr}}`=c~n4ClcY
zG*<XlO1FgK%YAYGtJ}lsL^oOFHRwuI%%=u=>p(mwX=3iJ2;#m?y2?^_lcdCWytm`%
z8w>7SQ~GJ>$vWk5HH^=CC(1{w6qcwcB3xRy;WK(c{is7L^W1G3<NP6GBeMwWmXQi0
zMfcKVJQjz;LFfC<tOZdBx5oF)LSlV8(w8!39*W1E5L)N>7n=mr9V<%p+;@MoB}7ng
zEqcs`rn>|a(0!0~e~d<<B1(P%qfscJCzY5a?xrE_{*X#Z*w4&Kjy>pS@*a=DF4+Cv
z41l-DbXL3Qj*r?5(B2H_R4D18WoElPKw{1jVzF3tiKb^8z$Xpu06ai_Zoq&vIOoY3
zhsF*4aZN2A0gLE<<t~T*M-AvktsVEew0P`KqjGc=wM&<J{kkG7x=;4a2p=Knam<ze
zDG;UzG3Tcu+PTDRC_i0viS}j@Zi}RFB0oBR0Tv$A{`FY(z#!aO(_iRK7SzNdcVfb+
zSF(D#7d}OpQKi4qXj2iaGyil!8i_mYrx(N?(r^S~9^l}xaU4=VQjS0e?j0M-_HYT?
zSN`?~^+`Vrm%)K+$`jpMr%}@!q`6%=EWTqzVS0V{7#sQt==dUQS`JZv0yizeu;FHZ
zU&H~Ox_&DvXO||Te!~ETa7_p+y%i9_4q+RIc#|siWpus28I8ieJmywZhV6@7hRqSL
zE=~}yN|EX2K>w+{l=}v16>qVyoR5mJ?I7p)-qO5uj&O)I|ET&G<`BTwF%?2Bn4&HH
z9~!+g59tvPzkfQ^^SC><lPr*q@zW<25Y4)fj*SqG1}PEH8b=mlmAGrJte?5P4~nA`
z{2D1&k9t>Ls^1_`+8h#E;%59@w)o@EQzhuW5a16}YOYTHN&<=NB7bL=+biPvm45dJ
zmRAkG+~I5*$JM$=OX97$4M#b;ZnCw~iDj=Z4(pFBS}{xsOU+=)_+COR+Fe$nzKjYj
zmfE+r&Hc_Asxiyy+z8JQHf@8}x&t;JTl-)GN*`U*Q*HD4h(HG#{gf~1PQxkQ=P@^m
z2$Tl}bl02R^6{WBzOM%tO(6X*nlENwH0yCRIkmmdlDY<4cA0BFhOmPlLs&A}60PD$
zWU`3iUM7~_!IHtjk0C5e%@(fLSd&KP&e2#u07y0sB`xmM9I7)n4H>)p|IP+&QlTD)
zBqL3UZ*})UGDK9S#ow|daC=jgpeAk_Q?@TV)L?>)K+kd$xr@Z3!byd-ScbjP%Ux3N
zE1%r%g-wUMl;Zdi?ASbi!$1`bONj)TxC@j;IidxU8@NPDqJOb66(gTQH|{4}Qd^A0
z3Kw57r});_i9W$e`&GQ|S{n}OGjmAH^p@!?e?vjw=Q@7Nez?u7L;nB@qnCR0`JhQ3
zH-8Thm~ai9kP~SWT%MG*r!My=<NJc7%1-oD6C*0hQ$hd542iwih4S#L%1SiT>c_Q3
zy}v%e^y+E!_ch7c?dXe+mAnn<0B~D!{9w*U#FEJX;vfn5bgh@Fc4=yMfloJS@rqTg
zo!w~6J+6$?>PM$ZFgqnM;SFae!kupe>CPj~%U+$JROhintBp+h`(43F02E~agFw5O
zl7;)+>?4!N*bHpJQy|Wfm!k&R(aUI~{__jYI^!3dYU;Dw=<bz8#@QZx&Yj(<&$Wm5
zR9xGa(OJRWh>p?kLDfHr9l5{Auk0MBd$f&pUNv|%(Qm6ZhInR$RJh6FVIWX~j8TF;
zUucQW*xBhy6GJ*8`n28z;zAy&l%*efC+Ai^5pxf1j6)WG&l~CMCH}ejPgdyY4dTnW
zVC9g$@7q>4!p+7W(S8YBC#eDNW=!9sJv~9Q-#$MQ<Rz?cL(*t{L0%)2yL3#a6@)*G
z(ZUl+lftzMiol^=H=k)A`o#?qh>1%~56&#74!alFwlm?|Vj0lVYyJ9K1*Py)gRp1>
zXy~#T00od=OD-<Z_4>8|>{AhIc13u01)u<8E?UvgQD8MrrkwF0YX$IDjIL6ucxeo<
zgxQrb=;W+I;ES5NwZ>CwCO@wC>eC$T05^9DMd=998{;RO0Vi~8ThJyqf4m4YRpUiE
z^^dBUVa=N%7pex0wD?LdQQZO8AsX_1vWlSn7ba)yObijLu+TAwKl5oEiclqCrcg|$
zaywKkv#5mmwmqXZ2R_nQ4WEsgcqY)^ugkyn3*@>wprvuSACjKfzEAJYZ7b^UBz0fL
z`Rvo*fIIcLwa60eOn}sI7yC0`<CXX?-=N$kHh3{swSEES(MGJSSESXqBB=DADum-7
zVc=r?5JI)(N@W5<s5T%B<E&hj;artK7{t=mz33HLqmn5{J)GKrFmU})N_|zuue9S@
zQ{y7!V(<}L>mf1c?LUJQl2`WR4SGC)_nhw#r`tRPQDNIuE^kz1<*XlyD0;Ud_3<34
z6Kzra<sTt<SrK!yBWS4_-@k53t_kGr@^|K3!|S;hbE(Asv~6<WgZR?uO`Qvlur+i5
zZc=d>Pqhu<^v{|w5EX1v*+IBR#(BYjI!OE5Ka5L5B@A6!G@+7jo<96P=@Rs{T%jF}
z)0<Z6LDpp3#R^dfvl|U7+&r?3JnolHFG_T>Z7pHpXWd~bXf3e_r2fqT_4@!FusL`E
z%qNjVc}-BdowU=gJu`mTb<PC6?-9D!4b5c5iQd-M&-lQTmjIVse`v?ZX@HQ$7Uiaf
z4==_P0U--xAukChFZs}pg)Iw`RN#bwhA~Xqxo3fS7CsI2*tRPE(V~4(xqVSIcGh=N
zuiZjPeUa`!8|b74%zJ4QkINFAS%+ZLLR694IToa&ou((Gl82^sU=vKESaGOa%zpB7
zaB&`y%2Z&tpZTc3JgsBVkJeYUEkk~aLI0n~R0yW#{(Mk5`kUtzy4jQ`j&SFoi<o`$
zC2)CZKB>wgoswUPg!P=gaI{>ZbV@_n?aEJqri;3yD083gjca%RF;j$Y;#{sEGX$H<
zm_Z%F)|o8G_pKisH#p+dkB;Xuh!^uYLE-!yeV9<FwN$R%w$^=Wg0ghgA!PqZpjkQ~
z8j7{KEs4X63bjBq*jZ=GK;g4xAK_rvmJh1LVH$}yZ1-FGkkZk8C<MDs`oL;WAy~h`
zC+W#}1q9SDyegHq{a|O|8B#dD@hjrjg!!G3J`497^UEVlDvmkUy9S<lga5H^3rAzM
z6F(uwUny30;F?A}<yzd-)C}X}8A=Ml+W4z%V8I1Ph$%qSfRIu#=PCeAe5%;4LH2Jy
zQ`JCIfT#JDv&5SCkZMrN%RP^mR=&;>Fcvq>s~a>Xhs?3kknx*$e&EaRa{R~+xx#26
zy$FuN#EkjSlwH&(>;My)&syx)HGP|UEf$)~L;5@{w9=pHWrn}CNNP%*P7{@9P;2_-
z7@iDn2^fj1fo#ZKQ_E?yl6?E*Mnnvo0Xs<8E?@^CS5xr@R8-`Eib}{3CQKDA3^P-^
zL0?==MY<9Pc?83t-C_|46B`hwT2;1_(aEavsVcl`njbLn<E0!}JR_5<H{gXG(lFi`
z>2r|Y{o)S|+zUZtO{Y=K#!Sp{1xAJMTKXCS%^=ZyUyN2L2V6~>fMC#cD@cPcJyPHw
zMzqkcLHo)j+!i>#b9aX_5l>-)2sa;;_iFo2UPf#;2<YGWBsDp-iz(5LRog{uNCpc^
zp%L;!=zQIJNp!&)6UmFI{>u{lc%cP^2j%u495C#6958hou%AignOTWo8{@-}_8$)m
z>iT$EFm;tMWgI*(;L2xkdzda&v@YOjIl%4Rt%6dg8hG93(i(twAhLo!&3jswZBs}f
zveNK<1vp;YTuv^r4VN6}o>LvP4G)Sb$;du*R<=C9yuOu2te}f{wYHs(JBi+L!|o$8
zk)dbspm>vFrOU3{7UsV^M^jUSM0iTCs|5vqIyDyXQ3y+@r5}aD2^%dT4@Up7=#qUg
z>yj<#{`DZ3Z{<;#u^Nz8hvO!`@l_8UFCgvT$xmoogi=VrR$vRTd>em#(-8dAwwy-3
zZhTcgF2imf!qg}q8UscWJ71~C&S)HG*mq26clMIT(R437TkOj(>Wqv*iW>|vT;;w=
z=B+G2gd3UieEyH64JA^M%6gSEA%#z-IHOLuhgX({nPclArz|-suQ7eRTU$Y)>KGcw
zUP_5khM60S<A_sWd~vxtYo_=!{QsUUnigL2p1Jpaq_~Q<k7_Z_RYov%#dd_`slE6m
znaYz_A}Q6p5Lvbs<w$~qcHzNKG6InTe@BlET8}6H(w<`OYSeIIO3@FA{hDi=`(mza
z_FzRe9b-y67s0ah^3bkE{K?`cd&*{Ip2R%8^I_ECs4J0i__{TJV!c{L8kr*JkpmS^
zs&<Bv^3_YDY_NF`A@$8#;-{wRbV^fU^$OIEmL=(6TX?uCZ9<4q5O6TSF#!hyNmp)3
z?(iaU7jQ5@u)$S@!&QBp3lRU#!t+hrnB-e-_ksYS-9^ub(9X?Z;-aVgq6e{O*Izqb
z+vxFKn6;;H)?<~aDmiEK&`9399SMo|RFw#(;>!sSvG*lpr`(Ra-qjz#<YR}S$Kjvq
zlc0)GJg6=Q(n0JdG}O2UPc@2;MT>m684!kY1z^8udp>Q(IU^MTeDC_)tm%vd4rvCT
zg}G{^%C;cybfno08jt)U*~EwxU&7!CpxY^R3`f`pBb3~6`uS?W)*HpwaOnSwmqpJW
ze}uWf28<l!aXs+qWKQ9N3xSB}%-biRC`1WQ`QQ*#7p@hkte&q?`DgRmN|pWk@};Fh
zwcEuqQ7zHw7_HUF@YjdIOudTXO<96JG3k=AkAl!OGr7`(igG25yC6RH)Dbnh=w5+I
z@A5Oc{HgLe36D_<J1;g5S#ys@Mtf%GdzDtEakAs(<;&A)Z3#oB#K?ss2PNUP_-i}t
zK_^J#Z!Bf3o1+UjqFNJU-eYe-X)PnoZ30A%$=lSMR2iCUb*(W6VlAy&xEt=He8_rt
zUEJCViu>Crq&%Nzhon1IJ;y|*sp#K{3^OG{EyXnU{<?0YjCU`?AI{Bu%0$Ln{EG}j
zWu|S!r;6l6vdJOOf^E%atzK-sUcAt{#YG@;fAQG&B07kEc7&DYLOp{P@+c#LPd{b8
zyYAFeKcEjr#$=*}8z;>7HM(&O+=)yHzwGq4D9h7xPyiERH1kOM*~H=8PWs~2FlyKG
zCYS{&OT+RM{<&eLh`wJpiiE9m;ok1r)r_XJcLi1jKH0OXm+s~TUWkSZ`dCrAN{=9<
z)iR43%(S_k&iY{E&ZY7l?O7?j`|>%+dd!=jW3FC&SAdw*tyx4?jnLn!TtojiJ<!3q
zxu~p^<|WIzcv4s&-VLuzj{#|{-SR>FOE*$oDC4BjuNLu+CRHp=mv1H60_^E3{i>P$
zZtCg6URcH2b3KsBCktNz6b`cNyqi2(u-!LC(J*y4KBFT^ij>a$OyM<$S094ok;Z>8
z%Q<8{n@Ok!%Hyy~u=^P@Pom?9=<<Wc&pQ}%r2&M!(jcykdZ%V!)+1nbtK*~%cNIU5
zXSsfduu?VE)dZ`@dZ+@1JQqNWeBXh5uT?CE@BjKpxgI|1^QC1H>JY@0Gdl1iA6%%|
zK|Yj-6m~0j*89xwM>a^nLHP9NrLsdv#l_>`J%VBwzdI_?Aen;-hUgCg9_JT|!M!Ln
zMjpvYF+dy@EyH9rDj^cYEXYIzzlm~RvF<JK&x&Nz30<^o8l&x9R=%qpS_sX&^^n*+
zM-M(E`HIXyrf5O36A$z*#jBUFiT{}ZoId|?p=+#2Qb-z}+S+?#9+LLTPvmPlgFdJZ
z4b&VMj{*mlnN7$P)ph+<ZNWbOL6;?lCD90r<#4#0_?fZZ>$QK-`BPj$-?=DDber?s
zvG2ESqZJ{qaPAr$#}h{2T7a^>*JtPujEo>nBuDDh<w#{a_yLfBNMH+hj#EhX<!2}6
z&EBF<Xb(HCw7epjNOn>0NOlz*cKoA15($&K(ojdX$AFTR&bbd%tTi3yRX|MJ#tqO;
zX~=dJq;?DdedZmm;J52ACg_wodW4(`uq5DP07qU9F(wYfW{1oskN-sOTIcoVPmso_
z$8O0#tgr;SF(~90hhfhmoP%U9jK0Qpf|c6OhlnS1&Hq)n73+7&rTwqe$cN=q+^N<M
zZN^U4`*ou&h8Uke*Ow@iIw$+ww)z6gNhxMAF|=@O4yalO@34e(msJ$qx|N*xpz}y%
z5wW|`bhp7CX~@(q0m#%6<kYB|`sqA$V4JCXHnlnkFv$G@SRa_wa7%iilBEKbEPKfJ
z4~_pHpmqG3ZBg&2!#bNlS?`he2LSd8${)bKsMt<nCP_iLFJkmw;%ic8o5x&VaaK<2
z$7nAZ$>H1Sf*)7;mopx&kgv8X<j7lrV!CiyJ<8BmQ7KbI;K_!sGDnM&bRJ5(R2iTo
zwM>dUN)+CLnYicuesc}k+3i+v53;rj6UA<U*U_DzI+$k|-{E^5PcY+IVY}Hx&W@iR
z3jQsOZv_9mA?Ms{(c3L5mMQ}qsF`Vgx?H3t@fEH`F#q6{X*RHa-QITYO8Nf+5+B#x
z!utnD2D4(FKJ?M_GQRtRJY*1f=n893br84QZ=uV7^Br#Oa+Qtihdm%CZd@h8OW3qZ
z+lA=r+uFHHANa^}Jwl@oBpXQ&6fEY3T#wY@MWzOzU>UJSmWM}{0|krU$n&pbwrLT)
zyxZ+}8{jj~Zpa7pKRFFX0m}{k%lUe7t|x8wx_C}dBSW48rph2Njmp$U0<!~$r%x*D
zRJ|*5(WMhB;lCbBny{o1tAwMPV<b4vNUf{SB5~<9^NEZs7aJ#kGH-fNlO^U5O_5kO
zqB$%<bQDe-L{H%ep}5WZi?4k!?h8rY!;_y`MF+Nn#LEJ11T9O-NZ)#eY1)zAH)WPi
z#@)a072+whzJgrCS7AxhF~J>(%_rn^V=!Fi2s9ugy6G4fT)efm3D>plSz**25;jfK
zzm=&!<L|eTx?pImR#lzmUM56#4pM&)h9h5l3%9^yj(Y4#r~CbY!=+=x<(1y<%gX?c
zLX->}^1(Ude<+FUn+|e?O{_NnB@qk?9+!?7myR3ARudaV0CcLwDx6N)?SZicBpIB;
z$It@qGK{2eg``j47lUtdUN0<nqprdG2KCwCsf77bGWdI8w8(8eOUlDdK1>Q1#|0i!
zU!p-K?z_-0y*0s^!Z`KW>H+C6d~aIrzLTXMMP^G<BxQMTk-u4cqo^rl@KvMF^e&VQ
z&>(QhJ`rCl@kQO-U?vs(GvM3`Xy~*sMXyFp!T7r!C`DdK81gxspmzr%nXh<Y)P^O~
zu=2b0(Ud9T$zmkb%C+GSjDY@dWGsd81pPF>e_rX(!4Adohkg!(!12*q!qNI|NX<rG
zN?)CFw;EX1WIbN-L1?wolpF%Cg4S>lU@M^Qttc6+02nQ++S1$4N2%atyv*}>`T*jE
ztorCWpsVDNyOt@so+RiznLX#=j@d-2XT)=#%y9x;JhVgtZ)tB$7v0N0NjI$Nmzn9)
zQ3D&{@3?T}gMt&k0oMpkx*g2Virlkl_w&(%8)qcJ)_joXgCCXv;!;piM;<U$r3I#{
zHAsUcq=SGbz#7=>t6FLmTyq7bX_rtBOaX?aq^_+ohrh8>S<zA*e`qadglZ4az=zp`
z+b!K(l5$2rFjo;$+c&;a{x&V<#h<>VHU7*+tvUA@_V%h&R!y*G!xVNUwPUlf9^3;R
z1s?F>Ax&|Ee1RbMt;OPVAv@lwMxV+*Cb$CmWg5EObZdmzUF^vfV>T!0(F1`t^$;*P
z?fxRG<29;70AD?&={`vH!B^*f@YRvwmN)=k9SNLVgM-9*G^BYSeD&Y~&am|uv0~=I
z5pozn4*H1#e6@?3U~X-cpQv__C=3DxY{rv5Nc3-NC2^?>EF5Rc+6v;IumsNzmW-PG
zANO>pq4T;sCns+{`^KF!W12spp`%{vdk;DpE4+Vjq1WJKxEw(S{lJC5gd4&k#dkZQ
z2TRXN9u@%kW+FPHyU!Ax74iEAq$fFVk{t2rFT5qQHPz`>bBTu#a81wKXZ1}yw5g^(
zgF@w{TU_1dm-y}_(^`M_d0$afGv5!5`KbRZtRl@};rRD4*ziWWFDAaH=5Mqf_O_gG
zcN9~#8m|RRH2abtCYoz!<ozXt{l^Tq&-1`Nr`iGPHm~ttTsnOIpmN-vGH36XX?srs
z*Cv_75+-1fDdXM&Y`CvBu$gS3C>fM^(|#Ibt~IEeo%^(v3F`Mi;9LIUr_dE*2SMN9
zkA*iL|9~^DY%@MHHje@bl`?JJ(?48PP9H9+zwY5jXaL{n4un2^z&?}4@xw&bl1?eF
zTaI%u6tCJY^kJgPrlcNQqnVsx%{HUW7N=8t_5G2JFrH5f-_v6R^3(XVj*u5bOA;AG
zcV!+uRJteBj>IQN6n}(g;x?&S`NV5Jmb?L7HHC>R-xB2+Iiz8;aYqq=NK?po1NaJf
zO9!Kyli^T)9y)F{2ZpHkv}t){H;Se=0#1U8p>&UzY1{`;SHG_*vVW(4jQg)f6kUz|
z>t;j!rQ5~~X*pAn%s25Ng>WJB9;+AfOrp_`QNoXZ!JtzJC%Vym)9B}&V|<Mm(D4SJ
zi#{ve>zTx=YO(0ylz9-++K#kU7j^uwaEya}<?jTu6yAacpB%FC$vq*`=s)Y!l2au-
zVVPfANMH0xOYKJ&M+=zHu1(0wK#R)z``Da!0iK7$6;Ghw_V~`pV>?dRhGo5_)1vD!
zCakutMp5Gf5cF$ft7<8=NWn#K1&C_W?fp|YpXU%nF%ng1Kby)lVT$J_Gi-rl+T>9B
zZ^-_n!bC%)oV}Kx_jt=!^~cz0tu&^aJ)XuV_RPq;sfouH7+~z5?kjDrps>9tHUiZ4
zL^dg;%dDUtX8bk1K9+k-E<prUS|imtTJV^=VaWWC<~-(OF@>O(O0^meo**vJo9DyC
zsG-FGiz()z^R+cP=OXj=!s^!WU4Q{w)Q8xICd$K{>uAJL1;$V1JQ*%P8=cO%`aI>e
z1n0;gxCGb-a*M-?bbC_u7m58Dda;{YdkeG`bSh~}-n?Bf!q+C>4r?KooU}9JzdjRG
z8fttc!I05e0=ZjYRB#sfNU*)QEz>sG+s<v`6^ui<CJ&vJ@>nW<<?_KR#@5H~$jv^b
zJMm%({bpQ+7o(n(FLhR)Z07QQW_79({N`>{1%(d-PS1DZl^<;g!EmlpB?4S42!iWJ
zsa4(SMbBO|a98-)7a&so0f+j-Eu{cB)DL8~!l+<1jc_%P+4DIX%t39Yf^_ofw=jl4
zaR;jgin|(kH5p`I16<z=HznM25U)Y%Wy#WlB2b}F`G5*_a(q(6a6)TUmh6+_<qs>=
zu4xVf6OrV1+9KLr^#!CRmGfPKbv9nJV}Nx<Ggv+s-0)vO<tEhD!bNNl_vT$Bn{a6Z
z=g6*O^Si@(&7?p_)>wzxiEM39uxAk;fU(O<HpT26gQPbT-R2Aj3J>e?_?BiAHTuC*
z0ms44VkGA@9*LYr>sKRBTa0AsB?*<n`geL$DCAFfylwd0eIW0RneTGNva56q?B_{?
z)7XNRU$0U?NAP@dDqyDTPc4sek=W*uILx-~fcaOelp~vGSZyg<3d~u27rX_iXDA0B
z^(>pVWE>dKWCH^luy2qDC2$8oIZFd?AuSC~t#0B46s7$@IqThun?9*Dbnx!oYUtVO
zn^Nd#1?g{y1=;d#X;r57-Lk51dT$g@#F03dy&lCkwZ(SmqU?WSs9Hfzv4&p`;*+Dq
z`oZA^vG9MSh@@h(+8o0-J|qlfU7<lf_<;o`%}||w^QC`B8ZeH3*$4K2h!M{lLm{*K
zKUEDvG2%B(gHL0}^@WL>X(58Rk(ax<e&<zOoI^FEqk=Eu$&1Y$`DYW_G;~Fc!Np%P
z^jkQ}e4kH3f#g&^iKVq{Z42UW-s!0&3S;`$O5yf*XZC@)qMcckC{YjsfqDx|1|DL7
z-`HS9lQ2ag;WEoWYtB^b)q1W`4`Svhd7$p2^v-;gUYXJ&!+aJFkPJ|Id+U&9N=Rpb
z(pxrC7k;$PPNwDVSjssCxbcF`0XJS-xH$n{ZoPLdw1Yz6Z>Tc6^W=k<tV&!<05{q`
zEh?{5K-P~(S;5qwB^$Oqza#zi-u}1C@l<$9ui@01Pm8F4=_?PB`~Vxa%Dj~!&?lR{
zlby(+D-@2Ez6dgH#h_UxE1QIo5O_T$ZbD<fpC&arqHGeY@i!XvTA_~h$&W2-J`E^y
z#e-HKnAIHBae%B}IT$CH`CZk!^;vRV2HcI1mp6-)>#g`NJ{_`!Y^LmhngY{77Bw28
zO{n@=GWVr;EnT{Xx$poYOtcdADx-DC`HII9@B~_7$RO2-cO=zP4pp9Uwa#eiY|DXN
z#d;vE<mNuoN|m<cH;`7UKw2rVi_Dcs%mHboontwn3pR^XzYAZxR`enInoau9p3k}(
zDy)p;HQ@1*P~Av-tU3tGv&`~%lb6URgWH)=g0L>IK(I8y>kvi3Fz-Yj*OxG>k=3A!
zTi(ug^m&8eJ{<IW8FXwWC@#O#8Dqm}_;0*t$D>s_(55!HOaObyq;A9XGp@WWD*<dz
zZWz+(<A5CfATOEJRh$6wlIerIbb=XGMH>ak%O6;yy9}Q!gZHmQwd{Bs0SuKX{UJWj
z<Y9NSrF9!`a;YHn>iAX&isshyQwxO;#OHJJWK3aDI(r;;4R0QAx!fSta*utmdwm@r
z@+nM<n{9+gK)`>rikJfF={!fek{h#r<0<D4l}2(@vq&CSHLELla`d?(<c|^G(oq~B
zWSsi>$#BEcvX*)_YpFJftgqZ3Hou_b!_Okf)!-!G`8~JzjZza7Oj$!gYM;Bg#-Co0
z<bkhwBFKKi7is!X>KcjnR9e;eEMFson#9yE6P@(wr^GKo>8bj^-0TJkg}L}&vSw}}
z2=Iy04zk#hob6M~<Fb;#HswYF{$qA~K4Jr>u3`nm1`ddgpFK>EDq0T^oB1GnF)Ud2
zJZpCrM39C`V^jk062+*r@3S$?oj0fPJ(g;e7s|1F_9&HBd|MxIpu&5;qWx3#^ja%8
zEF8jo$zhX_`fiU(*0?VXpi&ba)`U|Ns<bMfR^q5vxROoSe&HYWkHA^__9t5C)`n&F
z^rS3l_S7eg4m1f{&;F?*^%KKE<Hxp>L}CXJ1o<CviMiaYqp~wBeHD}{s~mtBNA1NI
zd?~%l-<*hlW22Uaj|Uc((BBZQpj4~zQ^X_Rj}E!41O^oAu{ufVZkdhVmB=DZ)Ffk@
zQGDvHy$Uq|h6|Lz02vhd1#6B=^>6T(zX?JQw&V{nO}GqEWVL!FD%egAKfI5u;u}CX
zzt)uO<aRH9sIn$L$_vpsYs?z+_StNSAq-3GFP<e2UP&f7e4-~SxV@CFMvMgk9Q<V`
zwa&Pi4ktp<NkRUQhCB49@2k<uytj3geTDo8oTbu8fF4(yJh&8#gB>!|owSToPzUh!
z5`WEKI(1h2)Ms00^l2-Cv~MF)h6!YmjpD75+J!XaP|VLTwOQ1m9sJdmC$`ci!`|=#
z;$jg|zsXRxIX64_KPUv2*Fraw`#)sq2^ZTI4m;`#b5AkX_h>oXt52Ob<_)oBX^hy1
z5agezkL9tR45h)C&qS;#^lZ`w36!G0jc)V<YZm&Yw#AB*@+<jUGC<>J;6_J3LE?c9
ziA)@(k+cYlm_T`FD5>E{X9iA29AvXHVl%Jtmm1w^4eK#w#+@eN)cW8ky!tWyfzR%)
z>V^Xq-BCP$qbir&n7K(IDddSlk04EbjX3Adn;N<tT8kVKpBb;(!`}19J2CeH43xK=
znUF6Z6@`tpQZ$swKtV5>&3bA(D7}x7+YaF~QikdC^OqWykeW|EjY#7Q^s(2wh(?I%
zjE%ml4jnx-*~82B9YDvw&zfEtmtOhsa&?tnIUdNU9>q@Sg;zKBspGTzof>*aCW)6e
zh1c>hkaj+KYuF)%v=@6GbJg5&+sq1QHwH!gI>F~IJnc`Qi*{AWPL@lq8*{vlY#2*w
zyf9l&BPYjwZh9!hF@Y$4PId9-+v|8qvQ3-q9jORYZFx6#3b+ZV_`G<V@8vdPG0EYI
z$B1ePt)dEW+p}az@Rn%rIM?;zM&&=E;#O!Ot!}0Iv>tmFA?Ana^?z!VR_*20aA*KU
zC!ii_zJwe!Ps8779bTWAXRv^5xhqvYPeRXOnFeneOFGe;sBk<fSgtEbuVLD0o9U8L
zFn36%;9ZS0apa0(HBqZSs*YeneO+_?i2s8F1qvEDhVM7q_`cJ?oxDvzQEj&+6BHA$
zlx&f~eMTwRVwts^vxq(n$-ibP%~ZN|Wt1V!^UfMXPU>iG)z3-Kr;1?`!^SrSEIZQz
z)vr+fD$8-jTWvP_7VwkkWbUu>3I8X*gpWdl0Ljt2u6ET(33^#!@JL<WF5a~NS|K(z
zHiF`GbJfej_0J#-pF!`7_J(~k^hs1N=KP|{d~h!?-s4K&v`^fz@83_x-m<?;6k7eH
zQvm|AirU~XPZP4IzT(vi+lWH)UqSE>(4WWt{P0C2vI*-T!jjZu_286BI(9}p^GO2d
zX8sgkm8cy)OFV&fOZxtkE>7X5{H_G<pU)(eqH@g9V@d1mLuq&Uu^7H;2~K45J?DJi
z;t4A1ugt7}+4AxJUfiC-y!_j@``{OuP~`_=QHo$VBbdI}5GK?7<(fjS_WJdS7JqqG
zxc$$3;}CuaUN*|Vednka?=fz6nLIp<x6AJh;=o;cSyRMQJy=iMzbeJUby6gf2C=8Z
zw8-WRW9jBmByL#EGnM2H)<tu@hUVg35F{5%&KI0hf;w|3`?n2ENeEkxNTi*SEc;qP
zB^EM>+X6;f8V>pH3AN+gG>{gAiJ@%QLDkUtzqPy0VoVKWHB4+`Oaaoy0yke%GGEin
zM-$tE->P4gGy6AfM=InP^0KL~X*lmQt)J;S*jPEZEcfYyRpY&zDG!JHZbkJg9lacp
z+YzFPn`z@rCI3WV4k6J_0okYke3}dhpOsRREHsn7fLWWvD>Bm?n;+f<8_}7bwa5k0
z&7^wftcSAS`+t<?C9Bg?TJA_c*eoQ7m5cIZ!bQ2bh2R6kwGFNWA{H*citkyp(|9En
zLXDBiV~hm$O1vQ5lyco1@0US8nFx0JgiSI6Y2oVwqy@?orW&^DJj@g5W9*yd=aU%d
z1LTEE&U%T7<SLh5MW3Y)@fwT`E9_Rm;I$jYJ`YE_omKjI6k0S%bY$48ITAK&uzq&)
zA=$)23T8Ki;xXDuzp$n(KJ~rV={J*t%*m^JFiX*d=Q&HaVI_zOn^U~S<C~}FjQH1C
zFid_FIG~i5h5@A<r1SjQjXaR`$TjL1{E6kS$6?z<3Z3noF>|8s{HiUpdBR3Wu`F9~
z#AT!7esDzQI^%F4+DN9*FXv3#QS5C25f)lGmS`t6o&l4X(QR}|(+;KvK^7;(MS>x^
zGSt#C<RM^_V~h;&XOb)t6O3swqY%dxE#PB1-E;r!9Rh&*)7$^qJ+lldl@i9>7TWwx
zj<>~bQ=hp!1P9%qSFiDPOEL+#AW+~oj76h%g}a!4UWa?D5%K@A^_5{&Mcvi{f^<oD
zE7A?p-5^MJcXw|ZM7l#jknZl1Jal)Lq@;A+&HMiOzWdz&=XuWBE5;mS%(>>`BJPGA
zZVUJY6M|2E&7G;?v3OQ(b{Up)^uhasLwYhKUlAqF2%DNXxbIQ=FU2s*GvO$jk9FTc
zQddh6ouoZddvojaPkoH>ao`NMW_;%#K37EDf2nx@8HFLB!1s9?4z=+2nZb_{rFj_?
zx-w*nX8wm-N%Vr4lFWnP$?k^Q88IvY0=SV{1nZs;zki{MB1zD*=VWD1_zEH2e3#8$
z@huj*S4-+oWj$wuui1jXpfdM$QicoUqs0*Z10p&+D~Rai5TLuIbZChT0z!HqJA6$%
ze9i4+4P&6s96_-i8LPSvM`PK_Puu<)R`D$G^`xC*s5ot?IQs*e28SmIs?pUjj*VT6
zZHqx5w+Ew}LE4{or|iRN`gR4<h{FuiRFg($Enga1nE1%-b3_|l<%VT~Z<=p{l!z2B
zBz`Jle#Zj)&kKgLN#X|k;-lK*T=Mkto<mkBk?G%o{kIk-qHyBu?}}H|B$sr9F~!bM
zzd7rLdVk#-!5$rvHy2*LCesftYNYs@fjbyK7>YB79h&}E0Bg`o#=KjFEwP*0yU>Ke
zhL?f6KEWF)(1lP6rI4oPhDm&s97e-in0uoUr^O^Y3(zqdR8FjIgiX%768_FigBM8q
z^-afKn;G0SwIAHID$#Z3pE4+gVSnF3>h2C7LmQ~;U7RZ31$7Nt6-~m0S6=4}{tWXP
zJ6nIQfosL$T#4&Gg>F1OgWPU{(>OGhV!Sr#-|5IiC+<(+2f?+vjToF&mH@i%)l!qD
z``95c_<W(~UjtchZ@0f=F{%pM50rfw7vTV;N$||o@VS|pG=IST$wx6T(96ZbNloF4
zfOaM{k=l@r6RNg1kunhRS$#ftY*}`_*xI|z*GS)wBRL{n!H}E%kG*e;5mRp-Y|Q*j
z?-VQf|CZ{o;r!Da^V%pw1~5I;C=f<)`*EZU?4VjH142~AlIqC=z^f0K7E%V((gx>u
zrWsUK`^tHCM9k{x9DDv?ly~UL<7>@SC8}CxA#$K2I?Fs;g-K%J#*H9f4v`M`haN+?
z*q=V)d?SY}so(QGQsnB26}@UX%E!4B0SYPl!M3*38JAaflN+A|=rN<+r&^;RqSY6A
zA2=}0?1{WAuIm63+xHLV7Hf8j=v$CB7n^{3gT?*(V={&iyYhmx(R@MNY9FMEA+E!z
zArDArIX_ggJ$|vZEmk24?`L6Uj30wp91;%FaRmQVZU0es#NmH(X#5I&FY^HZ7tyyI
zz5mZXU8jF$PUTia95A%>vl86=_pJM+5&K8@m%~deLD`l5^N}9ANY!h-AVtOBN}?D)
zk=dH%=(U#ZmBqNicf&G?spuf{;7NgNZYZ4+;k%qad6$9rE1;neP5z3S4X<qZ?;KQ6
z`3q~?PhFkJq~4N5EyBC&!6w3=QeA^4Y%@)1+nPw<-roj>1H_|yX&t5y{-|)ehJrYb
zi$usRT7Hw<WR$P{Y%}3MLPNhZKd2A&{-VxoAbXe3n}*nI@$QY?`d(d<1sfk~vfG!e
zxfZpps;;GYo|-}4IID(PtwIi>m}Y*nQf;S$rIr4%I}f=9HM%zg*8vooKT-S5$}2dn
zw@S0}2i=F?0Pd@pzjZ;-d~@Oif@Tw4*-&vAN)sqJ{dr+dJ|Ub$j58etwf?2YKa{w1
zqSkg!Zxmie9+izVx2GOG!cT9+PQO6|W^u+Oe)H8C{8WRxOwuXOl}&j+P)!=nOH-M#
zcU6-p<m*s^_G8m?)ef{X?Q7=^m&MSqCA_v&k&XZ#_osjyZ)6PUB0}i2VMY5moo|p^
zu<5Qa%*@$o5S^CsCeONPIC7Dh^ZxVsG_%JkP8M4qlAHf2ZX{7;q3w5pX4F0$Yv+rk
z7_i4Mqb1sn0Gh5+PJgf$+sL~f{%33**^JMj+8$$QqVAhK4(Gtf-oh^*PsW@XR}n@F
zB31#)%`eNr{ZD=5@BPTMScQOdgIO<!53Jap62jDP%fgvEbC&IfgWa<(=c)(vyAxSc
z5`P_REu4)x_r5TG95Fc<VTNU(VK!n!4W^5Jl4{#+Zd#EE?1K-nY1H2Lq0e<&8P&Zd
z%!-%0@DWH+<<1_T&6^eJR60d+F|%#n)~W==hP2D{FoGyR4kD`Ih_yJZ8TxNXD6Sn-
z$pl;#e~Q;o7C~PYQc{Kz0fw@lQb81S-zdOPc9aYGTkduUN9k;;?Tpt9u1cg_+}@@P
zo~MPuj+((vKAqxzMETB1iq#8@rcub#&?r1wEtY^UUP(;a@95PN!>elJ$pGMGizev8
zfflkE_xU?M)VhqeDx(RF7ehi4QGfCBg!p*l8?o`TVR7jJoy?BeSvD@4WUBAztsag{
zi#8sg^%L2aD#Sacr04!_t||7k|5<O5kMqVG*AS~BzGd+{O)2TcX=&8uhd8SHtN%k$
zLi2j`E3VcY>31~_TgE#vbr1odbn!fI!b5b1Yc-G4oUacpYCTeG#klEVut<{O5npN8
zmsF632^ku;E1B8~8G<wni{Oif^cRg+8irL-D^N^`Ig(^F8n*$`6)9%%EJ?b!jX2>z
zZQ(%D+Q_`q6oaXpvHN#jTnTQhl^G}`;B&6`9xCfhJ#ek7zYc-g-{zfAyurcvjL3$W
zHP&fPsM%t{oX)guIX;Ww%UuW$!Xdo^dOidpX{ZxK-jR_T3^D+{iEd+8i^`^bfJY9L
z@=hsiHB(^r8EZ5aMf_qysM>%OKWZ=KsD{9h<eewaUB_H?8(69p30)im7Q}$hCP^jJ
zazHObvezD2R)C-icwPn{pQf8Tl($b(<)S%-Uk@!Y6m;VZ+9N{8D^;gQ2B7>xJ0DCD
zcSgX5e}otTl5K9Zr9oP0m;p6>#S+fm5}-IZzYm;2DR?WY{9e%5Nz*ajE3vlb^QWLZ
zk|ZhR*Ex(&2j@`A%8)_Z)K<z0>|~Hf5U(X2ujK>yX{O}a)uopbDvx5DkH#IoP9leR
z)>D#Hy?yNAFoo(X-IJpCycRQfF&eXz!_NvBDvXiQpXGFnY<(gKnti<axnfMXUH^?_
zS!2jCir87lI5WojNBIo_5#G!G?RZy9L{E!f^w=5`%-of1u<NT9D;oy2SXD*Up8}wU
zvx*T+z8xW#l~R?_fm)1s4qKmm24!&<vHlOlE~o+DB!yypI|*{KK-T(~tW_ve1!KH0
zl@cs_8vh3C{f?V$|L%x0oNsLE`Cm?PhfV0RYwG~Vh8tlU@^YxVd*n~&Fb^VBdMpRI
z$D`F>w%>m3aElusavMlo3+Zfu{ZAGv_^>h7*gOo73sJk_C8GcO8J<BRp?x3zC6oIo
z;_}sVuq2u6ht5jvdI!BZ6F+g5#2ZE7ia&Hv+@T#)ifqU(L2{Vd;_5vha^=koUv}tg
z*7PK{5h2Kce7w456&Rarj2Z5-9iZN7cqI>wujFAxO=DA8lW+yBZTt<`!ZoU5Homfl
zep_wj<D>qSSCswJ0G?-O*|@zynLlnusmp4q%ayPFgEquI-ldb#D^8nRDDY`)2AJVr
zIeu<5Yd|u08MT3{J)v`#5ExX3y&^9Wa1L#EZT&E7Zolk7+c3Pb_SwZSb9~Q{Ym0d;
zWJf!ffJ>MGY_bZxw{9xr!4A8b-SqiUvVBdE4xDrNVdm=^L}!c!?Te18-JUjHBn1oy
z?d|6A7qbSpJh#y&juKO@<=a70(krosmudeDeRgR2;Gil8hn`~EG>;9H?7j68*3+IU
zSx>!MSnmaGQudvH<<}_ALN&f2WH$8Xr5*{zo``e}o{b&&jY<ijMoV3e2@dG2X=5)O
z!AXg{(s?v5+xrxKso<n?m%!?<CjE{3Rl0O}zDk!p?72;qIk-Jgxj1C~_Dt&ad{r)v
zYYp>=u03AOm=!#8%Rg=5jzHn!LOsXJp;1X+_U_2iq)Km214Tu|H~hY&$uZ<_)-!Fj
z-WHJm@!gRyhlr7>fgb!Na_(i=r(-lik((b?Bm*>MlEf${3eI&G)2#5TmfwP3RW+H*
ztE!&BRvQ3S^#nKu_)Kz_Bq|qh48)i%I`y4)!HnwN93Na>&5#yQT9i|{n1@c-hD_)x
z_1ie4fOU4Qy`tAP3VeUEckNmMCDP(9*b`U6<xJD!fcq+yY;MurmetzBug$Ld!MJ=m
zc9FU+OyLo*ZVGtqx?t;<kMPX_6}YIvQH{9s@(wOLSx;v|eE#l?-NK^5W95ON0gj1}
zTxy$Mwlqjpn{kBL267Q_0o5rGxH_EUitxE~(g<#^h|JGRj870=O(cGRlesMi{Q_C!
zuzNjG$zv~|b++%U+$__wTa?PL->hOw?1WwtNsulGl9?p6a{)pLMG6Qd;W~z@a;CQ7
zIv|ul@F~=#DbztYPJ!5p?p6|p3@2HQ(yo9=g2hNXu4j%Na^#8}vdkEgU|q#SM2i+d
zMdJMMdWBnl857u^P(P>WQS|LVwmrJ0AYF}^ZiobXwU_)sf10UmZ62O@qZ=#fEmy(!
znI^K2VSQ&*R(7e~kUJz&gY?|Ps&#0I4ny!pIV;n!746fwb91LVmpdhfg7XyEM37DX
z{EzcM@>7CW@DIJ>rbUvb%#M&$><*X;eRoYq)efI!iVC2trS#}G_H`3~!`=e+KrQhj
zOzq7KC77L*)j4)rC^Pv&c7sDj8Pn*(sohjUYzQmZ9Ndzf8?UQ+&4kq5%^K2UejX-x
zPJ14)cNW(*$MEp$@=mBQeoC9`7=Gt6c2f@t<>p!V2Tu#xvFvenZqI-F`!hFMn7Oc4
z4~X#qFb}Kr_kX8EzS2W1ddV(vywQT!b)P;Fl@i~JwMlG@|5$1{*$Zkd)z8pEFeI6n
z*(aPSL-TU|_|z?S8+8|9IncWZ>inxR&MT}XrT&t_dD;N4f@0Fv+$_4_YM!eRCIj=C
z+9sK@8qOIu@Twy}%2gS~l~4a;4a*gM)xQz|e|029ul?W;jV+rCn|Ri0l1r`i{-5N1
zn#ix<rAlQae|V^-KFhyVO<2y8M+HAt>5~*lLl2!zKbkk<9$b|uj~T(dz}mv^k%a6c
zATL^p!zxiQr{k7sqK{rju=)uTJ;Zqo$I3^LVSVb$+zYQlQQ<FP95%qB*v#B(3t345
zJjt-tMV9^%UUhI|(fuhYDu{%}cr$upz`XK4?FVmH-P?&Wq_CwbrV&~<Fq`xh+x+V)
zQD(h1T*hHCq~LWwawdWMaY4mUT*B0LK?U58^7x#p(wwT`e$1BV*Eg&n{51s91N>QV
zKSq8M&uUMKEHTHMRl}R*fGZ^hHq~H{*mk@NXk{vJYAcD9u4>qMeX&X^lZ91Q^(ybf
zOE#L;JNQZPc2~B~aoL4*kHSDgI53O~-G!#>(bd@Z0wKX8K-R^&;tWBejnfb(Q|l}<
zD_OR*sD<OXHS;1}gfR(%GqfwmTd<<V9d_Rc@?_Ly*52Q4o#aUS3f}`nz(HQVHk_T@
z!{AW_Eaz7a^=34m5xE`E5ESog<*4-&IJxs^t;WAzYDo~yq0Snz34P;$997I+YqB+&
zX7$}BaAH>F>eoo6$A|pxE{h(qj=|(_$>H9;qA=?+Cw3<#rI<7kyaK8=IjxO6?QX&}
z4YCss<2@vAPpZ1-Llgl7qIILMvh~FAx0MO#LJQe7*M?*<_}(5!s-iH01(J1N)6s(&
z_Azx`ekTBuVS>oI<#K5<6KWbuXg0WyS_FpF>4>d|X`zF}teY;sH!+@EtqX)#M?RR|
zJiv<IBR@lRR-L}HkgFD5NM#RvPW+|#M6KUrHVm*6{aQ-eI86j_r#kaP#s015#zL@p
zJ_TA=-}H8tMJ4@wzQ>E`5Q>w|ISfshBG3F5M}&L@M=9nZCJ%Xkj-G9VOWaRWMbmxB
z^Si1o{8pil62*z-h&6|ySRG!2>X0~xR@bA<hjL`@wGLoTWVs9xU+`1|GH2U3&%+uf
zI(OzEl|yUJ5Da*m`k(53+u#ME{muGoc=5s2BLOAQZ8Ru>>|r|S5ISDTcHk*T@}}$d
zTC+$Q&&}FT+feU9$fX1IjR5<KH{Hqu4e~i-A;IoOxX?&th8w9_u``&K%>E?W+S=Z8
zIDN7*`5dU0YO^VSmRe==vAcIFDyNXvl*-FYAMp5uVz_^SQ{6`-h56%|i+XH@;#d|b
zm9|PokPtonj3vb-S&{!fIQtBf_=`JE+24K#S#JAUoQtZ55RERP!hZ;(Rjt86(07Ro
zdXS=lg-aXm-(Qr8{N9AzFCk#|h97Gq9h552JI3a0@cv+q=3_0$g6*0aKNnJ-uF_|J
zIRxlNgf%Su{RmDto>%QetS37~y*uwvUd){Toyw4{<DGX|>w_uVt+(SH-%@{bZj=0(
zdFW3@erj#{7e#Aw#()mtN-YT%>fg!8J~Fa1ROsNx9MAIkYVHPP824utnfqqQpE;a{
zb;)s_G?0d^gb}ZH>hbcEh5G$EH>tW|P6swCQKFn)R3|p`a>{`fGpFyOS>^aV;qMvU
z|AntyY{+{ynM5o%1=Cn&kaRz^-AUfmx{#{h>DDOPaZkLPeEeq3a*lw1()Z4kz6L!5
z$^Bu&a}*W`<za^3iF<d!;f{CEJ!vi8{xi5}!gaCR69aRSOIr#OJ#e~^5W1F0fdU*e
zRGC34c2C>?viQO9x%!(m5MEo=h6rq&C9iE7DZUd<`Ct;;ft3Hf1>4q%ZpwgqcfDZv
z2G!4l4BFCIf<TF7&|nvAX>qbVgD*ZxLs9<{al+Q&lKYiFj58*j>iWB?ySQbkQ^Ekf
zkm}D`Ci|~+d1%^;p6bSUH6%8394$cRnDDzNj<u`5`(&0m6+VuJZlR5A=>+VR`~4Yh
za4}u!a96#p`}X!v=MuylCBUyWACf#|f3o7kXEN183HZnEkv@2YT2+`oF<hPUDN<44
zT-on7&-}e7#Sb#ZgNpESVWnxslqGkj5T_rt9WJd#j2FWj;eNNC|G6ad2-yG(J<J~o
zpC7&s^w1hD|K93}s`tgh(3BlX)!-eaVT~SM|4i%L(`%D7<5;@G9F|FxT&?P)v85&r
ziqk69co2FUWDqOMRp-n~sXn3Asv0%Od}>xz2Eo_8G>^Hbco|N*V!uv4*baqDiqk^d
zCMb{4!ZSw=f!}tq_{X`(1h6UP3uAC%j$VWczTbgsO#hNW@=>j<T*r%lP7UP(zpkM6
zWV5-v-Jo6J^h@s1Q?n$A?L{8-mFv1{<>KTJN<3w)a7_{lCeOeR7?v4|b0~tR@XQZn
zS#NkNHn50a>kueTFy_5hwLeH|9%c%Bnk^i*$#n6SoL&E{dC9+U4HU>|!S+s;|CfVO
z;fPLOY|}{xO(!l5Wg@pvIemrRIC>dhYjxm?rhK;yz#b*s)YZk=Dse5hPMY!mJ?NDl
zkDN}i8H@fbPzArZQXth%W!kv6`sDZEj`&9U3~maCA^z{wqR9$XxNJ2%4hc?)09-7y
zrGn3GWh?7}F%!^x`y|-k=jSqFLO$TTFHUV&G=6K$JT7q)Mdr>;hJl?THbR{IPoOn)
zj}@b#eqB&TZ-%t@#g9&3B8HF?(2^fY`u3%E(7*kWu^0Ee6PiR%BXH}-;g&{k{Nwp4
z4H>E4a(x@i{Hb4-By<o-*@3#-{&&qp@AiQ%eg+N;gF1kF|9wLF{#+;_*G|RJq&i-;
zI(bWV0O6{DpaG##>JWdk0aU%sn@6WE8QibFdl7Zk<59TBo(sZjr{yqc3SLq{D$=mx
zmt$z%R_`1uf1>j-Z(!P$FJ44@3A;}mweQ*&+ukAjOr`yJv!8xi=1*klQ!=T*C}XAf
z=6R^@Z88<0LQ#M>kF-ZTQkr~ch?SE3e(9UpIj3ddgaQFootNQ^kVQSpam<7o=cehb
zltsdYkjVGohNR$z`^O6%5$zu3YU^V)x|wL+##3fa7rXJey}HCzg}BuY=GLdhq%}<e
zk!6bZNO}QPVo_P`DXCcSiq{@ly1dg^h??h^vS2Onx#*UK#;{|LUYM0szaXq9p~q0~
z-$v{QF%-S9(%7Sy=38{kCu_zZ*2e6AS?flDH`kKZTov{QmJAmQW}ap6gU=^c9}0N<
zgbVQ9n0wfNy$@%`4%R&DrG<aLX!0k_re@d1sYLUKT!ulyG~8mI9v(-Pv@OhoaY7P<
zswPJbFqp>|D^HPOL!D73&^a?sGpsJA8x*f)=|&`T!ps>Q&vWr3Nn{XTWUwV?hunlz
zU2RX`jw>eJK>nHQQqCH`?ZRWamV#GtR{RcCl)^I7ER!OBcj+Y%gD3BF-hM>!wDn5V
z1CB(uYH#k{4TFMmQ+BGT9lsST$#49Xek?j8V7r;m#{x_I%{`6IFf`)q@AaRTRi5I_
zC&^wklq8ppoE{-&?P7FFor+m~v?MNEx>#bF42y2>RPwuHpir{3usaI`(SId<RxL&>
z4kNuq;gQj)6j~@z;RrGCtQ2Fhkj$(43Zn=Sde0Z=zf>2&_Wr|^Ff3Jk`^k?Ff4=iY
zH31(4E=5Zgol1D7%k0eLzl>@IseEOMBq%Cq2zXKg-=wK1BPcdgCXwO*oy~YFwQPN>
zpXrL)s;(%OR^p3}dCffw=$3yVmw8y0S!7dX7?x`bCzurB5(l3r8*9GcQZ6f~{+=k1
zSRa~{R+lQ!JGg;izT~Wwc)B>Q(kJ{=t^?R-3eob3<BoI3ZZh7zWy?#+<zBV%SP_0H
z>Swq-NOa_>cG+{3?ej=fzX*yA%5#uW<Do9rnJSGVO->mUb5}Z>C)U9i_Snn#cx<)j
zF5eluMP5Gq7&}-0V=mJI`6hwJVpTe*P67NRi%js7CR>JZGRp`ob-_<M0)GX>&#7kX
zyZv&VRY%nga?wI?BbxdPuDc7*1s_9*OCkJ$Rj`ZU+tAJ|{kZwRIv!dkUB!qW^cBK)
zA}1}?V}Imsxn4GQvX1iyQ|$)Z!KBzUtT9lwgTKC#-e}QB$Q$ureT)AC?ogWHU3!Gk
z&obyg7zvAW{Ffv#xme2T6{LU;<d+v(7uS%~dh7{06$E+by~p*%MHW@AOT@wtp>zwO
zlYM?lu2|xO%02ZFF_pwS@=sPgpFYo~#uUo`%$<f)iUYUwPYQ5Li;5>PplEXB=H~IC
zV}rk<{!}8+c^n#nNWWC!NM7Fbc`U>YkI*TH$TKU+DTi%G#MOx$A3zPS?06%+oQ&3L
zrxW&AV;CKd_)_9IsTqe|_$k*%l$?oG!aQ?R99!iDmbf{2hMWue(MV3jS7dOxoV3Xr
z-h)PDGY(BVBW`W^JDO0M)P`nbV=Mv=XQxt)qi_s^)pCr9{9iG%I_CZqIRYf(Z9kdG
zs=Q^Kmt`kALBIoT3{Wua*F3vBwB>(56SGM>X8NIzJ4WHf%75?RVh!uQOz3bJr-%hG
zuA(?|emOWd^ETEVKEgKsQ$3*ed`|qU06<RYVj<!~?10?}x-#87)4T5a8V+~a2PHW9
zLdhdQV=ws3<-UF&6Vv&K46#6w3TI<qb|2)gXJGqmQx2I!1KQ^}Nwl?>IRcU&!>fF+
zk7dnw`!!H}lIX+!sqmadWdY6%A7;>gZ&5T9n&=7&s40IRSe)Iv%#mx(lIs`9CR{ai
zmA3+)D32x2`1PgNm*)oAQGeKRJ<UwjVeah-uQmG3L5LE}$uwt`;EMX<mqb;{6WJjc
zN7AhhwXKfBOJF#<>GT^?e1)S>IT7y|lsmXWU1fX&J*=qQBoyz;;$T9*vz{1|r;!BD
z=2-U^QVf#|Rur3dTH&Nl4o&pRe*ER*OOC|e|1HHXL(@R@3J@mw_;sjfjk|hm$nnGQ
zkzS-acR!Lhfv(DyK|wAf0^~v?g&tC>76E?hPIGE9@H7J5^h<_#JuF)*OEz7?ctV@u
zQq*VG&Zke`8Mgn}W8qE5kax^6l714rvAa*cy@CC0NsBFIsf15b;=3)nUUl1Eb;VSD
zw;uKJ>KxwCs(&@doZU-czt$?J9m_-tdKe6~C-`C9wYQ14gbj6SbMd#`Rl!Y5D;O}>
zO6_*hfGO6ZSBb>X4W1Ldv5iZlv8p$m9=h2oYlo*ITz%N>m$a;Js7e~ecfm`X0d1WE
zSh_8!d`>zp9cL;JA7w;6m<FymNBkbyEZUD+&yLUJej>OtP-_Wx#uJk46&$dvhcP5>
zS+G6}C|Z~FKFUB2y>rx6|3Sy8{t1JW>_Ubn0K7_x_mCkAbj{ags+j_p$wYNAGESAU
zMrH^m4x6G>jiU7MQkDU7c<{$*z9~uVC-I&dZzM{yYBZl@{)$!b${}?VcA>)a+<Nab
zQLjq?OZ$n>PyDFJV?I@kU0!6zBo-1^RCP<07x9lt9(D}^-`grg3k$la>4sT;jm83b
zd4&xRLVOL2a5^qE+lhs=$JM{Io&Nnj=jskL6|^VJmFxEWE&0jKz{>^y-*X%H?fP2h
zbAVvj%YE4P_H*a8-_!aw)60rJ5pp=oo5s=(r>DXjT&q6{)iXFrsF1A<3&)9<tBKp(
zovL8ElOjMqQ*uh1DD~LSky(RiVl)(Zx#5z1<nrNtc+^iGetF-twbMATj`QwG%x#F7
z{&}O;yys<5z{d;hll3_f1@f-Jv3=vg5oy|j`J!$F%~NaGb4kirB_@5t@)w+EItWE)
z>>w0vTPFRb*W|dU1A}WJxuP|-VksD0d#67wUF!B&Xz{oa{Q^O@*MjE)AWAW+V=<~D
zU`dB3zMQ`-ogW?Q7w7y@VtervTsDFi)7m{m@nmQ0;62%FV)3vi)(``Cm)Td3yWL%M
z?HR~kP^-!QR4N!O#t<fE95u*o2aOp;7%T=7mp9+)P>#_sRXLeWX5qiZUkFJB#}*~U
z7TrJA5K;|sn6yd+)^#5O+z3mCHd293J3O@1!tbesIpTjt9le|Ul*o(`Cox!k-vTw6
z2l4xw^ra&M9UXsLTK$bu+S2@qRMPaPJlxR+`s=d*_lW_2ud0Euu$LCP1cB@Q@?}D_
zQNNcM$7)hyHcf~lsaKmAY#x>;d7R+rwuE!sH1XBo)&_{@=n>Drsfm1Nji|mHB9Nbf
z!lqhDt-nZUQG>m@#2iol&R8j7C6158azkSK9HxOB4lN&+)sO_Cj6-|vyu%gNbyfR0
zd1=m`4;3fjCbgnRKCAgtDpc4$TGAc)p%u?zx`oY_^!p;~DYC;Uq+f6|`L+f?QE5#v
zRjI@bczSag#dLvkG2Pj{l+`cuU*#?;Fqq4cc@?_AFo9V`<f$Nwuz-c25%u<XJG5dF
z+e*u%qj(4>eH3%k-{mEa4}TP!XHVokuQ_=Z%M}_~mr{2(Q)8d=+<O;eTBhzv2X=m<
zEF#oP5tWeAr=s6S4$_WKg1Dq2$X=r%&bE<-y5zb!UX8%y`-mG`cgZ4$@bxrOEK-~n
z;oU)u)t^n&^TM3$vl`#0X%;5xggNtYB~Wanmb;!8zL;){s72X)q(w6kg@kGihL(&o
zwN~fwQ8rj3OVO1^v;8FQ4@LecnN_O{$1Vz|LJ1Sd&?vjC<#)B)G8<z|oPoX=U5K<z
z?GZgW{}&tJpkv)r$xp2OWFp@0F^8@8Z)RY_v@I`d>3hiKV(ogjps@l~5I=~Pq&6uj
z8HGM+WIw*zJ9bqjn3@C^+%7pUyOBmz`1UX*iLd2Vv>8QP@-)7T@=a^O!D9PdAIHcZ
z>U>tu@<y7Rdtd*!?^)pvD{X{W866Rh1WWYr{m2)n*R_Hs&<-c0<7?R3|648B6q8(k
z*cW(+CdFs7TgSIR8auL(s66QW6o40^OmpZ22sOP)yE_<jZftay$&nTGj2KASJ9y8#
z|4@IGhI?3xJvDKr*VRM*qX!x>D7e$`I!akZc>v2PA`5mtK-t;_dH8XHrEK@izCe>^
zB;6kXYT-7s!E@Us2%g&@AgNqjlcT#6q!7>KkJi+W;JH19dvViDazVkgGF@_%Y61x#
z=6?tuW)>Nh555#0gu1kb<~?t{Zp@?D-*<=S>=mBxXOASpK8W}KEGfAV58I!>%XUF0
zJ~?w}<NmUeV{bVkWwew0M|H>jvJd#};MjE#)xC|$tzg#`oX7(e%dZgT^&Mu7l!RT+
z4MeXG(taN-7KEDJVh?(R0zxx)%oN*=$+Zcwy6eZYq8?~#xuB~xhpQLA^*abyLW6C0
z!$<#h7eQrM5-yN(mfFw`mSAL1?*=R&S8LK$YhK;ubK0mSh_7*^79_b07y?VE#-gdo
zl;hLNscsR><qD~AdKk~wX0~_Cl}01gBJz>Qf~ruWL4@u`(Tco55cW^{Ot&Qrfq02c
zIRe`e+<<kf_N7nlVAG;+Bpmg%N&f-1;rI0M3Mi5rfr)p1yRax0oj_t+kzn}ClUm!*
z#@VAK2d(<`_lEC`s2dW!^MI6GiuSjUFW1p<PU?qSLNc(2O@D4UI?nD_$LCKg{={`n
z8BVQTOz6A9N+4Yt*7$32_G-U}89v22y_wt8<ob?8dqC@{|IYAlP?PhzxEyCE84cmh
zthUm!d9Pt3d({cPI;tZ)MPgT6ubJ-Ex3QQJL65OFFjccDes>#;#B@Mak#C0%Yv&wl
z)h;oYG2K6?n{78Y!INS$V#lSo+I+UL42NJ~)SdwYV}r(GFUViC<%VDuDQf!EYWfZ@
zhofz(x0DO4d%w_iM!)X?k6tgcWR`h;?-}wp!>C^LIkPFcx5wi1w2-ui7UJWv2svI=
z{9S9LgB%utBSii(pyau}bpnbHV|)y!>f2kxZ2pHS&E}x9^{Ef22GT?Fj1GfCPI6<V
zd|^w?)nhg{0UkEBC`~H69{Wp9K2yB+*SFf)^EPS7*I^O1@d2&m{mhb#KJHZCpa%!D
zN+6N45hI)HB)V|zf=sB-jW?CR#`s0&^X6^SOJ%$M%gyaDAb5lO4#o)CK<sdAMe&qL
zrJq)9KX(dBlZc1`^}dsYKpzVlK^+p+y0K+m<9)Ir$wm0QzD|F>e#UTm31~9DC~ny8
z^zU>wCnv<a<LN1qw6p(mDsFuv5`t34viUuH?TrtDpmzh&Z!jtcnPkFT1lZ~@`FG})
zN(AARqK>5iKP>&$xPvBE9fbrg#Gl2>MmBRu=Vxlh<=;2(p{bxrjS=EkUVp$@X)ZvM
zXDW|^ty2F9i4MChy~o?WUK>Gs!qOhY9A~GCtfkS|(hQ<k0)>u7E+}-Wdxzi(%Lp`$
zlu00%anud*)Sz~AGyXQNx!@8-XJxwRSOFg8Sb)xKmj^%Dv2PH)*@$092|f6d>?fbg
zo15n*&%};N@}C~Fd@R4Bay(PMh}<2DWLd~zGOZ+E^vYQ2^GafsE7z+EE|;D8e%Htu
z$8|TL68gGgzzt1cI!(QuMy0bJVlKiL784uY?duSZD?(|>M<mY9obX0<5kSIMSU)>y
z+XR}<r(Sk{ZxUMJbAYUx@AlWRj>pP|pWjW`@iH8uSQnztMa{oYx#5$v*kQ#fw~~|D
zr1QUNpv@dJ&wUx17@^j4e{C&xup==dD$=P-HIB7S83B$T#~y_T6G;UQ+Lcby;I;5h
ztx#7f$dUCRYR*UR=bQE3h~KHsJBUFW?gARE(uTTdZ@q{M04c;}dBkQ_r7E*jWJ0nK
z&&t2Paow1P#|ns7D92G)YFyNy1%e1#Aj;u+RZ)3o2$#dP(whk>^u(0GUifYq=qIe4
zRKYwK>@o;B0l`%YBB`3bzky#@xbfXO<&h)c#uu$6xM5I?9E<IaID8T5tui_SXuDIw
z$JB|pcc+TV=CyEyFj9G1q;lfDjr-;_td>n$$ran4P;C5mt-Z3JJQSOmGnSt|583m2
zpUK{TDUoYw9UqM(mdATO?{_|BXmT8|#`yvtszLqrdf&mK>xGk~wQ)goj5?>RrS&1H
zvo?bM>n{XUQ+7xW2$2DzAVdPBVI?+2kdio25F?2Yc~t0lRIct!B~h=CgPN@QWax&Y
zFN?ra&G$(%>z6VKhX{%4hnRaM!516<h#o;h3K7zVNIwa<?2_c1oG243)<fhpuZy5F
zidJJ-fok0p-l`tG&YvPTPG0K!`PW#%NvHETyI@U3g^N^+$P%_O1K=m^UZjT7m><`k
z8s30z`&YzSf`HO}=Is&zM|i_4klVfj`BI6^0i*=O796An(xe*Qq}uBs>*^E4S2-a0
zNmc{o^B|5xk|@U=X?F-HcS_zneM9)T@+6Ns*xZcj{J0CdPIKz#x2nxCAl{!{l6uh>
znmU{s$r}VTXPtkXL29W<BfVgwJM-(aguT@l?ve}0T>8Oa<iHVsKGYOTH=EcdhH#_C
zks|i#{4Eo8d{?x`K9?w*-|&@;Y(s^Fn`{<76-DoF)af>cghAHswDKTnV&!Vsr!P>3
z;aG{&A7&K6yQC(OC{Ede?&5*G^X5@49foV~{`o8e0pU>`!$FSkJseiZNM=Bm##aQg
zG>@v9kdLJje5s(u67CHu?+pS;8u9r?G+kT;lt{S_FDg8!6rsC8k|qPS`4(#PJ2d#1
zwuu#DARibt^tgzBU@iKUs14l^ObHva9xxKqd!nWb2OZ><!oPL)C+qHLF~|-tNH+Ba
z&fvusbr^bqoFbOLN2N=*pC|EN5@^oW^MoG@LC$rn2y(77ebe_})S_;gXwiCs@E5Ib
zFCgb~-R}HA&(YHVTqp9E`(fG82J#G&Xa-Z@s|j#b+qr{GrS32F#2$g4=2IdNTEJ=N
zn<>XD@l?VG1$oHYd2>rO-<e|I19(>W?DrNrw5L~P?WQJs+NWuoHX^lL(+dAJ!<(u2
zZew4<a#AQ?)ovMNqX=T#Le?v`wGV}6l@ToJ4ZRKWz{QX6i3wCnNixXtz6t1D70Uhh
zSSWetgf7T!uWP@JNX>MVR`xi4w1213auoO-`n%`1P{g6d<V%jta<V0WTc#n7?Y@S&
z;7~9rweST(ZbAP2{$q2$utFNNWLS6z<kE7DrV>?tZ$);~<olu?NFZ<;Zf0P`=Zmt`
zeh?RWfm*OwFPhIhU&TID<&?T8tCgZ@`R3aYKE6+h!cYo+JijsP5z%7lHP(j2da_f8
z7UvBGl205;d-$`=g(g6De?)bkVX5|}mS$qTO!(jHr0>5@`h>ozEI8@=Os2oc??wO3
zOZ-#!^(#hr;`i;F<ajK^wj4NL2lxDA3gvi$@}qm;Z6(X&%~0cI78brQ_{X>eV1F;C
z3*W8I&>s&SLEOOTW+zKvXFBCw&ba=cxc;ZMN-M!r@Gb0XK}+bzOm_I^*TeSsdf0AD
zZNP`DF&@Fgwt@CrpYFFlc-XQxDyRJbtvENLM^L)G1z!CzSfCL8`S2}(PB`)bWY`xf
zQ5B+dGY!eftyhD4Xs5oI3UZYhcbPbg-X))h-0@k#0WIPGQNM#K!o49T6|8>>xdcFt
zEy5E3FOA&)yyc~Do04uKpidOu4INlqYyk_EP;Bw;dr)@KlMsIc_kKbi(+XNc>*LS}
zvvx@RAvNC4mcP45vKG<5cRMQ$t6@`gCbWKiNm91g>mzLCreAzE&Bvdc^2YL=cbgme
z$QgB>e(g19T~p|7MND@+`=9;sL<RKSy}b){JPtl6UfGij-o<A>wK>LHeio^AVHF;*
z_rDs#j<$Yx%pNxsH`65%e{NKRBG*t26Z?4<Z@*A}qInwb;0MT_CwM^i{L4A1oI{gi
zsu@(hW8|6E)S0jBS!yq<{?k4|>a<Mlwt-z(HF@fA+@2<FDz7NBI$<jC%LwH#0p(Jy
zqA|MG-}wb8vO&EhJ8rPB#MHvdxUPLrlk3f@Gs)Y3!``|2dOM=GJ;v1Ye9X~|qguq5
z$k9}NCpzT`SySq+K^0CK?<-GRhntZetPQ_R(J6XL#V<S6vfMjmk-8^cJc_QU6L`~N
z7}7S%5yY6)ZIOAbP*Hvbc5|~VP_JXSvb^mBF1yatVX>~&_eT0$jN3)b+t{KOf&atB
zx=#3CF4iz(ll?r0#C%n@S_$!hA9y6H_0_Vb4e_rtP%$3<LOmFot;!tYYxyC7ZR73o
z{HA+bo4(JWu^qVqZ?DL^yfM4pV`OJ{pRy`KZ}B4M&O7=Htnb18;ni0-CS2cbXTAwJ
zl?krq?U?4O;_^{n4F~_fLpDtvPYf++zaD*^-_Xw!-{*$^PyZ}Z{qjG%lxp(!;kZI2
znN#FE_xj0JW{$>I6uXsj;|qpoX2K_|X4FCoI!#oN$TtFWW{K>qFDk2vm7FFX{p^nO
z%fn|`PwX@8<H;X)#J$FZw2kEZYol8-no>x#wFtlS2=n=?`f$!}XGl7oE-iCxN83JU
zK5Qg(p%lsg_<JAf=}=CjdawMf^8IhKfTrh3`Y*EV3e6dZ7ztK{Um^cI@834XjWH}X
zo#koH&=4L1u&9^8zqh+z?23(_`cJtuTaKdkDj2ef8Hfh=ri9^`o=7`kN1TgBTTRCH
z;7F(PUxtHv+y^3p9Qy8`V||yq7SVFbx&|5V2VjwkOdn*}yZ2{es+4)S<QE{NdRwI8
zfS=AgLQRUwP$Wh|j-NSXn9cIYpe;21J?OczKjj(d<`F=Z%&7S5ehHi12r{-sMHr^9
z>Ln!Mol?Y}Ncnr+yAH7(20~(Adfc;GaU}ons6LOv7D9T<DS*n4*PW*{muD9)T-oI3
z9}eeYN$Y$X*51bOn{Imn0(<+lXsr%YPcm!898YtyD`C$<uEe7{NT0~xJ;HEQ3VOQK
z*CYe;>Lc2$AN)V^G22Y9t}T@9375CanjdsyQf>;}<I*)HjMubX?r?W7A1iIe-=+Jt
zDqJN+-aiF@wJzy_QLZk5Dqa}f-WL81X*SShdh>g?VTl;fTz0*qsYp879Z5U?Cw0Ow
z^dc=hibUg!39t0qD&g%+tLbJ&;8Eq0TAMLI&vCP-cyn$O^Ki^2=+b7()6B&#>;4PD
z$(~*6<O*a-E7l++HdnT}fSayaaR_FRKmI{2{sELej5{4TViO#GmDsiecTXS|`(;y(
zE75k6l6O`{t+RcjO$^ECwW}nYh>0lUQ@z_EM22c-A$EnCcu7@thx(yMHD&q_a0qd%
z>~Z&9@q(g#Y05bY2$$oA-^MHuYQRKfOZkLDF2%w3=k$;LT6oZ0`W=+6JtP~x-PL<L
zr+6`XOfo_2r&akUi3F1>q>NGPPQ#`oz9-S#S*Ki%DZJWWG~sha!nyfiKoOG#14_7>
zskWqAlo%Z?8kLq*otAVR7{!5B^l~ds*ZJ5aH8*0(S7S2{G&TqFAy$!)5>6BBQ7)t8
zZ{hcbO($NfJ61X-qs5;;uB%8@L>@F5@03U#=|dY}a}XHC<)xqlHQiJM0cXuivky*q
z`Z*Ld9`qiHiHVF>pDfl^DVRF={PI7`TUD#?OU!#E*FUt2`XxP+1D#epodnkO%Z~3K
ztyai7UwtaSSD)&!q^1vanf*YY>Vj@Zy?jR<WI$TCs@TIV)_AgX-O<KnAT7nClgvs`
zj^q%ItbZ5T*AB18)tio$=28MTG><JpZ~Xb-bMMyYb<ALD%<dBugTdq8@JhEn^=}WM
zXP=%#J!YLe0FKFp+60=7**sy7*O@w#0cUDM)l?Rosk2YCXu<06m0Adu;7l>WRI=i@
z&QBz%`4da3gA+9gPE=w3zE#A&71};x!|ygbCk}?1Jr&r*(@#|D{Vq$cPOzWWF&$ua
z7fBlf=g_tPp19_(apb8TkSdoZe=RNUPt4>5gv$$1l<C@;t$wO4!Cgz1f70fuvC31E
z_9Uwpv6_{!QuPI~%_^y(pcSsX?&65M4zw%b%R#0^7ox@%tX3~v>fwIz8f<Io%6HYx
zy8B7u!X})0x4?IjOEu#R3rli+EXg}q3u^5)N=t_Hc_9&$@xyW$tT%fW@cf=Iz`Oru
zm=aUz4P>)A1MWLo>nytD&U-bX%vBt&mabq#=B*b}-!;?RYWQqbYY(HP4#;6x@#)bc
z?$kI4cwcLO%z!f*^w;<v)CXmM#8h!J>sBoN2TZ_JiY8EQ)|!7XGC+awkitJ2qpRlk
zH-ppff5upPhy4?i_IHNlF5t4<NY$V2FmN2DXpp=~z8zG!Z?4Dog2z{Q1EmW$H^p>%
zmv1b5_ISA)e^>A3&v4o_sg{G59eH4ryzX|rk@7D`CC$a1jhG*vgsV-HpYU4&+l$7Z
z)bqz}4x}P!m~^)C$*BCcZxTI||DPgS7xtP@>$l1RIDQY9p<J+l3$S4fF2KORrwpYU
zs~ux-0Z2s!=41raeEk+fV)zGiP6=qIWoowbY`_>!3&wD1T3TLVWwrOTvSv<?2V1z!
z{%am~O`l`t4g^?=O$9sbOx%=Bj*36it{aDsL>@@v#xAmD1>R?NWlbW~IN0FC*6#{Q
z0qz(NR?@bI`5>O*Q!y0c!up@yynHPExt{d}_9^*mAIeo)D$F0M-6)(7H04BX0yJ*P
zr%eGPY4{wUmUoIR42LjCR82^3C_1634`}R-{%a<i1h$I*95<nBsm~cB-`R}}`s2KX
zH^k>axp)V)jNU^fW5JqMlQ=RcQUZX*>MMQ1USGgO+kBK<NSgc1hjuO>(yk0YYw#kr
zB@T)MgNPlUZ8)of<aaoH3FWV$&8{1s^2K{(H*=_nJ2@A|X_qQ)=ICf}h@OGZZ|Bk(
zPK)NrIeqN!w3jc^6tlSAadn09*jz5g+$18^@(A&X2(5?<`Q&QSXR$+tD*^;>dtc4^
zaIne%4P9N29aMSfA9e%$@t_>(pd7F6cJKT>2Kp@LrK;8Ph(Gj!=T6!&nom(y`kXd?
zOH1k;-1>cCv>Gy(<0{Fb&t876sbf($EeB_oaXE#DIX>UWi8%`j{}%Qnadg^I=rnIy
zT%IN!y~7=8I7z#~d*BD2N9%u}L;U`e_;VtGbA|Mzn5i%yaDi87kMRcj?7mNV*JxLL
z16}q=z#NTV8hf!|axJsIjS`L7s^#taOok--3x*eU0kEI6;I!{jQq8NF;jd7LBJu&;
zQvM3ymU@@@X_=zNDp&#BQZ6F<Gcx-s;F)H0@k$<D<^U%0u#E?Vr@`nkkw`gSs|>!X
z@v|6bqIa7z;A`v|5lf#_a@t0b<H1VPdU*4$9^u}fB_{~e&B!JFWxaD@ErqtCs_Y$!
z=!uEk_|kZ$G8%Nf?Ts)W91ehNM=~8F)cyvMsJ?4--&ly>A@^dl^JFM5hTrSxx?hy-
z;xWib5cq6X6T2<&&&e0Y^V8T!gO2s+a}-ZilQGTRG@spP#>+WZwdBDc)ZXJKY2ZU=
zdYVozCroP$f*!j|a~DdB3xrwd8=%LQ?i`!XM|#0})yCI90x=$4pSWrZbYCKDvbJ|~
zlKXB-(iCTsZ><$zPC$yr=E<E@G`!MNrkouz4j6pROh#a#$mT)6@^^p6=I;77I+-lm
zo2B8wy}c^r19d2=*x_@k^gPizDH`LQ_f;@2j-fElJiTvF^F8}TnJ_^yh}!JRAZlBf
zm?EjFMX|HeqUFU&QEE$5mX0%x=f|~{2e*V$*IyiSC$AXVgj3gE{6HD5+OY}OaO%_m
zE^5d5^5X9f@t1r+a%yY)ZFz%}it7upSc1%0^919#X0ssIgle~cCFX*a7dIad5dn|5
zC?7h92XTdH#mnB7Xn0v=vqMGH;#up@_`wew9HP>(VggB#V`Rx<^mn=j((tOmDwvd9
zZX8aOTxy7OG_{5>Dy-uK;MGNXjQ$fqMR~nzt;odnb?7RuLywoDUY4THX6|ewOQP39
za7C6m>|3<`*gU*|F7pR6{V^mSPGoQiGt=e`gMa5(s3+aLb`Wfu6Ncw(MI63sq#U0r
z((Vxwc^(Vf5*j((p>O-X5_z!LH-%gJ0Z}I(FoF2nEk*x5tt)VDC(iK(V7Rm5(tPlz
zNA>z11ciT%<ec!ff=Mq~$<((`+|Jnd9f?zb*8_Q>)L};gNy;S)t^+CY&Xk}_tTj&r
zD?3i{<l6{V0x>1<2>a*0=G(+o8@`&%hUbF$Hms13B}pGkz<ir5X55FR9$lC(TI6m-
zLa*}i3(o~n5_Ay;G*E;K`$gK^e||JuLfkF0B={mT<Z&=Hs%1D^S%CSWOL5$VWq41~
zK^jpg{}8|oh$ww{#!$JKqYOZ-#WEmRR`@I$#ZGfjgaFN96)W_b!wq=N;X<n}DuX%P
z05FG(fQ4D4hFJvWa97`!EKr;f_)iU0ZNISsQQUth4%lnL5{kkQnoaFWu8cBe?3ht-
zaFV)Bzj0+Na*Q*5g%E4<AXc+&M&=^cQCvOdr)0Y>`V|M-+=zTGZ5ffP?8slmT|tc-
z<MeM9C3%qFC=f&cxbI4y>o-#9A_Qr8%$*;ihSKTv=ePkkA;0nSS%8&VO>64q6W5jw
zs@^bwk}q)>o)1SXcU`=EK5n7_2YExV@>@XUi&e{?3n%qWHBn%AkA>uEBu<~Bxt`YC
z4zhai*#YXNn-qPRWf3lzq9ktb_k|N&9I8XK`#`uf%uq8mRlS3HTysRU@d4@Q=z5~%
zD2~v_CIlNUJM`t(8ESYfMzB#|YyufA&;V8=R1+Jusu{I{l-6!gJi94;pP+d<f+bg5
z;=|x7s<CV=@3sYATB~C)b<=b~QtN*EMiIs2diYK-wwRe%UzhBp$dcfi$4R>>>$qSt
z3}Qfd4c{o75dl)PQxgX1VN&kq=ltWijKug>g!tC>INp<-i<ZIFJV?{mt1lfuQ|t<U
z?V!8x$<7!DmAf~kdj#7LnUmZ0t;P=>yso=qw{}IVsBI^3y?XvTVl)qJcGSi~YQ(m0
zMj4+j;`BbN87MvYG@JO9-(fFYL}vtJ-}`qsXQEJXPA=>u(2%X<3B$iSD(DIzK#=K}
z^2)14p)-QC&H;W?3t_Wl9AILC->f+bs1OD_hVr6rf~ilDrq|Rb`3e^K3X*V>2}I;y
z*6{QIq~Yr<b6qh@)Nh+5akv!aM_k7&x=T;W93<T!68mD5?7KT;M4z>-hCCBv6`Ef;
zpVZN&<WXiu^4dPnBW;Li;*aRAf1rH7Ox5&~HdkI=vPaOV358n#Fey}k!jwW*_GKcc
ze3#y~gryv`yXq{1=;dFn{Pb75t8VBz8MN}XKr4SLHorbTA1qlqG`8Gz^PT^at`<Qo
zX$gi!C9PKz>Z5JwM_c`mD65OC_jqY;B?O@~9JzIi$KFDg`=brOr@~9~Af$=Rzad|U
zz3QmVk$`^|M;(&Oa>hyH=|3H6;b>poj4#};ZiYjWJm_X9Hzi`gGQ}V}Z%S^LE1N3x
zy?b`6b!;blIT##fR$OaY>&KSSn`6_w%buUStah1)#f8PW#6-bPtYz4<HlmEO*#5XE
zF}6P)ru+``<q`8`o0O-FE>D7#I+hzk`?U&q_aPAP!Y4g)uvB!L>qeP-(FhUrxjcCg
z=Y7LC%dvPBUYA4}T#~Fr<)-&}4)tHS<G$Yn!phM@1b)+$&bJ5s%Y#IJbyev2h2D%`
zn{Z9pn3((^GTIsQH@B~q>#iv0rK5grNoS!LCDZC4#^!Fg|AU~?aED_j^%T+ZGLWy}
zXbt+!XkqdB&W}}2+Kz?A5r3MLXyb^o>-vlh`Y)hgxH_`cYIFX<w{J`d{tL9`0eB}D
zwm-<9H73B_WxSR=aJ`m1*eCtv1WO(oLG!1R9I&PaK=X$$r8B7#twmzFj`fJ!7W7D^
zmYsGywPcnR;u_lD+FpYB2k+lDM<ivvH<;nEq8F!ge^-w}9SX(!f0RUAh=-t$rDnRJ
zcV7vO@;tHhn3EkkIWJ3fie}+Z<E?%fH=jQXzFun?8)8kXHEG*>q7-Q9a0m?|Ojye)
zv61sda}*D9*h1W6aDDfQ$%n!HryF-dao}_vSyU;jrUdI>Ts!_zIp78|&nmcM4K7w8
z0n%d~LWkQDnf^4W!a52-73Nc3BTZ8((UA<QFpeGT@*QhXg)QA`iBET0&&bmaMt^Mt
zRoD!}YszotFLLp+Uh%TxNL|Cx{OIafL?j=W>qA0r&S2p^qHup$yqcSlxR?{Ups_=#
zX)LVbB4^73>{FQx*#m9VJQ2z}3Rm;Z31lD35boXP$b4T1asN7qf8{lX;2`dkS<@Wc
zX-^n!DSg4YosnEGVSLllzg|~!%niKy&+9c8eE7-djS1uzjr<o}E1u~}gA@I-7Dg7@
z##N08z1oeGVAd{47J4Om$>^qe|KzDR5a6Ac`zyVR>faWHG@Q`7&ok8OVn_B(NLa49
zySx<ULSOq(DHT@3V@B(0YRxS-s%d}gry$u&wQEO(4&mH^sk(>~#n6RpPUE^v<yL-l
z((sznu$kF`Yc5{rR<|=(24V`t={t-Zq4v6&-anyUc<*%>nB4;9-&Xr33vXaXYXR}=
zJ|S7q+k%+|y)8JcRe@wxN*H;~3W!i#KtpVRfT3S;RDhaxm@BgXA?%{<n--7<_`mW1
z*q?CF6S!}GDna-g+MIQk+kM60(r1St{a=$<>dNB+vZz)RT6=_yuh5haW0dYbe-q}}
z`5&I%GAgU?`~Id&3F(q9NkO{1TclIETR`FvBHi5*(%s#i($Zbh-SC|2{{H^Y`)e>b
zwf9<cedgS)LMCgRonrSQDv_fhn@`E*;=p$y(PE^*cN^v3yNy&ALT&FO-;m6A87mdl
zXXO{$dtiq0Qb2VNCM3qAjtb8=w*)kSfxG#sEeX*0mn3Fk_XCDm9_7czP+eE(T-*)B
zEQDY<(j=TdJ7I4aq$a?Fl=Up?oC2n^!Fb^0tTouZD#5+#;YpQNzqG#hfDka68Lr;?
z;Rx==Mx!x%h4CLFqd%S`d~E+WHb&qb{+9m>>dwfUg&aq=2cN$b2-r{KDu(<&*pWu3
zT0hEW)7=Zee<=063x&a=iP3j~rVzNoe`4lGkRsgjnSq-k;t0NisM-e*ReP$$<{V@J
z4nS2~8a+mzAqJH4cYXsg`bkEa;2Ij_0j{A&ppZZC`=fpM#|o0<y@z&J<4<3!J*|;r
zZWSasjV_=G&u}VVn^jgD2P+{&P%Xv|0qqvruU2px+TpnlZ-3I}Y0Z-*K=f_XKf_r;
zAW9I%-`{O|)9^i0M`wwhBNPe?FUqPS+S(!^&Tf!N*S_dHP{kz0|3S{J?OTR%l3hSc
zOew;PKCw8D|8rSKRidzo;Nz&Lwa!SzpE?fIWOJ3Jhlp!IPfj5cGfr}<ZIiuaX+OB;
zUMFdgNEyjks(*yyv&z;1XXsn8yh-B;d#f-=;b^ZA>_o!eNRHJ}!0F(!<p0ql-K>sC
z=>Ut}y9XyJCPe9V4p$Nx7V5cnIwo(tiKO&#?^SLSMHsw?o$Jkj>a%|54NKZqZ?ahN
zZNWrCHj*7OD?qq9Ga9^F6sd$)#|>iAjy7Ytzfi|9=!vh_F<!NH89j1{+wf|m9k7yv
z0vjZZ11_Y!dR6JZ9$*48vRfbC^F+%Rpx6f6Dup1&^4@QU5%xDg0PkC_$9vEM`1p`3
z1~0wBzA0R!>j<;oc$Ydc^s$II=7?$Um9p(9`N7H&1AQ$6sDigvs2!Re#zz};;U?>M
zxJz$&<eGOvVtm+3-1^93u%#zeq;RY*UpQn`O6Kj<<B!-+JjF*`#uP;SJ|?aXNKmJf
z2obD|IE4R2qe5L={q|x&h>SD^9gJx_yO6DRDYtr4WcaFJJMtrmCG4cv#UeeUE8p{l
zxZA&bjX7!bRwVs%b$z;R=Z~rLG$$q7^6X#H=Xw-6Sst(#4(3d!!5wXFratRfvYal5
zV!bL~dD3h<SvEh@-MR$=63!nCfY|~ZZM5J+VbP-B53|1}&*b%n{X(=S`btSSAK;#u
z=f1j<JwHjo)Fv@hIDVrE>s>?7`I;kTuuwPQukR8MC@bS^mmPY@=LNvn24hn;SiTf(
zr!IcWhvjjCl^AY9Z=xV;!#uxfxfI!oTp-GlzKj%tPUBx%r#B|rt~-zF0-T#k{+Jpv
zJzv-v{8vn+3k|q_gMxx(jAgjmh-1wdyI2}0d5RT`r;j_a%g;qTb7k&oat?7Z5q}sU
znrLf~-@S(no$uD;jpe5ze*b;VoqsoyP+=TO*Vh<Qfw_gyA-f-_(xZV4?vao5Djw(b
zCH)ncG9K$1$WQc>!$1WlxTBZ@3GQrE2a8-_3r1-t#Lvcir|>nXin?9qZB+Q+a@a8k
zr1F%zV&)D~xZ?UcV+0?AS{3F;i-<j?FM(Bqu&OD%S?Y&J^o{x=J>DlSd7UdnyIsc1
ziEFz%umWE2JjJ-%rf1%u;_*{&-eBzKYsL28XP<sJvRS?Y=13>Rawyl&e6Cc9$;FJ}
z2diS}g9!If<c^q#!wJsx)JvO=8Xg9!%-ygmz)gJJKkw#CeAIPHvEdP()_<u5FXax<
z9i+p;o8pHmU)bU%KQX*<mU6uJ-j;iU2<BF$NSBCK`oP7$l_^t2MRJ3QqOko!UF)Q7
zcYaG-l@>4&0NYmU5V-~OA?9Z2bi=ySH~b;AKfmJj{VUnI8)hTXS9!|Uqei&&w<^yS
z_Px^E(|5aXQq21~$vWEKo$$7zW#P%r5+uEAlG<W>LZB}&b%Oit%MBxO=k8GonRsA+
zKo-s>EtJXg8hYIbyuv)KENG&3-PI!5JLB4i>Hv}_sz)g`D8F8$$$mdrS{4%ROnV_;
zx8+&Sut@ZZqk%fj6X`4gD`;O0u!4rN-!b(oC4{zDB|&n3cUF&i20|s7Z``vgpN<F@
zW>J)~v-GYw*NkjFRP%{f6XDZNt5)+#RO=8e;Jj#%=&&7<4B3^#NYbPiyJa7QJ6b5^
z1IM&2fvKz9(@Z<%EFnI(<1Pl_gQ7%D?~j<D!hiPgd_7q&o>DSNV(DaVJBySKmFW{8
zZ+k+7hc<f%f~whpaxT_dkWYh3o<@Mq2TL(1dGIxZO-?8?(Bgm@1t~T|icTBqPSD!H
zk7uZ^ZR(1uXVo|7=mN1V=<N<Vs{^6T=E2O?B1wR0rl*B!(+_py>$8tb6-ykh>L%Sq
zi?jwxNFO8Ov>u_&LfVaYOXsr3&3bl<UH!yX(%f*@c(5BI|13azT;BJ1UL)ntTCtU>
z|Nh&8@!GZBvS})^muQnw5&5`IjN+_fgCsVW{6cPR!(*LpnMeWhI$Nb8b721~iCU@x
z-djy$Q!!8jC}jn~#)v^eogqSqd|?`)q>14g!EF^dfBvTx+@i!TA@E&1cP5!*X&`s|
z??co&yZ2S&mxad7){ilr?Yvky_J4NX|7z7BNx#h-%=tX4++KzuKuAk_EEV+y=M`S}
z!$j^POGbjuk*Y_|cR&s1Ky`D?E?wu{+KqkMK03{7bDjDo`s>R#$LK6ulww$wE1b~A
zYJMU2J-fCus;E>CO0I$+L_`yAvN&wc@IN`Eyj-c>=d4*gXoGxpWmgg@k-~JFbT)Yo
zC~9I_W+4Tv^2Y=kPc&j4W_)J_Jgh&N)>^%gH@ujH%&Y<s`vFQhC*OS07SW7d#3%0X
zV)O>>6LmD*>eWTRx+<+Blwe1?PeN4oOtkj2gmF)K$QR$H$UGpG;RU2J+%Bum04u`_
zusn_BqOvcevIiHFz1W7mQpDz;>$R#!jnj}Bc|ix*J|t2!einCN@m=3^WxgLKA=RDm
z+BrG~Y6tT_Un{j&M7I&p7U&t<^AH+zY#B6`+zFY!F;V;uj;LSbM>WG>=`W&?+$C*y
zhlK14FTcE)F4W`XG*DlgoD}W6cO`3!AI#k;WwdAFVnzoKQE{{r^CnGA3aM3B<E%qH
z(OtJV7fQj>{J4I``(hFT*t9L}pL*_Ul}IfBTuXs@>fkVr^!0oo@U!K7{du^;(*NX1
z_j2sGfnTmTTqtvNbm{JyEVBqgcK21>ed-U)*M?h;0}jL<hE!+!7uGQSJ9IqJx(3pn
z1H!&3q?q-ISoNPH`n(t6jQDJ$D<Mt45v1wwR$m|ln|>p(=SL>OtXIdZ2S8m!;73{S
zzf(f(>ClQT3tO-f)BbNlt<5J^tB$U{^x)SLiDw=(<@RGj`1M+(QJA~D=hKZckr(9;
z(q0C0J97#3OpvHS{W&_u&2tFl?0J)`EEN7&fga6sr+pFA1f`TEpmT^O^_?=|J;>4C
zs(QhQgvi1Jp{nR&`M_1JTeAG>(UXe@bObG5u5Oz1$~o)(IZ@|(LHz@^o$^M!1f(RI
zKIAViA~Ye1Si=+5ZS=a#9CO%?TP=P7k|il<^622cp=1?9K;$`jH9qt*RiWcXVOQLZ
zL-0!3dzVa7KIQX(eJiqku@y)WQe-(;Bj^EN^};6j9k$z95a44RY~k(=cFegHqS<~c
z7*^bi^?tOL`s84Vul}icdGhR?rjxx~V^g`C-1|c=XxD_@_}JfWoU+^FU5C9#r0=hZ
zZ?orxh!sv|kiv!)hFmm%7aTZKSk~iv&B}}9^(wG=Z)63N@4O$wnrF)z<EM;kC6DoE
z{n9R#(=8sFfC&7<8u-%elE=R}|FK4ouiQD~#Id{_d+5fEY}o~MC=*YfJp`Gif~#tm
zCRE+yg*{-)`!UU$2afyCvJ>&{ZyL(^A+<7u!|<%#R?FH=W9_pU26X!`_bwN5otQJ~
z?h9tSxK$x9k&fDO;mE89xf7HtcHX$2y9ni_aiv8}Nu$6SLURMm-+HB;8Yp#=I^q|K
zm(J<JO`rQK^o|d;PifsL2ps7g=L#F8UG^woMSrFs0<Kl<AJp`1hl|hCL{&-d6rjOh
zUZjbF<@CZDwpBKv-s9h23DyHboJSuypZ-QC>>X4d8TTAu2yxC_REa1Gu>Nex<ySug
zmHQntK(2||bA=R-jgTPK6Imj@g6*l%Fr7xf^Z2PzS?{_fHl@%%j=|jeUqKi}rus&J
z1a8v~)D^KRvw#KSlNjPt$48)XN?XwX5J_RHAvLbnBFd9~OabTji1jgPz}{O5sEhim
zlDC~Gj8<7JNuw2Yuoxm(rIje&cP8@YHBa?50AfcT`tRYqmb8O?XmMMGUkSQMm}AQS
z<LN&3N6j<-!r);y&(9%}^JohHnLD}h$M@Aw#=a^jT~1Uh(9G^u7$1<qP3|h_K@iql
z)v+)jD;39Y3Hay@>j`T#%S5Tg;a>^vLqEuotSON^yPv8*Cmz%4tiOjf_|Ef<$O|}T
z<AgJSFoRu5e(NQQXE<zbf+G%G2+#Qg^9o(zpuRsV3+nqQX6ZC1-%CD#uJ(Y3XKQMl
zsZ&>$CFjh)Z?hI>#t#zi?7L2G=+ox1DwUpp<Lh?`Ud2N_UT?Oa!nNXPCx3Av3DNx*
zBwoHFKK|$Lo+Os|xJC3JWLW@WAnO8!#)2%kF2sQALI^QtlR9P-gzOc!OPUp)KTB6H
zd_Uj}ZawF^5X+0Z-4FMZoip8R<D<iTr(6n8r7x2A%wqKB>5;s$J1DaqKKMy1bh^W>
zn0$ds-~Q5-E<rImmzmUiyL}a_{Hu{xqgAWijFXbhDZKmn8$2+7@LrQKbUCBROUX9U
zM*oe+4_!&FDEK8o4E}r{BoZAo5~<XLfkNanZYvCa2#V|uL6Ofi7cdgOP`ZOCau=ol
zfV%$xxQ>;rS55gBShuP`pv8VrmuO{`%G^?2<(6F4d}IH1OhU6UP$bF%DmzF2zJJ~^
zMxg+l|9KgZ>#{2j90!FF>H$r}oc=I+y#gWpPq>QR1E&{pqp)o&!nGXdQ4A0JP4!GK
z=ciL)QK^T2!tAe3be}dF{pw(XItTYA8tirqKp)wkkU_pbQLT^bk~TKYa9rJilqK~~
zow<GtBMd<~&GyMX>gwxZKv%$?AlpG`<4ST2pp$bLP4rFb80QY1nfQ!sJDwwr<lz9>
z0Xs7l+2r=>E}Y|(T|MXSIx}99pQAT6onIyMe2_pj%jU_fO{F^W77y*<P{v%+v*rM(
zMj6L~-m!~|{3bkbKeUyGdGd2SghU&oly#1hTGB+j!6~HFf?=$COM8ypFjK<zkZaBp
zpm?Q~lG@1dVzpI37l*@AklT`&X;Dr-^DPLhIB>-5FA?w&X*)nti=v=<*Sz4)thX9+
z7GJ){YG)Th7Tb3odqJ^*5;mr7pS;%+$qi@plhv5tuIY3&@v+LRPr%N<CW>hL2wXQh
z7eFN-szyUUZm2k>1|0CEzvuB};PC{&Rii1rZF8~1T3L^wF;eUrd~V7Dkg0y5ph%%U
zpW50(^iWr`YvC~|^Kluv+0CKkVI0LL#aW^IP|;eubj9YtIcJU+cwJY@xhwU06&%Ve
zeq+z?cIrueT`qNO`CR?~{_qnJ1;s5`eCO689O>C8YU0lzn64Re@4FmE2ZBmw&qkBq
z6Xq`5Ik55SkxU(2so~~*a&G-$a<+YUXRxZ{1LaX1UnW)UN|8pJl<$Jc9n^aJl7(rg
zc=w2s;-L2MRaB-v-amRnPv)Mp0yKCZ*N`pOuaVLPO-Vaq@Curz90+F)t(%`<WgKbE
zSFWx5otLtCVfSt=xZ%6S0Xq}8*W^v3u-nMa0@cuHN<PhZfy&AV+;SnL%27g!MDtEC
zgR;gc7_48f=~QPKS5RT!=bC)LYWu4CIEtQOtAhqjn~Kw&hm6E+i2(!oKHwnV2a@K(
zcM#Qw1HTV)GSN<T(N6IDc#l!(k}$=AU5H~apt26uMcB!dz=Y)olynM|Qh0cM8ZNP7
zpBFE=?L!*BX$l?1FGBa3qL>!xic3l`BiQZFJf{Da-;y}9tf0LRjU0SfwVOhm!8#o6
z)UMfif8E?b$xrgsW^F%D%&kTJ4;mxJT$2Rd<EQB|Oy&!Df)!6fs#W-`C6=1iB3S~2
z@}P%M9%?{wH8qHN(1VzV>W4hlvOHBt1*ck6pgF1+psIb~N-PV`i+-s7XTvTc5G~UF
zHIwic1`f<`9)#|s<(e_4Vf@x5VQA{%BdmTz9_snntTJ0V*!ej@wY?SN3qe86O>Xg?
z00Jr$;}-R0kp(9~jXm^_y*HOr!LH7Yc+P;M@Ez`^dk;<0tby(Xl{02zyZh}$81UZb
z06lmjvD|nU@8d6F2XhbjJt+slMTFEiT^=rbr&Tm%oZ%sqXSL+9zZ^`(9C}m@Jov`n
ztUb3^6BRIR-}1bM!4(WkzmppG{dDhOg80f#+h6JYVki6tHj24}CVV~O!D~49Q1AgL
zGWC&$(@}&oPfh49MW*1kjz)q!#dnaWNTIo42tLJk;8P4C!|YPW>;ji%=aBW2H*w{T
zqGj@Y<H!)dC`bWk#yfRmZU6Ax`mwA9%W4$kB&nWN9G6|kbdR_E1E5lp{0y09vQ21}
znyVurc5VIaP|Y;#-eVL4_WM;=vvN1Uj{}@-?*8^b3lW}KcWuOMddUhyCl_nq?QY^!
zRBA_;Pxe5G#<cpd;i)Z-g3g1CjW7Q>^imjYkUg+}O@RF^VpgK2EGH7iJ2Db4kT%h3
z7c%`nI%Avf;NCvdLiYAQ$WY{}`+sDH_KpHOFEK!PCKT*vQH3~0RMazhqR1{63^tvc
zG67H!Cj%73$pGCuoSz3aouHEe^5^R@$-t&lACt@~iBWGW2qaR|NkOOnb`XR}-3clf
zM7Q1uB4vC%q+BxrEO_9$ZOgg*kaQ(H)}1zH%`xLvbmVTD-@jD~8x{CMv;&m99m;n6
zzUbq0C;nWKM39+f08y^wq}=gdI$^X~AC`W<#vRR{?)EB2b-2zGE#)YZO@LBYjm=>E
z#xmx76{&|w1jnbc<5ct8wi>(BVDozeG4kF7KbzGWPcs9X4X4R3B%*e_aQz%=yjODw
z7T?+zybvA(Ti9OKo6rUGfZ8EmHhl*ppNo1Qs3sMZYHK)lL+{|MeB$lKanDiWdjEkZ
zZRU#VCZ71|J-P8`r%SIw?;WGVYTAjS591?pH6g4yH;7cTbH3^Job~cZaIa5;UIs5I
z3=iY?Z;L+^kdrIi8*{F|YX0PX+phzqjVa)}uakUFPH4kJ$Uj?(1}LTp2Na;@h=8<$
zZ~#av1R*dig;raM2Y|E!p*Z_rS$0hbtw6YJq%g%nSBPUakPTTn=#n9@0-gI$<w{(-
zJ61I7tkggg`Nxkp(C9X3iKbW3TduI(H59o@v-0<%V!{^bnRTQXCufYU;-V2C$@5}m
z?Mx(s*<=DRFVl+jE$jC8xs>yM^CA=*9in~oD^P>NO{BKS;!;FY_<WX<_XD<@VAB_h
zMEC5fp(wq#l`rf0Ba36C3zi3;sx9t}o5z>3dJ9AN>()Bq5QZ=Cuuogv9{)3Dc}&^4
zRz0Wh749zI&{{1dLF+v3wa#v<U&X^sX+;=&0L9u^k)KVl$KNHP#FnkIcBErS39<OO
zy*O|19-N$TMsh<@@q|lQU2Q#01x<s*&Ns`uie@2TXOYeJ8u6j?bQ~Uaf0EA;AEo>h
zeW3w0VuW5p$AN2*pP!Ot>z2;r14|(Y7Yje|<M#46Vx#No-_d>EmO(e!{kO-TRF=O8
zWL?w<45Va|Cxs2(ce`TjI{zEInqbTN)Mh%6-?HovLRIJ~W~+OohIFqFs+Fq&v-+66
zTPF`kE21!~PB1?CS}0i@BApY2RO{d_E8Gd$WqmdD--5fWFSyIX5hJ@ZAiG00S-94G
z3AcHRM)k_~1sh;BXX&n<Y2E{{5&Ce76M`{muUr!=c7v}gs!{%p1n0?Pg|E%tMxP$=
zwB3;F;_R8lSNgR!y_Xbc^z!zvosOt-srra7I&vbtFrK5MW!9x-8aZb!Q+W1Xn-IoM
zihLC$98#|SprByY5u37gP&tnclHlc~hPY*gWo&yP-bo-u`h4xmuyz7C_r6!sw|QXi
zlq1V?>G>Kyp~do<*}J3QSEb<DJu=Owy$<h3$jpff3x;!=SyUe11$*5rSXqm$8fURy
zI7q>Mz3(-f`N0dTapHSnmqLnR-qLPFVp0%NVxr7!gYqo;Nht5@asJmQ9Bo6)EL5Uj
zUp-C>y;Z6pww}H#)FU7w^h-mU$*goANG#C*R4a{8I|6+@&PAFykFCaoax8UrlofjY
zKL<h3Q1ZhC8-~ZMf9uP8&cJrpj096Q^Pxc;!*3Kx8@q=H29hz*1@u{7Jmhz5<KZ^}
zEN#sVm_Q(!_66~sWsJv^-pJY_^qrRNCp+_hO@32nWQ3RKQ2;%OobFqF$0Rc$BLAwh
z(6{Pgi}%}REi_8oP50NhXeuhiPoJ<2)>EU<^mIn_y(pWuEMKLU6`9o<r^$pH6+_Sd
z7<cxHw^{Ot4*9%0f5Y$#{fhN-r}QtuYtBjL4Z+uOZ>Z%4r?xujUkdiiwq)H1j9XGa
zf#3vvd+5qmJ`^B0l85!}HmM!-zrNIn8Rkndt9d6YbBogNxyV-L?9#^&qtGH`eo|Lr
za|OOti{SiZ2CYbsp-2z%R?U<@Z01-WDKfM~*0g}7+YvLwC-jX=^qa<;md{Tgd)2mB
z{{_qk4y0>Do=8flrx$x(pa$-ba}(8p2g21p0|7b5*Y=(II+5byKEiFCdMQ^`h<sK9
zVl|{EEc(;-3!;&af3~QHr(`C2B<XkKcGHlieawhE7||M~b0{d5t~@>5rs7o``rKI#
z;NO_!VD&XIuP7qTcj_HF_AGx<g6e!S467dYS#5l!#wI$2e;!8jW|as;))uYch2-u4
zKPknaoE=fqSpvD}9CDY|5pBfYes10pK~(b{E+PG4jzItL$OldR^?$Bw6_$OphL(mW
zraGpqd*Y@^j-;FxRgw4UIndc8p9Sf~GE@J=O;XX+9Z5wKt6_ScmEEsQD5<fzkAH-1
zep~w6K(JSC0PID>$_`xrV;R2yTG{Byzkio#X*a?vo6JR}`nu&JY-E5^W+xvgWd^t<
zj0u8<+!nBfTqSR{rf!8ymGM@;=<B;gtXN9moipXe9f7U_>c1I|?BR@~e~W+c*=je*
zt-nEI#(a*@RMZqP;XR7=Rzjoer3@WQ9c$;pRijSxW*KkRpa9KMKnoFNi>J)D+vcK`
z#zC*ob&Bn&(TfD;TjQ!N-#zpQEGWqvmI!LwHUiu)8AoX{rvC-lwAyqyNEHkFJIr1C
zk2237dDxalVpV_u{IktTVDFoddAFFP<PL$b@C`?-Uh8GDb4a<j2`Tq_OR9%J^Z6!N
z?P0P|>6cOI17NwA8lsV;m85R*-dqn{m$Wn@`DuTbTKkul*v(OA81-H7x%9cO{IOOw
z=_>k1yQYZL7G5J$@Jpk-drNTo+v%si=N!HxJnw(w%E2G;jNk@IpGH8foq%8>ztNKY
zvPU78slWj%B1O>BzgvMY&jGSbZh)v#RQH$q4HIBidIS9OQG&3`6R^v{xg=~LgC2tm
z>VW0%`E%P`@c(Iu0Ci&R(5?L7t$+QFPI^E2Bx@e<QXGmG1M_RP<;eE7Y4QRr<_3B2
zQWtp8J`p%~<V=8Pj!$TPHt`ZKfCL(4XP^596Skry;mp4}pOc%^&g*i|_b=3b#%In3
z_E|#KGKqGW<^vA<oi^q3U@4rN^7rFQQS0qd5Gz`b!~Jt^VHheGbdTk{cx+PhqQU}v
z=Gm}&50GE%yHMxJXqFd1RoTdj$0*f`al#Vohvg!f5#)w<=Yco;M^Uv0MTum0Jb1%t
zsN~D2<iYz*i1ay|V40&jFF|_%7@7ii^J)-1)cT;6O0M;tyqYR8A;im}VtK_{-DI#x
zmd-$RFeSW33y<fs>@hUV?9r90mscM@$25gFhm-B?%{lsVM}J3vg8fOTreDR0x7<;f
zCzK+5^YL$fm(4ekxZ~%JcSiqSqdj!bxK)^xarDjglOhM3kSI^PKDAW?2W3iyj0E}(
z`BB?HMXXN*F4408FiH2AHK-ewZHVsQ$6%Kn-hVCDtU`p+bDIJEz4m!zh&Q&D_6la0
z22^R=&y`*lW9Sx!_kMMG_0Q6C;k=2?Zw}}M2$usn(lT8qh#QN_dyri2yCN<=lO#xe
zA6f9#w!JMJwRo8BW0|i446k*h!KuAgCTXt~H!bMB*J}SOkXl$HL>3m%z?nO~X^6qM
zvhru?u;OS^3FpQ2?st~u-qsDxjM;)}@%`G^7Uvy;_CJrS^F_09TZbf@jrr~01`pdx
zpg!)i?$?&Uk1X&CE90W0gLlfWdsS1ypVLO|QaW*N?jFY0<G%o8YNPcoJ%%iz&lrcn
z{z1^|`uNd6rYef48MlG|n@a5h7@aS&pHKH5r$QG$LOJuVC97goOvN`VWRd)76g<HN
z3QL4|&W$FAL=i>Vw<^M`FCV+l`O;P~3$J4Ca}v9M5VD>`@<E+s=Kosjd&zJlw@&!L
zDeX%A?@hsh<@o>?pncqvwcCqN-^^tF1of#u-Mvzz74LfIwih2Q>gTp**;ipn`U2XH
zcA0kMRj-tS7B+D1q{7!_U;DZ{!mn~%Vc-38%_}7cpbr{)4T%y1usmcifAc1WXfB*F
z(O&1w<78=w?rbgu8rAQ~ICN*MmYc6=qty)!S8psdn`c@AOt4QF(Jvc8zKH-*vZZiW
zX$U%W4T2CHWM~)!1sNJ*D0@89mGq-SgG0k0s3(j+!|2f9Tl^ph7w-s0FW~+GalXe6
zun{_W9S5oG19LyDCr0I4bLdXu<orBkL`q}DFKvH<B@3o&;uO8#t`A3Q$;LBM`#ZIp
z#9{)>&Z8<*3B=Tb%gpjBv6!Fo=?FxK4_lSz);@RkV?{^+Q*a%8meFevv8)54mHB8a
zY=c@^2dI_ZzrScvzW}*8In*b`mfC&7x@p<+tr>{Ps}7XVEkD%pNm$+b&z!jOoo3<^
z*cVR?;bC3yZXMN@w3gT0%NV|$0OXXqr3^^*0&@DAWVn&Myo+Qqf3$r3B%?aq@4`89
zJ2mou!&k-kPs?{iO*~6;jK645EfU;`D_~qQtiso)X@uu31AfVY?UHa3*e>~%57)<*
z5{hVm?NT#_OC6>QgcgI>)05QIPH`o61lwtGU9eYTkkB;`2G4&N(cMcT4c=M)Bvff<
zisae88d!O=+~~PddssT?4;hVQM1LbNH$N`W`%SneZ`12M(xT=GAHoNhg~FvmZ-g;>
zL^3Qnwy%l#wdnV(z{o=E<jn@R8&ZdK8~vo*<ZI(b?&v}egNId|cw+2~<qjmatbY9#
z_d3de42|IkU}8kPc<S_;Z#Osliq(YifcT)yYojuSM;V1|q$ZL-<xiOV29qt^{zdo6
z1Dlj!ux5{_^TUi{B2pAu@LgDn5WggK4&|iQX<5rpOV%$`{KWOta7i{Y#3Mv6lTnI>
zU0a34B*fpbSpu6F-QFkiZ4O)(hlY892R}vgq^_<W0VTcc-^oxiW5b#A(YovozBZL$
zjt_qN(CEkeG)h+P9P};YQ*Ak!{?L660oDtWZcdt(3|eBhJeRa<i-PL}`(b+xP2mX`
znx+BX|H5+c{;RAETf>0d+zJSS{iB$*rJgN=fMEXwEsqyCI!i$91vVD!SKmsf#_U;e
z1B}qExf>YJ_DsGSCQ}!GQ&SRocQBSN3^<m@=(Ahdi##u=10CGh<y*CvklofU-Mt&w
zfMrC9L+U@2x46_oK1+Yg2U`2}h}Wil`?B9sOV<*E`94p4*YaQ4(%|31@G+wac5f;P
zoMBadaFBRfn!A@(FSli5ah1g83c;!50D7V1c_~G)@LI)@a+z5M(;*RsW9Eoqk6hh{
z>_lc~pi!(3CN<1Y$7O#jQOM|7<OPZ+OCh{Mh)i5u?Je+evHu|v!xe}=B0##0dnDD_
zvxXHI>Das1vyt}-{D=7G2KGPK95kRit}t!fjuMOWTUWHO--AukDs#Np1kjsIYaO|q
zk!{m$YVt_hTX{U%Nxiu|mH!I0<mzs!js2QVup(s6OH867Tjav8@eoirDbhS9(mW*6
z+;=9NBfqLAtM;3CEY7lcYTunA-JGfjP5gopV6ja`wA@ZfaThaMEDxufL~hP))Wu)E
zFWH}TXasaKttU^Alai2)0drmbsm^wXdn|RWYOCHIu<K=((p?qReTfIF+s3E+l6$+V
zOH8eAsTrs2oF;n^rGBBw@2C~`+e^>fOL0HKH?IC@-Nw!q16P!aQZz})jN<PXfr0y8
z@oBd0ru$EEEq+%j`O5a2p9bK(cPD%+MXbkHzf_v1pW-$23cdmkxpzIFonWiwvFMVn
zxz<G_n~9c;v&H=8UDMm(9dpdAPMU28BA)%)mg~N2`?z_rF`E0qq|j4-H>OOdzm;ej
z7j_OYAEO%LuYFscNe2nP<L&lt5-mxf(3piH`%UiX*&Qz9#Ae~x4z`@N)@paSH=Jfq
zG0fK|Mp5ixD|G>IZ0BXybGy9M#&p{WFN294HeMH4bw@<EI^6*eLIiiWxH-lzoD+fJ
zMfT`3Ep1>)F3_iUdz+5_O6%z*i-bhI41>fO%Ru_s@hs40L1cHgr_axwF6Znmy_`Z4
z>GmA`1%8Z&nn($cY1;%94Yus-M@6xbcfYf>O7RuQWOD%#aR|U43<3BtOiiuT)gyvI
z3SK-um=26ZflR<9;+3>HTq9(y`sNR!QTZZJ#W=SIoz-NirKG8?vt#*5<mIWw&>1l$
zdAwFkoYYK4AVuP5X&R{>mB%3}jXUn!$1zH7T$GHc?~Apxrz65#DsCP$<V>{IzN>y&
zz(F=kewGqc)US%kk55fhj<D3j32-KJ#Tq1abwW^XA{)=V^9DDhGD2Dy!ws==?kQV$
zsctjXDOyf3bZ~tv{BAWLm{{ceK9>%uW5+sA3}HC+4Se5)bP>)V5*0^BW@A_;A+G7<
zB`?S)_b$p84(h}P!({!Z1oT*pPLv&R!Ylt?Y!RuVY+HOC3u&+uJ~rxE!D=CjqRspt
zPKXKHr5M|S6C2MIqo$-n^pHw`i7L3z4Ca9gP0Y~nTxluckO>%NNE0JpA1e=mG302n
z8m;~jrp=&KZrM12J5d^l)iuT|M8+tz!=<&hZn|%-CCioTu8H#UFjwyZYVdE5_cgMP
zz1WG}ViaY|8em=n@A6jNRHfuYmnpv>O05EZ&(ccVO?vt(N}`BOBPEYouNE7B8Oi2$
zeX3*7Ie+-s;&DB@?6DFG+e{Ff5TeVgO(W5cDZRzHmOq&6V7&$NTuc=0Qao*W7;eAs
zG#y%7JA)LaQ_0Np_NgUc2(N<$WsM!LuKvwr#JMtU&DAb!B#`zI_5zo8IH1)m^qkc_
z>bW#7?+>ZR2lV%yC7)B@OTP{ZNrrM9Hh&${F43$pr=Kg02<0d#)%<4z|Hbw_iJgQ>
zT@FHKao^ep`-<aZzsRlw(#_k%t=lRy1wlKQjwqtuQ?L#2U8@80htWGU^vgjoumhA!
z?%tn!GMsyY9)H0neSi37g!MX#BW_<1XhB+c1{1>I&#>UmSfJN|P&{X$R`1tlfdDY&
z2-4F^1Ri;_r`Kk+UD|Rw1-ZgCI=TG?_PXA{B-t1p`9RV1D^?+W-0ytxM=M+ytu{9`
zoW_^=>IEGRu=tWI^QE)O<C9A;gvnsxJ5G^FLSi7oAu$m6Rn<EmN+iR<7>KXpy}@O@
z!4P%)Ywuo}Lvuf7ozoGw9B647#0390Cex75CLt_cm_k)MD~B|}(-eG)v)uQQqW;{3
zpn#9@IqLxCf1D_js4vsS0&2)FGo*oEz*eTU#%SkijzezhAfmltr#+!V@mtn(r<cuX
zFEN2Ey&kw}IkyI-7e##cl`a=|G5d-JH2jLTFeL|?H7RGY`O86Q@RXyaI%nImzg#2e
zPnq}+zO5e9rzJ-puXxp9;cXZRXrW-?XD*Pkr@!t7DTXl>M0_4wG+u<WP3M#*0w5M!
zPAgDfur0OuJzN~aNwecu`_9ss!O|Ff3^WCOIkU?1XF2K)?+3ylGsv$H%H7@Zr~A3Y
z8HJe!{ZtoNrF>zjO=p$ubeQuQr&Glrw%EWcve-DIVn6tGhy4!;7%AlrvCYz;B!ClG
zz9yjUKWIQ_tY<Q`(v1xQ<aRjDBl?YWXY_$idzG8;x_>ywQX1d9X{QN?CZC1J4wXpY
zp}f5NTB)63zK@juCL2t5KU>RWB_=@~I-NcyEqLT5qujaqE&FPx_;V;+b_nKSRCcI3
zz-Htj+r?ezTcA145ST-2QoUp1l&@7kno1T|gD?cip^b**&;pck3CG%69I=obT6u~T
z8|oAYtdt}#X!$(DAy@>K3-{Y#hbEW;iFpw8@b|jdx!X3+@~GgyeUyQObY_Afof*Wa
zO1zRF*M6GVC1_NBn1?ta(h=Z3^`<EuE<r`D*~@TVP`U{9(}KQ#k^84z_4F)_wm9EN
z^sgfTX&jlC6@{w=W70i&qBTz<-=yXtt%6}w96}Yu3SbBcHt2CmK;_lq_zDIaV2psj
zqE3YH*Zw=QcxZZCPTKdb=_6oOx$X3y0`F8XxT7CBqL8ZugU1MEan_8yVi_Y+Q2fhF
zi#(eMRf$hxKfh_M<A-Wi8jX?(AaZ;rvrpWZCfHRG9W~zsUyFyf6dNYc-oVqKBRpYO
zC<C*>EXf(ug5U8IQ8GRvEOAK+p=H0l(LpU?v4h2UJ@w?K-%Ma*CfU&}e7xZ2AKDJu
zeg~xS2%I*eg8dcETsPykPY7n2GOy7?_29W=R_ay-3Lh7y5mHLQtNW-0fR|@nouJ^Z
z#lf}!K7t{NI9uvCuwt9(G|B2vJ0dKe4XxWM{01(h#bc1%hGGFRwMVByb+7lL%4xYF
zF$o3qh8B8TlBXM51H!f^c$25WGv8MGs>8^xQ;ur?;ME+Aty4F$H>_2-N^#?9#Pk&1
zF{qNq-8Cu^U+%c@0S4nKX2;HRa8LZ!7(S56&l6<wbEmby2!h~G;N)k6wtGUodjf1S
zn9eR2Mk>lDmB9QLMIo@^nVKl&k1!&5X8$QIWbngB^y^QJ<K)!Iwm+3}h3TN}_mr3*
zM8lTP!<^TIoz6ptZLjfml+v%x?4EHtFY)=WAdQwda8B46WBriu{^4uBtdaCrNb;Zq
zc&^>Iu<aelCiW>M0^!78TFUvq{mTt?`VI2>_+lcgI1eLA$kb4o6qnokKo{3S>W2@Y
z1+w6;o!WrG3H;AyRvW0<oi>5nz<-e7hGIx?gPO)l4%j#qgN>8Q`<!OZoMzfl7QmG{
zO{RjF7h&TH^N{n$lBo^S1|&FClp7Yb-w1P);x^zdz-dHPq>T_j)WbkfJ=C=`p*r~<
z)}-6C>V`aP%66ka6L<A+*XSm65Eqr`Z2hUa9m2W$9=m5v@nl4~kB}_=bwQ?VF*ez%
z@?0&N?m>J&sxY3vhpp;*2TU2Lns*ZX>LK|dgnLTgTInsyMI<R8+Thoc4=M_rdoi4E
z1{a-t3mu20{-;jjISsy$nvy>->HII*kzg)8D1tqCq(!ElV8#3%I(amNIjN!X+)vJb
z0M%JTASS0Ji*^w}J{_$g_&4l4AA<&G=Tbnelc4nJsu>EX@wwf<3UP+Edm4YjD6A(g
zBute^nuJs4AcQLh_b4be2ti+{&e>-=i=+k;^uI!d>k@?PKvx}>viD+ag?0EBhTh0e
zbD;Jb&H>S0`*}tCwci-GVO(NB7sZNQIBqpFC?YY>6YbuY_t<vKM`%j@Kcii+s|gUk
z7^PWK<lXiIr;?P*ktNx7<x^DG_%i0yEz7c>BYV@OZw&HgABzvaM!kR(4opOVD200_
zF%>DLg+LTdO|V9|{|ZR)gyf!nXo-;66Q9Gopk+e<gm>?B+^b^OBN2Mt=EMI&;fAzO
ztbb^9WpvblXLm^&DcfVcq!Ti)wE;?DpcMwGcjIwPK3Ci8{?4r?QIrBIS9azrp=@L)
zliY{jM_*l;-<-t(Z-QeUN^c!U%t^1S(S=@&96ypVSUuVZJE62bhG~<X)rViz_^b1B
z3=aDUSFfvM!+cDq)2wXc^T68#I+7-Cg<azUr)9MHqWyy<ktpvV6xG}j;G9+l^A8S}
zyzOdw1`#8zq^TTHmul*8Mp`!0|756y;pq;-O?T4b-#|GB!;kl!1tG~);bLCzOrx$@
zV_w#`Yz~+l{n_VnASK@X-ivyYjF<%v6O^R~QiASYTjwmif6iMYUyRSv&k<b+H03(H
zj*=pAG-m`2m{U&Y7yN+z9yR!TqUi<3j^m>)mIJXOwu2Kh-tSOZx|r!~NpzCxzCi2w
zvge3NCeUgI9jFw{GY7Sz84Ars7%3Sf2KzD~v=3pCnmckciE<=HMpdxXJZ8wg%z-6D
zaVccN-gNO#478T=fY#Ds=>#2_g#TQz!%7A_-%#nT0aJXxc_Z5F3()5$Y^pqUrfXBt
zm4WMs%_hC;A5bd}P!8g&V=Q2_;JZ5slb3%EpD*>}!i{IKUhn&<7Xq3kls&?gn{W%$
zll7&y1I=)~)*i6E*SaHav^XM;1itX?w7j*v9K>(P;-t+A3JZ-AdA=gJJCJhVntjX{
z1&61=@*w}38l9t<H_e<cJX}ksal8_ISU@GNbz6$mm!e;6-=0Rz&9t_^om-Y)LQw;>
zZ;_C^el=$|%<CY&?ON?C5DeiP^BnMepz#>sX8$hcq$gVP{YQT_`m%I)wo;*}pK;V&
zpNJw0#YT$WyG-f*>BcK@E{b#877D>&{KdvI;1^cR{@gK6#+4pzBG$*HdOOfd)vFpb
z<x4lh*C#P@OLE5J2sLp7#qI)CtxnAdyFL65(ed`zAGd$f%qRAzL8NOpac}175lpvT
zBO8UD#g^BcmWAe^d>yeGfn~CjdGI+bSAfr<vE$-GNj;)b2+YuW4t~@Ld4xQNKH#~<
z_-FYB01opbU%@4P^A!^5b^Z!>4%FPey0)Y!g)$0#VcF3^?Rp(d_5#*B^tWI0)*C(1
zHh$g9N5lQHzkoI-;Mo=%mI?|yY4^%cMJz``pVVo-`F5<U!*DZp0o!r=Gb?ERB(1%$
z_Zp^A@q2F%W1(SVL?AY^nzaj1r|=xzR+rwUz&>}IhkV0n8Qlhvx;!CL*NyrD47g%@
zf-Cj{QFViQbpyyBwExvfDoRsNeIK=5+4J{ftQaH(W5zag##U)2BIv+pCEQlqWTQx%
zZcTsiuVjC1Pk7mwVl7H4rBaWPNkeB|%RLNRoZB*<;~Rayjs?J|YCvmS>*u-5C!t;)
zrU9ML5h;AOF!l;Wy*iK*y#Z9}L7<V-2Q(EofI@w1pnFMzdkHAi^R51CeUk#Fmbj6F
z=C6HGFvC;p!)Pk`XfeE*w;{u>2N<u@j*m4`GapfICNY;*?0hlyW8cbTbTO)&zi1~&
zcLY5!aUM`ARpVl!aoS<*(EmJ<8}+8(c9$!vOnvlC;d@`zp4T>l!Q6H!+nx3KMjJ1e
zjaH9Az86Vite}^Q2m2s+l{YEP+Z(N^UM-aY7rt4avwy3D9)gpf{CdgW9|)$;{ZDCr
zGJa{xbNOP>JgB6YnAw9I#T>A@xjz5;e3=Bi&;|o@JTp8qMYasb<9i3gxnwD=p%a<j
z2c^2}z$+Z|r>Ln+FXbK~k4o+FbSs{|H+7_{eoO*pY={)}p|^0vYY#>@RT5XYTErM5
zS{^g#t;cMCzso1m4>I&$CT34)KLjaP>?qskv)-C32)AhkC_^IDenBGCMB0YUvP%iG
z0ew&=yvF!fhxreb2{YeZ%O;WP8GC5QxTf!bHJynESkrwl^`ITRu#(*(`I(^rCm?%_
zn4t2+QlZba!}kFU&$R`^bMw3?xALCjPeUGFzj_LHwK2G%(``grw+5v|#5-z7a0!NQ
zq2|reG1qcS!*d>DsaE=ZN(rLnsu>2FK2TtPe$42zk#?m(f%KTtGIO|e(<}0HUfj{^
zy(}6e)2{dnAC*+dm+ey?$Xl#<T6iau8)y|OOX3g~62Ky^k^xe~X(U9v2hVdT0c$ut
z@K@9=VE8@1kkL&|#J_SCrm~NGiggepX&HnBS1tRTr_CZ;_oGJ};74t<OLv95u~y(4
z8(bsVZ|UZ!u6=I6mbmc3st(=D`}#|g{PV@tjf`b*H44%ZkIHDyov9b8@hhL9q2(B6
z@0(G+@=!3+12<OU2~4zkvEq5*o&DQYpa3SOA)F_H|KU0dq=+_1hyZEO%?hxH2EboY
zzkvVY3=q-bBI!Qgm;_qT_VmF9rwJT?O~^LQ6F5~6HsR%8ct@&Bf~{<Lwh>bmnzYdP
z6jSD1WkR}h_Pfj)?FmK%`uu;2nuk0Lk@8k22ODSG4i?+ks4@RBJo}CRF+7BAAj3mK
zV6K;Kkld{y$#Xfzah=FChCqKhtF#A@u5w1-e6|#j%^3E>v94=0q{<XK-o3cly`lUd
zS~5#fo8FllRPMHve3nB(mtxwN%Nxy0_iAnAw7~t>z;qfRZkQ0<yhv-z(S2k{WfNqy
z*(VxwC;~eFe@D1}jqk<rGR{%*f9R}jFBejT09H98pL8l1TRH*M&`4iu1>|XgFQ#-2
zMAg_Ge)A6OhjzgS$xdl$M{QXShNwxV8i=uJl`-;-r-6&)#cnCTR1e!KKOu$vDucbx
ztWP3=_gmD~AB4k6c(J>abmzmzoR&T^LL(>J;X6~^x>d&`zf@dbBn!r_&{ecsR0x3s
zT>RNwBUn0s>9nk#C0?B(d_^U--LEaX_Fp3CwN?SW*1=O4zw6%phJ=e*#?KiA=O=w_
zaP9#!K1Wg0D3x-ta|n<o^$~K6=>LY_Nc>DMcFBg07*C<h4H!J~l!0d0SBEV!@aS1{
z8=og7!-Ko@t|Cfn1qq@FJsrW%(CYMY-?pJ}CxMZV2XJ?U@8Yy?DDwlyo}w-4(k%!G
z-^^S1TM(dPGJ#kQnKmRCsFt2cwAzYF8x$xfMRR6lbHHGrq6iDu6=Zpq8aqBekRx`1
z0f!ES@dgpm2D9B2f=xse7sRsY0i-@&a^kg2S(@V!Ev}>U$55Q~Y@2F0@ho(CTDibv
z;WNA3mj{D-Xbq?A0hqzyj-G;bRetz9H;J}RBNBd!=kJsA=d3F9uK~*`2XTlrnkY@i
zSF6>eG83pRo{$8z!#J?a`?1(QB6bm5rUbKan(5{BDD`IVF4?Qu_y@~!Fpj`NwGEOD
z*{mNcacto`4}J%Dzl}CRj5TU?VE{Z*;%F(B6|0;FBr1DXjCa5F_>NP1tr`w~@8D9&
zL0IEbQQ>%Pz`!5YAL#r@Ack?#%#0>#`)-hV`F)y#6j2}wwkA0+&8S8E<N-$A&)%sL
zJAb4lu>EWG7q99v!N6HS+ThnuL2RjAiF;d5Q9Bu<LM|pHvWpE(;^1hWc3`W!gv?!D
z+~$YXL#M*Dw+tH5iSk$FXA#av>5ENe+ymzTY2M9{%!-4CL-7?@rvt{7x}D`vOrXl2
z@4i<~i+)`_QZ=*VD<}v^Vhuo~0TO<Av5Uve??aBo8nA4eZh{V6y~*A9aeI8BzFg;U
zn}N-^3YJ_^MF$e&Cb|Id#CJ>nV{rVNcMpHCDuJSUF{KHe>iC+G)5QUAdbZb8?m0Fs
zMZ%-EOMv_<24Mp+VHEqwunN{6_Zc#FNRej&Df0d_UVI0Oyg%GvvOzymgbs29q__y|
z=cur5kxZ_GIcW@nhzRII#2%4y$d~xY&P+e<!Qhk4MgUsN-yZ$bP-0q=(?5#J3;Cam
z-YbnBx+X704|E2$!D&*tj*pI)aaq0(&-A7`^M7z}g<O~wcHz8=TAYxfcoTY8_+u}r
z3k>njl}$c`ETakZ^D$4RY1?HwpOeZgveeLPsL7#B!~eS+I{lS=(i-c$%l2-V=tRmT
z`?%Slfe3(MXlmN=C76*zlG{iec0kz9vg!8|F*|d<P$FS;a2_wx8_QHcqjUVk7TA*L
zNdv|~hqiOw!SRdPb0|S+HIXblj9%Uch}lM|T)uNbC#FcQwYm>TXly{bpA!1v#T4Xa
z9APSC2Xg_Q3g89lr|uyI#l@HU3-DBc``8OWcrYlsA|bj0a-Pv(!?ab7wX_n$cqCs0
zIHPeP1Y7<*>;naigIWKp@v*v{=%}T%x*g}I{*37%a*x}~!=G+(6g7&o{P)A6?p%Zl
zi|D5)E^W6bdp>dvLSi9wA&4n)4fQP?6I^Mne*<3oi8X6j<DM)@8c33O_N38T?|>QX
z@hbKoq<L4dVd$4{uvrE(V^OwYz1IbrenB7KM#bV?Bc6Axg$|&jO=PLZIhoR7_z+b9
zIXAG^f3I7z;w%+IF+(&<^uH@Z9Y{{CsKlTNjT42itOM}SZ`vp?gE$R{pTwCw9fiLw
znCVxJ@CzK#ErfA*^&p?nqvje<ApwXPv3&!mdZ+ZEU|RKN9~F5}I;MCbQ<hMx{Zhci
zea|Bvwv^L4yebbmOmnMsnxS|_XU;-^7sb2naT<=oh{+FiDnS_xG2hkt_j88x;C@k!
z$#$e53=MfiCubvgpj-SioRQAS7oT*ok4J@bQt~D4BE#*x#YznvQ1(+0cLBz7mxNP|
z?Uu_6k3Vfz>JVz)Vz^URyV{e?0wUFP;cc<^8+i4JfKi%-@KRm~i%lFt2gJ|RgU1Q(
zsgK?21bu_W=WldCA4(u<M`hi`8yyIiWbl`sqNChfZW^V0Yi$bL_<iKSwXya}XA!&O
zciUM*ZOQyI6IiEq0!69dX+C#Mw(P0j?sOJ$eB=(78`w|kfM@VnsY0HUzYVz#e?ZXk
zgK-PhdG)ByTW;z=jM92J49|__$v>Zd@XaLq(Km`b&{IvKgse8U2U0cTpF-L>AXo1H
z_*WoLe<{W730nCTZfW#)bd1ObsXhPgs(&;eXq*L<k(M%zHUEIlS$~kib>U`T2Z*9p
zbdJdPV$XD>8{Zz2g=AVK7ERMgU)73WmVvVpDs6C9BJHvh7+y*!;{uBRIWgi5vEmxw
z(M+_H8W}W`+Fh>c;^1*yRFe>DI(DBRb{~&?vWPL2!WNe&o@da2FEbNI%N5LI<-!Fv
z4<;?<1o$(&pz>aBMXxIewD69n3M0D~6{8YfWcJ3z11<xN%Wh;t5VeZ=G`Yh94E*_!
zFs4cKPP~6t8GKx7HeWTyFJ9Jak~(D!T0CXsGh78eP1Ghry9_!XM|qj9kTRy1#Dt$y
ze09;V{NN!2L`TNxXU9^qrs<`6n^pqVVH}b5LXA$g*7tWK0+;+FCKKhnS_+!B7Z#>W
zOm@PniFf3qvsBpus!6dAiC<P~U6A+5vt)Y%(uke}egpK>iW!81P*Ip=2A9FFF<Te?
zm_8%h;MVhVfBQ_33c3+_DX|CY+eqxIkf(jm3b!4V)hkZ8(n%F~h+IfDl_y}v5mK;{
z;Wz~z)Rr+cW}#22`GYF&gQ%S9H$JW*dq4@A3|W;*T&GsNKKoOPr5u@Hs6^%2FXce*
zACogZVOqA{=_yhLzx*84Ww6DOJG&0Fe!jcyS%5)kTaWvWBD5xef@rxWjw1`awJhhh
zJh4v9e%6cLeL<6{(Z{EbHnRm_mng>q=c%f##8TrfKISb%@5;vRZeGf1<=rD&uQgAa
zmwmKW%;LgN%bp;(ATIqq0V|f(Ae*%zepV7R5x_5|G~55DGf@qvH|y$VA&e$2d`;At
z-<aoBmo)pwtbQ+Tq1zu4;@VGavr?mER%e{LUdu1XPxQ+vjXT{<b){WE15DQM8=@PV
zzcoe^KLzYNGmU6Ax^_`LS6Mx8j1;-{d8m!IwskdV_x#LIdH=$HCpp3pI1E&Q`98;4
zDR8ChE<sVkxetm90hy@Z%c;II3wE?JejnGqpNrtPHq~;zXzlv@)?+++Z%F&X>+9ep
z=isN(0)vK<OPNgD0;^wMfIY#YjTWtI!I<t|gy&_$$*N6jWQS43mTqO*(QW9G8@@Y_
zO36Qu^kx#A;$MO4#PP3zF!jP2oL4e0NG!V=|C++z(_*3RId1H)`V%<aCg)9Hop_-q
zA`LuK9MGe$+3=@KlWq;^I;Mk>bDEh)Ftk}m7_^WJP=s7SI-u)5L|($l4Y`6iRK;>C
zMaUJrRn*s7oQoj0hSzld3Aq9>@CpvJe|lNrUyQJB3wiuS=wWqf@qa2rtPrs4x6Cw!
z<SbefB->~ea0CuzUj$*~bh!eLkt4E;Q`kyv=X9B|;>&Lb%U<wcWIl7iDdAduplnB5
zH<|_X6X=&khj;L9D*q(leR~t4AH+(?o-{-R4(oqo5z{b_m<GJ-l*itaW`p0hLSBH1
zg=g#>Z^pJ59YL2EsUxyN;Yd@s%aYBhEy8FUN~pg8vp+U#kJXI*vrhc$GftxG!Nn5B
z7VPE)7S;dK#C;)JOpFi8w*6WECAJ<X%K(u5Z3}Pn+HAyCMr9qj!ik^OWmj@>R6lRj
zV7Fx0kkn%*+h|k8jCgWWoV^q(`4d53^xe(~I7BT;bKjXmYA!4E;Wa;qjM0Iq*Nb7j
zv=QLIGHpa$ptl`~uu3(vMV?Y$FMiWfhbhv~X<B5Lh{vHJ%^g3Fp;e%j3Cu`DOal5u
zt^BvVPp>+;ZM)y+l49o$bG->{Cidv-MQ`3t>fGb!XxQcqtUdG0c{jAd<|JJ^t>8}T
zP==3%WVZYLe@uO4TvuJttu#ss(k<Oc$Db0VC8eaL8>I6PlG5GX-QC^Y-AH#zyocxB
z_jm6{;{#{2_sp6#Yu1#!Z`p)TD_%rz$%Y_Luze{D`f~dAQmWvK)p2L0Aw-tB&*ifD
zTd$#$mLG)A%vr1Ntoit&dG7d2U1mgt^Xq~$z#cEv$ewQvb*v~FDP_Z%x&LxDb=&<K
zR(3DN2r-rAue4B4qfyA7)jx=9YZa3B+yYq#IDQQ4ooAur3R_klNL|DU%S?+Va)#Vd
zMA1PHULN+2q8hPOtxyhXCxYM+^k!t|A7*b;4G>qA5s9@I@ckk5V~vW}EY*eIpwmhL
zCBU<f1DJbu;`w_*Foa{(A}-WJle&p;1knjwZvEF!PPcoVd0E-A-hexIo$*xZ?wP)P
z*eG{1a_4p}u%+eJ>e6-`nhXa;Jf`DFoh7*0XHg`s!1-C^op^2)%0R#>#SR7nITne*
z!=Te<8-eJKZGw~5)!-s;^=LrVS%esHLhI}q=Y6Jg-S6#;{xMPyH3mpR4BHPomn-33
zt7R|JG{bRQS|nQou_kP53HZ@&O=s`Kl`ZZZ6o~z-2wF8IS~cA~oM~HA8YW8#R%e4M
zcAZ>(D)5?9$i_~7G_P<txfVJ7i}{!5a2d>}gtqf%Xx*Y{>B;cy#&Shb8v$7LNN^Kg
z*!QlT@uz6m9{$xt)UO{)RwA7z!<t=b*QXgT6WvCt7Q$oEcJYa!YLlU=NNv&1v4gdV
zPd~v$H@cm*2E{zg0Grd%V8+jYYDZT!S2rO>KLK0^k7Jl{?JzR~{y+@2;13j=KsL5j
z!*DrYKCGa+i=s{n*==PL0Dhobbv8R6>1Glaus=8UIb*-p+6ESn_Dy{=2#Gy20JTh$
zna->v;mDr<gq!3fe!shI1(jhQ&E*kdA~VUEf?avwv#;AO+?gUBwLSBF$`uhIn-P!W
zA?gmcF0{$loy#p<e5=l@KJ@w^%zC{LVUK1cXvby|Xwa7IEvyW%)P94gq5Dr-*#c1m
zJkfSMXcY-)aGAR^lb7o=Z@ML}4E<1|UOh^$A&Z6|#MSJR#+Xk1v0lB(iOT#C+vRtI
z=rR_cjbh8wrA});YbJKwQlaEQZ(TYR$DwUYHF*XUM=1c=v54F8(1hV^m8o9c%6}Pj
z7Q?7ds`WaysRKH}PS~O~=vsyB$hKS(xm<GhSc!6?Y<0_3!eBP~8W1)t@h*<ab}Zey
zR<xp<7~MAurp6AbET14SvPvTN7p&bQ2RDaO%acKEM6(Ved);VfZeAW=oCfh%YFECD
zU0W(LFLzI%6kuW9IuF@s4k7%pPH-{A<0r|?$RghW_wShje5+=PXv~JKXFupOE7X);
zny!<H5u6CeE81G?aF|eN97cQfHscndSW|5-ON2-)d0RXLn~rCg0VyB`v?V!_6uVtF
zxAgAP$A~iibs2_D+?2<8{+Pw{wmbwT`P0A#oYJb4@=_)0BGH`{nKy}{#s$i@!@k+k
z-ZK-BuLk%}OM?fJp8y_+d{w7tO!1;z6?h&TY}3V&)5Uj>3Y;8Mc&GMT20v(LljAH{
zIJ<^ew|P{DhT#3;VtR*0C4}xUu-zM}Q^hQxwM^)Z=C!$43AWW73#kUV;)D&A9p%vU
zXHCpz(!{<=!T!p>tC+B2ph+FLuY5{o1|%WPv;8gAr98^qMl7~C3f|k4BeP-{?J&<?
zcLH^Pk-q<;$z4HeS}^}Qwx=CvG-V@~kG9vHaog>ROkhuabVg)faT&@Bb*`^8GD~Uu
z_wJM1S(>JOWn%f_cAYOt<|BM5Plh~3q5i5?2JR;OURrr=H0JE_gjQ6X^bM}CB@i3N
z@Tj<jlGt48d(qqWi%s3RKogr728E_!H#UC4on1N&b<a)n8Ie<g5zWW;_vRlga%pJ9
ze+7E$5R3>2J=1q_E%N8~P_go-0COhkpCbEcduih<te#Q3#KLIvV)HT2gh(C)=ux*F
z;SX1R;SWJk4_<~l0`qVMBuC-XhX9zJ3g*D<q@eA@2*%QE0Wg*xpcIr*6fg_4nSVau
zGK9Amx&2WwOSodi!s&Cuw(VSry^@A&r;Xo;lMeTGGE(ArqA9G5U^#6Y&$W<v5GMiZ
zR{1uYbA1(O&?+w)pmaV#V)>Uv{#T?BrUMy)Og&KH-Vi+=-Y$5aCf*r<MewMiOcnO-
zV^f=J4O5Q$Lw@_$xD#?^!kVGy-T0K+&3@L*1mVm;6_)c9B-i#iHK;^ASgpu0%W^%#
zqGV*(Lo*It5ffi~KO9e@nD*%g^3FY0(+B&M^4peEI0C`8AdzPi>E@qH5gG?Jsq80J
zbSvrQH?nUtKZ<U6%X0|<2!HDt4YtT@w`srdDi^I-imfCg9lZV6U5kb}NnW|H|5*p_
z2$C7tw>!RR!&jWXhTWo9dfC5pF%aLtSsgs_`%<gE0x4{TM?aJ}9%1sPZ@$C24^6C8
z1Udt9(9QE@KLu|bD#hQnvRm=Ss@vY+WFvq#3mgUz9b220s0+^qp5cmQEU+lxR6j1u
zC`-G?br3K+nQz;X`Yq#`X8bzs-VsFnh5={{QvagCh8>$C^VsLP-c}s#^B^ORR<+n1
zU2TV92EzCfTNM!{#-ET-47q+{ypx)e5QzxAd%u0aRaJQJnSyZie&^@TJNB;d7O7ag
zV*{o3sXjC2J<3XEz>lB)xJHh&@&3$<=JC;^<#Ha<Xtb}6><ay&GySza)ekiR)*KHV
zjRS+LHZcB=2SQtJHSWpeDddf{|9-E|>O;L9;kIu2{#mc}dr{j1KG-D|3H!z47ns}C
z9n1tLg0qQw<PjT|RN)Nc!rwSVSYJu<&8qynu9VFn#X~lpfL}lmL9<=5Um?S{?&jzl
zWcemI+wv*T$r0>}^?$vCmuK4JdtIEopP{N2E=I`)64m=L0&6xcVq<u_{iK@rFAqIB
z%U513;y>6RJvFxd+&_8YlvYWWOVqw~ZVNw}f41uS)P;K9H-K6v*OZ_n_#jw>q7mxz
z9rG8$+f)V$5`eKLBW91u{F?x!soFgjbA<VCK}=Km=dY?*#w`!zk0@>K1bjcvZ)OS&
zW`c4*J4xQb{DxsbUDQ_#j)0>0@o7nAKWw43@a|?N&`&Gn=;yx!eg7pDFfo?9g98_?
zODevBe#MLC+LSxGwPnLMN|beFL1WAWmfHMD$ukyvk^udLv16X%P)ZR>Z|r=-0bwoq
z5SIWIvg2ZI!uV}+*25PdD<!zxyFYV&Tcd(duAVHNWnsp)N3$ZV+@+LTK(<*lHP6hk
zRAyv!M%l4c%UNT43IeV}7P&`d<5N+-y;5IpD73TNmQ3X|vGCB>6+!rCUlA2mLfO2c
z7=LN+3=|oax3C0P>bg<|4AUchv@NVSm38d6k#X$5x$30xItE9Nh?nTiF9!-ymZS!|
z%K5u)=mu`UZ&=cEy+&;>jxio-nFPzDb4l%(JsVe|B|b}nS`~~X7!m@kEw3r1qpvU#
zs&Qp}vBN=}exh2R-|ip{d-5N0pD&is%}*5p{MKZcE<C6$k2n|g0ynH579kI;m$Mxs
zpUDyxJF->uIDBlWgFdn`(`@J_Oia9gI0{`L+<pJy4Weznlw5mfB)Xh%_m@)M9(wi~
z0_Mi6KBoz#r0Vlqo6s8f<y9z?A(st{Kh-7gdv~+Ht+mgJtJ{!+sa_o9EBvbQCY3>X
z`OR<8<2w7;q}OAlKT*s3n#wFGcqF_A+1X(>vL=+wOr6Y(<*?bZbasGkA7pLI=(}c$
zx4JdsB0p&`Zjh>Q8V~MBpT|hLl%ao|Aw;%ur76OQ>Y=~?q}E*c+m{z#v7!ozVS0fK
z8=MJ&WdLVFTvhYSQNWT%72Kfc;|m~T7gAu;3AEudTp_=mB}4+#n~yK+wn<6P=h%+V
zIXYyje!Uy;--7-T!UZ33E1iD+r^busl^!KE*<!rdf5%u|!-l;u_N^?LW$;h7;t5eT
z0>UvvIA-Z~7Q9tgP0#V#XxV2ury*ZkGa~gFBjJX`R?0WuH?nUCoW*DM&enloZX`tH
zcmA!JkNFXz#r5?ByV1|MD%n9zAJy>rrWfICD;@fiUvC1>>rJqwGcW2dM6s0|>|&wr
zN~Rk~25-WcfsC*DX5&4HNsqGacr{qA84rdVIWig_;E#VNHdb)B9_!u8@$U;;jxgRI
zvh8L4cR(+=F*j26_qzcQZACAVR=j2T?eCPSB^Mz-+y*A;87vJ41aYU5R-D<U=dkVL
z^W=szfkHD~*h6>9b3Zh1#^+xbf0y0`G<rV1pIE3{W?wmgGfli562CGI_*E+4HZ+96
z$243NzeW;XhJ;x3mGBukD?>p$xMsV|-`eMc6}=LqbBzwUG{>P9@Kt`7rTcwH+l&8+
z<<}p0DRoLy%E0Ox{GTQ5z8N@b${2sLZ`up^bNF-CShDF&R8sFn`Uxs9c989V*!YDi
zJG@5<dUW3R7+{?6#UN25MGCobI=F{b@nyo~bK5u@EnaTjU|BH8zec$vwI4Jt^ZivC
z*f_RTPYEt2R(7B#1dKmcO$lz=7|b%3j+F35C)32|t6`ZM&J?zHx;Q6V#=#kf67lAm
z@B7GRj#Z_fCFV0<G!{?Ko1f#8%U_yq{IQ`CZkJKxGPt{P*%C}_2s1j+@{6lh{$X5_
z??2dOK;mzj)xZ?5hBY(%o{epkIB(l@8z;5NY<O4b+?+cw7^u?H=+$Mr{&d#7dDdK{
zrtatnHP*!Udk+j@Z^l4ukCuv~WePrii0oijyDiKZ{oAoWU;yj59ErWM7diZqF-utT
z3JhjJV9<<RLPAjejA2Za>F}9-jJt)c=@pc9%Fdqi?8m^|Y(a`-l_c&(**sTx1xgup
z{6BmLE}Xf;QvGF%#=2sYh0=UIilT{Nn!oIOV{oC5P5Saf2yEYBKc{52*9|bCh%u$;
z+i0X(B~^{qQ0GMPuuXfRbT#8M+AJ_4WYnDsbaFMI)M=;diYL)8t^9*sNc8fm6+HpL
z+~v7&c0pS?((<1!xk~SJ%j6Y}5i=&*wn#mIFx{gu3eQpV+)Nq62;hQ!Mr8ypa!&{N
zZGKDl+&27WSF6W*avvb%^)RPptY-Z#nbV#$GrftQ6j90_!%L}our!cSnTUngi-b6j
zc01BdiFRgn<OI7EHaUq-t16HTY!bXpzl7x%a*|ZR_?aY4b2Og;*G3Sb_EXj7K~EL1
z=}|kcFsyKDMpAZb7Evw+tCC_>uqaWr*--K+UM$}PkuW`HaeZWQJ&1%^={-gdsx60A
z>6a7Pw!oq!-sZI^Nw67X*&<@mqj?&Puwfp%Q{+%+okwP^4Ru{(VciY$Ap<vc5d732
z{^aLh$jvGfgS~x|Fzz(fh|CFiyf;to?e_P>%oFs(R7u9XWk>2>W#YE6@=sO;Q8{<T
zYnigyDFvriv(ZgUPP~dm|2-T)8uC_pYX}Fub{U7n{U-Y9O8+ajh*f-@&gX%-YiZ@@
zKIbd9;04HDrY8pTgq#eIf1@@Az4k<}Ze>XDL|&Vud&He$;QQxOWB{Mw*NE9b?+xqV
zHbWwLDit7GrS5EBe>d3t!K0Xk8f1gaQ!vXIBo6%oYbr~4s8)5%;W3T+tJ<(JZ&9c`
zB%~RBQgSktP+c^X?2{)!Ex7N5*QXiXgWZ!gQ+N#Zz9%av4DEVH^SAQ!40b7QxPxJ<
z9kx6D@TbIIZH@CE0IS~k5Wrbx<Bb5sU_FbjY}%Sbeupn?Wb7VSxl<KFnIpf`k}${1
zR@cf8tYFm$HMm4v*b<puQ5^ip_4}M29*p#X%O)pbNoq4BkYK%F95adWlyLGay;pSc
z`i6#y6k?zBw@of@#geQjAs8*f6o6Z-#n9YSz<_DB*l|1q2(FR*$O3U(xnsyUg}=+#
z$)4kLjyvq=rCao5SZG&i9G*fi-Z&y!TzAqyErL2-;%Y|o#-T!#>TiQxLh3LU^lvS|
z_sEQ3@rUvKp`Uq8WC>5@3V22fhW)nX*bAu0l`Bk@?ko8Y;YOzgE;MTf@H0R9e5^2M
zX7MLd7is}9x0fZu>bO|k@^%MbQ%S9#ELM2&DhG?0+-1LdEQQLBJjq&m#LLRj%hB;a
zb>sZT4nGfO=47RQ{vdgJ_3&g)vNOYsC0IPnY7$qwmkS%R+WkDysdxKf)mh9ILx%vN
zUOY(dFnz`A1^Z)A29=U=ePR*WIgzoltB)r7S_di+SOyZY=-L(_58LXi@&@E#-9R3;
zdk%d~5@T)ia)>j~Dn+79Ig^9B1!Qx=SCO4liz!>E{jORm_FJrB&`8`aa#`+iXOl7_
zBXaUge;Vr!)gT23G$1bhp^5~_STjhM*<piJ-R}i0{eoFOV>Hyol;BKyqZG@onZDyS
zV6?0=#8aIqS^e;Cdr7BdQ19$x_1u?x4tWo4spvKHGF_+6crMK*HK>$tWE&Kv-#}Pc
z$=!TNQyg7&-poOGleAk-omewJz{GttfXV}kS}Cnn!H?N0_bssnpG>)gGcKwbw>c$`
z`T6}0B~P&jmMRxUQH;rm#1Xt68wJ2A0^&D`qXM#uC9;Y+DGyn#hOuLl)SOr6`#*T7
zW<+To>V%wbh{(Pi5w_p9mrE2>&$lT-f4l>Z$XOYJpEzd){p(6wyALkQ8nPTn#Z#K=
zGgCyHN-Zps?L~|5wf-td1S^%MJ}Tg;I?b%lNN&!&p6Z$D>}IK@wGxOw6T4=>K(c;N
z2ys2Ox2~Dvw7xc2H;u=B|5lyo9tt(KjG&}6U(a}lvRbaS1NlddOW>_#$+&6lO;#_$
zk^9DpCyAO6b=b%SIf2GGd|5!79rT;8v@dhb;V?FP&SUxEI$D3dkknBi;fIU`TI1j8
z8iOsN@H3N((AF+0yMa)oOS;`#gzZD<FXDvH46k`wdgC=uXLY0BqsaG=t0s3YW{%d5
zOX{)*7e3ODgYqNPo-Uqfs>xYX_5f%czl56lCRzqV|Nm2{Fz4{2(+Zg|V^ORJ3GE{N
zOuHA6qz<uD@ynn3oYgXfcWso_^8aOR;Qyv=;ns@Wv(^~R_nK5U3r@{fXLk{fR5NWG
zgU99>GDRs$C~e6P`mKn>1oUwn>dkEOCaYO@VTPrjDfy<~F`F3JG4Q8r=n&Q%J|j7M
zuQAZzjg{j}WBmKf@Z){C@@VF!O{d$(p3t#zZzs&%k-(6fy$$Juiv&9oT_6Et#`j8J
zl7os&?LqG&(RTtUTfR?5c>QrXOQP*+e)F~HXZX72p`O<$<|t4&+Jqqbf|eQVBGvKn
zEDG=h*HlCYd!|((mf)exBGs+3J4IFC;U|-gjsC!2{=|OQV|<ndG57g)ud=ydN0<(C
zb+XmbG&J|^H=na;T4CUYFJKr@K65x7i^x@9%QZv2p#^!nbXyI_zjN<BX@1e070yg6
z?4HrB-A|7H@f(YZnmAnK92BH-u}HyJou*^h&$kp-mA;XY8hgb+;ljI`h>A(1A)e8@
zGVo%=%C`}U5s6fWq4Sa_7=M|OCrB#y&u4~5!w$E>HhDE7MAP0pV}R)!r-UvyJ60uE
zL$0!bU!PKPpFO*ulMxQ2v`U2dm864!y8~{VG<2sx;O_Lw(e>dGt4I)o93AZ%WmP*y
zx+Sa({b(ZQD@TV2a&#p%u%oQ7Cq0N7kJQk}XN?0%F-EHe_%zy@e&B+lqS5V=gp6nA
zz?D?dm0u9B{~f(X>kDHQb^IT^xIa066PJ@lu}AF7nr>v-b&O+t$BRlaxb$t#9UIo^
zaVK$<%Y>rv%X?NU`L|kyup}e(L~AHnnGMoxTa_w(Y*?JmxB1U-5oziHje14{A$IvT
zP?G*`yxP2O0+$igEj$LzvRj7n&$z{EHpM0;$^h3aQ+aNUNHI8t^;T68{L*qm-6j=f
zi*iE+Vt6zBVl|0kHIR)AjM{y;R$7VARgUE_N(3Vz%LrJZ%(0G?>LxOGu~QQ#k#pk)
ztbRhc*lsq>To|c3`u-GU#VEpFqE$!rMUjHwe9CGWbP4oKq0-5FJAa?-nerct1-QB~
zr<n`e-e+-agvG*VuMR`Jc?PlW!&%c!orvAOO~kU4%&e!D`Lqt+a%<d&sqXsa<qG=c
zDJSPSaL^Z>Fgckz`a_gJq~KHtB8BtmPUX7d#j|M;wa9WnY9b*uAfNeO*1h+j)RJ9^
zejssb8vHdGoBBb*<|e20L;yu?zuZ;NTQtGgr$(Lwo7AtMDV&=+Ua0AHs9C4{6knXe
z#)iGR2ks~VFZCSM4XI@|+RG3Xr-%7Et(o1DL)Cp(KgypL`(u5wIDYm_499uu%?7Ey
zi^thy=^al@fz&SJJID?7^Ji4IPt+|?^%U}W?#_FP(_c6fblxLYqW}T#EmKI=??2C*
zo}-|t+NnQzGRXBQhfSqL2`RK<IVvl?nVhrBI<GVP^xR*hOym)ZW3H<feGvEW7tGkr
z)syZvlV*Gh#^8j)*O|dKjgAownv(Jb<z<VW39j_ZMAwJKc-}CR*(1TF8I`SF*ISwc
zPAFvXo`W2PG>MsV0npb(I@QNVF$Lmnp<EDehe_jT^?{E(0es})CL+1?61iZ0&vAL!
zEsi@B&8nF!;t2sUke?`sf$CyKZ;?Zod`17vFjPz=JHx`U9c7leIUkU_$wDCRI~(s@
zoWbcR&x@}H>D4obN+gnHD)$!^R|)y5^&ho9OXBZi0kpVhxP0?wXE-mCkK?u&0l~W@
z;w*Z#VXZKclzP6str5%jR`LA`<Vou@AY2f06SRNdn#OtOJF<&rylq(oley~2GmNq%
zCWtD(*LKlkXZJf6iC`CZH14o##IRfKjuiuvKg|7h`0R%P`?A>%NSyaHsL1M}-8yu%
zxbSTQTCYunmTK_BU9mW0^k@8BL8_!aZbK_(TMKL=?ENasOW3w2*Zy%olk5f-$0Dt)
z+Y8!Ktq*=~F`runbo@hU)gQzOUtkd6bcM7uS})x8pCD2)GyM0ltm8um*F|V8)r(q8
zr-QlT6}PitG*`Xffl##lOuU;d*xB%BK>xZAZQi+^c!ChUbvLW2zFAOIOl*S0T`ScY
z>O;Yj%^JI8kQM0*wHrs6Wfk`t^uA6ziR>WK?|~gtnS1ah&?+U<UUS460yxqIZ6dkZ
z;4_w%0H1NZg09pTWs7(PFksQ*<$jmQ{r=iiP^2?IpGBcI`Kn@@{8}jkGK1lJI*c;-
zxXIt&$u#OBO`BxFo%gPnwNn|7K9a7k?JYf(5zwPt1oJ2%?ED$jp)BIc7f{Cd@dEss
zZgCSV^klRw=c2S`kv>oUyyTb?iN*_Ov4>SHv($8+>78yRh>Dr%m6m`|i#nEtOsUgY
z$b8^U?vHx?)kCjk)S%`9IGwfSC0Vx->U(|&)vjkxpXVV63)D76=y&S1D1~;f-v>e7
zQLRebBjc0O>%MDxq7|6Jcpb`w@8pTmk6FHbCk5XiFUB&^=38%!q-C6hV{QXyYKwgw
z5T4Z$mHO)`qLqxNXT!}=*hNouaP-Z}MJmBPe{c1rz%%Ms)&=yyURJ*{cu3}Wl}Zwo
zO0S2sKxb(;hhkx3pkiBH10K>Mct!(1s_lP{D<>EqUe37cvw6yHRA80kC2;jHJyF*^
zXmPFb4uE_DKS(F|)D^EvXr3uUjjRPB#B9Rlbduxk4WdF#q0_!!pPZMt)9~H+i|tej
zpYf-V8~Ck_@wH)2&Oz-t>R@OF{Tg-Rxh#u6T=OVqJEDhm9fRQbsdfz($o4CKSm?39
zU{Rq6clzlpkI4IsCaMYbUeI;amrqx1fMGVgaV*t#H0Jjl4UN+9TJ&FSy<LVq%aKhW
zCr~4@cL(y(^B5y6(95<U%*z(b-<BG`>Pa8R8aUDSx0V6J=Xx?2K06vZbCZh~+rdFE
z<YYGM(n#x4Fnr=AyKY8ifL4q2y@|GsVEE+L^n=LG{c2R~+Lzq2E7!QyIHLJuym9?7
z=sqTM$-oQlx?CD;=P7dhfyNzIc7nw{)z8eEm%6V1k?PskwJ)}`W%IV?*RS)GzFpw$
zSe4cG_)ojOH-tH1^pXhf0(c`^<bNQ%kT%u&3q>4VE?wyk6(Jb8x)Ae6<K}i{0eE&L
zLiQBXqtPi%&)g{@Zz>RKzWD}1O@zdENtBhQFo}^DEa?NDxsu+wAk?HvFNnWa=W5K3
z(Hz;I1Tn9jiBjs*4R7PL6+z>70AKT6CyeMW`&Q7dZ?5|1jn7ePnHb^L7v>{c?ArQ|
z*okv^e{S|t`z7W#zRIj$p)UIPI8bL9i^FGv{MJtQfBe?+fBe?<(lx211XkIbub^eb
zU}y*y{OBN@bmCUX8lwI?Wy@?`$+yBuQNCpx`ecCEj%w1=4QjjsFe{~_E^QLR!f7P=
z0AJf19YjD?Y1$PHeuDG>OAZ}t4mc#0#FFC%Q*THp!CdBIoBa*^1t`4svw0Nytg{uk
zC)HJ?8Q)bA^VvP_*z?hp(CFyb6u3~YiNjN?J;_|#D3s>LNyP}bjuPZ6d*+y1!#?!8
zN039ZlaK!$@c@E6!D8sRnQSM;uqse8jXfuNdewc0aR#EUBil7bp<Tomr7L@JgCGAD
z&@+FXzG%Z3%iSW)^9Ju4fA5K}>wX1oc;OdDEB-L&I48-Ave2LaBs~gjw8Tp$UX$)f
z<61cg(~i--L6xsEZ&|eD^Q?KGC7nU00Ec>jRKPqJ8xY2r$CfkhoAy``=sA)Sa(|kJ
zQ!07XSuxEw9OsfRr^EN$-mWVxr+!w*RjNr(vbCsWgFH8ZdzhlBQ$LFO37k=+)B)EO
zEp=J@f-{OW9oAsMgKWg2LHS7oEO;7lOUFAiEZJq~YZIql0h;lD0F8Z=mA&)>KEhr!
z(1R~Uk&Cd0_DtO^;IZ?*MR}Tqb>sVSR2g;Gc5$ncJ5`<Nns(%H#<y?+7Xe$59U-nO
z^8-KA(3OLsDb{MuzkYHz#fjhYAGiB{4}yCQs@VN%Ymg!hkHfQHg%=X9!iz}dd1O#{
z5eW(}$V~jQl_Il2;YF&{WU9`|91xOc;;UktS__65*`Zg~QuYu(Rhd;*kLlsxLJlJI
zRpX~0Tw@-JF*2=5$e{Dk3a>7E!ER?SLriK4Pd5@Nc9Y9@R_lO+;odYRcAWQ%<Xl|F
zA6I#OT3z%<PXa^EC`gGb14T{)Z@Cvm=4+-9SmgC|xU$mE%G2=_<|v5)(=*~0Uv`I+
z_%HIU%bxII$-p_HHVKQpe!tVY!|>Oiq#x<Y%h-D0*hEHD@Od=rX#(;Uk@(SJBN_>N
zoua4SUg`w=8pH6T-g4j{{_EtIOA)?{Q_(^CkMDdwn34Z?9F)kP94<;f=^Vk{zM@S5
zEzOXD#TB@OgOhOS*8>6)z;$i>tV;8h5lRHCG2jU)`bjHAN`oiFNv-INZMWhXt!&7F
zpa4S7HwDPf#AR>_eemKjNZD=;e=nR%D~oQ+k|c=s)GP~E2kIhq6_j7<MWyLV_L<$6
zCkeBP;{@ZRXI0I5v6I3iH2sC{!tEmvx=7+x?-nR*uBEni0VT?KhvH9lVUAE!p^k`C
zAkz$$`^q#+)0;<vw4*fGb7*IWnWB3;_1ZV-Vo%xE=1R@QQXg?%1Y-$=Q6#mc22x_=
z^g|62!b~0U4f<r-+TZ;rOt-8{a(@qAy+^a<<m?dJ;rEc}G6s>wVvjQH?Bjy5_8ZME
zCOjHCpeOVa*O7i~3+d+xL0lP*?Y(!V;%28p{Cu*kO%6A=$e-e-Y??8c8{wgTZqnNG
zcVIWazp!3KRaS5B#sR9*g%4Kkl`5?S5e%9>R;`o%47@&wV1#0!)M8-OKm>y#G)on0
zzk(j8oX#Pp0Ujf1DYEm;+{e;ZVT~P9fC-Vm-w3x=74!MS@1~|^%jlUgwxjPOQOt}!
zmBk)y@HF(=bJ`H>_%|w&j|?6jaww~m3Xoi)_;JUs2`zO)r(r3KgcP_)BS3?NJ9Pd>
zL0wLFtW^o2gn2>8G#7<3Z+77aQnb2v<!_}NIk<!VR(z75{%GROcot2FPZ9Hs3s5N8
zP|VED=R9eW7CfUyM1${{loou?A_~5YIBGS*3gCODFbMxn8Sx!_&kN#(@xB^dSJ_w^
zBNJ2LFW@h&NUBfGUlW~i#eu(peDAyInf~j}O4WJKg@6K75PtfC@RKEahGhD!h{<)U
z2E|S|>ASBzXn#2_6eI+IG<n)R^05JaqNt@mL;v*Hzu?3f)uKe~WOR4xr7ueIG1fRC
zH4eP2CE?{-(ziNcDRKa~4G_9{N#5b?F_rBLN{^h@A)P_6GJm&g`pfE*)(X!x;%Q2F
zyKg=7PtOEo)Q=lk@ZB)B#N}e5t|jq<1$Yc)_k(v}>iZ>~@%s^Ihgs6uam*KcOuKs<
zM4d7>jvg3bFt{>;%!(}~5Gi98^G}oczI$qL-xLWHSZT^_!fPnVb76T^W7Kilb749@
z@S_HhBo854obIs2KWk0TV$@M>g-Pv>pX<5P>~!j(E2E}5Lb0xU1R}?yv0*2y4S&VG
zmjd3~ii?m=k%$1K^fIIfi8}*2IIzFUMWA2HKv>X>;|5V*H%kc=rGV}denR-rY7)?3
z8Mu%vgsnw56C!Hrt7?ni0LHA4;a6yc@BGtvTWY)?j$zf{j40j>Ie2)yx4%>|hNU`>
z(g3D_`f~XAtF3siRmO2j1)a7U%n@7|((|N~cLb1HG2V_;*i2SZJM+Kf*v6#bt5VVI
zKcynYOq~XIo$^bz0}HFzaosj?-mUpozf_02T6~f3_$eXlTU5PMP93MVOCc;&wgs#~
zQ9Wpl0tzYn_&-F4)upy-9*#xzhf!SavL_PVwd<)g+S4O1p^c9p^0;sY@alnI11<U|
zUeqyk!^3X^q55%|-M#0(q`tsj4W0z<K~b}XI?|K)w9tjN$gn${4KS6@4WL$lGd+|#
z;7rd_mzM7cIhb^`z)N~$P_9B*p>lqoLvf_kj$B4?4epuToi+odM+Y%vV^cNLhtqOp
z3i)&X0cDp4rfw949n@JcK!c@Ot0i^w6r@WARMSkdE)N}~DW|z&DLr1aoW1#^i7@YT
zcPsG7oHTz|@xHOZOIBU=h|%#>;a$T~Mu*fk&uNDe5aez3#2u{uXQ;UT6vaQkYL*Z6
z-S9ciuk}B8>nLLtjO3?WiTzZV&35ZaoT@AXq0$ge6?o!uV<!(G06V{HWeQT^g7P;x
z*r>TLW>*WydB)(IruI;7MkRq`BTPpKH?|x8KKKt`7STmkv;6vGCqSJr)$5}!4quqZ
zI=MJM{`f$aj$x<p(TR<hJIQ^d!x^p<v8~%l6K+nt!e~oS!-@6w^9OjGKo+QOn}6&H
z<DZ0AJkUC9o%-hEfKz$yCwP4bLDjw6{^a_(H8B}fyvHdaCx1|Dr9lej?k6q1y0tAz
z?0F>AVxJ~T`y-$8NwoP#&!tL)4RlmUsKOJ>(INupjgcd=Yc25RG}@<J_8H0^Exjgd
zYfC0?=>%W4{;H3(BZ$01apdEM9gg^!oxivoh<L-(LBtD?b#%sN6)%!@fRGo1UA#O}
zy!;Lv1)#V~#*$n~Pgf4&@b?CTrcj5HGwR}D`g*!Wy3T-H_`iWW@6)F-EPS>kPwnAD
zfvBd;zzq2~IidSbR_<|p3au)oJ}+lFZ6?I+61SUVeJ!7{R7@A&z^J?z+iSmtFNBZ~
z88_4(XJD+i-<KD2PkZA}4WaCZcl@ifzdg)$iKs%hhJ9hrPChxCe7VA|wiJ@3Vh_io
zy3<5ag5uQYSxnk+^*%wg$x4Ppq^FTXxY9R3__)rD3JrPo?saNyw>x-%pWRs-f1}_L
z@^sC0*_jh=vS|*XYSpG<q}al%BSN~`$elV&$_BE9vpmW}+cs^3Z-reE%9##{8W~mV
zL~)b4c->*tee8RVK~&{s4_<IpBOOgF-4)E;xDj2=h-;A%mJ}_I>t4I0;1Qk1*LL;K
z#?TJC935T{PE_+R0y}5XZYtfo8Ab88jc+xn$08N&Wm|KQGpgWI4lo<#mPCGG7x9_`
zc8Saqd!e9KL@Z2tU@m-PTv{A<fJw}i3t^7|_n3_NWCI!j>RjV&+n+V9Y?V5lBysCa
z?9a*&!O)vW!C=v~Fj29r3HdFwH9-g@Sk!++5H@Q<7yRQ3FFt>;C<3^!!K#fUB-CT=
z(H;C-*OzxoW}%{D0B*>0d)P>4JAeUWU9nez;E_){x;)?&ONe;7ffL7{@1f7>Q$VUm
z*ja=29M2{wM2v^Y6`&UT_YHTR0qUiS+u2x^PumM8KGE-&M_{&1H(HzI<-V+<s`+1>
zpxz%U^l{0mt|UB(WG^gnmJiG~?wq;Hm<q$qY~J(U^@Ty!W5TqY)mOqP7XakioKVM>
z2JE;%*6C1Zz=nNO6;l4}0@?RhnQ1<_<;GR6q@0$jh*OS{77b<w`Fjz?cTi>u!70Sz
zx<7=UuC6TNky`>gF8K!iQ$LWV8DOR*p-iorqzH$+dsIIJ{*7^MQgen+E_Arq(N|66
zC@&nFy!h}0N3$pyTz3hS*Pv0ve_9e-^U6v>KBt<Z_`;8$>3P3tP}80&Ybl&Vuuqrh
zzpP+PSJJK9?I%+Ga)=mN(iJz1wQ5hS#sKp?HnD2;FMRsv2v)P|<SC;Ll!IT;?Glka
zf#jQpP)3(-h$`Uis1Y3l{ckIAkN(YXEPB++gdxn)-o%<SRT?=U(e>{%;g&Rj++E1s
zUCF*%0(MUfj?sU<g2V1tY#5+44<D&S5CCFBFID)TN*F(1(KAv-(EOr(m&%WV8A9z>
z%|aPS%V_>7YlPR1@h-ERhqhmYxPTcL$}6E?;{#vb#gr6ELe7~zg1x%@@axJS`PMSz
zxk`9o<-oRtS`dmkVNS=La}t+w<&EU#TyAG!P59BlL73g7>PQ?qCFzb3-Kc7Mdrexo
z`;b{v3k9*0*#@n!$hNRUj%ePBfO*!-pz$@$$^dp{baG)4jvLn(i#vXFuALK`n&3od
zFR^wasz`?X9d~w(me!oBx9^ItSj>vAd3@gi!QUiha}j)L)xJ2xh&A7TF0a=QU%#^X
zj-GJBQYiMs9M%kFCuVq;TA9<we}j!|_&tc|gN~IXv@MI0ZP-Z1^tY+2FJ;It;uuC_
zf{9UYe46wks`+Pyn_ylTA-`k?e5l-IL(p;^IEJE5n9lSZ{qI0ub&RttF!XKob><cV
z#f$5GVCeH;zpIG6t9T84kM$Fg`IZ_A^rHbQ_ND`rT)67qQVys~@AZR3(%VyNO?DNY
zlVRdPYXBK6W%LBhq<I(68emr*d#R{aOJzJmNu9a&e7676i7^hssqw2xL&531*^<sV
z+328Pkw#n3Px6P)mQ{e{yQea!C}5k2QJlg6eh$T1zp;mdomJB<=4-BGF<FF-NqcaC
z8R+&QM%HC#2rrVTk4+`8TIWd?#!(cprK!`uMf6krwaXO#+GQd`TFM2xOk`k}33pPb
zU-D-^So;6b>!0C}TOrL>j_2?Xe~se(AoQL6+@I<dzT_J|hXetD9puV5qrHMbnl)WN
z;U7M$T-~G%4|8vXKMNvZh|@HF@|3Qr^ApSkw|n;KdvRQSqC-CW<eZ}$b~vBa)^6KH
zgyP7)e6GG8%0B{~U59iszeMH;+Bd<Tfc8zU%N6DPbVZ!Y;7YI8|5!}n$N=iYxg9ms
zZl_WBOu_MpBcL7xQ4Yi5MgXJ35y6q_JBQ!#XjYL3Hz&mM?Rap|+6!~v@c%i-rW67f
zB?jVI9H3Vhd+E&GuZ>I*XjF_cm?J3os|{eGyEiN(oR$;Brn(h%r6~;CmHzO|8ClW5
zM<#~ZfDjMD-jW`JUy8?tENs3kiu=FR<*(ZFKM@N9auQht<IXD=e}gcGp&ZatFE^?r
zR__f2W_mVkegs6pX7Ir-*s+q8=PGm1@^(uHT14*duJPM)@~DiBENo*qf7jN_y>*1z
zd*J(R`&x+Xy%r*)SezSRAu<XUBJ0UswlTkLU#Zm225LsEgWj#`%_8UEZm<~tNnr?p
zUE<h26yz}axW4m(-QY3~Z7y$u?FFmC!2!o8Ve45PIda%MntQ3HD-)i$ztGl9a7K*A
zjK;I}+$`_g)yC;RRwgd<e`HY5@T~EM?(I72`E(P@A}8pn;{s_-tydLYK=L`_v3m^Y
z*N0v|Os((cvbkZu9W5``VB}&b`r-z#jmOvfXqFdupsK}!u&$f|gmrpqz7}L^HM(kG
z){8YzRi;!^KEF56i;dB<okP(!p;WeYd!+?i|Dy%n?0=pqsojCqA=x*lmA?lRV;YJx
z-&%u^8!O?dYlKwZ!ZG8h`vz_^FTYhsDgkL2*M&b1^7K6jQuX;Z9l+=rzp&%)`k<}v
zZswI(12C|K%dpd)#U<PHsmz2I{JcoekkpP#<UP8IZ_U_^dN+ECNbTnD0^LsUnv$ZJ
z`}uU6YcEdg$TS;d{m3*aJ5w-2INU0cChaRlCSQ5Z>{p&sTt#<E0#u!WmY{xic#}#J
zlOWBx;Ayv$_!qFx()eLAll<$I+HPRoc5aOQm4ZL0^lqn7Um!jJwFSXP?k?WC&~j{_
zUQ8>`*&zuuJ4?|IkK^Dj5xAH%b-nke%p-P~K({w{ru!wM$!(u6$jj5Gt%CGbj5-50
zRb~Qx#6}1bMD!p#xn7O}j}yvhhwUR^(CtY8(wDp+fS0p1-NOO;99eLTN^x^Q+)6`#
z(|<xs72@aC7J5_Kb1+2)g?Idv`#S_v<=o{a=JUT1Y>gYXo1>aITHkF0l6n3Lub?Nr
zeGg&G-TCgJHi06$#*bhLSO!<PzO&u)Qq@fi&q&r!j@r>`h+JfF+aoda*8w@pr||I<
zTZN_+fG2jyJ0MDNGACY{^86}k=gG@?0aLji2d(~ukj3O}a57F7<;e)MnE{_FlVr`y
zUMLq5nOB|Wu2LcL_{pUBasKo1vO2zY)Z?c{QAfe8Kem!3vyt@)cys=3Vk*0919u0*
zta302tHWDjrdvtBpKMUVaMy<O!|tm6PNMQc01N39v7PFQU_{(uYfr;@(fO~qhHtAq
zP3BPZG&gz^DAqF@-{dVr$cIFqx)Y{TSq*)hY$*-UtpdMaey{ofS%KT+Um@F^0YgrA
z5g2j;>dq8|l`YW04UO>U_}%If-RiH5_9kO9MG3*_Oi<~r@CB&pe;ZjxHx_lny9&5Y
zayH+7b+-EJaa|a38bs{ppz-->n{SX*`;g+?umtA<1*<ia>>|DUMbyb89$fW^!OPst
zN$7$vaw0Op^V-)sKeLq`nU|k>EiiOck6{@;Tzw*TXwU4hxtgztK_=a!SdTUi`0l~E
z7^PRsgXlJJE@|3)T;cayF%;7Y*pUjo7?Zjkn(adj5hdULa!u*))Y0&-wy$4($48@a
zJm!wf;_Zq>M~TJT)M7cigwLYN;PCs675rN>oijz6a?&Ai7wzxH`9PxViZGUo05r##
zZ(oWw5#zmj3dY)0C@<6>ioPeXYjBm{!6_D7yRsP(IZv)aF^sbQt%dtD2O#R%suo-6
zn3dPxeH2l)(6Ipz4x2z#<E!f9@B18c)#RG^5<KQvsj}7Q4iM?yA%K0as#qLHWM&U}
zt;gFcsVGH*uW00oGD>aZzhg;1Y^P`#9Dl7618d!el!{8=WRXEP&ZwC2%$tt+YmvqE
z{}RXnX#Ww&z<&zK&XM2$NkFm{wY3Q8+`c;7kd0zHzZkOAa$9EGojv_qpya+O)p}Xe
zRhj&IJm=nj1RuGmeeE1#8j9qVwe!3a{7_Xh*PV0sm8AUAlfUwYwPrb&;q1EJ!Z4DT
zEE~WGBO0Ec6mi01saADSti%}7f#NEH8%TeD35;v3`p~Qeci2C9a2B!GmrmkE+#d>z
z1)m;4&)GW!9KI4_bFYM0DZTj?NQjk!gxET-&mmplAsF%uwi=6TzN}cMD7#!coG$B|
z_qMQ!q|W}(Fv8Qg{Z${jGGu>v=x|bffy@Io1*8Vsc@Mh_X^a0%w~Xe4TUIm#fKtW4
z<+byl!se@_PGvD$AB==lQ4#sriH-NegnwX({fO<Iu5s|HE++a2dLc*(fnEr;{?+f)
zK`#WKYLFxsA0jQ0{8$1GOcsdKPi>YGj86`h?mioV$^I_QpuegK+t?muoDR<TyrwAG
zD!|>k>+Zg24yCfuc{i!h?qUYe7mBr?ED`AE^`G5C7e8^~A;w%wV<6i5<TimpV1qy-
zXY<w;+V3vP`f88+Y-IyU-&&%I_Mi!w7~D2y!*+>?`bPNv8?o50op>ty7a#nK{%v{O
z<TA?9K+%qe#6e*xbOaDi3qNBx(&4ntxz*f_>Rqxe-2|N0jX#szl8pkZWyfoYj92#;
zTi3r>GqnF`FK)!qF{Xv^5H?w?4GOfs=s%a%Vn3<VI@>rewZ@cWkYVuGgIz-9LAUnl
z`#|>=i?z<SlleKRu+fTJTy2N1y>`NZ1ZPd8ZDnCYYSEYQkAp(rNV!mn#>S)J`c;%P
z8WRF(g7N4qQ0;RC;0pjH!UB7aUI#}U@scKy>|8Kqh<^i9M)(iiBv9`V4*Fog7vN<p
zOJpm*#t{YjwVN^mm#IP34n<{@i6wYFsSGaqO5ZK=pVoO6i4EcWdv|0LYluC+vA%Hj
zQjw+acz*8BD5g`9jkJd&;8AtjPK`v!F|OZKy@e2$eYNTX;9Fw6S4TBC`%u*%;_fDN
z=R>KowT)St>YuMddCQiwj=0DEDk{mfjw1(D$%Gc6ZGOxVQ#g#dWw{M)tbhJZ^<nfN
z_TAFxD}l$6szYPPE|L(c(?z!UGN6YhaK5^g!<YL0pP%~=^xLYvBl<Xv2p*(<qcP#`
z8u#b$&>K{MC}1U4=`Y_&H+HP+WeW{fFNf>PIdkSG4hxCQHS{ZFc!ZCZJ=YhK<$Fcn
z&N)Z<U1Z0fjoI;!vtAUs$~(~BZEgWvYzz92ipi(H8=20#2}n3ZOaD&i^tEr((cRT|
z^I1A*ZtBERlL~O=sE)3G7B&nk^{uBTt}qbeP>{g}qH!^)OvvuG$L0jn>^)_k-DV|T
zuKY&!=4*(`#r<jScU%K(<LJf^xW0=fHgD{A3K8k=F=^n-A)^I8a+K9=7IIydE7Ic_
zI)rI|m?d2EFLsD&rB;8A^4C;Tob}y|t6vIKXZ_`@K%|8GnA<BE?Pzr>e)guIivUk{
zZbP>hsB1eNPWtvW3H1!d<3ox4^wNa<kkfDH_F(0rp_#^HBQ;b8DTJyI%u+r-8YJV(
zKL6lQ%R@-yYxzZT=)K}Tu!Bw!;izLHPUPLM!n!+ztKHnG%0jO7K`tWg(P1L#G=lLY
z<IT0+(Pss6mSxhk59S`|1gjnhkH>YGEH9jd;y^-3)Om0l=DTWOs$#Kk_pd{ipWL%*
z6|&$eT(saSSu|*%1xo`OXt~O@o;`p!GTjZlk%I&@+7dL{uQxIpAV$b1aGD#e*cB*y
zef7<TpfCZu`4-uU8Ls)|3rrfd3|y_FtPi+OalzFYv=FqqKrx_cvY#vxFbHD@2z}|E
zG1&S2kAw7gLeLj8Hh^*CQ>LQ{vU^EUSM++z;pCm=mK@BBm<O-5`M7I|rzUIaqbRYw
z@RX0mW^FYue%jX&a7MTByy>(5z8U`%oappWyn<dfRC!NDxZm1yLT-9Qvf?y<P2Ig@
zbxe}7z*!AzReH8IM<M6omC`^Dh@+f{z`W<ivCxDLubnaUgH~7z?QyL09Kpx?V*ldR
z$muGs{EkH4X807#tz~kt3}M!4B(@$J^1EUD3db%JX|#aa2LbhciZm-PZCD4W8}O{*
zTr|sYKbH-k<#DyXZ%a~pRAi6H-mg?E6~h@2<Z+g^mwG0GnV9C@S>rtek`+Jm5~s1n
zx6XY~aH&<;e%NCxnu}{I4JykGw%x}>)J<@zy+b2(gTGjiPuL~$`eQCEJ`fFWhgvq$
zGpWuJ5Iz9uXQ}c$LooNYCTvwG91nGiWZn?HgR<$%rnFj0Fl*DbT>q4JeRKGm*Q@=r
zpX_Xe><xQS%qr8JzLmcl0NNR2+<|t+$L9l`u_d5%2Q)%OPGfhgjC8Aftwse3w1sCv
zL`-*-Y*AkcXaE0dCI2G=RJC{hkDmW&(}A0TyaE41q_Z}s6^6<*qlyAv>NQcnuRo}t
z4ywetJ=jp?vX96V!ymMm;vu{)VwwaP=66@4fd$YAfLBBs_Kyd-ErhgAl`(52BG0^o
zi3mdP&FVy*R9pEriqvtKdPLlhl{}W8r@uy`eAMwF=OStDh@vwaVBCt(*>A{d$^Fnp
z=}NkK9n6h-5nGC+x2s<G(;w?sO#62X(RcYM85jvNk9jLQE4<S+Okn&VVx_ct`s8re
zHRrPR9`Fbz;WK*FNF<Z8r;u_Fd0JS5Q#&{fXL#j5)L!|I%J1_sU~jB48tjcpfo@`v
z46nU0o=~lE;!*;`$#-SD@g^Y0JRD6n*70MQoh5#sk|j!3H}PI*?+OX^`M%L+igYaa
zm3+%Ywycza=ji<g4U;Z+UiTM0FB={R-Iu@9JHcB)_UlfFIsy<wA0v>a$&m;<E<Fp7
z^o`$d`k%Iu9A`ufHM<3EM=?u{omb?hE7-QTqT`ra%ue^1q|Sc$y3Kf!|D{g~!8Lqp
zPWNOwk5kyz8RrM$B|(P<d#EvLW!xp)Id@19Y?wH#hg^Gnl^$`7p{$zc;8{Mvdy((e
zD@SzXEr#OIpY=NEA@+(k!syKVK^0OMIOuUk)0IUxkOiWRoJ*RJ4h=4roS2^=^8t2$
zbij=})Mg#ifl!J$o&~Z|Z;7I+dOC47BJ%m3zJ738`3_cN@rqcot@+3?l`=AgvN^vC
z$;a(K(DFU>kW76&+oS;AVP$-qev*Y5B@<v7+oh&aH%@aS!lZumVTAFoVBWOLQ80*9
z;SWGiJ$D8NZTw%(GNgAZ-VbDoUifYHbY|!#GgCKK1brZFjH|PIFAB7J46T$oeD+w~
z@^qTNZ$G&oo^|OW6eBLt;5jj@mnCW#3+zROEWq9JERfw!AY}otCt0sdL0)+QDaaI1
zgG_-t@@)adE$yod@V^fn5{JDm)saO!hYO(S>RP}5(vI<vhod;}!>sLqkSwjk^XF#1
z%}+-N7dniT&xgJIdCr`#e$-F;)?xO)ez-4_-+l)(ruN4Yw6Ul?uVf=1690Cp(K#;k
zd_<Iq^d|s@m-nGQdF?$~tt|xlQ~k#Dhx2gX-D%Cwe{FcFF~gOS7W9QR2om*}ey)DF
zze?M--qx}fj95SCPhzd>->45gSdErW`?R=K(+|-w<qeh!gEJo{l$VsjsQir_04GZj
z=4l|<=p@ruE`B?}=(ZA&sgbhqQ4{mG@5j(%uCMcehg#3|ju`tk7LgXShPJ5LXT%h6
zm>p;c{2Ak)Gr8uElZ^o-v@i_8n~Nh+(#=+XPkICr*C~XxOPZgS@1LOV8{gPDxZi&|
zAX7jf+s5m=`KS$p7Ut7SBIf$CW_)$_Z$hhRCCI~92JzGUG+I6%s@!H>EQX_$XyZe(
zwYn}Kvub8qcapy(4u4j;J2H!<#==}*u5RPLPj+GWwBr`a{~&8ksNN_HQ)#K;(M-&_
zdxz9upHCtr_#=PHPnNCJ33sOGLx?)ckVvVn-EBbhD80K18(ncIOo!0yl_2&b2Y#lX
z7&a<#l=>^bt$Mw_XNdG<^P=K`hANtswFY>gVJ~<nPC!NM;(|RK;@OA05nWz{WZF^f
zkG#SHNtnBlPQT6r5jsVohyXILF#N&vi8C?wK5a0t`_sS|S#w;I##D&y*~WW8`?+C|
z2A`D6I>})8FJt;g&B>W7wdeB<MUhe?i<lmYo62$&)lX@LFHR9f{s6%=Y0V-$P%CDN
zq<#;|-c4WaM`ptpB_kI>>dcSWMOO9OY{-JCfvT-x6Bu}_G-LKmT#2gqEeH(NF{)6y
z5PZ*Dw7Cj2<y*%6q>Pi@1o0HiQm9r7XDDhU1B%55>fG4b+3M$m9Eo0maaIf5)tvwH
zJDetLg|?;~f%j|lO542afICIU2J`kwh)5v88`m$0omG3WXmGIZbaIcKEk@e?9pJx7
zu4in{oe{7aIz$+L(W$=XXnRukQh*rjL%{+lm!Ch>8@J+)Sy<63s^|0gb2uk*G&pYo
z20QQXaNf;Bk5i+Mx$MY~TxEYxZRfTlcpq8>P659`BO;K$P35@-U^i$M)v*+_OFi!Y
zs}$`36_-XF2$R#4%Mr%6wEu<)rm0c^c50|v8&9@e`R4S&q%l+V|3|Tk^ipP&AN*Op
zBY^bb3R;}LX)$Q|Sm(Ps3zn8wxnODex1@dn<nRB2{JqaAvP;oN7jO^sg~nB_rL!E!
zKjp@$wg@j#>9M7QVuF;K^b$QGb=ve}mwo2$jek`=o5w1Z$N^7NTg=<2%d`QvjT!3H
zV=js{vaJcoc2zQ%jxCAfjFaXRaZ@KBddA)mN(7)PDF^nLpp9krK8xJyzE6$y%@a?~
zvdGLLuReV#gAuvu+|FKbvjQMtsA~X~1c@74sBBDU8rp!MX6ADhrjp2tiCs_d22V&6
z`oA6dIka-V-O#W}F|;!U(Ncx%>}lyYB`k5&g7^#=z$!l-mL8x%BFn|S&u|tUd~$<c
zaP+w!Rv1%2a6`Jm{|GkMP@Ik)Df~=`rNV#;I#}Omnf6yXpXMg5aLD<xWd?9(Soc3n
zePv8tZPPXG?(XhT+_g|BPJ!a??!Iw%N^vjl?k>gM-QBs1%X@f!eEE{|gXAP6=i0Nc
znOSSin!f&iW~wXqIe!+&w(L<iegfl`dc^6474qZHnZ@bPIo90rno_EA?p#I?1=5Ce
zTt;;a8d(&?brG7QswVuHMW{P`{Ulo7lgSmWnLp}~J{Zyf-)nR5_wzk^&yDG^(fWP0
z<Rp7~$j%DY^5<zeFGoh!A64h!)_`|w>e(^eM4lZ9@LkYS)}bz3(S)W;()tz$?0Wi;
zX*n)^bBaDI?VG_zx0E!nUae0t8iwzP9TB9lOia!);A@>1h7ankh;XVt1=p6ClEh)(
zEk%#myqU$o{gVy-?tgi7feXVt3MM;h5}Zw~LSNUq!TEf4)sGgSJO^CU+t7d#-SxN8
zelSu<9|m|IP@*FwVbHOUT|~aI0O>Rb>OpVc?#QP$X!nF*Kowy(06YI9l$oy9e);Gu
z2h@^$j6!x-TIic}mdes@eTTW#EZ#VkAgMZ(Ip&jOfA)F9#3<AAt7)EkC$4@DihiUq
zP*^ReN9o}vioFLgme2&y^)E2`N>?asR+S<un=n-5g?4bf-v0Om<i<Qu!G-gvl?$o)
zS&(nS`+x7>=W9)1v_&pq^6b2oI7|1y5}@eQt^4&XcLwQ}f+>jdTdytkS+38L-pRD@
zUGsz{knbWa0kJQP@NI~aBFC7{`;mkB1N)hpGRaZro)`*fzaxF~A73!=ILY-?Hr^pl
z>M~BC#d)3#3yKoXVVCx{?;`CjmYHcW@Q^OJwwkG&AnfA{N^9nFay1_BB*<@w(K(ne
z*wt`*yGvU*Yo0x#t&TWTCAr$Y5$d8;K-7ISXLHqW!GuAFlKKkS^%MRtxwF0H?1JLv
z;sEm-t~)rO&4R|X7B=r15k?SETnz7s(QoyIx)M%n=0zv0->|~+)lc+Lc{2syHAq6l
z-)Qb{UKFI)l&7Ibv62K4e8`oNsjaZ(>%V|1G|1_r2u>ePh3^e)ah@#u`UhXCYDl+X
z-+A&cgFT%cy~(RGk$IFn8~P-QmmgMAZ|yyhoeyDwVM^m&7^Mu3qfx|5I9>$tI5PN(
zWvVUozAO-{JCLbZdGa)0Wfris0X=we8NUm1h=&+l0F{N2+8)H9iUErU<d@)xJXlFJ
z$oyF`?BZzKFCy<)9jH48f8N@C6Y)nkTEX5nXm<2)4-@)ZB-gy`>fLif!XEwW5%pBS
z<zsUDDM&wM57JNZB;~a%o;d!aud1W>>OV9l%GF%y|B}FAzKAnbeCWL~QPX`r9PB4m
z(CP24d8oJ0wi&T)x@Td+z-nWX()~Z_AP<dR4N?hZ-&BNZ;qF!y=C!E(wY`ZdY6K9Q
zlFjs;cA6|}^vaP;u7%2f;BM2R8sKso%!$u{B3>cl=v(pzzwZWn+X0B86ZY<a87Z{`
z3si5!_il&t<PS)zKo9j9Qq?$SDf|>DKd`#pg48+oK+T^$j$ggw>jFGW62|Q^V!MjJ
zIS_8dLzYwu|Frx2h2yuh{#){2GQk%H)TXLBjxay+NlFTRT$F+U16!MXVL%v`?ulfj
zvfB7;w%}nNWc0d7YAh`=*%UwD%K=Y(`t2f?i~H?{rDWp<r4+Q5ky;6~mT|4XE#yM@
zXJeilh#;^sFVUqg)%_G3&R?dTMYS0UR+3rA-h5gqd4QZ#DhEA;f^KAcJxEjIP98zy
z>(+5hOJnuhYCn?fX(fQmiaEW1BUxqZtO18r!@r&b9$K8#n`UGLE<&U}5D;IjF~Fc9
zbmrlJM?_CG-GO)B)t4t$`;V)O7e)KY%`HD(@4LIfzs=iO?r$d>6RhSMuUj*+$nTFK
zpw98SppeYx;r?v-XCThYHEv7ZQ-RRH&&9db80{acI=0HTSIod;LL_iyTP$VCh^`OT
z9!bf4O3AlDl|Sy=GYNSQ_nfvmAdMTKm<i9H@x?uIwm|x3+pziJLZ}HIgVvMI**$QU
z>R!<Kf@d6A@Gx}%&Q(%VC`M>)4Z8320?qKVhw1z5VS;}wgMm2QU=W8ZrU_&C1H<r>
z!;PxBMFK9`*cmGSSWT9I&dX5k(`m+3&9}c~6dtbGVEpE)8uzic@bW*alhxR{Mm?UY
z)1#l(Ws4&`3B5lSExVsvWKa1Ju!%#`yX2bd<hq7bvc|UK%Z@EGcb&2n2_8~z_Z?<a
zlyk;$dyOTIau$O#Gqhm2cUO1V7fmFNkHe=8fUlDO`JJz#U=<7RR*H9iXg&uN0W)-6
zNtPM_`KCaJOCVjVRiW~n_fVGuYL&s)c&DRZWd5hagX0mp^d$6Opv2eURYtEztkOC%
z8YkOVmQwTIbhiuNQEn1J!Lm*LDH4(kLB;`zgycZM(qVF~LVct1sbnKjkwV&Q18Qk1
zm#rq#KYzXar@@=4JY;{mtb(w^`}<qSm^lghz>(`-ky!S>BG9IfFZk;wStwTi8AjcE
zcMn&-lDcBBCevjp{t7?IXMUmmRDS#r5vSuohp)7b`P!jffR4Jp|5Pxu^nPP8FF(kM
zNFLJ{fMWZ1B;wCkT`;}~B`c8r8?~#2qKD1~#qB-hy|<)1^er*3{?J3#pj)oZkG{9t
z<PRsw5L2Z2Z#mF<O2Cy2Op}8JS2R^qJ&P9cEUCYLZ~^v5$V~nAaIVwi_3N8A{?!<)
zbNsRcYn~6M3+IlJ_%e7kJ-Q<@mSE}*n2>*k)GG_DPgM<aT^7`UcTYBOQ2_Eb36~q2
zW(mnLNsP7Fy#4?Dd)P8FCsMmX(0MhH-)a5l5GP51YAb$<4`hRNE_*0!d#-K}@hl6d
zmd(`#0mIVm2y1enQnnog3^$BTSIN#+fq-H7Bk-k_16N}`t(}ETPY}=5-vQ#e>VA7>
z;T`?}IPP}Ap^*QLF7ysZe(sUUK4^n7$#RKUjxvh{jc>{c7zcD3-CTk6YCHDY>r||D
zNN4}^IEXcS!shZItYWhJaPz~anE4-m|KA_=dAZ=Rb)kERoHCF?rRok%fr6|%U6ULe
zO=L)W<nhT-?d>dQiXU5Alr&Wi5-t~*>=1;YI*$7zEZtXdA_I3OQ<oz#fV!+qY6x1X
zWJ4N`cO?ukP{HTN2E7*Y^cn}&yp(Vr<?+>@NFMTr9b($bc74hLz$P|?^1;%R0;-UB
zIkroX)SdEc=@i|-V-?)sVn2%wqR*z9m%+vfRBP~pnreSa$XEvW*hpZCmD<0cvB-8~
zI6>Wui&h#0p~V+~hFq(trHey}lE26Pi8{={ceOd$y>25eQn&+oKs<oxp<K$d{~FYf
z>Hd>Bd?tahWWpsTCe9ls4mD4L)K6v`AwnHyer9v}qMPW1iAW)68WXU=<YU8nRI|m<
zGuo%lkwNz#qSZkwoGOqluQXodC%PdCqx>%stG~|cEy3F*_#LV1ry-WpHQ&z&QI?k~
zB3D)3#10IIl%NmPd@?bX!{Hmoy$Y&FueV9^q;0m*d|smbEzg>=m@cot|B|5J1?bDR
z9u6}$X@B1LArE797;Pqb@AhE7EPXsYA6|s{QrrC0G=x=t5Qzb1HeG6Umf2`QYZ<TK
zZ?-4~fL9*LgAeik@W;x8a)##c@*F0?9IqSPuG_ufwkA?K5%E>9LQ2(qPQpX7@b1=v
zfVc}j*S+d%JSg^T-;pz-Rz(etrU?0DHyXdXo>UeyDt3Q-q*0CMlbPVx-yVFi3b7ED
z`{_g>EQkxgqrm}@eD@UL+u_U&Ozo4>@^w1DvkfI2PkOknq$4--bFF#1w%<4F>Q;_F
zbEjS$j#*6zVB?q}18bPG=x|9gygXP^=?9F)EKxaF#<OQBnrxxIDXawcu%oR!&XU6^
zeX)m6*Rm}&D1xD<X0JI<SCNjo8$c%i;1rSW%0P>$zJ&$CtDz|$7Ftz>q<ubRCLFBe
z58LQ91s*UQX&ZUY(<i82hyT^w6f*@t<yie5D{k-EEfyHq1u^~pgP>_K)F@m%1rRHQ
z19E3Da10t`j2Hw>i%}cgG>+Z389G+}XB9gLGH2=CWdwN&u36W3G;eTgc3?62ohb7>
z!riYE0p9!dam7>!W4`g47@cNcyUG%7Xa7));{G<=-*DUI(w6_4t@gJ6Ov=3TEu3=R
zery3lrVKPMM}gQ~gvmt}3uQiQNA2EgaW(NE_|P}__fD}}=k67Ws4Nio$il_<>159P
zF)VO^QQoU%?oWCQ*gbv^SE9XW@Owf6={|&A6Cf%!AmJ3B2W$4jV#=Ec4OIZdDCeAh
zKX2jBDZ;*rwkfY!v$M~6H&GbX&KEfgu4RAwIoH#4JcWq_awNzT0p01(#>a}#CsV42
zDMzz8M+ATVQHWVn{j|ntm{~@G2N{u=GsB<aVf+UnZT-}i$nj7tEzIahAm3rV+dKNt
z6)4D6$POvC%J=cc$C{rItk7o1!YX3iZ)0iF3lIC#R4{J{jU`OD7A&sS-H~rlBD&t{
zv^^s;<P?Mo)xEcKg$A)zc1wu%q3WwAMO9UI^2@kX>BPl?A<SyzOMe0n=D!(?Nu;}Q
zhm><<FUHu1KF96h=yQ^X3Nc1gbq?0oK7hZ5zqq*gM~I=RTU509ItJ5peTIU)gAGT}
zB6_zgXAx);_OY^F;`Ngmdi-RDuC)#KKsfw0$ifDu8~;`P+w1?BA-^>rbR{0NV$fu{
z*g6QBBV+mG0nyCy(KHakUmP5r|8ZyAK_Po=3{Q;KpQ>dg*)s*Lx7h;a&%-g+eEdpV
z<>GT=g;pp5yw5%(!J)%`E;pI6gdg?|57|P|_gz;#wH>GfMPpAES1&BD|Gs2Re)ZmZ
zc;9#hCnnB%63%K<#s=TplqC7rO$Mt_{Omw;E98x)A3-@qiL2$h+>iaQdpM~@!ZGm6
zS$x%_6hzBouDMI*)wd%6!gO&CG7S-P5{86$!)2A$*9D$SM*`WA(!tK5A0`<x5SB&T
zX4>dhvdqt)C?uhzRu4Cz*OHaksDSVspr0pmeFGCPuo`BMT;<QgbRqY9CYm<#&3SQ`
zJ6(>jssL}h`7JEE<~)t<;e$3WvqR3HR_TrV2p&7ReOv4HEHeP;OOk#ALuK{qUx&|P
zfu<BankTLI-W95{1=qY;&w=Khxez1t^=FN8WfR6D+<Z_y2Jdp-#z#&-YYUh|Vs@Fc
zd}zOEUb4Xu?9qFed+xYLs+~p$PgS0;zbC`ev6wGTk1+y!?IU&PlmsuZo3<GK`=P;S
z`?_fJ4mQ=9%Bv2LzVUr@jTdiGs($#L(=L<;RShgjYnVj7dFBy@c1q>JLv{Oi-I&|4
zA8O#9K!tWj)OjZ?yJ|j`ow|90;22Bqu^+?ublxto?VT2EORp)#5gfjBLe09TFp>i(
z|IBl{r!Xx8iYa}PLQ&y5<RY4%{l|}8)DQQRmEOhg^kjfq#C!5w=L2+M6z?7h3lr{e
zCvBf&t=<lq4C!8xoOzR~?6@O8vSQSq8<w!0PY%A$PfQ^b@OeEksH~bE=VyBssFLye
zC=~SJ?VhWlYextVbS=Bqj-A-tIn%3!h)Z{zT4;=Yas*D5$s?V~vu0cnP7J5D1ZaG*
z81?)uzqtWlA2}2#g4>ikzWZYl__k2X3mgKX$<j5MhIN~~<|<}jKwrZT>)(bR>yZS&
zXCE$-p*$5Xk_kd%7HP#?B(y(K!1@rArC;JdeSZ&<gE=yVdTjAsLOi3puKC!EBj&c;
zVpjZO?4FYIrCKUuJi_#GLiJ7`E=qzAuqCDX4T#;unjp#xHR*)QOx$qnp=FJ5!KoqE
z=HnuUMfPAr#hJ@0znd6h)qn{MlYWWIWp^8rLqCT2KFt^UD87%jAvuxH?lwb=8ZCZa
zz!r@d8qV_3{)c2_jIHVU!2YCK#dKD?X)1=u9>WWJ<-VR1YkqZ*q@=N5NC{LkEkiDF
z12vsO(|rw~7y4cl1OR&HnxQr%dgp%1wJrm2^6OmJ4(B5)57#n5b%BjDh+1oR%c!?*
z;*(oB6m(u860kY>NM_FBd*TczJm7PL17YrKSsQ|opYyLy9H2klnxEIQayAOP2T-0F
zoqs!H6j_Ql&AV$}u=>i3s6Sr<#nMDhaT{b>qP<_~@VJ_n@7M+yVn{knte$T6mX*5`
zq&AhOP^%yXk)vKEH<HDdOvZHtnt!QTe2hB^E2Vh8TUpo1T%tPIzEb)NxYn3Q4TfY9
z(6Nb>`#M>1X~Vs5ocvq6pxHW*GLM1|L<F04zyjdI;|qQ%vhcy?_{@L-+uA#Hp`jKA
zA85c!0&q|l7HY6nCo%tV`-p#ej#g?|_cVcniO(8nkn!Z-=A(U`uAqC`Wv)tUN9%)W
z#Nk=CM+8f8d`k>Z0_Uh)fbO;<dSZl0Op<?{Vy0Rd{>&1D&*@<!3L+F~NGopt(Z(s1
zMrAQV_|vu2U@qyS11BK-F(K*g-fvg>6xgZFm`X8t?r~tz(L+%xWg_5EnekzK$yfIp
zV0MxBY5BmtcPI=~s_mfsa_(GOkjG!-e{%<|N7==k`ILX{c5|dm(j)d7%NNmeICF<U
zOL%FBi23I*ZY7Y604xU6J!wntc#<%T`J#T1!lb`8zK^7AiyBaT7JNC(1}DODUJF5%
zmM0iFqEG~>bB&u^Aa4j{H?HUH^A|NENAhPJsTwalAQB6yf5+L=A*8ZKA27c5P`kxK
z`gk;HX5M%#+i%N1bMXoa2*k0B63VrSs%(Uo?udRBe;@P|v~5mwQsZPz>t=&~s)n=C
zlQG4LW3|u_uLqQ{8ndpxh=#l6jF)m~iyq%!kA$zvV|?&TZ;@ZQ7DQ;3phKfZ3d|50
z*?YCuk>_Ih^C&JWf#d&y74FckZ0E7RmD!mo=+}XrMd8Q^mmWkZ?#7q+;-fgtIqP{&
zaT@3xHkC~Kk|*#T0R*!&$HVMG<|e^>V7`SLD65NdoB*UbRM>tz2arUr&~Lnwx~{Cp
z@Zz!75$#k16ECGyjE^49lRcwSqxF=r3nrZPs7L$v+82la(`-=PA4KXe?JO-AzEF2w
zP&C+zb->>p8VH(}VN<`8x9Lr@QV{>BLu$W^a3>|HmFuWWV9iz}?ZtT?=$)glMK9@B
zn4HxG#&JC|opmN{megK`wKOE0+uE0_PA(nVzk+ztCTozG(!Rau+Dc#Dw#gdQ)vR%u
zwHGC>aecm@c1wa`3=6goUm2xL!}`m1E+;^0jEhapgkIc?lutDVyx0_9o5FuQ`A>$>
z3D~s}(y>HJaKqU0>-~sjg4XJ5rwCPkK+W~A5H+go%ru<d!vJyhMkgP4J5S;HX1J&e
zXbP}Ow~cJ`Y_o=M^2?5zD`+UP-f+&AR0HV$O2_-`U#fI{%VS2Sy@Tym3}#67N440t
zTmY8BH_xR|s-NlVF?l><C(ose=X#ILj)D>n>(7s9RjNzp_|9E7pAikO2<yZnpzr?2
z0Jix67WNocI(`<S+;9$6WMo#9bk%ECGb^As*IuIVesM79`A&`7L}8HvrA1#5GsqMN
z^NYzi1&SZs{2v#+5#D3cKB2CXPK&dL1Q_34zC8BHJ9Df~MTF~bdTm>$8K#vGZFOgy
zc+dz2>CbiZOTjwJA)77{r?eDZzyTjj@mENl9c(lwqj|+6b?I>{rT<!AlsO_VhOJh`
zj9*~>xI-ZI_ZI>=a!=H-d}rJvigHsG@=!*hxb$xd3M<T&f-xgQ>ZI4__xX0tJMZpH
zM_UDZKbLK9sD`?UbN7C>(Y7uzikPd_dKGUygJ<<ub~^l>hp`r4zrUV623C^X1-KYm
z{_ea5w=;#Pkk(wv1=FtZ4^W$7Vyy*&#9knE#Igh0_6;r;+u?a=$Q|r3dV5$U4@p3K
zp-(T7bSAD<=No^X0@)&GXx0+@`dY0Svu_8Yn_q{7TNS8gJJ$i#Y|EZIAt@j;uR9R8
zF2Hl%k$B$m$*sFpX#?9!F$va%KkhJ5KsS7*!*IO0J!oDC|Eu04JnW9_zocfQVS&TW
z`wsX{L2da3o+lEH_>Q&9AEb$L$kIB4=u0;#GLhHW@@W|~A(7S9U~af6^7xF<xv}R2
z(rjDw@Th*Ys_56^J0Xsz!D9zm5`QTu1OKc2#fALV6SSm#Oa_d+vFs=X%7{#>Xxq>b
zt4Red$te)i$Vu~F%zmTHY6(D9`%QSkrM=tdo+_?czud}o$Dz#Nn|%I@)kh_4IQDG&
zLq*7oD|yftFbm-eLa^S$`~DR*FNupXT5_VWd&wqG&rbw#f#@Ggxs|drh21yC*~~|M
zrNX|CL7^9P*Hu7gZZ|fMG~toq4CXDoLha^PM_7q!Hy9nfLCdxxURz7B0VN44YfvCQ
z%CuxSlfiHR$e6UpV*C)1B*eVS1)|LXP6T|Xd3rYNxxl^_OEoGg?r*x5(O*wVVVT5b
zn!s=JNhSB3hk!k<W_7bf#iyT)rXuKx)aV(iDuY~BKKF0IoZ(k!e5?4M>GPs?Jyj{;
z${a$)p@}_+(WpxypL*A-TjDXP#;T)T^s&mG|5Qi)M{ad}7V7gRI41u?=t-R;zIyFa
zgY*{ORMAWb!;1;4OJ~>JC3sUA&TRbbH$Ce@vT&xu4vRTjAt#w3r>dVBZh^v!fr75b
zKS1P~4xaJ>-}8rQE{dNDUOsA6)w&RbDOr?16EO-6SqrnsRk@@5IGh#90{E|+V;P7)
z9z-4LXx#tM2V^HlCm6~wo)iOw5psVeZzW4>t6LndRc|K_*-~*^9`7NAr64ABq$RMY
zeCvr<gv(Eofm7fWMC`>zt9!aefrUP}%>wWycKWV{6GUkNNn#SYHh&pUZShq5?$|79
zk(f6j+;gEFcmbMm$7M*DY<Dh$V{pL-lYJC!F>{fRxLup!z@auX`&z_W=Sv5+?1*hn
z56d}&-pm<2>wR%<L=VI8oPlmWeWD9xST7I70ezBIV<x!%b8+4?DuF}RG$?D^0l;h8
zX3*j8`KUe?BbhIDnJ76HfQFrY^`D%v_qx!GIQB7Y{<=P;2}L)8fIMS4m4QD~*{?wL
zRxCl~r31T5@BHFa3;~xho^v9(sD}@(-!sXFDy5)H*e8qz=iOU?CdrZnVIP@hPFs}}
zGJBQo0kIHT>^p%_-i_$7x<xLy0Du@Sk1`O$b=^<{&r;5P%?V<-6p;lhsRTdqeB5kd
z(^3td#Ij_)iEpQ%wu*}DbKaH8)j-CIp6bV;He#m^O97s(5kp&t-v+O1y!lw^Gid!e
zOtITq(COYhTff16F3y=xI0S3;SRA(lI3F0aF_>bbnvF@ry|YX3BrviZfEFhEBd;8%
zWe(gZ{-^vyGR4a*m;DEFC{pFmZXY*d?stqgdZAONa?OYK3cLMK<vbv5#-A69qqZw;
z4Fx`%*K50X9u?$uGw>tiKUECkjMf+M!~}b^uPA%C4!IQV&DYC5=#rgp4M-@HBT%ea
zj{;3dC}7HUrZt*F`an?N_I8g#au-c6I3CX4He|gq`}%f!vp()}NNL~b@1R|hQaGaz
z;&*X%xeFdZW{mv5W=vz)%E#S0*vkgmJ)3;68ci(Pv^JsvjE8Km@sQHQB)v5EXa!xE
z$2nccN8ReQC!PyMD$!-fKZyvhZXUx0e`x{<5NQoh-(k5pB!T(y%8%=7rDqCQurpm8
zvdn2T`a-n~e%N`40)9b3sF489!5)$t)^(!Rev5ao<nI&R+FL65?ChMaQsn6q)>33o
zu%}+mE^+pV$S1g`dcLBl^Nx~&+aZd-xe*6x&2UEK1DX*R@-gGVA3#>qvR&dxx&;33
z6ZCPzqwe-#mB6aAl1OMr;dCE+4z$*=IoykIFo@H27)|vpvH7j@ILh?J=2{zjuu);E
zWa4nt2VYb}r|SpC7RzxPM-aDN2Q|K%)>X}3l3_djm3{~0^%r&T-j|+wUK;+T@pkXt
z=$2zUzITYJK<fhf;PRYaw>b@d{YgyS9cOH-2E&gcN`OCK-Qyv(WiCV{pVEPkvqCNJ
ze9#mLgCx%F=J}ur{}G|S(Bm>GX&!0pdbYHAiF}KfAF@`7l$q=rKoshsLEZM)H<|Q6
zMf2XugSt<_8#n0ksSF$RC`7A&0}s@I>pq0Hu?Y>eCF0gpKStkYy$)h@5{YzJDP4uY
zXq*hP2KwjEc<E3)DY!E1iDFX%Y;eqsqbueh2}SY+&XXK4qkD*9$MEf<V<3@U%E0Sy
zj5$PG{{}Eh(y<!QQ(YlV$ss`22{mb6U-aXD6I{_@mI`-39U~sX-&y5B7<e&A(g>JF
zDPi=6*^H~7AG@gZwUu|gSq8g?cT|lz4w@Hy1e|NI%*Im^0#srIuiIH$cyqQ?amhRn
z4{p=VD`@my8;YhX_d_yAynpQ#!>_#tC?hJ+IohOh@6b5C`O90KtM10E(^$l*Xuat0
zp$Mw^a44iIzw%x8FnEl66y^7hXcrE#(&~!=5Skub_kcUz=D51f?l{g4TJ0Um&<@WN
z@N2?7=BZGHYiA!!t8=0b;Pq?SJz+ebbiX#z<l=Gu9xk)(R7}twXN02Ac`h@1j^#?D
zkI_ngsd4+p(A}JmvfiT|Xr3*<j?b3{Cn0|rk8O{7N-}Yy;fMzriI|{7LjqZX?UrDO
z`7^R;1w#QAdD%ekn-Y?{z(WM&zpxj7;BA?hDm$fLA#gI-Euo=JQW`7fdyzq`5l&^6
zP_AB8Q(jjfO27|q+O9-|GWDq!jHX;~j6ce*XbKUC--SpG!&+4%czT@RU<rj84Mymk
zc7##lQ;*=9u%B$d32W~dLu>U5E@#ViPSlDlju=WY<aki$>*5OJhn4bw)CPC40aXYF
zh7l1EU1@ztyR`>u5wlp9H7<iE%M<xotqy-DXL0NW;(F#-NX>S(z|F`~hCsu=I(D-`
zzAZgy8Wk*)&=JOJY#LZ%@H3od9dO?<PL6CdQ90WYgLFO6k=%}@azP1K4+_K$97!pq
z3XYY<;EJh`3`O;LpsUSB<vzXww>qqWv{w%E6Um~Ced+BOHf-E`vhn0oNsU!dv_r|c
z;|_9pTeD|wM7$$kw$yBss%iFkr)_i8wj9X>SBMxM<s`La3vqe*1C<tG!F7G&9`$)L
z=X>0)h`@s7X)!7A{}qs4))+2B9|iP!)=4tOiV=}H@gB5`?%MR5zzg64ubK#sSEzfg
z8i;SjK{aP}{;2gKhvS%Q;5Au2S~Ci=14MiQ15U661dy|{fv>GKgjjY65tZH7=JQ~p
z%?4eHSDDg}u6?MZ*DPEC-EBM682P<L5p^f{H$GkVf~!el?}MczDNw|oZjnJf6$NIx
zp7ZAz-d(w_@#WuaA{=^w$|huY(W39f#vdQ%SGp~0LkUpp-GMhJ-pul2P1$}f)i1GY
zZeAU>wAsri+4YqbsNcmgXt46A=>%4@Hn#je_ag~QX-8AVCe#aLg_DtlK*0IXsiBAC
z%Ihc${#-=z7O!$n#>du}3vL)dWO05NA|byQcRUC^M#a|0&rbp%WcD!+pRRGK@n>zw
zg(-1}nWt$J_E7T)Bx+9t|AAKCVvF3VGF+vJ3Bk#VyajWxs6<#kPFb{2rVFn}{4j5U
z{D4(Nt*N|p?@Y=%sWq>97VEIAZKYH!B`u^1CuSh3Wg8Bbbz@bmTae4AVCKDqiXiR@
z2%~X;N;$6h_LvU*f~39;=RFAdUfy=TJVyICOV=5$us^`g6P+abjbeN(?@Cpd<vXp#
zwB8u{geT2z;tXa$!AAs|j9kJtblnk0cEvoDyRdICI2!~vzq?OvuL^Chfup9?8ble$
zRYnUkZwLA9Tvp@q+#jcOUdt$MoX7^9PcOd~0$^;jT?_^~IQ(#KTM6<YwL^Og1y89R
zJ4jI&%TQ3^GPy?Y6rK=#w1pg?u1bRp!oFNnG>U$Si$2zH#Ht@d2lEu`sEy(uPB&1z
zr*h+!;6{9@re3)0F=JL{e(G+4K7wnr4Nyrzz2vH|ai&xRS0McPK*`k~1DO%=k~$Jj
z<vCJoi|P)D_7bKYjC^rBPCYmXY*1U7X-yiH{;IG3fLS1c=2%q_6UCP4-GKwm1EH-o
zkXRuX9<s!FhF7ln{W;)7i16D1vMnl^mZL=|Wp}}KAf6<}i34q_h?7TmYhCk(#(gZ}
z{np<M|BJtb!54#lC16dsI5on{dS1;%bs$=p1r-ulL$=wHUDosS`?;|769>D5Py@7$
zbE5Sb!S;)e5J=rA*ZLf>bDHenTB|AmiTSMGBYLe9?6zl5Se>)ayzEk_N=g~D<b9EJ
z@%K!8B4OH@3X7OtzWSYIb7gP^07D5_(>RtLpbCCF3MY?2)m4hq6u!gZm<8iUo}63g
zu1^GDq5{}#@uXA>U$-~COuVEo=thWxvtMcJ=pRZE9a%6Bnr2s;8+^p$o{ms5*4#C4
zcTjWewwk9||BGnB*jk?u>Y)-r(Pdj{=*iHu7&%Tnf}8TR7_|wwMx*n0i<8hZ_EyZ6
zI5~NM<hatbL_*Y?MTPI(_{~OYx_QfEr<M#DP0kY~^uUbGr4BbzmDRaZ%$t)rS)HYo
z9Im9j5uIhw)&B<hbZ7U+B{VlFb*aS8_Gk|s{!-r<_*cTgj=LlxjzQd>+e;!wHV_+2
zZARjmZ&P*s!@-sno0ZRTP8_qi<WUGSNFlmOS66;;PDaF)5deQ64Nd??Gl7p#uoIxG
zz@ZMq3@15Z?VEC9pdWt_JJ^q#<A$4*ok`LUJ|bb@-LGYip-r0{y-}iAEmfQ`B=l#f
zQ#jA4Aj^x?ABlkdU9MTRTf6Fdp5-&w2bj06`N89K6sO@~a|#^@@e=gtq{C@bmS+@_
z%VH|;$S%xg?|aIP*@8`)DwN~HJ7oY{yLPoHaijRGES1&gaIi19A<;Ou<Y&I+4w6=t
z?T$;KYq78kIa|0}BIb|g6%}RuU2GdEW&QseWT+Ls=V_hpt1)!G{a`#d`e|LD+FpT{
z=T~~rJ5${<W`jwpD&1%9L7?-DZ3^b{n|AQI*1zpE?-D7LuS^fwTk#d|Uk(vqU|3z)
zCBT5H*f)w#?SQaXkPa&ee`u_qO@1(iMp(Pu4NdQq(}Keei{Ofs>!bokqQLE#>rmGV
z8DeCp=8&tT+4GD7vLaUev3Mv-&VuTkYk-2)bSs+o`g*$x8KOe;$Bq^;#Hjpfqz@F)
zw1}3TZmVMoIQ+KGbxQJh*yjK=&R=t#4Fa#ZBLw;l#6?^7WYsMy=c?(mfv!Jmo>gG7
zB&jTc0W2t07aBknn3&w*mt2`+tbeObm-q6#c2RuZm|_gs6+MN~2-@ri1}X|h-QUdz
zh^@P2e8hA!e5kXtIhM=Ny}uuRAsh;c6v1f8eF=Fid*a}zRs;=Y?(_mwxx*0xa8ff`
z`7qWrwe$quj7`7ue$>IJCI{h@NPYWx*a6!yz$G5=yU@K49;0@OcD@$!2k!!t_Lpo4
zUR0Mz6ScVLqwSwx@vhC%2O04H-pMw~nv%$6BrB9#Fxjew?aGkfG(#CGb~>0AJ89rB
z%jV2USxhBeMZQ1|D#ZN(6s(@{cx+JM4vmk^Buw)jZ2quQJV8G5xZs5?fu-oCc(4ze
z+lghDK2Sbyi1y-nD*B{OsKBx`l2Cm$PdTwcER9VO)z4IeHW49CdQCc_E7o~3n#7-#
zGG-Ubt_R&?0FK4I+@1@5;d@G2_yKm@_ZSqE4JlEGx1dsya9?`hA1sB+YAFtPrCY&{
zRpj6Obi*~I2%bjnfIB@K%$MC~{-XPxYW6HtpfaFO8nMFpux$WBWUT1|eR3gGG$cE!
z%hXV_?K(s;J1OBl>Bu5N%uFy9>A!(zDD=WGV1rFNswVYLRxmc(>!R8`OEV;~K4}xq
z7M|4Jafm?VDO&~5InFb!4kgAvba3>YC@eaz4sF9!Ed7r$i)k^F?!PUZWA(SHXU}Cy
z6g)^Yo)&h+?cc1LCg7Y7*Xz*0eIh}L>7yF~ct@3okvtR$t8&oGWbT%A#K(qxv-c2I
zUT6_qpxt4nn#(F7o78Y$*cpeECPnmuJbEOeW(K{u=buWTj=KoX(GyP<$~dwnrU;HT
zRbP)dwq|_h+r)SD$U${`)!-kiX5Z04?g~GxBB$Al;1&kRgJTxg$?t^@^`jAcnGO(f
z?b;@x5zQL0!O8#f1PSc?O1NRt)G@c|Q;m8hhU381USrh{F+Zoej<(9_v1<ppeUe@@
z3gCYW^0m?gwk2xPJRV;L|Mn;yh`}A@EuGkOGmDoTz|FsAcwy)`;o79K@9rP)|GH3P
zYD)}xcOlpeIwk67Y((Df>3_e@6A|xLq)^*%OC;G7v1-ScD>i^%T!At^v5Bw6LM(t7
zQUSf7cycF-jiak<zgq;6jM<}28S&+wo(>jz34XHz@Mm8&5kl0R`|8BkkPJUnmh^@v
z1br&VhJ5Yd0i$Cks7Kwpm#%9YlX~52Li~PfDZ*`@<vhCo=2J%ef9n-%Lry!n1qIVL
zsJUZlJXm?kZHqFvq$m$*)==v1@8_n~XY@eF+Jv|$qd)k9+>gTuW#HUpZ*^~9YY|VB
zIQ{|~Q(6iSq@(-JALO*SE1_SNNbvy@i1j@-d+cBD0&suP206{My^zGb!vt`T`jCZQ
z3khEfabF8jtHr-RI4g4mJK%2er}D6{*^6X+6M3bG4zXMIitA)o?yXEluBh;nQ>RCm
zWhCktFsc0q+B{apkK!Hsnl&6=uB;R>;2{d^pN$);4ZVOBaKK%G+rw5VFT<^ftM`%q
zp!3ln=x3BZ#utR()n*gq4w@5umL%q&Nm=iURSVuaM4=m|41w!|sau$dFV(I=xUz$&
zbLD|si40K&H(_Kl@Qtthk3-(nmP}iR1f~vuxG6cl5_BnA4Xb+zDDf<+)3vA9H(>*-
zW}4cd6#{ZUwWn&DWHr~I?{A<T;a*>YyuY{~kCWq)_)@%Lo+nS9*ob$GRokzx$+Fr@
z6`$ojYvErnp8eNE+5xS_8V~N#V8)U@NlXd@RyPQz)Y5}t4A#e?9<_&p5=@G7vijo}
zxsl*%zR{)TqAc&M!u%QbyP^>mD~TJx&Op#-5xA#Q$pJe>!9dG<)hH#k*T{&(N~gTq
zTR+V0mZ!SUN&%j)`o{>|Y{13_SvO6s^$$ENzM1aS#lRIl1giHRJIdY_{yDR<nB~Cn
zT=|jrVl+ub82*1JzoJFWUAu?9B>cp=+O+6=P8rWQ^dIYR^g^VL5>@)ashZ;e$>07h
z*(Kfn!)fnEUzyK&5lz0Nh`M_$AJ{x2!8{9NUT%{k)JQYY1ZKk&pvG+r3pg^{lc(3C
z!?|;18IJM%sf_(osZj%SWgFP=k6UK-^Ykr0PybKle{J7QL7QfD{<mqSDf!Rm>1)k4
zoj!Nly;dsaa~;_;HcSB5%^*vRl-uU69s7lA9>Xh#g2OBUez&Kv8EL^E+C^U)8@<;4
ztITO0ooiI`?M3oEbA4V@+{({&-r-3Jy6s<jG?qkyc&jGr=!8`C;(y*2&amuC-cKRD
zT=mV1rQA-vmPP7*l_iGF%4fjWsmP^bK^*-KR?jxA3&Up}xRVO_Sn~;JD@?ShRvzA*
zz6SH#;!D?L%INM!!K!4k++30UXq<J4xK(9FdT|>0Q!=EWvsfn1iuup`N#!6h_6H5d
zf7W^Ia5|Ny<;f4f(e|l3)ktVSik2gleM#CWzJPBxX@XDAIs9xjOkoDLyDrO`|Lo$A
zb*MBOlbi+iAI7$TOOXwIT~<Paqot7@*NLHgJJvJ48-&{Gm6pgZ!ea?0y}W4lA!fcV
zy1#KKE_U1dTC$nixV!LAZnKAr9DLg2#4|T_YIPto*KMBGT?|uik$%TI`Qcl>xN`Bj
z=zyZ9KY5Xe2a+zt#L!-?^iUrv7zJANY@<x$k%?kvlx7qlC&G-ntjifHfHEASSTm8`
z%88=!mvP4)EpcA%7soD}|CmqL;kxeXL4FUw7G8WV+Wm!<*3r1-&SGVtNI12c)mGcV
zM?xo0W!SVXBrf`C{qK9`RH{TJbiQ$lCzQY>oT~X{Ld`;}tDhg13d>Rh$J=#yCF@;U
zMNWwCc}*?w3ajss^F6PPN`~@makx4&-5@1aMp}=IZqi0J1;w_M5ho+Svcu-4j$d6w
z|Cl`y_^p*MzH`_`#4yLRScr4lprl>BofW^#m%$9R6BLma`&H^zHi|dv%sw+p)SSb;
ztKz9wM|nmtp=#>N=@(P^Uo%)tH39WAcOxflbxS?~T3zJLQYE^}@2ceQn?VMAPVN5R
zQv8h?vEuEhLiATvk8~W<TU_6dKUi8~q)jReYY1O|GM2ihkxunTAQ8V`MYrwVJuE!b
z+@sG^npjuu8AlD8Vd?Odl#uBEeEXG=q61T%8nJp=kt$asq|2V+V5lLSV_?D1>bGlk
zY54~iNIL;%<^i7(h>#b1hHgBG-jun(nY&tN97pT?wK;A+UJ^i;zr^v|V#ga6c9$Yu
z;OiZJUo7U_z{woR6Mv90VJvE`*L>5oqf3I$Tl23!^IHp#a!k_HaR!@ML51)+0!}Nq
zG0!>7FC5R2ArczM?L{Q>MPJs%%4~NOy63uFfx}+7qY<6_>~CgRhnUCV<HzYStyZQS
ztnz8M9EkUg;F7-=Ge)At-$pA{ZJbcHlDZGOe!Vru=qU<M*-O4g;lPW&XKDwCY8dGz
zj!VwHtVi#DvE>LG5X{UNn?}ZFr$(^FJKza>T5eT?q_LMMLMC30fF4OAtQ8f>%jmfh
z0SMo|(>z9SDEb~5ZFONx_b-}<DDG;q{#-CH@Xh(6*2SvycBNcI0g$q|b)mZa_mXM%
zA-oc`C4C3+DwG#Jqrh6uE|O=*jQl(+s{5rE(e|HDXl|`AF*6!TjARRvtLtz3f&0r_
z#@Ycs2RW^sMwaf_l07*&I^#qQ>7)+7UZB<oz@+hfLr&kv2Bqtyjy{M*^F)p38g*0K
z@3*_RY&4!jRQ8PWx1&?6)m$Umy>z*Diyk3;6|G#Gpn`f4q_8GpY8)cOv+l5}xY<`{
z*Zf+JN71ePnh;I@(8*&L#xtzFdh%Q>tUZKMy@YSmO`JXNp|rzx_=q`3H~nA_>|BW)
zady!?mI?YhWe(}P?Q}Q@t_Rq|HC=4r1m?UypZ%L~@OaqSc)KzuWew}s=4Ja6j2aey
zxoz3p=)K*qFQWH;>u~cD7Kgj*?&14j(6BZhLmlr5*Hms65eFq;FzMW{bNb~mTih*&
zx3#<TDVfRWqovcU`rX$|#BhlMXd-jETVWxS2zFx~+&P-UP3cwzZnHPGHp5TL3TE_2
zc0(Ov|L!Z;DC7-k%NOl8X)+y9K=#l>3FyMLkHU*(tFSv>sgd(n(dcnfEQeuk#>CSF
zpz*f)^ojpY<C6J!<a<)3kguDqM%Kod#C$b4WGDMgB9e+h8pNlY#zwONbb^esQLA=U
zZgtQm{|p^lD%HRc+dv2*bBAYt<`ORkP%b$x{qI@Q)OK1Gl*xtg|7%D-E(PV1)3w}#
zrCwJF`H;SHJ}a#}TNp0W;X4O<D}K(BQiAybe+XSA7I%;CEuAb#;kK5pcgDT<4EGkd
z)aGAv|5!D}GvX7o`T>Gmn$p!>e&iB?x<NGmiEbjuEh279chH~_tsi2)TV_OAIR^)e
zqyz<y_-hshu6NHn=}#Me$S74yk(i+Y4X0Ao7TJksnIs4ZX@hC~{ATJybfFjryb>@m
zBNqE>he;-e%Uv0G8>n|MCuiO7e6Zimw-t$ZrVM+_t{pJ1j{t|D>tanj?4BG@;K2g2
z)p%-)Fz*8(-=eqx5p8(jGweb|SbwH1B7a~-Rv$i^hcw~8CXr7S6h0meZ|BHfPfZLS
z9B7QC^%Kz(U2N5v?{3J4?{(M`78G=tW>$HgVw(0SRy#MmZPTjQ*52Uq{7OD8z`rj{
zlNnNojPVDuqJ;!Q=&;ZJNI2qg20c5M0Pstsv2%ErkDKC~ks|dMof#{Y(q9KKH4Fx;
zy?3U&2j3;%iyApQbnWGXuR<z|L^&*WEdm<!nj|e8c2cQV7H)*4+|VL86=8isbq)(k
z8)`WYMTdxvf1vG`802|0z*D$1h*799MI(eO8G-|6l;VXc7!1}D!JwB-au_YIl1lvG
zC}jyF?=+>twf}1fM-?CU=ffogJzNiZZhr3N5)2y`Q}mb7u8ceUM!Jl<a(a>^>(Gm4
z<e1nyb+5L~((2TJubm1^@z-wR1u}mVl$@ZnVg(_zj3II2C3dux@*I>pd#u9SKEepv
zfz9<s;^HM}g@(0N5ZWi=d73l9)Fr8t5!Kt;eg*t<Pq;);_vWsbZvR&cvuj1m@J1{B
zb}WjjGLuFDM~1rt&Xpi`=bF}t_BAeGjA24hMn>u$L`*1_aEal#B}mj1;ioSZAisR!
zco;baa?V=}Mm##;{arf5{69|sOa(9mKZBGhOu=TbhKvWD0N4oFpGqj1&l7<7qrs$q
z_B9*<<aH|E0O}6NKmDFm#9fTwl&OP{2|i#++V|Hf@85!>Uz?Fb6>ilX+S*F1lfWf9
zCr9ps$P2gOIElV1)&vFT+m8yv(ZzuYj@kLZujT44TlM}ukNUD<d*K8KLhB2EK(X@W
z)}}*V2H#y^c?EK|3YKBdiw$JRyqEl_5LSbSo1#oG-1i9$9z~yMM@#5{-sO@`-w84c
zR;bnvkMY^f7Y!*XZyyTH@F2-h=^}5IND$A7ka0S^{7Eb}^R0LE#so9>*d!>o1Qh80
z`JaIvDa-l=6zEuk0LUsh0bEKOKJqitp`}cJ*Sk_mgs7DB;e#G}C{p3UiY+Up#6}aj
z#6mndH;!RkAfdS!SrLzXxXLpw(}s~%v9Mey+P}8ixDz)F3Uoyz&eWJ5sF0RSEkiVM
z&f8_R)tvC26AKpcCfHuK@<N&Fh`o0h<ECb%Vq`!)b_39pi~F`5cCv7k@YR6SCaooo
z-&P4hQb&J$e6Y-#<!{=UV|5<qE@o=|pNl3Q|BAXU_A?L_7+lL=$G~D>J6!hKCT(gP
z{{wV0{lqtEj2S+Kz8fp=Z}`#BRfWIE@Y|-dc9FsMizXvzw6ajM+_*-aEBlwhOU3;!
zG;|^eI%r^~cZ+-Vbf5XgWkEHEHK@sJL$lhRcD3zp#Ri6eNW5Se?5m%J?|8RQp29z}
zGh%4c34(G^k$Zr{Do9;9T(_&2YQ!h^v5H=ByWp?LR))m6Al|!QlPSl1q^z4IJ;->&
z+FKw=dd3@x2@;6+GcMd<();H|p;g?MbhD|ADgmV$0jUbTkq!0m3=1n{$qYDOq1DQ2
z{QoJJ&dT8=H|D8;nsWxzl6iHN(p%6kvtRGDvee;$`9b$L{Ywe<su`YIs9?JszS<I7
zi7ehcGo(=AGM{<e@{QpyA9B+Ea%%I__mQ<B<&BQUtg4XHc2ftn>a`6&BJ5M4$X`Mo
zwm{*QTgo29NWjg7O+^d!bPy6PDxU-Pxa)B?-@sk<I=Y0!!!}q}VYFS}^4-kJLYLdY
zRrWK=I-WI>JJc{nDBo1-SaSq(rklhh1fwBcOhH1>U*jD(ZN^C$%I|?Bwf{_oB`8nP
zl&2kFJyM?23e4%$Xku<-_lYqrsBVS+%LbmHo-ofT4;6a??x8XrrRlc`h}~K+g05z6
z@F40+pNELKR|br@YZD00@)O-#<NCD@=aDx_P~4|{hDPQbTB3@U(Geh38X^=cYDy_~
zD*IohB3wjRb<Ao5gBh|aaPTU9$>mh^wJ>2Gz`>y?&};3!nnST`=m=neU#gAj>jL-Z
z;txh=hy=YJ!3lU=1RUmZxuJ%K=2br5r^gryzX|)?u=ucpW(w>l1@i`eR+mY!J6*3g
z(tz=bSdp}Z3e3vmKb>MOeKnc}yOk`4*LhLIGZA)W7LlD#1d>xU3>!ohKznSHyY*pc
z2gaqg_)PY%%J<QPZv;?VWUl3iE`cGk3iWh4Dkim(O;$8v<v&syxPnajU49co<3HRz
z`}v{xtdrq@#8o2R`m2V77~Es`)75kQo7SV+Rz{!x$e990FYeuU9{KDoR2##vwBT*!
zNFmM|^k`4dFPh_KUyNoF;0R8}i>o>kh}MbJXXBGomVBLAF%iG5vzn0!$pN`e__5rt
z#XkCPd$B_YB=@({9HzppZOHF9$-1iMu2ux|!a8h(kzyrVSfR0F+50`lSyQQ$)%2>k
zt#|Y{2J0udF*h!uC(8$f_j2xtoxQ$zNrzRA$X5hW*shzQt?lrVn;T>lte~(C?*N50
z`R(i)U2>z?J}9gu?a-b8b&6Y1T%Q#XRJ7?<6SA=WvYc>y0#$Y`f*@!0!j=wm2T$sj
zSNq2?$~)G;<2Hmi)xIrmva5s2bC*t4eP+mE?~ToSNT<>hIyF}+SD`RVfYRPIL>ZBw
zUG;t#w~Fkjy;Aqq^^h&jgTqYh*Eh<;yGd#at@|ob^3vBY#9M%n@@>c3s!&gC{hAGm
z?hMo+HHTj|n_%I=-B*VGj#r&awtG`yZ%f+{i?_k(%xqo#t0p&JerlV`9Jg)jbZxww
z);N7K{D$@;qu=`8=bgE`7VfA==FmmxtfOPB2^<K@GbbdyD#qQEt~7zod8g$M9wu4Z
zzg+9F@edDAtFr;Rv*tdC(RD6q8N#n8zh7M<y|}2e=0ogJYPl%!Jt@GP74RN}*NM(4
zxsn3x1Tl6)!w4u&Lu;xG`S<2$XkA<5bgd=qu=i$ov<z9B#L=v_&53u+s|{Y})}UU`
zZPEO2KvnhQPY?*UZGJ*sH@ez01p>idIj@}=cg#T`7|?iKKd)Y4=Tom_!*!GaLIkcs
zi=9A#z(m(hM)LJUJABj19jLd12#c~Ow7I`iw{7byWlaRn=(Gb~dW+N?q4;AVsH^d;
z_y?r@wNeSQ)I+`9vS^rf1Pj&o;=0d;9b+%(T??^m8tM=7i-^E!C1F3fiU+o!*JeOp
zDwYBbxWB(KSw#6*Hix{|y}Z)hBHY&2#PuG!D^Bg=?q0nK7plzka@H*QwnRC-(0cvt
zkh77$SBw03x-`@ekK#-hdB3tlyse1{LgD4d%M1DtUqtQS$$0=?&O)BoD4Y7aeU$-k
zzlIvp*Jo3z_xpM_!uPxPoWX7q<B#V%VOl`!+5EJud*xM*EX+gVDe%Pvfh>uR@Su}5
zczizhK%`;8dOf`-hJi)W!$G+BGBr2o<pHk3wtwTofexAG$-#q`<6Wj@N|1wS)0gNn
z7t*p^o?#-XC7$|uBuk*=W$t55InCQ7y2iF(XHp;N?7~O667FdKcst)aaPSx-vI3O*
z>PJPdu961NbAxC(*IVO%h?rl7$L>gzBD)L!zuqF>(V}H8pgX$D7Tcs=gI>6J`mPoB
zQT*Q<|Gtu#lpY0g;oa7E>aS^9kG8VO7k-8j$!@RDV+zer&Ub&QW2J8=eb=F_nBKOJ
zXVUKl`viLeB9elbP@CIyfhIE(-LO4K`%5%e{D2@hT`b=>Lw3ZDkA(0bNKbuJ(ufB-
zX*^%Ym3rQ<1}rHLDs<9cc4Ja`sJV&yBze?Qo6{%*%TJKB{gSCMttq&NsS&!b{!?5%
zgv*bWMtg%0pV=Bfmjr^O(Ln6qHe5dF1|Sv#_0?q+6X=pUB!_T7ACZ{N0lMTT9?K&8
zTP&%KSOhDw;_xpjC=`iAOhERa|2-NS#F8@b`L*PDv$*~x{aPS!@DAp)yO|aBR`S*q
zM*;JR$3B7ZSR$$a+JY`bB9%^Kmo2cKUzA8dJg8wF&#wJGVTj}IVjY-*y67H)D*d?~
zZIIB$Px5(f;PM;KcbyQ%4NZ$;Nv?NlpOa_jDQwxYmpN+v5W*NoEoZU%rXGXE_)`AF
zQnB7$*BW>Zu4S^c&pd7NnWqy<XRQg78_88c7aE7@@Vt8BXP&kmnU7kWb}di~*)8WQ
z{H&x@{?{87@^k(w!;p0)M?xT(tiGHi0fMDl!|Lnp+^gsK_|KZ!v%<W&y&s1Ug<T`+
zJz9c6|A+Rz-`*MaJ~|FfcYmTCiFaK4_C$+-sd0e@rj5EQWF4M1E!w=dPSBVzYn9}@
zC+1|i%HZi)$QU)yT<yifZEd4h@5Q1z3p<B?c_S2B7-}s(tXtm)N%JTOZBn8d@NRkI
zm5W7$+7tKEl8kXM;6z74c9}AxBO>_xuyZmT>0!^qLyJB>J$Y{B6J5ov%=Kn!58R>Z
zAl^Zq1l@ocr-_iX^`SkUUVi_DbRb@vuyHm02I-TT{o&RM%e8X$(7s`Ojmjvq(E{+0
z#|GU`uOMk-qH}e8pf(iir~?!ZhKPtnmIomOq*JUJH|MKCn-QazBFn*fguOMa8|>2!
z^@uLgnP3eC+UAqwS9fEYB%SZMYpR~>Ugu{NC8`bHU9VQ(tTl!sJuFal`S-tB5D%<m
zdj9u+OkGt}R$a6O>28n?N$Cb@5J5n?q`SNONH>UdcPWz6-O?S>-QCSS-+%AJebR^H
z7~fd#bM~Bb%{5o}2NOB$`<qz34Evu>nRbtRg{iPDFwuxNy9Q8oDTbrQgzm8mp)i1u
z@w(epaP1)(8Ai;nzgr~{a_=qV9~&w-_%BI^`FmO3pvaiBWNiNAg<jD!AkTL`+eG2d
z^o*UpWjpIl8SJY$%^-1AyJ=qzOTSZa=k!+{BSjX@kWBo3qwHNVg|T{%u~Fqxvx2jV
zCGwNq`H(&P>#$gKdUNY7x&2tW>2xj7IwvfM-c<c(_ye7H=4j3oI;@C0A9bzh?v}`C
z>S0$@soyjW+-Pka9VxEGSF%%Auhx76#dc$|VXd~Op-=%z?{oKwAq$LUBR<?qwz8Be
zoNUsjWxbrQ?$dPmmxvFKwzF)+R~Ug=Kz|GS{ogXyz3!+6b6%sd#NVt^nQkQjYmy`h
z0`=3$3+iz$hI?-80f{Z&!5?paR$0qaN2|b~4%G<+BO%%qszfRGL}ZtX_h<Fi+rd;4
z;jw}K__B#K*>24Qd())OrPl&Fmx@0fy2-?#b4*5+HcxiSQsX4smrrk1tUR4>=N{7!
zGa8@h69p^v+pbFv^P35c<ws2b0Y2290`;0UDW*GdU{nFcUX(MRsfUUF#PX6iRZfwW
z%Z4(J<n3L-Z2<dqUd!U~s9}@BNjcE$8+&3m`r(*oK|({N(GFXeq$Eyur!AE9VbuuC
z(>vljB21!pNHOy4QGY?H+MCoY&Fsz>wH$Q)<Xs_Pfe_!Zx{|$|*S-u4b-vc$Ka-|m
z#<mu$vngegkRlxT$@|9oNt)NBN^Ean$@!Huc>0X$tQw=M{&aM6T)_=~3Gls$A}BQT
zqCdPVDE5u+BLlnaj$u;mISLx$2IlVdkEg7s6aU(?pGl8%FI$#kZWl81OE#8__71v9
zn~dLyT)Cr(JUw$f9Mb?l_!kacVq#%>qj6ulEnp*ywxTd(pW|^V562XugfW)?j=#QG
z5~(s(tvp@t?kS!>A!RhF)W>Pb@!(`_TwcQTpHq=P6G4Ue;k3JHRl%KZ#0X+(((1<3
zZMbOd*>GXoxd$vAI+TPT)19ptzpI^4Ezal+{uXV6%yYoEOcD;vo=aa<eoG*;+mOC;
z2$af$e5a-VK)%!ANjt{xt(~cfl0*5ixux>7J*l<){5+52_UhLwT?GV~6P!oJ<TWhP
z`31m`iHXUYsdvt9T3=cw8k;ejZLI@@Vmf-+-6+r#nY%n%9YqeLJR^m5pQjN<NFr{U
zq!s~sqW3-}z`<(Azj4BP`c`ygJ_3nD+-K8<sXJr7jQYpcx~DPGmtEzjVpibDeGAyC
z>CAo7P$&{ier^0dX7a;N<7sy{dtD^3&ZG6V<{?&k^6@_NZmjX?{7L%7gZA|u$6;%r
z&PwZ{`%MpkaCWxbT>fBwdgScfaG8&2d}nte6T&hEsH}3@BWENA9S7I(++kowOp@|W
zyncJ<2r=r!_33v!$CT~JTQ|JxmMJ2WFkU;S-gP8LTyy9j^JGGw3lR|9bvzXpbh{+W
zj_jXmsfKpLaL4yFg{dGr89(Z$@b-A(X1x@fFy5o~u-R^1X7EB?#)vidw6BjO3q<cU
zPND;9hw}P!!p>5*T6OQ<{vjmWY^h&dH$MA0DffD>U)q%HKvq1>TQsDcn7>xk$wV3W
z6*;)=mC|o)3xW6%Hsij2oNi2Mf#roo9~ropHbc$R2@z?b6CU>E4RWqRKqg<p5!~L-
zK80;W>We2*ygd_vjzvdNb9ZWM^7eKhM^FYzpvo@p>5?M`PH{(6QOLJKUktaZ_5+#n
zu*~M7OtFa9wtk%&4iT`Ua}+hJw{#TgX&-rdoUdWJA1M$i6@9tFvFb-gEygF#G#lZJ
ze&YC}Q9MsDdLYC>t8a+?GA1&5^8$1F?CyPP!nZ_@ek%;T>QelshqpSCnV=h+XyO4T
z_`(8+R7(pJNnCxK#^N(cuP$OGcvUpSgjkDHKAe_>;SNnOsA@i44LDPfTt^ZqwwdkW
z>J%Nr;^DsH_QF%;pWr--Umz$*xJL2eL36pwfR+I#?GPf4;h?|l4NLGMADKUEC{o9)
z`pAC7n<c)B({zEyN7<<5TnvFJ$8Q2~1g|sui^8+*L<je?S@T>!qAZW}B3I#M_4uP0
z@R^~$`2J4fVs>H8z!nSBnW(1Cc%)9pJ^X;@F2NP{=<z|8n?;(^oBGMzEl&}%6NAAs
z<g}lg<Bm{O>alq;XD#_o8qseC{-dT17faUzBSQ#Y*hjo=asr2oUBywutkO{+LS(|5
z=Y{&;X&e;i)vgpjb@1N}31y_p1u;VOuA{FKg7~rTNfUl%+*PVN*X%KB!v`xV6_D>q
z>xgefughO)_GqjUo^Z`5R^|dIEB^fp0zc6kSuMw=?3YK#pJ`ZsQZF>iFmmcEk9AEC
zG`{~QBz7FJ`_rKS!THN9xMT|edK8?}-%pD^Y4@$8Utb5@rF>`!_B)^VfgkA6H$hjP
zH)_IYmO0JEZ`w%K_uXimk8AIHpkgqxm6?`u48Lbrd~k4z8XA|2woWH9)*=9Kt+bxZ
zbCF6tImVmU#B%(qfc`;@MD`bnPidOr3}|R%dl6}O%x_N*<^luR>b_C|oGxAwKKAk*
zZd*8X2GEE*@h(9rhfF<Oh~bG-V*AbCo5Hl22A}(L1>6mP$=zGLtiHDLf!pq99j#<A
zUXc1ICULelsT>>0|1KwKdlszAbYO{b<t^*XLxuC?mmXoaVJSpY<t4vke&E@ubae2r
zun|45fN@fF*l_-XMEpG;KwJ0*@d*%rhcq5wlppv+O>J#NK_!rfq7UAL(N+|qi`7DZ
zbvjbzHI5PYw}i*YBqDMy8?Osum!i{Il(hc5XPItB7N!?we5C2y-Th1v=+LQn5n$7h
zv4OxDE2Na}@g&Mk&&M>!#qMiZM>jTqYeweZFr+nU(A#VSIFPb(@9^>TktDu#{&o;{
zNJMUL_kAoSUssB>YVD1j&*^m?njomFx-`lBtVm=(+jEVrU+viB4$SdF`HsLx=!Z}(
zT3j-hHOSejSsFG~g_104>IE9OpjxER$+t_tJKfA9*vC483pjicKZSI#b(10{T?R8{
zrPAr}4D#j!W^AXu6`|&DD4~NcO^+Nepz{C3!3I)tXA2+4RdB9}8UFYf)2=jBtb(^q
z{q6f6?!6qTS}5yDD1h>VTjHwt<?nFbf(07WsFG|d^$Tcn80U;QmQ5iSVqE(rsaaPt
zSo#r(@^f$?J4Jrg5Q=$EtvPBrN0+T`q34PV(VlJ*@N2?pfuO)ciWDmyUg`E#5$tT%
z^VhazILbF-_|b0<45T(UP&~<A!JtO1(tFZoJ^j8{7W&SI(O2@*m&(?!-E!R}kNj1A
zJe9n7$~#3}zPm1I4~4%ipExL?S&r{Yhl@i$`~>S$sB`tNlyqHbvlXRHuH=$x$Jic#
zwns7=2pM0ZU09X6sMzzK4%?|PQ^8QhjTBbBsQf7!UXwogBe0aldI6c5%y_dJi`!sh
zcla_))9l@WaCM`#wT9AWHf7_|#-$Yc+@7xfqf=E}!#@&F`36IlYr?%YsDsHw#Io;-
zo0}tFRDACFtSq`Kf~PCvrO=%kxF<kY+y$Kj;I8jF&LUN}XR1VgKoxZt<SG0nQ*>-Y
z<`42P7fk&hvJ88QVg8yDzS8d_-vItF#8cXjs#j3Zq^p~kge3RJjwlLPuD<pxUC?>(
z|H#2q>CCZ~eZAd=DKUgSa|CVu@$qLuXL4Q`7^>C&S%Nn=gAT<{pZ74O6mS{+wJ=GM
zfu0SCD2B*J1zbU+I~)$U*G8vLALpZI5rrj;E3+@A)l3|jD%;Nk!)Jf|$~)xGvsiX-
z%EWP2RO%0m*nE@b*b)x@iAJUhzC!_l5#T%IuBhat{i~V>0ngDhB@o$Ju__S(4<e_N
zsg^}39Ju{ZqMu09m(|U+-O&QKFarunStc1N@ljR^90ko}CUEH%wT)cnZ|}7TS#DfR
zQStxvIosbBd@_GqI1Qi`6L4T<7!2!Pz@$~0Z?TCgysHd{^P>Ls@f#sZ4>oKac6|kG
zA@&!g;jjC@Tq;84l~!Mr#$G3k-`>Q2A9@ExaiB%knemN2D-5BSF4h@zuX6$>>?bJm
zzEaX%)v7@#z?<FbE*b*|7)e!4<$Rb<O{oMv9w`(asWDBSjxMr>XOk6h^S~V;+MjR_
zRWmggHLCQ~e&SV~ebntWC|}HY+P73=lxJNSi1HQ<^8h*2Ig<QiA~Yw0dyv7%k>iAX
z?7VYi4qd~6C}w9?&HS0;WGCQn@#d1Q2Sup&z6Zvqt<yPQq5d@4#DVwPJR-2dNsbyt
z>-_KD)bXQfG4{gcCDIKHu}?|*!!MU84~K6oA1&C2Ld(T7?l30;=W~QPW9hp+(uJCr
zZV|Jn^vga^yd(6-(0*&!WnKPO!c!<ent{6@;2n-HQz9Qv+`w^8AHO+3GtTx~Sb3+S
zth;#e)^pph$+sdg5%V%Ka%xo}xkLob8~p_DZ)aQo`X8z9jw!OeA@Xu_9Bm|W;TyRP
zV+PJaq<5!pyi&Ta#Fi_))&<cvU66f!PAVIHdC~{&S%qiDm28Y$!39g^ciJAo8&K@Y
zN9^vgjj*H?5UaP6><l2al7agM7Y#bQSaWGi28B&8R%4`_qw2&~ZKZU!e9m&9XNK65
zAMIpKj65UI#Z<88Za8LLcDJTu@k#25=_k@?W4yk9P|?R4bib9c=>VsuAI^)cMJXHT
z>N?3=LrNC??z>jl=|9&Z#mlJJjEk^kiZx=%LR6ARF`T|Ym2LyPZ`nQ9PY%QjUV3)t
z9r2alkp}2G(0>VT*8?ciMWr@M?`*pNO+}6DIC+||6O1;69d^6R(MRie2nw>0y&WNQ
z%kxV%AlcP2!7KbcY&9(zeT2mN`skp3=8Jh9^=0XH+Wl%kA20rndQ0KyV4ygac!_OB
zm?NUIIGg$pPL>&P>&m-4XY?sS<L4)51lZj?X#<ik3<RBd0llnLKlRsg8$9t`>oid!
zQE^Cx2#)V}NYRX@9yDLkZN9XtFXjsUmZ+_eWOLcp=nRcF95mc1Qs+x3j_UTmiE79Y
zj-%+7GFs=S3+qCFr}fLu=hP<pYqXoGnOxkYf%ovmn@<S=xI+{)aF5Gi!nt%i;P&lO
z5SDAn_@}f!obBT&B3;0$as3l6JH6#LGA(W#A<{6^f$_WJr_WlX3C5TXqfX;@uYOR>
z>#so_s4R|mBI`_KM&zPucOr$RPM107{Q#NIOPeQDpJ?WqvbW}MSHCSQHuBvocQ%7w
z(V*Z|B17LQAl)=eDj2OIg_F*R=_mIOukB%U{0Jj&vwNfTPi+s<M;)ms{-NE`!lA7^
zbZu>%es90hsMjjp@|kSa@E?(GpfqQcD>dD-w87&ptc{WuQ)<wRIBYz)(_6qp^L`L1
z(W09pwm7A`PW)_(`LQP9@NJ{RIPoQ0wO%7T)=0ME9I(18ymUy)Di3#DNfG5N&a~hW
zSz$EY0QK1yVc^!;O|5uO00VvSR%Imc*02jd$)JmVABB?hI#_LbfJW0?09y7QOQ`$G
zD+m9Ah!H!tRQJu5ze*|}4b2_{dr{h1xJYDr-oVKDOWOhsP+^*tk!P1<ouCo6E<azH
zX|n2$1NdSHw3<`^X^r9N1Snz2t_?5O`mOQ1iiN}S_}Vij{So+Ol9Ll{JTwP-6jr{b
zn1fo6?371q&U)%A_cbpvR2T>NGD6na4}Fu-c#ZL#+1+kJ*6{6=WE2YhO4eL^xSq=^
zMlpfr89Dn)=ljEyKNV=FcM++I_pXw<<S+yrfmk7g7nG~iN<3oPh4welR@#!bO0>e!
zKeGHNF*5GZ?yEjJaQ!T7t~L%2urEtu!u`r*cxR2`+EuV&oEw4RURJ$m63`!fbB;e-
zM963NW$U+aNEttT8I~QvFVtwn5PZXfDXK5>p>`I|5kyXYb|C`K_#4jlLCo{0qi>J)
zI)Mxqo?IOgIyQx`DJT2*MMky!F207ZNGaNyOqj$sjLO@_YPfa3UzXtX2y5(?Th@2s
zV8@_&S%`U_Y{*H8yT?8d`DNk01u|^9&Mr*?L$X2s+HqC`@>fE?q&hgouizsMf>G<m
z>`zNF-D99MHyD!5TE}0SK46~9WNimrG>R`q4VY_Xwcc>VkLfL@_^2CQc+%YX<_FK`
zHX2v5o%i@`AtB`UBzd><9#>Em#&kZg6a^nFn%W3?x6Tu|3)l+D9{65=%1XY-IYG|r
zYVMiy{la^;hkzTo>R*ix-Q6uYqKFln_E^f4PPiM`+`aBVmx%561pQKcZVv!Yy9(Lu
zuaS4F*=c7}<$NSP`Fom}I@=N|1sH}#fhebVF~JJGjb}=eKX;VRO8)*ukWs>uUw}a>
zU{FDtYAwMbC#W`Omr^+j>*ybj*G;d+{ot+P;*?JP_bX}2Tzzzn`+afgz8z!bmyv_V
z8uyXEL>%`{Tj~O*YKc_$Mj@=gl_J4qwM^TTT(hcu(Q#TOuV2bWMcii<l;^LS+`*V1
zepj43Z$i2D3*EAc@XBxh5*oUmt7z1jMXGgDB1<FH!wkLaX}cIm$cDRehTCk+P|8c~
z^8YgIup1(T^_aEaD{D@EMse>=#ktHQ4`!P~SInTK_PI87x+J;kn((0lD8UE^@eHoE
z7kHUeLXV8+=`ScBg0XLmT`~JJBMA-jL#of{IXUtTe{UzU8@Kr-WPKIB6z<fCw`|0!
zp$RfM-{-&K8-7n0{b5d8+iFj(F)gv=ZzGJAk8AqZ;ThYdvJcyCuQoi|A9lpAnfQ;C
zk+H_)25IgW)mo$}GmpCSfTwr4e<_8d44$WwwsB~kT{wBIi)6+&G2<ons7Zc!M31|e
z*JB0${Ri9uZL5J8j#on~yQiVuzSrHmulsc`^$hJJmWLkOLbRo6t7U7IK^~okzCF&4
zs)#b-o;lwapdvpPGmI+K7FW^!1=B^d`qCN91nJqhc1p|3L`)N00Wqm}Z{&oS>>Dlz
zo;Rw^H8ig+M}4Ljq=^L|#B6qAbBlJ+GBYaFE@Tr)#0W_XvU&o03PK!L*hWZw{=u*c
zd*xG>c#=eX;ox=<Ea1Vf{0#q&tm?rhi*4Q<leh>mW8SFagi>$-PaQ^uFVlZ+oez(?
zfM*^@vt^PUZu9vJ5vUKQ?MW4*o%W?#DmI=ET<oFTV0ADM=*&X=E14;Eqn3!y>JZs5
zpKpUAc#@(BC7aPNA0BIav>6rcIOu6ZAlPrlAN$2s-4{a(E`C6)y!8eiU8^RizX@F{
z8PWJUaCYO(tlPL2Sx;%%h?q5~_~*=!{IS~<J4D$5A>p4k;LY9aQBbXB*tM{sZlUc?
z5IEnQSx8q#>fEI@g7nKtgwZxdZA(37#qgj*kQ#$&bZ3ooM#DXO^~Tbg&OWZ#y5Qkk
z>eQ?r>+GSn*TTaEyW;V{VJ9^50Y&DYAS`T&KUDUE5ov3hU&awt&OC;dHaB*THa$^v
zpS)bB#NF#p0j<4^FXmAy+0;K*m&lu{_7*&E4ZUsmU3G+?*P<&1a2)MYK{Mq;yx>$L
z8Xs1%N<$D@)j)6RC~1}OFy9-Q=f7<cml<bwxXA4}WLSIhWHIltpuVFL9#_D|6gHf8
zN(qo&Y5RQTG-i*imdV(7mcjoJnf2K5?K-eKWr<2k0Pxzm9S$9-IuhlZO=<Rfhs-ye
zNR`=$lGrXSCN=Sy=BbUfse-{2I`hL4v~ZI2<>Ac84{GptClx^b{?^{}gIil#73%$C
z!22%icD-fX_QWzSSk*RPjXU{jyf3B0XJu!tM|ENfzqCIX83ebvP}J2wF-(qR*gYcE
zQbv!Nl>mz&s5Mjje&^Rzm(yZ6-qeGN!sqJsMnCJeOTOL(5U7wiQ7F6Z?YAv3py#-p
zaLtK3uk*dBp4$=FkNWGdJ)Qmf#r<G+OCg-=GkW%9u3Eqk!t#u&hv7vFH=fQ!0phJe
z@Pqt~5i<5wuH!Y7Tg{`x&w|mNh^Db3Q?BFZ2Y7O8=-FCp^Y-b`kEe0&KpYLu|2Z0*
z=h${+-d_G&GFLfLL6I9TbXVX%Z;8)JFr@X;p<r9{TC{0QuOFY{R`TsZ)jqjyS{zFn
z+ItD5+wf;lWkXbypj5eXM7Q%?d-Qb%7R&HIv<JMJDJ^0+>l-c>6k1JpF}lOr%>r;g
z{*f&C-r7h=Zuq!c(&WPqQmXtVR`Yv2$7NSopLl2Lt$$X{rZ}q~v($_*%;BT0Rbe_<
z6zuj|z4(-W$xlhGhFJxJS{i5ddt9}UGLsnxe;O}WvAtW%(%$UWNFKhEiu<|F2iwb1
z<|^8PHK-se%i{NMf5-Aqa%$~j4ln@8C`GQl4bo>dk~dgV&?OOE``6(p^0nmMd~g9k
z#8;X>Rl#53h=g{Hj3$)rDA|R~W8Tqa%x-HqP_a}^^w~HGWC}Nk9@Isn6nxOyaYLz7
zTK<ALeFBeURmJw6q9houEH)=ePxDt9nppHuH>RqDV*QVtq-=dXS;h7l_;NeIqE>N|
zTk03sZOfSf8^1|;Gg)H45_8nnhdfx%e6mw=w{kInMY-DK`l~55Mc-LemE&u##WB?(
zdf#pMrdy4Ak#Fv?NVP~kESH$xZdi3p9D#@YgK22O8u;k}WU@gQGfq1^NZ*qrbQ?)9
zZ|uZy<)AfgnGgb2j!-I&C-DH4qZt+4ps0Ie`Vi<%RQPzVTGDl?Sieq{`yq1&Y$dE!
zwBJtg9=sem)1^md<91zjoSmOlxMv9WJH_@CX_AJrOCEs|tkWQBWjLW0nBA9w67#sK
zVmk~bpQgtFI+yA3g7;I1Qa4{lY`E1uTeBSFr%OIzyVHJAGIj%_0cwFf!Msn@zw~&A
zreOIJ;Y+CW(0VG8&*fClRL*YYgWq|D`HQAT6Lqo7yi1BoK5%R=ZO(NcaHjegbM_rM
zH;UG!uRgYzXbisZjVqkVJmWm$HBYC4H}O_6<k)B9gU8-a%M0swHO~_lc<dF>M3!az
zASybui0{7HZ#x~}k75A#ZXQ^EhY3jE-D#q2JulH=;&zKa%^JJ!ba(y|zcL^peSvpW
z>d{kHKo@VueCTXKucH0g=Za>~p09MhAbqP~j?b&Wd4(kCCw^3%twox+wSi|N+`)S}
zo_$`5IJH6j4h}wTL<6<%>pmJra-^C%AD(rh9Fm;GEWm;^EV)S(|3*+|O^Ush@F|VB
ze=4P7cEYDtzmn$A{!RN0Z<u~0=mhm+2A!aHwO2&CrnYC`mmI#G=&333t`;&?@bs|I
zYOu^^lS^$KV+eKxIx8Wz+}=u<KtsmP%3B-!5#i21mvNdw!ksNJb=Tep7nD`ospE@9
zRX|`%Vpe(F0i&6PO$G0~AJJn3y8#K*TLdU>2Pn*yZUxmpiH_|0-8lnZ)6wb?+BY`%
zN<&Z@Uh6sNr$@&9NUR$;+6&or94x!`<i%WbC()ae$V$sO1{j?4u=ON1-?btB2Rn%W
zp}};2rfhJ*VF>g;)N?I4F*ch1=YLqbAU;kz2;oM7({(Nb!651^xYB%Gxy;j|((GDO
zrG|&Yq^89!#9B<3A&|R4+-)4?-1bDCuh>KoW%iIzXRTI=!3gD%V<H;C`#8VVO?~{A
z0RkER9p;e&*^A#fd&dffI3Gsqis8s#vwcH@wVm|f^h1Onj%*Kgl?4RRfV2dy{xnt}
zWyw>D>+J&RU3;ojN9)&4so#D0iJ@?d-@CtjALvH=F#t{*iqfK>Xp*NgwGyd)CFUSZ
z4yB9_k+Y*oWfEyu6{lrfzMe*t#~*Ckac}}Xs(h&skE+AP-;RO7wSpzu!%IcnW9F3R
zjNV0_TERi>HwO_V!uIfh^o^I)HPjD{@&~SDVwjLmZC{DLx|Y#+q6l(A&B|Ok=ldt-
z?AXI*Od9N@M5ex*3c)GD-2XUjj%C@aeBuDNn&L+E?V%6qK&exG-vS5f+9D9D7PJ{c
zO+##kin0}1YP0Y;ecOgmKcP#skrao<SbsrH+gHl|A{JuCbr}Kn_d&DI6_-R-zwG{g
zRc<jJoT?LIQ|Bn>4Pp~T8)|TuWEd}&(6+6_)Mkrmb~$hmZ<b?O;okB*?o!&9-?t3w
zy_KXiXP=9~(s;HP|Ae>-Hazh93q$9n6pu1vh4f*uy0XST@#t{{gh^tq&`Z1RFPwj5
z@wN-Y9j_!lQUoHa`9(CyDcpNF@+mVvnVMA#E+bG=r);pA#11it;=#U|-Xho#G>ON`
z5*Sb7F)CL-_-m~4`?oNPc8@QI1Szr1#nvYR5^^mZrPii3ZehbQ?23OWA5g&P_WJ}1
z9`SeMjir<P0zU{{m8!}q;kA&yzWFEG%2Rz#wX@A$F;@@JY{(xHJ@#~uqIqNE-1lvy
zV4!1A#@tth8|%p)xam~(2(Q4p3an7LGJ=kS>E9r+QL3LDVg;RncA(?nz^r6ZUAZ3O
zpxQiBZ5*y3wqZ=LA2D16i&_b;lc19|TnzWOUB#^vVi~WcqOd2f&)oWb>w>1b$`QEe
z)fx{xZ18;9okLwhN59AomtxxaN1_?+L!U=7B>k6#WX2II8^%K($*bm7oIV*VPmo|h
zj4{O+=M?`Dr)NO3$KW;pl~8FQC+{bvyl;T2W?W?w=Z52aV4f(kYB<MDn8bG}zFH(M
zDlSb_ZzfaLw=;#o2COeqBHOW5DMWSSaNELwD>FIv0haxX*DNUsa{5rtT?a+Ql)ArJ
zwNsLqxm7p1<Tu+cXZl=Kz7x*a`JwCb;6AeSu`skr{})tTii$C$I@&6E-k=H0zIwAc
zcjd|ozJIWWg8wKCnZR-dRe|Ng>YHSg2MrogV7a<15I5Da`z|hJXM)aa1=5??fj)7h
zxeWI5ah~qCQx`||$?Sc8i)?-NBX0ro6@pO1$1j|H3Gd+<+fv|vR-_t6wfY?q>j?C{
z-D@$7sxXMc+icEZ{n$5r`RY2KiHThiwgNZKk_X$`4PBkGxh6$>d%gEHeA3}V_x{S;
zVjS|bj9Sn3R%rR;>tG#%Vr_5~6X4f%gtp!U1svP=*4_JH-yvhvp~-g31sud|gD&=-
zImt20DA(+|-f{T_-Vu;J>q$;cG3zcf&L14G&d?P~VfaoQ{q0zUJLGzGjB!$w2OPGG
zt&J)-c>Gl#GSkkR5>ASFbte=xMfy+(P<eZ@+0ygZV@TD_8v;9+FfV{zL~}LLGB|LR
z`ZQI*#?m^Ln0Z_5Z=@Vs3SGmgtT1zxq1U8OfnovU9<2YGXw%kAaHdEU+m9X_M5|Hv
zbX<Nu2O^kx1&+&9*qN}Nu(5vg&KK3D*^ZY};1EVd?vRCQ+x|I8Kb}~$?icdd%6&4&
zpn2%d)A{^?c*_rRMFNj_;2n9Q;dNbH&9lS`-jUC!w~I0-8h(DIL65%8x}TOE406}3
zV_+cHia(eS&(iC!8wk@bgg#w<k=ZEho41nDZu_pyZlzjrPU?DqQ?YXHbe06!Ec)AT
z1AoQzZzx#qa=O^Y0pDWCcBjv8jm-4-0uL1l4t_3F<BhWdznI})d|~c1)EQB?ITKEQ
zE4A5mVz)IT4bCl7Y(w6;gbK(z*ETuC5599g;2|0`r(ac9ZUf&r-drC>d*TE5TjXtB
z=Z1Rl?pPWE^V1lX4hb7HNSB&xDi6E5E=YWuHqRGh%Hk&590rORGaoVt1Lh8It;Eli
zt=a%Hxm&NOq)Nx;>$g3u6mE7oT5(722MPh(p)%4^(Ijt^Q@g$K-!y8X6INK4-*veQ
z8)YwPVcG^xD!u!9tuk$wd*jy}EXd=24DKOcvCkJNK4i(H`czS;NHF+oom6MNKL)|d
z0?w-8YULQiqAP0xw;84PGD}R`EKanmf1?vX+#=+UunCXa`23M3jCt27S+YI=ZJyKM
z^tXSjUgt$?JyPY|BE>wU5(bb;__t2}5=^Xx_693aY2LA-9?%L_LdL+pcKPG-o^Gz9
zwfw2NMS89~_+Q0Z=<X|V`aaj4VGerlKwXZn9W%s^u-IPMPD+Nb+cc{@uoJjgSeiJ#
ztta0}oP4mFSl-4}*}XtI`H;lz_4xn!*AxTM$&x&MwrFmK{I0x%0>RI$#D^G7ax;=;
zg9E|pipjMvly&+8;z0}7YtDCBcjH))1~{yB?)vD8LvgS$cH}6%qp#94xO)>(;lo(>
z%AH|EJ5N_1@Mk=`cjh1XFRiVD9ug$84q(-M(cZ6w+aAvxtB5H5aAW3`$*<if==zuw
zufj!p<lpq}21?13eD4T)=qKGJx;S8v{oqVYVQwK^!m;Q+U1Nr#%juqx&Ei4Nk>!ah
zY^o)sZOEYYiTSGEE+<O7$LH3$<1@Jx5`F0-{e12`uw>eZ>Z3!!(g+vD|Bo4)Dh7$z
z+k+<;zxwT^%>go}O2Y@i-Wo#J{`A<p<^ja^f2PI2Q^pfR9PQU-RY~`!Ub)fuU`_gr
z=KIcJV})tj|7Lp@=lcnr`LZT>!{8s`yaQio!953o7M0+&oYM(j%c1bH6@=imj0RrI
zz<7>WpmsPscrRB-2C}ZCPou%&M^x@mIDi-eGX>l!r;N$RMsc?IP1MquDLHPplKdLq
zezC;<dwmgv4^*Hc99<)DZ+#<_v1eOzGw4tw%sv=pa-nlbum4*deV|KvRGOUx)k2Ri
z{i)ik5ygjc6DQ77B}3tJQ?Sh&&;`O1&=y(jdw@`ib}akM{>OgEay7>QhHW19nAqm~
z4P+*4K?6i@7W(^%xq}PiZ6JC(=KN#NXsLgHU&yggZ-SuAJFh|CnbzF~az_LG5J8OO
zt~Lpn$2Q8NcyDKy6NAxx#0(#$oi^JY_mui-2w$v4y*#|eI2?T9a0OO#+FkQR?gdw1
zzMnxiNA@}F4kuY^cW0u2#&8qPjd0)vPh0<l(78uM*eJQiGUe)BDn~X2Q&j!;(<;C~
zL$D#8*(C3yc2623Bdm0b(T9cj3hA_4g{^_w#VBmh1oNtoa~3VclZ_<+<tv7)A4A2s
z5{g#2_D=uYWe1bG8K?@*6Sm3CfzhTv5E^fBnXCPNP+#N^h7-V}+wqeKGR?D**u6m~
zv%^G(AXz?5h?Cb~pQZqG@^*r?AmMUwU|cr<YoW#0;POkE_md|5-!#rH2#+=l5sXdZ
z=z7<U$Y>a}W~T~k@g#0@6^^42f{&aLN2J~$$K4GCgXp{S&EgWy3AwEZqfhT!wqb|N
zVMSaAvDS`m3LUSuA7@s-O7cp~KmSR2*KQ+67{>mdLg9&(F4ezule{@KjRlpohWM<X
zB`TwmjLOvPH$|x#55r&u4*T^dhv!<F6M7t*FA<+DWIL2uF=5j<PV(cVUaaMHR=-k^
zdmFz2lr+c)C<D-pXTK$&UdcVPk2??L?kaVn?^)oCUs?o?*MO&1bPNI}g=8y&!Bgu6
zp4yyZ|151JA;_T(&SE@iJb)KLfzxungTVJE5Wb%)-+9`snVX)e+*v%I9d)5zY3$5b
zhNw=BFY-hPj%qLMFBA*wz`NW$0R7icnQ#wnFBU!R-~7LN#HoI4HBhX@H_|(^RxO4h
z^i5L9hT?O<N~(b3a7jh{`t<Rb-_3*;w4hft*)vfi`OAK)3S&^L^tiIz;n9|UHD`3_
zZ}67#y?|M;mDEVwrhO)Lw%J%V0w%>P9bfWa8yR4VKbo-FBqDnLAYR=L0GzU$lE@3H
zO{<&Rvs@8E2YT8$Pf>D|r1^UF|H9Duy}PRl_8Pcy@0wLW{sip$$0Rg}o_jDde>(TB
z35FkFs$jo8Mf9iVV7FOH7$751UZX$>vskkIrIt?{`S49L)G3>eD?1<l^5VKp?bCVs
zo@ZCXaN;g}v|(1n4wFPDAK)QK%hM%j5J%e)iF9@`+rmdiU}GA?E5;tnE6on!eZ5Q|
z@58OR64x-br8fho$&H928WVAAo}Q|ad&{gO)OZWN(l4jI8v&2pce4;dg(RvGoIozd
zh^Zq-07DU>&d23`hAu0Tw00^Uo$hXNCymZ?NJtlMrg+$4L=Sj1d2BQzEUZY=E#gB*
ziioari&*@N3@bPlVz{j!jTuOA5W~mD8iqmlqeGqGdf{&$%8K%hxgvM0rhy`@-oF}E
zXSJJ02@N<m24cTY82HDIA~J3fMbk6$+Kj7FDu38e>2VT0dkrN`P!{MU_#)ND@Gw5m
zc})(K$bN$=T?_-}e*Y8y$(8B(^KxS=K7e92?lH6A+%yO;Kds;k&31Ehw!&2Ex2k*(
zyiUm9yM2NPKCAUFj}>?72U8Xbp3Q=at}1Uy<AnkJ?;Bcmxr^AU#3iRe59P{c5Q&<C
zNYoU9L=zxLRH<)r2t=Z}5F|QiLBFZ4+;;(h$h}*--Nsvm_lG9ESahAMl{B`7g?0e7
zTUVkT?mrB#g`!k}bCga6qieJQ<?mt*0h%<pIaZ3ImRw)tLf;&HZipBD7=s=gxy^6E
z`Yt@Mjxt=$Gd4k;doU)bTPXx>hdNwnIlV8OAsBVmm0d`6l_?O%J8(YPO~BE}a^w}*
zkz@a?VB%X4Dr_`Vg{MObC(&@_hEZPT_cppjQt{M5(f_lF0S3LjVJJ<+!@&5I>=(Ls
zJ@|Nuj>M_*NDh^V{BJaz!H^Mb%@N8o4YX`AEU-!v&N8hA%&C>as95RMN~)>)2wpe$
zs=VE*3cc(V?**!N6J`@!C0r5@lPCel0g;d%Ti$RS^3#l&#(Czl^d3`R(mBbEBt&CZ
zYz>``1!<joy!63^?+xJRE}WCvj`;HuC?4bKaJTuGD{_)(F!gy6-~68BF`fsrQb(0Z
z=GghliAa*?%Y*x&a*~~6%9qwOMYU#i{4&{vfz9L;l?TG|YnNKpRd$J8FCY*c_hQKO
z-WI(Jsf<yW=gf&0@)maP&_=3K@h~NNTO7{JjG4HLbWS(8p}_YeFgR#?*f#H<!bs(=
zO5|weVTH-Y?Hd$f*BbuHafyT&qOT#|ZM<~MTub5T)V=xZ=uato!IRLMM_vdTU*oCX
zPA5GXD=sGG*U5JdHrF6c&jSA_tRUE`1j6ic>;7YQVz%G`nKn~gRL`pevDGgnZMdPQ
zrnq|X(%Fob-{U+ID_|OnuFOhPNQ>GgjpDFK*URRt@%v9WO*q>BdKdewms_qg%e}!C
z)tQ$4__AM%ddczXk6btl`b7>T)b4=6gsM*ulzh1$JjDi@3ttFptdMOowKnXmm|Erb
zs_BVNUdCO+V#(O)_HehgC&X|ft1`0k=F?6fE-cBjm=OAU#GK%zlYl!+OBk^bC37bi
zI&FB5lRyNW3YgK`fGCvc8$G>BCS^o+vK9FXQQlu~W)jPZqHe~$@!{qoBTl)mbLh{A
zV-_iXiUN%9cZrn#PD<?8=2HuOK#h}oVgKkf6mC*)AT_xR8+T;)T^e%nQ9&e}Fq3_}
zUxN#n1K>%B<ND~t7;XZY8yI~VJc&98Aw>a~<sCJESAZM1BiNq7?TGM56UnXR-E1hK
z6mQCh*dxY=vyXzY3swkEbydc!_E^P-S-^uR;n6%Xm?I*9Z{=M(uf%7~Xf0N}H(6og
zFCW-JdK!))jvT$yv0_`X5cZe6<(%7-YLwZzr1rZD8w(ZQ9iOyEQSc{WXObJH(~VEt
z0b@-mVXR>i*+C5-74_hz4<s5t27A60)3A~2xRL)8G5^<`BPzt^TDA7U(Z4b>g%{{!
z*%oiUCHYR?MZvWmfOR!`RyIxET~n7~evO>e)cWPDYz5v^9TaodzCy%Y^F%%5(lWHM
zh@tK?Ch)Nz=82$~J5(dX+IZMkgA7(6s}`)l7`S%?U>G|f&bnsyOmcuLzqj{VH2IZX
zp8<*S_=)=O0PUfcM*DLsz#DZ~8ztLb@m{X)o0*}!%R3IN_pXR90v$!4^^|5_;^aLA
za($?#f`Ko^P3h~Ua=1^-`-d!V9BzmEW1s@H_K+<-i+C#%4FE6j*QRCZE_muSq{OEp
zcO^4P$<jnd6e7zg@XbjSYx(x5lpy@Ti;K;Vm_eWw_JRf0|C)^fC%jY<%v>P`b3IA9
ztU=P9hvk&fr6M6*cKnt{1UBLi=@ik=Xg~TO@)r?A{<36h<pSle$+w{V6%9T{V+oPJ
z<cK2cL|u(zg2l`Dopr!*3w|?jawLHt9o4yP=YS<$@)JMFi_9Jl6Ula2H_W@Yjf^Ne
zh4s-C2!Q9Ipf1A<?=Z#R6@$uW#0%H%oP(h@FT5>^G)ykjB@MohQp^gtFlwDQ32(H;
zoaF`43WF*TL_RCD1mM3>jT1z$7=0P{jcd*Jd9T-)LpBk%nb;#9@p)%CVaBtNW94zm
z5(-O96C^D$d-t%*(<*fAd!LxF)cpNF?3t+P838P7)s4*FV)-i6s!0#wIII=(>J%yK
z=+uwUoeJwH9O*@a<_%L0sj_Jdb3yezC<{bl3v&K-MqL9Pt(|utf)UUX9Tol8Vh6iv
z?U?vU;aGbj<GPR!voceq891;nJUX&M38EQZ#L4*1$@fZfVGD~9j>XV0ziP4}niqf7
zfd;si?v<!f8Gq2Rj<j*l>|`qnNbK8%(;2;HQDMOAzk6QER{D=v2B!3Am*9k??W6wr
z%Iu|ruw!UDVX3Fk@2s#rE2GZO!l_rk$Hvy^wcsOUNQKJj`vyHLqy8D`#uRGT0v@2o
z&vFi!FPZ)b>a^D#wB;!@4qUMk!s{jghKitlE`KNz-pXu|$5!`3pW^j2xx`F;#!n37
zx_^OR6t6qsOTEDJpK|~?|38ygY{B!d7CY3f=n6je<7YB>{(Z@Pw{?A&DZF##tkM60
zN`e0o;f0_M@;?kTlM2-8A^NMm0O)IUb249!H+kkz-brR5vckHQfrWJdRsT4Q(!4wW
zLEt_0=GRK5v2O^a$6^EXr&ZV9ePq;lhrX3_!VA{sa0y6=lA2&z6`Cg`t!nM+zqBe|
zzA^*@;2&lQN%^l0TeTMGBlyZW<Vx9R-`%QG60wlqyVchPB|Jehi?UTsWhG_QA4c{z
zcoAnjjk2=X%JYPw0kcqfT#HO_h?^)wzRKC`YtZHU=OJussvGB)j|6V;p`rhu@y)UH
zc5$PNq<9{MFZ668sB9P$KQ;_cmNn0vbi9rTUVI#I?!;!EXPd(;Cdaoa!Ql0u!r%>?
zg1|U=RuIPVwO*~rnA$pcf%1JZaYkDrAJ7WHaq_@3S(_bwt6~<n)IOvYbcO0k#w@un
z1z)HUFd3X^f%^+qcNtlrL?2P2K1${8*p|4MeEat)L`P)l9`z2)KQ`Z`aq$amW9L||
znw`nh=H?#zCplTETOLwwm;Dg#q&$y5X~Fyu%!U{eEI*M_i2#mhb^kS<0uVlUcT{f-
zw9G`#%@@Bc!E+sPvdkgAukn=<vaTEFcJ9C54+tIMiU_*Ug3#!-0rB^FI|Jfem$|~<
z!5CUPq>2U${1U6T6`yrlRq3(eGmh}?@89C^+??5nGn=sQ{G09-UZ-kXz#TK2CM7;x
zm?jT|sV6}o!?Qt-;qiw7VtK+~AoW3qz+Aq{D<>teJ_cZY5Qs<`68S12?G2K<F5Az`
zclx<d)}ybWxUmj^r%P|}H3seV5&ucyXmUC==xp$Lc5{S$_xG*~oa*ZPz*n!p&4u-L
z)I{DZd*Z#-pB4(PX82V&86(<T5}&T^-t#oq({H)O0X0jiRQv3=`gli{ZXrZVDn@pc
z=^h(oA}%_Dp#C6ji>ZGQE9Rpea~Fd$``n){>eEmB(Fat{pw1z}S&xR-=aOokFi<!P
zyhGhsl<9#8XNc#_|G;+18Qx&UPLMrF<hwv*6kiy0+Jo6<|LHCP<;WSqSzb!DI=LP|
zdjNwAT${*#vL-?Mwsw9N64Ni*AzrB$UZKnG+r}6mt8BJFb@ziOi0p_dImGGDHQvy|
zWV3E?9@Qb&77qA9PC7`(h7?BEJ{}j#bo6gSU*iNP{~%Ml<t%0MZ@a#3F8dALhFkF6
zHrXX>>8}kVQv7!MEH%^2>j8~`@0wYF&e#Zj747`xt7NJ^(;r+h6-%Kegw`E+yAN@A
zr`xHT{e#II9`GrTzW;|uzm-?me^2Yfa;vIYOUQ?(ruvUa7kD)Vi^Ew^&TKN{9-b8W
zM}qvB#g1P`kYU~_!{!Z3mJKEg1V%Lc$DfV%O-n%j+zY}8K!?l0k#XG!B+xPq4KB?p
zynUMVeQBJ15CUzil@)qy8g*W2`_|Ys3M(nX=_XEFaK0n+7ur(lLPx7*UyAZy14n`>
ziR*Qas4Dljk4tv!#!UJ5iOs8WOZPPT%;x9|J#oiXUlDC@@`kzs+6SyVy~UUu@q~l1
zU*28(O%MY7t@${D|87p#k~Ewj1a>#fN!BiGF`J#Y>JZGJGNX2H&!L^u4exwO<cl;L
zn1#Iw);f<{>|%SXC?A#6+?b-J<#nw^|1}(6CW6kXl-}q4r&di?PRac(wwy%DVpT5X
zU?i;=BAPksx`<O4-<gKK6OWjF*i2n+6(MsfXj3;J%28KSWiHsr^heD#pN;)DZZqG9
zxn3gByx}^l38HUJ<NIx}Se1QXv8=hu9Erbfg6KO@b5pinh}$^2*QkuwTBp!9gd5xq
zRFlB%hH72LbT^iIYJ7-NB}swkI8KQn5~aJT+>1)!*(3}fX^r!^TUqlweBS%6W1hDh
zh=q+fVl9#SqsXIytvJ*3M)^-p0ij8Z4kt&@_?f>?KK8{!Vbs6EL7qx*_VEA|9E?Sm
zrbg|$$eXJ=lBi74?VpV`ny;B(waB#wcUKUNJpRDGQqQLqe7DSnHfJQu*A0m#^xSIS
z>AB8?yQt!&wPO8lRBcpaGt8y}L=o-)N%<4<o${qMNL&m5D2SLrC~g6ne#)Jg{AC8t
zspo@GoXcu_Pd#q}gyQd&boE*Vei2hK<C>3PK{{7qVCQPNFzk;trX@|-mA&(kAtsj?
zdAI}{0hR-01{jP|ZyWG$M0<X}saRMGKJ*5?c`;T3rM6Y;Y9EtavR4Qw*?_XWkJ6s+
z%reogk9vHcu()B0AMXWg^V=|s>9ZE<Lc-&8?Nfr9K6Eq=NyYu<cr<UPAJoubTz8g=
zt;g5az*)UtF$#4#0cm4`2M-dw3NK`x^6xe&VG+h`9X1O07+MOQJi`7UWm0`0GHruG
zv#VG1ZeLcWEGLF@6-NjLf_Y83j_?n7(y!Me@!gmz_wYiJVMnN{s<0j^N-}@Iy+4%0
z`j$3E?iq%aSiZ>IvxAwWWwIl&WCzB|VyghCGD}Vg^UU)~F1-HO&BPzWA)h81NZ&g_
z)2p|%nunep{4`;s$t=kvXhQnlGEA*CrNlf;xVj@%>&UhM=R6x^(0{(tywZ?n{><j2
zh5;TXhVeGsAv<PU{iS=Uem)`0ISS>e4yLPMnq6mfU#mn|4W8l#-Fp!O6XLw1$3lLQ
zF6t@D6OEA%Whodm4Lhq$>ECCdmW7p&{JfdxW)=J<C7u;;L2R%^7+cug$1qbPZEau}
z=CI{Q1yGx}!(irl|IxNG=qcKRr}jxv-5mY=X>DDW#%2FuS|1TfiGVvqKy*!YnF6-%
zX?-cxIoqR4QMv86T~2&OTPU2=9|D#v<zJ3wi&To_ZYxR~^MdywjOl=>b1?R{^PNPa
zfO|&BUuO{p+Le#P67!d58=aIV^VwT;xD*_N1c3T5#>U7r&3#c46Kiu0^i;9Xg)98c
zuam2TH<?ynKL5dzjyRy9Bn}nAslZzKo(!ie6`tnB-9v8a>*415h2Mm7^}G3QXKS87
zZdv3JZ^hD<wMG-OZA+6vHU37O@0ywN%@?^PugtVPI)m2IqJ7I33t%OdC@e&vJ5yCa
zZ34K}xQEkg6tnEkWN<5y{Ffm+BX^i@W9>k5m>Jk_&>6`;F)epWT6!67bDuF50HFLH
z!XA%Y3A*Wg%BPEczvb;bDgN%r;fGD^Tc2;QrlAi}O>L9eXG#~Dt4QPYG>W!9kwiV8
zoKe1_3Iu5v<PuDaXVN|aURo_1j?jUUHO+uULE(x`snya*@g8oc>ibt_GkI=5@!$SH
z_x+~}Yp76iFg`<4v{0Uu<Ko{Eot_u12_#Io_!BGFg8&BdN~k#3DxoU3q^1WWC3QN1
ziwsKK1mf_&Y-#$Xv%<<uWfMc_D%R46@8ZSdO7G~2RX@#8(JLQJG)h#abI7(|BLY5f
z49+l%F2dP7*lIX$+B(+WZpAe{Ae0&NYNyr)D5oF<skVZ8S0;9r1(~1khu@`<tFN>q
zkQQ%HHw|<&v#)05mC}^r78Q&Z_wL^SVeHAelwGW|&5fAaqZaA7xIJDLclfu$b7Ay&
z^7j+ctX@5d;qy{toyQ198^MK-z!C}g{zEHPd_%kDafF&)T!U5w!7d*ZBzFrzv@qO%
zaDfD>ciRyC+c5OFIvEs%?s-F9A#<qJ=jVu1&OXsw1lOhJ=RnLOWN_CbN{YQwVnlI>
z(Sn@<B^;`)eZr2vdHrao$F$e?4@%nfcH~Oj=PRaC6&s-ypVt+EtyEqIZp_R#%mVAu
zTBe8U+XuYgY&k5UwC_E_rIy!6_2THF`IvmAS`oLQU}qdNproohI$VFtf8@p>_8(~K
zix>Aa$^M?0ID#VI-&Pvs@;pc|1rG2jhw%{>mCLp?d`tPIHx+gS=Xkae(&St@CM?Nw
zgM>MZpiLriEZ2(zlz3OGA0&%TI_AI94`s_M3CP>L&I@@H<@Y5teOYIP5%CAM_7Z9D
zrW%CotUo7=@VQDenWB)^n;yg~mnsBI(-kUbb7^ygY44SOboPEj!q5C8rsYXdA6Jkj
zWlYGyusbWR8)_wH%|*=eYbv7czdr=O-XW3P;aXD04yPdO0}g*Pv%?SwV4zMuJ^wh=
z;CCsD?+isl6Ba~G_Ie<f2&~V5zeTAFef~1O_5yF|03jls5F!Gfyuw&ghK3e1)IDwh
zKK271BqHj?ovf?zvuG#;GBrDz9w72!%7C;`m;~80?}&}oW#_S#Qyj-Zj~dd&MV<c{
zg*^~g%$WD^jgVqVfMgmE(Y*A9_pGkvr$`)jg7dNAOkM(ETS!e5?=>UhwVA!Js_usY
z#gL?u&fO$9z3fEa?f=ppY46%K{d+zWJr(q*_AM!|ac%0nyY3(V!(40`7@&4-fWu{5
zDVC-V=3QB6fpJ&)mW2dbVBpsj*lgwkM#lgAF0cd#bgV2Fs^NT>`LuFLtVbsxDAxkQ
zp#~?=(WD+jNRHu~osVDzL=!{6v0|Rfc^tPD9u<LM?Sp-pQeoqe(ra|Ep)#F>7RbDA
zZQW<e+UKb>OQfN4>g^&(n*~2%_Qwu28kE-%N<{^060uUx#8G5Pc%`KQNaX365fpTJ
ziIfdjVnjHY7J{X|V3D#gDS!ADg*%1B>hCl<iu!zLx`9<Fv56I=X<Q0{zD4R@xrNm{
za?D`Qcp6n@QKm>8guY3ottMjnylv|AQ)!pAAc(uuf^<PHYTtFwy<fL>=M+?v?*$VH
z9sN(X@|5S(01x}8whN^dWQ94A>uV1B-|ilNp6P8%`!r-n(9ypmTgCDv*!0Wn<ZZS7
z(hkpR>Ge}Y`N&V?X%kUy2htc(@r?lTZS0>ug_S|`<V_Wb64#x?`rz>O5=W>O$`ze~
z3Dp(tpQtH@AUf<IxrCJe?OEzHWcirr)5xgMNCEXfCSaYV1-exd@wUNjf!+FC1xpnm
zWlCQQ`q?15vhe$W-4J7%v<hMG+kaFEs<rF!XE#@z6|+hztre`Yv|ffS!*O#Ho_q9m
zg%-b}VIr}~P7UEfUGQW`YUio{oI&EBLZMlilEPQXG!dT;L3_FR`R*E|+5mRkk6i&k
zC)|RMYosc|&T<-ek<X5i4Rh6|QfJ?$1<w4rMc{lD*nTnShcpdIWm#pw_KN`6eyPmw
zjL{A!g|uIKV^|lSrlZ;L!EC%BM+nsbdxo2ZLFe<BeKLrfGcKP5N0$)wmqy+a6Ygnh
z@pgmC<d4oKtz*p`j2GS)HXuWZBMZ*@EXvo{inVf+)of$)JfPRBF9c?+<fibbt~s#v
zW<swyK91`ff}uY~XBN2gmVg|F>X{<wa$G=g#c%H}P3&xhkNS&RNaP@wUz?!49dk~C
zzY7PJDP!O#D}HWqhE+_U>j+Aw?}KRr489FNgQU4wNfs|Un=y7|JRtYsJ%brV7R6|F
z1wu7INssnMh@D(OL_aHkYIqQ+n4=lh2;}A5xB8@4WoDUZYso*8($;1&$)?FuA>m{6
zrN_)ac@M)FO-sXid^2Eq;heVe=p4Sv2K-KRRD<6MjG-jGI?#QY1iCK`z6P4sV-G>x
zmyxC#%Ve|B)A)eQpPd3Xux`rf5Q<iC)AM~nM*3JNT~a3?-}@*UNwY+RW#ds7iU#~i
z?Y2YX@hvl1<<SSSW)!xkXC{x7$0*nBPQt$ug-n;E+SL8|{P@3JXgfvygTO|gU@K1)
z!yZVdu`)1Tgetw0FMgf!+nx_vzD5iBXoLn!2|)KhM15m$<;@fB#!fc2la0M`PHfw@
zZJpS*t&MGSV>{W{wv(Ipe{a?Oa=y%|`b~9D_dMPGbdMUvZAer9cssGV3w#Tn)<&7r
zFenGCX%1$2?mjjB5TnS9yGkHNJ1Rb9u69{>;Pvr;b*WdHTLU<RydWaoSwLX-GmcS3
zeM=3PWX&MdsGk)deSI*pSOGTO!ijkr7}w+!U1;VnvczT2)l{T!{8JDg5B?kalTQfc
zfw%^Uc%UE4Mf_K40+O^<NA9~Uh$aos*bRilRkM$y+K-%Cbv~@4IuNeYJck>$i!x|<
z>z7|{S6ogE$X*`(RdzNC`N!%%pIrT)Pi{}q4gHq2%eSoM)r53f659XAbk$K?xmrYM
z#ei)%>~;AT^>#+ek%AYtJ-`xo8>oqGKa{dk=mdSqY4{IqDfT<VH+U4QG-kkjV2;$)
z;WOXLTAb9!%uo_}ifU?abw&BOv#GnGDfxzbWt+L!zvL7;dC{;+3j;`$CFOJ2-3(?8
zzZr^segS>MDj+wCO@xxa8~$!os}G`R7daL)WSUNSA<0!(4lRna<nshy0W#3iNLSEu
z1@7OVO=1L4>#k}@9H2($pEhxbY@&M1WKp7IY|>muQaK^C>YM%O2_Hdfa!q&<e!=5T
zLWS9SC)va^2u1yEl=XTaeq3%@&{y=CX3n@SGdY;bYWCv2@b3rf_^WeOWCk7b@aaNj
zt6!5s!|gcLcNNO?JF>Af1(vO{DK=nEFjUAlsL`!k4NpXfXxN!HORmGSd~;dMs94Uh
zOjTi60zXQdEg;w+SrqMC9&G77gL*vlmqx!aMFdu5<s|uS;nX7-OaALz*%AFs_9QmM
zq9RM^b6tR(LPDXyt09;mV90Upmr{>k>&Yr+ZG+QG6DqV!3Ibawa7^HU`LKkkUi~9M
zG(<yM)|a80NZiT&7VAAkb~asG4Wb7eBIs9+1^2KrJzw`s&K+S?J9Kke>4FQY5{=V%
z5{EMq;ta%U!x2kpfFp4(Oc*2~|K$iCohPV3e?78{Ns8cpeig1K8R;R_w)m!lgw}*&
z6Rk~0#wcJh4z|w>$c@MghWnS#Ri%G(`uMl|pWx4x<l&gz<?Sk*hFMwMl-FCSanT)e
zhdR1LN6hU31+GIFO=^1PKGnY3xyE}0noUR5HL4Xh7q&i0Zd~Ky|E{Ox|H2<tO;7S~
z+Hd85v|q{Zze%e8kM>KWV>6=4uCGZsodGugeLVsFEdFD=`&%skn74zI_CdPxxgI`l
z#?{96xtnRsY+0C3W>PoAHTPWjSoSMf6PI_BN8n)HUhtb&+(v^$x*HZbR*s?~I$tAy
zLLpKyL`v4ZU8v0ZBtM}>*vIkBT>ZPPvd89h7*Fx~)$nAy?m()MvR$KIu1a<y&5rUE
zNdm+Iz=}{R(iF!jDl1PZ%S(;_VBwez0L%H2g~meRxkz{~w5-K9F`+kc=PmisJ3%qQ
zWeVB*18O6?=<b)mCOQ@8xi6r3n)j$Sl2x{Wum*%3vnPZ=W7wy+Vi?e0aRy}sb$z-9
zdx@yKsd<<p5_@gw#UtwO5~M~**4h5?;t0&VK7DQ3GzwH-jyWL>RkxdIK{mX=mUAK<
zw2b+AW+PbnZYug_7cH@ju(fPEX@fZGeHxMUv>MisQT;-`UHO0zRW#5IWi}76_U+;m
z=FG0tG=7?suF+1DRLCx92{}ErAMamFM-#gC$8dG8RcnH`Q)^-Erbuu)uGZ<t3<sXM
z&<7wd;2P~5>#>!YRU@BGzWsQZ@B)8WLK;To?`lHdz%OfQ@}r0(5a@bzkIMT8eF_kl
zw|l!gc>G>P3LgnMuEL)Yi#guRvm-57X31F+6`saH?&21?7p0uWNw{AqR+m^IHJNMb
z2B)m4*TjNJEG&L8x9GN#x{Igx03x&(am0z%?_(Khv%puL=<!rrR(WV^Jo#5>K800O
z6Gq{0ms`=aa%;O-S!iJZcFXZOv26Fz(W1X#6CO^XKmT!;j}MWIkAH3!X3<X$d*mEM
zO4HuT&?N?cG2D3qgI2wXl&~8*Rc86y$z=JO+=&We23+w0U00tAFZmDCK%_}N-zxzI
z8oX=aT}e65Ie2+-OIk_aE5mGNw+G*oNmxQc#_Inx_11i>2dUzC5ytDN{{ZQO>%W+D
z)5s25@d#b{53%-@Ku|Oa#8x#$pKkRJjod#?(iqG3N75mMgMcj`Y2526m>6U^$pj(r
zL(ot5NXoX2ns<O~H$VnhVa!+Dm`yoJ|L74xOj5inaI5|YrYvBx^s2nyj;U-)bf)Q|
z#3@l}n%FE)9$k22I5^Lo4=SuW{5YC2@-MT$-tX(A)hK}^Gba<ju}XsL0%N!$rQ#93
zdPPWBOt8E7n$%c^e-W=V&15xRn#DP6$y5SvWA2}S3oqqSC{n|K6EFN`3U-b7`2k8F
z6J|&CcSiTw$$W)kqfjxst5#$lZ@lt6Zv+aR4}o=HXm&ObZlSw2bZ4UlVrVr00@4Wf
z0(T^oq4iJiRjLT~>k@bCu+6nuul=x1gjY5aSHRwhweWcsa$N`hAbo3)TiJeNr|E$P
z<n!iwLo3JIDMBVNn|M@KCpuXeP*1FL6rbn5Uj4Q1|1g}#Z8Vd;4&Sa6R(V8Q>Y!eL
zRsS=h{<pCkfnO+l)jvH$FZAOmH1k-yIsoE$j?tqB2-Q%t)y~l7M50hUG~}^kU%j~=
ze;;fL9;OB4CEM7zPmU|I^*&;5Pm=f%Zb7;b&_Ku7gC`QGl#mBOI6^5anX+6#F6B{>
z1yUF^YZ)G`e?FFr9ObjEU)gXNf4BjKb+$o@)#1zN`eV4dYWuQxrAowA;~sjrdBh0Z
zNR07OAfRqNmw_GBsOIgrxApP)+K%`B@%gtD3L3tpU@L64iJaXf<@{(YaHt31I75{1
zJT<H&I|m|Xxok2(W*v+J2Te!(j$;{!UP=2*4MJV=G`dgNh#Gh%U3+QC@P|!y&X!@v
zF&M*0sXKg&T-F^tY4OCAANz3IJFE!IE`9RqF98Mh|M{D;^Z)!!@}{P0sz_{^^|!xK
zb`>@uB%|*5KE>l@)>oO=b^i5MVt4U@_3Xgob?C9jsL~eXqz6&?$0dG^;3}XZ=r6w>
zPo5>*gqsBy_0c6#f-}!p)L0#jmkuaHx1Voj-1B$TOkx+Ot-KDJORfi#rK;a!$>H-r
z3SC$uu_~K9+)*ItmDXLN;J-8-yt#&eB4wI)a`sX3F?hp^3Iv={NO*L2OX8FNeDZ)M
z{{RIh|83iR^}lV?t!pMEh{T#}d~dtaT6mm*OtbmprCzGhx^VDwMZdmj;Q6mXJ?_0t
z(5UC|{1$ZL3#oK7YT7yas9A5QhfD%TRD%gIz7`L~9Yna<F0E${ZDhiMo?E9iP`q0y
zwV<;@v}nTlBQ!Qi$K>V;gSG>Rf@`a#nkKm52~1(>-=xAo{fs_J(eaR&eG<2l^!@IL
zt#eB0oJ`>86b6PVH3DCQw50h%Biy^CpR=-f(+lP)C}_PKD1UO8!`Dxj$|=iVGMp!P
zHBRg#=#Y11^Y+P$PWtRsd5T(0MHtqTCx5TjXDg;4ed3Y_umNNi4S+Qjfn>@>Cw77q
zg*Y%;qcpz0@n%lgiyetF*za!pp!iNmDTHvU<@3xUM1P!5N$*7ZWmDb<sTQJcTd3+g
zJah*=6ml3LK}L@p)}qwdcWCB{ltx_U$l&O?&xF%8X7878%$%dda}vj6MN(1;C6F&M
zE8knC_h^$_Bho%&d4S1l2j8Db`SHFb`~ue{J<5alJv)*y{aWP5jWIkyeP_m+>x^TY
zgb3;EIN=j7UP~r|!gxic7hz0APyh6!=E|G>#yc2q)1Jnq&v*MXU(rt=fttPP@AWf~
z9gmlZe9KcJCo6hlgj_0crP`;R)*QBHP$eawvXYaV?T#U4V5~UhX6Ub5@$6+WOLPoz
z4g`dXLYD|ZCY`A2>W)8gzv`3nc{;Wyv=vjx-h=4>a%L8ofIy)xl-{~awRVYRJ|**!
z>c02h7y>8nW_yr2S9-)c-9Plte=z83^=<A9Y4uPT&ywnH5X2%g5ZvrSg=5+QyR|VH
zx-Y*6Y6}co0mW|Pg@)O`tpK|wrnJ;1APQg;6y*kr{S{}tLm@g_bETVqB!TC<J2JUd
z|E`pP{HhW-NK;XZa;h0Ar>jmXZtYoR^=J?<c$WGG7EO3>m2=%}i^*r6Ryhh6Pg;u;
zeFPxA!*Pu+{IHZ4*8NN-^|mXZL|oMuyh$%bbDWR|3VtS+dgajVlF>jZja`+>+2W8K
zM~0oD{w4PoBni<SIw=jPIh3zF<Z?xVy*)>jLY}0b8|!^3z)^jMn*Q;V05z~>n!=cR
zNq}`yX~7S^#7Iqv72Ch<TP%!Ewf>yG*+|eQIj%^(+FL#zYP}mFeXX2~E!_d!V291A
zJI1p>QpV+P*`(q6w}nDa=<Im6(KEJuXzj!cIGl}KItV$ipR7X<Jw%muBS*}OQQA_-
zZ+P`3S=|5V>GmS;19EtG+tSJsChRRNQe2fGN3wJ+Rq{#G+75Vb(P6bfge(coD?i&F
zBmEF@sqzM{?-fVb&v_9h=`Zz>zp_Gch?oFj*upj%G04`)+GPE0syDvneZ%G6#~K)&
zItjE}d|1yZiv}L$zFFp0FFmU>){)WsQMeA5@9dpXka_sRj0X^DzLkwiz$Rn`_01jd
z=yMJZq~vK#nbzsoNL1r6C`ZwAD1v+9!XqOWgFv)|%oWgzMFp9Wk~H6%2@eu*kN`_+
z;*%fV_y_O3ga`kFJU{FHgFGb7O=RSe1ju#YkSA;<EDRtnZ2b*++QU}R$sR`_!>jPW
z#|wr32YJYrSaOC%#V4?c>#_w5Q9PmK3agxs&V~n~h^b_CJa0pAZW!lT2%req8du!l
zLh$j4J(8!@svRZZKpD#*g@DbFg3nx^+61;k8fSg$kWo47X}Aojg(~c!>lyXRMK&D?
zB~=@-NUUcQJ|3cy5HP3`^#y3YpWuqF#pwB(uFa_f<{O+LQ$z=!q{0(XtObn@gkk9p
zv0<yPeJdb_&CLNFLKDp?P2Wafxb&@PCS2qOsPHr!VD|<%)4FI05NK_`x)$%XZ@>C|
zSM{3!_AG3J#wU>J*JaY8BK|~d<sPg$y0Wb~BGUD1hA1uTl5@xAGx6N*?3q}py$R{Z
zcG0^360LZ2fKC6!VXXF}lT4`M(v)FUdZ?v0JyY<P)+qGIaAAy~LY4`p2yQP52O7PI
z8eAg-Bvvm4qCVX%kk&YgIRaxl55ZTBmXbj{M=)=rLQ^KDvgZ2)pPl&|sUPCJEOjEm
zk9Uf}Tm5I)1DfB4ZJ@3-&R2hoJYX3+5@ryMwG=p5+svm|jXz_k#ram}uWl8386T+r
zpIsY%AKoV9!Fti3R%S#gjn<x-X2}rKFhB%7-_0Thpp|%-(sE8`p6Ji<`^pgzLxk$b
z%{S6SNV^do!6`2Ov-SBTC~yv$CzD44C?k>y;q`%)#*YD{)GH0iIYr@;A9lKQs%oJ#
zDkId-@yTSed6T7bI1m}i<*Y9G?3~YX^Tdk%8Ln(GGdbiEt{@sU|KK&+Xh9_E$}ECr
zZ3it+fXt7B4RK#rHIdGFBw^&g-eBh^>dH%S64eGaT|Y7?80IOpxMR;WZ>@6RfA5U6
zQtqLNJMg1KD(x&*Sp=~vAd5XmL)+Jp%->{`sHDe28=)CN&@byJN=~g8tQPTmaL0~I
zHP-wH2PK?HF-e=$=zFnmWDS52z6eu77BC192l_)(tHUgnnMKWz$zo?TFvkuAC{cqr
z)2jFPqvT1Yj9}vnjC`x&__<d=%xcnWupMb;wq0z-;XhS4Yk#Z4KSpc3;#(EY*0Ced
zTrqijf#CQpe0sK^T(%GNp4NGLYx!RLd3)cdD<J0kblHL9Um!bgz<lSe$S}#wfbYdm
zMh9$V{8#?Oci#l2$2j;>dVmLCbXwubDiWcScFPK(IdqT=v8&e}p|j8qXx1Vwbn3uw
zpFbV54p-zH)yL8Rg&GZylv&X1ctN59##H940Z!9g%o*&L2Jy(4*?@hBH)x7}-<G^l
zgC>Hps7z;5WN;q{Hf<%Z4jv8>pgY>8Qrx_%kc6|q!kL)Owu8}Pdrul8;)Qs*6DLH|
zcsr<J(V;^v_)5)$e$B2QS`@YJg(OB!u|~qA{=``?5-C^fw=01n<lr)|@!(i_@<&{I
z3Pb!aZpjP$FK%(Rw;EN%02BmX++fZ2A>(_;9dAD#jl0bD+2}FGA^`EUxgBHi@Hz#y
zMD1(Mc(S9n^H>4`xj~?;CiI1&*#E!PnKtFzUC;J4Rrmx!5n}TErD%Xdyd`W2g!Gtm
z>CMwz+UyUIoYbSFY%O!$4TEhK%K*zIs>RTPZ{+1#_bQrt%wlDLJmQrXI3iH!`wz@3
z+y4jVfv~o83S$Lg%C+BUo|>Z|00{+s<MaC#pl*E_Kd9>q_|K3A0{$~3xNn%)fsElS
zrfyGByREmCe}s+C8JM}OPdD&KswN>@OnJtMke9mEwvJC;{-@$QAT<vctD!ule!T%2
zIGL#Cm>2wTt+&-D4((pid~q)5jTG5H2^>2_cx9R*_la^lEauNL_5h>Yt?_WI**0x~
zwYB*teNhDW`?HzCe!QpK%5&jaDyr~<j!|yash5f3Cs~Ukr(VqjwOh+VB1F1ggLsY#
z-4&$!DJE<lb*n{Ij@f9NHy&EpB$#L)wsBVfbttw9Rg%(ReAO685y~a_MB`3r2r#Hk
zFTZg<Vi2Zn)SLO1QSCE|X96mwwcU!q=+cL%`Vv4={U16FJNplvI&5lceuL^Tt8a8V
z=pw95NVfZ5Xs9#jvaYsc1g5<lvq1`_{T;*C5ZDK+na7#rw&#`qTbo@Tw#|`m)~BNT
zS9C$Kkht|cfEyF+7Tws;1>9CrgHxRTfvnFg;$^izX9*TLUquSInETmbDM*gd{r8q#
z0WEaG`TP(drie3M;-J>ZNTruV<=Qm2fAk32p?2KZRGt?OaM%4Px;mS?JMGlCScrC=
zj)>FFiqCq;OO*Rdq8hR}1CMV-u%ua0q)AgrmXu`Np*A@U&eIXz1@uIeMShXb=b&S8
zPN#E9I$%i{{`wisAU{n5?cE&?5i31n`<6N0P!Kl*$$neq)MI8mRrr*UM3(yHhlxf8
z-N0k^1FM8(kmILEnC$!)omN3yQQ3sV^PeF)DG;Rij&evL`K*x9gyEBOi*Y9W5dioS
z(}9N7GguMGbAHTNKCqWuxfNtzKiv5MYbf0EnM>zHEsY!ohS{O=4{1H&G$t)WeG)Le
z;0`{d3dGpBVu7;d8dX_cy2LyloxFrLe0rzuPqUvGynj*9)E*l8xIO`9t!@MrHGO2l
z<jeCuQ}A{#Pd=Vd>$S&zoM28~L0BuLlcK3dT?A~C+fhpF39uQfxn4>?^8|~{;0n=S
z3~$^hVem`;UaYP?_x-N1eM>Hv2jFunrOHfsD9*RgN;BPRe7Ac)I=}VlF(wy0Pa*ek
zV&M{%&Fk?xJx^gjb+b`gdg4ZY?xmcR3d79{0Qfi}fA>}XskYeijtrnJr5*7$#f0$E
z{3w3C{XMDp2&CJ8{k;Dza@@hJCV46c_NOcXmPFxu4-NMg{RQ<pza#1!2SwhI9v7}L
zau0eKuxLL^1yW}0Oq_Zw7X6x6>LZBYX$rX*D%c2;osGPl{?6K7^E-7%9<ewNXHLS^
z{eEVkzK#28Xz$;BfoHgl+O^l+?i{=;$K;qe4Bbaf2coLOg;LSP_Io%8W85I86An2s
z8!_w#^^tITJ|%v7T0p9R$;yqFux#NcbG~16kn&!<*Nklqwphu;UiRKAM~Xe>7WOPk
z+Fibj<YW)z2!qEMFzb=w)d9xof819)81gc(a8#V_#SqTo9z9-n5Pf}`ghRXg(rt^|
zrFM8Y0MC0qZzjR}q630BfhpzeLc~+8Nlcp8V>4dZ{$Xy;Fj(x<6U07LLy`7t5R}GP
z=`7T|zG5>PQw2-R;#i~e1D>~S-~)=Cv@vDY44=|>q=M5DILr|y5bENb>I(xDd4xT0
zmto$qQ%3zvx4%YV0u9vza?C8o`kBX(X7#YNfY6lq?Wm>iS87%)sr@mq8XRF|3Orhe
z@Ivt%X7==b4v-f<$&)iIt$0$cJ(dyy>{umXXq2PdYqauXg7UNnsf;Zws;-y9-HrSR
zs&7Ww)#+nh1sT$9DxPd(Cl;>&E`SUY;=f-}Xz&8kwWUx{$9b$Td1u6B6OswN1xs{k
zz^C1xT~S0}l@gy|pn!P~?LmS567TSS6FI?SG{Sv6GUzZ@@&tB)HG@1vB%~LResWq-
z<YT}T7HCzjvQHA(w!nUVM<)mUE*g_bD3pqvtejF*-LuqUUtr+!cu|zYXf}T#>F=Yj
z%2H4+TD;8yS`*6gS)Or`r=j&?O)@AbAh5!ho5OFs6I=qKnYiO;g@mN!0d}U)uYkNr
zm?+o|4q=9Ryc=*8rANKotj_E_5@V{-y~?x#S_I|<B{cd-=1id*9uwjmEGVdH{eyh9
znY#vS4Sw#&aTbgtOQ&&`6q0&%#soDP%#ZO~L(mT`jG6SDY%)>N=4uaDJUrzC-~tt<
zhHirJy+z+G<@iypQ|U44mM-?I-6Qbx?Q4d$Ne3<^GM>Zd_U%3?^7MTw1Pt52IBY%V
zcB>3ooehRZ`d)q{MFQb`_192H4QC35u<Egvyfi85vralcI`!x6)4mOPc_-~^Ck8zZ
zh^Qo1{bw&*+TjUEvv;%s4Ku4W5bw~ST!S8tE?U&~FWgFbN_zz#tjx(MbJ@^SEW>=l
z0Tsyd5*-Ky{lB^%hCMv(U_QD#^2{9AdQb)l(e%CQp)cGutC&BP9-$+EtLypsceKW8
zA_kJKSG5C{4tbnMMR&y`nnw>dJ!2}VaahRh0T=4V0=e7-GESdc|CX0&AX72z$2zu@
zo&?fKRdbKss~Q06K(16SgI77%lv5)MfALC`bH_1)1V>X=-*csuYam5H@Eo@~Qivh~
zFYv_xi)%Tzz_S8rN{$6n2JFDz_It$Is*V_X*sOHSUnChz>&(aYnZLSjx2GDuFcV44
zsBB7a(egm`QuCQC2{Qp6;4zh3no--rQ=P0dn3jNeZK)Q0^KX{gKPQUItTjvrr>@Fo
ztJo{S?`b?cV&!Ygm1sj3H_Y2U?6FcQcUvXzUt8v*m0Q!S#ARK<rMrR$b7A5u_WA)*
zgA@(<3%v;5MHupUeRA`%`Ka=+P_+J0*=v@uHzSlW1s{)Q{~CbRKyEPLRwfB=4kd|1
z-|5gO`F%;>_Q}^69QyEMP%@F4U<5FSmpEzI(72+~PPpa`&Tl)n{-#te=N7Ub0I3cU
zn!-CC8A?AC)D_~$Gcvb5ebrKnUv>dW9BnPFer!l{i+66N8iudt<}zL9y@^y^hksfq
zw+Z)%e-6=DkDzM@^l~h)L6T9<&FFPN8EvzNfa}W4u!C+}+NnYPyt-_|)jMcS)-p3G
z9lY4A^Zcl^j*iCN&OOC=^D##)i@b(NwHUfu&*67mGVtLW{`j4IfpV;1<%K=L*!7pa
zw&I1j*_p1ld-V6Yc@%hzt<_*tO<k8C=u=El!_s3tWV4#~cQdOo2sGg$Lj?<^Dhki(
zC%UJiM17S33qGgiCQ`czf_I&?(Y6!|6isnk2>bPD?MMDC-XzXgF>c0{HFe!lW|h~{
z4EwT+Nc`GWEj(w*Z5Cf^Qd8##b!EzQhGj{q9B<t?4K1|`_Gt`0cDx8<!#lKAbD@!-
z5U$cBo3>#vkc>InigqB^DS;jpbOisaH<rAPUmy~(7j1lc-LQtKR?=(9`0F2J76uVO
zciQf2KeQaHXa4)zd*O4T7DjxoF<1IH5&O<0o9jX4H%Thu7m}biLVfUxbdh%qkbgzj
z$;mg;L=e#SFNBP{XBQt}qxA>Y)zA#-DUIo+k}+s}*FT?KI0*;Iv^^wlXTAH?I7j$i
z<RUpFT8Z*$Lk_W{YQ4e#E|yw^Oli*#rXZ`YINn2h#iJT-8X`L3uityG`G%d*9Cx-e
z5^E}039uo6DT~vJAlpj%#AYtom)X5=K!=6WO~cg5kznHbn?Wrg0#L$s1;2AiSZGq|
z;4b07D+yjBla7vu5w(ZYuM-xyRC4p#qIux#m`UFLGB;f)%Cp=e{Z@6`DLsYj{(8!u
z;WTJ(peM+qHN#+a>01d*I-Q*u{=O%Vc3aEENlx7#uXR?{3*GIYZi)0zm(bT0SRaJ9
zZbJQOXP^0!30GRLmd!*0aaAre+tUqK85M5e5sQpdTB#9D0Y-CU?+7pJZ|n99nLntf
z^!XhZ8&WD?VV_~X&nF&R%uVbMi%q22*t$XKcBs}K?I9Az7Ar8c?2H$2DB~xcoFt@;
zlfC`^1C-6qS|i=~5FCu8lW;uaNIX_8KHp8yIa3;$ugyAA>tPA`7P7}i^GMd#>12aI
ze^Vvvwvs~@Q>-M2j+4w8hA(7*8ta4)OKV-~dXvTlxlsl|pL3||e*dbm!L&X>GhG39
ziq#1Slk2>c{5C5T!Wtil?%+CYNUgUac<Xm8;XASC^ip8)w6(SHaltjeR{5Kmb<&~E
zf&;OcXLqO9>{m(5#d^r07h1|YeLE8HcM#v0Up&BPy_K`Y%Hk}k3A7}BX3*5wW2K%b
z6rF>k7O$iuzrt!K2C?926*QbE9w^M`1F7?O8^@K6pjE4>y(!4WQZu8*h@DZ$nkmq*
zARY1%^bmXS$y<rt%?o<5-Q~VySMT0=akEvs#nN4hekR?B17k>ce|3eVJNN@gS&+tL
z%9U@59DRAb>kU_#L`b7LMu;q45LChOhFB6!GUJM%)=}<}Z-PS8A76!SkDb1P#1k?3
z7pAe736ykg_S6UD3i%!`6Zz-;qux8S00qKgNomKwl7F_#j~FR7o(t>`&|)Q*M&rwL
zc&(5_1TH*>XR61FR;gV+ndo)E<BN5fuEi#q&CTkYs>0E01Uh~A&=LWD`GS?w5`Qq6
z26KJkUodWDTdG6^<=B59Jg2r<BOm4d@#Ov<Ov}l!OF?Wo9l0XZoTmBA^G{7qQ{W_X
zJx0yu0zpLJc#<alVN)7Hx5Xs0%w*FN0$N_0Tz6@q!c^)z_5B=?uioS~P>+>l*nA?s
zK)`hIVwv&p<{F3t4bcvTxvV6yNebTwrVNYB$e+Jb9x|}sy>b{fQfI|B;ji>lyY)NL
zH=3bXoazXS%W+Na1K?&tpG~&5lN)}(@UO@6n{{;mM*?U(12(<=b7@6ks|@|%eA2N9
z_mqe-!i2Mxf@q9@e@YI{z#<oFMkIqbaeA>V8lG7;VEsfrxH>7h<O=6_n+;EVQecpF
zJ)SyYq)1MDoR=@H_@JqjzR=G+Y4l>j+DfWikXms+eG<z9pNT{M@U^d<(j(Nq_=z!=
zltPlgcN6U!DM=Jx>Tiz4BQwgvd>(?`qy%r|P<fR*I9giyB0~>5uw%o~c{A1<RSY~Q
zu^rnm_5{Zje-kk~Owm->t!sP|K|36Sf1c7ZCT4+g(X3Y(Oi{c&3o0+$$jkwDJb)NO
zq_%n*J2!(Cg{3sXB^U)Pt@d4!8mFGYY@{FqpXPXgQawdmCXr5R@L0OO1?RLfOU%BD
zF;>ZMC0O<s8O*2%u<Vv=*SioTd&FW7<cBx=@8Gy;EzE*;<T5zqF94SyAB#YIz=lGC
z&R@|1l%TRrcn-y4A|5k^`KuBt$*yUSTch6;CL)EKsZ{=nf0}DwTo%EEd&l6yAiMRR
zWMWpq@d?=QQ;fdz`Qc{{yY_3X4(9iURn#xYAmjD?K=aN<V2<ji0WoG0Agdbm57EIa
z^6LZUc67icQgT)}j537)S;etCzdgyHjoYj=XgxXI&wHGUJEEg@HcsmdPiHbolDrob
zC>3p@b~J@QYogB(uvlo#+VZ|3^1L|VVM9>fHK*oD_d}|z(F58{15I{F_Bq7<dQ`UK
zQ>uVq*6H=Xz)V81EUgylis^bKC3QK6Hnluj8F~eJ0Z##DJX`g`VeOmJ{Hch)j4v2A
zE!9K5P}JEQms$)C3Klowm@mCJ)3-ayr?6^psq}KXU(bg|Mnkp#tQ_?|F&%W1CeI$Q
zh8!9RF|E5P8J@I)<$`zva+w4H3TKUA%x}-(IvCmTz#a?2UjxZGw1H!ov6ap97;V>Q
zu)zSK{|Y8BQf3Dl9qn6dt9;TkPvV)X3(1dSv*`H>3a@p|JpXXxZ&IZ_uCMNdGOP^O
zvhg=KvYVa7jMglNQ`ReeXg=2)T8^Q+jIym1GlHPE*aAW{O~Z;IYDF1(;U+lo%;7;S
zx+wdA%F)BbZWEw@pTf`_j97p5vp-;-`CZ&$3Vu*9RIZm;rr_FXa5(M2zkJt8whH$h
z?IJcTre$;Pm2abBS>c(Vb_%U|u%x=BPwBKi`rGPBNbU3Z67CiEt%tj&o@3~4;nSuB
zQCB-?mOL2*4G#?J4BvFHnqW7lQWdTO(0ww1Y(^wsuQBN3Mar1_&c*2!G|Kio(0Rrz
zZR%>3sm}%Fm!Lx-G=VCk7P}JhFi%3Yyl}iywetBt&}awbDtVMK_V38F=FB34)s-{V
zjJQ9tY5SY3<aKGM^|NqjL%yn##?HIZ7s$|yDJu&PHQmMN-Pr}Ec{#1kPIOXfoH}KI
zZT;nM<QMDK*`}(vvUW-ThOaHwraC7<gH%d8g<9MEev$~*qnXA<C(TvnFO$9eeR>;N
zUKA5qyGrGtJ}Cl{s@_1@t_(&tVCnXb;}Ps>Kab1Tz8bCpZ<^C6wZd?9`VD*`zhnhZ
z>SRuCB3lS|cGc&{|FL{FA9#wlMH)Q<drTc7dLf^%t}_EBjT(En+)!%?vDH;N(q;@t
z>2wQB60{?p@C(h`%=NaF(5C0$UDNOshSX7K(u1!n)RI;WK~TOYAC2ni|KiJ8aJkS|
ztZ@@zOQf)k<*KpP%8t!->DSv%E{%x{YXLZnJ6HVS*3J&mOU^<vBl*1UH49h<f-B8x
zyp^xWo1&2XK^kEeQh;D#^;ROLX#5rObX!<(jFpxSqEG;oZk=4MhJxr`0wZM#7a=Gu
z{yE@8oO}Z_m3lJvq6>3{hhqg|=M!s7S?mUg{EG0DlT>spLxb<)<oHyo&{zM<8b@sF
zQeDsaOQ3Fg=jr3)gLxcV0*9#_XeawCk?(=*?DEg3v16m+#_0n<Tir?4R%<7>*$SX5
zF<i6qy^v>xv&3q{%=#-~_2*aN9Po#$CT=kG@3D~WCz9zyR{w@jwo1j^riX<infr_A
z-?tf&^ql*1=j!GV?j|A<k`fB%BnLB#gstBM2mf1R6B18NkQsv%+M^Som12mQV0dXY
zzwU2#CfXtMW51e#m&RuJKO*Octfz!HuCILGouKMeRTzKkCyFHf^iUbx9pi1&hp*W;
zvvYVy7eEj9op|)7<aRZ1#2m!uZb#fP0yE<GE^hB4wY3i)*!P~cfT0;2EL{Ls6P6y6
z=GGJUU~MSRY~+r42frrZ0s-WdsSk2PkSoq8A5Z3_WA)#f2hxPvUUbJUFwa-;%lBPc
zsWSC1r%N^L6=jX7pwGB3-(hi1ipZ9+xwM0*;w!&*9+k)!&ZAR;nYyr#lyIFlA8wt(
zl}89GQnSb`5a&&2zhxp;!K(Uh?ru*54f>cUn&c9M<Y9>|#g-}{ZP+7`8eCxqJx(!~
zi2)CkDQE6=!o)u~Nhk7oyv3xt$EHATOt~&dU1JLmMNB<fOj;m>ro^m}LiaY`-xzR>
z(UZ?kkp7idySxT;&lf}`-Qx~MltArScK9*)-Lo|Jj99wZ;I!lRnDo7lh34#DXzE|n
zh{?7QBL+XgFla-8Ix?p3F-O!hpa)U7cT#rnz?wx^ZT>RrlQt&4^l8rB1QAK*lYv(A
zpg*E4H#gao9pq97L_RhHqA%Tvtzt@si<-|(W3w0n4diCFjZJo7<w?oA<WViuX;qp+
zlIhYaplk;-x>4J&Hf!pD)PX_0(2!g>0stY!yluDa88<dCvqnW$V{W8n@|H^!P@toC
zAa*u(q&T}wk8FeCt2*+fsR;j5jZK0{3xDoiQ}uv@ll!}lJ?&I`7A4`tht#Mm+f1z;
zO){NAGTj@;3;J@@K}@`Nx;y=(Mo$ezVf0eEj;`_j5QZ%3X=X_WvVvxbR?bDdJjM6C
z$AN*AN$+zYw{F-UY|(t%W7%VM8s(v<)m_ZK^2!M$nGqzPRD<bTQ0q3fK7W(86|xkI
zP=Bd=@gAp?U82zI?L0c>h{W_e;{DsW1SO%aOaV>#R0QOQ_WK5mSeSQu$J149NC-|I
z4*qR^DeYq5-th5u5oL{1-fdJ;zY*&58(28P#)-WE=m-SZgNDC;mjpCCija(xAT|lI
zxDc!B{Iu3xOJ3DU<TPDIh5<|93GYCV2uO3<$?gyMKu{@mz-gNF^84m^L+YhC7zt1m
zWmTL6SHc)6sr`4tUxG2|D6)De5fZHud91W}=-|~GFWb4zMoVCr{$mE2nBbe<8FgC%
zPUC0Ip0h?CrX5_e<*$b*z;DJN8gjFt;SAe((Cz|-`54R|w6dYUR|^}{(Cg*Y#R)AC
zo=}G~5JF#&yz5?8?UL-eiQxD!S8Bkroi6fJs|Y>vQJuCDJz$^O_X~&3>*ejNXu^$O
zlg3~Ob#Bd{jnxXQ2eoG59~Sn<OXx49E;fDHqqfM<HLQZ111+5V14h@iA+|$$c2?W_
zVP({o7jXNezfT)A2<Dqr%MQ_%HJdNY{nr-F{XZr^tG)3w3R`+{Si5nSD3yUp3XchF
zLE(!rDu}Ib?nV895?}1Ry>^bZLzS+HRMSug%TM1A8Y4&GM6lR%?Ovxw)uWC&&gl<i
z`JXJENg`N94!boy_eZPmY0t%yZ1v|H;;!5ZVS2@27|hSHj+?cgco`HAZ3&~A>-|)m
z?h%ly^e<@L+Yx>*Gmn+gxpM~YW~@-Kxre*(oU;t{1+|wPh;q&2J;sTHR)7m93E|c7
z!;FOfzp@d%Kq-UI^+JYEnD>B)RXp){Dajn-GY7Z<Cw(MFMM5HYEAtnqA+LY7rO@I=
zO&RG{-rnIdX_Mb5v1iEC?rOR@mHPV-)xke&RcSDW`cCk4!h#E+y&KZUrA@T}s(!bb
zM}~>vWD%NH5Xw2r@?gk`MT`}v>Aog+0ZiwCaOmQwd%JHIIb1VKuMYh=@2Vp$MJTj4
zetYfjh2mQqz!fvcyj%N{?TDGZ`8RqszqMD9ch}D2B>f3SqxowNF7%es*2%O+l)NjX
zCroxp%ME>2Z7UUcOkMzprrE^%9W;515N>t0)}(wAEsGT*jo6ZJ7OCyhnC`3VGTy08
zU~?}bXezF3PZjW@65e8LPLpKl998xsxPA54HjjYqE42b%6<MZh#-b&rTh2^&_+wGI
z&C4g&365Th%j6bmRl~|bshd449_h_vc_JZ^&O9Qkb5RPATV%NC&H2TqM#JIi4AtRk
z;3gs#`F=fTO|%;&q6=xH3f6bMBI7>-%4@|f%WKICzGgQ{OldL-&)?uGd&N1z)91=l
zAJwWUxhvd?&;z>t&ZABq`is#wEfhAZlXKJQ23ErsM8hXWr|fFy!3}A(n$`As1pND}
zF5q!yG9pk@%SB#!%!DRwjq?TG4$B4;@b9(@VY0H|{aT%(iy=;xRuljYefKBk52`=V
z6sn-QjrfrS2j};#w581ls6sV{ebI!FS$`gewVNF>MS-rdd0H^Mc7PY}V<G=YJVGC)
zHzueQBCFam*TsPxVi2-$@bSa4N1^J|stP4w_789bKG0%?vA3<w29!G$XT_{pNU$U`
zMuK3f;uOwht6aK0iWsOuSe139UGwN#c1*n#7UxL6BQOxYlL^KJx8!j#jK07$o)tba
z%ZW$&?lOqF$g5P+)DStWksBt(kVSC*<gQMKVa%I;`*UyuNrMHC4iGO-2a_t3tI~oK
z?FCdP7p>#}h13_!6Cp*^iK?7Lc65S4BKQNzNa~J5LO9Nvpdme64F{b#$UuCsh!I-d
zc`AY#ql7Wk3ec{a<wg@_y^O##-<R58)wa?S9{C{u1UBrve80I4&ukT{S#**S!&-2*
z0t*lJmTzH*%qls*z0OL)%}VpAXXHxEV+>^1{g?R?c;LP~o88K5&-ff4)k?Y>p+_@3
z|E3NJdxb=#Qk7gUsXC-;N%AWkr5Pq;0eg(=ujBd%d#<6;BpNPvpH#0ddV#;2cOF6j
z94<hoy1U2oed15`u4SiSd#aG#?JAAy6iOe8`KOLg=ri&d(syZCfY3v$^{>*T+bGa_
z2^)czUotgg`P9qyr;j!hLdhiNP@DEcS`-{~(v$(R$&VnooJS(%<KTA{PuD#KInBU%
zj<X#(@5^bn9H|5EhAcVtXHx}x1dlkML%Bs&B>~d)-%1BbLhw(#Jz6bu@cAgZTXD^W
zwZCcDS)V}Q8H7o2j#D=HcvKY@L*9VaG&KjFQjhLs*_Ol?T@wHkYP}Bbj>Seo6aw=0
z#a3L~68xr0#~PnS*N15JGcrwQ9VJ8$F`GSyxp=jvW*mC$NW6y(vM*5#$p*C#Y1fTV
znUa8}Ix4Mix<iuK?pjjlRXlYh7vvE0F}&ail^IyF&4J%7K3qeVV`++#^DXfG1HH>Y
zGP=Y*LIdHgqZ~7&hk0VUto^CxcpMc2!On=4kSSI2mp#m(Rb(*4dQv-c`C^yKTalks
zO&{Eg8EcngCW7%F#YV^QNE6DDGg<t_7rvw%pxr?n#hE<hb7e`5Y>WT>dqYMyrz51}
zUvSHu)9+x3m?KK^)f0CK8w02;!N6OAokX{iTP&GpYT2w0BzV!8B*C!F#(T`)g-vUQ
zRIMELZ|uSFNKUzXSH+UR<`R8H^PkcI{V?>9{8JCg`GWtL<(0#kLgT!ql`>0x_VvOy
z^o0tCb}5q6qNLm9{TBJ#E7BU1PJ4x>AXJfy_Te+3s!FO_gs@n<jvV+Z)!ahghQgN=
z@UnEmuzW(-(mfQU*|5akIF7DW*`wXkqRsIQ*G3dCn_a^fG0qw0&*+rSXS+?vo6Ue4
zz7>_OD=gQsZ!wb%cgexzPfxiSK5wO-Ef33JOxT_{laXd<y4*S~IoV?&V~gy`>+P+X
zif3RZdD=!wZKntS(10BVXlq)s8jx45>w%YCetV~K@0Hk;HNZlZU;!47o9vUoK-)Zi
zFC%}RIfD)!bNvtDsauo;ld#{gj8qfvkgMGw{L&s;z%muTf>zP5k=RD6Ikn%wfQr9~
za!{};$u@^-QmW^r^*TbarlOor-E&G%xglrAtpO3L%_5T>c|f&C*6t?T>RG6hyi&1v
za!OmP4pZyPwMkYtLSMbob(n@mN8I-s2V^J*l+;ue_5+L;6ND64reSdcHOtu6=aVa`
zgwE-9jso?;u2a@oz9LffEgJj$lGVWPAHZXr-^NF}Gb?z1e!<H>ouc~8fgJ9bRfi#W
ze9PO@;rJP2V5vXo96j6L^(|jcw?Mz68aMX)+;y$8OWYc>z@&#s+mC%^8z0U-B6NpQ
zUm|>VTkQ%3ZlVgnJrl>OxNloC@`n)PzN~!K^-S-l);X+9r%U^=Uu^%_1<?vQg2h>I
zd8@<punEiPlDYHTw1CJ&kCVyGG-unsTSTkPl=#0JAobJB>QU=4yeG6ci5J-H$#Xc2
z7i|6XXaS3##xrv?bIu1km7a;c|JWxb)nfgQ(lYM$s3Sd^pY^cfYeupMo@;%$oDlYo
zv~TxtVxBYdiaQ=2H8kaGXI_ZOR--{xp@77V-qqQZA%RQdkB;sW!|`xyJgoTOa9LVG
z(n**PVA;rWwxeb<7DEtIxd!4Rc3qu`*Dplxk-lmJ_ms0YTQpa+ffiSZ>O6cmXN77d
zEbEwrWu$*si!1&A_PR~qh{_mlB0kFP+As(mI*%JK5DoKSQH17eFJ6$F1$XrgLy%*f
zb(Tp+>IKJpRC<ng<x^FOET!jgX7Cx?TdxYufvk-f=6z33#vM=1JYG<;%@>GlH-`LR
z9MA6kReU>_@80cj825mPMIXu-3j$cgtuZF!KO=F6UKoq#Kg1TGiFpEJ0P``m#fg-S
z;Rc>r;ND0haSNY3<wD1hLD~3Y5glB!I5g!7hF<(f8mQ%_Jaexxjd2Qrmd(LBp{FZz
zK=YvRVqA4N!D(Vy^NbQFH!)2csw&GI!pVGB@2JPTQ7@#2sPf-0d&m!QF=bLIWUE8&
z!Uz&N?Ix>;vy?H`D2C(2IKMIucV}1y*&7>Y9t&*fhN#DB^s4+cCvE`K!|?=IE3nZ&
zyj;!oH}AssEC~>*wqyJ_@AZ{c-<{iWfPF1T`<nhA)uKf{lx81Ih}$k%r8nT+)2LW8
zGdHu`@5eT)4e8w?E~0ejmN~I>1IrFSJ#k{Zw{Fw08AHz@y}US>|2@Qv<v2NxjOeci
zj$eul`?4Lls{+U@98wach-p$ZQj%^2gOB&+CS9rJi8M|()D(L8yU0E&K;hzpfyNs4
znYw9S>LG@&eT?j}R0pDwd-H8i`tS(3SRs1`Bf+H&c3x@EgM%?wX*tDh%~vk>Z5?W*
zmx`%t41EB}*$Sy0g4o(nkDzGDkVT`RyKvLEnW65A0jFhF`=6_5+$j|=`3J9TV*Azi
z8xISx+G1waB6QZRyaOplVjM&%z(|{6b@SkOQ>DF_oDQoAGTR;eP92UDfw#ZigI4Fn
zcFul(XjOk(uM^`3MB#)&Ik!jSEU?Co@;l*;zzCk#$`7PWYfDSd_g0U?FBgVbn9p7s
zmuUUFrVA|7TD`o$8MgWKYknzH*G9tSRNxnsL8`^jglxvcF=QYkaOE*|2R2`14%QP+
z%Bsnr*_jl!P-8v4fUO-By4rs5x`A1?4#L~_I-{1Q<2?F|^lR?7iSA>|_C9%Jl5Ryb
z6r`9c2(ifI8m!OQSTo@mY?b!LKMA6o=1904Rm&{8O1o34^an!E(NFz=UZ;QGL@56G
z>u=tu-5V;@hU|NSBWbwPHPAxMDs!8|(o00+h6G+#E@n0_6m^k7lA>levj|N$Y&mI8
zg6F~|%Tb$Kd$pWw@j&to3)3cqbmRJ^Rd=LI(he?G#f_$;6X~^ba^!5=w;JpL<%e6Y
z9<kwKaN;Y&kMU&^LzD^l=^<6L42~IiT(4>?aNa_Hu+Lw1@d9iFWxz#$&x1R=MWls`
zEYqfnNaWhJ;W7)JxyyHPtCwGH62@4N2oAzJa9TKUbz-2H9Vt`J%Sf#3>P>Hz_|s+T
z-L_{FweXdpB_VX{ON<7-VE~pno7|JZdR*GC7#?wPxkfNvGp1b_9QJOT)P_Tx)CN;A
zM#B4(4~DM*-2t#|4WI@}b>`uS5GuID`_uOJ2lk$zga2Wi_Omwzlq797GBj{8S<SpZ
z8V%V!34@Q=T+08^s%Ji$#**V_8>S^%WN&dYpMImhN7k&+J&zQztOh+mNDZ;H0U8;t
z4vt{sh^IsfngRz-Z{A}V-)c%RK{;Or>{lVkBqmu-@z72m2=E^5^J@FY_lz+-9tS0|
zegFTc7B&QC9@@hYfg$LNM1FdwYb@;kpVxj`CbEWMA1or|Shn@r4<%hcu5y{+LH12^
zN4?{(6=z|vY*NkR8v>G1nFtIL`f!bNiXGA&q?F+;7?8{GS_^HU?FJ)IjvQ`a=+v9V
z)t9N*S_#FDfX4oy2_^P9RMJyn8YKh}9PmC+S`+gQdE6Lm;j+@xj2gWGn~|_X%(1;u
z$!>2;ONr`IjAMXE3)q{CA}5tFxF+*SdoSf=6PGaAU5~6dJdzWXd}B+StQK#`XDbM{
z^O6-gt<0CIrX^iuWE?2<o(mXcelmtf-g_>->Lhh7AUC=y3!FHf%^9@%<d{Hnv<6K=
zXU1Jims%0!EQ}G=l~QCAqs83KHmiNc4KzF8cbMh*m^H|bkNfLXoQsdM3WTg$qHINe
zQngwz%c4a`+vd}r8hVg2f+X{1f2vf|vF#*Ws_p6%hMA~!1Vg=*_q=aBz{=)jWNYX_
zcR@867-s5rMG_G!Kze%S9|IPfu|iVq4+9cPUn1%}?F1^iNh4k-v(m^My3APnOGMi%
zies2IC=&RYmFS%Q^XG<dP0+eqRHW{9p(X@l$*mr%uhv)p&Q1Z0Je?qhV{=K=T7kEf
zrsC!t(d3OjMG+ZMa-$YRpS-%SY(ik5KNbZYFcD8O&<_P;r#A>HL4fBR+cRvFvWVWO
z8T&j8wHx8E!S`<oJ2r*n?tZ<4G0%A0-Qm(-D&LqR2UyJF(=&DCAx+<&BZqS6pXCkv
zoG+a&#B@|e2N(b{g(ULr%#8J(0<QFZkdc#a>x-l(OHh<wUn<IaADT(leP88hh&S|~
zz%dGABjq@qcriP{Ew$p6&%U*7p>8#;fM(@X={FVVa=jP)a?S<Yk3d@E;}is(+fYV{
z4&z;WjJIE|x<C>Ygr3tR@1B3EU`&dc*>znPe{t*-7!@an0f%o&*pl5s9!c}R;&+RB
zBv#O*P*j7YpP_O{Y?wFa=8YaO+J~Vlf$cdviB0St-#NCtrq)?*0({rCx8a*9p)24t
zm^TG!ugpH7?^6dyFQOYT9X0EqA++Pm1kB9|^ggyf)8r)&sju9p13Qpd=oD(jp$)xt
zvflhG`IWxF3tnfT0(Jz72fPbsq6(@Yp@+cn%kt9zKgNQh!5g3{!yYpmNYKU$ESVAx
z)@)+<X(_Xt<d8a8(C9K1e#V4h)PI|XUeo(jk^u5U{ib-y>Jc{YLcI_`*tV;NK-wE0
z`mexCw#D@Z3?_rx5-G<g89pL@Ao=%}mdktG0Gh2%B&_z+a$$-2Vxw)Vs<8j1_PzJz
z#BefX#jwNMn><kU?B{Th5a9S9aPOl3t^2VN*ot(9xbV;S{k!;*=6Z_U46da%*Ok2X
zU@vsZrC`^CqOQqjul+2!I9gb(gS9<gf1(x8VS`!I(d!b(sE=I7gSXlY!%O{Jx}UN?
zWbcePoM+2uAGY-pDJVb_zu&O%!|oTfn`{x?whp4!A;K_jV+6S452d9hpfZPC9FfD1
zEuus$Qz;f5=}emVY5@ma?K}IQGfi5uyuX)c0~rVXr+gAwz`XKBYYozJFd+nrxOb{R
z+qrRaRrp)fA)MVxe%TG8cAL0&$K(}I##iw1{cO*0<j9~-b>X^|v0CcL>Li5zc-DnK
z7-^w}LWE1Ni(N#4+>bXM2ND^)k!UJ+0K_JbWJ`aM6fB@&CnobNO0N5^2VRik`gQNT
z-ag2jM#vN$oNv9?L;Ru1PFtFimDalZJx@$f(!FOi4vT<?wa}YyBv1Hx%p>^`T9u)e
zp8f@{$sH_Rf`V7GdCaTWIEQ@5IEDqsh(I-vBFlR2vEi8`Qf;M~0mMFbBiJy%c6^CB
z67ptjMel=%q8@C0J=7w5j^UU{2%?33Y<!h^IG~!D>9I+Rjbk3q{fsP0FWK{k8<K$B
zbTb($eyc8$w5e5Ml-SjHMI&&!2vA5WCJ*s>UYPm6%*S)T|1lp$d@#)%M!S;{zCxB?
z@icLa4cE(PfIk`$$HxG#ZerwB87>Qr*I}^|k#A4!Yf;By7$5-pqlt2Mdp|~FF4rLk
z8u`R~0I5?xI>O?ibYB(Y*xbJ226AZF7Qcuj#*l_8iMn?11g(Z{UJEZ&ijK%pLQ=2H
zV3!-by83Rj!EZ!Pr|WJ0qz^G>J?}_OQWyIluQs|;Kpwr?&cBMQ`<x*Ebem~szS~&P
zmB1%zrIfGpfBHlj%I>2IH*uijA0O<7&mQORr7t{$2|<4kJN7?O_47$QU9mSu^N<zB
zH)BV%j*0o4fDRV2Gii@mODuN8JmRU2+6MH;37VyBv`TDrq$&~P(W=K-^_8l}y`wHD
z|2ROb2R4n@xO;2s5rR!Og&BzTR~Bjr&c)%A{CPwHLqP3?iF?mUF~p3HWR@K$$8?I{
zvG-D8IxE97NfyLYSac^g$RyE5>SOG*VOR`S0W^KjKw&e(erh>d=JEFvuv{})v6-py
zxaA2Skjwr*0GU8$zXriIm}G>uno~nSN^`5w^t=!?jBEFQ#~&`=vy`Nzh-uF|p|&iV
zhn<$ah!gg@+DZ~?g8mG)v0k2aV|#)V@6Y>DJt|~Ap0(DT0>;~KEWuY!z0^)Z*q<_N
z=^L(K)~Dz_U#AKefLA>ypBNU8HguwZVw6RMD^QWv#=dGbz8ciIj#4iQy*^OAwu7RS
zx}R$QjG_L2ZEDJ{`wx5U+8u0du!a)U>Z#e&Q&H*8r*awZU~Td<@8pcXw5q#B?T^(r
zbG+tV_Xkd!YfMeO=@CCaigt8p(Fwb!6Qa6ZcLENkYp*Xj!+MVgr>Fg*rrT-%&JT!Y
zl9ZmRJ#+_qcvmMxHyAUtO9{tZrIh`uLn-rCfAPeB>)VOw1p+KQPHx@nuOP<WiBa!X
z=E=>XQTt@*8_j~rvdpT0ky{aK<%^)1z+E5;rtaE=F&o<s1uyErveiQqyLP}F&ty&%
z1=m9qI<HIlq`XZ~!Sn;oH}nWcA&ao(M;7*|ZD5UtRF6zkv+UdT2tR@fPrm<Y&R{BM
zHTnI2iXg&w3kCUTunpZ=d=^;A-{AE)&vJ%}3=FwS`C=y&=8o{ogNG&JZ+h|4W>ur2
zoc(>t(lWW^X%;y<Ckg-e6vgFUfkH6w3Q5A5wG46Gr_9jbmvQ(hxkNE#fclEuIU`}o
zF>P+|Co4Pr?r72K(Qg~O^j+}%|M!3V&;RRx|NX!J`?Ctec$;T{6+9KNcJ%;GNJ@*4
zEZBEP!S_(lhyAm%Tog}_jw&0&!{#;#v-y$8NU96WJc@MBVOF4F!=tcCe1d&VXE<~$
z*YN^}YBW3oJRU%i{~}CrisO>Zif;_t{E_QD<8(IJMc<w+%M2cV6a~uyUjHyt(A^e)
zu2NfJ0yDfoU{;$XEJ1|NsPMERW|LgzS&|?c%Uz6;WzLH0kCn*++caGdd%i)j<@h!x
zmhWQ2rW&y=-P0Mn#z4H!vZNV=lai6-`SlxVQO|Tk-M~5xENuCqhds-2u%Y|9?@>z&
z{NNgmd~@>hm-kI8fBogTuG{+2&u3YGQC{RRw^)^Hp_!n@-u7ock0j(G+zqB6(22`z
z=3*<bOl-NfhdocTapdY2(M?@<bh4AR_){9@mkU^n5*F(A3KWB2y-<M9hNCD>NgBq0
zU9qst@*8x~v32S=KEal2=wOx+;2`iFY->LAt-uZ<>Q7onWNmZ(9YJR~i+G2Bt7>Oi
zr^4tWiPKL<{{{XV(__OlOkX!Sq$7I9vwsW{l78a9_70*2*s{EmpTc#F1l&9bY$FwS
zZbQ}*GS3N(m&H@Nnx3k6--C5L*zZa$Ty<HH>R9bpjcQv67ut$s0X_$mSb?GI>CCe+
ziC{u>;$T0FTpXA|;1kWKHr1|wCl0OLi?=BWS&`>?4mGjo83bFQZebF*5hkV^P*XFQ
zX>=TRj*`&M)hi8X4yun6I1Qwh8vRU4c0n%DTbA=zLmFOL*|PDl`<3g^=Sv7JkT7)4
zQVPxlgfUg+kYJH#bO{O>uy4<zh=b&Cdn&%jibM40?1G(xRTg*?0BwGM&dyj`0IJVY
zipvbcd!H;8c}Bvs|NQs=C>A6I_Xb?T0+9*SBXx;W@PP);fhmg9b5@kG&>K%t&Wc5r
z7EIWGapSqlQ^J4#`+vv~2;jA0nZ{8JQXh~Aq6o_6{?j6sa#4(cO;#D6u>x#H*yoTj
zDtrkrP)CvQ64(kwoMeoD_Rmd`B}>u$tpz$yxoBQ7lBZlwUA-ADE-pG}G)wWasBes;
zAjxJ&hGsZNnscPvM|EP%dkBXopGaKgzyV9cvpLB>#pw)xVwbqW4=|XH;VfnNl93!|
z5e7=dQRUfx<wn`!4*hdHJHrJm2v|aG=L<j(mD(14s%e^Z-5?czM2sSgUa%lvlKk>N
z|NVbFTjX(qprdHNM|;>=tZE-8)u;|!1})Dpz7=|!75Uik91Vk<ivwo+I0{UiSW#pc
zbT=w97+Stn_g|)zeSR7PtON|Lr^0G%ivAT`y1?(1(9$qXbYZPEpgR=^o9<f*H^mS+
zUdMA5l7ch7r^s@DJtc`LlDy5cEP9*8X_d$`l|+_E^ye&3S;;p8II-agJzY&`i-a8W
z;PWM0rQ5oa$`Pqv=2`kS%Vmwa;i^q{MVcQ-o|AA%iA-dBwvxybiC)Ax`{|OKv`mqq
zYpzJK>T{vC32D|$wTs~sa9Ut8rXpo~8Fv=&5z_x6)^3%5lh0gLCBGrKBZw=PR0EM+
z0*wMGiZw@<0z7#QqJigF++)x0J4Y0+=$v7bGlroFSb_ceQNOkJ?w0lqhs=7a-F6Oc
zVvFA(l5_HzqkI}bjcc3i@Fwp9u3Q$3BT=GcF7f^TJAk}-cJV5ni?TR@J<H1<F6Hz9
zCIyC@R~;jNDCCWlE_KNfUFCxAjtt6dE24HlvF<VhLfVGd^IeKPVg`Ys>$(#~*OR<Y
ze)_p3Xx*mZtw$ztnGt})tq5CQK(J4ViJ5DgI<+;;H@!O(yk(n6V7fLu2FwU<Kh3bP
zZ@LcFBAvL@a!IHQ*N_SiYUMr^u}HoudelitF46OUWu8NiuPU8)+@fJ16bTHkRwkkS
z`l|n5e|$GNI6(jT@Be{7!kwa$GbV7cU||e|Oo{&iVJ1o98B0SZA;>PHsd$R|P=N%*
z(O#jmmMA~dT!It0Mkj_*g73*EayT!#a7Ob=hb}iVT_sh3N_Qr^S_3Q`Pr}QE0B&Vp
zfrCwd^6;#`Kii4WYntEA+{!l8hapzmdlsId=h=J?2l^$%ZmW7IpI2zPprn+zv;ZvO
zZ8TfP6i%f69+oUT3#&pqeFemOmgSdy4}&NJDIXe#O~)4FP$#QWMOiM=n2rr8)(lj;
zckQux1-&X!#0b3RIHPUjaLJ*$<|0*kHqc{#d~rs~0;lX^O{e~LMgZ*x9l<tjhF+tl
z+ni&eOk~6ug%j-HpnodmR+-bR&QoRCyutc%wXm>j-HGbicAFQX%?u;79UF(#0HSYX
zf=-TL%{6TjId15i{92!ak`sDaYtk!a`?}6u$@}Je5?saQCg&e3<JY(idLy+XJHQ)%
z&BzEt!*#LG0ux)FLov}K5Bm|ZP1hnO^|Y-`U}_hAHPC`8nZI=xVXXd>^J;<6y2!Kh
znDSjLGQo9|$wznviXR*_xX{4?4{o*bd=#_~z+P%-Jxfaxr*LVZg9GW8Q6BsU2Vkfg
zo`GT6d7OjJ2mCZ%3XgeN4!&`UY!3f_oNy{>oT9ia(7^%lpAHTn$-w~uXNzZZpf(;H
zNP_Kct`;79tw(M$cP1cvdSrM}6ym^v0C2veVdCf^h6oET(R71RXGgr>zr1}}v2_6@
zYrEO3W~*5T!~Qcl)0aE0!r~{%43ZolIL_ewWF$P}yoQDdd<9Z2Nh)tS9V+X8Hf~({
z-CanYQ{_lQsSU>BGv})&b?(YR&#NpH3d^bpsOod4fH_H4NqD?4mHkvDxfTP8XP$H$
zy;7^_%5BxFGH(}ooR&4etkdm=fF>(lG2*U{wZ^AI57)LD*P8yeWu=m0+3y@_r77HW
z6TO!{Xa{JqH*CrYKSY65_G31GCvm#k3XuYd&qI{eZCg<-gU$0$hnWS=L%p_p*rm;S
z+m?za8F)1#Z=~XlRJ@&0@vcEH+y#5@F2#-NQvS4v!5JI`6W^8dO)b<MN=<A-cn~Wv
z0_-~)!%?K^Mr2dNw7M?jM^fF+RmpOCn>Pqw>u^vCu;h6{3N9!E!ce7uhQ)Pd{+%$h
zleL6dT4YHqz>80;vi$}{DmTX>;U}Si{k%v>oc76vAf315M^aQQI?&&4^?-=75cpv;
z5J5neY@5$>tFUPW8--#dS_8rTzaLgSk`3m7FQd8}=WxJ)P#S-Nu?@2{it{--ArTYa
z+{FU}?Q=T?G|woTfO#5!OJP_k?*_P`7dlXAQKRk_4<hg=Uey+nd7OX{7O*6{INZjg
zs~%~7=&%s1fEl(3@o_*shCQ9?dgvQ0pw{*t6q*NQXPvd&BZwscwsebxT!JosU`lFt
z0KLoNYD)mjKfyC4BZymI*M0(IfB>Offg0r#vp`WoW-~bn?H4A0M04mL-KzgWkU3+7
zAO4Dx!q);<w<1iLXJN~Bb?g&I1A34VnE};&O7AXelIkEv9ouc(<8J@HBD2}B%UHRm
zwtPo*QoqS(uh=<Dgkd21gW?qw8eGKlWg?W4mHA<R4jG~WJWxrQbk|N&(e=EfHmT(x
zG<IfJbc!YCqt`8ea4pHhOs#QOEWB?FrEPm9Zr*oQUwR#ik=d;6uWOBmiT)vw4!l-A
zf-|q~+o9<<ydb`CuU&A~t@YZqwRf(SvAwP<pt}@kD-E-@J4+W^qZ%P54mIDzmaf^D
z=(dJKL(_GggoY2Kp&Q?o2%~589Mn3rZ31y{@Jm)IQE7yKdHO8lXEQf8V5EqXORm$K
zrEvi=1c)_UQ*m*&ji3Z)E~#pl0#O47&slkvfzZgMw`IWqUoGJ>FGxxO1z_oUoM)+!
zYRU}q0tuf<bNZADYd?M)_hbi^RhlK)45XMO%Rce;eM+;76fO9B3^sNJ?vhqd5oCj8
zGj3W=ph^yZ_Y&bWfpE9doNb=X=iECy_Zg9vc?SN3qMQ_Ez6?PTC7nfFNmA*%M<Z$3
z(HYWWllahG06mg~ZZOR?EDsY(EO3D0W8V)$>=_md96O96*MA(61ef1d6c6fBIFhqe
zz?u^RnM|0@&@$!g125C~?@PFccu6}FPulWEy;EO*i;cjyOYPeEfyyR(cyGs2iLCf7
z_^+qcP#h!0pM7_r>YI3ej@jph^0X2O&~dx8!&>H3hqRpq+(+!eX;K|BahC2)_kMl%
zO8ue7J$;W)(QadEC;hDtlj&oSv*he>bi3upH3mm8T;xLkd*jKZ-Su{ME}FrQ!_t_@
zcQqM*Zy@ugO4hk;?Miy>UXdc4eqF-fMwhKy3xAy*b``Iv?X9@Z`Q^hC8~xq!5`!>s
zBE!d;5io2~s^P%(4IEP6H#|Eu{2M|n1%KKoFdh)T<kceN#*;=B+fv3C@*3S1Mk7Ua
zy-rn6n9yvFoXD2#KcgbekJ&{EZg#-%<Ig02`~-H3Q}nJ@zr(#W&&o<RLuH=*SCT?F
zJFcvs)G$kTWtc)MKH%JPCyw$Q(~Ck|$C?KrTpbr8TT=^rMx>cE(%pc^g57%7-e-$W
z;8RuXSvz|_R^lg!O?h>Zi(r<DIdUD>l85{Rg?J5G!TjuOQdR+3#n9)<6NWH)o-Hna
zcQ$X-V5YB`0k(Vq*fdHou}l}6)FDQo8#*)0o$WS$=(P42myA1mtilnu*<!7IRg*WX
ziG<-(_H3MrXBE708Zi0VbFk~Fa6&C$K^S4*Gd*mXU=$gc1e+QSoY40z!?W)Hh0^;j
zfkREv2Gm<pzUVq|a1~0p?GA1j<h=cVr$IlMTEA3ync{2v$U%_qBS|m0V>WSO)GpbY
zgQNbbIzQ?knq#E-spmAQKgvUedt7^Pm}~o?@E3L|pw^yo>x!QuCuMCx^Goyww20Ts
znIQ}odsCjVoSPtU6O-S!Ii7C8M1+Ka@7bn?J!TR(kxU#|Mua^G_zqrcqJZ6h>WS2I
z{#5Y^+b2<QiOxwboMg4tlCXfPvkH`dq!KE)t!sVv_a9%-t4(gO@9T8xs(PU0%>=x`
zlWaW5nuDxy=6$T{jCzJ`;4B?J8><twsbcUrzWUkOHP77Zm6N%v@&3+0=<G$)9-gwd
zb&yoB19_Up&)64?5!~EJ^IFD#kTqnm$?(zCpsst0zPxA_^q0^{SOKl5=$xNclFn_-
zagi4>OT>NIe-_jL%CnZkey}x6l{hmU&w$kuhe~5176IKwC=hGoJ^uR{Bjubd-YVnC
zL$bURL2F>;&fW_n=hG)mb6#X=c~Xyz<kxKqSTxYZbrQ;bz)`z@C;Nea<%GVAeLVzJ
z%CRsBiGxkua7bwRp~kIcAL!#uoc5fa)_syyuj7rcuoW+&yts)XQH(T{6|GG(Qt&og
zByp(@o_Lh;hn-MjTrOA^?F(JXWQ*ai)70vTzp%@Squ8J=n<B)mBnLrRw`=KQP_TeJ
ziZ~&BJ&eM@CSl<AuSsivN7v-gRk%K=U9-Y@OE2Y@-(Vz`Y57q|SXX}P-p56<J9DzY
zCstru5sqvtf*XY4ATTuS={~qOjBML#Je}QPPb)K3^H$ALJ;Sq2;+vT1;HQCE1bbR!
zVb?T0TO&F(yZ7hFYQKF}I|t`0YdTb!(@j;1RYfZi9$2Lz)XNrs`v<*j8NJ>g^<BCv
zyF`iXNul^aYm=qA#2B7d1di!&n^f!Ejw0u(wE89h<+j}T7g=7l>g8Lmx!@-#Hyymp
zmWXCNY!A&Ehpr$Sa_W2$L$)wWQ#k<Q6z8=59L-pUA@D9m`7&X}w+NinM1bQDv5HU#
z7nl?+fuxnQig@3D<<5&BItoFnUSrM55=%*?XoUfBEX|~t8G(+ih<TVqwt;Pz*`Yy*
z$Lt+wepePrrIGqq`QnG3awn>2e<gI_MAh52nQNU0dwn%MMSoqAoTMd$_{nngg2Z68
zu%9y!s~8n>eU|h8&6Xwlg}W(P&wX3jzCGkO-wv1?Ssu23G!|e>w=L}J)We1rxteK4
zMikkPhy1qE<Gbgs4WO-i5^DW=xNV)-jw{sX3P7DIOJDpJNBb*w+%SYqy1mI%Zjtpl
zM4G*?hS)zi(vs!X|9z@;CqX7}e&b2%5tpCEzo%chb-?ZjV*RtzV<ON`5^H8_9YL%o
zqnO7*KH9^7qm*ssUwX^8ml5hdvpsC+hKVg-1Dje?$DtM&rWe|t!JL~*7JX9lm4%Df
zTM8GIx^uJC*)Pp)G|B6I1FVV`kr_hxXojuGG{DNk$G&Y?*dw~`>OQk9;}MA#^{8&i
zuiwU()kv-XlBo3~FMj03f0bfSpLpOn_a+^9I};9nB25eRkZG9NHiH=78uo%n!xo7g
z#|T3fdH%yy?cL&yHLMF94Z9xk?Q<0ZQJ)aV6@DE{BPHbkBj`&cbKZy%)Oq{emL^a)
z>+|l888f|_JnP;r3}bh;F23e@8u76Xk%}yfFdSHvVIy+vAape?u<6ZTlL8-q`S#pG
zKeMcVgLSqZlsw3a3<8jH|Bf9EMy)|Ow-6BmH#qDmiY$zIG&p|gbl#Y?*+iqYm?Dy7
z=}aVtTGbLkqcF?K;w*;9nORO_Fk~;#K0ur0lCmj+%>1u{H6m0Qm(W_iCgUtUM1N+<
zqV`sEiO#@-ejXQ}P|jw2XdtKDsKO6sWyd3bDZKNzif*&<iK~ulpUJpST`vHW@yPbD
z6)=WL5HZk4M1jr%qCbSE?T}#5tO!2!^)yL$hcI=MjTilTlL&>Aq7?cSV&BRo+zdpg
zeLu78Wg2DZ7&gjBSo0qNbp9AGKFX=-8$_A;mE1$>tu6~ZtoGMrie6P4tT$b~`?~jk
zd{ghVu1P5jw26YYvE^f@ly}GK!G@&*`Oku~i1tNipFCzMU``eTGQeP55OqA2upfqC
ze_SIQznmBC+LJ7VdFMG_krJkpXO+JTd4YeGD@1&i^Iv6?|KR!LdJvzQf5}y$)ZT7t
z{Erpt>&bF1Yir}>m8(_0e|Q2mgV0BRtjvJ~+b&pq8!8$G?)fUQHq9vGKR2{prAUs9
z50zMRa)F1zxluh5j(v}S`OYL9FAOY)g&HOygfrBsj)TY}SPMMcv#B1jD13Z3A6zcV
zKYPTF@p9ZXGJB(2k3S;w%f8D@PTpkgT`cqW`aaGt;nmvqbj@F`@-*l?l6#VWHZSJZ
zf4^`<@J4Umj$`r1U??)gfE};fJG*YBean!oOU}()9^7TTYYUXXA)0C11RH?|k<N&X
zJw`)pdyy5nk*9kaxexxZ+|#%g@&R|o6;Y?6zHz}nPG_7sdaF!h!|{zUuo?CYJH(b9
z>Nub#!J6*`w#_{1I^75_qyOxGJ75~W?;2mr;A7cBifUh+=j?K0kGG`(KU*xoW6c>u
zC-4v|A<A>XN+qncz)FCZ2DV*UQR1GOYf`Y-Q{bJkhzpR}VL0NDE0Uz#Ohv4Vs>t^|
zJ|23OB-zE0@V@;jF3OF>Uzl~_zDJ08;?l2<w9pPrmsr@<nT0K4L^#lY0)hjRQqMI_
z)AaQl0;#KW(Ca3M8$4->w;;IyYOs{AqMU^+KIfifT2N`_u}0;03x}Oz?B@hxDI-#H
zIFsdw1DYJjJj<2|g^!Co&hog7D_(jHYlfErga?-sO`vqn^RB{lAENj2Z&hibV7owk
zpiVeL?w4IGLQv;`14!O~|4TvU{=CSb`Z5!4?Q_PTMj=B11f5%O*uR2Z7kM^cfFGqM
zDjP{JQL!u*av{|YeME3@I5kjkxgZ7Kw4yt;T2j;}JTb5sIQT*KdC)b_O02c6JMnte
zt)jYN;JHLI989QY!u=3p&vOCVwH(dzHR_YQKy^Dy=<4ov<f65IhZZdw2(h!tpT$NW
z5?>*{%Q>5?ULmG(!kRDD`!SC8H`v7T%GNrMkp2FF(2wtP0$0q(w=54?T9O(2C?|x!
zjcK-o5a`?@e1Ek~M@^DWM<(b%*R&}zCLPp%wU9p?Ypd3wE6G+h$Xhy-=y`~*6fXQz
zz~-rF_T2Qe-6cqW^aFvoXMD)eH$2h$K^))gU)-C$-%EwEc2+u~-Bz`&)woivwbl6b
zM?=?kVFrBtj@`kEuy1!oC{V;B=)rari~FSPtMXTU)EB#R4eLe`iyQ+-9x(NE&%+)G
zd`x|f*rDS%p{ZTf$*8WOc67hCD5g9m_T|YjS@(kIyq+3=LdGU;#R~HQuKzp*XaADy
z&~;$i<!>}kIN4(<r#J74iXoAuahY*LP>{!Z2ou+lx8?h;&-&0bea+KcY}kPTJPLw+
z$MUf6G0)H`@mT0QWXG1Zq}@_1y*1=4qtyVChv=DjVZ&+`d$2Jh=C8ZHHvmjVKq$QI
z_+_!E1(n8sPhD$$jiUUGMfrw7S$j{vwlv>e249vS-#R6^P~GkCD94Ywx2?s_QI5ZR
zIevQjWLYroY)6zFk)&Y5&z3v#>37S^WqhWL&y?Y3N+-1U&YmiSShj0g*r1VtEn+hq
zn0A15!?&5H0lzA`M{Vu<Y*9s50Gu4Z&lakF=C*Wyvli2QO(OwjE+~A$NXNbj`XA;w
zK}ZbE^|lWQhiZ_yu~KP!A`<__7%Te1k^~^soX3<Es%xJzYsVo#2M5jL;NW08?Vpgj
z6yNszDMsQHo_grupl-2vi5(p9*9hnx%K{x7hz7{+9vn>3!2tv;fWKuqIyg|G791Q%
z)!S`<E*>8FVfEE#Si7^mW1c}B$Ho!y!Gt_CupbZ~yUbuD2z;Vh!H%AWe|h^-J_C4Q
zm$s&NQB92UAmr~fP@=I!Jk}R1kHOf9zaT|yJMohYL?|3CpolU4_7mDH2nSRwNd5^-
zDYrKTU!0+1r1J8&R?pNa`<^U(0m5IDs<^6u4b0Zg>Z~hnR;v6^4_D5#nku?~-1tP{
zMa{`4hUJ)4DJpUvWf55>@W9eqUQZftDQXlg$UNz`c%@R&kK3wunbyWP`-?nIC5>>U
z*DFNC33sQ)ANY!Htb)^dJcc(p4<9zIn=6NOGQCoTRMgn716yf^(2u^CYG$<|#*P|)
zvI2{&w4rnPDs3>Y+=goUH&1|E-CWa+>J?qpY&A7E>ukkn64HYGcOSL1u1}Wq#hXDw
zh*D|8(Y+D4G01cEyza4s>{TP^a7_RyX>IQQ*9m8I^*m1+4T}0ushsWHw&Qeg$phCl
z$uHOTsaZ5?pA7vPefqsmAZu1*?e_bBz7z>v34`Cm=+hzwMSr~5oyjI;L8JvdtdfN-
z&knFh+z5zAgxbF0>K>3MM^Yf1gm403vQzh?-*Q%9kHF5?`V_r-^%}`Nf%wr_#Km+a
ztgoOYsX;B+-I4~y)qRVU!GU<m(DR`v(*++r>C3ay{E&JKIoYcf66bIe+wdKKJCE4~
zmwln+Dkcs{z|H%G&B1A?@c)TUNW{>qIQ=A)81WpKg))vM+>NrSqBV_1s)x<Sd6S@h
z$>uR<9427E%z0~v{jU)*Cnur?9sR%=h%Lewvzg`j5e_|wa~Fgj_L*biK=Wu6*eo*j
zD}^Q$6?T>|jHkNH4i2s!5nHT(pw%^Ywe`fQhrs6}h<k3S1R}v=WJug`+>dED;vN(v
zs+V!M2Q8>YDj_HRc}3x889s|FYG6kvJ_Hriuy1J*HVoaMG-QSmvO8Azt&Hk69>L^u
z4Qc^t5_U=*yiU}~K8MK?kOb-L72X_@G214z3FV&9Cdw6CGviQkS(I#le#iq!o(uc{
z&dZ}C{+=r{L~8youMkG&R=kRR!DPNI-o&c~^G^x|pdB{hD{wX1HvrNvXy;R3ROzqE
zLnxfMyYUd(8QI2Cs+R2U-DjscfUGO`!tM;8G^)EA3$bbHA+`wBuop518@A_aRv6l*
zW#9PzMtDWqT)onN$x1|jlBBvF1!<lX;5#yBVKz(Se}FhNMHgprc!uHvU7T$r0WP^a
zma6*3gV$U*ftsQ?g=+?m;PW^yL82%~O5s{z>3N)IDaVB2tdQ};nTT`?Cv*g_^U5Bf
zo4w`VJ;}09ylJ1(>>@=A{_^C0@t5HlNVcTvX2GRC$Og$~;3FS@5vY;_)r8k6BbY*?
z;p&8@NE;Mj{C8Z`K>MyLF0EeaJhBmpm2FvhlNj@ip35okm1S(pb(n@V$067<zzIwg
z_}Hc-2p!!ZX6QWzSq9GIPR0Qbaox}e=?pDXz9jIHn~aEO!1e;jJWk=@R>8V9vOReF
zsfCcwTNl#47DrKks8<x~_2Jhm5B10e13dn&BsWDrzCYf^9Ug<L1&*zN%swvD1qnax
z|M<Sgy8kz5*b6vb<Vh!m(GRtYc(KU2v!YHq;j~D6|3hB_uw`08yuB<1-}Ah#U*Emj
zrmA+b)tcJhTNT|{mV^v)kICe46YyWfrm242y?nTCI;5O`IGBWcn_n}=YW|)SqeuE(
zd8F?Q?iJn2cV_nC`IlcWt16fOZpBt7a17IO2@Z6}z?RP(?D=|#HP`W75*Y@i{td*|
z0%4Atb`if-sdY>F^A$;FOOWNBy;Oi8ILCgdLJRT39>E(a&*p&N?f>x8b5N?vHdRt4
z1S$nSa}H)bt=SCjhWMN%mndN*=O~|e1D|C}5Jb7;mNSyzi!4tRlo15b`2qxOE<BRt
zk_$E<g4fuUf=-e`N+#&VGM7q#16P05m%N-7z*(4q&4w1`yeNg8w~-EiAdt?8Td#Dl
zpqU>@y(mfEPRDs!XgT)i$5-daozU3=`pqUVOeiD`oC^V@sfFR#M05y=?3&zI#JXHe
z$xN-8ijAFEH^Q|I;<Iue>0F&cv=ehsTg1x2Wov;9#80iiiOyRv(qE1)>w14)eRFmO
zJp`E>oL4uetrkp+=~<E&7iY~+OznuYC=0P4yuk04K)MJ@ixSB~$P4@m<!Xiy$;2};
z_lVCf$&6;R3na#lRH*M6#*U3~(4;e3Le()Yp_}f3p@>dh4+nPQAa1)p!f8NJ;xZq3
zX&6zP#w6{>7u@Pg8%?Ht`|p2kz9=Ew8YPP?udP>NQJYQogZzSyUcLI^7*<`ZHf%Qq
zU9z6NMDyZWII)%ELFiU_P7>JW!m6l(tWT|<7Nu1c`9l0WE3PF&ab@Whgo=$#D@^!0
z3`GUcLqxVZXIT5qRjn!v61x1HsyXM(`k(*)zt$D!05mlsQ<NG5xvhVS6f&5pNN-W?
zMfP4;8Fg@YW3&O%%AcOYmq(_c6wdgym4nq$0(pczM?$y=17!;!KJ8a}A0J6}G0SR>
zO3rvH{21Nce}h1ALwP=}P+cIH(VQcKX8aoQlAt0*5X*ChJ=?{ubNi3PNb5fGp*Spb
zAzcUZZAilCMLvo>&q05&ACe>_+_#-QGo6cA8qjCSbSeNG+U?PeiIM|KZbomoF$ES_
z+%|EIJbr`zaxT`d&N%->j7{oN18r3SE2YXhwoS$@`pSOaw^YkOP)X_bg`;&Kp}Z1u
zN7LEgDoZ_F1Jz}bv#Oh^J}pXaWU6nA{jn5h5@;iG%t~SSL$`n2UmGc29x){s%r`Ts
zJGar%;>_w)^!ul`tVuw!YjW|He}FUZ@Bh-O6EBKc{iebFNa##k_`Ilu3L}lyMO_!u
zCCHloG2YckOku~M(cf2M-hg<vLw)2X)JE6~2#O<@q9||@&Ur{<(6%1dzPT(kQ;8%x
zqrE($8mH|BhIfCM>gHO>DnrNUV8N@NfCR0Lw%yp-O~gejD+-OMzT`7$W6jKztbihe
zS*$(-r}N>C8oi?o;j3A53rf8svzsHB)<%<t-IM3p1)ot7KRSW`z(-GLZNW8}<XI(<
z{>{@rW@&9vQc9?<1Y^H1GUNSoa#I$0-v0aLOY4GwA`E{gg8ua_sjfuG>PqU=v9Wx`
zm*zZMZEL%8iu?6ff+^acXMAUND(2%b2|XL7PKXgs!w5xj93k6HU5tItvoYV6R6)lU
zDH1Lv$iMBt&@5>_KOQR34X;AOY&9f5Xz0<zH6RgqjonCICSdh07IRr<^gy<b`02&z
z#1fy@b5eh@iKV`&iKRZK;{h*&qSNbgxe2BP!)!(9RdW{{IN<J;1J3wjin-i>BVOHv
z#4P3sVo}5p<~~CS@gqb+Z2Nv3gkc))Rq7c-k}4U<ly-~+U%jsfPFO7u4M+}KzKHRC
z4`W(K9`V(wn;qZhk_6xVSgWPi{%3US4|(mD2>^dfmSIVifELrMVe+#rS;`HC4psGd
zy0TFdtz?NC9S-ox8B9g1De4SrIwPd~Yo&TOd8j5E(8%3G6n=D1na);vGFM4(>OR_C
zREy)sF-cs+k|0LdiG7q{9wRq$qtJ~x_59>Mg3S9KRv~v;$ny7Uxo~}o!!#hs^TF-o
z`5b@6HcgS|hpFwRiJLZ-p##zP9%6dhke)#vbQwKtY4Udw5IHp2!{w<WKzj-6^ojPc
z!9A=$j%u<5JU771iL%wou?=H~whbK8j*_(jJ%8n;aOKVFOnPaxv)hQ<5e(uml!iUJ
z;_VE~Nqt%Ut|bspfB{@O>&C_?-1|CV-%Wq9uvlTuiduQ}U=Aiq2qW`(S<FkIvD+lR
z#~q3938FBt1COJCU`UL>35wj9A&jFScHJ=Y*jDKn$F}rfD-5+(BO#*@qbloY&dV++
z@^~3;wZ{Z!i2cJ&_>J|K1u0=MXMAG)@5Kz%&m2~vD6JPH%Q>@-N)95CrUooZ@&A9|
zcKz|Y*NuB|e5#G${}Ih8@onrAk{~C+3Bt_t5lOLwNZ>g>^8y|P_;bO-HV2jFIoP4?
zRq?DJLVg}U&UG_gZwZxPFIc0Y1~)#^1}{3G)ljXpMTLqcKWh0+uYK3}{?*HZ(O~U+
zqSRUEMR|6teNz@w?|fGl^Z5oZsd9e}SK`+YJhfzhC|v8<Qvr$XY#deCIPvZN{!m5Q
z-$W6;3)EBbPw}8xW%We<TRdtPQ$15Z9H6$lg4!BidKV~rQF1<8fwGm~+{ioQ<@M*b
z@eAfLvK;_e5~vJdzu%T1<vwEIuPNs27WvB~FOG0T5p%)-Vb^z1k|Y>8)a8GUV|$#r
zw-87T`9_E?P54@)P~DqMx?VLISCiJnVSUGI7|a-O4aZ69Bp!-vN)hIfiwM~48ROhe
zgT$tNEcN3RI`t&>!w|=Vu{MIWJ$}T%AxiAwoFw}do^|=@d&ED?6;w}I|5rtRohqV<
zLO7#}^hhRn?a@~o8Rk{BBg22`5qYcQQ4w%GOkkB-H9_lUnWAJS@}ntXlx0<&&1l_B
zS@%UDXfl(KuI;>L&Du&<9lW-@;)yY<N*Gk`n_-y0?memK<m-z0Un>}n0YLmmD-g-+
zch}MTi4%BkjJQJrgdHzJQRr|K2FwphU?*|-;PKPVQKH}^EPJ0Z2t<Eh8ZdpMZ|LnV
z=<mTLKMr445}JSo>h^OO2r-UUA!GE9QgxCZO~KcuWsWLKa`Cr_mWO>R*?^8GR#jM}
z;iuKqKgo?XUF3B(hcJ^iz)4As#f)+Y#cv;VWDa>&)0`|SzFS%2tH&FD<`;1Ps*oke
zo%drZjqtWNSCUai`r&^Kc=VTxJ-k!K^&XAPW6#{S&h`FiGGJ|XmF^O!>ARtw5E~;u
zj#GqVY@^8b6BI;Y8sgATXlUQn%_Y6DFVEj&>yNx>+#)Lt3qsv%5+liER~=`dauJGJ
z+l0FP>{Tl=WQm?mERq+q3t1T2H0!f2cyUpZ`DI2eS`;PAfCGQ0vX0<3sTYh-EO=S`
zd8|Su7qhyA%U*s0B6_)p^aOw>67Wv#$`mPk<>%W?(yKFT4O3~2n>t{2hh`4Om`xow
zMNX192(yp@*9=Cf8znTQETs6+#$t4GW4%0Yv(UDC>i9D-R6ImzgZ0?}A`NN4Sk{$+
z1Z}zADF4Wdm$QGgu%5!l`wqUtcc65?%jWOY-Wh8{z5Ggj*OCrM2rfse!c+atA5W}T
z`lBB$*PIA_S)^@u(zIk$Hc^oeU%GZXC6a)7O6J|WD=#R_peXc;)G#rkpq_dCK>Y)r
z=(&@R+JC7TH0tkU<%DPbfW$Y8scNn3Zqan|Vy}q;{DOba*blreGup3MK3i6GR&$Va
z`r(eVf^qTli;U;2U!`z=EUU4Jlmx()OjWcr2;|}97PyvvP^-QRnI-Z$30>DiAqzu<
zz0^mE&0@rD#zPv#QRqjX+l2<_pz+TUL1OIATYj&sih5ps-hS~o{axG?LPacZ#x4N0
zbgS<#^?rZ<icmj;PHN`!5L&4^6MCxepkP04?n}Hv?xeeR5~X|&+N%JEA1=(@UYM7h
z)LIfzf1mf0qd(H?RG&R>o3CIeIkWu0aqT!kjt>@f>;faHW23<1Ug+CV<l6B=qW)c9
zkAH|=MdISswr^yjhxZyQ;Ml3hJ)WS%^K67;-$#G3?{Z{2JWYcb+dl7;vAL@xksphi
zCq;23oH~s>B4(gDXgSN;;}0ZCea@{l&-`AzXSEqQ6y)Bvf2)D}NN_#PEB=lCqYLRz
z2)&ZT8&I++zxh|&_PijFi8vI3zQxkl>>*+W-uB}brE~@1jB;n(Zveo2-`PFtwc}k2
z<^O+v2El%kbE2qf)L5Woby-XMHI`gM5is{K{E)08s|1}z6CKdaW4{SB-y4DEr#RpY
zlL&D)@e!t!A;P@~@s#?ZlcY3^ojchqhch||B5(4y+ig6#Ue3lEDRxB3DbL;u4_wC<
zseNQkyu~4~`{4q+R|Iv(0gDqKd&mxLpz42S7$pg3$V+{ihA}1Ky`&xK?Vjzl&Stmz
z%XX`^B*EY3WnBGgbl6_Fz%bZ)B8J)it`*2EJz8my6%DP7$5vzhmaunkO9EHYyK`Pr
z;Jmuv?^I}mP>flzNOFE8<b|Vtf6m$hy&)W1CzfN|6U#mB872C4{N|~x3#i?#>F9rr
z9ODCz@P>ie0|mTSv5fPEPg9LqMud0A0)@UMkjhoel=WLtX!YD3JkMX4_CA(AzO!=%
z1F^>k@{k?w?BYR(@kTQ*?fy+>$tn2&87Se;l_SF&jO_LUyNA8x?{{eo<Hv1Bup2AY
zXM&@6Tg;nNzuK`G#q}NAb{rpt5%Yf#b}&W>#vBEXmtdUQE{^cFyjPBGbyFIf(x0KW
zh;Xb$lU8_KTj{D`2D)N3P+|aM05PDPLDC<ET<CLY^`RIoU9;v?74%k3+Qt^{P|UKr
z5cGv0lZ~JswwCSX^o>dPJWOd4rW`Uj5`-P!LnKaY6fw>m&rcls@PWr0NcDdmx6-+*
zme(34%bp0P?l$vND~!`(mcr^%;M&f!+B*7Ec5!+3Bb*1hgttIpqAaUAZ|5+vlvQyq
za*nEAoLbMs2Lq~x`ruo-0)clKQ*eZ`Kp0pV#GNy5<fN8{s<W35n#w9oMGDXxha)Q?
zU+j$M#Vj=)T?YK~d9!DP+N6KbpM7VU_)#NGH-V3?)pA-?s7l{%8UMSj=CiD-ckmr-
zT1%UvM^2lZVW?qs8}c)|TPw1TmF>uRe#2o_rsRsht9boR=NwXtFj)=RG4MC-x$-EL
zLu+&GaQYre1H&7w=(RHiu6F|mJ++=%Z-xNpP84{%+4UqJO^>YsBIti_PdfLy&<*=D
zyQwOw;QFxBj@vR~?;4NQX>JsdzwAw!?ZB(`yomRtx#S%wOLBA6Y&}6OC;oeU(1Ra?
z9*p;^yO`T{R1Mx|tLkgGzjoJa{a>2yzKQC4r-2z~`DgqY9E=cOp%FrBrMtC2gie^G
zlt(D>8Adp^Z4}2WK{$UQHuY`Kj~(`)K#l<Q_-Wo2bM0*v&Q??xbM2|$Cw#;AJ(5!5
zB1(vZu%9?6;nYTq66^+vpK!c+hA->QoJ<Ykg_j+&LHS>VkO3&DNum>PRVII5U3BwA
zSSKf~G2rB6Gk}1UiH#%@I<*bhbgYvT(OYS7IXMw_2Y@Bim34n|(#bA&ax$?_P9W_w
z{8g0J$%$Ai!6#guoG2guJ~xuEzYL8#VgzqVV!Z@^@XkIT62u;{eS%0Bx(E}BQ5*%}
z{Uyw1P7>O&yCZ|ppU+<^o#AG{jAB(VJi`bi3?&eP%X4X&oAWX&*hJclWJ+uKlS(}<
z33aTLb76duj&grUt69xSc?Ge%o3m(CKy=VejJ%;ip(#10Q^FF${~Im+A7Bi63Jtbo
z5k2lN{Wg#b_1>=La_mMrXHgSqVMtAgE}_x5jHhIggF<X~XboEW1(PcQUOw*ichII7
z#J*Zx%o_gcqj{O>bUuSI4{*mo#nr^{>gm@igiyPFDg}Q-#H8u1non&`*swh&8yt6d
z4|*YS7jG5f$n1!_qmB%Wpu?HynAgodcw6^DE&c}6FOqi_f_BYp61Pn@yKBIX0Y!ld
zV+=rU&}|s33tw<3bC#=`;ICdTv8>MJsPySP63aZQL_2UP08(+~+vA#tfO(Fn9<Bal
zDj|uu>Gppf<_s&(;i4wx&B`&go5mcI>)c{Y{~Qy++TEzrojsV0-j^-Jt$Q`kz&e%f
zE@Fui#(c<$>98aMp&~*Fjbnse%6!)iIrsaB#RE`y*FfQ(fc|}&!e8$tm{p|QfPH_z
z;9$|GJz|50g9JITBj!mmms9Hnc-73}6YH9{xZZyTnpyIBQK}qCBGoQoQ}851<xRRd
zYf2cm=71&EaQ(F)<d><H^NXy`ra<N`xyzxV5>U9L5)$#mD*5}2UrTr)OrA_7o?lsQ
z7RcXOSt{k{tb*j=0*+i?mc;^W;Wca(E)a~<B?x3uu>v4FBLHN_j=j`N0z^3p5l(%K
zV%vX>Q5qA%7+^x<^u9mmUAUzw$tgf0HUC0q^Au`Mjoqr*zd5^*UTH(4Pz-0LWYkq4
zmh$Tw(zPN)+o+N*@vf@m?956?#s4CP_wL1y@1DVCefMUOOtVVt)OT;re`p(ATEy&v
zEdD$%7VO!4K88GP#rcHS*WeD<jBnQIsUCk-&wuqyOe(CmR-;5m+J1<?Y9%B09ByqX
zSwZWqHQlwZ$+hV1ccdoA$EV$w`d-@sj&-w2e@Z|QeaU*G>va&Y2`~(Mb<RNfVCiE1
z=d<&7Zx)pDs!A96JE=~ZOF2?txR7E;oflQDHO;XVRjX5G7Z<$L3-o5rX-0DStnq)#
z4i{3i`=8IwdqrOJN~nOUknCrh0BWl}v}EeQ@q2dmmRxa*<hcdMweHNMWh}8Si)(92
zW;g9Ae+{2y1*jasPSVU_eq+&`6EGt!=BFF1&(E`J-3kqgJiayh%^uh2w(FD1qzrW-
zSHxP(Ew%tekj2Zg5P2JfIrU6l&}V<o&R<&Z`HU4MFxv=uRs;1L-nOi)>Xobd=KR?Y
zV$oil8w+XtdS7d&bD_y|<Tck~Mw6TDHJ_IStd{17-+sZm{FfD<X3$z6STTq{FduGo
zBj{`Hc*XmM`K*(qT-(sbUe#8C{!!jRc#Je!%m%Nl-NS09!Y+m#_2Rs;t}lNxdTCul
z_lq*S$Yz3j5IQXP_BG@zzUJ23w@(DNY%0q_N|&k-!Y7$o)gl40xt0>NAW(&`1m-*~
zt}O~$tE>*_Fgc_KSHL)MwSu|{FtXKqdQPVA05g^5#kIMs&EJ>o>#@DOO@cqUqQ)6?
z%d_PXM56RJ#2<OP9j1B~O<;fNoAVzgGI4cx@BH|~%kL`d2=;;Ivh7I%!t|zA!4y*8
zna2zy3QQ`6FgiM_i;|Q4s9D6NqTccGzm1h0y{V3mkI#lRcQ($7>UyHdb`AgA76U@V
zF19E3@$vDAW828F?c)i+stj|X^97m<s~U`J!m>kp#Ja*T)aMTPQE-3jXl8+)c~Os`
z)jp*iu27^za30Bs>19*{B7MSZ1+ZwV`C}=RP0;Y<oTwxSf9RI`Yh%iaWnR3J&r4nb
z2&)-@nV_Ll*YBThUztqYuw`xbvf3oi!Y_T>XLpjf!ihi+$i-X!0bbEQj*cRGq}A5%
zwc0ATyjc7f#jJkQ)LVZo=Dd6bt_e9bS@C&M345e8bQX18OqZB2m*w9c>D8NdSKi&;
zXnR5AJJdlqiaEk5Bf#nyqsX_Z6F7btCBi*_XY;{9(?4kX2TlK==^r%xgQkDb^beZ;
zLDN5I`n%Wkg>VedDfsyXo0O2C8{5ne*=$jP%}L^Dgy!*7>AZi-^>PbYYxH7m<PexE
z>u6<Xgz9a*__4A&j+$O?Hqq9%Y8DJ_uQ^ET-1<+Vvtcf6_4ebFm0PXNBEMNTzEK;;
zR*n8x)Ef+Hg>`0|#<~g_n3CFDzP~j)a7(k2^>5ZTUANAxwWg&NRSqV8yXKdaUN*F~
zpOOmPvrrShcb9*)DLHz;rLq3a+GL}D*$ZeHD`*5X>gAKcjOJphCHi{EX@_XU4iqjW
zc_l}>4x-qZ##;gv+qvHasAxj@6hv=3c%lL#zR50TS(;HYs~aq$w*sf={!;=KZ^7$3
zKES)j)UE05FLyQk?Kb)+V%QHjaZzex0?9rc6#FzlX+nPpi>S-o)NP`F*3oDTduyVg
zA~$l}B#ICZ(-7f=+bCv^haw)5kVVv{m~TUM(!=KoG~O^rjDRc2uMT8J$!|iI!P)?|
zB!P4Tq}_I?I>F9pk&+Xc@l5-@B+VnY<Q{|O8W+7Lc!Y|KaGT}%YGp)===PAPB=P+a
zlPE&ivlD+Hy@UvrfTNh$i5>Eo5trXHQAvMFH_27IdCUnUvxNBhnwObK3e<sq-8a+U
z`XH7^<cS^0oOY*-rOUJ3caeJnPO`LY7oa!HZn{~v(Z0xG3<OrfphMau$>>*=R}@aK
z-6Wjv&UEV>ZJ_^(Rcv*Z_VL?sw~0dSI0+fBb31=Q<RR=+j0m+kiX80tk<A=0@$VxV
z7B7j04G;`k5|~Rab8&C&HSX2*-Ox*Mh$7d9xYxi(QRMi@VYVN09+4#J$Gsk+5%wF6
zAoApW*C)0Yfn0;Et`p4$*UO04AmR1-@t~0mLze!@SdLnVja*bpN@`!9Xl}1{V;n|I
zY#V<r0p`g$nXU~_culfOLd!%4;2eg5*OrhYtfOzAzdCM%5JW4pBCBrtjC<p3=^`uO
zdr)aaR>5l|jt(n<rc^Avl0nFPUKaBbnDsUYUvNjl7m~<LF?JI~JYpk^Q#c7&irkc8
z68kZZ`ytNT2<~Dl4_1F=vPYE<_y{=TI^uueF$mNHF|!vcEgF1JO2I8S+;-Mq7NjJz
zI-Bu{h_$rRB8RyzO6!G$&>oc>WC_hwSd>j<!;jy+K3*xV8_~%lLOTgOH(+sy{D4w~
z{WL+5?Lej~>UlVbgGgv&k6mc*98Nk8dq<M|eGBrBHS=-@`?)bsUymWLE0;A~;KqL^
zAb-o!qd{1`YNRbHiR8p5Bfprn?;2m1dKtR>VeNaO)LG|6`DLzsQx;S2d{-9WDp>oH
zD%X(NeGR(N`1Vlh(a6Jz-QPB<tZ|y!{oSF8w7-cWdJm|l;-BI{v&QO){I_`2E~R>=
zewcjaDjd*u>_&wfS@RJ+PF+sDca48DqWg+KnrcSr;d|}I=)EUFrORIwd#3kJ$=SCh
zO!D|E>SP$aGhSLB34`KyP-IQfV7E$b9HvohdoJ=Y_Yk(z6eVDY#V&JVpKxLWe)skQ
zoMD7*w2u1{;MNQ5<66XOtEx_&K9b(W^Eruah9WF-crhO(F?Nwh!o+i864-y<=U`Vg
zr?6*8H)rXr$)1zVHZXc`EaE+mXx~RCY;Gv??M^nmooL#U+qMifD_NSQJEKp5+a0x$
zWmeTX(z_8$b<16I7qJXpP@7T}hyIFR<u22|4n!@r2!aX8G9|AJ^k^Y<S-&=LrDn#u
zFABMgnG{ZK=QZKXR-)bDwdH>mPmEbzXaCl{Cl#H1wUX3ru6B8y?DkquJ%>}9ImpJ`
zK{#;}6en?n+|Z3;N<5tOb4T3!Rn&aB!nl^rSoS_+;EL@QG^~~S#@Xh=IXnAau+>2&
z**_L=mdF!AWYN=Y=FoRy9A4s{>>pP0tU8(kPC#FqRhH!9Z{cf&ogjamy2ld;JSA;7
zwDRC4H`a8K*V#PhZKoQkr+}0RAo(<pzJ$bNdo^-A=8LC)M9PvPt@Z%zG$tqu;8SxH
z8)YQzc}p1fB{Q<!B|&#jA${x#zSgj=ZO2Ev`noyKb_W!SeU5D$#wfKDim;QWC~{&4
z1s+ZUJ78Ym-PH*o-Bf=s&);L~kGyCM$162S!8_C>vyqvJIvyb9O%b)WnO6JBhE}9A
zQv3sXF}sjup-Hnk>w*^-C7EAl)S^XEvTP=tU`KE!*9#^bG_wowr(~57he!$cq1>Ec
z9q;E$5)Pg+tFEk)Ux*nJ#47T`lI*TJ>8{R$G)#Ons@uZc4)uT9z`@L+UW!;65QGCi
zMu`*JC`@n=&>&zzkUkP&qMz5Olg#Mld7GlN-B3C&>Enh3iE54O$msv$<8A1EvAzEN
zkryv#X<<EukK-Ne^LL<Tz02nB)atAl+$;6nm<&>?!c+ZC9Z#%R`lA{x*L-pPTexj^
z(zIk$Hj(3dXIXz=x<)f4lCW}0=H0s?FDT5RDD;ZdFg2o}`d!|S64%qNzbK%lQ@^SH
zAzoF}D<8H0Qd4Ynpp%~vp7r?^-Yll7wXV^6*d2bsXY2=Fml^F>ET1i_8u;>_57`@L
z1>@r97a7l4ze-^TURGm6`~Wx*nbu)T6fhjyKd2?!#f5+F`%cV4$488YG5DGz6mjMw
z5_rV*J&JwqeP#zf9G}KNN3PlJ?u7nX{RBGrWP?-s^HJMwc^mBFm=~Ijpxqgq-fHER
zGodw#77%!K&v*4Rs8R-DxzMH5$J$fa`sIY`_JyDQcT%`a9{A5B4X(gz9xl53yyz5l
z(J~q%=~{o?{u<P$#%{x4d^?O7bur>m!V!+KhvF!uDDd4d4kGSwkKIMP6%at3;$^7N
zb`tM`tDwx1g}ASVzE2{)eT!vj%1cNIFa|G#+x3D2!=1cYRa)SF7GLqIyiJcTN`51F
z*Nz9eD5TrrrKFn{2t%FnMYSn!UILnRWz7qilMH_{{lX*wtK{sO2wSYSlL|ZP8V{`K
z+E7iUEKEF_a6|&2D{@_mNaBSEla#uFZM)28_aL?O)<iNFf`|YNlcMX*<XAZ@$f@<R
z2D9|4+`QT!+gniaJ~V7C1g^7&$sRI%l9IP}3$f@Th09oFUxK~)PN=%g7#D?%H(TWS
z5lnw#Glw#D?Ml&PSiUcG3`;CA8IOJ4GLPn<hKahApY{}}gAB9F1bS__%6(akZx=Nx
zHqN&<a>wj0KE`#Z?E(O|KuEt9oCG1lZpcu~9fE==B56oC^BMj!&tEtZ`k8^?dhS}F
zc_~^N=4rdrfxS9~`QaSDzjJ)DG?lf;8EwN`%78e3ex7fZ!TE6N??rRH2c>nFhyF&c
zz>O{ewN-a@3nWhD`P@z+g9$?zQx7Ex!HA|YiG3U}J0=eqCFw>oOmYw*hsFZr(0F`Y
z6Bf76*h<e1na6Ao#U9}Z(<ntr5G5#$Jdg8`c@d8uPi&=%1r%>vVoC(#jtW$??ceHf
zM?{N%JSX#tf205C20|u;UP+o`C|Q)>{HtwyUJ(3F#5(F`n&88l8Lfeqh)BNo2uskJ
zb)H$789~y<7jqq9cdr4H)t*y7)oX{lKIE~@wKRoPPDD_FbgL6o`*S&(exxH94=Mm#
zaT(}{@~o<X)t|{}+8}<>8;M`U)We*G35o)LMiA!QK@kZc{Zc?($0OLo_FarS!<k!S
z;ZdSOsTEtjfDJrBY=M$fp1l_kwvMo?QD!<26_`dUuI6}3Zmfh`q!s`IURnY|AfN-6
z#Uf|$a9(CbnbnyNqiui$^d<pbIJyA1wneT<DJf^_l4P@Nc5w<>;l*FNHY%~^fRTfL
z+#8TEUZD|SCe@O+2)O!^-w3&vf0!50d|k*~3?&y%8p^GNS0FyarqV!%d09;7b$+8#
zi9z!qNLPz$o>3vOH!`)DxG8+>R&p~ZmH6D`a2h1LY)=3NFL?&Xeo}mBj8SWmHXZVn
zVlLB>8iuN!+^;;eBf@;-J1Ik$_!uRBPC`){J1%$J1QXkN04-}9A6>K0{bl>yT9Wbg
z(Lgl@R-(Rg@!;01UO1<yQW(gaP)=B`_Gj$_%hID&I26&$Xh(Y^{+6(JZ%YCf%DZ!3
zQsC;p;P2EN3C|uY7D>(($6l{DXYKP||Bp`^+Q06a^lJFcQ@f*o`2v;FDKk`m!J3f?
z^=ovTW8TAVwNOHITEr_ZW=xdn4MV7M1Tsa6IkJ8$Eq5zt?SS=s1g^&&YH^dXjJf8<
z8ReiG8OTF+xU-1|9mcolFcux|WdRmW!HJn8cuGD1ah|<;WShZm7Zn$3k?ew?Q(Q9K
z&&#<zHUh&1a0~nPy&5pq&^r}>^X7!!HThw{!^HDLhJrA55q7ALA}^(gr-XYBNx93n
zVkA^v)^2uqLu@j11`*c2n6cx{RE3_V)MA}i!j=b)T)4K&8MtN@ju_N5D=qmy7JLR0
zb{`il)HF3<C5yMZ!?c)XbpgN~A!Lo<kGB=3<;?9|oOYO#uq0wA4xAW&;V4Q_?D+(F
zVeAkVdZ`@;pN}}*LBE~5YEx)rTWd!?KDC~SNdbXdS>RfKgi!p(x&=#_5C%%0IPT|-
zgz{*;5F0vmAFsIH1{O_**%fau!Y^}G>|J`d_9?z^=0Q0~?_V!)5I?l^evrYpna{6T
z+HNUh9+AMU#jxE<+ph0_@su!vD2ZZ(W9p;C;U41HCDgY4B=({QbsEO#7A~NDItLl1
z)b_&^(KrbawiC$6$UNk`X>5l<$eeU@-X3}IS}&(_URK3ShC}>6WIF$y_3ii18*r+r
ziy(vy$5l-d=`i9D!!9IJ;bW+3MLsD7Q)U0BIjO2|tdo<h)1V}O<g7B`SCBn|+o&w2
zz?OOR?f1`*Pfi4cCIQ95z_AYNspdtIj*)<p1>_E@GezTe^xY57UO%5$-~IXJ4-@On
z`3qpYn9iRq>Pv{=U(DzE4WgGIL_@W6Qr0u!!fg6Qi?ZZWNR|Eyk@y^m#M%@jp&7qM
zGFN)TzKIldz{RY8aq7*%rNemZa7nWnnL)~O85UY{p{T(>#ipw?YN^2(A)o;j*d`*9
zps0N8-MMLGe6>m^CvQ2KR%)@IgF`kcWQ4)V2`uXpzgoA}gi`@&DKl{nsV{DSpQ+<_
z$u1a)C}loMNea}MAweV{F0%c^w{gN9+uc>T(x1;?DpCD^W`Mt5x(&tFH8nY*V8IUH
zxm3#MyvzzVk$RuZKp=lo9R8AG%t|>IN}KdhW#DL^lky5!CpPC-g2j4jW}3G)hrX_5
zW#}9s;+0~^qhV+yMUlcEM)!ov4QP5eHJa<OFE-5yGPiC838!+>4DKgc*_2#yq^43A
z(TFa_Q?kf^L4~qAWH~LVkIBFTFCX_iJ!n-9Wnb-zR7dhpmG4L^fxTf5;A=pN*l=VF
zR?RxI#JXr{Tx3N0sT5p9lcxWAmbF&8X&0F6!?^A|=$Q1NzEx+U*%fzZT^ZO$2E7o|
z0r|>0#yhh&-uAuGn`8azsNFAI;*tT=Y#O&sx4UqEK+XhZfr)7>AkJWWGDwKNU`CNF
zS2Yc@Dy>hTq^VtQmpZAXY}q7rQtRv3hZTMe+X$>Yhg+PKH!H`~ZW?n;u5*hq{c}v}
zZFggnKx&ohavy?6BM!ltay8GuRG959{yKJ2#@r}Ho<lLhX^c@4*aSH)WpT(bW~@iJ
zamcEFuyf3xutIkO^;YU8hJbgk;J>-(=N{32n~%GvL5i>lxI5RP1HYdM*eKKww_-M{
zd7ft%9O%#lOutj_yeu?Q7rNd0s8Cz3qm(P(*zek83G(ZMf2UbF<;=>9;tG(XSG@70
zDFx~+pAiV91k|DRDy!-xDv{hTpf3+$hTKbkT-S3ciflhXICeZl0^daePD7i!ZWIDk
zdvkB%U~i({)EjFekLSJvaW&2E5?CS3_PX65x6P8?SW~3|Y?dcYx+vwA?<rS832viL
z8(!P3{fq6gy`0XMrcC3p9|R#wk(W@0u<d#%=242`m^0f?C{9xQo*6M@$N%TQ|L@v=
zC4n+ax5qtZTKmc(Nk`S*C!K|OvJso$*N{}8GcAYAYxj|PZON3kJPwUyemmy+k&|_I
z@Ej*4P7pAZdbW+QO9DhZ7bC`<DDhI3V(RScLY4fU1G3H$2Ex^stZZ}NWcGuUSpD0%
zy6crWPKIwo>~9nVDD^N#n8Yq3Ucyj+L_O+JpZRgbzT6wrT)A#V2QvLHLNeG3r?D8~
zok)%47GJ|^tm|58wBLr~_&~0IAlHA4<oY9*)Q&|E%KRX3Q{;GwxZn~*QXV3k1RnOd
zM-rbt$OVViUT-Ueo29J$kCKpI4*0;xf4IGFd3zlg`ge=_B=gIjLrr=8;NU!e5cuB>
zgEw-e-I>OJ4a_X`a2y9tgm{Eqgt5&L@qHgr7DYI=V=wCGk=d!9y@dAvLCF5~<=W}*
z=gR(nJ5_%?J%AI%#39r{sT=wT2XTm^$WBn0ri44(XKvtqo|^t{vkH8EO74Er6Av+B
z>sYhT&PHv<UA&q}ztx0lLzI($!~zJq+DaD^pXpM5uS5ERuPuGSAv?idvJ(uikDaC|
z2yqfPgdt8{hOqC1DE6q2n9bvaIXHEB{2&+4Bg#{-!&CSxxVb)$+yz~EWrHLJOJ3M2
zn?bGMgG;;_m1fHOljL)^j^y0@%U2uGI5z2DXikK~?fC#H54v}&J~eiKb+>ZgOF{<e
z{DR0s*t27lL}83*nD8L-<Jj@zJ1YJ%%HW}qYQ0|E0ih;pf+`aNF86&v)MRIufz%?F
z*r}61>iHx^*ds2A(>O&=fO!)8o*lUHqgKQRJK_LNyI*jcSbzg4P0yW}jsqC&KEP<b
zsonz!%{V)E7pOrzJEAOqMoDV>2)j{;5*xTVao`2ajvNxXd$}dQ01%qKF7JLFjswu#
zh{n|M8Dg%RB8(ju#XO}b3Zf+T?Z^#+=*zne&DD|>8~|qrz}X`MoHcRZ2cQ{<89gk*
zW?1^cYa<Sl2BOyjAV|(D%8yjwuRRD9)=NbyY9jl{7M7yVA80mzF3a3J`;e*XR2VN*
zw6TQqw`S+JT#GW)3?BT_lXwjBpOsZ*v$`axC@;n;DMUobM)e3Dl(9N)c%B#6I}*Nj
zkHT|^<GGNI(Z@DMn58l%3wgw|?Z_pVCj8N&@CG;h0ez>k0VtuhfB;YsTpPIHm*7_a
z``3PzA5eD>?3?I+DcX;nD*e7-b;d2VZ(v;-vNVoj7ezjx$7AZDDD-0ZPZDC^i9F)%
z+H&wn0d?9C@bzHn<jRbr={y>FJWOrmd$EIX;t-T1eu5acnG@nD;_2g#n_DW>98h$-
zyziTf_kf-QXoWrojwcrQrN!T45RCSa=<Chx(KxYQHHS)nQ`to4?zFyiMfiZ8E4vr|
ztYG{(D8vFo+Gq8>5A<AnVQh$>^T*^8zpp#HE{g)2B9hn);n3$Oabu3$*!OMM4kDX|
z2mIWf&)?5UHT|M-b0)3jO1xaJ;8r-fuamsr;0ygs*!vF<x6cXUCU@8tAh(S!z?j*N
z1IaTZW;+mn!X2a7wqq1vpHbVTULyLudG=Sy7yexEg-c59bIBNPy#^)o=v?Qp)jziy
zlseo_PM#}5ajk=QeFc?uQ!GlWC@;uNeZN{)6A7Efly1obby-y0s>swJxC25#O3E^8
z^xNvxdS=z-q7tmss*}K64kOE&ygpX7V2sc5o5nbQpk9Y)ZUR>iDDslvT=5oO@}@qO
zh_)qBXBM&u{Cir=hNSC>Ryw6Qg7%fp_ng*6d3tiPj%Dz#yac5m62xkppzczASr&^6
z;NI4Qr<cIums<%>i;|04R5E0d85Zc;XLXZZ7Hk*16vG6{E#UChOWpQY^20YAgf$%G
zT%^o@)eAP47ro>MC$*k!$mx?CWQ8>6WOjNR>%(y0jUgv!;8H&fke2|eB?vr3xXXcv
zG;mmm?U?R6C)V657PXv{Hbt!7x5-WWRPKrQa9v2MNVu4_5kp=QBajyHmB<`P&F9hk
zIF5idQ@y2l`?YlR^`ZvH8RCCZi(z(Di(gHDCnRgODcx1`JX^v9J`wf)FOjY4Z_Y2P
z1;1Vs{T}Gv8Od+o8Iz;aLiK6DpDw9Zc;}C9N1rb>1*s+&8M=<2J{1`!g@b=tVy-S3
zUuRIq6Js`(z27x+m<h3TT~dB~Iwc?8b*i6OFK4uvX0r=f;y<$bQhhsWIyXulHcT3S
zwzOI^e^|G7W9h@%^kChxw@nYGYcVy2Zp|VHN1YAVXZj!!1(%L#n|!}tma=gRg`&3v
z_m@a(xT<^AXM%@L&3mW3xk8p-KNZW;_U^`SH<W00h%F(+#vw(HV@H7QjZoxy90d*~
zo}c(Q_Q|$6U^@wGm1`-v=}{1zfzG3U^#P!qma0G_2@R98Hf|~)ZQ3@g5`?P2r36`$
zE{kjJr!l0bPK{EAnpl^`wKWA{nq^g;&1l`^H@b%FFq^$E^7ougngpdH8xGgvl$Nxl
zRNPcnq)JuMqP47znMp82UL#0$vBIGz*}sp9wB|F5f8cacXYV0BRjE=dajU9-Ntzy8
z*O!G*NoJe_t9o4$lVQ9lEpkmt4)eFQ%db0ea*^bTqPAG#@Q}I$qd4^#!X!vgL>(7}
z%;#}x6DQeO>LS>E#tvG(W5n)Lxrq8pJ82eC%gLR^%ZX6AvYD|&Yh>n)Q?rhX*dUCp
z5V9vr<muzvMoDiYh|9*2?8h#Dp+IfvPXFX(xiVqwcWOO#8b9&Br^8e@x_={8KoUT?
z2Xq!|Q3WJ9dROsbKAnl>kM=}=&~FQo(?<0~C$L?g@=48|uFq5i%qcddMAsgiwaY}s
zrY<3-Em2Zdgkq000_FAmE5TEi?JWwFgO63G9a7UQiprh#j+7<2IU1~ggxqlQzsI7v
zLFypcU~lgG@@5<Dz2%klg+zNVk+(mGAaMMkkgNMly))z2@3a5f<dP*RcOx%|5lJH#
z;gE0?;ea70j1v|GNf6llKC+7rhM?1nhFY3M-+uobHR(3@i9buiICLO#joDFva7aTG
zr9psvJNAPlrhY*C_%nBZmE`ebQS+oIuKox^YUB?wz~*b_ENj29tmaew)vT4Ce=pv%
z#AG~$(@kaSvF+dLd_Ran^2&L|ztMkmGXW)pUO{(e3`!Q|H~(teo)-ka6Uly5Zk{$v
zPtA<h;4HhB6hq2D@vNJqlqt;Zs$`}2nsR8ooAi>?tE%bkAPv!f)`^EehHPTlMw_f^
z0{O{U^^LWBZq{ZWdI52XN|s4UmP7NRx-+QlOjPz>`VOS?<$Bf{pnC~rv&xz;l02&}
zp$Ql}zz->B*3tZF$w9g}mKskj@Pu%5Wfg4s*3%<JY{*?ywQht&<R7AB#^gG!%tG`=
zF04P2iYT^ONIWlpLM+BW><~vN38M%lDZ^>(*>=e8#^^Y{QZj0F{SH1kc_R$?tD{!O
zllh7b2rEO2DL_M4GzRkySMH|yute%y(}i$q{ao>Mk&A-UVwTkf7`6Ldsuq-LS|`|A
z0Gu5%LV$GEsIX*KOi2zwvqfpmi&~}q6=}Yp1<-D9o3lZGt_{q<QW6PFY?8z_N50P(
z!YK(*<WdjWoKZid+>V3bp7Ezb$VKv#6th^Z&sFp_`e;<cVxC^WiTl(#YP>B*=tuX{
zR52OHr{cY1t%1Wl3q4|_GiD3bVtUm4Tl6RaoxJU5_v`)p*B(W<alBwNsjGteez^sn
zLVW)6W7=(hEM6GLuFX6f*$%@p;y#IEj3VFTzD;8mvgm=1jz7Qr;c#-SKRN#V@`u|T
z9DjcK!)E73TfaCq)ISfW#tu&nHK*H0@osWxz-P4EGb2guI87NwoO4Lzm4=A;c8DCB
z`k2Mk3;I5m`#Lk;oWD368EcP>H|H;IabmnVf3eYjfzj3u=Y{&$;kek{aiONPcUsIB
z<vhQ$hyfqaZVwC0f*|FNhvFE5{e7CED2zOmdYs1*PCfEax`~h&tE}dIz4xH5tUE!p
zPJWAHq*doPI7@o%z=2}^bU0OZcdD54x-FC21_z6-e#fVa9S2boxe;=`6u_>;Ma1U>
zMI`ZmVlQy9AEtM*j0vZn2|-h5h}6YkvKA%St(5coctC}!ffSD2!%$d9=Z>&doV&-u
zBGt#c3e$%?t7K~iPg|K?T!1t16u@iwf;Hz{*L-VWY$?epSV?$g7-hgtERaU?7V-zy
zJB4Ac3jxl^LF+bP8cM&ur9I0~W%Z1Xz?m_B!$A}i#FKy_9H%~td=jCQ5=IHO<1~C2
z5z{niZ4fVQtbT_*{@m4bJn+5CNO)b&>6HW9l~MLoWXk{>W|K6-(q<9~NgwVCY1v%8
z3E)+riR|v#uh>qvCGe%K{4Feic(2E;GKR0v=A%y0EIq1t{qB-f?|9Cqd{!T==Y&yz
zAet^u)Ug=Vxg)pI)3F^jvCiGj;~^@!Z?fD7H{2VV0T%8}&=^`+0e-qw{N}0MK@$s{
zNVm)oB69Ai(_COG^h^Nk;@s^#QIjA58J(kEf-ySHNbm=IXKE*iGQDwiYf@0+RdZ-s
zUA-^R>UuXaoQ|ROu>&)fKz%!V=Kk=1(&jE41sIP^-v-k(*%(B8cMS7xV8}yBWM^_|
zfZfQ!grS(Z7~zD+h;YY7o*za$iW#x}WG`~53hUKwX%)d^ytoHR)g<sAZ@-b0ZY8e@
z-}-}zs$xXnf2hZ#)t&HB$6m^)hmq&w1YyVJDB)g=QbH5Paf(xcbh>x)AS4BU-d-&0
z=PmS(Qh9dts)Ho_C?sM1(TR21tu#DB<hoP2xYPBGWaE*+-bOwisb*A09+umUoZLP7
zWvJeusf}gj-bEti<#ls=keSyreyG_y2+msz&iyU<xeCuq$EJt2cg1Q~B%@=R0ElHp
zS$}(@J_7(P!}Yav1)=m$3UTd!-i|JNR8ZWVG7(eag>j6S%Y1~RI6#R<eB^MR5FDg-
zf`dIO6E9~Et4#FU|Lm2Cm$SVo6JAO@kNOPRJRt~&PKpv7rpTs_OPw?fZ5BMBGLg-`
zIAvn#kPgbkV==4ik8TgjL?@NQ?$rq0>CM%M?l5nyMs%xLu10jq?NW_@&=t30f2XM}
z)rjT_G1Q0^bGxw`VTN2fw$<AcqdeZtX>{(Kox5Livfb{|9Q2V}>Lcym{^InJm+&PO
z<;7>MkK9e4Fl5D@35kT;H1KJNf`}7@nQx=S2}9)YH0309sEz#xjjfH45*nM(r@hA2
zMs^s6VGL72B7}p4qsaDuTokxL!XoMgEa_899^z_u9asAzE2|p8El6msh&X@b*XXZ&
z#y}O6JPX@~%r>gNsXIvVUF)M2=QG9L$gLE5A>;cLAxgz_nf+qU%dB9h(5W*~3{llt
zLH!Bm!eusxBp$q)bDEJnzp;uL<k!ecPS}m0?YuFGH<3kvrc$$iXwFMc7iA@MjwW_+
zvW`nrMy7TdI7J%kYHbkhTM^Ehlw`)xj9(j5(j^EbmDGagWmZ5)m{s!k8NdFWj<5w9
z8A(i<lT2`FCNQk48ARQR>P1|nVtrEVoPxAdX?t1OPzUv6WW_vKDYcS8Sgh?Qk%v7W
z(U3EQBjTahi8=Crq9}2>AIG7)m0jdTXI0zKUb$&tBF(LJa<XJ|iSI!Msa{`lv5Rgb
zA(Gr(V#BH3B{!9IB)FjzKdC5n48{$s<}(5zwL+1GGzh%3F0-mGN|^AhYRwdoY-P5{
zW;_Q{q-))o&21IUJnLax-pMl2zjLS`vNTOFVkt`yCJsk`v6pb<1SyGm<OjswLyDAK
z@Nn_*b=vO3A6uh|RV~VtP}s$@!Lgv1;BE`qKU~I73*cK`dJM?@dUj^LeR=+kG;T58
zhQ$*~`5Xq?kb5nF5D~OtF%jQ?5Jom_u>#1k42Hi1Udx&aY@g5_5zWb>()r%b&T?M&
z-+pSbn;DsZX7orTGK9G*DqxGB3K|><2v5rFicIy7za0N=SA0}jw-zh2jNNp=sI-jP
zR5m_HBVckd>6vJhYqRCwWV8R*I_gf)2)mRxmfmnadpgZ#tu^I%VkyX@qVzmEo+tvu
z?(bQ8Wc1PGFzu0#Hp4Z0Ipkt$`Xfp9moRod`Ngn*a2V`MJw8uWsAcjLwOdgAlV6@T
zO|@ecn!n8Jq<?zy%hT?-ziKyN&lj>*4ew0amI@X`2CUbv9Iv?z_DXOxim~f%mCt{W
z8~UdP*SW!zwF4EBIg}?hp~z(f@c9J%3{HTE=Y;_YlgM|rN`?1hBeFC?XkS`hA%FGW
zTywF1tNUCCtfpvgFzQbPStl|tdm!2GOUeU5xh~|jDv2yjUVTo={03c<QgFvhmi=1@
zXL^Xc70wdo#!134qKvx;$1z33VK(9}r9OC#Ja7NP*>;QAm(EtNW=UpOQX)6jHNP<g
z@;xlC=zT*0BRE~Ze|`|g?pGL7UcUXxVXugPeqg%0Mg=rw$9TG&z0=@s)TPEFS?(b1
zbwxWlCEd!bKUnr{MZdcUcMYFrI}4jgd{72fLD#KU<RA$iBth*_P!_~5Qp|0?mM?RB
zU%eRL<bT?!7#}hc`v5BQ2?&0P%Mk&F1{y|*<0OpWG`deu&{{!Qdx)f)OkO9-XRud)
z7g20;-^CF@F7*I{mwG4)Vu~pCY2Z0DNR!Ru%&nhazcNvDAR59?&-094Sq+t}q3a-o
z3<}ViByi`x&j9(>V3o32U05e4Kfiv35(4?TTJ*um35d<o`q@zQ3m=H${Uk}Ts6`(r
z^r7lfErOILMc!ftg&OXDkg-W+otyxF`5^_)&yy3K;%bk(rSCRWFgq7pK<Y8SQUABI
zuf%oy0DCq=DW?I#QIa4MlL&cE5IB*W264PA!v8;?zf=;Z$f^J<qLP>!=?#wFkd#}m
zve{Lo*Gp|7r8eosmH^8UbxCCkAn;G5G$=_fDOn+`lyjl^h#2rX10LTwDX+kP_Nz1)
zu<c%y1Vr`@Tj1~7$Et5nt)I(W>}_egHA)DARL%g7CCh4I^qCkb$gP&n79eW)R=&{K
zip?Lty?HCF>@t>IC<sPV1jw}3G^Gs3qS9xwJp6muVL4YqS)n8+<&hr9uYyw_sae#;
zbgC!DQ?kebeP+X_)MyG;Rr9%joXu967B7#CV9>T6**@DApZ}ocW+ulPR=UeGD*pfH
z`RvYpDDz<#ghuppnTs5@D?9RYnct-ci<#gpfIpAsWj0e;YR5OhAm`cf1P*+a>H+rD
z5BkKEr+#IbJKOrHgpNCtW(?-O(-6mH-Dvm2`fjMk)n*4B5K=0dop9TKPM8~TT_>8Y
z(e`1uAqL&~S==(BQ*io-BhKuM*LJ4ek?XqB+aiMw!NwT$q)GZ9?>m(T!0Zb)`l5H{
zaX&9H6eUAVS-}%kld7UGURTX>RTKQxy^{r$^0|3q4x-lOTn*G42QF$rqO5#d;!_9j
zy5qW03v(N4N&8oSfSL(^#3xeTtQ=FjY0NRX&Mn6D&oS}0-Hm_$7qX}eRc@J#exDNG
zqRg$Uc?Q<kY`#0EhR<Ek4G1EFM%#5llq8{#Z0>m>3w`F<eLTql2exY*m{xz3u7SQ4
zx{T8QTczn<b0>fpE_Es;j2po2LCOTuQIEDxpa2qiN1%qJ12a~CDRlrX>Bq$S%WI1k
zjCX$1nq@@^=$W+6-UECqxv_GUqiH=z?72)~Y#B;NR#|)oQ!K-@)VOENddtbQ`W>W^
z<5itqkeXY6d5uK3bXVH=m};I~fvO>D;P9<pSd>iXB)ga`OO@bwrgEpgTh2TjL_9=J
z>;(w>DMPUnL@4%uY{w=+;Ci;ZRn9+gt*iN#`|k&mLqfUXJ{)=_#ZHqO3R1Dja5%DT
zU7;B>TB_Y@y2+6(x83$SwccKG3EL3_fm#9*;aZ)XfsJjz48ogs`q3iFmM+c63WXsL
zlY~&jLLajEL<veLkC7cDiIXtLP15`3xX{yU%xjz5VR@>50+?}~-$YkoXz4x6i&b-a
zIV<wwBIDH=jHfJQnw9mdwy~N`E-pkax0;t3NL<{^bi6^%yeDcLPre#5H`VYtgnBVO
z6;G{Ip<nvd>3hUK%we=@)?@*QVKQqwRZqK9+I>af1i_{&G@sY6#sl4Y;ceoJ@3q{x
zOgj(2KiH^$w@)F%gE=R#r;fF5E3y+9rDb;YMxVU6=%`Iy@8_{d?zyyV$02&$s@c7z
z5bCa_GId{NGxjtCw6CQqY*Jcwhu(c%q~d0#{@xC^^PX<IZ44xsVo|FGMMdjgUf0OP
zSUHmOit;0+_1Ob0u{$bKQFG})ef)Y7aBLMU6Ybi6(i_G+^?8^eKO`VYI5CQ&I7UvC
zvWODy^B}sTBq2Q)_b5lm1|M3AFnh7N3^5`~;3#&z$Z?U6v5jzwLli}kgWS+d9ZZun
zi5`S53+}`_$P!H*pSv(2267N3wh|@8oGlR~#Ix?io5gP}M0DG1L<r;OFH(RohrPM@
zV7#?|t?)4N>gooz5gg3X9K?og#fDu=4@n$(i5EC1pe{!^WIjq<>LborObH2y@3ZZt
zhb8G0|MJ>;UNFAQJ~osm8fu=^X&QS(C+d8Gn@Jg%M(*`S^qoMQ-<vs^TJJMrn5)`5
zY^shm>rXtNSIX9=O;;pYRAadomjb2xi3e7HixInCZ;wSu=yL}J++he~o}k1@DGDRz
zu_R1+5<1(gH(dR1D4BH(bxkt$k@dRuB1@<Mg@{Tf4{I%lG<HED+Grp_WgYR;i_?jf
z6zpaq1IsQUK&-VpR>yixo2;1fwra2;vQ;pch)6ma#+Kh$e422^INR+i@BHI-LqBnU
zBZ@f24#E^v1KanJ>j%td00WBYPUOxFgtTckgS%tk<djm{s=L;#gnZbzlI|sZJ8^Ms
zke;=HcqycuQutvz7jehOTg<G!8L3<K&t=|xR;nL=c@3xOxb!3<6{Q06m)C8-L~LRM
zx?ay4)DA$3X~z>;vo<5%vTptQlG??8X?)A7#k>7_;ZVAhTnI0y9juCrh;jH;Zb|*?
zK-Sw#=2{_UtyxJWZmlXcu{T*Zv!bQt+NzeWky+1pp~+Av{8~*%A{>&;FMG%W)zg2D
z=STYR>_b*Hqm=sxYWmPE2ChQs?;j&MYTVk@Wl`4Ok(!@N8K%LN{#;Y2|L^~Q@=Z$e
zivRPUTjfy-c1I;iT@r>aM$Drw!fxWCBw_@GgeH{PK@iaW@&l>^`1PwNaG<~ERsw)U
zEs7X6sU=cLBas*(;p*HU9^9tBYn=ICI?!gGt+J*r+hqREHklt_n<YS1YDYf8sY_6l
zCNbjJaa`B)cpUTlK$S0}7m87T#}Qra6*->xq07QJK~6|)ASt0JCfI{%u{{^lG>-cw
z<pZc>&!7^CFnl!75`mRm1u)U1qkBP?fIg^^t8E0pL@3^<NRjMaiy{G9o1(nR3&JLb
za;Jgl5+gbhL4)cyQ2RSdpaiB&i;}NJpS&na-8<D22^*Pc?x8L$rQ$Vz2$Qoy!KGyv
zP%Uw-U1W+Lg|gxU153Afqld2pql~yI0_KH*6LJ(g4o8^s01?M#2!}YvQ4o3&Cp)tR
zDeSNjL?RWip?%=ZWpOS2HR5VqR^ebjfXWXMr83f>_mhqa5z}bGkHmp1x2oFLFxJMH
z(6=3dgxgpV<fj5CUrDilE4PGfquoupSoqf2Ld4zK$PH$zcX2w!9EV{HJb9c^gekRA
z90eX?sU0%M#gQHCM)^NGv;N3uAR$16j{F7{oSlG#Qe_e_HC!Mr)plulzvR}FZqUUO
z6*;!4ALucg7`h`{8UWq~cJzY8jff9m{w1@U(EyX<jr=H|t17I22C4!8HgPt5ReB{U
zA@pe%iFG>@y=`V)$c;TFtmEAov4em|Hj7aj0EwPQQWQJfM;@~=Wi$<9m+jY|E(qSi
zr%t9*@qHEP_zm-9aK%`HBtp}~vn)+{DQU}$+oqM7<c{9(_%Nvxh9`k}0<;CcZq3s3
z_Ptq&=Lein4+SoNm@iTqBZ66syu|hs$BS^p(w#|Ftu!Ss3?cf$yx+y`(!H%Isrf|#
zAQ~YgDH#X4{*6AMCptK5Vx22Gn!oarWwf4H-<Ku0;K&7+61C`U8^$$o$Uqj08!1yI
z{F1!SfXoJ7oJ+*!1(`2rjO-sp_v>pTv6FHDWu?9yLI5^@#AZ;60*6ryI&?y|;`(eB
zSFGxPC{<wj%6|H|a%n$({Q32(PannNe)=d^_tQru|9<+I+<f||+xYZRioc&e{<Ns`
zqPUuT`Y3SolTRO?7xOGHYIr7exKAIS&F9rO&_6Z-Dn*`8K7Bkdu6cQ0WWeGtR`}CL
zy~LkBUSDQ^^zze3GN0#}GMat*NJ{?cBY53DeN0RKkA+}A`t)&8LFdw<RNXfOZFp(M
zK7E`QFo7A#KYfJV^XVi1FfXb_x!fn)KLsAdTSvL=r^Jp>z=H^3YP*QoNs8Qr2b86R
z$DY5}Tdlo|dLO;Il-jRddsg-5-e}Ns^|`;-pF0<SpZi?$-86cbG#bG7F8D~7fz7^h
z$={IS4KcrQgKer398cu?>P+6~eIt?_-dCr%I>gu2@N=01B;e)jyeuvN^RBBAXFnYM
z8`RL0?Tmplbx$-kysWwpz&Q#c%V(|V^wwKzImWNT5!YK*vzWes?XlHU1-rkCqUH*z
zQq50)ZIk9In2k2SA3S`fhi_9C-d5U_vpX@xaT83#2!+gv5GIVGDBw2ou^0O+AaNX!
z`|+=7<EwV9DIG~mA<_mYuBA&dpK}caTBRb5JJxiK2i<4XtG08{nd^m=`95-(PZ4%V
zj7XHa$YD63fkQ%DIM+57ga@|cjzGLq)Y%GutFmD!ZkrYo!$by^PLx+;VmLj(!J#DP
zG4NSNFRgh_YVgq;xHBQZg3wg-?8v5_S=zbf$0YP60w!vag#kn`sV?zZT9j0z4YR7t
zVv#e*dr*N_<)XfXPinWy)ULOZle%_HA`f|x0tP2ZgkloLh<Jfde4AhgZxuHyy=q#2
zc6g>ijD=1aDVKgjg-h=xZ4COK|Nj3>w~UCfP<{tZ`)WAHR=FaY4JMa&cn}Wu63qp*
z-dVew+MQwStUS8{)_zFdQ5KZTJtlQ-*-y~4WeN?*-qCKUx>OL`c5l@S@q^@VDk{TU
zwGX{(=ZBQ%$1Y1EWT&Z*FpD@!Sd=1v+qIn}atQV#yw_`RiGQS3zS>hps$bijHD9%w
z)uGE8(~*YKf|%4s$<Q+|-xkjlUQy2al7jM~Dk%oJq+mnT0}{4eu_Yzd)6X8&sOMLy
z4{{IN=7g#zYFpdJ3~I$hY=65mWsN^b+N8d6htQfB)n%%Mx3e=fvR&+iL5S>sG>8%A
zE=O?`f$ckWQXFxd_E|3O%~8__On|$3Gnb8A1$DuW=^i~$_`pK(8}TLE=E1YllQY5?
zaL{Eo^y9cY+si5AZk*r%xsc2pCn-fq5;(|?u@?k!z(Q}kIO`7BsO8oJv1^5hsdG!a
zwi3{)s-PJGLAAeY1$?XI7g<$*i{xJLDj<e<RU4ttvJXaHa%1aFjH^?cZ(Ciw(0r~U
z-U<Xaa05Y9HK`XRhpI(irCYP7nwapIg3?7<u24Ld<tTp;G0}AsMgosOrbP+?a~u?q
z01*}hK2M`C3ifcM!OhfP`zLCJ1tggm@oN1oA(CE!u-`ueD|2_OcQhM+8$+F8<FZp1
z!8}>Mp&B#HfV5v!@vbjF{Ot)0`<JJp)`nnTRNS!Zt7iW8L^dRzKKbS8ShG+{I!gt9
z<cW$fdH1DTh3=FA*_g1srnmJUO?q3$-nnDg#yDk|qcGtCBo=f~9Ab(RA9L)4)FqMg
zkYIDq5omLHM(h=79{SvW$6gvBJEAtiE@uEzj1i|SaFWn<nAcOf4@mQ!Bh5h)c`Z#o
zT`t=WNLC)N_k%QVtXR@ob$waLTTVNV2k2~d`)$e#vkt-i{j4nV94^jETg*giCAtu)
zWJj!E(CZ<(TN%bEfPKjY*VN{aI#yDP4RgnC4)Aqi9EFkNAQIz$1YzF`Q51$81rDJh
zccYNHTZMANHgN2fd!S1xxPg@F*vb?w36xbeD+JLYLR&}flZL!*VC&3gEPJ0Zv6Bc`
zu{aopgc-AMz^qAm!C{}QSj-&@qPt^yinwD3u7hkIM+jqzQRKxjiX59daq4&xy$@}=
zSyi=~D{+sSiP4CET-wN6_ZF0PQ9_6sO)@IA1==SX*_@@O&fG)*H=K6LUe+>s_sCej
zCG4H3_1!ryA=MguuVABO#Ujc1Q3)a6N5kgN+9JI^A6qAmZBH!sxQFE)R`Q#t_7Z+I
zqmY@tO00rET5d#Wu0(3ncIY7Z>Q7nv&z}79bWo8Hv4!n_q$$%IA(Z%*C=8$V+b6#~
z9h=23-O6?+ak{$<dzGkNe`gZ)Xu2a~s|?0rkB?(@f9<{Y*Vwp&?&8~YS4?k@tGwhA
zW6(00Pss;hJhxYm>-NJ^8%h|*_phaS_Wt+OilNwh+#K)TmINe5<0N~hnLl>1z3~Q9
zcl!Z|Nvl487Y%)E1coi<E3h%_oEDUXghwRw5hY=YaGY=yQNj>&u<sBrVO|{USUWIj
zLhoHS5RHFkn!%p*gxF>=v8jjR&?b-?IYJ2!T;wHQ65%AVQ!jjMdV<_LyV4RwZ5!(d
zimq}u8bZJ6Tj&S<Dn_(}evxtApjT=`%|I?iBlGuvDmiEc_n;M+OK{K$4m!bZbOPff
z_>6UegMxEVa1IL2XRF}sTG(Ych{BM?$Oak!49JWG+W|@vOat3tY08rw>p6ne@PX7E
zX#4Zja(1`kGzhru+Q^PQ7hw+vDB`Y-0^%|nMvR9fer)QE*fP7)ZlJP_l^ZC$E8V8o
z@GVq-n_dkgnoY07xMI^Sw4q)j)}T>qx>X#sntRY{j0HF-H3y~Uj!I46xbgX`G+)$U
z4i2b;1M1*_`fT;Honx0g%sKWs!YoY@ro=&s6EbAGUKHC=kT_xTppaJ=H31nyg4rYJ
zmGgjl*zu4XB^=?HIEX|sLrLnVl!t_-1aGW=vKnYd5kzM_FY=rug+#qr=Vj4Q@3(3y
zLP-ActWuef86YJ=xtWUS4V5qDO2-OUmstwa0D&8Yb#l^c^yFlsGpFc8ddbb4R08=4
z!632`ps>9bDFJ~9h?J!asLH0m`;-9ybWw@u1Y*%5&pEkRh|GQUsX0oC`hPjAd7fu~
z7koy!Rq}aJ)|Kpx%HK2B+35r{vjFI4^V89L`NuKn$Raar%?X3_b~-A|wcTJMqb7>9
z<`7h2ot(UUYhChu4qC|-1U`%Gb{Qo(supwT0*r;1RWTE@e{v$@EJ4XCXC#MLX8bz8
zK~$*d%&Pf}h>SEqYXvbiRn2*+)XKVlxF#jDN<J-WjtHefNiQIQo|wRr3j+WVK-IK9
z9l&mDlBmcLbH$c`Voy#$fzmM~@T|AU-;5AF3$U&^WQa4a<_ekHjJpyIRwnmy6J4&k
zo7+cemO}`~yr^o#c%Hq7BkDh&or{@xPjba1C9NtmW)U_8bnYUVW)-OQm8R5xg{`9+
zxdcX$yz0!+GW73TG0KI2D$@*>sToLT^<TcV^s<YTQ?!O%(vJVsdd(q49j%)TRnQ~3
zCl<3QnGs>tf!~W+wU`1Uu-*`YQY+6Y^;MXiV8s;D=S}2%aOg^@8&aD^_e<`UYC$id
zYkye?X27a~Y8xhj8}Wq${WQ>jtYxJj^a8qXNfpt2HK^q9BAM0J4=<jH9YXS4?bV~_
z?V$~32H2{?@<A3rD^V+6w}xrrc+yy<L`3?$%-&}?*YhEkG^^^8)P-R>OS7`-?(@I>
ze*TBwCx7@ZtIEY(oKPxXr?PaxFTH*I`?KT^zdxJ*;g_S!x}I0xoSj{NUtgcLkU?5Z
z&-e^2sxxgPJ4^E7;>@*O|ID$^?C^{=%^}qsYMMh$O{j+E&W=?dpTnL+a)HH068ot0
z^}q=r;_~?ixXa}k{*6Vf%f*z;kOVVA&WRap3U~o*jY&~l-C<C{nT^k!=uCVwvU^B(
z4|TeSpl`_R8|ropH625Lx?|1o!DgvL1R*f_8|$*Tw#eZAYCb90T)8|I;c_pFX;$&O
zjng}Gf-@K!DrTs@<On)~E{khK`pc$2Aq4$EIcKOYP}`4YSVGUyCu2@#tfB;{F#qC;
zJ4Eu;tAkPjQ13Q|@XYnj#C@vv9%@=e|8Nl$Lb6drX0Rd(^?Iy-Y`S|Ct{fq@4DG{W
zLWL=>%!DMnGqKXAc4|Aejcf>_!inpmn0g+v_5XyxyAxaRpEzM6m2iK<8n@<@!znE3
z&PAv=&t+7~oR=A-$rMK-BsCBLu<zk&oRjhj>a9*KmHJDHT#O^Okc61>BM=`BM9#oL
zO^Z_0s`{YBuFZ3Q=1!}Ns>h(AS|8!zSel<+G~OgEGYLBWi_FKXKQF5KJ9Vkcru1uz
zStF$$iSDgpF>fr_-|<=`nvf~c<ZLwa2sDH<N%1kUekw)I)QMuyHTXwVYg2O7FxS5^
z+G0E<iyT_FJM<PUEryYS_093|q&tY!vHiCgWHY>OTvj`OMtAub*L7yEbFdP8b(@)x
zI2khyN;?VOx=C2qn|q%MBUa^B+d_pBj86x?&2)5obng?QeOI@c4dHAUp9=prQ(^RF
zuk!%WgZ0hZY_79B{`~rt`r!YAl;EDd_5SD_8xY`YRH)}BST{Et_ixv;1UJfUjtI~q
zzcaN+#f)x$jyfC}wQO%!qv*Rip<Q4g>bWje-&H<s)vGU_j{x+2Q4{>tONE%#xg3?2
z*ZTejHDv>ri34IH#7VDwd)(b3g3L$!Eo~T&>3M;S7`w3I%IKhMx|qID+$i5=7g-H2
zI5PQS#X)>0<;}`5wVTEqlPe}<V3%yS*5ChyEb3x^2@UNC^aCWVt9fR%%eR}H#T17D
zB?vo^v)D^8ih(L2j&Nubf;~5tyj^=&WDcwYg5w3w6GV2;I?z|6&{E5__0xM^zR&pe
zw%h~jbIr*sqq4HPqsJ|?aVyK`?82~CYK!;8NE0V4m{xU3B<+$kDUVnqt=3Gd?=@w_
z*41`@2tk4I6;<K_wyx!6J7y=Hi1sCmayGkYt)*uJOKHo5@P-z1VFl!1=jFX#h`9yZ
zOqmi2R{oj@I~7c)wo4*f%s`oz%hxyp=J^8H6O`?;`B^YN2(zioC|FIb3Jg8M&R6mj
z6lYne5<M$PeF^r_OCn83=_1dq_i*wFs;N$YcdOH3+BA4vsC{H5F#n}Vrr@Tb;{|q#
zoFMcNj_edgUf>{~q%`sf=RwG}f)R=ahX(T|?b{GJ_*Xd?K}6gb4z!&>kP-JknPxH@
z_6uop)$MM?g<-uB$qB6~kw8MQH$W8{C}{drD4EVlb}`!qAt>fS2v?V!h<oRDH%0${
zqOb`K9k>}HP7{Qg6QVd}9&+r^$F?1EYVSYFsfBKCyEe^6m~3k4(cdC`&CPKk9}Tw4
z>0LNomm7k%Vs%|n%@(|_{aQA+rfg`n>bxT>Yt_atBX8d5s5J9x@7W=X-nuM$%hIoJ
zoL#R!<=ZCMTXM*@1c2hW-Ca1T7p7i+LIdPFK#ZMYibxW=D2!4&N<EkQ$#z#`o9NC;
zN=~j=aXlMJ`zknBM^4reFSK;`_H(nsK`HR^%Wf-w{IZhu&ojQ`8!Ny*@nXVJggpY(
zkqL@yCqRK6xjgm45aaD9Qlw=T*{w!m5jq#k(i^H_x4pjPO2`tVo~<yKX>QPe#s@to
zWu4J%4$kV^%x^~;XcCbS9HlWqkso^qlf*|+<YMH<aYO^`@d)pMfn99D%7RU}!B*?0
z1zzsx+3rq1wVpNCyAJk%sv+I96nTpo?=+mLWCNU83nA6Pp(R9U(H*g(l*}ytL6Z85
zRFhSm&1l`UBq}%^_=NU;<1Y7q_w39~&{ko33M9k&-puiXMosdmJsG_RZ8q^919_k+
zsjQ1%cjC{LXTSKw<{97F9clx0G^Z3%7W)W$k&lS$J18QF6Jx?yl<whZlh`kIhg(3M
z)oadwWo<FfjbSv?hKEBhFiG8UPpwSkdi!3ruYZ=g-X>z_>u2g6Y2Sx`{{mF7_h7?3
z*|PlMJ6U#z@A4CI{K!c$4pE$V9O1|hQG}BS@i0n!mIgkd{(T^X2Ot&=5tiReV~gA;
zLfDPG)C&?9`P9b<lN3nCqY!x>!(kjG%ujl@jRP(2?rCu)oSNhcZ~Ipb9{#HU6AOs~
zFvQzhrNPp-1dS|=Lj4ne8Z5+M@FW#TkLaQ-uHh}(v6gGAQYuhqr`EFuzTG1DI3QL#
z2v&`?lX&a~%*nEn(>lMIXzX(eCI=$XtGR%OgG5X6E9lu&g2KUKAxz^Ef(oEbm3oZB
z`765IAeO6B>swCAqH0Zz))c_s3Ac)wfLYarMP}7CFHLALbh5I4Xby;2$RZ$8OhMI`
z#iG>qbj>!btkv40E(WNwecTAV`b^a)lW3{@v?R}A4i*v@t|q7`t)vuix(-}ZMqoqk
zkkgZs#*{AZn`|nPoKkA}W~>iFh=<e%klEN02dc0XEwR}?&x-}KAi1)vrsg>Zz}by;
zBpyAR&lRBR)OuNeTi02hTLK@fv=7FmahHibty7&TF<)#`s{k;)<YE^8&MJ$%Cs{83
zA<*e1Cu+UhUcP}znDP9yoq~;#)uY={u1XI}{k)i^Svj@H4Cd+|3(%yR94^+?4D`3g
z&7eFia!F?#J}a?5dz*6<7_Bg>8mTPe5oQg7yIsdIcz1JuSZoUPR`kysns{XWL+?c#
zIex-ujAHKC2=fS|*a<KSBhQW@yC+R{1%ovAF$7kqGYqtO@!8%H0;#_p{n^~^3$V__
z9zSn|REZKe-rO!Or@Cv4?lm%+UQ9@wqm3)2P6@WJt*0PFSNt8=bdFw=Yf<ZWq$Y-X
z2Nk_ku#_5q&d{URr}DSsiS@I30-1ixBclX_zrSS19m_g=N+8{eVKw!?Dk#a#>V+0?
z^z%z5Md$w|gyp~4zZ_4j?~3XAlFl#3&AiCUr+`b~BGm~0V2NT!|DGL-5C7lc%l}n_
z&40~m>)+KG@M{HP7Uil)byHdYF1(k&c0vPw)d=Z-UmMl(*NdXK$oa33O`iWsrsThh
z*{^eQGbj14y7I*wDCmC`gzdko=z?D%Ug^3h*{{=-{0b2k;uDqm+u(G9@q@EiY+(5D
zw3u~3+whw)<1#3T!y0Y1abBzUjOt8NiC)2>=E9`vqV~sXh^!E6*5P7xQ@e(8iM_aD
z1V68T=>E%2K!Om!#b6+4Zw&-iHM{H4H0yi|bedjk>rERqHCUQ4B&*TrV}z)Ewnn1^
z7VU9i(U#aHx0ac%=9wulB|M68z+&WZ!V$K8ijs(>h;r__*rmy~u9y+&egx_v=%J($
zzOUuUZjL+it!GxXV2sZoT$NAYGLprMMO{IE2DTZ@ZQfOeCc^%2AUd?Dra>H_KF!PG
zqU6<b7tYE_9l$!YDJQ`(jiVHCpT!9KAw`MpM~FDF&!d<VYV#e5qs@HwXR(nkkFuUf
zxt*xkE!|}^+CuQ_nKf5Qf4!nBM8KgD^KVa#>;1_uL!n?bilLkTe5>54pY4f%5B`3C
zL*iQD>fhB-*Lwe(BwJpTc$A<d4j96&Lr_c^MM0cIgr_)hB7d91?mzmL6YB_098i=Q
zxtUl$zkPmeo_XU(oyw+ayeWf`tC|SG<_M|*%%cc?w(W0hyN%BGzOikv_HZj9rIkxX
zT^Y&@Iz2fb0z{~4&1NcTA~dUT10!mG>S<%`TWxW&5@p2_&XRR@td{wYllK`IFdEAi
z>fRj*udg|uSq_F_gQD$<3HbT#^NIBX+`A%Y`-?IYGY%?D2_|OvaV1s4DKHyawSb)#
z7NGh>C)EWawd!oDX%nh>0p^+od^1*&rbrID5{SXu-5FxyhgU|BP&@W{j8blYGlbJ1
zMUj&*lzLu>S?EWuyE9V1?j{sFqq7aw&V#vdv07)b|4vWE#)DlT#Fo3>EubX|BVk`d
ze1L1_e-{Q25VT`B(2ri9>fa&F_WGM>fE8$7ml4qIgQZs(Ja{A4<f*_LwlyR-stdiY
z|EXA%Kfir$Jr!$Jq>RYwMJ-EzTIeDBR23cko~~9{@oe~9Tu<sw&Prq+tf+wIsR~B!
z^9}+}{9wZFjA4n}#d-?HNJ{D>aDwV?{oZoyiGI)|l%BMUqY54$kN*axzp=$jP0Mmu
zxAQTk|NZUBpVYVVo&HvYpwV=9G9rbvm*1BlGOT1lG&z_i8?YkwrGqVhY2R8AVlD4m
z(70Up8mF{7Nd`V=^OB%mK;qbrk?)5#!YL0?#8Zl#Bu;RM{m}8qHiC>{bkS~~Bhw`|
zPSVklZ4AZFghW8f%1S`4fCs~Z(Sg=R7z1s~%8TNvvhwUoxa3rmlhzp`R6Jr`^E^k=
zvmv}s){%_2Ak%ryCBmqGx$E0{THu4A-1v@HSM5(m?8}?B__1gZ(rhxI6Ut`t&=X+w
z|DU~g-EJGn(gj}yeW{kHW=H`baLX*!I<9oN%B!=|9@}|(opyV<;|2-GB*6wi%c_~0
zHSaKQI8QQbM+AVtg%n9qvg~C3aEc@l_shO~``h^qy`i_xfAy_@o&RNA80XHbBD;dH
z5`{MDU<lQqf?QVPM!+G{f=JrZby2DnuxW*KZq*@kvuJ8*;2kg!&6_o!N<DuN01Z_y
zi)>CcUSElEz=ixHlvlq{o2B7}RQZ#X7mhkJd6iWenEhLKQtPEsQqgt3nh6l`xb{g&
z(FsqXCAfG*E8N+C&cQXFvDYm{bEl)7VgIkXo71{x2b|oh4{fux(+lE*)JPaEDG;sI
z+v42$vs|n|>az%pL@rCk0mSo}(86e0(KOXo41<Qu8^>G6jkb>uOW9&aAfS|Zm<1`4
zsqhdHG(eOQ7rBXteK!p~Dcl2zf!5}4H!%zqyY23GV`P4R{_^eXpP&6N=a*-H{gb_y
zPoGtAT}xTM|8Q>Dzd`kLE}UOq|1vRBzu6;dTfwa4#nnlv);EmdQYk!&O2$Zz#-li?
z$(|hKEON6KPzJt4ew`OXf7x~ds3m{GM7&Y1nagk0Ib-=;@|(qTGhmjn+#c9kMpXb~
zK%BqdJy$>n@Z=l8f4WZa)^*iAA9J&5|JNJIvt=e1l`8L<UK4$fSnCqA1mHK%yWm+c
z<9{q=b^7M{)bTLxc<*X&<X2Y{HaaA?&>@=5;#@j!&YMqb^#@aSZz!Hs%C|D`gxRH6
zFrIXA+wRY93)kotrY2KM-LCm(B)=@-T-8+%8g31bEXJ10f3vDOhx5SbQ5v6Sk0U%_
z9Uo%@FN;whtp2IL=r#_iEc)fcacG)kwXf^EZO;mD#_O)Gd7?-AUKifHx0N%s*F<xM
z!o-(aZQ8P&9zOKcex?;ACi>A*Rv)iv`B7mD7S(Bcq|`I_Jf9o==~W}2469iOGlfO_
zdPcc&40o-we^ciL5Zt{5%TI5CPMx1=`wRUtT)KM3>NZZzXpIix8@l*Z4`V&3m%EG+
zu8Z%#r+;>V`G4q6Y^tUupLPbK!}3o*Nyo)QwbLv(vqv20ZKGS(oo}8pC$aSa{HWWY
zzSMu#Z<LO1Nvo{t&+xmN69<M~{n|_s{05WK{!~xVe^JpLQ*`Zdeo%sQ*Z<ZOT_p{-
zR)spziOY#dBZdUS5h9#$#CYT)k%~C<d@dqPo&X|xfRKGqXtXO_-zTn%5*Bboq>v~M
zu!q8!`3!qr=*d2LvbRY^_$99-@KpX8`qU^2s)vnnNs7#xoJ!7XTh5(UhTm%(Wy_{v
z5XKn)f3C(UBL(DLmhy-Ck1m3lQT_><vk>rPUi|P+82f%0{-{9824>s>jw|s9+#P!2
zJ5U_wU+8@Kqw`WDVsD-264aUowsc6+4v3KJ(PSvQLjhiHO*L$zo=b;n^T`x`UP_*&
z83#X433SEE&{9+EYGv!Z*E8c+k_$i@F7s?rf0^LCvf(Vvc}8bQF0QhLR9NR9ECTH%
zn1X2OynHux<QK_TRrVS9LOK-7;Eh>jGhs-unM@(}&(L}(e~bl#1|kqm`>WJ(<q0dL
zAtwN9i>mVX><?hl$-qmcxVzgi0UW0NQ_c3EZ3l{!dyy8jtcn!}K5*yMHe~@7NuGa#
zf0gw~wsgesDlmCWfZ)_&@;WnR)rbQaC@}0OWWqH7q+Y)I$>3#k3Q*h%sialPW^uk9
zn%FRiH$CeZ-E`r@#yU*SfPJ>qEvRzU9NmS6msnepM%E*p$)a+Geob&JW{a%KR67`0
zlg8Mvp?7EJ@Djgn%rmrds41soHO#bGe`Z<ac?w2%13AC_!BGmbcA^%tA=x%PG+=fM
zGi@0cn?=}LgS9beTX=Q7N?}SCSH=v~yWq0<as;p(r70$9>Z2s}1R|6qDE4C?c`P8F
zh~iWx>>zd?&={c!yQ<D=COXG}j@Q?)%)b8oe0v4DQ>KaAY<219=Y!vCoS{?yfA@lZ
zlD3`6>6P$St%Hs(IaY*z%*e^(MJW4K@715KX{F=hUJCt9_f`A%!OQQ|F$3`A`kU^{
z2DscCvbMEa5gTg2gZ}iD;Sn4ytcn3*^Ku<tQ(dRsYhi?3^3rWkq2t9HeQ(g-H5E4K
zCU^njEPzG7t<Br6wszFlRHGk|e?n(HY|HnzD}T6Tw;4Va_1xA)*5OYrkg7qP+KhkS
zas2WFLQ%KFZhm9jh?~%)z!tU}vmvbb!!jF6KS~oK0+cY$5%E2VC=Em81+njj*yo-X
z@8Z4eZYPUR3XoN|%Mm^hjUvxe=Z{((hV8Be1#_@=quW~A3xz-h&=0r<f2jkZaS#v&
zx0j9(oYUfy0a7XGhRWg6P>AhI8>Z%94aO8F369c$p@4fB5gJJphr&lZPTar;#X0GX
z=23z;N)Y#!AT~=4>~<*MO<UaT<wm%zvnA5@d%NcVfVevVcjvQwh>DFoOqh#gf-#_C
zBSgJ4MV{voihVy7obL%Hf9dBva!$JkYX`wlM}l@>C5;_^kR8R8Xr+V(y>`~~S^uyN
zaziP{7kOc;hBh3fcHd5QIv#B+(f-&A?WBbqD)YX|Z3mwhc?Cd<T9KTCBC3LJ+sNrI
zs6|T&QaJyWRkiE+_lrOLkMr~M|EgW?Ks%%y>D^pf5Eapjt_8)uf406f%4^d<3-)0Y
zS-8L&Er0AXgb^r9Wy+wSfQyVP>q}NT*K$>WxXx9!8tptXihcd=7C4YMQW2CwYH$<N
zk07&7n?Z}sa<0Pe)mLD<>DXTiIR~qYWmUMk6YODfSE*2bjr*}NI%*_;tgQ{r1a501
z*bN+_4B_<}A71)_e@F>U;}DTVCWxdwLM)^LMWOIz>Zg&Q;ep^GEt|}~`>wz3*6upz
z0w(9e<T1N&HtembQ_#gHZCq+hpDL4{HWBJ2vx$&L8$8xA>GYk#eXV;G1EHVV2!QAt
zLCRN_o%ga^&#rD^%X4kYv5X@Ji9UwZgp$tt=$01tG6Hn5e=sWBBU|j=)e~ipR9-Z_
z9eS2+9wiIjT+@H{f63C*HJolEe(091b>N6@e^Qy*`!g_g#+HXY;nQv>r-Lq<dH(n7
z+ZSf{8Q*nxa1`C6c~vjKccXjJ>_g{Y8+@lhc&W2U86<iQy0fe<<g(e*rd)dmcTfQx
z4!74Fc7k&Bf1Fmi$X9Guv$NJyH*wA!7h~t5JJ(ak9k9K<KhZ<nbC+L^%un-Z<1@b;
zo3i&O|9*Yzm>D?vaM?~r3;3>Ebn@Y{*TVNFCK$zjq|-U;ncp=(zUEcm1%J8D0e{)J
z-+P9nk-8P)V65GvP=o<)y)xzrW1aa%1@8xdvDX8+e=m~#={WbtQk(ad(RTr2*wD}4
z4LV4+>Y%Q(F$d1+7pM#4&3$<qc#Mt!Iz(g$S44@3Q5qyJB9uzR1R*G-!t<#wF&%&p
z?ueuu@xc!5b`61{7V8ViW%gO;I+fZD-P12Cb*pRABo2OS%|hE`L{;XwRNj~Zf#wM!
ziE?1Pf6A^@reb&kyw6N!_H2X3QO`eG)(CUZ;%Yg_p}>2(Q2B}rnn4zdy=;G~!DEU5
z@m<%W!bOtt1Q9P~D3MGcEEuIRz{E)}r1fb1J6it^ZvAUrfVBw_WQtL*-N}db&cCU4
zhFvxg@SzdWpY)}jq3r$sq~pi~A*%Ja{$Ea&e=i*u!-GBQ`S00>wylWs_x+BhPIMY4
z%ukaTu@n-LM8ri2Weg>0ijzdLgoNpy{v9}%^)ec9>Hz+wwWe9Hn_gmeg=y2KgA^8~
zt(Hv3&?C^wJB@k92-TS83>|snB<g@!kkjmquFj#Tg~3v1j8>{D)oPUuT-(Fc_JPYP
zf2&G4OWQk(t!AH4b3^GHOb5CvUE!kHHj2Ygr4zDYNzP5S5c$nMH`IDlRg%O(5+xyu
zSO_<i1oLu4Q9xXY8I42Eyu&j-16zXj!wr{&VG~`uC^X6FHVdPdv-}>*1fth^)#V%3
zNFhH<0Jy<~Tc|R%WPnnzj>!Te8B}+pe**QcGht^&KEi<x2nYJwh@PxXe6#sl?i41=
zjhC@L+ehFtmSOC2omp(;V(uZfri1=Zhi=2h1~GPP4~#uZ(&(9b2DP>}Ayuh)q}z`7
zCqtCZ$%o4kucjsE^!I6FL2ABHpq(beP)|@%wje#`dl-9;63q5Snzb|becEe!e{$|O
z-M^huL0O`SEt7aSA$~$J3Yhc}k;Fxm$pnQ-5CmT2W5IVqAU*FQt=Xy^vtINBR0|hh
zNOc<k^j!|Q4PL%;z?$CWFR)mrE&75Q0AEM{YYe@PkuJfOq5P!-kiOzF-$(4z9UcmO
zG9*C|#SBF>fbexcMu~`hlm<M&f0(gUx;=u5qgmo;mUtwy#Nf^ylWzvM`bNWrwmNJf
zd>qXW_xG@TPq*3VZQWaVzrj0O-76i3L*)4)@)#mA0?e?>5S0-_NsQwt;V~1@PSlM*
zw~<gCy?(^5^tKBx0xQ2xO4rr?k#hqxsQLbHmwEZ$D@b$Qxy_432M42qf9L+CphfXx
zv6!5L6lyW))b&*=R1COhl(+ubY?j|#{86Ewe$L8jpKH4=dc;~2V}fZw5o01igeL)F
zNfe?W^f8wtW?p<4Yt7LBag0ZLxQn~FflGK+bgynZAWUD}cbNl@xAyVY-s0Bot-9af
zy=^X*&W%D?l2Q^N9>)nHe<6)f%wmiZPX@w^F%>@B<>vnN&CfbkSs`@0cW{ja9bV$_
zR&$}M7~|zqQovVd?Q0+kD4<j}=5YeuTERgmK$uGl6fnDW=GhmUFt4tvbNhEeuzBHV
z4lwvMX(*Ai!U}KC7vKlV6(yEVoC_i75XG%E`<uL|u5Wd=TN48ge-H*hF%%j<4So<s
znFdkS3Nj7f0A1Q=SytJVc2G!XwMgkan`N|shK<CDgS$gRuJgqVd?bJ-S0U^sw7O~a
zk0#HQe!4^6I2fUt2QC8?@qV&Qmh%xgMg%E|<B+3>M-mYprYIqtq99B-Wr7A$$cOSe
z9bl~)vOL=61qb8Je|3JNy+{Cb&LD?ro#ESL{03O;lFn;D{$R=WRw>MByV&X`+mUTL
z$6cA%%W0pb(nz$ZyRe_CC#n<Jy&<OCqGHSDOZ_!CjI=D%B$>9~>Av#Uku=k-SE-X4
z8JdzURQQakXktIPXL4Ena+4Ri^F)o7R)7rCZu8@>#q8xGf6dqOs{LBbwAeHm(nDuJ
zfS~#Ty;tne<7sd0R1UDARD9XVhgKY{!H10y*eM1c(3?ZQk)@}1q_&=zU9|CeD|@!u
zX&WDIGEi$F6ME4|n9Uds-CLdh9=$p{7>1g0`#vSi?;BHGZ^iGjbNbx)F1w~qx!<0q
zljXdl<peS1e__Cp2q3i#jWJ>rczh`HeHk-Xdh!WS)OF;g2c@UuBne_qFckW3jELu_
zh{ZTWiOZQ}p%+NnGbA4A=?+d$_t!??20Ah&nEwonY5z_OfTAl|UoDJXx#`{&lz%d%
zme)$RsbOxtK<#O(@#uWYMRs+i0-LFGH^Uv==p{{Me|3whY^k{1v&B_Q&X%t#o&%k3
zY8E)Wz-JjW?v#S1Tnf;J%2laV5-BDQr%Rx6Qxf&B#q1||Tua|~GOhh-p=b=>(p0LE
z)M)=fY<jMU=`^Q4zm`y~Lo3}d!%fm7SUXe5G4+5NnjXbnJx_{S?M(Bo>AJH<k<aqQ
zxuJqHf2uw(j;JcZBG5!bz_<B)S>*Gqlt1Y9b+Q#e7=v>I>M4L4b3MU!&T_@Lw*oaW
z&1R-Ag)D)S+ImRq1vj*SeA7~lv!bnv*$69|^d%=E3{WiG6cHc$hzUre$6P7{&lQxo
zhu7YlH0k~M{PoSx2nM0f1_e`s%v!uF&-1x@f4hCy4pm-9tG9L&I90Z^)aJQXAnnY|
z9c6MK&2Wq%Ox4p+SgV%2%a*kw{_C5c&D-W!F{JT3=YVYjbCvA_dTkZhq~~p@xVqZt
zJ{79t>#aV%vPB!tW~a~HrMhuV^v>==K!J`8QU_`$<Lw^Rx9a!0ni~gmtCDtVT}wgM
zf5%%MdB~1DWRJx|1~<iFdB|Ag`mx6&#BmxSk|qKr!gG<tG-hcM05Rw8xo;Z@q!v!f
zu>`oaU*g%Qj52luHDb+ZYFtAE(-mjTiLF9BREu<$$~ya_VM<Vm9A`NdYpw5LILg?q
zrI|i0*&Z{~pBNv<ZVc%ULrxeXaTudGe+em~oWz{@T&8ij%f$TDnU3Kkz<F3?Y^C|*
z()FWnBtf0C6QVuVjhOGRAF*X74?JE0jbqRCW8`_nMI`Vd6k`^nB#C_<#5lqMKD@YO
zg3KTsW&MB+_kbmrTQd0y91dzt_Ls0(oFHmez|vRWd-d}wZ{&Eo=vGovN!~BJe>`KB
zF@A2PYcZ*Edd=u0sObbe*nWUH{jy6ro%jg59C~%tlk2+0bWQL7UJsG&8L^!pmZ$(_
z)Mrl1e`0x8YU8#2q%nA_uN3fTtC!7_jRkx|x@DN2W&m{3$@Xb=u)zyvmdxV{Ee+r5
zF|WT>c`4z~jj1W=)s^-=G(2iOf62yb++fV=bd}ckkhOATfb1vD_jZ2EBg@_WSnlq;
zmkuT>MAS=zAV`oaeTj(cQ3$b15%*adGMPZ;g$GbbRU*MH4p(4U*Xg?y73n%vRIj^x
z9VG*2U%UIqa{To4Fm`J>a=&-i)-tQv9QTkA4z_aRIN>2<J|ce15DB6Hf5jyA5RM6V
zS&#}h-HEB=UEab+jpeT~POXREK<JB$6-9@#qyUD`LP>z~-CN~#Syr;}HlKN8Mp2mq
zEO^DP021)Jt_Q;k&SD-%9N`#1BqB@@i&%uP?<HOmdWqjx5Dpu<Y<$A@NVP-0ZopuZ
zeFkUBUFX2w-u!ld!%@=Rf8woQe!V?}-8viG-*uV8*v@eWIv_qRLyrE*7$)AISS(u|
z_vvqy>R}5PdOec&Vs*N|!w#Hs(|eFp*jszRUlawQO9jKoO&Q$hTq2ry1eggJ7la4g
z^`3ycuIs;fP=8%0NW^`dASM%u2=iQ&5G(;d2bg~u2!8a}J$O2)e-6OiWRiN5m7i)p
z$(<c_It^6{@unuvk)p|J80m)>N$r}-!M9@)KJ{sw;fXeZkRsK9bVU{wD_Y~aE2mBh
zk?alGZUcBUB)<)ZYlqEumfxU4E?1firS^$+5;Gw?r&75D!0RHP(;4iZy4@|iu_Eu~
zQi}6!6H=QjNJ@lhe}=DR{8|FSBU@adLY7%sL8Q)KUp&*SEe!{lO77G;FqN;aI~=1!
z-RpgWv(!nO&Yd?B>{lFeE~%`&Isuc?n^%iDT~I~TtJ5HLXrT?O4Ct^5D6FBqCI?v4
zlt%W*oz<eu;Yd<6)2j*+lo#O4S^&UUXFQ-#3y3}1BRT5zf76R)==Z~vy1s~f<Vn{@
z1Vk?yae_pGNl0iA5V5nc+MBD>Hc^_ED`66B&hehex|V5ft^B3j+-g2EFtyfP#E@+Y
z66Zqj7|e_kUCm2SzRsS!7Yw@T;!uQ*y-0AJhR9>gLnL7dqCAa}h#0}x^Wz{Pk08SK
zNAbRcr)FVvf9#CD(4-VQ0ZE{0=&PHGbX&~6P(rfua_jmHyt<*0ZiQNSMo1)9%UQ-X
znP9Gw`H)}_GKTTIP=a<{m1Tu&`mh1?doL(&o1Izt@od0zJxInA*ntn%An9fxE!1-%
z&YSPw&Z}h|@jL`7+bO;4H*BM(ng&n{nqlaWHp8z&f6`{?Z&R8ntbTv3%3^akkI+Mp
zvOxE$+Gsu0Jy8b4!3%4tj9rY+v2)h1{-WD+o5Hx&iMsC$HKV2#Cm$}GzqjTZR@=jV
zq}!lzHsYfewTT1xfc&^mK$Gg;phIOUA+al5hC&z2B%w$V3xWV8Y2*={_?{4W*IT<5
zfAVw`e?K!Gr429KsKBJP_lvr^b*d&Ci8d~*uDyqY(Q$&e#)$9^;Ng>L<cdfLL<oUv
zJn>KxMFNQ+z?2FS_&(p)iU%mTt%lgPL#c7J@`fw{{{^Ik8w^te{NLe5eZ+=$fKd-q
z;!?sWN@E{JokWNVFG5^|EXHoYMCd<)@KkQMf3)u&*>wg%TV~Rgt&^HI3QP6;9Y|Ud
zQmnvNcyCDCm<*x|-%<b>W&toos#3aQ$ae6!p;Tgi+_nMR$|vjJtdmLTddDP{ev`Hm
zReCS2OUJN2w}M%!mORocayyx&E(e5`wvR`tWrNhxANp@aY}w*AZe^B3_|*KAV$Y{3
ze~J>IkHb-lC?sEGn9@-Cj0Udz$bKR115?S(?|%bZJ~v%{a~;$=x2_Iy`fPb8v_~*}
zGgN_hhZi>iws#-)1MKVuC)dV1VGD=W7NN4;*Hv7v9+b&8*TN1?wYx5d!3$sOPFU~R
zJ6;E0%@z0^UI#;e;32MqFpgapy8&|je;BORR6qt^ibxu#iSQFi_)b>q7aKhSL%r<I
z9GS{FrMb;-u0it!|Hlm+Mauc$l)wmYAi-KAa88wi2S(C`aZyaponP`w{@|1laFxyg
znp9D^Z*=X*FnTnO3oHF60=Xa9$2F4~&{>$=V~v+b3P>(@EzM;Im&$6P{W1Fce?NWU
zvz3r0T*1IWceRwKd;?QGPF>$kQy+;CY~^koAqEs8ocbj3gM_f)!EEL7t~oTk^pH1i
z<NOU&I~~;o8`+-CzW?ohN}Kbto>1dfndOTsSvc2OS>-Cu3G#wwSJyLzc&Jlx&Tb)d
zY10I~o-Zz(cQ0T6FwD$2r?*a7e`T{-9jMjjq6C*fv$81XQboC$wRP^iGm8%rNt$??
zi;K<63v%%~OwRHf=adSeOYg4PNhA5F+=_~3AMSU=XLME8n(V~|h$6kxFCB5ap!1BM
zz6WUr<{~fiI<4b$<hzC`Z8VqVo=$`9l3-q3)X(jl?$Y^(Z1I0Pr`_I<e@Ho-vMe4X
zk>h41x|LMghS=%vwpL!(Gq#W5khZbUANAF5+R6?BMqX5Zyfr<@Dmni*dAqjt@bD{x
z&+&HSB(QF_fq|Y#7t<&fD2{^|5dpb)0Q@8)7Kunkp&#yKJ#GXJU1NRogI9lpbka-H
zY$fp3URHxzw3JVvtIE?3f1W@AoJ;4_{lQfz2a~wP{B2S#PiiztOP|$z1AJ{$lR?Ku
zk~X-L9@s(w;!f)}=L?9Po&!z-X_|NE-OtY<TOQz0OXvK{?cb)(d6h4x&bb2fPM!1e
zT7CRm2FDrP8R`bUm{9=3O1U_9p4D_{N_);qbuD%TvZ+&kk|1&Ae>b!cPTl=daeir>
zxJeFV^;6}uYd|nivx&x531l*PQ;T#}?nr$`e{BIxH}`f#I-`l}C4pclb`uYg*o#r(
z^8gVX6F-!MVfg??7g(f&JocM#%l+lN-sY|@QFwl^zVBY%7Ip=xH`Xn5oi%Ew<*rur
zJ>|h)<joWoDS}lCe?c#h<~zH(Ms_Oq#&%_56!qK#RIREB=XRF~w-p1si?^xfTM+}H
zG)U3;ZYBohRQa-b|I6*)+Opt0YCZvmuK55*RP!NUK)2i9va0<s%RaXsGQMgHzs=hZ
zCDZZb@J}I2ofaDY`R|qeiKn9Zo8=4Z!|HEsv(we0Ef~xlf6b?Pz9`|ctv>^hy7^GG
zf6iykpI6kXz5VvTn?Hs8-26?K?V$WEYyY0-?K7D&@6`<eQ(8SzImDpVZ%C^Tfcvv&
zc(tgC+tJzmwU~8D0z3A^HQ<{*V84U$c{l5D8frn_vbaGr&b9oG+z%rtA1DAUmi6N6
zJhIs)`}nF$f79*FIkxUrWY$8B?1CqKeW_FHMpdY$p3E1YHOHmS>uy!_XSfFxub~RC
z)Hi`9ZGb!d_Tx-0uBvOum~PI30px4q{K0Yc`+sh36<q}UTi-dV)4hiMg_e*}{?}sW
zT#nhVt;IT`-ZfN>y(DA}cjIsZCR69tLcYsiEm{J{e|mH-F9*$?I;uy&wYlc;ZjT{Y
zQx73DdCe=<AP;oT%eyqrr^G)wb<E^-I@`|azUkcT_1$xEbQSbJICvBv_l8z-D~#MO
z@VJetd+TQCrh98EFiR7(bN2`L<ilmX4&fWMicUUUHmeQ3H0$K#!=<&RZ0)|h8bjXo
z$$MeCf2_A)Y%Iu~87h_iEx$o;<Wk9Mrfh3|kD23sV@8I*@1b4|OazRJFe0Hqv6sY%
zBmr=tgdBM(6+GmO24S*`i2xR)30<;Gyw2$&Z`32rQSIEyYO;gXKxsasrA!^R0%0Eb
z&kE_tOc9#Z?|1ba1be4ZhKvdgkF6FfSUyI1f2-4}m9uQ=EFtNlsa8)w*-82W{cJ)d
zK1o&FP+g}BN77<;JC=p5PT2d@l=6kV5&3*9Ta5H$LQ;a5OgSPf3K5ODK%54CD$>9e
z56aWFgIcbZ#WnpbonKy!tR1y<VAa&ir5h!(MoET+(_Ju|w0b)?pIQP9<gzi`HI0OD
zf10YumXMK{I-<^oatLVMQI|gI(nnqTs7oJp>7y?F&FIo!S%1B}Y!z5z+Oe#2e{e8J
z0<E@t=>+xD3VNgJvR(iM)pBgx`f3H4eq8({)Yqe)c|f$?z8ag6y$1?gjQx-XEJ7>*
zavz!!l(=4s7{iIj7<O5_lfw4%NQAv5e@|;E`t;?ipPYgUT8yY{<1{sv_`NEn7Mp7q
zs>zhyiJz~N5`k%?n?7sQxB9mXK7spUa_+ooJj!isFy+_AT{iH#zG-qAm6kKAbe1`c
zQATG@wh$m(L+T`?>Qb#cpXZ;o6kjeSC~>n}M@aBCWuL)Y#KG@l7{HZHT4hH9e>w%7
z*L3Ib?%7ymw;*xixhX-O?{h>XP7zHahGJj3j8iH6BzcSsSL+#xnn~}ePdlxFX$L1@
zlRyoy?ef;9g0g2FX&Qxg>NQQe@<^&B0_XQa-pp>*@AhKgbRjZ@y0aF80wvTG>K3;B
z=#l$gJ#u@KW!=Z`c8AYx)Wxzce;d|NK>D*>sO*JeOh{^f+?2dZnX7+(4o2#k7~18#
z63%a#c5BxZ=ig7Nr=37-aMKMW9UqGzh+~Pci#Z|@p(x>jk0Qb%UvQp;QTPP7y87Hr
zJ>I4V<?c#l8u<}JoDqo#4P2CPDG*CtHwp+18L&+rbL~7Vcb8fPFF?wBe_iCpV7n__
z*WJlLN=~&MUv3b+YE!d5rQpH*rhW&=np(p7TGG}gW<YA`1SiVX0g$GefKI=if}8eE
z$}Bs%tfo2Y6k`BYhLB1nkIf)15M)dUDy%g1k4h>t&p+FoKZ=>~b)Es5tpJ3;^8#e<
zS<ba+$teF+vowKy;=Gfwf9F|MQGN}+5zX1vmNsq5(gQHci3Xx9g(5yRXtP3!l_uUT
zR*EexH<?f67s*#@eifS$xMLt+@MmeKO5*u!Mp<5LV9L_tH6Y6JQta{s2S`Ac970_m
zC21HT9$|t#=5aR)9>Vcr#El^-v1;eCS@-JpzjH04?wXvMk4kPIe_xp0HC+1w8~+HD
zxRLV|gmgwr0NB7zZTJ<H#IdM4;h}vl<fcCjDe_3F998%psc72MqjcWt?u}=?F%@j&
zJldxLx@t9|2AJU3`E-Z*aC!|nWGl=7ILP@WH?2@3Z0E)4bEqFP)WDh1<VS(Ox{^kf
zRWmJF*C)UrgT0=Le}T;Ds%$P2WGh<SZY*Lv`>M+9HzKvpmE;4W`%r%U1~b&CGw`q}
zY7$_b=YfmdFvf^P64ICpf|#4eJWT|bKHJ60*AmM1B?xr@4UKwwL*8NIQK5+SLESmN
zjS(ilfvnH<0S=GCLfbibQ;n~>Q-|g-!iDceL?X;X7m>*Ge^BhR2)QZeX-pGBgXp2m
zVPltJIX)oUU5uMAv2{1sW-9;T^|cd!o`tq+GINXr?cjH?2(&O>2#lLa2NW+A7dMme
zr-gNcs!l#!Hs%q#0oG&iR*R%lpPIsdHX<NYkk5oHUeoHj`SlenKvTE+``6`S>b(8S
zGcV9NB#wrOf8E>??OwDuq3Z_{%SfQebul7XN<{rALM{!G#ABXJ6Y&I8^}dq!kh*y+
zId>TawH$|tFqfk^2|N@eDI-2%5oi6_J8#p$1lTZ^=bw}duQ{Gn{~Eg&pu*azspPyi
zGu?Sd{9Yfgt+s4bT#SELE6PY|Ez45=Q2)_Yp+N<Mf95O%Jee0i{1e8$ABI0FE!n8P
ztrA>`N6^h*18MVft$*D*|MBd#^U_!W9c?L{?5e2$hb(e*4X`}As&Z$!Dz2n+`XA3;
zPmI#4RBLnBuI1yQDNwQ)#qf5ZwKvi;w73SC!5mH@-Rf#qwTW=M9C0mr4Ni88^Ux^N
zcWUrIe;K{}Z)4reN=GWKTCB@{t6eEKk}mT__BSc49v9MCu4eFVzw@@$py>`=orPRV
zg>ZvmP(6Urp%9(*2{;5=SBwCwKs)Y~D|JJMK5D%jGS}8@*$@W?v6n@rl8-^@I-8wh
z5LZ}Cl{S|vzaFRaCC#o(j3yvL0i35mp>-dSf68yBjlGKWXiTI38(oel^sXQB6s&i`
zqXC5IVjy^QQOH6+#@KZk#gD4cFJa5n9aCd-I<^=ldU&$x_7IW{sOK;~qd9G16W4oK
z#}JL>s)g70(Z3bF6?9W4C@RObZ(X_;n5?{KwTNY8y#ILidhZ;#-6Do+_vRL;P=fo^
zf8Qx!n1yy&`x|u-)%CvxQhgv+*spf;db*m8O#|7w882uy({_u!j1cPWu@(dyTF@*4
zWwESs%b2<MVyKJyKRQL#tqG4tkWok6(FpPtjUccw4r>F!VG?8Fx+st#LxfU-XhcHf
z2QC*Lb3H-jE;bN2<m)`H8#43WeIeF`f2_;M+k^sGhq@9)nnQNSjJs-VA0XdulyaA+
zTp*t&DIx)LQIh%z@?#IDTzWpo{;nh3O-Z<W&fWFHy<hHK7`ww~-c1<C0#hHwQAiO<
zM1&w!3G&@2B!TO4>c@|od3XJ=wF!8c{y{4ekCaY#tqiw+X5B4|+#$*C+7d_be>Qqc
z!#Iv+!X1|g>loj=Uh7C<-*oca-Z+_rxb3$(ac*Z&%ro_O$Ar1rqE00GFbQ*;Yvo{9
zHjiQ&;6x(dBPk*@=7@PRLX1maV&UO1j2<gp?wuFOc4;!VITViRZg)&~YcA!(t-F*b
zBuoO7GVCG3LXN2C`6!K&G-3&ffBY!fHxtR2Wv#}i=o@wKq$F#sbWrSI_3r94gCSl|
zd78#y6s4&|7)KQHU{VyjLL!&SKnOPxIHXS}!$p70hg<ueTX_w=ONW?bxb6RgE{(0A
zlLz;aC4_D0E!&pvOl@hI#!fz5wgoA2%eD`|Z)sib?@yYBo_x5hd-j|5f4JQR{k3h7
z-!|EVee?`mg#qRXjbk5$Dx(n=9I=?BD2S*?86%<AoW8cJuvx7S<Q_}|&OPD<NCw~|
z3_OeynncKxgnOKjNO16&9^Hcv58XAlgR;>4L}xSS?TXE_5-zu$)9$YK_$l|&YzC2G
z%e;UqirwnOYTB9CJXu2Rf0cQFin-$Zfcs4|BX-;^=gwPoL|I7LvT3}bf>2?6Kh5%$
zc(z>XYwu1s;GY&eUllMYCiPoxnyn(8jF)X~56j%T%E6~rtrj*&w9bN?sZoa>TCFbO
z!TGY9-GYmb&mbqQ3j5LxC?S-twpo;PUb_sZz(Kd1(OVU2r+6o!e=$y`@*r2Yni939
zV9`FlJcUf3HGIGJ^Zno~v(G@op=1*CK9Eyp3&XUL&6lz$^M!^UE4(s5{*hrLfmtdY
z%JR=3=Qt(Lm(t0qaj#&xVk2I`fN+*FFF{`D0eBz`P|R6?DDl#iFyhLGNI<s1E7;_J
zF_YYxux3S9_Qc=Ke}4*VOB0o<HDD(A+<67zfpCn^)Wq0TfwZB7BPk#(s#)rKF<pS<
zkgp&iY%2LJpUGwqsIX1Vi6bVR$UW9G26eYeFP!Vm^Im#YdZV6uPAl3E{erDk2t(`F
zK%Cw@KW~3f5$<&-45Dk~h0$kvv0`>@T2%BB<$r<!9<KyKf6GjaejW1OvI44khvQHQ
znqwYU7`iqrezX_5A-(cdi-wXdgwM3a?Cm<MkE1u%F{>hT#vQv`ccL>M584H&<c{{Y
zZs7w@!ZX;32b_hs_GP9D@ATsc=RSHepB$VUw$x!gnZ!+`2uXk><1Qj1brDNajCe!{
z!9HcApN#!3f0DiSM%=-Z*}HG;dv%Q~b4Nd=8o3AXQ-(B30){DyJ?SChMHI!9V?<fX
z0>%PKNVMPhL8^hf2hJWTo99i1cWL7GT0k;#rzQtCf>Gg|s-e#dJ@V^^b=+DC!+LlZ
zrkfHT1Zj*SFTo&VrifvWBI&z63Bs5qY5J%x%#AW;f3wVY@?1WuD0zo-^eAcWBx$bk
zCu@0UPtWn-<sE#)<%$h0z#y1uLCsD^w2fdmnQC!po3}@VvTxcq+#faL__e;)-r>Oj
znFsCfk6z-3_7XRj`oYAZNN|RIL6MM2h=?D@D8ZB<O#Rg7G>HWdAIeK?r5D<C%lGg1
z&TYQVf7#T(ZPcaTk+L8(y}92e>tr!_YGU6{KRWx~Pv(01&TJapr%oTl_+aI?$csDb
z*v~ewOAUK#@52c+i}=#Xw!Lho?GNoo=ufADjc|yzK(iFes^GL5@3gK!+oq;Xi}kk?
z{m*yqNL*(1nZC1@aIjN4CKS8Gl_&sU03n`_e<)`d`JDK~qa<Oew^MdoIxD5~i@c&L
ztmgE^FB2sRbhKG^YaexQD_U)#*ETMQfolbVg`hCV236Aulv9Tl`6tEpcC+Z!SVE0m
z`oT96XeWS(;?D(DBER#lp!}1*OO{0rkqe5=yQ0-fam1;Ezcy#D)Ah#F6~ip*MjTk%
ze`6jKX(~{dFpP-HFk(Vb#604$D5X?#{1CJGPJ4O&r>0!r(new5hRQA5(g4=n?X(0Z
z4$SLHQRrV4RPncWrcU7wR9^dE@=B-KfPW|F&RZo606R{zX1Zt-D9@15Sov#P!jUVw
z+-GX*<{x%)nP5pIae@dDkieJ<M3W>%e~Ir(LSr{fIDahIotnVYR4tE%Sss%{x9`bV
zJMO%x;<|^;H{5sMr=+vNdowN>jD(1l6)mb#MO2OpBE6osKdSS0ZEw`C+g<-n0fV=H
z(--+&SHK~!bJtI}j0r|T$~`zJT$IF-hZ2|h5sgTSW%MM^2n83^x5!}*|KmY%f1rax
z-|gmVw~q<yh_#OnIK{KYl@8gQOwK#+uTQl%{@BLzrt`}2jM*%U9P*S2{FqBZeMH?f
zMTEryQ4)s8b0c30#yl>fU4hsxc3yiUseWGkGLSfj^5wgRBcXY<1GrwVFbo-wfPAJr
zcm4wG(I&~SoyxXlj5fD~O1#^Ue-h~94d?-O7aQwp4jsf63x;`wJeC3!Gl~$E9!4Q{
zNr<t_QqSLGvVbr9b0#1;QZsM6O_)_e{rWv8Z4V`Eh@C&ckf$k=38oCWUILu9DMg8(
z90izD7I-lgLGTE;``4axDi@#SEMLk=e}9aaMmKBN-HW_*P6sOY@zOn*e{}xZTbI-J
z&GYl_kL$10HP5wos;$L$Zr1lFuRRlT(DH(JiyMX?*nryaT;M+_8+d=*zC%LryYIYq
zL=PdLFgJD+FJ;IJX^aR1HHhH|MN|R|CzMqBk8l8Y@5sSfd_07owuz)Z@YWo^cOSfa
z9=X<8dpu>2r|bbv*<qa4e?dI_k_t?*i#!&Dh<ILrSm*^P2nfT8A7Je6qgiN)b14hB
z_-go<(hRm%Ep!n#*G)i6Q^fkvoe>|BgP<hftJ0A<Jil6KHaWStqF1s-3+TX@a+#|E
zRX8@tiIf-caSy$u%9pwi2Ubj2ocLS_BtqdM;=2@4S9rj05_m!6e^M8VJ!VYDFRhz0
z<x;+T&P*XNX*xJ+&q>>Fv`y^?cE^#F(=cI3x`79oI|O3F;|P10`-FR*_bBn#{oSB)
z6l^iHTWEZS0a~Sjs6*O{lhTn8U+kQ&k5^MTG?A5b&a$f&m{UwEp|~=eXER!ud}>Ea
z?jc=1FhOI^9{B#be-5sLVB6a31z)RR@!mU7*-Nor1ZrN^_@`c3*R)hk{vUQLw-S<?
zf*_Q={u?6ERl)X`>WicNw2l1q_dPGC!-^Bsja=#n4EX_o7eX!(P23RSz@q_ivFm!_
zBb=6ld+3nor6K{=Rh*PSoNrFbtW-(imxU|=jhHRQPfh1ke>3vus~N~1|Gmlzsh)gU
z2f(T+nM@%%S7p>`w*1TI&S}mRNcYdbzI;A`D#0wX7#zg)031)^eKpGwblriD;+JCG
z3)>yWJDs(v8~t<EUQzaMFGn&29xZ~0IBU&*JnUf`v(%5c#}E#I8ptOuqHf|Lk5UqZ
zNy7a!dIAI;e}fhDKtvr<N*ef-pfC{$B3>vFOOq72QJioQ`7D)3qK=2=@qZ&ZTz)1U
zh>kVhm73#SeNh*>umNA(SR(5B5}!IkBC%S|AQP}=I)F=bMk}dHgew?g(98>(u_J4k
z?bqgc(<yOAC?E(EB5@;*BF_bGR?HA1L4ZiWnF!J#f8jjXDbF_$*1Ndh*}8)x$jl96
z)yOtYt{X_7-2iU1fKc;t)I43<S~Yb_no5vIAcHpy!iCz{niQm5DM94i>E^KoktAE_
zkOmlg!_bjC&%|fC0REG|K=9NCgUXs%Uo-rw=_5303FB!Jau?Agh!F|g05Lamk&7kw
zQlHT<f5Z<dc)EDwlHE8BTk-Pmx~?})Oqn|rTzSxXpnX|COC4IaF)B7I5m2KNDnQq`
zT1bnlkDXw?sdJ`*K%LeeCa2LIglSf4qc&%e`UJl=$w;(}c=F-0{ziYHD$pC`UABZu
z)Q5MlS>B&Ocbp4H<$yW)aH;-Zr&RjWmr52ue`}*^6ek}pUzYWE`YR)(LDzt;O^=HC
zV%i_7qn~zn;<L_aGR$WjMuEU_id+|RccvslH1vHWiSNNNBYkm?6TN?99pFIk=5qU%
z&ht5)jhyBoOGFrgQCq|bA`!!gMjl0hlyT_!IQ9g8YNz=w>Epho!`zTX9*^_masJeg
ze{(oY28X!_WfTfbQ6!~AgyR6kGVzd$(<Jmf7EtCt0WI06N)M?ZyE5T%lrSVhCJ_;S
zh!Pyehy}!tDN7?EwvQ83enXY6`;!!!_iC!XGmOgmR(ZCn@;R+C?leM=_8z>*iyK;~
z_FGpULa0^&Gi5CS0q=7r6sMm_2dBvWf6mUJDxK=v#BX=2KRW{hY_?#K=FS*sI|PU(
z!zr-;tt#j2j5aNmbxZYIY17iPGou+k<T6p_@y-JOQaQ-+h=ZJ;^5t#!e+RQAr7jII
z4hSNIxrq3lL`+72d5whYk~9r?9}a#@f_QM2)4`TfOVwJ|O;*I+Z7Sd^Fd>o6f2R5*
zYn~sIC%B2ARGL?Je>wl(|MUM^a5#hXPQisC7uD>xCFo?gy`5*k-5@44BGWc<(mDLC
zG3oa1hqmd0Yfy}mV7uUGs&1-&LkbFoPn~NyTY~DXSwquXXQ|+t@ZLf=%N&lpjLsBa
zXdNYRCmHLr<r0Pgd^S3Nq4EVOe_5<{KB3;2YPt$V7hC(U`u$J|63Ps+eyR+K2;|f@
zhM_zkKQUZ?<fv%C?Vg7d>>(es7!e9dt67vFm+-{(smr__ZUTcL=`P&SbVA?_>G<gi
z$+Kk!BDS6$s+DtTRwIbt88FFrCb4wV8NCAJ4lPxnm?30W1}(^TsRh<^f9Ef9wk+Ej
zhP92<eCnZB<RJBuEhS$850pdU-Gwacg)qzbts@s{UT`^=i>lFc?i%lrVGrWeCoD-(
z>=A)T%2UKVN|A_!A7e^!+}A7jR%@JbCa(daM2$13EqbhBOLT|S8c{R+dP3DTZnF7w
zl?dlmarLwOEN8Fv;QfQee}}K4fV25(rUk+p6gvLKTghK7OXsgNo3Z>$^RTM<c~+Ri
z>{8jYU+NVy;->rS^H(3+Xz)%{@$>rYzsl-57v;q1z5607AQ3_PGB9yurS`~m3Z7`v
zi=So^=$C*Eqw(-DdiC*>ye)e#yvH9V;}yPLF;EMy^5WK1*=vUxf1jo@O;1x4^!DRS
zF0QKUZdLEQuYZ_0e{k@$Cidw5sJrol)9b^=@>Easi@)Sf+ssoA4b(g!{f_>dgua<3
z{30s=_qXcp)Hy*XKqz94hfaD2X9ug|zscL-(<+mwDpCa`Ue*aA%rb9(vADkaE1{Db
zLeqq)1-|9WT{G!qe+qkUmsjEWhFxrQnEDZ*>ISwtU1xY|zxvl+2mZC&sD9Y}AF25G
zPG6@VU&{gvCG<*uG#gR5xJABVGkK~~O`DAIRwpmoCwen7an4+fr;a!2CbtiiA-Gr0
z&=lN^$H|Aw(XmkmT9r;#eXESW-4<Bp;r5YU#a3R8Hm64Se`htKby|(?PcXP(H13Qs
z{P0H#@w#eUo!^~&xZFI>w)GeP)}nOoipsI)co3F@50QOiI##Q_Ztj&J<gS1qA48RY
zf2fYsr`w~AoIVgAtvYpxK3Z*^eLbj_Y^-*xTDMwQI`~VO2B4>N`sF|W@dpo&<dK2H
zBrmEz-kQyoe^qi0*C`bA&sTEsk<sE~XRUwq^l6kA)hlCx^0Zy;AO($+CUSUBzN)Te
zp`2_mTzEU%p_Y!3<HZLvqsW8=iHu?tGU6j5Qx7FU5+dJo0hJQ)(8YUz^K0!tPo4UH
z)g!f?nq@S~zK*4k-Ho-Y4uv;fBc&X7)UI)b%7oXqf5n)lf_62}7g?37q7I`>jp$U8
zks!e|LP5kML?SOnGz~rEizta{D#O$hkET=AogWxL;0G86Jz7T%>Zm~-HK-?~LFw}q
zB;)U1d+I(rRGxa68EZ_ATGLT$I%-Wvt?8&WZP1$j{(xG_p?$uRc#)TY+XqKJBHWcI
zVJ<@~e~DbieVKCLFWysGF`P5^)mdsU*aPY+Z5<D&vW#dh5oMuI+yJ=|m%uRPA{x2`
z$v}ouFi9d$9yOPv@8{_IIr@IK&|JEdUcXhvrKLLSkIYehIjS#5_2sC(9MzYvtG*ms
zi(x_H3z`tbA|HZvq>pIq3FO8+!EO-B0Edr(fA0?0z`I?HhFE2tSG@uIJ#1jKFNw>!
zOOYFf5)lkz#lsLq(hF(g#>|t+5!?H~fzewa;r9mjo}K-v2US;rKui%brK{Q0VJn3g
zb?B_j0Zu9%+Cm-`CQ__G_12kk8uY8kN<PcWRUtu*&p-=?KI99~f^~Cx%DhG`LsdLq
zf27$Jy!!t4><=IxesPM`OqRdDV1M{<dR<k^@`sCya<v3LtMe9B!t?osT%cdyUc6dW
zvpoNF0iC;8l@h7<QI(?xtxspOTV(o;YJmR)u>a;|z%K#@cePaQc>C9PudQ*~vMsCf
zB3Gc~i)vLYP`+pzP*<KUu28l>xvmvOf2kKnn7SxRfnJ?N0g9>5Q4o8c2z`cmEERuN
zrzdsG+E9fmZ_O1ATDClQ{#U-LN4YBUnX^Usg0`V>NW0>|Pb~i;A;Saw1Vi&`RcRT%
zT++F=d}RIEnn_wLM#o1O1UJ$Hh5RtM$W4g|N<?*usBR%rEwlzu&D$2B@Osr7f5<VA
zjw{T%{IZ<oigYf6HMpeufQLbZL%hi6St*^{d<7YPujs-6jbMpnRSC$@Y9R|?pSug`
z{j%W;u*^v?2Uc$!<YW~@>QShDo-b7XTO_~0jjM4}fI7cEcYewjWu`1qSxMPU8J~J(
zea@)boB42(Zk^R)rU1(hgV}^Xe>p9IJ;o6^UxC#M@(Yeytu*wZzDh9>ZjfM<#L`D3
z3@}RE$V0v_qaX-f>B^nrUad2)f7F3Sce|7uY=O#ur_6^<pAGzbbj#={%62Yll*81{
zOJxnHP6jQ{ug<4V?@*X3W1=~&CIeHVRS1*U^mCTiIO;jQ)rYG}bljO}e>h`zp*7qV
z1#t)oibtG9i5nqFQ-TNuJ8+y(6a^_^p&NT~;O=1uez`Dnq3;B1^0ghfxd>;s+nI#3
zx<H*CotqV+16Sy0xprZgbu+p?oYO*H(L$&ll&7k`{xVsWDw$kw9az`o_;f2F&zO$w
zGV6ozu*>1lt0JI*2x!a^e|HlgGZ75YIEs-BDNk_BdEzDy3#_s3wEk6QPh}t0G~DNR
z;cW&H1<KA=--ivtzFomDTS>_I2PHO+1Rgv-#Jvt8XxiD&ac1ZH8STwva^8J=GHpM@
zKEB+uEO>W>xy<4!>(<*m3e3MM$M0%UeN@~ZW^jHx3CYHF@>`QFfBHRaIv5;X(Dtf&
zutrn&@dKSGZh#Xak{D3|$q!k85yc`!QYLOHe8R(&J(|O-xlC%z9*{*skkjZTqWGeR
zw@B~kIi535^_)@O1M`#=<`nLcC3XwxA3$qLunwdSThZv#L#Kr$6hWmYA1=GC0H;M$
zj8m6W$E&QVV0b<re<MSBVEo~jek*|*+nQ{x>tW4W`Nt3YT?>cHJ>ZKl#D0uCNiiZM
z5h$UOA?h+gn1>?~r4ONZ{HjbICalzXqij+StAO-1*l|r{HEh@6l#W8ed3p!E{s_Iw
zSI|5X8nGbdJ`&V}Ac`bFaU@a{5RV4ZPeb3s-?W@CHq%Ghf8lA#4q7wpt5QnW`z!kb
zQ#Q_swZEism-MiP`0&so#CNV%-7BE<C^oDW8`e60`|9MunTui(u{aPYA%r55_$i_;
z@lhn**o&f=ggn_pifFuaH9GW7Ly!SxZPYFWBUPMsj`PWO62;KBWA2J3r(TB#<qiX<
za`1G7lu|hkf4-(jaUWae!42JlCJ7BNVi6~Zh$KLihc1dd-^DSeej14TES1KX_t>jt
z9dFKWbG;l~Pw^ObgD61U_a!1h#8DCph9r%GfMe{l^zr1;W)0LQL@kfPnviP6-7)J&
z;q%EF$fwN-GE5p=E@xSFx`xlBNyIdH?|yg`8MfEbe|rkCO=&HDw^zYE#Mq<t>$fb%
zKCE-(VQ-$;^M&MIj7ZD^M40qZEW;RK;$xR4fk#8{@o%0MhjhGrzC-Wqqud%}RAu+Q
zJ2ugM9j}g~1>{?}Iu7o0Cov{Tf)Pu3f{4!|6!Tc1B;X!TeNW0Dd<Y*4sF4a**Z%Z`
zd@Q||e|<|{mV=wmC??EzeH28H06a}2lt>vP$wOC$%#S_JzXxZ_+j+I@lg=LzVc&qv
z(Vw_6(PIbSiUlM)pf9DqDSj)yll$JANB7IUd?<$to|7V$ksBc*X@p1`xrkC4Ar@ik
zyD1Sojt}8HDef|d_ip4T<34!`^1>4|iKkJ>e>kigpQkY*0whW=rN~b`>=7IWX`DWm
zC*{CP=YYPH?`!cKdJTDQf_aoAh%%BQ!bFVXNV+IZc)&f6a8Aj$XxutVn!jz=$~FS)
z(Zli$3A;z2(9<!K9S#fPGZ{zBM=_T%A~^LB6^Vy%7`RM|$aURb!n5P;bBuiZ%65*U
ze~aZ?Gn5?fj;C{X99#)zA;YfgqcmU)k&s3xNeDxUCmHv76vwXkn#@B!<P3ebHi-H`
zIft;v6Ia5pq=|<}OngKmpP^7l8qtt)k8KaNH1rW|7B@}A;pCrXQ9vTg(HyedWs;?0
zo+$<pxe!SCoEqX9;hdedbvBiqota}?f8})4Helz*PHjnni$mwU+%g^bb$%m1gTHH`
z8-%Pz7?KaWiKU(}-KJdVru2vB{Qd8jfA~H7!_UCk;>`0x0+-A0FP3}rxs;V$B6f?^
z|F2ds7#Az$sHx~epk{=C2uE|ffMKJ$oj4DlH&+R38|)kh+x1ii2}uBigIR(Ie<aXk
zfe;7>9`zzZFzrV%A2a11o=r>bT5FTE2_9b6tI#=pHk;))lY6Dg<@ut_XFAd9FkNm{
zQ2wd5{*)`G+(`AIl9gb^%ZrBZqo$jASI|WXL{l1IJ$2s61zl8*YVO4!A;+upb5>Rp
z=O(MJ;Y@%&t6w!2g~`-t_L~YNf4l35X-@}e#uq+YsrR}mHrq39a%ZmFH#%vpYE}E5
z9+nxc;2fnzkpV4Fo%~m&x}E2rrBhaPCgDVb7iYH)D{?9vs>+g!s(`^laH!onH<Esm
zDrK>0{~97AwIZ6iSIzp1r0Q<6nD7MnH84ROSdNGrgouWMAVFOcrP9SAe;hhH5FDvx
zI9PGcyFvnQ$cXh>$ve*JQWnnt`R9TzRx=75Y=55s_l#Lc`gW<Wg6=Z9-MA*&3t^k-
zZYXW^GFHqtI-4_GH)(w}Hob$t9B^K)<v<^q1U(ei98e;qiwQ*(=+Q{z1&D??MM6pe
zq%t&(4uz&)Z}p|~xtfS}f6(pSYev31;%0zTvrMyvkW1JUx)k$s1&ejsXl#mr2Cil>
z><gOB3>a`GE9a`9V1(?ff*;$T>D85U>C9m#WuRQhQwy!oRVTA@kykpSQa6$AWF)z+
zrmFyVK#0FtlUlca^jU`pr&(oRo#3XY33r!U7iriO<6Jr{TiC_I$WJC_tbYqoA+4vC
zAE(MoPG__@g;}txo!cc%6oKFRXYI~RCJsnVs_wcs|2xkX&Zlf4F5zy>S8!-TDHA7O
zv@PnR6s(TCKj|GnCm+-x(3vc`q1Wz?(bU0{0kcKZcUtoA9XC%4NjK8!loD>ApDB|w
z>xcKvFO7WK8+s$F&T>5lY=5?r8Xf<49WOc5RSy@Rlq6m(6NyMH1tJ2+C<YuC_uN!s
zFA4%IcXP(JX;Wc=bbD%;^K9Ab?Cfp5>T9POl)yI}vEu^LW_iaV@>7*SJAfY0G;H8l
zy}8c#bz3;N^5%J2)t6i~yVYlTizD0Bi#l@O{n4y-3&bA;DVI1w9)HFd5#fd?4m=md
zj7TX&N+rNP?k{w(+jfqWT@g-nlUK8))H*wRE-Q_hYs8Uuiqv@MAs(Nisbf-;XMbyF
zqMiXgC5qa((MKBrQ2kiX5d{akZh~T;rDd7(jKb4;4VZQucv_w<gdUKNK;nh2kE0kd
z;zfus&qtI~j664q6MyC=gos1YQf+cW!;ZPPSTfy1E`dqxZKb>5k&h;EJf*bpmT=MS
z;BSYCZWmju8y*g&=D8I6UV`E@@DK^OhhjJNP$<$c;I2=?$bb4O!-4juIbXF-t$s{3
zOXU;UvR{42c2eKKj!~KcE#;~G)io{q2}q~IFUH<zl8#RMAAiT5uCw(_d!MXl*YVY9
z3G8y@+|ffn?M~X%Dsq&)&Saz?pq?A4K^J@S;j&kc{fw^5dd5`lyg#vI4T#HaTeC6s
z&UY57yNAQi9-40^5O*iPoOiIR0JD^ECPNhQm>`k}f@17)B$6PALXQPuvJ=}&&j7l{
zc-%1wr#WB2rGJnw`ciYblsrofI?zg}u*S-2E{iFg;^rk_npT$EtRa|J4xNQ?C~S!`
zD-ZA1q2e=La4C>Ur+BNW`fpn&RPDg&3);G4&7chpu4xc^g2y2uoM1$_5QtICAi7AV
zaqMC0MNdJthR5!@LAwXu<+prA?kLpa?@*{ME29O%AAj9LNjVjtU0ne&eDnM-`9iif
zp6&}~>FTmFZ9|*qLVw37{{)r`V+FsKw3^f9YwP^JDx_Szk;)$q*paJu@(V2f|NO_+
z$N3^(RBxM;7;wnyH}ml8yi|TwU145T`5aE^U8MEHaTZYFrIHdPxWI@6L?TKAK`ij1
zfX87fl7EL+r-z%}oNYQy#K@tnOc{-x;-J#>H+@tbrRi^1nszsx+m$&>9DR^{8|U~@
zx*j>Z$-&O<z~h(*u&gA&Hxo*NC>X6H9tzL(sOx+5F%WIhx?FleZQUIOd>{=+cu-(l
z!V*SPFGZ;cQbb%9qSy}s1LOv2EF?)qFKX!s|9|;P@E?VwxgY#z4QNn9DVrp13@RFU
zO|s9j2mPsmK1yG_P;WW2tgNQavqc4}H5i_16Jnapj6+2|IO*Vh`dB}ZZ_;d`+i-UV
zwY$JQKf%ZrbC8otQ@{3~l~p#IISVP(^9y0)qu^;30;%PzHK3*%-LhO3`LY0)&sKmQ
zRe!)xzYN_V3S*xk&Siv%8wMzj!xUjbBVT#}mvMM6-<n=Sj{xXVVxOw*4m{6RpdB-1
zyCQZ}{R6~Km?W`>89_7wn@hksqRdNCh$HUvI0%#ek@v*R?`kxjC@QBb_csgRtIPdI
zsLc^-^Nm7nwx-nxwvrS_<iu{e3Yi8nN`D!O3D5)k2}6veK1vv7%q5A82s<GBMnO9|
zvdw|vH={Sv-RPTpVKh{AL+DHpCWJ;DBUj1*u=WH|=`rMmzHsA&6Gr4AuJ=PgXU2uV
z143sGHNc}Fm{9sSiHL`M7;ZvEfD)Ea6#60YageZ-rr!VvX46goa5$Hze}^BjD}Os-
zR}KeVk(BWmgKrH>;9nFTqRjOX4QNWDICWhff3vdlqoY%v>P9;n$-iAA`M2-fJQ~GE
zj_~Mk6uM#PvXq8M#Hm2Uk0V5VpCFfU>_ya1L*af+qqrZUO(t=DN<O4XJQ9IRWI|CI
zMkyiz4H2U*Lm^2#pTwNI@i8Lyc7G<78yF4~L=SHg2bz&56%gB+$1Pz)MX&da;_u(m
z6x{Ke@fYmjjWHXPwN*9C^H2L?n>42cDrqW_CKX0dg9=e^AN!|ODN(L#vY#y{4-|uY
zrv?5`Vg=fwAre$$Yqd*z5K4#Bg~M)_v@ERv*&m%k$L3yVSJy~|S7<J6JAb@(jnN%e
z(Op5bL=cw;Ax2n6J|dV0h=ndjzAuviV;RSs?4p#bmHR+3wAO;#J#zLAOS>w1m+08x
z;0{df3GqFdrYTBN>?0x~g5oH45%!pjnI~|R(yy#8=zc5Fek0iZt6AG&m<Jj}^W{^;
z+4St~owf2?jBM?m3L}B7oqrKJ#<d>I*xnuZuNc;fJwaXJ`$&=~LL^EAVnX;R2`F=^
zh<Ft6``Fbx9W`e4`$e^OrJMT&v+ii^9o{WNYdXdu^<*3&2B;OnIdC$CKH^d`O5>3E
z1RvnyK5!grXHXw0{1oa$_lrSYHzA|e_lWz1F#;rFV135{K}nE=$bT29z%FJC`{9$Y
zzTfNezn=kquWS8@#*g;;att7S-~dwLiUfPEKr&=0A`x@pD)GRWLp|3MUKBoj7|P@B
ztos|{ztIi%9oyo2gFo%f&;bKL`!$W4<NMVg?eRx@{3C>bx|EB=^*Q1R2@s({j2I>o
z35;V-13yir|J6b2N`E%~S{QYn_z4cNL?MkCA_>@&0+%7`QzirxNy?5G^(SGFe_)7u
z2bH9hnm(_rMN9c!HAafADSpfZU#^xwUpZ=o*G6>>Zbx~6Rtx>7F{mrMyD_vUER9`H
z5ELd!0K`ZMO0Y{&6pB!KVd5tYPwr--{I%3(a@|*_0-LJJ2!GfRL9G@ybOFj;omNoU
z)93WoxuHb?DD_H#)zJ;yZ>ktb)U$;ZcMU9^$&iQCmk7sFA`*d#JeCm(sf(jn2sctL
z!@V`_L!#10Oyq~cqPMfMvw3_Ri5_tgMIs=`0~8<;K-Cn|1d<1Zj8iWpDn98+%kf_u
zjJ}Il|8x*GM}PD9(LDYQn#Ug*ijJA*vM}TbV^<);e1RB=Qk43Xc$jla)A-OP^ZOyu
z$4usr13({MH$#hgDgxIJu!{nj2t)#rphRGSxClsyvBzSb9^f87F#P<W7V`s*>ZsY9
zq%5Uz6e1D<aVhs1id`v@%L!&l>~YD(w_)~vINbSO*MIfbx56FG-uv<<9?<ITr*Pzl
zD8>L>biskj{0LDg(lGKupSa1lEG>U^tM?PyZ%3>5(dvCfp?}9HbQ#Eqa7d3#!w8W;
zQUsAjD2Y5j@`)#Xl{Vw+q0l3=!RGz&Aau-K;d>E9+)G_V7)0TEE=GaRV;r-<XQZ$C
zc$;p!Uw`sSvONE!GSM}6p6YEA(;-FHX8Ox2Ij?obJC%XotM{DN3T;fs82_#|KqH>d
zW^`G~AL>84rs<Yf4xY@5AN~nr-w(qdmG#*ek6SZxB_7M>{V#OB{LvVZTfIi>F8e~z
zUoIH*w8fMw3+~;B>pFp(PRdpb25ePXd~kGedw)Z3&(0hsIbD@Xo@ny0L6V}r;r#4O
zb>i%-6+2Fs;0DeXSE$V9t69t1*<+cj3JQ&LbV?p6Cg;xCnbxwkdIZ_!GKGKYt7FQf
zU8kfs8S5{MMcWZNr**ba(ordA`b`A^{n0r)Gt(gC!m0<_*Zd@%-@#WVtsR*6p$qLO
z8Gkxcy6B~Rn)ZuP7xCGd11E$Q0c%=R3oKp8a+xp6jLjsBz^~mAwnnyecs`c~y9#iv
zy6-2Yliw_yxf$61y;^+IIp^x+c%|jKa4wp^fN=X-IyaIzrz(M;DFD_lAncXX19qG~
z#Z=;N=U?W6me)V3H_y)Oc!g#d)t8M(2Y=tII0N%*Rjf*w5I7AeS3jR>+(el>>c=`g
zBXo3r3k*E!K~+BtkqYtIZj8>()^P7koj-ly*9sP_D}#wVt?G1S6Q|Jm$e@syugyg3
z7jqLo&^S>p%#zc+%wV-w87h}_-k2WF&d!x{rcx;wbEjP9l?iCb>m^&eA=<vc5`P44
zOfBl0m4992tE=l~9ynbH6M_O8-lz^H>;am(mVM~--LpUbJke^!ot~u^!1P<M7~OD~
z&d#1QMk}?HAi0Q+vS_=b(wLR9*;y>Rx{_sO#cMcMbUBE}urJU0UWF+e$!W&0jQ!L{
zsSgypED2B?@BqcW8^ykiDdXOuw12#O*=|7C#9U^dyYoaV=LY6;?BHlpZFV9jrtJWh
z*Dy+X3Lmm!q}04U#uO#8!wN}12{;Jy)Z}~V*tQ@<MsX?wH`Vz-4eV-x>WAl9Av;Q*
zxq2GHPD@v`K|CY8pUyvAwh$p0ruJ?a(0_K{7;=T~qF`#Q5z;`TaV_&+N`Gd(Hg)o9
zjjhs;IF55?MvwKq-g!`_y(gz_EAGOnP3ysf5Ag60>i20MnmMt`ga=MRM4G5mc{qlz
zWl@hw3)&i;fN5tC*EqS%O$`&hnxC4&?FQBVwYPicl`O4a>Q+||sMVMCg{n7Hfoi-y
zg2VjwbWT6XkEN_WX6dOJNPqizy#n<WH?4<7e`)Hwvq9>MAM01_#;qIE9$WWdO#a~D
zH4FK*EI5c$myVLBPlxZGIWETM*tzJ;%+zt4RZ!(iK>oC*{Pyi3;I3)^$%o4|>!S`|
zH)YiE>rKrKAkUKNAVj`jc?Y`pyY`8?)1BYdTwBj*qsn&`EPvo+?SI2bxK{>;gP16$
z>)R=v-woPFwrZayHCJjnOxc`%`Okm+!NZ#yysb$^jXhmnkJ74xnqKA0pKOVx-@Ug$
zyk1rr*Jh1g4_##xk&8+e8%z10+RD*?d$&26(=XY4HGi93EmSUuMfE(p%3xinm0*5;
zQD`x<`OSlg`_F$|<bOiG6fZJ46KguAm$&^)+w6)KSF#%aO%3p?0#2HG?bpewtZ(1t
zS64H&c~UwnVP9)b`(JV)-x^kF3=7~o`z*`9)|Q*#?`x%35E|i9)f=OBO+?ZS6Y8ND
z#}pC9QWS?$qJYUDba|NI^k9JeeA$=S;bTW^)qd!5Tolcf3V*X+z#TCg420ah#8u}n
z*_HJ`q4XWi!dm2ut3zo)N2&NI6+gOEtj#ANC_Go2@+c7BOCatK=M#{H@s_f%F%;`|
zpM1C+u8gB7d=!O`qVQ1^{w_q}&T-d~iLn&acLN`}SW-j;ktoKTqDTf*B#BJoxQ%OC
zgDZVZ&+ouQ{eLe_=ajAbLEXI~Nc~s_1W}(yh=?>qkoylYMwyHQ>C%40{03yE^8zN=
z`9<aX`Ycah{4#OguGl;)LBnVxYiy4sLTC_@Q&F~6#t7%^Y;%ogXU<X<poF%FPUSS|
zFbgZU%iTUuEdwYAg{i)f;O^0>u&(K6XpaedojS@`4S!WZtg6v_&d!u#1P(^H|If@Y
zPMu%h{H&W*Rg_=Pwd2dUG9Gd%Do_3peCqlRa(>E}w+BOA_{<}|;1tCPmx#DBM2vHW
z5-u4|0-sW^Pe6S{6&xB>FtS%P;bGbCm<P}Da_64y?%3`|1*iUjw(7=>YH!m`oAgf4
z=j$TNi+`-jz;US@&uXYEXbAMTYjLPni)?WPv~zq_6w1-nwYNZ|9W#M-ihj>BUGyEF
zX>CG5&GcLk)4mYmVJ{$%=S3nyk^nIg1SsVskpbhb6gx55tX*Nf`9+;jEFEeHv)wL4
zW5yW-<tf#-To;kIRsB}{L$5yP6xM)Q64QE#Xn&Wa>9lzcoM&o9Or2-Va+ow>e7Q5v
z7a5S&>y_9>`e~z=ntPr2X9i(sPP;7XH4o%EjuM!hh3StfxLN$e_&;mP^@zfRt0URU
z1dw_{CSHQV)b|j<QGzJ;UBp=$#tC-=<~=-?S%v4>h-TgFZg1_$8BW#t*3o_QYyn;q
z=YO*0VY30u8@Su-Lg<&R3+a-&ZHzPgX_l|Vv*mKki>@86%8H@TF0dq&`?eW~5r203
zqcIg#d0D|xa(cR?MJYeRc0GMVZ&Z!XX+<ZK^X^NNY5Un&`Qhu!-Ac0F95H37P5II6
zua7T&(c~OidfIQlHs5%SN81{d+7k^$wSTX@tv6Eh%6M-Sd=GZ9F$(Dxsf~Ykd)&ur
z4;)8#HwQmfbLt8E_07*;Z_<8!^Ydt<^f~<X+ST3zBTH(l5py4D#B`Ik9WVEB#_QgU
zobZA<>&@eEU8-;O;az|G5G<Q!5o*C;a`NG_;n?gSbyGZn7qry5?(zB@G7l@sbbsBm
z=8Q0pHVygp&CeU!q1R*o9ZQs1|7x>tx;+`M&tCoA=Qq~XTcJ}taV!d^X5MMZzjsi@
zEL+IK1Y9d8LvO?O<E}0I#IOK+$qwK9V*&jif74pOy%%$}mB-)e?x{Um3QMy0+HzGa
zXLr?SEzRERw-P*jcUHW<0A2t30)IN&ceL^$W2~*|S!#|_0c_FVWufZ^0YiyLT|@#O
zC}2Yud0^*DC=qP8p!Thlt?xjo+ct9Bng@1^RFNYJ7-N(sX__FK1OkyHpokK}QOF3V
zGLB>Fkq4dyZ~(|rx|<%&z`kYIOh~UaK4j{^0XUPD6jSE~&1NcIqtAG=EPrw?%Tk#=
zDp~<xyjBeDWv!sYH6anpt7;|}QW4`64)E#}<(?A;m5$FC4l$2#h<xG!#>SI~#V$pO
zhgnKQ%ma};esulbDsxxobiQ|`)3njZN}WnC^)p%ewe-%ZMU+`zbNcJe?Q$QZU7hQG
zn^xh+Xq7EWY}2R*)<U~8sDCc)ui2`uPStIkEtGuCMP`qjEvS9XHjRwih$z>#5dM5s
zUCTnLuKK^;K{|5Y{KIAEy^RzfWAFcV=&i?99i4+njh~7pR=|P3?<txsGkGxYW+D<1
zxr8D=h!`T2`-pKCA>R+ND}3&|IDT>xf|A@6L{|wuI$F&7{XXJCZ+|bUE!ew|!CzJg
z=hE45v+HM6%!{?LRdX+$b+4WG9<^S5DK58o>!p|uB$_Q=>oxPRQj8w%ddw~zFX<g=
zs-4+FhYI256my%u)Ri;Yc;+<C?2X{$w{!69t2P|+G;zZu#i`4Yo4VkXO&LnUK%zLn
zk?*J2jicm#8sdfi>VI`!X8NnwYZSY8MF!6E|0xTR@oGPnal6Va{asgT>a11C#$Df0
z=6{+=x|sB`kzD6DonuaUT(1fWo_VoSe)UTCtD{RcK3W||yoVC0OGTee%STj6U!*Z{
znMB-W7!eV=D3*SVd^e;%p(JLz@!0|pPK{-$2UACTcjsWl-hZO!O~u*iwo`6QFgihA
z<BWy}A^RN!TI<jqnB(4+(r`(f8n<@q?VdQFGpbwIPIf(A&B#OcL+E3Xv6X^jDS`%t
z!zkojimau9SmrPi8J#&x6;`A`Wrvu$e2I+PePr6CE0Zux335{cnM<PxB@qvi^l%iV
z9JBZlvdL|Czklb2`DSVM+t`g?uh7ArueOPzY(CiCuXpp91OQk^9e=&yS~L$$ouL4*
z)n%$h0LOa$rMTScO^E;Q97UU6`?DUmH?myKs`Ks%w%wiEdFOcJZh6KY^4<+aiUo^2
zlqP~9LI5`$gcK1!OcKu(Zj!J^*yYO_|6_1)aH6jl;(vGBsN1N@qjLKGV)`z-6gK<I
zJ9Gm5%-#|@#92MGNd5lAl5CW7v)S(NPt@3-d}wt7-Jy~A_g*oMkX?7@_b7?qD~7!9
z*W5RF{4N$eH#{5*9yBYPRV_4sf5D|b3v0JUz&Rt-MM)I<kUJqoEcIL@q)0rHy3~VM
zhr>IXMt_1cjQsfmTr`wlt2N#w+){F<=|=<AHR5C)Go0qd)PV(WK!iHbt#tnS{1xg`
zE-#Bb&1T?;GC3M_JhCpR=4m!M#f4HPE|g`t2`rvy_NGR!(c}H%7yInhlwCau3Zjdh
z)BeafzjH1}oLLt}s>=*5TSGmiJ2yFZo+<fTmwyUbs?!<0a%eqlH!7%F!K<^f&KXh7
zZrd@Wr5VPxQt^OFy|=ndw(lB)JR%;ul*BGiB1Cx{Ai_cq(Kr++aGCG3fW|UBnE6Xb
zMD}peqpPQnovpPKvkE49J*kDE7Ufp!3DDZA;a@5Xfm*H@FuQDt=G@{Eeh3Gfb7<St
z)PH&H>5Z=U`Bp`BU+LMmM(e4^t9Aozx~095TUy=R>oBO+*=1kT-Bwx<UcE?Oo7HgX
z?9YL<hO5XtQ8#94k_P;HR$ZIO-v+L?hCpl57)zQb??~7OGYLoF#^;;-e6W(1biVQ7
zIzQiNh`Je0*fbjvc%89USiFCRUwcakhJW^-753<SUGTQ;0&XY#HE)Bn`)k39&8~8h
zuh>kUcC%)ic`}en>s1(kZzO_yP=ylb?u_E@b{6n+CW{2D2#c?%Y29GGbU}XhqqR-V
z!sXdNYa3gOK(v2TRyh6BKnOVbaM|zd*mH_RX*eg}JD~4g67I;{4<ubYF6nNTXn*}i
z8NQ!LyMdU;UBjqUA4G@fNAmT$q0h%}yc6o&{>J+-IFBAy7la_p2jm+Yo|=c{9lNuC
zt(olJ^kiG<x;v^P7H@dX?;bMHa1p~PLxe>kN^t5U@Tw6Hhs2H9L#VyFjV)_?myc?_
z3kECR&ziosR#)Ng)(tZf3D|@QPJbQwS%Lzsh<&STd8^;f78&?SX0>BW`_}Fbo$YdZ
z_ep0>q-v8Z%6Yj^1l%Cb=$uOV!X!4XX$_|4^ILUMYMr?mrrJghjSx}-0N7l-I&`=h
zMJBK5=PX|pd+D)tF$(%Is>6DT&)tY{gxw@Ugr_lLj7#K)sU)5Zc<Mf^@qf2X>axY8
z_g0HeKshTU6}{<x{z^?KKxU+KLraH_PvnD}k&hVBBS!S=VMM!VJp<yqzx86;XN=yW
zkn>k6Ytu_HnN0h~;8tyTt`Fziy3$3OpTEc!boN5st+fYn+C7E$F1lMxU2ON;tqn=*
zE6}&Y<Jp7MTisqb8lU+~UVndaCrESrq8pCQV4|m^@XmqFKvnf|jitblde`-Ut)SN&
zi;!3kZ}ZGZ6P@=bt?*)+dGg_M(DII3N)a8`YJ9Idt*xSVfqgvc_IK*`52~z?1Ep`e
zLo2(#px=|%210%kMM*+D4+Xx&h)9+268q@?XYWmu<VLbI!K<L7DwnT11Wtb&hZ%R$
zkW!I+iX=|ah9pjoL!K66IpJQJyr|Ed)ByubmSlvA$Rm;G3gTq0%`)nSVLW8=I#Mis
z0*WQ1bo+uCmH?e2FWLdfl^B=+Fq4UL(7X>$CHQq-0Hu;B=4=k>nPmGwJe`(c%Y*ZS
z7{9`057g4i3sfhW(vEP_<8XgnfJbPPllHL`k|vmykdt~Fu~N$HghnDDQNklavp9xW
zTSl@t4c#=2LYv=J3xVtE^YJQ;n%^-3SAu_-?)OF>m-@^)5P6bHFEkRKC+U*ZJZ@x5
z3T&1}fgO=B3Vlcx7?3E9JR*XG+o?xcHdH2k3brKqiTi|p&a52uG`N4LaTbiB@3yZV
zzTYpo60GX4H`cWqC-{y-uo;cVV-M0G?8MzEjPBkCdEC6omxhSac4$Hop<lm4%U?I0
z%_er5-m=<GPGe5KwiFLf{r2P;6`Y!}BMZ!z&jPc#+~&z2)H1JxC~n6iqgo&HqiDP~
zNsn>}-*Gqgd_Qsm5~P0#Bh(EjiM>dW#7^9hWjswB_t1FnaHJl)RDC#351fqqqx4X7
zy^YZ$U^MaEG$lzWD4}7Jki<!1l2OO!SttTGPVZs1?kk#Z8x;TQg6UdFep4)+L)}n#
zG$V<ilu+LZ2@|15(v*f_z-XL_gQY&&Jtzyi|5;+LC&0=v<obVeg<Ky4tq&7uJv_`0
z8Sljc$9LS&AtH8tLL(cKAUMPhSSExUrnVb=83)Mc59;h6F2|V8V@&7aHursobY_|7
z#Db9oGI>)0l!wAki5>Wi@g$>x&kqgsAXsSVilh8?Pf@b}mv!;p%E|>7)!Cr{d#97{
zn*z|~XUZ|?MlFB84sGg?oYcT$m1$XI`Fsr?Voj;t#d;<IG)uq_#@Fhj3FjTUnUo*T
zt!Islx~eTq=m;-V7)EU+4D`GzZG2hfbMSI7I;2+&`~q>ZJAT?&Oc_ZeW!AA8$lxM1
zhL;S|Pqtk+x1N+mokJVxB`fAK8Ro>GHKp~pHLJk9P)L7|x~nqB0j_(8`8F-}zpab+
zM2+MG9_E4PMX?<c8pWK@G>S+PxfyW-J4@{>=AP|-d3ack?iTkoO!(P8(|(B<GAM9J
z)Z)682iw=F?lqFpYiFX1$CANA|2;vqurK-H{iuZxPc3-IzTDs}rn+`FN3R2WHEoJ*
zL&dLYIVpb&YuNFLwbSpNcF}rXrczC(I%b^XH~K{xAz`zLr8iPNZ+~6K!0E)N@4odQ
z_}c<0^MW`eib@@i`fi#K5e1ac%yvi=xE}GH%oEJ<k|Y_Z%Z@k8H+!?pb|>jLUP8x9
z=#yMRYD>NN>E*i)dG{z`S~u1gqPZ-2eKypMKFxoty6GHXFRUCRtYvt0uVR%!8nxwk
z5qCQ`Ve@zI#dSR>@T>jyY`VcW>m+53n3vVHYI4vImA|@eOv2%+V%P5$qL??A{ic5H
z7k_&O398#<<o$>8Gjw9|_8Yd=hhHKK{<SoMolaA<9Z1XfhRAl9yVj>4Z}cZ{uC$Tv
z2nv6@-}P-j9+Qg;YZ#FZAa0+cz4-K-nRvGKe}i{6)OGUqLa`NDzn<XI?MF#(tJaLj
z9*m3;kKO<7qkHuh_v+#J->ajwcOXaWy<?5<rMZn!!Jm)*Xaez$oWv8Cx|wG?B#pC>
zPzQ2uu+Ss67Xi_x9|<N7t^6a(>AMnFx%hvejozm(SoI!{?!T5`9zEOSez~Kz50xfp
ziIwg2(?%BDTC(cB;F8>iSp_z#R8i;F&q#gL>yTDcu|-`X%}^q&hP@Ys#nw%^glydy
zN{SUemOr5u=1SB}KJWNBD^ah?q6P+}XRiki0cM=5>MQCI(GeLZRC<KSPXN!~b&-F=
z^(YmQ<+@2raC@rPD|k(so>@_^SS5<|T08kxR#UC(E<NV%s|iMpsKJ_0u!Rv#GADG1
z??JLuP_-p)Vv{gSecOw9=6ZXPx9&32EKS!HORue~y1%lN?(>cdNpXCjl6D4b0se6Y
zV-JIh%3Wr*DiyQ!x%HQPez}ki=pTPB1*l8LUII_b3g~aJ-tLdG0teo7!Rk8Ca)A>K
zp%%q_sD_ok!-}~}@%316df>w~dX;Qg$2<A4D`$xR{Gb1~)JK_K>@W`h`9J>`K7HM~
z$F3XLOV*Mt@-#2k^?&})|8;hYb=FSmBtx*{g<j;5fO-L;uH%t7aw!SjjJkg`2|_ov
z?^V_w>B5Z-E6;~6df;TKhhOfR6FvS)XWv!R`RTsKl_ZH$$D~=-W?gN!ZgH;RWZ2;6
zU~;&cg7r?^@596~uPV^^G`WDzZm8k>Px!9j-OFt?%PS&2u3(JBLO_6nbz#)m7kktj
z=iu<xi;6V|%@lkz-t4p1j*5R+7j4ylhu9_Mce)>6*&Z5=+YGzOPqrVW=Qh9B{%QkX
zHlxi6{e<4@kLwGN#>U!cXV#ZJX49{^@-;X{w!GzOQ3}u9R;#PRlt<n>@~VHVP7mzh
zpwBW8)BNa}<;?6&Rb7}u?x-l}zOi%d`)v=+AI`Qe#(oE9y5MZ0qr-m>+^S-3dvMeR
z--u-nsS6I1B;<}0kOau<sh|Og9L@<3Jjy&rgkBJT+WQGn!bZfRaMHQDBOX5d)BIfG
zAbH&bh+rxv2JZJ>;k>p^;KEk{Y#A`VogA;S<5hON$_{^(jc$aCi^1g~RiRRlkXp+P
z<$5<X;?sUjraD<x)LDO}O)22t%<FqYJGzc7&2(U))nS{h^s&T-W`+a1SttPst5*8W
z*=;X)_%ZE9x|iVWs{|3+n^*PuV%UM5z(!l?5p--9Y!8VzB9=KxoY^Ff{glwuk4PK`
zHi<+Kr$HRpaTM;GGsm&5SFUs`Q1rCmeI^;@faZG#)yXzSw^x6za>E<&RF_%H^sT77
zMxnP;v|kf>bqwOQK7+Vy_X;$)G9)8qixeWRl!MkvRH-N$aM7Cz#aS7Y>?Kl<qm~E%
zMXJ1hZz*Sny=d69qi4AyD|Z`{co=b(fTGrpMM`KOT*8E)By;^hctMnM?%%Jc!6d)<
zc;0TJX&Z)7o1A~a$+cW^$^&b63h5geq>UqM1L^Xe{o}q0UborJUJSn<hpt;Nk@u&)
z$Be#-V;j3VwaQWHvYnWF(A>LM-5GV!@o!6}?!mi#f^KjQJCoeqK*Bx2!aXd$8wvNY
z|6qX~UI@zAJ0QKr5wX;ev^-c7<&h10^FSO;yIV}V!>NC`U&3E{ucqDJg86hN-qC8@
zm1Xz_a%8A}wksF$=Or1Q1}P(}av%cc$DEST77n32@<}3+gak?AdffH7%j4U@(PstE
zuX4U-ivcn{3?j|D>U-dnab5`s_WerWsp|H<!BbiPBs^t-h%(N6!ny4e8VgRMP`Jbi
zDD`OUdvSjtJ|R4ngSl<~z9N|VSboOu3#T4{g7ye??;q-_wYewO9hCaQ!LI6U5ACYo
zj&S#jN&<6)yGOWtXt=9E&j{{DVU%&l$1u_mGM00a#7<1?geHOo%!$CyX>YjutY|7m
z%4&XisB3~-g^6@qhex%&n!iw7i@hwX`8H%5h0K3<B8QR?qPwUoJi-KX33a?6je?ka
zG5=i1c5)6sBeGRJIbz!*w*3OsxLa4_5#8Pgx>ZAdROcS??XK!vy-U9^h3*}-t@oOE
z4t2)|K)56LGs3uDBzVebLKw9@LLCv2D0LGOrnVpZBKDGy9RlO7@nAm)$Q{&pSd`oH
zuup#h(IMtN2r$*(F@a2dH?fn{Pe>?yN+|PTnxc?IEc5~vrLGr;p9Gn18|!`0=#ir4
zNKtd7sQKhj*i`Jwt-NQxEmaC2r2N+g;CM`Rb)yDTPrxBE4Tmz+dKVD%btKn1gjR2S
zvySuR3O9AQD~QLbAk=m#i6Em^9Qldsrb&NDL;n__r{h}C+2z3QkZE#0^w>QJ0)lit
zW<;@sINe38ZssY>gOp!oB^|HNjA-iHF(q!zm`n7>@02<BWi@{;uEauGIA`tOGGCv}
zV`Q*p-B;RN?aqrI(AG5p&TP)(#7hN<LkFT&lZ3<`hu~;GvsvbHd$@=`Pu5(yIBtKR
zG*@S)!^z|mvw4JeNA|%Z`{3QRoaW&s)3L(;!Lipr8oOs(k=_mG>5e>wI|9Tu*{W>q
z<n6_<dE*_~1LGZi#Q%CCd!<vWnthziy*kO5ctobRv#k&2=O74`Mn{Bt6Sf$^Q^&Ts
z2vP>ll{TT2hlGWWPbiI<7sVnL5j%f8JcYgVyFjPdp%$BN2c_`gy<@EX;q$;!?D{rT
z8ickVrXeS(%`!s0&?AZKF+y$I$&ys?D2l!fRC<J=M-uEK3HGOip@YM4M;v<N5qjT9
zbku<<C^|aVk683``gtC)=qJ*a_5sBhiY9TGh1?~M?{Y!`k0u#QiEsiZOEP~(Z5rGH
ziptwxk*Vp#A<MFEb^)K0*wd&OLh&UNAmYc4vJKt?W3H$hOX{h2<_g?wDsI#MbumV@
z{1ly`9XWM0-%h=*SCXq@X3$o&30L5lU6n9+Ia^pO+#^zFykl0u8{A#xz)wY=hjGko
zW)l{9KB0DGlf;i13B4e(BgTItJHF@eo}K{FUmcrssN7S;jLv+wjptpygDQuvGMO%P
zC;B#g)hPOmU+lydH@huY+!vlL(1;P)k7B<=9j1z?HAhMm(y~%-WxPgsF{nl2jBlLv
z<W86MCksCgz8ouKcbICv7j=+Q8hKIZQ9?at6AB#6G3N<k0i|guQr~}$*+Fm2sU&RU
zgwy(lxj}I=ygXY+DrAYn3#_YC$?Yl?Zh8$DYAw=rl{eQGgDkrRxUi>exnlXesL!o8
zlD@dM#1&htWi4g4x#+4Y=M`Hng(b2KuD>h!yOD1f$Vt&x>$<&grN_~2jD9$5b-vtu
zPev>bL~Lgy4E&5xJGFmFM8kl1b{dDAda38$uYN_(m+WB&EHKhy<0Nf2()Dh=9WTAj
zL8kf+-041%FW>nN7+*m*fdIKh-sH<IXyACW9B-CSezOb@p~3yal7L1jWrU_QAT$j<
z5(k-0!ic7El8P)2fQkJrwptcEm%!ogd7UTuB5$ts1+1V6@GXB!c)}8S1xrqHeFx?B
zpZ>9Ci=Rt;2*<X39Zxyq12FHpMJ&g$i1qZZ@>(*H`kgq@6y*A2S@CXQ4KHRIrNX6*
zglUozngju1G;|2hgcrGCBDlMIu2X9w&AfTPY78b%3HiT-5c5wwx*L|j1$Kpo7F|dh
z1Nw<dA3WIJ;)8z&h7jB8&P$-LSms4uHx+A2X}h`ECemd~HS?rq3pR(V6IAP(@^xnu
z3seB%ewtTS*7Mg=sS?}#3|&vlO1lMrci-#O!4OSzr@<<PxdB{X<+!8!JZ!?{neP&2
zbC=LKW+e7AK|(vqf{-UZ<3p8)yX}hqYuSjTEZ_ebHb{Sa(c^Y$vA*EBp?Yb=QbX+<
zSL+X0&ccm_`q&R}#yoOt`w!n+32qmXmWu^j)#8!<hko*?C=2m@!qWH9or1%gW%cNv
zY}@mK;Cra<N4cPXXsY&K+-MCX9l{p*ym$n}<Nb=QtSlM=Qqv>XUVT)5e-N+{9wp_1
ze=pnnaG8HM;(OKcKVYj98$#wl80mq2c-U~=wTE3VAL6*EzvTZuHrHS;1ho>YO4Ptl
zFY1)RQs%>?<2pS@XV*%uJH*-uwzQT4gp%5-80Lg%E?Hp#nvp9VQjgRE7@Ji-k-WGn
z7gqq{E6L%!5FeG@v=aYV=Lo9BM<B~roXn8^BfWowy;VWO_(ERSYtS1>cwEe_<$BTN
ztA#SV&a4EIMToj4X_aFt6C=BbOrb8ISh6V7_kv@N3eZtW+nchnLDCA9^;i}<SF>Rb
zV#=!OTI$y-YgOf?#PS#q3>q*b<A*#7Qh|m?&0<l0Ad9>P?rC`f;Mp)=lnJQ6Wb2q+
z7=wQitW_ld0$Ly7OkIJYP~MvPa>df-{D-9a5&rMN13-eyCFUhi4L*ACKyjHGqlc4B
zy3F!@>O+}|MddigzFMMaDv&tJO82f=7YM&gs}g*jigv&)p4ZhHkC*fD5hQ);2rMCl
z=^$#r&1U!)y4<HCPKk)4n9!69!W=guLBxLoFLDHr`Ci<g!~J9Zy^GjJVEjkOL=AbU
z%}w**fn2wkl+(-`ZN__p-T{VCN^`xlp5#T|<WoD!%>0abd727#3pQlIWv@1y>};zF
zJq649|NiHS73&3qCH5a@7DM%iw0zC1UtT|#W_g78mzZ|~MyQ@yA1?ESy!=+V`X+za
zTLN^pn7bOfohNIV(`Q*qxeEOmFjHMFK!{!C@9{=glh{w5-H5`f^EqVeuCMDxEb~-v
z(r#Pl%cbBjDtZ;^4Gx<^x(Rm&g+7z4vRGVqa=%>j*?Iwsv0Kuss!SGQIh9SjTXk~s
z9wL4GgpljlUJ`kMOPFJ4geEi~EcAav61lORQa6a1fB#8OIm;K<W;$)z`Hiax59EFV
z9U}&QUNOjQ*jqT?caN8O0qQx)jReD8osN>Tbkg85FHYh0x?#)J*_l}n`?ya%?Bj-d
z*nDnXSdeL|%0W{n2GwkoZebGe@am_H`C5{&jwNqAw%*~^e)sg1ROwD86oG$F^jfyj
z34tFfG87N`BHt%#_L)jB^X`||&p%&petG@8*BN=veZKy5=WLr-vR&2Ig_W4QWrjPk
zUF#KG?Z(?#RW7lB+K}pXxL)yBxxMtSbt6{z&uwXNPT72Z2A&XYD?_INqjSHW;7UW=
z0b7VV6{r0LIJ3{t!}Rs@@jHKVQK&b%K^ec;PT0&og9D+gP)O>Af%Pp8_BUv8SmcGy
z^bNJazxs-STEKPtoF!smJovSJ(g}nRXFgcJs*fOE^lc1yX$>lnlY%~n@1Fj3T=I_<
zjKH?C;I}v~TH@;7R_+B`fUbM8)!q7wYi?M2wXRl+of_6FaahB(0Jwj<TNgIfA$xIC
z9l9rzA0oT4t+?Ko`;VX8t&>xBQ_*(+ZtCvaNu^&940L{m7+@y#0UX?m(RYI|a8pK{
z%uNW5L`-6v2PDf}#sU`lBKALl%>mdP4gtq@wbp+lP)7Ap9TdGr6$w+GeJ(tMW_a8}
z>aWk!9R+A+{eOR+zVv^=%xv-}DIWj!-AhpP4AT6lWjrz4(qFPIv(;&Gs{FU^gRsiC
z1A-Kk$pXg@b*Z57uqO{%&)ay=Cf5X|-hovm5wYv1G$nrMM1*>gPa+Yy#E(-yOybaI
z>0S}RyXY?mCnV%c7NEWAt6v6&dN_n}opi2id$l6%tt$QND^Y)d=s&Yy))t}x{ohlT
zF9aW?FGh_?Ri>iG%(E)Bb9)Jxx0hj>zqXRHX%?ao>3dX}iK;5MSmsArV|&wv<1?kL
za1)oMNf46M4s8PItqDsrhuE&4+CF0<O7@QCR<YXZ<bZGPk9B?HM6E2x*O_B`E)|^y
zdD<UwaHF=afmeSylilhj_ckL5jw?#VG|4#Q+CfHbk}(kz8rT_$!z3bZn#D=rd3GFS
zUmVoHHI6xVafy`KAOY`PaK~W8kIsUh##zw3<hNdwEj}B#l$`y3Zp+&qrGqOl4jj+p
zu^=wZ5<;C&5ay+v@GOovXEY6L_DMXO)af+x|DCiP+{%9ecq=}<i&NC>E?!WxJ^Y?-
z?F4LD`)<T7`*5qjEe`Tc4!8c%;r8foyDx4T99*1*2~8tVicn5y?1Ur<Qci4|c&@Nr
zPMLEjLunuSSxRGN#8VF}rw<;yLGvXXXf0OnTSYq%xWUihbRp(>lY<3F``H>kI!oDw
zGYj2Fq%(g4+RWN6Ek$!#0>p&e&8lE?DVC$Kl@FJBdTB|IH8f<4^s*=y<s8i1XlRr+
zP4EF&u)2maS8S1UBWR`V&>l{=-OQ@8r0e`tTyx9=8Vj35LB<J9?TE09QzC-Ywe7@l
z(kM94?ezF2wE5w(tc6up`8)?RuS&CxZcu7%%x-@(F^^FgP%CCB7^ni_EmdN2E?|<3
zl_IIb+in>4Pl>5FnkD6nmStJDyEV=7`r_PjDUF+JZ;96%@Z)4o!O2p+*S)ECf0CR4
z*E%S+$jbAlFqcnp8~j~PsL>>j=I}dlqO>7vNAv8?L%GK=?w|%84bN;-;>MdNV%8me
zFXVs9yx4zip~9+Myg|@wR;ixfrp~jO)lU%AuVj!s=s;;KN6T#dB^wq|J8k3PG_y(%
zo}RV2#w~Etf)hYyl^#|zVM>4c%G3*8XfbML{gl^DUZjm28hFIzv%#3bX*OtP@GY-!
z>Y)GXz`3yOnPs2bGfSrR>GuIM_?+9A+^2tGi<#wgid1bC?U$Gi`tGh`*{hSc*2S==
zV3d9Os!v#HUG%Gmcl2Oby-b+$<-tI~>wkdDT|<JWujG5L6v5*+Y`?uz#8`hG?lox4
zI~+CT6wT&_)p8K>B=>&14lDN{{oExj==}yyYy*?yES7dC5+_cG!v!Zaia3cQo{)bi
zalI@Su^k8DA>{?Ml7CKVL5GEXIpTuu(XHeKEWBM>NS(|Pj++r~GvGdQJrX;iOCl$7
z!_ZAU&vU*2X#rQp=av<)6GutmAd&)(<xx&J$_clZ69!A@C?$M5Qi22m8)SrU(MENY
z5sos#7bqhP0p!pZC`j#)W-(z|#t46Pm`5VpWyJS<>Uc3_BJ>U^A0X-JXA}?W6<dBe
zq5<^gR$>7Z+%6SlcIGmk#Kfb(jmk5d#I^{C9fiyd{6z5VORyopdidNz0rcT06C6Y)
zfT28!1V@qJ_98)l1sx@VZ$~1)tN$nv9E}D?qrvAC2nNt`AP<Nr40)W!#7lp;N2nJ>
zB#uKtV(Mp3lx1n=XSZPV>mL)yt0Ph4P(0|4nX%LP^So|)9DV}|i!vLfL~Z%_H7>0u
z2zpG3p+)C;k(L!?9$Z`x<p(6h&}N2_WT1PK0Rw_4puCAd`EC8!<;N0T{RHIq!XUC8
z+aaN#386`vl30X-*lEgL9y@<Dif-W>wt0qR;vEI*75$OA&9_7hu*G6mkxtE~lnU~y
zlOW^{Xaxxs;Q@0qGYmkIU$~dQOQ*ZoAkQf>sEz=`0z>x(S>jeRnOqay>nXy;Fcy)+
zII(RO5Xu~zBxw>5KZwHE@w_C7KSe~s_RS@S3I=8(??pRzdYjev?zDgWMFvF9`rafv
z)pTD@JG%uJ^jqIIXR3L=pS->3SJqMu9Mh)m<S`=0>Z?d%Digiu%k}bUCAp`5%IA3l
z1)QDX%6>QB$j5=Y5v4qh38fIv7=;O8KI6o5gp&mcO=xt#nZw~q+nfq$d?dCT5Xs1-
z&TG@%rmiIH`0w&0{ThEl%dN@S@_y8``tk1f!fcr3W`|17b^4pLv)NGdvQr;+^-7f)
zWpqZ9TUXt$MpxVab?0@pxdG*pdk^lh+ppT*cZ?=vHW?7V--RrjXp`T;mE3Q%rw~#N
zpS-;o^<^>@<x~fcm;8Qip~p*pN+=p#?w&{zPHmUifyfB;SxA2pDg;UW*o%@lN_=X6
z3JT~cYF*ubG+%AveBMUooCL1pC%#8gCvpf4VvjI~W(Z{LI1BvD8xZUt>38p$e%C@~
ziRm;<yVLI?PSkX#JMm(-y_lro?ond5JiA{q3AQ2v9x|h&-k@dY&4l2<$ZRbkzPrfl
zrLy8)ip8qWIBb9DYCxF-Y?<?U1sok$rop&cFM#{B!i1+?4X6gn;R)Q^io6!tbh9eQ
zlIPZ6z@9vGDqxKOw%@`MRmoM6rdk7uZ^5kvkn%QV*G|Toe7+Vlt1hi&S>#PAy#tU}
zbt#%EPeFADs;7i4Sdk*ti0=G{yt#zG`5Ll+<jwVsB)@;yXZam{c3;I<Td(JH0a{ZS
zGh&Qb=ea->A1kg9Nv$ln(*8(>6UP4yK3J;KCg^<?m;V-aUmklr6oRn85rle4ND`iM
z;)HI(!<ca!B*5JjlY`x9{fs1Hn+ZzPU`(;;jyXuo#fl7#2CemDt6p;sq_;qeYb}|~
zga-OTi&=k#_%K+BR?2`Nd2Vtz8!AM}O0AiCnZ-rA$R)!v(gU}%moM=QDdtA~EKS!H
zORvwZ7v@3(E`BU5SJ_|>Ria*%1-JgO&eQimuv;26D(2oqWWdthT#9SOyDMk7w=ky&
zcXhTP)%@5|-OC~-s84JfM}%f9B1z00;`t(WgV=v_126vcOuOCgITG#e#1b>kA@en<
z5r#6}u4;mb%sD$M2gah{6I^?3OybwgA&ZCcgwH@r1B+ifv+R-6!taU#mQ{ish5~kC
zzz5Wv$zrW(J>TwZAJ(_{Hge90hPLNsKJfz<5gJ4eiG#o=v51{84b#~3_hKKDpR(1!
z_-21+rnrt(4D-CU$aKo6*!#@B_hDWQ+22|Uxs|4nlNl_U5p|rwJqODtgDeUXaMtBQ
z676G_H&O3J45y}M8!ud#aNBdkh=iDqFH17QeA^|lpHNrCwiDQ5U%NfbPHnyFsEO`i
ztoN0~^5GJ4N2r-mI`au5{XQmnDZET1snvfLc->$%OgY<BOv0@$!-d4Um`0%xg5PGE
zwx^yIZW4oq!gGC2XcojI;z2?(mhm7617>^d({s-4g@JGl-i2oFn3DE$q@+Ev%pII%
zZg?&axtg*t=5~}2Pq36w@XTRe<`R!l<|P^R?ex>6nck3N`fwa`#~uBp?C38cvGjkD
z=kCaJw<l5>dZDJFZ~HtV9s`!+1k!=Ukxvqq`OHqKNIiNNh2cR+?oi6OcWyfjEX)6~
z7E?h`y5s*?vx*fBsJwHPREuB&t>oI`B4g`CgDPpM9>gSy_;^*WAa$|;TrLWWS@O~|
z>r=RRA(~p<Bd9EvQVo2f_RaiI=&yh2dS6?_${Xm@8ZITs?*%+hdxgBIwW7IBws=nl
zv6nb@=n|iE;6~&&VRq&dH%S;x-6$0NP~MZcpl*zKlcFXVOSE@SUvg;)^md)~yxAQ1
z))l!udES1+ZZ|3dzd$;-q3=w;RO=-(gUdHx<)UcxZ`OtNSaO@|U+&Ru1oeM%=pmpG
zSXqp^KGDa1kFfktd8O8rYUf#z06Ez>5KBe?)z&4eH<7q4uZZ}#!X%3AYU@q$u(Gpr
zeMB`S`mmMRsT}PA*2(LlY$OR>TlGO$-K6Uj=n4&9x3-D9#Zk4@pu)5L>mGurzIE;B
zkv!r4$rIdz5v<)l2x-G*KJtJ1acseSKj9?yLP4lcInW%ZgvC5fGoE?W2@ePWZ^K%4
z2>7=HS=m<n_vP@Fsfm?r6WcHv=MH5_LV%i#P&af)6!VBgsm)WKWIPuB7lqLjZQ18T
zXeMRZ5uY9LS&Pp`<XN{sXY$}XVzWbGvm>$9k^J^6$7cO2e4v=~Lz{objBz3oCnQt^
zK4B4~B=NcJC$?`pDL)`Cy9Ha+Az;}JBvGFplI_hCrJXq-)_)5c^Jy3-t^jcD#)LW|
zByr@2B#j*>b`m>I50(M#FlbEDMSVUnW>7^PvDgudwODM(T67C2hG*Roi5-#HQA_qY
z(-3??NUV2z4}ci;nd^VJt{}FHkz?TMX9t`xo7#ckuFZXV7@nRRd^GQorbn6^58?`V
zYf_#q)3X~Xj~n_<mNH5_mimPH8JMyIpG0ZoIJOhTZg4P%zscd=Wsqkw^awnZRk@Q|
zc?ssyT%==YkRB2e&R&91r_8{-Yqs$8m37J_<bv2KoE(TSleK>;ls5!c`35MQgM;lL
zt=Au~+k8i+eQbA|muXJ=8ERAy`~LVtv(fjz7X#_%%__CC#cwlX&16VJZ|Pug!#~5*
z!52YS{<#7J*ZFY%2ea|?RhRrJuZ#6!acZumGw>+xFRop4Lz$&!mfKN1c7gx97%2yY
zJV3!dqU71dMu~sju~dKhaUK1h+GnFGtv{$bj~SwVFBzhG%jGcnmZDEWR5bN5gT*}h
z9J<rI$fol`egBeu{O!9(F8p)*cL$%JLw+;R85wNTAWj@N;3UpmpHRwdlEeWgf$i`p
zW`5vh&aLq%2D<N!LkA&3Sf2|1QMF1m(t^qlaE<MaNfm#V-4~JSKHLu?orI!^7so-s
zIB^qd6Y5Y(nD8=^hAa(|I7{L%JuDRM5BI)ERF>NfiS{w*7&NN;@Kb<Bz&ZdN9&-+X
zUcVdUcyz5ZR?J>Nc5>b9f@ftx#IsxL_{vbL>OG>z$?rO%*Q5L05xpMK>%O391Y7Me
zWJ%!I#E*X<Jt}uS5=B8uc#_4An~Kck;cZ~+8jWKI$E~{BPp3Eq(jkaiN13O<59+~G
z1%GdiR`nN6z*Xiau@?)6*bvQ5g>VQ9m`7|UV`1RMEIVAN^sPr(;nmCXgSBMEwZ*k<
zqSC(kMm>mXPnm9^dyrhq(u&m!6sAd4PLT!anb3cF(Ic$<U0I=T5fRZgX#_=#x*=hx
zT$Z<lZnCh%Z1UfG$3b*m?fKbtKOe&&wrCOc^c_O$7D_eY&1$i)T3b1>@V+LU<zW<i
z`nDTkqtM}g>c%$7d~OpOdnrjG*CC1TQJ*Iw^c?pV*yvf&RE)f=<_A~q<ptb~Y^dMU
zX)AwjrQOT1w`DcIJ%nnz1z2ib3@-Az<p><z^|t|4*x$06Z_@)h+>0{mM}%iwfbT#=
z7!NrSA`09{M7|IQ<I6wj%qXy>)q#3uKAiw_K#adaP_?*8CD>F9*7Z>*c+?3_FPg7R
zD=62qsTR~Ld{4cgEcOK|2G!h58n$((kCttP3+7dS&i5p_|8}tAV8wh*IPqxP-UBa<
zU~m!yam>PuL~+OnwVi-4;iiN~PLO#lrm>rRt^@??BW|64z-8R?97hlly9uF;#w6j~
zCSmAjcI2njA7)P40`aY<z+ye((y6V}H-N}ql{wJB{){}-fYn|W;-@OV(lih9e+eNY
z9{q-YC7U?(mkfB_%XJMQHa+4QhLi*bpM6>`7Az?xlYzBbum-j(<YIzscC}@8Qg=<#
z#bcKhf|URJ>kq3Re@K3O!!lt#ZW@+e0%N4~m)%@X*B7kuhlk0JKRjIh`1bU&X;$^4
zhYuHmRmFKnypWd5hoT_s`XN_j{G>!8e&Pjx{==GqFKO30$sm{Fsw5@P5`ui+geB#=
zIqP-$kL!HVki4+2@@ie1^z(Vq>wNcb>rcx>a4z^ge-Tg)5zP(Ib!_v8SxP>-$88r6
zcU`^^OSS;%nI(u;svM8!P5W=jsyTZ9z!qM8#Mf4gOQEd&(b$x!$WoR@5y`yJBQ&Ic
z5lL*phzJAQ&H_(xekk$m=4=l*5cnf}ILhkAx_H>G2f%tTF^`mVCf`;>y0CCs4f!SG
z78_GV$pzKEg)(8CvZ4@NN_~YvRS#iZD^Zb^sPd9a{(no-Bx6nqr51oAp<c1-{UR@f
zAp!yewsp}@1@L|MIAJxoJiu}GLZ2^xN<$2}ql`BZtpjXd7wDz|zn^09ZFJu)@_xeL
zXAle|x_}mI>y;if>-5d5mk(e5^v8!dv}c%F%z6owfR>~4iRtFXG&-n{0DX0Rwr_W2
zM{wBt=ebOaraR$o>cpXX@J1~F0=Y%n8^!E`r-{)~w3o`5$?3TLkncOv`;O*+UW2&z
zK=sB4_6aOkHBkS<TC(?osEs3cQ8z1!IL^AT>>e9@$085X+Y{EP7UX8wE}&uuP%?eO
znj!fT%qSa6e~Lf;Cz-j|x`3iHmGff|djIwEAHghQP4KV&1=8frLVlG#-bZ?DIW!}g
z#DQA{hJR~m9N%$ScUqw7JXuYDDGeCsKZPU%WcYB~v+8>5H+8GS{3h4A#W!K2Lk!(5
zyWhTJ>!wui-K?l>(Zh?MUaHHroBNh!-xGesViI^RC6vWBVS(?GBui|c#v+WlOqX!q
zxaXL73=?_4aYEQVBp#cTm-^z;gd}oyr(|R*D^*K9YRXJ`p>SK>lojTGnHtDYfCx9p
zQRh3P4uelfwD@7b$d?5GGz;Lr6iVQ9wVHA+AbTn%*n$*XvTy6vqGXT-t0`}k*{oks
zsBakNZNLf$+_Jp=`ql~~(<LdP!~DoAVReT+*4<imx=aFXnx!hQ-{U}{6@nx2y(pR+
z6L~!?F_#)7PeVzz{7`^@HlnPoI&UCvSzcU;y2<CrGhWtp4kWIym#cD_*V6itmPM9V
zOKWGjv>PgLIuQjd9X`tN)t*_KGkkfWmkBC-lBF@&3e$|lUcyKkC5~;2EEWD<epDN_
z1|I8UV<0YYd8x`o9J{3b+P41H!iT)h{lyO}0hV8VZoPpNU|7a~%*iFwWA!tGHLRLL
zvJeY}_4hcdVktl@oVVRb*>c75IcP302OB)=uR>$1y%ux$7Bj`1T)*woTo=f=+pTXT
zy?|JQ9KdC}m`pR{l#IJ6mzQTd)b}HwL^0&@q8=kjAW~unE_b{j4O}O?Uv7It%v_W(
z&KwOM+gEuHgc~z|59#qNK##rD+%jKS!(`I1-33TC2O}WZkE<MTo;ckkOWuEOsHUt_
zwqO-xb?OOWOS7gk%ow%#UG}l}?tSEuLO}-U=8t)!Hs*~QO9wq@iiUI8%JYh?E(c<S
zl6C&$j_Idxp0*^MQg9g}QE(q>dfI&fvcc}tiFyZ6uW>JbP6dk-68ezCDs^L$WIQ3R
zuz3>szKA2X&sC*Qlc#J6nFW!Rx6Xn2d;<*9x7I7I(gtTwMQnA`#iTW2J7sD;9pL~j
znzF#Pb*AsQ8zI!sph-i@_yrO>pcAX^V<tb^aLed=J?ordvGcPoyC@#mQcYiQ$vvOz
ztg>}u)j|}1GrZB@6gEj5@`4qOcD2zSA9-b|+?wi}HbK<g{b|}&s6G&+wTWAh3eU5n
z&?8ysxrA~rBrHs9!czf>Uu-8%?8D!J?YUe_oHVgu4zNDZzQRz=ss;g9!K2&F^J#}_
zHK;x7CLb<Zy_C#Fpsw7TZcmlrScj;MxRv_pr@D`SoQSJ?i9Niq@(i6Jw2BXUfRBDz
z6=yTc{Bvg2O_j3d6nUWXMm)k+W?g^k)go_BpOy<Qs#mPJoZ$-(Q9Ji5eS6k9MVLug
zy8BQ$^cs$``kCf9|I1_75Ac=8dg!0)q3>S99^+fjVSwKVQJlQJ=-=&#H*kBwfnN_*
zbZxhPHu!0%{LfJK<n4t~k#WOMeaWV-4?6q%@&DcBqMz-e8+^?^<V9Bg9pq}<Gq+O`
z;tG1VvzE}*qbdE^e!4-W1$>jw3-pI9npP3$ZBY`s{~@)6TksEzTDdyFn56=|8gDgf
zpL8rHz~0BlAM<+ir>3xN#Y<4W{8_pdJaYVh|G1?GPzx9D%kjtYT8Q`AIJ>6s!k8n$
z%aX)NW0Hs<gf!?eiJ9k;FiYIPXA#Y^^f1WN(5*fG`(5znZXgj{nCF*xLBLHurQ+*!
zd#8^J@U50@iejD@;_OR8nX5`%v4z+hW{Tn}ugU^})E$uKn^!N%<G)X;Ts((GUf_^_
zKp^Ft<CDbm7>PrXB%bgb-;F;P*u34ef4dlS{IN%@dBmDuDAqg-KtRRP5g_b$%#XcI
zla!|^kBJaGAv6paVYUcK<l8ih!q9eyhx~3B!Enb+u3HJ~hPbLOqx!_DZ_uOHE0F>+
zHBWvtTfs5hYT?_1dIL$iEOE)MfW=#XAcv%=8*RlYGu1dUt;>rU^ck&jr4mcQb9ooT
zq2HS1E?LC|r1{=Gmv=i`$u-g4?p?_T@$>V8AmV`_VQLFPQ{j==w_}pB*yEgeB4hmS
zQ~h|gTI8E%`%QPbPt5QQF0^d5Lc3(TSfh3IMor@6th26vwIx1+N1rIt+bw~AcFLE6
z)$2;sx0`XJO9!8HI}`y;SxjuoTtaE$0%b1+2kbCOLr-K*a(ECYF|`C$Q`WCc!Tp;J
zXbS7Ko8lC9Eo}3ZsA{;bz~Xp$rr{D`E&yefs6q7D5o;-3+^;8~PO~1i#}$U@Y*DM7
zJUl^#+LSu2+Z8I<$4F{CYG$l|_UaW!-Pi9%6?Ka{y&J7>O!D9Drs&4*5J!fW3QsV|
zv_g4CsBdQ^3Z0Zhu^(_hj+}_apTN|<?cCVi06%G7SBJ`$i>5t~PqhbzCP3NUvTkho
z|E?+-?sKWH8}09JF{{%m7s{-Br~6UU(jVk*v^|!kksvm;Jwh3aNo+@dlrS%K1@(N_
z8B(R+OgMl#3p9Mx)?dm60+lwg?U1ith5rMjxD>`pmd@Y^P-i+*HePFx{-Y?-)8{JZ
z;BSN4hcgx5J`pluYzl~~l};&eRgRN_>u7f~yHP*hX`5Q4^;D8zm@QWexR2311Jl~#
zu~lBI5V1o;O!DQ(Lj7HT*y&l2tG#Uqxr=nK)MRW#=C@Id0ZWB)hnvufrEV5+FY$@Z
zs30^6QxYSMmk2VOIf*+;6@Mo(1JgNg|Am6_dc7rLl+_DERU#M9_O&sb{hKF!F97!C
z7(?66YJ;J{boASAg=PFVHZEF5HfUuj9hK2H0=|y_fdkij@vats&8dDkv%HC-Z{#pb
zW2b6P7k!s!r#&m^C~O3OKbu+pM9qff)993Gt~H7vOvQOPd3%BXzm2nZG0uKs6o()d
z&50`9dHdP<-8YMEO$<2O0qYJ1^)`T4MjCuFw0nzi@&1<j`oHllqWkTa%}6)r1w3X!
z<dHawIiW1HNkl<^RhN3c<5M?_-0)LGf^QB<y>%eCZv*Wmk4Y2)*CLB3NqA%v9%htM
z>LgyaM<DpCvTn#vVv%2gB=KL_a`nCSw>7K48dM1DncCKqao=skcM3kaz!bz9>yoWj
z0-Tu3R`K)T0n5P4l&fYQJa}aNtEftHS*|PV@wzFkSL<qjF09jkef;XIrycC!s4mUo
z0&IKWwv9<?lJX<sse)Vo=(@gS1)B@7@mWN6EyvISKC>#Z5D;1*%Os%RDwpTh&utXL
zrMR|W4lu}7NGI<rv4Ajwx*_^IKvl9Ti&}IBCH=|Dg`1_9GTS6FqJLEG`u9pb;0#tA
z^tkQt{Y655$DS8Dfol^U2N9uh6aqZ~CqWt~vGAGg(P5G+cN@6-YuSjTEZ?KeqJ?<4
zY1)fO@Z8w=jace)|HgIygS20FaYHKD$F~2VLxu=K>QyZs>3{Tti4vB+hwc;{-Yly}
z|76>q7X;s9ypW3U>0*5v{t2R#U^83oW`5Pt1(aETCLqKmxwiiG@vA!pC2e4LxY332
zq#kS@gUujiD~7uOVq2Tbs$9=6<q7eZsT1NHK0;Ejrd8hLsTtLi3D&GppUFTu0cXLw
zT-T7ZL5EYRF0_oecnW~)(~@Cj3)tDq66nm@BL}Mkoyr121+->7Z;`${qR=^_7D^){
zBb8)-m<x8fJxL1WKWdK;KxgUzGY>x<5OQNg(qABlSATS&Ii-u&nN*dB1QM>X^b$QO
z;8X(EHj$N;uo8ixEYd@SSe3ZS#Ru@R=<4m#<3evc$8Q*xBE3G}e)?>VN=jT;2tRWO
zb9oAyvzWv#^N7QflyQ#*Bci+Q3I+K7{@o^jGdI*zF-8;CmO-}S4S`8&{ovwI)Od3G
z1Ru-??7S@tTFUowrNEsd)2o?t)|yk)Dk-nv-*~UK(}^-`dn4{_Q5j6qzq1vQYpXBC
zAL5!|nZsD<WrWAROK9YVBuT-|Dh`<w+fESeXETLq))Sjto8f0b{=3su|6R!(Vu$&E
z9$x>38B=v)B`QGI>a5*3<1-+QelH3OJ-d=?GlT+rjwxpU_3^8j^$L=F%YSOU?s&~e
z1D#SIfP!~kB2fUmjXEGBca5<|`?&133nsZHZTAUw|Io`O5{Vb3i9@JxIia4<NaQ4f
zh#+v%IEmscqxY*<NBuW=1F+>%YxvB6-7l$9U|`zeRBJ-UcKv&ccj2P3R<IQA5~YT;
zmvF%8^G(rWZp>Dr(;wsgKSgi&yNzc1SCCk^Bofu?s$*Q+#<;e-1f=zbdP`v1f86of
zI&c^o5A2MGaQZlu(8L20Ue_gFoH@c1UgrDk>pOjBJp*5IZLQ#<nL#FFuy>4qoJ>@O
zJD*w0ynt;c-2mk7?(_F<JQ2)F*vFkK=^quhIX!QGc>bz0%S-v{x9?OiP@bI*syWeb
zoj`aGyxLyy+sn1DwFM10u)V19;>q0)b||1GSG^8LIQ}YUOaFQghxODjtFwCiY-Vp9
zVzW&DVOMBkc+FzN$20qEXru0b29ACEUMRo|vWJ=aMhtn_Gu(Haj4}!eVLu==Vw|vm
zQj&yj=(;S6_RJmxg2!tE|D*5$iuVofdnWG%%zUj58K_688d^Q4I@$Re<!sX=D@EGD
z5f3pP1=6**cS33L992F=(;0&wnTp-hye>gz=cuM(e3=(Y-iLf7Vu99wV7R7g>lD>G
z9Dh5TS^u&w-pd=@%Fr}8gX;p+VbCrlK>28$A`4-U8s1V&{LquLA=^uXT9X063&eJ;
zfs_NrXjLxq6udr)ET6CCT9%3%QK0|egk?KNl9-jK7S~qyxp0J`_rRD;V`@#db9!*0
zhNoc?CqYWQAOl8M0qzrjA|hGlIGhEMlg8n_!-~BD#cT`hhV~B1a_}x}eXJO0>MBtK
zLtU9E=Y`)bmgohaYy=eDR&8%}UBC8yly`ggBI1IR-rm(Q$s0?{w@=izzTstf1zyEH
ze#5)?&esh#dQ+fo{_Z!46DEdRV}#)&ETBeNy#s&Y&w51F@A&6`5l{5+#EysbVNpYx
zB%v3Ij5uis9!s7eEOP_GeBaAN;LtFQKMA4u4OYEd8<Pd~0+9+qq9_Uob;6i1Ka5B$
zD5I_j{Uk=R$fMcr9?f<JEPK%ztpVHg&F^=$*dYa-xD-VVc&u-~GYsdgtk4S?Q8x1y
zq|FS?z)}WQN(<J1KnX1+gmddzqhMWYsY7;fYuy4tX`~0JgYL?v@k1J>x;{!Ph%)Gz
zeb>Eg+1;9QiUV+%wFp8`b+;7K?AhvWw7@+xDE}Z7rtL_@AX17*mx7jNZlZl)Bb2$5
zblLiQZGkgB5POH3eKZ59IT4l4+c7l28AZ35-%=U{ZXAYxBnU#A(9j7;<k&HBeV2KG
z!$TTI`-n%zl76i^xdR~}HzV30(zu5Q6~kSJRJ9w2L<+{2Cf8D;$?K+KVDde;UUc+(
z4YarvO_irZDn2uJ>a;5f412eZKr^Z(Ikj#W|F?DBNRA$$7EFXy2%$(YE5X;Pu+~K(
zfW(?r*G4mc69P$Z_SEN+jYNNu?*_~lHc10U38lg#iET6D3&-=lkY;`)KAWC$(`5bb
zWPmE4&qdX$6d%Jvm5<sSrt;4rzSl!|a{soQ&#B@&8J`_TtIWMxWhMrEU)#(mCSdC1
zIxsl*0@vqG=8(*zjL<a62n(Z(h{P4XZwCqE^p1Cb)+<o~br742@x}FoEz&jUl-lb`
zy$Xk(2~|c;BK10j(?45FPa}0MN>M=G6EagKgmRe`X=fzxG8$fCDvTBwEc8`{VF$)M
zpqEo!i&}QL2XOj*Zc)ZYj{v&Ebdy!u99(H8JQn-5o08b}Y(fJ_a_Z8E_<qW>AkHF(
zi91ezdP~kTawr)u0^ov1{u{%8L!_5QxhUt?GYK`My0=SrS!Pz=)Z3Sc^fKEBa87k!
z|6pBoZ#^{YJcGn5BPfdTDWHy%{l%yl)@YytZoC8|SO6!PIq5;$ODqN<BPF_s6+Guy
zAH)+&<O3jf4M8kxjNnI}px52%h8wCI3gw%BmWaz7bht2t(7%lfF4$$knMQ<zue>-6
zfH6BGNk#)gJ>c}QeL<-3Z71=<Bns|1wsUmK+=PS6b*pfdr-=c}#>=k*INhdrr!RyN
zV%iPu=+v5H6f;W5J_HR@$zDgg#!>YcoHUitePfWRiR`+1_&Z2fnJvl>o3Y|PeY&xK
z`Bjw{D$UBK;jaW+oK8H{S!p)*eo(M`s!OVx-gWn#bz!ljK9wm$Pfxcr{%~9UXAd0P
zKAS-@(Ou1-I;_e1x&xQ$24Z1unI&dCAGe}&1jW=%5js1j+1!v=rL3AKRgQwt(_Ae0
zw%!l3u;97O2A~yno;Oy7Z#|yRD<OG*@m0tGe67Z<lZ=wTeFs{l`m$VbIm^qEtH7MH
z64IR?f4>y0S+dnDV=(8H5XEaDpLf;#xx)JaV6|LT3NruDfA8<DF4xBgl~`4xhEHny
zj}53Bq*v9Cdso%cGDy|5Is5%_*=rR*C)oUF@v+$;Hds^B^t3FRH*IxGF=z6Bb7W02
zg}mx^QZ`Mw+>oGWXUN&^yhGgj0TqrPrh>RxzzB7{jKrz%324xwB*>`4{R7?luh12D
z3?m;M6gw)X(}xdlhLAEe9O|9w7UDq(Fz*N~Pd6%N&(0MBhp-KlXEN~t1GHEHDXAyM
z0crd`g4P;XhNLKk9Rwr}Tcp;1F&+>Xkr(r9y-;If-0poWv)>i3BC=on^zvOdZWq>y
zRke5r!pE4Aa8UGVUIDo3%F2A-G8Va4@0pCrezFjtg6TzXCv5)iy|}Ii1%9>Po=vv*
zW}PUV{k3Xw(2f6c(Qiu%lvTy9-z`KjZ!Y^S{n{`7_RRVbGLfsG^ZrAB`4yu8^sV*b
zhsc6vB0cLgg$~Mefc<G4eP+)T-%?Hd_8o{a+h0bXvE5z;m$Vzfu6ziw;akBqys$sO
zmZe$(f@x$dUs4M~i)~LA3{;&^)ip4TcQx*au?<kzMfMMioy|HqQNNUDqt|AGZuR<w
zI?v%m^rzqK%a0due82*KZd?A*vIpBjJ$enN$Au-KaQpfL%dzcq+j?l$JG0!gG1Gcq
ziE#4vV%X2V*0Xa(zvxx{>xpjs<n4w2r}4A(hwgXiv+f9DHpwbry!pFe&bbpa)_6t^
zlS%$Fas%j9bFWli@n`=&>kp$3q&t0}Y_v@=xnv)KoZUXe7ax*;+H8Mi*de)}Vis`M
zNkS6()CIpqpG29Lk;I8;NE6>>u6-LaOzBf<Tx41iJ7qLBqim5PT}ION)a9DgSpq}p
zn~2QdiUM`yz_3eVM6p~g%In%%t`|)XWHRGG3B<_xKh_u|t^Fr-(tDN9WTwd$S8FM^
zSxkMc^rB$=iWMn;U~pUwqx^_6;BWK=lL3E?G&u^cYz43mmvB3qN!<IM1+7JVl>DxN
zt(Z!W2+;6iI!LrWDedkCyL~TH-+0Vg7m^Q`FfORF#2Ee7dxaG!MnG|ZGF6_eHAO^M
z4cOzs3u3z^T{k~rL-*q>qE6rtW;-^aG<69RsRMrEg2z#Rn({3Bluo&WMcjs=8w<Vj
z$Q8WrhdUhJZ^za?Ev5CPs@BAAB70ce`-yYQD<VFwWI3JIdYdeFuFo^D<6W;rnVm{;
zW+06i^irzgvz-k4>gCzzvhXW#jG65%Q=G{QpdeEroUOE>2d!Ta#Rtf0KH&kNQ)KVu
zQ7|gDx#F3BF{(GkdFtM?IyDFU7|yfZ;NM;r2Q~OJpR$OvjM#~A2?Z){7V(hKEVG3j
zg>lB+dq0~;hO~W8=&fh-!-uDTdu+M38xT7r4m~rDA545YJZ{?4=5z@tSjS{Q&S6xw
zwYT#bD8tasS}y?0Nct2|l~{FN%mK(?jYvKS&Y=x|q)#a`OhLoa_vp(0FK=G{RjPb$
zQkmg{pK=xPqfc0HYzGy4cM?w=**aYD<W7gR9+!h3)~dwBVQn1JJ>Jr3(%Nlmf>z0T
z^7cYiH5)KnUl<9izTv3CuYudzv!T7unbd0f@I5HCb>efI+pbH}j5>sd!Y54F0ZB90
z34?@xhM~WghcIeT;fOl4*tgOZ-?QA;wsV8vmoF9HzIMiMb>6?ce%_M^>s4tAGoM-z
zY(MA*Nw9tIAfn*JFn&^55Zj-U1X;>_+p#H06JWGsQAQ$H2qIV{gmC>#IQP#vW8e(g
z(W4xAdpWQ(+I#{jP_hafWx%5h_{~x}Y=<F#^1M1Qi$m!6ju+U(_QQ}+KNTd((ttQN
z^TODU0zVa>UIN_jWInL`C(oI0NczJMx|{4L$K=2VG`_!G>QfiY-DN(k=qT|WCBA)*
z+C$p-cos%!Kob%MSpam-Hi>MW5pHwpxgv~g=I<lzAurRdB|U}v;ml<DLhy~T%iKbL
z`Z9GCw;{;#)SVFfuv-((ZFwufiID&{v*w}z*`xa*SuftpMmv7onPJ-_3A&8b*R>?n
zdG=~%@p8#>DFmKLNpG2d#K2}1ebRR8T#gg+t>EXGfjWK4oGdQ{Y1W01FLq?Ttw;w-
zezt%Q>LQ-eu?{1TS5?W^I&@k_7-PVH>cA~;O5$r{cQ*=sAW+LIs6Xm*HpbFk7c4R*
z>)jyMVH*=top3xScI=GUuICXNQbt&uL?q5ao6*>%LHbGUd**umM8-W>jDN#!U0C}I
zQQDntj|+OMIj`-_ttBno#9y?a^=YV3kA}IUVeTfRfXB_DWwO9c(ljJV!Wp4|%;O|>
z(u{E7L|MYQ8;1U;m&x`zR}U<b;eqrGNo4RncN55PL=Jn5!|U6nF?mznT^NIUj<VQM
z7TZl0!-MCLqL>@Ue&+iLal$Mn)Q=Jp1)fcW?S(dXsPDS$vv830KD%QeQ{ASX?Z%X4
zBn_gBQ0j&xN_?MiA1H-*6m#l-?#@`YYdWhpTBdo~l2}<!M1ej-Z(cq*YZ<i^QT`yK
zmBF3`iIO^dlZ8A?Ai=a!Q%93^ZapcN2{8D8(1-@JF1L$hX;9Hic}o)or%WrwHf2Y4
zI!Votl+C5iP-6&^C^fPIsFQN|MmYBk5~zD!4c=fi)Ma{)>7_Cr_%8K-QsO%_B{Xt8
z5(C#qmc(}Cx&gQ8FmK2)z0{$3>e|iqOt13SdX>MBt9)Ocx(5&1eaaTF>_JIUq}T1%
zIDhcK`WfJkv9%<11g1|a7t-!quLNduQ#qW<Le|C7YpGgE7p$(q_OFw*r0a^M*S(GR
z=H(Ney#>@GH&VV~w=jr*5c4-dUFiby#3t8PEv^KP6q`dFSYurS_x_vbkEKc7Ad6##
z@iqc;Oyslrz$$(|xyAH25Ph<2W_8PAH}!-|i6`ug(2S-e5+Wv^NCP|a+$>C-eYAK|
zfj3$PH|p<{ZfGZ3H&O{n)Z8Al`h&qU9<uB%7V!VEuBu#>mA3qUO9fo}_69;7>7s*y
zwC$UD(Yk$%)k<>IW#76YQ|XPJGz-EwAb}0JBDgC^lDR2KeGze&#W8aZ<(>$+J>gD+
z3#sdqVs3^c?u`XOAdOWPVmNDTA*yC)Ws&rN!73g@LD0tNs_=(#VB#yOM1-5A9|>uA
z(>&HnRhe1W$W^C*gDN-H(z)tDMS9+b(T*C`zrm{#d-{xTRYd8p(yMwbTd->WPHSQQ
zj5^>3PMrrRZRlcu#q~87fm9djjRK8+;SA4+qHIoo2A&8ATCSQJ;RA->K6%#*ZB<$y
zRa!dR%jnsz!m%qg`f7LMbvmBrw&valn)UY{=$K-ttt_m6e};?aye)KL{c{E9`FXF*
z9wR)HAE-5SDv(sSy?Ok*s@ucroqS`=me)3DsQ8RdY*6!crFK*GweRn!?la%tpKY%#
zJ>?c}eB7@mo6h!rLZsm+PWjCDM`glQ{;TzeI2`5PrqSM)cMnu+H(yqr!cSX4TrbU1
z&WK|>;6KlQZNk#fArXrLC#Alfh0dX_swb@#uDhxp4KJmu+Ik78ce?}n@nVMyXTKxr
z#`|Gr-a2Zhf4kSh&9_232M0Oa@qv5?CUwc)i+8nXPK`0&GGyw5{=#ZpI_=5<1*Gm<
zuLW(e+6#5uP}fb^qwVGsgGnRHPKUjgv=#k5Ah|Dpu*Y&I7_&LP#wKi4x=n?|2ci96
z?V-EMxA~yClLufcBej$qS|g{u*%=eA<J-hZY)Yt?P!flZM`)CBFHHlNhS@%n(POYs
z&%5ctOVIkcw4R_y2%&cCM(BOCh4q@LieS2ce%(?fXPta`lbAG>ycC?v7dc+fTH2g}
z0phxUT&wIs0`txeWooch6p;TIEgjIQbL+Lh%tEO^fwp1QT)>HrNr(e`X1x$RUoS1k
zwP)7z@`L448!}wTXbUOn)5z8zwn^ZEwn$SF`OQ<7eAi3UG)PHeXEvdBn2<==4&hM}
z#3{8|NDpOqk{{Yqe)S}L^lHEvX=eg>YtFiV`RMMnH_sox`#Y<0(1XAc2$^%FufypZ
zRo^3dN=t+D&n0Y^#g%xJ7tI-DCDW%9oDMMH^3VwES^tro0{IZ;q5t%G`9VH{ndv|3
zO_O|yMv52Zt-2AlS<HH-Ljzv?^s-%#-7>t&nG`l<>ZgU=((PdM4#XA!_0IF@yH{R+
z;G3>cQxcuJMknCI&6lKneH7~2Jv4heKq;F<<Gg?h_PC#BH(WtRUvK)nO}MC!je0jZ
zJVLQz^s5o<`${UzD?MSY$lb1)KZ^zl%Ic<5=m9O4WRgXD=+tWJmd$f4{DPOplG$y=
z+=$qo^t6OC>rKO&bv?86-ke!aU|Ix!m+{efw5xw3CX+s(qam2okPP0z)iAvy&c@|$
zM1kL1*29O^pCk>MRg?u8D#uu@(h`{SGalPMER_SIjlS~xC%{kd=xT37JnjS>>+c{r
z-RX(E08aV?X^ikDfI2uv%c7m25nSqq?$?vYS95tQH|DK;hVm`Dnx9VgS`(yyLKO(P
z%!5i{ubK5nlnYUDpvkMI$Kc2Q*cej_zDDd?X&%f0aey9c_<=2@6O_T&bp6IRC2t$?
z2h;NQ$HyOY_~&om{lu>ErEB%eufKh_VZvo&%3k^Cx9{4qm9&!s7*a17FzNJF^d=1P
zvJgn<LlSW}Ba}G_VR0yk6UL!`7ddXqg6zw&OaWGvtE+>m{bSEM{kd8TNHi(aHeS`%
zQ}q7SznqOsrM<M4=twh&$wLgM7#b&lg0{|}w#XVZFRFSy?1GU^ND<nbS&Efy2Q#&3
z1Fl-3(qH(BEr7hdO&8YMO9!%r=bd{~(#61<v@g-PVb-J(PaGSfSX|(L6wiD?B8WE3
z0w>~e8fIab?jwfu$8OUMcjR#6NgSr&8M2K}O&{dstd<kAhx1fIB2w+#RJDl;a9K=S
z<zVK3Sacz+<5~pC3uBrGCh}G~*>5JB6+v#$J4~TRSwwk~k-&}_h#?tanaD`y_^~Sz
z%3?R!X9~Lu=5cH9zp5dBF&In_?A>*>arW}XVvRYE#6|<z<o?6$sja7y9aU{S>0Yq7
z#;I(#(^czEAa_(bZN-)8zyyRqvlQL(3=1tfKy=;`O6*jAY+zBe{`3F(fBwJ!_y4pW
z{BPyj`j9Uc(zb<Zl+Yams>bwTi))!446~GC%ryAXUz@E-mx(Ta2E0Mpx3bD=&I+BR
z?7@Dk2dXDmHIZY4k}9n1J1i#VWIT4ffP~C(3FVPZ5>GfpxS<W}EDOCu#T;9IT;~f&
z^18^uPMB>F;=pGPZgEm6sUJpqLekkP(H-TuZ&Hpc3*Z#ER6GNfNIPK;P8*Qr^g^1+
zG|k9|(45rfVjGHocDpW|TZ?mFw5-<cymg^>V^hL-S*PNBem=8)dh_Z<4}%ScZIj4$
zB5~h|wab4GA6lo97=<m)tmpYMZ(0Q;e<(8-8L(}j>$)MRVgN@Z*>pE@d0ng*i_`vF
zXP}*Ls(gt$6Gap~d_@VS_^_|n`fJ%(Z$zWFUn|n}D$u`wpN+&U`4PVd#@y}N_8k%N
zKJKq(w%v^RNtpV?x6>4|?It8j5=I;rd#N8LSw_7>-F}n0%i(^up8a%GV;<F*d#f=g
zq10zpVYW6^ZDhUAtIxR3N-$+kDj<#9O!`K*(7a$v3|W<-tsAaX^Mf|ttb<8|V{r{G
z)*z$mU{;xb9D*$|t(g>r;IbV|+g&xI6B<d7l(nGTyCm~$aQEqI%@X*5#wGVNI5#TI
zj{L8^a);VkqZUPN59-+Isvu><wk~%p_(mzC1ZIYU>s<Asmj=rD2JcTJ`OFQejfV4Z
z$HYdM+a&ELHA-0ee%GW%2g?(*g|^)t<q+yCtop-$&`%un@#Ax_G~X_F&`tWEy;265
z*(g)ydOl;six?v`;G8f&h)GB}kFv;1+{`|7>?1_+cdFI}c=@*3&OxJjX(;|s8PcE$
z6r)VEBQ|I*q|)W8Z?dg>@g#Ek+KfSuIfwKuFf@40p#r7TvD8+cp+i9>7T6U~!N?1M
ztyT+vb(lSrniyT@Q_Sacxn8nDn)=P|oMQh`7YLQK`Y^3&fw?==bPS6wzj|%W(Tr5V
zW%_be8#*cUAvg3wkQK;G$9l;Mj**(nvJw^?4(Iz>y_0LSSD9*(-gF#wCr2B22Oi<z
zS=S?Vi40o78+NoQl56Y3r543uyDtyosJID#5Z(n0ZdO9{pWmn>=_w{mvvv=vNe^s9
zl$!5k=$41A|53Z;ZB~BVaMbAtyuQY*DHr7jQJuahIjTkeczp(*gYV!RM74!J`cOUb
z+js2WQI)U%YHM$Qg0mWIf$a}1l(9bYYT{R}$xF@0sWhp}(NWPKeekHYB(23^ph3}p
z&;J6)bU)H!ibewmc~b8qM}J2h%D15ykvG*XH6n~AsT0^4aS|2~8ip~6f|L`HQA%Am
zbA%hWNgg-2K(<k)qYz!sjy#r9PV9tpLU|Gr=4UpsId#$`2pJX0Cy6Zfb_;atKH%0N
zrBiuKjq!G(EQ{jMCc+2WtJHT$>_m)zFc!ofqds?{FUXkxgW^eo!MK2JsiHM)`wu$i
zlceQh!B(|+r2o;62JIvSc(be?{gZ8bUJ!hb0iVhi*M)F4+-MDiGr|@J4>Nt%3zGh?
zU685Fcz25+)7N4tc-{{TZHcxZ#1zg2RzaY5i!o0hKYJ~G?iC_te3^rhT0&iaGjg<z
z^#-X`u_pJvp<Fj<xfHcw+}svf`dX51J%0AuTFHP=A|E1Z0K;l>t!$u@0s0yMc2!<M
ztYyRA3u{q=3#se~9RIa2FE8aB*&z638JbjiY1QR)z$pXn?2R#|zOWNJNFx%4Ath8K
zltf9G5kGVjFZ5h4BD$9+bvpxp{dFL7^{IiDlcUzdl)v-MJ}O({Q1|G9S`IUV?;9%b
zf=oN%0*hyozpj<ZP7{%`b&UqIRh5^Jx3yiXXB)g3Mg$b?JgIfk4^Q3m&awT>p<JXy
zgh5KE<E13>m`yx~**;H2;EV9^d_Ja>3X_DZ|4*GO!AtP)KyNN!@{?kJ?8ebnn-B(j
z4ZFH^50MLEkNov;N?RBIM;{$o#(6T~{`lVn;7gU~beP1_npr301X5Y1`6?GhBV#T(
zuS9J`YEFZ8MK~q_`+pPHJ6YQXY-Pi^0QsG-MZI1$-+D5MzCYo-VynwZZ5ldFmaDBP
z+O_$7m{`KW9gCDBTg&5rOpQzLmqbD-+TP^z0=30O)9Tv1?Rq$=Cfnvw*{+!lI<+mQ
zkl_NfAJ>=(eTB=M$hV1~go4mG3rWIKN_Z4Sw(qfo#(Viy?Qy8Lf8u%bI0HqJjMdTy
z#y(fhWO&bHh)!fTm)hqJs4!1gk$pC^;?d8sEs;qakDkP5l8r)tI(N^syB+U^5}_n0
z4KiGRQB&fPt5kmA?NtMz40?()B*&0299~?OMGh&x74Xqsc&BXyOe5IRS_)XlwSiPR
zG_}x>1%8HhUn%Abb*G>8b5C>$!ZiW{DAvwst2WWvyL0PVrqrYA^;)JX&&m|kEyVyn
z!CxOXbOjMrjgU%z-6E(FKsYGxnH0tVr0yS>by<n*;^eYvR`sKY55eQHIPcE5v|K(E
z1zFb*wWLl;4F4cr;6KC*9DK?Q4De6rT{&M@g0$ajK0o;pOE3xl;12xd_466<L#Rto
zF5DFS0x^5Y4-c6}$NPc{jdKYO!W|$+9Hl|PV?jj5GeYfuEG0>l*d!62&%=zzA&U<d
zy49}SN7hfspQ`rY!&T_R@@Lo9X}3AfZr&W7Ay+*Ijr;_aYG<(2$3{P8xB69TTOK~t
zwY912yIOQc`Fg$;TS&(;BAr~O0Y+D6hZ$5}b@izi15#4VW`zyUbXbz%fF^%|+q^cj
zHW~}G9h%L5In8eYxgI_=w!hJuB?dKrf}t~|%gv*wMyFdco1$BKV^<cc_yA-61nc&N
zT(YCc8mSY6XYzZ7y;Q&G$rvbWdsY8<(Pc&NK3fLU^uuS&Vnf}c48VC6*+!Y}+UgaB
zTW~}1c&Fm=#^Ui##p9{s2-ai{@S$B@#_j;f9uKpB!_TZCre;0kuJ`TGVT>6ffe-|=
zy{OFs%@(X<C^#G`IYwpGyi{sAM=BlfRKZR7cCrp5e5hS8_@G^V@~_DJtKAH8pg?MR
zF6M}P_sHSa-Lo3B!1&(kdbMpY@-l}6lzN16-zJIUbK(Yqvea=B*Z1!UI`?0YQY8e1
zz+miu7;&;uEA#C22DRF($Mnx?3*zhXrjm@Vf<Jfw?xPPLJOO^)2M>(+p$1vpCP^1f
zd}%ams1t^fDlHp-4t99#LC4}h4Yz`D(<;zkcNd_=os=b6B1m9Uo6sZ>Bu<4-G8&0E
z4n3Zw@qWQ6=J;!X{4;wmibwk_lP;j;6m3d>H|Xm=Tngz%U?B3sVknrgVxNW~7hVn!
zODlDi-W1MoR!C3}!D|e}o3gS#z>O$Aigeu!BV_s!F}(mYlsv?hKs;_JUR6vDdOP$O
zJ7K}B${LI{<_8#1U}Ip@MonNZIOQ&j$j#!&cW6RvCxo=SRFH(ZK8cwxsN+ScA0Eno
z$z{tXN4+1rexyLC-r3d_(67R_9=K_|0j@0Pk@b_{Yw3I<wn9dze<|Uh%6y?fV25g9
zof#KKpR3>oj602TFLqHZZgc%qN<CAFhnRDWZzn;m*?^7~*|DgR65;!)p?6{EEAZ-4
zC*hT-c%DLF1Mr*6@RL8m<|$HP#1N@}U;eJ&Haue|ikJiYr=rOlL`N;R!V8u!)Q1?6
zH!NQ~k@D~$+@^)s;$u@WlymqsxTB`0kGVE~q6go=-4(SBc`ZrYO@Vs`c~$f&!AD~Y
zX*w%*{k?RP`jFSc`cSde=sl@~k-YE(fRHRV(epx<gsO*roo!?Ve%<+~FBoEff%U#y
zh+^JcZhrCNqURTCSu2*le}`p9qSe`~=UE}W5xTDt3$a9x7bvXOMpv8J#)jTZcyGX%
zqqYs}WHo`Q$-v?zKIXN#DbJ=UMT+IKpR5aWFvpFkSDO;u&aQF}$E-d<p8aGr^6;VF
z3Th8X9m8{0H)@${(OM@&dV`yPU6I$yN6(5zEEf5Exc1e&_hptvS2eC;>6g+<?Q$fI
z_RoewkKD75pFM}*zza3>(|w#O_^fEq1KBKh!w0CL0SQRApjL2iNtzuyL-*wI=b7*P
zYQH`2KC%rDniBGK7k+-${j{+M&kEf<O4|(FjmmZ1oif^Q2{aYOwS}91HZLY7)9_j}
zsxj8i3s$|CjJHsfNJI&!G;7yWZj^mkuj`fkC&o<4(^sft6JA|aq8<bmXy5SO-THLF
zfF!j)QYov&fcR#(;`Hg;9~E?fYP%+fr>rLDedh`$CJ`v=+FE~prtjEcRl{=9v^Dw}
z6JPaz?w|bs9X%R)XFfuI3A|)LPw+iBWwG@F<L4YnA+Pg$;91eTgtfX#mxhf58#pf-
zwQJi)Q}>qYja;?HeW(UuaPygwa8v)ate<9gW|ng{gD>xWR-Scz#?_eD@Ri%^cY2>-
zaNN}cjCTQB=ybd|aYIkFAjjd&df9H{dc8cAziJ~Z{GMFvqrN?VJmBxMNkrp4vi=2h
zbraYT9Tr=FgI>!@%_HsA`XU=5$Zb5XBP7%^FOJYbN5KfaAE*j*HJW-PIxg42Fwf*_
z9}j9P8Os4Qs%Xa<R>h#*o-FoKqIebSsk<ak%7Luj9ia-=Px2tXs&MG@vd|`PnBhTB
z&-%1FTdd$yo!v}-wln!@-zf3UEtM9xw);Af@4IQ55FT*~DSjzoUYZd*bY0uyS?mGj
z<DuP8q@E#{MnmOnwWF3{yGns8zcJ7y7?B5(V*^{*$tUHrxt82gX5EmIN!3&3^SSaO
z`_|lmcT~q5GC`2-C21hMl-NEOgt`GFVB--<XvDlAp@M~f^vhzPf^|+>i=$Q}!uo){
zvXi1%`Fu_IQM61qs5h*{Sg)tDe1JkvYTa5pul9b>U4o=>gFJE9D`9&3J$Ud29PfV;
z3(<%N4`$Yb2Y+D|@BQ$igea?~wEksXytkf~3ofd`6G+7N5q^Uc<G}+XNA7C@nH;bt
zsYXB!4O82HIFSKJr(BhXSKpXD?c~`T2Vgvt$JSlAZ0tC2QWg`={D{yvr6gufN}|w9
zeLsj3!Q*?+3n(+D8hHWDlz^8EXoA!M4Fg~e7DAUKP`ereV=Er)>WYAl@0v<unHT6#
zbkULi8$JWu@`9R`u#Y=e(oYz=HTlIpE|K!|ZaJ}kanH&})93%Mm^QZCCGh9l3mxjL
zd?I9`!S1D#vzaVt?552HjhEVj?cVw~*mW81y3I9Ay*;ifhi$q;CHP)j+}O>P+|8S-
z7{7bcCaAb|{#huXR-bwu^FYI|ayjW=_fIe(Jp?C`OQ_CmntUZdOg^63TPEKuIDFg{
z+&1}tW(^zPo2aTc`ID7&Z*;{sPrg~jhPP(Z*)`<UP6!;|u*2@|ch;>%5AF&U36>J(
z@r2L-JkrvH5|1TG68j0GjJNSnyP5O*@M08!C6bgml=~$1DJN8TK4GrwlQgljh<SoV
z&gYE4g2<2i54y6M?RzohB!jeml-d!&sI(}5qmjdeM^k&~>3a;iI&{$0&*jQ`p>?Fn
zY4izOu2?>Y2pgp}6q;mipXe);BMb#K9+PXZvPmq4AU5sVVod`+86VgcxMNC-5MVFW
zDcKY2*-yazn$HV~%R4$fO{Isb){b0#hB7|X1v$~G@&kwgZL?B?hg^2bf`gaytfRz#
zYwf}H%&KJryj((7vYFPgFY}Lx-)pv9L0sNCf!nY?xBensO)h1UL8Pp#8%>T0C{CK3
z>r1wh#HeLi@w|}vlW;U@;5q;oh~|<Nn2c140Yk$R>dy1Jlw|wo4<6hUYxXL?DuKyQ
zWyo7~BhqTKo6@=j^sKoK+NOHG&&i^HOy5JN>Pt+zr^YBRvWnGBwN9ILrRiCRL9*@K
zPo#O^9*YG{1L7opMrayw0%rn=vyeH7n|l0UX&#VZq;58?RHL72Y~<3zb*Yx+Gj5UI
z0y7q~b*e{h)>}=#ynb$_i#&b5b!E+l%j&G<<$wyFU<IJwmH)s9LEQ$-?=P=^pG!S8
z`X-6?V@~RBLQj9G7FdyzCIJ0`i$%^x7HQo&h!e8OKVIvtd13YI+2rXukX(#J<=trh
zXxSz)<=8o)|32c<;Y(wYMEB3|<{ZzYAu#=;Qopv|%)e9%$d%C-kbbEaqs-{9p8y+=
zAsBr*qwu#%Jwz8`IS!+F-Z(CQcT6>J<mND)$h(+@-q-hAcv;P#gL~C0V0pN<{)@I3
zzPiloOFV<}<yz+((bfb-1p{U(h0=!>i^F(`-#&QHm<^p;U~JxMn>HqGx;qnv-{A4`
zlRRCz^73a84dkQAqImiYD`=B=4Xc=0{!}f-RKI2)%nFPrGt0NPbU~eef4$b_ZyOp#
zPv18}jNS7mUIwoS{ccZz(tmZdE4E6^gA)?>=X7zk6#EC1k`&t?&8&-)?RDqX%}xD!
z^0(I(98%~Q59YbH!R~;77CU!`zrD6nb*dT84ug8-guci>g83F5C_sdL$LjR77R|eL
zk(b3OW~DlnTTb~8^_Pf$tY7}`+29ZDoAvA4Go60)e;|f&ZG?n9`+BFH(77%<Bzf}o
zqCZ5C5K|XFd3(`~!mlUY{yTYl(ft9Bx_kKK?S(N}zn;k5VX1v{^7f*)kMIq7xsP8Q
zZ##Hh*-T&LA5Y$1v?Dz;C-cJix7mW)K3(1F2Y3f}iUrI6<n2X&yKUeJYzzHBZ;`RN
zvr%MilBMly)jD*Rjd4svhKZLu)k+(@s|_H-INx>^4nuvt_HRkFtQuGu?0k^^Q+^R@
z8=hd*sB=)AQo?(y$k-!vct7So2LgsCzOLH<-{$vqTlzNNR|zh&w|*&~D3i!;6u%6U
zp0eS%%!?i25L>u^0inVcghkwgND?m%9nZDHo#O|-QMQ^Fpy9(MBKTNu((VuIPsN<g
z(be@9DwNl(ct52<>88$<_xcj$y2==4Z9vxsL$@N0U^;b`^jl6!slwou_+W{)%NF=D
zReYf$V=DHc)stMoiWcYA&zC|HHP#K0zZty)JL(#a*~PVg^^aE7&8<XaK(nY7r2jvA
zZ@b+#lB5m(-*fgJa#%eh@f|`W0Dihlby{szb!o>gYc09EXDm;hB#@Nw8U$DXC|OnV
zoV}L4w7rr&k%4a}lBAN7(zeunToRB7MC2EqjEsz@1C*3}ahm%cKt&hcm#%9;QaDRk
zK;k*|eTcAsMg~geqE!dvh-ZfTokbz9h!jU*HoZBcpiZf-!UY3OC@(8tA0LpvrrBDs
z8bLwS1w21KyYvzdHr0x?cB#q20BSrWQ%<|#M9fWHxVYy_`OzoPp&Bj^!E`~G5PD5L
zpAR5d0d>I1O%qTQv;l_%HxhEMXGi7z+tS;)M!YhAZvbWS7Udi&Ww%m6<WoF|f;Vs^
z{gj=oN1gH(1TWk&=I%J(4{wa+g6z{98sRZ38n~TwQ3q9mnnO>&B~v(fv*7uJ$%4l5
zO&GzcjF=_3NaQ{#kiO!V0uK~l1#a$w0tO3iDszQgqZ8IQr~Q%9>)U;!Z?S<f=ESk)
zs7I%Ny`ecB?}{(`wPcV-Gynw~#yaG)z5fvJ)W&#id_Vh|o_$TvzNTki)3dKhOJ7s!
zO5WVhlsl|bcvSMSK6{j!JW6?W-P5Ji>>%3S+4SsE`et29Uzt-v<ac@Yntdr=GoeeV
zyqsEbDw(qx8_y;qgSw-M(I2@JV=|bG4c8ri*^CYPjyrarFzBgRZasYH({wzusOj{L
zfjeYIpN^)+1R@-I%$!-&p7xyquL^h~eicG}mgb2loS(D#0#?6}h!QM-1$4lCBM*nk
zqG5gtBaDTyhl4yPNlYQr9nN?ct<M+HMbPT}pZ`bwG+nlKZM`5Z^Pndzf)nD23uWGa
zUuWd(`+NC3n$4Lf?q2(YP(+%<<rYL_hP3MCK36Y%t_k|1UY@VVL1JDb2XBh${$zE!
z@1}?KqqsX~359^~Rc%{z;r+d+6su=hM$d%*FVL?dcm%o`uN@~0V1qgDzvWumYj^g#
zg{lRyLaOIpCw+PkzBzD815W(F;oEe7E3H=bP~yZjx!ApSyDh5v7O(`fDDha_da+uA
zgtUP8F!K030T%q_k4*G`u-n7!yV{?LA6|x#q7a7e;Stav{CbwQ_(6Pq31?>WHy-|t
zdI4@KLZ->;*@qPlU*Hy97YYWjt)L5sFMAr`18$Mx>2pTs+_B0th4Ui-81WQ;agP)H
zjmJL^$VC7g#SVqwQ*gc%W~WKG(-izg=Airp$%`~QA$rOd5W&zP@q*6LFF2<@ILk0f
z2rlIQo)Q_h%MysB>y-R<Gsp*8sL@%mi+k9oA&!J{jqH2#1&iV^NRyadhfr-?F)zz1
zUUMw+WXq6ovfZggyp}cKUclmiL|nX_@>9b6UP{jl^%Frpozy8>$@eq8C3%9;%7LEv
z;LrSE2H!J2W{@)-h>BT!i2S$*Z}^Js{Rb@eG7JLdz;p7l=}<nI0~*hItDsyuJ0A8A
zdI!Bf6TS<2xV{q}SNljd#Q#i^bWVTEd)YNRrODMjM%e-Ey!;ue88rfbgK%amgnd3J
z4{gz;3~BL!>_s%M=aWmre2(tV)n|Xr9!?V^OJu;}79P)LyLF!@k&5X=-S`gtE{UhU
zk_u-jL%B#sX?hnl{6CN1Hayhy)%-Q1L&vY>>a+Fl9+yU!$yFFN8nU8cgHn7hT+xVM
z-9njoxd7_<&9xyf!)TFz&PVGsONIZXl3BOmp~Pd+CT9Cy@Da*oxqH)hRI~SPYQ0;U
zSsJSV*PXn@T1USeH|XU=9zUnmdO_Zc3J5@tcnFpP_QbEMbob+QLKRrtWc9YXte!X1
zL$5Tp^U0N|M$taGIxqcj=^iZ>ny8by2=vlMm#&klqu~exAeHZbab^HOhbpUNmwR$;
z@~;&J_nqeWd_&E0klUo5=<)}_*KOSby!>bB`Lg*f$md2c*?&loR92?6sulvG^nMM?
zWlsY_Z+sMPHaxc$ft8<0+v&`?Vsl#3*9QDADtR9SoIU#=5&+yvGa}?x*If$mfN22I
zYLK3CaY_`d7hKVQ(^GhM3*eqTRrIUEH@IT^F<bcIZB}K)<JrUc7*z2NrPgI0xYEqJ
z>K(F;USH@PD!f7h`!msJ3+6x@Tb252`RP#;VbgPUjjTxZK?JAqo1h9QTklgR3(q8)
zu1xl`eUlS+e{a)T+JlH4p?9m@A$t<{R@P&1RDztQAzA8w5+4f7nmk!`50+>({bS&s
zLY_5}^_%oeVA=@TGN0H7)`3~+#t@aAwN)MLxBe9Kd7`qi;8zajG)QA_4mh;EWl&sO
z*S3pG(BSUw?iwUG1cJM}6EtK6_h5m>HMm=FcMlfaJ-9oZ-g`gn_kI4HI#uWUs+u38
z?!ML>_nfPX)uYFn3zN<gzSGBf_D?eAA(uYr#)1yi8pwLoUh)O8n*8Y|s_$bRW1gDv
zZxbVltBaW-YQ$r6VJZXtY`cwbWtXHXAHD(~esoi1N@zx@63{ZPste6Ggz?UCd7I{H
z?o(?U4t^dY^wNnQPz?2DN94Rw+&Q9jBVbua`1)(&(sYf*(^15wf_}^Q5#L2o49jYu
zaoY2Awf(I^W70NvSQoXYMm*y)l2?>N@kg6)bf_BX=Qn5cj;BY}lB?x<@6ya!ogq(w
zuQ9=r(q3uHiDBWte;<jMWnauGK5S61AqT)8!u_(Cz~o8!_43h1c$#DPWzeIYOe_Vj
zr?`(@>30wNj_zr~*S;Kf&hucm_F;d0W)HKZ_#*pDTIks<VGj!hI5$anOb?EXQ74c?
zeEn9jrpL3|=tJIUn<$IUF@~sC#a-VvFhFp#w(F|XCau@`dFRx3xIN(ONN6~Mpl{n3
z-$|$C5rYN_tGP?b_Eo0>M_m+;zV3WWIht8V?Eu;M7UPQ5%kS1#G>XN#zTj)8XP(Yh
zKmKFhWx^=w+a{7#v^;dh$GDTPplfw`%Wp8F8MCOMjO#(|3ei23VBvt#k?e^Akj)7U
zI&iZW@3hmtM68JL?rfvp`e%m;AubJ3Qpc^@$;(>EV&$rVUai5Y=nE!ll{x(CX94r)
zq1JJ2&v{b+T>z1gly$YsAsU~r(S7Rz-T_Jk`aT_!+tNX&3WTb&Ci3a6c;)G5(Unh3
zO6Efh`N=b3C0-`V0rl00SI0^EKB&#|Xu#u&U%&<nv*{1feb)Ka$9C=H*?!SDS5#R~
zAyU7efoe@7%@)VY_`Fz9#pFB>dnb9sRe}Rh#IQ_*G?s9Kkz$}EMo8=I^42XJ%(QnL
zejleUdj~A~3~%B|SDeZV^+3(-Re?Q-z1=VGEgcc{n_?i+ef*A9b_~gtt6X8VLjcdX
zZ<ptniD@tfQ2fLJ!&7uHax;`6q*<Qz2<Nk|<^$uA(u3b8%&ww@s3rIHtx@7BK`e1>
zO(n8jF_LZ31JPc5>s{R~awlWYa^J}P?w2Q4haW76vMy2$9@&{8SN%D+%otHS<4ai%
zPD*(pStZ9XQkYC#`fD<C->I8>3IP0Y?3XLt5hr9`;qw6sNybntV((&ufA^xSK3;qT
zd<>TR+tXrew(WL&DLg!OjbYaHTheXNut;x6p^fPH`1`*1I2WHT4-qz`VWn+6{r>ID
zedoE#RtZN74fzvqHh6Cck6F2@qGiq0+=kgAF;L0b#7{Vtpl1*5-XZgfsT&|rDw^P>
zg&x42<fM6;=txnrd@@FhcM}-7x!V<vO6zQ7jUa~_+<i3q@F{=Lv2AF#$Bsgr8Z<R&
znxGpIn!f2#^sL~3hoE#o$KCHvD;yE^5IhPO6F<Zgb=JX+(qBz8QnlyCLvZ+;=#U@E
zbcmOVK)K-COiiDusf}`<Gyw3_M(u|xAzMTrWtcBa6)mrp_3e}47V0%pP9!(FEfhSp
zvAY-AUlvSr<s-)xrEIR3Iz|VVbFY+*v2`M0v9Qe6J*nWUv}|Gq%tfc;9c1jL+*-eI
z!B*jpC$_(!7V$usuGRS->Q%n|HSp<z7YBmJ$YB?#lmE;;qYJ|{cnffI#tQArgbA`6
zn#MD+ihO}-g)p^bN2VD+yWaudI;+1EEpw&xFke2+TFZ*KBRx<$(Dtc!GBtDa-6HrN
zru_o_7=e%4C*gaaW-@W4ZIU7z7zJlQZ@qbD?j)=X-?l0}lrE%WiQ5&6B4355w8b<l
zxzZ(TdWVcifZ{_p4UGV3OX@C_YA&&oiIn<7jIJsN(ypB1!%rHmOgA~zijP|^4B?ez
z;uycN<qd*B#;52O-(f0hAQ6_MA`J+1A^m;GBsuExs>nSX7D{58(2U<H-U@JjGi;^!
zGN3%g!}y5q?T~NKxu0<6+3~*Iy0k5jKj9`X-8a8D;ODh}-BSxdXK?2f#2J?_)f1!e
z!GR>hHL*g&FbH&Kl0ZalMv9Sir>FZ&wFOgL*cNvHqLpMVnw^*Sc721tU!9^rZ>SHu
z75&-y>drcT%+71aav7iWV~%@M0j=Q3#Nry$`)+H(54vS7pXVB_AjjSAW;{g=>BhiC
zW(7>RtIy$jg{Mk@6OuYAzj}0}(T01#Aq}Art<B}rr3C8R<}J2QX+OGolygA_pRyk;
z@?O#`9vMd|=_j;Vq}hxUTo7>HIh&acHbqo9HXZ%ZWpK)U{%Mg!>AnB+B#^<{b90EQ
z;IeJ9zv8(qAFX`yp*Sh~Sq@R>gSRd0^>4!k<oc7dvGaaT!1rxtqI34lQiT96ZYPe1
z{8Mg2{X$}|uyHGHy%hE|PNq3cB}fB*02jCN_KgckX=%CKqvm|xIqgs=o+_Vl!f%nD
zmSbSs>th7%9tv~x)*)}rV<QJ+CSwsN&hl3Qpt!{=(bAXL-do3z`HaZn$PATLarQhd
z1-n$8K$yD$aFxqVYLr>>ZulztC20BUljiz1wd*R(iOInC+qRqR>m}zVFSqY4CR|FW
z#_{e-@rKz=8?Y$X0jC!2_8+<DU6*k+HCcBqaGhIb%e(VZ29&Pmb80-;=1E1#)HPnR
z8df0dG?C0SHTQ>$D{wFqx1Sn!mfuq#{<==%RIr*#24>R=a6G1#Pu06yURW~DeM4sH
zk@P=3k?;Hx*y?CMr*derpR*@y2$fG)fUpy25IukM?d|(I7WJh)^m0_LIpf$`ob3YV
z&n3d;Zn@C9tkW++0n;``=jo`G?c;RH10NYR+G-YpYVb3sPPdECH~sV6Mn7{WG(uMM
z&_75G9RZWIGq5``KxZ9}x9E`KbWcQLd(%RW7Ew{=nh@?Ch%fsC#sx7`TZ)hKhex~T
zq`mA?+!k}EFWXe9>PkyW@kQ1{23TYz(b9+~IP;tH;*CnON2vS{cLM~-@@ebDGM@;1
z8rJ)kH;7#@E^@QjPH@l0-bVzTU=NQ4m#b9fd<UA|<q<Bu6-5?h!NrdJfFB^FEBAy{
zJqeWuM;Dc9bM`Kk6g9#ir5-H`L*z?mWNGYx$T+9Tc~6~JyMv?o^`H8<Sup|5vabs3
z?{hr;<?Z?e2~XzBA6$fPca4@+1$n*92L)H?Ql&32>Xk4!3wuMiGAT`BK<gXsA!|j|
z&RGCd_RcK*gcr$=nDDWJ59<OnyHomJhv413D$+yd;XeD=YsNdw9E2;G!NeJQJ1+Yc
z=$n6}tAc6a7re5Df&)KGu{~+aOdh%=%>m+E`I)>^;f?uTtw$xT4#_FT?b#Mg&s6O=
zh%_pGz;fQD^)iF!&co!l!{#T6^T-by+KIOSno2>Pgd93>o`(XGW5ub^Cx;xi9jS7f
z@b2U<pQ>f5n4>OuV@m>ky*WD9y#Gi&9_%Rs8vjiXBPbADNnzxpGaKYdq{@xF-)Oky
zx;Z-|&(LXhKnqHk9G@D>p9((}y%`EqNBgkA7FZFgTym@IS*mikf{X4=wdS>3YdZ?~
zHJW7->ybd*;ZXA05%?f(wqJ-L7&&`%r$SuU8AoG(rIk+$aO?ThJP(i);bfeXhjOK<
z8-BQD*!x7Eb%kExxFI<dHU}-%HNi2~8%mdGK#I1|e9nT%u0gx)v%Zr3=&E{lhy}Yq
zOyQ2%B0}=ms0VOWv}*Hf<bCw5nIr((HGn*bR2%AJ5Chzs*02_NR?lGzrf{uGmh(lb
z$k0mkCA(n;-jW}){m@(-Ksos9fPT6<{73K}MfFNv0vV-Z2AYotsU8z8DGfO@<>?$x
zts*35`lKY{{0ZfBbFoF!+&78fai@{{%i_Vuh<9s7NB4~~?bm1dOj5FT4tR`b$#bbK
z`k(l52^LU`Up*2f@C>)px+ytwg-o}Ey=SKt?Q>B3?%&-dh0iCg;_l$yye~k3i20|0
z79#SyBY9LwXPPly=zubZ<Z$U!LKWO>B9er|;gdV9U>5r3_V-Gr07jxjtQ4LbynXA?
zsM?uAQ$(MrqE8ifj6|?^=YS7NhE*c~c%3R$4#U2O<%66d$u@g)$pVrO{mndyM&S$t
zbGNMLHHIB#w6Lp3?YiUry`h0@ZJM4XTim>FtO@$Gf32h?sXbV77=m}~h{SoH*;2Vt
zK^$9>z!~=<0hgA%N2Juh0t&qE-H;~Ko=poLLLdm8Ofo>X8e&(34JcEX&%=dTBG_wX
z6(`l1n}#*E`r!92@yrdox08H(<_t#jBxr}KS?pWkFCx8Qrr_VknVwZIUjVa5T<$L~
zry+NZcwvRVp2WySbnOK51!jMuc_3pFqEk5H^1=6^nJ08rZK7J7OYLB3K{&@r;t92k
zO<J!vOr|BrC)d-0jR$1FA$_L0@#38ps<87o5O6Hqwku}*gSWj4$#I10wLisI&LgQq
z*FI&y&E5{uMzB1&l~!J^#8`F^8ufaMYFmon#JMTXS6WT>v3s9^-J5!@nWKTz;7`uo
z2Uk>y3t2|DG;=IWfq*uM`dhnq#>d8x+PCruDC7nLqU!Js5CEZOvw}5atfsn#SHjzO
zUkX1eEZ`2qwy|oC{h<Mhtfug6b*!*wbTqOj@jkg3sF$?~YCSoX3+ERJrWB`_c%!0w
zy}s@yp(P1u4^fnx4n*v4NT=Rsq=y(>#o&6hLA>0KZAu|GY2DVBoKdiOPpYZkW@4#0
z;E+K9PBnb2OX%lGeyjNU_k*ieT@HKpOXRc#vrn6hmYo3M`Kp21?!YHXoc>crre&`g
z4<7XbFFJ0^t6#pChm&UwHP2K_VNAT*uJWPrX+pK8J1Y)`Q2`x+;0BZ3c|EPb5XRzJ
zHa^<`xMK6*JB;*ew4a-Xf{|@J*9Ctd_Bs%OoP}giXUp;u&G{ogfuivNYPH>@LiDr_
zqaT4+KA9Jrrhy&o_Bwr<+;qjsXlr1Su<VpWQohVCoRVygP{_R+f&I)-^Ho$XJpL*|
z?Dp-akR?S_w9oq;BpiA<Yc6RaknQkas9DKSRY1*K+@_?i7Ut*CBama6{*e7D2J;C3
zw?56U+cx>~J#I=Y8t`4ajTRz*AlVUTc5|r%xqc81c=A9t)2{9WV`vLWC}_B-Z5g9%
z3BgcU%M_tkaYdO!smHMGGMs+VeOF3p$||>=i%TW%74c&l-jy|MP8?6)-LWOw;D#xU
zy2D{w_#oNzq4`2V_3@yY59#j2-HSU9;I5DAnaGN%yu=)Dc!T>DS9BRipdubrGA+zI
zde*@9&7hBU0DRp)O}^^9FB%e|7PCyg+KOzDxQSj&>uFns&<l0s^NzLKcd_@>zb^}7
z1NKGYx^wo;pwK+6#@0zH=k-L#3TT-w<%C&2@dNtB@(m+F_m~)g##?Ak%$q1zz%?$W
z^6SaUQn37(7Fw#o8b!M1J%fXvxQN(*jiN6ZC47!^r1+^xwP@>TeeW;2&^Gcz%yibZ
zvR{guP8mm=<AcvGkSBy@%FejL$Ax}<M*%Z~98&K7_HAy^*;vAaq+K)`BgNUR&>~ai
zA3f-+$ur%CS#@hNShk&}_TuT&04Dh8MvE~_mok<V`TDjb^@~5r)qmzwZQk_fbMi&C
z$|S<7<~mS6s;~y&(R|#I6PXh1(XURVn`zp5Txc>6f82ksrM^<}EtAX>D}Ju*+v(+f
zh>sJ<V({)Rb@KcDW6|M-?>@EWFuihirs(RnB|N)vTx?!4Z}sJ~v&Wy1Dd0E_O4K98
zLv&nxobymrE$2(?_rl+%YB?6dp7Q5v!uSxiYl~d7r}oc*2{FI#`$|*hDN|1^<4V^D
zhMh!0Bo*qLv!<~ywe8;1nF&MXS!@bs&~ukuohcMG66fu3?$71MeA7mg60kT*bQ@76
zBi8kDk0?4ycC#Bhw4AJhrviutogu}j>Q`a*wdxpssehQ3Nc-;pFg-B|O}N^46OFA1
zLPV#RpMvdGZ^~Mehi7dtV}}v!SjhG7tPy$kY%%_s(PFGEg=J?PJ>J1>*8Mz?u7DiB
zkT{VkFpZZAE_$ELPx;wKFHH=z!7onCyQJKZUrOejcf(EQc4>bHl>-iqrq{miTMu<<
zDArEO?w^n*3z#2s%^eUt*ir<Jk*y@tVka`ALi&EpdPJ@d5G8LK113uOH-%Mz*@akR
z6CBEnx~JfUS4C44%y@kFOQ(I7VtP1w#rU%K2fTjP?mG%(tr)YV%$7~P+Gjf6quq$#
z@W!qQ!l|O>6BvNqCa^Zb=_#Z`IZITVza*Zz+!VRDQLM`)kyoKLQr%w@W*+H{*}s?C
zTEt$ZJ&t#cmyS9r9-VK;EVxl0k5VQL)%3uz;;W17o>Dc<-d_uEkx4+wvq$J#??|wj
zEy!K!?8sIvJ)JV~P&rNP2k#t|Uk-y1&aWd91<kJ4{c(jY3n*#v0RN*I10W`i44b|0
zEXSGCIqoY7`}hYt9CA`PNqyo~gL!^;MNRh}^xjcGAFw{vs~5d9!a(niTWS3n6OQ_G
zedn$Fk8mhGX@Y~h(?{dYPAehP{B_l@Qne>|Q_p5be0E%>8mq=nVWCb3xZbT2E0x1m
zRs0fK(TaAiYyf-T)O^R@jkkoU-IaxOJFnUFp(61t(UJ5z_?tj#WQSzog&btqf>Jv#
zAxg5X!o8ZsrB6*VJ27g0u&`^<GT|6gzq?27^$UutpTbcBRP_Rh;3hlqT%R2mcU0T9
zs;OPGMDA{+PkfcI5!WK4y86Rh#BF)l$4|!OVfVs+z5z#_RwjH;Vdj^_C6<xP`@brs
zH>-}6;NAX2dgMOGj_1&n4d3u=@)H8&#^m#9y6g9`J(Q;|=TtBq!)G*P+Ho(mC>Jpm
zSm)G=O$z8iyZ1#@xAxdHj|u%c2^ybU2viM`aCFyMil&YDN%Ikf5ksMVj9cCv9-!$S
z)L2iN#{s^KsWRFlAJP-dl|;QRwu$gE_<WROh<rdKk#H-!lZ&EK=pFcQcftppj|d!C
z*Qu&uM^p{@jiN}+7c{cm)z5lqD7PlfuCZw@sY|iVgVWVV3efm<6111IJPLVhxQkqB
z1j_~1?)a1$bt?D<g>~ql%TJ#Xk7q@$<GDuIp@A;C@(1gr{G5bZ<s!bpVE_da^dysO
zy4`@x3e8O|$`X&exYeKlg&4)d#~ffkB$3|s<E=;Z$OejxRY2{ATAR}C<6XA~|M&NT
zNAIr^Vipuq<+~3}&NR=}vC=aZuvAbpOB)%Os8{t;mmSMVM0)g=e_1hJe0qz+npr8|
zc>~1Zr`idc7np25P8SE46-%Nv1tb$NkhOThT1q$0w$C2eOTMWpZ!aR^9cWP?^bTiK
znq06BU}cuAGvf})W%O`0v!1PH0g-HA{|b4!ydFI;j0PSb28T%j>JX`KFWv@?&||Ym
zd1#efmOEty5h6fMW9bDihwLLCirksM8K4f+&YHxxvHh7eb36Y1e2bE7YeEr~!5E;p
zN-tUq(%gSrF=>}A)xvZzKKl(KBE>tdF;CRW&D=a=qgdRPKp%<%qB;du6~t7Clq|zI
z%aGA~d8G4A>oTrgf%9WqC&^pA4Mc>yhIkPjQolUxKdlBopYPxaF3#Wlu``(qPyo;z
z$1*}5j)Q%^k+%hZc;PU4#Q)R3m2#gEfv0lcxUxR$O-pJU<gEMh5!5z4O6fc*hNWpe
zwR<oB1b1+S_}f$AU7rPs|7RHzCr^>%P&qZC0PO>~*&S$xR{ddpJ=sCcFXU#!Y-Cy~
zy<0+1GZ8RwEPbxA5|aU39}*r_2f_fgv>>39)8tDq-T9;xPD7?_TBX$8hPh<x8t2QT
zW|SNwd%+jhI_a?|1EK1p5lE3QW@pfPq(N=t{k!#kSL!>--^83&kaxnj{B9xlbV~?N
zg{8QM^i{J40~BKo4;AQ>T&Kk#K)ydEYmpz5TpfckH7&V6d}(AG*PC9~{E`D?j4wrz
z^yNHiSGlrh-VTsYc>XD29E%^^tkoRiRUPq3{lT`5{hjj1KC>4t@T8`fCx7Ib$avG>
z6Z$R5rzsNWOYURNhnf6|Fq)b@I7Cj;ZezVLl`=SdiRXGoKJe2Dxqi<$G9^vG68;%N
z*Ld?@O7PU*+`#%;Y7AM}a@7J8kh^d)DC9!Hoh6&mN6B{xQk{Y^G_<Q77ta4<Q&yUJ
zIPK9Psd_=P<T<vC^1E)NATv)8w~R4b3O(_Yu6+xYiFQ4Ejn`2H+fz$LEn!Qbug<Ry
zVKm%|Iqqoa{<{~*n)X534#nLvRgN}R+n>dZ1}V96mlC~)HL|}uhgt%3fc(Hz!%E#U
zwnxT(wP=_h43-uQZ(1WBSrNs{!tA{^5{%k@CBU?Ly6#B))LSbo?OO%NJ=aOBmonLK
z%B(Q7zwh7U<+)worgR~mggs@L<vg_vOUUFPoK?KgO?Im$?FqA2cr@mjt8RbgFU85c
zH;?wsgOK*Enz<-FHLB^_1fZr9;wMV(3fr?>d-Kd45+RaFbIOk$3S`lS4_k!Vof4tu
z6qAj;%sz{=wi5GV^?f+2&umC#sq}JQzt=g~{-kK%*2GdilmAQ>=tfhaO{A7oRbsi;
z9^>`=Az;FbAvyRcx-^b-rHW?4L^$*_(RiYUga~QUEL_ur3`SEuB#`bi_8k3nPAIVo
z&Ros{<ZSCl`m5Q>ci^)1&E}8NsUhdMp-s^cX8{V>D(?BwbGVSLeMQTPjUra-^I{wQ
zb7Y*l?+>sS)lp8@W^Gw%BN*W#<JLDxiq!&NoZz>PEx9gY#dNPb?Rso()=>wi9J&rN
z8YPPHwMy<j93X1*$^v<*aB~u%Tj>Ug!~PxALGRPVC33XHft!fz7di$9)BEV9fr8u@
z^n&jzEOqTq2$!T$C!YB)g}?hbpZeV|NpnQD6KT-STI6JqX1k4Hh;Q~lrXO|#jj_BC
zw;&7^i8G%N@+wfp#nH=d6B1%Q(#F!EhEq%1LzMDRbnM-V?|`igy^5hGZ}^2!7Qi#V
zez0BD`L^(q=UQT7ajrS9z6yKKUL#|9W2%g~b(H>-2-F)UWL<soIhl{uP460bucSF+
z<%^Uw!?dag*O`u%ZVqSbzR*I{z6gEM^)jhSyEpjUo3ok!p3`%IJ}>kOzH|h-Ztndv
z)X(R%5nuGnrwt(FWRvPmz%Z%N!DjEx@+GUwA5H>Jj4J#HqYsb~VcH0dW5)RG=A3H?
zH(%4IZ}_*@uqo%)fHPl@vu>%=r;U)8lb1VSP<O>U0cy)fuAG8L5UbkfTng>k*6jKd
zxg@*k`N#q}3(l7po2zP_N6nI(@y+_>`bb>}i(Yuwn;hUu!aL|xe$`_i4V!zsQQ1Yw
zaqv6hWiIJ{r_iy5L+D7{ttt8ni~-R_<h|%=JHj)fBLvTCptrc(&;ZCL`I@*|t8DYm
zW`<<TCc`j{tGThUXrs&_?aO7;lsWSBk~8l*iHT{fPiXTUX0R|3o`a4DZW(FMavWhi
zFKH<utUN$Pg&obQ;jCw|Q*OVc5!OuWw+X2e>V@@5($Q#;Fjo{yU=WJ7E$M>F%a88n
z4*W}Roaa8ZilQu?N?u_N#jUVqKg<%$@d6bUy+M#im&Go(wEKIeCrVxJfYvOXcn0lO
zKCZ7ToJb%%w5;EwYQ8TsfAR=4o0^4*z6(4_9fSbwUW4Pq^jy=B{2||Ps-*CIgoxI|
z`vNiGzX_l3z`wg*owRWxkKxrL6aC!CFlFI0Yy!vL-C_e%c5H@Z3Z-VerRZ#gr5H2H
zb|UuS1&5&)-E}OjgzU0gp4GgFbtg-;{bnO4j{H5ARy-@NLw0e=g_>&Ig1E`Oe=td*
zio864($%sRE;aw_2E5y&q)y$3VBdm+8u>pSQ_<fcHGRk0q<krjCxng-YQOOHHuHsJ
zWIes1<Omt33e!UNfiV!XnoxJ%I}Hw(u||sFTT2<=nf<j}$`*pl>^<R+)OOQdeC)8-
z!#&f;e_O$h2E9kAj~58uy%o=z7m+f6r6uAwfYz{hNiZCnIX<q8*kN|g!TA20lCqP?
zm9R=K;r&daa)hNp&ZK4EVN9vY*n(b@J#IaJulNT4*3qQpHpi2}heDp7;kdrs96V&5
z^@DJc#Y@PwghXFh79CM=&G^j#QU0NTrX$Zg&yv;HQOO-r99}ocjSEM^Gst*IBYZP!
zAh;?S<I0~fYc7iP6FQCW$tbHV5r3Xd*xo4QSp0C3R8iIrJ!d+zaS(}zCUHJ4vkNq>
z4;rfu<(JDuJ$5|LyH!!UhFdFx1+KdXs_4)sOVuCR=b;rL-|iTH+o%hv8Q4fPtYhC)
zKa$U8T~9_m86|-7)b{V|xs4akQ`L+Cpy)oUI0!RZii7j(cO$}fjb4IeQu*WdxZ5&~
z8|xvKh|dn#b{bqad*LS{hH9xMKf8j}Ev2NJ9@jB`F1rtn4DQ_F?cCXqtS^#;?RK~}
zfQ*jo(7rGmj%9M!SE?}8f9B@YManIc&Sj>~Wv-e?#F1W%l3tXPUNp(IXO2AP1qhZk
zIht5`nks@O0;F@{<)qPiq|s{GyyvVgRR;I6=k~I3q@xL<Na*o}F$jexyY`%OCrqhx
z`%QBDb?}6(xx91CE+y?QC6RJR4LAk%i#p>CphfogjT>MR={KrrjPl_*I8(Eei-JcR
z%wpHQvp8$;Gm>p?Bjs`M%i-T~0;%LFMZpvQXk0b;`N=kXQGaWyU<@qH{3CJK;Fl-c
zc>W`qaHf){76s4$Bk|PW|4g=N_(yW7Nr_F(3tj?C@lt487TlD)@+ghYgB0CYVh)Kt
zMfrQ`wk{?6eoLhmTNXv+ya0=~Sp&(ysExEkB7w_hoK*0^zuNyV$wAuT=idhul=3Fy
zZN_h$w;6a%F*P=|?C%uUy#X>_-D>LM2HJ&M`eJyOn*SyJzfk|*r2}5d`nJFFfDI0q
zdmzXNCcl7AS)B7#_b$ik(rEh(RG{-zEuE`hq5oW-x8q)DK{3G`#-6j=H>z2-y5KQV
zWYRRMDGL~Vl1{Dfv^HskN_`NR6SAuHA`GQTWUTbc3K;DMOX8M)Ng-g#1}qu<E&T`>
z-TaF(`%CHvOV(hC?{6swmS&$jAkMy03kWcK%QOKUA={BeL161|s<Xx(sf)Q-7CZo6
z!DSsI4&=Y1p}(Uwj!2!qw2^-_PUOF%v41qqNbSG0U;k)a$bUzZ|7cv1T7PNN|7hIE
ze@DOniU6H8?nq5c!H?6Y1Ry4tA}haHHa$hVdIAIRx!`UKj&#6L4t&{QP(G|dw-I;M
z^519Sd>J^>`madkzap9cip2ga;`^Tn03U|!e?o9X$9-lI^Y`$J;^5?vRsYI-_8%YI
zkstndg#1_3a4=tcR0IYQ{_8Lh{}tVG{qMX_|0iMwgM0rIf}^$nisrbomvwvdxn*$X
z%HG?7+Ph$gaZ}H93{fh;pQ+}$4qIQ@tQ3<UI%<U}po=aTev-1)$l3dUr-+biv(E1?
zGqCOfS}2DOpl{tUba+|#6)1ntceO533r`FYi;9r`FSiykP<S^C6Y+nmc73)I+%0|7
zNQZD$1ar$E+#VP@&_g#2D&Ab=Z1DdKB!?Qvkbz(?fKd!0?|~ut`z>hGk+af&zhw@^
zguAjCq}Kx@39{~iLFJ{A6~e0V<jOny1yvE1a<(Azuc2Iv79Q1ZTfOQ52j<g-2K<Vs
znZHhrO2Qr+BM%T!FAQN~FAOjE50yTy$2L59Hbu3<+HbaR)YHE7b)D*DISo<^*ST4=
zjd(+6I*vgOy)Z@~P%jJ$fGJz8*K60PxbFg<JPYMSHcf6*2h$-vX13J%c&gDOdW+HR
z>Y$&tev2a+RL%~{?5->z=30HELyK#wL06yfdDlj}>?55u-WpojtVOkvtYLE``&p>&
zWMNs1<qQ)XeHLA-W*ok;Ls^XdYb?%vm-%;#bsa7i%5e(y1xbnkXc%Xq95#c~CoZr_
zxHqy%@8>UfX0~+j*fZd<XZ{-d!0*6J5}{ZDA?hPSlN0&C0Q$#ybb@{K%Z^VR?_kuW
z1Eu9)6#3qo{Xi%#MTn|JNI9h#2z~o8`7J@wTdsBKm{`ifYD%t2N~^ADGD;a0a~Z22
zGQR>T#iir2hJd(VGVxi6%Knjb;tBNGu?*sv<uLf#{tUYBDE0kGJ|pG_vUPqmQxKb{
zSiD+OV59zlm``B~H3Uu?zC0eCHYt1rkq+#Tq(SLjh7m(GZ5DVoyw?N}{rrmtvcCS4
zJr&iPe2R#FA^N0ng*X3!fOq*|ivE?#22+Kv)DJLK@-M{*9tupEHIpp8$q&>6C#5L{
zp3AF_PZ<8NYO%(Uf6Y7etgH-<f>a{xckmja>Cuwwuwf_TsDS5G*eN~G4h-qOLS10U
z84`G<a22F}|4SKwDco1;Gng`brJ&%{V*Mb^BkX1a0y@9PuqA~vA;0?XF=F6ge|3T%
zP&Cl@>Ld_3pMnzlKa&>2krZC~3IXp%z!c{z#Sf;&UMU!qd<uzwDK79(D6d0JgCXuL
zyVxUdC+;MSYH(6zul^AT6{Py$Uj5s%VQUk<I%xnqad>rd4u)F)^^ZWLAO#2iN;!im
zqE~7FOu4*L9PnzfqyG*?tRN)~hN|_^l;G9g{Q<9}z^jugu#>}ACtIlb6wR+r(1nu1
zk<tEL|8p=U^h!;DsmoW&3@x8x@n1?LDLnF(dUp?oL|&mYF!cDfTI%OP=aZ4#0I7o1
z^}kNOvSH(sy*h#E`e^3&>VyJ8Efx{#b^Qm(6r^|%Ui}AxDe_ke3rq#QQYK&uAL>6R
z%>cQAl>5I>C>Wwp`8nV&%txVsC>vNbfZ_L_^I!69K7|_0>-tM2h1<RT*FT;y1Bdjh
z6>Bg>@JjW7Dc66g_etT0uhcs-FeLK|g@GZ8S4a{gpCTR%&6mT20_n-)*|6uSUY)3b
zoqT_FqKc>%tNyS5P-+D!3&dCdATUM!N*RHvq*p2qOqsv>52aC%%KsNi1w%A{LCj9+
z)a$90Sa;y4!<|J7elgWKJ#T>buM}<l4ww*E1OJWG|2zCY6oHh-U~ubyjll##g2;Zs
zAk}k@z~Djy;KZ20iDCa&VrBm(W(Q8}|7Ha3cVGvKorJ*wp-sbVgJLFNXzGuC!8}3%
zP~{Kr@qE*Q*Zb`cpRZ_q_sliAmTVo3b+0{(MS)xEtNM?Z^%(|$t`zw7V#;IcH=Lt*
zw1=`+=!jCt?y6^loHWDRmv}@_Q^o1L{FYc}N6aD2*N8YNI=^D(fFF9cE^^RHhzm}_
z)g<!acgG%@x2es%sR!2&f&JmbK{LRpk<(NzMA-C~t3_V}FCjthx}795PdbY9nD8a@
z%U$+uuHAdv9Vus*roSo}pA;~IXTUA?jz*WI=kmG{bS>9<IK5@KTfW-v2X(uW#zbRr
zad4zV(E?n?Amc4|&!4J}%)Du8tXi?MG6#|T!vpdTVd7&I6w;V31VM<d7(iv?;LpR^
zt^p0P-KEkSB|JW^dBb0!W7=IgZXbJ*{#3TQTUMklI>)p=P=&S*mrxxaf0FTH>(6e7
z5ms7ibr(Ue@z{a;8Mg=vd?LSPj_5Yus%$u@4kBF{(~jwp;;!H8l7H{HfB~I5%j<1n
zJCotf%4vkhF<aF?!h>ITxDHrx9BI3;IVaDjUdijXZCAr0E!`@rl->OHxu!RUY!Okr
z>{*TuH@tZxzrv&?nT=YQIjd@rer6EDHSO9gaZQDtjvA@<=kpJc-q?aSs|U|s9uf{U
zqkb7Tn!bTOtsf?Pq5B`rCf<kIP%Y&A7f;0}YTlz!sAv77+A2(wZf`)mBS)iqPHyh=
z`estG$aBFQxNrLnRC%1)+x9*8v!Tv3xXU<O4>7<{`mh6WcfYm4_G$$2I#_j=AN;(@
z)Amia+j0T<+Rp@fEc?`q9z_8LWhy$Gc^o_9XwRCAyQ8?q-%CGAdp%l~HR|MZ0UzNc
zp99^zH{T5A*Z)~s8uA88W#$hh7^dIaFMaHuSx?74wr~u4F}W(uo**O;p3;&$TrlN@
zl2vT|sS*j$-Pg=VHrW{|<aZabv+a*${X8OwpQv=?C|M;`fFa$OOpCQmQ6v!!nuzxE
zA@CNb_{?@hWKvcfbt#|3#@1;2yIILts%yu;NaW#dTaMmTzRDp$6P}-E6!W!w)%X2*
zF`2f0j5b~@DYOS<o%pqKRow!vpD`Y8r<9XqwFb4U%;d3xUZTo)G-7)2uvytO<xL74
zD&_t;EKF;o#oLz9M?(HLg#aNZ_&HZ`)>tg86&P`PXNHnFFJ6y{Eyw|1`DO8lzkb7=
zQO-qfM`(KAB|_Z;kZA-&(jeL{+UG1d<T+fEw%--ZgSM%RFLsU-MRY%hr1-252r>jX
z*?@0;X`<{-Q?Sn!#czN+0)K2cvM6uol=^Ct70A^C7?|CUN9T13^s4KWe<)5Emf&B3
z7&DoSWj(?m*0?{G@>ll>-^Pkwdtq{qYe5C%8ncuNqjP2g{D=^N?EyQsg!sVkA^o~v
zD;+J03N5<_w8{_Ou8*}R^&!f3K>JJWn@jrxYivBU%mz4~G!qgPXj?X~4QagVdu2WN
z{FzjtGp*YD9kqIi70e8!AaMV+Xw{qC39E*xHwWS0g{4tg3))CmTJ-v4`5arxWNXce
zt-4b=k7J&IS~$NI;NABHW=$tfA%TM{_}0!!%gSVauKVvw$Tn)Tcvt<<v+0*K0cU#?
zr+ecghIVhHMpv5r4IUGpeqK`S<d3$xUdrgtO3-TToHBeCIg$U?>vP4TWlu5{DCoV?
z{t}=^*3f3vN`_nZVs<7~BEg~~lFrfYcI3KC(S$GnkS0vF2QmiL$Rm7B_L=a8RF@P%
za>up_cc#ypnOFCe;IXN((}ob>VPW?w<68Y5b*hoJbpHs8G=5{6pl(;S<`Y_XIQAL+
z*O15j#>+pg+z&z2Yi11(gBSC}tj4d++*%t~XVF_}J~D%h1hg<sL|(&0JNleAz;Wb_
z4aS&^OYgwMYNxTE(&g<jm5dfvC6y}$8z_r}U2|<fw#AmU(HEa3AdpGx`%3RDiQ0I3
zFX(A2gqI3gCVOysRqNeGAPu{osDO|B-sBZVS9#~UZwSVVw>-FCWe5rHP8W*>cYk}I
znIEyGCzmZ!Iro>b^XDx-r;}w0K*n$kn_QHWfLcvDe&$B;>DQf>x0+7P)<9kaRpc>)
zi$l3q&%j84z>l|-N)4w;NGr)6mH>5stjFl_w`Zkq7sZsk1};Iot+%E+P&k{G$UphT
z!XAUHnKf3mD!dH>)2O+$`?ik3%}+%F>gqd2sIFm1tdS>U-LULFTg<5;0HP1>U7&!9
z?g;fdcZAF_abcTa#m=VT*ucCC&xJ^AbMplo1*>m#y>g!Cy5~K+427K1x4{=|Z^#M<
zmFsev^kJFh!N+4?xEf5j`H@Et*6aL?)iq5P;dr!1L!L*1x-_S@tXR-D8P?~sdg`lj
ziG5DO(ZE!}#XiBztnZeEZ!z#Zw_!<n&#SkmJl+*l)&2nWp29E!lrc%Z3gi23Pny$6
zA{kSAac3w2Ef@BeOC^U$X}%D@MX*^5dWU(w*u1TBg{jwVp|_P&slEDjI`ePiw_2`f
zt)i)rlVW#ODWWTrKzdZ54*@|Pxzgvwy0!dqAsbzV|K0ul-_74Z(ei8y^JK-bdsNk#
zMDzl|NZypl(M?p91o-2hm(Om_!g;^r$#<}rn{6A#?T8{4yU5*Zp=`H;8aET#Ri6rU
zhl(Gj11)95Us`I2wNcAwzjU%@PkS}xjp{|86v<?2)ucD~Z56LyFMMkWyL#u?m#>8U
zPN)6MX%hEG9Wn&a0#$moF@Juu>NrU5A=Z)Lo7SxCuPt*d(~>rBz4bJP5XAzdPboiq
zZF=d0LWnm0tCM_?*bYa6kFIEiLS->zD@Prn#VS^?E5ON!9!D^?fB7wpoVhJEYf{ie
z+C%n08!q4TWKh`_ujRJjQG`ab+9Xf<hI^h{zN_q^R0P0vkii@rE(Wg^J2sKikZ;?x
z^AKBs?NMYeRasg*<=^Aiz}X-J4U$BLvR`sTVJu%=KG1v1G{s+HLaVRhki$Llvstq-
zhG7a<ZX0`v{NmS@MMnHHY)Z%=cA&CY)h&<GoSt2`uKRwktXs2>U~!!J&laYe_-g83
z!?_=kjl}_|F~5}OiZ1z3{>8d;>MD-W@s{C^Q~!pKn{LT^Rb+!q=o<HfX$IAr<exk$
zJQZsd?lv_mLP=Fco)Blimjwq20z>*kMM^Lt&N;C+7#8nV)ZDMx>Crk<Jgr}t!!<-$
z*CTsY%scelq&wdSHG6aLpRnpIZQnAqj0k_*q9X?$D&B?M>vdmC9YFJ!GDL8=2s+@F
zs%aF}6fL2&?N!|fc0_#AMfuE1C$2(&RS-wNeO&kTG1g~R#4+o=b-{iCUD~c7lP>I;
z83MJ0HCFE65?6{{Kz~K6r>yUZ$4X04vxV^5&fYKA`gv`?IhU0v9>kUf8>Bc>aeyDq
zV5$db+_-|Dsp>?vR4<A0mbzD|OjGu%+)8r@6uW>2`GM@tDBkI0^X+(!s@;VTn1ACf
zXmk5eJM;4pr<Z5myv>6$Vkf|d``&3PL@%Y%hs*0T_DYL95#DqeE|u2(^G;N>x5e?n
z{N&BL3S6kb_8;E&9xDZnzj1ZiX~)N7ZnbKF1KzFKHn*b;o1aj-7i8=MTae3a-Ykl~
zi7}L`%9`+QV<s+14kLMVT~`}DNNH5ff4XM58J~6|AgI3o8o`GruIwuF%fF;Vn_}!L
z6M$k^d$XFp=y;)+_n3EUoarr&(wpSaoFio(rZx-S8w`UHyv<15!OuJ!l`53*yiY9Z
z0Aq+@^M_)XqXRj0TuhU^Ka2s(bn5y{Ggms=Kf=^8OB>vC_06{pHOr43(GPz95mNb3
z)*>c*1*s7ErC`T+q7i|oUHebnUD-@q{3^yzqc55t1MF4qfNldeB444cg6sj2Mug&v
zDXCv=2wh(v2Q6#1$V$juJY}A-I*TeERRL>tBT1&nwMb|UQ~R>+gNNCOtVL#$EZ$n7
zJG1uWR91`;W*o%HJ@_Tx7dae+l{9`$t_29YI?qOCO~lM^B3>##gX|Z)?I0$w$S$v-
zLNPQtf^OjqLMD4OoFURC=`4<wNiLReogjh7H)o0u6<x#fJ8g(7y-eYYCqASM$^dbJ
z@%Q(GjMAH1=wmXY*5{0ub)Mn@Ph>6gj)dyW*LpX-Gcyr)k5WV@btNo;DIH2zgC-1r
zh%Pq!P7jQ=uL3r_;XfKM$LROoY)r!>sQR*JS6#3vg?V>iCQGfSDM#$Gv42jEAN5Up
zque-Gm?{2rzxzf^<z$0C+R<mUyALQXfgwW06M^@0Fz#563BfHJQbSK~nrQjJr+jAM
zn}&qLMI71Y(`)3XM>x|Pg}NRtwkr|{Yy^(sE|L2X1RYPVM;!l|$|EF3ILLiwT|)WD
ztll=|r5LasDKN-UjLW!MG)|6BmQ$ss8sEU={)}v%{kB1ZchP)cA**&m)dmR3Uz24E
zd_;oKSyCEI`LW^+G2-MC++JxV$aJf=*UTi4H;Db8mVB*&h~LAwxTiJR>n;<epH?~e
ze0}2-=V%=Y2C>r0y)Fhz?LR*+Ly^K!R-s{syARBdzyEC%nuYm*$RALOfcIlCfKXtI
zO2i-Y{uH12T$P9!rws($)e{o%fpoZ>@|;gXNrOp25pVL#BlCH(M*r-3=KYjU&?kW1
z?g}CiCBkWCv42ZI{h7%BUb`m7H%_dDUXRh++6T$>z$suceT;!op00EDCmq@(3BsHs
z(c98%#4rBJyQX)W7Zyz*z`bQz0)=1ThcZhcS~sLyP!08JlkyC(PFwuE-iYYf*16N~
z>tZB{e9ob_^u_hoYGzbZn*XjUycWXKCjM6|%HERebv&CA1#82SA^mR$#?q0U*~2L)
z_Y2LQ-{y(=OBVX5N*j+0UP;8dR-$`bjKV}`+)SS}T9}X=O=*WOMqY$24tOtsMbfV(
zJMWkFdc_g;+v671o_H+_L=+)PYRz4}o5tv}9Bal=So0^cK7a6#*$6tJ)~2H{{B=lt
zSa!dB>#HZ!DKTs<Z~!8W{HwYDS#qD*{`{n;bh+;!cnd!uiP616%y$~ZbPYod2)*6K
zG_ria7Zkmp)?UEHS~uojQC#MG-|zGzp%E>@_U>-}&)IwhnyrX3i87m)P;Mn{svN`a
zGAT~C-Ce$;Th)UQr0^X~?Szd}{d-Q2I5v}R=xQ4;%JYERn@Wz7FJH7=qq24-3Jn_^
zvloTi&rSR#P&9bh$Ja4=EicI*fWx)(tZv7pO6x=F$d@s+iRE8O4eN>!wE1h2Xty7<
zH;7JIP3j|F-jNV{c7-5wt(P*0EJo(f<|*)nIDPU}fH-C#g<TtoN_1vf%ju2INNAg>
zh=xDXhe1MEW=Q|8@YV5Vx8&=PhVO^0W%3Q;joJPHQQRx3i-nYgaju;iZh+DLMB`71
z+het!^+Vp!R|-dplS!nNYWxTa9B{7*4<aQ66AbU-D0Yha=)oprN}{OxbIoP`m<^Zs
z2TE|Czjcp46=TeAbi>1~bhZkja<jUNV6Ee;GqQuFQv{hJH$L$J>%8E*>)V4(@m@1z
zG+$pKHraZlySQ>^vxecIabUc)@v)V24~l*ciSn4O*ugkH1o0%!Y<~l>r+q;G+wLjL
zayuKL!eT;UdM=;b?tv<z5ys%LL|i?SQQ@LuYq@Nais<N=#o8pjAi?mse1SHEXK<rc
z7-d__+{V50hmifIl6dNG5ogsAvo$jWh9GPLk&&1Li-yGkCH?o;-+)}2gC5Dn&<75`
z#qy9DLvql1y+A2j?4|@t;d^3))ju@W=H#3Or1;rpLmNE}dhZewhz`VxkqOS+P<b^o
zT%{-=Y@B`sk0c*_*vO$A$(H8}R1SEf+STd&rFRn7iyc4=ON1mDsPgH_t7nHf)6X9!
z;xiehyf1IzL(E;gSG6zvdaY9EKa7gN8{T(@F=jNmmdHeQ&Vhi*VGc4tcM>#$X@}9b
zGFHS5%x0b^FveFtuw^LhzE^;n{b``f4Yw{(0=t9W({EyhcpV1rBYk*^Ju{rXed;FN
zu}lM0f*zPgPX{Ry1!t;p;#)UCVs|iD0F`$G_1ca$4HE@hoR?yr+PZVmd^H~Rio=!&
ziU$Exr6-9Mb)mIE<8dN*gYuI3K!a&|xpB0OI>D_x<;@12GwbX}rDg}MFYrhH(+xtZ
zKkbyxp1g3C0jT><&OZNcFK?wd+r{G!@PpH%Z-&@0>Nxwh14esYT+J)b`%1Vt0h<xf
z*SkwhfiaG7#B}l0Ze|fqm8ADtVmQwjsN8R($GK)88MWdynx*M2QZ-dH%o9F{ft&y3
z7B+|eYW`PvvXd+_nxeCDvBJXE(a4%ao>6yJFFWe0s`rDotziKu$(rb=)@G3iGNMU@
zNrk;dye~grTJgS*CfPZtHO_eEbKD}F0ai}1k8bjd+SEOK@=P*ryxW~>bGOAQ0$6aK
z%hryp9kzULY4z{z-5n5cg0)G^*XNJzKr#0)Bmj$(dw0be!j@OLU~2I>n_-}ZT)N{H
z<>}G3j1^wf4ZcekM7PVymn0>|eA9(G-Y3Q-wr36Ed$i?kwZXKK2&p8fQg0Nr0FhIt
zLg(Op4pX2Ndf!V3Tb5~-IHjcNTrkF}GLgoS%~5m&A{KLb|Bc)CxK&}h5a9Tx?n}GN
zR{_cbzVGQYqewGE5=lCh-~Ib;b`0K)tU#kgqiEx|$B9Et#Dgnc{L`6}d(P5B^#Vps
z`jG-13x1LxKvoYhDnMjdkJHzSHFLVy-kg53pePy?S=wFlFg#efgwVGFC?NE@^<FCD
zG4-{lpMjfyB3lRK-?I*=$1!c-F0&|N{P`@D<RjaI+O=2hv*~-;WVz1NnEm!3<7%Yp
zY1xa0_W4Rb(yO^i-$2+p%AV4ZYaqk$KFm@t2<g=Ra})T75L$p)v%tq8Wz*RLr!~?r
z2K>#hP@-+K8bHM@AZwIp^TBUn+88WptY&224&r_MPyasKS>LI{-~IcnI^dc~r8073
z{%)i%S7qjUZ)x^QwHZDvdvtbN4!dN`kM&db^(p~$85B4wa%0Hoy+#z!DK6TH|LC<>
z(R-6Z05?XBmBL-o7tYUcy0Ht-g_Y)EYEkGB3B~W?ZJ=+?1#AnZfGN>fP3Rx~c|(>p
z`+!4wl1aZ<(=5k_tY>XmP?x`01J~S-?>l57fm!)U>YQxIx4hPQ{ucw6;M<bF%s@M6
zd`I~5DacCj*&R89mr9Zl1AjU1&$mFmv5UkWT;Lmb55IKDJYfme8HzR$sf9p1`}Bc8
z`!cjXxQ{;z%9RvK7jV7x($8eMGL$`@3vm-1T7A3~x$8fQ8HewuUbP>KD!rdbM0o4{
zsdrya*U9@fZ4_6G#k*_2*mNxtImxl*I*l%}Tia#Cg2{>BapCXMmm<EgE)bs1$Ws82
z(dd%vdk@aIc&`OsIIvU>UocX#<~d{Zh>>6rz98gAi@6ec6nx=38naHTER4Wt=G`BK
zMo4z>^bvqfmtN;aGV<h7mM(++Br-WXZT6-pfTJ1h)==62#d(jlG3P?T*M|?h?WHw=
zXYwP{AUu^hUnMGmtOCdKhs>3)-|l|{UkNz-^ZLGO`<mL#m$MTJV$KpzWSgV@meuj9
zDQw6pDAg<0FMQO#r+lf~>yToB|Fz+pkw?C=DrkWu+A=Dj@%!B82(2h3Ii}^V`b35C
zL=xT+XN`2%??Rh&W0}f8C8T#*3d_KUC1S%thf<rD^@yi#uZvOr`%I19Uo}@CAM!w5
zW>5udRC?8i7MUpJ5Hvby*gSiDi2d}q_D@CF_32vRAcJQqwWw-V+vTMbzc1j>ev<rp
z;mAEqwq`qouS4UH2#_9&JzpZUR}Gt{?SuJoO1^&OJ+c~3TEl}+P?Y0TiSz7slt9P{
zxH5Y<qdN=1oP026YLOZV=v+H-C0{cMBsGj2j^5Yiz_rA@9~Ij)JK=M_>6IIJ==!Ua
z>+x49cQj#?jxR}kj5|tb45haH#+HXOt-(j-DtV_@VUfYAx<u{6Fte8G+c6{c*wS)?
z7)8rfoF954P42#3n2H0Q+eS*z-h)|HPF<UvTq_aH8slkeVsrqv%{7JyETEYV=!l@O
zfMyWKizNg)r_D$%*MK^g6(WuqBzK{RiA?SUt8hniiFOXdE#*>$G;^ULY@5OSmf~V<
z4=nmr-<m*y9PnMB4FV75K^Ls1kGLh4C{Zgae7*?>(sR^Ey|=W5qN$^W!*G3O0%-)$
z@ngs~i{<S2D8K_v&3$X9<SpV*!Jz#_cN45+W9%11OgI|e3IZL2uAR8Y+bG-brTM8-
z-u6Eyt)0`({cGDE%JGJ%NOvJ#0OTduX*kbWFWWj+sBShE|A@6vv$8j1W3__akhFj9
zod1X!(q18e5UBJizGg8^px^PjV5z+DSoFZ|)cjS01u8md$APzD&%0-fOjs<DsAByQ
zVzAv^_j+9mpBxLOB<q%oZKsxeD+ej+1|;edlZ}^)3E|hLs|$rcy$|M3UXTVjoKO~A
zE&I&G-k;8=MOxO>CAVQA7uU}9jm4MJ-`jG_<4PV7!#T)}UlB0;Ceq#{d8A{}5g)bp
zx1B6C!8yHp5wvO}f9jKV!%;^%LK#{7UU)|Wf}V#_0ID;Zillr+Tf7FRiXE`zn@Q}k
z9#j`4GDc~7#?k7L0zKV+AE0>$7>^rqx>{Y*r{hiMm$UzghA$V~SA^S~$X%bvOm4r%
zlWI%Rtp}#gH|h`T^WeEm=9UECM{_A(#Cp}d8LGL7N_OEr)URBC!LU6(^m&1A6m#;O
z@D^v$0bT}8kRQ(c&MV!HIBAusfRA!780A=FEaujqSan#l!UuN4+m#COKwX@a@ASr{
z?GsPpA88{_h;PYt^Lq!GkEfZ1R-@H5s(SrT$bVN0UWlJAPuQISAwC5j*3<pOc2vt}
z7}EFg&v8$qFA>yo(|a*WFkVxu93ft_BdzgNKzj@LGTVa|38G_GPIlqs2jb&#k7dp=
z&-@QXLjzO0HroL^_gS~4t#S%W=yyZSb%UzMTd@x_ymH!e$2>y!U+S&d+^&|Pnn+wc
zG{cQba9D|y(@X+B^79NV>nnQm$BMKsdKX7-9$4_yecY^0c5<~`^xVb#evYgT1r6Q^
z0@#!``1$!>Y44-AOX;>xXFqY{#(hBBqNVU~Ww4sf<>+8X*2pn_{IivjVnNMwrDes_
z|3lnc#n#nrTe>l0%&}v398=89j4?AaGdpH`I%Z~OW@ct)W@cu_^8U|0_f*xbQmO9C
zm6q1i(A3m=SZeL-ZM0s^Hu}(XViJOL*Yx9nvDv`Ahv32;n`^)&oZ{(tf$M)k1#dxo
z5-Y!2I!)IsHd-%Q&@w#>tT6V2EimGYAScrfWX~)W+Nx{DFiXUUSj;7Ot%8#PgWX0A
zW}#vDuCwzx)M@vo9oC_^X4r4Pn8JS9Crz;o^r&v&ebqECbuqtmE-Xvdt085!h8i*x
z+*%py(2ef3o!DB^b|yQa|8faiIUiy?vH^4u3z@}H8rsvs4G9lim;4eCXH-FA9kzEt
zH}EJU{B>lD91hwft-ho-1Q(eK;Fe#w{oSE)k=yt;olD_BxmTWsIpsfs<BRu3H=XBF
zhyV5$p^|V60dvkla>4ybv;@~o9htJ^xK>B1unUn-=>G-gwzn;|T+769esL%?p@C3O
z{TG=teKZX)$0Jcj;s)v4USZV*?5n<7e_n+pojN-|D-?@gik`~R*}skcPdN8)Ha9}M
z*!Ev&ZW^au<zH-$FV)iQZ{@V~=lM3+q87J4^K8Rm{0>*4%}5FffS<{!V$C%#cyvmY
z-Q%%0NO)a55ynM&X=xyr6Wn||@2!DM?J2=?9UKb4;e|9tb5|fQnpxMbZ5+8$bWU=^
z8It9{*Y-oWYw|z)yuD?oqF66X+{Z8(t8i>V{-7Hk{QIrQK&;7)>QPLJ_i8W+O3byV
zWs2mlvbrUo9pxd-L6`Yp{=|v(&-Tz}CG5N4+bkWnjBA}Cwl(O#`-s$FG)vn;zO~)%
zAErA%L#(nOwS6nw-9jqvvYxtQh+fJm{YFca&`nnxmPg}}0JY>IS2E7{aL4})*3362
zSo2}PWD7Lj_7BHj7#E)TPabwN*qi2dQzX_rcVGHobOx2xRHK`<Ql0tI?`p<(JDZrq
zO!h;45LCA2dF7v@M5uwUguJ}b;A)q0uayGlrQ`~9YmP!8!zcyik{-ImN@joJh!!lx
z=Q8!M(Zo+Qij@#L9CH+4mKWlRsY!ap=9D2n@maG<@kw3vZ`2YJ727l6mf_)!a*eeO
zf_ck1m&|N6m%q`+V2R(~q{ezaos{s5P0g(Nje3a(X$P@I*DFw72)UAZ4a)-eFHnYR
z@Dt%bI2lnv*I$c1Ab9h)vS*RRFDyEVE$=xM^%I?Oy5A=9I|OAD&ZOl}yroyw|G=^3
z>f16PF=53n?(*m`2Fg%<F~4j85=jz-Uz^5@OxN$lI9^jg_MRM^xqzjsB~i%s#p6O?
zuV{x62)!nA=`%^i>BcN#ll1g!N2f8V#P?-+vCJv%OFwCEY<8u~=m^|tb9KEb{ulm|
zTQA%}k}|T}FN2*?wQU0<uRtFxpI4<Trh&8z4X_oP1xt_A#X05tu&crKv`up8X!=}y
zNP7IAA2SwC*=!=?>Cc?%lF-u`3czLsamo@7t@HxU(^YU&^?K#Pur|WOv3{Pl-P*rT
zy$o@u+Kp;oyJ<1ha4!GnF{l`Dw(3r?u6(l1FfK>HP0Cv=fH>W+2#nj^F`pM2y_of!
z98z{=-8NTwEOk~zU+<TSKS=s;*<Y~U|4?EB6U$1`vkLn!>H<8&M!EkBy2R7x#t5L$
zxK|_-cwFdM&t3Fi<W#`nsY%VKcD(AO3UZI!lZsiJ#sH*7XUtkGL=)e8W21s&nOrBO
zgEvQ4ZVvQFH*a+7AqaxEnZyYv{*oHaMl9gIkK?=bQLAope|4<SsJh9KPRsM?3S+yp
zYjs1x=gaQP0rXj?hgSpo>Rw+h?jBDU0+=#LBS;fD(`6T9B#Gm0&Jja&>)mHqnioCN
zz0%!5U5&7i;C)WftUQsl<1BUli@{J$A$Jdx?6bLV?}u{#Q?TIh7>3Op*5-S)@${n^
z8|$Ff%O)G@wUE*lK`xo?732D_6P4Ql$b>OgypjPY1pRDRKpofRi)s*~haIx+{_^wJ
z(^lb^)TYmt1qhAW$Elj>hUdGh%r@CbS=(vYi#cy^U#mC-whr$eSI%xyZ3qQ^k6_R<
zgblmi15a3w1fc@PrsFTD8yO+b*)Eo2!^T)Q$KEANFkNCEapBtW6qX$dm@>PPz^<li
zmpZe)Y%gJ^DMY-8?vKVLtMbWGv(HwC$=cVV>x?{>Kgn$H5dRw{gJ6O%GyXNgD^@H3
z)i+h?GZfvG_zPKwnDh4Ts*`AqdRM%;KWd9Q>J~hZBLd0*Qj-9}O}7_Uc#g{Ans!Sw
z8lcqFre2%3cTPChPW+mG_D}nWgE2<gzp2b7@&AI#<lg2SO{sWlv5$dvGK>m|<6Q0a
zp)Vjd@z4BGmO{dUBNLR?Xs4!NbWi+2F=o>cmDU`7iYp=+tQyXY`d|p!pov)0!B5>|
z{YOO?ARGw5l8InPYM+yw9_EK!OobtqM<?yyL#Zy^Re_Q-oD3|mZ*00wr9c6Z+3}tK
zr;Xtd+McYSEuRnK*VZO$$1v+cTVe<J;Pe%5_}WkEwy+<87xbF@oyh8VQ%-w*qTko%
z6Zj!&1NgsbIC>deF@`7DK*m5e81ThVp!ib3Bvp&kKsVyjdTV=A*H-4kbx+1ygjI$X
z+%bKd)%76xYpz~V790onlrY@7lQ6Ik{u8)iz)p&%)k4I#s3OrQxOxugE#r(Z`(-G#
z`eU`uJNGye&mpNY@FwXdS*)OYN3O<@PONop&;#q7QAOv9b5cxZrqynZ>ZCDCsRpL4
zP(C&tzt`MpP&}jGwr+cd|0&IJt@0IN8KTJ6CD&ppb^GOpI{kh3GaA#cV#6vuAqv=8
zuHZJpkiK7Ou?c58_BXm$HmO*Z!z-;j#~BHSJ)zKMc=8XZ3e#mVnAkV=8AHO}K*J4o
zYj<anY+ohiv+F>ZPn#`lhD`G>wGNZ#c)iLL#nukQ!MSUfCoW?a+I8j2&hAc<k=K^;
z=3y3>Y!|Do_~~1NLCqU!z6<j@$OHLZ6&Q@1|A}A@pAM(2!tuC97fgFN-!=wWia!#I
zoSpcQDs}k{n9{u%=NgW!DilU<v@S5h9cwv%8%*|fcYJH*8VhSh{KysW7#siE)lEB+
zqcO21qnbH>I4%7yjOr+0y@SBU)^?7s%?9_r68UkT%q~)nUB&9J4Rj$7iW;#0|3PW~
zfi%GXJ*Bzox%^p9@watmYruyc2^&6v%tCvj$7{o<P5iT{;j^07!SHm44@>+uf>Ohq
z2TYz-z;thH`iTB7-)_rpuoeS92st>~@N*$VZ;WyV5D||Qo(>6lv$*QOk_ts55JZX2
zMM7c0X!@I-4N<h0Or}^cbkelZx9}?s35<O?=tToDj<WHokQTcu-@g+-rqMD7J6)^d
zgpNqU32WFFISX8H#zSAjR31u=!_O|p8Q88WF7$Tu4jo<Ya+&JGTBiuyJda4zZNE`>
zHmn|jLxDi3{IEwgNH{$Hgzd`Qt0D*;FILE$xht~o`vVU{JXQhj+^p13R`yl~a}o7|
zfs-W^Qp(HTGd%|u?O*JsP^FY{!Hf+$-FN<-=K3db<}%|6zdAE%J`BC`EPtv|#RfsQ
z1bZ|sULHRKMw;qm|9341B7Oe0yOR}0j{q?!4Dg*A_*Lo)w8-<MIvy}esmuxmt)<-V
zgZN6Yv~s0+OXXZ9L(p<2ljh8Ov*RBbn$i2s@+GZ7z0&-w@MpbE(3o<`Z|A~kG>v2Y
z+A850zY7*kkD~$=MnsZyUMOwNE8=0!8<w;qr{7uHPFHWSkQkO0bP|3zNe^{GRMx7h
zpfM@0L_J3hD7;g?$(}bP-F<9by=s=#)WVLiTgwTkCQ*)(UhpERbe?3q-aM8a25Hut
zE9Drsk}BPvDR!utl_hee&8ZpbGgFfrYSL&u-a6(P&42FG`EHvaRebm#7=!fo=SoL@
z)WDGS{e$ON@nP?pxfA4PT5V$S<g|%phU*=>62N(@H!%KQ8x3pfp3bA*00VJmDW_;E
zyDs`KwBg58yXV0auQ3AIyZq~1m!y6ypJ7h4)b_YIK6ueuoJNm&mh*w5JfBZH=}w)+
zR2PZe2?Fj*W>D^z3asj4WdxsKk`1H&b*8+9;8MC@BVxlFN`zlyVvC*e7ZTKO#$h)S
zfn1HaI*UE?JHG30&jjcAyvK3E)_#c;9|HCw!5Fi;JXBz}u{Yg$*6R1>S5Xw(N>8mZ
zBDwu9ZUYuu0Sy#40xtq)3M51qxl33jiG7Ic^rHx<PMXw~T4inMn$CH$pE0q&QzzJM
z(=tO-dYZ^R$)O@(1sf+bL2TFv7WQIL0O~Tnnn1%w!<w$B{|LH``;(*$E^65WXF9T0
z#xK|HbCJFZH$P%)^vaO29XE#Dfi9eiOXmuKVa0@vMe_!ZT%x^y10v)l!N41oLDS^&
zo6nG4>^vbX2CdkW4UHs5nag25h?i7v=5mpC(%+>5h+cA6+Q`C=-Fzk+0HaoqwAX)6
zWJv9+&M(oehv6Mi#;||YhGr&caHP(%wf6tJHS}xVc#N)lct%IbSm8gE=4h?BVgMqh
z2IkQ?FO@~xSC$Z3`B$^kd@`Xs0+sz)7sjFAVbGk*OLM-AxWDoVDlhvm_^=TiLRPrR
zPCiyS!bPb~dnxeWCF#7{P<}(zlNS{&pa)+euExr_(c4<~(2IEJ(^d`i-+mZhti@xC
zOfz;VUl}>p3x3n=enP?=P8wu2@KY4@XGcq7Qp&2Ng<9py0tc1&63agqqyGkJPv^mc
z(ei@s))p~MQ~3gI-oYV7#D}uUmrYbiNlpw*PrSFh0I!}yRh9Z9zOwRh7D2OGeOoAw
z*HjSwSytX9bv$#D&%|Pw5-wH41qTHdwM0!r{1Ec((;;-2DMdxD8iVfst{WZ!W(Ek8
zYr7@3$a<kP-IBd7GK$oqI-k|_YwHf*^5-1<Na}*x%i*U~l5&mWK;<H9yV2&ZEg;lW
zqR;ds<8drXB)a{31N8@+1xNh|ub4>~>-59!2A`BnN`{|?20}51I3JXxh~-Jjl<KD`
z>$cn$VV0sdjRpSTj~0ii>!D|WRoqz9p8E%dU=f3=>3d4ruT~^*AVP2g$EoIADBx3L
z;^6_SgD{?V`pQ_bD;*7ERyjP5#_iu$QSA*C6PUau^UYOql0&I{*j1{C))XYNoqJmu
z&W|7-KbZDXcNOCo@L1LQxDz_F?$*au%GRF@9cEV8tp#BpGc*$9icyUimFn)gbg4sX
zMj1*ieqRy1d0mH^*K;2Lkvtgg?-*@-PhA-v$-1C%?D5NZ7(kPScN<aLH<G(5eDE9g
zt~pe4lX5hX_%E1_=~9+${JWN}ezE)yVnx_((4saepJc8snb-HSB1l|BN|D>7oQ0Eu
zfxor(o~@DQ&^NB($|w`&b$oSm^Li^Na>){ZIjl}F4(cimUyDh1Is~mZ0mayKQJ?0r
zr-bU4G^02RRm4yt%2+Sfl*Xw^eYmEPtHhK>{!&RCDK#7@b(=jgUXzw82+3touR#B|
zJcuo(;)ifnN-r}ZD__OB=pcDV=FovLihT~yxAVy;sf2SR2t1&##pF>p=+5TIs<zmz
z0DIdk+88TTPu>3eJkdl?cov7s9hod~kGw|Q`H}xCh4V^T(~q*_^)r|%jS<4;V6K^{
zs(cx5syHkaJF202g|w(W0-lG)9~G~O*eMHZvGaEq4*Ep=REjK?r)KruOv+J}LbzZQ
z`G!TaQ$agwZp{E44Jdj=6~1H%(}w>Uy%$?duPTIZ)Eo?R3cbY3(Rum^*EgtiV!Vsi
z+4IP?4IzQsAA$$1Cu;VWU@$|!f0R~DJ^Cn-r%C*}K}CeOh`EcWxf<Dz?W1UtrN#8S
z0J-2;Ny|@}_>3kBMF+1%HslbWLyU^Er20eOX&WPmrLY5VoKEqx*fCyttEvSeBuC_L
zd^bWqC+_rijU|17j9M(<e{s0c62^qv2xdc;rLb1B2U!3{%(R!DNH=ExBMRWqo+U%k
zY0sU)S`V5wqB|QVPZf^h4D2i1o9)0-ZXMG#9d}b?xsbKS8EV7HDe)8b0$Q5cg?#P0
zoA+lqE*DUUJL8BhV!A8bC3Vy!MEW8&g%I@Mmz_cGEGf144R^W?nHj(5XQa@5Kxu}S
zf3V~2YcO#UVy399Go;ie2hoX`a-ptvM8aR0mJ>&R&V$aocczV3!%bJAEX7S%B*7+g
z3ogC`!qaovoa%k7VE^)oubOAfGby7cQl*Y@Y9)YFejF*n;+J!!Q|&@M>&1Rt4ZHmq
z4|ih=?T3CD^c^G@#h3vC21|@3d;7ikDcL76@`*}sEuo*=7tn==bkWc6mnHr32g>Hw
zw`}Qky}fGvweflA_GO3Xi}Mz&qJQH&@#n>%3r-s621d%5t7`kF#yC28528?_Ym;Ly
z*ad*z`}3&)*k29ZL#7N5$Hh4(!hv=r$wzuW@k*G;#U)u%{93sg)-=kmIqA}z7vK(1
zqgXi+O@>iO17)(Z2UzfVT0fqT@2su0+uw)X)F%h74npu^xzG)1T(zI&&)lCUYvZKx
z(d)YCI6i5x!~w<4#liPj1A2BeCbk&4v`HY7z7#W_I4QK<=<N)Fs8!_|!~Mt}4(9si
zbT6&llH$4Ej)5a>C1y*H(c>$SF09pCMkpdeg!lX^IXSR_rSVfAn(1r67=?rj9W!*E
zXL0oTduvg*$D1J|mb4tY@uK<G<twx3lF8FcW9{*+xoVYo`P|&`Glz3p0?k<FP%dzP
z`s2gqz1C85ZKdV4z|GBg^00-p(apQz61*c66L=Jj%rr-NjOD=!$y+IdZonR{H|I&O
ziT(`hY2M<TUow?yKi}o96kO6f@|&(nKhQcN?&v2-g2fYh)ru6DSZ@rrxUPD7kym~n
z(QfjmNqM}!h{DgN;K?n(S;gk&Oa;y%?L@Z)a~IyxdUQrw%@n>kX2}!r9iJ7sZ$R5!
zD?|%$iOZoB0KCg1!vU1JKqisl&T&9b;^P*+#&VgIAB`$nHsIemx-(pykqv}{NVmP7
zN@ZAH=I_5#L2HO^lR<Bqy3>x6;zCsx^xt(MsFrN!QjYG`&JHPce86-n0=4st%6fF%
zhSi1Zn;f~Jq{l4P;eCev*17WUoOF0j{wFJf*xl+}8PH!}f4OhDdE4T|Mjd)zm7%vC
z-a)-yu=FB+x0I1ZYdxG}=R&6>WfyWAa*#r7jDU@=iGHlzWphdkh@&yd!m_iPst_H}
zvN~!ik$aM#r8|p`E7Sl-1awUGg(pa^oJECKJk&R?*IisGTi42`<=Gu^p*GA!=Eq^y
zpKKRiY?Xi5vDoZ+M&<Xm`Nje*d}B)WfyrqF-a9`vVbaEC(hru|h2P>pXiKgK%Mz~z
zP(AiHDVV3LX=ala_+Umc{V1|w6BH)fgUCbtwUE_<3BM)fy@vWa07@C2#>Wo2JHm))
zFGd-2`&7(UG;BQua37T;id0f>KHt8lmrwCWt<1TKIlRpZrjvZ5_CN<iU$JZ<g-u^b
ztU6V+5VrTuc{{2<O7SngkdJ|tR8q`kB>nM*7Pe7k9-gq#+i4F)){IMXZb#h#6GE*b
z6e#3L5c+iMMRDr<1PJ-z)9|!{Ig8SD*dvEeJtd)gLsNdt=u@&Q9&ZbI=(+c$@%W}8
z)M*8%jhWT`MYvmFJ&Y}gP;qHS%Q{ZyB7-f6#061#`icJd!)L2OEW5Hp)LnRm&;2Af
z>|Q4Io1JFpNWDH0b5^;_=cZdk4Pd=$CL%daYv_o(+QO`?OYGg{r>0aLb%7cf{gGYq
znHIFCZ&ca~W!vd|4u?5UiV9k`D)<T1C?q!|>qhvC+v@6uCz(74dW}9^OKn@2Cp&u0
z*w|E4X@f6bLK`{+2Wml)uGKf`d<Cf(=f^*S?YL65k_m7a5Msdn@9J|6(+sSSs4KVy
z6=!W_qz5e@#|2~24))qt0q7Z@)wVVoJ>LY`=>43;kus&C+XFJ>(k@Cbt#=_NRvW%H
z5=wd5cRm}5xhW-$uo0$TIAJ#tjya2-99XCrBoJ#3p|iKr1HaEEVv_KE3I;^h%37QT
zgt?%Z#m=jd#|r^)2E|TlroVsi7gF+FJAb<C<=FDd-N)M*I8>$uP<CE;u!KhsifhwF
z_{H{FXR|hxE@&gQ0aB~t%!HGphRNYE#-yYIJZ-7016GXezpyx6=<uN0N2ppJEfc?d
zL~eEnUwzZjBqEhUVk7+-olD7$OqITBppEx|JIy=)kX{6wjBg(%`*lW8x2wDAZ)-*A
zG8=+QSa4tHzhh9x{|NGi!9OI!Z#O$+RF4+IFkFAPCRQ%TqZok0_j5nh;|wNhV$XxE
zmmKMA{;{$+jfQL9Y=A6OS7;ikNHun+q1@^(x6hsYq;otmjNey543e<Kr;C;m(wZ@}
z)kVRKki7z=R$iy^90EiBNi1>}+T}H8-vk{}_wYb{!&CiPlZf=Ut9K1>L>9OWZSA7V
zeoO6tJFgPy_cY8x6P2yX)fMgENxag?Fr0e5^>ECYBtFvp!!FbS_148FdN9z0qZoRj
zQ(4TM&w{}HU4sAP0fqx(x}Oi#oAvPFMVox*E1@mWxj)~2h;Sf;kWVhhZ1h8t+jqvb
zb^U-<y!JL84=>h!bcTkQG}fB@%Lx$_m;-G~i%J!hyc3h?&-zo$W^xX}h9Dy{$T`M1
zEcqTUgr+Z$DKQUM@p$uydTdlU@RQzm=ZKSC(PzWfXts%2Y33*|n*q@{c<y7?{tdTZ
z;<@nw7nhm)ep^N(I_TgTWm&}5cKr-{-tHhd%5TF9$CzfWFZW+?IZ4l!;404f(KB!&
ze*gA|XBO9Re)UJ+ASMkaTG=L0U}n1T)$ZDm+~8^R^6eSA^(z=H#y2Y`c~bHI7>m6T
z*@0dkY&vP-e0x%w)4XbXJ(OO<5DIGwsVU|Fw!n_5TCVd0l4JDObZ%Hm97FZOB}G_)
zmp#9b1iGh+;N0&j^kx+m$IG+P25hwN;B3By^^%IEgZch{)axpLvY|U#B+;4`M^nvl
z^Yt+;#k;8(T9gR%sg-W2eM_ms>NA%|q8TsX6ll9>r-+~@A8*3w6KZ`H3Z!d?X4!%U
zx-@)g<?1c5>KmX9?-MqBx|8Pwxm5RIHWt?@eyiyQo4M3`OAa|!k%%MIE0X96==IVW
zXcF$5!JmEo$5dFl{M%HB+`sffH8mo~i~NW!t+$*Ba@N@Bks3s2Efd8a4x%klD$+nj
zr%h<_dWYPxGBL0~pPuyelmzBz&2KBP9#%R^O&>VENGhH?eTlc7pdd&Y=0eTNUU_JR
z@y}hm!5R!Uz;>(t`oIFNSzqgh=WUuSyz`@!yn0!vMZ}w+`E#6X&Ny=1c3nl0=DPfk
z9l<q1$M`?E5kFK(K*=8qz4VowW2cmHeFd{*j-w;g%2oX!jKI82#&b6~db;tt38YKl
z_K-qXbi7A|CD%F9vlAkmB7@uK>N|J)=1s@p*I~r>Q+blon>^6G`hh-e>J%LsQENXC
zms6-NVYLT2996yfLz$cv_O0O+hi)pr^Ef#cSLEnT=BpTf-~dt(`XiZ@c2{99K&zHY
zB}^hPV~(4N2g)4DDJzS#%i43B!?TjNK&eO`$5%Ufy`PH(D@^p%xMhd5Z1wOdt*NVP
zuV>|}+El+<_OQ?6IAR6Xkr3>*cu>tOYCgu})?9onX>wjl{D6T(kda=P3AH1m`T#Wp
zSH21L%<0@PfSLdSlCa){5}{F1`UUk-aQnwj@U-_O)|{IN4#M2hi_O@!tKp$UnZb5!
z+SeW1o8YH#-VTn?dUW+Hu~8+%wf^{>Bb68;F!kVFT}k@yQN#mz)lCKJvSXW*jx1_(
zZ8KkOnT8m?3Rjh}!J9`P=nhQcmb%6kMsNKp7kh9J0E%sFELn0D*IKxK#G9)MDpwh^
z)6b)cRp!ZoiI)>E#TPU1r*f@DE_qeef3C25PqPXYEX+I357Qh|s@x|>sV~&m>8quT
zV`sP3FqdY@R|TI~^<*rYcgL<D`LZv8V*IW7uzMilkTqeueO|O}P_d(?H|9_v%H^6*
zp8`@50I~-_j^^}kT<#D?OTcc-cu8;*7f6oUQa=A;A1g>hUYK6`%Xp2}&ae}r9illm
zNv%$;p}3s=Gw1HX+X&-zE@zXN1Diuv$rgWcH5?jf|62asr1QczC5@Y9Oa1eJ3+WzA
z5~XRtpv>{MH8x#cpQJ*1KCWD*ryY+5EX#4>3>f{x0Tn1ibbZP)WY)@>_xF*6SQ&n3
zTIvQHnmu5OlYqLVM|pWbBHIm#r|pT@n0slU!9^*4jXt&}aV3J!D0!&M?qZlKC+8Zn
zDc}*mf)E<{?DyN&)qkh{C5kIUO{v7G_SL4=s>+sZP|5?^wV;dWI=D53{eXZVNLT#T
z<D9{><~FxlaaeUkQ3cj!t4-e8<|Jz7?JBh#`pi)bq3_e!84!$HUP)|5#vo~I>ctx(
zb53nG+{lM%F1)CO<s;EVP}ifb?l)IGFBKJ9ANTirCl!j$<4fG(JleOJr&VMeP*+b!
z0y9e79xAi_;$6bL|LA_;e-i%xkM3_@{qsJlccgupH$g=-h!{0!wsEvl@7<_kWi-&o
ziAgOyvv7G}x+}CwZuePglr^yd?(tgI#YFEfGh?&Z+8v9b?;~?uKz?*SkwU(@pe>wp
zMPz6TS&EJT!T50fU~4*ev{0>=pz))mWbV%ClAT67nJ-54Y)RmK>(z9nxw*mVN&4Y_
zJa_sm!5IpI2aqQFF}vO#<#g9bHG0bUHq7L{WM<EErhZ&dRCGy9G0mf>)He8`;O<y3
z!R#z=|A7v!C2xxce#yxFou?!mY*BvaSxTOAk96;7FHkM0?=f~r4~VvOL{IotCSCCA
zlFfMzzt9lG?AzeVjg0ju|JeNizQaoPa|&Wd{j*K#1VDV;unxqhUCzuVbDk>s<4UO_
z<q&)yeUyr4L%d`1B;<EM$+N0DYA?jJyPB;X6W+EuZLgenT~MgMOiUr$1dZ1@-5;7R
zxovxCGvCnal#T}nG?;4P&sLqVKCY3(r0oqPu*04GkhzDg93IoDHYWHVWi{|W>S~6A
z{ZC!(kuH5)M94oM$Zc;!iEX-saXfmG3BDiN{Y}<SoZMtXFiuFI0-8!FDtJ`RQ<$H<
zM7o3FPjjVh4pgv5&4k$vI(9=s>ekHH!j-*Z^n&*;Sa|6LldQorGcMw0PcuU47}x~v
z5Rj0w`ZZJlV#0h><(`~5hplVs-C^ZcQef_(NYsy{Bv>ZG13M<tGr0d^k!fJW8bxkK
zN4<fXkDHCmZ%@M$6<xD3n4pInso&kT^P6MqYj$@;0{%KkYi{C36ZF90s{|Y$c>Ko^
z9eNu1pQ~(cy7ujH{BEfLwF-eUqq=3@fM;_Yhv6AOq?A)LSmw_J9-5#0VEC8PS7f-?
z$gWFuV%fzFBJP|sg7!bt!fs^auuatchAVU^DKZP3ST^HO<vbUQM<QcV6}t}js?2rs
zIv=f3pQ<`Rz6>PEfo;x_2AqdK?~+@brseK%e0hQd-OmKQ^bMruFGX8YbujM30;Xw3
zJ$)UZPxmRV%VLD*gnT5X3mdq4<Y`hvanL)qpvwCKNwQdpjO71PtMxGC>C;j0q>Vhs
zYt9?9PL3fB<_vw;HTZ*Y5;3zcXKTo2d`@&fvw{H<GDGe^s){oel(Nr_htY=dk=P60
zHrQx>dqi(Uw1=6LsNNUzD{h7e&l5MwIzS%i9@`8wFM$Xqy||;Y+~({FnSUHVEjk&U
zwP`w#xEfO0tD<!klDkePhQWkwf^T-=?Oxy>kwNVD;V`=GVr@o0*gR_bwN~|UBaj^&
zV4!>yx)KrkG5F|bPT5*P5$IOI*K$&mtBtGn{=@f(?|gk7gRXmoO!P)}bWf>7;n^OD
zg`U?z=cW0`#=>dL)IyCfBKsg<%|AAwDDU4(MhowM5^0gO=)esNf{XFCViz`hF3``#
zY6o??G}s^5Ji3x~Iyqmfl120mi{?NJ!Hm<%hh5AgsXX6tol!t^_La6^MEE_tE*Bn(
zP=6B%@z{3JFN@-GM6q8LX$RqHrCI@W5V(G%HYQjIW+sg=;*w5CN%?!ave|~OnK;NX
zI$!H?BDg20J6^5Of_$!F0K&E@I-7q>r4ral2@{E`x)Z8#HVw6NzH=Pvow!ZR{xP<7
z7~|g*!PuZ`qqD6Tq)nj*Az{vVp!<Ns7>N|@@<nurMbu_;NTwRf4xzXHXpjRa3je=}
ze#Pc7;|~m;-5a)v_)7MD5{lS_ArK>2P<}Si?2r3nea$e-bMyA>gH)7)ehNu(m6S6*
zEe`EE_wc8tL~`*r1Dwc}rZ`nwK#9T_e3zAOa>5F&nTX4`buwUq=)P-;kd5;(nPy7e
zbrSzj4zTe;goL{7XWQ(^5<UFj);-`S8pcvp$yi8Bi!nLO9Fj8>VvEALeR-pizq!UA
zlPFKX4UAJ>wW6*!T3E_YSnMt_Z&n!f%y^{Bsl4VBGzn{WIiJ5+Gw{m-rjYLrtS9iG
zS2I~vGTXIw6_lJ17xLQF)vQz%=HW+}NAM{#%-WaCN1eo=YV8!}csgb;FcJl|gmnj%
zE2i?BTuk|7`-n+vCGw(8@r|Hn6GMYW)+M?rx3@8$HB1Xla#y=h9K*D=ATrhLoG*jJ
zd=4GYqmO{0{$v(8N;NBBmQwkMRXQ{wRc3wJBpJcY;8Zz0neZ2TJR_yzxO$h}I0CqQ
zc4F|5gr=>7nQC##?_xu_i7Lg3xLY&q*f7=KF^F5YO1IqhZ&(f)h__T+p(EOe!$}6F
zkRYKH#u#iOgBYA_-!qS=ziEH|K41!_#2Yu+L9fi;60mD)4##PL`L^bdHd~x9Re0CV
zBlAX<;KE5YKdVulrJ-3EaL%AaV%oa}0<6m-s>lGhAnc&9J=pGb&~S<|=f|dFCd#JA
zU1vdl`rRB<8nA<@KBu7|!lC+1f7q*CZ&2gzj+CZ&FcbvR8Eaqq60h>6Ekm8`{o$t^
zTX4B)95C%@r}h-!j|BJWXdO-V4>Pk-ZHxtmPuHUFYE0vG8aoHioS<elK(@c=;CnN`
zL8CD!JOn5b^>s%7CB}@<?~j?AXs8V|8~J;+GJnk&bKLBs81`MIpgK6n&`l-oj|d6u
z6sKmH$80w-=MmJzjb{H-=;^uC@855yyz|Tr-7q-_RJK*Xp1$JfxtYU&WEXDJ>ofcv
zb@#z)7UorHe*s1t_F&qpM11ZAz>9#m*JXtUZjf4O{6zD_GSN+Dz@u^N+4>nJPwyA{
z$)qg+qK5Wm08|1L_|6R`^zPs@7}AaA<M^JW7uI12Y|t*I8cU%~;#c!|YBPt+gemL`
z(V?h^DF^@}6~SZsnO;wCDPiYCc_UE6XK*t=%diLR0Y<?D_sRkcF3IM@EFwo~nqapH
z{I6H6;be{?FyS-N7k!^xfJE6q@D-qS#i_pS#U&;+IL(Nh3gRIYxbH{&PD@LQuRU@>
zTHN!}_B*7Dhevb=pQihO)Lnk7;Tq$;56g|<bFK-+rg_=q*?fx{o8c6z{Y=(!uH%CI
zA}qY)l{F}kF!fc%jb8d$ke43eM~aN+b|ilO)G;on=XozryCgD<_aO;i!<0eu+8mM1
z<NI7dJ1q@6kuE3m7IShhS#SW+Eo#&`nL#K?E5q$kbR23L5hZe5ljMoqV--PrFO1l9
zViX{2b?GWKX*k+C+zu7myJcIo@|vdqBmIjuk#I=I)FaVDbeHOlN~@pBt=-g1mDbzk
ztM6-Ixrg`k$T5GaaViUu6^g_u-7}oNzE-GoAL7%6W&g;=QA}zP)O+7e0KqJu537;Q
zhfU5&#6|Xxf6URHCLdiY@wSg&*$)_4AlnA|<141lESRe_R@M)3@$JBJRm$J6@L8eR
zbRlnn2=NwMe9@nL2GjmvoA4D`(^o{q80066fKHHyql0gF{{2fdQD7#cnCKS=O7qIO
zAv)I+J_rJVcMw84F!I|pudl3%%|xTqo;P)2n7iY{zlr%`d_P==CWS5@A0M*=0B>mT
zkY9wqJ`$nEoL?7WS;;PA(2RysyovdOq?fLu5_>)kwf{$;C@yYW26$0~JkqGVgSYVO
zgx-;EJPceSoFqM3p9xx@-ne(z7|ixzVI*;Qc;w|P#z5E_^zaW}On3jEg@Q<<6kd5c
zECYv<Xg{?G@Q1fvZf<J0#Wc{PfyIbukYIjNLOP*yBGDXV#tCtf!+vR+si~;S;|`x+
z+QKp5{kDl(^gQJVENuoq2zTgy+HyP4b&yFt({_l0#uTwJ=^0i}#aSFq$*xPuqOcO7
z1hR#xj#7zajX)j-<L5!YA-?f^ya7XUe>C*bL*f<%2N0YXyML=%z>F*s0mZDzQaEs^
zOL0~CauDjxVpV$L{v>Sa`^(GqT#jc{gc2Wn51BUf7TZj6-JaH`{uJmk|2uY&-%d|+
z2Z@@zeBVzU|DO{{34uv?y{ZFJ9;he*yVx$09h04+B~)WHtDTKb^0`Ssy++l7H4U2X
zjjOg83u%q0tbDOIy-oO|I)Clr3!`Gw28c>OSA~}a`TScr@6?&wI=H~}xyx4rq3STM
zCI1&}Z)){rF2pWI$($=BrEjXZ=F2<V%i`lZOt83`M{BY{QYN?arMB2*I0EP5Q`Hao
z<{i}^6pky2mP@#o-kWKFfxrWr^v^`o`T(Z2NV=@@@S<D_k|~YtB5~G5sv9Yu0ism!
zTrGf2o|FJ#Ko<SnDAP~p>aI509dn_MwQsmtL)n};810D9?nJ1l^J8_>0#t8;Vyi7h
z;NIeQVx}tiw{H!^9`7s;Kf;HFE-;%9hi<c3cro<0`b0kO*so>-0!jCM%HDLotHF9h
zllWkaGr?>d!`hfF-bNB8`T4=*V+$_$en-R#a(NJSr^#v`>_2RW^$LxR@A4@R+yMPM
zgJwsm0z(wc1q%KbeI97$Yf1`3j`QXQvHLh8A*1|aJxN=}Qq1ZAstKE_QaYa`|8h0v
zHCNZXFs946m-95>bM%Sg8bS=oH9Z~u7hlU#lwPSwPe#3_Y6l6<Jbp_r#hFA2N8G9K
zT&-8tgQJBKx-oOWT7A2;J^AhO7&Rz>GA%n$_-=h~;rYaRG%fd?$voM;AVDIvdLeFn
zX3w9uq0QggF$ZGpE=AH|VxFm|Hy#r9ry1MgG!;flyhRB>9x76E|3_J*7ZFMLLexg!
zbB~pD+}f#W&fe->I=jDlNvx_0b72_MLVTs=3PQcYjMATB2Z5Ofcj*c0x83Ts@Zy%G
zDdCW&6WqEaBFxd~s(sn7=F$54DdZ?hlA;B(Hij{iTpLpjIdma0zjYY00Y08K&!ubh
zd8eAL{PQ6|qKb3WB28y3nplEUvfDo=>GOfHCjH|qiLSvVCE@<KKC-1l&7qcS_LVuV
z(R(V%XDZ9-)|XF-q0485^(kL1YvWtiWg^I<4H}u1EJX&A#WYTTv-c$zi81R3^C#65
zU_S>%$$Gy-w1KlAlA@se9;s>0DYL9CZdq6BCt3o0TDs@BP#>AUs>9Y)mLo4sN=P~e
zRu`zldHy6G@I{!Q5gi>T<dJ~-ZNc$q;10c1ve;qt=9pr2VKjkF^)QaFb6gZ{kf@>v
z4`z=38BJjLCNI$NN2r>r7}Kr!pu^K0DuC^Btt5BN|NOA)^IbU(qL>0idljpWP0{BW
zzxx9F-xsIgNm9yxiJ!OIDR||6n1iZC0elr5e?|J)m20bhIyMb8pTGLY7Zr=vhf0e4
zsp>}y4$388v`frGTB%l4U9-0;wviLWFIUC!;m~Y(V{&r9W>H;Eqo6V{BJ&rn+EZnp
z4=mGNxgj$OE%K)@70iAi-%J-04c4ye?C=KycLBakVUpFq<-`GXKl2oF^49L&#o|kf
z1aB$}#9;#s$m?-K^yV0FhUm~luI}&bJi+o&Z{e^}CRy;>pYkHcNyi5dw!TqCRMw?X
zS=BbTtm_HX6_yR--775hCsUa((tQi2GE*6iXIjWz*0R1*jeXP$nP6VjQ(YdzV^IUv
z({5CP%YGy1FDiZmEv5*zEGA!!A_`*<E<kb8{xjmj2uH5hhH@MISMxh=I^euSlMSh6
z^-vxgE2-pq<Vf>=Jpzf&Y2^vJvld;GiX3vjEST@_qY3d{MA5c0K(Ra7var~+u(@f{
zN7v&dty<_r6Yso-0lA!U%XT&t2RR0i{jj=up-Or*`YfbH*ImmqsUg@d(B;2W8tPOp
zos_7Y>(5d`u&vOU<A){Ad0cXe&Mo%u+KJev91Qqy3X`EIVxASdwYNViFl?L=x)=}w
zVQvI%Ru)$2igYIMe<a2>zzapz{!B#7ivZ0oHe&&i@SQ#3OT@lsT0Sj+qcL!hRUJ7t
zj_(iO`Ak3t(;wp(5Xgxa6gV{`U@0^Fv+47O2^>er_@zF$EjEa9Sd(HJnOF{)7i%OM
z#A$LLQeDVzbZMkWb#wvB0cRYM&siNEQLlavj4wM<pqrQ+BP2%xJ_3{pk%JxBF0Tf(
zZ)l*_6HX3tFB9(j?Xw}!IRGH%B~S{Bg5SyWL|};qxy9l15L$hs0ob8+@37<Nc48M0
z>Jt{Qqnr<Ke5N<=2aiL$K*(`|#ne+<oKqMD;w>kXszf>=$x5i}6Df6PBL6I0k{Jds
zw21SJ=Px`iE6*7zKO14Vy_{&iGD2FJhc~q^ky{1!X+?y%+I8npLjc*Bjb}lN^ii{*
zY^T#uHgbV@H=K<?1!ji?q4X-#>;2$4*49Ble-aVc4{a;jzxLo6d4c<8u>DoMkqn|P
zzm*t8k#l+|Z7M_4_E``&>%(7>_?5v0i^M@u@a@{-JJI+Q$)=<5?M~;2h;wYUdE>81
z1{?Y%4KB;(NH#ZyV1VbOpi9oeBZw(UW|c-t)LlsU?Hf68Etg8(KKC0w1y}bWxQuLM
zQPooc5;DiZk*;$Ek$51!rv?3|0D`#ncep8Cx*UtN=flUwR3qja&kXBt)@oj@ogqDR
z1{?ket#24@PvehZ{ZYb`JRoh|6h73ht7+TW1L_(IBn+^cx4`5O%<~;aAiqB?YwR_F
zc3?RwNQg@-Y42<lty`e;D22P*`~97p!yp6th};J&{^n4SNdWI-rZeXo_!NwfaTF9Q
zY@rrw0*u{vMkY-8_i|b8m(BPYJn--P6MxV#)sKj@12nqs5kSeaY5?y)6n`xBqMzXZ
zrav7%R(eDXSOHSquO}AtV40XaT)$<|AREX;)R3=ALi}$x{$4zCT;g_AqGf|JpuIOZ
z$gDwy8^3^=@z-sm3A7qH24bUB9#Xr=5NQZ>$+i{>igp;rU>aS&DC4)IFQBnQxX1f?
zKsdfuPS$i79~lb9yt|*Vc&6s&alfNIwL2Y>f>yf}9|7Et&^IZdtA23KMgj00T2(6s
z`Ip8=;()Bv0V?STgL}#!Rt8w9NmXU{I8mIKl?o8JfTKMJk&J>8&!ZgtC`K;^xJJDh
z?QZbSmL~e=Jj*LK-aPH>;GykE?XtHJtv{}Ch~1;mMh85JSiC;^3~!EaXMLFLeE3VF
z`Xq~o@W7jTFLeR3o-SxsKMTBOw0UFfcThneBB2G!{Pq<7AK%-cCH-?Iyc#mttuwbL
zXfjziwUVdu2FlfRdwxQ*kgP&#!{h}(#jfJPN3s>NCA~FKlQ(s}A>pD!!75#5vkZo3
zK88Rkguo)<e#H4U$mD1kYHj_*9zYiC@WBAS<^dmmAhyO1tm5d<g|J}6o(APS_o|84
zeXe}JyuK->l!(|Lj4<(n4&yc_lM2!K@Uh*TE<{i!ft$w7LfZGF<Z~fg@^#v=j1ERl
ze&!r<XW{MbhO8|E2?FkLGKoN4cVs~LP+%zkWVZTVfJG88dZh-r^-b@1&uT$V`L=(L
zfB?Emvulo~op`mx3&jcUdX8hw?BCUgd${(Gaw$oU6P)Dt2tR&XJ?;|h=K`FXdH(nN
z_cfv=_&5Y94G!;@qwumg1ghX+WOomn4snX$kP3=hH*A!?&Xbz-Ae7KNluv%C!s{`c
z6g+j>8wc8ok4Mc7JO?Pp2+HBt9bKJP)PTpNuY{h=uuVM$|9C5o-Qzyxkurimc3&sg
zrKbi;V+^m&pC`_ZR1ZIM&#hH6>)o}>aT&9>kgCy+FYL{}VeSsB9UPoDd{k`~&4xq1
zIdRT01dZRWk#kJw(>>*&2J!uoQ)4am9wiS*SHJFI-P2vJsmJC{Im2_7aI`6RbOKr)
zTr{rBHY>|q>U;Nr9NZ-_Vg3mREHjuH0wrTxql@SDMkvh7sXI%4?{#t)o(azx_ZDR?
z_?3$cx9T3%Gi36pXv!*BKWLPzVr3Jy!^$bSGL{yCH5(nzFgUmWoOB`s^-V~Zn)Tn4
ze7VElXurW*QnC`X2VD`Rwz$|cCjuqj`Dl`Vw#jPc1oAGWZ(Y)(V=1aZ_?~aGA6$z?
z3C8(z16bl#e58Y7aO{2#Zf)se^@V~H&&V}^y}f6c1&^gid3FHw3#+dJ&5c#pM&`>~
z8OdRI6W?|wv^q9;qKRQfqG$2R-aN(o^y1%ytyE9wn}2<2ONL;&AgS9#p8?>hCmzys
zi7c0dk1O;)64iDx8l$KYhpgs2(kl-4T+L3JEhyy&YS;8e_l!SN8CFIWMYj+a{pbbM
z8ZykO)zwySOw}_MiQ;ZCb=n*Q_rg#0EMskLZ=9=tsM>=dcr+LbYOTv;)r!87*OIS?
zv%2;qhSIP!qA~QW9UEBI+yU8FsBO@i=k@j0%DPT@4$8yv<!GCu%#E_Fc*CEQ5eLg{
zbj#N72>Ry_X)lt#XV}|TN+;6!-lGVvKD+d=CO)^Z_F=o2V69|E-BT7}!qk|eA_neC
zcKAJsRhK{23##ncc?MR06;!GJeyYKv_;Ptm6xOJ7t^X1w9npSiP!HTOr37OVnR^i-
zuw`8-T8_<@^~_u9!(?Qf?_dejVX$Ou6N;&;_wI|*vTPeE8-=BscAVj!w#YUvedBae
zK64#Zv^CGkI^b7+fph&CR1)f%IeI5TWI~g3?(8Q||4JmYLQnM|iY&xaR@ysrJbb4T
z#3GxRejpw#(NF0KMGXwKF^N#=#r6L9la2O;RXxag46Z?SA-&V>gTguH20BuSWlF<p
zK`DX{&o5slA4$ExH`=09b+k_~-f$EiyL#+<_%>yPk*4*z^rU><;P{VK#Q{plrdar<
zEHAfaQZge>IDvS!oriAq2zAVBL1<1mFwC&V6v17^;HlEIRaij2`NiXnOf8+ho6@EY
zS@paGl4h$?ranI6CYy9vYNa?E1`#F2QAu+%j&+9ip(LqcH&AOolr^uyVhOa2>9&F;
zK5xyg=Id*<NmNr__WsDbPV@X|pmA~BMzE_Yh4zHlHJcEVV`g)>bbQ^oBw5<iE?tsz
zz2$3SL0f<|f)}t^0cC{Hh-lu~zj}mwcnX!Gf}x&bo%NSYO1q!iiJ5ZNI0Zj?m0)dM
zVNR8hU0jd><%AMB&DQ>c3R%5TjH9M^hE|+&BboWJNR8NYwddQe=<!a8RNi{gEPjhv
zTeikXI#=yc%|g-SO3CD&Qe92&X|s?<lF4E<8k{+MO%-6NLY-fH(o{`|U0#J_YVkGt
zr5em3MtbToA&x+I=BQku$I&uISG)$NG>N?{JU>Z=IJvkbT+~4NT!s&ifIQG0qdp!7
z{`k;j*^`X107r*FADTWyG^l{lw;E}#8QQ}XUDE{iwg-{HAS;TNmS{jk1Ufp^$NQ}!
z^8oQjg@d++d&IPObnxmjDgp-%!*AcwD<rG$g3Tn*>xq<lkgx(gKlw2U@l*tYD<js!
zDT5f0geam08~(~O1}G6lbex%as#@u#{gSB1BpJ1@>{meLh-~bhGMLNuA2t{|FO5r(
zrGfaKphW`#_s<s~6;N{1X#0oc2O|V@oG4?ErsH$a0rsGXgGxlxO*%L!VQt>!;QshM
z()9H@A}NfkeSGX8M-t1Quk;ArO+TFwWEfQDSVUU*_Mq2aqcdTNHYGCdE?Fr!iWq_T
z%+HNW8ML=7pk#(O9*nrpZYY_kQ59HmlRRB#-Tnu%-fDNi)d@|b5X%g&00oDdcZ)AV
z#|2HFR`FUK4;8l5-x>u0K|rlhV<h=?rn+h~sVt3O(yWb{uBSykxvyrULTJZa>2GZ*
zwQ4=yNtbM0&x5nKjY3&zzUt4O#RBX`Qgp4FveSyE33h7A6%f26+sC+hQ=OYH{$G*9
zm?QKSrEq!xtSI;vM9;@+fsA#8UP~iBcBF=v@a1FP)nqDFsO|cVEP2Zvd=8`rgx<0q
zKX+cbd|kmMbu~doOW)*0)aFt#`xCyppw)0}mY#}EM7mt!A;aqW&P)xnGRCW4SO{S8
zrEvFfAs*DZ2R10+Wl&%~Ho!0JC}LCj+vY$0wlJ6g!TNzzoa@SQWWu@O80|gCh0*-l
zx<=31x>59*OT9nUkW!^l3rRivP){+5c=DLRT>YwtV}my8O@T^_DV2tP#M_vC)bRA<
z3j5J-mo_TuOad^)c*>+i^7^21-7#893x>W<-{fK=SNfPxl1>Co;b~GlH`)j@U%hC0
zXlgP5bw6*k4L*keYn{LF%fwQuA6)AYYGzQkEaxVA*=}?}<8@>PiToEy&T}sj=+#Ky
z0;Le~*@7O<+Y>hjHBVPL%S<3tD^nbB{v{04^!GLL`gOow)YmGT6~bqwZo-Oycn7x+
zZ!m)4-fJn|NHjT^I8Lq<S*&tQ;u}RVF=jqsRG7X*I9ehgmcl2-u_H@=19iT1eG>~(
zFou(>`dBM4eK~p?F;!p^D#7|bcd{9<?M_N~wPmlGj5omY8)uYk_tYEYCjAvW>^sbx
z&7mY{I&z(!PDOVqQy-!F&y)j&zBH2S)Qh94-OEy|xz%2?m`tIoX>V2GI^shYifMgd
zo-|)Ae1>#bK9Z*=nKIWN2DD}%upMR)iLa-Da!B0_d`7t|NuVGQ79(m&%;UFp67EWC
z<i*%G>{0lF?}*Y?Y%TM1UrWNb2jq#wQzwJD0l{gsEhBAr-y64JU(6OVcX0ZxDqpGM
zGK9$KjCxRjo2=+i-Zlo;oh@zT^z%5r!oYwN2iv0^``qh+kNX!WZK)e=3jCalkqO;Z
zJzAV4SajoJoNP*4p}(;jRgNes#%Wr$lxcrlVS5M)c3<cet-BT#29Ic(K+?reFk{F;
zH&TXcQv_N#l}29Fz*M7!3k}heI2iX3&%5M_01{^IzsGNBoxxo!BA{3nZ)CvAny6J%
z@|tLSL`-P=#v_^ei(TvjXaCRgBh>(6qzTCHs|%%XWY&>wx)69Fs9NgsX#+F3#_P>5
zCK>Ycl@mkZ0*R7_5??2}lZ}uphVnzGBAQ|EDC5i`mbsN>JKP(M=*Tvj<bLQ%&&e4(
z&t9X!FeD_Y)KFrtr2o{HcA^B<sw72bL{Y`piU}zKb><R{S+wGn&fTjHaHimNZ=bR4
zr&NRF@0cZ=ZRUpk)h=94*3wrF=9u=sOtWZgo_c1Y%cGI#3SCK*9+79V$wI71ump}6
z%*iCg^jv!?m1^i3YV5f#^w+9LV&90z(vt?4dqPH=#B&;H@-{N>FA4(*zd2AX+;+@$
z9X-a416k)Xv~I07N4a8%k6!R2dteY+WRW6myVLhNb~iYELcj8`_O_vzel~ca@w`Yy
zE6mY)HXhp6oZcuT8fO&L9zu-9B!a)wx<dxvA3;W8`2F%<Ofe2-e2;(g=-GVaw$Ju@
zCwOjZx|P2dVBWl-apeJ&q&N&s(>)HJM8*2PNL@#zUb5Y6Y~fG9D{vz1ur}ZS5=VkT
ze(7I@QOTiKe5P7#V|`q8+X%}cx}NrHbOK$V*8SI<Ssf3HEhwonOB3v2ILxGVk~N&*
z9fonpYfD_Nv(l%Cc9?0`n+>GI0pZhtAm2igVaCV;UfJg8F@RS?98I^vXg>6f@3_c2
zOH}9YTO#+#FNqP-l%Mm8Q9ZZtsR|eYPuNUXaN=J<E={((0l!$v0|NU!kqCGs{K~@U
zbw_i^h^4v{1T7$P1`#V%qn`<XnKHmRi!Y9@9+%a7k1H@P%t+4kNhm?j|2F`tKvlm?
z&BV4&Of0*y?Jy>rs%_qffBTBPtD`@iS*wUHYnx)LH_mJB%nwCuknT#JBug@uh%95x
zQ50;us*0ujN0!<-I&5hHrf9Fce17xUO{*pX;;>-44RqbMku}`ddw%kf{XX$Q4bVDF
zk$1SZvj{LiFi#SEWWtxWRBL>0C%kdq=oRzGB!EM}y$E(Blfj$$e~P38_UiNJe?u1n
z-C0<;d0aafx-Z0ricin8cOxyoO<2IM_KR%M(H{de+m;`IL3O6BSNTl}VPMHc5B>3_
z9ogrw@Vxo03w}+njY8)z_JbhV#XB%_j*wXKs2!qmcIzlhZXM-5o(1)8o`u%0LE%6I
zSpXeSlb)gx_yYM5e=E$YfEHDs0RHhSKhFJNz?<N0=m0-CpZ1T$!>=Rq?GS>Xla!3c
z1N4crF~G4WgTi@7_+Sjshj{poU9;dU3Vipr{5${t*M!BD54Z!vUl@4EWX>$}z7H2Y
z3<vWgbNw-R%k%NSpfqMlQb~hIhQpcp^ChWFCU^4q#FI##f99|qgZ%S1In$SY#odF#
zC>0(;m1*}mXE!}{;m(tN23HL)Grb(>pZpLVW*#uW*CqZagZ>a#&pC5Hj1!K);Y8mq
zdi~1a00p8PSY<Tml1%&GY`J3rJh80n%%g{Q97gG~!QIQ!osY?A!2~$<!}nRQcRMoP
z@_OWUS~s$4e*@DeuMb{Xm2YRyVP#N11(AC-a|$*%0$UjqcavLVM6;_@xi7}F?z)`!
zHk)xX`^X`DGP)5c8W+7OG@$n+_!}8l1}iGUAVsx2bM)U{oL%(#1A*+ayoxx3c?F=?
z<>fiWi{j;slZi7k<(EM;p)bbcVy3wtn8+V1yay`|f0iG~4KE5TS^xMWbEB9-r!c0M
zpBhyv(M7UwMqa;I<d0(fiaoQaFX(8=bUAQI*>VLth!X`Ln^<{2;4AoR5-({E2(fH!
zY7O(ZqsXoc&ra$5#=kC0S6-9_74j05I^v>VRQ~-``}y6xs5Jk+Qa-y07Zr!E%hLJn
zw4gNqf4VGPUK<O_X9da{`JrA=UVv~FrHf-#6d%({Y4LSgymF}OE93>rD&?`NuaSLU
zRuDv46o&IvmVQAiODX7WLCIf}Sd`?*T{AdD5jsWk071+o_d^u~nDJ|wry0C6FL_4n
z(~JTKHLWO>R{o#=Q~XbmAG}(;-c(BkY1TESf7UcM-6&|%;ML0>{z|(*!gXzG4cpAv
zjY^Ax%<J0J8@4G}fJ&46DAcuR)U;T<Fv35+aDc70D2_{Ai)KxWa0Q(RT(s=mRNKmr
zQeA6SO>5$$%@d0_Vs)+9l~&+QEYYt1_TmhEWTWVMhFr4q`KR*a{i!%Hbv?*Z%|Lm>
ze~f}uF!f5#c2nP?yu8KABU-jsTm!W&D$83epV_j(rE{(xo5~h{<SA9A_ZTjhKk>Vv
zwxznmk~afG;|))35L`&LP3bF|f`Lx81cS;1#VAgpNQ6l4S)H*EpD%jfgVMW@EWZ>U
z<)WF=ot$4i10>Hlk_!|uUU*Q`Tw^ggf5Q}O>dUuXEU>MhfNkhuy*BdK+L&MMRFgA4
zU+v)mHpu9^sf*WA=P1>S+oiDHjTUvI-QeeMgY8i7b~`G*cFsD$4qM&Mc2nQXy=`qL
z_f34-HuYxv<Ds99>YMZ+4~fXr+m>Y3b4JbFP}e~gS#m0s2XQLz^-#8ltlLtYf630y
zchjN`p&|d+oeO0HPrAHf6y_${-~7aP{J>9dTUe6{=YU@}GLZM&Xf!6VpLr|!$?M-I
zB={6HXI2ZNCudT3U~SAjbj2Y-G6Dv-y{S=>^o6EINzyw2m4}$TRk;fUmCalpx3{EO
z8>yd)3tuP)*9kvuzd7Qk{p-}qf2h8V-P($=z25M?zJ)#0k}NfSqZPJq)WBGOR9M(&
z3+Kw5%nCj=EaCT(EKxZBu-3x0RK@HXqJ8T??F-d4-2G>rrZxj@-wJfQ_*paFX)6ka
ztp@dNGqi7kJoS;$wZgjA4DDLGS}Wl6te^Fc?)oTKl}6G)Tmb7n0d>@vf8BIz2js7>
zdE5mpa^4-_oY+sK3W2!^adUUbPwX2kdhbDy^*S^Pj}rq4jKsHFC$f#MylE0s?w`hl
z@@HLQ-&{xgn8|(J-Q7lL^cJ8}wi6@0RiK6K!=^lx>uffFam{7~%ie=@V{1YeY=m-I
zX-9;to#%wXjmhicDL`{Ye;6G{jD{w8nA^`WxdpA=T6=Xz9F==X;&fw{>f4KNezM^M
z)pNlElYK}pS<H1HU>LZgRTz=+#%mBn?%U9dU=`kx^j)-`$d?_I%4jxPQ)uhOa2PWY
zy2sJ;C!;kR3)ql_^gT;s-`#XzqOGkB4U|r^aP8~f4w+u5cgaXPe<I_xuLXVwY-@%Y
zFh8GTk#b-&b}*aY*_LF^{R9D<Q}wqBH=I)STN<;dAvxHzRTFE5r(;L)G)!co5$Z{X
zYkRviTYuRxT*;JvZXL)H!Wfk_1KW(~Sko;PJGNn9Q&B9<v~AOKn*`&wok6GDZ>ig#
zb=B?k`}d~bUlyjbe^mFsAZX^G@E<;SXx4#w2lCD`a5t8LPN}+leLAJ;qMuHw`nZ*<
z8{x(B#yY)fwh*0Obt#>6deu&^y0?1O2c@L|*ifQK64ou-!<tJBOjOsyo-E6fXK0$M
z*=@BHEywb-UAaz9I4GUi$&5`;Sds;NXPK5tjJPtgwJx#Ie|^bsLOh*?-#9$T#(K~|
zM6DGBSIdFIFAUX&{&ucnOGvpB2-|Y&olD4LmtNL%yXd?piuLTgCpIIB&U<3j0zDxv
ze<q?!RgW9O-7b|Cw6$dg$+k2q=??a&;$qEWGPYFR!<tMyS0{>UHNupy{&cd!PGtpw
zShN3<!WvM1e_OG4ZA0A1M&1b<iwU?BHkussPS|)l!bTMHsIgAo=)AS(e>!jN&Rct9
zns@~AhRdizC0)a&L1nB-)WbxR6)ZWfWe~$vRn_R^jr+DuIJZ+G2M4s=Z;9jd6dk}Y
z5B5ut5Ky3<9I==%J2|4s@$KY@rz1z)vLJ|VIys_~e<NysIys_~BQ~aqM<7SYnx-2>
zqS(`ki#3Btm`IX|T~l#QSCd@bdXSM=YbH%zkVe;DBZiA=%&;v>$DZscSaTHzTe_=Y
z*|LaXN)~lBr;Fjbe|$F71#RsoC>xhA+ht#xlRf8R!`fv#+N;Q~)q?Zlloy@kyqHKk
z$+^i<f9@pbhafq(Me(jQ(7F5NE75@^E&S=k=1y#WJYw@YZ3y8`wKXa;s$o;IY^*7^
zj2+jKuxHzv#Z-qGqzetYQ-R{nne?`DOpOq;MHxjjvI}cmUDmr!oLEevojB3tAa~-#
z(=o&iV{&`fX1Fwpg47>x0ev-Vsd#h}<YZZOf4w*wA%_9b4lOh<4s*#QVUU9gZcezo
z#pM}YvpDuCWl3j}>`an%wB7;Hc0jb7(!?W>tz5+>iegyUFu}Fa)-6nIqGH1~R7;ag
z-L{&8ABvwYlxiyod)tE7tFzQR7$eJc-tJBkT1-%#B-G^Cb&}AM_2?v_b)T?eJv+Fx
zf2GUQ!KHO@X>&x;0V&)Y_ix!mQiy9}+myi}(NwVG=@c89DcP=O+IsuIrpM=yXszLp
zXc{szHL797v>Db6-NO#iOsq4;T+Q_)ohqF};{7`$o<&KDbBPK4?Zp}T$VSn12QPnj
zhDF$dd<W(QVIjqSWXU8*g|vG<ab1=qe>qZLwHQ!^D3pP8z>cmB=~qoAEXV>>&bMf;
z?M^OTyw{yv+T=uZa_Q5NOFMkOE<0lVPiK_sj8YrZ#3L|DIg()*hT~#`xf0fFW@4hM
z3N}rqm=;x3MQR-<*I|M01z*lV>UP4FS6c4)@x^=G@#9VIp^hJaI{bJCf!D?0e=Pjz
zSn`e~-<T#I0ZVRp4sj*f!IG;fSTm@LEtgo>u$W@$x~&pT?^yB&sVWD!x1Dh0Wy2jq
zzIcZ_hP=r+=os>+!;p7aavejy@TX(QJBEB?ns@{Zx#>{FB&vfQCaaJyQ^K}wXjt+r
zQ}HataN0BE`{25juMn`hMJU4>e-2n0RU}ol8P*k9#~Py^wry%)Q?Xp)%9cvy=B{nc
zXVBsW&9jHLdcN0999or0eu+}%MA6mH_vnD-r)&fl+2<}r>*g@%X%z-NX5%OZ40Puf
zO&};1VuBWy;Nh|fpniKKNEjMNiJ$t{3_@weCm|aW{s}D*&f<&kWe`p1e~a<B1{LBX
zbEBA^qQfzX6ZZA*NfaJ_BsaX|E0U6a|5y|O5}K-cK5<5V0%Urgl9ZvPZOjxNlz+bz
zM+BNbO`{}@{cw2LsHIBHDX0fAUJ#cRo3H1r49%CZG9vgbO#!`u7q1`NDY&Wm!M5b?
z*-h=l?q!Fn6T6#S)1BD8f8SzvMQRSCu*>7rfgRNSbTV@%Gw*@S+%61f`x3KeOCC`P
zW{PEE&2v@kNQ#av(^MRrQOA(v&V+RjS)4lYC1tIo4Zu1oMT+gq572&QH0&&QiwV0E
zA(|ZjPJ~#p9-Ro$Ato$6Jsn~~hnO%&6i*j1VJjkpvc3pGJVjBce~Ue8YFLw)i!I`q
z*wkbuo3<;N&Vx+gl&?_E1g>Fkvt(Unil$)MRVA$Hx`YX{U2LhItlLZ`n%=_R)~sNo
z<!H7LU{|9)u-PQ|%};#C5B&7Dxo)mECNUYYl*PZ~2Fy6h>?ObX?5638_S|SRCb6Fg
z*~?E}|2`qXr>JrLe`^v<c>kaLpdtEc!xakWCWbKLy`byHGt8((cO_4fB^66Vma*n2
z3btKU#ZvwwOKO9$HyL@O4J>T2jfth55w-_*Cz$wm-=X(l*?y6xgyY(BS?jqI{|M3+
z{5v}Obji5oE<qzGnv!_PGRe#rNPohThf)p>m>}ZDQIa4Mf8-w_m`;KYM*^u}fW{CU
z<%h!omnV}k8TFALqV$rXgasmJ@|eYbM32$SD0Eqv#soeTodfD_<ROAQc7yzo`qw_4
zkRU;Rf(QTzM&S@8{xBo~lmmcXhd~3#C8II%hhcJjbOf`6e@90k;f_Wuq>yl!lhU)J
zBXkz~QS7IFf5Kp3NxleP6r+T>lh{vh5rO%HEJ;ur6F=lrO8wzw%3?Gw33D6;zU#vh
zKyCJojK%?P6`iNC@1|%RvxKF6u^w&^fuVF1g?<`=wGd$_dy4?&;WnDY=+YlvvLwZ^
zpIo6ai^c&v-o@Es-<XT8$rw2#3|ZXjOvxV8RM~T|f9u)?)|e$@M>aI95}Bx$qB4g$
z_i?7wU7e}TbW{uUQpqIthznY&U7kX50)aMbj^F?#5jtn?hjD^j5~A_cxtONK%3(Z4
z=l;kKNQ}}55x_v1x@gWg)n4@YWqn+m8NES%g#}p@sxYN9+9>!F*8B5;&^L*q$-x&?
zXs8Bxf0-OvCHuzrstuz{l9b3U7rnBY2>nD$tMM|`O58hrMJ165y{z;3;2lX)bk11F
z$3F#k+RsZlx9IZ$-0KHlPHVAK#R{d-7|D_-J+m~Tz&MWn&fK(UY%pJNkT2OlEW&_K
zYcM^~#wQ~2|Iz%wLix++=0!+?+thcHcCuP8fAvR<J41X+-^9`AEN7nt>oQ^=NjPNf
z&T{UOMCdgMT}J;5+Zqm=vra-K{SN|k4-K_)Z0ZeTpPsX{wYjP1`9a!V)-4rDE&Zt4
z`Hi_zFd2pKN$PR|EF-s;-d<Imm%2{XwQc293%LWFaZAxJ6F^_`Rp4T1w#6c!uRi|P
ze@fnKCjoD$9P3R&AF9b_+evTWf8I;dTLG;`nd^^8u!gX`C8bv@(Yi(9Hk-K7VdGbN
zchtJ0wt!r^qqeo925eJz(z=t@owQw_v?&RuJ96ETd%8!iY0-vepFg%~4w<&QfmLx$
zO=b%rTI_jy8M-$j@sI}~_hf1Ot+B*De<qaXq8!xQ;`#}dtU^6%%Z`j4i>g>7rh*Ca
zG)z>9$d+X|jGB+t%<(D@7eZ+ao@bDf4}sPPVZ<ZIgf8{pevU~v2?%KS{}A?%kBn>Q
z!*tp;aFG2~#32=*@Gz&OaEME|QlIcdfI>xE{jMBGuA&5mKPXlyNeQT6r^kf+e=ue7
zH3^Q6cA@bH1sK9e)>`TMDRmr5n1>w|4ABa)u%*Z@Ha(Y`jOnV=C?)a}*Yz*(L0wL0
zgH5Q55<lR{j02XUVN61FI!$dq<X?{b5Y(XP6s1w(l7PgA6@5Lbx_gfNu%d<Tmramw
zjhmQKWS31OF7do5py(9EppZpHf1xZPrym|>BOUPh^uhSRKNX$lpC&0A^Iwam9g?tr
z<=X&y^pwRu=w4ZMh}%n6wr;NJs)?g+c_z-x=vT%?qK1KygZiLBv6)*AX)Gu74>E>*
zL8oXb-q3w+$>zYLJWcGfd;xU@N-!h7Sd%adggq>d$bUzFkNgl_`5`?Gf0&m>6EI32
zmUP}Mf%%*xcWEbs)hG|(DL-eG<>Du;kD{<rsI($g3YN{1fF&+F<R1)>)F0G1h-X79
zvhWFW*c$VmwXYo>@J%`B@6((!cX+|QfO|qBENfexcSdb{Kl2$|>sICt2WjsoUN!t~
z?S!W>!BITi&oiD4Zu3)Ke>e9JlXP#dw|s1y&wPPD#Qse=BlsIXz03}1<5>g8v*?MP
z4NKbFiPywBHJpCVAMNkV3iL(Jt88Ic*MYXkc`5+6*yFXDN6hHA^_7u2Ul}2l2Y$%h
zOA@EeJ)NQSS`IVcUVQVD+);>=Ky&4AFJZCIl6S;mL8bGZ`Ok>%e{!erI*z)f4J3e(
zLt7iQ!sA6ml0(MA-aa@#)UDL~OSSH5ZQN3^VlktyNPM-2Yqm&s*~Xf!(@=HEeu}|M
z`(Z5FdQNV&%eG!q)rH%`C99Vi*1yL#YG?W;dpIX^4Udyr3R|O{%94@WJzT9?!ED{N
z+N_y*>e^EZTOtN*e@JD2dvS*8y2~b#t2~S~n-L1vT{fs(wze771@LJ81b)j8X!V3J
zweFO`OS>(-JZ49VJZf2fqCOOk>oAXK7WQ;q#hPMEn7E#Y6~mTY;#s!E$Yb@P_=!-6
zbM!plMTg(_5uOnpSGrPgV|QHoQ#ex%LaZjMuo77$TOWxae`E;%j55pjRLEO0C{;Ri
ziN{1~4L{zk^Mu~Yc|w&;Lv~yjJ2KI+rZWXwu0*h+sFvk9jwc&#=RDEEd16acHSau;
z%sWqP7`a%gBKh;hYs@Gmi)g?6=O;qv%lY2n0)0Q%YR+gfr_RSTBG*rZe*GjC@9P<h
zA@rII+1LD_e}lcBMiVDshaB<aaC$T+<<~P4>Z2nhOVR)-{j9?p#p&k*xMH&I(f2&4
zaruCDrXVH5Va%bX`R&)mAkOJk_mL^lo+wkIOO~V>#KP1zY^-Unf*pk_*fkVt!;fq?
za_n4HWCg>zYRqeFbg{*pu|OET21nis=0|2vS=mnOe=Tpl*>l^xx&}ln{}jcv2)EsE
zeFZfzgHgtqgQ-gy)?_MS%W_R@o6Iv!Rg+X_IkM>Tepakp<2({=c+m~>MXZ}6qD@|i
z{o>Z2^BE#e^`{rT8#r>$WJ&t|2jp;q!)_D=WSp>P`7il5&j7mnhZ58aN=EUs?<7f8
z4daK4e;&t%d7cW4nCB@idIA0ylfWN_&%l~H-5~O!Fvai;KU1Xfx9sm51}cSTP884|
zL_ar|e#(Bx2K@a+@5h%gJ|~L#TU<T*;0`#6Iikb!laz|#oaEy=;VV$!*u3`v4<qs*
zi;D+PFEPiv_yBwbL#m<Ycr6Jki+*BcB;2>%f9fCxD2!4Rg~6?06^{{TM3az=lglVY
zaIBN8a)!MDAs^R(7?Xo+WbihtKxjTPz{e0wC!@a0QE-lqMBD#DM&lpQ)cPD9L4*VE
z#UG7XoJ3(Z<PiZ3nrM=sUq8M}1_<yvZc)OQLd?<gIVg>Q5Aj1Wf!*QCh$USIT1KU&
ze?<&Jur5;#k_|c7R;i2?gL<B2c+@cNC63_%xSRi(5ehuq9Fd<)lXw-qXv6@dNFW~p
zA;RuWcn%gJzT6IkWHn|nE@bUwOyVo(DFOHxs5aexj!DCVF?_)6N_@Dn;H;ow0EijK
zDD&PG<OyWUA&|JhlS%s2Pf|a0^I42Ue}&^_KJ9GATRQ7bNOGkYvP;-fx9WwyDtt_D
ztH&_6xLouqe(@8(ejLBX!Q0S_%90azb|AmT!OOsRuVx1F*C@UUB0?*}$oyj}L-a#*
zc+un4e+nW1<+<n$ra$=U_7e+9n4STC)$K*E;%n}W+?lbw@dNfgzhpA+8yNqBe^C_#
zm<_K#<H$U!cWa_TEasI8=WcLnt3#CLG*J-IxeHef%o2Uzp6~Jied6?22}$7Hj>r|m
zLcNU6EB-;0d4&6UBWc<VsE8-1I0T*dGj}K6<oZ5&OQt5;C}vpBOj$IuRm0fs%;Ds$
zIkl-{Q$}x9=BU=pQFOTF?VI=;e^VmAyUs7Ux+#BI%b93(yTyCm?o8nRXuTc9kw*Mx
zNKkoMWW(2MhA+C>?(pHtS(BRJZmPKejGB>)UUo6^EnflU##H85&dppnx4XInG8JbO
zr=Ws_QIW)**8OGk$y_G05qAJ#>jH#vjMe6lXY1&|c*QgjU}<d=KhA<Le>7CyY!2Yx
z+z8zR$#pA}<0QTQ)LNzC+z6H|%a+|#HNF7JY&RYO8)1&Ei8!`C-q^+{5!=Ct*ahfA
zixZSEK(8k8?N*Lat0!UZ7%98BBIeY#EvgDLRF6#3sP_QfKdPFW7SGM2v$&|TsT0O@
ztQ%CpnhT&Bva4cKcbH+Rf6VYa=P_AaW|Xi(^V%6*Dg<FWlC8)d_FU#+&Gs~GQC-0j
zb*b#Bs-)@538FK)<OJ9mUGCrL@_NMJ;vMG5Xw8f)&&S2E%8q4Y{0%1XSI`lUqL`s1
z0_gEHvt|$q>TSZsO;AyW+}<Iq5G)^t7qj0dEKGx2US=G#YZCCke+S4<4-(`8B)Llh
z4*0<kw|=D&`hDWNSHUgvDFY`NQ9EYDO}X0-$Mw%TJAQsLE@tw1=~SLOKmLFJ$N&Dn
z{@?%mf4<1=I%jbN_LFDA>nB%l2PCA4OUCT^iSr}0|K;#9O~=WzlaoA$!0{+ogdV%m
z=tNW`IgGV>;>ni5e>6wJibdgKu?e;%nPJz^Ov7>vDpB_YT$R93^j`#cb8?!JVe-AA
ztFL&Vj2{mBo6YLQB#l7XOOZ24K&uaX0~4LHG8Oq10GcL2kc1=%SbzxMLy_oR>>s&}
zqaZ-k&rBOAn8Ykuf0b0`=&EX3*s>LhHN)01(QFedI+cj7f6122SgR%Y6h%Qf{qvNO
z;N|+m)2OAIuB>30IvUn&*TR-&7+8^Q*|w-AIkwYkcpuK+{_?3D-><*Clx1B$`S~(R
z(wo@l`6sfSFE^#kp7Ar^JK}QH&IZfw$i!qiGqL7qD%MQh!j>iJ*fV8~$f_(GGTD&w
zUWaacI|j<je~de`^8t@i082_zlCl%e4@v0yV1Z(88pRt-&d_CQ7&gJ0smOq8<zUCL
z4XjHxvo%L|JZkrgt1ru$@|>W{n0cocy}Y|&G}DoH6ZqlP$$x?W_vxvkDyl837rksg
zrx(4iPC&w|i(cK5X>g5a{OvPfZjrdz7aHtQ^@^W<e;qPcfS6E!l04JJW{BDR2x)>K
zdjxks6qh~W-|f<KR=P8BLRv?bkhU*KNUmwg%+fLOfYM}QVB7Uf?5K`o6UnAJl^&BI
zG0RwVGDJxWnrB&-K~-#73c;EyYnV8uhly%BRFxE_D$Db^buvUwdz}n%|1w1BVgl|}
z=kV%ge@^k}XOglTa*NJb%(Zo)+t7_`DI4)CchDbAg4BonTGuS3kZwz$BIYT(#&JX^
z;N}Inj3UqDP9(sEf`?UZWj;oKj&9gBz$-$&EeI8e*(D1T@Ooh(#c71WwnoO|I3n)l
zfByS_Bx4dn0x&L{fUp5hS4E2hG!{CO0rJCZf0m@a@GT#pm?h&VOqc+2<k+EkF0udo
z_y2(0WiU8I&?NLdALJ#7Q1Cox_Zr6Rv5*Tf1Rxeu_mU+57{|W3j8Ty{ih+|Gac?0M
zBJqQW(fZv;qF^GX-#`?y3fAo%BXP(jyLn#g=H_OG`(YuTBn1z4;snv~M3EHZL^4if
zfBmE=jQPxfJ>eUO^BUM;p?f(Z@s%GA@fEwpewY9)CKxavaTGFq%SenP4?~>BNgvJe
zXe)TpKl{T=oWS-2!Az&s0(6<o_edT{l9VOo%G{+GMHszdPCOy;?SKCJ|9UZw{Q$xA
z&|!@S;tXk4XV%Zxa+mB@!_=eM^JHtTe<f+2jTOs~Fi4-+VY-byN0o`@d5UsB@WFfU
zb_Zn0ud&0oA!Xm5`C#gXxYcI@I&*-2gEX1&xe%7}kRKU9D;M~yf~8-!wIV!7fwJ%Y
z5pzkB!k3z96<@0G<yjm>-dW^_;%iGSzSiLDKSy!MQhqV`=`9qo<g$nkMYt`7f73DV
zUDoB|djr0I8%N<;6!Z3F#ViMB!nZ$>I416d68^Pr>BZL;eEr6c+3Q;dUn;U>!gsTo
z$1-rd^2Fpf)<q9Og<wesP-^-B&m7$oB>zR6T2YIyz37O)dOQVMt2Q#XhMmPCRg#mn
zGSt(F(AU2Q5y>(%p31bL(dlWVe>%I5oMj70c!S&%^4;bzTb6@NlfG}4fowN!0~>8n
z!;}AXl7+0}A0m7ixCLHno$zfLg&A!rtjlrNV8tg1<MC8tkynSJ&8_l%`=@+q?t>9W
zH}CwB@C<5B)ID%y{ONX=4+SVK{=#l|cL%`~K4g9?^5XzBnZqS{s=y>nf7d*!I~2<%
zQ?Mpc7hASTu|-tJQDj**yyeQn2c}3qfBkb+ebniZOHz<Mm6%L%uta1JYnDT>O^J$`
zsjD*8CCOH;PLF&)0l;F1h@+Z1X!=zTR4J08VOuo~EO|09sb&&aRvX@9?IMb2H9%Iw
zUb;x+i{6jtDY->2CvnWef3%^xI@379KMZlZ!Y!o8QjQJ_?aqID^|60+g#Pp2{{w-_
zcYsnJdWVxSbA5nA$y`bx!ZHZ_Aq!oWd9%z04kyphycs$GEp4qXwotTwqj6>h$AuZZ
z&Mf^Sxgy7-WY%Jy8;D_|rLr?uC_&uNFq>du!RM|Dcrq5AKiLcce;ta%?q%I9n(32k
z2R&VFszUw97X^xcV(uk+8I4BZUVe+5a$cEj0Zqn~q?tRD@OlBmz;NPIc&h5=l`{9z
z&6}K=A-G8mqxiN?H||BC=!T(T)zHQ4i(+{xFN#GO)zG0t?ea{|s=6ZYU@j^07y$zY
z4-H?rNZEp{MTV96e=L|MzPTi6f<tywJC(m)5^xCvN3tekg}I`9vOGwyvS}V;6kIEg
zj_S58I|w5h6*ck-%MMOm`F8FVkBO11+^QWHR{`~5isI^qj$Nt%jEkp&M=`;Ysp`Zt
zOxIRdcmpi{a+$Q;W8Z)@&qz#0EYpoHQwS_3lvX4HEC%)AfB7Q8ZvY112Yw2&@DjeN
zH_iuHpnwu*84dLW=$oIRr1;6}-zOya6fLcD4F&=}{@xmEkkfpbfbv7;thr<@S_r32
zeVUs2F)f)$=I8DyuB(_Pwwa@1%`zw^vS(r2Bf4s8M5WfE))%$CaB{18+h%-eiD8)o
zpqGYulv|Gre>M%{{8x_Z0&pthIJ)*JfBHmW;KHKJe4D!^9vzkb14l<-MOw{Dh)`Ux
z(HG8*QJ4}x1YQmu9gVW#3eM>02y&yimw?xO?Z@C_J3z_!7K#kO=pU0XiAL~epF?u^
zA@b7%9UVdZ`Oy&+IXWU~O5Dp407e`gErxgb;~}3^e`S-Cn#)G&)(_|^jZtGQ(aK|L
z$(~|)o{JsBW>~Wg2@^whu}fUpB$BK!YHa(Ms+%6u_V)HFw9Q}6-sXTb;OH_1<_YLW
z)91c~vq@MWJU0X+QwC<kQ}1H&Q5Hy_g~S8H2Am-y?j?_bE3s}G;?9sD&uBS=+p;PZ
zV|^04e<EFEmJAa5fZ2cJ04+gLFHfEME^>vpzNicxe5+I)kzgK;f;UqI2FQ!71rER~
z_ooLt*Qc1mZh9?YX2!7}rUl@_%!ErshOEPx1Wx&DlILox0hY;EGed%C*j<J#QlF}H
zW)K`59)04nMityb+0r1+`OEbtjz+Jd5%I&>fBwbyNPJn3&(f^_e8X3*dPc_rxi_QU
z8Yq>Ls+u5CWB?QeAjQhC<J^m5nJt$`3Kz<r)xpA5PY+n|f(OsDOMQg&1*<Q_HT*Hw
zK$B>NAkh*vVojuo=I9X1#oKl$5Njbnv_pGn?*q`-YTpvcVWnQ6En-6pl!kW53~Qk=
zf2@zdutMST#|G5c9#LT}6onb&goi_tn=EZBEQhA}4GTx~bd)6<iC{Uqel_+Xp}RkR
zz@nHUxspMtigiiRvF0cawhf74&y!@u)2X6r>ee+T$`)m@R)EXxp_ZH3Sev3wZxeL-
z5rQe_5=*I#<Szp-yu$eQG9U@pD}n7Qe=iLeMnebyfrOm3?M7h|1->wbU9mh%2SlZC
z>{sGmiEx&0<AC^Kos<qLtSL#JBzZ7D1j97avU!mULF+>h5kab-P7lK&Xa~9R(G~Nb
znm*80ax8*iSKu|j^@>Sc!wU?`0sjit(~UyUk4Na7cnrNLb#UmA11h3XL|Gq@e{fj{
z3rhJUNDyQJCNQ2da!BY5(`a1u=8=&ffQam{Ai6o;n2DRwg{{o2P`I8*wremK@((bq
z5n^M9S`1q<m1Wmfm_xNYa6Q?@E%4oUrTTd0_*AkR2?_^X;&DK3A#Q5{#T9vJYN@^*
zg#!RN18ii1cyf*+VGR=jV1gxwe;zY6bAr5p42Kz&O>3Ex)!C8Sl25*DLNvc*1lX-+
z1jTI0F=frelvx_qbW_GQF(inORy@_Al1=IE2}<2jE`wHKMXNI(i8MylY)5nUj+(Sa
z|5%XLXr&^P42Lrq&{d^oH5JklmE}~q5ApCFyJmp^oJRiy>Yg0I1SS4xe-d!@L<VME
zSNfc}AI6X~*AKX2XeznUU)U`=1%}ck>ESOdy@}$h0=gGL5E2GeQoY(O8)&JWBJuF+
zh<vLiRyyL@mj1$SXUk^OEpd!nW}WA2&XZSG%0j$jsXl|<sCGH3w$ty6G*^qtR;SVL
zm+Dh7kH1HLh_3vQo&qZpe@y^h1ls6NDP0$)b*i5{30UH?!?`a9NSaaDl`|%Z+a#?@
z)A*{k`nhds>9!I(HLtOQ2cTin`*qUYZ<4FNsdx2sPR}{oXzXsiUjEJoZZ%&vRRit7
zt!52nz?v$7^%Von)dMYAjNI{G+Q$@78_qFvxzHsl5u##OvQ@0ff0B-gtV`Hc{(tt~
zMLBL8T^D^7jCRd(w^qaE{gRBQj_t%5@7Re}tjVcb@stV#!4{X<B!^^M?tRu&?RVI3
zxS!<I4}jOck*$_2wWum5QaA4S0sPnRS5#FcRC87B^muB7(JOf+HbLml&woh@E*F(S
zF;I7&a2|$3zcG@Bf6<D&#m?g}2Vn}NJMI#AbKOT?1P-OVj!U_)b{JW(;yM9|nG3PY
zoPjS!0Ze~RVjoOcEdCN^Ni4*>B7wR9kj7*Rlh_wn?VM}hP#t_h<0MMvAkIZe@|lnC
zbDZ47DCO!|cqB_l5Yn0{f@)A~&J%nP=#smJ5Ru-8P|9*He+z^33PTaujp8CpAOU8O
zk-W&36g)j;TBAV{%_e>`kT`ptCC%?l%;?h1Fo{Fem||;&gNaWJNT23n*QFFYn!!BF
zq(NZ2qr`D+iG$0zYtC8CqwqpfX%1&j2(GeVJV(ozpAWo@!+$P;pXDtbL5yiiC)Ex0
zL0kd+qIf1pfBozM$uZCHvm;6|veOHa<;*Xq{u0m~b9Mzc`J}rrl7C-(!R%|=(4>j4
z(aUyQ&r4abv4HIgkgDhz+?nN78Yc0x*|Wd@_P+T+DK%_OqfwJsHIO0^5FC@%7t`58
zm&oLvaAy<L6wpG*rpARc^xt)MtoF3q)wvJ{A8wc2e?+|@vf#$5`#O+mK$_B_bj#>U
zgzfo|oHjRX6cYPo@I4VBv2!mB7ZEe&_m>c7cQ=vtbvAq+3BQd-VfP6LyY9&fyUe4W
z6=*J2G>>7!_Z95fu7;`ax|(BB%{?sxQqC2e4cjZkdJ5){OS>OykLFgmK`xo!zBW*j
zmrOA*e=x~16%}E=+%6=?HF@QWGCw3YF(hjQ2*ke;`Wf)BXXv*ozySEmMN*U!B`UJy
zzeqeoA4NFA^aw_zjwVds8xg%`wKPxmn3$IC1k_Zq;^+!CEZfA6?Hkz90!8-&)%LvL
z5g(JwBo#LD&&)@{!MPzH?l>+#lv)aqF0)bse?p4{0$A%D0wOX~N|D@=zp{bCfjHVJ
zSa)A&V2nP96M`^$lccMYJt)4$bXU<mY`9=QR(yhqq1#yZEuwj<rZR1t_tm3+Pk_&9
zz9L*>(|JWoKY%`uNbBXOa0$wj1Eke>mBLu4J3;qYd%HX+qCa)ox2WPVj|SLvbO#$c
zf1u2JI>EZ)dlq$FLv!wdmpUciiH-V8V51t&W7Uf!HQycg8aNn@fKRTX+~ziMS8Bw~
zP8pRZleZ?mZNISy%3YCoHTiTVo=BcDynZG5pXEcz|ES+e@#lu;l7Asz%ui?22ja2O
zRv!M$R>DzZ!>Y7ZQ=*>FhIlIIPt8*ye+}<c2Ss6%*ssMk%ed1rNBX;G!~KAFsXunz
zqkW19^<2l)73?sbz*D4S&(H$w1io!R=ET6;9p&+qo}vv8PZ*a^Q}YS(R_F`KL=Nz_
z`!ZY?<s$`d!lV?Yc!GgS>e>8m!D@BirEm8vHGKu4z1>05Tc56{^K$W)_%rmff9Ybl
zVNtepzwIe32T^yhb^HUL$_~!^vyBq|GeB$KJdHn|fySU33op5GWKdK@Yx6Qab96sh
zkHVff><1vQAAr5y*Q&A!Z@s_g;2}8Oha+@1BOOaSRL@TL;AHCxz3!V~y6-d(O~!se
zBKE_Qu-_^H`|Xpj|LflIj}JT(f0s#GU*hA@xa}^CN8^5v#{NQm;NZ_hvfQ3{_xmZ~
z3^I@od<D6Q_-)7{E+uVbS$d%s@OEC!=NS`u#YEh0+$-0E@E{lpg<i^3eAZzPWe2YW
zQI6a#zlw<MS@D{YVnNc2`njBEjK#mPz72q=lV2y1pZ}C`ne>kyX!U)LfB#uXlX&>*
z-Pv#oGQSj=g3kJr&f6p|K9+Ci9&m%cV>w85^Yzu&FyDR_9-b0s48A}ZoxT~-^$d%;
zHg;7CZYh?52_+WRRm~#QaH+B<yTVh_U){=-A_RPnIM6kql(xm4Hj^-qlY%YMVl`<r
zHEk${o?IAe?T1~j2n-;Nf5M`<NYL}_)0uEgUZpGvCc-;<x_5zPiOS*lXSOOKB}yyw
z9?$G<VbEHtW~C<Dq9KCv4ZV=a061!OPG76@G$mJKRO*0I=bPwb9;ncHD<->f`S+3)
zR<dHRlYPc-_p7rbE!-n9>W=aN!bm?^LBMl~;ps+z1JejV5MbEze>4R<s;im45}2m3
z9bKRIv;E7h8i1#Z#a?C#c>q}KyUMPiNFEN{t~sVoTpcqNa<?&qU`GiIZ0ovXDn#}5
zt%Bx=7Fhj^Xn}Ww7RbGeOB{Jr0?E&s*bQaG_KM5K5*++p3s?ZXYvkOxe@H>U9DgLo
zpU<|0oUcWi^Rl^^e^VPQp_v+_<MKZgu8>q7K>aWW-zHf(rgs<I;hHmE958>CERmm}
zI4R(N9>5@i`wA#!I3!^nLN%Jiv7EkOPdQj(hUP569)UH;mJ!RpN05&;0C(4ILHdY-
zfF^Z1fccQI643Byn1mkTG0rvKLq(7^849}ViTFT0Vi}6=e`BV3DmDV<U=o-bHf?57
zjSz>Krx$a!b_ztK!0%F709y%El%q+?vNm$Uv>7qhM*3(`{^owZL;tZP83CUZ21NFj
zgaCIr$rz}1m@hPjNyh)5EDQ7t&y09SSRred*)XsW*Yubj7!EcR=3zrM4eYAEgEb|v
z6<rUsATUS0fAC#^g{*DdePVrVaYTG3{SZ$V3#2Z437feF&{ldJ&KieYd=>_iwFES<
zWOcb`)0w;scGnPPo;?BJ#I0*A(J?lEKU2EPFN@co@gmh)%df@Xvk`sqFki`&1J>9~
zU57z1esge*n)dG=SmO?-A<pO>W1RF**xs|=bwt7Je;Yz{x-giYMpc)Y4%Spn$A+sw
z9t~Z^RPi+3p{Ap;Z7B^Ouave)u`*Cl`_NNRD<g^aD=0RL{&xo(zfrq1NK6ZKs#&he
zuo37QK&ZOdH8le}L{)9oWrm@RV%nXEX%$uV#CGhHuziGee0;EuBP!#F$~Xqv^$;G9
z%Q#!sf9SB#hi`UHmTe9cg{qV(n3*QShCvnVc!7cq5?Gc-DGQtt&iW{x%Xh}=Y;$!U
z@u(jO<I*?meUqTWy_-8Q$&Hc+#j!s*yqQz*cs@V{dn#_vs=og@EPuv`-G>;={!N^x
zkL>%qKL_UM`-?ErPL`E6UBz(};$oEsHZ}~xf3Rox3~Pa9del}F&-71D11&tM-d%h#
z&`&IBd0VuU(7*``e>d<&1KzmfAXmAleK8ObYAeXIo977)N#*y`(MwlwqP0`p43Q{_
z=b||D+H4VA*5(;WuS1Gxl4O1eiI;LT0Vj)M>9ZMv%KTRm6DWM;Rxn!r@P$eI9Q}<&
ze`%G4b%n0O`8CeM{4>hfoG%R2%#&qC0YWv&YCvI$sI>@ro?d9|&eY<~?HHKi$n|Z<
zgA_-B>0rZS3==P4;P4iBD)Wdss>6>X6V@k!lYT{}lloXqcglFXK{^|;n2iRXfcH^D
z2CFCD8re@Qc^3x>dI?v;6`bxXaQnFmf72_u3F}KHtG<_aMN^=Y%{?#gk?9P*FE5gf
z<*HkzE#%dG&Z>SIO@UJ`51M)im}G^3gIIqTuypJGn*ilN6TXILk5@iiko0b(Ly-Aj
zuZ}Glh6P*v%y<lbUvg=T=T{l0qTQP_NDmSnuulB|Rt{XFp)0g^efG;WKz#$re=15S
z+%hn^_oRT^qgVK*tR{qPs4Q=*ewF2IB|8<r_v=+&ZoFpoN1v*2$2FE_z)te29YCay
z%SF$bwtei*>Px#{eKuz?XcM!L4ji?pdf>Q$<lh{G<rF7A<25TNszGOlyO|v}=mwA!
z#44Q~;lv$T?l;E-%>7)?PFC)Bf2e0zj4GH=jX*|N6?=h0u;MwUWBO{q0y+kH+@-h#
zvPt954Kn*EQQgJ~=oZ2fH$7#mO)`+&rs)phP1bJ9Nb*ClbCtByz-$&TQ`@Arp<roW
zEB`$RiRxiWKc`?FYw!P)vyhEw&m%C<R*`xXK}QjE6hZrlpb};HU`*nSf9*B^il0$}
zeVAF5)l)~Y^(><3rb)2oIRQ2tVq%B+6q`<91a{!4jzUK8s-uBdNuCr}h7<4u#br!;
ziHE_BDPcV47&%V`=1Q|%jd~`-j%HG9m{i4{uM@1emS>vG@oj4xjM@luRsD=GS9b+-
zb=l3CCUj5$N-VTf-w3;Ee+^uU<b(00f`kGN)EqD<ioNsfhe7o!O(CuJHA5f4>QSIH
zV>v5e>PrYkMXB&804xna^iJ{uZ|Ju|q!O1BN&%xh2X7`=jF58wdZ`}tlLZOmylnE4
z#Uw7!t0+otUc8PH`Wd|s^WyGMr+`F6YI30(+pBaaA7N^Gx=jphf2+*E2GIiSDIUR|
z?)#3d>$>i$r{zVqPGlRBwR600rIE8;(s$)4#t%uxC=0*v^wKRqu`-Qy6FcpaBajK=
zT96g;7$ODt<zgA)-dx;^>pEFRK75&GVUmSKSYp0aK3#O>v8<wG0<CitwIU;79LDqK
z=u-YxwnjyG>@};?e`HI?Fj#(h#=ylt{O3~m&aDJg+SfFJ?u%r`%VdnJxG6&(%i&PL
zi7S21(kxk|kj*}0X_5h3fJnST`7%%CNvX1Y^R-*RMToprN^*WDiRo0~D55`+6_SO3
zZ|5ankDsr*50t|ehqwB~4f1xQo?{b5voP@$9e53j9mfWje>cNY3|H}8G6sLQ%{QIX
zH9Q@*JkRE~^Nc2&ox*md9o?Du^9lI8aXg;&<eoFRG4(g4kt7TzJ2GDIZg%AVl(T(J
z{Hx210Q+!t!7|F?g3Q^KTzGEw@sp(&u?bJ-G+7_bi@Hc>3R85hD#{FL)0WTTdJ}(o
zsdTeKtQG18e^d3$2D-t*wAQppFbW5w1bE{qC)$&NLa&LB<YJ*e^Fq6qZ!}7kSM_L=
zs-LaVD0NaPNWV$I)!k+fZCr&1nOc>;mB#J<_S@Zh)DGHi<GwBH1FY%`t|#qFkRq@W
zT!WPp&ge5<k=4(bbbJUkn-7ti#~1(B<UBCS<Wv~gf03L=ud3}{RrjwK9q|P^+Tcp7
zlb@{52D5{J1(t>b2k^U8$H5NqT<p6FF{x!)R97Ccxd?VqRmwa;KS-NiOX1wGBu%8y
zIo)nR>R1PBFoJ!!0&7wKpa9Kc5><izV6{X+#{RivG1y(Y*afwTQm%$H)6{0A5*;9k
z!y@5Xe|A6veN?c3<C<HfX>(vw6kT@}N3pSHdK$nB5bRopgI$L?n(7mW(R)B@ehSI5
z8-|uv=*)#C4?r0f1Mvppa7~}1SHidsx0T2oSSPRIcF#>FAfQu^_+azoih#7zW%D}R
zZrD0{qa~-eC8x%eo1xnnbGlo78g`u4)4**if8BYGW}Gp$XpAiyla6nBf=4q>#qf+~
zoTqEG8_hVa)fvq=$G;+bYh6J*pR=DJxwlZ51SHD$0(w5iBUkgaPfmOOAWfU2F{u6-
zZJR^Lc{B!{CSNq#HjlIX<L&&g(a?v0Fpjp(ZxeyOZh9$AVyA20B*ZXn-N2e3XxJbo
zf5V<`dRWz5lPL;7uLWaF`mtluFO&3@jL3tCDtwuwd!ranD+1kMimNEZ!_0;-Od6=z
z)gdaAIhIF>rr3^l^a%9rgX(3BtS#rLif5{G2ECI;yfXF}V_bzG7sLaT%9qe*d2Q_r
z<06rULm4WF&d+PJ<N0~NfMQ|o;c>mPe-)Sw31hIYqx17>tit?#e$MTj5XxNS==@v^
zKrX=f`3#+(|NXc3IsBGn==_|Aj$SXo%j5ifdpz%s9Y4Tt<}5AI*{XEt#M?=lw>s1M
zZO*i`+iS+RKf4DX$ACGSZ&@Y|hzn_YsfJyTxY%YIBcA6H#qf@O9QE5C$KhT9e@%aY
zpD*4?oA7EaBQr|NGt=+_;Kq4~DQ1yyUP)ONLOw9=HbCG{EIvY)8Q6S9?syb1#tr@=
zxHpU-Dw$-TA?IYjRJ!RkdWo7D3VMZPR;AYM*8E2JbXIl1V~rt)+jUi`gh{D0T=1IE
z`qxIy^jb`n!%tEYk!->nS&+{Rf6MuoB}&{$p9N$Yfn{9*41_B766FO;#Y)r$XkK~R
z9_d<_V*Gd0>oS(<Rwii{#u6QKZN6*hn$sCP4cvF5ihq?sj-SqE=+_L!rp~Hi%7vWH
z26W|%zBb3Yb_O5<w=ZQ(eLV#2C_`BDa_RKmW~S@j^?|*Y8@+G2CH3-9e|{b*^|kKP
zsQav`sgolRN|J7ZKpAE#`;o2eW|#Ko`x}a7dV3VpgYio@1c`<b+bJ6H5`Cp2k@DhA
zU$?Lg3HthAkGAytJF~IvmY~ie78C~$wwFnwJyfk<=>ax~-oaN*BZUVn({1JMfo6mO
z=7V9jw1aGDhv)X&2aSIVe`?GbaM>hV9ZZsYud_9h)YQjAlDApfuF$)uxVZGs$g)Uw
zjOt&92vP%_i%(tZ;v72qoQ41e5~hz>_A-6u1&ZfjLw5{pIHrdkVg~?FMSRoMY}MHY
z3ps-ERX-yb-|fNpzW;Rg*A1F2{xZza`}ZG^d|eRdSo1KSp;wZDf0SZoE|9atALva)
z06gp-!1{!Mb%#)WAl<jbb5y{xz<kRUkl`iuAo!YLk3j568IwY)mE$O6q6!u3^n4%A
z-*4<o$Zoh60$S$P#C$4+MRCm*EdL&{7#0_OBmqP3!}zm^AqW?M>6gSprcbj(4poe%
zj+NN}v&QiXA^0I#e}o+CFM_n998m3OD1TCwCN}e<7@CS+bL_vqaAVA5hT{g9I=Y7q
zk2=_8mX1Be@dM9ffvyIRIABXGP3LR^$&{z){G6X7aa@pJhG>y(1Pr<_aX{9O(6Hme
zA^!kJk05$YvZ9pI1$rPug6oI=Dqy@4HxL>U-HQW}A3trYe`sDv{(l=1PGx8=3k+Yw
zmP%Y~D87PSLkX~^shaOorfGCH_xZHLsn)1UU^9jbwmGcICt<YWdQs>D6g+SZg65Bx
z5k0c6G+Kf!#TSYmQ20q8(l&OS2%Hj;TJlz@0O(M@$_uu5j(%f{<cqMNd^&sa;?o(l
zMJh;D-WjY{e?M(4na|Nnv>*k`LY|y?vIS7@q;T@~sG7SC@{b#lrL~^cTQzjEFOe6<
z&0b;Ur$RBCfugHX7BVK)nnKuxW`~PrJJTtrmaS!*Go4Or4Y8QTe<fjzK8LaY5>!CR
zvS1m4Hl{7Ta$9%Un8K#1lZfS%O*&uAkkZjh*0Uu!e;v{5wkjs!5#n!9k2T`uhUS&!
zSI+xRqROKNL5VI(IlMy|y`7mkmtX2gxO4HbJfv=`>l*PH_UJ$k^kHi7IVbD1<SD*t
zD~w`YS1C4#uV9BV3u~rhD+Z;eZkVUW<0HH#YPZ?`Uy=fmC@MK<0ccI~kRw#nWFCkA
z3naoBf4aF2=`{*-baUND2wnnTSIM{)BZn5OxK2R+4P#)&fNA*>W(7zcIf;E>zF7Pv
z%#xV<j=+oSvjRj<hQPsub2R~2kV>rZZgmdPokYnT*t;l6KJ%e{j+2`hrCbROZ)Cot
z*C5=Ja+*08e4!c?n=@b?33SOFS_tnG5lUIke`R}MFkvVX03Xn}A+u#h@*-Q(Vkxl9
zhl*6|Y;OR}BuLh6b-|s9I<NdMl1_%oJEmb<Ou>p}5o~CTVG?*QHhtnzOVx-@ol)L7
zuDk=hU8iD;`d?Hq@yik(Ulxq#Xc_Y(ftMW4UTA{)i7JaQ29C06VQ;&cY~`QpCdk*`
ze@(R6>QP{7g6n(`x9KLSX@d;01x~vw<;~C!moHP2<?IUHmr1v`GL<Y?WZ+u%$oy&<
zr-Xi<{BXIJH};QDXK&%^l(#q+P5&Wa(8EB;E`0dUI;EcRt5tmer%eSQgTk^9Wv4Uf
z=kLG0-``EU(0VWJ?^~VRQp$wl^6bdMfAG5TPsMR4KRvGGxNQTZ^tkcsnX-LF>w0V7
z&PK`euw=gA)pt^oXPY#J3!Vu-LH$L~+1*X0b2^64r3}y=W#}XL4m@}ny1_u7wm5Bh
zmZlpv!JcYq*l?MJ9ap7Tu`Smofu{MsdphEDjxaZ6cMY;_X}YIe{GP<~CCHesf8I5W
zSip(A2Fo$nPdST*-Xsf17zL))$?G5AfIqSvPbvK_5}yImTL!7Hk~wg6;TIOIP{c^a
z4X{GPeVr^pK;{x<#z=&3k}PT%fI%=`q@V!cLM@3_T;KrJKxKDp7>-FUB?k0%nHAS8
zTO=8qp%5%CG|AE=<0kk@YW+aye{~o$^u8Pwbn^=-mKlla<+#X_Qof%2^8RAlO1G83
zxcwPS6AB62^OA=@72KxZj7Z^<(hXT5g07bf63hLP`Lt$e#l6Bote5V1QqmS87hi({
z5fp*vGXe>PJx71=!6TUIKPJ~jk>=mMcmX2>T>$tRuAVQ-{eMoA#S1S=f95Z$k9<iH
zL6Rk$9(2oWm%wEa93&YQg;c#`cckGOZ5`XT)k($d*tTtVY*%b29a|mSww;chj&0*)
z?|sI5#`~>)L5=60>zZrT+NJ-D-G?(myS;i|Gr=-QN(;RqxN9>>Cpr%?DvdPKTqyjf
zoDpR71JaDsR}jhyv$O<1Wv?vlM@B?U@3+C{gMJopp%~Im(Tc1%{?=`hVaF678hb|=
zw#jzF614BKq7$kVu;mPNs*YWUc668B>iJ@V^g41uf|i5I&eynd$k=d*^Eg2qXwp*>
z<>lJhz@t@}=acARU`?i;O9T>7bB0I7|D?6T#<L^PxYSTCXdV|0itmx%s`m3;-*0k4
zV}sr!8&etfxd(ndeF^2_g7aoT#aF0SQcQr!KhSE8cY1WLdOia~bfhO#y`;tmRh`&g
zp3m@Gokzj`x-fSLp{~e_Wg*9PqxZQFLaT6zf-F8Q`066>@*=^9vK}`0^DH;ce82_K
z!b;4Mjfe#riIIoG#;zio<Mv7UgT6k7<kMy3mm!~dp|H(J`K@5)zc!bsO!b!(K<yw{
z8EY)7oo8^|*z^Ns#k!z5_UpK`9gejW`4fi%!@f;cURxKlI>s$)@`(ni_13`U#;}^1
zfrnYkQ{vpTo*`C#;(RzA75ec~!&yc<vQSrQ#FNB1Hz5=c`cVrJ0+h#pmWVMy-0Ez9
z=}iin%K~l#@8>{->H^?M7#_MaW>`6Dyxu4yyk+bEnj!$tYP)e~c5bF?l18sifDTY(
zh;a<^EF4Fz!+dm0d>_d-Bl)R;6)pPVVX&YLB!9Vqg#NASG3QUpZ+Qr%*~~d<JXl`G
zEILb$M*c`TK|P&51W~hpR`j=%{h~av=D$}RG?yfwGzWf+z9;%Z4*#oMHag-Q`Y+%W
zvg4(&0t#wiOHGr9x6X(uV~p*c=WO~xF%{Sz=&2}PVB5SPHoAZ459#~U1!4Hbin)jt
zQ!Vk98;Z2RxDmz}k0|pEr^)HnBVO#nI<39Qy|3SjNaAYJ78O0py>dKVcY@+oYd$d9
z)7)w2F?&i7g>`d0>i%3~E0nixg3#c@S_WXr1EGu%a#(hTCXJXZVa_rI3}?<0uIz*L
zo7CiCih}6SYN&FjX@}TmB{4#ru~Z&UY#vV#E@gz_A;`k8Lw-Vk>~6nfKtUEzfbYP7
zfW9OK*H1%gnMq+pY;SjoID>KTGv(YVFi3sAEUacw3oR^r4_HbBn6&mLgt}Y1>36;2
z0UtToQqywyI>WtT=><v8HS*|?v=F^?514OA<ziOEM&*}ck26CrR@(!?7ddKCSCHIv
zm-`~IEJKY>+l^}_a_Fi=FGRo;Bu*C@bd<6rxqis4TYu7OX{%FC=}cIvOL`FX@r3Uz
zj#pE2p<Dx`zvnC(ZU`mNAALT3LZ7ogfT5<J2xIWxq5HOcdNR$;`wOIy?MO$<01>S;
zc>DDdt%TVbOn6dSz$lz&r4F)w{`-F)_^YzL!=#PlQuDt@>ZQGVh#X!C=JlgyRaWsZ
zyOaI<ezU-_GNk&4<wu6Eh34O6R0ZSTYcOSl;KbLmn**YQC<+lg0gQ^{^kKkwV|j{b
z8LS`Y;=|wnibN?C`uRTTf97eG?(|TiCNJVgb&4H2D^66AG7AKdK3u1St$I9AA`bDe
zRTJU7hz@DaQJ3A*!+b|>>iT4fy$4;G>JW$6^d_3Yy_3m`FzSBr>y2Z`o%HGCGgACh
zU20PmL<1baOKwvl+VTrTxS|1Dr!>F_;`DHLbNsD4oyreXR${VRe#iJJ>bhjF?;Q|@
zdQI%v*`R=-O|Vycue9@ZX?m<Otsu0Y9B^oldS<jup}+joqPqbwwhiIG##s~?=!?H|
zhsxTGI0coa6P>Zn2m|x3XThYe25vM+R3x5kFAVh`iX+iw5dWQ9yyOCfZv(anx1jDW
z<k6h&<14SU1c~~AcJc9);9m6wb!8dVGQ5ayIS0lfu5#zNlS3JWKbsF($}_#$F4ucD
z+7}hD6Ei19VaV^+2l_XWv%1Zd2ao`PuIL+du1Q83`JhX3Jc^CI3xQQsOQ<5%uei+n
zc5$Q{!lUfjMqO$l)UiM^Seog8<mK!c!TUtZxeJnWTHF2>kfghg!Wj!4GS_7=7td9n
zqv)l&(@?O*-?4t)p!<FnxKHyjQQzkfsYLIHS*;j@UTM<Bb`x4%U_X9T-(9^VhBBcs
zN*`P7hILrQ@|u&HICn=^m`1!q3`vn@yBZ;yD;rW<Wl&mSB?baFf8=CwASg^b*~rwn
zgwh*BtT^EG#U8${FcC~FvaQegexcGeab_>FTigGt2c{N~|B0tOuA}}ju||5hV2cAo
z&png*TK&NKNcb8@Ip(i!!XfhIj2k4)4Mrxza-R~6dN)U5k|$-@%``=g`z62?{dGHF
zFX0fqB`FoN4>JH%Ey*dvp&}(x=NlLZt;tM-2#t&=t|+O|nXHReGV}7W2|0cEv7kjT
z6(gigC?4Jx7LZnJ(6)Z@gjQM!UZZxZVi5yhDomm|5#7ID1MkP3895=nq2_(cZpW^l
zKwYt-5|-*YS4wf&&(|bMs{a`VkXq=%G%ZuGPyk7`hsOj;1_#S+I~j&xd5-qSaLSx0
z2LhCV!%@lJ3_S<HTgGzV-`n9mFB%V6<5&C8<PHNc8zfvQ8AxH^gp;hpdtm{qy;7gO
zxITAt6Cy8~VcQ;AMC{klJ>UB?ZywnJ!Tex;ys*7-C7SMQ;lz`3dLs@rk811vq2}c)
zcf8;gswTkl^5e;6q8{Z!QfepE+Q5a%#+avq<&~PQ^-8HuI^9uXO;9=}CXRK7F2M(v
zbDCu1pr3eDJJ$zq(LVwXe%$ku80X~d6;Ko~P@J1PjOr(>BXjzj3|4e9*0gshb%!TL
zF{b&-nL)I>(5#0Dz35VXO17pNqsfxwYVhWAydeVbxOPj$D<W)MY~jqRXG7_9v&-&2
z^N9|KZU8l<WjQc?kG*Q>$337jtuQ9qsxph!qrb8JSQ%~k9JEZr9}88iybBwKt)(9V
z@4?Rdg;V}f{j_DcOUvHTF&4FhOJgR^6PN{+r};zY1ygd~IE18dqbjqkJE>}HB(g|&
zzCsHeXg<i~sKc0PlCZo1-;13HClz@AJ_l3k!Ibe)V~G;+7$PREHDpzd$N25h>agk!
zG09|g4Vtxj(fxM2nhWT~ZZY+{n~i$DA`mCOluD4c;TG`>l*IK^IY7Kqx2%hfWP)sL
z;J%iKw3m{_HN0OoU{5pX)0_<lIJ@bVJVgM9$ONQwYNv+6oih8;Ijj&pc!h?3u#bmJ
z2I*U(E8yUrFn}Xo(%J3!%gX*i<H@7D_lhRux>yNVoz2TpYV|<qANpZ}oR(4LA<A5P
z(hkb;-8~#@?6u-_-pgULP}uBbY?sk5_qsWR4gN8hINoGip%g@?+vd&OdI~nMdb0@p
zP1M;bMz$jCU_Sx+D@Bzdg-~V$@4E;1zj+GN{i+S}lord3q!*#GXcEPp$S8D5A?$V6
z(7XjJ#P63H6<FoY=qQ9D{2Lsn!FwbxP=91YBtAtiJZG3d)AZj$ADGAf(Q*30Vl>z2
zSL2glIxM4udvD#sYV^J3M`bJ5wm{-rJ6x_=f;gzZEoIDsPK2Pz75rdXOLXH|e~+wQ
z{bMMesI>~9i3YY&K=5^1z<-r9EN1+FIZEmR<_4=q-fIus0-Y58*~LWp)j<{Ie6Ay|
zD_N$u{+8teu9tzn75;?Ulb+6V<y)582U|vl6vY;Ek#9v&8;MmMa8WDXB`*z^62lFt
z-9rIxB|$$ggHmYJYwt-PbAs=Py+Yts6_QfK#Ep_gW4oL%YxjTA$AU`sV&g^)e`dqV
zS8pVs2wZ}`oQUhP){x|Z2qb~vKjFuADBw0Mrp@IikIgKik9qjo8EMAX*{;!_n3O!M
z?PsH}p$AJyAp3~v;1V0*dbh2K2(s+?kM5}SJ=RR_YLm=D#ABpY-JL8vpdCuh($8I6
z-lOV!@Q&67^u~~loYZ}{Ae*KLvE<CgsFvSN>wuznlxU1VJ3N2MJzwi}p`}Q~iQByB
zlIRhOam&kR%Sn$6K}qCAq`Fik!r~64c5mAGO?GlIAY%+v4W*1h<7984!}I7SgbdM5
zeH`*oAtoyLf-?KiL#=gSW?nwCESOqf%CyV6DuIN`BSfanmlK4{I$TOgI%Rs5NSz^r
zW6Bn=HR9n;m1IekayEUM_xz+i5OJBU?w2(J9W6ZA1Up8OZQ(eoan&m>>Cz>X@kKp6
zEW_M2FzGuzzXa!`-vn{mg5n^5F|=tQ$@g#K3sX!nz5+av<$d6Q&o@g(CGSI4^MZ>y
z8)d_Iib#W<B+Q2J%aA5B9pR?ZDzbZuy^eu7*=_wONashG126#&@dx{4?__NhPfhw=
zpd0)%nolABx-F_W{nnz+kQa|dQ#MdL-6x;~cB$JjW$m+yYdwc}ceG>~N(1lV!t5s#
z9ksPskS5}HwY$&KLt`;@NLOZkz`cp?>WI?VYW1XTypUlXiPZkO92p`uc&b9LZn(wI
znKlf6IdZ*cRX!Afk2L438V~<b2kPT7^&8eNN`<@Ek>7-5o&4G}&@+d?iLHQ7QIeDe
z@>pn~F~w$@yqlhg+4QsGD72G%Dq$ZZ_(e`9l+&;l$?1gF*uj4X2H`c77hV;133i&&
zGw;~H#B=2v$g-gbcz)_6cog!%)7)n~OID-4vNAS$FAiU)CLsZFZN>QzNeicrTR93>
z3DI27$aqK5$~Sy9mvPb`?qM1po{2<(X~VuF_(<XGx(>zm+lAx>C)3>`YyNm0NHI4k
z1Gu@N;Jtb|>C~q)#{8nzeq^5jcd2QS4MZY{pK)x@F2)_+9==psH+acF;JM=oo>Ix>
zU*CNeDLOqRzdd=1j56BD@{AQXA42?cBf}XcobNIk)@Z>wgb|PZv17Gj+20SqpjsA=
z#REieoEe(h=#LY(4vlr~RTz|Q!m}={2t@8h0F@G^&!(K?b_|sPiX;al${#06Q=~_3
z3m@FN>_MXhe;r;8OJa8aw{Uf`I#Tcp(MhCI3upv<BFYs-IYRVhmD+!-28(hE#U|Q$
zCWC`)=OR_t-y=E7ez>n-{!)8DSvd<Dc{@d%ppQQ`3NDgKTp;~_5Du&`uq<y|9Q;1^
zuy+c{K=naFB3#~0{gws5=qZfVzg3lh@j;rLLXCG}h{E545|z$Fj%-14B`kIxWc<&x
z4r)T$RtIP2*HtF`Yn{@WsZ101lK2#I;yz#76pph9OIADSU1c;u_?r~KEG?dmFrcb%
z$%Bx{y2+0UqiJ)+dd~?0W1jVmQA|aT+}A8T{0WF(u&ymFfY_;g+o&}i9c;RnguV^z
zeb$a~Ek{hK{uJs|&t^iqyZ|D_Z3N`$@bFhHRBVG<CUzhIG4SD3@Y(>p(mp`HAnuID
zr>awy9X1u7M@v=-dSV9{XF)F>qJz?Lwz_Qi!;w57qr??gK0T)9fPRC9gujh7$pRj>
zRu@xW0cWm8G9_WLh^$$`;@X~DTUtilvN4&T;9&~(Y)Qg)KVkA~52{;7<fL_dTmNap
zPjTdf-&JRT?^P&z<Za#l=~&MpYzq>3o`@&IB+kLy+UN#V%S-~;?B~L=BEMKTGufT1
zB<(BebAHUqYAr3Eo6gL-e&K5_o%w0SGr3ZJ0h#=Bh1C}vzq-J1`GL>ILo~mnAhWui
zn)?2cQR46Ki&8qQ!(jEdGhHex-0JDVMaP69w9TC|!>Y6rc`#`<Sy-hyBQM%V9JN}7
zh<vS_6XpSK?xk_yqtJuXeEDX>>_{>IZ!BY5YC8ta1l&Yd$QEM|obDtQB`}JPI*y3}
z?W91tq?1RWhER8U=1s@~Mus`8J-(_}RuU%&9-CX>=pV+X+R@QQDijD$Btdp=)bzpN
z%#6kH`};Tfn%Qlk5IH)^60RXt<Q5Rvj<u^Z`Gef+LzD%4x<jF<!5f_5GSwy=Vd@@C
z9Td3&IoVmy-42SQsMF1+q3RoKX177HHe9X)S@VC6tnq5zvmW73e6@|+cW4ZxlJA?r
zzA7plfTI+G9-|72v3<^R>;Xs`jgjq=r`H2y-_sqG$giofh$AR!Xs~I(KutE5W&90-
zQMr;5&RK!`-RG$od|{PKa>0lCpR#IYu79veRuwGN-oBcm1%j|ewAEgO`h$MshM9JK
zwM7eXo*tB?QM)G;P>`(#w}9G_Y07s4l)!M`03;JIoi54hho{^fZmhT*syWTWZA;|D
z@0<5+(V+UIZx{;mfN08<+clfz-i$wLDYk<`IR3!s;6q4WVZSMly(=wt>9)xJnlcN8
z?qh3KZjnF00BffoLh+}hmJ+!A8Q<{kk^bqR-QCyl$|>`Sf#Vq)8x}2D+s*uMwi?@C
zDQ6@|DNdeJ7tHd8$*YOY4eEoVS<~DWg*#7&z!^j$9-~1wsLk*2#H_G^3_!-*!jE)|
z?*w#ti~zMMJ8(BQ-JqAq76Z^A5!o=x2z!@m_soOKLU)-sW;R12rxmY@S0JdWAvzr5
zVkx&0Nv}}rp6<NoyrETX1mZbEy|a(0LnnPlQTKBHFG5NC|3@g{ir{<d@_Ji)@6ShU
z5bo<tzJq~SK+10W)AmTUZD+w*r&<X;Y<#>2Ik^U0)|NijSgwY}nQ&HbjI7mIs<ROi
z|LtxVRaF?&oti;k!-?C34bsN**S~_s_7NMU{$u<S_M}<mT0Wt6nuzc^pa$juITl4o
z54uL_6kM`TumZY##~nsN_Jl&n8(eA7$mZb9ttg{6AcG)kW|&wj38aY6BPm-lX#bC~
zHap``mPblcPOw50EaZ0Iu4sPe7z4j-QNK?<IPm;27-tOT?{4|1Gk}&blNjiJ9~Z*j
z-U>*wk0@G?I$@|m1#LCaaZbn&at;o#h2H9dHZBL)8(;rLmmu%(^TkUT^}Ey}L;Xab
zPgn#9AYUJQ8*@I!ZW{3;WO`6C4qxBitJ(N5>`!i=5Ib0bcJ$!n#BeZO^K|kKS9FS7
zf3|9(*<;EHFlHcwu?(HqCRw!5p<OxET1K0;NFB^SJQQc`iaM<QUsqHaX&Lnq*o^TK
zPLISs#v1m(HZMr`>BW)a78qy0U0vVKXGOPWV3S~jH_bbhbjoK1o8Aa%)q@!kogGQM
zt8#V!-O+)KcEYckXBMy~xNHhy!A*g$s-5vt^>95sVbv;f#?1WGo&<dUVPZ+4l7*uS
z=?j=icGU$xxzE#p$D{1+3>6Cp6sh+U*%y~)dNX{VPP2i}yTzf!5z1n~Opuw&P*YtD
z@M7)S)xCkMOP9h^iPn1AUG7o{Yx)R)zJASY#zv9wEH19)))M*jm|Mf3ZSXbhR4s4-
zIXJriBw}gu53MiX_hv8g``c0!HITEBpuch&DXuyRzmepo+|SE?$NvC?xR<q0;|#M3
zCFa|FT4C|+w!r=*I_h{bs_GqBi4fQX_Q?~p!-K+-gE&eKwilX3zEg_slBbwSK@E%A
z?fa2>6k^vfY~?co9+LnP&ZI@Z1t*FTSz#JFSK8f)8TEa4GVdM>)~bgs+`B{!;oAbm
z(tNnzVtx~B{%OE{PdA4>ht;)R=v%)vkisdPF*@&okTaRaBHd%P<aZ#fJU-L_c3qy`
z-lW@AZPsE*={VW4XxFHgk9TO;(k*#aHBjhR)F!b|et_D7Wp{Rs&P};W*32Oy{2c4|
z#6jnJWs()D<6H(n-F9~R3@hPb71(59&?s<mDi|j-^2Lk5ktPZfDagOo4huO2(O8a)
zIzs~F<0VZx{4GGHP(WC0{`^e_0;)lLdBPJjGt@J4?TVIM;Wlkg{sk|sw48o&?btmJ
zAMae)enl*1cGGB7Mkw9g><u7v$M9g>PK3D&>|26$T!eX|4mVnMj&2MOYIKaj=(97z
z-lL&1rq;bDNhO#@izZoDG}o&wob=e!cHGdX%l~0q(y>bzi9O^7^w)mhzxwtDU%#T9
zt-En&=Tt-ns)?mfH(Gri3ze~5;8(ExwRY2mUsI~I>Y)GSDf9}RA-J3W6X}<n4YkrP
zW4x-L;La#1EEZ2X(ytHEuUH|i%;!$-jR6vrr#StML}tevW~?s`h$$>~=r5Jw2h1-2
zm5E%?i6L(p<&*@n-Nx5tAn8AwxQ8cY$g7MX{4vdpI)Yv%>BQZ$B_1X>NyDKF>=Q;t
z;&EC^+#U^i&-7$+fJ#qeanL^%uLJDrwe#<>7PbiFuFoaA*bW@Sg(bfoL1^eiqR4Y^
ze4B01WG2Ih@1tH*1Ea@z=Za#wtmKS7VwovJ``AA|zS~reH+5Ogz;0QsM<SnwX(;3y
zvaz<NRQ$oD0!b`i@Ps#vvldf5@TS!}VNLj<mD(j@Z)ec~au%fM2`(CLlUXk~@bChi
z*fM2I{Md<F)Mp5u$P?oc)l%!Sk_(SF5Yx9uPi^flB{6~WV+qWU(gI?&`@%>+)wzM0
z|Nf3s6PpnOc?QM?x}VBep;yUL6Zd<h2QkBt@wLkD6|1V*Yy2UPek^Sma`8Mz&N#<`
zT23i!>De#cotedzAb#+=Lh3txzz3I4&;O#ZYH#QnIHbrBYqBEMzQ|b+7ZJU>^plG0
zLSHrFJz1C2sf3_Yz}yM_)OGjG>w^B^!DF$!2fJu`IR{!g+17=*_7vYYmtF7y&^qvT
z;rd=@^~P{M%`*c(2_Hz$7Ph!mFZ93{IySfhjy5;M+k`|ee7h3J6*jk)7XlhG=15<w
z>}X^J3p%gJkYcCTF|Ga<WC;y7Z`FB2mwQ7G-Ctzv<t;GrE?sfO2W)bc^P$SL)X5V@
z8+($ZJOOQOP+WtzM;wU4ge0YORfYU~69}Hf;jP_G4^Hi&POONJz3C8V4E-F4oNrj8
z!|l9<ks<i_!9Iw6!0eo%kPu?K;P;3{Ki!?xKOL2u8})n5sjX$5eFhqF<{a{HAn?1Z
zjF*eBka&fC!mPWoYzCUF9@=U~IY)i8F5h2cpMcSgPHYm3yd!;+NH#VevVGMxrz=Jr
zb-rP=e+}cf!i=d~6T(=8SM+deJp87Ef+3udtZ5QB5^SOnf;CA|qgt^lxd2QzKih)`
z9dXIS^^+=T7Ju=6Y_f~&-S}V9^7)}8ykxy}=0jC#_ywPb<D*tR`#@9vyq8_z2>)j&
zq5<T!QG`=e#u{Ky;vF)tR%rAlq56m|c!XLlZW+wKkab$2EZc{lKnbtUY#@B4h*tjq
zDH`>eZg9s0zze~cRrxoR<i6CbW>GhGNEXCbi)O(>GX_`RIe-eexC#!I%oF2&uurum
zF3E7eJT;Rl@xjd8$;a~1sJ%_~i0ZRu*aL@`b)fbg8GFRFh{P4G^b9ZDMImozQ>)C@
zcY*BsizOZjrdqWKLih_<<7zs87Sg~feaXWBlUbsGKQ?5Jamh&H%6wvp3!hd~UV`2P
zMdv?LGLBN<a$FaYbkE+^uaweL@rP})VbdC(22GR-%^8`?85ybDX_$r9lIJrU{sD9L
zD0OA7if(+Bv$nC^j*ztKu+X=VjgIQ}VCkwY-rB1T7oA*e(*E`a(<1Pc=V!$3RkT~g
zdh|;S^!&I9rblQD`6UnPymh}0zPEwwRBLYCOoYSX#s(Q5M32rBYi+!!A)Cq^=CO5?
z5Y$Azmy8q$#6fzWMZPr>ooNHV&jJ#(7L7;ZN?rfe5&@&f>55IFNv|<y;bVaNM?&tI
zKyOtysTs4YEGz~D-zV(h3GrDPwbGvgtyNEL!;m^VZD4_Y=}xaAe@6&;0)0wM20Zqk
zyo>kiieBD=c1mIS>_P7B!Dn>(-T7$;9bW72QA}!FxSWD5{}BegEeLkv$_Ab}_{H@2
z*QZY@CT|$}ZIdInC)QpngOL4SKD|k~5zB#KH{#sb%fyC^o=vmD1lFqa0rD%r9%b1D
z(Vg!4?w<<S4Qspjj&1SmRbt^0>9tIJ!hiU5{{u!c>n}2IXps!}#}HGa`VE)zSs*}4
zTyWZu6-g^9kOFL88pv|5-b*XX0_B8%7ZOV{Mr)H{;P-6n#aW&U^?JtyiBjh>b*qP;
ziB-J91dhxTd1_pusK*Idc6zkbmVlg9gj75m`mx&{mxtMoTs+IE^qdTG<n()D|545r
zBX?MSFvPBfx6oQg+V97MWWz8ic5X<YDWX9(rvdi63kN24Ag~qr@$at<f=)7oyR#hb
z&dDfoO2_T<GD^6cTLDv8kIRcP5*bju@v*Z74)g%kGTUdT5|@bYnY&In=~N`sgjZJm
zq7BCv`mgWdz>D&C@%O2oa!y4*YJs#E>z;wXe(|%rMSuP9EgzXSw^41|!={S(l?JGL
z>yTc5F<v=fJpl8G`QZb^u1QMz?Embtj;4KagSXveDhTQpKu_&t#_8$bLL+`km0xG}
z&stU7>G3$|iY?dLF%jZRqZlIViXcpB=p``~v>w8if#TVb{#L%^{|oZgq@Af|>%M<<
z15Ri7IRN3S!HMgLNz4;kZ8-2Ccit8n>T2xWeu^eDCjnH5`{(7wCRO@x>2FaYwgYcH
z#oqYhhn-{>2IMx;-Lp_BotGt2Z1FNq^^)d)Of)$3@&zMyl-Q2K9DZyDQ`o>?oUl}2
zm~9~*1c#2wwPM<pRP|F<$hqm<T1&hA{1~aC)bIn6FMk4K#}#<MI(0pA3=!E6UQil$
zbyFn1^nhZS>U7^wyV$oU9krUMwUSv>Z?>$lYfj6A-TiGh`F}k7IC(*V8^{!0?BSu1
zS%%>9TWLt6&X@@kKj+YB*_p6%HRGRh0e()y<_}|_fWj1YW4l*d09*9OwajtQl~ae|
zz_cz4#K%hjHlyEux^#ZTb*_vD%pl~<yErfoH9CuJi*S0-WgGWqQWgs(NadEz^H}WN
z{n7~G`yf|P!NPx1)*8d%<odj7))*Jl2(Qjd5mP2-Fgc*Z?E^D+u#nYkBZBgu(Jj=)
zvTX957U#<$@eGHQB`->w7c;(@)2CbwAnN1RC8y|@^>!ok0QnnI_{mvCpSHr=PgNlP
zCc?in{Ao{*WLwt$X4Oo@UX8=|A$)#|X|qvZ|0S0Y{U=DzbDk-Ye;CN&io5`h8+E0K
zus@dscx>K)A<MY2Y)B*3^M|7I)srsPPHa*hEw^R%^n9G=DDa`e6~!QsZ@tD?hLcyO
z&S!I8Ve+@M2XlAFvvFRorgB@J%_6Yq_FZRV6<PP6|HWx5taK{R78&X!D!3M>0?qT3
zltgK)UlSx3rIWv?6fd?}{)D-+<#eK_`21NsSq4Qq@$iO<6WF9d-F+Lj0q;>yB!D3+
z?0a<rD-P^=C9kKBrV8v!y&s+l{%(fmI|SqAWmc-6q!GQM#HBSwa>H#4!vY$i!r^@K
z%zy6zA<Um?m+w}nBG(dYLg1&I7%Mbk+IWYWDNWqcpAn&5WoI=m%^!MIKz%q1*Bm=3
z6PH+NM0$c4d3Dx79c|-W1cmSXlEizM)h2(7puE~65n|khYYklRfrJ~WVCqWru60$u
zI@p|@B&Gfj8pr=H8YcjLv+)*boxf%OmyJiH>yffSZQA~}!J@cOvK5*SFqTVJT;Vz1
z<NIN#;AIw_x(I<kV{%;1cd22J7;vufzExu)#r{7-fCPh6{YX|(@2Whzk%c%lDu>mU
zhYeBx2Zu%7R{*A#By_B{Dxbp!iuv7Pye^l8;~uL%@a|hI1FodWq(%=wZA$imJ2H+4
zc5&6a7!lFvf>hiYePLc(Lc%Yo>TRpbovW-vE_*@qOmZ^UxfG;xv&%N~koS(JZ-%mh
zPye|&g7VB0xLY!-$pHlwSf9}4bAfyWtz5roW2wG6Sbbeeqi>T~SI$u{KeAagAKnkk
z)5WR<a%c4&t(iH>wJa`gD(8(7tu`j93vzP2k6GnSDS`7*NG$r&#XULwDhy|flq?MY
zt00>ABJ2&Pezq$1_VOlx1zTa-<Rv7<um4k~jxg66$~<<Yb{CJ^E!*FC;;+rJQ`)%8
zS1<w>0n%>vpo!(WjUUY%N}CS`nEM5NTT#O$a7(_ohDO2<2LfQ?Schs3%68}s74bKu
z`JF{7p<HzZuJ~uT2By=BX-*yH3@wWuYfDj9CfNRvCJB8wZR5Ghs0~E4#7}8-&8m1&
znlMO7md0p%m?ulxu9#NNdA*;jcRvy92Nky;T~3*00g~XQRv73CEp<X*<yw&iFNb`y
zz}>?7K^M#0L++ww-QG}HMIUI|Jwa5IedqgXkfUbXaggUOm$oYuwi;x@LduaR8vm95
zJTU#IX(#0q>(<!DB8cL5IXE7<x|WcTdbe@)4bFu3%rN8(+sYUBRMsi~)}-3OpPy~p
zyYR2O1UXXndVQp0Kp8x${o~g%9aM=2eiFy*800g=c3Vi?^LaNWehtKvJvY62QC==2
z{U*bZD~^N;*B-2|%U|VpOP8)a;G(F7y^{k*dp#d+;5*><*Mh|DBkLl8?v`8>46|&h
zWKbFi=N_<oZC0)DU7`&4*a}U?=<Z}Y1~fEvVJ*UwhI&=ZPne@~($wLJ@g*Pts}^up
zqQr9?_i>3iXShP?cu7-k@+I&#QbsVa@5Wftb54(`RKN&Y2S-AMT+clRd)XW!e&MCm
zw3-GR2ynl*AHuvpuxD9x!XDz<i+eJpkNyE$tEOwNd5etI%Vx4sr0&f*@ZfTA$!1<(
zCOnMJyFkWm%npim{vg~-ez{!$rVk2fBnto;=l(Lw6@(Z4e5-yhj%m33mVc*}&PB#3
z-Y$VOk<~g&Pr1_&<(?6C`p;^Nd4q!#a7Q=p{tb>2y%&bjWMV?c7Kh-ao>YS(C`c5+
zPkcMIN1H{)dOj{JTyr>ZXzi0i9HGCgt|*?!%NiI-J9f!#$;RMiJ?7hhZqCcHY_JU{
zV5LFy4A2lDRM!iR7>C~%EssMio0Ncdegv$|y!Jky^?}#}bQ`7;<1kGIB;6?Ma(RSJ
zMfp*TPI&^J^FC$EY3V{msa&;AqCeNsN?3lowW#z5@)75X{ZAq+omo<7|5p@=D>cF0
zV|L|Dx%{6f0{ovTLPcCkc6K~&qBVVthEj>rMw&hf)H0=r9`N`i&>P<#Un&LJ2Gfm9
zRvP`#2|enAl8mfYqK^F4yyr#q$S#-nMwWiVg8Of}H<>i<AdexCRYm->SgT$#$})r{
zg$lRxShwmo;~iU(u87)6{BuA3&ZqDeE#=Q1xj~={ttI0eG4x5RIVlsi{_O)y$(fGm
zYqK&m)yejY`eUPqfHqXtYNUt{dZzV`Nl+TpqiWn<uNr%ab&e2*YvbJ2-&>@JjLJ(w
z=k=~2s?4gt+e|4=Q`4KO4*cPzQn9y_ng59NG41$lWIh~EK8T=_Y<KfJgJQsKrta8p
zY8Zg5U<BifkP|df@GKS@PHL^xJ-L9ca5=6*u9N70VjsR1`wPxR|20R{2SxvU=IYZT
zcGZjpiRn<bmv38(>t1v?`ehnJuEhw$^6Mfkc1Qc_m#~6X3sdnYRs?+l-VxoZm&0A1
z=cl0*e*QIt=y-8k`?pFs?{Y@O8(#jq1Ni4Ofhm{BsCjEE2xj5AIoL|jVd=a#(_3%|
zGPUb9M;Nr<^^tHsISfkgF)v}_dpYrk@X#UDw*i5-L-bv>TTnTLBj%aGIEq3LXMc&$
z3ns-+IulKl041f~8OoF?@OdK$Le7}fsNAwoP2_ILyuKi}K9X`_y`oqaLCBYv280Yg
zp@mHwUipTFW12lF_+}~}>$M^`=OGg-xtE**uF+BKdHeD<qfLs!in8X+5YW=K;<Yvf
zBqm?F^*EIrde>5RtI0B?7d%aT)(PKv5C{gW1`aXi{*4C|UL88MeSwni;vL_}NOf`h
ziUR?1N4r$5T?g%rEuW(9FSfZ2U`RwsNRdnan22@(#iHNB!qGA2wg=N*@GLKJ(0$#}
z@TS~AVBrBOF+zu~z5?CUGx%-g73%3Tiku+3<rji9N8F;3c>YxEle-<Vu)7J$DK<RQ
zTF~&$0--=5-!aq0p~wQs7VtJGNhM>Wkk4}C(!OW2@OSY{d5n6>O(ek-km6qyFp=@I
zkU0rK%1gj0+XqoxW~`+yIT>zqfg{PXWEyM_T{hyM@jx-vqiTtXxn(eI<Vo9WGneq{
z%p>EMqo519+@7-4i+5U>K2FGxwL-1Ac7fvuS<7vr2hRW#=yR}XKHHz*m$)z8#ABAW
znKTV-WaKn&+PbQ4p)%t&AZSUog^9?w-;>rID@X5uxnA$f&J;(q-kwD9lzD9ZFH2FO
z&^;>I%o8n27wStK>*VS9A<mxGW_BJWjJdj>0DdpxS{Ta8qwO{~%;o^{aG%;1ge5Cd
zoMNWuJMl28pd-mxM#+b{!8Zo@uP0JQF<DsNzK(D%+&Rbg{tJ);R)LbWZ^`FSNzK-(
zOiH7JXkjfIo}&k>S>6tWY4miZ=M($+JsE}a>vx81oJHL)*0+XI3{J4csHf=%b%ABb
zNvRL=wl?8m%hgB2R`|nw!Sw?enJW46^OC=hF+cl_1;)nz`PWYR@y1o4%wmx3`>2o9
zKpM#!!wDAiUg!=3Tfas7eF=I-p*Y%bvaB$E1dD{kG>IJQ_m0Ok)kBOnnWLlBXn<4O
zls$>+vJ8v<<2ym~!;38gqLq~ma-T^u_?ao`(dabM-S2Wco@qXYs9tKM;_e7=G)0><
zj=n)MJayR_RfM>*$P(hW`dNE#Ed&WWTjS<WpBwqL4E0~Y**+a)W`Sq9B=Q!B{uiT!
z+QUBpcyu5YLNdhX;2ycl7<$wZ0G{+ck=afUV>gjBxaJSV8-mqHn-r5VWQGNWIOE*c
zlZyDBnJCH1t-*Gx0oXye=+tqYA5MuknoA4A#`pKTR44my_e6-?>2lB;ONIMH<jPA?
zf2HIT&Ix&7o@HVANU0`44r54SxGDPFWT20^CWDq%QSid8mS761<{L(<5N#CMIDAUv
zP{oBw=WQe3N)!JO#%0Me<wnr;1jQ7HT~(v18&zj09!EC&e4+azbeEtHwkgf@Hv@iU
z59%v#u--UWgDbS!p7x!4GcUBWkR&U8RPM%nAZY}WBN|V!ZJ*>ag5L4y^FDCh=l`P_
zGu+mfJUyIS+EBc1y8K(pQ)Okl7Wy8NSOkAcC30D=d)v8Zm*NPVf6n*lYLPhQ!zpwZ
z>D9%l%kEz36g4Qjsf3A=oUDo)SP2DO`RWenjOS<n>~fb$v+$>Px;FetkBDEsRC5mk
zseT2ljSh(IeIw<B!c&6AQ3%78Lym0W;uU%4Z*9;~G@15Cq*^^SOx*C!u1Y8>;U`M$
zoSJuo{NfuLDh7(Dh}D~@esPO>vI)Mq*BdMSU<XsU{fXH3Mlajbb$V<FI->@@y_^Md
zM$2A{+6wgu2r*PE?Edu@y8G5Q*Ce!tO4$iCNDTD+ZfhCIx%hq88d|&0pGJI%*baP_
zw4e@l8qU^SfAMp(Uc&=>;_J;W_Hl6!cV7ZF6Mj%jKtWqsFcPiBF;in%5}T$oF=+nx
zM3w5gLg%7HOIcX7zxE6TTsQSs*@Btnz>|-yNcA|z^gLTc5R(oQ@pnTEF3k~Z1rUt1
z2<<v?2*QaObQ;f#_;9GMZxO;XAj1Qt7H@%1Zh<|LaHz3%x15_QrOapo#wNrn!z42f
zSJU=lb{EN&eKgkDDjNiw0sP1^vA(h@F~e@OQ%$%G^ydY+yCXw$G$eh|eA&zoIuXmk
z^vmPx){^$=8OrO$en@YW8%FlAZlF$)vNID6Gq$tbMEwWI8PP*sz9qL?I=bPqS+}v*
z-|Ikck}ZkfX%)CqWJ_OPpI2WEsoMFIOU^2&i-(FBxxsVgxn8N0N5_=f@quQfmLe<r
zCltGDr4D{e+V>Wl%{-`Nv({A^z7d^Fc5d)80+?Q_2y9w0_3?Wh>X7{$Y`_jJw)J%R
zm!#$<8|U%`t11#Kldl?z=(+DHI|DF_-vIa&QcIIHWxAH%K`}oXQwkj`2GHXFBe4|G
zDxH)Pp0y=1Q$Hhhk?(4zP^?!71$iTmBZ{7(L52R8w;d`Ob%<gYr*(yxdhv8R+I9c#
zKT9x=;2zAk8i4n$zmx^0;Grzm`w$#Q1|r62rX6Pl_?B?z5IqM7EmHTxdRMfQv{zo=
zLE67}bh51QUuxd3m|`q(ncJ%shpaKmy`IH?8dm70^bXv<G3aCqi0Y@#of%bDgZ-Q!
znCK6%!&xDz4vn~cS;^;KEIY}pW<AXFMX9t)DqTmk9hE|@e-{HnQW6gH6?N%H-;+fL
z>{_k4ugjzBq<6H#-Zr_T+vZ#)ue=mG-8m^A9Ag<Uy=C-ATfccp*JtVVb@82WF#9ru
z<FsC>jVBs{oxXT%MgC#XSvy{y7x5{jzYd!~Rn$ex10a|j=E7yr3S5jrIkmLXL0d<{
zksdd+rulznS_lA<zpwgKY&G@+gSYR+%b*#4AtZ=$|8C~w{#AKsCsjniIcDXYE>UNi
zstLwmEDZ2;kY(mQpq|E6*=_`UACX-;ZVe1j7;>nG7vpm;L|Du#O*Mx-^?Lt|BSi3Y
zwQwGg!Fk(Foi#ukP3g`#EH|Zjy+dcze;?&znfQyhvp5MPhRk6oItPHcl3DTUWZ|Fk
ztK9z10QA1(?|;)cgs<!~k6k8mzl^>C9-*SiRwb+1E=+AeA(<@slI%0-K@0=}H;J>V
z0pGN0l|pixr9fE0MhS0Crl=y)jWS<b3=7zCPwJJ1z*XOX4@}&Fl!pwke|_LO>E0{P
zT!EG;nH<<l%)bu+fi6W+fc)Vu3&w=Q`DzFpUWnNBjYoJBdnWnk^wuTOB}@tJ_}pyQ
zT3yVY_A@jTQN$=Mtt6uCiYv6Dwf#H6(c}BM*%Dsn;eInDC{PFS+mZLz=@spDO@Q0l
zIDn3v$Wz9ZyPF~K1S$NlvWsPmTc~96ptBP0@GQ`VcuK3^;Oc)kBM@IDma6vvOD1;;
zMfI>pUd)jES{7Flb8igP<u3y*U2vjt&Ku)5$&lscmKAPnuKyf^S%8LWTI&Wg)PT0y
zRvV$D&8J0TTOSNPSX*(#KwcLTOdFRqXlNFLdraRuww#xF>qb0jgtULXESMJ5Al?U_
z{7XiOJCmy?Iv(vJyW{$?LPoDX^?+s_5Q8`4R(enw(5h8z2#%q(OZ>%Qnvk0s@+`NQ
zos^8CgKhr{6lgrw!6i8>)4EZ;lhY0+cBhu6KUQ@a+gbjqzva~*-6ysdVRPx}NiJ`3
z?CVKs2hi9|wS{fEbXI>@u(YP4ati?}0s~Y%t-($Li}=dvCAk#|qS4^Iq4hecA<w01
zt_u?>O!;oSYa$P-?=lvNearioIL$dh;v+PC*>f#qI~#eWHl602OKg#|8Zt887A>5y
z-iS35LR@xA#TLOw5K-andnqk&gg_+XpQD%eHRctM>2{%AR`Px!Js}9gcyR$yKF)HA
zY44haF&$KiA9D{Ret|LD4m7ClnTWF!<Cj>QX#Ami#60xswuZoSmVk1IgWbofBw(VA
z5#SsJ@U-!{xNIF$c#f>!>F9#yR&mrRIn69p5+Q;IRCa;lljsCA_t4|Ap}j|DcG_yL
zXcO2VA_r2^iTd1QQRfrL*n|Oln3VyNkyJiyGenFH?r>86oO6GZSRtY{Yqyc$A8}$2
z3J2Mxbrr<++OcXZX0+??#dz?qVBu^ME4Z}+V$$0!-iU@m4~|!6F|oa4FO03dC!J)M
z)#RQU0oq^~7wf~U?!yjIT;^M7Y$vGUR~~?XNn=nX7&A8?1z1&uzEI#9<jQPB=w>fs
ztu^kXvz%UCqf(zk<#TLPAxkLJwjK<t!8x-_I^zINy$`f?ND{o(W&Ai!Id62AZD$|#
z#8$hg2El2^3OoineujyO!i}5_UW(mIWFeY_H{AI}A+j37%SPDP2ojRY62YnR;(c9>
z6(|RS+5iJQjT>OZSq?Zf2l%BRA3vvbYPY&VMH&S)T)QuEg#Fk`9!3%Vi4)5kN-pr~
zu-}3DQ@y4;v?~N5!o#m<C)PXF?eke=3+7#a(m322GyP=dlUes3H<9wX)f2O2iZ(hb
zdWRyDm@PM01i)MS<0e@STFzpqfTqo}ok<(9`?V2L^>=CeAp{U3Gt}5{02zXodMTos
zCRQBb^ujHe05ZTY4fL0AZ#d@nS01ldEN~D8r|W*l0%3mpelS+(bwrXwRgEa<o|ra{
zH}s?hJ!Q>rhr2qI5Z%93x7=i8N$)w%0>9++SX98VVkQV-hB1cA#PsvRRzAq&&h_+o
z5(&fRv^o+|ffBfKCyV?hd!x4QK!6oJ+UkDzlYMx9d+C|XtdJQC7(GO6a)aOUh7%<)
zyk~F5G@|*gSHI9D`Y$sm2L5m^8b0HYCq<a~27?&Cd93zN8^W(@E7}a>pKwhQ|N0AK
zhp$F3`Fs?z(WCpZ-6yw>-{k9{(Otio_@w1YIl9~aDSU6&Z7CkR&V*n4$>ZhGYBBJp
zbR8rSvQ3x~2tzJj3bgEVc|9>xb=Pr|!>tnC;wp^}r#*+EqBCw)dq+fmg$5>_(Uq5b
zVeoVp2vcEWcSP<PPcZqGTdF=i<`MGRfX|PZWr)+gAL6mBec@{rZ5P5PV#f2Ga)L1C
z=u-SFA~OOmjx;4^Iu9NleJgw>s9~~)kA=-L*0JhiEFw}I)ODs?(qq;M`$OVE38Pis
z+4~3wrgM@AKsh*3sgw{*Yo||wE--!$=r?8BuryPeFwYP`lB-hpy)TwT#ds}cg~%2b
zm=j#D$k8qV)O1HcS@H$_w@A}_oyz)zDh~0fPXU}|GY}q6MG2;?X@r9@ig&95Gr*xw
zJb!t4G3Y$6xxRXT=Y)z0u-PLI@c!C-`T3e{20|&frv?d7L@H~YPCR(WOR&DZ$4gw1
z7&Q?}WZshI4V%;*Vuxo<W**-wki}05+Ke&t$%r4uK}}A<*NbzfnydcD3*p!dbF>T@
z6#~>!w9%y97ecZ?tf11sPxDIiAP8Os8^&Tr69Cf8X`dzYG8so{<FVVqpAm_oX{W@(
zF5qy0Ei3!3E9zRuv?oiaCKi}#!8nac2lQ~yZ<T+l6QnYd&@lz1_+@V-ui^Bq*oU+1
zV~-Z|PTd|JZ{VXRYBU8~i(BL7Ak7Nm2LSQ9f`vY5vAYTM%UVm@KZUXmL**$H3TxAB
z2-XpNx!-{N*>YcsUv)BS^H!ak&OgbfRXZ`H6SZ2T(fM_JZk<dDdG(B_!H*t?JgAQg
z=W}5X((~vPwf7fN8NtyGqAhsNWAk{7RuY#?OB#mpY^pb*#;SX=)h5X9AsDgu&wy$b
zH@IHd3#O>U&Psb<h*7^h$@a;bkFWj%XIR1NS~Rc$LGGX|5q%tQWAjlf6hS4_I{0FY
zrv(>va&teGG0j37%P7FOzRF=6>{8E5suM?JjK_5)n!AyJymaf9r}JwUPO~zeOZNK7
z*x-z<uKbEe>^BLz821+6voI_%K)AM%JdLy2F`;tyV*6sHqx+gS<i^v$=xV|j>Ob;L
z;;yHhDu1>pty=U;f=bs~TQbk*=w`0o-jTW9;HweN-e_T|KN_y$n>o9Ro^kJXFBZM3
z>5$~PaDJl<)&5Xd8v<>lfaYnRt}RwB$jq^7rScrKo|&Mi8X70iODS9F1gcS|F2O6h
z!t))yF);>5HYl4&5}L=?0U5M(MJu?=@F}wGnjnl1_<=^Pwb(ykDDqxud}Z*;<J6;s
zL0LqW#}Kvs6K9d{$fB*3Xn)QkN_H5%Q$}<%0f+IyJps^Dd~~j)#TlZOZ{@>@g5`!X
zzw<4pER>!@%<}x@Jc9BxfiLakADb*;39^ZKhRntWxO!N-*eOAY955yhV1k}PfrgQG
z)#%mMF}Qa^>QgYIVUz&XL{cXa7O1l)lDyotOi~U%#^oPzsef29tp|JU^4?ZRQo;z!
ztydo94x!+b_%5W(M`Y#?ch~&Vp6jw;Hw{uxEiipkUwg3hB!Yjf0tZ@!x_DdycwEIg
zl0)-+)(SYXY-dsA!;W-LYE*-fnD4y-Hbw0=zhs5ist1xR6x-WY1xCBj+Ou_ip3z<k
z-nF$mAD|eLlGh2-8Iy%OBT_Ae_!}y+*fVK<iyww6CA+Vff$6-c#RejiAyD0(so_$o
zRr~4MtF9`m<ge<^1GS%ufBcFYH;2?*MAG25RjRv`Jg(1&&$;a4C3G4S<9>eR5d6vI
z<z!ZjCXa!M;VM=iT}kz;0y!A+tAwn<=bzP11*P*$i^f|iUL!5#WG(gwY*Fyf$<-@T
zx`$y=mcoS%oXSr*mT_vw^z6qcCgd(AxF|KoY9{)cDKxaRM4*Q+%1)w~biJaqjnU^n
zfmDii+1HI!3hmoi)w^ag;jycc^Fx{E9=oxdB!8<|yS6ll*ighwrgNN>IJNZ$pOIUD
z%xchO<9BVHzyA6kkI@vQtx1vQx@D-#G>tZ^JAhUR40*@jt(|3o?!K!%f-Frpn>Cb}
zDG<G>j1+SXEucrc0d;!Mlh2hV^bd=*>MF3~rW!6R4jXF|>RNyeZMBsr13P`Y-1NrM
z<I+QEGRK;H`8uN_huGNv9?mb+E7QJU#VhxT%f^1KsTzA_8IQO0+sZl**!<9gWw!@^
z8t@f0eg4pn=k`btQKQNx(U4h9chdoX^t>P`ANc{VzDfHM<zv2SqVJOchS)Ow*_(m|
z5E6HvQH<*AN}~&8Axa8k`rp-ev&IFKQv4t!6xIiioK(+vk39}S<y9xeZ4dUxhHe<-
zn?BO>Oz!k&JCr)9?PpEO5PNA%QR9IOK_%>nY}Wt7SlNytxXFhsD+c-)-8e76C?`0^
zXXBgg-R%R{v_f6!%bnpA(fk=gOo0YWw5+CkT8tkqf=a#JC8!=<Hbewn=J(F}G0f5H
zmy%uck9j2dWG`{o(-nQioNnpZ6pvDeN89-qbhkdajJrC$im7DIg8eY<M^jz?OZwNt
z-7r9r-C9rd<s7Xdz5*tRlldrM|2tm0f13ynz8QZ;5hE)U*oCSkIy}=5nFsp-fn?7k
z5+-*BLa&JRvdDjoK2fRjDBt#`i5>B;p143V*?T-*syDBXwn%$)J@?uxym+Ds*IEl6
zq(`uA7+pOjn{AIlyqlabl_HcCcea@s0jK4z%^wg&ujw{iMuJ{!TD8E<77&#0o^IjE
zZQ!N9i_Ub=%-ps!7Jyve;XgFjKU2qD@+EPeB^-SkiDb9(Xc4SRqWFu-v7Q9glu42$
znW~nOG(u6k99)R~lj-luLApO=kQyHaW~vazUK`v%$;sOaOn3-k%&DdkKfCQX#xfqC
zaf<}Db2c8<GBb6p4^V<5@aVgMK+SDj<AA=iigB*UNz~Tgw%ML0BJ`*4^qE{pKhe_t
z!s;tYhV9YBP|<5<+#oonA7A$)B*!bLA8YB8_lQo-=-y@DC^3=OQy;VOJ2R^LniaVF
zdUeH*?rKA^2gHQF5obMco|0+VkoNA2I9#8{9zTJeHzt0+P2kAYkvlPx=i7fM=k|g|
z%cKGS%hB^S-wpxw)7Q0BxkscHo!!f2pRL>4Ob#}U9m+G5dGwE!SulKbmAX1<@P%u=
za-FALvgd1`G{F-Znu3{zr<=Wt=Tlext~hLaWRLrAbh>$WxOmZ@ME!+l(0McTivkTx
zl=;0+CRGa$$Y&&kd|9{PcZINB4_0!z;z}xzBn5uH5*rJi&AiMEmK`lU{c%M|bCtvk
z&|I!(I^|oBGqgJ3+M%pOq~OUNkVn3z;t;?i9=<WEBp#+RLjV$XS-u2s4?A7RzXz!5
zPTUYo^<@x&;33U1G2?zWNx5jWunjZ@sno|ir@l}DZ9;rbf~WD3##zAOn-Q=RQf`R*
zd1FSUMH3xe5Q@>mL#VK6IcN1ORqWC)$+jGHay=Bp3^19PY3m*Mp)KByK-^L3KThfG
z-pbe%-Do0caG<odY6SyD5aPJxfBB=-?#cN7A=^dOM}2;0Gw!-IO;>u1KVL&67j2Um
zsLeqDZr2i|8Xju#b8Peu#!3+oDDJ5k)7TltNyqxi8Z6Xqf{S!GGHE-kVQWkI{W9WL
z3BabDD9d&-occcihd_A0Zj^nFUh&%x(72@wEDEJ#sDLtCKQO}iWB2)hs*KR<_HlkP
z_WIuOa&@DZu+Y3lC$Hst$X02BZ50fINzRI^Ym#5Fh%J9uTuk<7;pEYG&7{mzK937k
z5X;L=G&4gNTI=gBcvII|p%=hXXHpGRrOv{v!z#%*!FB_GdZ{!(mw4b=yF@qU>_U|f
z7!TAcR{&zUF0|G+a`HUNtM$5x2(MNrBAN_Nklc4(rZb~<OA>Ku*Xs56x7d&2G6JDL
zxY(}YE*5{M0^2j9pr0mePwNUC0mx2$yPJ>M-GVe7euwS7hGvf+#b|`OI_i<>p^7`*
z)XMA1gOk<WS%&7Q2Jx}$YX&wv=3>HB1?#5mFvs<YVtP+OcPA6_lu=3&0l87}=-Rvz
z*&V*x+<T=mIY_6+1FcR<oyS+{$FIdujoxEDo34MW2R_veteb|14OL^<W4en2LOq`u
zff4Kr9e>h}RwDXaXd*kwDIT{rQrs3>r!=Z4?^i`xUQ2v8j;W^X?C?<)maReeQd(}9
z=5WR3hDJ6hFV{;QLxI_TWChgxT1UN=n4KqEC^Gl0>Zr_o3RxZH{*M~X?LT8)$48{%
z8a02KPininFWacq+`e?9R<qyFQ#m%}sd<tXO?^y6a#H&GJ{2H|{p;1S`D#FC`<bn7
z^%}v*ewA2y+9P#8zNHDHt1vxTO{wKlqT8;Eea$zq;kXv|bYfzaF^?Elpm>J$bgUTf
z;%{li==MHZF*Y2^ckz?4V(0<Ub!z%pVIF_MhOGwJGwc8>RMn^&*tX)27-9Xa7-4*J
zR*bDv8m$=Lz=~1c-N&?IgmIA(oMiLk+b_!D_P1ZOCwQR!qTR?g`$enN@$466v$egU
z)zLuvMfF%W>=!#$^+DJ#8i_wt1$Bt5c_&sGm#Zu6LVa<eO`kv#kcV$2DXHwqX-R)Z
zzwgu3|BY6Xr>E|1yq}|$Wc$*MR+4@{PvzLW18yzJ=A)J57&~!{{N47WPvAX9HS{+L
zG_;Q=t9B$zp_WN)Y&ncz!#5S|skV((76gn0Dpic#iNeObTL<Oca<J4`R*5B^O3p1u
zv2ELSf!K(H4a;NLQFIMkn&tTp)h&PD^T(W9W6rI6$+`75%<=+*3X9MJ{To@N-=kmH
z4gQ_QKA7r60^ok>v?}9!(}EzB_@$LFXDk-#{%eK;=v$=5k=eF$7BLE0c~h2!iT@mi
z@`4w`R1Ps?0`nxl4$~ZA#PXEUkVMf6B{9npi84m~6`~}|R>H~wIi{c}$ryhk2$EkV
zF-kK=ms!p&4^`To8S)_U7Uc2~bASYeS+WRoh9<9nd?T|~<;ygUR+wIcvXB%7p`Y`;
z3AQeIsw*!ev5#YR(^!(&Z;q4XBEl-o!UR%@pp1P9+0FN5_ASU!&Qp@nh=dCmy$93!
z979Gf-aJn!M6x3O|Ji#J<+x9cC2jOoYB+IzlDb_a_JuM%BTKfA{*f&mE$74?QQ;|6
z6}mA*18o3Jsy#k`+*i17pl8ve+$Xt_RfV-TG)YNZzzAC;P^b-6h0HI%%;dKmy9G^K
ze}vSx9N)&_|IgmLF2{{)X`-)!t?u1cY7#Op;LTO47+1Nxw@+8Od~DY~agOb9;Kmf&
zOfomgl&qMTh<=Cjcjo2#NhTJ+d*0=gtV~f6RhBYI00b9+b@|q}m|<bUT#l(_**Nrq
z&|?AdZ10dcz22v@wW0Yc1yZZRT}$y@f9JlH7=jfcerR%Gk9i0{Uy$fq6+aJs*Ym<q
zV#Dw#CMKuYH-*F|m5vZ*APkp2?vq9%ec{X~QL*_BBD79!zU3@hQ4XoYP})DW{y#b^
zqm}I%*7s%gY%Y7<jBm%1*R4SNlTQ~-GpguyGjgbV-7;A|JgJBH<kLm<M8oNQf7E4M
zTB33QJV}`pFKG5<pf@^ssLVv;qoa^*YZAMl;2nbp)c0-d5@KOu2#%RgLhN`{gp3h)
zqhojVm!EC{lZL$92v#4B{}JU8i{hxb*?{_<RZbtsH&H$j%GTn!0VGMYsMJlP{MUcZ
zY5YFDe-!-Mlk2#U@1euFMJxwPe+S_2j%DD01|GH~;T9*v6MR*=#ejUTe+K0H9(jvO
zWnD$Tf1z=V-p$!G%JWK>-G#)c4`x@$={N@3<yo46mB4O*RtHGx6>)BLWe$B7<poqs
zRcRzJF?3<%4wCj9y-VjAZ_@<j^^nWbFp3}hmpGk^=d+o%JvJiTe@%Egf6rhl)ChH1
zW*D|Aom&FPS3Y5$wyY_Dix=~x%@9)p^Rr0JH9TQ!)Hz%@ofYv7pwD?chZ4dN3)Tb3
zfv36(gXMHuq2b3+EO!>u8^vR-%1*;zP$YmaySUNC;;U*^8or)}h@zq*k*gr=&(JKo
zg0eiyEG+Mb+SE}}R^ExGe>0ioX`*?T6j>7x&*8E<5xk`wQI=kTsflu)&LoP8Jp<nJ
zIol2J?hwvGW(C-CEyy%-9qe=FU`nhoB#fBSwI8>KU=85CB5kjPyd$vniZ0rMzq$N7
ztSw!qU9Evqz|YYiK(GxeNvs63-4&R?%2JmCD39x<t{2l&2!5sWe*(o(DESSKWxWR|
zPIz5DO^jOH*Q^(1?QRqug66j`&;^>&ESI0bi+B2#UaPBK(1LcUoMBVRL|Kcu&Jce4
z;=K7n)i9}sUnW5>xnb!w9scKbU*NB>f{!O^QkORmRMD#TN>$E87jjl_8Mge7C!>Dq
z08CO->SXDdq2o@Qe`*AMR|?QnHVxbgEnaQ5Z(E0mV!vF>OxSYRttY>uK||wfM_lDJ
z>}{f-!+P4&OuuU%$ExAh$Oo3H0ieI)h#6R_29~OgKLbnEqh_gs1Mj#2`os*RaEXH@
z<0d8|G%*W819OiMV%U_CV72$`;YYAr{()@)`aPw;t=z9bf9O8|_`MR;M*zQfsTVlR
zpxC#hg^A@+>{D)F%0lKa=14-kqYzg#jlQmz)3#u?YaJ^-X9dAJt&HN**D@-3tCgOg
zp;IO4X{H7J4y1TzxDZJ3@gwuikZ{Kdee79*0e+qkGsB`-+NMn$*JnW(K5jqH8f5-j
zKTo~G?*z!de@A!DTFn38>sjgRS&<T<{SmiHeptA5>okXa&ia5KaF=NJNxlZC(|6R2
z#@b!6`OXD*$$_Rf^yjI}U1)u*6C4(%rM$5H`H<)^Bs%P0eLh+{&l8*(wxC$Zz{SM&
zeH<8+V1wGB&1v8Z?mlj%Lnk_@!ZOj<Wx1_wy`ZmZe|Hq?RdCb3qM`Kfj(rJbVQST8
zw8{#Ft43|r<Og(H)kJ9~M-ftLe}B5yD3IzJ1Siebw!CYgX4`ge5l-p9no=+?P_&J9
zF|Iz;zrwidCfDZXG>w$6H7_zwi{%doO+%<}T#pYv8GSq%4bb2RpV(7c>PLHA`h*%L
zF(q~&e@BB5%f^&51KXU~#G)i%p>@E1rk6C%C3-C<RFOlTzI;7W%6Z3M%5K`n%DaLV
z8$72q(r5ue1$39tkQ7ZlsC<lAmVQxX!LO5EZ#ndaPT?e#Unv}z=&gj(Qc!H_Zy8lq
zHF}>>{zaeJvn&OMIxzR)-nl9!t`67=wXt{if0lEbXo7yQBX@8yi-|B4*bSJ0iOCGi
zgrJyN#A04ZspQ5ZSUm4Fe(oPK6A>@A2s*TtJcT;eD+t8<N;iUN4$wGQMsrY?z%+-~
z*Ig+p#U@H7WAr*L-p%NAjNt#HbM#K>xKMDhUZUMJDrm2)Z+IC^E@RCt+|+QJ(Ah&-
ze@WGp9QRscf(4#50!)aoFfpmXGzdZ**rp`ZH{F1*q91=$cH7bgbsDOrnv_d*RC|wm
zrreGP&lsF#1)M#L$IkH>RBJGLi)P6ZrrW%rS&=IW>_ywB^Q6reO37F`diCu#c1V4D
z|K7o}xNpni8<eDDwl7RO;L;}sc0z8!f8K85!1pX1n9TO5M?ymmyd&Sbt*caWt%U7I
ze;W4oo%eRF1eZE+duMN*f$iNMj@T%fXzK9M=)80PXjNUUB^RwdAUZb;hr&S|3e^%m
z=3~LJeJ%;LF*U;w6Xpv{iR)s^^lT{@v$*gMoKMCy&>O4F2}2^C(kM|0a4%mke;CnS
zllgsJC#Jrw!yB{O<+NCA5=!0W=jiXz<Pz)3G<BOQtU?nJ3028OW$!6xQd5{kA2(1U
z<zZOD)zFXI5)POzn87`4u@Lg!Jr7f98Q3*U;u?m@Ld!n<wGkyEx{Ab{#?3O>etop=
zu5SItHS#bdd`HHm1C{VFWHK-)f5WB~a7?_A;y_T29fMQmSUwew^SFII3lvdrEOaW9
zD;cLVIqDw|OJexzLlj-RB1fkSF^j<lxP^b`jiu?NUa0rdbMJJ&T&3YJy{b|1+n)E1
zqW|H^8>?i*Li%2ypz1W%XUA%_HCP7Uy^8JlA(2|`BpTnH)QSQ9&6YjZf9Lcs>WS59
zUA{K$uG)OaZF|_&9VYWBli5r4s5?F5Jc-~2)7$>x(%q-B(j(yc#jcfhluGe6n$D*$
zGtJuZBAP@648VM-6kGS4jrUEa&US=Zhw27krf&vT$gt&79}@=NVP<&PqY@JGTuJ34
zX98JJ1iN<Af=)OngAXOxe^)7AE7ZVE3gE3&zn0E7XnVJ+%s6O!gSNNyXVCWak{PtU
zJ9PUUx3=d=Dhz6v*kX>0iDfyMxt4<+hcF|s9m6n>z_G2JY%`gGZChpKD(Cc8o^5^m
z^<~X-Sl_;y(Qygp7-47$>R4;SMxIWRNWr&cGNBXMWbtUe#C(=2e|b`=#aMs$Z~{L?
zI@9xV<bHAH2R0W13s=~f*e1o)6c$vrb1cU*scEbtqCKDmqM1Zjtq_%uvwn$`4Zs@F
z6s5OZBM(Qo%O^T+={8BosT(jXO~=B7Is!9caco!yw+Xi_YbXrTGxqz30Wf=RBkEhk
zcg9E=v6Ax3n&>xsf082!r7+OxY8GFWK`)}5PFXaW19qSsB{Y{u(<r8yqP`s<!ncJ8
z!>d>Z4u;QPXmVlTldn+G@Ug03(z^#bdL>pl8tPkh`fabJOPZsPC;z<~-Bxahx(TSO
zQvD8PQB;%d57h^QhvFf7C=S6%UaN)2Z8uTVGpX$`Y&(!<f97(DX<)k8a4hN&(=biz
zky9Ehc*z%3#C;x}=cv{~pX3N~I`yF$<tRxDG|OZTd<jvq`~XF#1+X7nr}G%Buz${@
zOsXqiRSfY;oJV7zuZPc@GvU<>beb~7HuJYXU%ePXmyi~eES$;J1Pq7rcCP#dZh*a<
z%CE$#8@4%@e|I=~)$serZd-2J-@OvU(K{Ty`!ZUO`|R~uXnWjZ*l?kmrA<ss&A`GI
zrNnWAfZO2)p!(`Bhayy)icoEZLprWvR8mUn*py&55CJBZD=`a$5SyMKaN*f3ltVG9
zjrg~r7}Z{iQN5KMG}-qGBVSgf*slE4`%2f&bQ248f7Q#>LtSyIEU8-Q;bSBu7V}vg
zaavZh0X;aTh14yA77ZMy<qf(jRg_%Gyof+?Pm?{@I1=j7cPn#5m=J;KaqL-Uh>2q`
z%!uP);&3LM&<Qwq4%nOj8_f$awR-QfdWSt4kTs%ETVLA50#=Tuz0yrtm)5GP9c!%N
z809pSe_%01voV5K^;8`ox~^9~SEkar?x#fcyb@qEMTw?`1JNprY^CVAxS|P^F#9{O
zlio$}Yj<M)Qt;Gt>{f?6U_1<5ZekiZJ|>RoU}kzIHVw(G&}P(i?}41=FuVq)v39ds
zE1{h-c<6-;HR=m?q(8zi;u6`ev+ItwR%Y`Qf6;`-H!ylAYPVW|TXnw|Yklio9Zcc8
zboZ)!@I{v|%_g5aw83L^rn8GXW9%E14Hd7DIqz5ChHsyIx@fhzu_||Y45<;rt<Cu1
z+p4H}Y2rWmbWwexKTsX$-Qs;TgHF^R?_uZo@B|(OJw<<m-Q&rp3-vEp^U8hwwU8N<
zf9X>_iYK2gUggzi`lHg?hDU>%;Ce>N55~P|8geZjn{WFYcl}*zCfly(2*VGtX}S(3
zA@MMEZ5vBsTW}mmTO5zh(N`P4QROI`8#E3jds7<krf;|`5UvYo72yY%c+9}mvnY0?
z^j*s~d`moX0<Uk=H!5jA9(Ch){X~Ppe=#T=P`hE<bp;}%!lI@4mC`qO^!Kyr@1kx9
zS9-26DE6e3m~g|vz6>mE8e!mC7IP@ufao2(<G1&YYk%Bhag3WX;Jz0yEL<ir5w?p1
z!}T$9i0xArdP1yXs$SLh%K6x=$Zn@cG|H<2zdkPt%D+gV%MOp#XWG=wwa4oDf4oSi
zw1_yWZB7lxdYNX|G=o{M6kLq4_OnJR1P7M&RU}k#_*|3Osw(kkXV3|)I-W0de0Byv
zg(zX^JP{?3p}|8W3izOE5mN?L7S7ISJw{oLQQsBTV>~-s?S5VJo_U&x2y8(b|0BvH
z7R6C<vtfc~G^0~l$PA2inCbVFf2|crs7gVzsC+L`{_8*IG=871z2}NThB@fCw|T5)
zr~O(Wj4XmM`X!y+bpQGO%lOtSGc>7d7!JXNFcTBol9)*kI9)tpnj{Pz?(KbLTHm@f
zTgv_Gw2&-KzbLQICKX?A!j%#tMYQq2Jc$Z9gsgO!s1Qhr^TkKC9x#oge@XHTifsL`
zpODq!KC5=I){ci>l{@6Nkt_gNm9*gXF8f7R)%(Drqea6at~{XK4Hx~_fByfi#O;!+
zDg^A8Oo|u)U)e-e%3(LXt+=G80t2u%2Dh;Q&*68?sMS6WU~IbKD&<TCO1gAH6xz=F
z1IZ{fK1P=^o`KstQfRgCe+JDI>j&JI2sBG!=|wa~S(JaNXywkqH3R>hok3FebP64c
zGKll+><m4h&0rb;>{euo{18BN%F3)zd$>2Jx)RY<B(H1WU;jCBG)wb5VzERlPWcxM
z7I;H?m+vu1sJ3>~-gZy#(P3GZ5f~P>4d!D)Wrzdj1=u7!Fl}lwe`}>?a|lkm#TD6g
z)Row|4t_I}Jeoz|8`087bre9Biw*oH(Uq!g*^<#5g)yB#ZX3-Nk?pv}aGPeR^f#QN
zzsq=*Hv$Yx7b|hqlBLR8RVy-=d=BL+5rumbnOAZiNBjoKBuq0dr!pz_5G~vwPP<8!
z<A*k3L5O{e2uwmAe`01)iiIa^-=Ng+@52@R;QVoDdHL0aq#Gq?;BV8i20LC?q*@YH
ziXVuxQrETf3$?vp=#Omjo4k_o8!b400kVm@sXUs_V-*G|87h`t{Z8^fW;yzuMlnmj
zmKUo2UPM`WK3!aVJb9(pL=VFH`-?w5H{~rl)ch~1kAIiNe`PB25$fFeGRpFzzNW0L
z73CVO+G%zKg{^*xB~=BrYTPTMlh0q|P2RisgYjv!tgCl(242fan%$J0^+up(qwGeP
zj>|H7^EsBuq`2&M@}Ya{rxE%I8RM#4SNBU8{4>-U`P#PB_~EA4DQX6H%3)wo-K+a(
z|1RNa%8p;lf8sjLzBK;UF?xcZK!LDw+iQnDtA@4+$o{*$>0kRkEoiKoQ}oamC2V+H
zif;2wt1N5(jbF5#wWF~T+bwTwqROK&te@>~gR9E|uuG?<%f7ADq}F4eE<E3V>ka$A
zb%)cfN%1okpWkbZ=kptxftQ|6<mYl}DNwga=PZ_|e;Ism+V3AdZLa9Ofe|`04P%U~
zQQ4*1b{rKk@3qp8nb-61<kQ8{IZ=^p=uYnoDoWn%y%k4qF6ng(*Ob!-(d_<2!q;jp
zfo-Ncrz#FUqf>~kcV-v9_?ZGrx|&n;*C(GY*3a?wVRB=OD=*XQ=McjvBA#zcxOW1T
zB^5!?f7jw=mQLSPt_J01h^F!wz1H`|FxZyTTTu)eN6fzWU5N9>cloy4JI(<xN@h~L
zpxKu_kxJSIzZ^Ivk58)0lX2L-j(z)5TF&sAkNq`+$~wH|V}HvXGvrpUo7|h~dGMO&
zeQRwyXlzpzCf(MI(9DM?&yZ#8Q_weG^l5w-e@yauniW6a?AykJIOo4h<!JraiA+8-
zntkr5{-3R_7aWZ6j}kXx?Q1SKU9wqTcbd7a=52qow(Fd2oUzTaccQAM?dW9S@NDvr
z;!<WR;to5V@qjV;I#_^_<sWUDy9|gENYBSEBQ_>7v~b`AF19Tb@{k?wn#SQX4^{wx
ze>6muCs(hq%>l_WwA_zIDw?z!2UQhOE3*_;l)Mw5TpoHX3$r!Nl*5EL<TOp9B2`U&
z=dj~$(MQRM6ByLPj>kPrJj=&4bS-QPFYsw7-O#!RD$4_mK2|S(0SN+MfEZ|L8Dfn?
ztZ|4n-a)KUpAiu6IpR2D_sV{lv6qJ1f0~OSzPNmcAL5Hcd~t{`uKgL}i$i?zuzZ)_
z-BUfp7az%s9^#9S;x!NP#mDfLhxlSMHA8&y2;+-;2%<f%sL{5b^Mef@5zDgzNLVvG
z8xw9y959n%7I-G(whXy_1a;lYYOXKJ<igv>kgD{=JB%GQeLTbv(r%F?k22RLf2M;?
zk4sFv(8Sa=36_p@rC^eHmK-8ULnLX)S{t&~9#qy^6Ft#q#$yd6l}BbLo}@n-!b!^y
zz9F16gp-DF(%PRPoHT@!R_vZbIH{b7A)NF$J<vlq=~2AqA)NFW-trJmYNlogCk^4G
zrAy{9hLesxs>GbY7BnE3c{Y?Xe~~t(z9q2f^T042S31Uqs@IRL@}|2FYH`!Ri;U4K
zaMUntKAK{jwj?I!CdH=fN=yupM((=Ula@;Z(`S|p24>@-80Wn(8*f1lzazEr+1al>
z=5|%!g-KZT;XEEAHdlPPh{kyeWV#a3h7na!riwYlw^f+C;r<m-&f_$ne`gZn<Pn6L
zVdQCYes-n?(u$R9j%MhDr%4!1;HD2hvY#My@fBtBSmr-IWj}p7y)24Z{_N?~d_J3{
zS#dtCIFQeII(;e={O7x;f6R+GO}{*a$9g)?C06(2BE>arJ&ofVTs|?bnC?eFf?wVY
z#Gb%CJfEp?y!-wAo7N0%e>s+U{xnr&%ukDXmf$pL22gb#B@-MaIMuykFSK0GpeFXh
zFvNs-4)&?dvEy5oaBXIAUyfj^J5N%Ltl{i0(gqDs)9B{s=>JXU)hriT8lx?E{53>@
z$LSnuv?|(BnWK3QU%}M;F)ws@DWB1)1{Os9w-rm8B}?Z=l+4vwe@_&)UFT_9wuqrc
zT(yX+5n?sM)&#2ewgnlsmiCf`ILpygF?GwYvp9_kR6tTDr!%S#b(lgph_iGW<r3Yb
z^9-fggeD~i9|%ZP<UpZXBr?m-&(1dSTfeGn)3&f0@CI7Xf-s5-sJuj>_i36SK?{oI
zS3qB7y5|`!F3-^~e`%6O3g!{zl*J0!(QE4}qH0a1i?8Sg&68O17$XMn5`N`0m(aCH
z`5Yi2QtX=>dvor5srDH}m`-5ez?U{Au4CZ9^ek-K(sLZwl%_o73U;kcyuWutJoRQK
zSKx?L)LFrf>Q`ElUN7AbbkVOy)T)g2F;a@2W|42n3p_VEf0gHx^D*k}cw+@bD!1a%
z0t~6u2$PreDoQK%<SD(;X9mbI>c}x19r^z2>pHvCJ=#aI`=J_F+~dp(Ob<&M5=<yS
z_WXci&j|^0P2chz^Y9^iuaZ*ywT{tRYZ|gwD^l^zX7pZEH3k+DqP$#?y7&XVk}KC?
zxlETXM|7IWe+kWm+K<yv_19mO^IVF>W!F-+mai^lvy~{ncAM3q`tVoZu`fc0I>Mno
z$J`8{EWBWt`ks%aOL<`UoCoGA>+%tDWVH0vzM9%zT78C=#ba(Ab;bgnKKgi4X}KlY
ze6x$ZYU~>Hmy3@lJ;wd}Wqhv~^y|@qE}?K=C71nae~a;d=`)N*=iR$U<K}PJK`(CE
z7Ti1PKT*j;56{r;wY)IR3iwW4_E}XBSCcYS&t6FjK8vJsgrD4v!~Ev?*Jx{2@Du&s
zPWF_4@(`T$&hEZ?+jt}=nduk-5rL1X5EdrPF)%emh@}k7P}qdKAsbGzB^do$sjO(9
zt}jzne|2W5G6^Tx5^b_~<PGQBLpa|QG`hS-it^mgEBJW-;DaW*2j7bO>w~a_VH>Nj
z?W3_<<_~oD<kLmBe?Vi`ji9QPs)WeW=65@hhe90(Sg2!BB8K`6dmua>s**gq1m@io
z=;fR4HVX9t>BUE@5PP<8UBmXVC8>c42?P$Pe`J`NOb})np76p);9vbyg$m1xh3Kt{
z<=&m6wI3K+?s1(jj%k0+)l7m0shmf5;9%VaFE)5spP`e0ddvyAjRm!U);e&o?}-pQ
z#G;P0L)W(Mf!6v^Jgj$Ymo8g*gRT1gY*p>??mLVxKA!x}zQW6?+}Yo5({8d<l~sGk
zf9C4oI6mrnl7pE#lo|Yv89;-X`q0hP+vHmG<2T1{wT8a%nC}Q25JE8t>=09v*w~Y%
zZ+V_iTpk?0)mo#cE0V0YlFR4{6b(S<;pQkQt=Q9!$~xL?!7k!&OI^6?QQ5MY>K0(4
z>w!ZGgxfKSa|Q1_NE7ysFha+^GP$5Ze?T1rGmjHYMBre`T@!njZ5qBo?a&cNv@&Z{
z%zZA-#!wxW=iMyNV_&77#SGK&9L#N7V&Zrl2fkofQqOU?Vc0Aj+)c~eP4$|r4#>*g
z1Zz~P)xY789DGX;1m`!d_ioMc)`lSFvp6bFmqH$)n%95-cryB6e!5flRBv?Of8d|0
zTWa|2dX3+ihiU*)teBs{L$&{s$}ed4WrwoLTHpUgdFPbYU!LPCo!a1+Tl!}PAjROJ
zS|wrw5_w;qtVg1k`<5*vw|q=|=3v64jeY6**dVrH(!jB(YYk!Gb$WS|NIt0M2cCj+
z$9i>Jso#fo-Bzo+2E(9SKSL)}e_YXoOYwK$Bu^$=?65=lcSVSL3#3l(ra`%0H9zwt
z0xz)XJr3I5M;rbf()_knu8&>EHi>VLATTfsd4P${JnVB{;K1P)4{b|I$9)8dX9&zH
z{*>mc2ZDI+jq0&uo{xP!hSVU;Hf`*9j*CecdN`2M$CA6IbeZj2oDVkdfBizA-%X2I
zvjPX~^8+-3d#`B07Ty}^+#;^n8?w37wziHFZ8m2fX{n*dp%@Q{?!lyA5TzmU_yL>r
z4-fKuwE8iV!k3=uVIrxAN$8oFQtDym8PqmIBDn7#A=WwD1gGqoi4Owpe9#8$-6Eck
zeVK-y%Q!4kn}<Fo0z67qe@L+%T82do*9rabkpiFhxKj5BeIC~8V_&kC85rCP0!$eR
zF=4{Tz9&r_2HfG6ML4Hq@I2iu+G6lDJq9H7CTG<Eh<@yjt^p9;%*BA&ST8FBW~28r
zU^ec|HT}Q=(MPMBbDK%uV>b4=^f56)3sVtT*l-<_N#U8M=?%L1f1sN`j%oz=qgW4!
z=v8~tpj~efi5dv8)*Wj@x?z7t21GP^?7)u)u3aCyk{vRa8K!CD&|wS{mwGq|2*ZIT
z8MnFT`{o9+p4DFtmCILFF1HE7t@@h%Dq)YMX1QVUz?2|(VPIk66B|>{X4n;ydeo)d
zVymQYRog4)V{?3Tf4j(N6B8}Vq6%4*CD?QgU6fwQEQ>@_b_8Qw{i@iE3(5duc?H*?
zs4RmG!O0X+F^yEwUYQ82Aog{oX@Snpn!f5z&dy5P0HQNxWo2|tAypBsg~%wB&n+%t
zdj@5HV+rChx=gR-6~OxwJs{i~L|K=&J;Yp#qaIT#^icZKe{%le$JtLmvY&o~BFku+
zW)g}o|M+xv>jKPqA!nG~VD;~04wLb8u5i!=O$4rI2r5_WV$6WKC~ijR<Q5Xk(?mq@
zAT<6*lt;S!@&-|vRX+IF<@$e5+1jNArJQLNl@b=^zy5Ph<M-*>d#-3aSB-nOd8}1<
zj_<z(-FjD{f6@s^06Fsp3otR5kC`I`HXMsu9w7!@S>fyUyNdO#+e(Wp{dHPMmZo2n
z8nuZsU7smcyhe&>W4z@gD&%ydmiRs4CO@iYKuXXqKAv2IdiTsUjKBVXm^yecPve-*
za`~+KrTXSsk|y#8M)?<*mqfsoY4+@248yiv_lJ)se+qZ<W1;aUKNh0y1y%s2aWqMu
z#WF0q4Wckj3Jh5FXO=PhTK;`4Ve5Xz(pdbU`?<c13i(4h;J<!6`RTdZ&|CZGi+W%D
zquQX*>GL>Fua&3g$EStRLwj0{@u`}PpE^fKUbey0Bv0c=&_d?ui>x^EOK?n)QU0Zh
zw&!!Ee?a}!DHG*@I7_p-%5GIt`+Y`}d<M0>6i?w8y_X413Zw@4^yfI`U(jz+UX0Ln
zR9wO#@$p1`2USPau*TK#q)7BPoj1)<0Ymu8<GH%;o#cPa@|rrd-p)ton=079l~<9x
z*5hsN(^C@D0uEK0Wf9aJSEr&z+huZ^UV+fje^|ot1~<kxh-E1ih^n?^Qe-eu7*4nw
zbS>!@nZQwAj(^{U=#}u)Vxpes?~;PzwVifv3qXh(1aqiTPfW+f)D;8^Y7#G$rr}a{
z$OY=v+FDpf=zS&=u>@MC>|Jy^lNtISf6Hhxk7*VaH~(`4<*dt9qIIcC@#(ISo0S6J
zf2cm&$Z}mFTdz-5NIR4NoXZ3htFTf6>*s>s5I7+BfcV@jVQTia6fjDpGz~&AHK>V+
zXE~U<Mu>%!0%}6j(0hz5lB;W$(CJhOVIy$uZMl@XuC$c`7M6QZln6P49Z$DXeqF#$
zG_KwLs(v&m;eaj{G>TQMBbEi4WE9Xne;xV%q56_eCg=i9VT+6a!y!*w#i!eGh$v6e
zLQZGJ&FLT6<TrUG<2P!|Bej)wKZAPH-33sVr>-u0-l||-uB-1@ow^q~>8_A&+@x*<
zT_6@E?M7jqM<X?}831ou*D5G#k>;GnG&_YkZ+ALvw=)`nT&%vf{UD<e0!v8sf2^P6
zKhh{cU!p`@fI^eb;pBrhMkr01@pM!ET95GINpFLF@<}~Djb+Z|>5|zQBV*Jn4O%}n
z&H2C@xe_ErGfD5VB6co8aruoh8Mp4-Yn2n-MP=#sL}%+loJx&WNiXqSDn7@3r9j=a
zD|*4Pe6&tuF9<AO1`-or3QUCIWMdza_PJ$-(y%<oG2{WOm1<+FQWw}wPt8QoecNI?
zJ9}4c$Q48y?&oXH`Q_%<YHLcF_)@@NR0lAEG^{nmh4iB9%ZOh#4Ff29n&w5NWft*`
zRwf!ofQOJvv_u#ESp!kGq?e%O2OfXZ$fiPtfNJ$#yL;j9(h!n`W`3ycphh&6ENJms
zE}CP+X(1;m$apP<mGo(Ggiaf`Z*5wuFDv<^khY_T07-7}cgiCQS8LfX$8i86`8*MN
zinleCEZ4LR&&P~d9wyAPG3C_2mKpc~GXp}zJy_xgWGLxP^qbA4@h$8nknexq4!e&3
z<j!p&^dO9(mf6#Nq=DmOrB*+Sq*m&`JIcXyk5(IHmPrlU3a}qK7A6k2uy2MIc17qq
z+_Z`7*~8YlPao8tHq}yR&>nd8We5?Q@4DB1$E~*PRI3%BV<=}6&E;wPqf45jk0-y=
z_?l+&<H@-D$KsW5E~ETXUsr$sx_H&Q8J+5js^41IjF$Svw0(53<XF(tI_|!VajU_e
zi>PU>&puV_wYteCpDucRw6D?qw5};TMjxKEv|%V|(u_oX*)sR4f+zZ~!C!R<xq0pP
zx3!yTU{YQ^Hv{d`-e{K|KK#`>TD{O<A>mBA*yBFIBoGAqhRLxA9LIliE#|nvAy<g)
z!6TM}NjgxGFy(Vl0n?=K_sM6HM`6j*Am(6vE5&UE0;5z7$Dp&7H_dY?6sjXiu4G<B
z6HR3V$`*x0_B_h>kN>N3)3K0obS1MJtOwSh71tpBwt2;i{vbUg^<3`+#t0qX65Mw&
z;l#j%3xOFm7_i*R(D#2WgIbR<pYfYqKycYQd!efeUL2M|uvg#9qpQQ07n_~4>U5*K
z#!?mF_W5LzNxjW!$Y!#|Lss$4-8yU*uNrN%MI2q-G);xNsR2W7dE=#|#gxw8G`006
znUu*}xorbr)aRFJEb_l)YV-TBQ4`v(jNVDa(`5JAyR+dGbn<^*eud5QWUIHYMCWCi
z6z{59AV86HvO`yI(p;g?)r(DwBAuQ*d?nL7S|!t`!U`oNSa4xr;t+``5d<^G@*M8F
zp$LY!&U)u#sl7qSaH-m<!i{w-ac|zi15*YD@8IEj2hF?Fy$XGbpp%19)CN~#<9{5A
zvaOPmf#B=#T#0|=Xtg}Y;sy~AQx2dguPX_rfHCv9D=gEZrftz7OMY*;s8yD{=~NJ`
zrCD=WXLvo9Wch#vjD}W-L*ay&n9Rk#?Luy=>4d(JBowQ-iifn;`e#UMy~ngxl`DFi
zwAK~u2%0COBss_tgXR}-tI?J0rL<NFtSa8|RNaN*C@+7;=y_5=C02k>RDhQ-ic3hV
zx^UFVW$lw1fb|+ii5|noMAwaptG~c}W>c_&^Rj=9-p-3Cj!`0|x;_!@ykEFlQQK?l
zc}22rmDo6&W$7#f(CytOtE!%NijTOa<GH@gFz3?4#B?3(`)-I0K|Nbq4wt@rOz>^J
zIPN@I6@7m^Q9Z5ARoyBfwUozu%SKhh-X$B=4FcaX7{N4vh_AyrrpyYlYk1t|zT*Zf
zPsqm^Vfz*&ppu3MmvP#5+LdDeAR>4}D(R3)dQXARA(iytQ%Uzw9M8F9XUwjynEg0n
z0vS5e3mNu_EithJh8YQM95911lLXQu?07RzRd#=0%c$CO=IMf_xH<9k!KLV_2iPfV
z)NunsJ#JuAN(b1&2&U3v*m7-Q`T-}5$Rjj6zCCMnx%IurtkH)oT)XCfy3#fRk673S
zQ6p41IA8(AuI&=rZ~_+6d#DZgsPaG887Oy?;`vaGk0EvQkW)90H*-@`#(e_-+=dJ=
zv4wwyDKl+M9U2nP4^5NbLtWzo+7$0`JG{H(%!jp04!Ekr#Z?_UrhR})4N$3#KLb?i
z0HIRe(du-j>zXX2E*5?$FtL3PQ`;ukWZbYkYKN{c2dLEEp;ESs*8!!Jp7mIOQl4;3
zA_Iy;*9$RmsEZjj8Foov*~I7E^auX`f&YL1e)#{PgyRFC|8GE3EsIeVZ|Om$KD?tL
zq~NGJDhef4L!7{mJTKxj{c_ukZCxS^=QNZ!*WW@9szOV1*}u$liBsKE``UbT2Nef4
zVzPb}b8us;$tvfyH71QI%MqsuVmC9I=dE%8KcGxkBDjnumsn9AswwXj6WBKl3j}}e
z8%hQcK}_zr1~#N;V`6XzGuJe*ZOgzh4C(uv9B?>9Eyp{l7|>cxyVVKUfW1=9-b*cj
zMakI(d=(Jel3^I)AT(@Dgh#ON`6f0jCVgfJ!wWZH<OgS7%bBO&yK=m(Wn%jd_$!c;
z1@B({;loOs>>;o^BL29z{JT5f5-NZH&fE-4{sa7~JRQ1%GZ6V7k+a6I1T}?iV@W&@
z6E6^$31Q>Fq0FSh<DSEh2u{_J<PuHwEj<2R`|0-d{SN@>vZ(v*1fntwms-;IFoU!-
z!Z{Rjb#2V0WR&_Yvx#whR>NMI_dCLLPlWr>Cw_RW`>TX;SJ0KmZNeCVy4HUHx-uMs
z11E5?Eka?K24jYO4;e*A2D<tt!{qk3tDTLG2gjP<dxC*B{{XO8M@*Y9Oc5BCDX?@|
zh>6Ec(ETh3*-^{1gyp#d9p(1mt9@^a--f?BsNM45Ay~bM9rtE`Pt^DQUY4S;`dtq&
ztO16#Z~zSC_p1-bf&Bjd$nSr*fN!Q*@$=0VjI9Gx{<mPZC>McgbIb$cU_u=qGlNJh
z48!NtvBOYqsGzj^%TKp}@$fVeisY8Y|A_L4MR8QzY(OQ=DvWOBwti39TD%cYr!$&G
zrI#nlfBom2#_#W)-b%Ta26n3x9@v558WOwIXP5*KNOnwysZE&>Oay-+8`!M|(AEP2
zZQTjERVS@hxo2C$=t8x|=z|)96kWL1GMH9ApUu*&SPInAz$;CQh0_er6a8xmx>DGz
z5{wnF&^IkXup0ypRM-u0V3-tpu5hL026n)V(P$&2>d#!msr0j=0#GJ7SkZL><9TvT
z6L3?PgV4CEDZN40G|PX0->OhFSNIyNAJt5hOzsp)wL75|lP-6uEwSNCiHQeLDqnio
zrKaKeLYUqrDD*)EMfS&MwFFAF4;HIN<n9kfwKIp6$A#w!hhPgx2#A0}!7dFjVZvpc
zS}xf{HTuY67T@TW`+hW5+xzIgf0pC`qZ(jTTddWA#i~6exqN@rFsgyXYGq+U%Ve(0
zv0<136J`s{h!^6}ro=Khr!@4B9Ch_A99GLvSBFVmwWulX1iA`^W7>{kVn+r76GsF%
z5Qe~9IK(v!i}^e}KKo*?#8rC*T|Hol+7&rPLKafrb20Ixz=Ycj`=*rG<iucsZ*j@R
zV1?`(IdwOTRXcy%83S_aPzXXEFmmdMfm3z}I+}}p0~iiW0L?So!&HjU^(@yW<~`Jv
z9y~PP894O-Hp>AxH2|j`^6@nAR}K7C8-E7=s{YTwU-dmXNge4CE=?R#*Tck-6az^q
z4m`{DY+^~<+mOjNV4-fqU*+L7NT^3eUuAGp*p^2zw?cmt69zR7EYrY_&3(gXj?Ks_
z_wZ2Xul^b8{Ou13^>1`K`=JCGHO^P<V%?3r>Q%zP7;D(56s~78U(?xH?Qx}fZQZeX
z(W)L#lbdULb9RQ9<aC}Zqp;#c#wg7e;8bU4YUpQYjqP|kgH(|ynczH{&ST|QQ6^xo
zCVi1n7#x3+UwJ$iQjE^g*_jS}Xg_Oyc7`IA-`n>UE1;8l?5wf_(bE#=ghV=}Q34Py
zaQx*m)^{q_ksr|6SvmPaCar#8eDzln{S`jSR9Qd-pf7lYW|qVpoRu&!>f!50ANQM4
z=_+Su2zF}i<IHE0NAT1Q8&M|nS(@Y#izUp!pWS~MZq00tcsi9OT?(WlSI_<=N9lEf
zrsc%`$2|FhHDg&`?&mE)8+uy*mg*_GmJFT3FI58{Pk^0E0pWNW!~8{Q^6_MZ{%tB~
ze))sC>+Gz}a#l~F`mnan;d8}KR(@M#^Bi6V#4{*YU!Ow$RGz|qpBE+3ntH_P4b*Z}
zmwkUcQNp3v8Mm98v$GX79LMO_ul!Om(CDt<1)dfeO>%hABb3c!2xCAauilg|Sl^hI
ztYbB#?rAA%`UxYD@*=|dj85x#$l2Msg6b83y(v<Z&(fl#K}#!9tuR~7vw-Nu`qecO
zf0?E8$z}ZxI88)JS_ccg^oEyYX)x54RV;r`-#`EPw~_XgZ^RkCO!+*oBt;J#US(&k
zl@UZGLTO&s2yHzME{kziD~d&viOh=@%Nv@|+5TAE+G<aw5y89O33+HUL;7}T<IpAs
zs1OeJ9qwS?Ha*{#K4si`j4sM_)@(emd2tzCb>);6=o;jC*@mgv^~-~#wQ<%0lwW^>
zl%yg25oJqSO`Gi-1d$?^N%}>=2AGEE`ZD5|-GCzy3(j+OcF5^@&xhG|VXBW`M44=P
zD9ghZV&aKtJ2~4ajvZ=#?es){xu}vRVRD+2uxx4B)!p-P7pxlOUSdeRT<#XVwO6!S
zNGe8L=99t&AQa0=5!9qDE1qzNhaZ3Ut{PYUuFJq3R}=J6L4}?n_^9uWu3P$eateyw
z=;O)4484(A^~_C*>e9&_cP42m(y!Dq;PuU?r)AU4Fsh$MFX`M6h1D(HuJp9kPq3;v
zb**Yj&CF+je&3u<=@<Dqm&NBOJT0fJeLct%9L(ctBH#nn%i1BJk0(E<3tN9fSv7C%
zg}3<RKOtkOAij|q2W9U9Ww0zy7w<enreT~L=xJx}$H*+-agoj-X{bR!H23z?hwE`a
z`E;@3-B&dj$`-0340W${dT~qJggOuXt~-gye{HU)9=P+pdZVpt)ZatJhm`?cWj-Ca
zt9?<74k%N3yL&gMvX(sz>BWEBr5BIyULGa->#gLF+_xNVJ4$eFD$k~|!wvN7$undb
z4^7Ose}Z)P`K>(03e6#TG^O#D>wGI@^+QXdpJa4)x#QtbnsC+@@8P6KXTNN3$t_!v
z?+RK(c@c31mfz~#cb25N`HpQw_XN}xnSJBK{6i&)-{K**yXAIEYv+F`>uuH*>?YB4
zK7AKW5^xmKq<9fcq9Whn^ln;tnQ2c>-Gp_&OK&TQNm3zSiI<U##jOPSBv0oVZ#S{E
z_?#3po5<o;x2i4Sj|_~0O4Z!v1*s@k>$dmlWD-kwHzAF4x$T6#)8*Tec^q%mDRjnP
zH#eHbHYc1;ooVfR+xCBV8C}Wz_bN>2Y;%hg6Zy-M?(RCrW|`Lzyj<Wn*r;V!ct%f}
zZa^*U8$QK^u@L*Nl-Oa?aZT<9M))X+;L=&&Qw)E0+=V(BC136WOqJ_=wPSHfm}<ef
zcq=y{`g=5KU63h1I}9r?vNW0O%lkffBL{EfExnOC@CMMt7ixcL4UWi-j>!I$eODi(
zv6T<91Pti$KKXR9_|^v(<ii8)4lc;<d<-tg+nSIE?wlE1kb?{I_@#VsK@Kj+!3Ei0
zn}Z8-a6xwW>cIuMqYJWQ{cY=uG^C)m>DbsbB*jD!iG71p>`8};AdrFY-!Bt!HxJ%4
z);JN5owj%ZnfiZk^*dG&)yI;bBb?Cor9&{axrd1eUCbOez>HBQeMg#fWmT!$=jW`I
zy3Ky^hFAx^gh&l~Ehn^yuH@;<*CX_9&Zbcg9`lBiw#wMR7<Wi)3(D3K*jA|>=<IBL
zPiJRnCNr?E8!8?JELWcJC@(Tvq?v-IZ_W?VelP{%F1t_9BtYW9C7z;7dIjSt%Y}@Q
zg0@0eQ1heo(Vv|uCq5)!fEVnnoYpb=^X+eXSVckk<y0pItcH6ZG_AS+E&D@BL1fwp
zqhHe5&G+9AZoQXn_6He%4k>t>V1q*n-d<AhmTaRcnFzS0s?BuIEaY2n;@vI0yK_SZ
z+@ALCwL5ov-(I(CZ%h|@lSOG36%l0nsBA4Y!37Kip0^t=E#^s-On!hQl6jV?Jc(|w
z7|6<5$xV)RK3W}j-CMR$SOt!8{a!D3NfdGku?)*0*br1=LIMYWGvPQm<Rp*|<E9jc
zT(@=Q(&>pX?yx#*LV6JBW`&hu_8zaf3Tfu6NX@tEy+u>m>kXZPke4z)uGWA~*eNHZ
zybcmil*o_K^IG0VH5+=0rfCutX;v<^hA>@25|nU5{;WVTFj%8T?yE%&rDQe62PNh6
zsD|s+y+<1LmQ3q^7XcEzMeM2+X(zOV46FdVp>1Jecmbw{ZDP(s*AKYqFl(UaYEu^~
zmh(1sp`QKj+inZzqNtv4MUp;^5{P4>3sj^zr!mdiEa|9?8kj~&li@WQHBHd3TQ|{8
z5^FWFNY(yJoX*Ab*=#YZPN!)p{DR8*g@y3(q*=bbJh$e5ixTosq<H~n!|CaaX1V+f
zd(-J#daZhTK?^z>op)~<jhnwq94dT#v0F>6I~M>MY76>Y?k1mKzSe~dqwuspddQEm
z%B;86MChC~Xr#H}UA1A9moI;Y3#ix_#R}x0N1?X1O=B?cb_}q|ZW@Adw?n92#-DG0
zyYCnB=iA?ZmJCFnBKJL(=ImM!ku7G%ywjP{!`N<K%)6WyRW`KR*3boF?VS=>uW3?l
zc8WBjb*<tTfXmB$xV#vSarLR*TB}d<LeA8$djI&3G)mByC=nM>W+|P6ns7=dlM$rX
z*L`#mK&@eYcv6a%R#rw&K3(vX#xm#fw7(&ZjS<{`pjG`<msdMSd9gAFR$W`J@bc1n
zAb-C7ZOu5e#P#oKsaLCSt)-;<B+L72%XjzswSD#EacqoGtE_DO&S}nv<jR%ErZ`GU
zy4=mMD0SVANi@0u#BY?zxOL|p)|gO`z1}u+i&7K2<UZ~fCewYK_7-rfr}#Mo&&GFu
zj@IsfwEJVEY9IgZ&(Ph!4_>BVGv56nX7g+oKcIKfIwE#|m>UW3{)hBZzUguFyLk|g
z(@`;Q`(h5J&d)MmWXr*&d^lVBZcOHyrsFUiSk%PCv27eUu8A#(s|J(^cF>h^wsHs_
zyxZ}6mO*LBAiKe8n7ero8KX1^!vNF35tsyj4#kuZj$KALmA>y&YgHNIBb7i%X_ZUr
zdG_iw-L~bbmhBszTQ^3(q|;d}3n|9vC5>Xmt=KQ?Im=Qm^ISz;3R(ckTjjQFZ#|0k
zswyeV(xQlEB31Rz3_<bGEPp`43J<cgv>L9#J;TK|u^@HRl9>4>#erq8kO-eUV(@i;
zuPxJaOJ8@_WsHu~XIzf3bfR>+ynrjB@IIZ!<BvTX1U_0bio0<ek4s{_?Z$97e&g}S
zwne#N2zTNzZodoAaqoEyZHH)kC@n4Io`s{Dm6mmR&m-u~$)ZJ7j_2daAH}82KAw#9
zPiN~|veN%@QQy&zB()NHm)*I&<8d>8^@M_NK2K<TQ$##Jo-$o`<9Fl$i;?QB{SEYd
zMVWEeX5e0x_E{v4wtiS30^ym2V%zZ;CY0Nlapqy$b`4Y5+%^sWG4gHfO=(khh9cuo
zDz)b0ZGC?`4X(E__bYz^q%0HY0<BTD^fii;w6(*lL0+I$x1IMcZQc4xTx@ZF*DEnz
zP%^i;tvAelDwcYhs~NjMR?s`!)F`6_Xj~0-oSEwX))Ib+)*)06t2bj?xZsA9=z;A1
zddVL1_HVjDXoM!mW@rNBGGsV#9f^I%@N7FYOy3KR%ER<jfAl8JBmL2v6|SN8Sp?|c
zf5=Qkyts|aX}hjkzE9m{*<<B@imK7Z9Y^Rdv7|}ui=u!B&e3Ih-8py^o^p~=02Yh6
zf&~})sXD%>8iA>62RslblpZO*DraLiSClP6pO{QyZZZQC;hNZ&wvTPor8c3&XTm&S
zv4)IBB}us!C0*a5D}f7sdM&exvs=$G<)!Oh@qslkTe$Etnp{F*3C-_+2=d)iaO#>l
zrzK#w!SRmJRYdjp8bPl_wU)Xs@<u5%S;XclwMrGDQ4sn}PNj&NayPRSW+|dEnkjlp
zl^FI=#WtPc5~RGF$VyWNt{W0;hD2audmauv?qX>fo)>b1`5_$?@tqa%G%G)umD}(#
z)x6qd7L;?fdq&A*FG{+9-roDFIwY^^k`!z7*Yct<TGZ6H(t5S7j#{_B5*J(D2_-Q)
z=hC{{{-$T^t<2|fao#=7wo#QkcMOX1L$0j8`lLQ)b=ei6A(&_3Fc1tA0*nBTOEIzC
zAh1kf1_2v3>CPrSt8#YA<UG(+Ry#|!-)A@Zr<eFcZto7+Ws`+}z53M#-;2KH)}9cA
z_V2p*@T6sxD2Q*pKYw_l=K0B|#@C`BV4)IBuMs5VE|A|x=XpPddMdZU_I`gB!|h1}
z^%41tdT4b}mM=nkPx$3fljXru#cjit9!7Dok%eW;PVe2q+(y+Zu{jRsj8GE?o^NB~
z@es4nGO>^%ut;csQp-5{)N1gsEl@#eC&^2|U{QXlj<Rm`Tjd-n=ewo?D19Ckp?a8R
zV+2Q2nZv3%hI91$i$8F$;4YxW!YBr$8KjEV1wVB|aC$=vrPJ@J^7cJd_==i!eWXjO
z){aLl7cXD8)hJy*w`a=&^*TE3&kOo1x>$l%ds^DpQCTB@xvmGRA8vGxo+~GjZk5vn
zg)yBVT20%vVw_j>4N;E5O#X8&lOn!p=8)#)H16MZvz8fa{mRlWA6L8yyZLZTN_>+C
z9;V!PFk!BRsqYHxn9R1BLw)H!%3!Ky>F!ZdEL~Xrtp3WoST2x}UTSL1sP($lQUjt4
z^~_(3IyXFjpEIcCxK+0G22*4I2s*UyNaq;6vGl&Dx4o^J>fX|cmM-l@&yz-lt+qp4
zy;F3hT^FqzuQ;jLm86nXY}={Wwrz98wr$(Cjf!noZ0~&k+2`V%yV=@%yV{y_^wIm%
zE0ggJsOyAYVGON>3c2z*!*t;KGH$JPbJvxMv^8uS-<xsz)!5>`_~h-?>nE4XTBu;x
zqR&8Nyp7K-oy7ZO)pYVuycVN-jx-*++EHYJSTOsSfyTi$IcGZ3c+|cutBqM4%I-~H
zu-lJ;U}QJC${Oo0xA7p>3nq68+t<POJzw3LnO`E5e>ox!&9iLQe5i~Woz7KKtu6By
zdj$b{i8kekv))pp0gE*ReI2%oKdZ!=39&bgHXn<Wg=>;@*FQDHp3|lF9$hJ+N_#YB
zZL_`FzvGK%_2)|R3qwx~Bu4~IN!`L8w#HSsuC`S*EUgz))f*#nkk03b%e7**^2OJ^
zXIP22=R~kB^rH`i%M}M2<`4l&=WW<7=f75~1XAz=HDsp<7sQAc;8a%kBf>y)u5<H$
z>L%5Si1k+)Wo)!qT@fxT2GOrAq0Kg<CxWp(0vny0K`1wSoIS6GFOX$Ex8!T8xW6IZ
ztM=FsaSTj?!7z7PcvyK+L=Ayz!IDxrJpQBg*;AM-WL=s+Jkim%`7^<kWB}ylq4e)t
zy*DX#+RMT#h9os4gQfE?!b$JlbFO0I5N<E65|^_tq#3JMtDR<x5SWfwCW=U%BpEdX
zzze)C2{&%Ql24w+<pDC8TLEqP_+8{g&vwyWq$GZF_3tu&r~$&jM1Df0zh9P*Uml2Q
zorS9MoHGPcrL8#W63AODQdW?xY&`vS`cMR9-1iKIS_bO~q;-V@LXP}#D&&71<gHo=
zJmADX1oovA<}_jGKIQ5W#ZOVR=kewafs8(4ZVP^<#yjdSCfP|CuEE6f&yUDo&rQ_T
z^ZzEUINQ#XR`TQS_^<}$bi?M%Hnvw=aK3q_TN_GQWcnVTj1p$=3IccKR<ZU^dTq}0
zn<nKZ9XU2p&1#!|yw{ho%z4%SqOn2Q#?KpH9ccu{Z<##o5ixX5+_0M@_;#u}fv=s+
zlhqyk%0H3Kt`H6f5?=l8(Uz8}u?b$U3+GzLiT;~!=+6*o@%yTj;X9wmrE_}(dw~RC
z`!R&{pC_G8gIKZW0DLh%u;(`)sTyrBbiZRr&^qdWD}Q^1*S?iBeM72iL4Ai9<hH)+
zHAjK%{p!B5Qkq=ok}zGe2%7|iE8X}zABlUEkn{}*{uDnjXiT7{<$bg7cFnwCJ@ZHY
z$vSIa&x2-7{6S$TEA4DTY3zKSPf2;4I&`7Y*Iq%nUW7TGbiAo==g02!nQQs&DpIxA
z?^bao^dlan%R-RwZvV;sc-~`LSeO2i1c)=|aU;Rs3Q8ZQFIYEd_2@e%{Z+Dk;Tgv)
zVl(hifC6g8Qx@Rwac<D=Y~uch<u$RUnffgHxt6N6v9i8UI_-Z<yM`!GptA>x-)5Qy
z_9q@8JarI$n$#=hM#sE6nz1{U9;(qh%tWzy_sYpuufRv8G(}Y@U8m{G77SC0(iV!L
zQ=G)N>RrQ`Cp;;<ShdS_wRS124Kn7=82&|~l)Z%-H%y?%Ekn3c=${J>30Tei<$p6t
z&)n7HS+(&<abaC)xNiQoR2i!|0W?&~<<UJwDn~8%6>M{^bB%}Gm4G_rALX>&$}u4t
zy7tO#gVDW}HOVVJL(1cdU-#v%u|c>gT?Kj6yVmRy!S#UvdBMwGxZNt9wGO^{k_1MM
zV8)2`o-`m$XP@iEhPHw9rIzc3ocV5LuM6I`Q{4pi(4YehqLr?J3H?Mt-p*uW^ajM1
zYFf25&X#TxEooVZa$$v*R!imFp+dh^gyST)IQ<RQz@!l<V%TZuY(h2q^?u4i$L^!f
zaT<1M*ZOpZt==PR*r9kvV5+zvy}cBY;^}It;~vnRmQ;Yet1qG<noPYb$dgvJUhf@o
zQR1>eV@$5(Aez#IheTv2)jg%mlC$_QO${nJAj}q7%G%}|+@6=1Jc3}U4E<sMdfBq}
z(DR$k=Sdi=^afz@{%a%SCn}Q<)|v?+g$bf7h=%DtKPMh;wNRNJkv+csK`^OZ-J@fa
z#1^nh5k2~)=V%NQt++0B)r@aC4(jf2&{}C^v9Y@>t~@ikt(Bs-*e@-m1a9emGscjO
zUg9bgNUm61$TvSEjTsGmd<*$rdiB=_ye>-SBI{`11r_bsvUZ|Sd0%XPh!>RUQZukI
z!YWYZ2^d~K4=_#MwR}mlzPE&6Y3*OqvKqkYT~c&@YfXe*ypMP?cL?um$#f|t<0|6>
zmBN#+?0NVduCVE%PKjSEeeTD#U8u2xz{v!<Rxij7?A87zYd(5zsds+8e(#@5+pu+q
zI7Dpy{42ve&rC7Wn`h4hNlsN`GJ(!3UaH0il)M&YTUKqYE>d#b+>?D+k(*{1V}-y{
z#wptD^Ks+FZMcU-molUtS)+cRv%2m2<D^wT3*_zO)s_<GX5RCfe(Xj+Hgo@1aP8aA
z^@1|SYahwBXxwtYMwy(ZFgu#HjT@A{QzE=2U9CFsf(S-%8*(oPWC@SARBjW5tPECr
z>gn2hZGUmI)D>46TrLwcNsG0}I!_?<2Ykq@U8${eX-rE^0ZZoBz)R1~JKf^Iw(k2)
z8^b&&`tn)h&9<?9TDaFjltNczeW%&qDLT1AvoDroV9DwnmN&ONdOBZrBra+C+}JVQ
zE!ma!d*3s&#?oR3$9`jM0&@oi*Ll<q9i}wfn$GC|FMI<0FMVQ|h>2YyQltI<$)A`<
ze4Qj#z%KggYinqLZplsg=Ao77>OCwMVI&f4dg)LoM>N>k`>h%O;D_7#Y*vX2lrFkh
zit?aX25r3iHoU5zA$hyy2i8lj^i<Ee*!yl-HA;Xx<+u`3v0K#pcSG=Su7P>x0%_PK
zZ00=m*!lRw4+}h}TxDN)IuFH!e%?+^XKSYlrHWL}vPw+`%nl5~gG-f}8V)>$%>?dC
ze)CB?!z7_%q;y1X+ri{>K4lu{#$VmCz|1@vxqI9v+=^i%N{tLRBcekRH=<|95>0dq
zXCXl-B$QH&Yrn5S)g&gafif_AAoH}Ma#6gv(kvaLfRj$4qK2^6Twys>&UuVd=Ap!q
z2!v2j2I}bHjH!9N5a^Vut>^VEYltO>3Oa?d5|qTX6JvxA#13NW?;k5JoD1pGaM^;i
zI=nf3#+2!)b0j%)Qe^MN`7on;Nryw=pt%DXy@zlsH0>uZfkDNl1|!8NK-5qs#t7^c
zxHiKTKWLhD?%O6|jvUj(?c9paj`H!9M>d-LdjCw=z8HP{Ub<hgT*&0;?Ijny&MQ28
zV!#-(l)B=p*6u`P-m^jK#rAj7sa)TDi<XyPQ@;4VBg``e^zjm-eoo|R_W}RXQ*)_3
zG*vu>bFWM3jw$&Jhj6ySfsln#2ro5X@4B2Q%SRx7?$6)n?X&e3=gXH)UvCI$bG#e!
ztmChToG;IN{v|aUvJM)0&D3VoH&&Oh3j>2RRz$A|y&2drk<@ebJ{~krUS!!XFzCXj
zm~+E|ydrnTDiTFoFImbt>OM+oCUnVO&8ESvGxTOTTZ}5$dA13lIt?g0b@I+pMnz&y
z=c8T~{7JJdmUFsCLJ?CMdR(ADb?eu=s&f_E)R6J7c`E9jX+0eyYCjr)cB6(>h~>o9
z43T8LNZLkr@wmRG``@(yT1%g1Ix$S=f-jII#w3IuZ}n{&&>t;nJ2%9+1`)U!t#|d*
z@73G_f?5?LLF|8kO=CPWbiKe%XhHgss4J(=cN92UzbwZ?^k$dOazjxOVl+~Fx&a|e
z$C(KPX@n9sLFv&opI!#Wk>T55+O_GYAY3s+mfTkhmhz*RIULY)L<_A=W*x@XPob(l
zY^4;$Sl<9&h(_mi!(a%vNcVnb?a4q(1LCj<Z$)TotqeKfdSdnkR6u^MguGn(KZ&aL
zg@c*JxR3kOngqwHGRq*e1uYE)Vn3+0HkR=@R5@`;|90eZZ9Z(~aDf6W=I{rcp?)H7
z`#G)|B7^EE6==Jf))JMl#PV(Hygp2RaP+MPYvWI`0xBA7&Fzl*Qwdxu0r-pL_3*X7
z#p@C)7T}n`$_FjT?vV~l`D@S`6FUe#Kyi*TOyeOt-5S1aUY~LlLi&b)nL`ucFm;hV
zCz$M;4+8KTVAze03Fu|1rQ7uF@Uw*IcI`!6d}^;B#gzoFjH6WtcNc2c&`z{E#L(6b
zxQJ3NmOW*3a~?1c%@6c@R8~&Z(5uu^i8^Z}k+23nD~eSqm~$!@&eOL0(^J&G!w#BH
z`hitQQKyYXP89kslp8y-G<Y=T0(DeAH6L)N^WWjdm4760=~b=9b@hygN}0NuECxZj
zBH%%f6W*IZ#2fBOz$sF|AkvH^HJ>{YW%g;6{f%$5vPC<U4q9v<tc0z7lxXR-xtCBn
zWvK#EM?Z2@@cR5PW;wgu7k7VJn^$3bXOt{yXIw<uPCar0SzI2@_%Sz<KF~l&ViuL?
zq-*U{Cu*Squ0_@|?%jT$oDA2rxOmJqWdhIm>wm)vlr^QP$y=lQnpSRupXdpES}=pC
z$^&J3xcWy%N}u=y!?`}#bpxA2Z{XuhClJMF?G>V0!O?Ggtn^%qrtRm4bDiH33B2BX
z0aV6g(CM6?v^3+wD5ofzf$10SPUr|Cr#Ab7&BOTErmd0X6LExXRE*9Fs%xu#c_;RI
zzqPY+XM*V{V{>A#=fDjwV(sIPUbm+`u@%VibBPpAKf)EJ!mzMw{7DkS730bJAmAai
zB!t*5jb~Em2_=dn&J&*Ln_a4i^gjMJHac+v2Rk9+fTs%LTW+VR$7F}cOexieoE!j7
zpFI^qL2o+&gH>D53WeQeXA3;=gRsj~V|pp<5&S8iXITgcZ_{Wa{#K=Nw#DeS_jnpc
zMQZz7RqHq#@GpXDWYvB+DF<Pz73lO@T&`3Zd1*$uEhwLG#lOt$whv{yp&*W3FVfTF
zX>vWx!(P+B6NTGppGC^`zi)^>VcMPc-NzyQPG~K)Az^lqCVtp@0YAvfB&D|*5Vvuk
zC@C1j=dJ2(Wwq9yR9;ETvmdXV&KuuDH*C(v=B*qgM>4MDNA9Kld3JysB*~2oNelgh
zjoOzTezgIfxx;*3BkKw`pNP>d4iEw7)^=T+9MCpJl?c-<-kjUx<^;WV0dG~j2mtyG
zkYFw!pp-2DZ^v%rv;PVkk*ziQ5*O6_r&-U<Cw~+;-X$$JT1V@Sl`gCd%s?U*D_QY<
z-3(1Ij}5!uFYpZaduRe}J4fTdi$1`zrEQN)YrLsLTTbQGcd4FFgN2QYV@ft6G#0Q=
z?!4=YUGsPFI@d&Syn~Q<+lYpOjhL(!?qe~g?oWkc0n>>%qgTXhgVSx5=W3TK@)mU=
zuCf0DlrT}Y;i1Q*kH9-^5$2>bQg52xeOA5BNAZ{%ksTZB>y9zmTNm=ln^~!yk(5=5
zU`9%z@ujC0C>I8WqQ+JV>M&~o5+GTyNUbb29H4uEI)W+2ZF(2COxnAiui7YC#J3xn
zvC<-wD!ze7t@2LGB^<*np|K88!cjjhs$8j`d0y+Ae%BYgo|FM_XfN(;N<Ak&4Lceb
zTr8OR%f81(PIFucDgC2fPACX_f~;qZ3j3TS+5Y1R*ZEGZEVc@z+k!+;0?1z=EM84*
zsod3l2Fc(qUX$;X{e9DD$V%{ZZ$_F6h5D{)?e#MGp=C4Rt$>};vF8a0Nn$<K`65CD
z)kkz`F=U);N<2QJD{l&H^aaPCqzkgd#y=^KwW$%G1W@oQxq447Zmz#Q=+gSC6L?%*
z-oM_lsJsLR=vUxeYhvFm0@JjQ<iAJ5xvO^PsLL*AX=j=5myK9pu50O!HJqGBETz1T
zTmPb_698Sm;dek=e1*sZHI&Z{^^tcsfK7jB5FUaa@CRhRA;`s^G&Pv0aDrmC8!Hug
zSN|*xk&Gm_`R6GA>-~u~OfEAwn5;jJ+=ZCh6~FJurJ3aeU}RqqC^v5}iR6Ed{T<)*
z`)+BLvYHv5tfwFg)(?)9+<p7p5oonV>fd2hGm_BJLp)6rqdfc#n}W`yXi}+hf;(o{
z9&DG<eU#6bJfiFuJM5r4-%z)m4M-8#XFR#M!1ad0o$>Fu$DwxWp0uvDV@L1_@Y5Il
zfcFWY@qt3?-(gexW-gy24AzNB<E^v!x;Wt0_QLV#>(AFgknM2k5gn?fS7X=5q6D;t
zT(QnViL2k@lq>ny@k!qq;EMI3@Cj6?lMffctx{?BP*fl+gO+L^LH>Oa)J$pDMM#SY
zlu`m+4lZL|Mj}pt$@&929aD^D$~$A)&b`&DOkrETucT)N6tKe}WBpGB<!ci)SkNwj
z$>PB};i0cTQEf8}Bc+2b6+n>kUhf;cMwra}4!60a?JDl#_VJ@=3SDyf)Lzz~uDx1+
zCUiN}b|-O9<+8rucqn>D!NRd3bWxer8H+eLo1ZVK?io~oo$RkC^KElcShd_1WY@tN
zK~@;92G;{~r#O>0Z%IoPt}TOeYfjgbFM6#JPL`UB5f^!17Pxb54E)j?mxJrcLO2t}
z@F%?|$&Kgn&#vHuNV_xk8l{KSs+fQ5t#_NEN?BRx8Q_v32I{4@2inOxj6k0-XhOkR
zxZ~s>f3Fa~M`=aEVDN|5zeUSXsBfZzS?pZkZ0$gWg$#@d->}qyys&2kEX1~hJ8DWB
z<gVg0DPPve`O`?z1QI^6t0N{eI<edEVaH7goa%1p<f4Q~nG%#SdI**;2_T|}khz{P
z<8oUYTa$j?Jo(R1QvSt=(Sp;ef1o)~)$ozXp4F%Z26o_YgN}99*S)BNN6jpQ@2`)(
z*(bo^W~IzfszX<n(UyXJ+p@hH$~n2yH_g-O*FD?6UYJQ2&Z5y<G+QF`=u6YNVn}@m
zA5156meJt?F+OGs+A&KrTdG{m%f%FqVKXp8fvA|Mm#ge{Lg1dfyP*4w@LG;ttX<z0
zvWjjE9*SJn2<T|4{}%uOIwoZ4k`GK!SAIQk=3uy@(0qFS&7C!EhLNP<n)vlP!x6Pz
zVtECMuENr-0j_zcwn&v>bm|pM&nO)@H?gddX4^)kiX=c+cftMpw_>_9+WJD6`DAys
zcQrP;gwW=Z1|h>U$JF5PP@M^x1O~~Tqxp|;o@sWnNoNMq>@X2>>+RcAv?U;A@{zK2
zO=ip#*}BWHhGB8iTs)gO!Kv9;hWrRI)o$4Mv;P<U@L~-mcy%s(WEK@9Y8CC0o~Sg9
zl7{X7T{l<t${^TD=F#skOXPQsn#EZhoSI0Ls9+>zsk<QMw$K-&(l>y71;b`hHLwVy
z;eZt1Rx;3-N9&Z3R-*!O&Z3y7BmyoE$k~wQpOZI#1y+Fv0=(wb3pYY6T_PDr4<sc6
zql3zbsHOaU_j+MSAL03&c>3@tH@fIp&NY`csMhcQpH$2zl;?4ArefEC%3<ZV#PnJu
zn=dHC=8@b}qIn|r0RIOc1oNkCwScOd3C^%CkYDOzIJLw+1%?HR2$+zgr}$boIt~=s
zgtMF0!x2k3P^TWqUnhi}FYN90xtnA((Vgh2A+<7^QNxM&>BP63B2NS)2fQzTJ4$F)
zr<KyZ`Kmwm=LJuQc&dgUm8Se(@jpGcw%9n)kr+89jA#?U#xfOGe1x$HGm}1&JLGZc
zCv9+Il!#8zq)7vZfsTptARqxiY5~3U^G%qpp2Rlcp(*M;=4hfz@1$YXo%{)qHTJBb
zTg$M;nFGG#IEVDHns3Zf#sy{kvSH%P3+cZQY^O@v&|5FW8{3Od2{JRzm<ThB6uB=3
zgF9}p9IPXCCI02vWv6UmEe;NcL6VK(y+mM~0sK0};2KLQunmGvwjlGrr1eo+_i3jW
z;6nU>dBTQShES-1TB4~&CMn1Fj}LDQs838O6j<p#QS`heo|ro*3&a9%<>Q@rCL{Fz
z`PK{RLXjegXM>bKAGr1a2Rk@K^O9-7Y2@wRyIArE#5cyn&(M%FNKrHqpO=eE$aayr
z*+jO>NUH~UP+u;f+@u!8BYpb^eLAR)I1LTk4Q;*>N1H)55s5-14b74E97c?IyrFH)
zUiGK6X8C*7g_dcdVJy#KAs8@kvY8aSHc-f@w+{Xt1eKPgxcJa;xup6cLjj_nOHbAf
zXvqI%W|2#7x-^qks4MJI^$31(vNRE|tDv?i0wn{qmor;iRQy|(jC>J!S^AS*BA-~J
zS-&wkSmUj9RF6pxpGYoZqDvU5QM58suzvjOSyME@T}mJFW9CPGF8d*;vS;L{*IUN4
zle|pZ1Vtqvb;T>Pnyx_Y-0&OcLbk$5!f&~w2s#kGqQwK7RlN38rVt3rAudoqGuNSh
zFGBHc6)SC8cEiD76mVx2H;epcdc@9$s(Q*bSc=S-q0v(<5|=%GlX}vB6|Dj)XfTV!
zz2+fk?&A@U87iAhhNkNihaB3Go<8D5ind=BQ>XFqZ;JJqwq0nXq<;+t{=ih6xv8~<
zg!-L~D;I(^#zrI7nJe!VaN-0zSLmT#r6U47>$Lv#S5-=hN;6^>z}z&x6M8sgmgwcG
zIR6<?YFxr&>$48ziHcWj<)%AvV#Q&pnyu+*6zrk34*FkQsINN=1dhlvs`9#Tz^7EE
zFovdAAnE5#Yz5C#0k}oLXC-U>4BfU_taKyy>ab3nRYAI0kRYYERYzmSTr1u{4)8x0
z!H@Ts$Cf3K`%CX_L$m3~nBTA)N|F@q{FO9shE3%Xt5f{omfE-`r%Kv7wAHr;v;GSu
z9(77NM?slox|*H8{udici=FOU;VViQgO2Au=WRD<|IaUwe;}scXh!WwE8Ahf!YUfB
zyMJLDv3#<uqcbNpychIvjt#{9rM6~X?1eOiHmhB$9TR=Y6pd1LA46lKvU~x3Jx)qa
z)gw=~zm(-E;&DoA@e^rb_oS-*f=G9~+4@)QWsYIP8@tA+^5y<<N{#IU9-paR2Vd-O
zKdo_1o<HTy&4639o_VZXnilV0NHX;cHl7itX;TgA@3T4*&cqvg?lwRYb|iw0^OxY?
ze{D}ddE_6GZKxbx(RpG+%9zuHwjmpvo!6ybKzaUDA#7FYS^J5$n%eoDXKxI%tvX;+
zv@AC#*-$S#(#X_dYrv!GLb1~aMhwj6FBE0}3h)DOiZBU0v)jHDUZveW?cGHF9*TnO
zJ^SN2ZiFNGvP-Rfz>k5WS?ol^4?RySj_VKfmtQcK&%sPh3CPX=yg~W?xIf^;#~QmL
zzNk@IKdL*GkZ}RtgOzNhhYpF5jW+J=P1ajDrdJSDe)wH5I7mSy55SB>o4%&5bO(5!
zYOcVv?$`A?lJgm{zFQmIb`_8TMmYyfGDbD&h9G1Zo7^%EZnJ<Mv$@ZT?z|j73)mR_
zcBZgC^1;p_g`0K%k|*bvt*VT?ny8N(XH(q+1tQucV%6b&n&KsFkR>CClfw>lmFU$>
z)IBgcNTcl~{gm&z4B;mXFb*dl=-IfzQFCCV+|3LI99nnfD7}yH+_II_^YXYGccNTL
zX>_UbnT$9ONnC;Rxj0Ir4%LC#f-3VES|UnFWk1eCh=pR!REI5Gt6<HrZT`UHDPZgE
z;SeEm9~nl3fI3>QL%-XF2Koe`)Ufil%Gca5F94ZQoT#F@e+Prd^=YGGD@i=!KsGnK
zd6elE2t;gF4)K--xOpxz*h#Nr_zhyfV3QU9W@u{bC58uj5s~j!+aryQ0~7$ooXHab
z7Jl2t6gZY*{wXYvmlyN=Bir#W99u-|cS|I6&=<{VG@BDk_2s2u+OidU@QsvQAzJ{A
zBtMlRI+8UM_cC@P7vdOfGfX5J{QHcmt_x*!0Ups-Bmo>^dKf7rrW80UWE0K5wGeqn
z40&T6)nGuS;7rXVJkIOehVMG7Lj+EVi{&%_5!{x(aI1uQHJN;3uwJvF;=kk78E2r8
zvEzDwDJWnyG?C0GBPP%?Q5s8asc8?L`~q+O^N;?SsFE;^{jTEPcLEzjgpH}n+m3}n
zndc7q4!z=qVL%%4<X%Zt{r%(2L9ih;8jX$)whN5s$60X|@`GXXlKMjOv~9;@tFMIV
zmT=0}oRZRj3iHkztd|!rQfybHy!pfFY+6m80Ez5JQXR{W;Y;!zGi{v0y^r~1>p5aL
za({(9LLcVFpl%~hpa_$!mr@}?{s9ePVE?u8aTltQ%8{36?pGa>eFtrPW14XtmQhiu
zM-H6WmxuQQTc$3tCpX|a%*VcDG|jO$lBO+Y_@$>EtWZDv*Bth)r7qO1(rPnmJU~m2
zo+_&&4=b|&kyB7xu?)si`1)l;DgLGd-EBZ{ucwFwM`UWqflgQ<Ic@wUMRavc^4W&&
z#pXKX*=@1lxs_!*0*JUvwlS90HQ?(^PzgjdIS%r}svgg4b#D!M(D@RbY`eP<L&2GB
zIPhkj8c<2N{iL-<3_j_1n<-e<x!!4V`E}vhGV^;iT_WN`H<f(RR0FS@J^IzYZ#cnW
zDW`)AD_;`&Py{&&nkr4_5u>|TFtl$XqB!hCtIu5Mo|tx=9YK--+Abp8)3E@Y>o0Ia
zNaM<`kMGC5rVY;VA6()KVO(MY`gPl<9jw!Im;5}%x)J!e>dE!-l1^<Ob=Yu?e&i31
z*TCuHH)zBQI=b{n2A%Rn_C)ys-$BV=9C-O-kH`WyIs6v#@zWD<@|VQ_3`l$`yRVQ0
zKy7CV#l);FEC3esKSjov--G8phK_))KOJjvLMUDdOUUtBpX_<hmhd+iJ93~xNE)6(
z25s<r8>EM^#2nRg-$0ir3RZ5p!@XmmR^Z^7ZqsUBqThUPB;#JLL-JC>?Vm1tQ_96$
zp?VJR*RZ?bAO4uO|Ijc0F$!jxy0WYd?%8hITKyxn_yvFG1rVfjOL|vOC%FX-19xa6
zbr=)7@YN)+n|Nq7HcZEpn|O=TfPFFfJ?X&Y;@nG(lzIr-pw-4nkhVPw+EB?m3fkc1
zrFieFz9i(>OU)%c0@yKc`z>c0QEKpeL5u2^A&l6cCM$Ji9^T)2zS(KM1=?{65UC0_
zvK$jY6#;|2jbDo5;b^KSaWV;<CO0k=fy(oXk&Y1lUJ?g;M{%g#X&JD)^qM(c*KHsc
z1qR&~2uPd^fEH|^6a)%z@h1X89e9M*XX3#H-FtpW(9Yq3jFZ;)^_A5VL<A@v;+Wqf
zuRIUT<$Ryl<~XJ1e)5SRfgBPX@9)!}a_jgyAWok~%QDV5m;HQQfd`g`(ahh}UUk5~
zCF7s!pasR@Z#sUmYiA@}xg#q2X-y9#HTlevC3)gw8VAVBWXN)*h`{<-74usMBoD<4
zmrB3a_rvZpPu^w*88c>xF}b5~9R{}fDwb~v$1X(_$@Rdz&UOqc{)R%XptS|?r&sTr
zw-+0xsDn29(+~1GVgr}@V{sOiX=XaUsG%y3$)pNfU_}zeT}U@-{o&$B#8u6-rwu^`
zhTRcV!>#KCX-F-9Pmb#kFksOmrwPz@n79)tMjHxdP}w=B*|biZh7j7=L)y8U9@)_k
zSdcVlbY!11$^J&O#IdgxaY6v-@93@HXz8*|5ndx{Mcf(bp95XA7$Wqh7aTqG@2VcR
z_HgCHHpNjM^toi(6(!%0xVMGVR(uQsB%}g5I(LqX)b!5P_+Fj1Y)U1#RO(W_d4>7;
z%xY!4F2pcjtnm9K1P=dkr$RprA6Rl{N9!ID&)rA3p`~22JOpgL2B7;{`-9R9G*IKb
zuGIV1Z##lZSpfy>%9wZ@z^H1uzbnopX^yoa(fK8$vJMK*Dv!#Jf`s}hwfV!Z=?P=R
zJKG~TEM~Rh(>X=pzV05ucCTGkwv1jd5Ag-Km>q6eLE<jZ@!^B-pl)TnPbA8m`dDUK
z6mB-!PF<MFS05Lr9Zes=NpcppTC<kMR;s$`yaIRYSAiWtB(&*b<=(MF>qu7Wmxn?z
zyjgVj1tNTrxtL-((<#oEgqt;7B8Y!K1loaWk5d6oz$@r*T;x+$g|0DwUyXD>mJpGZ
z`mhM_2nM{h?o-Ha%$4M3opN1oM`POQ#b021Tv7Un2?sH)p#kh+6RWSM8yVyV9h8_H
zFiTxNbim1B)cBFV(8!oQpB$uPAy(E|mhn>V`>$s=YIi!4-B?e2Iv-MXlpT3|+$)bM
z)Frsb|I%s8v0#N-z}E-!E>Bk+yiid$!&{e1Ug8YJidzgoRGPZ#_miwg)VPRP&mE<u
zFP|!n1d_dXIqq3c9eF-~ptTSc+zdC(M@X`6g#xQS{uC@Jej<j-=G;weA^f8<Z7=?~
zhk*17-=UX8VWe0|dllK_kZefgf%)?cIZRq4_YGJ2%r`GSWtXM(+}L<%L^G)=A+5>=
zBS}alxgqC~R8wlk6_!s<#u6Nvfw#U@{`4N$n^ShjFoN+W&USP}Px%-2?^-scE9bb<
zfg3o5Pts?$cI+lABT3orRQ~ERE|$kQW6#nhhw;YU5lzANi7^X!E}9JNucjVo5~-D_
zU1o+Im!c&00%87Z-sfNj=n5O)rm8O$rc)!Kccl00iOOd;8g;T7()LnT&vTa(9C(&W
zjQ%;v$&4u_q9h~;LTZ*i2%JgmV@wT0%m#+;S{h$WV8h<EMhf}jU=>`y%wfet6xlN*
z|3FlwPV0S^zH80Qi;uG(XoPMaF$x|vOB71)JvX5j;gwcn5ax*3OI)O}t1yOl<sTZy
z&I*on{UPE$X_=k7O}J#hixHMs$xkHyV}gmYBJrh>++7IfSMR14-)~}L?(}*hO2+R+
z<=@sxVYxYUD!u0kZp1zU#N@xeB)wL!4MNVJWVAIqwwwqP&z!WTzx8f|fFmQZH^$t-
zbb@gptTWLuA~{2z{3G^@H<tVfeHN@Z40g7@3<FU=D!{Yp$5)*vZJyzY<Oc<xGr`(W
z#W7$$WZm@jUwGQ8f|~7_Z=&}tvV4J6Nr(8PFj22$&e#KkbJ)$3y+fb~6ieE_a;s%a
zO)Q^Qr1fmp1%47*KZOg2-fBMmrWX6UsNoPVf$>{?p6QF%3YlucI$Uktk|x|LO;s3I
zP?FlCL*`-@vX?Nd-TLLP;KI~0EBB|ETlyHm$~FN{MQ9-Rrvvx`a%3wEGru}8b&x_A
z>6-Q7AacYjLP{*^Q5;Lg5oKCtHsgph+!)HSE%c~4G!s36y69xa9M4CbP+zlPsFl2U
zr*t4+>R$+x8$FC91Cr+X<zqB-#JtvnC)G4P(=Bv^Ri%1&NL8pC`*m5gbjC~Yenzn2
zD*&x?SB_sCUQ8&fvu+EoMZ6b?$N??N0lM|L6z-946TOedUZq+>&M#eSgID5Bu9IlQ
zjSYXMGP-Q7L8P0~EGYWRDY|!tI;QV(BH2h%EyoJQCF3ns(1$>E6TWw*#~gFTo4~_+
z`dCH87|F5pmHGq^aw-PFK8GafClvtdUR1sNOVFMp!$^On`B|BPYhe+XZ-n|;aWVrm
zu@CPaq~HO-uxI!)Fa0i<1L?ER%btUB#NB*#8;nUM%~R4BMNtW?oY{5^ZERz&ZvQHT
zM$-94ZmP#K-O`}8V#4E{=_L4)Mx}c`^dZN{v5&;V%&-0ou+-Apl`W2Z6Z<!D{$|5v
zPxYgP$l0DFw?ZiI(4rXlV|B$PG=yekzV3>h^)aocBM<kr*gHqjHv+q93G>nW8w2cY
zVT)y_WnMJ#uB-X806*#H@!i;Q1^gpwQXj7p_P=AsWwt?R`aDr_mtRR!#FE9Z&^xdz
zF^`T(2@WHT_cr`2^L9M{+KYp#$V2JtSis+0^spzFox}{ExGO<`N5+1%XZKB9!ze2#
zC2eiv7KOr`7Sv%xD`W=z{H#L;xxTQ-a!831?<4_pq2gfk%4Yh=wuDw4f&)K=suCGI
zRLRI&k;6bY9D*5tUH2J|GFydLjo#FWWr2v1<VWvw3Ns;bWGokVZcAA1WsKUWUt$j4
zkWysMU2<e{9jIUcu`|zmbm#66n{47nUoy%CLr9)t*v3BI%eqDORz@Gnz9FebB!d_b
zx<8m0YsIMzpyG@zcU{@%uEJ`HI5&p+?xhtre!2|(Y@-?<0Pyx#AcVw_GsPgWY;Kf4
zqxqr2EF7LFei-D#tZGv*-}+mtLE+sYdaWX@0WQCbz~{4oT&Y!Oak0jHASOYY7Acx?
zl!4V%s|y2U_AFMAiTZn<tcZV%P-z;~%ruZj&$t1erJW7yvE2^bm&sZ+j8!W*?W)sj
zIA0vb6K2fHEnk`OnZA)Ta$3+m?3qPl@aYBA#Pfv*(YXENlU?c07vijG{w;7j?9?I<
zVXMnlvU}t}7%DglEQb_Wzpp;3a^JTMr7r2sH!yv)l-UvrJj*fooA(L6Oj(s`)T9OL
zmRPqDHgIi61S>^}x<f?-RGRv_9}t7E2s6g_48enUNzDwWNxc<)>k=ZSO#=KJ4Ix>W
z!dlfPNmUhALex|pwZcQIq62N~>PN=~`D;z(&n4eVBF+toiFsLdp5s0B!LO?7e;kCN
znttw5sS8vMPI(=YuZ#a6Yd(ml4<~modL+Q@Ml+9j(9tp>+lhw^WL|DqOmu(CeG0K8
zX#8~OPU{O>OPh%7&@qzNjkJ*TjEG>S5)pkZ-{mPx!}PO_E$fUk>-OlqTqsgT-AL8>
zctCIiN+LBs0jiJ)9J+rh^#f8fkBH_HzTe{>{4_qboXyhDS=9^%>!3s3r;Jvs7(;%j
z!Ku&8@V{`<k}r9+o(<k0*55$rI1d(eB6PU_Evz{xM36{v5yK~*VZeaFt2fpew{kvu
zo$1ppnEeR|ef`JvJjx>%C}6VkY5y#krTyj$q~)e`%1e522UrRGdjuHmt`ozBOioe_
zANx{os2eu8?<jf2n%g3c_J6-+pM|(_fT7;x`kPtAR;mqNg5)NCmj)3WtYidrc6y3a
zh|HSvLa%o6K~?iRm*7e(u^*3b;IOX5pw+O=0f7`9`Y_FhuYP?X7))MPr{63I(++mv
zz4PWW_!LrCKudqMn*V6P+kS2!CEyZN+)e3^Ad|p3B0t#n4ibAmsMw0-=xm?R?iN?o
zPrE?y=vt3*0&cXUkwawF8+N<E<j+NX(ON5mli<Eu6FW+^+{9VD@Gui|#DZW^>vMtP
zij7|X+o*cwaQdJwIT^37jl>S=NzG$mF|(FtjG%#jLLh7NKj?lS9<FCz$$9$aOYj|e
z7-{nKAnlzkIlHVMx#SWTB?+zwwG!8m4Gbmj<m(<R-f#mnu}QkDo4enua4#hP+W0Yz
z+<LeQsUQOq>>w3#HP(tZS{K39G#yi&!JNBf#6@uiEB+!MzvZn;hLFt`(Z?82D423B
z%yiB9F{jAR9X1J_0leZb1}*7^r8J^U*Atzc>m`0J+*dsK)7{v+s!i1AL_`E~D&#)<
z*@y_Ibi9vaH@t6s36I}&9INnJ7^`rmK*zREiD9ATT3E1*W>fGe7W@%vuN9(w>cnX1
z^s#7}Wgz$!Y`nKQ6JoPx83G0{U6^l-m9D?OBcb1fO@G?#i<)$-GIBr=Rx`sg=_d6i
z?71nB&LfWz{JIk4CbjELz>5T6w+li`o%S05cOB!ZV0Pj2#Bd_;geZXY#A!O$lDX*^
z@*s1!{<;-=jbV4qF4Lmsw>SSZ9h=9am!1eNIUXQ-XOlL<=Jd|bh8GU}7_F@{{(%7K
z7OE>aUAPOoNR9iHljF&bHKk&<jUG>JAr%idjsR;d&27V-^=}b<Bq464sV;f71KM?2
zgLd`adyf#I;rbQnOSVu;rDE^SlIEd4%kOmT?nB<MG1+T!%PyP;A2-Eyx}QiBBW>e&
zfJ4A6JewwhNj?P(Zxa9+ipDVLcmBH9VI!a|vg5QC2YCj*jQKeJvp&Veuk8VUY#9Ju
zVc$Vq_zf7z@8}J7@BKtv*&diu_4)6hYv@2w+an~br>bX+J1gs`jl$j@Y#k$SB|k8j
zeH@qy6<32x6ajz63o>gvt~}F~?^8Z@b=(OsFCt>YX6q?@2O4V-=0G4_p)Hk&nse30
ztoYf!N{!$gP&Z)BGuVfQvG5RA8@`fwWSZx>Wc#9Abd1}~rWP^@qYwP4?oAWr!bAOs
z`VjakN{`xPEa7Rl26t<vPHD~}9%Q=(n(kRSt2K3|$x|-yujASc^f1i41ssBm684|u
zdpApp?dBB5I#9;@WoP0s*L(G#vn}S5_Y%X1!&MT}+e_UE5i|@5l}*bbdSj&OV28tP
zW^Q2Q0=$U1z}gpCwZz5j87JDRTz`U12+u7z8hpLc3Wt7qA?gh&uv20pbEoCStj0&q
z9=4qz%{3^#TdIRYaHz9Hop%kNuB;uhcZ@kpQ5p^{9!N1m(39J>g$@xEBaj^9;*|Ec
z>{KNALLWySO23_eY@sNXVTOVGXf?7e22*5pzA$Mt{5De|;qmQRW~_wfDVx#}4DMrx
z_u*utq}<%z7O!+r%i2S(Y_+2ZE~(UI#H;k+NexG!jMED`k2_F~U?+BpFQl;l2^ukN
z9Rx{k6xj8>dhd}N?Tb6x`Lmds2@op>_iaT#sz(ULVvoK;W$VwrLa{P$4}f73l;YV8
zliJhl{!uBWrLz6rc(!zgkC=;&Ge95}&$ma6xJN>3dLHAyB`ja?PCIf0{=Wh1fAbZJ
zRb+(j_vLsX)Z9GHB3|5SuYG=TtrL+G1w^f^@hN1VZO6{y7?`9}mtiB`w)7xZABAR-
z);3Lj5%r}pcwx^~8mP7uOE(QkzNix1`QLz*L3CjAM-u_JAjQ64Y3(|_zK#Fm3B**}
z$X)|+4j?)V3E<i){wG498<9A3jbvEq^I?a6R|K*4=q$yNt_d=Q@~&VKOT_?0+_%yI
z>G2M5?BpkzY{=)gHFySMB#}?X2STXR&TRxH>OoM+F(A~iySo)QmP-n432Z4NcJ%ec
z$o}TzL-6sDB@WI`B890L#tQ<??^(27_}Ho9;ragH!TIu{_*G8*dua94y#G&jcBFD$
z0zGa{J(_HU;yCe-tSk|EJVu}u=cBoRZ(6kvXLLOtW&*q^Gprp<OfSi3@nP=Vp>DCg
z!XCTGvOO=2-XC-!&&=j_ov&ygd_bgvXwS`CY-41dgqOOj)q`c;R=~#cyQa0Jeg7~C
zs3QgpyF${4R^;|P6dTz~=)B>*ll86h1)MbWAqGI%<+zI8NdAxD%m6U%H2u5K3kiVp
zE43}USR{IkeDh7kY|DjeV{2oUnR!9-JV=Ye%hr8D6^;=fx86|-y9YWa6L%j+^085)
z+}E~0og={oO5P*hl!yveZ9d8H7(Fkvbh6=rm2$~LIb4%1JhqUcpx-CX#94pzh+dx~
zyOw*J{52NbMY9$!o&_izDR2H3;N6}Y`!0!6Qpso%=>SIJ_kTy6v3-Zfncrt7{IH=O
z!H$PfYuBV+pOjJc<#;1Spt;$_$az`1#ojtiVa9yNWn>oc9fD~&sI6WUeE>HVKiUPk
zywA6YmJ(atcZYF+liezAehY`*$E)6oS8VU{KJk<UYc?>k;S*qE0)f?oWwrcc4w85B
zVjywu^=A0?yXkfH>ab+^<mp>*I}gbSusD&_SJh^`??AY6DQKS>wPw)MM369~);k(t
zP7JsO<}<wX*J{BUXfGJbstXsxa0`GtLf67#kYdZq$=8ReVfMkl_O4?pdS&?q@nveN
zWTT!UXabGgVWN6ff89O8@nQyFlWq9BBQ6H#r&zjHBEAsW%I35(+3%sSDL#8xR`7>a
zBNlft(xTqjXj{#~A?g}5vYmxUA6GZAuXuEp15k~Qr*E<AwN;~RidyXW&nG7r1FOK0
zD{M~V>u7EpAlKUQ$J<fc+qufy$LP*68tU{2!+;51&3B0#tvobR;zB)qinpvnTu6de
z<g~0e1Zl~u={g^dn8ucHs>P&~lNp${MVTG?`^n+{rfHLpp)vULwY4H%2&f~hcF2(F
z)-RI}<}04L<-6T^goZJ&vsdb4{?u=`s{CuL<pOvyiX%J)H=<}wm?>7B4DI`3?ee^b
zS3uwABX6J84nIiyV#_sIS-D<J%A?VRLOs(nOy^_jDTPN8!d*<PltjTXYQDFK;<Vy@
z?zVsSfQgbKyGAdKzh@ML_WJRI1^4jLpDqF9<9|^G{_-(3j;X#pA%JULP>-U#3UePH
zQPQrWuI}d0dh*c$9@kp8P);HZ<z!_gDS_?o<*%OOVn@dqORA%+BkDLQ>N?bCg<6~F
z=~nV49IZoBLf*N*YJA^hW=$S&I0?urEA!NPqy>yce3fA!5VWf0(xTMdha5%;0qu4F
z)}7*w0tIEJt$sCzeok9Mk&1&d?;_~U%9=eqCf%K)KPe|ctKX5<U|-2F5D}65lLDGw
z%yN$D{T<#gWytimh`Mck?gzwsVkwaPeuQDa=<nIzcZJ{3)%Vi#)kpqT9Ofpd0j|PO
z=6L#yMr;&VT=jV9_G95h;q#U%i8s(*_P^ET2kF17i6<KDwV-E)=_L!;e-=z5Tkt3$
z^NcH`vfdvo`ET~86_EXWo~Z9ExB(73O@*pY4$Gee0Nk+jx8b1?yZD!xF@h$$XY#J8
zmbfu{*J!uAK46>Rk~m;`pnJvI8y|mD+YWGn|GBNRai4IOjyJNg9uN*$RL;zON_dXo
z?>+M>px3U^PmY0cb5yjOF)1Z^3ALxwNVV5}E;KfTiajbl6a6!ciW1Z7gA5dz)#6Oo
zG>XbPz{l<DDD8qB4?k3|>NMv(9FV8c&E7y8Wi{l-FK?><d3;04PCtUv?D)mXvRQ9E
zGn{?pxl%9X4;~Vv<_KS&A#;NDYB(7?VaoQUIepWr7yhCkwM-J=F4`u0{wiG=B*kLl
z<AN~qhuZ{QY2=PYh*4VsMHncaIoVEBYy?5Df&3$G#Mi&}lk(bWYuS|m2i^qX&lw)1
z{aVc@!L1BD#BCCI@;o{2A-0h+jbMCiClbB|ugQj$DgDl=s%kQ+uBI`So)rSTsOS#H
zhVT4ZuIfHIFM++*)ycg3p&=C!gY|6i%$e&ikrn+%?xh0~5&$K1yem+Aryk*`S!(F;
z1|2sqlD6;A$f3zt>_DaHV)w?YwHY4}{kw+@R1$~f3FnZOAa6mlTZWU%&;ehNh=3dF
z)zbsHj|B8qyBns0)LC=%TvOCm+0^Bit;g?JOE|d8C6^7Fsy6%(@louBdm+(xkPg<H
zT67#<L}DDh0CVPRs|?@^LEDH!1Lu}*ynW^*^7dv#E5BRP8b#m<+~F}89!I2C-l}xF
zxQq(Ms@{@7+XbDOc4CtHINOyUN*fzx<<H*u3HzwPl8S>3zVetjw?k21&CPTDDWX9x
zzC?f40zn^?ZY~PQ0WDYx5Zga~C<=+Cderz1ptyngCKluDq~^e~Jr3o6TA2j~@l3Ur
z5w04L(C;g`Qx>Ze0^lo-T<)6&#bxf*VZXj9Wg^m;sBE+J2-u6A{PQ1rO${3bvCCBA
z^~h`g;+q;niUvOBpr3qWx8vzz8#a^qdxBNb+8IliAxj}Fl311js)$RHul+mPLyRgo
zAGj(y#(M0*NJGE`U#-Wp<qX3P;KZAA^j@gg0YwEjciQ&r8wozV{M`%@<v2Hq@mKv5
zFYPKe7@dDP<`7BP#ODNc9(51l;Ucp3qYRyAK+IB!U-)RngJ1C=?P)%alGIr?NrcDO
zI@5rQTb!vys&0jTb;OO&twN1H{WeoFfj6hEC4m-TrvnK8M_5FYqm;9WSy)a<NbbL1
zOF>-lXWc&<6=%=t0)X+s(mw@HdExdy#p@i1)NH`+Uu^a`#y}8Q1j&vJxvkBNTu=B(
zmu$$1?ckc;nU2nYI_a#cRhx8^bp)ut*5Dy7k-t|t<1JIzX%88%c?pU#*NJJUYW%7X
z)GhIlB7s-9wzo4s;SrtIQ0m79R*?mv;Ia9vB-yEZ04?t>pd;P9Z#bA8)sZ^Tx7eO=
zCfb)RAgB{t6QT~T6x1z3PXw?9`8GCCjSDk=LOc9yEv~hu6-pT<Xb>JJ`@S5s-*V;%
zF9X6qQNP`l!G?Ttuh>}g0hr^}pB>;uo3qk{Za`dZ`yv9nWaDi9COEk-b=XPAy)<h4
zAqw0LQa7jg2Fv)`s+;dF(h>J$ht%_Efx;`gtvyqq)%l{{*&q`>KG)=Y-Qfu<qEv$3
zwy}U7qhd?cB4Toe?#*0oVMkSH2y`@U_Yo)wk8dFoE=d<|`U)=|En@nL0BT1@qPq4u
z0Wh@ZiB8c*WDPZt8NMtAy8yIVD?~4!0n@YDL?rv%V)!YRyr+$EX~!1EBnid=p{=FX
zs#0#q%`3)EnSzWO;!aR8{6GML@UOB=L(*&u|Gc*&x)7p=&VINS)8}=Co6}IZ0!Nl<
zoEQ6`{+|y(<ZBY0+w^ecu;3vmXgzFfE0CDO*gP}(vF3fHV{%?Ecu~%2$?LMhRLzVl
zS`0sUQ_gS&HZ9Cs^UnT{SAv2;edsKpr9NAlOuW;|zN_Y;o)pdkeCkJ<l$)GP>bKos
zPIRQYC?ayfn+o|27UCy0f~%(eA}lVGf|R4mMi%6f+Z3Q@m^p<*<&RgT`e1J|IuI+>
zEEzJ=&<44kEaHC0exK-Ds(v1<SBv`NAD%J5Lt>?HvF**?xRaPs+vyu>7>d-6Lw*ms
z1J}#upaRmn3fdg2qy96dw+S{&rG(iOQFq_S*~w#2yAlJx@~lg|K1Q{VP?CW03VN{|
zeoGGUR0zm=um0Qu-0i041iW150vj*2F;9x?wp1yG;M2xJ4Gj(Epf#H@^k)`@{=GB{
zS#Qtt+>TbU!qt_Y3nyLvD3{!qEy8OMT`nCw?uMPiNXzVi%3(c-1g0P~2EpxOHW$h1
z^EQJ_icbo^A8yW9klhSyRxwYJ$e%D&s;7t12zvdq%nk~}#+hWa7IM9G1PbGl@b4$<
z6Hv+LZr2AI!a9unFdMSWW6@?v%0P1ZqFP$9g&6t;xD4*slML*36oK7Ah3pSLPX)6E
zYq>@=3T`4*Dv7FsW8@E8@tDoSG5;hn$-k}A9+MW`OF+0iaV|a%w-fXYG~yQLm)~c=
zr$40HF+wRpjW+5J2>k<22Bd6y8edE1nGUb_k)yY~m+&b~3O&@mneaVGi-$JhDv6v8
z<+gxgT?!qlMQ<f~EYmlL;fNEx?}e5=XCSy*EgY(D_`uow_gJ+!Us|ygX(e1)@i1ZH
zqi>~ylqC@H6JJ8bSuRLx(Qf3L(b^|}=!80OdQK~K)eD_;`1<cV0BFY1T{{Cw^>%iI
zoEGuz4v<H$Gq}|+KRRYVYw;h&D7An2R<l<l5ZLyHakMR<+80^avj+g5C-WR%JrdET
z*9UHr!?rbgNJz;j6nRSoyj^cpmEMvNrD-AVZYhKXZR(ClcE6_A-LE;02ORz&KGMuB
zED<@XVaNQC>FP1R1F~Xjq{WsS;(m1|`PWB<#GK0IuxE#TjFzkrR|oUJ;rR&8FIi87
zavOp->>El>G?m=5xH3_tRJmt^BkE@33a=1n2Z5iNr?$r#t0xnr&S_7NJIA4u`t-#=
z<Jj$gNen0aKCxAd4><N2pQTDuwWNhnP4cCJa1b1Ik(F=~0g|CYStY9<?%R7w5fg3|
z+=7mbn4a*dW$#v4r5BjaGYVnOdkxBc@nvhnYxt<rkeE<2rh=dUhA066{`NOI6nISf
z#YiCnT*@LyNQ}gSC?lk9$8ZeS;uPkP#F9G+=LBu7H`+(N&oemhGGKy82q<aM_rJJH
zC*@DkOjPRv0M&MXt83J*J?M7TAKa4cqCYu<^3D*xwWlXP>eN_i_e}i_CaMy>Cn_qr
zm7ZV37aCY_<+ggshD&=TcM;^fPLpPy*9g+XKUuBF0q1$sIa$>Y5nDtA%9lJ%<cESz
zxY7%K-TX5Eus))%VzMci;G;WsnEyJ~`$HCJ>lBMt2J9SfI6aZT!|tKsVwA}}|IUJ<
z9ob`tNORtW#yO08mq4qL?%JiA%oC?Aa^Kd&MG`|Dhw;<;EgDO?8NygS?Egz=nI_!A
z!%{^3{twiNvk!_5XNm~%#E?oifE4K<?EOCg-asM0=3TCimXsC6us%-!kCG=^^E6ac
z(Hp7Qe~U*~bE6A?kCT3wV@4WB6}$sKsd#KC98;`70gJMnp@4CcYZ3E`QO>Sob^~#v
zb-Mybf@09ynxGPfB@JhLV`85>CU&A@4-A7bJJK;RXb3I?KK2b_Vx0ydp(b${yU%p&
z@QK@!+%uJ3b&+6w&XM>kyD1tLuoaB#a(VE%&#eM#b}~ADH{D=6S+ib+MNBLNkg>9;
z<k6Y+l&n03<s!(g;dd@aR<o6xGAar1hdK+-P0xRj2^Pz-yWQ))nzl)#6XKc?roL@p
z%QIXYgg`{#yF~Xj-SO^qunVjzwT^;WGtI$l!Zxq0KP0BlIxMew?V=HXB0Df)IUv^Z
zyk5D$hA7B?vo9<~ocSP_HHm|HuisC|7~X7%F0SI@O8lzagBF*laP^l)Jn$15WjtRY
zl;%e22=W%Nv=k?$+7jAo-(6at!3<YJg87g<^i}Gy!1TgE#}+dvwoIE~PY)Poj-!Wu
z;Q3MXDDCOX-Q~Dj8wCH6@mRTpG!H+K6Bi~`HNEA38Wp(>{!zgjAV#7IEX`fBGyDqA
zg>zjU>%U%eg4rf5f!Lt<js#}@%O1$`l9%;S=WqBAfTJklW2g-HhfEINJCnn`NMX>L
zDt922!MC=Bd=p{!f#)TljuufD4pH60R$zLVP{Y8cAL-0wW@Ovn!He@TAELvS`*|=!
z6OdnjhXu&987PBu9`3TiPDk%JPT}kjadG0f;+ugyZ`T}gbra-k=O)@G-}VB)_UHe{
z%bpVaFME<9J&yWwm5)@JBj7y0>{S}Vx;j-MS*f8*tgF^2c63{L1d7W~C<}w+!LN$1
zqOR^)#+V;eDPFX%54EL(S(k0zP=yx;u`b?!zBN3gquNb~fux;3I2>Z5X8N#?R9n|0
zi&)@DVLRCJ2*t#)EF8FoYZxT*40_)&*>?>fha*Vf#I=OYp_wETtj~qq+@TF=eW+~V
z@*Jg84!t)W{{;j*cc21sWr_-Ls#Yg(hG@)fKWSNq9Go@H{{6Vf0LG`>azp4iPNfNd
zU@!z*5|23miJ?G!Zt0=?+F*$Ob(($=f;5V_xAhPXXGm5I&wT|(2GoZ}d1eF<0b-s&
zGtBZ_My3tsGvAinkTRF-76>e-kiiqiXp$vy2ytL(6pyANnnKueSjy=nmc&oQJYnvH
z<;e`yuM5Wsk5SoU=FMg6yqX9P9)6;Kp&R&t6Jpbe0&Ecmp-;@iQKajXIG!H*-(i{G
zBguJdnR&P-F{ld9jACGvr~-ruSWI(POcVYb5tsDH#N`HS=Te!u-VZAwR<)~GE`%ss
z7vv)FQEP)#`G{857Nw8m-npSL6oI0ABi&Gzm$|R9b!+gY@LOLKV)BxKR$}sh{4HKV
zj;|~OfAPy|Eai3n=RvIg(PDMC!}DQF$YBt;rpqF%hb}}ynhcZ3a4@lLGh&Wzx#0%;
z>SJ>?-m636-E=r+mg%sNG3<GsgDu_lF|l0_`^+Mi!CX7=*}=JRlfmHNT(}qK!iLWH
zruMo9#jEK#zN=p$Yy~;HVrc<?Dq`Equ;K3wN}N#nnxux()w|LghYe_WESTGcpWU2u
zgE-4h(5q5vnw39c$s?num2N70%R#~5Y${D3CgDC;_fa@ANw>ph-&HR``o885$r@=I
zGEhlklFVt#oD8+<mQ;RQ9)%nI1Yf1saEy*Xg9ft3sv|i8>QpQ|;emC30mfz7^Ygg)
zG82wivTpH2`3W{&koS&zjBsx*`At|pjtkJCioLlBHlDeolVE6hj^Vp5b{tp3ma9A1
z(={I(wn0osr>^CC_ZX0Btkrk&JA44~X*Co@n+(2?rJ<z`3gN4vrmElyp*S?YM=%o@
zQe2cd0l(W5^hPWNp|Hk(;9XnhaVS?@y#N&E6Q?TzJYZJU%LFXb3Okd_g3$k*7Ntnc
zJ0>#}FqAR|i=oU=&ge8`Xqu)h1oz&2)_BZ5A)wael;ecO_-#jy;n{{mY^LGRAr`hQ
zX5v882)3DS+NNtowzul^f1GH_Dm&z=$@)kDkUSoZST0S5&tP$XiW`?bzNEw-^YDfm
zw4-n9Ui72Pc}I&o<iT-hpQIKK&T(kTgn4}KL)*|pEjtGvIEZ69hE4TI$B}6fY=uFD
ziR(p}1qQQi%?Sv#9+p&j!E#9VOGd0MT0SR9I0ZXfB~Z#@a4a`<rG;RVVj6;c7EMJ!
zmOQxyQY0ifXi!jpT{at1F<TIfH7{gJrg_NHrG!b&YSoycJQ%DfSRp#x(y-cnuGF0U
zySiJqTU~e(mJi;>$V}qfnh|1OGc{~EhK>Wn@~~}(G;;jN(+PW6YphCxxe%DrUUM(A
zT;!Q-#DTEzD$SB?G#d)tOL!c>3@?BW4rX>-7VB4}h<#jtsqytyKYv2!b*a;4n}ZYd
zY!Q0kY;$0o6#eBKccfIB8?X&v&PNA|W5Px;WZNr2M2>+Xf&d9z#se2q8dKgLFzO3c
z5I~D5P|{6#3KyP_^Ig4}fCyU;g^ZXC*i{T}1Tciqzx}Uo=a%cc={EG>7rO5{QRr(C
z4kF9JmI(=eJ2jhOi`kkUm~P-X2kPgh`rAHaHvu)-v~mX!hiOA^Ufd3p9$IftpOqB6
zpw@O#O40c_x@^kSvY*N{zf`|#E6t+01$+2h!<Rj-68_Fgpsai&goIag1@CmNaMvx+
z&u>VaL`inDT7mD{m$i?b<Z)WUFRKPQXC&z_xj7hrwrkDxc&=J~SJacOe6B?~bdE?+
z^z&?*(tf|c=E0}yS|1$inl>03gTb9h{~>uK(LH90EK1TvpDyF=HheWalA*OLciB8|
z-Qq;*rXaUC9d%=yI$KjZHVGZU9M(+{@7AT=Xyz)CxvpTs4h(a<=9t_U<6D;jTr`_^
zs+8q_<?}q|u;|N}C3N?RsJ5UU#G&-|kYN^9>z2!qJ2%|+J$NI}Mx&gKs-5F^nCo3C
zbEs;&Ue{Vt5A34FRhH0>*jR6zQ9=Ed<qUi<HiJX5;uRz1m`pC}<vhw6OW(1s4b)xz
zYt9AEPS{~*^pG!9uvH7-@97rIu~pChP_8b2_7=5sHpy85(?xxIJ}_NZ{P0_j!p}c&
z6mmv8Bd;BIzE6AF`Qk83w_kD#^LJm}X`W+ScWbNDZ2Plpx07sNM^s5hAK2G&xj6vs
zvQ59t((=7}r7;_k-WL71;655+dIwoqX5-Dr*4+avy9l-S7Q}EYrrU1Fun{=~TZS2b
zVLxOx2458~a3V{m_9L|6UvS2lMU?Vvuh1mt;y69sj8BRLE70n)PI0hNpqIBqE&D6I
zyap!{+6AUMZkveM4JRojDblrNqX1*XzJd!JB-IsW5#B+7dEwkE6s;Xl!Nut)nkIZi
z8qh@(nCXgM$g~}AUcCKWkJdSwki1}jp8?A5S0MEp;d?h|ReTxefDhF*;}{Zuh};#e
zRtJ!}<9WhJ+Dh;dkkRKaY*x$_{-}K#EP2xVX&~MGX7X8c9r!Qj^;3iyD9_34bHdV5
zdDVW#$9C0E1N1Y}s%#|fo6z^U%p_~u;@yWzzh@1UzaK)!2A91-^HVLnSR=lFMI~eE
z0S3OVAdf}fTnxgS*P?Q83)c4<><?~lga3*0RnD1Z;GHNUKeR&jUnT_HWG;I%R;ZRb
z!G8_>s?O*#UuiI`O$e$`94!<Z&UL5i5BHUsAL{03ZT8~lb6EB;9jj;ljI`GDmN(wP
znm<PZt*Z(jBVE%@G<4c*b%>0ALE9&$k*k+ml#V`~&-bwHEmO1XoVObOc%&YE^yysv
z+PI8<s;@(jMK`#*FVe^~${n)%J^Ylxi!*AcL>Jn(PXQxD-simgT=11c$^}Jpv!tkg
z4(TfHV!DdqH=N^Y8@vZ8TogJo+{?1?53AySCvo`>s{;MB)3UI>_p;c3Vo8iS-q7_(
z5+A*Hh79ciue$G^Iq8S2m(7Jf4Yy6#_no1<z4|6S<Rs5Naj2mOE_Q9p0Fo0MdyyI8
zK=&-y3T%TI+C6qaRGedi*r%bPD>uaX7_w&OgCJ+*i{PVf`R2+tC2}QrO5z+96Bfo%
z94>}yo@`Dnf!KJGWU~T)ji*T&L#EV4UO*1w#eYtD;tCZl%Jbw>R%U`&U??u+Y%&$r
zB1GhyikMO5w;_`t6!Vltf;M~M4VKbomm(I2QR$crd)^oT2pB1>`rnG9tODfNn8EZP
zRj*lss1S<yPw;O9J_f{NDWq@XiZH$c5g1y?u#_wrvnpWr<_gAtg*%9W!db`al9c0|
zP#rLuJPxKRk5k<Ygy%ub=Qj$hQ~lm9q|Wvu&(a+o6HV8!WrYSNEYyLAj8WeULmEYo
z5RUIeP&BuQtJElsg<i80G1}%Nnx9_xKlE-HfZm3^WyD<#$ii~&in5QdG5b0ZHA+6<
z>ml|NwQoa!#B9QUvZyam=N53>$Pz7^9dwBAlSPL=BG6A_oq)LNsEI(wDWnaTRO1y?
ztOl!Hkz>FVEe!>fHMR*WoU63D(P3jW*YlC9ev=|>4l^mjJK;O|xOhExj&iF`<_8_+
zMr@0Cltfqyn1QWOW0-i<#a0w)O!HhnqQ>D6Z5*Nt{`K2`9;Isz(bLoZ-<}~uGaRhB
zShog^lLLgbg;S|IDEebSWE72H5eEr3Syw{j0F25!7^X--<QAFNz#NH+I30n!&09pU
z6o9d%WQ0>h5EMW@8P3V}ukYXfE)1&cOwauCi&(OPiX#!Y*`_J2j?E=!t0I;@+VNyn
zBeCa`RhD0WI9VGfs*(v>X8^zdnH#^>80jjvgriUAvYBDCM8!h*`EYVPXbW2X#UGu0
z!PLU5JBM_B|0MATsPjk3cb#&`-&grAu&G8h!@yx=>DY3ajS15n97cxjI)UZ7_I>8Y
z;(kvc>g*HYoTx^>F~nItX9LC=k0&fIB*NK9x;sRFe}DJ71%4KjtclxwZ_KlLp$(vC
zRc<e+=aON(AFwCy_?Dn235l)gnuWsvQj`-f!k)nxX2fHR8Fs|<LsGyMpr;t`1LV0K
z<f&XszbW7;a_Jo4&I8=Ja{oKPo!?X(7MtV420Lw6w{_Feux7h1w(O8$FA5#3Ys7SY
z&2#L3@Ib=37VO;a2;D2xDUOH-0Ce&f*%js#qp;W0l$Txya0&_FmhdKT<N$7N*!B+K
zrWl6<xVd_c9Kg*-<HvbRY3?C=Zqms0LdOcQ>qHK=d{4ukMk7o$YMBOeJ&oA+7}(^A
zXm<iNCBy|%7l{)_SLWZKi05FI!d#U`L&$A^OAt=pr6n=daRpYg1*~z1Ml1!Gt-cUU
zlP}_-@>-mZh7FHR9PpUOVpfPem9H*_h-PCF3%qk6K+SRdl_%$rY?@WKPQ)1TjC%a_
znq05#Oq5ZaGF(nmCJI)asnJVtY9a}|P@T1d$8+=S8IwGtQ<eThWXa%J3Fe}~mw}sq
zRf2|<_$FY-LX2&Xy7(H4z-CQ=xeV6)RtP5V+;#va(@oviwFqm5X=2N@2qu2uVLx&;
zV)=&Uga@z96#!;)y?zImO<0J3<Bp`~XgkbM#F=+gan?9zRz27eR^(gO9Yqx@A6DV@
zxYGTV_kU&Cwx8?4;qu^cd2byq`R?|A&;dxt2*S|CK|l$%h)J=phY_Ys_o9GO!*w4c
zgU}WL<W@)EUhzkMmOKFX5#D20^pTIjKF?ezybgNgg2XM6M`+^!JZ@UX2d_##4hP_I
z^&B|>j|bqflMwfiaYw`V?Z~zRth<qqE!zvQ=a?F1n(1m(w`{{8huq%#%kABNnq8YR
zdy7wGnVR8SB*LNNMcA?o7khziV`@V}SnB!IGQN9y@Z~pF4ZzB0ZU&yaN$)k-jNU6~
z^KF%n89iqy50`xZ_W7Vn35^uwj4^H{fG$bU@T^2Ul`sI96=+&#dOktVvvB}fS^+cW
zuAwMr#Ux7$E*s}@C^<9ZD$_B4NOTp5U1o^E)B>WsrOCa5th_=%`wl=-jU#i=n52*%
zH->iud3t>w<292r%u>qPdP(v}T*N_~#N}+mfKODUrAk8hfduO|v7Shi7R&Dx7r*{F
zCCP`Z<DxTfv*?N}gjCWb;Bs~z^ALwUEt&4yc;^lLpPP1sh&r}mnIX1+bt}Y{r<>S^
zTz*mDYo1{^RI^s4AKHC|8n<1d4b}ShtYkr!efcYFfSVNT9^WQaY%Zhm#t?^I3~OXl
zjMI;_i9MBO4wz`?mpz%vUekVhf&#w(;xJ1RGAY=Z`bFJ2gWMob0up`^NeQ52mY@Aa
z(@fKGo?P}sW_y+4zNFQEQy@qhlO!IcXAnZ(ZV*LTT4D&-J~On*SNZo1gKg?8$P)TQ
zJm=;rF4+^=;h!#hKUe$hE42Z>QybtLu>taaoR(B{=v4LWl#fBf@K<fvB!PVpj8<tl
ztM<y1<74yzP=&@`E7GHZy{*U+;qqQg7~m#y%Y-YuEfUUzsVz)@NKru8gCtZ5!)Z>!
zS!*YL|Mof9vbgq?hHPURd)_V1WsD#o9oh<$tl%lf3wF);_>d9M)|P0NO>^}A^)nGo
zP#p^pbkHcxkwZXZrjr|z)4k=V7ki-^K&;NFoif!&z7d+tu&~Lr2wRaAVvjK&n=EuR
z&om-8SS>8weWSI1uvah4@3rP?X$tL>svhSINWy6?Sg6ke^gac;VMzl2=WXTLB+FGy
zhp;zSrB|dN6$&mVE3Zn%X%*13M=PqBRN|%TXKiOm4fQZ`T;IWt=IYp@2E##QggCUB
zM-AfpM1PE-`{*S%<Z}VE9$JnSUy*BuNQr>ttVCJL=4UK_NmyQXvW<$kE?)f^R030^
zYKC8!r^>z%-U1-}H5s`Z@nO%D@5G0zoRJc0NIX*zd#`Ar4m^WK)Ld<HZ!3iKJr{*}
z?_SY0R#){NYW>dRvm_sVR))vFa`%oB4v=Gx*s4mu^R+Y&Aj^jrE8t*td%(B)G%Ncb
zAeR|X;OAw3!PSDx-t*_5D++Z<3?u6aW+1`OUN<$*2E)l_)adjVKV;QvYrL9mw{8fY
zdT1+4(Z7J4a8gw{NB@$;QGC*>(Rn<F;>DB!T2h&-=dK#<y5VXA{w(gdjo7WnHSE`o
zE-bZS*LAwtv8(bOZQ0H8a|A*gDSfKCi)=oP*ZO#WwCbcf`qbq2nIFGJs-O0F?3>}|
zu5$H|986qbI^JBFm)nwdp<sE;iq|AyNu%ao`4_|^lq$YzI&>yu;G#Z{w@#+4b84zC
zE~?+z<J8@lm}`R!)6IY{eZdSfj6zDVuIWHIL^Vu8SH~Xl96hvbEpqk8D8W3hd@*YY
z=4@VnR=F<F+ww|m`f!dvOEyX(+nsA01c+f%AmK;E!;%};iw)Ii-}?0DmqiKqbYt>`
zeJ)tpZ;bBB0g|ur8!7nYsOH8wQoU-mE}ZkW5INVhvQF%*I`+JgtS5^4^ZkSjIqg{u
zDRwS<VqU9nwJ6Ul@yJt8f-2q5VDtW-!ISuZn|N;-+wT7rFjD0k>SFzq<RpYJL$@`o
z2bzT~GqAAl>L#|lh?-&O7?vB|V>sj)cw&$0Y0ITW^dUpfIn)Idn$wbr9Ry&JxR9tw
z?H|q^fMqi<6Ni9D$a=#XHQR)ap#FsAZB2FnY#~X^rC5cb4Z(Y9mQ7Iz{z{CYtL$cf
z0VxDWr*y;$;U)#0IzjJP#Bv6H@&MD7Bp)$2v3`R*YmPQVZy1fIW276}5WUWBkYQ;<
z^ePq376QMtJWajW-f<S_BrY>725U=yb;At9&<Sy%MH;p=H^3g#bWFX#@k2`^uJssQ
z_QZ#-(w4SxTOPZ>XJj=KAzj*_o{vg@W_kbm+2=n<9s{lohaV*+5kP<cy=?7FoXf(m
z_e1s$X5%$Gi_>y|KC1KSvIkQQ4i85g))&RJgUc}U>g%tw8@LFwu)f%uj&R%Zc#5u1
zT(%KDgXopwvU&63ZMEL&Wp*7CfgzzV%lU0MO6AM8j=oC8Xq?r{<R`ekN)Qr%_f`u-
z3xeM!aYqzhpygG!ntg0Zmd%bdQK~pa{m$~naE(w=^={MaESF&0QfxyGgBu(>n7h^>
zA-)iH?Oc5niJZy#@K;vyyp=^+n^+)UBdY^=mdzA3C0_HYZ)nz-4x4AgMv3})%VIM`
z?@Llniy=~LYKWf0@G~m7n)z{mB!A~}vxxd$c=08W=3EK>#h1_X!F=ttQu-5wPEXOV
zA|obBvlP!G_@qE7V^knL@NaP}o63S10^#8*-giz^ZEY{riOshp2It3T3KHy*IHHc)
zgVq?$<!Zy+Mwg}4r<fCQ)gXO5dUib$@<Q2^7X}=lBG;q-(*6#r{fvu$$jwbg%F09Z
z3kPpF;-|76E`Rr*+hbCFK!|@KGYJ?rhe3y|itQJxasomP&WEk;KN_&Cj<fhSVA<Da
zUt=iSdqHNM5>C%#g-&={Z^b<9?J2ricyyhio|+e(ULoWQj;o2>BcgYP(rJ=>Ypkp-
zRTc?>L^*8(bVsSuj9jXJN4kqWYDCx~dVq=VGOWA4YkIm766bqpKC4|+ZYNf5<*u@;
z)5<okE8?eH*87fX;r1i6L`4+aXRRT&Pj1xzkWU#Bso}2~Kz=WIaIv~FXu07@<*^P0
zo@X}X`j5;xy+nFdjvm~Sf#x2~@?tvw_!IQ1l)==bD8T=&4z;O&+(bZXt(*g;Yl;X(
zza~jc#fyrl=S@Bv+pqx70~@A!Vs?Y`=a%`L`%6ddaaS+r<xX;Y92V&!>(M~hfd9&{
z9Bf54!yXVyMvm@LKXfD44Ldxw%QNrZqHE9WRclWrHlANzEo^4O@{pw^z%vU@Dot;b
zG>Y@_l6A#bP!>ghELVYIIe0}C)0{WB%JmA?6eO`vgiowOWa6~30OuTIE3oD+uCa20
zdA9q9vA9f&coq#J>}Wm#$SA@jViAsX+c#KX5#I<N?Bc3*j%Sq*_H}{Y2-j;k@22_E
zbrmPcv?yU3taRX7dS>w>O*t=yBuQrKuoCXx$&4?u>Ik}jt{k?-DU>aDqJ$*|-H68%
z67tZ~hJz$`NUy!uB|gfdHNn>n{jdM~|M~y^-~WM*|Bq~nZsH^no=0Vda>kwGq2Vb&
z8_5hj7Dec*;A#d^lUegw!hyZ!o-R2=o1-irkyPp#Cz}A%AF`_9CGd5D#dqN7E9`3z
zW04a*qP}i_I@l$;fi3E3I53%xnc-@%{v+31PsIF<7P<MY7WuBI@e=I#muZ|(L{Jig
z8(y>mOod=yAo<3*v@XC>S->CHBC7{P^<E;XSqfD1SCW1{XJHMi!chRIs+uN4#L{BQ
zX`ABmsAx{5Hptp-TI>w1-bviFUQ5$dt*<hJF+zQRb}~8{q8INk-c(BD+(0ddPmhGk
zdemjnLtpwL*$hbr=yg1f%gSg;PopUu)(x$*Wgpr=!80eVpQAXADoaIN036hBml=RZ
zLz&0p{$&q=y<z?~2Zt|v4V%#KS&81Wk{c%!u-d95t`6qFPSITmo$9<jc6La(P4d6}
zBBgr~!Ao!H-f$NXfe!u-cU+bUBbTvT2o`@u*6MJ=M=r}OwFuAe;^@_jgK_v^9Bvth
zmkPZ<$S_>_7Aj}MZzaSugp&-cH%m>s4cSD5f>*k4O2(X^QxJJB6^)v&vQ$E9$ePcy
z@ni~d<N(Pj!cN4IC^F8{kwO<hU}}A$U2V+^c3uDj6&BbMa^h%CdJ)Yv%U||tbMJo#
zh+mV&1o2Y|OKmH6qdowf(lK*cGe4u+J7%$)$4J+-6Ahg<>r~})Mv^{=VEpNWZKa@Y
zK-D9Vf?&7kK6oYB(stY=4R{%|gbM@nQ)G)YkG!F0qfyQTYlAQarrR{Z11WZSi&|>n
z0}*!?y?NDfMtRjbN_?y8SB#WnGP!@Kb7YQk#?p6eyJl*Cy1(XJGW)nO{A1hHm>~0o
zS-R^8f0qt6d8T&ksLJEH&FJrx$a7gL&n+Ixh5N7ZcshQWi|F_l@hC2#6Grz|I?+;X
z`4LJo`oO-HYDcK;WxMPNFSE3KuZHRC*Vo`6+}pY@q6=bM39_=x#$EHq-eG@}SNARc
z&Z>_rB!+1df=!PQY&n!-Vmm%|ElRz}GXo>i4(j82=2M`XuN^lMh)*YqTORx)t{R4F
zZYV0bw=d^IQWOecZxQCG>$X>N(PBOl`wTZ$ot{3UKz9Q8so<RFrls2YRG>KG5dk?%
zct^lEB_ww;nIuv+Jry=8(c*tgcEfUXH64>wINUe8(&v5WwrgmjvJfiU5G;v-${CP=
zg^t2ASb;{|<tqp6=k26uSn4?QL&IJc7pRzqAu9@jFJ6(9a+cO{mNRsd<zG&^J9Gy#
z?#kJ;JhVQ;!5r~;9K2zto)!xh2*HuVm7;~|9?a0qmBPDW5sz;jC%J!IGv8e+UyblL
z@2)jE)LYw}&vr|17Hk1rsaFX$+OdNCslTXL!4*f&=_%T<WhutD=G-W=B)egG|4l}@
zrQw&^0KynQ!*15U?8)t`H@xhTe}H=e|E+3~{|P%RxHR%V#?>_bO7poZRHc7bw}i8*
zWJ?eXBMr?RelB~JuS9>t{2=c91{-P3=CPQafDhYJ1Bn>VJ86P=j79@-!rgys0kMKm
zceDuW0dcV9x<2-tkYW~DmSq@`&Wu%LdaY+}D)Q;u5O`Hgk{ifG+b&(2XOhsOSPLk{
z77biX>`22Jwe&D>Tw<~HE?sNhcIA6MdIHJ?(zQ+euiuG>a=3pNM%YcHmAV&2p6_ay
z*^uEZv~}$39>Ih-zDX>b>fWjtfdgq}^>ZMt+zV;ts}>vYf2}DipK<BFGiBvFHfA(#
z(@a)r+<>qWY%(MV9^pzk>_2<;PB42&HI~qE4BpT}Lv8X<R#d`(?hDf2Hji*NEyHZg
zipp1W9ZTgqk<fqb*{gSGBFH7NxXD!l@DdGX(xnqL#G9)bXvKMU4a9~e`NB|=LFlsR
z2FQU0Yf7pzbhqR>D~Y&=D9uoj?U}ri#QAP~l{V7?%?Um1x~_#S7FgH|+z8vQ5ty!N
zQ07_pnV_MXV(sY-->aJ7V)n^tzKlp=eGJYTPRlJGFXw+c&_95Br4rE8gq1bq!K+6i
z^<#w+^#c}?X~F&HCV8CYD6bdd;N%CUfU0JwTw2{(FmIhf;Fd2fmWXCYx<y%tnd^ku
z(#;TiCeg5|6V0X}b8O~5?vzeVs1nu%-%o$7J?-B@XbKN8g}kEz%Un6Z<)#kvdkUvS
z71shQki&l*7g<rN%tnh@lf*g(%@dvf_om{F8Yk0SX!yS|040ht4@ueoot1zgzF|c{
zM(h<uLv)0XhUgs&<4MfYQcy`!nzN!JpInaZ$V7nx*ZDU#>)`b`mt%0A(M7!7J624S
za<9SFJL&olA|!j1lgZVVA=z?KZXQ=Cn@yf?=f8gjHuC8>eFK@u;B6$d*%4J}COFdf
z<I~pz|7@1u@-_Hu-{mDbqA?Al@)lr<G9<fQL8%?A$jSu#J|3mq-zP0AD{xmd?)HY{
zedRXVSmdAIm<OTSAA5H=TYD|`G-A%aQ}WBb$UTG^ME7hB+kwll<wq_KNN8c|d7fsQ
zB(Q({;Blx1)t_93c@}|{Qm`5-F{G>3u$1;~DRrBtl~*eG7!rZ^C!RJKB7fnsuL;fB
z_ZRN?1Ce_{(C7?R+%auY%yFZIaL}acZOV*`aMF$p!IcH%)8U*vgr|ZKcpVfRXK7q=
zb%PI*3P<i&%wQ!WV>D*4ITsCGy4Lm+rBr{zWq9s|%<~{sGVy+~vg1xN_}(!|Djgl5
zg6eBlRy$=DK0&V{X>*sw3vQl9Q5J%=FP&5H;jfz&UEw-^!Igd~m2v|Whbx5K8p0TW
zap);QS2>H$kFLscQk<QhLg;sTQkjuX!fbrXQamkAl|cz-+|G(k$3Ery5`<Sa)VP1Y
z@G$eyG-tSa-{$?JpLq=;01A+)|Nidv5a{xyP%S2H2w}J^FHX?YQ^Jv(JE0vaWC!zM
zy<a+_?}d&-eTG>?BW!6=hyyRsaKKEPx)JqV;y*$iv9VR0p%*+|z1;LpC$0_q4Vj^S
zy&DZS??%dhUfu<-nuXl;wZFL9pT&Rj6&}{|8dzdaPgOgLG^MI9HN!W>XsvPxE)N(y
zAC_x}s<m3>dl~1o_6lsktz7V+0g6Wsm4ijYH9}kgHK`C@?l2II^<NFeat*m2mX12|
z>1ktMZ9E6DR-4~+sG4x{>e1q(QBR5G6m6}M%2HXi1q8f+8Tm#`#sz9P@Bx2-JMa$k
zeUn$zptl?^T8;jEjyUOL^F;+0T$}x^S*h(y06!m(E<CMKqdxar6+w(xTG{VZ*<VrF
z?^M}etjsk){?!|Vb+VAeJ{AX7rvtQCsDrfp*UiU~rD2rEblW5iSzi7!+jm|DVDtJn
z#t(@3Z{6LICCkgV(gLf0w>*Cg9p>N`Bi0Q<x%FsmJ64;WHomcPzsqZG$#_`pU>%3B
z+Ah16_qHov?f(1XTm&%pH5&oeu---CPT?d<KZ9-UzR3NWW_o6%W5=>gY*Aaofo@Z5
zILsoUt_Ox~KMstfT|gKpfC`PJv<t`DN(<_%cPs4sLnQMN#QzYqYe0Xn&n4y;oFR?T
z<7421I6i)!Fp?f0H@FN-o}6-Na^WVB(0FXa4mHosCSz4OIU9se5l~K~PxQX+u8zCI
zx>6%{&va_4ha`vsh8@k)uoXBA`ysP&WO>Z@U6V$ke~;Hzd%-At=>z$~(z9(AUQNB$
z=bprCycKS)m<a4>fLVVjA{@^o={66|*`L!GlxF3xBb{PEiYKYS!+@HU05X{6=mzv4
z_LYUxa-Per&E3|b59Od8yJj59YIxO1_BS4Z(#rJ>OK_4E-~!rwfrjF@?*(a^yZAx0
zXw&Z5vNR&!vvn)Ln(i9d3N3~MV%XRxHnVio3vE|>j8NC=lZt<PJ&@U%M0C{ggszJd
z#LuQiG|GEOhp3;S7mQ9t^c7o+!9d$%fw1s(nk#HY!9%d98`5+$8^v0vXgOGPzTTli
zR9ou{(R5(o0L~&zv=kqzn^!?V9V?2wBK+x3<_Fq<fzBc3RUX{eET?e@bXo;R{lW15
zE9^{Z$SN*6`S*Vxs%*vEu~57@jK8L3TypJSX3cm*;zV{{hE9<<c`mT|M!ZyoO|h?K
zPB<J$XF!t?_McJ8!(~arWBXeq9Ngv+7hvols0sTI5qOEo4VNyAVu47Wli3py19%e`
z4Bg~pvQSQ#f?$*qhCxde^%i=aih9s+n~9?0@Z#@vve17IPUgki{G70KR9>wvcz)hs
zvOs7;!Y`kB%>@i{FsxVa=_wL{JN0|8gpGN?7gUyWpl+>x!it{E?+>S^e5|>xkGDt)
z44)(dk5KkCF6zZLSe6PV9lv^k&YMHH_yAe7%y=Z_bxh$zQ9Ht`7u5q!Pt{bHb6h~}
zuSrqLiL8GRXYK`5#Kn8QjAe>=aqCrDvLuN|?fEUgbQA1L>Sp<j6~S2*kS)fq@$5kx
zD-^5o*{jz;A9*f^dwK5`tG!A~&W_TowYKAOKmgiPt;@OEntshr4LEtq;)^xQeAGUj
z)UU^h=N1uB_3#g`>Psu1{VG)tzU++&MA&81LhOGXB1jJa`*eo*a*Wd@AFUB?TQ^Y8
zkT)d%BGRivMJ&`9P=%su*2ImPr^U3Gh+jGLp4dZ~+yJ5IBxgm7z(}#wv`)g834sjN
z&9Mnd!CGmF=4X}ILz|;;*{iz)!;$4nzwE|}3!ey5KUQshcqLB3Rs(Z2xbNKj#R!P?
zn-_nZyY;_w|NPcI&5w3|BmhkQ1fmYfG~w)uIyX9tJxi_i#sR79F{&;s2v~%1TFRAI
z-C8_lWKYB#Y@AvArCTRd&6v3Cr%JKh?8Xr3gCV?c>t*7o?kk^PaRKkPu64c9@kaK@
zVot(3hvm>;oNTZhm$WY4{rz-YEyQ9v?u&n`!qF411~auWSIZv$9xO-~<{A1|FhMPm
z+IVzrC2a7Jd1;goKC<GlnU~#Gr^sHANvd3>3+Hy7v=n;XvVO&K{M6gmX|m@Ab|_}^
z{4iEviWss+1J%gF3}`*GrE0zv60_v`RNaC7Z4TNIo1PG!7qf_7<b0UpEL9G+@Ew2W
zdN*jNIa=d$yR3_=k{>O7oyV65=`NvO_sQo@_iWn;!vIr{TG+Bf3llSpu;v<uX41$v
z4f}D&8VDpS79L$PR;we9wH~yhGUyD@ss`VP$Tz^BurUDPheQ)>t)w@bZv-C57V>yB
z+8jN$Rf6T+LJRImI^}%;fL-z_-+F(4+B{_QLC|~I(KIs%9cG4Dvnj)t;ZW@B)Wd=0
z5z`4QM%?caV0g%bwq|g?N7fkFGjZkjrpz6%@4&9R(L^Z2#Fn^9SGi-jeIsX!_J;|}
zA)EvZ55hW7c@`=MXVo2&vwCx+&^s8SW=!Vs@q3_vdBGA^vg6|+IzIl5<g|Zv;Y|kY
zTxEv-b((%bFSCTQeD2PxG|0ZfH8^*UkN-9$If0#xp?55SAY!;DFgl+2plKCpGJPq#
zhsdrbkHEJ3<X+Q3wYRd?U_z!uae_XO^e>w4=ppejCANnxKeVt<^bmWl8QQkv2aI+i
zL3xCf=?!sB9>WmT$@3KoAK-uSnCoTr$}O)5IP61eBq@f$+(L5;byzJ<6+H^+#JTt;
z1;N>*g6T&&0gutvW>GoKj^mWaa&R3!Bnim{gO-ryTA)JP<+S#@9h0w}n`jDfjV8zl
zU@s8U@)%?l*6$wQD&#caxB_VphD_X8l<_`Z_8NQEW$)9u;-8jY(a?X!QKQJwU<j2O
z``W5XjUuvAwZr`<?0pg6`&QLnR(8Ib7&gj{4e(O3YGW_W#a_Cq`eMl=E(uqkY7rWM
zNhLpE4oY^TEQiyfxSU(EFm#V!71KpsEdU^bUsq!~eKHzxX1nScqO7uiHM+Iz6HDY}
z;nq-F@p<bC?OUqC>Q8@L*IZF%p^3(4T~b-yRn=B~(z@!>5<^WPLs?$7KWryNW?Nk5
zkx-U*MS1owSad>i?zmV%4MsdhLQG5=V9S9Zp)jzpNrE8o?SNQ>-UV*8TYGf2CGBmf
z*jNw}-J&-3ZHr=ynKmYdVdF5+B9EAic=~~gtzzEhUuSjlo;80YWQ!C+kBWUwBbsgc
z7R8aLo7l264|4)QFS0zHFw+XPRnzRizE=Gl*w^;LzV;!Tpf}2-EaP;alktSaBjBWx
zMpq^Xk-N~a{S}sS!&c9Qswub;35|<G31R&NQkLKoeM7Dx3{$wifQBWzBA$<4y?{LM
z@hBDONKN*vh@OABWxA$|9&)@M+R8vQ%WeRSsU9oLpgawvbXehH`mm;MuH4y*Au7ZJ
zXf`G>5M@bsgK_+oqbLO#Pk_C68h~_MoS@%?tM?V-QK&o_Z&9kGzo4-RkGbNCOhhW~
zEX!$}a?o6iMgeT);4oWWkrb&I@kKuy?o<#LSt3*Q9&dl5ox6yyGf0BTyHaM8dPFMY
zf0>~x(2*5mdG)APka>_~;TPysaYewgA;&0Aqns3FJ`Kxh&i2eTS5KO*j;m7gF^SKt
z(7}3ON7xEIieZ<<e&iB8FhY}BkI}ZpQ)Lw8s+HOpZaFu^(&Ot=F3VRG;no6cEN0YK
zGiTUZO@DuX_Zo#s9DZ55vWD}^Y9O-;K=tRmI`|2QUpQ5wdIHSuzrTAeTpf611gl=<
zsHmrN|L=Li8<MyQXu{wd8<Pc>L-A|?PQ(L$nW=5*9JO0n9{)Rs&q%k-_Bj5Gv?g`@
zqK|32JlD_X3(W&Cs&9>$*TpYbfkJ=g@>&(m{r7)7d6h<469oEup1jVQX~X{Z?s-O;
z0)OtxoBu7Bw|FqMc=v^`x?(KmV)|RXei7%A?2^Acpy|_;UiJi0NReiok8aiqn6C*i
zTJPL!`)xjY4dDhCz+OK?|3$cpU0lV*72jjy@l<T_!u>=hssP_5j#soDTW%W*zbmI)
zW5j>uWLt1Ws~+0;EXzBxQ1w0EDqe`4qOL7217sm?Evd-&k@@Ol@`Zga*kS`iWG}YS
z_?+*^O|yFA&Jfw!%E!xHto3AZZRrDfEb4p47O4joih?t%D%pa2n*|qU`Wp0aZja;Z
zZCPbG-P)UsM8>L%L!_{<rO&GOoK27Uc=Ug_cL=r`9{dkpTGhkq#STwXeyV?aheEzH
zNiWq_YvQxLiNAuU9`|<zsO~c<!hXTZ&(k!{(ta^X;<7Iml632CPXuTg{tX(xC>QyU
zp9TZ@Opvn-jf<@fm&qDW{dhDl>mGeNZx6)~eLPZ?k3OB(@B8tnUQ<V(&g(zmR(*d~
z9(_7*e3FkxV%8(M9*#bpx7G(QA&%e0f{V)uic2@SH}Th_Pv_O>4x69tyzzVU336%F
zZOaQ#hOYwz)BEVtd9^6u4orJ>LoI<l`?{4PsaWs+`o(eG?AvfOL~$Zsup`P`6DxKO
zm+y+4&apkJ#nBmPZc;v)+f{nI10{dsq)z1+0F2h1hEYJH&-v?efK+}nfy8x1jl1XS
z+mYFF2X4z<b0pp>L*hzW%TCN5TVzMvW0Jrf*F=3T99G5cKEPpBJe*Zg%SZQMRpgAm
zAo-WWaUn+L(H|H4AeQ<@@N6fsQ+c}?#PoHhV~rUOwwT5+@u&$zHfHGRrlEhi_mynp
zDIW*KMU?Z)o;12>+D}iU=>~^cl8{Nk&eSh$qfVVN97<;S*<UoxG#%&3WltDilo6(+
z)l)zR!6b=C=^5zRd$JO}0h>DCDj8ig5>?U#`ZXPq5f5eVY%h98(l5)*MfG%Q!n<ww
zc$!BfR0gA_AxZf4ah5vneG7j*4l-e{p*g!jtm-I&=(n6El7=TIH<eN78jcHgf<9a^
zkyo}TvAEXg9k}jJLGMat=+DX<h@yZ+kQG)rA`DR>ctvVM3v`jf^CXN7EoD*3QdEpd
zl0d|K2^c+CVfb5}pl3Y!<v&=S@qv)Qi%1bVW(2y^7^`f;peKZvT@QbUpP*l48W%B)
z&_U4`Fmokr6qhmh3)awj<CA46jCh8EX`E1qZKrV%Cvho5xC!T3f<Cm#4j|+*%}PYB
zNu2Pd0$}J6ylqGc9fjV2^?|=+mevH!$*l2o-XlJkHvrP`FA65JmJN*)7;{(bx}s>f
zgVpS%;%gRts=gqY9H)N;w>>6Fc7vxA)F(G27o1Kcr9+AD!jOob!%Ux{061wTkVJEc
zCZs5CvK$yR3RViVm>b}r^#vmwnA<oc{2lCV<E$w87%{q~#f|yQ(gVxInq^wpGMJ6M
zK(nx=yBY~JM-M#x5n9~dtl8vplEOHz*y|vx`|exZaBh#A+uwf<hP8uX?O<3t7}gGk
zwQpcplXmc~MzzYyE=9Y_P<$|-&FW#<$$qxl8n(S<?O;DU*v}rS{p^5>9*k%QBig~R
zd@w8@49go2i-Tc#^UuMsd>7p<?wtLs3Ab)zLDQp%d6Dm8LR}wQF7>f*`yQs$H5s$5
zkb3I_JJ-C%ryYNS+`=qX?7)A-g|q~0h}oMckGbFFkbEG)+GxBm8&60cOG{f^{QBpV
zBp<Tx7qwU;w~s1zG4LXT=%Iye>M(2(H^4pw)M!kP3}OaWXs?=VOQ+fLtTMg0c%8vQ
zSf?NLfcW488&AMQ@{0EkC|~20CAf+YQ{iDRvs?s+nT~&5CCMlV<k;j4H!D0ql!@RX
z&#qYt?wG4TU=IkJxsyG&YySh1$jknm@V{`?y&_Ad&;eW}<>cKGU0wAhRr`O`mI(92
zIMG*@mwgxgVW#if290n)91YuA7-3I~9PB!gOAHo7wi|A0Y2nGsiZA)h3zz0DwEk@T
zQT<v^%X)uzfnI#9_Kl){^ny*2Y^FZ=zi0WEAj`fS4L-?ksz$2Mr|d+%YPOubov@sH
z&ywVooEWDNKT%9b$cj@*UY-}HazxbhYfPUWnZ%8OGBm@)nuRqTPlR2vQB-XyAHyt#
zXpQFURF6Fx43AFhF20xPZL9tr4L8-s^d`VZ!)bpS|2bvv1#|3CmkDt+7z{o&`kTnm
zpM|ln9*0$tqgF-ACcqQ*Hf>`Uy^lF7vS}W&SG0drzvDZ36*APqM+GBRaWq6n^IsQJ
zVz`FOT-yk2>Um~pXr|}VDDcfF)NH-g4R|0A0DzC9p7DzImv>_QTsQ*D?b7ic4AIe=
z&!vBM6tS40ookZEaNZaFqt9w*ctww3=vB|_ZL&AXvkA+~n9ZFfJ<5tOk0<K;RDrQ-
ztj^HwcEuhz`>P2*zYX^Or3kOsn81@&-eGa&WK2?NhZNf&&p#~g6{m)#`(k-CKDBzt
z33$@{rM)Zl5|WOl?QPJQH^eU4u=EoR{+oX*7mp`d&V|sqO}*X|)CXL)@%Pk*(Aq_+
z8VlQL(~8VH)LXX^w!5k(>9Wq=$WOeqkK!G>_Hc1eRE1B~Q;Pr1&<qD_&eBb-IW|it
zYTYq@FnN*XQrix&X%Pq8R5vm4{0N)69q7a$R%9<_x~w+O{halioB^7j?)R)@Fc5#M
zJpg$6#5F+eN*QpoLs~blg~|yHyu)tkh6dhdDMC-nylQ00Z78sV8=AM&4NbY8)s3Ug
zG5?aJTM#O8hHvq?W$(Bz+PaQ%a`JXhm-XXmJRYGdK{S5Zv$V?|D)R9BvfB6J@d!`y
zjN))y;JmDbJRD}@6Y_<O39vk#q^y5D4adbPnZ&1Ld>W6*h(XHq7o;So?|#+aOwE8l
z_p+=yFC6J=H#+%s`7iv&4&Oj`;2WrU!QYh=>8bUOO1U4`*|JEA*jEw1l||?(y8-vF
zigJ&S{)hlKf&2u5^<m=|JOMAPS0y6gPF0{;Hf^`Nc?$I3ym&j1?0lqP6zqSjvup~v
zz(ypE3lX`TGDZvjFz(w|z33F^0(oUlss?UY+`EvU&Ja?|2)K~(n@<V4%30L-?g=A#
zdQyFDe$KHJPeF<iy~ST?eyZZSuxuWSvk;4?fV1V|TmJ7a-aS1fKlA8xa0IH0yq7u!
zdY+{z3(G7&LI1|sq-H6UPJe&f^p~I0r%GJ`ktK>ppus?cIA`1q52BHOew~d_#W{v5
zDTsF#J`E{QlBFZ~f678Iu8O?sBUaXvgJ(G8QwoAJ83ljAIHSWgpYW(qA5pA~g>`Y6
z{*1uA^n#PJfuA7*SH9!c_XajTg37EUJky(Q!KW@xAcqlmOiU7ffqQ>uUIUhqupyt7
zA<#vJ@IHKOb6`wJ<y28QoZ!Y~@8sm<vWK`-%;`Nu@<)+ll9O<d040!ZMv`*yO$Y(W
z#>ugGhszXW4F3}^b$tA0nv^jvK_4yADH`)XtD%RtELZ}DabRZ1ax?}%)LL>?6XN*z
z-_^C_V<ha6V!5#!F>`+i%nbg9JgbY!R>Vu3pqE*WcmdUw{+svjF9xUxSxWLaD~2db
zgA6GBMBo}U&r3=N(&OW2Fwf9yc;%~X3gok>UtX~|Z+5r50*>{`gc0y}6eKGA{W2ak
z%v~^HR2El_7#Z2SS`0ltR_#<JK|&&lcqhr)3u|<UzVM}#q5pqw|F8e+f9hJZU%+?4
zN8&bM6710kBV!GIr0ClM%O-(`i5}|MGO2+*+x-98d$Z-Zku+WKRlK4sOAJ=Hh<#Be
z^O&SeWywklkHoARD=|&xa5#b}B7i6WK{C2en)Mr;i_>>=F*9#5*Yha-0yB>=_Pb+^
zKtuqsh#T0JT_S(syZ`R~uix)t#g+_Bay*UN+P*=f>|L3Vy3=G47Td;qvQ!Cfw0Hk|
zyYzufQ7z9_uqoLTYqI2ETV)b9Bt{%V)+J)<8#S&wOsKZ)t%HK|t<W~=f|E~KmVtIY
z1p`0%C5Rjnv@8ze=!60<&M4f*e*?X1ORt4?h{WzpNala<p;gt8;OAQ+BG>wtHSKN(
zpsC8;4!|<*cm-rrvF>&Rif-TWCK!@-$7>)fl5O0RZMeH3=(45V@eoYYG+GZ~Q;}v1
zO|5e-uD#|w-Uj<p*5}5@ro_`|_10{08*LmzZY}KCd)u|&*#8xqw`N-o7fO?vm<`=i
zJdI$c*&ct^bVJ6(r8;&cT``G9iKnjNVE4>BRdDq;)(MEifWsM_1A=pwx?(d*M9y_7
zd*`}3vr%B>6-J2MU{S`Ae`#?x!Swr+NP0MUA+qP~NSL5m1QiuG0)6>+bRmw)#oz_H
z7|2<MJihSaPe1Y03rDg$6rTiR2&weMlA+&6XrX@<bGenjGj;{dn9xi^6;)cU^F9jG
zOQ@tuD{9#dwE)sRWiiyVvwAff(!Ia22J-g)9&5b_a;%l99|XxRQg12SA&gcUuuH&X
zNs*bUs#sGT4Qqz%VaqcpmNjND)6iARcK0p&$~$Y|EBD<yKfG!s^cG7DdZe`_13$dl
zlVpFax{Bf2nvETYSXi?Rif!VVSaB@fadm1DXY=h$SrBkRuZ8zcF@bX)-dv-IR`uTH
z*ZR-5jLsmnCd$$>Z%$`6bIM-j&BgN#fo=ya-|SWkdgwQs=$@@>hKVf=6h^M)U`w|s
zHZ9p!RTz(E-Pc{^;XD{{sUe!W+ny?i+0%bk%X#QMbqs2&F0-&~xHi_PEn(ZX9c-zl
zt?Dk*4Q;ay>u&dygPL~RQS~r8+G;Tmy`wghB!gKp);!3&DmgZ`T}8sGDe10jP}wBz
zJ>Su{lPQanC={l(KcQDYzwUSo>xbE3Q}<-1SRQ7!POxUl5+<G|VZ+f(N7boIG~<8Z
z8|-=t)m2Bsj=@~4$-0bf-E**`dXnW>n(bKHJ>THZQ!?qcquOCMwAET3dP6-|ktBoK
zShXD;Ybv4Gk#rYprYhNtDT>RSd%B_Lj7$>rC-fTJJe){KARW)@fws2Qsvdf48IxoW
z?h2}VCh%<<wiISzT_dugnVRen<(_|TE%=R;91}YF3~3q8A|Jp%#I}P^#>bHT6#Lg~
z*lpA8!|Zvh<v#cW?0Tvs875X0!@!zFEbQ1!#jc^-x+2+@s~Pun&mmCvPb~oq>l=EY
z2e;K)9-K$k93~N}V%5_utZ6U^%`vc}8B8{*DNFRea#WCu=hp<ZB7Z_Z--3Tf#x_^9
zaUgcN&AJ}^hL&AblWZBAj!Ln{6c-aoRj}nSOCh#ptFn5}xv9cQ5q-R7aSZNs-S*c!
z&~4miX%DWnkeQ(vJQtd!V~yC5rN?tIV@x%uq!G!zuL5p8&-kBEnHjVrhjk#ORI8;u
z^!`c~)l{N+*wZBiL^2iIj^%%1)iWH)F%(Df?(60J223aD0~-_2Hy*wDFoe_v6F&hZ
zZ^t8S9cGJLt?r?>*ibFkR%H)+s%&G;mNo2{ii<7Ru$V1t)O59by~Sry;)^Xl+hL1k
z=`efTYIzUNV=1;GIgDYdDg;zlF1B4&!Hy(puA_J=q4!m{oJX^uBD{YqL9ZFuh0)RH
zkFSSC)Ii7WK9rKO%}TG`?)?UL=N3F}egfm&nzNh{i%xAKyM}|Q0*s@oIN-x7Va+yF
z)ihMyT<O8kr#tNoWUU+s^fZro;^{qGLZ9-;_&l8rbN#mIXf^~-b@z^HiSpfjg&r^B
z_o@IJjLzaHmtcwrtCoLQ-y7q1z%?I2G63EoW|t7DdkyaX*`1w7$0C<yxnR=>f|6i7
zS$K#@ew2t9ojlYg1D*zCdbqH&=nOy3GF^(yrWKtiN~0)%IFJ+t?3%?Q|7jLa5Rf^~
zg-NE<I3n~C#*h$?jb{+*Kp^fZNzpV*-ZuikY0$}ykOOfc5Hf#~<=2EcMiYo@I(qf<
z>!AS4jyPs@5<&gcr`4pe9H@7niQyN55H`PIdrNWO;`UgExma&A?>KkyHfe?|+n%jr
zkAMwORw=faEMe1-b!vF7%M@?$E&Vv#UgKL|Rl8m3yIt(vuXpj&B_UKx?C;%HaYsz>
zRrugM>XQG?vsZtM*fNoW3pwo4&r(P;&x8B-TENUlp15oH?UCIz!p{#)Gf4(QzGwia
zKv=&pgL4FbON*ogh>6Us&Mf62S<x&-%pGTegJtY=k^gq$hY-4gPEi^`CTkKeWOyyp
zf!5Pj4vRFi6LQ<Si5l##XhMLMqhFW^&x4v?5Zz>hh079v{Tal6=cNd|@?e3A`R0SD
z^!S<=28`d7#Xh9ZV@JFk>`rxL`QLJo-eP3PVd)J31s@eN%GPO!o<A?AnazAy$q2hL
zpX^d+W#UQn2cTDu)|};t&GOH#Dw7$7E(Yl21pWE}qL6vwi<AfXLUf%7Sj^)+A*POm
z*+ax*Ug7KKw?DssM@NAlG9*hPBQgx|<V3VXAbe0fo_>Pd8Kf5%0gfW)1DwkQISiVb
zO<n%3xqSA)JkL#0Jl9!dY^9TY9dZR*k%agUJPC23YZH^qX9)DnN5_Zldpve?7UrL`
z$&7$z{PY>5cnAQ0UwHJ2_|;WID&dEhQtVdu0g4a5M{THoR-9sp*US!aO9B?%B@c>(
z8z?x6SCuH~w`?-Y<NE%mk6(*x3Y`KZOTxYaJAPE?+26DDGIEpQa&4YawA9Cow6cC8
zQaIO|<{4i3O#$x0X_N>M9fyp+Ua@(yQ22}V+i+EPpJxs*b>k?WXB{q#f)jMsl}Mk$
z^V0?_9H*Cm^^U&OtNxbdzRglU*FVApz`MCJ`n7HGIY6ZkQN?6&#IM%j#h^O9l?P#A
z1dH<@)dtYw*wo*yf4n?HC+HJfc+9e#Ga_-dh+R%2#KHtZjc*vbgxvISF>&0cG8s)8
z@!(z&nhZxDGHcY&8>sm63+N4xmuBwTV^^)P;}L{^8xwAWuf%nap1EZHY=q2F!^s>j
zb@7s~FDxv?Js%YZ3Rdu9Fv^ag_>BitiwY1O|CNMus8OymukeXY;|QYP!Hd6v($}US
zM;mgGSDI^=h`fOm#SBK}%(H)fV#zE>tE4ts8eX0DM6?9~%iTC5L*h>S5GAE%n3GF>
zYeNKoIjkp7_;drwmO?~=B+9Zhi4;Ov{5dp$oEg1h>GOirUI)?4eL0;9g4sl8_0r#f
zyw*?`e*j*>>Xd48{;!mWdo0sQSxnR~@21K{{)yc1$wAD?@OiyT1MMyCXPZ_(@|4qW
z-Q~lxFhp^HWDzu?G~a{uDw_xlsH(!}b65y}@t{*O11tzXEcu0;M&6U)D?hbg-{+qy
z{B+aXpK}RKhl^9@(Quc6-CX*h37N&9l;Lbw1X->Y<&dK{XUVW~FlZD5_mE{J3+OBm
zTwOlTH)mhrnqN7$#vA!Cyfc*A{$i}B??~9hM@P%M!_$H^(#x(}mdrR>i8q7XY5Wmn
zXD*se>rd(k`QtF+`NhP_@te+1xEsnf>|@~5IZD!KIxP~Um3#F8_Uh~BqNg3Vt=qFz
zZjZR*vpU&mczJ#^o$)zz+8oY|9d2u8VXMt~zPQl8R_fjDQvczetu^n1=S!>8mz^pF
z9e>8PU-5`Htpi8=+2=yQw`?&o34I#-VJaBfSa3jm6XRL9bo1tHFjocD6irRyD74Z*
zrSPBV^K(j4uE+*p=hKV9&$T9jI17;;-c)W6J|#|a#El?FM@MNCGZK_cOVbVvhktG;
zws=N{!{NzNbIT9u>c+~Ot!;;YZZ~?oRDX;=d&A-ISe7I#OVV(p42K;Ri(vF=ZS*Q@
zT}C$rpjZ3!G|i!~Z{lcD1bTPEy;*3JD@AjKbFP#5i%`jQY$`*O6LunKE=ft+v5nN<
z#{SU^$IV%!PTlhXq=8uE?rQ6%G!C_6+HEnG(xSJ9^Y4}&q38?VjXh3XxS;GfWq)Pc
z`dcK0Z%z+SW@*&QKDNu+gUyihFK_tZw;c5>^r5P3cJ6)Kyzk3NC_ek+(D!^w!nDXk
z(Zy!eBCUney|tDJF1D`FsdzWy7>r{wz1-na%nWx@=c_Q9KGBPia<{enb`|zlN`Iy7
z=}H04Y=;|#<DtCqS>SF>+@g(_<9{(E(9Rjg4^h~?A?{|i{bVZ0?4UPDE~CKR=%U)t
z$Ru)kBVH6U;b^u+BbSV%6EZz3xsP$oSon!;(^xs3Ut;c*)7mYh{Mn8b0C;+mMqDuY
zvHQsDqc1#}ZGFq8Vm1{SV+um!tJ;~V+lH;%#}fW<dLP#?in+M?6c<t2+kYYgzS%e6
zW;Z5WTWG)Q9qiL6-0ccpx~mR7<f^!})6jFFtNR7Llf+d<J-Cee6B2ZnQ4hSrDH)#&
z)V55^eNsfx*OisHuCCmUm3R|{>F0b&lG&8S@4zK_u;r*ltdcmSPLu)wXD1P_ec>+a
zIuLm8e+O@J9s$znCMw*Lg?}d`Mx7pmJPJ*5nL=zC6HBtOW-*G1EX$Y~He{PI9K~55
z&AQ#(pP;8|k)1=ht4>)Aaw!>eLjm`6Pf*Nw7KSWy#=i=0J#J;l6Cv;{3}iClZW57K
zDduMF<W`u{-S6us(Q?fQv%>WTYS#^3!eOCoEg$E_K$NZ9s-hVW5`U{ZtFG`$Txgj4
z)ht_bL@!H5oYGgeY{6|b^lvwowcT>F4g6!(B6CYc!^h#MUTa~*3)RZ6qF&a@*Rzs*
zPEms$sHx+Vb**y~N^d@SOy-k)8$Xt5@8O#RAo%NnnFH>^8n82W`VDmUU0K7WWWSvo
zh~o5h>~m+sLVdRTA%DpY(%nr}y(OZzM6@HZ-V)IpH}AbAVh>koZ<cr(W{Ds6rVW0o
zR*4_);R?pg{fWd^y-K}TsXum=dPTXGJ$q=^XRlYGcUPgyooZ)^*>#IhnP}Lu6boxQ
zv$1Vh6uT<*sI15aHP$1IZ9#Is9RS_rJeq#k2ohFLccmIOwSP^9EzNSUX6ghxnr32^
zXsS*flgOUjqk=p@R1o=F*jjQhsN>_h{ZMF5Ilw^15M&mU5>IIiWg)6{75dU5x=;=D
z!w)lLp@}dsB+rkJ5hOVW1^eGY&mTfw>A3ig(o2$x+}bk^I~+4egv{{}ZWu(mCJ5e`
zEMf)<Lq8MZGCV{)u!a<2AA<u~5*HwfHX@Pl1E**Stw^5U9%_DBZepD&Otu*&%yY2D
zR1-UpxWdt7)p8A$$&%e$D|?qg+y)qzPTU3ymrmRU3x6J0=W*le%tB}i5Gs>s7E^Y5
z&hriABRXov+<8xe6A{`{cw}>DdkATH?}xJly*W!t^qtI`x&avn;oOls2dEis>YJn8
zpmGFnJ|w6D3AoT_Gd#}5PAbixCFm0%_9qPeg8)j|avyDn{+<NrMC7YRCG<})U)k_7
zN>Hahet-RdJ9JYA8rs;=8r&sx^xbeR_EO`n{CVAQ3Y?_|BKq^n<yzO|pVy5AFKlfM
zHL3I3#0(#9X;#nvek~ebvkIhTb;+{z*ba`W8@|UAgrn+YHO(3s$G*FRdt%`=+sXc#
z|7_#JvLE1)1&3d0n+A3dVAv7SX!j_F{lqbB5r4^W_~3`%4(QX{gSag$NDtz6*HK$N
zh+DfQ>p|S^cj#2t_{Sc^tp{=IaUma2jA<CT?5$fwH0^|%I1sw5N^{#mwTax0J2%6x
zz>hJcCCO#7uE3yNYOOSJ9*xHVOST33g~k3Xq~~xJ1f2&1gP<SEMr29a6}@hoaa=+M
zh=2FFQ>EUuI^?B$-7t*%fOoU#Zf|bkZf`Tm_B>m|mSihfv#E(KL-Mey$&zL>S+y;C
zpWW@Z#QZ7NuC9e^?XkamE>c;V-fokQl-Jwi0tzxvWyz9>sbZVx8rBTM!ZuS3Ok7jd
zOiyN#(FWL|&q(^jV-J>5jZjQd2Eheo!hgJ!(aSIjqVXI;1$fTpEL`ACo&Zf0j^Yuw
zXeF0C#g&KrG^qhJ@wfvXA#g(yo?0y~QJ;?T(68^%Y5CWaY6HXP=q0-J$CqN1kQ>Mk
zU7r7VDT&Zc6sKTtyY|@)q-6X?u?O<wj6GnsrCE}uVo7yftPz)Bo0%$BR7)~U&3{lm
zvqP9ykCe86ly=6WWR?%yi}mLz15R5wNQ>}kN2KMM89qnn(G;0*{Hxc&_r>{6MB>9A
zWT`%mTSy$tT*%o41Li&X37Rkx`r+7{1w12a#lT*LS!;_$wnaA2TE&AV@?7revE=Zq
zZq?Gn8k3+!@!En}MzuBQc^lGWHh(9kT94Bw%DW(ch7DOrml6bKkCFQ(AY%j#&smbU
z)C#7rf-{Fskt<w87Ap-Qy=8W6^FqG2RBW^`oMJpYx#i+oS2wIWiXTsrEOA0B`uq_|
zHNwq4e1h|Pii8=vD0~bu;d2R{R9hV(WmvZYe|c6?(Rp!`J^Sr+DYGm3@_(#4KEB(@
zv)@i@&3}2858&Bvr};lCe@5Sxe}{34!Ej_NSe#lp<g$c{0x7v--6XKyI=yOHdh2uz
z!yu>RyD?So!Pr#D>94r~o=fW)lPUt=+sd@NL%Tdy%llRXS(8SnV-}fjXv!bmfu~6R
zOzeCD)w?@^6@zb%1T@<FQGd4kliYDN`;&YZCmDUW^HJ9B%TeC)7*DvSXB(D4JR4we
z-?H|jyg}{_EAUvH@Vc7nJf7}2^VYqO_Bmw>`<(1JgxRi)UBk1mrWpiVvPrS!xm0mI
zOLetJZJ(>CUp`*57?kf^sgSUzYN<0k*YXqzGs;Y?S(c4$&ylgGJAan$*rucDq>ZI+
zQ;`isuxZST8!t;6cfQzjj_8Fj`uUbobXMY2y$ur{T(z;G&U@Z@x0m*LbB!f{^c@#C
zyB}PODGHOYqIf3ObQRE?Tm{=qHwb02YN+eUVSPUvR<5uzZgRcrVp^=GjrkCz%!#6_
zUw|aqC6Cz_5Uz_kwtv+n(#-_h-S}FVU4P&+M4akRF9tVo=3dB>^xgN!;RJ_i6a-|N
zuowA1@-HtSW5f3jp;sa;Bb1Ed7k`u_RW*$7F9zH!`$H<svp=M6(F>R-F$w%}_yQE|
z^#+j_g(-&En-_{Sz0H2VVQ_q3I8oq!FZ#K;^i%eIHsJ3r27f<RPP@y}Jp0ZMC#fq2
zaFUPYgwL7(8~)>&fr<xW8b{Z@%MwIF#BLd#fi)^qrO(0c#lh#^`!tS{$V*q^-U(d0
zgwa{-r*j?}Ig6RFp<M&_%8h8e&@_%9{s}b6fZ<D0z_5d<Fqdn{1#<#c=^R9Flq2Yk
zP%<Tx;Rr?7EPo~eZ!2GfTFj;h^MuYP{;f!0Bzh7)XaLN|Cl<wH5@xYI&(W_5Lw*XN
zdITjYiFvtc<cBFYu7}8t{UAVom<n5)%Y-q{MJaI-z9eERn2Y@InkA_(l9INwfOmw=
z%&p#PC+JK?qn>V>6f;>NSTi*f+d46^Ol8|)Og2^9ynhS#75h*}zn)pEh%W1zVrwwX
zYaYxGMQo5xB~Owi8B0W#vF0cWwyCOODgTkBZjKInT7Vkum6y-oe0I~RiGVmPsJDTx
zyEd|g8~eadKCyqzd{6^)4pZbEZtW}r3=qtd1fQ7jr7hJOU%ClzoHzQ3d1MyAA>dvF
z2a?I)&42ufqy+Zr%a?yg7XsZ`Sh#syI~ckz#D<E$e$L*FwEUW|fM4ww*`lN0M`*Dv
zKLCU3LR&xOHz|aHB^Lwq`)}RIK8J<p&F@|CYkO@JI)|wr1j!-ZfrWE~#EM7V5S6oA
zM_F_0D0lHJsNd#U==>TK4n&Xz&;d2+DVl&Ukbe)c!mJ8tQS}MnfBwmjb3YjHCU_e<
zz)vox{Uh=C>xA4MK@fD3lF4+0&N&+c9D6b<oOgr|#t40k$M4uR3(lgzr}Ogn{QIv7
ziz|QN4h(-~;31Pavn=~QTnsQA%ukH^Q}CAO<A3S8F-ww48bmT4FU+4WNo6v*lgBwv
zB7b?B!*-1FzrV?uzU&is4+^7HcnDRdJ>;BSed@xUC;J;*HM~rHInW>c5FKS6Fu>O(
z{v?C`5LeG<Mn6syj=<qWw-<w9WpIE3Q4Xv!8gxnO{x^H>SO8C~>pJu3;T?xjx^8fH
zvUH!PWU^ucociH=*6X(&8E<(zayxArS%0;G`pFxDS61cg;yJ7g>QxZYtA$gr!x7la
zn7EtV79(0*rOJIVb(^lsWpA?uH?vP1!Y88}fueCSsG$M9C&53+v@%#x5e6x$<(Z@Z
z@$&3qFdPYFm-SV|8O$pHy{<3MDP9yWXPnHOg(<%dqM7@0IxS|J`+<r4vBG<>;(uWI
ziQMp_z>*E0e_}L>UFa0X^!mJ2r4n5v3uol@i$(q<#;@25i~7=?teGwcE-72CU<Yxc
z;A0aj?+1JZe@)^w%>f~nt<}~re>;loy726j&Tss4S-SF~tf-KesMHY`{i^csYwhQE
z^QzMPd!>AK6Rs)_pUcwu?X;pa|9@PTF0YLh<+B21jr>rrC@(;`iqgfgDvD3tN@?-A
zEM7TO%@y(jWtH++HP^_#mlXt27KPz_m8D<0m8BH)wxZ;(Ni0fo<gNuAq6nQLd4wQl
zlKY_w0?hce%+n0snb$lc_Gw0eqlQ+LN-O`*|0(`YkRQBSyk4!Pf;5{NQ-2#8t2YXo
zG<fy0hriM;kZ@C*TFW*wcB9gwAoHd+^_Fc47NF83KMGAP8VxNLFO2YyFC1X2EsEpP
z)S}tYB3wZy0v9biH`TWCqtw)z)zF$aY0JbSj#yJGcBK_~6HBzKf4n?HpV%b2ULcq3
zeEzvSd4DcWOj8fC)G$!qFn@DFDyY4Zi`_K0D6em^@`#r071uyxi^}>I%V)N1aP6F{
z$ELEypLj}@`X0mO@@IZGG`7@qSn_6IXuRRt2Em2Y*p$AZDHv$2B^XpDC`NG#MIuCU
z&+3eY_;NA$4wT-7Wcgd+Q7)P(-O2gYGeYu$Be_5k<Ap~J&9xSjGk;96w!VD(#RA(4
z3fPVw)>|WgZH@WWO*OgT^VJ<5V26ypySjL-b&gWKxLXSA!)Q@=+6{jGcGwQ}+ipk2
z*Us4n*kP~R*=_2(xwmcY<i3kf+pgYhzd!WTQGJsh<RKAxdb^U$cFw4o8|pU5B5O{i
z@*qy-ogT{Wkac^CGk-bQ`EFaZB{bykhjXE9;YpWQjKbVR`!_%F9Y65Xc?WA!;T-T`
zCj<F_Mw2Ot{mfg*Pk#Q_j0ERVduFvTdU7W90M^FbLsuLUBqLyOyPFy%NndGdlq9_e
zP<e>STa|Btpt76G<NlU3Ya{hjap4Q);5Ol>-8V=4bbp;X8GqIHv0HmFwl^Ezx3{oo
zT9UP<Z?wVojanG%j|&U?V&PnwlUc!Q!xDZk$r^?8_ggJoM^((BA=>v2)V@+(!`*+j
zX=*pn_Ps#2i=Qpyo%W(o*lSSVK12If$Wxz~yH!}%mZ4o+SL+0vp7pcc(cK>9s?tar
zhznrbC!mQMvwxdz>wx_2HIIj&Mb5heoD+LRst}mF5I1*+JZHDC=z|AA*4xl1JWdQG
zFcQ!APGmb>d36#~?w-bk@@HFO-(5%hn8|(H-Q7oM^d6v6_7fw$SD=Oc!=^lx>ufQA
zam!`|%RYc~V_QNO?1XYzX-9;tea;Dk8<V%iQ-J1*Fn>CZ7!6JGFt=Y~G6${QR(ti0
zI4XKc;&f-0>h|TWpX~TR4JdeEvXAK{i@6R23<KY26((f5^BM#ZeH(fatin5zzKgaK
z`Lcsj8O=^>3T?d{k7Fi6_c(g~Y_erz0UNW>eb3U^r@IbJw6(XPfzoLau6^6vA=4`j
zE*VKDWPiH#wZQLyea$cf=I3)PQV#6K4rcQ^+mp<BKS98jRQ;X84Qr}?OJkO6NDek_
z)x?_N>DW;`4HKDY#PuYD+TJ0}*1sJXuB4`)+Xk|PFy=~{fo(=~tm&4D9osOlsVJ6a
z+P3M@Ho>@EXVB~RJL>iqU3Gi?{+;Rf*M;e<)qnl32%33T_zypOXx4#c2lC!B@NFyu
zy;61k`t(ZGRX@E_^>HgzcfyP1jrDrfY$1BR>RLMK^{TyI_1@}LAC#5?U_*%_Nm#dR
z4{MYdn5fjlo-E6fXJ{JL?5<jhj$?V+u3RT49F$J%WX7f^EXe}CvrJ1RMqC-$+LYMn
zu7Bh=A)YS6ZyY_##`>&<h}tL!Zk7XuUl?i({q0@F){t^95O(F(dzX;MF1>8&cF}uJ
z6zkc0PwYk%z4yeX1$shU{z62Tsy=TCce_?r(6*KpB-_$lNq4a4DimuLld+}h9@b>y
zQJpBN)e2L-`qRq_2bC2BV$J=R6t;l!+kcC_Yail9Hu7HBSWUpau+iq2_rk{05jLWj
zM~(IJM(?e?{L_1D_ukq&)5If?Hz;!zSJE|X8m^2r$@MVNWCcqOwG3iVRaK2%-neVq
zgfp*+930T{eoGvur|20B^V$6pBm@*_FGs8<%wCRYb9{R_;_1i{a~1^AO)p3Ea(_g_
zPcKLGa>ULw@d)GyS<`fbNG|qtLa}BL2@^>&F*OxxQca?|^&lg$woID5B8{%SMGTj#
zF~hbj9ec8)V2vscwsfjs*|LaXN|sACr;p*fdwe$32W{O?P&O`KcFVrBBzrE!hIPw!
zbgv@6HVe+HQ(p9v^J*gPCFeFrxqp|OAA;oE6~(*KK=1CCuS5@)wDPAHn|rbO@rcda
zv>}8$)z(~@xf(Vl%f^~w%h;ioggx8VET%flAbn`iHx($pIg{R1j%g5L_9&x>Mh;<(
zYsz}pixaC!v==AZ9OPb{csho-aZKjl+6<RQQIPu6J)o~<EftSWf}AX?u74Lt6XY-e
z+Hnibi^C|HB@A*<!OaPmx41l`YZk}8>$0RbN%khmCR*=-XnP>qU1{PG$W~ObiJ}-5
zHcW7Bv~>#;o2b~Z4b{>lQ@5@5;D_R;52e}*!rs2%^_na-55~w+&)eNgLaPa?mxS6J
zyIvAnvmU)9wCxjCtY;6GwtsecdbqS6E^Ub@dLV^6<Nht1ND84QwoMrv5={j=p6+5p
zGbNj9rmc4mY<heSiPjbliKZblQ*$+}m^Q<jp?laNnu&GB7}cmJ>8{c{B;LJ4;#riW
zIG32vKVF`pPizuh_we%H&aenukng~<AS|TVPb`@QsgQO*&nRU{l7A!hRf_>th(Z}i
z2khw9kbc!<!h$S7<vd4AZTE8N>b>se(l#femrI|HT-xLN_1O`de|n=-Z<N}ZCLV!N
z%8?AiFdT{vMkTD-%)~@h6>OSJF)de76{&NaT#p5QFZgl}Qg;xpywY;dkFVb2o*!>>
z5B2=`)8WT^2)sT9XMg2S&yx2n`OY-)2v~B%a|o4W2TN2_ux7XvTa;MXu$W@$x~&pT
z?^*H(sVWD!w}WuxWy3u~zIumyhP=%==o#{-!;tq_ay>)7@~3CWdxm^xns@{Zx#_ry
zNmK_rOjaRZri5+V(6HoLrs7$O;dE!n?}O`BzCyt27NHDVIDcSit|F<b&9JV>I@Xx$
zVcT{MY$_HdRJK%CZtvRGeg++0&^&u+r{{ay#GzH0<U^D)CyK6qxkCpmKV=iR$iDO`
zT6c#*PpdHKF`Gs)V4yp5G=rd6hzVL*f``i{fcou`AYo`4C4TB(GYF*>e+k)`@V~eP
z!dZL~z7C?9`+sseZ9s+i#Ap<|r|4)(;)H$uXA*@+pU4d_`4dUWaQIvl0TQa!{5*3e
zegb6rIVCAWYui{TJSu;GEsh8@f0{-~8vEh+s8vgqnl-2gF<uat6`QZ;q72QKu`(j~
zSDFHP125h@wo`CZ^MifK-HV&ri{0xERWEk8xu$!u`+t6m-4&@hjKV&TQxA5~^wZ1C
zz07<MWae&RIQy5FHCytCN-$F_6Kft-u_GxuwoFrTZ00(KB=;t)JILbHi!UkbBy9lJ
zQ7KaFUw(l0GoxW|xm!)xy$I3f`1c~jn)T>Kh#oOv?dj<e6MDpiC8Bt`hzWZUA(ZV!
z2;wP<;(t=?xu%9SiBW73$Hb;4GugDMWI7Krfm6OhITN^rz0Hz!nJJorWvWV8({%|G
zW>ajbo~+wUCYs*C-qx;QtL1375MWnxePFXm@Hap49Y65Xd3)X5U`k>#VJVA0<Oa+*
z%Iqb7^Vv<?6&=uMG9|H}2-(X|e*V{t1m{uf`hV9XnDPG4{h%fKY0DJ~mnMcV;=Q2j
z)-%kgMW>P{$&!jCBFk8F6b0K<Rk4)+$dcM(>}^KgY6A;fY-?iaW`rGp-3ccC$3LR?
zVA+0|riA0#a#`yKC;kznE%@*F`23P_%UyydP&6g+m}QcgFOdF(B@d+>956wI#!-?W
z5`W}>LNJ{K9ZdvM!3a$uILZ&lBQ8%SQ!*JMKSb#zLkSB+&g3bJ{m6ZeUPmEiVHy+o
zqv#w^cOwrG<gpv%hpvC^yE76b$WIUf0Kq66qr@MFB!F@N(CaX008uiT5`P>f&ySB`
zmhj*4F-W+R2@73FILt}u#qlvZi~T6}Q-42UFt8+F1TTtF!ssma(>WqApO7U9N@L=O
zd`hW5zD!w+rX^ucqrj&=ECJMJw`4L6c&q4h8v8Uw)0ibJ9g6j!K?H`<Nfi2N1lB@?
zq3j$1%ELUG#pu!>U$P{{v7cO_DT}57dwz(s#cmlz*JO$u5{4}9bf#pFX{ziwn152+
zz#6k;?8t_ORU#ABQdH(J=Pu5adZ;tCn~rLQUMiWz9-*L>I^-!7ClF|};RudU5~0tG
zew-$Vk`PU6=b}!FmBaWPefB4QKw^|ehyVsk?V>s3RC_Vtm-X|;%;+uhE3C+(P=zU7
z&_=<pu-;#u34N0&nmqdr6&k8hUVkP>R>{8jUbSI#Ns<!T<zi4)6QQ4IZ8ct|T8Vq7
zZ>S_Pp_g^OJbOoy6n$na<m0cwoeuL-&K!Mt2KV~2-%cB`Q^g9U(G<y&D7~;WqQEqc
z{>f-sG&Wi;ILeo7Bo<-Br!}e%wDpNd{C{hIV4?hFbn`MK!94Y8(oI$yq<{W|ac79z
z^i3R1&T{riur3q!iG*X;?JVamNyNP-A!Y7gU|Yj+d)7&)r2mZo-9tm29GeE?*mpm(
zw6nQs;Q2w?UDhoXNge&Dy7`UKD40#c_avoU0L#d&qqkR8=cR5_b!%IB)k5w7XWUWr
z%LLHZd=<DDnr*Sj=c`X|JAcW0-6Y^0m1Bch=tDKx>^kWk{LcqTIv3DtE~Ea01X~E(
zds2FJ60JKF?y`wH9X5WY_eZTiYAeX4KWckBYQQ%2C#^qe{Yg9YNvlaP{gLaB+|xaB
zZHu-v`~1F7b4cCp23Ex_HJKfRXtC$rW$3|##A6<SJdma7ZEJ~rN`G887v-Sd9@kH(
zWEIzQZP}5rW4S8Uh^b&gJPi|7BC=%}4s*@NYUcPU4;Mmd44!9@k`IB_2Vuk`$b>HS
z-+zfoI1319_kS1mk57zi=fkw_8aT>+E8>ufzwj`pq;QB!xKf|+M1Vp?Tm4p!BUe#^
z!XFf?E=dWfVC!Q-et(#<_?iUA$A{4Pg8~d;Bx{{?{jTdcE@2*aR4_y<#KM*$Q*3(F
zH5t=Yr&UViC$8&X;e)!K&_=sZmrMMBCo>LMipDVs(P^F9zRy2S{1DWj=oF<<LP<d4
zql&&BRoy)&ept~$56dRVZR;j#itMt9gc8q-0vDa47!<OoD1VeC<n+U%Y@{PTpCK3@
z_+Lfm`CpTiP5D2IrX7;7|IW7o^yn#zebBwK>JayrtZds{(^V5k)AG!mh0$+}i$pC0
zBS+0agJLuH9MV`$=-<c`_641ywRl5!xh1;;kMcCJ>+%IO6)3@s_+rh%ED-jnI3oW8
z{WJ1IbmfQcX@9`HG@5}?`lzJyb_vXv9Jxz78LUQm08jZjt1K5kX+so+l|rQzsZy|P
zmIN%J?1=wigrwo9!9hG5T9JiMn8UW1_o996=o#OXXT$q6=gb{ma4+DVkO<4#Ugw=r
z+r6Lpf~|EgbBBX;?<Zb0{O;|9r!m1%Jiec2JR98Zr+>U@?jL9Ay}jP@vF$$d75)(S
zZ^{|L-}vcec0gOt8aSR+PwZk?(!HH{L#$KF>F4~>{he8XzQ}o%J?!c>&=xsQ1>hF<
zc&(NZGlpG#Wu)F$Mo8s>A2NDL;<UY|GnC%SVdnPbt)JwMLYxHJD~AUOi+z^7BMu8H
zogd79Mt^jdJB2rK)E#Xg0gN2l+Nl*DFCvm0G8PW*gY!evN-e)s+pgBmEfp&kGxsMF
zU){qsTP3^fW6ic{sJdjYV(`*_7>l-@lUw7mZP!$F;qKv*HOma!-(x$qQ@_a`&dJ=u
z<D`+owrHoaWMqC1SF2Gl+jgyXYi60c?kR<>5q|@Aq_Tg!Jj3p`%O;YmJd8D45DK?l
zHmF>-wj0$2@MyjQzvTzCdP11mcFN$T-IZP*vm-?wwJbkT9}0&$%p;nGJzZC^rq~iD
z)bp@n*fJ%aWm}9qRv(I2#DzFV&+{od`fiBug6O!>m4X|)<I<nPsWk|(nykV~WRYw`
zB!7aCA^bDSEZ?<|w`5eRblf!_6Qwo$`C*+W^iIwbs$?3nLn(G-qGL^G3bv?3u%f7z
z<vETg8?<+x=-@oDC#qU@o=BFRCw7cnELD;G`QkMel#)fXU;guoxXa~y?`Va-pKCQ2
zG?}&YQAgx@Mcl9FV)4G7u^2+H$(Vi34}Ut?``u{f1nh_-ejL?Db5ed@n9vX%BUzG0
zNEv1wHYiTNJcBDH>mGf_gBsTl=wJ#`G9JeqYMS4EeGKA~UiCgQCE62ZN_5GRRD)R9
zwGA6<8db2PxC*9*;@a>d+pQcsHx=2yux=Xj78_k`F=s3gMn8iiZw2!sv!`rqr+@R7
zci!x!ZQfi1B9>o8v0H@O?zp~!8koUc#+ZX$>N2d!u7oX%n%Fj(XPT-esm^+2(e?do
zSh?1DB)agTJLZenHb+F4yb$+`TmOO25OJzMy%^lUk$WLa(s$n@hZ7v8Q4o-6!d~S6
z$iKV*=<e@JP%kJM#V`ISNvdiX-+x~WI5x}=slbT&A$5yhfd9oL@W<f`u;$hqL|zo8
z7@px5iZs2=e!pR$Qh4D+f&0Da=jPH++4tFizq=Ux_!`FNL@|Ght4AN)0cSBsbok*U
zb;WQ_@^PK;6)13Q-ur-u5qXfs#RI69nB!f11ipeH)zEXimIReW&l#Br_kV3#9mEKQ
zQHr84m<v|%IpU0H5|U|h8Knr0b&^%ius0y&;~EfSa*&M--ewaB%_j!<7=r0!u1`4%
z&hfEm`%h#t{T|iU=lB>R9C$DOWXj?s3bP?k2w>1evjqM6>0L5HfY&ic3112^N6+V=
zGy*=v55)uyhbtqNbQ@?H)qgcDVi1CL+0`J~kb`a2m9b*Do@W`JYZ!MD$M68$&HuuP
z3q0Hsk)PB_yoz2lVE|GjkdJ^6VfSV{2a6D2<|83lO<9Z!Sv#4M_zHST06qq))!WZ8
zX?QS(513tv4>uN^6*LY2G2=PPymtk80@-p1Brfn|lD_LFsUOmO7Jm~_;dwiscDCRx
zopmQ9xzY=n61LW@dZn)lAJg0FG0ZJ47lVpl{LF72$FFhlHuR#h<cuy3<kvWO9r*NW
zVIY5x;;SGcZe<vme@tbFeu$1P2E6*KAOcXHi@~V=hgb7+7LqVM1N^G_#h~JA?oH^z
zSl;*nd!Ju2nfDEhe}BcO3IfcAH(YRJo;15Pxk4=Fl?vx>aB6Epl;$*15YcA}R}IV(
zedM0+@(7)C`m2N_@NOsMieaH%MxQJGK`!$M_wz<l-3_RSC#X0CeI91+PQ1zOee%{!
zO|((Wu$-B)YG#{;vEP})$=PyhwPRC8Z&l`~Hq23UxaaMg`F}f8BEP#nUvhO*{<4-c
z(VBLP_qyMi!2QvAJBlNX_|1@@^0LT=uQv=|bhY2%!<DloHNoA~Z~+(%BNx3KV&r?i
z0?Li4%(0xCxpHpb>JG?MoKc*D3KB*|5?a^&W%J2gCbJRu0Abq#gmH}3_K;`W=)icz
zG!S5ET@ybpf`2cxRNm|k;NRW|JpjpdFO%aWz5UcWrQzHOmMqJb-BvZe0?F(!9sxUH
zj%|rJwmsh1&L|Q4!H75n=tGASlrTWACh>eP$Eeejuyl-+LtGI{YTFJ~g&Ar<W@$8d
zfbJhv%}s~r=FwSPRN2%CV>;FiSHT(uPz{-?*wh_nSbr)rJkNPd7MBGjtkAsnMwbdf
z*p6f?vWGp&JgnKChAmfDu;fx#_Ec5U^z{VM8(ne&?2RsWZ*=*2!r<Z^=g4U7j4VG)
zi(!==%f|E;Ch&LA5l^C+p(Fz6@ien$5Es<jgo~S?q71pcLs%hLJ`68r|C+Hd4d%Se
zG-lT%;D5i5ke@zF5CuqbN&*h}!4S88r4jnq%%@ku9QiH-CmB&YW`w5P?T6#~XPrI&
z;bdCO<jdNr{NVif|NS5T`~UU-{@?%eWp39wizBd~ybxYLxq3Swp_@=LWj~xaKSKMz
z9bKmBG<k7ylIIY3KFJlK&uKI{5fw=eW38TevVUbT&5^KTxp1-A1ly9#Ff}yOupGmc
zTzUeoN?<7ZZvwnIIZeqp`A*T*pLn2*AC8B+&FbYWjX>G!B4?I>Rv-2TCR(#H75Nna
znkGSzgd_-9fC%41k?39QADPEd5FppjOdBYe#Vpx=l~m^Fs%l!;vK1F=hOJ|w*(O$W
zSAQb9CR;LNotEG{ih^?bpHoJH*V_+Ib1l`RvVvvT(XeJy3tO6DU`4iN+j2F@v7JuC
z`}q0ohx2lLzkYZv%es8>%Vm_LH?hz2Ph>k^Zc3Rw;}^bngmTr+4$JPy#AG@%vF2zh
z)=b^PmL=)fGi8m)sw^8a*^%;o4rx4}0)ORY#+}9afJZ5SB_%0I*@@?eB&0rApcqY~
zc!$Xuy6hT;O|WJvGN4*H*l}zF>ypiE&CwmtwTH#km*q_PfuPHnd8ZeHyt{F<(2;i&
z_~F&be}n(;yQhk(sJ5(L46^y0UJSlE0ST`z22D$*!8M-ow=aOXMdD^(X|PAtD}TQJ
zI%KW@F>(D_@<JDzA!hR<qzQuT5#0SyT=s;2JEZ5V^v%QxX&YHW+P@$nQPYx{rDNg&
zrOCv=HuX&GsE%V3$#!*DdQ5`EB4g3Z5G5^Wo@H5vt76Mi2-c{qVd9t`CaUSUs-!Sg
zS)b3XmmzZ6>t%?$mmx|Q6L7Ek41cd~<`j>9At}2db9BaHuB{7cOE<2yY{akJL4Ps}
zQXlebU9-@IbXx)yF;CewjU#skZeEbfDDph+L;_qWcv$6D=I7`y(G9x>ctyy!1)%~l
zyJTSkUN0<kaT;N;t&!<8jtIT{umAYZWJ*Fv0LEn#5H`T+s%UY9rb1^jLVtdE&63m?
zzU3nnvt$~D2@^n$96L16CH7zc@t=^p3<ie?nuWgSgS-S03Z4h;Uc;C@7IGnm0K{TS
zFIfVBaqN~d=8C*g44m8uokJ)@;s+6Pn|C9Lf|;0p3sJ}_ShshK#37gLmU*q4o0|ph
zhlO~S6g=386GY<^MN*6t$$vPJ^^>A7<}(BKgl{0uYhZ_k^m0PtD?c3LD>lb|m;fy%
z7%(7l6f!(#B*u}4Ax`6Dh?aP?4ZP@I{P87DVEch!>S?tAT_*EAl1GvxWl6a*cPZu~
zjNULOo{@O|U;pvHUQS~_KrlUY)Zl@*K$_K=4fC};B)ioz^=S4y*?$_fB+aw2Vi^(!
z=@UClx3TA_GSNIwQSJsl_};tS0U7dZ?C5RivfCFvn7Scu^@V`W9HGBKnoRh+5SH?g
z9~nR^SNN-frC+wSB0NZevhV!~qa;b;qh?ygM-@Jv#Zly)MSdtgTWaxHgU^47;*h2M
zV(`;B6tU#8hz>=#Eq{j7G4Ea0<>I>m-`~bjcoxOHeOWQf!I|*&6^Ua)XD;ENbxSWk
zTk!dfAG4q53_dEdWWu+_%wriiUU_2j8|z{Kp+c~vBPdlrzzawB1j&CDr&iSBYcD$D
zuO3f<)~Sumt>Iv?NR{MdoecHvOz7+1gNS4q8c$`~(&+RwQh%M@Mb5GnB)miJ3HjUR
zFk6>{Oq0IrmVxXrZUZ}QP|K75bdrT^;~ye?8Mp;r>YVUx9fcWPDXh<N*J8zI3FGlp
zVv#q8qAjiRUHhl}*4_srj&9!h6X6-uo~Q@l$oOi0$cF-y7Jp^)!`(qJg^!uviu^bL
zO_p#;o+>a2(|<M3)g2ehCR4B`xfENr>0*nhj-$x3Y<TOHhYw7V{Q2i!s_LU&k6e<1
z?5V_Lii0I0dswp^f^C<mn3=jNySgOVs@3a}?<N3P>=1EOQwL4I>VYanQZ#I<rhz3-
zCZ?;Igvx5md#qbT@uCLEYS~L4iF`5m@pDS%==Cg)S$~+eR99yjNB9pz+^%p7DYBHK
zqe8p$zy0)Sczlfh>p%Vzfy#G;QXYDTlPRM<z@cO=B@kg51pb(Xlx5y5i-E(*3$$#8
z4nRxWsEaKWt+#HRS;28(25&M;|46RL^GUL3G0zReFws)knJbhaZfKlMu(05BR|Pzq
z3eTTxhJSz#MPho{G>dln<i<hQtJNwrk9<|2_&KAO=yf!ifP48IIpw@E+X9+RU6N+*
zOv3903<Kkt@4{2nG_RD=OPV*iFhg*Y8b|TGNjL6Apy-C7Vb##Z?2BS~DKCme8P(9C
zMC0<*XH{L1cQBU}d5nMogNKH1T%>G4wj#sIe1BHV6W?5tG{GUeX`IU6FA2DWfg@R)
zvBF$YK3N{5SJ^a=F&A7bj*pwREjtJkH!5o671kY`rt;m~D;^UgSGiStF0KOV!xV+;
zhK{ML0E~;Lf=4mIlBw#%GfZl$8@vHle_SUm57;e`<{62}gk`$XbqayigwlybfW>fq
zcz?b~@HYSh@B=>uS$GX!HJIjuEKop+vyO%a0`$$#P*VKl=YP#ea2~C#a}5RpKK{WL
zYmn1?nSk<R=B&A9EjkFNZGD>B`7y1TNapA6DU>RviEZYnShEZl6WOz{?GaryHKMxK
zs@7Mvy>fD!dE0h;X^CN(1E80Nd6Zj^3x75Z<NTi-)dk>Grg3!byZq@Bg@Fr;GV^Wj
zmUw(z`VSl*gB58rD<ML0!A4&=H%4Jf{1A9KbbLI?hATLu<73E;LN5WY``VAe$99C0
z=^ToTz~~>7Fo`Dc>ySfo_#yJs1RWnk{Q2=Q6gfU7X-eqj1OOwBk5|LH{Qi(ns(-S}
zNzG*=b?*mslg6mEmT2QKwPa7RJda|>uo>2DL&C(6DW-(VCXr-?xyHVask-Yi?QU<c
zLficH>}?K61CA~=Fi$`~s-OE3&L&}j@Z1oPOc|IBPrZx9pRz#uEF>NnHsA~yp_e=c
zuEe@&i917rJfr0TZp)@rjLk{xihp#GSu#lI17?5A0a}8hUY<JhT||YqzNicx+*Ybi
zNU)4X!JDZ91LQ@v0teughxNfO^(m%sm|jbmnQ82YX#u#fFyRuBA?t7<fm8mP<hj}!
zfMxR4%#a{jc9&s`G^Z+E7z9U$N9SDDsDfK4dm6-N{&KyEqsdRvg!tiN|9|2;5+9rK
zS=#lVZ}_HF&*)en_h!`F0Hsn=RU0IV41l5lq}UjCoO^Msv*q$g;X>K7Ias*r=>ZE~
z@ZfoNsZWr;VDp8zg+Im?XcC<eBs!u-Y>5=n9vx!6c-svHVk_i_ZfFnPeE?cp?K>hl
zY}5;MMQrGR($Ec=VJkF-?SBy%HYi+v-+>ytBPwi#qOgFR@Nh_Sm!<85<<J(tVdaRP
zj<RGY5iDoduckgEboZwZSQJwvDjBY;VqH>ntT~E<Z9`(%^CVgEbXQR|b?+JzWskC0
zC&1<IP|NLXtZh-J_X#@v2*H$diKWy=@|OV^USWKD9gu|UmB4nDmw$!}qa_4@Ktj&i
zrcszgfiH|<S1ixc0Z}O&`<2iu5zcZu4Tv8$N$H@%s!8%B$%FYJ7^an$&5I}mt&c%O
z1gXBB9)?5Ej&kE874xr6A80FiE`ne;;5EPXib-6<3k=Eu{|eTVMxp1&6ZDyQ481IM
zaOj8wDxyi`vLPVhvVRa3)a8>PL68NQz<A2YA)zx&qiNBbM<#v%BC^AR=;ry(Ox%Jl
zY-47H!u3S5slh1ZA7EG`#Kw+mF>J}MEK^%yj;nnG*ONos0)PBtsXksfK9%f7g2Dlp
zcp8v7#BHshxFRo2Bh`1KZ~!1@fQ?KLPtH*!tYIPmOt9q8V}GV*PLLOn@i?Qhx|TWF
zoE@nv`Q*zcMDt5VfZb|GP|TJbQ`S7}GE2jnZpzpuh6M4^il;iRWV`O+2}(UsE`v^C
zMVm7pi8MylY)4D>j)t^G|F$Bn(MClk8IKn*psPyFYAU2PD$82AkMZ~&yJmp^oJM~D
zbx)39f)al+3xBwJA_KE-D*c(!k5kB*>jzvhR7-C3S2jndz)(_>9(`cxO%z`h(7gzP
zkT9r{n$>REKuhfuiN{|j<hGhv>6m9*`YW3+md&PH;uv?#I?vafC$FrOg?PtOeFnQx
z?Q&9WXE+pTu2z+;PGdMM)u&<}|BU<)UHPGV3am&p1AllCXk%DYx~@#?)I50-u!ORs
zrH>;dEhy~D8Iy#zNvqN}zN)K!ZeLouy~Iu}YwX|wXqohWn{@ZP<f?D$U0u)VxkMYS
z-L1FF-`T>g=C@tdKnHNE*+LnxrAlCX#Xx)YKt~oMcl?*`V+yDp=a{)%=#ncDqGBr9
zD%NC4$A3iDB}^4bmSsW}TUH()PmM5onO%uh5W3^z4^hhHqC6-D>W(AM!*J*~MiM`m
zbGO)W=qDgdfpo`R0&gzc$cw<C<kxX77nTkq6P8{^ATe_xc9t;k#YlnaPe|y335$i-
zejJ5Dyh|gf3jk>>OJNea0;`>K?G4qz7c`85XnzdiTo6T9e0*17bQ7W}SI@#DnLC1z
z+Ds8tgJNTz;DbPy+%<%V^ge`AmT*}Zq*oY<$Ziy-aRdo4y_h6vJfq<0nWZ)AB+)eS
zn_h;qx3Hwi!NiP3y6Gly$O@B8MYAw*i3aJ@Y;4<<VoTAOW9ZcLOuLsj_APO6Id{o9
ztABbFPBJP@;LHiZH7gj7(JbWW1J6SLUo+rmc}sf`W2(|gaYMZqR{*~#o@Jwcc8}zk
zXZYD3rI@VKGZH7v&8L0}=#B~d3OD)D;=*M7`{Ww4+i69UCO)IndRxzPS+KHz^$L)x
z=o#FZ`Bmyi;j_`RUq8L8{vnqdR;JM?Nq?*uNE!(Uj-%R#;po0gWZ9l@XA@Kv(0s_I
z#)UKVKg#S_^=a3ub0H4?xLR@(^}5J{ja4^wkfi~sN{5+S#-c=6pASiBb;Eigv0Vn=
zM<OIH+zZ`B#F)A5CB)I;CQ`r7y3Zrxw^1+bJ^^9Zezd|abEso@ij5`3VOVor34c4L
ztzhcfwqog2u^*QKDd7svitQC*Jq2^frQOe^M{_OQAjz2Dwl+|b<V-OzFwtx(D#CoZ
zT__vZ(Mwm9`6;>yAz33pApV8WE5O4Zp-)AC0q~cTD9t5Gl*Z9NNjO5EML5E64@RT~
zO_;hdB6`VcsXy9dq8qB^QC-H8rGH9TGfW*@rmJB~@g&vtWYclH2YgJ<qp7fwUojU6
z2j_}>xaPS0lxrzKx{PxP2u&ggU@db9h{()LisX*`g$)!A#NJN9vim{>WAt8}5QNd|
zXgYti2gOyGYD=nvH5=^5l1nhrR1>SNK@>+;WTve0zIyQQ3Gg}9SA=V97Jpum+z+75
zBT{=g3S5Hx<N#?^UL`*i>Q2x-mfkM+is&CZ?Hg2bm_t2mTdIXM6;S3Km0(qJ9fR7o
zrdZ#AmwHUT6OH;yV52I|W5tV<X}%ZSYv5p10zSEla+TY}q11@YP8o$JleZ?m*56nJ
z<-U?|esnPqPb5znUcQq2*MIz><iC_}rTDesx#S<R7xQ8;yeA$Tb>-n-*<3hkG^|Qp
zH6`k~tc$0D`qVrXrv5>7P!u+aeM~P|%$=4w(%&~W+;@1F+GE!}*r$k4$F_7;!WL5r
zJVh#YG{wV~=b9R1PV}7hQ65j}DQb9l{4jr-s!xzJN7p14Il$}g%YSfP<c}1%36ory
z;t2){si*nfg4J4lm+tOas`?5-d+URwS3X@&=jGxp@n`6?>SEZiC@Z>O^%UlVC_7j=
z{*F)O0?zxhMhX8JptUzo<I6M97!+gSB^yTuMMbnWFViwd_mlM~Y>C6Z1p@mP*z0Yr
zDouFn?L7y#!Rg)}p?|v?>6qK0T6VetCtH>1W!ntXZKt_yGWIPJv2T}zeWwKMyC+}&
z{hQ+-Z+RxpqiK1G_eW#bUFeU-w>=u03$=lRABbeRE%EL*Q^Ei;kam0pxrz9V&jKzb
zHL@(NPz!iFFURAUiM(PWZZ~X|>p^%BbcI6CWhy>vzlE}cSAT*iNA8wiM8vkNc*#gQ
zA=9(+xg5ugg`Zg420+wFE~CIreu=qE`lSV0eVgMy@M#owU%i73Cne)^ktt}<o^;+s
zVfs0LJ2!wEv>nS<s+-%Fw|=tvEZjdOP9J=MFnauEMBC8}YMa=WDY&H=8YYw&Sd|rn
zP|c>&hU^MYNq>K}lPN_A_#AOy(SVZM7T4NL{3MK0HkqdLqe@f5iel)=g`t*y*yW1A
z0H%STRu>6+9$gHCWAc2;BJW6eM-MkHa8{ylIQ}b}=a3S)6?%hb_F`esTFQE%CR(8(
zg7Ou;kjMboYjqyKR_AF-u3E3u0j18J=wt4w(76+nU4Oa!TgeLZtYWK^J>a+d*TJ3^
z?tvI}dwBq1q&`|fz_E$usG5g8UGqQ?VAydK30tzQ=&t1Hy0#i!pZBx+<4O&{)5T)X
zGlkp(EcSI}mrx|P2X0p^T_v`PnGCtxm`1QAc^WoV)zT#*yXs0ovquXoetNXP!=MFn
z@8TRs9)IOP@}nwtLmsg`=dy7I4*s?VEP&ota&CNkNI^Fre~^to8LbF8Uy3y6WfL){
zI#@zAHOPX?e^<CdQg{Hh!yJ4Q#rc@to^gk3&UkUa{CPA(ZiK=ph5vB?1`*s>Kq<o^
z2@@Zx(I^bF=?nIhgC)jj%p&X%Sc7;Lu;hCL`G06VaCco5q>m^FXqiq2Fdt%;0~+oP
zlh7eN#<|3MC<wA7LqT^f5g({S3{6s9%oIn)n#U|mJYB)M$#kj^Vln;k#hfjj0ud?j
zw@g_8TM1N@pra{^>&OYiYQ$I_>7z#Z&HcPU|9wVc0zN4Wi0lpV0q*iBW}w<(uFx1p
zF@OKxXqKW6JTu~futJtDvu<D^w(c;~(=4n>%)y$hYuJ`u3oDXmN~-E9o~QSE;X{Ch
zEN$Gk#QIp_i1;k?LwvkgAZ6Ke*vut>w%p@zR5|40Z@zc5lz;}7tSt9zILa=A^)*D9
zXHNh)apf9k=oro4N7CZ*XT{6E@gl`qXMdl?@1q`laXVkhM+dCYOkLYSFy1-1MoIgJ
z2i7>?G{hM_Fvdv>h3z-iyY?uUZ9|A2FAS!mP}yd>g%w#*v1Ut<M?;k{l^jL2sBS52
zRZ7E$E2T9lRyqo5?^_CLc_h(h1x2&ye>m9qM(t83G0jt{V%Rdnnx`rNp=x7WSAR5Y
z5m`26n`xTTi)jZD(+a9;iS5`XVS5kj`0!vIdsN0Am9Y=BYau-DmvJ_X-eI8)-)ucv
zw%L;;DpMw5rt1uA8kMl+coNo#XBY~l%(Hqp>%Dj`AB@#m<?7tyQ9lsIrES=Ilc2-B
zn-^e`D<!vzV}EjZGmpXJc?%WnV}EgbmetMAVgA!c?B2&<_B(N&-m~xT<{X&4?=Qkg
zd9<vwZcCOW5gW_YGqI)-h8@jiSn&+qp{67`y8Gxf(881I?b)@4eqm9~+oGm~22NP`
zyMZqn@Wu-ca)pc9wT6gLTS1=PB#Ed`3csHPy>tO5S~|sz5DB7iEQ&*~)qfVjWo;aj
z>7`E*jiT7~A@Ndzj=;$xow)$PKt8{0grGA2r-%s@zH)OIEr0m@D146o!h&g$g>{ZD
z{qZG^{p1S8Y|Ix1Y9`SvrU0QD#U-F{hNw01d7fTq>|ko~>UMNYab&xu<v@xfPq(n<
zFoucaF>rYE9GN*p?$zP@kqOHa!AXC=Ak(ArSPj?8c<VtrE3ufB2A_cUQAGwTCte%b
zFD!Z+dJ#H>E8#1g?yunX^VOez%{F0q$+D{Nvb&-x&}Gd%&+n1p2))ZMlE!kyEmIfr
z%05R$Kb5AyDVGOL-3LsvRKP(jzY92X>;8)X<v>S#4F?ZbKAe#0VWdNl`Cos{_bnOv
zDVzM2@fiHJ<Wd>W$1F}o`DV@_El9M(I<*5>*>a7#uF%Hy*(}!p^>rkxAfj-~z~tVM
z6mE}J;hR}CA!I}4?6zuGIlHa0PQ}05^_pF7yk_xBo2qcfRhFj1PV%Y?fJmQbla@2B
z``8W2OS@ftHfAAc6Jwut9JPO_y5+cm<X>-v<rGFP<24H?s!nHyyP0h_=n9Y&#3~K;
zaN_nX_v?KE=60@Uk5=xtsG}K-N|;cEKt@;@JDx?b<XF0;yRyeT+6Q?YQd|Prr1EQn
z%-%~>yEp;uAS`jyQ#@~yfwFBHt`Xj{+I1Nz`y<%7a@wh2Hj9_3Zc=}1D45&V^8fCI
zM0G!<pT}SwtMC7lvyk;@&pj~EN|Cx3L3<Ij7eU*Ipc%^W)|kXGTW<gqKfMHdKeH;!
zj~&I<F^Ht<I>Cx#d04ZEjxFX=tXrPunVuzE66wLK_6A;+@uavgoPZxF&STnhJPdA3
z@xw94$ayL-SBhaP)X{$#wiKOWO{X$;T$NzSHXL1NmTMZTVAOh;tKz4JxjGcg)%jx1
zG@*k6P-3B-x+CnWC2%Q{bjFwRA__QAW5A$DH_o#i2Gz^y6w+#6GV~d&9x0l}EMX~3
zeFmYZXevAk080Z9y`v<>4gD5~RN_)XQ@|)sz?%sc!>8Q8K2v`Wy3vIAVUjm_&O#EV
z=w%Q@Hz%)xh+d(0ev%#zbqYvCq$U@tv5iWH{1K+Qqnbp+rpz>~5yiuf<Phwru4|d9
zs;aj9xV*@giL4=6JIDK$DmmLT`Yt@h_#ufIW&Sl!FJ1E!%hOm_vD3~u0+}GL37I2@
zA(C=mE*2y1&BcGcxGtkv;KIjg>_@Sm`Z?xX;nPLu4vPy)CeS)ZQA=auhkiJIj?S}x
z<*iW>9(&2kG})PB7%YEw#=ynj|JO|T&dmi>+U+!g?$c<*%fyVUxG6&pOW;t!iOYS?
zrg1cxLN@!DO`{mt0z|?&N@mG4J1Iq$Z@zXDxCoImpOSxs-$`ORML3G+Ph^E;KH%Fq
z(e3{8b+>_XSmE$ip14llZq%_%A}IzYuA~C5L9u0-;PR#!l4eV;P5R*Py7^||bahXM
zot<ZW)p<ro%}!zK(vGf8{P_fY-Z&o5a&pg6wlU?G+(_bkM{6=(@NU-R|IB9linw3T
zV*>2M*E4?>Qx>LV%)Vv|&&@t=G;;!W#M3z)Esy4;EV3|#Av%^NX@rzv&1Z4Bi9ei5
zi&-I-3M~dxwaf<EU}0KnS|k{SgOLNg@stzw$v~l3#6{U+q3?L1^~={ArShw~H%gVy
zR&SJgR4GXBB;e|>*+VN=;Z~+rscofxyYGIxYma~0R@<$8Ys-2EtNMiNN!t>n2&@Fx
zVCfNO^y#n2;-^nK-i4a=`$*0Gi@!5DcZ@Q5EDUT<&b?RFYOktquNUp{1s1fyg;pnd
zv_2cm^gQMn3id3(?~*MGTg0)kYfD6@hG9@udcfu)*hN{&^922r+4O1(=ZYoiC=)t|
zs||lh3)aCBj9?S4z*5vdC_v+o1Vx}fSS^tkvwzK42zHl6?1IunnXN`<rYX%zIXXZT
z`f0?o?0^P(uV4ZDHMeA@&5lV?RMnO&$;688C;%@&ux)4-wk>8UvP&#RzX4M7Q%IIw
zF|^b|XU>%D0OVmY5N{w3*YG)dDU9oITZw<nfo1Y4Zue|50Rf#l#08rtR|HH8T{f@7
z?S{3Z*IRO0TXITFxe?mMn6tRmkHd~rdm6Y+WpSRp8K;je>SK%gq~j}|;NFZ=Fg(2(
z=jmGQdNWRKb$T<-{;$Z^T367{C+rtU?kyB19to0-fSwQW$d!EUlhdBxOVeg=3@U$r
zdfR3fa_)^mkCQLzZJYa9{{D8p-)QJvKp1=5=G{b~FPmO+li1_6ZxW*ErmA7Z^%SfT
zonc4S9V{!h&Ljz-*StO^ecv(Z=h5_K7Lf-LRroxbZj54lToLFRlWa*M4rV5VVNy@V
zwhB?1%rYEG6v?!dy+@$09#ku1WNCjnM@2kSnKS5ZX2i>5k1@tY2y#jsFsWSoE=x*l
zpC6`CW;o131<~<wX?8q5ZWmB2tUWxgH){oEL;Miz>*)Bn7^^UUA0Kl&CxkMm2|7L&
z1IQNO_;`elkAMC2E`fhVF*-ixp`(`*@bWl5ULDW7X2-Yin;A@VbhaWLI&pv2lIBil
zTHWPLXLfr<yZf`d^>Or=rMQNnV~^O7rk5(%c8HBlrZD0-Hjy-E-^Wqi^*DC-3aI)6
z{PpZ@W)q$-Wn@Ov{LECm0Jw1;Vv1QHoL8nS_8}h_cN-w^D;9r3=P}rPMecayF~$x4
zBDmKNAS#)}SCDhET`Jw_B|3ja)eHr#LNbd|%XVviBU}uM4tT6F<Z!zzD&;UKWrho0
z6I#Em)SO<5sdD&9N&*re@kS=(is5Yjd5Ii%(q$f*1z=g100W_jy+ldMreY;Z12nHZ
ztdDf5OELb#^g0W(bSp>G*bg&w%%%A*p=%CD@HBAWjUxUv3v#>|jL?6_7{(@#ieY98
zIUIH9$`ySz$GR>IKm=}|XEF8V5R|<PVady7q4zp7UG}ba>^<M;P0O88FAwGCky5v1
zpIX^xNlgnm0-+>XOc0obnP&ZDt*mF4Hs|~6ie<Vxis{z)r42!%e!$j>M!ZB@sYs-}
zc-_`5tRX>P8|=}Vet&;$Hn#N=)F5D9y7gdNnI!5%Roa#AV1sBKd{s44IKVRPDtC7@
zBXlqybhD*xWkcIOx8Ejc{2iz<VZddRc)m4BZoJNxNK%m>4oU8^w2MOThT`JVACOrZ
ztr^wt+Xzw}oQog3)Wtb;bT#z>3dEm2VA)G|nd3>0g*DaEux5Yh4z`Ht0YDXTbz3oI
zYZWYH55`yg^k96ugYkWTG5E1Tv&CPA5qkITJ<47e#5vZ)Pe$lv#z1CbW+ITY#4qS|
zKma`K8-Vo*0qcNJeIVV}#B-FwvcP=v70AL%%0cio!w!MilRPGc6f4J3$V3$?*6H~s
zoWD=(+GjUh3ju#E^J-!~g~B4eWD}Nrk5~wci#`*Np?7|GC1MEt31Ip~p^)jPag+^J
zjHZm0X@FVdc!d!B5KVlJ^%p=|Q4XlKH<Z6jl_oaxvlyC;UUBTdws2!iXPRYum|CiX
zHHTW*W`>F#$#OkMXPzp14>({;EX~5%1d_>5(eW`qN8*3DAU6-uBC7}(bYJ3tEFYn6
z$Av@w0gfI)^peDBE~N|fK!ya@5B(LucsXt$G$gtg2O`;j+E&rLko^DBC7eoAZ02dM
zf(@D2Sd&}{+nVHIMUfTPrA$%idhYXShf^(4mB427C#*TF$|Zg<=Xz1-0~9=P4T9#6
zmk~X(TN;1Nz?R|)MGq+aG9c1AcAN;D5|LWjtx^Ecp=6$<Z1Nm^Vw31vSWqqoCnpyJ
zXp0n(s=PB;uXfs6G9IH-G$ARAeV&~8Xa%6&qr%DCplV)hkpH<7Sz798oq0t!dx{)C
zto8~kKNO1D7!+NVvXC*U)D*%lR6Cqh+ZhfywXA<ETb=1}SZavHEdCk!A-eKI_Y_n>
z(JW;#f;NUVy>eZ5SeZi8)Jeb+%8nL3jgYjUmn>&X656BJtyE0HBgEgJ7Hh=Ib<Hcw
zubg)ai7NLR1SPu2<?sc{Xzk3*x%^y5!kvrv<sr4JuB*pq*q{U1(ub+S=R8`cB}Z~)
zQ(}J<tEx<~MqCM7lo?pjEmP7c)m2S@Y&<@~OQLq2?f(#^hy+2-K?^`@lK32<nnvT$
z|2L2bN9g9#r<cf2(9LBVA$SIST_NKZj2xP<^fChZ*AIai1E%HLk5iC35)!(=e6jG_
zkE4+Lj=+oSvJ^y5hQPsub2T1VkaDc>#p-_?qB{zrF|c<*6kYM5U4_w2h^AZ#4R2&J
zqn9AulYE*97kr@_6dN;O9SL;F9a;$Q6A?;T!ex74FkvVe06w5`LuSjEBxyXO=}cgm
zcNM9Y*<KHrNsz4T>VkubIxpSpj83}BJGy2XOu~|35UeSTVd6P9)?MOILsp1NtzLiL
z*{{3<yxl^@8ugzPF!8e-9zQD>j?paSM*`0{oW0NlwG&k)eh3_8)xutPGg-+$mran{
z)=kve>Rw=~g6q5&w`r5q)F4BwfYV--@<!;V^V2Db6ZRF}m!rkr@>H^5k%4R3A>*&J
za7yUa(NE_~d1Jp^4Bo)incd=CH2r@~z@Yn{kX`ujpDmPn#;;cK{SQqAAcMjz6=jDb
z=;zl@?>2W+FSOiC{d=vG9i>bto}HbnFuZR3ui`l5f8DR-xM~A3>9O(iNLsz3Wxb`Z
zqh9jdE}1WQ^*t)dvrZb_1<#0|p!TBY=x|e6I33;Rk_YJaGV~sN2kyNLU15KqAGbJd
zIEJEXCc%zuC|I+Zfh}96STYUUB%Y$UuKjq#=>%bJ%3d_c)}`r|a`8J7j%OfazI<CT
zVgV=e3M|K9KjkbMdL2z5VHB8Fk6!)!8vK#7@#NC)Byt%by~U6UD;fhw=U=m6jsiwv
zZh#dU?#pNf0y38<V@3je6UBc)#Q+R~@ni}L04~&$V9o^&Pz@Azw~FDIB$>p3-pu0k
zlEsrKW+UW-#f3)kG>W+izK~kq6ME@~486-o1>Jlg=`1Eexg2M4l*`vgAKsk}Yw5Nk
z7`HouX+j}kd!F&|r<B|Ds}U(&Qo12?M9}4ILc(mnvV2-2H0NI7Al83p?s%D`EkrK9
z1}P#a0MBOx5(;~czVN{#nCWjvmuWgpUYwl32tgMBzJ~MXlYIZ5(`a(y1kw1U_>-Ga
zgcrpTrw7&0>m_hr1bb18MIo#jdV+&&g)s5?H@^0mg_k6xemKT_?l?;icA{yrq-n-*
z@3@qDXIM%>*;OBqPFjBjs;HVFIWlIFqGQc7D0UQA$Es&qRH8QVz6B`dx4vVlZZMFB
zj`JPc-89o#49V%RGxLKKz2oFu9Jlx4?l^k)?)?zxozpoSv@GZhy?l$O(GB;A&%9x{
zwkrsT0|%U2L$j20&(X(OjFKpr@jr*r4dNnXf^yo0hAYRF`;~v>sI6I|LC9a1-L7tV
z+a#rO5;O<mB1xu<x#++C<A0$m#sH6|0_2)0R-#!7r+OaEvb=b_*|C4kEv0!Xy=cnB
zR1$Rb`QvN2bI1hLbRoMz0oYDOoDYw_6Tx@H1yeXg0G0RCx40hsap<QE$IN9Ocdn_Q
z`#A<x5)Oh%g42Hp!-@tB6CAP|%wmEg4+He=iKa@5rpWi}dJr_vNxs_^A-krcQpLc!
zBzxctsbgDJWo+vvaZJK=N&W_G$U||o;Lx+6d?b?z50lCLc<SiNVqctjBg@mIZJfhv
z+QQf8{(5Ls^^Z@?-{Kjck5GjzsTQ-SV9+l%5yP^RM&^H#QFlQQcrD0fT^tZL<7jn_
zgW6X#)Q&MxtJFYAO4?|Epjbx*5SMyij>j<@7rlLm!WNUvH5uJHEN{jEJl@G=6u2$@
z4+bF8@aW<wW@C<P+_GZX(=Rc999k*3TI+>)m=G`vLap;-2gJ2vWPi)G4^oHPG2@B3
zL!pPxvt@tn7Y1m%HTdE5VJt$MVjF!^+AZe5r%~Abuq=`8zJ`;M@j1H%#$(Xxu=AVZ
zO%$e|^B^}KlGLHAvnb&aMBL{hO4DdE_{MHO9T?HN@~$eVwhOkr1MOYASFsh~N+*S%
zWe`=8sg4zgN?213f^AEo*fL~?F=kSmtU`Nuf}DT$W)uIa{1BN8oGGL-?OW#C+`{t)
zXt-e2{iLGItAWNO3-UPh)!1|4Xj6?kDb*5O^_X6=P&gU*A$ZDw7c+;!pgyc`a*sW;
zd%nLCdR13BA&?Hfl5l=>F(?$%KqEomk6B3B#b9(Xfcuir6oJU$1b)InfB2VQd@n_m
z!~lOB0U#jPk)PE$Bl9>40`c#+Z_${54%rXK{4eJuxw;rEc@k88y&Fc`3mn}Aj;Vi8
zv-AArt>4<voMU>n@FH#{v;c*$k3d%(vKsWb(nI1ysv5B~pFLVTqN{7BW2zGNWK+YM
zXIj{@Z3|0^r)Zk4s*=VYc&@Y@wGRnAolJkPc3z9(M8ZjFSXc8G$<pE?Y2H#svowR}
z5xj#4UM=i;f&&51qG&c1Wg6dcbi|&IpN|l~vtN_g9ii;P9--{E9xf$YoAK$86kYn`
zOBSQpPlUH^)vQS9Rl!1t3KKF%4qL1TuTXLs%>oxbRuiys2(5gQbndXY(B3ZxoIZbt
zwAUi^G;56tUrNB>nlcJA&X<6Pp^AvwilOn6&4nBEEtpOK3`p1-W9Elm6jO#AmZWIP
zEr*a|P9%(rCR5mrm`$UYdsvcij*?k2&8!k7-vzPA+zyGH`4o<KF`dF;Q}oB7zb=`d
z*)Q%zqPfZi6-@;_cXJeWi0#_U!LEO0xmaVmiyfj{n3$TR>$YK<p4m$gnH13!pPtDS
zRq4T*qiYg#DqFZzKoZR53rOFU8QNTa63ZlT%~t{(k98U0o`7n+aH{1~SdW~yl8wGs
zTy&Y+;&cN;y<%}28-#$we2vQ<R&Gx#7CvhjYzB+z<r*#IJk4D5M7}($C7yrfC0BSu
ze|aYQ<z>V_`;f`iSZ)wC(_($bvF~;i9%?}8Z8-h{WNPoetqYh}ZK>jsrG~LKv;0pX
z`9SLqcfou+NJ5SllJz$hkh}1o4H9z3fIeE$SeJF%CXRw#$FQ*`+d6hMW@E)tEK{)=
zRrL)T_thU)ZuQfJ<mNIm!bpF=dsw({1E;U(R5Lw;U{weAN>yjrmZ*nS-Si~Ia};l-
ziM7X&D}H(mx&NQNcTtYp$kK#gC7TnyVsR=Z+%Ix-VkOz~Xj`_~7Tp^$mV=SVOcXIh
z0o4GC6nCfp*jM=De*r&>A7!89kCU0W)(urGQe+W~utiqo{d)2{=X`%BxHE@bNg>xX
zh7E2jK5-N)LUBQ)yl8v|PcOw5-FCvR!X|tTGC9_5eLh~{sk`8yE7Im`d$h<^w=Gd!
zY3R3+K<@866IQxO5lPeY(t^Li6E}lrJ#?jl+j3ryz>E}^`8Q%nBWOtwr}RqN;V$c=
z@L9<CL=59?I!7!;Nm>UeV_g`7v3i$7DF--zPe-vr=73`#&v@2$F(0ksKxnP=yoq-$
z?y=YCZ*!8tT21&E{f~J9kaP@-EX~k+62+XM<BS86z?oFdr<wQ{490)__UAnqMlW4S
zjo=8|L8gJNSvDa7)&ncR7Bg*3LQBWQF?E}n4)+{ufK2z#tx(-QWjKqynK3A>!$2{A
z_c$06HiNs}de32%b?CK9JaybSfGP%pg~%wP{5s+1qmewU<XN>LU*l908AY&)4S7VG
zSB*^aEZmSwCKBnt&C=OyV+NJ#^U*UP<y)}|6hp$YZw0YJYk8=|jXO*0t^}2&{!An(
z=Uja&{uEzS^Qyj)e~Yi`DOBI74+i3YhJm<2N-Xs{+@9!Ql5w6q4$cO#<ag}BS8u)A
zluxz!jmzmt6Mu*kbtk%yw;8<92f~kMLHN;p)*UwE2lq_hvpkBK?mE~qY#j$dU}2pa
zT-P;|Gvn!l8jW|Ncmh^*nibmkAh^b6^lmwlcwfAb-|_-RU`yX@%MU_5FtMk9QHm|@
z8JK{<7h{}jp%ZBIAt+*=A8=7FqAn%ua&pLCp4*Stfn(sSd?>5B`vG5M%IP)cUuMb!
zT^W?E<Dh)00)M2!N-+(OA)Z$<88z#T@+1|kMz_bR(1k9Pu|gZBaCM~4ho^c}b0ng?
zq9!~Mf$l*-6X?HyOSp&<T2w=S)y^ou3)YNFTQ^+g*arRRWLjP5xG|avUQkwmU0TSp
z-6W^YVIHCrd`*tXWezj;BeVzF!3gDWpB_>uJM3pipar^P8b0Paaj>PE9`;<FW7lD}
zOB^lm-GN$s2fyReV~9o95d)6;m0aStrLee-toR)`7A&U<Qcoq}E?m}s9)mDU8ghUT
zcDwh!y7rH!V2fJ{zj+kI;&(x#59g!|B{mwPJVm7Rys6@b1-EEAkBevqY-hFOk9xkP
z3FW}iUw_pQex+bRV=~YAeuds==8OC!Wx}=;BhxK&PgsT;2!Db~Qfj1;o(8?xCY~`h
z(tSD_Je1$S4w0A+#dpAe)ad2lJ8;;(1LJL-dWOfvQ+Qk)GWUROxLQCo3){XQV#~KQ
z>}hs@9nTG2%e4dQY6oVfDb1umoLyV!d!AONZ7Y=;0&o@P#bBxn0%yloS6T3i5{VQG
z!MrU8u31u<SaviW3uL2XMB+4=$iz@*vph86=_Dhw%ZMVHrWuQWARbtbjzR7%=8TUK
zWEQ`U6iM+sDKdE7$jeYLrgzv2fP4T8>VeYISWpn8^Q?60uSf@!fAlmeBFUe4UuqVZ
zlC4xMj4_SsMu_zw(6Pl_264A692#CgL&{ug4WwLqAmysJfLQC*$~><3)94W^NgnQH
zi5|HRf8znzn7TE8TvK(bR?oiY>4zjt(J35G7jVv80Q7$m%`Vj1SS(*<{iseY8U9SX
zQIAz|FUu2cG)5oGBW-EA>bz?|KI=NiRXvTO#)^q|aA{xp(wvf6kI|Wu*_O}DIHfRi
zP{l`5z>M@F)hri;$|ryCm9d<2k+b@vPgVdK8oeu-x%y^*?eGkLnooQ7v>l%6s9wwc
z^79E#*bltOBD!U(W!4?r9Tgm2y*p4OCn@71=lh7qY`Zp>CTF`fy1~y3UVA;B=Kp+r
z+-ZX*s3kZ4u=(J6vJW-S=EOA&6T8fHv1Nuf4m9Rtt}*UX&-Yw=&;i|}m<y6q<Ig3}
zt3^q8mCU(+F8shc>FfY?A$ON0h29{$T_z%`Nm?h{s@!c6Qhf+Y3b}3?gh=v!YU@E3
zl5H2|K^s&VPfwN6obf@K@jQu;9;+T=qo6vx?uOUhb9voea#Hj{G(;|y`mCh}9v+8J
z+)S{P5zqVBP(0ZuVrV<Mq4@#UZ7>tG430^tYuGV=x#`-P=NZ}tXOq=m4rFO7$<hqF
zTxN?@ELglaOY1+}<obCo6l=N`n%v|84op+SmT%kGw+)Uporj_0Tbj*Rt;&I7t@;@#
z*6xR5?Yv6~uGsL?nZke`f;Vlpgyg(UY)0~}xy{0q0@wBgTv>{Zz1+xv_FV!@+cGRt
znisf#vJ8;LMRg$LB_RovMM9VQYzD4`xrn$_k*cX9lBH9Kxp}XQX6AN`W})S9W)Tl_
zBe1bWDZ_-D9_AsnT|Ee?>+6SPDzms~IuSWaN_}0cgL9PYwK9VdOFrY2N7usIy=4Sb
z+M`!Id_$Cs!-|rzTZ9bXVSZp+Ce~byV9Q{C77hZ=uo>DkbbU%(`TzlOo|M;gXJc)r
z^Qbnmy=o()<K>9|(=hlsSnWxNj%_ir#aMK${=8IRMB(vDBOy`6n!p#Tr*8?nIL`<O
z92aLiqY#*O!Y>qIoKVNGbRNX~SVS;B?zZGrouJeB5jsJ-rj3y?YAL?DCH(1BlV7WU
zwHw@alXTrudd9z4Q2KO=mEkmC+o|5lz#HveK%%#VAvH$m&mz(KQ5)P}4%+=?&>8hq
zgbX^P{pyUy_qeEA2jNbdQ0@NRx(3gz=eIChm+wvs(|Txs!!3LbrvmityLF^D-O+1g
zY>{K#rm-HQJLB^(0JzUR^Gxko?8mr&nxBb1%Y82AZOjcG#d03j;PdhA?qT(rX2n|o
z|9;(I(lxM5-K+V?c{;1GqWr*(NDN!oG+no`>oF5sx@F<OvN(2hGq9{sGc3<~;=$;3
ztqhg*t<*9$;qrz8OhgozCv3D@@72~;HXOv)`+6^UVgsg{B_yt#ue%}cyWZq~Qv$)J
zfZ|k*go?pl$BZvMw$mgkQZS1bfc9P;xc8_fk`uC}o`}044cw4pE1(2hx@}_O2O9Pm
zXS!(zIvv6S?ZYRgp&x3w$DA2z<(IB6K$s-=)M$*7^ae!<=zq%cWQ8<MLRk2eqkI-e
z1v>usXma`LN06gpNnQYni8B0u<g9BSfu@QvE9X2BL}juSFVP!uAcE3L@gvr;;sl$)
zGF6#SJP`)A3IZyaRj7O&9lo{A2c1``^O9<r9$|x&%1F%ryEF-#&N>Y~vv<|X5K1>i
zXV!N25g(P5X?@txHfYLfnzJ#aY@RZ^=+2fGasey6Pkyl)8^Z)+33*q4mn^r<u4T*I
zD@&In`H4f{r{s!X<h;0uLaEDB!#rM1H_%`Ys85DRr$j{kw20GdELF{)N`+uOI^g`*
zAnTi=Q}k((g|8Ktsb0e6z#dOWsKaIO>x-74A~cBI@$9RxRJ@U}nnraRu`(N9t5dj<
zKz?#>D$f=ZU^yxxpH!lMUyv*#x5w3D`+NldjRs9=DGCjm(#Hee95A*%ppko0|H~8j
zeify|Y=3?1xqYDy^L^;Lh6l8R7`FG<pYFlB;2y0D9;H5ZP{;0J&(x2_C#01f#QMR=
zVD+jVY-Tq746oEDB*zXmGXqjG*vt%(+3s#LQ|j~&+hE4k-5{iY+{1y*ENuCjhJBv}
z*b0b7ZOycOeM3y>)n5**E2~*o94r=EZLf2l&PsQ6;jNB~bf(x1o(tECZJQ*d#K4pg
z9b0yw<A75QGfFJO3G9Gd&fd9JRyV4bkydS<g+9&5v=OZNgR<QyIW{oH71c&T0??9P
zN8nss8F@rWkt!2^l``br$w_VCa&pp-IzwuT1=WQr1$siF1WdTl$%$yEw68ij5w<iy
z*iq!@<V04kI(~98Mkgn~{QNP8-_i`7oQM^A369eF$;oPVi#0R71LyPBaX)vV@~TO^
ztX;a*F$@z!d`<%N0hkWH{{G#0OA^O7iDnZ_T-U%Bp%(UkJqM@_2-BDzxSDV5drO*k
z-ICk06*PGY{(AO789LmeH0&_h<S?-fn=@gT1tBbXENvubJd08`mL_Th{>1Vl8RQk^
zl0_ioT-bU^@{1@2V=|ImLF~(ZLD6%FYTaaL?q$zZrCKz4fhGI-s4D+I=gAdVG0dtg
z-zs{rGUAYb%J)C!$yFm?K9l_vCQ_8dBs&&mfSCwZoi9_AM8=GVWFCW+j@F7?T}Rh$
z2E&HTqgFc?Y7~vXpE~CW&?{u0ljB(yC5mi$p|=ZU&7&&HHWDNZu#6<~0u~`ZWg_tR
zxN4;uMQPX6vnD31TF%bUsb8|1oGTKfx(UW!ny_GhP1)^z%Y3=6-Q2QvHO(6b8|;gV
z6v>rZR%X?eRcojd<{T1|Zgfy(DpW_A-xRyKPsq=0gMHpT%;(MlK9^YRL@{6MbSF~u
zeH$GWQ4!0&^)ZlN5~H(^4`2(HUmKBe{X6O?=3%jOV|!^5+D$e3rQSky(AyWcsaps@
zSh}l!x5}1K)fUD)+qo1jx)Szrm)beL=cYg_cUX-%2l<+0w>vM%exc}_OVZGv&XT;#
z&~~4>8<NXI|A@?sbWN-Nxyuu33%`{^e{TtS{Aw0~xotFi!VfJ<7_&`N$2to<cxZVz
zpuUeSgEHGNT+Z!P^o#?~Z1pqn%<hF}wu5AUeHVuC+qGmx1s4HvOFRU(tZ2zSQp+xO
z4PNZ6CpRjfvoFzmaHnb}AEO&y)52E7ml>a>89)KSExJwT86s>7-jz@|$QJ-j<Y-D5
zM>C+JEorwma@c+dQOqY%5lu<Kk?4H{1!cf+N^*fsj8Vp~BYq<}3Ssb|+PCxgN+5oJ
z`DGfj{2LU763K{i6mufjY>Ue*or5z)0n3968pP?o32a4+6o0M09e=H^`DSPa4yK&A
z*a~e6`<mh7&?kg3pw;xl2k`7Q?ul0O$F$%<nqGYm3WA>GnnIaSKH)fv`jX5+NQ|Cj
zas47?^rRf!euVBwKf0ELl#-YNU1k}7BfE7Hq-ujSjvhet(s_Y6n@Hc%3aFb#3B0+R
z&_o-Vs}YK6l+=WnqZ-DVk}tiBXmV<*B3`{h0m=E_M8_`P|9J5R&YX)+^I#g~;=sB1
zboN78*~$dX>LKyFIGwXMv)LjKX^oc!ytn~J*5h&%UcM}Q)AC$<BZd)HtHdOKMFZ;k
z#czcGqgpO@bqbla_PlJmUj9sOL>s>)1sRQAwllRoFc(-&`xW_90O-#L*6LHIao|b(
z`AGYGv?^p9e7s`9{^QNr#iu!?JkP^<d?C=-#&j+Dx;t57y_}_aQ3AD#v!>=CizXAE
z$!YjB<1`|%{6=|McBe|z_8)J5&RSpp%yWUCiUhJ{>icch#?m2zP5bKAIl1D9#4&<9
zv~0q-jt-A5(;GA;$!&f0-oOUSfj&S)g0IFazC|?V1QcNN*~<;H@Jo`fpNEA6k7FkO
zbPqGJ>nwyMih;x-mE(@)GsNcLg^zfar5Pv_g_8S~l#O1!Is1UFdBW0vEJqXhNGpk!
zOC4qyWqGl3?mnHp`9Vz1`?G4g8lT<w41q4>0tVsu^U=?|l;}Pmjp5H(mcpFC(Kgz8
zTK+SQ5_A<M>=cm3oKGVpdeFS!I$Y7suX>%=<>fP4nY*DaQo7_?Wwe;7gvz@|ZOhks
zp|Uht$gp;0s`UqJ6V}Op`?DO~Tt@T~-9VGmESf|KfvpeClq>e;k|(e{&(B{7mWHWJ
zo1_KGQz6Zh1m*Jp-XVp2l0Y0!vG!q%!}JDGK+0rs1q@D@DrLK*X8>df2pLwd)ESvx
z0Q+_rr#JOlZGO6RwJxsE^_o7h&>HhrogX`#4PTiZyglvT^Lo;Mr{#z>Ich$g{V;}a
zlg<kH@rMuJ=I9t^n?-pMCA4VV$U?^?M!P8pUNjF0bc#rjD_{QO<08#CiI1zPS}9hI
zM*q4j?b5qsG#b5HEV;Ej))dzf5w@%NU$^KGUTk80+Kxt}6J67=u4$vOG3xI<s6f-c
zzAD>l&GxH7+lw}TZM|kKFGzn!6G*&mjKdm<?F1_P5rWEZ;W)BOfW=Ov!y2FHUon8S
zDHGY@9EJyRfA7T=5fdjF=gH68u-T$!<G;@YUeSw)z5Ll?xI}H~jAx`s#ajKhZQ9vx
z>)%TV-nX|dB;&J;=Rk&0E*UXyy&Yq>ajdxeApPa^v5ZoGnu&AekcUaz!!Y#=Te`J>
zO0W3BRhj+Izlf&EuE*cP$#EYIZ0g!~Z0OdGq`NZv-i6zDi<Pj&=oMsg&c8tKmE~3o
zD?Bcd!S70Bu(!lh-oEeCr1(_!IiJsX_7QBej<#;%S(*!NuTY4mMUhVXIwJQ;)^EtV
z3TnIOfw16zim_y@KlPS~w)e=`(Jx~s?~JX+Qz}3-)A4Mb>e%vpj;)Xp>}j@-JzJx?
zquZ_*Y$A~DTjyb+{sTlmK=cDdKS1;YL_a|E14Iu$14KVS^iLI{7f%5Aj)HaSsnUs7
zs*@k0WS)aE2s}LmCUL5u>eX;M!e|4WExRjxf6(!Nnq~;J9KHWBM-6+1PCNR*>%A)k
zt=G>SBxR2NgUn`Y>)WkQvRG8B7UJ9WeOjuB=w029X|b^*Ym_H_t7$(gLCaG)xS>DS
zRqv?pLH~-jX*7C;HtKxV6uB_i+f~0J^{TFI+$@T_8sUn;de>RWIR0vrg8mitS=NU=
zb*P$uy9TFsIdPKDyE%<&g0|K7^=6JdbbVh>1J0^PyWm@0SC){(dEY_Y+B<KZr%`L=
zY^7}L?Yp-l+`E-e-?}btwHvng_1h0+VAqdogU8Zcv{O5?SnkN>eHR@>?cw(+nj}#e
zQIZsulV4vZ$Bo{C#yx4d`l~^D>IeFsO4~<&FyA?jx%}B~5#4o%?nrvPhxNbn4!Fx6
z*wH!mJ{JF0%m04%%5MjyOY22!cA&~Mk6E_EiGf4SBG_WCj(wXtI1C739yOQ|uHv<6
z)wwCjSBQLB&ivwx_w=;#3{N)#&%@jeU2Fwh!#>kZ>~WX4%%d8$_!Ewy*l}(Yu8iPM
zc31i<o}36LAt{^#3?;)Rl2x98;43735f_{lw{uK<iOwN#T*e8amn17ncuj=AyW~h-
z9#CC{<A*VsOgIw-HE6x^Jw!)b%4j9}yH${vr#%NAf5~faE4}mzKeV+$4!cV#z2+H$
zr|j}*hm1t=Z9f7jGMR|zT?Nk~c!ctn!&%eL{HJUp0@|IWaYS#WpNSwZgsSss3Qlyj
zL&UPwpE&(#mJ5(JNIUWORxwdM3d{3Oj6FzI+s&V%py|yw7UQiP@`RONBdu^Fs8AOe
z`!!yHf5P=;W!kp;U(Hvw%wHs(7d%5y#;C<|)y8xhU4XG~#E^xalbGj}A1mG?t;3O2
zcah|@e^|2~)E+y5J^O-r?g;QKLOXD*i&MQvW|3|?Ve3fJoP8t#j~h9AJ)`={a<Yn&
z6QsRTdP{b~QoN*V=^Zq_Pl)ro((c@&DAp3ffBP})JXJnn%@15=ni|#}&%~BZEljA!
zv8P+Q?P*Lm1AE{T-W&f-$tUb!SX;Q36tIv@zdj+(!!QRMw&9wg<zmm!fH~N)vFGVF
z)|qDeoO>h)_Rkz_?2)H*EBc4+i68n=J`C(R_rRW$gOpThF=IuZI&Qo`3r;VSG)^bC
ze`6IM7ez^!k-W&}w3uhS=5Q&gqQ3(34(oOyA2(u}SA77k)p@R-q;>Xj8H9XO&lVYe
zwx#z0^O6~vZlu%snMAqt+!YOYmrg~;3nZQ|==klskE5D2N7Ry}QGVMFr!IMYDi)w1
zPN|^Nxr`>4_!_`wK1OkRgT;A|0;o#Sf4Zv&5Sh)gbe2V=;P*+lV{Ava6L>~wSw?_~
zNi=L(A)Ku&#74+0;@iIEuOxncdLWS4qYDeX4GR5TN%X=6ehzQs;~CG|kLwYDGYe1l
z4u`a;?3!dzI$yS{(BI}HBk<1PV?kMq!Ze1Zm1gL@q*XZ1IK109lNdpoRopZ`e}4P(
z=zgG|2K)1N01$CZ!(qOQZHH29*<pY^P4_X^sA*b`?|2)K)&T(8765A9I3->89#El&
z0ENB^;8PNut5Gh4+c)7T(T%l?3*Bl(MAh~y`BdRZ<HjbJpGD#E0>8Q_zE1f0Xe18=
zc^+)Y*El&uMrh`j4S7VGSB*^af4td{OC}QOzs*vx+}n^rr2;mTgU8dBF9HRrE%|b+
zbr*+9+qf09?mAFO>d!=ya>muS;!p8KHLL0y`M3D0o<Q}T`d~c3e!Ibb5YXYEV8116
zb~o&Ak2>AmdQ$JG?K>d24*H{)_t=Yi({JAk$wlxex*<-d?R$`M_BMlef8$s0fILKZ
z>cLlUyE^1|YW%Z=@SBgJ!-n&HH}rhXG_YxL6I)ss;s8uTEQ9I3O*qkf`+#78hFM4j
z$~^=Ouo=}_4z=BroyWJlfc|gy(DzN76JKN4vrG+JKC^M)TLw0X8<@IJ9L*doJ@#wq
z(Og0uv!>=Mc?H`eOJf19e{MEI>ID>hea_=Y0ax@u4)%p>Y!7QpuQC5JgAUc<uo?`<
z-ByoYN)xga!Lgf$$C4Gf#dsX$Nm}sfthhZ^WsZ8-%+$fMc7N<ca<%AGVrZ%ORIa1)
z)6N544ZH}jhMMpB2+(lxmPh|pd7D-v)y^nh`>Yueu5P%>u?<|%f627E&~all*W2Ng
z?It;G4)b7?)9-cuXaq}n@gBBN8Jaq$8q=|6aUENM5nw;?J#4s!=Tl-@fw$TyVskyu
z%_g)udWC{CN?3FqF|b{3Cv51MOM#%jJn-t(cOp_L6cPPn4i|wu;5lp57(>fR<K7WM
zO!uCV*Ua%0d~iyce<qKDSo|(5jA36&8|cv(n3+k<0<H|6gIhG6$3--YdEKZ=Bu^8{
z!CbrkN_67MsWR?GlkqrZgZ6DE(=px+zWM8mWiK@0h+N&6jWoIVrdO23esMYv(loVi
z*qH4-`*!f@>x*D5hW*?Yjc&T}^>ydm-OIM=VOzpxTktCjfBE8_=(CVA)I30GrbaLO
zl05e9=B|E<J9sGW=9_pYuf*L$cW&!6yDwn0N9T^hC@wZyQueI$!3Ey4h##!D>)YJY
zEZ4`O7Eo;IVTe85*Rf+-fulLhbj$-YrIJ>RAI`2V^gT~26O@%ms))ZOjQzkg4#cjG
znV>Sc6D1NUe;jdm>*gs1yE$bD)xlR=gi|sGNSr1UnHH*S7KbK0on&No8Bs*jG-FXB
zEG3UY_$%g2Sn(wj@vDsDB4n5h1a5gLfQ=3McOK6w$G=-?1(-$o70UQTjE)FQl+H5>
z-g{|=3KfH0dG4WUR78@7|DLd2n2@b-T}QW=PR$Urf6yV=a%>+5x~pL~upEav4s)Cb
z2)uW2ueBDM8{9V5zgXzix;(Bo)2RE3c?52HqOgYK-)QZl@Zf8_H0q|cTJ}9pKO|v_
zPT>f+fZconfa66pyHInmvQr<`+0cw3r;2-7o*Sbv`dA(uOVd@SO8co(*Ez20X%sb<
zJ-a|?e{i~6`LdakS&wW}GTZW56Q>mB4yyP_3Ye2#5#v=hDaH#Qx@wO5<yXr<)hmDR
zSFu_(B4_nSpRDjGZj8>6Ty?#(cEZYhnooQ7v~AF|^+@pvPuLH<$RfIBt7X<5+YN3u
z?{<lWbCjfvi=6Kx9<%M*T$*I;*62nE9`JkFe+TQuo?jRCj*klvb$-}<1U%V?g>CCT
zb9Eat>iS?>?_rNK8xzMQhHX;I=IbK@43gPhBr}kF8h<W%5A+w_y5iLfSimnf3RjOE
zz}`W0ySr2-@LmzEZ$a2nbF?btX$3uJw{2leeF)&Pq}34uzCf4dG2Mo*yQu)k9>lbR
ze+Hl%6aMTFXnR1Qw~0~p(BSb#X>E8S4Ns)uiPZ0jq~eA4d{`|;7wu>7|5RRBrKr`5
zO7iKxvozOZ)UYu30*)=;GO_Q46g#%z`i{qSZn6VX;0QW|4~mbWt+V;IWJ471qX?wy
zU@l%di{|YF?22;4qA=tcPl}~93xJqUe>enEmuUHUIzzfvaVwPSAdywR!;U8zzZFqM
zMhohenUJP{c`=bp3o;8W>y&Rc0?MNt%~BYxh{Py|0Z216Pi}~?XezCZgf-HA8QF_I
zZKa8!%neK$a7-Ks185i&lfZPbMM7#gnr1Nj0oLJ@(!_Mu<jrM7FU12JB0-56f2bA*
zieW*%L>~$;Zd(Ng!0)BWeP=<7{7^BP3x1CR7TaZdgQief#o0+RUaKa>q6cQUrG-6B
ztF@gS@YlN6*H}n0kK<z)u4=SI*VaAi7gM(%?2F$oH9lK*f(Z~{G5=US22cCKxX+du
z@ep4BPv+rYu`Uj_XM40gd$KS8f5-8P5Xb7<TX~)y>?=YubgCJ^s6`wXTZYT9&vk+w
z&m*BrIJ4Q{_3+iDH;^)<VgWA6Z^b(V9ye_hHJ*u@W?6b2F`n1#b$1f?gh812wnZ^F
zNP+hz1&$ZyT4pcgGc>p@t!$P_gNmzB=99tDI)#D0Xpk8Pnel1MjDx$ve=`ypAG@c)
zU1dypFdwXt8R(vAb1lT7PZ+i=YT_Uu7N((3eA{xE=97Vbeed+^h9~*g7kHlWGMZ<+
zoaMO`BA*LsyQ#U%WSWV6lW=TNFT{c41vvCflXI7u9`^>)_Qy=xE=b1(euu=$JpFv6
zc+fTN&)+CEbxhMZCbOKse=dJ%^Q;GiUco*}7^F<I*Z-nvrs+7}d_Iz_<|Vs%!KzvS
z#Ka_yCdq5y*|;a-c2Gu<q9F8&Gaxn3<ns_72a3Y`0eIN+Zcwo<KRVeu&=?9+I?v&4
z49C*OPHtvW=hqRx5l`f4nirUepmXiwF1aicdebFP2VGna3;<m6f2ZR($_qqE!sIaB
zCoQ_U9WA;=O^Y)(z@Ebhwm8?ZM;srAzC#V&B$jDu2c!yKTpVlk!RpbRl}e#<eOCT@
zVufd%^5|O7Mzp}4lG&l8?}uP`Iaf<)N^ViW5h;X69nX;PsT00*m+3ra@Z~Iv(kv>X
zGWbB{Sx0XJp5>g*e}TaYksFf9_?JaSq9jTtFVVUBtt^d7@-5({m~jfRe@pi~m;kk+
zYu1V4lHUrPhku!+P<@e(MVgEYV_?crz;l3$V9%7Ef3qx|&WiXJWqg)qaH9)YE1&1H
zhzf+N!jQzkP2v1P!R?IX;xv)nsi?hVeS)Opl1Ct11nHMOf2gkS;OW~69hlC35mVVy
z<Nag>aPDdzVK%n)kYS7177p});?UO(t{Z_xG=0#~uSI#c@tUm89edTegN~PLslTEx
z<$|8O32;6NuSvo3EQ%8rUKMXWOiTT7Y5g9B$E(~!MFmS6*y`t7!Y<A;0usu_8P6zB
z3NqmrYE*<Je?Lp-LClYZpm^MA$E*7LPRmCpNY}J6GDa<riBA4MooWr-*A~vAtrT78
zx9X9AeV6ucnXf>*P)H$~E2!G%2@`2L9S{&QVMvV*`m?k*SUX+=*Udp28$4%MgMsYk
z>!HWvdtB44b8x3st=<2s9v0^FTbQl8cc+DEecgp=e}Qw>c*m1_i;Pq8_UgL}B?;Hj
zYh-ATjk@enGndVCE<%LL$qh-IZ&biNxh?lhMVrBk@-T0ZZFoGsx^3`4B>9XiGkSO$
zq*?J6+-!dR?U4{ho~N@4Zpjba@6h3HVA?Ljj_VuP(y5I-Go+Y@gqu1Exxx7pRyHYL
zzm^$ge-r*~=%GaP!g<0*o7GPp<zh`Jxt1Gp!Icnz$t(fqKt<LFnoSgD{2z0kfYzo<
zJ}EStYABR`r`AVJ(<CZVpdt}~@m@(D_otwdGjZ@L8lC9@3p|E>NB6Pic>(rKn_$!R
zb;4XT)O=@9(cFiMrp2UmW~fbCvLw}Z)1#N@e~p-UP~t>Tyl8{6u@}nSWzB-E6%YoB
zUGZL@Rmk`wvaIjn>i8H{Ks9Oq7*aO3)ox0m<%ak7t`9=@qY&!n3oz(|2Itc?KZ8DK
zH+1u{A&3tj{NUg~lLyoX4b%Pgr+d({^cl55%Q761gPLTx@elIGe==&4ZGzqpQl}V$
z3qe!zbu=X<pnKSAmoZES8h`R5RQ0U>^0ytl8)=%9pyl7AJPM*XDsDG8YtBkGt{>G@
zo|9m$8zvB+kStQ_lqmo1A9E6)rw{4#>f`Ml=AMghE3+uoY&XQz4_s_%fsZ|#nb<Z$
zUvnLo>7l)M-`2HDa<huAR?bOy8hx0~c$TM$jAiiO$aMA%di&kGihmolRK#J7D>ui2
z1k$~bLl|BG{tK6_yuf1lDII`vr=l^*^VjI)Bx+R!i{>qOD1!fnYzy$VWa%`@IXZs(
z-Mi7riD2LfK&RFq5nU`NpQUNo&{K>{6#$tRm!RyEj@sz>+aKQi{BDfC{p*Jx#^}@8
zdx*V0oxPbCmk@+_K7X6Vx0qgnz5<G!k*r9Bb8FQunr0c7S^??)6-HTJU>JKs0hCVo
z4Zh|HOS5u2AgrPvPm;<7bOs)BjMx5aVU&=B0#T_5JC|{xql7=jR?AD$ql%&k=MjVE
zOlKq!p699fu01xDIz`RW$;mk<(_BsSJ8;zv(oCd1Ie}??d4HEfLune@O$ay@#5!3d
zB(kHYe5C5DwsVieB4os)l-W2WA;p&M5=<OoV9gF}%?h}#8RotZ3-hjr#rDjtP0rT8
zo_$cdrrQPT;FX(LZ2YFmQD_2T|L|C9^JhGZQZ|+fN&<gk`4Ku7fyHy4Mc{tPxzH|3
zcgYCc*JmWVf`72%LM0gU0!=cKpi}g}zt2cAj|n(i{_~siOIW$5sOde{kHd6BfbQ0T
z`}qhsiC2d5PSf!7QPm*f?TJoB!|F;T8ATa>v#bP?HnIks%E1xwQYeW@b}WmTk}HnY
zkd;YFIxWUSGLJ#qr@;wQX%taj@R=OET0bT-kJ^o0sDD#-;eKkJ!#N1Q9M3YKTPrn{
zoenRshK<IJ@aUcSL9dXQ1?7tK`Dl!O%Am3OxN3Jfwo+-@w{j+HU#`^cG)X$uo~yf}
zZiKO?Ml7i2JN1hp;H+cCQ@6w1wjJd%*fbYvbqjB6p(yxLS8COj)@yClru>DJq)Y0i
zT<)q^@_!=ZdXaH+(D-fndhgEEyE8}c5{J1c=4)-SMT)+!#-k!CV%fJo24hR2y!SB;
zZ-GN=V|uTDVIBdu$j*%wYiYZt8vRml0buoZ%h=Kocr)e3mP*tul&9M%O?UFQ*gZo0
zCc3jbtj3&!7)-L;otNas<7{C`8v4^&l6M)}?tjC7LvnfOACY;Hu4&ajcL9&KK>rT*
zSya9nK_<DHMPU6F&AvW#wDSYc*F(k(FT|!!Eo_Cpg#$+;ST`v1U1nK~g?mSXj6J^a
zeoPA<r0JFLJ=^%s69{1`eQ*|Sbh>~1OlJqgawd#e+wp$ZB5jQa_XE(K%|z?&k?*X3
zZ+|=Zr(gz$*Um;hwC@tJSfG4(%S1`R<2ah|gmTGW-70sMr6olqG`n^&z;(J7oUU9O
zz7b;^2`Ez<OVcz7qio6<iqrH8R?Zc#93d14c+L|7v6z5o4SkIAV&CLya(MwvycMw;
zHv_{k4T?R@cCh8^CMJ$;V8;qwjT?sN+J8@(SZ!g`;m+!6EIT2kbsSv88#qVDGoG~}
zsnL?iTP2kmET>J&UG9q&Z9!87I`!FQr3;PR(;W;?Ak}qzF3GPJP5Gnnf2o)3hv`fq
z2U`W^;=b)TE(@_4P=+ndFtN|Q5c@u7njKIp2p?eaKB>T5O-~Xz{{Q#?{C^u)D}SU}
zxo@gPwcHhjktn|H2k(-}1f8NODR>qE8p4mCPY|x9fb)yipugyr-SH5CQfp}T6a`Vz
ztQLlTByrgckgP^p2=QG*fiMltYNpL{Mk8^htxVhO>S$C0#Io)GnMMh^iV}7Tl2tk{
zc!r>iQ43aXgM*DOw1%T`s>2YFn1AP#A1f$P>%fk6U&#;?d=2hM1eYbrHX>+nu0gsj
z*}9~H;Ufun+{n3C+Adi|`OIFiWO^IC32D9+!t04fiQ2`WX~_+Ju;xsT9unPg7!FNM
z!<IoDOiaVVjO$)thAgzG{!Ap{;I>YP&MW?WDI5P?9T|L+bS!IZ3JMDnbANDKg@xMu
znq-TV{-CRzm&C*B`>t4>KSo)X)64BdT@7NEd5(ia)3UHdd;=3RVA!K3HL1;P-y34k
zJ_=E{xv1L(Es04H@%&XqB^@O_UVFU+>1mXJz|++4wv8rM3U_r8<V)`&+A`lEiSv7v
z=2fT4)=jT5|1yIf)%x`r$$xTw0q6E{w}{b8xrjmfzMb(jJO+3^nY8?=%aWGbwe)yC
z)EfBR-w}{pEkKnR+AKbmYpVRT^EObkB}_R`^QjO4o+X|M=)Xkt^C+Q3)zx-J@sMCm
zYm~a-D#tc2kxr)7g^nAex&9?mwwvU%In2YeWZkm_OvL1~<k1PmaDSB_xMWP3?Knn=
zbu$pMM}SGlU91tuv`lW2z@`Jtwn6s58zql50(o_23&l&6u;@Bsa{|%Q7sFhY0!4p$
z;?=9~ghgf<S_7<_#iby^g_M=W04I{hwI!sX?lq-uspBaaKa|oD1ep=P3yc>wGZMQQ
zEWA@h%7_~kf*#zW>3=*fqFKzF0YB7xBL#&Hyg90`o@S`lXDVE@uS1z`S)A8pPf$Ve
zQeC-?G?M7Qm+e<S>%rY@2=`@4ct?A}yVLNK+2xkVo&qqmJ<uOM<|qI=K!}IJlsg0g
z*qS$bXM4uO@!@@xRGnjRWo^)|W81c^iEZ1qZSUB&Z99`pY&#R%wlm4e`_=jC)cLvh
zUh7BKUiGZ*zOTC*<U{L`>Yww+mPEHMd3(~W-s1gF&cgIU2LRPc8)0s=!&N!<N~?b>
zJE?uv<Kw*4c~|x2{L?n~!YfuvI1BQr$MyAVRbD62EOoS)suE#z#f(W$BvG3mU%M8c
z6s3Gz)I5xxZBha?FKUCQD5A`2goMdtVxC#DV>suIIcREsCDGLuER#A|Becso0Kau|
z0;aA+bLeaG6(9<ie2buhR$E&Em>7IaRH|)@2g+Eko%7gwh?K906B%r6JbGn#=B4km
z$3m%d$;O_cQRwH_!-JFaF1)GEkk@%EBb+&ha(xmf;G4$W_pg=0z{d|&`|+!R=g&lK
z9D7P>8dC4CxwqnRU~yC<+4hmpULEX6@S1yNO6I6;0r)F1jW2fX;CEkm|0RS_bB7LI
zfy`9G0%b84t%YWt+fP>45H43zE@SOW`PBT^-H7;~?ndNKcjLtDBUJl;yBqj_1S`IS
zRekIc7pOCz#@NZ5>GOk~q>Zi%qT)*exXzCJRT-dD6~4A<O}Kuh1^?I5V0wz(2G|LW
zku~*X%CayxXd{={^Ixqkwt>$mb!UAXouKA55PBwxxlXE2*6_69@?vZUO3k>#f{+EJ
zI3=p!No^<_NbwYG;poZyme>`Z8w@zjNBpd6x_Pevi98RV_IVqx60}``!OLZus_btt
zyI^>hvo<Mn5-{vU$JrzV>w~9B0PsXO6IHN%>E4@b(OwmHPl`iQ^K9#FqX7B3|B;PR
zc4;ekvZR7iy(ZrTTB9%cca<(g+E>pzz7Z9gIxe(wOC{PQ{4P<?gfh{%@BZo`A4Q#6
zXu`ZHp`fwK6GGHC`FE*V1q@EN!5|*ioiOZZFxtk`i7y><rL>FB=UBON7O+0=iFn&z
zR#Fx0*Wk1Pr~A`c<I0PqS9x&S?cgu7@57&c_S<?!lqn{cn(wI-a4CoPxHZ8b7fJ*M
z{*Ei(AESdbgw!yP2iLBE#A*8^8cLIbyA1b_a2wqZbjZ#!fdd-s`Q*W9o7f%j1u#q*
zH$bkKF~bE<-t+arK%O*h0<>s?tMA?S?G6z5HShjXmK`e{9}q3s+G6KLgT}6{w&5)r
zWtF4OdLry!C3~nb9BqzLkJ?|A*?KOOcTO|0#vtjW*&F7Eqxr;PzP24>$2AjEj2Tk7
z^%~o{5Kn?Yv>#GhU_Q6-g`-7&?Z)x`CKd4VIQ;N(-t2ipdGa@<0*pNHae45*+MKKy
zEJqT}4ATMEt7B(=owi@)^KXbkZ#w7>t93^uk&tpuQ}8@dqNBma*T|5VF3N9p969A|
z^BUmPhUxmPBC6(|mhFY2ZKRnSMTaJ(qGk^*vCR@;!2iV+MnDYo&jE&w4+x|++=cPH
zNBQnUX3{+CpWQ9#6}*hX&v|@7wyl`p<vbHm$M$kubbzFD(>nF(3FO0#`0Z<LJp0S<
z)nHe<?K*Ra*RgiC*magMl{47lYs*bu=Of)o^GDWd&cX4$zp3(7awzV{1l$f2`rhG|
zf9ysJyzbYdF+m!9x;d0X-i@@kt23<ns4!qbJmAF|qgcY})J;1XzT)Bb*x7^~d*Zl3
z9t|WvkK9nA^ZCo<f<6wUTTF@He8@LR9JqaR(n}-sbM$Z>%+645FPxew#NYah;{c^j
zl>-B2x1(q5mnXeYgdn!AcG_J9et+zu?qKBxhT0C^V{48<<iC#Yp)%goLEc4uM<G(?
zTXoh!qWQ=!5+_B+`^h~tnykfGL;MPcw}p(?34FBT|0xSzx5!0Xz8y@tKOlZ;gMd>d
z0Z^~IJFP4cDinP`-QZ1O5`HePbaU)@a5F&D9AT@RvWsi>3~P!xY7*66t*@5cVwYwW
zQ&OWF<6=&6jx28A9-~ws)p%2dvD}P75eL!eae+ZrB}EzbM4<ultg3#>EcStvuMTya
zs(ZwS@NO>1<D3^;U|6(u0j-&rigPpw((7a%YY1{+Z#gv@eON*iamc8$qBZ!TNdmyV
z6=Wp`!|M6|@Q_jH+2M9)e0&xUCb%71B<bbrX&m~UXEs1Oi>w{JQE;tfpGD>*Sw^&K
zW>E&pn6Nk?+-gLOdK`?z1wEa2LUDvzA&SLT7Qve%FVbEZ%S3dpCg-%X+ho{1_Yj%a
z;s<llx)rSgKMI*X^iiDC8my?ChX523aOZ_6v4^$|=a4ZHMz{anm)>45iROlA)q~6i
z_C(>1i-hLjY!lv@&$O}PcY~lS9Z)u>%Eff<Fg*(HU0>+8`&YZkuyU)un?(PQrJH&l
zi+Yvujs*>JtYdxp{O~jfca*H&S;|tp5N<ZyvS3;;R=zM%pfZp#TLT1BZ5gmLv9;MJ
zdas3tJ}R@pE}kF%^>I=>U;plKQII6Rca=4X0bRJS8bo$rpGM)=_Ic=PRY;<1L<w?o
z-v3IpA`zM|bt_v(3q*fEe`Y1QpA&5vzJ=k+1E;cZK4rOy6@1jOLALhPeqgOhChy2i
zZor@&8b2Q%QnpByIfnMlN&{e6j#CU?)&4=P{=;owxAk-G;I6?V$RHM{7QB!i4&b8r
z^|h$H)hO-S?Ly=e>a0vmW0pt){?%{HUARx!pVAC(QvIQ0Y8rNWeG=0WN0qTjr<G(}
z*6;OFBY-2>oA?sU`wzIK`T=g=?u~GOI?4m8-Tsct&t?7PSPb9-{Cn8Luk9o&hSm96
z>#v*vDknHxu-}s9skOf7mv5p(%oBM0+A+RS0LS|KqMjuFb7ChpGIy1HV(;(SiSl6v
z27|hblZ!U%M!D%d1kjHU=2<yko~C5D8|w7P<uP4)<;|R1n8nRZD%$qjQKtQ+4d^7F
zd1Ib{g?3VB3L9Vo490w$%p{Za)CPA7&7G-B-PUZHGQvSVyFwtM1n^65BtbmR(<p%u
znYd<d7f=U;&`m`DWNXmQ1-PD9;^S^O1}^Lvq5VE|kcWBcnv&4Tk}dT#bnxh4I>KR1
zY$FG!Sr$NjWkrHO>OD2k0FK#0@=+_zTd+IEoSEp;tP>!>LYNYWI1m-1Bv#yy4V$Lm
zZ-@(o!*WdDM?*=dG^?n+<cQHH0r-=O56j_@LkjouGmPuC^3RGCM7c2feX!Ny&OkkL
z7lEY+0<2jUZhdYW`?}?9Dci}$p|8$rf8E*}ly95biwvj~K53k44|t5<7_{1uI3TYr
zAnbUILQoQbjZvL5L>l2xtn)2Q4&~goWs0};x~=5VgifxtovMzcRe1&hUNPA+1E}bB
z%|0(~RBwqHGAgntPB9hdVMga|x+1XHOY&N(*@g$SvioT3P)kuXg6et)8IDTl$7JuK
ziKMIma~DaQ%gH$mhSVb<O|>|ne09MZ8<0-AO5qSyA4ZRG9A|8V9zOU4gtj~!E%1Ty
z5@#{J|3PSBixFXAzi`LL?qjQkV$!1cb_lMzNi5YQGp_6(Es#*mIZS#-;m+X$O(BXq
z`nCR5i>4?fvv8+t>O<lIDlv6Z059=ek+X~ZC*+YQMI>827pR3PFR1=5`2Xs8q(8|H
z!z{S@DGDtNC&}@A(gqu@-+>=;`kY$eFXgLyb)`;QJEQ-|p8ZYkm}Gm->ihMNhSDyn
z^Z|QdjD8;X^ZAd*t4LBX@?@6O21Mf;NVS%r)!)+4>JPiD#@G)Zz%*xtN7=<6?gV|-
zX_tm0WlW#K14Eq$JIdS2t2wosDK)ctym*)v=D&5F(})wtD);}3`Ym>x2~ksar?hfL
zvrkBqs4j|k9N8490g(L!jn(q}`8$F8_FL<$0ACQ`#*v0uBg~mcpKfn5Z__qVxgT<Z
zr|2;<14L$ktnM#NIaayRx8sNT-hSLeMzOLlGc|gmM`IL;<U_Zq!6H2(n8lJlqM}~*
zmNm?$7x?hlCvHiT=h&K)V-}iMj;emZm+zwktSP$m$+x+_E{JW3zK-mjAwKNP5cB(U
zJ)u8Vv4X|TC<s&V(mwoix(0YMJwVNUFBOaKj^`8L;g5YprNQXIWFm7A0WC62>mOb6
zGu8vf3<@6z<~3alPMvWQSAvnNd!m|MTxtWaQe%|>txOf-JMpjAua3tBnuj2=7*jex
zta|*|q+DCbO`wP#U#1AkuwpmWHG0akG@3j86?|#`v7EAwd7^uC5#IE%5Z+O`BKRZz
z<|-Ay;?&bU%gJ*tjx0+vfCi(#7W=5-(dI%ia^6&sKslQL!b!Rwi5xol!PO$Uzw{Z9
ze;Cy;uhWomY4dbqGeur@W^}BBL@@c{xa&=TAZ#AmQ)$J}oX146?cy?l1d`o$JU&io
z)Y;A-5)hO>o`eq}6JMs%^Mw`=3SO`9Hnjujx-mR!i-9yKGH@oCF-dgHqEJc<%G7C>
zddpc@_?az$z_dp<vJA3RJkTqZBrgSr47UI`t(=h*F=VMe5C{}2fPnR96P3x3sp?P2
zep7@vh{3^X8}^{OB;F<V(h!ctk~{T^uSG+I-jyC5(=WPslg7ULU-MA<{FsAkYL!@k
z)ECG0yrP2%q*kG}HU2_0+~d>IF^;4FzL>L<;$d;N$(fVIgL8-ZBp{;CPQNQq+Xm22
zYt<XXnRb2p=nqO#fbZoN&qqY$q-dU1xZLK|dru+rj|q2%4!fW7)(_UFZQL&QeacJ(
zEPuLv$3WndN!NdC^5*BMSUtM_xCjRjvg`S|jqe|;01z;DNaLLDZ!z<=(Px>hhw*Rt
zIHwUl)?tOG5k<_6W;(*?NnM#6e_>v*wa_1{EP6qq_K#W&f)y0&BKy^K|2$*iI`u9W
ze%wC2gQYKLm;b_e>KQQWc%N1r58yfUNfR1$(KZY`o4weh^Y26uXBr24Zs-8VoWv_~
zmmf&^<7LFpy0b%t;~h6zg;Ed+E)RZ?yM9>`;5XJ75Sz_@&}rIn`1S+ZLQT)ymrFn%
z#t+4N#&`@P@5Z)uF;@<wM0o-Se;V=rfc6so+PMRny=^cG>kAWsleLv^kN{caz#nYd
zx=mm^95C&X(kZm(j`SK7&$Iv(^s8T!NV9&~rOX;T)AEgj@r3<#8WJA0=v17`#U?Gx
zyk^;k(#!8sFw;Y4W~OPfWC1q$NEh@#p4D>0Y`;>)q2oyzLPHDYb+9DrCldF>o3#!?
zn%k!hDkniF&}Ux#Wb^I5cg<7!%6MFdCl}?C*l^<0nsVmNHzeSM)A0vbn#@uVAW$2n
zXl4<1f{ryxo!Zc}`8Zl~u!~2_e@s!O?*wJfO5TfAx_VRMTQ=ib{iJsLkD%=KW+2fd
zW>_?pQy3gEY+sta0z|Zwk4@dV`LR7c?Y+8sr(AF?WAl+V9j8rdRfamy#kZU%!^7m`
zjGj~Fywq_V5_@Rd9@Bt=Dbo3PRy~HaMKc@on3<TrD|+{3b&bM|L8bELI5pC_fm$VM
z%KkxDAYZOkza-N`4zzg0R!%NuH83+AmuMt_d^>(_;;4EUn5=gDBZXM6PQH*0=bn(|
zkyy4^>@F4MWVLnr)ZV^2wa0=~D8Ri_cO^%M5ZY#8C?p`eo(J_8nG-1i|J^m+(G(IF
zcrHE06p{=8Gp6EAO$~7<KGI$6Mc&Ng+uHRE!?Fgwh#IF334Ri(^nNYVNMH1#`cih2
zO<Y_SDz^dCP>PEOx%ucMY1#K1U3-sW<<7#+lDxZ@9Ayn!{;p+S(o4JMasfz*pH5VZ
zK*pH;8Cu2N+_OHwta`p%aFTp$li;_m@)*jkGxIWlA86{CoVM~9lja=W*uBmc+SDFr
z8F<PUK?#5P6EWiWJfFDk05#}0gy@5ooX3kfuHy8v2uDHIKmWYRHfoRQ<|WH45u&8v
zfr}5*0HS9HhZlMcP@WBgx2s%xQp+`kD4AK$qT^8yRU=p6#b7aM{Ct$fC%-8;bCbyj
ze7p?6&<OVlaAS@lEZxbQB{M&nflBmzt>2t6-C7D^l11?_lZbKFlDXyqaDQ5LIA_Bq
zl8q`y1wm)s2t-_izjh227bpG51OvQwOnt#H)$FyOHFHtP7?gbT_}3Grnajro<2wGP
z5@4ReH1(?})f(^~-L$H`GgoCP^H0o8i{lZ1X(RrmbjpYmDBue3hN1N!TSLO2A+ehI
zbv}i~7feJHZy=*w*JKf%1n0gJ9{CNgopb{E!hSs~B-7-53PCT`n}5<|#~;v=W}f`>
zRea{E#HansIOHus7tVV%7|!WI|3F-b%~E4!G=4m)Ewj#G;B}|wiP4x;h03%xAr-(j
z;!mr}COsnUP!kN@ovyLHSJp*m9b$B>=c+SE9N!N{Wx@&kP;u4}0MFbWmZ5`)@^kK_
z9DzeXMbCl!<6z143-&+cc)j5@DyT{Z4)_RNtV+3&gAW3`lc6`7@gmv#l8F<p&<Pt+
zns0L<aDh?s`cKPvM#;LDCL2`!1z<i%dLZkKG3OeHIAN71MHy|UlJks{%yAm9M<&;D
zr)|YUGJ#1-iXjamdR5CR&>A`8oeVuLg!#iN4h*&(q{-ieh*ZENQ?4{Kf46b7U0I>_
z=F1-Kz}yYikbnkWsPQ%eq;o>Dq?V8vvKO+$7Di???VhCTtvTI96{<)=1vvPTx!=lS
zdcc_{#3Wg8k}Y9s5esxQphXW+hNBaN$!JmX3jZss_WFV%W`s{r%`9o8^q(;WWZ;Nk
zsA1ZmGfUS3EwsyGD<`qrc#Vw>Ubxu#7@2-webn8hEZ^Pez_!QPQoMlIq&lDE<kYP4
z7)MXus&S<2+9v6^g5p2`I=qJbm9r(Tv0ZuPTvjQ7h9^}?Z(&8j6`;U2P}T=H<tTVX
z(v|c}uxrYx>iIsM+4jbHr9FM44NI#=eDyebtwU2qT;8yj_k2)gDzBQD;OM4=F$|+m
z@jlG^8m~i!PV%mh>{1hMWqsfGsTl9QHCkV$-Cw4f_*li?cwwQnLPc1$euqxbJGI9y
zcTc7n$UF4<w7>riTs&B&b^Y4AY<*lX>x!F|q&i|fE$g%yvCJE*u0$HV-NM|X*Tu;Y
z^n}4qy-O;lCSsoRDx4c)qj<=vJ~!5PeMkqff}{W}{VlcDm<ntn0Qpt7-}^J~P?fC)
z9nB2eGVA;QmUZ-Mb}5ur{pHR3?#%I$ujgu|%XWWX%c<S~b51^3;(Fbkzd`t&@^a*h
zOOC~HV-xqaCKY7Fc(^e^1V0|Ac<oyh%7A_uF{mBNaQ~R(YaQ4_dOED(jd{!U^js<d
z^89+r)^D{zpjD!!EMF^_MYdp}y{}g-RTbCeik#8U8id_HpSDgU3fcYrVYck-ya;7M
zHvxLSZd;5<ST|C4)!Esl5hnqk&vlAPKw^t;kA4(8Iy>UY6#)>ZkmXosIfa9Ne{ayi
z=^V^ksS`Bb3=NRBth9cbx{=D3^UeXFh9O7=?dAH&bUc`t<yMI8ch@@KLhdpNX>E%^
z4mvCLU=qrbZ3b;r_*lR#S3)RBXC}Nyp!5rVzk&EgZqpTn!WtSSPONP6hA(3sMF8cx
zWXU2?YWYSxNTx~Fok|JsO9btv47#sE$@jqtK>ZG-K7eTR%{MM$g?9;7#{C5R4CE7Z
z%z~P6&#r>qtJ%@RmZ~F*SzoodvjY|D4!@$%HmJe?Yq<YO-9e3;0Yl<%8JmQf4~Z!T
zY}nW7MV!(m?h}WU(Fw}IO1;vpIVRr-35uxSiG%YDF#m8D+=arggT5;gt)6=kslcoZ
zKPQ_eJFxnS?t8HNih${~8FvAXsJd0)zXHS{K`<&wJ%A#w+204#ICJQgU<n87es6%m
z{n>YPA1+YCLbF%U+;b<=4n=wAwyh1CjBo(`PLcz{f`^NP29qhT!#wrw`*FbqkAiny
zKx3izt=2yaY8}`$Oh@TD&L-3eqAV%>-J2a27+m>nr%BKc@hgywj;#@J@`|Q1Sr%8R
zLJ6lHO0BQ<JaM;Lb8ue1RrREOnw~Gfp4kQD9u~hnjNC0uh;}4jxj29|C@@gdL<GF+
zw}L!`Sozzls6=vpe4J4LFa$i_pVmP0aR}DuY2~S<og!lcz_uhvB+A7sa))U>30Mwp
zjTPPR4^sd+vjT~9Mq>s*sS|=YD>%D4vyeN97Q5!<=X7oU;4o5B?2j*0@j+B^Q5*1}
zT(tB(6Me@gWSW0&`@{lF6LG%(SDgRn{w$CC2lZ{J0ZII3VXgN4<l<&Aw>__LBhJhk
zE<A^O^*#s)HQ)1R>7T?)%-o%y%Z|=$*TvtB?Ya)D`A@(~Gom!OQ}lwOEk>nXP`9SD
zE<S*SSc0(lkcP26X?;anLH$}}yt`dgfIaPa{KxDkZAMWvU7TZqJgYR;q39L~G%SYZ
zk}@ml4$j^$YzEHWn;a9ceGCBPCz=wV-paq7a2%yq>6M?R(_w_iwp`WrAnvCGAzZh}
zYFSfkM*#SPU_d*aevC|q{<O)kAA84;4i2-S-K}uWpKq3`YJ&Tm-D`@0Oq3YI-HDX~
zgl@Q05@MF+|H;m}?4P}JDY{NIBh|8HXaW&;2~#FSgA2R7)hVJ>jIXkBy0!AinV8x=
ziY{x#AJtkpy|7Q}2kkZ5rA^)<!@a#zNjz;tfM`ryq9wy#)4Lz%{|d)JI^A~nmlsHX
zbMx%@9bGgEk}Fy6T2f_wYl!u#gvoES;a`w8=i&ENNtkwV=TFf;LUsR-Q0?PVDizkM
z24A7kR|ZjGz1#%hX26}V`*#`F?P>a`t>@jEc&U|99#Br)8$qkb204T3WVt-ebYZ>(
zuyODs<&HKgq;3G?wtHm<ap0gaMMN?x(Gc2#sh*E={+D{b%SJ269T-wl4WU+JSw*8Z
z=H2Mp-2L8`cJ9%xw6n(T7g@y|wSrq1h302anbdlvXW&y8idF5b&)$=hZN6^<9R0+&
zPI^1I)zN57|Ff*O*x;OAcFjlSnr^idu!9V<sy_TX6#w1*`GjXJ_XYuA7nFJ3fa8L2
zgP*i@-9^ShU;+F8e24v^@Z(2?0MTQy&N8*{E(gVvzMb9&I&qC=DB0VhHB|p6mTcUz
zJtSG%kp{C<1_Y3m5gZP=^bU5`Ulun3$&I5HH}O{e!ED{{1bu_C@c;v0=ClDwi+S-D
zoe(c9C?SF{q!LjmbgJ+jm^p<rNE_WoLehvnbQf^rIkxddPGgeuTXe?aCSgTjWuRD&
zZj=g$Z<gqObJPMPXf7JT5}`F*^4!&tl28JO_S5hPbE~|txl_e;1`xJ;R3>y6Q*L$`
z6&O=O)KlsL5_(Ngbbuq~F-%fF?K-nK-~)R;<?gQq`C*m{2oN28k<IQMl)X}p^4V>7
zBK@IW)=$$@41Sk#0$IV((+mxK`6i^$MZWBfgG##2OJ5XK+3~SGztK{CEhUSAFJDXp
z=p_P$6VDx0blg?ENUBMI9|>IU{8(JJ$qmKXTsv-5ujZpH7(mZsy1Igo_)%77GvoxP
z!kX7G80qU$MNZD~7m=(7SU)Qi{_is{GOpA$=Fo&8p6PN^C{0!)@OiGPdb_EFUAvEd
z(Sr;FHs~q&c+|ZXLlCO2Gue@krDQ3#Wf)Lq+j=9Sb)p)r!yoX|&P{j_VP+RQP@Ou=
z-2i7o8+oKtV8CK55uUJBJ%X?jL;XmnbiEe^K1W(uo*`M(@VuuS3vhm_7+b(?+%`0N
zjy{D|jyy?TZ%}teY2$Ac_WE^wN%l<HIcg-sTRM=2V8Z&{s?!lR!E`bSMpZ<8HkGdw
zIsSVa0+}V8f6#(7g~qAdB#RwnAaA~8@|R|n0#5IXaDXt%sNhGLaF~PoPmJ6kJXtBH
zPf|wvg-hwRS%9HsjQ%breDg<IGVr;#P=c*<BY#gw)gxRGPeap1xusqMWTumM>{~ka
zqhf60C(b@5+oX48j~#*`PjG<|uuSBv#E(PTi8)7%G9r|7p8J>j3}r22-${{hyn@o)
zBPe#X8h|xv&Itlbhtw{kbP>XqC$lACqD^2N>N7&U+^!=d#v1NtMj42b_;=|4x(wMs
z_UTKaOvr)Ouibe*pvVaShKyX)wcU?rT~rBf%ASN)$)h#%UzEX&#A1^&&r%DhD^~vv
zG~4(`%w;E!HEso{N4n}zis&<=zdkRnhn{7-c<N5euSrZNbcV!-8=eClZ)|F+rypk5
zNtbl~slV=)1iAkN)9Iw%xrS=ZhYF?WkxoP*YZH$}-DCxC%60`KZPZnx7~v8U<^XM6
zIs@)n6K#0*+=vg}2R>lyrv2fJFHkXc5cRy_eP`ihB}Nf`aklB2AM_QlAIH3<Ace28
z``j;F+{IX2$+&<eZSVMt-zbl0Q1h?f+oEG>;Q<!js#ti8<d(+~lL8kA=@MzHDetjf
zy9B1k(DWoq3S%qGA}TxW=XxJJ(`ePCD>I4uc~2}U*q-IE&A&|r-M`^m^#}MKugq8&
z9qsB&!Y|--Fc2LJ!qNT^uxjmw@j5<Hc6AG`{}Yv3Q1<gvt*STEF)imKkIkpPoo1!(
zPGK<iC^bV(^0mUrEjIabzIToZO4*7d54<N=Bwo?(@>R7beu_h@xxkKKD|IXXS@!G#
zNekE=I9Rlh$mzLD<%~r^a>SgnKVo&-QYl~v@;%cN{RnONr{hL1#ku}k_0RWF1|uDj
z;f}>}4XYgb{9G|h>?>(_*@(jWYh#v(iH?8QUyYl9Q@_gHm;b$X-)S9>;Eyds7ovm-
zRpV0pm8yBBSD`Ag{-tWk*cu%o!Uqqp5HX-bJC>#q$_XTY0$kmH-An!1XSddOu{M+T
zsZJ-=xW+CkqcZ^AYJx<4N;nsw73B0%%5^Hz=BN2ws7BeGRQ#vjsIe2KC6=N;yBc$P
zv+14Dp-0rK(gmfuE8XlN{i;gn6bi1hg!rXRi}qo6;V)aSZ1cX3@-6F|?wQ;?NEV>e
z00u^n&pTEa<%IShpq&ii^#l|Za&@B^Wu_m-1>sl31rCNe#jgf4FbD)*@dg=7!OUY$
z1h+g7w45*m5h+RmfG@D}%r6OG&#*Mck}z}IVUtR4Dz$m76v3rbo2&>|5iA@iYz_Ti
z&8PZAQ}{D5ABM9q8;xujOt?B(7A62%HmK);zR}GEw?QVk>kr(=+@I#~IKhMOIHYtD
z5@Gvg^ux&j3d(9-zpg-Erwm(!o@Ao}9V$kiISvNAA0RbwbhqV>s$ilQ${=(iSNKiP
zay?&00p|aL%|Bf8hbGt$*UT>Y|8vdCGdKq0RwCX21Ay5I{2ouwOrS_%)5}2zFqG3-
zw*l&0Oz1IaIdNKTbvGMPpLv$vFtyPE#HLP?on-u5qv51_e&BW~IIPTQyj9j+>^A<*
zVvTLCb)@SgR=SY>hCLw{BM_LBvKTsXb^z?z!Ort1l~3W6CegDYk5}l#PImLCySp?3
ztDXeFgX`HX*Cg5*5>?M+)tP?h9&hE5lS@^vm?Y8?iA}1exfbc|M;(#$VI%ger?EBq
z;eA0h_sO+nPl}UVq-v7NUXp&V9?7e2V1!jH<hi;f14*e_qk5qLHG<xXJ00QEUsQ0&
z(EW9@lNB@UJz0(}(Yi2Ut$OG<>g=iA3t&x$od8Dy<mJ2XEz|xuR6Hr{AxYvjhyM!q
zd2`2?^seoL94T`U*~K$(dCwmscoSzL`K)#Dsl$u^k)R#WT!Is;6~u(!FOo?zNH}y4
z#J5@+w7xtmysPqwS~PEVS_blZ86=j3c+~$#bfd>)(QzS=6fhc_;{%UOQ%$uqS{u56
zOOK&!;VOlDM?YQ{mq#^Ob6^V(qy-5Jlo>b37yHKP$~l-OC470YIYO~WH(`1DI>L(h
zdl@KtuPs&l#*`afLmY<z6WM@nEJAX~CJBT@f(}L`Z#-ci-l@@lv0rKH0>gHM<y_xp
z`l3cYz0m^_9q^<o=_gBfY{EKsDagS$X;PgLl>fQd>fa<yttLp-K<)AC*hT=Fiu#od
zT!HQmMGaBv^zK5L8!z27+{CqP|M6e01zpiFmS4J=p@a;DZV^jS=`Z^IpiBddBaQa^
zJ)Bz^XMCX)ficcxhE-IS9|_3y<>JE&cM8P-k&9C~4A6EALe9ZNrWA#rs|1_y9Kflt
zX{g@q7NqkifF9KDOZxBbV?FnA^ycS%bQixftp9%C(UJM}s%OLv_$1i;y7STcBJ7os
zJc-`{WMMjG>BoM*>M4%Le82wF<Br~M3Ah2fd>_4WFmL|+)e;*!?_od{KMMHtPusq|
zq>D{529R+q5%#9@oX77tFpzq`joz5DN0XKse;s%v-3j<ZF0KjqBeH(QcSH>Q{Puu{
zgISho?GMTuBn$m<@S+7Hf}8jnzhl(=b;t9~BJ<$oj_7`=v*{E(er4k-+F>3p`p__l
zkEo-{$}}H@gbVCJ1q=N$y<9bNLgBfx?|d=?P;qwgTT4AYKeE%HCN@8B`@`VC!(jg>
zGbT;Ts9X64WM#{;YsBaYyT}H<r3Sc6?YYj+uzg<hSdBz7z6*Vi^H2>WI!WX2$rpKa
zfA+qJb6P3tu5F?i6fz`PPHabYO02s}nP?%+OL*5m@KyHUu+K>0h}=y2yTOt2f%7(2
zK;*P(scR*DHe+hTzYfXu9L&_J_lmkEuCHn7>RHI<ZJxy(-VD8~1Bri+gMK)t;)Y5q
zgA9v&w#ed*CywwNX=fW##635>0q?JsnGtE?aHVb)1NRf<fvW7VYllfw=3TChI^ak2
z?eO$6xQd;W0Sjy4al{#6XUgUqnilNCfHZku*{-=h?q<C6)1hVdwQzoGIHUfQl2G!?
z=?nMRM5#f?k~;N>R}(2E9(8uzgRn@<3>WGKqs#|8QO0>X3h>{NY@hbSKm0O>)o4wL
zl{?9_{$V0z0v`wlE%dC5<4<KlpfJEzjQ1I!<excX5(d%$J>|(l&9JxY^VzVI-scTT
z1c?1Lsj-s1V8Jh!GF`T5$5+tre36#b_5A_(+9{jPH*8Q=Hz1qgG-{WdoOBB_T=q}<
zW2MBcx!TEw!Q5uBoZY@15gUsqp~2e|>c=~&JaLqkX4qv*DR`@uVy=XI)YTXqEsJcq
zq|=cRjc5wg!sd`6%#R*&JIB#vwcgVY0zkAevNVbI!h@WGZ8W#^-aQ*?;<HIuPOa$~
z(5?%EzK~G|3Ej|bokc>j6$8H9_u8_E!5V_Wp_Rb7k8}vx=)&78jXcyKNj+Uy5T&8O
zCK7g5Pb*X2;nNy@cP2w0BiAVZi^u;ItKFb&G9~>gOJ`gAOEHzNU`YiYA}~H0HGSI$
z5{t#0q>w<HpnV`b!uswIez6mQ&d^|cR+L`h1RI@%Rv}6Zu38MMxd7sA@$7`Owu|`h
zdODTwPtHL9(#1`|*hQ|<m3idFDiT(vpW~Ic5Ybot$EOU+Vl+mfsB1TKuFhr8VDzD=
zAC2Jx5Xn!*mIvBwau9*VQKDE`S&!^-2i6mZg@;Sx3FIo2kdSPg=R~F5qK32PUQk=s
zt|tA{n!E=6y&lHm=K1pX&kPfYI9{^hs3X-}r85Ai0Z%sLV3qe#ch>6|1nBk1<7FSV
z^#Cj#+G;M>y`9Pw)lyl*cr5#mTQ|11Npch};7)3lf)BfX`|r>H1YYq4*4`8l{VZ~}
zf;l(8BQF-&+oRaCUNnc<o7-0P`V?9t>ie<ZzG$W<Ok<Toi&v^oh0q=?1lrCW@Kko1
zOanL|i(XAj15qp3?B)@26Omd`+1`Mx!X94PWLU)L_e~!@pXNm6*WjbAtt<2>THI$*
zMkVHQJT+r{spS{7;ejaMCYF4%@2}E;ti8@|4@cFxG4;dSe^;CdRnoO3Gd<Hf6KUwX
zST6*95^b(Y(8Buz?9m|RivLk3=47a|xd70!MsffZdOBx>WGGG5l`dl#ODVa$*NsTg
z&E81E=GJ_u2%`^XEl|B>E}xnQU75@5kfvrsqE-_CO<d5ANC6Uj)vC%5Ez*`$kFu&L
zlSy=b^FyIl^LDLd?Cp>}Vy$4iG$0~Wo-OWinq@~u^Gi3i!W*2VVRU;|0_n~O#sN5H
z5)f#2OX`=XKA?^1kA=`4@x~K@G(ee7+%O(L%7Za>I(XHUUu3+h2heZ0HlB3i@o*P1
zaPX$%C~&cX);Q?t{Q13sT**;j-dQGFUD3o>NpMIT&?p8{#BvK=Y5dKAl`IM!T}Mj6
z4g);Q1{qu5fO@7Kfku|?xC&wO_Z)x<G=iYs<jPlP6IW;w`$6zy5;K~8^t(L6S^lTU
z!S_B@*Z{7l**dv&tv$J*2%%nYbTQ4oaZ+H9x&sR(WGp^f+_)b1#6e#Bv!?J#Kk8pE
z-1-kyu{{R5m#)S0<ANJt5cT?RG8`}Ut}+lPQrb*#1|cl_@WF7D!Lk&0EdampXF$lv
z7*=aVGDh_4Vr3g!iX$oX0avXO&z63cHE`dg7sc-Hra_>A)bNUyA-}tgGht?sYgF$U
z8o6?dgnfFYo{Q62Mt>eXc5jisgW#~|b=b4DLZ2|c0v`j|E!>@hCi^^J9(wDmFU+TP
zH?D#i$PNbFmn-?nh4+a`6hPeMUEJt126p*A@w^9O)aYn>@yggL7VJqO`mb3L1=bz_
zu-NJ;zXE&-*Cu#4ZSkg)-V25bMC!vzzN4ppz6F@#{RrsKHp(>LDC4RptoX9MneGc=
z^zelTP*4b!{J}2Ek9Df5%|T~<KK5X&y9oLfcGCHREKgXPLIZ#g7{J_qyO5SN@&~Wf
z#Z}o4TfGO3<CDfR?=-s@g3CDL39r3ON3QJ+sxnaJrFzegUf)^CP++q*-dTof^W7N)
z_JFg6FyGY@DhMs(srcui@iFPwg;?54Rarh^P_h+1(5rLy_x#Hq7<S^zKFF-<OFm0K
z%Ae~t6{c5ZsNm3m6Mz`v3LGt|+jp5omeLFWY)gL~lX$z&76=UkGV0%jhI=_h2OmB!
z>L-PUcWjm*&;dWfPVs*I@VW(MF&xcTu>M-`opk*f&JWEvGeHoek+(+9hgJWG-O}%Q
zRL!{5?`bA5D9{HTzrTqeqw&o8Iq2-a*&?H`?0Gcz>tf0oz`J6`|5p~p7*>-4RK~>-
zNpor56(fw7(-t>PftBSS4h5a!jbXp@D{c%o!U`O`O^=n~WDDM<lgJ<fGnO0Qh~7S8
z8SS6!x`?Ykh?D4473F&{WLx1|(&ZDi)9T!Bm^JF$JB+N_R+MLE%_QPoELv8WOqw-x
zc%Z?<6Z_TWfX0x#Toy|vO)gn5HzrLjyrO=?qn~K|4NF%l;2~&#<h($J8k5j}mt-mZ
zx<^baPlge{YA*i^n^^rPY&2^H3p2zp%~{!3Jh;YpxOKybr)A7@!-&@WJwn4K38!m>
zFwGC_FC(s>i(V`v+)j^4>a3jX*YI@c;2Omu)5U`z5dhDc)xCJaC$$K<7P~(@2NFAP
z@~&47&r*vkDz1KC;}I%8>Z}DP)K!9W`dq@LfamtP_*2t;_0<PX;KU49=JBZ>&M28A
zYyWlNOp~e>cq+RemdWdhTpXvOAqm9Zbl<fljd4kQ|42jxcmR>5xIcC%(=-wRpBN=&
z?zz1D2w(!iV&Wl3)-x_>1AAQTH#<}Z18rtP&`tn0aY$AX*`$4FrV3lG5D<IBI{U2H
zlvR)=&S;M8G2Xn4a+mG1g1Gxv0vc~zF|-1e#Lt8-t;ETZ-GIZKLhK5LDo<<bA)9J`
z?w+*X7@~W0-vrE@2CA@U(=%V^NVsXo5f%)08~_HMuvu|(GUCZ;(kLqvVW%)sK<wfq
zSrOUDn=gc1K+i3m0xI)0B_-9=LS;k91PY2sTFA~&dqz~B4jei!u~gzuY%-#Cv#>L)
zW_M~O9AqX`2a7Gc8HzN*4y9H#5KIRoHJHfrM+5t2wDS5wAn34NTspKxtGPJ=r7GCy
z0KA?H*;^YdEUf4CE?Myv8+VVGdoO;K!pAE9lcE9NP55TYPNGZwEQ3%bIO0wVD}BQs
zU<~KF=iAeTLVPc4=uOi!WuzQhBt(w*hnLL|=NgKeKn@H$F<z^XW{^s{<*XmEP^;*1
znIG(kpp_)e$g4uF)%tdfn>Y)zlePo~R2N@=$UL&nM$;96N0A*gTE^<aKA1|QkiZ%2
zJ+O_RsN^lf1`auSqe^tF!%vGhxJnn15l%Ml&ZX4UNYW=Y={ct!x_Cp&eQe;>K<pfH
zq0zorIsLebXXKT~KI6SooG3=qD2=jyxx>zInvzKc`g?wh*C3#bTE`Of%AjHZ`k|7r
z=zxqOVN66>7#WP*l)XTX#72^(oVai_n2*0OZM(EE^dy)WM@3{UQog@0yCdB<#nb5D
zY3DCB=*zf+hj_=z{-_pRE!eFsEGxF!YiVC+Bn*+GNP<cxow;wheeeC-`$%e+7d4#9
zEFnYq0evNjkWfiLELJV@St!i_e}yq6ob=f)KGGd5cKl>|d19k|`IF0&v~xmdv>-LS
zFJ3lG-nZIEn{W8>^HPs$Jl%bLy}Z2GYGLpjZN2G~c^TuXZ9PWW#(&~8>KH9^vV9%x
zvPZZ$cHF|Nvl$>~^Wa_Z^98m+u1=@LOw<+0)dT&Lmz+f81nvZOKI9JwgW}Fskcw)~
z96M4%E^i>(1r9J?q~q!BFX%EE<YEst>CjMpaa`uxJR=C}*>m4<Y&ZFRjaA33j!4*q
z2qK9t|3)T1%<7t^N7D4zTGft9S0kDmLYF;rZ;OMuZ+_4cFL#4A64s2CZUG`9ajWGX
zDfQi|wgD+3;7G#Bz`6-|EG9^6c~PY_7FO10VnLmq`))b(0PWX4c@L0<l}z<c20!gT
zZ@x5ngI~5mT&dmPp@R!;utrNp+m5h)^mKKE_lo$%^X}k;yvP|jIgBA>D(=jJUOEQ&
zyKv|u%mHK1R81D&`iX+M^UY2<{$YE-ib<9^IU#q#eQ;hHo8kb_1qpo66h`RjDe<w}
zTQ(Cn%?JyGmt^``X+J>RY-g(~P~foLbZfn%>bWJbVZt+eU;w_?keoh~lt#pge(OY6
zrQ1<~6ghFpgX)!Y*Z8hHEs9`~F~%sUotgNFcTOKSr;tily&!1J56PuAZkNfuNc6$v
zE1;D&sqIGCf<_1E)r<__ttJzrJnaQcNpUMc+1>#BRkm_4l0k9<cIof2u-=9W?X?P@
zm2jIB?#Js@oZVje^P-B#7T2)&Qcr!>8vL)x371>H<;|;U0m<k`m1zyCBIku(Rm&kF
zYmM#)xsCyY$W_c=<walwey&0M1Qpm7C)fC(XVCy&tYW|lmjvY)UT{I`K)sndQ&K{g
zwUzV?ID;s`pi8a$?}#zpz%=;RtR)jjE3Yz&_Q3OA+}M$;Yg#W#h6Py&Il6TrxZ;1|
z8i+N?y`2QPt^TeX-1pcLy=jiF-*>cO!;2IXB?O(_cBk3icVdtRl$zZm7b{w18gc>6
z-(W31_hNu@!Qrb*0e|ee2J74Fui*NRTWkpg?4`-!56>|9f)B#&o(0_38?tb?zbo3H
zxum;;8yXdLHCgZu8@88A^&7dEuPB$jTSCYJcC`Dm9}e3F%<9X3?VfsZC%|iyXnd<_
zN<Vnjix>FTZMkCrJ86B|S(y3dWLhcAv@M}dDsKRmyeLefPu*03!?i~_a&(zU&b+90
zvaKA8*L7lL+Ed^Dq^3J$s>W)A-GZ1&(OA3m)q@@xrQW>So+x(v)h_><Cn1ue`}N!{
z==061s#cvdzJ_U@;@gc~3mBLM_*}-1eW`O>)vxEe>(qBA?7bFP%)u1h;UCdDTzBnB
z{s17Qi?N};h~WPM*f#uy0pe<%#8}r&)=pp{BeT#s{;cI(ZA)Djw*bn**bF~;lfS|&
ze!0hCXZ2bTlrwAGa)i|N5XIM;ao`hUIO-~Uxw_O(>;Z-VI?4g%WJ_xdiMX8Nva!v6
zfkBTUU{MOBauUD$Ys<Plp=bHLn!&T{hkp4cVi<O%)%sc~L3>k=10IKWy}#Q<aX)2U
zWcqr9FS<YM+Z`Zn7Ur$?ue|1!X;$?Wf#wPKlHy94y0`eY#%jCr+VSO0m?GUtiwZp4
zNLr~4FbtJKQCP6J4ZTs1D59hP(E?`aOx#Pqd(aGF{KT6>0LAMaywNguvDdfx`~U*q
zm3E@N)@_x?ci}_K#@{LUJPaM@drr&CCS26NoF>$Jv(tXVqNU>xE^`xBKlhX-r;XO!
z|Bfrwk?U|Q!GuS*AcNFNb+@X!jVK&Z)2swvkJMJ%aDI*L4*|r%R(2G~l$O`rFUOjF
zQ~*sX<jCX1Z`~!eUqgAC@Aj78Xad-ix2b@8#OE(Ub2M&I50Q;_%@`sdGy7cCznG_*
z(A+D$ty)RF)23h@^QZ{5{W`$nb6j_ZqY}(xU>vz60V)h64QN%up_f|n6Rfw3xyVN|
z5yw(N47;@SeI{FH_D+wFBg&d5DrskC;Z$9}eXEHI_zBbxv)e30S08<Gc>saPdwtKc
zmq`)e?8pNTZ+;YPNh-~k>0#r-1(9xCF<)id%fy;iHX@E@FZlgDm-(Pi+DfUgb$r=s
z*{*?Y*SDmP_89pxy2BvD)alPA6~dhe;5UL8SeY}Dyi)Ob+n)b6fgH-xa$G43S%n0l
zx^$45bwo0-L*6JNR00jrcmO}l7?u-mcGwMf*dDAoTt~}#h$wvJN{>(JcFKVsANBG)
zB4PadMTtGV-3~rJy%UUhMq93Rcd;2xd2F)T(yL0@p>@3UdR~?~xhc!q{@vP^O=Gb{
z#Y0S04f8>pt;?;UT|AFa3m?1*SFbl7*J_it8F?po)P>dG&^_?UYJl~2Rds8rLgw9<
z2S)iRulyVInA=(x8W%TN@_2;_;bqpR_LepmK~h9e<lt8~GmAIGusK}GYJuF-@)o`<
ztIs;3!(`NJ=4qNF0~8PG8v+{;WYcDz)<9jJ!LZmb$v0v5rdKM^2U=mV1?yY&=9o$f
z>(JlrMegQe3GWhS<$z>5aGqgrTgJz;vXR<Z2KlA?OcXi-dvE!Tc-skH+swr1+%cmJ
z#hn3vBy1s5ovG3n?PGNV7fXnF-2|6By)r$nk1e{$Ni~uI7_iD9YiY(?EGvTwWlVDN
z)7t3%>uu$R^9MQ%L|wFJy!2IKWKKuhApCq4Jgl;CKGFtJQ@}^h!RCh>tm3+s`qV?7
zx#v2v<cf4#sP3vOa8qU*IMh-j*ATVLv2IJ>ENfCabF@XkRX6RVmqo37`7?VYswi=P
zAny7q@zSu6A=fJWV1QQ~J%~j&{L5eUFu!bC6Tsmb%a^S7jH+cCFBB}8#2!L8L8=hM
z6Llv>c3XayD<C9q1xIDL22M?Z75bTidO~^LijyH_ijgx*W)K|8V*!fd4=E-ODK(0Q
ztR!ubATPrNr<vJSQq67!r0K_H)s%I{dM#0I)+lbn;%M+}5Y727H37em*Ia#>tfuyI
z*<~}f5MvL%F@Ia{IXVn!_)ggJj_v7YO<v8+^#<W{D8LBQL18pLk0W!VE-GY5R-p(d
zVv)obxN@NWCxmlM8eE$s(?aDk|Mo}BK2P2*evl)5c5VS@9D)JH&P7`FB;|RFAR%HE
z&pWhWfgf)GXWz{5#P8;3-H`3Era@#6fjG{u0tJpm_^B}`Up!?ULrO<KJWjU00mO<)
z(pmB;e89k_1LJ3Tl#52W@zETB&gfd*P@+wO{*q;-A0ZM9L2B1z<2a7cJLQjS?xYRS
z_L2bT?Xh|QM^;q;8F$e?2Q|;H9n;@EOFcx=0FD;;->)m8Z!$L~21Fo-us~drz}&y`
z4%f(ehq+htC;YI-$7V<$yUN5Yi%h{qLp(@^ssWzr!!C-DG7p@XHL@57Q7S|r0+>qk
zdyyr2Kz#XRCv(k}BsxHpnIWGQNDfd@VMI1SJprere{@-a(Iie8gA%>w4dLd{B+)Ab
zwP+5GCg2iVexrHuToQ0=5v2(ZdByFc>6v#-A-bhaKfq9`TEg~-@2N@>a|sG==nowU
z-vb0oI(t}IvLjWoUH4$7`gQN<PoXEAMP0C))}bTgjvObj64(@MA`;M^_A8^(7@E9h
zhMLv<63Sw|@}gU0F(hG-7PvYfYVJtJkMa2Or(J)QN`i?ZFw7NpJ^8XP-Z@E}nnf}k
zkO{GT>2H|+R;)l^(71Qmg0}lor0Rf^qydm+NdCjejL=QsOaw^&4cA5b*ORT^6D%bu
z=DZ}^KQjeRn_lcq%U2hKsf9EAhL(tSeBRErnocu@C3Hfq*=qfoA|6+%k@bUAIQu<g
zoJj8j<3s8*154(`x0p*>ZXeLRhrCCurb_OeR)boq=D&d0h6bJ~&j{neEcV4g;Q{cn
z@`C^Mu?t6Y$IQDKbs=ic+u1qoI?s>tXf_^2x(_n#oNHFfr(ED8oNC&CbHsMm80(Aw
zF;ZEwJ~I~fhF2XCL=PyP@-m#&S*vM*w+8>9=LY`OgVY-&b9hVNk@71qDXFC<L~&XM
ze@Jb>;^_7&vGZrM2;#eZl3vtjgBk#2!MOXd7~{v4iZR!A6mY(7U=~AmHBpMbe>*6H
zApMyyKoH~4%pW^)%9d@<VCIjr%vwm3E1VDlG<PhjTPOhF<@}8IB%AI14gkH4k6PJ}
z|1J7m7(XBYgY=O(Cl)0Z_$3mg@_ovb@Tru@{HetH>yvrBNs8o)s2TecAPw-JT@Wxg
zWhNabR6BaWrYwCu5I%Hz45wgz13gV(XwLa&jvXTuJS0(|fq34hOFw`hYtXGCM2u@{
z8HB&PEBHBO-N<(RE*k~6&&yrKVxPLa6(*li>fk86;ca1_(@-{#p>C=&H{h*OZ0tmK
z1Zu8cClN*?Rqqa&M0?0HbO0P)e-0{k&bIF|mwm);aL!A&FEr89x2$g&Ag!*iEPq!s
z1lRUwxP8Ag8(raNcopAH`319iP|9pE8oE3YJ&!3i8{8gGFDzbW%3IAk&iK7r)=Q!H
zNCcd?4e&Z3U3x7h%x=h`_bhVn2%tSe02lg%hhDQLbPJ2Vz@lxn;sR*@O?Zgh@Z=Bk
z(D<o>6&~CnWd}iBVlfP|?IN2CYo?hnd(S3n&|b32Aak<}{tiletaY{K)+qj(cTt_<
z!la(_jA9;}ukvJPjLs0@)Z!<XTFLm8R*|MoC10wbKF?wJm36d6hB<7}XRGHSbcG&Y
z%qO!1t%W73`I~nr?gGFn3(wIv1gD1_62v6JE9@fNz4Q)S(}sXI!k65~U*+F!%Omj=
z7v(d`)g$F`gSJ`F^Mb$M%WG9>r@&8N?VW8R$PE$0h#~EyLH<EZB@8LXCUed|B(iC-
zX50=1BUf~@4%~{}&-TdaPM5r!;1t%K03j-h@C)>XKn4?V!vn~kBlbP)Z|@s7j^XbD
zFk6Sj{O~SdhcHXt@{OdJ<cSnXA{AgkJLI^{M!c*sVHBJG=2*J~s1Zqc<P*)vFU90f
zKFRZkoqw^qh)Yzb&jlmUM=pxjsXN!i!YkZAq?lINNAp`)CWK&}k%LFe-NE<kD#XRS
zs70e>A;aL0JpeNDec>;RBd3&#W*CZhh+cFjxG}k0eK@=O;xo^rk3!EF$21~H-*h~c
z<m_fP@#W|MALhxv-e2K^m}W{L%LTC5I({A@Y;P<tN%OoDF>~m|aUuPUs9wkjvJ+0G
z8$E-591S(M$P<>`|EM|SEW*#_peKi%A2AYi9!@2%r2wl$$~@hfOpp*BXZF{)8@(C2
zF9J>KODw<91(CRYeN^=bW80(sWuQLajfR!BHZ@6^2aY`M@pH!dPLI7h=cYZl|E<{O
z0X)A!a>qE5#d0dD%<yS#ZbFGJV6+2A)KV8-Z2B^d)+W&G?4gLmJSa^fo(^P4TqspF
z^)2^<bpXMM^QEU?IV&+K;Q^|(+>i7uu}*FW2Z6w0FYjWf!o~CFHiU?I*y8Y7Y8S28
z|C)gRrBecyeRf;cL6!aM|8VLPZ{AQP^8so3($*&VJ0^|#D$w%G?cA81SH;@56U1z`
zgXxRhetDm**+_k--8cJeIQ@<%w%VA1-`>>qp9Dag68>R<Bpkyx6EpWAgNsG_Q|Dkv
ziNcQ{I@BN~a{d~3k<H#Q+NnDktQQE5xFI;Pe5Rs(t~a@~8K*6jZlOgSj7cm29h44~
zW<0>9>8X@tb^<QF?*jdQ0JA_$zvI*mjvD}-G%FKyDUt*$G@L{%qC>?!My9hwK>S{<
z>@>Bg2o;$Gf8|sZ=jzWE``f#!*hn^Vd6pp#>73$Ji8+!zC%Yt<WP$#x4+;4%4Rt$0
zuk&~Uv}!U4s1uwlrxDcADx3#^drfRlQ@g54_5zZJaDf(5(6~(NR_f>*7<~O?mD{Fz
zW5A6LP0#XpO7cZ*T+id;{2QpRdZ0q>zyp!Q9ZIw&e?f_u#AOUPs0Mb}pc$nyc$Uo*
z4w@}f*hRrR^lYR6C?Ici+BS%E4TAEGPD)gW?m#=!{$JHF$5qP+0MK#_O}7;|68Q1t
zOz2!*U{R1y^CR@5NavvJwh~G4OcXK~6U!2=bnv1iQKWn&I+i%A0h%4S<z2x#N@&b}
zvE{_Ee+=qISVY{y4ks=q)G@IcT83>#o+Y^X2({nVN!Xleu!`uSd-!SK(&@{0Z(cqB
zU+CxOKYiam+76$Wpuq@H{POAORGoi7VuOy+hc`cuv>iwvAM(V31)JrQCxzVlu)Jo{
z1ST^cX@yyXaz|A@GK5i@>0<)N0LNu#S-y;`f80&)uGMZ>O>ZTn@8mv$`f9vhcA1{)
ziE06`+7ntS=<?dBj1d43ytE~}RFmC-bDpk(Vk)HMTfyR4EYece^<1rkHg>WBPqwuF
zx2N4We1L@gT8Q%S?dcd<hS5TIRyftW=j9sjVk)UO1Uf-)kLthHm`QZaoxwjZB_?kP
ze>K^zxrF&6>7v<x-QKM+p~!Z08>&as3oNc?@HtV<_Bz~}6p^o56wk}@2zI(Q5-CpS
z_Uu7{*1@nm*&<(w$W^!63v0s^io9Dd9B;ZKtzLCuyv^<h5VjiNniB1n>#FOgwgPKA
zUDIbFyx>CFgLbH)6PtY4zTe16BPdpgfAZHeQv510<Y{@>91Yd`InAchEcCh-yt>t|
z3U7v`_$DDtLV~-V+%ftAGAF(R3x03ejnOO8+#y%X3sSw8s%K+8H!G&=ElJO-DXS*%
zWY;+{s*1bMz%6r(tR+}!-5@F0xHEW2<)%u*{zInGx1H%_q}Mxw(bWdBYOr-Fe|>hg
z3cyX(zPzY@t)3{5>P2I5Q-8yK`3?|FwY*!u61WF1p}AGPlEGT{P_1?CwQ>*4b-CcT
zXst8t!CE(1>+Z9)PO7*&xf!&E%T4C+$fuZ7!^aMD7^ciOF^_oQSvKRov4y*4{mr$8
z(MO!zwaf0X6k7gRXdX;%+O}hwe>kKr!;atr2d-gZFQ7IxEX%XRx@jJ09_pWg=HV7;
z9y$?s=-<e6_6>Te;`|rrRDh*P$0XiHVin*(?4>f1w(%Sg--UXl#o$mNqRjeZxIGgr
zj$#H7tRhRb0|1hogDp&1y^eb0(U32ZLTK<Ti_=omFBWx<^NhtL!6Kc+f2okX4bKp%
z*(7G*q96r&`F@PVm0<HSzJQ!AS(~>4fKu}~;i@l)iU`;pb?Oxfm1<EsK(ZEiT$_v~
zNUacHke`zTJOZ-GZ|Qg7c8CE$1~s(i1Olhqx2lvC%DxSwjngP6MVZf8InM<;Y`a(>
zT}+mpL$;oCQJD(WqmXT7e*_895fx{#uB$@d!$g7eL8A1}AOiB`>lZrqKO;aZP-1W<
zD7*U6Zp;X>v#pVJoI$Gc<<25163A9xs2-G=?2a13OuGwySKf{l>yacPFVQmO5HNpn
z8ke!`2L+Eu!^Y6KW?*zrkKiG8R=W^LiHNSJ<IRed>tL2=Sp?t^e@&mUc!s34QsEnO
z0deoDb83W|n4`u2&~kd!i?Fu_D~H9dR1wuGg;$bJZtSY)3T5$hwjaZSA4P@}MK%s2
zi(`j4Ar9=o#ujxQi~B(&Li*?&4q)1ZncT;!D_3FX2vmId5Mkam?Vj#x+wIh**-9HT
z@9ELfeHA=i59kMSe=gci4%B=8om~4JbLVmes*pDRtgb-1PC5_1I3uN^6nx3mmF|P>
z`@Kis%R?1d6sjxTM>W4fXQG;ZD(m60d3I?eZA)#B007?nQrP*)x}fuuUg-RCF6a|e
z2eq%RSQ{vpdbqNwI#dUW10N1=;`2|eUD|2pcVz?Ww%`Cpe{O2Fcd2=KIc}dU$>3YH
z;;astZ$;JXF!`OMvmY%Z?+{-9g~E=982fD#HpJL}{TTb3gr-AY$L*o%U)vf9U#6W7
zy?aZGD{Mas9q!_gGKL-75||Lr!<HM^rf1m9vVwaIcI?Upt?YOZjkcKeGL$I(o-9It
zQ8o&YR+RRpe<i>!ePWYsLWamgkQ87F2?Fj#U>pSDT2W9=Nq(*a&t!ZDkn%OjDeqE3
zO1b3s4}v$s(C{OdVwYJ4c8D)<;BgzXAT(VYjPv0aSVx1#H)wocS>xNR=h4No{ylEO
z`A;@-06@J%F2%hx76^9z!nqXhhfuRuY`bq64mGg|e+>g-+kH%|D8iOyImEE-h%<JN
zMTB=N%)-ikTcE@42fqW!uPAU^kr6c#t8b33>Z?*l5furM^l-+{b_qm~cJ$*cZ(EVu
z5fv5ec8nw(SGiRbj`moAYca51_pS47&h0!aAugb@IZwf6ExCpp!su>XhSJ6aNB<R<
z6=e9^fAqUQ9~~Y2R|S)XEL0NwoQlh2ff;xV1eat&JyK!t0aT8f+Rj~%uNB3hZQdYO
z)eeDGA{xv<QAn=`0b4zfnRL{|1v(S+9IRgqfj3<N2DJ~MdUl7fhPOhdjX#Sg5bqBo
z!#T{Le(z&MlZ;8Wad`>cJRMg}E~en1X*nP!e_LZ0va}>j`dp?ujHMlNB4_fO$}v&D
zz+K%5Uq9ACLO`m0vzI99^2i}k;9(~eA$B6>W9ku(eUIBBvLl}p@6m~($Hz@tpX(k;
z{S#^JfrO4>-5#q02pyvh$Ick#Bt2Iyy4r!vNS-g0qgCyubs3SA(_~#Tqb?e{FW0RE
zfA*_VYf=4OM@sR!<sm=mwy--Ex&_nLHME>7w?Miamk4%LKRBa_+E@{%(F(EHJussh
zSM^fbvy<iZIQzircFL+2JwcUiyniQ-4%g&3Tmi#wlEN?Hu$x=3^p<9Rj8-j$_A4HD
zhdAyHP`};3pDljSJ4{2jyAvam@ahL)f2qA+x!d$kL;qe!XX=n7*hApx=yhdFJx#!5
zy<2sC?Y&up;5+#Z-!NF~IYi4GmKo3HG^vumSFdV>o+8sQ&~f+Oj*;2RhWN`9HK9GM
z_{oa5Q5UTN<0q?L&@WH^ezrh*#-DsTX{NuSY^eJ4<kLy7f4@A@3_9&1ouReLfBdPw
z`G%E!{Q1c`^!Z7(47*OL6)j7k{i<FsBk*q-$6l(S_k(-vsCv8%71cVq2dH<+yF5VN
z<+MC{f{O9y+!@`o^&V`EAt0nPGsEuq{JY~%*V-1&m);ip5Z3RN5kOJ)fThte?i$n4
zKy)+^9qnf^+bejAo7@k1fFn0Ff3ZV|z?3@<_6WCZVhe+;jbgbE2L8XVLf3a4|8;h2
zWr58F6Y+&CekN3KLC+CTO8bLK>&GA(LE5ra<?x*J??>WNR|ts+fx9q+oQ&}VT9PFo
zrhp1*Dz0hqaS!!gRNOXTaIb7Nh+L9fqyU~Ra}uY3`MxXQ0XYeK+H4)$e>5$^O)Mx2
zv13IPhk|l!a7su31T~KP=xnwFVEpj`#{2Mr2KQZI2*4z?60rT`(|XkRSYe`1YRZ{q
z6oNhKo2r)0q`y4rAi2Q;*38o%sLW=_G@xM9?Ey~x)vZ+b1CgLU8@qBeGKbnx7+@MP
ziXGoEaY!h|VH6o*C}`+-f6+Y_Sz5ajBnGv=dssz?wQJn*tq{MCs4_+}R9iXNA~-GD
zCjRlNNHrMTRy2V2V%NTXG*{tx751?cIEPVvV0Eqdq6(1IUT@iy>@{?RD2KW{(?EoZ
z%R(ekBT3PDa*k`cNy$};?_OHpkL$Bc=6+_`OhE<eCobcZXP0+He{Q;#uR9C_H}pdf
z`_u!uNdPv-C)jmNVNeoyj9QOQZaO}e&<^>x%qO9cx68XlC#YY$UsT@uUG_{@J-EpZ
z0;0=abJ>RNlZy)hamKJ0TEV??H$f`qilY#`?9kk$<n%m?xu_WchnU10h?rkdPV76<
zSBZ+9N<^_yKvW;#e-#mZEx-E7I<NW)VX+q|I$j$0co_?;-I^=p$iC-TO1?e6@luP8
zgIPAHi*)<&%ai5c!6%<iR={*ya(90p*6!%~%DB~c>Ba4YK-Q9TvA^edkf`fV#o+ga
ztitOS<vs9o4KCnjS_UWAXLNGyW024_47+08%nX@3?pfxJe><e#?x@&WM(EffF|bR8
zjUC~bm{1X7FLYhk@@<2&`y7{g+9gJ!^P=yP>e+W%6jr&AS_H6EiGF&Fm+uk4I-4{Y
z4brs9f>Ci)RY@ci&6VPlFTgP+;}n*7v`{k7#a*$MsEOOlRw6vdb^U;1pSX|(!47c9
z0~<#!a}9&ie@K|*(b-A{1AzJ&d`x{G(~`ov$}q5`5^wZEDHqZXn)~2O+P3ir&36#$
z?-)pJNXK_aRNdZ*JSe<3dkw?h*!nXlyz5kyT_KphWpm%6*bzR^Fqsq+;Zqz2M&O4m
zpxk%wvAX-JVg2nmPkWe#ciq@{z&&yad+fSbF}j4ae@@;h7qhJRZBEJ_BSD^aB9$dc
z^uOgK&%epj(Gl3lTUiaO_DV^K40!-$wB_?8$u5uoB189I#YK5nbl<AG`ymAa!!d|U
zFs0nZ4hvmOL*K)$XB$j70kwk1hZGpJU-dI+zt`7(Yc;ljvb?MRwpoys_Pfm?J*d9h
zcKx9Ge-5hep!(k1O!S{w_3a(UgYtW`7cnTmTYm=ScfF3Xt8(JdFd~kNSrCNS@raKD
z8W=dVgv+hKAl#<+SpEI*_LWL*BYE1o%4|h?)zyUIiCQa_32A0CL4aW|ZXN+$TC&H)
ztHK4q%PRxB36R(otysfkfu`{lO2i~C<0&AMf2*cCDs-3YE6b6}-VJ|^R7&&mOvHIB
z7gCl2kUx`&t)&wgJjOERkMc2JW_fwGkcj3|Ck%qfNC=M16@wn2wPm7nNWmjX^WX|3
zIlmA^8BY|9TA+Cvk!hU7B!`ZzNGb%NY(=`4r3oOpflpB8JJNZ0>Rx|?QUScssx(2D
ze<De+V#QmUp(=ZO3}k6{#~=`AY(HZFcOxeVJcfPd3+ym2!lA<mcD;}h%84tucyz{q
z6=4Inunos*t3ci}LC!fWt1Loi*`*2t0IIuKaP$*NAfk7S-kin7nI!FeHzU)Et#WBM
z_ckyr_huhfU2c<+!&a0#Pw%wr?4sIYe}=nz{w{?QbYea?gnQQ6=Huy1T?EX(3cuu)
z2c`W)`+=W|36x%9B!mT3jkWGXoJt;9-N>jZ*Fg74KKZo+pdX{B(q7OeD0|79M=KnB
z_kP8hCu2QjfAy^odGa!ivNg%$KjewBJ?NSI-&vfZ^El-vG35M`y@wHx5WwS?e|pp&
z$S+S|%Sg`aC!ZR7O2xcWTTwcdKmoP<)e~{l=Ji8oqyQk3D)I4Pr1!{%vhuzx343Tm
zLAd?#KwD;@=e1d;o|Aq=LT7{n6u&-x2dm68bWksiLG4`kGpL=9%_wt^XxD~tlxA9n
zaFoxvCzLcZY>9P0!)M~LeI}&Pe?Dx8o6Y@Tu75Zi0+iEXKiq8UhyAeiXK-Jwwy5vw
zx^e@;JeOhadXVZqFfb*M>Yh;B76CPdwZ)Xa{^r`i&h?8QZ00-$QGq0Xi;I}XNnC<?
zd&41gFspd`!EY`pfeGC-`~%39MDkd>xZ>jb-{vHFpKW~Rf&kq+_&C;+e~E4wSM`o0
zJrBZ~yQgD2Uf=va=~?$k%(|44byL};bh+1<1WkVCgl=GQiapy5uw&T~rh(z%&}39l
z&vFG>2jyH>_uBcWeWTXKCAZy8({|AOoRxxR+4+y~F1NX9)ElpoLkJ#krOi8tOEKM=
zZQ*M=g};?!Kyp={d_1@WfA`-r(=h(@4We?1V3s8bnHAz$^-Fc<S(>Hd8%o$Y%u5Q1
zz>+L~_OFIv+n)E$#{=m_{<c)!<Znw}w*px@z`rv|pCuwHyA`4+OG^w{LY`U1>`MQA
zDdNdl`HW@>|3<ZQc@~%A8{OeQeLVQ?r`i+r;q5EsF?toJ=jiVwe+O1t>4cJdRd(mN
z<f>oCRR@pdRMf8T_c>wbx~}3(y4ot*tX@*RapQoKuDLRgCli^3j<kx_dEvmb{W^*u
zFOu!K(z92PNR$g)#xr!OdaDWW&IHQlCCjFezE__#@Bm9<=-eRzV7TDmoGa#q@{kEW
zLX6DHx%Liz$deaPe_T0-j<#ix`#zN`;vI>EoIgePyOc*TLy5czq1)_CK(mOHs$)8{
zF^r(aApBHvQ^^8yY8uZS)KtG6Nc>hlMI;e<soIWfmwTM0N9eusK30R(O@i;frbC9S
z*>sj?)3^}NRR6%+RGvX@Kkzp~S1!R@3M6Tndclb0LdLlRe~np|qkIlt%P3CtSaMN_
zvQtPour5iSle854#<}XcpZ|HDAPPzFc8)8z1#`IP;((hGc5K7Olm`(O)Fi^SOimp0
zaXZtCc^(lailz1Z;q5C7i$D_LrCcsatoI_CiZYLxT8t`lVj^9`z-t$0{763C6mI8^
zljZk01W*~ze`+uGRC#y7v7X1k*eVV?p5E)YZk4}zp2nFx<_={Wl`j@{eYtoa&y-jE
z!`oN-IemzJJXlUC++<2aweR~>lq61|?;mTcyMiCUNbAbR=yeXhaZ_>G9d@0>`!^*I
z>v!s~j?>!N+caeD-q30X@s=S%3Mxf{E<YSi!}i_{e>cAH)os?nm5sN!)t)ozruBlW
zq)OIR`Rrwj<Eqxdg}mN{94EVYjbyn!`H^LkvlqLch-)aNc6)(KPOTk`x4W1(4hjL<
z9?2Is9LXLo>+U$LeV*CdH@9a3mnBEu?OE`y863ZNX#91YZc4Y6s6N5sDM|LpkaIKd
z!fg>)f9<x|`}*@v52>_=2hlu9?tW%=5IuJ~^!Bl5>}}OpW81jl<S1F0`lcON%*V`#
zeC$La$04^&EDRFRD0B@cy3f4rJyo&NA`6rO!Wi_kF3kJ+N=0&&m|W|gGm$rvuuR*1
zK@y!=y{mI-;Zjnb%if#;dNox-8eCPCUuOAvf07Y?`(S3z+jISEH8uyKYezium)!`r
zwhwG0Fau$5>@kO8C-4FsgdV|!IRT?K6H(yZ<9+a=v--Ph9wg{IrgItnkVWekyS9!L
zl8GG{)o*=)+V-^;=qwfwe0jPg2rSbMuw^+Wc3jKHfk6WthJnr8!0-*%c-$rpt*ihA
zfB*UgynOt(Y=<qo;T$mf@<{HV;QDL^b66?zajmyj<vA${TKP$+tr?S?0K@!$|Cp0>
zo)E|$_Rkv2K8;f_TqvMCBMHe5dtGSj%3bpJ20}k2SNqh`VTx~RA(KhZ>e8*Gjb8tI
zH8D*XK@~C3Qtjc{>J!_fk8cGbC=__Rf1E^(%L|hCV}}QIISnJP2Zl}%ZBG{@mLRDf
zZVq{|TV>_f8;a}qp$kinPq?b)x4K%CVkUp>!}Y<epUq2v?32kv!S$;)x;BVbx0Ys!
zB%)yAuzh`uj8)UpE~&3W$*v8g86_#$t!63*jo^7ol0_M_VppZ$&gLvn;#9CRf0FN@
zh#$yudzw71o?pd9HAwkFzO+Jg6M68#YD7M<BG+|8YzkXo$FvCKY>6<lY2;B62CiW}
za__-ecDd76mM*l&D8<FKegin3uJvVE3Y=;_2-TUl)^JW2t>Cx8=DYS3oW=SOyepFa
zgFSeHAY>k;Hg@cQV#oDe95|7Me~rLlCUqljM)x`E@B6GFO4C4s+Sk20<{lW=O+%*p
zl}<?@e`>}5f@iCD237Uw7+*MSl%W{(+S(&22s>*B4&Q~SafoNU7L6QdG+=?xun|Dy
zIQK$Ked=Swwn8iPtkC`v2E6-`a83t}wii*e64$LI_)=VeduH<o>{@}nf6eC!zJJ{>
zR1>7T-U~|?Xl-0<RbxL-*XpQR;7)6~jnysf82#l*)srWmPIeC-s}u+Ou_+FpGmUKJ
z?AwZ_yCK%SwHEFH<UJSsl;r0-IT#-{QvI%i%*PKdM{@g%z0;1b^h?(>38w}&BMSN@
z6PSdS18HI@;|_C~xkbNRe}8kpr*FfjchRwr1)%P6$7i+?Vk$y`9cr04bPNG(LqIbu
zT+Rl7`T$V>G63~1lP~%=GM#;c-p0lGqDqjk8#4W+#2-hHjO+3&gM8$mDeAoSD`ol$
zi=6?OS*ZkoD9lrm)Y-nFM0Kp|tkk*eTdfb^HCXjxj3P)Ci$T{Rf2?c>r%K6lgC!ES
zMW?R1lVq1T7qhuav|fS0qns3FK4$=5M;LJCk}Hj*sF(p4TbfNt0>@a@Zz`fpfeQfM
z%a{;+E5`jzgGz_FkcxIaeSi&DSl<~00>|kD=c0&<5}4S3`r*0C2oFK?DWqp+8DVD)
zVqb#OyVJ39s(Yiae|fG7$<KF$-U@I|vl7KAh3E<ii&yTMc{(L2nZStPdX^URDR}iH
zSG=BF>D-eXc8YZlNbdx1x>Bow8Jed>2Hys_pUul6mVIO-1@60|BsqZXS(bu!sv!8c
z3v*YiY%id@L5OK{-^P|OZR~&*fcVV8JTx57A+GE2`))Dne=WzudKYQ~53I9dw9;;*
zp2!6g@kQmHl_$hnO<#ts$mJRXDu?L$$4Fewh}=7J;Ys_EehBK1XEB6O+!X@Cddl{)
zBL$YvnGt!|qSV4pNJC6m6kzUC$1p5AaKkUKmhP1uslUK(x~}8`UAe5ZJyR|`X!QxG
zA0<ip4XM89e-lw!s$@WqYF`r@R;?d3_9ZC81?KZv5;Fozr_2;xC@DozLbX{gtzA`9
zHJG6u!CLaY8<6TvFR-c~Nict#Zm^mjjrneo_*Ddj^#ry!2XlT@Uw=0(XH_1&K2>1L
zWLKAOa1nCq!75h|zCFtKaJOZ;YdM_ix@1+=(`#&ne=TynC2OI&x22H{U<5S+iAU%a
z*R!V@c*9`!WK`p!X&6TadfIRLxI5l4GDm$wWcP`_IkIm5$)}V0cbV`((QCF$kKKx7
z8Mz7CMY^4-Yxz_C_#3v1KYuV?-e1#YZ{ZB)%fWoP@#m46FS~;EUKY&I2~2KM?3v(l
z^mv4+f9tw9jC{*6LfhipxaVp|rJ`oh%AnTeENM{qQgWKFl>(*ikwv9QJE8HbjS07}
zNVxm15a>xg5f2+)Eh69KKIhnR98i8j3x~eXF?U^q5bn6P&F=Y%ZlNZ&ujsaiTrS%v
z7r)I#S|$rfcQ5(XH@VE0_#f`}BHt5uaZeYye-}9>aVWu2V8bGJd`!6IW5zui7^X|P
zXAc^FN5e06JK49d^mWjYwqmauTc_G@)aa}IbSo-77kmzA`5RL#EGx{a>K(OZ^;!LX
zO5#N8>9RsuM_Xs!PS(&@pY@Gho83*3UiX~VsCApGRO)_rcF?JNkMxyl)t4uqPL?|b
ze@d}_x~(|(D%?%EuId5px*6Y~UO#ALP=E0Z`t_h+KY0E6X3EoU%JqH4t=kbXESp5w
z4~2~#!;dgwmVv23h$n1HT=S9BZEZv#D<C?YsJEa|wSe!c{#u-@980P>fVl1`Q&vJ8
z{Jrew*^e@-&f~OAP+a1N+5n~AC{OMHf1KWum#O=xOdh4CVzgbX+!?mLO}Ok8{~9vo
zdffORP7XlxL7ZIoGoZ}}wE69tDIc~t=>>sl8m5a)I{;7{;W+R(!A=xJA-6-}u=@;Z
z`(Yy{vTKI_zPh_aJ6yS^0FEm-e7!Hvz^?@8&r6V6B=iy$LZlVBlrlJ?Lut<kf1psR
z0h*&D1pMF6PyzhPQ3Ao;B>{0%wT^YF-5R!8G~LEvRy>QjOy!#+NT#armkq`h2*PCt
zlq?J~=R8$tRCWFPE0)Z;(A=GxS>-MO=_0nT`%A+zBhxmc$j00QD4iMjm_lw}Mr<dv
z-O!=#0HrHit7zTw2A(O!sUtQnf9)lsy5ctmovOXi`@rm*nak13YOQN9YLcZBk)yM?
zC^N};92e*;o}49sh%eAYr1Ln1T;Hj<th)dk{rDKYfBEJadRbH(UZti*Q?fus87E0a
z*j&$y#0%D2jxZ)9+qd3yN9euYmF1b3O2*ye<ITGc$W9OyNp^`23FoTrf9_Tu)%xNT
zY=JPlQbWQlA@f4{4~~yPjqBBYg7_jO)0iFp@=>0fS&>1~@{b4O-rt`T$ZiQqcuf>x
zrNS*u?8%8VBB>r%rD~L5F-zj|aFyx&<H4Ul9*ll5KaJ48#OeP*hux7bX@v5ye+Mh|
zq{r3NiSDf<eploA;^=S<e=cyN!=lmbnr?8>CqLfmERYW)c>2kwle(rgQNg<a_XhvK
zgZ2*$@H;&(L-g?1iyq#Iia5*5zbtNhH$bYJ{}hXx>;&l8YaRA!-PRP|c|c-I+TI6@
z=m^swe!y`MxB+%Jr8tD>YT;9#`@;8Z?><AfY86n;O{I%Lu-F=1e-R3{f(%hkQlJNv
zvb0=}ip-?tDVWAr0Ca4}wn@US0v(#qOc`+pOotFgt$t@`5T%xks>nt}b3x8|cA3^!
za#D)15??ypJ9P|XFYr(DO&nHz&QeHRGliHvOz6B29KC;aT0mgq8R(x!SBu}r=%~zQ
zV{{~$p~mQ_IFo<=e;$K$1){1H`i~O=^g%+TN9ehp6y@rO3n__r)Z;NK&IRbd*(J$2
zs)k>TArX$^JtI=6Z;umdY63E$Wt|EK0&*^5aak$YWrl<j7$2g#tfpYGpRP<o(+XWq
zabSiPb^<HFq0L<E7=dGZ!l8zE<jzCbzb#!^odcUlu=+cFe?9h0DmqYpY3py_`K|a%
zET33+2FNhn{Z0b8*>9+w|12)YuzxXZXrMvOKsBG7VcloBacdu}re#-47$VBctlGPK
zYUsNv<=tJa8@bC$In+_ii`n~x_nt1ZnSAPM@w<8&4rKWo1hdOu;B1z^WGM_vU5iWg
zOA=qGUt%^_e-$h;^-Dn^m(Rz8Tok4J<+pkD8;iL7mu9K{W&XQrKANZM;Td77-f5N=
zrO4&)z~C%@Db+vIME)}&x>ohqZ}J~5F66&traJ$7tp1&5>Us>WVp(adnoKgHewhm0
z2MC0(=5(Hx`C@54Kjg_zD!<jT4;qeztu$h)P!+hBe}Id=XUb@KYd;<wfdvDbpO%6i
z;Zg8zS1-9$V3XheOB!qHVJcIF8r1T5H=AzO#9Owj9Ca;2oz^xOest$vWa)(@r9MH7
z6rydskqI_m@)7jsg*r<iSrv#2i(eCwPRg^xGOPC1Qk3fmeTPhV_Q(26hQ~i1RHyaF
zgKk&;e@cpXYK@_jRY-=`0$eg)Rmbm1ZJyGBE+-n+usqG9F?yYf_u1=IsHfuSu$qmN
zlTJ6sNRHvf87Ws5ZI2MBuGM5gM^_fFCv(Y)cCyWeHU?54;IXJnwr*=;aa}@I{|4wV
zHk6h3Wl2aFzM&x8R^^(vP#16B+-Tew@J{+xf5ca$y3rwVZ|s6?*ofZeT_fXn$XF5j
z`<9eqr|{q1BY!s-9~)pvyVH%0v|f5(Uo@YYPd=Sg>kO{QwesZCNxh=rqFxbCKAp7I
zPTM|NOjZRI>o=`mvwDZEr(j-M(ZqV1punr_62BEQDZl8tTkmzVB^BOcb)$NtgPF7z
zf2apDX`>_zB#YHd3?z&94Mlx@o5DU8LCU!2J08b@6$aP|T}Wx>F>FPIGmlZ?df`2`
z2*O82Qy8`!$>=c6YPDbF94NCEq8#mLB$V3x${NOq&Ot?mT+_KgB9_UctLMAAJBDvx
zt>9~m85EnRbMSO&gTxVfe<liniX@()e;IuGbhB!00>j!RD6`UV0b{ILy3U2HZrM6V
zQY1*8EKrfLm?T)FlQ<PZ!m5jSl9J?c*x*ue$+PKxCb&@8f#XCDrXph4p}vPnz&K{a
zwId$6CLhve>vY+BSmET3IU^SW{rq~xwvxLFHdM8fy2NH{Y+|sdx_fDp5wF^3e{$c#
z?x>@_Ye!4nNg%l^^LRFs*ncicAz1=%9#J}&&IZ%jU^*L2XM^eNL7L9Ks_E+Fq_SOU
zJ8jFH{v9&lYuT8&PLQk0O3<`yrBxhkQ!PwhW2!32Ik1V|0lU>;V0sW4JnohLt@Vk0
z)bGHsJ>pUyQx|esk;uWJX+@Y)e<QRgHB1`ZXZ8El3cBu=8lZ&#!<VmLpqy}$_Z0Be
zsfSt`!@Lkm(y#C@NaJ7HMBGv%ohm~$I)ppoicDvTSPhK%J%+!)1v@%IZ)-SELp4j-
znRe(eL1x}cCpgIYMax}Ypjig97n20VDF=NZlX^R}C3|-?%`TMUQOpFWf8@ymaRDCj
z_yT;|47}5F_5dV9I7;Gkfc7T>!3r$yf-+qudvYjqCkQPwa<FCF3_HSzFbRE%16!Ds
z5y9;+eB59b6$!sv0<L;L^pxSfw#T@Ge`}|MTMDoji*{1D_J+WUs=nD3@1;5~;UseR
zfTWR%%VZ(%xAzGnDUW3Ue@knhNU+^>mS@vgLo^0(#qEMCu9c1LdJu|@@QIcF^wq2Y
zt3>4=MJfQO#8-*S%}rR`n*#LTzd8kvWy1Ro+K#+CI2^yaJUG5ffgJaU;E5*l9bQjQ
zGI$|}E9C?I&ZL-NZ;xbt459ryHz)(guj1)^`a`Z#%bdoOxP%Uve|I$--JRFFK=j;4
z>9P&(x<MeYVHylOzC&=xTpRli^=-~r==t7|R1S`I0!IbBll39kdnc9aXSC{OvwAd1
z<{}aKwofsmj=&CaO&l`8F^x>qcOBwUdmX>*y1LiSN3G^t>wC46n$uQrz(Gv2>|C1T
zwy8O42~;*G@EC8~f37k#Y)CTqg_6w4jrjxE6W-*R_Ga#uSFX`RPer86yr5maj-r?e
zWP2_u7*Sq-u|a>Wyst`_go4>+^$cVc6CC`(#k{C3Im+t_u?kY%gsf!>*k7frR8L0$
z$lRLS?PYo)iZY&n>ZuY|b*j-}1v+zD6z5YE1IHUE>Oc=yf2vGHka|Z<vx|0$BAFHV
zO%_8uM-EPl(;RF%Nye0ZP6<1&@@;_=;s|}8!URi-IP|<M2|EKMg-R~h)Hbf`QWLN;
zc^}vV2vl)iM_lBB&*iXDK9_0zGDMS%og;B2*j&C_nS2Sr8(cuJ0lcvCEYIeXGsLna
zAvDWBM@ly}f6@D7bh9GEWTD|=&OH}9#I$i3c|K;o;TRURnCZKZ+k#Z<)5Vg(NKW^x
z-tAJs-MW`?cTbM>pVIiVdSiC?aD|+zArnyJhCK0L>7k^6-~c$C>U^{^k$GBn=nns$
z<>yJJLLfdK)MJsO{dgb^9rIM5YlpJZw!NX3Priu}f6>td2r6yP$pXDoLxPBc*D~Rj
zIU2XC-k73l|E5)=a{e^v8g9!8Yr0^q?!xW0uLq4V`Z?3>!;ID)uq!)GmP?ckTqS)R
zyKHY<)jk+f)*Dh_&Ucs}D7U8}rHso&=v}m{^4m9g?EC_k>>WF(y1Q5l4hq4tl#_gM
z!;#1pe|ep8So=J)x7p@kDpeR`SHnr)#<P<FV7C!m&nC0CMdmv8m>XDQZfc9UEfdRb
zi@mRV?(|UnyPTS6o+Jl%-jE|@lATVydrR0DMy~5J*Tkk57})VeghPirn3_?*qL4FT
z(|hdjuO+l4g-^;(UH`t4DYp1DC5v4pQ+6axf9-V4E>n@$vL+OTuhLy`iL2!-RjR!_
z;|}At<vRi!%rmj$TNVy%>SHrvEDA{I5Z8a)dX4gouTp7>)oW!p^=6YQvQGbKdo?$!
zAUmh7ZN-FEK);pYpl}yll})%fgiR&_{Y>Ny_#J+2MPx!VPd=U0{@Qlqtzz(06YnYi
zf2u2grA-&mK$dWkzaiyWefKr&M%}jj{lhFBqj!IOZn@qd>et(0z|d_yGj}{JP1_ZQ
z@HzHP)4+})1SYocW0SaHXi-Z<As?JMpUaukvl%}Y?@b^WGbsVbjp1R3nhXb_YhgEx
zsAD_SXLKEp+Tgvp6T<4ZN-nGXD%u%he;9wNTq;=Fx@U!WR{hd-wt(Rt_Cm^`WR^es
zSHrMv&->=%f%e*bDeujjtSIrRvehrpKc2rqFVjNNC@a|1Xg62RKSZA4GYIn}^D;xT
zc|H;7@E_0LjI>)rI$yMSzc%*{i69+|b{#C1{5rMO5&Bt0<-v;{qg)j8q*P{Oe<g*r
z^GP-#e;_}#(gSOk%T^!H3+=i2ebq4I0txANQQ*iWj_ph%7B2;vWoi7o;H?qo0?p<L
zJlh|9+pkm)2gK4`%!CXJglUi?fY~9yVs#Fz*A3#4gWsr`cfzEZRx#%(&rO!Y)Rj2|
zO9ERKQ1|6=0bV7jz0ARu%SftYe|sVP7iQ%`AV#J$5>GV6A4C{KM57EcuEv1N7)a41
z?g|nd-LB8)cQV`0<zw0&i@;;fE#d-!r2)BzP3%$64h+LIDKQ?mYP7-SGlPSoda-hC
z9Io07Begu@a&dF52^=`^l23qfP2@4yx5c3b%fZ1_om+|#Yt(boz@z(ne`#b2FBsl)
zx%rD_AC0P4sbZ>-qM(v$o7Ncr@%)WU!?kDYoyYr*nN96V3Z3h=+IqP0#jI=dtvqN|
ztMBHF0SWpw+SHFm^JICVot+y0fy4>;udd;al20zT>#l8Azg+2^FSC~8{#q}&s^)*T
zs;T<m4NkDzj4m6TV4G)be{h0zrekn|4NkCo?F55Q*TeRK8D1C|j%i|7coaK?IGFg3
zhi%tn+@hw%iMYo;FpxZz+F79NLgWZksIKR0yJTKfa0nDJwPY=`j9rjq)DYRU<V~p)
z){@}ud%!&JI!jrqpF8@$zU+#=wFT`*%w!Sc*d}3w9haIojO-BGe}QF0OjtHE)`7Y2
z%Yvp0y(Fcvrn{O?W3WEZxxAf4X!q3(ai+k%bn8piwy&{NXR&zT3pJ$7;0CdA;Clo+
zA@^};z{zX+p5vM(BX;n(%_my_D0VWRES>VOpry@C8Z;}Vvch+BQWCWCJg;pflbirW
z_kaJGlXRYtJT4dif2;}6r*R6tUKMZ4NJ8@UmXwZ8+a;4}7}clb>Y5dHNNAc0$z-yt
zsb?wRSAEA|_L@v?8*MWcyY%KqT9%Pf*QI`fXnS5DcLPcFU~))O-6|{b{7_uK16^3c
z=i#cF$m(iQikbX%L%wn{naE`2bsJspeydx(nIVZNm^f^%e~yvSp9)>3x&|e>z}#kJ
zWS>~(?NCJNWP6^HWKqVf*cGXE0GmgGDz3^O@@)Es<YX!o$nxN8CJl%D3+#;KJD@`k
zWVt<YxL41w;-VU)d?8<2LAkzA_h9uC<_E+zLV<0|iLgTghN&fdOqsBS!7an{9y$I>
zC3o6e&fDlJf7tm;(YMgjMaz~xV2swDWwTfxWp_i=ez?a+#6rglT^v!v!VdKqCYEL6
z$PXi*hK_Ih_nFh{eKy<Zny*42l_=cR6yJ58TZ<uB<Kl-Zm(G~G0Q7|weXZo@QQ-N0
z6bWn?KEaO32o6jxut|i=xfyc9Baiz_qmaJv&CsaWe`1d%v}xVk<Xf~R9a4v(wExxm
z2bpPaWjlxUm(qH+r@e0aw`a=hmZSa2r<0}{ne@8pIpn==sVu)dsk`{((@8a=;p_dN
z)3~&j%01vo$^}0q`T0O^bZ}RhiN+6(LbfeQ?1O@L4Hl9hu(9Vj7IqBIFb$jtyFTF&
zrH;4Nf3Um$=BI1Gq#-UhhTTV!zr{sN<0LK@TTtJ#%IE{}CekKC=tev@fFwyCYuPj|
zzW;4blK0t{N5OCWay=~Md*m`^IhKos3-EW>GH^&jA6vp<7IPe*vvuJX1M<E88IbR{
z$Xld^b?N<nL6QW$o6~7r6qPKy4~bD9%r24Be@Ozg%d;#8ErBk8RtHGxC2?+5vVb;A
zU4ZbZOpOF8hDwawLDC+fciB8=ZJMB>?y^n|Bl)pkB-xxlpUsr+u@&L|eaf<V4pSj}
zsM0b+w`J;F4Ip1T!Xj&FQveq)=V_ZEMg#NnSk5(!u+{4V3QlKbvH<isOXiS57<|F1
ze**>ZR99}Wf=nwk{1}qu&JwbaJk~PpG;{{V9Qd-!g-RA*Wvf!~^(;aJl@*Cx1z~@N
zX7L52<&kQkejajD$EnV|6HjL%FS1neE=jT`AfCfII}yC40uh>BfU1cKmdyl;%UcG#
z7jwEF;N5i?ji?o3%d;TT$a8VPsEdhXe?^f)9aDJr<F*iN0K8YE?bRahEZBNSm+ghW
zJ^efEEtRKT?g72PkI-u%*and#kqfik6sW*bQx_a4kL#_jHq$XUzp{CWk~k7<!4grQ
z0g@A5rBCCd7WXynd0D#$MTemI?I}7zGm;nLSFqw8z9pBk)F~-Rm&zFqm7MEbf6R4+
z@Y~a)=7!8+QgvSkL9cjVWtk5DbGt3DS6Jc4139Uys|TuRnR}&5XQC20%eM?i{>Ot+
zKXd>lsY!LRvd_?Pr%u^}z9|K0Dw_(fg%+<4+qbQch-AN9j!f9G+pUp*rcOiU8+%;E
zG~C)mKZpHvOEdkh{W+Euw|YLXe^d<s{WYJMfu(9-soMH8uv9&2mMZw*J#2u!V}^oz
zj*A6lCU$saVj4yUX1?P%hE1pwuD71ueGhiaKCml5zbEv!h5I!K{W}1^mkad~!0$cc
zhb}b;4lH3|$MOjd2s1FD5p^kbh2!`SV!5Jee6@L<wijkQ*RkYtmJqDNe@ZFVww96R
zt(J0rjt=EY&vLcUKf@~C8!iN^_~9e-&B$S{8wJ?6LIdnP5vGPku&_<ralL?sQS`X&
zJR6Yt8|^&x3BMO0{|lOPHe&t<ThCfs&zg`3WskU4@WaxhJBK+GbJ_>|fVo7OPl^pd
zoxY)FG*;${?N2V5OYUiSe?xzsbnHUwvI=lmnigHKeSHXY7y=z`UwnSBdY;c2HEd2W
z7omq8I|y)S5C<E?j%-H4fHUuL3mq!ZK_-@ouU5sjw&jApsNE5)*TGHuf`*j8JNhN0
zg{eiG(K;;@N{!m0$v5b_qKTAD9)wG&egE)Qy+E>QSU6d}vF3dpe>J<-dkuF=|JCS)
zd4l3yq>FKNQT+=2uB+S_o6}UHUu#k3jFhVf2UUZsZ(R2eu8ck&j0R}%oe%8Mn)-wN
zTm}v?Ove=1g%}OTv208jHL%Sb+p&lf(#X2UcBUUlQV8_3m=H-0dHBQ6BPpDB?4@+k
z{;a$!Nx8*xS|g2?e-KnacL@~<-sFQS#)#(Gxl9Xwnf6*Mpfz*|Us7>J;Dd?Y3P>#l
z$)<kHiPWmm`<$?I_068;88Fm=x)0CJWioO3fvr#*w{G5Yuj5Tn1AE{GE^1L8MI3t}
zHLzn+15?fkrj}z-KO#gh;}LA0_X<DvH<9z0l{+{c+CrX0e;unG1k3wERf0$X&^Xve
za}bw6HHX*N-6=A}CQc_~^mA6en~~`l!T(1`=$({tA>m@ZMY~~CP@m3kcot9262&dt
z<Zzpi*<IO5)s#H!y+k<;ePM*yakzyYlW<JJFv6j23Wo%y7qWHq<Bv*jTe+bQBe_*m
zy;VoG^|+_Xf9?6<8H2H`gm2ICXXoK4R2wjQ%WBCArrV+<d09vb>}B1jGt%aU6f)NK
zUf$hB52+vTKRaj^Us|)cfspi&^$XJunFt&MyAiYCY&UTj_!bULYWu`@B0~(kBR4(P
zWhl84!fr=?8qW5;&vqpQYZ<tGvbVm0?b9AUv2i+4f7Icl(NX95(Ym}^D++D=Ky)4$
zJ_`5Zqfl+(hx}P^?SKh~*qE46gdG}iOdQX{mg(DqQ))5p-*Y}0(?D-59TSFlHYIT?
z1K@u6c}a=xs?6`}JTdiS9p0GrCa2|OlaT7JI6{AoCudk?rm5?cZWWU9n9EEqGI~!M
zlbXaVf9i7sDN^o+CR}y>VQa!64LCKJk1ZNO+`I2%A}j-YhUs{QVbaL5@BiM2QyyQ$
zd`^;Po9w<nT2EJx-f)lHjTOEp<I+7{;Za0IXb_4`D`eR5BZ5Ot7<LUtsA~m;yYAz*
z^(;|Dy|K`tNH0W^&BUnxd064Y-|V93>J<e#e_Zle3_8Fy>^pBPMJIJC-%HQD)4jP)
z!e3dc5%JrW_l}_d%ab>jX2e43S)icmRMuz5YSlGp246jk?f5Q{TJ5zozB;KD1^SyE
zTdcp+FXV{j*IK_eWv<%(k=ylSS2vi>r&Q!W$f52v#(5gU1E#<G;IjRvvXUcU{CwX`
ze>+m7xQeIq=?}SL?Kq7maS0tT?<&RC7mmiek*c#BVb*;$15h(CLo1@#@<@Ok3f5t2
z_}C``0`fdT#3N?{SrP=hdef3jI0%Dx#o1R0Uu(p`Z35u6M8B5IH%NQe%FH-OdxNyM
z@@J6t)Rq~fz0YX&d)U&RF9<h?VPcEAe;#%$%f-~QT<p3IHA34p4D$gPwv~}>CUVei
ztEgOQoZiW@tscKTt9cIV$JaADuD~243^hR>Yem?|vPl|C_?Ac~WFnd<9>tef%rd#2
zWN0x~_wJ74r_5$*ULLqzoCcxIILF-MHg;^2U}AC$GTXV9>zl+h))CR(qYa{%e?-^q
z5E+lNd5h=@V2>z@(rfOKyR*3Uh#vOpHl2tOFQizQu7w@qa!k3!uwfa@c9>;ZLt>Dg
zvfuw00JG;VOMM6b&KOB0RuFbp6aD5-3M3#E20C2N;wvNQd0dbwjVE)!4(MJ&bwxal
z6Ov2n+W{hcU5GHeidEoXxPGe0e}#chzCuOAWtqXG_Y5@jlCLu~)Q_t0+g?p)q(C1J
z{#^BLCo@D{1>{w!euuOuvdZ>Fd10_n++_>JeK3;OV&TKqn~3R~#C9pRT?jMtn7|}7
zJ#4rZaUIhzP3w_U8Z24Kmqf(d{B$0nS_*wqAc*NyAI-QxX;z|HE(+jFe~8o7A5e5y
z0{g*bHcvnc`)wZQLY914F~rN|JQ@RiJzQ_T2`^94VMZm}%#R;lo{peN2n$M=zRA@D
z3?Jp)O!-UP0Jrj0e#zH8u*-LOk58}ce*d%EUN`M~FZuB49X`FcrL;cmZ*M>&+h-QV
zh6mX!ZO6pK3@vOC;<#QIe=<AT0#sjrb4Wt9EeX|5IHZS_j7kVWT$?!93wekg%M+MJ
zVT4UT2pRWn8i^qp)mHr5kc{e9l2N@C3?$k25+kp(QtXy~>U||^=c<aOyy`miP-UFb
zDOD>ue2lojd_GHJMszkCkb@Ia3RNRW(ZF%4A5dAT;`BlkWekFQf0o{Ijw3FIzF(Rn
zhjJd8KEu9cM%Zx;imBte*l`)<ZsdlHx%b$b|B4hPs9L@ES-ry^4akP2P-|aG#R682
zrao<^tW#@M*^U*~aEuBP3DB70*%-mAI+h<0mDj77OI7JewWCozFF7bpajIzHU}@<j
zTN!%JFGvb0%>D}Of25zo`L#bWzg~E9I`+%M9a0vB9y2is-2gkT>0)a7CN>ShtjMOs
z^S%H%&Hb<%n8wD#YU2v+q`^a{B2uU?IFVjQQOpFgJ$K&|ZR46PGDK36ETH$0)NcI(
zZsq-6&h@QMbx?&1ZSIxv;L9dol23l^&<2muQx#p@>0@81e{86DxhPma12^1#^68{i
z=hm#;`ZFYZ439Sbhr3l$bFJb(`E*iUQ5R$b>a=(t&!7?c$9p(Aet7~zLC5GvI6a<x
zI+6c^HZRTBSEa}yO`mL$Klya>vZ$`9OIq88p+Qb?H6!}MxHnBhti@xqZQt<J-zR6X
z?fEV@f(V<Yf9GN+a(qlY+s4ANE%+P=n?D?xqc1kzP~_0n4HAc3dsC9^CvSK(<emp;
z6&{4x@u`7{ZxQSY5qOqu1Qvhf1YS3jH>%bCaKw$D)QARwV-PqXcf+px3YL&`i|Xa4
zSKnaKznw#WA8~_w!uPmAurGwb4l`UFh|t2O5rv**e^HmvEr{O1I(~iYxU$DR7Q?tH
zLKgTT#oVI;JKXkgXm|mpu44y;Mn323n5x&+y>>pf3$nY(5smOF!LQHDlCX2ZRodaP
zyrxv$LRqYy&&zB|%9x>A=Tva4AF}+C<S^@%fQvC!cGg(B;6Ss!h`CG-UnnwLnI-<|
zQ)q-#e+|!<8h-i|fC_O+vw6xjkfFgtq!Rcba}g5?Sr(o?C3PP~)kpPIRQK`e)Ai=p
z4eyy{DUU%HB+1|6BBpT?my0bEJR>=oic;jDtiw#dCv@Y2gsc=KkM(<ri|>D%ljME2
z@tF$(5#}J{UT0X%Nqbcyj4TIX^dg%ry8nFre{Fp2of(<LGYr?kjzdlC*p|Rl_`vDn
zbJKL9$YuVm?@a5aTeBtH|D2VAX4$#4`fL;N)gfF7A%e$SKbQw`DF&C7aubyt$>n_V
zQSJv!l6aCngCtwu+>Xm?`J9!fSnI??FZBtzt0xOUR+<*PK4s5EmAwx%I#M<);?e@z
ze?4%~|M!3Y-&WwZ=BkPS`z6vc0l-&2k(qMnqIVQ)dMZ!=Yh`d34e$tlSBzTi&jIvJ
zRa}LfNk>VSPKZF=MZY6Cfy&3|Oe8Zfd&d&37A??BvVOpGDMzymwq8sUl*h$+MJsm%
zrWyF}=~D>Go=%}buAMl~o<2p-XET@ve*n9cxg<XX5S`RAE7TtD&8f;nbP<co8u-^A
zM}cNpQN%P6h$b03$Dn~Xq<6(FItk^`ZrZz^={-6u%Q8a4!nQ#J><|&*koqAu9Tu84
zF{!myvbhgNyX76(HPmVBTnE3I3l`5}u#KqIN0b*p=*<RpllVgBwrs7@0!0a#e?V*-
zDI}5YxW#ar<w)Bbj?iC4GAo(|3|kk=<*HVeOlwu`$U?9=q_0E-o=rtjt@9*i3nbDg
z%bA#pw7dmx;g;pJ->Pzh$aZKL;lOe@b|MyGY7v6D&+Wh<#0b8GDfrIW<Iw8#t4l#Q
za-D&_O|3OJ@w!W@wW9R$gXJv6e|2U2LT&38dYw;Ri3^duQ48l^fNY|!s)(oaM7lvV
zL&d7n?*w~2E6`6QPH1+e3(EFR<6M8APEI}^yi|Ll2Vwo`^!2YzdW#M<|7mskCsCed
zycnU*lRw0HQPyR2ZmqabXw^=&BS>uZA`wI;)T(i>luUj-7mK1-_!r~Te`r-x@8%S&
zmXj=B=*D_Ikh7tiQK{qdoGgA#L^>(Yx{dtOee}}^eTR&3m9DFM6FUD4b$Y(BF4=#0
z=;sVIojYXEG05)K9ol~i7>#cDXHi~e`FUe+9iu1s2_y*9$6nj@Syi-yL-s$#qF?rX
zR+2<kC+VS2G;DaRmu_>Xf0dTC|He<+#@f+XF54X+Y`n^&G3=k+AA{050qn|Y>9TK2
zF{w4o!=>^4d#~I7-tA5|C&ga~|Mk6+cz%5&a<I~qiTG7-EeY!8*_<ZgFoz3={r1su
zQ=<0<M(C+&7-M9Obd&Pfaizz+S4-b#UeCjmPbVwqM0&EJIdv{be=m8r^_CyKDbi~e
z%IN6>Z+3qo;kKMhV4LaAsq}--$P~Qmo!NyOe<8q<F6R{e>B*;)&2zlFo7~u;<XLw4
z9DEpM%!*wJ_YNSlq$CKsDu2kc>6^;bAk7T%R6Inh^_OB8Y_HO5Q4AUnn0@c75a*3Q
z=i6?dIQM{2G8g=mf8^)4L@H?;>}=qae0Zx`e;J44>!BZCQpy=#^Fx2lAhHf``Jun%
zjv8{U*X?{U(evI*o?lvO+e2cTN;m1QYJ_4wJa~pI<2D!i_ClY=pMy!h$nx?pi`&-m
zz|Z-gLK<5CpNU9+r6m8gBl`bp?Y!Zjhp#nm#Ja7y+*V}!e|p_(=60I5+ncq00JcC$
zzvpc0jBQ_g2Qq8go<;@+V-v5-Gm%S=JDhaJ9meD<X8}f5@L<E-Md-Mp@B{2o$HtC`
zEF8L_hi%J*IAoW3rg8t72P*(T7NN?Lt9ICShop8b_q~ylCauOnRY}xzl%n*KcN~<f
zU5`33TT_khCio$zS$`UrnXKw7yB+uQJ__o%p+S7?`pn0UZv~h{o`r4hhXIL%7g=9`
z%JLq1AFG$Ygam;bung2{8GMa{uW|4-eg<Eo`bL1i=K=c}yCwT>#$Fh1Yc2-=;_4HA
z@GlPj#lgS0@n`Ta4*tdaWxM?9mg>R3_()##;9q<cuX*q<K7WR{Jop!zsTur>5757O
z3r@7h<u%&Xa(-`}M~>xNAq1=$zKtDb3LH|CVjB7;WwwZz{Q&a1>1?j2I=JxqKBOu<
z@iY34nl|pD3u!-3l252-JEn_Gp9$>vk%@_CI#{^E6Pyaix5VH{8azou)Y=fWcBi7&
z8t;kvW;|9$l7IeWcKk`|(%?>7{oxzjNrO9Sa3^j28Qe*OJ88}7Ik=PbL=5hv$7z8c
z+)0n(H4pBj$MBX1cTzJogF9((C#~EvkI|j<(7j634Q)<B2UFjMR3^g4B(OL(0~Q*l
z>j~G`lJ)wrW#05|gIe4)@G@hxbR0Ddn~x?Lr!5?lF@KX_)AIy&3|NiK^RO>0kA!AG
zEfEgP#zQjBFT!lR13CPj)W%Pre&1tmmkC~|fL$NWlQE)m$(M^rQe;4;D-dZIQ6*(6
zpM!r}y15(fUmh1M$%=U{z)v27s~LKprAJSn%8s;r<%**j8ev%)#S?hwmv8BJ;JUa%
z`8*NDw|~d<yHAH_WjQOJ9Um9-*(}S;qiMx~e8jTpu}JZUcgL^iWs+s*$1tqpc_FZT
z9+w%eY3oUnEU+Fiu9)seK!UFy24YX(9-hx+Ki>WH{!MF!cI?Z%IL;&)^Km)PQ=Fwu
z2dc*7bb{j)XR1}~N0#Rs#Ke9SMc8qC7YD><*nbTyi+eUTSRh6))t!-4J!?4o%d9~I
z)HJ%q5&B=*yqe`Q&l0o)kH3N_uq2y9j#f!KDhf0&;1*2H>v^f%OT~;#6|f-gzpX@&
zJY6|ITr*c=HBs31+~Z8wh@nPY)rhMeV%fvi1j_fe0~xkj?V5!+FVIvnb&IQ6lEoz|
zA%7^7kr`1Rb(li<5a-!6E(BU+^BiUQgru5-4;DyV7C@m|rXnwno<7~iZ~d~)P20k1
zz#C|d1z{AIka>wf>(eYnoRkEMD?nf6s^u9e&yLWGEG=RQ^N0&V6N&8T)pZdQxhJ#b
zSF}L$G?6^Uh{C&sUl}O`G|e+M2S|wEw|~uzy*+kbi+zT}O*b@f7zi6Xo@?OH^et@L
z!gpQI6sEY(8SGkzc>nAMf9hf;*5HVw*IB}j>Q|~suUDQ2D(P3V)T)T}F_MCwVv%pH
z7Z^7>6i1VzG3uRoV+lmkNAYM0hSaKriZgN%XBB($lq}RY1J*I>tYi3e6t|yW*MHq7
z@6l}pyWdykiusKCq3L5mA_qGJAbUYbu<u3=^~}HuT=V`z_FkrX`70TtwbvA6uNI_|
z#dh>wTvY}d5h6@)NR|A7T!^*%P;b+f+Yue+VnT8*&*LnT?e%x%ybyeO+qHzP)w@gT
zY#Qa)uCw~6-u>P8&^Mt=T<(&9VSi?ZkQSa(Oaec^!Xqp+0>(mfop$*MIWk)EYF|uk
zZ>>H<%kpP#6LrQCoj&?_P)WI(Y`!@~UN(9S`j?ZB2R+99FU$B|G3eL516e}izBHHp
zVT<v9<rqezqwdqAaq~BvpeNU?3!WYIN2Gb^VGP|?b-^qz;hrq^tIQxSCx2zgp1qb9
zd=?972tW8d2J^-9t9WNt@B{VU4sI#_<SrQN-TiI#w(&^5WTtC`4i5uNIJdAvT>}$?
zM_7o^jJWMEFQUVjYz0QY7Ah;+r^~ZUW}R6nOu`pzg*4gw<PG1qyYPLJ&}dyoaQ)pc
zD)@N+!v|G#KYVMRuRnwuhJS6WFWX0Bx6~hK?#ZW<Zu@}7t}8)REmaDUmDTU}MII7$
z+`~j2%PV5Y-*5|r$3s?<M;E}np8&o3(A`C#zDIKLgB6H<n|q#N2iOwCz>X7g91=k>
zF)4SbW%%5W9)W%JgLD<@jD_f}^yPj&Lu=nLvfAQ0U+&ZG8CP=w5`UyL9(@J_>ppm~
z!NU3s9fZWEZp3WNi3POQp^F2bN7!{N;tD(RZ0ifqTHhB7>u1(WSM9t(SN(drs<L?Z
z4aO%Q4}PLo@Nz11_RV$LZJMgoYCp5OIv9>0bUw*JO&!t<e#Ho&K~25uYU*`jE&BeO
zhpx3o0rzR(avVAi!GBI@N0^w7jeTJTmhT6S$HM!swbtnAiX`i;U?RQ%K?BfvxcQW5
zE%vY@vW~WEu*>*cEelsIN?kUW%>qnxGjK?Pa63wIA>p0(Qic6Y7@>#0GZ`mgNL&L`
zpE=m!p^FLgOzc~>X#@tbBbPs*omrz|zU1a?6xCsSexB|5(0_NSZ&AZ^eHSy^7T9rp
zhQokUEQs&A%rI;k4d$j*=B9d2Rv*a9+yr}6$lbr?BRSZX?g-9rT%X;F<E;%rEM`eu
z9<GEuLN>2Ie>@odVt)Fp=BZxqZeX9PYijuIdX;}R3)KLmSTjF^h3fWGDxZ@4e2=us
zO5T4Vt#eZ9*MHw}8BT4mvmNa-1CU~{P_0{H0}}bRELo34E)Oi53uXn_38;%5Dr_7G
zFTjRl8zu=|i+I-H2Hqr>H-Y4XXnxN_a6YqK-4^O^L%ME@)m?>Q5U!u01Hvyz$^`!_
zaFVB!9ZuN6{kz6Ry#rFG_s}3*ubZEF8iN(s^dARp?|-9p{|;e(y9(D2UB)(@z;MFQ
zz%*hZc5Le7fCU_fF0)u<TSB<rBS1WZV^;E~G`H>u;<?wW$Bub^==(7uhC^-B#;)&r
z*oh(^he8BcFwYbowF8T>LFfIl(C2s4a@Op?0sDLhmEhhhTGEAgMmo2MD{c+htfj4;
z{Y2Z<nSV!`YUptY#si{zQ0bSJ(hzujhgJH!2YG(5@-Y=W5WeYSM-U%7k#Ax`h>xjn
z5ZjC#&Vt|pVx9ACaLS&Vcqh=#_gaDdyol$AzD*<FqYSpG&7uH194ty!M6exMhUFNZ
z8wJrL1wP;6PQ69w^RQPR`<AuL&|rQTVnUq=JAaf1IPisuqma4GvK+>UGgzKJFWO?T
zG(83+^fqJF0Em9<hOPk+-OR;++1R{R2Fyn9XTWTHHq-PS2Sh(u*__!_1U|KKz(jx@
zBeF2zp@j|4HL2jfX`22Zn-8-2<H$zvWd!U0pS^cqZW~F`M_;8@yS)|_EE$)=&2Dvs
z`+wruKGALa*q%Orv>hFF1BDR?Z~#!UV$VeEgPh;X?US6yDqMLdMO{e25j`W4KvkiT
zRh9YWmzlrxjOZnMQm<Wa;EC!JVy!yX`f$V98R;3(=(!U=p15{>>`HdXTxOW2jYEeq
zOkC>WARr6}mSo)Kp6{D$lJzYAv9Dadw10BBO%QI?*PN{q_FQU~8x{{t34#{}7A8Ki
zG4*VQT_LGQUCJ%CO!}6!y>vd-`$sqPj5a>evMj2QMOlJP*U&}jwal_eG-XFH#?_xH
zn{h!IP%N+E8Wfdfu)#T*A}Yp_D%vX(ffdERt~4#s*;&(9-O1TmX&ZodrmU=tZht6*
zD#Eqk8HMt>#U*UdpzN<LK|Dm4>5aSwdVit^gj<6s>+-gTm}_y=V@ib{%Ivh9|M~so
zhws@Bzd?~@G)^-K#h1T-IoY`Yb6&^^X17@V|7Z%6@p7to&;?Bdu4f1;SL<TTz_}=H
z2k2x6iREb`B6tuQ{}JVpF2B4+RDUKF2LG;H|DP#axwN2^GtHt>!lL|_e@<!qIbC_r
zHI1jLac`H$TE^#i{4HqbU4=>~AOXb88!W)YU_NG!5ZG`mYI%ehbZLdJ-FFr1uG>m0
zS^B%QkStBFlp3`zWx767Du0a>(OQ4YNmR)3S}pN0=_cQ+XFy8OF20=HfPZ@T$~27c
zUL&Rs9?a7?rjuO0s{W{cd6lGze9b7of_X^<T$yIC{@pNa+jU=mIZ?cm?+eX8`MwZ!
zFR%hIjiXWWDwbi<Z4iZNQefb!zp{+UxAOCigsuA(OJng`_j7X@74mgC;P1Yi{P0F?
z=&k+p=Xzg!Uu{t6^i3S6H-8H0`Tk`g^w3^bV|=M*<A=@>l9z4pG|AIA610#xx{_6n
z{E{3~WRzc3-u8UT6sf;DWuhDyXK7Yf*{y17f6i!<PoTD!%2PN*pJhUm0;xg1{4q}X
z75Xj8ivhZcic2^ozMQDvpz5d^*04IBR1*Dl=S_1|z!1Lic&hIEB!Bt)NnWQ8t+(^R
z`ML`BALVr<Z}fPZ`}CB=w17jEW?2Mv$JME**>;&6r`I5KG?s9@!Hw}PVp&QBqN**K
z6d6nuh7;}<-AH;R6FADt@$b73y%L^UOw{xIm!zP0ZKmDZ0vMtO!5pg86Vq`qbp^qK
zn#2pGX}FXfa)Elawtwc95&E3TL@c0|DSH>4PGpAu`)?UdrZLT;;`UzyC}&-+60J*B
zicfcq+%6UPM)lc5mg@@HdVQ)w+L`?4R3@NUg_ROmKNtLk0D#;B<8!@)soC35z$lT@
zGzi7ipe81s<zVU>Ar?{!s0mF&?>T0XTwb$;j>k#}8-Z(Y%YUWRb)~Hou&~^NqD06E
z?0CAB^5+6}qG1jDtNPKPgaf-+&?r{Ej#w6Glu=;!bmaea^&=gP&;=U978wDDL!P#Z
zPq+OLQJ$oQ98Zed)A!lvH+e1N4{FQ<wUu_igL>251yGi!t}c7is$gBNt4FL(J>xp*
zu8^+Zq;3RVAb%Dm?M7jq2Lm;;84zz;*D5M%k>;GnG&_YkZ+ALww=)=kTr9t~{UCz@
z0!v8ste@l`X_TO=C=nN+(4<p1`JjyfN|R<h-H^Z5BmDVdW`lk4RXsk9WzOa4g4r1&
zV=z-1w0>%u^FC|jQj!$SB)!jy*trD7<u}S?+`4nGRew%&7nP+uBRU%w;#6w13VMmB
zQsr~pR|wR7L(y}<^3j6EUJzKm3?wGL6qpFZ$36t@bIS~+VR?>Y$OBd@)y7tZF0k7f
zH4{PiZHw*f>{GQNR}^WupRYLQ7n@(pttn;VO96vX9l!|Eu+|Xg!i#P$BYxR545aLF
znirLpS%1X0TA64v0z8FSq6NC>kD7?OVd_N33Ar=^Y#D}ui7;L4JC=!kMx+!Xq|z{s
z(Ar_Qjch7b2&h({HQWoIOG8K&I`czq2Q{LpWI>D9V$mETP766oLB?w-tfWtiBXrup
zzO`wseyrq^LfDQT0tC6i=afejuGX?&j^hAC@_$Vt^b~JuC|Ry)8=j9Du{=zeWn;>z
zfh{xe17-$<hzGF556Do`o9La*rQr_t63F+=4!bJ<$-Ub`=t&quEwiWlNPUivrCR+Y
zl3J;Mbe4nZ9<4UYER!0x6<|MfEKD43Vc!fb?26EJxM>sDv-_=epBU7hHq}yR&<MQx
zF@FS)&7<zMkGR#AooclLbPNSH(OjOkzq+J3`f~C+jc;fsznl!aALg(8a2e&7`nvkh
z`Kvxn=vZG={nff=un-s1_R+<HV?j^ru=_HGtp;ZxqNcUk>{GQ~tDAiB^<t)v_BFbn
z)-`3v=+74|Z5T?LG$T<zw#>b%;EDd!<9}6$5S!P2e;dP0eJ17QbJM3?+FRPCr%!*i
zj#e);SV%aNF7~)jFbM>~zF~4K0>|-Oi#cv^$Q5E|=n)IaBps?qnDQy8fN3&|`{WbJ
zqp-}<Af{k^E5&UI1EW+8hoG~SH%)UX6ssdju4P_CBb~|!lr0K@?0J;$pZ{0Irhj80
z<LFvuw^$FXVJog+`fc)x=kXvtBlTQwMaBpn-xAz+G2z6(gbRTgH5g>Mm7(uj2DP4J
zJmZ}pAh>Lmz0g$!FAmEf*emw(?CS94#d>g7oo;knU#cS9z8Q@&skb>z*-SQg$jZOD
zU5Cx$RilkI@T04n#;H&@HDt&QZ&tjNv>4OLho-jPD3dbzC^u~YjQadCjYa;qOl^LD
zuGNG#E2DQ3@if_f_U>&s1s#2s-(a&m+34*n(RrID#iyzk2&70l*`litX|7o4>cyr-
zk&aKEmq$AW9)G=GXEpd(YH#2&T&Q*`cVq2K+#5Q0V9G#`4jwK#Xx^XhRp?U$og9p!
z)<cO6{@52~TP7uag0I7a63NkOd5*;mBEY8{Kv7;-5=?<(=5be8rbSKLqJ5P7-eOU!
zD0$PVC|C=l=CF?NdM?580Sg!ntq_O82{AF5i+$UL*nd{j34I|+D3;|a?!#K^e|=c%
z1BSJ#SkYa=T9;%;(0MY-BnLTS(EJ>4HM*8FA+1#atMYfeRCl2`%8Ma-lN3;i73dQc
z;U$dXlG3U!9CTt?XOkL$^%_Qr9>dx|*R_GGKf!!vW3YnrvVYCq&Wk9HQ6i<fJ`wG>
zU$|POwtv^w^O9iQDzI@f$<j#%q}%%qR#iQ3<sWfP$8&v~Va}z8iRn7n_uUX1f_k>J
z94>wLnCRPjaol^bD*AGwdRiH)x=}!CDUS~pjjD#dO*E<-1ioc3f@uIAUx#x{nH6H!
z@VL!=#|@UAkk8Y@b{8g~l7=T2aoPs$O0j<u9)G+(l(Y{eeIUnYA4+=gp`?2#j_2Gn
z7_%)DvmYQPkf9^JkYS(L5)(UMn32%N0W%mgNgzGKjyLjDMfbIgsy#=Z&S{G415ck^
zh@N_Yt)fO9Hz3sG1~#R1AX^y0R9XyMt}RSI;Dix*gl5Oxqed57-+PQ2eagbMZTzPz
zZGR*1h=pwsHA01h0~S#1+AgsTCtx9cfZBl1D*khofpR|~o=?^I=tDOTIdt=QBR3^w
z+&6&0ZO8x<TUeMf)5g@HA@TgsH2DM6H9nwC@d3BP`wPx|TDxS=t2$g>)v<Hhd#Y4V
zm0J6+r%D|lRmwYBoz8S!lZDj9!Vd)|wtw$oYTE>xj2o6m?a&owPnFs`RmyhpDx#Fq
zvz`l4$`g)BWI%D~dLbqbbuptR!!8LdoA{iYexLup&;S20`TwDW;}b~#-;kzS7NaWO
zGDDU6^Aimr1V`0TQ7oyN;siMIw20I6YS)NuT_OzUG?X~kzd{eHLQ8YmzfW_CQ-9r4
z``UbP4;2U2a<YCAQ-HD6WR>&U8k6Rf<%rV+vD*pF^Hw>4*C^AK2ri@1B~~d9)s%ON
z3GADO1p;@6k^w{zlRK_~4e8mK7~H|kH4SXrGH?t-`aUNI><&@O@m?whv{uu0bpqCK
zuT--SQVU>Sa<(B~1;n;w7=}0q4SyRG;Sub6zKIQsNuOE5@WM45`5w$`fqDA9E8uNq
zCbmc5UxA#=p?me0Pb+M4hJn=)@#mGxzq|7-Naf#|n?93&ProWphpyoCiTsZUtT8M>
zO<~(u63@fL3j}6D*f?+~GpX>n=kOz<Q*|V{WK-QGkAK&G+C6>$6Ck?G>wkV*k*EyA
zrIz$P%pfd{a1MoBT^n;L8Ku6<Y;wq{_m@}=d(FJx5vB)9xDS2er<ZkqnJ{iky7IV9
z7$Z>E8c0`$LvY{(F1AG|4AWrDupc0z=*UP{cQQ<N=Ur`WbUeAN`7=+@r_DbA?$r^e
z%@?K!49gT)x-7)RV<zZ+7Js<xsAXEh^4vZh<>ut8eQ%3*<6j-rZh7z&teJ@&&dmOv
zQs2+^vXF%}+jURF>S<VW2SA_ve)-|pC%=EV<o6rUH`A>6@pglZt$n8ayKuHB7lCPW
z%md<JLLDD7gGek4!{^ko!%(iNptStQuRG9qc$x^6<d(*NM0v!bIDaZ`*RYZ%6-T#%
ztv^$?l5fP*@q}hkiSk7GFaMm<`16COw^GnjpWW(&2X<h%hQu!Q872WZk{y#_YEvcz
z6G6!O>{dN#>j{yz?j^ZZC#+V%v#nutsaiwyry7D3UAopHnpQrYOwz1aNYv8AE1eb#
zrx~6m`p=SdrMOuo8GkEap>JA(U^fUHsIVL0z%VKHT;WQ~4eWp!gTY!#)!%bXr_#@g
z3SgP!U`5vjjHk&BO#r4Y2cdaaV|t5jXqG{Kt3su@!Z%?3sAi&MbgxvZ?Gsut>2jCa
z5*xmhn0P>?@}-AeY8sv|gz2rLLLZb<WPkar7Er17k;SSJxk!hjQEi>W%HzWGghQ|e
zNeGC5LcuN#Fk!-FoLVkfmumEx`7G`T%ROEitIaXG$B&ZiX;eLpYJ;`fXR&HeNiLr?
zjjB&#wX~O<K?WLs&bqow4y#41tHVrPHLoddMY;-wW7>{kVn+r76GsF%5Qe~9IK(v!
zi}^e}KKo*?iL3TXx_ZJAwJmdsge;`K=VIbXfeE)6_Dw0V$%(-N-{O*s-U`__bLxIF
zR&8x(^vtP4Nf7dcnNvqhoU%jE(Om2skm0}t(mb<0Or;2aUC(lDVm?4!=^mkZWa88l
z*erYER8O3G%EwcmzpBq)wf0}1ziRehpTFucbCNpJBV3v|q^^gFBPoU?r8w{`+p~!!
zZEsB^ThE2sC4ZHNS1_TTRr)G}o5Hp{in$e<m@ueuV3`JXZ0;LAb8JSI!NYx>zxrQa
z=Wl;ZsQ;vY<H_riWYmDK8e-ipdDX8817oboMx}T?>+?08oz;jd&1>t9O^a6bc$(ba
z(A%>!#3ZNFTp5K`PGpSIY>rNKcBY1YcGlRArxOSjiINe{qwzFWxQa3XXKK<H8HK?i
z`Hja@A;sVvot<gNhsIg+vojQ__}*EpSP`AnV`r6r9f)3*JSQa5F^v+SZ~^d_%UIv3
zvW~n)XJ_T)3z@X~f$`NpN%S3jm8r6T2uNS>2+b^sDS(wQG3w##M<32Mqrz3r&JgU>
z8sp3-l1K2=O*W!T=94tZBNj`TfxmZWxHYpm;^|nH=~5sZxq9{&IZAI5G%hFhAJgOt
z>x^Z8dAXmr2yN(P{a31|=teSh3V&1$d^v&aT#5+C(-`J2N|P@q1N5I`LG#Pk>aMf1
zc9yex3e}gjbq?RF>}2JyMK;ahWq?0}a`p2m#82fZ?Du(5CR$UEIKG8ij_R^6CrUU}
zcE-)-=Im@q4aXt+<r}|L8EAA@@B&YZj3zmMyyyYSrZKoNppjoclrLD{n3h?`YD(S9
zQq=SlMj+)yg!2g<*Zz>RvvWn&D}Z}bq$r=HMVSUItwgorY&FjUq8IB|*GT+jmQF{P
z^*i7+5oOXkSm-4hUM5R}p)RdrdHVUykG~BxQofdF_%`L!ypj|>aCnuSwN`o%l?bJO
zd08X0^*FdJ##yZ>7L7(SFIrjN(1=d<m&L8E_EZ`Xyz8x)hc+{$Z-+JxZDN25;b7n4
z4)$%+^KI!<#;xZFQKpk-<AKeK%jmi*r?fyfAkT|7Or2f7JV;s_XDvYaB}hpc!iOkZ
z&}!Oj-ynz-u}sn{0UKZ%qMOTzUv?dTj*wVznya%zj?ZT>%r=CnzWzDNWDB7z4_okw
zC!!5<wnH2{srfbNiT>@P3Yvt;X->kjrA1eF&&O@JY7l#gA@FiBEV?r)S}i2yBQE1f
z;Q|nfMWqPpq%BLHaEpf@&RjLD`dt-)JFF(?i=qm>Lh#ir99_5c<>V9;yTO-#leroC
zAhYV3n-JB7lRNB8(n6+Rsb#?Hn~qP*rki0@{~Eodb3+tXw{*MG(^fyhvgXvaswp)y
ze*yLT_H<0I<X^cg{))oWa?0A*gFL~(Jgg=HzEHia90K}s@>*Tk8p^VHYcIU{C;tH%
z3kC6m%s41}7bt^ec{+dR88Quj<J>?mJ99roX8DebbOJ#`4FjUNcQ$;u9`}o{7farK
zRfC~yp(?^q_gaS+x3o>D^Dx_WClL9&=8EcpJHM+p+PX%4?khelb?7Sd>A<1(c`-Vm
zNafA$T_4I?_RxnHZx&uWynlI==)0ZdkUX>;ZaPW;Hx;sJY;gnqcJc~;S;kWn^Ua?i
z-F|*6#8|O8B#*{4-f*37#H@a5LG+`HPA<1R97+?;+TcB$6zSxr%`Le_EAmr8izqK5
zuE_Emz5C9RG}qs;iRhkyx+1eXKFl8~NPLHf*zA_wme$r@)?L;W>?YB8I{p-m5&#Nm
zQv4i^q9Who^ln;tn`tC}r*6V}*rm6T#3ZSZzlyh!jKxlZe3GZrjJKQESbR<jnvG<!
z)2(Vtc%Ok$P^p@myddS}YTfoZ9gSiM?<S;iE;pU9Pr7_tGL7SnI)%>oyXHpI*yM!M
zp);+0Z`1xRqidP}UbzXKO>U85B!61a-F?T{EJ6(d<pSJbt(IMX@fkg7x&gJYZ}=1w
z#zO47QeuZm$2GYd7~!)_1eZ=`kz)ARfeUpoO1>BZOciv#99Uf7rkVp6cY+Dge?_C#
z1)0LxVOV*QrO9Yt=zEVw_GsjeXry+$0X6YwwX}L5axD-!J7tfGK^hxjkR@S2kN3sb
zi}|<SLy%98wA({}klp#{A;?`#$O8vwdI++IAdg?ldkC_JAbSXMc5U_$WDh}h_v#*k
z+!BK9Sbv*hk%ko1HXR$AhNPGXBC&69iaqI25d<>u{fEs&+>L`bjTIo`v8OGbW2XLR
z{f-qy^|{372q(0C=@3k9?qMQA7c<8VFk_TS-;pL=T2*R)_xPNZQnwx#ZxZXEx8SKk
z@8pOU(X~8%`)+_fP1!ig0WoiK(pC{07~@V7+k&!{32dv-4s>?5x~H=<G?5ut*G(!O
zMJ!iHc$60zEz(R;)7Qs`XdFzDxXbP{36yw%#8Y%huVFl8xsV}J)K=&UYJQX${n?oU
z@gevEP_VOqa$1Mz?;n5D!zv2OFULACU^(6UpwpWBciA7x6hx+tF#0K-+&=z(u=5hP
znMG{DDfR;{F)^i!8RrZKTrwkYY)UQJhv2QF4fY{;dkMi?u#Ku<BFHUOZKiw9LcZ}P
z-rd5xJ2ynY?P>2`xpTMo?Nz(>+Hj!{S(Ii`5ka(nkBZh(6I{SR;CZ|5(qfuK$>=o%
zkxa8p#YuFX#gMF=mAT2Wjz_Egu6v6X3M<DkuHWnBHi1GeA(mk|1RH`%Oi18hCL9Nc
zoCMNg+?3*w>$WakIx`}SJ6WA|LV6JBW`&h*_L;oq%B7hvOKQGR@2xbIGrgfx5b{#y
zht(Q?&;dK;gp}7o;E59XA$n8G`=HK-o}zJ@L`9mFORY(mt|<vhxFLR4pcpb(qekwl
zMGd87HOB`f<@2b9>(#x-H0mvx)-M7idIR58Dbh}82^m-cc0=33#P9-44co+=g{~iP
z(_vPho~xa@P-Qu9r!Lg9-+kL{;hY!M^No^!q>rNn{Fvwh6=}|COtW^Dbkt@IjH9H9
z@EQ!7Cg`_~n`j4#wVIeu)&5hQPQ{zaWIn1+hiNJPf{OZuh4AI1S-vxIZp{xR<)KLP
z0?vlh(+SOT`4{X>ryuE!>gi`%(81umd(&Xpd@gyY@b$%ZEw%2PBV?#8=&y1&`Rna}
zJ6*^y3QuQ85Ajh}8THnh2pzKqjWjoWsy2-B^2N_^0TmmgSdkp`DAd-rZVcxAjsZ5=
zbwe=jcL>$X`1{A-9{Pp+{o`*72BJ@qhaO9FcFl>%1~X&c>&)n3Y&I|Eea?$28(M8^
z=mN3!P6=7BX;N->DrrRPT9sb_E-&|g;qqcQ#?`laYpuS`3pr7L>iy#%X_TO=C=nM>
zW+|P5ns7=-qXC51*L`#uK&@f@`Jxmpt*i`Qe7)c)jb+Z|>FkCyGzM^kR`r)%UhN#^
z#mXF5c5S)B%S-El{Qcu^E5@NEZuXv*dbRx4T1vW4vbevte0Q&3+1HFb4vhhSYL%6(
z-#N{BA6&VV*%U`fnJ#xdElORtWe|-n0P!1TGH%^@k2NL~Wp8Gi*`d_LHnETUrO9+3
zr@aO2^b|j4fNVVabF_A+?H?mm`}m_jLwEl^c$tFDc>9N#OtVS+gx*E#h}iyNZY9wB
zpVCXY)8puO^CTXpqhjp(Vh*N%&d(w&vITG{3}-{^#$>K(Iu65uMNLc`+s1+8n%Dxr
zYCwr#2VEIwBS7%rVaLZTgVK^gc8k?8w?hvZqcjM^0Moz`m;?^Rln{<xMmUwe?^A18
z8R8?AKnQ7-3+j2!)M?ta<*JtL2OV2CL_ekDNh}K~hUhJgVwGEQwyfuWBulx>bLDj@
zXaPyyD%i5U^{BL0RY_Tv7DX%*sj7cw2#SYh`4bXWc#y57)o=~&87{Vo1)-ak#LPD-
z4lIL(MEKkhJ=VRlOwW#3cNa27$B7x2BP>CbPL~&OMHD_HXgvHfV}rm~D@JiYu<@`=
zjJMes?guv>era2jYld)tFMx6TU4V}Jz+-3wqV1uyw2%iDj%rp~*5w0_U}jF{Evj-n
zUryc^moocuGSL4zTi1e>{%;rc9kZUKRzUBfJ2wX&*QcIP^vyR3jc<#H=f_i~>wa)Y
z4zw7l-rC<l&sQlk?%NF9tI|G+<k8j-3q&A1lTd6s9>auk8#B&-JZ#&pVG5hurr|%w
zd>eaH+LWE4l5r@NTIb_!{l1$9H?uL%R{jD?Stig0TA^&|YgA6s)()=*d4ZPQc0O}y
z>(*bz#Rhl%Du#1P<_5RT40E4~rJm+$#x9T*%$#j%lu-g{Tn%-cnd*P71^FdfhfqDN
znHk#vg6mJBC$js0>m_^4+rQ}sp%I!Ko1qDm%aGx~btLv3!?W$sFnupLDun5!{^~=T
zNBXM|OQ508Sp@9gKV&8%UhD!nZPrx_`_x^QJyuXu%{J};p+CivCN&mCfe)Oc%k-vm
z@F+gzD5F3u7E?tFF7#7%u&A1WscQ#35fDm`6knIKu^kkDWsA@!CX<+(%)msrCibQ6
zW7~A8O(^l1Fb`O)A)--9Qm#cw*SF|O;2ch`Wme_v)^kjG3EiuFU=7U{F1(CJmrz(j
z=XV78o>6e>nmMN>VYlJ&4$yT(_4pb=uSB($x+{6B6q+nzQx#gJ3ehMEeJ00JL`}Jy
zNeZ(R(HKpCRC-Dk81_`fHl5&-q`aNTN>c`|8xm}WL||fj9u7S2Vrdzk7jlF7A?+3M
ztrhV!E5DhP+wdaQyxL^ulykLvM#*R|O1j?OXH|6wUezTjR_L$gMME^Nsc)q9YF!<*
zZvRzWY;-4-#ORz$t8V+7o~@5EpT@;`_c+@`Rqot>(JRVNxw885llqv|WmklTV4j7;
zKrl=QWCU<riizz8fn^Fa2w1;KcQ)xs6|++Y=YgiO94y&<pIwJfFTg`~heNj6WMQxV
zbq)5Suh|(1L1_Qb#h)))R*9nc*8B6HFVsB0_}XAC`T^!D!OS#*gxrSm`|ObSW2mRH
z3%B=w@v|6io-|M&kw2-2RtIJIA~br!FZ-G-Pc~KDCb`nXC@$7!VcD?L2e&XcQMF2L
zj>9=4)Wm`3+n9Jf#4NN-ETjl55}MR9jy|*+5VpBgP#Pq83mh!UFV#`jt$wS(k#fH4
zQ~)LBQ6*Fl(`<;~Xewh^b&la2{r>ZNJX3Ig7uaH96a&)?LPhI>pSmG9y`hB?^n0n$
zzL$z$QD<Er=#r{6@TleD?Yp)brR(R;*s_p%9i7h33;GUSEMTj>EbZ&4tdU&TgVhf=
zI7e?3NTgfkG(llZM~GI_cB3-RtMm;~j>1g-b1IV}zHR1^=H)c*AG%qY8Ef^*(k~x>
zS9ue*!*EPWe3J(rrrdWhVXlR#?+Wag%(j_Bed#_+XR6N9J(H4R;li4Y>aWnna)Au=
zQd4V2t=El~8YIe4&-|^ZW5e?)gIbOoMO&{iHTKV-L;Lo04$%io?|XXN+o-ATEgf&^
z!d~<|X;#>BJH%?)A;tnbWHw-|ZHRP#M^p#VYa#ehzU>RNOI6y1^+wBIt04?^6Z!uW
z6_;g}`8xD=NkQ8|?ZBz8Z2gQbDd2?V6)M12?f5IMRlln%;Z#_0A^coM=+36PR}%*d
zU_~@-XHHdI?SH_pGeQBA_#Y~)?R;@bfHrHhd8r?Glk|V~eYbM{7pX|6ES9H#b+~E!
zt(3vgty^KXt+~noa~*(Dx~@7v_c0+3R=;`#@4i)kv>w@<WORdd+m}`zy;gi}`)BRp
zYa)r;zbPM}{%KCXdGYmP_E8sIr;4J^zmGmJ_o%J(1=72dwQk(MwZ78ew%0?s&!GzH
z#vQK69=$=C!UL;gP;RV;DA+-NFW0?XFOzGf5%f~6=ceDSk7Tz7UA7l$JvF^hABj-U
zS!K`9CkFY1dlmios)Wr02|LL)d1%?*LaxV(VYI0!plvHC1#awV>1;q$dU)&h!HwJA
zo&4BduZ<9|inr{z44lZA86m@jc`go&(8ds1LM+22rq7;%XIanY&ow81y;~7`85Q3^
zoB~x&J18oTF#O%n@fYN}t`lJok-V1RqfVzIRr32*-yJ0p@a5wwxI@R6tj~VWrbVkJ
zxR}B)n|k17via)K&e5+4kEf8eU#OZpIk*WvsEexdJj3$yr*xWesom1`BvsU47=(}#
z5(t&)|8@5NdJdVqq}Ne@I?bMptGF7P3J~7bO>6}=H$B3!VFn&1JoGVRTw>b|C9$N#
zL$ha*RxHwTQEavzW)_nAK;ukOF|!hWey?O5g3=|rp*f<9W&ED_sC}N5KF`XX^Q^RT
zXQ*TvcX#m*-^t=8&8~je!Ck+K4H`Lr&%lTJs~8N1vpf4nWB6HrpEtKvr%9Nezl{<a
zzg5({DjH<iJy>>by4y_EZ1>xZ*%r$?&<EaqktWoY-7zD`jq)z7KCVoVviOXipM$v<
zI$V@mW!B-YI{Is&n_YK-sy@KcJ~Na*U(^qzr?9?e!SK+ZFB*-j9O8?w7jvWT@X`_7
zTKT|d9;I>gR}A=nzk0{`GjNPQJCu$XJ#+n_{pd$Pf8USkwGCDgcwP_?%fgN=4NRoX
zux}bRwgN8{Cie)DYYeYF7xX>u8k{P%1r*^l@!Mn`HhKJ#oDWl?mpIhqCJ@3y7GffO
z8~e5;u^Czh4T<G>!TwA1T6e9{+ai9yOAE=;^h%{~TSxzY)^EKEl9M7@yFgE(LXP|T
zovKD=A&`>&i!Z8zEv9iaN?rl;_VvBh?^NZppIrG)fJsyp<~>yIq(F+khREYGea?Lp
z?1XPe3DoP9$%u}msQS<HA>t`SE5Ol(Ti=2eH_huDJrfuljIs=+*Evz93FPZ3B3%Eh
zF{*u*?SzSc-nD8crv@Xwbg|Ebk4YE=kS3qvFyNlWx$ha`$Q%G_!8}&c&biJvOrEdv
zyMjDlp*$K-V`awW1GJ~goVsHAJUF}GTAZbz?ox`=H7NI8!^fWQIhZ&gvD~+@beS-?
zO=$QKj;cd0#i?KMHtETSC{ivWwQDIUY>8g8KUd;^^Sml|!b(2GOzh3vz!Ti9Z0777
zY*?vMb$pjvnRn?|Z=#=~aSJ@G2QlXnsxIEC$3v~JxU5`aM_^W0OKiX5D&%SQ^s0A|
zxf>U~qrNQRE;&m2vV;dwLhir|;Voa<+dtDNlQKDmGK-tPnGMk3`v!LxSd&}VT|3mY
za8_WK30DRle<ls@uS%Da)Wa&$RW7a_YjnAkFx%oBGfxssJjO6HS%5=gIwJI>YX$uH
zCG~!Cd#^%f`qbWS@a7Jgy-i|y(k3Bhk`PQB)5BDHHs+joo=Zs(O0P$8R;5W+Z{dN<
zmCPBxeYKK@tX9(3DY>VLSx-q3IOe>|)HNN`@=PoPm!?++5r52u{yee!jduOV%#GhY
z5&G2leQNw8+?$_MX8bU;%|KGj9PR+M&c=asI5u2|Qo%yvI^xI;OUT7K8*5bN-8xn7
znEz{<T%j<Hh0F%~0Y@6nOP6Y+BAOP(J*{QYRC!~Y>N=X?qMGDs5=Nsb#0C~=6)4!D
z+$h=)e9?N=>VN1^ivotp(r@SJ*FvYX%@HKERTpHcZU|x&Xa?XxzJxO>8bL5fYe3a<
zf^VRnz=n@D4++hoKWW(1HPY!x%Q?KH0#e&nLpVo2rAZz^AN-OgBUM>z(WDhA`oE_%
z1Nu&)V=1rGNKJ6wIc)ERB=L`Fa)rxRu$_@DT-){o!+*oX4+JLM_c8OW5L>Phaw80c
zZ9D*;d2H%d2M<@$wIVtZ)?xEo6_Km*QA_n^%f+>2fa2kC4u)XtMw3V;MHOjw@kUoJ
zt3J=wQ`)9J{63ip`>DsiW6w*Y1Jxkz7TLF_Ft*vOzlvwjCf=k8njPqZ_un2(6@m9#
z%C+B64S%F{`m79uYo*N{E)bj<hQsQMtL(t&qKts+3!fZ>lHNWhk6A<KrcE4+Gc0|V
zU=kW8_Fc=yjv3mLnl@wX0bD=*q23?r8y)Jy&Fg6O=YN0xuRZ@u_3-zf-~ZK^X`PB|
zb=dgtvban|KInR>-bPtoG~wnKC{k(vb<Y1zvwwpj`f{QwG=Di6HcB+3qra}?Z9a4H
zpT^h0qOLwo8K;FDrP*!S*~|$3?V{;M+Y4DnZ~uyAGAb^+o&4Fo_3HrrfQ%u^i;UA^
zrd=5PE7TeJ%C^+_;ih+KEC10cR~4#(!@97v0=%I*1BOzZeuC9sms(JIbn|_sRL#%A
z#a{(#mqh?Ac=Ov@MH1GPwp%sog}Dx(ofls(%2I#m&lgH4y9xVOHQFu?Ff$vi(g5A(
z?UNN8b+Uq433_&E3+z5^!BOTGeSi$-2bf~{=w9>vr~K~U^0P@Fa%Zq-o0pAR1{{Cx
z-o#}Fk4#=i@}?qDpZ-p>D`kDWOMx^!SRCKHp+8f(MO3h{?nV1U%G{37$(UwWQs@GJ
z6eX(5(%E*7KC8-^o#9lDI2z}vs#3`$D(IC=5S<q3m=+ONX;M{#Z}eBn&vGsEB7&j9
z%?ZTv=aV$ap@8PEA7|+0?HsP<Se1XLRHZUdf~SL7^dms-fN2teZKqwW>9pV}#Ny@C
z30$VUi5X4u3C(1}Z>ux`8LYCrcp?OJcoVpM0o!>OJ)f}9^i1s7RAK^tMrJVsdm(oW
zI}o8|n@7HuDCg6R@>_JBcUM*E+rHBxDl5n-7yJ;`0sJulxdVYxu6x?<Q@elN^K<lH
z(daVP={s&NCAg0|K1;POe@Zhbps3nyKBO6B2jDTy^C*m@5^_j7l#FJb>^d<)S@gE7
z_J}~?Q9n*qe8!SByipdAGBo6W|L6bHp15`n5SWMm{h$A%e*IX-o=*$dN6?tY5s%Vo
z{=fh8e+Exvjn!hZ-2$_PX?uURZ)2C(E+&>~<G{BF_N<Utgt?v-JV3GM13~)dNFc3!
zTpt@vTACN*N;37v_o5QblC07+Q)LPGsFv7Ay~5_|&7x&)`er$+B>;!T0^WRcmBPtu
z1Z$~7w|&E))6|D7oye?+Bn)!N{pY`^Yo%x|E*lwNWBF|Y^CDvj*>Zo-MXSZOySDuO
z9HJy!DU;jNQ~|aXlGYw{S@W}fIl8DD{R6U=sc87k%ld9eh}dO<hx3Gr4Q_1w&Wob(
zyYd79ajhQb{2<jP_a?sp{CJ*(U=ADXbh!8u3oe13bLkbf27lEtqdXBRCGkvzht}ra
zlpC5F&ddmPLe};J4v~L3G!{2>(FWh=ZX68Nfa<H&sG1Lh6#~{B)Udi~xL|Oz54D14
zP+i(n0uF)_(AI5_nG)bJ<_XhuF%zzdi6k!eO(C#wZ9;8RdbS(%io!BQL20r}wdzun
zKUYWg%a^~5&b6kl6;e=hX_*oUG|<kiQI1}KN?InU3!&Qei(Y@D=rxL7qgbs`%pKAf
z7c=KMc+9oY3J&fi_tYwpQuVtnH2eZ+pyGSBt;~Nky3)e7^}S1*uC%d|#L#ZJt*9+*
zx~+sQH*mpP&z0kQxV;tyU+`)M2k`H}^s_2}wjAe0yW<TsxT>*UlRF4au0~LfS&j2)
zXtE$Qa1b~g6YhWbI0#$=`_c`#8@NW`dj|}te%6&mK3JMyjdaNxh#S(?>Y`*LSaf*}
zwhvYrKBddx)eWa1iV_CeS5;AJE@S1QYE-9XqSPjT>Y!CBO^1qf+C|skCWS1&0&yC1
zNP$%bmP};EWl}(B)uMDYlX|qEe_mGjt@;aRQGSJTRYZT~9<tVKnZ3V?h)gGVV%3EP
zw{;u{%E0wz1d?OoN()md2@WmCmA311A)MY^slt-9Y_ApRb%oWsiCGn4?N{9byVWaE
zh1ayAINIl|`ugW6t66tnPRhGip0>K-w^=&Ym8o9eG0f=zs;>>#Gop_*hG$Ml&<ZK(
zzS{g^h17qv2DnIW6@0qzmKKEC>gul#&1MWTBho30<!J_ODloHs+PrKo(9u8xbcRgB
z7$U2B6-~vg*_#*9Ny{<oVFK}UX5_#LojvnP`f2MMxJu0hDkr0^bG6`p^xb>|tx4#~
zrbkUSofW2MM>aJ{UnA=nS%{teucsp(JLz=pP}?%;m6QA5$X4z}7T=g3J+~)rapPE_
z8Jp5=byd8RSI9Cpl!gc6@jef-_7Tu{_ktsALzmBA1{;4s%YIEnbRCH)jc0(feE?=r
z(|89vqe5gd2LR$Q(6e&b2Zf&LF>i~WQCIq*pbi$oa4-p^z`iFfY`TQlByjA&eE<sk
zL850`&Q^)`6GzeB=%GIc7_D2<exsJUxAaKdK9RUm^0tEFI`=$bEUp}92aGGf>(RJ$
z{GqB;tc-u|Xe>WMQIkhV*W9CVJsP)AQu=7o$A@QnH15fv3OyRvqj8-j+oN$k8n*>5
zu?-sMdwwWPN97jwFcGf6EHDFXFv28tsp&h$;iGZCCPhYZnvM32#I>=v5|^lY+CS*l
zY55t!ZtBU?Y_ucr=6lpJeUo4ha&8h!+L%geVPb#UF8AF)*uev&#y@=EZJ~HS0`OLj
zpoiXi=<VJ~a7$&a2jBJyzLnG5li_;!tv(HVGF(rFJAOQ7W(Vx)aL4|_AD9l;Lq`wI
zfPM(J-*A7V#-0v$9|*-Z5S;Bx!6{*w62r#Cls@*k#jwW>Cvaq7Gmjo21UFSi*d8#r
znf8D73&NFoCKuymvyj}A#m%a@*$y~!EM_q7FziW(U_u=bQQyNp^=y~=+_Hnd*841Q
zwn_{)2g~}Ba(zj;=UP&3OC+vMd((?=mQtokXN#F+`VK&`^j}M`t8FXFt=G^_^2_w*
zO+w?_BI0?;{a=4q5sjsKN#6=U+<K1JKGT2WYZ16#8~lFale{eob38Q@`1wV)lD>>e
zAF}oM*1$GKs+1Ntg(a~qh{VLO2=<9(;lOv8WpU;a&pCV}wW&|`{#s^P1ndhT!>Y!)
zN^-Ubi*=gIPSFBwk~Y>sX)Y|XQI$%VW;z$$pjEJ8w{r84oUSQvEvC9idZP1T;_83V
zCutn<Ta=b_(xRpaS*W4HjAf(W<h6`-5X-Rs{6XD3R4Qbvgs&QjkP_G^QIadmT2-&F
zdO=KH((5RlW>3YQ){|0?Z#!e!5F%hUmpJfDND9vw4r~GS7o5<bp(TumSU?BDLfOV%
zt}>hJTgvS5ORBnqxPuKP(G7)aAZ35vS0(3SfuQ%McwgQ1IahaY@7Mo!0h#5Y_wG)w
zzh7aMuQ?btssX=|F<+h8WgO*;uNSjjx31B>x2~zqsXt%n5h3UuYJ|4NrxAn7byr@n
zuoiufB0Sefu^9<FL^Of;J({rh3GdN_B@@#pfH}YfFf+E$Hc*0T7(%+7LfU^90}~=V
zOg+=Vgap*~0~tu49zB!*O2aci64Zcd9APzp0FT|#*6J^g2SQNOu_J=udWPe1Phf7)
z5EI+8F|%xniD8%_<5Kv(-y;YQjUe=p!F;CVxy&Im=8+2diNZz2%#<0c7W&#`I9)@y
zoxbLxGM0x`fsn>>U(vI%-=2Sa$e@7?X7={An8Dh!;671<xy~2C26Kl~j~nzEX4JnP
zH`w4`&qC;NgGG5`y*_d5Q74Y=8bDjY1}yMGPgvM=EP)AN2P~u<OVc$&7E)pm_wZo@
zZIF~Duc1mM82jTiFE#-R7T^S}W}z6DE@ZE4{iduoTnD6fnHNaM3vGW~>V7$8J`yrf
z1zej<wYh!}nT+U23IIQvVx0LjpXl;<!&ardvG!Aep#{!anAnKMXrgd(&BUm?Mk6|T
zGSqv>$f956mL-<FAfN^{F!gN*6T>$!a{`Jz+hvANg>M9XlGvJZ-@(DU%cg7VxAULu
zH3#cQ$<qvKldni`s;_EMZo#IZPX#SDtVpgdZQc5-xY(!w`f%6s=X*~I+pYYlXY2x5
z!E#@=p)6>#_GP!Q1XT)t#Srv0v$kd1aa$9*wXLaLwJ*Ll52%}%OHDe{hO#F6I+RE4
z%ze%*Wz+5J@AQQw9!+uDq?b@-1|WYqwLA^co1&on3gyul62pOdT<Ov)or$wXLLE3e
z0T^8=>P?HK!$eHs&_w(e42N9uX%-c?h~CglCXhCa)A58xqa;5^pQaONFGup4##7x&
z8ZN(elBJ`Jj>i(oFa$OKT7M6ELup_{GS{)Wx3yuR!ziDKB|z1S$fNO2_JEh~Wd<03
z>V1B*_JE$~#<o;B5tqvEa*}UH$KO!JUsj@_()Tygo%O|c(tPKY?NvsO-Yq^w<0aNk
zuSfUJ4gIgzqgNaiy&nD4Qg=ODoPAd9*j$^Y%q2c26cbKdOt@#`zzq%T`Gg0I%P?@w
z)!Ov(AHOd9Y5Amp+AJbCu4w#6lt(OoilYL8hgR%FCzGo5$-8o5K2x^p@lSX<p3p2R
zweBeY<)2d;e@<8411hX)e7Od;;<2h%Hp<fJ1Yu;F2&1>}v@+j<E0+&JFR{&#lan#c
zMk?FXiD^u}t$eNt6-q<h<XT8#@MD^ZwTolLOq5xWh|i@(DE2txm@wDHlz1k87NN9#
z%VSbl%d#{tYkTQ@tT)*<Gu9e2t@M_BNb^X0OFj%b7FkJ8RK^$lhcT}HR1t6mWnk=F
zE1GC^u_iO>)Iz28hR)7b_jGpFa_rOuw-gEkj-w>Xi;NbjW}dF+bZTW$*_mbcKza*f
zIs!8b_;0Atu`(M|M4<u5RGu||rX|hMyR_tWLPIknO|#OVJ2}eD!!+))dxWrcfbako
zoka>hT(M)6P9|SkB6KWF4Pjvt1QZ8OD6wbwq3a3eP~q-<sabbjYprP0cWEJ6nqK`4
z_Re)Nr+SC2%2`Pft;MBJqC$?>BFm2n3w^Ji0jUGv;>*bm=nAh)!}#tAHDYQv#ypK<
zI+w6B2p@lwA7E4ZzR1e|7j-X?a|Y8m8YQn{85Z3JQJ5wLhU_=5EMxMm{Cp!}BYVZt
zSiIK#++0S5d|eLsyDuj{EZELenEk9@`}>!L&_jAzjqRnH1@$-l_olsXbSfTXa+1kh
zCIyl?r?CBq(m^;W`z?2)Hes0EHi%Rq=@^YAxW<2Tlu;l613s1@FwOPugg#%&T%zK3
z5^);G;P<{x<7<HEGN3k&C$aoia`iL$&uOGUGx=>IGl1EyBY87K`IKM6ewabW>VhcG
zr{MqA@K-WI<7r$(lenb%4-uQ@5ny7NXHfxNLto=*5^)7`<cLYQjm0Uyl41zkDfrqo
zskwh7FOQ>~r%4!%rkTF!ynF}kN#r!kZZ%IJLz65@HCCs}Pk<*spT<DHM^qC5)bS9<
z=?#vfynq@4Y9Chn`6x~qxbb!G{1WQYsU&-oOah*PZr~i800Ud=v(b1$d2#+d%YK0W
z&dvbX7?0tU5oL$3&d$(BHI1#=Q!g3UFS&oLYEV@zR%1_-JW_>oVXR0dMFxmsnpLAK
zrisFkQj|$C<+7e|B%(Z<svURv(X^q;-`dV~L^=l9Qy>-Kg)-YT$$%vsA_I<P;0Ks+
zAu%;AAG<zvZQqn45Z(bJ;j<e9`lG3VqQI;lGfA(6y;E=|ZP>0I+qP{xnb^j}wrxDI
zZJQJ8iESGbV`5vA$)ERIU)5i=cGhNZb#>KU-F@OZE^(idXK+Nf3-bwP+L~)JaAg7v
zK(@zIs#^`Ec*p|b6S$O&x_As%?CPSjEiopp9n>#!2pi{)jMJdi*fcempKmvP<{Vk0
z7(eIxpdy10QZJORNZ-HXYPZrDu%qwg3q(dH52T$Pu_m<%3dQ$XMi+^~wLy-M2>d2$
zPc&}1HkWE)Fqkf>!Da;|N-3wZv{_}9fYvoHJS;X5Zw^_j*!#`y#KTBUU*%?7iNi(=
z7Wx&ks%K`c2R<p;X5^o`OtLAjKxds(N<u|bE!&ysJhSgVY%k*5&tQqN-FLanS;io*
zrG_lWF0Ar$RFlETn5q-6^)|2&^eM#3p^v>BEEHxdj9oH5q7d#X1I;PTBtFL+fYNRB
zc@t|%EY)domz{y;kN6UZd2RhK9C1eeJduaZ*C!rX#r^y4!ovxp`4-VW`z5$fU;`!}
zUJ*P8)CUz9Q)sTW87vg?M-g9AZwm~xhTpJS-Lt?2p)&rXp$+-R#TB$dQxq2T=DJ+4
zy*fIhrgT|?J(dSMPP*y;1pNRX2*B5?t}TeqOTZ~BhvjGnx`e~8G7No^)%4FI9gVU}
zi^8DRI>ctT8YX6JO>b5!k#pT1tzV80qKeA}wcX^JDr8Lk^3oMXmj#OpRv;qz?!?<H
zxvLHT{EGfaIk#9bxH2hqnQ(GI(e;gv?H<=J)c153XT`q3U#zinKs5kbmgJ3*XE5gN
z+x6#|wk-)LRnLg=w`%G(llRi(lz#@4$dA_Yzf3+Z>M!FUFYjk+yXUC&rrK{>7zz5t
z&s-l`k!m(30DAn}mR$d423`FV&xbIf_4G+px3^dNLmN=Rs;ukbPp+icwCvC|)GS~A
zn<Bu5xr`6h!z*7Gc5eWX;w$LsMfMq<KaZ~AXswyFRDT*JAYV2?@Xl1&TC2}}MEyw8
z%H`D;+zN`nA2b13=i3C&^*cBg<FeJd41elLFGkHS9BXJe0~85i|A3{1#=Yufyl^gP
z!<=2zy}c`hCTE17kOx5}zCj&_TZzZzhxG96RMf`t+8=@rY!nlK*4G#K^Hw-fcr!6*
zyrWCG2iPE15A!&(szDE#%y=>XhgVG**9S$XW=bA7K<rmr`QQ6J7&f9;p5`n4cy^DN
zG$|w3c!HFmBd5W}!z`h1&bE=^`}Z!BYcGadf=Ogv{C`wJZ&@W&(35<x7Wi|U@{zE)
zW;S<R14p_~g)(<?759E_LgK_`V6!=-?=rlr@V9n-Whx93YR$FJPYO+`Qv#ZoU%^;v
zm?Z2se{CSsw#fdcMKDpH%C2Rh?L*8;8Q)ma|LbjMF(TvE{#(>3{;HW*Cepbb?MhCs
z$5?=6%X3NYGFC>UH*>BF#SN=b)O8|M5iFIgDTqc8Dbzo!-UiYYnzxg(I!T)cM%jk)
z+<sF9iJ+!i?a6P4cF=vGDGluXoJtH1tt)?UptYn({vZ$cCky#dG*hPiO^>m@agYW3
ziT9{;>BIOeLpTh`sg4h_-2lQ+0Hw!SSOuf1W+1VQ_uxffJ>#HZehMY>v8*)e5vjYr
z>0>oD0_AU;26wgv5!}2o#^?627V`P2y+y3LX6*J2fNa&#+3PFT8o5HXldE+vLbb95
zKh1wiw@}{yJWBjc=Ph60aW_9Ga$|R8U-t{<oORIOX%PhwBxB^0*`a3?!m^nhP6@-A
z5T&pa2B&=H;-KMjIzKfxD@2>leM-Yww?dh~-7t`Bm9nH2UrYuzXqBc=hN;iJ3XVg9
zIZ!I5iqQ%rn%Bb0pbbQ8sdQvuI`U$IJ)AKgW==}i#hfL1Gfy5pg9#?YAl6muBSoVq
z_eOfrTjBwr)nddx1rqVL%95`fc{#C@>i$%R36%r0Hrhpmq}sY=MT8t!JW4laS^Cra
zf#80}eQ_I=GsTfXGgGVr5d^lzhK{<{n0Hi+drj8th|%<usl2gtPd~hRk{>IYcHGex
zwMy%^1rBG3o+*pm#I_Ue^x!j>sH>$pRgLn1Wmgq|^Dsf~HoRjH0DohpZ!>53(#$mJ
zqPy}}Zt(FhV|QDd4fm^9Uw0=xr{mR$YQ5M}DEIe$Sd8(NR-qhDI-+oxs*BnKIwNKb
zzPi#oVy-OF@TM1E)%a$-Dkkn<^fw3)7N9Ruq76Q@A?w}o&;EJ5_#_jmWD|eo7B1IY
z2fPD{X$0b2c=IvZD%ksw!cXBt@5v%1L(>>~bEkWPI#5E|h&PyuW8f6=iwjD+Bhd^_
zWdaLA|Jhr37)fQHl|CR4FVhD*XXK1RvW1WHaED7nPUm|_Iei-^JlykgJ!1$-+8u55
zirz2p5|lJ}h++vRBbsik{E{RseV_Bs2~~h<zPKUI6%LZm`N~|RZ8Oj4z55$s+bWK{
zHsVKj;#VrggOf@BA5h@mVAVOM)++nQDg|PC%B5SP5ub@;&qz+KS_AO}Rq_3PL2+-6
z3G^*C?jMNnWX%yN!w#7J%?cwpYqu2a;Nc3SkW{_QPJ8g-{uaNDNx;dSddNqa-H!l6
zQew>2v0X~gy)}}LX18*jg?S5d4&mh-wJ7i*qL^A!qd{ld>)ifR4-6LH5k>!lRG7gp
z%7^v!GCc7FJ%=d0U)mSWQ$%fgak{|aQYl7c{MP078O6*apUYok48GG%V+<K}@s^|b
z=d4rjVUL+d59kX-&35JGV+`DAW8?rMoom?T-(<hmkHVz}L6%rbGc%V*dyQ2t*O6GS
z0+r8xOT}u6#@CO9(0`Y(e-KupeFNc*WO1fvY0RxczsKGCxr#`s$T*ygq_OdPr5M+Y
zRYL{GT=-MbuqI7IQdz=@O198SLS-&UCy9#n5LLKT7s*p2;*{y)%AsknPoV&URZUqj
z`RW~__*dZg#Dt$`GHLXd)z}MT*b793TO|TQ$QiQ_kTjNixifb%XTJF`UV-*hcJg*>
zV<LMp1Sr%TpDcfh(22bM@hoL7+-M-G#p%rsrp5WsE6}~@refE|x{TWW?%=4|8}oo&
zX0pm+rU~5`Wwxzhk@d<pPsRq^T`^==MXzg6O!MY8;VHnF_n3jbw22VkrQR=}!49t^
zwt<t_&pjb7u{2V{4uv|$gP+ORIWaMyW)8m~|A-lI`3)iBV^|bvp0thTpp^`tG<sJ)
z??XF=7aZFJRkyrp5~q`{%`ZY1!Dzx_L}Cuv@%U|mP+-Kv+A|HTOt}Dt6a@JpoMYqy
zr>Mz?F0nM(8}lyT4M_Y`;OuagM?$lqEOI-(@fFN0_BoA(bFDl%40bE=)nzbd<w<89
zGi^J*55BUL&lD+@$X(8h_^mBp{SWT6=v{(9)hOKC>dxExFfF4KEx_GV@usrAN6oCs
zvnDa9|FThDz~&s&eHP%+xXj4KK_CkzFZQg>N`SC$#;xeAphQKzf0M(v>nRB_$UYb}
z>Ij|8D-bp)^|N=3#l5m0NINrc9*Vl_8@`|#^H3KIt862We<t&!T`N0dD>}%gTd2No
zESjI<^Mql$T$n}1sSt(rbaxH6f1AhPuz2~)L@M%sa(H2Lz=s9`)Q~pxo22PFN7*8@
zxpyx!;#^+NHJ2La=BJ10Z|xnCEF~Mqj=Y~|>v@fHJ)!$#XWOFaYcnOk{O3oy2t5Q|
z%qy6C4W{EtQUY)WXueB{S{&^LU54(_j~o8=+r$}w=Cx~NCJ|?NvTe!gHcHcA94sz9
zT$2N3WOg!2z_Fsy2g7ZaSnP_<=RI-8>VcjRd0}r1j9KRY&Kl7<XvREDl*-y^u8~#P
ztsEBIx(O6%tMh^W-!K8!H@_OMI!H(PyM&CFD$OH{(*!u+C+p0xPL@9FFkSc{8{zSK
zW=?NZ6#jZ<Hii1n0@Tnt1@w)7$*@|h&x=88y@a-9!ZmFt8|hpBhclp#*yH}Z73Bk~
z;UGp^+-iG5LHEat5%`>`SbMX=PC_Y!ZK&vAWaw><H|klBszw%^L3{vB0hru=@-Nyp
z*u^fshD??>!ILWaqros#yh#GLRN9Zi_ivJoYIkyun+;DNt6mE)X05XzXR0!>ehL)u
za`Yzxw?3E76<UI2;~y_)^8c^X!ZrjerXRcS*DcT7DN-M}BUt;1C4M13PqJ@$L0o|O
z+E*B9%Sc2Z2TFX`In1H13U|r#%e?WhPAze5rU~@+ZiZM6(0<pc9WnLR^vu)I6dn1M
zr^U@Va9hPIxT}lFgHl>`4eyqv4JB`%gXUkHU8rA8Q5<NiixU(=(L#0yaD<bI$fPDr
z!9>X6DjEGN*H+&u7F~3nYK7??d&OE<pb23MTDvlew!;HV`9-qfN=Dh~C>u<{1c0K`
zr<hEZ;gP{LOK*F}|ARMSv@lJwB6S_M4mL}VzE3C1IS#X-Nyl*E=Kc(AiIi01759!F
zwMN6NLZa(T<&_5{Nf7+q-=j6>2%jz|AzayWEIvRJilJpLzNl;$gwA08>*)c7X*g=?
zMgINOepmtg&LV0KK*HgvgAPEnV)L4jB!_*3%4FZlZlv0SE%`5Zl$3!%6r0$0xA~)p
ztzCLReA~bA;2WTcY=2>;3O@G42WnV7&9zK{fVw`If~K~Xnz=qbB<~cYFlRCdU&%sn
z7-$W~zKQgXVBVF1A<D4(bS7?b+V_>dV1}obI0^tDVlDI8)sL{qjm<cK-ATTw!(<iu
zq3MfU&ND`%p$5GWsicnQWQB$E<o#mH<8J6tVADcmj1ba9swCxcHnkF#CX$NMLB8dP
zbCNV|m7ps5`H}iyE%|oE``*(NU)&Vz-4SU4jQnrJ2=%mJDbjF6xuJH&B=tm%<b0fE
z1@N)Y=qB%7bkxv%eXS^-iTz-+rF(?XELI?UU=#u&L`C|<3LhF}F9ns3zn*RjEeN+m
zh5>^&urQC|XvZ~X57!`u7_1^m>ga1J(Nh;dAO-uU#lWB#q;;UvIW>3i$XjGAWuVYH
zEMT)7^WEN<-i<>P8^-I~Sq?DlDAXA|2biQZY!aBjzG>^Z3xfRkD9!1=Zl1qTk_Dct
zKa+?(*@|FCwi<E``!AOIY2%s+JL*?I8@6|+mfxGK1DD%$`2JTd`3QVTmq6%CM74t;
z^5g|`dHh#`4n8bCFM&S>hCiLayALzKlpXv}1G>s*mXyunpgsF;DHrfk6I0gC@E;KY
z?79O&blWj?qTT((fETAT2JS?Qga!YBHFcy6;hz^B<_{CYnwtuRgF5xC^wqM*Kn2*a
zVRk!uw}wMiV)Qj`=e<rOBr_wQt;3)z0vA{(Miu&wh5{}+_1)CxaM-a{jn2rg4R74-
z%D*%@j6#N*4F&3$mjG{#fq-%sf4MjiY#W>k?y|<Lin|stuvF0Jb%8Zi8cznf8&>1>
z^b^y$W>_jxcvg1=cxWW@bOeMY&ObpBn1Oo7r($Zo9%EWy6~opJOiNI-v{88QCNRJ#
zocTlrAz~V3NEmg(bjiOIVZS4-5DtFTvP5#v_v+j4C+ydW%L4AyAuwpfeZbmMm8}~=
zaKwN|F!G|@{k=}ONY*rZYpzwsFPu4=>D{}NHmW(}4jR`d%Xg5JxeM2vx!jetHS|2(
z1prKJ{4Mtg(b*RpxF?D00>`9}-)jCbgN;SlFhiE>>8Yk*1DeZ7jCN|G_E>0Rd&o}3
z#4u}3d|OWgZUAP=>ks`qR?m_9+n|iwi|ipOL-rWtR%-`$zv$5@j`RBi+Xti0D3|uK
z#Y(2jK{ny(iwARJPUvf1>{s?}YOUJyEQ%?i;AuF|7N$1os(!&Sr_coZbKFc8QdUGi
zXm&il<vnqi9D<}ZZ>Z<W^I3<KM~!`F&*>+fbWGi(Yk-EiecV6Zw3tP!pF{snQY|pt
z{Gy8W9uAzchuh|J6G`(%!^j-0n43*Fs|u*k%;4;>`<=~#X%-jP9O{QvOtk-$nN-qX
z;(dik)qq_)CZAhpFPy-XR0gst>}$n1CjILBd-`TJ<*th9zR5_jgJ@@gmmfy>y|XEZ
zg@scTS{D$jGRU}_a=;rtT%864o~Dgf2ia>#Sh|b!t2Ra8Ge=fx<!b;t%yWjDj!>{N
zc{a6pl)5JW+I^FF>-hdz!-Pw6M473o?-s#7hF53R_5OAhPP_-J&TLq$lTYc`XTs6+
z#W=q%D5*&$So!xoEGc?yx1*L9%r2F|QBY6&qZcrGzX?(Ir6;F)A~DOw&QtGkOs26M
z!y&NJywSK*EFc4~pVaH%g=~K8zK5?)=ZKkI&%Z9{ZoM7qQodGjP3mZU<NL$Lx1s)R
zCnr=&EB82aF-4~*^0{(^JjZl1bT=!!G=2yI$xg}S03|4EinlyyPXMDxLH@>TKjsSF
z?gjwfy<S-NEc<xSE@zt|S{uW170Ci)j5diAPPdV%l^^vf{JMS;z84%umWbS+#IG7!
zRMYV3^(v~S-z9~ekJ&k2^|u=wSm^mdq}^_4R#ZRTZ5H5Twm-p_b0t)9ppxEml@ylN
zyz)Srk4S7nEV+JM3NywoEnL-~oJB;n=ni0cq8*q<4Ie@nW9i^AP&d9{YySYjTvhM$
z_Y&Th!RW6IzA7}DbkGVG>kiaLGh(IhA5JAg@*5ixV43MRlkES@uWg`DFTB_jB1%<W
z>%U40wG5+Zfp576p{PXc9YggYFs>&R6BOIulerL#pFf0|l4!N0nVyv+*1QvN3I)V}
zw(`ab6WC;>Q#Kk`sW&954mv@WL$T`7GKlf~p_$UCn+SGMTA_2#95hf>6!5d3+=h6V
zZKY+LV--_`1=4!5IE%u3ITK#G?s6b5Av3&aQ>AOsMCFX{DxV01iEAJEGvBk}OOz^f
z(REQ~+L1iHQKF14p^#Z@2zGx4Dgvs);YqBklXa!-t92PsqqUVubb_5E61OX4>np+^
z4r>h>Pm4`Q94vBxQRf9kt@jlUNFCau?-!=wbe&<AoiCStvik>UbaEz8>1m95nNIcO
z1awb3|8;riK*U}X5L|u~%=I44UiN+728me=(7-8`2xN`kS?d}=B{o&i1B9{1amWt0
zaLCd`K3YEHEyp=xUBP=Uw>ZUDjaYO+Ec_#f<Rv8CSlQ)rBzY=}3SAhsV?(x8@IpGM
z7Cg;!h`kzlWsC(Cw9H!oDf6$uNG}6A-HRK#;zsr0*V;ht_o812g}=bWP2cX4?voz(
zM3I>o5>s}-|GrX$&0c#(0z{C@ccBFd+-8bDQm?aye5l{3kP%@WL7@{$%wjMr4L>L7
z&2Xi1smkV(U6!qO2rph;xQ)t>;0Qv~Ltu-bEQ078Y%>RuD-Sn{ycsI<>BgHev$<0y
zwOTc(Xqj}E`y~)(wgWM{Ih!=ef;SI*R&bD@*EX@{O+8TBnK0K)0K@&m6cB3G5t+WJ
zT?{bVdv_=Br|y)_x&lhOZMgYs689EGZD`)@j;Dwy6fB3kFreC<33veCQCbCHASm|a
zh!2PIZuxvaCL;mLv1Yuku_Jsz<=8);OUDTC2KWA_DkUG21-0?;-=^Oyc0IeFCVemK
z$NuRIeqZ~G@0IrhCb<d=_PtX(%7X|E;p9WjO?N$cu^15KW2WZOc2ENY)XaUZF`ufl
z{dn$)Qq#gW%qBmRD<jSV{V2U&OB;G^(t+R~l|x|siBw#L7Pv`^!^>q{T+@j@b%gV`
z-sxc*+8}Z*H*7s3rrBF$D&{y7bWY_f@q-Xb)+=HU;9V;K&kV||pq8;FHx=45S!qu0
z`iSFvdX6=-r`j$X%ICZb12J!%OOL?*$2h!?MSx@8R2!}Z^`_#3`<ywy4U;Y{cZBrI
z9Z)*`p+$cFL{p*ySz17G%V~huB~n*rjzGZa@z&e5kZ#HfpJbRlY^b)szla<`9xTW7
zSeMEoUV#8GP->a8x(`nJU&r9?!>&b>NIf;MR?4zUnKHwgn@qh_GTWkL`!3l>3nW)Q
z1$T)<DpyhC>6Q25sfvWg25IrTeqcU{0VGBn8zaL&8+7xR52J2K?X`Vd^elbMXO3>7
zE@Dhdi{{mUy&7_=nB2i?u858u6#b@v&&3OA!~jMHP%2w$fVk>uj}9_Li*16eNE&ZK
zSdz*=!LP+=K2Ro!khH(*nd$t5oyMo3*2PGn@wa{3m8F$R&!f~C_b;Q=1q0hLkDCx9
z$Mv{jDzQy|+|p2mpPA4x#)mm}7Ab(EY1wfeG<|a!rUG<&hd^7%$ks!w|0k}CE;;Z3
zJgGRbRjHPA)1Mr(n^zNkg;pHG&J?5B#oinK<1M>8aXS)R<H-Lts&Hr)agq(NryF>`
zXL<?(W-V!(XTJR>nEv>Vz)UfisjmaAWf{O@j74PvvrwR(1*kdvBGAVS!}}S(qqzPx
zvGE*Idqlg~9m&R;$#8Dk99Oq@*gZfEvUMtk*rWEMb6tP@OVnT9m^$|f%U5Jmz0bEd
zHdQ&;nyU+G8V>FV4!K*YB+=U8NU1Z9h`-OZxre;P0&))opF{&+6~;kccw?z$+EK@&
zEg;ld@%OZS>Jvk{A=Tj=>fq{P8V&e=Urt_9h<h!6_!Sq4J4OfJPc@1flPmys@42#_
zD_45~69KRPz7<t{MTP|Hgkg^#u3R?d$>DjEYks`pB!tpKhG;k+A3x$yq?}#X>{PC(
zMQ6DuK{@U$HLaq=xD%+p(d42vs}<tgm^B7AkL<jAs)B3gBAu9Ts$2NZ-?#u=cG^&k
zm%joW-(_mdUOOn@-^Td~m1}_QKpwD_CfyV-gg=HYOx-+5_3))-AkLag^^8?f-t^x7
z2wb63nJD6XBd<-ANldZh=5YSmPF~=^)IvJC>;zBpbVD_=$1&_#zisep8_`}$thptC
zNi%vwcc*$K*lsQ8oItIrH&nAO*SVJRqsib`pyOb+x5hi}<4Ov{5gTC6SYd5=R*nv(
zmTrz~v(n(=Nn^4r$u*lo)#^(knG0KtGa_pGR@_2`ZvF(JVN=gSxrQ`VHMRH0dc_0m
zOx*!ZQY*V@s){t)>n>o*iY@NHSo_OI|8v|5NoCHd?yrIUE2ZB*TeR{gceo6wK%Z>k
zP>*LyUX3<j<7I(*6(9;~s7~d$fX45$41&0@p1{Ad94;^5{r2C{M*+aEipuTw$SiWl
zGVm!U#JGz*u3pMJ8Oue0)<Nk9JvVv(>zh$m&?#x9^)*qsD#x~NOxLc`Zo#Bx+;<Gi
zJDxLpB_j9~_FT=B`MzE5*`>X0aSY6CsHH07#3p$o2|p_R3+S_wucu(j2sXf;*@DMi
zv_=rb*+UAd3H}x?=&9H)#cPmVVXT$Ut&#OE4VANLmPgb&O~wx#^o6Kiwr;C{A~Rzc
zrDB0hY^P1-1ec@uRuTX4t_r0sUgra_Y})Rgw6=cC95i{Q=*q~aX8VJXd~(0D-v+kC
zzzKbN=Y|z8zzQtP_-u#<TGO_2?M&THa3IjxqK?aMM7Xw-oYGYHk0pGIJAbM>wVS)A
zx;r8B1=3=s-2AY$M_03S-FE)5_#zv!6vYi&Yct7k_S6$qfM|t8r-}O4#>o0c@MKGW
z=-cPXOId!G#UT?SWWoC4opqr8CRyfufB&*O!?dUcfQKT{faG-|DLeclJh(;>Pxxk0
zw27nV9iPPBc7`NuOk=F)8=Hvn^q-qy?>1(-NYke|7r1=ve|Pi;3Tv2tiKW*!E>ovc
zi&X9Z2~C8Ux`9_{`THL<vC!H0KdS>1K=Ap$adg?&|5_brPOX{@aU-_db2H}Z<7-EO
zeIG9OLncP`F&B)1vlviMpHrfz#=SM8AF4Cc$b>b_%$o!iGU}z;LXIhPu9~_{-boh1
zF*#xH{gMV?FL@<T$D9bc8d};@4FLs#6VV{mi!gY~b;?QcX3n(ifJzc*pffM<j6$(0
zFgy25#|rgR{|x~y8^o#@uivO3^8L*A{;cfaS2~RL2Wfp7o}y3@0h|X_F=>mUD$0hm
zGu9i1yltw)TUxgC2n$9f#-%IC)gZvql9+Pd&^W*-*ci<)FR!T08p=%^)|@~DXE6sN
zm(V)=zB2I*MPi~AFdbtBp|>TIeS$hJbm^<j7w<A-_g~@uH;z3*5tka|LJ1paBkGCg
z&&%W4T-nz^X8LBtJZ_+6M6xt=ga8N>53;indvwQ~{7@ok#w=;XAhY&^Ea-)5_saW<
z1vVYqWIe~8nyQWxHQU7?KRC^Oqm6gQMfT|3^ahkj#7Y|A|HQTAMhZPDC~LNf_pFdy
zZ6H2CamX1-)kZ6kgSyoD$wmliS9Ro&|5_^Kx5S~O92v0|SlYJKZ!}W33@ZkZYv)JW
z_1)HN8cQn7h8kNK$@Y?ge9N}xKmOc7@-z(M0ZRaz;W7kco(;s`j>2$xW=FE=P;01l
z*Vgy*pJ<V4%Cx=fO?stH(LI!5t?@weqDL=v`k-Hss4-3`)$ij(jW&g!tM^#Yl*_?K
zL&P0y&Y-CAfkAPLi<_YqlH9xDdhty?<%L20wuevd6lRcByqFW?j0}?OW$Sm*Sqs;O
z)6j5LG|kQ%4BXg`-Mm78`t|pG(e|uuwv`jW0tAC9Auoh%+iPJuUGWM1VMwEQ^G!U+
zHq{k187+h_;GC0m?G1VqSUaHL2vJAj*eng4;>z44L)RS9tO;Y|f@P{mnPP-ib<h|k
z>eO6ny%L}ic>7<jqRMq=%w)I5g_$W^c@rt!u-J(34~h_&P>AH4UkdFys-9th?rV0R
zYN2Lb_a$zy4&d#c!`0aKVoujShqa*CI%o!m(YkA80&E-DwCF$sCE|eJSW=J@vX*0A
z{7ah~!AP6*)wOpjdH3|?vg~6-^a&WR3q=pwnL?AIQk_84r3d)ov)k-BT9Y(-t2Z)T
zns4pEJFY+n+*+hYhiuwM1)eFOlDGqNZ#C9u{SS(22yuEe5JLyBxRoa!Xv!3X7Rb#Z
z#X19@Dwl<j7K|vX(#2t(I$v6Oz+1iEK_m7?k+Qe8I@f}L;<Z&c<MTTs1*+l1<DD-F
zX#biYCpHIUK?O!sjUh0!V}#Ekup3QHxXg(f)^kqi={Cc!E)u23ACv%8MgnPe%XCQU
zJ#@h;5W7{2=tC^@17(zJo1Wj5M+a;a4Eeh+v_?0Izx2Q3I-dA_i7GM@L&fZ|oC%LF
zgSZPYiK6K7>hAmb=J&Ik6f+j_s|2xcvO~qlSw@PI3aKHf5$bZuIJL8SZm)tVX)|(5
zJ3%osHS;%3@gIdDv<5)jz!bTK^O;RwogP!|NjHn(d<oFgNT8{IU!Hxu`|I0MQ9D%E
z{Dew*lbQVUeJ<*bitIpIrvfEYJ>x=rl;Oo7p6p?+eZMXH73ryeT8|i0;ezb*J2)M#
z9#uU!WI0ylo2bxOT|a&-=Fq?{{QwCIFYC!t?d8oedceuN$^<~h6iC+g_j!0j+2;5H
zXFZlYHtU=d9q@TtOa&%Zlk~cVoi$Q}lon`IIvA6SEfDRp1#BVj`hC{DQUHQ%JPix!
ziHh--VtZ(8W&#`O^UQrEx&d8*rn@_SG57kKqp;AQ^1aY)bq9=rM!deirSl!&rmp6D
zOeZR>HZDMG&jE%7VuecFZJrI5)v7rj<CzoS)1?>2Ce0ww%fJR~wkh{YrNKmEO0x~J
z{q8qY&q6nLH*~b_IHoieWS%K9DrGTHKK~TqW8Uowc}W#AXeC&pJhSftn~SZVI@Ov=
zIu+dU``6~j>QTG1*~}Nd^A2dm@w7@>3CUf6a{`~JJ)o_E)3j|ny<+ZK3kg~}SVO=f
zX@x@0WoGn}{_^XyHKB2?nYp39A*nslNMBoZqE?P}&^QW07)2Z`ikZDnpw|%PY^1C0
z^>R(W2TwlFtGvWC!iNt?uss@Njdt0^0V8j74s6^RaQUDY!cBd&K)b^kSU6e}2rPw8
zd~^;e1-u+m0FfhNhGZ_C(7Fmzwe>HEBKuzI)vm=i&_h*lB!$X3;2MtjAkgDF*PA)%
zpY=4^d&4BXPa;^u`Y1EksKych>})kP9@C5-__kNe@|KZiVyiPIL!t)CYVyyl%I=~m
zygcy)5j@t6X6mUt-#WA5Ej1-8o_I45Avxn50RDnYer{lQ7oy`){v8L0Gb1EnrIHYD
zrog}Yx;5Q3%ZGAhh$w!TI4SZ84+9>0C5biS+hFLDayB~J3L!-~N}{q_%NI*gYg;Z^
zXV;+B#T@GaMGJxR1W9M9kVm0sv0+&D?w2~WW~FDkQKy<DuZ7xP>`~Q}cA_%8^j6*g
z0EE2vj1;qJwj3cnh0rR4iP01sf;`6**eEMEjDE_f&uz;cO8l0ypNU3|B!lqC)jkmz
zSJm2$keyD$l!CR2=rHRrbR0CAKgcWCZCr3Vh?7SkW2olp7`aoeDD@N5Oy&?bk2YZ*
z0V{U3Idrv!J=*1=JIi=<1OuOFD_saTV0l3BOoh77w)bVguYLc-NJxM{=OqB^)WgKT
zQYRW$H3e;KbU50??zc{?peAzT$)=*&NB(sZwL`0Rw8VDlFSi6`eOv(DV<w_yoR0tX
z6pDTRM2GEdRk7vY2&=+cJ*U0~!Zf&tDo7(m^vOf!o81nZY=NB>*(G_j2%?c}Kv~v0
z+3;BJv36!=kqF}wm)i-cREr20hXt-hBO2v9trBiI$xnj#pWVk5<*aEPZ+n+N$|rq>
zXo+y0xc@-u4$kqLs)7~Jpm6C?qRvyXz~2a)Y3Yi%|6<Tj1dSeB9m18Bd7x%N&vLY9
zz`_kuqWiOuBR|Kv4*?B3VU|580*D)N>rbr@O0iB>z)gllCKEu!sb4mr$Jc$PV6HwE
z8PGdRdsVhYo%%S)0G(imM4fg}#4SSgO~PH*BF7r}xfi~kfPn719K~4-Eor5r<m@|F
z!RV2<Z64XU*;Xo5MQ<+2F?eLtyv_hO>fwEgp!0X9$jlwud|U(E6M>oi34qQhWl8E5
zjWsxpRV~dKo@Vhwc<L@JfXR9#gF9keug-fwDs3z}Dq<qLAf<g5j!d_B)O-zE%#4}4
zW;l*kUln{i8xLX57##3;mioz@a)`^oyAyr4Nxwc6T;?TP8JDAUvrlL183j`1of+{0
z%chgbi44MR(wzrg;L61i0r+F&8C4GC$_g<Pkl=aRFQ3^ou(B8Z6>tCd;U{#ezJQ-R
z^?lS~)_TGxjPCGCgJsZ=lGR41J#M3=ow0|XjdjO!YVUD?#ZeRIoNNF7lxql%?r^gc
ziZ@>T)_N0z9P;$5kmZq2Mh0ep%r`*I=@3Aja^`uOflJ%(`lIAj5AbJ2M|x0$dJirr
z7o}-C1ukyFO*UwTt=?ZCUyz&?<woKFbS_^|3Q!>tKlWB5Y}rgFbz?CSS^RHzZU<2(
zK$DTeVvs!({DK;y0t7%EY<48_FO8H<J2b$SPmmNBR|Q5@B-4}87^7nW1(TypxM=DE
zVsA28DSja$yVg_w1OP(?E$1l4yLp1C5X970)8L2PFsSrUQyO>C=Vv}}Bs0kR;0`J@
zNAlH~pZ+W&2dvwbY%!L;K=qeDtMXfNb03>``om8I^qUKl_eb>*{c&5Rz_FwgVMKWP
z`=S6`@WbHrw{e)%6Wmvw%uU7^D`fhOQT)Geh%J=erEL?l1E6f0j}H5%8s&+Rba^PF
zTOvjk9`>6Z$Fc6HQZ+Ev^pua`1|m#Cm9j|Il1NQ;Ci4aZw3@;WsoC#m`9rvrfm@Jd
z<Y2&HlAMuy7Rss?oZKfxU-2Z-a5lK94V-xAB0XCbs%o!gqtje6oEk%g)d|FU&D7Is
z@<I~<*9YvL3cy54%~MPUvnMV3v%-wS07u^|_jV{(x!6wQ7Rj!{q_L<$VF3-2V-`Ld
zY*M<;dzxMnvPbrmb2yIc%7p+nTEy`iX@rx`kb4ss<!_wRj!Nijgp<0_7$1ciw#T+-
zx=TW}T0%mRBtsxe%tpxXcL1dFq-w5aLa$-wK}&eJ0H`(w)*72(9}FA|HN%bnmMIB4
zgPNLv@;<_1Wr8U*J#ro?X3wG3_JxBd9k1W>ESFksPRnAmLA>>J$1=#w{~}SF9%<~_
zz9`BD%G97AWV6QmZT6>Iw)4OQMfQ6}UE6jZ3Z5EaC(_YM4d^MjvJ@;{B|la7KUzcI
z=?Li40Pd)Z!PRs?Oc<XpTEV!)MUntTxF*xk1A3H57CpV0$*|qOQF`#Hk21gLwnNe-
zQoG*a$%$TJ<6P3~QDoW4-4VRut$yC+sWQP{neO^0&l$yEkPg^M6LqEfaIo~S%r{EJ
z!RVGNG*m!isEsX%{kZ+h6OjD;xN_|>U5gm}1sFFY(-&QyNjMn}lhIIeBrOqW8~9=4
z1->lJ0lCm^?GaAA-_cM%W&b%wFUeB9h;|DZT`O&L+;<to#O$SA;Px-P51as#lq-BO
z5HSAdww9e&AQA(rw#o%r6?dzZ@sDEawp4xwiAxKQi!u5Nqa9><gp3)^`lD%H_HwNK
z2LRv8S?EZ?ZQbPu^05`%`$YqUKUc)iUT{R0Rm0LMzYN<tzn31tZr!>G$@3<nuHF*F
z+eSy!^K4reSi{G^ue&B{%&)0@BWb0Bf1*d^+Q%?FbIiU^u*Pb6or#sDxs+TQYSDz-
zKZ%154$z|q3%whv|5lGz`>wKLL2FcEUjZ(}?2nAN%vbQ6ZWl?oMmF2RBiz)v)l5jN
zPi_d18lTMG+uPK2*Gyxy_N0yZzn9O3Mwx2!I3cdFNMGVEh>e-;(hDPrCH6<zLgs{I
zQ=r$(m1%7iAsYKv+V7hX$5|lwXcB($LUcD2fjOIp%R2o^=XZ)P4*ea_^b3~Ps}7L;
z`5}`99!tzRg&0L8LnRLqLb{%;H4SQoKzYtCr!-uL7=Fs!d<m~vsxsYO8_~ck)@0&!
z&5MJpOpIrqg(?gwtpzs2!VHI+#icdvr^_lfDcYn<((sK6Rl+H;&Zi<B4l;LU%f7RM
zbC@c^ElJTr{gKoV+M%XX>bl&`WCx&TkTg%o;?|t-7DOcy{EHFhum`OesX&d?AVCu<
zq=G!wSSK}n_c;FrW%4hO<0Q}hct3o&kWGMHF;Jx#35CjtmC=e<?zgL#-XgkM2IlH)
z8lP)3(W-2Xoo17slLnA>Tz#)(6^!-)wYGLfjyS5-RnC|OOyaj_XBh+igEGMVVs#Jx
zsI6mk<qsw}<I0~A-I`z=LlvlhCK*Rs(HEC<Av&MF)hpXvb7Qrn5h8opOmU4wohY!@
zs`4g71H-_XOuo*eaNWylrI{74dZehArTt8uaxpR4#uINOpxfHmu!rEKT8tKy`&EAh
z^vR$-R7i;HzCkX08v9|+=mh`|$>7(?tHLLoF)ht$rUfMd>ZU<>bRRdt!E2HdB_~GR
z&QphTrSK5??AGk(B~~u}tAR)CEWPt$%_l597Or6RT=`ZT0TNEEg2a>Y!L_RbaR+;f
z6TkWglP~PX3#PAhU8(i>zI1Y;+kVURxblTV)R5y;iBomKp0@|&<|zP1ab9>;%d?b3
zI4`<`TA+cczrDsMASu=Gcnei-nXxY=Ab1kKX@@ld^>~J|7nYGq2G+9D#nB;nlHKu?
z0!Js`^tCRAaBQXF=p5<UZDuUo9%X5Pe9ff?8bO-2>D|CD0=ZDAHlmm;Z2-H8qa{8>
z?@cwnimg4Em>~5AbsE4Mo|>v5(tq=e)3aaPk6Z)mwf0j24KB(SLfAw|21wNpZlOU=
zWt5e^o`nLB_IXlM<7Kh~n^h869IJ{FPA3H!XF)2_%uqtw{(|Lt#QG5$sFR`=i++6A
zhR+*riI3D+6)qN`wcb=21+GB8UfyY)Q-`^^)4Ba+T}*p%nFzR`x<CgNjyB^c4r9U1
z4|2N4&k&?i{hJ`+C5E)Iu-%FMX>i<Ka)f!m$J3&u8Y6YW(_%6xAox<Ge_HhODkOnm
zn3ZrS{!weJ(Hhk*Oe8kyVk8p^s?~l5R@zLEsrH_bkz|`0cL8Yg7F@cIaB0^nN*g@@
ztjSMH4_27eh5@{53mk%Ko17d=qptla6j5}q;-WAGlHk~?Okl`AB$mn1rNpktW)(Bw
z)G%02@Ne-Mw|?jmyFTBXJ8Ua<-g49s^~5E8XT_Z4!@U+Z>n;d{(BVhMn@A<=ccx0z
zkIoZXc~GvjEM<(Y_4mOiS?UMERy?!!9K<sbe=kP_kpM>F8U4`E?EF=eGiVd0#B2Gl
z?@a{&@d|}1^wyaHRzBTuBAiVE9BOX>?igX!p9#cuD3-&LkPuT@DOj`3YGDb*K(b&E
zSiM;=>}HxME#LmixrAU4o$0`2hf&q`2EW{!oDm51bqgBtVKd<|*ml%@6w$9|=G|Gw
zBVBiVAHZYqb(bQ+yH0G#x=Vw(=%C_E`Fb(19J(CeYc}XzTks!{`?tNYf>8A~=&QxA
z+?<RIaBn30Z@s1pZ@{<e!JAsVq~=z2zFb_e$kBK2w<g5#aGZX*507a0yq<JxsRL?$
zgkMLID`o3dkpu3zB>MP<D6_~jQ@=*M*Y#|E2r#XXNY=QW>J(w3k@=u^KnlOoffqEW
zT-`c)5~nY~*Fef6LreW6D==5-+ugn0OHrsr&OgiM!odp}=#l;+^`ck+w}@t-Upx}f
zr|e>Ub@74_v(>zAlGy1yidw!3+&XYuj?+KCls~IP;|u1k*%ay4&2W%p*G!pqheUVi
z2e5c95u|*W_+79CPFXxCrrj6&s8Aqa`KQfubiRqF$|)lsDEs)1v%oKQmf*0Rgm3mj
z+y1fRpgXNJ;0*}x*ePQR`Q>rp?n-waq~AhtV!e!tf1z+6sn&M{2}vA#wU=1QQ(l^#
zc-AGED+O8h+jpZisJt4$lsWhtmj5!A2*4%+smlrd?_UeJtKD|9VOe!dkJwePBD~I^
zTheYmqP%7l@y-#A-xq(ps7T4|xb0Zl%~Jl)UW)1FZ3zeKf7jLg=R!c&Hjj-NkKHK;
zV9J$k%&+lN@K2puF6hD>hNb%Zn$E;}jw15K%_8EP%mk={9T5YKH?t3*`xnU6H%Z_s
z1d^2?<{XHxYB!8DkZwG>j$9Qtpg97cyS_;N0lRU#%Q~8Ao_hagP$V-t;_T8ySnvn-
zXW@!Qo{15;6tiQL&hwg&H)1?w3%tDhG#BcUt)!|fTd8feB<N^l03<e#^slKIvYHT(
zhrwP=SsnhuV7Vq00lD9iH1lC_(*QRKX7P=9Zsy$p2gwTz1sRpaIS}&~+r)Rommd5U
zx?Wkh{)p^s8L+4yUf0n-tHGtW@5st1Y$;!1#!nxx`Ixcc0Lwy%KLyTAuwXp<I=ogz
zq5nO#c*AjnV?t(q?+@boHF{;~XQ%neA-qdoJ1e=^3+rz<F5lG1xawc|=nAMS{QHT*
z$JKs`xUAIrXd>$uBR{$fj^L*zf)&%<gA>Z_D1NkuHU0v1iR^F_{B?KlKAWYnN61Vj
z)FS?DSO&3W#^md&Gnvje0DucvF>}+d;lSadg3zXk%7{k9?o@k;c$;KEYJJyUG4KPx
znIJDU1{}Xg+bTFZ9}15Dr3D;V>FdAZE^=OJiBa2Bi<u#82(il68Ca<By}Na;4*}cc
zhnieBY+etO{2mu7)ZVIHa6cP6kOYsnjmG@*B_(M+$FE;r)u5Q?D)A{h=dXnz5j4FG
z8?M<$G!bakFlMf@i~sVLR<|dd(S>{Rj2*GPf~dAjyP36PH{K$v-T@j?+Wo+*gaO@2
zT3Wk03?3*^utWHr4l;jBUh>Jse1}zEX4t7eneLl<<}3E=&fa@jQ`<CmOUH8m{H9hk
zI}M7_-((B?GdyZwH_9_FIMoWaNfQ1XNQgptf<yhRqIkN9=*$`}KjVjjk?Obax6HV!
zw@@xz$D<^pTIeD>L;+A7JaU>jysDx^$&+95Gbo;5s6`u3?VN@m7w-PkhAXE>S|XvH
zzZLnDml_M_9v(7pw!IYw^{!mNLjB!7k^<(4%>0{qZ{QP>*76%OVWcR@Nj{v@5ex((
z79;)BaYSVm)WuEI_&wo#twvY_#``bzD>oQ1xJe_%V4Jf7jv*il27%E`OI9;hn~=p<
zFx=S~$;4^T&ct12)Jd@t2}dCbf<0@j${K3$f#moh9_+%b&lA3?`E$M5O=?VhiPKKI
zC<qqOeUG#x=_bq=V@wGp{zhE6g=E;>218;V--8UVl{X5jVr>YyM;EfN&Dasuc@3nA
zWL970c>=TCumaF6IRfR!J{-WXW)G8?sbo#`!h6027N5qjQ2bjY;#Ek+?bR3J9kvD?
zMU$`!#w}T7!%2kGKy1XNVFMEvil8X1D6n{x$v6x?ZIzo(UDB1ExZ{$WR?Iz926qR3
zccNnC!uyb>&BroeS;b)(7>S*PV++dJfN6t)&g{~NIR?O65m-wgKWvDi%Q;O3eAeln
zg)2P%DgBzlW#bqc$c}NhExaTsEM>fseUe-#03jo{hM1y|&YI}_Nd|4CZZW`O4oAm5
z*9~<ntxokD=FxtY3`_-NG(8$k5>-SQ<jo9+dee|;=ifBquW#Su@_tIZA^4sVwf(n+
zwz^{u{WIXF41>ShP@YEoaK7hHl>lo?4G;Ay^p<B3k1uxi0DG3j6$e<U0!0aSu~zXJ
z(bu;IR{<M%orjTvT>pXP!Mh$YzCQotSMcRG-!soVm+>F!pG*zpjEe~15shW0Q)OIK
z>aI>W_?;IJ=@%QwS@<z;f<eEUl|o(V@Ow-nn*#u|Sh4I`^42PFp=vUn{Ne!LuTIE-
z^d-HKt6t7y?Y?=e`DUgz>}A&x79oW76n8(V`IOM%RkxWzV-VWOC~VWYLJYM76<I|7
z@^@0&J-qppgcs2JEyVlOx-w5VuX{Z{==KK?&pQ1tB&U<SUqgP*ep^NrSLZ+nKD<@C
zwGlu%q3Y#GQHXn7W?j8^JRy-Z4|i~0mwl0M7~dP#9ZaC&GZ}Xn?;FjfJGXfmH)yUN
zcsphH1Rif-j&6Dnc>BcIK8QnI0XekO!^Erej%tqYbbgM?rB9J5<hr{Fv~F*Ou~Li)
zfpwBO-trTN$qyr=6w2Zr)Jj?sruk0k<VAp${l7SvMuKV4tm-8zryhIA!HLcmvU0wv
z0ol$_PNaoM3y@|`>|pKpupjDra!m`$ck9ETG2RR(lyhp{{~RKV{Y25?J&|}Sd1ZQ=
z{tyH!G+(c>5|gK^B=qD@K5fj3<5J^}tT2>x8*OJn^*~fmB@e=LYV&Iea8Kp4GTsBM
zsFnb?47d#R1EL(SbWY8R^9@+L5SN+NjaMoshNigdb}%fO1KFNoMoqI<P)4fT%l`T?
zjTV_yK)o2F18AaWQ%&-8M=eFK+YLQ%qhI&$h<aQiC;;R5(h4i?>BO-tPk{qFr`Z}`
zCo!!gM(r02jT(Qgj<rLb7tPhLR&&5+Kpk|%RLIa#h<m$P^`<E_2_ZR*7&f$sc!R_=
z%!d!oVdS|1fq2q>r&5xL6*P!T1*22_EBU4z5$Io-8)vo0q__d07d@J8SRb?KVa6mW
zt3wb02lT@bO-lR-@Z0u)c!Iz&@Y{8nDBtP!lKl@4yG_v5?e($rE68<Mc|?HPj9aU8
zo81se#MaKo)YW$O_xsfMLCGvDdtaAgwCHeTy$J!^H^}~QJUp}^=|n31Ze}T@zPHf<
zWL3zO|8`5k*RkKijkIW{&0WaiG1!7Z@BZK_MkEgnPi7p~bW0XQKS}tmMw}sy1tgQx
zYQxM&NRs(p21Hv2l-;7Ps1i_k#4#sZj*l%v!^57!x5R4Y#u=%96gjvIR@|L7(G%Q_
zM_%X;O;R<Ggli?wCY_Me-xVa(!<%pyK7o6zJ-qHC^KPq3C6Y|F;x`qjWL{b(FZvn;
zk%QGpq?D2#d6Sy@;~y9KSwwfqd{!H3CmS+p8V77<zCH!Ru(1-^l0N|VraSP<bu$`8
zD&AhpBGP^vuJP!M>X|gdkl;1j5=XIA`(hD!TTe7@GrH2H<sWaoRpN=^KLq$aAh<^Y
zV+tErhUCO5N`wIzTNC5x*-J~*r%WcVQE{HZvpAiv!pET}jnM@&(gO$OQnFA+-#Gsq
zDfhT1C~V(tDTFc`b3WipWJ!L>xwq@`Zu*&R$RBe>DTu^ce$gydFaqV?BZOwQ8BVPI
z*;Onj025%Srd6H~?TzO@R^TeANcWz1dP~ggySsLA)u9KnI|X@*Xb7VHL-ALn=c)Mf
zWoTTG$!j&XUGg9wjAS)K?wak<U9;sWcp==R&eT##P*3f&+BM+bK#_Kj%48yxzJ?KP
zwxfzsUPfDVJ%mIZc1T-f(A$=>*Xsk!PW$pPHO$Qx&v%t^)I64igm43HsoRWpOwLE*
z_iG~R{OV7u{5d$cyZ2Zr^yN)32tt}NTo)LtX*(Z<Xe-CJvo{?YXp||zbIGi8(_I(^
z8?E(Ho!HuSxJH0fRe}N@U$!M)BYur$`gPwz_GWd)@r$HuD@&M%tVRMn9L2s$iPrcW
z*rO0-XSp@pS2Hl$FB_Y!JY+NHV$oJL@gAIsoW5R;N}F)LS&E*nK>cr7w&j(D4B``u
zhu-c${PFpEG(vR9I*hZG8Z%qu4f-c-_;rcqbmAPwyam7t_oo1rCPoq*=!ACIeJs<g
zR`O!;xf%YEvwqDxt~!`n>G%3et<uSWu^vd_H#OXjwATjqGyXecJ!Mr9#2`x-lN(M(
zjv&kV$lPkW7ofN_b0*!ik0+6RL+9j6;(b@-T(ZfdHXhN}^cFwex^O=0@Xw#`Srdz7
zfeb_jbwPlTqbpF|^XBezK%kz5aFC%oB|nzlvqAT(o?0cm364qvJGgVeb9t2n7mg$s
zxl~2pU($=8x`$=J?al%3^P*Y-u`ei}L1+CVj89!q-8<)M$&)*Rd+Zb_D-m<1f-Z-a
zobU_CSN6VLE|WH*iuL+5rkWOGZuidLjTiTX_P+r(Z;)U`wW&hx+vZ%vN3B9cwVPG(
zLREi-Vh-EnpO%Oc{Mr9*Y1R>`21dclk8RR7yYMeErM5_0y=6miXxLn*0fK&r5{;}W
zM9i8Y$gf!5t)9htC@QRsNIc>D=633$yV@@pcjDfLF=rZwJL90%*zzeON#IcxRhuSw
z#S;N^fLLAcYRg6j%e|R#P!E18njLftn>N$f{_A6Ni?!L~4j&s>kS3LM6m~IQdOkxI
ztwlsvx;OtW*_c5K97KEP=O}C6Cr|4LN$&7|Bqb}v`#9v1{jUCbvBm2Mo#rY=pR+vM
zY08{xCg{9ncu8$GZarrs-RS!J@Ifb_+T0&t5hj)Iho*kk3!Q`PiJVX6dC+5i+4*m+
zUpmjRGUiDsF$F~waeK9a$O;QM-9Ok{owI&_FpeNL*0A*oIz(!@7bR#@&bWlN5JAvm
zq>Qa>HA^?Ci4rK0tXfDG2jFo9!J6rpCjcWNJx9b}w!`NOepl0JQECD=f|o%rACUzh
z*u(6|J@|!--f9+O#64V4mZA{kHK8(g<Y2g+<MdRpGSa+GfXizpnTQ*Yy~Ezu@NS^=
z6sfS~kZjL~pSlOcA;{quKg9CuI{jU|=Xf*m9n&sMX`f^zt|9zfL1ae|qaF^zvRz-?
z0`XN}a{dDuPppIITw8J4H1@+S57+_-+iY5g<RZVwf;n4+n(<5Jn;N-jp6g2{1J%Rl
z>Wfql1^@hnU)XT%Wp?e`L4NbijMIGdPSyZ_RJm5l5X`h`@aEZQ=oqgc)C<pA(*xug
z4oPH&&5W$Ng>I&gsk-@_bRxdsik~D;9nVa)wRUrwc%-4klNPZsuiLN7j!Xf7z~1-B
zqRW-)N9y)oMbv|rReCYG=v^-N2yBDmqqMeVAs~lbD><EPnpx$p_AZWtGTr%(y>H$M
zo}F%t#v@DnKto8FEgb9}zrz~SA1T!FtW0D;Ip&nE_RqK|$a~I3szA#X`6RUi&gyrn
z$+WWue=fU~O2ZZgE-^QiBpbj_q@>g;QXkMECGy#oX(0I>|5A?k^2=gOeIN(6Yy)$z
zPd+l1t>f}ypV;Xih|h6$lVXOsTe4s!*;Exg=Thi@j0t5vT6<#sf_iTsOqIWCkIHub
zzW~)9D&eu&l0;$u_#A--d&IY>qxPUFqq+Lnu&~hOS^X&%R9rboACJziMqFR0RDXS8
zzyK<8HR`YI@1S1Kn2M|}GD24#q8}J|!w^52^>FpOf8QRH`U67z3z-YRP#p#xvMRP;
ztj-AtH5ebZy#HjtvL?>rZosmyXI~R2+j~joof1yZMTJgyT5ruf?CmMKntOCTM?E<&
zI=w>31dbgOnMXwLIm%{fde>N4TYsx8Qv!){+6L&3TBRAgksj+V_97$37SRJte3xR~
z^<C4`jgUCs;^ed5MdfyC<xcJ@H+5Rs#dU@Mbjy0*@mRR~2(36G^5wHRA+~pJ)c;V-
zDB`K%uP8u%uUK%gyfSFH;fcdz6AHY@Y{<?(BIoo9?NvH@FiQqncr-1_*?;2WkI{K0
zf~iSag8y9;YE!$3fYw?&2MX5|9*TZN(j?+9%A=mQ`E2aM0=x)pnC7wB4bEQ>^9A>p
zj;F_)dO5FllH2332p3r|3Um$luMEq<R%}!30ik5<=w9T9ZtS{Yho^RV=KT}8_RL-<
zdor={qIk8inJFzonpFVLEPpwvsNN=7oD`E4a>XPlk7HWMK(PY6qRLsp8eHdk1u_Lm
z>{IR&D-oF_Qv`6qF}4P4?xT!VQ_Qm6KMvtCE#g^G5MxL42|z|MCNYh1tlPdp1B>`Z
z@MwjrIdh!VKG;_!dc$3>VZWOdE9ELl(^*-;G+67vwQ|p5TbguU41Y<Q&gEvs-M!N}
z6S8^>x~d(v`7V^NcA^9kgKi{~DG6EVsp25X9MT)_b%BqvXie~SL;v@G{qO(xfBq+W
z_TTaux=zxRdmdFeDkyV~hlXbWZKQMXSmdFvoU0i~P3G#exC48`JzX(~wm^9?BAGa6
z9B%_me;28Sm%vvg=6~OTp|7y6Jq{r!dK~$>>0p=W2DTzk!+}Y4Obu59`Hx+5GZFJ0
z3AuS!LVi=!cm;O+!z@W7L{OT58(zEyOod=yAo<3Hur7e8Ea8tEk<|mD`XCY2JOirv
zv7nzXXxPB2uoVERDyPX1(X5;?+NPvBD%Gjf23fmJiyK3$_kR*MZDeVdN%^XB7$elD
z$D`vRdU^5gO?`-57^v0o=@CD&9(56V=u4j`n<41{y-p@cRU0j%lXwQ3wQ}lg*@w1J
z@GNNSrzlC{+ES5}00;HkWd`8UP!-9ff7wG|Z&<v|z~RfDViWo~uh0dpm~lb^tF21>
z>R<uv<lTkPsejJPV`qni+a&+nFH*V}y!4jt4fg>N=-}^g&vltFCU)S4Hnz1e#8zMi
z*b4%Jb>f?$?FMmdtq&)B;=0UAi}2zqj?P~mjKc@xaLYKnQtADj48yf=p>#I9D<wuz
zPI9o`tTgQ^x(N>jug|_2nJ|J*PUN{#HBw(?rG}*Fntw0y$#e#B<N(P@!cN4HC^E^j
zkwh0jVQPJ%o7$R}?7RR5N-VIY<RtNe_QIP}%U|{ybMFU;UlYaz{!=SUZ7a7@9{^6_
zn7OK%?@{9&v)s*RNY}Ju4V|cU>hc98X&+QD_VmH7T2MEj>IrB;uv&B<yo&5-J61^p
zUL`bT%74J(6xkuoBWvhvG%6@(ZQ!QBY?mfjAjM7IqR|@IKqQ@2Z&r1ZN33cSCB9Sj
zF(uW6Oy4y*GDiia*?YQMGmSspp9`j$ecT%Uv1@8f(D}kVyXgpjlMbppQ#b6W%;UMs
z=-()j=c-hmJ3N#r_g|CAZ1Sq$(eW>nQBpxCjDPN}bfTr&@gr1Z^nre@<ciSP%WkqJ
zyvnocLJrf{udl&DxVLj(co+Dx6695tPrBxfy~if6?o0f=JwDQq7^Y1KHa$YH<wOxC
zw&P>hiXt!e%)p4X!|`!5^C{5HH;x-A#HSO<Ef4+?W5rO-3`G_5_GNrXl0pIOE!-S+
z)qnO%E?dk;e4Sy&s*{tm2<T1#KjobB%(T>4pGuU(EFz$wDeDLrr?}=$rqfjDrYGD+
z#anzuuW5nCvkA$#!@b&-KI=QPT|*PKg;3gtKqLk-XFv)Tx(J>@OEh9GUj>|g-cC!!
zQpcDd6nj}xqH-37v@AKkI3`)dSXw7}L4VP8UVJ(3?$8~~nJcGid1!rxgE`{qIC#TK
zJu8<i5S$~29g3EwdoV}WV~KZz5KnF$C%O7$e)CiLdW2uSyV2;-ENu%u+pTjmXA5A5
zdYNFO9V^J5`h$!WT(jkzoS-dBmSlWW=SG#M`86&2Z}Ny)8h)4$AdK-dtY-boo_|=r
zdc(^e`3JZsu;1zy*`Kh&f=eU&V^UA!uTimZC6ei%<t^^4D%cV@!-#Tnho8${?JJ>}
zANZZ0U?FYTJeIQ)uwh$iAmQVAFHI0n(P+STxQA~oAXX6SjuvA*AP%-%*T<d{MwrHy
zWf?}SQ)3;OUhA3LihQ~o0<W4$a(@e%XxpVr^Gp(25!Qkz!d4WxnAov~waC)Lz;TI1
zH@kFgc-yt_`Q!;Gmq^#P@xOi}9?Icf7-6@OR_b0Hd%mk-YD0#z(AKf9dju2W_$IOJ
zNcYyo2pmW&>z@N@<z7fD&s%J~|K3nmo-ysdGiBv_I-yb0rkSkMxB+1$*neb50X)L>
z;jn*p{+=^?h+`~?CJA^$^AoDdLs?S^1G>*if7?95`K$`_2`y`1%}p$o?|DMEv-9_8
z%E=`$zsZgS;3XQ&g-a)#5U<B`I29N96%ZR%<O@Y<4x!7u8=wc4RMk{P=x)W%tR!Y0
zqEU{@e9z>SBq?sjS7}o%(0`oJ!>;RE*rI`jy}*sJ?HYmUnnpxD>md^~)KjcIz2SS+
z6P(XJG0j&IDQu3x*}!SJ!{fzV2l@v%UdaSB4Pj*id9dm+PyJY<ME!t<WL7f&xoMH)
z1u7ar9320SDWK{ZDnzS03+Ame2;B0exrk_XtXmNcF?F2~Te=xy&wnHuHg%%eQAiz|
zx=%Z$lL}RWT(I@@$HvqCErh195L3uI%CXF~6I?9nFu!N8OVn{KAb||#c$b%z%xtur
zHHphHoIKI#|4<L!NZFYdLc{+`0hB1KA|zG+XIcS<_=c7x8PW3y4bc%k8lv|!Or{CV
zDo!OCMFlNu^2ycMj(<oL$Z?&&(s>83$Auh&i;OP(?cURJmR5TWuD;P(|51cwj|ws!
z?--ITgmU}1LfL%!VmJRau#wLu*&E1225%#v&5o#on&3#^k569@{Ih9s%hzDD{U$Hb
z5sgud$~%B5(va+S1*L9aMV2Pui)55Bf1j+Xt-xK;xZ4|&_kWe!Xls#w-Z2kCy*~Et
zaklnG?NMURzESeaz34rJ8btSO4cmcBvE|1u4oGO>$n!kSHc4Rl!P7Vz)PFJ^<}3y)
zC1*91YDm{p!%Et>mDFvXR*hxwF(d--Pd#lgME=rcU*jid-(R}p4|whcPNOrFamP`M
zVvZRtxPxXS-+!jcnF=TD$PipvLOvbF$wOEw2#(i5!AYJa6+3RQL6YIf{hAr9qGW<5
z6c*=FIZHRE{Zt;R;W9k;oyhYbj%57(5^2Ys=J34}lGbN*fC}obSzGO-S@;;8$HL|=
zikHkhjp956YhSi-z=yxC*K~!Q`Ac@_7g{MZP%*fI>wm2wi~$&j{zTBYpz-O^xT>b*
z^OF+@{mzbSGtzOGPflotXXS}BDB+yhS+VKZC+xfg;g!lU?hh=?d^9U4uHRR^fAl@8
zK{!AGI`!Y)za9czzEG<9qzxeqmlowQ`qK$v$j!Yt9ZF;evtfN$XGGr%9VhZBrg0Qw
zON&Dscz=P018Ull8%MrN{3m!uRF;b8=p{>6FBZL%scXY}L*}U8tVV<FtC94d7k9y{
zW+``l<1a4PXD+_n!&+PeOYF&sY)6u&)b+*5@J%_|csK-?2MnGMt51irwdTn8Dk+-N
zE3g5#a>2t1kUw%L9V`^r2z~{QNhSAkhk;P!zkeQz)hFa;SUR4OPfnC|Re27gtv2s;
zs8l$4{b;e#Xr{z!ini8B<(a730s>ybjC{i<;}SI-_yE8ic!$Nli7Rr@TaFj4M!!Er
zjC4|cQO*U|W`9#FwS5WT=i|{kPg80%`+ln;s1YkG`<*KLYbyJlD*MZo*$I$+b%n4_
z6n_%f$MV4H(E#lg>L4xub@ORtX&4nrv}=-vyr_Pd?>jF8uzCHJvJGPKTX%P4$&2c(
zu)ylyEDuA6Ik>}!b%RiDJzBet)pn<iJ3ids<TZC>Jgir+jzd^4mtD(yyOpn3|9x>T
z0+{=njsR=e?4oe5a1wbwgJtcZ=>3{zdVglDW5=>gY(=()1Kp0W;ZTc&x*iy|{WLI=
zb^&gn04g+^MO`@7)>=@{-><Rn50S`6ko<$wt^vV5)0kf}hBO*Idj@<E&z`+VDaoEa
zQ@9K(mYi~Ba$yxnP#&w;p%%H>M64<!XM^x50*4df6TNS{tK;54uH=Y4urqa}hkqo9
z1BxBZ(y$dc6#F5yacp_i_gyoJL;nHGR$E{szVv~7q1p3Y1h1i9>oZT{4c-dZW6A?N
z6fi48gyESa+vTAJ{cV=Op;`Lt2&Wj(;z`EwFrX$SfDGmZx`uNQ{Yt}GwaDex=5A}z
zhceKPUQq^RDPA>#{f$MSv~qoe2!BrV5?nyl7f=p<`xZ#kyonz~i#F|niKP+yo~>H}
z)^yjvR%lTi5W~hkv8kn-UTC}8Q-r$K?^Mj|fy|!^L`QB<=&C$MY;RJcQ7#}IqW&Dc
zq|uB=U(t;i475Gr2n&<bLSict9s;3Ov}rXP#YU)THCS}I*`b10+vp3SI)5-Q0B0E{
zT8R%e&C4L5jum-c5%%=&76;mZfi58CRczc>w1|=r=(I|P`h(&9M_8G%kk(vu;_qK&
z*_yXwskl0fKW0@@vD3fEn(>Atspz~2ogzv4f@AYayi|=%(XUlO7#tYQfhHsDpG6T1
zmnA8S?QfBAFq=nGg0X`j6@T_0BJdIu3vRSDiX|dNLFV7_7{KeKr0BXJ)1`9U6a=G`
zQVge5UT>+_8LtNox0xtv4lnjz$4mWSWL~Vz&neAD)p&iu(^G}X0--4hzkFsjmoUh|
zu#w)A6T|~|n)je7ov?r}s4V6{(^~U{H9c8eA5Ko#STkE6Ymt-~K7UCJ9-;JWQZ~Xi
zSd|JUo1DKyr|J+cKR^_%au!K>l|-<k$Q9xIW&MDY6FJqz9OqE`Yf@HXB1^=Xc>$G4
zdBMb3q=@IY&a;Z9X)<chZ}Fv7urF<zWiyrsXVpM9A3x>UgEm&krSa_iHPA<%is4?}
zyX9)<S;g2<)LI)mE`J6Dpgq~Tn5(Vnr*>+<$WxYIOfB<K`*hsA9wVMxMnvVqKb$w0
z);{|@lMlY^O$bET<+GBn9Xv=60Q+o?m^dccijSs*+cpg}Gvo~^zVP(wP!aQE3><~x
zde$UL&69FgPWi8ld5^E5R4jl{bXw4|MPMXZYFazttCT>7YJYWXLQ>LJTB5~S#n(`E
z6fS#BcVIa3V&#|JT5;(ULF&i4tq<pX7i=}KP=oo-EnbX)SYN%UuGas-{PSDuG~3$Q
zmH;sMcMx?*W+`J=)S1zluUS&ol?_tbV`N<r2oS;~tAym$x0ZJq(Gxxgl|75SbZdud
z7!z0h)G3zLZhs7sJ{ZFLwq7QQo4&I7m6Y&qn_AbEjw{(C%LNVV6vUywJlQ}TSG3OG
z{bDw$1+kn>`ur+)^n|OyTrSMD*u&q0CGEm|j{X8Bs1;fpi>|Ge4Hhylj1t^OmTxwT
zy4(5`*-JV}ovU<d-)@qYLa$rauSATWeETL%_QJpp`G0I)9L5?<;X|f0P>(FkfYvix
zN6oifV-{SWvOBQ8EkHYb(c{YVau(5d1smoh&!mGbe8+{}4ccjrHu&7G>f*ZOM=M|F
z=_NwCPpH>J^10JJ+cv^5z>ybO*s?<l6Elpl<{E}(MzL=i_S23v;7C@&J-S4!R!1Cb
zGiViwpno$!s}#Nwo^OCXVQT=w?-EV0^C4YrUI{!9EfmRUv^{!krv%G43oUpc>6G^Y
z0CvfzeCzdT`;aXLLGNWn)65`rs2O6-jwrSaC&IoSc{s2<Vmg6EiTf=A3=etGHVn?U
z$QlD{Ca(S7q`3pu9awd@ng~Uh*a}zaI(H1SZ+{eY+5Rx41%#7;;elHRYR^LH;4HgC
z3fe4=5%dm*NR7#S_Ur;EU|!OcR`l7kA$s=gCsIVM3vY5@=c;n_ms$1&y~@*w77KUI
zvmpNp*I?gy_UxA#DG01=6uqY@1QEkMj?uBi2dY&>W%`nK51w63Y=Ld}$-Sn7YA<E2
z!GDBIiF^lrB<Wu?-_b+j<A~TEw*1h-KG8$$xn^kFjvvsd6A8)_q)b=THL(ptR42<<
z$bEn(6Lv0ZB)1w9aM*{`NJ0&RxrG)4byy3hj2?w_;!J%Lir{=&!}OzqfX8TSv8bJ9
zCrQR)IoKIKBq=F4gBI83TA)JP<+Sm;oqv$8otsb<IHd_P0@w@Gv?2jrh4#D0w{krV
zIIck3gCXNLmUX<3mpx_8y6k;AmHgAfD;nB3Qi>c6hEPda*Va{1iik?}3iqF|_Qh=N
zTUUEk*~MlOSSYtPz)Fd#%350RwRBze<&sBC6RtniGBf~_N_@Zq4%tds2B$-DF@Lv2
zVdx&a%BPFGS^_`>zplr0`eZa>%y#uNcv)%xQo6P36AR>J>DEwN^Ld*J?OU?K`cK=`
zTvKML3FWh{s4VZwYU@5}Q*~vDp(c@`yr|kAwi6<=D=zayD9gK|Jo{HHIw3jtT&;)<
zN<2zJOw1_2mIFaTVPIjC1VP~20e`VbbRW3YZtc<8*0gt_VxvJwbStv4Z(9+zsA*$j
z7&Z<AE%t~>iKic^*lOl&_I1`L@7X{?woD=Pq}bOqqS>ZzML70!6I+(%VMYMx#g?ZN
zYFeSTZkip~*Xo}G``TXE*FNM^^hTPLMV#&nGMSQO1e{dD=t?;uau*u5KYxQLE4F&3
zRL#JRh@ZF^ln^#gAXNoE(bwb(!Z5k(3!Jb-SNQYM`Af(HpNuk&jx=P?lIWRPrW?BG
zA;asTtsGRd{2IWR`mx*$%F;jzhZUx#4;$*{+MTT&qLM!#$|ocNqAcNVFiE~L6s07S
zDX<sM0?>}jWAqbu^&V3eg@4MD@s^cL`U@vE?lD)6$&{z!&hsKlG6tIS(I|nf92{n=
zG0BjO5nuMRVNL}}nWrLE@3U>RbMKO?9FkzNu2lK78IjufU*%{FXJpA(UO%c8WFDk>
z_ysyujtN*c#26)6T#&LVW??le=$^Uenn}~uaaCwOCh@5iI#>_v7=K%#7hzasu^+oc
z4~)=^tfy$(VyQC9YMrDi!!70p7d<AILM+cCgj)ip2s7%-nKNuj)8F2|Mq!$SUp7kC
za8axVBC7yYf5EDQp8)@bQ6<VJ!0i6p``6snfkj5p`c;m~W;*x(R-~*Uft$cd7<^+B
zvgC5epAEnXf8Y;uxqmF3qIN5*<9`?M8R3@M9>?#Irc%c*`<S-Nv-A04p+x{j_DzX-
zUH*bKDD+z)uGP`pe=E}SEY4LB=x;^(I#<(%{qp`r9#IMY+?O~1r4YARFg1VorLVeX
zEEZz=TfKgn6oTxMy*!}lvn;yoaiWki%NZZtycICt5MZ?4S$}Q&Z83Tc;Rf%3y?&1V
zmAi_)8z<$Mt+B~u#+P{Rej*Z8fbSB+E831Nw~d9rDW{w=;$pHbxuVq%RX)q=jx1HZ
zU`xeIzEU)``DK7C_^lNc**daVeL}v_&m~=MV2JGHHk8l#o?NTdl{-UZYil1bR<YKT
z`L&e~WU;6hlz%Q$4=fc0XI5FV1^222muC6~^lxE}WAe7DvY2k|MMfZF^~E8QSlG&E
zHEYhc$9z2c<voI>h6VqFmsb6-M%dwL(ogl5_b6m5lkie)wZ=c&o8&8a>M?&;fa*Sz
zGVGVM`aH{$JnNU!G^zSrkc3-zdm=!~@Nb~}B3<M^et#Ma#4|z9GBl>PDlU@^p8D}<
zQP(~CblM(@A^LbED<6G2ZQl3eQ6p1FpH7=U;8wF&9(_7hKFP-;KI@T?hoeuYE%{(2
z`1ZS8a9Nz7xNwtulYBk;bXt$@Q2lJD%J1qEglIHviwjVO$pM1tee~(H77Dln(_Y??
zBCuy)w||N!73)1*zc_X_yBm&%I7#^nc0`#QV#Utk@?DYB1-3^i9G!t?mGaTtt<u{Y
zP%=)NRE`0_Xx(WTIW+o$y)FYt#W&+fTvyb%d#=74GF#q&+w!J45^t3uaV@Q7CuWZw
zvLo&>N#G4-qS+S?QgOQvaFB|}BNdH)^Z=xypnuUzQhYgV7kp%%{C2SqVyQcVXFI8#
z(%a1-rms^SYt(SCMKy|v7nwk0V}`D78k+l1$u|DP#sM)E<@B;Aj4qn?$M1yc28Vf?
zl4(hw%U{|?ohD^Cl+26gf6z43be!)ld))XUjWAVIKLySpn54-ldk*L9Jz0s~fK8n(
zm47r^HWJm^1^O`?kr4}J?rbl5PqHto%tg&~QsLb;d^{^+5=w)SYDnUKeT=1!dEY{h
zgPhxIqJmx{T6Yvd^ji_7f`+Fc*R@gT3bqS+j6RGh&nsJ2m|s(R2d=v_ICrIU^jqx>
z6rq5|kQG)sA`DT<c|{sS3v@Ap=Lr}aT7Sypie{*skTive`3f+4u)?snI!0$K`Q<-o
zk+Xpizza_iI-vx*ql{HPrO*??%5H|kkI@ezjSC+}=pgS4n7L9qN~#3>1siBx`DA$p
zBc7vRmZTBHwns^jq)8=0xC!G~f<Cm#4j|+*%PT~#NRl#90Wfq3-ZrFyjzVw1`hUP)
zGS3<U=5($+o%M(f<~4vc?2CfQtYt%E1jfu2yQ#<<?qD^0CHb0ppXx6NCdXOHY>#Q0
zU*p*n^~p6UIHwcIqM^WdVMut-VW!Vf0Gu>aNTNAJQ&N`Kc>xR>C9ODG%nWeQ`jQb2
z%xw%3{s#88NnTcLjA*o@#f|#Z(tiWX#hPVW*fOY%y+E_DrMnslG)E6S{Rvv!-fURp
z3X;J%uUYFLtNYEDxZ%PYx3In)3~L9&+QG1PFsvO6Yj<E+6L#>fMzz|?E>yePP<$|-
z&6{Dlk^OAFHEegw+QEKyu%A6v``G~%Js8mrMzn)r`CwQ+7?!tg76-%f_J5y)Vfj9~
zTiiSQnF_b=VnNg6n0m4AViLJNw%o|azU_NBid>UY+X^FZb71F&*Z6dUAh$5jBs=i0
zNhvG=TVnR6(qrytF(e;IurV4h%qLS)B*M~`lt2D9Bk70y+eIxl$nBGgT@1X~AbMzF
zJ8~$th#O!Z0%|m>#|AM2D}S`tO}3TOY;{(dUQ)i!K@c{bk9t6S@PSUIU?MqZy#vbE
zB%>*=<HKZl*sHwY!C|Ij*GV!;0y#Dr!_68G5NRTKSL9bT19!~zAFv06&CJQ3*|q-x
zN#sR;j@e(h?p~RvGw1-WlX9|d@vg4>lCu3@8%u<FY#i%r%ZtAA{(n%@_iZDJaX=gm
z+gcc7Pm3MwI<ZR(8pO66Zfj}j$*YR5_{>X}7A~~@RQ^zBqkQ|nCM>s5??Mcr+UG7K
zB+JN!W<@07e|`CWRgHaqS2>~=;h0WHtG`;?s&u=rC~M16lkfN+dGRI4^OiSJPw-wX
zjm(W?NRgaq7K-kF41e<sqEdj>uzy901h%=dfAm=n+<9~~7(y5YP!%3U*TE6{4b8IT
zw;8?Qq_?7xwe?xu#W&>*9d#K%QIt)cqrqVCsr6pTqj{67O=7Zj;k%pVuG=Da+of&o
zg4Ql2c{^d`)0{*rkhi71pm!|_L!*;ug+|f??kE;QvKq+iDSrWIt5)RR8m^}GWknp{
z$^z~9#g#<_CceGIrss$v9lH&gqibt9i>v?|?>JxDaTXNRMg3*l=OH)vJTKCG7M)F}
zqWk;pQ8m3mk6P(J_S+#T!#C*Fg~-FsdbhP#>Ytxhi{VRBkr#QE(Xh%_q2SAJ63Wti
zp{RE>9-#ED$bZEqb|2mj7MXHNLi%c!@tqZ(tTa?N(tN?@ti|@E`V>|6k6zMgn$MT^
zj=?9<SJ_BCXwqw@8KvX*w9IEkNFh-?v^HtWYmZD5Wd$`f!^WD0HDwvC4^7h~!WuCm
zKZrc+#NZVaJ2AxJYdEr8Cx|@9a$^HeNl|4ywXeE2^na#BKBYyKun(eq>E0xd*b~mP
z5cux1svQK<gNR%>AuR1*|5h^P3+j%mYFa)&IpJ51CnOV|GkhmI4)ck)SDqM}?(^4F
zMnxV&j=}fy4_h}I9kjef@1b5HhkNaZ7oQIP<Flxj&#LK+p(y|Tpa1e-{`oKe<^Kav
yO928D00|TT000O898XV|wsi<X4jfNUT@=}T%u4?U06+GZ26hNF1|)U}0000p0qCCq

delta 478272
zcmY)VV|-shw>J*Qw$s>dY@@M_#!i1>qeeTn8r!yQ+i7guPSby`bDqz0UuVDA`_1f`
zS?jwn3)6K$)_YEdtSko!g#`u%1_x%5r&x<z;)?S5)z^&5BAEPu1q-~d?{|fk0@kC}
zq(6?edflJ8o0KHv@-|b?HXPS3!z@?B?8h_DH)xk&DMjI}5w_7{H^wqEr+t*bDZj}U
zNDHoOuATpMGWl(Uu0abX@%L0T(r@hoKN|Ym*H!Q4HM$Ft9J;Q7)$jgcb0%Mfpv$NW
z2P*`{`0Y^jkjJe!Cs4qy2k@LHl7QKUw!ap`&TE>#gpn0)zIh#or_wSV?yBY3sOnCX
zv1*@sXck-Z2-bwUr6WT=c`D@3|9FtGG-`KOeyypb>k9m-1y3y-(fW*4l9qr|Zv#q;
zp0{q~4_@OWkZiY3g~1wUbC|ageFBvm^1Z97d4)B$LSYsTe)mF9SCEa+;RG&uqg>}t
z`C>_w7RUM|ySH4BhCz)47Y4;E&g1re%q|Fw{Swx!xY-aI@pC4BH1_x}G%dHagQMP>
zW``z=SdaAt^LLsif)}qi&u{4pIR<f8AR<y}84m4k=#)9>7%Vp2XM#^hC;fIBLXq!~
z30iC$k=hr3aOx(pTP3?uECE=CCWwr^|8EJ+C|d$d&zU~SX%J^F7>XJG50@x|?v>*<
z<n`gnIqjUHXN;nJ4EY3{pZ~J}lf`1oTFpimq|1e#-L#e76qr-QLnMwP%wx`m-2-1C
za&FqL9O)WW%6~D{aqH5JH5jT$zume4fG3j#W~}iyg4fQQq`S?NlwylMxeEOJKU`h6
z5$UL0V_|W>XiykuWdw;5$uuuEF<Od@6~E168TO&+{x{5D*4$?<+7;JWJkgZEgf1ar
zn~~-n)9mJL9y~ARMw&h;`0@Xr9{69>c9Z1zH2d+4Xd9O<jQdYpAoJ(X(lZsyjZ-bG
zxt$blsG@294+*trNQCp}sH8^#BEq@oXspk4503R-mgxiR#@v+tC&?mJ|7W~o{sq@-
zz$4fklyS+lbzgI=t#-?X)nhvp;5H6hVI9uAv-N)@m7qD(l|W!R4Y}C3AyaZ34@uYC
zbf)=jfGEYT-YXCGQ&43OaoANfCp!N}QZ*;qYOPxpmdK)KDKxjN#QSo<t@&UaiRx#Y
zYB%Vw)(h#nr01SY{##Jj{jso;Y(;@m!DHimTkQdS-*M04MLU#G+eF+uxlD+078Tuz
z!D5lcf`*g_x*4|iPD#v;-1Ds2%LfHWxAvl)rnM&1y=Ze6S$n@uTz=>zqr8Tc2qnKV
z8Ee+^p@6J4!sTVwv`QGRRl#y-GM6M{y(XEq4WD+k%`<5=FZg+t{{<NMU%e56_UHUV
zZQFnGMCLT>j8r~<>?`hCAGSfwHF+B`6p;xb_g~xL#997Hpx6(>!#Uw3HEgriCV~~>
zwM|A_vvY$fG*#jlOrAXy`#-b}6>Qa~E97rjaYi;->lv*(Z3mR_9<Q}*kOBv|QOSJJ
zNyh(g_h%k{M3yuDR(#ECV9LuUcr7bu_{$efOmo%`pymet$WQqhj{k2B&}W{x*bBC%
zSF;_r+S8n`(Jd;h_)1j#xt+;5A?HtF@ZwJXKiqLQ+Wpf5`l5g&R1V-dMKr!DPnDXx
zyg@Eq@D_^Fe@feX`X{}b6Mz37xR2?RcEz?SL`avGic2*P&F0RqkS6Jn!za6QTa#(K
z5j<#E?EeoimpvR-0-_N^_TyD$wgOvi<YLQ`?U^pfL<%|PFP|G)=8*mW@e}wDz8a<_
zz#Ne_QT_(ZlF_<jr0CM1Wb>7_MfL0t?y+Q+87#wrvyznmGNfO)Jqk|J?1rs+PZ|_n
zaRT|%C5O)&3Fko|RRhUSBgY)|-~7p>XxMSq4Jb0-b|pw^OhSf-f0L|UIc?RS8?pe(
z?{6eN|6r>5Z?iZI-BuOUj%>ogqCLPLOF6A-KK3O*v>9Bbt<d}Ul^F+D`@i*F$uCJk
ze!V_Q6BDD{d9>%ayh5~K4Wv7jvt^Yalyz@-j`iQe2{ps58u++qA@IJh{*@#i?y>MR
zYFJe)j(YQMKS)|SOfJV#nUE+-@v9qrIf~aA_zL_Gfy##FYIRhM#`O<_#^A&q=DZJu
z3}=c7B$shJ!&}z#8NEgGPE_ip`SHsag9sQo|5bN|&!k?B*rLQ<?QzG7a}i!p%o-y6
zLfONjyBv}FPL&6yI&I8RKD@KvhS<VhzZV?>5&z6CBO~Tu55wH$7_Iap6DIVs#r55c
zs2mWEP1;tLV=4Ik*5YxWTtkp1@_Xh%kFDT~LU5s@PFv?|V<(^1L`SRBWCp)t>O>0m
zp^#;ej*VstEDys(pH8l)evdai6(_2u%%lmGKF<8yg(f_e?E&3Mlz2*kQ&w(4r8m8G
zc|u$hin5GekZjrij<+SMh-(T@bp8g&&mtzbuKUaE*iP=VbkvRQ%jzY#aPNOLLvf$q
z(vX_%K$F_aH{_g-xYFc(lCc>wzwD{i4R0g4mO70USrB*p#!m53Bz6q<#&I59r^+>v
zG;2i=RkQ=U|2wW&LM^!1OoxGp@rKGWaybr`fkXiw`P=cxUejr1-f!N-$PyXgRW#%|
zkaw4+2`!@SgW-i7KA?+PNL#UPDd{0k_pVk|eE5fEurzAzU;G&COaa?a;av1r+ul?X
zhis_0GW3`b-CD+T-`C$QyI*sxQosH4en9uT|4kG|BB;VE%0>uvUlM}dI5lDB0~Z)w
zlu~C^F?aRt_;@QwkW3B9K2!Pxh`2g)@jd{B;}gfz8Q&uPV?`WEoh;rFRN*F=^!t<1
zChiq8ovVKzSHA^q`7h}lQcNoM9Ah=PTss1_JW$sPe5fBL^4<Q`LjLQX!H{~yN8$eO
zKkpl^zYFXNp2vkEDfw#H<kBVc6M5zKq+GSXs(NGMH#BFCvieOYlyZ8~#zPDX0z&-n
z)*D{M5XQ^Z-(@qtm}t*Q?M|Yb$3;Ri?&Oi6K^h;DW+Pf_gZDl{p;OCj!>Xh0g9(bp
zrl`ooW*CLN`}Vi$k@gXipx|;!^fR}7Ay<>{Ov?-P-pcn-4{Bo}%VM6%n2r@{EpHaa
z_~t8!L3V;Chan^o?}ZQ$C1@WF0g!u55mNGEtY<5Ob5lCTW<Wv7IdYj$BvC+Z{2T+>
zAEMm|eqn_)=WzMuTO}U+ha;>@V~Jz-5q{y+HD|W-l<XDt{%*pQvIpm(BqM*#-SNBl
z$=n`0tp0Ns*vIA_n8Gixjurv19S2Qu|DGDO`!oL`w6>AZ5JJ1@ZS1lWdwH7KSAj#z
z2vc6hvCDX=m7_Mpf6ULqE>jBgAdW8=|J>s&)!zL0j>suX|Kz$;^RDBd?zFudv0wG#
zXfNO2GfH_5gFn(3&E@HwS>4Bnjc5Rd9_cS0VlCIwHLXw!YSxcC0lJP#D>89!+P|4I
zq$WVS66`yQ%p?i*vnsaE4Jl0Dn3%UI@=9j&AaC|XRj!i16b#e2FtqwcMk}I%&hyL>
z^!s;pJkY8~C>q0j4zp{R9D++6EP;1c;pE;((v5Awhj4-o`I{84?PWT<(eFUl;Ulcj
zVMXjnj6`3t*orIkRR>~=LLhCy<L}7Q*xrtWk*_;@{Tgc+9UndF)EVaKbQ7HC2R~A@
zo`j(ds#-Jx5b0_K{cNqg+xfrlW8WN8gi-n!u|+n0AQ$2ZY8ITR@IM%ZxoUAJr(YW*
z$W?bOKXE4{d0h5Ap~jUCW)%UCy+4*;Qx(Q;i?YH=#*CTHZu=l&$%%bJW~JzllED)x
zbKJ|X%8t)*y?H(|*(^6g1x@TFZw(7p2hvM7i*eVSQTE{eHdXgV$JEU+zfaKhhreEj
zcJXU2mnNc%75tekmToQP@<=w=Wxl)`n~iq<#n9CtA@U&Ifs}Z>J~<4mRdc^`lQ+nq
zNlo``B#^#5aF~qh{gW`^%G~w+5S@W#+=mtVz^kG^CRDgdj`!rF0;n8b;|F;4eO6I<
zo{4fKLS|nO3jayCPbhgzo#^s11ARmuO37Ums9o(72O*oo18zgPZk!J~|Dv29^_2Y<
zz>jA5(}m25JnY${J(z*D1A7-?1;VeWZWHk|>yTIGuPNT!nfiifBz7Uf(3^!)7XizK
zU5lex#*n=0;L|Jvgg%zZ6{3l0cKJotdumkuwq_}8PTqRt>pk}{P5p1J-9(Z2ts#ti
z;b)*&?GXk>$AJT%+R=Aoe{ecZuGd6$78I0kPE~1Fs62W&sdGS`{{DmH?+JU$g80WK
zTbQ<t&P$e7gXOEHqmD@AYnE2SI(R!~|GA+-$VAAVku~=2M=bXgLYipUHFks3NXL}-
z;`7`!xts!>haB^o^xNdRMPllIbZZxn7_`<9Lh|?p3VmycxfRwgEQPTL8V&PDBG&B>
zxuX=u44aY=h4R28?C4J`kIl3bvH1s4r%Wz$`$;dIh-c9;(tZLvJzkIrNSH&XAnIx@
zG^gU_V}@s%CDp$FLo(?}JW;d{qdNjg7XKbq17`d(i+?1SL({>kPTL7(Lk!BC={;oV
z*Q$#%;*eb0L3Y@c{P^qXV4|xWZqmWizYF$oM_EdkdLJOwVQf9;$UDS0Sc$}tN}Q2Q
zkr3up;+a?hHoI7iwf~&r!CC#Cnl)YsMLnZ*cYiRyc;2x{u6LdQdgN<gnE0lw${01)
zU{O&pZT-RC*W7V3WTwmYnMEFDE+ndH_<@LqpZOw->e1O9Ef3$8Uti6y;HLKjVOt|B
z?pcb}=r;l9LaEbJm`rr`ts_6iEdu9J$m}0f%%?ii@64qs<LhX<PL4fj#i<CbOIOmv
zF2uIAebfN8=5fJ7v{z==_SFw(CYyN7%I>t)-R6qoeD|mcsU3@{pFw<SUew>=g6UaB
z^SUdYU7H0N@zMRdaVznpP_Vl~j)ar4ilkEU6`g?gmN?-bt;Nn-5b0Gev-ybMAd?8w
zQn|Ke%_F75>_sW^YLew?%SoX1%td&6Vtn5j>CR-#52;r8H012W;+LKdYTs^Eo(pTo
zaV4jczxCn{N*ZFM1EK{@ndi*GdCWn#hH$0H2VUr)TdJB_T#?zS?wja;-P5gkUF!bn
z$QUGR0#ah>7fY@0P+Tu^M#g<<lNeJ8vK(quDWw<_UY_x{lcwNt@tRYAz-{B1rdfcf
z0wJOOgyAibvORn9!5i+_)#r3+>v!7%whv8JyzYfA*AcofRDSFm?%)2;=`w;|Gjt(_
zHcmc>bb;Mr3%y&CW82B9_2P=)@2YIP+X-FWiQKJNS`U9^d)Z-iQi#~kC#f2Rrvz@}
zp-txmgaqXb^h^I3EZS_zRX*~6g=z!@oVasM#8&Xi>I_kY-=*AX2{6C|ULDX;pdXD`
zpu&9+p}Gw<n4V1ZBTeuOi#py;p$x)o)#NOk{+Qv5jZgQ7>>uz%JE#6#cj@__T~3Lj
zSWh#M`fEj~y*<f+d4jW!gXxk+JqPHq3lf+TM$|y_3>UOf6T&>6A4VMswl@R(XvKYa
z+?-z=uLTcHCI6A4)Eyo_p3+#E-jR}Ko#tjSC42E5Fn(!6^<q@~8bYEt3*_7{h?hyW
z@`zKo?uotJf(^=3gkbhkrfp04^H7Ag(`(y=uY7+K4e<zqxQ)R_4$XgV!P{IXr=P`|
zo=p)dBCo0mkw&`)6I3V>6y*XeM#!a&v=Z$|*oo0->U$oY{`guMi_VT=)Cs=l&{u@W
z=f#dsILk@}`Wg7Uwk%^(mWO?za5wA}%78bFQF8Vtn+j#}7Lqs~jfFCb!lQr5xdRFX
za_$hyNSLy^HA!l>rz%N4u-so=?-g=4J@*!7q}UGPdb}T%?)i(6{Dy#RwIOL=#V%b~
zd)5cLFf@00C%!KzGRwz9__g!sdyF<<(>&_ZW1v<e`m@^D$v{y^$E1}iB*EAm1#j7u
zg(I(F_)xU4agRdT4t%J{soyw`&f8$+VE21lg1ck&i6Q7Mz5hJH5RX@aZ0~f^E>Q%(
z;p<oCUK91Fm!I3^qw@nY;zY9}5TO1Q6SFPocbV92$ShWEv8xv)A!At*_ME<!w_+J0
zkqG=dyAPRIBk5ckL<6bwU=^9#0ubRBaSE6cwTM&0J-V<D7#uBP@U?841f|RPX*Oac
z`%~Qgjn3WcU+C7A#D_r%nEma+*o|D@zF@FryR(VQ(;Y0w5HA6ejJd>(6}>Bx`^Wg^
zA4&}!4N=RZp;Wl$9Ebv))@8O<Lxi2oeO#duEvV!%F@vF%plBI$h0GK3Lx6f>NA#Xy
z0txf)0y~UPFHfoWWjOrC)52mpKVCF25gMB<<WoY{`P!%PcM0`-AOyUgz6Xl~Zr7C`
zCqcMn&HO$&rVY?97J##`1a~3G2vzeNc7P%#MP{JyLN##hAXIQ&o@CAtAp)D6b*nnC
z<3@B*5w{sXnPve12`k@h!``FI#aX$vN&e~Y`BS-&?IsW_JXM4P-YPX+E}VSXkuFER
zKyg~FESVdtx~nwNm_lB*bhR`Bp##<RwT~E6>KiZ9IRqf9prp8?1`12fI7#7M%d$OP
zkYwbIzdO3}m^7fZY2vaxJ`w&c3);((E}i9#`#$1Z=a}+`W~F|1cIEi^erd?Qn6seW
zr=Rflo1jFhK<;%!d#PpgbaW#hQ>TnDs$S+<7G>Dq6GHsSFBt3$=TbI_avbj{oVg@7
z8~b{5duhO=&f_x4zk`-PaKGf6pPirf91h#=$Egd_!WU@QAjQ2~x<am;`aloRo=Y8L
z_P?Yc#xh+dp?*=0-9b$S59HQQFxt}-Al;+=>Cs8yfhpPK254;n{deB4kbK1PBIyb0
zZ5jF9{`?5=moz+jXgd_!P2|+;khf72(b9~T4qgC%oBO~*K$Y2CL^K~=gtlE_MaF)y
zxh#ljjk-Smpw#t1b%dr{eTjoXC!Lmokh<N`HL=zV1uv7MwBtzAr)_0pzw=hVhC=Ee
z1?c?ucKXFXPhww^tal6imJGDFJ0cM279*nD@*Zy1{*FARr-=j(vrsn@(ADmBbyG~l
z+d}(n&I9u1eEBDq+MnIPJQ+=dD${w?i-|&r0iEx|q)1M*3d=yJyG0%UvcLp>7EiNC
z3GCeVSDmj@o|v=Oday>k{vK$Wi^`ZHIbknwGwy$3r3qjM`KR#WPWYLHfImf#b!9AL
zO76&~zJ0t|6t7MGy7I1HVHxj|1CX~&wu(U=H@F>gVMkbk9l^fjdACK%+!N6+K8K}u
zW*=J3U)=4vG+uIDnwq}%i`oTkcZeaU1I{i=8|qKl_1QPQ9;lg%F#hkCc02)%uf1Zq
z)HOcC#7Wux$`kVSgJh-qW%x(iSgga6>efbdCrlM?(|k3*XB`6^qey;D`3%Ah;1GHK
zNklPlN*Vv&Ae)G*ZH5a_s~n(xz(6PZBX`v`unEC-C#uSiHJ|)QG6^TT>cM5`1`xz+
zG1sEz*GqZk<NDQIQLfE}dlR^gTpNQFQkQGG=BkM8;6oZ0l+BvF*6TxzrJKt75|X4e
zf=bK!?sqj(nhdp*5ZMo^7(AV887r36vogP77v+&Fw$HEk`?q}qeX|iU5CsM4py?TF
z)?#~xRpR-)I=Vm2|3%f74|QK71F**FafMPA8ng(+j1Mm%$IrX}poOQBLL9hP4=+-w
zclhtqZ;EZS?j%DPleH-H8Z&2*Vfy#|g1*61;vtomX9?ue{^^W=O#|CeFBD&o-hKcs
zit;<fW7iX^7k~*b8l0b>PtCMKp6|VVZux2<|NQ+6nWH!)G1ns!XP|$$hgKQ}2N?4o
z{CuY_^<R=Ik<8yTEbcXsZB@9q_5<-83_DTZD?3_^l~~MSYCt6~HWH{ylNQx$mrbYU
z{wzsUoGNm&Q?)q6zh_AWju(+LDJ-Y16IN-uqvNxd9MJjy-i22Fk>v^V`kE|wrsW$H
zPqIu2D-<(1#(ditFS|?tFy$U#Q>u%KO;?#E$_?o`jFyNLR)f(qk(}8R-kk-=9!BS=
z!eH_T$fjq$WW%b{TmOU~)y$cjQ&nqnaO>FJ|E6S)b-P)V^Q0NnIgazZ**4=g;f-#R
z{r;k-xN?Wq_VSjNccqd}IBptw6Zn+umvwz&wKnF3Wk<|dqV8%8tb9?Y=fb!3BRY8C
zqc*mSCbE_NiF#%cL^P@i?z&J`lP`F10HI&B?8%*<h3TVicw0(xO^3bzc=~D!DLd|g
zCzPVzt%XS2==9`k{%DAwBcZA4biyje<p$?OHvy4}Y%)f~GtC#OSUdp!K9WvxE{j1L
z$(W)V%K~wTl?MS2gh9$=utQZ}Tl!6ZOOcBxdy`SO`3)uCnZSmJo}x2_biRd<Bijj9
zViz1Jvx{B=5-{wo88cF>Q!^BcYzj_e1U;i~s((GwYOx|~v=L1-rrI5B3qo@Cbm<H+
zGdza<2>eb+inx}o23c@dNXETAj}BRYaE*n#fSH+JbZ03I)Z}F~3F29d4ofIXqoL?N
zb39M`3I&B1ENYXo?yygbt~XhNcVPJsQ}LzlPD?OEq?k-ooEnH^q$<q3@jJF15BJ9-
z#7P{LurCU>x|S?V%SO}Icc#`Ch)DRZ@}z~f-PN?j_ifmP$X;6RBhI3w^;1ze-Mk&S
zC5z)Bo&FX93^mYnI-~9SxWx}!pj~)-F`TAyX{0;y@E)Hr-$irQJcg_XtM^0>?saB?
z4f}`f0I48(SDj8l_CcS(+(ObC7VIAaImKmXBzeD;rhjmjVkYFt(_epk0|R9-j^1))
z@(iW@VCqr}4y^G!`hn3v>2`WoIG$UIkSP_G8ON&+U|jUIbleRFqY4Wv!?+Ve4hhG<
z@Yd1F6*pB<HJ)*7;99jHP<=Hg4riS;JBh0ch(&ZCV*7__l!ZvdGdX1e<1(V*4VK6@
zfKNmQb%MaIyB>VTUr;Ak)?-3ZVvVhzrDLPY;Gp(0P?`$uTQL_@k7P?WfqtrH<Lqn^
zF^hf=(7qL2oeg-<VXN*smoUzddwb?`%$g#0>SUYI+K}uuK<k9;!V0~d>6YJ1o*;dj
z4H%F)cAqf6VWg|>N1xUByLe|{T|-=X@W5vOLLErP_}jNOAX)Sa{ex*=kh=9=-z8OX
z(H|B*Xj^|I|4jie21Xa%Y>|2D<tKQ|9j&1;fUTvDm`O?H9>^@#RxHN=v7-8q#0R}A
z{V3NG_n_a<fMJ;Ji&Y=GH>u6@7;j5d%^ag4J3}lSTXb#_f`=|FOx9)Q>K|j+Npz=D
z-^n=}I%_oj7uI<eYqF92xE_G$tOP))JA5!iq3d&%ZSquBqaHQ82Hvr!EaOjYP3*n`
z0uDYh5pL2={&(}YCEM=^Q^F!V-RFIE;*rOP)Gth69|A%q7?qRY9}3o&##EJHJ}Y0r
zp4YH@y0f>HFL%IHEy6?I&LU#8NPsp^IGSR|yZHlx7+n27eb>DOx1GA~-I?t)jP?J@
zw!Jg|t`|z=46cjJu8XL#9rUg%AG*;1+g+%I-ac*W&@Ik~E2e%K$KM_Q4nFZD9#^vy
z^1%7K5tnAfEKBXif#o?5JW(V?!?;+Bj0m8^(`$hJMn@BMFj6|T=m#yNTVx8Dh?0c)
z<!)bFV&D;*Z4R4~BY_jaf{7ROy6|t>2EnWjM(WgyNJDP_2)Ww^krx}($tjNmZy@;t
zGmFx%j;QUJgwj((4+irtM8&qI<+d)h7tWw@*R+;dA`bm#`!@5MR~P>c{A^~%?;O1l
zQPF)WssZ;DmJ#Re&J&?`Q+s8BODg!jDwtR?T%^2TRyAp7R0BxD2r+o?LSi0M_kyU}
z^R%THsc|<`VAU0i;9`e%P;n;#=Xm;SC;r$ySiUUv1KKW>fg5B<oF&81&fVKgOpDYF
zF`Xo+)?iM)`g;BWlO}crwNrz9_K|MO$1a_Qg7BSnbrTKU>FQiF4WuKz&>b&pU)GN=
z>y+Q@Zy9cN{5rC0x!0_xdX6sGkr}*P11QUu*Kr~5k`!pU72nPReq9g|_jVvryTaUY
z)mICkrfAJ|VaHYWbQCrgg-=$R{6vkf*c1kI!K&liQ9nV10qd}`Bb5rF)`42f7@X0U
zOx#5%lr!I(nTrVD{Bd(Z7xV*8%;)uaM*#iXsVP^lA0%0yuRwIP4MmW!wstJ*qx&wK
z4_1uY+8#Si*FH=j90B{3z!(nGK_Jh%BDV|N{=nj$vZ4Gyz}Hd<gO=^Q&3%U=1Y&@C
zr!U5AjOqo;J+v+!s=4@wa`)a^`IIB{i}{HH_L6gpqXM(`(O;vQZs(nOZ!us})RN)2
zdj3*##_-foW45~NSW6U`hDX$x*&0_@ULZ-guUgnI?pf28zMi;~KKTqCL+FaMP^h*H
zT<9rZ8iRwruHD*YOf5;p@$-|9;>X`^NdUsc!P%Ep!XMA`)3~VH(mK7P45xTgiv>7c
zx;(Av?f9SEN!m7pyNoD?5AUOO5t1y?sR?AEnNQOc&0)v}=bc-(?3_XK>FhkE?6vqY
z(-3yD>soJ&vVNH}U;BLt#NiR(+Pq~aPB$~F(m!A~P3>B2kL)nqtI$5rRf%Gk3QQ`_
z_bDunG<?=fLEA;Vc*`i%)OPWTmNQqT^R`^_BfbKBr_JpH=R0=814MHT-^Z<aqUTTd
zES75DHll47Top`Q6mZ=p{5DwLn8wffqfj_NT>6CO3V*)8P#V3XL+a({D=txME?IM=
zDHLzjw-sF6f3X-pL2uqVd2Gwi2ZXD~>peXeWylwswKCPDxd{vnI(`uO3-Yyfo~j#{
zubgTJRT9(t|BX6Yt=K-Jcj7!UO!RZ+RzA`&C#@vcT8e1!uV!d*{57S1oF{I;)Ybx8
zZFOujB+);=4E<`sQp?`flDcv9Yi2OcwK*0P^tI?fB{u@Q&E5CdWF^Sl4REe)&~Zep
zV2z1Lk#PH2;i#78sV&7&q4J1OGh`6Nc?tca<9UTFmrfoEit=3g<K(9=9R=F@!Et1=
zy}-kH9ak_ab>j7+SXAeFrg7?DEoe?^godxO;}(R3UwtGa@Ub)kG&JT~sidz<<lxIn
zq1nZpG+-{_VI6ogtSl*lX8@_)ui>qV-;4-i9bHRf88UWHk?ZXq&upZjuq7+_g9V$V
zjRJXX@}ZiC<hu)^#|nHE>M^U}X3lELX}_aB`v3E8bB7x({E^gkWVrcj86Gj=gDtm@
zrq{3*iP@_MLJen|=I_rD{6^q#c0=x*=gzQ13F7ZtA8Lskx(2_u5)**o)sx+y%{`F{
zkAMAZ;WZo%W90e*VJ_k@DNPme`{mc|7zZe=Fth1@g=kF?Z|zt^MZLjK?y`bZM$XZc
zxEQkeeY3i;u-X}lRT@7a4j#p@1qJndI8=y!2GN`U6Qe=Y$x4z{Y?pq#`pz&;?*MS|
z@%?SQS+hnyfwJeGATtCO>JvsW5xQH_AC7NUZmj=!?ybfzxG2SO{Bw?uv_K9^#eSp@
zu&Vp(R`N?%oFPh4DmB+ncXAWb=v#`QVe;=LF)&mtaQVr0dyJ3v)Ys)CPh>vZCw_Z6
z`|~j`;7@3B8PfKqNDC5?epkbS#V@dNug8yl@e9K-{KsA9t!Ga_dEu{?9hIR_;yO=f
zwLR6<g%#Dbk%=Y4i-lCuQEgnZ09&vb1H&&};>5&`x;T=Y#EwrN)|lv(zW0RVdix(A
z);W2xpFX$VFRQyUYTn(WxLJL^?^zeWwMW{sd$-0F$Xu@XY@|AFP)XL2-Tus6Ume<I
zEADP`hCrkE8O8{Ub2Hw&qeUk~x^tT2D&c!W#j)UpvaO}_N{}Y5;iXw$ITSFauWKaN
zoM8}b9+!BEe7$_S%3%BLejVH@P{71nC+H7pA1#)SzUw5`!*_LSR2KDUVxfeFGy7v0
zJo|-H;_sK+XLotR0Co;cO0-bvH>4;$RWZ-q&m-XS-7^sH@j^c@O>jfyZ0b(}pLXjj
zB1QQ^9?zyu=r3;*+6E^j$p?nAJ5qS1R(LkoBATG8qE$OjD@K5@BqPWp$-^^*G&UP1
z{SPT@(9*a?fJGf&P!vhyB)a}p(Woy@_8eM1^v{vJ#11S7=sH?|`@kJ*yYN_kRB9Ht
zeK2hM>&Ft^I{eR>|GmV%n*#G)`WINUo`qmm)|0l^hacbmxmYveXpxhqe-#zdp0P#O
z2<270-T^zs0}I(LBjpa3WAMiYMU{XY$~^C@8z+h-!*oyk0Ell8{BJ;f?SU9LL;U@L
z2moMLs25Ui&_S9tOacc;vDhDv*w@YGrXx}F|6ZT<0I7GTfUwM)=1E4X>45IU2K68_
zhId=*#L}`-jl~5NRDhwq=9~o3Gp${P0LJ$ysAsnbfwhD~V$C@OAU*)%-Bx+W-m`Bj
zSZKLC7<2cRJwbq;X6xrMrKnRE$u1UX2WR{QT@&v+gs`kU={?U~j|4~s^%UfdEujeA
zx_(8H@KZI15N{z_q%}?Qpo^Tc8IgL)YANUoEjXk(6c?*%fO(|lLhl4MLgJmck}DV2
zHJ%!EfnTa=;1&xAv>Y>_tXNsZd+h2eei4Uo|Fcf%O$H`KdyAd5<IVS9^a}9g_LFy~
zBFoC>^ZdgB1`9aSv#$n<7~t8y|J^`!bJ2Gb3wt>~Vo9KV>FE*?7+X&7zhZ;=i5#4~
z*w%MLPgos}l%JuGTb)lvTij39Qm6h8+X8*tnTKDbs_({tgY6u@9D|FVlKIRqXkSCx
zAZR~`K?Yl<d9%Q252;HijvH7;A07WxDN1{G&+$9bUsM<RWGe`xa^v}8xAc@(V81)+
z5XV1$cc^MsFtKzBM4Mm)OtN<V=TxXr$s)J{!t(W)lngq(fL?6h6H^|i=tdg{xPR(n
zyx&VhEbS@T6YT2E_FRu9>~`wLDmi9%@>alYyYzc$5AA@uzLtGgi)TF^01TgE=8b6|
z_T6F;p1@xumZuIVS{+G|Y@8EzG0^BYrgFtpEyj81Po^ojOj+t)#b}lEM`^<KUscW=
zUU!`y%0o%54rKhp)TjdE6Z`N#bG?HTFJPq@)Y=)5(Fp=lQV8DkpahA`y7@!>Wv*=2
zmr+Y!+z+a$WZdKu+6U=7pxH_06(_~y<=ku3(p70Zxu7X6hS~2|l0v`R)_blxaaV^c
zIa0#Bi<*fW*tvOg){Bt)x!P2f1)tV}$7#eP_GKMoM&xJ)3A|$h>o}rbGAOCr$$QVd
z?=cK2HHsU1zEL~8jL?tjThb<S7M<9M2KK2g=wQ0cjNtK<^vs?K$ofUxi4d~eH~{an
z&Gp#jk+Ll}PWPVFGRot9B&9wyEf7;7_F64v#1K-@OxHG0YX8$#PUsz?j^T|6HhUU?
zma-Dz2@PbOW)<{X1PP#wXlI6zJDW?dEK~f#Z>|r%mTna>L=P*a>2W7ewj7*kTW~jq
z@u-frmyu&3Uk%a%-rSRG?+45pi?92Pu@?@T<Gw3fFxa;4PZaJA%CM#*AN){UX;D8b
z`P=?0LBZU1_0HvO^@}-#C)t9kY_=1BYVr4n9;^zrged#4jAM$YSobkQ;iuoe4%szw
zF^IeCfe?D8hU0AgiH7*mpo89)_pHd9?_KItNt>KC-q1c^K>yp4Tc~x>%mI^t3ERu^
z3XO%D`|hs}6IpQyvYjzzYNnVm=AzpOUXkvU+lcW$S*+9k?Y28C@#8k~rm3c{jOtHy
z`;zxKB<!T<Ar`yCT4O&*IgN6@zmA5Abwpk6RuSB0`HfooA704MbTERp7@g9sHSO3v
z9n)LMoyT_Mc}{;yrbN=*6S$>WAIeV`tacg{r&@dr)iU~O9dO(=rwS)imYks7(9pxZ
zPCR1<EMJp7IXFZFOvjg=se*^Zzn_JIOT-7AGf?2MLz7RS+dvC_xOku=O%saQw?1FI
zUD3twQ*<TJ6zAvv6O5lf=Lh5qGSy|fnXWW)$H$JXoEt<JN4(q0-$jPw$K(!L&m@Zk
zWV&qKVnO}KR8Kw1>08^c5psg~tA0=E)I98x3R^#%Z?97A>1kV?zQGI1a-r!otOG90
z2}qq4U_suNWBR;ly}A3)U_lG4ZUiD^5iuL!LC7(7(@?Ytf<hsI4C*4r*1e^whnjRh
zQPGrXJ6k}=v<dwE_5o-dh_)}2Olba5rI+T&m1qzv91&;`^<r?3{%Gs+#aKnVQWH?w
z{xVllrjQm>1M>9iXM->k?}A1;pTWY$1ubwilBXEdH<G_!DeZJ=t=E=<C{sjB%0+rO
zOBB%(E24SExqM|`8<nk$rX<gDY+7>?!-|;etD1CY6`nsxxV2*T;lNrjA7U1W>wm4`
zEJe~9=%BuXnclWwFk)+bZGcej)dTWj<72Dp2I~>yZSQx&DAJ*tYk9cxr<JSf3I{T!
zl417YrB-xtW6D4U*CB1a+ey0!6PMsA{TWZ|Kc#apPfv=od(e<9MgPXLlR1(;ppLtS
ziuaR<w+N}R=7q25z2gs!=8O3Uw|K$$O2ut`o9w2XKC%iIj)xW9ml<2w{Oo9mQqv&5
zo(&H7){1epsO-9=Joi)VLdcxa!~iOrYG9zGJuhtb43Ks35)#;*0U)_1iy=wqg>E(^
z_&!nPwxdHO{6JNF@{5hg5eA*Z1M3^H(qGV6>RzNIQju&@*|DRB3tCuHvjIBpv_NSt
z!h(iUOf(Wp{t*XU;$9NJY|)vX_qNiHE%pZ12+ev10ja+rnRn@elnzvETwp*HEKZxk
zmV?jaT0Z)Z>GU0B6=Y9tIPw0xYrWxLlyUcUSrmH@YNAXXZHxJ?4>8xm%9(okgV_kH
z$8#okot+NUF#eTl;#I8yia4vk`fp#2fA~jx7@4b#5~59+<6~><`Vm(8)<7Igpg6Pf
zg>xl2h)N0HI<W42KXr-_dICxWrJN_+MQV;(Q#|T@Lj_dib9^s6{FW%_3jQc{E}nFs
zt*Y?9@1UVht6h~Z&9Z!F7Nz}>to9>|JJUu+zq+uYzR4ilM$XhA0>8R&xI9UB!6r4r
zim5TU_>cW0y-_JB(n5%QIg2zKLyu~JW;+%d&BG}?Xz6S34oT)w?FXRmkp(1YrEOtP
z6kR20e6$bt0L=w8TZPFFS9MRn2cxqswuMzZk#*m#EFqdnhbV=Rx+#pFXAL6Ys&iY!
zsvrPV7Eb5W1&mCms^YE;Ln!bpOJZ=@?PA#w=+-|$V?RYkkID*GPtsahtco{0)mV=6
z^@Dbk6E%VWn~(##-vHjbz!)A?!Z(vj6>_eaK)6FW4Fr8wVZWUN=xe2)TJP+ix_C2<
zJgGJv2qbZ$2M02|vopmY{HwU079S9nWB#hQmkph?Z0oC3kCw;L3?{@~)RsJ04<Te;
zuL0%NM8Ex$x#!3h>)7F!Cw4noNBTcx;a%=%-zFyuE7dy#W&mP!YzsOG`dSx#h6ZjD
z{y2pVX-Dj1;<hB^II>%LLRD*X{(*V10xonqx8uO!tG|?)<7lYFKI?k-w50r&vZDrY
z5ImIEXMv!Y$b*MTx4jDWS1dJOb&CzwI|uX#t*o75&R1BAQ04Cy%m-z}04g6rIqcf!
z+aAfvj#~a32#_X=!z<P3*ld1B7&0pX;0sx?>pnY}8)ELxbtQBxa^vGD@^E1N&r2ai
zf-WTpnW2UAaPT%nC1R`aa)R^_ax|Dxmq>kYi%vUxBdtB?`>d2i6-zTRXs--Q;Yxlw
zzw`SHkj9%*1us-8>kgAeCub^aiNX#?u+U44Chx7@02;LGxoiu>M`k^hVi9FCdG>VR
zm(4`R4OhoG&1Rcb7*m=mLV869?uD9{2NW<~-@APi+Z)Rh`9EQ)TqhtF%^Drkf5gMX
zsH#}E{-v&YIX31Us(Cs0>2x$N6=LewQabg5U{3$wSX}+bLULA4Y}T!OW%F!isDCn;
z*h~hBz;B%|OaA?#@LuIrV=J|(UYgpN+JgN=r0jfMtLzU$;EnHK%D_oKD?~5vNU=~D
zg@?0Ubwv9c?bhN-sCT44R;(X+lxqvqRMAb3AGtUT2+kkf#R2+AX}1@(WuNOw!ka#l
zCVOcO<-{d)g+o_=iFNe?hU+!c&-|Wmxe2&1Xy3S6F+U$3<?XD`Y%!3+$N@uuKC202
zb7r6REAwr-J=bjQ*vIV64$IdHouMPrPa6rkQG<pRP07PCXHADE$00sdTKEYf<SB03
z&j`|(_Jej{4N)qDMe@m{X#=g_SaE!Lfv7ki=2Sl<fg(rF^<L-3TcqUdP_h9}T?M?_
zm~9>ncncxk?!oUHpawmNyb)SB5nDu>js3X`b&kJAl(BzZ9FHnZGapGRq9<g&=8iq0
zYKDlsg#6&QfDgB+0t~BTc!dc(AAGLo|9QP$4g9z^t2ZWa!d?6M+07tTF6Y0FX)czW
z%)o8et&B<@X~DK#3e8}U*XQ$ge*^6OduO^KS27~Y8hi3Q!)<JDSvxZ+KjQL)oU`VV
zDc|8KGHp&znm>I~(+BHBQCma4K{9BR$m%$9yNG~#@msTR`{bnC>qYbmhv#3PHR?=@
z@~sQBVbHmB)_ofC(m8)7_z=<0ZD&u&`62x!+vOJP##R0}R4>on7u3o+OrQ+umsyUd
zd31AavG4^H_HpnFd#XFTRm&@0#{oEe?$WwJPXWP~<Ry};->*2LFt5@Xs8GUvuf(pq
zCnqN$YNT|iThIi_*~Cy@6}^4v>)&tnmK^DwlviDXWXk~Dh<vQrheo8eNl4enu)O_F
zS(;2mWT!#<R%1oiiW}ql8Ndk>V9>pX0o(7uYumior`T_eTwym2LirN4*>lP9syR-T
zwBlSTndiA@G*sZu$lbX3dLxZz!DjFqcMBW7EYoMaH^6oHIBl6T4S9}xH6Yk}yXyxR
zpX+qPL=ek@)6Nc9uvE@YG0B$qE6?`{0p#xDebnFnW>vzaOffNMUx0dUh&;D_KFZ??
z?nyqs?GPywiQ4gCSjR+n`9QMm#OoV!q!QPYNn}rdI(E`0>z-nDG~*svUowk{G-$Ce
zDrNKaVHqCq7EG_hmhZzbKPUpyDBzh}Q@DA_qU9hbYj+h{=Z^nOTIiPyM}8Y{7Hk!g
z)AOKe2lJMez55NrP6o6NWO*EPFOnVCMXyDhrf%2~xLx?5a%U!OI6A<(IgAew4HIn#
zFV?(O$-rb<bgwjIP}im_wtwDSSaaPm!ZdLYvlEllR8Fj0#hJLqGd3hAh*&U?r5?DG
zsbR=eaGRzjE3I^$EkGOgHI>lW#|^jUO3U=f*WuQKtp8C083yF^ZC9bkv0;_&!(wE!
zohM(-)jRiLE~hHUJwj*(`SKjwa6LqMVqbJW*PzM#so|qf%-2ghjaTRi2wp7+v`8#^
z<!`bb{s-&X;J+OaveD>lymDybWL;&5J(#cWlT?;v@^;7c*t^=2RrgUAY~De6u=4;I
z8sgk*{vsAgSTgf7hUpya;w^Gwt4~n<kZxIdohw1)%i86`Hj$LrIB&pU?j}O12LH*x
zL~m!T<S#dAS!dZKtCoczKrNp{p<kVkd4cQN*301amGb45bf92BkL%P+`UQUgf;~S{
zHz`G?7$A<{ej)_GV4C9(?x%|pPe-Mude9jqTOQW7<G7kdI=rWT{>C;krjt&CSy;=v
zFsCDvWRr1W%e)JJ)79os;HTW*njTNB+%0r*e|oK0dAZeY!>xV#<Gr4yRaj?v#8Dn+
z*&P|O#(lnuqqu~482Ezrc)I%s<V=s-eBZL@>edyZIfM*kT<uC_)f-0SoYVhyIoM5#
z`U+9?2=UeKLSKKq?s<7*&{q8ZCiVOJ7<tcU2r<a?8A1$JIyv%7;5Prqnt!$X75c_i
z1-cL`u7AX-0uiWfjF;)O){R;ek0e&Awboq}w@^KK?{4h8BtRJjfJZzKxLKd=%TE@J
zbs8i$DFPpD-T#RW=9*$=Yz0%jI8(c%wh?`)>**|DoWGe@e(xz$hQNqyMw`BXk7hxD
zL&^*QljkR>-Jb~53?uwQzfK@4`U<XcK)oXWu#k54MD|yRxI`>oB6bj(qc;ZXH#4S<
zihF9E5rli?`n|wzqz1$!OFNfqQGyD(Cii?JEuhh7HxR1+)yC1{k`9~8@+;A_v#De7
zXS42aX7^Li0vLZanJ%)fzrivXEa$nYk+Q$SQw9BOl4idY)B*kfE_`X(!2`?N!L##F
z`y+OgZ#bpa69ehWRBP!dpWx&KDR|@R!8$NEzFAUS*A)qz;vVqjOOzVNdQlo&kfGsV
z9{}vFaiRkJ@&@Ab@L6-LH)qT9P$7X<2WYEFA&d}-y<}QVBE;s|*q&t=<sMXU7>K>L
zWmqzm^D>;Wd<NlHQjEIp#pE@}g|605a@wG?NsA58f^E-bF(u0o`>Du6_s(rkET#$1
z`jcQ@qR<6b>_FsvAUwN8-p4-Nmsj;r4}jJjGIFJ9*n3wQM0t1&^fm!io%mh<g6fiV
zlxiQJ)`T}UyY)Ia`qR}XppiM17V`HY>6K@KYqj4%$AHZ-Bf^7p{At(?WC}k=+m{sH
zArq2vDfWQ6T0c{;k!vVL0rfK9atzlN+Vvo!t&n#5V;Wi-w?>#ey3|`R3&!vIKqxH*
zt)BTVGE;9(qKdJ>|8!Y%@Tp!p=2LK%B7xQhlFbf{2O!PlS)Bw0a6ELCliale?K912
zgtW;sw&-uhX3=+hL(MsYY*EyTR+Vl(+i=ux9_FzSFy6kyAq2r~ZiUsT)u4+|ZCg$H
zK0H6A#wyQo?SnaS=hQ?{3_$|U7?y51=Z44oJS*2NIRDO@7NIk<_(IA}zctIADQiS}
z|0(Fz&<*iAXE1nixxD&o;bzr9f6VYu?cY^KIAl-P-d~3eF}1}E=I!Dd)b*(`M6ate
zvN!TGS~_wn(k=d7bGIcq)d;VA636BDyLH~kOL?a6TzJ~WXqBfRKR>`$-i3MGGRSY#
zq8SeIOcQU}fQ7~U+JBD_uQzYyc}TRzZfafrbo~svx9x?$rw$Bj1p!LW*C;>#jQJ6&
zo^>17h*1iN^(8>bLX_xwCe~_EgDVup3HWSC3f*9laM+%ltsHYP;+n8PW}2b}zX_Ff
zKNoi<pQYl{7eb5`*9U^EMxHs39S=p71F((dmR)-LP!^3${pGyX-RH&vl#GrQe7ThQ
zaaJ;5QOpsHXTh_-oTNdlOQntnSf`+h*SAPC1QVC$#Mbe`<I%Aky`lfe${o+HMmE}F
zY5%KeIWSQu*NOgvN&hrPoBvno(y?nD8C}d>4Ws>c@|gA;TxsB!uk6mRW5|$_V=L;s
zh|~-bHRN$>N;&AXKFS~m*cLf3kqCeDL|#vHl(U{Q$UqmQFdhQdpnS<|O{h4C3Rq`x
z#y>+~(Lo0&mZuyH^<W%{rD+KJdyWQQ;=EWUKz|4-J^Cw@EVBx_q$1&9*etpr8KTio
zO2vkyOH9$N)M0?_+3oSZCOk-Xo9-2Y-T1^2KJb<So^N@i78n&X2Q>5U-_(`r;VO8c
zm!*suNO-gw0Z}4moD#Gi(V4?!-!iXlS!6P8?Qt+qgAB9p0qPW*zGx?xwxJlgaip_r
zD7<CY$q2x&+~s@(AWTBVd}-=cD~Nbdt*Yte<+Rdr$sm6BuP)G>Wz(L_&L6M)<Uy8d
z@KIF52==YX->j^qAfu(Aa3(i0hYZ^JS_%WtM}(wQYG^<Onxj;~#A+8!ETSgxLGkIE
z^d-$}t|uaxEVgWe0<Fr5LxxqpSdALp4B|jnOiD(?V(;QWB7*TusF`|BRZbaOu7%_Y
zRx$-P2CQm{tux?U5H}c7GMYz!(!H(t-OmENLWH{OyA?EFwFrxi6xQ9^M?ZrN8#a1f
z(pZbu4)YJEu7e#8jk#v}5A&tEqSTkR=mZ_L*dHTNe~}uM>J2@%&YdUeov0tG!!t_B
zEjKZo>b(>{Q^ts-+@1Qr(;0<arR=x_q=Ye@)cz!)V^jgL=?wz(`$b}QDCn(poh|2B
zylP&%n=q9p*t_(dOfzZ!n?#xUvT}}_%lQ|fas^TM4%nN<Nltb@HRZDq-);R2vmKtI
zAi4f#z^AEqEFmu6-#z)8gVWYw8`Xn>?i0k4iu0%i#)c@BgG9pO<)OGujK$$<LUW-?
zxar}Qd+>-!=8=s0`{Z9X0)8(RBC!*ECpGB-+mJT5YJ@YEo<@dq!4KGLmoPy<dB)if
zB8Q-lGYO5q5qSQG^=}H&?5^jCb(w8n&Hq_m7rZySzY!js5FGfaA+c9o#;5Ke+`ICV
z(+diMv#ci(7vcLaMWceHlAf6R91ZNBs)b%S8m@Kfv{I9I398maUb<tvSnc7m(1}@s
z<H<>@>c$M|0VLy=iafTRV9&E#*zY5|rf%1!{p=^~ekA4>5M(<D@6zM>5W@7=duY8e
z|MAJ&QYZB<T)?wbH(Kejy&nMjkBPAg0!9vV;QryMKMxyR$HbU15(gx`I1Uj`|48Ll
z6QCx^Y3K<WBqfM-tBe43{1P#XWjBpad-eeTE&B0M!|1z&5USimi6aB}I~<mX!C&)d
zh_*RE45M&#yk3K=q^OGR1+}fqXg3G{Nb${OAHJIcB+u;$>+VEOX&gY11f6A@ro#_5
zp>@1R*kZFQ1=Q@+(+R9XDXcIst}#Lw6lKbJh}k0Ikh*=|0M7IGSSOrEt4@(wf4_xr
zzlAuzJWj~Lh@q^=%bU6e6W3|(GMYJIs$mOfbpj$PSmp+6W}TaV5-FJ9FngY@>fb*L
zN6r|)Ankj}aG_UZpQiq6iP7(L{u<SsyPq6<ZE7~)f_y;|wyjs=HPr!B-iwr|uOhsV
zKR-Mo{(jj5*r?|7Ag@}FVz*JoWss497OOv8r?v<T%J6G;mwm#QSby+FsbA03w!Z<V
zFwkJ)&{XHBvd@0eG}y7%7}(M_(3NUu3$wuhwJN{K@mc`Uz(gB!fI!ORhfaPfpMd4M
z{U!DVOZ{ZzO=sNI9L%}iIplUn?O1DqyW(vB4>($K4T$Ou$|ey`r=uHiGO|Y8Kh=oC
z;IY3Tb%M5#rzuMb`?hj2^6X2wsY{gnnrmaXQ;&Yn6~~a!L){+qRVPIW7;U<PLpjv|
z3=pY<!<TUT!IC+aVx;3=cE$RzAzB+Y<yjvzuc=+I<t@rF-nRrSnTbb0l}ahtxClV&
zbp_M^Tn?bqn$HL^Yl$3Y9<zp(IaRZJd?m7W`@?t{@h%W2jHyWWFWv9%TgnOx)KfIu
z>c0E&u&<FjfRBxo9o<y=c}d`Khg>nX5I4CJeMBFWyyhDhAolD~15Mk?y4YD!flW&{
zDG5$%%|)+#t0OXMSd#IbMQD&XI|ycd2JEpZph1&^&5Nxtv>GQ~eckd3j{(BnI~fZK
z{0RawIvE)n{0mUs*Tev7$190)^Y!W}3BN6`xj<N}`p+x+pT=yX=Wvr&WRMZ{+v{@E
z$};-e)V`@D$WzU9_s(do5V`GBXVw(Q^Zzr)8(8hdXDXby_F@j_nknbvd$7ruaj#j+
z+_vPPM*pV56-NK2bnJ#sTq{o=%+Ep#)~b&<0k@#z<|IIdvkyrv3T<b3V#Z+}U-s<L
zdtvdB^qK2k`r_~wi2IAKvlS&68*`U*Og*7OGLoGwcIcpcR{0lk@*y-hE7=&<sE5_e
zI1RCTblDors7T?!qa`?am&6hKAOt$0`_JcQ9vJY?Co`E37F-wzx=!2GTv!^Ui_q)y
z7_{tp6#ku}P|TA9p#4o4$cAr`$dK4`{9?0(Wd}#DRHyuA0r~Mw!SqY(sq#8o<!Ek}
zHhQ2TRSwm^6m*N}CCLCSmAx&Dx(}Gs#{-V=F3T<h{cZ#PCxiSgy`R-(uqhu}eg`2C
zNtP3tdCH}$hnDBSGh<+9vo@;3ARNT-KU}a2)me-+UsoNkbCgwEE6QKgGgTG2^pxNI
zTtCx2Ir`A6MC4Xl9*!$r#M?fRN^4;5lVT;6t<b*Bp8~*GhwV$FP!HF`&H!f547S;x
z{<aguUU*K<;nsbFrp|6@K>cv>kmqdiLHwV}LC{=h|08hZ*kd^%$}NvEoo{;mwKYW5
zy{b&J`1B?hGv#aX7mEO2TKy9gD8B!Xq-zSVvu(PuZQHi(#%$8qY8qQl8ry7aJ85j&
zZfx87^M3!ye$Mwbvu541X3a<=0miY^*ew`EQDS{rd6`JD!W`{B*m=Y|2%_u!ba}FX
z2pS6dWIL~+Mznt&nxz(ou(tT3JQ+T_h9L3}iKaoYXCCGICwpCAmJ?LiEf?%)@%xdv
z^d%rxvap-w60<Tia?kRBIu*naRP_xlrQF&tB6(UcX)(pyp_KYQ7Yl@wPKu$QpOz$^
zk2lE}&J(*!Gw2cwQ%nPGJ6805^ezDjv4IxJ3uH)iDi%T7ynohhYShp4(s(0Z^3sFc
zvhn(zLXU`<GIR#@D1<9WKsm)bS1deXHx|(68L&+q1K_TALl+&+pH%Ucn<FRchl;Pl
zcjxgz9)Iimxz`&Z5)OOl#w30;yXtn?6S$*y%gk(wlcBqjB=ty-4@y`Xek=5M6^p*K
zCkahJYP;KB6^B6*a!-t75ZQYQV+#>34C@tE;6aL&IFxZD1s@%xrnh@tU;!fh&{AaK
zK#2fqnNzw9&p*FuLfJ?JKoSCdCHaJSy?;SWQ2=E!6NR=xUD#IsDNhJMHJMBV#2_yt
zlTG?m>b!Zgzf@ROB?s<@y^(9{_PQjE^~s|u-GO~hk4!OjING}y44w}^e-$ZfeXoi<
z)DV|-C|ij4_DG2JRsXRS8;C%uM(u#ZZWFNI0p}C)rx@g#u7Zd7hv%maiMj@4t$!}p
z@7xQ+093RLZO58)`#gP?!+3Vws|<n!>7}sh-yOXw6QV*D^ES>mq{XgDUOeyB{uxM+
zj-JQrwbw=MqP@!l>{Ga(=}%0{?RFy}*%mVSB>`|U-mD}JD~jM);n*N(6MDb<8H4~=
zXf*DIT><o1t;J+4v?{;;LeAn*8y&O1f+8ffU+kVUws}LO2~o%ri_GHy>uGE7OHgzD
z{*=R^Bl%=l-V6QckNmOMI!}fDW$i8DK^h(GI)btzpt0GPpDx(x(9fw!>Vjr~-_igL
zdWAV`LoPvV%<qzRqX3z@koNxop8&QZL06DLF9LY#OVXt9HAwJb;Jy6hUlNz$lp<<`
zIM+Zh5x^?M7K@f6$ZBh17*ABTZV)74&`6RcrdjtUk_ceG)r2sNtBWf0lbi@d3#y2#
z)5$gGpxjCkwLF%jCKBXGU5pD5kl<czvR*}T@|0TWX%TarnIMu~iWJ7eXaMNH^G<a9
z<en+)Jy@c|h7g{R@94IO_*yuW`btDY!*$|g$`y`h)5*7?A^271$yAAFEROtxYQrg}
zkMcm)gpqd1exs5>P)x<_!&Fk&*hsLdkYHz^oMNnjehrAA5Xz8=;jw?oG#cQPLidBk
zezN{7FKf!Q7_H`9ZlM8+9{^Xo5Tc3#64?tviZedvT||C~cr7&1_kWU0DNWd|Go?r-
zZ);cD=qk(!=y^4(JWsY%IiFz?ZDmA1Y3w5n|DqF~Hg72#U;miLsFDALWBz6NO+7|X
zBW0;46})Lh8Kpi7+7Lx~@L`T-%G?@~*i81s98X0{I5@QF4-U+kZUW>j(i94OqkE2=
zhZ2R%j!`)V<WCDPY(xwh)e}g*m(o12Q~y&dpIu2D^~<<6)Q!1o7P3iQw=E@@%GENo
zki1?D_eJHp-*@VsDYPC}ePDJ5+d4%@-T@K28KB~GtqG2PmKU?OMWm&+Eb2K|7dzxk
zWyi>W*F(vCZW8;Xy8|wDlrCTJ0;ZW-pxY)}p~kkhmf$3GLf+D%zH7K}+*gZz(Cz*2
z=W-2+RF|vWZ)6)XwrjC!*Z_;TjU2$oGtYv3rvFI*534zBpiP8%qe%*cguW%|>;9Gc
z7}b{i+XJE#WU2QP9>LzE%<G3FJ%aL|b25Y)JtIG_9*|249vY5;jm>X{aegMG;<{P!
zP5O0pne5UDt&g5Y-L4<O|MA3>Xe3Y^)GzjvgZ_(E6O`lVO?U<aP)TV*0u=)tOL;*8
zB?o0sAwmYF1_e)%LI&jlz;%Vfz^AcL(=K~jbTY(*hEn^lE~K5SU@{SXsCv6;1E+(;
zvUfnSRLb{HXTaqo-*V3VvFUI^7Jf`B1-l7T#fw+9OZIWrK3KXI$3Q*rfOoUEzp`GC
z%ChC|x4^WK8<_h2^0-Nvnfc_$6ZGNcE911j);kKs3J@1H`W2=MJkGiZ^szK32}OJo
zsY2)Jtc<8WD>-?>C1Ha4hn$5(h-&TJawN^GOwA_D;n}kZ2&?=c5Tv7UrkY%H*N%Y6
z9&$!kz_yE8{ak%I$6zy}c*#EUjqejsTzmvb-%0tTsX?y=Z4yHKB1ck!K6=jQ@LtBQ
ztF1{QXG%WS+(2#s!fdKs!G&t*yX?d3NbgEZy|+Ad1XERy#@}?Mu0sH?&^zXiRDOt<
z6^7vKQzaadzzco1E=6<p))~(?-05qa3up=X&f1e0T%8GSSY-XdP7!QtY6keSurwC~
zs7?6Cgbw52OhwH5ln+fK0P~@^w(F67O3mPQAN&+6eW@N->Yb5{mHR?l1>%s%vng|Y
zF-3MAHUeQ&IRy?C)B^CnwKt`<aHLAQxbKb2d=oVK(x@?`A-Y8aSNMN%@`CWZad;QY
zuYvXvInGPWbPN1b?m|_cg)3@RBqoVOBC%i@VoHiy6qN`;{W5@5s(H}EsWDMN7>E|=
za=_bR+F%PAiry#_{xJuq{ql}(Oi=U}8)3GW^g?|Z)I<L{P6Np7MX|DUD7$D1y!r6~
zw1lD)VxbjtJ&uOI8Ivy6Dlv}OC=olf&mfE6C@LV94oO|(keRZwW1>~3P^g0lPudgl
z&;*pWg6Zvz$Qn(}^{W3I+<?c$LmYmqvk1fIEZ_qrnR|AW9lde_4K2)8`d5PZO{BKC
zXT`aEFLRaAoLvTc%@K=%TW$k1%Q=2rqLwW%DD#L4qG}Z&Vny+-$mP>0_61{N8Uys;
z<nE|J99<+^D5l#GV5p14>sH8$sb18|6gT%D$)8f1&_Gi_JyVp>K{)}`@Gegtju!fZ
z^qH7s>?=DoHlM!?B~h;R;a30n>(Ch+@N@XD$wPueI@WE9@S_dydT!gvOJ*By4LiRL
z?I5RE;E8R$v4pUEP%YaNsBNN8@#P4c*!>MlK1NQrAdoTa5c4xY0@deg{#|+uiLy0W
z1!Mmo1a#x$?PbA&er@}}K!nwVxth&WBkjfn^Y(+WKOQjq3DKOf?T$a+q!v2m`d7r~
zKh2c0LCmLcg;C6>4fCW8d;T#QUj7`ptZW@0S@8Toex#tRL%*Uaz3YV;erv(FBLl!X
z;u;5e1$PM*;Z{YNlEhX+@<4aS>=>BYeu+4r5P<^wTYoBj21ulF=6agoGH~*KJ|q_1
zkmIV620Y7VjV2_RfiPK@MQ@9fNlO>gwe5X#-n}%<3iSG5<9pe@T>AX-xMnjk3km$w
z*Zr`+-Q^_t)t9}o`RRDA@=i$4@TP@@tE(e}==<ADDl&RH^cv*X!^VIP`lYUq$&JsF
z-=Cwdn9fQ3UEt5Z{CstRlXCxjx{PC&UHN0q{d9=9`7?|?Jhs3~T&WZ12{<WPWNk=t
z4VGCh7S)r8y_M?%h3ydaOT&8~DhjguEVyWQULNCTd6?o{Y(MhWwqDf#*s!#XySX<N
zPu^LJAcbxZsvNx%q_nzyKWH!Nf6t-qP=U2EE)WTz35D*+7F6WFr+K+Kq=-ztCWOcx
z9f&bANI&GR+Szs5Q`%HJ?ehp^>{Yls1YWy?L|)4O11)Np{s+{5KpQ0^(!L}gD^h3?
zSi%;%uF9&T$fJ}8rc*|?K3$w0=2z!&%=OQIJWY9neoGBQ`Pw5o$1qbA7j1Pyp9ByQ
z(nXFL`kHdUD+xDM=295QqDeL3=>cuoO%!Dnf`0E0?Y(lro{~B<KA2|FR^V*Ddm8_?
zNG~2C&I6a{Xh>Gfl`3uDJy}#c+Jg}Z;8xle+uoL5s)V|fo47Y_U)R>63<EvO*|*=D
zOa!jGow7>AN4sPvUR(V>*mf2cSb<D5qyF~~Zv16-v@=}zhdS_`WFc{(+O$+7<adN3
zD2+fCLEA;$2v_DF7trfra&y&?ZzZI{(pNK&Idp_sM>!0QA7aW_I8WQX(#BK2m^~<M
zZnB`nkSK|y6*g4<&RW8#EsgxboYZ#M_Gn7H7OCiDw2Aiu&(ixRfEchsW)3iWe-8dI
zPGs{i=6V6Y#b815m_2hQO`zD5401k(A@U1L$v=OAj3w2`7mih5c)r~^i8(>rRid6w
z^AtQok#ALENj<#ELe2mb$88(a3l9oMdHD)Vq*kDXuvjweDZ%b~ms{u=!r-FnLcPfX
za}yFu;HB~+ijU3^B;7#5wE+}aQ^uf;bsjt@dEMwyUEldMW4ny`TjH=(54K*+82q8q
zban3!kW!awb3Z0fes1~3^yzB~8$8M5<E5oK;xa}jgj^@<?N*0LO;4D>KGZbB+ybPd
zC4cIXpeR9t42Ix+4qk0*s9*<n8N^g<M6H7peoZlSu18q)(!kjWYk+0pNX%|t)_wa`
zg<)SzN(DM$X|~5kC+2*>*sN7$KwW8ej!X%)*IudvmpSTjR#3r(wBLCS$5FA<tM((X
zG9RP-+MS8b*SB9u*4WTqu<gnxlN;4KKaTn4Y-fkgmnJ4<AIj<%zkxBeqM&D^R>@B*
zUMh_0WJ3qaI(9fSb)dDxg4t42wjM+5lfPJg$kekx$zR^exYjRp+|s!JQsHnx!^3o{
z@2s^XSUp~c^m^XFdFPG*dN<_Q8tPv&=o#lsgzT_k+VySZS!?Do?Rd$+{PuV{Iq$ar
zQR$9E`DWlLU(v4CA**<zXl$GEXoBGJ<g9=5A)1#q9^V|33!vn@dip7mIcSAD!m#;I
zh7J~pkkllB`J03wwIMPLPdDN{<{*qt@)`383G13r%?q^|v8yd^Hd&e5_`{Vw>u0Co
z;5uFR-A|Cu;|XhpP+Ep=Yp+Gd%{X1Hvorz->sJfk>xo8kdb&shvnH~Lt;R!Vr{@0+
zZoAl7KJsq@6<&Riu6NpPpriOgS71M+x>##IR<55drPm6SX2|XApXQ<8sd!xy4DhBX
zYAo@?^c&`OET#hY=IF^-?;R_w%6!=(QM6`vl!_yps@k27dv7e0YeNQ$@y-UQW|rk?
zPJFwGOU1!dveCkfs6EXZB~lO<4a<B$-NH7iF3^4e-e(s~wYj3NY5yok{o%fpJw387
zWlt~9F@;CME$qK8;sx5;7RFk$>K$Ark*7|x>VHs0Z@n)|I^i2fFWKc-xEw)0@SlC2
zV($H2Y=2Kt7a)DWe=ImUl%FX$>CjgS_x;%T52sGPT?az$kcu5m#0l36&{0W<YQ_R!
znsjpH;eiy&Ir8V6cMd|Ykzii~abj9WxUI-Nl!1ahs8F##z@3SR1CYTRioq1j)y5Hy
zs$0_w?D^}dhx4;xTX#B@+W7^t{pltCQFzm1$~=MgApJ4s3h-S*aicWygJva5T6V58
zuwUyYYRD8nFftx`4!i`n2L3ijwiW?i{otVKoU;+&B1tp!d7A#pSc3jox{5M>1enNB
z8+gjP3;S6^+1<pF5kFFXK_2(0CQhmnP_ld{%<@kbw<k@7gdq`xn<9lNe~BP{CI$Tq
zp>D15U|@<GBOLTCO>orj{WH76ZQGWB8}08W+|EQ>9ecdXedXc(nY+znWWoc`VA8_Q
zi#u@$9v2(PD#-$2^~0n7`FxWWghDhduOx!8G)kxq_Xn5*EtbetsTigjVE~d}$f&8v
z{s?}_v+or$A-8skRQ^ohDYT|q9h}?W)e=tY1?_rm{<0#wUzDY7Wc*X~TH_cyP%PB+
zT>Gie{nZDJQvYO!%gNK{%H|~jeZtX%VN8}hEu_>@nkq}W4`H(Cs}9SLKIZvfTxBfF
zeGw4~h-2nh**3Q0rS#-xw`CJjRed!R<wVrX{d7A-<k{9_lcgM=0Ystv^hs`JO{vzH
zJ_RV$+LMr_Rkp;4;?y}=<c(U(hDqO%YdLeOoNIea^vg@UTgZ*VFPrB8(S)SxkgGLg
z-+5KH$Qm<LW|G{1xPf5tD`Jq#@(h--l)7bV87&62VJesIxC3j<btPxDdAOZ?f;jAW
z+&RtflzCJU!y`L+G)2T@RfLe=g#z*Ju2z?r4S6us6Yn2xUv#3GQ>eDbKx?yh)W;#>
z1*OGMo>Oy`5Fs>44)Xf|CM3AgePl<D5TfexI1%bDahLwL$dbu9GR$A!jHskrgkgGw
z`s&3Do+LEEgS)H8H8zMVLYRDCe$MKoK)&Ao@#$x3HgIt;L@WRjuFP*!=T_+5{!M0O
zJl;@0r;Q1hfD3w4-7sf6<HF~W_s-<r_KPq*gwQp#G7>_e3G&bY<Z%`$35H$obCQCJ
zwdFq5&<)YP=glKi4tuA^a<`4*NlSfv#l6*T|3a3xDaRIa^aJEO)qY73&fW=O^|+Oo
zMepH{y)hAuY+k2MW|J6$x!SJOyEE!udb}m9PU2Oh$WZ@bh^w}a<TT1$LS5t)XO1Fu
zJP#iJwgFyX0v<dJ%xNIT{n*u7M`<BJ_M{XyRiP@T;|d-QgB;3O<2wA?G>!7Z-QmY7
zN(&6C_8^D{-;%m}YapoOw)Rq8JRZ2|G*7yPp8z}5a3c=MT7L*P>OT3%<<4B0<KRZ)
zW(($x&7i=-{pD$+Sk{Cui#*&`d7W6<57f;2ZJIP})UqxUfPAM3y5Avjdko$OSy9Gi
z1VkPk6o;+wmqJE%vb36)p^(#SXgQSqyoe3j{A2|ES`aj&gC(udEn_+aIN9>E6oLo%
z_`ZrA$+|;5@pRN4=x!<2*sOovYV%L>pO*X*6!e(COtuLz5MY$5ew(K~!AINO{>CxI
zje>y#KLIIC26T7PPuX1>Byzk3uW|2C3s9P%8Na=f{SIgbuMwIBnKdVJ{Wn!ba(h+D
zLls0SPDdbnaPxC?CKdu53fjPoai`*sn3rzkpC=j;B;5FJ;uJ}Mq?k^fHp-MmcPzK2
zp9Y?mAU2r{QjJxMCXItv37OeYY}LLGCdb-n38P4b6ks!Q&Po(amD0sZj2qBJnjAns
z2-BkNUp*1|`38<7TKltpo7~+7Hh;+3ZqFD2nj7D2o*^Hd<jhRHI{#DZ-dr{4WZGmt
z7mc`Px>iorb4SKNe}BRee$ZZ>M%OW}WnO<w^ckN;TQ<Fcr0#fb*Ycvv8dDE->^E<r
z2Bn=J0l>qMzSGStMp-FSTG83oUlVTjely^bdXMo*3oX<Z?$K3#!e{Gj`;h{Q2!pc{
z=2J?wD3%ZHM7<9>UZ$d|Vfs(aY0TV~R%Dct$Y_tnp@%(CKz;qzo9oWMxhcCZ$5GOg
z$2tB|3rD>hY^b*zKB3y|Vn19^rB%USmj9|06Zpr*kJ<-*q2J}M)gNSQI!5}vIgvz`
z_!>QpNrUgnRTXLO=WW866qCG1qs$m2jgV~Bn`-E*yw5?ezC;BV7DFM#Oy^j4>!IRQ
zh1sV@`H?hQXvVbax5Bo;?OYzibiPMMr#IC{VM}3g3263HVF3Yk>G}a}D0*r|tI+sa
z2_XGAb>Fz+TsZ^u@(dGaVSAfY2C0A+8md!7_xm(_<_dV=J8TgXPT(g`SE0Izqva?V
zb9&}Ncmq#N$tm&-yDtMrfkBBE5Fs`1u=jG}fVO&L1V>+^^<&-%Wqd@nvBdq3c9Rl2
z4x1-I9DKTq6jKMZw%qS9N)Y1SWEi;+3m6^xiTk?`{c!7@{?ag;^;P*6vUz)z&Z(2x
zR>S)aaFi6}N!4b~x5z##Yt@@}`31QST!}k=4W<T~y|ugMTo@Q{eZZb}p!o0*@1(q|
zA0nBrcNmK3&LdV*r@~i7y;u{o_A@)<AgSr0{={6Z?zt^z;?L7uCM>>i-UjN(0qdax
z&D_GxNgN9K813tqBuyC+?|w1f%ejbokaF}Vbfs$XZEOcn<6Hs{6g)|rwLmK4?F`P2
zohU=*Q)RFVbcF9UBa8(l7`@t&Fpgp4$P|BFXWC5A@?|uR(E9}i9D5#_!f9AkbVPO*
zCEq}`JPD;YA*Au8ucY9>7Z@rA0UXXrIxeDorUQzbYZCjR?FDt4NC&?G{pc0<jOgvH
zh$d>79c9Df*iQCe!=fPIbv{&Q;f_wF6E?ZYY~lXZt{FXkFz2TbrR&$Kp9QWWdMoty
zv>rcHHt-91T_~|BbU+kC`De!EhY+1Vh}H3~NzX8$BB8fX)ki%W{GeoZfpD!|YNp>6
zSh7im_}|`42M6I(g$$-{o&G7gfn31<9VnQAha+cY$h0R9iuNPMI>2x&im*A=KK|FT
z&olEX=Sfd_;O{x|Crk5sYyNz;Paqb1Iv3<<(DyhdWCoFunv%&z$MomWq%;n+Fb|L4
zw*DA=k|UHolj#dr`Np=XCqN0WHJ>Kjop0pX$7_PlDn62Eg5^5osF3CU6nDp^{x{aw
za!&%Xhnao1FtNDp24pIxb4rZarE8vzyvaTq6Rw*wi+;Wm={h2GpL|2Su!Q74D@5&U
zVtm@ck3z7{#N0p5%t81IXS}d;;1?JNVSOfbuBX*=GaKK|$4yf>fG7q3)KI4-+L+4a
znDVD}`3b7rhq%rFq~6J9`Yu(ts;1&=(9jrmFRIe0AC%hP1?7G0kAf+LZzeEYiQ`!E
zTA<oU6>LTCTn!-W8=8L~x8N$sO>-Rdl|T1KgE;*JP5V-{hrjEc4Sy)iKY76jg4$hB
z*GeahA$ZS)+z(k80l<|DUpr%t0hRT{QdX6e7x5&lZvJIbB(k0?2lBnt`qOmbCoVBx
z!koDkvBEj&dzs>&YjM}>&WVWh`e=8dYLbQ}_(Kz2&P_7&@d6cs@g98p1p%D}4fdY|
z<!#nXmK*@3=0sjJe3|iX8E@?Yj;6wHSxZpWpCIg%LOo7w;O`RiZnX#3QvHn$EHDxD
zQ*X@C`i(Qd{8x0BdA<1?=Td@~^yKJp$cvAcg<@%D>sM(qsB|mB@p-5>lm#(Ja-)KH
zRj^qQXL%}%rJTh<NCvCX_F~Z@3Qc51@e!&c4Rt3&$qN$2gWgF%b`ZkF95s~z&n95&
zG9a9x*7gYn6l=Z{pWGj?HpA`+efoXK9sE^xx~bXy(2!7nu6}{05T*<hE6_BXABpWV
z$P`S0*m<1PH}wa(wH{nz8;cpEA%;&uVrhau?5k=}l8RHSp(igFVM9C188sT}5IQ54
zU7|ph14AYik}}oPB!o!+b|f2t_+p3A%2h9xS``Klq}CLROThjV;aR0t{)s8hLPX@p
z@&oy!0U7QYf-Y=8TJ*c?XM(O)ns*}#k(*FC#QdvYzd_j48Om8S*Lhe8o8ct^ycL`i
zDo?X0C)+VvvI7sDOr#dXI6AASn7u3tC}!xZcj!)<w$x`S`B^Ii3OPMIBf6{T6^7yd
z@;5Rr01pnG?E9qIG>-fyn<+A=bj<LkxaYluaK2AXx<{nbs>|TjPo+S26g@r=wX#s2
zf|b8pA66gowYmDufv`yl4no~ryYV?y((lcELMg#)+g@~hB!TRD!ZJT7gKAi)V^Kny
zGvG8akYB}IbL{OYF@LKCO7ufAInn!Mqj*(}1Kp})>R`CMr@TAh2hdldQCS3usE?tL
zijxKsQN$A5e8$&&kKeM}L#v;8lT?&*h#?d{Um(rCW+>-QluGKUgEv;>T#D<VKcTz6
z*H-4mcqej?TaZ_oGFCNo_k8C`b19?<C8Wo!Wf=~X?Q3(EP{XD@Wli`lk!pmC&ekbE
z3j9Vp-sVhFlRRy0uU(p|kuCMg=9!0K=1hf;Bcs6jj`Zkzk}N$IVKd{{Z!fha$Qb!X
zkZ18*WONjUU&@uHPfkw3zRw6du|32)E*S=)R+T!(X#3O@zUz5ePXwO?!P~%1U<Olb
zImKyR{c8zGkk1b9GMS?y#Vx4N{(u;-AJEFyiFMO*oLk0-SV|_A+A3#E8&iy_;pzic
zB{r+~O&=`AC7T!NI*B-?50|GdChjnS$OknGoie%`i)nmfS<=N6v4;7w0A|Rn{^=vB
za8={icdYgJ&xkR@-X%Toq*iZNVODtlrkib#&TPyM>D#u7Rrw11ne#MFf;CqQWB|ik
zxL)v>44T{Aw~d5x!F7i!?<DToO#O~vVii%Ym5X`DTjN-NufODX0LBdUJvv0sNO*Dr
zu^ctM-{g|j(`F>+XYw)!fjKt3;8aRyxMnT_bhg1S)ep}PCP~~wvjPvQ3OZrm`-iuA
zeH&_pd$*C(K5g;!`Sc;Gd4-qgG(egA_(-Hy@~KjM-G+})_6<a@doM%x_K&Omxk`uo
z=3RurVRBh;q=vUintG8Tg<*43Q#iNU-$KfYowQx86}nEE3U9)4cO%0JI<D{6VVpx+
z15p~@uN6B3UjS3N<I(R43;r}tG~^=hn$am+`SS;F6sUmZ;vsJL=^#ia769Iy<A`m)
z`Yg>;>%!Y@n|<YG3tc^xn$bGz)8Tsca<%}df*Aa)!ceSXMyNNOZrsZV%>xz9k48Wd
z@yKBd3;o)qO!x>LaxXX-&<}xhOq~_BX*MocU>j5Fjc&03YHIHGnnZLvAd(SYQou%G
z*uD*ZqM<$(WYcX-M$VcL2c(Y5Ozb!I`>PcB-Y?s3>Wbo^c%AK#Ha-AB=y91Hu7&!%
zW%EjsH6MEsQonX0UVd0yHqmqs4=fA_cPoS3mmbOHED8oYdlT(PMU#4t8VT21HuQy#
z!L3#$y`615n=TjG<MH5PW7N<hm;8iOJ5MeyXa0HLe<&h3xb!fg0lW>Qv}KPSNx#TL
zjL_t}9`%{N{oU=Ym4dGmDH%pL6e6GurYA;BV~o^^+mQ6dQ}q^3P+<^!XVEmjLYZg<
z$3E^<ilqY8PS<()?n0de(uWFZlWtj;!O~O`{nxIF!$D1_S^{xmvVExZHD3Mu;wn?|
z&nK>t8q~4xqsmzd(LfRBa&PFVnv0@#KS$_!eQ61J1w0t3t8oQ3Jpuee9qK@yN-eZG
zq&=<G4hA7$XnYg?Lq}HCcKMoCZ$_HOnLZP*|4z<&Q>mYJDqcxxF#ud8NME%X0%ceY
zg6j3s$kCOL>+O^K26!0wBzo)ed_DrU^XnkW+LG?HHfEn1fcBaJ;qcu%HRwa+eaQLA
zDyv#+s$Vu@i6f~Nr7Mu~29_hmeeak2UR@tR=HyY69iP{JyB759#o06|W=MpEFt|j^
z(PTkTfdWkn3KxD-{&%^_0t&}qaZgbAo<mU524aP)fao#ZJL#uud+UP3qZqP{K_fQS
zK$GC9t>4j9z~segQGY?mzPiO&!p=PPAFU&>gA|tmCMCtKyONSqG+~TEg20DejjrXI
z9m?-*F)#7pR2mb^<j2RNY0yIU!_J$dbW>AVLUdPNaY59{K9zTSH_Yr~rc#r`#|fS0
z3YslXnc}y$nXZRLwz_YT@e7LoBz~pM*er%+`;{;`0*L5F<2Gr3blqX#%1go@DgR(k
zdRd24FhSA<2EbuM%&B3bo}izGKe5eV@y3`Crg^fJ^LdB43d(i|i0>(}5rLdugFJ;j
zKo5R=u08-hYHysx`vBvo-|9-~HL}bm>n^e38+fwdAn_%o>qY7tU+aC1z2)z_;8B8|
zYNT&|!1jn{AO&1xsvMe0QHzyZ&^L30250aKINFcS$TqP>p6_m&TCucU@oi!%Rn>G{
z7jRY{IBt-;RW(r;aQ|_Lbxb&1&E#vHlBs)^66Wou8vCyt7mL~yo3<Ih)v?6s3Tk{}
z{AVJ}hwjj$5gFxn(KwyT%IT8y>e+#XS5FLpC4fC?cVN+E{4gaW;KLE{IYWo`#tp^K
z?4hzR!uaBymTNt^@Z`V63mjB4#buti`{VNR>(|I;Z7~u%<&=+BdPNX(w|8%ow2Pwq
zqP<X|zz+Zsz&uxOhSA5<80n(93561bfD{coOvF&?Dum~ZufiZGT2p-tb7c(f029zv
z@u|SN4)KE|<Kv`}F8LnT_$2Oad`5fMEf6rN(qVRbtSZr)pdOC_Bi5Z=NrTXK6>@Zj
z$eXcGRcaSZ<nX%6J&P(y07lWN&-O>X{{r2EeXsi4Niy-b94UkiP;nk&>DpnsMq=DD
zYNRLW<gCO6Sf3F4>~m`H#mPLyAM(Iuzn8f;fmXeHna)tY{v@&o@`}cT$!{#qh_F4-
z{!Rkrq3DZ`7S{rf-Ny$dY!~O~E#b5-aRFBcN3L6xvUrEqs#2BGQ8lyrQ7b})B!!n)
z;E2;Fsm5PP4@BCS+FDb;SvI>kecCs>{X4<GDJ2XN7uC6;yRe<%w<SU)bwR+xQIjwv
zWGCk6GjF#c4A-X0&{UCD$jRv>qg9Bt<1*he`b{28tF_ph&($*?Co{9S-mJj3y&)0a
zF23Ki>LzSmGQ0CBTGo_RXPmvrc|$iNYwAZm^QrHFrE9@*j<~_Xs9mCGr)oeXJ15`G
zDLQT8J#^8B_{q1@Py3JnP+fr1|Dc<gpBvvcxLHYv)h3<xy6S;yOCac%v4PJ^qU!6@
zTH@r;=7nD`H9o_BuGks;S}+U#Nsvh4{I@JK2gS@Mf9B2vm4}E+%OFv60d0i4-WRaA
z#E>rAv`iV>MarwSc{5?Xc{Rd6x|w&PmO4*&q3jP&2}`sCLHrz-vrmB3Ag8X+OMhX}
zQOaOz0#oVT&sHsKo*Lc_vUSfXBIo;ZF;eG~$}>l*z)9D@>9oUdDV~?<I(#egQ;dAI
zbMDNYo&sk=7!FJP)||*c8xOSgKw`8f&ermL>6er5`ZBO{&Dz$R;yJH02n+M5`@jSv
zm{<Ppu~2zWlWhl3HDLleIFd9@^`>C3K9yM>39c$NFt*+7)wN|7`d_*CIIc5o`y!j=
zA^B_Ri@>L)B!^s&vuAm%9i?gh*Og+gj!gq_r`iW~iCYKJvOM6IT9YZ~-47rq4g{v!
zi>}9YA}lsA_j3wnzAGvWb*XqOz1VB{zD=&*{b4^S{m&T(r0Y99pc{SF*z)u&m`5^k
zcuHFjvhgt--N){PNli7#_H!HFY!uBV$a@$hvFs~x3cA9pX|)z}V>~G8^It4@GMlYO
zG(rtleRAQFC?10(i()-Ndl|tSlB1}C=DeOoIFf3wE@)HZcR15d*a$2@e{}t)Pig&O
zg0Drjx)dc~vsTFFU+w!cR=lQI{QkV#$Bg~BlsQT0R3Zs`>71i`-=fZ>0siC;yzlNV
zFlS#@_dnWul&;bfih$&g|HD@Eu^)P+Y=qiCKZ9_Vu}zZ$hjN82xqzoec54Dicjt-S
zxP{BRn9nTEwEMCC7ERM9p>pWQ$6W)>tsg;90olMx-+JW{Q!S1u;WIq$CfcM!cEiBG
z5TY(S{-_ZbLq|fJQ6VxB6zV0%FuiKV-DaaR%;R+PGt5E#+6qAixaq@vf(h<xgd)g?
zGFVP^e5zuoH+EjmIu~n4Z7h$*B;I@phMuQ$F5lf<4W&Vr+b(UjWeP99rVGT>-aqAk
zdg}xRYg=h;M7geIi)!+`Wi)K$jlKX@EtNIsS3YgU)lOXltqrbBQ>0l1?^5uBZZF&4
z|L|2M%8bGC@7LHp8z?UDW&HguzmYPJkMjAl-vM1`Igwi3O61#tRkwHsJx~C$@jD0s
zn#}L-aHmn<KNZxMw20tb^lk*Pzo}w0fxLkXtYKR<rFAi&Wj?_nr28~DUM!^<taWK}
z-9iT@DfQbh?J{6gJJ0CcBAs<*B5*D<1Q$J4qC46jTF%X>3-S}deRDEzW^m*+z0P!*
z25N?wIa8P!sTs6FSac`^6uMp-ItE$hu3%|PJvI5SpT9JuOAfa>8$@Lj@;BUVnVeWq
zT^`EFReqhIq?Z^J5QfZ?vssEr`9IasmFC&^AC}cAQY_9%m(RBJj+Mx*zlVVj-Ea5I
z+t)&3_FYlgF}aWeHKTsdpkVBV$W(Des(Qq8Zb$3c6>M1iCbesc0~h8;M)X?cg;g$|
zrVK8}>1GTrI>x1A)3+nl2(|{eO-h}^-B`Zh%^i(&wo`aRC(S-R*qNHW=aL3o8Us*G
z#rsC~Z9V5}p=<EWOk=wbn41?VqL-B|vF(izo(9c}jTKb@R0s4#zQ@t~aL(g>LCfH0
zw@-@hOTRBptp3#`?CVUVRcZO!lH78PxiCHz<dp`hD<|w;7;211Zh%j}z|Qx*4lz)Z
z=z_nX5jZ?IEQjO=YXsMR&upvg-*J^0x$a1!H%MDyAzIJHYOGYiU0nV~2Y`UjBIE3U
z{-*aKBjYs$q|LVWv9O#bZjaerU<x{<{(J)g(~*nt3*~qht6=ebDl@_yi?5Wh$K{Uc
z_q@V`)>P&aV1Aa6aA%s>-P+-i3){6&rAvWQnygW0au8rB1T!{IIEA&&#5HH8?#%vf
zeIi$xa1c21;%K#jmL4pgpx}g_+wIB<rdj8w2Xi|Ic&eFW#dMh&8}Acvvar@JDpif)
zN4H=J<74xf#_QJm^wbm)pHiVME}eV`Kd(YF3*gsC6I5Eq41fLI5226-@CGA9Dt8OI
z8a8LBU$O5MSSxLlFPQfg``*!`V3sDh>3uW0r`<DXTp|CpC*Z7YkVJ3YvnIBemkAb4
zoB+f3VJVt_uK?+kD30=B<{DA7g}jp9d8htb-}TvH_g4a>xpnQMAZ(I^7!u`pBJx(m
zgyKIX+8@_4W!@4l#xR_ca~2}aQ0gKYSeY@LiB-u)@|?rV{kDx&E(RM#;ZS`gQl)D>
z_JyT~2@>`;>N|=?4{^0Dj@>4`AU^FG2ExWlgJ3eaLbP<B^L0+s{9^k^c3aU$hC1P=
z19(F~&G{}q9p9Tmn31`&`Mi3|*z5o8Q>Vc(Twi|nzlcep6McZH{mx_4eeYQ!W+Hu{
zUSvMG>?#@hoKcqZO1{{0E7AA5<ciH(Q9hs+fBqlQGdd&2kEzk%FU38TKFJ2I*SLMZ
zHiF1c?$N{9OmcUR#AxpCeMuUb3CvG$x3U@SM?VY7mhEpE1Q4jXGraM6J+=qTtQ0$|
zxUbE$UaoadeA*%8{uj%2!G+Kh2_6jZ{WW)uHFr9GYH-JIL3~L4B0%>WtWcLzmM@!0
z_(|F0{mos%%2dQR(02ALU=sYG(4LQanswWl*eo+viTkPqnFa97izX-g)14m;wJQco
zH4Ex2k?&9hrzGT85F!k}g`)e<mDG9zDfMbyZtG5cQ=@CCXINNuDGO`60!#8LUDEiV
zfGGpP4!vZcLdGxMa+^M~9h-auG1I;H)hx7Wgr1c}#adn;HUZiT7!=;U6@H(RC|`j+
z5qu^C)j2{`zD&?4b^9uy#T)RQmhEWwOfPj`vd%m|BeHl0;{AryiQZTF{Nu^|NY#O`
zE0iXeuas=~@4xEFxxjLf<G~l>kc~Ikfi>teB$7+(%Jc)9UzGpq7`-LtdNt@q%jdB9
z)p^inq4DZ;U>zu~C&u`X#5!<OFE>F+fZD|}N(+Iugx7Ei>=D&&A+N8kHO6IV$SBgU
zf9k+{iR<kJi|^F4>|@w&=Z08q?vqU_poL2{5+T@w*f!3iISc+7T)8+9Xn@*s5;}h&
zGP&)4(~UOXaI3w?@GOxg>>Xn>jE4CwP8H1AkJO+E15^#2BFbW=QD}Ek&8nmSbdfqt
zMo=WSsM@A8QW(OlKNvh`#kG6S3vEVfjO9n>u!qUJ@U>7f^l<oN7}(POXE{@FxEvu9
zG`#A9BCzsOT$pVZ>8J?=@8k@0L({;C!(Ym5rr<)Ne`Pg<?#KcQrBrlQB%b0dnQ{vS
z+_f1^9N3!k&F=q0ZHnU<qm7}yNQG4&7B!zo!ncz3?DTI8*C(KyKXX>Ho5$nASvJlQ
zmUa~)FGE5c6Y`P(D-u5O)#!{ZVjn|&-?XVa;5}@d*5?=ER!(q@7YS}-xF-aeMi`F<
z_#n8(4Kovd*e&6*rx+QDFvE|LoLt96NY2Qwz0dahQxJ@cv<f%ZLFZ4sOt@PXquvgM
zqx^9$rK?5c&>>ZvAmWogN2}3uHZuHZd*q=?kfGne4+xyIqCtZ`5EB@3sxT>nMsLVd
z1NUrx|M9h$Puet)7GfQj1e|4<dDI7Ho_SyLk&&B@(i<4*&1`11(WCmK;1*uvAcnEb
zW`GIIn6;D?z}V-YOiSB=IPXuRV!y$+U%}7dPR;t_U%h>UlAracJGqzj(~SdX!9+*l
zSzm_(#y_g5rtFkESW)2ZTF2eA)52-M=k%ct(cu3`Gpy!g#S`_j(P&|`%fU)C4N>~1
z*Nnm%iMS`S$rc($eI_oI3$Jo8zC1~7CIF=H!xMUUv{pKr<UhV8Dq?5mKj9!Ddv`~o
z>-jye9(NNg@i|>xs7<H$u_B$pTBljEb&JBZb#+8o$P+FLo7ysNHK5*yy<>%#><A8>
zJ@I;#7P1!qn@9VbU^G~jFA}jrzTOs)0#7uaJg_I4d81>tSwfgOVTqvllyUI(Jso(~
zIUUbHko{z*4*0uoI$gAzCz&1uDHfw(!>-TCv+Ahlb#F`gQfI%ZuQ8>LzgB9E{r6ma
zcx;C(!nLECq7oM~oq^wOr-|iT;O`*YZo6$~jjo^yhl-1)8WL7t%C4Zid3_C=H!P~;
zbkd^9#3XHRcyAwV{~tf^h>!(io<)Jbi$A~i@NYAxU9uYFeeepZB>}>b)NKQ7yFdD%
z^cnXY#MwuA=Y3?;a!m0<j=9*Rgqc&)K8ll{&H(mya56bBofe2Qv&1x`j_`Gu`OAb(
zh?A2e(j*Vsx8@FC`2XIx?^xftRT*~s?D>|~wwz&!ga4~TFV@~T{s$`p0C6z;ZeI-+
zad6j8F%x_hP0Dk9(i9lwTc#Id#zbm%>xNH<KD<ReF?s@+JGMUjJY+43&TUV^fnXfD
z;2(i&lM9p)t0dFqFos0?W+kl#5(A|h@A-9{k}>czZPQsdQY)zy1&^~oTk#+^5oR2C
zECK~L^<&$s(`rB*2uSA}0RDQS!xGcuCG@5-3@I8#ug@H-%Tnk3tMb|1{Gd~G{(Z{V
zYPi+=3~n<}wM9Z-Amo{CrA@w*oPI^g>|RBT9+p&oAv<jqTKzw!UAvputwj~w{T3FU
zkgi-|TR@kgk?l*4eO!sc$Utz2oh_6!N;zyf)w|WMKX%++L@fz;891<}uX`2#45II=
zFAwKvwAT~;9pB&B;+~vz5{163L%dixNpWzkwYK0Qz<ZIVc`wS#d(5i_+>8C#+~=yX
z)RhQqpyd=SyPQ<H?Ff<1NO~D52wl~uzgmhXD~sLd%=*jjtAx;f$}zd9Qy*2)=s9U8
zZ9&Cha+1y3Z5siAa+&y!_r>lHY|aUJU4ayh4@|ZpOz=FDAy&uYvpi%}TAz)4QH{YY
zNP`B0k!3Xu*OKt4T53jQlQY)AtX~`t82Y-&Tn`w%qGQWWlLy-RlgTxQ47#V<$;u{E
zu-c8h4;kMlmYo)jr>u}`CZtlv@uf>6H=0N-WN+t_XoG-PYeZh-yOkI}T2ODFU;^TK
zoviB}5J5c(3+Pr;q5>MQF}V~N^k@O7k|8B;#}yeI=Tv+`oc&>P-<W4{Tp3p0ry+0O
zWe3h(mHCnq3a+J4ZKx+)ZAx2$Skye;BBiX+msR;x?i^84T-=kVWGJEEb4kmdFMfQs
z9P4|qEqws#oA>aWFXuL&#x{%rBSsf17D}vHi(iH9ngfhGm8igIKQ+aHI-fdmo4ZWq
zyFnMTpi}fYsms2DnnzAT#H0hn0h;=|h0Hf)fAR3m6e)2!<f2hBEN26Kb-MgZx%{dU
z`m&*3(BQs8%#Lv4Z_3YRGW+en*)1mqP54XCH;(}F+v-}*k`lDf%b1uDF)`E6t+h|a
zq+FzQo{~|O#*ng4iNz4bL!}Vl^;p*D#F+l$u0SZN6$>fPF57cw4tdA>Bpd0I;^U;~
z<7JMNTICtlWq~?fSkh4jIWfjVB-qa;j1NJ_gREbTJp(8y9c$+FGbGaut?~S?Tby&!
z2TbjxYPGAn@ZFdaT{^Gk?RfQqA0#Li`)sa=Yk1J4Rx~P>njP_TJ1g(DeO8r^`pil%
z|5dTLEbj7dJ$GKs78ZJQbO6?m|FMQ>Ctg)>O-~^wOq}JOu%Cda2e~q(t>ybXv591M
zyq*#hSNlGD1C&r9d|ob3(_ZUL!$#G!z+0pgvpBI<Nb92=X$YsYDXJAsCcv3=WM;j6
z+CVqdVHokV<JxZX;Vu>6e{wBtaE)0e%ztk|&Hz6*wHu%whj!&L;+P1ZF2~1fG@%}J
zv}Py{AmkT*ZPZdU*ybtY<$J*!IwZ@Ehm7_gNU>R~6>@TRzGja#XeZ#W=H;{o6r-%2
zR0Wf5&miX+S`IiH<=2pyHn`t+mK;2k5pk<SqC5oURV=nD?Jn<Q&l?*3mc$QuzCU<s
zCCYY1FNqtC`IRlZ3(8mU9)y<j?zH;oBY$=7_r;y2*y9<tuUYEX90(ISimO$>@?pyD
z@R|iik0<Y1lg0hp^}HN($V(HDfQ0O_ds%}8guqYj62VWe`#Cz`UFP9C-aM(1dDh&O
z3CA^K8YB(%c~7WepTIS#03j8}qu1=UYbX6?s7-<SvgZY=a_d!L$GF^2IOnm%pS~`{
zw1fF56DB_7op5`gkGT)Rn6<+e^zIK>1keRj1tWS(Pd|p(O<vzPZT5lACnO0~4ALLf
zfuCS6j-O#;EB@P8NsP#rtk^~?w9{w(IJX0C^Qcv%Nc}TEvhPOVUpnWHoq=;_sZ7QF
zCObMVc)F8n#lx$w-g2h6hF&o_-I=po9{N(1QYGjOEOMsEeZZI-A<x1gdW0uN9u@d$
zH2F+#dM~ew-VQly#Ry>EAe;bVyT`b#d!{)#rJ=k!LToB<By-~6ZM7YUx}HdrAxU6I
z0BM3OP)Wd3cnU>=u)TqL-`F3w%pEX-A!bafu{HJ{MQ{sGBvuvk0*z5gC*e!ES0p42
zhE6{Q3?u=}cCqdB+GbHZNnw4?ApwR*Z%V^qK$c#U>(Ib)JMdbP7~35FK&j;Ly<Fz0
z);*2{UBx5S>70qK#qV+gIW=Jyi>wL(U_^c|lz`M=7rqeD)V-o%c8@gKG=HEsd*~w<
zkV<gtM5=WqwT*g$QHT7<$A?<j6zCSOuEPB&^1p;rpT?4Xov{#K2x6o2F`&y|?Wu0u
zL>fIBTc0|w0haQa2be1(<ci5bgcpf4i0jB9zP|U1J5$;t>1{)+`PN_8Bvt~_+YXbz
zAB??ImyEdOAZ^b0whYWa|Lzc2B-&O>>G=2T9Qy8{x{Y9#cFVRo%msgs%@rv*1?@x3
z3STa0LX8o`xl{$}Ai(2s`B;-wx|r%@u2RboN=dH`(6dymg&>3XhRwTZ$@S07iRduy
zz>y}#JL00R_>k^bbjDwy`F9^3FG!4MDIdHl#1?Wnk#RScw6UdnEW6MUqu_rZ2|+~!
z+X*mPeQavSZU}SPh3fx3-Vdq^M<|DtD1wC@5u)EtH<7vEd0U`im$?`do!;nKxyV<!
zz;_`C9HSaY&{bEc&fxhIO0A;c;v8E03&fo3YSqJ@Iugp*#NRg7`Z{~t99@(-YkEoJ
zD0Qz}MtGTAreH0%B#&BNEWW9H@=2lJ2XN=~9XI8?cyqObvNFJ=V3!FHGoGH*!2HmE
zL6q0{+3cuI6ikm_)$UN${?^L&Ey;qBKBDUouuwC*=YYRLU&*G-x=}gL(Jf0HE$k7N
z+X+~u5WA9W>Z(3T^=N5UCl0MJ{oye}lz0+yFAgK=96Qq3)#_jsgREkVE1Pw4dLe!@
zNFcMp66-A(Mt8kzwA^`<_6Vsuq>m>2gr<BbXmayy{VRd#iit#^61e{oCj{6=IFHBz
zOEc^P!(_f7SEd~ex_k=aHGfBTVe0cSKDLER>aks<4}R18u1sfnNqz_Ep46wjBZSuh
zCyReR4|CIbMm^X$YqnhTU-#|)>`k#>W**e|tyD=Z<EP+lco?gL#!rSyDJA$O5sP`_
zhX`x>10#1R4$|ty8~0?^oLrLzI+()`pflLKkB}sYqeP2>GPGBwK~i2t(Gd#J%A7y{
zEh^EV6OOj^b;kAODa<JS>EzDx`>YzpBubrrMcj^hhA)VE!`I&TJdLbS(eLwCzzsb*
zkCjPmDXUY!s=L?l{4$Q|D0<&$EN$^klfOLVBXgNHc-rg@OYDe95o4gd<WiCuK&rN_
zcVk;yL{K{*U-UPi!s^(ePz(Ji-$-GCx1!WaYff8hE?ZnjHIx5r_35QhnlMS-^exL_
zuHZ%TdK<y^&%>yVt*~u)BLOU@wAhr!U7z6_Ub~ePMC8ccL-W*wk`3eWK;$0GrZ^7K
zP?2Cd43^4qZa93c$Id@^5A3Wr06wCerR?jr5WLHS@`Z~-bkLVt7V0ikk4)IceOcDb
z8OeI#OmZJih}5y0TwnyRhhW7Bb10`<8mxUq*W-c2Pe_|QNv7$-mkb`Qml=IORB}Ck
zPn>3g{)q$)?(B<{qUU?$+zAqQ;(XB^G&buA4~N2n{B=@XMBa+?H>KAYFtcfq{ZJY~
zIA8QmiZz6bUR*DP2xX*Mv9)uU{h_^owQ0R%w0?qe>-VG)`Y}jvD)T1f@`{ODslar<
z5E5}Rur6MY<jQ<H<8MHsx)a(OvkbrWnSMXCna}%i)I%UlfSlPE{kjxukBfoyFgdDo
z0sivgb|%FB81}MgC~{;Ekkeeo^D62$L~&osr*9`)<ZN?!6>(a0T5)U=;c;<8A>Q`a
zuyKr+zE$QJ_2`w9EsFGgwL&;JrtRT#jb>cTepqU~=~*<D7)Aec{e#CO$Rv(fY`XGC
z98o72uPO*nAC=Ga%KD5IJ33ghmT!}tEn~ierrTdMcy73+@qJhsDB}rtA)riq(FesY
zGnw-2om#OqKio1us71Yg_Ty3eu(~R-V9E%9yqaHW!*N{2s((~1b1ti46iltXjYAtc
z(Dq+22*LJ!ou;}=zTOn_&aoA_xHhW+rdM7!<6Y_8T8rIw)|pT2JRX$Ud}RkN6oOT=
zPL7k&YlTBLwA|}}T0@aH)P0EpZ2RqLi*(-Qu7MBqH>O!^gj(`C*t@G(K9lWtb6!$E
z*6m;{+FW^+tx<|4(B}DjtsrO!xoo~ADHNU!^Kogc2m2I0GTwH96u7Z6_TaXI=`4|m
ztAMFqA%gi3Zd-|eLiUOWkj^rnlyf);wQ?QPaexSV7&8&@H`}Q9cg&3xh_(Rb7_2OP
z#Jep?kC=yf!H<CEzi(G&KM(#k-#>(wH?sC8Q3ofXYAWvA1vSH6{84X&awyz4LP-(T
z)d_75ucDWG9l%^ozr@-YjayONtt=ceyIM?Sh&kA*BoAm>^luW1BXz14J3Y?2qt(1b
zBNkusyo~$_sDds8wQiJB$MFVvG`vUBFFF;_^M!M~--|5SXt_XZl_P4&{m#+VqLf+w
z1Rp9daW1ZZ1pO%Xae8-qy8P_D*Fg-APmd)N&4THNVxfuhZe_6lMgkir`~YSiR-m_t
zgIEgB9T1i#n++>0L0mcoZd&d=)gL@<TqB#PGE2t;G&;b|bks};Tyf*GWs^*j{KehN
z4XSQ6^~<Ksh;sfV(Hvw(B6);DQ!tH>N?5D%bDn$L|6*(K1_UfQNqF1uX}QI0%6Nu>
zp0maNmtn4u69V39N3*UpdsCvcT}*H^S8(vnR{-OUeg*Kfa?eC?*<w!aR{-O&Sz5x+
zD9-?25zNuho$T85q#V8F`Uja&kf|@E$kan11ep+DsDbK{+CAz0OY2ao*nD~KCH3vz
zWXJxaF5r?|Wp~1A+B|*z;6z%wNf#2J>~KfGXHTHuo*0RWg~x0N5}g)#=N#8XS&Ai+
zpznX5S743#PJ=V7HQ+ki`f}K8#mZ<hbO=PBqPWMQ4@ipg{+elFph>WzIOG5iAvyW5
z=$c1rDSp%2Bl9C5XkGMME_57X)a!Cb%Kz;c6K6$@av?5JCNg6Cd1JSP2|}Lqy?lm8
z5M{|~p|_L^23iTCH&(QW#nJ2!cz+nO4;J=1>!j7v|FLz=f0=l}x;AgF&9-Z+&9<%0
z#%8<Tu-Ue4+qSLEwq5t_dw;v1`zOpfGiT;`=9xJ}l-=H0;9EGPX@u?!Olvfbe*mp}
z;hQQS5c!G{LSgAh7)Nrg+s9JOoEBm0WRl5tb0x&(YzlTCKC`8qRB-*kzwIcc)QEKn
zOvTCC4reCN1vqfgSEEe_K=sH2VOxG(5YCdrwlIr=n#D&Pl#RU&_Lpf>wRyY!DNTTN
z`!mFY^hfjq?vGk=7_=}F#2J*V(FZ_2enNaKcNR66!yZrjTSKUXA%&8tYy}R^J1Bc)
ze<L^UxBfQ_(1ghE{7jMEM4O@ig5A<-iR`bt%_qMfNmR4Q&$aIsw#Lk`Iz1K@HRC=8
zWN4J@%^z<Ic4DFXjcK<NO2hpEuDK@F5eR$=;kHLP3yVqE#<ZzW<)SPLt5O6QD+kz>
z)LXXBZ^+?&(&cgDB5j%nW<)b(kCek&px5-YMeEsdr67)_$xHs;zo+`{Q7}S^yK`VA
z;M&n&)$NLOflJPt`E26$_K^JKYM9I}2S;PLlRmon9Tmg#QGNkiIz2I{rymm4hKQWL
zwUYKy;3?InxlJU|!Kh=-$n6+lhgAy<{5TGy=l<yZdsqBk#k;0yyUYC(gXx?6gA$7H
zO4}LLmyJU)-WBiq^5_snn_yrguM;qr)p=Sl0C|bso)+dZri-|_AtD*<527h&L;;ht
z?bkL0A!pKwk>1XO!M%csF%C?_T0enlc*hTdEwWUj4`S}-r`EJ>4}fmZ515Aw=341r
z+-o(98N@ufB3=^llLWk!YPmD~Uu5A=G+|HLun?%g8JdUaO@-KRA2WHxDH>$8i)qr_
zQLx5cTHliy6s_aU9?MKu_<JW#BYEpU-Wr?#BjSYR{F$?^JiHSl#Lgm#;7{*i`*rfh
z1NPvVKrPb16Ep#rlN3DPf~-^mRW11*i{(U@?e;K63YHi^?Y8}&dIGYv<h`BF=7}1|
z5s4W6+TDe<HQT91`BH%NP8o2Ze2m;V9-$F_GbkEaHS!sq&vy%VGyumaD!`WWH-Ym`
zOCqD=1REU<v~EXo(&{z;y(rv9AcFchOi-nC>35odC|f`mkh1zd8Q6-cSjvRK!@VA2
zjbcZIvirJIZ~?|CR=>11C6}G%bZDTSpwJO+4&^R16ZQ;-@7@A$R0?v^tVb}ZK<;+9
z29BW12W{F+GuxMgI&64(^jmp$rR+`k)gKEY{$-s>Q=GGFo`QAMs>n(o!+Fp7D4K>_
zv}nctIRyajd8Ggh*r4u3s}DN<3?A_fresE*>Rne}|Md>sYY=?H@};qh9z^zFn*)O;
zUY^?rgf{kJ>z$W?@)8(iA7-U4$}FDaum%p71$nFG6&^E9wSFSdm{gs73F{GeE4z*P
z(RjByOjz{k*pP+s#M19&>K~4RuNgd9!SaxX#DG16ysQ)r0xVem0>KL)h&L2|rN4!7
zPRB2lJwoM`;`N6b&-%U*ZcdsyKRQ0dO(^u-LTx`snWJL0vt?JhVvg3ZAPE;cs$JZ+
zt3Fp<E*EJp88!Ayt(G|*WY7I!|3aRqBxT6qAVOcn-Fp95B&LhSk@YSgs!1&5S9ibn
zA>c(>c~iS~8h-k@+!qk1gWf42w{3GE-DE>f(Z@Ej@o6F$)Fr`(-8te-N`@192hu52
zLB}@m#_x`_CuDt~-`%v_OR_iA#==hIquu|;>#Rb$Ts!QEuWm6N%!zO##Qt^-$H<Dp
z(+E@KrM82r`46Q(0RjXfoMX01QWp2e1i<WhOjMeaJghZ#d2-cJ*7RHUTvO9=y7hQr
z95CHl0oSi|CCC&Jk^w_GO;!Vcu+Y$wQ`2mY3K+{4b18kf&SQRYB;^^6TeLj%hCL~<
z`zyGxlPNV@<pX{WIApy~y(5SJtX_knIUgWC`+48_H=UA~B_NbBPTY&|1qPD=4vp`F
z>A$CDFzAsY6`jP5fqh8ISIuST?*}5-@Fj<Q4l(4~@|Q=gjx|J=y-3O>E9=NibkF6N
zyEzeH?e{%Km!8nG-`9;{YQa`K*&l|A590uV{qX6G-#NBt-V-_Yh{P+}Pp1+1v!>A$
z3>I=(36E-Pay(bbn@=a>((6(HI6ZYu6da~FBphxAzf<=1ls{BSi?+}OR4l}S<_7Lz
z#?}Rp79F+L(vGNGlC)~-QHVKn!8-$A2v9Di+VZ7?=nVIX?2Lx&jQ<GSi;w{=H2&CF
z7rbpJ$$KEf7oj9a0_Jp5B6j4gh*z>Be$*UBb%>d6k75OIDpZ079H$?e1k>-#ggx}!
z+WpdV6<1JsA$EQ!&xt5S-vMuL=JZ&8l!pk5ny*V<%X`nK-CJ`jG|Knt!yC*LL{#Yq
z@vjk^WZ?A@Oz=T~f%U(2haYXZ(ctaoefsP4;2F#SQ{qJk(^QU?z9>I1ur)*;=8wYe
zl?79@P%oEk<qMbrc#~%O-}Gj-t!$Ge$<Ab~gRC?RJxzMKM9MbdCi1{hitRv_zAXv2
zQokNk5zU&TS~AAyNDPppna+A_%~~?zB&UkEg7=uy(cFnpld|*_uf_3M4L3=U0kG5Z
zPTHXQ`jyx`9<{1Eco4?i%R7(}$CCO-g=w2!nhXpA9)Fht41@-Nh)8){zJ@N}U|=cH
zxMi7G^LZoJprv;04}D|rFdSA|qKOwiRv8XcBRZ4wRIBz00%l#6=Zo~43;e(dGpl85
zZAnm!ufhF1-KH#Mq8VH4$vgHBILr~!Z&C!=uL#?`Yka=#1PZ=i3Mg?K#ZsqJu?><j
zPHXjMwK_m#jn`s>T;!y9liNJEmGfyw+zVBWhs-Oui)Nyis?9RX>wIYzYh=hq+=xT!
zz0TN)ljfqt#$bhNhXNOedHS!Ddkxg3sHl?&)iUFSG*vK7_}9B5@T}-vosK_FQF4>5
z6@wDTdM?Y6<3IZYOk)pG>6w@B`ZrhK7rFB-?M}(r(g#;@CD)wP$gf?KYX-_}eE!X|
ziP_kb)o^x<lzmJb$;?dnlqRJpfsz3J{9!%VP7Ul~vFKs3N^+lAwoxpw?odwABpNzs
zJ79~z(qz?so!=e4N^>`SeU6ZKiGP9-YYBCV0Kn(xt*UQTV>^9<U6)@-biG^Jxgk{0
zespdL-BX;LZSWUU4LzgCiv?hfm1(;G6yY5?OC-6XQ=4!Bcuf@mzLml!x+cH|*EIrG
zR75i?2922Mlp)E^EvTLHqr#9#@bj3;wRnSr7pxld4w&0DeKt)4HPv5;e<rhRBZk$z
z3TNzwzw{#eMEfIAf>HIf*!hLHMYX?)Jqkk?;x`gnve0f(3oAi<5THwCaS)2!%;w1w
z>R$I~N>AnzIr{`!4JmZqG%Nzdc1P>|f0i?PfNd;;z*$%#1nx^3IAJELy{Gk5=W@}g
z)cAhsUocJdmRWnNdo9Lle_GDKzeQfxa6g~35@>oG1xCq8)p0~cvA`2(+Q1c!t(7f5
zeDpm{Jz;fOFfFFn0OsyxdD7sp%GjE+!hJ<a3bvzD^(mJ@`fWPHo&lq$L3XM4Ra@%a
zvzJd;VEt4fO6nz9<vGyu%BgV)J$4ULFbab4?LY#BhSeS~(CXP|o$Rm>KOlH5S{vQ7
z(`|2w^rEp>uvki%&^f?AcpB6%zI{|Mwh_hWiG<p>z`Q;n+vt(?6xFzS3c)_>;4DJl
z0c^dfh2tWQCS;*S4xn>yGw2n1fulSS_?o}3-y8*W?P0I)Rdi$aSt3nET!UUWdrfQW
zrq3~07tC}Mi`*A;OzWm}>xcII<rMk~hxmp($SWiu>8Q5i;?S4!tYFS00#hQGaNQU5
zn@bAuN@v<6xr^ZynU%RGj3!759S!fn#XKyi?z}j;&hg^+07>a!7O243l%4*+VK+&m
zAw&9Lgu6H0+&pK^2r$Y7yaFQ*Mp4?_`HLS_csU*6%*kLG9h(T9B6yGP!6nT5F$s3l
z2<J;yDIQmnxM+Ff9b`Q|D_SBT7*c<~qy9s;NhI)Mjn|IxR+VV#kKvgz{V6gVkuWpx
z-V)>`i?9E24k%iRr$Ny>xdKy;wA5+(>rnGbL&6wOb22uWpuqJ*sk;3BptsR0Wn0eE
z$>DLGnj{7GPX7#9Clg!ij(Odi9vK((;9Hmq#v_3c#zWRC#v>GGRvd>m!JnvhdHkz)
z#n%hN5-n=H;pUTSCg+Fl60_F5h4X=TW0RHRTtG_;9YFOa7M>@1Px%i|Mv2~EN<A&>
zzob{g(b~taC`RUQ4G(JqSY9o!EqD*^cLh%cPIe`WHvwdQ1`9x1^GkPmS}~B-5X<Hg
z)gZQj&AD`Ob5SiR9)mfJ&rNB_#<~YjNziQ`^G^BjC#&@v)Yt&!<Owbv$_`Oj9l;b%
zP6CP^fQ#vPkCThP+;@2b<ET&Q{pe|VdKNFgpkk#;sRDj_cJaXMPbH~pQGwe+7Zx2|
zYk(>mjz(%?P)<Q$qBRK}U3(+#Ia$+F+G-@|95?dd?;7vln>>20Z^Me+_1?du*jz^f
zQ7&p_m{WQay7^1~4MNkE68>X56A<5>XC=A~0pMSjxGvmc?eRalsYFot$)uuR=tr5y
zl`B~MBFigv<@JRg)0km@5$pUFbpSd?0w%o#CXIs@UF0Rkb5mJ!I1|p3R%v$PW>jtZ
zZuVMJRJmednkMun7_=>)zIAGF3M25>6}Uca9)j03YJ)eL2<`fGEmE^07o-?w-wgcl
z8Svy2fY47UhK?Gk6P?U}iToyP$+2enRdZ&KL7w=s2aIu-XSd@LDaQ;mAcXMcMq23;
zd<z#)YyBOr6Wi?o&Q&6I_UhV>cu0#(?ZlZ8In={gt}H6@0UUg+gx}xobekt}w{p#B
zcs4St*={wjTjW$6tq~*8N28H9YzXZHJeA|Tg!fTFBS%V`QM8VgE?i)o?DsaXhAL||
zt6Fn)Hu-Qfs4op2^_X@Us+A%8!tp7Wc?}}G%HGd^zC|$rmQs8C2dp*I?yFfui5CPN
zS5?Zag|%hb%g+Zc))=BgPE1iCc^zheoR%_KD863lCcana=TKHdAZ{cF0oo;S!xDT$
z<n{Fk<3;A(35Driu@1#Vsui1Mnabtr#N3=R27groR$hdVnR%}JP0U6Eef`Old(r*B
z8TBPjPAfc?lZd#vxkQo3lZm-q5(74K8dW*jlLnpLd0x)Gr(!!3f~<5FTF>><1zN33
zR!th!OOM6wYy3133gws+1qdDhw55eUly>tnmc!^w#A$%<B9mG3vg!s?)|;SqS_DYc
zgyr+Beoln9L8h3e<96#F#5+<GA9e&nM~stMP2W|Cc|==(m2CifS>{HWhOLt^VP&OW
zbL(uyU2#~3(9}i3Op^2d&C3U<HhVv!Jj4d-D{9Zw)!lR|wA%o&x9u{(bV_BZw>>n6
zy^2?BUXJ?yC4^pm3LEK+=Y@37sM1lO_UBSSo4reT<tLV8@n;^d%*=?y>0R?0k5&4r
zwx_)!7Z(=?&j~V)KhtuBPF=`(>IU~Ie%7xO(}vZN6ene_b5@W1wc^KCmI@CqK1Z+*
zEz51BvN>kE8l3)99&R(h`H0HrQT?CYx<!TkW?zp4_lR^=4buiuh^z<f29neK87tCW
zq_7x&ujXgmhOW1_zNA-YrYf%;Mn3V8E-^2`LHpY^r{7)J(3(0BJDR<>o&T*HaL<#>
zWGtG>_xnPx{Z;IHDNoIEt^q=EBxbd}LQ@WdXcj&tnl;PQfZLU5`(B#rj^eB7^FUri
z>T3TQtXo8=p6MCLwSrIg-cJp^{jXvAX)hFeW^B!$gw9bf_WcHq280c}=6O2%JGGK1
zC3U4$AHHbp5WrswrVE~>-=m>uyCcnRx=MLYqN%M{oSW=C*L#N+k6|j;WKM?%#h#$q
zaGr)QGPZ#WmQ6Aqu=mc2y)~*_&N*vNoXd=xuoD;j)sT$s7Fx0Fcl=9#EU@zRd;RSI
zQBN+)oHydfje06utUIdXV6xKO!K#3*LBy&BPPG*y*BG#x-{+ZE=ve&%Dkss((R;q1
zswk_VDI|2h8wg=|47A-*XV|hg_UZTNbeC?S;%El|gsN`3llvO1V3&ddD?q6<Y_>JT
z(6{@8=2#(qmDyHw8IIL<09vQCHvx9G3{5(}8?gwqSZ~xsJ}l9)3UZ5<-CGCnT>}r6
zXdln2!!gQRyxt#A$2dCRZINz<b~vXeiy7RkAO8G=ZWE*ekeAPRmZ)%?Bibd{<D=+U
z;j%OU25r{PEwX(BL<U-yVSKcBV^|Q&Y$t?lf7|&RsHl~h@qMvNP_VzY8S$f&#3rF2
zG}Mc4OApkLV8_FW&DHhDK?$OvPRU7vg<260{HhRfgHF!|q=kMc|C0j2b@d6tf1w{B
z_$3y{btPZRr?|7sy<cf0RUMA^oQ9sJ)wKseLf9WD|LqLXDTsb17fgrez*HFqBK(cY
zkvis76)g%kJzbc+@~q!!bWK!4%;b}I_ath(CIk@VFW@cPZXd}_?j07`w9m_}rUC9`
zha-~PhTofNK8W)`krbg=RRElX%Df9^*r`<8S(r9K=ffR5fcTA;BBo_~wXL$8P>T!z
z+<Bt^4C83$+)IcVDy2(H$Bhx~nB~4$0g`WlG(}>j8>1u0jkKrv3!FSPjl_Bh*PSZ@
zmuYz`jV*cbuA8`4ldt4zC}kd-dn%tM|JX$6IDoQruQ;GAy_4}D+uD(rlB<>a;;Ttw
zkL{3_<;`CGnkh;WK?+A4JKe;t8$Ez^XmG%Ur{taxaLDirb3Lf?oc(fj?7(&KpY#&T
z{W_x#>;3NeV=eM1U4v@rV_A?s!w;qJlVQ)fd=sKS@Y*#*mV_8E#kOl>gtQfZp0slR
zOs-UjZdxz<0J#;yHT9c5K-%#9AOl$xo&k{HBLpoMeG(sqUh$_V8C*<kkaYuS*~zJj
z7e9EgYJJw%@#1HY_+rFlV=qUGb^HNyU0&CC=R=WP*SC1L{!cF5e9uPG|H#>AmkTaF
zz=yc7FZ5Ie@a^RWs1sc9E;xFDTMl~DnZrWs3I!htJk3LlCeZQSlOHxFa24Bf*A1rn
z36dC6c8d)Q0`<M%C7_~AZM*?dY~9sN_%b#F)nD+SZxjd*FjZ%~VoR5QmIFE6J|;K|
z94yuC2IJ#=f48-3JTP^)-c_sUhPPq3;nc)~5$<Rw1O7z~{zWu)3@#T}Zc^TM2*19y
zwnB9ZX6HYxy(JXUIqLUu=SAw-+Xyk(k;G`auiK2aGe2_d+>exA0l6EZLQF;<m;tz*
z_sVrKLcghJ-L1Q6*iFfQE)_sFE8no6XvmtO&aa>jDgNjv)f*$$;TMDw%FY}`%FFbB
z)pCEAS38xSzxa^mEL7uei(kx#exJ8v4mDpdXX?-B0OP2f62j(>Ci-G(k9P6YGQJ@e
z>Kw5%uIAys<KKV)Zoo>Bp}q53m+exb9_Bc3q}+QHIX-Ti$vUHb`%S`2Nl!Ljo^D#Z
z)P`Y>2;iXSk^O3W%z6-||2p(We&>yzoxZ?4Mg)y-J|jsEWY_yJ>0UBkKW_(-nbZAX
zeO?ew8L^gga!o+J7edjyvY7h4SSUNsw#DwX81hmDZI>|)_y^qM0%Dh8iD37IJNgrV
zxPz!NH;qE2MnDUQJNk{0mRN}^zi>ye#Rb0C&`-6@Zf6_^IzA@<mcjxzPDF<c?C}Ql
z@q3t0u*Z!@JosbB!2{_f#``TsqcZQ-cOx1%0Z~5vPxU9%`xy*@^!VPY3<t0L$_h}3
zErbpb0FP4mDn=9ZKhL&gRAC)q%)b}xC&RUSG}PH`z6qYQ7$9PqYvcaxSD~ue%UdH@
z=%w(IWI;Hn7$q=|#Z*(JIBn~8rZ0^NdFVN%B@7MLXZYcYO}eDe(9q6>`agci9?QCf
zUkq)>fhs@>S0Hz#PyTDpv<4B*utpI6vKI;PWw38?t_Pk<4X6UpU?gMyc~-w-puw|;
z5EyHUmzas8sGHV?CHrC~)${egrVjK=nEeYD{R_I05G@dvPa|Gc0#8J6*tB<ZD{6Zg
z2zTmb01P^`Ox|IQ3s_bCWA5MbA2vm3KgAMOB??rhD6u<ShTwTcZIGh?U9C}or~SO>
z3Bz~GSE7VFmYK}5n4<XXimKhH1mD#9de@LRdE8FwbH(`;8Vgy`S@q(&q*J;d9+G%I
zQwg?~Fa67L!vTYy!+01iM!pQ_@y`QApaQ?$kNDxF67VPN{`#ZmN5&y=;<-e6Bs$yI
zG>4&6ALTSyv{NY-8%)X#R*gIXSm>Y>CQWSEr&xXBCRu~xzM@d}D++BDXS72~m$&kP
zQ7FsA{s#xBMQAWqPp^MEa2X0#%mjByqXc?^P<&zjO7R4dWJD^F<mt%!0n%9$kW%cE
zE1%k|>zj+8Eum3rEzA@TBx6yGnmIR;5NwH=w+26XKUp@DKrAqr)QJiLMFS1oGSi^v
z_})@>H8D=iYA4R`ZJKjw07bq2F)d}jQ-UPTGzY)!7dVh&3r1coLrn8Dh{BdKmUdRn
zi;)|H;xqOoIj<&|#&7h4A29M$vy-hP(noZd=&9e}O8PJa#e_N8{J!<$-}mCsBmyHK
z?NI;g^!B&RMs+I7pw3Ny$&zz-d!sbmQ)iBh*PyJ78t45Frs+b3O>eV23yyCrVlkOj
z@3yM}km&67`HEJOe|_+RBJPw#q5~AU-BfwfS-H$O5UUAn8I8F-@b@~Diz#HnxLJvL
z36QX2HPA=ka!Kuw!YgtISuq%{0i3s2vw-M03=6_o*b8vY)V}!nillm?MPDXt_+l2H
zpNhZx;|=IzyD27vnlkL7D@j=BaL(#aucP~Stp-&aIzi8rH*uXu6Z%h<sj6Ps`ea4e
zm`e@(Gk}!S@`zrMRljV&QliQZ(ZnY6B_?1rZq@p>2<W^|bM?P)Zl9F;u8JD207YE}
z;x>*YwKxqSb8X*fxQs8_$mJuj(pa_6=fOshibV}yVdCc<eo%3KlM#z4?b;uygE<n?
zMjnJtmg>24S)9&nH|XMz<bvf&^bW2VW<kTiV^Hk;$L=e(uHRATl077z8XO*<@Q0oc
zabv#9W#{}COxzC<{nd`Yj`cy+VSxX%oI6jciYiDY#2WpO`4BK$qC5SB!cwNZ=Smn{
z(J6>FM?cc^6}YByvFn;DBH*iw2M>NL1EHX)!WR?_qi(HGK*K>#NDR_f2o$j*38Mx=
z!Li)$mzgebV*4=GO?LA)B+TsQ8mSX*?4^Hf=QV8Sd5&*QyH=tl=mBXFX+#%sa&T*J
zxu;Bk;EdBG5LrOG1Mfn5P0ZZAJWoDcmie!yEIE<Ts@XPH9Pwgal-4NXeX*K{F38$Y
zinSm0qc`5A7`NWDJ2cPcX4IXErc-MEs#?@wvG2ak&U>6rW?Vb#Yh5#!;jLzTH_I<6
z;I>ntu9hqoRm;a7OaLR$mKG085Ackvyvcvs%TC1*UcCI{85=sz)mL!j2dFvGKkGe>
z5`{M7r-kbzpm>>v$UpE9AdTlgj&pT%ikql@V~h~J+zq(oM!Ae59?Z6H=)1;~h=pAh
zSU~<=npJ_~fLoKlI+>#o*3Y$j4marWc?uT3)yQ{pL_T_1BnEWsyMJNsd-S7zp$-K;
zp7I5Y{UfD~^s04%=H>Kvl-YF<ElX<z`UBu2*_`}EMh)b8C<4i-FyI^6Y__$-+B@)-
z6m0Dh)Uxn)Biw4&t^PFwld?^EqKO5*jV0E<C+hZV3~V@hE!KVn*aeFccQLP}<{B15
zi=wg|fV(Bu`m)(MvGosZ+%n$SR)Q9DEA~NE?6nHf<L?4pF<PWMtK?HAi7af~Pj3BC
zBZw~z9M-m+L2Y&-sVTf~*{u+K>8Hb1rGGB~E}8qvNp><glevO?^)%$!JM%1T&Wh})
zQs@x=4lSGXu^S`O(a&tZ)SMkIY%6UK*H2q00UWQDrUu7won;`8xG>U`LZWfZ5J}HM
z-2CVC%2&`)4UzMQ_oQvz5gG6AXVkls^DcLHj-je@vuE_a3mG1+d!vT4?Cx|*A=J=f
zz_|oyhkUwB<9Hp8F>$&y;~y0%#`$!~kZw489cv%;6)TrL74U?YiwDszK=&2<2XtQm
z)(!oOPChm3FmM3Fza9SOpXi=8uuvqpp?`bnFzn}&i*J)@2iA#1|K?`7Q^ne&;I4J#
zx&?NoO?Oan-hHebdHR1zhCX(4&kwM+ws=?*S*~@uR(LF}znTqx$f}9npE0es+10<V
z<J5}02yOj2pY{{8U~t6U5}C<w#*qi`g1oCT=W&T5x$hq!XbUqNyc5BmZwlcD!zHR>
zR_h>AhDrs?SkBwwp$O|{<>lFMRUWPUK*a-@2IC)D&<FlZ!N0|sa_sP8$~ZllX?wH3
zZ5!<M!XW;M)!Op`3fD%bLp@*+{fopKAiP<EKQN5`uVS*~6h-&DtQ!)uT9qiEObo`;
zQ@<x832JROjj*QFHl#j=`zi9<;C`J}XXls(--~6jwG>uDCqsh5`PR~^4V3ZS{>7p5
z^65;{PSWB)fyNj{BCgfB!ab4Sywd-rp@ef2{vR!!{R&S_u~-NWG)x)b(gliDG3K)z
zY6^)V)o2GIngqdPL(d27*SGzxm-%{<3Q7wHMsLpRJ~Qj({2(C;{@g!T<2=+P>C&{%
zPTW<j->}JKTnLeW9^yDu@Nn|7PS$gYqeq!^+2C6F(BfM~(tZU_?N{K$4CHdjsnigC
z1x~Hm@D6J%FmM24vkD|jZ+>-#&5UxL*zp!;_|{t9MySm-$d@0n8|3T8X(pXTx-j*z
zCsuITx!-qW26TQt{KY=tyV!-tsB-7^C}h3<BCNi#|1V+1T>V8@J(jrgezj82B1o9_
zrEXpEt+`p7?dY0o@PLyj@c}VY5%yHX4~V<E0C5b#Rg}%<WmyZO`t3P11)gy@b4%Py
zNb~w{@zNmqCLmGkC;1c$4EeCfRKW!5uR6Xz%`>WVW!c#sD}2xTf*nO7;dUrKv{GOc
z<bA^_7pPnFrlcLCTf{q21iJ<2ABke~Ujz$jS2j1ZcF{wNVewlgVv2BC6iln6egagt
z0kmUyO(bWKqXds28mVfg)D%+Pf#?W-hfEg>0=WDNUuNuJ3j;#hY^UwEFA8S+<RAH7
z$@baRsFP;toyaESSo*AfWR@nk;wF3`Cja@6lUSTGuu2QxQOCZQkk6j?*(S=+odhcI
zQoIh6;#a&&)(mgQ1efQZ3yMt{o5Wz_0dPmr)kuLAeYVTsesx#gk_(8V5Z=KT8v-r6
z2-{M!e($tw%kJ<W$4Qg(n8g-Ajj|uCUl)mh!h+xk^CD#_L%e!ey!0B_MOoz?ni%Uo
zy09c(7{?F$9kmtcGn8vY&4lhEPc)}7{uR8xwL^8AqmgVN#!+lg#ty*pDt@92@G+5X
zIm6Rhy3D@<tgqr(<ehPHEP?eE8f9CcS`VIKjhn%S)zTC&Z)@=Zxlg93flN&FHgxpY
z0MySez@7S$cH1_RARcfMy#b}ef^8}e>y=acdY*Z#dTDUvp-yeu=3WpCONIZM<Hd&5
zQ8&~1{V&*#A=E~#X^yK+$~S-+B*%m_iescCJ+i5x)HgHAA|WhXG}+v#$<w!>zwbaM
zQ5FV`^7lZa_AF;@R@e^+9f1NYBN>_{sGhvoQPOzbM)SIFEUH$JVKNeuGSBk7dR=ng
z91#Go%ikZkJYGMA5WNGeKQ!;Q+3Gis9UngKXe!@Mb8n(F_RDXAy<Y*Mo-QEJO_>Rq
zM<DMw_r<74eCFSbbYuNOBR?%%3d=){i#TWHMv7DfICq)&d?xfnz1nuqV9Jgi6|IAA
z_>aPCA%j;i?UPmc{FCZde~78K5}h|n&z^^)P9GMha49ppKu)H8+%%0;k&jBFbW^RA
z8*Jdmf~>K3V@YksJGB8o3(sj!AJiOWUyL5mUyQ)E&Ws$kXn{c9zpnjc6D}QXL$4$h
zo?U9J&xaXovJp8QO-C~k!nEvs*Cjk@U&5iuZ3S3ev|DPV7Tvn8lx!PYY#U=Bx(pj4
zGz@N)qxu;3`uvu=#7@YVTpl^*EXq`bOkk01B1o8!zq!AumI4F?JOmudWNLI?aR-go
zj5ddktgYUMv3v>mrz*i<tm++?Zl-Nf!fRywMn$$ZLKHlWJ`NAAV`%w2E2A;w?CX4Z
z=lDw)r#SSu6>j94mHzC1lFP;(Xc2xl({UROLKKwMY5Q46kAK0-)aCW~?7Kzu>3Q#e
zhZoP+Xcwi$2nZXyq{j`4$gSe_=vT3$Qqk3;5hs)<@mx+Sru@TuZPbRkZ@rE$bSVCm
z=VS-a)$x*-h56y@qJ9%#OA01A0LFbcik#3Y887Y#g^5(|qP-4))1FDopYY$<RyDWh
zN5}WY@u(*#eWyU!{`*(*UdhkHkKPYN6YRIqzDYe#H-NXra2|g2s7|U9*z_Frb0c@B
zyJ#_Lsg0#E3CImap_G8E^hxD=be|_KcJsW;6e7jPW2;?bt+pxC-#k8h|2&4&+dMwd
z(*-8fAg`}_@QkKaL>Ucd8MqL@*9-E&isXz2SP#O!es2#s!<-pIU9m>(07g^rzb^=f
z4Cr7Mx?2>y`*^!8;<^%-x3RiR-OHF*E<A26#1{zMW0`Es+Vizn>vkxQwGFv9;Kp*L
zuf$!J4V+5NtbKJ^x&|4rV);Za6O7^%mg|F?6k8U_p#ip0F1JAb{$?Poyc7HW`$rZ6
zym7M#>Tm0ltQ_Vw8PiFV%l%1Ke$z=-F@Wh8&dT_&87e(9)LFVbodSFZG8i3AaE_(F
za26-CjZ2H68M&NJTZBm>L5cvg(yZm;L3WDCM0UzOcqo{rtDi|U-K4bAL8qxWbAk8C
zX#65j^5^?&Vt&_wi)bQ#Q@s4pBJw3Mg-j5VIQxG)Q{23Q#m_$m@Bp(~>D*@yH_+G}
zeCh)|Il+`=Svuhs@+IVYOCY*TYVNa7{jgxyz}270N;<9ffAm{^`(!xKDTyStzNUsL
zYU33c@wV%qTu4DXSh#q`%x^OW`;l#$5T)Wjk&#jRTOOdql#^7bwyIinYY&rh{uBdC
zD*U;VlGNdAwfHYn%oxC<{4ZE+U&_E3KSA?d^SZc~3s<FP`wM{M8@tY<-xTivi%ag(
zEm8NTYURphXKbm8pG^J*g$3$aK?Ns}QWb}AdYEv8HW{4x^L_I$?~fU1PLj{LbZM0i
zCw4~J%FIq<O{kI+^7b(}!3aHwgQD!(qJMkcyz~;XagfPj0q1NM(FTMet@#8pZG21Y
zD(=#1q&}8nP{z=|zy&+W(!(+o)yV~0b3500;uS>w<mtSq`)wpqtJR^l=r0<CeAJpS
z9+PgGiGy8Y|Lo6}ZwRP@?YQEOREyZ|+7%j%%=G?djz2;2y0(lajjjyeR7hgC1W(}(
z5Fa}_VPI=A2F!Q1(FrN5AYQcT>%@JABQC1G>V=4%gm2h+fsL1SavUT8+oLIJU)|C6
zQ0r`9chn6i3{6hb*I65G2X;rLvZ6J;vN{d9Y31_UCi;L5vaLTiYdOBF58v0f*xQ$@
zMti5wF~;+>=Oq@EHQQmvR#cYmu84)ZXlcoZFa}t>zMrKJ5_et*q>Vn(GVwR!!HIe#
z!sXVh^ta)%Rz6#8m<!NiUBw_HuTHVw2@M1x;XkBA4fJh7+d~n4Ehu(1z4YHxqORop
z8(M11QN#ecnm&|2O3s7JIem`}^nvWk!@3;SdY=KXEzoQEjlfWW?0$?kbPJz%yim&z
zX@FZW-uD)$01|8z8xk#gd#k7#{8H#^W?3*lrbbKd1Mh6Q-W*sc%#~!$v=JGz^@i}a
z#hdOzMh}v;Wsp|jyu0=nd*k>;-sF_!rUA(t0X3lSI2uncu;!M10h1&1k4*QWVdczz
z=QQaro}#d@U?p9wFf~xRB0w78OW>2E$b3(~T6}zhZWV!M1NvO3%ksFBK)l;zhLdsq
zz0>lfeBQfFytMqkX`C_pn$UlKyO0EVO@TvQx*KBMHwwcCH7o1h)GQU7Tq5~@n`8xW
zA%s{c&3Py#iz9ku>+;q4fQ2FBfD40fwrl6aasexwPey85pKMF)ZvY<GK9Db7E;+Im
zRk5sA(!hu0!aA#uST4C*t)+Dy-TZZlX+IjbXif43-J^lfUGp|tX^gPwo{++>c*s?7
zLb2T}sqj>@o`H3|qycRFk48_I&JnmVypsm16H2II^&G7o_E~-2atVt^(dsIQv$+)l
z*Vmby#RJbwA5fHwgRN52BMUsVGo$J`R)eB1#%q}hu-R_7P9>++Hj(k=Q?g&^V<;mM
z&P7A6{H`r3kaI%0%`C3aLbINZb^h4wwPY^d9ndgd;`KO#RCJF-A&=dcW&$&JRfxAQ
zBUa~9EQYfsBbK%+1GG7V?aSo$k|R}76@aBH(B?oktbg?p?O!%K{=93)yN#SF<kmlD
zwbB5p8dzn%3Ro*n*7`p@^%Cv++aSd35GNI|x#J?&hyR?eigvNMShb($=Z3qB4z3Zp
zi#S$4%mt<tWak~k|3LNN72Q1gb{d=rE^;H_U7iuu3%WWgQ}Vh~D)TYRw*uZy4lY_$
zCL>bt1C*gk99H(Rh~{I+F_sU^h~|l0wv@G;uE|`z<UBE;2*n5VHY>VM=0z5PDLq?<
z=YYg+OeFnYTssfW7cNn$q@CF>FqK~^?o&Ga?p#!VsIF;h2!~&PC{0KoXf<BIm(`Tz
zM}v|omh!)W7af50qY)56Sq`-N*LO|5&rU-lS~=%7nL*%z6Bz;zJVk6!77j}j7Ry5~
z^M-F)u~vxHx#dqgijDpyc2vgr^1v~6ai%<E6pLIVK@=G^;)QHySOzq!ku2!_+J|<B
z`x3h=i!&=~#=!Hp1cyc4;os~I&sT71qS`wO4sx_73OkUw0MLL&gxTkp>P-Od4hE0H
zW|r_nXIHe{EN~-n+}`ovdF^xq1u6)yk6|1o!%le~`?Pz@?nxg;ZI^1U99lt#m#m+d
zEj>wO^35yuWg56GRFDhUD3tO1%2;~_ko0EEY-??gJG|j*O6CN4+nZGtb%~gt8j(vK
zSJL+Oyt1nTh*b=6?P&JH+h%1u{P>v`pdEDfN|^Q@E}$C6gqq9A4-mZ9s0hb~(&!ur
zr~a^wG?ypT!!KR>8!L-8yYlDPol*RLIL&BWQzf@cw{FN`hJ1D?rX`sv<1m~vB32kA
zX)9W;YX5$$-BPexghW9s5;wJ47G=`n1Q@C$;3SI(kiI6vE@#pOnPKT;n`s$o`vuo}
zQ-Gm?JeliZ2!w0tz{u$R1AWMfGWqqK{B^LZ(&Gx`y9LJ)>V2W#0aoUTy;=8t8q#&K
zzc*}?tWraeD#7n1?pYxX6d<mxbM>GvF{Q3b59>_LQM1$*T!|a=JC@~w?yMzARj!Qy
z*lrbOcdX2&-!dorvWg%9l~@2t23#<KFe;<^nJ)sW9}e6q^8y8YLc!CYcPX5A*T3Pk
zKa=`oZB@^7eMB(Z!9YAra57}92-LK-o4YxMJ_D5X7V<HHUnYe4{>lk9Te^?&@PL$T
zk>9ciHlK_oDADD9`sVoTF=Y<kb{sG_VK=TNQ9j9dTMA%~RCn|!qh`frrbFywgdbWL
zjZ_D65gCT`_vj6VcT95WZ88i%E+Quh=$vU{3{!9&TFf2oc3=c*ysz)$WW%m@vd2dC
zeRC>|t4e9m9;R*JKTD>)ScM+p`#sS<CvaTeKhmxvw3-f0=2vzy(~h_40Q)T|l?H)_
zCZ+O3Qxo%Ob=+(YkZ)-2)`~0|yDbu6p&77a#GVyFyYScG7T$>h07=z0DeftgF0c$M
zAJ<H)NY}3m+xhRprgC5Pfftquys(`=!N3cf0$$ijzr*oTC0<^p8}WwKNehsex=)Wa
zDPs+CZ!`~duLK0Rm-bZ_AJ!51CE+m;HgcBG>mn2|LRxn>Trz+15a?zpN;w%z;w%V_
z`%I~xjI?EJF&BI+)BOTl%<>XuqqTL6)PubX_976HMUqz>#42_#(K^|#l*_uhsy<9&
zvX30+G}Tc|t|gTnH$mo)$4ytko0%GEy5#+~wtEB0$p*0A(|^6l^KOaW5=0B8A=kzs
zvkTY{=#Gf?#oZ;0UVUuq+owItr57NgVC}`#cf<k?d&PmI9Pv6ruXeS!^6`TT`O3X|
z?f5He{f!yY1I=5u8#D{XGgm;j-**Y-iPA%2(=x5uwxqiZ^hLP>S%c1d?;fHLiiUy;
zStZH3ng+m(GoF+H4lwUk``EANC;z23ncE=l*5ZfRfbZUr)i8yRReV(FX>IeQmM(WU
z1549z=AYKE`dZh((iF4lq^#RIrdbQPzv5~bP1M9sOjfFnH>!UDK17oy1od=0=~Zqx
z2RD)6Aa@GiE+7iBHbf{ZM9#7r^C!5?J;P<{Fkr#-?7^`@S&m6)PoqS$b3@pA`%kqu
zEyZfC^(Sy5GTUCk5siJnh2UipDi}v%<3nKRU4`@BX=i17cSb)8(!UzVeut(4-NE0j
z|2})C6vG+MoaX_$ri}Oa`ou>sO--Lzb$hIDiwq?GUULYoclnYL5bS?DnfbK6rKwzz
z3mALY1fP9%c)gv91~Uo<i>#JIa%LBrTF!BPV>!=>7Bf}h$%6aCE<BB*hI<`$x!%l^
zDBr};Nz$B64+FXn+=wCKUW<JoYaA+3`V7v<>qp}@H;9q?nEw(9{VCCRrtE5;^JqYj
zTKop>Aaib5pqpoi-T2KMjXlW2kb4&$8sNlC3L1z;Vz})Ym1(!*%VX%Gvk4MjW`i*J
zm83C~fG<%`bM6{5ka4vGIyR=M-a2b<GtjY1e_9tb`QVY*y9sVs5jO!HI|isFHN=m3
z{ao?DI2g2|)qkxb^foOkz*=ctz9GXh-mPzA{&z0x;gw=ZcB0rrY-E>447fvy-bihF
zd_C9210n4xGm}6c!7NoCmGNuF_1Wt2cd&I29JUG=)_xvDJBkbbL7jM>%_aHzy>CYq
zPFi<mZYZxxr^~%*D^KTMeI1*j`+;g5>P4^3=9o4dD9>})TJ5n#T-P@Jhz)OzJpT>?
zZ)<r3iMYwAe76k&o8={?4G`7xKIBkHYZr~4dpu_~+Fe3ovWz;m6y0DAz;x)?)~O3n
zC3RUbfXvQ5LY?>Mu6$=;gjVHq8p>2EBXpXPEP-M=`GHAU=qGYzIe3A>@=Kr!6vM&)
z1e(?SYS%nY;Ms5YS<7rqX?&W8$odU!sM2#R0$FdzG#sRC0?%W`0uZeOvtFZy?=qgy
zf3VKT@S0&alv`Rnx@<dC%nj%AYrQ6Pz2<7YmfmIEc0h@FCz(PvVhpIU#a*&d4`+9l
z0Y~$8Yz}3|$KGky-oaE)+jzUh_*H{v5WHLJdtB!B;(CW>A%u%)A&g7H0OH{p+y%lg
zgkytlNk7&BeTq)v1L*4jAelzeL%$Mp7+lFYN?p-<pWmqJz$68Jtp3*NY8PP(dro)f
z_MAm=g91NKci_(Sd$;_N-_eBk4NdsU7xkjAuLJDiDSH}Yy;FNKq~Ab^*CEhDkM&57
z3XVtS{Q8HReNL!v1BcWW_k;9B7bk+E*AJ6GtX48z4q&^m7m%#W8vM+6MUtqLI;zey
zPAvBcMy;59*RV#(4kyn^8H9(b*nj73A!xxD0;38?9W{PLB5na$`&XY7jtu5^ldtbD
zXe$G*bk`$%e<gY+uMIf~Q0eMgX&k;{HM0C@-8Iyc-~CUd1mL=iU>JFIQ82cO9(jX(
zXZwTtFt*p#+<@j}nvjWY1Dyvh|1gmT*#ux?LE*o~f&tpL!FG$WVRQ53PN9hzqg?Vm
ztBF>Z@nA9|)kL0(+4XStKt=YzZGf>u%c7{-Y?s-mA8!jn07=&0^YJogQr=Pdle_C8
z-rta9_;@M=WayYzYXLzvc&*iwhqqV1c=<m1D|ko%;kzsC0r|Hywm+XV!C$6rRbVr8
z5$pS|E3e~*&%ZgW3-9pr5GZf#2F>(BoR`>nSK!6F$PCWc2_Cq(mdbB&+5I4>sr*KD
zIzF8=&c%)<k6)hj+0F1*NRe!XYf1rGKG@U{ia6VB=u>;HNEf5dV<!jn=4fsh?b9q+
zV+#KfFtX(44pE1lF1;dX(>W<-Lu`t0LMI4jBu5^x1=3q}i#*&$H7OdN?>Q%^dzc6C
ztFwUZaGSHt5tedbmdckkfquL^UXr3=%Og}_0>g^=d*u^zU=lBmH}w;}WssoU%%{4|
z68zKpBu{Mvj^WqbphGmZcixJiK2(UBqmRiG02WJN7{_Ba*iiy@WxU|(czaB=UN;Tv
zJ?}7~nP7s!t_|yyn5SyX{a4hMJ#(JR9XHBjo*S9<*cDF?S3GNf0ysxU(fl7_`p=o?
zbRv=jPCF^y94SIfwH}ca@`?h1)qWXQ(KNKjYt+bJW%L)HN;~6NH_&HG-4ES!@h=3J
z0D}gvZB(gqoN=Sq6z2!OGlt)=H)N@OykX~o{5FC-cQD`JksV#v8T$G@N9zczg1Dny
zEP<jS1qPaLvWI)WI?nb6rmm%GeqEoCQ@0K!IUIW@O9@A00YH&F<2$5zsX;>s5`y}H
zY%2%K)R?!ac>B?bgt29`t1>=h2o9+ZK!jAs)mj}R1UQSK!wj8C(djO9b+2hc=&G3d
zu7cEVL-?dh_%yYwn=sLr-SBEqXSH3bd8T4`<sC>|6vclZ!-V-(tm_4r$+;&I?cp_U
zlk^t@PO?t*>MRRwDRgLb5oz^&o+KG8-Y7O>W6e64QM1_MIQ_}gvOw4w|M^A&@V7ov
zHQV*q>7EI{_sCT^)7bt)czDtBZbLYmR}@{pF*EQJX1%lHnxd8?+C^~Sy7frdQz)$5
z)kru6VS)t8w-}VGU+lWb>dVfFgN!`a%-Q9ujd|~uDy_QTC{L51MuGGa2jv*h^6c_r
z?*b;)Y+7nWuu(Y5GGa;^?xu18>}Y1y;8J+PzC`uEa?AHbEY-yLgKKJ4XUpF!s=rq>
z&%!aj*?YA={r%T-10R)Cg&m1!N@?>FtwcZ$HWV3IhB(yAh+qrK6^VH&9C3gCniz#S
zgb(!%JkbuZ-fp=jm5<Qv-(GNYV(b2FQDE~wYyV?(ztkQm@11E1qmb!t0F%zuGSRX~
zvJ|}_MJMWr;(kd?a}zODa<1K`Xq~UoI`#&brp|Sawi%qO+!Ja#^z!totu2yrE0vYB
z!<0d|F`gplU53eT>d6OH)-v@!yatCb9>QaDMHY6K*NK?}({!ZDc1MW6yC;np2li-S
z4bT#7Lw!n;5{RjE1|<1(0G`+q5+S`YCZ)LG<saft@fzh=fQOEA-#pK!YP#YI;l`No
zG+RhN%t~8aK|OhB$Zp-?*Z~xOb$xezwlI%RE0uwPldBCvT5)l;^oyVN!LQv#GX@{Q
zye};w-ohDM^7BVB#UGE9ijV8<!mwL8x+Un3ZAAah4{WPi+@ps^0Z~nzXjI+<G>k>z
zL49wJw>0yjOQg;G{e;$3c0A!GPc%Q5vGg=|Y6HZkQJ<dpP<&1F?TvAjLC5gJZqc(3
z6cs>(#QcVo&Q)4-xAnhY4lu&?kGkdE?VWaLqaT3(J4bFTAH;!W*sPzHpz%CTt$|~K
zHG>XEYo{SB-qw-o0BHAg3HBVn7egKcP%x9sp$A@n^!O|X2{_6OKH&P*jQR7^j*&=v
zbo5%GF5tbW4(SejK>heZAXH04H$foq;YOF+erlMXP^`gj_7=x7?fuicnx#&=AN`Rz
z&DXhKnD14I>VEHTRWQ7lAFJ;WR(1>NmHnqtax`r?-Z01p17J`Wnos`LYJP|q@K<>5
z!d5R>;u*K!7FAr}ZGZ!uGYrxHXADz0qDcg;T(tiYNr-R4Q8lrfB;Mm}C>yOR564N{
zO*S_B9tUG>F5+GUJ|@%j%q#&oZ<RS4bj0<J{%B717Azf9x7b;DKMm{4(I!#^7?&}_
zzQrjZA<iaj6`-iq#ChY0(|M)EPHI9_*y!O$zN`;^AfL7t^*3kmm1c2%@Fm&(>KuJP
zJmCSRuETQUwG3Ih8H-Lb16NnD#83J9x_rt=AZO<dKYI@>NSd958HXjd*QOBfv`#;&
zdcaj0GmW-8MZ=RSBmn*PXsImV3@WL&T5Si}A#Q@*5}?d2$j0&D8iHAL%TerY*g@kR
zP>Hz#zHd2AGxcmH&LWo;w!mCUPTY~KRVjRa&t@y)0xfe$2Ao_+KZ*1&HoL4Z8b!Tu
zL5sNn@Lv%A+k1>tYM6v2Cy<@#ccx4DSGyqg+w&(FR+ve6?@Dq3G{>$-s%0$&>s=%8
z$L-ywSHNhUHvK&Rp2ULCT})H-EN~JT777*%Jj{tH#fSP;T#Ma{*2)P|opkVDZ@?0c
zvRq3AYcs@r-pO2YSm?U#xYeLl4+@mQ&xU=F@11PD?7lf(cQeiya2;KK3jTk&Hhh$#
z^onBMBw1#771{Pl8Ge1V$BI1WRKGoTG3Eb3t^uITy?7WSYaFP-X`_NTgTF`Wvq~q*
zm#^w)ZqFanGBZa^)lLn6UM#(v{>YhPr2+1Bz|#8(Lj*woemnFiodV8+?bdPC)E-)o
zvm$h0lOi}ec4On_v=ZfXpxc%)>D@H<r_p`lP;!9em4PJw%vnuJt5ro!SXC0!$>9$!
zg&Ck&PEg+(f(aWp<OuM5iO2aNNE=MvL13=^^A_?mezS5Qy+QB#5j^WGfCkOnup;3J
z%c8<u(*n=b<^VrQufj<yvq80zl(lJb6!^w2YKXACDGv^6&`={9Rv4Ezl$uqj0MpBo
zM%h!R{X}{F4XK(9O$9K&l-I}3a;qB`0GtfU>l+OU$h3=6l#v*!d?0%t2wwu^_cUh-
z*C4{lKfD(nG%2u7(s?l#ibj`h@G_J)y-!>608rMEh<_uq`)B&|>SA~ZN;p}JjzY)E
zhVlx3amVOHnU6hS2r>Y_K!L*kF)HYxZ0n@I6Wcg~W3<jK50mD!tBCkFOcq&Y2GFK-
zO9m&hi}<Y<PDk<$PN$SrhjV06P)@R2iei7eKuf|hGU=vv6HAA>G^#ipUMF-E2&Vj#
zN`sTWPtl$36v)i~O9d_BR$s(nuh?V)O9z^z4UsMjZ@c>4)=!_Fwza@3_D*83H+@H?
zu3!#MTb97(gv)q&cIMChisB?c0C3!l%z+P~ckWmzt-=CHD$9>exRLuAwXGv59MCbf
zs+4umPnO6zj|VSI4{+oocw=0TgOsK!d9ORb$Yib^PSzlW<08zw6v>RzkSGvspC&dC
zrk<ab8V^N(#i$<O30Ai9`5-P=K}4aLF2e5%5JscyFLX7zCv|YYoJp|<jE-C_{PEo&
z|M7ia2{FF$wLld#S^so!uXp$I9s_K(U}ae;DrNU{;`-hx{K!4EA|opiWJh)k%&sMN
z8MlAmxQiJ{P1#Ke3kL}!AqdnCvR?(cA1zaJ5yB2)37W;w+RdPh%|WxvIIxARz^yT~
zB?IfAQTxEz<Kq_USEj)uz_;Cc)j2Vz`j|x4D;&;>i?a;bYA)z$k|WI-yO++cW^4*C
zi1!^%)|$X_kbxtG>f(W-hy4UEHWq^}kXh?UNt6A7XvhSYC0i=hJ4=~XIj8tL$t8Xb
zlC8SJ_tzmF)Pm~3<U?9bB5oSc+w_DWx37BOU<Bx^$wkGB*-QY|WD06Te>b>;65<0Y
z?k3A{x7zr*RM1Rr-vykja^Q`+qRgJTsDfmA4}oM>fMg;%hU2+~q7@xoJXE}SNNcmu
z>N1~6zzN+O8Qqo0#rpER54+T-R-5kIZu(~FjDlA8#8eT&n)V-?^$hhah*r&UtzV{J
zxNtRPOg`>(Z35CNw*R$3Ko`9uYi3&Y`1-ya*F3A^Ioo&yZ9YzQUS<`TEWn+f5;Tzg
zNvH>Y*t#`c_j4P{Zl^X2R~V1?N*DG_KN{DUf;ysfvI01S9)c$Aq%<BaLXL@G1y1x4
z)(S3b@fb7(8assXT`<8_Bb|{pGP6<pdib4bSY{ahRSzJYDL9OTOEgk=2Sa-tpwfX|
z^8ikVc`fXPX}4E$z3QdFz}}<aivT|39vqZ>XYflWWJHHeCnTZJXa_94QUw+dFceRF
z4%<W`naB_lL8Wf}(3Wcyut1kklVbz~GLj~g>JU`w*Dc1{k`J^MojU!rYOW3BCOGxu
zNOk$Y+5lz2>Ptv<6-dmsy#lNh%*NId<!TYbtyr9CyzBFi!-Tco`D0}v!?C*_Y=iPd
z=&y{>^2N^}I&qBm<)EW*B=g+S65Z+4<0?8}kPDaHDo=2^)<xd3Hc_l@->}M*irzXw
zQ^9vYfA&xN3B)prV{Sid1xWu7RbLfUSJOlbA-DwB;1=B7-6goYJ0ZAi+%;%$cY;eG
zK#<_>PJrO<4tMkYb#K*u<AH)RJ#)I(TD^J(V=dV{O<KQ|v$+<yz-O2gJy_6^o*fsJ
z_0eX%>T!TSD$yl+90UpR5j9ANYjg6wf`=ArazH}-$Z}K?c~tU7h#v<vHEm(MFTiV`
z7V7<mk&a|!>zfg7u8@uv(T|*uY87zgJr{-&PYoJj^-Rw0)6)faW;6#-bNs4NdZ}IG
z9dRCot&}|hyGcjRoX{O%t6bvBhFF#aYy>7h`l%0Mw~OBmTW_yyy+sM5JX&2<$z0H`
zII3huc^@}vI^M(nCO^u#qOo8fNf2WWDo72-r)i3Mah$LdOWPDO)mO9co*CAV^`=BE
zHt-Cl(L~R{DE@WiE}0g2z(8v%mX?3P96X3xOp9I&bh`{c1X~w*>9LI@QP+8y7K6!|
zSyd%Htb%zuuS<TpOCBdDKExiDUyNJ4wS>_mY7q&s8kPI>MjfN12WeD+*zcgiEL`=q
z2Bz0~+XK9#<{KOC0`!Lo<NgQZz3y4t&-h|cn2mCxi=i?ilA}i$)2F!S4sYnFOPKJ4
zlp82xIaYHONU%6AL_z8FpU2BTgnsen*-=_zYu%Ws4i=++lu9t%n|%24C9!(VycY(s
zjtD-w(2^{uJvxx~AlWf*W9`dNy%XT6#Sz*sBxSVaIQD0XF`a>eG&N}7U}D}jX!$ky
z-nQfnkMP-==YG51@KfrlTxGz3Q6cZM+W~+!0vKd7ajTy{!IV0mpvHB2H!y6*!XtR+
z@Rj%cqdEQJBRfpD5gUe=ZoCWs>!vhpM>Rts%)50#&<G|m%RG+9s8PDCOyAi-yGd`X
zvpK@F*5Xol*ffR+KGewzxch#8n(v>PI&bA~=RH+}_kHxfE@3g6>fZxhvWofXemBq<
z>RnaCyZC{#pxsA8?31?~kJ}hiHPfn8cgr&gk^ik4a>(2SvccEqpDxQ$8h?P^Y<6_y
z8Abi5d7*0m4CsssN|D-;9@q;ulvMmb7syjlkU0PFJ>|OZYgVx@BVHAy`zj2uF%`uT
zUix;#qR>P2h9;3N&oQ6q?~+JLl`4U--kwc;QReM+)rS!C_Oc4TU&-q~BbM_DF`C~Q
zmudg*g#Ha|=#*zc%}hWE+)ewpxEXsNm|`7ahSvtx*jC-i+g<xAU=-a*+tD`aY-Btq
zoY6Gm+7yLGS<w#e1x7_sZfm?)hj!)|(m)PA&UX)LBb-^}ZAO&B5$p?yu2uqnvCl*E
z-5wJU>CqDJ6|qqso}Ul~eRP<O1kP!k>3ds_x%aYj@vf!iu&Z$>Y@X;gF2oud*Tjx*
zPCb6aU=c*SMNmctHOsx8d7H@}Ntu`{eFOg&vWifQpV9+7U@+7S^T47$Br%(ndUxXU
z>y91a`ZwfMNAP(-h0x8~jWB?|;quT=`>o_oxZM@bjeNbx`-%BMG=)CpE-p5buprf?
zzU8)2NnNGV15HainbZrzo5&#c<EG%5bwjXFew?2}KJn+05ZqgcaB)Y`(N3uZo828s
zTBgqa4c$0=(^9SJRB!II-a<Nq@@S<BtAra4SvWE8S@lEmaX>Bob1m>u?ch!dU9CKj
zC%mC{*Kx-~<IGvQ{DCRqh>u})9C25!60=3E2J`x>PkW&99M@A=9s!UTR3l!a%9=+1
zF^utV4J;rcwwhL)nZj+($#kU``7X;NRwOCAlqzr|ZRu(}6_<|zXlXFZX%?Sv47O68
zec0oAxxK7NRi=5@P6|jZ!j&jx{KS+-GURO7$8B8R%Y@EKEH>IlNPChjLkqGf-v}2$
zXPhH46BP(V;T!0d3$;Tb{st?{pgh9QS`ha>c3MK{K}ILMd-rtE;(a?*hK%|FM$*5I
z4XelvG-n@q1#(fDTw(p*yyb+pv{eiyq?xs$mLI6^eS(Y|G<E@h<1K;2+D1ZVy18s`
zOza~f+i|%5?s1yIA7?9bTBg<0hsW-%XX_wpE#lvF*YIt(M5%WdMUktq=cXTTA_Y_1
zGUq=Kg)E2W2kV*J*%5%btqHlWDKD}KIb=7b(Vif?5lxkiEsTGEc6r1YB=~G$h3s(}
z-+4ZQKUD!~JWsOO|3r4kGDj;ot+|Jk7q0S(1tt3m^8hv9#L&HkHP5F{wK*4bo=b*k
z0<tW}6~YF!3&*e<gwlfEEB%*0>t~1|vgxIZh_igVVEv~=>=DT8!ajWT4^L-ch=M{Z
z&_B|WbmI(sAB6WJDtUXCcWw>&xC*x~Y{2f2YfcR?HpE+1`|0ah<+(H7raZW|7-7tb
zo_37c|7?A)fg^+db6S){615?_uX8R?2uz&Tx3k;W57G?YCK!ji(hA)b3|Dl>h_lms
z^Sby{zkW@q?$2MV8AW`tE-Fd7%{5chYLHe;V{~SjfVnZ7Laj^bIiAx+UHFcB5)pMq
zU5E;(#Fe1pZ0ES2;G_z6Ns3?ut{@uuak+zYhj^+-sGL+WW(s1S67HgnF;v>~HU0k#
zMTEk;P*3km&#rZ7HpI8rR7h^89x$NIpxSU8lv0@K1Qa5o^e!kq9^$o9Z<5#!lcjW?
zGnIUA`iNZDFJwi!Tqo8@n5JbPk#mkw!6^p_3>i2OCjVB68!{~eA!TOK4!D^qI%*u6
zcmyf<$zjH2p+y=AMc5#uG%s7E`<?DQ%`Y>Xk?~`lwMQXw>Zp3N*tbWaxm&?;|D!A4
zUf{c<;02){&<93V3_s}a@P~X39J{>^9F6#AeP)vybMl7vp;Uc~k<5>8E0nakJOK<h
z)Fp;_IitO%<-OJU+WMOCuNZZ!VZIjQ*s<(+?<=MWSYOy-!^oC@mKdVlGRI@|zIW9o
zi$b7tz6s%nN7^#JjXD+#=D7PO;6oDE`!hdQz(BUbj1<aBODm<$SwXJK27)v2_Nv0~
z-M5Bs@1y%jU>4!p<Yp$K-E{Mw?dgD;BKt^-^`EA^LASayO93u9C-AxCifEt7w5LMA
zo3ik(iE3<L<xptP_!F{LYxJc*;n%fjYMS2+vZeoni&!`!5{A5BNefd8(~I}DWpTH|
zg$w_Cj;THL8-oM=1sZ_L@YyGsxUy$1>S9tupl7;W#BF1&6)jLWDj~(rKS=|uw62BV
zaTDp<P7CKlm8GW$Ir24D7QAss&*noVMP6w?zI#ceXM5h;tediTD{9W{PFqJ!b<}r)
z`r(PLG-A)1Z4#%M>1H6?0#7WA>t8N%@RbhmFN+Q9XxNrJ%m|Mq97%&1Pj5D)^N7&>
zd)L3?;l}(G==(b+!ggN*2Mq@(eqJYkHHGj0-g8*%WZ%J`2HgT9m~xBaYXzH1pS&CF
zrS{LmV+Dt1XJPBH{rNHESnF{Mdh2Tw(?Q26EYwQs&PO}qwz-aw#j9+Sag)bf$fHMB
zlgFmE4@He}v8}5;V|lgSF|SA!Rh$*amQ3dllr>9!o|T+n-l$&!Ara7L6GeMRYuaN|
zaKT(TSF=Q0w**3>)=D?s!-4dKRsNqaPxZP|b!~pbWM<9Y6Yy$l6YYpz+SvmMze#Wc
z^(1TvY6OLXgugFr4gX|s^XmW-ZQ{oJ*?AML9C?$p81~mOA2{9|$XJU4oM!GBX1A-F
ziu^cyHlK;c_^Juk0U}E)_lG@IL&hM-$Nt8yX7JG&=A~m+oo9LI-&u=civ%h<{z<gP
z?V@V3PnsGms`Qj1*$N6DLQl5eYYBOE*AUjwygG`gqe@~d2PD#*y?^<DbvtgB$fXnh
zk^iF)lfu}%4=nz?*~wp)fO<O<uI*H<28g)(cYNh@unJ<qY(Q8M4?O85^qN_bk)o)y
zO#+@=&lY<4nX{)j_Zw{7c!Q0>Q9tn1`a<EPwvEGUNW0Z3y1~qf9N|=3WIbBrn0<B-
z<2&#8y{kjUI=iyFgBs?sgZ>6<S-zU!A=~Ve)5C%)F*TI$BQ-~8$Cny{e{HV+Dx#f`
z&sG=M=OBRf>ws!U!Zx<eLmaF4YL<6nW@BdjSQX#i!Je(TJ@)tSV^0i5<!q&zSZ{_w
z6a0G&l>AM-INY6x9)Bw1Ilu*eM)Gy=Glu#^{lHc0gSnU7Hjb|r=};H%06$|D`TD=^
z28-WZN?)&GIu4shAl3`nl{6vORiS(gvG3B^@Bu}(1}@*d`-eKR?<9wNUN%f=94aUG
zt*(*JE3FkZ;phew|D=IVm%8=+Vv1|cVvzuHfQIGaG|CpBGomnKJII+!yVdxI8EWT1
zt3<y5mw}&u7f4k&^v92j9SwnvVluw>ZpBo3(-xt?HNAa}n<0QAJ4FipO^=ru0a++O
zQCrGb&dN!_Li<4s9a*N5Ookq0p;;7j&%gco2WKBYEr5VLHc&zK(hf_SpN-_4Qe?BD
z30GivV(E&dq(eHC<YpX6g#G<_GDfei81g7-;XTwu<Ik9^%kwnmrcqVpnCA_;+)&HK
zsHl4M(hY6T8D=nMsy%P}iX3$S<bZqt89e(l6UsfbDm~pUQF)=`@p|oL8xIU@Gt8u;
zTVn_|9xE&}P8l<2*xn!BZ^jFAn`1EAY<sBXd>dfCQs32djP&?;U#GEzS^K+%X`TN3
z8YaxEku*((?S(CetQGY%N2;&aZ$%}IQu%Tqla2j+Pd+Ib%VTi<g@hY;MxGg?jD_z`
zngv3EbaJlwB0tdtSwkv9cein&Y4&8o^Kl;;yAdIm`gN>V`by4<Xyn)Ep`J6P9wE8`
zp{Q{Nf{Ss>A7cmRBH!u$=(L$QPOxr8W+hp;V<8^nW49_`(^6;Dn#Khr{FY@!dU11q
z1_$bs$!9b#uLAbz=0bs3H(N2Oc`uBnVYyTOU4|rLsp3P?KS*nCg4nMu8EpW{z>QJ{
zLyc)Y`v8?)heQe4NY_mU+n&y3Ueh54SCkX$PKAdqBIq><TkB<XONnMPlj~>}&mQfd
zm-xPyEq`9XVDh&GJ6%;7#_ouO5tH8{u)xy24L&6CJ}^z0dl@MBylR)+uKO<aFr|O{
zO`J%5YgXv}DD5t0<<w)O{m`?Glv+WS3N|b32DUj3aAu-swg(&MG@?KXt;Il9w5Tg_
z;1xP!A2H*6MB>iUMopBD(Wuo}Hf%Kca=wX?ALpc%DnMSn_{zgV;wzv;9Ckop@q5L&
z`oRb#v`HK=+#4#enJ9>Ix^wxfwz0R)80`WlWz^@^Q`;Zn{PBi6OUq;N_y1ZMqr{;<
za*ncWB`|(om7x{>Jwti4Fo3d#`kw1^6a6Hrr!|F!_{<F_2lRc9WqS%aV!OZTgwE!I
z8z6T5Y?MMh+S|S3jL#nE%qpcX$A<EYL{FLZ6CkfBSuU+j$hi{L^vyfX>%+1m)$N(!
zHIdu0vbvRx>V9CSbex~c{YhPs-}f@)5GL4E$4wZ8#_w{_f%=^6`Kv4X1m@HK+?D4@
ztcpK)OO$1>v-)M)Y{h6{|5}t`Q-@+=&#bzER%63j@e9x>mr%AoM&cAxlY?C76lODa
z)dX}1w)<jj{&t@6Pj%1@-G#8?8kSV;n!IbJvfFUtL0+W~UhZ^QW5fs$HbZA=ojBdq
z>=9U?j9AymBEvX(66mC2dyuA|_$C3J^tZQfV$;upP5FZ_UWe;mH*d~(4mGcOh%IYz
zHiz)vg7E>knZ-U1KXgxhqu7j5sPFH^3j_dn47IJ$AjRwqF?we$iSHcJzuZIXybzcr
z)5K`nSxSfo&irV;%TACkq%WT2G)dJNX1iFqn?H!pNV*MmL#vC=YwLbq{ed+L=r}Ww
zuJB{II!bi#RXI60K-X&_7PY5V&D26NWPr%pS4EtmGo(scc!`s<68WGe?l~%KR~69O
z=;`i{WN-=Zm{{Btq4yX$b`JRD)Q8dSAzIlvzA!9V-Hz_2=e>R00ve4j3FpDQ(X^$L
z)LRxk8f&XYWYIr+)S}_s-v~+~C$WcAznd-EDn08eZy684{Lxk^V@>p9$y|WFt+H*=
z+;`TyA`A~dOYmW4e(0!*h*$#v99==B?8U++L0}^JF(Xebh(zd9t|?QKp|%mzmsMH&
zy5<(Ib*FY6`<4%B_5IBTzTdpvj=pEOc@li7<*h28a=V$oxE<rHp1N%A{?hc5vs%$?
zzI<;-uANIGo2J43G;v1CqfD1%`CE2V!TAdEbe3JH!`xW!n#Ix&g-QD~!1Cmz&|x-M
zmuGyrA%JfNO2xZVEeB>|l&(YDWqVR;IZ$<0O^8t>X7jsE@?w3&>kAjn=KmV50*qUf
zw_i$bqc{v<26*U=$9HOe31onRaffAM>hsu*UF455^*)PnD%ubAmZmp$<t>(~pccL^
zcY;S!W|6_}*<Eo<1&o4W%3ue>RJByd!<xaayI9C$=){X*k+bQIxa+fw!Og5Y!sWDr
zpj-3v%b591P@7{L9Q_KBeTUC10k;(1L6#uvY{{_Q-;c!V0F-5crtxD2Um)DG#pS+&
zaygkg-iWs3kuNCq@}3dKn%W@U>b0IG{H%YHVYl*RMw|njO?eY{b)jYG<Hk<+H9bq<
zM~<gLCenh#V7C$D_^H-THrCdKe!iy<u4XnhwL#0;vF5|+3b?x1{@L*UTfJSMz5B@L
z%^Og!dV1RI^K)X-UmVMU@8|u52{)p|sFO}pQyi*ne<RUL)S~52OM(cIws8EFHn!iP
zgj38UI9v><$5ly;<BsvGueFWNF%^QEq9ue;_3>s)IxavLUi$1w!T^@5pa$^R!AwQk
z=+K%%O@R!LWYoWbHn8Chsgc;*BKVGy=w=%oA}`K4eh;vdvA)q1Y3c~D(+#i_>hzAf
zne<*J4Od|KMI`MRk?;GJG<Bsqz37^ao!=J%D6dX6w(fsEsBa)6_iG!VKeU4ywUFPe
zaY5wo+}7S%Xk3~R`#_{Wg6HuhW*!kj)g-p`X6Z=uKbrDw5J^DoPjETl68VItWj0V^
zmXaI<lRLJ{N@Q+iT=`|{=XW0(Q8q5rf?w5k3xB&~=q>%Z%`c+ph=Yi%idkFEXgrsI
zp)J9C-Y}R<x@0K})Wj^eE#Z3Bq$dUFtLT!p;#gUCIdZJjKd(p$Eb1t!4`m45XQ~vC
z(Iw3c2BH%~6Px4Tn*1jDd-tD=dvu+haGTTx1tZlr`XLWy@sY5-(B%FC#LU!0Zh})%
z=ZlLLSOXrkn3L}sTaMklR<G(}X!MH!cq1Wi$_b_bh?`+@|2F~#@kYSjX{iaR;Ss#U
zO%5aV4~5W3fOsQdl>X!Tp)*KV+k@3>xsD)}o=AP`l~1_a39k<abtp0ZJUfzlr@>(o
z0lrF^+G%s*o|!klzxCO-9_f}(@CVPW901wm$kT6BB>Qps`2stW4jQ1O^M@@`E%&$)
zyQ}=C*^xupAioMx!Nm?2*DqgFl=9A#gkYN)Q7t|sSyqibdHGL^ff0Ku%!?mxtAs8s
z_Z|Z>!AIxbS>~eN;tgK#1=p)VS3Av+VI++A&-4&8fr~$!F71C%q_vV?iS(){&&hft
z&=$$nYr~OCBE)ZWk)8w8r#K|P1H#n>N$7ZG{-xwZoZeTBK}wIl>wO&#WX?8bC`-`k
z(rnaa`2`>M`k_((ebh<7aci#}-ph;x;5-ma9E|q?1~~WU{KO(Q9p=y$^Unzt3M*!I
ziwF-Rl}~P_Mj!11<{ip`jz`(G0y)35yU<HI`=r2zQgBP@Wa9+T1$iKEdUiAaM?Nw_
zLR>$1KU7_M^xwFG6I-zw)K?54sIL{sU*qaEeflXOR<|zv9l&NAY^&$uDbgOc`jdJe
z%pQn%{eM8Vs=sdq5ibs8YsGvj$5xx?W+m6UKG=6Tr7H5Qi#*N7?P$a5pnHO!6abAF
zCp{HZ&D3}ZnSkKbO#fi~@>b$O;_|?RWSR^AOLx<-#j^d?ni~U!?565S!e~5mLNM@i
z4^E*-f$ClS*VEsNz|H$bGD692v7Z8YYZy25cYSS1#JR5!50tE1Y6-O3{$`^76%g=w
zG)*g9A7l3Inw%i*(Gf=lF5t$9$1WgN72(O@6fwRIVgTt2L_xibRybBvzB!8lg)NTT
z+mn2qDS;+7f{UN<b>viPJ3pX`^9ZDS;d5Ln$vx$I;rqhcopoX_^pI#7-@w1qc8+AC
zxc?^rH*PWLX)Y<m_x0(I5`@WsBAW8J;o!6sjOA@C3wcaNh{t+?;`;n)2kZ`C7YaE;
zQu@DVM=t>VgaK|U{Wz5+9{y{$Ux>X@u<y0-VZ7imaqY2{-!a&oY2GlPbHc~z{(S52
z|G0(3tAYegs7s_Eu-88V5n5O8H}imCwtJh1p4G6DJpaV-j<Q4Hka$k=-xZ<%NfIQ^
zR>?D1MhNdqAn5EK=r)*B-)BF*%PdY=61{CAKnGT^55^lJ_rAY|Ka{RYZqeWY0jblM
z^%(st-H(<%r0Hz5YXV34en<M~a+=QUBE%6r;<lj{#zQ1Z%)8JEmV4H+e`Z)p&afJ5
zx9BGe1a@waP@KrhRBb&KZ?!VpY(@+St_upO7Y~aQ(Le3WcqXyGq5r8j^e+=dyGRR|
ziphZJKWRpJidJRnEuSWR-PZYG@sVB0=z1p?q)bi|Z<NV-LbXSvxnJbF-t;1)Jgbod
z1-}(j^>0#a?Bw8f8&R+HykGmK%D!nxqymCf@TB?zd(Ff05_#^~F8hjB(q<?8u%paj
zA?OzaQ1_93_$L9QYq!U4TkD;`Ye7A5bN}k98}`cgk%;|uedE;z=jOl;QL_PY$dqoE
z$Icw~WaN3vw8zzEz*VvS`u8+?%b2yN9yPcSmn?80eXfz^Fd&0>1?z%dzf%_Nmn?7{
zl6t$I_*SFRO4)FS3SMAcAQb@VX%(4(W$2Y%$d!K?Lt<EZgeM?n=blkR@<*z;dU+pe
zYQA`u4BCsNm3swo=Ub9@$4*uqks+6tsknraw)x+mRlbzoSqA@)4$fD-(ZRg`=wJ?9
zY_OeVzvXPd;NdSw^>CQ{%DUpTn3^qr#A^O@Wv@eoyVk;}fsNn<%N0s~w*Gf9Lt%Ee
z3BZ!+_G#N0Q6K@^kxrVbBh9O4Na|PC1mM*|Y{l;GkinI@i3@{}x_X4gRB5K3ELjVW
zgQCF;;iMla=i7K=cLT8<jEv<SA|A`P6x@-*q)%jBsn>OW!SSS%rkDkkPLY3C3lc-G
z1jgVz-dQWuB<_Cx-MA(l^xjlx3su*i!UITYH{zy)gwIY6d;gzF?2VL4*OV@mvT{l@
zgPqa$$mo@1=pZMpjC#+dpEVQxVP~*@&BqDM{(@=oJ2IBg#QgiXf-P8rcZfx_ztF`n
z;>J)h@F^1K^lukLT}DU)_bNDH<f5g(1}Sd2Qfgixb;7AVN14&NbEiG=60k`r=Qvxz
z(wV+w=f!som!Sgdqy9+fO0oef+qtrJp1N)~pRZ))--_ymgLNJ&9<$eTQQC?XTb`Fe
zp|(%Hp=whr;v~5K(K|Z&Z;Y)TD&wVcL^|vy+NzMsaQ8Zf`EPpjUzlj^+-#$(*J0{1
zYs)Af@|%MvJ{RJkI+0ix`~yPDVzYM<1);-)c^H}C!VGNpDT@jJ&QIt^G}ArT;58?i
zS|(bsZ)kN{7S3n-fIhylPZb$2PMXBLHo^svHo;lv^A06JOFH#e37bOa?%|j86x)Um
z&hb7XZVS|85-ader$T)`zjK%l9@0GoF>|z#r(&LwrmEPduyl+b@PX69dhf!FVvA$A
z{T(?I)5465=O6J7##x4-NzVZ^>Fwhe>WUQV`hXt2{U6N@l{f>V$tG1ICol|bBwRG3
zC$#a)93<{^BsihqWMWaa##Q--J(pO*bXfL-G@gg|RF&YbQQ||UzrVq!$>?|pwWv?n
z?tet|22OV6`Fxv223D;+XJ(Bsx6EQ&rw6PZy?&einZ(~^%rfq$stoy;Gn~P4Esfaz
z$V+XiNN;VtgqdKIOG_RVy>F+8hX-C}1m7p#XkuK{L*Vy97d2H$#n9T~E?tk+Bp0Q)
zwF_g3>$W*>4ytn&?b5g<??NNGcuJxdZ&753i<|-thFFP-fG76v3#Nf6agVT}34egl
z1oeyr*ZSFA2l(hpT_W;fun8MY4>n;zdsBJx&;oNE*n}l#i>{1}u6%34lGFX@nvag!
zmie)!_h#N>Oi8kE#KJkmW4uAvvy<1yjlHPx^B6?+r67{$|66z0%A?IB_I)}m|3Mi~
z(QT@N5TMp&xoJMVqK`!GrZ@BCwI$_zDn+hLszDBLXEG~BqNm(1IFqbTwH8(`uVh!#
zO1bSh_=F=Ojjqw3MiEeJp&^dWAfmzl%|3+CI?tmaMk8PBiSFE|-sFooUuVc~VKf&w
z8U_c+V^dvOX_3PMjcC-D?~L49tbK-b#`<u_VE}b0ED6OhIy-e>6mxlR(|j_Nh?}9!
z{R3T|HfQLUDHMwE)d({p&(-ozuMhaf*cqoW&*n##3tt)+zc6{jFVO`s+zy!zzX3Of
zT@bi6>3!wNXXUix0fmDUWZfTRx{RQ35Wyg1I;+bzmq|V7RlfrYN?I;&9bT==JivH#
z*?iP!m16t^l}|_2s1b<)_fwp|I4Du>T}<mzB&TR9WPM<p;rCT8S4ztpqYmT99~<{U
zY#Prwe-2DQ%h)t{#r+lYEXpwAEM`EYz>?t?7sy8RdS{LMi{$ps5Z4=)EH&u7L7`);
ztbh55&T%+wnbpA6yXDq%FLJ(t1;}#}-7#wE@4VPBQ0=MH@!V^ZuH1el_e_gpZ44Gd
z(r-tG{FaDx!XIzL-YU<J^aW>Z6|?Y!$^RVXDjf-CkBO*K_=CfX^N+|gI`lpa6q(Eq
z^HT`~9w$A_r~rhO?Vz46ua{hW^ZWZYDiSMZw<_X5L=L6xv&0wd6;nxiNI>ZoGD!6*
z#0gv0n+2&f>KUoDg0qxwWN!U~9E5Awc0emg=ui&c96;b>cU@)C$fZ$3J^s8<2jy@F
zpaX~?s1+F-fkVvAleLPg4)nReEP_6l282aIJhNMsfs>PmAY<1*p+(jE`vsHpRffJ!
znTZ8Db*)buukR9^`Kf`f9qjBaHXh8NFNovcH=z;BG9_~K!c4$B@9&4CW?b!3D@DHu
zZt8f9eGqfs;9+S<319eVY13|vA(5MIB?&QoA|6X7_WW1mfNEqV^rV@>QH~|F?egQf
z(0aM*6S)lzPHjYDDr5J_4U@is01>pL1KvlbefKp{kQYRkEYAQUFLp%%`bUdGG}{=b
zO8&P<V{DUEv!xaGUv1A9$0v^CWPf`~ZEySn!w`G<7KSmp@_%3$#=tQA<qx_n55EM%
zpxf*DXC9qn%fqv~lB@sC?z2T%v}pL}{2_G9K4dFkYg6+d!^glr)gwXFEB3~I)wH<m
z8p~tvUI0Bi_RHi=Ir7N^-b0ok=4|t@@UKL_Yf=M~qxzMuPW|B9xje)}AHg_p8o2=|
zdTIBqc2XZhwOcPp76Wj-zk%gcGW=YU>}Vq89ekk(Rz~Lj(H)UH2nYczYKjqYcfu5v
zmZBa3G$tyJ$wqXv!t(mvU6+1Q_+oQS5~;ojpiO_6lQkP*yHpt2p)IR^`l>DwN2s6a
z&s1+kM(G|=W;k9RK^X~I8lRT;$)prPERrMGpA_y@-9hDVZsh5l-@m@$)4y{(Ns!9m
zf2NU96Vl~7P8H67*iI+~L#CMj7P1K1@-omn76E$4;y;PymrLirdB?t$B4cg>>CUD6
zpXV~fK=W8n9%vpj_>&il9JYiI_TX`DP0_9Cm;Rm;Q+`3i$XeIAQ>_@MI$ea&(#q|D
zS<R54Cs#4HVmvo8?(ulD#7#FTa__yT-%rOh-UksZ1>BF}eNU$CWMK!5%Z`+cJF0>7
z9`pYBMxj&-VyFn%F9uW4Ufqm9*cr+P&)5{gvxb?1tH`0EC9VC>-fYn|fk6Xg$w*6l
zMM_qotCX9{$j(Zfx?_Z@fw<XdovVLM!u!5T#`_8Dx;=|O#dJ8(rG6ehqCfbOw8SPA
z@7y2#io{XD$-y@^R}?3gYtg^`x&AF0qi@mRpexq}4-f}<fRxz)vC(qr(YJ7@)L*OJ
zr9;;9)65a1y;<o--W-C^BZ^4O%Z$tgiAMK-dbzl@yjPiKhYr=r>l2Y06^X+S63ycm
z2W4X7wF43ybH4{zoX0f=SkSes71_EF@a=A~7+12Z*1w$BvT#)7l`YCN3HqwMW9Os!
zkPeO)xmcwDpi+~o{rOnd+%8ueEVt=+RvHpk8XgXdxak6_5!HB{!-=NtwTqxivp`QX
zI<3BNG-Fh6zx;jB)Hga|aj0wW@aqHaRil-Q&Z2cpxb{mfz@pVBo~O>nB=_;9C?lmP
z3#o~`zD|6yyRfn#BdKVH@p*FT`!_6H+P+x&7dF7nY*x~wWU=+a8eaOSfuAA;90y6z
z0>?qbOeAKhlWRpxKo=E-MZ6YPf)+Rqg6L)@(Rh_US;LPumk|nvNvsD9ldeS17!vX_
zK5`pc#ilv){x2KT+Ipl_1!AXzHnWNOL2ZEvO`l-L3>W={=;f0%IT#FbZC<yBYUohl
zI#Es>fxA`?wIrd4)#{GA{V{B|XYj5^;2d`*9O*W_Dlcl{G8?C#w}E=5Hhg#Yj2Q8D
z`0`5twQ{@+J{du4V9fm|SiV@<9#l7mke0h7`bmr@^FfpFYoCZJn$nnm^#NK30c!}i
zsgO?RIgn1XFiw_>2lv|W5GR%V5UF%P#3-a5xLPPDiDd5NT1Y2wwGfsNdRUNp;A$}-
zQkykO@$82aHQTM1!98eTARV0^Ls)WKVrj6qZ8$!8=+W&b0!ULBG~283nkhrGy;xZ{
zL7&y%rs;u_`qmZ(mfq&!<r97>vm6(v4hS}~$)8&j)FxevSI2I$L!GZc+BepQdR}70
zD;F+z-6d7BV6#7EvEd}_DXacZR_QP+y#UOL8vaW72l3Wo_oYRF7MY9y_xBFqXdp|=
z;HaPG-{KnHTvpD%pvnj3fYee((n2HHZ1>LLOXHYVLWW+zZ2F4b1gn_Cx2dBaWL)}U
z4o#vC4*MS`p*u?u=Mj_uK1poolkVVY1gnT9I@LYMlY4MnqSL0LyqEj>n%CE(+%ct#
zza)XNnrdh9$#;PfBXaSB%m_K7LAVD;K;sy-`u?XK_}JrLsK^uKG(+3=eJsa4?Kz>|
zqe87YrY9lRQZvJq*DBAga8Mujy}51v5L;Q_h+hnmP!7N5HAUeA>6psdsK3`_287e@
z7otaYd=^`<2%&tUIADX|-EghR4ycCWI9)?KImwW%n^f9AC630e+d{ufaMJ`04ZM+N
ztD>nVX=8S`BE@&3JF42Y+pRq4t_4J4bp=0Xc{nM@fn~FBs-pzaQ+@aVx=~LPs;}D*
ze=9QD&Gu6KA=<V9(%)~D1>zD+4Daa6Y0IOL-+}EN65$|-if{--FfWk(KK>zX(}#Fj
zsOxCZ0vhd@<UyldB+d;I(+UC;*hOG$`SX(_<&}w@+())*9vR9T4?kP*W@di)_wQ+g
zYvaF>T^&$UI6`NK;@P*9j!WQ>59hf#dFj5CHb+7v;IrM^h<ZdC>Pno;bAyZ56|Mx(
ziyMKkUus6Kb?W{la4LcMNngR9GbV|2YB4cX<Bv24N-z1Sha_?BWw5}-ugV#*h!KY!
zk0#oZQYVzZ3F3n8^Td*DM+>GIj0*$gm(cySA61uNgfB|C0HiJhWazkpv-6F$U9NDi
zPmL@<NVZ}{sRXyHMC7#%zF?<@IveqL^`Q=yUWtaaI!`lEEg#jK)!Tp>^x>vZ$UjwU
zyjM}ZP2*k9`|_|ab?x6(dGQt*Z_mQLK0se$DUqJffW4DCwovUJms+-ObkVbmhxd;k
zDz;_ZXmG$kye?RAuo=;S#ANBR$pXx*djtM2QRW{#(IcoeacYc09$C|c_*-}%^Hr2+
zNOX6IkE?s}jdA$oEb5utOp3xw5?;UF5z5o;w;#vvj`N?*)bC~_g{jzH9$8D8J*{|B
zZRcS%YOBf<j7;2*Q}0NmF0);WP@M!Fe;WaJaEeIcV)CnJ%ZJ_!@1|iXwvm3-2_QLA
zmdpe5K5mFiS+Afb%liSVSZ<U12FkhL%uLE4BakUz1a2QMPg>Gi!6(Yn#ZCy5p;yVE
zlJ9!PMD=3LjUb?JK~%qt{$cssQdXMDe59>YRUy?}<i2VZeWUb>H1T$=Zq-6+GuER?
zlZj!g#sRFXK2}bc#!xef8?wd50zjEOJ~5h3rCY15@S<xgeUq^&+aXca;JmIQpsXtb
z%-i+PlY?f`z*N2&vu)Crxk%`gMUcToYf3e?^Lj0+HEVXKI8^^)SOt%9M^Oe?PMW?(
zy%S2V1%GR($8JBJVU^Zl|4ltzo$`gz{ITd~pS^d`ZU`C*M*Qqm01$@X*nSxGJ9bmt
z@i$MA+8IMP8Ep9{^SN8I{j+ykUh{sCqHp4e<ng}oHJ44j<h`4_6=64Jv+`~c`hula
zt^K2Wt-Uw<wUHy18`V?2#yCfF2#L`Cue=-k>KbGM<Y@0RjzmT131tDeDW}tAr|RT`
zUebje;G$~aC@c>VP>7Gk81gxiz(-BOzYV@4{X)VhyShuX2mNr1K|SM#BZTF?hmaHJ
zQ;nLumw0;?z>hA)A@c9KUaa3R(C!5Hye{#*{uQ0)!@&FczG!weT&VY#38*Jdrw^;Q
zJ?+@&g480tv;tj^>sRkrbWt$_nlexVu^*D1JZOZ_`+~i)fUCCi>fTEUyfKkUv<cC4
z0C^=k9kU@RzIzVVL7;|=nA@y-|J{ug!Fj42_r5>GU-$#aEjWHh6IW!Z$aP968dV+(
z(!?Jhk?LMmhUX2V<zY#+WuFu&E(hc^+fho{1e*wZOVY?QNc&$zGby`m);bNHxF@yK
z{*a{RmyL2?11U~VY~rOE7`*Oq_)07|7=qCVXaPzN&E0JO2G4fx#?N+aE_Zs4)c1|y
zf8E#cuVsSu+0zBASX-kK^PriwCj*qvel4Eu&|d6-veQxt9F`W*JQDlvVC7n_=bJ{J
znY1%WJK<v{d^sn4*_)?iA~n3rv`~A0p<b|403anR5W5|?m?>ZGe-==7dEf?E+;hJw
z(lYNGOD%cO65-*-)&FVd-JymeUHl=@F(vbIF9aNNex4x@58Buh=7Xgk($y`8slrrM
z!_4zA7GoxuPnEtmm_MG7Xd~p+z8hO$Rx=wPi3p?r#hy#^!j@aMl)L{)mrj5dlASOa
z7D#{VIa|FAZ{(Jh&Vkf1mj<k4=}1=PWLC5wb$pkuLD$bArr@bk!DXWZ@*9pfU>}nH
z0K;Jq&mr+^z$ebk<bJq9Qz7#KuQdZ~?YR%4mQ4E*hEGRsbOgCrZAwZ^ktk}-gq+dv
ztCO6D<2|D}(aen(#%A^AQ>z29Q`Xko+N@rizg2k|egX#3p|j!w9R#^t-G@5ZSWnaA
z@&?kjHI5LaKI4tB!jcSElKP%o-X*Y<rH`BIU8`KmSzL6J89V9EvQ`=B1z$8_tF0GZ
z4%%_I{`4df^vwwgD#AwpUjxamCAF7V9MkTXlpzWFu93kdmpDLh3Dv(vfc&Fw+Ex-C
z=D7WF)coO<*JBpr6IW^h={6crbARCWjH@f8OL&_4d*NZ5r3w6|k1f0*SyQ_55)jFn
zf=HH`vuB}vVBrnOvNc)K!`g%{T?A`7&NP7q%SKKX^#9oKahBTCl`1??TKA73&Ns41
z)nxv12kbbZ{jbYCmz_h2N<N5O$FTl7zG`{+Rke^-9cf$J073UJ4Kc!Oi?JK~aICZo
zUGagXIMf%>7YE}<Dys_K0~%qz8v$A>!(VS&!W-Nyw156m3?BdfQ{3$rOOO;;#J=(y
zc=Ym0e<&;-qTLjtFPs`aBOXf{J;@B4bZLbIKypyB;7ii2jfM&vcylxZ&GT7vHGrcA
zcjV%W{(K3?$$2|8m#Gt$6rMw0S&vuaxbqmD3Rl1^GU75LzS7`bRHlhpxbWt2by^eJ
zRvOdD;J1jJfS%dVp8iF|fi3jEpp(ey%}Lbr<|Kj%i(;e&T{<YBljv_vK#zJb&;vFt
zTsO`x=YMdJ_j;mNa*-N<>=Bjvt!aUpgDd)rP!tJ<dlJh2Ir$TUqV2NOYYlO6H9kg;
znbp?^ZZ$)?pa>-;8~+GXs7^>RJ-nT=bK;r1ZDe*|T2Bc=?_Ws+lg;16MzR^eH)*K4
znXhNK%$}^rp8R>fK@9&|S8)eSbW!8Q`QNv=1+P-tz={3YSi9{JuzJj}phA1}=P~A2
zEEWH9;4GcDz#`A+w3z5MvO={*b7Rw6Ol05mJ9bpMMu2IDgGH-y!3c6&9=-{0V6<P`
z2sf4YI}z^g#@%>Lg-v}$qTTFG;d?h%6{0rqw&I;5+PA5Kiv0B0p#`9(0#vlxSdYph
zkIF$si?dBfDeni~?;#A+cE~vp@j}qOu?~pC8Hh^#ca?FybvX5!F*S;8n0&qz<#8z@
zS|ueM;#!?5j-gre2(@O1$bDWgec#B~NNnR0&(*B7%C-bU5o5v}6a>C1)vK>eqYKYj
zdy>$BI}%h0?g#*0;(Ndcc2(=%x~jwem9&ACU>chf*7)4mYVnCqDgIhg8|(t)Ru;04
zYvfh31=TeL)`0-lm5-1;iU=)N&vc<8RMQe~C=<k7VMD(wrt1%SDzJilVOwbFaD!S2
zyw>4iHACt`y`75nE{b`V<q6ADU5<3iQ*%AS=^}s?u{7$~tOug2J`CT(TN|C?bFrbw
zS*(%GV`oS`m;I%czOj1`kpI#d#ZS_4&m7b1CWE6qcv;C|(QlcH^(}J^l$NICv2qT4
z0`=->B-U~=Rxoo_Mnz}mjm#mTZ%6!Ci?;$Zv2;@Wj<zK<1@9rQbc4FIS+4Sz383tQ
zq*>)XLY<Dgzf-|sd%ID(^v_+oX&Si$*YT-Xt5u1yv6EAG#T&lW%x!h$zXOJR(Jzmi
zOS>WDq#2XiC4$O(MWo6B@tLIE0sU+5e&2hRJzc`?{S>B7kb2&TJs{^Eu$I9g%3p(W
zI|gKe<d(6bT)r*@klQ2Q$~;An>jFhT<L(*?ZNn_HR$X!$etJu-P#dBXxa6!Hx&QG+
zphE{Mj4!w~EB#J62w!qGU51NSN^UZ#HPsq-_(2DdQ#Lq6Q^Bn?@04BTl)WAyWqcgm
zQp4dfJ0}$JdH2xr!ANzT2+C`$brx3Od{Q5KUxbH+wa9pU^%}NCLVw*Ii1E^vSzktp
zC=OYHrY&bWx!0^LnJ9=sgM;?Dqna?G10T!bkI32JpWWeKwL7lSeYd-x(*NHS)$ZFA
zRc1*k5g7VRaEPkM6KS`MY!@7&svP#bn3+uv$mZ9cCAfMUqVfXiPt`jC0VuDgcV4|F
zvmf@L%m2!^ej@?s`LV;H&#RbqTF|?-2FT)W(tg<x%?wX$U9psPd=7=px-K6Nn)87-
zfFRJHJS#kG=}(KEg>f)sZOQ%eAPRc@2kRrB(!3-7I;ApFXUlnbP>xg-!FtK{dOkis
z9i)$x^)pokyu#`sS<R8$(ZPM6_c)vgaTUy=gGtc`mVW~O%=!vll8}mUgQ<S?DQ(_&
z{ntwPV}CafDoNe)Ha9Iw9b*B|_suA4s<50rQ>U>r`pL3ML@^oze-%0!U@}?D=-=bP
z-lofVh7PLQ9OCd!A=nd9Tv$D1eZ#D3P27vfqwD@aRfo_YJ*tO*!D7hS{SYSL>gVTd
zD%6tt12`%N?GhsHi}Hf*q<y@<XcexIwK=z%_;&Vu=qEN;SL{Q0hK<4x3|oyFXLLVi
ziF~dSX8$bHC~Djntm{nSwNFN*Jc;c^2DkP#Oa-mhNmSs~tZG+Dhmu>Q<59Lxw4HGj
zvTmM7mWj{v+~rAyUg1~kq0S~u4ln4oznToC0rJ7x*R$~~LGNN109B~m$f}{<jt*g6
z%`cn|A{|KUH*Q`ifn^JF^FolD3)?_gV?kPj++1I{HRM`%l-nj-`f&6!=>Oa(eKY%P
zmWG8EbkIwgqe@@<MKHHec8TIV#x7Q;=Mh<ydOd)qL6#onaTMDT<$6PZ!c3r!lF?ux
z`=8`DK7-bkp2r#Q_?@rTGJ*_u0{ShH(o}K(rtT|vl?`|`4iwYYSz-modZYMPGF1C4
z)0{V-)y^WmcY0A6_P^<h+5|Eu;#K23{ibM1_fuKQN$;K;WVxWTqNbaL*kBP06S-jI
zejB4sO!bUOJ$$12d!Y!;#||i0#ws5%>q-dHLq-y&!2WqlDwuB;Jmt#L;zCwV<+u9+
z{vcsikYT=A@CYNZR0nKfdM|pl9ZBAbJ1SV*t*}t}ScUDPghz5*0&5HhFpBZ2(|rle
z!3s5@YDm}9F&2B!-BH))wI4P}?SVRz5n^FfV}-ZyLk<%_iZU+3v<YSx6ZpRE&0n8o
zen){%(kF0-uSnvDOst)T;V>>u-eBWhug94BNPNqH_`LPFc;wx;#;$AC61D_l?5T2m
zgZI>$Etm!onhb6}=>~0+i2{Tn>K}98CJtgpJ;>Y9HiH{&S(|n_oqs09h`Z`MuA4|s
zKp2nr3<C*bE3kt0|B{wwMmJS19U|y`Aqy?Y;_gebC$_|)jc%%{GnfWF0{YU>w&pVK
z@G2T@pjr#;lAlZ83%jck<-Rp&{29S|2HBc_kU0e2NeGs+TsHq7k^bNSM;%@+U7bxS
zUes`+Uc2@RSkCAfX+~dYvFEwy9q8y4KOzI$ZHO=iYI}3!Kd#GV^n}D*r(v@n=<(3q
z=c)xGh6(nUx1CTn-nFgz52obmFKm4^*)Z>+cKZLUh@>jw?dApYr#PG42+>-5{UTaA
zDRO57R_!*w?D%Te;H0$vGb8#%aYN`JK}N}+bqCN9lK7I!WO{rBiW}pna|xppc@7X>
z731m7QT^M`)zqpO;SMG(5RVq3nek3lGO0i^YQN9y#P)~iXMWSL?p~rCBmZLpTu-}h
zpryQG4Dr?yf!Nh&c#7P3GKa1t5~m|E?53>k0C)+!SG;0%`{LPg4c|vf<|;o=`M1)`
zR`u4mZiu9n1i<{>0Ooi3Vdg4Y)+(^{w#rwOzUZ^%CsQ|jVZ4n>hij;$_g93^)spHg
zQ|q9@N~FpBez@_A7<;`h&zo}&Jt>Y8xYlP?K0Io%P(Jjd>1%r(H(KEu(|0HUmev9}
zn&n#SAk-o6D4ZgI_yt1pwR^FZ_p&HD*3(#pRzO#TeG^|^zCbsEz5mtpI!YkHXBQ?0
z)?&XvT?#txzLDlE^nEG(!SrRp0h{K}POkD<e@3vll-puXR#>v&`RElBu0}Eace{En
zX#%%$Y(~1K;^+P?ezk*!4tn{HUON%$vF-OA17IKS2F+7ne;J*9a-DqccDw7SN{tzN
zEd$hNlpF8Hl^bnT8@KGPA6wp+yXg_Bza1+z2Jl#YZp=^rKD40R2p%hSHnplqwJPvf
zVU^#kKnss5>t-__#w>x&eG&UN@42WwHB4hWzfD^gMxbbC;XEPr6@^&)v{e4XSG+Sf
zw+l;1$8+~wlRE}~8>_R|JT79#31Ac#(Qy27na-HdLOPSwd7Q!-Qp_J?K~RC}CM~yT
zt78m_K*wmV7}5n)FI{F~T&Nd^9%SH+P73*%Q^5q;^`Cg@BEi80CP)`BK{8wZ*2C%o
z#mjB;F1?d?c@`dwN`=>bE+B^b`}567vGG$iXtybFH(Gc1plcVXaCu0(#Ig!W6CRjk
zYrYNKC)>`hwkt_HtR(orn4gRj@jADDnt9~jN+aW&k(>KFp|c71`SwraxRsPBXF>h+
zK~PICiDk0ezMiY3ZaLE~_2~wbC&d_+>(M#7FDxm{k7CXY(dX|1y4<2Gv>w7b2mj5p
z1e@}Kv!xX22LSNR+=EP)>>V}!$#IXiO<8}!9~8BowH~X`PMiLgyiNq~wpWVbD<gQ-
zkt-{B=dc;L226e1OjQg?Puih?a~^%BiLUe7h!^c1Vc3#I+Iwqw)RP8&xVPAlzQrcU
zNurSxyw&JU*oCts(ZeEr6L$6CG|ilq*@jX8>Uw_(*F$O0xu+dm=lX#+KoW;>G%uBb
z&vn&{)XtBr5xFHQM<n-?9eS63WB;yxx?j3p7qM(mq1pRe<}cnIAS(Ub#3r_A5LyR+
z*o?Tj5SNSZr%eA(J)<+re9!R#S8bh2Y;|nRMrQRSb>ITlS6LToqa1!C(C_i>wi5sz
zom$w$D_D);p=|8H0a9`sq754q#&4KMAbUG)l<;5p_mvXsl9>0Msux91YmZTFw^dme
zoyIfuniaUy9yr)aW+?so?5dY~&*;59oi*OE@YBWNf?in{lQd8a3OD{7qiSv!ZY+-%
zd@33EA);bqlbiLiNY<4FXLq)w1K_mInA~Hy-cdt2Rp(Is{)*Wv8YZF8C$>UmP?#J2
zHTKvqf<DI#4|bAOMTfW(vkmqBO@n{U=-&3}b1m>6GLTJ=PS%7lo_Xf}qpI{M>vK@x
zRNvZL1Aa>+Oj>M=RoVR0sJp$OdcjNrVIrEos%Qx<a^%JfL)!646ln|?c%KM!FcDS+
zKN9~j^<WE~F!rF$+{&aG<9=xlo;s8XBCZ`Glx{AG4#5U|xvpajlDT}Cl>z^MVri@x
zdG_ba-^ApZk)~IBg`^+O<>D*|23zmHBrpoUOQ?G>%VTPKkGdt;t8p>g6tO~jUD|_W
zAP-)%P|0qPWFzx%02D0m9}zJZ``x;W<7&d2n)bEi`|E%1v)s$4we7(JwUx|Cr#^%)
zeY+z}%ak#H=J>BgW9bUDZTDI}FC)3hCs?{ux*g#kwU{2=rN`hTlCvsbTm_VZ!@1mU
zs?V{uh##Ay@HKzFlC5XlDIGlN8VllbQYykuqvjA(ih~#H0~{PG13Af$<`O5&nd96<
zCEQgMeb)AbaYdZ*MW^n=e|=Wbc?>(4n||MaL0ll*rK@~bUWvR5GJYq)o_pHC`^a%7
zrt$j&`MWRMS}xtqBFjh{atW4>lpBY5-OcLVB~>dYse4=pzRsVT-Z}ozB+MY^A%fag
zBo003F~2it2Bs@Mtm|@|(P6}i#Wigp+T^CxCG0hEaZ<ZyPm9(}JZ<f{xVR?i3JHB@
zM_=Pq{Lx_5bRDdz8h9qp%)`5AF|(xc-m?t1vBOB>r`-DxW<>#$@449LIV^@1+;a!p
zpMJKp)@W3VS0*z>GZ<B^ymJd{M6ea4wGC<ni;mW?5l|&-Qnh(GT&#7-gYUMQtMLQV
zmT=0Xpb7jdG#C7O@Qo<QGfU7jf#x@dJKAB|I$476W^snkDjjxfZuk-Ve2SD)Sef{8
z#y8Bjgq0^C787N*d<5O?US~MNc?l|E#2|tMf5skv<6<yRD;Ajc3R?O$K=LW0-MXov
zZS<(_C;056BpF#)lZMaqlq$z(7@28|DhsQ;Yt6QpsR4YO=E*F+Vm6Q4E(3f1KPOOV
z()(bcDPuNbd$Oklyf6AYkMm2)1hVl_EH`y#R(>5ZOEC%22lWu93~XG4)Iy`A>i$0A
z)-#S#Ft_K{QzHuP!9&rMLDBT_^CU&VF~ple2D-KpYIfipf|~H&r;?2qB*UEykhD~h
zaKl;niUh>5^oH98bd*x%&&RCA)?xDa{ws@15^-D|`+Pl_apoz`L*DWA!(_5E{)<{{
zp|LF57tw#1mkW0H`iZ}+mGF5Wtt5E3Oc<Wl3fLAmbm)M-xxKlb#0UW*eKbdTy;$M_
zX#k$!6M5s_<{ByT2S)a9vsPg;CbN$Do!xl~3^TSiz8NDMZIB1QeHC|0m*+E8d)Ql9
zHi#X~yl3`&FY%Dk8SL_e*6zFt2SOsuB78`*N;y;*um??!{l$fXc4)SPUlb^YQuPG1
zOX7p89{d!-wC@PKRQMS!us8E6i0Z`qa{<X;73qBq%r9)kAy`uBQap#51+4KqpChE%
z3~_aZ(|<xAp;%+j1*^}&Sig-{6^o=Ni>LqDO?6G!sn^hRg-ZXqS-~^0l4}oRRXkAN
ziEed+Jh6g5ku)9K>E<10*<_lid4j(@KDBujP|~3sYU#%Jd~hj`dvGpdz}x+l2-FPr
zvbcQX2;9?F#jiK->EBy)-$+z;uN9tW4bo}$*Tm*KX7o{6Y5vb?p0~tMRhZoWS0XX=
zJ!=T>P@!~iB1RIkM*|ksYrO}d;}^5+xr%N}PuU6j3-(%h?&#ie;m%00PQNjoTtk?v
z!&JEEw_~yQb}VuYja@&R1NOOwVB7ZrZ%<QZ4?GvzI1g1iDKjyb+p?8Au$%T1oGv5=
zk^FI*Uph>C?wk7VLCG8UVjyiHuFr|Z6b>dmL-4{UMjMSDwUMaHfIexqH{r|p{0~))
z19%4DL$0LwPs6Iv5_(E-n7JdMU9q}zoo7)AS$Sj2|E-j#;{tEBTq!_Gl)J!Tw}mK|
z$+R+c>@j+9Q$qn;b<uqF7&}N3-Y;!Q+_VK3pmTR<*}H$vm&dI=!kdxa-S6{Zd10fd
z-=w(Ywrq6KgBj#!OfcI)G)1IfYxZAF80mhf8Cr@T0kP8{J4O9Biu${!I`~2Qnv-&Z
zi4iQlQDhu|%PNCKPd;IHP&U`o#D7P_f9JHf;1L@Id)h0F6pi!Ab(tyKtjzi0PBrIK
z5Jy{9;(_Vt|6%K@qVfouECdhk!GgO5cXtQ`cL~9QdvGSWdywE7T!Op1ySoQ>mmU7y
zhuw4b{X6IDsqVRT@2#5Zc(7C6Zi-a5VwixNS1}3wThvrYKq4}+B`5Hq(Yw;+UA}pU
z?!z=1t-8{rh~{v{G*jjBdfUWPd!2f!K0--Yqr+A0cuLbD>H{`#{)7aOK7Llnu+NeH
zA8HOyhH<mkox^6mZikPA+B-n#TsmFRIY<(_R3+pAZTL{I_*>xvqZOZ=y!b|rVLN|H
z1*azl|G}r~uic`U2logoaMgBg^;ZKciSKi5)y%_bF@^j{=p#wKILuO0n~?O!VW1m>
zi2jqr5pf<M@?|J#0wLY^t?DQZ{w{<hY>fGktlz9O<^Yz=u}8ykXb^ePl!0Dl+pQ5p
zJRKjc0UPZ;Vbm0HF6xLxz0Im)_h$YNB2}>8-Z!`e^HuuWLcx*A!>g=<R;@spAAI>U
zX0fa!19y1k?LSCOno47mU_O25Ij69NexUd(4NUO9_;EWriOeT%oSCv@h&5wI4GVO(
zJ4A!?w~$x9qu(cFELuC~u1L^`K%Yi)@0rwdQI6_P3@<z3Ok1N~NCdmnv(~u9F#NXq
zzM*Sauy7(4Q<CpQ^_fGAR=3hccDA#2%2$Q2p^ikl&S%=rg3RMpd76;*XAQ1Dl(%J;
z9B}h*fHHwWg2zMWtBf{rHN258X%Z{Uy2q%c=~shIv#$m{hHK`d`0Le3^Df$CM?<*1
zIA0BHAe;QW0^&vEYka&wUN;Z^jMC8H{NBXcqbmZ3*f|GixF~7B+k~}dGYtmQh>pzb
zDAKbB<U?PfA<!dfoVoiCYC@wtBE=clD@i|MK82wPds<m~OduwQ<qKx2zj|d*y-eKp
zu{VwPfx3+CG5@N+2m!lGDQoECHjqQ}sZJyix)lon>rpZgnyP#5n3y=fNspS@JJKLD
zFXZFDzb_p`9jYUsy)U?kbFS$j$ql<TMh540^}kwmc#K3cc1qxY(LoX)Gs@U@PeUso
z=v|x&J`7Dw2~{lujJHo8d;+1>W1(>}3~FWGg)vDS^g=r3X*r_QgION#^I+AIRu5zo
zQ5R%gC*&H!nt&pnpJUdCO1&h1c$)Q8k|@Cz8>sefyDN_7ei~H+W+=#}m42?eWVDL)
z`Zdl+K9|2$Sdl>728&gKufir{XUqi*JE<!_a$H}9-ZTssgw|)FpI?+1M`F0^o!Pb=
zO~U>Nb)ZZt@6TE!FX%ovq7T)r7kTC|m4*jBEiGbxy-$c~oRzd+tjNKn!0z~cq-6x1
zh*c<JFe7QON$@-CoeLjjW_fkgc-i>edqb<p)(gaWyazg<>_cG*@&nkJl*#PZS`^%x
z&eB#w#CCW8-gP8cqZRE?z8Pewr24cMM`aZHdScDB;>}n}8HQ3KH~R;OzKM?J(Uwhg
zjNNR&v3ErX3;uVHhjCQ{R=<wM6&s>Y^AF5jh>JZvnldG_g*7p@8R1Qkq0p(HImIGU
zc+zX4xqSfU;Q0y9^nW_FsQX{Xv2Tpf6Gu8Si+6A%pjbP>dA8FbKgme!>=N`X>*1VX
zplW{^G{zN1hy8$9zwuJg3E}M8`f3ihV_s@WiGo<d_?tYX8MDw-r_@=y>pW@6sJ4+Z
zv24WpC^f3j-@4|VofR=nEI1m#YWBdQimLTME7=pML$aG=L|@(kL35o61Wli&&Z5-8
z#h*<eXx6i>m&LA^fuJc^zcd<~Wy8*_QOS|-Mo>L6-i+mTqdwW3p5>;K<@S1}VZC96
zH7te*Yhm)qU;w-Y%8AFG@X@E<=%Ue0pIHuJ8ZQ5#9WQ<E_@-#=lGB5zR{l!SFqc{%
zsHqqQ`vpEU_MwsfY$T0tc)G$Fhz|~5`+G*nE{yytSf9;-lYS}S-~ZEsGw6g^2-)w}
zW`jqi`77L=cSnDR>tgMG+@Ye?UruU+`(SX!aO{oU>E$>!w#DZHt}f3{%UcE=HPwYi
z^#OZNpPX>hp>SV=L_OaJY@YD%O{R@o0Y&oy7$`O1%@PKLtQ&CIlu%c=sOqI~E@Ub(
zW>~7C?V<3O1dZU8Lauu}wnQFJl%HuGWq6XAB9Tw|rJhcGJ3l9kBB_jjdq=*zDO?Y#
zuWp_6u%S{4&2Yv3A58(HePkAWE6V|G8?*xyV|$KT0hjl>^4g471lO&?X0r)=K-sly
zZgbB8HVX~w3md0Dwp2_@s)=+t64nAey2M*5qhSSiC9A(vyI^oJvme}*P<EQiSei<3
zSC~SVS1s~wKCx=las<VIyVBl|<@T}6KPCuP(gsFSzwyGqY+m-nyYNORno@nfd^!B=
zlibEsP}V~d-qHN=M|EO80Eg&~*@l${HPM&wV_{Vi`dMkU+K#Ac_8hC$fMIGQvfh;^
zqVN?`o9-{C;hBFrdIFAJrZScAf5UKZV@Cq>FC}<#j<vVx(~MU>o;<TJTfUSoVKoGu
zhf6>&`4Dg2dKb!CWqB;k_z}9mxJs;{U1#>4CgP{`Sm|>8sE^pt2VkkO#sgwpqBQ$!
z_)~h)dCbZqIm3c@<ovr>g*OaCGCzSd3?kr-hGF5%5`Z)e3#4JfS&#wo&;f5WOk{)i
zFs_lbLzi}z5W!}g(+?WVQ`Hy<AMq&au_^9YhNK_75vYg`N&pB?HgoFB#)WmIgvk6T
zsq1G}tBNH+ph%Fw^M;^8Ogd?!6K$5ZDS>wHOh)`WTVf}{U}8i)a%u&!s`SxTPrg#p
zKZudPef{vO*;jp{v(AVma@a38!MOM&60O>3k7RcU%v;i=WWNQ>zdMIdZwd2HhVSHf
z{>n&<JGCSlIs{v_Xrdq98e;s(LyUhblUGDM{Tl&@y9D+_E2cX8f;=+TgvX<%d9mDi
z^U`rPrm+!bi@)DJX>*Kt60V!wH5vR79u3dz{)>+8+HILw$y*Rli%v5X2i{I;X3XF7
zv7A|Y<*V!`3XXF&szhw+LMa~l;v81#1EmlO4lsr!g<uRLb8%)X)n)^8!5B&xkru{N
z0EKTslsS+rZfGQ((Y2o?EPM;1s>=3)L5S)jY+);d^7R|t>y9=10)4~0d(``D1FyjI
zq2Nl*8ndr{shmY~1V9}WsAbVl+5a1nM>sdn(#J7-U*EgnUf$tz9u@hDR8q`ca=5pD
z^vwEIuT5Mt5!7Psji45TJA4mV+R#}-ffs^(su*o=l<jN;wb-no-Z{4DO0-^?qGjX}
z=l2wmA7BpE4>^iNu3SQ?M4XnvKKBgesqAUEPSvb%`N`&&-e%+1zr}F;g*f?O$h2Os
z&O;Z<rmkbC!rIlP51!X0xNoCf6tb_oZB<|~fm=3Gh5b(?l&LXlHzn}#NA&Ta3i^hC
zA6&290ZI7R?fDa2*r;Ke@wzXzc%8RS9V$AQDl&mKnh~n4T<{PE+k!6s6U%nwg($b;
z>6?T-;MFIM5Y&v`VyUA_byFer$Qr3B@pBzixqm~#m2H`~wg|l*>yeg!=#tsIkq0{+
zkUVr*2VgVB*K}Ab0d60bP3?3j?RDPR!*VTUPpi!^BZ#tQHsJgGsSe96y~NmtI<Uby
zpy9a@oF9a$;2&F#(0Re`6}a2&hyC$;f)a7Qqorw+o#foG>8Hb12ea)s1~o<E>;pEl
zd7U~BWv`psh{SJANGGLYxU=`3A6>{%w)CW1DU0ker$qs9%Ie=hk7N~lR|BHazCvD`
z@~nGYgDq;MMVQ_C1^!^cX{&%&Z+Zi~dVW`Zg~d2Jv4X>~A<>0pmQB5bK+nQ^*}u(c
z-^xm$f;`@7^cX|fYXy4fp?__legU|b!`xJLCcU(asfBwR=eq<Jt$c`5&;xa?U0)5F
z#?N}sHzI&fVwgvte048=HatszxT7DEa~!m?AJ81@0eaobHn~qJq~e8Wq4v^#1z)~N
zm((}uVyACNq+nugrw=NZJ-k#6nbiL%mpyBbQbn$kMEZ?nqZW{|R)E6gi^jJW6~F7j
zPWOs*N!UY^h#6tZ>7au0Py&tllYbc)z#*l6s6)j^RdNb-*xi6nV<fylLFY>asnZz3
zp}ke7`}D;63A+@%5ToCCT7vZc+ZsgQ)&Q?(==|Bl8eR`n)#G@g8Zx5b8Wu>ihSVMp
zCHEaDbsa_D%#bX(n7svAQ5RGA6?OO(Y?EPFmqMPKdO3dMvE6Q?7cJnVmf$+(z3#ex
z-QN|h1pES2x$6)%)v_glV!?QwTM5?=%!A%}iCf<S&98g@6HDOemq6cWf_?W5v}sol
z`xR&@sgng%)NUx(Ju*Ue@%?4G?;k!$4FE>iWpk#L5Ck6^lpuR^zoUKd2(c2j>^KSi
zUV5JuoRdFam~%WC)f@-Zj2l695xgfIBgtiYlE({h`B<-`hqPuf`<seieACQomrh}O
z)S>#UiZysyD@2^>4N4r|prjvLy+?I6uwMckijqp|5KrOoh9n`&oT@L4O7*&hv#Fh+
zdKBA;y*P4KSE|?VQ>;H$=5ByZ>593?l-^{iBYyjY8>nVvLGi+7W__C88yc^*VZN9s
z<+dIIXSL^9piF#uZcJ%HLLP^4tM1z#%rWZJT)vQBZLZE;AqZ6I557i^%C9XhX~8&m
zWZqf8t9{J8;7@$?aB<|q*kGq#K^5bg!m<U;m<6Fiss4ZQp()2cOaF9&wKn+HADk1h
zHFk#T0LIP1qNc`=x`t6pMjnxR_WVm7LZ3Xo2z(Q&uj}q%3L24xg>kSIVZCsbGph<H
zUPM<vi<2vOq@`O>GkL8fVPH_<_QV11Ff%a9T~UY;tX3+8cr#F)=xAG<yCQ`JQSnY{
z#_djtyMN~(cD8oE(DMGze1FF<Q%Pz}58(4Jwu-fp>@_Av_8#AGNhDU=zqi77D>LPt
ze;2d9bX!8d3>TIjdJEP!J=7G&qwPY<N3@EJJY;GFO)`J>UrQ=a`tdn6qI*nn%tGZ$
z7LiGbyL%c&fm!myU;2Xv(GMvqV^8mXND71%chgyl3A_zDnNl31Qyw!LW+qS>dk4ss
zCr^xc{+mg$v6<u);{tJCPll^0(8eajrjz^aqskhHV6>k)sk10yaxAzlHiHWz%Kxqm
z3j{R+9e#Mk=$F&&FmRq3j0f7CC<UjtN0+LrqEWufaqCEinXoFS*~0DqOB_;%w2%ug
znx(w#774#3Jd<-!i6lvivFbLe1N7_thEuku%$09bIt>&1`>ib0Vvq(6a{LGdwo4#p
zpaJT$9K=YYT><iAXX-cHS3FKNd(N4W39TlRib9(ZD?0EzepPupkMh{+#^8CB2hZdD
zFGH1hV-@f`UN1~vV(&Jx6oK?0RS7(gT?NY93pxV@?tx0y0ZMvCK*a;Pjar4ESgTob
z_O=Df;~=^kvs~4bRMvw9p7_l1H8}P5edOcu(w2|XsK7@+1Zuhl{Pz0zNAnR0#M5{H
zoTtuH)R9kC$GC)&txA0~Mu-~px9cH`KaFXDoR-mkwtsG81cW)iqwUUy`jjR({Plzr
zOxl}-sR|HmCD4oG0RldOGy0!|Ob}1Ygnp7@)ayMIeQy4ZIA)k=lN}RUhHYU|Lh6#3
zGsD>M_E8HDmiA`huqix5-*{3en;g~0w8GkcDtJA4HKD<$P#0x7q;Ss9+bLGRzlYRI
z@w1<mZlCOyHPRVo*Keux;52%qOj+U@e`|t9zU4m>Sx2Gw1oZBHwVyL`)~GI#hP?73
zK>9z^S`x!vB>fGlQ{-SjGjbQ_%R>;E_hp)pz~#Spak}dopBemB2yGpZ_uT%YqdX5?
zJ-e`?INdyHnG{n2m+<3+L7gf7^oXbOk2V9v+_81yGsH*lpS@Uo{t+_d`(Jn-rVTDQ
ztZJX6x>$<z5P%m2H_~Sv3u*CJ#`ht*F*#)QI38b~h88su4$7ml_7SmuV-?wO(-KYo
z{xHy?X!}XjUuxQ)A073a_Q!;w)jLZv{tQf{p|IdnRsKm5+$tu_#aQ=%pAy-t=*g1-
zeS=(`RxMy3z&FO~k)r7H%g6w$l^-5y<c{3N$f!YB$qvA*XuSsP-AO!r>m>;7XK5g`
zx4UfY#DEg$6eQbsoa;@o>rHQD`%d2oPoL`~jlMhC@f1ui^)8|Os2UEZVqGnDoh`PV
zXr~TEN+^-=-A|3?w}uJ4`CwVHkhQvLiLXTPc$Dav`Fp?s&MI^i!cZXDXNHvz?#arM
z*?`$iK>j3JAd@Y+&ae+f$3FnPA%U^8wfg7pcg0s#kXZ=CjxuKV(>Y&2dN~2<Y}T=8
zgH-2#$!ST7+GG$6Gi)!LF^<$E$4wLcCFD3D+&x@iED#fkvS$NMv7kJSL?pbwwI;gt
zpc?}Y?|o|*!d5@I(Sa7k=VwAx3J&B)3E;B4wUf|40CqorLw{@Sn5r7*nXmdbW$nzC
zQ|h%0`XT}ywfRO3oHC_wc9ar~XT^46sL*0-H89>5CbyO(3cL2s$J4J+7T)-C>wN>$
zF3#@u68ZVj0GG4rZ5@y4QHc9&-2yb~tvCFz@s`b_eZSZI#Peaz6x6qUF8nXB9sp_%
z-pk@R&8-0pkplkWL!UKO9ryM^a*QAMhJ#d8KO^euuOPWU^$~L4V{8ABHjkx%L!jku
z?c>)dAGZUcywFB6>TxhLqBrzC6?@4L|2Ejwp{CF2o|z><`3Zk?BQbCcieVybQJ+SX
z4Suhe$e4;titbev;D6-$6e(c7zXH%swy(ak3_Q|)SzY?L#nr9?_uaI~u$)t89}30x
z9}&}y6PlBoDD1x`#l`}i3933WWOd~i>qgJh^&mL1Xin2ybnG}JbtYoJlUDgOrD-cN
z<;U`U!7Vvz-aHZG%V6nmZJN#+ziR2Y+=kz&!tg#`aMp-ERK%yba0HSbc9;TsU;&8G
zY208-Z!Hof7Uy6P7uVFxl`p4I<TBKzdBE}vzQkPdOLN%E%`CC)G-TNW*TKl1$RGrK
zY|#m-a-NNUJM*w^c=RV7j;}ASmrG6|)4{HnZfGc|^|*S!TJQOTLrJxxe~D5!i!+se
z8fk;!D(~e_h;X$;YbLN2MD+zU;6Dbs^tNrZ2|4qplGPG12rg?bNukHobccu3Oj(g_
z)jyTSv2uMLR+k~FlSOfyA27tzp$ww5iQfjrsSYIwy*9<UXN%e<*0r)Ajn|<xEzXVA
zp?o6)b+Yf-QX8$Kw?h?{#P?_I{EYo-dpM;VeG+gj;>V{F(gyJWW@w_wX)cIeZ&;s$
z3h@38mfnlDe?H%O76<d@jI3u!GDIwS4?m_aEh5eyUZGGnu4Z^_Pf&f)RyMfRyG|x5
zT_)jSC7{q*Ac=7t=0Ou<#30U`h?;kMw~0`(^<H5@1nfhg-27-?I@jXt@GEciUyia@
z<M6CZor~&oX&lEI;Ad@Hl&dC8xDxu`9P}Ftd+BRNi_3-$p%hB(>-$;iQ*(3jrEHs8
zmz)vz#i@|Ebi91#g;XME&#&l}4e~MWGJ`f_O^?qvr&tiN>&Ur`+7wH9RRi@hXo=s@
z8Tc7gS$-SHaHsBGse2A6@-Yg^LU=xZ5bn(7Ip1hI83b~pTF|y`Uq9eJPO!uU5Z-3t
z#@A;FZbfzQ6RdFgE^qu4SJlN}anYQ7Ji<>O5}%*-ex-3!0?=L`OFi)fZ04WLIcPPg
zL`SHgZZ4Y847y+6ySf@8ggO?58KKL81)`Lnp03t&7rnY|k8U3kklZW&7%XHln<|}L
ze}uZNo(3{~CN?v_e6G#bA+TAFZYq;9FznV3*zbk4ae93EX&r1xcf0KiGhGRJHUvqp
z_xU=FezHt}OTS{z5YDZw4uzllA1SgjB{tRwpAdX8QFn{4=vn(ux%wK@A-)5c6_N7W
zgtole9kw$WGlzGXmaSFq9CFVKCHWd?3f&;@=%)Y-%~-{dq;I;+sV<+&wReM*bhQ<}
zQz!Q<<syjknMaQw1Smme&2Ux-iRvu)C#sQW$qzyyFk&pKV=NwA4ml!NBg^%af!{bN
z@|`TVcFm7B2uP(*DgWS;`0?0zbYrIBZgvlE9d^Z9d8g`(#Aq!;F7hICn(p_VbASg|
zdxr;*dmcW>-0Vy8zfZ4%9`N-1{SoC0N|4)xpIAB?hbvK;XxZ!DrkM0qd4pY9#6<Pb
zIOi+mJaOqteQRERO}|mf&R;T$$EM=6q}@B1-=^~&NK@eoB%P{grX861B%h7reiK&?
zBvcI)n%c8k`^qa27{|FAPPbFlARk4^tJkUmCNuq1aTmgzAy$>~R+SG=%0ej&2I$Vn
zvKDy@_B0J$^JucW{f_GIDb3(14+CR^qP=vr(jK?h_$_=n?$?IdN=?oNx8%n{kNDMa
zcleM(a#@m{L!}ceUlAp@qgxHyScF<mXHhrsT%9`7b%>YixMeoHzo9f-7Yw*Uo7oWn
zDkZ@YdlzR}N?4HlDRzvAG^%ib-)Pq^_D-YD!S8U_;kCte?Br{VQt@X&H=KOe@f9Z}
zH0N65B_hT6_d>Ajt`=%f$uGj;>IbTMbh#hB*SWT7>|5R$7AwzS`R=q}^kfpnbSfb8
zlS0X#!N0SZq8t63Dh-DnEq&AIn4ZK8T(EDZ-wmS{nhq82ey(c#%^|{JhO8{#^2s7I
zc@g$Tii2LKsnQ}BY%e645ieShEz<JxF7&Ywv{swp$SuS+>5JJ#F%rxDO+FT<oa^Q*
zT_u_8X4E7XOoE?xD84o*suym>rv@XIg6~ByMXg8r+dXd$wS9Q08UK2ys>|CNNUC#a
zaekL~hNZ{9B^=najX4~xAG+yOwP6qUoP%FCoUhWm(><Bi$B4b9q(6WviW1vNtF`kh
z*FmOS(pyuX3UfuG!@$MP1bQRQHoKxYZH?nuG&HE1=~7I4&OzHHn`QY+a;7si@+9xu
zBRRi4(jlFW6ZlBZ;3Jg+;Ll{WHN3nRB4*VLc$|<Y%_-;YrR%_bpWNxctj3y5Bg-vD
zpA10%@Z#<*p<m~?VIBjSPnYV+LmJB_nXf0}5E?o+vi35_e~T9T3$qbfw{pR~F8m7o
z^$fMop*LkTE7T86V>|o;>KelDbfG?#?~|lHo9f&Sd+>)UO9Ofh-gcx>2LcdlG~`}l
zjbhOxY|&rV7lwvBVuL4Xzd61$&xUNsxeZ?y{*l|3Zoq=6q_i7UP_R?5uWBTi&gm1X
zKp-vw9_gQ<)yPMv*lM-x#xud8u@}Os{sjf`1qBaJl>~Hj72lhB1FAO<xN#Q^t@;BT
zw%ybR14g3}XMlkKV{Vexhj$d#I)X=y_Cyy$fjne%PsO_uW)kYDMZp)y0nPm%(wqZv
z)fAs`owl`=gO)#?g|Q%9BT(Abd9Rm|uK$J)kP@`AmUOpe7KAV%^D$dl6{XUgf07*N
zg%PMNuojBtsKNX_(fPrE)tn(b;*nOOE7nHm$#$sW`3cw%;N}a!GwawZuDd=GLi=k{
z*=Fah#~rpmaJAnxQHs56ZQEWbC8+e&;KVh&Ae`5iavWjJSgsNNyYHjUeV<Es@(au7
zcYSteG<P^ZQD+kax;z%3zL4S%<H9|Ozea7}B{e_atu1>U3JJbku#x0&kdTg!Tdh&v
zPS+0aSJVJxIzm_4ORiSd)^pI>7v!Bc3suZ%@dQR3XKIy%lPWvyT<$L;HK~e1&|zWo
z>9NkwcbYPcAI&r}#)4RP+*$D+J#CzVW;hDdwtYkcts+IyZ+Dj2y1f|tyv&l-I<zqB
zPfJ9W^Km7S>%T0uzt|a=h$*Q@)HBnfc6$XsYKH)iMPtl-o2}GL(v7{4H4aDIaLeEh
zK~`N5q7HGdy9N_hNTPgT8mtcrFm^{%4=TgU2xSO*s{fPlT%`3?l3omxIV=3)I)GvP
z1GRpmwW*KV%qxsr=4V<|kF9QA`o1)Vat{{$jStL6=1xi>e!oK-DM*Hl^eRcpwQ0de
zjRW?+Y2UCRu1C^2dlGwFxG|aIM~K+g45OZ_HJxJvBiJ9RwhW=}=uQPHnLX9W!dK4Y
z!8-Cr@j-1w3I4g7^2gwEG=my+0|7(t1!Mz(zQB_Yos&bAOYoM7e@QzBWAc?kE0DxB
zugMt<Trm|lZRaPowd6JtyD&B_9Ho%vrGV>3o&+W1!$N%8HKYE&;eRJsBGr!ZTt$+c
zhwgR-@TNa*ikY}m@roPf?P6LiL0`N)C_4S)J?pohxbIXs&Y?lxXd#?i`t*1{mU&%v
z+F8}b=0mky^XvQbldO$vYRaEJPvTm|(42w0NB+`6j7xgb;?n?qwFyLV_20x~#R&j8
zy_iumzB~zij)-v{xJ~`C;5J38nXpN!NA%OtqKc~rmuQESfV)&fQk<VMq_?H6?eim5
z=lB!nwmQ!RVZ1{zx<hf|x_T<_y$*o+=!iB2(|gr;>0`>yT6w7|@$2+cw_303G>>kc
z(lc(B>Sn{j1H(llN?P)}#1e)+Ae>VyHa30n1nPX=l)!FcAW|j$Peos(&A>!m-x@q(
z!gI5AFe}0y3~}MS&%X(i@yE-}b-?5G0q%wH<&Zcs>hX2)@fwI~dvXNqKauo8ESEhD
zUT3Tt6#VAvQPxrAB?<G(=@EII6Wa=l?ZPOl&w1f+{wQN>|F!b5r{k+VAk0PZvIfpf
zT{}BIx&*YCUcan|#;tt>bO^677ihaG?)=8mkzc7F&;C94ko;5RBq5&fz4krrWBi=c
z(Lcp1v~A9~XHFiWBw*p2AA!GZ{+3;*Kq!jJSF5cup6Q<gp(s6&zcik|6ilv|;0*dP
z7vvoCoq7B4S`cJ`oSlA0-O!2N;0cTF?_^HH24m&=T=WFE3wA}d1Gku!tVaAN@9D#?
znj$)mCH7*ojx#V91o5|BaOU*G5px#z5GIpGO((9(U(hgW2r(i!sJ7}6q}grIF#dtW
zg<=vUF4C$C?a^xF6taU*r0AmA>Y~{oaj}V}nTtNgM*t?@7jIE~5Bf`rFc`C!`wLn=
z8hS?Bm$QsmyjZbQTpXXW@8A$tJdW&9UQP7gMpW21oLUc3+{D75iCj&gI9i{5sdByx
zZdHUB>Y(EzAMwj!+2@D(oH`p@e)h*_q23;Er(t8#KCk_A4D4v-?Evu?_9%i82?dvF
z>M%bL&jAsdhqgG5=Rp)N7TTwH8_r?XmIO}|+spxVC(ADBK*Dedc?YQr*IXZhh(6T$
zzz_VtaQgk-C@N;H-1;78v8SDF?{zG6+RnK(Kd%}!qHwwG7JY>!%ob7wvqbSufo1mJ
z5Ni3%G8w-DIp%PD#l%{l=d7~9Kd~kFN*dtX3pAoR*I+oSWf=Sr)BD0Q&?MPj&3eQQ
zxnyW1-R`i>!$|p6h2kp*Mnx1sqohWGdCdJEI-T#Fa{f@0&r%o0>>Asti1J6N0j|B%
zLO&s-5D?pzamKX1j7Q`(!%KBdT-muga1SFYVVB+Hz?OGW_FTW}dcw2pbKs8Fu%!P8
zZ~_7jRwTdBtk$g%Wp$Ezn|UjGYVO0vQ%gDdZ6@f#EsU!gF)E~d6`O)xh}QqWQ9)`A
z^=Kp(AAzXFQJIy?AB{{(U_nVxB-nP;8+Z{uU&caGTEaW}^T!7Q)=WaTQCYlkBs|3k
zB>388CTq+4nZ!eNp-5*dQDeSzrtrjd9!bEUPGh>HKUF1OxwR-78*fWXLvuof*e~%s
z7M#V5Gio;GjrbbQ6N7YfwNM3A=;_;}UzqsXDYW!JwkagUpeJuyj#)2x(KOy5x2fW|
z#Wh}p^8DFZe&M?OY>9`ZdbUs{#8l|`54@q5QC#QC^hM5I!zwmK2yHVj9T^jr-4VcC
zc02Q<5aGKOsZGh*d}vNxAM1vo_G}R@Vv!KZc}4ux#aBR>)ksB_a_k!J8<y<vf}v-~
zjd#Yo`Fvw5tE;pDOwZf29}Uv;zZ_+r&dr+X7mTS(i*<QGq6XQaAkrXVyaX<A$tuYZ
zsr1vj<LJW4mQJuRT#EHoBy_d?HvJ8JvV8Y4g6|K2?=8gZ8-;jLtHm*yfqw<x+q<B%
z^7ymzHwy8zWTH07Azct}-bcCt5<cmqH^L|F>KlD#LSjggSTdOW`Dprwzy)RvaY5fy
z{jR)fIRQ~R7M@>G(I75SwwRIUq=-{}SJ(NbuzgT#9t(L$j83vf46rtW3)j^Hna}k;
zN^YII0TNSr7h3p+o9KWM#T9TJcU{Qp5y_yqPs=of+F2C&g9-(M|06a<;2Lz2tQFzs
z1U)!U@`qR9yG<GUOsVm^?sE~WeoT^ZP9f&NTK%#93e1;O=1~+&S|$8~`^MI7TH0+o
zvzNG7p(T&wHup7I9hf8vGUp3NHq?&f{~~9&NZVP>Yl!bEakrFGv(wca%F_3qgN5};
z6$S~}W;ujM@ED0~s=%{ly|@<so8o5RLpc5BQ|YnI$mIytmgy}E{;&BsynGFRMhn3v
zSl8u8VdA@ZT=vZ87p05r7m}A-opU<BuFL$HT-^ocMW#mXp8x^60Xd7F4Q2Mz5+8oQ
zUSSv%Eq1|H^4i>8=b?*`L0eO@)H}H#8IK_`U<UgG<8aWxJBtN0TX`ggHkIZzoglLn
z2BzHH{B18H{~FZIQ7>GUg(u%6t7Q#a3F{2>pq0t?Ml)TWZqi`IcTyNB&NI}!LaeXr
zJWxpO>IM%xen68`NqhFqy~DthHeY*!%W`<>INWm7(!z6nezJ47Ii}TlwMcCNm>8{;
zz{EKJ%>+|LJ;I8G7S%YcA4g{Zrx>I!l|7+yzsu0YN}qTYkX$|xV000>rN?7*u~7ta
zV2Ej^$dsd1;Oga*n4KK{sNkb#JytdORnC|j)O%L~&|g&)J<Oem!kvlp^XarxVfcI9
z9LbsOpmYLq8Qec9X}KEODd~q;c*-vbE%thOt5)DP|Bi63E5~nTSq`1cobE4e*?Q?$
znXt|i)78qro&<jAB5XKYiJ^E;LG4jQ#>Pa;8U%Pa;a$BnbKkA4w!QcW4ZS`DZEd}@
z-FQC(Yg^2(VDAA^Fw0N$LOw^KmNrGae9f#dSvX^RyK3(JSNHFpO7IlAq+BPyVHpD_
z4SvKcR(AkU)eUsjHIKcTG&~9UG{q3az3yr&$gUc?3b<WOh7abQyo1N)9PjmKCUb{6
zqkKAAaDWE0GE%HFN<Un!eG9}(Xc<28w-SJt+rZ(^z1tR&s7oK@eLwC!?qAlRAa7lj
zAwe$r`3rtU0TLct<L1Q-O}o8hLH3qvPMmgqA2Pm=o8<>a;Y%KDLRTtQJaYU~C7(u<
zzlNA0SBir|=W7Tkbowyp2~sO9j6*=7BPX6PFPotGrgJC-%?zhF$_nC5`WiL?@LeuT
zir+KV?8T-Q+YY_9lMq20_4|1-4!QiewX5_X8T4~g?Xo+ZGjLZ=6k(?r(Jh-rrrAzs
z5R<;p>zGifT6RYL*{Z7ZmhoGFpuw_F41~PB-v<2mU-F6JX0di&xakPzgo2{H?{7Ou
z_2DCO&+V`#+CRTjHF;$;=Jx6Wnl1ykdgWdd;eu=nOr}%Ef-cshDjhfM{T}aEh%0Rg
zz*+?T*}%|baWI)=zAE7#{Y_#Cz*`qC1wN_Ax%akay%E|oEHc#Wagw2)hQCyobcOd)
zHte}4i~ACeQpNi&_g1pOjO@E%b1{!onExkNQk{{~FS>i~kXSn!dR^!Mf`7cxF;#%G
z0NTED(hDiA6&LNcx<p5^A*<C-tlgH{TZ#8_{(t#sr@1P)lr>j={Zb>R{X7UILmJ!3
z8QV!c%sfUF@I}AUDID#<WZqh|erP@#ZMT1lhSDDvqmviG(DWMSHDcC4`n_WfE9<GM
z3DStgaveVluh@I~qE|$8pewXAAKrkB*T6YEQ7)%a-%<-g;_L1{S%B<G1h$S*p>^DG
zApiLdSH*pN`9H6lErFd*E1TOxnzrMk4(5Mig{=Qh1i9FLup8d>5sbCet@jd@YYCHn
z_!j?pA*U+~@^#7eX!RQ^PojV2!O4ln%P3vt=Ljn9UlSxjlORN*0C^xr5*Afvkrhj#
z#Q%bGpxIU|-BtuKl89%T4QaFNoTik4Z!`x?s22r<ZjrKX)9`MpY5WIL&rem5bSSU>
zA@E-FtPgm2o<-V$ft<000|jix2Lq^`VMmeJcilhqPTEmCo_*i14E@u~N?cSyQ*SlU
z`K3W7(=bW;@4Y#o5ngjgxss*Lv78`z^Nnm#w7Ldy1kXHtSqbyI<uu9S+bXNy7Wuun
zGLO7ivKm}uHkeCG#dY2mIWen%<2*-_s9r=AqzmFWsYWD!UtY9jcyzHsKP6SB-7Oan
z#ojLO@OdJxXG-(qy|e8MAub+J^lcEA;2V<>z<PqT>)xBA$h<#j>fJw9(*B5@kG&4S
zK(fL7uyCvm?wFD8rQZ@QQ&qXZpj_6O(Zwk2#%%s2{f=)lYYhqSj&Y8jaiI}^fzi!0
zIv5R(@AGBtXR0B1vsx4?XXzfCD=`><Qe{Pj3`L>%4Usq&&VH|#Wo(2K-3*R{hd?)C
zVEob=j*N4b0kv0ty~EzmRS{%qXPF>N+vpg?$p$snSCFN_p`+GfpsIr;t=o^UOuP{m
zzQ*C0n*>yf@bHe?JhU+Wn9%;r@8P#xV+(2FFLc|Q+*h3Jl#L$?wQ1KZrQsq5a+{ng
zwt2q8BL9giBSRa8^o4&s@bw}~2DB5dJIK*Y9Ba^C1G0Oo%gZgc4#kb0z9hE;aj@qZ
zAm>^a0y$R~5HByR#j)9z%a8U-`eI4>QY_du9r2o8F};ufIQ70}>&O-)(T_thd)2?5
z<zt>_#$ICCqIDt3uBT{BjV}rxJ|r*JUpuoNf4DBbfF?Qhh=p2@(|rZ>eb09qF0wE)
zI<GA{-4l$ocUw$s;#ZjV7xSTOQVbQFm?~Qed+ReeJ8u3UR|>pgo5vfr-Ov%ZgV^Rl
zi;1+UXDp2(^j=a=-Pi481@7esRLJCI#>br@k*D=$=avZiU(F?El@~(gIeSL`$`F~}
zGwf30)6tmejL!K3b-v%XXci<#_lG)@ie6Q}rN58|Wd<-D<ZR=^@tC|PBqGBh8_Rb~
zY35~5b7T&PV>I;u&z<)CstPWaUXHuA{g2cGPz&a|^IW9HE4Sb&w<Kn|pM<X4tWndM
z8J`vM(i)gb--Hj8I2xBPs{ADI(iyzBSXd5YIFsPKB6|Sn2h4o-%j5QK|7bxDCkq2r
zuoG`V&wLBI7!c1WqQ#Nj_A4TAA9ccjV8Y<~K9B0^_6l2S?kqz+m#7Z_&-}Ro$X#U5
z*AO<_de7GA*G4^*!Mh;AKmH#48a^;^8}f?paPo+<`NR?Q+6(_;5xE^C2>h19zrAcN
z0-l?x@t0n65zbsDN$%cQ(^)?FvaOd_BGVL0o+bW*^A&;yN}&Ppp}l<D6ds?=B^K?^
z-u$tr|M+81X=HcBm`@^BpE4M%EeBLM8d0=VmbA4`W~noTnr~&eSz2s%U9^o)3lC`4
zO!}X~2h7cq40hl$^_N{dpQeEu-2ZUw9cVHNmJg3%hh8;$7P0r9_9X8S;s5-}#)kg<
zC!2@?#XI{3>Uth@%41vYgyv5!=-IlguxE=Bzea~ats-by*pCxOJ1+eomMxFYyTjHX
zt62cp#;OxU&I2+89=Bq76G!9sRxkYP?XIKJ_uLo5Ttny;pdO(*fs{QS&z0ljG>476
z4E~umH;O$u@0-hBnLq#FdnN~<iP|7%={2~^h$^PU>7<mQ2xNN01~@-0^r8qKs2XKv
zaEk0H5ac?7>{)p4P4$kd)y^8vNbiB{nK#I(EZ(UMWY6Sj9<xQ6mR}X<M<V?ih<XFR
zGD)SI<$XOt>Hu`Dzea{~6nx<v)@fMf9ep<n-Wj;4U+67Kl~I(CRTwdGLuIxC;WXxk
zHqLw+;_ViLx`7%MuY1|f-N<g~Jj})&i`C><qu?%UFoWDUXei&@ddjrNbW|Q7B2&)4
zLn>o4G}602<mSDsHh76@Z(x3uC+?rO%xcb`JQ3=*ZV$wTe~u4x&*qsIT6H~Xff<GB
zv&2!HH%Mc{or<`ApLRaVZu<KFxL8YH{<n+uW@0t1x9ZJ((ChNnF8o3G2)+{C-db)7
zK_>IIyy8c7a7RJEo#_kBzTZ<;vsTx~Jji37ZZatg0mCIr=+i+Er!o*<#67*=w+-<l
z1fPBi*6%wf0y1!uPCa@4+IlA5b}r+#(xdmD+$pTJub$~SlPjo4+%cKx8=?syWzUIv
z-umC~n4GQLCJ|^bPuom2>GcL)fkBp}ZDEUEosm54oL)ZRthcX=9H_hNvbs{)=1mPP
zG3IFo){9rQQ<NtApH!SxS{I`?@TR);Y?-?}Zl)A(1$DBcasTl^S%+}ojqx7XZ0fsP
znOigLLZ3sZpD(CJ*?t^ov9z5F=c~PUIr01Qjw_SXzV?t{x1+{E^`G3m3S;fwgYiy-
zWu&iXqp4Dt0R8|)IL_qWKg@MW-a6y0&Nx#gAjPTxmwOl!HVW~zDKGMxpl!|gUl~_=
zQ?2KZYCDPyIXJxLE8q#|(^wYgX)I3$fv0rh3o|Op8WBB8C-&i^*o`%mnUH_wJL;x=
zVqAvIgk$;%_#73XPT8Ghc0=-V_YeT<`QDz$$~dGMpQ+wz`e&f8^fo68XbTB3qdc?$
z_y!M%dw1M~){V8G6!Tnl@WM3}LT>)7SLjaiLgu{9_$wVTu}kE^7ZP0rdCl!aoACFZ
z>OB{3Dj8;7=u=Df{A+8<aM#e(if3SVMuCo)_xQzvJ0}0luZY9v`_!B<!J|%@TY9(r
z*()7pd*TPE8E1A!#sYuBGt}wkm+c8)W>8z-fW>wo6(akry+Yo_!>B49uI7d*Ee}yH
z+#l+nLCLy;;Lycr+}2%Zg;a>#uI0lq?~DfP!7ZjjX(0-#bWag%?l-QeC^#7MJzwV*
z2<XHm3zsJo>$#njdiAnIHnZL-@`gH^S85mz=A<hb5^<Pfc?`wVgaF(3Wo;IK&UxhD
z>E#TemA)#0ld7?&@$=f9?bUIHl?bZ-mI;!EIS>*Z%0WonZoQb4SC7~hq(!B;l|Ipt
zIRT|lQ}m-Yn#kN;i+VND-Ytm5_g<0wQh86_{!gu(-eVMh6me`Ynp$jxh3G0TRCnTR
zKS5vhI!z-BzZ$8pz}UIR0MdyQUD&-XC~MdDhcLNMTY+V8WULz`;c`ju7G!CLb&E9p
zNoLNH+EUuw$WgQ{cj25`NCC2|+2e?yKc;-V#PS$EMKwhq<YPOStT@Y`12@z!u24hN
zheBqhjfNwWNwjldLlVG*g2o6Y6mso&Ya%TUj8f1!`A#}vK{)}uStp{^MGMn<V(Qup
z&V*Xvn=AfiY$lQwvyc@pMys)}1#3}}9RzJO9y-Sr+sAO^A7px}kT$UX*@}!QCMyLH
zeyUA>50;447kwIdANL))bI(HKbjZ*%AT(+H@4A4Ja$`YZrkhJx^WDW=`~iDmkA4<`
z-l5j)$t}t~p!N{-RJ8MCQS#TSPyVdf-tS2kWI%WEAOkut9>j?%!M_Jx=Kk_%gPK?a
z(5AB3&`@JIEHh*%h3AX>3)0eWC4_DYvMjUEEVCa!;oOqBuAo^e8&4ME(->&L{|*0_
zdx#cx=qZPmAPwKd^^>v+le~2i+ko<fptJZ2bpucv+L#eH8dFIAsSyXe5f4VHogR#o
zpGG_*7^%);kniY|Hd|0OgMn&BY97=C1Erx2`GZjJEl?U@)=$VTrp+!E$fTc#y=)wq
zsqRl#!B%W7j@HGSGM^j3F7T9V$96ISmfvfOS=BVn#k<c%Yv%#drP>OmfA9g7AB)g6
z$(+)qSDghu+U5lF#5F}$JN-p5+LSv!)9(w_=nK`ZL2N5fTTDK|ubvz%-x{|7nN~Gu
zSC(LDkDzJKz?N>V47?@VfyvqggWm`Q9^xNGhtR{S<|4{XB?8lmLND?H?go=a8-2=)
z=zwGJTO?^FHi`b_j2u$nY8#m_^FI|P#c!2A8QorB4<1h@vmx1fFwJ06l{#iD=TPDG
z$_<S^ZYQrBorm<<FbaMB$R<&6?)sM|dZ_dMXu&qi3O|?<>Kh{p4qS6-Tm7oWQXbXs
zF<iK26!}R1vGlZH9}bc|Pm;4J5!HD7Juv)GolPaX8b4)op#j^E@l)1ou^%iuiK@5+
zeY66D!co(+Gu%d=jLuS5;hgX^<=UF}5+h+cF2@q(cIOr$Yn!(ubpixES^rdNc`q&a
z8B7K#n@p~ZI9-vrE}xlRTTvvBJ{kQs>b;DbW5}dJ{ythQ$(3+Hg^w)te-x1?+&?`t
z0KeF67MeJPqrdNM1EStGfVkL7a-b+C3fursq<c;Jd(G>66I{U?LdO=%+|Tp_k#Ut^
z4$ozfN~g}tJ%X0elFw!MJ#d~MX0ZLveXC*PfL}ZRu{$^6`K~c$K_;d&{~*^hij<Y@
z54E1K>6q*L1DAImlGOd3f3<{XfdnYh6^Wx_%9_GN5YJ4bt5fx{AX?X6b4q-@Jw&mu
zbQG|;rp>;gB*p#W(oRjPb~t-Tn%8RGf@L)`oi4D7%g+v=m2y>$aa#_1djBgor8(rk
z&Eyz_6C5AGxYGUEK;EF}L^hP<u@EDg%k~K4Jvb{dq&S+a0pmesR)89@(6mR!0T=F{
zh;@6R0T(N_>8eu3)#{lSgzZBqUh;gN7JGXQe8YJ)=^!@|Bfjwm8F{?jS)V<QymY^1
z9X^`qpus4UQI&->5&jP}+XxSsnwGWAIr>5KXDvIn)<b53ZmWdL5X8F`BW6OYDon$>
z5a;la_PCJeA*O#_Cjn>@L31>;L(r@znFY;yVO_Tgl442W)L(G#zCm}FLU)72a}R2h
z2sdAkyhl6cM=I9oCr*kUo(q0P%AS1bP)pJt@aW?b|M^NgBBY{)a({R~W5~<3dibX+
zUm`HQDCmMR&}lv?y*2|yWA>>r#BL`rXQWM|j9B;6Qlr@_V03hQ$2I35O7i%h!rzeF
zhiOt&gJh+S+%*c@#VR90+$KiZ(*c_fD$r$Tc}WwvqEItVk@Rqxy@=#*FZhSysbc$4
z<Vk8jKItV(<J(ZyRAKK4zx6xbG*0+5@JK=Oz8xv2BCD|eB6MExNR1<8snBPsfbVp}
z_&+Ux({@fcPCc9mP9Dr2A}W#mW3nPsc)owMg)yU|pcO<q9lNoHw7^^2dh;B&yvcVH
zJgiewEQd(jmf6OthUZ4pMnkOx)EIX>kQ(Ax1T2MIWCh@-YggdTKWIL&)VqBadUySf
z#%}r@S56e<b$iHQ&}$=ooZ!uV=@J3zNdF~(8v4ASG$0!JI6icZyj{r6w&YOC@yNB?
zz8U#@`^#nhzxrXFIV~+J$Alw+CNs`^B3F}v=cYE-x~KJcOPwJp6C+z!(Vz6JL6)N;
z2^XIIL(`WRAK1vFH~_J^%lE71w(Dgr3j-{S32y6>vGHZ*FzM!={KMNDs@Y7As8zCn
z7mlExyt6h{cd+NK@HEuwy~a8OHK&vg3cAO)jg4>@sB@SCVuAaM7O8u&Q%O{TlNg2P
zXvx}C$#ioZYBTxq{wi4WToAR#r9srriHT=a)#8}!2lJaGS%ej3M2TP<f1>0`Eye+U
z!t`L(mZk%Uoe9H(j+_i#u~nqsfPv?417m`h(XzY6X5TO0$Y~9wjo(uAvamCnJRQ%T
zXcNEL&dai}1_D&8?APLd8)w^g-?y=l&xNPgo$FB=UNXW^Nh@1-I~zDnyH0&&sWN`f
zAyJB8+^e$k`e|bP-FESzBvnOMmI+^;pXrZS)}+-;84g5N9N@S7YM@#Ph<|8Ok@14^
z$cdeKTe|W9xO7>vcq{UF&(5a{U)4%i%4rswLR_=DtZgPEF`D1xUvjWy@!=^g<(w)Z
zt07)^33f|$ZIN+|2PL-Enj}r9Sy<0i8Gn^C`$zW<e;4vEDY(7PmI^?_pyb`CB19cH
zKi^!3ThjBE&z*kmX#%ikAgZ^ESB#ILD#6=~P+*PcnTO>u>RVm4B;&8KaT_A8iCp_(
z4vvFT$qFA8+;vC$blbh0qUB!4Map()2FEpXB{69RzoSXK)!Rbf>TOtR3kor6<e^}_
zO$jTzKs~zvthX`Ah^K!?bwL(3516-yr~&1pFj)9geGg<x!e{DZ2~(y)>T?13*bB}@
z7=tc27t}_a2TXwMeftrVkib+ALxxZXB`rjJ(W?wJUD?T_l;VI+6g1ti@=tRszJEv@
zlS#QbRPfUUBJbX6xX^DkTzFLzISKU$Xt0J$p(vfHEt3g~6lctWZ(;S85VG`Lkx&I7
ziUSaIQt4aD5FC;aYDVvLS~(LM?v(jD21qw7SLa4DdnFRmKnN)fKpISnXll<KWH)f_
zxYB8atg`FM3#Ln0wW39s0azpdyhB~}6{><TCf@l3!R-uhcL1fMO%TQdX}i75F0lJZ
z`&FW4=}`RR66C!=pT_IJFHLiq*W%@1M}Wtbk?R+JA$bD6)2D@en?9j99y}7L?{;vH
z@FIo(l81)$0(6j{88iA^uh^u#XSQemq&ASc<R7-fEF%KK41LA~XrTp?>2O0sc;dY6
zJgY?HRLC@Y3DMJ?dJ?;IypegpKKHDH71!*Ci!G{(m3k4Yw`PQS1u#MtdL~-{sH5hY
zz;1*e!N=Mm$8S2064z^!EZcHhfxb7`1}}}mg)f{@<Rm=D(D<YmJz-rTMg1iE);A|q
z93YRyR7d-bjt#{ufoT5fy47%-Fu?z+i9!QSHh95K5NyuCJ-8w1S)dUbc=)SQ%0^lC
zgi8A4M)IUSXz-BAC5~)M0hkfH-xPH)8>U)=X^7*Si(WpCSf(Adqifi@4P8sWJDHBh
z+-S=B!FSe3faU=ii~0NLvN1j!Qp>p-lD+9_NXq@6rjNw&<xcE<&927RAwC-n^?j&^
zQD@HRd2yq-FUddc;$TTrL4XkEexr4E@yG019HR9gt?MN9x1<F8K_9D`#DAy^t`T;l
z`r8q=KUn&N-*_v12H2_i+c86L#F8RTcrbk-CSOue>l**l%MM#*j*F)&dv4I}RyMpB
z;m_oR?B1Nm>AAbdMswyCwiFv1q4YaEut--xnu|k`E$-q#m-#26iODAyuZ-}|R&nbu
zX4-YNMd_ALrT~m?QY&|ZLtSJD1LLz;P;Ek0bzyIHI%mfuXm_!{*<I#ucGo1`k`8Eh
znZH^2VhOXd3F=@QR#aa6(zTwLxi;+&!n`*+YW`+IWmn^6S9@i#JDCmb8yPPaT6{>J
z4xTivI)%*3;#ztsOdZWYW)gO(#T9klp8yh48OL)<A3s{NMW_i{`gV@s=i0rw85?hI
zMyDF*4CrQTC`)2B^Ro^I5J%L>#`9nk-z|-RO#n~%)XZJ{Zins!8Z>TNW5zpxzSLOX
zq#mv=mgcY=yQ<=7ZEAT)1bcQwjxhmG&KF`?BI&0~xu+;#yP_-_-|Ls~CJB)Lx#MFh
z{I~u~b5^Qyl!&!uxeenmT3s+b?$GGo5-nCMA8`k~RinWzaZ{GvP>AlF5#11HT1CY9
z^q1rjI;BMa7G*Myj89>P=RQ(&+jLlAF=|;^`vj5WRj@V;=X7;DC-CKQ*4@(4FrU+@
zC{L(zhnXPbNu2Sq_c=itaICOR<n1YqSXL4uluZ~t?;5o3N&7>Wyd{|@?%+9z6Xk<9
zg!r^}=dC>wI7xox3j!Zv+0N6kxKUIFd&imr{<iH~%fs4RxZ2cem%x^XHPHNd34AJz
ze*#+`E_7eiTLt&=t)~V{wyLec>|+gjq~^5Nd=iT{7}dZ?Q2Z%ORjEe>#+n?7D9S*a
zPMu3RL1!8co?{W+ATG8jx6zM95%@VMj=d}J&Ly9Mp%H8HXB0Q>UtgWX1TyrxFc&=z
zdFh9YM`O>^Z=>$^A3E_+Y(BdO6;-la3v^>6cZSfX)=d)?G@sQh`z&sJ{_|d8%9p)t
z&=_x^+Mph|W@lR=HyC<~F0V-~PqSb+o1(f~H23qAe^X(}Zz`;2km@(6!n8pZHV6JH
zw){<nZCPT=zm_R+l~V92tbi&^x$dpxr(DODYvYk;Bg8VbSZ2WG0@nI2z*-;kr)`_w
zqmr=YW3xFO6@mdB#DSE0j{ep3&Q-vFIJ(ua)qeuMQfr5@`XT*CV!AoQc@@?El9u1q
z+amT;z(q{d4F-aX_@^^y+_{oh-&7rO_0~>8>{Z+dv5yZ-4OVVFy~P$78oUHcS!)V`
z{cAV<Yj%6)l9XZu%vm8>))5`63K+I4k?nQO8cYawd=_CVd)ZCEEhgfLE?W(CJRigb
zClkY$lk7d3)5!)Oigz$9JMZhtQ2GJuLMcO>uNz91GjbkFA)K4pVSX<^pZaF+8y&1Q
z^Aq(DBtmG0m;+Y5>03e*dDWRbq!?3v=gozDdkRGyTd|_kB^zQy`DAV7mEtx5g-(9t
zg^KhmMHZ$wE6xxKKw=-mS-^#21idXJRnXh|@ZI@QQ#}HS-K2pGN&<FK6!yXYK93Vt
z+nQ*W1)>PoxDIk3<N*-LZ#>{9KD@92+D}Q++xd%8d+Xa9bnyBJdUAp<YQ5vNlCbWv
zc6`SuP!Tgi(uG2jJBJki#nW4dMb-6f!ypY3(%mW2NQZ=Us&q?tOS3^hx;v!1L%O6>
zkOt`(y1RMzT=(;R|Ifj}-fL#9^LN%lgv4At$M`J5U_y{S@^dnTT>!={*n3aNCDfGC
zfvx)}!Lp{z4G=+AcU`1t;evm@X{8+yS;qYk7-Sj^?N2=HaC!&F7~8}|)G1cS>WGG;
zUMVcw6ahZl%?;78@Kd5oYfDaT78bL_QaJ7t7FcXh^RWIjhzZ&>7cN2NOdnLv&Zsx~
z)HnL}FXVr^*Zc#pi>w1xnMa~<`oYsUkV85%?^8FQcz2UV_iZUJulXeh=joUC32ba8
z;r&Cq4@TjHDyM?d{%2T|l<e{s-HbuGTQ|7*)vq>~Q58}oJtq)CF8>;zww@A_T1Gsm
z;>g%fQ%*uz?R+S!EmKw7$51Af53<_S!jhg9lAbfbPI9u8r``__=pMQa?xBGmQ0}9<
zjibBG(=hYkVK(wl$k1^Go#YBH(L&%5lErV0-_Hk99-GuXN}wZXQar&tBSO&c{B4QP
z)3HB6Tl39v1;qQ>W<C_{+t~Xnp?hRx)D^|>0M}oSuc})5U>VzX8Qlf>y{)akq)@~m
z0C{M70}Z5S`R|sm{<%i!wV)qM)e_%&IbuPOuN$BHwO_^F9deyi*s^qr&&_fhW`49i
z;GKOqTzGU(SqO}YiT~+LgMht@JwgRKQrO(=7LVZ$i-YVy4Lw?ZUspgQ(+iD~UEuLQ
z+ev#6OJDERV8M8m+5fpmPzHcrDu<4ykGmse^`w;kbJHHQ?FpI>xxX&;gbbVnZag+)
z_)&Csljp)Qhr3C}gNlBhUi-^n$3AF&A97C!D1L$+@)Y;IwqYbydmadK_I|vMVljgI
zB`u=)JSTlV(c+51MixV$!tsJZNOcqFRZTkOgXPxe^lF<!)R2A&&)^aeJy9>IRV_9(
z3n_#kCDpx7cs9j_Y5BI7fAV~H7sN+p_k#H@+bZvowIfK{LWH3w-$}BzG2<orvetON
ztWQkH+wHjzzx@3Ky#})}ALZ1#A7RhB^YQVj?g&-&ZkA3|Pn&n78(9Glc!OpReQ?e9
z%OP|$azbaB6Ng_7q)sk?q|&Uqb`CDx{coO10>3oL#NuJjL5deYZxfL=hqdkz=Ap^v
zQkMMhPrUUkIQkv$T5zUv9KRu^AKy76qoD$=x}2*>j!HxSoEl(p<Ob}Ah3lJtd>8L`
z3$^jtMj!0?S>HzUe0`mC=daAT@V5f<jdUo)rUAAyL^)?^74I2zSQdDzWvN^6Q&z&E
z6eR6y1W5I8xiTTqTL}}?dCu?RT()Y4&-h<nP@w$PuWajINPUM5h=zoPlKYs>iJ*B-
zs6LB{sl_x_?r_9np#Gxz6tPrzR}^P$wU~;rHHePOv?H<==65OAyLd8&6e(zC?@j$j
z@EP9b+$Nwb!Zv0O=odvC-}C&C>|cL5((3acm~wt5om+r~d0j12`8Qa(--TzyUeN1Q
z{$8b2p`|r7iv0InGyKjN-DK>WJqmlFn-$K~9STr%UJv*j#Uaa^^z|iLU;3R!M-)>o
z?k0VQTm;GE+Z+&c8qk4f<Vl$%q_3=;xKoZ6;%`8A3Y1AQcglUqGRS;V+Zc+;w_c_F
z#Tn7`bUL`Z#v4l3pL9#lA;d}T%+@dmMV_n^t!tz_6RRPr!FZB9y{w3tq$)CAc#5OM
z?#8g8b%^>l^NEAbpY9dEeqW`vx}!fET8=>@=)k}2HIG86LpK20kH@j%spXYs1n-i%
z$Fcf>q5P*TswU@mOw%_f)3KUgOKaH+y)cC-Nw(kudu2%(HO5L3Y{CchAU?9q$e5B(
z3!i68Z}!HFx&5MFGqLTQmRe`tw{{~u`ZB_W;#5eh4Jk;Cm%ke&>x10HvYkN*^Wqxn
zQHo-Zr=h&E#QL_5uPbr<u<fRE=Tgon>BqozznL&5#^q!;e-v82<UfYa;3`-+&V6R$
z^p0n@$AI2d*)_Wmj>yNlO>75F$*azeH#D)zo9S#OnM8|zkM~kd2d4tw`iyGkx>8%@
zkt3%h#TiLMZxUW@AmgrYLTW%@IV7J?3lrp<O&@zs_YzDnDc{zUxt%nfYVMKIvkGLx
zJ$@A#;f&Ue3>mV2yH{ZE{DKT?e;@4E2=Q~v)jC&9gK3LLgslP*G>kropyApQlM!mI
z;M+hXy7uw+qTFvCA72mFHJ|SDI%^XRW}zV8Zxf5&!8HYg$5=ylh8YU-L&vy7cD5!O
zw+0?IL*-tyt<9)}sSc$pL4{oXK#p)~L)Ia_mFK2HV?t{O?ftUgln)0rn(fxN>ef>(
zVvL=T=72Ie(OA6>nAXc~L24#?yqmzwa|&Gels$@9qe*b1C1$2vwyzA8NZ?bTE;e>B
z+kt7Q-rx(m*x12nhhHd6T_Q{!6pHz2SticBcPYWs8JK{8&KH+dfM#5asU?G|r5r);
zInm=dM;3yu9XZp}W7BCjH?0+mQe>6oEll;BTgmJQDTVGnDz#2KSRfrexoj2z!_|I8
z%X>#<O+efnY3t7p=E)3Aih9}5FYUyyC*qGt@h4%)2tRddT{{Gh1DqL0Kh{va)-t{i
zF0X-<I~Hn%jiwn!f_kr39{6snrNDP<9GQr&1{xdtK@Q+OwY3eM^?&rmdl4hC>GvDO
zc=`hp7su>8um7Y&&37B_-+OEDH*S+Ed8b=kdj-bxqV_6}q+dPkD};22CA;~Z>w7q?
z#8ZbWsY%>5h+kS{Wc;EKR#$r@a3~Opw(4|Ix2ur{AffxJDEac>MP!b4AH5elZF5Ca
z9uH=<Lq#7S7W>3}8<>hQBquZ&H-^t2*M7EMb;k=?ZAUI;kdu?ftotc^nr9ae_uXBx
zKphzH-sYn`nQoXQFco+OX56b|yO~tbO;hPI``PQwb<fgYLsE}^XKnWqHh5p0(*<7C
zKc<ub=;Vaa?}lL0P>)bu(<n|i*-J&1teSQB9fmxuk!JhNYM3eeb4DLy+Uhgfep)D;
z$I}lk$_8vfk>MZ|8OAmae@iPT9@6<lF0%rDDy|KLr<w9AnRVp5#NVgnYQPy2WY&H@
zgX4pC*qYLtu6CI3;d9Mf%wFCO!WTedUE>sWy3&m3U5EI!Sw_aU$aaW@_fr(GUb*p-
zz!Jm1cSSJv@|n|^1*3RSlzNS*K9%96EoV&QF4=TZJ!B<mI=;Cm$!*&I@)LD*QeACZ
z{Zf-qOmkgtGy0W}g+BeHw(7z(Pm{BMUf+v}l3|x$&%tdx-E+;AU0&x&syR?WZn|ni
z5U0(8aSuEWP!K2;=q>hh@z@&tM^A1xe^MY1m{nV1)Xd9v*zoB1Lh{%I8Q8$p*=wB+
zh#Vm6aoqBc{hc>bg+iE|xAnovhYFSg4%W<9W?oxqUg<sljU`Ut(J!&?LU02PRD{wZ
zI;PeN>XCsgAT44eGY@FX&Vxh$6;=awS*NvyB6CMnUOkA!ELfllwZ+lv32k8u+XJLy
z0sRazxz#r!a8Gkc>#x?EFvjO4Y)>Pxe6gxBnt$SHd4P@@UP4aZ&8>2{(W8ZE@hA4<
zPLU7WYt}>3+pmOtu5Bs=N%tbZd;@*7tMX?k@N{qS9+~6-;n%5?Q!7TC9(5N}5Crbb
z!w4taG1q~CtpR%&w_Epuk%ZO_{V&wIX}Anu?vPSxwUrn}N3Kg9nx{2C_eP!|K2zoU
zfFX}ZX!Xx)BGRp<m*|R%#E&^^jDPu3m5EPHGo=kZo8%t$J})7~jzklL(H0g`jo)wK
z_1=%%?xF+8<9CPElqVZlH2q+saY_u=?YmNJWf%6Tq^2VKllk*9C+Qw(!=ZMT_3f4w
z7T5As_-VDY&vHpC3yiUXNL4s>fXlS=Qn3Du19$Uhns;w`>86YlGYiK<^B2CJs&OI2
zV)G7N1_9JR65P0zbw|8;E+Q1pe@LSCf4L(MMa2P_)X9sLNj3H+W6whjdPct;HI2Ep
z3^ccVqFr3|cbIxl>!r^=K}(;~w$huH&ZrH!n|d8}b7Wr$!CL#^JmQ#=oED+W@VTD2
zoXa=uqHrQC+Oq3&l~9`+WNL^FR$fJC-84N_r<eX-u-}q}gT6OES|r+~^-Ak7m87Xw
zskRVk(B<qQ*<C?3Tog$hf2HX$?Q|P{3#XhH_5hg@eJuQYZjWkCJnb;s%NtaO*vYgT
zq}s!a0Pa-}g(@EPOlAG{sInewya?bYhwV{8uHGE@TpVQOa%3E!UP<;cU)?i*YAm6i
zS=3V-jb0@2IIl7?fXIK<OL!c0uGy6(3bZAsvp`x7T>;%e3locDI$YI`;nU6Uj%n_&
zjTf8Zt}`ccX1S<Jl^GQ!S*&61+CiB3T3bnQf1PETFSE%`G09F}x*yl&tnZL3X}BX-
zt&}Eng^x?PdDRkFtLlN*nOq?-gNu_@oG{GQ#XcRnoSm~6AK(?MyWd`}$8-Gr1Dr38
zkw3<XB)pA3wkym-!m5AoukJ)8!!2?5pP%kGp{RbHpZM0_jMOl@cMu3Cag<cB1l%(c
zeS06d6Dx`-URv`qoY5nlmLXym1__LjhkcHZe>JwzAx8Hl`XPFtT4RLC401O}31I!8
zERUo-M7bDI(rU=E@ppUey$1p2ZBOe*=CQmXpl1-l0P%a3K$phg(%rkBWx~sJ@a|^>
zE-1gx4D$O-DUNAP2Ni{e%03wTH&uyWWIE^CZN@#ma(P>Q7A(@(=tO8;EVI!Dx<#&%
zzq%tl{Qdmua4!6z1LsuT!bp9>gVw2p0=qd0hhM@ti$oENKTnLh2mtp5Nhlc@qHD?w
z%G;747f9<Qv!yM&1#Sz1*v)$CaC$w?+Bx4y$HD2S*BKgl*=T;V(VX1l928Ykl|CF9
zb||by1ZjO;lHn+@&zQ*k<>lT;_gkI=(}mn2uE>H>UbP)u^=N(E!u4_}de>J2TQIO8
zzNc>T;~z{apu7NHHRfhm!|3F;eJ)(jU+clL^~Q;4SqR_e;lpXlJ(ar+zdNa=I(Z)b
z@6BSdQ>Ybr4QfUHZEPy>MLlv2v?9YtBa`c(kb`=B{r3Smw9LvgDX3|Y1hgWb_k*TI
zd5=v(4`Y@#4sHUYb$mqOT-d-cPY8*@z(*e7XQ{`zPmsd|A6X*>tCh<W#AzNG)#c3%
z?fIz=9|}e1h%zVU<u|yA*<R7g-MpQD4YvcG@@yhjl@e?n6Rpl?!JCM)sHCrGvP4%~
z5&;hzTQLUelMkZj#{ncYHG9}g$OKX4|IXo}5i8$Sk%sMe7-8sW`LjJEU}ioH<}+^q
z-;AZ~LMtWg=E>?c)<l~eeh0*Sp0)AZEn@hs>TX3JvpluQHQP3&8M-m&^@;dw8cW{k
zT+*YT#$3jy_ALEMYDi$kfG@v_;V042pTd`+w|vU*39X6(|6s{>7^3avnn(l~JT1hk
z`!%Bz2xBdmhv{l_E4b03t+l57Jn-u)fK|<t(8nxNvLLtfzF+T!vEC?fvqTc8o`@TD
z!)4-k6b{G|R$bpBToux&2#3W;?wV~jyLd2ke{RVfXlkbWE`vWHKO7#&{Eo-E-6-=!
zU;`_Vs6XPY3DV)Eb3BlSchiJ2CSn&;2Nn3t=RhW4Oy5J1zD#N?6ZD#X+d2d)who~R
zpVM`i^-HCgYsH!X#tgV_;#W{rKj$7k$MZ<V=RkrU>0mae0ciTwD3Y>JMN*+0Hp-{=
zvc-%#(c&nuhp#<8b4%bb6RA0+vmm7w;e8%)wAZYqhmSNhGn}$QSSE2{VneEAmbbTV
zV)+g;xM=&_#Y|zGeiIKEXBH)`RPW(3{$>$jw%IeZ>*66(H1%04W^D8fJFY8!a})5e
zzk}T>`P4u@G#hG@shc(_yGDAx@&L&B@vomSn{=!0g`?0dd_oof;YJ5pYy$({_2b_i
z7JY$iQaPGFvEADY(?U28`hcuvWtUoW&>;m@UDXYrs$xZ(uL4F(ib<k6)4^Mum@y2a
zSA&RrLU(%`1ma>uYwzfMKL|hb+3Jp<P%=lFiuZ=h<jJVjx$wSriHIvuxD1m$;u3Xf
zu;qu(uuw;ir>9)Y7ej{rKCo24-v_0k=>Zru#A0W{4D>^W)j@#;e;=+Neov~&&8cLo
zdy`4~gSZG#HH;D}DqwU7W30x<bx&P-U2=bS!4g}Q4zCn$!>{(V<%KGn?I>U?it_IB
z?e$JVi8Gh`XuFHxt^K>ABKKBV3KivYE;#EyAOt#Ci8^&Zy{T;1b6zt^EJpeunQ7!9
zv_+KUh~|DD{G}A~#j2D;y+~1|#4_Lu)a6l}&;a;9sg?{UMU)eld;t+$L5y5|oZNp1
zt|0R(ha0+_Wx<>yBUCSv1N9<x)B-c)0xSPd8eh?{4(+&TkYKWwRI*a5=Mf0}6Cro7
zS~bCp$43WJYIW3b%4%|V=i*;XGsgZ!muB7&a>G<dB###5E|`pVAYf&(jmp!^{sGqY
zNBdycbwW1L({<GWN8$KU*|qzP<q@`L*V_V7N)erws8oaBey_TILhv#uy6!AUER>ue
zOKn3Qf*;fv8JI6W8}S&={VJYyiCx+@j992RiuKark^RN7^~i>u@s{QzDL>rUR!=P1
z<5UJ=&)8inEX!-5md7;q@4WjLOf*2{!){U19n~8f{x=zx>Zo<}A#3Gg)X-Iwgsx(U
zp=kiPijv?e(tekL*O7$>S8<%~dn=nlOFv3I=Mf(RG%t$c43gu+D9SN7$B{Tr=IFhF
zABTywd`gvm%r<NpIN&_T3K1zXfokT6ka<m}78NOcG|97^$9EJUtL}9UiM$68^#lBI
zfZAqC@-{#1E7gFxb-As3fK?>$^<5g;&ObikI}vuHZKe-$#RY*UmT#DZwrEuh*%g__
z;P@%0aEXDNzwD&m+FzL#C_hO0xt|V!sl2=Ag#UAA#GT~tbb916E&tDCIDz(m&WuD}
zU}D$7;`a+BVs0Nfw|zc_bgSURJ1V6#m=Ff^SI{H_Ob94{AYn15$ALp<2sm_te|}!h
z4@@$6$oduQ)w)DdSb>gI-=?1V7>aE$v7JDXNiA9)MB!WgSQYIZ|C9s4LT+qcfv0xB
zgZPgGX=KSNe6wd+IQYgc#KL(4e6dZa;-n4k-?MxeTF1HS)HieY^*sZbD^{{~y<0dm
zi@sg^<Y(ntgU)mu3E}5iJ$svQ0e>No>Kd!1`uxLLUU$HEEB5{D=&uIr%;lT0mUfy<
z2!I}hrGZ%MF@ButQxi1uQNshdc@K+lPG#?}4oUXHo!JG^A;IzRZNLs7avL*Ae=z9Y
z6?8YWcn`ZJ#WYy?=C9usm2a9;%%;Ezhx0rt`Gs|J+wk@_Xd`FizZv;+k#n6GTrrX<
zR8+{v#`cH4Kja@p%oiOvr;derPAaU&3z`d`JM+q2!5yyR!i*n*+>q!6zZYYoeRe{7
zSPR)pm|T0K?O=;)h{Y-JrA~m)_7!?2PYB`_=vF|t0^JJ4<u=U2rEk#bA^sLv6Nbza
zhETVHg+uUr*}3d&^%Sz;@8H&v1MVE-aye^6;$7O=YXf}cK34c~;O(#TNJ7>8nn@E#
z5p(Fs<6#jZYFrRBbl4n6&spCOO+9s|*eLIl<hLKnD*o8Q1F~Cj%??@cc+Sp51XIoX
z^JkW?IT*4IkupEQYHB8B`>gQsb1Qb4$6;e2n}@)?a(C#OS}k<KzBu;2?rH1gpH$pB
zlBw5HS%s+8|I78qo4%NRMOXO+@AYXk+Rp!iS=+L$Gkw?2nR#i>i&@2{28cFCSr_W@
zIuoC<Wz2#1QIHZVMLwliRX%Cmw=xai2OgcoNuS!_SMJ7x4)R-D7x^||Vz$`vOD3W(
z<SCTqlHe8!);sr~9}}%de$7zq!gUIQ2`}lBUL(e)4pEa;9&Xk$UE8i@%8S#8wusfd
zt%9~}&|D0+ccF>3)2k}v;IW>k5X&GOlUkN_p$jymSpmc2*QDm2KXh5CchKg<QpQVY
zrbI`)$1an|(vO|cKvR{lNt#C%;Ft4wAm8PQsqQ5U6V-Z9=Z1#jK7w+aYR2R}3lA%5
z9peW*WnrPG>??f_4lwoh3Or@89cb4oXxE^JEcR&{{<2=)x^~yMj31zlCVyQE@W@0T
zvAA8pvUF$Req0rDYo&T|lNUzaFzYqu$$LJy4*IieV6jX$t<=$s<w{~6dSff7>K2<j
zH&PQH5r^wM_!1^?E_Nv)PVY}cxBgFM+<ZIZWrvu%wdfTOUYF^l1T&+;v{S;+W8CO_
z8ZX@#EBX~5)^BkaWNQReeD|RUfLrCzLdHQ?>E*U+LMuJ{vJ33@GeMc-l=gKd!(KD}
zrlUq(`)B4nUV1Gw*gN)rDLGvYn>6PO=4BP=9??GigFR&EArPE&Rh<3Ty3KIIt){*o
zGLFDxMa)n7$~dv+YNkuHKaVkC_32?}8W#St-aIybVUYH`>yLeMV5|oZm;!S>Z`GIW
z;?!vH<cHx(2tU>Ee5!%wdJ4X(9bQCHv9(XPM7Dh+BB8D#^&l=79Qm-NhIW4MHjjHh
z>#CkKltD+M;kOW~`y;)I#GB|NVn(U=IV5mxgpcbVX2<3JirgcffW?sWTG7XCSvMBI
z8fneE{!i1-k{v|3o&XDAR8*+c{hcF+d!Js~lMQlzH#4Uui`7ni`caxt?9TR_4xi*l
z$J22YZ+~kM0T){qud~RlsG=ttN5N*5b)^89bpfVsiD+0HoU1|zGTp<+Ubb>Sk-q~9
zur&Vn(~FX=fe(*@H?R(?!&kG^{ygoDjsD0a)e#g#&s6H3?Fhet^J7Lzf$d)Q7@!HE
zn82FnQ!7{oqBm0VGpA-hlD_!o1Z6!`Ke2-9C)1U+6QF)#1?nfC1oOXD<bQ*Ht3I{v
zhlf|z2v!^lj2(kgU~MZjC$zAPyr9Q&sC3qY^*M5&7*n5s+*zN$g#=H_vGjO|7dKaM
z(`MS&1xTK_#tdti>xA{P<;Q+=2YdC(&2(~r{IHk|yp*=7(_OLC6pjB_B08B-o<SIs
zq$EW-&7NA}A=UA*mT!$ZG%Uns>IAYZ`&p_BZ?iq0;9X3p67Eimiy)OQoLj{Jy0eBb
zEX+j!%kbL=kIm;~6`MAKOJ>2#K3qI{3zYVK1pr#S6ZIN)wC}w`2kuJt??}4<ifVKY
zg}o>wG8NdjRlZo6M8&%&C-4a&|4Us<w`U739j}}>PB(aOJ8wzN>4qK4A-Fn(AqILX
z+!ep}uo736icguYr4Vyckv;5c+;$TcRUKO6?|Hq;S)Js2hs8z)&Y~<0g&@h^0JLqY
zn+Ay(CM8vxS+3)Mh}9CcdbJWs9Owq6GEYFp9CJmD=K&lcPrwn<J@~XT@f3^{oa?%4
zcz8^_|5k*j*V`DORND$t<%Vwk6YRC@#%0*YzbqlF{%m|rGMBtx`Hc`__p0Tuh556w
zq8WLtc^+0YRT6Ek+xZUkLjf=?b!ZoHcucpjd{Fppllnq&M&Qm$+{!#7Qc(VAAL447
z9T~V}Xa4v42j<3~I`(uIr83Ogv)ZR_vXWOQ-CA>KoUJM}TlF;pN^PJ4{<^N20Go|g
zfAypO*XQeZoIeH>v8o&cdZFR-5NP=PP1P`cd^vF_7(SP2i*X0)<J_ToGQGZ@nVxoz
zYlbU0Wt!-LK8A$aN|f5l7OiBLA9y1tfAKb5C8}g&5sFH)yalN)ImhUKe%EhCjebyA
zY#+zH2|unjxGWKrpz78Qd_xJGvVmN?iHT79M&ZOLCU0azMz<oj*?m3=Dz9ZsH`J;W
zGzD&xs2ae+k9akjAn=#ZMEa>o{ZkXDOQPdex>WpqPg<0yKhPKn60S=;X*A=OOi}67
zQDr0pL#{-}gn#x8Ou9>~2-3#l*!(l%(_=7lwP<#9EzEZKMomVa!bI{=yoAgZW6$3F
zB!?Cn{pg3IwmKEiRo8tP?+cEZ(05+fB{82;0*smhb318$z3dVibulYRMnbt_F+xTm
zX}O<kdFDHqNZZaExKP7Z(8_<CIoGqDL8>j|L|8HI^+r^%iWqLeJ~7>Z6bEyVRSqnH
z1X`BX2o)(}6<P)a%7QN(IUf4L3x~Hu%ZX7wgD*TKhP^(H9s0g06@tth<_6;cbt^Ik
zdGItJ`V=K(USMMR!(=aLFiumQ{=BQ*$*oE&ma6D&j<+n8Ip>&}-j)JWJreSlx~aLd
zGrWswg>bBy!TROJ0a1q+;uj2__Gad<2pugqEH!M$uzYyC4aw(!L)rMW`345ogG*i{
zwjH}RCF?(^x&QRg6QJIqj%Y&y#xI8p8%1(zP288$MB+#gE1GXc1p~z!DbdrHwf*aV
zpyljHe=4us2`~BDM-Jn%tQt(%(-!-kbiT2m{e7yecdSj^P0xAGd(muv2-0laziS#T
zu6@lhmi)3y3kL#llAaZIUMp<Dp!o|y;vH7@_(HzNVh(3jznsUJx2H@1bm|U#pRuP>
zWA!rk@Wm=y&(NGLHNX3MW05=d?Dr01<zIwAc!1cUi<^XfRcEcVsM_t^da`ff&*;T;
zm2^}2l5K!DdU1`!qGV@cz&f43u}iNu$RIx1cQ0NvcHQsRAL&~Coc8h&lXk+^R<G^C
zVPd@UJmfm*Z;i-6);h~D@EXm`%ZeY%{)E9wR3(}P;{%BcLeFn+x;_!RUG1gw`HvH3
zWxtmZbJBBNzO*?Raf^F=E$ZVFmg@LdLI<C!#H@R35}r?_@-J|wTMLn&i9-_B<Dmz6
z;KasLK6_GnJ6szT$EvqU@EE4aEA6{4!Gl|WP`O&+JmpMcF<VAq5zt4mYEh2~q~RDB
z?>3a5!Hp6+Z*(D^=}#xG;u!M@5yu(Vhrtq+WMn?x)8Em%Uzlbd4?}gQBlymV=XACU
z$@<O?6cXPHQ}X8$Qu-GL5sW9rEjrnReNFnWrag@r)8YCW-ufts;pPNC7BU&SP~1FQ
zGhMCur|FqTewZHsnI47puTLdD+y_&<(tf5gEQCd<qZff6C4R)p28SSuS5VPV;sfL=
zubfyE9uy5JUV)!x7KH~j!~F*=m42p{YpoBUo$usj#mJ`VMG)%B&O%T+t^2T?g#hDh
zm=-5a77@X(b|p?j{8MRMN#KgZk6F-+NwqcsdH4>9la*^4<&c)ua7ws!Xl4H>D>s^w
zYXa|Bej%;}D8rH{bK^hB;yfPbi}^y0bB|E2>{ib-9?U;If?U~_+u(`z&<V(uy+0K^
zn#{GHR$^|B`V4NzKc>O_QBlG4F>c8++NajJqc$&XleQ8$1_On`gNVAR%JY`7Z3e)f
zLx@cng~G?j1w9OZhkl*%^s0c~1N*pplvb9BWNP8vsyy5OiLU~#r_P)9TiZ4|b$)5w
z*=ie(ZK!`;OF6zPr^DzKp?_zEj!SybajE6)q8vCb>4D?YuK3>>xxZ?lTa3WPmB`W3
zbk?yKI!-%+>AiAXN8l&bMk#{hPXk}dB<JzR-z|w$hj*R?-T$07k6ouK>!{J7(#SXQ
zf2J8f>$AQkT6uHTycuUX`E-OwdyM7%c1f}%Q0z;c7bD60JY(6Af+Y2ucjod^i@}>q
zRFBkGrIKtPUp9Y4bDD=&Zj~rvYsq~oN<;%|%jUnY>P(CJ`U8CB)s5ApgBNfYdJmbY
zp^97LyA-<;d(|Ih4I+f-162`H<<P7mSY-y;JMNs%c2vDhD91DHVTx1)wWx&zC^y*5
zo=*uAL!u<j+Z&IG3;Vvro;u7YVd>V=Ili;Ml@=B7M~KcV^>o-(ZNuHJU2@et4xtz?
zd&_#hQ1>LZZ2@?C)m33n?fNsi%W<}(2*9@%ghMLj_-MxS*AVwlxdNKT$o{#G{cZW~
zPPY?orf^H+5Nc;e$FGUXwM;p4#4{s2RsJxRmfd2G{z(sf|Jg0z`<HfQu0jEQbFQHJ
zSQ`GNG4V?y^vEuK$gek_gQ)_!7fhL!o_TgkODP~TZ@n7+H0p;0d|N$?eyr?>v9+1@
zeu9L}2r%QoTNZdenSVT#jN83D!G30C%dq4#zInAg{OCx5Tao-BdPyhY@z&P3mHdL(
z&Cy#K4nLSPfpWr0#@_MtWST2<$OfMs`LK!a7CBt>>bLUm!rypj_BuPvTFnhZZPP@m
zOSFLc?^!H3_Pq#XMcq?us)&|0O6OXT!Fr!X_U?EUxoXNLr3(y-;iFlwBHB&lMC&{U
zULoDVZF%!>bUgcEy;0?O?6M#^&=H@0600?*Tv9#;Y<^auU%q?E+;OYnIKwNY_^^oi
zztr5LBR{WV^xaz-^#muB9O9iJ!V(Wape)Yyqy0JS_-E!TC&>1;UZ&egU9$DR@lLK#
zSev=^L`&62XET?Vj6DZ;Nv49yGu=JRTq&eI9;7{bq&@r|xKK_HHzw6YCvN4!61lw1
zP>0Oed;zSXy2tikM&$Xi=4Kn{L6)tYxsnXKQ5#N14m(x3(mm_XjvkdCTN!i#efo%>
zjvlgb58V)DP1B*$H^~eT|0YsL4>ZTS&)dm68|OP!+pT?L@+J$G-#Vt|V}9;{Ougw2
zV(o?Y{2ivwLm4s2{4$}0)B39u-x;R1S^+{L*V6qV0{q+yRlA0}q?`-oW5h}6RPpxE
zaZ;SiR8hEY#0q{djjl|`4ud5C`{A)Casv|@CpbAS8q3?AoJ0s}$ncv#%v_M(;-pN<
zlJ$O-9@AsHl|6MlOEA}|sE_$ReT&B6ZO6q@z5B3HkAUt_YuCqap_NawaOYz_l-9d?
zDLCQwHUvy5DNOY6Qps-370wzmzUsfIPP#89t)4cPJA&n^bQiTn!ZLu*LI^m6y^XUv
z=?4iBIWZddG&;|<XG6-<wf0N)D46>%CTpuYAyIdWLIj+J9l|On*Pe=<SGaD=tIi^i
zS%+s#RFnx0Xq59ZmEH<{T?DnJNU7<V1V|e>A>CZX@80YA#^{s{8cS}gB2;WAT#3Y|
zs4zbD@S(FvC;Tw0`N|FWGe#o5DF794N;yzfl1NCb(9(KOJq-GDRjG4r=yIV7IDx8&
z<;?W^w<UN6MG`!R+&r%rVra%ynG#8<63c_+&fVEL5?>2f%Me0NUE_yTV_BdeQJE^0
z6kYm=AzpWVbLoUPdQFqjMP%P{Dzl9ZZdq~}k{b9cqZ}6SMDi^R?nv<!fff4RA=Pub
z6W5ELz^H*8qgAHwF+KYXvxE?IbD#?>0JKjgVvMVDtm~#xo7O9;BW7kpA9JyAJ5QJX
z6#i;^hoDqLucIn6Cd?o)h(~dd3Y{WGK}(cEu3xo(J^mY`p)-!V!*?HrUSY#D)rrOU
zli(w8O9OVoEzJk)uCFa=+8W|;{FNyw;Rs|zu6avLMZ+#LOEhTXhDI@mOh$&bWa<ow
z-iy&oqsPgD8x3VVbfckX)~TztqKyYP`cz5I1vyTzoza6e)qA6~#M<T)^Y5s-A@C%!
z;e>kJdHAJx?yzmn&%-uD0b|x?Cm*!EEuaY+S7ZN`XW-LtG2yWEQGls_1@)0&Bi?gW
zmW+eRDf$Z;smBY#HI4B4);AAVQ53Q*)~aLkr@SEJIzP?yhaoAEc`U>Ry`{^kp92;!
zHNws@mO|{RiZmJAq8wkQxeBCT`j@~ympJ}r)8l$b`O-n+PGwcapZYe9;fhZ;KzwJB
zKc0;uOu4Fxw$?%{%XpWa?_4trD?#QV=Ah0lBj$M;Q~$u4@O7P1oH(#mAmjp5rDXYy
z@`>h!kZHF3And($#n(TXC7N|SZ)eMEzn0YDeW`bKZ^HXH6GrS_iVqaEwKp^(2_O~$
zA*(u3s{?88@0w5^MeMLTp==4@3#CgQ^*x$FQQ{G#OE%nkPbzv(z`^$Z)C&cFm)LJE
zta=m17c`gpje`wgxWARLes{wAy)fyIKAm1a9bCT#TaKK;nU(;r_GZFi()W6-abb{b
z_RZSxveC;=BsOH-+Mt>T*c3v+KI-4ua1Uq#*=AfLnTh_2#<Zcp83KC;%#RO84*l##
zfw&d#=oJlnWdjIRLHN#|3&MA!-r=O8a$=6JU=75ZH#7~{G++%xX84<|#_m00`RQS>
zA>I-E-{eQ3#S3&wv2-2q@{heqZdK`&O5ulmYMWbvs3;p2e72%u3O<Es|MQ79Aj38c
zn)A|rPXnk(1ERbt^*G?X!n-4_s43d~VLL5<mvHtv4Bv$-U!Y%ke?!MnU|U`mxf3*6
zb48k3M{jRm5io4KW)<m5^``iPt~XADG*|%UpvUU#zplO$J@xv!3wOS)*jZKE^Y=gn
z9k;s1Bm?F(uF42api+1$g#b%K29MHv>u5`yUyi^(O516WU-(xH@(aIeY7^g<N&QPn
zK$?`wkF3a#1eYN#13z3{La!%WyUUf74V=b$!=WzsjXt7{K7y|B6ulA|BpNg&wf4VG
z{fw|ZS`YkrGDeJfK?eD`K|S$*^8+?M7t=hlfS1%Y_~=KPU|l-QnP(6dt%_97H~5tR
zj<V#eiF3WY#KDfLUQe){9~Zc0OErE`=q+6RRIsL%zJYsRCF+3-b9#k$ku-|3%hH<k
zof3q|fLFhRJ2!2oawCv&eBc+6u$cVzsg<9Ip6e|g+AbF}-3Uf4%R%tu`qMmKrW!5S
zLmM}g6hD+|w!mrqU15xv7TQDmfgXSs(JH7nSewqsKznF8LrrQEO~4-7b6w86{HxD%
zxA`Dk*og-xv^x`M&BNUm%K1?8W_*^<cKi9#2?MmG(;Y17baCPq+9Uk=DA}%q_z>7!
z8BZ>R^n|e?%eLi&{Y6T3@7!PSfwF*S)Wi#=aN|#kj-#*smC`E#KqQ0(Q22gY5;~1n
zqq`lfSqafRmNc%&;`WCq5%)TQ|D+!T%0i5&@$7=lq7aaUcn5weQ4?e#KA|Ns>+!in
zj#xtG99h9mh?o&*Cq%-?PwHeZCRW}^5ft5OnCz|tdY7V)h(AlepPL2++HngV;pU`o
z`@Uey`Pcy<%Y{(i!;s^=W_J(YDK4VFga22b&qkj0`gUb|$qrVyHHRK0u$6E@^7!i`
zF*%_s539Bv1<_&d!$!BNn$=53guivmB1!sH;Ai9hR1SeGV)3lUOu`;2K3?@pyNp~n
z<H(iBt1-e95Betw`b8&tuTrg&pFCYA$|NSWo<_j*ZxiSe45{<1gH^yL;1bY>D>Ni3
zG=Pr>7w_}@sm8ikoq0AY?;p647V|(|F~!%fRgXq;w9j0T#cZSKrPMP^{c>C*N!o+W
z$>8dn4J12hJ}r6>jIe&6Hm{u$HyADC4M<*_T=MOlC0p0k{fJStQ6&?ku(2uPI0__B
z9eMMcr`3;Z;hbKSi`|xhL&oW6aL8CQH?0GW;HO-mewT$Ts)Hg5)wh3-o3nMcNQpxG
zU!FkaM@F>noco9A<rE?HllPl@lu#o5dSff88}T02949dL+vaRSt6zV#^>Z&~B74hr
zC}VSlD;j<_4N|8NuYGO&0Hm0_>9dBBuH4i3wi}-MHi#<pzvjVMD*pwRxa9v1F%ur*
zCNyfYKmVOy%kLG~X#E7Obuh3X)r_=q42|T=ORl(+GdW4SMPLLn>uakj8PH5XxZht5
z`z872dWoPETHH_!EpAZJa}5UrN5$aaB<UKm|1V@8$Yk%FPPCzKciJTkoRTkJ#Igg6
zLjy;^;!xD}*I@hxX5CwJN#6uVSGdED)f^XO5Alb2ah;lDW19|Gww)lJt8`zIhvvOh
zl_w82H&>qWl|{72D*g=K|L1dW*z}RxaS_>I@v<?VqKi0;ij5pN_9#-qq}Ziti_+V{
z1bPvrWdPZqu;zXkURckXZDpt3*C@+2gjdMRh{tJ&Afu2W{qG&6^$2WkKNH3O*h&3C
zss|t;Xt&Ykf6b1jn$F}rlZLD(^b2M#Sr8;cPKFlUm5qKRRuppHQN1h4uw&m$ix;{!
zu5q(s=5ak~0j#EppGh`qB7cCt2d_r&m-D6=#t@p$1TQ4A|2bt_S>WqQ;e42}z$%71
z=vAQg+u7O+xM2OZ3Ru7G|Mu04`l}f*Rj2gf%2K|gl0&@$OK?mRl+8J3q1-Fc0Wy&_
zOT?A<s04hz9LCT<<Uu7LRg<oL%1$dr<C8w`SF-;vXa`Ww#&TGReyu3HzQR`j?Yq?5
zZrI>DE`%uPEHAU#>44Nfu{8!KMIS=Yd3&b2a80U)%#DE>y5`{&;~kNGC6qQwt<Qn_
zEjj&(E~=yGkO%)Kj+Vh-)*#^{Z0e@{dY{~PL1L^`J+7~CnzYAZeno4uHNARxfB)*S
zHf9ct<~;%#6SXy{@Z40%DWBD26o)z-6QhPb`N*ESz9k#<ysBpUXt2TL_F-}=YoSN^
znT1knziwrKCCg`eMC9={xUb8vy!faNc8KZpn9a)n_af)yII8yEG$r!`?9g`|Rpj3e
zxrSZW$6I<KFHia+t8g=l_(}|xM;}nBiK!yiKo=E&rCB#_+kje(qZxQPsr;GZgH7dj
z3%NtAOx0%^CJ)pWhN{ZbO{j1BRhHpA+$a@3A3+ZVHEo}^%yhCcuXmN~=;Co0MSP7!
z-p+3yhmeCeyiLaB-uTF*zTet&#x~C)2Re5@3|t7@M|U~*Q~WhGWO+KTF%VEURDJMn
zHt7Hi%#m_2KjUrLE11_kHq;??=3^EN=eMTs?ZSFH$vO<{<`QbbKA-hFpRmMxJfEc@
z;EGUfYr?r0Ga)Wn@DY<?px;uwWDkH|q`l`TPrDF&7A|Q;6^LrU7cHp5UJF79RmgA|
zCKxS+fVR@NG-`HqYL(Db>|0Tv#6{qJae1N<yngV{z+o`w2b(A++v8l*j_9V{t2#)T
ziiR<X{S--QtSM$9arkv@2sWrmi9^2*5oC}%%KZsQzR`hU32_LAI7B<!>8mGIEJ2#q
zsn5aZOCL1ef95mXwKrdm5>7bt|IipO`TooBCTD#sf_OD$zE(uhwfyBI9Tn*F-EyS4
z@cx|Bi++`=35Sn$_$pde1n(V2w|4oJ8M#`)_u=_7uB=qk*u}o0<}tX0$Diz!l&Ajt
zKUVbZ$=Kn&2(s>JkGW6CPWIBb$Tt7(q7S*ERP4VY9uaY%K?xSgK}CoX)+RvWZx0DH
z|Mt<HI!AeP5@$K2xA7?KmhvlLvDqD<B$=zzsNpi{_ES^ox6NXU=~&zwc``Y;+;=Cq
z1T3pwzju0Jg%;ud{)HXXPON?%!(2wuyBr|CT0+y@)Y(qq>%FMVs#`{w5Ie`e@qCHt
z2#h$sXu`pOjb6`=0Zj(rIyiKK>#+VjJR%BqXg!0&%?-`5J>7AY2mnquHz!d<Ek9nM
zV*c~0kxj@8w9>2Z1*iAr&&JE#k(mfn?c<mB1pD{!FEqyIPyR2Su`lu8H;?%P1Gc%u
zu>CrQkRnXCVlbH~$naYp&Qq<(o2Z2(?f3pI);rr)%=3<5KCY1XlIyqH-{)e_p{)t*
zy}_)@{=UwG|EUR3shF7Ixste^b-L!6&|HnDpI^)uyN23D521F^c^y+U&@Ori+C@$5
z2UoO*RzRxj;j6t~p`EtnH=(#54C5Xd3=ohdeQIR-)F`aVOJ4Zk%GF>Q8&qVK<LyOd
zOhPn;!PUScIPumZN(enTcKKEO@iy9^!iu9oFN-^X@N5>`M{XW#PSnrv=Ml@kp449P
zz1i_El(zS_SoTn+egzsTZc|&h1w+LvV5s;Ef1^TuqXH!AkKD^HSWUpzlBFP<;F=sX
zEhvS}ZvBJ33_s<{zanKvHQna+tHQf+ecqNdJT3duu_0cZ+_G2>YtfeT{3Hq|7Eu6K
zTVJ&1)AFyB!Nj^pPetKq5!Q^A^i`n-Z4S2VZ!mJ`FE?hC(f8!_i2(+iwPzDS7u!@P
zw<L}Vr1zcson-iuEGGML!53ENN8K31aK1`GN!muGwM``FE=Jb{CJF;+9qEL%U#{XN
z)qM7-MftTnF&KneUVDZI7`)t!8$1JdS(Ms4DmyAg4Hdrxvx=Cbznh%D74f<*sB`jv
zdBTAo6_WEh7ejy9>ayZ@E`{K-P5a6qG+d?(k%kmAuHZO$9|SK9;7{n7IDU9%4p9|7
zZ5S~;;Ls|itRfuO`5|JxM<L#xB+;JQzm)YJ_R0)h99p5~=LuyAuimBy0ku|vp5XL2
zEm1rtR}A*xd$3M3>-oAwLM%VdIwnCe9R$R5`3aDplp|$KkzRz~c-~wx)>C|uI_qrn
zTuwO22g`HoRl)My^T>$!>(3nw`!C@~un0GmOTyWKf|Y0FW;~zzE#I%)vPbd8Xy-Nk
z-JryqFISf7LL4(8&jgl6-|iHKs3;t{;nz{kgfhB-GbR<CmQJ>U8&}Th`iJj0ow^<h
zb4DgTLLY-1I!*V34@)73`;x{hncQ8KO2j4_AVmFL2}0CpJvE+hVEnQYgs9(w4oedc
zOF<a@7`QObQ`#z3|Ev3uZw73?m#K$3!R6|eVy)U4X8>#r>oe}l7ROoWH?|b|jU6K<
zDq8N-vg`wfG|e6cG!d{49s`Jj6o#f2849R|-%?iZNOFX4B%k?2Je~OY7rd9pVq-sP
zdJ9&1Xv^TAY1{|jmO*Y0z8E8A@%VQtk@OlsL3Ae+L<4F(Q6Px!1pmXwpxd&<+cE%z
znY_=FMC*E+`d|bt!wZzZw)DYv3ucJE`Cz-%mVV0c4Zk)Kk$WlUk015D0+dgD@{R5r
zJ?c(lK~nBxR>F0J#VMtNMio2de4HiCMZrDsJvp(Txh4Pe@Z@g(=i#xq1U)>SCK;|l
zzDB49M37P5xoMpSZj$0QKtuE=;J*0bpK`$!qw8BF_41jG@3HO}_30yv>5I|%$QA10
zf1O@Mleetc8h3|#W}778Mel#u&wi{58ZzB91Zx3F6y92chnM$grtmGD52G5r<%H0x
zUFhpq|9>Lf{m-l6MrVy`<NvI)jc-;dxvv$PY7Z$bMS!Vtq46}zKj!FhW>8k+50uqN
zV`h^C>C-e2j88`7Hz(#dLo0|aebI+Z>T3`A>_MV`Fdb~jM;~#&un1}MsA{`Yd(bkw
z<lsKVwqi8Umr0Y(>t$|S%)g_1de<7yl_Zbm+}FSsAT@JG@{?yuRMPTD%JQ*5$M8!u
z@B=;jS6k!14i)WC_HWXb_lVa&CQEg+Ypo=qS!+3ogjuPCYp`6bKvg@KDosCZc?`XE
zWS*VZCQ2ysQ-~R*q!&@hj}k+!e*{EMrISI3+ydrN5g62UCv*tq**fU?z7TX^mEQpH
z)5RLS>9eyr2OUI0Znk#{2%04d|6&0+O-Z(%e4I6FNd>Eg=oEaO3yItrr(9Euce;5f
zxu)DQzo5M|7SIxriBcP6u$RUHED@1J3sq+hRR`Mud2(l58Q9xLTaMrxM&|#bfUPun
zpM2ko`>LUJ-f!833_3FkzxKU7V|g>t;Qf`K_js1Wpb>7qcrfI%no37D5Mvf8m3KY$
zPHhiZK-3)yB1fa7dB({4E`Np_vx0Z^D%j&R<nrL7!N7oI$s?wdd7(0SiXqch)P&cF
zFRd`|;W4xUty~!j^Q<0NF^A+EL{LmRz0S{$C|EK!jnDU@-gG$7s9&0l)KXRZe*rJ~
zl*yIaI{S?W|KrB$gEx?@39I!fxY}O6U!iGR#*hDvTXgCoI-EfAsYd|S!PAOlD6#jd
z<j0xERdGW`FEY3ulh<N{2Q7Ta^&cr)9o%eq$ZT=nsu%`6D%P1ep6-BE_Zpk>j-y=}
zCclizj0}3mG<^SDQTq53->Z<O5<nV{P@3t2a#nr``40vgJ5mDT+qY3@Ro~Y*-qgG)
z-Gk#*yrJW_X_5#PyFywxq!|jA(8?c2r``);@a!mDt;BJ~94x4FnM-nJmV4|&J>J4$
zGcEDc;g|Dx4)f@DAXFs%j~Y0|eLZv%en2-+qK`fpvU>M>8Os>eSRwO-@zqK%P6)xi
zHh00YP+=hfKM?Qubat{7j72TDc!hpJDQC*3RT34GBf}2_4-FL^IQ%%5jqd-P5%T5u
zW&)k_Ny1{u$wFxI9kaCJhfURhznUPp$gTmwh1lls0Xo=hunB?-Vj6BcI&LV)BOsn@
zt2`n$nni8eB##401YuebT(HuO8q<!}V{MO%02d*fh$bi<!lSf0cKX95;lGEuh^%g0
zH@6*Q?~3;Gyz8m#$RqoY2L34fzS_SjOR&|G&{=x<+svJcb6RjbOb4_31>5aHW-K}5
zyI!wEYyqv4;3eTnlcc>>v&UE;Kx^4KTB@tc!lXb@JkHP=@U`VaZY*^~lF`12Vj`&F
z0PtP5LoVOiPJ%O2VWWB%r1Q3iC<dq{LPAXK8Xpq%sQ&$jzv$b0FCPBv-amu5$J)oK
zU>!8`{mL57>Ff3xAy^ZLr^x}=_zosUy|C0D>A%7bA%>Hs5KQ%r73wYd7p(Jo((}mo
zNl#5EgS>WF=TJbg1(p5>H5P_J<saArrGF|4@eXzI4sf7yrdm}h3$3IQuHX|q<_0yI
zzn0w6nc&SfykhwpXp@4xb4d~+cJ{ML<7XspN({kU%i~ofD~e&G0%{jq%xLS&7TlJi
zZOnhKR$8+jSeBn()8*2Vn<%aPJDwF<wK@Na`Ap($_@`gtyvSq8Q+GRq2H-#4`23k~
zU=qtWW>TJ2WRy*%jnYf*Z4Bn6KX~yI;;&UvIsIvhUhoQ7a#21ZKwEJ*G3UdrZQFC`
zKg?<4xf5TdLVhMW+OHL!dt$KpB(iSO9|a!y>}fmvUhv@GT}F*k{PT7^#i>8+gIzF9
z_vm81xU9}IVcUSmWN0emjsT)$X-Hk<@F{p*+RGS!uu+E*#0Qc($zkO*ct4+Z*kTTY
zu{Hx0(jk8W8Hf<_?s=u{_c!gY!p$(xLnUJb)2Fj}q>84c$i7ud?yC~zg};r*_KV|Y
zeljDbW!Mq>`h$2&IJ+c3l_oR|`{Pu*Di7A6Fsu`NfF{hUvIRc51OmYGX5xLc9h_xU
zvtw&+!+1!Kou%Qj#9HFuY`e#o7lff)_G`KAV1s$>=OEi$Slf8|j%r2X$N%z72J=vD
z7){3%m!_<r%?8Y&5b!*9&knQMKy69BMr9$7E!QlH%uP{%JlG&{%K~ParY7wzKR+g2
zcdt%X>fbc}0-(3~SY>+iuQ&dhu=uxbZ>e$1QsKNh*);cj1zszaz1?KI8r3aU#K%??
zaTM1(!fDU3mVhf>{f|}bFvwY2VjSyO#Tc=44RNn5Mv|G<bMqcQZue{3f8$&v>;L&*
zpJP33%~#HlK0M*ra3zaNAqD|$XG>ma;>Q3fw6594E6PX=OwOW#F5HRrzkV;aLf`Cb
zf-~g1?Wxu|e+AHbmTDC$rBhB!A<F&&wUQVMP%ELCNF?9{$^QxPoC=k~UY5hw16AIi
zk_N76lGX@wj@a!Wc$3@#UDI;8<}$ekfs#eF7Gb}%wp6w$fg^WMb(5KreSmRQGo(m5
zPwVE?<s3HVeidz|)67KgmwcW8qP3u~`aQ!>K^*ikf~fj`%yi@?CC7&AU>PgQG35sZ
zAg1LevER4L<{;A}+Njvc975h+M{3nscj)Kw@<(V&8}TpIc)jR(qAO7CP$|XPA09HH
zS5UA;_ar7D<ryRw)ob(361Yz68fKm4`}e#yTwej%WV;!?co#3+x^ME{sD3CfvHn*R
ztcT7<FuO*4AcmZt+`f*w>(nG&cCh!`H<)&Ir#A`DB?)}4R+Ml;a=(24&^${=jgZLS
zvc!W&4^eJ>&qK`P%V9gZ+h$X2@skF-Nb|s?R0G{`++perZRR((en1v*w{@fE&GYav
zd=nQ_h|D6paI{3*`6P_sM=KMHWjler@MG+-kj4L&5x=WDKwJ&Rt{cM@<+q&{_5*TW
zNiad(zk5EeXeBYY&GI<L5NyAIsk+xR$H8?7uRXgMu5f)jyl^olJ3`+kJQGgpI!-Rl
zy_0xorTp_m1_eBF02J{wNT;Dy$(qdk;AQ~t1+Sy}lSumqyuYtj<^pH7!!>VQ+h{gJ
z#Gai;B8zK_UsFB{>4%7YqDW8Zng(VTk_T9F7MbJEQt~!LbnmE+K#`uPGpOIa-|4wo
zL>#58Jw#dMBwLuz!rY`ZIz?=H&9>>b>1pv!t%=KVB*+=C)(Wsk5RpIPJzS_Z@5w~>
zTJaO^QRoi%Lvr0_e0|uHVfWWruD^e%xl(Bi?hmm`HQJ@nJeB7xS|0pmxvinsZu4oF
zq`K{2=TGE_!X%fvvX{Evz8+ea8TIECBp$QFwcA@B0X0PD8C2u(^;>tnF*~*~=9<c#
zb{aeJLW^Mk&xgAe&R+|)O8ZLb&0{1t+xE-t3+`k<kN!ZjA@9NoUgHV-sZ*}{%mtsT
z@Y^q9Xcc^nFK7rh{sOkU@sDrxN2{iti3FACNyj$3C)yFXwvIVuvly1{$ltw*diXf0
zM&7aD&RHbdAK$#ecPCj_Ewq53B(gxI1bu*va$CUAi?8`KPD0(*!3lf<29gY2*$n6t
z5M{L0{;D96m_@DLehqzsAK(*A)xW-*X5UIS9t6&-(SI24enYrZ#nks&ikK1_QBwPO
zH_OQmK8iJJyaWW3N;2T!`I;;_@mB#;rst-r5M5{!QH;(L8+=@$6>{dg=}%JLWWev9
z()PD%O+g7GY==fU%xs7F*zFj`+!n0yylY{%@(g?mx=AC5G=8a!W3eWvgEQE*u(W8J
zem`BA{-z{Tge6(?PUBkfq@Ri=N?LxV@{DJ;g&14t^jR*J^uvoTBiITqQ`v$BPWXS|
zWf)$+DyqTo4bLxdnwMC7ZCgfb3owgxCde(K&Of{M*lEkolD68i^8_rbLl$hSdhC`P
zy6o73mlGTozUpBt9jQq);zhnjZwsUzPEPi>Q|CP!u6X03qx$4BHc3X)2yfF$ZM?nU
zX+=NmfLW{dFNtJ^`_Dh@{EFXd1mFH2QC}HWWfyHLA&8`)bcaZHcSuTigLH$`CSL*R
z?%p&=cXvp)bayv`wD;vZ_dMqp&qjZ+)?RC_F~%HoPHQSZJKtgD6?!JC@@R)o6=c=&
zHT?g60%7>MZJZGIQ<vL+4HBNC*QHEUWpk1btn<)uHJgBAyqtzh7V(Nj@u-dmr_u*I
zPegI1qn&1koCXQpG%NvcI2{U)U#Nmwbz~rm#mzAf*8dQ)inW`h9J0C?@Ocyh)sMX1
zbx#W)J#R&Ecb&a#joffw+HtQ~3bFf4L2)GysEOYlvht4~y0#NRHE3{nd#?1O_sRqY
z9}bbAV|?Qn{6-Tg-$Px-@yFM0+;6<hao{Uz#QZ=j5E48%(Cg-nz7dv!y6qc%W#Yhf
zJU<O-KX44WyQQCobrgRap|$)uCvF-U1n;tT7L$J%qqPi!zrC6R&0QVpQg~=&p_T@~
z3+k0TzlyScE`PfCHnGB$$h7Ja^F36F{}=kadna*|_um*v)sdsmd#0XUPAug|Vh^Sd
zuSA;WT(XbTF76J!``T{3u6>q>c#vWFp<So)5<qX%l6p*@&5ywM(O=97V&An%4^g2>
z&<YOyNx0|*xWb3_ST9=l6Y5+nGTxa38x&E?DwnUAUT<_A#=O2F6{qYcr2WVFj`%mp
zR<^cdyRD^q%Piw<eVtf)8MtUK9dOaNt{WesOBc^i^7v8KIK5h8y}$vzm&#szPWgIV
ztz{pKM=x#=jM*T3V$hX3NQ?FPjrzq6-Cu>1T|Bp9;vt-*t|j$`htc(um1dx@9j*0=
z_0F&Q_iNh{bm?z{DLbxw(S!72+9~oGCQ_yckuA&_p8%0+e5Xa99b-+iUs`4wHMIw)
zex|N&1FYBGpL|Whng!xvdYjXsV$|U;Lp_yWdRXZOS;NMem_}HSPKrywKS*mA{DbJ(
z#Gw7wTDw(7DfyKn1ogs@5y0ErtCn>2hx^rhkGO!c<)cf~6+OQip4jl>?U8F#2|9aN
z$v^pY*SXHp1n$&v^xV7nJdWsx-LG;Z@=Ci4@7N6l*Yo!cv7V6cMv&JFRpk%$FZmAm
zxXs4Coz4;sF?7REg%0iY_pq=2IEW&1_(1K@kMI8o!GS-81i{NQg#(yx((8Rs-ZggL
zq?9gVfPKkOeA(d3W8ure9o2>X`{*LP!kn(2$kFdW5I$<yh~j=T`?V3;<*?N6P_bN5
znPk3OH1x^92%$%7Wwjw-!*yNPf?3y>JK=SYD*kEW;7WClCiwFi_f*~SboRIAdYhg@
z!zx-+nm#U-1D7ovu(V|tfXb>>w_yj~pHs6&aH6cv#hod^a@p#sy|&hD`b$9QSz+B?
zFc@CB4{T}s<fe1qt5TRbC%1g>jsPtVyxcJjPMbNIOKQyj0PvNb1dfG}tlz;t1)s-r
zG~2d>K#x`m^czER36$w*Pp=ZUniJ8nH(0MnSUm*A#Q;gkZqKs0XV=!b0%H9UuZ=o&
zapRieXSX9B0km`OEMvgio=F#9@i;xAzn7^F&V+w!SI1Xy+1caC$91X1;5qS`R_)`;
zN<!pm*TOP<&>-c<$?aVd27Xrs+s!*kCrm>EL~i5Q9^~TIq|$m*qFTQ5HBoq>k;ZL;
zfs?7Zd0_lWPqF41ttbWD5JfgyxTRdPfCyTxx@<FWKdj7tYEczwUEJl{SQW6X9`y~^
zDwpywEg9MbCYcU6RVF5(qA<}#BxS^XKc}L<cUIt!T7++%QXi}AuruKts5w=Yi??U=
zA1OV}A|5FHJzFdkm74fwTk*m;cTH1~KkmvDc;GRJhd|0=JT3K{N*%@wcNz2G2W3;s
zqA0&3KEhpi+fCy9+*bV3g5z4V5DFddz#K2w%2Fg53lTdD`HRbWC_lf!cldRW$OU$D
zusF3$c6Z{!_;y|B{{tv{WFhf8R9z?0TuRl!);3X=UeqxmBU>8k(xu$Ck4!1Y0E^!;
zJ&D$BVIKjzyB_jR1h8XPf2rI;&yRqw_-&MdCHKK1S&(S#uKDquO`bL}!rq%-ICK)p
z@EA8L{hjWV<nHRaKcibE9({?T3?JSt=qC3DPLYfWWw)5Vq8=6SBd(09q<iAQe&i(m
zc;-)b4PJul57gIiqeI@6$jU<V09g^(VH;i<?6B>b*M6=ouWl>l4aU-G0%ZefWdkpt
zg&))QBPfS~r*&V;c$(J?Z4g$>2d+#QnuS>Q+u5C&gpo1xsNxoL-AD|$8ifYgZd3*0
znONaY%TA?jJKLDz*W_vb$y_eu7~V)qP6VkU`r)C8)??;hj*>E??&DSgO3YVp&>qcX
z`TgOe%&W`2Ny->;Bu^(Nf4J}eHWBTIcX<#9v0Qi8gV=}?`DMKVB-#<yhE0g3+l*!B
zB>t|`$!J^j5l;}dL`An#B(n$=2pS)|zrUw%L10*wP3^lNMdus<cwf1R^y2IVDIS|8
zN<CDOt|m9aKrzKXhj)YhpX|P)O*rZd^-0<cssuZis<*5}HuK<2V~Gdbl6=gQH2FRF
zqx0>&yEs<VX!fryS51))29JK-y_klbI2I>c3%p#Uy*3A99O4$I0YU+0^t_X(D*ug0
zl1SYkcv1K15U1cNKDI14Ui3Yakiz4&;G?1Co_8)1nS_er(2k-wz>ZA%30Xa3kyh$$
zrFdgTY4SazKbQXb{J?=QN)y|(=+0`$Fo2Ot`P>+<u&qe{1_~DOPdOb97N$o%iSmD{
zTI|he^F`EuCU#@@F2sn<dceUSvFoLLpI8tVNKSM?F)(9qrgjCxhdxg+^lRvYMIf1H
z5<T1EaPjxTs5$*HK-R<n#Z!IJI$PNJY6DK`_U_4Jugcwde5wKW2L8G0XV`ZER3cWS
zc~(+lD@r>XEEb$6G#@!jmgW34_gCv^zazR@uN@D#2YQ5mZ$xa6hwo0iy{R{fJ*-{&
zhj`jHOwD@1xt{BYm%3%h?=L#3ip0cA8!D(cXNDehP&NzE1d_I1p}zaT1v%gbTd$-B
zyVIQD<+vj68WzIjr!j1I{f$W2+vvy|53+Us0c%#XlOYz%(GX3AY5i-7p3Ws0H3{;2
zZ|>=bQOmz2W|~dxdl%r>)XG2G<Z|w8_KwplAF_q2r?o)iK%&j4I3l}jSGE$LKY%(x
zBOzkZ$89uBen3k~P}@ojObXAZddW;zU()H5FT4RhPUk#^Rnks)Tua^(_&jjB)^47Z
zs0|l?kPA4EKSz9ns7Y8mSdB{oCsq5kzG8}`##`;;qy!7Kjd$VK&CDQLL&cx&Peu=5
zAJm)rinmy(T6GKUGDAH!1}P^cGIj<ZG7UJF+dVjWN`R%Y1ofQBQ~AO~J`I9!hAO8S
z9vjI-d#^9Jr?qly*=IbG*CEdme0X3H$>*xUrms9%4r0Pa)g^nOEni8Du5}%~ppXcD
zg}GDRjMR*hvQyo*%f^91ch{HB%S2|b<)x<w4UJA}2m1pF{I*kzj|1I-Xg5b+si}2j
zAuWZ>z~0fN`naK|5w2;^%@>Rm4Q%mURpYhHQ@@jp)94dWu7O<w<r;x{jrrX;HG=x2
z_#h+Cz!SCD6L1an{Wph1-?iu_Q$6!RdbE|$PCLGJ!&~pR%xP0WS&t~lN!tfkSTY}m
zKwiaY;6|VF!4@T=^#|q<PBM(=tm9^#jv7!|sNuOT`ti><LXSJ9ZAb58(@(YTe@u7F
z{L=zN*$e%oEBdSu_T=AxHq%$^?qSW%rTDWzRKqhu@#z)Du3}Qw_W&xgEWh9oU6)V|
z3o9;t=Yyz=oDxpUt+Opc>xafRxT(bJ?j>wX9g6T#>9ls=vY7f!iR9A7=z8#}w`2qI
z%0lx_z@89S(o4U?pHgEu+Tf4mW;yZF$gJ@$k4veniNt2>MQ06X-B)zW;>@RtXu-br
zfhAh~AuWtl#*NzDBIPy{@xv*bbP0d-$;69!a5rxh)u}#)X<QmtL)4IvUDyl0n&W8x
ztP!Kn0|A_-6nG{o6^#f))om*kl>uS|WITFRX?j&J9~RAhJj_xa>_srhBAX8U)(#7x
z_YaWi60Jmu=s`_=|Ci@2?t&xOx9O(FnHW}tIw{X{vNq;I$HLm2zB)5apT{U3N4jvC
z&jKB7QHzvXcTf^_HPAY2sUyQ6AnQC4d2g1tzIfd48;7^-tDoJ{CtR1&#lZMR7oH<F
z2JU+_@6UHi6cL(^j$9)&Pb}q9AKX4yv%CJRL*6wx0o(9^C&3BK1Pbh`&a20$5$wi;
zCqX`tM=h2IJPFX@^tTJWE>}WRp=G;SmLOf5h$kCA)t;E<$SUHW$U8pFjOdp|k0NQJ
zn4C)53pc%)(eUZ6NHYf}LHM+$9w?~QzmhspIJ0cW?eVsoT6i5v(F%ewWU3OazZp6Q
ze16RDx#G-&s1aX>@IA%6b`}lT-kxmufZ+mjN0C!w-(=Z5gFMZCmK3u;iLs;WeVdp>
z<*J*k!O|f_YJh{G9>)EMCn1*Kj%z(=fWCo1v#MSU`O%?<s|(1U*dUj^m+1L9)B)>x
zZ?uh#npiJ0ErV%k&C#pvi!8=eT}p{9ed4R)DdQ>AVI-w7RnC7E6wUROY6$PJb`yoD
z?3f(;{oU2nQ>;!7GL>MpFgE_l#q<?Y`CGk@uD9JA8Cp%=Jx0~Tir`=pk;C{&edHZo
zESJoFN7-4@(=y;#oqIyutPtqk8Y<P%P1AAt#G}NlR6{#GQmp11aDB<X!iYRU$mjfJ
zVG1!*JkwlcgG0$++eNFWYGIQ@B4>A|8)r+=?|VkI-O%~Lbsxa)L^3|zhQef7Ry(1s
zgq{#IEQmHE;iSi0LtC6eVP=*tAU`-Wz{Kx1mptmbxd1p|;+eNKhWD5q8n3(m+HlvX
zsXsl1g}S-D83(aF4AdIL_WVq()3Is<5NLdm?;ZkF0~3k^1~9+9G=_ttz}Y&{G9K+0
zU{D4E0|<k*5U0fx)da8j$qx&tqldZc3n=@MS-RykMTdCY@2;L%9D5mI_Nv9jOIN28
zK%@D&edRzbfS#$I8N|TjD~SB0PQ!-)37L9LWk(9lNA`qp?!Kpg<ooPvAE$>OsmnXK
z*~q`fX`W%NAVckB_7jdE(49kjvswpD)PBwThy6DKyAI)=Xikm#mcK~V9B^>95z8Q$
z+uQP&QUQ!`8gYWMO<s$vaJMw2&gm)xK2-hO!cWfBY^TkebETAH&vtJfiL{@$<<{an
zH{Ya$o;gigRy)w$Kg9AlKh7&_TbTZgm+|E)Df-31NulRS>mt)U-4G{c%0b5(j)PH2
za+($*OT4}|fAOZCBtM@_xzdaKUoRJ?@E(%K_w)F2%3jVC#rY~RWFIc_n%>Gy;7@<$
zW@yc(@#xnJ2u|rOB&ZZjDPU@XDTR}&&F&HetvaJ$AQD!$(R8HJas-jEiTY#ujO9vl
zm3kwGc^^nhn73X?3F{WrsE^OEPw_s1VoM)-QD~LtRfT6_L-e=Z$Yg{BQ7jylg|oMj
z|0@c*nxjcNEyKVGTlPf(;DTrKNIuUU5rU3NEf1hjmvd8}T4D!-G-Y!Yji>5`rhEla
z`Bra0(%WjQo)8rY{#H8mpQQh=6JM8Lj=Y6$-($jYc=hSwU@+7naFyA<>ql(GQA+7!
z)YbkSZjJlcXBaB|ob2>(Xf7R;>g_oZJthQrxe7qSJ^4i;CI#@ghR4piojMmAabg-j
zsKqYHFZT>JYq&ggxJYoPdDJwL2i2ejUTS@<*jZF8Yf~MkFRfkkC?Ch7%>jmwrvzUf
zW0N&|Wo&e{<+h!4eoJz~RX+@oISP$ms$46z&!AA&M?S2<Qnovs&12@MYwq*jF~^g%
z`R@(Ipsosp?gA5v*K6S{1phA6yJ5T_L!FXp`b8U7IYVy5X_;3nr9Y}5GBUYCo@^B^
zW_I45&&_mJzTd9NclLOv_ob)nzMuvOli}ffvfGqlYe?!Pz~bsu$)@JiS>?&w5Q&JW
zJvvd+6^0ygP6FBTEi0nxY<MK(GtX~pZK;~a@+lF#mVlwNb*@7k6fsPu8wXl38^53F
z`_N4eo2-+ee&MB1v88sirrEXEwI^p7i=Y<`wifiF30UaNJ140TSfqjXu^wSj9di*o
z(?B0>5nG3R7IndjO2^5h1>B?R(da!xhH4^QlNLRbhi0V{((zT5YsL0ql;XNb#I=vb
zWgIzxK#gtG?Q_GZ1rq~{q3_AtnfTUT!&O%1is?FP2mPJUmGAlsFk&8IG5SVihGgtt
zgPGnikZ$1_*qF#a(!{SGTt6%b4wV?t`e>$@PBGe!%OT;ng@Eq#{!^OPtH@o-PEIt3
znD^PUA}w(L7{uR;$rVpHaA=5a@=cW9AheJI?fyiV2A~j2+Ww-$dLdW50(IEik2^-e
z6=dxRl<lAnYm2$Y8>e3;ZY}S@1*$o1c$fTIvK|U32j0?Co*M|ng16gpMwcw5Tw+ud
zvI;Z36Wxi{I2hjF-qqvCQG#OZEF^Gl)+xyjsiti}xy)^Xn6Q=)@3Y1j?@C|^5cS{l
zNC4BI%iS=0G1$=Mk<h>X*`gxk(mLm{J@He=f_~5W4;K4o*BV&fG|_Hp-82vunmR(}
zlr(9~x7@9{kGV#T6xgk+;`AKm<A}a#f{R(N1Q*k9gsig%UKyjfOJ>4Zhk2QA^P5-0
zvfnhHXe;d~)#-kx#?7MweP&WNfgpa1omUb2+939|BIyy@`Ym(mH$S)(u{&%w!dYIy
zr+RLiTMXQ{*5rGs15G;lm79aI4jLCT)|6!#U>DAHm6)!QzR~OJ#wMs0wq{{VXGtMn
zZ;6Ld{CAByR2%dPY|duW8H5UOSI>*PN)mcYUUqeTru3H{u(DpPp2HDT0tS-K88!Et
z#iMnr3fuL=;m#Rm26D`L-b*+_dIK(PJ*EDMAz6!TFMqsRt82`&747U9n-j?h^!bPG
z6&RuF@AAZHJCdA@o2dHlfCKnfp~}w{?qrCYV^>fmvaZ$%IGlQX2<e=Ta$8oBsx#gS
zEW0?521z@xV;Vw)v#U08hCVR&Iyjp9QS0TMPVRnrrzJwjE(vl%B`diD>ON=KW+!x8
z;HuqeWNFY{5QYXheUi&713j9r8By4*9o<wkN6`L<sOZahk}7|n(x;W`{NOu+(<^ut
z6fci|P>!Nh7$D)9#CA9?;rYL>Ht>JXwx5@=+=e$@3wiUG<C+V|!Nvu}*_UFVCt+zp
zG((-Q1mB0}deG|~Kc_mQbv?v9XR1~5f@D-TK*km93^_HlujwJ&)X8l%_k?o^-=U?*
z3N>Q-Np%yTSxatMmj3zI){i^!P@>H2*B2j0(y$0l#(Pqxci4af!ERQnV&sFtc&jg>
z)qncMd4F=k?z(;*V~u8#ZHV|@gHmNnw$9N#PY82FFpm$**v=iTMgX54A0*O=0Hg5^
zM##vA1`kHa{GB!%ekqP!o8|dOV>WhfF=$2|d!w<%dD!H-ko!DB+GRy=%>lPC;{Hm%
zzgtp8+8eh^ur&yPwSzp0VN^0##PH6}!PdT5p}P%&S$}4U>@jrpI)7n1LXylt+3#L7
zq$66AT|CvWygK?VWd$6>q)sFMZG)m;3M#T5Ql+}Hjy!$yaNhQ7OTI6<f!|nk;7zf1
z($?O(z-eO(r)&P$bHe3l)cN*4=?hMP=IyB8T|AIm&5JP&gey$yrrN}IJ6O<~*ng8N
z^FoO#;f^}8K)DzLyI`9K@q;2ACgeq<yJ+k#05!Vv7mY58jlVpWAJpiS+hxsssf1VF
zq^qZMP`_w&7@$U{ZH<&}`er%oUE{3+Jnp(n92ebqs|tr=dozlAjfZ;1pbneZlL2On
zKm^dd1A$ln)S>bgarNU8!3(^&T-kzQlogU56L@PXJiZ*b#58g4LMRpAkXHUc|K|L5
zm?Oh}N=h|^++;NevsD#IFx8Q-oj~HVQ;J!iX+@+tt<B}B(i1YdPy>cb|5z-+f#Mcy
zJldUeyYsErE`@@J(-0)HZ<P6oMYCp86Zkz<YFDafC}$m{sRFLFvH)DE(P+18Md_m9
zD7eyDcFmet%^FaR#H1d*J}PNukt?IO9%Bb1p;0QxP|8hH^?KM10xjkFIVByKG1`pL
zwg=s3#B0*b7mDtw*R%sIwA<|Df(xWLHw)JqEqAzJ_~bg}u_~{4VED#EfEO9-R$p+z
zZ}(Etx|@UnRjMt;9o{LP?vl(@c;=k{HZ_OANV}v<zyQ%Z;mon|lB8+`RY49wQ7Ge9
zII&V!U(q|CK1Fjc29d(K>I+gR3MjJ!^~@p=wLq;PR#fg*pq@zqy$_$!Td^oskL4&V
z0>7q-X%u(jihQ7`Kd_)3MXn9zjKqij!NqBMi$6?$hX1afm2l>eXzoXDfg59fch6D%
zBXc^JvwS(+vB<I%$#asN&EtHh%ItpqiP=?93<0+1(c+*eqo;*9)oG<duTxUw&RrQ#
z$`A~-7k|*?x%;ugV*ugpS9uRO2k9Kv`^&MypCLA^UE~0U1px-dGOtkQRY2v;CINBf
ze*Ha+R#s#gaiI{kZ=M(3X=(ARyov*fE&I8zk1-l$ypQxu^WD{-W|;o&AV5zJ9(o4!
znwj~i;&byuixYq*zqBSrZKIm9#--3)d*MBfzkljjT!?>{E&%l<6@8<BPnD)^VR1{n
zP*TddQv`w8QspQ&k%A~Use%_R{mTp9PGM|~1SuA4Mtl(2@4zn_v0p&EEpz>6REudY
zLc%&<!wJ6)eBUEL3}nv`af*kp_cj8%MC)rV&()i^X7is7?k=Y#Z=n##{ZP+`KbK(f
zHOx-fkg#RRT!~=3e#PaE@d2AsmBZ)OAMpVD6rD2jI*V)N+&a^9!fo~*B?jK8P_$v6
z4T(1*rEK5Z2ycp}t2O4Bd<o93lK;?x&mp;&knK5g+9=7yz=}GecpHpUGC_Tm4`I$2
zuoHH$|AqmFbA%<GX)Y*jG`Qy6loFzt;)t2NQ8#4KI5z|e=b=s&&_3eR6F*Pj+I64}
z)Jl9kL5CIbUs@a5!D7_Epj6_()YC>g*cJ+Q+uG4rU>iJ=Xs^92;kg6JaiEv!Kut%Y
z*EQ-LZGe||CmNAT{ht`_XGFBO-QQaqy>{-V9^4bti#;zHOtX?^jx<O-EbH2IR}<u7
zzMhqlDD6iSJrj~leP%oEM*>R8o(2!2NGh+s3*_*SdW}lDIl2Skk&!t<_pSU_u%DD0
zw%RS@->(TjE8JQUub4Tuzn<#)E(DFoc@sB0lYR-_1eIcLl|yU#(PzeFWgzGa*!cl7
zITpOeEcxAu!KI7L`QSBHVf|7R`=#h5sZgLgzgb2gKNVWO%WVmOR5=}_%3a#&?9ALn
z@6(-ouz&uRK;De#GVqm~NWT+l?HF%(FyK<h-v+DP(1vglx@6St6}?L-YoGsZ|Ma}`
zQH9Z2Hnf*nH%#8-38+8gr6O^DyEsN?kx}oq_4&2Pnh)VeaX2A1bQ>b5B%VyCvzo#5
zYe_Vs!?4Fbj|^bgYG<tsEYaxP`X2doP1NCFDO}~mNsQGojTU_ozNGv5-r@HP$g{2R
zxzo8XQB84n)8K7JRAuRsVJ(tir@50vj#^PkgFH{B!_W7@j3uX^`_Z0ZmDp+_o}fK8
zU=&9?N`ESu_*q7_fNv4L+Qm39YZzn#wj;qDNCfu?h$-vt19Mr?W#A?)u$q*_nv}e3
zQnlLhemTM7)KK}Zg*CWGwFxizYm1}atTNWg*}am#17@!>yN&4#*;wsE_3jnyuG{Qd
zU1H5Ai#$L%0l{9YEv|XJ3^ujn13K+5WSIa-*0BU4*a9+T^3MFKxbvpBJ(CRQx~QT6
zj+*0}4$9DP71_ttkJK|sC1i(0IZp<Xo}?}Fbb}OOrkzxrix0LPNY7HJTGusUOO%G?
zQluBXmpK^Dk0jyEu;e~B>Bw%~)v;QoWG<Nkd+BsY6-tW5$sIJ49epEOV=Jk@{>fl9
zQAP~Ai@#c;BF2K-Qzn7iqea`3XE%EQ1{v3v2hldb2{}}qJYe|rcM6c>(W>)x0>dY_
z`MNIEhAtRB*|`7qQi-i_XQ+pB>^Xzs(*b<RpyfNxg@L~l`VI`6PMhYHuqV5Zt`i=h
z8M|7}#g~H(3BFG1XSKu*j0P)o4h1m=&hi3XgW_Kvk^e?A=z0D+v)<X>1o)yxv7qK_
z1KGd!BVo8@NHpTn?!8!3`z5j6ogqF|4m*X6-FDr{eih#lvg`;JZYLqW;2UjG%x%Ft
zGoMk|@=C6d4_*$0ny*r8L8!_8fm7CG27#Sw$4EF1MlJzf4uqO=!YV9R4R+4bbS<gB
z^HKZE_NR*ZA5L7Hi`D>6=OXsz_dgKBM=bk3j3Uc5{OAt&SR+nFy0N{G+Gf!{aLd46
z!G?V@E)Ww}*%OxDc|cT)h<G9|F&T{_4(eOOA^!pR#)}ty>#*TSBtDi_A0{*p$tQt`
zfDR=+0XdnypP=L2!28l=sh)UDKTc|7gPuXr=g6Td&W96#h&jJBsk1(L3g5_PEdCFw
zO$5yct}h@5p#hhW9BU+_W+J1IY`|$GbBEwC${nk(f4wV}27Uo~FZt|md664Z`3`vv
z<;mLb%>-QcZ-<Xu6}6Q*2dq@C<=bOW<g4#94!81j<(QIay>HUF6w6-8F08-#6Z1eW
z36bJi0{$*I`Fz8TB4rjgU)Dk@hfQ}5Tj}q!h?-*>4!=nqv>qo664=&j8D~oPe50bF
zANq3#pn}Tvi^#tQ&zeX03i976V--@h5baeD;w#3B_-zBC5ASgLr09v+_w<~nf~h8L
zvLU)d<Cnu`$Ysv@G~iI21<V!IA#rc3dW<9tpvvBiSV!JmCL3AkP6Z1ljgR1JO^8W1
zVLrgP$Ss-aS~0uR_0iY2CpoKrUCmy%MP0D3u4EIpJeOsbucgx=gXk+aNO(FOK*AHW
z@s_~3+RA?;_L3QQ%&<}BYa>W_oLF?T1H@J=($#G^3LRfw{{H})WxA<_E)6??HbxW1
zktp>AeT?K$A=vwIh{B`nrxDoOXOY@KA#hO3yX5|hT||2aWr|oDDc2vb-M}GVyZwb}
z)EUB-nWREfi<Sx0>|-sCG{w8YD5L}fs#r5i6kBT?%F#tK=@;Wg?2GY&vaAvhG+t1?
z7%!$!q)RBJLEi;`Ql0?NwOm1<@cV7WF25}pW}t~LswH%mgTKrK+Nb;HZ;k9b_<a}S
zT07`d0d0mC7hbs8b&E^4h4N@Xgchv;pHnc7Fum*bPm^_wnUn}2Jqt$iT1h**3Gr4J
z1n=vC^c5_E4QXM16Re<BtTV^jpi1jPbi<s!PCE&a4I>e@JfK{be|lZO1KIL;nI$C0
zs|f~`nCIW-yLLgt!-43F&XeS@USV-{34QZWWV6833ifZ!4oVnGh1edXZ^&JE!Y@7*
zV(oTe>_Dkd6#7m)k|!@v<fKVQnZEjq+_-I4;puq1VS)?9mbI5bNs$4<qcnbbw>IO)
z)wLkA&a9B7Oab5yvF3w2WKvvdN>RdT0*-4FD?mvprc9v~?68q9xTN22hM_4Nu|mrO
ztrRfIAo<ou&Wl8irp1xE`!>0ArE98jX22E4J65x-+7@R|)st8H>===(s{PyGzA>Li
zLW>DtOew9J4QJpaiEBplJtsRNM-LQYt~#%g-aG`7`bJA+m`^l~?MTjG3y97z3SN}v
zFE2TVWc7JUFz1k*2+ACm2nA}G1uuD%Kug}=9d`V3boHrMwO}lPXb19pTDxnHpVwAH
z@D1e2)8LnjHqah=5rQ-SaL0tPIXppD^2(CTXN&M@4737kwVw1Dq?S}NeNS2f^#E2y
z)li~6mQ!_TKThv57o!2w?&a&xg}nj!%vC&@n=+0Lf!JDZ(n?UoWB<e$M`4?-4`4Pw
zTFtSd652O*asq2|?fRw~L@+QWF9>FU*5+cM7<B+dFyHCns%ep`K?Fnay;P3=sF{qh
zOxQZI5!^-*T@blfeAe~$2O5V&bTK@l$C<sVK0eaCadUHD`Bai=K3|kdZJ>={s`cc9
zs;J&x-T|R!hAEG~)p~r)!f%z$gM8s*&OQswZL1$SPfns_<wK?%e{M8%AgroWwwDcI
zSkvZ-omVC(vX?4#mQte;Cbs)vh?RJ1<?w#e*f{6s=P7udbs8RaDS-BgMXGpHs<@&`
z_Mt^s`H6^}2E5P0$}jgh@2w6ac%SpY`z$p?S|meW1m5SG7*!VJCcAxUy2jMpLhuWi
zPzmHmw4VIknN=7&iRDHftfBi~b~e%Obp?SK>I?it2H~gSrxKx`Sb<ZA-c3?NWFqfF
zLrEsAw}JdvFTq^pG0^1e$@{SZC+Tm$MKB}dxD5gMuvkbyzi?fGtG3kzwsYLS4lcGY
zE9zbsv;|hr%-`HqD-)cPr86rAc4QxAypy`(L1zAbWM+HyYiqO9;k#8nGGAn{#OW0q
z9-(-*Bx*3?F27+^_>DG8f(o0a{#C*S`10)}1ENTGzKHc*LuZOnw?Y?K?-h6}vdJ*t
zfo<>8@J#3vy(lwgY5%t9UxpMW{GP#XCO2-*>P2nL%dw+{wWPAMJ+%9H`p1(HLx?-+
z-Qw!7IrCH7&oU}IxjvGlk?gJhd&QxEe$rAx{xevU&L>PfW)d@c){c}g=F6mK^4;h_
zVW2=LP*^=(7>#{6u8Z-_wqX#wGKh`d<bl}e-9WcQ31~_Ir)i@2vcp%$!dKruR`dAM
zw{jN~L`=V}+GYO+#w`4l7ih$O**h_ilof-l**d(=$9#v2o01(7qgP04WT7BCgrKaj
zo3a$P8y&tTy2NL!)?SS;k4%j7m=9dQQwSJm`{Jm&i)q`I{I59HlMlQ&6=(l*DoPdG
zH#yjqJxiY$nnW(z4+_YiE%e1C`8`xKYanN@@t9x|_O04>p8M?i(h{0g)5S;h!8a;P
zCmu56@XcE4?NvX5=9f8Y`+MkeT(E7IfKvO<w0}e{cQo?$j6f`#!%nQ{;4+*7ty*#l
z3?^JOi~c=)RS5q-r2T{ytZ_JbGr}`<K?F}VLeC6~<MlW_!-_bfuS_qGj{eIbZF`$0
z2_Dim@Q}_A8&=4Ct=PPhm7Xv8j;GIcn4e%YS~Le*kEZFwpoP{&b4A(u`HB_j?+o^a
zr*EZH{Q(6D#BVFJUMupDLU(XfbKqsZX=BoiP?_Lg+Tz<C&kdNb&1jW~7iZqL2AowF
z#uUyfaGCX$^E#)i`R~6ii1{ZCIIa4ZJimXvcJGMWfSsh}xJH1cWM1Y*_&#}yX}c4L
zt&;$1tRt~%&mJT95pvMUWm{<&OOyh!DM#TqoCMAvztbxQwG_I4y~dy5!5fD}(T%n}
z%REuJ{#1A@g%An8HRBdWC!O3+E{gxl0mb+OZ8khw8GhHm%@6mvo6(i{sZ%oAgFP!w
zvTNjr|NP1p?1SJX)yX=`IsfkMvKxyGOMbfN2d9;dfhQUiMoc5v;H?`=)@)<H<|ksm
zy>lS4ifJv^;U0AW!fAGOH<jPDwZSh6%lx#;W8?AO+jN+hdc?T3&#t3imc9~)P!rKj
z_HZ6?E1#tD4yM5ry_<{>LYRM#IA4cub3A^Edt>wO)hZ35QRXAuA+fNvWPg8#e8UO{
z)ZrjX#P5ToUt#L!?gPf?^#in+ED-UMiU1(w74r*VkkqOZ@dF_*rA4$MRgB>U*zZ>A
zoQE#HSwy7ly*1ivQ10;cE4d`BofGL2SrYDw%_jXDckz1dA(M{Xj1#6KdCvQz+h;7X
zT*mD0mjR{@SsYTWW+jnuSE}v07y~+Y$2^0r2$=%Zf8JtIEBxC#M6C(ohTv!10)(Mg
z(1;jhmycr|-8j}f&`<9@TFa20W=HtG;P<B>BdxC(Urq(@Ggz#AhkmgjW&3j8f?o`4
zGw`jJtLHEL%DYVo9%Kx4#VoY_!67v9P6I-C$m8pX3oqY;>1))|;f`#Wyhr?pBm3O|
zS+d`~3y?2f9bdGi`q=FFu=ji93V}H;X=#6nCqp9O*B<Vf{|%a<-YlQ9PNiK0GiQ*?
zJwiRgQRtFOwH4eEc)%;iI-6;`o5Aj=X+6#4M?tAZylsz%5eHzpy36?`UH!|M$p1j5
z%lXlUa6Z^;XoKdiJa|-0gXPQxt63gORd@*XlEo7>N9CQNcFwL3+NKB8U8eWh4PwWL
zK(9z7aY}3jSx<IK^qW|{$QwJfF)ijrG5zJ9*J!YtP3wc`rh*1-3c^C{{V?>uOb7tN
zlRE%6qMalnQX)6E4-|7D5Znl~G~kUyZV&kJp9{MO_!<1L<|Bkp^wfU$0RHyx^N0F5
z!idOcX8b2#5+E(WmkMG1>$oxcqoPQ9Qyd%v55{T_6Qif%(|`?vibx;#4{MS~7IUBP
z{H!1CFly*0VI1U#33n@Q*E7u#fq%B_yl?*9{VN4}K6MB_Ul|yiyZ>bZ`mp6lvl7gL
zxY%O3;pn0bKj|Mo*nDZC&P#SThp&3=sP<t4>aT2LaRB)9?zkT=aCh!19uM_HI@Jh^
z!Gyi5IgVmkjo44H3>QfeEW^FY(l%20qHdc74q-$n#`~!*{Zk#ZnKG)<*<H?|{<JjJ
zaLTF&6&c0h=)yYepIQh%6JV#;brZQ0Ux!tF!knc0>soV(!mW0)Jv>;+Zf&TRnZHAG
zkE~dm0N~p18CjD^F&o!MwZlnr;cdzlNC$hci^E*~8n*Hk$Xxc5;hIuoM{mlXP}L6U
z2}TXF_&4{CQYVNhg|798zgiRFF*CPq?S`!AS1KK(DsN4v6ZRP8!&w90A!q!nZ$vtO
zg54{h;m;aB(Y?Ou=NQ*`^@dKJ(1b0CIz58JdIP9Z%wqpLQN+`i@{Aj-<``^hIidq*
zPlgxCdZ$2a82o|_F-j^?DN8sp=xEU4s!)21DSJU|$dB{&Lsi{TU`4HR2~YcrXTboJ
zWm>QeTu|F-UmL7czCHwv91aG(u&`_~O`lxlcM6m6S!Fkl&<^W!l4Imvikl4ZfO1pR
z=9xWhu)0Z~wW90ZCXYp?8798BLM}kfnrvZahU6fxDwT;$MtI0qHN8sM*ILNvA#u*t
zQ=0#Lwp+z7aKQgqCPKc&dtTyS!sMY+a~y*S4Ud`z)2&_b;<+cO-O$RG6&}YGY}9wY
zFO*t}!w(jX9^SGCSno9tjAk{D0H?PfaMR+UU(nyGR0m%oL_)3t3>^nayAHN~lCrKC
zsYcx!5WB<eM~<8en94?Z9y8#M{Cv;%sdF_Re%G*gmpIM8D6QZiL?7=thH?xFuv5bz
zxb>4;dY1aTB0lRtwxO|za`#Ytk}oG#iPS54>;0!_7vR7ts&z>)^7TXk0di_ubzM<l
z=zFv{H>SEUehGcIj=5AyD~);T>F-*OrekI8nCsz_jtT222Hpn=`|{cT9?5^?L1YGv
zLFu%mq^#7ORoC0!MMrY!>osiK%Cp2u>h*25%3}5|v>DxP8n<1W^3FHiS5z;#$EROv
zh5JwvY7zR^FcRM10|sy(2l=$4rG`+-2`&em!>lb#nr~^tz9eXhk#9|X$5WZZf7=u(
z8h9{*639MC|HZ4-9!8AVTAiZ5r8BypuQ&Q7%S85)WfH@#mjkm*VqlhuIj<`^p*I?&
z{y6>7CDvKZB2s0{)@WoeQ9K%qQ)L0s0&rvv$Yd1&4&-?V&xC1wOeI07y$8j=7NN~P
zSmfJv1&rShA8g8KMQ7tzDOUEVz?TI5Ur~dw*89e)xa-E3GCjm|Rg!@3ULYU-sYT;f
zLno1E>T4-`oaL$pu~V>rKhiQdrR1j3*vL~=-L}yf^fZG1QB(R<6TG;Nr;XL8MFg(X
zLqPTJydwyrj+4p8pS6$Yx#p|hAHQKCS*1ijUJ=Oo&ITs9t1HsjZ?5S1z<C!s!_gAf
z6BUA%x+NDo-JgTt2`Tjv=iyNHd;V32M34}Wsn~$nv<Ixu=hGT6MMu>am8AJ6uB%!4
zj^K$qTqkUJyI@hx$n33A!PHKD&c3e_V9f8A6)VA&b=ABx`GGna?wFK+ug5&D^=jCw
zIIL%@7K0i|)a_06fr+T0T$z=!b8rgg66NS<hv%-%w{mD&%^=m~&-T7AXJ@cu*KTk2
zUWmxp3lT}Dv*`w<)O6XQo=zT6ZbI67kx~Pk6trolBl<0WX<XrkfMgu#l^S`;5=Rl>
z5^FF<ZK;gn8CbX5!E+7Ntf?l%oqhCQFYN+ngv%>kCb=H`{>C`@dR_PJnD&JBMCp-(
zA^G>3EDdoJjwVlW&Ai4})~{cO2Q7pdA2S$b`Mm1-1Mw1YtO~EjL0E9wzkL@o2;Vs;
z;22`Rd2D%_VWichZKnyShuoTFu{a{O7;5<wRnvp8&QJ@4b^X<EmqfwjX*Kxj(GORa
z%2bzv+@p`4u79_jpnXcFbobT@{Mx+!lLc=Nd)G^<&p~!5ntI+mIU@~iDkx6#`he$b
ziYjmATaNiwpRxWe)}TQnRz0>hD8u}%#<|W_4@FOO0F<`;GB!N@PTx3w=r6jRH=&CK
z8|*eA{e;od8Pwo6;NJFh#)gOR`|sh6seMg@FgW)g_ZMJ)UwDssw|e2mMQsr6)(x@U
zS+f^w{+5X%)-3abj~d_l)&wW-$RsH5Mdy?P+b*BPly?`zfih<~h~*Dh^Gag#K$)`|
z<^UMtm^_kbs+}t4*?Ez+znKnPIWz3=a>SRsA95M=Vtz;DfsT-U&a$Dp0{yKK*(!f^
z%&GQwn{SYm$=X5Ndpm#T<`P|2Uf?)~>~Q{4bvwP;;ZPB9{ubF$jvX2)FN(yUkwccc
z^&Rq_?@wl4mk|L9BcaYdJ%aa8Fbr3CGXU%S>3O50XEshlCX+QvzOXkgX0>sk7d^MF
z5`uE)Lv*4SHd81D%ewd=heSYKzIlC27jTot(0FWqykO0w@^)}ou+sA@+=qw$sVBdW
zBUK?ufVcXA^JkC(8X&874G)I>GY=6!(H4!CB=qwh#Z@0Z4T~$DJi(PfRJ&Va0Lm40
zQTdO-d62vp^Zd<)Fk$iguUu@l5ly<7Uf18FOX$H5FK3H=gwa9h6+`9E;M{PwP|e1t
zQm_<yDE}ICYdocSR~4|>)WF{U@y^&e;?$=PXD?p6jLMOXtsEVQDj(^HyO>Ea%|bwH
zP3e!C?&Csw*up1fX-`oixv)fC0jL!SmXdj+hAfTo-Z3X{yc(^Hs0?Es!L)$+T}~w5
z(jCDj-TB!CM!v~iA~E7Vgsn)xbOhmIS7wNG6|-o!$czTkjNI$lEY@2BhMZsxFyvs^
zZ{+)xE|RW-U-c$Oa6@cx!;7Nbs{@hN=2|WJpf~Ej4SM>qDDBmt)WC^L>)$+E$XVFs
z>crEb8pYZN0hE)*ANPZ9@gnWB(wn2&OxpysUZ2IbMMC~XoKG?1oC{Jp>qBh0|F8!x
z2jw`u<h3?8_MoX%xds0bjLJnM%}@Kr{Kwxv`)}=68Pnkjk4bmZOkxy0+SF3_+c;s|
z#%?7{LzawDkqQAq>hqx_!kx^d)1<PfclZ$!10jd9XcvA?e{G|{*?x#k&e?PqVvCr~
zOMW^_nEYDV`>X-srNs&2Cu=B}vz_aOiiRSIru;)lE>&23QpO}k+wVwDY14w$f4yUd
z3scDiDrB}B{%91jS~l7lULY4}ZrqrS@m}V&!D*(OPS^s-*cI>kb}Kd4I%f?XFFpsB
zE_QB$8%NJs*%(@Ri*zNsP|0o0qQj<Nnxx<M<j;kdc7YD&z04VyPI2`gb6RiD%#%JA
z4uuj+6r>mXWFs+%d>Y_u8d?l9ivqc>6Q8l^zvViuZpLv<o%Pph`l0GehyN=eV~~iW
z0-%EYKMu(>r2i}+(uM7<+^V;smz$#L442QNhBl7NQU~h~pc3eCtk?G3(Nmr`xm58G
zy?{zt*Kv4-KSPKED>?i$jCXBrT@fOC5hiH32jgjSVrtbSr?r0MxHLlPA}aNdl9(^K
zDnIC))zG5qPk{+lVi&BPI&v%^Lb03O)QYIoj^}@L|74?X>7bX-Mt(Kt4aHkqcwK&U
zj4}5jh?TzxV!9gheV`zw3z~4dToC5eFz3LKH`M2%WgXJI!CUs{@MN`Va6a7AJdnSv
zu5paD@pQ+5s3qxWcJ5@^atG{>0Cuj6_jQ>KQB%>xDe}xvTHytf8ohK2F`GKJe)-L}
zik$1y_0x=fuO!59wcwwaBJr=KjjW}QD6&3*wbbGh*M52IYhQGJ%MbNGK%L(b6v?9#
zMYI#dwZX?;IYzzUmmXJEeuCcU(>SPeT?h?Fo4YYg9O7rGy`9*!*5Fygcvug-xYDQ~
zFmbsW;Zg$*wo3-T(;wyOct^XSm5q}{FJFJ-|JW|1#XDwvn?uF9iKdvfiMb1pazVYZ
zKkm5R(t|Uw9&4sD?S{v%-DSLGw)>9omEUC=f8_QMi`?NeBFA>jU@kMafowWfgx@ts
zf`1|@8VINTAE{1N8GS15tS&P8cg^ch-mTeZKM4V+V(D!LOC20K`&T>tM>{5>9oQYU
zJxpraf&@<7u1oC+-rxTXKI+*r+&3s+ZeG@V)9HwbQF=IlS;ErzyYEF;SPvdc?E%0_
zRYekUhVdCo`*CRafgdK<x|@iP0ZCHLr#;l$1m9F)J3?M)HVtxgMRB7u8<r9-o9ZGV
zIRC&KMY)7q`N%5#<diX5+bu{+4tz4A!NKn*WOdz~px=SC4!jP^Y*J;hQe`i3Bu~Bl
z#DMEhK|+-u*q1V=0ktnt)Lz{LxnHt(U4Dt(iOh5CLM*4_T__S=uuZs}sPHgMK(v^a
zS~-;R=q=~B%JTsMDs-7ihhJ5v?)>^d*lHxI2i@zoj3%2%qWV8f7r8x^L~>Fc6Navi
zPX|OU`c0Axj?l@%;w-OhJPh*;LJgAM&oWVYvvg-hr$jD}Pe^i~(q|Yx)Mva1c-H(~
ziu)FUtVCUbVzvL``iZ?Z+xlhQ_$h8sA8JWY&Bqrs7@NqQu%pMJ{=wD{k7NMR2@x+w
z3q#3-+j0m4{oh?rCE9T7o98V9abv5+Sn&?BeLNI2@#WB?odm;ijkHbMbk9G~tfxr}
z_C?8m`GH3MB=39s|Jj*U58f7XuOYeUZH90OT7~OQ7Rg5W4yvi1JBGL|A2;`Q(JKgh
z*~nC-cLn&35bGg3YVdy@j<f>u(&<03eEc#cdOnz00SF$w%6Pmhje9;oO&hPW<}-{z
zQ@R}fi?PS321U2~8P4wB^E<$ocVJAfkv$8S81v3r-~N}H{jO1=I^)POamS}po_2Jt
z6IySD`bTQ?mg<61<X=pV4Ok5(+n0H~#mu*I5ec8pR##)zVU&ZoSfS-WPfxf#u$ID=
z7RpJqj`;XV`{-vwZf@emo2&15W$H;KE<EGagqn$HW;FVV2zB2Qm<<AIt*YhG+1)&L
z1ZQ8jJj4!@Ns*s*ZbtLM$5fb%B(bzZ0;&upT0dox3*DXMaII13EQ`S$_Rk08Nf<VY
z2-3_yl5(~_q1`UoQyV@5w%pOI1k_u20QGx|e+9;MQKOS55~$gaRc3fTt;nB%R<TbN
zFDzL9g#~+UT!SZ4_zpag@mz}Sv5M_4C-T!jel$fca59GRsJA`{@h{v*UyKQmGrV*C
zw~&7!2!aafZ*9(?2vHSj)qgKbxz*OT35FD1kMcCUfgxf`?zd`>R2Cj+OCJV@2*_&1
zdj4fiuIkO_id`mz-;g@2B=Zb6dCF36(_O=LR52aJ-Mekb&r?Uqlkt7lob$2%huU#S
zfjoA~;v!u3H*KQVCnw;kVE=XFXgT>8?kVrE70Ky&q2`OqBZc6GwM8M`8e0pbRo#t_
z3hAszSb)z-BN~4>2!Y&zaj_Ym)V5?4<#k>=QP`OsOd1Dk@ZmF@i|tKx>3hMP&Ez$@
zTaWxY1N73hR0hY_kT*`*2Tc3oIO!@12<U|5yeTHm%EbPlZ{U@+ZS9=s!)7LFnbXbs
zCBRj4TWCQp{oAxgH;OS9_;#6mnE1$tkW=J11a!Ep^A!GY<`*<)_O77G`(u+oa6N9W
zUcm(DeK3&2+nb`s=w`jJxgg=bMcJ;&WgX>%#aZx+j-^4}C)7_1%Wp8mAd7R4HZp_R
zK%a--;P%Q_%_h2|H0X{vhue&lmR+r9oAc>e?lhJ^I+;Uqf%OeQ$t<PFJhoJ)YtuU)
z1Xj`R@<2LzF8yNNi3?!R0j)b=J7Ziy%UctwJCheS>ZRP_S4<EzJyfzw_#!x?fr9h1
zHrfIgVfA~oJDC5x>Hm)76ynh5aMpo~W-Sw;@vkZ_^6e2QVYTx2Gv+Z4k7k5fQVU`Q
zq}Oe_%<j&ABAYoW=g$u^umBZMTcQwRsQr`Ohb|aU0o^F(eWfsyOTh#G%aWsue=o;J
znm-%S;T^NMiPQ3rpJ9{);++VRc7hOpYPH!|oj!`LDJMx!IhsJ(8{yU?JV(N920fg<
zkp|UYXms1OzD1Pb?-dC|saP{^6<UT{Tz*>XdHjL$n#io)8y}wsRRGt06py$<u4A`N
z>|%+BQi=EY4>cXg)zfQaS}*!Xb>2&Etf(@B9L$Z;fVr_m6s=-Pt(V-`H^R0o0bQ<<
zybt=LEWbgGIhjTb>R*>^X~_Ir*6?FyH~W?E*Z~gV<CV)+fd~}uMSS~=w``JuVileS
zk06}AX+KE@$V;OV{?0w`UuJ8@LkVG{UigPWct?TrQxcooZx2QVXJCT77kv#7S`?#5
za=&{&NNtb^-7=OF$>06%O~yFASXvbJo4<@EbU<fWDI_up?S{0lqG!2C!4@=hG1g-2
za``n`5Ka=BFzq34I^usoB93|UnDw2-yq}+T6k7cXNZ3$v*;ay!$mX4Y9ff}!E%|~r
zqFxF;h}Gt!K^GEnLVVDMQlO+-tR#pwWcHNs{hRCzW$1pT`WJ!OpH5ZKy*lexgaub1
z1EZ4p5sUYuc~}5bH-(bheb}e-=Avn7C`%zN)JqAE)-)qsHB$yjO)~4~ld|idFrk7l
zVEvc$ds@-7pAVS`>0(}n&`|}&`U$~1-jDLPh&l*p#s<9yGWkQ46&@Jqm77;!p$*!<
z4Y8CVV~W_%5!<N0!UDv4xDDi;jX%%`J2TlIkcU5eJtejnocwrf?T5Ljyz*VSN-4Vz
z<cZ|hZu+)7>X6C%EfXt(2vUuF>QpUu3go^h1(GjHfr62W2&fb&fJ(sw?x~9OsmhDQ
z_m{>hb~fVLf=a__wg!~=js~Om4zy>TtTYv9O7~)Yp~}aP0T8!d<9YP$E^V2|xd>1B
zD;sW*qCE_*6CZ8Y-Zx5~7KzJ5wTo+$K&i*!c*YTg(0t|6E9^-X-{Au}A`ghp&VL+v
zIw**3_8{<I9eRprHp!4ji&}n6Y&pw+BrU_P9`tMEWbfDQZKb(95E|SVXj}Io@7nU@
zG_{NAaU_~)qe&4ouI;yuac`V<#!Vtdo=@h<iBG3ALBhj8hH?_a4Es1=q(>UXoW|+g
zHoyDa#9Q;Z`Qsbp&xA{WeQ4!Vb?DJ>l*IrYZ>xS|d-&`R3|_F9{rMZ#FIsfj{0?*`
zDJt0S)hX_*<xE1w-BJzY!t-*4b9_8D4J}_AuO8qoU10W)?=Ov~#q!WZ2iPJ{KDQ$f
z6C*|lMczDjOzv;|&23X}`SA2M1LJFD5s9K3VOFm_1J!9_xbw9;uu<Qg-a0pJx1!V#
zgR*WqnpQ?vZK&^H)UbI!CAK|!KYT~%`6qLoyWZI!!DOZJ5h7qSa)I;hNKxp!Ppx7h
zYNna)1#__m4SoZDVvugn{^>iK42}D8GgVC@L_gos1AzY4nq3?<ik^`FW5bKSU3J(s
zK8k(6^<42tOc)MGNOn9C(^o$g<iL@SvVb`pfzs=Xv>s<PZk6;7ac4g-PU;b=i|tJ;
z^dAwhyw9SrBpmS~xf@XyksV-QM^{2o->^Cqp*4;g+hc}%jdDjRjJsl#d7e&*)<lg)
zU6DOs{9VZ{ky=C^H*k73W*Tax?pWADT35(NSqFk?VZaKM&Z4HV>n}}b0;fUgOsb5m
zE`hQRMAN7Of1s7Ar35uILzTNDu3+FbYoQ(geZy<!xyU(EPiaOFi2ioVv%^lgCC4Kh
zHEDwT&WAN`mRGJ-twh=?0YfV$*8a}I!px!S!x`@jFqZH{-mgG^`oQSQkmutj>rLLS
zQ49>YbUsM=^%xAS5Cmazy}Aj;_+dWIK=Ss@y=vBNfaiF7v_JT737ulUDmJ)GMvlox
zgF7vbtbHCDVDlkEQ*dvd@pl70IZS%7K$ljP3+fe}(5x@nt-oFM{TmvhIA?la`8rF1
z6nZ_Bn|dH!#P934&q+?G;g5&*ikO!(=M)fdIz{SMs%@YxkkWg){EsOfJeU7*W`gLR
z7hKO%r3(I6Oi(1p|Ib1m)@JLK`IlUXNCH>pO#S~!tU=+jqDC_~Z5LdSNEV;PRTz(9
zkI#0<ZDk;}+?NBX<%Eu7jU3n|1)Nfk(1!O%{qvufo^nn5w!q3|mRXh@Q<aB*y<DG}
zuudR9pS6fi|Mz-j;ic;-gW#UO=3&2<DopS&9t!&n28bF}FwR`W8swqZ1y-3}Y<T--
z86QtQII?x}7Ni&pS7<^rVYp*4h>A-w!+sM(KSw+To%WFPGaxI(a7!+UOG;X-{WCxe
zJPsI?uDM%%h5*Dw?Q*e#w`PQyv;jgSu|Tu<lR0&9VDs<&P`n-|d^fV2;oS27$J90d
z<@vt-Y;)PmSS{OHwrkaD%gem77nYZ8F59+Ucdli-@7?E@=Xt&Ef8ajP<2nz#agZ6i
zj*^h&N0V;mN9yOx$QGwS=$f!7`Fz%<er@$sXXt-z6w0u*pVrx=Cs;e7P+ba&LG=IV
z<<p(=6MYHs%UF!MCLTG+&-m-e7nl!2<Be)N#;(o1YW{@VK+~Go#h7hSNQj=y`dI;_
z0i2Uy!im%8etQf2tkS>YllkEHF-so&K8k3WsL5*Dh=3P|!8s93YRFD%yuXhJ9tE<7
z+^_k#W@8WUK<hIYXr0%6H79u0V1IkuoPc^>8c@4z&Q40O7%FC<-B5+|&?(fs$xgc7
z(ljgq?{&ajxc&KQVG8q)_?p0LvfFh0rWt1D;1{p3`5k76&FnFqDl*QtOf^1^xXxD~
zBI>o#s6!$ionwmu3%;_7UrayrX<iJS1KeBjGU;Q23D?sfL;28BrhUgvZgu^kAQ*d|
zkLfSGpuJGe-5Iv4KF?>?A#a+VVBCW@sY9Jl0pLWpskZn9%&Fguiw}Vmg1cA8y2k<Y
zOa#;$*NMxCwx+;5%}@*Q*Vh~O&JF6F;S4Rr>4j#Lcth1w{<={$u^^o8dHtFI@1r->
zKIoyApxB;*vQw?tG8ZDCKNdUb82a`4;gObFz3ti9F7t)o@CKgXLZLIQR!fc8*9PDr
zKB1|gaG`8prU_L0E4f&kjiqNpllRA?oB8@t_5n(i=u8#^!>&lvv*>wJtQ8v~C3wj3
zCzaMRp|Z}U$8N|x=LMaML|}^<{Y}z5{4ooy8!=Ox)2ExHz!}w@;lP*bX$2U^Wppb1
zKy>cMU(ymn1IoAO=DM$p*YZ*yw;O?Degv0&;YY}n(ysGq(W{*PZvKzn1C&Zk*Xii+
z_})UMQMc<}!v0FJISyUtQBt6}9KBTTKu0(ZJFA_e{$x*1iSI;B!^P5lmB)|!9Hk3(
z`4dWp*b9XM>wVjvUealJ&F2%wNA32sD3l1{k#Jsrv7*HH)~EAIGh55U^d14$Q>c1<
za_xHb;(u7^oLEXq*jv=WbKm52F>7<~n$SXev}f*Ld`ELzSvij2LVO_l3ZljF;jc5U
zy3ZA}gL$x!Hu{E_y{7N~K^suOWldmzzqd?FwlpEV(jV*?w$L{b?nHmKlUPH%+S|Gn
z)8{3!&APM<3Q?>+`}=8k<D3xK8%2+i?(ap-;xZpkz+c6*#|b1A1?%r*+o=Niv(XO1
zcr$fpu8IxDpekFC!&lZQ`sTo8VR$LHEW~Lz=M&Mip|b^73|oZZda~hq?_We8bNzZ5
zQTN<%`5uBRIBo({DJHh-5bhSqS5+}iQ#;xPHyyr~`4oD3od-7o*cP&@7mTiR{NsPu
z-}zG?#U09LwvW{G&DE}h$H3ae>Y5M>O7rnD<_x8=yXI6A02GV(5-#Nlc~&*rR^r@-
z-8IrbHK=a5ILHG0M;)~L(rQegEFGAMT`1SrVL-d-x4yYCSU`&PM$9UxldPB}%9pUQ
zEs|(23lX*tv`raW?Su<ca3k{7@R|iy-a#D$kdHlYJRhhA_TO?MiiW31Z}FZ1&?4g-
z{4C5xS&nc4sa`lc3*s|`S)cT$LQ|OP8sBYjqh=0$rA(Ew#zo?-6t~IMOaZT~=UuZJ
zWnsn?-TufJE$ViwL27MaZjSaMmL@IH&O$5&-L(uXN_cyrDPIcK=ot;n=S!azix=#a
z3-?C_r`b>x2bg2=&BiU0SXn=A8z{GIlc@580fH<SFhC%Eg0$jY^F#au3=qtYE4Rq0
zw!D)Ki`O_7@SS_ybVcWhx8JRlF2K$ydJz{MaN7y~7eZ`gGZ$d_`U0s=MUq8Vamhzu
zLos+&r?BlPj$fn62x`nAmi`9%%wf08Iycs389Cw=7w>+78UhKXu?X|^9RISYIrPP$
z_U_7P{dHsIE^|Gtt>eZ1c5go-+OCWL>~W?g)o8rpz9Tn*@c9B6+&OMa%ZuKho-9=V
zg<-x0vD%AYNqdI=Ei0@eYAC5~TFwEM*Y(b+aNpKf6eFfJDcd1jaHXwhrGGZdN~Apb
zro$g&UUSriMYBL<@?bl0S)AhJOGj^Y_1K=Rcv@pqD_$z^ox<eH9=q=?+a(jZjeZKl
zJPNJyAoQ$nKn|Q+q3C|^VFKSVT!hjpNHB(r0LE|ws!+O1sJs8eZ~>EDf@Nn@bzRxH
zG?jO!nWF!kW{MtzRT8i<Y`c=TH;h=%1LW5Z=cemO3a#2~_2(x3&a0Ql*--|Rmd*Iw
zI3&zE;xO<bae61&nkRYv%I8b!qR^O{;pyAu%lv%Gx;q5QW6c#xVf7yf9v3c0<mIkI
zvj(p~Gc6kmo}2<Ov%4Zg4_+4QNaz&3d-Z}m-m0&m72a}Gyl7`CUd38n-40<?e$L6|
z7TiU8gGlweBFT5h=|v&tVk1(pTT}&9zaa$HW9P+#;^x@hxvkP&|5kpId}`^Ge<9hT
zc_#_UzmtTLkcgPTB%vg5u(%Cv=F4s6zcbkc^TL4-{m!Ney47=OobUhs4?Ec4ZR8JJ
zFlR!V*XHxf6LQjo0A=XJzkY=Pfqx1b0uSHV8;AHvW+Axyd<OQ<Hl9M8{m}-qG*}_i
zYs7NsDQa@g-+(}6GfFJo1;Sr$4N_F3jYC(`xs@;5Q$?xa-|@r<gP=*4qvEh-e>Fq=
z!~(KsH&@BL93*{J7Kx9akzWE-v{0XD#4W}y;yZnkoL*G@fgzdi0+Bj66HG~wyS;Bm
zA`n$(`YgU|)n$B2c=NO&ArYnMB}lmzU9qCO=b(qDJNES?^gZ%wkfGRv<$+~)Utkrq
zp&I2DA)Omr52Oc#PQ<+d+P%IBkr_W?C~)U1xFQYqHo;6v%r-z09-=0hYTf<+{yjXr
zsh<E4cy!MDJZteT;uL@?{K>)c0B5-%Vv2(9BH9ASpJ(u1%eH_A!_h9d^+{m%v<rAJ
zY?+j8kdS8pE@iRCp)3B5{OfP6?JniLddIok!8n&0^A#WPX|&XAuMZl5@F<})AQrc<
z#L!Z3#2Imr?+~jRe~cI`-%NDrhw|*(+5q#_x;N?@Wev>;=Ku3JAQ`)4{Bh2uue17k
z^2{KS^WXgbP`11%2_dP;^B5MaZX-T1*r!O75b@!x7GogyiEQ|NakX9axFDSA%n;=(
z#FhlWVTh!=yTiy#lF52U1xnAvV$8>y35SG|RpknGAB>wW3SoR&_kLBE!IB_>e~`EH
zAAm8rQ~5qF?)YscY}5g5jCMKRiylk|fcVqmDFOMJ7TSQo-mFuFplnCNR3+mWia7lk
zgZRCv=6P?b?bR1|z_o@w*gXMK8je^4z#@L{sv)GU6jqvJsmiZ^C`P?omPvzowg&Q1
zim1E{Da5k)W854^i_?7|XZ|ngdteWU(|34Cdj9Zx`J~E0?C6ak%Ct5MA0MAsEI-P`
zNBDLIli$3gF?!b~JKvhAcR%7uxD69Rx9Hq28jhQEX!s@sm78&?9N>fTZ%51mfz+&I
zg%{uEFqE7l8v0=Kn@6g<1B4d>ufN@NJDZL*SbqAq2E0cF_SEh)Ff8zIWD=tO`lGSi
zTKzh*=Qoe(;vc(A;w2q;Bs#8)HHf@#U=C@KpIueeJI=<q+mvdKgNS12-TGQ-?|S_h
zZ!6!<ZpK#7pX3&6s=Co~fKvc$KzI1Hsmerg$GIQ$vfUvW`gU&@I{X$CjCr9)rKMqu
zsU@uACUmpK>a{z7=xigb>=RfEDJNYZ@ttc_6a#RSh9+BaJnA<BeM0yu@br6u_h)8>
znKgDQ!^xLtGrvy;qcUG1I6lNzUeDwrJ}_VWBu*!WogU=mMKZuE0hkG(eI(9Uymw-G
zTWIU2)wG&ap66S#nJ!f^yl5v*#1`v{)|{BPo62XmYD6;cK$Av;pV3J5;9yMj_*7T~
zxNgq%+0;V&5@$%w^pgeiC9PKwey7#I`k9i~T;z*mWPMx5`dqiH+VurhRqm_t5@&uC
z-hLR7*z0$nC@*dbLcnMj9m5D&>a^6c&?D;pKbnbQ@>v&^vGfIs8GDQPe%1`x_2{9=
zwvrAMqR<>ul9H=mpOR~6-@7|Q#JgGykF_-o?9RXhc4z3?f{W0?ig;Ixb#7TDojCVw
z=^oAzM}W;)0{XOemTVdpj4y0kY^vPowV$VRZO<`*<0jtQK?^b^S)9Zt@@i_2u}Cis
zs@;59$#_<#p23!rUaR^)kpjh!LpQ>@-EkPwMH`8wG%@O6y__VTj{@xv8DhloyfwK~
z|EcxVGxyV=i0J)HpQgPB0v>f(*72!>$IF?*yK{8dFs(n=_Jy*XM3BcEzE;#5z6dW=
zRKkM*?5ee&e`v@Kxj6c0$z;YI4>_p|7*Q6QOIdVq7E)kbCs@)nX;@nqdKpTKZ;$}y
z5lu}W{}%Y!Ol8u306P+h1K>CPdSEgWX*#p;eQUVz1gFeDN&k77nt5u=+-d?Wu)1no
z7i;zt^#N?u{G~IE`KeO0m*&>zKW+=X0YJjPe^R390?0~p5)ZfRbVaG|+6`an=)PzT
zIvZHGVW7*}NEi1Y(Rp#zBL>y_xJz~^`!zc5cIL)L?!u8F_zd)HP{6cn>~fR87CyFy
z%jlcW&=06)PajUIqs{%c2&S_8c$7<%MzDtoVp$@()+9a)+U|@cSQ0$d3D6uaGXo6o
zgPe_>6_u1qk$Q%Y@dzdwX|%H}xYO4+7tP?xseJxfegP|C&-E-q?%$E2^HeZ01ZwE+
z2hZU*8^CjTACCL--}nC^L(laOlv%dqieP1VKqGiGC!+t31Co!klULwi+<~_Cj%)<h
z5D3qkV^b3>=8E}fH?-k^Cg&B+n^>ZSpH5lrT0sR#@^i#c4%ZLA5m94b4z_qnxL-Fc
z&jdX`oOo~enYxpODkNP^t=}2k|Fhsr|8?7b_R{hI4Ssm8y!o7S8KC;x!UT>0QM5G0
z8_<^>&s*|#Ea?nsmfEAL5XK`QmewI;3&vue!r&qT#{NQd;(!O(h#Q9;E-Qp*$N!jy
zD!|u#SgZ7Sfc2v>m~cyKb9FNql>r_GUB7-Yt8XVv{RM&-iAu$^jRh)T#*nX9ihJ=*
zwMg{n5z?h|HpUdE&Y6$)K<xRNH>>Ya=<Y0Wwi<g5ysBlJ+1s~%Ka27Fp1dfwTU@<J
z_m1TpnmD~{*YpIqjt%Vy75WW9YIq&ogw1DwB;`9^Ed1@R*HeE5s%ooA7}-8&C4lP@
z!U*r5u@@Ux>sjF>wAX$o2O%Ye6LcYg?m@xKsq3~~<r1}<Z`*0%jr$3~*K8^%w%j6%
z6H&Ux$s#3AqCSZGAmLNXP$;Rjtf`pjx5}T(_vK5^kQtu9Cx<ejN5@z16r~R7g4dTt
zr4lW8gRsizib0&GD=}^q&j>MW1RqH6?TOW|qm?Yvh$x=e=696U|EkV4=1y+G<Cy8&
z#L^fJ<=X=^7tbl<iU(FDZ1YED58IYm)X-3pqX`iplXe<PN&5aHDj9}b5|-T!WXjZG
z+2}xS)^iZB*B0{?|5#jPf0)XP_|`XMa?l!MxBh;z&fh(jE7~6rDjw1oB%62<Q6#Hr
zo<Z}t0zK|s>L8_Ji}?|e8CIPyE(}bOhLU#>OQ>SFf(0236S$`;_I(Rm9*ovP*>&>x
z75m?7$u$F$KJVx<#(6U4kNtqzQJ*#CB>zcF^UWEsXSR8~Pb5b8yu-ThcsvDQIib!h
zGk@kuQ)`H|Y+4etGthet?WlOBJ8Ee&91nT@xsCyF<z`?4Jm6_exsv}uaQ%N%K;)qc
z`k<OerU-F}Ep3#GcE?rNYpSFAhs9)k5r<t`ZF()A%%n$|3JtAs+WQ^STQD1&78_~>
z5RzdE*diIi`{QBVgc18^+q|EGFU|_12=A*TD;^rIA0q<kM10QkP&b`1q)UwOH&Rj4
z<H#h+N!a8pN0f`8L5k+EKa!@$IsBv_f)=GsKH#HZ8oav73jR(qvA!AEm^K1$6Kb%|
zB;sACzGkR7vG`6`R2LzrY!%{}1+JN@0QeGcaqgKF^d0;`ANzp^fVU!Jq?R;yB4GQ>
zi8W|u3G;vTW5u|7V-37uXl-e46bz`Ja9J!^J0{kQx$o8Rx-3q=G3xO-UVev?A938m
z0MFbT_*>lJ-u17$X7&6nC$={Y{K75rKp4rj)*jP7^_Q7I>*BMjWuwQK-$42Gno=~+
z4rz;Mt*`$tWwsx-)%zx)8iaywL$jCL1J$`cR1vMY8D#qKZiILbVa<#|6+_8QF1GZ=
zldmb;URf+x&vWx;v8!a8%lFa{u1CfbcoE3_oXW;Nnom2kV2#;x%gn!q6@~VZh;ck*
z7<`C45Zx;l28A?zrv6VfA>bhgva_LE1qF4g^OfTDmg;R7Oq=U!HxDU#+r8jeU7}F!
zF}q4-{>W|!)5UcK>HJW?$(i0f>pf8*w5oXjvDfTUeSjBDVse)sO8{dlM~dpW+i$w>
zBcFf-h;^($7xTsdj>GbN(H9ITDhO%s{!=1NSH<Vof`L%6H=(WQ04QIl5xc2qpH5zS
zqi5f`O}R5!yRQ8}`i-r`S*kjp&GK>{G;bx#uS4|?{@mNYu^xlu(6hg~OMhG3SCtlb
z{sOtZkK8KdrN?t62|C%D$QAGnxF>PM@*B(D$5rH7?ZNvfGe-6oR`fFjA?@kMj<(5k
zZZy4RiwMcVU{i`9K|sAjKI7W`c1#eOhi<PPnJDVd=id{O86UxZo7RVLTb%LDpyCaQ
z@@kwo$=q$3A1fCy)bjF7WE;vjY(^hOwC?@nkBQ;$&#kL@wlAtSI#aK$?A=^kNDbn-
z6P^6>no-qy{2~LNBd*+*ZE1FkEDhNK6QoNc%*EE2VLDQyNuVO|TQ=Pf{tXLXj1!?0
zHS>Dk$rDf<W?d@vt6f%y`1(I7>^fyCBvKsL9NymbYZr5I5qb!_jH+xXb{TXpw+3BT
zyY-#e?p*1RCbT>fGa=0Aa1up;Blz2WM%MSdt3}CK*nPB2Mx|SE*JK><n8lU?wHIE5
z7WI|(5wk0&4DdCZ78a6ac(xse=Q%=pbO>!eGMvN?BwoOBl?_e31CJcfFZR;>5+dR)
zq=`$1EWeSB51lkDkNwBlkU1W~?WpLfEbY0K_gIm%T=93q-W%(38&(IehY)va%QBMS
zD={N**~dN;68M_rW=>@!kSXNP{2UfgsP>ggIV2rO%Wp|$J?GhPOk1ibzKyM`2;OsY
ztu~lh1G)SH<D%9JmPCu|E()Nz_OfN`1?pXsdaF?v1)2t{cRJ--g*%!?$;#<3&G2Eg
z5RIO-R4^N3xviQqfR&3C1ZHDk`)4>hr61TyT=gJPGJeI5Cg#n;h++KG7y=gD%$L>A
z0l4}v#-LbFInwx?Y|PfvFn+@pPe*GPJGrGcOuqxL3Q)hrNwjsL&BQUyqPzI$qmk0L
zo`Myjir3&@%J$cgYT28+cB3No-HgYIkli9Og^DYhu4odEVux}O!8+>~j49YX;)h;#
zn*%1R5>gm+GNm61WmfmeJ^N1Xe^*{(0SnX<K_{i5jN_s742krgIr#7sV}xaKaQX40
z^&j}{j9yy{TvgJaS4JYPp5<ArB_~-BYgMI)B6LVm>2&&85S^gLkE~RC+0JQ)xSO*Y
z?f1`vA%5;jrZP;w=n*$*WB+4Pt6$#9(WyahDBEKq2TL%7Y8oe2-OXkqm%M--fSt8v
zlN}<14%vJS?ZbD?aqSCv)hS15h=w5i2|Ro1<y!6B7Z}MD5R82CEoY+GB`KQZKFheI
z=186xik1f{XIxrZjh?PMVcf5Bq0OZe$+f-imox404(WlvRV!PvkpREQz+We&pOsoZ
z<3(R@6gzI9`9kzOK~cr1^MQ>g04RUzFYTGj4|V(Ko+m_C9i)6A<FzCNr5fi@`O%Mb
z^{`;F7nmJU4I=N{W~DP8T|!0PM~|U$LD#brfO3_8@aK)<VV(7Oau!P$Df^DXUuoLd
zU^=Gz=!Sp%>=tsY53bo3o4_?&^;I`AE7;6yAB?TL*e<%$EV;j9>%g&oLuVxs)q-5<
z9xXAr^Wz1@P)w}rO09E5wx(gDbtfFr+7ZOKj(VQBV|%#Q|0%J%6f`4uZ&)i8qD~@=
zY7D2U*k+Bz0STtEb1NX>8W}+zv#_MHYa)q|EOAB|x2s{1J}VYbZU%KDZ_gqojqry=
zNlL*Sn$lYlKKj8|0u7U*zn=`cvteR=vhwQ}zwi}>!&N4w@qI~*vR}@Rlj3uLCM#m%
zUbd?54LV~Bs`^&#XtigaqyEUSL~nGThZak+(Djz@as7iK;^}o1$q^2BzW-BlB&is!
zmDGo@Kk`83l33fb4_*oHk%8u1&Yr~TZ_Pa3i;gV0ptlImTY&1QwyB_xL|mBiLSr8F
z5mTpli{2ewrO*db8LQL2E0fL10kKO;fYcBUmV-De3`3_g2Ko->)o&_!3||0g!s`&m
z354MT)oquZkA5S)@s+*+51%ZWv#vMlD%2~6x>^Ay?$1Y+lkcN%>nv4<b|KnI;2WvR
z0N;p7TX#VY0Jd3a1DDbB9NLw?wJYE0EM*PfWL3Fq3URf^hStG|h8e4P#!H=9rQM(*
zy_r(k!>mB@J3H!7e0FmI_2JPyF}1|wvfPZ^s9~*AXa{>ZW7LECTAR+RsrT#vp)D6<
zG<ktp&9H>gn+McwFitM_U8LKx;CYlqD*d)A4QM_;0yb5!q)s_5ONK>Ap7Yow$nXrB
zJYj}K@E~>gh`)%~>-nr}ZU0HeoE0d6rrVy1g^{`7aVsacKB5XuNJ~i7P^Y=fg!0A_
zp=a!1jIJ-69BnY_qWQHVV?8}NK!C=IPwCD<Wy%ugOOc5oK^u#aX77gQ&q!`|1tLL1
z0)}__KmF+m+K8p{Q+y5O6G(J|jJ>Q6WZUo|;g|OzeDY*j^z6oV`I5X{1%DuL_M>wW
z+U;~`ki^=5+~<|7Zz%@$m-E>ASNyO0s~}?m?5^+U(*<4ryt!@jgF)7K=iL~>VSr;h
z&vGu>^?62UhrrJPZH(ZhAp3b)mr)~jL|}e7^d@U59JB{!y^zo_I1*R$GLXC>q2)b5
zrsr;4FIQttJ#^dtYRs%gQ2vcem@|{X&5@%Qk}mV86e4roh}NsNce|?yi@}v5JQG&d
z#tzl)o9;*&p4QA2=uM7s>n}|as{avo9fxB=QJ)q$e}nS^rUX^#=?|_ZfPY@w0f@Vm
zfDx{9buhxU`P~FtU(;suI~d{0Aav7}b<=&H=L>ibt5(`lYcRI`iJJwtRWd)`^{%o<
zoiVejG9{x8cpgpqQlFN4)t%g5njMbFClb|el-dhX6i@2m=LU*Rg1ZJqndcucU=0nE
z$ZR&DenKGiLuC9YUL3SM*#`~~(&MV3DbNy1#I%_03!!_-|Nc2;l)TNiT7M-%A<+Hn
z^Ki^({Y>+y<}tggS$*oNvo?sDEB3~o3+X^-_SKuCfdosy;kq-Rm<)o}E3_2pu#lRM
z%kd7HnreeQlDMCBQ$*6m4pjX>8S3%$oq#wk4$+YB!qu997$V1P#2BcK?0|#q>heox
z@K*4LW@GB_g8w$~wXw_9u7jltSuH4m8NN?Y6|?u1|2e2EaoO%QCQ<yrj<z37_oB}n
zef7Ii|B?ixaW$PHyEAVn&8gr`GO`*CZ5#X9hxBHY^TL*`^A<ynE4$@P8Q-dH85-RC
zlk*tqXayKfJjL$W7j)o<S!hv;-Wv#%eJzOwG2g-@!jny*Dp$<qj8+6I<?QB$@EiJj
zxSyc0Q6ulqkf~=#hLk@*Lwml2=~v625n`WH7s5p@(PwY=4oElf2&Y+R+a7&Mi?&1E
zI*~J(Z1BRBMwx!6LfPS$NYau+pCY0?$9n~RX#NcGlBz};n{WoKL+IA+XZfJG%V!6f
z3L)3VOkmu4BY-j8&G=7G%1ca5=LtIB7B?Fh!mZLXR8q$h9@u>=8of%X+YKh2&EafT
z-Q?MiYu8N%XnS1L);rwbH!aF;{qOuN9KJYJq`2Ps6F5w*{d|VafL)MML(mcqI4P)f
zYEPqW?%rpZwd?_26{MXc%Fj<fITRuT64IMLEwziqmLf(zPz#WrY~765aGc|QlfPJ{
zr7b2%1m&yQRf@MeIKh3*7Sa{je8cnbRUqxW7#vEwASJ(T7e_p1{gmA0^`MI$aUn<X
z?FkyD62oT<dvOs3b%n>es%(;K&}b80YsUu%RHIf0OZ@{#hhGRTUT{z*zLfaEwZTKo
z3cbWM+W$eP5T46N!gY}r^znlqKUyNk>IWkD54Rf7-?j(Le1AqmYlSKscB;y(6J#Xe
zz?pekS8uL_aQt?wY0?eH0Ffs0M{;!6+2MrVb$zUa$|h0Px<zRvvnWnl(R*6{v$a(X
zxrx11KsW^t6uY1A8`F;_vr<9l6S{A@8reGtbriCQT#k<Ha!zO~wBCPL$kZD`=8e0f
z8&JZoe}K-#OH<xjWV7j3*m;CZon0*KC2CTbB+akAZTd;<R&;Nc#+G~Uxap^Ho_z5|
zG9a!&?w65byZ<Xp)%lO(w^O#(l=8;j6y|OUuxooH&|`N=pL#}kC7=JJdkC`DBh~!P
z{@K27Mr$$sY_qTGhwWZ6Mr`M<BBu*kA90$;Qf%H5{n3|p>Yw7Pl{-%wK6a8MjeZR<
z69TD?96#AHga3?DFs_r%3jW!y++u^n!KcjrA^@k%cud*zu?9!sFHIU6VO3Y_@2n4}
zE~nV=M*#XA<Wn`ji~ws$I!rp^3FUX^uqZmhlrLSxeN4Lio+54fHsao}Bv7Tdie5Ch
z>g5@CG}fYb)H1n8<Y`#=$sR)8XpV(gcD}n9Xk1>JoxfFfy1j|XKTTj-GhVLz_Nwn5
zK&lOPuM$l1NHqn@;(Ef>g)ZbIT3B2p(AAt@O#wu26MfvyZY*qAFODFBUel3ctbF=u
z<HPWo>QqU7M^IFHKJ&T@sb8Ui&}erD^r#5SFR=KxX*Cc2$=;8mLfaq>8Ec@(xPs0f
zE9d*D8)h=~^u!7enWYOpT+2D-hvUfz5pcq7MF3+16A@W#?ui;itp0fdk@$WWltp>?
zfarS_WC)|Q4k}7z^wSLFbfsA|w(d_L7tf%zGC)*}WE4#SC5m<AFP!k$|F&o^UjAsL
z(C?77B2?VIE#g+gtA3soS{pCNYVQP-U4{<Td{27OVarqOce2h4fsm^BQG)$QT6oo@
zrwVx-I^fDIOq)1>M`Xu-*wwFhDR>CLa$&iz#@SjY>;G4Q_oxJKvS1EL_6>O~g|;5r
znBT81Cp|ut_a{`?F52hMaC!N#4~{0>bgMX6dH`sm2-4TK%PVu8H~RcvAXz-f;0F}o
z+#^pd5uku=KEtu~;I-jaOB?VUp(e<J$ai^+1MjCJJ=T0#v_y03CHjwCYvv7@SZ}d!
z_(g@-2*7U7-0A*Fv=MwcFuWsaIJtIPQ52}25wy_LAxjRV{z4}vuk2FG-_r4t0VRUv
z6<+^AmYB-Il@C)?00|c3Ub#pt=ckzcVNEu?`k*?pBh*Ds*hn$Y$R87>LFWqg+^rvf
zViMiD%um-Bsd^3RDpoOGvbPukaVJ%XFt2U_vez7H@juMH7QH#Su#eO~pGDP8>A2Dh
zNeSXAw=8_*b_F?#;6)D$GnM-#89t%D5umzC%!Ke)AECHzzHJ^t*3Z3ExYlq8-i~Sr
zhjKG>x$e;4<i^8Piw9BR!KEk<o$kukd&sKi!49O8S3~ohPr^iPVx@Beh(>Wgvm{6{
z3tMBpYb23)KEN0e=HpL=rSa?qJ7Cet2D<ZJdzXv^9m1e4Tk+=bPDtppdr;b63u8ik
zr^jj)xz+EFOZc-nUKq^=A=N3hABFx|`v?Yy2~FNcPvmCvS=5UBb8B{{!QpT^$s}ch
zuKaOqN&qwEfc$68O*_d3VC+wfR{w;UkQSAb@d#UEymT9N)LoB><Qxdn@2`~mI=zvf
zT`7Fjrl2#%u|1q&9-if1EanSC)K?c?D00?NZWk4J9qi+wj9xU0!EYvSb$QDqi)Az=
zG;jC~o5Z3G%*scXU2Wg+Tx@sfJHJ!?^U3?x=wQs@K*m83OU=q#51fF|=-jCO3b^;9
zk^F7dk4a?U=W|tk7(5s`^7-n7KsoMQ>wp>T7`>3QDP=4lq5az#vHJYaHxg6a2w7pa
zHVdla*6b5V2}ZOr`yE#tLyQ0!YLZi!D`~VdZmrw;r{Q&nuGc3w?5Y>HfT}j_54fGT
z-B9!JEAnUa>hoZk9k6R++~Rklhqy8_!CLyrKavCGynPe|mZNDIW!nUozVCXV*Ao7u
z--cDe;_}17SnLh?142f`r0uiK_Dx(XY-)wmk*V3aN2Pboi<?0aFP2ACU=CIO;oL?a
ze+$nOdMAbb6Out#a$waP@u$3tY~&-%5sP&(DMFFLF8Ag~z*TeF_!C9}YOZBTJlU#V
z^p~?D5}Kxf$+$NOu3aH#igELtRZYI9#6+coPj9Oxj!&mYl+U1<lPA2#AR$bxt<;t#
z_~e~|Y~+urcy8Fp%mfCP#2{XDg%oBCQYhHTQ-?t->$4&763!PNkv$T|UnX7hj}#P*
zD_DEEqk6CXz^@Y3(Ud<_Sc}H)gxF1q5*oLPfsZH>iZ+7Sa{~N-Gflm*&F80wZTlSW
zKV8n_4Qman5W0;lrcIZmHj-+5+}nDTmdP>2|GY?r5V$y1-8)L96hDUBj#P1yzePi9
zt82N1gWF;8buw(KzO=O1jqtG0c9(VYHGu6>Ddp;H1Hd3(bH!2A>>kZw|H)4;r#h)*
z!3LMbK$_0=%D(!rEgaIbKe2)Csw?TrNS)(y5Ras0nLo)kqKtMSl`>%75$Z%2qu(m^
zM{fPZ`4-Nz?Q}hBBdPg=!Hg&x!NZq8c@YFoe}`$}=26LwuAY~8Go>llEtd(OJUx%u
zmEJkXHNZ=#<SV1*ie}A|lL78k&_t_ta*XCr6dX?Z&&+9}BX!Ja6}6|cAuKR(Q;I)x
zj=1y~j^tbY%ju3HGVqFf!|2uJ)6?Yg8#;aj88BJdIQ>Y%rJQB06X1EobxpC^GCh*H
zM^Orp@5n*%9ly-e7RFQ75}Zx%Vw0XLH8~3-%LQKJpqY;AW?iLsL9*JsxiE?*Ug}rA
zbX{J@BOH0p1YfD}o*T#|Pq7y$_e8RzAk`I-I(vpbqTwiVxn(IcMIxc$AR%jS_=z39
z6b~;G)AjC}py7=Ab!(E+#e+SOJ+qX<17=UmvX!klg>|&EZT8G4m?soHmxja&Z4~iJ
z5P@9(w$82l$WlFVyGMPBe9x|C=7OI`sb=H29_fooPW%(NB16zKl5CTGU3D)<6S(A-
zLtbz=i0L_oEAwmZhyymCEbJ&{`r>dK<5f%;3y8lA%N{2kMmCzB;D@mmS;bZM&ZxoZ
zaej>+^7_`(sC*#}h40jXVZ>=9wRaOHT@6qPB*WnFI>2Ys>B`R<k5O|;n%ecvv)9Va
z8<+fK>&c~~A4$9OO=^^)o2<E3<PoL3eF)@p$wDgpV{X;&h_LUc7#n#MdqFHPf&jh#
z<*zo)wwqzGX7Q-$_rKHMaew9iI#MR4r+!T&KQ6|vI95L$&XGKHY(_Y7zcg?FvKE2E
z*jZTxvhCn8$SyCGHR~d#>x^HYrKkasw_vpGbHdG<e^{&q_oK{%95+4^9Yk~=sLsOB
z|LPod=FbQ89vri$+fdA1U>$%poxaC~roVwp;@x;gqfuV*W=p1m0mpgpJ2n9|=JP#`
zC3p6X9lN@9E4Fy5E4u|jCJSJ@fd{Ht^It_I<oM^h3+8M;>nmI&>vLGAQd|_wf3#nZ
zu=#4FZ!|C~^vqds1*+s!zPI#q9@kIO-n3Y%7wm3Y#weO}oN8b~k;iX8A97@$_PHcx
z{xlc~ALo~$ok^Z^eO^iQ%?cCG(J*XaO0DwcrVP7O`KQY?Q8qJZn|WM&n-<tm3r7~L
zJ)Wzg>LF&SsBD_Wd6`po-J(zM$&c&%gB|p`0<~7Mp&^X!*$Zh3u?5Gyhq!tP8^PoY
zhnCT@Ibo;@U5B!vNaeeLt5g=&xlQxKeuLoJllh|K>BMCsnR0d#M|5&5EiPQq6S@FF
z=ic6+06{*mx|v?g0n&;?k`9Qj)tK+cp<qEb4LAORSwDpXg1s6k?ZHgs<tt917pq=8
zvI(z}TZyC>12a?Q6)^ewakBsL1XfM`;qPr9c#d$ONY3{Hbt^118F!V{Q<Cr8f3v4e
zV`tBRjrbR-;PxZ716p+NtJTwP>3L*2Ooqw{_M(j|yyr=7n+q+~_bNaM71;}c3mYBi
zxc~5>L;wLKaLt!~(jbXYN9^|pP*d`kKlMlDkV<RS52;BHm(;46%v9|0R8BW_%ddwd
zc3UJ9x|Tk;lMO6cQJgk?mbT$GJ;Y(^;!8DVN=Ic+{A!}!sSW->$xP{AiZykJ`mvHi
zOqhbJt!Yf@g*#gLw1J*W8k02y`RvIbirSi%sT53LdjJ+1CIfNp5(*{@ZgOS!lw;6y
z!$_NL%gWL}*B0pkyQgVsZo8X;(u_xTg30NBPF4`Q<F+wuL5W9ETStb>c8J6>L8t7)
zACO)0BGQOIJGx*ucE*;+urO@3N3VN7+e0IQ6lL4xGlX3zNC3IL#wVST!&mVXuT$Zj
z9m<tSgd?i$32|Rf;=OYJX#gJdAt!lnR4tmq^2~mJOTRHYq{Ato<J!OD8l(|==))ox
zjB(nn2Y=NMyLV#2aTsD0SUriVcUH~)k)g4!#xG&cZiqor)FUV$DVeE0!&S6XW58r0
zwga2MffI=#7WjZ3>XptLIqXJetPTef+&t;zL?WWl8<e}xMG88TGj-cV5Dbupus{wT
z_-6k{I<rW;f9JQ}Vr=;N$|@wRdme`9qDVa-A-glOCTLATr2Z6+La&;Q!PhznwhX-{
z!LXpX4Am@Rq(_7cdZ`|(CIS2?qAtnV!5{T6BY|y80Pu2?6%;G5Ow*3u>L0<pCZbhK
zr%*dNnjZkz+wGyH^X_!#Dg^@mZPUEz3ZbqKH@`gf4tL8BoCMX47@^la(${YT8btoV
zvO`4Ak4nxoZTCQk)PI0P!q@(aBBI^@!(p|{@4Sc7pe3ALB2rpUeUxNG7g2gS%%iRQ
zO*V21=<8vTk`(`-V4qg1vA3xsu?w@`R$pY<>JkKkrIF)z!&~ZSaSDHyq!w`sS7+*s
zO#W4#%^1g!^ch6cQ}(YZ{a#Rf(<FM<hMGsuV);uQrd|v|E&b9Pj{m`sNTE>rZ_I<T
zQ+yq}L8T%oE#x32Z*zk^WTW}+(y9Y})gL^*z|L*#AQr{~_6<G;?~KuCQ4ooRpY<Nr
z0UCNsnnGrm$c9BXiGT#;ZD^mw<c#q(2y@kfwqloA!jTIKR8hcT{SaI`7h8LSG{4!V
z5L3SnC;NW-<Tl{bkFHHHOah<&ckt=QaEUM1|E_&MefecggSUlW9k_C}d(SpNP(8sb
z*mUq!^>v>6xt#Fz<1vZtY^$U60LvTOV`$-z5vPKBO}o_gn=4KCX1o&C<ZQb(Md0aB
z566k+dGDvP&pja!87i9fmJrb3x+$w9O}1*mG1l<=`Lf5Lg>}{eh8Wv043uP4yq%?{
zP7@G;8{ca#nu2JI2iH78ZlM6M5y#mvTUd+~>$sN82^gklDi<<uBP3!M%X?jjgwN2t
zlH`?W{$Ww^DG4$$VoAZ7TMQe~)i^NE@nJP8(Vwm!mhkss{tV|=T4!B%xsK)EnwK=(
zvr}ihqaU7ju)|BsMlTdc3!JLK!zJ!wlqsa45tXi^Vx>pGl)C)14S5E99#&oopGyCk
zLmxl$@wQehY0sXR3(^`=+;S3WO}RpQhxReXf9h|f8NlDYpYj_=P1BbTbNnYJ0Nxb6
zys8Tp8#Ph!879hcQB;jZJ?^krc8~DUc$HrY$*R*G#S?|z)1$NXUc*Oc%V#aQ3EU29
z-$RPP_^UMI72l>EhdBb6Rt|@SyO1pr{q_TpP3MU9OB_l4pd&Y$XH>D@9$~6d#Bla0
z6ANiA@-6x}_vmmJ@gxVXd%M)OD6XW;sf)AlS2y`K$WeBojOs{DU+T|eKV?2GW?m6E
z7S)M39kWLp4-l9fjS7N|^c%(}qQ!=H|7aGFkyhWB3&q|1t%?RnxDwwskx%33)stYp
zo2?N(B&cB@Ph%bqBE$5hC>%~_GduTv<zV}j#B8WJaI}vsD0MlZDz8qrx|$?z{@C9<
zE0&J;;~#D-HWt6d-ym`?wofxtMKXrpF$*1EemP<ueAydM;uKD1WcWinee+-t_1pYr
z@z~h^$H0#l#V@ua00VPj=TV`sLip6e8Oco}nKcK9Bk`GsGna_#0LQEPvp;~OG?Vk?
zHRmidUX1aeM^nyRuZzx#=7!~J+npyiyXP%kMa%28{gHHD$loK-dd%6&x_U9vpAjB+
zZkw?*^XJv?kxg6<m6dc{N5uL<#&6gx$HV*BC<-(SO8R4hz^`jc4#BM5kK`V-)$}qQ
zSzPH;M8#`gAJaX92y&99Qy(G;I58xzb^EcHz0Nj8^d%ezEQQ1u9lrkI@m{7fvS9ns
zb3vgQy^O~f#qzuKE%A5!V+$b=wp+A=Ihy*l>NChun&l}+<?XMzk(5!j{XvPz!fe2@
zQ!u|w9rNm;E3n)!F7N>)kRm_JF%;SD1w|4|VDR^oR{58`e0nv*Z(Z$NzJt>q94RVA
zMorG)3gaNp%Z1gXnvVLZe?$8Zze0g2O31-XM@EbTxib0RDV83YsVZIt3VSihA&!m&
z&DoR%64|J^&wFfS{7FALcWef0v!VH`$=!ca;T_OAVFULs7P*;2Fv2Q(#b^4*D_T$<
zi;rdJvc&&rN(oWQ&K!e>?_f*b1c%jk&U*UB@BE^CGG|UUXgx2UEDe1-XyZREADVOS
z(ax6Viy9FYS$%ZNF3*_2_&i^j3)`I=i;$FEF@E`Laoxa&CXol;R+h1Kes=-W+3P!^
z`IpNh%iq8PD^KE?T{m@QhiF_YI9(h6*3#~L{BkKrHeXWqOV&`Iw4Zt+dB-MS*6`tB
zx9+1m;|JK;F~UmaWX^_uy=<F)LNGiMkU#GRZTd^=7iY#Q1KfxuuJ{gjxbW{!yX|-V
zC+BeP^85yGvlb(Zpc}q`lZKu+LUab=eqtc!11#|P%KZGYpVp5LYm@-595r)4!jgs`
z6~cdx+Ew4SB6dDw1hlmipq&Y|w!FO@Z|~Z>A;Sm9pMx-_Nd!*nUC_Pm{|$^7k+S%_
zonMGOqg9@fM!KXnRm0Svb-BzjUBnv0kGk6?%X`CZs12TC)7~|3cl?$-CTq|-o9mc3
zrUj05d+{V}g;rqALMKo2d7hsiwk}<dl-B<~tq`dgIDdX*)LF$CzervU8>63fD;<ho
z#f!+-H-q2_GA=|m(c+~TRAcyfn$93GFxML)1@mOz-GYflg8@aGq@+E_{ul0$Oqdps
z%ahf7tTU1CcK0V66@crV-iBA(GG!}d#0L8FS{6<_-?}vP<uZ`FQ)WL1q9V;_1t??{
zcEL@lfpdw7(t9QsOfbwWDns=MAL+@W4alg+5`51k-bA&}e2un6#ma7+(h7{VV_5}Y
zSA7;qg%CJSjetKNl(UeBchS!7QcE2>rSTUQ0P|Jg3T*-HD)DFYE3CXFwklBLs0}?!
zt)Zu12<a?c{{gD%A<1+zwddo>xJLMOubs(a6o-nlhE#u$rA)6_XouR?SM<d<st5%O
zV+V$l!l~qYITmLmtzsRr@2Vo32q=&8*Y&*uIfa;L(75C>qr0f2<0+DT2E_D!zdFf8
zY%3z@_k9mho{OoTd6~3vNo@hBS7KX?R~+PAsCzYV;B6`$;sy*acV;#Upgey%w_pS*
zfx~X@e4mDKrWuqeb}>i%RyN5M0I=`4*W$bp6FjRSzBV;Awm$#hbxfuT%6-wh{nFZk
z=#bW6W9k&&5IMuC<eh_Zf9M=lPxdTP!p!x$6<nk0{kf<8GxpG;EKrSE6;~Znh>`y_
z-H8q@;F~glcEbvK>~SFMA=%Iy)Vr{#Z*%2nxfu*~+d?Y4cV;DiY*@@3+^9_qZunOo
zcHUMsha&^0K+GI7Kaz-m%0m2?x`l7Oa1f0$cJI)4B4)(va{`xUKk;BPbQ_XCF)kBM
zG?!>#6qih3c#sMtCcwaC>@87rttw`26RNCF8jL_dS(_kH^!$9OOR4_yyUup8NV%VL
zKni@h#<}3jW$lw1fFsiI|5d^C)o97pQ79MB+|h@#&-CY5)k}T$l*785(gObtF2`ii
zLKrO8x}qh{ArF>Zl*mY|w1|~;C)7_mFJuNBv=V%6RF%6oK-qL5wWWUhy16sVMX!aF
z;EGo1<!?$~QmB>VCmz?km&#X`>9wvO6W?wv8-(UX^iL%6!M5{cBnP4ld}=U|JCp)h
zAK5M2S^na6AAGXc$xnetEFOHd%ic$<`#9Lm@)KeHv-p)qtqCBtC#3Uo7Ds~5L=epl
z856~g5Cc8|08-@r1R#p9YrrP}p{h>`M^4~dn*dS#egeMN;k#CA2rAhaR*IqT-GKy{
z7Of)}s)#~S5{O~2{nlxkl;+vno*5JSR^K%#yN;x&#eL(<Zd|m$yX3=`hePZa9B_!}
z5~F;rumlgei|K2z^o!Mms1{j|`99g(p`ZmQH;5|S9NEv@q=Eme>DZZW-<~d}6!S4j
zy3U_3)D3%xtS)>mgaH!dPR$;fHW8!Do8yj8`MW`+bx(%FYcg{3&>6WpR!JYH2*cTV
zVbLCY!c=XTd&h-N^?(CYc6?Q^l!}gzUYj?=8VV=f8UqIx9O%mG;6N8qIW!L*UIu(~
zz>!YJo@L1>s`CE8W)+S8thY5QQvSh7D-OQ&nCx1CmJ@Tcq7^Q)B0~1we#&DN`)wwK
z-s=KH6}dP6e7!Fxvlc@bIfmS~pVkz`sJFuW;QnGJXJI6%F`|ftN|C0@Jz-<=kc>$V
z-jaX#R)=%Q>9D$CJbH_FR12B_hO1Ys4nHA2v9&!4Od}izFk|1T6r#%ch5n03Y0`Ec
z+vRcOJ>`s-@`7?qtX;c>i_w_p{$?=vBaBT`TC)$f3{@w==nnic)qr0na>jtNdQ6=*
zV;^_t<ofXW1<oGbzTf5C^Sb#qa8_V<z`r<F&M5OG{c%{<nR6Lfl>XuXL_Rs+{fd-c
zdMiyvg~!pA`J`qg(Z8D$2|ZV#)G?6&aZ4P6&O!9@=!YcM*<w<&w%pBJ9aG#@i@&Q|
zL4|p^I-0A<YD^Y~M*LsZ+X>GRr4sxKbm@|b6CI0p1xiY<iri>kY24xuOi832paRIh
zx#jcuP{Lw3VfxRJ-rxrVas&)F3>Y)?+OaNNqWOG8d8&QgMZR*lcvV6S8XiMAHC*Zp
zEa>9-C<)7Q3>rQ@?l-?$w3vVW>(4^k)pmrd19wjW!(dJxeZUbRoCab*vw2n_4*&i!
zCcjYRZ`K`Cx4NA#Yr^g;JSC|O^)q$K-VG>GN6sxP(Ya!6(y=u_NJIJc%IQyia$dIf
z^k29QFdi|W9SZmg|0c9Gju5xk1pcp<2c*PVf8(bVK6nc8wJa}GJg=#3_z{`@0!2aS
zbhGUfI6iPy2hG?H>KN0Y<U4%+dG5wUY+}{7WE?0vNmbuIYGElsLWx9p3UQ_??0Ah5
zG@Pfh9@}aP^-H212wCUIBnSMxd!G?`CNq3FPU&Fvb9>OVzMc#6k&26OX>2t1d`#6I
z{m7+iYM_3}a_68ulGfa{(gQk8nc#6JM01_O;TJOz3Fo>9!{ySTZgo!Xpo=}-4;o?8
zj8V>yn}f=&V>OdKlDF#K6e9N(p{AT4JBTFT3%3fP>`a#f9!f_t3=Ryfy+x@$M6+S#
zN{R0sW6rXTK943uBYNoMe;x{9T@PXn_NmzfV>0nP|1|38q`;$>c^HU&=`rX9d+BC+
zDkJZ$Wf>Ggk&J`SepYXY0i%T#yV7C0mz9^743T()hu}R8mv<wZfyqq={2`Ig-U-Cr
zv_AWg_=rA0SkKyrz&SbWpuixcxhL3e+VI+gBma=yk%h{o<fbDQJM9p1i*hWGl4>fn
z#ceuQ%>~qpqCu)4mC&64murxn_9qV~$qA{|w}PRoCqL$6wm1v{x#|!&F8@!gc5o3(
z)>2G-SfW(v53>o}zXMWx<OpjnFPrU7&A(EFJ@uggc@~K3EIm`fZ}DfP!0J@vYLDTo
zOu;CvRzufDPL0)3nW93#atQJ_@lOahsoj$fOL4?*W#IN=htvFs(p89tG?M=%=TpWw
z8%c{-kI$iPHg_Ys>GUdR1<1g(I%j-^&6V44u!Trs2OQQAvH0MymN4`n%CF%H6<|RR
z7z9u$H{>J?!Ex=a9-z_i&$(weh`pSb1w8zROR^aJ+klgFhr&_`lk|oPxSPF7Vi;(F
z9OUj-;C9+t6VfYOk4nuU+$&dBd_-6{NrFnE@+$V(PV9EdE7*RBnz{~?K6K;mcs10?
zw~rI=VJh`Ag|dI|^;&O|kQiCVrK3&&fP(E7TDc5Yy%zXI2ba{bY{oyGtrGnc*ujOh
zUh6XE$w`?bB>mtJW-TwrDDOy)o%#Fk-`aeIQeoiO%M6;Af+I5cCN7Yv16=O(M=!0S
z+wj$iPfkJ4Wu2e5B;6lqRHY~w_|~Yje;m8!jZ2(!se9j$MwdB8)Y#Tj_N?jyFLT)D
zFPhpSDJ^>l-+SoRerGDGR2JmLHJ^`B)PJL<Qi3raN8DZyNe%GM`^G-`OImF8Tv=RV
z4P&13i$xmWV;;+0wUy0a`B#BQDaPYIO$0I2=Q672V_a*%Bh@#v4Yhj$TvbB|BZG%v
z&rEF+;33#OK~jicCY+Bg%`+1Ko`T`|Brb=~{j$RY?@sk{1P=t--wjq&+n2b(YT0&o
z?k+A*A&b9~oAwtr0b@SvB??+RH<Ikee-}>dgcsu(qC^H%vUYIA6+-S2l#v~CXNK)3
zDrWM6A_`}JJYOWO(T-OO=2z50CA!q>&&E@21|Dp7?8V==81p|StpWS=3Af$sVX!u_
ztS9x8MlP9Tl7^x}c(<PxpHB~Up2eQqHVV}l_>$pno6%iWY~Li#l3l~fhce_Ygf|3_
zksV^Ct_I%LY(z=993~;9;i;U?jRqf0c%H9b?SM9Az_VBLzJc|~ZXz1*Ho&MOvUkG=
z?^_SB{`U8N!SvV&0M_@ZW!}CR+;FD?h&vc|bVl}>Um(q}%yV1sf?`q#Yo9~vJ$~t7
zH>&gnA)t@bE|Oq7*}swc)!8(*kf7yvQInyaN%WH;-la$f_q0U!kT{Xs)XC<%W8v3G
z2sb&xI|GjZKZ9d*Bxb$M=hcUQl?&WGptTU!yN*onR$??eAVr*6&P|ix;KjQpnZ)Tl
zFqj{|=4gMEWa`uNK`v<g|9XqhXsE7y=Sfoy<^I;U41N1J9zu5zMn&yLA;b(tgYtRV
zPOquOy>x2G9SX%YYphJw(@{pi(jgaM``XxhA+z2T-68^p&WQzeXELOd;d$5`e#Y#A
z0L_Mx`AD#prq|{eNe&B@Jw|p!PNgu@H@`b!EC+k?v(jU#3({SLT(BcD-T=br?xi8p
zuBB8f=2by&uz2!8Fwzy5ql7(Yy2(gojoDX)UbrR+&|Uhg><Y2y>;*!OkqF&mDv$qx
z-8n)I82uv_#lfp;rwW};)k&!1^$#5ZdWc1nsY1&I{OQ1vxGXuuZVBFa6e1Qo_k3>>
zRG+dPg5r*rNGgmndLd3TfPUvVk$-yMW9d}5O6IGy+TvJER=07h(n}7W$1-L<vZv&R
z8oE}!NMp*aVG{ik1IUKA@f*mQuBD!TdF8SxuIl1-4k20Un=k~eotRY>@-qT~9wUN>
z!C|HL`9#Pk@kRX|fvg6=X_J_&Gtj(KYM=W_(Tc@#9`C~_A-je&J13oXD;k$*0UQyv
z+Iyb<@}8&JH9Tx`Yrv~3z<C<Hx?)+5{XI`Jr+7>eHrvLRD0^`hs)H*j<&yW_C|^A!
zSXD!;m?coOtLI@3SX&A>r@OOvnLjyo=99Kqb7{D;pZJDOwzOKv;(&*qWY3)P*z0p|
zbK044fteH0>YfA{;w~>_ARmxlzuYU*(AyBh52B8{VA4*su+CLm2_R|wM6!a*WYl4C
zEP5XKgKWaKg@4hC?4<7R76)w0N>yiwG12AuT|_kGKQD}K!2Q4(y@AYP$idH8Uq&gS
z2oo*xqkp#F=@LqiI5hZ26D+m6TI$c24S^smEPSRHzy0#blP}pZ!tK@1%EX7<n~l_%
z>1se+>jRY0T6);;Y<)VenkSNGz&Cp4YJ=tOe^h-{R99crEl5arcSv`4mm=LrH`3j3
z=#-L_?rtPRI;A_LyQI6hhyT5IjPHB%;XF9jZ?X5BbIm<h4z>5QUz0b|ixEsI;q57P
zuj2#>f4Y%1MPBIbYrqYVI4ldzY-1EaS=p+zwFPb(%F^?m5K#X6{63x4g%a<kPyjZ~
z%`M<09Mj*;<=+V3wyz)laQ-~0i#L6&POPsUv}>f>c!~kj*JA{2bkyVA&tZb_l|j7e
z9I?X6Vc$Mcti4P|UCOIhP1};TaVGe?=b(4J5FvHqaEy2|Zk;Ftj}AE&jLR|YHEt_C
zTV0OWKZw-hKf#QCCB0RrwrCIHD_)Q?6gwCRan`-2?p#7VGI2ri^C2(hIE{ZGfo;cA
z{p)d)nUG&K^wLD=i1~V8M;&+gOQI{Rz64`R-|E!$VME|mOfcDQ&U;f}Q-;gjPH2}S
zim$}cx#{+0>)5j%_}0>RyBIbgrkR|qy=PiIjqkD;u)c>9R)Djg@if5ate46*8{1OQ
z`HTCaAm|;_@K&2bwL2Elq5DXX_HYVt??7Y9^1|$ef1Im>6lP2kip}A+SufGFgvj|X
z=AqY^L=5N{B`^<qF`BqMP355`{c#QBn~HvWBz^R&?s}&Lm`1tos|(-q4_;fz&K0`a
zV7^k$%tw~VbYs~wqdOK-u#H1YrGF5u80gh0xY(~!2~g07d2s`OEK}NZN7f1B(z@+w
zyW4k}Ehfwjeqq)mve<SDl(Z0uBYalND;ZoIb^A?^&wjE@_9ri1fO95C3Tff@_cy~$
zB(A<LJSHQ+;18SkVPdX(I8n&;BZ3$gf+WzHjwr=Qu}2Io>E4RaGiuQax>kAnB-vN`
ztVQ~X?!Q;~<ZcI7uI-ynCs#(bi&vz*_pRvX<@2JTxSR%;Z)+r8bw)lg1rvt}^<coD
zs4~Vb3<2agdISs&&K_8_^1sF`PhH<18)DooJ=W_0S54l0cdy(X9TJ$EwJDrL)MW|z
zTcRuDrKgkC`!?LpCAxxvgQ(a%vEx7fd5;9ha*Z*MrRPl;)F@`1=gr8Wnh|GT{j8o`
zfWq#eK{?;Yy*iMEJ32aXdwt#!;s;YZJMx8GvQn1L^?y5Ksb}aQ>G?KGxZ7-py;N<4
zbr?tk9c_~AGTxbE=Z-ne@!epYz2RhH#<@``;PlSz`95NDFP9MiVNFCnD3WR}z2k+5
zm_AD+K-K+_TP14Hyc>*&@>}QC-_AFH>YT9OoL69IT-RHUr+GJAV0|H(p@5hfE!};r
z5a&&d!d3eWz3OdKz@2uO$kB{e6EEK-O<WA5Q%>@eM3CUbP4&nVMUdE?ef;@$PDkLp
zozs(3K5}NZF_K#stTK7KA6*z?B|)1;wGhTLH&LUVMRABz)&1WC1X~V^Vvrbr@pAJr
z9aAWe;Nf@2HEyz%uNgpZ=Iux6&8?HdtL8b8d8W0WEH2M}$oU~Lsefzvh$<xkgrKTF
z6Y>)BZ{ZZqi$U%gTW02UAh{C&NMV<59rMYr_<vq?BVVs}VxME4Vtu%I6JHMp6ZbAe
za4&wyO`S%*K0R?fSxn$m-}-61qJQ!d>A-yDOA*N;9V8v!1|-ef+~bCSyFZU*-JL>^
zw0qC1zaC}!+M&4nVHqK<jp_{o6JY$l_pW?E{r8%-i8<I;NO9$sE$RnShYu%jMxCiU
z#OAg5+2yau?xtFUGbWZuf?3;wCs2??CwF|YeH)7oVS9ondf@|ht6R?J9%-7~ohKV(
z6xBBCvpvLV&v>S&u^qc+!n9sUnb5J7txW<_vAK^M=ZvSvZj&Yx<Q~AtMS+|46&@Bk
zNkVHAB54qJk4eU@n}83JzIxh$$SZ^TEymbZ;zPfSc9|2_GG{84DJwXvycOv^{qbaI
zlI_p&iu16|C%e?Qw)1&|g>>+nSmN+m*llmvuhUQm<{QzCAn(9p!RO0NGM+9E6>uxY
z3(fkZQSPC_n5Mfu>ItwVih%8}F8sQ!!gimT_rq!<=xIXan;^GuoD^sGQCcmdF;s@n
zwUEs{MZZ|T%X}p6!i;s45Go4^(Pqr^C(5Cp5q{#wS^*m~#`)6~p5T_Z(3?Z7$8PO5
znf`4Cx$f8dfxoN3dfThrX(m$GW6#Fw-f0J70d}8gv>qM!9|yk7Qxm*bRtlnT`1w7*
zO7YgSu0BZr#c|*KkiKMZ2TOI27(3pWk3R$<DqGkSB{<(t8ER-ADKl{RXJ$^|W_I3!
zsOgNavBAfe^{*u{=*1NNy9!{Ei=y4Il0@haG(OmrrS-59ssn_`-t%<(h>~tEC=raP
zu})*LRyXq{hfZKt+&!?k{c?fxd>Z*9-}9x^&lt<x-@mlT8@m&D9UzegzIAm}&weio
zISEmvfQx7NG8gQeZJJ=LSG;K#4(mv&Xi?e^LuVQr{5qn5g+OsfPBnh^+$;?%5_D(@
zXcAyOVUWUiRWJI(MMd{ZX#rGyHSgj}@}9QdDZCI3@r?i+v)bo0UgQ1QA0CA;3`1X@
zXu}H7w0%C(Luv@n_K2klS%(j7Di;Q+Bw>;!TiM}&D^YS-=_9Y8h$B9Sx3VoqkVM@b
z3iM<a5g>41ff*oYTHZ3V<hNAEo)4A3@AEshrIIAQHNTqeem>Mr<>%9+`b|@!cdm;a
zb7fdHm{tmGUdG;ivQrHq2nU9Fmvh_o(MVOpnkHCC(#Oeu+(nIuA?V268fhK~&4_D0
zU6d;d;tE{MYZ-iys*sO(pk-zgft4jyh;hVED|NJ0HIe(b87nRy^~%Ue&ZP+Jg)0a*
z!*X+~b)U=L5B&Lv$-q{a+XbbkjM)LRrT6URfYuLy>-s_!6yr}v;TK|jHlZ0Ix_rLJ
zpgCuTq{5QdI`Px`;;P^}MoIm8<#pL(wn?HR9esW5z%8ceS>RWYKj;$a!jtq0^wIsm
zd<*q!$%!GBQx~3>B3$}sIwB$2q&a7jUN_HXsj}piQ-Rc4KM^+y3Tia+M`Byi7z72M
z7;Yl~%IT*VVcgr`0ZIjw#cV`nN#B=LfZu?F2iV>Pf15(&k8ipdH`(Wy%tP}LWm?wJ
z^;}g6lNjv9WY*pNVC&zOOz=YBN(87$M8|K$<@O%Uq^4-hc(VF&$SJB%hP$;iR+zD*
zC9p7IJ89HKEF(AD_>Ze2lxXhSp9v}ej}+vpt-^kyf&SEd3=<S3Vn@BLtx@C)eCMD4
zN+@x3{Uc7>RvQBb99JV1G(TN8u)~tHot)ngdbFCOso6tbK+yD@isI~JT`#J77U42r
zJMz12V3f$QkYwWc-~QRi7sOT>BY9juW{as)$wBS<gNA3`4Ate-9@ocl89Xcv+?&rJ
z?Y7-rpUIJZ@ONncCZs@On8^LzkhNfUx>)GK6;_Z|?)#r}9;<tovb+pvG>lA&?9%+h
zv%cpud$Bt6@Ru3VAKGe!l>vQxR&)uyBJ`UiUedL`@R#`(Fg^`%!#L`ENwnl2N*!2X
zO*!2>H@-FBeCtw|Zmuln98Xt(0@{XMxV|Vn24bC-P#RB@9lnrSA-TVB7tf_|jM3e8
zp%x1A@j2t-1_Kd({sHHNRO7t~9b5)w?=kke@YEX=3r0_Qm@*Wuw$>2%FSlI0P^X8!
zF3e&0k`K7M1jRX}z=vf;N$)aD3U%*0D7axe*CP&&2v}w8VyJVU#NUkv1I;CqXlYB5
zkB=W;uzh0*CZA?)4g(^MC&Oe(G_YwM-BiCgu{M~>>jd<g*ywWS!OA^lc#@zG+eog+
zaJ$<c(_1}pd`QvpdHJ(J(Du*TfSDVEC!KN}o@b;`7-|JqRIddi02{-~r}fv@NET8V
zWZS!jI0CneKVm3N)C8a_4tRk+IVne3-1&pk#&{^97mS|GIxdrgxv#Aop%L)Id_8$C
z=n^@Y&jJUV2D=XbjO9K0#!7H_Bnep#7;hyUMA;!^w?UUzbvi1=D>_5=xb=+Fa`}U2
z<sXqd|31X?k>Ni?f)){zlPz;Y(e1~D2k}mQ{F6ixc;e0d2xBTGL?BNhK+7kb&5Z3f
zB2Wei5HDI6(Hskh`#nj}WnqbQqngzc$ruB3!{f&~`Nc`yMMws#@=>A5*%*cX&_l^l
zSCk`$$5F|#wJRtR{2OvmQU?EqQ0Qgtt<~ptb10Zmot2DG=o>F`@<2I#F(^{~{L_j8
zI|9|0OY2gQ66t;hM&tGdrxLzlI)7I_{uJsmA5>w8S;?KUi$rO_(9@Sy^{tCy$>ZcW
zYi1uQKk=b@<4T-55cAuw&wiqqH{Xb0_rF4O*NVoPCc&|q1ZV|zYHZ#l<*4P+Me;HD
zCY@YQ&>b#`9Nvp~A@#hVJ9$DwNa_t!redP?VV<vFZ9AS&0!I#^jQzflzfa*lX(dNG
zY$&elYBWP5+2w>Ie715S!}}MGF|cddwY!f$46C&O)s#Kr-JeA)k{`g09y?SKStV=A
zap|#@&XAc)M3jSSJOwSW%?GW22iXOWjQe;BMJC+!wS(PocRdEJ;)f9P;sLt19r_it
zCNUhvf-?@GFrdKCizaXQ66}#%%$x1uKhEP}cXe>{{2l3}=ta))Og$#TRE&WH-?zoL
z<48^1+fTU5&oBtpRTW5zK}SWI2!UfVzn@SK$0VijLL;29*hM$Pv#+;Ec_isl-Hzg-
z^ZGz}W`sy7=P`<HLR)R|ldUjR&A~J;wh&{0n*A5?48Xfr0ZmXeD>L+z<a+1wC|td)
z*mT-ZhhgmJ==kt>fN@=HG~U(rj&I?XH{%A59mTnHVItz-OMglbow6X-Ext`m4b-ci
zD5`U+a0#IXOGdF#hC*)aI5BtAxH$*kYhN(|f24c`^NrvQ5`b8(L`1gxU1;}&EhPu)
z&FW1FSd~8fNly^>&m&*I#EN><{tDUu@4U=Yi+ZlDa!6oy@tU9MN3$0tOK}&m;C_&E
zT-CQQyzIYhJ_kNH9_g>)*-~6xeC`(vaTAG_b6w+)KfWj_Xgb+F_F<_mcSZjD?!$+0
ze0QQNZ>);#qa3adZ9bwVesFa-+2e3HbuU&050EuH!BSGQEbHlo&t%^b35<zb6-d+|
zq7;^%&HrOD#oYfWh@EZA>z!8nSC=`KakpC=*U|Sb2EH&JF*a<V4=Vp}kHX9;#<wlq
zsERz!2<_;Wl6aww9e{KUp&d0Zt2W{>>mf$?zT6liJNPNWK<J*+If$@mQAV2W?kXYJ
z4d|XeYCkD@{4x@LAv<e%;=ito1^+FdZihlkt>#Wj@)}VPi>Eqo49D6i-Y74BFHdN#
zHDAo;3+cbLfXah;D}kTIt|d1OaG_OC^mh*Ia(pApGYDZ9iH@L{j-E12gJF92kx_6D
zTKTTCv-i~5#r!jr_E9V5zYDe7GVzYDr~u6&1Ze=6+xI=e%y?Cytw`~1Ff1a4Lx4Wx
zK7r-*eZ<vHnSR5%bHc5kG6%+kA=?p}9Sr*z?Wgh}C!}{{+9(9CYp6L?PuXaxT~sKq
zG#PyoM^GgQuf;#*>_|9Y?#6@0*LYAn@k%gttx(Gw#$t7mcegTLP+%+Y!fRMnDS-+W
zxB8LGl9~-{=UvHfQVr57)fs=g#FcHv84YZv|7em%5c4{dpE)#7?$yli_RhQaqf(al
zmT@1Fgnjej4r`O}F-n={lI2<JoA(zdT>iDixm{L(ub}&i0y9dsF1`0&{ol41)bVpc
zJ9{Z|pk=ZXF(odFmkEjV90Lz^-aUYM`0%(K=H0f{SDHhN6YQuEE=6d6uKtYxm#p-Z
z?A~vz>JZC!uS@LSugvpISZ<*kLk^G1m)x|dy(W_X7xX_H8bdmfJd0F))ERMo6DbPL
zhR^=O4)mDC1<*oN{c4!P=N68toWJ;1*ED}`pEisnsLmj}L|-7VEyEKwCL95ec6p~p
z#VJSEiX1$X8^)05btv;4FXiqRL}iJ82aU_qj<hBN8$R+c&KF6pAWBwNBZ+HUi%<s>
z`-}|_2>^2jpSHzT#7iyY#n-f2YAM{EcAXchEJoLPdZD%tc&(ygGbyT<bVeM{zF~4^
z3J7QNNnQ^IKM;v+V`Z+Yq#gi9G$*xtoj`yvW}|VB<fA5;sBL)((@<}*^3*iTb^vAv
zxkxfxjC6yGrW>R3S@i7p5Q-=&B)~RTAyv(XQSE#qM%^u4?yPx2c(r?x6KbF`qIGs4
zj%&c5tNYkEDHpwKf<n&sOTpm51hTDyvc%Z<s6+9ZxX(#+4NQ6$eh@$`l$tO`ofx$R
zy-SBUEws|DR>2)s#d0J9>5Lc!W8C8>RpwI>+1)ss{kxOFWUexu=c(0yoo~J0tS2=4
zIN!wNPFtpDJmK9|Y=S(VUzW|pSv|;K@%%vkD%>+Z)d)dvZSp2~vpsQ!X6t;t)AsYz
z{(E-W$4%qPanG0tn2pK{Yg(qW-OCNv&+D6C{Iw=b7?+h3uI_EO|A{8R>5ha$os}9Z
zxIvb<;B<Oh^sHVm!=|;?_fyID_qR%mYTU<7yW&cVPi@t!e=b!>X7t3=JW}pjst;gE
zp8bu_1(fE<4LzDm@aZ>|okfz&IJSHo+<A#k3RJpdMLJ(OftTah*QbNaTLAs_Q5Dl~
z5j!l%1B)0ju-wNo@`_x}#$ltayY{S<7gt#J%d9Q}2{!({C|z0iCvUO<PBVI=7F^fO
zE%6)1UCT&f^t)8gI&0Nraf{PP1-k@jzH+F`hepR6=2uRx6<e6bQf*)0rV3wMg4!Tv
z*=nz?Oyz?CFme_`a%iltG3cK5HRW*hryk}_KdR~z7yDPMToJ_bA~f;hYc4-KqMVcF
zy_cQ6{!*U?i(fAfTq(o+xf;wv67@ZZn`qe!n!-OW>izwy3<Xm-WI0uNYa;MZmTPE?
z*Erfd4vwHmJ^+fQMN9p3kH5**8@$M;n-zFc$Lgx0K%Q@udnW43URWjHo~K%10Z{o(
z17gKW-F_7)o6XK_lr}R;I3#A$=A0D`t?cF_^RZJL-~$etRBLu79^=N~I7VTi0g^E7
zodV@Og0G*E+vqjxF|hgEMWd_jIHG>FM5n74FP~(OntvY9Ey<z^(~~9N{PF462jF)k
zE?q$a;H#Age8A%C4MVR07VCVvO=IkK%}3P^Jc*2*;4*_HFsjkhPL8<q(D)uvU&n8~
z&&Xr^{ysiEJ2Y4O-93q{%)N5&H1XLISGNv)P`^yaCQ3$Q;jM`EV2(i$qhmwGQXw>C
zJK*fQFTLTMgTCh^ADi~z===5_CbVC0HtD(;_*TcfZz<_t8n%P%F8s?t_vQ$pTzK?H
z>=(kXK{6uYqfcxzGp)G^mkqLhrQa!O^Mhs*JmOMkSjPy9eg(03ulLE=b3${)O4NQT
zf{h8A>3_#PXxK}skv)zH`-o)RgB5_OgR~$NO!KST$`GNL<BXrEI52ny*85$QCV!D(
zD?m!J(Kr#z%kd|;MKSo%1<BhXomcV+2E~SE0Tc39$>pE+vZ)OiJ9J#{MB9J?VoU_X
zh|2}K^V(?Nj9NAYzS!fyy#>a-+S0MIQ?YVGcD_Fi^Q)a=);L#M^J4!nj4J#lzUX!?
zqI?++;sq6d%jn@AqMvC&bGCw(zFi<B1cK%?A=c6|Yj6;2S7|EBe~xC<n1h4*tKbF`
z1+8*EBlQ!DLgf0$<)KLdIpWl??SQ_&L_S3ihbNay!nViTOcyTEYNV{ri;MsIz`c5k
zItIe9WkQ}pyrN>n1qsQl;>O_`+w$7Vm_+691V#uXv3yp#%Nf3c_PJ38)plR@fs-3O
z#LW7GZ;povlGo{v5<ED10;j?@)l6+M!^Nbn=Uko?V@z*mO5nQ%e-k9lrVBz!4LSEO
z-sxYIb7A;0qNSvNH661sNwUQ^aAzprtqk@kQ@w-uPM-gq)LDylD|BaB9OM_pVr|Z7
zuB;KE+G;Q;ZZYXhidW<3fR~^HY+K5VKV{w5@Ff$&4G=ib+e<=*{Zc95aL>KKrQ4_F
zFAZM1mAd6BWXw?w6X+bk`0CfzqWyjQ<YwhNRu1-AidLODVg!PynSqj&$MJl5`exJj
zq)`8%rc;EqPmOtWN%&dV?I|nV`(Ir@%OF)uq@eWPB#TJ3{Ft^C$>lCM2mT_tF2xzS
z@vpG7>ziirTN=ko;t$cR9%{(VHWG0m8k`wNN}xy%p$M&L3iLrHj%DtCv1BHa5xrUT
zp~*zYugZA1>^M+(&Um7Wrykr;<^L(G#NLy{p^@!LI66k%>|_z7`wKjf9d^KHUjs>>
z?fKN^LKy~jjGF5<hI9s#fHysHcc|Rf_FsQ0BFq=({#MY@U;=Jfa;GynA?VkIHxW*M
zw2Ab!3V?69I-#S<a-T|IACZhjgof3%PiJz!#PMpOE{jby8gA2ffBfr&zw&w}Daaav
z01IhFYZ@s$*2RSC(_w#NpFS(Tr+K!<X!U4x!eEpBQ!V<7$4(5;Iocx1o*wl3G|RT+
zW5y|SrD>ulpDBW8{*b*$7R4@|pjUy-DWX0O?9jt-y!WlYcBuX5e+_bfe@>hjxTOOw
z!Zg7J2o!Gq<XkG1*lA^)1@&g#fh`nRhwfSo$D>F3BZFjG1x0JgisCHt5$)*5A#sV5
zn3WA&tYfp`rH4EKoSlCU{)ek*Ci2oq39?OE2=#dCHetuE(i;=JV$m~2w(?-^M%HrC
z{5@Sc#xFxmABy%y9Jhm~Tb>XUda1Y<Q|0Z7r{Cj#TxoO+P?H&6w(H_9`wbtsxI!kz
zgd+_D-B9CyjXpDlXr0tRUgGG97ia}{sDUwaaXD-af7rALbj~7I;>fn_TDpRR-=Aq<
z_J_*PMGngbjGy#A_@^*gr<fdxf>#^%>7_Rp$$l*eW#ef^Wo`QQk3X#N3#*q!Z(j~?
z-h<D_bGZW+%t(yKnY)vv%pHVewClU}hKyAwOd^!pzl<$YLryuBFr+|ruQG)P(ybq6
z?TAjK`))J<dM(D0ZC;UqaclrmAFE+Tm*MxKM#`uCNfr-!;2ueVf`0RNuDTt@sWfaN
zf6@xlqWppzHSgE5B7RCCUO3{iUZ;CZ*H=`o&CEE-vYasY^<@$KYex2)nd5*EMR$?=
z;2455H8X;ZKkcPID*NfH=Q-@Y6U=_x94nx+8ad$tI65>EWoE)nXaAXdra=@>L8$kZ
z2i#q=XGI|RA-t@XI!L0jq0!bWODq(6^?pBB5jx><<+)<^R0#fqPNG7dI2k;4cXO_`
z^|w<ir^+A68^*hEmHO_hebCdJj(#@%*7k~@S@P89LbLmKjP6P|iggAR-@1OMm}R8`
zn2nCYk*(R)bpgxI43_^zg?W)j_a_GPLzbY7vwZj6Gm-b|JB>Ie)yMvOOA-68#pQVq
zHu%De|E`;|!KDuO$TVCTE(sY|1TwKMW9dOkvw>`N$nvU|$c!vaqIw~N)X%UV>SXT`
zwO}m}AuFt!SDQ_DD2?Wl$EkIp5}|;fQ<#-d=PI~=y0c{9pJ<DCf()FuJP0ml`O~Uz
z5F1UO<=5w5V9%{VCunE&n-jDnSwFwL0@)8d$=5Z544N=Hl0heEl!3u-+zP@_rbN?G
zwj*#NfXDr2%f)juWVNBfyU7~O`%9DRCX5j^L6hp<+32UJC;XvN5Yr1-;&h8^nwsWP
z@$Ey3KE8%sQZzAOgZ%~tu>}F{%!BCmzKe)#WM|&B#^cnEZJCsH9L^f0u)<%LWg(i`
z$n-tp-H`Gz{`@$t(ZBO_yp_1S*ygDFg}jUq>&OT;eLXn{*=ZOQCOVnk{0~ixZE5P-
zgmxet+(-`9v7>7G&;O9D<Cm|ex>94Fn`0fr1%kn@G;o@s8_9)=JXb+tZ8awyYLh%a
z=D<|KU{(XG`3J>|ynS>9elPKxMVFUQ5MnDgy_AiS0d>o{VYTni`7s19?4!<}ccg*O
zgFS03!mtaEVsLx8^8yw4e;I|4kd}Sw9h{#<*-@m|aFT(mJoK-BwxjsFd7+a?>reE-
zgj=3VxMm)PyOP<3yo(w`LZ@bUcF$%pc5U#r;U7~Y$bXaxg_`;F))Lg<SjKcJZm{x0
z!p>fb>>ty@-&rkPgW}rrL<&_C+)y+eZyr?z5`125{EWmUQ(uzEyfzr;lzNY)qGTD*
z&!T$hv%uac#Gw9Z35n>%kb3s6lS${qAD+*Y<uMH(>;o)dJHJHu*>Toj%sfT=s}hV5
zIkP#NE;@8$QDlZcFj7=%4G~wZ6HY5YDXrm&3ehjn6WhMaA+bfv!2xZC{$D^X2*T=M
zwti?4Vg_^>igH1?GC*40-<x6kKOnn(b<Hmh0RpS|g!I6dzFFpfE<Nakgt)JM=K0H_
zi193V_LGR=_NL@2HN%}#=M}fwT6$$P9Zg>=`c5Hn9$&{ak)|=vddxJZ8^$iPA3iW$
zby4Ax_<kn^w`mr)ZZ=<`J;Ft{UDobJk%=!{{{7P*C5=`K*G&jB$gC%j^~Y=+IsP4i
z8xTZnrOdszcL=o|qh-!nFkLbtmt6el9}KPf6msOq2U8L#>Yw%`o)Kol-tGK;aY}k*
zR+iY)rmSJs!YHa)(Y(Y&;#1c0e&CjbHAR^wZfifyk@hARp{hkdRw_p}Mz6FbG(V3z
zzl98YJ~RCsSFb1o`DZf1l6h%v{oYo=UEunmQF8gKo=LXH!Y?C5V~RB`qRXxg@?JI(
zZpRVpPb)Eq$qNJNId%ht1$J+agO)eP!J&rNJ!qktVFDcoE8qn#d#Lf|pd!kmPq}vu
zvJJVY<g)?2@vx0=DaUj+0&F$M>D`S3FfAI;+qPSc39Z*zRRM=O<_<bQwY!SJa?!z4
zTEJ45m@wygc%NW8RCzqARH6w!{NIp#e&$VQh;ceG`x^te9d_}=JqkWc7-yT!6=NWf
z7e5N`2)GiVq{mlN<LWI{j6-0+m~)aAMDbR_vJ9eE?k91CyMQa^4v-FpjWUWYJc7w@
z`H6Pa_qt#F#D=5VgVO@!EQ4M-32~v#QG@Z8APFO9d@NGDZP!Km2|0~1_I)|qg<QBA
zc@Gq-M1%p~U3BkXs|^ziCYSiNV*C@?0q?f2`MTyl%pHWX5_I3q9X%)@++fqBlYOHh
z{P69qT&!<Auv^Qkue6Rkm<=o!9<tH0Y`2!5Uuha^yPE}|%G0k!yOGAxkG*J)XYwWM
z`G&oJ!Je@Ht`dLibmVc9)u!WXf2vBKVIS_a=rtF|x7ztw-yrJ&Jg7{bZ|B(GYK?tx
zuR{K$dcJg^{KgdD#Gd>Ou_%?8<IXFJ<4pAQXS<z5h(Vb^!Gd>%aLZ*ADyyFRw27zl
zpsqdc-=@oFAh?#ln1R{QHlymPOy10vR}b`HPva{zMQ5CV4>5VxU8)y}XTD8ie{NpQ
zuuE#hS4aWlWK|UA*)poU6y7txTiu{@g%}WGo*3<WpIVw~ZSzi*9>40zMIK3GnL19k
zLzP26W$O8=h=Bm%-+;$P;6~^jrnxica%~TooPd@Jz=*#PZB&#6HLQnChJTS%$`BBw
z*dMvA<%0Z)T)<$nh<R>fb-y-c$@&qE;FL;dUJ^6I#yAb?FvXV?_hT|-W|Tq$aMmej
zj|K+)Mj!PN@4`6PV_B9L_<TS3)E_1W=>gx_q^nK<(=x@mJnqoZ)c?#6WBm*wLj#MT
z<!UVegoYh&cjU8d^$Q3MANxRPn7!erGx$6-&XVNNVc#@dLWshM<umHI4qhv~tP)u(
zg}gP^4(m+=0gLMG9P`DBGwGL2w!QPCIyi?9CBmMt2saNaX%bx(=r!1kXjYgG<eM?2
zpN-|vCMLHs_+Ru#ju3qvh!4f})O8wxcMoO_eVrZl5U)d4A-O)G7j0Za^GsUZ?mS}m
zErbO=Z%uUZ_BS`A>BU!E$DPOmHqkxO&XVkqrk~$Eb)x-_t;EW@er~HZ$}MOS5AX&b
zkTQjM3qjqM1$n#UxanzWWd$j^3;Hd^bEz!iGT*xts%CRYoOwO#%fsmdvZM3g4)kLu
zF}UrTNP_NQddHB}7`{I%Jb$WrQi4AyiHF)^clH<;C&L{k-*O$rHn<y;IZDt$%(GSE
zxB5`-7rDqZvufWI2ks?a+5frpXnVEivQntpyFZI_DDKJC8pQCla4w2mDT<u3`uiDD
zet{#+*ge-{mBVtF5#!?>pe2YGAV?__&lImL7*PUUyQ6zjx35tH=?#0-##J-Vpw)iM
z4SC~52<;740^;bc5;dA$Nnj-m!Ad~gAT2D()_|4JhCixoOfMm9W5BW+Jy-#Msw-wN
zx2*80%6?yu>WX=XA3|>>5`GW2dxB}}YINZEBb`a}$TZ-}s->SU(DM9p)6=T*#ek{h
zcZTtyu5g#$K%KPx|KeZ#QazbV@H?2aiPHzm@Fxf2v-K)#=>K}Y<rB(f%G{_Ew9@t7
zFldJ>{U-52S;Hjd-vkHX$%agv%YO+^eon|3PvTQmv6KPkOC%eg_B<B|MdZ%s0qKQQ
zoQL{m{znFFOZjM}?7BaynK@<EVtoR&m2EA)hcvQNRXfsOe{w&Ir^2~7MfL{^DY^HO
zkkOw)WeOQ;Uz@Iq?V}#40(MZ_NXYQ&=8rL6b2howyD^v3FsM@f9I;)+a^)5bj8elT
zAukKaiOS)rr+z5B2NFz>RIa2jfB;tdZ^o2>Sj1kcCVw`X-%{eeY(^%i<J2?aI3`*0
zdf>8d&9Gt*?)(#vOLTw-e}m`u(N%1Af(X^rhw}8Y{g{r_LC-og#1Lm5kyOv4h{fLj
z-u4ha@|vIwa6G_H8g>}kPpm-`9ND8Gzg^3mTHv)jVR*omKeU+B1%UT50jH${!=&Nc
zl+*I8&pV+dpi>-ujtKe<L%ibv7ZM=6dk+ikM~Fsi`)!B)g6JlHb<>vc8u?<*1>^&#
zNgMucFFBz^tP%&vu*)b&&GcKUD?dU`pzSVk?tdz`l?Mr3Ph<Gw_PrbYsKMeMz+&n{
z!EPUUN%yHKP99jdT#}w}KmV!tOxBR=TPhNIW6O6;h-Cu-o1Wtvggn&_qBqgUw<p}k
z3~lUc+JuX^DPg(3;Ad3F3?dzB(vQhUqKB}L2vl0m3r!$*JQ|MM+fZ3>w=`Vi3HEie
zj~OE#;Uf-6U>RC&8ht{!)Nlj&Vs)~SU)zh3-VeZ_=!Ed9N#Tknd%zn4L)g%L67MAA
zFT1UEvvXILUbv04;Q4rm@xNgqlbE{!nIk7|<OIJDs=JuMA?G+3LN};Kk?-B>L*x=I
zqqLmOLLeeE<z&1sus>bCL<s(JOIJ3Qui1OGe%D?*u*+fmK8NMw#;~$!-(w9Vj?Xqj
z)))~GXv)*5G!w>z<zk2^)%HFu<)j5i<#~?Nf%STzvx_M#C=7-$v`4<Ps|UHe3#<ji
z`!^&D?$`+iYr%^LI(dU&QS7LQ7{OW~zE81JKkSD?gwb}EZU$>X3GP;(RFU>D#WSM%
zhPE6X2@!1&9xd#+IXEF6z@gHEkOGvNH&0A+v1=Kodv`zQA6tY}<3WYuS0&&_zGE)I
z^}q}MJg$kMZ;P#tb<G%o<Gh^`O$Ws$4YM8by7Pg9)%D4QM|C<R*TfC#Wg#RUb55dQ
zqyqcH><G2gy(>l0DqK}ZV=u8;VC5$^cw2a_LzqBO)qY>ji$B0<#6JPVZ4<y=j_hz~
zi$b!-XoMgRTxVA*0_$bRcO^)_011LgFAz+6y>;!rHrTZ}76%PALyMy0VAEc4PB=5<
zTD&#wgma&e=E}N7uBbJN2ngQ;vO)N+k025YI-!yL5J)RYv-DB}UWSMW=i;mgyq2Wn
z2Rx$$^d4uzhW&vt{nuuaoO;o<dD7@RTvk>@mhX`zxJYGl;v<ND(T6T%`QuK9m=Iyi
z-51!Rq0E@%QQ0Lz12H4pORyg_Zlgm!kUI?0;;_LW;KT}#E}J7ByxPE=;JKfcDEf*1
zuG}xHTQ2A@iIH#BIa2%r$2|t3B_6Z&#Bik0N(^#Er!C;OuF{F>{6&yjqnz9AeErEf
z>yJD4U0+B}1o+}RM9=kJduWkHC6*sA3JVXPy7o^6C*m=1X-Vu0`)K{_8z;zq>~QVA
z5R;=xQHMsSv;W-^M<6nVM34S$+h8?gs!Uq5uXJ)5yz4w;sNcTYG(_u%DWr&(^6O$b
zhiyc4GQ$j@#d{w+&?}w#o^cA=gAG!DH4S%QE3k6poSJs`9G1=;<b64*An%JcPS)Qq
zt3dAiHr%5mC&AYA-5BJ38o8<Jwk3z5oQQ=w&IP}~mYV`wZcwGb(>Tst$}vso<P`F-
zGdY&I<Du8NHs8%_Y6BWr(!Km(|Est>=OGavsQUXa+eT!bG5<=vei&<jT&#9-PQj5-
zJHX#!k+tFp9^Uv&d<FgeF3kCcB*wyFo<8AUk1m~|7o@UXbVQ_~UIy=EtEwSCV85)B
z*{o-LzbjAZL}pN7GO>lg+j=M6F%l;f(kzd?nztg{M(oiP&Z744*QVH>q#{4QD?Az*
z;7WMj!lm;usfa_-RX@W=1+ACgsUv~2{acN(TEfrL0w4F=%dh;HtZrD<6drH?PK`aI
zC_QX`yyv_tXDvv4zq&Z>k#GphrAdNRIJ?>#`RRqN@w<)!z9NDfE=_t4h(rtiL!#_&
zNOVZc>o15z6W@?1KC;=eEHDH@QBPmIgA`l)Lum{|s*=e@1>{eg2)3W&dKH?dqA4E5
z6v3^^G=AiFpDNnPwGr6iG||d~->D%Z&_)+U94Pq<!Mjg|{h8cwtQCBJZ1%x%g8M@)
z{b~GEne^Xy2i~EYu8a@0#op7rY=v=MEzCt>hv{Yx#`b8BQ+6~8j6mi6S_U2UK}1FD
z)r5=<Ut?f-z9C%7>Pc79ENVV_1Kc4o3O#EC(h=ki(@~A2vIxGHSLuOi@Iqc5yB*~;
z9V7}4xy-s1ir9qwyK+A0m$D5GT4S(EmI|e~6;zmWVdTcD+>!K`|3t@yvk%Qv4@-G>
z)y-sXGN#h%?82*@fED%+%=ZIv&BxS^n_HRn{J6hEToalrs<&D`E`##1!e%6*7GVTK
zhq0<QAqIH#lRJj?+EPY%cRkewmiMQeB3XrQMfPdg_q3}onj<}e+k><txA<WP)PuG#
zmKx6RAg-LoCX)z>5I+v54OesY@7X_LILnIkG-OpJ9}1WQ`?~gM|E`$|ovVr9*3jn8
z;k{v9>MX`BP&^pO-4Lqfptd+`3t{pu1j%0{wV&W+oND4~GJeT(K9=I&_*hNiyFDk#
zJ?R^E729#Y$MFiEQl=bs7{A>u2niLK3@Gs6Tn-?`Y*XTgh|)V<r?*yt4qE&UAXzOr
z&CJnhdAf500gL>ElD2Qys^JY=&HP_xR{}D-phfUI*_k(H$7NM+_``tbLW6cTEujfy
zDu2K|fxkZw>dePAS+zn(-peci%U*JQmg4Tl48J{=JSx+h+NWI=eSahA|3hwBik(Mj
zc-CS634v^;LmgnGrSyY+?xP4ajSCLorf1wVBVwW<A5f|Kd09TXFa=%@N2+Iqv<2mS
zl5!V1GtY+sRE61+r&Y0Zrk_C<Ru$apB-#!R<j=SzJv34ZTe3f_hjK9|ro#~9zGwdb
zTs!ae;~aA*SBDXkr4Y#bdzKEc_s!LFTBg*4CP}=;^VYqT&)bSfuweXp90>tQY)h#f
zT}lLPFWNS@!~&Tx^6!Hpp&#w|;*W5SKDMNjeP2Pw7<>Z(AKos$c*ZtkP{N@AB^>ha
z;Ad3v;KkRv_}AbsxJ|ysBzNB`hWJgviFrfeeKA5o#0*_A?!6DJTl=u8d-1+fq*>v6
z$~wpXYus)}J4~B^%Ze%~Z4j|{(CUrJfVgcnjsSv%tr^okmfk}W<HT3A<}IOfv5&cv
zL<_%<)d|t>gLvAh6?=b~p)}xpN9mU;ct`pke*EXeAB&ittR21O65TUxT+DMA$NdDf
z6u6;s|1Z9@DJ86^l>3p<@C&OE8t8=ga-oxPm04vPBFt!R0QzPBLZPnZZ5Gsp1YR(;
zE^8ndX_@q3;xU(eS)t#h($oZ>HM>MMP7jK?g5{u?dtNd1nLMdsLmL!xv&=l^G%hOM
z#9U8}11k3w4-K#aWAz{p+0X_nz_O$5+f(08HI7l$$@MC4pKfz~nd}V4cqk^3>$Hh=
zG@1eorMIDuZOM)Yx9TB-coU2x5q6T);)N((!21QxL58wLktsTRnnXp@mb2;uHFpld
zq=>){D&G|;h?A`Q1$09tL_ILk>T0(E<4AE_rAc$T{<FY1BCa#Ls@UE49m`Tv<ytkd
z1Nc3!eYNsf4}@#cI*JQNwc3ZyUYXc+79!y9(cfoj$=Z;9w4<~I_Nx#yI*%2u0=Dac
zxPB&@=;uKBj{s&tZHL&D7ASvxG<lQ1z#c6E<u3wI{wkP^>#zI}4a#4UpG+okO6*2z
zmBP6!VnA;Z>%iN~5%z%qqnKIU6|?$3v|&94@V<c|`5CSrhR~GmW?ijUjR5*KnSEw4
zL*YXxKJ;Hgq()M)b~`*Z-@lsGfkcv+fkodQ5yJLMb|Q>(=ohk73>hrPB8qbp&#u>L
z4k9!s#Qo{N??H_IC2e7;yG>B+V*p1$1dgrWwLY>9wx-wdSF81V1N_Kj6mU@>X+amt
z&Pn$=`~bTWPL)T`s`Ngy0vP%{0;9{_WX59Y5*a+CBI3BYgS~_R&9NL{DnfQg=Obo5
zt#%I@qM4mPaqOg>C3}eJP<~9Oo6wNs#c$@pGbldG$z?~OM|)ECT<DFaD$ZXI@nBQY
zGFqwUz@(Fs7AHYnxID{a>ofQRMe_nh%$1mPb(JGj0!e|02)l8_2}CjYhYE;91{+CT
zY#07*Dq4KPw6dUGVLF#QT2tNbTDLA(d*nELBbF{`2_A^9-AWvp0o>(M_J^H<6-@l2
z{|-D(N|(P3(hr#R|HC1MrPfqTucna;HY!r=>`J(76zOV5S|=J^kL~StRzM?6O8c|(
zR7tYXi(L;Lv+MW=pvgEgiri!3++)q{URuP8_0d|wE6aK?DR}^6jK#pGXEpF;!V6^T
zEMWhuwSoPwd_DD>DXAg%5bXalyOIYDm20s7%TM#GTg$5nO<5AZj*>ru^fOLKA}j1O
z`D1RtQIeP&eh7&kYtHJ%NWP-9=oOOT_|%BQU@?O!P&1>kjps#%@W?FV%bIN}h?u;C
ze@50IM2r6@)aW<95L95?hI+Fo<9%G=&kmUj2c}gulK+=hmC^oRS`}>AHN+7M;k%?B
zSM}D)NFM(ch?_5vZlxWkg4{`ze`>CE8?&%xLu<Ue=`>QXlaeHh@%5fybNLlVrZM}~
zff<_4qlt)jmG$5w?x1Npw=u>j2mL}o8+=OT7n8EzJ+^+v`ac-o<6@y!bN|MBj#we(
zbdM)PSsxn{(iH79*V{$nyN(|+S+t(aT6r*py9Aq8J%PyA8`KUD8?cUEZ}R=Yn|xoK
zvZ@1y0x86T^1VyYG|+@moC4ywu7m2eo_XX#+@bniT3>J$k(fn3o?l4&{3qv1R;i^1
zBicAAr(DPA{WYS|ezGG%N1N@|RetMrCa5DWnJswQJN$e;Y7HK<pWu-$5}0fG;!<9;
z%lG>uLF4f3#O$%Eh_V90k~l%7R0kStSIq<+0p^Y93c5EQ;A!(9YJsYyA^4-o>zv?m
zCVR<0)VF_!K+LT1w8UZ*r^Wn)S48iu=7)5=lKvZwh7;8OC^aLf9d0f>^Pas7W%I)Z
zHty&<b>uCsi1HK!sc!#-HVP3^lkR?!EcucU#(u%{mIWH!Ud{B)zu#I+O!U$pOdQse
zw>t9!<+~;UYKQenSVzOR`UJey=Y6t1GYE50K$yEO8U)pZ@&3Q@29!ZFQz_vq1D4_F
z{TkR^PhjfEz~}q5+6`bW@HIj&jXwcR|JRyV>-|>ibw-u{p^n*^fxUySz*9=@Md*ty
z)Uyuuap~9yg<D{~XOz#Ml2!RW^IMz{V42w|IbHUH(C$llpwQ@;QjoXo2$LzM;__Bl
zOjNP&;rmkL&Ckzl;r7GmYmQwluO67;ryfD!)!=Z6tQ{22!tP{Q;MM0~&q3h~EnCb-
zC*lqi&albbsdQpn(A&lDXEV+!C%7f<z`%;S#IsDi?%PqgY^MO<6T`8Ca9QByqET$^
z(`uQ*yu@`MdrmbEZz;|G@QhE-<J`dG_H^?T`ClkE+~|$5@pWVL1$0;6O<or{UBq|h
z$nIl5{+SHRC|%@B+(T1Co^RvwU&Mz9={)@#@-<d#bB@9#aVEOIEob2Df010SLhD#I
zd7*Mu*RAN;#O<putEd;gmqi0Gh7<n%!l#;p_I~N0y^IP;rm&>1l)25BU+$ErsoQK5
z#QdjquL3&`;oR~6@#w_$HL}VyZ#T0WPKMKrzvO>JI#5lqNvQ;aslcl>#CT<e(*e9f
zI{TQyqG(`rViM##`x215``-97?i-BIWo$zNVMH??021gZSY|sa-8TXakDFrWe%OzP
z*r(;(|3;uq<c2S6+P<-oG$NZ+#ISX%D31v{MZG6%c5Vm|P$g{U8O2jYz-K%$_9_w9
z4Q0DQG09$HGXG}A+2M4X9wE@NUA{9Smd;xz#EqCcs_&w$b;je#<iQe7Rn-kzTmVTD
z;71*e1F}pJnrB8!G8B)#uLIs~ONmB$Yae5K%D=p{+z_MYrxx;;;J>Y<7#5R^f73eK
zl^BGbbnsxIh9b~icyLuef3DU?q+*y9|8y?Nj2)ubSAzS`tcW&~2=*uYc4DM-8LQZ^
za{hK&ug1A=PBp>&0`d5HYEFH*dD))a2Owu8hOG+G`mjZ*Le8m?B<vWuroTe*wMA<S
zMBifsQ6T!ZX6zsWi!}#|4Mx$STy~V!J|OzWu=Y7<EH<yG)%tdA9t|2dYWk5p-IDA2
zV~nDcU|#tyeQkWn8{weIQTVqv!fLH`%ThNe6z2yF9c_(YiQF2q`Px08@qowv>v+-l
zXPE17oS|LWcV%f>qLDa>oIxY;*3zM91j2FlYU27GiEO{s{=&MYK*~Iu@HiuddoTW#
zzcb;%Sx_k$*{B4LteV<)4E{-czF#I3LyApa&xY1Xz+z|OT({{n`8iy}Mj87wpV8c2
zFDiV~FL?~3BBx=K9F1>&7z?oVEIV;7(k;-rf>R0sLdpC$C?5UB)i}R+%~sTLTXKR>
zTpF2RMV9jmD05Pk4VSxHxJnd+Y*z45fRiiOc+ju%8!O%onW7Rp{>3&%2q}<ypVAR-
zm*O3BFh`%sMWa0HZ%;%4z1ta?;q{4CBlkx~%iKoIC}HBwe4wQHy*g12Q??_bz(Rt}
zzhp;)5GS415o48D|4Ocr1gcL_V(CuVEy>w+hYUH6fm>VvQOh~?0;-`lpVNYK88S<`
z`^2L4?D-&$n$qPD89iWscW{kz;j5`&@cQ~MWQA5Np^zpu6x4X`TvbV#{1M!ou45dl
z(<UAIUf28_1z<m?=B(&j=!*D?dA+dDWOob<PFwfc_Z;mH+}z@?*bS<6qGp+N@02d@
zDN)(-rd)rAED&|8M2+}_FI8F?D;Xcgibd$eVEl#=h&-WIGIkH5tp$&!oZh#i3FC7$
zFL*Rjfpc%AJn*v!jJLVBR79aWw`)&mNM1P~H=qkvkPxh36BgkO5_bhOVb-WGcb{RW
z<Bl-;$#m`V5Rm$alaApS;~22!CYqYaA3DsZhd5h21kt-{Wd8_h3_9;fsKmQS2NM_6
zu>MRQOoXWYLP96Ox#SfJF^w=Rq5Y~mqfn^?;e1gjF7WZkyiE6A3`@nOET-TOPs2<=
z^P)jxMzD{OCA$PUIj#eJyeOG;=x~HQi&W63G?-a0`vH-h{4lTI;XPbN8DVf|vPg!2
z^9iORp6pQ5EV9eR>}}0@_)T}8sukCmjSlo-&zOKLQ98|<gV|-ZO_frf4+=o*z85o%
z=6OQX*P9;h3Fl3sFUZ?V{Fv|*{7w>(zVD8_7i;~|@?mY}`;Hkdr{Tj-nf9?xzu8QE
zy&Tm_x(M!fpOo7^m~PcrY;tuIUex9Mqg7U|4!xtSL>;fHq6=f(CcHQjY}Rz4Npy{W
z-c3sPIhJiIjMlvUG$+2?h`KB{)E*I`Q>}{m3|+x9%PBNUdOZH93^nOs(VSof6w^Pv
z(06n)@X*>ebM&D!(55?=rhWBIv_-BmZF4@uWAtF7NlQCuqjVLHXUe|RKC{nt)qdwS
znLZ($3S4a~hxphle6b8BR``C59)x<<aio;3Jg@nHDJ<K5DF8`O2wfI!uN<^sX-6Jq
z6y^}cc@_AjWIFg&Q87wWklC;X0E612f6k;csYn05$I7HgmEGy+8!7EqEa5t{=Uw~g
zhrE8a1;%H<mCTe%NP||O-p}K~Z(+h)Gy5UZz@Avwqf+>;Ku}o`9HKo{u<2!>!dG&3
zf&jipO!yGOcC1F#NJd7o8!B~Dm3=IJD`>Nzp^`7qQnEt)?r?6Z<_AC%NkBE3nVn(!
z*xs~so|SkfE*?>kpo-?Jzw41XL%oI)!li#)nI>CPooYAcXiv3bF_-K4<61D~+lbep
z`9n@^Au3|BuoXe1uBmAGE|K<xjQAqXrQkb1-R0WkOk6s4jOYHHF^HZ$0`$UeIuU{c
zsn}+A^v6Gx&CjB8tw4=Sb~;oJlL*8ic1`XoHHyC%p&-N?*?TVv!jV&m5>7THZSad`
z!4b$fK8VF3sGK*thw85{R&?lwrAFJEMhXL7@XlD^p2?S~{G4_^gt9x@kCYg>@iZRq
z)kDkX7ig-k`^SSHJQ)P_h-c@AGvKdL9$on{>3JZ^01=`{!AsaG*gVx7Ga8~#<u)s2
zy3epR^3=$N45TdQB?8NT87>OY!wOGJaC3?LbNFL0*FWOmHCN3>l<XQ&vTDzJsL;k9
zVb;~vd3GHv@Fc}o8QdE`IPOa$pwslsxJKaOqB+l66U4WXq3ACwxue|tE&kIl3>kQD
z7-dqD36y%gb5)#^ea866Z+As%c0WyLH4t%3`rAU$WF}RmiSEg4o#rf-sBH=wAZQw}
zWs0c7FGh(dw8`CSl=D@gzy1{WP@s00VE!4_5m6|~(oWHzvRG;=K85r!DzF&(^4EK2
zn*|Ohyv`-`3}#v;2FzTh^c!Q>4*^iw6inOk_`oF@G0Lw?@HvPvMCVG0fzva6Sd1(C
zT}^IRSlEV&;;V_}S@QI{U)N1d2Ry;@8W}P(_}g$cgG6L<eaagKBqCiP5h1X#Jkyw3
z2Y;DE&buA&sTQLR@vn14h}B?JSjgK5B{JkaEFvJm=mW1Kj=+KP0D9EK^jEpj0FpNg
zqZDXigbMZ!3u<|{!8rR0yPB+dO`{U%R3%jLC6T>n-XZzC$PXrW^=LG#>@yAi&;$n8
z-Ev*$zxujrqPKL%Dd<;RhB)3&LD`9^L#a9l8Ri+*1uuAMjXRvSN;PF9Hi1RR+#jdk
z62Igbz_=^U$}92DX111JbODmkBK)+*B+kmGClw}noyMGMLK%iclTp4!5akjvy>TeM
z#oP_cwYdBhL-&|W!}ldqN{E@G<|N+TV@u{%U>Jdr9^I_P2y4UY1~^bztTU>i^06Il
zKI-FT8Tztib?6%#GtfItw)kx>Iv14JcFC~AEgIP=F!e2sBDMfn_);+P6jC3FtP}e>
zJi17Q4NMDR?v^D)R@GVjN^Ft~n;?PwW6`J!;n4w8?${wnt`fXoSR3AE#xt@kKf#%C
zDF}U2(~PWi24_I%JImgX!npshe;&c?i*x&1x~u^>5t>wKcQd{FLgjO87g{`2n!2zG
zj?6Q4)c^z?%+u&KP2nM(jf02cc752wYn0eV(n6-$JFC*aU63kb$LL|-kF^GM6I<O~
z8732&7ErAMXk{p4<tJyE2rzLze$+k7*A-8y#!5zel(@w<DiQYBdV74Wv#Vqs@B;l!
zE_gLK*^xiwOfoPo0^|S9ED`4uVvoutzXE03`x@+NhA3YxJj&|wmd#jA?xI2yA3@3l
zU}h*`<Nne4tu91;6wpF>13`TDMwM`KG(8MlQ>j%d&FH5kqeT%0qw1LoeKnglt7@Or
z8Q#-ZI0cRPa7(N-DlM{d+zFi#RD5szIq(I(;i}`~Wf*GeUNk(Rw+DBw25V>_@KKAk
zSv0-cF8;8yRj0l`aa{LXC6yaEe(@l(eJ22pUj*L9FGp`f!y1zVDKO;RZ~z>?xN$Bx
zGSr&9jb9edrP8xo(EGt`ybM-wW+;IN`i@!?SxE@Hwcw3f)5gLFeh_X%{l+(;gd+a@
z&%C*PTAf`>vz!?5s_PZ#Ck^G0?XNdP&Z@0eJce<5>XY*k)UVMRUvOB*pKVWEadWSk
z7hbe>Xa5d+M#gwXzThnQ^t@>zT0k1?K;jiPu!Kr%zya5eA68I0<e>bce>`Pxv=Szf
zJx+l-&&F)xBU7<7?GE9lVk)udpjI)GduJdMP2oNx-0WpPq`4em?D+kY3{@XeFJ`ay
z&9&$a3v{7a4$ZE~-rlgYOPcom>2*u*z15jHwch9-hB?N{Iwq!Kg6a7bIRe<>UDt3h
zbbEpE4CC3TLhPRvvX^d+j=(B(vd}77@|*ios}VdWjQ&myyCpSr)q&>(qxJtG>Kmgg
z>w;}Nw(X8ONyoPBq+{E*d&fz~wr!gotD}zXbZqmT@4h?6{c(QnbH>@DYOShSt7gqr
zccyN<@?Qk6KdV?9=m6qZMSd-2&HraNYmnU<lIC-8f9SxKcUv@u%R0Kob~A$^+>eO+
z_9Eo%|C<2u9PqpoT36?qmHoyLi_VF1Yz2$_@;@}DESeiiqh3dszN3yX!YKWejbZ*D
z*jTGX??4*G1?n_{yF1=UnzG_ru<${mX4e|sMJ)AcT?6A#_xmSen|11*TAYy8F*_+H
zkpym2nqMUQ{@jY(C+ZFr<CehU*ILhrcoaY!BqA($pc21>`ch(mxPWawSQ6?WZHL7S
zj)94-+QWmJ&~ft9S3Jk_5%CtLT`9K05FR2V7opOX_5;VcVAC6I#@8D#5dL9fN$`j6
z`?QcM00j0I@(ItBsUW?6tr$YKo`Twfk%7O!h99R5_u!FPLVRbrGpG1CinFNIBmMfG
zqM2>o4RBAiHBP*L)ZOx|K)Ug-e0BTJ*7N@{U6q&qo;reJat+AVC)Q=B>OYqLvvv6?
z{A+gy*pi6RB4OKqZEfAT8$N4Bh#E=24nmg}qGlQ0#}&DcU-D08|BKVqudt^#CmC+J
z62kL*k5&i#){-O^&BGyAWxswz`*Wfpfv&Yk9a$@2Z^N!pd)fP<uHBC#lQQ4puhl-4
zLRV+qH|CxvG(iJH6455pGpCy`)|*eDLA8`Cu~yi3DZ0ZI7K44(lb1NmALo)l?3dRN
zvk<Ffaf>*<oPre*r6F2g+H&6lX4P)&(lQ@1lne}Ukwzb=pUh@8U^r)p+nm==`HKoH
zxzxEPVa{YbnFd9f<Y$h7=20rS0%&?_@@#4IBp68Mo#p9I4Tp5Ov8x1m=32QmZpw|6
z{hHYsSU7bY*6KgG|D%u5F`xjVlZfnV64noaAXc9BLxq{oWSUkz_37jvb*oGxbI=(w
zotZh&z@P6%=5?R*9M!*v4JF_&S~e%eW3M<-{_y;VDbRwFo7=^H&aeD5{HAJvf4@%I
z)5u+zr)_<RDyV)%Bjd~_Wne2*R;sD6W_p5y%E|u<?(WXe>kghj)&TS!Dsh+T4zIIG
zU{@Oa9c79f8@n9Bg0w<bBo5k|q2Wn9t=LY@^Pd@HwHrwrKN!JTb@>QV#_7YpP3o{W
zwl=d*M-RK`1MB$e^Wb}^q{Oh#3O2h9G5VfXD6aTbN|U3Y{LhbYz9u)(Skpm1D8h1H
z2CGP|ij-nI4c7Kj{2u`6lkG^Kg(1ZANR3R}D_%A<WAhA2=ig=JH~cO&6OL7@fgc7x
ztyZYJC>UCXbT7btxnxH8gk^`szb${qRnJK2F)G%XlHr9~E1CMHX=M>q^&joG?(cu;
zNk+D|2t@l$29-aW<)E*P$^2LTm=#x^FP}imAslGA7<K@l{KPc*AKRVj9N+N8E};B!
zryFGxcf&oXve1Dz!~HhJyMqN<))qoOw&N3jMwI~W1i1pN6gmsvQ5!z1f7@uY4K_Q1
z87f$>b6+34Naig6uWU|6@?0;4UU7i#fWz%4=!PG=k!Vw`z+U5W?f4?r4XJg;2*W#S
z%zUZpBtS$)S(#f!n4TWu&$bu>vM0FXk3U&QYQPMNp2Is6E5JN`OLGswn#**WhW7=6
z(9t7dDihL8qiDbG^?q64H7ik^yo;w}Qg{E1&m6}l%Un<&!k*zL5`RO~tG`CHPq4-k
z$}sZwLNnGnQCCOvANok*orMR_sH+p$S^+6fH{kX5fMaLj-l1~@y1s^JP7=9(GtYs1
zaFsRZP$GPRkaTe^So3)@>R}5%v4)_hb|YhrFyVO~i{`Qs&4OL;R`$2nDFLo@m><ei
ziO=$zHxTa3qt!fmQJk*d&XiohBkq8-u&|R7(#%Q|x(z{pc4b&=jkj52Z{w>-@oz@2
z69{HRUpm!=BroF}?w{?oRhrf%U(9?2J4t_pJ*g&%BJ%gPp>5+;a<BnY#O4q5KEK8l
z?nayUiObu3_&0GL;B7;K9*Z=q!<!dNINK?_B_UR8!B-s}p2JS&?GbSlt(3z~aa=B2
zpHL?`US#73r=)Mz%!K|;QuY?4t+JGI2$1XD;JZpYeT_C91F4Lg<7&?Jdg?A{-?lYe
zKxi~yplRp{;`07hTT*xQXggW_+d}6(sK)Eev_48pjsJ;7ak_x^*6pF18Y!NV`rawY
zt(Osf%Qu0OuDPG7{SD#M;PCzfw((i0gvH#evLL`!I_szPwU8K5*g224_tty)Eg*WD
zOOgS+Z3gM9b8Y_`OwPG0!pn=B*Gzib9O5y%IC=k@i6tOlsOtuD)Pvn@FJi_1Dw^N^
z?-QgK4)99;Ju3%D^>Z}MZX&~b{@^HFi1jMEKJ5k-jhwD#3Bm=}bIFLpaj4$cG>+|T
z3_|jpB#JQDKTvND*viiB2G2fOfUi%6`q)nyD_-Rcy|Y_PQ8AgJp#AzE7)nr?id$+S
zTgFP+(Rns&^8db-=7>%S<$n)vi$)Nh{fUgKhcQc_j2&+V-fOu{(})*DJ$*R-C0UDq
zTYL;#s#GQxFfB&JWPm;-H((?&=)$_!u$9(-Y?9%(`>qmrk#zkQFS(IV0Vpt_rQZfj
z6>M7aia?dVq)$(o{Tn#~34=+*CZG@wH7-frJox2#KJXWKp2C>GP;ainUmy>yX)h*<
z$5QM2@JV1gh+Pv?M6|v?H>hAbY|CFSqjokIK8~Vw65QE|op}$>t%NUglN)>RhU+=P
zT`G-Pc}<QtB3^a2S~xj901E^hyrK!&9r(1ryiG+rrpSe_Tl79#Ax@)(J%;mmTk%{=
zQMIPE6!z-Gm`zDB&8$W*_`aYxXm|GxK760SqnRPzGWH=%;U77>1^*FYx6~imnNAf(
zhK4wE5NI~r;~$7c$Ib8;aosK{^_B13ba|9W0HBGV;uK>I`{?f&1#UdCODTjA1Y(r4
zlIUtRWK(X$xFICq3K!4``j(Rg$#GwQ_i0*8l25jyFfF!AGP%DSo_&eZ)9Kp?sMm=+
zYdAuSvWp#o9gZ<P3xYIh6*RDi9M*rddRm@YX&!hUon86Q3Kl-Ya~t7P9ppSdsYhpH
zfq#0v9T$lb?&gO8P3dKFuG0<!M6QX{&+y3@uvroVp*zXI$$sQhp+?_1J0Z|q#<{<i
z6i?Jd|57bh3cVq!q^kS7)G0_bSd%NJ>@0}W)nkcoYW-EnY{N&)?7w)UwDMoP`QF)F
z#SlrXyaI|hWoO~z0#d5(pjDiryt2u;V*+8e6mv)pz?eDAw4x=Q<0(3jQ=dlXomB@k
z!0UV#LCSpr?meqGDfY@w>k_IZ`4;bqsfarpZah#1FTOrZyO;b^GmcqZaPr%2syZLf
zRIFAK+Q1cpkT|u*X4bU1y`q5EEonK$#rtU9eR7TXj8JMm%-zP#C*+Q*EaY>>CE?OO
ztd7qBx?hDRx_rbY7D2B))9~MGYqvC0P(~8ZHh^B+awR;4U#iLW_0}xaaz*0Tdwrj&
zP1tq(fGOwE8f@ZyRB12Tw_C|HTPmg%+JtF;l-mpnCtQmO5uO%Lg+m1N=|QbKJ}qp@
ziQWs(m5(^zQU-A^k7%j%;};YXn$GdvEr4Froswg{rHUz}?EZt!BDhn9?%Nx|G=1ky
zLcwMHV$$2U+-~E4bY7X1PM*I$P)jX8@8DX~{E@M)ebcYFx&2tgOBEF~pUjoNI?mvl
z<|^iv<*gemQ$AXz4^Vc>c=P%N=0|0`4(r@U{msG}GL`+lVX$n*TTDmt#wi17=M7|3
z4CrgXNS8^?Z3Qbxu%ovmXuQ3VO&_vUcu-}sJY9}L@f;G<31U~NmYPKf{WzYNJd6y^
zrhERSQigZnpknHA+ZBFWz-NRAo-n=FgjZ|duTdmj8gp7Cjjijx_=}~n;J9{g`Up3k
zk1CZUl8#X@foz>o^VunVSnInJ7Blcp;`P0G0`xa@U{AfjZg9NQ6TAp7J|B!&b|Sy*
zj^Xl|da*a3=N&jFMo1K-3SRhe*>e&Uq-bb83J_`lA-S2&b&or3&oI8$BaQ2?j_Vme
zrAS`_^+$3+&zB(jZ*S5?7v_Zz7j;GO1yo>53@-<q`0cKsN=jao<mdMK0FOvB;&`PF
z6#4ylp4!;??{smF`1tCQr<fteplh`BJXA>KO=(2E-22koi|C}E;Pm2LIK(Hwk-wEG
z9$cq5`owZvf?`$IQ^4NPN5;QGfW)&Ni1oaF>01WV?`jF`9EfcFsW@67+118ROs>zj
zJA{JHxcTAR&Y<tR;c;pL1Vt^y?30H@{kIEP^obM|*C6qHR$=ijAz401$NCkc3JkWo
zMWz$E-Ueecd(ECpDah|Cp?_(p8&S?TW9N3&NyIJRX)m1(K>k`{e1yRlJX+%0vD;wy
zIm4uth(ji6$c{hlBXP)nhA;WLkQd(dMl1QWDW*)=&=<VRsz?Lur{xE~(JDUj=?qG%
zBbOv?Ddw)TiOt}kEm6hEJ_U;*c1O%9LK#fvYfieI5o7MJP^FM%=oKXg+={bTU7_TF
zedYTG?U1WDs#+Cfol#l_h9@^tQ)0~m?gBE4;e`=|%Nq{~>R<kIV*mD@*P9yucBCLD
z7ejkLC=cjAc8tKlSb?Nr4ahc3oZv1fXlb4O&(3;=_OGq|<UzZOu^W4#yY_!u(IQUq
z6#d9COJkMR74q6118L@tz<&BY$^?EoKKX8FW(iP?lvgTlDwAVdcvouyX`1Vy_dPmH
z_6Ug8VI}2P8#5$dB2KiQKUzj)v380c1*rR~f@JS(kO9YtadcbMb}M?RCTZtv@HO3b
zkiB=^t^#eK2^cd!H!DtC`IQMirvx7t1oWz}>kW;ib-yT{MX3#pEGbIeyrHK+2{%0`
zCnjQ2aKi-^Pk8-y4iBRjZp@lA?$b}yW!Epm)pIO@z2m?oBa?xEw?`@#*NVY~o0br>
zJ(vy;2lySu<P6AZPagxqj~~Os|ARbVjsJr@VzxHYGT8iN#vsUpR*#0}6BoV=f;?_$
z^|VrFu}J7Tyq>Xy=>I_;sVWP;=;*jKW)WlFph1c|<Qxf|e^X1*VR)iHvO4bek=S>Q
zN-X%0`D`ugFR>AMc|>l$=ho^TBw#}t0!m1swn)KOZg1^;>k*BML9Ix*{H@HK`V5kl
z_Q<X5X5~_A?v(O6?Ia}Di|Ma7QAzOV-x5s4Y2M!8iq2$cMVilS8N+7VToAK`$KNHx
z)9`G>to8&@S@($18t;SZAqH*jpgh9T?C5PkjvlN6Iog<m%p3)sc@4A);EaKmXt~ej
z?S^J@kXTX!C|3nffHL+vY-&2WZc8Q;9+nDLui!-E!I^E-0ikwqGh%5?w~RZnsEOy{
zz{td6%|qC4Vjrz5xhVDXJxmsP$I+TEp3<S}8<YAC=@AYAtehcoEeU8b(UL?V1zZyh
z5gh)Mj?}slHQ1I0h)n*9gurj@eXUVkGfev5!US(Mno9a{d?7;Z8qFDmS_YsMyto80
zQul}brrL`HH^nO!ck#cC9oqcg#;$8g0ZeDfLl=l+(FX9Dt6+W^*#SMeym><{&JQLK
z^^3?G<S_O2pnW}ff~ROh9&Q%>b#Y3F&T8e3WBNNn4#o$5&l}JoZLk=JT3W;JB^>=V
z<yb2gVh~^Vyz^1=8`5S>XK<FA|6*$?4GOGd#>K=LKk~3x+OL+ddaKtk5{9kDq@v<*
zIk3$x?W!8&{K^=$D{@-tETK%rTsC;Na#foX5eMh1+!E2EVD@uc!hC+&gfs94{cgMl
zXD#pqW92#6!VMsN;jh`*FALJoEd!imA#qe$xd*J0bQ3js_HVVJo#!v?iuxtWE$+li
z&HGDyc$WRKPRheHal8H$*rolII&-i#1!OT-1ZdmF;w5|R@|7$kXv5UQ@VYg9-;%Rh
z#T%sqZrq7eQ!Nd^(4hp<=qH#m8v}25ENvhW!dF3Rae+WTWIQ;UY8`r&@-%L~bQTMn
zg&A=eRH-WXk!D?R2&GUeT`Vh4U<}9=GuHt@F^d_G;cg^(g>JEVd;huOs14)_2%^>$
z4YOJDqh*jQTnU9oVBmP{fu40p*Yy*<yJew~X3@t{;Std4f+PYVp-otxRq~@YjG1e8
zX@Eg$>Phx;WZX_EU=u?0@N}5)oD@$%&->;lKC|RpBZ<Ian|;0D3@U7<$l1fN;8AEl
z6jvoDDnppn%MXvjy-it1-Pv^S0{zAtx<V)(@(>|0BL*|BFqc09jCrg#7V+3bg-~M%
z4`>R(@Akrp1J?XWc$~+7$Y5XKZQDv7+yO7gh%4%j(yyh}p$SKUWlOQEzxReK+yG`H
z!qs@yf6nmMscuk%Qj>dzaCHXhefmRSG`MPAtI2eHvW*m(eQ8SpBoeNUpiqJ=;OIJ|
zf9qIx2|?6!iAJOgs#}C${;OM#wigqM>Ab~Y*7leSg2;KEzRvcYPlLMKL2EsLAu$10
zoBKX7H<xEnPxQ9ov?mWipRffaj0ZUKVp?A~vi<+<x=CyPe>;UiHX5(6C;|+gaf;?R
zg!_W_Fi1B=r~bmtRh=PF$r-&$N{-6sgJ@W`v1~8`!iMxMxR!pdEss*!=iD~>h*N%f
zfm8eif&YQ|vh7s>gyyl<wF{EOW6KOdXkOJ(42p!}d)qrG3#dAtrcRgyK`ntcQW(^K
z2@?AZPtk*%?kJ{iTfwlew?}lEmB$&Hv$jt=R3%lPk~g+2@1KCLsv~GPE-&wE(UT8@
zFej6_8ogPo1=>djRqehI!s$+LPf$GSmAc*9O2`v2fNi0iG)Zu0k|q0sd-+E;fNSgq
zT4~VWc3;15(jIGlwJUv98pra@PH{U0@LReoyH3TGeAO|`Y53=FqVQG9zSy}(KV9v@
zzMKkyrPn;3uTpyx>1v)4Q%KEmj*EXf!R48Y8Z{FpDv))QD`W?Swc-bLX*jt~GK3W6
zI$W9+FrbJ8=h7=;Rf_cs!#VNUbl<4v4bLkLh0w`uiEkJLs&zr2TK7Ltjk@$7I^FGP
zZUTX7v?UNa4L=QU6ObDGuQcokKW(Y)AAxSGA!?UIZUfcu2K?LbwKHEQ1l)wxx|<7Y
zqc`~SZTo&`cS)})mQnRyhj9`jT;c;(7CwEYHP}TtU}V2dBOVq<ix;4=OLZi@SBpvA
z7lLKzeB%!s3aF9OkC!KXVv5*O<o9YUjehh{tDIREk4=M4jB97CY}AA?e6G4)q_>ue
z|1Eemu9g#==U|bxbCGkO3RC6AiB}<Z=Hu}!@>MmfOE;@)N>kH}xz}do!g&Jj7(Vxe
zS!6f)B2L=oM=Uyr)DspI(VwLF26;Ies87Ba2*l|z8xNeR7UHD&NcQ_W|9(!7W=URB
z(nvFWf-zD{p_+S5ePNQb2zUB=gPL9Psna4xDy^KJc%>4llLAgm=AniZn#YBdNEto1
zGM8e)6XOG0WisBlcm*Q`aU}{6C5r~gmN`O<_Msn-Ge=-7T)B1pt!0u$M>pNoRFO0l
z%wg2jH>LSx5&wsWr~@%Ns$Q;aze814mnJt$Mk^zyg`PWLqGAUYiwiCdmpwxBJ*5xS
zSMA1BQPst!%)GrGGlB05@Dkw;b=<ifB@N*d7DsbZJ}mlkV~mAmeK`ftlg!yM+nS~R
z=9pu)?cXE<kL5}kq4@RLcNA;vCiwi%%B>e9yy^Y2pIT+A^e6sjnUhA2)7atAabjuj
z`)yJ#e5qp2$=uutF0bFsU2du3cGh0IqT<}8%<^LyH6w<*uQ%woWF-eHDtdE0&)85}
z3R*GGe;D8&nqFk@53GQU;xnDm`}bq3h#3#Fnxy$$=pV|ISYidk6u&Hv=Yqw}IxRs(
z@2|)wlC$z1dVvYRfJyUBF^DdIYy9x%Tm_h2y&0A;uDXPqzPcUX_v7J*Lr|k?JK)e4
zXWHT@iZc_(*y_qab)WRp!YyRz7Ega4Z)m6Mx7V+KYK)F)lPJI#6$@1zHnNI3amej%
zINdHei(te*(_#HVxFB)oy9=uK`@e`4&{;Vt@)kWHA@`>>4@uwEXM^P4Uk*zd#2W#}
z<=C-jf|5XG^5*(;Bp+`W|1Vg=0n;8SE@Ph*y)Q?4dxO6E=8o!1BSeA)oKxpJ9>O2*
z6X<AHZ`!}(HyHqr+udd0eJ>L(kN^tK<%3SmAyg#GiN>U9J30T61sv`22%X73CtdXA
zM+DAJ6N1tx6N`na?^{e>W0rWeSsYVBY1sX~3tVWirxu~|ivC;rp=5AQBAY4Z1bkhb
zb6r`OqLARv#|^Y+;_Q)NlYRLF4CtXcNdD=+Ng-w_Bn3b(QwypRk1LhJ^H%MmIYS5$
zR)Zs|a-nC-AG}a9r>Sk-z&*s(*YBD67LMF0j=(|!qyv*28jVsyU$a(TQb?ZWIHQrh
zMb+8*FJG$w{Hli$9zE7%A940{=gK?Vq`A2}A6M@TV!|$YTpHZKG($y@W}UFjjqsAF
zQhG8)fH+XC!*n@B>WwE1t(o`+1L<9I+ZG-aEdPuiGLaKJLnAQCErp7DE<@oE*fbzS
zL`-}G5iF}2MK<G;#SEz}SpGsS{X1w>)Wge3caX+-92un|Co87}*W^02A_xYiHdPvL
zFM&5eLeg^TQ%e!bRg<ejTx(n@rO+!S@*=WTwi%E@M*dKLcX#}f>IIhoZ!79fs-BpX
zG|tKqCI=~ugMo|X?i8+X%DoF$QF7KR!0p8=EI#@pVML2rTnpcnqLf+}+l(V@*K1sa
zj~N*`r*B-eHt(OsN`t@qS*iuy)WTtk1)aEQy&*+y2E$A0!4Tw2D_tHdKd*FDl&#+F
z85h7+HeRm6(9lKk>u4_UKsjaF=%2zYRZlm|-PYOX+v8`xjddqB9S*tE%l_jr4bH-I
zHWCa=|0rrJ|3R-Zd7Uk~XWCJI41FU0a-)0%l7R~yeR$POYhIefx2sN;fbXhr2bW`O
zGOAu$4PNxRY~WEzOs4Mvc1)9V5Vp_w1L}aObsE>70o6ubY;FAL^*Ee5HF`G<05jun
zqM1_UC5b@^<%9}&O|=fVf^L@yU@*+x1`lW-%5v~ynL_C&M6rzMMSgNNEfK0{-6F^O
zZ0?knKGRt03G0h_-`9>?xaYH-6<-xiX`J2K_Kf~WNx?$=9d@c}DV{4pDee5S4*@vb
z=9<W8y|l8X^du1f)v*J%?rOb}$8!~O+5E}`CY>9&cq_J|o%;_k#o3y&e&5w8x`omQ
z1ut{z;)E$+azoz^FuB$Uir=e~WaXMOWI&Jatn+b;H+IH+M=eYzj3>#MU*<S>%a8BA
z*k5RTLr<eI`(|76K#>1Yr!bqxod`??dd{d^FpW5uUz%j6LAM0P87j8w+FF?#s>~JF
z*yx*#FPxW6HL%tpJTrUs$Er5hYSBcj?V0_4wI@!c``0V~{MkF3pw*jeBckMkpg0sV
zUW^uBxAPk^HC)kLv^;>|Ns2y?D=@btTZAeP6Il}+kGFY&crR9&Q2h0Lx(l%Q)b)V=
z=;0Li<x>_*2waFvls%FU>YMva#`zv~4o53o6O8%E=O;oPJv6GWwH2=ai1VdS&}>gJ
zm+t^6*axu=9+}=R1qVeh0?r5Nz%!<}FL%qqh*xP1Nd$i-t!`#WeV==IsS1_1=HevB
z<hg@H*MxUoGPeWgjCUEq(hMNz+I-j-TO-aW6JQV6qeyVsfyegdWZyz{t{yO;dfVD?
z;p`cAqHUcTSNOHoX>$LfwSrH;`CD*-{^51zn-b0r0>fOyRx5wNe$~Ls&!|_c?`xDZ
zg^Ld?X-3}h4u%@HqPEA{{(gy8%d@y}gd2<DHU=g>U{DuC(iYX{W=Mc-ZQB#~7&xjx
zg@L+-QWb^g{5$PkQG%(?fH{xzd<Ti^1pbq8`ta{mb7XZH7bJ)6M59;H1MUp=Bw0?j
ztrb<{X-=KTs(go<(+INWEh9W<xdU#%k;caBRZWvVmwiD_G1u2PRYOztgk_$HmxV0S
z(EJ&##a418IFzF#!wzU0gqJqOU(yT}{70ep4KjxJBY;HKI3N(4$e$)9w{=M0#4!1x
zYV4yMiHlyyyDMkwV+=)&`DZC8?cD$;s^NrJ2D2qEbFmZ(46{ARA~wlIJQCvHEm2<l
zBD`hY!(=}QOmg!qH8A-#gUgXpuX$uASgC_yObj$4dP|ae831Yh2Ey^{Q)hv2>9(7M
z{le$qTIU$xCKuZ&!BJR53vrSa*XS8Gu2OLhF}uCw7d?4h-N6ys0~ys|#}MHmPs{Oh
z(>v;t#*CMnkw{a)VxTQPbXlBc1lfAh3o&Q;j?&hR6Dlf-P7a1~t{4Lc_%w1Ekv9eE
zPzdNOiJ3Zu1%Nw2-%9iy9(VURjjcUd_?)xAW{{mJkS_f!NS+WHtM$-Ero76n(Cg82
zS<q8B8*QZ@8Onk3hq(toThR~KQ+$-iVA0u(;TgU6Y;$&4o8vc8d2F$%TJ8P~=a<NW
za*BLkkM)B8;3xPy=lG>WKK)$t!M>A<Kd#DkYJI-_9CZHYK4p<{$fP);E=F%_6%gxZ
zZMp2qp811nUQfhhtv$8k1MMB{{c7&E$IRN{q|!!`hqViqb?e*mjVn^(=-)aFO?$&t
zQp%J$FBdTh(C}vnM3}PeaZ8LJFTA6nL<Wv$3W?{U{VV(fG=Fv@$Gu%=N(&mL=v>y!
zND0aEGQc7o4l!A>>?}VCqOedSxX*Fs8+?#^*I1{$nmd{>w%RnV$_}&f2OcAzkA^gk
z_2=~Q+3JXS&@KIiFg`0u&HHVGjNb%+cZIiVAsRgo!aC{{B)zAN{JRmKyXfsLe_eAc
zY1Xnbwa(Zxo^vF$^%@)qn3j_xT5Cm`e59s(2J~D>EMb8pFmfM|RG*9e(%(fI8z?#Q
z{9lu!H+5#h$h3}*hTL)<q8dy6L_}hjjZo;qWS`+bUl2Ru`q<BG`5arV-E81a=bP9J
zM(hnkmyMx^#8{Eep#HFiUp|-EUp$~zxSbx!5A_}$S9ChH+b>+D=;pDGIMPLQk2cne
z1HK5a%3{nWe_TZ-$?!L3hn}%DX#~})k_5@(#NafX9*E=!#PiPaYuwdtMJ6cJgUNMR
zw^>-~Njxz#<1s7)Oduti3Kw3%H_4B1ILN;qo%cSO1uEcI$SZnu%Xe?ooYT{--IY0<
zpvA~-jHJ}+a5*AH@Sk}8S*o5XUS#lj1vqGpXV+RYy(?`pJ396DbR-jZ2(*9WBFhK)
z=ZV!T%0s|pn9u$WmqWjh>ZumuQ)T^uaF^9*gMFUc<t1Ph&dkrhMMq@65W6MVl%w$`
z48cgtT<9!yHbceZ22P0Yc#$sgWmN%5r^h6t#$?qV2})Iw)?{O@!Wbl3W-%fD4)kR7
z^;(NX&8Cry2mPs7t2K)2Y=+oX7wT7>$x0F#rvqLXGt4t$RN_-_GB7DV-04?S7G>Aa
z@Aa~V%m&hTn~|BF>+lV0NNuh|;if|0Y&O<2+QB~2KhM?nT4}-0`BAz0L78tQy(oN<
ztq)#QG70ON4og{(VyRx7fF80NDBV4hI#o3!?th5ajp5SpEU^19O*ez9laNWOb4hVo
z^CY8zfonJAt`oqH<Rd42eAA2zpG^53`c)|XyG)3omWlv`Vf>dqvH9`Ww8;SU=Fb7e
zX{tc-^kfS<Npa}siMHL;B#Jjx!tuT{Gm5fOVS>$!L|^PkHJxi%Y9_Txz~HBYd;7sr
z2g&od7+5}#DCQvX9Qzqh2N4fi@t^Pu@6=3!HgtOb66JY9qH?2(Y5!l)MRBg&C_=m=
zQ@fZcP@;4ZhI+ZI0_<88<_eUj@RZO@M$g5nY^DZNG2-mJ>N8==b#(0+-*i&KXVXm`
z*ypvlW4FDHh)ciJBV@}-0q6;lN(XL(&k_(kv2()^U!LqO;Yo8_8N}Skm2k*Dd|ZQn
zng^0WwHH!!#zlux!YX&-ITpzXdrlRUY{{!6dFS5lk60><M@V!ss(@3e*csiPR=|Y&
zC*z<Z`SxC95;nr|@Y(XvjTo}*U@Ywo?ld{=%^VGBtKE=;r<etN05hIe{MBy*A`H|%
zTzXJHgvSfX?@k$i6F_Z{eCNi%C{qZOQlGu{-xmAPe!$I))|1oqcFex|Pk74B&Uu;b
z{zxiGOz4&pxuQ+Tm8RfFbMzGgCKI)7d)^yjzAqa(S|rMo{=zKvab&eMeptJ4sLdAf
zHlHYX?~nDA>}qd#8z84Oo>MS}tJOYTJ=d(Xq%LRIxmHLkL$^RT@Gj7lYrRe)x_wts
zG#e}4=!SmPUN7<;S(T@Kqg8*m;O}lc!%YBt&cQ(WJXQ@hgI-S8$MxjMaD-9!(tghy
z<8Bvq=F%y1#Ga)f!?Lfk{zWT%F03D<ph>WI!J-w6>BBWfCqT!8_j67_E|ivE3p$yR
zSj(=I-g##U3*IO6zlI4$%G7wHyIXH_BaoJN8P8E&MtdGxKr2#MaA#uY)x}A+$C!Sz
zz4b4QZE3KHm$%J{$L=_0xM?AZzE$g0{jJr)VHVAMglDOU4Gyix4ic&P52`GJVYI$K
zPMQnX3@-Rzz*{-696wt0A`Qy>YdET-AyZr*&nw1Nz{wT57?^^-W~=-H9p`3)<6%GE
z4X97jD>-(siP=7vlg)QrzK=&@gKK&*Ai3hnl;WE{uha4p;$kK)u`L8p92bwSMEPW2
z6Y1>ZF=dB*Yw*yhy4MdL93L<qdgx@b#_GssEZl?wXkXauhQ&VaiD*-#%Na(GWmq*d
z%C<dGg~rUC>uWR_uf^3ipdyeopeqyR1{29JF2W4`uzgbu^F_d@HA8bXy~^lD|4FwL
zO@jn1%Q$L>-CuaMf^C-ax-@h8xY#ujKXqu5SNv$pq`%83Yf4TwU&ZKN*$3wMIWJHB
z?PSmZ4m~rSL)0E+S6f$jCaXBIHmSR#cjlV1y)vO-D;2!L99_Uj#ez*~{(L2%Db^CL
zmA;9;e2lHFjE!j8VsujdEBz@^wTrM`_Y22@xywJ5n{T-NDmCBmeyHhl*N$1a1(mZS
zc;F53BRlx7N#@@@90$Svq56{4Zi_d&iTgNb0B7V3nB2t-K)PVw=7h=|u>{;Mz8MO#
z)K$1M=MN?5bcsz+v}0cKO3XUX_WUlT&MC$_W8yA|sQ;G7im;<mOWimGPH|Glo7nqX
z?k8XQ>1tn*{$+&iH^p^gH~p0s9umRRU=Y1rkq8IP!Dlz+SY5@VjR&dsJ2%Oc*xOD3
zFb!D?S5naUpjMy%heGTJNsL)&0lc~OQ;CRzr99&0fu#5>GZQOBf!Jr7V`ifs3cPPM
zjD#_IB%gvTY3M(Z?|T?ojC0Ai-RPU#Y>VKVFT@*4GMC=ipIG-fNk#igG`QX_j&G&v
zeRXj*Uq#nXbj@7k0*!MAE?-|?%~Dts05)UQtt`23z=`zYhDzetzGZRS!l_SN-C@>x
zOTVDql6O}^ltDe{fzT3LmCdTDwH!qw>4#+T=a;i44tO=oB&5De@tjE;a0?VW&0+zY
z)AH%eqcsAneRdo@=h5Po`Wg7E@rZ<^go0)9@%&0bM{$`Uh=Z|lvAZVlya75uYie$(
z2yr?XT~RNf%hKLhGh%iI%pmO6$`0>G<npA=ydc}z9RMDfTlYhoKF%y%I{8cQH~p)9
zvJIB#9fuBHe!qlrs6S)>JbSWo2OHU9cH@c;Vz23-*~v%N4*ub^xBWSF7{2WNL}qs~
z_x3p(H~%?d>oj)_-;R98L+)M*?0vB*=SR$%d?7Q3J7-G(JUKECbmI+9B`J&oX!pHg
z?(X2$pNF(kl<GhJt=F>Dl{aL;y_0^vN5wlUU^^riGf&{jZh<{}Rbbz`OfB%|nV`MW
zV{|^ex_3y_pCc?vOks0F9CaLjsTH;k);9C=@V)PE&?Usv_%2WIJvy-mD7M$pLOmC*
z!ItpQW0P?k@ApLh<1Da4ncj_)bSP88T|r}VZUf`NkmHTiHTw6ah@nT5LGuH?DWM>&
zz_$;GBZ6y4n0xnv2(G{160)GZyCEv+n(;8AfNn2vz)iv%Tw=avBhev7V4ig&Vjb})
zx8n^!Q<cjh`o4h~JMa}6pwmR|%=q&}G_95gHIB!5n7WDkp<jvB=C8E!*Tv)~ORmcx
zWn_}+-!P|HSe0n=-927qci9wtp_kRr=o>#Or`VFgismbu<U;yDbJ?kNOPeidRT|nM
zSzHG-CY|QcB$o6FNZaxJZrr~6wWfM+hOl3~$Vh@XeBJ^IB^$okz@i5Whe2glLs6_l
z=7C$3w^(P-c<f^Gba6qg9@#40TUE?wa}n;>8ruZp7M`N#=BjZgXZHxuxXM4nCA`GL
zpTw5kS+;6z_~JSA;yD4NevmiQ9-<<{3q!e=wYsXv3d1*wt+Wl)9_d-%<~ij($P1d}
zTKU$<^A+gMyh6k1fz0P+k1kXd)+mvUne3T*^|FY|#v#T)HLY}#j2My^2GCSH)UvZ(
zAjE`oy)@k%GDPZ8{Lg=ML&C^AeZo4Xm{hF)L`M%uDN94WIfI(=7zoHt+>R~ii7}q^
z_U9Yh5#gOZ9sPd?q_oL=4oA=SNh|A@3LW6lgp7Q<dW1nI5O15?fs8?bK4}E+^G-y?
zr3lS93}z7{iwm_rE6Hs=bP(2=!^zcQV;?Ywp7RTZiv+i2o*M$gg@#J8_nv1?uX*lF
zwUA8hlY$^j9hHJW0*I;ItSI97lhSdeO;IAmTIBMXn8?xK8}}a9i#n|qK2ZD4*rj8F
zA9@$noGIBY-wj5N8-y4)vA-|Ko#6Rc8p3MGOhrVqZ<Ij!iWim;G5(}cij3bXZ_h<*
zQB#wlbU?U6{*#Xo`hn!z^0?@lY~S?_jt70SR%yUTmSG9A7m!Klbe8Y^2&`4r%Cu`$
zbF-lixBSc;gT^<$w0*bIE3_Urnnr(}+n%YWy-_?}4dhMSAVbx+33d*3aPbcv*)~Gj
zi0Iv1{5^)ItTw-jGb(90Z`H_GVppv+Nn6%ryEY5nTsaH=nhvG=%mq@&3ShVPWv@~$
zqb@w7w1dT{1c)jL9UrfyLSPa<9DMz^_6;Mo&cCVTpp4gEHm)F&VX|XdY`YHbFyfg}
zB^(s>g>pm8RWBvuFJebuT3?3{)DO28k%;$%@K18q9fUDF5YqRT6x*asyUsoK%S876
z`Zm+^wI~M&%F%=ncN!V^^`tyYoY`@BJjh<JXnTcz3V1GCga*O6$xlSPmT;eu#zU&Z
zg;R%d=?9?4p!{#sNH0*q;AOj<{T1~&G;)zlG(}Ooi0H}*w%=J7n_iug3eM5&18UG0
zoOdC#qTN7QvPXDivR2X>EK&3hF?*<yb@oTyQ>4mx_exb7w7#hq9E+gX+Rg>>%f^~+
z5b*7{@AM7Z#9)RrO$#jLvPI1=q`5i5CFeh*&F*3to)f>2D-*9>-??P5Z7uveb(j4b
z4m1^z(Vlo*jjYOK57xXl%^XWEU8^@@rnhH8mFs5qcPjF(+JsyrzCx=v$ra%s9~iA4
z{?U(?@kRpBva4Dzz8BQ?FwV+~`QU4Ga08aGnFj>uON-4m<$npXnGn+n?M0`t+fOW6
z-@8syyxRFzk0OKr#FcITfV{0lcNm*drye@ORR)81Yn1=(6}Wz<R=}k#&2i3FxxjG2
zm(PoFF0Hn9^UnO2y@&2JqgPVfqJBd0avPINV)tB)N>Heygvk0xiryn4O8W8mW)0A9
z+}&KF+T9G>!y+L+YUOW^_NB!1A&Jq!dTY^OHv-X5?llf9?&NQIn|vt=6=^9w;}CRq
zii!m1ueBCltF*IoH#yZ&CUi!<roFs$R}&vwDQp-2u1w}w*bLee4PF=>^5`9hx2M<W
zH@cM)@EmRVe9myv5;e7)<dr2&r~^#RE;o3aOsfpuT?ak{8Cv4cJM{|Q24AZ+qr6d3
z4^@a%sK7t}AdBg_h@OeFv03h?&#%5f73k7$OQnZR1q;(JUu=>oh;@(7Fd^WzK|cDP
zNe0A_69h6oF+ipeTG!OLtxn_;!jgx>&z{!aN>pDoRw{WHsKnwy&(#_Ey8te0knRlZ
zb<?(C!E&5LiF{ca3pgh|YU!?cq8}9k+T2_1`se3LvuagnqzAhFL7^A}oG`A~Rky3r
zv}GnK+!(QiE?g2%r{Po;ekF1?7C6z30%)oFT>Q(I*LB)-qrNN$q~Yx(4dz_h-emdO
z=nR<xmG<oTk99Ip#sPA~fdGORW~z`URT;JP)EvE7@E79YltZV4@UJU;=ByaCY~Mv-
z2jaq|jZo{3varnP<cyG)yj`ogF4b{YY6y%=f*389oa-Gha8C0tV4{v|jyqfNOc#-x
zrRLa)Y{Zu8v2dXuMCS&{tdmOmT5ZJKt<}$ZhtEVjNA0`1IB#Jlu7R3DUMIh8!z*$;
zC&@vqUiGNb$9hD}O%kCBZCbPBs)*`&F*$TfTMV{x)+D#MgO*qafuZ3H8V>isRR8Yp
zVi1>4LIjXF9Nrzee!%@xx{BV=f@g>;W7y_?qsCblWgz9uTjvY%HF**Vs4*NQaMR)#
zUz%~5uu{c}@9Uq$0I=6CJg$FzX*0%`%VdmjX+L4c!$GCa9v~b40*k|UE?hQ)@LYL!
zHe8s~1YPR1IFS3ao@>XKI{s|Vom+P`S+I?N^Y!&lZbfxTphSyR$v90I?uFmaR{LT+
z5z4L}Qaec_D|LJ83kY2Oa51(S`gXvxs-ObtaYbE!;y&f<8c^b05Lxv}_Ze61arbbq
zv=XG?lX0zd;#`;GwbnY&f2}w_A*f%JZaV5HA-suM9o{P<ueG*g*KNb*K4F*sh^9+2
zuYE~BYeUJDgR(JEX#tTPXkrJOX;8Mv)v(<VBg|&-f@4&spuew;gB|c<n{yv1(3c+V
zKfls?4<zBs13Q?F_zxaxjEI0)TCTF&rNL|}6&?QOu(g0OL$cg9`ky6i1cVkEH#5~r
zpUMYmuvGmZoSSKD?*k5k(I3T@2k1BxN-;~>JQcS9HUH=4IH}@dKH`;@yg{}-#PPEQ
zyPwNG;(i?5Jl}#5Q=F(HZt~qdM-?kwS%SW=IxDpfP$wvxEHpW9+xNkD)0rVox6Z?T
zCOU-0WQSCx84Y0t(BFKg|My(Yl)&N|bw>l9-3j?Jbd&VM49fY2_l*0I&xKCosHv5%
zP;K$^7Kr$y!lqu2<Z~$P@_v56v3kH>VbE@?(-1=`cGWz2r_|9&)r}O8X*ZU=OSN^-
zbEf<WP($5T&l%Lr>Dc>4!Zn*$J6NXDwrB$F_73fiAg~rwyl!`nUP-@fP_m>`vRvpl
zA!9rJ(eS3ObzWz&P4Y;TY4ML1LH6QOkp1;R@!tNl7RH$6jx7Ucn!3xq!=9fv87aBa
z;d`r_6KC-v%(zhdaEbH6L^qB50CiJqRs$li>C_6d0a8R=$bHgcRnq^IsDuwPzuD!T
zgMrx)3V0X>_bM82_nP_r@+<3rl41hY3e)gM+A~svAB2C}P0NQ;<ri_M=#N+uE0v;J
z%MVD6c&c1v%!==8e`-^zmKDu9Ly0G&oG<)}OOXYTmS&xxu&Qk%GdzTA&un~cHgpRC
zl)u7?v1GDJ>x=G_%j?aVHWvbKJqoQD=2izBPX>ErAiW9(#!CBf`kM)SIxOR;c)pr>
zVyEl5tyBuHTsJ4N`f#5Gn*u;evaUyCTSUGQW=BNc=ZqAr{gw6D8a7x|{I<JO%8WCN
z--EDmFXEbKet#jFJbz390;)*QHm()ueRsZq2Aejxv_BGTZB^Rf)Srf?InCU787p6X
zaSjyzzMJqa#ACnSre5eSr0#QM;@A-X=4?m)5@tA>oyWD4AMoC~jFsVe>KYA35|X?o
zTqleFcM(C&X)h;w!aSjR_NXW~C?XB`H@=(e;yiYV>9m#=-?gW9aoafUG>Zq^p~i_l
zKo`tiV_-aBn&u{oTYPD}GQ&6Hd!_x+GrkR;{I2|?!fc?lhVysgfiCrzm8jx7cG_F6
zGgFM*P?rAmH{WO~;bXG8Yc4KTRHZvFVWf#3s{w7vpoHDt&86%iz7tC@cfYxz6pR%v
zCNcz!Y|UVa42&1$*jnC$CR=7eAJ#;*k?@Sw*ks~Cj_@faNN?bZZs~D@`iwf%;XFZC
znD^qSK(~}>nUJ!Uq-(3PKBRlZZ}LG{$zT`jRc*_eUSQXA)@qGtPzZ}6w8UubmfSXE
zux}8Nobb4#Mm)wWBn7DaIXjfkP%Si{R>YpiYv}5<B{^$tNk0>Kc{v8SU)p&+AZOXG
z5!vnz`9nKiT?gv`{Tt8Et~hi@KA4rSN`!NKn1nsaCZj)MNhcraDptT^%FskSp^1D-
zh>T>Zlr1p^?zrHdh+|00-@R1BW{_Zcd6Td_+zQy$RSO3n{HGefsZM$p-4j`n7D6xB
zB6K1z)ECdfV#spVVFv>_qFFO+^8YSknpS^kFYpOwh@L;;o(m^F5})9yS>23~pO6wM
zr_xC`L|%vECv><@G!PXi6RuDUriil1u}u!;+XUNNTIHXMuW3i9rD*hMgEgn^`Q${C
z^E1_9;e$P#&HV28hc>dnhp*j71m<$oS620O?8+YKFg?}`{;CH=OT8*hz1R@_KIKx}
zgY(U$V#>?kEA)7pU2Cvl^@}`-(q3NRBhd-1-TQjSM)=%wz|3lhyn^)b;Aq-)N|en1
zZ$BosuLUM`BQomUcKo`^Tk7vF9aXA`I$a|j&0Yxn>{xEbxoVzJ!+d*ffq#Iv^os@*
zHW|WL!!}1Z(_<az5`nuQBYR?%@o4OkQkTm<Tzmm$#F2p*1VxLj2d3*^zlgS&`DI<~
zwoZ>+JZcp-iW!;>0)3JSG*bKdiH%ThVF{8ED@P*!VN8C_kMz?B`&VPL{k4I{oetE=
znz*-%8Pz*(KP|^<i<#1m)LwS<3#A{4aTKD%S&ITy`s9;9$uJSW$5NW~dOxpcr{mwC
zhj_nVOUt60M_*L5sw|gVM0p_b*pX3=TnX6AY={#B4!L45f|rf*L+Nwd)6z-;^iuI^
zB$4K33O2^%TDx|1pp{!2HrCjq*51JEZk6lXh&h}K{DU)y4e6T@ZMoS7^`-dEJpWwT
zu5tb{6U@j4YBH!d$0b0;=fy2d)3oII`itKM^t|IQylwyEZ%VA}XRk3K&7&^SqpVr}
zm$w{}Jy;gv^pgdl<{1J5E%|H9#%%pPiUH)8Ar$lci6>KfnHA@0S4tJZFla@3SzxFw
zdQY7MGNf{G!iifCRLE`FPm~7|=>N9oY8E;AoaP^Zh=yHp+^ihJLSYoD3WFpC{UJ_i
znl98@n&L#y)l;s6Huts$HR+0p<OgPkRYb|Qom;2w7@y=#Y~sobb$2h4JFU#vrM`Dv
zm=nq`7XrN^gB1u=_Xb~5YQ+aB((rO3tEt(X^6)qwbeCX#B_Lql<TuHJZ26QbA@0Zj
zZB>u}Woz7%)*3kEhRxB+bDl*T&+&^l@)rrCOo;fq;T_m5Y}m%JkPPnh*~c{`*7kMQ
zk6OGr%Jse*i|Iyqnke!}IxW>k{cor~=0$4)bHB_uH9v^F;^J~FVSJ~I2Qk>}eb*Q)
zCfPxs7(;=hxmSY^sP0gh-;E6vx}1}-Vc!7Qgs02CzE{@akX`Ue()O!oI^-lx9&*%=
z3fkJ4U;-MlD{A_mA~PxA=Sx3J2{h&%zdAF{Q)36n(gMFN`);@j!;ZXCM6w!my+dmV
z6)e!msEu*>+NQnaQc)GyuzN~wqj(pyiYdxPGNI)pATk)G_+%pof*_7)-nRO{2xoy?
zZqMBksZogkh!$&nQ#Wl<2+&Bh6~bS7=bJ6;!QXelTF0{nQC}@0WSG`X+fU?uz%~U<
zaKT3>1rndhc8UuyK-hhj%mRv*%9yX8B8YR8Pj-)GFQp9kuRfU)x1;15>Sj0=<<#CT
zhIXB8d|i!-t)pPf)EGDvh5Qbm3XqnC)+omh?}+<?+>%zhC*(nAi=Lg9W7Oae)ro@@
zVMZK)M|=5DT}@S=VwmKEJ%_o=F8!|p6~}ruW9Oml`@{)q_TViSDYw{PN|CYoRW65T
z#H%HE+hzIs+!l^o9h>TIGBP&gx}R$pWd2h6XMRU+KXqy9Tim}_nPbOstpbZ^bs5P)
zwgipp6khEA9DHh}lnXG1e{7b5ZqWN%wAW{|&9;YT?`?^?u$;UC-v4@amrZ*5a#R7I
zRr4)dU6e+z7T%&_&fTT+a-{Y<Y&m|CX-5cSs`czf1`fkU!zKMx)H0@l>C#ilJDJbo
z>P>8K<Y{+VH9Xqn#ilqWNf010zXU-9L(E<;t_y(yj;tpaeU$SLGO9x(&N#Eq$_%;I
z$WT6_?E%**N(&a}^NpM8n1%Ff+q*to>m@Eu_ixE&ctg2^UhB7(kC1@@ag03eV7h%<
zdAw%v=f$R?j$+}Ay*>pgX`$~{t?+^Qb#GY|Ffb6z3fkYelc2#U>H2{HI24K?&t=v-
z)J|n7y<uC{Wi%>Zf<G4Taq<o<3Q2=wW_zQaDK4NH>3Eel!s$Is2APGWda{V-x1ZB{
zs%T$TEyi4KyiP^5e@IQxdrK8i%l_tMZw18NSjHe?=KNMxX)YHaDdavX%X(g#saFC&
z)o2KJ_1=;dM~BP4c9H?Ho54M`GWG94&3$3MwJnf#<qYW$m8hz{H@vDYWg9OrTB9@c
z1Z?{#MhWg?gFAE&@@HKiViov57igY;c2`3i7jf{K_<*$1Hwz4lGNOI{JeIN~`G(z4
zm&%h3Ndt*>G$|BSu<2JQeB!I79mS<1C-kn-Xqs;P15`E+H+6tFgRqTLp$8w&S<_?m
zUUt~#XAaDhf`otOsNma$hm$|i#Rm%&*MtR%$L9p}#UbPoNeJh}jW9`|+N(P&v}ou&
zO5L6_tz)Ly>>};Gp4cO9N0|mz42mbLH+z~6iWnupzyGoDHo!wTr(pi<-IQTZSO~-K
z>?fD~3%=Rf;43hnF-Wt=@Jrn4Gz(+Ngl;(afSFc5;8LCv;!EAGZ1vI^me5+ggpYvp
zP%XZMKRHUb_+ys+`7R7Po7y}v-|KfgO!6>VtDe@AC(<yQ^$u*Twu@Rx`PmAq4ae$m
z@QwDP=k@exS|s)8y@$vAkE%t|D7Y~1neLIbkVn6Bt53j@WRa+>`~3;jdSO1FC%1)b
zsVVZIZ9d%zU3V+k{7G5Y^mDuID!C$2Qm>QgcdFT3E2PI7gT6<=DYVgVGGi~U20IL2
zRm-$s<zS?dB~f&*o{>>3#|;u#sAitvA&J*5In;|RDV^V)ge`vvqBt$F;P$_iRN0g}
z=6n_2{n7&ne`EfWV&0L)p+Tk>w9C<Uxbrp7rZvmgvZfHmC>$dD^_vCsgGjXD024nW
ze4vy^zYdhE2b(~pzkNOY(S@A+W;m7a#Fa0Ru(&dr2JrK%EBk>Xn;OHZ>we~9l?S(%
zAnMC?H|}_>gBCI&Hj4>KB_-l0`DBW4|ATl_nY#}VlQEsGATK6XPQ&tzHlQe}<-G-F
zO_Jk_-@yIBY34jurqskr@3R@g4-FpX>g?>amP4x&Q9e1pk&zTEd@iQ40MU^=fwx(&
zq!$z&_F5L!Pq-#`_;fi+F8$6~zaq<G@;^pN%-DwbKSJrVt(R}x?)f5hmzvmEXD<2L
zX15Q38=~p3CqqZtKm=U1aHsppR;eo@r!-19EzC2k`_z*OmArgljfsTREJg4gN1j!F
z<QY365wYWPJVN$SPda(ku+%VNu<?$D?{F2WkXlw2@%5@a|NrwIm%;vr_ZacQFtwZD
zM@#U5RC~|e#5OwEqO9@7k|-tF=k5}Sk<n&9EwkD|BT2-5ymV{En~kLd_tu?CS993@
zVl?V{7O|(E_w5)ok|RQkUon{;sAH5=JXYLBj*QkD5RpU|(O4x`*9M=i)zBs6;D=1t
z88Jmk6ObA1bBSA5H)uCtN$7mI-4{Up8f)6~gxxH0vi;?5tt-W|$IvUjxM2)%0q^Rz
z)ye}6v3xIqO*2X@+ZH8#!5zvPr3$xp`pz>mF@#Y#D>}kjeu@@`YI`~lK3Dza_1i-I
z&J6WURyfa;J>fDT(R(@?eAwo=D^W9*>;c1+mo8qPPcUi76kWShVw(qJsR)<m{{xgj
zYrn7@*Md*6Ao(Y#sQ}6yWNVjS@%XsDK7R(DYZ1eagjq+kgrp%mL{jY~1{x-S6Cn9L
zEyXSx7iFA=RWIfu!{PR-V%AYP$|{98qN?#i!Zt;?9)e+b+g_>*t9oj2v_fspGVX8B
zuXzFigVeOku-l+t^W=FFho3qPf@?6z2yHc|hJcjjR-x&6A!-=c?vFoQzGo>(OMem5
zo_9iRSu_tjEqf6s>~*!3B-8}`8Ej*{JnP2x1Sj5~_oI4L$b39&tvLmZx8GQTubg_R
zorJJIW!Ta;T*0hQ(R;p56)pg;dQLtuEFNv>L;=MpiwIYsBCU;m)oOe-sB;~qUKDzL
zpn7cwMJaVZ)&3bn{oB-(UH2dM*nhP<*xFzXC8*U?v!|z`(w$G`GTy=3<Y(T=8GmV2
zcZ=E|t8eCb&AaXooHo~(ntIbCets0~=+L4Qc26fnb-V5a98A|<UvP%?9uH1W`$bK+
z)Bc?w5X~ehJym<?4)*Y_PKa(WW@wiZj=4%H`&EZh=B@tXiPyIi(F+7vcz>MSy4PPp
zjJ*@1-mT1&n?<Ac$<Q~N1(Ri&RRJTnBG$?mK{J87Kom^fwFzT3wjByy)PZHIhbDII
zfH|JYoG1#ehbVMjm-0z@o1lW}2byo_5spF@Vaty!>`~jm8V#u)nWkphx9bsp1Qniq
z|I?hoRL*Mh`xQZi?-mO3(SKkYy0iE!u#&&Q>v5jt3>6s|a+UJMPAJSB;g<&wOT^#w
z;-$^1MnyUM`;w()a>>&ya&}G<{_iP@%e?}HVBi&!gfnXy;<!(lp}#NV@KbV$V#)yZ
z6}fXp!jfa!+}=-CcKF@VqSd3{Hg@T|;QRmY|M;K(*Z=!}|MzDVhJW!k&j2fUDq!vE
z0i2MO79m-%?~a1+p`H)>XJxr4o*o@lHin1IZ4zelBax9*7npez>7K)^K*NSdVUzd-
z`<l*h=vc1f1rF6{cm#MnfFl1znBo-2C7Bi97`FK%*L%k4Y_f~KJzJI;Jp3pMmIb{2
zVWyzFEnKCx!USe`fq%fPHc4252%k~mX+_K?xy-X9K{S@T7$wV`71tjtlLfYEx*qm?
zgJR3^ZA>iR#fD8aVq3bWGj@%Ec%NlSGYBUoBgymYH`1b>>4v(2bsAXM@<R`Mmg8VU
z_jTW+mKONIH5&Qm<mE5#n^yk%%X3|~^`oE9vZB1mV{Wl3*MCAYL5;ob&wL(9$VIpt
zOhKR%m)Xq4R$!Ufa%~TLo@V37)h(i%y6)&?Cu{MiG|Vp-uofjO)a?~02Elrv0G|y<
zQJj)Ai~+l1VVUJO=%Qom)Ny=*E!WV&EF-`{;5*pXeCAt$9YoZhw2sKy=K4E=&T<y<
z4p-IAvQCB3MSl{fpN{?u{5Ph@hH03-ZgNOR^o(c!7$hY9#DDD_L<_KGc_lxE>lg{R
zc@Wq}D(>8dtR-Zg6B;jzr*<_xRqwtB>v*u=m0Gy!vLMy5+OHbbwh%6~70Cj84k)n#
zL)X)pXJZn<gy_V<ei*qpFoVD+non)2T~8cZxfgF!5`VHH&+{B=V$U-OwnE*)Byb~4
zOgEsWW-!y}IP4rHp`EK&8qge6A181cNG&z`nUw5;T%xxu=dXq|yt1-o<6-wJ*P+js
z5LzH%=$xe#oCyeHs>&h3BG2d&6f$7no<$J{$>H`?e32E0=+D^&I|r*Q@FoD-{G6S!
zv;b6}rGFHc8HV>hSuFC5glGTx@BdLONDA%^xP%2F6R1b(5~tt;4W0v26sPB`C}W{F
zo}!!;i!3deu>a!5bCsur|NQs=kRcGjYr`^)qZp(<AQ40nl*|36MJ(l_7y+BCGCX4i
z*o?5xA!Ahd5@4W?BH<;l6^b~?810{%B1@K{`+r*tbe?k2ykaCzxtzLsGhAF;bk1m&
z;$>0a7)L>p&5jJsaE>(RNVkvb#F+OG4o^OjxXOV8mWF3@l7EWR8UDmBafKgXFdf5L
z%J3y4InE*sl!~Luv;WGCvc(<x=XiF83s?}agxby*fFLThE&5c`H0ioQDu@_G7`<RY
zzJDb7<$wPB|9G~@;{-uR(SDEiu(MdzK2EAp9k>iyo?(0|^fW8-vEexy200f8%=U2<
zm^!hd$S~+`RAw-=e5>xiOey>PGzM4+7+Oz-)z}pME4Xxl-z%Y|VVdZ|T5CXeDiAi^
zw-j!QA#%Kq=PV=zXM9hQ<$6jIQzUttXMb7rHjC3Lk!LE2ERpEXS)Q_zZw7E;!xMVC
zn$Q*rIp)FVOSVe4btRP}QoYQx^lg^Q8g;`}o9>D<Kae~p;gS-W$o6a{ktY(ph;#PS
zB{ylAB16|)kz&>7LTwY$teI*T!zbXhz+_BC%JwquEZ`%g|3$3bDkq=0s!D!CaDPV-
zS1zdrBD(|{1yU4ijxGgw@)|?~&#}12p5J$lC|=Py!zO18Lldw9`}L!KYwg`F?Hdl6
z^;Em<9Nfefzd<DD<TFS4G=Lh{Hre4#-UVE_EEq?kM9Ey@`~7zSdGqYzRXi7EaRPgm
zmp@#}=>bd%3^%VjMo`EbDP8K4BY(Qe1>GGPl-X89?SNw4Wd?+_4YB9D6nn%B0z=nz
zCyK5od7u3Bb4$>=O~G4_OyV*l0Eb%<w!DB~pAr)@*EV%(YnpF*cP4ntHj%(|ZFmfr
z5!`;7VPW5N9jrw<ajE5!P#3Nt6&}>eeJWy+d{y+QlagGb=gT~Y9$!^D?|-;O!$2q!
z7+$SRLi_bq|G)nDZgOyd{`24e1A&A)MI~oU;9|kT7zmjX{{zBIlEgEXhD<_`T}D&!
z6!oD335cV;LT4>eex|tuCvc5U45I|!lTYMuUUcD%=9LazZe+SjssNSlOm?*fSU8@9
zmkR;h%Dw^zo8;kHe}A?Up?}vjzn!_2ZKw}JthV<oJVVd3`5X@PONiZ8^-w;q&~iaZ
zDRF55Si;+Awu~v9Nc}x5S$Gy!g?9Q1i1#eZFZ&(_Q3g^zG!C1NEykfvR;7xvT%<7_
z8&a$psCMt#WAh4nRicOyc+GJ}+s5INLvzhVs`PB2$N1umlm$-N#ebSk{q2kZ+7CK{
zZQ2aIMoqUl$3mINh%pK$*ug>nRLZR~r&*n+%CdQb_2p_|Vb{77)wAt3FGQOeMrb=W
z4yge|-^c`=9Ko7v+9Yz^&^P(DJ_RKw^s?5ZSIYKvox76v&G#g@ipx#TKUT)CaU1kT
zYDac}H=2<VhKB26pMM1=wmgSoqDLO~BVwDbMNH~xTbsbtF8XSq1ywSC>n_4r{U_(u
z0-<%0XXi2HyI5p`>n4+r@Cp<^IB0O8g99GiYUBARXdi&R)X;jCmLyK$(n1FZ(l4Vt
z_zw=iP&GUQ!?N=@2b~Z2X}lC3^RgU#;}qE({yE`P(l|wNS%08|1K>X$96*wT0|L$#
z&*ngFJUEa9+uK|%JoZ|T++^-dK=$;=@S-Thfdc{Hd`H8?(L)Ro7F?p~2BXf7c)x#n
z`?6x|0!r3)vsuknvkr#+XL6=5cU*<VPm&oVIX-Zl!THHZc*c1R4H5VXq+F6z-f}ur
z)@|Il^t-!|Jb$Okk%m$mjKycpS54~Nm4lvFStt~iRS{6t=S~50lB|;Ocws90sY-G!
z1{BXc={9<$R?(H)s#j&+F7h}nYkpa$+YJFtR=Q%uT^(zUPlq0^Z8fen{cX!iCB?Ge
zInqi~xalT(FMZGs&|+`cloNi40;}xDY);~IwG|=-5`UkED68AHqFM%<=b;WW3!H~~
zZTGNCoAtIW6;CqoYDV5j#T%)3JEP)VgI>4`_TF8J8`Y)!X%T}nI0z=bE9aY9s5z9H
z*oN>RR$v6!cQl5hNYjnTriN*CUC585x}B?%<@7dh5Wd#opcG)q^Mn*!PzHpdN)3za
z%KSTFW`8GZ3A41wl30KjpIBx44T@B5jzz*xLIeAGk&rm;lMO*SZ^@6Os91EMzuoEq
z5oICp!)73YfGpWIpXXL#(+V~U#YnUUg8P3ztav0F%mH6UbvMr8fB~U2{sdziW@!}X
zb96!?CcL?e2L{^bb_!^oQ8oedG?v1!Qr-=4Lw_%HpwOa5-7OwO;8DD)Eh6(c0U<14
zNp^9#jYn5K()`e2Ay@%3Y!Tw)fO-sjI@R^iH&{Te?L8<o56I3sYq>`dO8{)?774io
zUHrh5)b0R!m&MhV0GNM*XG%s8x4^Fb1jqmZLb(Dp$|q)lqJ+$5auV7vOo-;tKe|=_
zg?}J(#t1+B6(xnQ1+H#Im@?18mhI};Cyoa6AR{sZs`-@OUDPDiL5w=K+qlQw{(VJe
zvtgI9a!+mfj_Ra-lh0nUbCw9hK=cR2D=0L$i08{hC?zZN!~PsHL<4xBk}~P8ous1c
zc}Z<j%Ry-D%&zDZOU_5HTi{xfhnZUAu76l~-xx~U_DbBm@2bA^Ius+bS=(RN8V?iw
zLm(Y^t$YM$Ufs7t({Fe|eBoZZ;H+EgwQFndTq|RHT~|PNDbQ9LW^H$tF1AKBLQEWL
zzKJbevoX<a4TpxN>pBSyA4o$tzAF(%&*(X*b!giJ;^5$ytW=`X2=nw=#?NMMY=6K=
z5hs^ir#DOE0%QmfYq+N3;%pm13C>(n)h-311`M9F@+<?PkxOsOf&so-!ew5NlmZIC
z((^daQX$op8RP{LK9lD3DHYa!{5I~%4l1iOOR^bAF-ewv;_dsCW)~@1@b?&O><Zi^
zt)3#t2FYgJw46Yd9PTB;X#(MHrGGiwJe$wCcX;kIA}#X_{0T)lDaw2qf+9*fi@1`c
z(sz$W(z2s7q{Sxjp}PQjBnjPMnrm1dCX`s<0L90?ABNa7EEYI+7)7rCI3x)!zpW@9
z)TMAFXQ_ZSCj>H?FrA@g%GU>8rt#mGa1Zg4b|jv(<&Ao$z7`vSZ<pG&^M3=CP4@8K
zj-?V=@mug;PphFgMv6cC?m*Qy@%$XK&kN;gB@&?Hc4>#T%%=`%I}5mv*n`ugI%MK3
z-J9<H`tFtbLyvp<9-pG!#?(&wTOTIV#~^3P+2QDR%a3aej$pXRh5q-(lS#Yl?d)7M
zgCB>bF_G_TGTuPuO_i*3+ke`X^xC~5ML7Msgujh0TelYeIy>wtUQydyah>zahbK1r
zyW=GWVc<lDk2ND;*rHU!f$JMMq`q%>c4+uFgjfpxv{7I@AbiQIMaYdOjViXKj4$Lh
zx-E=Git2ius-7^R*&I2ME!%%aMVcS8ixk}KfZ@lVN%#ru7N_W4t$%)pdug7Pm28H}
zJo~RCg>ZIUSwE>^mhQ?hg;spPx#dnA<vFGog|?104??&)E=0Db7WRxtGiju|0gnZ{
z^{l<m7M;MSs@Su3_I|9yPY|2(>LM4xEERL)I<6%T`3VZ~8nlA>+1aG50<wys&y^<(
zVe~v(T<&b%sKHEMGk*hY`2etKlwe|+E;gw{j6gSZW|%wMZT!$_?J+JHclKC?BW|<B
zTKlRdZ&nit!>8=oI2F$-c;hr+^0nt+*HhtyTEK!Z!oFvE*fPN=GB61?H5xdf?^}jv
z-Tw=v_gw;qnxYM;x1@a0b>QGClyKV}+%U*_`%i;@FtvWE@P9JJ*Y=TvAl*ljUUJ85
z;>4(3vNZ=s{Zn;*)IT)GNb^(AX;OcbhYI(&_TVtr_Cw(>>{39jJ>%9DKSfT;+Jfen
z=nZHQua`4J7%cXtJYzXGLEt7Pzi)Fq-GYe-2?O7=O$~d@Byb{`IIxTedl2v)yw*ek
zyVVn^=lrSS6Mwc(qTmvplUz8-YO5t-0aa%eDE~+$RB&6@`tI*PzMxl|++g3=>C{#A
zK*^g4c!MX|c#t&*S>w$6Sk)Qz4BNn2I(#-(Cu&p0;BkEQv$JcSxz{Tvb64a2oq^EV
zi>5t1WpC>ssbB~4G>xCJFBl`Zxsm3zj3H~tV3XmaseeIT_Y{43(JbgMp_8xzT2awC
zKdmI4+nVDdFJhL6`?CKmr~#B`Er<PJYnUo=W;&h$t0fMV#zHItx{FXC*2a7M_cKPy
zIa$0_#*>F+c_)I_z{;Jy7e>yfPnzbu$kOtp9vR86+Z3>9po{Ayl>30AcK=TH1Ir10
z7yEh$sDG4WVG<Gto4VnU(DFl#TgyJs$C)_oIX$iWB&%M>8((27UPO6u6GfsJX(%gN
zn`WfoZMI0_QXM?;DB}-1p~Sdcuq@gax|GQl!(XSV)f0bVmla2`L0dLOh+9bxg0gPc
z(#4=)0eKX0Lil<Zg@H}N!0lg?){d^pp{sCxP=C8-h4YqP$}hjcNG#LxqmZz!{M5aV
zi)44^WPwktz_cP9*;WKM2*W{OXxP(zaBmpdw$*q#yThJVW~%0`nx%S%XPd+~G1I|M
z1G5PBw8+A)X?nIsbZU0*&ym%B`>b{j&R5oSs4}OUsuZh=Rw6vGN<*lZE%pz3*)n>)
zKY!}GbXRtX64{eN@qyMROLd7cJgo>E)8RI$*0~);&Q)pkO#sSmx$!TuylU0Uw_J0<
zPf%_;c$qB`&3M=znl%nxK{n*n`67mFVV0(H0K_TIY5h5xu?$1tU5fH$!isMZIH`#M
z#~)%9p%5-GDOv(aD`yq)zRR5#L39*?R)4+5nw2G%l1kAE1L9bkNij159a|CeFo|pf
z+b*+1gAk9|JJ9^DERsqi^{?{94?X2hRMGxQ=)j4pw{0`mIuZ8zYI=(Px+FPCO9=6k
z<>&>8!D?YYXCPKFD&+bs=l`26OY{qOQ?j1>wz7SD$Zx(KFgLP1Y-udOmTp_v*MF&p
z4J~pt(~OKLvL6rmZKcO|&s`fpTlXZ?`t@+zI<XyBsLvIEI#rgw_$`k1SM0c92%B_!
zld0Sy>vM=SdtVK)e{iHF%d7wURO?QHOy2y)lhh+FKZ}1)zjEt<-4Vq4XQ#(Rpr0hx
z%+@-BSWiYVkAr-)hes*f%D?oMZ+|Z%)O}`q*w76VTfPQ1wWf|kEig<kv^|44H<v8>
zq~<FN7q7PzE-H2BW~sAZn%iiS*ZT%o6)hq&gz(V}Tajsim4}ag+pw@lbluf`W?9A~
z5-sXc-I8CwjW4T_TK^?c>qlPv$cz6f#hyO#z;W(PI`DQT97LKH>LJrGvwv*{F}^kI
z1(Aj=5;=|$hAi^@hpXDV#T#o_7dRSrJ>uKvDg>fFA&@KlI+jLC$^k~umq_Nk5hJMc
z_PZ@jpl;UZ-5oP#dNq00y<Hf_?rdFr&GR(kV;v$DSr%b9uqeYu<k&&zYFc2^o4+On
zKK}CUxrKgaSqJNEJt%pQ6@M87Am#oYI~t5ygK%ykA_Q)5*i#f)81raw{L<;XF>AAl
zMr$!eB+1g5NDj5CC4xp_mXpO<43RUloW@|tUZ8z|Hp?YtQv{j$Uj=JKs4_00wR}y+
zS$c^6%#uazt>zM)fd~COE<T~0&G^tjPPtKqAI!>*M^bp_aTVQW<9`!Z9oIgSai6+g
z04C#+?O`im43i*YppS?GodraH2v6G~!Jt_YeCq3IlI{*+>Lwd6`t>Fe3MWM=^ee=^
zl}or8h)(-{X4%U$%Fr=vl#j6HKLY6dF<yL>Q`0wyGV?3BhtykL7I;|gugMg>sy0|}
zx_b9@@A;<QX<d_27=LIJ1#M%?$4)8lj@5$=O9k?u1!WQKi_SiI%u>LdECytN!MGsm
zcq(B(48i`mMmByqFWR*ySqSsabG{-aOefDOe;4us|0-9A_$ueW$|nE8^U3ufJ~jW6
zt3s*0-PHIWE7aGM<y_X*#>*>Lt9<|P1Z)POk64)l3ASCZ_<uH3Gz{GHRbp+LQO196
zXuC?092p-fvF79g4})`~dL$hC9s%>6NjP2@SPly{OhO1}s8byWkw>r=c(!L#Jz`P#
z_-;P9T$F$Ih#%wSxNBtgMz<b+MCO-$mzkWr$=bVE=I`}=oL|DLwe9Jezg*>M(0L^H
zByC>It^a=Eh=1UX-n<>h;*Y^lWQYMfUblC4-AenGAzPQ6o4Gu=%XrroD1k#X)3ymV
z0uLgc5gU7qhS>HZD{>=G_cU@J{9(DLaV_Kn?u;v<PDOp=f`6ROICJz?nZ}0W8)0BG
z>=|~5Ej!e4Kuv-*-wAA+dDL~f5ne|B*>}J+e&02|mVd#=vV|1YzBtd><;EUwO9Otk
zSb)cxGlov!Ayh(?=Yo|=SZRTk051(}yRxFhJvG;)V6msbJ7W<SAhW}8#35HCNx7Md
zSQk~1?|FPY^ejoTizDHE`&C?&8;QR#>%x7H5c9;PUma<o9hfe$u&Xl*Tf~TPpald6
zCZ(Qhnt!J0>o){aSLdMDO%OMD(iCq&askv}DPKi73t4>5J;}77(#m6v%I_8qJH^<~
z3B*!Hq~vfW%Mk}OIgojlEfWeK7kQlJaT!;<^cvO-F9Qe<E+?8m>73_Xh3P&-@8#dB
z(n7&@f%rh3aE9D3yI6#v&H)FIy#JSi%>8+hL4WmSCfwTRj6aP+h5`sWx8SgU1-mZt
zY`y?LN=;NYl3t=>SuEs2svY`>;NWm-px|;r3chJYcWSkys84ueU@>s;gY5I5Yo3)@
zYh8EZ^{QJ%b;H1OiDo#MP|bw<A;g~N0<>#6n&oTMCwGDBc9zi9-R;OlYY#12G!SBE
zlYc*pjXos4LVTBVHdnnuOyz_%U#j<G9PMwgiRG28bsi!6{R5#N-{%Cbn2&E+9<sC~
zGxkwV2!9*XYzZOIxkdQ?YMYLlB%O{-(1EULQ)Em!sQqdoe>m1wtwUFmt!j|BbSBaB
z5ML==_@{u)Q_<|X>1n%5kmv^janJaWp?`09qV<C~zS+OHH+#RA3T5rAbVR$YYFn#u
zrCMvN@#~L<uI<7M`1&2YgB4-l?ut;Lh)2+a?I;%aN!eHBullGjcIO(_jUpB~297*n
z>gk?`Jreks`WmrA$8kbayQ-5>T|@2Yer-`qc}ncdlVh^(1<`puHH3^!+=><E1Akoq
zc?!<{CE20tz_iQXXr6Gg$5Kvj-W3%?B1_{k<A$IhkM$5Ht|M>D_g$a$p=tV>r@7d$
z0|R&z1pAKVVc%n(p;O|q(0Ry?Eo(`;rC54v$XQ0K0VEI6Gx5TP)hza4V@AwhcYSXF
zn2dl>c-isGVo?h!ji0*K`Wi*~8-I)P4TG}wo_=j<zPk**EJ40?N^+sP+uu=+A9ZhA
zi=Cq!fA@0y^z_NHVBFb`C^;fY!G@nLcjVLWmY2);Oc|dk!_SmXXz!gpRS2<c*R-%f
zBLiE+W;ihI0PBWtGfe}2RdkQq+V|O_imm`SIewolRQ=3t>1Hja`I<%o%zs=^_=J&;
zeG~LQ%yWW}7@F&C9}*7LAai4-()L6o{);hI^o1n}K&Uy7DJxXhK4sR9Lx2trn#aMx
z!FJj|A#*9d?fFxT#3?-W(7{37V(}6?IN+}l&^wj|Iyevwklj5vn4*IN2v`7r%W`yZ
zphPV=IFPEh+gv<6^26$@&wsFXXM4vygF23lBjSSzd1zoiAU<}P!AKDJM6-e&Jq`cz
z_N9CV@W3u@P4A+b80A68-)W#kV~KdIFIXOfu@iqmir9AICmD!PI9xyxWBlzWv{?`i
zs92Ev6PQwNZwkIRL&r$v<!`N?sZ;hnS@;5kzbI94RU4SCoz+=a+<&Z8`Jo=JoM|;x
zbpN>ViNcGTlTQrGF{x5i<UGnEvP|HCrM0}CG~QCwC|Zzt(rxidrJ^6VRqrybjc@iB
zd7Mfb;YzPph=>#JPK`hC72Q|`r}KCWZ*m?!Y+5&04(Viir3$I2v0n$a(hQ*=eJ|C_
zYD0`2HDm=AS!qM(@_$v@U|zWm)%0(k0J*xkrW@5Ox~kb~YHrrqiqRyb1^e$lYH3}c
zEa{6kgM<*J(uSjZBXDDo=jwUgV+Yx*M$qA!08-N0-2JZ;&gklSo-`U1^`TNZ+qrGW
z>EMzFu4|HCuI*E^Xw*I#`ZfCWd!Inotj5~y_kAf6x)KJzhkwzhMGT7mc(FT^P0E5u
z3wT&13tOHYV2`*F5RVA8eZ$o~AWx2@KsX8E1j1ye?nl4ntiT?Dov-yNdiClxl6wO2
zqp^sK=}K5%K}%ADTClq%4T`J#7Ab=R@sgqELs6y+K6=uZXQlZe^%!!pS1TmW;U>1>
zJ9Zwk3oiRY$$wQ$9FTyU_Y0eY(@^366P=KVp;vMGNhmSmIWP-l980(xWm83K8jVyB
zn~n1(LHm-;W6n5Cz<`<a)(-n$BVtZYL=8Infin<WgfC_@%kv`~dJyL>2tDjG$Hal=
z(I~K4Wa?K6O(-htEMXW=b(tL;Ts<PTSV606>}u<YQ-2SE&qomV+)@cdg2l*?xZ}7V
z({98)C`eQ<<8BXHP>WPTPWtnT!p|~%7FpE5j!t|CDyU)K(jsgax<P5k3?pQBtngbI
z)onb2$>$o>0@5Vxlsb5wsFQsTlO-St($_1zIV5AYO=uI!J)upME4F6Fq2jVA+5C_P
zk~|mq0e_sAM@RfUS7wOR{9j%njLfZg75jq8d|SMUR}1E!6be8)Y{FOIYP4?vq+ig^
zr@pAtUzLYYIB|F5A+$5HjippA+26a*PICZRSMG(~89r%LcQqDb)6_$35vpM?WDYiL
z&(*9jv`x#t@%@ePinO_UrT>zZh$KmMI||Y~DSyCsWX{5Dmd5`8acGJz&f@S4#Ra-J
z+eQLha(66M^^FIwxo`qCMR5w(3>?AdabAK%QIM3vwZhW#IL}g!3By?-<A*a5=@w4t
z2wvxvJwi8o%fEY)WuJJ{KBd`3iWdCk$^GIl!!wX<N!87QOMQ?HlFh(JJ|a*h2dW9L
zQ-4M<g+{~G2~CkUD8TsdxTt~lT~%CKz0!GPBM>XwvhpS|<{3SgQ{F4f*p}-s4Qq}=
zuw{S~m?-eEO-T?sx<Sm)dknG+oX4Gv10LeKp%Ky<TBdwS;3YR15zm0_1(121!ojVA
zb!}vO@b*&+A)mJ{q<t-pqEN3W)a%2qSAQPrkqZWR{9Q?Iihg{5yp20N23HFlTLGDU
zT&4>We%k->eUEkjZ_uz8aJ<NqP70$RY8UZhk#lE7opi!!k@)_Hz64;)w1jwjSqi@A
zd0oH0d$mnf?PRMpwZFG2y0I(?8RQ<5$>Ap8zlu#${knVkaNTrBIdL!v_cp&~jDOYq
zJt;<y^t<v%-x=I1x|Q$D?8Eafzg|{VF8|$%txn(=rsWbG=#GIcpE=m`^$=^W<GUm>
z3`+eQh^+;}95wACeydXJmh$H-lFpVO%RPIk06}n${ZNG#;)gwgH&UL>0l(Y-;iu=I
zRF!S2q)Z4@3Vh}q%v!S<+zs(LODQf<!br|hKJf-V%a$OBa>*@cB*7P1o+v0I2%z%?
z2-;kDB*`TgY(NB;BY*=}e@(UR%CJt7N=YWxi$w`(<)#I27G_|xp+z|_N@3@1q{ANw
zq%-2yE8Qz-=0{R5N|LwJab6Z$jy?ME)%kHJbhdzgvk43n3P}U!LI7!MVK_Ds9YP|z
zCN~zbE*DcWQ){MTV<*;)aBYM5tlURBSEmr|#2nNXv2t+PS|9`Qe^cvkqVpDv^p~T{
zx}I0xoSi`rLFNYM)y-+E1=C`BmgL37S@RQ9J0dO0LhJ`G@Vh0DE`rjcM6wX_0>47J
znju6o@l4D;;<HOKquJ~NiLoOU>U)N<V`CgN>5P_8b&N~srh8y0qEpwyft@&r+pdpr
z8c>wD%tu}tM%1P;e@XlC1-JUrMw4mZ{(GA*N(i?`$s)^Z>y=p4X4Cy3zo4U6uYNd&
zRTrxb+f6~2tY<ILyto!lY~^?mx>cT&1h%=bDykssQ|qTiX;nqO5I@g~YspYtS$YMb
zVq?<^6TS{ZQNi;Nk*&@d)_!wUs|tgJE<dMg&N;LG=fD52e|5z<08Nd^6s5*MZmS}N
z3}!0QTU2|Iy%$zS9UR^mZGg1$r|0nHktryJGk$I5V0Dy09%0Xs5H7+%*#d}9`<33u
zN0MF4vYMlkGoA`RMtAq$AW+;;o=+=O7YJrF=ZK&gzec<ys7MjS@|<DMcCqW+{v$Ec
zx{rJ)4hvmKf7gM08<H@3k&j}}b5QJuBnb)kZD-F+=OUH{^jR{U3IK<8dvs%><baZ!
z(Hm||fdv+~O<W_7-=M#oi}kBB&OZ@jle*METUEeHsj`l3lW~i_vfuYD)iMxNQo4QN
zXdOr>uY}yuboRH(QV-Waby?)B>Sn4>i;^3e>f2&}e=NnB1loukvr-uT&@K1ZMv9k5
zOvwfF%}nafZFICavpN<1{^>1i5|HegT)gEU;LQ8`zqIPai(*#4X>dOhI@1<DFDjwJ
zNTYR8*Tr-RvZjBGcQq1I*fD7I_m!A8AfD||AGry&5%vOt;>e{a3Y>&<9?}@Jt%tR5
zE(^_6e<F#_XfKbb#%a5O;T@*BxmL2u&@nn#@Tw;uL2ILJH+FUtanZ_(LL;g#`Apha
zGczSCpvYhrtIxpce7K`V?<hm~YS!F>Qt!y@<_M;>(WGJb<au_%XH>+GPT)WA(Gyx*
za7`w8Rtcnk^Yo8dT3eKq5~?e~*zb$Xc>kQ-f0RX@xBq_m(z+m^2*Zh>e|<};D-p7~
zk~(#4EMM`ZInP$x+U}g<e*KkTiuUIj-<h3?`8Z5M&qk>eVuaH$LQxz?$aYf~W8d>^
z%(o>~(6L2|gi8tXZ#ytFOPbG*hYEDVtI#l84apB0dNgqjNCaMEH<FhLSiOtIT$UL<
ze~_&setK~_vBanKoRn;0sc&jxsgLP+z{{ZM^txPbf@#4pTM>HI+yw^?xO?S*GrpK&
zF8AMvS2rOsi+O@r6fuOk&rm}A2$2xmz8?o+n1*|mdd85XN(M5e9V5Y4@9TjRR?9;J
zlEaoSVtn7jnAVX;e0Az($M?A;!FNB_e`@Kq{~6u-LteXO0>F}GSW+dR#q?^J{A^2>
zazmj*RXv`rY}7<6S>i^A1AKA@Q_*UQI)j?d2r2(ssoqT<s>ud4a`zC0AKg=?vz4CA
zRT7-Kk9HT;;`nh)5*M)~h!J*TA0?Q_$c@}6bYo6EKe>+}^S*~w$Xyn){JmN(e_Ws9
zFbxRud~o}CK1Z=lQ{?$!YP)ITrj2FjK=i$bn4UJIXOIV7Mh{z>{9Ob@4o&uOd8!D|
zUcx$kqCISI59^Pknk)g&4KQ<}Y_)Q1!`Pv11BbMuWNkptUwJ89d9yl`URv$!HsW>!
zgE$POVUMnOI|Fl4Usk_s3B(g%e*l-xy0I||_r6ZpcT+4ZR#>y5RvtZ=gNYKt$b4QF
z^Ac$6Hi_?XN8)>eC=Bet<0v2)5+iVeA~$9T<0yz-H;g>CRXWD8Ej`!@L#@?F$SB09
z$~v0!vI~klUWQxkF~J#P|8Nt2WBp}8N?6PppIHBUF$488hgB#_>jlYjf6lC<l7mR3
zsR4^p{6Dx|fBf!s<6az}Y9si6L~}}f8~cPL$VqU5F!OvwQtTiSc#hA!fJXuTT=1~X
zL8W;Pc4&K5JnM&$pU01L-Avb8LM7M>)@Z1~jgPd!iw<ZtR4Z*!p`yu;T7J`O-!;B}
z^|D|zSo@wRb=G-No*ir7f0V`4JKvSXe7?a;s$9dB_%#GiE!iIm*E;r8Kw>)^M-?_s
ze7nCtRFU>KQAF<o^;G;*JZM%~J(2$wkJ`ml&(seGsO_$xw#Jv<1<GEOoX=LEY~?pM
z^3Hg9{kd)Yf_aQ=2LP4?Dg)T>w<Soqj~MuCiaEPQ{_@C+BOFo0f1EHt*!3NhBnd_i
zb-Cl%9%t??1X4r35u!^IzSbyI_a>9BS53y%q&0C^-|-p-GX`A4agsWTha#I&gn8s5
z0ycZbIJeUvv1uPm{dk2=J&FA=#PMLPjbLq$A2D!<5_>o&$$o`rU4Hr=@egwa)l=60
zRgqt(ifEz`&Zr_if07Aad-T;thIv)($Z&c@-s*T%1Y8djSfy4?(7IWsD4B`;Xi6Am
zSyg8<S~pYHeNhOS%p|01JFi)@wvtr`uPv{5V$7-%29^6}80N2gPbxb3x?=v<3Wj3<
z5dYB%MDqIGb@YDX1fCls?vMas$BR%DIvj-o^FtEYNgO_SfBbZFlqfg}%id=U0@0TS
zOyB4mdb<nydvM8*!`GFBCSZZO{Tv2DjH6Y^82zJEouo%o@U>}~qso$8{4Jv8VV_Di
zpyP>E6&7juX*Kmva$`*wd7aH6%%lx)Qc`0vqZ~r<+eaOlL!Q+%CyR>jR@V6H@rIxI
z1>C<XWXW;ofBl$BBfRa+m1LBWes}{O{pDg0@04-9M<estGq<gCy+4`^Sesp?yTobw
zZfGaO#>kK36yX@#D6;(o1yPuWIP?=5+IMwxNpI}S^Y_^LBQF}a$V$V4Q1_a|NHW<~
z#~G+xgre3qp>98W)rt&RqNfv!<i+el7KS#>`m76He_WJgewk5=7DdT2;J~S@Be+fK
z1>+M7UKW2It5C_stS;fQm!E)$UhW}10pN)Qyi>a}Mao|J`F4}^>dachR9fSv4w&7c
znS(KAQ^!q_lOztpEM&kngHh^62~8;rDSouE7@gc$FVEX7wC$cc{tOHi4-wj6eKvqd
zLmDuae|2RbL0hgj%0Ker<t#0%r||K<gYWPiDBbU}`8&0D#@bLXzf#||qyrLy%aN+^
zRDbiw6YG`!=ts*nCqiEqY1^GNEg6+fROG{#uH8<FBw(JBdH3$h3kowR3cVsVOpGX~
zXI?*0|9~fY?&PEPUup)8`a4-U;aNW*@y%kYe_HFhTQr@#*lVHyzu+_W1Fy@B_A8dp
zmQ|hA93-87xZ|u~T>ShZ<2mbBDcm2+YHT7U0dOT#6)g<{c{sTRuB9K;s_#N(iF{5%
z*Y!}y!VqCE^-*H87;&5NkVbJ7`qAfhp}{$5{BuN*7`yY9-z%%4o>!l@Up!8K7dM4a
ze-X=@u?s*g-Rk>Gz2Cng)X$)kn)y70R;tc~p6WX&*pHk060eXu>8_nbDW8M(D!}1~
z3v;&@<|QY!mPFLw=l$g9kMug#XV2T_E7(cSEI)8uJ5G?}gGC*?z)0%YDDb!!`gRn#
zcKnd2f7jRJA7WRLxOlbg8=2_gy~YYSe|G9|k0&VcJR9NI_fhP-9N7*}(;&vS&--L-
z?kY*-$D-y*QCtb9P9u+q8E6h#&a(FS1Bp_fb8F2rzZdUWZAK0Sxwq}#YT!N+Tu<|g
zf205CLi!UzuO#sXlq||`{?)cUF9>8J4uzm^vGg^2h**KQ{kTObT|qdb+!^;9e*iGw
zcXp3@?ReKh`M;k*u%G0dD5@GY7ARR=*3y2BCD%{{%smW0B<sj3L1)oK2Xyn;ZvxHt
zMxgmA4miUkLflP!gehf+a4$kUrGDrnDGg)iPBzQoj1GdxoBZu|8&9s6v#~~s9Z_=1
zv-iRS*Re%vA6XM`aR}^wxWMiee?i@Gz~aQm9<oClsJa<ONx~WOQlF+_Oi6ezX-9gy
zXFIL4*{%Mv-D)jK@b`HcSHBt^wihli47Q$#VYa_(1u{#IRvKhQLo4I4)tJ8}?A_av
zz?JmwoR<_huP*pI71|&aV^%DZoF55!;i%uAv$jBQ2*=im<=FPba*umPe~Eq_zj<ow
z0%~__I(j3=_`oB)VPN(^0q<2T<GkV1RAZJA;oY%7p>GMKauqXW{Z<rOJ$DDs^B1PQ
zkEM_A?3}?s?D2s-WQRMuc+g?I(acM`f0J2qN<KgaO89f-$nXXuyZylKVK4dnT^hsq
zaoZ8>#!B^>;3(b}^XAmAe|Bs}aec?O9mhvu#5{x@j8TFyM}gxd7^k+2BfKr|m1A4o
zl*Xp?XQ(YA9Ba{}6&}}Cx+<7~u2>C}7{C}n3@B%i^hY5V`dnIlC`L=ytT|N$y;YO8
zv4uMnv#c%zeIdwXBj|^%WqUb&W70hjQ<{V+hYXGcVaN9ni4z+|e~dH7^Am?YeBkj0
zQhmp*bndF<wT8*ECxWTF&HU5~<FuHiu(}kuw)3pEj{cNgT%P?1=Rq#vEl`*!%c{=X
zIZP~NRh)~QqpBCD)-&<JfU2QB_?E6f;9bTP9HA@_237`f=gb>9simRn?B#=|vPx5t
z0`$h=$V$i;JL7pVe@jhAmjVBL-s~BnHYxOH-&rPp)JW4!;G=7`oE8<T(zjd2|8A@K
zEUW4rd<UD>(x&K<(<WyaYFOQd{LJpwimYR0J93`iaF~@Tx#I6CUcb{hhtwiWRzr3S
z{7rkVJWA!z+FU!FzDLr)@J1_o?M#8|-M~Rlt*6$TA;7s4e+Axdc0I{Q(_?FZ2>RQT
z&b=;l!~V=}s){POKJ2vPwv5=j#$$Dw8wKPqdsAjR@M=9T;yr0Dc}L2U+#EGqPf*K=
z{~jOo;K!f`<NfL`=C&PGgZJ60`Wo)9-St}km!`XKqWa!xV8&Vg8Gi-`Bg9u|gwR^)
zZY>a@6DBF;e-TQ2h7pc!8^tk85Kf3qecSV6hdn5eBS1ZVnzzMVds~IG71hODd+PTI
z-|&5pq?EXb65=52Ck{$DwGpEPyFub79B-cC%X%{>Q-gTnWru7~{ud!+019f7=)_x<
z$=_EO-8>Q2$w_MrI62u2ARuL8BZ-7gZ38wP>*PfAe^we?PELf~0bmJrWu2UKvdf*E
zOsta=Nc#+b6{U4@BGyXq30Eg4%7?$tjU?<ZL*tGZ!CR78FTo$Yv(JYFu}5s5AQFZy
z!h~WJM*(<$3A34#gm&!i$RPCR^Os6zxEU~`SQQM<Failf354MCTw3PlyvzzVkv1cl
z(pvtce^QT2LLDpRTo_-Zqa4y|R&!EbLG144EE*LM9dr{TZ)i|xN{;E2u!QjcMoa$(
z7=xZdgDqJ^kNZo%4dg<-x2w4vyOGXW)C5`>QWK&}Xf!V4DOu#85ZfJEgO+~5<Vt{-
zk9++cv?&I$uT~echQIn~US>L-&tS|0+%Zsbe>E|@diu2rA=Iv)O2H5@X?m;XQ=1bu
zY>&wX#~t2-UP#=<TZK3>JL2xBBLgGoa3(tDb+ZrN)_qWmzrpm2<ei0}T{D}+ZIjLJ
z8n9zPQJ}&Y1CSeZ8wTsb7aYo*<*Fw5tCveGt8+OjeL9cCGLI_J4qOU=R9yM?xaJ{X
zf1V?%N2@=XN=PDZy1j=v!^(5Gs7ZOVa!l=}F~{UOw;0nu$3(DpH|lg}4<@7cWeaiZ
zUd=PGPG!4`SfYe6A97+kEQvs<h)_b~7-5$(-*rRI{XSyx02JOeP`D?cf1jrC*Lw+O
z6)87h-`_7dSoCR+*x=zHK~C(5d6LZKf7E&bUNy7$#Jc7!uD5|^mV926Do2t?wM*C(
zJjqablWxwM62`4LV2L$ce=P|4WoqU8BCE40ka<h)a;T^T6fUWRL_D!d{yyW^5?%<C
zCsT>%S5}(^@^@C2O8GgfAUU{zBiEN@u>f0m4O@i^1mkoG0$Eh70Lab=0NJr)e=qft
z08vgtgi{}**mh%-#)L2in9w-A@6UM`ZfQz#3Xn+6ztGt{g_=`iw`%rp&Mu@^+R!Kz
z!<i`=brp!E{JMs8tq9RJs-#Q2t13A=vl3GAzlh<zd-3DDXRuk{y;&sFtP(r*-JA0t
z+6I>vF}om(KhKK=dp4hsAx~Rze?H;$HMqky<C}GQsz=rHUp*6(3hS-aDAAF&AL6fC
z$;ds2TU$z2(0Xf4ckOF(EqePMsmby2Y4@eR*LHwo-K^4|5)edRvfk)=9RzFw48vZX
zGf+NQx|sj@?EKxE1*N>I(nbDGs*~nYjuaR!q}WmCMOAA}b8JP`>Xg~Ve+4h~0==1Y
znvq;SYy7gqg%s`n=d<%(k=MKuDxfMP``IRd+G-CinL2R%o}IlVSKK0bZozS_J2Pn+
zORUS{+M1HtO?%2;!)I9mDo3!BG;^5WSTyGZ%t(v*=?3fb^Q>C8LW3fYZ;gJl$2Gd`
z`lK=`LtV%fu@-ZSEdUW@fAO*`MBWBrPCb(s^x3oXm)3heV?_zfHbS1&K>dcdEi0>f
z<*L3pfA)h|v=`^bLK?r`*V^e^X!0C+&9#`(<R*K~=Vbw_rTO8vU$8F!WyPl%wAKe!
z4B`*Wha24p`kFgl@xEa`>m(`HHng!<wN;>hly?vwBaIfb!7FR`f3VuAu!~_wy*RI|
z>&uK@TG!D1qRcL`ncyCT4$HlL4LOUix%Kw#6M-$8%CeBsr7DE*NoH2HNI-0^r35Vq
zRN*UuIZumgi-OiFs{=Yr4ynNvFb-U;pl$+;Z1tX=lj%FaOr?2oZSHFG_a*y!Y%gz<
z;7_ioaR%M;Y<UEce<=M8@kicnhpC=L6IlA@{D+B5T;1I}KmPFYyUIF(eW1B)dy;@K
zy{T0&h17TEF$0MLlS(0sj*jZ0<Rm|87ICSlcYOSBV`WEgs^jD1vtiAhjkBV<o@laN
z!~eF$fY7ju?TLMSe0<{AHgatHcml90!(8Zmf#$-h2IHErf9#MRv92%-^|=Fn6x=$R
zS)gZL)FWuMPicoM6e$s$M>1l18P$MDpYU1%EZS=RSPEqmG(0&cDha|Ly5;`bn6hG-
z7q8^=l2-u2Y6f5?Xz0}S`={GiCKESoS)0AAHp#Q_OW*d{o#d@>BG3bJ@s@vpSG13#
zqsSg<we@?gf40gkFBbnrF{|G+^;U~HFJFOcLJmz<d|p(-9w`l-MO_!uB__;e`L{=U
z^`_mGcegj%UJ&^Xbr6nXj&RBdusX&l@@?t_jvq#eaL?b_d~ne851Rf#(?4kX2TlK=
z=^r%xgQkDb^beZ;?lpZO9K&-8ety9wB_!y^HuFO^e_K>wbCNh3p?N%2I`4A5+(OnG
zy;vJL1m?;*TG<()dRs4ktgMcsrq`QIwDql;1w-3w4$?Ze{*&lzm`hu|{rF_%R%^4!
zZ`O@()W)$@qdyk)27_8*o!O?bu0jT;q&AoDZ_N(e(yV0to3%~Xtut$_X=z23gNfg+
z`6Z>7e+_Nzr=$Y+EYyVW-DPb`jvjDntbemM+2~*P0$Roj8Uc-Z`D8GoxtMB+z8-Sg
zAsVp*g-c0Z$&s#uD0ZgtmO#aJ?l%D{novFk(c2E5sDOxXvWr=kW|Yk828-yez$v=_
zlt9H>@cNDq@a{2nYkK?3T@8P`jsA%k_5)5_f0WvoK(Y@9#Xb#Cnh?Sw>M}QVo9Lf)
zG#bO+nkcBqjT|?LBE-WqL^$C#ikah~h=(L(5w$7i+fbeK@Oc7_H_Q<u;7anV1DR3s
zn~-I&Hb5;&Al(3Iw;ifZurpeu<V0pX(|#{W^T;i^$Dp~!MXw1Sp&}#PW_i9^8POuT
ze?25BNqj%VB#IFB>;y<JAwnhKC?<AdhdgG)<@Zcf(x1{za@B4ga{|dMA%4E*WhRmW
zb)aAO&GffEh~*J^Vn;Hk-6><~@@)5A<eq?&EG^pw=nb=*ZkBDdFLD?Ift4`mkTyv&
z`c>r>h0|*{3Fo^r-8x4b=)YnWTb-qSfBbgbZK6;+PC^Fk+)faA2>TQxLT!#B2RnXb
zGsjE(`-q0cOQK-|1cR0Y=90@?+*^B%dv$#`^imw6$h9HvHSkdsIX-fj?Z=!)BuV;l
zuZL)a{YE2*JbB;siS0!o*C4CwM6<#5GU7Ezczu36Xe7gsrGGM(qZVQ#7nPEdf7;h4
zn%isL7>5xP+lEVkd2&vsYr_*>ldO`^GSLAzhhgBgCFBU}=-cP7j@uvv(aNmIs+&IJ
z-Z)#j$O`x#R2q?0@EVDu!%Cnj6$`Iq5Hg>a#k>S&y$!+_+>!8wByv-X-2@Sj*a+hk
zP6C!9H)WW_evIROi1RjryV%Nuf7M@^>`~<dJ_63TjyQM>0`)-5?1f5;2H%rXa0?E%
zo%NRmDaowPW_%)IEv>Z3VeX64dLbdSM<oYYLNgT>WfR%(<9Dx*SBmRKbn=MMP6E#j
zSR5ihpcG+0O;BVzkg1A#9uDFl657~f7uq|Ala9mQktBcLg8XC6yxhTle{Rgv*JH@*
z%4H1~xbX?d-?H>*5LT}mX^ToCIq}KJFJ|q##@D4@hAw|t`<^Iu)_GBWnQPya#ne0B
zl?Av8*1n|5HDq>QgKjjwJ(PMh@^E7Jw~Z=moThevcc>!mZ=#6a1L~>xr+Cn;v3er^
zEgrQ?sh+7HCSSP<2eci#e^KE^)_g>dQ<qckUE_@Cz9NvOno)ZAUb``R?@3VU@)yOP
z>Ah2O_H7B1JpPJ083yl+m)1wZp!gjWSyMFFtx_9@X%yR@i#*IdgzYp%2^eCr%beIJ
zoY;Why}bZu7-1W&<GuvA^#c327O~o@s#B+rq<8UrPGXy(2#XwEf6PZoj9uiBF!7w2
z1h)4%*j3Fb>>1L{SvqU7=VY@DjNTiIc#k96_t6QP8_ImUlTB|YnzrP&Ekn&pmS*YB
z=u_Z!M{Q)8Rke=vZp2dEa@X8NEQ1%+rc}kDzv5T9%k-}UQA;g?U_!D?$twdrT1Z{i
zuMJ$OnX&GRLM~$_e}z-qc}+O8m1sA3ZF$8LV^-JMzjg0PMJHdaBz2psU0x@<z1CCD
z;nZdhvN3lMPTT~=NgN?JbfcIO4=4TH5%+!-HD9hUu4OZpz0Vl9V!H(mYo)$%wz+W5
z&b}9Hbx=w6j|H41@`Mms^mLm!^qm-om$)bUhm}05j;4SUf6&)vl_k0OTliXGCrGF6
z@dN@-NgEEWJh;h?HC^O&HqUw6sYdE4AY}qbKFy;qAu-urjU12p;^`levZP3>JwQ8+
z3CaTa)Evb|8A*HI5{7-rjBIyF(A`r=AA5qYHLPpf@e!}SZqBpa0fl0pV;hGtO6`Oq
z?4&7*oY+Bue}|L64wx5scXa|tH`UAY_t^R)FB-$~N=;Jm4mHVaWM-m{2S|BSM6GS6
z)qb*}73qu=|3F^ME@W9~(yY$9;KfBr=9d|@Xi=0bn+Ye_5uC~Of(ZxB>_Yr0StZ0F
zQo?;GHz!!f`}vZDgQv`@E34!eVul2<iu|x7yQ@yRf2;E#4HF-Y>b5YqL%lX|FmtGv
zB9;aO;lPhk;)FH|6C4CI2v`uLk3^X0=QZjiGkSU6rYLPUl+H`~xFJEJTH`u0`v3TN
z8@gX?uYZ5!#miY*SWn^OcnACZ9jICFviUo;Ix7bEN_{sbgOsZ9RDV;)6YG`!s7A{*
zUtIqde{S2IG%XpGP2~9AS=N`X(M*XXteld0_io4w3Ueq5y&^SCjVP#om-nN@^|b3R
z3aIJSZ>oQYSJm{&NA17V6dN7r<R^q@eSU>Ei>Yd@YqTDAhhOj+`+?VGM*9`ZXUnPv
zzP#r{_J&!(xcK=+#&g!MQrLl))z}a}01iZ^e|6Xr1q{db4{FJFaiROZ6SL6q5u;%Y
zzUBx;ocV|Z9&vq-VxN1T*?|wor}58`Yj(Rkp?_9Cfet>|;FSJ+)V5pR2D>=sg=QmY
zcLt}oTDj#+XpN!;1YX_qUHuHIltEZ7bSd?*_7t{$Iib3J;b;Gy6fTno{xeB~EAX0!
ze~a!uFFHkCw2a0`x>mQp2KA}2+b|g44kJcgjChoAgk$WXI7%rBd^e1Ph&$Y4chPPI
z1W>1V87j1$#Jk`sD6?cC?yI5ilZbEMVp*E<5>f(;!3*Jbz2LxbCvR4j7Pz0qSG+23
z)1!-$-w58d<AE*;>2`Q2>81t3P^WxRe{IT}mw;wnS@QzsB!f)9FbTjaIlCsp7OU-~
z!j8Je11q{VR8uJn6OSewkpSq5T$dt}cp<_hrEXx`F7w$vNG-iJk<5i4A^^jr=z0LZ
zKtR7UIaUq}a%#P-!7RNhH?Q``_7+sU4-H!jf$OYcvWE<xq~xvLLM*yS;WAd)mtb$c
z6Mw31GsZ<B<INU%egu=)%%MzOyHYe6mhTH4!xBqO#$#W%%%eG|VWKYOr#%JgAj9l3
zfnFP~a$gqX+eM9vjq~k|+%db0k8vGpyMP5JL5Q#$G8A)%pdgA!8WPTYhQG}77fytJ
zW+1qpyB26(ik60X+U|5<uTEipILGhr9DkoIO=T@|M%(a~G9Zqh=bL44KAie{(OmCA
zY2D?azmY3&qf0<-)m_~Ji4%D~w^PVq!Vt#PLrFp~qG?QG9|z2i$wNj-x{(Z%97M>W
zu>d(V9v|0)#qBe;(z8S6G2272M>xVXN>LI-2}&c+<2+<u#G}U(Td86J#oLyc5`V$C
zqXHFe`?osW5z!*g$-Ls<=s&uFkO`qzlI9pn7UehpYTKR{1iurpj=Gs9_^@V1YoH|}
zlJ7mj5_D#rXI5rLkhJl|Tu0d5Yrtf+=hRR2+TpGbd2DknO(B&N5mX@E>IBvPT#lw6
z=?KPy3cyxe20EfVt7>5NXL6c0h<{)7M&cJS^)P2)f}(&CggJLmL;^^^6j0ak2==gj
z7vs)w=GItvl&DZ@#a1t115XfJpyZTi?*)XdBkXFFnGQq+rjd%PIi8XmE8!NY1%QB;
zmVgil=)h&M$QeAGmswF}b*95;8z2F_Nq`rQE&#4=k!w;)%9*+(*({q~oPR=Ac=4C6
zjY_OJVB{e81|*DEXatx^wd5@VuD;|qLhj`s<^?og7cv(^$%T`Kax38#h|jR8G|*vQ
z7Snm1->6h#&^!pz)uNhbR7mWNOf4pE3Lm?b+{{TOJ~ug>2FWhl6M(@>p24x76dxL6
z)LNuXhkT`&%XFlMp=u}hD}N8|h%g`dPRbA_K1PX?P?W}w%N;kt#C9G)%i6|A*X(nD
z**>?HWPE)zP>q3=sIOc+xHYR6&MB%C2J$A96PBy}S^L1U^k@|hMKm+o(cXx^CG6eX
zlE8)X?wpqtxcV>nJ2gkbv&V`>l5@qe*Xzw$`@Glx<CBK=ue&C_8h?KC)b8kCzCfjP
z$_!PoW@JMB8Xf1D_pn<nln|X3@rsKX6J>hC5UL!3Op#)atlvt@-O5=zU_Bp!>v4x#
z++-|cuDNkWIp{_P@{k?wY~n$O@hv)xMTdJ?fQ3_VV&({*k`F+fXRjXFX0Y2u#f4fV
zyCCQkmkjswa&C`}z<+Q7+`_(nuLg`Y^iIXRIiYt=ei-mD@%)gXAdFpv9qOaVODW<h
z;hsZM?((e|36+<%n;qT|n+%;ngtaeb?07R(p{FUeSm%|n<$)s?uI+LLu33d61~tt}
zOa6}qpMiwk$3+V@O$}Jd;;rs5EoNC=0B}bLStI!4ZG~w$bALM*ryb@bEQuJ311Cl}
ziV_riK0#g>JA{Q^YRAFnBTjeFZ|APs6dKvq+L4b>t!H9VK;TvuxYi#b6u+@<!BQrK
zfzl_A`*|awJX$ZrhECnbE3UVJMU!E6#oLSU%Ul(Em)@;?itn3wP!7`j*9#oP4=ueP
zWbkd~^J|v2TYt)!M<j4-F>JTew(EO5C5#|Sq8Q<r`Y3U@hd6c#wQWC%z34%mhB3N@
z3uvFtL53-{{V+u|PC|t31Tr!*5BY8y+hGtgC*7R4M;^S^%juk#RWXy{5dROE&VOfp
z`~C9<oNDSK2qD99Rg*+Ij5x%w3yD<t7^+&4PfEd5*?<3OPO9n~>*OTsG$;u<t4#P6
zWRKuBDvK$wWgdO|{qy6K69J(~K(R1ztiyV$c~PWeB%ovgxr6FV(YPIb_rtT-&nMP*
ze}4JH#Cmi70vIo*^Jk0t5+e8)^Lc)Q=p_izQ0<(Q^-Q=hn|{%vEV&d?rN2TXK1U+4
zHU&v&#(%Go%$44-Zz4q<a4~C~dUJ5;Fy1;`(riX%kg{Bcg_c|>YVc37=_-v{YA{9!
zXg~$FiHIa9Dj$1yZW<Y1t<uTKTTZ5xTI}cGkWC61VQ_K+%eus`)~z++R6ttFOq@gN
zi`(C4>iAu<3q~SJnU7ME0ySnx5DAEjY(MdBoPTh~c6Sx7^yl-JN>slY;IEf%L$P&D
zO-?9SumgB5mGU_+vw}^e-X}8<$e$F4zoZzmQqG0aCOuRcINIl=yaLvV&H0sJv7VZl
z=B>@4uWMNuI!B0jr5N&P7#c}Yr0|E)J>hZ#njTJ#=6dXlO>=_Gty@9Dshl)}`$<+d
zC4W~Osj1XOG@^^~lq_;kq3jM>PD|=zGVs95$Nf$ZT9rfDSGywBk^EETJJL#EZ`cF)
z8jvD392tXEv(7BBE?OEF8IgV}1sBnz>A#+3t(9)t1t$A2t~(DpCOxQc)tP8^#obv~
z2DXtwFT`{}zOs(-&g_l1eQ)&USid@I_kRnQxMaXIo5pR^?JgXUGeKEkVj2sGGuWOC
z5~44dQ6$S%O~b58>k}wxYM0xkPHHJzHc6e-`a1Sug<r!q0xQqq7ANJ+$}zQ@#vGID
z++s}s9Fuz6-Pk0MTBW+&hv3nOLvW^C%`-3+X1j~Oj-8Y-H%gJ`P>gUIW0V9oL4S@*
zSsXHq8S4>l9I`6x9P=lv(A_}2mAZ)`;N2_uZ!Y?|NA%z3<L+sYA}j*#&b8>k?`Hxw
z3iZRSn9XXQ=h+1ZIy3>(@6<al3ysu;Znr)v)RyZg<;pkqyEa*Z{QBVEX;w}-v+|<2
z0_5lwZ#-#AfqKhl1VSkRb!ffHs(*TkN+kCS=*vTxA@>s3^<0V~+Yb<q9S@PfcTs@T
z(B`fig#gvw+?zPqo2WPS#+u0Ex$i(+O|!cMRtU4bZa2tnv!plHRA~U4<w=t+O1b5G
z%9T)p+vwAV*LG|FV!LcFr}L#L(|GI$LC8|%C6pm-yB>;pl%hE1%=QzClYi8{XGRR!
z@&Ebn|GRccpv=<kagUkSzOqQtQMLC;XCa<!#3uMPBo*jP%OUgHePmu+GUY9gLnE2r
zj=6s1WZfM+$4QA31PrB~Z6oZG01?l{h;b)Myp*MwI{Ug%CBNr@taF5caP=iC+uS#q
z{U9Y)|8}nKdS#B2;oA`V8-E1>N<EAbCb5f%moOAjk9yQ+ejKqc_r^3=u3OQ8O#h3J
z4EDllEQWX|Qe(Nr*RUGvx|SO4x8XQGkn11F^&ca-{>UY@V-bWhKM33uIbI?zxCD`u
zhsY*@hdu6*#HSB(!J)O++X~@kDJ%b@B;=O^J}~khZm(P3UI&K$-GAaf$^5eCP*Yw%
zI5-ak{&&ORja+GWrtx0`GYdT&$AJ?e9$^<@Y;#0>-$#^15svNHi~4zFcB*GDq5Xdl
zvVVQKcKZ9dvj5*s)gMm};6yQT2z5~EhCaeU9HJ<)6BMQ?;STqi8+f0mroY>)0-v9f
zyPx#LLyXuu*6g#hQGc6p7q4d0Z#ALX5alGX0D`Wz(uKrlx|HARkiOt+OJ8uvPOz8k
z1jFlNr)dg8oCFSGh*Os#>^mWfJ?bN7^EhD+PF)^9$i?%B@)Ydw6#fcsuFoTPL04Yc
zAc?_}7q-e~P%HT05^qMOnezT5`P{7|IXD0E)kZXqP5Kv_6Mx}wdp<zQgYMm`PmNvO
zt=#vLkU=`XAo39Q>=-3c7$X`cJc#@_cKrB`ioc99cxa?ruNQYfsEL}O%7lQ+eIF1t
z+1X_vwTLBl>LieQK1mVwh>PMhPLUH}p2WUq2X6eR74gB2IDpgc7n~**-~dX~b0?<b
z07knHFj{Y__kRFFGtSQ41!@q_jwp*!lG;APZWN-#25wFqcmcB`heYmPZpkkIgr={{
zyI+Un05mtEF?D=~nCqqpW5-1?PbrFmD2aVLa)TiH@@_+OwPXbcz}W$C_Q(KdP2BeZ
zXa-_N4~wuFmVWTsh=Zho=(PX{lJko4BNg~-4+4etQh$+(n#ew~g{A282bzt`GB?jY
zWU4w9#tRi~EaCjE+4(Kkq6{^I2fy?r9)tX6WmVa%E(t2ii?K=y5fQRcJ%R^itd1L=
z=f(Aogs<JB@EqcJE~I1hv5gUCsf@`&9`S5DatWphf3zsP!3}>v->GZ>N@y)002Bn*
z1}^v|xPR6E{<UA_2h`mI`zCsd_G70?zb{ywaZBwRSeJ$@jicB_kq_wcn0hD*y%_$J
zgxGf?k9fPb96VA$oi+q~Jy<%qGUI4Ek47F3QyckS>>!*t1SN@|AjWOxggA<L`ncof
zmI^fo6x}ZG`{v?3pyvQup^t&%i3NUX@%I=6qklal`g(JFG)}Bn&7sm%Hqp5|tuI{>
zKA`8y?u9=q7=I25vA~e_S$*#VJ=b0s8{+5uF}cL=>&~vrqQItzBsN1h^f^l0m?Jm#
zecQEz$fn@|KX>Qz_j6KBzi8Z?No%<hFV`!$6;AH!B=0x)LO&Ds{sYAAbAq_Z9kvC?
zZGWQ+FlM&nK=RCp*$#wo$0)Y#7zNm8)OM+th(2$g{Z;aXKNo!Al2ZFzGKO2PLCHKi
z*EwwU&#eZf4!4t&=Za8V>)>5qL1o<(i_$8}3o=vRuh!K>!lp5$Tk=3%78SQDGBpV9
zfKZT<vdkL&wmP+*S#`On1S_@bBruo5$bYgXua8wN7~`}2rZEnv*CCplz|{kayd*eR
zyoHy%sZS-MZAsLbg)9R9o))tq>3X7-PHB#yeWmj~r*%=Do}8>>8T>0RLFtDCu^K0+
zyHsD6#o_|ExAoxZC9wGAR>ISw<f0ap3|VA`1-kZG-DH;q+XXMhFoALlIK1^zw}1VW
z{O}D2VGRd47b$b~g3aYcFZsbqt!Eo@`s4;#A<a3No!-X!Fx+=z$O#&_)DHvXC4g!P
z0uK@Hav&lN92R0bru)u`HMfdIE$5_75v%uYa??JQd*VG@7m_LxE@o}Ske9>=q(yus
zGDlMLdGtPxBVf%`Zz<k>EggNmsDHt6hWMY<VwfG(;#boN$(n6Schx-4mN0=&M7{q@
zWUKm{^UG?%uh&Gs2fBAg^4oXD<mj|eeH!qmOR5##`J>y>=SxjNstHDhuH&aqMaD_t
z;9r)Qt4qe$8PxH_n2lxccg-ATLM&aEl;56C$%l8H>L=FA87-#S>_V3KkAJMbRNs!8
z&W)0X4U>i~t=7yR*6rO``mi=VShwtL(}U?+OiiI%vk1abXT$ZGK1f8trDNJA-|v^D
zY}`Vj=q<thCDIzM>R$Dk;Gt9V-YIXckmc7;#j>=$yYbr%C7K;#O9-)XNRi{%5uke`
z6nP#;fkTPsCq9mSvTY97PJhB$<yuN^dK3g_pz~;b04S%WD$qzm!{n@un+iyqw#}*p
zp(=1GL6)S;;#&J@4C$#;qm-d0)@5;RO+lDuSyg8<S~vNPuHib&X77vqJ!g|9L8-`w
z!?if2B`qlxH<cBsQdP8QEo)<D5)6^o2$Ef_aOg?)@1r8E`OM-UIDcK#*?UM&RjSlV
z+^TAlrpMOxWg%3O8Rx*NUYEpV7%xhTT$7T+{B7;>>rR|pBzdB!EtWVuq%OfIPCbS&
z2@(`h$3-FYd7RqBNp_aH2zH;bgO=|YvHMgmqW;oOnnl!da%b^!B2=zyW-QSfnR(;X
ztm7g!2xBXR?8y>&`hWPgQPSH8;<9lh`>{(XP+PjwKY3ZMOc?u}T2GzEPyFxcFcpsO
z-$)gZ1W@h)oyA&I0ZESDReYFFXJYxIJ<%WZ+d|~DQ9aQKY}coJQgf&4GZg`IicKle
zwFhVIGEuRqONePpl#~^r*dvWVc|HG1@RVhHivs1~W7TPg)PFRKqH?FbBV|c$js`0s
zH=O+Mv1o3PI!HFyoBO`J*+zSBd1ZYe(cVks?av_y96u=J>ONEN%=q>D?7ud-WJ${1
z$O~db(#S<PBpgLJV8{vMghfFT1UA2q?4pAq==7qYmS)kn-#<r9y3Kv!&yp|>9f(|G
zb`&5S(hx;y5Pu-wj{P8ssUOfj{>)t^dHh(^JSmE+Kf;h2`9ln_`I<S)+HWkY`BZ;3
zYo+Jki}x%s8BgJKQ<-{f`?osZ52BE~a$fOo^dH?!KnbB&(485Bl12H=zuLCv1;Ot`
zvLBV3r_It+Gov*)%kCw`kTOs_>n15>3Uj+ES?Rr|9Df?`CcWhJs%m;WNJF%B;vtYB
zn^?BdCaao2elk{lV=bSXwb_SWKwP4dWm1ym(7dSb3~D<QmA#j~1L=IZp0x((UP9Td
zvgV5<&#Fsk0>%#TL&}+TG=ExhkS>m;##0MCAsk&<1zW!L^hgmKau-#t8zB+-hbWmb
zxlSvy5P!Xq3+s=hB8qJm63>eei!l&8#1TruC_+ifa2k8I9kRPII*zZDj9Oj4gHKN0
z2m}7=sMYagzG4Hy%Ftp8(9ji)!MwwjyJ<cwkvi9OA)H!2S3F(hqTsZcWpx2Y?S7Z4
z1*MwS3APphXNQasAe}WTESVKkl0(pJQCjn&R)1-KMVc>Y0kqrO=4_B_12eFcL;@3=
zB(cqr?=yyQN&*zQ)I&CB)DJ1Q;~=<a{HYLfk^CgZELQ7t6@8698r86vrx$SIKDCY-
zZ;KK7(fu@4Ovdr4c<)$i;4sfZj~MBU*+R9L9yR|KJxV|)Z~NK(djI~lM-gruFW5}#
zs(+xqUv7b?5TC#Nn06bB7sjz`GtWl0!?29FPvRJ($oIH!)0l-UdZ44@&o6&CoE+;<
zjz7Qr;Wh`ypI`p4*}2iyFOCiM&%>#)!&5`e>Gn~)n;aVO8SVDWNK!jaQ-%@e91?k@
zAtJsVB8R3vW-;}GzK`X;&WtzbFAhh>+J7VC&H0O4oEUG;Uu<+>w6()|q5gF^E_QcZ
zs44B87V||p&+jZ^zz4M3!veD)NV(&oIEG+<pQb1ZBM+q>=W&Enk35uaA|%Ett9f7V
zJ*X?|P7tk=-{Kf))%gw1l3qJ-pqM`$PL<uAD(1Xy%jCAf!J@0*@#$j6L6k&pgnwKw
z1+Xh|5%D=e5lOt*3ta4n>76WN!l`FM(9{_sbupN%MG1B*<@`P#P@!rdg=6<H6xPwX
zBWxAt?y;~)_3^I4^dZkG*_y%AR%RC$;0!zk@LIlL%{kXK-x?TON^%NT5?&cb8L$%z
zq|v;E{DJjOVVLVefHQK?x(%3y(todSY0olLSv{j8aAwSK5XA)XBwz@~sgEL`L@1?%
zQG)F_4If6tG!0rC#7i5i-(inGcl8_(eD5+6UYB!v<-m4jlsy&MGQft}B+an2nM6X;
zhr2>rHdk)~cok?OyL<L4w$p71d}%9x3kx9L>v5}$;VZQHs8cjck1AfjyMH9rJD&3?
zpVdd}Ibjrtrpps`EJk(i$gT8rY)4J3bGP$&h)V98EH}ap_l9PGg?ke;h89+UpKcYu
zd1`mi!~!SMEi;6OoIC0?7nlk?69Bt7cRNqiBnUu8=ct!pj7~EW`~lyY+6kgeZ(QA)
z6qI<?9GX^F?+diL-i-{WV}EFU?7)mAP~Xm;xj($LxeG@D#v{|W!8A=a1`*#K!@L_9
z@=y}lnOquRH*zpxC}u83IN>oO+_918hY^orMr=RXi(IP0dbL|xMerCe?m<#D3H-;~
zZzQE#$*aP*{$Qf27}571>M?0`Cw$bgmon;M<oP&3*l{^ZxEG_8(0_z+oZ?g<o$j4H
z2uXpr7t8v23%#RMo*ljFAPGMTNmze$Vx4v?4UZ7H?o=-BbbTY)cx14*k&j2J8I_TT
z<#r<{caMG<syAqAV_CU(kw|%Y-P|5z=JkvpYW5C-^VWiMe@lL@!t>Ix>7ngivDy{M
z=$Iw|Vp&nv-`=Rt0DnNsaD6RZK`8x`LR`DIqstx@6nCdg#FThp93$p3AK@qtP~s6E
zIh-d12dSOlV2{eg%h|&!6aDr-du8I~Y;VehmlDsTK0`K72*RP0q6CL2vZ>=zCk;cJ
z1rMl9WV0_$nOHicgEH}0%<B51+k-OEN#(G6H9~iKb2Xwn%zs;}5#4H*s}Y@YyHq1|
z#jV)iX=+O~qPap0HDblwZmdR_A(xJA_4dRlk9Tt#ojYge?$?}bx4Se4edLz<NV~Vc
zIDO<Ld`U%l@mcF5che^fS#f7VBH=a-d>W!4;sjyl+bD6u5IH<eIY}LAWB);8Ya^tD
z#wPS>uW_}J9e;*l7{gSM2;m^%D6%~l1#XbAh<X7_`jnD~xY}LE)xOBeszz`N5?U)F
z&L8<T`YWF?Pz5E=!nPr^jjC_z4pMyA`e?=ZOtCj|D}`Rj_&!C5Qt@17znJqfE7&P?
z>P!?vRCQKRf5N$Nnav@I2e0OwW+cyVtYQZFHS&@Zc7G#iJ8w+lO=J<Esnjf*^ODm=
zSqYt^i5;A*<I<Fosa*z6k;b}O8$|n7gtI0knK3lu*T$4|2|`IFwcvS~6%Z0;mHd6i
zuYac_Y=K5b5|id66I_}J4C`tJQMaOc5f`agpA<W%AnjDzURE~LLH!t6F%MQstz-}u
zYx_y$VSmp@G~^87h<GS=Vvf8hN?h*8ap-Pk7kSZH)i$(OZW@?Kb8DTPEZJP*dyqk@
z*Oy%Eq8mwwBzKqCaB6qSO=TSkZYaf1DoP!Lal@+lj6g`OP^2LZ0xzx0tg4F=COoTJ
zGX*4DnJuyz&w&)_T6bo1TSYU^dKi~?vP|^v9DnMEEKL)PSjrNFiNjIsB^)_HN@5=Q
z0kQXxA|)3*Tzq_;w)^nM)@Wi?i!vn?cJXX*Ea)Y;+d}pam+{jA_?DL*19HEfomp>R
zo_`~aTa341@q|)7hk-WaUJD>Z1Z`MM#P=VBkxg5y0CFsY;V*&LvZeytCv-<dbF!#(
zzJIr~vz*ucx1U<<W=5tNJraowVXle_*y5*x21f$IlQO#^Q~l#F$G_VZAC=av#mX#W
zHyto4En_y7jStcYm|RSHCK~11Z233Y?Ekfnx)U_QE+vkoH=NI&PP18SO*x)e3i7BZ
zJ&%qjiU6_udzKy<eKa{td*q|daLry0xqq0N{z#JjC5)X<elaW@2K!Qv&r=m@nLI`9
z7F7S_m#0lr?O288FY`L-pPu~kv^(yv+6~zAg{)P>JCnAhf(4NQ>$NM#Yi@(R5*&?U
z?7Ca!^B?4f{;9!rZZKu-K!s!u<%vxwav1@9J^??26CmPwVL-wp@|~?x;r-Z%EPss<
z+LxAB$X~rT*IexCJ{JP3DViIM`V&FciOkC$NcQ`Z@<33o3wf<dB1@B3pOZ4bLD!@d
z-0_lS{}#fT9^!6=vxK>El5mVD<1WH+Oc8OIjkrsx4_+hB+rMzO-6Hm-v(>9vlG&A%
z$c=T)Zw!Ha56dfh-%!8^PS@|BAAf|g`xVBNmv6sv*ejwRnC`Ao0ZrL4o-SwaG`Jge
zsqsjbJ4kz7(N0cDw=(MwmVH~%?=He!!>8HK!X^?Qlz~;yb?X&5NP-7RP<s@V1@Vg%
zbK9@w%N*ZVFUB|dpLQz7hm6ENfXaLVf?witM1Y}zhEd`;2_ra-?$Z;rR(}xI9wO-`
zlh=vz8SK?X6x-Z)aYT?yJ%He)9*TmPB8q()cn%HHWb-(4>*v?6OcWi6hVaw#Jfl}u
zLnUkIItU?y0<<Ox+_~>FK)y9trEFFg*2&4wuV0~rKz^<keQ<IDVzab<HWdBB2cmdC
zNm49o(FY2BsJc{(Af-u>w||&Hp@zF3WNcDdCnrFDNP+Y7<V2^q+T(8NyA2i0&czmx
zddzRs|LyE6aUDOvp3P9oX@GE)B#6W$LY@-@PUNOR9Pf(o|Ig<ymBcBsD!_`UB<4nX
zgQGVj<<_fgc2(*1Qd>x=O?t5<z;Z-gQken>{1Yh+N|H-TRtPKQTz_ajA_lz9fX8=E
z$}6z_Dh&o~yB8$^k-ftf_`CM8>f2N6=Q0<2TiR}o5`rL=Gk{~svRW8@CPoT!tEICA
zh#J0?FEqAd^T%&*-U=(bj3pNeg3%NKGOaaDDZ{a-^qDLV{~mT&&XrJBD9K5AqzCe=
z;M7NI7IiV5>WT4`EPrx9pV{y!HJXA|)qE~zvz4aB%OfKgw5><B&$h+qKWMp`$+3o&
z?(&R^|NnVDyK^7PeAoq{5&c}|B8TnDj{IEacj>`mCU^_r&!c&n%~Y1!@l7zud3HR3
z17D?jfIantJ~8E~Us>kPwtgz1<IbcRgSqcC#Bo_S+WoM;8-J>Cwb?-jgp`VAC)~CZ
z<_28XiDqlGeHd<tL3e%@w~Xi%oIc`+Gdtt8ooRREx~}xL$e=^8F$O(pl0L}$PUQhG
z`+|+W=$(1o&r1wN$xu^P@I=+5s_2W?RkK{x1b=n!WC5joZr+%KsC7A41NFv%iyDw9
zE8mv*)WN&%xPNZc!rX>h(*D&Spk@N`iIg`h$JA~bb4;#ti!uFkO#E$k<KO><Eb2m)
zTPCC5r^L4?bL(oJf%P?;@6M^=bJueNf{38ecAXF<N$4Y+dtS&wpLup4PjbM4?HUKB
z)gPs6pl^jPqxAn)X}Z_k2_S|`ok|Jg2C#dOGJ$l|qkpXvD1b!X5vU>Qz>HN&9Y9O^
zF|q#g+M)&Ho!_)(Sy2LdCatsg0N+Y(tX$=2S`QL?E>jp=hSHH$7N5Zs%P=i9?isV*
zax$%c2WjMZRc9BZ=GI?cBhfA0l{P-6nrBy_YKR&*e5)50CDS>{E@sP8B{-g`+^O%D
zGY<z54}XypdjZ0J%24bC5sE$Au}KiPp6zax^G{ssYQE+E`+?+;P;R&nhh9ms)8vMN
zRBSRFjx1YOXvU0|YPXtha%9VGx4llSx0hVPb_7A7mViXKRwrj*V;eAo@TQ%9w1~2$
zOEa=UVaUTIAr!IDhipDkf)dJOWCuy&B+PM>^nboNF7)&o^V;TiSe~i?W?bht(N!2)
zde8D=)tp|=ioCeUcy$KjDGQlqW&NsctY(vo3z5sM=4A#F7dJB<Z;&(Zi5ka~uZGM`
zHGB@CUQAELQ)^Y|mwt8n9`O%z7_FK$SpZ^~%-T-X)9#dZUlBM#u;~iT=k=@cK(}6a
zn}7J?do4FE)6N6%4>s!UQ^@dO&I#<PW3AhY>;y(>nO(inCoe8KYE#$yc`TB9E-l+}
zh#t3Uc5f+!x@)OS-B;O+J<R~^YpDvGl$PD0cV8E&xS6THx5Mqcr`v8D0|};B)T%*I
z(Ylw{H8L?)j^w<e{77ki_CQPQj*3*&Tz@)HAHSXi99sp;M7y^1hA~fl9wx{S2}lx7
zjN&MckrSmXqJ;ZAi0&v!NYBMR$`P``hn6DDUTiKyjEE9Aid`>qT;yYHBb?$8MN#A+
zH}p~m(<Duz2cgS?JMj*(L{rD-E=-7l97Kt&L<uoxO9Tn=tUK{$@mmWK-8LH$!hiVr
zixeQtVQ(%z7;kMWJdC`$x`Ay32XizBv0+=WVb{__5=UO*1r7?R%MlKlj}n*qh%**b
zLIUFZY<uZpNjk;9ytbYfj4!i~4dsc3nrC&I#vaj$I$z*sQU<1xd%Y2TClKfNW=^Ko
z`-~Xos`d_>s$<Ri6VK<BvbAZ`6@N(<)mW~@r9kO^;(^s-#ID!dV^I?N+(7|%7{Zt*
zC~;DX!iae+2~(bg&Nk}}SN|JIW*tLalT3YNy>7k85-LC;qLRtOTFW7gT~LTN8c0xC
zNBs2SbYdk1yP3$qvP%dMYweEJv0l?AE2g}y8f=Jc6$~aKl1_%P<u?|eCV!kU&UU-X
zJO8-d&`;cmB95_xFa_1X_I>2~0rMHafMU86xpM;{ZJN#C?ie^ZrIfbnt~DzmA2zO}
zdkNo8TwEKZXKf%}3Mr=)e%Q`M-0|@iGplb#>Q?=8nKz%6>c?MR!)ZD$J&8y~slfc@
zb=xlyo7jM^*YgIo1CV0c@qa|ttj&nGtXsdnq;_!{-?D1)ZoghQl<p)K!V78#tKuSJ
z9DbEsQvW)T^){2aR)|?^R#J&ut4dAmO_t59Xlc2&s-<gW)-zscG878GR@0FPha~gM
z9<o67^q=GTkv=^8kX6kn<^F-1K6HzLt5Ev;$4HJEw{~?|l=XL{=6~l>hG}r6Ki3rM
z|NFmulajpR|NQ4xd6a_PQAtvlgrSQO^Qeoko46>67(pSS31xN=1a!arfa(B#{ptxE
z=<m6e0ANvzB8E+BiB!@^Bt}TMI`@YMx2f+MXa1KCw3%nCtf|X3nZL75<_Fkj2~d^V
zk&kfd5)`FLj5u~2*MIdq9>@GXQ02?$g<{lkL|1!7jwgQTvM^4N6A~LpN+^m6_F!6U
z&&4#2<GxAx04muts6-+R9}TobU?o=pOf>1}UXUfA4{GFU8v!s8iZ?1!BzxDQNPyO+
zD6jH@u!*7EX&}19h)zV%p!yBe{*DqTfhp6X<ZIC<FN#w4PJi`8!bT>Vd#DRbsdx>-
z<g8F|Y1su-OI&LgnW9IbtoXpd(k<TT;p@OCBW{X-d12s$9L0{q5vDvq#IYH|A&zkr
zgkHqS&TK&nJ8T4zNCj+YA9!<FTuXnAxEhyLIM@%M@<T+aj5O%|q@zN_G@9@uap20W
zs`fREwJ|32ZGT4~;WkzT`KbWPS5oZCEg{=zcT+AFzIC<`ad$RygW2j`oK7*vVHg8X
z9%mF`N^KNJfrnUXhs<$tWCy!Z{?E>=Kk^w!2oRwozd;3OCm^9znFLG?7l=!>U0U8R
zx%H$Qbn!$*j&14(ddwz<?#Pw~fVY7iy&!QT;scm}$$#u-G{EF|BR|ULstT)tssMmZ
zoDE-<UP(#_ecDB0-OfaBn^_lfV~+{zcy~tZAmEYBVw46zqUVtm#SZt8$81a)O@r8F
z`}L;_f_Lz#lj&4^Uqw28!#o*WF_s{S&@}NZOH*D-+A`y|X=Nt4qc=Q0OzMQ;NnoA;
zZNaZwvw!rweQ#Fc`2i=?LxBtCi<HKQU=|}UvHisHA{?=FXHr!wP00&Gh`uoIcX7LP
zZ)-|weo+93MhHnt#(}PXqYvnb4$hib=ZcQzue@X#ttZy^WeF}ga>1oUEqdFAaSa?Y
zkj3Ig%2WxzB=0jIvw;`q60vzf=F1r)`$y6J`hVI;?4%q(S*dS_5P%J_8I+>HVHAT7
zosg}#KAXiAtNI^G6<EHqpFXZ!+D{*Ue*NmxN3pn{KFZbo^ij#bpFSoxpFZj~K7Ewp
z@28JHE$X}|t|p&83f%nU)5qt<Jj;t3o(Uc9)5mA?dG!tSk4=C|k>`_7AJ2<xUY-{j
zuz&cA75?;5FY%|3*OwW+{PdB`=Xs`#W}iNil7IRLUbjyl(~|#VA=r;TeOy$~xwI%%
z_YFZCUYfB_ALj*3U`Fy!A7S@=`p7@bi)v9W_sRB8fd}!{QEvMwu_F}lAVQehE+Tf4
zA~)dyWhvpY=kN7aYwx1oN3SlW_G{OkRe$}tHyZR@eeUn|=g!6FK9_tqjUFbA2JpQL
zKGJ1iv#(t8H)ME2%x~Oao2mrI6ZyV6lQ(+bh$M&i)hVtH@pU!)T;>1?csV;SiwnTK
z>uSW=4@dt7H8f>AW8h5P6HN^-tL_7Ej)KVYSt~ld_10RB@vCse^_JBvrY~T7Y=8As
z!S3&(sJTL_RP$5Yq`3-aqs{LJ51;Ab+th`(l{V$<PE2v!1k*4=A#);x38N?qxQ%@5
z#Xbv290%ln{A=3ys$FYJN77P=v;m51>5|OnTmyktsYv6FHC^LD_Zju7?HqLGdLd=L
zj~wPxgdGwi5~VJ37!GLQkkA&+wSSET;eqYABM|Qtb+*E)Y*>ohriH{XkwK*s<<*!N
zP7iQ!D2aIte3sEmYo3!DeDntHObD<bG!;ENvT0|Qc5eAG34MuxiCSb~01-^8OMI3V
zB^7DItm?8@<P7p2RNz&)s4wA@+O0CR>#gLZt{s!eLms4n!ATOKn1nGRUVq>d-zM0>
zTgA;vubP$}o@o$cp;Jc6rQcBD(tAl8gZ}5g|3A|$BVsI+-$B#98qTp*u83xX$>kj$
zgoC|Ab3v_l*6yZuXBayx&#r*AACh;J1?6&&Nu68v6Etm^LIbjQv|Fk!6~wmPTlGTx
zAo-h$%J5e0L+{%8A?5k8%YTvx*=gz{%p#5w7Ny8`Z6}Ewg8c~Z^%`8_A8D1Z_LPz8
z*EVO(SFL7s=(5Iiq@lDRCbdyA^vuh*#WRIhl(W91pnRxGia{<Z*bw!Age_NWNlEqe
zvqv@R`BmzJ+{3mxq3Vg+*0wQ&S}_sZ-|kFV;}4QHsju82v?fM%nSW~G?d(jAY!^FW
z5F$GbVuZQNQ5;2J`%aw{M;xbpmWz9H)bs%p;I7`xWg}NXU9e-iM-LP}uu%L)e95+X
z@T~OYj4%cqbeRqPIPT8&a>}?HCpbVZBs0fJN>P#o4zgqH1wkCJ(AzG~x&t<9x%EKo
zS|MWU+|sVC1hlFuXn#gPQ0?zp0pBY5MOM`!xfi?&h#_9pM(DHbgOQiq*m@J=>Xhc&
zRu?ZcpR0(s0>KU3KoC_;>P5++YSCBe*6gV!COoE~bWxTo6pv*&${$2bblrrJz$1`p
zkwU;62L&WRgav`m(<qFBJsfFpGxgX0iCSR+NhU_TT7OH3q<>c+?Dx;W%G@369nHqZ
zP-ob<?9@dtPnK_}#tbtc?H5(N>&p*+djiA$<*BH(A=nocH|+YVnZG@e4T+~uetA09
zER>SYQh^_Nq9RP*ed$)AJ7qvNCTy?iZT&}+-qx{q?ijW)P8sGXOn3l^1sxQJn4-kT
z96KR(N#r~v*niw}1lnAl5qm|Nhd%eQmj=j=sEx488GsaH#3>7$By=6-^_1=d(tPJg
zbC5({OOsER%eDiOmB;J-Ak7;qmb6w~Ul#I~)6U}oI$Pa-oASb}LvVjTD~mjbi?h-e
zGm%<}E<`HX5i1z<dWh~;hA|3YUvj}UwK=4YmDFOx+<&o~1ALtrM`7eRh{QNS*!Myd
zg&{|QLukm|D5UOIq1><y9DC&+=u!%9Af-CCGDS-QWmU}zL3D`F){*<9A+H<QI<pze
z-e*kgBm!0}4u&CN#_Ss~Yf@ft*e5F%bH{?{?wFn;?%09rAe+Y#!kA(dd2x&)$EHr4
zI$lKYLw}oYR#mO$O5CGnVl*O`HuBcJ1*Kh-5TZttj7n{R_K8L|XQ`<(Hxa-Mr=7Bw
zwM^bUGL~-%dnamrcg{;lwFciS*eF@CNOFEuLdf^gu=%sLNUzVw)`?@=6U#mBVY!Eu
z{N|~>gkQ}lWTvkYtKg588xfi-k=nE!Itae{Q-7BJvnRhi9aJPlY+*ZT%JfDECB7vJ
z!)N{W$uCdGX7Nk6vfW9X?k>Y#C2H5-nM6IB?#S3GgK^m7<5=Bad$0X9HtwLi_%_`Y
z)7#@JFS*1Rv`pqx@&Opn?bYMD{jk)A62|fUYiXXn|2?&0DE1yV$Gf*B0g2H#$=+$^
zkAGckZ@j_O-F^UK(yGrzLmwM~VT<_+Yz#Z61tlTj5ea=nNthxWCmcnTFvJ|}JH$(v
z7Y94m4osTRd)Ey_<DZ#kuqQnswpmPU>Y+Ha38Y4jP{IQjd5M=qI7#f(3m==FAotF$
zv;<Mx#yWzctK5x-&~N${`a!>n5$&K~WPe;Y=#|<~GmuNs$o#!Z4qCxIXa(jH9CU(%
zPOuxDz&Hs$W1Zlj;2ad3gM#zfDmc3qb{P($Fk~^Zfd&8rG9$rufRY5$z;;-g@?^()
zj$k!>AT<Zt{yepu-K{tc0&crDvSZIh*uw#exND<;xQvDo;~|M3n|dR*%&xQ>sDEr@
z<pv7xO1J4Xd<)g4SHp;A(<?Eq*mMhRsMm-!Xw;f+6$h>69<&-`0S-#dL8-Z;QqwnX
zeEurU7d4oJ1M1*_Iyj&{Tm5Y3*d-5hj(v_WOH+g?aZuuf4B4(1#dZ`VPMAC><kdw@
zK!%WD_6U0AJfI$SJmf|RM>r-9B7afLP?Gv7<sqRd!5gcr2HH^s(OJ)nJSRyZQ7_hc
zSv1u9t(uAul7Bp_R3>BwNJ&s`rXqSn<x9EJvBK45mcleZ;6`Dcob(z!Ihp9pDLRo}
zax*8DKz>3nh-?HXY_CO1Kp+AlWhn!yvMKOBWdHzOR3bWoShUD<PA(QAbAMlbYK~H(
z{$I{&p6A&GpHXg=d|s4wB|D??_sn&6Iswfr0Q%Ydbo5^SaSS@L$P8O^!XUk!jtX;a
zH<-w%i6X5z1XWlkCokVxmpq??R&oV_&my~BMoEsU#T>c-W8r00%*5=UoX9v!P_oJy
z$>Eh5zs_$E6)HNjYCa<(BYzFhT0u-rRdZe{wX!a*Ny)5|Pm7u(La9*F3rL_RCa~nf
z06+v#HLXtvu-lp>DsseJu_d6`lM_&&bPNeR>n-v(BSg;vtZNP#;*6`gLgqH(u0(^C
z$-Ue}muv3k_EDPU5W+Dpsv0q#XYb*N`p;+QVkX{`Tro*WtICX7gnvx|ox4b;Sp{l+
zr73k`>!?O9fl(x{I&-uP{rgsoav`9~G=pVo2GUvmmv1e->>}k9tznn6<3F`tb4XD~
z>n1}L^hoZB#cWDuL|Ap;_hMEproafSH-w<n%Cky+6=o+`F@^Mb6FDCox>D+f)MnBB
zlDnl^&`aprUlxKHuz#wc+J;HsMttEwKMgc%St$s;fbLsTMKoUxDmlDJX0`Rhi)Uho
zkUUp=_2_wfXoHynwyLmvkOk06)QZ=wVVXFeG*&4Qkv=c8_gT*Me268@s=6d~VVKU+
ztgO2G{BOUX|Kaz^AHK_~axoVtl*-qsEM4$RZy*2uEcwIl&wu8B_~q!buIJS^XJ^;f
z*QYIHkQUQ3K0}M@OxwuLlDxP$b8Xi@bL=xaJY!9BNHvF==1@};s-d~FW7Ws!uqTmR
zV6l<JKI(iuZ~}<9eEtFMa(RY-V-f3eF(or3!Hke|Vg{Q6UI1HTQWRHr7*ud(<1;5Z
z6W@&N9@5=Ioqz5j=o>QohPoX?O~;V#STlUES?Ul$2u%LQx-70OGPu8*PYO0yE>A_c
z+{<E`Rs3$_^v;~%4913v8LBTif{vie;u?|uvguC<K|fH=8LA7^_M;h=&~x<3n3EZ+
zC;=+WzqsNKk$m;)pi}_VyNw|{bG<WhpQ^ownpV+2Tz>?GkZcr@8LWsxy&fx@?jD6J
zM~E#$`>>c$Vah8rA<6Dctn{g!+Kz1_8-l2C;<_lNo`-DxKOyk$#1{M~PMAm~+~2Uq
ztvTgz3QM|k5h~7e8I>~UWd><7#gPa}4MYI!d$=0sq`ZQ9t5Zv*{*odW<A^OJA*TEY
z#D@csGk<VU)1nl$sy-;OYxA7B)9Rw?F=(jPM|e1v=BF2pHwnv3f{y<p^YQA>i>m%k
zUFxza{n}#INU2And#hN?8_V@~ycUTjWJ)wS8_hfd4dF~ud`zsLN|7^lq8M}y{t?yM
zlw38;^>2)}7*EL}ht};5y+uolVPs%^b9_AM4u4{GZ2v6=*$l56m(`BZT|UNjo!RRg
ztOQ@(W+o&~#!Q3KPJ*{?64v$R-lxKdRk_u+P@x3l(}8a@9o-(?`-EuU)oo@&I2*>N
z!oST_7=796JV5kdee*V(>nx8yzka1Y`2Qd!xMy#@KRU+-1o#>i>bVKl&CSOB+x0BL
zjel~RBLcL@?@TRHF{7KK4o5~U+uPMB`fg5W7Z`|ou1nQ-l}}ss>Wk+i0DWK71b_8X
zA!c<hN2TSpzP~|D*}!GufS3qz(ktH{cejWj^AUeb8^&XLULYgJF08mRIw+eirY{sX
z%6HjCR>KR9Oukrg5Z_68vvN%BrZLClihl_i*d^Po_4j`vi@I1sLpuWf07>g=o>}ek
z?Ive2#bH1R!Vcst_7aR@ph}1%9NL6n&rKz7*WMMG1M7g`c!Bc-k=?Tn^wlV|)N*b8
z^q!aRGk(1-_rUsGbMnfltgP<nam#Gn%JMn8Fszl@;yp3a#0d+gRb3KEyChA@BY)ON
zt2NW=drcX!b+sKrP+)vTmAHVdYkAp@*-0m&eaWJn%`RGN>Dj<i+A<-$p~YNS0Xf)t
zd9N2@ZoxKFri6l(zb3*?1=FeRl86>FP^RVbHI9IJz5w<FWxH&C7K{(VY$`JfRuiiN
zLyxfYl{^K-Sr)29&q`8Xf_?OoNPiPjy2x|uJ)C@kYO2%S>U5Yk4IUS2A6W^^e`%5_
zxM}Ekft?~J2t9-&J4KNfILId{jXc765VEacgrdQr!MsWPHbf5oRSrfF5jTbdZ6^?9
z#QjgEnaqa$LYiE4yBl#~SZ_pfLTgGSkPz$*P=y8xnm!durgM^A%(g)Yihp?!!qp`w
z;@-L4P0_z7Y(hf^Zia}{1YzccC{CG&96R)}ZHJuN`;T&Jp_|*TO|uaun_7DGw+LTz
zb6m(rgY9y97f#pZhM=ujT~}1I1+Qzrmd&jx8(OV8@5stpweicyn>RWt&Ai%scF3Z)
zE{oo>^y?dE*XvLDwh8u@9DlMc0iZZ;cNb3Tg{ha&0J#njW2cxRl7ub_qtuR4&!v8{
z-PPD8y0em!lPgwS&qmU|3eMG$lXb)kE#1BS+^ld=3cUQX+sYrmtYrQ3jPLly3b0SS
zm~a$fj{tRKf+E`qP+&(cPrWe2c>9SIX_-ZKtC3iQ&c(9yhHBVtuYWJO60!uTXDiHQ
znj5t7LC;B9XEd9Gv-&pk+mQyEL?i@9X-rV$#~#8Y@lh1H82ND=(Exiq!h2v~7hABh
zU=wbz)w*ecmpgj4yVFmtXU+AlgFT>XNH;A--eSf(4QDFZ0B6=hNOf>%2@zU!N319%
zGmC$ar2Zn+WL0M~T7Ne!i3&~!KB2wexXb-LJ987XRhXUv$*{gRbNrxDlYDAVM(;tJ
zO}xiI9%xD`>*Cj)_;cmiFFvt(#&>py+CUx6DMggUKEht)BjWlFib&$bm@pQldpO!8
z_KV%&7EovPn)6>-Tg-D~7|pcd;m`|AQg_@_D-*fizE|z*pMPbpw~5&K`k8u1+V|nV
z02S;#*f3AFEPwb;mfhjI{6ri-a#D;#6ek`>IPyaj;Uq#lj1r%vflsJ^9|++Ah($w$
z<@eIqBKL_9b|WwKg2Y8W^)bRE1(NY7M4rcR7zYXSlb&tkK#RM3T3iXICb`1f{#ApA
z|0=-5LZSc+@qe~fX|VJyK_d&JQ2&Gm3o#fxNd?j)x+sflc#C$d<=U#03e?%D^{jz!
zw+KECh}8~)Rb%ZW9=ic^vaIB^&Tl3f`<#Nwfk^afF5uxH(USZMdN!4yaIjbi)3}77
z0%%jE9^-KSiY_;Z<?7V>mQ%8*T2rGn1@L#mtzsr%R)2M2ky&-kOA{IlovbXH10oi(
z2#6F@Q1xZ8D78IZvkfb2wYI2>0jg{tHv+FdQ}xLtS}H#+$#a;4g~Wxc2`Wk}DFvLa
z1J{%h*pNHq^yH*5rHlI}n@S|7lv=(S>w^&DA@u=dHnzlpDlA1yY_`wyV!<p(t}Lsm
zdCmcFc7J0XiAT@oa|Nh6wO-cNb(ZIrzy~YsgK=rxWnxe3RA)-e7u(b-08B5rn8m-d
z$|CPcmWzJ~bb85&TJN@(Z(tH;JU?xxU}I$U=ysH=(!)|eFJ@_0PAxKnx%$TfG^r+s
zi*+>v{jG5`C=ZKV(iw-(O6<?x<{Sk^D~zf}Du0W3gjs{&Zr5=P-rXD)n*zNR{qu$<
z9$Ej;dl5&DpD-Gum^(JYJi;h;0*u1Qvt!8aNt0c{AkBRYffecu18rV>ws(X;>TgGX
zHn;l%tTVC4&s!l?q6CgNw~NcE?%JYzjf|!j6B6fW<4UPhg6(VTDG1ROe+M?5qu1nG
z)PMRNsfnT9K}9bWETx7s^yu}e{Ox#R{j8oqrr+|&C;{Q`FWGU&vJRgTNVj5GP5rM5
zN^-M$p#>cM{E|u0`F{yv`ET|w#}n(jV!FPh^UHBFFS7C};1ak<HNrnwqS(>DXUF2h
z|9ANEf7M{~U$ff!cXbB*T7j5FxhhiKRDagL3-9HxozQ?^HA4E=Mz#F)q9`tM{wrjY
z=f9FE`LAO3>zv%oN&c&@d@%<K`d<ZM`>!gx;8%!Ox-Lrg>og_5LWG6*L}mUqIGtep
z;4Bs!7=Ao0W*yKr{ASF!3`*j#Mq6#1*Xli^I@465S8%AgFsZtz{jnM%E5w?0xPMsP
z)UKgiVlS>3!OttY|FRR1AOvtR7zo;11A$e|?s_!MI^P1Frq|kf(?(4VmSzmeYBc&7
zA!?tk(dd9hdt6wwC3eZJWu~inW(rIRk769K7&)A9gl(UqBw{I|oVzY|X|k;=W<<Il
zfqDpfC~1W6Yk9Jp<Ia5RnN=+q<9{;<SLGA9jAZd*QCE<GZ3c6jca@=uu>Tu~4lSx_
z5C^DF^Rl=od9~byvvN`gunuj?NpMW#C`H_7F~WXGQDXZMB2Mh{DCUIPd`IGFGoSrg
zY^2MhtS3@#Cn|PJciD`#5d3;(%~jH0ujmR9aA?H*+Y{q@fAY&vC|HeR=zr!v-zs<N
zXM5t`gTLR9xK_COcXiaY-v1`amKP-+B`AplhOp}p6jMe~5GN7gDNdZo-{!FUkG|!^
zI)W1i6lF$kCf3hypC6lN-uO|cvZ)$x%3$QGCPJ_|f@%QsD1x7D`y1PCqw~FQY#XdS
z+)7Ak<x){shBAXrPtJz`5r3*$vzbbo2+b<oz=)c9+F1KmTb!&!S+Rt(WSt$WW&Y#j
zeFg@M#<GRFcSpkOYtCnugJIa9XuDzpet!FWV*LR3uE^Q`qRhmMg9=lEi5Y%eNtJL4
z%!XDiV5fxzs6Nq2b%98&I-6?Rglb-Zxn=?1j8&v5l7p@UV(@l%hJTp&;gu02)Q)`~
zqm<hW;WS85<RlEGo)=;k`jPAIjMT5Y3B}InY(us4U@ly&)>-Vo(^IkWU>69n<*s)N
zXo<o|*w+vr;F|g0g#iQv?HCU9qt~bUcSy6n{w5k=1)A4o1a$jg=@kYK-iS4MD)5GF
z4atq_La*z8Di-C>Z-1X#PsLglDI>CaQOlARddNOiMF+p9s})u}8$K7;le&|$5}5}p
zDxi6)f|2{YgTNC%n6NuzSmJiEo`NxwlKKdopt@VXw;X$-A2bQ2C+*^>g2%_>zd`A5
zZ1GalvfS0}e2nRTe|z#L^{srTzZD^9G~JzyNFnXz_a%r7D}PxKO%A5X2CRsE>0nFR
zw^oE$%lj5IF4w)rDeX>@fzR2zB&ZjVIJRTt`=O0+%0m?Klp-gI6C7ecbUd<+AY&L^
zwA<&%bcv0VbaZ4JL-8{q5s<R75|At4!LVR-ptTXkK-;qNqPVK8Ji8JuIo0H(b%qEP
zk670{&yn<O2!HRBbtL00$aJ1_i7;yJ`nH}H_#h}ZzT?$Z`;!s-@}@0*EE@d(*?ZUR
zwvjAd@Kw;4YKdxw6aWIZ%u=o6N|&p=IxFq5ou}7nx0gF^kZ?>AYyh;ZnyFdy4)ccd
zB(ruz00>-2krXA%PUa7%NCI)c?8~>meRG{V0_cRYg?~Qu6j(jKp*Qr_`LDjU^S_J>
z<J@^wWLFSYqR=KC451oSkjrY^2smU~5J_9QE=simHm#7(tvY0G7ELV;yaNWJd9&tI
zspk&@prPtzk<F>b>nkx1xR8H@^6D3AvoySrDu0sl!ck`?ud*rwvw!POYQ0oSD!R^B
zGXWwV*MB}KDLUaPv;-HAXoWl5Ik?6%_PV8L?sT*>?Eh7Fb6VHzfRkJGp>4KydO>`U
z8VSQC1){ZjTbw(8mWvfgeHMX{$YrTGfOtL=S{N-Wnx@){VbG9y<9O@1(f09SDO>Ca
z1e6jFvmiw>6&@mj28c4^A~*4{@1~(Ag?k_|(0|(e?IwnyVz=G>Zj1ngKzqN;&tJZM
z{qwW`<^1yOuYa=l^69e*u4^gF_aDv;`!}e5&V}>q>t7~D>Nk5tZ7Z0Sytq0k)%u1p
zTq=b}QOOv|(RdUmHQAGcoJDT-0?NRb$glHa=r7w&0JY>#n20yZHFNo`I%h1OOMbI>
zZU)RUmfL>=Tg#~GyXOk%0G@m!Sl0>Ox~{tCV{SI>|9T^Nw#?+BQsq6<YohNFYh7ZN
z0Q}~87d#7Q{EwxqPTxGAIv&Oy?_KSU{OW4LMu+4UIz+QsoJ;4;dGl$l{$R@P4aKuc
z`Bny=FuU{$#*;2?+x^*X;Tqk-)MRR@+cp1;<d=UXoU6L(LBp-#k;T|@c~({Da2^;v
zO5@Y)afAn~<6~^#Wijf5)j#zY-Nqr6MZbJF4o#D+_H~`N?O6fNc-_@CPxNTt>%yD&
zwsNNSnrO~YnD|nwO<R`J!-t;Q&$Ob%L_b=}>f<#nKPqg&qB?DllzQf#=X0Y!y=vr>
zVKsm2V5YEWU(YC4j^VC#cIvzUg1fh1`ROgtsq-^!f1zK7OIOcW-NvaIt<fQTLl>Xw
zVXO!Ba+fi}b@Bc8^v^CZ{}0`XP1UsI)6PJ2SpMlJ>9}~PcA5oe_J{+$ZFI}J^UYJ{
zB(@%aA9Wklm-^58jndIAX_Zy|8GcuD;=q5<t6!Tbg5O|L+MntvIx4zjimpA*4@z+E
z`rn$OtEA!9s!%67aXArb#E@V(LWC2J7>`^eQW1xq&qajE6F@`{5V8*njdq3W`^0ro
z!UB$n6cWV&_D~ozpJC4nJ=rHu_BN>qzvPt!p2|N%pBhC$^{_E6Ns(ETQ^|R4%ejBk
z%J6%QqioqU48j=W-_<x}q=3B3QvOi?(M2#b%0EGK76P8kiy!_8W8V+M9~DU1z>HhK
zaU~vsyF*WW2a4nT3!N{2bY5yi?5*=$f?CtSmJUhU0TFUNnha%kD8S3DsfKOTbLmiR
zKAFPLOUbh|<KX8hfv#8?T55`2t!#gt_j+dhN^${6!)2Z=DifSnHk_q7&*%)v#Z|VD
z3hVrXMWDR|QxGkkm+z*I{37|P%02^MNQYt>yfLe6CJYHSlPSdh8CnnJkFj9TKm?*`
zf0a6}JYl6Y<OE=CQC0q){Q*om8F;A_cXvA`fWx$Zs@Wd2?Ld)oFVcdRRk45Kzz6P}
z+NLa^BFXblu(CeMmW~)+1tyOP5S%(pUT3DP8gT#v1%@4kOt=Ps)XP^t8N6&x0g788
zm9$FPEY7z>6B`Ecre__an=X9VScl0Ou+Nsd1y!z^qr1@X5^GD+$a<tRSyax@uL+LD
zY>`!&Y6k;r(ij^y^zQ5&UgCe(jd_Mv4mIU;tcIC3%PfmLPr>MJAm_I~I7&g*PSip+
zB-^Hk2Fz|@rY+-Qvj}@@ur>y53$LzMDNM=Y%9w$A7hE=9jsTXUG{q!MeUzl0K!lP6
z#eVD~j|IdNQJl(z9mLK98Y47eSJhd~MCTaL@%kE;+1H<+Z?8ai$~1p*o2@SW{Cx0x
zjWcxW|6b5f(zY`>y%OH4b<oiz$BNL8898~p2xY(Oz53HNt#n-6OQFB%zH0wIc=??=
zW&oaCf75;00GE41*0xqFVnYph(4W3CJc6TzRWU$pUarGys_V3SEsT&$Ub+n`bi8<@
z?+x0!rosl@1TR3G1+ahUx3ziO)z*&snrid|Qs}IQZTbFo<qwzaHp8c)p4+;}I{c{x
zQZ<NEoAK{Ej$eL2DC&0D&2NkwaTA&p*ur*WHiQ*_SY|`%M`=PtfD*<zBEBaPrD2G?
zAokr5``q*5UA&jw?PT#u0kZ0LIl>2`QRI2*{85X;u-&zwU=DxQZgg8qd!Z1h0Qv#f
zAax)#4g$j9_R<l8b6R{dKq>{@P&r&03bB1@!_*wC!I<JC!BHA86mSnCLL-UdQ22<)
zi5vK!I48Z)JW3Ep3F6)o#Ad01-45luX^We^+z7XIwnW-~Z}%Jk5O)XQ?tGRHQL&MS
z33HK5Fa}g?gs6X)rpWU=Lb30sg7ZDWB>lWc&T02x?I0NHNYD<fq_M*fvZI(1t(4H9
z*UoxA>mRm3ZYbsWA}?&!(1xSb?%SzO$D?f}+8=wNowSfcW!_i0?cnnwuK-9<E0S|i
zL{-pj8#&ztwP-0p3g^GFs&+m9e({I@aejXOU$x5}Xor84BfXnT3!)-=(Y2u1*VdOt
zd2RY<!9I*43l~_U<&Ry4Fal+%Oc@juaFKCkeaTAaTCNHZ*SX48qn$@av9I6V0tfO&
zDuPl-4Q^uk5oFeBGib3{&Q;jG`U-3}9s5fm=U{cQtO{3mf;~*`DizAFaX&UjM~&o<
zwY8y{z-@nR1iOJllp(xc<HJio5GkQ)93qm)1d)_Sh=o+3C=|X-{WKCZJP<sjWs})=
z-}SfM+Fj>dz~o$*JZ2ZphP^d)3cC2DjZ2N`Q)SZACPKYrHWBh@gU321oxW4JuXT@N
zAoNok0T6v7NcqaL^ImrA+0`v<d9F=4mT}}D(Z_#~no!btAKlWzUPgc}7Di=zWQ*Oq
zdZO%+%8RDAL(j6!qh!IGYx>XrFIjrJhSP1t58bl04jj?#PbxEee+H(`*z&L^eA?~g
zbkIdJ&;NdX`@-x#<Gbz-j-q=suj&Q(Zgel2edzpagYPs5FLf3vgG8@Ecb3(KTsC{!
zlxu(Q;0`LF!{PRt!%k3+p3^E9`HIbIcGi08CeE4TV(eUW=X&b61GcyKCwho`?()l#
z`Dq?)eCC&9Q}+Jk->+{SGXp0dF5Bs70pE3tPCi`rTKN9N1f$rGbUJ4}^SkE9*SzYx
z;4jxX;4d5Zd(V(GQnx}JjJ10diZH;fSH^!lVXQOXsNnqoF!p*N_eHWl9q0a7YV+PQ
z`Yu2W8~XXXK?liJ9n^I;=D<1q0(D`$xi3!xkI@l8hlmW}iYO5=N`u5jgi?u^AOwX}
zcs}(drUUT79g&nHKG>n%t|2hgVtpaG%s%T}r&7D2d-`RiZgowX#KCW^S!kP#sLFpl
zm&zMcAkaKPBvB5GSJ{=yR18mm_nE28o^8-L>iI{@8etAvTrCGV6nIY;DqnFyGsr@*
zm+enAcuWx>zUz8axJWXdAmXJAC6Wn*1*0?um^kT$v>vU0N9*6gt$(cxur>jLOfl-U
zJNdBQ`8U<hu*(JlJ~SfwlfJYwl)Zo7pL85~AVjtP*8j_?@}=Wqc(6x3|2_NAwiR*y
zzTeT*iB98$`Dqd(mO?_3h`1=BjG-h=ags=ukTBiTzXRv8UPdEM9l*b|)-(%t(@V^*
zFm2j&kix>W)spELdIVZ|r!mhMp&HYip(AgcL>({-a+<x-)j1TkFj(r0(Mo?+rCP1B
zfopr1+CFeuWmPF>X?tg})$9{$ZYX_&=|Fd-D_k_&MsXObbV4>P$+^iEBEQ+^hFWi`
zN|HE8q9jBS3*m;6U|x<W3WzH)qjAWYcX-BUU`x<`xZ#p8Y@%xyg(ex@W?}SlmfvHU
zK=fL#x_rYLDdcAf05_O$3srxnmJCn|)-hRNB!lX1RG{8<ChW|}M>x;{;Xq#-(UY}_
zZ#G}cox)_f@iNwD`v`o-GK^iWGmDK}%ss@`bkP6l&~4b*AjWR(fw4zP8a-3bpw`wV
zq$)L!bldU%WQfu^`EWVn)wJZC{yuFiNX<72w9{l5>Io{!7No~~4`YANQG(gtNV9gv
zzE68iPtN_O`?pgnC`&Z4WfBi3#7`(j0h2x=lDLR6nV>KUg20P>Eci|cq~~3vHCvTq
z){CBiYT@Dwscr*+zRMxE!OM3JSkt@w1s3bHMPE<@;OpprjiJ{u(k0k3l)rQU(pOyO
z`-pwI!$YA@h9n50n4y1&1`xjP$0!l8kJ5k#7&Deiw?|NMG)o-K5|3n-7~HvI^3C8@
z-)OkdR);NwkE8kF{vMX^={6g^t$PdaH+W~Od!^%Wh&*3J9z#S%fEjifqB3GAiE$hy
zJZ2)=iMsLUHWI3%*N@nh-ge<dVCC0I>AKoKa&BM-HQ)d3GB1Dsdj)B(JGXhU=-^;f
z@Z7%?v?zWo7L#+3LM<kpy1q(<iUIeG^433_&GMUzKPvRo&skaRb8Xi}k63GBOfU^7
zVoU^x@FYMii9!^FKIW3d%!?0WtvMPXj`2tjcX2m2a0$<f?$vDvgz1a>E_1-~);`|a
zTin{cRredbx6OaW(z#IxOHxV##N#+YB%~3FS&UKQ$v}89rov~t+}yvu`B}#*D}-+M
z4z7`)!%H0AYA#e2W4v5S3i#@*eGNnb1(eFhJWilnD>w)R2y<zH0%o_)Jo{o3=G9eo
zZvQR_HZL5_0S2EY4JC3`SmEvY0{lR^qQugPb0GvBqPTyxW`C0x)%C5;c57n50m1+%
zhC<_~!4IM+(;%u^L8jpwpiBEK%PPCl4hre47Ac))vy2wdu#q@%aCd0Pb-tK^j|9-<
zDumsHRyVEw(d3!ZPj|>02P0JTz-53U-cOdvay}x*h#)0#9C8%#NFu_+6eWaH6od(<
zOwd3I`A~mervt1tLzYL|yx?HGxz2C27YTsQ8RRgnGklwj-vEnU(s>QYA1vA4Dup?1
z7hBzAJF-pZxGVE|IqkDl8i^Kl7xq*2M0EnYH^g*XRBYLNslNt?k(OneB-8dg-B<oP
zl4iQ~Ds@sLLsPPa3ZF3*P3$N4OfIWmZt@~`o~VD((h87a+HHRPwV1tJr1@H2wO@;w
z7MmtRdgu%Y5L7>)_lg~QJngNW$^kZ%iZ46)(29dK_^=TIJH@~QdUNPEvh?(h)YcQT
zi#9%QWzSYSZR5jD25K#2LN6K#vl*kId#lsmqgQ7K!%#DB-=~E6ePfF2t@vGbPM;g!
zW!HbyDfipcbh4axw45NOJPbGz0i>3pF-D96j}K+OFJtCPPd)*Px{kc`p!9T{Bth&6
zhC<(s5%K&Ku^5LaaXFJL^a4qHhQuR1-NEVU{@MuKKu4wo^Phn+?cZquP;@2htA(*E
zH{H8}@=vDJ@>=OOHO#FSs6A~p9-U9Q$gY2`RA4i8?q;}y8@;5dtZq@2Eftr0wzz7^
z+45DzbD+~r%>suP_$-6Qol>xrO99$Yxhl0vBE`hvbO}^$N}~R?nEeEgYw7z=rnNsU
z6pi6qno2d28tp%bP0tlEo#xc%*Al9AXr&uwxJh~hYi9~MrXEm3)1$bn=SfkkooRpG
zHC=bsDDqjpI5$*qM%4$#5mhBv1e$0F_%@#}i+rAy@(10%PPPIFV{mRjJq1u>t|!>e
zS*{rOR-h)P+068%kR@<ZTMucy;D#2EZ(53RR<u<y8(~G0zT`xN0g8p2BI08oF#&1x
zm`i2gxq=e+@Y;KmCcQtOzrOhy!61Ls*`Q!bkXeg&<#|3=Z?_NIp~~xM_110zr^=R=
z+C0|^q@9_$qfG9j8ICc8sd^d;Yt@o>*|Ju|e|___dD|Q-hBSWX9I#DbuCjeVudM=`
z^t=rfS63U|r$Tjnz17E8wrIoI?DV<2R5z}P-q~FUDA2J%>Ok#eyxpVvR{eioS99ZF
zZdKAwt!pXB`gqGD58082?6G*r;HEe%4;hPGKlXTpI8Gx((nO#{crKEd#w<+&Am-dX
z_iZDA)WS(QmH@Z*OFSEuQO0hdMywf4jcbTty5fvEu~mqNYLU)TS!aJVObIHH<1D9Q
zt@S+&M;W`dG}EUg+hb<>6XSp5*o`6mVaN$XBo1Q~Cm}_YlbAD~%QOymnV6qC(=nU`
zI1h`Atu%jJx_<PHB&c(CLbS)a5%c}^Beu-sfyXPLaqPK%j69FHhy-4QV$5QcB(cwf
z7)Ln3hZmPjkQs!dtRJx99<bzcOD11|!$Gad{t`Be6GY7lSo-RFuYP}C<&7Lq7u`xq
zD#`n0muJi}#?P&EEhbe?uNj>LHJyM5+Yd0OUv?>{6CYuhL$9uSa$UEWuIc^X>mjl|
zBeoO75*46~`pjwhPb}|BZM?RhGzM?=l>#1Z^|E=gv4C$#w+z$M41i8L**>ifHh96z
zl6hRArQusW=JmHKFC~BcxiK{*y}HuAhlWS3C)rqy8;n_<uG0D*vQ~}^ko~0j-p+4%
zWVyQ^%iW##(!oT9h<a%d1POAbFA;G)3L$nW;yz15CKJfK@Bj*_N+h_&;R+1vI(?U-
zB3-A7>UDRoqh#RhYj^)xj-Q?$#%?V~?)UE6T4pty;~o;i!B&56949<v%tyqJ86rUx
zpqQi{!ZG143sT{xJ27><%Uk%UvHUg0srB$12z_y}qUcbT6u|IVC<#!$d#k)I%SsmB
z<}+{1C@OP+1+Ul@KmuOZ^<Y@RS<K^zBOC*WM1%=q5sMJ^y~ImGFY)^d!eK*~jZfGf
zsdmWM4H#^)&)|Pdx$7L*+ne9+Z#YW2TfFtlueXP=TW5p&yDoDW+d1w)2gIjk$k9I;
z!^Ha&i)E|hKK-pyJ#67ZuSfD;tWNiL*nv}SdJl36dutE)i=rTOsbCnnDTDi*OGFco
z05bvOg7AR5-V<=wb^SLF>aPn0iMWpw#AG57VV;W;f+c_8=K%9B1Hq5}x(81u)d9Gh
zOj2*M@>9(xxwE5Ar=dzA-qhqdQZ!i&BmM9qsa;b!_;yUfr#_7{Jkcf)QluJ?uE?Td
zMQdDl<<v<blD#3@Z2*sk<hS8)?XdaI@*7mh<w}#G)IPCJVkTtgR4SJMcwOXkI)mL)
zx4UIGR^)%ZTuO1iZ9;031xbl8&G5C1UrRuEWQ!|Q$TBM{h}8M(i)Wg(rQrZm$(>pU
zrt;Nwhhuc8d%bUPmO5$Ex${PX{fa}*C6%>TCty-~^J+1t3#y2EbsD4&Ewo{k0UcHW
zg*CL-<N#}$(#RgUvs#on97&31dR0M!@&cS$3jlu@>x>5!Y5}oFdn8A_etNMC{eGBI
z*B6nGJn8y~fapadPLN122?-4XB6b#5dvkT#CQ8$CB}{_NIo=al*D}qmmA{mmTg_(%
zrq-H^7_v=4;#>$GgPBpHt9c2^*V&Wzf<ZT39Ez~97YUBj5P6Jwh$JjQl&3Kg5hECT
zejI-!<Pk*J{wUse@YF1fj-AmLnv`NEAPH0reRWfjZj0F$N=Q~-Ze72DS2r}$txyZk
z2#LgMIm@^v6U;R-9}?_A#xR~2O3<#WvaFCzA2xt~?*-*;vok9{o(*`e2g!H>JMiHe
zB;5?8g?cW;dGr0-d9|z~o`*nXJEeF1hHZb;RMP-zK{E^;(q{N|NZJhjZAvqR)$gxW
zS!@pH5qjuR7U*788?A@BC(3|0cwsG-v5WCJcFy|MUvztJQy8~8QTLspX4JIe<iln2
z_tsp)YJ1p^bQ?6zMtszwHgNzSkRSI6Xj0u9bf`=vBzA?%Q0Ri0BorxPK@gxMjXZyX
z6W<d8?|N(3;!mEA;%COAwBdyt6_~X4eo<GqPSs>1(Z+?<wfAr^I!^G`7!lq9JbW^Z
zToDO@2qAEdCmu?oNFWgem{LIk-{<>U@c;$4)ezfuC^e2&-jF5Wzkrl*gJEib|2y2M
zkJ#`IFzR7STuK;4Y3#$OlL%4aMTmckkj2;ym<atx5T45ImiFBvyUrkJ%S^hmbyCwt
zVX2<K14&CliWT?@?+s}ilR<RhTM8h<EC8lRRZ3S3*$y5zluFEx+cscZ`DFc@butNE
z@0g_0Z_-wxO7Eq0=@{1MRxnG|l1F+)ZYQ(U<$%!A_VFmSY>-;|L;tOaEn9!w#;we9
z2%nmtQtbIOMNtCuaX3m5h2)D2QyNO2(ZF>d*)ODhU@E!!{cm8)=cdbVu7g_V*405y
zpDpi%_6UY=hAQyx@Zu)G_U^-efSujo<l1;AY~j$_B2>2fx{B-7gEHCXTG+v<cGu-F
zc;Rc^3F|$3$Lrv$xdOk#>tKKA4?M(m5XQ0VVmCmpAA{AJ3dq1q5lQ1T5q=^G-^ptI
zVxvc3sF&TDBU3r2G`IQ9HE6!z|G0spNI4&z5*XnPBv@+%&Z$!Hz(~3<E{e&y^GjaI
zADj{buF@GmlPU`LjjkOTMvumEVWs~>Aom0NxMnf~It!C~tnu<l0m*;muBEx`;8IyF
zv_D3F|EDi}wi42WD;PNFu9otYZ(yp&sq4FG>LU??t=x?x#DGGCQ=cS$kPsF;n5|si
zHHU_m9`fdGoWFr;r=yx+Bipmt_rKjwX>(rI6KdQlvwU$S3+Fm3t6ar7L0-`8>UyRS
z4|OWe*)3!)ZJMCh^TmIK^X}#AABLG3=k(Sot86x_1GU;*l;9F*Ru<)4swg+Jw$7b*
zX7NEHNfS?Vaj|)MK`vg0$yt8moKhil>D@IuX(S(&TT#*M!~Kr<jIPRBlfAeAQKVP;
zr6X<^be{3k_aM!{T;ye5r*)i;eAh6gjpnl4(`m3>63mN>`ni9d(_K3MkS+di=d|1V
z5h-U=mc@f4a@?#$w~|WR5Ig<d*2?R8#`X~$(l++_qrUo0TiHRt$cyTax26YKCFlPp
zZ`ZaS9)4x;Io@uZ1lG+qFwhg}Vj9H)#c>cLA|MwJfS+W<A`!_b^uwL3$Bn?DYpid6
z@ak`nPI_sYtptC*+RJKCi<a^UbX9rU!4oKebLpJAKe!6zU=p{OzfG#;NsT6H>9d+|
zfUj+8GU(Vy(gt_Z16wFS+-cqBd;zi3bHGU;P4n)&`}sL!%L5#0>70ML{oB+zukz*8
zIagrbsdHXltB-%n;5dUjL*2j^GYVi>DHrF?vziV~Y0rOIsjkJ2KsI&CPZA`q{Dv07
zsk>h)&M%D<H_3sleyV(S4G0EmHqqEBflMZEYLTwW9jVXguPvbI=H8A-XEbrWBoGY6
zZsH*ldofCU9w35a;)jwjEFZw=0*iEz$9@xTxxbv(+uYS93eOML_ub3e!mc3o#=3>B
zvqtT-+|_@IzNb9+i@ce_B1N!jA?O9td}mkJ$WG<n*se^BqMmzzs#P`N-0m{rwqjs+
z@ix_bD`Fs&1}Qq<&BUObDqlA5f4TizTNa#0%_qRnH6P%JYChx(=yv;CR<$2y+2{5{
z##e3Ow|V=aWICQ4{wZXs(?Y{P|Glz5@l-T_vwVMHeOUdiZFag^v;~8?qxm$?7bRS_
z^=AN5Hy^6@&-twR^NL!vx8MGE^QVxXo4@I@9hARi?cejfeI`@py}AKlN~=dIhZwZ_
z4QcfOaDVm;uNGBtJ370+7PBr%V8@=g27J>8>~}Ce?`9oNLoLW#7B^_dxt8CN`(Xs-
z0|kG8#j;*}okup?WFKF3X}Y~R$JX77%vz|CUGSu@FLi3&s0!88llkJa=D5^(-K~oL
z4EKQIHB<qX`X<n%4REL5ew@k0Rdo#+)6H2hfP77yKRB*_|If{>qKklk>pMqvy4SG3
z&=NAr|60tP%Q5@4wOB{gyN0T<mxQe0ZXAD3z+~#YTF7_#t3^xTSdY%-<)FD!NA(D}
zHrG7f?J)#v>LG+CuX)89<blq4d6&ldl=vs7j+wkpXWKd5H=UckzI!f?u7dst2an?8
z-q1>Jg^}9@9=B0-Z`};tbZ>11W@&<U?*8DOe7LOFA$+4&(aDF)X0^eWW}TdTxU_%P
zl&#&DS7XS#K6x)pm-QBmjRm<gL#496<u~Y!Tq;@3lx@xLF>~B+%*gQfJ=Cj#iGXnt
zMkEv{_L3NpBmgdykRvapf`^>ZAWU{K5x{~pp-YyD*EwC}je4Xxs-0U|O?I#vD9vZI
zl&Qm3Aj|{*Ss@*nDMGXQ{jQ#aVDEo4%8*f^;jz_X1<S`MZ*@Aga+WQfB_v%m)#?c-
zJ4s)lpG~O5C#i}Xs_S&&NLtKp$Fi{1345QKQofKkBA<_Ci;;dzNJ<csDMy4wA)+xC
zh||DNMH;x`L3!GCP|MY_xTc?_^UJG|wWF2}teSecbfZMpD9NyJx(jBLR&Rgj=2J_c
zfm}9*yQYy4PE!@x5;77~N7UI+4gsw@>e5GD`lw4Eb?KuneblAD8D07->#vuWtpaOI
zJC=3s4-N)Npw)ISouGbNL2p!D)(fDZT8?d7U#%e1kBgs#`g+te4~VwgS7S4>_dsEb
zu^-ZaMTiAJ?n6_864y%+V>o~D7{e}$cT(7X9*MBG<Y_HMpT2zclT%PZixHJ=oTkPS
zzgMNyVsq_6HJP$I@$+?3A~20~(`SwPR{xg4Cvaa(&Yd@nN4bp+ru^Et%LZQ8H%(5X
z(sD+X&N7EF%IM6=76OE8NS%aKU8;5G^Zc`x;>)E3C2n@>2npV%>@$COi#Ygw3<J2b
zNvrHgK&PPdn(iFlJsXSc79>tQHzmmPeU6C4DWXZlQ0z;WaVmwMB#)8dYCR)SGwD6`
zX{R+X?cfA#5~u;TUEbPMQ1+}NO{36Gy{1W59!a%C;QU_5o7t`U-ChiwE<~nKch+K1
zpoE%2-NLpXJ#ycxM{a*_vaI{~-R|(Yjk;LYWy2Z@NPm_KmAz1m2}$jbo03;4bM?>9
z!ALz5L%V!e!uc)JZta@l{QF7uv=fL8Zn}Y_<6{v7aV!ybF-IgK6eT?HQAAke3(k`;
z3ZDR1SD(A7$J_Lv++C?mBR^t@Ga?b8fr}C@1!Ae|MggHA1Gaz3W3HWt<?d3e-~~u|
zuZ!FmY<H#Wx;q(2$*H#E%MGGeZEDu16g-&U)b9XUQ%g8sOWNAR3`i}V;6%AP0Mb+w
z(CN2RaMRvNnPn%J)ig()Vho_l5K^h+u^Ge#f{Y14g_WlMQAuUy`DdH+M==w=&ND!>
z6@U<UUVzL!%ej9REg9vXYL+IjPn>r$_B^X9%CEsUqB*<T(xy#WdH_Z_(Lj`?P{gMO
zZB|IJ(!{&PO0lKoCiAKMBKb<quVOO-cMRkU{w(cONj#s;D9eitOj&xo21Hq2id~-I
z013#FL#XScBn>0PBTTTzJnlxpLpWZHxG^LpR_$Ci>t27|{&%ir)LoNP^HIs|;|sI9
zhHGD7;~#+%H*%hWkj`ic02|n;4Zot2I2KhWJhab+-1Mg*MIK3&qYB?66-|43l+Ih-
zz45F!rh<)}NBcBDSFJ|W023TLpYAXpPOl+{Y=s#B2RXmwrWI<0?YuaB4)tS(8aOkW
z{3!5OSJHo|vTCL!>-q#3WU$v$F_1Z3mCZ$hY(<OPjYW)SUsaj?Mx@rcl6*jPAIh)a
zV1^oX1|Bv=O#-a*JaCa4#u$-ELK<^H5OdR*r-|UwXS-PWT0+^r1fdR~p;1q7$UAI2
zDipCks5{5EF~a0GkoCDfz~NC?XgddQs_|8K>d=22M!4|3h)9Ha=pqt%9*TVyAvfhb
zjcGz?5IvMRZ0s^D#|LD)i*fTMw(jQIOyxhkzINizv(R=;W{z>79sCX!ffmLKfpIhG
zfa0a%;${;5w6Jba)yap;#yny-z<LbcYLRs6Q&afQMg)Wk@|lpuYg%15zrKP6XzEsf
z|GIx%Or5uXdFBN=hs4n^v71|>-HY}nbp1eL83`1*E=B}PiKrh%$fZG&c+8V&BA$S%
z-dEBdQa6t!=Psk5mg5i+=5iD#fro-5WyB{e;;bKg=WRNe02{{g{F8FwHOG_cUt{+I
zR9HJTm7LdRraSM5-|OSG)s~Hli}CMjMHzo7tz}utAL>84Dm18I(42*UC-dTmf5O=J
z!|+F?B^%YZRe~$=2)g-eAZ>oG^{-p!Kc2mIUK%T)qb;SAT^05JkVTHJ0hUKsRqiZT
z#g%kU|Kr)~iBVdWYHjY?wR}7@1xgm97~T%F_C|V!7S{kXn8PWgTV2hnHW6-@Bd&i%
zuffS~aUL3l`c4i0C!?4DZLFJF=}4tji*?y=wJYUD(q+EL{w9Uh<3c*i)ePS4ciy%d
zG~I!#vye-v5N<FGss}JS6r!^}0f#{AiV<KHXvdv$rEciZN3EAb=GvMq8{)tq_Oi%S
z@-Zk~XR}ib;tGqY(&lpI*W+})q}hL!iO~c^D1h@6D75YaQu)oau~(5EjcN3MqstM6
z-t|MCg7r>#G=LCY3<QrZ3R&pK7`rZ`_)!)5C2X0xV`^+p#}>mx4^LLz9zwDK^&G}$
zG^Z_W;(8D37^1OUweb2r`nRIDf^O;rMdi5mtxMMela=?Z7O{+s_aDz*@11`Gw_C(e
z?cUr16-scQ`a1;-v(OG}f1?hfy8gF7st?2p`_*n<Pgk?CX&_rS;|0xT+HSFz5kkE^
z)`DO|3z|isES6Pn88i1@40TceN2jQ|HQ~_+GU|vs8bQ9I5d=2IVQnBdOkzx27X>n8
zh)_xpjYx?6z~#bYt|zG6#Rh)@hkTvKbwg&}yD!ALkaZb(n@|AjP*<WzbI9(PaaWD)
z1LWI{QttAU3*^%zMI>M@N>V>Te(d3tOV8)n-*tq$DG7Jaxx0S2_shKtV|Vz>y9wi1
zVCthd3MnFqh!CVILB1P>Bye3${rFKc@2(%VHUTfwKWIhbk<#g|mEnK(&#b#;kvk;W
zU0dP^-bQa}7{}2}xZ@IG9pih~YaJ=<n@*nF8z++xxBXTp&g~3}d8YpEm@qe6)QLnN
zCSh)KtsLyi=21)ooJiz*Bt?YA95GKuh;ivlEIb^B(PO2{z4Id3E=}e(hr%)4?T+bg
z&82*}b(ivlgh_x>hCP2oSjZ9eJRhY|l13~cksl@dW+EB0tkw7weWUK3lw^&S4vHPD
z-d&w$FvROAPt!PzqBNBV<A_2YOp0PxNaRu(2;n9IhxF-Wxag1haBJUlE3ct<=@63)
zxBY+6rLh%s^58zQgs=_0W!uu7sVyzj*vW^>wjf1r+4ceWEv<jc{rySP(320Bb<cj&
z9=E%ozqSqX+a{Z^kDh_6Fu**aaqOc|Wi-NqBNmes1rZe~V<gm?)7N$tHmmi4+=FSr
zxktPJ$pCzWfrn8-lL&c|aE}ub2@W39qkHh-p}XdGP!^h>=xpY^U9ovq!sWJe+THaY
zKjmJU%^)&tnHPU>MX_6*SWP?gnkP%By)q9_F;{#aaKCA0#E!e=+<B{xC<`fDHjOt_
z5GsuCr&+!d&z4Jl?cM1H{L_Nxs{#haq<+gyvsI*%@v^P$VVPT3Ir!A7)xrje)>&{f
zHR{kqtJNhuIA2z?TX50w8RVo@VPCodC4|z|Hj9$ZYnOlF6gcRXGkU8+?G*1MG{(tP
z9^~p)Q=--sEZWDHr;zEhhVR#Yz8{=r_8Dk6luTmY2Xe}6VVE|u`BD~TzR=KPg;xg1
zKQe42FiWLFS^gR19H->@QaV{R?iDOoY{V-V5YAHOCCCds01t!#ia84qC0?2mMqK$2
z3CK2h1)G2TFJ_WE6V|Ng%AWYU`A=bOX`)iK2FwJXJFg%-5RUPgni#t(kT#TXBn5;;
zHA`JDrVEf9@)ab6O(nnOGui9`6}G84am1t(xyO3Opzc=bg>$`m-b=4aZ`5<oX+`^?
zU$C_bVQBpth|`<r=j{(F!oBW<L3EA0F#1d{R?L5{O^b?NqWn)Vz~hxbXqk!8uS4Ej
zRzNlHa2zT@bIjukL)V7IkM=@0q*uOb(NMC5@R_!ly<KPZarDMIW>sX)xMO$gPISiO
zLAwBz+|mBlEqvffcm_N1fV1${zRXnNoqinQ+(%F5lY?`^mO88_lemc#AqkLV+(ksB
zE@FR4iV=?pA=syk^pmmQMY7l4h&y;Pd-tt<udZ=r?&zmfBliG)%8*7$z%WIzCp|>G
zh@zNsj3`T4z*ry&iS`>mNHuWxz}X{Z^Sr6>E=}BC3rI%p)a2ksFe;o=HS~F*M}GaV
zj$2D%SP$>QbW_5EAdOMvB^YGP6fx{kBz=F^CqWpqBuyXHg}G72Y?k>>p36rSCGT*K
z9wp74B+WJcWG(OP={X*}yn~OpT(O}A7z8sdsM*Pgwh;^`Q!Nf{^Y(~P_D%bS`=e$Y
zzt-2<J3JU5^Pv6x(M$Z$UgG9bKbSZa3C^%DC=xOW5%J>~C72R~sh|3sCb8h*LwSFR
zt@J{hZu$QG-nq@!Ih*>ojk@$ZQWk`!H}~6Qoh$}VP3-&WM`z#r$y`t0nN6en)aip5
zAFTWqd2vS_``HF|sbO#JeK>(;5nnplwwKMc{h|E`{pnP&5f0H7XqG}*6`WS%oz@j-
z+tjpavHo_V|M|`xiOZ}$(|6Vq4t9S^$An^+xDo{b3?Rhw5#<acpA(;Wlq4+mcFJx`
zXQgz0kyliO)ttWgWuhd3jyB6~?W68(MXN3J+QtPjaIHYF5EKU4plUjSa_X=m|D@R7
zZWg^7OQ^9+Klnxh?F0}}{JEe?<agc`lz-B9$+E~HazU|qSF~CwjyQGj*XDohb-Lbo
zx?-3`-G~Egd(2}ZO$7=Qh7oZYMob8bm`6MorIbpJA7VD&X)n+J)RgO6+9>SXP`PDW
z8o-*notEIlfq7ji3jM2sD*pD))G6G7%4`2iUg<O&@bBc@d8>p0V8?0JOc!ke<ry*>
zD}QZEIC4do`%G=!{KHNz6D)s;Bu)?^0umTgfoPJXDDhoMXzYdw=Z^)uQxkZas^zgT
z%VW~$_B|PE$DKD-T=%f~hWqaOlyo+DZ^k8qkr1)6qD57zh{|z6q}TKIM|J+L?Tz|%
zyX(IxVDR>D`XayU3OM9-?)nLrF~KNExd#V@i;_6<P~tK_q7g~4jGlkw8KK~U`W89N
z;eR|R4s=lHyWL#v_Ay}{vG&mcr+Buw(jl9Z$$97f^{Mv8AKQ4|bY3~0F`H$PL!L5$
zA9G2lkEolbh_F~7O2QC%ZsbeBn8!u5D-heo&TDTZ)z6Dx1`_8`zI@kkBs8yf0N3jk
zh9Tn-kk6Fo&R>8%+9ZGZwNu%)jM3(nP>FXNQUZOv0X@L(Vq;y+p@Z0B!7z`I$5Mb|
zMiHXY!zjcq2{CqA>iK(27Vu?%&IBY!YUXXX3A0M5U%%(1?V*GXvGWHQ@-$^K!IUA_
zOMufhr6>`UqX2Wt0xzZ_2p$1<|Jrj-<>IrP<x4r~?~f7F=w^QnyL*wB&gnqqK3=*9
zlg?jz>vGz@d4Asgas8FL=DGGxwYB)p&HDc2wP!*OT3+yOal`Nf8&Lb53;YLV1MiR9
zcSs0+_np^{=ph6Y=EiQ~r3`r?jS*p>1~D9=h)RIrgpx}C5f0$)9XU9QkB9KnHj&f^
z-kRh0?t^#FBiDaAYmcYw@svHlDLahQI*5l~Qh_OUk;j4%5zh+{3%vjZ0bw}t1B~5$
zGz%?pE@c51Uk(3Kn!(npg)ZXex(R4$idY}IGvY&X5R?RbRXQ?<=T{5OCMOqH^h&m9
z0Ua1qE^{@Y3daUHk@5mQ?xB}d`BL}cz={cr6Q2u#L@0lJM0}Sb>Ix6|O#&~7T<T)6
z$BgOtrFB!LT*`OPnJEM&O$SHqIcfWiwyFKV?l_Wi8YT=$H}D{Hhd@kt9AOW0pK#Cf
z9wq*|zZ+DJf-Q!23yse(K&vzmbx2!rQaTdii=ET;@oEZ(CbE*wS$4GobBbvt6jx^R
zY(@){Pwjtb$vvdY2PSCD*#qA{*THoVY+HN1;A<5u-g^fsdnwk7K+Ve<|I{n%nwF}`
z|HE$ORzgx!5QMVVe?ug?D%k!~eQ}hZwvnIyzUSq1SaE{7kxTu6AwK}{LdYeei5nsu
zcr+j`c3m%ggwt|x4;}KnR3yN<ijxwE^UX<_l`4NJ{IZZGpb@jh_^IifYDWHiH3Qk>
zzgJly)srvl09Z98lPN^!s*F0#mVf!&In9{@>HhiGm(M3qC75LvgM+vpfa6KLuVy)d
zt~=0C{8FrYVY|b4r?XadqkqoYE6V=u<w%CWqebu#XRX<fhdpd#miiI*7{Vb?1Np>7
z)J=ap<WWk3FiE(dMo)mCW3YlAh^RwKNdun}6ec1;#0w>2X_6v0iW4p(pQZ9h)bY?f
z{%<6Q%g>|((Xqz6QgghkFX}=UHsFgJOGI5?;!{URBv#8AWCGSq2XKkbXeD)ta0NpQ
znt4Gpc4Q5+{n|WlIwj5s1q5M2ByPk}<hg&q&59XfBnS`*I1@n{B%B93<@pA}dKdRQ
zTX%2-nYm%C8ri1Fbpz?M8^Dbg5NckInx{)!tENs#Qwj12WblSTxKJBglY*2hC5W6m
z-8{A+l4J`V(g0&`7&>z2nfOc>z<=@=2%g$tP+1e}YldGneS{`0VLVMj?jo85F(Q9~
z8zAOJE^@KtUg|R%hWH@`PZw`ovKyyiD_;Ix*Y(DUDRYN{D-T)^v@h#tsYA;)M#W|&
z0%}x31?U=A3u$rnu@lTUb<Q*psMFfR<TSd2FwIJB)aEQwpWxRf8Htt=Pd;4M-{>z?
z1$u+L%a%}y`tS}m%li}Pj&tFt958<;A1>AZ>y%1=`claPXl+!D;^f2S%d-AXe`SO;
z=o-+q=}|FXO#4H1^waK6eAYQlhWU)cC=fVKk?TV4&Xh!mhQ5y^@jW<Zq%ZDqqW5pC
z103kxTyEdec|NDJk<&b6i3me5YKu5QBw`rR$fGEbG7dc-$DZI%?KIydecXSybeJ2m
z$m4N-JkFo`aSn&c;4l}Vj6#7ailmf?a2%jmCLVHenuMOm0?Pa+pd}ks=^+(lS0+4;
z5{5*`BqG8OQG&x5v4Hq7WoabD_HlyBZ>Z9Bf09D;UQN|^hEZAHD$iC`KBra2okr-<
z-h&r;aYGB$e(UN(2-PZJrmTM@AmDw@gyQrw>EIN(-`N>drBi*I`0Z}>XJ=r5%@z#O
z+!+IHhXB!JI0g2<Rpp$W(Wa%cZmE7NZCZMEW;DZxTqepq-dW&ZDhD|pagg&<zP#=J
z?_jp1)TJTD0YQW?7ZKl+h{*^ruaR(FlBNOg!@-Y95D(6BI@nTbsak)_y2*;TyG;dr
z1tui2*;Joo&GTdO1UC_sO7rUOFX#XJfBs(!4rh?wDY!7?qMF^d1fA@*xAP3R8^okW
zWZFhfI)}eCCf(ls&^BFg4T@0`Y!@6&)lJoJNI{|SsdFu7OHjQvYiN4wEEQZ6-dhM~
znZuEn(V5~4t)m3)Bx8Slwp_w6fX_zfFI2uDC5zS0C)68LO;@4lVr&0ZzaJ_=LYYC<
zPn97Nft=dLFqG%xCx+{f92E_?-ScpQJ>+8+BSIl*HH#AD5}vp|b(y!rO<*u2-Gw`v
zP6)gq9Y0+mdA7_z#MaY8wQ?@aY6S5+119;-B$iG(qgR03p{0Kc6f=bE%Af_=F15gV
z?)*j0mSsD`u(pw!Pd)UC9Hd^drQ|E%fpRFkyO3qQ5M~*_b>t$=3ohq!Q8jwbUE@76
z>_MFRge578Jt7cEd5V}vDH4(JV@xTI`+DWxYK=3_<TXH)sBs3hMUORXiSCeEBWi|U
zPpG=aO*Wsd65)TmDz1K(pXKbe9=w0B`0!N}a5i7fv_M#cLdV~DEBUKs>HL*uGnRj8
z9#%C!&kA#xT`GI_OT9uy+;o3^{_0~J4c>_=eqMk5S6N->qMSIrcVA=$BqC^E1}2WI
z)E>D`!4pk-@zYEK{SvTYG#)-iuReZ~w`K2z_xQtPyuyFCD+X%eRbJehDtqlP<I_~8
z>1m3B-hQ0P#Z`6Pt?GUE^$!#04-THz#2(!rbvJ%+dVSbfp6ZEy@t53bn|aEiftm-T
z-_d`Q&^ObBUt|T~{#L!6Iw$A^2t~~C&`Iy$>|j;=H+egJT4fSdMXG?r%Q_*1S?298
z7S~sQC3JsMLui^XwZON0xoak!OkvOM@+v&vu#1fjQ$GS!-N06->kLorSO41Uz`u4I
z)epP>BNZRt>Ff04YgvGygkH&yW+N&Wx5!s)CQntWX_GPD>f}ZHL~lkW&Y6qx)bS?W
z<o1Cw1oz4rnu440IQeinIyTBctJ2A;Z<X=4+X8>fJlsCgtJun`(dN|X{;Wo{POH)V
z2?iI8#+@;SAO1)oURRB)^ShG|mz&4gw*KPZT9nRRQ91S;55jWrA+m2w$7;3L&Ak$Y
z+!YYyW2o})57m+SbbGXs(+A?CRi_ToN2{%~uLsqVjn!^d>sAX(2Y)Hk0Q7WDzx?Mv
z{@{P%kvuYRnB+zE$6K?xvP#b3I)#G%`ARN6GFp7>to4tcK8^CCdSxt7p0=wUq@Z!q
zL=NxCSJkyFl#>mH3vXvT)Y36>y!c>d6q%49kx`67MtnqM>Y*e^Lgafcpi%-Jx_A$8
zey#oIsZ-ytdZe~fvy4XB*Rd3`yRmlFq40mkYowIpj@mV@P?_-hwiwe?(5~kBBCB#$
z)M1pV5uHjh5+s;LD2RB3NaV$crlE&?5hXEAWte*6(R8Z1^8*72`~btCN9(9T9W|(<
z2K9tAD1E+yWc=N0Pu*vS%2N+BV~xpCYdUI8N3H3oH66944O-LRA5cp<w9i)(FY<p9
zaQooMM})f)CCp`rC6UXxFH;Wu#d|6%hI8h=I!o;Zdq7>Kt>XbzmJ!V*qAc`@8z490
z5*VgjL_?P#8OTryCQ0PUqvmq-{TzKiN8isDnoF0`>$j@7v{YyPkvXa_NA=~Xz8uw;
zqx$l7)t5tSF)T=YK@);l<U_EI^bvoJJ%QYqC)f=_8Q}0S@ZI4Wc(;qu5UZ^7syAT2
zhYgJOC2=`-DRRS5B7$M8co?EcdLd2Rn0YceVtXGrFnS9l{NCW+v$H?-pz10Rh$%v*
zbTykgY^4yR4xN=bz)7V;TgaorM2Z!t-a1oGgMJlR$!B@FDkP}!8EC=KhkSnlTCi?T
zPnp-KWvGhhi!{4}SKt4h{Q=~|FHW(V$@2FX><=GKud8ZV{%~<ou9m=Ob>5;%cs{?7
z3-s&Ti&v{^mgk=?pmP_iQX=&}s&dqz_33POi%h>!4e*};_TRh=_(j0ru9m7DZ~yx4
zwKYy#wq;db<O-C0QLTyv$`^la1M14N#TCjHDA%>3DD}b!Qx`=k(5sUuKr!_>3S!R_
zq0canrQ*-(^rUWC8>&#{t+}E>%a-TP|H@bOC|5;3bG8Uy&^8nfX;&QhiRE7;WO#s|
zU}#>gDlNm8OFGw<kE}miGf9iZ==cbO;6{3&kRJvYxhWAriKs3S)h&NSs)g17s(IT2
z6ke}-133oLafMlzUzW36k<MkX2A5PH@GyvQh!^=hE2VRruOP$k6<rvh5iF6cDghZ<
zEo1@gb9W)VUp9OJmN^OL!0L^IoUDRKJqoqY^M%TPi{ux$aW!rVQ0Ld@&QJNG%#<Z6
zD=C{P<5RD!&ly#FGar9W(yg;v%oJeRVKAHUC#NN_$2cPAE3jHYe!)?zm4-glS1BgK
z4HAr!So(;B0Y-@%dC2!=6a=9wUAa@-t99n}k2=ukZkKX{El~OIl=-mfvw?q)ZW$d#
z+0I3ca+unAsjLCj$)M%=)%n!v9ST!rOf;v}WME3P3Ssh^e$IdL8b>{+xB75ZiH<uH
z4QK2ww1(TFAPylx@rbi1aU&#YN)Vx72aXepq97$KbYm|L+&%2TFBfJm^qpW$zP1B5
z7vb!7JCkr$7pT*tbF)Hp;0paL*DegRZbsLKb6UtNS_rj+@>JE=UnZ+kC6nu|1M8X`
zpKc}O8Pl;{W_^DU9(Fk#dQ}885CM%j;%)+DCW0XvM=_Ei<q3{CPu%2Tfi>2h*1yW^
zsqDj=hWq?3yv-n@K-t;q`>;XSw=4K%D+xLOpv1<Jz=Ow!xYt1hO*{KJ&g^_YqrI6-
z&bx0<rtN3g$CrDS1@De9mswn8-Fllxf%#YE_+2fkkBWc$!wk-ECn4FmPJU~$MZbql
z2ZN&v+Fn%;)@bTJexMV@4RAt45+f=g`5_B1qFAIz%EV2DPk5NJM{{^Jmr0G;1F}d6
zavHrv6kqi47U>;5$8+YXo-@jOV4jk~oWeb_#BL$|187YN)`8SvD;j-z=(MneBB=D_
z!)3P>;Iw~eigD_4>Ufnk6%5bEV`NAVj6WRHZzWJ;Ta&GIJ*-(P|M+3QYvFLY2YeBR
z*pHDXDMo}O0wq*3L|rBb^Kc}h^da<)UzN$jgq1pPluhbk6_CCLJFbbWhV43>(osk_
zPw$}DAE8(I3YtekBNn9GM}m3~M3Dq2jzo$A;?aLV`f2EU_?wm!#%B5`J3KAfL2HJ6
zRZ8i4e`Q}_%ElS7_Lns7k{;F&A0AqS_|Da;dj*sp#fG(F!&=90U!6QSb5SfJ76$?)
zgiu5hKSk6fK8mCpdr=gVkSBXc5sjCwMu)y>2r|H|joPJPq>9tdaX#5jq8R#i%w5ss
z)a!rnpxj~LR1ThwkWwng!PgWi?qkb5xS?CnB%uLDEaC(akpzhH&_$8wyEw+wPXlqE
zrP3Jl9(%Q{<IVYPu9t)BDIUXa5Cw?)zC<L5I7(u{kfc!%aEyJHKAt?<tbzK3sO3>u
z6H=|XJ7)bTd_GwN`LsDfhDn3V<t(dC*YJOtG>Mod@7)iNBE$AtdQTy?DXqot_A0oC
z7<;sS{g%bphjorT?9CH<zL4CD5s6uV2$MdFWf&t&eC*OB@M!2g{>{_kkdBwncj%pc
zlv`trs_edZ$0oY3<JEDrfP4#A$H9H>B*r93Fk&fB5b;@rVjc^W1l;4P?@1Yi58;1f
z0X0&=>e`>4kdLL;vTw=Da&Yq*#f15;kAesifTwAM5-DROdFaZJ`LW0O_uy=KJFk{~
z()lAI>>H3d`V%)MdhFm^v4CU;^rh4{#c#!Ta^HLN=zh7E59M&db5g`Iaw9|}jSxvA
z7g0(h#3D?6Hzk6{@gbZi#a-s`-i?3!WZWlDL0))*Ch;^18HaV_^E5_8fJEt~6#1!#
zJ%Ym^jnl{Sq#StZ9MG5YeJ!3tuOZJ(FprW1QASckn21pvNf)IF54h(M&MEm8jax@a
z^SA9<*+yVJdRV?8VfP3WdOBvZ!(l;uCgX_tDCROo1g9RNBJmIo1D8n=xvqcPOL%s?
zeU6cDU)j!abg_JEhLYpm@pSHvgDb%-WY~3mlm?6;64D4I31KMlB;!7h;@A~mlX=L8
zoT1Ow22npK=MeUI;z}5nH1QCLiH~UHGZYF*BN|ffvF)LjhCZUr;--l>ocyya3P@x*
znnQNGOtMtWGsOTR7Xm4tQ$v4TBb>9dw$7%qvomvytDKJ72JGC}sVymRap;_vTc!iQ
z&Tr&r@OLeAgOJq-L-JuavD6c$+ms94l>YFXzyJO655H%B_!&4`oOxbI;Bxu>#d2>x
zm$H&e#BP!L|J4cx<6@;8H5FY5)Qk`i;b?9bFl<z}6X)Uc<|<)rgPnilV7s2mAR!5W
za4<^{fdrZ?5CY-Aqh3S^ru``9W2W50vuUYaYi*J?!NaS16*{NSX0!Zea<5dmJYSUg
zOeb0$rpv7g%0JcCpK`^N8>v22vJ$L#dC~BF)O0iN3c4tPXi5XDr_MXMpo_{;&As>|
z<al*{&dO@y++@`?oC$x>XZ5S*qA-~n&3;p%WOp4g?dbr`_`+u^^<Fo{W_!j>?#y-j
zMklRRt!m%X!!n~4oTIcTGN9$DlmDtzxAXk7bjpg(B%EmQ;_TL8MNWl7RatUT6);!`
z4z*k7M$%7Gr7Sk>UqfW1Rzx%Rs#$-LRNYM$6P^IS1}2CD%MpKZgAmbB5G1HeqExy#
zghOWsf+MvI2P@8bS4iLu8L>VqdB-_j%EI|S|6I_;YDR&B?e7!do-qqa-!Ao4&|OBi
z8`ng8A#5|<4W*4<#)|nyXLE+@Catf=rg!j{1J28}9OxsHpohYm14^WHF`<Y8JsOF;
z0MQVqNJuGwREB@1(V@`v>#e?YK35ab4!XSnbwG;0d(FsqN8Ai>YL;oX5ON8dLYHEG
zu3)iF8;wm7(7@FUhJ8V^nE?aNWaV5H6pWCaRq$i`GrhWUE}c2-qzse`d1|2*y6R+B
zF7ireRO%+uos1;c)pRv$QtQ@_KI;(SG^^~Z6WsJP;qG$lA`P2=Vw_8dWedAl82QP>
zjCBDjr1iA&<5YRc>5LYqFbj6IbGxL8BJf-PtlgQ(!~v;E)m``If9Ki4`IIfhCEShq
z3Jy&uW#Z(EwncrEg4L1tC%psc<bxUnI+G<g^xEAqnmTwgV76%bPD}p1<K}50=|)<e
zQo`-?Gi7pS{qVkj`K6IhdqZzz)mg5`fX!A?qvQXs<0Xf>>fz#(lEjN;A`ywDKt$je
z#en1Do|{VSML~e&ZqC>?Z7M8~Zchz!o-JFQoxQDBeeG0(68MHAc3eQ(EbmxEeyS2^
z2hanWh7BC6H`f`zZVLxj-aId>`jV?=xB4t^ab&xCQAh57yFZ$>Zh`oNAmtJ#$io;T
zBHR$gf#;%_5h;a8sRY=^{e=#8+s=`)E5eCx@@lq}T4!g^Wu-B5jX2Uyks1#@#N$&m
zbxdmV>~HN%)H9%`L{S?z`e-8nsvqk)qTpcHO;GH!v@CO;QFvOf0n?5HPs_7~&;!yD
zNW9SXaTFteM!X0S=J|+nijn6gal+h$5OFA4s!eWa*fIAOOQw6sB`}G-t#lVW^3f!Y
zr<69{5-z$O{OvH&?P7~{!^5G}JeOkMOHiB!9wGtvQ0%523Pl<Q-1SKq`A=VEIMCiS
z=d0GK)sLxWseB?^_N(vMPU;)jF-kL_r98F2x~64+KLP1<_{G>8P14b6|Kr%xb+(>q
z@00cHI=(tBfnAQAJ9_A+-AS8TMUJx9nT+%U)N>;>=weSkT=wd*pV4($&zQ=c_a~OD
z0dcu)Yc{6d`OZRh_i*^xL-Wl9;_l>^^A2_uV3rcjWQZaj6GRe0P>fxUL=ps1=&>M7
zc4B*f=@~%R7>_$9;WXzfxD@h5UurIwl4q$w2U-ag)>v81Wif?Q+`I%#)5>z2H3aj@
zp|cPUg)LEL<>B2rRD7ljE(J2_6mK<E|847psvS6eL0fmM8ML9nH4S1<@Hj+-6O0HK
z0x^miL>I|4jy+7h=qbq7@Yr29X!pRo{FbkO$Q^}R{2dClWo5KL_@jF$DW~GIt1BRe
zZ=U}pU&z+R(|y4#U0qhDZD{jc=<gWipTKfqtl-y@R&%<1ZJpm&g_MgoQu)IHJ970-
zeu2gRpa0nUIA7$8>TPop0}fgJW*&Z>m&&iIE6l4ZpTjA=i?n_?&H^gDR8oQj7Z{O$
zfJj7%AczHC6!17qMe^|K^l-DAvrVUo7&(-cDWkDd98{YArjLrFH2v*L)9$8oyE12q
zqYsjA;~YOq*CS^)IoR19cpMV}mX!qfW<p621*3JuL*cm|b$yRM2BIxmmrF0Gt-GUu
z52WD;4+?BcSi)%Pr6?6aiipcX6#F56V1V2pjfEts=tV6Z;Xhvq{-cmI_k;he0S#&>
zWs{_hK}7?vN%mRxpg%RxN9l_f>MduMmDSXFwx~e02E$WrLQJ!naj2*VCmp;`AL|G5
zO`0uq8}81ab{DwkCm7jc4sudy>ev3WvdU&NXCb9}ej#jp6g;g$Ahmq82Gmr4qg$5C
zB3~BZ^4SW|qY4=6m!TU(VeB)+xr`8T!vMu`m?A7_<V!E$G7j(MThnXk5db|(>{GSf
zf#=x@v}2}hSHzC0e}LEtlO*;qBZwwoa|t*{lzAx%am0Nd2Vv4b@}8LaU5&;QMdftm
z{$>Gub-DitwK+m<zEP;n*0dUb!B&#uh@99>S0U3tMkzxv0eWCRVTh5`M+w7>xg?Ph
zVF!fYC}>AVwmC5TX7nby8+~&xjE1Ui2%QPSgwTj%<VqO;)}A0LJ%+r{7jB$z!iYS?
z^?nHG%(xJEK<Lb&26z+%6G|T^5%G`@!%e6NP{I<5LO&!v4ic8q^cw(w!ECze9}eg8
z^zZN^c4a5*%Hg0Zk}@7+@U3A9{ENavl({~l0ZmC1r>@K6Z&r4Gbacv7-DpQ6`L}B%
z|Ms1mN2B=25gr|mLN^RumeLT3I2DNaafGPv6XY_Ey@>j0DBQ1U6!$~4$t12%$%izF
zM<Q^EOejjjC`BZoA!5{jWhf+x=aZOoH$Fzh-p-_Q1H)m0=;2M`Kr`~B0%BY9xFu|;
z==Gja{QX;+f;(O_{(?QcF=m6ZwyI`%{%K!qljf8_B~2yLq{0YlP$BB=WB;@&CCYV8
z_Os>Wfnsp)w7~yKtUy~dM1pE;t#)Y-Lg{e2aM<mVmZcRS`=e8T=-Axr?CKh+@CwbP
zZHL#cF}lMlx+{p52;%Y}#0bmCM+EZ#vCzfH_hk}bEaRAyU6gXQavvy$)>?48N6y}1
zX;($>5*<4n+<~b*A-*TmG(|~@eMCe=P#ncB!XA?`^8}7k`jyoM-ESq@Zv?x4HETNz
z^FV`WzI>`Uo1VRYy|Y$+i;=C}Q(+{qwKGD;xYmOi+q(n*6~kJwC#WlYA4w8Lh(w7%
zOb8z(0c9=~5sw0XAG>;|qsFX$zo^!(baTI8)*Y?A!@Ff@O~*K-o{S^J0JTCm2TrEY
zM_fuqX&f@2-~(LT2aZGS4C*6=pF*AJele))CS=t59&w+4Fh+nx46N@sASelv5cwh%
z*u{)tKYS9__j_Ib_cOrnb*(?q_|aZpjsc_(96%~ukzmgiNQNv$Bw{XHB_0@asONgZ
zi^7KwLwVetb$>(rH@e}zV_ST0@Ta{QI$!{3zot=he82jmJ^pBqe}oWFmvWJ~K1Vzu
z0U|Vr5yM1(B7t$tY2c@+^uIbtUCG8@3!}~xKfxiED5Nn%BmsL;;4(yg%7kDdN!byj
z{v-_Y4-8T7ppukQ)9017Xer;T#z@gM#gCcb%heL-D@Tp++NiF<?I<tMYN7u$26bh3
zH-`3vrLpS?g2E&TfEX!333e%pLJ>+YO#Fo5$=ytUl)skROs@OtRA5t8837w2sMX?z
zE<m}f(+Vnk`kdZ6H?$}KrCuqpI=X@TO%(%)dbY6Qu7Ra98S;?&65&`%L?SSe$1*}8
zb#W96;YP}3xVNT#NL2cWiTqGl^mbNuHjj@Z(IYORNCX6VfC3}}sG35WK=PoFaq5Lc
z#V0*~X*vFDgVA>p>z@w7=4c*2n#aFE^Y|k}(J}K}7KR*Q><UDfFAyV9ic+5v4|7gw
z8XwwZem^Aon92Nc0O-T(W@s@_Md11Yc2OV`fk+?{ln5*k7Xb+|_E^l*1Ki^WhMynQ
zVt$}e9W{HCl%+I|LPR1UF6BN$u`4BVIl(M{i9Ig4_%_Vm4~IM7>$?8>R=A_tdtctf
z16sZP6ps85#TbB#E;vw`A0aA58b)5|6F2#mrRA?~^?pM8?P&ErTD^}b^zRsjE&~}6
z4(X9;7$Fi!iXgHGC6VVxKJlcl(q?=;6nca<*t{PegpRo@d@rJid#Q^EgD70j#VGK9
zd5mKg_>A;bA8*rb_e)+$mgk>TCc5U%Q@w3sI;6<jOn+G==e5pwr!w$+^`6sOp^fPn
z<KNW=XvFi`j4n(0L;XkBG~M#b!IOFM!#`o{`(gN_vOXK*acf4d#ADgK|Ao$%KN=%)
ztJi4VWnT#T%LRj;wwQ8d!Mz)CT_<pV(@EKC!GNtQiw}-2Zg1%A*_p#6r>j!Q6HOjA
zNK(`{oS&VkPMn>!V#nzc+`!r53YFP>HEUTrdn|KRL7{PuPRS$1<lH$s(^|Gxk085T
zrtnXFbxfJG>y-2+WBrA(XgfmZw9XbvIx6K%zo{UgKRRb;W*UTCSoJ{rnxCY9^E>#;
zq_qR{K6IfSB|~RQ7rm5E(|$4PB0f8F;Dpd3U`>l^fu##sF7rj1v6+Ms__aI2*2tC)
z&*#!$R{^e7_x+@F@|%S-Hv{{>SBp<N=Ukl}ue4kj&PDSV5N=;f=SDK;R3-2;1;F|R
zguQZlz>d?Wm`eQZ{L5U>^7==A_2$``9k0*~qx!ND>EL@6XJCG<id6{{0;d7x>gQ99
zn<#Tf{aB}GgpST{fq_RosOpCyQXxLujnUcJ8t$E`^QSNTTET*KWiXMaRh^D(;uJa`
z85HvJwV7!BVs7FG8YjwyS#r9U8LajyL*<gr8`Hzt*|~DgR4N5y?v%@ayfOg|dA($7
zH$>YPSc1TfsYQLW@~?}0b#>j$1E&jNLQr7C8`Z&tJwQ{}vJaiUd-lhlCt9tz)3fvf
zn11UOqZ<y>+1Yc(Xr-1CBp1<97HxM_8naS1JBwvkSF)_Ecn#-@E(h@#_T^dMt1x9F
zIn5ZBv7h=V^?_oSB>{?m10JB*cca*sF=gC4l$Mt-+YJbtn9J;Qcb;hF+`xQ}9UM)n
z%}(URv>m|m8b&Ek;X_u8l$y84n4&~>SRv^r0S7^zntU%E+ZKe#C{AVIraB*}fn6<7
z{qQ_1WJk#}S5HIOY3YhKh-ZZN)A@(X79s@0)ZPsP`p@ngL$1(&T@*}>H9{I_G_Gad
zOUbO)rcPe1u~qsJ$8qk==&`=nI}ggV_vEx~#a%eHX+3!G0UrKA{XXqOGbdJ=@W3gE
zNE3A`56AGeEb1|7L0h8}FzpQD8Yh>zsbQj5^HWo}-Jtrv_IB^QlBM-a-RkNAwfeHY
zQ1yl?P>t6|aG2kJp3dnf`LUGM$1FWH18G06SD?P)ruDGsFHL=SHb{N(WBrQVxOHRN
zW9uG_$sZiNW+A_p1qX5J(oypC>G0h%$Hn*@I~SdqnL2K>3aWew$e-4f-@ZKr+%@e#
z`Ea>rebnLWri?m%y{WkY<XJKugvj?R??Cr{*FI5qy7Rk#nrrJBZB+TLg5?jKtbI5M
z_sZaK5EI38eLJP|yFvTNR_)WI=1NV6DVx(T|M`zUczAPzw>7D#v8T)HQCf9S)2n>>
zlP$6IyZ07|*UKv7+N{y*p{tA{a#6`*V=4brTRHk~?=~lM`X!sM=5MpBg~|o7sGet6
z8LSJn63owkFA6PYHoti=asT;`i(JT;;zcHBVok^N^0uF8n_bc3N><~)sR4dfz)4fD
z{W@8d_3gX->T0GoPfBMc>}$<w|4T09Tf-`iVF6rcpJn;i+Hw>8eXaBgLL*$NdSleC
ziAcI(LOm4Ym?FYhisDd86fhZtE)Nr&9t@D5FZ&XIJACYjt=bP=j*FtXQeoB$xFcqR
zfsnhGxa#~RyRsfAl)j@`Sc`mdbto<9C>0;2;zyT?wfO`Dh39Hh9tGli3B>*3d;+pC
z-clAehGO0BlMk1}m2nh>kD~BV6h4Z=--RgLIqo_#F_wb*Zr~#qONxjf62+KP6v=>!
zB#}vf9Jg^zYjCBH>G>U)sQ;zuoU&CvsJmALsUORLAnNl75s`)na{nR5D3fs@UD}VB
z-+;_?Ucdx9zo>j)pXKR`Unb7m6`N-zXc%o|jqQ;{2n|AVD$2IX7~!0qZLaa`%vs6;
zl+YH@shlPqW?|)ax!VV-WdP-%Fx3|l+&wyf71lNV4DB&tuTw`EtD!20RW*9g*_l#|
zz`+Rj|Ct%asq^cbpLMgUit_8Zc6=FE#zQVe<;fp{PhH<Z&QJOB_F$+BpLxU=oT514
z5)oI1h;hzP!X?8=;8W`L38;^#f<vPUM)ry(JS^KC^Wa%t?%cE89oyZg;M70RR^7ON
zQSEKIX_MaR`Fveud688aI4+grSq*gs4T1i4Ee_Rcku9!(c8;%#LOHs+_7;e=V<xap
z(eGKNi@xJCtxYJXnV#!m+807R>;(k!yhuby5+Ejm0HvHHGGN@5Vkah>wJWSQzo-+6
zr9%y2w%dhh%s7LfJf-@U>mu^Ds^5x#f9TccoWdF~OJZ6t5$%#Roi@*b^GvOXsq?H^
z4wEK~FL&noA_LNTy%O6<KW+3<bFUNs%pmN{X_rO4=7C(tQ38{*F#S;lH;aE5|7T6P
z9#NQZbtGGv08&rL#7j_^`W_-UN)W}qi#SWeIN@%<yobj!tMEJ<(X5-@?X5k3Im4+s
z-#WT)o-M#@;#{^oY&L*-19zKU2>r5kAzf0pjd6xQ&GMCawp@;R(Y3=>Suqsa1(t+z
z-!=m=;?Hh>G^U~|FDp1oPEVJ#DCI}kuBUJ4jjHiEt>|QO-hF8@Z9f|;KYV?;TS?ZN
zBc?31DL<P1_3_0onw%p`Py6kE*XA3q@n~CvQhTDIsP?tD^+sx58SjmP@4+rMMj_oI
zwejz6kNa5df#c}z=HSO_PCa42zWMp<P1>(-ejaU<K8L?vyV`qTWJzr`V(uf2m~PUx
z<K;fic-@<k6J9W9y?Gq2OZBZjyz6ftf@RYzLM<3fPCi^V9Gm^4Zi**=@Pd{)*F9dJ
zL*`*6nXY@*oDt^HrXjz+`FTS-^m^>SV~H~BUv1V+w<qKE*{i?%{KmR^D|Ct{jzz)L
z%sVal_YSI<Wea(jfNSMs=xx}3+_i<D7#3hJ+2MPCETI46Z(8fO_hPQL^7vcbJ+((m
zVM+F0Tds=b?5_H(rP+Ib{Z@j9@6L+X7oh83UqEO3j#fTojI}jAOU+R#fGzsFEOgx<
zU?}mZi%8%D1#IXd5A1viC4%i1)V`In^&Kd6+eU6%^T2MADsn^tV~o-yO%p_uKp>I?
z6j4Gr3K`*4#&JwN^1!nI4gfhychjR8*thJO3F)=QhfEzf0B5p)l49z-pxI2tYxEg!
zmPO8GSt_$fMJoV|*NUONtQB;)CM05cRn6o=Dq@_%0bZS=+;hU9((xI?A?6Vdkxx9p
z*mx4L*rh1(FiVMuc_5O<kFMWaW$x;n&iAf#nl>6)sZ;5tekM!5mfktFh%)PIPJg|*
zUG8JFt8?9N(<=Ob7_G8JiESG7z*=Z`2GyngHCxrysk)7`g_5ti$n24`1+}l)rjc<Q
z5#`zz!k@3IYgs7ORsYvJNJq|_f4J<tw~^vw?ET*kz4f@NqjM0c@l(;n3OMlhJw>x+
zCJ*M_Ohh6gmr&#f5krJ>A2H4%<oh9Zh0lE#$4^c|P?DQ}g6Jy2M@NfUzu!k(=<P+d
z1$!4V_{$36Tsj+WcKwWsd9gOOYVM`8?zQvYqt>f0#pM=ny%f`dM6<<fy=ER(iqXSe
zkJ+W;CA}j}wKH4jP$Ar$Vs7)7x^gBP&zz>2y%C)Jb`G9>)rLc!CT^IdICVL4Qx}}F
zDMLvZNE8QuIP(1zyK$7<PeZ)WU%k%DOn>!yjbit%$iR92KV=~@UhStcZdaM5zw1g(
zowX|2xa&L0{7*AU7n5E#lI#4YbId7^>s3L)GcQ)kuU_eXb#%$bN2}wA_fR5rspzw5
z`G_j%i!>%KlZd+vBO*c<#nO+F?}pSTl*DW|K3f2P!l|(=^<e5~@9rFo*jx0xsW>~`
zcFK(jMkmN?oYC+gWWR$zYaO}+bKJX98ZL=b<JNAy-4o|?Ms*9@$*!lX8F|Ql2z@Lv
zwo-5`MbMyd7=@fmk+n1s%N#}`qcdlz!ip5A>=09zFOhM(k4&3%WfF!dL2gPQb7>Tz
zB;p}|k{*ttlw%e@LN>YW?)SVf-z?338@uuA6*{={)izO-%?G>t^==-M008T#<F7Yd
zi{_!JGZX-}x=ghQ;8?G}6qj4Q3Gv^ZqiEA>f7avnMwY8tb>2O}w!3pX?;LO3Ezj6P
z-n*elv0#yh(nK&s2;hc;kRsxTN#eP}O%nEh2)le)<9`ee4o>v-Li}zUbsJTAR8HSt
zOy6af!e)PYhfbiM*;_(~IID*iso$Sil8th1HrxIEi5mNp53Nq1J2Vpi-Ydotvg_{r
z9wqU6#gO;?n)?Qi-^GIGhKFOpgJxy3s)gq7FSyiaVePgEIA?^qD2ZYpawnvSrJjp_
zgcONKQkQxV>u`8S(@1cJkw0I6i-z)RwZ^-ITT1RU{b-=NMx3l;hSR*5I<Vjkh)@T*
zmCj$Eze0V=<z<nl*$f;}CP#ygN7e<^Jk3U@xKPT(g|aL+fyEQe-qh$ddc0r!VxPU5
zva2USL3FWm+8-I`ch2RAGwZ@gb(x`mWoxLXbmu1L&NC%{>rx?0bvmP04y}jnMg>(X
zcy(6RIU}msZ99gvG{d-7Djra&_g0t5_FZF;N5o^7lGx=*geZ>#L|Et{8ixV}F7tgB
z&{&2CGk@ub$Q~|wboKPHv$b|&R>4HCC$%utqTFgd0a{x%{7YpaP|FnqW|u90(VSac
z!VlqKa}I5rnmVsNz0vhP->RtYD?R(xXg&3K)o!3ox3o8MORJlE9R}4pyX<Sa+e!<<
zs~5>@vl=d){W-AKa21&+>c&h>(tv-@s%sPZ+rahK5NJ&rV@dPm9SQqjCgBL&_<WO}
z4_4BW&Nn_>=jR&@Q8&X0n`R?_0<SaH3XAv8@M~`g!O;G*!XBNk3*NR}!0m*;=526x
ze=S(C*;Ov`6`RS^Zq{rwPX<zHy$a*+jYMz{s!-zGol)G~&H{eUWRZXsVeu6;tsAVD
zF38V*w6>{PxIFu3ZDVT@i1u&F3a5V>2mvP_F8iGwdrpxk4d>*02lU;4OTrzQ`+=m3
z$0gm(60P4T!}k+uHxTo<YZ#U4gXj?bNWNY-^!fOWcS4=p-*_Je=h4IJf)IrHfP7=a
zQ}eLAV|VtiHIv<&o@^^!cSm)^;tj9)-9rW%E@C)kh_EO`2~K?kUNz$3khn2>2(?$Y
zv1M)V@=>jK!C=MvS=0A_*6J$!-MV2$A_1E)!KouZOHiN{v2S%PZ}r>RA_G6ktafZ^
z-`d@wvt3T_KIyE9RBduaIWHHAfE&aaol_}an8e04t-;iMeyc7@tur^nRNKg*5kg7;
z0Go?fhYmNR$mBKsoaL)xFFm#{MnOMDbyzR)xf>CVu$x4P@H9q$jB$zlFqOoU0Z-kB
zHU73qUACC?-fGbaC})MFqBq^oU#STN$c%JuXz9@LiF|M~@)09?#E5=9jA$3FXFz=S
zw_Z&9jL};Za{fwXZF(stlWG4L+^P-F_2GP5SGq{^^B38I&R(dywe}!RyQlEpMR$v-
zi|u~9wIOMJ1^RY>cszTMdaK(DN8>Yp$?Grf1Zj?6bi=V3O!RaV-Z`)tsH#4$u@o3m
z@46na74({85fba+ZJrrvqVxWw6<$m;Pd;1@THbL>DWc<Ajqi1*wN=zEu#ZRG{!ZQg
zL6sG9p!7|5Xl3^o^n3E!K*&#`C`pLtq2T{#?@g2BMzS=QemVqGe<y501tz?-J>te;
z#+@{zR3x7wiBq&8iId}yr^Q%KxK}1G>N6*GzyOma8KENbNaVSKIGJm+jJjbM51G7<
z6ic6gVhJhTzF>wWK<CJdb^vlE1||T^WTG52?}Jkbew`OUsU(Uyn?rgg***|YrzP0(
z;QS!QuW;D|wY2gAf7MB*v?HAKI9wOt5!&RWeJq8f31%haq~1oXlrlS^kqAhX@QBbX
zjv>~Tkt|L_H%+6^=6BUX;JW&Jyh@|ycZ|T5;2);@y^+VIKC=!)o}|(XjfCe(x+FD^
z8`+Wqo25};M<k3wACd(IBuXQXh#=v1>QR;rl}Vq1ElGaje?Fm~Gb=|u4K8Y&1!L&D
z?W>3H_e-t>tNQDWb?wFpzT*&VM&t3=gER;`ad!%%yZ1pJH*fN#A)>S$novaO*YD8s
z*G*@$iJhjmthSTWn3Jz9#lus-J$Xh2r)KQP0`ujwz-%tJdGZIf%qt;^+wsV#*2nxP
z8m~>#qa4C_f832d-;bPt1ZlzubpuLbFA^lN6E|cTPZP&IG~PQLsmCr=ACA)lC*%Go
zJ=9!pWAq3ZO*}VENfHW5XqY4<agvy1)bV*1iolK2dzh{Jil*BJ#lN~>x)ze(6ieq&
zHxwStNFpdD)OSL{MCg$;rC}H_8fW5QsgHIK%EIn{f0mf*39xbux&B-s*T+EX!vtCn
z5A#FDd$GXr9XE7{h+Uu1$i^fH4zUB43E_sR?FL`Q0rL5SI{SyqF{bkv(|NefeV-wn
zS>`#hU?hP|-c$hPq3}~;2R>sw$!Os7Ljyes78<(ZD8JoPl<fayUA(ula=}G)b|}E!
z>E!#Se*kp(nQ{!eQOmDGn>r*XHSkzvS{7M8UxSBOQ)+jyo=E`B67YlZwfbnnd53N$
z<;QdDStFyaY6}xO!V49KQCkTEJ+Dd|Usm}Xyc~=U=@kRNK%DH3pEed#MiNPxb*u(5
zxJZrRC4=;nZ5Ph1CuLFR&_;U6in&aNIWcHWe`)<~%_=Z26w;&as?2eK>)v6$O-uc6
z>*768BRPSGdEj|bY=?wKF()*QB9cUIM%=*8Qag*eXS-h>9+soK#eEGEezwoFUm}JK
z3LFx(xNhaa_I0Xzjb!xNndsuNWbn{`Pf#uFOMZAiYT?6E3*NCWH#m!_uHDVi>%d-3
zf16_4Q1NS8PRha>c6?&(^n0gWw4Rr#RMV-B8Rz(oeo;n9*lc3yja1LuU)M2kI`Qed
zZ#@Y9wm{0fAP$M5Qpcmdn<hj=0VOoE9TEkuM|>yq1arJ3Ne1e&<IVET-Ym1-Nji>~
z(D4%bB$trdQZIgb`L09WJxZ9?jrE0Se=bX2pAB`RPxGp7ItSPbE5`_H8D8D1SY?n#
zZ8=`V-Of$e{M~zTT@MQUYQH_3Zt%@INm(Q2Wp%BZ9P~rwuWlQYaJZ`2^}B^A=FMfl
zsbBlW-=0B&>NXj9|DpU0otV7+hOPDCm&k&DEsbEO(-dt7((=6_vK{8G_36hOfBgxZ
zD{Z7Zg2L{1ecO-6<l@2_Mx+CX+oxzRKK*7Uo^Ac#;GGS1oxHtJY(>_uC%AO`QPSJ0
zH6yYIBV)v4_rLq-UcJS=dN}^~>S*m9$kBT5SmS$XZevvN=c7NGK)fR-@x-NW=GhKO
z<18f9ft(vG^oZ?6K(y&cf{8;bfB%Sb`mV%PE<R|Z_vs5(y~m^buO*mA&o;SV?x^iU
zr3qSMWjp<}kp;Jwta>lFB)4H!fsHCv)VcLDQXlm?q}5bxQI|+FlnAR~??qv;byF@O
zTQ`Q1Vug?8PpE~t5_OZ$JATee)T^?nfdT2+>w!an8Rx3{ih4wJM8*k~e;y(76TtI#
zUF2{*N=0P3ZqgFmp6c}qUX!M0R@5t2i6Xt$PQI1ZRO`A+kGcD5f>9%CuqG62VMLS6
z2_52lkSrBcZHb%MB+OFZ_F|s7-d^ObyUa98({;ttYwN1+uPmkeyyHSr93QBpoxxgw
zf1JVC!=R#amzk|f#cX|UfBhw&UoNBr`iDya>XNaSz>~59`Wvjb`=hMDfj3>Sy3Vs)
z;6y{HMKK?$VWsb|V(wCWJr<lE_;8J0B^%c9PJZml8R9?x=l?DBQKlC=jKhEa&;Nx_
zU$^eD>jw6cwPcGt&C7NDpa1iJo!w%cwUau@5bSuN7kMP0UO=epe|RL0TuMSWqb^N?
z(2ebTm9<B@aAU*D^P!6#I9cl9m%HXfkH6B{chz)$y0391Nuty-X_mEFSKF;yoNG84
zHuyQ19ImEdy%YEQFmcSQ3N$`VE}*j;YB>KBzAJe5a$C*viinRZ7$dO|5a3{47<Kl=
z9`(jKIK1_uV$DG_e+3_nH~Xx$qaxNtTlL=|c1ii2?#EZQheqQz!*24E?MLak&F{6p
z+Q661Xmdh8q4)aZ`U0e}u{PS7^<|IQ^lPqs4UUm5Z+Tjj!gIIP>Z&m1k@t?g>L07q
z13NhAvkb&EKYC_4Gka527p9OqDhj%9>|FbP+e7n*v#pD<f8W8GE;yU$=<ox#s+ijz
z9Cg7rVwpqgg2N;Ux#I*R0rGk(Xh0%|bHW3UGS3mA7sQ|TenOP65wR$obgu4*hY$ZW
zKbJU2UiSbZn2L#k`@L5<udNff@Kpd?28?ef$E)mkl^w6L!(U~i8{y(&aCt~os1zim
z)^bC+-VKfTf3#ndsZN#^byjIp3ivnk`rgovu479x9av~}*k&tzEU}@P;lOSdN<hM@
zm40(}+Y26kOuLcpB{=&kL4@|^Rein~c3>y4(N=l{9oq%lLn4ldWlj=jHi=_DB{cOT
z632l}A`!%C5C?V~h5P2ract|AE8PkdJuP^jNk%!KfBD`)b+V1o?Uk$C@CH29W!5r%
zE9$OM=<O8k*F;_&gLtjaATHaz0u8PV$w=8Eg@`NVptTZJDvAbN^rk{_Rt6<|iPYn$
z<-vcEDzD#L%9&v=8aD0dS+2;+-NqyyMw}&}sI_B}5*i4XFd-<(Tt5(A5T%^^_v>je
z$uB;hf47@x+J<4&CTDPREtj0~z}lTc`bGw6<H*`Tx_oE<xUYiOZFaL4!|%tT>lRGp
z{b}zpqi^Ea#;#7Sa#Xr(C*~eB_wH49MqPCL+mfk!@NS==8=S+=BzHHEa8Iys4~y?c
z!aeLiSYU@2f-?3FNUw23EHxx857tC^WW(M(e-KC0?iSPTa4PPX@R#1JX}7mvKAnko
zv>JD18NPuW8LFS{%0>KnNrtCE%E+o5h=BPqrzEt6Lnx1Yl87WBL6W#0cYW^i_;zsg
zS;6zGoUhqpfJ_gANb|1x9yn#3R|0~4zY=(=x_xi(RMtNUPgx+Mj5D8bZu^ABf|Do|
ze=czXN<A9;UL1%|2v6l;ZkxZa2&O)kpYi*`sRy8-Jwo04hq`KQ?um5=rM_^mt9si*
zyXv<i-2I}Gz#QT35$+xu?rP98g1b=|W!&*Gj5LId<(wq36B9e3iC_V9BJgwC8}2?U
znu?LKnjaqOn&4JpBHh;EQEjj0FBI2ee=o~wz75$%A@iNcp(KRpF6s)8Fu`0x9WO|u
zAm(1oKNqr{oWswEY*kN=*!GBRzW_Dv*421KxA%c=)sP?6xkr4vt2$Tj(l1P*dq-{S
zy(XSR-SGhs?g;*jFs>H~o-&#cMs1H!M?@q_-Gqdx?Z>`|y(DCZz_@EX*bf47e+M-l
z7Ui})>{CE=h<OhJO!aq6AXDE>>?HLQ5(=LZ%6yonC?pXJy?{lj>&4+GL8jZrdLJ};
zq^LPk)Ep^lJ~<RN6}xgP@0o8)l>!JU|Fr=)9#dW2sKL||aEMI9p$xU&1q6K^$+Zrl
z)f?Ze<2<>-O&#tE;&CbnwOvXgf5@m6M}FeEX%f=VzXj;&xE6GFIj}oqnw$?kb`OGp
zAf1mHQ7j=&cM+?bc?$C&<yTor$LljAn)-H3iCZ(~68-TzWzKzB&7X@av5*$dS^Kxl
z*C+EB8Ejeil{Qzq^Wq1zbxnXXoAWsFQbFR-foRnvA+g6HINHx_mbu&>e=efWlQmZ^
zj@u{A)tTvVGWo=89--ZleelRWcy}$QdAP}Rtnhzu?Ddbv?%7tPcf)zQBTwOu0I^NB
zDqA~wdogU@ct`fYct;=czn;im>C~!bA18CKPBJDQk?HMh>x20@2tuXN5ux6MEk^Lv
zv28Abl!0@lO(^9dVWHy_e@bKKMX`uQ#10QnVK4nI&?$DP#irXqDSUYE7;As{Jg^kI
zz73TIq3wrh$VqCmj8HH1NaA{oP}_F0Bo#c0qHhD09%1N_1p7#W{V8GS;4s_~hu(OE
z-Zv5*bzlmLj?VQX7X6%lo<}VDiL|ACKrx1*NgQS&cZuV>oKV1{e@VttBAmd<l8jNC
z2DgBs^7dC`YC3VqvaFk3z~?0PG%AKre8~ie__3pGgZIFgE9%CQdg`6I0ymqA+q8dO
zj8QE=MQ3P7P94p+Q?Kil<f@n%v=wc_6*y*BB@AB97S;;)h}0SHm{srwcUL*^Q_<&P
z95b8QghifDs2$lPfAM2RLN7?{i1Emd?>W4uCqVR9$L1U=_Y^UsGv96Fd6(~?%Au=F
zrVHJPz71bBiaz5PJF&&hZp#(-g=Y&iVnp_%*zZt>sUm94krIWptkhc>uMu7hYLPhO
z8)rSa(`Eh1!jFS5$I93prkd|X9i)^-UKDziP><P!0ta)<e|bV!KxrC^)VE`H&>M3q
z3EMc~w7y|(P}~eJ&(@I&S>o^l>*`c;yGn(dUc-f2i*#M(&9%iK%WeTK>?vEWSUxZ6
zbL)+yFRm?d#TIK>OPOshx~j@~#g<E9i7bQb?@In|<l6;uQuNijZZBNvadaD_9}Zic
zFE`(l5sL#6f7=-e13x3wPHhs=Fd&|t#v!L(>bdu;U(xd=d)NUBjI`J|N!yKdy<2a`
zOK)?KslEeux=-ZGcfJG0SI|u$KyHyY`Em;yINmJBo8^<=EW<-+aKEr5pixR0p(zar
zO+$~wL1vRMqG_C@B8vlHVt<RRmIcoxaQJ&(=SjZEf17K40V`+%e9ID^utZ+Ll9OED
zL3#bBf2`T!=Mo>nu`OT6Q_lDR%)4$8%W*7XJ^ib^mQ196Cr&g4x&ByIyc<}<i<w5L
za492Unxup#K|mM{9l|r=MQ)e~?(UxJ)S5^$Z{DvOgUM4u{x2cK{1cDvh9z);U7?{x
z7m~(+e}1CU2M@Nl_~3yd#J0Ng66h<Id6Cym#hOyuZf>@TblFnPJgM1&&Ee_<)w-s9
z-Pyzf6+pP3=9QK8{Iyi7#5O-e*VD4nZo%K(_d0bjMAO`9uu5TW0M}PJ?&v-bn{avN
zyM)=?B{Ys1iTzBF(2lYo<cZJtQ03unyW;;^e>Ng1%lChV4boopxLsPTFL-XKUK+8~
zQ2WN!`U94;aATo9_5++Tj~v_n!}nH#+l8d%V!>9mc%=WKpFAqcLVTaF^gVQ^;P7Ty
zJ^Clx_PikY9;*9MF6bYcs{I!?S_4Ukuth#E9s%)qzhWyZi-v&I^vJbWAJyL<1Z;#y
ze@VIE-^=zsT;`4VUUmEr*y_ZFkU0=WdY~U3He7e@Vb{xtI4<fh`M;0NHP{P5t;DJl
zHSp7mI%Tkw`7r6YPS4TVwUX-&u{MG&t)&2=q_!%CIU$-$R#<>$<VuIsBeej=W|dDQ
zFRseP6@d6kayT!<M`bsy#6Q+Kf@<**f5`F`Co`n~NH1Y;RnRcLkk|DZ^hOdM7jtX5
zUNre?q0Fu`D}iJYqOM6=<(SIE$SxvNs0%2TEXwq~;FzNVbX3yzrfh7Gv_fS)mW9sM
zY?y<XvZ}h4`nAehRe33~JjMfq1`NsgA&-Jopy5%oSd<^gBCmmaTAl!SHp~}ge*)?+
z**azy#$W_%RSAHA)(1FKS70cVw`RUvv9vk=A*p_Z|9kKNkl=EOc?nd5j~+ZwT&Bk8
z;UtqTvwWZWP^My0IgYWfmMEGEB#yGuy=&G5!tc_m1Yf739dL{1b+yLh<$QbuNuN3b
zO9){)h#GLS8UBSX_o;|eBH}0}e>CNSFvpEZ5V63E9KmD07x(9I|5$(TBDN72{}D1#
zLmp~#(>!<}*DWUHH1kHA@!p_!fFYF9T<@$Wd675y)Q&PUKVx2=rh?sq4Owv6tIZ}m
z+p0oO!Lt6p|G8qtdck0c{l}TbQ2ik-Uo-2M*UzO{9wGiE=AD2Ms%O@Rf6II!FTYi;
zz6ti00G%!7u7+;s$y(<0S(Z|+LVpI#RF?}7VpsWlywTMp_LFBfqOj_G4%xcv>$(xk
zJk^`D+t&GVDL9OZUPXF?!={jK!reik&m^lX7T2BJFV}pwUch4Pmh`GBlZ9ALWz+6f
zot(UfNFP5T<T|#OL|)($f9BX3p$QEL3;mEpZfvL24Pxfsf6`OV^2N28PFr?<<0`@f
zxt~DCh=HG13^E(`7S8wG<7HledQNg9!EjfnqvR}|G`P%*Q+T~@*m8AtX4b<#?o$u@
zxS<|4pIa9eWSXjS(A0@RH5;W{m;^k$`e|dnmL#lW$s3QYceu6Re?5IARl1W2Mc@;?
zmTh!G;D?F~#e=@c_sN=lrV`A&`{niX&)1t@UO(@3MxJw@uRq;6+vb&QSG9FvCFX9K
z;ZAJVdIeXz@pe{~ODv!^q<S5$SNv6OFa2xXh!y^GTN<2GHlLq?Cq&!I&}qQv+^;9N
z($IFm7NSnYX@3FEf9x~#Fn#@e{El1{>Wywt#xJ%LHnY#*KqxB|lDc7FeT#$r4O$!)
zd7(3XLv8S{zG9#jaNRy<iC7p9er=z00wKhi57w{hBZwD$8v|Zig9_xNpwHpEr+*!n
z{9^?pu&pfkEsl$pxVpEMd%+f<>z-_NxBlXq8<t+JtJPwse}?r+9M*6x0PgPAg-vzH
zUffiN?#bkb$Zl*auJ`5s<0p6P<dof1wB5g(y8Cug=@$e8ou45Fm`QyA2lrz1-5?Cy
zlo2O$6G9^qli20~$ugI*fQ7z@{ZC+X05*q1z_DGe_1_4TQGHYgMXyms!jxy93(ue#
z9=DMC>+^I+e*v0V|KFddFMTjGoBT<N$G?5|5)?gyG(Tz?Pt3OTmu$;yb()+i|E>EV
ztn%%EAO&Tz!0|&}Drh|H$%EGOHXgLeH9@I&U{y&(?D{E9i61%<p<d*ZNJK92<J1q6
zIP_V%S48kG`pdxy3Hg!*Xs`O}mw}-k4q;p;o$K0Of2~M+t4ja+N)#aa&n%d=g=j$k
z_mt%e!3XJ!QDah-si-mYtV-?NUIOOrWtir#t)y(4g(yV&9#v+ds>&^v`BB!`-n8NP
zOld3J#ARs`ge0{?n?QPN!qUtkw(F<1&zOjky`#BRthPEi;G6qnUEerSE6ee9=GdM~
zMW;cYfA&Wl+^DT<;8o6Kx4Ox_%}9ddic&F6GS0YmkWrgtOvHo+c1GebiHMtKaT0i*
z9Y@(02Q_ewW6oV%B4sv6z<U?mF&Ocqv*4$37BnyUtrumB&jv0fXTP7@^0r6m;0lZb
z$MbkBh)c7CP$v|Gc_}A6izCh%O#_>K63-@ee>#o)e<v*mw{ig9iVyGN6g9hx7u0MI
zzo%O}0bAC-8*$4%-0E+OgM5?2t$%d5Jv!X(i(3W<7iVEY(+HFzloJ{|AxVOi6PqTU
zD{Plj=G@6p+J}CY(pVYs)C0@ug9mTWd<h3yi`Dy9(GCP|@H04Fh<V=RU;)y8wuX<+
ze^Peg%tAL3>5PCjv$ji1(Oi}QF(G%eD%f0#<tS|B!)2acTGC?;4cQ{SEXqYW2QxPs
z8l_DWd;k`#uA$5oTjbmbT4_79htq90v#KoVIzJWH9P@z2!X{CWaY9o&A}r&Sh#+-s
zJ8_&e3J!ETJ-!KTez+`aVU<-r&%w;Af6{ED8<bibv)fF}V-yC|idhN<sz7*4m6)6h
zm?UGRNb2ym8;1Q;V(N`%N%^8>S=Q}tO|!hdIJaC%<L261;`IjnIGIy$vQ+PNZ|dEj
zBqzYN4vH<Z^86{x<x|`Sf0q+#G>M}*{7#%GZOGcuJiGHy?lFuzs6j`=GuxE7fAQvt
zm~{u=3%N2c_8(iQuqqdC5cHZ=s^_<<^K54I69n}u86*!nP#Vk8G8=!%hDFp)+juz5
ztkQ$0XKk)=3!Jpz1dv&!ht*7&(x1LE^+Fd~jG9?L<#m%6X(NXQ9&!0>FlKO?4VoEz
z%PX8Z=)XE}E-ZUy+2{7ml4*VVe|^9VKIb+j_i5N-W;vZARa-^-C8mSEyQ^6C>g26;
zG3+TAWuLz46INOm{p#TzJs4Im6Q+E5Fi`ONAK-G=kl^Vn`Q9r<@c0eeZ|@W_)}M!a
z4I1+fM@>0Jv$<il9E3c{z2C0G$~{OwcS#F+zrhpRz~nfKr5%dIi4)>*f58cjB2MCn
zCnQQ-FN;NN$3b{Vc>%5DpHo`UVPRj6xS)G<D|rD6Z<iKQCv$}3W`x@exQ|?q#7^jv
z$cfxAbQ90>oG(CHz?Jd2Wd-cSQBpXFq<~|2loO6}!tLdR!4f)33Ez&CAc4RJ8R1*B
zQ5|K3qm1wc$_PUMIrIeze^NW7Sxi`#F+v^Yk;rx#@jah9UQC$?y+g_eNP7Ai#e;gq
zmS2u&0KK`DSO5jLO9h#oxr`?<@hEVk^2{c&EdpXkA#(#i5j^`6YzVL(KDST+eK^Vl
z2ayS2D32n+Q6#v%NYGzFM~UFukqGeWKMDj#qruT=@Hqv70dyS5e*+>4LmsCw@e=M4
z>ID&r<4};8`k51DS(^FTEg1d!#{}}~NYpqK54vM!>~#J-ubUo+-+;oR%tk3uTRwh`
zOX~@O9#djy(Rp5^Wd)fB7uQ4i0SPg*nPDUu=-y<&fFKGeZz52BTR(RBu|!ut0r|Z!
zh-}ApNGNDRXp*KRe-@!2cA9dR#}196Tlj`;o*|idM}c}pf23~nEfE83vDj6lQ?n_h
zg1qV^2)P4VK|)1%z}(CX1CZnw?&a^&=`J?NbBYYABfzl0(7i#HxYbN1*F^Vvif}QE
zMdUC}Y?}pyGRG!KngqlTqA+$mFG=E05s|QcbIGBCftkpAf6>mJ-e&c^J1u{a0g<!5
zH_1*l-IvqOZovip*7wbsYM$>WZ!h|lwNwMgw5dCJjL5P2Dw3GWMDO`>y?k0p?x~;h
zdEP()XJ@#w-_1AjaiDHQDNkcUDa12IVM3VCIPo0eWI;j`8r^T^aJbSorve%uiR}hN
zGBT<2+H|+6e=7+){<}O$zlP9qYcjUHA2qFhy!*W{8)muLp^|f*{^sm#Hq^ZA)Q4TY
zQe{RNozdjhRrjmW)%Jhgd0lO8K)K}JgL~}utG4$YqY0T!2E^}oA<HJ(<acl-_Z#gg
zgjB;PZ!boDnM_4F)xqN>zn@#^@sghsibj{aCz6Cyf7>N?ATmOI7LtStK~g{Vq9l$I
zpW2^-0(y#CSN9*ySDQGWw^2DKf$R8*?~&Ar972QGBg~;00vS8b0zdNx1p7z&-Fv3r
zwUAk2It|nA^t*@?HQnh>yx46oCTX~Pl-MoL?w3r0t%!h!%;=~$XxVu)AviEHTT6)V
zF7kS*f2_EdVzKHo4jZ}}Q04$z=6qfON5_?EFs{}M;6AM|;b~U`s)2HN0{6BeuSGW9
ztje+Ex%C&YCl8$pSR;V#x3EN2a#f_M)<EK0aBBgiyiM7)ld&eBuf@!&OKVvcc~eU7
z0OVC&il)j_P~Cy*DPap%q)0WQJO3eXF5z#!e}?QId2@Xu$uIU<en+3(S25Ps>-k)O
z))dB!7$eqsE)d1XiYr7?D+{i)Ka$~u@qdF4ma4P~dSAumzlGhG#~u%bAS`eMp<WV_
zgr}T1p_}k9X50n|aCgPzV0T(SBZ=5%f)X_tQ*63p4ia;*B15A=YyH@&*PH|CEzsgx
ze@iAap@F{8VpbtO3|69*G9XBvn;g!D3Q@9BYo=aiagi=^$*_#{!0qhiOFTo0xlun$
z({;tt>vQXcxzK=%9}CM>HrPXzs8?mdt$(cZ^gR&lmPU<=xi=9Ruyi+<;#%?U${Fr0
z%qhZMoh?W;KXz32vWN-l6Pv~np&5%ve-d+tc)p0;AokqAi$6WnZnt}mM7uk&#Ef&u
zd`)VEp^UeynqVSx&W_4~u_*Wi*IpZw_;qv0;$b}DGtkn&;@8eBd*rn6yP|+)m0*XV
zfSnld0X1i`SZi9(w>#U1^)0@QoHL@K?YWsx{D4J-29ZPJAn-{nVkb<)H1_<xf7r+5
zr))JazS)^6u45I$Jg+S>oiZx+KC|zAm{&vgx0XU~r77fO28(7y9cOUQ!Scx<i-H84
zb-9p4`<UfT)O!)bsj1n<3l}Eb_S`TcA*SQYl8i9lc1i3f)D^Mq1h&}MZV$6lTdz85
zqB|JteI>DcxP;shYG#zqe8Nb-e~(FC3NI5$YPAJkH&_i*&Nda3aI4F3A+au|Q7DAq
zx0$Bxsb__o#9*QDT%Qw~1u=<ukdTaJJP5*o*&h4!oO63&AY6lYp_x0Tr2QNzX^$*(
z2WOcZp36h7rYwxP9VNsQEF}~?bC{R8#AB3sNk)A;{WNK&H{_T;9LL;oe@A~QJNipV
zEPdp;JM!G^iIj$3sA=fiK97jUfaN%WbYOAhlZ0hHvr{TkkKRRLco331lrrv}+YSTE
z@_($wR1lQz_&?UHVnqWg?_4F-BA7rcxwg2-*m}{RN?NK1F^M8RUX?3Ioh$&Ci^5`-
zy!6ca6fRzfrdIa|DvPC5e*>SWeKS84`fIx0*A}tz2KuyyO9}FO0ngK3A#ZA}Xs(kj
z-jhM>C5|1s#OEBi5xGs6o%zH~5=K)u3I#uu_arW;8zbJNs0qdr?cLLtTv`IXU1vRS
zHV3|SMQ%@?w;!?Fjf%i8kj`!BJJT=KddbY-^37MdC>s5nbzwc0f86H!mwR*@LA@M$
z2q*+r7Nf3D^s(O~EdNtpsWqkAc~&GqPBsq2k`X|)b;;^YByP(qB0jD#iDJ9jdQ&{C
z?Ce}0QB8?HY-M&TM|*&E^13J+NdnhaeGpbR={g0vLW9?>ZQ^cmRBbh=@NECOhajqN
zT|0UtPq=^b1ovPBe`~i7LfUYdkGy^yTQJ{GIElSb5b9G7G{-4nF;CNsXC8IJ0|LO?
zu$CPH{_Q|kwiW+<IecYmVkO(eHjKu(Ls^m#pe7^K4IL82JR(tQ^OPqUkA?q5VKhZs
z_W2N+Nm+KpXGeV2;<FKX)-BMPJot{->`>V3NNjZ^zx~Rwe_8(uA1LPh(55kCoQT8;
z2^E1)Si~qvd~W-R?b}Yu4~WZd!4`E0Sat(R)Tf7Jd-FtTXAX$<--5<`8peq$09?B<
zp^gYi9Qh$hW5<b|#E#R0Wk5R&8k2NUpAU=~R8dDPcEn;W78|k_-2#f?S$9NYM<jOC
zl6}rJ1YZymf9u`e10Y6y<~pt`i0xwJ7`Xb`0Vm9+b|AQGbDtiDr{@MA&3mNjk><vO
zxB}jqlxNHI>_*DthQ5=fj1rHfKB0aFrtH8cQ5rdp?L@H~9L(Wwa=3RH<e3aT0uN<X
z?xa>;g1Iyo=@=TMhlGT)mtfQ>GcfO(Ej)c?oiYize;{@WCkG<TWUUJ24S`j@0Sf2f
zU^__b^~dWr-;rq_+ui16nv;Hp8r8$TKmO2c^!@L}K>B&JO6_d%+ss%q8Pd>OIvCvW
z&+v5cMbMRhuE4-`KAiu-Y&?C{C4b86V!c?LnrrC{Jc|2^YuDURW~rIwc2tjD;Qua0
z$^jt{e^9WGD0z0VQDS#2)t`P`N57}`*{DkE530^%hN$05hN#|hIZVE#=#vl?O?}K@
zF^@in?ldp5>AX<izhobO`|gno|J?rF!RP0Y-wbp{2HP}<6UPlWi8I$HlroznallDn
zJ3NY+A9$H_Ydng9?tA0VL5L96r-FY}trCs2f1vUMTw{A<QiWyrMWnh9_k&0$p=jd8
zaS$+0+=SYMI+PM7yo{tFOM@iNk~mBc3q||Gy)P1#<#t1&eGEDVjp{!96rd5X4giP8
zoI{}3?*=&@UF(b$vloz^TsOPmSy>SA?AAKIGSsSikLYpoyN>Af=ze!ZuSfK{FDM$p
ze^xsTSrRxl@gqo&%3Y5{QIHazWU=F>B6E3o8`!!=<JiG*tFHFbDNccO2%^?e<|*)l
zdN5VN-&><q{Y4XSmHA2R#lj&rM6**N9Kr(T5!=aF7<e(u4i_qY>rqyC^|Jh6Em?7G
zac!HZv~Rvq52D&rrd#M9B-gUEV)X)re`!*cQ)EGUCbVAk2rGYAR_I$qM6^vBK@p>F
zNEj-Y<t?F`EG#jb{P*5*5M5V$es<l@$1sR3T0}j4htRr(QcZZXTI{RVR!%IuuSsWl
z7{#8x?MB!rbhw|ou}w0c+l0nmN|MNRNaB0c=ZOeC$GrtMdR8<QBQLA@!IgV?e*k$v
zhQ9$fBOB`XblQqrY4>vMZCTB4524y_0hU@9gNwXwIRZy_{cS)M_P4C&+w_1A_o9sY
z5#bpZ;5!fz#zRhohyphfkuSu-`0@`rGYV{Jb)cS^Pp1%6EpAc?HWh<)ebfmab%N82
z<}1?*%Jpoj1@#KwQ!glseSwNWH8+!nZGYYAqh(v+f_atmJxT7r9jrK5F<%o-JleMR
zz)K?-oCHA}voIr395O;}Cm>9?DdCY5WFCuY>?WTp0fG96Tjw8e8TUNL5k$mpLMWp#
zNjSGj82XtV`6=~>nUl6aeCsK&SdX}LYU}h3AhK6w4m7YoBM&uTwU>qXsmiZ3&3}XZ
zUqZ-;N55goCJy~2177!XT|<aXk9dY5C4s?bpO%XSOG?RPV67Icf$a*pm>`>7ZJC|a
zU6XY2*ky$v<^TTr!|KN$k{{o&OjwVbhNYLl7%BZ_H`mkk1#A4_Ve;b-4_80FJ-uw2
zRsHDU!-Zf~ao!Oxq~-FVD9E~g$bS_XKPi!jpLl`)ux8*(+O<wH$fdX{Ny)Q>Am2A(
zNx5#$dY%5`I$ty-FRZJ)TGuB1d|vcA-~HSA(=rj93x3aE1e8NWa|3i8+x%gcl8^3j
z+r`6OmoLPUEkJr^38IxM$K!d^{#&wYj^018g;yW(wH4!1C~JQ-Hf1WZlz*jBL^3b*
z2n}gO5?e4L!oaq(z!RJwN<6zc+XD^+{s<qAvbwP@9=7WNupUgzBPE^5w-u2tESy$D
ze#yAS##B*qLA7t8OjxI^C<K>MUtv(yLs-{JRAeQpyyTMq-;y-Rm{UTj1>i`iSFC!!
z$O~bJfWUxlUG!4{eBV7zSbq&J4{)5l(C3TN5JT=L<4r{C0Nd9Ex@o}gr&xR&-FJ(;
zpD_3t1OtgKpvBsHr3cMAee>$&!<Rq(@gWZF8KxGqUIHbc<>-83y16lp4(cO7UtOQ=
z+a1{v9QOWsF4LmvPPm&oai|`=Q44@TZjtszF}vVtVssSkr7~u6I)83I<ok~FzN5L<
zAnrX-z43v40?Snm)c>%S?7bjr<H%jq&59z9vo0*V#|GcA$b<Cugf*%Kxf!+#sMrCN
zOrNl3NWKI!%Er>4;*bAHX705vpy*8H{1}AZf4%%iFpF3d{HuR~G<ma-U!{-tksezP
z%}6G3;8ua*-&z{ScYj>gofc?1PgYY(1IGDJA;|z4KHT=Ky59Ot-RdyE$#rh=P1xuV
zLwC#Wx9`}xDb;&7D{5Qx@ZzVJ>T>PozGd0>gdee(1fEL?WwA|I;JYNr65FS-2xBhO
zCEPdeIVK*%L>_RQ5OxoV$0p^azPL0YiJaXj8JWsT)l!d|GJjKEDBM;zWrcaB1~L>N
z!VPlN`3|YW;1d!pei$(FWdQ)q0{Ab55;$G0rko4No{9;!AO)A~+j_Mq8Dzm~${S@i
z>lYO28-{rsumS?NEN{QQwZh1BNlNH2Kk`ag-C>V)x0anQlR%qhsmkm3IFM+C;7EKg
zisr^dUQbKRrGEy=(@>HvKNO&iC@ZVZ8^~Lh7gwTg@;UO1mvx;3i7V{os$Ax^w0@*z
zk>%CW+F35`h6<ccL;*{Ok1~9<XV&HnUtZ{Cf(oBxX$-c)G$XN>Fp@@zW7{H2g};{{
z)rPHs$NJb9hznd^sxlGBE@{8Et$(%fA+K|P@xw}h<$qV7TW=r*7?v?}a>?{q{mftu
ztLBg_#6n^HJ<h6F3J?qDZ8uW3T(Nu(nhVUq2G9Dd(Aa9P#T>rHOfe_dZ@V<t1v2h-
z>l;ZgAl4uUaM>;<)66&}<8I33<=GDP{m3U#47t3h$4C;0l-PmG9WO`&*U9de+ujf}
z7bT1{M}LFI_Ep{k;l|8EdOQozV=pzg%oo-$nKW#70g}zZ2nhD$DhHe=PB+Pt_n#Z8
zDeIIiSOr;~dP3OJtmzChMs0qVeeAt^A9<uukU_fnW8SEZd85YCK@Xau;T*Q|yke`%
zff%7=o&UIF`YD{JEeWR-T!u&#+=rT;c3*&Ouz&k>qTT`2Yut-d!QzC3KIE`U-Iyd9
zPlzjQo<zPc;)v~YRq4~@DO*BjL1g8vb6`H-0E6_c^-8O>!P!$0TitXqX^q%UnOaXr
zIDm_$EO2d|={xR52=y~)(vUKKfy55z#H#z4$&WVNGP+*RI%iny{H)6^iU+n-(-&NF
z&wuASt8Cp^wGhP&Z!|cCO%jK^U`3-{ZM4TnURf%)ruwE$5OsHdnsybc4+Lp#;ufUB
z^Xw?}NEUi7q1+1z3lp30R6ybv+ldqV@V8)lF4qz#O)QuLtPixWFjTXuLBLh;=yvmb
z+M!wvYR|gKhl^G(C36v|EBB_`Q)M{TA%AKkZl!+usqP~u;_6;v4==1dLuUxB;)5RG
zqhD6V*~~KkoLO~KrK~wc9;mz#kFb?l*PnW|$eYur<${aq6>BbM_`*Zf&izW?o^?(U
zW)ha}K2#39hNG;0ra8|4^4RqQeC4qo`saG+yVtPC_||h6;5R}PCvPwMcRS(@+<#th
z;MYSHUE8e<ei|zOGn74fdtp>$-0)LhvZ?EX&i;P<e|Nd)XS?VIU$YN+k(GZ3xf=J(
z?UaPLg5K?{B{cPDN<X%rZcu3f-{kWG{UM8{RRnrll!WeoNG;(O`~#y_t`0C}sQ|CW
zTaDT$9g7LD_wn(^yx#n&DQsKu5`UC0f0nKVj~xF$Zs`Hk!o~Y?{BgV%;(a#Gt|`1Q
z=1B0eByrN1Bq9hQ4SGys=D8%y5;yQ!M6)bC4DvK|Ymfha7reO}NCX$=`6XTuaFb7|
z_&VL*>Ei-?t7V&_nCFE!`;t)RsuEXhA@+uuqPWVdvOpkp2c-Gt)l2gD?|+jj7tdjl
z7dRvkNcraYB=I~(;!q@sCp^b@<Ie>)Z#V7VF2)>x>=A1ovE~<wH4g(2P_c9b2>TuL
zV{g+W<!Q=eA_Pwe4Fg7)EkY9cHqD|iwB6w$zZ*s{+%c2uR>Ha=uBywZK5^<B^yu|U
zq<~D#lON4ia16Iv`1YXQK!1`hOI)%mVDT2nAt~xcTXD)vHI7W{@?r*kMr&ND#8U8F
z-o<d}w<ftuR&fDozIV^%-Og5WO?0<=SMovp{QMw@cpyla+JewjcqI1in4~QBIA@;7
z7{B{eKVGdC`KH-^(_QWpGkk*!EnBV7E}1UYXkEQglQ=o+tm|KGiGPpa(I<-Zc1xh0
z@}*$)x)Sy6X58q~!6)4gML<&)6Pq%ZP@1?v*-OCzJ518h6Pc479>hsZEkV_k^(#|w
z|7HW4!g}qdIE7sc+k7Re8m=p_I9{G<xCEFBKv^Yf5IuIpT1pr9>j|jStcUG!g<(2d
z)M_UWPf(#YrB3U1g?|e6F_IdOni;FTdc{%q^}A6;-QrH~M(Z1s{CB%4y0JUNk>RDn
z6AUt~P@WO$+Zl;MCnZtr2i%V%Ct~p@Ftu+xH+DC`Pny@&p|a(oY0u+R?SY{QP<FSh
z8(aRrt4fCZT<Ysa`}<qW>a@y*GArNde$=$|2e}(<k7a2jh<{COk5I;965A0a%u8KC
zJ>PYPROvSp4xr8g4Ij1jmvVtXrA=%*<f~WV{{Sg2g|U*QGdKd&na-4r*BYe%C`$D7
zxym{C+o1O0OvSfPgiIKl0-|cAQwm&_<D}p^+TF}<)Q@-CrWR>El_VHu%hdwzV>Hje
zw6=I`l@}{S?0?V@lYBX{P=6P8dKTnrZyQ4HBHb%B85@!LZ4_g`QlZ@8CbVLyn?>A9
zd}1>y2u;G2#7N^Mg3M-4;*L_q--*n?bk5s<p<ujTZ;2RX^}<k<$i=gLZ477s=1JcR
zfPFc}(6+PMU}!KM{q|d78UKxqi<XfMT3Jd*W%P}JuYcoz;K21>ysJfXsvpiQZ=&cM
zIn2`7shZP8-{sk9&k8yU8^PbtW|luuvtju(I%S$`jUotBaUM?IUf}<4<Lq6Gv!58n
zA&5nDq6&B3es+HM&0<><1I~89x`RQz4d9iL2A>S=-XdJQzoowZZ+wgBe*0xJ(#?4R
zk693TB!A9gPACg)5>ZgqrJnEj)XgF{{1lPkn?q7>9SH8*Kzqq!5{1CE$RbJ-9@&J4
z8KsmuiI?pW2>z<98}gG_<X0d`{8zSIeQ*73%_^`46~cO^w)JG(cN_7Yf=@0m1+m7u
zWUG|`C+4zM{5*KTGVn6xs+k859$Eh?s*+rm>wn66ylzVC)w-Gs>-1kAzdGw_2YWcG
zOS8BD+a9=WV^W%={D^p};MPC7t}j`^<^pVd7Li@cF?4{>tV%2dgcis$3Fx=V<+=59
z8^v%bt}U1Y4009H$@@wyAdH}Hi2e>xm8{C57M(#!f3kAnX6dEOHi?YrAC<fQy;2W2
zgMSqVJ#IUEf059!=Y>w-+JwhJL}(m^Ku^F)kj6<Yd}e!enB>ac2JZe^HX<p@_h_?d
zAs%j;_97BIH#UAFmipYkaoztQ?blu0kP7y(?LX*{A%c*4Rf|XZAN^pWgr)DHI|YX~
z%j(fT*|z5e!S@(1q#}H}Sf7S}f+!`}%zsw9nO}8u0cDm62yscSt$%&|>P|sP8`vFg
zbYVQH2b;%WGf3Hr;VyvK*5<M**YitxLi}awggA$fkkqSbl{a~6M)hQZHEYyoGEh#y
zS+FkGHRNp2;Z&*%Eh8?T0^s_zWLVh(cJ{IaI<xl3!RkP#vVc$ltr^c-q%V&sbbpSh
zh0@5#NF^EOf?aM;k^=dU+T#PznL5DC!%qi<+!&Gc7s%n&A6;lp>Ed-JRplXpgljCl
zL{ADhm4LNPWMw6+L|`b3^bjFdC9ZPu0lX}_db{+v(A&=O8-}Gwug|xiKAWSG64w>N
z&m6*Bo`U8qCb7#r;_xJ8++)Fr=zngzLIJ+Nf49lZ4fRxv(S)^Skga$_V3JxtxHuFw
zo}50x2lD|tZ_9#~^1WOsaOcSMYUZ4^<`lI`$}9Lc-mC3&qRiUfh&x+U29xyfY(?bS
z>Pzv5xF%TUFcx|l;j!-$8o41!QgE}1L*~S`6GZ#jOktY!#3t8f_!*G@?te7Ze^)Yx
z*kQhh*S}%LRGnCf3edGWYd6mL3`nEji^4+BuH@Pbp}?MFirIgC{Ay;sf+XMapIWaw
zUNh1_r_=|a;GLI96aa6d4#>z|W316WF1zi5Nv=uTeS+OT^s<RW;zeoV5Gq_wsOK{h
zIf)=52%I!dqBzUw{p!_G|9=hM0BpI`8a{LPOR5wYn07eTnvk(w|K8$VxM-{uEQPy7
zsUhtp9B}%4Q?!^Hv(@PI$9Vrw(Hs75quKryBo;1-M76r=7}vHjuI(-XX}zJ|5}5WM
zcf7U^9EQdNJL4goJ`N=`@qmQab%_^ej_`z+`9AylPM=xNz?WQGD}T6XW{}Ak>>VQ~
z6IJ2PXVx+=V4F!d0J*#S{Jk4b1hW$Mapy|<N5ySU&)XlKzv|5LQoj1_I~5F+XQzW|
zPV`$R5Z(i?wio>Na_wtvK?4qKFKWDaa`%HB3aH6dufq|JzslLtzuv=PJvGegtR6p`
z*&B!0EYpA36`B}cvwzs|@ytFO+NisMW8c0P3h;vLVWz$jLmu`F_Z=srjDkYg4+xDI
zCoG_pB%vF+F3X}lvj>6T@!G)uD13n8eS`a+$$J4aU#mj~>QSnOR?n$UcD_bA+ce2a
zk#=yzLrh13bnWe(P+B}kl~2)h#^6V$V)rz!OOV+)s%aQs=6{8f_aPsNSfDi+uBqBO
zMYRsc-_B;%zpRV*@&>muG!4$+x&U<;v<nGPK3b>9LfE5*w-ggU^yF;F_R^r%WI*r&
zu^nq5<$y6-m5V$Dua6?j=WDr^rQ${u=s!4N+0Kz9W+ke{wbgwt9AW4^FecNOT9fUZ
z9$cv5X_&-Gkbe>{$bivRfcu1qNR~McXF=qoad_{rVsAh(+d{jcy@RqGybD_&D+Zdn
zO4PtmS7yq2;dhHAdch|f0Y$e}+gn}NuYDio-QK;3xZtF>cXdqi#?tcb6Sb{xco|-S
zS8<Qu@Giddb%TxG6sViO`%U76iQ(25VfY9Os8Lq$z<*!(vmR0PJN|jZ6Foe!;~{-m
z)Q~1g=!GI9P8x#8k|zku+<-9O_c9SUG)&`9LMVQNRqxiuWI??^q(YD=iULBNFec0o
zBN7YBs4GH0iIFVwXtujYvz-CUUUWulz&3sJ`&}(|NI@qqMNtDD>)Y=P!+9$!^g>3I
z&AbI^Gk-%fu#|z7(t<TmLQ4tZ+<Mk1Sl3$WkR9Aww?I%D=>h7XyRvEgkcO$QkJ1XF
z40>kYbuU|Xx2Bxp032p5f)G^QErm3Dwz?ZFaL)|NKL~|sJ5n)-lp@llprx6cXdl=J
zW$q+hw*FpQ;EWH%-l1k6%|L2SM5Xg~3=MEb(SL2`x0FVK8;2nYg3u;3bOI7Nc1&E~
zWnSR$kcQDd;*qhWU#m{;KnTdqh&G5c?%_ejaMvMK?ZzRIg7KxvwUlV`x~UkLe9x^H
z9sOPdEiOe<<>`=$&&-`V?Mec}-mN3hjA}_vtsBPwZCy8#qX(!36JZrXC=$#{@O3Jz
zb$?L^AhBlEwb9IkK+>B%^|@pt(O=}d0rQ1T(tuGysqjc*+l=_a@q90&nIDPIrl;IA
zS-(3OpvvcSQMD??$FNZ4qc(@B{Bwx!^$?!izwPF8s`yUEXUEYhbFWsJi2>i&HZzI|
zm^!%*49>m4^|_NdB=aaEG)*$X!YCsmaesyH+d;xOz2lwrN>o4{#O7jraXn#+bPYPC
z_PSE9!l7qEm64N3y-wlu&(_k@NS%vP6p;6X%#;bCTxLbu840|MhF6#hqXh;FeN|!D
zfiVy0<y6<AmL2W^oPM8Ml(EqxfbKBeWR*4tSDFcr#lG#PB(^=9&;XL0x-=rbpMUZ!
zh_lFH;*OKvlJkrlO2&%-xS)~$#_-<|>19za%K7z7LJg_z?b2PAnUy#7_9Y^{%r*j?
zQ{C4;SQp(}56wEyAo0owieh{UsN-aRF)D^N8mNF9FTn^Fz)5CKdeHU~i$Tapi7sLV
z&pFly@x&7O0Ek^f5X%}P_>m{*b$_?I;fCslLiwg8;xY#vE({^`Z{vasc3E(y5#it~
zFAf7>%+5%X(ST47IDKqi5Gs7zNxU$Lf_skb9Gx;Z;ox%JDqQ7hV!*QT^6LOjw<+G~
z3t@zqc0)TlwdNSbj1saBLBmwC*O9JqR6PbKO(k^S7-VW9yRIJo4$@U-i+}RNW~{hR
zpKfe^Rpo_Bv$ARUE5R106AyJ(nvK056zrbrlB%Y6-F;_WSS+beWy;Xg(=ClZ+*beD
z1IM<{W{^yDSM#S1YqGxXz@@r@SeRR8i5btwt>_#<F?Caf&W>p|HzZamtL90SqagG&
z7Yn|v_rokKcrLR6Xhogpjek|)TaV}SN=ROO6*2%{t8wcjqvUVjfmW%$EEinP^0MSA
zFsH19bmzz4F9mCsZ1u_*%y}h5@mk2|T{VBM@O}VTEmxI-%s=$s`+KX)_3=R^R+XsX
zliL1c1L_9pRrTZERkgGXQZ;SPet%r{S_RMvHvd_CY&M7u*3>jTEq{yVO<Ubk%$fWg
zS(8j5uezO-O;av6B<R^0a<)6~5Vw9nh2w{*AZ`{gLR~K-aVmTQ8nh@0GU{;uK)3!Y
zbj2OR$VUgoj>_ru;lrCDqzny*dZ)UDcu)e&I|9qojf&Z`bA`YmYy;()OnkrqEmlBE
z>WOhc8o!UAwFZ_UDSt{~2LXx07O8cN2gF6>#XMUt)R-8zdmqc}cg3rS>=!@1eAkWJ
zg|%W;E#86fF=iwj6n&ak0Is^SGT*n1MefymCS$UnECi@vdePeno4<Q6uIoX8U+uSN
zlkL4(CrW33ty&y(<G)<=+mZrhRk7=L3sKCQ%YIA0_KUwgvwwbsOynx)y#G*s#V7!M
zYkl}3vY?qr&pJ(^gEAdpe;P-h*)zqrR1?2_2cpdOm(gczw^zX>?MARGA3|*SR&Wh3
z><_SIsg{6X8X3!%)Pm4r+tURDRVP$+4GiO5jXPp&0~B_V{lj8svrbObFXh?jwb`Is
zy?&w2b2t(G>3=u-^5X>@AFzPimVdPD!M0G3Uc>2eVM!?5zW%^+Z2R1{9-8&eEca~8
zwBA=DoV>jl_Oq|`>|D_=dR6~=q8mSXd!hen{A~T9`yKkMJA#-^vI-b){w|nv?!=5W
zo{__3lK+g{0D9HjE7e#0*}u>F!{`I)P9G>6ZBtAx*?&hMXSWaW#fPLe+g}-WNbaYY
z1>AL#kc2*U!EezgQRZbNaUvSh#CMr%--ZlR`ji?MnO4M38I8>-Tck*rk#s$Exh8d%
zz)<=oA~U$6Kpi<S?2;H!ELV&2y0(_<MUw-W%s5a2F>?NoH3ms*{|TM+Uga~HX|l!D
zTFPw}Q-5D8y(k#JVnqrV99P3AKcWoy8-2lKz+WRxj)E&&0j$F%+|Fha_r7OAYY`tM
zziVJCrqUw<G`yG&60J{4ySu?|-^<iD9<$bk<ijP53#u$JM!)r5VFij2P#mC4l_zUW
z5z$ox_IU7u*ltPJ%}?0S{Wy!L6F7v~j!h^{U4Ozv>VTiP;Bl0uJj*_%Q|@39w_)hU
zLhn3s1@HUe4u|*Kv9(W2X?>}xHL;t>9v1h0;@t9zh>t5-PN%irCd-}c^9<~G*DFzG
zr&635NFxTll&bh_C&RvadG@(1{0banW_!yNXYv9l$W#btD{bgO>lZ}v0kWD;cmU`W
z*?)U^6pV^(u6SmQ>P>N;y7#P3%>h4#^K3Wxx0l614gSohEaEI9b|PFtfr^_&JR~&B
zY+*-XoN@Qw&*qUKZQm1m>)HJ9;pyKVTdwT}#14r=&y3>-6Q2%`oA$IhT>=W$F&U6^
z7*%cU?R*BxFtoGQ3&1jxJ_S@IR-G4f0Dm%ABa#n-b7%wUQ_2ie(6ID9y0ZVvo0or;
zDxaHFX87QzTt)oo6BZoXLB-yk#1luh4p%(6(_yX0<=}_4Dlu_b8;5j{w{)7ccAJ`@
zRkEJEy--!n2F%tMM#8FZII8e#;I{T`Xzz0-wVFPB4@zyF_}u2U>yk914xyp&34arI
zK+?>0!XTkx=<nqrj2cupq7E(gt#rlrEcdnT+#vYnOU1XZo$*_p_b;!X_awr4Rhq)g
zrxpa;54u4TY~MSGC^#{UpHvpa_NOF4mNMUVY)aAu80}b;k;oN-2o?z;Tt5@e{d3M3
zI74>yC<oqN4(yCJpFj$ftO7?F@P8-+ezTMg+hK@2uMW)O5IVl&1vat$FeKDZ1&OjW
zAdbzvFt($>PsOK~0QWnY4=n%5bLJb8{_unDCi}@TIq(6E?{Am-)CF^QnGY*EN_<C&
zZ=a*~kTyP^g;5&NgoHsB0G+c<BAaJ~+njo?2qT;M`$&7p%XDi=PvL$zGk;mW5PW0o
zGPjVvOdZ8-2(mnNC&WJN)`W9g-b!#{B!JDVxhO#P=zd7ni}$k8jvses*!D<*E+h4I
zEeUm=y_#9PT(VpWfoD?ETjn1zuvtZ)wB0(F<Ai)G_<3faPM<O-%L_r8bs^-79a(QH
z(t(nnE#QN?h-Y-H!^q=RRe$oe4xN?}#u%_VaLb#L_}bXrjY1y?)ba}IkGh<Vv9#9(
zi%iLSH;8rE#)MQS9M6dzJ0rI1d4z_P5f&#AiL=mVG<Io_ep36Mxn4h!aSs;b->_R3
z*8W12c4yn;g5GM*YkPBRNeege7cFRg8Y<MIVeV*{y9p`aadT*yEPrs5G!03Ta7HNe
zIEkG!BV0I9mT>Ndq5tV+vc1mL1B+yMAbmp;8GO&(1Tq|v!ye=C`gUnd-c)xN#-N^~
zEOwN|c9X^M;5noy=Ekv~`F=v2FpCNGql83(XA@z2q0JrYyDs}I9Av%E?ik2ax2b2l
zF=ZJ^gD4}Ex*>@Y-+w3E2TCCx#hkjkGnVa|&gzYpX<oJ@R@M_ypwG~omru@GMlD5@
zKgeihuxCM{q|V-CArBKsFs;<o(PW)lPs(Ki3_c(<qQR`o?IKwkRP<8b(nP^2(@L>T
z*^!-2QZpoFbEz}b7=k29jjRCbq#V8x&V7Rf>RwlaH&_jInSb76dZ~;DzDvE7_zq18
zjU11}!1a+Ou^qW?z->Cr8*)r9b!eWtc5^+`tNgWI<uBwa-<PNE!Gm_6vIQ)AP*N1>
zb-OjrA3U&r2DoEvElC}L>66NZwENa8f!W+t4yUq^b+PnXs#ekkt81|R>trqIx?<^d
zZ{xjr`9x=L0e|(#jg)WLEes;W{7q0-x_~^f$+cCBD}f`$<`4(gSl7V4|K|B)X;L@H
z;#gt4jldie`K&&$il0wzF+C1MpDdeM-LlwCJ>gQ~2|FV+qbZ4mh>0iCz>YjO3lnD_
zEuK{1jh4ZU`a7i?+KJYUR6-Ipw+F5MVDOBGEW3*Z{C|I}t14Gzr7izb0oT60flx=f
z=wKji`(|FWZXaW{k{or}x30)kdSfTef-nw9U_-75?h2A*Zc0*LMBHU@%$!5HCqiyd
zxYOW5>iVRZn<0sNV?hu|W0i#%&Kg^Ys@YjtBt2lTipNk8v@yCW{9zoJ_)01f;b!Sa
zLK@yQkAJmNRc6*Ta@Fae%8j*jt~yYWp0{DNqek^_@T$a~KI2;zQTnU&svgT0teU^m
zT9`kh4!D6+=K)F^y4YWFeT_vR)rESaK%-wc!!x2No710xCjx?&tENWyfZ?}K-t|IT
zmDWd<md^GvdbX=@>`INk+TD1aj;Fb;xi^Al{eQg&I;I$ED+}wN;o>=O3td?MT)}yM
z-Yc`m2+!mPY7LzVB-L$i9{;ZD_ON;<-x#yywGA37KBE&G)O=m3-Bf+;`#Y-p%=h<a
z+iOctxy2hF_v^`~v%Q}XX*h~gKJ)!inQ)c=YW*P&N4d9YwD;xR1J&BimsO|m(^e4I
zOMkPJGve3|_|J2jurzc?#G=4Ssc&bYbEvE8No$4cuBu1FOX;e%UP9{K?tp&0*x|z2
z?})nbewdlJj@s$p?zM39t<cWFK@N9(Am4#WU9$J$T`ihZW6ZY<nfjo=uo{<6yK+DQ
zsr%MzK^v_0LLE2MbrbezyZOXm(#W#YVSleBZAE_%NbU>lvD^v9Y>uz730swJQz7v|
zX#ZDx=&tf@K4|Xb0ock&EhUH6$Z2nO#)RwmHgOW066z(C#G&I68fDx|)4-)+wvS}=
z7%bHDZhG(%w0<tFCnyp^sNK2|dLM0Jy=JN+m@c4Sw^YelCtuzqCQT(T1?Tcbj(^v)
zmNsW#fVeK#DtnN?yt6}@8f+B><UdAB2XyM(dMz-sP%2QMZCEuIaH3-p;=rC+F9grm
zOUrTXnf1K<V7b(W3>PxmLQ48Hvh{~;61bo((v(Dg^OPmu_0lvAQj*x2O{g6vBoekm
zc$5TjN^KU>L)o3=hqjboJqaJZ8h>y`+L-{}nzL>`x;yR7^T+T0&Z->rAaDdi<{atk
zaQa5o_eh@7(%}4a3EO3HB_8EPa|T(-^yvhr0}Qx4Gy;3pe<Y_sK7@JbKYd<)kdI(y
z`j2|kBwwPD;zfC@ZbWSsv!3bDfEPc#Y}aGA46kw~g-x0IX(6|CI~ctKv3~_Xz4Ltf
z?v)q#rYqExM5nIN3HWgHB`IGYg}QbR&E5`B$|lh`FQ9@w?x)!eSCG-yn?7$7F6v{W
z-c1gVP^=jJY6Sbfk_z)mPgpB*w`=ClqCtYPy6F^pK+7eWWYHcvwVJwR^BfDm;H9x-
zc3UwwBDN<zE#b_1)39b;&wnhvH)qxpm=?ihd^8^I>feaTqz~w52qrZogLiN>Oz()Z
zarqlj;P;mG@S*i5NrPq;WkH6@F;=Uz1m^sV$F>hk<$!3Tul)WA@Y6fG+8Ys%I|0Y~
zJ4jA<dLl1?lm0*&BfJTq4vx{XXeVd{m%5?*_2lu@T;9r!c`Kixe1FTX=BJar)&!|g
z1wt<Kpi<atX8jT6LR1`R@~Y`E__04W#?*qZ5xZ8J2XjCipvM}1U`y!)WiU2fzwu4U
z+eZAsw7mWC@y8tg`P+9tv1@$kTK)3tZ{Ka0aM_r$S3dgfyLN0P?c@N4)C&eoI(-$r
z2}8Ur1QPm?MBL2?Wq(dWSR4xCgmLIaj+?R|`*JK(fK}z{>Y!@>*t1T5uGRt)P0F;5
zSGDyNy+8FYXCqT-FRdjy(hOqq5W^{k#tERHtuv@CvIfnIs$LJfU}O_gg!X2ZVrARG
zOfA}gt5&G=7rtT(ATMvzg|+t5fo$P<=iZcbF|a1>OEhknHGgTu6UT-q78f|hGhdJh
zq7AdaiFllbSs14Kh#~#4+cd)+Iox;>hbef5Y~xeY2RS*b<;3jaJe81$R693SZK48P
z7SmQam^mO8T}bP=7D4jDnC5|ryp>M&o5^NHkQ?+4Q|M6^QJ!QZuww>dNJdyDGLkud
z?23f4*iH7C!hi09dEDCjuWCpP2Gaw3cU^6qy?n7)W6mS7(Lgr2|8RS1>#1Z%RU1#b
z7c8!ED%<UJ)w&bN9aT<Sab-F%0U^*VMYlY|LW>R%owtM%JCz?BSQM@Q{J;L6|L_0(
zKdlG<Te-GA<co#0ZDATEbjN_IF@4zLTBZlXETtGT4S#<0*Jf+dWul7#Z&3EFtg@Q3
zLMJJEu;1!|>d942<QSo(3M=~#i-|cIj~y={A#+?pd1RBs6Alq>Xu~?oLhn#9$JQU$
z`2v!>E^@FFW*dY!@R@^KoK#BchmoF;bhb)#M>+1Bl;g?*I0Y^h&p;*8PMCw!24p$C
zkY+MXGk@|SG$*yW*oLCrt_$bZ;@lT4t93hXUFhA|lrUb_sW_jX&#a%`yn4~YV1r@X
zB(j}I+;?K_^54UU)~O^$VT&{CdA`h>RsqQ$%FIOuY#ZphZV0Lvz!6C{-Hlvc7wg61
zwExx_Xy=<MU!u-L5k(JQQGzKx?CZ7uS~k`j(SPXe*NSw#3iR)1BQZ;U#P5MIce}QI
zM?}1j`>UC4H)DPhratlQG=*%t35k+~5r@TI>W4{|QSVT<-=ywxxSy?OKONPWM>Xc&
zYRpL}^;uPztxZ)MS?}}eGp@4|Oqr7kNaHq>zR@i-FW3@8R%K}GhAY+lpp7@{VA9}N
zTz`X$HOQzsm{lf+U`tGECIun5YzNbJSIy{zMiL}tEhzUc$vhj}eY#q+1b(1#$^8t@
zjY_j4|7)+@p?21&MN!*>I(E7$NZGKh%N+~8QOYQRnW5l1SH0+^fpWgV`_o81b3<yQ
z;XK?iu@UArN&88S5|+N-HL20T@&s+6ZGU%1IfVKOtNt+b69;|#_#7<Fx62)Llm2I~
zltE@T%9OdD&lvF{#t02KC(I9G5>n2iEb<aJvkx8n2vPi<s&xTgzHPR1&}d#7ia%6_
zG-v|FC=>074Vnw7bh+xAZ0lY;iJZPRW6)#HA$<!B4PJAoK<RWWwUuY+P*8~lc7Fv_
zF!BOmtJOjsW)Gz%M%Vci^Z8t^m#mPcezQBL*niXoLM5#}Olw+T?#?tF!=lTtUR!fC
zBUNyjzFgIYP6~a<4ZRR#1v1mIUb2E?q~@}$gawDg`F>XK<QnZ&rkbQT9Y@{C(FWdu
zM>u%a^+;VJgI4f{9c_x_+WK&*MSpSF?#qKXDsBRVcL9T&l@R^sH|j`wiV4%K-Gge<
z0~-;g<~td><zef8)NXm3l^-`8bvgpCuW@V2MfpKgr!Pv5YLP!)pMmG#J2(eXZK01o
zR8Rc&9s74w<?FxN+S{MttOi?P`$G$5tdG2!_?2t&QuA>tP3m%VRP;w5Jb!8}No#Q!
zXi)U?zrZowkF=Pg(ZE5T)ceTM-%*G1Z74?MO?69+2%|~r1a?N8gaw3#VN9YR<wRtZ
zQrFEK;l^!}#|<u!ZItOKMAx$;kEN6oJK>yAo`i(?nN4g?oiqtTMn&>TB8$D<0^Pa~
zxOGVBR31}fyqze^qByjP@PC2!D)k)_I}sy{1+mAd&z<NCGUorFc#>c+E?`@#XieMx
zgO2$mX}MUiRV^OrfAph4I|%{aEUQQVWZRw>1m9!8r?SO$A)F02S_9#Xu*Jc{OrQ0F
zr2lIdWGXY>-6F{JwO9(C_X9&)qAdt9g>!*b5a``v%+truUQ3^Qg@1?{U*=$>mQdG>
z9BpI0L26a3$-QqV*G*b3MQs>2w?&q|mZV#cpS`wLG9Z-5hlm=$u$o*e8>nP}z6O9@
zl~)jJ*|7J*T9n{IDmwzle=W?*OF2h22!2_HCRJWqbvYey%78n2V~nXU?8FYzh=gHC
z2^9$?Q4(gv58cEIJ%5*ri0<V{-OfON9mrgLYM|xhsP!=A?|ie5%9c3PJ-VQl!_46O
zhRVAj(@wa+;+f>HYh|+2M5Jt8qrq%d<t5~8ZP)7A25*KD0Yy7cYMu1MQ}?`cY(H}-
z7by{8kP_;6DTzF06VG9`&r=cjB0M~wk13_XB;o4+Q|C(X5`R2A(3=aG{G=GWakSMY
zgu!0Ju5R5!<bv2Ee?6Si*2VwPM@N=%o=mtu{x<>mQsp@vCb6_;)(JU*RF-MJ%0<!0
zm`lzpQ5%t()1X}uj!D4&-^BG!*0up#*)T3Ze&=gZuNTd?o=l?ePdKmG>T*(>hE9{^
zYHNyiZ9X3+mVa<?$0Fs(*77)0<I?*jkx+`ZH~G9kZE?}Gx;AgS9!{#sws};xYi5H^
zZObWSxB%_PHD*Fz;W8)kZQ>`PAT-WGlCYE#9z~Judn}>xUVc@39O~_#c-}nDK#?S4
zwe*3p&y_P7-ZL4Z6WPtB_PGNp%+pn5pUtdz^mA-WWPcLJqbKp1WTTMI-81cO$9thf
zC<#h~4A)=Olz8MSl^=L})j%kNp5hG2F(eF!7nfy`LyB(&e6$zdX&V942)4AA0@iVD
zAe9bHEi`0-pP}7Xiupp_>1X}i6J3IEjer1(wKLkPO|<sz+<KNN^{9HimZ{3KG6i)@
zF@R6-*MEl%T|q=uBcxKd2x<fn4$6Bbg)soB`v+!SRwBDNxonzM{pjIC@OUiFyE85=
zmk&ij*7ZXzsgn}JKZqCj5AgyApE3gj{1bXt&exS7?f06`PkzJ_Ou|371Alq_d<Ogw
z>JpR-HwC{y%pUT?L#EO3zTiURT!Mpe2Z#|zX@3y#SP+r%j8HpENfISCNrdO~FynE^
z;)8{5wJZ0L^%L@^sy+B{75cFJ*|l}rZH}{>H%Dj4RnI{qKS8D187%d&(NEc}ewEsm
zhYxjaZ7Tb&7M)SPo^Qn#(y@$4Czok}(bd^u29;M`ed@)4loYdBVZ$>WmSi}f$zR|$
zuYb*~jm83Phh}q5^IJf!hYyYIZ?tBKLCv3F=uGKy^XRG3>6Xl<=$78tm4zxkz?eV5
zx_u#+>?pEE>IC7L{GMSi)h~K72FluA)jwWzS<$=Cmccar@ENn%P`4-pa9%~WQKq}L
zdPU(D+)zB;sd&7xc)U~bc&a#pHJJl^Xn$9iu{!{=$HVOKGi!*cS<krZeLHj*V}?i|
z1OaU?YO_GI1?w0J4o6CkQCT%Fm0He`O2<1@a1*|rtiuQ&Y8MPXXjh;7D>DCTH-j7~
zkeZ&0IpW?ua=3N(tOhMGzPGwwZQF~y%pn1#9--W~N#gjNxPhQ7b)3ZY{d<DW{eKsv
zR0%;LFc>>VoNUy}JbS%Ctv2g1{j=JF_<FplB%`a~4<3N~=z|AOfM55)10#N@K^C`3
z(nS+r8qFH&gkhvg%f_FB9UgnovG`BJtsvaA3iQ|A1!!?6Wl5F@64=xxGzkQWQ{j`0
zMk0<wk7sGTUvP>!{u&_v%-)OQ(SJV6qzh;{MVrzM`nnI7Lb?$ch`g{E3TCX>r(wv2
zmjlGoN?oNlg)^KL64XQR8UyjBtgH`kBZ`kAT{puBnSMk}FTe~X4{;?Bj~j|t6;p%W
z4n4+BSTL)y24ju+0R|M<7}&H?6W9w*xyvGQvpDh{nh@IwA?+>|Bw?;kVt?if>UdG=
zhlg@<*|Nz|@5inmDG;i6wsi&ctFWyHZW?cZE6aIg{UrEWI-iKGkP+%%N;s%8UnmgR
zp;}mH#)Z-6D!2jTPNUq5T@;JkTtAgk&s5?e<{abONl<Gxprb{0ENY}g_<m~WT^RZb
zyt>p$cqJ;Hrx4fx{N^(J<bO}Fd5TmRF+}Q@zw5UR&)A6~=D_}`Xz~WpQOm9Hg5?YK
zAx7j4%NI|iJUj@uY2mf_*i;PV9DWV%sOjlruFaq5!8dSsMQuY~OA>ce;GRKV6@5zZ
z(bz(o&Wc@sFWsa*<h8IqRBSbRPby&~FFXMtB+E_oypScK>Y-m}8-H1WUw1z03x-%=
zz3&#Hm^YW3U%a^J`Gs26ily)0VcC&rbvEmHR!DDz?rX$CEYafy3ahoz)n>M_p*IuW
z8!+amZNoZQO<-y=uy~1&d2MdWvuR3^V)^VR>%tt&aU<&0rbM^1tDM6zt51+;KN*cY
ze5kjA+5=L@@SN3+T7TwRwAKlc-r#0e<hAnAv!W4;MLr*{eKqfWnPt&cjjLGtrL<DJ
z97&`7v!T!<_w3_m&mlPQLJj?NAEydFD;o4bHp|`c0cvPK0@5w072I2rX2;IZJ$d|j
z<~zUIZ_m4rY{P@5ggo7apPzL<ZS29bLN|}nHUoE~a$R?)jDPl90!>A6ZQ-WPi;2lJ
zycUgWjJ5NERqrL^EfggZQ35K>+VzwhWgph-dL{pfF;nvN73$c8S67v&2Z06JH@tVZ
zK3y;%N$rnR%4#tnz8S7KefsuC1s$N;uF2sktI2uaxq^vF1d6)0)}Np0J9b#ru$(k)
zjef?&SN)&+Cx8EcM~{ZynU7EcFB#Aid=E}pY`wtvIY&~+>--*gR`f1mt*+9gVI#o?
z&WlFv+V;`Zy`_31SFLd$szDgsd}buv)PF7Or`esE<($pn%X^=dXI-ChHRd&Z<@WlW
z-X|Cwcl7|{UBDJP9WPGY&{HkQad@*{w%fQ~FHhyK+JDFjzbDuFsBaGs`1@=U(Rh!n
ze*s<H1a?G+#TMY8*RoRcNPD%u$c6}V8;|P<3AN0NBXrPFFhcJKs={22rXGoo%XKi!
zGr8KwgW5{QasZ7g+Hr<eF=)3Zi@lU6Ud4LqF3FQ}AggyrsDkyAJczF<9QwR0w8<N0
zc+k_cK7Xyw7AyEvXE&4WOn%xoO1yJRrNyo7zE0%(Zki^9N1Q^6UrLylX2cF%*Y<c8
zdqDYkX!jGTXUL_|P&r%esAbr$QsByO40H)b<bmYaz!rA$N%?H9CAXAWH>6}z^;G$M
zuDr;;H8<cL)iH-m5M+Bv8VD~Xw$BBjZU70`cz;9^8Zj?Os9+)evKXjfos-t$sMUzD
zK47oxq$pNCUlV>5Ez=F^4J$F$>!~aspwN?Ax7N<9y&rU!AZgqnPu%rNnBIO59=rj^
z`=7)@G~&U7nf2hoUs%O^KfEX*%Bm@?e_0prt*7OJi)!!$60v=R-{8b}@W9BC`&vLI
z2Y;+dsu7Sw!_+oTWB}4BSLNZ=H)c;edG^Ku7|-Ofbr&uhI}V(b#e_3IA~a4ZiJ6m<
zDD+a_58_1d_}=pZ%8aQ-UO+P?;3Wf^Aay{)09b>C&?O1fu7<$aiU+&8BB0~DrqWpE
z1v(U6bfo`=&%n04pk^iP<Ia`z6NYY0et)r#OQbx#TTX1;v+~jO`Tr}XjqP>`{Q34m
zhdL{t2$^WGd+FqCCJP$7X>&p2rM6(ZxBd-wU52}Ea}85(kE_aIo9<8vzSkBvc5@|n
z^X4kX@1C>?DsG*B77D1<r(VZA(D18VPWspV6HG`C!HMJ&s&ktrUkMPCk7xFl$$vKs
z4j*>~w@toT!^Za}s_IStWF_4jUGdG6Z&tD4t=V*T4LP+F0>?M(u)F)6b!*XsyMjf6
zrG$ArAv6Gwv^1f_V@Z<4e!?i@Z9LR&=KMaq7)4--BxMfeK8bzG2^F4CnCto^P3$aU
zo?wylIU}$j^5g!4u54!eUQ9X3Ab+hNrFKLxDlN)r<S^mU)E;{J9)qq99dz|`xw2kp
z9jS5}eZrP2md_!=MrjR&CYjqO`U>R;LqUzl<QlAO5{n^-O}n;O(|}LL2X+PSn9?Ey
z*h_Uv_QZPj6L7!g^FreCj!sWg>7lB%BUhiHj1P4|PPD500AfJftkmEkmw%nI;Nayv
z>nQPBdvHCoYS{oUmynfgrgiMg{3GJ`nk`olm$y#fHmuLBzerb;OPOR4DJ$znlVbvk
zlP2f-lC2~$YFSo1FJ%5C9E}>d4!{MXxnu<<Bb8#n(C~!1^Smx4+5Y*12RFr<y~?jj
zVDeKL@>bo5wA$>Zv@QWXYk#hTwyB=)bFwJY_t2^O5|i$!G0KaqVs%rk(`H?1de&i(
zY&-W8X&$)8VnNe@IEkMTnns+!nLy$!WKQCy9zR%`2P7D&n@ua#=%*SRx%6;ds%80%
zTco$ZjKyr7>XDoER?{!9pIhl7Pv37{S+n7?I%|13pn@k@0jPK7KYuVnP`3f|`^)R+
zQcsP(NuvFjle(MG(_g9uR-~i}K!4z3k+YFSTDK13glzJU*LrJSSp9l7dAbfH7b8)5
zH<~|Mwn<Dmc24NOkGORB(pV(X{WH8d$1`aNO#i6VudO%pFVzBaW%LE4U#i6@Gy3Z%
zz{X<;Mqkb-{H;<C(SL<lj>Bl4H;&64Q_UN>IZP+=E@q+k_5BuJR`ciJUiAuC9<Htb
zqV0vRF7x^l&!Bv{*7-)XH9=9qfSF36^r6M#FdpK!58g9oL#GxPo44AgjY*sC&P3ri
zc)a{1PnWK|{24?8`Dn5zo<740+9Y1XDrS~HRf{pzuh|E)0)OMl%<}CmT~Oy=uXXv`
zhDOoT_l*!^_xy>M!7D<)+f$(QUmfj=trGL#gv9+hU0f~2{sE;V#r8)t>*8d4-FbC$
zQ@@`4?X?Am6gtL(d9H1+J0PIN&fVc}udP&_YKF7Jpk6tlFY=FIzC{NL5Mkf3Iz6pL
z^KM<_WpRpGseex8mQ(&i{Usvnm;ZY<_(S_<{rdJyryu<vh+$kCAz{zH-f1UvuFDQd
zp1i&24-q89)WuKUUUZ}I>q)o&PTpR0f54;e9zJ<{VNBMqCvtaKYTul^z3A;Dd_!LD
z;}^%<4qjI_(--;2leZV`NYBj4yfFT4wxG68SGW2B-haWJV!`r1d3(`r8+ZcSLO;-3
zWNhwi6j_^OY5Q8W4xMFV9Mh0t;^j`Y(gyEp1IRGWw_Sz9P+zb8TM{j+237_;AEf`3
zUxeC*Cs;M=98{;2@ZKsi_6Qx`kGao*fZ>U+>o&l*`F-7%zRmYlg3Ii!U&<%SB(fXD
zFT<p#Y=1Z|^I}Ih#1?KqsIUcL5%(aH#7jfRbM0{F_<?Vft>y)2_;85`KGvJG`@{NE
zF=umhb-jfO<uxnbPiauPsWauhzC^jMGKN_j(6zzPtw<x7PF*GamXlJdFnA?CSfcH+
z1-?ubU#Q5KihXGHBv-Ja#kuwKrI198bwlKDMt|?Xj=F|pc5(gxv-h^!Z6itA;Qu{m
z?;(fPGZNn+L;~QayHuyuR#lgF?6TI9yL-m+)JXzK39mtb1%Q%OCC}Mw*-P6i*%KM~
zW+F){DJgAB-Nz*Xi9ket;mOFzc*t+LtJ@`0HiI;anS+#5Qu4)V?t1_gU3g!*t_4Zq
zEPr7EiRaY!A;KCND4B~^9griQ8SZx$g}fqC9EI8R=8S?mrMe0i3^bv<tbBcZK>nI$
zYr$#+1yL99{P^tBOFY<AE7sbjCJO_o@sLb8?S>OEH+A9So-gG`pFoFdxI6^Y1z|$y
zHT8TxfM5mG0Vg+2KvB>J91`3}$i1E&m4EkdOK;~I@yfgbl*L<=bEuTvN(GTm@gNG`
zz>)M*cCsFI%3Bb;aLbsx<9t87F_sImPj6_1$E;}JcG5*1R0(PhJ^hwU;o!}J=MyFi
z8pk(b1gA1$mf#|h`=mhnieCymP<$1*xeE#yEV!x66>^PESl^uXM@Fx2_l>^A27ktw
z6UUmP9-a1v=5)L(zU<eMK_1Zn6l@slkk9u1L%dTP<F)bq>}z`VH9h;9o_$Tvz9ubw
zO{pt+b3aq=uukDo$;bNaQEKui<<)ghmr}EXXnSYVvrFllbt!#iP6?6U<=JcYrFhMR
zE~WBvYQ?E!&Sq>pn~V(VjwVKb<bO_#$zU=zTz6zMHt0L<*nPsFr((JF@S#uB@yw#8
z(>Dh0kQseCni>;`aOg2}W>I_EcLuyF;EDKE2=!T-C!%nE&gKhP{X!y2umBd&0rQPK
z943o~`6-Mr7RDY9@|+|wg-mxi<6X2qUqlx{tMh;UANA98+1j=Bg0#$oo`0|iPKYNi
zlzD%hk+bjb<@0DZXP&rw?GHi`X%d%P5Rn<us+ap*z3{mv=#P4Nz8(jOd5s*rDW?0A
z)#<*Q9@dZI?wlnQ0=`$ZZPA7I_o7m)o@E(56aK$Izlz`y=w`fjoG^e5=Dh!wYiY0D
z+3Oan7Q_mvo_n42={@-7z<((XIPn9AZ_}-`TGc~|6W8Qo_uB2YsOnq563n8+V{z-n
zY7G+70^-BS<MRYq@RvU_(f`4254Z1Xe<pr-8A6Ie7`lf?K!fn>S=!<U@%1H~na$sL
z_&4eWxTy%4CaY&3RycftTXbD07{IoIE*!q>X@C#7MT)1-8J%;-Du2%u&W`|K#8bpQ
zPVhG#|2!ZU0dN#M6oOB|`BIpjCgDy~@E4hb@)IO4((HujDO*4ULx;o*I!C|YociD_
z!zdxRko$W|WY{iCAd;?A^4rZIA84UQXT>h=VV{OL63R8Q@68u1io+mHVs;%uwQ<F~
zEUS3UvB;AxL&nK=r+*glTGoJj0gDrH@p8&f3G;g?Ju}o#1o?DQr)VYL&-9k$2}Uai
zdg6mW^Me_D&-j=@&U7FuX7M5N;~u=>E4KF^u-MBm2$%!U$;+lg`D6}gJnOB3a_Q`N
z*gxnU^!`lvF6iO<PIz4HBiRuDGfC1p{Vnfh*X)!gSN9lY2Y;~h@@J@K)Cdg1nXM4^
z`Jg<sMUyh5#Rsw%(Y&5dE)DZJx<6N+{WW_yO^_^+0gGFBJe%#-eV#-rrW1AJJMg<C
zp885EoTUuqA{nLWUC{9VJbv5oP}5iQ*NhGwzm}`d*1vmP8eJw=Vbo~IiiQnJ@wsqC
zBYt%YW#Z)msDI}-*M__dqeVI&t<x+O{+CK--G+w}k42l9?R&vTD3|5#P2W+?-n*&w
zZfRy|tO8tj@)m0y{c_x(mlJvXoL1`vc`qs;06pR%SPIw^zpB#RkJAZNU~!Yx+v>7<
z-b@d@(%8-?SEd?8`{e4p^uwilv{-1OPU<4iOB-FfPJgP7h9eAsRKCZV0RSDUtdd>s
z$+gM9Rv6rOn&a~gHOoP6lX{}d9|T{wbqnzFpQY!^=C>f98@*)zAwg1EnbN9S2#C`A
zH7u7s4G6vQQMlRg+*$-yekN_FGv|uUX-Quj@V}_!eGqW=?0-lAa4XG-kXv1MDZm4!
z0Z6MsdVk8rDN(Rqa79l~;n^*Kd-hb(uL|GbitWd2;fJ?bl@*U?59ec0#XFQ*mwDhy
zGwZ5%$ToU?p?9e83JL7bM4v5~18r<o>aXReM@@uH&($@uBGm^GoW^g0Dx_?^Pn|40
zlW4j!+0XV(PTc*yO>1cnB6ft{t#*gBy#-KQTi33e-~@-@?hxGF0|_1o?hxGFVd3ts
z!7aGEdvFWx?(TLvdw<#gw@=l*b#K)<Rb5^6GI-V;?_8_9R*xP%=aKl5x@siQDF<tt
z5};os=}tv!cA-DRr;<H$73uBv&gIwVUsjVW-X^5_L+*NnD$s^`xFQOUzmyy*Rv*3&
z?*{+;>7&h+G({BN%C#nynT8K>+N)V?BvUbEuep+%rE!DWR`Xi+Kt2#~waS6>b*3y%
z#$Pqm8)0TlnI@5}A@MrO*}=aG2<EAq1O!FjibW&Fx+7|`NtmRSxGSIQZ&Ix2Oznk-
zYvm>CdyrpJTWy)}k#G>-^pXuPaU|DAj+-?2k-icBG!^OHyw-X@(3&50du}wq_Es*F
zcvpV26L=M4+}2B&C3}~+rYc=_$FRlLR3u--mCdQ*@N>1lprx~Z2-Tw*u!XfrXzhXQ
z02jtV#oo4YRHyi$re6OT<v;q3<2W?5gAtyf0#`6qRCdl-`1Nbi^_QWvSIX6ApEo9Y
z$i+DQoT_O3NmiZ8U^t<D!vnaJ&-8GPwM)^uGWm5A8SomuH%rM(*yAYpQcHu*?A@A8
z(kn5=TFdvcY^RCrk1q|zK%?Z7PU{YCBB|MuZ^oF(J&q0JWpei|-76v(GwBDCqpSOe
zYw>Oe7Ps|~Ox-E8XV32RHVd{TY^2oh)X5s{1_%_=7XhuFQ(yCEQdx^EuSdk9?-wC%
zp>`Tp?X6gG)(>6X1>%HR&n4TywHB1=(z#Gs-L!Z#To)*fT3<3b0IVB$c9uY~jLBdj
zivygT7w5I6*cE+7g5@09uH;u+CstyZ-q6+jd9Y9mjU;Owuua+4S6@QQZcjIx3D?fo
zCt1#(1bp|){kVIYTYjT;0|4gxE4jIQi#uF1pW)ipLi8A61MD6Ao)gq`TBAv?7PqnY
z<FqJ5XV>Mk^K2z25Kmp4WT-@0wiC>Uu=0~)y7`;qG1n12-<caUVn}mMSoBM7yFPIF
zYG|NE`1*O2i){Ve9by4hW}o>qrP0Y~=?hF@z}!(zd!l2{2@#zA`wFtuG;A^!FipKO
zh+O}sn;3N|>vw|?^3qe7q^a1zvaF|bcVo7#=E+MRDk|lB0O^%5y_MX4Ul`2(1hPpa
z8Sv-r9Yxp2-w@}X9GX(MMRkVVvWKUa%|WJ8jKuTw+5ml}qdgW+EWm<8{#7h?hT|d*
zInODNO)5g8>2ud!83n8e>ODV+z|OiK9Ma{7R-Q*1t^kMwr%wRGX{wFasFmw^e+`5?
z+-Ov6DJO(1P}Nk@UcCa*g3KjpTopEmKjs<nPBDIce+#Q;+-;V&&3B915Q$kg0Jh-`
ztSF8eCWrgw*w^P{7YD*uTd~oE>g3ztrRDTM6hEhP#~*xO+?N1&udKB#tgop3MO{ub
zR%^EM)*-j*>isiYn;zXAIBD<@b9x%M*)-p3czfF}0H4VCqS_=?RPNqj$QyH0<Q##$
zW{+Rh@MfHOVykKJMB1OnlCD01n{lUK2l7cx?lZ3LX56ycLhZKE2EdSIT>6U6BvZ8C
zf5<?q4u*)=kdcg3w4@_(j9ATkU}@AP;w;UX##>CkqGdn9Wycki`LM{^2R_S+H<ZHI
zpFK5i3}2ycSFsBdM!gzk%$taN4uJ;%^*9B-8kx4+5g(0qCQUMK9{c99K(8kGsU+sl
z`KA$p)opw@O~0J$xw|14zBDvw%-)C?2%bmC!s`h*>Xo>CH`^$9o_gP-#jF1E!jrr3
zCd_;GrqZrcOptVTWL4$OoL6J|>kR$*jDi(P1=;58@W+c>Qu31?_i*W|mb*Iu<q9k;
zy_YeGxBoD;`Xb#iS%74Q=h&!OzJ0unED4vmn&j~px}=q71e`@Eq*_6SqtL+@gI1dC
zSw%n%t4No5qwGjQTWoJ$VHYXOL-dOKxZ2c79-^}7g>jlt_+I#gdn8L=YagE(NmGU-
z0`Nvii-!>zoP1L%X0}o#3DXZWdBBAJsG3#1u38HH$$lO?R7BO~10k-WOzVQK70@Y?
zB!}8E3Pohk!R%^c4heJOjXXG=&=;__ZdxvU!0!jkwthIw>3JP;M=T({SaK$^*O=@I
zS)kmv`IfLTzw!ZfM`0z=@h15P;=%&lubazk=k0Fv(a$LuC?d?FjV{i>sA`*<2fEfy
zsG@CLl*ebC9XpHr*eJBZ><5W5?eEB~xmrfJ`y<r)xkIMRdF~GAQ34meGrI-S+|}F3
z84gD7UxF9*zkfes{AA@@jfYTR@zJ98;zD;f8<KZwTY2-@J&RNQ;e|;WYx<JfHmi%L
zlTLwaOM#EsCwLK|D%Jc9NGqJUokHUJcofq;Z4-mI$Q!QZI^%zm8vkOKa$e3FnfuYG
z5v$Wr@h7ngOmB2F`5}E@+kRcKRZ&Oy!(xhV#9rQF8`_WD^>CWlw8=*a!uE&96#fQ@
z(_+1V2O4r?(fv~NId#B<WvQ*7XNYj@O4MDg&tJ)|{XjzlLVbx2xQ^UdF;&O7^}E(u
z!chF8?w*j`p`~U(q^;4hK{Mb|QPuR}T-zY=X9g9i-sg2cMYTud%cj@(T{*h%nH)8|
zG1aTX7rQ@8+{<!DRqVkJo{BDZRKH(4)a;vh)b`jl)W&kPuxbw3nJQH%nOse;jZ%l}
z?U2|Uu7kbYp*w=#0NVbEiNhXfEuq9;Hy&347wr1?cP8X6LMAx5{G=DSq&@u)LNHn9
zkh)Tz>*Qwi#~idZG+UF#w0q9Anh_ICNqA<ALPu9R^?@fZ1=VNY4Oi%CExIU8%{+$U
zHZ{;vpSQayPK3c^f{S*ej9Jn~T6W*nmZY7!l@Tsqnw@{%0{B`5wDvRCfk`5VQQ)sX
zV;lDCbn7kFNa!7y-&X9ey$sNBis8*PDcIzQG;ojW1d2|o#bxxJm)<l?h9jD{etE@2
zlrPTv>BQaf!k@!S{Iyi&e$*6m)X-g~JF)m@BwWHI+vSYH4%EOx?hz(+z2uY<W|GJY
z<gD7>GZlv%8o;3Ta$p*&XOrvcbE&bVz2PS&KI~L+XL`~rdR~41EjzGE>nx%3K0el5
ziOYsZIzOM<P0p)?ABVg}T|d$YdYhZPmS^i|m(+}r)+WG-XvXAdJpk7!)M-F`IMS!9
zMZ1TGkPf3wnU)8)Nw_ma{@`7_rS+#L#-|1i1x7Igc;LdE`kG-t0xk|GlhyJ^FPw!Z
zC#|c=3O}pF-5n%Ll^Dq*?^w_v+U(AAQ)~Qu@v4Lt`2KJW7_&cN@CGb>CHAR#i&68*
z(D_=1uY=_A(pEhAsdJ7w&WPj^xA<@-25Afs5hSD)5W0x(Q}DCT`<-8kcEQJ8mnh*6
z+!<p2hd@%AtkZU-Z!BlKBY`3A*>SC=bdzE^4R<ukXV3jshud_=c)6?|)U%zV=>k}+
z2G#6my_i@!gfrWww*vzAfe<XzaamI<o!^aJIwaTnW6_Xhr}(u!S!GBv42G^J-4?c1
zgH@ZuXAuTj#Da}fHv|OJe<4x}Jq;$ZYkX)`X#pJlA!y5)`nyCAA$J>Orm9->64O4E
zxWLava(p|@zf9!C-MH7_S1&+5+QaG!@j5oq#N4p?Jj0l~>lr;3uC2^a1QA=Bp`j!p
zAWM@fL(}!TL_?{>_tB&qxs8OsbVFdhQh3`<TW~MhYd3wWj177x#>3It<;|9Q*iwbb
z5jha{Itotg)w_&f1vWPuz^C-)JFN}kB+Bfu;j6#3iu2DvqDgBd57G7F%-KAzUm`7S
z!D!T!dPr|zKMiqWl4h&8dhi;b{%j`eQAv+G^>+)r7!&WU{`%h7DQHgm?7{hL*Y<g$
z<;HMZC0_n|M8fPz?KvLI{6~C)_75zoD~bz%zIBZ*wUSD2qItk77PKUjuyr+E@lr{Q
z79rC3z*8gWGk}wW68;y_<&q`t?S1DeFc;19a;p{5OVf=IrDn&USGNz&Q4Su?5Zek(
z**c%{<!6`FFCLt~u;A6pfQ}(Gc`Ph=#TJ3@)OhAn;xn|$=Sx2!WdYX)J$aOt05Jnx
z+9@p1zJ4F)YMsE7zoY>5raxgdOUu1Ogu^sg!xEZroIlP#3?h>%%=rF>QNGQewG7HG
zK$nO_U=W$ET1L4KM?;++zOnLlG5yF(I4tpNR~3AjwTis)!qT_g0%G<_rJM-zBewis
ztvlt`@3)3d*_^YtU!J!+c{=Ga@zB=*2n9F480zt64SHg=`p*JEJt)XqPIlW|%49w!
z8Ful*$%k?q8$MoN3mW{O;<0%S5jzNd%P;g^a8T*MmpJR)dh+Vi__moL6_HJPG>4V7
z()^GgE8exeJ9`63qYax`e6B}?tR?J)j9@tkmiE|D!)%ZUTDZh4^R^Ab!&vt#fa#Yd
z3i(d8Z%Xk!bYPrvKbl4>W=iZ47+1Eioi%n9mRg|4M(@kxbM(3P^xbne;m)oeS+?*k
zxc{Ab<#E!1#v=a`la#q&P>bdo9+p6y;=BF`o}@v{<gYq!d&E(7&(63d3;Z`F><ncL
zSH5q(Ah_bto<%S1E`Pafsah^Q1X{8Zs*B1Bzr|%h57h8%<;iX~EFha?J;}Ju^gL-9
z5~sCp;_^9kOV~G`v+jy=mQ<2-jD$h2SN!z(f>2Q0vlp*(`g3j6xhQn!(+C&*2xaNG
zO@f@%9{dB?(nd9`e`6q|{yGCOtDp1!lLG!4n7PI=b6)93Ek)IBMKPHBEI^*gM4J}#
zu1$lhIQ1znTl!mxNtU95nX13Ux9JHN#oC7xo$Kz#o22{`;~$P?2V8<%|2!m-kWJDm
zIC%HV9&45XDMA-V0@oQ4t)+Xgr%j$nOr|}(_0_Vz(2hNES;cigUa(Qs3#Maaqs3Ze
z;2V^uk^Md;kOROrXVu#Trlo1!MwX{RzFG_bZqn(bv*9Xu-Q^YbyNavx3h6sp(`hpz
zw-eQp{hOl?vDTDTOZp>p#4@%Q;}OYj%^qxsU})^ZAJUENbWsS(3bne|N)T`g6R>wA
z?H2^*B7kGYhlRO}AK;nbltHFOT2PmccBuoGyT+{kr2x-Bl{gEZyjdxP=~lAOR;Pwb
zC3;+7f%ONu_BM`NRJ|KA>1N#&l5|{7^56@+16h+AMVixJ91#Ti?xY_RHfQl|Ik<Sw
z^1$5&tb=`qYzUy92=3xryf_6lPhw`nJcg6w2L+g+Ie~Xjcp@$a%D?QB1vek*8?$G_
zz9c1i6#=^`_l3|sWC|IP3CNRCmPDKL5J%tLQ*kBq&*7O=2c@F}*`h9ygK~-UgnK4g
z6JQmDy3&d}9xY%iBf?s#;v==9Xt(KN<Ozpc$@HLg?dMz1`CXT*trOlf%iWe3MI4`w
zvWTCTpKj1@wJ&bZ#Qj=gNB!h0+%+l7yZJ%mjTZ1^ufEqJqg5t<yTsbR*~RIK-A=Tc
z9w-;+-k<l1M=vAf80db>?5r9gQuuwXw3p;PT+JzLEBvhmW;Yy;FIW)f6Vg1iHVxUO
zeuhePyVdC2CvZ1y#~kCfdRkR6p<$=ha$|TNa1#|#_+hCfj?ocu;V!T?H#=N<u5Wzi
zuHHbXz1Dtl10>Y_8{%TNYws|;pgtz3&d|Y^EA~|kksP9jfC^drHm`bNj__`mx<~=a
z$05iTt0=x+&8vnSD4cpECCZ`q^RRXIlL&tDSLW_8sVYpx0XK+uQqA(qc>@9NlXUIo
zBd$$x-O@R-`PNl<ygMmevIDhE#`Mb%dP=}ZvC+>TMpi$l@lr?ESZ_#FF+PVk#h;0^
z!s{h{Nv64%Iz@IGRLfR4jJY&BOrX9fAk<ZKY3KIzS(B5}tLN^TIwU;l)J!4Y-L;bV
zdT?1#HFleqs6ki2>+kvEo|u8(<0mebV7M|c`Pjc)L@3j2_wH%QWaXI`ns2P)RVo;G
zxR%dWi<Aydxn83il)ct}Gwx$GrO{n~kESH7c8FVTY8YwWl_6dgK+4d4kB7>%eBvYj
zRZ71SKP&1QCN3rX)H#2;<X1mS-i~8j%2@8VNMUY6zW4h{wd#{hlHT^_+w*k!bw-nw
zT-6!k{RC0=M?H{lqL)0;a=*=#UByQM5v4fSd9e|#p~OnRLTPxFST!jGb7`e9-z)F?
z_%PtNti|*qAH6Y)d<R+#?QZitVBYm2zyMvY!k>>Hd^QT<k<^KqNy=1R3^@4m%^Xze
zZa0#JF5|QPMEXcz{>f;_WF>GME%+xA?&rvNMsiwBP1_OkxAW1bv$pKHoqY2%0Nv+|
zy0gfHM&hMT<AVm4OcWb2F@T)_Csu2fDS*^YKO*osm@9cDr|%_t1bq7dhgCs&{djn{
z^?)6fR~GRVy55`J;e&7sztf?pE?ztQZYZOUP>c<55n(s+kh4^i!JtOyH==lB{t_oD
z`BWM1%QCihZXB**H=be(ZQ*zbFlUDrTTZ~ox9Kqr5sXnJFdaza<yhV1_w^X^eVhAc
z&&>+Wmr_-G6tpVCUV{U>cQWLBYr!;U(kI`KH${--VH!4<X?3;SW)c>7GF{Qv+BtwD
zXC`*qE$;+D(1V`Rgi1uUV|>qw*kg_G)ur33>|zBSI*{}A?Pp()<Ad!CfUn;E=U%rZ
z)-D-%bFk^C`;oK+_JRr=hdgFE=58o_N&D5RQr<gnaY1-V*V_fqUE5qh>ZiHr5AUq8
zO-gpVF9XA&bI!w(10>&KOtgKIdW`j6ub2o^^$5JCB<U*E-n&M0>88)=-GSHTW3L?P
z?7@;X0?%1JL<p~(NyUC%0ixupIUF?XYH<BQp9HL!!O*fsX&}i=d7f9yS@p}9_GObN
zPDc#;>^YNgZie$5tvIXk7MH^pUO9##nQN8b4Vbzeh4tI(;8ssevpyt9hF2aVhJR-{
zk?y<knlLX{P(1#|u+dB*KjZIDc5qwBQwN<BynaQQFyU14oyoC41n9;I@2}&*A1`8A
z34i#+ADU7_zq%N<YyRZ#=dW*P>3{eMHL_!9Fc$d@Lw~B5zW7T9>##_h{6He>KC{sK
z?}r63YxRmrXUYU-ifZTQrk_3NRLuRGbLD-v-IFM;$cWxW@n>vTmkXGej^&Fdir<u)
zlNd04a!^X(dfpmIv;%aUH;(v(Y>zZu8F8F5B&}ZG3%xPI+PW<nJ0l(VGG`@0UKhKT
zvhzZFG@42_Gw@(%!@d@JJSuAY)57-C3B}i;Iu-=|X~gt#?M23TA8qp~DHHpQ{CR^g
z=U>7G&RM^NH6~}z$s4pE=VT`t`{7}78cqsyQ$my``SUi&7+wK3DUBP_@QC<L<`($r
zxTgjwE%Vq-W>_-Tg|!;^I%*_`hZwOXKITvkqAY~T5ZQa~^~+r(_3bYN$2EjA%EG2B
z7W4?!p}pFJ%5wIure6iQ+^cqeRK&U4Sva;gy51q%If&$x4$q3Jw77TCL#|31npYji
zrH6!Hel5nS`+*8@?I9YP7J8lSpr>JPYrSff*P~GPG`-~8E)iWaTkKJnaf+K2Ahgwx
z&BV;$MU*X#MCWM^HEFm8DGL(bOf7Ph1AH&%r<4r9Q#>99*UO>HHX^4sLmYp{WLk3l
zclw8?k)5j1)d8~eO;)O2xEMv0r#799pu|fL_XJr2gG+#${8}kL#+mDt&7<IHTuUqO
zQ;S5kKgM}giGVf_7_I4n_)fx0=0tqFOGq))h>1OH(3=5MjL(`?ne_T3r5eS~7*q9T
zTzV6dFU%uf?xEa1S_e}SZEeat7<)h@C>7qi&OhuD8V?WA6jlf8A~Ex|aJdnjG~=Fd
z1>E6?Jr4mv=SGEuv1SKu^m>B(yRL!Shw1Jm=zSK?Uo{`(IU;-5z~waZq%#f~u5n9d
zDOEO^V6jtOU@nMVI@a$SNIyv1z#Eq0YNR3+UOCb^*^rZK-}^_=b$jWUV8mX+C@`R6
zHDHa2B8nqTepI}WB&L+H!FYij3%bY79+1RTUGoGeY`QSELlaT1ea4<7wb?$D_M|<u
zPUCRhx}6Wyu|VJ5MfW0Ed%S<(C(Kxd`lXy~#0}Qz!jeQ21HA#AX;o_3ar=IT%1PXt
z0*PJJvyvrGXH*XSt;Wqf>IC!Ix6xK?8IAOrkN4YMymoSd+V{b({B|6!SfLk2y`#PE
z8>E52$IYVhGEP~F$SE!A)z3_)7BO9Z%3mU)^6R%WpRQ$X;^}KQRm+w(Pl&noPWGAA
z?!qrZ#S~M;C{u>Bamj|=;R9{Rg==y2;qO<=);e;iCRLQ%D|N&$%?oKnRH*ULk2~NJ
zT=M2Ixmd2!JW{2pM!H?HCRsH!d=;G7lA6!~3DE8`9+eaPw@E*WYpXn~zOKGS6CX*n
z-sE!PP?=@U@Ju+-s43&c5K{SNQF|T}WU$;fyi?oWb#>V`X?ccvV<H58%d63%H_MBN
zxBCh`{6dlOh9kXRV(_l5Wd28)vq{8<2_*FDF$z^^noC5}WK>JfPRrV^vvNFHKGdim
zKw5GU)fN3kI~hbRMcsC=vd_J+GV0aFNHWsAt#?ip4)E%~=I@qk19Yj>WQ*&|<sW{F
zo1EV?dq>$qdE*und~->UL>x@g)Bck48A(z%`?jZLWji53JRW?fLe2dkk?$rR4C}gA
zX{@@-cjR3p+!tjTvGSdq7oSn|#Dqpw08HOAsHv$roq~_H`tstbOZA-&he5!0^f_ef
zmE+PEtWUkGo*R};9Xq}Lhi0XTvuw5Z2Tcu1sSm!$lgTZHHd4BMW#7GDg?H{hA&Bi3
z>EqN1R7rR`_osXey(YS_;Z;{dxOdml!reO|72jKdvOnQ^6adq^RO!QsqfXZB14<!1
z1y8fDiKlKqgvD0L(DaLch<wHC+Yfr*^Gly&2p2D=fFr#%q@XQ#u=t0=AdAYh{0Zjp
z5PR2r?7fdIvn166Z^806_Q8X@PW-6mjEUh-U>2ZO6O`iRKpryLX4rDK9mFC-ozk68
zrIh;1Wbu|bI!Kxuxa)|OgsD7ahd`&gZ6L1-$tpv@OHN@!_`ZNGX-340NSeHB^YqIN
z={UgJwwe5rqXsIS5iU*uK@V~2DZD+GABgERkOEQcmvXctMAOj%<hID8z}?v#+;2$Z
z+PEPgg=#jGmBdzTxSih7T2;LeaL2P7*G?4e#JbtGemFe9HzsX*T2Ee~0A3|}*K;Np
z=a59LzMUql^eJW5tGYOb%GTFiu@_9=!%$T)nmhRGkjf1nyjx$H#vS=cpU169t~W>#
zSY2bcTCF|%kp5=;<?_yAJGj^O!0jA8G$NH?WX+@?j^x1ri%!@){NNF8?!k`vR%rY-
zl&~!_mI|I8@G6bOTy>gi2L_79jE6t>7}ENPLef$gg0^Z4H0X&N@giLUca&e<jq_Cw
z)AxPty<P4_!t4a`ppE8sU&*ap4i(=;ol-Z3fY#R^I2pv`yDN{LpY=!X4I5-J3v5ui
zdoG?CGCkKWT@i>}bzEh(e4B($IJ_MC3uzy{i@{?xPe5Uscb9(<;A$oRN--YknG1c{
zklIMhEV&UW<c#KQGt6@E+VM(qN7?dr&K>OllA4-S`-j1T(|}%W#BQ;oTU4=&C;8;j
z&Q5+veUr_@#Gy<g(-*t`Wk0u|aM2UulO0*C8*7~glV!~sPh=-aOQ{w23d{Gj(NPM#
zqbj{N$;r)iHtOUjz;}oUXk+3XxoMPEZ*r@!moIx{aA|jXqp@3%*-N{iuXiOk@)8Bv
z$g>3FvqwYLZqxA5tkD|GVxw}M(N|zo(`T{f@hh()&1c|md`zW(=wEM)zi}O-)zIVh
zQsa=lepW6{G}YKYxv~CoaD`b)__9MTz)&#$1$qmQTdfB}7dSe%_M^c;lfdJ=8Av6B
znFl0`JN*S$ti7Mkwtq;a9@B+l_rPENK&fepr3-_V@{i`|^_F85V()GN7kySQ92Xwu
zvMci$M`CD=%WF&Wm3UqW4V4JMlhcuI(`fMjQ8p?oE^Z1Pybp)tnkh_2#|Cp5LxW);
zvWmuri)u0>24LT$myOXEtx5~XLup)dJz`vk`-xsQxJ^8)zdzlelJL5r2^+xUk0sM%
zIzn-Nn<c8;o7Ii`fh3PkaKp=tKUG^Kqq+-Et7cCWj{a^1sko^*3vE_mcW14=j~6~O
z(q0$Yu`~5s?lM^zeA5}dn!uXnlo{<OPksRb@;9-ALqG{07dKz${q(J1xaFR*IzQca
zmtctu>}ruJVJ<Vf{W{I1o%hheyHWL$8Sz6`ZlYNW$PAJ=ks*4F#{T6r59U+QUdn1W
z=ncltXCV_*M0QD4hZ?Q(FzcnBpV-lo0hOh3l;E*;k6vggC@+JkJnTM0iD@`XFFg*=
zX`!U6R)C|O%w{X@2YEIJG^Z^6H;g==l!9UVIzM#RB~6DUt(pOZv?IP2<M6u)b=zK@
zwQb<FVtpgW#bj#hG?tg-CPO^haFDc(fP1H0rC9M?%B2WlJwSPB=ps<VcR`Zl##d1*
zK_>5T^_QQ;kd=)8bKZgP4-6SzjKSeI@;(+%Y5=;Kz9((ttHegV+HwJPGwnsAVuk9&
zQVvbqqr0?4$oxB8rF3-c{fj`!Imbn67RuD!Z%MoLOo3KzWZ%KZ)<N4n%<|vWx^n@)
zmb!#1mo8?8&FRAGaKh{2!s>d&)YY&oIB+azuq{Hv>uMRBR*mho2lv|M_S!JSkZ{5Y
zr~qs}WL&=Su07qH2@&#~K)swmH7q_;R@YqptIy_FpW$-)!^I-w!w5pd3Cwh_awqnJ
zV<yllC(!7^*xg3<atokjT@mhb3j)_sRq}&|QoNE028PW84D)f=H)BKt4!uW*4V?{t
zth3Oo>NgO;jF<-)=i`X|9hw|AOaeeL*1uw(K{3;O9HqZwzlIGPKq0ojLP4OAc|MNe
z-=T$J!#Plh{jbo#h^d%m0*);xB!j^hl{yo)M9a3-M;;143*M-TT9A^hTsl~q4{ckW
z5}leCu+*R*z3xiHQH<TFYB~@ui2-1j{XfS3e}$T{8|VKz;_>@^@1-NdEyH4Bj{l@+
zDP~#sSBjwdSTY|>DBSpNJe6NaFfd{X{CDX8h5G**DqRg*diX03EJVFiGiRKDVI*VA
zZ?}s3jq)(+_ZO|gb3L|0$}=K!jz-lp#+LwlkTk8bPIaE|h-1#kq8D4GhWAJvBKs|_
z#R^nG@b)|NlS7@$%!wTfq7;>~jva4AcBJ2-^xq+Z1D(r4P{=F!cPJW>J@R)b_OB3#
z$_0hil75GRF_Lm;;U(%i^$=o2D?TF8QoQ{ZVq5|nVFGyfGg?ZU*W-|Y&Y+{2_aLMB
zZ}s7CHN<H8TQUEwMi`BMEAGG57^C5DCH%LVVATJuB>q-YjC#M7{NHMZQRlZ(`&-R2
zYDph`k?S_os2a%21|YS%t=TG<O`Sm(!+a@78G}>^K@A0F3WhU+?@W(l@n2VAJxG1~
zmlFAxBK?;F|CidF{_mr7|F;4Va;AGyh5j1e0@}oTmhtoNT($n>D)uk+5u`TCjHc=e
zK-rM~_i+%w|D`sk{x#yiRL*}Z8U)|}mI&Xb{2Z;&Q-2Yu>eLfdnmik}{8IjFsx0Zw
z5<R*g@L|clO+%thrL#;E7rGz_5<9yfsBtXD!)BrW@-T;>$5zpdU5+q)hLcEJrJne?
z8-f-~(6&MF++Jwv9E|R4A@hHWB2|F?F!TH0D{y;Eb(|8Lx*>2Azjs4WBT{i8|8OR$
z+5cRK;cPLN7~Ks)g(SzKg<JIdl<05-&2*e3iu6EGC$fQ_IAX}ozYK3o#Px~5wXmD^
znUS)!fZhm>eu0&Tr<^Z*Mku!#Bx$bgFxxb2VORQXs>2ew*n2r~xCesc_Y?I8Nz`&`
zLoG9j)_h1UT#n7!%70D-#fY;-cED_dzV|Yb5_ofJqEat}NTOaZ#0P+E&=$RVn>`P-
z+H-j_pK6!JOju($wOwt8xuI+fYkffyTjCJLLK&nbi(5=jBVX@uqek7hBV9%6d@R}6
zF}2~?c9nmfnfL1OcQS8FSteilM7kPHIC!HQGI4vi5LNp|^Q>dFHO^{E@!Z9)!?{BS
za2B&*L&<#N%*)^P*fjxqb>n6X=g}i^)PtM%EC;sp!i%*X_Mov9Kw~TZH8ylvEDCWU
zGcl_?@m`ld5vj-*0}<m~k#W%O05B*D*eE#ED6H!rqoPR)t4LTUNsPNfiAcr17>F6?
zijDi>3W-Hz{)`y^9GM9#;1fn96i=KLO(KLA0f8;<^Fb02CYAP~;Du$*hEUA+6Z-)n
z-GHjE5BtL$HryW8^^80TwF}~FG}BvyQ1e+|md>~+ilmSdSSnD`1PwC6X*wU6DKkM1
zUDvo_U3`iLzI%aY<Iww%4B}lri7(hs(9D6dkD^Knp?&uU$^}8xe;^<kMCJdX{6JLB
zKhy`%Q2$URAc`i_Jo?zxnkEU=7V>Mf=G)(M2|g<hgCQjv02v3GcO(r;VpT?TRg5p7
zbHrzz?q}Sopsywfn$znJ2h=JMWbqG#DJ9wm83+7_(gabMe<)`VrS*rp08t+QP*_r;
zP*8DnRhmeMP+x_+bUsuu{;`7MTQtz~$B90CJ_#=PfBYjeCxwK;|MCA51Tp`C045MM
z{D;~CQ9S=ptVtp82!E(a5XJh3k^@20UR9!Xhn+Jz5(79=qIIC8{`POqh>nf>$4L#y
ziNzl$8&F@P8~->Nz?Blcf%?b4HHgCdL-l|tn?Do@^w;RYe<(aDQFiD*L)n8M{4aF_
zj(nW>Qm{p!qz?W#=|RjVss7_6iYF=L2=R}TGtimj{o@1}1W^}%sE<hbBvb!Td`ThZ
zNPnn15XJw8+6O@of1n-^bP0my%b;(4sfhtb^m)QRPTq7W=zINff(r9B8WQY37fle6
zlqdzvKmL6|6wx0F8ASR0q2xgn`acx0l&B%hAOC?Mi1-gg1cHJD=Sdc?*Mb<y$x!l1
zBq9Esf6=56DU?4>FmyjuiT-f{==v26V0r)NRg(*%%>JQ1C4~(CLlJ<ePk$(H5JdC`
zB16q53H=8W2MvWvrLNyhpn;n2Ck09>_Ky=`*ssxYf1G?Kml9Qi{l|X-BYHCVA1fLl
zD)A5H1EO^Qp(vz86JY=NPXR#`e;{)Zl=>U0?Qlr&v+9!H0x7V?Mjd=}t3HPWlGVRb
zge<Ejb4U9hrTB08e@N9^4MS9cC!UQ!z!kg>LA(V(In{x3Qu<d;b^ntSxjWkbO$7n6
zO<rF<0f7RZ7&!?+k=Qs6u?@UyI3d)%vcU-;tgn2WO})xWRE4!GZ}qpB-z<80S}&Mc
zm7iF3b$zx#|NV%Z4}+u+Wv|WQ$joVD%j_GrDPq!5TE$YYGaK$3?Q!^IZ=4L?NPgq(
zpu?Zirc}NQuQAI^k#jzd1wRtZbfOLp>Xr*HGKgHBh&sq+sHThsythZgsPS*YgvOGw
zH&@J!!vd;NYUk|PvAAx>>z{T5HzKR>OOr8s2lszhCT2iwP)ZpF*sb0Z)jt_5=(5ii
z>{Q>^Yen4}%$Lr7NAtJgl$5}6rxG|A_tOlB?q8diXsuncmTA=yr64Y4*`Xz6Xe5W?
zY7fDZ9x!=NF)R*r>`*LLX~U7KzfHHRUg6PQ8`lSfNV$z*Lnr0X849~^7SdZSE&GLT
zPGX5}=*wdonrDf(JMjWvP_H;`ZWrzahgXtu=OipKpJx2m>S+-{cNiOGLl~aUJVrvO
zm@`Y+a18kCCX(=BTC01>rHXC`t;1fr0~-AVEQ|WnRe?axV2#m4XODrQ)h`Bz`-CA3
zTI)>?q1qMo)A<5F$g>Bj2{b2x51z|3v@X>;DE{1;o?4PF4t;L;lV8S;5$9tS?710b
ziY}wIY`M%1TbJfD6X{jrO6+TY@!Gr8rbEc|WG)nG@2?z9k?1icy=<~wCoa`+z}-33
zPW8zIAshmbZ$s4(zR~Dj`bU2I@o<-+2WrBmhG~$95q-*D?4^OW!x@(>TYmfOfn5ns
znO1PSQ8vRuIfpBezRT+|*!ddKz1Dm{J8@xR-I$wLvXqDDS}SZ4p7=8fn(t1#G>t>s
z540~T_V#&3?T%^k<dYmW@;%z*emD(T>dFs0JDNkFlEk1Isp!k68k?^O%7IQw4XLf<
zFQGHl0b*9hS5n_lD$OF7VaV977lfH!vi8OdSq`eanUWC;`Z{u1d>87>q{O=021`7x
z7*X7VB<;k?OxRtX-irx9otW%F2A_4-*ag-8V4q~r?dsSnQ$6MOM~6*?%YQifbQfYP
zohn=jq*A3M_y~bDdEVj=7W?Qs2pQ^r^n_o6oQ9eg=>27?4H2NL0fE_xGN=|$Ml9aU
zVxua|CqQA3Lmyi!AGu_P!x@%4go%8$lOlRXa$&VamHA>Z93+V*kuTTK(jxKMwiiGN
ze%U=&zhH(3+ac4nf5WY%AP~;{M6yQ!`xu7|_^Kc<r;wFc)CZe3$2ZLbPdgcg+6l3K
zBdN{m59a6irYA0DM}_cRMFw(i2NCdg%(dY!`fE5fyQ5))UJ+~Gc(BI|nf(<Ie$>o0
zau`{eSP%Z<k7gGIN)4yA%iOE{$d}2%yk@^t?hN4Eu6=r$+m)W?{RRsk5ztt1BRK4i
zxkL5_`2{hh+(Q3JmBwjC*bV%Wo$360V)F@v6d-?t#nzJc;OTs6i%q%Sa_vJl5mS_n
zU^Utxax;Yk;ra?IXIih(IdZmFGD~;`)&0HGaA$n)D>qZ2wC1;ILL?2R$yE5hoKM|3
z0xUo!^?NqA!*{Od>Nks%p-HLix1$rJ4w^{mD#_i&XZI}(To|V_%{sL%QfMc8F0U_0
zwt)BAL-w_gM$JoXFJ>uXqw&4{&!@@SvGmYA5+XoB;uW>*{U|;08^aS&>y-k^J?)%g
zA$4D#my(h4I>LP6NR`3cy}5>-t=dWVuk2mwHnxYCn6$jBk%~%{y*{VJzp8jHg#>9<
z4MJc4ZlXTHOz?_bKcO5ma%%Ad^-%+VHB##Z&-M$%*qsoQmm8-c@7ZqA*(EuREH$&N
z6pM3`4x*EO0-ysSxhFQ8V~KR-I%0-{J2ZS;do;XBDbLGVw{8p?;8Ck|<Xkbe-K6+l
zF|==D30I;RiTo*?fN!wDXem9`&wEF7S(3AoFwIbbxA+oIhjcE|=`;*Fz?PL<gGO#*
zLH!ol8ERw~BY(JXVDEYKW=E@2D3J%3vftCNahw#kw9+cawaD(beQA@C7}7-g7{;dJ
zfyPEX6jBzXgD9~u&h@Tu^v*^r>Cf?apH|qKc^-JUMvEhsoCncYt~Me~U{%60nC5og
zkY8Zt*Q$7YYdvs5u}uKI5n{(SgW8dD4-^!WeYu9o>021vc#trAj-u<$2`G*<x6lp*
zEtnGhW@$+poiZOzT2dkbE>feR`QgWpCnuxbK`mE&EBx^r{+s*#M8Q;CTokX$dyp+n
zLi5cj_VlC<l$Xu7*uyed`Ye~Lt#hfap1#_RS5o|E!2Frnv~AZt;3KBRP11VTznU;D
zfRs08&WdJvVvc+2?j!#_OG0NY9@BkkU?@R$6*j$ZGNuirqG`(h-Hr|a^XNO%ek9Z{
zd+tLdx0?lq)Nc2T<_JN(8z#PjscUUHhC64O9LYWo_>0l{3A^$t2J4%*Dvt^+X&4NP
z9Ct;cJ)<Z~mY_8>sD&neiF7Of)0r(5{xZ%Ue%`@`&|gI{T)Ah@j(TEZJRQJ!ZZVtq
z{v3h=_}t#K$kx|~#Aj;8m?-mDv&zwj2zv3xrS!!$4)3LIu9sLv29&Y=YGHdLYB~Ep
zm9Nr;=d%*&yH(2<1X8F<r<e0O$Gh`UM}4jatw+dqKl$DL1a>>VwgM6ly%EO~oY>-k
zMKhiYieGT8*s0u1FecA^-QwC&znI^gy{q^Y3K$Ko0`261OK;yQ-`Je+!x|DdlAhc0
z7ewEJ)*Wqna*z=?20wVgg(Kn(_}$-4;Z&gtzn+=v8Y*Z(7!#^Qe3mVG0)y1$ou_j2
zk-+H_GF5zOe2Wf-nB7Sr$)ncVog`*m%xYTvX$^zgv5feleaK?`Wb!C^B_`cuiCZ0(
z{0A_69Z~L2p&Kb>`zfcN+LV^^>d-r@e#pR~LT`+&ksxTGGQrf?OtF<TcsiBaiB?GM
zmV~6+3pED+Vq84Y+7|vHrA-yDY#lf(GMnlm^MGlbNOu8&t9VhhB>OW#kRei@$qy2i
z6Wa8l{T&1Gj`{4*#Gaq50+;mQ-EbT7;Zp{-y*^~sf-3uzcCLe3{?p5?8*CHI+mYI>
zB%Yt|uP7DlZWl_G52&1|3%F4dGcF(q0lNuoNJ8|JgTbwqc4M2w&EhlWTh5pqzoYhd
z_y=|fi<qTITNOWOe-0csXjaIm=8fjta@=M2ubjSN_+`O%)|v?+lsBCrkssGQ3wH78
zMDwx5n;<VeKO@`v`)P$adQU8I9DJT!7=_)GaTNkV`^^UVb?d6jW&TOZwO4A62r#y6
zXauP@<ifE)c4k^k_c;Rcd7IZ+8f`aZmQbM|iYHC6l>GpGU!>EPf4eirt_cNfgir%Y
ztEx8?#>9UkX_HNMn}#HjYbEVrQglLTu}b~@qJHB2N;qu_(#gzTw=|)xN!Q85*14kd
zCB2Q#7tno^&i-R62me8GW4V#!DiA1wO>_`fyo$H%lCh(vZT$S5S3qRr+eq1Jl=kCf
zt=o_JcWGn3Jw&n4_T77ptk<f-5$*z-_~TrmgSt&jiP<o-p=b=&F-Je(v}a4MG8n+3
zz6i4z;n{b*tA|RNjO3Lnhp9h+DfFUocd~3B;fTLT+z9kIfMk3Bt?4)fBOV}^(M)~l
zk|>!z_#j@knD9fWmz^r%SEE8Hp69Vx5o%32jiRPhQ2dW_c*h(Chf0N6GlOUfCFzQd
zg>c9CctEqUsa>dK@yDg0Xzc|U`3y88(?fbnpy)2i+>>F^>`uMXql~BIoX@?c973JY
z_A7#0r}fo&R7L>F;}%Kbs4Rdf^hg2&enFWr660IqGq6s4{}rO3?Lsn7(Ho_b(T4?5
zCA_v4vHVn<!N;=R*=uF|Vk`F9(6a3_W4#L5=Nv-o+h-b8B4@iDjR|A$ikXe=It_An
z?uRX*d5k)f!^*cGzj}?&!VyWRyv5wWb;g%KQ}2CiEs>MdDBv>ewAl?nKAqF_a2$iK
zXNKfQ3TMn}D$Dj$k3wFDv;a8*@^Y;3SP@QAwt~U(@!1VXgd5*8!*&aW+Bv&rOl4(;
zol8ucmf5l<WK%Gn8OqS2Lc8He-0t!~gBhfdL;No;wStc5tD#@f6eO;D{rX0`Imr*+
z%IahI+kw6?>Fzl*kYNXIZ9edB>*aVtT_0x9yb)>*E#PfCW<$a)E<?5E)VafhX!3vS
zBtoE7^Fda~{y^+fY@N5)?b?Q3W!#?e;RM|m($+!&lY`rj1}yy%`6U>QTiZJD$mD&K
zWFSLRv23EHJyA*IL%TJ{ms*8;nO!!71eOD`p+c<^_X7SveXk&(PexpNqiXJ+CC*=L
z4RP5#k=V?4QcSW4KgEZ#6ZwMSjj;_6xmk?s;akS;W9*l%?Bj|x*{sv5J<yLc|I_&X
zjhI1=0rbm*F+=|$(du6wLu*&p;_SK^4e1nLt($g6D68wv@15Y>vBG-z6{r@7jRXi)
zeTjW!jwrX_fhrQ6C<-LYy{Onb7@56pqnZIpn;Mlnt({d%<24P_iH`WbR#HzaPYwDH
zNlnZt3tsHS8JqD7^oouq@8jSwU7xH~u9|8@jpNR2U=EB%gm1*b&hxEH_wtVE!b-al
zES<QEOK7tov=_5^Kf4j>wA*~FSfIRv<xh{?jvPzf2ee-1&mEE2w)Ud<8#DRgp~ulj
z6WkB^6$3L09|CtNTJE7z32z6zQJ4mXtZg1g)^ij&w6V9h`aev9trbZN-?C@gjm^t;
zaR#@n*#dbg&7~F0soK@DaC0NtDC&u-DYmH&T%5s|X1ltM=2_2~vE^6RJ+l>Os^?X-
zE#c|3z!=Nx<#74x@T&#z2DAmXO%5hBaqg>x<?U)(`UC6RlF5XT{eA8nueK3>j+P`b
z-wV-Y;$Y0SME$HFccE&hiuwbm&0Cvu2qe0K{Ss|Y#@{XUk7#-IHG}PF)sDF3xG_fX
zdS!F1VApav(9gLrqb+;@y(1Vup`rSlY$`3Fn(PA4Sx@ZQd3pWxsZ#kU=KN!ttXKN6
z(b3c1S0fYcFMfgB&KwS#c=+AXN;~|tW!t+(#r;O@{3Z9iF1(#v=V4vn%|8^SIRPs0
z)!V6U6TK&w5La7h<6^~~%LF4!;$1-qNCQ8%!v~NyR=a<eJlyM!u=#vP%JN)q^S8VO
zo_>bHBC@H>_wWYFE~QNb9##7e`69O4bmxP1X?@`l_~<0^Z6ko=ZCa8K8sFL{gJ8Rk
z_Mm0@7dRLDHCRICaldNNRt797T8Yf-cwIBsOm7>C-QRn$aH#b)dWB*LxGFs;weu6y
zIHAxI*%#Z(Grw(H&L{`_pnfgt?HCy31O#alBE4u#V~&`aDe+GwDbJSFw5k`CPo59i
z<{c+~01s&iZjoeg9x|j2Q2}*)ERux<RUj{!b0`}tv6V+c8>_u2+>cGBau-iPh=zl@
z?ekFJVoC(nMBFQ5ow{0V8)9ZgarGK!`+ZC7x=D%hCf6Z|3*vEh7B@jKdMp#bdv$%@
zLAFf4CE3&$y-ttGFL1kaaXXp`m#f1N*3ezp<S$J?(IOd>7fOlzO5()zy}Q}|wac8*
zLOI(pVuLEZT$0>NoU9p1e5J}O%aY@|i9%QSnUyEiTe9HDm{x!x-SF)i_D(i=#NCBn
z=wZJoe*R&ZOado;-w?gln35UbuBl{v$0(wdvTjMr<A6WU6OmGahGs!}G6Z4SOrQk#
zYXqzwRCIleKw`@za3FFoPR)(?A5Qbs2ld~FqHWs3sw&x*fEO_v_e^muX}FA{2fr!o
zjK*O$D*F^18o?MyzmCk0@ZmEobpJiNr1n<t6FHe0lrvHP2}<HhA99bpQ!>5XS`c02
zUh~BUS(xRaWER+hNY*=g9-<{GoPJ48UvXdcDzAYdBB_BmO;@3gV=t5^RQoJ{HcjM!
zI(;)g1K!f|qD;g?7Fdl%SBn`ezr)1UI|x!BROLirNKNV{0@JL^0jC`Jy!7+3FhPE&
z2fs^`CTedz!7J4$xgx0J^A20QjDLTg;gDXOb93|~>yk-D$A(L0d}hAOc9Z%q8<A2&
zG*`I-Dn5ar*^{V5{_suH-U9y%p5rFnd;A(W`OS;Z^Hp5Ex4W9W&#-&YV_0yAyZc;#
zc$q~rILCUAzzR+O=jl<bL?m|1p^^B`pSb0d!-Y)RU^`Q?dz?d56!uUSi1l~Fg1Q8{
zZ&mLkIj2AJ@=qy1m*_~V9pmIBS!fBV#w&`wz0Z=THi@M9-E+@$U5%3GBb`$?m?fuR
ztm-YnqM+QXSX&3zzXF9=GSc)E?zIQxOZjRu7(4U3Ub$cG-S16YPUI}(@wq0IPX)L<
zv`1Shyt=e2*Q}=IKPW99$A`GA96onVL?l25!#Ani)%(;JG)CX9XV~x8&o>gQU>Ul^
z`5QG?Lmq_DKW|yF>T+DMpG3t@9lo5$SFg1r+*_3w*=;p-%p<h>kVfq`o|pqaes;T~
zq)<DwMMrkjCz67;&R8)TfCYyiYJJq@E=`IsnO(Umx9+}Eci0oKPn0FME2GEIeOGb7
z#tZ+@(Vf+Yoj(-ze2tj9d#*rMso`W?cJT95FuPMNrKPjwnGyV>jC}#kxSWLNZ3X^I
z<Ld0g^Ut>tX&YZ0Q&<@k?BI0)(@yz!IIF2{uuN`9ti0^{22T=Dupec$0-|@n01`R<
z*wm{BUi*$r2XD-vQAO9APzQMMJ$VbkD?6=&yKb&|;qUn7ny<h%zN`j*R_@~`$gTYN
zI?zRa$HM5(5~s96n@*30^|4K|Y>$ofeWtKrR!O9qAg{~yy)o?io{0{lJ_Ty`+fm=d
ztdAI>1hMGsDXe7aX@O*V@2M0?#P(P<gr@^AWBs_4y>Ay$BZ^sWNEq;2iIl~wg0$_M
zS;Y%4&vj17QFvf-hEBq7Cl0^+S8oM~mAL(4>A!K>O-{R;bz<5%KB(V+gur<ViM)$d
zYM2P~3_%W%H-00WJf;FJHy^hM>qYnp@e<wZxj3p0KB<#@+?zo!pt0!OU$<k|e$%)I
zTTmR~&BCnHcD`Vj&4_3;$dp>yvE5?wS0RVZz|Z2D+Ocdd%_qs+-+rH5d1&7oZM3<u
zgMO?$tR=2b92wl@v-uNg7(dvE%~JZqdJRtjsNF4_UgBsamjj7NziIt=|Ghnq|17Q7
z`UEd_EyncyXNIq_)VYX1kNDRBY!|kktoE&tQI_lD^$zLcT$43}i)u2$sJQhGZeud0
zLHkc0uHf7U>folsc!@aRhS%Yh2F-ouM^YM29|IG(R47fhN3u73zE{~6Ic8lL?MFV%
zW&_}ujd+5gw=M|*&cJCB-P0NSp^ECzX{|u6siE-2&QP03X$u;Di>eop20d!z5#$u>
zEQF8Ygem8I+(;YJY!a@&+)}eRoefv6Ag44|75=+|2vwp?OfDkFitBNj&S-61rOi$W
z9BVaKD_>pu{$1W2xn4Xhaa*vq0`mK`j0T^fjj)ia>cs=+%<31(DMk_qH{PfhJw7>z
zDe0GAWDa3i8y-u4k!DzSC1jFPwca>6MQ3l5F7MM!<T$`<>vzMiQnu0ruhB327MX0p
zY&zdPp}$bQr?bIa&2cytf^#NJzy=;3+q&7aj7dX$3irD%x%#^<$*K&n=d9^Kam}(`
zaB_^ltd!3WgN`mVW0Zo)Vo{tqSSBM%SFa;3%IT{pTGiw##GdY<9%ajPxNr?C%SyZ%
z@5_a-NABC#1sgdw?#yta#%JdPo;6)KFM0R=Nz>uQ<es%bLy3~N7;zusYplz-@9WG@
z7rOxkhPiWEG2oX%HZ{-|kMR7{JzAiW*(TwfO1Y3c_2S15!)3W#^P3UWgCKUxAL|E4
ziRh#4VdvT<-`QAQMb@tr%W!oQY2R;VWWJcQ=g{L~#qL|1!b@?p6k0U*>9ZcC4j<e?
zp{-L=Wl+?MA{}BNZ;L&UOJOA~wU`>az@|!GY;u&zRi#+U9M%H!5(T|BKj9`HPMY<o
zV%^igpI(`)F~8uhY3`QJw86l4H^9*QkjB)0;N+P)frm~j-0d#{_eh^6)gXzo4}RlQ
z^-*MNbwEz=c`*qEGimIviXvDB@2e=;Lq@+<^_K=l?l<@hVCe90hjy@Lv#seeXfuw*
zWzu%HofM(dBmmNknqh!Lu_d10*P-m2X?*M*eN)`$!45X#v2^U%xA>h#cFf;Lei=T<
zGZs$j;qu5<<?ofx&}t%=I$<?X^UazSs@Um=yPf4U7(=qv!<LCxhjh-qo@U+$T;bwQ
zs4CFaa4=eZ&E9cq@w})h=jfMx^mM!Hxw(CmEf!p@`wl31pPvPr>2y=?yk)C^ilwyl
z(=C7PanMm~9Yl*1Ew<u!;Mw9^-&ep&+I&GPX2b~(z%8yQ8*n|y$GCnz+aZ@NZjz%t
zcCC>+lC(f_VNXRC5Llu|-k4A=7uZ7x;PV|B&YCE&*ZY#%)K@4#&~TE=fgJ`~8}bui
z__FZr{XJl6x%?tM6uMfqnm{lfq-%GI$2ZA4@@Z$}1J&3HhvCoV3a3s}w9h4t)u+#d
zTVS2npekac@iS#8(@{V4&u&nmF^xC+NsjtivO%7+IWBLe)wtE`14#zW3wM^D#=EgF
z7#lv^TGck$iwxQ}r?o)yWDLsshOhN!?gC1xy%+#oTcFC&$uM-M)2Hg*SNxOol{`5@
zr;2F%eo3r-*$2rRj#q{RD!CjHZj>!)U<hwVljT+>=INsBo_9H&_RSk@8gi5NSc<b|
zw2a`UMg3TI50~)D`!eF{dCe)C*yfNl1Q_bmUlfv!v7b(qSE&qin-|aa9+&ew$7h`2
z_FP2<mNlt;O4VAdd2K=v<hSRDoSfM9w?95SSsoTKN0g_|Ps@i78Fr1NTWqGwe)-9w
z01Mx8;S-7LGJmnpll66fureXBdl7;L$f2{H-VI2b+KV|y@NK!YxWe1zD%&d7zWuvQ
z_U|egG`wCHd(E==nBHcaZguDM9+Jfr7Lvx4HLY0}UZ{*wPM?K?^a7(aL8T&`<->4J
zU9bIt3ZEG-d;X2S`IV8#Vp7CjkIv29iE2Jy`hv&EA_)MOy8MHQ-E&V)-M7(xq2RfV
z$+6Jls$iNmf7n256%WbC!;RIxv~s7kb2F>XG-TxaTnj!~F^azx$7_H%YCm6~5wM<B
zGW4c{rbCV4J00-)obbL#u_|t)la>q@f9QV^_fFB7_U)E$RczaK#b(8}ZQH5nuGqFy
zVa2wSN>Z_H+xE`;t*?9a*sE8M(feeN@f<z}|D$`%`J2}@uc{)rZ&L<>n^Y5fnz45c
z;ROYQqMR_h{I;gn<P6`P+<@lJ3-IW!T}hvR<1X8CiA8-$%4*m`1~5$+tpd#l8zvPn
z?(T3_9ut)rHr<;-%8JhyidL7G&iHfvf)D^h|F5JgqAuv9f!?v;RAEmEtXbqgQCHzs
zF@EKbR2{)bFtiB!oxm}mpS}Ha<ug;HsjVrWM$=4MEXF@=M*9Da!1@dx{*!=7J3kuz
zgTTNY8%w}@r360ze@|0zevV!hmP`%29;5pSS2Dgq&#iX2og~pPi<^I*BSfXd`N3dF
zvCC&_PMC0wR34UczmaFLcLSh|OPuOLIDEm*RJ>FyDUkC5rncz^)wfK~9m&L@mjHC`
z*#n%$&o!mLhN??ANoW(_m6b~BN>)R-Xh`mg<Ei(~8#ZaVzV?%v6Hpz&Ux;OZ>De}b
z57p#$WkOaFXYf~bMLjYfYuV1yPKWsKc@GDWAGnZ$r3*B}wVOm>A_LPfH*dvJ8%lb}
zEu&Zav--|%77?~f-@<KcN4zh@FvcJstZui85L;LcA1s_WX+Qo8+wv3GNu_`j$#S~O
z$mhA3(K&&w*hm15chwT?nO$GvE-)#766;%<N*;SUZiD}rpWsdaJ(#EZmBxa=Z4jgl
zfXW_;6SS~~e)%eiV$mag)rZhhSE|tOvV#7NMmn>V{Vpg;qhwAsUZ?4sYCyQH0$qi3
zi5A!Ea+DIeg}!=eYbp}0sy_CqSjn+bN#(*YiEMegL4O1884c}6tCQ<z1k|K@;1_PS
z2QF2LXkc{9!-n{2R&Zte#+0hY>?`hptk>jf@SC<g9Gie)+Eu!Lv8vc8&VQ4tObEzY
z^bcx(Qr)LQ=0b}<j6tw!#<mp!T!TcvWTOJ=`FFCK_d#n0M)LmQQ`RHXP49+!b|b32
z#rg6CiMECrjRd&gS;3)vI=<uuqMzqzy1|Psl_4!=u7h0|Vf3Fp03C=)#nCg2!}+`D
z`HoId<^}t#Pw3BD?YTX^Nb9FfQKcAOl`q@J$Nk>#B+(DYM`LCG5Gd&%`O(6hX+vpE
zG&1J>cL=}RwTRlZ%=>?LV*O<z7@$@}^biVmtiE|28FPE=H=Tal-w!v>{{26HYnLKn
z@tKkd8Ni$g=3bNZZZmrI1}BNe8R{!o&iLT<;K7&+!^f#dTS)i~PDYyr=Bzoi{OFW_
z9r;G9{M;60>HAg-w0&pK{-95G3%83&vQZ93bw(G7T6|2ECMHvt@{1s){?S%wmEl(1
zwyCBEE{|rm`TIedeplLu_8uHnkX?8S+xjQ?5c@azpcT3PhkIxY$I2l{wqJHw`QLT~
zbf|XWcExnkdsuMEn!jBKIHEk!t>jR36w1D5r8ca1ti|#gBPol~D9xwT?tF@3zZcfU
zCEtPZ7=G8}dvK2Z?vbl=NpG+)jF{*x30h}DjD_o)y1AV?eZqO~Y~E~xYY#C)dG;ig
z@iqav;H7KXjYFe{A0VFB(1&T3-x=X*m7AXgy;U3i{u5&~iHJkdW~3fmhGnok$Np0l
zFuBEHx5#>rG5{O^A%}JrnKK~0VFZ`?wSTxIEcY+<|K@|rKgRk|WUBTHBZoqL)&$6K
zhJcH%(+p9ObwPth7VL)PgE;JqebxmyOl^x#NNpT{GK70EL9u>G+IDqV7?f63?%h`y
zgp(_%9B*_5=sRkddLHi)<eV4kTV0H->D^LL8E=68IAR}YV57~k94&*bG@}Hgy;J4(
z)vT<4Q!@P?#}Vg#1a7|+DT*BNvj|;-ASh_ltgS_;uJnfw@AsMO;$a|peb#cH5$(Uh
z8eF+tGCUl-AWAg&a!5{EC0pze#zi7OlP)J020;^C+F}`waKwXwHj!ymqH|t?SZo(R
zw9_DDcP!PW>Y=_scgb28pB5MGi7nk$z>qz)ap#{JjhQUn`u_noQvNq!BW^mTNZk18
z#}O;+mkCD9Z;pRbFtv3Ac41@}bh!jA=yH+x9G_atCoc_y%US!@#N2>m?pk*|Hfl4j
zWtr6!=v6nq@^_dPxUM<FpfEf_tM7cr-yhXDBxzx>4V)<wWi&IfQl$UZ#v9{HBngsc
zk8kY{J6B48eUC!bn)s(yAdhtPSLS^>1bRVWz|Jepj?RP8I|`BXASjnxO!F;!Fj41-
zOB$%S%@2`{Buq*}7i~Zv27QtMM%7{IYkdC<r(Q3%49;pixNM~a5{1byeFxE|TQ`(1
zbn9eqIz5!Ib}d^kbN2j#ibBX;8d#-mM<b0I{jNUEO>~`>0fL}6U2w8N&R@}!t_?!$
z57DR%fmcJ{fhS1S=80*zoY4sz6RlnkKJV)Obcd{g6GD`xYhIwVFp<kK#9;v@zEs$A
z(zKUk+<e@cCJQD;dMvr0>dKAu!LoVAz_0)2JFTGX&9G}z`A)Fb7{zU#oT8^MQq>wU
zgAdN&T(~^!p8K+E-!+c~X2HN-T&<~d_{Bt<$8*BxqzJZg&lWEq<xqpI`zA%^<Dl0b
zR@gH3&UMeeQ47$*tnp(<H65F6U%K1-85-XlyFYL|cWetI2b*e?l#U1%fDTCy9W+lr
z{)t{LS*9DnAO&lBLsJ$BaxGk_G)<sRf9ca=WM!T^44xsTm>``0d$JZJ$?SJ!c$t+g
zW^@NUo<@f26Yke3*))hQy~)e}2|Nz+#oM?%#cvt)i{Wo>0n&}%@5V*jYtVw-!O(GY
z9w5^y8>MX>N=y@89r~QhQ`basf|#%$YM1w{9M}A>3G{F5JRD%KeRMHSd?CW7DbR;t
z1c2S2Z7g4KaU#mNBb)yp7zfY)3OW8S7{?%DUrfs8A(#R%YV16-=0MO6M_#LOn_6By
zRX}{S%S(ow|Gfl-NvL=WC6B#5m29*HrhOyXK_{yQ^T*L4c*}nbrxZ#GWyL@`GlVS)
zV(Gfsx5wx`&}EWyuo|t^Wpg!l@l5Rg>FSJ#OUe5z4M><@WWN>*IDIP2@fc8T{<1Mp
zydt#X3QRk>wjLC55ty4zjXZ)so%2R=@AA;U95^__#PjU7rSy!DWVff&wxKBNdGvKr
z-ZHN?>B6Df!(CA5T?&|d<Rt}8eSP^8Ywh_@X}}A%-YCxTH|b<Wq#LYbS{z|8NgM=1
zRDv>4zgdItC@2`0q1h`A(7@Ft{i01yiYHkx;Q5v7j>KqT)*R_kG>bNp_`#@Fpku7B
zYZ8f*P;ilwTfdv<7t6pFZ^ZBHgttAAb@sp6+r;=-ToBKVh{rieF4S~Tfzko8QkDqY
z!cbP>nrxtbKY;`_8qOG*2?6;%b-qnA(XdT*_0Yy0`@zj0!b0`LaZ|db=MsPSc<m*<
zfh`T=pi$Y_jv6WCjoAJx!y*=J;f~6i6~4(k=FqP+j1R=scN`%(3wK9KAG%Ktgj}!Z
zZK9X4cH&PNgd3C}&G^?(o6WmzV=Zy20?R1GLZ5q>x|XnVh&gpnAb&;WIdxs(GUGlw
zR{uSk75&fn*n#W|lY_i)6*Z|1a3Wvh+`o_Z$Aq>(nxREY4l&bVeGJ?!2E#*Z1{QRO
zEYy#ejQt&1jIg*G<y`K~VL5At(@+tU+|7PE0}_dO?eg9QhC8a)8l(HtB0EwG_Sm~1
zrDO<A3DVS!@Ukni9cOz|-%0c!?fKqevq*KC^^*BXGagZ5*uemwH9pk@XwB#E_=<m5
z@s-UiS~}`$-Sfa=t*$Y<8$~5gp701>c|!fQnWCehyk?6^o5EAwt$53Z+5AVy;Ej93
z_%sdONxLMxsc9`^PCKZe!PhF_dSa(3kJ4?aQZp+1DqCZ!N&U^Lq`~OkMa?=bYN`2m
zqHBl8*33#$x+aU7wDBKZfV(8`KR8a#WQ@&6x)=dv*V4udTUj2ed(|5D?Q#~MaaG;H
zy3E6)eYex+LGCQWNhz9ws~_(+YZPepO_HjGqCY5?KFJRH{ABXOoQBgkTqNt_=8&{S
z_Ka~A%9??aGA$aTu5TToEebcQ7tQGqKBn{bYXw1qhpXsxUx1$!@gVJ1e@pea;Aqml
zGqAlD67^_n2MXwDsR8XURvD$zZ66(dyD=VGZ{v6;)%n__syWCZ^}~Q>;7f@*P6xVC
z<tySCKDC}g$Xh+!r1CgyN~i5oRlj&;sP^8C96=n;#RYy{5aD{|DB>AniDFu8dxDvD
zxe<nd#|R^j46y3jQvajjUdv@GNi1xx4&t+A_*P1oTs*>66waEN06x>VN}h7xhO>H%
z8ehf&uz+9l-Ea#b$EMfrzS`pubd{-Jzwr?B@F_YBYa>MOI!8}#*X*WekGU9&C4h8p
z@7?J@pjOxQHLhAakBv|KHy{%=K_woSCMvdU1;#%|<`lIesC2ri_WC+lb?f(kWk7u4
zMh>tl_BDkt%fUb@JM8(M_a2`y->o|to`r;)Oh|6c_Op;IXoEHec9K=^v(WRWp3|9w
z(!nLpzxzBn61nAruef~QE7|j(|DjaH?q!_>m@?xOn>k5N>)yy>VMIEGhwGZwK=>tB
z{b&QEelBJnrP{&SNxINCY`qHkFGp0UR2knm1G)2}GOU`p+v|FtYAOD6EDrQuiU@zP
zw4g{&n`%J7L0Rf-=uZRu$m_?FSJU1=9INc5YI|DNH$~AD2Y!)YCkkc+O+)m!UkIXR
zQL0pQqhH+>sQkX5eklYL?shf0dURwq#`@1Y`}HpJZ(&dQdzUYwQ6*!+JYuP!X(FV;
zZtFhI-wC@mW~=SWFx<!nd!xUhipi?hk}G+kf9{kGHKAdJv_e<TzpHQ@rBInN?)B5;
zWardQ#qUzUqRTu<F$|d46crsi65n7S`#j*6#&LajPpBFY4P^p4p*WBa1XWwe{I-^#
z-Mwa1Q`KhB(`PB3TbV_SP2<y5VI%~nVU$%y>d<YZ8Y9>=ovJICp>a`2qlr&Ym@vct
ztfWrPMzhV69%%onpgEu<WHBSVS=HuBl1Z!AT9T@p4Zbj>G?DhtfuHkXEMvC|)AUAY
zAMfgE#-*UQN`wL|qMq2s9J|CmN*%l2M$+B7Kqpo9d?5|6AKF1`OIBHsX<B_IG7Kb^
z`KtWNB^qleR~!K0NmJ>z1LD*oOICv3Qj#*~$~y@p5e^0}0w+?+$GI3?O9i`+b@sNX
z_r<IyH3#|8BvsvcDE72U!ze4}Mz~{x{&*K<rm$_~n{lAI7<2PuA<;QrT~p6%(*pfP
z2P9<Pi^sUZ^B`qP*8Zd&nR*j&(v>QaOP$h~n}-Z(p&MtOsIDdM54Z&#W~p3y&J=#v
zxqQ;Uh1i1x?k$6%RgN{RymVgoYN7ArZ`D#~2Yr!7Pr%gWf9JL+;c0@HEdJnbxPysn
zIzm^1Sp#Sb?QTiPdOk06Q7u@3Aoq4r(BpHdKIOKoUzU$TT}>|^Y<A|Ns;v)X_)%Q)
zI0pobgis2ZHThU@%%i9h{Big7n3G^oLeiJYEHsSi=tit+Ea07@TdU`#FqUFPwH9%%
z$zS4jOFLo`bxt#@Qp;|pgKEAVPx9FHGzCxXrUXzBvDFhX0vCR-^K4gtDMfEVR-2Qe
zkXu?}B;cq@y@0xH6Bg&LK`;GdqdISE!<8M)Cdph~C_yk!7J#hjq(hV8)rx+Rw-rJ@
z-&fc+ReGLf7g{EnZOIsJJ7%bnz>CNed~Pt8FOmc&@2J{ZjC)<RY1_0PTwm(dMES?*
zTLf@Ob1x%4kS+w>sA6R>)IheP<SLdN@VdGa+<t9rXQSt?thLZJ6BP&5pt4q9Q?>*%
zuOr%v;R;utnp~(PP8n@|b~MlqrO`g%%UUt-joUc#WnTux934qajdIaunDMN*&5Qm)
z1<xbdqy0vyP1p^<gr5pQ%DSnv9_v9QBLhf-st3e&5VcBNm<vbcc^Ru^=e0ZkFk~oW
zRPBoOn4on+wqMw|r`z#YA+(@L(zpq)M<+L9GBT_=;E>D$SzJ`M$8?vgno9OEAjwYV
zSp;bXWw(%HnDCW1Lw~m_F-WI9){wxQ9u;)haqs*U7_4|K9U@3JUZ+f4&Jl&rmjJAy
zs@Go=Yu;*WNjDYkVZ`0MFcB1qX5Y%|5n1VO2l34l=I8$oKJE&&Vstn*$gft`rR>`4
zD7%z)$WM7*K#S$*-RHW=tZ3pD#^HkV6dqt?ozjZ(kga2e`<8C9aT%(+NIZxwdc(zh
z$5<k)_4UN2S)RI~O)lX7Ng=w0%?bEj#Fo?Q{tEWt(}NH?t6agp&IDa}S@6C|@jF2e
zQu8|zMB1yYxdY3JsBROF8cw&S!fEB_aA{bPv1iWbs##XGs^Csj%jPryZPu;<euZ}!
z;<`HwrODr4W!3ns;R<U;3h%1Q5(JFa>zYiAC25O^@6nd<_Q80fM}>Bg<^p+x62~un
zRXFll`V}2h2Oje%sMgpsTFF|Y4S8+G+I3rG;A+o48Vtmll{;#L3{A^_rg6kMF1~<f
ziAzaLTPby(z#*@+i4)Qktin(hkFA!KMOWey4_8<fMMQa&&;O=lTeHEqejaskZW+G$
z<Fc*GkSQ;+eaV|kEuBdu6a<75Y<Rz3zMqsWbanVVJ=0#;3K9<HFnB85Yb16Y`W(qO
z+#CtdsPX$~%t8#FqTRhQW>t-L<rpi(4;?DZ?#f8H3Iz;Tn`tDQFh8f?HSxq=8Xf6h
z7EXL4`#VvW;{M!Nakw%(cIsj$9~?1t%l7&M=Ld3AI39kS$Kef!AfY;7?GP17Jj;s5
zUiJCeUL;C<E|F?|xhaBqxJ#L`;FZ+OG^`5hyICPK&ELD&nJ%5FGVP~tQByBFx!82o
z>tqd}NLa25dF^|eX>@h9zqrmhKg$x#zeveK1s4EfblKrG!oN%tWaV}EkX{@+zI-k1
zHlhRea5`<aN4ms)Ln~invz;95A1@tRasQHsp~mUGD8mJOyD3%tx)>xE2UgNleC<Q}
zcSu<h;f_vHGV}ebB?B#CZS1>Wd}34?A%gLC2;gAZ#Esr*q8R#)4Z;#bTjm@7&IQ4H
zcU=eY_%!xpq`x!~Igp3t6a6f{>fy|B!RyY(S%Bm*sR&P~WlWh-qSStSr~INmrDd!i
z*8i9|l;;_65zCzYd*d%RMhbRUoZQpRACFb+N_$jWDEm8a64uM&%b*MB0Y?R~JlKII
zt=qhXPo=qmBw$c4D5`jwr+#v)QJr~+c18}&aPe*O(`bxKZO_CXthy4Yb>;?H{cREL
zqQLiRDLkl@+LKottd~~Hb3*3*Sr~=Qm+@zZ9NYH6)@Q`);Hc)(txZb)XwenVy9{5G
zhtlI<Q1@a`H|XzLchZY!I?4lz()$?%oAwfkm0LDUbc_qR3%mShm+uMIojOE!`7kNa
zWHgK@dz%(ewJ0&tsbH=LNzQ1FRvAj8qa^r3QA&s7DQZC-u40mW&4Mzm>GPabG7}Vq
z%cpRf;iHz(wAkFS3ztLx+DEV6z<GzLX5i5(1}kc(enLHUr;Pd|U8VU}6HddX=`5Sd
zL(h1iR=oy$3_AM0c%{f5r?gXEmWCD3RE?X?47^ol^&PC_((^?HoxsmMbW3d>X?dlf
zYc)V8#(45$+@ArhtlrtfME7lfy+qg~?|&T^<rF(G*McIcewB}@IaDc$z`P5)LU(^h
za^s%$#J6HAn}gt<)!)fg&gM7TJ5mZP^}5fc$`o<~GuVsK*bIRS-k=HVeWw7fux%l)
zDiYY2g&o!Yx-!wPM8_=#w(d{;bmn(>`!OgdVCCjXUi|X6wxj{#<siz1YpylZ3jS}w
zNJ*m?@guUB+j-q>t#-_L`J0WAVyGE%IUytNBi5!j&-sO;Gw||D=1gNWy8m?gp8feq
zW0ajk{GfIn#nU?&bPdjrH$4(S7E?Q@e&@8MM^{gF-j_2H=<q?V=BzOKo7s<?)ogjb
z<2dDY6(c!184=kgmP2nWrj%V2+@i{xro<(?y|sY+<i^?01|QwrsFmw+t+z2vG0yVY
zB5*O9-8wD<pW-!+mSdwz0GqE)Mt-3gANwnIBsT++%=@ek?#_U>*;ou9jLf%oM99w0
zn8tq*5FjgEBpqsXF7&Z_6(3;GG2Zgg6<qa#U)Iebe><MMMkJO&bb7e&3`N!xlT42>
zqHoeFoX*J?sfMWg;`xL*x7iJTmtHL+`UKg-q$;lM$VR_V;J`XAupDLda%Lf;lZxgt
z!=yALfKS>WAaCXimrVc=x;CA!<Kx~DEmF0Nh;inljH-NXn+2Qq(XmfI{u*-`7B%oy
za!GqQZmP$Pp!Q4G!y2a)34>2RFNP9ESJ?JytsWqF`_ARauoU{8CB>3kE;}m|?(NoT
z8?SBZu)yMSx8DQrk-q74yU7sbRoMRnr(gZ2Yg{I$;BIE5M0_pqC{pj?l;HE@)m;Kq
zbHl5sk|!eH8UsY2_0jGqD$GkXcqtK@vF52g=1IR<BbW?^!aFzL`?2)bjEy9QZsL!Z
zt|Xln&vHBlZ?x;0h%2i2-Qz@>MfPu?C&4zx(#kI7NAaR)b9qIAY7MLl&bn7PQfV(1
z`vD~av;bOHGMElv1{tL2O@Hl65dvAY$Qf$q+&k?4p8G+LYql;?<I^(UsE#z{nCu0G
z#O;K$Z4w_DHWHuUh^PCK*gquMNWzt--aJTv{gM=<L?+rFA54xNV?5yOlPr2O^RN^p
zlu{5fcZ9Y^a0>}Zo<(@zq{7r0&{Mjcy3YA%zzF@eL3s-3NZ>-sLT%@6TmU7J9HD={
zW@x|U@nm9hrIt!8r3SG+A<3OwdFJfUO-*ZidMJ!D$#*4YDs+~7DNn$Io9sC~H|lSc
zS(_t^TC6ocEImb9qe%aSr81*pB?Ax2y$gb6Bey=N?WrLUx>xVO_#Jk>P2fAEbR%t-
z;vd6cw@OLiG=Nab$>Wl(3wwPURO8uucTaW&cW^4TpNL9MUzG3iIofCZD>S84jS7{1
znfdRdvlUR6%glOnhW1uiO>ZY&5@KxTMLNf=D_kw_luW94n}`5~rP+2=UvPlK=i?Rx
z1%Yw~Gn={0_jgPBt}*mGhw?aK6sZU4LFL8u?SVF+>fZlwoiE_3kH)r7KVEtsi1@qd
zbU1^+N-o+pU~Hp&nJJu$9e?ZfECrKZZ(z5JCf>+k=yykFskO3n{9gAX>Ml~=GP`OG
zNe0fm?Obp4uEt`GY47h6sYaC-F!Tiz?Q_GVnhFGT>zZI|RhxM$v?^J_cFvq@xVz4m
zO5S1MH|K#K8s^n8Ch@={$!Z`em@{&(#8RW>;yOv<lD;n@jI|o-ok<#{x3O0hk!28d
z>E03yJNZg~Ivv-dT3R4{81i7OYglR-Q$5GOTu$TO-oIVW(giBv?zY$`Bv+_iZj`0m
zcJx8yA=cikr?91>>@C+SbduHRM%6h7dB%-w`xRHCDIxsw#HQL;p7QY({PTn~<{1IB
z|KVrCUNuEm_AoqH>2hrOFU#VVs;TpTbS$5SMUGVy+e)MQy6iNvZra1%yj<<#mAUoE
zHjBf*{7&d8j#f%)XZQdD3~?&IDv+EDk#H?`Tk!cSCTFGhGu(jjXJNem#77<nmB3@2
zd|LH*3QXcM0VdF5<KIEnfex`-LkNazxhCys5~i6i9A$SBNNYa>-GtVvF12<jD&fEK
zM;;~%7m4`Qdb>MTIf>A7s?mUrnb=qDW%d=XTyQlgI2)|%DeU602P8|YP|gv_*U}UB
zVby|_q9*4oI;Y+#{{V2`hk#5$wCAu8#kCHjLEPpMXtyfBqz+{uA6Jr3)!PhF*H+55
zNVd}=NMIsQ4`a(~S)8)LZyUW$&1;dVQ>T^J!2r|oJdomb>Zk>g*+dNsiKLZ+?X_09
zz<1<SF~8_zi#SR8#nKQTrtHQZIXFhU&ja#y&bX{)6GX$Los^Ob3XTPcvIPjQtXZf&
z$Z`CcBb#8w>Tld<ESJm<!54O~K32?=3NCJ@S(||`>FsG)i&b;IxDV8*G)30!&p!IA
zp-k12ECo;3l5C<~Iu7M{?;>mlI<Rafb@J@q%7pSOxio{_jZM2Jy-Z>;FWL`%rdH+n
z@Q-5!-&(2}GOzQ?RJ|5(W4lNXn#v-Xsd|_PODK@HqZ9t3MR`Y}{x*&xpNA;AKLi<7
zfu-^mMgUo$9x-+>$HQ2KFk1FC&BZ`3qu{}=5|3fCE1T|o;S{$CB+a$SUPo$L^7>~^
zb4?fi?IyOr+6wAzxQ2g^viUO6F|$*?LGkTsUV=}d#pk7*Ge}WDz%_87B{K8j`ywK%
z<Ss!%!>2P)^0bReYv<QgZxw=n@oa|+T-I%3SvbQZ5{mm<w?S5RwVepDosp=+L?+EM
zW>0j8CwB9*`4mCll8`0rT=4aFKPB_Ygm7bDQ`2okVcf`003ywj0&=8-wka}t7<ZRo
z8)y$F5~(M>3mF9d7tzmL(#u@bK-Z9JE$TklXx1m$Oz`YUTrlwZ?1GI>K!J1U<4_hu
z(sXivK1EM$!$+pLb=c|$I(2N;x)?fW6*c^mSs%?%!rmKWG7!{kKQ#;7W#6X6mr!-%
zuJ=hK*M0x1Y-lsRbUfZ)mXoWoLBxx$PR}=BWhJGmOKpqG{Dt$~dn%xIFz*!a&p|Pw
ztoGBbp&~8=IPTZ~quhUXT6hwUC<J;^_?u#h1Vl*6e2VQ?V784~((o~FOq#J|_4{&)
z<1ih|{!Sr>h42HYw^vON3xBbMWcv(nU;t&kNO+-=oYI0e0sB%1eE>UZAR)0IyIPAA
zZE|&FW3W)QSbrp3*QugXZDFJ5q}|&RLYAVz9PugSrr7r6czu0OU~PpbL8{5izm3uZ
zR{nA%^(rI>47!!VPyQ*tMx%8t+@bB4P22qr7wwW7*ox@H7J`1?bD_R`s}Br=F+iC(
z|K@^d{J_ZnD^S7fMQnX;r;)L4=9YHh(zI;st=_&Qr>LkmrCj1eMe~m2L-}eci+^QP
zcI-_X$wRhZ5vhCT(crb58^J(6>V!wOCNU?mIEB=T9AihBBH~T5aY<9BsGdLT`XKDO
znMG%VVi{@u_({ZKQ+^9}12u9d7l;(WjI?h!6s;221iFZQyDb93^EO4R=8tL&xTdI=
zrHh<ByOSdGKb2{A-K&E+(**iltaF5~Ecd;W^n`BGa86#dWlFio9*M^nX<Qah_OQX8
zKFy8m^&g&euWLm=d=v&NcQ)NKWZaSo^^fW5L%uK3cGGYK3}yTMOTh#Gjf9`b%=kyb
z|KKkv4u{eteID(pu_-Xs|IJbrfRf4rqb`C@Uy|#Cs)_;MK~j$<O2aJugbjUE&i^((
zd(=DdS;urg#$Pt3ZL_N96fDn?YnM`{mH7-w%gC#nA4Jkrc9(egToT4BO9SXU(?QTR
zuDHpg@m4VzFO@Au?t_WH%-GIwz^iT)Q=q4p(+Kh1+sX(%Q{!|QFW@nBNlM5D*sisL
zJ?-YAB|AUKYPj^!_`|(?$GSQCs=j!29RVYt=j#D^8E@o!K!TTl!}1LbS>wHUP{XBk
zwm;(e&to_b0L6oE)q&8EJ_lHV;vZKzPEyMg)?B+#3(fI)DWJ&_^MF)ei_={SL-g4v
zi5LP2kCBZ5kMokaXTLaUcU!SiYzHN5gmiB#y159O-`kCg3E6l$;%9tJmS(jA-fqM`
z1-!0Y1BA)+p2|uG(koO_?+abW>3lwqwLpdjTApV0J>)1v<*nH;4X@j(zIlPq^6>1Z
zgx45tl*3WQglCq_U%!Ww?{Hvt(s&IfY{no>58RGTl?89LfS*W=?k|6Jp+C`f(@b%N
z0p~$AH!-q9moHM0OYnGf73sv6gXT!-g8`QU2;y}MS?mOu-${2cD{C%0D~ZlKAkHc$
z;(c8$o<fj{AX~h=^#4FH<dcnwGo@%(C>>2Gl4t~Ie(89PuyWY+_mtHr%6kpiOfAi?
zXvRsgR^r4tAUqSRd2?f>pqGJZJ;EwE%88D%dW2c+Nk}6MC>|7Ft7vl{6yt+pmpWGf
z=*(37(`XD*(z{z@PGpt&Hj(*jrZ|bHy`;IAxfjQUF*YAMam6Kf3#(EGg@(}|TTDCN
z{SV)qxAkg~{mkfRTrzoixUip(_Wp3W<xfdYZ4O0TabD`$E%n>?fjx$ReXxaBeK{fF
za`gYpg&jv`dKG4IwM+4G{dkcZQE|ZsC@*C7PqD%J5$bw3-46WeAnCIi21{M^ULSmA
z(4iAX0Y~MZROI)bo3v~si=ZEFf7_6%$o>DOv{jDSbKdk{V<!%HwR?|KGs+e8C;-S*
zYAC2Zvat7+vKUvk#+It5@N8$POq?p#Z-%yw5kJnn=dQUvTkuQi?h+io+a0Kx^=npS
zBFFCh`7Y3=co=_+bS*@vm#_#a9<h75Y27Jee<TRxO274d<;TLC#69@=5lr#x<0UW)
zHjc{L#L!32-Ayj<R{(`{68fHq(<E^5&?PfA0<f~Q=(!Q8={dHwET-$4XXqKhR#hG;
zF}?U~4@UM5Ln8lTd){x+?s88+4;B-j&FSLvB60}WHt>7)j8oQJ<I_pGx3g?9Rn%mm
zTcHE0y-T0Ws+cyY@h68BRX<*py7UcDeqaX?>vxD{?C%$Xi=wAwPBJG+6#+h}_zK3%
z6!cy!&~>2^=7-LOzw+XoAf*@Ce1D+-v>Mv#p=C$NTWOIl`ZOcfpJv3OMX^q&aEF&k
z&q?Tqb-pF{X<UsymsNPdp~iHz3YR_j2p12MOqdZ31&eF{REcRxB}qxLB;TMKpZau}
ztpd9lu`GY!jP}&a=$-YX55Pa!bjwH&@KKq^7h;1kR%Yt%;t}g#?i&0ol~(t5oV-9(
zC`|I6h@iM$QPHuR9M9wF(s($2e;9CNHDfybT3ofYPL(HQjo!)>U`nY>iF8S3l-xb5
zA7Ig4-1wc~oZOC#J((8D3zoBzb!Y3KbfJ28J7EVIdMGwVt{pB@9KhTlrwk`s@yDV0
zlK=~o3H@QWuZ1ANnJLqSJX{Xax*we47nV+Y5Ho-*A?Xa~ExG<=H_!A`&9cxL8vMJ2
z3DDJ<fcxDPd6d=hrB+#uWl_hf1V2C3cm{c#@S@#;7?=D*H4Y6_8Y0<*HyT@BO<-f1
zr1Tr)fW7v}j7;eX0-(lbWRNvXLy>%Ds5+0IMkR9N(r~W`n{rt|$UEVVeZW%N#zRbe
zR|l%O@`(*2x$FP*C&#EVwUtfbbAY?=UZ1ecwn61MhnW4T!^zRRwIg!BX3>oA{P@bn
zn+Vyah!pGCo4wbyyTJ>aAN%Go^>Xz&PX7Z3Giufw9^69l3xEg92>ojK2#5AG15d&L
zqYStFWFF4;p8V$1XW*R8rT88A3-RQ$#3{t4^x3Q-VZ){bkKaMVo)G}D|6tGFnvh6O
zNY%t36H{-8H}N)wq<h_yt#`|Mlot}e$k#!2&Ihpm+2PDv#3$#JlkUX)G~=l{amZI6
zJ%^5er%~M#fy~$%KuC=8Jrr&USHPgVJJZ|yTUX9+go_7~ZxA1^WKlpnR8G#NY|zHA
z{v)RKsh>?Z!LCcs!Sm6yyn^q#qVG}uX=}iq=qWCC6lgFBqOKT+!PyY+5$e|=&OjTX
zr!ZmPRIxJm%f}Yfk4JV<GN`-^ur;xSBRBPg?yVPffbhAu{V+E0YB6xd0wte{AbwI_
zq%}X5DgAPMvRGP8&LzHDL}j17LV9b^{}F|fO43+Ntfl9KOE87$hUSHU5hY}>-|oge
zI>-aWI}YpHyVy>`sx*Z8nDG^c(bS0O#h~Y1-wo<DY3n_-6hj%TW47aZY_lX|&EO$J
zWYiBPfFE68x2p-80VtMtDk6BqoFMd9fP~*p?Ro2qsubvq2>zFmnRN&6cSsIJ#ApmA
zqYCXMe&sOvsfc*UXBikw_brUH)vShynlX?$e1Ptrlv|@V2vV{$Y};fsD<a}j+y$8c
zKMOpP49<`IerXDsJAL^=I-baXnu`4EWDQW>qeeM+SOJOt6YdEz^bg$cNp}$TO_if~
zM(LNa1$MJo9$L~QFj<uM6LMk9j-8#I2m%-qDEgw%f>&b#)}1ST<?Y;Vd8JfxdzfS}
za(>f6aU+CJ6N~juO5y5q>x)vrFDJ+-KLw3*B@j^<qDet#K+ig)fR?X_7QqF}&JIw9
z=I09~b8-vy-st0TxRFwYd@;Smj?P69WUTs<?7xPW&!HIU;pa^iaxpP6@l55YDPbfa
z1wjRq75WFQC4nqTY?7BDEf-gyLquG>xAX&{$QxT01#8gIbLh31d-XOxC^T{~^3T&`
z|7#xSQQs>Cv`o?dY-rMun0oCmadF@WkErBktOU{i=jWseFNhvDm)19t<W}JJ<MrW#
zTzbwiN|R2_2o;}abqb2qw1%9{IN|rU1-B!ejEVX{x)i$25lw&iH|+FXk92G6mHWkp
zrclPWl#PJiq3W;&3Fw!O8r({a@Bgh~2cC!9XK`gLtX6Q_H1_{TFbOZn655}g^NJ^e
zFr)~P5t$!VY$l(n*c=6bmZ=EakD1kMxsd$1eV8n@`tFiY-)e;Fb&vC3Gf9mH9uU!{
ziyx?Pl5GcUvFJnW_a?aK_E4=hmJhsOGptbq!hnXViEFuKOoTN9SIh#Hi%X%qI63#P
zDebxe+j=Ls76#Fg^^D55;rFUVTjNGk_ik8!_jvd<W!@-*q9uZP7vX`xR_>zs%2W~O
zuwwcxgQiiQH@pM~lvvNVJ(;YZoOt4z%^7|e{{0IxQrD(B3)^V4Cr-K*OH@h)kV6%i
zg#gHhb3h$*C|_0JgB`+B9kHRm8M2DXYVz&V#$*sD4Q7Y=VIJj7#QGQA&>&30&vkr<
z2n5q*OnvA9Bq!Q%a$x{&QigWln-(xVg-K`nm6lFZ%Bp|hgI1KHAen?QTWf9gb`to9
zI^tJ$)?7wy=EYmoT*A>ZS5~s5iB1*N84&YEwD`BKJn^jgWSwS7JsvGBtu&mif2!K-
zFF_-3Uw`cYoEc85)soA}Q4;%nxB7Y8zk<xeZ^>A<64KHTz8($aLmGwQg0^D=(ZY1)
zn!ypa+i4n(bZfs_t&z>|&Q5EIHvI{@Y{TlFt?v8E<jDwXUBXFl=Dbq$PpY~ACinQ~
zg>uX5EInq&VLf$j`4n7`wR@b-r6>%S1$*`>KJ5iKRBarp$lrSg(oH%xTD29Wj09uL
z3%dBo0^hMZD0|>PFHZ5Py44j&B|9&89b;8iD47{9<+9J~X!kbS@+>OJYR^&6z{_sj
z@bR_XCXBf8l%AW3<9^$(be}Z?;!PN(2hzpa$|a+tY)d6H*vPY#`jS5PgT2K!q6g^Y
zNc_e^-@)H*pG`-!H8#c|GFmBF`mY)5T>aUklNqmAp>d<lxJ%EK^00X}434QQE4gvp
z;KXVuPM8~ACwiifC6kRU8;vc!I(rU`nXQ`gm+jc=r?k#Jh51S);<uIojRt&tYZ}KI
z(jzqMBATU0Y8cb;Y`a5BF)`?8%v+RI-b@JzqHhz&(T$CtnXRWac7h4wIgI*)%;pNK
z4fSYmtC)!}3)>R$aJJpI$EZX+RBqlbGA5pgS4MoInzPM>D`Jx>qmT5v72DR13_kn%
zRUY7HNwHMCp^+*RT)8Ijr#E^`MFxIt9(}0sx7q1Y_Q&%TKHh$}dsVy}Zfibd)8}I|
z#pm%Tkk$K3i#0W743N@|4a8YeZCZ=yT3&_~zsA2;L0gEvgLk|`5MZC^ObtXY?ophy
z-r#B#l~OD*v*XY8<0w;6#FrY37$ytZjHsEqPPCNtN+SC-n>hk-=PqaW3#(JMt0tE2
zmG!Y{zp!xnlg*DbNE?G~C-PI7if}3mki*W)etKb$Q~UOVeBhA8e}Mbpq&YygCgaUV
zCn`lHyDhxXYE~AZjP+&HQxnCPEV|K!t4=tO4JzREuPlr_!KcbiGT2Cb|GeG2pTf_b
z!%3PGqF&G2J8uUxHcuU&dq%*|<u%fHEh?MhS~r#(4ysT!{x)RNp4UmR^6Ka}SKN;H
z#=l|^VQR_YwQBLhecYJ(6FNs4s;ff%uB2)#DK!v}XFaCMmRj|h`*tuz_dE1XYEl})
z&Ctc;eao~f6vv`vtxZXZUGu1LrQ>mg0axR)`3XAGU3wgF5~FLiMoq&(a6>o1Q|<ps
zs0MA__^Y(&*YUm(V(?vs`!Gg@`;TVC36bXMz(GY8ClML3x3;m1CX?-q&+1sMK-ZMK
zG5^q<VCWuga!~skA(kFB+z>6UKOO$6u+)i>+vXdR@ufHrF#_RrM1=1fY(f<U%L=qp
z6Jv!r$y;&&W(OfA_~Itap&qs&xbU_g)^>_b><>mU@6Q1TEyA~>{T?<#A?7cLJZ33K
zjb8BQ?@L)(A;UuKJOCE+my>{8GAwxv0+MSFG7>RL#0Ej?m|Z!AVTMyW?!Fl0Kek{x
zZ2M}ic~nt(U$(z1p;cRB2+z`!Xz~hvx6_2H!P{{J@Q@!+24az7;3<)gzZ0EPOHN^(
z>iBZv<;G18!N-C+5+gB_c<wnziXknyJkFe?ynQ7UPt>c$B1fK;f8(_xBR^Mlf{SQY
zZGSx?3Y@doP>WI4<5|?xvlrR^HGwD<utHkK0s;Bkfr`e~@qF8M8cws3PrIMsD{gLi
z>!MLD5GX4=uiKZONUe84|Hhf2w_~lZnxT7?p?i8(<$g7T)m*`~|7=#)OpM{hM}Is7
z9n*>yYPQ)(X*43D1iM=;P1r3->^XX~`QBmn${fb)xNx~b+GZV?Lx^J@4;Sd&(gQY*
z?43-KUPg^I2qHL6wnwZvMJ5`FP}kkV?3TU(@cvxkz7~ekMMf&5hnDdEd#44W45s=^
zLfrRnje0_2<bcmt&EX894IGZRo+h=7p8zH0p*cnGO>PmU2*;AaR;^4dE@S9~G_uED
z4+#3r7^LFS6*+@<xEPsf4PsjEA~6GGn=-!UyC%YgRwNu3U56o^NJxKVt?P0A&W=+$
z@Yz4))2Z5S`Sluv0bwxK2bcTuUjKHVX9p2W97pg2>=vd9uJzE-Jv@TI-cd1al*(mF
z`11)1`b03;y_*Wd0p7%|a$t1(SJ_C);=QND+e}rLXHP2&7gNL&8g$ZcJKjGjDf93_
zwgR@VZc#-j;j%>uHmPzww{$4}8cxmvCNfWLVo#?5+Hzh<2B`uInkF`d3Eucl;43^(
zzXQkLq30`R8^R>_S-?E^^LP60`3Ty$pl_<`hTwjhz1|WDDq^kX;aQ6QsiMc31|U0k
zF1p=cdzC_AMim}6rUhLIIkV3Ye?!lOE5lu-FA>{Gbmz703dT9WgNt9~p^(1;$+Bjt
zLl^o!k6Jp)hiI3YDEH`#SA9Yg@7aYZ$g<Bj4I7V+@yXAR%DXS?zjC1d?w1t3Y?6-J
z!#H5lZ>Hfhzk2rDC8YJ{6f(Stu4Tz*(oJ02&ToxUaSEF2Ua3+z%Gh;5(BT!O%;5WE
zS3VcU_=-$_8K>I}mj$3vzg+AC!-px2{Rdx?e8XrcB7}V#?ioDij=u3iv5=-_eHd7M
zfsY=$UAb$*G(QCMF=2^GGstJTwMTBt6blW44#e4DbdjvwQZj-<f{#bjtxJ8jg9$RY
zC1J&m<_BH(J#P047wG!Ae(7N;mO{{G6$Bqcw3_OG>rI|WK%n5{#rS<6$lW)&KWP2E
z3-KWAqJc-H(G#&w#N)rsK%nrA=DW+QI?B3GlvC1=pcorGaili{y;ruxcT9*sSyNkd
znnbxYaEXs`E$@rwhQpXA;Duk*RBS5=#<Ca|zCcsCA6jLj^}|8zjn?T4)S93as4C%(
z!rQ0ci`0XE9a&=}6&4cr1w!MMSVo7)yBdi7@#dX>#zP%O34?=4l2y<8U88g&e)pgJ
z;zV(dE*%4_<b^GQ`fS9D0ah12UL?Ko^~bkg^nSC5Wy+;vPxjP^52?iowW+`L*JYC;
zUP)WF5&}{a-mhGeaF#PxCMYU=9e&!ZPe1jsu!uPRG(l#~o81VQQ3ceHu@qE;CJw5R
zwgugXz^aK}t9LP-aDK@9SG~^q`s4trTg4~q@0rrSd33mjKOjKcT5bhVnZpFB`<5!9
zxNe;OZe`RJ=yPG&p@BYhzc@;6%7OIE?cI1g-=kMP1v!^>#JTtJ2$$S33^0Fy93G;u
zUr%klo?nhaHr&=8B?IKB(Q4bW{+nul#Ut~EJf0=-i2y7y2c_Di9geIV2aZJR#ldcO
zd&PLM9j43j^IN?)5U;zt_Cw1)Tk8j#q!rTh$8tG#9KGxf8FO!h3ic2d<F=J_$wdq2
zXmiZx1*wh~-D6<6u3_J&+h}6a{%%MvUq)6z$IvpcU8i434A2edXsx~VHq)nd+gfhW
zzYJZd02O~-+863}UotX5dFH(DQ(>&H+5GuPF_7SJzCX5PPzjT+#5xz2KPd&D)GIJ`
z@Iy+e@-GC~(Wgp1DWUM=gpDIuSFuCnCzo^j8$}cn5@LzQf|4jBy@qi60+dp-dx<^2
zy$|U)-yj}s0|Ubu6_z1@6}u;|dZd8Yo9~B2G8vt;5|DfQ@(n#g^B%Xwv|{A2=*z7Y
z#%z1WtiQGlOEd3=SA2ZEDQ-zu^qa9&6tFGU%1hR!`tYMOFXg19;-t1l27ksaf+;2E
za|)v^t)plfvmIAEv(-Ux$zgc7^={#>T%95Pne4nTaE7;nySK8=`fz`L<FL^1NP+R{
zFqJvo*&t?F$o_k>)PraH5Z;)%b9GZ`6wbXYp<!%3VnF_u#HD3rxl=c2EooYpTDw*0
zC(FvF*p>&?Kfy*rn0Eb@5oct}hWj}Oa-)4{n`VVT8VobfA$<G@RWAIr@;KXPxyxl<
zDzrFI$A;5lLWUoAr8(pSXFSjwW0N&7eDsRvT%0*zN4z)TS^lMaCV_R^e<<cmoS*Nx
zH(_ah!G^{xw)|^6=WgJDdIOts6M}YA6uGx=Ym7Bkzs{<6cm$QLEpi5B&uVCfZW^0Y
z(OaW?^@Z4$nfm3bZo>(&dVfV!a5k*&8N(qEMOMjt?8m%77?;}-*}8)+H*}fs-FBpY
zl~NS#t-cmTzKnLkn0#Ht&@-Dsk{P@15x<%2VIHp`R23y;HcaWurVaTv8^fxZt{2F~
zTh*rQIO%t-H4*0)U2Q&yA86@9X+k#GsM57HW=xo<n#oKoHh<ZTIm7FC(_K4S1O(-Q
zITD@_2X*{9tX(DM-C&UOqwL(&D>^vM{m2bidp<kUzo^8QbZ{oD+jb~%>eOO&Zcel^
zN9PZB`4&Hhq3XKt#7tVMaM}a=gqF1U$0M?-cx=nUDR?DpmNi}d)VF2&R;$d`<4HZ!
zShf>8YfWM6=O???HIm&%#@H`M@<jK6<nVNcmw+QJ7SikzHDB6e(+Y1s+MxrqxkbNY
zZhp;qZjN6r`w4?4{7a2j#@Y7-om^l1y9iRbHu=lH;yM?*=hhM080p&Bb_PM@ar$7t
ztS(h6<k<R3I0d+PDXW@?9nv9>NtD-#xD1SSG>O=3(VUH<$oJ7*d0Q`U7F#6&kB*4y
zv6Lk-RoqFQ#Y(^_&0V<DH?RB2q6xiXA^R$!6z#cjl)4iPN7FpR5hc3vqtSsz!<N+2
z%7fu>o8|$hf*Ll7^AUteS$@$SeKr3;+2S@O_>~6P;BRA2)n><FJn3deNfxE&+!S$q
zEyCbGe*Px9)?L(cV*H(-Z~5{In9Owg=@&`-myUuwdm3q2Nacj&woudM7xg5fz-Vlc
zSZ{YM9w9!lgcAbHeV2c>Kw$f{;}xG2gCvcUwLIsk!zd9l^Pq6EA<|Jgk%w_@C^i+`
zTO^cesD}YObuYgsPc7N_ceDx-k_`yCDLkz>-uK3`C)1WN*CNIxvsA_jv>qH~+0*aa
zFyaZS5jZpn<ZX3oZYc;1;8ZC@4B$|}_|CvwTHquakqX5WncLD4Wwt#L;gliY{<s%P
zX6R&cFKGtPim=3pmp~@j;h3gU-i68fEZbjBsDtQLuJ2<8svCG`5J{vSH`4wzu|HXS
z=KFTaPYb4BHU0TPjDX(B4XE72v4<&_!wbouaw45pDncJ%O|ZDx;?P!egP-<v6Jt#V
z6u#or0{R?<`?a$R&8x&s{k`6X6MS3=9{J63%jui-wfx9{zj>n@3|q<F@*lVhJ4=iS
z-!6=(Doya|+E$Y#&vHodIfRWJ=w8K!+H|uhIO80<&1?;ivBui2eSwqaY8yxolYuRD
ztzy41P%L&4)@9ysLmo#sYY}GPl>c#S1i{CX2dOCy{OJ4YIgeEtsH1hG34Z8`Z-`t&
z6ma@|l^dxE0rUE6e`+wYsl6rgR6Vklk^EsT%~%EG9EB5)-6~uch`^uNWU`c@Wsm@;
zl7{I&#TJ}!8nyI`40QJ`vDtl+Nc9A8aJ_GZHX_LdvQsDX*n{LIKRt2)9@S&pGGV>e
z6t=!a$o33PcQ0pncdrb|#)BoCMzYV;{49NunGCTkoz9XyL3PFHVQI}*b~MN6tf;{u
zitnCdLX<{&$Nr>%bnmXQ`KLdeie{~eQRyN@YcN}1b@dn;D5_Oy`q7XKbNUw^7i`HK
zkJBFBQsi*SVWQ?-nbZ`3`GGmo-@*g-7YMJpGY0)7h5Szn81bv0+V%0$+1tayzUeYw
zS+ANw35XqpQL?qZ(JSU4+)P$oOj$l1NjCVsGkN;aziky_k?%rW3lHBAPLLzFhHaz4
z*)8z5`6WiWqj?btj4y(kX{VE0(j==$)re8`u(PO^|4ueZP5<Qym_>Xh`P8-$)Mt_6
zL!*Sv<|7lz5Si@Gv1VH{2$Fp)GXi2cc}&b(kLpzcgyA=zP%dP`)Y21ggUFFFKei4Q
zV$|yzmDPysw(l1Qw1?PixL*fM-8@=^O_WWxGP-;EU+2!^!T7$qR#j)zGFg9&erZ@U
z?78IJg9?cl&74%gic2nsN?!0C&bl^soE&PDfb^MyNEi%$qn6CR1X)HO+#Df`ghofi
zjP{PW!_>{@MyQiR-G-4R(}<V1W$#o=ouiyPoKQZF&QXZ=`4w4GIWWWL3VHm38pZ51
z?-KcM;2;WjNh9}nDPS4q^(nU?PrhH)?Q+kBzK-_UTLB*++&J6a963_C$w9pSis#KW
z22^-Qb}|TrI7ak1n9youmN<ph{y_&<a_V1}G{|!GoT_!1Kca>U$c(=jROtXWRwgd)
z+J*3-uP~P>h4QwinXyASyVm%2VGVC0iSsL2)8u?IQJ@)8KJGPb@e!=_!5xGaVgnD_
zqWUi1#+?#q*|Tz^eBzg5e)iqTFFzYm)VsloX)ZFyPyWt}Yv7<?cc0%bcpr@JK_};7
zE9*)i@1FVN<UHR;PP31nk_W+%J&B2p7uGsmu$nxBzLEEsX0}eHl+Wr#NA&G_E4@G0
z`#>rvkWW=QYfEuNnQT<Y%xJ9E#>Oi;l5efXWsn`fm!*`Yb1e%mC-PS{&R+A-)M~lu
z&vq7J2%I{x9~Ctxmz!H*-0D%K#kJ}<sBrhP%TZrQ1(n!v@T+_A(~?n44Mgu}sVOS^
zxi5ll!?H$1pP(wND~B-hqFLh<l;oInqKi9Y#AZ9npg5dK)%uJrk*9f`>iTtSIn@|f
zm*fnPsXmLU3R=43$|2rX0X(PL{8%1jk_#???+BEfr(%NN2cW%@KjMKKIA-?OO{52@
z0@J{F#n)3FNhQ_3$F01<vDyh`!)%}I={!tEc_Wm^zDsPX<zieBJ+vY$Bl~RX=|}DR
z2l#-Um(ehg=YYe5{b~6n#HF8IU59TPTxURH;g9>Q14?RiP|hK7r{056AOzrLQMmdZ
zxpTN&OeaVta*FFrX%IE6a@1t-u)XPg;lmLf|9R|idmUP*EwCkFQQrQC#V(myZ?GHu
zDlJFemCz2S|0Crj8E7zr<kvogqF$<nSlE5A@@cNnbt3Ue++34S!0|P_Qd0(GUF~z}
zMVTpsWE7Q~@M%K?gmfz5QV`UDpTFias9=mZ;}YwlfP13;d5oM`K(_z6%|lqU+Dt%#
z^CI~3l@Yy>eK?RQCNGf_S|6nbJ(5JA-AwX0qM%@mZu6TVi*s4iG7Pu!l#V=yEGCO4
zu?7np>Iyeg&FOGsU#d-M;}61f+Iyff`u_o+Kw!WAbY`t0x~y%At=>4Vxidc$u|c{k
zd6F#2SR%5FHAhjf?W!u4@*i1h=jgDd1(>3}^78r3XE&{y2#CXi={C@H+eX%KWAFLN
zNA~-~2Q@(JFh$<s+Rh@t0Kq&-@R12$+ET6Yxt;LFd81d%Ba;9Q0rw)<kxT|}<|~pC
zf7q+fpZ^VA2y|y*;pTDeVCcRO8!A3M&)$u+{5D|$zuGUdMMr-O&}>_N00z~WwqE5o
zDTIL~7d`aHmv&^I!@~3Cw=VcKy*3J+!`KgkWEbzi%sE10#iMqJ%Gs@>EV*@*`*;@A
zyLlE`zXpW^5o7^$KuvmzM&JwNL#!~Xe*#)meFFH$ulzXog8^@Xx1j_4<b2vc5)Z$Q
z$hSiXf=*I08V}GX&c*=8o(u}-9pQs9Kp*1aJ9f>2vncT0+w$-H`(G0lS3ckl41ZzZ
zA(J_?%=<oE^e`OEkIePQ;4RO`|ANw(B}pX>A{h>6=FgX;GMU`T;}cIJd78s^e+=@^
z-{eeR_7!&z3Zqnb2vw%t=bYX2)P*}w_8D9?yv+1+pnvj1beMU-0AH8*qYU~(Ts`N^
z{V+~A0*4cQyXf^Rg98+Za$uFwpi46Cf3xL|1@OeOt}~Aw-f<YE%LaEZOLsmdqXiS-
z)DPchz25D}c+2aN+iBg%strt^f4n|;WmUeNJ%^P+{S-v*)yyf_;0SDGOx#UwjS<bR
zQsurF)4J<&-rH=(&FmwG@X6>#plDq5rqF=ili+V;Tp6sW2!j;W^32hHdvSKr>kkC7
z%knDX4CWPpUYD2W6fcUGGfpPX%#>dS(S*JjkBgb+eqbVhtnePJI9Prpe>c1+uw?z?
zkIao?3Z253UVds+sYDma!Wnt}Vv#?J@hkSsqQ0P`CDY}=C1uMM>>y4Qd~9On{eZ9F
zuSvY5IUvNcwW&4C-;N@?E<8J>^Be!VEM0j~7F5VfRO*O}eo^`NQ|;$>^P<xH`%3xj
zCR|h;zAj7Wx6^{s{OhuGe|c>zD4!K5YvhM|L3shfRg^A{RZ)CQE2YKPW%0_Ps;`h2
zD65pms=h|{eOW;eWl<Q;S6TW6tt_RWw*@7CO=3}!BX`Z<5Jl(|$pZv2liUwg5Maiy
zWu9j6&b;Iqu}?D!9MrU;R9g9e{!j5gL4NRR@p@A&6{K0$m|D}=e{`duNrP7}d-yBu
z0twf(sWogfV>c=-3No*2Q*YR&U;!#k@}p4KqEXXg@xloI_`(6U+M+lvbuF4TEy5La
zB5={Nb5m_AKT372Sv9SRlQvH*;)vC?Vpm#$H?c&!`rC^$^pTCC>lt#%&gY-XllQ0M
z#MJd5OEm-K4KoT-f5Fr%IonNri}LaoE01W|UU3c7wx}#`v3zFB2A9scdTc6N{E??r
zncic#T>ixGhT4|u4olt)42?HDwLx$p)i$NCXbJ{8)e;OU6BMI3g(49mxo368LVUjH
zeGf|SLbCi)c$AA~N_TR8^$d_a<47)0#CYLBO>>RK<P1}+f2l9ucCo;=f&#XohxOXX
zUu$E2wNp*b_<Xg82iPE^@1`zZOP!-sFK(B@dN*3sjdp{dzYVrSz1!`m_}V$^06T1T
zJKIftGxxT&o!mF^Y1`DB?T?3kI;wBdgFGZ6Pj6e2S<e|Yb3<JRS!BtnR35~syw^k7
z9<pvraV9%Ef8R}uHiU-!V|Ol;4Ls@cicy%GXn*q)-|+)Ky=`GlDx3p;*~mcNbEDCi
z#D3<j<R`CxpOD~F)SOu@jGmlH-GQ|+_s|uG1jz^(-1eqMNzxaZ8YM~Z08}1g@>b<8
z5L7mEdEDNTW^JT?DlUAX99$>-wEgCYpZ2d)E2H{0e|Bpt#`b!{`}!94OiQxV^o>^7
zzEJ~X{ZV0IpDmm#b22OV)Ubr#OR_}a{KHxc*HRU;Yl!x(1GO(y*Kqfrb(-1?w0$ek
z?c!(6c&Du>6t)`Fx6RPL1@hEKM%N1KS~Ik3?P{%n)3bioJG$$mTvZxL191VY`vlZc
zV|LT6e;ts&zUFZkw8(jPfOBF$ktzh{CdAF%AwRKiu;{%9LDuWgC_GLKBrp=+Zk@<B
zy7Hz;Ou2s=6Uv`;iG6b&?PDhQb$53gq0w7_O4&|~^j3iuwhx=~P_DDt0LC?&5iENT
z(v7VNU9b_#Wu+YvvUZ*m1~(?Ji>Cn16=8H7e=!=G<Y8_<$K)2Yc5Cg`9dT6dC5h9G
zS*mX@zWK?94^+<u4@~wUy<{=hfq-G)j#gnr#v89e5V>zdFM?HgN78rEdLmzTP%5L@
zXicH57sFx9MCcwz&!3FeY%E|y7Si`DjeU31fr+-ZHZ)K=&BC>>dpl%$rQRhY>4=Qi
zf4&y@9k8t#X2AS>jz!9W&Dg<gerH>fIrkF;Y);kRD%@~N)o*FcqK4#P(^gHa8J><E
z#nUj6iAJa=8LsW^(ro=@$8aT6`nh!=O9*3B(hO`fqGL_BRP5M>flWoRG}E?C&utQn
z+ja(>Zoj2&f7VsE)9>G#et%h*&Qjg~e}bTygTjCK;GtOu<{ij8%fQ`O20Eqc^7ZMI
zs*8R)rRw8Ws&0fA%Ny(Ts@Xzxdex<L(&<$@z3SfTRUed=0$@XlB1u@cY!7QLF)&eG
z4|}pKOP--=u4cE@QnVb)({|-LIpLsmVka{;Jz+@}@SSB^Dly{9$kw{VM)xJZe+lt)
z7JlRKARFsJ0}-`W5L_(>3coN^8~WS1iY+1KP9SW{t#>XVk6n6M)9s@3o+#F{^Pbp@
zC_3+nRSWclxcr%jE>%5l2zR?wR?ya#6(rlzsH8jCql$|)i^<qhbq{MY@m!rKs?`Wn
zzWUS23Okh*1Y*tpOA2d1`EAACf3*#9BO7@qY%C_=PS|L2%sXM@=?EK9%%jFSd86~z
zp8x5*wL5R^jcMW$$Qv%B3YByXn+BD!CQ%O)O;)hvxRyZ-S5;M`lQ-_$HsRb(i5wiz
za=#^x(^GT+!#vn8K|(-*c5=jG!tCUTCdapvBc6^Nam#`ry6NPIPL8Pgf9d3iPL9}^
zCLVztA#0j$5Q$<>Coa|uB4Hv)CU#B5HC;_|b?ZS!Vy&4pc|jUodyN<_sxia1EFF8Y
zqhQTd9Bk>Xf@RAhhACOp)toMd>;CcCP#3hdpP+19zHFC$X-@W>iw$d+?P#wezg7#*
zi&I{7lJjCB?Ih<WN4b-ne;<P6+!n>V(m?0#m#;(zmbCDv6Pr7+`SFO&>$D++JJr^x
z%&3M<$+EGg*fMrpOTwOQYZg--W{@s4=uQQSJ7?0{$}u%U%ob%7(a0{WadlbmI&oq#
ziFV>dlY`ue6HmtwH;l>cU7O+3C<;=4yan{ttfk`7NsyCe)%D_Ne}o(cKs&V1yg1Ay
zlY~JID!4h}@)nn8bj{+}r<5g~NwPCZ*3o(gMB4$;Zb}o6K(=xfn<$E5VZ#L1Mq9Tq
zv5ATe+fXe{GIiT(4t^+px=^aEAna`mUa!tl^I(iD(|Nl)NoX-ab&^n%W7kPSOV*>4
zgw}n+iuLT^(v~hye+QS=!KKX+MF*sCZ`{9S6G<ViiEUE`heT7sj;B*>Xr^SlnrZ9p
z1DhV7L!z~YL!xQO%+#oc71L%|GjtC-L^H9@7;`n(lXR+d4vF{gka!j)Db6J(^tTsh
z=p!3N*B!k4-5C~P3-TS97lefr`;jG+AQjT?`NVZulH^Ezf7N0@6{1iE(g8cVHl$xQ
znXn)WP&wbCxwbpGbn#wya%qzj(aEJxM=tH~{krUk^*^0asxwM$OcRg5DCJ0oVHl2!
z4dzN%vzdvBsw&ttnPOU0Q5C6moLq+mz88Es2dUc$S6*qk<Hr~8amSB0xraJ_{OR!H
z9Ryw%gR}6be`CozmV9HHcmyoD;W@;WWCu&GreMvWF1B1^VZ&mIrR%mzG`(ZVAEc@r
z;NEt^k(Uj34Ef?6?ilhW=b&TApAJLbVaat2`NE%$A@3OSjcMW$Fyy8~6_cnAc9^U}
zzDx<*wxMCkvrNUa6vJuHkne-*R=z^O>K364YdBzOe^ilF)n-^%WF2dadf2w9flbA7
zi7Q(wm7BY^HJ?F?7c|cv+UogUH*siHCix{wnG;1<Ki{JRmY=c_Tx6fS6s?=Xpr=(B
z^q7sK7%<SCTQq^7ScnN)Sb~SkCV=|wksx7c93_70Uo!}$6`zD`NcbnTKsbvp!k0lb
zp)bbce;QPXkIao?dWsImBu?1Zzb8?6_>tW3lCMZg`u$^31W0JA=J~`K`3aEec}h}-
zmbNidcu@ZRQXCOz{xpq}H1@;cVWXBRHK(8+#CSnmR&2hWvobVa#>$A`w=@Ox241{=
zY^UI+<_Fu7yJt7G6T6oks!r@~a!q$)_kN4re-)`YjKVIDQwMfX_tVMDoy@!kGIP5y
zob5}@nk{)mC73Cei8aqvu_GxuwoFrTY(^bJk~<UDJ!Em}#Fvz{k~RSAs1zx-FF!#0
znbEMb+$|>TPK0Q3{5uh1$$E4mM2DEL^z?Ly2_0g>98o-7#DuMg5X$-@1o0F_p)U5Q
zf2m<jVlK9bV`5X2nQYpwWI7Krfm6OhITN^sz0Hz!nJJorWmlE3rt1<W%yzM*da`aa
znP_?odt0-Djh3U?LV#V3`oLzB;5R?<9Y65X+vd8t-k8K>#8MXjk{dAND6^OR=Chlo
zE826T(U`=3B4jT=dHwr@1fQbD^{+`Vf8qUq@`HxxrwvyqoSPWJi1&i78_zJK7TuLR
zNtRSB5n0BXqbS&RRTWG5k1VMT#@=M)jW)2b#Wp6Ec1GA9*qvbF-+hPPgJt_gni7s{
z%Vn+SPW&TCTk!Ab=+h<Rmb(OvplC|sA<HB)Um*PnOCCx&IADT^8%IfkNRWSoe_%QZ
zIvfe4f&m&saFibo2V9;^#$?n-eu&abh7uNtoXKMr`w=}xFQd?9VHy+oP;?HcyOD<o
z^4JaXL+W4qbV7mz`3WKbAQ**1l=#Dt1W*nDdL0H0AeW5B#2<#q@zD{?68;?>frL96
zv5-Q-VNOcVj*ie->_@Sm`U!)9e<k@Mcu|ZJ=1yWiy+s7(6S5>hX-xc(Pbu|>mnn<U
zxFpPR6!@+WO8~XmH!>Oryj66b#=e`Pam*5y_QiU*K?H`<Q55=V1lB@?q3kUJl!x1B
z5~E9hc*&9!$9{5!#w;2K?06Svi+y7*x+Y`fkT7I%t1~5gOjBjg!LDl?e^_Idj2+p~
zuu5d2T8hdX=G@1bQg?NxHq%ip&`Twg*ds1zrFMA=#R&x3tT}=Mltk#9xgW*}a!H8B
zQ|Dru7AuGG7@hkgKOiwmBSZiLW$L0i<5YXm<CpbuZD#Za`4tvqQK-U{&S<0HPgw8I
z2SVQ@iY5nNP@$n3<YjVXf0gVT->Wu^E=f`%yIl0jY9jO#Ev?4OR4Z}s^c9svCiJq-
z=Yw}7NzplDAs_z~+-W~A<=mpr2XL<+d^xSfP8BPZMq?yPqV&wthyvp{`a5&eqOrkz
z!9l)c1F;ALKCQv@KpUTk#Q#V00}JIZqnj5Y32sy0P1?z7z0@Buf9?$NEqxP5qqCfS
z60FOJeI((KwL8nXOA?{iBy<`5Gi+-(Y|c6fmGnOd&^<KN%CV_8jD32}($?mtp63T?
zds(+sB(?OTYUelRM!{qhz9*^61+a|VT6%j`bzbT^RoAwaS1sfYaK<e~zf1sq$yb4k
zq1hITe7^elTPu05f1L!pp>nJ@34N$0n{6k(f&Y0gNpA(T8fC6OBEcHM_Lh`htwie<
zh1+c6Mu&}G>D^K5j@klp>5kggjvBB{-AU_CT6fZRebS~RnC{4RNABq!xu!)MntlG*
zra5HV?gm!HH8q(nglMtn?PciRh{Qu4fZUU%@wdhj`<PIge~WTZZ;R_ERI&>7s4Y7(
zb}Xu5jhG51#M3ZQB_dmv;V^1GRx`(|JX{E+F?gOqN<IWyAA}K)AQQUOfBQKm;UplS
z-Ty<_KRz<9oe$G#*T6ycR}qI)e8R(=lENV_;YxkN69EbpZS}iy9Jz`T6#k%Cr6eVw
zf}I`{^23zHf7c{9I@*QC9~58+BUx*u>!;LlC}AFUR4_y<#KM*$yV&$xYBHv)PNS5_
zPh8i(zz20Xp$#^nE=v4>Co>LMiiR->(djg`{g8h-@<ULAqEnPciAw?!A6E4BsOs)H
z^23T2x?eUyzBO)QN|9YQk+{V3qJW}P6oWz*6@{{df1G}Jn2mJ6=hFw{1OHTXo`0I8
zY|MWxns!LS{*`Y7=+RRa`=EPe)gf*#S=qX|rmH57y5*TTGoxP_7l|4MMh@zO2E}G>
zIi#_i&_Bo+_641yrFcX4xh0zekMcCJ%kl-(6)3@s_+m}MED-jvI3oWY{XOzSbmfQi
zG+<sDe@(zBeOS_YvjpaIj@+f43|6B&fT#SNRhEmNv_6W$N}<w<R4G_CO9Ga-?2vyj
zKvI8D;~<_5t;oVB%wcQHd)B^oc)&O1pubOZ&fMVz_X6$-iLk6~b>11Z?fuMWY^__F
zI~=6FpLo^qyR{RZ#so+4a6iv@Hn`1CdEMMUe@xQ7z25S%Z9ek_{t){&<&5BO{PZ$A
zpp9n@9M7UBb~Y?&Zzo<8>(p@iIe)ajGb_*+Ij^#XU0ny-BIl_9++vT{Y92A8-_}<~
z>U?E{R37*tb1zApHurRf(rY=)e0%ZDPjW{gP6Ex9!@Y#XK1<#ahXs|+cjiAMy33uy
zf9p8vmNt+8Mh<Ol)C!Lm5lIdi3w!(E{7|=2^Dou9tF>`U#frs@z9R9}9<JFU*<~AR
zwoXIUCHpA`FYSl1XzMw-)h^q5O;s0e50|W7W?26o+o+xCo9yA7%r!htYAI}ub}CCo
zZufAtY6Y`(*J`t7=BaB>DQt-tupyQGf9=H?rt2=7NUriQ)@(*7TzA=^a@pEuR2RUb
z`4jjpKcLkU!qmD`1~2Wl^zxV;De|ag`HA{aIIhDyqFLC}broxhEn(t%9##xnc8O=%
z79)?<hvFwfA<ohBd>0*l-$!^xbX@65!HwN<=}+NIH3+eqtinoUk!*b=f{-Ene>2J~
z-%}xP$)Hr}&?O!dr8WF`x6TuKE9VJSG7Z^rUF^t2$C}O*Y`GG_ilSPU=Qy5hxSjJv
z3+IU~QPsTjL^AI@v0>z5sfy&!7q2m+lq{nC@}HjwoiFEmhYR%mT&p>w$(%YL(}-L@
z5&HF$SiG-iEQZi)GGt%#gAVq7e;Q4kfE{wgkHhKFoRnYBOsJ2JkSs|9r1Y~6YZRxS
z58#T)x<}vhpvL6`+L?ls42Lm?n&!7(7lSybSKUXZM0=u4i7r`^Y7h%k+pw{wxe9g^
zs$kbps0}}|-N><XRgo18>#8xYvC+jAbH)N;^coy_E0`adJ!NG(t+%}OQ)bU?^XeK9
zvHVjM(<0n<!}S%^zzjwiV-BV+WmuD`ge}W8v28NXG*wMfo#n`)%llcea*gvywBbcJ
z%onk4j)*pSA@++~f6ix!IMttC^lsqDmp?QG7Jmci?jK4}FDMzs&%To+RW*zsE_xgr
z=6NbGVxFh8=mq#+OagxxJ_Bp+bc4u?!W6?Z{7jL?-?G1N7^oDUIZ;4=5dGX-`YHP%
z8}RoRy&qq~_?#%_Z*leLgFE0P=7<i@Pf{v|bCQqigs(t>WAokzJdDVLEG`~Ey~G^v
z;(r716%46{p5wJ7s4V)4k&$rUcB_LJpfE~N6b83~RXj$V5luoePA;Pq!Ld%V${F?s
zgnV2BVoVOQk-^)n0-^cH03Smzos9Y}N5MHd5^etr8I6BHQ|ohd1Q8Cr7k@NnaT0~u
zkVgbCXrf7ie*O3^86d#xxJ3zH3Nc5|=YOCy0zSkK#RPVTD<hV49cUSqnieq#!MaQ}
zNH*kPTct8q4C;B7;Zei5mpFz8;BNkBMkw%bb3}eJP2yGbq7eg-B7uAagb2Gg;W=1@
z_;NcClGT{SxRAAzF^R9Brv%_*pxSi%IVKGc#_$2NEAipRg0q5#0U%}^qs)6(kbftT
zEr&qj0#7FCQ$I=l(9LHt5*3b{`LwecZ|ST%A<30q$Sz?^-KrP*s_-$rtscYN;&Rce
z_{C5B`f>ak2X8|!Doak>*@65T2QLHPy_y-wU!(XchzP9=BlC}`4ABqK;YE*E|0#$7
zl;@&1nEv3W+fOVcVR{DmRks(tihr-UH*#mj^2QI?`}~s0yl-Iq3r1BCU^cw|j3e`?
z-mQrWv6xpXoV&rPtqxI|(?mf;=Pq0|FiZ4-d%nv9^oi47B_x4&J0e#M3-vNOulNU1
z<`M4ajihNepdy~2;t+J+&)l7Olk5BBEt#5VqnKeiGiA}tRt;mjGl!G2=6}?tj!hZ8
zRhgq&Ge^<kmbY)>Z%m2&?mEBZ>Zbf<EoY+D?H2EKyEB3NqxE(aM;h^)AwlJ3kquw3
z8NTRhyTgYoXH9B?yQ$^^Flt6FdfCOuw|oVZ8&jEMIX83R-0tcQ$W)wBoPr7xMnw{L
zTKAXDCv%z1M%)2}tqTywF@IK@L!Pap1LGCbK!BySP5d|uzR*y4vpIl&b0c&QB-gD>
zj+6BIQ)`umb0b)?EL(O{)%XG=v)y<EY=k+sCgRxocw-x*L~I8mVi%wfElyCv0KJ;T
zw_7<zt)7IrW2EfjikMT|wx}x1P(3n9quv8_|EOwiT0A$8&f=oVrhiTt)3I()1#2#V
zYRImNP2FLJr82|woX2EwnNh+D&1+|LsSt$iNVXz-*mIeOHQUp$MRf&B)TOegs*<KJ
zCy37Ik`rKObh&?{%j*$?i+7kKqct<KJRcXsDm#{q@i&;jUqMGaieiS62%yK)%$h+c
zsJ96hH$g=ia(jocLVvJ)7+%bNpRh0uZh4t;%&tkm{~jPeJxGuXkmN22IN%3E-1?P9
z==X{5UIn+vrwp8AMD3UnH|1_W9M?bV?D+Y~xR}Z3rBiwC{P_R<AOHLR`hWlL|M?=f
z>zu_A*iW7bub*7K9gvVFE*Z1uC(e)1{+GkcG#w|;PEPV10)NM&ToHQgMxzr^k>oJe
z>WL>?2Gbk~D;9-|#U|L6WQJWsGY!izs6^cpa8&|B(SH%(&B<v>hROGeuD;@dGJZJh
zZ#JtJlQaTlFGbEI0j)ml4NP>(%2ec60BD*7K@yT6U;!e04@IJPv47+?j)DMDKQnEh
zU=p)r{Z&$#qkpTaX<^G&DAo*H$3(MDtmsrCx+YsPW386pQxpZ|^v_d9f|u(LPotJ<
zy0U_0>S$QAT?<>9VPHkJW!s{f<k(KD;e9xN`^%?te82wkQkHf3<mbyMNpE7G=by-S
zzTA{Dd&bXv?}*D)I~y#!BNLP9%*2|bsaP|03tN_?V}H+-H6p9BY{+Co%6lEU@$DEW
zFEj4U&Ide70W2v=Ny<(<KO~{+g9VDYX%ufTIYXDJVb}y~rXmBXm4h9}Hn1+)%+?&;
z@u=M|uD&d1%5#D)W9FS+^z!b8(M(6)P2h)DC;tWh->0XFs;IWCUi7m0oL=<4Ispl<
zE_!uKrhmaTp7FQOfVoBDW?yKqN7XBS`gO=$0b)Y^N%Bk=n;~ZNBcus}>=E4kP+aze
zf457|S?SKi327Z!LfXC{A-Sd{GfT(B14@&Lfo<0_v7<VUO(dJ@RC-K;#4Kac$q*$i
zXr5(R234_TDFkb-tYPAq9ww^kP*qZxsw~gv)_=(mIqh{a#Qn<<rHcu;SDnMFn>od!
zpGnGY$Spc!G1u0GZbLV&rEJ8n+(Cad2~r>OYhAODLb@%1ikPSD8pjcxfSVWOGKxHp
zJCOhv3LaLumH8O`Il5uj0Ivx7wjfj>W|u5X!0UyD6sHje+Zq{<<A}JI|M~C#k&H<Q
z34g%2Yy!dtI9(Mj4$xTWOa{mguUV4%!nb^YVwQ}fFku47kz<GExy1hS-~R)0m%-o=
zL6gw;e2|wQLc#N(-D?=L$3iZ|5P(=r-Ak4LU>y7AGDbz-C<ab$#Jz=3h{O*fM(cMY
ziGqokegjd+Dp<F7jKm?A?B;o`o12>%?th1cc#;%6*ohNF!xKePj1$Q?k@b_JFy=D@
z_JnUB&TC+Yh3@5u#8-Ye#8>PV`(XmKm|(zw#8JrbEh90GJPdIfCw(->qpjdY|LhMh
zaRS>91T&ph3(#dU-y?Y-Nm7=SD|44(6k+s+Iq`(VxBvO?|Les#_5%ddLx(jUh<`Jr
zS)ExwU&~#xTMbi>X3vwYxt64PHdZV{!XSNOhv_!<991To=PAnlzz6TW+Z~W0zs3&V
zhLnAK=7Xsl;#Qvt=*$874bo)7=R#P@Lw;lctz6)*3YLD^){5{T1<JnnN6aNj3SVlb
zReY(!muGPld1sLyimxrT_*#Rn|9>3CAxrti;HS4x#FEP*Iuzly7*5B$cUhN<?+y6=
zZ5)MXQOw(y6|)?i3E%!i;+VJ-O8D2hr59gY@bw!%X0LA<e5uHi3E$0T9?QV-$`g~{
zSQkAA6@n!lK&j~iJacqUko*^MYDF!+_M#*H>hTn4t=h=k8g>?oR7p<O%70K#CqiHU
z9z-O|(0D4-hDN8Sk?QO|a+WP1;SF+6$akB=Y*`L6P5QoF2D06_4Q#YQ4Nv~lNfxq>
ze~9p9;1+nPb;7r06lS!gur9}4gB717jK@=nMP40>Hn+<6?Vs|cxerDh-MsTh!ZWBj
zQTM=+@u%BeJ`|v|_zSz;-G3bfQ}~eit;ml9&}0sm<f#IaFkSPg?oce7Ou?E&U2NGV
z#THQ=N0DXO@RlnNADANf{PoXO^--rsE=fW5RAMs4!4i=@tXU4hHYF-%rmo6Vmn2)Y
zIz96J1OSU2B93b6py^jVP^CzUhHcd}u;j_aq?$=wS#5ZawTmd8)qen44SVS#kuQ2b
zo~Ps%y`01`3)6<`>P+JZ|1iYu3b&9VOF23$v^)Rp)yMwP5&F-6{|^Kz-vLT_=p9bR
z%=G~dC37i(2+JVwhb(ki=FKu2IGj8~^JeG(w6wLl*h10zjmDW392aKrI<xeT<cb`R
zl39y+ZXkw<mdegtp??H%L&I!>g$19xD&Wajc>ZKF1av48yO(vdXr@oD9rSdysS5QY
zUlb_*iMf~PWi%Rrd-*ML%6VnB1vD8`l4kBq!s`VL1H*|=;i;;dSIXQ=H*a!ghTtYO
zjN;om-MANlq8o;WRYMoEFN)=*yeJlBR6~anwaYU-tLlopgMYcC$YTTy7(6t5<sxMZ
zvKARu=Cfd)_~w$N2@cs!?Nt7HNx&rx9LbuD73PZa$?_n*%BFdYQE;s|I;z{Y>>!M2
zRMf~TEIT-L<=eSeJSIl2a;tV+Tm{sJDT=EbI(Df7FfN`79>oMprm7RqFkM?+;SI3(
z%VpAXk9`BuJbxoG8L><^x=bOkm{3}g2(TE`hv$m~zX2G4ANVQA!b|w7-Z&p*fdWdL
zWi-?ipl^PLlHw<?f1i-xQ?#_sH5dr^_<L)tK~D2!0?H4Wv*wbuXd#?7^=WG6$FyW3
znV-9-xUOQF*k+E3HOruw$ex95kLaqY5tUktT3^)m!hgxF=53qtr6q=C4uD=7=231v
zF4#1T^Itit3&5$2<LKI_{OJ>gfeVW=^KI^ycyv_y4;&qV6=^jqAwqG%MqfBLMqx_)
z5O_IsbTrC_D>$R0Bgl>7UIJeCwI73z?Eod?TPQLBqkl}oBpSh=eGbXthsaM8baVvq
z=SN3S<bUXhq$zPPM*tXcbhH@W<&TGaQk6|kYAze8TR)(yG)9fJL@SS}C3}kHc`kMg
zn_<m1Buot1#V&DWlSs0{sIl#1s&0Br+uPf#&^CWLdz%B&fTPP4m?xkgO`rP`&L&}j
z@Z1oPOc|IBPrZx9M_C|!77`B(8*qk<xR*Qzu7AY3X^1;Rf;^+;3~tM+RE+gW?22@e
zSu#lI17`n?1GEH1y*zd1yT}#Z`l2#)@U2pHM1pxV3f@c=7$7gQ7B~Q}+@BuoT%TeJ
zyXm!rnHk4^m==HwGZQWm8L|#%5;*0rNuH~%23RIv%?t^mVRsp}NPVi(nL%)Lc=U<O
z8h=%A3uQ}#IOi|dn>ZT1ibli_XZsi5Bk^TDK1;Ly^9^6M>KPpi<lc;WYoJt0s%nBn
zkpWN?fD|jkj&m=LWwu-%DO@OfRtF1LJw0H-3m!brF7*-87p%Sz*YL+!15Kh8f<#Ny
zh&7QSnxjK37jN64K&*xQ&<^dPy$?WRtABk<B!`uHfwqVZEl?WTAv3In#;`sD!wQAV
z9~)3(dqjn`P!wj66CMspZnCtkupFA=H!K{{(@~aeB!cDa`qkKngzo<M0gGaa<Vpsm
zD%K@M$C{%!*fu1FJx`JqPp68isaw~WC|i`pS^+M%hgxoCV{M8$y-m>RM+l~zOMfh-
zHj=*#!0-y=+sl9?T(1PStGqN^7!4r+1QK%Awi|^>6!^jzcE$269T1hmv0sUMCBj+0
zjRWF`by7O0u%;w=lH|es5De2u%jQKc1g#H2L<FgRIz0@BpdIAKM_0^$YWhH1$*~B6
zU4hs9)+;7)4KFY#2mC8oPd5rZKYt#fbK)`dqSV2mLk_5jMiFIwK*D7qEGXrZAVH7?
zn80|-$RVLKOrvqpn@2`|03x!(g6QUWV<v7!7q&99Lg9KM*{;D{$UnfaMu?3aYB6ld
zRF+*^VGh;q!1ZJox4?JbmFnY}<5S6QBq$tkiN^uCg}AK+6j$V>sipdM6n_o?<P5Np
z3F65)ii9;x1b_*a9D2;u%n9-WG8|@9Hmzk&R%b_QOFsFs3DNwL5n#8P5frl}$CNb>
zQ)X#c(@h!M#E>99TJcneN;ajtCn$ACxeQu`6|K&EB+?jFvmMRZJ8IGz{bNB|qm_zG
zG91oeKv$KT)l^7JRF+faK7Yi+ckG%40&p7r6R3M~1QV3_qe;Nk6B(FwUFmb?ei%c}
zTtDE7p{e9Xe_^-i6c|dEq=&z-^d^e03g})0K}Z->N%d;CY@nrfip0aOBl4}9Sm}so
zTlx#Toh_S9x5P1SnRTA8IZs|$DGTwArTPqZquS-D+D^YO(p)VnTYsHKzhA0P#XSBV
z`60UULwX9VNHhU>5on`7rF31G)~SB-Bw&fl4(GlcAZbQnSI(FuZj-bsP2;QD>gTql
zrQ1sE)V#(H9)N~P@7GCpze%q8rry=lIX&lSqp`d7digsWxYc~wR1LHPx0*GS0c)xR
z)>jNPR}ZvgF>=R$X@4J6Ky5h3%;iFts6>d0UCCClCQJW6d+(wgw~elgz6wUWX1QCd
zVe@`T##6_3;*59fL@U<hRIPYQ1%hCU%WRTEvMu*MYpV7;>^Iy`a_R@bYv0ILOO{$x
zl@qBOcl-eU>-U?OsHTFcrl_h)sOGBL>G9MEqgV1uY=Y38pMU?76kIMUgJPiWJmEYH
zhkj!u52F=#i=D?|4#E^jcibiL=DLr(2pmdz9hY)p?J%-n#dQJ_GZ$i)IRjse0+{}s
z#6Fm?So|f-l30j$MFMpJAdSfsCb2KD+Bw(0p*r}2#z~aSL7a<{<TD@N=Qz2EQOeb`
z@JN=9Afz=@1b@|_*qkT$AkZau4Iv`E522LhTowlD6^0_R8^uMIKmyDlBYBZ6DR_Fy
zv_^v@noay>AaV9OOPb%An9-%1VG@U`F~!yl2NRzdkUq`Du1hI)G=q7TNrS+4M~UOu
z5(k%a*POGON8yE}(j3m55L{)!c#f7aKOcA*hyPpxKYz<xI)WI}luoJ}>Vvof_(kzd
zj{4aHl4G9XXGfG`WTzJ-%b8zJ{Ux9~=Ijb?@=14LB>%qng4x%!p-B^8qnGWro|m#<
zV*%S0AXU*bxHHSEG)&@WvuA(*?S1ouQfk<mMx!RNY9K`-AUGziFQ&7HE|JMS;m#(g
zDWHXrO@ECGXXwA{>{#t-x2tm@4nEv2xrus1WWkM9_jMrCfHb8;>6X!z2;1`^Ic;v(
zC?xjF;CmuMV&`5ME+S^k?=K<F?rtLO>umTu5`G(v!tN6gcHNT|c9};#E6`l5Xdc6c
z?<?4|T@6#;bv4JNntNIXq?{`_8@5-7^%Tq@mw$FY)*j8RaD!YjzkO|>Brlm_U|^DE
zDk{Q!xm`$(Yx2q$WqwF*Vo25q5Qu*x^fTaL&(LpGfC2EAi=-$eN>pUYf01~GK8kRJ
z=@E=b9Zi_NHzIn?YH6PAF)=OO38<-J#nBaPShk5B+c&VI1&Zzms_l8fBR(dVNh)mQ
zpMRN;goATKKHPC!ekipRAYEpq1cVj|1hCdQ1Vm(}lp?t!e`N!O197xdu<pLlz!-fH
zCj?>iCP`N(dr*9h>8_%C*l@vqtoQ^IL$|T+TSW6zO=a3P@2f}uo&cZId_}m%rt^xF
zegJ(Qk=Dym;S!W52S}^&DuuC7cY^M*_J4MHP(**~v~N+xV;&8#>*x+PbU>N+bb@uo
z_blqVhUVM@FLg@36C3rHz(zHk$Ep`eYQ8(}HE=K*0iRq&xy^0juGEN|oiZv-CT~rA
z+kRsal)EDFYVzq!Jdr$Qc>PN9Kg)-b|53k{;?E7wCI3Rcn4iw355!}mtvvjht$&20
z#)egCtENOfpAGR;(4U&8LK@zw4vNAiv0sa8mT{+Lj`VlWhWi2UQh)5aNBa~J>bZ`o
zE7)N=fu~5vo}mTU34Ggt%!z@wJIdoJJw+QHo-i(-rsfmmt<V>ei5%c<_hq;)%0~*^
zgh?q(@dN{v)U)~Bg4OE2OW*EUYJd6)LVLS|q_;j@Pv_<0E%9gQWz)rQ!=h~Ie%n)6
z4x;X0>-Yygl^vY-XB#E_XMonec^ZE_1C2p77G84W$e^f**5+k;=IDO19)&$|*bhKp
zKLC5ZuT^Ce-g<w}!9#Gm4@c;3Mmm;usGgnf!O7MYdfhj}bl+(nnvDH`M1SmuC1Jl+
z0`}V{U;o#=;~yV*CN7h-zQo6)aob%OkH-BTjs1oCz`>u1WVt=@?)Ou|8Dt<G_zH3p
z@!OC^TuR!=vh+eN;O)Gc&od_Siix=0xL2+R;XyDI3cZx6_^iVo$_`!$q8zzfeiaeh
zv*I-)#e$?4^>aDT7>j>neSaGOQ76AnB0v8r<1*<VJ<#g=9RIVBCh_pqyR+dGWPT|!
z1)cRLowrF`d@SG2J>Uj?$8wPB=Ig7kVZQw=JUk`N7<_>+I(;*u>lqexZS1NP+)^w9
z6G|+stC~fq;ZkK!c7>;;zq*wvMF{vDaiD8JDQ$~8Z6;wJCk0!i#eZtjXlmL}3_ZCp
z)Y=cbUJ)2T8ihr3k)Y?<r!(Q0yh>RTOoVszbngPo5|zX8&umpfN|aXUJ)YU!!l1QO
z%}PzQMMDJT8+sv;0dUmnoW54)X-clfsMG<a&NtD=JW!$YR!nx|^6w=ptYpPrC;N=w
z?pJ3=TDV7I)E(skgnyBKvVwr;62sGt00*WKfFQuI=V=OdR97>7B`{56JGwsaXZx31
zH2_Z+i@nSg@&K^dca>d3kvtr@U2{yGxH@Jk<ZfdI!HyCb*w%H&REX;9TLsM#EwK6-
z(E{%VEs%Q`mpJmM1d^XMu^Y;W?G=}eB{=xI7O((%*T}hX|9_BzemVX~jz6Dm2{~Vj
zH0Nb=F{d_ILNhf;$K`)0Tp_7Efcjw$zD=@nOz$qZ!!>8TIAH!NSt36{aZ<qlJb*z2
z_Z3jea7e;DglaU2V>x}no^r6n49!`BJpyZxEhCnHk02jy0Pe2ag7gsu0Zr<30P`VZ
zC7|KaFbO@vV}G1$yoZV)Ycdpc*Awx9dc-mm-N#JxRBQyy!6Yy>Y}(AE8X*odPcP<d
z?G%Vef#0RF0JajSC`Xf&Wo_hyX)|K1jr7r?{LTG*hyG(pG6Fs+42bM42?6eMk}**2
zFkfg4lZ^jASr+IQo*D6uutL@@vteK%uIVv5FdS?s%zwj%Y8u#8eFtkwU@N*FXhC3(
zdf~eO3t8K^`^5U#;)wW6`XQb!7D!$85;k)Upsn;coHY))_$&-2YYAvz$?9^?rZagN
z?5-ioJbMDbiCfoLqGN3Sex`JnUly-F<3*~qmS2m%XCwOJVZM?l2duG~x(<V2{N~^q
zHSOO$uz$uKPD7m0JH|Nap|HJYz3YgA**ApfbYU<(jjAp)9jvLEjty6VJQ})+sp4t6
zLrq6x+fo`nUMX#pVr8J9_MxYsRz?!-S5Ryg{qGJoexr72keC+eRI^-_VI$BrfKYX@
zYib5|h^pGE%M3#s#k4yS(<-X!iS5`YVfzT{_<#6d9Y<8g5tVTawCf=}9+z>ptkGei
z58v#ZEZZC?3RNjnFf&bt4TCD!@d5=KB(N-vQWiKPob^#Wm+y?#+2-mz;!!^m#-(rA
z`zAq$dpCDrk{cxtierCrcr&Nq@qB;^_Eg-SRek?+SpJL=yALs#{hK&XAKCYJe-6yi
z_kR~*q@64)ZMur%D8$7o4Qy-}gkjI{8P)>J^r)>Up6Q>Q23mMhy}S5gpr2UM^0sIx
zp@9<?{%+ul2E1{{L9TL9`(hv>)K-vZH_sCqlFIL=qnEDWL~EzG86r^<&qZ<Qwb>%L
ztj#l$UWXLXB+2{`5-;Uw0!|ji(q}USm4ErKA|_Dy%B^6u{NW3e_&NF;i_$6!>k3_m
z^J|=i`Dc`|IbRs4nJ3GP0)%Rk)quhhQEL(MJiXA^ovFo}+c7Z3k?Y%z2PuvM)4_(v
z7$#o8z~L?MROS(NREHl&Cag~cC;f^{C-t$K?v(L%gLF1xF&hm&0q>)R3|3FPHGi_7
zSn@6o67&+Tgey4RSK#(@6{c5m6V{hZR(&t;il#s(n|of~BhwjrUtS~|%T>2bTga>X
zoK^iangXX>9yIk3Fv$u52eJMxVCmNVHv!6lCVUOg9<O}3AnDymhamI6UL9L93=6jS
zneiC>zU0yv&#y90MY}g=kRBvDV1J$Z0jwOjMnhL<@A~YQYk>L&l2w#YxMg5+?@0l-
zN3ZZrSxpGpP+8tq{VL1bN_HxK@7Jrm+<49Ek3Lo5j%zH<fSu%3JAg<Zmy4b=ZTr}r
z)t7d^`fSc(&?aUf9XM)H^}ulh$-g-W%PCHL#%oqkRD;e8cQZR|&<!9dh<{Z&JHm-O
zvfOWu37Gr2o}H}R?@-UM7*#N#8i9<kD)s`0V8wGx$Mn^J1#}GZxJz*fWRu398)WuT
zqPmR}&@F@|ZhFdAn`9ulP17C1o2=cIk>rP9=PGHZf!QoxrnX6KL&4I%R{nbs64k?$
zeonzU*53aoXCWKWo=0Gyt$!l*D1we6=qQ5r5kV!&@WGhG8QX0D6hET``!KUAtEY})
z>sdt6O_N~Fa{_EQ#KaEsDK?$J2<*U79fgeGRYwD_k~}G{3@6|Rip!Yx5)XqLQ^I)8
zF>;;?%#~)j8ud(u9nGZJFsX_?Unf{`EzdNW<J;CY7_|}Rs`?pWu7B<d=IXMWGfn8A
z0F+p0r@j$()f%`I$p_<01qlTls5xLz6np2{4}<DennGIbYlc38)uTXZ#&TA`)Rz#7
zic;ZG09YD;=$+&R-q3G_NF^>MlmbS14&F?#7$N2U^-?|PCkqnBdD-M8i%DFdS5cJQ
zym%cY^fP)N=EdEiPJaQ3h}7glHMUpjP(H%c^mLmT*jAZ=4Wb3uQ#^t_-S-_^*LB@h
zPs@vJoyayMYv*|1N+V~xr0>d8j31JWQ5JsT>7`qKVr3fZCU)8-M<5f#wID0xF+>XP
z%f&Lpy}7s-*LAXteE2fW!Xyieu*7_;e7fk$V_8MX1X|}PYJWvW!Z?iQ&(Wp)t!#~o
z@Yrisr^%L%VX*x2jDd@P_|K*Aom&a0w6AFb-51G>m&q7caZ`pomcyZf6Ic42rCG8_
zA)9^1(j)`60Fiiw@@1aNlTu~*=4-crix7FMl;r$Q64R-|QAB?tD<lg6-_A?E9zS1q
zA1H?{4sZ2|8-L{OMm@(Sie_QrD?0ER6g!R$E^mgV7_Q>GWDNdpn{PU&Yj`?rd7jN}
z=NU~lJB95^JGwLR=M(UG<9Iyl$vtOsW9n~8BS{!cc4WNZ-R#K!DQEkd_*a)10ruhQ
zf@PG&1(~xex$xZV<0nfmViTUuX|g_=7j==&6sG80RezKj(xxq+#q}os^it_&g;*=p
z4W{au4RnKrX{~9IU=$8U3Gl{KPP8Wjg<caM$;Co{=7n}I-)NL7uj<h#RX<y!QR<{p
zkbaYZtGmq}+PDf2GPNpwD~;Rz?YF!2s2#N3#(i7X2Uyh?Tu<7UAVpv$xCSdHoY7~z
zBCDS<>3{eTYBnDtHIFa;t;u;{l*y?uup>E-URB$@s_tJeI^qj-w852DCqG%A4Q2-c
z3oH!>4&ZmGj)NWIx!89VVp7YpsIEL>a}n&Ks+4(xevmf3mcqGVNt#HZbGqGt)UgiM
zU<CVc1=gbeK>?b@B&q`a!D@+ujQw-TVz9e(v40C{6Qx`YX{M>oN+mi#5{E^?v+RHd
z`lw(5$2GS|)8@dWD7x+{j$&iY^fZ7MAlS7G2fGe)G}R{#qxXQ+{1lR9Hw-PU(3uNO
z9)L0|2I39G;hH{2uY_?OZYz;FuufjZ?Vg)VKtQJ+@xkWF6#;3b%jR{s-LQ4^MoUg_
zOMgy{DK|s6G3Io)`ZVk~t*3$8RJ!vV%{XIh(HL7aCLQ1M1dnE%is2c}I8WDVH=1!;
zt23H$j(<h=*1CdrK4(8ca&Mt92}qRh1@wH3N3P~;pPcsmL7Fy4V^IAw+BS!f^Jok@
zO}=QfZ60U&$J_Z~qoEH0VH|Cn-zEZm-GB5_n#4}mzDbB-+PZ-?KhUs2Oolz(^suVA
zCQ}rEUJJ&U^kc`QUnc1*8IcDORroSV_eL?ERs_1i6jxD*hnWpwm^4tat3y;Kb1aV%
zO|c#A=n?4K2i40MSzFFg70*=X40<PxcxCJ{#<&VWE{F#vl`o;s^4i)L#zi6xhkr6u
z5S^dbX2<jMegVb8+QZ{|Wh*cn62@R(N9X6&ScUof{G8i4A(Xku(fPR;fLws{^BFon
z|NC$6bNDUE(D^wJ9lc(Fm&f_}_ITbMJAQ!Q%voBZvsLNPiMNw9Z*`{i+ni}>x7Uns
ze|8T(jsbHt-?B^`5Es()QVqKvaeuMRG)6qnC5qu4`#9>iJ&wb@0-F8+KVQ6)HsRG;
zMrM?jXQtr=z>V_|Q_LdayppmkgnVG!ZGga^SbT&oGqCxJ-0>)2j2rw#aBmnvR5Hmv
zL(a*5sdUq8^b$2Q6!Z$otV*rht@(}c>8$F2#~MQpx9h4>36oN1xZpLR^?$F8n(4Ke
zDu<t>BqG^_H?km~8J6=eOO&{iJ`2b)0?WDr7zkDDCCUqyij}Ah(7f`rJ<_!<#rW^0
z*JUiztxVD^j3qke+I-j0HK#Lp8o2L975^%O96z1S(61ScO`TQ4lnXhX4d}`jeQl0)
z?F>K!ZePln`g#c3QHHSQ<$u!Yz0FM5z3T&eFE@JMa!cyvq5M2j>TBJnQTJI>Qzu6t
zlqB5*filcg_9I)_%`WZF_cs*F^!6yG2jiD+2oen=wo^3XCHhK5BIU)KzHVU~67==K
z9&PFOcV=VTEkT_{EGP~hY%h~Ud#GB!(gSP|y@RisMhXvDrrXNh1Aom31I!1*Y-tDC
z&<@Y-w+|Zs7SxzC;Ic`!I+!H)UT140si}{LByY2{U7>eRadGLNk!6wW7}dWH5u^q<
z7oWP+#W{5JISl~{BupQ%>}C4Q3lz`6hVB^Ha7+(7#0~(Uiuk6h*{ZV*7IFmRtA0i>
zzT1QGegEm~uNyR5{C{Pbq4)1UAo;o=&aviUK0~i011ZJKTp(wOKhT?q0C?Cvfb|Ih
z>kgs%K)P><=cs^Xf%%pzAj3=QLGU%h9)Z}CGA4yoE5}jDL=`I5>G?jKzu(xGklk=C
z1hmYniTP9ti{hFsSpGd?F)S|nNCJl5hw*0-Ll7<i(=UmIOn;wdi5#jJO&u$<0cMTk
z6+-YsvIsfWUj%7IIiT9nQ2wMUO>E{zF*Fsu=GcFI;l`NB495*Hb#xCK9(AzGEFF7_
z;|HF}0$mLraln>Xn$Fn-k||Ho`8hvF;<zBc4ACOn2pDu<;()9lp<%~`L;eAd9zpb)
zWJM{Z3-myS1b^2L{Z+ttC2k-zB)S&|B0qlGR?)nW{Qov2oXXH#78t&UEtR;~P<#cu
zh7w>+Q#IeGOw;IY?(=DfQ>{^zz-9~=Y;#zZPr_)$^`g)RD0tu+1kE2WBYI?CX|x1e
ziZ2vBpzxDGq;2dt5jZ6xwdAc*0nnj*l^1OB9R0=?$$uANLHTs{;>D*kXp2;ks=PB;
zuYTHEGM}TDXh8~=g*-X)WDB6)N#W$}Q8jlP<R3R8OKUx?w`%BSUm`Dzo4vxyPlaMO
z14UP(EM!coHHEMX%?=mMcBWHKEnCYrXF8qM8e%bv|4PCbeGX&)C8&UsWx+B8ZA@Ew
z<+kpyF@J?kQzsG2DVub@njxj5m#k+?ayp{dZB<OdBgEgJ9&5zQ4b3adublUtM3qMk
zf)ZVna(IU_dOI_7F2B@~aOdJ<c}U$>*EQlZ?9qW7=)=_Db57Q2$y0pQRv5*)u2O6e
zU%?J#7S>G1Rt!o_-7rs$$47Wg)NZr=za#}BQGZl&&;rn!<RM3>rpY`G{})JvGjwwu
z(rXmv=;peQ5WEDwu99&pMh-1lah-tt8^*wl0n_p&%nFb?auWN%e6jdTm?bgy9f23u
zX9b9!41t3Q=V}75AeC6*-Rc~oJBgAxuy;|CeC9*@949w1O1Tmm-pG7OuR*vc<ur3H
z_<uq*C^l!nIuhuTJG2nqCnA)xoXhsWV8T!&06w5`LuSj2<VCim#Zq9I4;87_+1>z{
zNsz4D>Vi8Hbzb>jB%KVEcTB^!n1U6{BG}Lv!zA!rZ2H8bmZ}k*I-|UETzLn0yH3Rx
z^}ncK;+G{nzAPBe(K6;o0xvn7z0d^p6Mt0}VGJB))56|%Gug^N*G-VGy_;yW)uX`F
z1lRc>ZqrRt(*_x03!HXW%A27dE?=f3%h?sYFOzO>Whz;)$iTJik@?j!P6_=y`QdUc
zZ|onR&fdb+DQ|Hun*Kw;pof8wUHI^ybxJ+sSF8B`Pn!xr28CrI%1&p{&)<K0zkk1*
zcA@oN+TXW2xuui|#pT(Nh2eGMpNiv9etKNVaoYw+>2c%NGiCdV*7erDosE*`Vaa^K
ztM8;F&o*fc7d#Vwg8GY|v%8y0=X4C8OBtX$%Fsvf9eD6Ebc2CDZE@Q2EKN6Tf<4vJ
zu;DTbJFZHxVq30F0!{OM_jJVR9DiYM%I+Fu+tPGTx%fSa=Sz?=U%hJ>v49hK4VGiD
zpK=xry-603FbYholh;4K0e@sUo>KZ<Bt8SAw+vEYC3E2D!Y?dZp@@-;8(@Wo`#M>I
zfXpSzjFAZ6Bw5rj0E1w>NI?O>g<2A=xWECbfy(aIFdUOyN(|`jGApiGwtq-6HbWs;
zTxgP|Nybg^mDKuy(CaW}=zTdV=;jwvEHe_-%W;t<rF=d4<^9F9m2NA6ar-lvCKM93
z=Oqt+D!5I*8Ii&zr5mzB1YIu|B$oRn^J&e{ihG5FSTEi2q@*oGF1`i@A}9jSX9N-o
zdyf9#gGVsae@w26BF(>h@qYqF2)Y39HC#Pkl>7gjCW{wdl+0gLANi6Zf+R~gJ?NI%
zE`iG;I7l)q3Sr$ca~#PP!X)J1@wLY+z9umZ<2mMY$1*+G3&UK!Q*@-!8g?7owv&!J
zwrzIoRM4@}amBW6TOHfBZFg+`*?XUVoHNd4U43=&RgLw|=bg_|!tAdtmK-i(gYN$Y
zH)i|li!ev4B+p4dsKTtmhK}ziURUx$wFJJN2j?PfPn?_h<UP!`X-EP@Bs}ItYPXm(
zg&IArZAK^n>pVWtC2U6CyG-o>egWX_r%nlw(h+z>YqoaTT6c+V=J129+Vex*?0Z_-
zRf`KfqkZ&#Q!D0EesL+-qF|Fcsm?L5ZE#g@)D()@B!xkd0<${wK3<zftqv*7kp{%$
zOCn!RzCN$M0t8s0+}MDKBpPL!(#epSXKM9{?l*1?ch~UEiOFU6@rhw&2j;go%bfPd
zv5=*wMy>&5wOQd@#6;dd{I5chi|s=}%CAb^T8R4G39t~%Cd@$pR9ob{VM3{)Mdyo0
zM?mz4OCX>VG~iFL_$PpX-~WRb)nF4<AzpeQG0#qTucZ@tu#pFrqzB21Blh6V4OCZG
ztgzectp=urdmvkn7&|oX%rxYBQA9u@C(wMjt(}Y+8FVa4B%38PIY8D}ARFX_oafCh
z2nsL*Bh0)6L@=9*wG)+la}74c5Y83w<|qsP`IB60$4&=xkz5SV;^9HNRGOFS42jvO
zfFDAh7J&L2fnx%NbkDrmbIh#uA0B1Vo>EQ9Msbz^-mKZZ`&kA*;<o3%b`Zqyi1ac|
ztfw5JJk={bUupJZL>VD9>^f19(ZPNTm%4oNfH+j)tzH#93gasA8uKy#p}(IoZK~Yw
z10igJ0=mC&VdW{-b#~EwVBOIdO7p$fR>ob{1*^oqP`&}-B8RnV`lsx||4VoSHr%A<
ze5)DaGbK?Ra=sIe_`y~F_74O@vGuX`;@maHm0SF8P|+FQ38Dc-^G*<P5-uZO>8{!v
zY>RrqgEtsm<Ppi7(Po0b){lPB_>}S7d>9hTQmZN@{V(I*=5p5^oK3gx46vni^jFCE
zHkuC!=xuY+>ey%@k+on6TkSz#two=S(1*ik+7pr1Z#aXp#0l)lUM1h&hUv7d$V8EX
z)}YXr7syfzx5$m7hC8M&zL;OVn8)2n3B-aCLt=z;LVE4*exX5t6O)GOK?MQ3rGz!j
zg0CNor$+1U_6#|Ka2^5h9p~uAzu%QKuq*lli))^OXQRP}?fu9RuNE#kJRaCDY|I&$
z`90mf8%ec&MOJErGzjYP?pwx;_e9h2>LOyZDhX#f5!V}BAfd}`49RN=FIuVtFn`V<
z^e?y!8piNxXoszZKx9WRROmJ3bH&;JN^e?xSF3NVlu2(+o~?|%=JWr9(p!<Fr)W<C
z+|f#;S5f}G&l^p3@$&wHaKrnCIQotokNt=+y6(}IY;7}IA`0hBI8~z+T+f8P)g<3Q
zmX||^C8DYsi+QWrOw=Lr^4|f!KFv2u)I2GnkS@kF>CuOO=bpQ;6DzNzo}Jc<1~h=~
zdq+x_0Tfvj6ZJ2m=svp+Eayp$ArBCgiR9bQ(8Ph3mcYH$)Xz=SK_VT@l)_1&|Fseo
z`TeKJPcQxb2o}X6wfv)Y60Ed!(zs@sT{n&SG6D{9Ai?W-deEHD4GG#LJ3}c2<~`qp
z@(OwN6$|oP^uBRGn!sb|si6^mxJ6sC4fG?mxD<_%idS1AP5N9wvxtGz5U{M$smzx`
za|}DSOBQd<%Lnb8!ak!0f{Un~rH>zU(d|%myrdSN+l~(ZBe&&*r+ILkAK@W+aC3zO
zf+E>U_o>#!)1&UX9#D(xJU?#J7<<R&l=0(sxIukSOW!eq^PYHGth*!f*##kOBl-|Z
znU#OZEIa5^Xg3csaVuoM1}Ib<eYw8Y+i@m~`6C%`Xm$ElFz5ihleYu$Xg!PK;Dl6b
zyTO+)@N0vFR2J&qMBG?~T`$EA?~#9eF!(Heg*7#TUDC;V(o~i6$$X<3*y>V|!$85A
z5{D{r)EpAjPR!*!Sr|;H32{!<qH#vmUo8S&nc<pi?pFe-BVS1#4AgyKH5%C@60Hu5
zwc_dbsDM)>5JywW1gELt&G9>-oXuYsUQt^Mv;(C&{v(+)-6VEa4S8}~|1yPJWxR+8
zSx!gz@d!5ZF~xFOgpZwP&(FyJjL+pj6Z*iEB(s^^-~svTm+tZQ9VH@wLO*e4x)1r!
zJc0X!$k34&uEr?Z3lKIuL4@bL4{xHdM`4alc8;C`vR#Fb+Xg2)^Kd2E=oCR`0H$`A
z$)9lYp$@>6Tw&2v@b*crZfVC;VYRTeWb(xzE~!8&J7cW)EBUYJM9Df6inen$=Y!t4
z*#+-Cv1~kO)sS`Y=P?UZk~4%@vdPI$Sn{I+=^>$n9xp(;B9P@1Xpi%C7_uF`gVPxo
zk2i`MTqeh_!Yn7kSLqQPf@r|W42yt?E~_DL(41<FTQGM2yaKm)u2S5<m5v|K$P<a;
zgbdCM=yq&gzoJyqg4VBCD4D{;RtgfTO~wuSHbCB;IWSX_S}GnFtTrq=$Q0G<N{|@u
z@|C4Gf;=t5fFd35$XfBmo^&I>a;CCDsJF3bV_{%3x(<8be%{6g;oBw86+vhfenw)`
zJn8z3e;pX8zR`B00`F?hekN{@B1`N9qqYd!)3XyILGz@VMGhi^H~1yI`>{SB6{LjR
z)**G@aPeF2Ao~;$K|I~?fWvx2yt|?K63f?JHlhlq0t?!sca<(Gnt~7~RqKx3q14NU
zRMlqFYWRJMBt#Vs$P6J%v@Gzi#B1sdJe#!=+%#HZ1#7|74GpcEc0K&gPFIwv2cewU
z<a&0;pKw*c##K(dg$DTe2gRku^rTiMcVauqnu%>ehC?;n4fI|96nLRhVjD2MrH{cl
zpDH!M0|Rbb<=*4$83!p+g#>Ec1Z*Dhj~x1xqtww?Pu4KTbn_53T6k2BKScS*_`iQr
z$}0S*{{Q?csAhoR$@Zv2jit%udU14&@4xleJa+1bQ2t4l%son&MJ*<tL7qac1O?F#
z%R8>=9x?OwHV=euU@#dA2my1!GnEuH?os4cfff;j*?VQl)vc*z1AW2eyeoBT!8YTZ
zHbykrRxvYs&;x`isG>g4l=q+oK6J^?<tA7m*WrR9hP}T_NoZ(q?04&*U{V2dJK$Um
z>)ua?4T4&}jJBiiM|s#c+uV@?8wq4dE6%~U5OFNG#bfwKRWnAom;g9)GnbthjP3YT
zAWP3lO}8aew|`wOs@Bm(i`*4@gt$*4A0Q(F^^hazhxHuZwVQvqie(~d98~8FRW=jb
zoE{Y3hQ>w@Xj-ZQrK^y}$pa3r{aPJ(L!K~yf&C3mV1&vL5fi)4O{kIKybHK>ORzuT
z;C=1kil5C&v82u6zy@1T#(jGPBh+gckTS_?UA+KGqs8&b$bJzrxM9D7j^E8aLaa7u
zXDb<eiM~vio;Nv~y>|A0c?#g9VU;Mo!6ZBGo~JOBO8O`y7MWfWeaADRX!<t{?VUjh
zTA>>*Hm(%s9`ixyDd9aB2yqXANA5k_5emd83thk~-3%x$aVJcK($0^qBw!k3lSypY
z;FEVyxwfy`v`XFXy1>CEi+wIP5n`#GiZR3?4;ZzEHw0IeMk06F^!z<2zVxMHy%;iI
za5pIkN0Tk|lB!-gd&B>YQ5Z_-TFk129)RC5N<7EXdWzcixQ=Y0;6BTl7{^mb$80g{
zeOJdEM{>nwd(*WR@QJ(P)q;&ZL8`-8>P=nRNqCN^qJiX8h?!M}`hvjuCL5!cyi<r>
z)<5=P;Hr~0*>lQD9e7^`Clfq$A!AbArN+zE|G(&?q=cu!qSe5g!>sPh4^vADI$B$m
z-+lwoD|E&WLdN}{@S_V+>i`+w>D1A6B^UpB0_E>AP?YU!xxZfl|EKWJuABbPi1S%E
z%jnV2Dhr+_@AaWzqSO@?FKpI9GY%KsVGc?B8N&M39&Yx}4HEq-r@nQ!DZNu@R|m5n
z=J2ijjHCacRxQyZs5vdL?dYtUwWMB1acCem*+Ak3-WHkyDlzes4~22%abu<vXE$zU
zQ*YS(fU!j7ghq@7JTiX@oS#$++pQ$R_3;q(Ws|$i)BGfNujATbllk^ciHXA{>Byjp
zi!8&>0gDiv!lK5h5as?qvre1JxT1?MU^!Ml4`Gs<FzMx4Wm$AWjCytV=sUmc(a(>|
zgeuEqa#^$7zcoNe{AvrM<pmsdRV;{PD{88BphOb+fc68cNaZHtz?vyGnr{B?kFo{O
zO=w%~Hqe6(L~DuL-j(0NBA`~DNO|;wTUwXmLT}7ag*I_mG^6mk?ogpeeLSeQ!HE!a
z<azMk$s*K%DOLuxT+7?=`vk~?jSdwtR&ShqEkn%-&d`9gqqLRWh2g+cq~D<IHjD73
zz<=c>2eb_eY*~>6l!aa83!~gJ9#tELT%%@@_1ExEu6EqLiJvE!NZYBD`;GM`1j(fR
zf4!Dj5eey<L~8S1pdR^-jQN=?4BHb|?upR$_{vL9r+V>z-<2ZOxBeq382ugfwQv8-
zt#vL99c{zkFc_&=_1VE@7}#r4k$`e#1eDx^=bm34=x&>UVIt7LrZ0$1b)BlFFeKm{
zejc5RSP3*^%668#&1aaweaFZmS5y8imC=M?u!;4Z7oZx*u05!4l5N%|X1_2lMG9p7
z7Ux0aa&>GXyOHq3QaWM3iPI&&H`6zNDv#P_{6YB1vKHxqCnAwC>tG|%z)Nwq1Qd6R
zrBrQwtF2~cIX^}HeSX6q$`th$%}Ib_)v_bA-6bh0HlO7k(g@1#N{F{l8q6wy2<_X>
z$EvuHGw2n%@GkbQbs3)-(t^(i<49z2eLCR!bp0w<zsFAf^|`V?$DS{@S@t$!8n51#
z|2~i<#ipW$p~hbK@0o`~wZA7D0A#W*Ycs>~%g2qr8A+I}kV&IGhX$BhmyhE^F=Z<o
z;=axQbFFFmTaQZ8#k=JB6Aj<FTuUyW_PH%%uM1zkizL<>jzr;5W`y9vW$Ky5h&QaC
z47Ay;dPcw!<O#J(%t#b!E$sVht!X424nCRMymTI_>Jr0Yv##=tY?<LkA>eRmn8iwn
z_AWDadf_|EJtRoNKwA2gQszc36V#jHYW7Jil><niBJS8cHT}$i-R}GAAY+fDI9LY=
z9Qx_==zBE~LR)H}GP5ofJSj|>PqOAY2u6Y~EJpJ<eBT@@L(X*LTFmQOZKvG7ac*pR
zbysKDtI<7)gAtH?8pk1(4vc*M?3Uik#jTw0Vf9o|hT?3K=4x<lLH;TYlsgXyZW{ij
z-k&*{YjT&&J>c5Z8b_CVE%3n2&XEkegmz|Yr$vw<x{md?xrssjmOP-9am36usbP;6
zA@HXn!<{wnh7dS^ZWk_5CMxPf0~te?A;9ue6A$8i(Ql_4N^={m6DUT!to*F)o@R;0
zfbCkJnvay+OFXR|3D->Gy4+CH`)f}Ej9vbmC6fi;U|gp~S;))LjA|MS&9IfWBbzDT
zAda5ALR#E9XKH8LxiK-ha>ks-o9iqCeW@yDZG=4SYY@?^Ie5;Yxx4eS^&>a>&HJn=
z*z-OBC+4Yn`*OB@2Z+=OPgKb7$~H{2JF(EWM_xY`ZT)d#QkzvSnUm%%SdjP{`n)o0
z_In{QQh?R?chmaYL?Xw>ylZNm+B!V7Q?1!66o;;OZ}qw7%5|uSyf~+xi=x8GKZEE}
zx^-m@`U%*o$K_VJITqb4$%=h4Y09=<m0oRT`7DS;^Hj8aBVhl%>IHMTVGf#T1K+%H
zu#0nL(!YSS!$P%ov%DA@Ew*^}?u0IU$|0zs7XLNsP-yizMp6iD4Fw{AF2$U9k(~P<
zAAR1I%$%oyDU@U*Bo|U0zqD8;C~O92pQ&M*_ll|MRz^e+R}5|*LF}yYu$-LfnU|Mu
z@|DwXCmlRB4df2e7tM9{@#!MmG#XYQ_I=^wx;iFR(q|7%aTsaji3WIuF@}X~fzI_d
z3wA>jOB=QFD9ibW*;uWREc8?xgEoTRU>ZDF4=zS~Q#`B_jqaL5%4hoLFm6dphG5G0
zBgM-j;jdqF@B3)Q_Qi|$NwSz~r9QLn=1c4-(hHzT1ND^|lpw%{T53{2x?#xesmNE&
zM!Z)UX*`g$sxn|EJKxjFf1N8Z3f1RKl|O!2;R2x;gB#0l0|KGxSdm6OzMOD@whQAb
z%!-#}-$%ZBSUd0yvD!>8t$YZUM=habRJT*=s)<Dx*MGlRtV{W9qMWKE1)keaop8ZB
zL>_6ffrVN)vbBeQSF8Ql6)Wi1Lj#yVaA7Cm-2&g!Zw9s-EE63ugA7!rv%O{)e>(>&
ze1R<<{PHJR6rG7?31qh$yS&i39Cx{T?b$lyxYDz}W@JF4p#FO?QOa9kUYc-302goT
zs&q=LYL>R0(%z~#Hk~&rV3%`rw*!%b&*$0~3jBxAwomywCSfM7DQ0BrO>n?@aB_hT
zzVd7QYGR~CCz>ZhQ;C3YML#+4QR%Nw5p*h&$M7D94LlK(Y;%-4ZfQB*&IBucp*??M
ztzyeU?+gDErFJVM`w_ykReTi^)przilJWmWD9r!A2qg~)HBgn=)-m{UGi?EL*#vkE
zh5RYwwY}hiS<!Xun|o*&)5gHTc9xO;oAtMCfEj_q?}{8$vqx&K215Cz7-5iZZ`9IK
z6tW(Ju(zJ%L-JNp^VNqkzkw~ZR%Orx@8~TNF13bdgw0w!tR}Fo3C(nqT)1m>^CWs!
zv3E!@4Uv6dkAbfxnI!xkYa$qi4QzWScK@TEFBu1NguO6a@biVJIW>5oO1#tN0D|d-
z?1(Ld1Svg{^P2~*_Yq$AJ5SjAyC(*eNCN5+wNYTfD%P@AeV}1D*hqi_&cI+DsP#)I
zg-;a^Lbtk_F8>Tayo!XiHAJzWp17044%*%uNX01->Ir4FViUFUh*7$?gW}~K9S6q4
z-^$Tggr<*K@B*F%nugiKfAC>EaTeXt`5A5#&Byr%3=JhJWXlALr0Y4A)B&i4E`RQ<
zY%-+Lr|v+qdU%^SPQb*bs(d56)8Akt)FF0~qegY(pCij#@@&lPrs$0NBryjUg3klh
zTc3`=2e`}3iWpft)T8&l)>pTiybEh9zu!+v&+>`%9~u^I(W2Vt<9zBHLL}#fx<SX&
z<ExEi%lbE_5SExc(gMD1z)zjtB;_iU_O`%MZApC&QAQv+r&pw4tiN2z^m@`7YN}Of
z@kjdmBKW^)-fs4isU4E|=lQhTQ)`_uj%PREc<{$@Ma1_vkkQJ99zO}UGR9y3yL*25
z+rgt%>Na0>q53L)BY-}0T8pY_*LciaitHvTvi`yr^Xi|VfnH<RXVjrCa11^)ZuBZ-
zW@w1gU-WHnkn&{$C5#Nh&YU|?D~pgw?+2&3@SfVo{Z<d?IH-WHnSad^oi-^RGZ+-G
z*7VhDn&F*)>d#fbwqHmcI<PGui^~}s3{3)LFE-RgavbADHndNYemou_GHheyL*!b5
zQD3h^)Ijs%hgS5Fh!mY)vMl~@l;7@kE>{Bj9j`r{$N$9t>P1aodW7^~IYLG-eFseV
zblh!<W~|SwlV~gGEo;RA&4=CbOcFW3{uLl>`cURikpZ(AuN@xE*~uD@&E>;=)=lkp
zz|Z)mgEf;z{W8_0KQ(LWl@Hox(jDr6AEq*|;A;>(?w)Z48RxP31^76Q@j-V?RQC6P
zRDUD8YAu8VclVdb0ycWFRW2H(Y<t`60cryek`N3L3O~N=%tt^}zyXx<Okx=D2u?GT
zByPwRbQ&a`6vSjjp^QdL7xdK?g_4uKibHTys_Go0ZGCPSwyMr<@x!5K^Ezs_cYXa6
zy@JzQxmpvw;Anp^1lJ4y5A{I`@|DlXEQISi@*P>E#jIOgYgAZ`YXWMAr9RpTC7C{h
z@ym|{vQeBcszr4h(~9DG;I=Bzbzg@iOTnPBd4nv5aMDFH5J33#<_o*~K)TfY&zXl`
z0~4|$oF&U*{&P0qm&F>Vx@qa+MGIDAf#$rc&eE;_Ju;hLpQsbTQu>NQexCtJ*}HE~
zoG2Q-D+}S$YuG1YKt0EeyGu)mFv%rxXA7nA9-lG&rwvT{PfMiFlE`x)od;-LiXeD$
z#8Yx1J-K+F#Y2tg&??dSRT114J2Yo}9h)(?FCdYkf4S<9;YDmu_&Vd9fxbYZnhc9i
zP3A2NjihF=kA*DsaLN4`qwe3;uTOXjG-8jBs!f7F%ss_bA3c6ZNEG}St4|y&UEtJ!
zo-<4npV6+qi=tz7Sq&~A4SRrKa(eF;f#S<+m;BzIG54`oTKxt8^Y1J~qCN3=Co4wI
z&>!M)^si84Pc%z*qis-@4aY&XSmAYmD#6F2&|pau0-O{FCFh~s2Mj0_@n!;*B3cfD
z6ae`(tSiR+V04+%;xGC2n@7-*$A5Q?jh_YKKB}`Zw6DtIg5@VbNz9MZ{E(dgeju(0
z&yE1OCWO3NNSUM3PE!yFykUVhMiKL{&l->|E8nVCki_|?Y!-2PyF$#i%8XF`Q_>DN
zs@$KG#~Lkg_OM0hzj)3GmB}LdB|YbC1`L^$W{a?#7inDMFNq2c-P-(!$MF17-|sfp
zoYABStDa5U14R62y?hn&M1K9lW-@aExn^~@I(x8YgnaHJdupSy?x{)P%HD_R|B%-n
z&-^~g0r|muCc0G8=~BAZ4psc8)d6g}y*0`)Ab9P~gIqGZt+S>C+>E_I^j>FEDcM)d
zeOsJ>Agh^fu2h^mAkwDO_z6k%2`T(^oqbTa1mIS=4Rjy@Z+B4jBuln6&f>utycMFq
zT3;bKgXxah<wFXHjc+OSe}5(8zKp_JxEvW<+(ww27npfc$II@0-{CvjGs8jMd<-Ol
z@$iCp6?}%+I6@%6A@IZ=5Db04I;wo%FSNGk^qo{#NIiNEwqVZR6=H_r@X{Hqmi|fL
z7Wj;`2=w~75^Obp=423O7yDAb@$x`;g==wW9$oGp9gs%2vT~j3uV=7W*Kcj~hNM>7
zOXPqws9;ZyY#LbG&Z2+wo(T;Ldql9HL}o*_iiHbPCqjnh@Ez4^8tyqc!-nm%NT765
zX(^X4yS=ts1rO|lZmM~_laSqU-?@t-YSz5N09R2t$+T}?kYpTB(u!?RhI@mn-Bxlj
zatrB$_43`qCv|hopM>OI3B~^**2~(3iLR%8U$*sY6g!y|#gx;G_g)&O>J?Nf?j_Ug
zidGZLA7xA%)J$IR&Y*!?(fm)G7^z+u7dnzYjNb7snE%O{Z>W5cAj_*&x)Wtpiu3K2
z4Nx@S110-7i@;N<{4oO<*72KdJF=!3VPs$5C#s$=GIy@6XYDE!?jVm*XS}KZ%d(?f
z{)TL{-VoQHqxffHMUz4aGo<F51d>)NcbKNas@NV84Pj)VM>s{v$9(#O?<1GgsuMl?
z^iNE_^K!zLrI)I$0v1Nj$W<P6CbO%sVPL+*q`r}=fxd#XvXOryO%bQrF#n)zOY)ZV
z{#zke_s@$d!g`~hR2{^9Q^ten>bld9E_%J?hbP}Fjef9dIIgOq?1Y0FF4F`zfib~A
zl|5J;9CP^POt7Pl(`M*_R^kK0$pveEChH4xI1*?bDp!KVf%2ME24kd~j(u`yE1={6
z4I#uA6Tx#H@j-uRwiEOTH@CfX5+-Z>PFX`Rgf^20;SXgNgGmz)U5p`NiCZ$AIis{X
zy#AuV@K2}_UY|d3FO_lg9qHhPRSZrv@k@(lrf9d`tU8j<xNukCmy|SG7eVtcQGu<Y
z8;9U-3G~kc@B@R`Z0;XNAB|9xyTHx?>C~FF(*?+C#UQW)ao9t9p5@(lJRqnkYepV*
zYwvrPB#|>EV6zBB?Em6v*%m?@oQ>#Xb3cGN5fzVeEdav4`4w~tY@4L|6z@`f=XkgT
zV$aMus%Kp$Z<|tbT68Ccg#15zI_R8++H6Ve5h<AM>H>bW&!iQ2s+#wu86WAJ+54NI
z9t%<$qA<ziq{>$<)db;y;|QKmI9_dqt^56Y{oYnp5b^#P07qhUnts^M!SPe34gf{u
zim^B-m)B;iS$%jh+ZYX(n+KP>6rs}RLM%+@Oe~XUmw!zII(0~!GWsv$j9MTnD-?dy
z)?H$;De?W+S=?`6lqiD$e84DP7mr;R!}F;%EdzuD@kQBk3%8p%&e1Zzi(49Yl+0e&
zs){Ve-XU-V?RsNfMK~FZEiqxa#D)s2?AQABq1-822>rSnW+DUO2-$;Khg9qSt<L9<
zulzN&m#F6qpqgFoyMhlB{-RGv*#}8pzjWCL$IJzwt(zRU=8T*n?VTU2=xa=PzpTHt
zOMfOR=!FFqu_G)Ou&vN<7R&tQ0_C{Rnd93chMeBZN!;FXfQ<K^pt{Q$lsB(_-0r&5
z5?&41H00q(B<Ue)3C2mUX`=#&IZUGe0%zM0p)K0*E(LwG`pZ$Vb~!S=53Szw9s>JX
zZOgJpEAU<HuGbrUp0VPDh<HBm=)6dooF9`-H2iRH9<MZ9RVGczxZ`FbJ&;uKwi)X|
z1J}iWbQ7SYaX&*qAX~$%TUGZT6Agn(wWQyYgy4@Pzc+*K2pYt)Et(tztt0#m*TjCI
zVML>*yh+A9kpQbpePw@;H#I|;0#<O`ts*30QV!4+!mah1uNTj9?2gpDzm-1bvpt-n
zO8pyZ%f9)rlI!x@YZ-^O<*HbC7Bmc5UOx8I{EuhP(v;*le;VS*-dtyMsNkN^7KGOr
z4I0vN@J;qtAM<E7un!lBaq^k9s|<YlWTz{dyF568Tj0Fyrp!QZAG-DiXSJHZyxsx9
z8TH>sSd&E1cLh_fQ9|LfU!sV}akwoycr(LJyIA+q(&$N`N)9Y;XCj`jHu`a<imv^#
zr$Exu7N~dTc2{-s23ctP*o+=>X_NWFXu$vcd!-WylQbJ^L6;rsKR{foNuxe)u)UoW
z%(jW2aU*ejFya_Hc+b$+!g@PA<&y?3FLYTL2TMK@qRcOA1pLi@bSmX&!yQ`Y%)Gm%
zUjH3vQ^tYsTQl(z!Ra-XIUf54QgsT~c?o~J@+UoHh=vFy&rQ>MuPPr6S#gt_&HPa_
ze3mGI7rw7_<y?BTVcyfsjZwt4{-WB7MU>eZ8#-LFE)NRyTdx^RwslK3dT9d|<)qRj
zT^o7*xfv7^tSfXBUM-hCd}(fJAZ{4~U0-xSPh|MhAx@S`4pncPt#qA{5UoV`VF_<9
za{v++@5V4Dk}`QTlSz3OS-4Cp&L+(w7};8K0Fl~lbn3*|<u(Px)Y9cbP5|xyNd$Ra
zCk!-J)`tA73dA<VI?7T04#9vfZbtbgY09BnvMj3K5R1hT`DY&)2GjeW!u23T+`{F*
zs{I;eM23R3FdX#rgV~mJD~|}{`N@YmOZ*gDyxbO5MUxNeh_A<i`m=|H0&?@!7<V9j
z_io0BQ{BvK(5Su3v215~e<dE#Ww!=}{q_4W?IBBE;4q>!03MW2hUdV-t?~A}G*N~B
zuyM}+vT?3&Hg22LRI2j-pmB88b`f)gwsqQ7da1R7HUC2J!F1}p+CMXcp1*ps@5gW$
zD_}XYhiBA0H)^^lz*lRYI}L{8E&pc-2vgfuPNn6xZK?5Em<ljp^P8=?n&Wl+`t}39
z!0GB^fk*^@OFed4NGFaaNn7ow_6E#4j=sgR&sydb2HX(Dwm5(2J^g4u4+oReK0c)u
z5cT8!Pr991IIQBbwyvu5m69g->WA+RT{|PAQ!!Q-%T((>625V)?TBVjnTq?<h_^z(
zqpERzesD0Krj%BX6Sxa-&E|C{Q{C<HhKDL<ppIiqQxRX4>hx;)WaKEaa4Wr`3s=DO
z-|@Y4+lrd@BB40`dW#=bzP8rS3G+f31yCMR(dBRIL|2DP5~vm!aT2IyIiVDHL5~=f
zOAQf^cTYfiH1$!-2mg4l4##98UV%k~34$0vKfCh<59nZW*=qG6Q_|@tEUrBlK_71z
zaCoL^^<62S)bWKH;&M&LQQB;?Gt1XNIr^OmMssM-h<pOfeBu}Ztqk7g#WbEwt*jPP
z#tEf{_Mmo@&zLS-&7|$Otu!|$<VZxFkT!~%`D#h*Dhy7HV<J_pHffj=5`3(QIqo*f
z<*cd)zJpz1yJP*a6P`&}Ue~|V1>;mrU@Vl<JT+Cet#JT^Y6FJ&-K1x3zoco{>CC~T
zi&RakFJfBmGm`3n9~sHW@rfSjl+Ah~=(Xpm<2I?eJ~5AkZ1j~fNZo%1OwcT~)GP|)
zzZUW6{3QK0))x*QRfGh--K-s5OF;wU)agBrY88VeO|qp1jGI{B6~fymUQOTg|Gtdx
z!z(KdLf1vbkazt^XbH)OAYN~`h#rCWbo7bmqdDbQ2&wqB)x(3#M#&F4aq92Oz7bLW
zhMF3SHh5pKBpHr7NExCZWqjg1Tu-)g?yv*`K#4|)TL{4V<k!WcOgl>0WV-?d#;xw#
zbm}}eNF#yk{;Bw_J-qv1W>%iSpXJyh2oLH-DU(#TN=EGA9%Q)MCCs(hQGEL&tOB;#
z4hR}<BJ}&BF>EbAV`vzT5=>e67iZ;*A-L?rVh{t)R_;RmEOyYA+2{=%Mq#>roS$7L
zQJ>GPxTf9ECs?;4Z*^JX6d@b+G^`DtFbUgv04uo)zWn1i_B$s$#!WRq-U(dcbz&BC
zUTDJOSKa}dyTcOJuz+f6;HQ3mnQ^)ps<hLi-is{0+2*(Wn^~|D5-<I@`K5%R*Iaoe
zm<6kPhql>qU7;@&7AB1`wSNU-wjb@g-isq1?msg<0j+c=7aBrBAO&;f*#nqvmmX|;
zJ~6S+XU3p#P7AO`Se^rJNnc9-GBXfy?H4}~kH=2EE_C{LRGnsy_In;u30g-N2?j)N
zr(~ac0$xn|BEqyyR@2!VhrUhNCE%qggmC=FilN*fQk^bA3)Z4)7EW7UW-N_c7MJTv
zK+#NQl0;s-K!qE>!Y*zB{d*sPTzf1FZ8b0OD#XN%JAtC{TND9)n<7NY!z=^FXKwVH
z|6fx?PC!X~X*OxNK693mM3dA}lqK$~enbi<<mR2bEwMYPN*S~ZvIT>tAoi^pVLAXY
z7DKN<0b|*E@PY5bDqZMFoMqpXWhl#!MwDn=SP#OiIPzV#!6XiA7S5Djp2cmpRh!P>
z$O0(U8eBd{dK0A6^AXgcCgbRn5qhdRqn|H`H0LlWV#v^OaE>as+#GsuQ-mZp*L_!Y
zVR7Trh``l=8S+fUvDh;V#f*4SMl|SGVJWxB7eIYxUa(zuNQlO+waI(b<Owa$p;Oik
zpg&B{YA@UILQzg2I85Ul=I@~0@K{NH-3QLS@gq>J_ldeg<3q2cA6xAi=>3M^O00lS
zR>s0MnW{c0w^#HL)bc>hu$OR{!yS%zeVZC7IhIoUk2q2l8m90e*r|%=VUPeF(In%n
z*1Z_nvi4{HonsKL5kCmctA(Ka`!c`|IWsWbAUQ7z4d@T8XZ#D@8r1Wn!YssWM__3$
zjO*RM#^DCu!qX*wHxxCxKZ=Xw00I6!>&{MS)Z!Z(*m>Wb%2hwkC*N>*2G0lnAh5vm
z3*JH+WW=@$Ve*upPD3hz;gg8p1_XN#e;fIem{taJ_$`}3EGZY!_6DaLM7)<sHZDII
zVtl0=B7g(<zV8Pjp-*K|WIL+J2fUmyYAVTSiut*|Sey3?o!3K%86IX{4UH+PPSV;s
zzRu?-=UDM;GazJd6+Wd-aMRA`3<ujvXf$gj)+#SBH+8}Y1}V`n%5YUoc<8g$gjv(3
zZ6{%)o+d?P?T@AB0@;7^AZoN~CIQ-!{Tl=}qaO-eVg;||$DYwKda^Ecz+EmPSC<6C
zO;@$Ob&uSZCG-4NcyxJq=~Iz}kVY}-@{i(@=~=q28^ZzEJa+-8Q{(BV_KaXi$#HT4
z9M{&4Z1waT=mV{7@`W4HbYIJvPuxUnqKf`VkqpACs|}*S%OR2lMl8cd=&0TjULOh1
z8Nk|PNU?Co*8%j861G-Jpyy1>=C)6}B%N%I8h#c1J|=g%^bqzJg~7X|F%@q7z0U#9
z3tnV$yqz%(4QAW-iF;Nq3v%E`D%$X1u&n$=ncVQi42&Aaywih?LtuT*KZDPG-xG=S
zfugzFCnn@hCb)>jY{SV$vHe$Z+e6A5*I)qHHSDN}g#zpy@mDJaaMsi@hq;D<h=}P)
z)kw!X;MZUyxSZbfQ1G|k!|Y9%p}j-fWcp@lNW|ad@<aNPb9QlvJ1<+}3X5j^mIA94
z;WLVU?rQd&cw2QPw}=$UST~3pYXE&W2x0Ep@lX(Xbqs!DRB;W&gbOoDDjOIwHQleS
zA;eZgDuTMlIiLvwY^IdO0!+;uJjB=)A0HF=4TEQBgNr$LX7S0#=K@Mnlc+%I>8pEJ
zet`X*JqSUr@$qC86?}ic>__nKaD#7M#y+hubwHF3O|ihMV(NtQgk;NzuMBm!w_;~V
zH^D_$2SxqF4Ajy$)btb)rXg&=e-9e;iBB2^1*Cnr5owSDb7{mzUMiyv;QLYsFnnd)
z*IFYTzD4`d7;SxjA~h6oE@W?<DKbjt7(T`4KmY!gP0%=|OieT5Y8^OcYzviEr<inH
zyl`8e->vK7&CRV4`43Y=FO7;!#bxmy(Wz~^W_s#k`6&{}c%ws8<gPH;_=kzJRi<W_
z;Si}{$_qXMP4l)N>v5tt)&{IUUiPvY*{hav1Dc79e6BO7ByC{>@A}CAlZskcRG)G<
z)UfYigOVrlKd`2?utc6IjW^n;`zS?W3>2jwap$6)5)236*ruf-_4B{3N+JiwLxpM&
zySo^>A;!GJ(r1l7nB<-)PHgpBa;88M+^lG?C}0JES!&>Wv)Lz<#G0F7AO+O(cF9>n
zvl41C%5_|P25^+9qg456kS`Opy7l!^uqB5LzVzg^k2LlHs#xNQ*z}kY8tcPuhZdf-
zR^H(>8}c=>Ezr9u(&?ZZ+7@LOa&Cz1);v~)l2;eV9)8aZBTAXy4EWv(DnQL_v1R-(
zro=q3E9)))X;NZyDppMCUy&ExnXtJe-axuV*Sw$s*wLR3w=;(m(P8EI-mcErg~@`d
z*1R37%`)Xb+Vg9Th%fMz(%1{~!5eC=2kwKL^!uNMH=;Klb}<W{OcGbYzO76~yxw*0
zVO_uWwNSC*Qgw(!>JYWI-dcj26GeHQJg$;~Ow%Ab2Rprv+ISqQRR*V^aFtsCTyR3a
zCsA7jwtOU}Y$VonA`CkRx8P@Qd$Z=;p-fPGx%$Okiq<C{9dc=TZ$1k5jG}*VpPu0n
zvR{$(5hlZ>pDv-d=Dv?tCWHCEEFrQFobddgbW(jh7iW9HvMZpvYPdm{)GQ6j?GZ14
zT5!GP65h*?i2Y9i1y%u#<T7sGV#3{bTT2Z8I^D4YB4E^;NpJ(-`Rh7vN&)6DlDDqu
z?&D&iksadF)0bEF<>V6Os`AU4_f;_(0cmbZpRbYFSb=^<V1xyrTl?P?Rk<CF<~8|-
z!obi#z%nUR3&ZlSlJS|~tCzK4U0@PTW|0LNG@!{)ApHBGN>gU)kRno)JCqTy2S#9-
z?Dql_5yk-(-+e^vHzbDa#h&TKRv5hD7Jz;=7dd*B{$$h@xOui=4r12YwY9u{!ZXWQ
z!s9s}PzGJ7saXnBEgees%~<z}z+d2wYm%3Hy4JYx+EPU-IV$SGGoh@Tz}Z~~d6%pl
z*`10Y_(zgG1Iu{tW~rhhLnR}Iqx59cH_#>iGh@+N=L?n}J=No0gZHK1?cG8hF|^DY
ztnp%%Utb^FUuKMdMbfH{i^<9-^QZ-23)BQ37}BO^WgAH#$3<p>Ye(m$`~E8LzE}P|
znQpWBLnfBHsLlR{<__4n0AeNk(B9YMn%Co*k`Df<f(x`UcWp3lV$Hh!VPmy=q*^ks
zElfZ3X&{YLFb%lqhM1z&!lD<Q8EPz2x21!|S26!7xvw5VN%9|uMM^DyPMLSfiPBi%
zn$SbCuZ~{2Nh1L22`>>pbcqrH;hVR8<F<l6*DwYdW>5IhdsjE${)QJ_&@%ZXnoFqY
zd@%N_$z~coJ4w0e3)c)LBtBjp(=0pqo16<D|223(xndytqq>W*v)1l0{MPdychg$$
zjk=S%QR+&EiLG)O_`e3}_sgUoz3Q#>ej$fXdQCjQ&<=)z<$g^)NXKOE<RI`(rdnZL
zMD)$OI#HK$m3dB}p4o)(8;Ry7m2xxwT5JND$x8&B3{Rw|lxHW-sW=XJ|9s<BQx;Vd
z%O4l?1FI{lHNI_{x;x3kqr<|n*`Hm8kL*FXi;oY9Cfx1*o}P0yMz6Xk%=X(AiIlw%
z3wJjin2LH$jk7gHA<s%WJIE>Ixh)hzS~x=!f|zV-K5KD6!~<Ig4WtDOOpzHg2WHR@
z&S@W_@2$S#wdxT_*zVJ)U&y*kIAmeYv^I9mOPZ6L@lxEj@$*M4F-D^dbr8A(ftt5F
zsYY&NikYm%T^3s3J7k;t9U&poJ=T>dvYgJv=+lJ-={Cq$eou}>yg0XKQ%AumOppDH
zdEFGTKfU>ZlWL<%_s2i<JD%e_O_Iyldn(cd;rR5VR<$6`#OB<ZxHuQQix247wS4bH
zN55$t?kDf^O&>twoh=~bkH1u!L&03GCtahagm|h%W!kmq7(OhHv(Qm#mq%uqb`G`E
ztPhfStGv5DXIL)5UXh0*zA3~Eka4@lXDcA&1%(JWo^YM~8Q2`M`{VRMXfj*XkXq7L
z&}&2s1WAcB8}8R-Duf}E?S1cOWC?oz8wu`X#I^9y;iG4aN01EC-nGr9{r4$`$q4}w
zKe&&HSsq<w`+Hz<a2Z}DYWHw#vqM$6x!jBJ^D%;@-FI7B*jC#y0RPvRq@^ywcbk0X
z?4<{Um?uOjD>|9M`-c!m9d?}05}CIuklqm3z4bqw0l`^JAn!Z=Gg%;mv~&WP72YGU
zlg1KDJCFc=QmUt_4nsM}_hj%*GSb|fQv=OyOg|D(i;)p5|9V6AR3puGRYc3Gil`Bo
zH-#aN|E=4nCTa@sWlBox`fU?|altwWoSiL9dGyAgvw+{a-xSaCs}>lUAEqHCTFx-x
zpNaDnKXUk0E3RFceonanhR>e;Pib5W+@V3H7mB*RPw>-bgiMeT{wAZG_XiDW6T{XL
z*ylj}ABWi76#G`aUVazI@S_T*&Ul?oLU*-?&W?vb+<=Hi^wo{KTZzo6nYUXR;D%;(
z8{;~f<>qnaS;_2zoZJOm-X~bu?E=Icq_n51PONh-7Y-%HBT}22BHT)X{;njY^oYma
zlRoCS-Z6WH;Hzp-mED9b2nl-4tEIqns+)y-eA{9EvD`Wlml-?zQ^oWV{i9$l8T@IF
zazr_FG(H*Dmaps-lRro_$qjA|aI~f{Z$_gJ`J`5OncxyP5ar&U<aL=}R_(|ph<2w`
z;6iXbW(mS*E!eDVU^voJfJ1I^s9Hh(f^Oo$YY~R+C>mjh2z}(ICbyv~9?&*c%hl2I
z<fLO(`Zl`xxVZ&PK*z?Y;2^t7iysdPOv@9TL#PSN2B^bgPVtP%>AqeIto_Tif=2`)
zs~-A%@>4;CJ9z~OXk4fniy{B)n8UCC`wAl-#4f+=hZzh`onbd2)&(=cxMY}BVoP@T
zfXh$)>FmEIrxC6kTj&@o6dEq|VEC*q(~tb&h~u+$d2|eq1nYwfkEw^L)fMTN7FvxE
z)N9RAW|xt>SPl~%l;(5fK$PtpO|Y~<FangZi|1^#(rkakW%$}Wbi{T)e8WYS)Z_Fv
zBZ~t6UCkRpD@juXKvz4;@2(Z&6BdJDW|J4B1-KvB^&6x~%&P7<p6hM_ipiZWVbxp<
zf9kNQsW{k%hqCuFR@mq_Z!sk)qaQI=)+LF{b#Ggd6JiJniYvJnfJNn}#s>3X);Q(C
zdRR&qn$gGU;RRYt*_k8-1q++?b@C!uh>?KNm?_2!2T3Gpln-VCcLYhF``wX0<c^j4
z-iV&?xM(-;QoV#v4FBG5LOM{NJ5vWy7HL`Lb3Tk)PFN{qcO33$Z8OwxuyK2(IRwoG
zU_&(B3|01MGLX`zfZ^iGj(5(0Mm(<v3;0r6WtT}<Y7WG~o?v1aRfS4)J!OI@oQ3s&
zFx+rpA57p&fxf78-={pcdxEb}R3?wp-f5h|?$a>Bfcuy@>(X*Qs8c~zB6oy&yC3v_
zKYCnr5qYUV99mU}qpRAliKo9`p4l*;@6ujq+-w6phoO;o;QD$d)bP>y!fYBL^~!=C
zCVsX|?Qt5>W7=Lt(=Hc1PMpKlgp+0DXm{0(_?X0Zc8n7tIJC!U`^1a|j2zq^GmNf#
zZZ|3M3>)Hv#>bv0z{O^p{6imPv_~VrVVwX_bi!TIomXWWbi}ZX848jljM|Q&^LWnY
z`GFI}c$wM>oPEkNLZ&+V1b8H7idcI&4d>{}b>z*QXQS?ZWU>jV)$6*^dyfC$HBTPr
z3WO`)1lo=|++P~Yc^SJ%VAS&;u;#}`G2bAQQ|Wi;J)vQKAwvFG)=*V@pmy~V50YbG
zaK#)POa{EF&X!*O6XtbWfhvp{XNyvQo@6&^{Nk(!N_9(OQ_zukF4%$S^R-GjN{RQC
z$5>Hv9*0g(e=B@LWJqZf|0Hcv76_{1O@rgD6^uqZlHwQ1MkAu2$m4XLct&x@M)Tuv
zKGQKm<LTk)77pIIJs`cTksgawk(fu7knZ5LsLu1fPT%OG)sq0S>LDFJAr3HnL#Fz<
z5i<V(!BuG1b-qm+-(5ztOY%sV_fDx?i>|;#Mp77AeG5#KK9YahkX=mL6svc4cinEQ
z2D{rYFLnrc;Hv|YU{9azcTV@b;~+BW0~K(Zxdgu)vM9%2*vS?TPT48yVq%B=DU3Uk
z+>p{*!>zD>QyV7^il=c<LAT?NKeLfWF_TdPe{!}FUCHI^4ZFkaS))$Xz+=HT<gV1J
zjsy@);i=14b1*$H-EhG)Kt}#FqVV}t%Ky7W<8C;B^_R_Z4Qq)%l%kQI5WSe$8lt-B
zwJEP<0ndddiGfmlv>xRkJ_!uyQrM~XQN_hzAf#>x_Va_MmF6$Af892U=?G)2tb6()
zaB{YllZv9o5_U0ifrXDS*N+2?-2*n@U5&wuyW^LGvdc#R*Cb+=RJH_wd6laP_tp9F
z%Zn%DGw;(lrMz(7t^L?hEVImwCXu4SHi^os>G|MrNW#6XPXTJ`U&M{VjAW4@`WUOQ
zMsDLs38MiN#Tf3i>k6UppT1hks!=&JU=;g`ZaZSU9+0;pS^NZ6pJ8OVLVch0o}qY@
zEb=&i;0qsX`BrR1+<JEVe{9Ccu7*Jq>I%#REx_h6p$NN98cJTVi6dNpL44gfBj2fz
zb_~HnMH<5XQw{z1Cc~<{9%UT<U}9^uwKw6Xn|jmiLeby#!`zhH%IywnMj({F{kd1}
zl+_-2EA`2A$McaX9;RcAaLrO)LV&83%(hIy)TzM}vH2n-t{(5LqC%Es)Y*bvu|lWp
zoNcEZwDMmEJI>VtjqL5G7h?NIY+c-?Cp9#MSF>$W8#@o_8`h)#^@;~w4T4O2CR);P
zfJ$X~IJmhqlB;tTK=wNz0`kw>%io4BW~WGNM<j8#(W}(CS12%4VdtJ<c}zV4^kFc~
ziiTo&CP<9Gbn9C})m?sZO7U!3!VZjifA-k}7=NKi2|XykCbOv$S78N#nFLoS;5UL$
z<`Ex><ILx)I_BcXy7oWIqIm;8BRQdNHIdRi)z3s^*u!QX)uJf<fU3R8w4$@=)A`r%
z<3gYr*HFTBw=R;e?WRcNX%xb}Mgv_eZS>!YEi|PK%Fqsk@2x*XFUF?s58XvP)}w&R
zbkta6S<O-k(Su+UgrzHCA;G_#qSo*F)ha}cil!Wkp?;e}Pj$ld$h@kHwf{0E5Ha#S
z))FS7Qwk^h|9&vt0FAlP+qxMRr)ggq9)LgFqG6WnLmUD;{+xjQISY5CK@@&z6u048
z&n3-7nr@ymD1#w1I(gDuk#bpGN)2q(3;8jf>+IA3jP;~+=52kxro0t@`P=Arj;KpT
z)6C0aKpo_U&N%Du^;?76ibI(;Y67u<`l@yuqUpAR0Fqb?2Pk*2T)`q&uKUrlRa#$E
zEYi?g`1ev)Wr-+h60WwKu-a=a-)J*###9uWZ`0GA=O8}9`TC!YucQ6_!I%tXCN(Yf
zS-1(Vmi&@BF%0~ty!h{zq4^#S*`sW`nnz`Jb2XV%0OKpV6s%Kf!?vjUSyY&bL`f^N
z=0}D}qT(J4FYw<LfXD-YfmNZe3((fjprlx$ym=+*p^Qj0$xB@6dmjceNIR$9w=zmM
z9uSrt*@y?mZ^x`ord$Iz<M)4n&J%1pGQ$!e;&T92nCXctn$BOM54Do(p*JnQYwJKe
zn-p(ie-d`2g;*QcAZ{?%IL;qw)yttuxR!PH)&RW%fZK!ITy+;Kjih)Ppl#omB~Mn@
zUpsdzumG=Kw(5|6O*QK2K+aehIM7?KEDR|aYOSd1&fn@<YCC6SwpRVCI#;H#Y0Oe>
zHpsOOkN@A`e5Y8O^#&nRcS>0^_-@ZwGoZr$?@*_!sOgN+3n^6Pa9q)hGq?6xK`l`b
z7z5-}AWNlE7MsiT*7*G8b4OS>^|AF$+AC!*L`Ny!E`ikH)jCU0Ia8l-EF%Wta-Z8Z
z9-zh83DlXx+uzL^Yl!(IVekm_uYc0xeUgCNOkA4V?$QT9#@E(XB>2Zpg6kZ?tPdB&
zN|Cj9gP##rO8C+i<0)L4=+S9h|HW9q|8gweeK=O?Nz>Zy4r(vvTkJy&{p-QK?*8ua
zb0*2w#EsslpJ5_7ytF>Q=_t6YPSvP?o%rVaddrhvd#v(tc}$)hci<W0G;hXv6#Wwx
z77@QC-p$eokhQyDVU)T^n3(PsUDr5x5isa$_RV7uKk^Mkb)L@f1g+}ai2{0~eg^je
z?x?Ey8>BqN0MT<r*g-Gs&Y(^qOdMlgY|;k55g^veW~i_X!^N*HgSlgU{t?nTv*G%N
zEL4a5$LI@<U%`HJwo2)Z`UDa~il?5iyU9I1ygFfSQ?*?hZnKl{C!ZTmyAoVLcA>Vk
z<*#(zgtG7PBbP{#)?S%s19N}})t>DtFj5b!tM+}q_vZD6?RKCf^sxd#soh^2pr=il
z&^ZO&$Ml*K9XtP}xtz_HvA2{(rYJu$35EK!rYj(|V`RSM_e_MzMhs(3sO1f1MbPpZ
zRiXVY-vOm{<E)_YP!%3hv<v~%15TL1^7Bu1s3`Efc#Cy?UY5YMM4D=Lj{(~lh9e$!
z`f6hZ!<T4li0SVFg7S;RnlT+W9fN%7!_YO5b?a><G(@M@%;gNYApXkJl7<Iiw)Lr$
z2<Zn-;xK61cMq?B@YeU>@4uC<o}!!e;|4ba;sp8bF9VDRo{h;a8|R@eoAfkPy!3j*
z&+y3tVvgIOT;+gSX>cyy>%^?j7r+l6pC^FVdt1!*^pya??c>Kc<?Je{u}$mtx}Cn+
z_3YtRxcu5pP`$xuP~W)S3|PNt%;9HL+90_`oWN13&4c8iDmF4sf-2r^S8cxR7r)+p
zVe*?(RuaoGyV@UIzgax*@E~T~BDy~LMyKt^lNIYhKY)s#>|JjA5zA5(^r1%20Vxa(
zY#x37L>tB>A6vLxrjT-rb>|{JR0&Wkb%cb_JjT_=5Ind^nQz;?N?SkNHEXL)0Slf@
z#JzK44n4A(_)@L{Az4H_^430V0+IXunu3w?V>q8Y9<#Tw-BE{YS<m2QEy?@b=>hEg
zAZ!Hr0H6_zKjGeKwXH?41$2oC=`q8d{0iL59BdXRL82)XmNhN|+0T8!KzF>jq)>|e
z6C9ZzDDd(Os<yf9GsPP$o8le2O#(OB;a#+bMye*eUPx1q)1a4R+OLZ`8;>d$xfe=k
z%1j9L9RNRw5F8?h%q0*~!@(2~Me#oJ4zlYP3*dmq;V4VN1?lQve2GxUm|y@uZWn-?
zp?9Le%euucj4*+VD|et|Kxw0gD2d=LwW}D=4jt^eZ`iog$k-VFzSQSc48|yvtipTP
zlfFs)M$oy}Oq}Z=i>-+vGpqz^+T>#xcsG1`_kRG8KySYRRT-hz?c@Ap?Df6l<?2Q+
zVWD}APF~A@^^mR71luYY29ul>SJx!JVi8-gxR~tE!pWoWnn{_bd>$97AeNV#Xl8~k
zwAR;M@TRV_LN9=&&ZHWsN}YvShgFhsg6#(W^ipYnF7d##c8PAx*@Y?}FdnE?t^mYx
zU1+Uu<m7pjSL<~X5nioML^K(kAi3|nOlL;zmL%eT(yrC(?{Bdm!({|Qe{iu~!(A*+
z1-55IK|f8{p4JsO0+5~hb~hihy9H@F{0`fD4b2`uiqQylb<`u%Llt+rsg>822Pdn$
zvkc8q4dP?h*9>fU%*BMM3f4{AVUFt)#q^$n?oKA;DWjAm0&=6`(Y1LcvO9dWx%WzC
za*$4cj|W<vlsb>E(vM$@p&Gr%dNy5G4}7W{ST_w18>+^z$8;A5gnB+R0wdTLI{u^`
ztwi*<&_s5UQ#@{Mq_{1%PH9w8-mi+Xyq5TG98*o%+2NxqEL(%_rL^2I&Ebm64UKG2
zUaprqh61zw$O@?WwT^l#F*{GTP-N~~)lr#$`4qA`%KaZTn%jTIypE4Z#WiX)pVW4D
zU$#-JxqazIt!BTUr*dq{Q}ZM(n);ZC<fQcVeJVf_``4>u^VNXP_A^`E>NSFq{VK8a
zv`6ZGd`lBXS7Caxno`T9M7LcR`<icJ!*MO_>BPh;V;(WAK=BOg=~yw|#oyA3(d~VI
zv|?;Hl<(pvW5v(|qU+T3vBErp4O<PcXV?K&sH#ylux-U3F~a&;F~a!dtQcFTG+Hsf
zffb{?yN_wb2;(9nILYS6w_lXQ?Qg$mPw+tdMZ1x0_KQ}j<Jm9DW@~#xtD}MTi|Vm%
z*e`ah>VvRfG!lQP3hEG9^G>WXE>~B7*oFGyLYqE;Bp?spN>WnUlhcxne&465{~N6&
zPfy+3ct1xg$@Zlitt9<^p31R#2i#hc%||QAF?Qk@`Md2$pTK*JYUpngXlNf#R_#cb
zLM@Zp*m4-bhHom^Q*9foEC?70RH_)e6NQa=w+_m?<zT6?tP)E+m7H6SV%xTV?E<k8
z2OE~hu%qZ2wlvH09jaTt=Z`tJ#++OCl5^{AnB@fq6&9fd`Zuyjzem5Y8~i(qeK6ID
z1i<~$X;sGerUgML@k=XV&R8te{nrcy(6>m9BeQMiEMgS0@}?{c6aP63<pnQ>sT^X)
z1m;P89i}<Lh~+7xA&H_DN@A9OBNAnd_$x$7maT-919D73QIau45G21!Vw7f#F0-6l
z9;&oEGvq<yEy(2~<^Tx_vt$wG3{77D_(o=}%9m*xtuVa?Wg#gFLO<tw6Kq}bR99X`
zVjsusrm-Zk-yA2&MTAwFg$bk*K^glJvYYSA>|2ndoTntC5eXMCdJm>z_5ZW?CdzRe
zOWNqG)NtbbBz3z;><eXjMwV<J{UcjCTF!|(qQX<CDs*Fr2HF6cRC|2>xUX>EK+mE_
zxleK<s|ssxXp)k+fDyJxpimpC3YlMinR%W-MlMmkNGU|JBH_2`x&=*JfBgUKz3Xz^
zxRxgRD%k4YZKWn5^8(&nrHXNt%X|BDmCMI=?GxwN4hL>bvCSlNlT68qiHYcUIDcne
zuAgLL0lep3PRYs?6;Wj=lLSC;0a%xBeJkVvaRUd3%&;(FF2~feY#e$)=&^u!ws**!
zUhmV{+R%KJ0;yHuuBG^{e{<hT48e*JKQy_p$2<g}FG%#Qil2wR>v>@)v0-==6O&Wy
zn?hofN=FDY5Qa-1_erCXzHnxgsMvf55n3lV-*OhMD2LQxDD9tG{~w)|(aLrW>-(~L
zHkZ9_#<ye1>sFxs$)}5^8CCSU89CIwZka3}p43Bp^68>_qT%#Df9f(WEm1iDo}^5Q
z7c~1a&>NjRRA!>_(NV~@HHlqN@Q%R)>iaf!39&FS1jo!LA$B|}LdJ-@(XqSw%TKp}
zNkd+41gnq6|A_L4MR8QzY(Ra_DyI+Rn<$?MWoz-=0FtCxRO+Tt{_8*IG=87nKMH>B
z$#q=F_t4?oB9?=te*^G$$1-q00}or0aElY-3BD@bVnDvvKLhf8kGw^tvaX`vztA{F
z@8)b8<$0yc?m}YJ2eT{WbQ}Zi@+{53N?<oYs{<tUia58rGKW5k@&YQRsx%Uq7`iZW
z2T6O5-lg-5w`qd%ddOvI7{!nMOPtQd^Vv+>9vczvza~7Le`hciYJ|EhGYngm&Mg7t
zE1xh=Th<i7#fy2;W{4?)`B|jq8lJE<>Krbd&WiX3(C0j!LkVGs1?vIiz*Aj?!E!pS
z(C}j@mOG2-jpDIZWv5{<C=$SzUEJtm@l~}d4PQ?~L{U+Z$W;*bXJ{5(L0KMU7MAxz
zZR#i~EAK?pf0@kkG|{|EimVBU=Wtn_2;NeTC`+%v)I>Q?XA(ulo&oRqob3j9cL--8
zvjS|n7GxT^4)!^7FeO$P5=Knv+K<~qum<p6k+xSt-VxY(MHg+s-(3D3)|Rf*uGT;)
z;OFQMAlL?#Bvyji?g~s`WvNR6l*jc_*Nf>X1i#XGe}UpCl>COrvfcv}C%i77CPppp
zYu1ahb~lO+LG#-e=mO1XmdnrJ#XEgVuhmsAXhFMF&akOuqO8SSX9&N2ao&8PYM4~R
zFO#5`+_3bT4*zqzFYs4b!N(Idsmq%Os%TYvr7CBl3puN|3|s!klTkl)04Av^b+UBK
z&~c|te>H->D+OpOn+9%$7Oytjx2;1&v0pA`CTuzE)|21SprP@#Bd&59_BPSaVLk0>
zrr))XW7TkL<O5690MK7?#0)G|154G$pMj<7QL|LRfp^>hePRYuxWvJdaT5~}nwSNl
zfw@NrF>K06u-bd}@FUnQ|G>5Y{hrd_R_<3IfAk*!{9Xy_BY@w#)C(MDQ0!aM!o>0@
z_9-_oWg&AIb0i_&QHU#=Mqk&<X<IPcwT=~^vw~oqRz`8@YZ;Zi)k@FL(5aI2G}D59
z2U5H<TnME2_>uW$NVwyKKK87@06$NNnPE{ZZPO->>$4yXAGe=p4KjbNpQqm8cLL<!
zf1^8RE#`ml^{n*utVoH_{)k&8KP=q3b(%vyXMMmAxJ$JABwqv6={sshW9_ckeCL9@
z<UrFK`twxgF0?+@2@VU>QeN2pd`NT{5*_xhJ|C@}=LyaXTTm=y;9_F?J`M~@utDw6
z<}~mHcOSRXp%WccVVUUbvfS3TUeH&ye>;lxD!6H1(NOw#$G(KJFtutkT4ja8Rin0Q
z@&mf9YN9lgqX;Rrzdzk;6i9Uqf|F)zTi!KLvu(S#2&eR4O(~ccDB4E57*`+aUt!#J
zlWTKxnnudknim<T#qx)PrXkcfuEz(Tj6R->259huPwXiz^`kv5eL@YBm=ZgXf1^Q&
zWn;>jfo)D~Vo?&X&^lm0(@PrX61|oas>mTvU%nnG<-FrBWjF0(<y}FG4W82)X|#Z#
z0=i3RNQ$N&R6a&5OTVbH;MYm7w;Xyyr*M+WuM`eU^j1P?DJVAew~Q*Q8okdb|Dw<A
zS(XAr9hm!Y?_3oVR|jl`+St2$f6KW|G(kVukvq7U#Y7ki>;}xh#AF6$LQu>sVlgkI
zRC41HES~ooKlcxriHH|l1RdH+o<be#6$Ijar5iys2WT8DqdBNcV4B10>#h`)ViP5k
zF?yXA?`Cv5M)3d9IeMpbTqw9$FVSuq6|`5@H@u7{m$Bv+Zfdwq=<K1af23+kj(aUJ
z!2(Yj0VYIPn3z;x8U!H@Y*P~In{L2Y(T_hWyKU)$It|rQP0FP@s=dcOQ*OtDXAI7=
z0?wYrW9N7bsx=tBMYCiH(`{bRtjHAw_M+|6dD7+!rDUuez4~?=JEXq7fA3&f+_z=%
z4NB56+ZU!CaOo2RJ0Z7Ve{VN&;CmJhOlEu3BcUM&-jQ$J)>SIGR>Jn9KMi~P&U?F7
zf=eB^y|cH@!1itrM{JZ#G<EoBbl$mtw5qPwl8e?J5S<%_L*XC}g=z^O^ReLAK9_{r
zn3`dT3G)S}#C5S{dbSjdSzLGr&L?9U=#5q8gdvemX_Tl0xR<XNe~jp^$^5>q6I0*T
z;f-1Ca#}1l38n7xbM*IUa*1_inz~IDR-uWAgsSACviFoTsVU5&j~ghF@-QsnYUsyp
z2?xv<%-|ljSO|IVo`<Ql4D1>vaSg*{p=BTb+K3VnT}5I}<7Sy`zdl-bSGRuS8hIEJ
zz9Zw(fl7E7G8q_@e__)KI3`|5aUdwij=?E&ET0O;dECC91&XLQ7CM#5m5kGw9QBWf
zB{BT<A&RbDk)zXvn8jcN+`_-}#?o|BFVuVKxp%r>uF~+AUe&1hZO?m0(f{z|ja4#Y
zA$>1UP<0yXvtzZ|8Z3kFUd49&kVvg|5{>UpYQ=#5X3HMye{=d5^~CD5E?=8=S8YDz
zwmt0X4wLzm$?T<i)SaGjo<wki>23dT>F!fm=@Ib!V%JJLN~QQ3P3O~>nP%;H5lx~3
z24Fr^imiLj#``8yXFI~ILv;f%(>DVvWY}`4j|l_sFf%;tQ3(louB7sjGl489f?d05
zK_?uP!G{v;f2)+Q6>8un1@Km?UrXm3w7pwZW*oG=LEBsUGiZBy$qd@w9lHIFTif#_
z6$Uj-Y%#~h#IhXBT+6|ZLzofRj$xQb;MmqqwwcVpwym;qm2-M4&$hn(`m*LZtZ!e<
z=(q%Pj4-qWb*wdEBTpwuq~KdJnb3)BvUoIKVm?cie>|zwVywS=IDwxco#}Zwa=$q9
z1Dgwhg)3}KY?ESY3JWURIhNy@)HGHR(H_tO(M+PNR*1^SS-(We24Ib7iqc!Ik%uGP
z<r5vZbekmP)D0Mxrek439f6s!I5sSU+k{(|H53Nv8T<Xi0GK_u5%n$NJ7c7bSV{S1
zP4t^Rf60-AQW)rTHH)vxpche2r!1Px0XtBR5}M1SX%y2;QQr;_;oCxl;Z-aH2gBzt
zG`TSF$ycao_*hji>D>bzy%MV&4fU-${kGTACC$;tlmA|gZYwuL-2~KCseXsDD5}Z!
zhw6jDL-CM36o=p>uhqiiwwtKwnbdX|wjD?_e{;FSG%#IkI2Lt?X_%(<$SDmLyyOci
z;y#bgb5v`gPjUn~o%+y>a+IV6nq@KvzJw@Qet@FW0@x3((|HV5*gxk{Ce@X%Du#F^
z&Z9BV*Td({negfbI!&2koB7+HuU?FxOGpb!7S7~q0)|6*J6HY!H^5#_<yT_W4cnZ{
ze>)t#YWV$Qw=FmA?_P=F=pByUeHpFCefIh+v^{PyY`9R((k3RRW?*59QsTHl!0m7Y
zP<{26LlLS?MX0vIAstsSDk&v(Y)Y^jhyWAIm6(M=h)vHAxbSQi%Apw5M*Q1QjA}2%
zsNPBrn(TXpkuR%KY*&8jeWhz>x`~Clf9hrGp{_VpmQ=0u@G%k+i}@^$I4!H$fF2yv
zLh2Sliw2I<@&;X%DoU<oUPPd{r^%jc90~R4yOlX2Oo+hrIQA?v#KbWeX2fwYaX1rB
z=meZQ2kg!NjphZITD|vKy~7?2$Qn_otuJk20V_w-Ug@T+OKVltjy2YBjB*-Ef3TRM
z*%-mAda4c(UDqq0D^uxQ_fw*JUI{RoqD0fefoPRQwo>$5T+swdnEf5tN$(=~wL39?
zDR^o+cB{i3FdhajH!%$y9}~xPFf%<9n}+08Xfx`%_drf_7+wR@Si4!RmC#NZJoG|_
z8ubM`(jQ?Mafxi#*>y)-E3<iue`rGE8yGzlwOcK~t-9ZfwZ8SP4yJHkx_ebV_@c{~
zW|Pky+Tbxd)7izHG4_qhhKg6nocAkm!?#a9U9{TVSe3gxhSZ4R)@J<hZB^8~H1VH&
zx~M+UAE*xWZt*^vK_}{u_poz(cmj`to}$0O?(yW)h58q)dF8(TTF4B_fApyy#gk7L
zukz|M{ZVOc!=ph>a6KdC2jku}4Y?MN&A0uHyZ$aUlWo^?gyDzSG+hUika(E7wv8pR
zEjSLOEsjU$=&Oz2sB)Ce4H}1%y(x`%(>Gie2-gL)itqzWJZ50(Srj```mSXgz9k+x
zf!DX`8<n&lkGk=@exgC)e;5=FsNJybx&jeWVbN0jO6eOs`uo}RcTqQlD?L{j6nj!i
zOt|4-Uj`O7jWBR6i#e2SK=cmY@!NaHwLk8$IL1vGaNi3U7A}*R2;0Sh;rf_4#P%r*
zJt0;xRj+D$<$P>bWVh2J8s$}iU!NBR<zJ-GWrxS=Gi~bT+GF*6e_o_hT0|VxHm8PT
zy-c%fn!&7B3NFT2`&lCuf&<I?DiW$Ve6GoCRh9U&Gw6g?9nTj!K05=TLX@y{o`@32
z(BL5w1$<Doh$(|A3ukAv9;2+rsP78vF`k{RcE7H9&pb^;1hycJ{}JU8i{hxb*)YK~
zn$f8&WCq4M%=CN8f7S{lRHdL<RKAxe|Mj198oy81-g8AE!yI(n+dNjY(|#=wMixOB
z{gTdZy8nFtWqj+E8Jg5J42NJsn2CvPNz9}NoGzX)O%jF<_x8Rrt#4hLE#>}oT1b|r
zUzFEplZvl5;YtaSBHDOho<xNlLRLCVR0yQR`QoEm517W$e<XPZMYev}PsnO<pH;h9
zYsW*c${ljsNEU#sN?P!Gm;EBE>V06*(V}4yS02#rhKv5|KmY$$;&#bZ6$184CPfT@
zuWX_!<*=LHR$S6kfdN<>gWFhu=kU8`)M_6GFgD$Am2##6C0#lp3T@~8fn*dKAEQed
z&%o^+DYRO6e}iU<^#krp1e&F=^dcIgEXu!Bv~uU*nt}h$&LAm!I)x5J8N_*Zc7~qM
zW-tu^b}KSPeh45sWo1^VJ=~j9U5V%_lGioxum2o5nx%Oju~;G&r~C^B3%nt{%l8;0
zR9m}gZ@Z`W=&&ry2n-9`2J<nYGQ<J%0&Ef<m^L+;f3;GxIRvNO;)?7#>PqZf2fvv~
z9?c@~jcDnkItn1m#Rh(p=t|YLY{_Vj!kA7Vw~gkC$adUfxJ@%u`Ww#C-(@_@8v%x;
zi<P))$x>ylsuh__K8Ny^h{C;z%quyMBYuNq5~dlKQ<)Tdh!$=Tr`@E=@k5)iAjG~!
z1STO5e=)Nt#ljP|Z%}IZ_u&eDaQ-;7y!`4y(v6Zc@V9AMgB`CcQZ0!p#Sg?;sq5PL
zh1%XP^hY-NO<u|PjTW500NF&{R31&|u?mBf3>C|+ekb`KvmE_SqnM>%%L`S1FQTkG
zpDr#wp1jg)q6cC9{ly=joAMSNYW^41$G^+se=-&M2zBm!8D)7<UsKlBigJxs?KC@r
z!dAb;lB$AQHSU$s$>%TfChuMR!T2;<*44W?1Fz*I&2GxhdLvM?QFfzC$7LD4`5en+
zQe1XB`Ov-f(+K^9jB!=2tNSGk{u%0wd~I85{BYCj6g7i8<uEX)?$v#?f0ytyWyh~&
ze{r2=UmAbw7(KyHpg>r;?X^RnRYO|@WdB{>^sjxN7Bp7PDSGIO5;i<8MYs8;RhG5?
z#xL5=+R<2v?Upw-QRUGX*3b60!PR8}*rn6bW#3k6QtL5K7oP9G^@jc5y2I(#r1+VN
z&+oOy^ZAX;z)Mdj@^iVg6sTLIa~8|fe+)i2?e~wKHdplCzzCh0hA~FgsO(a0JC2H&
z_gd-4%<Fl0^66sfoTx}Pbf@<P6(#TX-io6)m-M=YYs%?^Xm)=h;cGRQz&6vJQxylF
z(J4gNJF^R4{7iu*UCk-_>yu9x>*sj;FuAeCm6z%DbBJLS5zn_J+&h8Fl8PYce{1nF
zOQ&xtSA%jhL{oW;UhDf}7;H=FttbYKBWB<GF2s4`yL{X29p?ZTB{L~r(Co{eNF{B9
zUk;p-$0yb0$vA9Z$G&|jEoXSm$Nri@WgXt~vA^Yx8FH)FP3}$gJb2CXzO}X;G`6V<
zlWuE9Xy(I{XUH=4Dd?Lo`ZT@^e<t}n&5ECI_HE-qob%tMa<u;IL?)jZ%|3Tj|IgOe
z3l2v3M~NG;_BEHAF4-)vJI&ly^R~ZP+jY)1&e&$zJ5g2Bc62gucsBV*aVawuafhAG
zc)*x^9W21e@{cynT?WJnq~~Lo5gQX3S~ze57u%KzdB_fTP2=#H2P*(Te;T67ldD(Q
z=73}wTJA?96-`==gQ|+Cm05}^O5O=jE)PAHh1r^B%3(qra+)Slk*cP?bJ%gW=%ZxB
z2@L9C$KxI*p5<d2x)!#D7x*-kZfM;DmE{3OAFG$YfCParKn%3B46()`);Po(?;zHw
z&j^V39C4hndu2b&*h|B0f6c`ZUtGS!5AnqzzBt4e*ZvIg#UZ|USiZ~e?x`N)i;v_*
z5AnrE@tTMD;$wKrLwvEBnjyY;gz?2a1koN>)M#7J`N0N{h~-%UB&->pjR`j;4w%U>
z3p|r?TZY^|g1T;HHP;tqa^dY`NL6~`9mbBDJ|1ESX}3s{N11CAf78LH$0a6SXkzM`
z1WQM{QZPw8OAe8wA(Av?tqoag4=QV|iJs^)<FN*k$|JKAPtqR^;iTmU-w;k3!bw9o
zY3<JtP8z~VD|XKzoK#N45KelW9_S&Q^eA5Q5KejwZ+QqOHB&Q$lZJ58(k1g4!%4>;
zRbozH3mOp2JR3@xe@Gis-xApLd0?21D;;A))$7MrdDGnowYX{EMaF0qIBFO+A5Ae%
zTN0CVlVa0#B_;+)BX?cwNz0{y=`%|P1GDi^jPqWYjkh3&-;vt*?CjSbbGs_=!X&Kv
za2}5ln=8ItMB_XKGF^#i!-%RVQ^g$O+bYc6aQ})Z=W&|Pe=`Yj@(4oBF!D4xKRZ(c
zX~oJlM>BN7(<F>0aMOn$*-sF<_=>W5Eb||qvY$SkUKYhHfA;igKA+9ftT>-m9LVQ9
zoj#Qb{`1|_KjuZ8reB`IV?CYc607@hk>Z-Rp2qPFE}s}zO!p%o!7pzHVo%^6p3l@c
z-u?dmO>2g>e;ms^f0`;X=BLFxOK_Sr1E@NWk_nCyoa$b&7h0}oP!oG$7-B*^2m93K
z*zqk(xHdDmFGn!dohPYA)^PS0X@dr+X>{{*^#7*wYL<&EjnNi7{u-jd<8%%+S{3c6
z%+WlDuV8Bam=`*{l+Wl?0}G=5+lnR4lBM$_O6F>;e<uptuJbf4Tg1>Ju3E&^2(cPr
zYXa4K+ky;ROMA&eoaJb$n7ZZHS)4`%Dj+G7(;3x=I!qxP#92Cxa*1xzd4|$#LX(n%
z4+JDCa-dKx5}D=aXJ?!EtzXr(X<Jwgcmu6xK^R2^R9>Rc`!r3EpasS9E1<73-SdnV
zm*?o0e>BM>1@nk<%3_7==(TkfQMD%1#aDEL=1Hu0j1hx(3BPihOXympd=8KhDfZ2c
zy*YQjRQn7fOeZjK;7c15*D-KldKR{A={b&TN>d(k1-sTJ-ru_+o_aHrD{w?A>a1W#
z^(!q&ub1uzy69IUYE{Pi7%4?hv&gsP1)dw7f6DX8`55(fys-izm0R&>0fy9Sgvm>K
z6{Qt>@|51_GXvxpb>tY1j(q?1b)8-69_=I9{ZNf7?s4V?riUdB2__UEdwxK%=Y)j0
zrf>O<dH9gMS4k=UTE}RuH4WLT6{+}UGkPzo8Uu?6QC==cUHpMw$(8G{T&7ExBRb9G
ze}ra2?Z;`T`s=UCc`n7`vTG?@%U74O*-DgOyUprQefX>I*cYKg9pO-)V{Qge7G5w+
zeb2|zr93cv&I5Cmb@>Q6GFtj-UrlW<tv*A`;xV_5I%9!OAALNjwA_+xzS%`yHFgd9
z%f-i&9^?M~GQL*~`t|5Qmr%H`lFR<If5rH}^chB@^X}cFaq~Cqpcl7n3+^5DpQz-a
zhiB;aT3(oD1$?J2`>ZO6t4SHEXRo9MpG8tR!cXqTVSe-cYqT{h_=$dRCwt02c?iyW
zXLnz{Z9I~b%yf)^h``5G2n!SD7?>I&#8L)kC~U&rkPRo<5{!PWR93W4*O#fPe>$^N
znS>K;i8k3g@`m&6A)Idt8eLu^MS1S$6@0vZ@Ie#ZgKx$C^+8y|u#MH%_R-ia^9Q<n
z^68@6KcKPeMo`sCRYGKG^ShnML!piXEYz_m5kvikJrEubRY@LQ0`qPP^zu!28-@CS
z^x~sch&@}lu3`JwlGMP21Of+Ce=<x>CJ3_(Pk7-Y@UQ-<LWO0;LiAR}a_`R3+7FB@
z_qfg%$Fx7^Y9>L0RL-M2aIo%z7aKgR&(KLgJ?4bm#)4WvYaKY)_e6*tVo^uhp=(?B
zKx=&{9@aayOP8&@!B+i#wyO4c_Z`L;A5VT~U*Y9c?(A>3X*XG_%BsC%e{*$k93OQ(
z$-zt=$_#$T44}bGeduQDZE`L8@tb3}T0>uW%y$G12%(q+c8IA-Z0t$Xw>-}$E)Ndh
zYOT@J6-m}x$z^l}iUy$baC4NDR_tj<WgTs{U>EVXr7m3csBGCxbqg@j^}rzo!tEHv
zxq^2dqzQXR7@=cdnOx8yf1r+mna2qxB5*L}u8BR%HVxmPcIb#BTA4K}<~|o^W2g?x
z^KO>sv9D6kVutB>4(7HkF>ySO179#KspmM{Fl-hM?xtn#rg}|Q2V~`Lf;B4D>fdlk
z4!)%ag7X{Kd$;CzYeNw8SsWFoOCgU?&FjB^JQ;m3Ki#Q&syDiCfACM$Ej9dhy~gj%
zLp1;?R?N@fq1t~*<rg&jvO`&At?&P$ymLzHFVAt6PHphZE&VeCkYeyqtrD>TiM%gQ
z)+5o&eajY-TRtW}b1-4j#=dlYY!KTpY2aAYwT3Y8I=#F}Bp+1s15d%ZW4*eq)bB&P
zZmZQ@gJDpvpP>^ff39f4rT9B=k|&cbcGw~OyCOur1yZMX)1X|hnxA<Rffv~H9tUmj
zqYeKKX@1)(*T=47o5VLr5Ez(+Jix?e9`?B}aNux@hqfi9<30k!GX!Q8e@gS!13^6Z
zM)lY+&&R$VLuwFan>Kbl$HgQJJse2sW651py3F=1&Ig<Ke}19Q@2179S%Cxg`2iZi
zy;rng3vZ2dZV^}P4cT03TU*D8Hk&h#wA9e!P>cse_h8a5h|-XF{D4jRhX;8+TK$+w
z;Y-i-Fp<>5B=k&7DfKY(3~HMp5#0BW5bK<6f>ZX)#0P<PK4=5>ZV}JNzDz^UWgM2N
z%|jm(0UjkQf27zBEyE&)>x6#zNP*9LT&a76J`Zd4u`gN63=HlC0j7+Em@wgE-;*W|
z1MYCkBAin)c%JSSZ83P79s?43le207L_c;%*8qra=3>BXte2Gmv(ft*FdKK~nttGb
z=%dxmxy_{SF&q0_`j{A@g{cTEY`Bier0`7B^akC0f6&bzM>T@`QLG0<^r}5+(5|<L
zL=A*k>yEV{-LO9+10otdcHqYY*RGFU$qt#z4AZo6=rD$fOFbL}gyF!FjN9DveRBg@
z&+0FS%H=C7m)iv4R(;KWm9WQBv)r(FU`i0YFt9N3iH)geGwcdUJ?c_!u~pKys_m8Y
zu{l1ve_dp>iHVkFQH3nZ5^TDLE=sRtmPMi|JAyH;epPJ71!VxSyn<^`RF=Vp;AD!Z
zm`18-uS^715c|5)v_NNPO<#2<XJ@5t0MVJUvNF1+kg5pRLSz)m=N6Z+J%h5pu>|oL
zU8dLa3gG>T9uRH~qO8l?9%8P=QI9DVdMN#Ae>wl~<Lsv&*-yVgk!3VZGYQ3)e|$Q-
zbphtQkTc9~u=;m0hsk(4S2*Z`CIZ(p1eL3GF=oJA6gMMuatn#&X(A$c5E}m@$|GHV
zd4s6TDj)poa{a%jZ0*v5QqDAsN(qbdU;jC$@%wb`Jy$fItH!<CJk}~a$M@fYZoR8e
zTImENfSh@Q1(+Dj$IKA|8;(USj}U{dtnhXFUB&v=ZKXw){yHrrOVck(joL(+uFsSz
zUL!@cG2U_#6>_>!OZ=X2lONSHASGxQA5X49y?bUF#$SIxOdULz)n^7Ie-ni}`LWRW
zlOGFF_W~;b(>R(W&te%C-3C#ZCItqp`ZLRzeJ%gKmaug{V`(gY(EVIrMuq&L9PnR1
zp8WJ&ZRoB2^F_Tc{!wjE==6CUr`O8U^W)P(=%GEW#`sjt#!sCiBrn_GX_BXLBxoUX
z^hH)2`6W1}$SD6(MceZ^e^a3T>XeCcK%AvnU1hhbsr^2qNj`(xUW%u1jNZ$HCIwQ1
zeEM^o@-OJOC@)6nIw~&Vkob6_zJscxYFOjycv2+#o6ei&sDL4S<?&qI_fGOZW_e8=
zT5sp0^Gy}(-^!~<UhDBT_vtB#X#s~S&9VsUj;m8qqwO*|O|L-ce`qY>c!L|`8^p4d
z3Pe>~GAS~cC=4gu4Z4=}i%j4sFUP;{Li9>_YB5pI^LI%>@!C$iw*??X4T3pTsVAo6
zV(JQl1vQBmO4D#DJLCfOYHcknBlJF#iC6+HQ}!-8oyiRSkH2L!na4DXiktsAf^yd7
zD$%-BrTBE$$jwTDe{WQuZDhHwkgeCJDx{ssf6iqBid9%Cf%S92ZwMTadq8|{mM}GY
zTM8H@Qkn*#m>Sf?#IqbsT_eOoN&z*YY3Myh7Rl8$OXzf}gs>5~_O@I~U02#l0Sn7L
zC`yE!!H%a}DZegYCmPpoe^oyklyE>73mU~L))C7BO)?7Tf1Zx~|4@BNClhpmrm#gu
zfZ>p*t>V+|I7E~uX(6Yx;^y>^Z1S7DlJOfg=8@V;yPrY5>Fxq3%TrgEJ#SU8F4xs}
ztWMnvope`7H*Qilf-Vq?l6Ipo&!dr=*$jX;t!ot&wMcVLW15}9oVPojw%ZwvKrU8a
z+kTMI2!SP}e|pwW@*ioGpf6D(E<mA4=Wy~t8zYn^&3L*gf2~LO@T9lFKKY~`pT;uh
z@^s1UjFB<wl?JV!n&y09ja&(mqM4+3SrI#zpt$@-nT%U^?zPH^?xM1Ed!n;-Ax@=6
ztE88BE)}2SzEYs>+7-RvSUy^(u@?lEF9V5*F9jyTfAFynN&DO~Lupu^;~4UQ)k?Lo
zRjCW?rl)2i=)P^Sot?d_HslH-4fpdk=lpW>Yqd3{OnfO|FscI>K^oQ?;zD}S^<~5_
zn}z|DJx%kX(lU$qMk^ByBfvw*C0e43{;YwhTT&-FPROMZV9PKJOoZuT-?2>WGa{uB
zA(e)4e}vW!yJ=)op+Z2ldavER@ONnl$wD(f)OJuKno1V5cr6#rG2*n4lN4mUmcmN<
zv^YYijoY_2t<{&6d{Ri;(L;bFH~2f{5rwO@?3d#>0Fiv22tCEy8cLRH+J@(2Ml25#
zX4#l>YGBI@{D7GOA>tk^@dGlH^d|bv=F<2UfA$i{cW;MX$A5C?wh(#{#!$=b=|0lH
z@v%~?pG8tD_1_)kV7f=EjWWxmhHVAd4;>2=hg;Y;LkqhibRBNm#P#f9Yu%?0YEPSL
zsWWH~y!tYPh|PE1Yro@GTXw3|3eYi>vx(;NwEfW~&C$n`-)VeJGx_mk-2G$m$~Tu$
ze}1X2tAAa*>fMY^^+nZht!qY0{bJfax>#~7=xH5yU&grAV9!O=wAN>zs`Xmk<daVq
zy*}F4=zdz)lpUiFPg>eAlr(8ZqP}dIdsV>`{ny~HI)vQ3_WRq~%``A6ub!KMc4=?4
zOAjCZY8|a!Xt0oQCSB}tpI{OQf_=l}e^>;L<GB`d+~ANa#P;A3OTi=^s7RRdIjDeX
z()au1Gs&Z{WN8p{Fus-IwgQ1ss)l3G*~**dxfBZ35hYhLFQSR2G6H3bLLz$}<@?9~
zRk`U{$T+%^*$vhMYtV{okbc{|;zfUuo{@U4cLHOCj&BL>yO?ldV8VsKj2aABe{N;y
z`<6ki$C%IfO)em~Y@NN(RRu2&%OKdR@8!|e;meE7&RKQ3(OqMy3UK>;GRdUg<}_q8
z+2SFq_~vdMHj7t{HrgVNu5Oy9LfzDWA-BBoQqp2dXK$L?dXr4b<gMJc0Wj+G%QP1G
z-!irNeb}f8ZC6I`B;skZ`|RD>DR2rpc`v`hW_hyJ+gGCVGEItiRV@&pNIKb}t2b$`
zQ0VH#rbUrXPac;l=m#EuLtJOQ^Rd+4AY`~y?Ns5$I+nOM@8E$c1A}+)aJ_@(-RWM1
zK1I;U!6<5jE3xrE4n^5kNy$L)b$G5sa<p2WV{wBBh$#n9l-HF6Q^1&c+!dB-QPZ~Q
zkR`vjT+}K{-gGJm*3zswtTVhGOR{{x0!BkC#G!CPOibot-*zE?x7Bn)Uq}*)Rb0hG
zT5J6?q_y5-TC2(xy-ix{3U&m|lTnf!<cLA@3%J$jO7>D(s{~dR?|7>2LUEKAWAr>J
zpb{&<Cn~^87{w)|Rb4ph<g)fj4ZwO0qePEkW1{QE#MNJ5KC>xU!Fk!gMsMdu6vrr$
zQeB^jcHS>st*GsPwe`FrS+`1ToXxUymI3JYZj)72&pX9OT+{Jf-)5L|>0x5J4)%RF
z#D<`rEiH#j-#sSywq6`}o~(*Ko~WMI=BjR$kXp*)y=9}SVegWS>IQ*t8H`{WK*ZPK
z98+e6*fl(EbKh};l_%umjIezR5>QFQgUdK=JMBube-IIWydjlzNF}|ez~_)kdhn^F
zdnk_Q+_5ueS69q_95I0m9qEM(`^1)**a5?ggf<SC!I((`=@E9knWrkduVqy2IrDTu
zQ{0?*`ruOZ)C264HR`wlp&mD|DWwB!VFXiYF>JZEF#UiNM&uEi9p9ccy4?ESW7g<H
z7Oq|MKV4~m8-YhGY=fu~DjXcJfMVBniETIm3+X-727FZcpX&^iyGikUsK&>Tx_QW{
zo5!2EDJkQ=0RV182AJ5w!jzddrVb5>=ZB`r@1d^o0d0!+xE<bIa^}O@B?ny9;o_=}
z9n(HQr3R?f#-9Nyb%0PQ?`U;8({)W2QWpz96qwk5zK5x86KpbWSRS=QSC|7-YVS}f
z+r{gEQcBNyEI=twI3|$+#i8qkm^jqMjG7F)B(QAab8h+r|Np@Me?R>HP{Q#6(Em4}
zsg}j4insKjQXk&Y5K?ed9TkO=sv%C`N1hjPntr)$#<ngIhI1N9oa=9)2UVe^x$Ix&
zxx}e|?x}rkKDvX70~;|}zlu4yvDIXi^V%Ad#+2oV(*&`b8O`%nIe;HfrYjL#Mw3gd
zC=b<?cZvz@8-@h}_YEZjh#)3+Tmu`@voSHagPCg@*tTWh7>4wHP7XL6qL$;GR19dX
zrrqiUY`|WrX78mIz@p^r0=^1}ZOJeUaS$4RHYUO&*!O%B8y1s3vxMP=8!+;NGq2^$
z)9+n5-qtd)eFyv%$jO3tum131rA_t_SRE06TwMO$oo@-1e`jt6CjS9`Rh|xA!5N7B
zkH}eLSc00uwy`9hhlv*m%!IIU;812#;c?I5M+B$pNOFm$`W7DluKjd-`u+z1bXnAY
z{dNLT8HP(O>3f(#S{mUT3c0#A=29|BeV5t9I6kXkugv=$VY(;6edrTEJl6eH!niBw
z%HuX+j6hv$09_dl!GROF*cPEMOoK7QzK4vWBLiK1lVNgu+||xT$Ae?d?>)gln|}b<
zt0Sh(7p4dd%M@6;EX2fPCg^?^gzTt)Wm>}W+<}gAd+^o1x5aP6UmetLdGHXd-o%c3
zv%e?m`+hG=QCR)12N>1>!&*212J-vWhvPtge}ClnTfjHdtoZq63&z%gDgRqATa=5y
zv^nMhaWJ8dkC{Ov7KY(->eyi@H&jqs{pF`yz<79?2t{&B<9|eX#G*JVZZ@EQl4cb~
zw{ly*r)(|Wh^NyT&7#uF6Xn1Db57&;_fBu6TuTGH)d>&mz;F$TUFtJT0th5KCd1UG
zOb8}|kPYls18D03fwu01+^UmStK74#VRWHdWAs4{L5eP1YZ*){pU-A#RxAZ-Y2cNn
z#lmTZ=ZXHc1YId?Rtd%mSm>L7mLS*-0tYJW1~@QGial4j(sBbkV8&>)5mNPMuHjVr
zSy2HflN_w*x`6RKxuyxYsmnoV+|`ucplh0Cz;9J3nk#$_){kl?N+x#-rP`g)ib<Ed
z)Rx%rrNqPoD3vcg>{8S4d?8G46BPQOf+G9lvswbB+6RkOBXai#quQB&!^-2r^MpgN
z1tbJSK%rol2ADA6GEOa*Y@!-{WHF0xbjy7|8msMnbl*Qqa)40{Fsd!q>cC>vo|0TX
zY8cf(Vzsg`p=C1H<=8MxfeEt(X2c6|Xj5VtoKqV5M~=Gs77nXrsH?-Iu3FR-cLH67
z!ZB^fFtH;8fr%pm90)^yU@jcu8ivJu9v+{4u~*`%y@IYDute>OoFX9$sqeX%cv4`(
zZH9eQN^Ejsu)w#t<YKTw_Klpn8^)@g?Ti6AbtnWO4;VRh#K0*#1Rc%Az5xseCV=Ld
z?O`fK=z5lG6Z0PGN)H~I?+l!J0Gs6ioEm^r5BYc+_^Sr~s*OK?1AkTjXW*~;o}8qP
z^az(G4yo&5;z){tq!b69WqUTUr0s3UWE-$hx8bky@ERo4qoS`exG8MQqnKNvi3x)m
z2bO7I$L7A_Gsk9Rm3w%o^H={2b^i8;g!(r+o&8XPj2h>wcCqe8UiB(rV2m|vR0`L#
znXl>WtoFFlyteLt*t}>}kEhAaHN81ILriiy&y`VFaUx@sW(#ntvokgHv$Mu_Je@(R
zNR&))9!=-5@~bEluve45$S4dB$*(+~3n@nD=<G}fKD3`TKRZK_%J1#_iWSgFJ$6>v
zf#_+8b3!7W(kKB47dZZM8S6V0>&Or2?5v!8A(K`=FuwYKD~bLJA7!d6AOg@AJVG-|
zVh+wqm>Bi&^`npb&8T#hvoi!cwf1r5Gsz=(>V}Odlld%7@`%L}X5i2647X-BM?9U%
zk}d_(k*jBalB4uGLDO<#|6`tf!J4rwFZc5npbb5(e@pcgT}y^e;g_m`k0-#+rGRie
zjbZ+xH2HXcGD8106*Ry6LEUwB)@C`Yr%-)ZTj%h(VkaxVEwXtIF9YHkl&h~#A%7}Q
zVZYCdl4wmm;`9b;IjYM(o+#l^?2OyZ&Dq(C8jfT1>sNlM7-)1?@B&YZj3zm}=n=~1
zF@!OokymfZ7p!kgOV+U(QunkJHT{GUNO=+Ad`72#bv)$k>|8<h3c%hJDavPQQPQBL
zm8e#jt>#%k^kV($8i~Km()r}Feg~W;q9m<@g<g8YOR_W=>dGpXr|+Nt{M$%-$~WQ+
zU#5JXSCXO!4zIGa*2)N?5}`CNYlOBQ2baY-s};qf$wcNwi{%YX=xl#1Zf&)v(um+)
z?}R*mw3#7&JG60V69ZHT2m20puy325Z%dytZaqd9Wjbp%9@xCNjIO$JN(*!i^1N)r
z)a?4@LDJedYXQnHK}ymP{)n<At)|WP4T4A!%Ow3GU;|7;bbT4|%Wl9Chy~}lIy>a_
zyywGgyD-(qFQQDgJe1{O3o-FTw4I#o6vqyKHNSRxqQ6{JNs}-+%}H3cwCw8c`M3*K
z4RS9rBwj9ei{9ERS}i0MBQEnv;Q|nfWu*ve(v}rZxWmJbdsmICe%EE-j;jg!sGvg6
z5PZ~kN7pTVJUIo$ZuIeFVTRtwta|1qMRn=qjysdI6zNxL8Swh%)6=r)W*F5^qnC7l
zZivF_mTp&i+Uh4*)ttIkHKk_eGeEy@PN(#X{G7|;a}=JIQ`Wv7<OvSuaWxU}f$C-L
z5YWeyAJm1dp{$y>_QG3y@}H2gR1n|DjDxawfihT@r;B%<A=5C<4fM1#_hV$1@3=^3
zkTldFAewvo>BIH7pM1Jl@$Rb{3}p*{RS|}|*E+qprENl;hkn<cMC89VS5yz&`Ch%z
z)-~$yq2j~JfUYv14&2qgC`JdAsl462n^RfK9)|Sd?b3_KcQ20;{q<IINbXw>w;d%o
zH<f48*x?5H_2e0{jE5%X+do0N`}|fOV}<6BJetyY%XPjLvihMV(N8iuyWH`Aa41bU
zYm4`AQlztAwzuS#t;lx;Euy@LxB|;>_3k@M(%gK<Hllk1>Wa+1@nQa<lEiQE5Zm2y
zyQQ^rl=U|23U-rdI-kCaCJ8tSX;Qq1CQ*^^aC$ebyv(#Gr*6W!-=(*e#3ZSZuf)qp
z#^P3je3Ga0jJKQET6|6lnoVSXajRR^mheXgMnR=&Zu5dvl&f{y`*bpiCA^!E#<|>f
z!rtlfZOJ^2x9Su+<FA_=O=FuAPN&Ya_PuTUyNs@6{(BWBbhf!gii!MXNq2XhW3$X_
z2wpDm8*J3FD?FnoO*fzx_6?t6!dQrXS4!+K>9{6$10#HtL~!Y>?<t0VKRfP1os5z%
zcLAo#b-voMxFk%q;9R_wn-KjynzSy+l%E}jl^0o>O!nn{AH0!+H}aO=NF8_sXyOaC
zv<64yMn`0S%D$@)(%8xeSpo+1c%OW_SbXb)3-aNCb_W+^cRmIe<ZVsJ19#30F37<J
zdHhm7xF81?<lutrug$@K1v$7NyL<KEg51#s*|Gk%^+g&|P}_8DY#NecB8bGk!728n
zLq!nC!1wQ$iMX2wZyIZyh{sM_ynsyoxB49`i0Wg>&k;^&`_dtp+T6oLgf3=|8(_vL
zlfENOy0WU&?elZiO5J9^ctfm%UP7b>y_OSNL|5|k<?9i8H)qp-C<l*u!%16ZY+#H#
zB(?=*YYA+t)DCoZw!WvcGc=PKSl0~|j{=q}Pk59U87<OGLDM(qhiE^T0&$n!XA&Us
z;1W;KCB1_2l;uLkNI_enE2#NV`smNjloKD4FTe|SR!-{}{rUDcJ*=Xj{Bo)j16ISm
z51Q88|Carsq#!bXZG_P;>FnnF?+3SD;x@C0EjYz~z$GT8bTQ+c;ebnK1ddIqC5IHe
zO|Zcs1#d4YcuTfXl}rTOQq^X<XBP6UH}UQk-rcz&18z@y_u8Giy>GAEwKt{<y~(09
zi;4)ceN?uVn&1Kk0?*qGmlpFRN+v%*63INvRGvgPSPW!;<*ei;$2uRaj=SzHTPUmo
z$GCp4m%AhixrA7T<q&KLDls8}gPCv~9C8v!hjCMiL$2Gpa_RI$7<X8mH6c9+bhE<B
zFnf>JT!l3ARix%y_1>bX?Dd9DLC8y)A6IKYC+w6HQeFp%CraeU=y@&gqnZspMbk8i
ziZm;iT0@wBt|19ZxFLU5pcojeQ6u-&qJ~nk8smeK@_AIl_3GXuje1L_^@{+B-XeBY
zinJ42LIzfV-O#o$F}wg%!!|Kzq3Z|SbeJ{JbG4}p70Y>>x=_!4_ieX@b5T^!w<1ZO
zMhV0*(FH2foYR<QZI*P@Mh#4(q{;9ajhZIt*R7j>XeWuanpmW2|0Pc6;`wa0m{q6K
zv=n|pW&OfJ_;}JR-(H?u^F;}HDAK%uv*Gk~MzdUghP~<ZExlGfy`Tjhjn2C_jmFL2
zB@PunzSym$)}0H047CM)E_aj9FJJ3IhEaIhA3fwpS!LE+Ya(>c8Z^?}@UGf0%FCBO
z!v$1-Y>Z+Ba?qntTid2Fn0Gq{*km^i!MNKYR4?Ptx4+%@3;FZyZ%YQEPm%i`OLKND
zh{zT*W8Ue^=wWO(FXmm&iz*vhZENTPvGz_0tk*OtH#<cd(YjXg3&7>&K3rZ5$GG}b
zZ>`m*c_C-&SG|AyM;ayQOO%KUD6^E#K}|S+rIX1B((CI!x(J}wus%E~MN2CyqbHv(
zcuHfLb9vg|kjBOcZqTa!s>`dLqr6y|1FNnrS9p18J&-@&{<dZuTH^ZmwA8EBx7Je9
zeUjz<wdK2e{o1~I@;Ej|s8v?Be&;mjLvrOxWK$d^C0*`jSd_YM$0QnE0OB{wWZb%c
z^A2lFD9B!Ko4G})iCuCZ_Y0HhK2CcJxYbkqoPlTKyFW*3ciR0iQninN_h;zt-v=*K
zuo>_E5VLtUiyzRtXdMx|Kg^8;c>hCsDc|%s`rSN;$LXjTw|y}OQ|D)yFS6y}Qa+q5
zeK#g^P1A804lHV7;@CD09M{Aa#8m@-N(4LT$~ap&1P|Wr_&v*@v}BOoU^UF$yoZcY
z8iZkhY2XM<0*7Ks2*)lXoJ!yKskN#M@sUa(q_oN<^*noZnr_>2Rm=8`&aE4xU()F;
zmW32!^pZxg;#TaJ^_*oXmwB$DE(I-s<gIdBwznQddsUT`Woc2wGLfqKXNI7EcxaYC
zAYp|E*;!f**WjMvVw+fyx@k$we3Rn9GFV82&mA%Ny4RNJxuvhW>oP{i=`$`zSUOQU
zU0%QyQFxzD<MGFy4FVsn8O7bWjmIT1-gaZS8^7`RW80$KFoZjC7`NXA=(zVhhPFer
zJ(QLfa?iq1%}UF<yyp@0=48=-qAJJp@#K%<Qf41dM*63-buC%xf4Qjd=tq)T3BAki
z+}`oHnR-IOH=idoz9}M}A5WRCyYV}6fW=7l*8T>1zM{;yYcp`KO8YF5M_WHE5P|Sa
zLb2_53=_(2%sBI~ZM%jkY;K!|{}}l;_NKHcJ42CiD3x0C@wUFdod(x`+nD>6zW`E}
z33P$hC|mj(#Yx)Q;ng57(5l<cdzZFueI+ioxa*Y|FDRK?+}0cBJ{3zn&DD%uAS>vd
zZEBQJ0yM6MI?hb>e`^W9MC%Z$ht-?0EnINJN%TN=f4yXndHXlrAT&agV>2`Xav3rl
zxQ@iWV|cb58m8|BN9AFEda6Hqljf2B=*<e((EBU`^zT1pCL&(k#^tnKS1sSC?y~H$
zaz)i><BlWrmsrxI_C-;^1Lx>6z3v=53Qsx7C;*GaT)~11{Zt)aRE@yYwF4fA6H1R1
zUzM}5n=8r|p-)UEF*likiEvHqOWVh`=~A0e;xl0$uvkMzqmrb5T#J&fZ_$;&1wXx(
zS;g6{=a}-+b+7oq8kj9yco|JDp|FJJcLe$FDL8e_oYNAp+u(Rd=qjRme2t)2qFPJc
z7kQ%;nk-^-m0G0=(I^OgCZ|$FO}U#{3bPc^7|j$trAiEYsA8MWa0yc0O=P7h1J?}+
zHbWvXu{{q59(S>Sv<%M+xxxI94vP5Big=oppUlc_c$sQmZ88hWx!OIWWU?0}U2pGw
zRUML7bxDdf`fGX77%gh*TWP&oS4XYeUx|yY?u3#UopWj3ZGY3V^;YKdxH#_~XWOXC
zojV3a`5{+UUwu*^v%2hx&=AbCa2N=N2?0g`$EBFqZV*_1rZ9tm4V!dllb%&MJ7sbn
zXez6nCEM?_oBY#D{2{k@hwQS+!e0GqgYQLOb8AlsLi=}Je0b8bN)*Jm-k(1_QS<!d
zQ{!vV53o=Prq>7(au>+&qw~BULp_z-V0*tmi{bX9f%=I2MLo1SD9ab2y(j!~sLAqR
zsp7WbN)MxdxY)?TvSp|DZeebtYL(a=hjT`#i388KG4XhaS!kJ9ND){hG^u4AeQGs$
z*cPauw3Fl|V6Z5^R7Y92`mJ(~l=EFv0hB(EicmdFvoV6Bsmx*39K$*K{ly=+S8x~5
zVqp{m(hO2X>w=%UAvnFEh0^KwRC)WJDttxFx<1l>B~@$3qn3-8uiI*ruAkepWr2Df
zo%ZJi{S{p-L90D2?dzzlkzCh<)ekp1N6(d$NVm#qg2I?i5Ur-|S~1Qm`i3Y+VJ81M
zmq`)dG;>JvavJyVx>?JNwSHykmyavngx!2NCMCYf0}oT~JD4!n!qj&Kc1&j5%%Q$?
zA7wCqRkL*WC@GdMtbSI1<y|Zn$Ve|WwPw_M-D;@;QHFZvuSK03p3fQ7a@;E0dV{I4
ze*_)cccgQS-dK9y)7#!wO?7YSL`#?UqUTAY!dBZMR?7}Cme?Wvgt4|E(j8HqM6ZS5
zP5HJj&~2*HF0D6Oep?M;teeRHpQyMjS?23(y<>17O~5T2Y_PFy+qP}n+}O^<+}PH}
z#>Te2v2AmMy?NfZzWVA`-9Iy3)&Hitru&>e02bHLA?zgGKuWtC9@*P}?NHLyDt+(%
zF=FUa{ntSMdue|r?Cv>>Xp5p-Ed>HbZ>H_qbaqAO8W8H>BLbTAQcF{P>FXsO!11He
ztK7j;^zSyXO+WpQ1pPF7=&nhD)2=6l1-spicCz`m61GtRIFk&gI@E~(#X;YhX57wZ
z3vd><M5-JA)4sv}ZJwrZdA!yRs3!H5r*L}XMF(Frq(9;O()~XWx~;lZP@V0)VWGIh
zt;raYbhR`r#dNeRE#quFS!iCFmIbxDh1;wYwNR;g8o9xZ$2=lI@M0Z!$DgY^SF;5P
zS3GXObv!0qEaguih*XzaAf1sSpFvb!0JlSf0g9eVb8)pYD}|)H8V&MSy3HQ(=j9?;
zb~Z3p>o78bxIQ{Ox*#c6+wEN*`|i+`z;)TO20<-M%S9_(&}cd~@j!?d1H#YQ;dpHk
zx&iW%83JK5?U|!!oTRPlh%T5Y2O<Sfno@8ybulb|hn*MM)*2g<3+6;k6qChMz_(Dw
zfBU4PhzzXLSC8D|<UMif;@Q@q=|@mBH(X;mltJQ@W}JJh0XbhTxJ{1|yN5G0YNs-$
z`k~kG;r8{s*Kjd{>~fNtaIi6whzt=D&FMe(H-JA}&S1WhD#sF$LQM}|o*eobhoTuQ
zD~n)vg$W!HmEdnWGeiAlSfbWEuv@^LFGY)H-A2`{i`W(V>oebpqWt8mnF65F4*%sE
zSz{f0;*8xx%6Hb=$Z}KV%Q_<y{k4Z!`}#xx?>ZRE)=!5XIUA2MwsWJegm5NhwS!h{
zSJxN1F}tAx4)zraNlg3zHaVMrdA^rA$7rih-A4PVJ*#@-recePZq*eaMCj=Ok*TEV
zKJqgF_s~t}qb-%l{1v;43ksIewezP=F`=U-zMlb(#j<{W1tN6QbJ*Rk^oNi)%(+b}
z9HO7+yp`S|(tnr-%MB_mc4vtOa?2-~V%Cs&M-VaaRuTyda5dmDfg61cjx8btefJYA
zS!U>t>b(yN(86%HwFZnxzSy;ex_Wfa0;V>}hz%pp%eMS$r{x{BMGU2og+az7@s_b?
z#xXBJa_>k{d3!J-J~Lv9`IdSIU6iZ>^VxW<T+E9evD(LKc5mI@>t$<V?M#2=2fM7D
z?Z4HU(#|SkxR@u>YNMx0J*t03>AtBn0JqBObwg~i6l1JHTfnEI<s+~9>jji%H|hpi
z1<XAGjfV<|xS{ZolXRX7CIs*9f;8A8k2y;LDs{zYqwh~om{k}@*WIO3qoJw$%pyz3
z;9%v{@`p@R^IQ-^MdaPTHkU<fma7WsC+ixQ2a867X$(&pH_YFIL9Fhmza%x<*>AbT
zv2-B$7?aO5Ye3uVYwE#k<~I7lE9`jDDW8Ugo`8r?#bh~c2_ui?vu<=F+Twcho-6#g
z-||iUu@3?Tf)w4e9i2V}oINVemSp}}ysXoiW+yEFE0#Eo*e`c_@=*FYo2O$LUjofT
z1+B60(ZQ`rc)q@tl&OoEzSI;N^^t8A+I!u<f3i+GtTfl036_GjBB0eVw<|_Ot7}^;
z^h_j;mNaE;d-iA!%K`5{yrcaw6I*jisW%*W<f7XB!BoT^JE1okjF+2v)``*?c%m6Y
zm)nyVTRR=@R}A$O9yJ~AWog&o&?Eo{{B^BNTH@jW&Ad9pSANrpGqrK^5Vu7xS-R&>
zV~Ylm@IhCx6X|7`ms{DhO-G;F`$@RPExY3>P9~qM!Mk7bB9mmq>0Bk@<qx)#+_!vb
ziA2d;J44!%NmX0@{Ask>O#b0N$e*>V&B|1rCD9uR5=k5<J0}*|@fYso=)i%AzCljt
z5)RJ#-FYRMiT$wOG$Ef{e$Tp>f47rxdwfXX7GJ>GKasDd;v%sH;p|xB(OAQIL8=>_
zi11_KmkZSD;#*_6oCi=^wcgq!$gh{mVMg8!?+;*M7PLlfn+T7kg1t^f?9?O{8ahj3
zs4}BCo6Bp8kQpkZb1973GDHD;qXdn}ApFsoppRatYRl?agx^#~>2x37u?Faw^Bj^w
zKPnkU)i#j^se0jvf_%SQs<8!{#V-X^9Dd6a;t!-Jw3{Pu+WC+kD5*&(p`<^)NrcI7
zt`2jI^_NcK3lexCm#3&`SZa`_Re1nrtRZi5#Ew-AiW4$-I$c(_zDognf=6SRdfh>r
zKW%r{nhCK8DEx_-cDv&;970!|W8!g*iEQ@?-ZMr@?A_jXW!jg_DEoPAyDM3o(FuR6
zIW+6(@lsF`5F8o74coIto2jT}SYXb$9X6a@hkDC&EQW7WvKR|Kt~jjTk6#F}M>tGe
ztgGVa<~?fe!magYu?Yhofec>%F6Y#+J$s7vM&SPl>6Ff_iM3+bU3o_CJRl*QGuEsG
z&WUG$a-s=vLz8#;$q_V$P0MF-VOVPYW#}Vgle_3hjlpMaB4@W7Uf~b%4-@s{T5RE2
z99dtU!<qiK`@Ze@nRd2&&G`AUk#3z6W#hK?a^27>CoXU%QEmW8XdAGd9$`|cH2urG
z?^(F8`f`Pr!Aub<4#%KOogCa_dL=zGd>Z-U(4U`eW;^MON@s2+=R8W>q(ztD+A*5_
zKWrw<<Iz7C3YQuFFQZA*5a2ql9{QuVj)A@!#G%ZhS1D?Nu@3lqt^z9)XD?8jTrs5G
z+A4I}0G$uv0O(dq^_R@MpG$NlpM$J<eMwvC9>WFrltos_FASHhI=F-!ICP3Z+h=&=
z(ec=|g$;uU@a+QmXEE@|TTb|yvI&WX?&i9VI!fOOw(g1w5MM1UXBZ}lCrLD{a4C+2
zPmE2%KuZ=I>(gSPpuYnITZ81mk`%QhUiyJ$ia_Zqrnz6I0w^25PVRQ6IiG5%xLQN~
zmH3FLjJ@QEnM@<2$_ZEi8hOP8%ZhvKR^@m`&aPS@7tV2cg~}Ki%?V}(5f9@$H9bj<
zm5O@s%%ddDv@`iVNl-!m)c1qC<3_fzf`FsS7Jg5!tbyNnl~F)44GlQCCr^gBAebZ6
zWD>M3Fa8htV+ciJOvb#K9Ts%?Nvp&eD+*M9)wyqGb>nw?fgrQH@;i4B7Z~~vzWpK#
zto5d<k>3ZgGlt+ULN}N%ghEp72wrsxvu9Yx9cI<H^wrI6-?A{2wS^TzcSh<EcG8eX
z@u8DpHW%FUcrJk4uh=rlqzSDB4?RN}XhJuW)F1kvi55yi%D>m&6D)cWdQCHrm9eDB
z4}^G<<^Br0%gZTYbkSGxlPGyErn#i#)tkUO41uYXguO2VpN#mCHZB3ZeE*Fd9xvB<
zo_!5^1%gW0Vm*_m@BjUs`N!`~WK)Haw26^UFSp+42jF%Lx--|y;X-wb*I9-Rl1x5U
z?GQxq6GoH*px@@#Mjq?uX6N}bG!n}>yD3wwQjJndGNQ<Ls&z~p9$|FLIHNT}PqPlI
zQbF)AWF7CP)W;PKeCjkHUDr8(^2m3M&1XzTN%a$HZUCQ^?HW->dkqPv=&6R5OpGk4
zy{W+rfDV20!0*H7<9PDbLOFXy)x)}KKI=>2G<L!Dw4&(tIRL~aV?1oTyXrbMAYxta
z#uHhoekewM!%G{(Uo)48xaQBk2;Q%?gWO}x9YKR{#OeFP9y|vAkq~LU(`|P!y1c+2
z<{}d0sKnN^-Gbk3$A@7hVGFng6lQjUJ6IW}fT@=#rrq&de@sz5j*{PR9QFGVtC#>c
zDE1nA97b%te+5fBa22vpQoX`LU~BD{%%Wg?!+ge>3>N+D%n5@--PGSOYUIo8WM<rh
zg_X66si@@Li#7Cr+#R2d`u}}c9&1}#{4E0WgMpqpK?wYE1LyGMd)Y5?VSVU7HF<D2
zLqNXr*V8-3WH-LM^(5yQiFsLq_FJpwhH9ml%%AJ#*&W#YK$z>*W|n_Nb1A9K)z|u~
zuEjAaL}Bg|cH(x{3wGqTzXM^HylcR=_cwo2y##2oas}mqFU(YYTXW9Fyo_y`-KiLc
zl)oZkYg-F;p8S!mD4O&Y0utQ2o9;L=0toNmtfblZZuYW+ZSxw1pZVx(AH)=cE=i?T
z1$GkaS2M^oJ4e^l^gRvJER?!pced}ci7EFBy;ac2&@*W;R7$w%pcHewmltW2v*pmt
zTVv`Ar=w~4L+r5~2?eTCq)wU*o2v-@_`}kksm-r5E67Ouulg^%rSd1lVMW9^K2W!G
zF}h`FE>^<I*LWrp+yRO3%^b;_6>N;zsW`Me`CEAEzRdb#8`88<jheNzPBUlJLrMP+
zeG?4`EuUgtBTjGfiib=M49T}_b;6#A1{}BN+h3hNm)4cI{u#xp`Wa{84stF$0cSS*
zQxPYoQ@h$oC`}SF?X?^|TBPjNpa4UX?xBFbx9mjd+S%ECmIW(h2J(OCge{mOg|*Rd
zjn9r@c2$VfHB4>*i?q@kU4E$Qb82Ge*J1i26X?q-F1L}$o29{bK|4P%&GI&(L$gJ<
zn$(TB&-N7|8x+X8Q{`a!xBiEd-VzGzA7=QZF!hc9;2j4|p>i1TezbTWG96rTHvINU
z7-|`oWW0#v-QZH+`f0b@+)lGK#%hMGD>Klw>q!Wu^#*O!>2phZ0hZPS2aOBdq;|=O
zxuQpM$N0oH`f*JbmfXf(|Aa{x!^1-g-{q$b_fy(p<v-HzvRq8@rz#5$Wx|sKqprJ_
zhRtFi=J<}s>v#>??;pR#N^f~C_7><fmwR3y2+66_^6Nu`-pv7<&*|-9FeR}iiMGaN
z2K;F#W&eU}e|!egL665zRh<UVknmtjaVRJo^T@X$=yVF^v@ib!w_3Qp&Clw&Pmrx?
zd@~Hc)jFMs|37n3J%bEeT-*1e#ynBFD+6M!V2!<Sb$!rDi^V0^SmD<(J}GF}L)ILt
zEtEBvKC~Yw>WXh3?QS~$V)mSm2i6>I#rspwWu|{A`Uo8DQDoQB0hu4hCTk4On?fsn
z{7U<T-TQXso&eN{E_YDhBS-7j72dZNl_kjIb%7j*LpDUC*1ivoyfAPqdyoPA9>J0p
za0JIzQ(*TQE*w`+@;N4;8?kBI6UZM1Mex8Rh|<?{Y-WTg4KbF1!$np7yK;;%K){*Z
zn-Dm~=N-b(+Q!lkJnaOZ|86m))Ei@M+fZEc7~|LK(ProD;GV{d#{S6*=ks;np#&wi
z_*|#Rzg{fRa$!{VxaE;ujXH3dV=gM)R`6@Xl%Be!h_VLWXCb;4k$NG&@lcAz56ZLt
z!GYFSvqK|!y{aJR;L9R;A2Q4-K6sDv*7I6Jk}30;*p0CRIN>rGy!{$kCUI=xc-cIl
z^x{Q3^0cD3*`Kf_7sXB?Ha~yU1@FKrSJBx(OC4+`LO~rMS)u%DcGxyf9m<g8JHClo
zED=~G)MS|;5i*3v)?lATA6q4$Tk>My6^Ct-UekgqZmXM=P^U4@v}R~mt~46B9G?Q`
z)>qxqnRH749>ngA_s-@lt?_PglT%&hgG!*a%L@8`nkQ`^r2KS4nP~ldi)r_&QXAFy
zZpe;8OrEb?NT!+kyTZWmF(|$Bm!>k$%-1ecO<7E^Z9m*ZEY@qw;Ixw=1T%w$U<>+)
znLV3dK>qVhO9(1RWOc}(CVlFWp4{g>s^W_1%1BfiaFs8>ks5oeIMAa*e&|CZtmqIp
zI=j03_{)gdONZFy;o<%9ic{%3&{wAp|5E+)^=y*ip6Uw+o_K7wOFVD2m++Jd@Xe8m
z%<?Wm+r=pQz*WrZd-cuhJOpFz)_+;B$u5w(z7G<1e)q|{>C37!F@Xe22PX?ST@~qQ
zMUfi-kme83tPJ7gB5s%-<)Bbel-3c=i2S@CYQ8Dq5Cl>R!<RjgR(TNhntC+-{u{jS
zL|k^-S`5|q2sg5y+q;oZOwnv<YO#ujI>014TzumP+z@TFKp8t?)3J~<GKD`(lBV3D
zhE7CfP_t^#Kg5`E>5I0?8@ecCPwZC+Ntw0*wWq5q4l}_M`A*mmPfsxd!7-M7`rhyu
zJcdUcT3p$XJ$=1QMgCte3_)-h;~QMM{g_9{y_F)0*h?HC-ZprxozUF6x>GGM)EoS|
zcxO8KWjJlANa2kE4_vF@UvysZ>NI^Tc_m);F-1m^dHH|n(Dvs;FH)+vlmCRBgDe6J
z_h6^K1=X^fwPBNzA`}$?HUnx|=THe_Aqu}hjwMxpvgRGL>JvC@R3vl$aiU>rBI1HY
z#r>i@lk@aQna^tGLZ%7e9tg0sA1XKM2NN;BE#^a(bYB{oyg*tg2-RD5Ox~2=#267p
zRuezt3u<|+y4rnk{2Mdi*4mcIwNL`GeBrywyCp&)vck5|n^qb~+S;4k&S{<M)j=O_
z?I!ZBbI_V~UzKN8AR2=H)Z2<`&syM5*uSEvQNOT@&MrULO}OtgL%Q1Ns)ql_^Zh}f
z#91#Szh)z<og|7sUW9NYV3FK#ity+W){n9+@3dB8Ql*gzeQUSf_??1-ovA)e8U-2|
zfcVV^KX?Ciargy|sgVW(z4cD#ZGt2HNDCCQa{_Vosn6u2&3nZrcW1@kA>qRH?z}M2
zIU@`f<S2x2hfiH4ilh_siahSIo6<<V#P{3m$>BA(c_!wiB}!Ez&9H(pfnq_Zt^zhD
zl8p0>jjXl0S?grPL6rP6@q@Vsji&%W5nK~eB7%SU`<J*b(C@2>i^Fs0yNSy>j)}jY
zkC39PsV<GeV9H$w&cXWJZHwBiW{OqW!$-BNrQa>5b$9gm6A!86HO6(}DU6NfY*F}5
z*eCYG3A^M_zN8@AS&ihm<#i?gy3Imz+u(7CNq=PY_h(zY)`CF(yqf?gY{(j*%^=I*
zOE{)(Se=WelqLRc1pWWZbqF{pVCS71tD^C{YtK%9POkQON6l5R{PKTP^Ns@_$JxWz
z3%{QOU@CD8s{^aOs?Jj68(alMu`($7PY!LWCtEgBD#P>BR@`%wlBlOBqU_EF*(?l~
z1(tup6c^aL(8puFXIlU!`+HifsN}FHw{1<(Lj;z1s7LMTC^Lg3$;}R4axgaNviB9u
zn$sf|Np`%Z)yxayR%2Ogajs1VQ)Q+JDK}!~zI_1J{+VV9sHPI+@N`O0qz0x9Q&9;9
zO*QBLUNJXn7?nb{7As*n;*cvFm^DeU-?_4usM1D{Pt$b(P_w#N3*XbV0|3#`>6BF*
z5*T<8Rj;M=R5r=l1(fCQ@Q)Ii7RACI&dFKf*1i*0$o)&8{ovgvbShT^?7R}#W_QKp
zA|w5aNEj5tLQXp&C_Z6??YTw>=vP~5nUB>r)hTv=|JUmR1b4ZpPM2>PS2}BaQAQv0
zl*+`V051Q;_5%GwkvHTogn;Nc%H@1oK34esT0x=`chkuQu98MQflB}KZm-l|k?(<D
zC$1xMWJmK%{x{5lI=khM-Tg7eI_eKCv%{XkD+n%2rkEn>JGxZkIXk3KYZW7-9xn^*
z#@fT}WfYDEOS+gL#P+=NiL!XXWbn`Pk)*s-z}Avxs+(~6^VXX9AwE~b)ThEi_yge|
zzr!_dP83u|wmD0hbfDQZwXI+w9Mbf-|HNh)JeCD#jATW;Yg7q}$UgTt6-YpzU@8&Q
z)Z<mimf^Tw;hqJC6V3?IbGOVst>c_Ih+X!y$?NaIGt0ZYdnxXzgXOPar73sxv2*5e
z;P@ToX#kE#15?aPApE7p9Uw<#%NY@8i<T|>hgI)I5U2=uPe+q)b7I4zNK%uH$8CaQ
zZ|XGOBgGtciDq(%v#1x8R;oPxpSSv6ZrjzMJNSvrIn$gIhcdoE8>4tlvvgchh)ghV
z1f)k&4IFgw7HQ;^J+`Pb00-;`p~f5VN~VAva_e^ej&e3no!F&K(U%ukvx}Dv3Z{GB
zIOi(i<@8B9;UDys+|gUloYPNDI*yQ+lT*<014p;9)PSYN&{_LWeuYlea4v<{FPP(g
ztpvF!IKC)rjhLEr%JJ~zLb)jJw8s!q<il0H%ht-c5_<K|CHETEdFIhvXO%#pN6BJ6
z5l*Y0m}N%`(m&ukCW`99UH!T0@{>F@*e-q@WoHj_KETGVl+1d5EH}?c(xveh=<a%M
zKE_C0bwvVR%0<O?c}9JzCL7@{;jxH_N3M)azs{s1D_ZTRW>$w?7K>CibZAfrr9-Nr
zK&*WTywewr@s-pCeI7$AD`f-DITid8K=+5dWjj^r#v$4gxSXwk#B!Q))nmQ3ngFUT
zK1x3OO?iN^q-_mBsDkR{n;Nx9X!b9n)#H;*y1#|VlPZgAHhl1~8TovfWNZ>&DITNN
zgO&VctG^3R)nL+7ek7>9eP#1ZCCpz0|4EIWC+oHj!tj<3zsFkAX*5B#)E+nC-VA^9
zA1j=9_@I_Mj*U&*!i2^F!Vj`iNeyPHx`kbNLakJ~YBXv|+_pG?KH7?jVL6t}{OGHO
z*Mh&!IOIDye;(t67aJCGIeRX9awW#7^>Q&?d2nMgHBOfGbqWmAnnnJ{D`d1S77!ZW
zC86=MV=SmfIX{B2lRqBkIr=B}Z4UIeFrb0EdYtCKHcFwBYYUjxN;NCXH;E9Z2sG=j
zO<C#1?*5Nj0Q%GSP1gp*`?>p?nay%|1Qo)*q8Lq|XesrhUPrz7!XiKLcMW`_YXt)%
zrluFOmGGHrmsW-1y~y-pE&W!)f1aUUIjLi#i@f<Uvv1P5ZiJg`+5hPRl<$g|bl6h4
z(@OR0ac}|Bq1xN0mLZ!58^&5I3e(&EzmGp-km)YjRJ+41U``lTY9u9}u_Ytb{*GX9
zR-S*AiyxvSr)*OtIh{{;k#xCY{*Hq>b9~U)e2Ql@UvEa%dY-9Y^~0k-pn1N%pIC13
zj?H7O+aw%K5@I;4CLmMST?hAy+O~$9O<nI!fT9Gnf3$QBHBKI_()n947V{w6-|}&y
zWJ4idJ^Buyo^n0}<d%8MwxDx=L=lV*sAWzTT!ZPXw_ldL2N3*Pg1pwKYZfBiU~TPn
zQ?%dDvTggByl%5D!<l;ChEci#M;{i+2#$x<KV)pBe5Nv!(AOKdCeAA2*6QF<Xq$HJ
zx?>MSIENJXxAO0fZhDdo6Dlrp^aQ#bC}bn;|K0YvXuI^rdj9v#!*?KKO&VJFsXKu1
zSEo0;^k@TbxNlVo#~WR{YEllkzi35E$=)3jG|Sa1SL5Y6p5+B(Wkl~27B>a>#BPY`
z2&<o*?RH=H1O3Ifja#i9?qot1+)obX*DYlr3ET|dq*4B$I?V)(GDD|R-uYF5-%9Dd
zoG&jsZVop?=*HrwzjELs7|A-LHJa?)qHU$AUnAWi%MAM8p8O#_@=-d-9vx|N&WK`h
z<O#7mMj9--M!K%(Y?P7K;@*naE#@$D=4j_5?{wVUz{r_zC46l4#@ri@R4D>32z-h_
zMb)elfzHivM`CI%`W!Y(j&ov%wGupy8Mmg0B5|cPYz;|8_+rGPXaccR6Rqj*4h@JV
zI8HK1gmO40rx+wCg8TZRfq=GVyKnwnVj?}lk(#)K8)eI$IA?-5-`i6pwowNHM|Wx>
z;b_QxV!(8D`MMTs=kkZ_mrMv3g*&@|GpyDUyJ#Vk=ny#6g{1T~JtJhuZlq+#<<@Ys
zL-2BNRs4xV;orU24QMgHN&6;ne4d}I^Y<Ob-tn&EFTHFMF+<$fCsVJ?ZM4-F2Wv{z
zogj5mazwAetH*^Z=P^<2B0JUaSa=gg;F_YtQxX17Ep0tjMCB8ZZiExTBd31@O2RWH
zAUL2K>8-Vbl<w1K5A-!bX+)>1Wf1T^UsqRoL+>E*i=S-V`u1bijl`SBtm!C~kwJ}`
zOjNDSm*pQpB&5ulPLt6fs;i;cQijZ76u#>$a$=-8w+r=qeu+nAe;sNRvr74A{Bq(6
zG=mBqS(<ei{T6ARJMd*`jTMUqg6auoJxVmJf3@Qw+EbW~M8O0)N)y3fbo>kN;?$4D
z)n58$NX|1;Z9zdFJlL&dvRd|Qo_dou#gi<jomDe=3@kzjMN^6hRw!|N!Da0T{;%Y}
zEW>-Od%h2_dl*v!*i^lQvE)H=Z3<eH2<UHM^{v3wr<Yhg`VRsM<ljs#fQaY<m_8!^
zG4lA{496}ir>1tFQtC(%78pd0w!*&Bp!>Ku>xTKX!2W2ao}8&fZ#!JESxoT)+L41P
z@~zftJ8lY8Td$D@kB2BTR_LW$NPCG2>QcnceOx)&z6b41Sm+=iYr__m8GUFF@r#Z%
z<(@I7At~)<)8KA%2l4h6sF1vMvgyYBhu1IPn#Af84tma~g+DnB3(l;UBI<PSh<M)h
z8I$gEydFo!mTo!rW}6vaO>y|4zlH}l7kZm3S=+VKXLBjB_H3W0*ub8G@z%qnTrtzc
z<?Dp^xE~Zlc~~Xr;lU)9hBO{cgoCWX(se=a8yJcdoQ5fnI@cBiEQFni>m@tkq?#b@
zV4y!ANkF;(Y71}L+6@9oPFgnDrV}{C)*?B?_>7vjulkth*)PRJOHJaiN%S*XQWU*9
z-W$-+euohMb$R%nGxLm$w`OR-c4^wFR_R1l6b2fZCgIE_mUKxRv?mz2SV)$WhFQ2F
zzA_~BuI0B)7zDNj<VwfIt}QMiES3mHC0f70mp(>KT?-r;u_LHH2rDRaIbQGkE>`ol
zn!5|aBS>3ZBSvoW1XyPMWR5**5PAl$QkAGb^g??hfUm>EvN&KhyvKhA-A^OA-$fK<
zMBl&K3}jS~yMpr{<85N~#y(4!b|vjsBaMexVydt0fP8WVW*qfNndI+zd+!lpx(;NI
zBu&#gQK1f;We*bL)<9eMc2dusCWhI#^HZO3f1}+^DWo4-T$}}H6EIDHTeLa5@v-z2
zfLmz$#e-YCzLcDRHdcin1!%ix#v=AEI4kB)V<-<Pl(lIbn4*Y()8%2VFU9`0USfAz
z;(&aViHKDTe2c9mgwn)7W$ETsB7ZoV?oFP}$Wb1biiQ&bC(Oc#tP>}Nf5UO9`?450
zUIfgY?3lLU%Y27DlnhRu4F{KKBbWFd>>fach;-;3(U40H6>{fKnygpI4U#Nt796Z<
z&W{0AI?g_SLR@znUL^Q6{$1pjUMT1vMF29+KRp7B7|(lkf*j&yFW~2y<({huKGb6?
zq3V|G8*h7HKhg8fcTvHR^0ptpJGFCAZr|gTfVE|Z)7pIG%hNpbFpNVMWpm`YGeo1k
zugC?iLDEN)M=E8#n1`YdTc;m#!%moS#97>txsQK$0WDSQiX^JWlr8W_eJJpVELDIb
z($ELC5CYirM;2V=M;N|Bsv(Rc{Ek?vLW$YSYISox{%ON$%*dxpIiN>TC0)q08be@`
zNGI0Jwr7uk1^v9osX<#e3DuEVQb<o32s33eB4P>FbDz57E5REH;n3VUW7%}fnL!ZV
z*n`=*o1WY?3i~5v%jv<tY?-S-wZyh(6nz5VAoTb4HSf1|+h+>z5Vm3*kM%EIwwhq{
zWtSg6^dIS7b`5bBqI4vYoej8WyOyRt5qfq<vebVJLZ+lcdU*BC$kz8R)%!o3c5W)A
zxL27lzxhT4_|F>UysX7B+^zD2qy&wxdNCoN#f&X`^5OSPiWi<@-cm8_+MGdkJwgGr
zVC&z&b;2yQ*&gc6LCt%PzwB@!CaRX+2j4V|yuSL&Qgx;~U}yr8(|N|E|7cICPQiwU
zsJ928?HUUaBzd}Fx-90mk+Hi)VSFB6LiF!mS9OlvF^=;Fxmz6^*nyC&)AC@!9m5}d
zC4r`>oCewCIu!4<xhz~-s5M?z<{SglXHZfC<y}s^)k*cbeugj51Lln$u+n;LacXZw
z(Jh244I2~T1b#e*Cz8?rSi+340y&K58^Y~|9#MF|-hy5K)m>ykoqld1qj3_=+x_xR
zf&l%^25y58U1yGp358+G)#SGT>&sY2Z`Y;P^Y>_6FS}Cm+n@)|03O8{p%XFy<%E*f
z__)x<sXXYe&fttv<@50s2}Ma3SBy-=;Q!$wlZd#w#<NV8aX0+<XTScaE7h0z3h4Zs
zVWRFX3V7CCGHNSuPOq}-t1+X6*+Vr)if%5{AHGmfw4*y!E8dfi#L77gfmHqQF(08_
zkF9qXv0XaO%-p!v9t)y->vsW8?B<WX-$|+LMJ4uQY)UcHY&(&4-x4IMOW*O4@&u04
zx^P!Cr(NaWPQSyvp!FH2l9{R0u|7t(yQErB`=G?%!2Xn#DKJaT`w(A{TX4$NdunYv
zx2B#nP?Xi-hmfLRmflnLPOU4m<%}q#qh}6@&BI<hsC<758!D>2qZ<WK{)+J(AJH(Z
zqOR`dG5841XdilJ@=68GHO<`SW~ZvTo~k`wCdY}G=kEXTE}(nza>rM-f2Yq!yphfL
z9;&Y$W)p3cVpMC5mYks`_5xz{Ya!@x7Qq`e+)KkuIntm`%IL@l48Rq48jU|)iRyT%
zXb`#24+*=?pu!hSce4T*(xb}4LO^6@*&_etQU{weq2lu)4=j(brLm$NIbnx`uro>Q
z-WM^GeV5rcp(Dks(P9a_%{p@879}U$53@$LjT?hYn4=133tXNuit^2@Gl_7<7^1G!
z-O-r9x(bL&Vda6xz9xyfOJC*_?h&pU@})ze)(#X&BuTYY)1U_Kt(EV>P$U96+WZy7
z#y#20Mb*r#vWuNEBJ&GrHF|H-yzqkf@#u;{r2|&cEW*#;<@F5uwq0>jZ{75!6?zX~
z|HZ};?@xHb8HSL6+UDXDMhiqg2gL4I>@NpU1pl#RGuhb!F%82d)qvtNPHsF;-@L&V
zDU1lc;f8RgOr-nz{&_e3{dYdjy0CWpR(tp(e|SK3X(xDPP;egQ&sf4Di&$+l0;9ok
zRH`~8g!J>2rk1YivwAn0g9U`vuFxZq4qL7iwPHWl4P6oyP{A5+^Mc9S5VCBT#~Yox
zvV=O7nTwN)%hCr8iQKKi_L7H<x+K4Sp%?ptf_OQvueM6ul`RVHs<1F&!2`%LVk{?A
ztAGZkNY!qF9lNtJ?6_Bqj98q@B&O^mvh19E&M7yv3AiI?<S9F3ZdwX$nYp|LuJ=Tt
z{$`12CuO-l<#6$g6-3J$Ba~DVg65^oOMGOE(zdf_jcj9!17wR;twvu&UF2KG9aa1+
zj(hkKPIzGC0g=jcpdcU-D>jVB%e0HzJ}Cg-8R@4pSm$Lm`lHw;-Uzj$POXA+K&H_q
zm%^J;C)JoI3)W(FeC>LZNH>FB=ue3gyudtdg5b?G`mxkHfmN~#j%Vi3cfOi-?0`IA
zfuZh=@8NIuOm);a!I9FV_AEC{CL!*gfHaMu1_A(g64T)OFLckDW30c<?zYmzy{uAv
zjN)B$F7Myu9-3dIsy70PBL{?am7+uuXwbe0e-Zo<NBiS#1R=AmNO}KHvMOlpyq;qu
zYZoUyw|~;e1f2{Tdktik2f7rFj96TYT@;|QIPA}7!Nddwj<MvZC5?iR%dM^bd2-m#
zaVtRD^7E$qo(74%=-HmLkY>2Z#2-1*hWbk+MBUg@(`_f)3syr9QO*bXH-S<ROx7RO
zj2CYTk!R<NTTDBx^D=3#J<S3VyflK-$4N7q*cX&E!G2{dD>LRb4iU&kA~A^<5;R%j
zsdDH@z36p>m&Y`ehq2bDn*l#ccD+~J<Y56_Wh7%08_1{2UY7LQ)7arFFD=l?2{8S|
zQyY(;<aOi<E-op5q#|7xwNOOs<Oc%+Y@>#RK+%cv38+$Dq#=utlfIQy&h`^+39Yz?
zh6#r0P@6u~$SFAzqky*_!kJ6#1dqg9ub}BB?3>2%fW}IR;g7gQSP(dK)XIDHq$~l0
zoC%u^8;lYAvMO9fn=V`)qt$dQT+2XD;W7S?O_GFrPW4a(=_^8q#J5*fzv#jGg!8X0
zsBTOuf*!h?#KO!dNox>}WMZlR+OcpO)lk;0H9Gh->sPDbMU<ekW^y>9Z-^!?0->@6
z0pXAKHuYO-FiMoNiMi6hLt>~69V&p;0mOP89M=*4O9NpO;>K6ccPXz2lkOi<;t79{
zNtl*JhL(IaXnozr@^JaRA1g3a1A|}GYWx>@U{yccL=gYS3*kx0%d&;o@6dCDzRkc~
zr=H!lHv2dGr^|TioK=PWKW=hvQ0%;dRwREXF4-h(Hc4%<66rB~&XAN0A9mn&J;{~@
z!U40_Nh=B(rLlH3cTgEc14D)BfB_xsU$CYc=rd=zcUJo|L_ZZnfubtcQX=-=YZ}0n
zSEWZuQ@(Cbd>iWk*?xqxQj%;kQHn#MV`fSU9f6LMJ8@zP7kNx;XF5+Cs2SXn5;grJ
zIKbHgk(V)|Rd0$$S93K?O9OB>j*M!I33F*_oScyq|81jwt0=0(wkJI~uc9w{e4;%n
zsiVK@B81cecAw5vu4!>9;*s`Hxe9CWCZ0W!F|ZD#K<>nI&-l<#alyKZM-64)?b}Rt
zE9Ae2|DgCSaNx@tjQX234cnt@w6GiNPwEo}rnN@Y&j<AZA1PKwux)@y)r)k__c36z
zT(**;mAUKhIqpp=f$cS-4k6!xuV7gS;+LCGw2<<@^LT*HyOEo1)(x+|>0mQ>l;48+
zN&|fqI3*nOtu>Ye8w>rWU+c}#)A#0QPy^S|$}Ws9&z17uhrckS)7{0esQ%ESe8Xz6
zGM#XAyLeq3FesaghXjxxS3PbLeDa}#C+j};Z$f!Go<Q|I)lNic@9z;-f>tgONBdjE
zF%U8`G=I*3YPU8HTio}SzYr~K5yXdnon>#rJ=s2y-jw>=dBs<1EM7yDCc!p`FkEcq
z_)K<tOEU4TnoGhTb_-#2OZzsV%Ib*UE}x;$uEfCf&~2f<s{-x=D7F)i;K87D7B4IF
z8PR?-?oKD??X^&ugx*jNq5AdT5}=+(gukmJY=9@;l*NZw1TEnQeCzHbbPNHHty_*S
z2oCS>^3W07fri2}epKW4q?(MIAg<YS+JUD3sO0@=v^qEoA8b6eqgE$GUBHcoIyH|c
z0Uxur6fCFN76?Eb;+j{Y8N>J#WWRj2QF~;iw@k}hw>A@m4)#-gx3gVE4*AE$@g$<S
z%)WUKf2@omOP3R=f3&USm<y(yTIHc8#Sx`d<{q_)qQ;T_IE2pi(-K*1k}dD%4(u^9
z05+g0Wkxr@8NFI2#DoAXLX$|3x$ce1n|~|E(86S>@E%CTSeNIt<Ea1wmJX^p!Z$ia
z|0adQsW+j{G@V}v%I@Bw(a@SeY82D!$+RwK;$?eZ8}3|f@Cspml0#h`C%x8g;C!TE
zViGgK4m&NzMZ0E_eH{5>gP1G&faQ?dMKqz>MQ{bX_k1XfNG&&^!sj&qfKOn?nxqU^
z#oJ>_O8}5_W@1#9p`o_W$=>EI@NAz|aOv10{S)mBLd-oVL#OQfv*$jwWfHZq!$Z-U
zIhJYmnfFm|ZN3{mh?qm}XoK!C`#cA~NFnU>gX(FqC?a6&5MKY9UHiB)oejRi4<fj7
zn=W+V?l?v`&pB#&>>}Q!-`R1>wyy^pD!tAj76p8I*{GpXlc8dcHd*2vPF@1-xzOGc
zj7=v<a1eaMO(Yk}k5Si|Nk0nmz4?e|G_1DpQkWfN6VWCxARLv2T{yo~U@;fcVvf3c
zijTXWJKpPH-hroYv7%HQV6p?L_S)%8to;SDB9u2py&eN2uqVGQ_nJL(%a-A1Y)HNC
zXMrp+f^PN)NNAL@+Zif|)GMf%9)1&<BzmLX;(HTT9I6T@Hb;5bXXyK+kE50Kc}^Z9
z0P4aa9K6n{7r#sqAy(WY5dJ>k1HY~(JgfHoe+I(`d`3WcL~l*+I7fcoQ9GHVEBrb^
z(Mn-hB>&8JW_S`qP7w_3ML&@I?PQ=b*GK$AEopnk3vpgX)SkuOU;1^TNl4&3!4`Fu
zV$8g|5n(;}_CrQ2`>3`BbBXC55~_{2nBK^P^aIy|$R!^r`I<+{W<ImDWdu!Ff?gnN
zj5`;_3gy}N#~34u9}~$>J587es|{-NKN4ZKJHgqWwF=rY|Fn3k1+RGQ-hu(+s0;Q`
z&~j>MD`_u&HVoVCS@g|0fA9LzE`{G3#=KkzH~lu~N1d-yVg9}}oZx|>5K`E;9^kdb
z>5lce+~gL8$E`!jSWB#f5Z5SN&fc)&t*Q;AI)riEz~MtRTd%Si)s*8t6GD5Xq;mH;
z+|L<&<nN)m^0QpSko#r0yMzEyUW$#rO}qvwZm<DK);y(|7*u4cx%~dZK3%lXFoeN$
zgqJ5Q#i|R@bn63bg>e0@{BmWo%%-`fo|BE(E`*Fx4W-hw3FwF1#T1v%w>gQ5x>x+_
zN8d31_W7O7wJEAE>}_!=MYgSd<%u+U$YRncU&g*Fja}EX1*y2bAc+88&;@+G#907>
zbm%oQ9!m=-L4Lds?xqh=5FbqXr!S#`nHw=y4GP4GcG4UdiP;fvo6<gnf17+|-W3Yf
zA|&0r9W`UH#g|kouC=QB)%s8MA6`5mTDCC$bTVL29B)usZ+eLkqARjc;#EI(3hMvI
zSL7>Lm_45WH~Cn&tzC{yqMX-$`_lSu7lt4%rIz7`lvBPNE00T9hG9dty;%41gHl60
z@{i2+X{P%a5Z%E$C!z8%{pDD;83g)u-O%3Z{{R-J=;&sAGY*FY<9<ka(=NNYOW@yY
z(CPNky(YXu#GgN55!^fFSEKp5F{tx)35T^l{_X-aN3!3WF3;1Q*;+s{$zO^mi8M{{
zhF6<F{NEstJp-lEEyV-325<h+(I}^rfB)W~SJ?KQx(`|--vr0N>F!42SS>BAGq|%7
z&pj9*%v139$9aFx6@%lal|?a#;f4Vh11i_c-uiTXyuT(MT<`8nKh?Drq8b+#LK67+
zv4KhxN@ETIbLw1-(qwTG9^U9eF0&Qai-jN%R{alGJacXa3hZesv>g<JK<Rk-3E`rN
z9=ZKrgHBO3`@TB8@ibviTy}0<pZFg<2w25G{r8`Vt+7p0UK*}e&Xz^GpxSC*Th^BL
zLSm%Bj_6Pvf6>IXVfB>4+soY{myVpAt^o(<YnYix<Map>7t^}NqlNJyx#6S>?DdB_
z1PE*rOfLBH(RfM9?a$S-otGM|U2O%{R%K~Rux%<YTX(6o7-l>iX2<C){>TE{oWty?
z7uLVkK(|BKT_`T$3LnU3L^ROqN@z!>X+@BgGc3>T)T$mU&|2)#h^18}LO)2R&Vc^-
zDdT=;K4Y(J<p*M@i)JHkGMfmjqWLGNH&<rj*EBK(ZSzU2!*5bx|Na-^B#s<j<S8yr
z1)w24!X1y}{@#^+c~{3VSLcqE1sCF%Cl=xDk$da>fjZ$ott!8W<sQl+Na^^h5`=hD
z1*TtCAoB5y>7cmX{c@O$c(MaDaEdv&^!|P9t9vC1tQ`^0OtIyow){Zcn1p8XXI`lx
zErj(=Uk|4)dfbmW{OWOS+@4U3nY;cX+?EkJq5jOK_1CnUop|7GT}rrRC9IqDHsd4@
zYxPcsTT?+D{u4933pH*-8*DEd$!&;`L-h=TJVG);r;}mH%`Y@Vt!Ds&upa_j7)xGw
zz+nNdmMT8VdEDmFI~1J2T8X1eOkW1LUHMjsd%OyGamM8<E&Mytty}>o%e_Hz`;wc-
zC5=E7eSA3|b3KZ^&GwaiOuX(vD~CnItZ984r@BW^bwrBM>6}AWvyK{^O&N#XfTfI#
z%I~@mL>im(<fgg@massR8*j23rK_8Vnp=|L61|0KpAZV=tL-s$o0E@DdSaMAP;y`w
z=1vf@qNHcL$In9F$lmq$m|=Vgqef0vEuE8bONQHHV3-~qVumH-5}A;<#Mn6c1&1Qm
zZifhlZT&9ee4*}HNPWOhRCt&GJ%76~5kmXvur{E{PA!;=pcIJp`QkmOelRkudYZb9
z#JLvvj&FnBPQAT1c!0z1$t^eK<>m)4s!b-8OZQDLGM-IqXBJ;b3-vQHF;IslYWqK7
z%CpLkcsZ}`Bcv+I?pnPz{raOSwAW7-DS3*G_i+iSoLo#ERt#8JCDq<t<3hHsX~&a4
zM0!q7sp~aRHUI;H`cM7_2p7Mdy2xj-NAh!Xzc`P3wa4e=xXBs%s@izF*hV&n#!jt8
z>9%%Sw$;K(XUFKQ@V`Qm2B6P5`BP`?u6#;b+M@OTSwZ7bAeAW4IIVgGEV%V|QHSxu
z2(G59EvIB-(4pDcs}feoA35uAGKpYT{kXmPd9!Diw7~HK?NucWa>J3V0qa(diHL~Q
zO2+(Jfm>qVub8$O6E289IEPNRp@?M9OuwWQE>IoULV=NyYpm9u{+C{m0irL)p(sro
z;VJ@do~z$%)Lw<j-He-NFA-f7t#rAHY9IM!PobeO!uYFrIL&gu6)88yI90+)Kq7~D
z(YuVu8%Qo@vO5{8hUf@om6R8_Ni+A7+>bfUL~cxvDVl{sykY9^#zw;P4y>`JgURsA
z6W!IU@?r@1t>5|j7ySn&jSGrDazLD`^`)ZLR+tB5{DJA_UFvxz+1SQfSR_JaC719u
z<t=7lz@JwM<934qIzrT&qmrH6DJAJU<b8uCCSbq&MtWixj%Z5xPfYwzN-~1L52C32
zHdnTmQ5@beUXCCSWgqlp^od3tuLalf@FJaVzBcN3yWs#HH5+rm>3vy8qgZy^<4?OE
z?dI#bG5p)lb><o0pb%i|kFeA@b7q+zM$(DXX6!#(viF_((C&-VYosCXe>&$aJ!Waa
zW&l4X-!E`t6Fetr%3_ag!pz!#kwqkOWw?pTjY0FZ5|fa`fkGI6sPCM1)?V|mVNK%1
zFLJ}|H5q>JALL*`AJ9V4l`3<LvyN8igpd(?5%MhhPPVR28}%;K*3ijzH;-%duHaz(
z{Mk$23R?PGxOSM<mv66iYp(Qud_+UUWDUrN&--&N5mh&E;Z-#zErp<lM0TCnYmPf<
zmk~9wPs<^KtsgWocJN~&cC=b%ePI99(T*1ZPtji<ES2rY75lh8pGbL&Z;q?`@BvSV
z2%jh1!}9}CkTlpqhcBvz>{)aCa?8)His=i9tp^37Wekjs>dRJL9T#4Nq<Ge{({SMD
z3#hx@o-r+(FP<1%FXV#N&ML<}zjNH7g<EG2**;eWad!u%Q{WBFZ&m0y%<&lrE@!M)
zk;W|7r0goXhQ6v`=XJx`b}HJ&WQQ$qa%TrMEx`ctw0)fKikf3>fEpp`?RX4GOZ)Ob
zrf7tRKNW=CS41nBuZIduSR0xO$QBR}M*fRRxlfDd0E`1#d}=Y-NoHPU$faVXjZ1Qf
z%+hEX<GKk3>7`yc>rX>kFl61a`(68xoa((Es$`9|QFJB)g?+v;4oihsV98tG56d=5
z;#$o_GvcOIavN(z+3>d_<SS6(9&$q>%MSWLfB0G|S97IWSf%faG&VJeHF!W(+Cykx
zN0fOL+h5MA&hcJHIKn7O(6);|wVWgF|5BgN@rID&MpZSuJXv}kpQU-Q3Xk$c)snrW
z#y`!k{q!1GzZrZ}XN;0YN&86C7SZ+>9<L;BzsNCof+Va~1V>NMJO`JL)Snk;FH2wK
zm&SPfY_SZxydjxcWa`lv(8C1wKMslw28_Bb>G=P;ZY}Y(BJ_G-$45jpJ1e>Uu#U(t
z3(Nm+wMdY{f0(Z7R-HZRNg|GqR<9O66-Kxw$hElOY1x1JO4{$Sjemlm;iS5A7Ib!S
z3O{3|U-H4G_P`qk=6QHQnP&0mHg2*_HRHnlT8Biq#8PZ<BU@&0(gViLcl`KdxLd?^
zGz`G?#~PQo2(Y#}w+`|IvG7is$jy?%8;L{Uuvq+8QXRGY5$#_u!D9XVp4b`O^|8B<
z4p^TsCfhe0Kq*qY(qay-RJ82FulUg<#5XtKtjhDi!+Qhm?XQhyG|D-qsGuKaM?hWl
zzUa(2KNFml7_fo*NWfBD`GtshAq;i8QP3SqrlTNB=!T<xPlkVoZh|lH2WI|fBU<|L
zAgeY{lqyH7?9B<8<uaME?tT$nSL{9AA=5H`u++9;=g`dO%2H+DVx%Pxk9&Hl>BO8J
zUOGiz_e4;yS&2PvB|aTz&t8$Rw1+M-A~K%7?-aO{H;6PL2O#Cm$yV>jrH98>A57uS
zN!{4K#E%4A8<uQDHBmxaW2q3bN`Tw8A@qrvGCbK%Me!~F`FTyO?C)Y;)whi@NrQTT
z<LqF(s#Oqm`$Di=p(3XReH2=PHWmym^s6%4g0{fnYhfPIgyB7O4x_hOyzgq>o<yM+
zf5l^wygEh<0P%kju^wp+Z?a>sV?xKl!OYN!oWz~S=eh7N4PWa$GD`d4Dhp1kUN<yn
z>So>X;&|XX3Wn>@Sy11akM`qVD2fNokP8s)&H1zB5<OS<ybaIIWib{ZGf7!8Zt}C4
zGVW#zV`BAXF|o_vG>D$ip#`*XuA28M&^auAr5{zb0=%$Qx0#6kG1d$&Rq-!cjS+$L
zv`kEMbg)<>8$_=17^i*v!=m4uDQ_ap>v0mkp>u}&NUi)@>v?mu>Z9f~_5wv7K_YZz
zS2_Xj#SCybr~(OS1h*ybY7ig@v_a>oR<NGN>mD9EJ9&uc(4yzj`s0&iMpzppoXTgm
zg<PSI4RjVDTuCGHyy|~+As!8|3qsxR3R`b>FwDxEcGapxVY4J5j|>kMA~)O8_vcoI
zuiV>(uXUID93<%4VVEc{N78JPs-+F*$#7f5)F?;J_@Nilvv7OB3)qcf|6{<lg2n7-
zw3RLB_q7F0PfCw`ndm6hl-~>Q(6!E#E}S*h0vg#+bwgfOmib^&S=rLf*TSwgjw3jv
z0*2`a_%sTIdd$C%pdG}L&PFYZ*tDC_a1x$;YF5>6Lq|y>Y`};1r9%51N1^pn!i2yt
zGefL>v){!Zg|m?@Q^3{5Gz&nff6NzUpMRI06g$-INX+^<NQrwecP=-Bz8eDaeatg4
z04N+b<uMx9>>VRhpu`&sfkIAzl>3T~O!-aklZ|fvk#DqglJc%Zi#*Y>mj*h<N{&3~
zu7F*D?6nAITZJ5LOzS9mp*k=~;6f5}5{R6+WXiYIC>^bD`NlrDdZ}Aks;pU!y&9pV
zd7d`)-oMgGz!Qui$dg=kmJicbu^YQ<4y?V4MbBwN=M=RuHNMiw{M;>mMVxi^HO_<8
zc=|I%%!2tP4k)5A89EqHo0@T2bbv^pSK7Zj4<>HF#I+xcVQ*iAbFH*-<O@f9pDT6w
z1XA#3cE)Z~e{LJ}5fIRktB6$d`+7fXYQ3dGE3qQp-!KSExHKLS>_}v{-0!$d1L249
zco({b<<+7`bu0v=+1|jyksU)53$gkL$EO!9ggGuE;X;9c6CdhZf?~b69=s0**Lz4w
z^?E9@*D$2T$Vh6cjpC`zm4ya_?mZtAUN;|SM4dPvEY#uxlN;$o106q8QAc*lISH-I
zdl308`_Aycl%JG}v)d(PP%|INK!GMp?UEi!4GpL!^g&4cWp46GlpF=z3SHy)$o@;Z
zm{6zWA$V-u%q&pHH=w!7COK1L9>!4e8d2~G@O5A{z1QeSO=_7jK`kjlD}a6~d>b1N
zzMz#fQ;GVl;^n8H#%6|A5!Q00KSFDBjc`t7%AZAd19LPV8>T!F9a{1MhAf~dpcEYj
zzO5g#%LXvCP}O@Q*7YkkG#ULq@9{PtJCyFHy*dZ;%@uxfW2e9DGFWZ*&nku&)rmO~
zl~Fv*DyifR3oF0&T)E@NWO-D+2=U)x&9W-_4b#Un+o&lB<^9w(+c<y_SAqXosBoPo
zjtri9Z4~yozdD3qdqLX(Fxvl`<e@ooUyzvYi<g7mJ|Uu3@%l>snoHqg@z-@X%NANT
z_MxPj+-E_^ay>#OJxqR6K(3SN-({LA5of9NIxxq?5{H{c4b%gxoJhYJMp-!<S!K7$
z7VhL`DxvuL2X>O|!w{oeVjw=#rLzseM7awGOm*nt(^Jz%8T;h|AOz%!O-I&cWrdt7
z_5U#9YK|l@2`E39Mt-uz(s)AotK6<Aag}HVf?=3*i-PWxEt4Ff7iIq+0NX$$zg@@d
z2I5BRb_I?E#h|w}K_v`J8qW5{#6EXS>_o>N7zSf@q+?>x5L^a)>>I?yIt@ZXP2w<i
zpXu1)6SpO~XDYkuBEkBcBk_M#c2hJgU@I8e<?`TjpIZgg>|}Iqy1{m`X1xlFm{<rP
zV`WjvqciI%S$PV}MUY*??_7?oW-B*kR1)A1brznRp8p^dES6(;yVrd+ZIehR#5E&K
zecQm6XSg^Bfr!9&iSBE<<K63E7g$wl9R;&ynuFPdZC+V_NKBt~SYChg+C?M&M0Q}p
zazL!*dA)Lh4N;J1Us#Gb^Fc6c5(o2Mzn_pXyx9<4T*bwe_*J<FEiO^v>MxCW;3qW7
zc)mg?&5hI%<Sk%nDNahYCA8JPyR<%o8Lox|^C5ZYtJGtG>4kxgEoM+`nKr?m9x%)t
zM-TnL^P}id+S8Z2%W;3VHVFPB<FRrHX&!zeCoW8?YI@5xDsmhAqk=a;j6@Syn!9Fa
z_!XWD=ej!9f4$}evrSq8u|e@23C#SLJ&@%kFYBYu-|!y*M^VJbP#N$KnH;`%CWm{G
z!k{%(?m#MoZ*2?tCc^Fm&r3iZEut<QqPm5x!1OSohJj5#(wTqB%*eLCgBRyxK17Et
z_w!(eCLq5K3y^0sPzL8b++~BEj^1&c!r39>;>2;qHv@Uzt~uiBCdk*$O|(zG?FE4C
z&;O5?Jtg>G_9R1k9QEfaAE`1&z<GYzt2Bglb*e(LQbU(mSFKU(=(h3*6qlb+76!?K
zUlm_PUEQ;cF+YE(QoLwiA8Jbnvo71bp$abyVqLs_Yj{XUwVMzFNjraVIK)QH^kE;V
zwysAOvA~hScCh6Uiiu-cIB*TuFi7MX^uA-V?;1c3N07jYYYCe}Gf5^`p9{IULmSfi
zP}#!eIZCG-dT%=Z3kZ1bKn3E;6cyl9txn(!(U{wQ(z1UJIXG*Y{rho|0gO+%<%ZC4
zoJteGU<kG(9&-Q^LxK9-(nI;R!4UoHH2oq3X%um9>meM@kgOP<`wEN<s1J?u%m^R?
z#5{p!nB}>QOdHH+zAd>SWiHt*5LiwjgC~s9BunBD;=s}<9!*6wg|OwYl+#HpiJyph
z!rTeVlNo=iUl)!O9;33y%$v*Bc{LFpJp4pMH}C@|#HJGk*dh!<pO}ZENY^QGJU#Tk
z!!o}|lJnLw^KeaKP!*mT#lR?01qc(cnC7gQCj2=fF6ohp%MI4fr80B9A67!FYFDvb
z2vN2!$VK3z)&{Ba5v{B(N*~F+b3<V$0!8^ox}kq8FLPgI>(<~);kUjf#N;Idt;FQ{
zTfBlCUs(qJ;+NG}%Io~kgIN8e#p-T{=fjqe!ys@?mql0)U5JD<877h8U}D>5#2npn
z!wvS;$L4ChSBJ#A>2S;}(_tZF*z-IGTe|CGV!IypnMEvvxpv^QgLB~~gTcYMa4*h<
z4V{1SP3?6JidWNfd{@6h*a~uX#nJ*)#I~1V!`~Z}IHB@2Ne!i|ccnKD8_@7rFt-ao
zyE*3uah9E+SEbZ6D}Tb0M@CO8-BkFNgMz`?RGL0a!hNppqi|-DZimgjt6qZiea#<|
zHPSR>ppwKSnbVdz8EVxnsr<G)3OD)*zDj?u;TRo(1`TA5RY!6H)Tvl_!UO99jLWj;
z=W+36CLFP3-QtPz6KuR7?;ZCT;oe;Go3MNw7obBGdvg<PJab1U!O-#?!*^ZmIIe~*
zS9h?dYd$t?gP4v^UCZ_EF(B1gtMBA@_yFS5YAA{}8GIp2LrWbL!dF90RlyZPacF;h
zk6<P+q_`+^0)DqA=#5wkLSc=;ySB{ZP_DRo0VvETPFDnYz^tm530S5Tb|#kvq5nB8
zN|Bg%OlBxxC}j*5Lz$tR(P_xgG)-9u?!Eb}@tA!=K&{Cs#|ew^+m0N=vkiyXOv9l=
zENofK#DS&}Y%|@oP1lNSZ`JAlIMIKURd&c#ll74RAbC6*v0R!ApTXi3H!gd8Nr^w^
z;SDutN8i@H=tr6Jjuv;wgX7RXNi80n<Is``^Z49{wxNewb`Cyp5XW>3o9dB{Bhw<-
z3WEp}*NZR<3})M!6A)@WEUEH><&f@|j96Q=d`^;Z3U;<ipp?bnSZ?Y{3&DRT#WV!@
zESiddEO~MZq)13|(4e5YY&N7~wjda5UdWV8^N^)W36q@Fsxd`*Fj!HrLUg#LVYT~Q
zsX6<1b+>M}y6_|{AH0o`nZ&m>BgDRDYS?lN9S4TxVcQOA<oJ=N6ZWvySd|8IAuy%A
z=3ZvG$TQi917YD+nkCt2HWYulm+&}%8D0P%9L(&vEY`0`5&O7O<Lj$_{)Eo!Qm4%}
z2Pf#+BJ{x7=D;{9`pY@)NU1b8U>m@kj}8>agpFdzwpW6P90NrJ0TQ^32QH>Gro261
z)EBBCfEH7rq?_^-E<7LSyLvML5w;!*88I2Ks~Fq}U<jdq`(NMAE!Tf{({1R%FLd8^
zqR`hO97L9bEfW%UYBs|bvo$?1-N17W)Xz=zw|&TN0&22p<qjYY(}v!>xE&}xwBDXR
zD=BzEt?i<eqVscf*_5eeKb2{Isead1nniO9_VBreFMC`i{GF9RS@}i?39sl1-sxK5
zu3Mm=-;g+olI&)+0^fhNFKZt=$>X$yUserr&PdW<a&s_j*P83`T($bHs3%+bT#It(
z9Fd^t=h-x+{eFMVgHPABJ~-AjZ7?(jgFBJ_L-I(Xd(0GBl%$J3UB=sO_-c40Lu*&=
zvU%RR#fj8SL2hw6>c%#8wx)D!5;}r8teYa<txLPn%vB_FUBQ2Z9T?_z%`v$z#<wm5
zxM()-R4L2L=XuOw(U&nx=<X9yZ9zSVL+R}y!z`@UEtes8Zn*7x@J61EMmZZ*JIC)Z
z*Sl2aP}O$5uC<~b*hP!0ETJ8-vEDeNg8D7X8Tepq28U$DD@MvOnOxM%d6YAjzGGb*
zsJr^toC}<tu)}}O=pkRIV5=6u-_tFaW2>J1p<G?;Eo$d%lCuJ)i~9C_V7jjO;kO)x
zpMT&e<cxMkUOVo5pZ2u##bK6izvLF?@4mXzJjb@~)>fz4_Gj5{C)vJ^sFI96u&?EE
za{$_9n|_(4<$Lu?V>TkaE&6f6eKf@M4zjY$#+#3=y9a+*b`fgtEr{V*Ot;;TVIy(~
zwhS}Ee#mSLzA9eeM3zqNM`**p;EXYgDCOB+p-IlgaeBHLpA-pJpw(ra;$WjdFK>xj
z_E&m&4NfGq3ruy~HW9HKPEtxzq-)DY0mg`Z1s6C-sw>PQyn_Jq!ns!{T05YEi_=jw
zP56j3po@PdFw+&ikZC*Kym<S$9<6gUA$h?*1C-sbK<YQb_ioUt_%hA`AF6A{F(m#F
zxhq<&4j^^M^MsMKmEa>Fqt9R1te7kOQTsGl@}&3EK)U<Q<g?~F@L$gBrwB7po|D<<
zgr%eMs{M?Q?W&&!=x3x=*+|+qq3?5<N!GT-yAOYre$N^xe?Nqd4K90w=BHYCu||B0
zO2*U!418Td9*exW7=$;kMdjcYtnW40AKcys{}bh_oHNV7J5fY_Xoc**ObEEiT=r(H
zP%U+W{~GvJozZ2!(qLGd5LBT!S|~Q0>rT}l?kh7t)XmS@?8VRLu<T(vR?qwyX|3rk
zZ@hnlHGhr-T2~c5M!Ke*Xy~-r>JS-&wognWS1-3H9ep~V?_t|pre@hWZ#De!NIm-K
z)4BS!aT)zoUxyxxZg6#9q>*WqJ7o8J_$h-IXVgxKF0^l-0!E0u&w2N`;46oe3yS7u
zNm2bA(pB8WbQQyIILFmCcn?yzD0F1Fmt}w9A6CWvPU7+%Rt5TLr)6P%?`5&Yk{ENm
zq3e+(K6>vA8QKG0b>BU6(hpfLn+ts!Zkw*}J41PU^-X%nNuGV;P(u$~?An$ABquiZ
zA~V8)?pdxC*ak7Qd+dOyIL8FBPeVgjZiw?SWX;S6LC(k*!AITl&6RCR<Vx_A#5sQ|
zCM=AjI9v?ZJlULD0<rNV$z}x_Pm?l+OsR{!fE>h&|D5u~6)IYk=gFn4%mlH(P+Z8_
zWGbvhh{!h;F{8?FLnc8e<|&H=ZT7+&ETzpZMJx`Z(lHtKyfFX}Fj83czZFMW1<0{6
zgXur2Ub6&IAr$eS;NJ**42Z{4NZ)_P6=8e@A~3X&VJTTMW>vuK%@vFbcMt=GvyRmz
zDaSdXI$$(;986Unr@9#k&x4rHZxmRk`n_F9o$W`Sr8_z%nyz8X3JpwHr~?lfqrMl0
zG>RS}9N&qcXl@Z#sZkmWy=Et3w9QF0KfUgM=-n~^y$yTIh`Sn)h2`88WgmZEWA=3-
zYLtAy*F)?lYTt$ciP?l@QD30WE#SD3C0aH+=n&s0iw=K8pr6D#0ddt)6M>FXNE<Gx
z#w(~;4OY7%$ABqX8VV?DY!g;ES7~*l!^UW?=Ob7BCPmmBW>SQA!gum<@p|qY<yM`{
z4?4<?*cS09iLe$h16!fSF!6t=i>)ZqnC7{DM2*8C+BifP{Oh+pO4l5sr>FhDJwt|O
zI9PMBZVehI2MB2kr&4uL^v8h6C>p^c4iav%u7t<|7?pW2Op$=dEi$ixIT96dIs$o{
zw}@aV0AowZ2&af3D1dx2oRjTe-@pA`7*yApp84e$v1A1mM<Q^uO;dkb9h*zeRz)m*
zwByODMq<w=t1Q28vNldsB@?vH0Dk{7H-4=#(p7E=N1x7RGs9+yiiPm=;pBMG7PR_{
zKRWw@sfAZ}4(a^<N#YMs=Z})_I^~eRuku}BQ;lkdfy2nsvE?!w6Q(&hj11j%0?T#n
z`^=5S{hmP7*(bs|QH_6oV~DeQ&IXJ#9#2?aNQASIba#mU{_b@P{46F}6Sw=`m}m7u
z8$i#h++I-6CBt|>U{BuhEkREb5?j+X3x@%uC?{ToJ%cgKh{qT+?1<@yq<||xPchyH
z$a6c$Q@NIYQ@~T?(mBAL2e@<P{&#>ozo|GZHphnzcG|9P>!yFBVa;}3Y}p~hUKBc5
z*NEx*n&;TzfrN7{*ty*ix>u-E91#xy=;SZ5E6gcIVXvntFTD=n6cWHK;Z5Gi0o>fM
z?H#~PF%AcCbM+iKfSZrTkMow&+(Y)<q><}|jul|ni5zVCo`yY*Mwn{UG7aW>8nN#&
zu*nnA?gVN|hzozDE)pk<uFStd5zoOag}Ew?hLGEqAe_8QOJb_y3an%cSmO|lSPC#(
zeIb}8U&KS@wKyFO8y=fD;4zQItPpuBUtJ6l&Bi1ac;`TXn&bE@PtGCPG^=i%h%w?B
z_4w;GxnA3uD5E%KxSXa;6s$T^qnF^+L=t$RI%@}y=jMOeGbVXPrz-u2$dbXc63j(|
zF9SEL1Pv?kO~8(Y7~39o@ii8K&6)sn8LauO5KP{=?Ep-so4T)S5!MXT#FlFjO#HyZ
ze&lMz@(s%g4_=!q0L<ok{SGdhun_;o9ZAp8c9@}vGw-P4tZ~k)daxs`$hWLJiYit<
ztitPYrTc#?@BhlOZ9mt8!{x!@^4>aJ^4;yB1CWjpgrSRrfD&vGlVV>FBTSj@MFFLT
z>pn&Xp)CN&t&YIG;*b0+c>wSuyvMHSBOil(p1DwX9rVZriCZF%(8d9H+_a1jUX^?t
z4#4B;IdT9V55Qw5A?_jLj)w2sk!=T9cOxHLwikb3&oMR3G}G0nZrO%G4!OPem)pBF
zyEbL^7N5v6HN&?^ghR)Ruw@x8_5$0+)P{tx)bpujeE0O=%Wte2fR)eO3_N#}-fOTK
zy;soY+bSP3dd^ZFF8TiL^Ffso8Y##bW86vrU6P>TS&4WmVE`~I(6r9<e1e{5;{dX>
z0%m{AT|-gMib<9hTsF?*P;zF*Ri<N*=qeDq%n*aA1w?sElY0eOd4+)X9e|`7N9Le0
zNg+LM4DSZ=^!hx;YbIxyrIfSvlH`xLh=VwZ%h`qjpQuPnm4xsE3D#|5J&`6YmftBZ
ze*JSwk`GzOMQ7e-(G^(;siaB3<?KA>Ar60gS~A_Y@y;9gKR4|N5p`_CGDB?ZR){T6
zH?a@7{G!0uJi~CPX01v;wEGG*Zo5Pqs`c+#$$~8V@>kdZH!0XXzD=swTt?%KAr8G5
z*2tz9rypq(dn(NwFwxF0doq>1rv3B;1$_U-VU{FhQm`}ii@I|Lxj~);B>W<h5<q{+
zEI<2;rkSSWJh|+N%=Rk7eMzgQK#(*hNjyr=AcVZ#Ad0fI#1O81W@wYI^6wi4+tgW*
zCG?4S&dpU^vL~{`KV9~IuJ+qkY6E<yHo!Mx1LXZUEve|xsp{D&AA^SBuiCIl0{b8s
zt<rE-?Ug6T$LIr~3XQ#1q(=jLTakYy!sWe~Fu+aZmI+sQTO^zbQ(KsjqJXdmNvINr
z)0~8})=vEX?Q^hYaqTG$*~T>Xyjz^h7(qZfv=t^<!BdVG?3(fMAtRuzEzvBS=IH(F
zXCj)QIu;=4pi!D5hk(XRCpRRgd&^HR_Chs)Se;QjWvY*SBQ%*|VUuYQwjzHk#2#Zl
zHd*Lso@qpGuv%EU`$lVFuU?qnYt7Zt6xu0OJ<b`BgwtBEP@e_peF}8Lk_7(G+sd;^
zmaCW!VQ;QVuSh{E6kJYLUX_f~DxhbNR#Y*m#7ouB+Rl<1>S5%#zJndj)v-klhJ(lm
zacDD-8pQXB{uo2|(MxW~=K_CdJ+vGvz9QEQkrDyPS&6cg&Cghpu)OSK8x?U~y!tb!
z1g1#U48Jf>m3<++1wi;~GIBTK!=5SMi4RvfBPG<3c%~rsUeQ7wcm|EAx!UC3RtV{P
zE(-JBy`pQZuIfG1`klvTNk00l43B^1?j0o@AjcfBRh53{YiS-pmJfd~R=~mP_JD8o
zX;$_>KrS<&z|YHqs|A<6=g&V^6zY-~M%EL|K!TsWZfc$lhLg>x(djRK$g0)Wcs1K@
z-4HzW&{meBe*rn+q^fd`{w0T__@q^%^LP%$izx%Nq%v2}T{YTu!_@}-S=?_Mv0IO8
z*smL1SZc$r>vXeYSLJ^@+OnJF=Lm#0Qu<VN7ukFoul4b0)k$^qsmbp%KYoi;Kkf0@
zH^a|e<?10hn7F`nyty(jw<YaD!Sa|DuSvj?M$NtQFNjAdReaTS=uF1IMSUJ`olIHh
z)KpzuRKK&wsk<>T*9IA;n*m??f*EEQg_K}j(}8k`YM6wsjy-?kIeKW>TIA}FQG$71
z`C`@*%-OuGa$TUe<(1g<;T(UKY?MT{JJ&V{5W}WG!jFiDB{!@W8>-R1_36(qixTkZ
z#^ek8T(Gj=7~PcvBwyn<Qt-)9&5d)Udev%OIOlC4a;|A*o!D7*?0F+uPZag%`w1Cx
z+Orx`>|FN5yjFkTYEhn9;*qDG1Xa49!RGxvgD3Gf@!m4F-Ty0Kq{=tc#rh}7NeE$v
zZfjT%Gz(j1U}4|YO>B7)HN(&`EH}ExaL6<8#2(etmP?E1Lx!Gns0%1GrzI0R2*4t7
zAyJXqKb$)N%VuCE4grsl^@cTSwh0|U{Rzw4n(P4BLXv-&OR)+=8-n-JESsVb{FN9(
zSJ}-1QV5Pt>4+7=O$s`7g5I%+<qZ7f0j4WSK4NfU{RVl~9Bqi+Fd9$CNH?@0dY#=M
z!_tQ6RVth<1b%6GntHLl<1ElgTxM7d)|US2h8c#T6XHONG;C>ZfIX(^n0kTZhn7ZM
z>oL0Qi4T8Wr7dmYwmf!$&&X;fLb|j;Js*|K^8WR+&wr3S23#8sKT1j>fd2k_+1i;n
zmxW*NhwL59#%p#Kr{w^BROi!W52hL%9*#DwFN$dgmtp4B*I#Eha1mx<eX%ti;kM=R
z6kVUVY$JRI(JRGe^XA3dYQ5FV>^dd_LqcJe^V@%Ll**TF9etIG(KxG@$xm>7l^`VU
ztrmtB1iww<jwrl9%d2iR``D5!n;mJQRB?*>o#l<;8lj@<-KN)BF2S~?*oGViH#l}M
zcdbD}d?D=Gx%wy)Ig|6@udL*GD~qx=u|U2?RtNAbn<;8ayyjKk(5x{XHqVBQ67}<z
z#b$qq-j}4D7DJ@g)DS&~;b&BEHS^<0{?6rQ5%s<B;!7aSxf1+~FQ4aw`Pyrx^d|_N
zo}ynxMog4uDV|60Nr6(vs6cw)-{M#{l?5>b!oyX(@0_UG+Fq&?n{P=B&X3O&B-kTy
zL>;vUtudO*)rPr^E=#LVF(=}xLHc;~?0SDB<b|>+FAO+9MXpEvrTraL`xzIJo12W3
zm51mT4&HFYPh~w^{_a1w$E5mz5dT7E5-@BIgAQ30+b>q-1cVx#4_n=TG+<dBXYp;o
zvaip+#!$BRg3LN4oSw-Fo$$2Yih0=EQ*^cP=sH6^H7`27LdX{!R};BMMDGlx(<FcS
z)>v6vsw@%$iE`Qo=#EmQ8M#!CbQgQnh_FTU02AM3Sa*Hb^mHR6&iBxKR=cR&PORL@
zU1e9Nm2F&C#80=Z_Z`*3?MG;diYT_vT0?A~+^GK{pE4v;!(TIi{9f|lVs&NEa>J9#
zV;u@S&uqx`ADMG{iS()*J-8(U%{_mb<;8UV@h9k2DTAp=QGowl9coj#iGb8vIR{GD
z6cLJkO_G?37Zp*@n|wC5VF8{8Hca!x>;~u0E%Q0|myX)wu3pZ|o#gg7EYd~Rqk*mg
z|CM1m*oth1Js^~f9NnXS=tiy^c6e%+XWqR<*Phv{)}BgiJiokJ*vy3GAxnQtfM*t*
zRGQu<X%y$<CF_c>pe%}5t^&n!@QNy?Id5>4>lLgiNMfG|pIC*+#A#yz&N;?bV9i}z
zW90<%Z1)diahVqJEE+`E(R>1sQG`jvA{^<qZ?M23z7agw#Z~JZ&nh46>jJ$IuGeth
zP4lJeDo&DVQNlD>>A<!0%;JAXnsQzYNs`ReVI|zXlNn!R)e&@EIc$qlC|mAC2}=yR
z5sxP%<e{ex2TAUbUVE=ge3VCPg0CC;U;p?2^Z)(7{{tQWAK4V$#7QDNkID??j626e
z!&87Zk{Ng`iqKcV)eNL2v*xpe1AEOqU2=#vM_E21snj!0HUXwTWL1B|OW^AQi|@eE
zSJ>Ac#v&(rM19?KuuF6UTh!BVU@{#u!_{E@N3OY^i1`~Wa`Rg)@?BBmCD`#V(>S4s
zpd<!2yl4fO3c<cW@{Mz8U4W&sfIqH9Ru72ky+l;A6sYE}B>jBO!WveEqX1A<HBE+y
zrNxxfHpS&p(VR+ckhOo?wAdM1y_2|Uy_Tk_T3=-bV}$zbWOOn_FWz6gsg%gMfm#lq
z9toB8sLP^<zVt=18Ilap>v$ZOmC=%(MpHPf8(L?}KD2>?XHHr_M{yigmWsFlIH=z)
zGXRf<GLOgo%N_!I!~AUy4qx^fHlg3M61`_7H%=&EwN*)69n61$oua!CI@Ni5?Cg+m
zo8*7{MN0RAm)_F7;VvKo9sC{cxGWP!#17oh#<muQ*b2-5dqF_3PJA=8-5`pr)!~GX
zT$WjC5uV@0(W@5+<M6>a+%gU?6?%V=VYu=wRL+LqN{DF)CmC38mYQ}OvWW-<uXNv(
zj5$H4Ao5%)8a01kWvPVJkTsuY<H;1_$N`d5gq?^ZQDmH@BZV%2z|{IgyV{x;?7RR5
zDlD)i<iydO^dg#TmcQ)P=H3qwzb1_d;-?ap+E(sHeE>M6W9G7Eenz!-%wji>k*;Yc
z8ai#(smkY!Bz+LU_|pg5N<rO#sz)FN!EVug@Jh0!?YMtQ8t^h^2^R+Dr^ps*9(hC0
zMx&ew)&^k;Ot)!*2U6_v7PZvC2O{n)dh@E|jPj~=l=xQFuNW!EWO7mG$Q<R2rSI5w
z&D8#Mf6cjM_HkqQ$F`|4LFNmybk`C7E*)(0OzqfFmB(|N(cdYN=dx6uTRfBt_g~}j
zbo??G(eZyT;!#{eCyef`bfTr&@*|XF^nraX)s9fx%XZllUS?_eUJcXNudl&DxVLp*
zL>I)i5@cnWjl1TJy~8H2?pyqwRUcVM4AUkAn;s$9awx^bc6{twlzNe821cYE)W`MA
zr$9GfJ8mQppH39FJorakH4N3<P*ienU(Sc5C=`Fd-XhFV*KM!lqQ!h9_8D%hIz4?x
zf$jwGQ^7gUO-r@)sX%eWBLZ@k@Q#3SN=WWxGD)OtdMa#GqQ#f&hUMsLIwq-bxNml)
z&->18*U&^|Ayl>@SP}!3GavyA9ffDG0*$!KR}R|G+ey)|)N$sAhP^B<P%#ZdRulqX
zydr-o<t(k^ENAE@%fFm-cjyjg+?BIwd1!rxgE`{yIC#TOJuMb25P~CzD@6;_J(!`J
zD}{H%A|Bs5PI9?szPnbw8sTr=U2Alxx3)Q-?Uvpw*aEmxuM%vuV+HwBe^If5D~_Dg
zQ?y~rQjBlSxlv|GcEj@in~ZWx!!NS|gfV}9hTW`x*^}E>Z+O`w{{Z&{{#(@|{}Xmt
zaB1X!jH_w<mF9C-s7n8=ZV6{q$(A4(MjDzs{9N`bUx|kKLEQNbHqx5SV=+4cAGW0i
z5;2~4(gg7sjRxX`yZ_b#Vg;e@Xc5)};$X{lee5|Q#VoQc%P=CH8LP<jTF=~6<kNq*
zA@Hi0BsY+Wwq3e3&m^Hmu@+E@EgHC(*pY@cYUyF%xWr=XUAor1?aKFj^aPX(q-&e_
zU%wL%<!~>Iu$xFLbuWrM-_<a)A;Vc{>)6*lf(dbalUO#@y;U&+2hz&w=RjJy7t+dC
zEjHf&T2od&<I;U+%F1_a%xK)EnXG@(xB+1$*kni!Ji?W7*njrwonZEmYAm7S7`&l{
zhT7zztf+(m-4~?4Z64ulT87z}6_u~%I+n_JBB9%}SMSh7kV|55ldA;aB^u16ODAZE
zH&-*ziu3Fmhz(2fg`p&a&}GpLkOK?WlvHKtZpn345^)bvnxP`wGkGP6^WA^=Ds83(
zniG21bzKWvEU>T_xDmEpBQRalpv<%GGeJW&#oE&wzE?HD#q5*Qd>N6#`WT!woR(WW
zUe0x(e*pDLC7`JZD{IJuSC2&M#|kCt2P`Dhg8R=+@;J*;UN6MK$q!5cRn1Vjw7Rok
z-a3Q8EniwJ5zUTti?R?i*9m{IrJEu4Orl{^Cz?$|=Ge@A+$o)!P$jGjzMuYDd)mK+
z&=ekG3VBBbmbr3*%S|2T_Y_WvDy{`qAcr|FvZ7R(jTW;eiFFK`Cp!P{O~o5EPNuog
z@PA_fN)%-tlCu9hD*;1%!-|58*ei;L=m;MT(K{B#lbEHYppv9CXGMQSKDiv*k%<BY
zuJdnf*1_v>F2~?Jql<XEcdVEu<z9oUchdDAL`e21CzGo!L$c+f+&r#OHk&-(&VLPT
z<kNBb1~QSs+em1$BdX9$aHQ|Yr>_V8*(|^1Yw+2=%S&`bV;V-~Ex;6INOrq|Qaf0Y
zl?nKLJW9F0Pg+)1;I4mY-0cm?`^s&!vB*EaF%LquKlbi$w)R@=X~dj;r{tG=k$VU;
zi0;`MwgZ=8%a2?fkkG=^^E}NqNnrWG<4_H%Ke-I^ECMT~U^P@?NLQ_4Dec=*>NZa+
zuT=0cBm(bGJZ&&U{=#Kn6PmN{FWm75BKLxz(HW|^W7?va<3@iA;h;&?+msm>;iMfI
zf-4Kir^7jU2u}qe@H!|s&eFK#>INSq6^`7mn88X$#%Ro7b1oXXbgk_tN~wm+@Z1ZT
z=RvAu;{9S}$DL&Gy<?J8IyyiF)z_@7cFHV#f?h?^<}QmD+&qn<ECg#`I;Y^nUpFhd
z!gc<FEB#U`<pzH$4p#`dHH0w$<Iq!ru5uQgA6=E@q&Pc0h0yQxq%tF&gxUC%rFdGL
zDuWWvxSbW7j(y7YB?zx<sBwScVdkT0&T#d<&HG0`^BP0|6d+Uo{oU&!(B(^^T1?sy
z!f;t$oS>(tgd;b1LOWE*4(7vpzjQ?33mu3046}$v*wTNZ5C>kM;eeSobtCG##D9c3
zVq>c~Loax`db#PHPFx%I8!|)vdN&$u-i?(1yu1ruH4C}xYkzUIKa1rnJgnt4u*9C8
zs&*7<N>yKKhHr||TICR29x!-5EY}WIYqiSvGR|x571)4Vx!^$q6ptJ#2aASlgt!7~
zQX#zDVIY4R>%SU`<r;E5EFE>^)6>Sj+IS9Ptv0{uP&MJ?)uY8nqn;AWDcV{im8G(3
z3kY}tGxCj?j0@Co-~#}6;2q}sCa<VLZ#iDH8vXekani}=iwZ8dHv3z%QrnjRem)*u
zcv_=IeeSm^f*7&1vfrt)zoN3=sj|OVnQMUjt2ciL>trE`eJl>FP6ueOPzP!GubYn}
zOT#FS>9$E4vb_9dw(q<Qz~=RDj2{s5-@3aaOO}^!r3F_1Zh06w%)u>2tQ&-K>(SbF
ztTsDsd}HN)m)G2q@vz##Iu2pAU3M++ZCAe9{rAPW2w?7OHUg|+y^F$~!by~V2HV<w
zk^6r&&GgJj$Bt#0*rK+E1Kp<BaF|6xT@MV~ejFG{yMQoI02LZbX%~*Ql@`=j?^f9N
zhe+lli2osI*MMN3OUy4gLmH#U$G``1eEd9NBt1TEa2b|7Ipxyi!c8Ed@z{nPYMz@-
z#;S61HVB_0pqxmb=zZH=9e0OyrAF+Y>C}Hz4@nRO3_F^oVJmPL_Csdl$nu!)yC#i7
z{~oWc_JUFP(g*T|rDxkLyqbEg&pnCPcq`moF%j6&0JBm=IG#z;Z62DlKc_J$&B|X#
zI>mq#Pf~%00W~QBWH8Io4d_AaD+{OPJeOOWyRAhZ%0WAJ%{Y|R@T!sQZ#)8}mFs^S
zmf$2Szy-AV0u9A)-wV<-ckzR0(Wc$AWobmdXX{pgHQhC^6<Q1j#IUhXY-Z`E7uv4&
z7@@A!Cl&X4AhR=x=&0ifT^A>apG}Qul=qMhQ9na37@dmfE4CJcfwsp2Vd3jESJ;Yz
zhhR}Rr0HfhinUPDa<J%py+ehlw$^_aqUpfE0h~pcXemBaH?M+#I#v{UMflU7%n!5y
z1D!+6t30@`Sx(~+=(Gxs`h(&9SJ;`-kX2lC^6x)X*^0Mgp?Gr`e@)A{<l4W?n(>Cj
ziR`=#og#7aTwwE!c&Q4TVqeRga5#|8fF>jCKckd~%aVl0_P0nlxXmLjz}SC5P!ska
zBJdKE8!lZK#R8E$C$lFa2Jj{>7`n;HWTBie1;HpK41<;`>Mis-74@LuHWNj~;l<zU
zWT79N%!{}AIbrFjyjorG{Jg<rfzX76Uq17i3mD{JSg+pGQzQa+>i1v?8}ooKs4V9|
z-CF&G6+M~XA5KsCSaVw+Z;^i#7(Ph^9--`OT-1wguq+i!I)3#6oi~SY@d2`Enej-<
z>zKlcqIQH=FRBNeo~o%X=eU5{Uz4Jg6Imh7+zY6Pi}!pP%M|hA)~mE+NfM9R^ILxD
zCfJwM&GH#5g0m_hTZ~`h*@HG#C|2XMSFeFS@>~x0^4=|0dzF@)9i@L+Yi-BnfB>|o
zT9<RRHT{~M8gTNI#TRRq`KWz5sb7y1&n+UN>fs+=)t6R2`&FtQeAyclh_K71h1fep
zkRAZ`=?wAZ7^h1<S|i-HZlInaZ%F<{q*sTESg0|e3Pshdi5oRfi)k?tzjEe1v4=9b
z0YcG9&WaX+kz%Q7orHfc69O5kn`0A_g0<2T&Ce>ahc-vyvR8Kph9k?De%Xx`7d{cB
zeyrO1@JgJ5tp?_5aNoK4ixCj(H!n7K>wo9|`K^7LAMN}|0GRv<L>-c8!r2vdZgduV
zmRjqL15(*zR9#pQun6O{lq;{gwRp<No`^ZvIJ5Xmw@#><F>!y{PnBZ1*^MF62Sa$@
z*2~0E-B&)p;sV}nUF&+I<BjZ*#hiq74$GmxIN4x1E@@r7`}^s*T8PDT+!t4cqbFPq
zW@=-umOcDESdcEvGxV=uf?6WA@#xx0*x(`a(kLN(WW`}KFT1Tyk-Z?3RJlqQ&h0vB
zDfGH!{fg!IskeWx(`3&L>`=_+`C+WU6ftCt2C9*T8PIxWOVxZUBxcF=sk#IE+Z?nb
zHa#IcFJ=+F$oVkGS*jdt;XBUtZqQD1w8rOlSr=C&KU(@ak1r9@T|&L?lh2***|rge
z0j3_cuw{o9CT196%{2_oq>*nL_T!E<5J*-mJi278R!4svYdvU1WzZR*RSmuok#B%M
zVPgQo4~Zt&T1js<-v~UAE#&cNv^jcgs|3rtg%;eCbjtex0K4Q<zV-gJdC2C2p!c$)
zX=V^Q%nY$+Q-&?Wq1e}{hXczarW06<xZfkd@Q?>>&ER~GtTC`>;>zz$nLA+Lfn9f_
ziBN`#EpdO9u5!n4`$o<d?GF={LpTW-9)xwE@+?#i&Z;{kXZ7Ytp?5Gu&6v#N<M%)T
z^MWO;WXH!tbbS09$!Y7tn+({w$_)MMH2s2JW(j5a+?`ixkbQ+~aPAx*|7}Wg0y`T+
z?^pss#BfhwbUg7v(<;(r`cifekzGw5fo=E6y{3PIYHww&!GuhS;skvl>0dP8(L>^6
zN^B2XerREz=ppu8Gqi2T4;bx4g7OF{(;MQNJcc2vljkcGKEUHK*URdaTV4@x*oV|e
zQVfH+h2|FOuv(lddKA)$bMZ|Ig0o2l(~oij9;2<zqH>xY$0?8H;5vLr5|RrBEg{Xd
zK!ty{%W3U*J0@Q{H_;T}8cmQ9z+NDx<uS-AtlvGpRmf?;aRt&I44JsGDC2#+>^1hR
z%igDR#Xl{*qM?nWMv<ez5GpnHwN;fGMP#LFhx<?1`y#&gt*X7O?0hpZY?K=t;H6~M
z#$K9>y>wOe#ga!{60SbgA~XP#N`Al`l<a>-Sq`T|aXGhSVdx&eDyECNS^z)<zpln~
z`eZcX%y!i?L|JA3YIJMaCzi;|!mXjU;`7!O+P74N)t|PmxuVQM6OGThq_VoJs;&B@
zb=9RMhMGc#vb=16*iMMdwz$kAp)Bu;^6X!*=!E3laj}9LjChQMn3y!cmIFaTVPJn@
zlLSHF+X1l%y$jrGxAy34OWNB|v9TZ|x<zg5+ZM$ZGi^)^!^UBtMIJF3@$>@~TgAN1
zzs~C9J!?qF7Ab@t75kb-G~4toiX%@qv1Mr<<^+IVWO+JarWI<drrCjgt@=5zukD3>
z?L#&}Z<I+{#_2vM;|YmJz)2;Iu1tRrB6p!-`ztKvhOM3pRa0;y5*inW62kfkq%6TF
z`i5LX7^ZN20S!xbMLZw9dI5Rh<54Qmk(%sT5j}IubWImM<aj-_m4RrM-2fO<Jyw`O
zc^XLRu)@XkVNKm!xw92RREP)AY)oPx%98E|<M=B_Q3^7i0DJK?0O`0mLBD?qSMMvv
zqfmJ=-l9}Ve?emt9&^PNnTS-}S(ei{<)FD3jRM%p!C|(%A}LZa;){MZ+^HZgvP7op
zJ>En+cM)G_kOY%=rOYPvh*ZY^GDBCOBP+)8>QSvA^B~E>FVLytihyN9j!~ROIVs9~
z8kW<X?U`$?o-|z@SEb}*5}$urp@a3nj<6Ma6vHly{m3PHV1y>M9;0oGr^+bGRV%eI
z+;VP+rN`H$T$ZmW!mS0?Sj?!eX3ns+n*RRoH42kB{IYgs4d<8DKxP$y>d$#~@DmWf
zaH>T01eo1_fA?CrI`GH{R=vtmQBUXo-}8hwBykhaguyp9CJQcy;@N)yoQMbhGE>{q
zIcm4EJpOkMpOJ2v?Q#4WX-(?*MIY04d9I(&7n%oPRNopguZv%>0)_s}<+UoB`|o-3
zDvh!x2=w<nd7U-WhW+i`^NcbD{@j%}|649^@nCB4?h9Xa#aPV6^tXEbBF-h*C4YH9
z)2AuD><OZfBF#7--K>8VFkcg3wBEVd_S<~)8o~`OfW3Z({)=!GySR#rE566Z<Ehx<
zh5Lz2Q~|zA9It3Qw%j%repgPp#)!+ww&03ZJ+$#zmUm>K>U+LbybwD@U0YlR$U@v&
zQjzZ?^VP@X3;SHK#Ri7RUTmZBIp2|+X7$FMA+oiVkC(ex>&buO+R_K|Sk(87Em99G
z6a{BiRk8*5HVZDy^fl<;+#bi*+p@}Xy0teMiHubjhe%;zOP^KmIh!8y@#t^w5NtI(
z_#eEqs)yB!9iFEARR8u4g?wj{UaGCu#AkaGe+5rH?(Ygv-DgsS{eqRBr)iv}{bG{D
zWnU~L>DJwz2+)5r{2MfWQ7-ZyKMe-*nILBw8W&p|E|WE$`tfL9);;=k-X4k}`go)&
zAALHn-}mEDy{3*no!5WBt@^Ay`gGp-Bp;8&tVeP^9DO=(tq)#89KVYN7nc(hmu_-z
z;;%=a&a2TKHb2{W<M-wh<kG0ymKUH5Uk3=L_tB^GYEgf{9hmm&hFSu9_H`>oQnB9s
z^^4=W*|*_nh~h-NU`Ld>CRXemF5eY7onw1ci=#8p+@yRox2yDa2TI0Coysu)7_B=E
zqku-A^Vj77sr+UFiR+3QchA+gBeUfW+?KoMNW4{s#Fey`otQng$d0(jB!N4wiTYeP
ztcu%xfWv>PcsQ$~mXGeis>m6ALGmw$<3fzgqdzY8K`ix+;Mq=Mr}B0)i0SK0#~L#n
zY%z^t;!zWbY|PNrO+$0<E7`_VJ`RYBDCd_wX>`%FpPoq54Gyy;A(MigsbAVgojPSW
zl+5z8zi66iI?j{Jo-n>BBTPxFr+^NENfM9JGthst_hcn{12%QORWiD0B&wtf^lLgI
zBOc1!*<SRHq+gbqi|Xmrgm>HU@idP}s0>C;Lz3|8<1BUD`xbf}WWruUb9RGR)lme|
zZ#hjQ4Np#PDx=Uf92e{aeYj#GuWV6bajnriaNV7P-j&SIpOrTdMFEQ-E39%v7@|V(
ziqwCG7U&{{=SdhFTFRo5rKlK_B!P(e5-@tO!tl2`LC<*d%YU#u;{zdq7m*@#%m{R+
zF;>}xK~D%TyB-cdLBGf}E@Bv=gQ72B=1SNoE@SW)tfBSBC(BY8@eBpiIH3^RPU9d>
z;!=ii6V9^)eQ1*%K*(j9m55xEIN?hLz|emoc-xQ?Itsl3>jQtuEUgKclUd{GyhnU6
zZvdp>UldGcEgKpqFy^k<bw$x|2dmjj#n&wQRDD4(IZg|1drXq-22UrbPi{yqIGspJ
zhZ5g~ArU=?nLa}SaMDa5iRKVZNKxEmIWTAxtQ2T5H^4#b3r09Fw{b}LJJ{RCSy6xT
zF=BK}iyQNqr3aRaHOsWHWiT6ifo5S#cQq1djvjdWBeb}^S+mLIB!zKavDZOX_uaR+
z;oKfKx4#_>YX`&H!LW8PtQ`z%-@vdY?ciOFYL%5;iguNu_+UPp)x)xr{cN>0Y<tVv
z!G3nIpFLFj*#Q+j7|{+!w1Z*!U|4@X7?w9476-%f=AVOM`7XL!+&TMM6K>tcf~H3i
z^CI8Hgt|VqT<T-r_B~9gYcghAA@$Y=cCLAiPdfy;g;}cDf&YjLX$ja6vo}#5bHB?W
z`9OlT(Rg7to{&72mbSR~_0K6uK4jl7YOzLcA64vP;6(<}Lkru~Vb~&WfPH@msL_}n
z8N>{%&|Wp!mQJ(fS!H^0@j8Qruuebf0r9~HHlBcq<Q4B7P`<_~OK=q*rozKsX1NFs
zGab81l2H)IvB?>3R(OCY6TwBEU9%M2F;{=U9uPKjCwp$!{s$zHm;E{6f8nZoMV3sV
z1Gq}c$-5=Gy6Q`+_W!6Y5$1o1aiXs*FZ(X~!%W||4I1HqI2yLKFv6Y|IoNd~ml!OF
zY&YE0(!!IM6<_k17cR|RX#Lsvqx!X;mi6uez4%z|8%6)<1)C(<OnvZw&+;!pmVG%I
ze3IQ%jZ~jc*@=49Y&m&5VLA7nCCMu}F-{?VqL`476{nKCJTFe=h^T+**O)#%GKm`l
zWoU+pH4AGxo(Q{Sqo~?aK89He(HhOysUCYY7#^M0U3@Ro+gANM8g8nM=}mx-hSN0u
zbIRTe=Gdby6XIwv7<_8<H<6(~3u9kB4yz(Zt%{UQfG6s0+Qu$=A9Ge@(>!FaX#c2w
z$9M87WT=IY3P!BrXo!D~=D#kc#BdFlxwaA5)bq^H&`i&zQQ(_VsM&g}8}L9L0019H
zJ>wPaFYm<qxo`xQ+oj_@7^0&!pG)m1VlhKI*CdbOyf6AkpViLriXOqxtDe`}WN(sZ
z6PA}Tn>$N-loeqfPt^CR0%O%!ouS+9ial`lR}+4I8|?i{5ng|>F@Yzmyu;$k$(W?l
z4k@-lo_|=}D^3kf_r>yPd}{TO6Y!+@OM6%9B_th9+uNWqZ-`y8Vd*Ct{5MxF9#68I
z3!!tHdc7y854ddO@2L%;wTo0W7Pix-6`6Oaw{9bBcU4W&Wu3i|pLl5>#XENG;o_dC
z3ZJT{6#tu{84iEeoTZyub8MDQ)VgE*VDci%rM4Yl(;^PGscvH8`4KjCJJ5+itjJ!<
zbXjel`#I}3IRi95-S1h+U?5g|0PysQYk=C7GT>&1v~FGtl@l6xhuzW*4ZO`#gr1gp
z)yR_DP+$i)G;gUJnsPm>8%LXC{v}DbAXMZG-{N!2-f@3lv~?Zj<mBz1F6+nBcsxQ^
zf@u7*XK9x`ROI3LWwr0c;}M?Z8O7naz<F5<c{t3*C*%tm6JU8fNm+Rsj*C+=iBHM+
zG#--?gOuqnNJ&oL{i?s2ngM_AWm$DzIMUT_bn@%+U-*q3zJcz*H&F9}zbhxwQ|ld-
zazC!KWs!drv9BV2D~r%ob_4ET73Cfu{Sg6f0{IC9>%+z`cmiHnuS!I~ovJ{yY}#&j
z^Aza6dGU52+4)GpDA-wN*%WetjYt|7B62xpj28T1+_$fK(J9ac^2(f44cxG}cOgHW
zA*7ZOa3SM2pAvMHv#9ai6Grm%r25+YoMS1Tf)sxvdW*l({8YttVc9$uXCW3(0cXp_
zxBTB<ynA{|e&*5X;0RO~c`tPe^gK&b7M59lg8q%MNzGCyo&L7zFF&VGmAV2VOB9bl
zgMkKd&bS*ML?i$FIvb&ia|~5d5brE}8d9JnOGohkl!ahi6?xT1tgI&o&v3}66a;57
z3jTkBaYl!0KH*WJKB8C|3+v)C{TYFK=>;cc13yCsu6)O>?+t8x1eIAyc&0bqf=^wX
zKn^4Bn3yE|0{6_k1}r0CLq01*po<LQefZesz?hKAsiJZ?!Hvt_$;ruO4{@oO(|d^I
zk0Qq;C*dFgN+8>eB<0|n5CW2olVkA?mnnb782%?->iGE0G$~_Tf<9WJQ#9s(RznYO
zS+E2Q<G{?2<!B6ksI}y(CdBdazpHD<$4J;C#d2deV&)K-8T<`-Ru`46h?h7)FS8u+
z0;((hH}BtH3{VlWl;m+%3{jQ_8BqF(z%^)|my`~q$H&iLo}t(9%2(MG$Y)W%ykdWG
z-t2C91sv;>2_xX|C`eTJ`(-?8n7d%Ys4T7;F*34uwHSJQtlFtcf`mj8@lKMp7uM(y
zec?+fL;v0WU;o$t)U{^6fbW8j#BIPN*rO3f#v1%c(YFPbO#%-SJ=Fhy_TFqcZX`_?
zd=;-K%MybXE@EGl$vh@0Q(3ao!Xtk%tHw%9lQ|rYAc_be3P6yI?vrNy2Iu1R-CWGf
zTg>%5O25F&BaHp-SR)V-KrG@0wq=({`0l^E|LgZ-O?4G)>8gtrTQW4s@ib~{`v#4&
zcV$BAPLoAgY#Z;%QYE<2-u>_G(g!j{wLDwFressB$&!O@l}Xr;7;y|)mxzC<Z`8Q%
zFrnJEw+;%<w?f;f3r;>|Sq9qq6b$_2mmqRT(6Ts;qZ10eIHPbI{|)r6Exi`nAriYY
zA(_92R#iiSpKpnXT<c%fw7VUErYd(k0L!@J6_8EEy4w*bx_!r+U`W~>uYs&cwsB9k
z;qHc@%a(S>LoiL#Xg!2YMVfytG_}sTxb~X!cpL0XS)Uspn-Wi>)myX0ZM1O=xwWuk
z?`_w9WB*rd-kNPWTqsRuVm5S7@ic;&W_wuE4H*-c>e!WZ#UvUfp1OvE-81i0!PVbb
zCm;?34rg!<2+mpRip?kyIoGA^o$Kn%MuC-A7$I_lMHxr_rN!9<)9-&zBI)7ag~*<_
zBVmGO5mZ#%2=wLO(S<lF7lRk*VjyQ3^7z7wKmEj0FC5A4P<#@MA*9k1ONM?Qp@mk=
z<yQXA*cCKmLNg6jRB5@+`zTB=p^_@CsAV_Q0!a6i#Zb@A>eXyW_x{Ej$lLpSto0(u
zu~w#j5G1=uy`^l2Fj{|Uz%BukB}HbYs$xxXG^`o2hb_;bSk{=qOhZ>K+ugV9EAOm<
zuiSU<{P3!k&|54q=#kcz4E*qFPm;0fDu!!oHg+6hVa+lqwuxtA#j$k9)u~0C&9^gU
zLBIvQ7T!C>1kQPQbB!We)q9s;>p$NzI)l`jC`-${Ii1<eDSLmFHy6)01iBrxe6w3E
z=%L?iqI<Tk878(gP#C$EgDu^n*tBF@Rbf1ubzgUthx1^-rG{wgZhNX6W=~r!=b`u1
zF{rJ&%)+wa+E}Bugl*e)u%()|s=G`#w9PuKyWLX`YT9i_)x+#)tHnI@j@nF;3}(q#
z^C0i4<k;AD6$yW<rlh;BL1mM;_k2g+PNpnQqEMLD{)Arr{JP^UtRH5BP2H23VtJU^
zI>DMHOPF|?gbhbC9aX0;(Tsy{u<I#QR~-#I26M3{>oT@=&%uuBNtR=2wqt4ce1ktv
z$)wwkYKPg-R%?0a4fR|_k_>8N)pm5Osf1!j(p{{Xs$_pNrYJ6R?&*e}GcrlgpU`V?
z^Kc>|fpk2p2in?Jt9t0IWlWMixGSjcnZUPc*ix8<b&be|W@@rSlzY0h;5SloOz7w{
zq-8jZd;tFt+YUY%A4B$2>|e8Cw@tSXv*)dr``{0->#34tm{?T|18Wwsuwye7yM}J-
ziey`^X54?%J%>QuKeYrftZ(Rn9^6)Id2k+CbC^V^id9duu%^KvG{?Y>W-!^LrYzC>
z%27cso?jEtiu?)vd<z~K+g#Dcf!O6X>w54TT6R@UvSn;KD#aR8TudZY!Ir};h1iy@
z%IZDmrV1xT^zoX-F}Txp+h6lQw{e@LJ-E_BW`=)a@LXt?jx}OKmLAW=j4{=ql13!=
zz6!YYJmY^tWoFQh9M*x9QmvNu(EBS{R8xuOVNaJ75Xn?*JC=)8&u}EiP#nd(ub1;1
zFrA<eY)nAkc=YDO5K<RR`~;M|9gnbem@RI#x`*CkL$zF6l|AgKvW+!c*05tLF1B35
zVzz&*QPb7#^%kE+i7&SJY=<qDrNiuTtK~g7kEPg(<S>S*st{0Jx!8791v`?YxsKwg
zgx*)(avsfsitw%ky=Gt+Mn|7Nz8)4)10A>fP)f=+E4_BR_Z!@uTkyE~35<7Z&T>X9
zI<<-H8V;rkFpjF?fDfyLHQP{C(@=GDr3ZgQpYF6XkhO9k(9=BTiKq8$34O{V<MVVj
z%=O!*quCHV)!jR)CCYdA6?(jg->U*_FglB)T!JYgtXg7yZ;amo*L(=c0C<O(T|%Vp
zHMsj{cXl2fi(HoFf=wd`N`moZ;UOaVQ6ge=@=%)$cp8xD;lj?MGyFKqbSW~MR&;-&
zD2<{3;y_Xquxl2J{HIwwK|tm_7bclb<A~5p7(+rlHl9JK1A(}wBt_FKdEW>Cr$Hw-
zLJq`*K*&gzUlZmSO(3r6=+)1!hXO1+;+WM*1ocy&R+GYVpx%8ZhF=Im*!+g=EyaC{
z+hZB#V!h40<J`sDq#3eod$x)_0ycj@S*6%wvV=`T)~VsSE>pb0xAfy|dyQ{>Rqb}A
z?{=|wzuv`9mxNF)vA=g)#T_xhSK)*6s7wAk&t5HJ%R~+?<giOWOCilX5ANS<0W%+Y
z;;!MhM|Rf;KR-0hBpC?#qQMN#5&SJJk`f>$GP63fl!s(RvlKCRoCOY+vD1G={@aNk
zLg)%QMQH??tVz6(0Hr`$zu~n^2U<^CIV{r5PRMQRCTg&|q6q<3j(%YxJP&GmL3EQ1
z7A{Kw_Gb{Emm=`Wg9R$)n-8MW<7-|RFn&`O`;b159r1FoJJpfpf6GC7i;*FRr8fW+
zd{oRRTc;s<{=A%KHuGU6Bkan2vP+$Rm5C?OAAnvtT62~oHp@S|s!V1Sx)`976ZGo`
zh(hLxFH#=l3(<8VU@?#PgqS)KW)BgMd4;c^-~Rj_9R+^KkSvLe$S}Z@6VVQV@Imo-
z`U!GpkX~E_IEtJPa4r+%FlcHvb@{vI^4SOTJU2!0TxXH7l}_??$Q5iw65>C9@Fc{A
zu1!obpCQmQ9~~dI@A25pS(ty$CNlz>@zZCJ;voS1ec{n7;#XG<se~V1O0iqr2Pi)L
z9<`xbaf%^cGdsjB30QQOJSY-wpx`K8RidQdvdJuu>-(QRel4ykbPA9x3Hu7{_)(!}
zf6vm($W4aJwRu9(QXenU%KC|aNa0*-nrC?BHwCy0r%@t6bR07Ndd23+Lg6pcZ^KpH
zeV#eM)QzKfo^`k|3Qo{jS0a51&rch$aGYM&JNi<u`dgO!HcS0n{|FNR@8-(r*S5vy
z0F^#O6_dpgzgmYEgX;8F9)yJvEY5#a8$gR=Q-8bu@$w9vpigY!G0Sp)&WOa-B6c~A
z5DOCsHNIi!5^~eS#l&%&%49TY#DjZ9Xfhmq$gEL6Z=mAOFQ7L(UYfaUk6pFGjz<t~
zOt=lc64yO?=92ld5i&;&Cv&*e#Y?`vu&@yKd{i7LSiy_IC_94UHy%(eDnNAnR}#*l
zM!Cwo!Y4M3BZz(nFa8F9N?)6T9Bs%!UTLmfBJu`O6f+o=Gtd6{i6yfjt&-YkX?S(o
z6VVm~EO+CK42e7OLzI-7VNNdjtql?6u%0~O(+wnB3K0pCD9h3$QV3=7=g<IhX7q}s
z&kIs}9Yizt<#Z|tW)q#&OMe6MT0>p@0eA_kQ>xARzfvCVu}mj_Wie5|yqhW)`6qJ2
zCkHVn!{_xX4YaqkpKV(G$Wu<gb(as%!Vtv)l10#n(tHort85}LpsEU=&tW0NgHFi|
zups=f<QH-pc~63`{M3GZpMR?G(@k%G&LuP*E>4+8!(9e;bLoR7WEO)`hO=D}WVu?D
zLyq2@CBw?WpivBe+(VX?ETFSMaCP}S-<*AgYkuY28gJyo@Xk<b`-`!jz9V519~~|4
z4o?fxNH4o?Su*2jCEg5jr}0Oexo9@6KdB?+kHd)P7ZWSTZ#qBWZYbBVkAY9;C`qH~
zv`COv?$rm_tFNDno_5@}ZqHV^J>rhf>SUwg<@wEY#^=y~X>&L;cDSvXg{?N{`Qk$V
zTB&!pOZ|s?w${84o-eIVzttx@jWRVsafPK3@^TeR8FeY%=*rUbnSHI;g&Ws?#UtLd
z4jl1kp9=xsvc<?G^l9vesbFYh!2$72jA!A}&6~5qToqJPG&PB%&`JZ9!hfRA&nZc{
zA{&66PcH_4Ki8TB;w(gZcvHDO_>?%w5jTPy9UY}n%t%l&EloQx9R9hX*y0%(4u>a8
z%`HEqs~anCwzeJqx!vgTQZfGQ4Tr;HS(30UNyCvc9ClPJg3+h7(W|U=8Qm0sUhUJ<
zG>5{ziK9so=-mnTW}!{46wMXRxlZOULM79&sSHhjPS}Z{xg;fN$2L-b8~aBy95-i?
zI(5$nkOpFryQ{66(m2$PX}85#N{ika&c9oBgrYBaH}*Jn;exW`l$CAkZ;=$fIXyg?
zrBN&U*e+`iHbc(8yy1i2a@4cXhpMvKx%X}JzAq=C`0S5E-}5O6(;^Q=7n@Owv=&PD
z)><ZixY)Wvr{dj+V=#`%^m2zwF*Dprov*@Z`a~~6%H7uP+f~?KDgBkQrz-_GvmI^}
zj)(HbXMwvlaf>!yj>nKdJ7*X_L}B-axSQ4Xlc^xHgWe#yi~@I~i)uq7lgQ<bcu~xR
zquCaXTr!eQ$n>n_KE^R);U~6DW94*yiMdmMPHVT2@@G3%0O09K8gaqo$L=GqkG}9^
zw)HKWirG|Tj423>uWDzeZX334A4~Yd>3v+oDCXkkQ(Q!8Z;J@{X5WCD-I#D~q5ZCR
zuur3Kw<~z*t~&IPtK!y9L(he-?ich<5?2}Z;4<n@NYGtIJ@5*rWPC1A+cGWpNfAYV
zUsqP*y1H^ZR^m+*rl0dANoG?PzXO-#!Iq;Iu}b2QI#CJ$oSj6x_JzBw>p<YW{~f%^
zc?3wOo2YP07M_q8b$Sf)C^W@o3bAEOEXl^2#V97SEMsQakZs0r6lZ-j>vnU0f}W~H
zb`IgLI%P4)rDV(v1>Dm;K{4Z57_!WN8UHH0^|+NGPlUj;Fp$ZFyGcY|rI?$wlUrd*
zcfYTnM9VcJ%nH{Vs9iUB35SKUwS1fx15vhatBPhkNUZLxy22}Qp<(V<vuw!`y(}4V
zN?+Ns1-H@Azuj2YcFWB+@Q+oC%q<lSABUrQt%VUUR4c!VdRZ%9&r0$+MGba;pr(#b
z*0s(}D82dQF_};HZTwiKy@ziOfZ(qOW)8RuYrxLj={L~XcV!KilKpmWAd1u1vCo|i
z3-#IVha@*hcQ;k_mWbXG(T>D=OGIzny!V!fJzS-|S>kD!C4ShOHu$MpC4RhzD;P8P
zClX)vD)nBa{@7LO73Es??4ezMpS@m%-d%+*cdDHwX4fr3WujrrQY@_L%*M81QS7SJ
zqp~6!)L4%+wgt)kb^vsf^Jw~EBS=_1-IZ$C)HWHmG|R!7sT1sInu%4SsXBE`B71U=
z3i1F^LF8{?YstZ&j*sj1L!mk400S9AkXcMhJf$&|g{an5=u3;}LN(BT4?oP1g(kwl
zkUT#=Mv&wj6zqQoJ%0#!rQ_l|N-s$&a%;~x>~PE=5i-X^xM2|Knjm;%vWOWd4E;=q
z%MkIv8d8LP3=U*TT!1Lrh(x{*oT4SPB6)gysQG2NiFKwh*=Cq9&%qi~P3%D83P+Pw
z%QaLcOLlLq>~VE^T%8`51Kb88mk-<q34h0pt1}CsDL|-9qFGGY={e6gkdNr78FS}7
z2~I?4OW~2to$Vo{<-H%y67=RQDbaT_Z|VkQ9E5X6?i`?Iw5e~7c7w_hy!nuz3MAk{
zpUv<%8#}2qf0m$6fY_ff^bZ0kWy^iE9r}9`pc9d=8kNvL!F*-I%P2ve`uOz&?tjot
z9cXA{M{97G(9w6pwb)CIyYlCC!zpl<8i?r6E0=3slYd?}7QC>vHPoceYZEhkxTRS=
z`}?(Me9bD5menQ8)?+(3s&4omPY{l(lhrh9WE}hM4(^GC*K8;IYyPv13(J0hM;07@
zrEMD6J%C|HM5EoK81@s#utg-p;eUf4emkH~Zx7<Oupm8%+g(R(^&oETmaGSHyWgQx
zUE?2n5Vs!0t;dCYKryCa<g&MJ5z(|0YT`iXvMSAO2h}EWJMP>JzXCtTkd`Eu$+`lA
za;de_#CbFx2Q1kZ>=zdMvyh&{SrBv{3=D#PC>xO_X;<{RZN_m486e*0PJfkp*Xod$
z?sda3?gQS<qPxAhg}c4YB-`_B4O^0}V9ll`whYO`swPXC&1BWK=zVs#-xBkuSi8Cw
zuC>Sh?zu>1X?nX&I#OP5j|(WsK$Rs+CZ>vQqH9<)3=7*#F)(pWRWm)ANk$uBhdv|e
z6OTPuMm0h)Nf`telnL`vMt?8ED2T>$2o>Nto3n6%H+cdyQ8<c6+@h6S@)TDd^3$XS
z(8S{oc!a<WNqB0txI}$A%0s`tL#O3mPpS<JpQD%P(jQ-nQ9^DYKXiHi<E11*H&L8|
z!R^{-H;|I?8^s>Tk2Cgw*_LKWnu;aWb+JZVf^BB1SWzv>Ff~K<%zqAHUOiIU0#e!;
zkCItFa4*)Mrwll4;UF!-ryY@&XJ+^uokvq-!tt+O2j3UxI}wQwe~_j6IBp?vFmoYi
z7Yvy9<R@stNa%-SZx-;3s1*Zy6=tn17TFfrJZlvXn#gmxr^k}Rv$|DF6KhO@7R74|
zW*ODipyzE!kJ+4<YJWXWpD6Ew{24Z6Azexkm_0`Bn}CcFG(2ZX-cl==z6#D9Iz_H<
z5m~G>g!Go#vCRwl-cqsA!f=Z5@Z^?@YhB&2>L`9ZMY6;Rt?2VdB-IEv`|t_Q?<o>y
z?4s~7$b`=&bW&|~gp^_33jF0+Nk!+yP4?`!)1}O==*zR}_<#6rC(nL6tu_DUSw4Vg
zzn$j)to#{$SN<KwEe6AptzdC#<&et~Dhj0JiglB~dh7J6W$CTcH4KBClJCY;y$54c
zA*a9Q26!&5XH2RHd~Yk$?hftpSS{~c4P;Fkp^jN(zM(09bO)Xy`7^Qe2~_Xy1Xc{b
zITFxl??>70Pk(a9)$C95U7Td}-Ofi@yDvw1%VRv@nx1V~0`Y8s!F|ixkMah&H>|*8
zal-3rs`Gfd<IG$4KHBG$E$nl$;}B-MGIkBm!kT6fY{@3YmgiE%^(@uZ9<_b0qJH^!
z&0<i#bEQJUo~otJ@LbDNB+Mu?v1VB|wmnD2p6*z>V}F~Drjs_7x=lqk5W%J~FK)an
zZQS`{&pDzO!szE)M$uV`Q}s4XcyQImhC1(g=iOe~=gl>i0Md6{;Ou^IEv6_;!iwUV
zSkqNNb8;1IGu<GR$*Q5QCx`X@Y*@L%%DBn(u8V20nl|P`lrkrZu6_ZMXqP-@TR^xj
z=Ga!3NE9~{Y<J^pVRrq2&k%8{KfM^-z?ql9_y!h#fQ${_JA__|w2V+PieLOul2p|&
zzP}i7v+NJ4Fwg#wx<xNwp2Q^Z$KeZ5wAUL%UKFMnVsBn3()2d_{f5Euec?ob`@QJr
z=F(5u_t}8IyBPdfIqfb>^Xxl6oTRQ8z)3!m6Fz7DZ}^XA1}YwiX&hbqE=v#z5xZq{
z2G*#5OqD(dyB7zad+*aYN+K^^iF+q-?Gi?3v7gR)Xyhzr!iIJY+$%St@j}x$g7_!U
zBm;&oNddzSrovpVAs5UESfz6iy-|*!H$usjOok&AU9*@3ysdl@YB8H4%o94F__rc~
zk?2YIpaC!+pI8)+Ntng<JV(DK4EZU5>JgNGq$K9$rjZ|}+_)YhH}-=7`C%$-Z7vhW
zJQt<JN%)e8tza(l!)unLzDP>i&H~;MHZ!++tDT@T6^(kjX;RE&g<#FpOl<4K#4?p_
zhcVeyZSyYNSL{O_{d#7tBD$<=imkykuX!*(6tO`%l{`t7WGoR`#+suj*ruwArTj;K
zmby7Q>}dgNv{zm}fAiT*rzQg8u%O-sy6)P@7H;eVKl#M|HS<9Y&^b(zceu5)2rxh}
zPZE4$!k4yGYkcV@ym8*>C+3k^0Ed8k5gbS+gE#Xhk`mafFJJy0T?lk%Vd3U+?O^D>
z5F0A~`Z;?y((-G<0)Dk$WQ&e|AECv6w)_ALstaxXl;5Nf29{h5(C@!>Bl{c{o;SaD
z!LRMLQRp0|eh?&wcn22F5fUpNbwgCnZXIRKt)tw<v!H&PXQA_JP&g1l7C;Boq^D>C
zzCb?23bQJpMb#&O|M@3B&i!D(o8WEe06)2$_K(EluM={61VPYAN+#10I_GSE3~=np
zsBqp9J{TkPF&@8T*DN@T0-w&y-}CRkCM>S}fjcn#m4Sy$=FGC}`*1P9a4<hH>QBL2
zo{#^f>&7feDrpeOc)T!wz9f~&<W3&vJc;CK4%;!x|NbUt`m#^lJt&M);UQF+_K<US
z^{ESYp6qXM)$lU)<v@S%Lv)mXdB6Z)m-v$m`a@hjpBeo)O*jIF6Wv}6hLynq3Pd@u
z%4pCfsr%pTxnlu5v99aPqlb4KM(Mi2-O18@o|4Im32^F%?^&<kc4WNe?a1x4X=K#~
z>L+gqURjl|i|4R1s8>NmuNF?h4o6@wW8!XdTa0LNl`8ke)NQ&hm%Yt@7TnA}aR{G`
zZUl<P#h``;^qvI&Ak)fVMMW5-sFr7r{>RI+i@|UtkX_bS5oa*30Q9=PJg0b3yqs||
za~7ujI*4ZO%jvY3Y3>Im^2ZAA!HR?BCvwA!0!uc0{)y2jcA--k)9dqAl}dDxES!<o
zFBbWe7{6jKEb2>lvSzw}9Jr)xxq=<UiGq(!th^ua75p`c*E9!&ShiMM!~E?ivg^XL
zQ#!x#&t>V#i?X6ZUZPS*T=c8Tzpu5Q-_5H^^Y4}N*-f~rID9Tk=eN^}()@E-y1X`4
zl+Oy3HS$BfqPzg%DoPi}swh5nE2YKfvUufCHCM<BlvT=O)m$Tg`(9QML|GJu^Hr99
z=~k9f(A$cVzb3IL$&tGjaEKywisTW3m`U!3DhM#+*D_BtcxPVojM%3c1&$h8Q7Wzc
zKmVurKS6%*YVmrtmI~5rYD{fttllVS(%{w09{x(ZK*CLJYAxH$*o{hyg3O!R)LXVG
zSb$2C{3tZFXf(8cSiCU8KfZ8)t+ptROH+$xLyK?)od{gC?A%n_%8yc0YgR*R;-oDT
zi#TFUt=N@T;7u&iuKw}z41Hpg=z4)%vh(@p^5p%wI5AB<$Wp^VdBe;Fsi5{sE_T!0
zqP)Jv$|G8~S6l;)Eh_6<ET7r3!L@U)9-GP*f8r@s>U#`-m&>2|-O$)l(_zV*fuZq+
zYa0X?Qe#v4hNfVkwU%H|nV=ZODHMqi$vvwx7UIjr;5$%y7n0>~g-5w)rgSIgSI-E^
z3y$OhMT{37H8j^+OwKUH+WPYC7Yl4JC}2B!SZ|H|wKe8fH`U~V&sTSNfE_aW?&{*T
z);UV`;%+H_tPi6_-Dx-Y`P*ST)Ni{T6<<4N8(@dMZfCct@8;gNwUhfUK5e^tv;F?i
zPe=7ldXR@i<mv57GTS+$W^Sn4Ad9RymCA!Sm3Mk5yF=FPDbD0z=eupume7#DAI^oc
zg(qEJF$!}N?ce;wcl^Ll=N+s`g>%4%oebmy8cn8uB=$3JB|rK3Uo#S%N9~!_!syAF
z)B{)>a}Ql{NRW(x!R>Bplq7wnsZo;j9zf+GCT~@~1%k?ME|2?L(yWctPsN2Vl!M!Z
zpLX9I@zecv>SR>k$8PP#*xqb--`>KWX-U?azR?ETH)>(5KQ1ini-mJ#PG$wK4NLgF
zBx@9Z&fjmfa2-`KhlXh1J5c*dbq#m_*`}%8K->2M-7bE%jCb0LLSe5#eftdUTOm(<
zV(wO9U0a5BZC$MsaC+9yc1L%6l&eZ3X&^3uZJ&T9YRqoBtpoD6*E}AA7CG+@a8B$M
zsX}1xLfqUP@|@kmq7NPfS#Lw5@HjD$z(_oQ-#d}*bmi4aOu2g+6Uv`$iG6n+?PDhQ
zZFhGcq0xJQO4(10^j?7$_79u#P_DDZ0LCqw5iI)v(v58iU9c0%Wu+Yvvi3PA3~o%`
z7Eb}1E5hhFVl*_#!`yy}$sDwHTkX|1;;85)iPN1~s@s>hezM~OHK5>u$v&o+Eap0Y
z5HJjUqg9xY>CS5qMD%UwMX(C*Nct|?PUOoDN@X-Vttqtiay*Wi2;Jl8`LoHEjRkDX
zLiasOW1sFiFwxfDh6YNfMY#5DZ--2;G`M6Wosj9)*8;x-_BF!{n4izFNI9?@JDAPy
zY)>-h{R9D9QuTKVH>|1pEsa^OAvxH8v{e&phNojk@ia_iq7m1V3~GCaG+Y06V7QW+
zer_Ac62h1(X$H0#(XpmmDt2tcz^0;DnrYjnN81GBcAY`5+wZ8`Uv$;&_4{|G-(MG|
zvsU-NB53AW;XnNBp;-r(9mspjz_+ms^h(wB>(eV$SN-%#)yJ(=-3c$2H`eQaRkMZY
z^{Q*>q}QwVdewWYSA9@g3V;nIiX>s(vOTO(Vql_D4|}pKOP--=RI|HkDLRhjX}fZr
zoN!P&v6C5_p0Fef_|7sdl^AhlWNTAmqq~ydgm}6Lzj5>|8|$+cB5I=`xLFPqeqpFF
z^tX2vTSLmdK-iUA?_EM3yY#YurQ1dCJyEP@?>(^_QS{yun-=H^arp}oU8?%LCEV>=
zSwY)cR*-B<b0yuuo~ux-Sxm;3s(V<IiAQy!s8%aX`RY$ED;!i-5QsJRUsBit%5N|B
zu6>9b*~oigV>JQy!bY28-U}N~N7#sB9yQj>8@;#o@=x!r-Fs{AOcRfPK;EFtRa{Be
zuxYq5)+E=%M3WUPIn*+UK~+^XdU@lnZ4=JCCUS5<%lj>HoSvd*FwAH7OOOyypuHTi
znlO7gqRsK`<%p*vN6c9eL^r)0(aRAHKfN5$%Mm-%#3PU+WKGizBDvVp3B{U0Bupg9
z#MD%%Ni~V;)`N`1+A?W>@`^ON_7*W*uEq@8vUKdpj)FC+IM~vuf@RAhhACMt)to+t
z>+bQ{P#?5)KS9~JeAzAg(vs}C6dTqp+tIy>{MsxyuTFW<OU|o_w3nRQ9OYheeh89t
zR}}9`1HHRnz7joH(#oG+Z0^P8$0Igx(}oc4R9kap=4#lKEE{WoiY;S@S`zkbTeFzz
zFoX1=LEluM_~uM{S2?CZh}olzA{se_HLfY^T`x|oCedD;XmgNzapLJ1;>IzVe`_;b
z8bv|sPxpYnnzd9sItg;Jth!ztO_0L?XvZxyFAk$*mN3Xc1ve*L-s19%u2~%WuFI0%
zB-xuJn`pfUqV0iyXm_QFM<82K#U_ekSlBSZwb9lsOl+cJ!!}e)lT6*V+Jhg8pFWgo
zF9>`4g4b)Z)I1m?OFeIQFA1$Cs9q9kbL@IaXw7=`lF+tKSh1cxT-w^@>EY6PxU?mr
z=z$dOjQh82A}NHL*fwQwNHi7fc)E)X&6I4anYP|Nu<7xCIV4(JI3${e%uLPIuwvQ_
zYliM&hiE3&8DmtVo}{}<?~r)+4vA+`lHy!qLjQPqhCZ=Lblt<te>=k>Y(c&Q%Yv|w
zVn4BD7NkPj{XC<TB}tCdS1krqAqr(69k8QYL;6*d2@A3SmGc}ewcX35tM|H>OWT}?
zUM_t)a%qo$@7HHXZ2swuQoT`XXPS5fMkz-!48w3JHW-z#W-}8LRaLNQGR3r9MOCEE
zadJHt_`TrEIY`|>xbjNNJwLvBk9&T+%{|of<4=bl?;-H|7@U<qJxkuR<U7;EBVfr5
z&mmNj9V}5z!J6SxY*Aui!(xi1>$XZXy=TcEq^cZ$;NA|xk(Ukk4EgFE?iunn=b&fE
zpAJLbW6AXl`O2T3A@3RTooV6`FyyA=Dkf1K>@Zn{e3=rqZ9~J7XPJs;DTdRXA-@l<
zTloqBt6PLJY~g^Vxr(H!Hp99i>sVv1hi%(6u&G#-P}x#lxxH&!`x$h2LG$dPou2P)
z6NgrRWs(n3%A6>=`sEHCu>6!w;3E6dr)b?B20g99pvP<)#ejkC%+U;jVj(7IWeFZG
zn*i#!M}mZ*X_WY>f6XA2R{SMoW5WO976@nYMff_1X70=Bv;h_36Qfb=o}!~Ei4*qq
zpGg!ReIhr!<WD3e!{KvL1W2e>^YhG^_z94I>F1QB46SWrq422u{k1qE(EMo{C28!3
z<D*tBRch9t9>jP-Tvlwpo{KUxU&hLa;9qG9=ncGh^Vm+oP0bJXC3i1wYA<%LJ5;^c
z-R7F^#qRqpc2}h4FbexTPCeK`(@!rm_cHT6keR!M;p|^x)@;cmD#1*#OssiS#g3$Z
z=-4t%#j%;|7?RwZu<js>Q!l=xtdq0>SVyHuv48mi+Ru!Jz2$B-VfP|Lo8#Y$5Np<>
z7a@AYgte!qM@;Au6PAeL=^`fVMTAhc7a@qJD2hw5=b9SUBu24C921+G%w*H1lIc9i
z1Wx%1<xJof_BKn_Wu|BfmZ>UXP1hxVOqflvrFyb%Gnr_52YXw)f~}UL-9ms}&GmuJ
zCc)qQ#CQC_Pv`A*bAu^~$%LgW{*W6m<0!M2{LN=KZC7+aqsf%Sej;QqKl%AzGZLIf
zt?OTtV8;7D_k)(`r!7|~T$&idi1&i7ThB0~7M)6-Bugrmh%95xQ50-bRmD<&{v%6j
zi?O#Ed8-X9Y_YA0rJE6U0Cp#s_#gj>-h*ZPWttL>Ys+P=ADs9{khb8z<Ky#7#w~XV
znn2N%#AB98X1+lB6P7%ba&W)|5gJEHf=H163Bhy{bTko21tT<t;3z*FkGMRUOvz-3
z{1By=3?(cOIg_U>_9OQ>dL4y-l!a+b;E$qnK;4ZzM3BdBkRQ7KweQYIkRU%n1ONo1
zaEuav9FhRa0YI<ApaDe5WJ>&Tm^?o|hFQXY$HySyP9`jLA>lA5r5DG?=q&c5*iZe0
z!N8Jy5xgiy38S;vPv?lhd_tBaD2<69@+qbM_%dZNnwEq)jRK$gumn(lo86MhG~lhG
z&uQ$_6is86uyiQag9Z^8N+(h1rx92S5r(pJ1Sk*lXcnVOe|*W36vuvYg{CZ;2JHDE
z&KA366kU@ka!44mxYL=EJ*KI$=U_^018dBZu_GHAR*6hhOHrA_oVz$v>Y>imZaS(J
zdZ}a<dxU~k>X4^UoIs#|&4wd5LP>-^Gx~9wAWA|st(}WHEmjWWbM)Dt_yLJg8X*E0
zD7A~`j8pB!fM3?n8#AM~$gi*>i$WEqbU_;hzruQdc_#EtqG<B$H&ke-MtPYWSta}8
zd)0=~B}qzTmy1DJO@w};wbgi;Y9;QSzM+!HgkIM9^6VW+QuLXBv5=3y26sBlOF47&
z<r&=T&we{?#7-3}ltxn|OQQ6`(ue}nIQl1}Y0=ndx!@>YvXNMX5uetmKG4=DBJuyN
z{egw@m(k73kOcG8r%5+iZIJpC#+@N<(>HN6Im_86!MaS?ClZcXx3iqPBoX(Tgp|2|
zfo%=P?O7+GlKwY;0(1`zb#iPPjAP&Z%+k*0rh(@NX?Iz-R3vruqw3~2Mx$Uh3Ez{H
zasezOw~pRkRh^f*P1UV!<y8y01DtV3(JvD~U-MPqVraI-BA>55z3n9Lb(4U1RE`a1
zp%2w$v+JaH@IN0U>0Cgoxs3V~5^N!C?@8&^Nwn@zxXUJg?sVArmEIq<{-~`Wm;R{j
z?Wh6U)StBer1dB5&?l`X!SqM2KXOm^$h9rn((Lp5KFuL@yBk;)x71{I5TeDNcbB0D
z6B3Vk0P;YVrnjvn_9=1QT$F=)dt5)El2u&KwPi=fj^(OYBc_50@ia_SiO7~^ILtL4
ztC{1cJX{EWr7?J(K}tRZS|5ZFk02Ae)PMgaCgCg~pxysn*grlouAL9lx@+Jl`>lvW
zD*nR5oRY#JF5yaj!V>`s6>arfIgVUK2?~Euthyv6pn|QB3Hf2l;%gEdA0I;F4+=1Z
zk*syn^}DX)xP*DwQNa+c5DQz1OtI-v*JMmromMG-k)OD(e}xa~dO{oRLR~KL1D?z{
zU@02MBt)lmYWqI_IPpVJgQ8QEMhPVWiH|D!dQ^4yocLiy3q35GAh)fXs423`CK5_K
zFA7|Aiega6qM}fikkb#3vXPGXe1>3r;C~gJ=YLI7Hs${;ns!LS{yX0W(4(g;_Cfc`
zszcm=U$U}ob4^!G98JqJa~4LwF)k9d42&E#2MvnN+;d1{IiY_eQ`i@Diq_%{-Q||-
z4m`@!#IDO1&{UuVGvbRi3$sAjqvDAC5A@H-57Ct$x~Bp2(r5-o>7$a)+a)kxa^x=U
zWUw0L0X*gBtg>AEqzzFNRtl9?q)NfESrV{+gt8<4hY^y7qXq}@Y-mLmK4A{qV&04P
zwWDWzQ=Sd))0{JRc)`7ZdqN^CYkQq{Ms4?g<_osgz04gB(!HN})$qHw6Q0HdNAdW6
zp7CsOyPxu=xqqCc_x5_r$F}>-SNKERzbR(~f8(c@*#T`mYv6cRJ+X^nN%wZ*4Y5vt
zEvKLJNB4JT1^OcARrau}+dy07JQaXj+~c)cM$8y?^_7u&Ul}2l2Y$%tC5hAap3YEu
zD~Flem$!bBI|^|UXs;X|BrNt>@{TwxsC0fX{~6I;?iAj{QFpX~1Tb=FYo}ItyogA0
z$XGbI56%xwE4BPmZM#}Kw^XcH%-o-UNPKk<*KC#SvX3>}rlIPRy^6t0`(Z5Fc1~`M
z%eGxp)rGr<OV%tiY=4jK)K2{-dpIX^3y+gV3frQc%94@!JzT9u!ED>L+O3&o>bj>C
zwnhxtk;?w@@(jD%E}KZM@-WtHK`7jI*`RXS+HO=Az@zyJ{FWck>Iq?L+bM&8mv&cr
zdCZO!dDOD}M13e6>M)OJ7WQ;q#hPMEm{8Bdiebx?c$RH3@>qQ+UJ)1K96isc=;*s4
z!V99~Mpp`M?2b!+3a8c}#A>n%E0IOA4Uq^!hVaiQvwYV=-jY$N(s9>#OqAB}=ZAHk
z&^tL#sFG>O4yD+UiH<d$DcGWa62Xe1T9)THo@~(Gd7^{!#Ga^X*?A&acAnTVa<NoJ
z^5=`!SWrq9(SG^QE8;Gf^Sz@L`hKp}T+n3J&PN@Q>lJaoo{Po%dd6Z1y(VM!H9zQJ
z?{}k_6R;zW_;FMp%}M!rVM0T6jATg~A!V3#*q}K5@(iw+tb6nw4{BV0KcIstNXd8{
zbEs*4`}Hx1OM2D&$dqVLlqu0AOHvJDVb?ZntZ7uij^Zkq8j5Sfk8HPc?A%mj1H-y$
z%v)@9vBjLRKp6cDj=UAjkIbI3v7OFa-g&c^ws~_6h**9V#cmO9yW{!_YG4L)8DkE1
zsmrh?yArl6YGT`Do@uIonxs1Gkww?{vti|0=aJ~bi|&{&V%r=MUGhTQFK+z@K10N*
z{`6vS14r(KEJ@#ej~q^Lm_|WBrU`qI|0DnM0-(FUFG0PaWE8*nqa>-SVSIlv;Mg!f
zqyi)6htw^40sa@0z#oS%z?xfc5P4CUVt9sMDAM#c`~8N2O5ufn69w+~qMw^fKV{!%
z1ODz}@Z)P3pA*IWEv_DYa0i^l9MR#2lhhT%ImyR$!dIZcv3c(U9!BIr78ehoUSf`S
z@e%k6hEzk(@mdm87CmQVBHXuWbr2&IMk$KIU@ln2=ZG_+Nl2#2Wt1W~)=5@5!`^_9
zk841T$w4+Uc$-asAT*yC;A04;les?SC^*N*qU}GC$@F_vTc6`&h;ZP&_>(D%lPJuF
zJRyKV6U`Fz>!)|g2mxNl93^}y#2h`JgVG525I+<XI2^8wSki5vWmMO+h(QR}Wmkh_
zLk_l8SH_CrdY)x?u3_9s9K!=}H~$MGF7R+mM1E2y@hW<M(S!j=kw88ILWJF$@f<8d
ze3_4gWHn_mE@bUwO5!W%DFOHxs8(-3$E4xG7(QTjB|h9(a8}Sb0K|;vDD&PG<OyWU
zA&|JhlS%rnpQL_B^I1$ph3D;j+S!7)bk?1a<Vr7OO4wSr>Xp7Kd`xev$1u0JTns9H
z@iV`99KXhY!Q0S_%91m>IFMiC;C0~BtA&C5J&Lb_h`5zuWd1RgA^IUYx)|{4uYw3b
zc`gQ{`X64+&sj*q^bGK;<`;vCuemp&3uAfX2kd=*$z<L)F#Z*zDhMze-f+Q@dD86G
z<O;EvS1O#l!KtkYQJT|4K}4S^Ts1ID^pShM%OiAu&griblEAy2kSm6TdKrDL_y@Vn
zBizp$Np&}%BA%e)5cGMNxjXSDxA)0gGd0mhF~f3Z%Bq=d8peKS4ku^Jsnw268NF4R
zquMY>(czxAZ|3hziTv*Re96^K`O8|)L~GhD-s^s60{2Jf?I?~k;x|Kr%F7}fzTPl=
z(bax`hYwfImed4yQ^N&dG>lyIa)^=d`3fjErZUHJZsy9leXBblQ*lOd3Mxn#6-j7a
z_m|BlbD7LW+yjJd3lPRJR@+0KZKDI@71Ka~rFBjGxCp+`QhBpGfPZ@<^Z+E+y-bdi
z^!8Khl!kLBSh6fzc3ai>3M8|`cm(W(IkqK#;@I|hV>_cn><1&_5TFkoPEf)Cy_&@H
zy&R)XPr}kMQVwxNEU9ffR262Z0hy)I-~qaSR5dppo|{K!aZzPcCyeP>H(Uj46hJj(
zs$x@jm|>~R@I2=+SzH#ButM|N8(k^{VLOto$R746^RQ-n8n#?r!IDc|*;7?X)7KM!
zL~nG-39vW1+`ZA|=Lv(0cbp@mwKKB(FfE2vb}SpyTbRJ#K}S4^Vuq3kpvTk9nn7Gp
zZxb$Vf{HTa_6}i%VEHh-nEh+U!ZeukGSiq{lYsv|LVo%zK@=d#DG4~>2SeQYl}6}a
zGoM}sbL6`WoMc4pm=T(Cw;zt{pLO<s{D+fiF_SNAr}BgI<Nx=6{O|wQ|NDRc&zHGf
z=PZuEe)2+i{p9NHfP`*B$&~$Y;`|8h|8{hlrqkrb$w{6=;Q1t1gg&Ry<U~{?IgGV>
z;>ni5G)KaU<-)~c6KqQ|!_?4B!*UE)a_I@UDuJQszX|Z><TNGY<U2)If8v3EGJZH7
z?l!BJvor!_uZx^n0$P388<=R#%2ec60BD*7K@yT6U;!e04@IJPv43P9M?rvGKQnEh
zU>37v`&CkzqpPZEVarxrtQoeBiDsKv(Orq?nrz98by|Y+C<@Bye@+<*UT;4<&9zjM
z$_kcUN5h&;Eo^Cqffd=7ZOhevB*%6-4e#UUw;#^S@%{SYwJhuM$uE~tlHSBV&p(mv
ze7PxQ_KaWn-Vw@GJ3B19BNLP9%*2|bsaP|03tN_?W6zW|BCE1&$Ye*#`#GfXd<vA8
z8Fv=v10JOSmXxF<Whb5=l92jffnqd`;vFVu=(1}VHo=;y$bf3)V8^k44XjHxvo%L|
zJl7r;S6`Mh<p+W;W9FS+4D#;A(LzVwP2h)DC;tupzwe$Zs-oJmdNIi6b9yoO>I5Xb
zx)?MqnFiN*#^1gG<`#*YeWk%3Rj>H^>yWtu#KiSy$qQX<hM3KdkR}MSM{xH;aoH38
z?U0_c(l-+)q-|sgY5#(MghWkCW|oeL2b3lg1KZRyv7<VUO(fgZUFk6i5{ryQFGG~H
zpm~;M8Lo;gOCeaJvWAIcdYGuD<EoOvRAqfWw_b+GX|I<d?p}r{T};5e>NC8$nNvLa
zg{16;%+VQ(xwbB(E#0`*vJt;>2mQ$`NPWn!b<IK-(rpP;#5`qx*EEjY8Mt{tE~Civ
zxDyF*q2OVaTbZAuzeG3e8sHTn-xh=l#O#uV33$D*(8Xzl!L~-G(>NmZ^1uG$Ka(j5
zApsbdO+eTHr>mmH5t<5}$q4!3HA_-o_?C}Q%#vvoCQJZ1a_rDNm)L*($A3cZG8h~p
zXcqdO5AqU3D0m)!w0jL>_E^Y;7y=NBDZOL~0LHOf%9tziMlo=5BXka-5Q!f|%x&I{
zBnoC?`Yl8ut6<&UF%pMdvRmf0Zf<TCxE~hcSyJ#|Cr%KJPZUWpP9)<*)=!GUn9mH@
z6TX2suYnyF(#r{nul#U~uh<;>VFI+6V8DRHQONL|kr+pR9)>uLlObB-(Khg+fAPnc
zIDzd4f~lv~0(6<o_edT|l9VOo%G{-xi!ge_oOnj!`G5V#|9Ux%{Q$xA&{2a2;sR+_
zXEw~&@{sIS%haRU^JHt(k~Gi8ie*R`q)+TH-Nv4y%0%-#MY$XJ;Ct_O2V}^vv7@)4
z%WhxzVCsf{xYZW|I&*~n25B<k??PD0Lw;lctz6-+3YLD^){5{T1<JnnCybILg^!wP
z6(3djcos*IcNY1f_-v`gXAM68C5l6q@{7Sw=TO9w%OW}y;kFn~$Gmr0my7QPe1989
z;aL>(_GQH^2WP_9S0s)Jow<a6)-ApGY{BO@e$0M<o-_EU$dU=)7Bi1!;CSVU$#1NS
z0fY*{l8&HM{Qxf<-4i7LRh(K;i?6-th`)L~1zM*zGPj0<#UfRblXWuGyECD$e-9#(
zWoSH=X-lKi(@1r87dgvTknj$<C**IN!)#p+GEMrfTL!YjxDD*IK`l@I(@7Sxjem&n
zW#ATnc&T&3w{;X|bfvI9$6bpRpCydPQ;9|19E!HI%6ILb@>_c!j5xY^=TC%ZP<x^t
zfFt9p`5_+)P+I(z%@216!4y7bek=0h05n;`C3&jABuv*lS9e@2n@qu)<Wg+eri(42
zI*uaCvf-^)9zHNd^5>s_sj829J#tA3vZoS%lPM0Ci0om_atO9vqGD$1s_g2LWUE%M
zN4}c?V6j8QQB55*{i+A56iLyrt(pdwJeioTW)do^E$^{z5ygudAgg6BeI)Y5;K$D?
znWNXUIA&qmQeB;C9N|9<al67Tq{vc^jtcG0|Mt_T;qfv0umAW@1S;PVN_prVPNs~1
z`T&QLxs*VJWf1sd7E+dZvn&P<Coj;l89D$hZKE!>P_*8<ab^X_g&DlbEd3+7BF`tu
zqQyKn5W_@EWoNEXg1Dh^Ho?Mz&s`PpY$`l|vKaz86p86&(=6KQlN$$JuU4zjJn~h6
z;^&NBqSw)60`BE=<dpNuYzt^MbxE3kxibl`7cdNrXTA$hRnxpuMlWgJ<iZTWO==v)
z^CsQ67lEQ1hK5x`7qc&l<)yqR7G+dJhZ2p;Q=e6JMc%<&QsglL1`Hk=zHyPV1=)%W
zEAv?~PkeJp(gcU>rg18Nza-!i299KH#tL&q`DA&JUS-of#$0f%I6iLLw(KB(Ox&ob
zkyluEaGJ_@bFX+zj9leb?YX!Ls1H*VsvA0{t^zPFo(dkt1WTr>6VEWIt#0rJSp9LG
zv^-$9K$>SHCKHzFM%O6>Ruf7m5&;&&_2Ky<!QTK3zz_TsWZ^Y@)nJ+rvOobP&N><z
z2+%h_LrL+IpZ_%@!FjZ{&NUc+2>AF1TdYA&^JN0ckD0UPnziU4oVN98YUjtaW+IuN
zyQfg9m?pNFqhif6Tufxo!nQ|r)zpaUTB}-L)%MECZRTy;@uek(We$K|8s<@MJucWZ
zjPrkTR2P6#na0tz@A9Wl6b3FV%FMU9TjKF?=|6CM3|6Ggtb_=~1si>T;oKO7De*(#
z<<Rl*Bpa^ajE;{XHwwK3yzXm11|QoIN~UutG6JK2Ou{6Zz^_9N$>E2{PZM-}4Dsj3
z$57<>n4~G8mlFVtI6htt@ACUYKB>wsCpDLi)V&|jO&X)tTB41|)RH~L@;r(i!)92s
z4G9xNrkD~cn?#Zo<{JBdKBnrf$F#e>y$Wsf*R!`dAPqRW)WAFe{iuHKOE{Z^1;TSf
zKr&@uHazt%7JteD>9de{VAy~&WQ1Pw7`PJarX}tS3G$4V3%D(tQZY6su`AL=X2~F-
z519Qe2WSb3dU@*1cM%od`l2#)a9gQ5A;B^l1#hMb43HPu3LJocS02^}yVR$c!eM$X
zVP>YWAEpK1!oq}0M24)xg#=FdYm(<`YXFwXS2II`XxUwcEz+E-bYT!29Uh%?S)&SW
zq3mf8pZUx6CXOaQMHAwOi~Wo5NPKL@XKB}ezTulzJ)>iR+?!Ev1C&ZhRc(+cG60GK
zkYZ!laqh*j&X&u6BZUiP&*os^s;37mc)^3`*`+=~`hv|D;uiiGTcAmFLXhZ)8nGo(
zM0<3I_2O+e6o{>mAG)DEboT*hZME-+<gigM&=s+v14=_TWQMKK7`8`X*r0IveFtjn
zj;OE|ioybN!owlSU6!^JmP1?ohLt0FI?9rrM6jG)znc1gkkH+qK44Kyk*H+2u8MU@
z(Xr+z4z>-6Vb7Cf#nW9y)zrOfOq4y!Vx0h&yF)Fvv$3{Co!%$t^dkgQ&Lx&o8_8b=
zV0eY`?R7vBu2%xvRbCn{jFu1p0tq>5n?_+01->wbU9mh%2SlZC>{mjsL^#XsG$4N1
zB&CB2t0u{RlOzx3hhUgiS~f4D5VSr95fP;NdU_ZRK|9Kgk5tURHhrM2<hclf-GJBp
z)+;7)4KFY#2mC8oPa1`uA5YL{;xY8H)WM-64ycGGk;{gFgv&x$P?t}F1VI*H0^=zo
zhlI{BjiyC!9+~(7h{z5LqMPSCGjR*Lu#K4&3fB{V$)*OQkbi(-jSw3<uEnq=yRuAe
zg*mSF4O~wSaSQzMkEQx};rLXt8wm;rT;gd!<`B2Fg5rw2G>uf>jluzdoB=j6K|DD}
zk+6n|05HLlLywu7IYC}P#^a32>RRSxb9SVz<dZL(5X~<c0d}h$K`~o$Oj+}=%Pb9R
zx+!CSn-~(rM=PG{xRUL<hbJiYK)DP$g%xeid?eBsRkIx}**hB28vWafv_=~hnPfa(
zz<{nQHLIzR)~GCN<vzyackG%40&p7r0n|M?f(c6e$t>XNi44rTsq|+?KTaWMt{-s4
zP%XL9U)da;0z*kjdh~&%H&J|5K=&dDLc*YbN@`ZSWdkj>QzRaLosipVVx?oAZRxLU
zzF0P!Zi!>uG3z{EbDq4iQWoMJOZ6G-MzzaHwVmNmq`6vEwmOaBuvDLldHgf-Lv-bb
z?kTV$(G1{4pp9Wo>AEtlQ}g6Wz!J)imOhS<w4ksnXG{{>Cap@__^Ph@xqWHr_7XdP
zwXCs&2cTur`)$(Q?~<#&t#@@jr{@xFw05`NE`MhWx0>H}RRbNst!4{lz?Le3?G*#<
z)dL+_jNI{Gx{oQKcAR78a-mDEM2L#1WUE+{B^?u4moQZ%S(XV^Y*~4HJT=1TWp*W2
zLFkT;KSU{)i}Iits5_2055u9~7)ktpV9woQ$DyBqFa^>bcL}_?Y$GoMhmv2%xm;K}
zj7(U18G*#ih1glbz!xJ0ravK}3nnZUUi)zr3h^$Dpe_KUu`Gp2=nAZM&b2pG2Vc-I
z3ZgNHb3qhc@$p@S(M^b^Ts;eqWbOz;YBNPp4T_C<f)4^+a@P<d()$ofS;A$1VUS*7
zC?dO2n8pz#!1Q90r16Y`r)QSdsFOs~#BX{T&fdb3CI=HU7U`y&#33t8G8N6j#3dS}
zPqVRYQ;ID`V~(Ly&ok{_;@G#u!R6c~=d9{cILW9qfiour*Q{VTMzfHg4?GL~f6aiO
z<t^<&jHyZ|#SQgdTmk%|c$STS`q@2_W1it>dz50bPR~f3FgKt2DWE$h>?_>lM~e%S
z@$Zvs%x<R@O`7<OPU~$w&t<{N0@f=)s-kCbXXaO_ABE3G&wl;%uKI^uYFL>@qa?9n
zAZa8ZIF4!`hNJr~k!5?rolQ_xK=UD+8W+yc|0uI#)u&yr&V@Mm<7&x&P1Nfm3pQ5W
z)IpX8q$(X|ZW)UbVSPR%q16rRg~WCld>@IBxNt9Y7ZGFTwwDk`hnq<KI_o}<h~GxN
zu=@mrUHj1ryUd}E;VCwj6o+BWbtUYWwt}f^+lr-A#eQ4{q=YLtE4EjN^%Tq@mv%pw
z9?i9IgCt{q+uA@$k~77Bz`#Vasi+9^<#wTLTt_cmQRb)UCWK^-0D<@yLazW1dxSm}
z0S3TdPNFoIC{Y?m|0LlEeHP&e!#x<07Bpe%#)#-8tEK*EkBM%mmPd6NOO`5O%`kOr
znXZN{#gkOmlTF9*9`G?akEX&#e#KlQ9Goli;hN*}Q?8`|=`zlLB_K43Ab_>ZAs`|%
zGbxfg@)tHxI1qa~1<URW6^zk)aY7JAucPVw(H<06VX7^u4%Te2A4@L5L{m+yx&~1k
zS&^Bt%KPfUzbC-wR9_LUu~~RUazB7Jk4Ww1C~yh#lLMqxd6oQ7s5?RTSbDqME24kw
zv~N(!VGi}MZK)Q2)>J^5cT|E^$#o2B+nQp1177Me`A#(IFM*A!IFA)CQl|M{aIb-b
zQ3?3uD#}%E6NgeGHale$noQoB_*#Es5tRE%!uip~Ks=E=WqA2Y@?Z0ZlK)b^mEzZi
z=aPTOUd)TZ@Sb>V)Rl*SWpm-E(Xc9Y)s(2`vM!zq>QnQ7RG9h))j?6%B=#}AWHEPI
z=170v*l^$BU22bA_h6qQLLJ-ERS8>6CGZrf*wGXZTb^rbkU7zF)<=0frKhOj;qk-#
zX{tU!&KzBnSmXe&yD!6akv~%4CQNc+iYFK-q@Lz?3s!6KUAntxsp=~T?X3@zUioxA
zotKNZ#Gj#m)2fSM!=kL{e$`W$52EZ~<@h^3l?yoU&l)BCXMon;JdH2UKx0shg_mp`
z859-K+PqB59NkaWqp&3o`xXf7TVSuZwW>7Xt+)3a+y<w6dxY+4q+@P}YT4-qoNQI1
zmu)jlx1Hv;$=J6@#J*h;_MH;2@1A`9_iv7WyycmHIFF{~CEg#6U3Z~B8sGM4Y%bIW
z4t^k#<+jAT-%JSu$Uxfh733!3H$Drvl+?(wv_dW5?Ytb1V<z&7iMZXcRjvo&LC_Tn
zJ(sEYto;_s4qgeO9JyP55fR(6;w2;LgiO!M=W-k~7Jg!F8vs!!xr_og`6cEu>6aF0
z^=*!S|G=kF*nRa5Hk_1<&qb!7L3`496NTyL{O#NTZqRltTd8htU*7u3>a%eFlsJ9x
z1;Xg@n-OhCGpKE1Tc+TaVrZC9VqjHP3_>-VN*l5(JSF|rPNozg;B&-*MFUE1TU={1
z@slu0*<_l|k19<KD~h2f7lvB;VV5fc1DFPXep+25=y`N85RS?7DT}-#;T=8PxWHM7
z!r}O@Y@S0(<W}enp4p3qL2D`Ng_>xEh6u`6^g<#7V6WAA{92u-DY<IBQU{beccPEE
zr$XmWOm^k+ZzU_tvx==w_JH5+Uk7_yxCdg??d1W4k@{!_0mmkqqiP=Zbj<@nfMLgf
zQ6y~1wxYX|r|a5kbba2>>W?cm08bZ-J<k+!53tzRm0d!S+#a}Hv2>N#DrPd|Zetq3
zmgH&JR8>oti0rB>1<f8Uu=wfG0uO^0$i0hm9C?%j$&aeo4SB@&oXf@;IQZKdumE~n
z$+_|EAqCxh{6RMUWV9mWd@0hLmrcZfoa$f+)zlyhF8^KO3Q6Gs)DCm-O%&&2dV9tl
zt~uky0rTh447m{sqZIzf0T@JZUjd~Iha^mVs79kO%%(5cQx29GqcMxHLtqW!S-_I-
z5#*!wz}<CKkUpXypk+E8z<h{V4rsVHOhSk780Ql2p&-bT3<ce_M0}tQF*Hekbum*M
z8EYQ1F!6K+>n78wLWsrm#}{+9bP7bIz~3@u0c<5uQG$-9EUqIb466}ib)=6P<u~{9
z0{!<Hi3#|mFd(uw#0R*`qnLqehq*#y7{&a5qgjeR@XUw@!U|cs%({Vv*t)|^PqVNl
zF$Zh1u3=ktEv!hMDXFTbc%I&W>xB;i7P7Q)-xBL%g(Kp#%n$MLVu6%p&tWr{0NQeo
z!%^jsi@*8a(NY2$ShBL*v*9Sa4A$2WWu83&;KY?{oS|bhe;-MU%byi5|Hg|HYn^=-
zzmIzK#qE40A04npGj(kT!FcE38YS%?9$4dm(-3F$z!)bj6t>@3@7kk(V73h*db}{0
zjzVRd=@wRGMa7yeK^_fN##C|?)uOtkuvIAyAFh<vq*&=FsJ(9~sO6DFn-vtzqW|Gw
z;~TY0oy0UxrHWz83~QdM0EDWIZC%l@MP%8OZKi2TFQy$tOe?6WCAMRmgzY`7<HLh>
z>`@teRK`Bgu7&WpU&h&gFnWiDHhi=7XxU~@lBi6Xgqf~0tZ7ujmg7lSBc5R>lrqoi
z;jH)KxqL8IXO*jSk4ODL7?-wT?@fXZ_ikQ*Nv@RKDvtfh;mte-kLN8^u#d&<Synec
zhxtz*v3nnb+3&=8de6SUn{#0HzP|_~<<YXzx-D6jL~JZm&%~O4Mi_Q9mtn;-bcdRf
z<mm3B(?APPs<&s?8v2DrHE)ZW5*j#R;qL~%XuumUILH+)YS$VfLTv?kc9SHcJ}LZu
z7WC2uoM`D3H$o(c!m%h0y;fTUm$h+Brk6fNG>T%^hr~+>Iszw)bmp=Vg3A1#A|_Dy
z%FSW4{NeMX@HzT_3k#-27S=hs^v9Pt_LD0VvoQe3KsUc%7^s;<vzP*eY801%!Wp90
z#OHZ>p|OLh#jD%VF~yPXnwA48jy&DMn!^|-j>o{^&2wbt5V==}??)yqPXs6Zf=rLf
zV>MhW<E;njti)ng8hirYM->^YoOo?yzp&_S=tbxhu7s~}y1#<kf6rHc`Ze2x<t59i
zzRT{4sz8@D_dLHxh9mSYzepO(6}L=X$SeCC75!A20;gOaG<6>^$x;CavHULJ%&q$`
z0+a(C@iiPgT={T9riYOZLFRuo-?wDwr)=_9#$)i?l1pVgAG0_W<(oN!v>?$A>(mZl
zWy>|{x<VV*XR}-bf7I8Jtb&NbEd!H#M^d;wT7_?B)r61@m9yKbUFGby$~qPQZr5ve
zx$&CCFKw#A9amYJ4m-)KE&w8Zo=sZLwC-a!C@<}H_1Tz(piPW@+HusP>XzdMl7GDw
zmQxtHjMprns5+e)?q;^#pesO95UVuU!-?Co+^_cunA^FYe?3~c-=dCYFe+g}6#^My
zW$bts!IER?mhQ?P^JpLBaY%6qWRuFT4KjN#QSIUcw1cq3O;7Q>Ne0TcX}Css%WBtU
zr0kDi=gMiPg4rxyrn*V3p<r%b%m2F<64m{bejbB$tiJzG&O+9sJ@>#sD@E#F1nou8
zUIc9;f@Ubge_LY`$85a;Q2g`~?ETEDEI)P>TgM=hs_O(Rj^$y^B09F1OR;WwnrC{J
zY)PaCui6`URmPLz!f*n9pg50d&+#z0F~twZ93$tcz+5SYtx!j2*iv+gHJ!@XaaDpP
z+i-N9S*~fUf>G;Xu8N-?=IT%|SLcg4(}WHRK#7HRf9j5~tCql}NYWW!%8MxAK#c)|
zBHcL8b{JGIr&CC)eaX;guzI9u8nc9@F!dRPqN1trC;%)CK=h816gTu+AX14-2~7c`
zJOOVeSPY+X|N2Zl=tdLbhe_V#ISWacqL)Ds-JHA%B6@}1`AK>>)F~hlk(ykn#x^P)
z@<*8Je~xMr4VyC4utpRQJCZ}Nqq?qTs;a8m^5gO%TPCuGWbGX9TdL%2&*;1G6yt{^
zW|aBYJiT<yPb^PkUBym2=LlqixF%$d9EM2BeYseSxHlK~;<}7xfeRm}u^+{L>gSkm
zg-;iqJ1j0JnLz6tMJ<hqANt|=IXch&mA6Jke|YRAE7N3Wj$yF;*%<>DfB#=I;X5}M
zP-(Z*2)a+B5ib)nuHvQ)IV^!g1t%`|Ih)4OWD42rV>XRqU<(il=O~#a)9j=aS-$z&
zP2eI#&U{J|ekY0P6yYeMKamxZ`G9ZdM7R6T*WCunVTHq6dEz>GyHUq7iKG~qxRMII
ze+I>tWrE9_W=NVXxi;y8zw73kh11nN9d>q}^;PE?9W^_JtxG$)Hu2{Z@Ok5SJj=;F
zN7=@dUveXf?;Wklc)`0_lm9cD?JMGbJ&y^n4`0t%Oj($cG5eY=JU9Ee(aZ_h5l`oI
zv^<)VvdF>|hUi$9q!ChvHJ`=hCjM|Le=TN(SSqv_Ow}?QXoH1mscDg56b?oX@WxY4
z)F%UlUJ(~%i-o@9h1M@$Z<NZf>fR_-K3ly}>QSX2y_0~e!)6byT!mYiTBWv?`t82^
z?XEp)TWz=Ytu5;vtm+f4Cv8iRBCrx%gQZ8D(Wk#6i=RH}co%Bc?;|z$FaFNtf7~(3
z<gqZYJvsMYRja+KzP(<w#}`=81{YeL<k9+UFw^sxXDHaS0KZGNENl_S#;z?9of?Kg
zRp|kni(nUJDbEx1Q)bhvDV!^oq@zse9IiGXEm#LjFoI3E0!vZ<pa6|S5)^^{V6{YE
z%>FfFA=q6Ou?tEQWwsibnWi)=f92=^QRt@;&$0s==)Hmk?AP3qnKnBnMNw5-vLq8L
zx}yNR0KvAQS=hFirN}O^82tuF%}*g&cE!+A3!OPrvICHZ#X!7)I9$W$=%p~O!)+xp
z2bRgJxZShK1O#;I5EpEoToEuWblJQPw;R@uUT?{1ZOJJy<wj^1W6t7Me?Ja8PVH&n
zHkHMB_GX+uwy2LS>XVMIc!GN~PQmc>W}K&Mwd>6|wbkj(IQzdMTWeiGJD;#$Ai1|t
zn0O>eHUfG+#3NVowNFlaelJa%y)mf#>1~@`$hkKLJx;!;w{7lc`TN`Xexspx0b%TI
zn|Bj|zHEBQO=6GNzDbCtf19d?71vX+Ms$W9Rd=wg*gBIWfL`<ZnDl+eq@PFAmsvy}
zL{#DPXu2_q@o`0<YfQ2wi8z><5Qa%T8QUsEWircfC{ZNSQuZE!zIsrtjFF|~92N0Q
zWzL|tnGr9KJ;oRpA;>9lz@&2RyDTZKeSVlmnc*-C6-39!rP=ZLf4E&hv9R{=xZbQ4
zm<{nmu&<-z<6^AB{C#}P?VJ$GoF?e_SPURrfaBv4IzImO)4K%z6~*ZIn1_yDPQc6K
z_;__Z@0uOo!f$3U&C%J4bm+ucOPV{KX?2$~o!RXb?e5R+*2mFfmf{+Qjy+;SnqI14
z+aWeKnZk(U*hJEte|;ZEb=TwA-7BE#5AfHsx0y|NzLb#}P4hET@dDt+d59@yfpA`#
zve<`wVBBqhz^_>R37yAa^A)+{k;fP}_>16PKY*xY5??{i$#$u9r<dpyRWlT{3dt-=
zE!(a6jc_q2I^eO!ki+e=sFcH`lo>8~O=$hLQgeDKrpn<be<=w_e8d}>kSm6>`R65a
z+)0;tWEOyBT>=b*BK8s`DVvIwC=JlO@~}SAr7p$z57X-`%+jqKO=CaI&@q?hyM(Se
z9KqATeK(5u*DT2KVlYA<V;Gw}Du$UY<Z#rXD_8W@9P7F;01>!-p2gIcLs0fIge5PR
zh2HDTblJPwf3f#`qc<&gM!h_gpGQjFmVIhvpCvUd<Oqb4WHCWt7G|3DleMy*UD}-Q
zuPc`6?kJ{P<CiuBiTVLsD;n_<ZKWcS^5S({x3Go;eQmHuYx@1Q+1S=gP=kPZ>DGg7
zWs;~5RcTkcgAJl}@Kx1F;Q-6DtK8kujL^Y+(9M>%f0Yew``mt;pz(L0#)JWvP2&01
zB)RcATOvtCemEq#%hE0iy&H;)OMgISX|!fkzi%T*b#N|z>{1u!(9zY@2PhDK`haCG
z-DQp^ITqGbOT(I_JJ=$o2LM&X)osO;tyQp)Js4l{(}VHt4#xNW#o)&V%@%(dM(EwU
z_b7W^e-P(b6F(WDml*?@iJ6H&&Jw?%*8u_Wux|j?Cj_hmLiK@kUlY$!3d;iX%~v1`
zFDVDX*9<!ZVo&mz6jH1lM<Ekcs92}xn{fU<v1^~*a4iJ1%&Up{6bg&<l1*6hJz^m&
zF8WM7hTi$%m53qmCxGb}g+ivE#!)s@F`6<~f2ILujpG$U@Iy55Io4kQX+=4p+TKw9
zGF6(`%+F$IGJ3_a|JuThF`a3a?O|%E4%QrMVVfB$b|lO79G!Wp>^<OsEwMBUXA?*!
zKSjsK{2Ynng4{eri>xAG(0z#mvV4TP9TyJy2RM2J(MuAixs)!@0~r!rKlE1s<K?)4
zf6$QVUL1&I|7lxA^Fs3fOP6peO|hA$xe7L9Vq;BmC2VVwhZRLuT$eIMq3gNNryWkU
zL{$Qt(Vwv9uqv1M!JO+wp$|~-z%>Y(KVC-k$Zlyc16ztK6g{Bu%YaDh*l{9oN<?a9
zw@Lv(hmv`cvdMGwiA|zwVL`bVoSa+?f1oW=K&tZ2V7=ODYsq+wPSJ#<EcSVF=A#vW
zdXEYxZ-c6Nu|fXlN@QuNr*-BP-RvoH{IJ?9to%?YW@AuvRmwufq*7A|yHM?LQf+5A
z<kYgVY;~r?VW}Y&v-oG^hv>==-BVBjMYEK}2-+Cd^vZSJVPy(UQzrpSC_7sCe>6hU
zf?l$mElFsPUbj*)36BtegIcT+FV{7%EWdKzEhMVkYY>#^BA3G#D5JGAGw1Si9SL_X
z-j|2euDY%spJ9UzWJ@2W3ZL_6ot7NQl}(9Jtg14_8gV6TQD$I8w@gW+R97|qvGMo_
zFNxZ9w*NzvA`%2S2Q2`tN#b*ae`*?yL;v4EA{?QcOP^jMKS4K_ZG_+%@O6cZTQG8H
z!qUqK<X=AoW(=5?Yd=mw>PSfF0`tYfYd?-c?mGf6uFFyoJsAQA6VBCmU_r{U!WXM^
zi0&we#=zbMQFO(Jb`?f9A)0a}G`x|?j9!9pPx5IdT=0czP;AVAbtKRwe|KmhyiY_Z
zWeJz<fx(2KWB~Yp#toS*W0IutjHWYzW!_b!T4sAaU?xGbuB!_UChEL&uQNL7D(~o;
zX)p;(hC#5VFouce*jRUoLk(FWDz$ofXTS0e@OBFoYt(;Iz{JmTc>JtjI7YLO9|=6;
zaP~qI)J{~H_#tqVRSSFFf6Zhi|6DdfZd*4|XRCXGsS2+1UfiZlQd5Hru>wweQOX;k
zpUzLGBu>~@cwdedd&^VFf<*?dWrvKv&cZ37S4TgcFXfH>axr)VS7&yMbJ6rS0fX*)
zLU!T9f3{HS8NXV^_dhfhfD8(=RFoZ#pr2nqz1!SPz0h(m_3yP#e|D5Ip?G$7vcmAX
z@xO}WkpFeRlH;lk$fU={&m(E|ik9`3zK(jybGu}|;MMo2B+oi&bQe4$euCPIo}<G}
zW#M#mpGzK~+sn{<@Ey4KGIWK3e%#`;;TVdlnFKqsp<vBs2DWUOV#zdYlX!~ay7uD{
zrxS#^DSOc%TbHI=f6B%0NI0H>jQR3y#fSx*$SbfMgZ-4VXy|n`frL?DT0MI8^K0-&
z&c>5Vzmv#ifb<qaDy(P>9G!p7f;kEpiMat*Xt*z<83@Q+qKp{{@J$p46$3B`#*-;1
z0Ju;~f;ksBKs8X<-71D-l4KGCdNYgDOBPR}n2nGR78e@Df72-DCip^XeNX76A2ReV
z9~E@-fuysT1m$v^#ZfL_AANXtHms%FieTLC2&M^zgzb68!=F-a)2~LPa7pQg%n?DC
zvk3{a{mSxbjnJHXg@ah1x#MM$wh+1a8l;Gz06d=&NGR+%`oaf~V5YwvU8d<Yd2w<A
zBLrOl_!`cie^2uLe@>&xi4#QQlj2WqMiE{VN1Ps1L$8;>c@gYIF&2feYUl|LvK7L_
z=im6+V-{YLkow^m^SR?JJ=lq+$&#iS!@c8D>YZUJ1!Y%#Kssp^sG@3y<j9ywijFnU
zpx9Ad9jl&cQHk2b`xc;--};WJy1_siI?i`&chgK~e=#Jd!_LePQuL0Kb8+0>i@W3K
z-MjZgpm$E^aL}@#GxYK;o<=v^BR=zn;o7bsAPyXGZVk;+(mh8XXE92mV8;I(MmLCy
zkO|6Z7aFb{SMFDmqqb&=1|ff4cDuUeZIhJBNzfdKizJyc=A!@lkN<_P7y~?-3Xp52
zSczsSf1K)hG|Teh@n*;VHMf-Jsq~^L6H`gh(dUn^;m#owP}7C%1_fX{6>&a1`c4Gj
z5f@D15CK%)Pv7Et@W-K_G8{9PdEB|Ce(vWOR7p4pCJ9a>3@aKiOmN6<FpCL}JPgpc
zCz>iLnj+t?>p{>wC;4tygzTD%N)-d^lI(#qf259WRh6-=o5V2*(<S*Euptk{(Sk$I
zg7T3}COk|g_v5LfD~o+`=8Y^*leTdVuW1WkpZn{fQPn>_F@K9^d_F=Iwxn9jqJlxc
z*hCD=P8yj@M%@KL;I$x^b#Xx0jHA^x4r*V~P&>v%tx^LeDQTktf?^#NKwRp5IUdJs
ze_ZtTAqrbeGS_5u>#)2T2k>|&mr>xh^gkGYNW-IxqnM33u5rtXWlz7v{BdZd;A*WG
z;$cF-EC{vEj~x)#ijn;-*FH!cYR8Nx<_?7(I?tB1Ul^e6*5HTJhp`B4if!~wX}6dI
zpGIN#!?HxW`x;J4#^>x77>_}#!_IGte>YK>e$Ip3ct}!*uFj%_M-XwJizrQ_$>1Bi
z{d8bN>&m;TpxQ3j@(#3j?Ow%JfGeF8ewIO0Nv1kh94cW=H3+sXg<{K)9mbeRZL$jO
z;R$lun@#+y@<U`YaHf#Tv~QVja|_QKpy7g5_mhe;uLc^EEXd=~S7XnGqfIsHf234P
zaMfda$wJ{|;D_KT176G=27~&rzR5lI%<lRAO6XNx<%B>w_)5b0(Z!%pOaqMsfj?#;
zWfz0d#Q^S0LQ@1HhZFb-2mRq+e(}8&Q4#}i1b~2CM}Ai4jLhRG2*khNzC~jKI%Gc_
z^S_*v<mzIu<VjHV^==q#FK~1he>kT8LCwzdm$!avLvxPl*}{vsmCynd!af3BamZ@W
z<4O;S52<Rz&V2T0?TD_fnU1MS*pp2SYo2Lg%eE~nDW0Nfx~fVVd*Hd!a@0N~@N_c0
z+IcOC6A34!VO`B%Buk5nq<Kpj&C(2>NAM0Jc(t(W2@V82i=x?7lxcj&f6)<pK7Kwz
z{LX$&Vt0hH3wwmJ+j_W^Y;DG;LsE3<k1tt_Vm}eywpFttp;rY9Au3GB964;U9=t-y
zWi$(1_*hNA#v!!wNz%E);zE1B9B}#^(q4<u)2uZrd?^8gYsx6hI9~!DhAJXzD~85P
zHWzNtw_rK}Fd$)TjF}&Le^E>sa#)h0DYqO#iaC)mE}BeXH)1x8V(wu{!Z}K2$uzS{
zlzbP&B6B+=a^_Pw-o<nZhfUERhyJ=`erCV87m4O77gRJA^xVx+*dexSGY7kt<zkKL
zE_R4+VPa~MuG@xbdS)+0WKu*^e0nBRRHX-Jj;=|}schj=0ZA~Ie=i_?S7vB)`AIC3
zz%^e9a6Hy!gnI(2@xrN=PhmZB-byz5UUAW7Zi~|m4E2h|ZEO$%67w}Kdsw+WtyuW1
zVXzr2rk889kn=Qi%@g_Ztd@9|mt5fu{pFeHmzNR$>_aA3W4S@pOpEmy$G+Q9c&GuT
zx8e8;kg2`<wk}{^f3>BGN0u7K+RXAlh2#URJKP2H?H~y`T1eL4SU~Q=e>O<S83X!g
zMPpsoZJRg>b{)gUnr!RX(U^@DOR-GFW>nQTXxvwST)EXx7m}OH$Ot3-?qT7+4V=EB
zQ_b`Yf>j;dD^;CgTcRFTb<>mnfA-!*Ic_6M6MmI!PV|b!f2ovkzsSvrm1N7KZP{j9
zbZ^914n`s~QN$1hR0Akd+@1boU*V7c1^g_2lzoyvPG;g-H&n4mkwq}V7Fm_Z8}f3_
zch32a5e7!M(!@G&$W=cBhuqyc<Vp&;rZa4CTk(mbSP_Z~BIQNrGf=%0TXZ`JyGonz
zHOS;xxA*yYT1BMpLV&I)o39<wB3IqEM0KU3-$nwtzw=CZ=_W-aUC&Do{svFn4AgoU
zN(Hy&yq<v>DK7JG#FR$RlORs%mGr}1HbxP%knxF_#@lp`Sc;OgP|mtA2V<p|4=D#Y
zf2yNcA#=d7k7qn<hnSC6aUitTdEUgk7Wdd|^tU<5V67&6jQ+<w0Z2NAMV4mhJ&9t@
z&~e5AN#IPH=F?343l8Hye*5zt9HW=6q(*Xt?I6>@)-0Ql0PBGjV2hbHCZVNc;+VS4
zOow}pH9)5O=T@k0pE8}r-rN|J)nTBRe|sE^37f&)ZoB8O$~yE~C7wEN96%KV!9r#f
zQGZ?V^U+8iR`RUc@Lc0m6Ay}H6&s!rWnMKNl4s$Dr(_{f{@W~_%{D%uN_{?h2Bdr|
zR)JzjSoW<TR%k5`Rk(3yY2B5eiqxNpBIP?*--<uQ7u9=J-^jnkSM@7Y->DA<mqaQD
z7k?bVSMR;rluxz$jmzmt6Mu*kbtk%yw;5>Y1L4QBApB^mb%)LP!9COWERSNQyAHMt
zTgO2VSXie9*LBV0%y{~sMng{&DquyYS)q*&f@^F>@0KHp_r(kOEiYgOwv5fT{2<f=
z6MGt^*y5gn2{?Q)#<><cfkq#KBIfx47k}j<>QcfkCx`46x&3$pI0nAThw`esAMiz%
zoL*!8Wu_v~l|$J&4$7A*@kc7W6w~k+@_8kbQM27BPg22ZbbG8ST^K@{E41MXS7+*c
zc&bPBjzpGM)PyG@ussN90{s_o2^Ud9i)yOc4+`*tHS^Ne9am3mgMM@#T3zY5F@Kv1
zUQk|uU0TSp-z2BaX&$l@d`*tXWdSqxBlHK_!3pJXRSzkY9k$vLXo2pShL5>U9Bk>P
zhdo#4*maog5=RSscc2#EA?~=07-G?N#DJrIC71YZDJ*UyD}D!o1<R>|l&U1ch0E4s
z5Qa%Z4iLg__ug06{_zxiaZBMhkAH$#{4Qwp;hdDI#71M3r-+o1H&x!S;1*5iaS_dc
z?W_*`QR-WoP!1gZ^;ZqyR|*z1Ci9%{SLl6avB*zSCTvSFvfQ%pgk`9Kh$pBdrA8SU
zY0!&p;u%vT-DjY|L&Xj3kcsI~Vh2o(UJkJXhaEdG-ZrRbP%fT=a&gGq1An&RY5~zK
zZ2NwQE#K0xr`Z8^JU4VL*AA$w9hjS@bd&yYc5R{Wd0M%)tu$%~z*V>xgR3qGoE=|X
z<-sdzBvLE{_qH6kW=Z8@*|Bsikd2NJiPK~v3qzaD`p|@@lZ?zRBZ_F6W-NkyU^zMl
zxwn`zK1T4c_;sX6iswm@fq!-*FGInY-eE5Q@&PQU2TD(4K|zqtvoff^A{|ii(bK4i
zB!A+4nOWeKY-M6$jA>LiLaYaYjxFXg$h&3X(C`8pQsz=?Am!QvDObG(#9FUb=5f8B
zMvvG?@^G3ZdgL+u4F$0A>eg^g)umb^`<|yCk}yT5a5!DSIdcKf|9?d^yHIOmv3~XF
zM|En+^k+gxJyzAdEKju27=0{{w58>$^RBIY)@_cfb{bWU6%+3e(!NsDoRV3O*_o2r
zmTG34Qh0OF#79!V8|g)=SuP0mocz7lgXKFHPgZ~Qc@#i~#^_3BuD*|Uc!odCr#(m7
zPEU1IujPKv^9fJb4}ZMKBD!U-<)b_HJ1RJ6y*p4OCn@9N$@dYD*>-&{UCwsvbc3H6
zqV{^I=Kp+r+-ZX)s3kZ4u=(J6vWl8#bK)9?iCyNp*fK*K2O9G+*BE!H=X<U_*nsX)
z%mvA*@#hltYEcqiC3CJzKd??ZJ3w2=-DOE(H^^?6iHPbYt$&kk)zfVeQhf+U3b}3?
zgh=v!YTH2;ifxzWK^sgNPtTOmeB*;L<9QMxJytu!MnQGZ?gs7dxoCHnoD{tf4e^vJ
zebzDq56a;acM~jS#PdEr6i-$~3~fg@G(W()4Q_&#!7&MS4Lc?`U0d@!L)#E+vii$`
zENvxOnqimAY=4o81q+R{^!~$5uAk>Zv8HRG$xR;Mz%(^%`L>OH+u&H!c^EprrP+Md
zsvIcRs-J;k?S3fM&byT0iVZ)VDGcZ#c++M}NY2~DW+dO5+bm2eaBWW@l%?1>%8d+Y
z-zC7bEz=^Ud4Vg>09jpBCqiD5l0bPRbg9o~5K5SfjDJfNshT<>SvrNBoA=6SW^Tu5
z7FrHx7V$7Q0vlVDGEBJXVIET3)q{|_zJ5rqGK-6*laZsO)Yr8-IY+r(D>oRi<TFlr
zbS=EyTTU>gKYGQ(H)P2;tSlM3WytUy<_ETAV$IbEwhU(BAm9v}p-n^Ar^KZXkPzod
zMNM}$)_-<3k7^^^t2Qz^UXJ)b4TqnDwVrh7*cLNejK$FE&r1VF6dtd15)w_UNqnJ3
z`j)VZ^NfJNadE~o3W;ea{6Z1N33Cif=RwSmMF!*JZckp-1v;G{p%bKQ+87z5mf@>g
z!=Fwy`L$ZR!ELulH!P)R{)+{pPp4X$P6M``8h@=!ywM&76naY-Qgej<EDEikwITfF
zpu=AVn^8|g$Y3+tugz$DkBho>5bk6N)$Tv6YlzHxehag8`R=qZt%r^`+#=R+DnQ@9
zTSrFI9lb`z7Ei3(G}dDbXM7$G0Qb3Po~b{J{TNsCGx2A+&*i+0yTPMa&chmfKC#_B
zynjB^tauCH->(~7x(1f1dvzZ<PiGZYlpnYgiDB!Srt3C#J!WD{w=5i37RQcm29_0S
zhUHmLJQ=;Nm8r76l~%?kT;4E%iHrjCgpF3)z1r5wMu7PGSnq{MY`|2rgv3?wbvMO*
zH=2A(AlVd9oT`~nIoRu*@nytznnXnkZh!Ft(B5kR_a3c8@`Y?^C*p2M12^Q@3Mj#r
zZkw3+frdTCnQq#FPKUHW`-q8Y*oRu-F=vKa`DN$}5GKhzH5#KNy+Kg|_Mfso*&t1m
z5Eee=D4)eqfsX$@nq0p65#*>?k{3W>q8vXt>-tBasbb8^IZp&pne4?&^hO+rV1Kky
z{D^g~IKgJH%v2@}PlSQ5f`AHU6)In6hi`53!RA%kyrfyCN7^7|G7|6qU7Cc=V4Vh^
z*}H0G2&0>#Gi!(Yh>uFjv_5QT8!Tlt&Dj`AHcy#dY-h_Wxqubk=XtRj8`A`H3D2&s
zS#FzM>y}TitX<CJCk|tuk}H0Z^MB$Z3Z*SiP4jp)-9UpqpgtKMoe>fBvm#Efu{1S*
zDh-15>_G5egRF0gPSK}D7QR+qrg{mN6MH-zp$?b9uP<7Him)Jd=d-WDQt?K@Y8usL
z#L8@Ztxn-a0r|<jnLJxefaR=+=cEz+f@B%FJ+2np=Og%UG+0VYQE0G~K7Stg=76#F
z0gc>~`Cp#E_iHE}-uBnWp4%7d@V*b-*6@IS5X1KV`mcNNF1SbUf=6kO9n7(N*fX`V
z_=K#ogIGT}8LVE_gU`&SpFvA~LUQcjGczD1gU`&6neFaAGo?-cupMSx-3>y@JsjA~
z!j`XT*!Nk0t$=9M)=b;iH-F@WUj603y0V&e#ld2s)&4r?>8uP_7t!jtNN0-O;JI+E
z*tSVRN(@X1(XnL*Iu1D1Fr&mWoWKsa<?NknWp$@|Ice4IS?JS@OdH9XKPcagl4Ap7
zTv2TlBmgVvbp*l1m6J!56sdAiDO28^oYW33Cnx==Go+<hP+h26V1FbeO2CB+ot%h%
zO8=^p6X8n(gdIhWPEKUwYTzd)V{~%z%g-Nk_$|%Q$%$B@mk=nOpPZ~_w^;M0ci?>9
zI`8K$R9-cSm$l2VI*wstiqA=aJ^<6f*WbT8Z%N|#CedtyiR&8JBGkgZ=K!?<VH(o|
zSM!a1Z%Om6TXK80f`2AY!C%ilC`X4|l!hH9n;c$j!{<!+WkCu{9!np|8PB4Wjirkk
zfj_bQNG5qjxnvOtITyZOlKdiy!I_L?SCIR%UsCiOvRXG8ntS;(Rizf4USP?7KC0^f
z&v|kMUJSG9k#7|}SebE1J@-H6$yMXId?v>!T%;(8Np>vi0Dm_TtOj3}D2a?256L_R
zFCDFwxw_7--AslJ506^?Txd~r{(jn=CqS=|eNK*NS(GTU<%Q8MkTs90EZazsFu*dB
z$P0Lc{FI5r-{Y#6Y8ItmQ_q%|Y-%|>L#KVoYI3efkm@cNd+EZ0H)VJ9E%)WRb#u$s
z)ob23+2CJXq<=`R)Uq+FZme2EoiyiAkaV+yDp#R8%lxL?&3#gSZkz1$?rA=EPVl+J
zV<(FF+Mqj8qOWdrR76EA$JWO|eo2nbJ~4nTSbl9r#`SvCQOv_)=g#)BB(%F~^eerE
z>7aKkZqv39fUtDeXq7FYsx6#(whJj-3?=LnF12%h&wovcR_?GGa}M$~$!>RElKoQA
zH<zTLKb<9cm#OWlxf_bhL;r}(i*!w|{<(_^wME>@q3c^h9>1DJ;BFhup0J`t31hZt
z>R4xi2a1-51M2(OGAOeR!{yvwMb9|!%vL`G&+J}!W;;mMcVP&>T}xI}2oVss#6xh)
zik{pfwSVm5&_H8vsobc5!M;TAA)KmNe2i{*O$%EQUuJxkW&i~Qx9B#VXNa&VL{~!P
zAYTA9k)tVL9L<1=wxr$O$YJ{-L@}R4MKmP^M`H95RFnb3Dai#kF-94`j`)q_D1^y_
zX5Y@^D}ngsmubxMZ%`CUBqPdE%!y#LEiSWk4u8QE1uPFPXb`9SCa@JfQv9|0cKo%v
z=9{4zIGA$cVk@*Q>}!UPL!S`FfL7BFA0V>VxF=f8AJc*dX?pcN7zlcjYYJmRslss<
z^(C2ulo&n9;`(LE=t()c{S4iaesnDfDJ3xly38_1cIzZa)dp!CJ%H$?^8#@;k+G!}
zP=7a#641Gu&_o-Vs}YK6l+=WnqZ-DVk}tihXmV<*Dqg)p0m=E_#K11z|9J5R&YX)+
z^I#g~;=sB1boN8p*vbOU=ArPrIGwXMv)LjKX^oc!ytsit*5h&(UcM|x(~4YsBc>5n
ztHdNl2kQ34Z-oG(S|N6I3HfLpdD#rT{C}C;h(3Nx3NjkKY(LbFz+7N8?N{Yb0iZu0
zSZhq3&Os#c=OgX&(W;bf@bQWl_8)J~E<VjE<#`^?;|qbtHeT0~ue&cxte3MiFG`?x
z@vW(MkVTUT&*W?PG~+ZPvHV6wS$1EQXzf4VoVC9GndbsO6$NC^)c4!0jiplrn}7Dz
zt8;S25s702cWBv#ah)9=U8Xl^N|M|9>b-#tmIHl&$OK=_SA2_T%n2C4=ChX@-oh_Q
zzWzNd6nGqO;!pSRCU$)bA&FujaY*I7qxlT6IYi+jo@HqU#zbM{ekEn2S8vWfplhD6
zG|SOMDrqIra%sa1qbx60zPnFnZ-0IeFX#PP^|~6L-S-;;TgU}W!tv*$pLr?KeLfn)
zpR+85cLGP-XzSPVpJ|k!t0-ZofHdZO8X+-)<^|W`if(?@>%1;6pV7*v8`dIaORh~u
ziw~7hdH1Mo#ab^kmL>}itX-LE{lVIVb@Ki!M>m%dy+k+A<ur>XQ9@wrLw`5rioLny
z2`ta^^B01pVJgceX@T-oNb@8?`8)tUq>w5J<na`1ALckrZx98fOjcLG<b<g*wo7^j
zK!$*jVf9L#k?94nZ-;SuQ?J$Lr%PAs;tE}F=@SdB@!qQQV~4ZhE3<>QU;FpGe(BS4
z#+n>8pU!?5!?#Iih5Y!#hktK#bPR8sMR^e=v}oMO!p0<KyD11>G!F@Mib#;FSpMVV
zBF#97kE>U;Qmh({{&iW|rFY3_G<vmIb8C65sjed;Y}fF=ZZROd*v0y^9gRjOx~5@W
z(?(-s)IWMqfu?<9RkpR7?bm{~7i-#j%UWKL{(&Y?c-tI@H4@uNRDbv*B$eMHaAcPR
zi=9k|H9pb5VE}7WCLV`#7!>0E(TgiGCQdTWlb^R?vqjC$f1e4wq8AZ+`Lo4ziPq8?
z&q$Gqwfb+{^t0X9zn2iaZ*N^m#%CGNfefQuGGg9(2gYs_SaJ7B`pfBKnWZ!n=gJ{Z
zleULx>X){3>-dyj`G1A0I{Tl05lxd_kH3YJ<32jrw6*Wp(X9hXcV+gy3%BnUD`AV-
zE6C)We}T~}&#e|#cw8cb-<8N<Z;7Y8ecz`^@u?hhKA-XIBlu<=ZQaGQG#A!hVGvJ?
zBAxaPMDA0p-;{L?)OODUVIdS_$y|TxEfH-Wk+EZ3#!k^0TYt@`G=ONP<JmgZvE}(3
zTOlLZ(`+AmwnlYFw_PvTL?GL@&BH?d2Z(-v=m&^?fanK^et_r)h#r0hh<<?RpDIKz
zQ~>ynf_LhvvWZrvlOLjFo`W$6B0U5qajKx|)o?n(Xak%rhbv-#(D9mX2(%o%|1n1m
ze}+y!`oQbG8-E0=*UuazWsd%X%w}ub+igs;T2z}B;@kCOT55>s-Q169v2h@4j3<4Y
zX{(iB<*5SP(4Xt3ceMAQe?{AL8ofdrZ9Z$NT$t?bnqN_R)zCI>7R6nSaK&J~>s!e<
z{%S7;{VVFTtPlIuq3Yc=IK9gkC;7aauTj0AZS8%%nSUb>-QL&JfwLOXF8EeAlqDo_
z-ggqWj?P;bY1CRdTN&GW$L{S2_ih!_w{D1A?S}1R{q{o{*o~vw5V3R@>(tIHmOFBJ
z-^B(|NBDh;CP@@Vlq5wJ<ky$UabvWgaZgsR{$`M#_JO{q()Jn5cg|xjf3{mhcio{o
zk{<72{YdY;1Mad1b_|ZakHx>$^1q+G^4me#(s~h_9jGzQW0vi3V&G7-2)3B3W8bC@
z4g*4%M-66#t9Wf%ZEh;^6*6CzZ+`KO_l%eNJO><D&Y{=|ZWN)65O!C_E1sN)AR#H7
z0}Lh8CX!W=fe<SsV-XjE6}Jmae2LB>aa_g;qL(BqN_b7Azq{l}ULMd~h2w`YnM^nn
z6*XwR@;zinT*_!A#=BLLmu@`=9)BrnZ!5d>ia4~jNe;V9D!t|z0#$Z-wnIju__iN`
z6q!s!_O60w5h$U&6>!${Gyf@@h=g`$X&lj88D}EM3!&*ennDm=9T2gs^e0Y#n&kqd
z4bo2jy;V$9kHYi3lVcA`)qeA*C}>9Wjm3PcfIQ*l*C;E(2rASC=6+37pnnK`Sy{Fn
z{#Wx=EsGaP=LOFY)G=zYT(vQs#t>lc8#!cQ<Rs=f<;RNmNb7JU)k7pX?Vr}H2erpe
zV9&l_o;w0Oi_i`n>*7@J@vtbjov?KzY0f^9fX9s|d#O=<WjWbI$qCY4DZM2-;VE9y
zwe(IJ-zUZSU1@jjQ50(l;eY)YcAhGqu;vFYGffTaj%Q-arWPht<Ji+J-S#x5n}I#>
z3Ga>nrsNZLFsv<HOA1)XreB{B=V6$G4cl<d&~mY7Xuuro*x2)Q8|zH7ea<}+1p8+W
zHulI<x)uGy_QVhUC?5v)oO@u;$w5l0teCMPPaQWj(1O#;B#qO_?SELM$3;;RW+X4N
zIW6WHuQ^;ws_3u4yu-Rf$j6PG=G7R0YjvJ0m9&0*TqYskG_pm8pKa-Vz`bNfrW@&W
zekM^aBX>my-lbD9@B#_-1s%VA_i<E{=7?63G|F$=>C`2!PsIWh#3>bYI+xMp5?=$@
z%*QBBZ?HJ;Q2<RTT7P$?0Fl`&OJ`X`3Vxq-JH~c&JAr3}mSqH(m_);t6~fudLTrT0
zBEIcg{z~HKrw0OwJ-V>K+n~_jl|(N>;OC$tAJ2H!R<1_?&Mc_x9S&*H*fq(bbiQm?
zp});ZMnKQtV?kMq!Ze1Zm1gL@q*XZ1IOuJhNsJ)PDsGw|zkmICbU)BfgZ+6s0EjrI
z;V|FDwnHhl>@dKdru&#{)HE%}cf1Wq>i__43jnoloRY4452(;XfI?pd@F@w-)hw6E
z?VE6v7{*%0g>JJVqiS1AK2<o<xUtFQXHj^(z^^W<uM2)Y8p#7eo(CJAYn&Y7LFnd}
z4bO-&uNn`@^M7W;Q?igK|816n=iY_~R4HIXIe0v6`65t|+LABFT6b}%vW;6o>#hS;
zr2b44Dc`vIR{SZxsNSmjM*c0ns$Zb`PJJ*QV87j9KS=0sP_W;UHM<-3w?~`qZX>C8
z)b;}qTnGKp%X=I}z3I0fh2$c56vGgw)Al3CID4Cc-hcSj2Otm8oksB0`>qc8ojU(4
zA^fH?bl7md?}nbQnFcm3ZemLdLmYr>h-EO{w+SbjZyyj0&~OW>K)Hv20XCyr%b~V=
z^7HtX7cl<q6n)>cIq@}yJ<HUv<ue-xzGYyOxPhtr#L>*b(__D$9?d1xacgR>l2@=j
zvNRUp>VIZ8q+US5*XKNb6mUfk<X~U8#`dtr^cwRoGZ;{v4y(a%-0k(~rF0=n5gfZ|
zcr00wTa3q1o}>kz&WhV(Rp+RO&rF>xYj<TIimOGZ3PVrDr*a*YpLP^@HSr?B8fxnE
z5uo8hmq-6qMVnSL)qYTD`>dG}uI{*cVjH-i^MBClO2>`aT<?cd_M7CiIn9GpPCxDZ
z(Fm6E;yrAkGBkBgHKt?D;yShhBfx&(d)ROd&!@z+0&lfb#O8LMn@?zU^a=xMl(6VJ
zV&J>nF4(X$mjXe5dEnKn??k3js3Q8u94-QRz;o7UF@~O##=RqinC?9zubJa1#Nd=N
zO@AH*vG`qh7{k7lKG35vFf)^y1zb5i2e)WCkBev)^SV=&NS-E?gS&S9l^Dd6GiBV1
zCF60*2JPESmSen|eDl{A%QQ3*h+N&6jWW6TrdO85et9|%(lxbj+L-Ml`*w)w>x*D5
zrv2O&jc$hV^$q9TJ<7HjVOzpxTktCj`G4Y_7_*Qv)O&#1OpRXlC3);S%w6LYcZg8j
zEjIB^QHi^!?%XzLc3;3~kHH;<QCw{Fr0m(~gA2T85kFXQ*SEQ)S+0*mEuh%a!w`GA
zuVcrw0!MS0>6i!RN+rD*Kb&1#=zE@4E+{LJRFQv6IQxNX9Ee>VH$mlcCu$^8IDg`x
z>*gs1zd7Xy)xlR=gi|sHNSr1USr(dXR);1$on&No8Bs*jG-FXBJSC4o_$%g2c=06@
z@vF?@B4n5h1a5gLfR7FOcOK8Gz`tAR1(-$o70UQT%#KJ*l+H5>(R*oz3YCLhMed<#
zR78@7|DLd2cp+Qix{hu!othzLp?^cL<=8$BbXUV}U^xzT9OgI=ka+Llw6zwR8{9V5
zzgXzix;(Bo)2OS(Jc2MiQCUOsZ}j$2MDR5<jk;^Co_){L4@sD!Q#b-HU^ia?;CK<u
zF4Q|%IjE27Y-r|?Q`NmJ&yCR-eJl@-rRAzqrLF4JZH}vU8dZ(u$Sx2Xf`9H-YBp0c
z>+#r>%(hf(;*`R>gC;(b0^UiljPdF*DaMN!y6PSGdtNOA)vo-#U&CtEh$pK*`aB9s
zabtFl<f`laXeX`Ar}?z!NZSrgThA1q@Pz%qi!7pB_F6u=W4|HH=G`v2aE_9caq;B)
zh{tTZK9?>TyLGyef(PPW_J6^8v1jeV-ch*#QRj!vN5GR+ENol%nXB8FQP&68dJlV?
z*_b#cF>I4sHea6+V35r2BAJ2Y)A)0VKG0uy>xx$|U;)3_C|o^u0DA|~?e0>Uz<Wiu
zz6D`Ry`xnrPb=s-yKM_&>O%mRC9RGS@CCXokLfmi-7N(`_8_JmG=Biyc;U|ufwl((
zdYc?o4-Fn~l-33nX;6^{6{(+!r1FLKRIC=Wi}v&Pe<~VQDQfkil6<;)mgahl8W!eW
zz_I09CicCMV#hXI-|@K4O?E&A96^WhLGdxPZ8qPQY=}ZXia@#!=0ek1bZ;l%SCk_b
zg(1&)QY@ue0K|O4A%Bs&M9a_98Pc_iTcI=uiASX#c09@Wt;i}eS}?cFgfs=ri-}}f
zkdM%^O{udHFdpS-mcndBBt|(*K$@X>azlhiQ|WCaypit9$zF_UD@zPzZeY@YW8y#>
zK*OMz1g48E5>ms_G=td>unwP;C8o0`Z!RNxDHLqT1SQ@;wSPEJ3=8rl`cQy#+bS>s
zelK0_I}2Jo4-KQa;P)tCv0bJ&XbO#0oSh`&wP{i;dSHfITG`X|TH84Qe{FbujfEuh
zI6j8ys%A?JZJkoTSh}sSFMhw&`E1z<CP0A2=f_GJJnakPK3itQL(u-8jN)IhE)KqD
zd-OefvYP+n(0?MtvHJE_o~H+^MQDajH3Jy6h~r|*a2fWwPO#&7By<U9HXEWIzPj`V
zQie1vz$N*u&_h7EX}hTLOtdu1((8!vyk@Vvlei}w!o;^Nin&1wyf-Ouyzs8&<Aqd1
zgWJ-}W|=goxEkeiG8tN@GO!m7GUFgKK5dzC2v>MUB7fs!k2JWej42Q1gB3CZ-7{^j
zg*fyH!<I!&90bI|H1vsYTMpBFGSIK@oqpZ$B>(yX&of>|^Ng3XJeNY`b0KXvHJ6!8
zGqG<HjxFkiIB>iGhn{J2?lRNk-ay*^m`U3O>A1k}kXV_gpN|v|x~Bd48^xxMX&T35
zmh;!;FMn;G^?=YT*hdM2l4<t(Uo_1$9p{_RN0QaNWH&EZ)e3-^n8eW}c?~=p_e9(d
z#wb!0gkEt5q~@7a4?#Il6y6WO!=87Oigo$X$<~R+P?*wr4!SWMOB)BdnMs{rNBl;p
z$kQ}0FcC@T+SOfhStX37OP~(6xEvS&xa3dAaetH-h?0cKX}V8ZbaOjebc>o6XKsK!
zhY@UXu49ilJ`R0{8oEg=)6x#e6uh`N*4TrU(wvn>p>lmz@p@u~XPolrTF^$cz@3uW
zp``DJWOzAOOK3`NQNR%?L_{6Wkcg=hv2>T|JZA9aEQ``CDxxy^Kowa>Zv&p?oX&y4
z3V)FslF9s+MMk0|N+vJSx%#cFjY{$@;H8*x3b}vF@H}_{YDL$q6U8OJ6*v$7GE1TP
zA{~n|85hpLl%s&>02jfYDI@=8Svs8+@h!^uEY09X7qC`7&u0-82vvn4iHV!S`Gtbp
z8Og<IB8O8^d&%|$NyjCRK)49fFMBXu-+v*}x0O0Do&6$SWlxLulNG?Zt9gXk*w#aa
zEn-_Z&;yD?UpKgJ1QyZs!A8Fp<=rM~vO0I{Rp$;mUT&rSim{XncJ3y?`6!|$1<SLj
zPI!1#y!G%}>W@qB_b5DG6&@-YSlYqXINuU>ah?&7P%h4RMtM?@3BORYB0Tw7I)4vh
zek=sV<4!+b)!%n|J~~0Vrj3y?YDG+Rp8wOS*1&yj5iHs&(S?4i5ee9L>G+n#3bZSQ
z5~90;s(qd?QKmBh0U;BH)a;-?OMip4^EGhY9JI5+a}G5a$ZozKdOW_zHQhP~cUslj
z{jcg_VLrcw*}8joTA0??U6>XGXMc@%Jh``ca4K}KzPnJ8a2>ryhW6N~%N{jz**xbW
zMW}qaA&K*i2Dm4;<({c%Gel7y<_)q9kH=T{4IYRjpOI%qk4S?wE8aqw&9A>b62i#y
zbXLJF`GLnBI@}FR+hy2seFIxMwXtW06!Va9Qzs!eIDf*%CKc<~a-(d*zkdxol*nE<
zPuOU)`Ke=EtO+I8azieJ5&|%pB@i5_$Qr@2iNcKkW6l$>+H}b$g=JGsg|hF|_NZx^
zL`4czBmywrE6L;j3^ejh9K4A}XL`T_k73`@eQbGNfPK>@*mQlJFxLz<-x*9a_hF)G
zF)5uHYLk{MNwwef=p}k1UVl6oaU!T*^g;R93*+vxZo$?H2m`~e(AQ@bGX97>>wAPc
zK1LHzP1-+(lFe<kn^9=F<NdwcgV6mLg!;t-4ECTQ_;k(BU=P|2-F$2a;=?CDI5^Pc
z0qsG<>;C$$d$6+fnYF>nG8~bEnPj-}5Aw!;GG>x(lHLzer<jAmQVH^PEF~qNd)Q`|
z`b!5Ie~Kei?X3Rtw;iGzX_}Ov<=>+`3ZghFZZ`yL&Pq0}AJwZoC&Ah<OdviXS)|M<
zQU2XO<|IB(A2R0E$J+<YJ(t*4W>KoyZiuNLxY*JHAA2@4v2BFD<~lCZLwoPBt!tO$
zW)od)oRjc0`Y@gGEKd`e%izC}>FgWy_Pci#e>Z4ph{G6HVU7g}WOyNmG`s@*7a?1D
zfyMGuHUJe)MPriZuhGd#)M^SA&0C02g!m2F7vOEl(rJ`)bo}<accYUN!N3!MO|3y9
zx>!#>OVhAnrx=$e05UHw!PqAQwbAjnKfL+*-57oQ*AG98(WkTbkb8YPdowRCAqnw(
ze>RJ6F}(zP1ynmDS&@j~)~a7L%`z^n0y6w7jIzAIF!zK4D4p;de9aS<X61H3SY<z+
zBvlCL3?k$hujALkC?N?2qEeA|F5|*R34e;MmY1YQ6-5!wBL>}>&PXC6&r|VTdu}Ro
zih4^YC+D0@bM>0vL8xw!W}@uL3B1;qe|I@Fl%=uVg@98*tdm7TB0GA@N2<PRJNGy&
zLPk7FnT<mdQf%2S!Neg3*6hI6tbps9Veb2|Fz<R;Y|q@<<ZS)x*#~87x?P|SUb%_I
z#&4P&g(VR7509laf5x*YWn*ceB=9GeAE9%RSUl%h1mTyQ3+ti`my95MeMYh?e@Htn
zOoA~l&?F-XIz|8c`-~*>m_V@QKffuzgq3@Wn$ctZI7~Mr=x!ajpO1i(cx5W@Gz~u=
zRUH!1p6FC`tZqb-QIzR7%SNDR<I#XqIXNO<3MDbgj%77da>cQlva(1?r^R?k<}q0N
zG&n&jiz3PkK9iGI+sDMiqjqN(f7+BoxSv+%a1O#R$FmIR)=EodXTS@rVWV*)J$mQ;
zpjSw|1r>_(`Dl!O%Am9QxaxN~x6)|Zw{a$0UvAXxbV&x)o~yf}?u4<YPAr(_JMD`p
z;H=}tQ}@H%wjbp(*z_*c>K4(~!cg#~Zq%w9t=HP9P5BEYNte`3h1^xSV&uhx>qW-R
zN#nQW>%BWu@6H^(O9JMin6LH47A5*>jYmaP#BywX9LAPpdGF&I-U5f#=JZ~#VIBdu
z$j+S=YiYZ#8vROd0bunG%h=Kpcr)e3mPXVqjHlZfO?Qg7*gZp+Z%+psf0^2@;=iG|
zJoJyqyhzvd>YuxSM_ZtO2dfs9S|i9LSF;Gb-=f*qhmLku@O(XF%<w{N>eRwk=vz2&
zG=g=5GT&vE#aOs^G|1SahWBGy@E}dEMC{o{Jx?HnrS!pBv@z)Z@iUzr5X+fxVr}R9
zS&Ota6z&J0JDZ8#-6P*wfB(^T@K3=E4%*H}KD6%=u~?vf&}E{e;Bg#HctW}4uWr>l
z%hHk}61rW77~r~G3r<&|4c~~ljRce_ouz4-gi$u-48>`B1uN%@SAh@;1U%;nfm}?$
zvxYuKd9iPDHMzV1Cf<rzjhlgCm<Gk3W;@vObrTcEHn3xbuEq_+e{=1pOsuxB>2POt
zHI|)_(mDYyLI=*#@r-9}NNThs^Hxcv2Fq#Fa+mvJMPJZVflhsPSs6kj_jCut6G(NP
zpG)$qMN|GL;$P||`(Zj$$iY^LxwvmTj>|%929#k-GfeDrFT}pjnPvyn3c?3iyiY1I
zS2L1C&j0`YKmXsxf7J?QR_>c>Q7sQeVI+!g`@y?pGC`+kN(!DufQInn=aYnMDd7B~
zHR&(9b$22}pw=3iJw-v3G@FH~A4yy`10<_a7E*lIP$0a9W;4@fJ)@Dh(pHvj4s|rD
z0b<$r|4gF<T}25y1<5L%7d%5y$EXD>x52^25L(mGIMrbae@M)8%8wP4sC8h+daPu~
z3BCq*B!bJ5WE&AQIM<-umTX<p!0?d-JZ?O>SK2PwM5$)4STemG-h?#YO5ycHvqbIU
z(6r=+K3I1qM-PeaI1GoTreVt<4ko5yVa9bYFhdqvRDULtaBy1}MCTQMzLbssu8s`8
zNjjD-HU)(Re~CG`t<pkm)+X5^r9apz=Oyv5`o1ex=Z{g=<@9npQCEYUWuD{U(6lUU
z5#PYX3>fyPNlj`q+xLbXw2wm6Z7%9|MN4v0L_B|0QAtNh4{fiPAU%x|5O|vQ-L})j
zO5v`qf_&*+MO)@OByoPP(!3f}*}LgA=3izoqT0Sbe<NAWFW}rh?p85+DHkzF-?uZK
zhQ|QUCzDn@by?F=zm^{ALv4ZIU5|j`Y5}Uk&}Z?fTvO$z9o;~^E#b<6nyNwsc$QET
z(0_^S=TSn7YN+i8g(AV4-Y9j))f3xjBAtg;S2}LY=6X$}>^I42bD9UWWSv?9E@DzG
zd2~WCe_Z7UE*Vp1JB|@z-3)~65nvK>7i+{ZEt8uhu;~D^ZIC_iM#*E1Kwh2M!tfF$
zEV_=^oItkp#WYu?K+#{Gc=hT#;gMOU)&Q?&aVdy&A!TDRz=@=BZ3$_pdrhfZ>Uavy
z52bVjNoK_F0^^0vjKppR5API_GUG;tpa-{Te>#tgXcqHk!Vjfyq+rkioum5dX{Ks@
zrou)0I+W#><#}DEf(nY4>dI}DkwpK!e82j65ANnexGzt_JNgseora&xF1JMX6o8@a
zf&TC@X93s&LOc|v+#w0T*1XX>`!gO+4DX{9*w3Oz8JFAdKI#=Jxs`<PnwIZ7x`(-E
ze;L@aG>(aF+n6%XvwY1rJ#TgF>cL^(GN$6g*|mkf=P4@VcoyLAD)6ttcG}7;t0Epn
zO?5iHE`#YBiqukdX!UlCNSr1U`7rdMSwEWaRNUT7y>o1(@Av&(+qT=O+o^5awr%Uw
z_SClBPHo%n)V8gs@6Rva<oWZQ+$SeHxpU>(Yp?a%$f7K=%oqW<%CWJ6<8(*SamYNh
ze)wa(V)5xrv(yL4pciGjYHCpALnP1o!+>8#86qxe1s1lZpUTK3anV+PeZhLQH(`8N
zcymvJ&p23gaJ6Hvjb;`=E<%ZSxmwb9t0K`Zm<RjjiZI{0BTt(|?ca8*rUlgP59SsY
zk)F?G8?a6&J4x=z=w4jZ{;?fP_k&0y&$yKxw)VAZ78`(KXr2;&^X>hfm=M}4`pKb7
zT838#wXg<k-#-YWl$@X;w7_zd(gRs^hnr!Zsk(dX@xCc$d(B4^tE?NVZcf~Z;Kj_1
z+)3zY)o?Lv;8<-QwOW-bE@>cKfaHI{lt2ALo2N>D^stdK)2;||l-k`CL?x62zAjRK
zQEVeybiRAmLrk&P<<b0{J67~~i~-Eq3XYNy_%f%P=xjBSNN)P9I~Um^W)*s|K6~fL
zd-VJ5h+@pqdD9VY)^8)#-yrBXHESagAs0nQ{TfPWqI*n!09~(M_#5mEMhwP_7yk9y
ztCj4lUJOH4LCAJ}_{$okUYEwfrJu1BVj!iuW0k!;CVlwR|5VMw0e}R=o(2%OA{r0K
zoBxq9rW@4Og}qZ_5R}|HJ37gMUM}3yv5L3W0+$L6i4^1+b|FUXfG_Q>A!5LK?#S$M
zG1M?1wFe53#$d1syZR+5M<O?Nw>hawOhRLaTnKq}4X=?Bff%%vXQq)D9s2x!0FAyJ
zDTp{Ld5*l8G3QEKIlQ?_#ekXhH4j7uLuI9<K5CnPY@n&&XxjgY|BF6&9yM|0xDF$Y
zzWObn0}U3EN=>!6GyhHp@b}V0Wfe>Xh`RU7!I&nXSBaC>i~}&v0z&Edq3TUhK;QET
zjW+8&b~Z|mut0n3YF}bQs+ocrxAmbK(=LczG-U>m8hjAz`ujp?0q!Z|NEMyg9viJe
zh-#gW5#^pquN+XUxZ0t|djiI6&2%F!X-B7n%sD|G?+3!k(wxtZ<MrBMRJa6><#x=I
zaHNAN#ki}-#6vmz;N8`pq5C$Y&`caso3&UQI-?DN#I&ztuOYmbqr{>G{K2G%yQA`a
zc&~mcu^a6A1zS>~03)7lWrvX<Ywn(}3OO)GdNXK|zvGh+;yt#tZ#I9(9eO;`)nllo
zBBOU$GA~$iR1|1=8i*s3WVzvwQ$`%U?tLtqaGV|uY09|fWCviWn(3zcF<{AQez8TA
zTjmJT;#9c@<DmukWdXxV_4cAOI)L+dMgVr8usR=h%%SG>(cOj+1mE5z*i?9Vz)tzq
zusxv`?0=;qYe3>6Rn8Q`%`n7p2%CIu+RAB<r1EI|%&G3PaE$J*t$Y;Q=a8cK2lo)`
zUt$(~!-oisZq;GZglWIHHctf$ZZE52V4t?4VMF_P#0%5Fa0XJWo$;{vMndg3GV(cd
z#5Vg{Z;A?U-z7!kwv~^83U3av8-KrbD__isZ1T&+B?^bf*mvKWW1`wyJ~Wt%c<}#%
z_m?_a@CTS*4;i%J9P&i$0B>IMH@on+z9XS-r)39(*bLlZYmA1by^J8EGF;a{Mnrx`
zM*f*$(Om(J<SjXk9~&C!E_q$8w-I9v%IJe=4jQo)cw@<(+SC5HLSb6}W@pOw4Vsov
z6L>1i4d{IN>EVgdp=<eS1nr2CbF(_78>2@8nE;xraqINuob9s5*iwzql1VpeR%$=O
zMhZ@}iQVP|%Q5Az1u>%+X(b}52HFaZKliC8@T2vdtEpxcQI?@jSn7k!kF?{*(YIvX
z)o|Kpj-wkw0`kCKCp;MfBcjZVNe$gpZKA+XABUsZ{o%da3uqM>$`V6pfemO$YQW`i
z^MD%Fos0#NDZQMm5AxA3_%CkG*K}diyi7(i&ujhMth}CkxUwQiCv9ZdBwgws7YtvU
zND&TCSMU#L48|kPOlL7shKO0+ajX!|H0!R2a$)$uz<oa*i=yba7}(S}rtY(Q)oRTj
z9uU{&aEerL`65k)?z;3vNbqdd$&3tJB*2;BjwF_;@`?7O<lSAph&5f!0Uc>`nX$r#
zYaO-#S^j=nnnRE=%>#aRTgs8Ld9M;Rt!e1ICvmE@8uiCg3WD9a{h?bMgl>Rz^TWhL
ziHLELK@Zuu0v^$^6?^5MLT5X?Kb>AuLd-Cx9(*F8wh&e>FxelHvOa5FD6M4~UjVhM
zBM6GbnY}U&z4eygZ$1y({Dd)nO8{-iWEX1t7M&*vDD+YkGHiE3%X#w&dAU?I>UnfG
zCWo4wXhbJpm6vp|nS*waSrWqRoKUjqwo$j$OF{SE8!4?I>=<0<x{p&fNw?3-)(ngY
z)GWEN)F`z>;|JpWQx++ThQaUXNPzTT(nYf7<!$YL`e|m6`W8%co*-{vrieakvs0e%
zS4Rj{!rCgdu8OGUcQ&D45-Ux=nZ&G+d%sp}v0OV$*j<y2?2?2ru-5i?KHdtd3L}dD
zo}(9~TGeiMQX@hrIvjfJq_+eUvr?VR6ujJ7;sCXk`d7LxkIBtuEI;Q1JKMb-4?t?U
zN{V4Ne>4UuX9LUejuvmWr@Lt_EeB<r$P@4YPCk2vwsK(@tFEibvLE8~NR5rXBwv{i
z1~$UI=s_SM@uH=|&Dzk;+mC>?6T^5H4p!%=eqZ)B`(*MMuHN%xFIkz!PEV-V^x6JO
zO%>Gn5d;3T3(lXa$>yoq-C>4;dUJt>faS%_w-f>UHd!SBjbi;zoFyWTx+9UYPz=O7
zfoR&KY?Ir!o*ph>njLWxxbln$Nn(r;d9N6sR}ictH=(pP=83KGgaERkrUo-OoXB`^
zzsK`($_fRSNBZtR?F_H+L?E)oBHsb?zY7co>_Tnolz>>ta+v2;nt?qGBw|ocA+-@>
zhrN2EEy`b}66=46l`GrU3LMk3hKGF4nyiw@`SVubu9~tv3&)%U+|oAg7dIXqX?3L!
zHseWO)OMVWEWOd+_AIx@MhL7G7S(&L7z9|?7r5pT`^(c94BVmwJ2d%rCx7LUu!QFW
zHhmpQmrS*N6W87Fb9h4Mr&2$wz0^@Q#ty?u!^iGmEpIVsIONUyuSV0sLPXGi+J~AK
z(dkUpq`ZW#BFsZ<x19dUj{+}ZF65Arv-1rmnTo8>B0oh_Sy_Qb&SKUlQw!MCaVMav
z3h|$RCt7BO)=gm{p6~hr&&syRKyCy4;1v*>b22o+`^O5LM0MkTR#J_?HX_2pe&LQy
z-o;c3PNt0WZs%NfkyxlorCr)Rn8%}-v77gdz@5QIm_U@a5o>%_nk32pVdB30KOx6k
zGNkctm6oc0T5>iFm_B=20)r}sZoKDxBx~^4GWR}l(0MN2Zd+B9@(}PDysabteIAR#
z58bw#9vdflg1zblJ(6?CSk>Xz%k#?t&la>};fz5Y#jBcNkG|IBJhg4Y`r;8}CA!kb
z@(*qH43d~##MVyBcGm!5B3_opa%Yn*QYKwp26&R0u4Zfdb_w=IYtPDL&^)v5_ENw@
zhGk9=U26L(EI#B$hCP5gK;Aa2W}aDnsmqCvdUjZ&<BW|aNmli4q-jSmL(dnn*7=VR
zmA)61wIhaYQnE-zNsQCPib&-b$*})m1<$9C3#k8)weG^#2RzImN*_y%G1J8B`CaN=
z=1M%*bLNlkot7FbIL6}r$&g`|5qm#%TnGTgKVT3o`7%|dA%c4_LJ|LS;5s=_pi7);
zs1Jz&usJ?rqJCko7yx|vJlMmUppPGYo9XF**c3I<m3Y*}f}8LC|CA+T;50$Y{GiW6
z)jpFM{bXSeati4Wgzs#9G0ySiBLq7eOT6E^WgbKJ2}xDS>iIJHpaQ_(Oi_L3rk=+q
z<fZDKOCyw)9i)#^8$ta^;|Kin0Pb3fRK0Z*z4+jS=)>B%Gi=YcvD6!0hccREPBKNf
zsi-qOLEBmp)0O#c1umN{vcKjSmd}*qb2bEnihj_ty{p90F;1be=B3z>A#P-IgCH{X
zP<B(4Va591VN%f)pm*`>kBs5UULll{X+HAqZrD0!-_MdYP`F*-abw+j06_P!j!_1I
zSvUA;y$>Q}&G9agiP}kK#u3vwH0d5Md#Ma@ouze7mJdpe_qj3@<x4v4nql381=r!Z
zJg|mFp05-u;J!Pkc*BXnC&F*clOs;F?|(|Fo!ut=p|jKkk=!bGZ*XIpI;=t*%r}K3
z7x`}!MhRvX>D^=zGBH3S3IdqLhhy*RVU9m^kme>ida5W3$_vg&^AuLI(4N6e9>p?8
zVY77G5qFUI#o38bK)InOUKDsr?U>ljT^mPDh1gJ4XIRH08oqjL8GOUk6Lj$^qd3Em
zGb!}yK$ah$)`dvpl@A|p%@+nQG*Ex-`wCw#1b=U>*yGoZ&pBYJp%uV%H!`x-<s6;X
zDszzTwmP_3bB&9`%vyCinTYKJvfWZ=p80RNY(|I8<Yvw1{qu1Eao}*J>*MQfH%#}c
zyT|XvaA8S(h1QPm@z~*(cMtCuBH*@M^%k#D?ceQI(85JsZ5Pqv2crqbQI_>8lMp7V
zwsXCl@P-i|Yc?Rv0oligPX>r<9DVM1{oUosul13uW$Q=9<ks=Zo!+u<y+8BX9ajdx
zvu`=<v!Xyxh}M6GuxFY#zF^aMImF^W`I`S8fo`)i+7A1WVS}$f_M$+Lo%Wr9k!AAF
z%Dm<Vx?bR+_E>3P+{w9=u4{6-a6ny#Nc_8ESPI^Xnh79;$J}@Ly^Lw>Y-$7GhPeH}
z-i|r^hyMaz{u+zv5gG>14913MWMJeR$cvKJeTtQG85(9nj7fhlyAI>JAUTQ4HqHYI
z+YE!Lm~v}h=!5Y`8(WfM^>>pT5e66ELdehVPb}yOm(*La)wcs*>Wzx<2*rdS>nX=Z
z4_JGY$26d#qxG_M-e4`Cti%B8z;gfu8sRs|o`)K0us^y!G7oxr_)TQraVhe7a_N2a
z-H6GG9TxGpdlUZ3pCQ_jd+4Kpfx5#mwkMmt-FOtSh~n3LZhySY;O-K`4#+S!W8<ci
zrkQA`SGwTWXfpjI>QeXd0M-u0ryrqSj^AKkjUG@(sT7-^IBw%OAaNY`_zp^N7_8Ua
za^G0L@*JC5Ny8f!fg$g5r$rxXlT5Ly)<?-R?dj+!c?U~yPbD9@Kc&eb`k>29buSUU
zFOwQ|=(3i9UC3Pc=$hJDeqJ>jWl+vs22rVGZiHc(tdeEW5y+oy1wT)Y?6FKg7sJWD
zup|pk0rGbo+h3#R=T|W}o#A&@n|4h7l}q8#6hZh!TOE`O*oqw#L#<7APjBzqHb)NF
z;j@IgHY-o`7-2#i%yoH$6t?o`P<T+I2%oO0+$NB?z>BHsCXi$RsZnJyDk_MB;UI7E
zdnq&b7c0+mbdv_ul3yUz2r$#AjSritM%p6R<yW%X?80KQu$j&12GZ;t2(734@w5Jp
zG)?`o`TH~Lb5ddeX|jetS$md+33p8zoJGI|J{sW-JSl@4tG{H{JO{kNX|=Pjz_sYH
zkDhuD6Qxr8Q=^IjPrwGv44RUxJ+lh-NR7^>(nQV+RR{)0&ZB2#Ti^Z`HDB0wTztgg
z)&eZKOXpWxHlP)4US|+0joUNMYix%#o+%iz&JrR{3Ld_>kVFxm8ymh8OTE)i>VDp(
z8&F<PfA;2?bIRUt@nx}edmjuEltxMiU3>|dgVt8>d>|nK6!rDfo&vPL7C|OF`P8Bj
z$5xt*T(k+Ru%y`z!w%Loeow}yQT)YT_V`i5&xjFd*#~i!;48vvD(eGCt8&pvr4Xhg
z>zyQm(D!LHevdbL=c+|hQZWTC*fap%Mb|dJo}!+B+?({9Xf#cGERxrAKMSgwo7tOi
z*5~~cb(i4*??V}yzGzQTVta_X!r7wBJgAk?6HCZ$B|TisVlzb0qx&t1NtG8rZ+_7B
zv*8{fDEZ*EuPf%=xh}CPr@c>V{`$DhCKHjUx_Hf`F7aYt_JS19@_vBofv5=oDGLJs
zaBE;F-p_irx;PX&0^OWey({3ZTXoNPK(<(JRxJ-eV>{Sfr@BrFLpRbSPw}AVY~h)5
z)m;f2663Mq1RlvT!&&{E<?p%ZqR|_gr7b*N4LR2K$Txlm0var85%7hZKHV+Ie~0_w
zp2NtvGzQlDId7>t{9FPq82D10%y`U`;P6c@PTWMNykBOs!5POHQq{?vBTD5Bt?Nl1
zX;=YhPjejeOw<=^#4{Yc$1X*V*w;>?;1MUA<}hptPo(WgRzn#54K6A<j4T-cK`lE=
zyYG^7*ng)`yop^1gkmp9Psj-&p^#R*KzV%fa_N4pvRvWAmpRmurU#-S5g9mJ>0=yN
z?VNB%Ju1=f&~J~UoLFbZFG){YWu}=VM2!qcx;+oy_E9$54#YboA;*r9WC_`VWUQ(L
zV{(c(6O|%PM2DVH=pA6$cQ6nXGdH}CU}8xoV|bs)C8t0NK?C0?nw-DrWu{vgUOa@;
zCiq=n`;M2HgNgO;$#=zL{OIMmIz-!??aw>NvQ(S1oSfPPe*KW?TScZcJ=+*vJ1{ID
z=pT;}fB6*YGaOe=38xLJ|DI_%@*sFY;4iR5TWD*;AF(Ybe}a->9&TAVX$9GjGvmgD
zfSjjWv`$IYyxT5K|8M_zd7Dr4(M?xG@uHh176gVFF>IZvORO*Rj)uF?p7V@bc(as*
z2gPq+$0SV8uFCayvkq^wwH)k1pPUe_;Qst{+J8caDXkmBXIrKd45dG}Hf`VY-qYJN
zbgplQCoQp4CcR^GvZOm~IOR=NV;1>?C6#c?m#e6740?PSBHob6agVV%w0JD6PDTqO
zoIjq^s?NU|+GkQHEg&fXlgq`H>Ybp6ykKTJLx9YmM$W>6hH{*#j^+D#M!Zn}aa*fo
zol<^2P~Lp#a*w%Sr&2vxwPkHDx8UGgaOBbw%k}bX59Vdi(}^o4F$33@MJ&>sj-L+x
z@<ay;=yIm;rge^A6J#>DjU|Br+oUn>Z`T^q(@_O`_-&S(?Nl*<^VLPN`mhBCp$sN@
z_(fkoyd7EPYp-RYBHt^ke~0!>-}m9?(^DE@$lA**woA+7p)Vt>!?)}0l5LNGLFcc5
zT06TGk{r;xjSfLc5H#82h3E9emhKn|MPU3{#A(KPPT{a>$CegGn;3C(P0zu4R9GpC
zTI<)bb+I%#&pZHfB)pjazYKrr<|_lEj2hv8y^XH-(EH5%YO7-4!>)=0=tQ!|<?!nz
zN=)DuE5W}=r^nrfp;#3DEehxtu)|vHf@o+IDQ#pP*Wnc6A?G>E{ej*ii?Y9kA43^K
z=arQBkU+|ET1UX`gHGFp1a4t8{nwjvtt{hGVrZveCCmc|vP6KAL+x9$Q+6fJdhDPf
z9ZL>Y#C@mjw#_ShuG<v3mR<-1Qrq%-wiB><id!wi`tuHI&6ju=MKSQHgeI;zDVP3X
zf~;i4c&1*Q;(W0UjAFIN@5HsP`ePwmr$3q1y&+^}p1OSo4#|U?1ZcXy(nHjhb=pJJ
zSpY>X!*T#V!BVXR;SJ^j{6)`3@dXMxroMiV;^xwe{UdcWS5F|Jx{e$jMs?J15G}uK
z9JrAxg`j=$n^pTv2U`LFV-!Hq5D+6^iN(q*ur9m?gD_phdms;9AadZ0&y}PK%Obco
zjU<@;%qEoaV6I8-KeFb`4XYh)ig=x%ED<!U>;-_6Z)mZh-1uw}I!M(r@_!u#+eYh~
zW{Xt^#@pd>oGb-{fA(&nyQ4_$ETm|g@_G~F@J*aUC9MRI$F?ijt1z`)4keY+|I5xf
z3OL=6SDo>30yFAy>7@`H&Tr^bWQdbV9EVtB3!QTsJnq<%CV1TJ{t@uX5Xi?9g##om
zh57&cgO{BpBZ)UhnSK207lZpcu%%KW{3q{tAyH)Ep4))Pv{YOzQ~fI^^fEmU6f%)!
z(Gmaub!I);T?@lkCVanXgXcP2+$z6b-`-u0tIbcEjni=kh)WTgJBfM+e-W^`j?D3r
zy7+AWdtPR~Zhvfkwzl(P`35{*1ThKzD_}v(6xGT!U`WAJAIX&%og1NS8=t5ydivY&
zC;45$>6)%SE~eO<=_i}VlpbMoPkF34=#1t>FQZE$=!iUocgUQm8z5iDs2MPGO-5?a
z^18ikPL@6bR-pX#D*IY|wnFtr9yMf0>g!#39mG*=5X4O<osts4ZUl%n==V3o1Ms29
z_aqO6d^_9+wX_`fZ);I-e)+Ie;1D@xZP{1|w4z3xZH><7#<k-oHIh^*Ck>Ku({q36
z|8&+IYWJ!b%AtgV|4onM4J{pVRK-Y=FnuV@YuHM|!!W(NXPr0;-mNvWdSEZr?pvxf
zO&h#~hkAM@6S<#=08yCSM3V+RCbvH{@fG*|RNAesPfw7s#>SbkTiPfTBp0&mwM2D&
zZRn+@xZ$55n>E7nBI2PcIm0^M(mCd5l3>`Q<I?ky)E_wON-l+3e_4EmsR~p0qwXK2
zttylK>?m`>*7tr%s7zbm=QBI@gQUh~4xdAQFkjVupsGU=P}}vGeL@==Qqzla^02!B
zRj^qW&npm|pa|~DP$kAN{-~Z2v`__f3I>x{gRN3uP+p=!em*om^>w!4Rk6J(?rVPi
zKwdITsdpVrE%mUZL~gy&(fy?Z%c*wgy;jD_zB#x8f^p8eP8vS2+16-8XS<?WsDDbQ
zv*xXQMf=hY*hYp~T^?)=A$)WDI_7@OzD5Ap2B!ZnCisT%znCCyTw@5i<%ztx<d&&b
z$4-Cf-rX!e$vuhgLM32}z07&%?V2ZQZiyBIv(w@!_^+Os^8gE8V8l=31-CgQxU;UY
zUvkQ{Vpei=f$zZdRQB|hhQTATP<ai^^RMg!025x1#>WxGR<KDjH6Q?W#~4gRE>tGK
z`Jv|TH_oTAANh$T2v(CugA`OEnKO)xsu@=6k)Dj62on!t(RrFI!1|J^3CEWS6e2OI
z2uuP$zD0R@z(zs$z}PCvFTx^y&k`&bHt&v{myqjUo<_P*ub8Gp^q$r$0gP_hhg0Sc
z=wMWjhtr#j`~9{t6J8SC!bd~Al7#|fV2P{?8Yk`$wU;#Re;s2(d_7MV-9Tjp#IG3Z
z0kS~TNLl9i3ohH4X{tw1(P`?QBqKhsu;(*cv}L?z(dG1&wjHEZe6e@8E|W;Agc(IP
z@$)u-(n5)y-6*m8PdxL26VH{=COf`OD%$|~PoEbIDpxdJo|5!WgFpTS!ow1SO@sSR
z#D=U*ABpCVW4!7FMux=^M47wN+P_5nzneb-+B8F(30&TPk&?eUWWQPuB*vd-6ULcl
zWq_G%AB_nYNh;O0++b&2+i<~xjgHnKnspd@fe-nXvxsIvOK=4_istpQg9~)@VqBB;
z0QWKwcC@m*eG+I<g|`_dAbd2H7C^iB9jMeCT{80=*+1i4aPQyJ#y>Pey}w=YHcaVx
z%0#_8nqUTy{Ca(=b5oZ7^pdf9WyqZtDIZjsJ_jp2DP^p0sQxPbgVcqhCC-vycdrsz
zs}oXyy@yh48F@6w(^LfXVf|M+E^y8?K;qtuxZb~_wdA|p@7`Igu3iQlyXR^m(8ZWQ
zqO}7fUq9%j6KpbfgTq<*xpou8yT1Q7F&1JKzq20IpRGDCerx9Z*%$~059=Z2!}s60
z9d$~}B}qFNv20ln!)NIW{2LS9%O^6>3~yAUDkC8{mbrHo$8>-;o6TTj3{VuJ(!4Jz
zh9ut9ZbLI@qGG&SJ%$<1^v3Y;e?dTGBzt02d>Y`{r@D=}IDtDuS&L2rt8>mZr%kl*
z%+pSVsR*lO{`T?!$NiXuwBsZ~nljb%-iFKD_$)SktTD^)GNj8k#qeHJx~sFo+8LJf
z$F7vzsy}~bgflyUQ?DH%F_A}RLC5MF>TBtS*t~Cnm@eE>Er-Af0PwGi0$d$IwAxFz
zE+Lw~g9VdxNyj6xwTMR}uQUGqqwNer+OVrcF~lV#%mUiLa{}D{y<K$cKkpAZr@3Zm
zWgGb&UM;U<!|QU&dc(`ih>y>`xU=e%9s?S*p2mEnEQDvYaWN)cJHnjvmthK7!VB<@
z-6f5!Z~9^}(Wq)<0&tW#t~|RaVpaXcF99*`S0_?arE>85#uJc{K-C^AF@U2ufu!uZ
znFlz&rByFUnr9LW^qiiP(YVNDn*18`zxcwn>I(Kg*_bfV+gaBcL0G|VrX|=BK&1MC
zEj0APd+wacdw2&ly+<S#nZCW1$>>iskIH#Vaq%nfWST2^F;ER%jgM21z0R|8iI037
z9votUQ+41=gB(id3Ds14yq5hFl8QsCI>!!YDRwWlNHubXqyZrH?=P5(XLTz|XNf^W
zwZhu9D9P%S!Yr!B{};BkhT1r<u$Jtf6RUo@pJUL}q1F*%ws^%Vg+5zX$WZ-C99lA@
z(E8e#A!4MZcIctTMZ{xJ<>w>(RJ-M{m5bAL!+aQ+!?L2iH0EB?<m*(ZL}GBOP~usu
zLPU7yF3VHU0aS~rY7}t<$RC2x@L!fCf1-6Jb8Tk07eBPCk`J$!U@EKE7074~MYbsL
z_f++^R$3xF#oMA!@HL&8s5!YjyV9zu2Q<%-dpO@0WNNd0A5NuGGT6!)B|qQUd^PAY
zL*WMqr@9<$J<W~twmz^<F)UQQq@aDsRM2!$Y4s{S1Ed8F%fxFHCH8zwKdw^-fxmqW
z_JF*-Rr)zK45#xU9CZi!CyRcFNxi)RBT#P8@RSR9Bl*+!(}6#}xSs>`IF3PJyzPk6
ze{@z!*h*tqjZ!+fK*iKt5kyhF#*$<n-q3=`M8|V!vcNll(Vc_lB8Zp9W@KKY*T%*&
zC#HH9K(q=AO6V-T0zbggc5PqhUi0Nd?mc-=PDmLc<n!;2VLBI9TEd_M!ub>EoPLhT
zop^|^UPi+s!%~Cg;ZqfXKzMez(4YF7#0b5@0R|m3-x5GiO2sI<pEl|A)&5b8Z;XuO
z1-?OKsK7L(_Z?M|Ub63V|0)4)?NgiwkL~*jNET)nxp-*@LI@e(l0SeT8Z>?IlNDgb
zNI}dB)p)9jo%aXJv~)u+4UWNeu$OEmCOsMnq|^3=a7)FYr3K|Lu^eU>bMKUIY;dpm
z#YAhYL*Z!~=6lcyghVEZt{Qv+LT?fc;Jz!w3vv2cYZr96hfWQ!?<3fFrQ)1)!QVUt
ztgg7m(v9QGxWpJv{Pme|)>+s;P_T`OBr6b{C99uq7Ccxm^&<V83*PCfXb3q(U_&s7
zNHzJL9VazSUN4m~C%tEs%B^UtomMdJHUC!@giJME_COM75TO@$NY$murf`e4USs7i
zGkU;hjyjHH<I>2H%CYl=tFQI|usNDGAjxX=84tBl!8zSdBj<>R|Gd9a{U>j7Bl8bI
zgrGjMI>i6kg<#C1aR_|8_-E=#pzHKdFopjh#6<jb=j>gD5&aadR#abx9jO&Tk25Hm
zO4dU(b_v2gUlz8qx*)v2bc0qpWp-Qve0LQl91nNW^(MI0VKD8q0w4p9!<D}Ru!@%1
z6fDMR!xpn^(H5N~vh8Un>f-Y%rf80=;Q%!tU;r`Uhk4`NJDxa%()|fuU1^JvEzwMx
zo4t)O&vB>(#u%`r$=(`sp{|K$(V-{l)`&+=7+oO)7m3wC3+4GkHH5ooRK3urxOt9Y
zbHsF}XFYXZMb9QMjR?<~dE~GMQ2B-M+cpf<%4h`WUPZ!JhW5yqdG<npop-{xGA%H-
z^Ji~lm68-X5{%8bZuaXsH844NZV^%hIg4VkM1Qz`>ilji88==bb8_kRHIFee-SA1r
z&ugK@w2P9A%v)`VjQQ`QfwHGPInuh9Vaydw^J}Ls9j-4YevQv%ZnO3paD2%q?ZbP3
zB!Ru20h{!%H(rFw%|(n(U>$Ui$1zN^`22@-0H6l5e-(S%fBwsT8n+F2ecdPQiRyY7
zxprdyyzS_B`Fi1P{oH?U_~Q3Vjh`m$`DS6*W9h>AzU|0M#Qwg0?{L8wvIO3SUVV()
z-kvmjwLZbcExhhlAc*@0ynNDj?XGF!kPk`NmGS#AxGxg+Z0m?U+{JB=*<gr|4}OeX
zlkEdO5Na9$9|UF}gw6>e_i@|DoG$b-%uAmT9$<*%7jfI>R5G?Ad;ET3Q*R^J9}~1w
z$7{SV_4bY<@boRUbI6Ao_$X5Y2<|*Kic`HJutGLq|MF?c{;{hAGI4S<cXXpBvbp8Q
zrXEez+bdIBbWMZP$~UgsJ1<*XFU^>=%|affI$(9&e{LN9OXlG<tg{UeX=<+>PXU`^
z#;;W<f?hn@$gu;BQU;25<8P&aF{AL3m-sBxQ!ox~6Lg_LU}*FG1=TUJ9!})~g~x}m
z&QI_cwxE!Y2%&I5HoNv-Sd4tgitRBuTU7FVar1?5dEn)Y=-iRFVsS;>8Aay(woTKU
zkHdKv^VC?->k^;eqCCIOk^nnMR6BuN`juf6V<c~w^=h-swi&{$?=kS?i2RgjlZz2$
zmoR#YdIiM%Dy_*MX{O9ura?ROq?Ui|O;xr6r#V1U=7d~;Py?J2>2zD;>@_rPuG`<Y
zLZIi9PGyCt>Kg}yZ)LxO!POHnQtDdDHdy5-;71bLHHr7)$VD$TUL9g^>GgJ|i+e*&
z`&xeR0gY*BNEGwo9q8@+C+wCZ)kUXnB%68%3BTfbK?rD|XPlwR)O!i!`&kO{_WTw7
z(x;6>L2jT^1H2$<q_bJ2tIuVznR6+|&6Tg331$u2T&1PA{&PCoFC5D=YEacOpqOXX
zZIm1za*5Yj@lR|vQR36u=;B1-ZPcDkY1<DDi^Uew5N!9S3QU7zqd~EpRqIR+K{5er
zWw7fI=fVhioTS=LgA)UG>C^{;AIWI~`fY30&7q*08-UzyJ8N)ADe41<$J0ZP2iZw%
z^rmm-h3;q+rQj?riIe}pArZf-rKBir^RD&2IZ>dGlB<_4XYoD8Xw_*MPfNYX(Are9
zDkk&iH7Ua*1jI$5dO(Jc^Q>CWEWk;-<6~Oq?;A(q;=SiU+L18k6KD~%^oNaF-5%gC
zv;))b=x@!4(#aoVqm$6cM~cE#iefbyK)f!T9+Osg5--1{K6pdYKv&;%a{XdBNu)`2
zoB>A#K)Fr6kd4FUK%aAA-n#NI;K=MYe5RfV3+;0<a<j#TI|{=jr@Y}fVp89@4(_ZX
zje#0K1qNrK-A4;A71Yj;HG|r+7FH`s9c#J~_Aap{l?QEUUvmvWVL8eK;t%8tl#T=U
zIx!l?8sE=4^B$+e0wJYtZ$>dJ#-i#_6bZTm);9}o(ggmrqX=*Pt3KbH#m!Xt_Yy^I
znE7DR>7|{jt)-SXjQVdJhJHPAzLvotuO~Ya2jH7;^jEZ)!H?UP_4XWgE&SyN{82iQ
z5v(*%r4A<5rGRIL83b<U3UV&H_G>BV53P~57mP}T(=!3sk}SDy&)wE<g(=$ZBR51_
zK*FTEX3bVKGqUqi<J=jJ*DnY<deTP{GDw833-s=#Fbms}gGFw#@+~^e$Frg(-`q>&
z!Q~E(T>n<SBxgf3Ok8M9FSa)%+M9N_69L{iS{f6K5xZV|8)V&)ZfixnRg4ywRGh&L
z0fnv~Dx0(=d1_)gEE73Z2M;C*`N~l<z%&$LnWw^VVh4^A-Di@@`JtE9#jJ)223|yJ
zX-1%^>E|&ZB)^m+bHg%>#AG9!ic_T`9lu-=sbqZJ^$B}=<#LGR*iYC4VJY6T%x4=^
z!8v!yl;PhNYMz#jaVS_rc$5AU7dNx#qIV>w8KnYGLKHgK$DUx={-PwxegIBDsXK|s
zobQA)ukOfT3&?*vt9e%rSLdKz+jiR)J;uwi4Sdhn*M~NzCAxrF7g!IqM3b*2i{op7
zhB2VS#|M8EjemCR$o$U~nzl*_2DgAm+ubi;bWW@kZ_{sxTcuek4}`_7F*g6$TEiI{
z%X;O#+E5nqL%XamwN`l+25df@Fo*SH*cdL+D|cAaNeicIbcI&4zuV*nwaNN05P?Nt
z<HrqKaW8KtH3=!MHhEJ$eKT1$x~O=NA_nW5T~^uKLw6uO>So<W-xc{w1LFy3aQzqK
zSw)M(#Pw6fJbiErmUEHCB{g0wkkhK#lP_JLSLu%-i9T);yL9meSeAnWF&wA+?~en6
zLa7rJ%%eX4yi2f4P_6Q-oRv)334#$VB11KW{5>z1E^8O?&~b=3>(&fK=3!UZPyScF
zbT0NjaTD#Hcb83Nf8X^Ntyd2Hxd;#1ZT_|V$UWyY4ALC*BisZV+B_WSks{l?lu2<6
z;<X9&zcHtUajkM_!m`bLzCj{y=6rK7B%E7e5!A)n_S>)MO5iAtYrp#iyZC0H@($p^
z--XCicL0#+0QKB~PK)<9%8Jsk!%i<dh~In2-Zi#j1$`{H7&1aVUr$i~{&fnoi=m`C
z#I>@O48qqRLgINRF;2QnEJt87F1RCXtTHfb0l<}eEIb$=_%R!MYJcZiEDm;8BHO%n
zhk;&Ut-?+AHU<j7%DOYYU)w#UzIzag0Th+x|MXCH01$%!EpydVpPMik(Vv?j6EdIK
zOkHrFPJ1+{ex;Fpqdg7;P^Tam39bHXtdf-G-(Q_EA5)?a7mIm)gMc)xPlG-EtO7ya
z@3(U&#@pwNzkP$-*T=7EFV^)>Yh#o_5#M?0PdlCS=dSSGaPsD+h|@GP7l{N}>TfdZ
zJDqn+0L-(U&W7Am!ku7o$18+sn)mcCLr#9X_2SaAPN$O;S2NC>b0$J-3g~)p+CKrs
zoE%WJXBJ$r!UTBDh!dsQ>3;B-7#8j~2Am)8V)$X!p`onXEOn+@2v4o~hGAII?F9Su
zw~#Bzo4V?QPn%)KFe-}+j^L431NOxW2g`Oefb3(;PBpG=24^ix%+te060=SxO-pq~
zk1AR`(4dj=g5?Dbp_yqc7LF=Bia@R(P@&x1PTk$(%HdAky!A3fSh64gOfSarZNHxz
z%J@!=Q`)(g!yt~@lVI&dA9Cf&IS!oFe`UvN%*edp;nn|FcKGAcPu1anf2uYBH2ha~
ztj7P!{(0*8B;57niloNU(QXY-n-;EKG$Iys(^P|5W@d%w*X$<zmquj|p3-r(T(<cR
z^(#9P8_%Bu&n)i6CKpuP|01)f_^31H98j0>PN}o;7yO=EXL65sca@*-I1%I1oasj=
zx;P_b63l&90n-gCp5TCFK3^>3mt)yj4g~`eh|{UwYYS?pqPV`1@NjT{B1<tp?2wxb
zVqULEIXSMW?5yZy!s(=A&h#5R@D}F8C>Ps!CtWrsV(=bdb|DE?QOT4|81_;Nt{^a*
z_`kL}QCSOMb1bo(>64rVsYM=Zc)61oAH-B1c;cuz3b9Ol(v1L;)a*XsF-~D-MqQQH
zMWxXdHD4DWIsmrd5zPw`1Bam^+~?T*>j4UO#%{DJ{RImxN71<0uU~}IbL4U6JA5u7
zM8LSEsgfd+(f6-#?Lfx6nmH6kTk>*0<1*!4=wx!TP;nGL)NLbb6#L&QH^F40d=P{T
z32l4~95YEH>Is0Y_~`s-`GvqACYD53a!GwgZ*)|Xo`^{*Y*cDBk0&^^3jNK|hE~GR
z)d3h!_ITCKjqWjcPiRDdW$osKiCfo^!w6;WF>|t1Esiri&g94@i?<O}|8?=JD%MbZ
zfp^LgxY>^_Z1?Itj{Rr$T_c$lHxxAg%3}Bf2rF91g#1}r5cW@zlVtW*hZc8flw1;p
z;CShyN@~fSUW^0N6WkK4wiHL?yc)nEes~^gD`f#(SxE3M{lGl)69Wg2B-^h)iP3?*
zH<3ai!PDQpXBj(I&RK#D7<BYP6>nRIpOUL{kt!e~oM_vbO|G($pi6AfcS=5R_JY=Z
z-@xmH*ajSMs?a=JI*!>7P0J~Hyb#_~?#oQm{anVZFEFwkJ>tp0-*!K7>$xQGDp|cg
z=w&s)m?eyEfP%@XvyjI+TZ5M*522GVvE?a-4lQ&J)86&#Zp}0wz8jw@)*W#*n@?&*
z8ukCCox!2p6J=g0MKnvdm`bY)FSVOmwiyedqyi*};E5zlHe6Re!=A&grMI|{1Adz)
zCUW>&uaN`@$b>^>8Rq)Z?}@0~6YHDnBymzTVzhHa-WO<Y_xNzXUunN>TIw9!r}HE)
z?$NqTbG6QE_iPg^TzB*4_&%TBRMDCbHSX_EOiUD7s-A?KE*K~5c{=Ktc5s(SvT-)U
zO#pb=VvGm)k6fKK*u&0`9CT6X^MBSMUG2kaL}_&Cw1pqwoL%6oK4v9>MbLzkD*Sq4
z7MWf1ky6T<5}}Wa<Ol%=Mg&63G+TRxhd9K?ovz2mo9HTN539V|m3wA<fNyyZ?Z6*!
z9dTHy_j-x<MG~lR82{x+os-{qfs#;Ms|x7KHZUYVBQsfZNikn&MPkP-^|kRDVPwlH
zZskG6;tHH;kd}F?tzPHDdJ919b4=eYA$+VW>MG?zMoqj6Oi1?#{VFBz!G&7pT7fjt
z5~x_rq!mC^%QYpOurJf|ZnZ=IHZ!CQRxL~`x)D<;94QR49u=-yn*&5er438!{J@2v
zNSG7<lv9d+HKtH(qqZwL1Zk3cRvo6czI?TCN^Y6s=C%=y>8ROptzfG&*cSQhqd;Yi
zpg7$;l5bkW*3vVR46wl22n0HYX<;DzbPI)Vz`pk>A?oiX{pVk61RI_N-_%fH*_|#a
zO<?Ke{&B{NhvT9l5-Mif>7)D6ae$>%D+(u$0TDmo`SIw3V+DK1V803z&149ad(P2v
zDZ7cqbcnUE-S@Euo#l%6ykdjbAt|r}O>!zO!S7FFxp_|^1Mlzq%(J7WG_(^iF#Cj&
z-qBwOt`jhS<JRMS6XpG~6DtRvZ&lF9)2D||%0;#(LLZ$OUdw7e-I=s?Ujdm_l=6Rr
zi*b|?r<AKH@Wx~R;$8=X;>9Y&-14K7-<%YpKHLgS3GljKV@c?L?Dt`HO>=Sy9$|r1
zqxsP_1||d_s7fn4(K`^|VdYr=9S{{cf^M?uT`3~qmY85>ZG%_&-n3w`bJri^c1$p1
zvM`!MFv7az@ANXr{#bfEsRBF}ZY(FvaJ>BuE_{#E|4p02rbzKPduc1Yy%@#7^}^M6
z#;VsdP10rslJ)s3Z}SfW7dW+@`S<OFLx^gS`!k`>X4nje(`cR^{niMx3&`g8%~SGL
zFW?uaNnQ6c&Iukc;a0bhtLc)B$A+14so&;RXK$*(_a#E)i={R)U<&}a{|Q=GG}~2v
zZz|ARB&+Odt5R(q*W)B#&6zD2e!Mq>Ezftp@Q{xcL~G{LMQ4tu-l}v0?H*Tr5YLp@
zQ<rN<4gP#VetN_+u!4}FC3p;*k`xms5TW}C0%@v4VP(@XNbsy1`Sxh@sM_Q>aP(+g
zjfjGrymECRr*Lei4yfLgx(=}2!VcMn;8#|Nw>$A!!<1JtFT87UcdcEFn}90SZN(}%
zpw5{t<v$p&amSJ0Ygld0aJ%XFzK5u+N6J(F<KuWq-uB3$t(CYe+dPw~Z7S{PnnV!q
znQp7$_uU!$+X%78QhERq{lEvKkS=T|Tm7PZ2yfdMjJw3x2r%*k$!a5Yz~bl@3^&$B
z=JqHn$=Y~o)@-q;f8nG7PvZiB)t;(#ggjKM>AUvrSF5~3I#QKrkKOf96pywz!AaQV
z{fUE2trN~o54|n5M@s$$34uwFj=rb)DD8TznNhrlE49iwDLtNVlEVM4K2T>n^M14+
zU_$WPtO7^24M^#<0|%p#N%TnM3u5qT5kfPyjM%01GQ)19`Ft)0Qa)kMApgK!nm*Lj
ziL`eK`+m6H>F5TBu6@iYSivOe2_GuHSalpzMU1PgA()UXk5F!Y+iV)t&1=2Ds#$*3
z`1?$k-Na*-JmN~bX*C`~+GSD3LCU#W(Io90A`Zt|1L&8co0VIvSWg+Shoks#){&S3
z*QMq)O|G@0-4F-Y@Y{2l_qd2n?Q|9IWd{A`^&M$Qe-MMdVU5&dIOq(_C5nRrWpI`(
zngJ_myo)nTDXtS<lCH#`Yc$dGzZZF(J)0o+I4F9jR|{q_R`FjDe9Lq~4k%VYr#6{!
zQpyR)1zbf_x{I;MqqqR;TLKfD%ehAtma?bxbLBS3FmQ|P4jpQP13%u@k!&~dlJ=Jz
zZ>&N`LqRs18>NcS)<q!Y%v>|)CuC)q_OQrcfXG%&7(TE+)*$prY2yacbX-Gi8GhrH
ztwdJnI9#q(trx*IxrPzuyEne*>``M-%C$8S0))}$T`4^v8+u1w#P%e;9v+6zk0Csm
z{~i=^LuW&S2<>bJrfuT%PZCYC3ueK96|U}<#0`XRtg`s5{D#wKG#)Kpq9C)9=z7|u
zc`U)ZK9eku^?UJH)c@sbZTWt6ViBRt*xz)ia*j{8z+sz3TR5D{M6T|wGXJ#LL{0o>
z41f_gbEOxB&nuK|u3{R4-C~*<1ZnO454zyT7Bca=v_IOHvP4ZYN2j18-$)O~prNOF
zucli~=Q|$#+|$S*dh9qZFHkdaR6IIIoGv4V|8B5yuyVFMej6`>CWH5M9g{G}Ovz?U
zGz4K=QG0b|kg>Ml=b^1OI3v;`;v~3=4H$FJ1LlZ7e40dYd;FlLuMix^Z1^)Ij-95D
zOr59})RJK;!>UL#*oFR=nI>?NpPD<{gld&)+1NW@o}Jas*UhmYWhTks)?vYU-Ooh%
z$Z#TB=RyQwAovaADQFamWW$KQYlW%hEkl?&{3tN%{(|XpeC^syQl|z5S&c{n9iXD@
z6)+<4E|lC(NhN5n3+MKn5~!MM{u6a7s5@>QM2P4OFh;$2$=d5><h{TSASc;)#y{Sw
z)%KsCZZOJuW*JzB6=+v$pgZU<fsLPPq7%rAog$XgWI8SY_sdD>jMn4<wYk>SoaVN6
z<@(zqnMDKxjqq=F7$Kh?0c4`j4uAzQ>1>0{ac<k%(#&+Rp@aQSI+Jp1KJQc_)OaAM
zLBs*$&hbzN$5bXi_jk4FbFql@p>sKn+RU`fD?_r5T~aY6Qf|O8-^8zPP6vlxp!JU!
z;~IY3Dz;=otC5fvGWedO;xHA>d5Q_RI4{wLxw@&^z@i=a=_1dTe>NY14*)|&v9|o}
zbYtZDL2Ev#i`TS*zK|HL<6Q8`cp=EFUcqWsmt*SDE@x=3Z+tNnT}hlV6dO_ZVl^Nt
z;xL1QXb}#--xG=Vjv*fAVUIoDxXGkWG%!J~`ssGd9Bum+>>4T9dhG&i$kFAc;YF`S
zN0(2r6#UIYVRKF%2;_1f7%&LzMz1!U{r8yUK`aG7w)Nd{@D|dyJ>AYgEOviCejS86
z;C#O~9~i?=K$pOi-tY?P$j^J1Up1?P3!NtH%NW|Z1%$hS*UB)p4Z%%<%s~Q#aD&bL
zW47>L@wtv3=uOENwm*9dNavgiIN2QXC7`nZ{+nXpvG@sG@vS4@7SKD?Lou%JMfeVa
z`~%A!6@-~Bza^WY-=$ja`%<}@kPvet$UkPK6GA1YAtLESCDt2iq|OQA(#RNTGcawy
zQqKZGerXGjM35)D1UY#n;|$A@MPCEq7$Z9n5AhIIU;)zvy#W^?TszEw&f^dQAV*I|
zK^Xg&2vi7wk1Js_0MyOGi-w9vHw>R=$3W`ANT!|9N>7+3O#R9lZF1B(@`bc-SYb+q
zV8(z!)}Kh|F%uz4mL9Vc)?|vt^I+8t5RM}41?3e|NHZqlm*gZ|Xv36;{fj)cgoBI9
zFy&R7ToR_7DRQdMf>>-P?{$hy8w8a6<EO`14Pr1Q*^W<M0X8L-RH7tAP7VPGht<c8
zKS=~`AqHs|>|fA{x6kVo10h1L4sD6K=W-VJVLy9<1eA#TM9!{T1r7oSBR+&1_znV3
zo;M%v@MVOk6AR5?+|1}T+VGaNPaV-aN9QT0OT&v8)qAG;x>W>+p}6GxDpUtbS)63L
z=2d!|6VDr4037Nlh$kF3k<bEnK1Hm;LiYsfbH5hF2Wv!N#P#t73g0?04QSwGQk^jN
z6w)BvM0R#&AMh?9n~}8^4Wnyd_kCw0?X06fQ=|B{`XcG%n{Y#4)kdUT3v{j>1V)_R
zdn^}C(eIho;WG==q%l$Ft@D^5Du8HBr$N29#?6Xt0SYv$_H)o>w;?a+IwWECW5rds
zNl8Vf<iS>YXGAq9d^BP9af^R{C|k4ci5E%-Vbv({80X}Kf9vQRn*E#UAXQersEx@i
z)#<B|!U*-86!yM9ZVeuyZY^2FO4nSRsqPoba-daD(E`c9{Mml(!F;~%_w51(Nj<+l
zA@TeH0F_P*z##b>qA%K)qW|hlFuf8j%mX1x)|+@(z(HJO^ln^6`EHzKiY&@4Wct+3
zxAL8L%GYnwC~V2EGV0tJ4yqwSOp>@lewK(aLV+-s^uv!hOOY=i5=>8}-*uSgZFuZN
z0f$PT9u7&x_;%rOkUxiP4Jq)oaUA%a8h<ejz^dwa$y=*A)xnf;&e}k^t|e)QP259$
z>YtrNp^i1~+n1s3h`t+#Tv6n&FycG9zJKjw8~Ea%a?i0dRa-P(D+&ycdLtFB7ivN7
zoD$CV;sd&_*f#LPRqs8y@YdJ8lei(~SGYxO+?r>8z?qeh_2Qu!pMmW5DLG~{E>hm1
z0OzX#ac|j*8(t8eTGS)YAcL9AP@gTkiks}^*RT9Mb||P#Zd#YzfD3ezcKy7QnoW&U
z^=@3R?N{0@#nVC(DEzpvRWuQU5eMuN;5bIq{sz3LIq%p`EyG;R$k_z!Vf3aV`(ovV
zHk`+}oI<1NHi>{?<!HfJwV_5&%|X0=z}Ov?WczScy~y7tAxCQ8hRAN<`xV+5iZ)6<
zP_y%PSgTqOyi3gjxzT>2{{BN^H=SHVt5#qNvy(_7v|#K#<P6la;$?k<zpgusSLt9+
zijN(p8=MvHD*w2rZ)MxPOLrh1yRMPG4<)5-z3(hFmp1S~=YJdc)GI`GP_H2h0+6{V
z3pACUi3#@jCNMfg6)aGEf0nsSL6zi>)ElRRg+()8gs>2iIF(_yK5MkUcyF%-BkYnQ
zc7w}d7(eWOMk$h-RHe|75vk`bJ4fQTQAV&N;0ci<ebBF^!SAOVvaswvF%JMerwJq-
zP%7rcv=Y*lZ)ZkRto$9`fhR7u0;oX>RWa%jF3HVJ(Q}FX-H;D#Yv%kaN>)VBijTtL
z;rmO2<SxoeJuXeGWWvR0!`P$k1j5$|_$|gCK;7sc2^clz+%~wF1YQQhWOr&N%tvf!
zVN}Nsd@)~>q^qaW_U5U6*@)7F_^Rf_>!yq%se;fQT|Mg{EgDO0ON~BK1egWaKsl1Z
z#b%F2IT$F#l5RZVUv&hShQuj|onOkgS#oi!*h^_pq!hONI6TG0o#gu=64p<rf;kym
zrQMykSHFf1+P@S27Nqo50|n0RZWNxqS#;_?XbbJEAkxI19S!3|Ak+8!x!w_h5M!TN
z2(jy4IPEdJ{}_13JQ3+m2hi?`sM4KlXnHe%X{yh{u+&r}b?bvp!%e7_SU3wq{qE$(
z7Oo=HM@i?-@4pj5CH#jI9ZfI#Yp2t!hzG35YAN47!7{oMmk<$-v2%q%2oonpP5<5F
zW|Glrv_h+P>LeBZq=)CVatpL{i6H*YdvoX(X4g+V{Q`J&Punv20TA?u=g3=YE#S+K
zL0R3_rQ^}ypqu;#C-8YidPYzBttBaUb0c=Z7fy1+&F<#t=uTUX=zTSr^F`o_l7?x6
z)X*Y$)zuf2JK@HWh$K`NM`^@eXS->Pcll6@-~xu$V--TFMlN?==~}Dg$ZZj(oo50D
zyA$eF5~&lc4h?m>56~Z#NXyNjfRZbXRchz(59p*wGd)i_flMQRm&^zmpZe-IQ#Lus
z-m{fyX}PFq*(e!hX#s~ipm}wBOLa)BAz`8s?#JDNRw^}_aKX7o-bM!dpzkX&3a~8O
zK=#TWLCsVBBPfu)W5OAe7pu0*1N6_@$U9?QRkZ;#o+lW#2@oGRY^v3wB);9dbN;LH
zAKMZxsGW<2SIUTTB7@bw7Xjw+wt(*vD7qEo50dIip@0=yYLJZHxL5H11HV8(zcsMK
z2F)my!Lw|haL{a-!Y&Hlp=TonKmmE9)3!mRYY>!gbW);1bO+j*_W!DeIj&kp0DzWb
zXu7Syk-(29XF})l0*iuwe3~DjA4NI`Ww(_`if5vbxtLg%aHWG6C5a;CE77sUSq;$a
zz%B0z)=@%Z_KPhij%83c!Xn}pb~te{p^k~o&@yZ@@+`s4N2vX_PQvC)gH=Qq-NR1<
zmrh^4d-Lk~|3W`M|LObo(RTQ}1Pw-r;+IcHr|SFz5*u`kKD_yVd8F+?`uLD14lLL#
zpFAn#)`#UalO`~k@klGo8k9S#@{u8o(o7!{I0iT_JInHAT;*<hcdd5AYI-XneJA%3
z)K}y6vdi>TPgDzl)t=BwL6_G~WsCrT;H53$rJC#xobz-Q6jLE3-wGDbVv&}zuIFkU
zw6T*7c(SGSzdh}L#^D1b?AJn+hi^~E$TEx;y0gNm-aRkZco$Piy&=#EdV5s=wZ=@M
zYwisGc_}e@OQ^|q%_YnqNf*uj>-KJq2}QP}+fY54USM%GgU^X-w%6g-q=<agqIh1G
zN3heikw|emw`UIuv<`;l$rkxaM6SBkURWEZP~_cu;ds-39clHd3*&8eKY*~+0N0dg
zw_I0UKeZKD+v%D<3*iM9${w^s4V~EJ!}k3~P8vb6LX^Lrk>Xd0Ay3Q0=4hzi&uKQ5
zW}(-$;MJ{uRd_Qj#Wx9I5)$0?<c`q~kU8-kSnzwxZj4@$<_@`9UXbd&R6QH(xmht?
zZ%KMyO<6U6fhW7piBVPDeFkosV`MGCO6vwm!N#4zLn=2_8ulMDjlS(nFC)F)5sa=j
zkX3`NOX;(-RRC_P_T@$OYxP8dR4*EfoBA8>%Xffas^#7KmB2lC3C*qQl?>Lphia{B
zua$dXuFD0#MQfdD57xTDT6dqVbyCIM$<3fOTy8RdhetleoEkoMn8Pq-zKMCn1JAM<
z_l+&wHS2G#HH<#u<gQ(Iho#W+$3pX9a?`dQ)5IZl8FmC0IB*RMdjYknVOgFf)=l$3
z^HBc`G!M5(^U#U7L;psmvv1H#73aS|rvfZZIwtWp5~~0QVlS16w2kM0_%75VEe3}I
z5oOkYAH(gLU~v>PfM69_svQ83<Q!~a%IbC08;^#3i4;PEXIY$<ntrjUbDU=^CJ7el
zBu<6oZFq)A%_cDe7X>NM%lBg>t^}Kx@de~`$=bXX0F;`?30HkVR7Ak;s8g><s8oy6
z0g|=A<Jx2_L288ngZ!K%;1Q5beoMatw?hnn05YhdH75`_-M&?&tWfrC7;T(JIVs9~
z&dPZ%&|%xf0_kG1>>RT7oQuj-s2+uED<epVj;J_`bzK$u9wrK$4-%z+1`&`iU%$|?
z{}};Vff9o=LD|)hc4J16oo$V*;|x-jFLxGEkwCWkLiM1`WOvjMX4+lwyYhCdSdS!s
z5qXK0A%}qZi_^G_Wj`o*JQ_BJ#x(<@dwK*9v9sERKuSb(JsodWtXv1PJj)^ghiLkY
z#WN(Wl?vaO3y6DHol_&!#2hXDhnCZ;UWC0hSUD_qrHZIlDZG+&a${FTS1608v;7zr
z{3tS<D6(-FSsXjW32|TtHnyniSlkbPA`#L@=WqbiCd}kMR$aLYJ4c}6!-oj-u4(sl
zSKDr<HqBPrn0Zf+mhP+I>3TpvkaN*?a-iPx@8sI=m^+s%P=&PdXLSYAb<%n8#Th9T
zrQl1hu5=%4-|s#8ULLBzqEKDwKC1Z@Iuq6OQ&|s}&9h4*X<KT01OV{nm%`3}Pu2yU
zpY%fKmvcd%m^!F^b;a61xzxjzP1T_~P#pMhcoUz0V(rpSGrubvP`3pKFmh9~y-Ur@
z%W?Z;Ne17l6=!wGd@HJ6hsp08o&9JTd57@&FBEn>#Mp0}up!3&>&MvNBs3lJI&Ke5
z|Jv3__%iKu=-pddTw(iB=x`T*hm<kw*p|SAcpkRgz&1U@W|kG)W3XdaE@)-PgJ`tH
zte2rg@%LmA`irtrfV85tH!T5n=@Xl56EZ{|f}{XbNDy!@0^=YE*NTF2O7e3ZcqZdJ
zfRwLEPI;FSQpzR2e-OM8hK3)x6uZnautR)-1CQI71)=HMV4M%Xz&aX#G`>OO`^p;M
zW<8HCmi6y(6V89Kkplqg9daq|rLjP;>le<Yct3=iy<*#a%W$ZPMQ9ih+wNmxMG>|v
z%OQqsN1U;HEF!#HVHQ^Q+X5YSKlmL;eno-Xij1g{SbcMJRbQ1dil|74q=z$pwo4#_
zw4)zqdE1KIj;N?$w__xK;ke4JqHwgw3S5hU^}27JZ*y+vSqX6gmCbnyHfzZ>+z>{0
z<1&;sCOG=9xU3+<-=^RF`RM5AzbcqCWTBGa=TuxK3(UY{Ah;wG>X8bA51?|?)OPNA
ze61)3ZSw}Ps&)vh6477=ib8rl2-xa*%%r0xF3_2n=V1L}2)yZk3NWaB0M)ZQgf+Ys
zGHv`>Jb`$B7#YrC2K9R%BbsDPvW?42;O6PLYH~3J2TjWXG1(fskfkMI(&sYOVJz*C
z6FHOLRE~-I1@7uj`1-L95&}}~o4rI)mq!kX0uMW(2(c3}A5)KT?0ei6ksbM*c#lpL
zJw9&I`ds%&>Yqq|YY!xJ4D0q-9YE+9Z8&zuC@1N;a?#ZeWJdCQp&YGhH?7Nvq?{(}
zk{NZ;(0#dXC9q$WT8rxMI#P<)Ef4ugw}suY&@Gs@uA${zxdqbYxJ0m{`oS4Z)W(W9
zjaG=o?tvNAxT=@Zo}DbO$Jqx~w^LTN=n1N9<NZ5vbhsve$KeVXc9Rr-35VU>f~B`K
z^JBDXDYRelxI4sgZ-Dyk{{3w6gWh2py4{@^nS@tA2utn#%H5`S8v6G-I#Y)v!5#uf
zN3Sbe>S+Qd>)opBYwyh(1mDST_=dq+&mmgou*`Tir%9Fky?Rw6^c0zffsVWHc8ttk
zHpE|^s0r<VVZ~2Yyp6hO4H!RJ^@4tR^7pd^(lh?#(@8V^4P`^spC_MAdj0$5iDuAg
z7wHVGRpw9i%{Q#<<Ihjlq0djMW!QB}t!P;S?N{}B8G(PxIQCKny&v3TN7dtHsHoP-
zJwUxn-sJ)EE~n+u6I6^p=g#P!t@mJS3;`jXnHhF}$LHT2f4bJTaK7}m*oUxwuZ#eS
zvIi`UhH=-Jjs~Kmf#_&Ii`ibmQ{3c!$O9a?p@|(r1g6|^ut&IM6I&Q$Z4}FWF!29<
z6}rCb_^-2DD+_Ecn20ZA@iU=<3wn-#QraI>T0aKS2-23VDu?H!e?JnJx<W`q2;7Ak
z<YbJ0C(x2C0Wk$sNK<i5i;sJ#_oCvq0fT#Gt3l+F<RS&|Y?+fd1<dzd0T0MY*wbd~
z*rsU_Zel@Mh#f1UI24p)gHu8RAgFQNM`yDg0OOAjFy4m`G`Q~yLjWeBm4NLhpVp(k
z#|jgDQd7<>qY&&--&D11CjI3}2gwZ<ux6fr{y=3mL#6=*n{E$q>aT94x*v!H_1V~!
zqmen(j=})bh*9kLj)_A;DGsB^2tz?b$BXW<$kN)KATg-@-NPzEtX<=dZ-w}EM3pg;
zq1wv97Qt!JHt~;FMXJHzwxR*F7rXZDqqz#ltFVuqz&VWS1FLJr7gd0y_Ik^vWUrxr
zBSbmW<(UQ|R9qG!i5f|Y&XaRo%S}qIQhfK)`hHxWWit0O%Vr8HP(N`Qr#!p7D{|Ad
zeBEIfxS=0<*ry)IO#-kvKEbYI3WJisW7K+da?|m#gm%ckWj+aoyj|WcIzj!~{i5>L
z@3LpQ>cLHR5D;DVn#(q9pIlrBh%<(Nz0eBomAeU2F;^Ug;AMyAE+wbuS<FSv064@X
z-ay3sigIG#k-kb)>{KF(jRK<j0I!JXYx&hr)_K)e2#dWy(ecu_$IDn)?bci&NA^9(
zQu6Kjjh9+%9L%yoU8LKGU!E)n4?g*HvI3^tlDqr+uy#k+SH`WrOD}FG1hSTYoQwTE
z$Ad&&e<}vQFJu*7w<zy{pKEXdH`6jWxjv(lYafGzu3^{}>t<%i+;Pt`cibWUc1Ok5
zGD61=iGf`zZ0rcf#Dt0vd!g&PmTw!J-RHQ}(=IU*ofmzVRL{QCqOi(^)FObTO7zoX
zynK%U*4d=NXpp8&7L1Ccs!Ae%p=hoYpL_w1DH*4*#G{3hc`ojXwM0$aUbYh9Ij-vm
z6#K-5EC_ahLmt>Ta+zxwlt#iNkIq&y7y#7I;A86hn3fdQRfd5jm3X5UO1Y4B(A)=K
z(zcC1Xug9`f5$*-Lpr`YqU!ce<U!%R*=rc~#@3%f;a#Vq><Yp3Et~s)7R8S6friPX
zm<XTZFfal?WC7*Adym!KR}JfL$9dYrG`#D^#slt=OW0%Ay^7H#oOSX}xtL|eZ*x-i
z7zy&U6R9joqW>)?dHzkFj*h@a-pXoNwO2|?WXJ<3qb;8&Np^Ys7a6+$DlW>qqWf0e
z-47`c7>+?)f+^)Lc39|tVjB7$c0Jo*!U?DqJU*nrp#7?!LHoVF_FJp51(fAo{kP46
zthC>44(UPl-L~ro)pt;R2i5o9W}^Shs&DT&9+cmky@)~i-TE^qzw33BU6m7uh7oaG
z%z_}qjz@eP(7?c<C0uR=2H`fn$LjBgx35%k8_CnwRc0&FtF9)03{TWrsZ2;Sn+XC8
zdvWs!=+crsCSDaT0A5}h*iC@Mu4u&?CJQu;uTUZ;aT!kmnOrs1QK7qBUs;Y+_HOuV
zq*9ufXCls9xsb9Hfc%+EY%QJ0;4zjdf0U2;GRw=eg+w%$I$;n*MnZ68t{C(Htt}Is
zLkb>Ang>@P$@ztUD9U)EVAKN5(}+ytBqlj@Y(-Kb0A(xEy(~=t$qjshGT)KT!&CSA
z8<Yy*g;u2rx)e!*6)WD-3{~0NV<1brI|hL`WBVBcxEnb^;4$noUtouM5e^+ju<M14
zP)=OI#iKI@tOy&pg>5)iTLto-33AS1S!EGA%Pv(I08rh3#e$=sNCFYPWAx@MF3u!r
z=err1R&13^yScZ4VYxT^u<CM~j2yP2+<AJZU1t~77Bk%4^LHtfpcC`CA>6ahHXl!C
z>LOtNRrn>ZJSgoa+7J9xOrZ1<BOxrPYOHl9;#Bg;>PALQxdysV^2x6q0R0#}mG*)*
zLD@^*JX+y@;Jf!L&O90GDf_E$eaMrSX_T!=9{(Xvl<h&!<p0j%6rIN@KZzmdm+U=^
zc!U5Rztp4lKz?}wTSjtTKl#+yQ!3`2+KSSt1PZ9-ubzmbHm@H#BLx7NREduVBfUp9
zl$G~oN!UXh3c~G=2ih_NJ+I9&^_=u05;`Lsp!oHF@jF;$o}q(!X$)%Tx}QPqd~8OU
zdqlf7grhXmGK8ai&OM=|nPE$;`x!nHkL@!dh4x`X+-&X#bN$2F5TKk6`{8C&KkSFC
zKZE;fwMBhb*OeO(=D7@W*Mn5|fq^N3RQH71wg{*xtSzSW^*7fBcCKIiU^C}2hzcb6
zTU^9{G*03Y%-b6dp@Uh)+Yf$oNeN8orr{qzt|XGj+Qk(Y-~Toz$@^^MGZzHt-oeMQ
zo=kMZxT<#~>3I;=+&vxJ@%rZXNzb}RV%DXUteeU%rOUm>Bxv$8Cv*dgQ|#GhfE~+@
zFbxb3hbE(fdX_85Iw<G5y4TJ}?Hjc=F1hW0Zko1(=I5*wG|SF^gm<~kO{3m;l^jCw
zcq?t*L0pRI)@%!3(<%I|90QW8^5o;eCAj~dnTGMFZxEGB1hXtj$gB|0s$Z%*&(bUv
z-%!HNVO~;51eRp^vwt-V+xEO~J|0Lf^0%e(CVyM<x)sRM0sfsy`YaJq*{u*oSz2O$
z$P)6*GG<r$?@JL+&dO&rOZYdcoy)Vh6yN9$|LNnwcR$shpbu|fDUZ>sI6X&yCpoav
zN+*=utFk-CC0G4At~z)ur=oU!zt0If*L4+V($!YcX7!TljT;A?bj_7{JekNObfi_Z
z&I<>g?blHRd68_-m7cwVM50{aGM=G-OVwLVfOjTPHZNH=h4j7pq=5%m5<}+>2>`<d
z2j^TdFO-K&@DXBUR?f9|@I#)wfa1zIbhIsl-1n(m5${MO<oqeR-=#c)8A{|$2;F99
z0-8mnR2|cqjbQ{W2H~fYn@SdtQ`30vpr-omK;pOZDI$r;OVxH<yWHa}Jwoq)mG`k4
ztZou~_ca|dT+ODlJe$Uac&7RX-lp;la{Gb55xQ~--cle*%hU@-EEh7)9caw59OZNH
zT1IiA$C8Uel$}D#fptmpoTR1TH_lbp{ru1K1W`zWw{u*%EttbS7YE#ouwxrGraXwS
zpe7NnWpd(}kK37E%=3saQ7o;0=MQgRVORu`2ruPwNn*Vh(NvUq%+z93nG+M~8U|jw
zIO9k1>85ZycbqK0&mn-ycvgF{r^>qvj`chS##V9I@$_EDb*uc%^EA%nF?T52sC==o
z>&wOac&5DKAKt#w&*?+-<H2%D;U-fWs(s(5q9kzweg9Zn-4*-*Mp{>YHb$>=@Qs^_
z%kHr2B;LO%d04+whjpCR&fcaWYxjm$JBYUo5mHbo5_I|DXd1TnZn*J<uWqvru57%;
zt@fNzH?0?3B~`Mn%4aWI99OjtF68wt<T%;IYb49<$&W0PoW0onL|j8Dwc86^a%$~h
zyxqmTaZm`*_DH_C;Yjv>a9MZ9VeRwG-oCj#6Syon@@~(9cg^7Vy+h-#<8)KHtwi++
z7EejCPllYEc^7Vrz-qU}-q)XZdPt=`Jc#B=a`!W{gXp=_p|_7cV{fa*8r#MVCr8Q3
z)Hm(GVm@X@<YOlaIS#pHVquVgMxkps(S7D^@2QHF7FnPS5XPW?pLJp0&sQpvtHk75
z_ne8mk%VR1?hBIW%<5g8Qwx`p@?7@j4A85o64KzRs{As`&y$Ss+Xpjy-k$4UtFbu<
zT|45LzwAc1wS8b4ff)#cV~;r$JAoJAAoK_(%n2B^nTP`K9`Az}oz>r6^B_UzF`dik
zhb&sZ*tK<}kWB1<z^H!f3)Hr+wLoXFc;L&^B|%`Bc7QF*F|p%XJ`M~T;4lnq<_3mu
zxW?l)X=r5yDEQYe;N|1LWjk!y4d;N-mq&8{1lMOXn8Qkuk88cPD$hwt(8^CjZOxeE
z1Q_Q3`^TK5^MpY5uz%KA_Gz4g;X(oB8A(Wf*y}=DSMHL3zc&#2DY@FGmJU;VQwy0)
zdRCWiC2jQj->Zpf!U(E}ftG3y&sLw<CVhM>2tlF1+vOx`Twaj8A3Hp#%V`*SJuq~F
zXnVRKu>?u=aC69u-6|`;-cVe>4_#Pte8N>Vztz>E6f^m2AFdB({cK(WWS>kX3a($Z
z(X~Oey0tWaOC%8m6Nl~VV`QwFmUc;f9ZGg>Ak8RA!EQBEIcNmWQ<5yom=(J!1$Q=Q
zc@n3BosoP8Mf^aP+tcK6_53O>szJ&Z@}(7`o5+I?RwMF>6}he(VpG@xJElb-XG?^c
zO(TzrFmMg)k$Vr$vdf*mvUH(EMky|?^&7zPbgeIc%TnM}^FgT2ytRgNx@ZNz4L0Ak
zr{FBshu~e2^dIcO69ggiD7CR;2NXN5@8ZCTENlc0GpQSKGrG@Nf8S>fQJMx4)V}W3
zG55f@ZW=P(uXIWR`BN+Y7d%_NGpMRZ$N0iwqYTBM*VZ0MLD*S4aQH4njYB-+wP@rx
zqX7$le1?qxBFDKGV(L>L8@3f%p=X8mmoVVnkA!nNXtceEnw7Y2Ey0)K0^Bp3KVa7i
z>}@_z@crw4p_(Aw^<G%IKx^Y-s~Y=xx>iTk0(V-=ZLDr-$LKFls-8Ugbh3N!Sfx1F
zk4<s-oM~h$XWv#d-3_tst+j9uAn&>0rzAgr-^s!Fu#xI_6=Xhsa5<9OU+kTBe5GHy
zo=G@0uo+R%FPXq3v>ZqiOBr{V%ginM<@%cgK7AWLy^D^0EC6+nJ3h0G5K|Ef>`=?Z
zp<@VO8v>eP;c_+r)CYk2mjS4EnS9Z|k?HIk^foTe7gd6U-H_=oCH^>qWL%eL8RR2>
z2Tf7utzRkAS6J)}z|2Y|07PM)lBCY|4JE2$U1z1vW#4Lj0I$KS7h@Dbs#pxV4q;_O
zI8{oX8!VBqEjo48og}-&xtPsWqV);{9_6Gc^Em_fI>LZ6mt1KiMa2xb*wSoD5;(@H
zep3-;3S0p2UdDvrTQTl$8dN&Wg;cbE>*)h*xWf9*AP_iCCpZ^HT$I4X{?iZ7RYrIS
znol7;Gs_4&YY_VqoZg*|l~dgtea&-KNPfN}^j3g#nw2O{DMVLDSiEx2%+o1J$pl6O
z*R!;kPr<7vx#IQYO6Q*Buv4saKzb*5)0J8c%+Ne7GWa&Y{cK(qvFsxwDRAF^6(z|5
zY|pY3v{MDazg?KST4j3y-3>xaoBKAlglS_3tN_Gk4(6fZcn)!0hu?RLQExdO*1J#}
zcwn6sqm_0e^+Yb1h%YMltUMvsYWgy4MK0GEP&q``KStteM&#a+3s2gQ^g~d8Jc}WO
z;;s-7)>F2Z9VxJU&Wy;z7Nr({c0w9r!lD3kpE`zN*?}8=fwgq6>`46ucGGnw7wF1m
zrR|w=;X$iUK>a95(r-xhMW2Y$QY8a=RQsCPuxkCNu`fXxE-;_Zl9&-#I%THlLP;r#
z5~|H|Y3-_-s=*BP2-cGC-GEeYdVy8_NP_v>bc5COXv}wu#IGVKtS7L4#W|Ssqx$;0
zX*sL%;Pt5jTPC}@e1nUSQx8_TdhqR0zK6Rl(_PEqRM#b|s-9kBD{PVDEm;fIy)BJw
z03)aoNIXKXxSl=Lz#9g$C!-n<O~W`c(9?d?$KCOckvZxcBD+uY&5?EcPd=U0zsrOV
zie9s2dhAvt%g9a8F4FCPOkK;L>c`)(UHtij>GJ-XE_(}SFkcSl%Z)#e)O^_$toO2D
zhE8B|lVZ;Vm!rocOkLN-VdPtm5!x2##ywX%Dit-0RtB{$XGw#?my*+btrRGAk1Q%h
z+6j$cZA`d*MZ(>8g+Nd0iFnxXY7zM+_c_Oo<ACxLS~&E5j=Af98ia7iwQY9KS9A+C
zv3*6iJ>+uPM!EQHF48htK)QR$ufEA;zQq4<w-@=Iz>9mj$i2uhi9-pF0vi^&<72`t
zA2aUJz%X6PJ$umbI~snm+sVFtrLTjIv=w{R*gDmIqefrtr(03!x!`j^%iow{VOe2T
zRqv=RtIz89QxYeCT2Gf1$~xLQ^LDa^zWS_h?Aq*ZiuAhYv_`GlT%}U?yR(B%-Fu|3
zRI9!``E;_}DNu^_({07MSK)5TbyW{&*Uk6__4+|0gZhhS(60ym`oZhhH&dQ=Q?BnT
zZrzTEVc8_Yekg407=DBavkXiPLOfwp;+l_~Zfhd~Spm_1;Y7U!jj9EFSM}H8WaU^=
z%>l%9N13t`;^6OPKhJ)YS#=(#ZGz$wKhy>&^+tJe2jKLUyiDCkW%4LB6{GE9<<79}
zZNg=*_}7pr*W<<qadH5f58~vyp8;(?pv`aBO!=_INiPUY(=c6Z+5v#t2*-iP33j3&
z3b`E$huvp?P}>h1F_B#}{P)$}CEDT2Jq2)F!QtzDc?NzZK!09>)FPpms1PEp$fcCQ
z5gkf<J^+PM4bU7NA>jXhh6><UjuHs&E(wUEs&%YW?bfi(qUkmUv*KCIWh&nsK{8c^
zzicqBKoBlFpk!f?Ip?WDqpIuQU$JD)h34+m%qn+(0Z13IecfLgmKmA08AUec9zf~L
zz{eDF`!ZrXq3wnabq6S2*;+;GmN)QBDNY@+acM6Z)fK-n=v3{6-Unvi%v_FMR%=~@
zQIjm4h#Z~8MVU#)<G4U)@#HK4M0|lJBAv%6<oZs<W!(kX=*P$C{mVDc(95FQ@G3Pe
znvw;7D#|!XD#GS^W+Yy)-g1O7A=$q5raMCK^{y<>#8fiw9v^SsbwGB4s7SI)bVxW?
zb$7S&sMZ&!U<-uVl^POe37Hqle{g&ZYFw}G6T}xOna1q!myhz?%!&+>mVZ1L_x}E*
zKz2(=!fT=kD-~{OVoy$_5lQv9DpjKdi&+wXmxrrN=N}LL{PAG)i}`7U{v}TT4?66Q
zbV(zWhy6QPsV6<IrcQKk9r3#w*B3{JYjA-Z9Ttsd*K~u6KKb!hXMube!P8GZozyk0
zi3;8YxHtF*9<+a8fZyqP8KQ^3Ui9!zRK!_c{$+97y8%+&{HIvlWG6t!UhA+=>$awU
z@XiAgThjJEU_?il2Jr)qgTM{2!zslfL{|%+`rH@3XM6V<x>c)yYHliB41&eh=!#IV
z6=aBVk^()Tl%?f*RAeSCPr)?40-$3%woMXt73k1>X3B^=U^;{_YV|uigDACRR7Ex-
znhSEyv&*!;l9N)5mH5)(-l=0Cdx3v{l5gU$>T{Mt;+iSM>|sLZh2ZG@tJ4Ak8_z)h
zJi1!^K1N4nHXEZO$qY3{N5z@^^Y<8}D-czs(0`l|pbruvJwng*q$pQMTu4d0qaKe@
zaV|jr%`QpKQ8oNx42f_Q?-`LoeS4fxQxlL0E$dV`5Rh{bi_1#EE;A&Q!1xe<)nzpW
zi~V$E5}H=%a*6{pw6GIc0S;~EV#f#^+Y=5o#3Oee!v1aP%IX~0M1s}d>Fcp)Qqh6(
zOIv^Y&TqwEV)?|nGeCyn?spQ%&3;4e{AY1FhW(3SLjw(J2CDhw4C_A2ja&O*H7&bZ
z!VpnjX4T%^Q$ycXDevxT-N;>kR?4A{VqVPNC%pG`na$)=SBu}(({Lcm-yoP>{sL#S
z{3T0aQ0iJ-s$Y`$Lj4l6xvF51sb2~TxqLnz<f16$FTc&J-&n-uzcfqrFZ173^U*w2
z56=iw^-i<2C`B%R2L@;POR4^uCi0&N(Y30-ev|)jaUuUDGu8RuWA*QUG*j1Oa23l+
zW7TAm5%tSd=srLod^M-@w9FSv^Z6l9ep30ZmVMB0ENrC_Q-!L)y#!qJJyS-@Tl?|g
z2rL-b{InGG2#<nyyL!p30-OByU(#4p4^x>c)S#BfyV-QJCf>4L<)~{J>a@1O@S{8T
zB1<nMDfJ0rq!4Z6jZCnA`I3*IKQGi-3dyQKTv+^?h;&k(9hO<Ox0a$@N9a3b!m~ft
zXEHqg@t``bKOS_u@>f#4Q)>*JtU@xh7T}Wcsycp8YV(v1bUD$mhUIA<jnV5=yw6^z
zLOm5nht+JHoOHT5Msf@<&PchkXnTY}b*&}~I=ZrWJ(){Zw3BUrHncI20s)UjU9xps
z6N~E-vidhbhq0loye~^a!tf0R;kGK*yoI`W^X5k5#(;Oyw<5kG)r}5`dt(=D!$$Nz
z?;07uL&l2G-?yX`JB9!59{Ib$_}BnT+MRA}r1jDR`=a^GeDdj}T4!)Yu9YXBPU;l}
z7xjvG^68|tcG~uT$zrl9s93*g{hHM~Y&`|@(uyY5(*y-xWtaG^m`V9X*WG%rn=PsE
z7ONZ88y(D~wLm?XNgE|$AX%(tVjx+(Zz$^P+Z6V(2vWv9-|;vOtT4b%=t4>}k6|k!
zoOz5A*9-5lMG!tJn!>Q<NJfWgR;&FY=RldY5ann`BcarP=2zA*MsyA;D&(5Z1ro7L
z9$h`()!i|C`)UPWTg;%?Je`B5OB*DP(EBq{2vj8T49(!vr<+x46ByPmL7A0?3m9X~
z(seFmb<5T{k|II!WPyr|#U#NZoy4gS5>{QrlawTn!v>d%OP)>lGr@(z4jd<PFclHQ
z4)r}u0>&|aBd#6s$Tj(pE?cL|-opwfcgz{N5a{REE4G!~Rj{F|ozx{ZTVoT0J=NVy
zn~ZqXK9l<vc1IocT{~LpP6EkYna8u4#Qt+p3ds_9^N7;HbT*jI2GiMKIvY%957Kn@
zRZUkXCzb6=+i6?o^zV=XU(3eKb%I<~R)VHwE3M*xV4G@T@)}cBNzQ>y^bXjq1_RTB
z$l!6W^lz<C?4y1MhV2oT`k1<q%Zfw}4oxe<lp3K$sbSLKKC9oaR?u~~)Bq*?AHID3
z0_B90yr+P#PCeAp80Ljgl75AMK^p(kCgPSF=~Nl2(IMOsS7bU%#A;y7?=k!ZF4)l#
zdRxPPff}k=!p^iqe+e@4Ryx5!&M#W-@&e5=n7x=JC{8)(1DVv@p)J|FqiJ@b6pvyi
zKqXHWhzszD#~0w!X5gKcvj-p<!ch{R1GGO82v%Tm7nJET*^@(=J3(lfk%KMUX4nx%
zgh}XA9N5C7j0kRr;o}Cgs7UzT5^&Y~p{ERg@3lR~9sFB69o$lYy;!u9!nHR9R#f%P
zu6Qric?l<xy9XqVR9q$tdB43+7)g0716W%7M1t+6vpk!|8lo|PD{dEDajk4@*Mm@O
zgioyWr>|xOSS2d|C{h7HCB8~rZf?Tj-V~t!{?#dXEEC>$(01hA!QuGT<-ze?3gozd
zM+8qaneXs=dXm8lIb10p=yxW?1bcfV^J56@-?>2<IDQpR=hGi@m0IRBp2Q_|z`U#3
z=<dAU1)}FZN|$YL*9`)J4bx!Q@g0Ig=GxeIsBd$|LeKYxq;hby6F4g1ovaVR-aDyW
zKciJQo7JO9G8c)+w|$Bkbp&>ZYvPc9365!Gn!f80kJ{__W!Kfcc0Ot~-&)_Roz$GR
zf&&g>nq}wG9Jfu)QA?n*If2J`+jf<qVMCI+FO+0XZp<IRp718mv^R6NymE~mdMYAi
z<^}EYbri)+Alq|M!HDwuiw*i~<$YDcBoxdpt7jmqnBd?KF6KpT$x&Wch*gk(>Lz3@
zQ^5WzWu<yL0zl^0+-@(^3sIEu1XNFzu&Psy4lB@^)1o+^q8K>dKv4&JxKd>*g48==
znq9P06v?c>Z?YKTIdX7XoaSKDNiwGNb4u8Gm2V525J%|y6ed_w#G&V9N!S@6DO7T~
zrnYfimzsc;$@{<_K%k2AI^rUK7kn;<jq<rn>z5&#Wb7P?E5YXS-OA)k0N&sNf(_t>
zm1lW2pPV6<B?+Nf{y9>*sfpevqni~OCJPN0bMCp=A*PMP$n!Dt4acyk#Z2FQ+!mx-
zpDvaRMsm7m^=_96?$*7GyL)o1|CGj`)f=<Bhb!b%4Vi!%H{^*2OAjS~1q27c=~U;V
zm5I#LvO{<H_bfk8G8F>x@t_`y9PP&gY3P`z`dmAdmA35-y?pXbjEIgVKu~FOP8R5$
z8WKblyp{>K%+a`A^~Mxc`!}r`mGh@T*Kk`-Sknb-br){0eLZM|(a)J~A7-@ffL+;f
zvRtBU;410k*kya;s`kNukh0#80&~8@{6M)q4Jl<@CPMF`U6tRy$z$gixMc6xLDk*G
zT5wPZmZhBJiyMwauE^_*!`kPWz0EcUQ>nrjyBbdVHlCdf0K1LgdN!H8Ei%`!$K1dg
zb5mQ)ZJAhhTkL(^bEk*m-{sUq^CUUA^M)KLlk9Zr-CM%OFmhdgm$@c3y}-bZFCrW|
z+`-h00v3gw37g(yhkq@hEh&6bcIx`~l}xe4rzu(NDw(n)X=<lqcA1L2mNlU$e3kBk
zOI$5ysZ#Cb8Fv`BE#DE?V4jH`-?DIEQy-fVV^Kgthq(UZ)@zh!e3eR5tX?a-sW+Qc
zk#+h<+pD=*1=%@&b!{sqv;z9A3<rg~;HqrG#UX4m5$I<kZ@};HYbzoXntAf+r1sag
z8*deZr<!<A`Bz=}D{Z=f2C{^U{0%A3>btLDH|n<K?;mFA7`^-JbIbJxQNP{}1BPzv
znYrU(Y1*zZgwL^Wng(_ZAuzFhADhGtLyKA>3i;s7`CQI_oSx12v3PF+!I()2IBpCN
zJJe)22we-iVMHC<p+2MQc+>{(&7BZdzg2Qs<yX<p5X1OW<x;`Y);%l4v+9?wvjq(I
zuoqGeCA0k5zZ!;Zd)_x6546|jOL=eJWJQTjm92h({_*?`dYKlAMp?n8M!UIk{vq-V
zpFx->nU@)Vn$7cxK!^W${$`}z8q)cq#rw6ncSr>3ShVY4vE<jOt&Y&oDk=|N^cdx$
zm?xz&8!IWSolmj}`2+c>l^$5TT(<gnUTDwF@2iFx7f49IivmY3acpNAv3M!SEKB3x
z1#gWw7icz5;MxA*+kT~bI3SkhVkTr*AWVZC0n8460T!!sV7+b-j~x6)&AbyP&9sU+
zPkC;#9Hy?!Ay^XFvVgiTj|=cBLG5J@wp>P19oq}xzc4Eo0x>e3k$9ph{vg5_A{u3o
zaWw{9#z2ZDaaWMw=yrWRzmwU1E+5nOSOgw(ZV?v<EDgv#Y+{dkc3>E$Nr~~eRih0q
zpBWr~6xEBBYvXX$W*DjE5toabYfa$5ftP#&jB6r~!M-gHHCPS~uIk)Uj98<dn+6`;
z-%BG?c){?V%gtXb`)E|XN)=Ou6a|%3+qA~`kLPb>8m>KC?>ydj%xr2`Qs`W_)z-s}
zFJ@hvZ{<O&T75TX3`o$g(WZVhnkUN>?d;Tl_zxsbz<+fOca(f`xm|Z{yZYry?|hlH
z9QW6H$yGJ~vsF#i2XAnK-DY&z-~`(|V}lc{GaZ8yY;c0zYbO|dx*oO<%<#g%a7+`s
z!lT$B#KFXOJZ!rr;}$h7PQ*R-fq~?y)XoBB7a~WXLUlb~+a>d=f<vH)sU>TfW$c1~
zB%_ANrX_Dmov@Y!Z{GvvdDmIWQvKY~|Mg{8^sOyuKVl|}7{@jVBkZ`;#9?HI*bXcs
zV#2bSu@20AUluf7=p`wQHQm*G8iVzL&gJbaLc6bSh%*K5rCVRBwtbDII*Y{vU#KBv
z1~-U}1K%Uq3Av9$15RGk_Z-(W8L@+Z$8A2*`bV*o`DE#ohXpNdZqlGxDU}tzo0F2D
zmFIbFE1Bd3D7ydq$DE||gyeC#_-9RkK8;iG^{RMVMiP>*x1@A*+Af()!>B$bSJ$kt
zLqgM3NG6kAO+8Bizv?>%v)5#D+i07q*rhi=(z1+<x-Rt-MBDQMxf@8T2a`j8lIm7j
ziRXvn`W@)P5<U-C)kIcTi&D(wuN(4}lgUITE3ez=diPu1>dg#EM8U*ib9Ic2{#58P
z)io&51?Dy*Bm2ZMZ-*jEC)@LsB#Sa;#jZ%T1K2zgRB=`QkZ033Bqvj$K$ZtzGif;F
zUtnh>-vJ$ZAj|EE!@YWb6&KZiAmt1B(hAD;g}Mi;pD;flt`Q1sTTX->5-?0H;bY2#
zEeviMp7+S{S1P&F-g4eXSHaF-ioS)GE?Tzq0b{iGEStspD7zb?_QO3sA{IJc=;DYP
z7Ivt|FtIEfM}8RjG<1C1zt5ar@3YxP*L)QMsYKzfrueS&+*%C58W%r*RJnA<+y$U7
ztmtbcKaT>>_oGN)!|(}qOh#~Ea)C`ET+Ypq8y<PwUmAt<g>QyN#TI)kp-t=NCf}kp
z>5w`MrTwqgKgdjbE897&zm(RqJ?(YVzdci4w;b(HKAkkx$fVaz&mr%1OJ(`xN!`UK
zpH8X~4PWmEoyMiLRPF(PPf{-UDap?VdZUB8%1ktVa1^p_Nn#%qylb$K1c8k`$FZ<u
zaE58%MA-ESk0^D#t%lw8H$PniCJk}9G3-8){4FkG8YgkN*n;|=RYo6(H<30GLO0^M
z0VGNCSj(ny@%?XelDyBpJPLl}m+N66-y@eX%duQ6T!6p3mVrZm68hK@4zrl!_?)c^
zw-}J`_0NEOzeV06Ev!rL_Y0CF=-r%7<D#f!*?mZi`e1g6oK6y;U7lq*XbE%yv^qdi
zFNt%jk_EI`>H>sMWojf)F;rsY4wCi=z02k~YtsZ3b(eK&7|D<QBFX0b`D~_ikF5yz
z?^Bk|bC?R*LzR|)8M-Y~=V}1?+7T96OPd0?csWno3^5v*pT}~pVT7$-7f^6IE0YDF
z&sj2u6vE&ORvjpSr@C^36=YhW;m43Hcb1Ta<gu1%r=c?_=D?R-E>yDkDqEF;uV)b=
zsH{ljDhT^CG>b1FEss<S_4AOMI!<-wop?GEd6A`xcS(|eH39J)*4c^REft8+>;hCx
zRIqF&P+Z<J;JujB{Q&Q-!)QdU5L=!Fkw%`214dm;94m?(>X^c_AGd{I1K_<PZLb!2
zXTjDxx@<4}?djiPZ>c=(au4VQeuQ2F!8V8_iCmcNra%Rjn!4aXd0cOGwV95=`IXH}
zl*Ex>3zmp~`V5eq@G5;8AGNrzY0t~rJt#T^&2LZ937V0-5Wj*I@9-_Tl%-BdNxD?d
zaH!;5=VGoSgx{VXH8*4qldAhV2ztc>E6a5FpWAJLy}}AV9>_^uT|H1m%iJqfIun)1
zS-xdB@;@Go`k@0bNlmJgm3@YWJ9Ww)^i3&1Q`uC1a4ocWb=babeMBVt<#J@gj@@pJ
z{4;eLD&N@SDyHGqCi*$-r(2rockR!ythm+lfu(8y=&$+23@lXxOV!q&fu-tEvsA$c
z?_mS<9WxZ%b6hMaGqJ-X6Vos<F!LS9F>FGeaJ}{H?t8FX_JLgi`aPk)E!?j`=-&bO
zy<Dh&j{tt}5kGXPL2zIR3p<uia6p)W35}>rsVf}Ee-O(RP2;Q0>$JTv+qsS<pR<Hu
z9ac)QwzZ5jZ?%;3b95+IdX}q&{ux&B-f$sU#Sb5uZ$=Jt-6+7m6&hgYi7+)Rf`x6`
zj_U<9jH1VF=h=YF-)QHlPx!q6`CrhSvk~)uKiGQK+IrT6L@0a2wSpg(9^E<2p_tP?
z;0Mel%6w960P6G&HKVaIS8RWB$y{<z!yEeZq+=IamsNnn(zNJ;?dwCJ!w~3j`{MJ1
z)$@GLs9|%0xd=V%*g=3pgE-hAc4RXW2Ap}1Tj)@M4l=P!e6=dJwJjI)MeUAYy$)`F
z+7~pW{N2$nAuUWT+Kkp|p-^hn7EQiE*A-2qWbz<fO6~iHx9SCwO~b;;@{Kj`>!{ha
z-fOs1`maVW%o7yvB3+EDi|SYCcU|Si*qo*k{aTAMXQW&`IH($2edD@+aAoxIU^GC3
z?|fj7*3=*D=Q41JVLGP3F2ra!j%8zi!l;35=Gcx!oRCJ=J+?FbK$1eBpT&eoa>&CU
zejZ8Tykjq=i}q*bT}jF<meU$(w1l7nx=W}?@FpKrF-A1c&ShHg%e2>80j;4!_>zh%
z0v}BDRzPYgNH+CjPNY_i-sgm!t8ex!&w!y0)O~n%E|ZDN4{U|nxOMZEdmV3of*RNZ
zH*isl@+jii3#ow}lNy+EPB66`i~12Ef*Frs^SoF1xxa~=$E@7J>ChJPB<fi0AXwfP
zsuDyBfX2Z#nuE9msyV#A?oN>*HgP%`qo1?#-Hc4f2>w4hLhq!E3ketNE!qvEg8FoR
z!?SpDmMCuFCWqUE%<jrgs;1<BVeci%Y3K_h#E!!)?3jdO5{3~DZBsZTFujniqaS}%
zdfUnkbr{L5n(D1Os;$R8Rc_A@&lrqlC4769KRXXcq1u4aTUJX}Fx?g<$;(1gU@z-F
zosl*-q>!<;_ww#8dPx0v|Jgya_|lri4TPkJtY4UR$VA{6*o~M4XS<1i!@#$2Xj0oJ
zz7rW@;2pW?u`WZ&l@NA2^3!m(?|rr_Ay~`6?UTLr4Q!wG@QIDniJ}f4jgC6ckJjbY
zT2W}@2cq-9@KLxIABAcQKjhDXYX?j?#Ky#oBJ9wBW8!!owoKm^oKlN%|DN;7m<D=d
z>6kFYvnh#F836ag&r3>wbXR45U+0ObAM5bOtT#C=C!2&+cf}F<Ydkr_Dl<)8r*x~3
zl*e3Va*@${(wNjFW>KFTNRe_kG~uf24_gxsX~3z$d~DGO;@*896JZ(HGfc-b43kEd
zegF4Hobvc0=5vxX+hq6s(R#Xi^oD!nZmjS<8JF(q3XdWxLW59$Y+511jvo;ma>B4{
zFhX4`Al!8yx2<Q1BI=EW4n=w)l58eM{m;V+AO2<+MOUvV(BYELV$cDuVc&UUDLScB
z`CfYFo$k$b68_3kjfmg2ymtisU!J_NG$R&L&jJNir?NgfR;#W-Gx+LRY{z$r)M~G#
z@zqJKDA3>R*kb*Eoqi!lEWg(JwJCGe_K)1IAG^B2bUvjb|3MCQuQATk7#=YF-3OQL
zKb4gn0psWUX4;V=#Z^3=Pk+c2YsYCkiA(5!c~>d6zHl_&jZ~f82(#|18GxFB8Cns=
zmPZ2YP_PbD!^b`m5Rm5yA|5#t$dVw~)ti=N!a*3kE6%=uO88nM25u7ouO<4mWWGV#
zyH;k#LE0Ony_G+Mw5PVrAnkodv){v(_IyFOK@1aH)b+4qSuUoY<zm-$s1e$(VVDoV
zu&s=2Gm(RCTSetc<Md9JZT0x&S<Q1;Kfa#PaRufWVW<i6SS!LtmQB)F!nZ^^ArsL=
z@hHB;VwTB&^&~@!vATD696x0?Q}gn`?cy{DZN@p~9=EY$n*<Y+Taek#wOrpMrm>EQ
z_8x5z#U#3Jhsb!G&09oQ0DDAHlwNa>+?~a(NA$2)x9LQTcp=5YbS>-<mt)E;h7HSL
zw!<vT8WMx_l>Pq40GK^@S?W9Zcg9F6v4XI(n&>xwe^MX;sW8ytdKO<9LC@oYOldrs
z19m|75~?fWX`GN;Qr`{`;p;+#;Z>{x2gCJKMJ^0{@)ar?F3Suiy=S1ImwcU}p?*|_
z-}Y)cBL(_+@aL*`JDDNsDj=^)^*f|RkyW-Y$_s;q;x1b#?t_uM77HJ?-b75_B(_Vj
z?LwG;na2bsq3L16wTSDOhG|-loYG*)O1>l_-sY$C2-Q;PlLA3Zr}}8d1xm9L&2muy
zUqYO&{(z#x64(zevv~qq*l+VV7qaBbiXmPu=g}DG>*0FyO?Y{V4l^p*W`6we@^l1E
zLRe6`^i8fNVE8ESX3AgU2Dp{4@=Lz%fnC0T%X@r!W%v7^-S)a^-+Rf2Pw(*Qy)C8n
zVSjrA8reRxC^kIEW@$SnCT3`1ix9{4!jRd~7NGk2n?n++ZAqwh!XZ7ZWK=>3;@ZT)
zUdTi2Sf0Q%3L|X#LCCmo(?|@-sJ7zYhGbN?l8oxDU?9o9ml%1Sm14K_Q|~KTJ6BbI
zEag?#p@%BtluoHy$>C$f1?KZv5;LN+*?=6JkW#1`L5c>BQ~iL-N)@LUq9|h!+_UtS
za~yFw^!?HtIh6Cz^cnUoGs2E*P)r@y#g5A;cOy4s%)Q6f{8ywXLDlNL&*~laXh1eB
zg<AVkDi*MEH1%mSWu029%66=<hGSHJkVt^W6wk&8Ue&SufT+A)#ayaNN2(o->UqgQ
zX^K-t3kOR}C)vu-bACZmNMZI@U?=??&aeH6`Srq+)3IM3?vS!5^q7fB=mywvO&3$s
zH?e65W<@q7p7#aFY3_&Bz%(`<RvTAnCk-At6_G-H!HM)biee^^?YaA&XdBmmY>^?7
zl4JqBhopAv7jP@@_j0apb*h6ZTxfHzj0ayf`I3C{Ylk*?jGn6K;!Yp?N@YXE%SFNZ
z8Mxu@lTRnDI=5!!)}JBSV|cXbKisX7nrjvR$)}U*in<^hP^ZQFcm|EgKi<R1@yin!
z3OYtV!s+qk(~0~Sw0UX1zA8n34r%&ii~Px_lb1zxO<mI3HVh4Nf~y(P7skD58e%OT
zn{E4sr~W=UlWos;xe-LzG(8tPk>g|H*)|rAZNcY2*!<zh9DT9zh9ZZqZjd<S+MAMO
zKY7EWA@@8$tMDMij!z9te2ZXLh`_UKBe3`*C-AzNyiu+8ha+zMq((G<2pogJ0l6D?
z-B+-Lq+3)kKfU?}i~j8#`um6*+!MaX4T60k1a_F=;y{EJHjOCsEQ`8?Zb9@8*756G
z$CW+qu^7fp5wgG!Ddrv(*x|N^L&FO&bsak(H1auL$5g$p?zQu=U69>Pj%b8e34VQE
zmV})PuF?*V<u#@17Rq9O^?Y7tQ&PqZ)jFqwWBrijmn4T-uLN9-v9hzq(gg>a^+n8O
za`-}#*~%>OPoF{~q-uD+)bP`%091%mn$1(LfeZ~EB9*`gnTwcE$g=SCDXIG?sy?cx
zqPmYypRPB*Zg|fuOL+{sAW8lf7cq^KxLj<R;2FuuRFonIWgTXJ`aPi=7bIk*AbG6c
zOI&>a+ngltvyIPO5Qs1b8TUHFYEIg#5@BRH2%{I-Y|;Ja>u=+0@65;~o?*BSb{uMA
z$F>Bf!Us+lpPQx=MK1GieP>!X-I^`o{^zU|G|SGV)n}WCuMXi#2oXHq`oTPiOEI{t
zl$)sJNG|7-k8(eMV3Nd>^cf`C`sQ|AR?FwCJjGfk9(t)y$Xz{I0J74w;PokcE~@N(
zpwW@CVG)-W(C&eY{=fhG|F#0RHCI&x*e{Wm2>`zGiOiHk7rmoc(^G*0SSy3OXn;rX
zyJFO8e-5B;s^Ti-Ogc)sbV3B`F8UqG2~<8tXCj$_**lhhXtij8W|H*-o=Z8JWw7;P
zlAt^;&MR8EBQVXte@~x6Q1)~R4RY<odG_=vdOn-MGyvGG%q96Dfas)_S)ulDZ%$Pv
zqKjBu*1*61I0`h&iXx_oKs3qNIR*{9A-yYZ(Mc$ecGKSVOz+WQS(XtR7Pbu<V26kZ
zhtv<T>9Ej$w24WrwUW(!FxoBe$gZJIW9K^f&0Mf}7K3d>tv;f>077pzu$#meGPh-G
zjTR_M$OK~BNFj-A$1R52EJxbjaD@IUl3CF#VA#4?E?2d(WLm3gM;3z3A$=tx@N6oI
zYMm!BTOg4}S<b{%q~$Gm3%4w%{Z^G5M7Bf22nUvb!?6>w2vds?%zbVL1|df9B}~D0
z&K`$Wr(azPx{>P)>}_hT!HL&hQmqxGmme%=DXuHy7iwF-(Cd8iN?eHKjaoSW0%Q|)
zRYg3VC(;d~87fwleka)LS%H2caYC~zT~M}n8t3}^baL|X;HBCVJqYVhr>}o)(pz+>
z`A@5V%Rh<oEaSxpb)Nho&Wo}xqjPJ;g+i-#svSXMs~3qNGND$Dd!=OZ>$zAIy~4j3
zpGK>idN-$FwVY)6LO0gyft(H9j7lAs=Vb9~BGO5D)@|gM?xUYZ=sRSLt8`u6o6z}Z
zsMGU}b;<t2LqBJz>D(cMjzM;>?$G{Iz-V-T!#|7iGRw~!d+QiI!A~GTm_GK}uFtBX
z9UQX%DHi>*@3WF5vN}l*eWGE*W4&~nJFT>={WpHnHr9^Da@p?qVB=LDjbZ=n{uq?j
z31C-FOP76Hib<_u9xjdV-+SHu_ilH(IVt`^_^<Dk#PjPLk%N_<OvJBxYe`Ty&*n6L
z5r;WkIPABNj++v_H!wm^O~V)?Yowc$$BrvK=Dk|_KJ$7Wo_so4IVaMS4b7=@L3+u%
zt+)K>O_5%+P)1K5c(eNx3Ag230^3Y?PNg4wMyB9h@60aT_zMA+bUCN!PftFbY@XxY
z-Q>m&CC{?U=itLAV^-`+xOV`VB_%<B&{g?Eo=x9WrUq$dh^OKqTCKkn!(e-rUW;PT
zc);v?Uxhet{5jut`^32ijFP$FrzAhWB~nS-U}poT<ilIl`pY;RUl0BGl2Xp_njiXW
z29b4m%Mbl6chrz;y>91=iJtdf^8C_L+a40zRJuubRU;Jh;lVRx8MnF6w-@?<H2xe+
z@<o=He_7nNjt73u{}j^D`u|Ks`YR>*uN~3<S8L}D2R(ePaU<4k&E>Wt+t=$}Gq=;c
z-QKM2J7-&GZ2Q_fkXh6AG%_$4n|NKGiClWz;iNO}FeYC)3ox>R2OH)tLdOk-A7GC<
zHg-g0;m{2|Y+EM8A-l{ojr-4kJXiq$vItd{T(!ftJ0!Jhx$ljXG-)*ss!F1!qZFl=
zyyKu;?RwOS*_vu}H^C1%&C<BcWL00;?YN)!QBcPX4dP?hXFhg(E5Ic3ENpW>3`iur
z$oc|QmiN&6SiSruBnaGqWuR8e;A<Rwjf1c8Gx!?SHv;@UWSvuVWZf6-JGO0fY+D_6
zP_d1U-5sl9+qP}nwr$(a&G&z}_u;;r+GEstsBvnHefFAj{pLbio?50~aR#zJ_S$Lv
zV}8a`%ewXh+Fvswehx$k{%^I(xOSk{q>S`AAaR=u^|hPlGT{fjVQxR@=~|YV*w*v#
z{v6P<%jIXNnyE~@b3fzzOSc6}qCatMea@t`9i56kH_b_1C)R%s6}<#7{l~x16R`9|
zqOuc`HRC*AZ;z$(`^^;?>mkg)#;jxYDx*IXB_qQ(*VBuUxvk9ANe(GDyDf>EyBJv9
zz>Cqa=pr}IxmUvzdrw)nC#RSM={$Riw6!gZyDsU+YrZ%2zm=uzR8K}erJ)@qzbxGS
zwyYa^mFxF9u!*lZF0};bf43eax`too2VJV<+L--A1@a`na^$n1a8URR)ZkQ4GwH}R
z4<?o`MbY0CI^)gn7WyRN<Q41{8!UUUjc{4-B!{Pfr)5%B8+BX!$qe!|a3x~{vk0-%
z=OB!=_d+q*BN*O!%IENUy?-P8*Cul<3~~NymKlzcA>FAh8cPbsqT}<sFPMf}=>`9N
zZFXYA4)}H3tS_lL{tv|K7F&B_`i_p@?N!++|A1Bve_|SXY?dmsTcpe58&+Q$z!*IW
zq3Yx>-16k%qaD+@Ie%_Wo-)zUB?QnS?*B{#M2Uq8w)1-NGse;J3I-YwOu_ja+%=Ee
z0kq^||M)xv+YdMhf}(nSFd@5xK3#iIyxm+D0iSF&S?i7T4hQThMv|k(Tr+p+ta;?w
z35(G1i@2033<YcXwumVn^Qd|w_u9CKIr?n$HP-7&dO(?dOD@CnPc`~h^h^+NvkPbF
zBd5Pc4;Sc?TobbiT;4H6eaKhv|JF;bDkx;Tf;8z{=uSx==+c<{DfNc1|FS0c-9H(9
z0q&%>;Fg8-HXae0wu-~E@0N;dKOm10Hd4rUHW3V0FIX(m^}G5M#+GPlPsGwOD8T$m
z2_FxBE$&0_4dR+Av?rM+O*^6*qa<6v_ox=yt^EPJz=Gjwe}8|%;dPeeXtRo`3brX^
zNe7+R>_09Iu9;;*y_-*_t_|`^qeegV8|dofulvUwMLJnR8#(p&ABn2Uu;gL>6#A}Q
zh}5ExeP(g=P4f5A-z3@QnKj%(!r)!jHs=>Lcbey{_%^LMK7B&V%QxC!L4~#kYnYv9
zZiP$(o|F1ZJpFH`oX<*FtTm7lWF3>JPRd=10Jn}?K6%Nm)B;tp@~9Z}d-O05OJGNL
z^Gps`Dt?5*RX?6IajZb7gfvsWD!FocOc+<$a$M1$oKBqTNCi`ZzM{P5kN4I~0oN#-
zpUWSeG-~6f^GE<9I8^Rsk{>H@!oHrIe~V2aRku^0h-#l$7RK~Ouq!$WiQOBB6X+WA
zo_0%Frh}0U+(b(Ek@khlH-g;KDuL^f$4ppgvHx5NO=GO8x@f-}z{b`p$*n3jbrenK
zsJfgo79<`nuR4P|VRUx?CV|7VvijFwryHU^gJ2RG<e)HNrk>T0Nesu##Hzg+TDV(2
z;Akca{!1%nO+3Dz8S;}FUHEf1L48|0V>#WG?!kA=d<oPTd<y;5bxAOciVA!xXgNpH
z3jd-VV!|bG%p#0P>)HY5Z!yuiJ}(v|oe)7XI&Lh5GjWA^`ctE43~A3zE%JEYP`_QL
z{#)d^=ZHC(F;j1Vx6YTS_{qsm`i9cENB!#3wyY^a;+C9M=cj`UwtjC*0KqA4GB#hY
zu)j&a^*0|!(D{d!>9s*#V+JVjEvB=ajY}DzcIwmSk8D!fK6h>eT&4MopRxF!U3n?=
z480Kv6z9I}Xx({ykjyh#8F{V<;I<Wf3jO<jwK=Rou{r6$lv<Q12A7w6bur#X7w-{L
zoT}@hh<pZW5%Uq&#`3lPIQ#%VUI@Bm0Da((4I?TSI$vAAgXir|BnCn{rAO~YLx+Y)
zwusR89eLeDpO+Ekm&u#biP{!0KHcGHzD33?U@pD<&9a$lPKApmF1R^n#a4gn2}8hK
zG(9FJ6L9=#VkAqK-GHcr|IF80X@sJ-9Am1b=e_vasje<qr`u|AgwT4rG^dg<&}Pdd
z@Zxff*5R9^lu~C~IR~_vQ!Y?_OIcXxv3t+HlSH&QjW)Ta75{-?ajK)HRE1_a^R&h1
zP{9t{{GBPYH*F8?B+T2}?_hNf$6D<nXvc@S39M)kms2Ctu!TUofq=&Kp6r__61A)e
zB8YLU*YVRC+_KPUwoo{&ZLz}C&rS0YLG@o#2!(^WYEPm$HwE@W^WSHTaKVV|;wHb2
z_aGwa$RwK@Zq)*QG6fT~yn|ef<6_*AbDHKABd*=uSxp6XN_&Rk7M`^wuQYZ?p0VOX
zrW^k9STYVYm@{MItYG0>aIbw8Qaz+t&J(`;q$e8bX>^dV^V)koSH-urhBjoD-o3RW
z-$$u+{Vxga7>IQ@XUZ=3;N}eWrmUmXXS-DPUZ+tENj#AHf<vd=l%@C*zklSOucCVU
z31^-Wr`YuwIc8_!mvLd1h2xFx7hti0iWfcHWIW<V_SaQ^MVpDXTUJQtT;5<$$OVK0
ze~n4<ShK$llJlCPr5%QhNc7H~(DyFo;IvU5h&St~1uVa$f%miffG0ryF0d({^?c&^
zGS2OK5ihsc8BPhJc{+k1cicAK$LFxiy9>X#%-o48-khQD)>N9kj#(N{zyr|&Aq!F9
zYK)YKpy;-_98v~I*HC*O2tjsn@atj)3tAi{kf%Cy`JKk^M7E+(nDH&rIGj9}`ee~x
zxX?+vfxfPV*Tn?t;RrleNdW>~X^C|vP>9P%yv5*8x-+p1?X0scV%qkW!zT3B7w43#
zm6Lq4$|6xBOoYfAeo|fa@qyiYyydf7{KI#C2~j26KGy&uUf<{C5DzpoVGkKkzh#qs
zJ4|pS<g;{JKc&a{eqJA^&Toq3NQ_VL-WvA>NN8LQu*QT~-qBa6CH1`+W}zFpUZ)Bs
zq`rQ^bUvjQ&I;;yU2ZBj4urhxLq<ClUC!a__F<I44;VL2JYW(}@43Bqox$`gIAJEv
zX~HRk6uLL!bU^SvHerAqA3SVe(dTdz1T)#IODVkKB7W@|JsdA2y)KCWqX0d}jtPJP
zBGFs9R7yfTeE}agJzK2FB#Ar|G%p@Cm8<_~!*aGQpj=+wSY;hIdRob439d#)w)*r!
zgD?M}(x@>def%|fb?_)D`v;@4Jua6ae>*r6MKZfoez<h>{dP=dj;%wN^UCq=NFid|
z0R1czrNc_@wBZbaPr*~TTxCd;$cBp-_>=!9F2D2c5ZY2@l+FlZ${74yz5Ov$V2Ct7
zKDhr*cWn6gR^j;%P@8!m_?R%3q{`3)(_8VHTBp*RDLwJGZ`X(V*SG!N+fT_+m^o2R
zOZHGK-7=6UxmDYkG&$t<b!?J3Gf1hKD27o>C0%`j+e+1usDT+$cn&?-{HkOOWM!ZN
z3q4@h_RFn>=is7L5*^@D6mvHwt<GIuN+^Wj;kA4%<>lt3wFbMMj890IK?sl+YsTcu
zlNV@e_P@Z1|7ai&4mxJ(h*=W4lDqe|vqU!5*?dI)M<3}XQ!*`*l96~P*qQZy&HuKe
zMpYX=XikyyeEY;m$%~~w3CG<7JjX2iA_5q&=*nUswPuHOKfwPwu+Ry|;ldiY_>pl=
zT*C(t1xFIz+sfmcJxE##9?kFF-by(8Vl}2s!i@i0sG%&S9{+VwMI9knM0?dzc%#gI
zdGYPMKI2DqL0q(#$)A9ec_+L2K_p|34~?UM;zf$lM<M$$R9rW_RT^&aIck}cO9PWI
zV+&3a6!R7fWR^^&4ys~EHP39hLtwde%g6;NHul{g;D5uc4kX3l$zSPy<F6Z*{qsG3
zNtL9~WWZ48ThE*q$}OziO9<5;h4ySxx&th9tq8eH09bhK2em}z7gev$m}<u^LvuRa
zGcOy4JmF3TsP~PeIHJvBgpLN_r}kCYRT%<oMrX+0y*LT~Ru`Q=;p&)0IOBrV`!u)k
zZ7o73g)6RvFD8qGTJ30zUaV1Q_-)zfTBckIDeyt9NG2X^k8a|WrcDKKF@*!Tg_(a;
zbcGE%u9GoSBxWB@5*(!N67CXrWftO8u!jliPeOaZQzlU9!&M!MlgjP7Y&VaD#qQ-K
zl=~hCLk1KaIh)UUa1!9sQ|tN6YmeNIAhi9Ll^L6iX;(Z;7nXh5%!9$c#t^r6kLw>f
z2t<wKY-a8hqmwQXQf?rRBlQdU9>Tqmiziw22UNn9`_mIESFKkmEW|DID;6ESYNFm<
z>xalZak5B)n;{QFVI{G;e4I-T8$wd82!njp;^I1sa29JyFvL8I@m20z$oMqyi$8CK
z?faiz|FryZP(G%T>sTUnb5a?zRsgzH3=~Kk{;NZxRVAnLn>P*!Fa`}(QK$BK_}8Nc
z{bQJ)NnlAjIkf`;A{><(;3qGGU}3ncfmm3HVn|ZpojT2SpJ{|Sa=<Qq>{9Mujne$s
zs4b<VwkibzH^xsT<)7XiS)@e`WYDL?U99dZB|?zmst$vQFg!R5Hue$6fpC(O0DkJJ
z3C_+y>tr)q#h}=6?VFc9JFFq097t*o-{d#*duBy=B`mRgW)JeoYneas7ISXs{4jPs
zJ+0-efL%Ojb?ZN!XRVC8ggto$oQh9F7%I%#pdY$2$+M<`+!Q)i<mO_UPnyfrDJ9=I
z7413k`hg4&+*+<7v0xKd`zueq0wq6F#9>-PQSCus0XzY5NUPY{Z03V=2rriWy+n*A
z9LrdG3wv|whuWD8$r&UpkgNs2&WZ}Tuj<4Z$R%fFX5Y$#Go<CUy$WOoD|nwY4@8|6
zG+MtEXnPXb0`ao!Bo`VLfg#TTp$$%SekeL3db4u~pMx<W!(C~g5GIdvBavx=rg3@P
z#3QaiKK%woYb%vw(6$T(RuqS=#^uRL0TsNzVljblFQNauYF--FQxz#X(V4IpK*EU;
zED`J(+K&%ec9Q^oLZgI5t_tQUVjg7)ArwEmm4eANv%@}%LyGYVlT^7N34v?Fg@ys%
z77rSI9oH>v{(o{<1?QdQf2K-d*1OPSPLS-@N9UpcX;18xdadUYE<!lhN?SY~k`kcy
zzc?llipKMhbrs#Qpnp5yLKGs~A`_OoDGZD~NNwDCNk$p#^Vi@gOvhbj0Ta|W5ejzs
zA^q+RPu>x-xuT7Gsn6)+F$FxYF1yWIZ=?6m^k<%Dac_;9KYCU#U63O!NqCho<xakw
zvB(=|DKXFjc@!Dy?cc$CoS5#dgw_d4<FMy%+tPdr`E_BgMDGY0(OpI)a=pxVs{0nK
zWxZ0ON-H!Zua7oyVE$Gnotno;*){VVXmUF?QvGJ|If|5|;8jvp_61DuI-T>6d=OjE
ztFVNGvuCy@(xKzRyst-WV>DW}u!AJE&`g^UP&sR89l_FLG<h}C%X>4|QF03ZbeWkA
z%*mHzMSU<DTQ7snJeK3vb%d^Qy?AP39-lW=)D__LTrKD*&~bacS35I%5cUi3XFV~D
zdIOIWLO#c%7$UX9p8_@{??DD>lQ;zu)<nz9=7joFXZgY=Q`9xf3B>Thj?p0)!VWem
zt|u}vNiEnx^Juxwu_X!D@Z|1m9*VKemV^tf<RTAeO1yl&09CAbFj*oijh(_Cx^WwK
zVGFk?s$2+>W?2=d9#sE?Pv6k@cw(W+!pk%xCoA~<O4P!6?F1UjpK%YeZo+{2j;XG|
z>8M=qR>S*t7&1;(BI@auLzym|h&MeH(DYuU%}~X;rOm}p{P7Dae@|O;T&B}yUo`_0
zY;849hjmmE30%J(l$H!*&hRj^IE!GR{#JtLAiImF80XaYfm8E`PeYmjvpN<xN))-c
z3)8F3K&9y!Q{W2%$5>p%W+!S!lewZtsfCYFXnq`h>udC3Xh5Z|l_vVh^Zp5K%Ha%6
ziU5Wx6?Km<92i>AZ<!F{WbVWxyDbE<={HAJzo>#oNQS-ui=w}ri=F))Iet)u@b|~t
zJGp*`A1As20%Fr6JyaI_@ypv$o(he|inEl@JbY9!_`r(9BlUG+P>)d%^aDro9&|1f
zLgxTu&G~xzRf&-+dd!B<Sk8=4-v%ZN#53rsBUCz~YVVn8SbM5;WVE=J<tCkAYxaz3
ztXO|Tjmlkt@`lf)paubb^|DZm4f1kFNhk0O$~>9B(LW(4rfyX8EV<EUH6f~LfJ4%b
zSfP3C*uY#)Nst6}9{~jv-CimN>Wb6eUzCZC93>#?RR;0L%;g9UI(W^mXyc|FkhENk
zZ%gMF?ZLa)<cg(dXfu&-0c9!{?$-Q_FpCwSc$D9?*dL+RjxBwag*(+xlqCngr6!z1
zZMWp)N<Ysngc_1!Q|YmtS?8#b&I+ud4ydwRMm@^XqJ)}KJc#_n+h_fmVvFT9(Y)4Q
z+ggx6lOeZn9Jz+#HAtKgqSn@(*Y!_eUikQ}oDD!}%w7JX6j@JKqQ6n@^qh%EzRAx*
z{q=av$%i76Y7N?TndJ9lUK3`114$a^gTxd4DW~F~H&(p*Z~r8{uvy^xek9<y1ZtVa
zV%{E1nBPWUNeZeq07a%?p!#67_a00ZJ4V9HX`SD~q2{4usCcG`PJ3-IiIyJ{2MAS+
z@LawtsD?xJgtq&l91$hpa2GAY8O8bc+i&p%gI*7WXQ~MZpk}p}A;3kQLIT7I3hC^D
zt)dgz@wRtuj~6vaKem_l9jFlS7IhR!Jt&tne7Tj*gD4iX=PjJbEU|0+)}ecs*Ef74
zENlc+k2D*&&Lip=JSvxTC>2;?0jo%*sQJ%YkPG;Bl0_lWgDSBMcjd8IEm+QDyK6(H
zT27u`zTV!ykmA0Gq__lp?!OSsOO2UJcj;M`O9TaGkcI7(2`~m?OQ~hOf69e%0jiuL
zmKVu;?PNtl{(aEiXVcWPC4IcHC2=kAH&jhPJ;~ea(^H<=8p1L)rk4NJ1!@`1rq|-z
zrxH8y=D2RsKwaY+x1#nKv$giq9OR_l$};<S&Q%L-U&^z1LmU1bVy`CQ$3yeuO>Qal
zvDSi&H2A%BwC}w^V!^#BJ>b1)v05qHjeD73@%YOEWL$cZW53LMIT5}O87jxXh?LLQ
zbBeRZfcb<~8e6wH@aLAFE0CT^uFDysy<)uo5&E4rI*!|+>hsn-05Hi^%|rUx{`bY%
zxf7z~o%i3I>Fw2t+QG>*M!G=E7m5#iAbByh6`u62YqE<^w+u8M6rwQ&2H_LFm#9N&
zBw3PGY1{tI)v8=u(G?I>G|6?tmKHU^pm{#FGYH4O0A(^Ky3Epu0Z5)V@0<ca<bL=>
zEi<S}dE)K87lL`pk$b<dy<|iiw3bvOY=SWYKh*>~8MT8(Oz$3Ogbpyk4aa!|6GbP$
zIXRUL9Jy>StB8oCOkxKf!o1eMKy`QU?AE{ZqWc)6fJ!F?B)g1*Z%lzE5j4n1t7oni
z<*lcCG+bHV*u0nd0axjfGJV;<d%;pxwv<laR&+6It4-Q2&DHr4EH8f?$89kR;=k=b
zAtk+gfxVifVhC>9MAtM-#RIV>F%L+YtRr28@MVhkj7*S20t}whd7Q9E*)if1zn&eT
zaFOKDa$?tKpP#6r)X^mdE^t+6^LLL`s~=29Rc|9)crvHyfHVr3R9|a)O1MC;>w8sL
z&C@!qjO%Vh_@(IO0)alV9}=}jEHc)k{`#cQ8d)2ql-B$tvx^;MO{e|~G%k(o;S4I4
z!JqOX(Yew~nxb=~MRAg;7;qt)sV)U`hCAPL4@AE-Vk^-(%gBr%=<Wg1$mftgU>Htd
z_}CN!nY7yGz!o0@CL<<w>5^B8$`j>R4FwRoIQ;VCR_`0OmK>Pw`2%9MD+?Lh8H5Rz
zVOy1AHnnHSa-s#9`0&dFsRmDBS_+*@MJ>a=Bvdq{V&%^JYH2{<T>w*uqw=xe-_Uc$
ztOZb-1%X<1cG4$1w$h4!>aN-@nRd{P#4sQz@>I(OKoAO<=5VDk@-xK<0oJSm0)v(z
zX`=>i@uz2nSpJC8A_ePe)i*lT3+j=Bx<Z8q$?`-@ih7yDR(!lbY9@om?(bF(L~AKJ
zzkgC9U&9(|&Laj5!H$l}C1r=~0~Np3a_nT*m}Sm~h4goWe?avjC&L9b2O2PE1r3?%
zowM670CgqR<kWK;jb&q^1LmK!W%#I>b~ySvsmVFGnbo(owExa%k-VA6ZpaOmR$PQ<
zaywGN2xl_=I}Hv|a)Rbb4f6zJ!A}-SHEj$kLC-nUs055d71M6~WQ&qXcLPl`mP<bk
zQIdOcIlWVRcqv=_JiAl-PUO8)<2R92lyLKx2BHPcKQP&o4MgXoLuDGfbJXNtRD}FF
zYmsl;ue!a4rI@di(lfSGT27Q;ZW2aAgJegfo9m98@a!{<oET<tX|B3c`#L*&zlef)
z$a3Iw)rk$qy;cz^Un8%2B{$FyXJ08suQK)QEUc@;wJ&hB-l#F3DJ7JPTf=j6cM442
z2RfwE=2ee|ge#;@%#=({&QDKG;;!8|faZ`Yu=KjJWe&osDNt<70A5M+n7GKgZd_>c
zvD5SFSTCNZxh%b$0!cBpc*8JgbK~63%WJ`A#$u2BMR^JpK+zd~eE!8b<5gLVSvo#1
zPxl~+Qx#<De5DNO^s8b~!9)f*fg{XG0g^LARHIUe^Lu<8_pO*HH;=C1_-1GtrN4;Y
zLT9#)h{un3#8SBS8^W+&M_s}<nQ%z(5sb0u!217GoBAY`I05($9(<E^soDk^HFV!f
zAZ89iNBNi31Nz4AK-rzBQXfXj=nQF;9T(ibcQNzZgFoJ%|LDxTUNkoxofaqm0#)U5
zUTYgCcia;)%HJD?3%T3juTAAEy#xZDOZWml1Q<s}El*K~n&ih6bRG{xVS+{{n^)G;
zGw4fpxI}?(gN!PWxEmPl-E*XQl8B6M-nHiNHt=TqNk|89i=2hVi#4f=PqpamAO0x6
zT~T&Cgohdg_s`F@6&_%>H_@p_ft2P7g}<a}6)L#2ChEM82VNK0QGqE1b2G*th+F{C
zlzK!=w~)Z3ky-s>=`!_9FR#13DzJ$7sso%(zzbUynHUnjuCZxF0--3mu(|Fcv^75>
zLzulPZKzmY%y^h;A}3pJ+=sEfWf^~hIQW$t?P1OY{K;BQgh(28wlLQ+(7D;qbM4+k
z>owl~j9WPVB!9(4|8AG1^>UP&ei~u;E*C+`bcqouc5zSxPTmVfF*fj;WE8VLm1B()
znpBJ~?p~@JGCA;n)rn5fPcqE(!_)KVy*nKEIs}8#DqtkbiZIn!AEw7{h?!sd1@e%r
zg%^TbF0ifGm%`w0Y8<fI%6w*F<IWzh61QLXJL^;%KI}3)R25G0C3wt5vH6F;p#rrp
zkNH?E<@)YU5UUzOnU|W_HewmfYi_Y{6|x6AoWv5nCpS05fX(&6ADcjd;c~Y_3Q@<M
zeMH{4`sfoi3!LlM!o9iL6BF!(E^)?_b>x5r`i;u_`USb_@^7-J!a{0dJWJ@Klb>LY
z_QjMTOfc`dKE3wwfmqIt38^f^n^BpOHpsg(y<HWnF|gKZa~00^a|9?fDE#Z4m=$q!
z6Jk_fBXe@gHBhFHi*tHxavdo~qjQfmLugvQ&)e)W1A(Y==wtV6Al6xLL7z&iIFxC=
zV{vDI-Wu(cZye~f0VDcZ*^=wFJ$ZE+(O9XF^%jaGP0%{(!DCnKsT+<+rRZAcz7$lO
z$bY{xkQRW2bfrf~{%S+XO@>4tlopBF4G6Hp)mj(o%4io(yqWL!xTE~tl(hxRtZIcg
zlE)museOdUT$ZJY{6Uo$H%5;XH0xi-;etdd#`9wSPa0@56Z)<^O*$GDOk4Xde$`n=
zHu2zWMcPW4T{(OniFDTni@LQ#!qH~jRM60n^xY>9(I&~387U~12ktGLiY_RTS3KOr
z)sd#UX@Waal2%RVbYe}$EJ?G^xNA*jR1-&>wSU64cR|5{nHA@2@>Ap7p==d((^MZ_
zx%7~N@!MHy(QNXRmB>@?ZG$mS9|KUH$1!Xr%Ivx1$>y+rKbRRd4(=U?V;Re>wfe5H
zW6i@Z6&qpGIIVo_kt|FH=PhQAFnJN7mLHtzWyWeA;&Q1rLiFc&0t5av$ZwVL%LcRd
zfJ;d6XF9Z=f;f$QYyqcjVS?~j#=sv+5E+b6m_V%NlEdzS41M8yy_sUiUxju~*s9-F
z7t1Qv>t<dIKW@uU+!6v?A;7x^eFb5#Hk|0B>`I<t^q@HQA4%-#J<pp5!_SH*<o&sy
z7mvt)oCVyV|Ei(gcK4(Z`ks>v?<L*-?~~9sT_=qnd_^RBqoXy5xXGXRd$w(%dOisd
zq5&{8SV%%m;rsg>FWpd%M;Y7)-s8)F6~%dP8(;(x>~d}%c9dN5rO{<1rr^nN!`%yG
zt;Ykdl;)lsJUuXO4>pc%JnNh<nWUPq$}eDAFkdk=kk-$0Oz&bb&C8uD=0GpE)rpra
zr^FHYS7<yfy<Vjsa<DnBzcJg&7<3ItQxBGrQE_>44iESPx#$=dDuFVFfl7EFCLYG7
zG=KkaLxKyXM0Q#GCId=NNPL5?Gi!-0r@`<i7`*|b)i;%hTpZ|BDC7a%`2+oXmtQ1#
z9U9Vms1EhL9jifvSC@SfIIchZ)OieIfrv5x8SW)T*%Z}9bl%=?ZGxg@7y1G8mX?t@
zF&yOX`>rgY@zWHgA4y!!%=|o|H+6-tF|G1wlA-@ftE8P|)<xU4hd4J~Urr*R*txH^
zsa>vLc)BlCc5rAPi(nRLD2pOr<mEQZgJUrvyKGjr)hAOZu(%=oBAcUAvPac1WhSFF
zHMaR%zBgmhb+(xs&^u}$e)a@(YXM|OO9vaPBlZMlqoSd5CBqE$kWl(KU~?95?YCA)
zCryS!@5!o~W<(Q$w`v#^q<K<Qwfr?d9E(l0op+}N9LU%nqx-kVzZf(?I&{l&lN>lA
zyX1;`1#iyZ3KZAn6q%({D8!f?C|aTxT1xq%+5~4|PzAy-7RS6<D2M>5H70I;Nxtxv
z?zlN#F-N#b7e0jj2-)m*Rtc>~(-ekO_1>6nWMXdrq14C0Y?^ZhweFC-P;_Kb#GtG(
zxmE)AaPGY2q{Ve4_TZ66cCtqWB1q9HB$oOQcdk5xoS;DiY>&#Ev>no~5a!i-k7D(g
zVFksZQo|Q|k<yI`OG*^5bk0CCv@1K;%Yej#+dT0~CSB`JMADUNw%xmK=iWiMPWuza
zeeOiUEzj*W1=E3v>uQq?n<Gn_kjBHaMn}4W_Xrxt0`9eL9q{S#CX2-q-aEH4BjORS
zBHqzJAv{$6>*oYQRw+VWyT=Wyw$Q*Jl`0t&KWsxo1)iU4mytIR;Ix4p{zf4D!18%>
zvlQe-^7Z_D=Ie8;w4XCHo38VZw6<qF`H6?s4LfZj%r)yScQjCS4YyUOyhBNN(K0nY
zEkg=-rd9O-%X@6hv$-8R(*B`hQ?tzWPFQw6%kAsg6qo#%MyekoUPG!Vn<9O7#_Y$=
zgCmg+q`aj%u$>AhCQVE0_bmjuNExO4bLD9xL5KiZ&sO;`PEzBQaIIm1O4QM+yuO`v
zBmVD)h1#2iq;(V(=+bvJB*tFG(Op*2Z*82ZJ+l9d5;5}DG&VkSmi@O0rN&^)F`%GW
zIHn^PrnqE{Bbo;%^e&YWuI0RG^gWDWC2hsTiHf}ja1Pw_GH2NsGPecc<sXQ`A;ydP
z#IM*ee;fL}An<uSHNDY=q+6)Zy7@^$F=vG;nBzRdL)r*T)`GeJEV@^`yytq|;0qZ#
zDaLN=O!h0etAh@+0?~&34&7{HPO(gl?6cEXKtmg9wBK%~XzZ@Sl_y>Pr8c+%jm+n=
ze8W7JT@U;dy<x~celaaFNQKbL)XioGPT?cMOzv-#gd$sT^)|1m8u<L199dZNz}GF4
z)iKq{x~0_k?bpyE!i?OB3+k9~D2bbNp8A1mI{g{<h$6$CwyO@Trci7XY@?MeKh1@T
zieh4c7|NJv>1h^@@9sCA?eC94_{Y-x+e~o}3<Fvl{yHusXTAf3f{p2upa?jNMmbi|
z&DH%}+z1Gtu{Rt%fR;usm^*;bMhQTI!A0sCUnag@2vt}|vf`sd+q32feCvq_(p$wm
zNF`Z^(_i<(%H9*W#$NR{bEl%G-}ec~OHD|0eChs~oD%06R*FBB6!$bxFy5ICf8RB^
z*Z|Zo_*xV594e<Q!I*A4o}BO*dMKep_q+oL@2!#UzTCv0v=XhyfYFPWHa$8|->Hm-
zzj1&)mDbCVy4FARfucZ9k)f|e4l(7d4~DZMtu<OE_Z~KyKTk1l4Q|GB7@HRV!Ivsn
zd~wn0x+?6Muo|yR=<-%fgmLgurP6xEO#sH#H}sYL(#<w*%9zq#ZGFJ9uj$e03f@VN
zZRxRQ?OQK0EGcS9t%3Uk!D^a@YaB0xt0qEVTKKAG`O7P0kwh8E(qxdsd;2x+IOP1(
zZG`ad(YE!MnLovli5cht%O5T~f)LN4Yb#zhnJu_TSOd3`u5TqS=JT`<)$I5mCJ6BD
z$vGt?7^_W4HqCLNSHLmJI0^$@r7nV3=vb~MUot{WVH@n|+qpWy=L?nN9;HGK8&IC{
zh5Jw@per@eKV1cp1NWc(Ik0qKWd$X+LV6!ELUu^O%7juG;%WZ2%%Nj}Cgnjf4u)wN
zY^EF=Z>cc*K;MeW6*Om=qQc$wfDcsC6@H>2QWvQUfMd*?AxBS~ej)hPX^NiSYBFgq
zxoqvy4(33hz~3o8{e4C*xRlzY37`mDRt``t5oQY&&KjvfS5Ue%iS4BmV-rV9$W(*~
z<X5QyP&SiM+fvrf#`~NFf~S$7Brj(Mfkm~cYX%+#tm}LIb{F%o6yuv1wFOcfaJ2ts
zui{AIKG43%RA5;Ri>+*W(oiArRdbXK#dx)Jok5<kJjFBb&{UJCSOcP9;cdW>GxHqH
zmactPnx5s27unly@=tOoB=9=lhu$hxmUq7A3z#^rVC0Y_o9-|n!=r)XfZ!(?8n%6h
zM)tykF51p!0NfM@&f|Mrvw<aaP|_S*rb|0>aM#frJJHr08p~xs4Zn_KODAz*<W)h3
zo1w5om0YUMhtKyRIQA*VP7d`jFYgv9Ce{dIlBS$@0p9%&?9-C--V4uny1+C_gn5a5
zxzn75UmBgz5t-LxofKnn0E{Nd%6q2Jum%lvj`RB-`f-4AMQqxh9dHtw-G2LpgMtu=
z8IB$ejv6$~pQ0f=52*su-<km<9#V1>6e{di+A-d-Y>UP&KmCdaLny>m8D^o64Ud#7
zbrf4Q!-z|w>*Jkp3Vj`-Q5}1ro6S#trggi>23pqEEC>8Um!|%zU{`HkV+pD?-vWWp
zqQ&K{vO@giwS~2j4w$biQB-&5+bMztw`{>E{l-IMNw)N$|ImjpIfDm*dZNk=kjI`w
z$z7=5C=S1)@f3;AWBSj(QtWS<z@KeTAN&yEq-8a#(A9W7*rT!Sb;6F646(iK?u&mz
zq!@2tdeHf%wN^O(6*F#_p2#d{w3;d^(rK&LDSTjjx8g<veRM4>CW;?gXB7QJaZXdZ
zFdVI11dQd!?DNdd*b4_gaU9IHGABu1^-nzIY~AtL7di^|=yjIEGASouwQPda>3RFr
z^@GMC!y6D{E`v{r-RQxIMw>i+oJyqHsyEGEEZO~YY)HR=xx2OFEP6qk4Af@4#ROar
z2^Cp0<Phn=>ULp>=TZXTK*OoCBY8S3ErWm781%-9@{`4`K1g|R;l+4KXxRtSv!ghb
zKI)f9Ktl#21I)CEH3#DZm~HImROglI<QFN%N&LWVJtC)dR{{%mt0V1rBfA=oekB-_
z)RGF+u>eJX&#79}_D0ib)Z)*yxNw_lo447~yrocJmGxISzXyQK{*ChhY+i8Ugp;vT
zcU<5!_e@z~{^e-~>X5J@p;O4sxppz)t!YsWcm2_g>WN$V*G6+6#!4P1m6D6TBm8K@
z12P2f@j+|SnepEWHecP+hxPlmhnVxl?6F7TilRcS)1N4(+-2u4Fa5+>c2&7VdI{C8
z#0HeW6$&K!HLc+Xb>?smc8Gdwh=T42e)<fAU@0Wq4T0wGIIuXPwX+74U6q?ef+Qa_
z9M+$Il9{Fkd{9=gNx#o+&HeW)tk-mBEAK6b`OdV4jCs3w!AjYq=1^h>D1lvgJfFVW
zOOB-HB(Y1V9`h#-`BGk6r)_y;pq(Dt5YETI=h%mptCf1Q1#m1SY!fA<b{P&m{#EW*
z@|_#>+DAB*f0R(1Jy4DcDw(G0UZ3%@tPBlWt(p0uxbS|+io&2dEFWEypL$ayaY^?)
zQbj9q_84j+N+7*!tsxcNhlLVc9OK=6{y_pJ;nG%ZIb?|rE@qE(v!P;|451T?edEGF
zMIy6wNg5N?-l?mEauNAfQBF1qhnny$G@^#7y4fR*mVcQEs+aHyGJBT{pF6x7>-j4S
zwmi*eST(<X9$n!)%L7sTdhDD`x6I%L&+ZNzPuXDR?wS;Y_nJae)x`YZ+n~lK0nTY9
zsTW>t%xi|OP_Nx>jI;i&wY(<aEee~!f`y?37)8vinY({XPr^ZAie=+G>najJ28X&c
z2Kfaju2s{(+o7;mpL_JhB|2=v*FCX3`veh>@4Clko<Nt!SBsYDc|4CT@-r0V%k&Bx
z2pM@}8Z?WNXIe>APxJwOeD%iM(bz)+It2%6sIgpA;1g1h^9bl0RNW5f-6td?`5Up*
zaOB%Lq~oVl(CAH?PT`d{-bWFo7kg(Qb&nd9x(+U!#H0d=1*~Lu)9Sx+HYd?Y)h)TV
zK0Dretx)^*S5edw>sV5G*j}$oX<?WST(K5-Bc@V4z!oV!LaV>o+1d1(QR?v+N4o{X
z6jIvT9yFSP{(EK#*;Tu6swK)d<NAWi$1Q^eXC?++<x4|AlrO*xf~(c;Osjgg&^05^
z6x7d8Au;Ek2S_=}=HtOH=6{yOF5WOzo53{Grh2hIuiu}<@R)MV4CD7>c3%k}a=ni0
ziC+Xi1x$!Od5C6}d+8-`<j&DcE&7NyUSiL@e7xDi`%yVXNlhjT%JfMqtPXu%N6Nkx
z@}Sf5dHIeX3Jr=Z@r@&q0S&SV27#zo!Ev~N>w$KY0?7Y@EH)~Z??g`?KtE&ocqHYK
zsdgZ%J`$81(vgDa;@g%mk)Gj)K&w(3d8J5u$MA6qxL0Dc@d<h$KI9W#7~p+yDSp66
zN{~K>9zV4Rxlq#%;G4+QeL!S!-ph5KPa<C@mypy;ye5_!CU7BXKah5RGsQJlq!^Mn
zvA^T21A^dsY;9kHTK+w2wG2wdoP@O+x&dIdr7OtLC2e;<lAA!*@!`Tw%A5@YwmlP0
zR`Yj0R8ACQ-PFZeM+X{=A{dfTO|;UD4kdj<hOkX2;Ou_ONcd+uRCp70<!{Q_T&WDp
zWUaO#Y_5~kHA&LRt&;W2p!$Xwxg|?Y4W^?_0sm3M2%kJqO_s8aoYM1sk2~ewYpPPc
zjb4y?<spAkW<H~)1|3RwPH8PP(##Ao*5^)shU}R?q~OrTl`?l-uTE^4&Z2bcnyLIs
zZn<fr6wbo!l8XTPyWjmA4JQh0#Q7bX(npZJxWW~UI23p$Pow@@TLQnu0H#IV)F@)K
z9jH|_N^l1R#L=P`)<m!93vU1Jb3IYCRu-MhZ7yn{OQo^3QqqxN)mDz<1N54)1uS=y
zR)9kA#^Z^-`7mluX%Y}vD0DMvyk6jcC?3Z*a{J~tp8CoxAp8mko%q2woMb01_7fV?
z9HCfK_8MUxZTWiUkR*ruo)RIgRh)<49LOD%q%35yW&wS4T*Nl=^Vm;s_D?>IC4Fi=
zso2+3you13qyyc7BW?-IByZ3~M>N?dH=xq)1-6m3Ho$VtOW!5=*{9q8O~9lR!*GmU
z*v8+dIs&SjH43nCy1gUSswzs^%VXtLM*3Gpz@lW+s-?LRUY?I{vIjYQ!whvKA6QH}
z!La$AHM?-s;wH5=AGAfuY9RQq?0oKO?vRb!zd`!;h(5@X_MmnHzuKS1_Nxv|=lXLk
zuY~m43()e2SL#zQo0Z^WS5e>62jR=wXQ%FIpFn`E6OUr&xfACnKf5-x&un?TULRs)
zA6RgODkI$2-)XtB%q*g%IA;>h5A;4O5}bb%@yrwPY<4B6_<X;b`f4}=mJohE-n|Lp
zu~sPAS0Lhj0WgzFhM{yA7uKl8!YJ0?LB(h;x+Y(?%$=A-^<<R;4jC!?#6wIR?vE1M
zCrlYW`<{8!=NF2o_rCig*xKlM({R2Me%Ut6+)2icFS2T6#0QL<;sjfpfL;XIMA6Km
zt}*tS<MnWUzyO|~dMk;zg6sDT)(3(-2c^R7cIsG(s@|N+rrq+Pb8^+MXNquAQ8t}b
z@ue>s&CNm=wb0oRwq9Cgzk6F}oyx>Jn3h25?{?3`G)|E|ZiHcsISsx_#n%QvOic1r
zaI@dqJ!^gQWL24He@!u11AR7%=($GMbCIHV-hU|35p7s@e#LKnXnAp*h+M)yTE%hu
zYxKif_x1BZ^UI7gb;rALd=HR$mf`Bmza8F4YaZW@89DpCsZ4e{w`Jy3P#)z>9bE_&
zwwK0vZ%We?49l_DVFvu2vWCKgGj}cptMel|SJY91XKixERE4{a6_`GXBC*G(qC%4*
z3egb@lRHOBFh{ye11Pn)j`);%(Wo@m6=hOx=Jrwl{Fdyw(Wl=J_TW3(Gx{3v%WmUK
zl_90B9hkzrz=sK#0HoCy^=0fCn0x{1?H)WnWAU8Kd6EJ-DKgL22^7SBDv4Nf{@#eT
zph=ASyjQtLXqc&)zz~8oDVgr6VLB6i#{EbGDAIbXyWu6&1CLY%udvFy%TgN8HD^sx
zV+ig8U!q<fZ$U_6XJYwLN4Ygmizauk$WK~aok1SYp@{<UCxs!?lEni#b4Unum9~i>
zHox;9e1)!r0Wr$Lh>}6EGv#qQloV89n~4jAC{%o>LnWb8K=s-{&QVasz`*ybuXo@o
z+R`Kl=-qYK*Bx-ais)?l&K%?o8h4IsSAl2Z>k0TdwH;Dkqbbv<rQgV8J@sgPj=DC`
z&ti@LjM<Zkff~lNRObst_2@zT`wJf?zai?(C{I%Q&QM#jaPwJLIaecACDo*q4uog{
z^{rTKS-V36SU(QfqBCs(->z2gPP464<Z_MBr*}MVw8eHveT^<aOTmco|HaVq^=^Br
zNu3%tCO){N?v>WvKCCX>i0?3CQFBpA4-^cd8c`kHe`HhfwhqW|fYMofx6+GbI28v5
zl^fIGdfnA_;-Qi{rEKr;<rw<m;dR~RQoUF5{Swj!mJM+W{%#oQ7-9S&m`O>J+y}`^
zz|h(6E3JQ|?G{kcqvtqICFd_C$%nR+)6l|s5Lg(<$|{@@-SFWp@&_?u070j|=cxq`
zN`yW8)q=hBuunh0+YySr+y<8cd;MIbVjD*}=`r5hFB`nxam}a@+$G$#mrZBf-_npY
zB+OF@2u-J*CchS+c>&pxTP>p?pL(uX(K^3BwGi`hd$1*bq^Yz7OI_SjFB1ZeYj(6q
zCBY~}PLDPpAb;^HR;6%{`+X^2q&h@A2@6ZP!{<9(HG_b9igmY0_+9e4fr;w{!X|&i
zzovR9h^J$2u=cuH08m?1mozkMT34ON<k$eJ_9o&r>sK6&-te#MhWRqOu={~MJL|t{
zU<heN-sNuGK;mjIs8@{;_*1C;q#7z8d|_kLK*r^Q#*c(?_P__P^zl4_Tu0FUdEEg9
zsVsOlN=ifrs1|SigV2v~V&SMzi$d4h4!H(Z2A?%+e0>@?hb#sIc2QPJ#hz62SAqRo
zsbf*Fh!b?2rb#Fi5#zbYwX};9PSo?^ir~)grU8?tVA*4#Ca$+oXib&m*PIq)q<vTY
z2&kj#5^kZ%{fnew**LzbCnj2m##eJH?6<~)2yVRX#tJ&ZY+n#i5)U4fxF@yt(1I*$
zTd8aysoA*noiE*MvC&^1TKyPi<Ff%gO(^cQ)KtK~_^0am@h^U%yp56aV1rgpYvX#2
zj^J!mx#|l0(Ba3zQs5cR%n)uLD<zp(K)i#VwO5U>g(jFbSre>)j*B#$u(jjEQIH8M
zWD3fEMGKoB2S)OWfVD0M*0EVO2#-ji0ep-~M`)qp;`v0_asEN_1C!4)H!JY(w*O?N
zEBQzL1A=zJA!tIJ!cvQ-o#3lYr_UnU{hzr!inK}CZ{a8{HNPsxF`TY{@^fhpB`U*#
z$GQ08estu+_7Ck7X_)PJROT95Q?q^fbU5Iov6W_Xg!T^(o>ZUTjY}4k#v8O*yL%5x
zW6o{sY=JB>^dr2vA*lxx>j*2h6Hc9#0e3HIk3zO_7a3`5WPki1Yxj!4kGf*>cE1b-
z5|$LOANJVC8r<i8!c+IjO=3ygdfzQB-(l1r#51h)re&gUA$exD_tRNm;fwU<T?*10
zT5e=ES--WZUA2DMXSioFVX8&efej{XJ(y|pe9EiPsERwYB@*QnkNnKHyqsw!jL@Q@
z_N+hN>tp4|ecG1~AdEPhX`YO|`0uMV(4=L^h&z5k^uoNqaPG;_YWkSTARIt!gV@&j
zdxE{|nP$CM(mbvS@i+0^)n%;^X=VNkB8Rj3_i%mAhkbL7RTP&y{?p`6$!aKW&Jc2I
z8S(}uX6vLk8{+eA5XC(rf$K*3b|MfLT8U{9TmE~eE3)Q-+C@LxH}I`d^UD!C{&&@^
zKz^J`%02=?Le@I4M~7x3;En>4Owd_QUXY29Ao!YXv!J4pTu>X5zabv<<YU2hJd;d_
zfsvsU(c8M=@?Ibs7fW@DL=>`b8qH5DB<yt=_cw^0QNFk^`&y0Pmm|9-3+q-;NdN;#
zY~U}wGfzw|E%LxLKVwhHmd^b3fArK%<fu!99VY{v($sVLbptXio>1B9uT|vB3yl~D
zi<V}TFUD?n6gfB6C^zl<pH*FD!Gnq&`L+<mHvB`DStmCQ(CbwQUV=B0o0tLInW-@E
z@1$Cidg290D{dZ^`glK8q{7mAW0x^S4S|O0;BWo4cH6w;wOn_>NBEsFtMioZK>9j5
z(8qvi1C>2(a_%+10iFrtA~PQjNxZXcHZ07QVkvSN){HQlX`1C~trpkcvP<zzm`XZi
z{4+01_7BH#Y?06OQe)ia3QGQT^YR9RwKG+>nu9#w1_kgl+lG(^qgJI?Ekg7+4A3f`
zY9zt9qI5~EgP4Nx#4%pBuE<dCOtNICDTCP>8igrM8sCM2EWi{Vs?qxuPS$LC8g)>F
zE*s1s$I6INEoI_?-uUsETxH|edQV{NaiB1JG|N?4?7teJX?Laes>|2(vbLtDGhmzd
z`0cd2bJ5aPRrTl+K0Mxn_ttQ76>##LCGvJ)DQu-uYw37XYf1TNo`~^282KKNU07>x
zF8J3$D=nkCdRV6fN~UH0a=1SMX{yjWAz=B<|H-U3Hsl1Y8($wZ8Ar<ukE(|ao<v8M
z<RZ)m28FON^F&`5)Z)ztK3^`1Q0hm)4h}Jlg%EpWHLj5N(50E>1J)2239$HN8ReH9
zf8R|rB@?GvaLC0<vIfUMKht=$J+;Ty6^eh5II`QYzJSuL_F**6-S2>R(VbjFlhJS$
zI8SSq^h%O-S-pP>IAeXKLcfh#s*YEdZKwGEObbD>y1!|T>tATtWfk{mABE}rwe*z?
zA-uw~p6W&6SzT9|lH51<<O17kbhEe~i_wOh5V9-u!7yENDCw+t61%~x!7vpg3r<o=
z;Ha5{-Jh#{IDU`DF3A_5hJV<nVx|3nfV1;et&<Oz#;R3o^iopAs{~VQ8;8r^3*caI
z>`G@Lf=MX`tppUVY6}L-h&zx$coPAbCp}W-99-KC$`m)%-%7ftL4ikfGFGBSYzka0
zCWiAmc_<ltIH&x7{>)VU9YdAYMV9ybMui&vLU!<yxj_apFIf7DdO3XsB&`4~SKIm<
z#&Zo1YcFz-seTW6`{s}hBWn4a3rkc@`g7AozL<EbWNJx`HXmZzR?0s-n=N1NIw%7!
zRK4a|oqWpmTNu~mF@g0OZ?#(LzBCYBhS0C68f&!|%@r^ktBdoMt5|wzQ1gKC0*VZC
z5sf%cg3&yuLjlvo+LOlz=ht4;s6sAlMP^l6fd6yj)e1OT8gBA(U<eoqb|C}FdfYlQ
zsM~mAPr7Di;4wf!-YekN3_fH>h`-X|Bw?~&<7W<Hdd83NN+9|};lQi`X`!7NsTW+J
z2*V3oSg4k$tr-Q{Z@j@17vVgG*sMIcIhgvSpRRzt5*u=aq%EG2Sq1SSqmVz?zNx^9
zE~t(iHYU=Pv*q=*)#_=3c)5Pm>{GG*85c_T?jj#ru%G>zXa339>)ir3+E#dc*WfiR
z)(-+*8ty`J4nQNV()3{I1844$ro27d;$24C8Tpepypze-U0(CfyU|CQpAuJ?S-Cf;
zmPJc>?ni;2OJ_5*k)gU#UKS;7ne>waWlmO=0Hs6JEVNJ<N(PGcI{WQF$VZP}ut8(&
z=0gi>x0firq>p+JMImcU6nr(dPyW%Lm;(wRJtDMDxxhF{mDhb8Zssg%t%qkyJ_0#2
z%mhv6|3`U%V5qWpYJ+Lrs4vjs8J{@#GO+;sXTFcfDYiWcV?o(T%O=AkBgrN|6Rc1B
z*(kPD1(y6_3vz7!(vvYiGf(ud4%8S@jMDw?Kbj>)cTcyMNj@`_;zJ9QU+p|#rY;8>
zYosPMbT|ksrdg%oSVp9%x=9P<yXJS06G0M$mFH8^?7@BZVXFa4p__eKn4Bsx0QIfv
zaX5|^IkRperlw`?-_#7ZlZCGqYyilR0_uN`vofpP(m$St+T!!^T6f}(0A>Q86o_|D
z<zw}f2<qJFAAe}3aOYwVk99O}d4M@NDKUi_=F=JY2Zsi@&MW-F%RE9ZKf)$SA&4rM
znWZS>80k@XFbe~#nP5Oe!6@UGS>LB0!2cE7J$25Pw^cT%)}OT1N7DhSJ`vrIT9cJJ
z`cx0f^Me<6XDJm(hAd+ahWrCM)uz1XLF{f0_8}bt)Cvteo^Y8P@QgCQGr=?VZ&e;7
z9>&VZ0Q;8WFBs#}q}!ux?hjXi25XgXuVW)f)zqGPe-6IFTCs+?{mk(rV%2Kk!)*Mh
zWa2<Y9@G9W@)FbW|06G$R;D!LUW-*9A7jGDBpv00kBSq%uXvyCbDNwz7)UJKBfvil
zaiAmVO3PlNC&cOTABk-WX-wlbc%r4z4&j5S+I#<*HQpdZ(#Xk&ZqCA4jK&NK_Piln
z5k}YUdPO(vLJm0cctdgOUbHQ*DesoJ)YCFvX~XdPjo&pQyn?_%QZ<pubWJPq=pFTQ
z7yElc__PZy)(ja#$)`wvp(}VY5c^O=S!ii`$t6`(+XtW95Y@)WezYndyVnV}(+Oa~
zFfz7Bb!3hzo@ZWY%fq<!%N><_qE>4HZFrh2Ofh1i<Q8pvWU7dH`U+)1^oJu~zrCB^
z9u;GDp!aIff|o$35~PjC25*;ts{_r*CRv=fX*M1g6lHh!;;R)~ro3)C5I9v!wB1$5
z`h#Q8h|5@XWv8r;^<DvBWcfHRJ@_EaP=>3l61K2BM;4{Lqm4})D;Wcln{2Xh9BQ7+
zl#gz#DAQ6-i625WRcJA!<HcrOeB0Fck02)U*CYCG2$!634giZjOwh2m5zaFRh4yb5
zz}QfwoX#3&0kpq!_wVO(;GnmctwlB!)7g;BEN#qY@rMxDhMUH%G;CSh@DFsTfI=O9
zaso@38GQ$dk8TB2jG0`7yau-URS7Z3G@nywA5HB`a<^=DqXTqbmCv^;96%v+0LFb4
zNNzUQ0gtkK@V6hXMsSiV)H23g4wby@5&Vrrsh=6e6?;%D^N`5{Ew{Bm`XZN=`C$o)
zaNm?kgahykh*yq|=g3+WrA(+TF4!{z17ze0BT#Yk-Z>cexpo%_=g&1~{tsdA6kOTk
z2XV%>or!JRw(W^+=f<{e+nCt4ZQGvN{QkRJyDwY&c<Q{Ky0`k<-JkZL1)q{`k*xfN
zUFn)hShxyWPK{b1?Xk_q@RAB!#9GmAGN#a)Fy`8U^yxKJI&b@nQtB-8Ylqe5WV1G;
z!ZJ9W@xb_kivaLa)3-O|1bT7D|5ge<1dB7=79KmgCs(<;{Ge7mvw4ErRrtqdin0j$
z&l!Ez>T=vqHo--GRRBV1Qr>*-i`|beHc_RWm*LEV8H=@M&VI95xR=f*Bv$+kB&NS7
z!XK8%97ij#f6%X7zL<e-KnR`iKDml-)(dh8;=62P>@UFQQz*%%aJZlSCD9OfS#%Oz
z`P?KcWE(E@80&vg0)l=4{=XYI{yW`-UU1VH_s60MSyohHnBgs^fO2&;s!nVR!y4;B
zTKuZX$ze5pIPLfkb%xZ7&8~RVXLFj{F}37ySVq(ZDy+{k7gij>c=K%u4!AP5Y5{%9
zcO^VJ0M2Cg<YKKRd`!SZ-A{Dk-TKLzq0WNb<nO@8Gh7TX?KP{)ng|QH3$ER2lgul&
zM1<<cC<I5<Wh<%2F-mfZ0acRY<xDqow+klQ2&gNknfmrgGK1-6E4C(Lo=MXur}miI
z)nT6f?)4L%fSF;ZKmtX8=0pwwshZ9vs%PXbzyfY5Rd07JDT%ga^X85=$&x)HZ$qZy
zhf14!st)3DccedypDWp0K=CBHth1qZ^hD!DjHqJC9M%JCVQalA_YTb`Sp&aQXK33e
z?(svBz0AD|lxzJ(0`6_AeLmvEw|an<RWQtWZ|V;!(#{D-C#`qE#eC+R@3tPTh<|ef
z_%&g6FAs?zl1xI2J~E9OyM>6t^yO68`p(8BaRVNVwes(uKVMrx*#4D-|6x{kMUH>H
z*e&csP_jmyBueAi3_pQ&#Wa7!&GPTlzTNnX8meAi&cJ9${uvwZw8Q9a<74EtY?9I6
zhFsYWS01Ht5!XCxX+0r1{yYS*ykQR_fSJ(V2nD~B^6`L1gr4=0M|M<W5Q+@#E;)yH
zbv_H_uL@qm9K?CZ4F5;7a6jePXAs^^drLH#`6ZhwU*9C!W9C`(&))oDRq(MXo?dMs
zvbOO5<rE%hj^R?ZQg<X|BTTL+>#cg)o{Y4n3bQ*1PD0HM4_E@I5anz%5jePheEr#M
z(6}UO8rI}6jIR6I9~_04OQ397_K_Wy>L83(HjR-uQPm=bu7oOL1@dJXu?Uid#)nl~
z8jKwT4xs)uct<Eg1D9~CeANTz0x<^cx_Evz+$e8s?}xIeD*XZj-rDM6Cfp0rjnSze
z<*N*Ne^P0(m)S}O5<!Q;EGw&EY~>svhV>?_IG}e39GHSwj3Dbun+Cb8>z5W{Q%#53
zRbB7yjtGjsL-yd@F4lZHBc+eDVaKA=o>nte2`D6YbJa#KQ>bcex$IV`S}0S?Ku58S
z=u+eQ-6~D6Sf<C@>@dfp<DFGS9q1M9K$y)cYKW3fU`CI*_G_xO*a%v9+Qc}?y#Pe@
zPqt199{1BjQ<FmEF+8_)jJ50dA-qjJ>BbRjYEgN(Kclv(ilx|U%rg*#q!{CQJepWd
z4FHlgb=VXpAB^q-H%f*pS7yM&8T($Q_*gxJMba;$*pWNX5OR2QWywAqEW$E(kZ+YW
zR+I+ZgfCx0zGgwvm5X3Yb}SVg9b`XI5NFL@BmkPjM^;3r-lfA7Yl^kwmS05gYnt2V
z;DmXaOuESeO(?&wWlD6&)yBNTBD8bt3V<6@of2h9OXZQaU-=LlVhr=JsVz#a-ij?g
z{c9C#O4*4+7ow@YJ7#W6D+8KF^={qHYWnRErOT-HZg+r3J8k1}^}9N%aZ8=;Um_zP
z0QUB}W&_@Dm7(rNdRphRW9f2^bw6h83RiY*B&j7})6<SPbkd5lHt)u$Y4u;JDd5KV
zGb0$HiS<8EamTXp%QuZ3Qsk-sqquO@PrcuITl`P&c6aV?iR6<}0Sd}z>&(0!N*IMA
z-B^m@>+`9)AfgYDf-a~+WFxXD1`20;L;9h;>#)|Sv%<i|(6duYhQeS>FO)rs0zg&<
z{#t?=_c`w%<a4Cq)^Vw0Kr|6EU?zr08Mvuz8#$Y3k#Pq8N%@vZ<hT0Gb)?Epx1SPp
zr1;?6q31oi-c&3y)U~}p^S8-GrTn3T92>l(04sHw2*-L3ar+m~oHn)G={2P9He^pk
z(p!hqZd^amt@J{ZjI9-}uhrtH^f+smM1y|gJH9czdKKn;5t<UG1ELZEK<)voZE9K}
zsAueIpR_^eXG30vX@re;e9GTQMKU1b78dU<&?ryK4Qs3qO7}MWUPkZzZhmf(`tW8k
zfT0SR5Bp0Q-opGTF{^+|j%H{eUlDwz(b3Qg<3(=wfj4Ts^&9B!OQ|5uYMhtdtpZ}6
zBu$4n&1%JKt8tW0<1m#Dz;v!OIVeuo;@5;~)<MvD!8A$Gbj37TQgxVdAL=#L=tsn7
z_WmW>JW88Yan3XuGjtD?p6U(a+8R#n*0G=P6P1FaA}4QYu-8Q6X%&&>`K9Xhf_#_~
ze|UMnH}RA6R)DMwp6A6*M}cT!k;eYnV*!V)m-~^aQ1EzI3&Wv+Tct_YbTp&chAo7W
z;E;#4Uu4k*qm*q!ltv3);f-OG8Y0Ot$xl$nMkLA7Md!d1;D3Y^Ds4^*Db#A`#6SB+
zBqRV{%EuGy7h+HMV$G10KP8jd!IDQG;0bI_b7vprk6a260>dn5T-42HM<fpv$RTJs
z0XWaIV8~p78CEmElegNSDoI+CgQ*FjOVY$Q&aoIxQ8tr~8$CSDTZ0}*3#|4DEKEV`
z{Ui=eG)k^n#*vs0Pn20Du^T$HGeTLlII6JL&+O#4?VJQ}39qXch$Gw4HIU?{v+p3Q
z?3L62qfz#upce{mHmnR7`Th6ctZ}_AyHNa&2Bopq@3vq7Zt9V6v11oiv;IUw=&z#c
z0Gj7k&7xG(75VrHqbMvmEJ-aP`u|$^&><$mSuzgKjav>Xvj{?42Pk_F<714S!^^TZ
z6rDYolDowqxDc*P1*HMl=Jam5yRfpGX0&I{bTj0zIxUA*R3I6azrE}pYhHK0a+M?a
z#z`**?Xm$+;&j&ncRqR(Lw0dBs>TpsmGocEL>OyaD+WH@XY8tJ_*G5m-|G^Bglw8+
zyDv>qKIFcdRO#8c3gp5RCLeS-3ZwQcdKMq27HH^q?9)4TzQ08bvkV1|--DqD426H0
z_TDnd;#1e#O0&3N8x6hY8Z|E+bX6IGB;zcKdnp5a)vJ^rGvn*0FeueL(&JBy_4$Tz
z*epsV<x~pAe7ib@IejRivRFGS*N}~a#AkL{6xaR!v-($rdgig%<tm<pv~q7{2Axk!
zJEv8r-Fmk*-BR5ZPm(rt?8?-*-OR6?8I0N`z1rr6Tp!D=2wm>&!tiH(*UzKsFr5$2
ziUEY;jFCUNM-2Gd)f<f*;%>KH>(|la-K&<*AQ{E2K*_fG3)}JZU!fuJ8lmZ&OM}sp
z5gn*&{IEVJNG2`ny<ejxEu3kyQ02G8AlRk%w@L&Jl(CVU%LhKp6)2m_Eo1*LRVwfQ
ze^s31HFlhTq`1|VE<b>fCfB+jSLN&Q*!M!M1N);W&=w%e(x7gp0oM>&P%j(C#ePz1
zZ+rm3UP=y~vTP1ka2ed%`x_+nM|1AA*pF&cAzfZ~w35Bj(~-(7(x{2p=kU1~>I<iA
zDn?pdZ~PBS5LLrhs&e@smLOvGKP<tT#{Y#SNDc=W{%E-WKM5D%<nC)=(YE>;Qtll<
znv^~=Pw9z1S%1bJKEO)F7#!Q%7(L$h@E8*<o;FOAI&#o*b9%x|eRS#6x9iLGZZtwu
zHnAmy9Nh|#k2x|WdWzRqH}S48D{z~oVgc~g@xEwz;X@yPO&h`8NhDYWbw9vy5cL1)
z)8C}hR9Bwg2Q^HPcg_&vIcp0yx6BO%|IiA>VS&Va`(%u67j3;%?TBKqW@v_yw&2RM
zG(BwEgwHfl!CyvF5rp2LzjwDhuK(TU<$vn+!L9bm9N~e1jtp5YBn@0g7*imrhypl1
zWFFX89zjj-wZuSgE01^Ca-s{o{XrDCuukO5?z!@$6K9Pu6Bf#bDiLR4B(E|D8uSfK
z6sJ2?goY2$D!b<v{R`BLTGu4i9{aDpm{C&LRWerUS%4Es7P2)hCqP73IIoJJlw0VS
zDJoVO6iIK2uxRib84|$hA&nhF1Zbj?lwf<yDsK;-HJ*q%<EFNo?LUV7my;tjoOX}3
z6aMqB?&IoKI$E6v3K4r5U;vs4r{6R$3DOOG@>2t<hV~esOj=FoQbG|PRCMyl!Rc5O
z!>IVVgVeu#<?b$vY;tEV^*MIS_pMSl!Lvb&fVJKg4=u5gk+VNCqUsth0-DnAK&atH
zISn)WrdoseMb>Y~LXalieYq2`KW=-?Su;k^iti1Az*`VDt(m449GkKPyOj9Rg~=)N
zL^Y6jT%rm^MfbWT(8wOl%nFF)%PM70;ce`b;M7GX3uaS5t)S$$uyBwPN0ka!KzZdz
zvgb8z6UNJz`TyrvddC9%tm}%(s}1$(3p415lio??z&@;T?yIn1T3fWEAADd$@v%$2
z1iC_EsTi8^+*Y=?BcL9Q^<%uNvW?u%RHX21;`>HPe}aYqj1AXgeNLd8PS^Po{W`%Q
zLL{6xnFle`C+%{;ZskIZ6O>1`x7FqUQ(ytvE0Z#4`Rtk;fd5bR1w2a|)ptvSsVbwX
zXM^IFB|=Li5LHzRxo4i|g1Y95;q@&wuAVbN@VnfP?hK^iWiqr~Av2kQCJ64V#(McL
zY+Blasy^Ii>W8|F#IvpbSj2})+-aU=a()#hGG;z-nabRV{J8~yRnS3K)z_teYo-3L
zM?q{lc!4T!NyAhJui7k^=!h(y28&<jW3FohT3Sg)@vBxJUz%X~X9_cR+szgYq=>uH
zJ{~NXnF)VrV|#Kxp+d=l#8uSuceB)1O62CkpJal1s)BfrP}>j$H{A=9gAZ~9-PQg8
zIN3OF-ufI7df-|BnH3r4%c6M5Mb^R&<9>UqH0Hel4?_`d3ZZG!@aZMYOHySZUmf+@
ztZJ=&1@fLS{NYn6EBhmBuDYN<b00z0sW!}Utm!!)Io#%h&y^>8Kk09x(paPYKBJ+;
z0HZ&lym$2=@soJI789#CSTcLboYT{$8^6fNluU%+`q_~Ipg4`=r=Z}KKmnD53*mXi
zjJU`#Lb@&J5cd!pZB=w%Oj{|ERJoD<AR&?pd#NbYbQnM;W36}r|1pFy=?976LoU7O
z*{*ub9w!oCb+qKHP}gfFzO%V|@`G76x<el!T2frWPfs2h4vd33ZxqMg_2mkB#=alv
zoCLfp?UewW>`x#@Z*ZH5PO`t=A~y;`Y^BSmg%7a4faRY+_qEl-I{DLYN``!UY4}fS
zH3|6dQ2ex<-_ESf?hDwbYho4VITOV7^nGjzWI2=&+Ej6tL-aHu!aaR^u8L0j_)b9p
zrJrC`YJ5q**Cpb$_G4F$F{senPqAX}8szvuQON<Mr2)5w;v!)<*^+iiBoExPeFSRT
z>$ZtK)Vw#b9r}}v#xx7vmDM%#1}YttF=lL6y``*0`G+!S$C;R6i=;gvC&6&%tn_G(
zBHkJ3RZ`!)QWPqNoj|c9sG<p}J#OA)u_%+o4Co?a6?1QdyvFDbfFxCg#b|yBEHUtC
zOBleYwojDm_p!t*g-&f!W%;HZ(Y>7^%i<mF6%-L8bZ|fgGWVKsG>YAOF4`;;seVm!
zi&!12KD<p8HFp&(NNOVAmWPn&@I!UuG~Fg?DqUE8-_ZKVfaiwViFr}sANS>Z1rbKp
zLMhUu!Vd(!d=A}dm*?qR(7<F&&Een_H&a076uf(X`$mzX`#(I>lB4n$fD{%Iv-xB0
z1zI-OpW=5Px%Ydv)Ln9i?^EqWZU(2;jDF7+7R-u5{o?(K+~wG3j30K&S>%)Jpf@E;
z9q4YpvS-zt&vyS!h0G;+GE4Vg7er4P@7+(O%^=_D*Bw&cfdkgj<lLnTv1SQ6f^`7i
zCi&M4E2%3Uxr3oM3ThbCl<o`@JlJUgl&!JXD6D~vfuT3y-Y|q~i$)>lsGfEwnw4I#
zr9`k0RFdKdqw4&~(1Yw1<iIFD2N)(TT7VBw>{bFXoN37Q=pbh1#RlJ>yXv_R`Quak
zdhqVe*Rg?bVpw0(6SBue5?F<mbsNAd7kXUdm2Dhtb#_fI;=Roq(kJ5pJB1i$t`LYc
zc<R&>V?u3Eg#xr$EF+#7XXyCweIblaTK_g=d41`}^&lvWLLrbHx(y__irXLx-U0Yj
zB2bhTFnQ_Ik0VEL5?~2I&H{4tY7?T@0Hz1|dY>Qs2f{9nl$VCIKri1F@)tnJ_Kq)h
z?hwiw9{U0t22w%$)-jksLX*CdPsGSg|D!$fG=RkAs&3i{>_Bm{nKlAmrX(;V86}j4
zku7{*+6a4qNJ6XDNe&~~yHdSk5bY(=>0sYl<%T@ny;jcBGZx!Px?Zj$C<0aZE$-4V
z@3Yi0-OsRNmbqa_SZYi3ZzzEKl!|nM`qn!kZJm<Xc0+BQuKzb^#VkVrV{RxC)8ftk
zHKdC)n=X))PRf?BmCm+RgyK{n$UI6gP2d&3nin5iHlh7<q!=bXjT_5mvz+QbxSA9J
zSLd;5lm!Dq7S(w=-o<Y7e`+w8X^KCn^!jR>{efU_{C&lW*T0~CIi3Irtbw2M$LG7x
z3!S^!zw0nWJZ4yNB@dkAan@Lc%?D=xWIjFMKY}Aj*ry{%6>uA6+vfjy^Vzs(rl++;
zjSxZWAdHtHcxKehg;5z=8>|CD@Zc#X=Vo|Uu?tvJY!N*)n_qoV(^4>(mIKs9-&w&U
zZDK=@%In$y4dj>-6u^)@c-K6lnkkSP`Y)WxxVYrFVn|Fc2cv-OCxX3E3Mv=3UJ*Di
z#&7<!{d{YT?J}2HycM2t4o?e74_HnQJTjeX!S4$NeWFRu16C^E)Z`-Z#~aPjv`%0a
zI*q+w&3Lj<Y>cqF0eXXIeuDU`2-7A)&#FSXHFI4Vsy|h3W`LCAdLab8mBkH2^<GUv
zHwy9=#%k4w184hAt3N?gP@ii>9|j2oIXO|fG|$jh(Uz&u7)YFefnXg?#O8tLN6++K
z7kwfJY<J4ops$F%|E~b-f8tPM3%*Nln=JB{jo@(Yiu5Z*0Uzuk5VaQj{*1j&TQJ@_
zZ=!rJt0n**Jb-@<Xsv?p0%}yQF#8n2=Ve3hVU5O)3E<~F%FNF*2?z(cdMofZ+-%Vl
z8~oLqvLP`o?q|<rgQ1b3wr*(ZT`bU37WJZYUAe*X(O|-Bel_b7xyntND4#6k5l#Of
zMaZ*SQ#1aW1U|-E0BZv<+hlk$c`1EMgHh;`^R+)9bhe51XL3xl&^PTI9%u0gBZ7KR
zQaymB#tn_!L%NC}lW?u3r<2wav6wHlBuZLJL%6cTlaKXPx1fW(%6?morr}oi6=!16
zxD6Dn)P89#?XUNxZqGC$&$?S?oj3ialJmNB2bbudxHhrI>@w3p{$6TsU%>;%gHYI+
z1d%O(wAaaAKvCFi7O0w*_$ClhE)|{~I0OQ|ks-<&9?LE>le5hM6gl5!GXf#hI~f&o
z<gR&9_d|Xmm<=DdObB&{Y$tL7G1~$w?saV1(jds*@64(6QmzA+%F5AMtvUs8AtmQ{
zvm$&dmD2j}cuszdf_S9TOA~6|fRZP@$+R8-Ny)2^QZgU3ZA7)|RE4w!VJMH<OKUox
z+HW)rFNHiWx2FniT7*!+64RFH{K{f?8JLuw>j=m4iPr|kz(yPgLgDo=#TSRM4}h=I
zK4_qb8G9cA4A<J(&R~eJ7qOZ`u@$trLh%LgPz__6t)S@1A0feRq|X2eCMH=-6-!3|
zt<NI7Elzx&aTRjfv4Ef6%i;q*LOwcjKY{Fj7&l`jJoL7zxWFW-6r5u{E{^}V%V%iv
z|G0erW4YPkQ1I}sep#zPucWzGAU02D&rlCe#aWWC5bx56Ynl-i4YbOs7-MU~p-O{H
z1vA#4asdkVd9peGGK1M^ZOTCQ5D4$USy~&KJh4Zbs<C%Tt!Ec4Dgc@LN){Dk70xEc
zI)l4)DICpexzxz;4+5|bFJ@=c611faZ4D%Z3p%)pwE_hq(X7bCd8Ny^j@s;x@n(^a
zwK7l7+I|*p;9-XrIZJ7$rCB*j!8!Y#k`>-dqyYpwIJ#`b1vvRQm4VxPz5h4<4i%ov
zO9d_2AQl}4G~#b++kCW0%geXS%is?UPr!$-n>JGF@5S+?<^nAjp+;KHqsx~vxkqL%
z8uQZpx+RvluJNX;{s|iMB3t(%<Fo_6lq0opDC`-CN~(O6koA~=d{KL!QebV74Ipzc
zSsi<$sF>yH#Qv#`DM?t;aduWDiFiP5f6~lwk`VUCSM0&qvebz(<|<`sZ=zI@RKuWR
z^Hadx`p+{ZIQ&07)45=nW5@E^ZBLpb=A-0Kegxauks%U(v(REqub*kKTDp+6Pj!o3
zSDLMz?KwAAR+-CFr;_sSV?ehy-IyDG`3zIag^b7X1oo<SBg170%o}-ihDJ%AkOAL+
zWjeeS7rCphVvzaD2b-ptixz!@k}h1XGAZJa7XwmDXC_tW^f5Sv-xwtzzB53b)20x^
zIKot7=bu5o+<9|X)Uha9JS^haA*2ESzF(us7t_s@96#%RltA<e0O=X-bi#f))L`JW
zm()nxpv=J%sJskX)WX~#QN`67ck-`PN~Q(l6^`lOh=ElD={w+$iTN<A%DMBhp9*@<
zzxUBJD`7|j`Oq_82+dwDtX7_dH?L$0OQO-FgO{f!Cl-+CJj7PqaDu?hlN%#yvBmC|
z_RsI9?+Tw~tZtbsKv38D7QvE=fkp2{V8yPjS6kMyt(jdE^rn@vwli=dqOqp@#J{MK
zC+Pzxsx#O5sqT29oRPU8;2Wed>U2yOULj8+3NO8S9jqWLgQz!Z$fyflPj$aSGF*0r
zCJ>x}HgWTBOlgeJJJN}uAFeX|Go{9jChk&Lm-oj|4k`sbAU|VZQ^yllw}GnvsW?1R
zQ(%*v|BP!OE%&<R#VBj51qD(kMkB}H|B6?WjA#>ndE@GW4$1=8{KRTd9d4<TN13@*
z%&%2Yr%go5U0B0iLT&ZF@#a@d2bf&8SsPE((Z;o<JSp9ygXjaj3J<Jsb%(C~0fmcp
zF^%|honCYefUaB?RyKXt&(GkZ!<zkOLGdnv4nGfKt%WWS8XitoZ*+k6cc=)+Ie1_m
zUWH}5J>}R&5%AOhjvZCKpbM=laLOLKu3Iw5HDXE%g~G9`;_kfUF%SP8J8X9_4dm?%
zg}RvG4?9=GD?%dCnc2pVt1jX$(ln$p$5x{sXwtyZp^yNmV)b7=bE1>Cuu88WIGF##
zGWO5!+9HKmDjWXfrf5wbYQB6(fHk~_7c{$8zPEJ6LwxiQ-hQHg0<;h>f7*9I&SZ@g
z|A%5cnY8L+Sf2Wt>;HIYoc>SsXC6PYS1`M`kY!<7LNvE)l_T05kvZ&gY1``$_GyKr
zv;g2PU!l{hq3Wq)@_~<G(9b0?(wKu_oD6Z(OtRz;l3~inGipOH<^_^x^Yfwo$t!{3
zULwl#ddTziscWqw;#&wGv@7?IP$vou&53b@FG;}*V$jSJ6#ARRwUP}gB2?i-0;K!-
zAs6Vs+}&Q3K)%sWAjz@F@0ZuHy|T;%B>>5aBgnx--BNw)31*aWFd2wS$-0wW;o?6;
zfMQRAfUCitw30*0)hY2@a--y!`4J>57BwV3YE&d#M?dpnyPK(sV8pjZ=FK@z6K^-l
z2p5MjP(%MmBuMt6^v@|)IBchLJSWPpM7BD#dir6V8UtIm0^*`CX;6N$l4lp<CcqCl
z)}NTLD%HKC))H^F+7`)0Q}3PYgEgX-6=Y=z7u>NMf{IYZ&>1%0Tt;=yh7>&tgY-rk
zx&}|ipH<?Sk@F|?!3y$E2us*`+`=rO#Vs+;32avRTFs$GKlgbei(G{b|M@{}SdM7j
z46IzFTm40Zz`!4rrrL<-qs=yb2;k@g`6;w#B5V_xLBqwaE0f+jsW<5pi|&--QZ-u=
zEzwcUY+&UWqY}?jz*$qp(SX3bocQ&G6PsW`Yh5nCY#nO+r#WA8j<RPPj;Vyi&_P60
z6ayHBSRpN-tVwrQ%OZZe^;ZS#P~lPYUtZN9EQ=!=P}(wA+w>AeHMUdMQouSDT>18N
z`}T}s{zTo+wb$=bR|nLD#*mR4MB4#Y{xVR%M&j)-WZ+rfr@Nf1m5kI3?$4dpqYdjR
zuH>vUoxCuMB)CwM989}SPzN2eqngjKHl<0@o)dS+mea3eb<?W?Z#KQnnV^9r!2bzu
z#5u0*ET7V8k!L42p~eLi3iGPMJ&7=f3rhZauiXf)B6HOkyW}rwyI|>5<M1Vkw}wT$
zS@GMV>+ZmnPg-FK#&?hc4dn~_NOz#=qeX+$SwNa{$HRVm@_#<L@Bqk+D)~e$-Q-Ge
z4NOkS*N6hjJ?P^}B>syBkX}9=O^{65aWL8`oL18lMX@Sny#n%;J63V3^ZJvj9AY$6
zs#H4wl}w=@2|B=b)8%1u2t;geMimw^1<w@I+frbhCn%J_9wN?Yi(P^p$>WMtYx!s`
zGAiQGa*@=zO_4cK%*hJO(0;bxvXejoqwpKmX}(;RK;Cv`b*Pq`p||UtPd2cqM&9XO
zQ+<IlMsHJ$pn%qF+E?1AXYHh^7Pd}9x@)6zN`4$QxbO$PO7I7(HZq5eJ{t5t%oZ!)
z>0ry$)^&)cc-1RUErXr0rqy&GyT2VX0uQnDlc_--j*C6JGHhONm)q$T(JI5cCTI}(
zs`CCaNkND#{pI{$Ya-i^>m3dK0UZQGh%eFyMPm3Iu*r(S{3#eUN%Z0L@I!LkLws;m
z6gy&j5!5kZSQKkfW>V`-8877jUd5esTqd)xwEWwWd2+(cChxjj$C!~<Ec^3aoM{tG
zKqz*?S%`YBa+X83Fp4VfhVJ$J+_tr2ny=!-6dG*SSU|615_rthHlm0cBh3EbI~q28
zK9Y0;A`%(D@f9sJH?pXXvznmU;{w)Wwd&t2mtek})6DBzJIpU_IBeUlaUjoI14MX6
zl5FtDTV(Jw#IWDcVo*{xiK(ns`bx)})R7RY!(uqzS4o0Eac!Z`k387H=!rx|ifp03
zA9(&8x50A0Tu--A?z)<0JIu`<c{^NE?|?u7Qk&9Zj?PQ#w-B~@QlleFy9wqh|2}hp
zeYiM#LwdJTw^)WnXYlsP{vjY|hjkFNh4m(C(hd6{g?m>LE~P`6$=Y>?l;#lOAnM;d
zQ^tPwZ=y8@VMEJb<beL2yXZUd8;#8AE_rWWioDK}wrxb>_}}hM8~tbuiS^&z@J9qr
zfa?sN8W#-8E#_-E$&#D5HjCS)t*4jUs1v6kO7#I#R5iI)qBXmjfziL)I^SsDT;BlS
zkeHzmu*-==X*)e>WCR&fpuk@!l0F&lrfw-{o+E~}-Vh1;UEWc%e%s4c{Yw$%+}v*E
zWhRsJws`5}{XH^4eZ{4AxR>~}ZM_Fc03j)Ra^yH<JUzc@P)RQ!DMAiOF9CVuPltBS
z>>&h-hEJ)C<(8X(H}8Mk$MVH|LRcY2M<&umKsvP|jPvDDd^%0Wv#xB1Iu^<9epo7R
zI)R?Hfm?z%({#AjvBtDLVV#x9Dma0jLd(QjNWkSTEsHiaPjvGx263okLbF!UfN^wF
zL_&%pCOVpPm)y~VeWWm=83DtkI^TX+?gFKOINp506<`z-Wl>g{#`(X90xxnWmW-oL
zl-zkf1eNBR7Cf<-TxgvI;tlA^sGqGThw*P_Xvj$;q+TwGuIxFb<J9|qEM`n;z^q`W
zku&7A6y?)rG%e=UM{84r#WQ<S0O5Y%fryzQ97*lk1LVocO@XPe5`D?5K2OZ09ZL<u
z2PV_R5UtgHeWFdYhIr0Fb8ME?kP5hn`(yZ{6zaoPLm;YK1UE#6NnYPKgQeh|Tgez?
zqIe=ca~{9uA^jPEb}22Ofy^P-ggs1sc|lgGU6gMZqPcv6l9uPkk)0c~0dDnHE9CwB
z`jA1@9%F?hs#VM$BKTWL1g;OAC*FipVYq$>Cxe3puD9j^b`&dNl_lv!Y*damvelF$
zsWroE&d*5RJ=dbGx90?&2kKcRnoDw((yvg<DfeZ<aqA8%<;$l%aPub_*_{x1)LtXI
zqM)|NfuAAQ<*MllbU@CT07U|T=f4@X#iRRL^-Qxw&L_$h+UX$-BK{Y)*?}QAc&m)o
z0v<%JLU@#Xrb))A6v}x8&k08Gh69J@12zG+n2M=sNb`S8YAd+%_hbH@L>y}<emmGn
zC~u+x_50Kj{_Fu-9+1R?8!(kBrssh_eYRGD8Aa(#fq;xLA8V5az!;Q|GEv;lZ?9Tt
z3QkE$@<lWRE80@fQXlwi*(95Zcv%mmeak+Nk{9juwMGh0EjC1$6Y094Fzu+HanD{j
z$y};%LpSFMsF<~=slE}M2Fg|tjv>F_>1##u)yRB|!i!#!o8J7k4VPE+BGKDDWPH+k
zR4j$a^cq>iW=f2$fJqVaxr0{(vML@*ky@N~6OW9FJPR&v*aDSiB(qjcu}Y?D)=yyV
zScWHOsj8kXF3}UGX;}VBUUgYs*_E&Cp>K7hbrd%GPJS$6?+zm}JK6I@oU@fBLk|Sp
zw<3kID?kR`tl{{*di1V-KLG~qu!^wlmX8;rhE}HxnB?>zfVWE_etw|Z6Q~{e@S686
zyUB=)6tYu>wWVbokMxjgpaPM@cIQRd8dcfV<}j~~JOAon--J6s0dIE5?@D5gxHgmz
z7SB(3am98roX-Td=}<*xvZd^a?UjWlt;RDK6u}@DcW8|`Hza6m(cx$$)l|#NaO9PX
zX0@}c`c5VjK(67B`wuchwpXNgN)kBt6I<+*xNb!lrIs651L`O^{yJCHLbg-|#wOMC
z`tbe=J0ie?0R_?H<%;Wrht7$2#vGhGOO4BmgGL<f`Jdm5-P}W`6%i9^Za<!;01+qn
z8xJxm4dO!`T*5f<lg{Ef^!Qk~a6HUFmo;?JSWIX+AfE~xMo*stNF&w9DVl%DrrU&D
zf{{zp3wL6jzs>^YCrlD@?Cp>4muXIBtNZVm29{m{B{riD_RbUHef7Dy8Bx2@^_#sA
zUPL?Y%tTt@IIFaZC-eubd0&6*P5=8Msvh+tK*6>!V}%>+QgBxPAKuyetMDuW4R58!
zo4cGBpqDq6s@@0E`RTREox{+?Aj#K}#&kugqdt?G3sQuc%%&iySaP|2%)E$cm)TFd
z#S~9u)yR{Ak~WbVT8;ZLJ<)2!rwmGy%*Z+YxQRK3gZH5jmQ@(-1vOR|q-rv_eneUG
zg5n)r?d8`B9+ryAuZ0x-1gV(#2fnBf?^M-vfH9XC4@IAuUTs@ybn0>ax&lxf3Qy)A
zT<OZQ8r3TSvZDKevw_24!joVW)2cvsLmu=f_z>I3RLXoueMK}yai?h$eJ1KNHQ_oU
zyJpL@LrFzAuT3P?f%@P3KK8O#u$x0MXKSE?`Ae~`veA@aX~2Y^5KIjO;6xF!2Z|r@
zfb+F|)Hb#bmJB`D3`5`k1dnWkv`BCpc#=*eME2JVHNhEq96DJJO?mb)nznF9As~F3
zI2w$cb=mO^6-_81Kk!}_zQ){|sbnQ<|K6&myMd=K$P8op*zIe5#N}o=;~b>bXvd>X
zh*sXgVIe3{upSu~gGKyXA;?aDRVgkQz=>66(0j67TD1XqsRB><>cP2iga9&r`T_`&
zb%Q}2dOZ<L<QMETk_kW53AH2R<@0c|?A~<f*)}KD=$FPhK{IXP*0KTCeV>9wa+6Pp
zVkUNl$(W8{Q{-*3lavMF=S`9igtIOpw3*1mTFFvTz<EeOES;6;8nbO6A76etfIF7p
zBj9xOKB>8^&MnQv&KBuQf*kc6rO?igmx5ll(#s1L`?v%CuhJlHzIY*3_=#K-%NNva
zh_9aArGP$DpjJw%KZBx;7zoQhQ$!cf{>hKxM~*N2y>h4qreugO5%Mtmobi33Vnz$O
z6z}+ny;@r$_rfdwhc2*$qTvKsKvub(5e*}sEb(ApDdFW(v6;>0ZeP?Rm3`r0>Zd28
zgvy*j7};497ajyA@0M6lPV0_TV*gJ6;lZ2RFa~JDuHD)}Ci&Rvj9jyO&o;XM_Upg6
zG`@;AgBLInFO*kIYQk}5i9S!i^(qCZtc#@(QL<y&hKfw(tFzV*C^XDGfFc^ibdcV$
zftdbwQ)~lgxp23I0ihKQWD`}@PJBojL<7}M4;ycB(Vq+yP$?e3sY7@T#o}mp$;KZ7
zogokjn9crF31V5i$$<dt_D~_?*>D1G@=twWC#*m)d0m<{yd~0~&x(Hd0KpdOQp6S(
z^V5RWWUlk#ZI);+1RgycK*ORMsM4|(;EYB#^^&9}H`edGe6_1EfoJ#?u4O05D#dIB
zf(6%~I%JF>XhNx!r{zWLX3HoF$Tc-+Cyp^bvE>V%#!f^Zbe`=W^Z%HmoQwvd792pa
z2=!D7A8YP6KG}@KR>nx&1_?NZWA+%pl6z!@CPJW%N}7+BP;t-!AWUQB3`M?01d~nW
zED+}uowyqD7%@?MPjz)j&s;{_o$Z%Vx_}Be2-|Qw`qK#$Jw<qN#=7zm$Cict<v@Cb
zEatkcW<lg2g-F@Ya0H1)arI{ej<OV*)SAd0JWR|@|5IJ>R=bpu^<1xRY}%Q499Y#T
zCsYbT*n%OM5ociwu+{&Ntj^Ja5kaP$z*wL&)yfE~)M<k-pzNJyt0k|)vZx?u*fB;Q
zdW&Sf!|bFTRn|2J5G-Bn>eSq{dh*-BbHRbEx>!a(&xJ@zCK;pPB9OP*jx5d7acmhI
z_*&JDc)Ln=<spnNG2`PXNAk@&*Ozqileb<P<!KKwms>*u`1v?7?O3qzvSD8jbj!1`
zcUkpU9qyF*M(r;&pk#!EMp<e0!`EJzRlmCTkw)Wus4EH_o@-}gM8I)!9ZuYC%-i<1
z`d%ANT=XN7%&rwQ8^+GGeA$nCjve|8ZKx{|QQh;bKgM!0f;S5`+}CC1dg|6hoXF%v
z5F`?Vi($(ErsAR6?lO3OIs_p)-(a&%G;87#4uKGjBY#N1fiG02`1S)_fk#Z2AES!D
zm``Ih3+>)>o={cw<DX+aqZ#e#@8v9*q@+1TQoNl}RdYQ>DEj9f@CM!Wt~hH$=``Hy
z%dGj?ZGzHc2|7|Q`3wc66P8~Oczl4KE&0&UE8uzn@g)VWct;ayPO>Te=wEyJK5>RK
zOvT03Fd%+yqi67#;C_a3eVwh;iHefCBtR&SQjKiD1dLTUOu&=PLo>me@n-_&ro*U@
z@?&`5Xr{@5jH+DJ7Ob#TnWotA{oQTpG;!+`U`v_V#@UR7z1w3<yqgZ;a%_0qLj$Q|
za(EU1oPPFYxlNavwU?FazY3^wTION899nr$K+2>=$aKNucW}W;yX{v@2?qe$0bHlK
z*qfE^vsdO*e7d@L$k77dL~UN~(E@bTlk*P5YhlC|D?*>6U$N&{ZpEYAv2sy{G;qeU
zx(p+%jODi0@`A*dj+QC67Qp9z<KeAplbECccymMZDs*WjxK`8W>Si<><r(3**#m6E
zF%%vSiO6<xNO-48nHD1KCh&gEDCtte%rII#<&59e>Jw<D{f4GeGCTV#&{f-~AL&g1
z4fjj8g^)6%=QG>rCDNW6Y@!!7mBCb#GfqZY#7#G>;aEa%?t(a(kqg#znE)!=4DS>G
zChu%93Z(F$V`|yE1^<yb!;K>lOBWbFXZpI7nq8_S!Dsu+&}!QE7bv%_bWXV~LhSrH
z^Hbm2NgwC<=OpKiB$<L;AG<#`AwC|S3b*vHO?_}`ClEAbFv&e9jP`Ufsi6%}abG_)
zusLIhWEYmyfso@vpIut=`~h|mB4Tm?D7SoH3{WW2M;qYX&5mlfa&xW-(`DE7U~bhI
zZzwg04i&}CihUTPg^iDKyU!V6Y4+m2t$W-K)apU&8ljIv<#?;B3vbNXqKVfxRr_wC
zp>?tVEho27My(9vJGt~d<+SsqAcLdrH==>XTjOYKu)rb=CC#n_**>rKAkQ`cuRRN+
zaMoTjam3QE`!CRL3j;184_#t)puq~flaSPgful2{&8qg<y>QD3eI14N`&PNr8CpXA
z73Mo_)W`SVP{=$RE8jcW)#m;=EVvu755#_w2m(fx-&zUur{~n`w*6^?Bv{&=PHA)x
zD|8CQc92IHWkq&Z%I4<M5-D>4<SC<VgoEurE-aZHnZIjk(j7oUJF-sFw=fTN(tvf@
zv)n6_F_)u=jq1;;f=lP8DGGH1y^z8dHbp|U;#cs8<GDDtUidUg%!`zSB%UYkS*D)p
zQ?ONAbn3EHln}29k2w{JV%Ie76D6`g=ol#93~eC8M2DHkmV;$?*$#LC)RfaZi?#5q
zdfzJjXfyI_M&?iP(9~;{Tz9Xd_~|B>x!=@!dRO>Xm@e9LD5X(fFE)mMq`&UyCH6me
z9noNLT*dWyYJKuvnjgrFa<A!~WFFlOwv}ERaynZU?OH$e-I{W240Ke*#0k$<ty;K%
zwtr{%rI;^=_>@57C+r{qzCA{LSl^xy9x5j&Hrr}GAvN8UtO#kt_cc}9w&RUS+@M<F
zSVsILZQ**T_4kHS3Dy<nLjT1wjnEb)&%VOQG1JE;C0)OfD%6A2)Lx*0;&OR;$}BbZ
zu1s1x(B|tIR+_X%r0cUJDkl=@>9D~tia*h`_X#QM*<l#rgQa5vUb>YRHh|G}6Jrjv
zCd5Sp=v56%X}pLQ+`2s9Uz}OA%PgcL6a644I}L)C?Avd*^VROvl!5q{mSj;Rzxtgu
znziu-FJdvN$h2tsB?QIudgnYl6yJ(oEb9-XFq;J1Kc|PAFu3pP%BEG?vCApPzMQ3-
zl-TS94ox~Q%78xr1eUJsi7#?zpTcH|F}4jiA|-jw;K#RNa}E8b_W6F5C73D)I=`7q
z2@LnLU>Y@#u7`hhd6G~=wh8ud7y=x;F~8!{>YQh)L2f;e?+eHp|520ekvp$vEh@Jz
zLH|{`t0FI&G%o3{XCfLCmg-WqX`jpaBQT|5=2*TwTlsPT_*6miPLF+N>6Os7_KL#2
z6*^Hsmbknan2oQs9L3>Q(!nP-nR|&)a(ZTtT9_|e942V(HpNNJSyUe+j5{id<IkBe
zNSQoCoOV59x`p7md1Pgl?htY79nE9*@D$&soDXq(r7~=v_zZN-qv|o1%qX<5TSYsb
zCDI%AmDOMZbPaORr}aa|4~P|#40eZy0OBLVa)yp^CBZ)iV}=GkR*V~hBxSL7=3HeC
z2)keLus29j|Jdhpox3NbU5D_)yUVS<#uRjQe~|N?kk0Zu5{n?}UTvfTlTxt17_*E7
z+-TLJuR$<1Ltgn)a*c8}#5oD4*@Z_j{kA#@%FjOnz@8S_y`My~gF6j-N+*J(sNj%0
zqR@v~6WA-z1)TlPJb6TsGqX$)EL}3y7lb$<>z&p-fWfAlcsLSop5SWei#MP=a~Y`-
z3lHZwW-3~+7a<j*#H5Piw0&8?tuCIf^`J$F2{vJ__Cy8xWmsH)1)zy-M2Ig!g;@ls
z_L_kMDuu@m1^RoD->{IPN|1VDtOwqtMGY;829^I9PhI%0Uou6*IwJ*vnxj_9Fo!w|
zyY^W`lBSRI%FD4J<w7#$xua=Pe0J+d=3I~Fmhf<sXVw}`!obT~l!GE-$M`V76><6n
zI`~io7J?JisuWQM?$o2smrqMIb9NK>oo!PCfV$zmqry8O;=vtnA{!NI8Na!Y*{Ip~
zvWQ+xI_yOJhkT?T+h>(dF&wIYM_^1Na1Xsk6b|l^%qbY=__tq3isdK4Erh~W-s4cG
z1})c)G44Utz=5N&xk1zDmN)mz7cggLy^oppN?}(H%1+$rzsd8{>CfUybS(2c7R5RN
zNLt0Z!iO|r%L8f@i_$$3qG~u-%1=7{@UX+=RM$n*zAoLjr8#U0DJZ@TX5tI55mt1o
zbwEu|fyitvH7YqG|AHZ5OOa@j3r)zbw4iVS6*0qxQmH6*c%HB^N)$4Wi|5-nVIYTt
zFt(~DGe$xMf{alNa<2dNxqmUYQ{4Uy@G?s?AP+=OwvXtWW}htd+SF}mlQupt!o8_>
zB7Ny<ihPjascI~e&dG0qtpCi*xVH{UsCAR!{BWVp#I7W>!Wfth%Q;linagDOdvpa`
ziV=H@zwmyYG(?y`vn$hknJn_R;KDrs-!j1ri!+)IUx&VhsUS0GaBWVHqF#3u;5W9V
zIdu!In&V5Ht+IZGFOvQ2+-jIT{#!aq`B%2|!Zy*z<>xBhT~qc6wcTqC)9gn`tADO*
zM|XZMP3XN*UvBjwPhc)7X=|x91_G$0l6)7IH$+J~N}RIQ8q+eO6!5Blu1^<Y{Ha}h
znG0RFN?+3H0#{!SWV`eAhr2%y;8qp?B<k=Gg2z^)&2@49XZeA?^(x+&0Rg|-ddS6h
z+WG2EaG(SEYReXOn`UXeEnEV~r4h4(YHD1<sIHTWrW<<i2&a#3Uv6a#cx$Wi3cpW|
z9|6+A`5TYRKTBaG?lE;^%j9J%+ISTfpQf)Cm1pgN58hiF?NBm`b}_#eP=@>o44OrY
zd>tbw2kaQIB9@peZvAL48h&huF`=6y9&~9-gCxIFg3h!o1+Tt9R_z!r&I+1d(}6U#
z!0=UYpq&^K8aYaipgCp2#o(Dc@#rpsc8r?n(B<4GG%fXzLUxK|lj+(P`;OHR?RE96
zTD$5-KEXLoS!;%U41PHSU_B$_WJ^HPFCX9NKj_eUiMC9TV9EF!WIk@F1&vYIuMv>t
z8W`I0Ms7H&8)F;C{SRld&rHO>17@X*1}w?djsqy^qV(ocJDP2fwc%JB3{~K+p0E?A
z!DrBEAZYaj2S_Dl)qbxLI`9qFnUqhg(<qd8rt1*dJjmH>I|z3G5NR|1r>xxgdT^qf
zVD(RL<KH^E%@=1rPF(^#dcx{KGM#M#9-wn9A*?@~P{e_B#^P(MgIE%(uLr*(;Z}Vk
z;e>gB;(2TXyoU+b^&g=2Bs}7>3gc|xUOG;N_vPkDR7mY2c!hBx_Z+jZ2)n4)Ir02Q
zpPi3@cnSPR<)ybw03-PDyKN?$2=zB3{H-<&eYqx9=~ksxVt-6=A-IlSb`0!pSAKp^
z*Rue`lS^>B#7qeI3_n+__BB`=TnTp4;22(k#%TLo0-xs?SJ3*GjLm>kyA5wp_99ql
z+n$<7rXoyMll??Ydjq(O<T**<8LUHfkh4gzNOLmdieTVAK(){!`Qjs!SAqh_*aA#C
zlQX;+I9-{iI`ekBq;P*m#!^PCP*Ii86}1FfDF)JUjqDBj(J~hBH4l&!eC(8<NurR~
z7T6B_)A_V#G>7aA<1F#Wip+vR5;JrnYsHBUgby_dohixyBI#Ol__If5v#3v5@z;GD
zwv@mTe#lH0AZ9Mb6RM(Es_*HF*oX+h8ztjr(&H5TD{oUhnA6E-kXgj$QazkbfujMj
z<LjVrm3PpAcv?Hn@9YG{YD---rRaIqQ!I%0-vfmvP#b=|w@pTJLkFvLYbfUvN_>JX
zlYDQP+*RDb6fo-bQzM1)y7dNOj|i|1z%jjyDkJp?(D5a<<B8BA)B`K|7D7ShpXho2
zwaYrqihtTUNib`}z_O*G^o<6UI6^8XzU~Y~WX}<Pz+1%_Y%Rdie6Df-$`)dJ;Tc~x
z@BYQLdRSbz8-eg|zwy<#dnb1i{H|LUX!j00{`s&t(j!d%_pJOH7G-F!S3fybb&z56
z#DHfvK%GFqJCq-&GQYZomk(!cbAtDn{`NQ-#Ev*swtZlOct1O9V<0)1ESL{UIE67A
zoiw{m{UEB1p)Yk<UO`K;t+c^>+gNu53S^<6hH+XZ)v2pkBRK{U8`#!1<mA0t5VLO9
zgH@=TPH-+jIg=>Ne`Kn3wK)7GH7~a=#0jVYuvKK2T*3bmGgllMB3C)Q7FmPjo&2#@
zTu|g$irm@nWqSS>x2B`p%hJ!DRRdPVqD=L<Jzo%ofGslQi&pSfrO-OF^iIIKYOKtY
z$b`GSyMw-)9GpsEkGb*T&+o)#U_S5W!Uw5ggG$d8yVNB`M3d2H{40yv*qX6?&hQu{
zKp6WoanKw8e4g<czt=F_yDYG6XsXe$iIW&|1yX#r8s+TSK{Oc^U8Q`h62a<lWu6cj
zqu7MmT8LQXmHU<sP_jTuf=&b?Pf`ym;RrYx`Vx`{ImL_qqA;olM9f%6rIWo(@Ka#L
zK(+hnJVaHM4<c1>)Eh08cwWi=y~0#CpePXj2wTL)v?MQsmJVd>VE-70Q*(!)zJ!0W
z>M!J&DFoV^m|CMrzv=C8)GS-bpI@QK&zvksr{?yV+P{O0ezQ2ad`uEH+O@FhTW!|h
zW|t9cOt3uN=2PIUs>#pyV%DP*wpqCl%n|{ZEd4Q5PaZlh#XBwA_5B4NKW$0e0GE!D
z-`eK`(ztFaWm)*0^t<z^HK_)_kT#^xRaW)P9+mVj59j~nT%09M+%|FgO{xl9->-2D
z&iWo-5P_$+_qlX+Gt;z@TnkG@1*g_Y396Kw=)YsWksK-cZ2ycFjP$AcV%X=*Se!1Y
z>glTXHjGwuvN5e<;Fo3r8@vT#1I)0(ko*6Xf*vat8=?H+ehEK4D=@Wgs1gu^KM}i*
zTDM@F#dJ-nLg}s<@tF_%;rnh^MqIVl*(&`CtrQ+;4IeGxuu;donD2SMnWcY3xjQF6
zg8kNAsH}^=*#JhVyGNy3KPo>Rp-SwwYMIG-bW`NwXl|6cuI70WmRdm_1$+<t35RCC
zREMJRr1A0B9k*$(n5%mnjZ+Av+<4c&JG|~$I#KNCjMQEN;G>t`L;q<01LJ}wTAH(k
zzYH)lnuMdh>iiQy#}GTk=mIwxL&%8d1d+Q|WVXR<i|ji#4-4T69CA`!=mQR{NlFDy
zz3>*s0%<r8H#J1Ghg`T*4-lGeEg&fuC=vT4<pFAqXEoBU9-0f?>t>xbrvw9#NzZfk
z>I=j4&r{*fCw58+mBr3`<17XS=JEEqpi_yXxmD-=n$0YNpU1@^Yl2>Yw++`nT^*}$
zCgPrLZvr1>pi@X<Xm!s9=Z>htd+gtsH`rzzWONb6vuFsVn})BK0I=ap=<mH1lpwEq
zMbdkJiL6@6=(N*C=^3&#=0?QR+s;i%R5a;!@qd2NP@(j-7(GTwigC{E_9E5roqjUE
zUVg{-hOK*u<xyy{2@)Rvby*LpfXE6fg3pTb+2}V-_ndxSeP`1R)>_lGk&|e*^`sSB
zr6}EW$P;p*@37hF0{G}m>X4XeK<{Irz&r+Sht{Ze*;rpz#bHh8cS{2TFE7!E{Or4#
zn~UFURop%H$+Y!7Wv)$RnpAlT3st2;KXRU9_903NZ?;=kwQBlXTQtQGgK*(^G}}w#
zk$Ml^u7&;30<t6C?<lkzx>8J+(=~q?kl2EFs86GDk?A*80_+QQGY~e-2i0Rf#3qed
zL^07T%#M+yGH?np8NXN$bf;~2P<mOqGbDT&y5C?VoeRJ|52{Yz4I5s>>Arb_<>lw%
zcuB}79^e>=--<=COOPeJ_I4jME5pF~!L|lddT#?OH?;LH@U!To&|czZkuB;ae4@Cm
z5Hp!GtK#5c0kC?x%X!8^!zn>e_h(mDL(d`7%a{;w`NSGUe<%JTTs%itj9n0uxEvFG
z1O#xv-6v@wYV>}-UNcn){2J<w?*M{ZHku=<GX5OC$o5wZx;L8qRDhthKA^pUp#AiE
zVGC&NPW!z>wg056dKO&vyfQVolUrETA+hSbl=N7*2%rg;-CJWy@DzQ@EwV{1b&pAD
zX_;Uqi>EBJ^}i`s%WS|sZ@4jLU^f0g0(KpV;%pH;z{Gbc)?ME<J>3Y2^DRz3>s?fC
zr&jLdu5weSm0es{_)oX2_Z^RgyN}R{BO+fun-gMt=SKYx#f&1J8vcp`<oAjN7t1Sy
zmK&ZpJT{@gi_C_9?EE8gPOs2jrK1P4WT1sd)1sU$KK>Y;S0b32lqLAzHK8`On+RyF
zwR50wP2r*FS0qg${-QkUd7ID1E-b){z=mlao89321u<W6f9ZI7ys4M-YA3lp4vTP+
z^`b!6fd9&{9Bjol#U2n!#*Xeqe(1)o8+LeVmuKETp=-~7>~*py6B{pzR|}h&(juf;
z1@O$0lZxtXlEq0eSs_<Ug7P?~g$xucz$>bp6|BK^u2&#aki<UaKCu#!NiszM7aU`2
zu;xC>ST)5g+x_DZF4H2O6$LSNG@k%u6k`(87{|Kp8#J(pZv>B4xSBJ^S?z;;RiZcC
z^&0lOS+P=ou97sJl@&~bwGLb>_bj%hN$16or0HC4R@~h?oiib;x1g)qVVmzl`D!Oh
z5HaXRGMSQ)g`O%7lFT8!@m?4BD2vtvUpMrB|JVQifB)xyqG$gtpP}m{O}Xb$m7{_(
z=Xhv%2GB-22aiP_`pUVQfz)KKK8riBH{8<|gJ=tXlounCiF3yBHo)|Ek!pAed{tup
z9T@rw>)PWGa-zqPubU2biEdyk@-!TnRL9hCHIV<<H8&G6-;t1;cO~REMU7Wr$3M)H
zG(rTW3Ao|KYrs?p_63q}TnOs|h{_WFxDi=BAgT`%QOz@;njZ`L`GSTGtO{EJpsI43
z3=z$L${C|=N~)t$ol0$xwcE6~F|>LwannYYW|@?)Du*#beR@1P9-@~Q@7~mh$c2Gg
z4WAzIBkNHYp@+Wod9oRj4$$jll2o<PGCGN8uvsgo&X#>>3kA=Dwtk9|B(5zLNeOUJ
zzg=bk9t~BIO!}8S1ono-+YB7O>?t;(pYsZTUC@ddCnT`is>H7j7Qjy4T?n1(ygYVx
zNVrY%zx^Vmd%;U@>E3W35P=T<4)<J_31eahZfIj$3qx!LW`MmQAXq298QN|T$JY9A
z!Y8iFth5L(uHxwY<-s_7Fb=nj!z-2E-^nms`xZ)P!@E*q6y+ob>&;5juA-apQ1JSH
z?3<AZBk1Hro-0)&^;K4CNQ$ocBA-lW5JwJ>oFwc-42dF>JR3=L0TiazC%UPvdCATT
zV4%bTTS`t6FK92kIko&{uQB(2fcQ0GOyEDYvedS6EA;{36popzn)x0z-Z9JFe1>#Q
zJJ!&NTBj~wP?GjR1!GSi?5YKI1FD{XfEEO+Mfbt0$d0ySl{Da0LQ|#;EKZRf(mb+;
z&PJnxa@GcJ3e0wCf(26C<SiPlfel2`S@mXBCwauGHc{d`RUcDQO~~|JlOuCfP@27`
zyEW7J)BUMnn%T##;UBxE#sr-&%(I)0@Hgq8$}@Gtj><fqyNv#g5_zsl<+;OuLz!~_
zHJQvNuL>R=|1udR6?DSr-byE0svSQ<MMfX!*GjGkjlJw9Yr?BMt1jd)ef|0x9E5v2
z_l0+XFDpS_Rr#cA-q?F=^6I|C-`nFO4T)jegkaMn1Y1rNVPZQzcC9G#V$TeWSUVga
zH#46C-F)M?kwSbrk=*j&A2C*c4Asm~R55Q~#)l*+6u{oX%~4lvujI1De8kroW~@3n
zIg5bq1n^VNInPW>jrFNSNz5Vw3YxNxfN_dz?qoVmg>HJnZB)F)SM-_|Xgr&cj62+`
zUFoyFGut&ZQCkS5Z3skSAae$!V4;iP8MH(r=JHj*>F4dVR4jFj`9ZONmn9`CXJJUo
zlH-eGl0}TAb&?kpUFXG@<L(aK!JN5rs+Nb=XE>N6o{obztkkn|$pXPSa@e70X}Sk<
zbUl`MHwf|M)^U=nPv$p2m9Izm)w>&w4$acG;IrL2H*>ZCcBq#LHrla*?5RJ<Siv=0
z&dCYdvSdldH+61Qd758;)1v<-kC>(5hxq`)7(c^m*1znD<*PTm?2&(fdjk8dZjt>7
zD=fG)vOgyEH2xYD3s)kU{#oAQ&Z>effisLKCwKU{?A5*!iur-x`3V-%hRtI+I{_QE
zl?D<%p7+uO@f3{)e207Z)&gP$q3&og)&t^T%XNM1IbnopY+06nVZ=H$){*J8p1G~a
zr@JBWs+lCWkcqZkx-`!up%q~*h$3u7fs2V9YgmgcJq#R|Sah>X*M_%U`<_ppfO3g+
zZ5#jVH{zij?u8L{8)>EP#j)qR8m2a6I16nZ`?^OkA&zen%Z_w!U5vniw6gv=kXG)6
zwDP>g#`_-)W#t)v)9yP{R=%eb8YOL-$vTZ25LSXsh7`afTptemXXo!Zvxhjwl4z2E
zH#9$?syvi6l`x?Dob<QNBb?8wFrUz}_SM|PQu&@IbUQnLkEWbl67!qvNB~}<!Cbg>
z!U^$uJcm<pkzWC^VMV@Bl;#k+%)0@4U`bU?RfO(V?957kV&)+l<*3Z}OkPQn;%0o6
zHq`>n2|et(u7xccSlA2P7~8H9n67C=)UzHkK|?*o+S41pS3SY`>=V;`6_LW`7@Q59
zmODIN%ypoDfa8@+K+_ObHjoFa9`n?XHA>VEXh>!y^Pig*NnW6$5yZjq@0bFro}ogt
zy0c*3I)lJ}Enk|8h-SyS710n=*9ozun<4g0qG3}fnjMAIv8nsCQ#z?oCCCL^Pk(GY
z?cYLZ3JWoXyrUe;Tsy(Vq7L(W2D?NZ*8&pAV2*crS;@>s%UP4S9K*>Io&FE?;Ej}>
zX(2THFBCwDvMNGS^?#-nV2E#MS&|VwkI)bu;iDmcdQZb-n$WD`RFY9t(6T0<T#fCB
zM1dUF`3s$Q@OoUxF}TR+!r$&aEoW)9*Wl_Ko%J6@NcN~8)A5cW*+M9{k1LeTr!RK%
zUjrNYY?8f!Ol0sj0^00|DyRvL^!@ns^}s)y7Pov2HrsFV5*^VP#i+akm?90yZdXw1
z23BN$X#&1TMj7+>$*S54+!c+xy&-vDxsA3K`R5(;Ak^z)?;dAsZ`2+o=Ik3Kzub%7
zL#RP?&(^RVxD;D{?Balg7LGj6(`=IjmLEKgqe1;A(_zkHuu^hXL#c*zJvFSPeOpQ0
z=4sVf1|LHr@cz`(21Dd8UG_D8a`yeDJN|%w=U(76Izt(E9JMIsn9+heXh!mFs+_5C
z!j25Vl_liUVVpdKrGnsi9Tc48SyHj%1{)+9j@+-A!7557XhLCeE|s%%bJ|bkp&Bm3
zbKi+P58_D1-!GAN+-VNqJ0WR(MhB>%{+hMbPMU>}(RnOv?xJ|f%+n~&L$LN`3kQ6E
z`0IL2SJ;`qWQTsCl`;brgDbe+8p0TWap;c(jSCu|9*wJNT0TEHfza>lxHcmlhxz1$
zW_VVfNP`m2nVl7zj(x(;OAubE9OM3tg_)0L1;zFIs`rn+XEg{1C_tzF>-*P3pvxCZ
zHJ`L0gyGVnJVt*!Aq=^>7pFss>|i#3tPksq=zF2#L_Wndj$&+Safkyi&~QLaJ96X5
zcZvT5&xp!W@f^Km>FULzcQSQtSZ~N2^_$gbuzfX>{`2B4c-1WBu5bLs<@(IUmwQ-?
zYhZ~zIg#y1(v-TsI2pbvM;i}^;PQaM^I`SrP`1__`CcVOb9x0f;8repI05p1M-HWf
zh2k2)ufQ>><X-MD5Q_ZQL$UgV+zd;{GxEuavaTx6LA2H8oeq@>C$AqZHX6;8SWVH^
z8mT-JRa-#7OPG;w_+(t7h65h}xC8I7*f()S4tmS+qSfg4r-+eGsxQj9;M(kOYNfU>
z0sMSCdgp0Mjb`6(RRlF+Wo5sAQ)PcmWxrEpf4MR{0kW^I5Y~x80{d7VSUnn`y+R$N
z<-cw|jVukLB8hfQ(vTO`5A%KJWdJs>zfiV8EPm_mjx2dmy%iQ%{hQ@s=r9L&7_n{;
z%B@Fh*Rk5}v~kCW`<uMxj*N%(3f6H5>*ca*d2hG!_3FPb&P4!oU(*qPU=5pH6z&yH
zBF|^AtUVOHU(-y_jCJf-mWi#%)^MQP5jGrZkx<tI!?vFWM$#_84HQ6yMzg33$J$y8
z>iPRM_WdCe`3RDKaN0E>*k>B^OU95!qi4^658~Og7bzv#vu6sIVa1YDu1qeh0tw1v
z6+6@-H=Br6W#nuSK1JYva3Xx7_icA|+#AT19I*#>rjGQG1aUyIqgfiZ0*7Khq&AK%
zkNUoAMsesrVA*O5jKr5dkS{cQzKh^B)N6g_NxZ>Z;d)GYV21)`Wr#35lVrO*w4lGu
z5;!zVe;wfz16n-EI35Pnqy&(`yg=7*4x(RaII9-9+}hl2E&5P@2HMdp%AhR8t46TD
zu?Un_u5S>*X<mX0sQLoR!EfIJX_`0jgJ{vFJutB}V&AiME5MrW8rTXgiUVTU*e5o%
zbkhrMS9^+3*ZQ4`c|DN%bAjl{?Fn6#$B6AsN;Jv^q(ju7qn9+A@#rhM5rcuYCmdm6
za#~1iMZ!ZM)QUELt!AUx2o<dci%vH?RPbsWeIZl_1_t0P!$d3bp{98m1k|x2&nv>7
z{@vn08!*rX#Jq})`-&D(5(1r8$xweVy#EL*Qx?*ii%$Igt1Mgdb}SWFhw;a(N-B2x
z7g;mjkR%nI7ok%mNndbmUWu2gu_^ksDhPuEqdCxIg#ELBC}QEVBxSMvEfNl9^GHfC
zb`Ye({zC*_Vq(FKmPWBeq$tSzJ01ggos<+^7i79rj+=sDlv0Y}l*;QZ^*ZDApy4(X
zMa|*G-s^a&AB@b4wfQ-v*{B+?FL-*YFj*ipCE=IPtmYC1IT$w5dvbz!;7;=%G^G<3
z@CB8{9B5j9Yo4&CCyVRD$q5^4X6s`uk`luwiNPb3eoe|o*aoXo!DN&3m*`X-!sQ2u
zqE*f!DX)?Ub`-fHoWHCeaB?E2x|rh}YJW}2N=#&lI5RJxGAS>Z7>g9~{MLC^(KJm)
z?fEUfv<mj6O|xvq^5Co*$mZjxJbTc_3b{0%oxcWu`p8o;+^c)HT<tuo7(0quYh%a7
zfB>{7TNiV+HT~314H$XK@{6fuK5Czio7ZE+bIXXReE5g+=F-|{pJ(#Hm%Ryr2)le%
z^0k8p=>cG$%@GsFBwO*(lyKXofo6uhA;lM-UL7i8evE;mP+ZTNM5%dF&dMqOl`-$}
zHI#~f1rUl(3tF}aj3i4<YbSh_639@kj!j5P+Dc2bIIH*?s*b{Cujvj9M_#P_vRf-I
zeIiKxShw}zobQ6I1{P{C-?_z$F%avk7uD7JZ_GcxwNA6GooxvKlYa+Mhh&yAc14{T
zo%xz2WnI}Ir9DR01%Ut|OtMNyUVUqMmk~XG;d4;gv)D_wcBqCian(<qVp;9R5b1*<
zyl?AelDO$Bn_o!@@3yIRUFo=zJ+fTTuuef7`pc6I#BoLI{M|2RlUfkV*`&{}az{_N
z8qDRwT#G&YJy_B%%;)IOV1inqwXx{hTG?PB^TH^>ePsD&v#7hRPm#T(lhnCNm-g*{
zCTS`3x@G-J#Q4d#Z_;Eh4D684=EY&G!4y7ZN(1%C!VG9Vvvt&b%Qa@f^(ngp>)Qgf
z!xufSJTGSveOItyPV!7T*ur;Q=-r^5=4gY@?W!)WOMbNSb)H@#r2B+=JtUty-Lq{Y
z3<Df_k%cWgv@kKl7;CO!Xl4}qreQyS?N|ejWF_3AOT=n*#IZJmR*?ug1GGxv8{zo|
z*b}w}Ap9=T1Unzn)#jDJ1JOc}j7Hm|$977ve6!Gk2a-;C9{^yNe9E_8pSBO#Vi5FR
zRy55FLWi0m*6fI4%Wxv>>yd{8%Oj=}Sd_TmBEayF2W`XPe2c6xux8@g?@gM2J7C>`
zRd=h2P=txCaFwoe$1wXwL6_|hQ(8bc2^b!@b)fbvln&0aJEWk^;ut~iV2IS1%xBLo
zfCA<vO=(4+JsYBD&we6B)VlB{2X?M1M}MAWU(l;OjcBoO=R6DYuW$|aooCN}nUR9P
z%0|(9nnDmU+~XJ>OMIYOMO3DLFKPGS+111r*mj@XYdWa*Qq~$w$dt%;&_|N~Me`j!
zBtDLa?P1FgE$kCL#GY%0w(a-<jXIH_JVDBIMO_oyFhq5-e1+Txcrsz<vPN>NF#(5t
zNR1@aFqm6tK~RUaaLVXWNGHzJH=zj5r!`DJDhPOtwib)pX?BuiES7_Ro#8{0l7cg6
zac!;zDzsfr8^7BL`P#V&Re@8QAR~aiKus$W&{b%^dweU`(}3d&v^^Lyeq&k3`*_(?
z)~w6kr&Gy4Exe+kjU%PV(O?Lblyz-gC8da{RIhOV32R@>*1mPMSCw6CCV_==YXhv5
zsH&``1z$_oRbMW7#5Cc5`co}K12Cz?2Q1)_t(0YOIusXkOB9Cgv8#N#$g3p)MDXi+
zOs7vqBgSl3KZBQ*_AjMdt3I(nUY2eRwKbo&snEV9E3E&tP0clBmYPsL>x#<quB^81
zlQvaXmKbUh8On>Q{b4&HGP~k3PlU3(E6THf#iA3EbI;X^$e_f3qa?({i~?*q5F``^
z7B)!`1il>*i$wQ<TkX~!oo!8f7b-RyghaO@8~e5uVT+nJCWc|-FwkO;n3Q<>fr_nW
z-ezBCee#|SBxK7JLQjf)O(U9Z`c{NvPdBk;X&z<-fL?5QI-#Z&YU`%ifqkw1Ik2zo
zg?;TqK1FY&Nm;~y>AoP7DM?1aNhOS~loKL%p<(+Ih_Yg<XG+x!+=%#zi$Mut^8`{=
z;1hjKt{@DPyS~5)OLT=lADzF1Jn+dV<LF33_AH5>nPs}6iykt(9@@%5HOsF7jHw^X
z&7dp|q;ObaYWlFDZm!+g${{NG1EPFF5+KSF?go?OD??F#N-~)Od+{s)?YKNfKXF&@
zF=bJxEE#WE$)vw<V&fij<(N!)D(*Zlq9kLWIUkJ@*vi3Swi=TR$r$lvKO5#$kd%2U
zQuRLDMmzT|xym64ChJO-Pn!{`jsI1S#&AZKjOF#CT0!PPnulMYQ{|X|WkZZnlEnon
zt6~;bvx4q_nQN|@G+iB6h2~=tpIV`V^}vp?6?zedRTlfPOZ319&B%I+wk?(_qpa3R
zsxsVSZgA0Kaw){}JVLl7V2UuKzMMJ3mNfnK{c9AaN%&=>WDOU^Y9O)-K=l`_I`|3j
zUl>)Qd;-kwzrKIXT^(3t1g&4?sBETl|F1>L8WOmF37mw%H#Q+lE{FWt0G#j#{xFxz
z(kW`UvO4~E0iO|WneB1>9%(9d{IZW}yF5FeFBVz^U}WEvnAhbmSc5{p72;YQ&HdLR
zJ<sA?1%durq_1-|ZP+jGU*r*$;Lm+|^Ir;aiv?5jcVGIdYsO+BroYwemq{VWF4@Zi
znm)^aqRSp93MsRk@zKp&0rL$3M(dr`w%-<`*AQ;-4%qAG=wG?3*t>C3j@cTUOlEwE
z=k6yWQ3d!eF}$Mf*mB!g_?vRdDI+c>+mb6<{ZQqztnSEC)eE*%yyPoIQ=4A~$b#Qm
zQIV}9i`6IO3;kTu<pzexUT#DAobSoCT3xw+Geoww_VHpBYdx7?Tlqj1i+VxnGWEbx
zQE+CJC0lT>T5xHmZ$SSR);K0_t164>)?Q=;GFD$4B8i2qd{(pOY<tYdqhH=5SZY}C
zKX_@?4{L-So+kZNe|e8WwlWDX)mCf#v%N{af~OwycLk{KGbzJ<NvqGZEXlKeIZcy)
zs?P;UxOKND0<;YO2FfqeMgHTb!9Y9{^ejVTYOCTh+2E-kj}~>^qfe*pp%|i%N3!zK
zr_<(rKOQwQb@b`9`2%h>d*#umQ{|I<JmRw+33)jBblQ>+R)TN8%LSLk35p9hxi`tz
zqfe*x=nmD-cB=fYK0$~^)3&$(Wtbd)Aei1qpH6F`fIBel<qatUd-ip!cv7+6!}W_}
zXS2KEXo!=PzhFm{xgl2U94_A#IbC3Tl)}*&XjUm7&D|=!y#XcTv`OU{0F2h1hLJ;~
zFWBocfK+@lj>L6Ejl1XSyCJjX4Y)0Dnj`U684}mhT6SXg*daUO9+L##P$rsxec>P#
zxBCDGsdzk6(db7HKq?9vy(Gn#!*;<(=E-jt`yiIOBY3ux+9|!=3}X5^)v-nm2U}F5
zn0S#1L^fvV>ZYN&50z}=k8B(eQ&CPYd&20VX@B@mm~L>Grzx41^tt?{ZPaN}hC|7`
zc>ZsiW}1%k-DQs(U!)PHit49-z!?OSG#O>j;heoEE72RUsk5b$M$1N`TDw3$W+O6U
zq0F7_Mej-WWtF+8nNBLa+lG&4MNC3zFj5Uk+^>(Z)G_Z{=y8y9dref(YeeggB8Yw~
zqEyiE6y&-#3SGf=L66agG39w>%L?;rO7FmRcLwLKbdG+jy@4VW&=|6R!b(SkAu2hq
zNMmS$E=KS?0b@f;d0f#9l@pSt5HVi?Mh{jP_EyK}j3vMP2Q6|o5CVANDMBZdKzEd}
z%BK{1LRi_&aQHF$L8Niv!w4PZeE~C9N=HeRfWKe^tt+1_&tSxJ6wHz|g4p&b36eCa
zL<l!wJWJ4rHrWA$TxNNHg~%02QYI<@h7Q5ohE&i|=nYsO*h}VFL%^KQm8Y{FvBA6s
zkcNFxFqyS%XpF#^xnegJdBYv7X0Ie)Gw)OV1;OMvE1B&vP4jC!o1#9sCI#noB3U#P
z_$~|y?>Wr$ISPQ2W(r9(hiFR5@;WboL8GJ<M~j&O4q9I_!hyMejX}cSz}_~=%ZiN=
zjdrxSQJ-3RV7XYcObc5EwXqjy7PfR(BZ21Vfu}z~i`$zGi(El680R%>9b|RC`4Tr=
zSmPGfw}WBrU|2gC)((cXgJJCs3~Ry;-qom9TiJzbR~w2C=CgS-EH|>Bt+$5lZdp6n
z&kpvp$7(-2prQwVBig};b}%d-49f?@^487bU|8P%b1*F5M|X>RXFpTn)?F-UdK^<P
z_FYUO*T<F{`PjF84@Z$}Qfgaa<ZTY@-0&KoZV==a=9y#%{xvCuC16X;-c)+b{Vay$
z0|_=p<AwQTN{U2S+LH3e-)1EJkbk?V#Rj>3Qn8DH7aK%>4=rp*4#gI61MEXUjYjp@
zAZB2N_PWWoa+<BqD$`5K*EtBnrt?t`hz~x{$rMZ^=d5=?`I=-j#dUm`3=eyi7d$x3
zbnH4wMoA#YCS$l+;{hT~1n-Lcie})Bx&8z8fUuc4*)zNLKOl*`=+80x3)kH%^K=Fs
zz;#ki)-B$D)pcJ|w*PBmi7=0iV|{IT(Rbb-YWluyL@^GCqhVVMW9(_MgIy<fi9v(d
zcEfEgEj@Wv@fDwW>C(c5)}P8B>THy6|Cfa27V2GyAyoU^WrSoIxzMbLB>b;0-><5%
z&+jTn^dcP732F6LYg?6W_Z4MrIcoA9|CSeDf;?}3c@y;n@72=C+(?EL$%$s6=>Eqr
z&mbxVSPlDEq)1?!EBi;E<-nasM}r}RQ2<rpQFI*~vER@vOMaWt3r>0~8d+PP)m?m3
z-q2B(0Te~q)Hxaq2A^8*l{}g^x!NQqTNl2&S?;<ma<^UD)-Gu6Qj)h5Mn26+v;uis
z+6#Jr*P<{qI*C?jBt77cVj(1}fxMm)fVOHy?ycc!T3=Sg@vSV-j$d3^L}23EOKf_M
zDAKXpkU6@xmb1tTpz)6Lr5$HML0!~ewtXIQgU|CK&1ccsbSk>P-yT)d8}z7^{$sx#
zk}`aQUR{Vh?5uZNd!_#QX|))>Bo%p)XBiEDt9%s-zWgSkEX@~+dPm~{O7DtXY-0D}
z?f#Y*U&<*7>8n}BcUE|^(oo$<^97r;7Tc5RQ&ibMdP%2gK40292A@P<S!=v2y?j<p
zXY45c-~ah9|K*?m@?ZWxP)h*<6aW+e000O8W};4A_+|mpc6I;&Z?6OZ7XSbN0001&
iM|KD<4rZcGT~>{r8_oU)0EG0HgLVit2B&oh0001th7!vF

diff --git a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json
index bce6b5e3be7..1b0a946dcd3 100644
--- a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json	
+++ b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json	
@@ -2977,16 +2977,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
+                        "columnName": "InitiatingProcessAccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
+                        "columnName": "InitiatingProcessAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
+                        "columnName": "InitiatingProcessAccountDomain",
+                        "identifier": "UPNSuffix"
                       }
                     ],
                     "entityType": "Account"
@@ -2994,16 +2994,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "RecipientEmailAddress"
+                        "columnName": "RecipientEmailAddress",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "RecipientEmailName"
+                        "columnName": "RecipientEmailName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "RecipientEmailUPNSuffix"
+                        "columnName": "RecipientEmailUPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
                     ],
                     "entityType": "Account"
@@ -3011,16 +3011,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -3028,8 +3028,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "SourceIP"
+                        "columnName": "SourceIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -3037,8 +3037,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "DestinationIP"
+                        "columnName": "DestinationIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -3143,16 +3143,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -3160,16 +3160,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
+                        "columnName": "InitiatingProcessAccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
+                        "columnName": "InitiatingProcessAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
+                        "columnName": "InitiatingProcessAccountDomain",
+                        "identifier": "UPNSuffix"
                       }
                     ],
                     "entityType": "Account"
@@ -3274,12 +3274,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -3287,16 +3287,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "FileEditUpn"
+                        "columnName": "FileEditUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "FileEditAccount"
+                        "columnName": "FileEditAccount",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "FileEditDomain"
+                        "columnName": "FileEditDomain",
+                        "identifier": "UPNSuffix"
                       }
                     ],
                     "entityType": "Account"
@@ -3404,16 +3404,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -3421,16 +3421,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
+                        "columnName": "InitiatingProcessAccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
+                        "columnName": "InitiatingProcessAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
+                        "columnName": "InitiatingProcessAccountDomain",
+                        "identifier": "UPNSuffix"
                       }
                     ],
                     "entityType": "Account"
@@ -3438,12 +3438,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Algorithm",
-                        "columnName": "HashAlgorithm"
+                        "columnName": "HashAlgorithm",
+                        "identifier": "Algorithm"
                       },
                       {
-                        "identifier": "Value",
-                        "columnName": "InitiatingProcessSHA1"
+                        "columnName": "InitiatingProcessSHA1",
+                        "identifier": "Value"
                       }
                     ],
                     "entityType": "FileHash"
@@ -3551,16 +3551,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -3568,16 +3568,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
+                        "columnName": "InitiatingProcessAccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
+                        "columnName": "InitiatingProcessAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
+                        "columnName": "InitiatingProcessAccountDomain",
+                        "identifier": "UPNSuffix"
                       }
                     ],
                     "entityType": "Account"
@@ -3585,8 +3585,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "RemoteIP"
+                        "columnName": "RemoteIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -3594,8 +3594,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "RemoteUrl"
+                        "columnName": "RemoteUrl",
+                        "identifier": "Url"
                       }
                     ],
                     "entityType": "URL"
@@ -3603,12 +3603,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Algorithm",
-                        "columnName": "HashAlgorithm"
+                        "columnName": "HashAlgorithm",
+                        "identifier": "Algorithm"
                       },
                       {
-                        "identifier": "Value",
-                        "columnName": "InitiatingProcessMD5"
+                        "columnName": "InitiatingProcessMD5",
+                        "identifier": "Value"
                       }
                     ],
                     "entityType": "FileHash"
@@ -3716,16 +3716,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -3733,16 +3733,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "InitiatingProcessAccountUpn"
+                        "columnName": "InitiatingProcessAccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "InitiatingProcessAccountName"
+                        "columnName": "InitiatingProcessAccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "InitiatingProcessAccountDomain"
+                        "columnName": "InitiatingProcessAccountDomain",
+                        "identifier": "UPNSuffix"
                       }
                     ],
                     "entityType": "Account"
@@ -3750,12 +3750,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Algorithm",
-                        "columnName": "HashAlgorithm"
+                        "columnName": "HashAlgorithm",
+                        "identifier": "Algorithm"
                       },
                       {
-                        "identifier": "Value",
-                        "columnName": "MD5"
+                        "columnName": "MD5",
+                        "identifier": "Value"
                       }
                     ],
                     "entityType": "FileHash"
@@ -3859,16 +3859,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "CompromisedEntity"
+                        "columnName": "CompromisedEntity",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -3972,16 +3972,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "CompromisedEntity"
+                        "columnName": "CompromisedEntity",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -3989,8 +3989,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "PublicIP"
+                        "columnName": "PublicIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -4094,16 +4094,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "CompromisedEntity"
+                        "columnName": "CompromisedEntity",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -4111,8 +4111,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "PublicIP"
+                        "columnName": "PublicIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -4219,16 +4219,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "HostNameDomain"
+                        "columnName": "HostNameDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -4236,16 +4236,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "AccountUpn"
+                        "columnName": "AccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "Name"
+                        "columnName": "Name",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "UPNSuffix",
-                        "columnName": "UPNSuffix"
+                        "columnName": "UPNSuffix",
+                        "identifier": "UPNSuffix"
                       }
                     ],
                     "entityType": "Account"
@@ -4253,8 +4253,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "LocalIP"
+                        "columnName": "LocalIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -4262,8 +4262,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
+                        "columnName": "ProcessId",
+                        "identifier": "ProcessId"
                       }
                     ],
                     "entityType": "Process"
@@ -4271,8 +4271,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "InitiatingProcessId"
+                        "columnName": "InitiatingProcessId",
+                        "identifier": "ProcessId"
                       }
                     ],
                     "entityType": "Process"
@@ -4280,8 +4280,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
+                        "columnName": "ProcessCommandLine",
+                        "identifier": "CommandLine"
                       }
                     ],
                     "entityType": "Process"
@@ -4295,16 +4295,16 @@
                   "alertDynamicProperties": []
                 },
                 "incidentConfiguration": {
+                  "createIncident": false,
                   "groupingConfiguration": {
+                    "lookbackDuration": "PT5H",
+                    "matchingMethod": "Selected",
+                    "enabled": false,
                     "groupByEntities": [
                       "Account"
                     ],
-                    "lookbackDuration": "PT5H",
-                    "matchingMethod": "Selected",
-                    "reopenClosedIncident": false,
-                    "enabled": false
-                  },
-                  "createIncident": false
+                    "reopenClosedIncident": false
+                  }
                 }
               }
             },
@@ -4408,16 +4408,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -4516,16 +4516,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "Dvc"
+                        "columnName": "Dvc",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -4629,16 +4629,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -4742,16 +4742,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -4855,16 +4855,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -4968,16 +4968,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5083,16 +5083,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5196,16 +5196,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5315,16 +5315,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5332,8 +5332,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "LocalIP"
+                        "columnName": "LocalIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -5341,8 +5341,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "RemoteIP"
+                        "columnName": "RemoteIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -5350,8 +5350,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "RemoteUrl"
+                        "columnName": "RemoteUrl",
+                        "identifier": "Url"
                       }
                     ],
                     "entityType": "URL"
@@ -5461,16 +5461,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5478,8 +5478,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "LocalIP"
+                        "columnName": "LocalIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -5487,8 +5487,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "RemoteIP"
+                        "columnName": "RemoteIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -5496,8 +5496,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Url",
-                        "columnName": "RemoteUrl"
+                        "columnName": "RemoteUrl",
+                        "identifier": "Url"
                       }
                     ],
                     "entityType": "URL"
@@ -5606,16 +5606,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5723,16 +5723,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5740,12 +5740,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
+                        "columnName": "ProcessId",
+                        "identifier": "ProcessId"
                       },
                       {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
+                        "columnName": "ProcessCommandLine",
+                        "identifier": "CommandLine"
                       }
                     ],
                     "entityType": "Process"
@@ -5853,16 +5853,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5870,12 +5870,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
+                        "columnName": "ProcessId",
+                        "identifier": "ProcessId"
                       },
                       {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
+                        "columnName": "ProcessCommandLine",
+                        "identifier": "CommandLine"
                       }
                     ],
                     "entityType": "Process"
@@ -5982,16 +5982,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -5999,16 +5999,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "AccountUpn"
+                        "columnName": "AccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "AccountDomain"
+                        "columnName": "AccountDomain",
+                        "identifier": "DnsDomain"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       }
                     ],
                     "entityType": "Account"
@@ -6113,16 +6113,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -6130,12 +6130,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "FileName"
+                        "columnName": "FileName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "Directory",
-                        "columnName": "FolderPath"
+                        "columnName": "FolderPath",
+                        "identifier": "Directory"
                       }
                     ],
                     "entityType": "File"
@@ -6143,12 +6143,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Algorithm",
-                        "columnName": "FileHashAlgorithm"
+                        "columnName": "FileHashAlgorithm",
+                        "identifier": "Algorithm"
                       },
                       {
-                        "identifier": "Value",
-                        "columnName": "SHA256"
+                        "columnName": "SHA256",
+                        "identifier": "Value"
                       }
                     ],
                     "entityType": "FileHash"
@@ -6252,16 +6252,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -6269,12 +6269,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "RegistryValueName"
+                        "columnName": "RegistryValueName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "Value",
-                        "columnName": "RegistryValueData"
+                        "columnName": "RegistryValueData",
+                        "identifier": "Value"
                       }
                     ],
                     "entityType": "RegistryValue"
@@ -6385,8 +6385,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "AadUserId",
-                        "columnName": "UserId"
+                        "columnName": "UserId",
+                        "identifier": "AadUserId"
                       }
                     ],
                     "entityType": "Account"
@@ -6394,12 +6394,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Name",
-                        "columnName": "Name"
+                        "columnName": "Name",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "NTDomain",
-                        "columnName": "NTDomain"
+                        "columnName": "NTDomain",
+                        "identifier": "NTDomain"
                       }
                     ],
                     "entityType": "Account"
@@ -6407,8 +6407,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "AppId",
-                        "columnName": "ApplicationId"
+                        "columnName": "ApplicationId",
+                        "identifier": "AppId"
                       }
                     ],
                     "entityType": "CloudApplication"
@@ -6515,16 +6515,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -6629,16 +6629,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -6646,16 +6646,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "AccountDomain"
+                        "columnName": "AccountDomain",
+                        "identifier": "DnsDomain"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       }
                     ],
                     "entityType": "Account"
@@ -6759,16 +6759,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -6776,12 +6776,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
+                        "columnName": "ProcessId",
+                        "identifier": "ProcessId"
                       },
                       {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
+                        "columnName": "ProcessCommandLine",
+                        "identifier": "CommandLine"
                       }
                     ],
                     "entityType": "Process"
@@ -6886,16 +6886,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -6903,16 +6903,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "UserAdded"
+                        "columnName": "UserAdded",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "NTDomain",
-                        "columnName": "laccountdomain"
+                        "columnName": "laccountdomain",
+                        "identifier": "NTDomain"
                       }
                     ],
                     "entityType": "Account"
@@ -7023,16 +7023,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -7040,12 +7040,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "ServiceProcessID"
+                        "columnName": "ServiceProcessID",
+                        "identifier": "ProcessId"
                       },
                       {
-                        "identifier": "CommandLine",
-                        "columnName": "ServiceProcessCmdline"
+                        "columnName": "ServiceProcessCmdline",
+                        "identifier": "CommandLine"
                       }
                     ],
                     "entityType": "Process"
@@ -7149,16 +7149,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -7166,16 +7166,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "AccountUpn"
+                        "columnName": "AccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "NTDomain",
-                        "columnName": "AccountDomain"
+                        "columnName": "AccountDomain",
+                        "identifier": "NTDomain"
                       }
                     ],
                     "entityType": "Account"
@@ -7183,12 +7183,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
+                        "columnName": "ProcessId",
+                        "identifier": "ProcessId"
                       },
                       {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
+                        "columnName": "ProcessCommandLine",
+                        "identifier": "CommandLine"
                       }
                     ],
                     "entityType": "Process"
@@ -7292,16 +7292,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -7405,16 +7405,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -7422,12 +7422,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
+                        "columnName": "ProcessId",
+                        "identifier": "ProcessId"
                       },
                       {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
+                        "columnName": "ProcessCommandLine",
+                        "identifier": "CommandLine"
                       }
                     ],
                     "entityType": "Process"
@@ -7531,16 +7531,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -7644,16 +7644,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -7765,16 +7765,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -7782,16 +7782,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "AccountFullName"
+                        "columnName": "AccountFullName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "AccountDomain"
+                        "columnName": "AccountDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Account"
@@ -7799,8 +7799,8 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "Address",
-                        "columnName": "RemoteIP"
+                        "columnName": "RemoteIP",
+                        "identifier": "Address"
                       }
                     ],
                     "entityType": "IP"
@@ -7908,16 +7908,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -8021,16 +8021,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "DeviceName"
+                        "columnName": "DeviceName",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "HostName",
-                        "columnName": "HostName"
+                        "columnName": "HostName",
+                        "identifier": "HostName"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "DnsDomain"
+                        "columnName": "DnsDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Host"
@@ -8038,16 +8038,16 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "FullName",
-                        "columnName": "AccountUpn"
+                        "columnName": "AccountUpn",
+                        "identifier": "FullName"
                       },
                       {
-                        "identifier": "Name",
-                        "columnName": "AccountName"
+                        "columnName": "AccountName",
+                        "identifier": "Name"
                       },
                       {
-                        "identifier": "DnsDomain",
-                        "columnName": "AccountDomain"
+                        "columnName": "AccountDomain",
+                        "identifier": "DnsDomain"
                       }
                     ],
                     "entityType": "Account"
@@ -8055,12 +8055,12 @@
                   {
                     "fieldMappings": [
                       {
-                        "identifier": "ProcessId",
-                        "columnName": "ProcessId"
+                        "columnName": "ProcessId",
+                        "identifier": "ProcessId"
                       },
                       {
-                        "identifier": "CommandLine",
-                        "columnName": "ProcessCommandLine"
+                        "columnName": "ProcessCommandLine",
+                        "identifier": "CommandLine"
                       }
                     ],
                     "entityType": "Process"
@@ -75411,6 +75411,19 @@
         }
       },
       "condition": "[parameters('DeployDefenderWorkbook')]"
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "pid-0a2d9bd8-6f34-4f6f-ae30-d476bd8647f2-partnercenter",
+      "properties": {
+        "mode": "Incremental",
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "resources": []
+        }
+      }
     }
   ],
   "outputs": {}
diff --git a/Solutions/Microsoft Defender XDR/SolutionMetadata.json b/Solutions/Microsoft Defender XDR/SolutionMetadata.json
index 97645c1ef11..dfd105b845c 100644
--- a/Solutions/Microsoft Defender XDR/SolutionMetadata.json	
+++ b/Solutions/Microsoft Defender XDR/SolutionMetadata.json	
@@ -1,6 +1,7 @@
 {
   "publisherId": "azuresentinel",
   "offerId": "azure-sentinel-solution-microsoft365defender",
+  "trackingId": "pid-0a2d9bd8-6f34-4f6f-ae30-d476bd8647f2-partnercenter",
   "firstPublishDate": "2022-05-02",
   "providers": [
     "Microsoft"